@calo-design/cli 0.1.0

package/README.md

@@ -0,0 +1,53 @@
+# @calo-design/cli — one-line Calo design setup
+
+A tiny **installer** (not a runtime). It logs you in with your Calo email, sets up the
+[`calo-design`](https://github.com/Calo-Design/calo-design) Claude Code skill and the
+design-system packages, then gets out of the way — the Claude Code agent is the
+runtime, the skill is the guidance.
+
+**No GitHub account, PAT, or SSH key needed.** Access is gated by your `@calo.app`
+email via the Calo broker, which mints a short-lived GitHub token at install time.
+
+## Use
+
+```bash
+npx @calo-design/cli login          # one-time: enter your Calo email + the emailed code
+npx @calo-design/cli init           # skill + @calo/design-system + @calo/flows + RN peers
+```
+
+Then start a new Claude Code session and ask for a screen
+(e.g. *"build a Calo-native meal-swap screen"*).
+
+```bash
+npx @calo-design/cli init --skip-packages   # skill only
+npx @calo-design/cli update                 # re-install latest skill + re-pin the shared runtime
+npx @calo-design/cli logout                 # forget the saved session
+```
+
+The login session is stored at `~/.designchef/session.json` (chmod 600) and refreshes
+automatically. Override the broker with `CALO_BROKER_URL` (used for local dev).
+
+Fonts ship with `@calo/design-system`. Load them in your root layout:
+
+```tsx
+import { useFonts } from "expo-font";
+import { caloFonts } from "@calo/design-system";
+const [fontsLoaded] = useFonts(caloFonts);
+```
+
+## How access works
+
+```
+npx @calo-design/cli login → broker verifies @calo.app + emails OTP → session JWT (~/.designchef)
+npx @calo-design/cli init  → broker mints a 1h read-only GitHub token → private npm installs
+```
+
+The broker (`../calo-broker`) is the only place the GitHub / Expo / Tigris secrets
+live. See its README for the one-time provisioning checklist.
+
+## Tests
+
+```bash
+# with a dev broker running (cd ../calo-broker && npm run dev):
+BASE=http://localhost:8080 bash test/client-spine.sh
+```

package/bin/cli.js

@@ -0,0 +1,470 @@
+#!/usr/bin/env node
+"use strict";
+
+/**
+ * calo-design — one-time setup (NOT a runtime).
+ * Installs (1) the calo-design Claude Code skill into ~/.claude/skills, and
+ * (2) the Calo prototyping stack (@calo/design-system + @calo/flows + RN peers)
+ * ONCE into a shared runtime at ~/.designchef/runtime. Each prototype is a thin
+ * Expo project whose node_modules is a symlink to that shared runtime, so there is
+ * one copy on disk and `calo-design update` refreshes every prototype at once.
+ * The Claude Code agent is the runtime; the skill is the guidance.
+ */
+
+const { spawnSync } = require("node:child_process");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const { cmdPush } = require("./mirror-push");
+const { cmdLogin, cmdLogout, ensureLoggedIn, githubToken } = require("./login");
+
+const ORG = "Calo-Design";
+const SKILL_REPO = `${ORG}/calo-design`;
+const PEERS = [
+  "react-native-svg",
+  "phosphor-react-native",
+  "@gorhom/bottom-sheet",
+  "react-native-safe-area-context",
+  "react-native-gesture-handler",
+  "react-native-reanimated",
+  "react-native-worklets",
+  // The Mirror loads each prototype as an EAS Update at runtime; prototypes need
+  // the expo-updates JS API (the "back to Mirror" chrome `push` injects calls it).
+  // The shell binary provides the native module; prototypes ship JS only.
+  "expo-updates"
+];
+// Install via explicit HTTPS git URLs. Auth is a short-lived GitHub token the Calo
+// broker mints after `calo-design login` — injected into git for the install
+// subprocess only (see gitTokenEnv). No GitHub account, PAT, or SSH key needed.
+const PKG_SPECS = [
+  `git+https://github.com/${ORG}/calo-design-system.git`,
+  `git+https://github.com/${ORG}/calo-flows.git`
+];
+
+const args = process.argv.slice(2);
+const cmd = args[0] || "help";
+const has = (flag) => args.includes(flag);
+
+const c = { dim: (s) => `\x1b[2m${s}\x1b[0m`, b: (s) => `\x1b[1m${s}\x1b[0m`, g: (s) => `\x1b[32m${s}\x1b[0m`, y: (s) => `\x1b[33m${s}\x1b[0m` };
+const log = (s = "") => console.log(s);
+const ok = (s) => log(`${c.g("✓")} ${s}`);
+const warn = (s) => log(`${c.y("!")} ${s}`);
+const tilde = (p) => p.replace(os.homedir(), "~");
+
+function run(bin, argv, opts = {}) {
+  const r = spawnSync(bin, argv, { stdio: "inherit", ...opts });
+  if (r.error) throw r.error;
+  if (typeof r.status === "number" && r.status !== 0) throw new Error(`${bin} ${argv.join(" ")} exited ${r.status}`);
+  return r;
+}
+function sleep(sec) {
+  try { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, sec * 1000); } catch {}
+}
+// Private-repo git fetches over https are occasionally flaky (credential-helper
+// races / rate limits) and recover on retry. Retry before giving up.
+function runWithRetry(bin, argv, tries = 3, opts = {}) {
+  for (let i = 1; i <= tries; i++) {
+    const r = spawnSync(bin, argv, { stdio: "inherit", ...opts });
+    if (!r.error && r.status === 0) return r;
+    if (i < tries) { warn(`install hiccup — retrying (${i}/${tries - 1})…`); sleep(3); }
+  }
+  throw new Error(`${bin} ${argv.join(" ")} failed after ${tries} attempts`);
+}
+// Build an env that makes git authenticate github.com with a broker-minted token,
+// for the spawned subprocess ONLY. Uses git's GIT_CONFIG_* env override so nothing
+// is written to ~/.gitconfig and the token is never persisted to disk.
+function gitTokenEnv(token, base = process.env) {
+  // Append at the next free GIT_CONFIG index so we don't clobber any the caller set.
+  const n = parseInt(base.GIT_CONFIG_COUNT || "0", 10) || 0;
+  return {
+    ...base,
+    GIT_CONFIG_COUNT: String(n + 1),
+    [`GIT_CONFIG_KEY_${n}`]: `url.https://x-access-token:${token}@github.com/.insteadOf`,
+    [`GIT_CONFIG_VALUE_${n}`]: "https://github.com/",
+    GIT_TERMINAL_PROMPT: "0"
+  };
+}
+
+// ---------------------------------------------------------------- skill (global)
+
+async function cloneSkillRepo(tmp) {
+  // Authenticate the clone with a short-lived broker-minted GitHub token, injected
+  // into git for this subprocess only. No gh, PAT, or SSH key required.
+  const token = await githubToken();
+  run("git", ["clone", "--depth", "1", "-q", `https://github.com/${SKILL_REPO}.git`, tmp], { env: gitTokenEnv(token) });
+}
+
+async function installSkill() {
+  log(c.b("\n[skill] Installing the calo-design skill"));
+  const home = process.env.CALO_HOME || os.homedir();
+  const dest = path.join(home, ".claude", "skills", "calo-design");
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "calo-skill-"));
+  try {
+    await cloneSkillRepo(tmp);
+    const src = path.join(tmp, "skills", "calo-design");
+    if (!fs.existsSync(path.join(src, "SKILL.md"))) throw new Error("skill not found in repo");
+    fs.rmSync(dest, { recursive: true, force: true });
+    fs.mkdirSync(path.dirname(dest), { recursive: true });
+    fs.cpSync(src, dest, { recursive: true });
+    ok(`skill -> ${dest.replace(home, "~")}`);
+    log(c.dim("  Live in your current session (no restart) — invoke with /calo-design, or just ask."));
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+// ---------------------------------------------------------------- shared runtime
+
+function designchefHome() {
+  return process.env.DESIGNCHEF_HOME || path.join(os.homedir(), ".designchef");
+}
+function runtimeDir() { return path.join(designchefHome(), "runtime"); }
+function runtimeManifestPath() { return path.join(runtimeDir(), ".calo-runtime.json"); }
+function runtimeExists() {
+  const rt = runtimeDir();
+  return (
+    fs.existsSync(runtimeManifestPath()) &&
+    fs.existsSync(path.join(rt, "node_modules", "@calo", "design-system", "package.json")) &&
+    fs.existsSync(path.join(rt, "node_modules", "@calo", "flows", "package.json")) &&
+    fs.existsSync(path.join(rt, "node_modules", "expo", "package.json"))
+  );
+}
+
+async function ensureRuntime({ force } = {}) {
+  const rt = runtimeDir();
+  if (!force && runtimeExists()) { ok(`shared runtime ready (${tilde(rt)})`); return; }
+  log(c.b("\n[runtime] Building the shared Calo runtime (one-time, ~a couple of minutes)"));
+  fs.mkdirSync(rt, { recursive: true });
+  if (force) {
+    fs.rmSync(path.join(rt, "node_modules"), { recursive: true, force: true });
+    try { fs.rmSync(runtimeManifestPath()); } catch {}
+  }
+  if (!fs.existsSync(path.join(rt, "package.json"))) {
+    if (!scaffoldExpoApp(rt)) throw new Error("runtime scaffold failed");
+  }
+  await installCaloDeps(rt);
+  fs.writeFileSync(
+    runtimeManifestPath(),
+    JSON.stringify({ builtAt: new Date().toISOString(), pkgSpecs: PKG_SPECS, peers: PEERS }, null, 2) + "\n"
+  );
+  ok(`shared runtime built -> ${tilde(rt)}`);
+}
+
+// ---------------------------------------------------------------- shared helpers
+
+function isExpoProject(cwd = process.cwd()) {
+  try {
+    const pj = JSON.parse(fs.readFileSync(path.join(cwd, "package.json"), "utf8"));
+    return Boolean((pj.dependencies && pj.dependencies.expo) || (pj.devDependencies && pj.devDependencies.expo));
+  } catch {
+    return false;
+  }
+}
+function hasPackageJson(cwd = process.cwd()) { return fs.existsSync(path.join(cwd, "package.json")); }
+function dirIsScaffoldable(cwd = process.cwd()) {
+  // Effectively empty: only junk (dotfiles, *.log, README/LICENSE, Thumbs.db) is here.
+  try {
+    const junk = /^\.|\.log$|^readme(\.|$)|^license(\.|$)|^thumbs\.db$/i;
+    return fs.readdirSync(cwd).every((e) => junk.test(e));
+  } catch {
+    return false;
+  }
+}
+
+function scaffoldExpoApp(destDir = process.cwd()) {
+  log(c.dim("  Scaffolding a fresh Expo app (expo-router + TypeScript)…"));
+  // create-expo-app refuses ANY non-empty target (even a stray firebase-debug.log),
+  // so scaffold into a temp dir, then merge files in without overwriting anything present.
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "calo-expo-"));
+  try {
+    run("npx", ["--yes", "create-expo-app@latest", tmp, "--yes", "--no-install", "--no-agents-md"]);
+    for (const entry of fs.readdirSync(tmp)) {
+      const dest = path.join(destDir, entry);
+      if (!fs.existsSync(dest)) fs.cpSync(path.join(tmp, entry), dest, { recursive: true });
+    }
+    ok("Expo app scaffolded");
+    return true;
+  } catch (e) {
+    warn(`couldn't scaffold automatically (${e.message})`);
+    return false;
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+// Install the Calo stack + peers into `cwd` (used for the shared runtime, and for
+// the per-project fallback / --isolated path). Forces HTTPS so private installs
+// don't fall back to SSH. Does not print a summary — callers do.
+async function installCaloDeps(cwd) {
+  // Private @calo/* installs authenticate with a short-lived broker-minted token,
+  // injected into git for the npm subprocess only (no gh / PAT / SSH key).
+  const env = gitTokenEnv(await githubToken());
+  runWithRetry("npm", ["install", ...PKG_SPECS], 3, { cwd, env });
+  if (isExpoProject(cwd)) run("npx", ["expo", "install", ...PEERS, "expo-font"], { cwd });
+  else {
+    warn("non-Expo project — installing latest peers; pin them to match your React Native version if needed.");
+    run("npm", ["install", ...PEERS], { cwd });
+  }
+}
+
+// Legacy per-project install (no shared runtime): scaffold here if needed, then install.
+async function installHere() {
+  log(c.b("\n[setup] Installing the Calo stack into this project"));
+  if (!hasPackageJson()) {
+    if (!dirIsScaffoldable()) {
+      warn("no package.json, and the folder isn't empty — run in an Expo project or an empty folder.");
+      return false;
+    }
+    if (!scaffoldExpoApp()) return false;
+  }
+  await installCaloDeps(process.cwd());
+  ok("packages + peers installed in this project");
+  return true;
+}
+
+// ---------------------------------------------------------------- thin project
+
+function projectName(projectRoot) {
+  return (path.basename(projectRoot).replace(/[^a-z0-9-]/gi, "-").toLowerCase()) || "calo-prototype";
+}
+
+function writeThinConfigs(projectRoot) {
+  const rt = runtimeDir();
+  const name = projectName(projectRoot);
+  // package.json copied from the runtime so versions match the symlinked node_modules
+  // (kills expo-doctor mismatch noise); just rename it.
+  const pjPath = path.join(projectRoot, "package.json");
+  if (!fs.existsSync(pjPath)) {
+    const pj = JSON.parse(fs.readFileSync(path.join(rt, "package.json"), "utf8"));
+    pj.name = name;
+    pj.private = true;
+    fs.writeFileSync(pjPath, JSON.stringify(pj, null, 2) + "\n");
+  }
+  // app.json copied + given a unique identity (scheme/slug must be unique to run alongside others)
+  const appPath = path.join(projectRoot, "app.json");
+  const rtApp = path.join(rt, "app.json");
+  if (!fs.existsSync(appPath) && fs.existsSync(rtApp)) {
+    const app = JSON.parse(fs.readFileSync(rtApp, "utf8"));
+    if (app.expo) { app.expo.name = name; app.expo.slug = name; app.expo.scheme = name.replace(/-/g, ""); }
+    fs.writeFileSync(appPath, JSON.stringify(app, null, 2) + "\n");
+  }
+  // tsconfig + babel (if the runtime has one) copied verbatim
+  for (const f of ["tsconfig.json", "babel.config.js"]) {
+    const dst = path.join(projectRoot, f);
+    const src = path.join(rt, f);
+    if (!fs.existsSync(dst) && fs.existsSync(src)) fs.cpSync(src, dst);
+  }
+  // assets (icon/splash referenced by app.json) so the app boots
+  const dstAssets = path.join(projectRoot, "assets");
+  const srcAssets = path.join(rt, "assets");
+  if (!fs.existsSync(dstAssets) && fs.existsSync(srcAssets)) fs.cpSync(srcAssets, dstAssets, { recursive: true });
+}
+
+function writeMetroConfig(projectRoot) {
+  const runtimeReal = fs.realpathSync(runtimeDir());
+  const content = `process.env.EXPO_NO_METRO_WORKSPACE_ROOT = "1";
+const path = require("node:path");
+const fs = require("node:fs");
+const { getDefaultConfig } = require("expo/metro-config");
+
+// This prototype's node_modules is a symlink to the shared Calo runtime. Expo's
+// default config does not watch a node_modules outside the project root, so point
+// Metro at the runtime explicitly. Managed by calo-design — safe to regenerate.
+const projectRoot = __dirname;
+const runtimeRoot = ${JSON.stringify(runtimeReal)};
+const config = getDefaultConfig(projectRoot);
+config.watchFolders = [...(config.watchFolders || []), runtimeRoot];
+config.resolver.nodeModulesPaths = [
+  path.resolve(projectRoot, "node_modules"),
+  path.resolve(runtimeRoot, "node_modules"),
+];
+let gorhomWeb;
+try {
+  gorhomWeb = require.resolve("@gorhom/bottom-sheet/lib/commonjs/index.js", { paths: [projectRoot, runtimeRoot] });
+} catch (e) {}
+if (gorhomWeb) {
+  const base = config.resolver.resolveRequest;
+  config.resolver.resolveRequest = (ctx, name, platform) =>
+    (base || ctx.resolveRequest)(ctx, platform === "web" && name === "@gorhom/bottom-sheet" ? gorhomWeb : name, platform);
+}
+module.exports = config;
+`;
+  fs.writeFileSync(path.join(projectRoot, "metro.config.js"), content);
+}
+
+function writeStarterApp(projectRoot) {
+  const appDir = path.join(projectRoot, "src", "app");
+  // Never clobber existing screens.
+  if (fs.existsSync(path.join(appDir, "index.tsx")) || fs.existsSync(path.join(projectRoot, "app", "index.tsx"))) return;
+  fs.mkdirSync(appDir, { recursive: true });
+  fs.writeFileSync(path.join(appDir, "_layout.tsx"), `import { Stack } from "expo-router";
+import { useFonts } from "expo-font";
+import { caloFonts } from "@calo/design-system";
+
+export default function Layout() {
+  const [loaded] = useFonts(caloFonts);
+  if (!loaded) return null;
+  return <Stack screenOptions={{ headerShown: false }} />;
+}
+`);
+  fs.writeFileSync(path.join(appDir, "index.tsx"), `import { CaloScreen, CaloText } from "@calo/design-system";
+
+export default function Index() {
+  return (
+    <CaloScreen title="Calo prototype">
+      <CaloText role="body">Ask Claude Code to build a Calo screen here.</CaloText>
+    </CaloScreen>
+  );
+}
+`);
+}
+
+function writeGitignore(projectRoot) {
+  const gi = path.join(projectRoot, ".gitignore");
+  const needed = ["node_modules/", ".expo/", "dist/", "*.log"];
+  let cur = "";
+  try { cur = fs.readFileSync(gi, "utf8"); } catch {}
+  const lines = cur.split(/\r?\n/);
+  const add = needed.filter((n) => !lines.includes(n));
+  if (add.length) fs.writeFileSync(gi, (cur && !cur.endsWith("\n") ? cur + "\n" : cur) + add.join("\n") + "\n");
+}
+
+function linkNodeModules(projectRoot) {
+  const target = fs.realpathSync(path.join(runtimeDir(), "node_modules"));
+  const link = path.join(projectRoot, "node_modules");
+  let st = null;
+  try { st = fs.lstatSync(link); } catch {}
+  if (st) {
+    if (st.isSymbolicLink()) fs.unlinkSync(link);            // replace a stale link
+    else throw new Error("a real node_modules already exists here");
+  }
+  // Windows: 'junction' works for dirs without admin/Developer Mode; 'dir' elsewhere.
+  fs.symlinkSync(target, link, process.platform === "win32" ? "junction" : "dir");
+}
+
+function linkProject(projectRoot) {
+  log(c.b("\n[link] Linking this prototype to the shared runtime"));
+  writeThinConfigs(projectRoot);
+  writeMetroConfig(projectRoot);
+  writeStarterApp(projectRoot);
+  writeGitignore(projectRoot);
+  linkNodeModules(projectRoot);
+  ok(`linked — node_modules -> ${tilde(path.join(runtimeDir(), "node_modules"))}`);
+}
+
+function isLinkedProject() {
+  try {
+    const link = path.join(process.cwd(), "node_modules");
+    if (!fs.lstatSync(link).isSymbolicLink()) return false;
+    return fs.realpathSync(link).startsWith(fs.realpathSync(runtimeDir()));
+  } catch {
+    return false;
+  }
+}
+function isExistingProject() {
+  const nm = path.join(process.cwd(), "node_modules");
+  try { if (fs.lstatSync(nm).isDirectory()) return true; } catch {}     // a real node_modules (lstat on a symlink isn't a dir)
+  return hasPackageJson() && isExpoProject() && !dirIsScaffoldable();
+}
+
+// ---------------------------------------------------------------- commands
+
+function nextSteps({ linked } = {}) {
+  log(c.b("\n✨ Done. In Claude Code — no restart needed:"));
+  log(`\n  ${c.b("1.")} Load the skill — type:`);
+  log(`       ${c.b(c.g("/calo-design"))}`);
+  log(`\n  ${c.b("2.")} Create a prototype — describe the screen, e.g.:`);
+  log(`       ${c.b(c.g("build a Calo-native meal-swap screen"))}`);
+  log(`\n  ${c.b("3.")} Preview — run ${c.dim("npx expo start")} (press w for web, or scan the QR in Expo Go).`);
+  if (linked) {
+    log(c.dim(`\n  This prototype shares one install at ${tilde(runtimeDir())} — \`calo-design update\` refreshes it for every prototype.`));
+    log(c.dim("  (expo-doctor may flag dependency versions on linked projects; that's expected and harmless.)"));
+  }
+  log(c.dim(`\n  Docs: https://github.com/${SKILL_REPO}`));
+}
+
+async function cmdInit() {
+  await ensureLoggedIn();
+  await installSkill();
+  if (has("--skip-packages")) return nextSteps({});
+  if (has("--isolated")) { await installHere(); return nextSteps({}); }
+
+  if (isLinkedProject()) {
+    // Re-running in an already-linked prototype: ensure runtime + refresh the link.
+    await ensureRuntime({ force: false });
+    linkProject(process.cwd());
+    return nextSteps({ linked: true });
+  }
+  if (isExistingProject()) {
+    warn("existing project detected — installing the Calo stack here (not linking), to avoid clobbering your node_modules.");
+    await installCaloDeps(process.cwd());
+    ok("packages + peers installed in this project");
+    return nextSteps({});
+  }
+  if (!dirIsScaffoldable()) {
+    warn("this folder isn't empty and isn't an Expo project.");
+    log(c.dim("  Run init in an empty folder to use the shared runtime, or `init --isolated` to install here."));
+    return;
+  }
+
+  // Fresh prototype folder → shared runtime + symlink, with graceful fallbacks.
+  try {
+    await ensureRuntime({ force: false });
+  } catch (e) {
+    warn(`couldn't build the shared runtime (${e.message}); falling back to a per-project install.`);
+    await installHere();
+    return nextSteps({});
+  }
+  try {
+    linkProject(process.cwd());
+  } catch (e) {
+    warn(`couldn't link to the shared runtime (${e.message}); falling back to a per-project install.`);
+    await installHere();
+    return nextSteps({});
+  }
+  nextSteps({ linked: true });
+}
+
+async function cmdUpdate() {
+  await ensureLoggedIn();
+  await installSkill();
+  ok("skill updated to latest");
+  if (runtimeExists() || has("--build")) {
+    await ensureRuntime({ force: true });
+    ok("shared runtime re-pinned — every linked prototype now uses the latest Calo stack");
+  } else {
+    log(c.dim("  No shared runtime yet — run `calo-design init` in a prototype folder to create one."));
+  }
+}
+
+function help() {
+  log(`${c.b("calo-design")} — one-line setup for Calo design tooling
+
+  ${c.b("npx @calo-design/cli login")}               log in with your Calo email (one-time; no GitHub account needed)
+  ${c.b("npx @calo-design/cli init")}                skill + a prototype linked to the shared runtime (empty folder, or an existing project)
+  ${c.dim("init --isolated")}                          install the Calo stack into THIS project (no shared runtime)
+  ${c.dim("init --skip-packages")}                      skill only
+  ${c.dim("update")}                                    refresh the skill + re-pin the shared runtime (all linked prototypes float to latest)
+  ${c.dim("logout")}                                    forget the saved Calo session
+  ${c.dim("push")}                                      publish THIS prototype to the Calo Mirror (eas update + registry)
+  ${c.dim("    push --slug x --title \"…\" --owner \"…\" --screenshot path  --dry-run")}
+
+  Login is required once before init; the session refreshes automatically.
+  Prototypes share one install at ${c.dim(tilde(runtimeDir()))} (override with DESIGNCHEF_HOME).
+`);
+}
+
+(async () => {
+  try {
+    if (cmd === "login") await cmdLogin(args.slice(1));
+    else if (cmd === "logout") cmdLogout();
+    else if (cmd === "init") await cmdInit();
+    else if (cmd === "update") await cmdUpdate();
+    else if (cmd === "push") await cmdPush(args.slice(1));
+    else help();
+  } catch (err) {
+    log(`\n\x1b[31m✗\x1b[0m ${err.message}`);
+    log(c.dim("  Stuck? Re-run `calo-design login`, then retry. Or check that the Calo broker is reachable."));
+    process.exit(1);
+  }
+})();

package/bin/login.js

@@ -0,0 +1,150 @@
+"use strict";
+
+/**
+ * `calo-design login` — email-OTP login against the Calo broker, and the helpers
+ * that turn a stored session into a short-lived GitHub token at install time.
+ *
+ * No GitHub account, no PAT, no SSH key. The session lives at
+ * ~/.designchef/session.json (chmod 600); the broker holds every real secret.
+ */
+
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const readline = require("node:readline");
+
+// Override for local dev with CALO_BROKER_URL=http://localhost:8080
+const BROKER = (process.env.CALO_BROKER_URL || "https://calo-broker.fly.dev").replace(/\/+$/, "");
+
+function home() {
+  return process.env.DESIGNCHEF_HOME || path.join(os.homedir(), ".designchef");
+}
+function sessionPath() {
+  return path.join(home(), "session.json");
+}
+function loadSession() {
+  try {
+    return JSON.parse(fs.readFileSync(sessionPath(), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function saveSession(s) {
+  fs.mkdirSync(home(), { recursive: true });
+  fs.writeFileSync(sessionPath(), JSON.stringify(s, null, 2) + "\n");
+  try {
+    fs.chmodSync(sessionPath(), 0o600);
+  } catch {}
+}
+function clearSession() {
+  try {
+    fs.rmSync(sessionPath());
+  } catch {}
+}
+
+async function api(pathname, body, token) {
+  let res;
+  try {
+    res = await fetch(BROKER + pathname, {
+      method: "POST",
+      headers: { "content-type": "application/json", ...(token ? { authorization: `Bearer ${token}` } : {}) },
+      body: JSON.stringify(body || {}),
+    });
+  } catch (e) {
+    throw new Error(`can't reach the Calo broker at ${BROKER} (${e.message})`);
+  }
+  const text = await res.text();
+  let json;
+  try {
+    json = text ? JSON.parse(text) : {};
+  } catch {
+    json = { raw: text };
+  }
+  if (!res.ok) throw new Error(json.error || `${pathname} → HTTP ${res.status}`);
+  return json;
+}
+
+function ask(question) {
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    rl.question(question, (a) => {
+      rl.close();
+      resolve(a.trim());
+    });
+  });
+}
+
+const flag = (args, name) => {
+  const hit = args.find((a) => a.startsWith(`--${name}=`));
+  return hit ? hit.split("=").slice(1).join("=") : undefined;
+};
+const nowSec = () => Math.floor(Date.now() / 1000);
+const expSec = (s) =>
+  typeof s.expiresAt === "number" ? s.expiresAt : Math.floor(new Date(s.expiresAt).getTime() / 1000);
+
+async function cmdLogin(args = []) {
+  // When driven by an agent (Claude Code) stdin isn't a TTY, so we can't prompt —
+  // we send the code and exit telling the agent the exact next command to run.
+  const interactive = Boolean(process.stdin.isTTY);
+  let email = flag(args, "email");
+  if (!email) {
+    if (!interactive) throw new Error("Pass --email=you@calo.app — a code will be emailed, then re-run with --code=<code>.");
+    email = await ask("Calo email: ");
+  }
+  let code = flag(args, "code");
+  if (!code) {
+    // Request a code. (Pass --code to skip the send, e.g. a code you already have.)
+    await api("/v1/login/start", { email });
+    if (!interactive) {
+      console.log(`Sent a 6-digit code to ${email}. Now run: npx @calo-design/cli login --email=${email} --code=<the 6-digit code>`);
+      return;
+    }
+    console.log(`We emailed a 6-digit code to ${email}.`);
+    code = await ask("Code: ");
+  }
+  const r = await api("/v1/login/verify", { email, code });
+  saveSession({ session: r.session, refresh: r.refresh, email: r.email, expiresAt: r.expiresAt });
+  console.log(`\x1b[32m✓\x1b[0m Logged in as ${r.email}`);
+}
+
+function cmdLogout() {
+  clearSession();
+  console.log("✓ Logged out");
+}
+
+// A valid (refreshed if needed) session JWT, or throws telling the user to log in.
+async function ensureSession() {
+  const s = loadSession();
+  if (!s || !s.session) throw new Error("Not logged in — run `calo-design login`.");
+  if (expSec(s) - 60 > nowSec()) return s.session;
+  if (!s.refresh) throw new Error("Session expired — run `calo-design login`.");
+  try {
+    const r = await api("/v1/session/refresh", { refresh: s.refresh });
+    saveSession({ ...s, session: r.session, expiresAt: r.expiresAt });
+    return r.session;
+  } catch {
+    throw new Error("Session expired — run `calo-design login`.");
+  }
+}
+
+// Logs in interactively if there's no usable session yet.
+async function ensureLoggedIn() {
+  const s = loadSession();
+  if (s && s.session) {
+    try {
+      await ensureSession();
+      return;
+    } catch {}
+  }
+  console.log("First, log in with your Calo email.");
+  await cmdLogin([]);
+}
+
+// Short-lived GitHub token for private installs (broker-minted).
+async function githubToken() {
+  const session = await ensureSession();
+  const r = await api("/v1/github-token", {}, session);
+  return r.token;
+}
+
+module.exports = { cmdLogin, cmdLogout, ensureSession, ensureLoggedIn, githubToken, BROKER, loadSession };