@cicore/cli 1.0.0

package/dist/lib/ops/ssh.d.ts

@@ -0,0 +1,127 @@
+/**
+ * CiCore CLI — SSH/SCP primitives
+ *
+ * Host-aware command execution. Every function takes a {@link HostConfig}
+ * and uses its `sshAlias`, `sshKeyPath`, and optional `deployUser` to build
+ * the SSH target — no global SSH state, no environment-based dispatch.
+ *
+ * All commands run through execa with `reject: false` so callers can branch
+ * on the typed `ExecResult` instead of catching exceptions. Streaming is
+ * supported for interactive long-running commands (deploys, compose up).
+ *
+ * Dry-run is honored: when `--dry-run` is set on the CLI, every primitive
+ * logs what it would do and returns a success result without touching the
+ * remote host.
+ */
+import type { HostConfig } from '../hosts.js';
+export interface ExecResult {
+    readonly stdout: string;
+    readonly stderr: string;
+    readonly exitCode: number;
+    readonly success: boolean;
+}
+export interface RunOptions {
+    /** Suppress the `▸ <cmd>` log line before execution. Result still returns. */
+    readonly silent?: boolean;
+    /**
+     * Stream stdout/stderr to the terminal in real time (inherits parent FDs).
+     * Resulting `stdout`/`stderr` strings will be empty — the output went to
+     * the screen instead of being captured. Use for long-running deploys.
+     */
+    readonly stream?: boolean;
+    /** Working directory for local commands. Ignored for remote. */
+    readonly cwd?: string;
+    /**
+     * stdin payload piped to the command. Useful for `bash -s` heredoc-style
+     * remote scripts: pass the script body as `input`, pass `bash -s` as the
+     * command. Avoids shell-quoting hazards in heredoc embedding.
+     */
+    readonly input?: string;
+    /**
+     * Environment variables overlaid on the inherited environment for the
+     * local command only — remote commands need to receive env via `VAR=val`
+     * prefix or `export` in the script body.
+     */
+    readonly env?: Readonly<Record<string, string>>;
+}
+export interface RemoteOptions extends RunOptions {
+    /**
+     * Connect as `cfg.deployUser` (the forced-command receiver) instead of
+     * `cfg.sshUser`. Only valid for hosts that have a deployUser configured —
+     * other hosts ignore this flag and fall back to sshUser. Use for addon /
+     * core install scripts that go through the wrapper.
+     */
+    readonly asDeployUser?: boolean;
+    /**
+     * Execute even when global dry-run is on. For salt-okunur (SELECT) komutlar:
+     * bir dry-run *planı* gerçek veriyi okuyabilmeli (validate/inventory/discovery).
+     * Yazı yollarında ASLA set edilmez — sadece dbSelectJson gibi read-only
+     * helper'lar geçer. Bkz docs/planning/2026-06-02-cli-dryrun-selfloop-fix.md (Part A).
+     */
+    readonly allowInDryRun?: boolean;
+}
+/**
+ * Run a command on the local machine.
+ *
+ * Arguments go through execa's argv-array path — no shell, no implicit
+ * expansion, no injection risk. If you need shell features (pipes, glob),
+ * invoke `bash -c "<script>"` explicitly with the script in `args`.
+ */
+export declare function runLocal(command: string, args?: readonly string[], opts?: RunOptions): Promise<ExecResult>;
+/**
+ * Run a single shell command on the host described by `cfg` via SSH.
+ *
+ * Connection target is built from `cfg.deployUser ?? <sshAlias's User>` and
+ * `cfg.sshAlias`. The identity file (`cfg.sshKeyPath`) is passed explicitly
+ * with `-i`, so even if `~/.ssh/config` selects a different key for the
+ * alias, we use the configured one. ConnectTimeout caps stalled connects
+ * at 10 seconds.
+ *
+ * `command` is sent as a single argument to the remote shell. Quote-aware
+ * callers should use {@link runRemoteScript} for multi-line scripts.
+ */
+export declare function runRemote(cfg: HostConfig, command: string, opts?: RemoteOptions): Promise<ExecResult>;
+/**
+ * Run a multi-line shell script on the remote host by piping it to `bash -s`.
+ *
+ * Avoids the quoting hazards of embedding scripts in a single `ssh "<script>"`
+ * argument: the script body goes through stdin, so quotes and `$` inside it
+ * mean what they look like.
+ *
+ * `env` is exported into the remote shell before the script runs. Keys are
+ * validated as `[A-Z_][A-Z0-9_]*` to prevent injection through env-name; values
+ * are single-quote-escaped.
+ */
+export declare function runRemoteScript(cfg: HostConfig, script: string, opts?: RemoteOptions & {
+    readonly env?: Readonly<Record<string, string>>;
+}): Promise<ExecResult>;
+/**
+ * Copy a local file or directory to the remote host via SCP.
+ *
+ * Uses `-O` (legacy SCP protocol) which is required by ssh-wrapper.sh
+ * forced-command pattern — the newer SFTP protocol skips the command guard.
+ * Recursive flag enables directory copy.
+ *
+ * `remotePath` is interpreted relative to the deploy user's home unless
+ * absolute. Callers should pass absolute paths to avoid surprises.
+ */
+export declare function uploadFile(cfg: HostConfig, localPath: string, remotePath: string, opts?: {
+    readonly recursive?: boolean;
+    readonly silent?: boolean;
+    readonly asDeployUser?: boolean;
+}): Promise<ExecResult>;
+/**
+ * Quick connectivity probe — runs `true` on the remote and reports success.
+ * Useful as a preflight step before a long deploy. Forced-command hosts
+ * (cicore-deploy@) reject arbitrary commands, so use {@link sshReachable}
+ * instead when targeting such hosts.
+ */
+export declare function sshAlive(cfg: HostConfig): Promise<boolean>;
+/**
+ * TCP-level reachability check for hosts whose SSH refuses arbitrary cmds.
+ * Returns true if `ssh -o BatchMode=yes -o ConnectTimeout=5 <target> exit`
+ * exits cleanly (auth + connection established, command rejected is fine).
+ * Probes the deploy-user path because that's where the wrapper sits.
+ */
+export declare function sshReachable(cfg: HostConfig): Promise<boolean>;
+//# sourceMappingURL=ssh.d.ts.map

package/dist/lib/ops/ssh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh.d.ts","sourceRoot":"","sources":["../../../src/lib/ops/ssh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAQ7C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAC1B;AAaD,MAAM,WAAW,UAAU;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,gEAAgE;IAChE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB;;;;OAIG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAChD;AAED,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAE/B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CACjC;AAMD;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAC5B,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,SAAS,MAAM,EAAO,EAC5B,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,UAAU,CAAC,CAerB;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,UAAU,CAAC,CAgBrB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,aAAa,GAAG;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAAO,GAC7E,OAAO,CAAC,UAAU,CAAC,CAmBrB;AAED;;;;;;;;;GASG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,UAAU,EACf,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GACtG,OAAO,CAAC,UAAU,CAAC,CAkBrB;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAKhE;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAQpE"}

package/dist/lib/ops/ssh.js

@@ -0,0 +1,269 @@
+/**
+ * CiCore CLI — SSH/SCP primitives
+ *
+ * Host-aware command execution. Every function takes a {@link HostConfig}
+ * and uses its `sshAlias`, `sshKeyPath`, and optional `deployUser` to build
+ * the SSH target — no global SSH state, no environment-based dispatch.
+ *
+ * All commands run through execa with `reject: false` so callers can branch
+ * on the typed `ExecResult` instead of catching exceptions. Streaming is
+ * supported for interactive long-running commands (deploys, compose up).
+ *
+ * Dry-run is honored: when `--dry-run` is set on the CLI, every primitive
+ * logs what it would do and returns a success result without touching the
+ * remote host.
+ */
+import { execa } from 'execa';
+import { homedir } from 'node:os';
+import { resolve as resolvePath } from 'node:path';
+import { isDryRun, isVerbose } from '../config.js';
+import { log } from '../logger.js';
+const DRY_RUN_OK = Object.freeze({
+    stdout: '',
+    stderr: '',
+    exitCode: 0,
+    success: true,
+});
+// ─────────────────────────────────────────────────────────────────────────
+// Local execution
+// ─────────────────────────────────────────────────────────────────────────
+/**
+ * Run a command on the local machine.
+ *
+ * Arguments go through execa's argv-array path — no shell, no implicit
+ * expansion, no injection risk. If you need shell features (pipes, glob),
+ * invoke `bash -c "<script>"` explicitly with the script in `args`.
+ */
+export async function runLocal(command, args = [], opts = {}) {
+    if (!opts.silent && !opts.stream) {
+        log.cmd(`${command} ${args.join(' ')}`);
+    }
+    if (isDryRun()) {
+        log.debug('[dry-run] local:', command, args.join(' '));
+        return DRY_RUN_OK;
+    }
+    return invokeExeca(command, args, {
+        cwd: opts.cwd,
+        input: opts.input,
+        env: opts.env,
+        streamOutput: opts.stream === true,
+    });
+}
+// ─────────────────────────────────────────────────────────────────────────
+// Remote execution (SSH)
+// ─────────────────────────────────────────────────────────────────────────
+/**
+ * Run a single shell command on the host described by `cfg` via SSH.
+ *
+ * Connection target is built from `cfg.deployUser ?? <sshAlias's User>` and
+ * `cfg.sshAlias`. The identity file (`cfg.sshKeyPath`) is passed explicitly
+ * with `-i`, so even if `~/.ssh/config` selects a different key for the
+ * alias, we use the configured one. ConnectTimeout caps stalled connects
+ * at 10 seconds.
+ *
+ * `command` is sent as a single argument to the remote shell. Quote-aware
+ * callers should use {@link runRemoteScript} for multi-line scripts.
+ */
+export async function runRemote(cfg, command, opts = {}) {
+    const target = sshTarget(cfg, opts.asDeployUser === true);
+    const sshArgs = buildSshArgs(cfg, target, [command]);
+    if (!opts.silent && !opts.stream) {
+        log.cmd(`ssh ${target} "${command}"`);
+    }
+    if (isDryRun() && opts.allowInDryRun !== true) {
+        log.debug('[dry-run] remote:', target, command);
+        return DRY_RUN_OK;
+    }
+    return invokeExeca('ssh', sshArgs, {
+        input: opts.input,
+        streamOutput: opts.stream === true,
+    });
+}
+/**
+ * Run a multi-line shell script on the remote host by piping it to `bash -s`.
+ *
+ * Avoids the quoting hazards of embedding scripts in a single `ssh "<script>"`
+ * argument: the script body goes through stdin, so quotes and `$` inside it
+ * mean what they look like.
+ *
+ * `env` is exported into the remote shell before the script runs. Keys are
+ * validated as `[A-Z_][A-Z0-9_]*` to prevent injection through env-name; values
+ * are single-quote-escaped.
+ */
+export async function runRemoteScript(cfg, script, opts = {}) {
+    const envPrefix = renderEnvExports(opts.env);
+    const body = envPrefix + script;
+    const target = sshTarget(cfg, opts.asDeployUser === true);
+    if (!opts.silent && !opts.stream) {
+        const preview = script.split('\n').slice(0, 3).join(' / ');
+        log.cmd(`ssh ${target} bash -s  # ${preview.slice(0, 80)}${preview.length > 80 ? '…' : ''}`);
+    }
+    if (isDryRun() && opts.allowInDryRun !== true) {
+        log.debug('[dry-run] remote script (', script.length, 'chars) on', target);
+        return DRY_RUN_OK;
+    }
+    const sshArgs = buildSshArgs(cfg, target, ['bash', '-s']);
+    return invokeExeca('ssh', sshArgs, {
+        input: body,
+        streamOutput: opts.stream === true,
+    });
+}
+/**
+ * Copy a local file or directory to the remote host via SCP.
+ *
+ * Uses `-O` (legacy SCP protocol) which is required by ssh-wrapper.sh
+ * forced-command pattern — the newer SFTP protocol skips the command guard.
+ * Recursive flag enables directory copy.
+ *
+ * `remotePath` is interpreted relative to the deploy user's home unless
+ * absolute. Callers should pass absolute paths to avoid surprises.
+ */
+export async function uploadFile(cfg, localPath, remotePath, opts = {}) {
+    const target = sshTarget(cfg, opts.asDeployUser === true);
+    const args = ['-O'];
+    if (opts.recursive)
+        args.push('-r');
+    args.push('-i', expandHome(cfg.sshKeyPath));
+    args.push('-o', 'ConnectTimeout=10');
+    args.push('-o', 'StrictHostKeyChecking=accept-new');
+    args.push(localPath, `${target}:${remotePath}`);
+    if (!opts.silent) {
+        log.cmd(`scp ${args.join(' ')}`);
+    }
+    if (isDryRun()) {
+        log.debug('[dry-run] upload:', localPath, '→', `${target}:${remotePath}`);
+        return DRY_RUN_OK;
+    }
+    return invokeExeca('scp', args, {});
+}
+/**
+ * Quick connectivity probe — runs `true` on the remote and reports success.
+ * Useful as a preflight step before a long deploy. Forced-command hosts
+ * (cicore-deploy@) reject arbitrary commands, so use {@link sshReachable}
+ * instead when targeting such hosts.
+ */
+export async function sshAlive(cfg) {
+    // Probes the normal sshUser path — that's the one orchestration relies on.
+    // For deploy-user reachability (forced-command wrapper), use sshReachable.
+    const result = await runRemote(cfg, 'true', { silent: true });
+    return result.success;
+}
+/**
+ * TCP-level reachability check for hosts whose SSH refuses arbitrary cmds.
+ * Returns true if `ssh -o BatchMode=yes -o ConnectTimeout=5 <target> exit`
+ * exits cleanly (auth + connection established, command rejected is fine).
+ * Probes the deploy-user path because that's where the wrapper sits.
+ */
+export async function sshReachable(cfg) {
+    const target = sshTarget(cfg, true /* deploy user */);
+    const args = buildSshArgs(cfg, target, ['exit'], { extraOpts: ['-o', 'BatchMode=yes'] });
+    const result = await invokeExeca('ssh', args, {});
+    // Exit code 0 = ssh OK + remote `exit` succeeded.
+    // Exit code 64 = forced-command wrapper rejected `exit` (still reachable).
+    // Any other code = real connectivity failure.
+    return result.exitCode === 0 || result.exitCode === 64;
+}
+// ─────────────────────────────────────────────────────────────────────────
+// Internal helpers
+// ─────────────────────────────────────────────────────────────────────────
+/**
+ * Build the `ssh <opts> <target> <cmd> [args...]` argv array for execa.
+ *
+ * Caller passes the resolved `target` so the same routine serves both
+ * the regular `sshUser@sshHostname` and the deploy-user variant.
+ *
+ * Always passes `-i <keyPath>` and `-o ConnectTimeout=10` /
+ * `-o StrictHostKeyChecking=accept-new` so the first connect to a new
+ * host (e.g. setup flow) doesn't hang on host-key prompts.
+ */
+function buildSshArgs(cfg, target, trailing, opts = {}) {
+    return [
+        '-i',
+        expandHome(cfg.sshKeyPath),
+        '-o',
+        'ConnectTimeout=10',
+        '-o',
+        'StrictHostKeyChecking=accept-new',
+        ...(opts.extraOpts ?? []),
+        target,
+        ...trailing,
+    ];
+}
+/**
+ * Build the `user@host` target for SSH/SCP.
+ *
+ * `asDeployUser` = true selects the forced-command receiver account
+ * (`cfg.deployUser@cfg.sshHostname`); used only by addon/core install
+ * primitives. Default (false) uses the normal sshUser. Hosts without a
+ * deployUser configured fall back to sshUser regardless of the flag.
+ */
+function sshTarget(cfg, asDeployUser) {
+    const user = asDeployUser && cfg.deployUser !== undefined ? cfg.deployUser : cfg.sshUser;
+    return `${user}@${cfg.sshHostname}`;
+}
+/** Expand a leading `~/` or bare `~` to the current user's home directory. */
+function expandHome(p) {
+    if (p === '~')
+        return homedir();
+    if (p.startsWith('~/'))
+        return resolvePath(homedir(), p.slice(2));
+    return p;
+}
+/** Validate env var name and single-quote-escape value for safe export. */
+function renderEnvExports(env) {
+    if (!env || Object.keys(env).length === 0)
+        return '';
+    const lines = [];
+    for (const [key, value] of Object.entries(env)) {
+        if (!/^[A-Z_][A-Z0-9_]*$/.test(key)) {
+            throw new Error(`Invalid env var name '${key}' — must match /^[A-Z_][A-Z0-9_]*$/`);
+        }
+        // Single-quote, replace embedded `'` with `'\''` — POSIX-safe quoting.
+        const escaped = value.replace(/'/g, `'\\''`);
+        lines.push(`export ${key}='${escaped}'`);
+    }
+    return lines.join('\n') + '\n';
+}
+/**
+ * Thin execa wrapper that returns a {@link ExecResult} for both success
+ * and failure, never throws. Verbose mode echoes stderr on non-zero exit.
+ */
+async function invokeExeca(file, args, opts) {
+    try {
+        const result = opts.streamOutput
+            ? await execa(file, args, {
+                cwd: opts.cwd,
+                input: opts.input,
+                env: opts.env,
+                shell: false,
+                reject: false,
+                stdout: 'inherit',
+                stderr: 'inherit',
+            })
+            : await execa(file, args, {
+                cwd: opts.cwd,
+                input: opts.input,
+                env: opts.env,
+                shell: false,
+                reject: false,
+            });
+        const stdout = opts.streamOutput ? '' : String(result.stdout ?? '');
+        const stderr = opts.streamOutput ? '' : String(result.stderr ?? '');
+        const exitCode = result.exitCode ?? 0;
+        const success = exitCode === 0;
+        if (!success && isVerbose() && stderr) {
+            log.debug('stderr:', stderr.trim());
+        }
+        return Object.freeze({ stdout, stderr, exitCode, success });
+    }
+    catch (error) {
+        const execaError = error;
+        return Object.freeze({
+            stdout: String(execaError.stdout ?? ''),
+            stderr: String(execaError.stderr ?? execaError.message ?? ''),
+            exitCode: typeof execaError.exitCode === 'number' ? execaError.exitCode : 1,
+            success: false,
+        });
+    }
+}
+//# sourceMappingURL=ssh.js.map

package/dist/lib/ops/ssh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh.js","sourceRoot":"","sources":["../../../src/lib/ops/ssh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,KAAK,EAAmB,MAAM,OAAO,CAAA;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAA;AAElD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAalC,MAAM,UAAU,GAAe,MAAM,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,QAAQ,EAAE,CAAC;IACX,OAAO,EAAE,IAAI;CACd,CAAC,CAAA;AAiDF,4EAA4E;AAC5E,kBAAkB;AAClB,4EAA4E;AAE5E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,OAAe,EACf,OAA0B,EAAE,EAC5B,OAAmB,EAAE;IAErB,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjC,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACzC,CAAC;IACD,IAAI,QAAQ,EAAE,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QACtD,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,OAAO,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE;QAChC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,YAAY,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI;KACnC,CAAC,CAAA;AACJ,CAAC;AAED,4EAA4E;AAC5E,yBAAyB;AACzB,4EAA4E;AAE5E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAe,EACf,OAAe,EACf,OAAsB,EAAE;IAExB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAA;IACzD,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAEpD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjC,GAAG,CAAC,GAAG,CAAC,OAAO,MAAM,KAAK,OAAO,GAAG,CAAC,CAAA;IACvC,CAAC;IACD,IAAI,QAAQ,EAAE,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QAC9C,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;QAC/C,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,OAAO,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE;QACjC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,YAAY,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI;KACnC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAe,EACf,MAAc,EACd,OAA4E,EAAE;IAE9E,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC5C,MAAM,IAAI,GAAG,SAAS,GAAG,MAAM,CAAA;IAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAA;IAEzD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,OAAO,MAAM,eAAe,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC9F,CAAC;IACD,IAAI,QAAQ,EAAE,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QAC9C,GAAG,CAAC,KAAK,CAAC,2BAA2B,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,CAAA;QAC1E,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;IACzD,OAAO,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE;QACjC,KAAK,EAAE,IAAI;QACX,YAAY,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI;KACnC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAe,EACf,SAAiB,EACjB,UAAkB,EAClB,OAAqG,EAAE;IAEvG,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAA;IACzD,MAAM,IAAI,GAAa,CAAC,IAAI,CAAC,CAAA;IAC7B,IAAI,IAAI,CAAC,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA;IAC3C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAA;IACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kCAAkC,CAAC,CAAA;IACnD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,MAAM,IAAI,UAAU,EAAE,CAAC,CAAA;IAE/C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAClC,CAAC;IACD,IAAI,QAAQ,EAAE,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,UAAU,EAAE,CAAC,CAAA;QACzE,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,OAAO,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAe;IAC5C,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7D,OAAO,MAAM,CAAC,OAAO,CAAA;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAe;IAChD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;IACrD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC,CAAA;IACxF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;IACjD,kDAAkD;IAClD,2EAA2E;IAC3E,8CAA8C;IAC9C,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,CAAA;AACxD,CAAC;AAED,4EAA4E;AAC5E,mBAAmB;AACnB,4EAA4E;AAE5E;;;;;;;;;GASG;AACH,SAAS,YAAY,CACnB,GAAe,EACf,MAAc,EACd,QAA2B,EAC3B,OAAmD,EAAE;IAErD,OAAO;QACL,IAAI;QACJ,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC;QAC1B,IAAI;QACJ,mBAAmB;QACnB,IAAI;QACJ,kCAAkC;QAClC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;QACzB,MAAM;QACN,GAAG,QAAQ;KACZ,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,SAAS,CAAC,GAAe,EAAE,YAAqB;IACvD,MAAM,IAAI,GAAG,YAAY,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAA;IACxF,OAAO,GAAG,IAAI,IAAI,GAAG,CAAC,WAAW,EAAE,CAAA;AACrC,CAAC;AAED,8EAA8E;AAC9E,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAA;IAC/B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACjE,OAAO,CAAC,CAAA;AACV,CAAC;AAED,2EAA2E;AAC3E,SAAS,gBAAgB,CAAC,GAAiD;IACzE,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACpD,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,qCAAqC,CAAC,CAAA;QACpF,CAAC;QACD,uEAAuE;QACvE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAC5C,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,KAAK,OAAO,GAAG,CAAC,CAAA;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;AAChC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CACxB,IAAY,EACZ,IAAuB,EACvB,IAKC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY;YAC9B,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE;gBACtB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,GAAG,EAAE,IAAI,CAAC,GAAoC;gBAC9C,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,SAAS;aAClB,CAAC;YACJ,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE;gBACtB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,GAAG,EAAE,IAAI,CAAC,GAAoC;gBAC9C,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,KAAK;aACd,CAAC,CAAA;QACN,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;QACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,QAAQ,KAAK,CAAC,CAAA;QAE9B,IAAI,CAAC,OAAO,IAAI,SAAS,EAAE,IAAI,MAAM,EAAE,CAAC;YACtC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;QACrC,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,KAAmB,CAAA;QACtC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC;YACvC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC;YAC7D,QAAQ,EAAE,OAAO,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3E,OAAO,EAAE,KAAK;SACf,CAAC,CAAA;IACJ,CAAC;AACH,CAAC"}

package/dist/lib/prompts.d.ts

@@ -0,0 +1,46 @@
+/**
+ * CiCore CLI Interactive Prompts
+ *
+ * Handles user input and confirmations
+ */
+/**
+ * Ask for text input
+ */
+export declare function input(message: string, defaultValue?: string): Promise<string>;
+/**
+ * Ask for confirmation (yes/no)
+ */
+export declare function confirm(message: string, defaultValue?: boolean): Promise<boolean>;
+/**
+ * Ask for selection from a list
+ */
+export declare function select<T extends string>(message: string, choices: Array<{
+    name: T;
+    message?: string;
+    hint?: string;
+}>): Promise<T>;
+/**
+ * Ask for multiple selections
+ */
+export declare function multiSelect<T extends string>(message: string, choices: Array<{
+    name: T;
+    message?: string;
+    hint?: string;
+}>): Promise<T[]>;
+/**
+ * Ask for password (hidden input)
+ */
+export declare function password(message: string): Promise<string>;
+/**
+ * Double confirmation for dangerous operations
+ */
+export declare function dangerConfirm(message: string, confirmText?: string): Promise<boolean>;
+/**
+ * Ask for core name selection
+ */
+export declare function selectCore(cores: string[]): Promise<string>;
+/**
+ * Ask for addon name selection
+ */
+export declare function selectAddon(addons: string[]): Promise<string>;
+//# sourceMappingURL=prompts.d.ts.map

package/dist/lib/prompts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../../src/lib/prompts.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH;;GAEG;AACH,wBAAsB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQnF;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,GAAE,OAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ9F;AAED;;GAEG;AACH,wBAAsB,MAAM,CAAC,CAAC,SAAS,MAAM,EAC3C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAC3D,OAAO,CAAC,CAAC,CAAC,CAYZ;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,CAAC,SAAS,MAAM,EAChD,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAC3D,OAAO,CAAC,CAAC,EAAE,CAAC,CAYd;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAO/D;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,WAAW,GAAE,MAAiB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAalB;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAUjE;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAUnE"}

package/dist/lib/prompts.js

@@ -0,0 +1,113 @@
+/**
+ * CiCore CLI Interactive Prompts
+ *
+ * Handles user input and confirmations
+ */
+import enquirer from 'enquirer';
+import chalk from 'chalk';
+const { prompt } = enquirer;
+/**
+ * Ask for text input
+ */
+export async function input(message, defaultValue) {
+    const response = await prompt({
+        type: 'input',
+        name: 'value',
+        message,
+        initial: defaultValue,
+    });
+    return response.value;
+}
+/**
+ * Ask for confirmation (yes/no)
+ */
+export async function confirm(message, defaultValue = false) {
+    const response = await prompt({
+        type: 'confirm',
+        name: 'value',
+        message,
+        initial: defaultValue,
+    });
+    return response.value;
+}
+/**
+ * Ask for selection from a list
+ */
+export async function select(message, choices) {
+    const response = await prompt({
+        type: 'select',
+        name: 'value',
+        message,
+        choices: choices.map(c => ({
+            name: c.name,
+            message: c.message || c.name,
+            hint: c.hint,
+        })),
+    });
+    return response.value;
+}
+/**
+ * Ask for multiple selections
+ */
+export async function multiSelect(message, choices) {
+    const response = await prompt({
+        type: 'multiselect',
+        name: 'value',
+        message,
+        choices: choices.map(c => ({
+            name: c.name,
+            message: c.message || c.name,
+            hint: c.hint,
+        })),
+    });
+    return response.value;
+}
+/**
+ * Ask for password (hidden input)
+ */
+export async function password(message) {
+    const response = await prompt({
+        type: 'password',
+        name: 'value',
+        message,
+    });
+    return response.value;
+}
+/**
+ * Double confirmation for dangerous operations
+ */
+export async function dangerConfirm(message, confirmText = 'DELETE') {
+    console.log(chalk.red.bold('\n⚠️  DANGER ZONE'));
+    console.log(chalk.red(`This action is irreversible!`));
+    console.log();
+    const firstConfirm = await confirm(message, false);
+    if (!firstConfirm)
+        return false;
+    const typeConfirm = await input(`Type "${chalk.red(confirmText)}" to confirm:`);
+    return typeConfirm === confirmText;
+}
+/**
+ * Ask for core name selection
+ */
+export async function selectCore(cores) {
+    if (cores.length === 0) {
+        throw new Error('No cores available');
+    }
+    if (cores.length === 1) {
+        return cores[0];
+    }
+    return select('Select core:', cores.map(c => ({ name: c })));
+}
+/**
+ * Ask for addon name selection
+ */
+export async function selectAddon(addons) {
+    if (addons.length === 0) {
+        throw new Error('No addons available');
+    }
+    if (addons.length === 1) {
+        return addons[0];
+    }
+    return select('Select addon:', addons.map(a => ({ name: a })));
+}
+//# sourceMappingURL=prompts.js.map

package/dist/lib/prompts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../../src/lib/prompts.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;AAE5B;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAe,EAAE,YAAqB;IAChE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAoB;QAC/C,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,OAAO;QACb,OAAO;QACP,OAAO,EAAE,YAAY;KACtB,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAe,EAAE,eAAwB,KAAK;IAC1E,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAqB;QAChD,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,OAAO;QACb,OAAO;QACP,OAAO,EAAE,YAAY;KACtB,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,OAAe,EACf,OAA4D;IAE5D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAe;QAC1C,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,OAAO;QACb,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI;YAC5B,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAe,EACf,OAA4D;IAE5D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAiB;QAC5C,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,OAAO;QACb,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI;YAC5B,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAe;IAC5C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAoB;QAC/C,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,OAAO;QACb,OAAO;KACR,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,cAAsB,QAAQ;IAE9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAEhC,MAAM,WAAW,GAAG,MAAM,KAAK,CAC7B,SAAS,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,eAAe,CAC/C,CAAC;IAEF,OAAO,WAAW,KAAK,WAAW,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAe;IAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,MAAM,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAgB;IAChD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IAED,OAAO,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC"}

package/dist/lib/sast.d.ts

@@ -0,0 +1,43 @@
+/**
+ * CiCore CLI — Semgrep SAST gate (M3.4 P-1b, K8 signed marketplace)
+ *
+ * Üçüncü-taraf addon PHP'si/JS'i çekirdekte çalışır → publish ÖNCESİ statik analiz
+ * KRİTİK kontrol. Bu lib `ci addon publish`'in pre-flight gate'idir (geliştirici
+ * tarafı, fail-closed): ERROR-severity bulgu VAR ya da semgrep YOK → publish ABORT
+ * (bilinçli `--skip-scan` ile audit'li bypass).
+ *
+ * NOT (otoriter katman): bu CLI gate'i CLI-run = teorik bypass-edilebilir. OTORİTER
+ * tarama (DB scan_status='passed' yazan) ayrı katmandır: publish-addon-job.php
+ * (agent, container-içi) — semgrep IMAGE'a eklenince (mehmet/infra) çalışır; o gün
+ * gelene dek scan_status server-otoritesiyle 'pending' kalır (P-1, fail-closed: P-2
+ * manifest 'passed' istediğinde pending sürüm gated-servable olmaz). KARAR-ENT/seam.
+ */
+export interface SemgrepFinding {
+    checkId: string;
+    path: string;
+    severity: string;
+    line?: number;
+}
+export interface SemgrepResult {
+    available: boolean;
+    ran: boolean;
+    errorCount: number;
+    findings: SemgrepFinding[];
+    message: string;
+}
+/**
+ * Pure: semgrep `--json` stdout'unu bulgulara + ERROR sayısına çevirir.
+ * Parse edilemeyen çıktı → boş (ran-but-unparseable; çağıran karar verir).
+ */
+export declare function parseSemgrepJson(raw: string): {
+    errorCount: number;
+    findings: SemgrepFinding[];
+};
+/**
+ * Semgrep SAST taramasını bir yol üzerinde koşar. Binary yoksa (ENOENT) →
+ * `available:false` (çağıran fail-closed ABORT eder). Asla throw etmez.
+ */
+export declare function runSemgrepScan(targetPath: string, opts?: {
+    config?: string;
+}): Promise<SemgrepResult>;
+//# sourceMappingURL=sast.d.ts.map

package/dist/lib/sast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sast.d.ts","sourceRoot":"","sources":["../../src/lib/sast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,OAAO,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;CAAE,CAsBhG;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,aAAa,CAAC,CA6BzG"}