@cookiecrumbs-eu/mcp 0.7.0

package/dist/cli/src/commands/_shared.js

@@ -0,0 +1,78 @@
+import { Api } from "../api.js";
+import { resolveToken } from "../auth.js";
+import { CliError, usage } from "../errors.js";
+import { ctx, human, printJson, dim, yellow, red } from "../output.js";
+import { findProjectRoot, requireState } from "../project.js";
+import { cliVersion } from "../util.js";
+export function api() {
+    const { token } = resolveToken();
+    return new Api(ctx().api, token, cliVersion());
+}
+export function apiWithSource() {
+    const { token, source } = resolveToken();
+    return { api: new Api(ctx().api, token, cliVersion()), source };
+}
+export function project() {
+    const root = findProjectRoot(ctx().cwd);
+    return { root, state: requireState(root) };
+}
+/** The site a command works on: `--site <id>` when given, else the linked project's site. */
+export function siteIdOf(given) {
+    if (given && given.trim())
+        return given.trim();
+    const root = findProjectRoot(ctx().cwd);
+    const state = requireState(root);
+    return state.site_id;
+}
+/** `on` / `off` / `true` / `false` / `yes` / `no` → boolean; anything else is a usage error. */
+export function parseOnOff(value, flag) {
+    if (value === undefined)
+        return undefined;
+    const v = value.trim().toLowerCase();
+    if (['on', 'true', 'yes', '1'].includes(v))
+        return true;
+    if (['off', 'false', 'no', '0'].includes(v))
+        return false;
+    throw usage(`${flag} must be on or off (got "${value}")`);
+}
+export function envOf(value, fallback = 'preview') {
+    const v = (value ?? fallback).toLowerCase();
+    if (v === 'prod')
+        return 'production';
+    if (v !== 'production' && v !== 'preview')
+        throw usage(`--env must be production or preview (got "${value}")`);
+    return v;
+}
+/** Print either the single JSON object or the human rendering. */
+export function finish(json, humanOut) {
+    if (ctx().json)
+        printJson({ ok: true, ...json });
+    else
+        humanOut();
+}
+export function formatLint(issues) {
+    if (!issues.length)
+        return dim('no lint issues');
+    return issues.map((i) => `${i.severity === 'error' ? red('error') : yellow('warn ')} ${i.code} ${dim(i.path)} ${i.message}`).join('\n');
+}
+export function printLint(result, title = 'Lint') {
+    if (!result || !result.issues?.length)
+        return;
+    human.note(formatLint(result.issues), title);
+}
+export function lintError(result) {
+    const errors = result.issues.filter((i) => i.severity === 'error');
+    return new CliError('lint_failed', `${errors.length} lint error${errors.length === 1 ? '' : 's'} — fix them before pushing.`, 1, { extra: { lint: result } });
+}
+/** Extract a lint result from a problem+json 422 body, whatever key the gateway used. */
+export function lintFromError(e) {
+    const x = e.extra ?? {};
+    for (const k of ['lint', 'issues', 'errors']) {
+        const v = x[k];
+        if (v && typeof v === 'object' && Array.isArray(v.issues))
+            return v;
+        if (Array.isArray(v))
+            return { ok: false, issues: v };
+    }
+    return null;
+}

package/dist/cli/src/commands/alerts.js

@@ -0,0 +1,85 @@
+import { usage } from "../errors.js";
+import { human, bold, dim, green, red, yellow } from "../output.js";
+import { formatDate, parseIntOpt, table } from "../util.js";
+import { api, finish } from "./_shared.js";
+const STATUSES = ['open', 'acknowledged', 'resolved', 'all'];
+const KINDS = ['new_tracker', 'preconsent', 'unclassified', 'removed', 'install_broken'];
+const SEVERITIES = ['info', 'low', 'medium', 'high', 'critical'];
+const colourSeverity = (s) => (s === 'critical' || s === 'high' ? red(s) : s === 'medium' ? yellow(s) : dim(s));
+function oneOf(value, allowed, flag) {
+    if (value === undefined)
+        return undefined;
+    const v = value.toLowerCase();
+    if (!allowed.includes(v))
+        throw usage(`${flag} must be one of ${allowed.join(', ')} (got "${value}")`);
+    return v;
+}
+/** Human rendering shared by ack/resolve. */
+function describe(a) {
+    return [
+        `${bold('Alert')}     ${a.id}`,
+        `${bold('Status')}    ${a.status === 'resolved' ? green(a.status) : a.status}`,
+        `${bold('Kind')}      ${a.kind ?? dim('—')} ${dim(String(a.severity ?? ''))}`,
+        `${bold('Site')}      ${a.site_id ?? dim('workspace')}`,
+    ].join('\n');
+}
+export function register(program) {
+    const alerts = program.command('alerts').description('Alert inbox of the workspace');
+    alerts
+        .command('list', { isDefault: true })
+        .description('List alerts (open by default)')
+        .option('--site <id>', 'only alerts of this site')
+        .option('--status <status>', `open, acknowledged, resolved or all (default: open)`)
+        .option('--kind <kind>', `one of ${KINDS.join(', ')}`)
+        .option('--severity <level>', `minimum severity: ${SEVERITIES.join(', ')}`)
+        .option('--since <date>', 'only alerts raised after this ISO timestamp')
+        .option('--limit <n>', 'maximum rows (1..500)', parseIntOpt('--limit'), 50)
+        .action(async (opts) => {
+        const status = oneOf(opts.status, STATUSES, '--status') ?? 'open';
+        const kind = oneOf(opts.kind, KINDS, '--kind');
+        const min_severity = oneOf(opts.severity, SEVERITIES, '--severity');
+        if (opts.since && Number.isNaN(Date.parse(opts.since)))
+            throw usage('--since must be an ISO timestamp');
+        const page = await api().alerts({ site_id: opts.site, status, kind, min_severity, since: opts.since, limit: opts.limit });
+        finish({ alerts: page.items, counts: page.counts ?? null, status }, () => {
+            if (!page.items.length)
+                return human.print(dim(`No ${status === 'all' ? '' : status + ' '}alerts.`));
+            human.print(table(page.items.map((a) => [
+                a.id,
+                String(a.kind ?? ''),
+                colourSeverity(String(a.severity ?? '')),
+                String(a.status ?? ''),
+                a.site_id ? a.site_id.slice(0, 8) + '…' : 'workspace',
+                formatDate(a.created_at),
+                String(a.title ?? '').slice(0, 60),
+            ]), ['id', 'kind', 'severity', 'status', 'site', 'raised', 'title']));
+            const counts = page.counts ?? {};
+            const line = Object.entries(counts)
+                .map(([k, v]) => `${k}: ${v}`)
+                .join('  ');
+            if (line)
+                human.print(dim(line));
+        });
+    });
+    alerts
+        .command('ack <id>')
+        .alias('acknowledge')
+        .description('Acknowledge an alert')
+        .action(async (id) => {
+        const alert = await api().acknowledgeAlert(id);
+        finish({ alert }, () => {
+            human.success(`Acknowledged ${id}`);
+            human.message(describe(alert));
+        });
+    });
+    alerts
+        .command('resolve <id>')
+        .description('Resolve an alert')
+        .action(async (id) => {
+        const alert = await api().resolveAlert(id);
+        finish({ alert }, () => {
+            human.success(`Resolved ${id}`);
+            human.message(describe(alert));
+        });
+    });
+}

package/dist/cli/src/commands/auth.js

@@ -0,0 +1,92 @@
+import { Api } from "../api.js";
+import { clearCredentials, credentialsPath, deviceFlow, orgLabel, resolveToken, writeCredentials, DEFAULT_SCOPES } from "../auth.js";
+import { CliError, usage } from "../errors.js";
+import { ctx, human, dim, bold, isInteractive } from "../output.js";
+import { cliVersion, parseCsvList } from "../util.js";
+import { apiWithSource, finish } from "./_shared.js";
+async function readStdin() {
+    const chunks = [];
+    for await (const c of process.stdin)
+        chunks.push(Buffer.from(c));
+    return Buffer.concat(chunks).toString('utf8').trim();
+}
+export function register(program) {
+    program
+        .command('login')
+        .description('Sign in with the device flow, or store a token (--token)')
+        .option('--token [token]', 'store an existing cc_* token (reads stdin when no value is given)')
+        .option('--scopes <list>', `scopes to request in the device flow (default: ${DEFAULT_SCOPES.join(',')})`)
+        .option('--no-open', 'do not open the browser; just print the URL')
+        .action(async (opts) => {
+        human.intro('login');
+        const base = ctx().api;
+        let token = null;
+        if (opts.token !== undefined) {
+            if (typeof opts.token === 'string')
+                token = opts.token.trim();
+            else if (!isInteractive())
+                token = await readStdin();
+            else
+                throw usage('Pass the token value: --token cc_live_…  (or pipe it on stdin in CI)');
+            if (!token)
+                throw usage('Empty token.');
+        }
+        if (token) {
+            const api = new Api(base, token, cliVersion());
+            const me = await api.me();
+            const file = writeCredentials({ api: api.base, token, org: me.org, name: me.token.name, token_id: me.token.id, scopes: me.token.scopes, expires_at: me.token.expires_at });
+            finish({ api: api.base, org: me.org, token: me.token, credentials: file }, () => {
+                human.success(`Signed in to ${bold(orgLabel(me.org))} as token "${me.token.name}" (${me.token.scopes.join(', ')})`);
+                human.outro(dim(`Credentials saved to ${file}`));
+            });
+            return;
+        }
+        if (ctx().json)
+            throw usage('Device login is interactive; use `login --token <token>` (or COOKIECRUMBS_TOKEN) with --json.');
+        const anon = new Api(base, null, cliVersion());
+        const { token: t } = await deviceFlow(anon, { scopes: parseCsvList(opts.scopes), open: opts.open });
+        const file = writeCredentials({ api: anon.base, token: t.token, org: t.org, name: t.name, token_id: t.token_id, scopes: t.scopes, expires_at: t.expires_at });
+        human.success(`Signed in to ${bold(orgLabel(t.org))} as token "${t.name}" (${(t.scopes ?? []).join(', ')})`);
+        human.outro(dim(`Credentials saved to ${file}`));
+    });
+    program
+        .command('logout')
+        .description('Remove the stored credentials')
+        .action(async () => {
+        const removed = clearCredentials();
+        const envSet = Boolean(process.env.COOKIECRUMBS_TOKEN);
+        finish({ removed, credentials: credentialsPath(), env_token_still_set: envSet }, () => {
+            human.intro('logout');
+            if (removed)
+                human.success(`Removed ${credentialsPath()}`);
+            else
+                human.info('No stored credentials.');
+            if (envSet)
+                human.warn('COOKIECRUMBS_TOKEN is set in this shell and still applies.');
+            human.outro('Done');
+        });
+    });
+    program
+        .command('whoami')
+        .description('Show the token, scopes and workspace in use')
+        .action(async () => {
+        const { api, source } = apiWithSource();
+        const { creds } = resolveToken();
+        if (!api.token)
+            throw new CliError('not_logged_in', 'Not signed in. Run `cookiecrumbs login` or set COOKIECRUMBS_TOKEN.', 2);
+        const me = await api.me();
+        finish({ source, api: api.base, org: me.org, token: me.token }, () => {
+            human.intro('whoami');
+            human.message([
+                `${bold('Workspace')}  ${orgLabel(me.org)}${me.org.plan ? dim(`  plan ${me.org.plan}`) : ''}`,
+                `${bold('Token')}      ${me.token.name} ${dim(`(${me.token.kind}, id ${me.token.id})`)}`,
+                `${bold('Scopes')}     ${me.token.scopes.join(', ')}`,
+                `${bold('Restricted')} ${me.token.site_id ? `site ${me.token.site_id}` : 'any site'}${me.token.environment ? ` · ${me.token.environment}` : ''}`,
+                `${bold('Expires')}    ${me.token.expires_at ?? 'never'}`,
+                `${bold('Source')}     ${source === 'env' ? 'COOKIECRUMBS_TOKEN' : credentialsPath()}${creds?.saved_at ? dim(`  saved ${creds.saved_at}`) : ''}`,
+                `${bold('API')}        ${api.base}`,
+            ].join('\n'));
+            human.outro('OK');
+        });
+    });
+}

package/dist/cli/src/commands/declaration.js

@@ -0,0 +1,45 @@
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { usage } from "../errors.js";
+import { ctx, human, printJson } from "../output.js";
+import { findProjectRoot, requireState } from "../project.js";
+import { api } from "./_shared.js";
+export function register(program) {
+    const declaration = program.command('declaration').description('Cookie declaration');
+    declaration
+        .command('export')
+        .description('Download the current declaration as html, md or json')
+        .option('--format <fmt>', 'html, md or json', 'html')
+        .option('--lang <lang>', 'language (default: the site default)')
+        .option('--out <file>', 'write to a file instead of stdout')
+        .action(async (opts) => {
+        const fmt = opts.format.toLowerCase();
+        if (fmt !== 'html' && fmt !== 'md' && fmt !== 'json')
+            throw usage('--format must be html, md or json');
+        const { site_id } = requireState(findProjectRoot(ctx().cwd));
+        const text = await api().declaration(site_id, fmt, opts.lang);
+        let file = null;
+        if (opts.out) {
+            file = resolve(ctx().cwd, opts.out);
+            mkdirSync(dirname(file), { recursive: true });
+            writeFileSync(file, text.endsWith('\n') ? text : text + '\n');
+        }
+        if (ctx().json) {
+            let parsed = null;
+            if (fmt === 'json') {
+                try {
+                    parsed = JSON.parse(text);
+                }
+                catch {
+                    parsed = null;
+                }
+            }
+            printJson({ ok: true, format: fmt, lang: opts.lang ?? null, file, bytes: Buffer.byteLength(text), ...(parsed ? { declaration: parsed } : file ? {} : { content: text }) });
+            return;
+        }
+        if (file)
+            human.success(`Wrote ${file}`);
+        else
+            process.stdout.write(text.endsWith('\n') ? text : text + '\n');
+    });
+}

package/dist/cli/src/commands/diff.js

@@ -0,0 +1,26 @@
+import { diffConfigs, formatDiff, summariseDiff } from "../diff.js";
+import { ctx, human, dim } from "../output.js";
+import { findProjectRoot, loadLocalConfig, requireState } from "../project.js";
+import { api, envOf, finish } from "./_shared.js";
+export function register(program) {
+    program
+        .command('diff')
+        .description('Show what push would change (local config vs the remote draft)')
+        .option('--env <env>', 'preview or production (default: the linked environment)')
+        .action(async (opts) => {
+        const root = findProjectRoot(ctx().cwd);
+        const state = requireState(root);
+        const env = envOf(opts.env, state.env);
+        const local = await loadLocalConfig(root);
+        const remote = await api().getDraft(state.site_id, env);
+        const changes = diffConfigs(remote.config, local.config);
+        finish({ env, changes, summary: summariseDiff(changes), updated_at: remote.updated_at ?? null }, () => {
+            if (!changes.length) {
+                human.print(dim(`No differences between the local config and the ${env} draft.`));
+                return;
+            }
+            human.print(formatDiff(changes));
+            human.print(dim(`${summariseDiff(changes)} (local vs ${env} draft; + added locally, - missing locally)`));
+        });
+    });
+}

package/dist/cli/src/commands/domains.js

@@ -0,0 +1,44 @@
+import { usage } from "../errors.js";
+import { human, bold, dim, green, yellow } from "../output.js";
+import { formatDate, table } from "../util.js";
+import { api, finish, siteIdOf } from "./_shared.js";
+const METHODS = ['dns_txt', 'meta'];
+function instructions(d) {
+    if (d.verified_at)
+        return `${green('Verified')} ${formatDate(d.verified_at)}`;
+    if (d.verification_method === 'meta')
+        return `Add to the <head> of https://${d.hostname}/:\n  <meta name="cookiecrumbs-verification" content="${d.verification_token}">`;
+    return `Add a DNS TXT record:\n  _cookiecrumbs.${d.hostname}  TXT  "cookiecrumbs-verification=${d.verification_token}"`;
+}
+export function register(program) {
+    const domains = program.command('domains').description('The domains of a site and their ownership verification');
+    domains
+        .command('list', { isDefault: true })
+        .description('List domains with their verification state')
+        .option('--site <id>', 'site id (default: the linked site)')
+        .action(async (opts) => {
+        const items = await api().domains(siteIdOf(opts.site));
+        finish({ domains: items }, () => {
+            if (!items.length)
+                return human.print(dim('No domains.'));
+            human.print(table(items.map((d) => [d.id, d.hostname, d.verification_method, d.verified_at ? green('verified') : yellow('unverified'), formatDate(d.last_checked_at)]), ['id', 'hostname', 'method', 'state', 'last check']));
+            for (const d of items.filter((x) => !x.verified_at))
+                human.message(`${bold(d.hostname)}\n${instructions(d)}`);
+        });
+    });
+    domains
+        .command('verify <id>')
+        .description('(Re)issue the verification token and print what to publish; the worker checks it')
+        .option('--method <method>', `${METHODS.join(' or ')} (default: dns_txt)`, 'dns_txt')
+        .action(async (id, opts) => {
+        if (!METHODS.includes(opts.method))
+            throw usage(`--method must be ${METHODS.join(' or ')}`);
+        const d = await api().verifyDomain(id, opts.method);
+        finish({ domain: d, instructions: instructions(d) }, () => {
+            human.success(`${d.hostname}: ${d.verification_method}`);
+            human.note(instructions(d), d.verified_at ? 'Already verified' : 'Publish this, then wait for the next check');
+            if (!d.verified_at)
+                human.outro('A passed install check verifies the domain too, without a DNS record.');
+        });
+    });
+}

package/dist/cli/src/commands/export.js

@@ -0,0 +1,136 @@
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join, relative, resolve } from 'node:path';
+import { CliError, usage } from "../errors.js";
+import { ctx, human, bold, dim, yellow } from "../output.js";
+import { findProjectRoot, requireState } from "../project.js";
+import { cliVersion, firstOfMonth, parseIntOpt, toIso } from "../util.js";
+import { api, envOf, finish } from "./_shared.js";
+import { downloadExport, runExportJob } from "./logs.js";
+export function register(program) {
+    program
+        .command('export')
+        .description('Export everything about the linked site into a folder (--all)')
+        .option('--all', 'config, texts, declarations, versions, consent log and audit bundle')
+        .option('--out <dir>', 'output folder', './cookiecrumbs-export')
+        .option('--env <env>', 'preview or production (default: the linked environment)')
+        .option('--from <date>', 'consent log range start (default: first day of this month)')
+        .option('--to <date>', 'consent log range end (default: now)')
+        .option('--skip-logs', 'do not run the consent log / audit bundle export jobs')
+        .option('--timeout <seconds>', 'per job wait limit', parseIntOpt('--timeout'), 600)
+        .action(async (opts) => {
+        if (!opts.all)
+            throw usage('Pass --all (the only mode for now): cookiecrumbs export --all [--out dir]');
+        human.intro('export --all');
+        const root = findProjectRoot(ctx().cwd);
+        const state = requireState(root);
+        const env = envOf(opts.env, state.env);
+        const out = resolve(ctx().cwd, opts.out);
+        mkdirSync(out, { recursive: true });
+        const a = api();
+        const files = [];
+        const missing = [];
+        const rel = (f) => relative(out, f) || f;
+        const write = (name, data) => {
+            const f = join(out, name);
+            mkdirSync(resolve(f, '..'), { recursive: true });
+            writeFileSync(f, data);
+            files.push(name);
+            human.step(`${name}`);
+        };
+        // 1. config + texts
+        const site = await a.site(state.site_id);
+        const draft = await a.getDraft(state.site_id, env);
+        write('config.json', JSON.stringify(draft.config, null, 2) + '\n');
+        const langs = draft.config.languages ?? [];
+        for (const lang of langs) {
+            write(join('texts', `${lang}.json`), JSON.stringify({ texts: draft.config.texts?.[lang] ?? {}, category_texts: draft.config.category_texts?.[lang] ?? {} }, null, 2) + '\n');
+        }
+        // 2. declarations
+        for (const lang of langs) {
+            for (const fmt of ['html', 'md', 'json']) {
+                try {
+                    const text = await a.declaration(state.site_id, fmt, lang);
+                    write(`declaration.${lang}.${fmt}`, text.endsWith('\n') ? text : text + '\n');
+                }
+                catch (e) {
+                    const reason = e instanceof CliError ? `${e.code}: ${e.detail}` : String(e);
+                    missing.push({ file: `declaration.${lang}.${fmt}`, reason });
+                    human.warn(`declaration.${lang}.${fmt}: ${reason}`);
+                }
+            }
+        }
+        // 3. versions
+        const versions = await a.versions(state.site_id);
+        write('versions.json', JSON.stringify(versions, null, 2) + '\n');
+        // 4. consent log + audit bundle (sequential: one job per site at a time)
+        let from = '';
+        let to = '';
+        let consents = null;
+        let bundle = null;
+        if (!opts.skipLogs) {
+            try {
+                from = toIso(opts.from, firstOfMonth);
+                to = toIso(opts.to, () => new Date());
+            }
+            catch (e) {
+                throw usage(e.message);
+            }
+            for (const [kind, name] of [
+                ['consent_jsonl', 'consents.jsonl'],
+                ['audit_bundle', 'audit-bundle.zip'],
+            ]) {
+                try {
+                    const job = await runExportJob(a, state.site_id, { kind, from, to, env }, { timeoutMs: opts.timeout * 1000, label: name });
+                    const r = await downloadExport(a, job, join(out, name));
+                    files.push(name);
+                    human.step(`${name} ${dim(`sha256 ${r.sha256.slice(0, 16)}… ${r.sha256_verified ? 'verified' : ''}`)}`);
+                    if (kind === 'consent_jsonl')
+                        consents = r;
+                    else
+                        bundle = r;
+                }
+                catch (e) {
+                    const reason = e instanceof CliError ? `${e.code}: ${e.detail}` : String(e);
+                    missing.push({ file: name, reason });
+                    human.warn(`${name}: ${reason}`);
+                }
+            }
+        }
+        // 5. README
+        const readme = [
+            `CookieCrumbs export — ${site.name} (${site.id}) · environment ${env}`,
+            `Generated ${new Date().toISOString()} by cookiecrumbs CLI ${cliVersion()}`,
+            '',
+            'Files',
+            '  config.json               The current draft banner configuration (BannerConfig v1, JSON).',
+            '  texts/<lang>.json         Banner texts and category texts per language (same data as in config.json).',
+            '  declaration.<lang>.html   The hosted cookie declaration as HTML, Markdown (.md) and JSON (.json) per language.',
+            '  versions.json             Every published version (number, environment, note, hashes, actor) without screenshots.',
+            '  consents.jsonl            Consent records (one JSON object per line, keys sorted) for the range below, from a signed export job.',
+            '  audit-bundle.zip          Deterministic audit bundle: records.jsonl, referenced banner versions, declarations, regime rules,',
+            '                            audit trail, integrity.json, signature.bin and a dependency-free verify.mjs.',
+            '',
+            `Consent log range: ${from || '—'} → ${to || '—'}`,
+            consents ? `consents.jsonl sha256 ${consents.sha256}${consents.signature ? `  Ed25519 signature ${consents.signature} (kid ${consents.kid ?? '?'})` : ''}` : 'consents.jsonl: not exported' + (opts.skipLogs ? ' (--skip-logs)' : ' (see "Missing" below)'),
+            bundle ? `audit-bundle.zip sha256 ${bundle.sha256}${bundle.signature ? `  Ed25519 signature ${bundle.signature} (kid ${bundle.kid ?? '?'})` : ''}` : 'audit-bundle.zip: not exported' + (opts.skipLogs ? ' (--skip-logs)' : ' (see "Missing" below)'),
+            '',
+            'How to verify',
+            '  1. Hash:       openssl dgst -sha256 consents.jsonl   (compare with the sha256 above / X-Content-SHA256)',
+            '  2. Signature:  the base64 Ed25519 signature covers the 32 digest bytes; the public key (by kid) is published at',
+            '                 https://nldaffvxmpcghovmgvuc.supabase.co/functions/v1/well-known/cookiecrumbs-signing.json',
+            '                 openssl dgst -sha256 -binary consents.jsonl > h && openssl pkeyutl -verify -pubin -inkey pub.pem -rawin -in h -sigfile sig.bin',
+            '  3. Chain:      unzip audit-bundle.zip -d bundle && node bundle/verify.mjs audit-bundle.zip',
+            '                 (checks every hash in integrity.json, the signature and the hash chain over the consent records)',
+            '',
+            missing.length ? 'Missing\n' + missing.map((m) => `  ${m.file}: ${m.reason}`).join('\n') : 'All files were exported.',
+            '',
+        ].join('\n');
+        write('README.txt', readme);
+        const json = { out, env, files, missing, consents: consents ? { sha256: consents.sha256, signature: consents.signature, kid: consents.kid } : null, audit_bundle: bundle ? { sha256: bundle.sha256, signature: bundle.signature, kid: bundle.kid } : null };
+        if (missing.length) {
+            human.message(yellow(`${missing.length} file${missing.length === 1 ? '' : 's'} could not be exported — see README.txt`));
+            throw new CliError('export_incomplete', `Export written to ${out} but ${missing.map((m) => m.file).join(', ')} ${missing.length === 1 ? 'is' : 'are'} missing.`, 1, { extra: json });
+        }
+        finish(json, () => human.outro(`Exported ${files.length} files to ${bold(rel(out) === '' ? out : out)}`));
+    });
+}

package/dist/cli/src/commands/init.js

@@ -0,0 +1,134 @@
+import { existsSync } from 'node:fs';
+import { relative, resolve } from 'node:path';
+import { defaultConfig } from "../configpkg.js";
+import { CliError, usage } from "../errors.js";
+import { detectFramework, installSnippet, FRAMEWORK_LABEL } from "../frameworks.js";
+import { configHash } from "../merge.js";
+import { askConfirm, askSelect, askText, ctx, human, bold, dim } from "../output.js";
+import { CONFIG_TS, CONFIG_JSON, writeLocalConfig, writePulled, writeState, configFile } from "../project.js";
+import { appUrl, runtimeApiBase } from "../util.js";
+import { api, envOf, finish } from "./_shared.js";
+import { pushProject } from "./push.js";
+export function runtimeUrl() {
+    return process.env.COOKIECRUMBS_RUNTIME_URL ?? `${appUrl()}/runtime/cc.js`;
+}
+export function snippetFor(framework, site, env, lang) {
+    const envRow = (site.environments ?? []).find((e) => e.name === env);
+    const key = envRow?.public_key ?? null;
+    return {
+        key,
+        text: installSnippet(framework, { siteKey: key ?? `<public key of ${env}>`, env, runtimeUrl: runtimeUrl(), apiBase: runtimeApiBase(ctx().api), lang }),
+    };
+}
+export function register(program) {
+    program
+        .command('init')
+        .description('Create or link a site, write cookiecrumbs.config.ts + texts, print the install snippet')
+        .option('--site <id>', 'link an existing site id')
+        .option('--env <env>', 'environment to work against (preview|production)', 'preview')
+        .option('--name <name>', 'create a new site with this name (with --domain)')
+        .option('--domain <domain>', 'primary domain of the new site')
+        .option('--format <fmt>', 'config file format: ts or json', 'ts')
+        .option('--publish', 'push the config to the environment right away')
+        .option('-y, --yes', 'overwrite an existing config without asking')
+        .action(async (opts) => {
+        human.intro('init');
+        const root = resolve(ctx().cwd);
+        const env = envOf(opts.env);
+        const format = opts.format === 'json' ? 'json' : opts.format === 'ts' || !opts.format ? 'ts' : null;
+        if (!format)
+            throw usage('--format must be ts or json');
+        const a = api();
+        const me = await a.me();
+        // --- pick or create the site ---------------------------------------
+        let site;
+        if (opts.site) {
+            site = await a.site(opts.site);
+        }
+        else if (opts.name || opts.domain) {
+            if (!opts.name || !opts.domain)
+                throw usage('Creating a site needs both --name and --domain.');
+            site = await a.createSite({ name: opts.name, primary_domain: opts.domain });
+            human.success(`Created site ${bold(site.name)} (${site.id})`);
+        }
+        else {
+            const sites = await a.sites();
+            const choice = await askSelect('Which site?', '--site <id> (or --name + --domain to create one)', [
+                ...sites.map((s) => ({ value: s.id, label: s.name, hint: s.primary_domain })),
+                { value: '__new__', label: 'Create a new site' },
+            ]);
+            if (choice === '__new__') {
+                const name = await askText('Site name', '--name', { validate: (v) => (v.trim() ? undefined : 'Required') });
+                const domain = await askText('Primary domain', '--domain', { placeholder: 'www.example.com', validate: (v) => (/^[a-z0-9.-]+\.[a-z]{2,}$/i.test(v.trim()) ? undefined : 'A hostname, e.g. www.example.com') });
+                site = await a.createSite({ name: name.trim(), primary_domain: domain.trim().toLowerCase() });
+                human.success(`Created site ${bold(site.name)} (${site.id})`);
+            }
+            else {
+                site = sites.find((s) => s.id === choice) ?? (await a.site(choice));
+            }
+        }
+        // --- existing files -------------------------------------------------
+        const existing = configFile(root);
+        if (existing && !opts.yes) {
+            const ok = await askConfirm(`${relative(root, existing.path) || existing.path} exists. Overwrite it with the ${env} draft?`, '--yes', false);
+            if (!ok)
+                throw new CliError('cancelled', 'Kept the existing config.', 2);
+        }
+        // --- config from the current draft (or defaults) ---------------------
+        let config;
+        let updatedAt = null;
+        let source = 'draft';
+        try {
+            const draft = await a.getDraft(site.id, env);
+            config = draft.config;
+            updatedAt = draft.updated_at ?? null;
+        }
+        catch (e) {
+            if (e instanceof CliError && e.status === 404) {
+                config = defaultConfig(site.default_lang ?? 'en');
+                source = 'defaults';
+            }
+            else
+                throw e;
+        }
+        const framework = detectFramework(root);
+        const files = writeLocalConfig(root, config, { format });
+        const hash = configHash(config);
+        writePulled(root, config);
+        writeState(root, {
+            site_id: site.id,
+            env,
+            last_pulled_hash: hash,
+            last_pulled_updated_at: updatedAt,
+            site_name: site.name,
+            org_slug: me.org.slug,
+            public_keys: Object.fromEntries((site.environments ?? []).map((e) => [e.name, e.public_key])),
+        });
+        const snippet = snippetFor(framework.framework, site, env, config.default_lang);
+        let version = null;
+        if (opts.publish) {
+            const r = await pushProject(root, { env, note: 'Initial push from the CLI' });
+            version = r.version;
+        }
+        finish({
+            site: { id: site.id, name: site.name, primary_domain: site.primary_domain },
+            env,
+            org: me.org,
+            config_source: source,
+            framework: framework.framework,
+            framework_reason: framework.reason,
+            files: files.map((f) => relative(root, f)),
+            public_key: snippet.key,
+            snippet: snippet.text,
+            version,
+        }, () => {
+            human.success(`Linked ${bold(site.name)} (${site.id}) · ${env} · config from ${source === 'draft' ? 'the current draft' : 'defaults'}`);
+            human.step(`Wrote ${files.map((f) => relative(root, f)).join(', ')}`);
+            human.info(`Detected ${bold(FRAMEWORK_LABEL[framework.framework])} ${dim(`(${framework.reason})`)}`);
+            human.note(snippet.text, `Install snippet (${FRAMEWORK_LABEL[framework.framework]}, ${env})`);
+            if (!snippet.key)
+                human.warn(`The site row carried no ${env} public key; replace the placeholder from Settings → Install.`);
+            human.outro(`Edit ${existsSync(resolve(root, CONFIG_TS)) ? CONFIG_TS : CONFIG_JSON} and run ${bold('cookiecrumbs push')}`);
+        });
+    });
+}