@decantr/cli 2.9.3 → 2.9.4

package/README.md

@@ -176,11 +176,11 @@ decantr verify --workspace --changed --since origin/main
 decantr export --to figma-tokens
 ```
 
-Use `--json` for machines and schema validation, `--markdown` for summaries, `--evidence` for the privacy-redacted Evidence Bundle, and `--prompt <finding-id>` when you want a scoped remediation prompt for an AI assistant. The prompt command prints instructions only; it does not modify source files. In monorepos, prompt commands preserve `--project <path>` so the finding resolves from the same app that produced it. `--browser` uses a project-local Playwright install and a supplied base URL to capture local route screenshots under `.decantr/evidence/screenshots/` and write `.decantr/evidence/visual-manifest.json`; missing Playwright becomes a visible setup finding/message, not a crash or silent skip. `--save-baseline` writes `.decantr/health-baseline.json`; `--since-baseline` writes `.decantr/health-baseline-diff.json` with changed files, route impact, finding deltas, screenshot hash drift, and contract drift. `--design-tokens <path>` compares a Tokens Studio/Figma token JSON export against Decantr CSS token names. `decantr ci --fail-on error` fails only when blocking errors exist; `decantr ci --fail-on warn` also fails on warnings.
+Use `--json` for machines and schema validation, `--markdown` for summaries, `--evidence` for the privacy-redacted Evidence Bundle, and `--prompt <finding-id>` when you want a scoped remediation prompt for an AI assistant. The prompt command prints instructions only; it does not modify source files. In monorepos, prompt commands preserve `--project <path>`, include app-prefixed read targets such as `apps/web/DECANTR.md`, and use root-safe runtime commands such as `pnpm --dir apps/web build` so the finding resolves from the same app that produced it. `--browser` uses a project-local Playwright install and a supplied base URL to capture local route screenshots under `.decantr/evidence/screenshots/` and write `.decantr/evidence/visual-manifest.json`; missing Playwright becomes a visible setup finding/message, not a crash or silent skip. `--save-baseline` writes `.decantr/health-baseline.json`; `--since-baseline` writes `.decantr/health-baseline-diff.json` with changed files, route impact, finding deltas, screenshot hash drift, and contract drift. `--design-tokens <path>` compares a Tokens Studio/Figma token JSON export against Decantr CSS token names. `decantr ci --fail-on error` fails only when blocking errors exist; `decantr ci --fail-on warn` also fails on warnings.
 
 `decantr ci init` installs `.github/workflows/decantr-ci.yml` for GitHub Actions. The generated workflow installs dependencies at the workspace root, writes JSON/markdown CI artifacts, gates with `decantr ci`, appends the markdown report to the GitHub step summary, and uploads both files as artifacts. Use `--force` to replace an existing workflow or `--fail-on warn` for stricter repositories. In monorepos, add `--project <path>` from the repository root; dependency install stays at the root while CI evaluates the app contract and uploads app-scoped artifacts. Use `--workspace` to generate an aggregate gate. Use `--provider generic` for Jenkins, Please, Buildkite, GitLab, Azure DevOps, or internal deployment tools. Generated CI uses the pinned local package-manager command and does not depend on `@latest`. Project Health remediation prompts are also monorepo-aware, so missing-pack fixes use `apps/web/decantr.essence.json` and CI recommendations include `--project apps/web`.
 
-`decantr workspace` is the monorepo reliability namespace. Before attach, `workspace list` shows app candidates. After attach, it also discovers Decantr projects from `.decantr/workspace.json` or by finding `decantr.essence.json` files. Workspace health runs projects with deterministic ordering, concurrency, per-project timeout, failure isolation, and aggregate JSON, and can limit a run to changed projects:
+`decantr workspace` is the monorepo reliability namespace. Before attach, `workspace list` shows app candidates. After attach, it also discovers Decantr projects from `.decantr/workspace.json` or by finding `decantr.essence.json` files, and it distinguishes "attach another app" from the empty-workspace first attach. Workspace health runs projects with deterministic ordering, concurrency, per-project timeout, failure isolation, and aggregate JSON, and can limit a run to changed projects:
 
 ```bash
 decantr workspace list

package/dist/bin.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import "./chunk-VMNUJOEH.js";
+import "./chunk-GDGZFGMK.js";
 import "./chunk-RXF7ZYGK.js";
-import "./chunk-ARR3EPS2.js";
-import "./chunk-XZFKK6V7.js";
-import "./chunk-34TZXWIF.js";
+import "./chunk-VCUFZB45.js";
+import "./chunk-FACL3NXU.js";
+import "./chunk-WONPNSSI.js";

package/dist/{chunk-XZFKK6V7.js → chunk-FACL3NXU.js}

@@ -3,7 +3,7 @@ import {
   sendProjectHealthCiFailedTelemetry,
   sendProjectHealthPromptTelemetry,
   sendProjectHealthReportTelemetry
-} from "./chunk-34TZXWIF.js";
+} from "./chunk-WONPNSSI.js";
 
 // src/commands/health.ts
 import { execFileSync } from "child_process";
@@ -383,6 +383,47 @@ function commandsForFinding(source) {
       return ["decantr audit", "decantr health"];
   }
 }
+function detectPackageManager(root) {
+  const pkg = readJsonFile(join2(root, "package.json"));
+  const declared = pkg?.packageManager?.split("@")[0];
+  if (declared === "pnpm" || declared === "npm" || declared === "yarn" || declared === "bun") {
+    return declared;
+  }
+  if (existsSync2(join2(root, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync2(join2(root, "package-lock.json"))) return "npm";
+  if (existsSync2(join2(root, "yarn.lock"))) return "yarn";
+  if (existsSync2(join2(root, "bun.lock")) || existsSync2(join2(root, "bun.lockb"))) return "bun";
+  return "unknown";
+}
+function buildCommandForProject(workspaceRoot, projectPath) {
+  const packageManager = detectPackageManager(workspaceRoot);
+  if (projectPath) {
+    switch (packageManager) {
+      case "pnpm":
+        return `pnpm --dir ${projectPath} build`;
+      case "yarn":
+        return `yarn --cwd ${projectPath} build`;
+      case "bun":
+        return `bun --cwd ${projectPath} run build`;
+      case "npm":
+        return `npm --prefix ${projectPath} run build`;
+      default:
+        return `cd ${projectPath} && npm run build`;
+    }
+  }
+  switch (packageManager) {
+    case "pnpm":
+      return "pnpm build";
+    case "yarn":
+      return "yarn build";
+    case "bun":
+      return "bun run build";
+    case "npm":
+      return "npm run build";
+    default:
+      return "npm run build";
+  }
+}
 function commandContextForProject(projectRoot) {
   const workspaceInfo = resolveWorkspaceInfo(projectRoot);
   const relativeProjectPath = relative(workspaceInfo.workspaceRoot, projectRoot).replace(
@@ -394,6 +435,7 @@ function commandContextForProject(projectRoot) {
   const essencePath = projectPath ? `${projectPath}/decantr.essence.json` : "decantr.essence.json";
   return {
     projectPath,
+    buildCommand: buildCommandForProject(workspaceInfo.workspaceRoot, projectPath),
     compilePacksCommand: `decantr registry compile-packs ${essencePath} --write-context`,
     verifyCommand: `decantr verify${projectFlag}`,
     ciCommand: `decantr ci${projectFlag} --fail-on error`,
@@ -401,6 +443,7 @@ function commandContextForProject(projectRoot) {
   };
 }
 function rewriteHealthCommand(command, context) {
+  if (command === "npm run build") return context.buildCommand;
   let rewritten = command.replace(
     /decantr registry compile-packs decantr\.essence\.json --write-context/g,
     context.compilePacksCommand
@@ -461,17 +504,25 @@ function scopeHealthFindingsToProject(projectRoot, findings) {
           message: finding.message,
           evidence: finding.evidence,
           suggestedFix,
-          commands
+          commands,
+          projectPath: context.projectPath
         })
       }
     };
   });
 }
 function buildRemediationPrompt(input) {
+  const prefix = input.projectPath ? `${input.projectPath}/` : "";
+  const readTargets = [
+    `${prefix}DECANTR.md`,
+    `${prefix}decantr.essence.json`,
+    `${prefix}.decantr/context/scaffold-pack.md`,
+    `${prefix}.decantr/context/scaffold.md`
+  ];
   return [
     "You are fixing one Decantr Project Health finding in this local workspace.",
     "",
-    "Read `DECANTR.md`, `decantr.essence.json`, and `.decantr/context/scaffold-pack.md` if they exist. For route or page work, read the matching page/section packs before editing.",
+    `Read project-scoped Decantr files if they exist: ${readTargets.map((target) => `\`${target}\``).join(", ")}. For route or page work, read the matching page/section packs before editing.`,
     "",
     `Finding: ${input.id}`,
     `Source: ${input.source}`,

package/dist/{chunk-VMNUJOEH.js → chunk-GDGZFGMK.js}

@@ -22,14 +22,14 @@ import {
   listWorkspaceCandidates,
   listWorkspaceProjects,
   shouldFailWorkspaceHealth
-} from "./chunk-ARR3EPS2.js";
+} from "./chunk-VCUFZB45.js";
 import {
   createProjectHealthReport,
   formatProjectHealthMarkdown,
   formatProjectHealthText,
   resolveWorkspaceInfo,
   shouldFailHealth
-} from "./chunk-XZFKK6V7.js";
+} from "./chunk-FACL3NXU.js";
 import {
   buildGuardRegistryContext,
   createDoctrineMap,
@@ -46,7 +46,7 @@ import {
   sendCliCommandTelemetry,
   sendNewProjectCompletedTelemetry,
   writeDoctrineMap
-} from "./chunk-34TZXWIF.js";
+} from "./chunk-WONPNSSI.js";
 
 // src/index.ts
 import { existsSync as existsSync29, mkdirSync as mkdirSync16, readdirSync as readdirSync9, readFileSync as readFileSync22, writeFileSync as writeFileSync19 } from "fs";
@@ -4682,6 +4682,16 @@ var GREEN5 = "\x1B[32m";
 var RED4 = "\x1B[31m";
 var DIM5 = "\x1B[2m";
 var RESET5 = "\x1B[0m";
+function readAdoptionMode(projectRoot) {
+  const projectJsonPath = join19(projectRoot, ".decantr", "project.json");
+  if (!existsSync17(projectJsonPath)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync14(projectJsonPath, "utf-8"));
+    return typeof parsed.initialized?.adoptionMode === "string" ? parsed.initialized.adoptionMode : null;
+  } catch {
+    return null;
+  }
+}
 function resolveOutputPath(projectRoot, output, fallback) {
   if (!output) return fallback;
   return isAbsolute(output) ? output : join19(projectRoot, output);
@@ -4853,9 +4863,9 @@ async function cmdExport(target, projectRoot, options = {}) {
     return;
   }
   if (!existsSync17(tokensPath)) {
-    console.error(
-      `${RED4}No src/styles/tokens.css found. Run \`decantr refresh\` to generate tokens.${RESET5}`
-    );
+    const adoptionMode = readAdoptionMode(projectRoot);
+    const message = adoptionMode === "contract-only" ? `No src/styles/tokens.css found. This export reads Decantr CSS tokens, but this project is contract-only Brownfield and may intentionally use its own Tailwind/Sass token system. Export from the app's token source or adopt a style bridge before using \`decantr export --to ${target}\`.` : "No src/styles/tokens.css found. Run `decantr refresh` to generate tokens.";
+    console.error(`${RED4}${message}${RESET5}`);
     process.exitCode = 1;
     return;
   }
@@ -10320,7 +10330,7 @@ async function cmdAdoptWorkflow(args) {
     console.log(dim3("Skipping hosted pack hydration in offline mode."));
   }
   if (runVerify) {
-    const { cmdHealth } = await import("./health-MB63O56B.js");
+    const { cmdHealth } = await import("./health-R7AV5G4V.js");
     await cmdHealth(projectRoot, {
       browser: runBrowser,
       browserBaseUrl: baseUrl,
@@ -10391,7 +10401,7 @@ async function cmdVerifyWorkflow(args) {
     return;
   }
   if (workspaceMode) {
-    const { cmdWorkspace } = await import("./workspace-OGFYJA4N.js");
+    const { cmdWorkspace } = await import("./workspace-DRHTQ2NG.js");
     await cmdWorkspace(process.cwd(), ["workspace", "health", ...withoutWorkflowOnlyFlags(args)]);
     return;
   }
@@ -10424,7 +10434,7 @@ async function cmdVerifyWorkflow(args) {
   }
   let guardExitCode;
   if (brownfield) {
-    const { cmdHeal, collectCheckIssues } = await import("./heal-2BDT7TR5.js");
+    const { cmdHeal, collectCheckIssues } = await import("./heal-ZQHEHBUJ.js");
     if (quietOutput) {
       const result = collectCheckIssues(workspaceInfo.appRoot, { brownfield: true });
       guardExitCode = result.issues.some((issue) => issue.type === "error") ? 1 : void 0;
@@ -10434,7 +10444,7 @@ async function cmdVerifyWorkflow(args) {
       process.exitCode = void 0;
     }
   }
-  const { cmdHealth, parseHealthArgs } = await import("./health-MB63O56B.js");
+  const { cmdHealth, parseHealthArgs } = await import("./health-R7AV5G4V.js");
   await cmdHealth(workspaceInfo.appRoot, parseHealthArgs(healthArgs));
   if (localPatterns) {
     const validation = validateLocalLaw(workspaceInfo.appRoot);
@@ -11417,7 +11427,7 @@ async function main() {
           `${YELLOW10}Note: \`decantr heal\` is deprecated. Use \`decantr check\` instead.${RESET16}`
         );
       }
-      const { cmdHeal } = await import("./heal-2BDT7TR5.js");
+      const { cmdHeal } = await import("./heal-ZQHEHBUJ.js");
       const { flags } = parseLooseArgs(args);
       const workspaceInfo = resolveWorkflowProject(flags, "check");
       if (!workspaceInfo) break;
@@ -11442,7 +11452,7 @@ async function main() {
         const { flags } = parseLooseArgs(args);
         const workspaceInfo = resolveWorkflowProject(flags, "health");
         if (!workspaceInfo) break;
-        const { cmdHealth, parseHealthArgs } = await import("./health-MB63O56B.js");
+        const { cmdHealth, parseHealthArgs } = await import("./health-R7AV5G4V.js");
         await cmdHealth(workspaceInfo.appRoot, parseHealthArgs(stripProjectArgs(args)));
       } catch (e) {
         console.error(error2(e.message));
@@ -11470,7 +11480,7 @@ async function main() {
           cmdStudioHelp();
           break;
         }
-        const { cmdStudio, parseStudioArgs } = await import("./studio-6QGXJBVH.js");
+        const { cmdStudio, parseStudioArgs } = await import("./studio-2734P63C.js");
         await cmdStudio(process.cwd(), parseStudioArgs(args));
       } catch (e) {
         console.error(error2(e.message));
@@ -11484,7 +11494,7 @@ async function main() {
           cmdWorkspaceHelp();
           break;
         }
-        const { cmdWorkspace } = await import("./workspace-OGFYJA4N.js");
+        const { cmdWorkspace } = await import("./workspace-DRHTQ2NG.js");
         await cmdWorkspace(process.cwd(), args);
       } catch (e) {
         console.error(error2(e.message));

package/dist/{chunk-ARR3EPS2.js → chunk-VCUFZB45.js}

@@ -1,7 +1,7 @@
 import {
   createProjectHealthReport,
   listWorkspaceAppCandidates
-} from "./chunk-XZFKK6V7.js";
+} from "./chunk-FACL3NXU.js";
 
 // src/commands/workspace.ts
 import { execFileSync } from "child_process";
@@ -322,7 +322,7 @@ async function cmdWorkspace(workspaceRoot = process.cwd(), args = ["workspace"])
     }
     if (unattachedCandidates.length > 0) {
       console.log("");
-      console.log("Start by attaching one app:");
+      console.log(projects.length > 0 ? "Attach another app:" : "Start by attaching one app:");
       console.log(`  ${unattachedCandidates[0].suggestedAdoptCommand}`);
     }
     return;

package/dist/{chunk-34TZXWIF.js → chunk-WONPNSSI.js}

@@ -1323,6 +1323,22 @@ var SKIP_DIRECTORIES = /* @__PURE__ */ new Set([
   ".cache"
 ]);
 var MAX_FILE_SIZE = 1024 * 1024;
+function isNonUiInteractionSource(relativePath) {
+  const normalized2 = relativePath.replace(/\\/g, "/");
+  if (/\.d\.ts$/i.test(normalized2)) return true;
+  if (/(?:^|\/)(?:__tests__|__mocks__|tests?|specs?|fixtures?|mocks?|stories?)(?:\/|$)/i.test(
+    normalized2
+  )) {
+    return true;
+  }
+  if (/\.(?:test|spec|stories?|story|fixture|mock)\.(?:[cm]?[jt]sx?|mdx|html)$/i.test(normalized2)) {
+    return true;
+  }
+  if (/^(?:src\/)?app\/api\//i.test(normalized2)) return true;
+  if (/^(?:src\/)?pages\/api\//i.test(normalized2)) return true;
+  if (/(?:^|\/)route\.[cm]?[jt]s$/i.test(normalized2)) return true;
+  return false;
+}
 function walkSourceTree(rootDir) {
   const sources = /* @__PURE__ */ new Map();
   function walk2(dir) {
@@ -1341,12 +1357,14 @@ function walkSourceTree(rootDir) {
       } catch {
         continue;
       }
+      const relativePath = relative3(rootDir, fullPath) || entry;
       if (s.isDirectory()) {
         walk2(fullPath);
       } else if (s.isFile() && SCAN_EXTENSIONS.has(extname2(entry))) {
         if (s.size > MAX_FILE_SIZE) continue;
+        if (isNonUiInteractionSource(relativePath)) continue;
         try {
-          sources.set(relative3(rootDir, fullPath) || entry, readFileSync8(fullPath, "utf8"));
+          sources.set(relativePath, readFileSync8(fullPath, "utf8"));
         } catch {
         }
       }

package/dist/{heal-2BDT7TR5.js → heal-ZQHEHBUJ.js}

@@ -1,7 +1,7 @@
 import {
   cmdHeal,
   collectCheckIssues
-} from "./chunk-34TZXWIF.js";
+} from "./chunk-WONPNSSI.js";
 export {
   cmdHeal,
   collectCheckIssues

package/dist/{health-MB63O56B.js → health-R7AV5G4V.js}

@@ -10,8 +10,8 @@ import {
   renderProjectHealthCiWorkflow,
   shouldFailHealth,
   writeProjectHealthCiWorkflow
-} from "./chunk-XZFKK6V7.js";
-import "./chunk-34TZXWIF.js";
+} from "./chunk-FACL3NXU.js";
+import "./chunk-WONPNSSI.js";
 export {
   cmdHealth,
   collectDesignTokenEvidence,

package/dist/index.js

@@ -1,5 +1,5 @@
-import "./chunk-VMNUJOEH.js";
+import "./chunk-GDGZFGMK.js";
 import "./chunk-RXF7ZYGK.js";
-import "./chunk-ARR3EPS2.js";
-import "./chunk-XZFKK6V7.js";
-import "./chunk-34TZXWIF.js";
+import "./chunk-VCUFZB45.js";
+import "./chunk-FACL3NXU.js";
+import "./chunk-WONPNSSI.js";

package/dist/{studio-6QGXJBVH.js → studio-2734P63C.js}

@@ -1,13 +1,13 @@
 import {
   createWorkspaceHealthReport
-} from "./chunk-ARR3EPS2.js";
+} from "./chunk-VCUFZB45.js";
 import {
   createProjectHealthReport
-} from "./chunk-XZFKK6V7.js";
+} from "./chunk-FACL3NXU.js";
 import {
   sendStudioHealthRefreshedTelemetry,
   sendStudioStartedTelemetry
-} from "./chunk-34TZXWIF.js";
+} from "./chunk-WONPNSSI.js";
 
 // src/commands/studio.ts
 import { readFileSync } from "fs";

package/dist/{workspace-OGFYJA4N.js → workspace-DRHTQ2NG.js}

@@ -7,9 +7,9 @@ import {
   listWorkspaceProjects,
   parseWorkspaceArgs,
   shouldFailWorkspaceHealth
-} from "./chunk-ARR3EPS2.js";
-import "./chunk-XZFKK6V7.js";
-import "./chunk-34TZXWIF.js";
+} from "./chunk-VCUFZB45.js";
+import "./chunk-FACL3NXU.js";
+import "./chunk-WONPNSSI.js";
 export {
   cmdWorkspace,
   createWorkspaceHealthReport,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decantr/cli",
-  "version": "2.9.3",
+  "version": "2.9.4",
   "description": "Decantr CLI - scaffold, audit, inspect Project Health, and maintain Decantr projects from the terminal",
   "keywords": [
     "decantr",
@@ -48,11 +48,11 @@
   },
   "dependencies": {
     "ajv": "^8.20.0",
+    "@decantr/core": "2.1.0",
     "@decantr/essence-spec": "2.0.1",
     "@decantr/registry": "2.2.0",
-    "@decantr/verifier": "2.3.3",
     "@decantr/telemetry": "2.2.1",
-    "@decantr/core": "2.1.0"
+    "@decantr/verifier": "2.3.3"
   },
   "scripts": {
     "build": "tsup",