@cat-factory/cli 0.2.1

package/dist/env.d.ts

@@ -0,0 +1,38 @@
+import { type ContainerRuntime } from './templates.js';
+import { type VcsProvider } from './vcs.js';
+/** One line of an `.env` file: a key/value pair with an optional leading comment block. */
+export interface EnvEntry {
+    key: string;
+    value: string;
+    /** Comment lines rendered (each prefixed with `# `) immediately above the entry. */
+    comment?: string[];
+}
+/**
+ * Render a list of {@link EnvEntry} into `.env` file text. Comments are emitted above their
+ * entry; entries are separated by a blank line for readability. The output always ends with a
+ * trailing newline.
+ */
+export declare function renderEnvFile(entries: EnvEntry[]): string;
+/** Inputs that flow into the local-backend `.env`. */
+export interface LocalEnvInput {
+    databaseUrl: string;
+    authSessionSecret: string;
+    encryptionKey: string;
+    harnessImage: string;
+    port: number;
+    corsAllowedOrigins: string;
+    provider: VcsProvider;
+    /** Container runtime that spawns agent jobs (`LOCAL_CONTAINER_RUNTIME`). */
+    containerRuntime: ContainerRuntime;
+    /** The pasted PAT, or empty/undefined to leave the var present-but-blank. */
+    token?: string;
+}
+/** Build the local-mode backend `.env` (`@cat-factory/local-server`). */
+export declare function buildLocalEnv(input: LocalEnvInput): string;
+/** Inputs that flow into the frontend `.env`. */
+export interface FrontendEnvInput {
+    apiBase: string;
+}
+/** Build the frontend SPA `.env` (`@cat-factory/app` consumer). */
+export declare function buildFrontendEnv(input: FrontendEnvInput): string;
+//# sourceMappingURL=env.d.ts.map

package/dist/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC1E,OAAO,EAA4B,KAAK,WAAW,EAAE,MAAM,UAAU,CAAA;AAErE,2FAA2F;AAC3F,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAMzD;AAED,sDAAsD;AACtD,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,kBAAkB,EAAE,MAAM,CAAA;IAC1B,QAAQ,EAAE,WAAW,CAAA;IACrB,4EAA4E;IAC5E,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CA8E1D;AA6CD,iDAAiD;AACjD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAWhE"}

package/dist/env.js

@@ -0,0 +1,150 @@
+import { CONTAINER_RUNTIMES } from './templates.js';
+import { patEnvVar, providerLabel } from './vcs.js';
+/**
+ * Render a list of {@link EnvEntry} into `.env` file text. Comments are emitted above their
+ * entry; entries are separated by a blank line for readability. The output always ends with a
+ * trailing newline.
+ */
+export function renderEnvFile(entries) {
+    const blocks = entries.map((entry) => {
+        const comment = (entry.comment ?? []).map((line) => `# ${line}`);
+        return [...comment, `${entry.key}=${entry.value}`].join('\n');
+    });
+    return `${blocks.join('\n\n')}\n`;
+}
+/** Build the local-mode backend `.env` (`@cat-factory/local-server`). */
+export function buildLocalEnv(input) {
+    const tokenVar = patEnvVar(input.provider);
+    const label = providerLabel(input.provider);
+    const entries = [
+        {
+            comment: [
+                'Local-mode backend (@cat-factory/local-server). Generated by `cat-factory init`.',
+                'This file is gitignored — it holds secrets. Keep the generated values STABLE.',
+                'Postgres connection string (matches the bundled docker-compose.yml).',
+            ],
+            key: 'DATABASE_URL',
+            value: input.databaseUrl,
+        },
+        {
+            comment: ['HTTP listen port for the backend API.'],
+            key: 'PORT',
+            value: String(input.port),
+        },
+        {
+            comment: ["Allowed CORS origin(s) — the frontend SPA's dev origin."],
+            key: 'CORS_ALLOWED_ORIGINS',
+            value: input.corsAllowedOrigins,
+        },
+        {
+            comment: [
+                'Signs the session JWT (>= 32 chars). Regenerating forces a re-login — keep it stable.',
+            ],
+            key: 'AUTH_SESSION_SECRET',
+            value: input.authSessionSecret,
+        },
+        {
+            comment: [
+                'Master key sealing every credential at rest (base64, >= 32 decoded bytes).',
+                'Regenerating ORPHANS every encrypted credential — keep it stable.',
+            ],
+            key: 'ENCRYPTION_KEY',
+            value: input.encryptionKey,
+        },
+        {
+            comment: [
+                `${label} personal access token. Agent containers clone/push/open PRs with it.`,
+                'Minted by the CLI with the right scopes pre-selected; paste-replace to rotate.',
+            ],
+            key: tokenVar,
+            value: input.token ?? '',
+        },
+        {
+            comment: [
+                'The executor-harness image agent jobs run as per-run containers.',
+                'Pull it first: docker pull ghcr.io/kibertoad/cat-factory-executor:latest',
+            ],
+            key: 'LOCAL_HARNESS_IMAGE',
+            value: input.harnessImage,
+        },
+        {
+            comment: [`Container runtime used to spawn agent jobs: ${CONTAINER_RUNTIMES.join(' | ')}.`],
+            key: 'LOCAL_CONTAINER_RUNTIME',
+            value: input.containerRuntime,
+        },
+        ...reachabilityEntries(input.containerRuntime),
+        {
+            comment: [
+                'At least one model provider must be configured or no model is selectable.',
+                'Cloudflare Workers AI over REST is the simplest: set both, then uncomment.',
+                'See the README for minting a token + finding your account id.',
+            ],
+            key: '# CLOUDFLARE_ACCOUNT_ID',
+            value: '',
+        },
+        { key: '# CLOUDFLARE_API_TOKEN', value: '' },
+        {
+            comment: ['Or a direct vendor key (combinable with the above):'],
+            key: '# ANTHROPIC_API_KEY',
+            value: '',
+        },
+        { key: '# OPENAI_API_KEY', value: '' },
+    ];
+    return renderEnvFile(entries);
+}
+/**
+ * Container→host reachability + security hints, commented out (sensible defaults apply). Agent
+ * job containers reach this service's LLM proxy over the network, and how they address the host
+ * differs per runtime — surfacing the knobs here (rather than only in the upstream docs) means a
+ * developer who hits "proxy unreachable from the container" has the fix in the file they already
+ * have open. Mirrors the relevant slice of `deploy/local/.env.example`.
+ */
+function reachabilityEntries(runtime) {
+    const entries = [
+        {
+            comment: [
+                'Container -> host reachability (defaults apply; uncomment only if the agent container',
+                "can't reach this service's LLM proxy). The harness reaches the host at a per-runtime",
+                'alias: host.docker.internal (docker/podman/orbstack), host.lima.internal (colima), the',
+                'vmnet gateway (apple). On Colima/Apple this is often unreachable — set it to your LAN IP.',
+            ],
+            key: '# LOCAL_HARNESS_HOST_ALIAS',
+            value: '',
+        },
+    ];
+    if (runtime === 'docker' || runtime === 'podman') {
+        entries.push({
+            comment: [
+                'Native Linux Docker only: add --add-host=<alias>:host-gateway so the container can',
+                'resolve the host (needed on Linux; harmless on Docker Desktop/OrbStack).',
+            ],
+            key: '# LOCAL_DOCKER_ADD_HOST_GATEWAY',
+            value: 'true',
+        });
+    }
+    entries.push({
+        comment: [
+            'SECURITY: with the dev gate open the server binds all interfaces so job containers can',
+            'reach the proxy. To lock it down, bind to loopback (works on Docker Desktop; NOT native',
+            'Linux Docker, where containers need the bridge gateway) or close the gate.',
+            'HOST=127.0.0.1',
+        ],
+        key: '# AUTH_DEV_OPEN',
+        value: 'false',
+    });
+    return entries;
+}
+/** Build the frontend SPA `.env` (`@cat-factory/app` consumer). */
+export function buildFrontendEnv(input) {
+    return renderEnvFile([
+        {
+            comment: [
+                'Frontend SPA (extends @cat-factory/app). Generated by `cat-factory init`.',
+                'Base URL of the backend API. Baked in at build time (the SPA is ssr: false).',
+            ],
+            key: 'NUXT_PUBLIC_API_BASE',
+            value: input.apiBase,
+        },
+    ]);
+}
+//# sourceMappingURL=env.js.map

package/dist/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAyB,MAAM,gBAAgB,CAAA;AAC1E,OAAO,EAAE,SAAS,EAAE,aAAa,EAAoB,MAAM,UAAU,CAAA;AAUrE;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAmB;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACnC,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;QAChE,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IACF,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAA;AACnC,CAAC;AAiBD,yEAAyE;AACzE,MAAM,UAAU,aAAa,CAAC,KAAoB;IAChD,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC3C,MAAM,OAAO,GAAe;QAC1B;YACE,OAAO,EAAE;gBACP,kFAAkF;gBAClF,+EAA+E;gBAC/E,sEAAsE;aACvE;YACD,GAAG,EAAE,cAAc;YACnB,KAAK,EAAE,KAAK,CAAC,WAAW;SACzB;QACD;YACE,OAAO,EAAE,CAAC,uCAAuC,CAAC;YAClD,GAAG,EAAE,MAAM;YACX,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B;QACD;YACE,OAAO,EAAE,CAAC,yDAAyD,CAAC;YACpE,GAAG,EAAE,sBAAsB;YAC3B,KAAK,EAAE,KAAK,CAAC,kBAAkB;SAChC;QACD;YACE,OAAO,EAAE;gBACP,uFAAuF;aACxF;YACD,GAAG,EAAE,qBAAqB;YAC1B,KAAK,EAAE,KAAK,CAAC,iBAAiB;SAC/B;QACD;YACE,OAAO,EAAE;gBACP,4EAA4E;gBAC5E,mEAAmE;aACpE;YACD,GAAG,EAAE,gBAAgB;YACrB,KAAK,EAAE,KAAK,CAAC,aAAa;SAC3B;QACD;YACE,OAAO,EAAE;gBACP,GAAG,KAAK,uEAAuE;gBAC/E,gFAAgF;aACjF;YACD,GAAG,EAAE,QAAQ;YACb,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;SACzB;QACD;YACE,OAAO,EAAE;gBACP,kEAAkE;gBAClE,0EAA0E;aAC3E;YACD,GAAG,EAAE,qBAAqB;YAC1B,KAAK,EAAE,KAAK,CAAC,YAAY;SAC1B;QACD;YACE,OAAO,EAAE,CAAC,+CAA+C,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YAC3F,GAAG,EAAE,yBAAyB;YAC9B,KAAK,EAAE,KAAK,CAAC,gBAAgB;SAC9B;QACD,GAAG,mBAAmB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAC9C;YACE,OAAO,EAAE;gBACP,2EAA2E;gBAC3E,4EAA4E;gBAC5E,+DAA+D;aAChE;YACD,GAAG,EAAE,yBAAyB;YAC9B,KAAK,EAAE,EAAE;SACV;QACD,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,EAAE,EAAE;QAC5C;YACE,OAAO,EAAE,CAAC,qDAAqD,CAAC;YAChE,GAAG,EAAE,qBAAqB;YAC1B,KAAK,EAAE,EAAE;SACV;QACD,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,EAAE;KACvC,CAAA;IACD,OAAO,aAAa,CAAC,OAAO,CAAC,CAAA;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,OAAyB;IACpD,MAAM,OAAO,GAAe;QAC1B;YACE,OAAO,EAAE;gBACP,uFAAuF;gBACvF,sFAAsF;gBACtF,wFAAwF;gBACxF,2FAA2F;aAC5F;YACD,GAAG,EAAE,4BAA4B;YACjC,KAAK,EAAE,EAAE;SACV;KACF,CAAA;IACD,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC;YACX,OAAO,EAAE;gBACP,oFAAoF;gBACpF,0EAA0E;aAC3E;YACD,GAAG,EAAE,iCAAiC;YACtC,KAAK,EAAE,MAAM;SACd,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,CAAC;QACX,OAAO,EAAE;YACP,wFAAwF;YACxF,yFAAyF;YACzF,4EAA4E;YAC5E,gBAAgB;SACjB;QACD,GAAG,EAAE,iBAAiB;QACtB,KAAK,EAAE,OAAO;KACf,CAAC,CAAA;IACF,OAAO,OAAO,CAAA;AAChB,CAAC;AAOD,mEAAmE;AACnE,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IACtD,OAAO,aAAa,CAAC;QACnB;YACE,OAAO,EAAE;gBACP,2EAA2E;gBAC3E,8EAA8E;aAC/E;YACD,GAAG,EAAE,sBAAsB;YAC3B,KAAK,EAAE,KAAK,CAAC,OAAO;SACrB;KACF,CAAC,CAAA;AACJ,CAAC"}

package/dist/gitignore.d.ts

@@ -0,0 +1,15 @@
+/** The ignore rules every scaffolded project needs. `.env` secrets first — that's the point. */
+export declare const REQUIRED_GITIGNORE_RULES: readonly string[];
+/**
+ * Produce the `.gitignore` content for a freshly scaffolded project. A leading header documents
+ * the source; rules follow one per line.
+ */
+export declare function buildGitignore(): string;
+/**
+ * Merge the {@link REQUIRED_GITIGNORE_RULES} into an EXISTING `.gitignore`, appending only the
+ * rules that aren't already present (compared after trimming, ignoring blank/comment lines). The
+ * existing content is preserved verbatim; a documented block of the missing rules is appended.
+ * Returns the original unchanged when nothing is missing.
+ */
+export declare function mergeGitignore(existing: string): string;
+//# sourceMappingURL=gitignore.d.ts.map

package/dist/gitignore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitignore.d.ts","sourceRoot":"","sources":["../src/gitignore.ts"],"names":[],"mappings":"AAKA,gGAAgG;AAChG,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAcrD,CAAA;AAID;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAYvD"}

package/dist/gitignore.js

@@ -0,0 +1,46 @@
+// `.gitignore` management for the scaffolded project. The whole point of writing secrets into
+// `.env` is that they must NEVER be committed, so the CLI guarantees the ignore rules are in
+// place — creating a `.gitignore` when there is none, or merging the required rules into an
+// existing one (e.g. when scaffolding into a directory that is already a git repo).
+/** The ignore rules every scaffolded project needs. `.env` secrets first — that's the point. */
+export const REQUIRED_GITIGNORE_RULES = [
+    // Secrets — the reason this file exists.
+    '.env',
+    '.env.*',
+    '!.env.example',
+    // Dependencies + build output.
+    'node_modules/',
+    'dist/',
+    '*.tsbuildinfo',
+    // Nuxt build / generate output.
+    '.nuxt',
+    '.output',
+    // Local Postgres data / captured artifacts.
+    '.file-storage/',
+];
+const HEADER = '# cat-factory (added by `cat-factory init`)';
+/**
+ * Produce the `.gitignore` content for a freshly scaffolded project. A leading header documents
+ * the source; rules follow one per line.
+ */
+export function buildGitignore() {
+    return `${HEADER}\n${REQUIRED_GITIGNORE_RULES.join('\n')}\n`;
+}
+/**
+ * Merge the {@link REQUIRED_GITIGNORE_RULES} into an EXISTING `.gitignore`, appending only the
+ * rules that aren't already present (compared after trimming, ignoring blank/comment lines). The
+ * existing content is preserved verbatim; a documented block of the missing rules is appended.
+ * Returns the original unchanged when nothing is missing.
+ */
+export function mergeGitignore(existing) {
+    const present = new Set(existing
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0 && !line.startsWith('#')));
+    const missing = REQUIRED_GITIGNORE_RULES.filter((rule) => !present.has(rule));
+    if (missing.length === 0)
+        return existing;
+    const prefix = existing.endsWith('\n') || existing.length === 0 ? existing : `${existing}\n`;
+    return `${prefix}\n${HEADER}\n${missing.join('\n')}\n`;
+}
+//# sourceMappingURL=gitignore.js.map

package/dist/gitignore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitignore.js","sourceRoot":"","sources":["../src/gitignore.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,6FAA6F;AAC7F,4FAA4F;AAC5F,oFAAoF;AAEpF,gGAAgG;AAChG,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,yCAAyC;IACzC,MAAM;IACN,QAAQ;IACR,eAAe;IACf,+BAA+B;IAC/B,eAAe;IACf,OAAO;IACP,eAAe;IACf,gCAAgC;IAChC,OAAO;IACP,SAAS;IACT,4CAA4C;IAC5C,gBAAgB;CACjB,CAAA;AAED,MAAM,MAAM,GAAG,6CAA6C,CAAA;AAE5D;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,GAAG,MAAM,KAAK,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAA;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,QAAQ;SACL,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAC9D,CAAA;IACD,MAAM,OAAO,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IAEzC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,CAAA;IAC5F,OAAO,GAAG,MAAM,KAAK,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAA;AACxD,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export { type CliOptions, HELP_TEXT, OPTION_DEFAULTS, parseArgs, ArgError } from './args.js';
+export { bootstrap, type BootstrapDeps, type FileSystem, BootstrapError } from './bootstrap.js';
+export { buildFrontendEnv, buildLocalEnv, type EnvEntry, type FrontendEnvInput, type LocalEnvInput, renderEnvFile, } from './env.js';
+export { buildGitignore, mergeGitignore, REQUIRED_GITIGNORE_RULES } from './gitignore.js';
+export { type Io, createConsoleIo } from './io.js';
+export { type BootstrapInput, buildPlan, type PlannedFile } from './plan.js';
+export { generateSecrets, type GeneratedSecrets, type RandomBytes } from './secrets.js';
+export { slugifyProjectName } from './slug.js';
+export { CONTAINER_RUNTIMES, type ContainerRuntime, DEFAULT_HARNESS_IMAGE } from './templates.js';
+export { githubPatCreationUrl, gitlabPatCreationUrl, patCreationUrl, patEnvVar, providerLabel, VCS_PROVIDERS, type VcsProvider, } from './vcs.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAC5F,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/F,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,aAAa,GACd,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AACzF,OAAO,EAAE,KAAK,EAAE,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,KAAK,cAAc,EAAE,SAAS,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAA;AAC5E,OAAO,EAAE,eAAe,EAAE,KAAK,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAA;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACjG,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,SAAS,EACT,aAAa,EACb,aAAa,EACb,KAAK,WAAW,GACjB,MAAM,UAAU,CAAA"}

package/dist/index.js

@@ -0,0 +1,13 @@
+// Public, programmatic API of @cat-factory/cli. The `cat-factory` command (bin.ts) is a thin
+// shell over these; they are also exported so the bootstrap can be embedded in other tooling.
+export { HELP_TEXT, OPTION_DEFAULTS, parseArgs, ArgError } from './args.js';
+export { bootstrap, BootstrapError } from './bootstrap.js';
+export { buildFrontendEnv, buildLocalEnv, renderEnvFile, } from './env.js';
+export { buildGitignore, mergeGitignore, REQUIRED_GITIGNORE_RULES } from './gitignore.js';
+export { createConsoleIo } from './io.js';
+export { buildPlan } from './plan.js';
+export { generateSecrets } from './secrets.js';
+export { slugifyProjectName } from './slug.js';
+export { CONTAINER_RUNTIMES, DEFAULT_HARNESS_IMAGE } from './templates.js';
+export { githubPatCreationUrl, gitlabPatCreationUrl, patCreationUrl, patEnvVar, providerLabel, VCS_PROVIDERS, } from './vcs.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,8FAA8F;AAC9F,OAAO,EAAmB,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAC5F,OAAO,EAAE,SAAS,EAAuC,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/F,OAAO,EACL,gBAAgB,EAChB,aAAa,EAIb,aAAa,GACd,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AACzF,OAAO,EAAW,eAAe,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAuB,SAAS,EAAoB,MAAM,WAAW,CAAA;AAC5E,OAAO,EAAE,eAAe,EAA2C,MAAM,cAAc,CAAA;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAyB,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACjG,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,SAAS,EACT,aAAa,EACb,aAAa,GAEd,MAAM,UAAU,CAAA"}

package/dist/io.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Terminal I/O seam. The orchestrator depends on this interface (never on `@clack/prompts` or
+ * `process` directly), so the whole interactive flow can be driven by a fake in tests. The real
+ * implementation ({@link createConsoleIo}) is clack-backed; tests inject their own.
+ */
+export interface Io {
+    info(message: string): void;
+    warn(message: string): void;
+    /** Free-text prompt with an optional default (used when the reply is empty). */
+    question(prompt: string, defaultValue?: string): Promise<string>;
+    /** A single-choice menu; returns the chosen option's value. */
+    select<T extends string>(prompt: string, options: readonly {
+        value: T;
+        label: string;
+    }[], defaultValue: T): Promise<T>;
+    /** Like {@link question} but does not echo the typed characters (for secrets/tokens). */
+    secret(prompt: string): Promise<string>;
+    /** Yes/no prompt. */
+    confirm(prompt: string, defaultValue: boolean): Promise<boolean>;
+    /** Open a URL in the user's default browser (best-effort; resolves even if it can't). */
+    openBrowser(url: string): Promise<void>;
+}
+/** The real, console-backed {@link Io}, implemented with `@clack/prompts`. */
+export declare function createConsoleIo(): Io;
+//# sourceMappingURL=io.d.ts.map

package/dist/io.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"io.d.ts","sourceRoot":"","sources":["../src/io.ts"],"names":[],"mappings":"AAYA;;;;GAIG;AACH,MAAM,WAAW,EAAE;IACjB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAChE,+DAA+D;IAC/D,MAAM,CAAC,CAAC,SAAS,MAAM,EACrB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,SAAS;QAAE,KAAK,EAAE,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,EAC/C,YAAY,EAAE,CAAC,GACd,OAAO,CAAC,CAAC,CAAC,CAAA;IACb,yFAAyF;IACzF,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACvC,qBAAqB;IACrB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAChE,yFAAyF;IACzF,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACxC;AAwBD,8EAA8E;AAC9E,wBAAgB,eAAe,IAAI,EAAE,CAwDpC"}

package/dist/io.js

@@ -0,0 +1,74 @@
+import { spawn } from 'node:child_process';
+import { cancel, confirm as clackConfirm, isCancel, log, password, select as clackSelect, text, } from '@clack/prompts';
+/** The OS-appropriate command for opening a URL in the default browser. */
+function openCommand(url) {
+    switch (process.platform) {
+        case 'darwin':
+            return { cmd: 'open', args: [url] };
+        case 'win32':
+            // `start` is a cmd builtin; the empty "" is the window title arg it requires.
+            return { cmd: 'cmd', args: ['/c', 'start', '', url] };
+        default:
+            return { cmd: 'xdg-open', args: [url] };
+    }
+}
+/** A clack prompt resolved to a cancel symbol (Ctrl-C / Esc): print a notice and exit cleanly. */
+function bailIfCancelled(value) {
+    if (isCancel(value)) {
+        cancel('Cancelled.');
+        process.exit(130);
+    }
+    return value;
+}
+/** The real, console-backed {@link Io}, implemented with `@clack/prompts`. */
+export function createConsoleIo() {
+    return {
+        info(message) {
+            // Callers pad messages with leading/trailing newlines for plain-console spacing; clack adds
+            // its own, so strip the padding to avoid empty bar lines.
+            log.message(message.replace(/^\n+|\n+$/g, ''));
+        },
+        warn(message) {
+            log.warn(message.replace(/^\n+|\n+$/g, ''));
+        },
+        async question(prompt, defaultValue) {
+            const value = bailIfCancelled(await text({ message: prompt, placeholder: defaultValue, defaultValue }));
+            const trimmed = (value ?? '').trim();
+            return trimmed.length > 0 ? trimmed : (defaultValue ?? '');
+        },
+        async select(prompt, options, defaultValue) {
+            // clack's `Option<Value>` is a conditional type TS can't match against our concrete
+            // `{ value, label }` while `Value` is still the generic `T`; the shapes are identical for
+            // string values, so cast the option list to satisfy it.
+            const value = bailIfCancelled(await clackSelect({
+                message: prompt,
+                options: [...options],
+                initialValue: defaultValue,
+            }));
+            return value;
+        },
+        async secret(prompt) {
+            // clack's password input masks the typed characters — no readline poking needed.
+            const value = bailIfCancelled(await password({ message: prompt }));
+            return (value ?? '').trim();
+        },
+        async confirm(prompt, defaultValue) {
+            return bailIfCancelled(await clackConfirm({ message: prompt, initialValue: defaultValue }));
+        },
+        openBrowser(url) {
+            return new Promise((resolve) => {
+                try {
+                    const { cmd, args } = openCommand(url);
+                    const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
+                    child.on('error', () => resolve());
+                    child.unref();
+                    resolve();
+                }
+                catch {
+                    resolve();
+                }
+            });
+        },
+    };
+}
+//# sourceMappingURL=io.js.map

package/dist/io.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"io.js","sourceRoot":"","sources":["../src/io.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EACL,MAAM,EACN,OAAO,IAAI,YAAY,EACvB,QAAQ,EACR,GAAG,EAEH,QAAQ,EACR,MAAM,IAAI,WAAW,EACrB,IAAI,GACL,MAAM,gBAAgB,CAAA;AA0BvB,2EAA2E;AAC3E,SAAS,WAAW,CAAC,GAAW;IAC9B,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,QAAQ;YACX,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAA;QACrC,KAAK,OAAO;YACV,8EAA8E;YAC9E,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,CAAA;QACvD;YACE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAA;IAC3C,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,SAAS,eAAe,CAAI,KAAiB;IAC3C,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,CAAC,YAAY,CAAC,CAAA;QACpB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnB,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,IAAI,CAAC,OAAO;YACV,4FAA4F;YAC5F,0DAA0D;YAC1D,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAA;QAChD,CAAC;QACD,IAAI,CAAC,OAAO;YACV,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAA;QAC7C,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY;YACjC,MAAM,KAAK,GAAG,eAAe,CAC3B,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CACzE,CAAA;YACD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YACpC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAA;QAC5D,CAAC;QACD,KAAK,CAAC,MAAM,CACV,MAAc,EACd,OAA+C,EAC/C,YAAe;YAEf,oFAAoF;YACpF,0FAA0F;YAC1F,wDAAwD;YACxD,MAAM,KAAK,GAAG,eAAe,CAC3B,MAAM,WAAW,CAAI;gBACnB,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE,CAAC,GAAG,OAAO,CAAgB;gBACpC,YAAY,EAAE,YAAY;aAC3B,CAAC,CACH,CAAA;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,iFAAiF;YACjF,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;YAClE,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QAC7B,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY;YAChC,OAAO,eAAe,CAAC,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC,CAAA;QAC7F,CAAC;QACD,WAAW,CAAC,GAAG;YACb,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBACnC,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;oBACtC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;oBACnE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;oBAClC,KAAK,CAAC,KAAK,EAAE,CAAA;oBACb,OAAO,EAAE,CAAA;gBACX,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,CAAA;gBACX,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/plan.d.ts

@@ -0,0 +1,29 @@
+import type { ContainerRuntime } from './templates.js';
+import { type VcsProvider } from './vcs.js';
+/** A single file the CLI will write, as a path relative to the project root + its content. */
+export interface PlannedFile {
+    path: string;
+    content: string;
+    /** True when the file holds secrets (it must always be gitignored, never overwritten blindly). */
+    secret?: boolean;
+}
+/** Everything the orchestrator needs to render the full project. Fully resolved (no prompting). */
+export interface BootstrapInput {
+    projectName: string;
+    appTitle: string;
+    provider: VcsProvider;
+    token: string;
+    databaseUrl: string;
+    apiBase: string;
+    port: number;
+    corsAllowedOrigins: string;
+    harnessImage: string;
+    containerRuntime: ContainerRuntime;
+    authSessionSecret: string;
+    encryptionKey: string;
+    /** Existing root `.gitignore` content, if the target dir already has one (rules are merged in). */
+    existingGitignore?: string;
+}
+/** The complete, ordered set of files for a scaffolded project. Pure — fully testable. */
+export declare function buildPlan(input: BootstrapInput): PlannedFile[];
+//# sourceMappingURL=plan.d.ts.map

package/dist/plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../src/plan.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,EAA4C,KAAK,WAAW,EAAE,MAAM,UAAU,CAAA;AAErF,8FAA8F;AAC9F,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,kGAAkG;IAClG,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,mGAAmG;AACnG,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,WAAW,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,kBAAkB,EAAE,MAAM,CAAA;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,iBAAiB,EAAE,MAAM,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,mGAAmG;IACnG,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,0FAA0F;AAC1F,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,WAAW,EAAE,CA8C9D"}

package/dist/plan.js

@@ -0,0 +1,144 @@
+import { buildFrontendEnv, buildLocalEnv } from './env.js';
+import { buildGitignore, mergeGitignore } from './gitignore.js';
+import { dockerCompose, frontendEnvExample, frontendNuxtConfig, frontendPackageJson, frontendWranglerToml, localEnvExample, localMainTs, localPackageJson, tsconfigJson, } from './templates.js';
+import { patCreationUrl, patEnvVar, providerLabel } from './vcs.js';
+/** The complete, ordered set of files for a scaffolded project. Pure — fully testable. */
+export function buildPlan(input) {
+    const localEnv = buildLocalEnv({
+        databaseUrl: input.databaseUrl,
+        authSessionSecret: input.authSessionSecret,
+        encryptionKey: input.encryptionKey,
+        harnessImage: input.harnessImage,
+        port: input.port,
+        corsAllowedOrigins: input.corsAllowedOrigins,
+        provider: input.provider,
+        containerRuntime: input.containerRuntime,
+        token: input.token,
+    });
+    const frontendEnv = buildFrontendEnv({ apiBase: input.apiBase });
+    const gitignore = input.existingGitignore !== undefined
+        ? mergeGitignore(input.existingGitignore)
+        : buildGitignore();
+    return [
+        { path: '.gitignore', content: gitignore },
+        { path: 'README.md', content: projectReadme(input) },
+        // Local-mode backend.
+        { path: 'local/package.json', content: localPackageJson(input.projectName) },
+        { path: 'local/src/main.ts', content: localMainTs },
+        { path: 'local/docker-compose.yml', content: dockerCompose(input.databaseUrl) },
+        { path: 'local/tsconfig.json', content: tsconfigJson },
+        {
+            path: 'local/.env.example',
+            content: localEnvExample({
+                provider: input.provider,
+                containerRuntime: input.containerRuntime,
+                databaseUrl: input.databaseUrl,
+                port: input.port,
+                harnessImage: input.harnessImage,
+            }),
+        },
+        { path: 'local/.env', content: localEnv, secret: true },
+        // Frontend SPA.
+        { path: 'frontend/package.json', content: frontendPackageJson(input.projectName) },
+        { path: 'frontend/nuxt.config.ts', content: frontendNuxtConfig(input.appTitle) },
+        { path: 'frontend/wrangler.toml', content: frontendWranglerToml(input.projectName) },
+        { path: 'frontend/.env.example', content: frontendEnvExample(input.apiBase) },
+        { path: 'frontend/.env', content: frontendEnv, secret: true },
+    ];
+}
+/**
+ * The bundled `npm run db:up` shells `docker compose` (matching `deploy/local`). Docker, OrbStack
+ * and Colima all provide a `docker` CLI so it works as-is; Podman and Apple `container` don't, so
+ * warn and point at the alternative for the chosen runtime.
+ */
+function dbUpRuntimeNote(runtime) {
+    if (runtime === 'podman') {
+        return `
+> **Podman note:** \`npm run db:up\` runs \`docker compose\`. If you don't have the Docker CLI,
+> bring Postgres up with \`podman compose up -d postgres\` (or \`podman-compose\`) instead, or
+> point a \`docker\`-compatible shim at the Podman socket.
+`;
+    }
+    if (runtime === 'apple') {
+        return `
+> **Apple \`container\` note:** there is no \`docker compose\`, so \`npm run db:up\` won't work.
+> Run Postgres another way (e.g. Docker Desktop/OrbStack just for the DB, or a native Postgres)
+> and point \`DATABASE_URL\` at it. Only the agent job containers use Apple \`container\`.
+`;
+    }
+    return '';
+}
+function projectReadme(input) {
+    const label = providerLabel(input.provider);
+    const tokenVar = patEnvVar(input.provider);
+    return `# ${input.appTitle}
+
+A local-mode deployment of [cat-factory](https://github.com/kibertoad/cat-factory), scaffolded
+with \`cat-factory init\`. It has two parts:
+
+- **\`local/\`** — the backend (\`@cat-factory/local-server\`): the shared Hono app with
+  Drizzle/Postgres + pg-boss, agent jobs run as per-run local containers, and ${label} reached
+  via a personal access token.
+- **\`frontend/\`** — the board SPA (extends the \`@cat-factory/app\` Nuxt layer).
+
+> The \`.env\` files hold generated secrets (\`AUTH_SESSION_SECRET\`, \`ENCRYPTION_KEY\`) and your
+> ${label} token (\`${tokenVar}\`). They are gitignored — **keep the values stable and never
+> commit them.** Regenerating \`AUTH_SESSION_SECRET\` forces a re-login; regenerating
+> \`ENCRYPTION_KEY\` orphans every encrypted credential.
+
+## Prerequisites
+
+- Node.js 24+ (the backend entry runs TypeScript via type stripping).
+- A container runtime (Docker/Podman/OrbStack/Colima) for Postgres and the agent containers.
+- The executor-harness image pulled locally:
+  \`\`\`sh
+  docker pull ${input.harnessImage}
+  \`\`\`
+
+## Install
+
+\`\`\`sh
+cd local && npm install && cd ../frontend && npm install && cd ..
+\`\`\`
+
+## Run the backend
+
+\`\`\`sh
+cd local
+npm run db:up      # start local Postgres (docker compose)
+npm start          # migrate + serve the API on :${input.port}
+\`\`\`
+${dbUpRuntimeNote(input.containerRuntime)}
+At least one **model provider** must be configured or no model is selectable. The simplest is
+Cloudflare Workers AI over REST — set \`CLOUDFLARE_ACCOUNT_ID\` + \`CLOUDFLARE_API_TOKEN\` in
+\`local/.env\` (or a direct vendor key like \`ANTHROPIC_API_KEY\`), then restart.
+
+## Run the frontend
+
+\`\`\`sh
+cd frontend
+npm run dev        # Nuxt dev server on http://localhost:3000
+\`\`\`
+
+Open http://localhost:3000. \`NUXT_PUBLIC_API_BASE\` (in \`frontend/.env\`) points at
+\`${input.apiBase}\`.
+
+## Rotating the ${label} token
+
+The token in \`local/.env\` (\`${tokenVar}\`) was minted at this URL with the right scopes
+pre-selected:
+
+    ${patCreationUrl(input.provider)}
+
+To rotate it, create a new token there and paste-replace the value, then restart the backend.
+
+## Linking a target repo
+
+Agent steps resolve which repo to operate on from a projection seeded from the PAT. With
+\`${tokenVar}\` set, the board's "Add from existing repo" button lists the repos the token can
+access — pick one to create a service frame linked to that repo. See the
+[local-mode docs](https://github.com/kibertoad/cat-factory/blob/main/deploy/local/README.md)
+for the CLI \`link:repo\` alternative and the full container-runtime matrix.
+`;
+}
+//# sourceMappingURL=plan.js.map

package/dist/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../src/plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC1D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,YAAY,GACb,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,aAAa,EAAoB,MAAM,UAAU,CAAA;AA4BrF,0FAA0F;AAC1F,MAAM,UAAU,SAAS,CAAC,KAAqB;IAC7C,MAAM,QAAQ,GAAG,aAAa,CAAC;QAC7B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAA;IACF,MAAM,WAAW,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IAChE,MAAM,SAAS,GACb,KAAK,CAAC,iBAAiB,KAAK,SAAS;QACnC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,iBAAiB,CAAC;QACzC,CAAC,CAAC,cAAc,EAAE,CAAA;IAEtB,OAAO;QACL,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE;QAC1C,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE;QAEpD,sBAAsB;QACtB,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;QAC5E,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,WAAW,EAAE;QACnD,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;QAC/E,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,YAAY,EAAE;QACtD;YACE,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,eAAe,CAAC;gBACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC;SACH;QACD,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE;QAEvD,gBAAgB;QAChB,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;QAClF,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;QAChF,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;QACpF,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;QAC7E,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE;KAC9D,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,OAAyB;IAChD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO;;;;CAIV,CAAA;IACC,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO;;;;CAIV,CAAA;IACC,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED,SAAS,aAAa,CAAC,KAAqB;IAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC3C,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC1C,OAAO,KAAK,KAAK,CAAC,QAAQ;;;;;;gFAMoD,KAAK;;;;;IAKjF,KAAK,aAAa,QAAQ;;;;;;;;;;gBAUd,KAAK,CAAC,YAAY;;;;;;;;;;;;;;mDAciB,KAAK,CAAC,IAAI;;EAE3D,eAAe,CAAC,KAAK,CAAC,gBAAgB,CAAC;;;;;;;;;;;;;IAarC,KAAK,CAAC,OAAO;;kBAEC,KAAK;;iCAEU,QAAQ;;;MAGnC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC;;;;;;;IAOhC,QAAQ;;;;CAIX,CAAA;AACD,CAAC"}

package/dist/secrets.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The two mandatory crypto secrets a cat-factory deployment needs, in the EXACT formats
+ * the server's config loader expects:
+ *
+ * - `authSessionSecret` — signs the session JWT. The loader requires `>= 32` characters;
+ *   we emit 32 random bytes as **hex** (64 chars), matching `deploy/local`'s
+ *   `generate-secrets.mjs`.
+ * - `encryptionKey` — the master key that seals every integration credential at rest.
+ *   The cipher requires valid **base64 of at least 32 decoded bytes** (a non-base64 value
+ *   like `dummy` fails the cipher at boot with `InvalidCharacterError`); we emit 32 random
+ *   bytes as base64.
+ *
+ * Both MUST stay STABLE once chosen: regenerating `authSessionSecret` forces a re-login and
+ * regenerating `encryptionKey` orphans every encrypted-at-rest credential. The CLI generates
+ * them once at scaffold time and writes them into `.env` so the developer keeps the values.
+ */
+export interface GeneratedSecrets {
+    authSessionSecret: string;
+    encryptionKey: string;
+}
+/** Injectable RNG seam so the generator is deterministic in tests. */
+export type RandomBytes = (size: number) => Buffer;
+/** Generate a fresh {@link GeneratedSecrets} pair in the server's required formats. */
+export declare function generateSecrets(randomBytes?: RandomBytes): GeneratedSecrets;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iBAAiB,EAAE,MAAM,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,sEAAsE;AACtE,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;AAElD,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,WAAW,GAAE,WAA6B,GAAG,gBAAgB,CAK5F"}