@decohere/scaffold 0.0.1-dev.100

package/src/webapi/devcontainer/templates/initialize.sh

@@ -0,0 +1,169 @@
+#!/usr/bin/env bash
+# Runs on the host before the container is created (devcontainer initializeCommand).
+# Creates bind-mount sources as the host user so Docker does not create them as root.
+# Optional npm / gh / MCP setup is y/N on a TTY; no TTY skips.
+set -euo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=tty-prompt.sh
+source "$here/tty-prompt.sh"
+
+npm_dir="$root/.devcontainer/npm-auth"
+gh_dir="$root/.devcontainer/gh-auth"
+gh_env="$root/.devcontainer/gh.env"
+cursor_dir="$root/.cursor"
+RAG_ENV="$cursor_dir/codebase-rag.env"
+
+run_codebase_rag_mcp() {
+	local script="$here/codebase-rag-mcp.ts"
+	CODEBASE_RAG_WORKSPACE="$root" node --experimental-strip-types "$script" "$@"
+}
+
+load_rag_env() {
+	RAG_URL=""
+	RAG_TOKEN=""
+	[[ -f "$RAG_ENV" ]] || return 0
+	# shellcheck disable=SC1090
+	set -a
+	# shellcheck disable=SC1090
+	source "$RAG_ENV"
+	set +a
+	RAG_URL="${CODEBASE_RAG_MCP_URL:-}"
+	RAG_TOKEN="${CODEBASE_RAG_MCP_TOKEN:-}"
+}
+
+write_rag_env() {
+	mkdir -p "$(dirname "$RAG_ENV")"
+	umask 077
+	cat >"$RAG_ENV" <<EOF
+# Written by .devcontainer/initialize.sh. Not in git.
+CODEBASE_RAG_MCP_URL=${RAG_URL}
+CODEBASE_RAG_MCP_TOKEN=${RAG_TOKEN}
+CODEBASE_RAG_MCP_ROOT=${root}
+EOF
+	chmod 600 "$RAG_ENV"
+	if [[ -n "$RAG_URL" && -n "$RAG_TOKEN" ]]; then
+		run_codebase_rag_mcp merge || true
+	fi
+}
+
+seed_rag_from_host_mcp() {
+	local mcp="${HOME}/.cursor/mcp.json"
+	[[ -f "$mcp" ]] || return 1
+	command -v node >/dev/null 2>&1 || return 1
+	run_codebase_rag_mcp seed-print "$mcp"
+}
+
+ensure_cursor_dir() {
+	mkdir -p "$cursor_dir"
+}
+
+ensure_auth_dir() {
+	local dir="$1"
+	if ! mkdir -p "$dir" 2>/dev/null; then
+		echo "Cannot create $dir (permission denied)." >&2
+		echo "The scaffold container likely left .devcontainer root-owned. Fix with:" >&2
+		echo "  sudo chown -R \"$USER:$USER\" \"$root\"" >&2
+		exit 1
+	fi
+	{
+		echo "*"
+		echo "!.gitignore"
+	} >"$dir/.gitignore"
+}
+
+ensure_gh_env() {
+	if [[ -d "$gh_env" ]]; then
+		echo "Refusing to start: $gh_env is a directory (left by a prior bind mount). Remove it and rebuild." >&2
+		exit 1
+	fi
+	touch "$gh_env"
+}
+
+setup_npm_auth() {
+	if [[ -f "$npm_dir/.npmrc" ]]; then
+		echo "npm auth: using $npm_dir/.npmrc"
+		return 0
+	fi
+	if ! prompt_yn "Configure npm auth for this workspace?"; then
+		echo "npm auth: skipped"
+		return 0
+	fi
+	if [[ -f "${HOME}/.npmrc" ]]; then
+		cp -a "${HOME}/.npmrc" "$npm_dir/.npmrc"
+		echo "npm auth: copied ~/.npmrc → $npm_dir/.npmrc"
+		return 0
+	fi
+	echo "npm auth: no ~/.npmrc — log in inside the container if prompted"
+}
+
+setup_gh_auth() {
+	if [[ -f "$gh_dir/hosts.yml" ]]; then
+		echo "gh auth: using $gh_dir/hosts.yml"
+		return 0
+	fi
+	if ! prompt_yn "Configure GitHub CLI auth for this workspace?"; then
+		echo "gh auth: skipped"
+		return 0
+	fi
+	if [[ -f "${HOME}/.config/gh/hosts.yml" ]]; then
+		cp -a "${HOME}/.config/gh/hosts.yml" "$gh_dir/hosts.yml"
+		[[ -f "${HOME}/.config/gh/config.yml" ]] &&
+			cp -a "${HOME}/.config/gh/config.yml" "$gh_dir/config.yml"
+		echo "gh auth: copied ~/.config/gh → $gh_dir"
+		return 0
+	fi
+	echo "gh auth: no ~/.config/gh/hosts.yml — log in inside the container if prompted"
+}
+
+setup_codebase_rag_env() {
+	load_rag_env
+	if [[ -n "$RAG_URL" && -n "$RAG_TOKEN" ]]; then
+		write_rag_env
+		echo "codebase-rag MCP: using $RAG_ENV"
+		return 0
+	fi
+
+	local seeded
+	if seeded="$(seed_rag_from_host_mcp 2>/dev/null)"; then
+		if prompt_yn "Found codebase-rag in ~/.cursor/mcp.json. Use it for this workspace?" y; then
+			RAG_URL="$(printf '%s\n' "$seeded" | sed -n '1p')"
+			RAG_TOKEN="$(printf '%s\n' "$seeded" | sed -n '2p')"
+			write_rag_env
+			echo "codebase-rag MCP: imported HTTP server from ~/.cursor/mcp.json → $RAG_ENV"
+			return 0
+		fi
+	fi
+
+	if ! prompt_yn "Configure codebase RAG MCP (semantic search)?"; then
+		RAG_URL=""
+		RAG_TOKEN=""
+		write_rag_env
+		echo "codebase-rag MCP: skipped"
+		return 0
+	fi
+
+	printf '%s\n' "Empty URL skips. Example: https://rag.example.com/mcp" >/dev/tty
+	printf '%s' "MCP URL: " >/dev/tty
+	read_tty RAG_URL
+	RAG_URL="$(printf '%s' "$RAG_URL" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
+	if [[ -z "$RAG_URL" ]]; then
+		RAG_TOKEN=""
+		write_rag_env
+		echo "codebase-rag MCP: skipped"
+		return 0
+	fi
+	printf '%s' "Bearer token (hidden): " >/dev/tty
+	read_tty RAG_TOKEN hidden
+	write_rag_env
+	echo "codebase-rag MCP: saved $RAG_ENV"
+}
+
+ensure_auth_dir "$npm_dir"
+ensure_auth_dir "$gh_dir"
+ensure_gh_env
+ensure_cursor_dir
+setup_npm_auth
+setup_gh_auth
+setup_codebase_rag_env

package/src/webapi/devcontainer/templates/post-create.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Runs after container create and when workspace content updates
+# (devcontainer postCreateCommand / updateContentCommand).
+# Installs deps when missing or when the lockfile changed; skips otherwise.
+set -euo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$root"
+
+lockfile="pnpm-lock.yaml"
+stamp="node_modules/.decohere-pnpm-lock.sha"
+
+current_hash=""
+if [[ -f "$lockfile" ]]; then
+	current_hash="$(sha256sum "$lockfile" | awk '{print $1}')"
+elif [[ -f package.json ]]; then
+	current_hash="$(sha256sum package.json | awk '{print $1}')"
+fi
+
+if [[ -d node_modules/.bin ]] && [[ -n "$current_hash" ]] && [[ -f "$stamp" ]] && [[ "$(cat "$stamp")" == "$current_hash" ]]; then
+	echo "node_modules: up to date, skipping pnpm install"
+	exit 0
+fi
+
+echo "node_modules: installing dependencies (first create may take a while)..."
+if [[ -f "$lockfile" ]]; then
+	pnpm install --frozen-lockfile
+else
+	pnpm install
+fi
+
+if [[ -n "$current_hash" ]]; then
+	mkdir -p node_modules
+	printf '%s\n' "$current_hash" >"$stamp"
+fi

package/src/webapi/devcontainer/templates/post-start.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# Runs on every container start (devcontainer postStartCommand).
+# Optional npm / gh login is y/N on a TTY. Install is post-create.sh.
+# MCP merge also runs here for later reconnects; the Compose service command
+# merges before Cursor attaches (postStart is too late for the first snapshot).
+set -euo pipefail
+
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+root="$(cd "$here/.." && pwd)"
+# shellcheck source=tty-prompt.sh
+source "$here/tty-prompt.sh"
+
+CODEBASE_RAG_WORKSPACE="$root" node --experimental-strip-types "$here/codebase-rag-mcp.ts" merge ||
+	echo "codebase-rag MCP: merge skipped" >&2
+
+AUTH_REGISTRY="https://registry.npmjs.org"
+
+ensure_npm_auth() {
+	if npm whoami --registry "$AUTH_REGISTRY" >/dev/null 2>&1; then
+		echo "npm: logged in as $(npm whoami --registry "$AUTH_REGISTRY")"
+		return 0
+	fi
+
+	if prompt_yn "Log in to npm?"; then
+		echo "npm: starting login..."
+		npm login --registry "$AUTH_REGISTRY" </dev/tty >/dev/tty
+		return 0
+	fi
+
+	echo "npm: skipped. Open a terminal and run: npm login" >&2
+	echo "    (creds persist in .devcontainer/npm-auth/)" >&2
+	return 1
+}
+
+ensure_gh_auth() {
+	if ! command -v gh >/dev/null 2>&1; then
+		echo "gh: not installed in this container" >&2
+		return 1
+	fi
+
+	if gh auth status >/dev/null 2>&1; then
+		echo "gh: $(gh auth status 2>&1 | head -n1)"
+		return 0
+	fi
+
+	local token="${GH_TOKEN:-${GITHUB_TOKEN:-}}"
+	if [[ -n "$token" ]]; then
+		echo "gh: authenticating from GH_TOKEN..."
+		printf '%s\n' "$token" | gh auth login --with-token
+		return 0
+	fi
+
+	if prompt_yn "Log in to GitHub CLI (gh)?"; then
+		echo "gh: starting login..."
+		gh auth login </dev/tty >/dev/tty
+		return 0
+	fi
+
+	echo "gh: skipped. Open a terminal and run: gh auth login" >&2
+	echo "    (creds persist in .devcontainer/gh-auth/; or set GH_TOKEN in .devcontainer/gh.env)" >&2
+	return 1
+}
+
+ensure_npm_auth || true
+ensure_gh_auth || true

package/src/webapi/devcontainer/templates/tty-prompt.sh

@@ -0,0 +1,38 @@
+can_prompt() {
+	[[ -r /dev/tty && -w /dev/tty ]]
+}
+
+read_tty() {
+	local var="$1"
+	local hidden="${2:-}"
+	local value=""
+	if [[ -n "$hidden" ]]; then
+		read -r -s value </dev/tty || true
+		printf '\n' >/dev/tty
+	else
+		read -r value </dev/tty || true
+	fi
+	printf -v "$var" '%s' "$value"
+}
+
+# Returns 0 for yes. Default is n unless the second argument is y.
+prompt_yn() {
+	local question="$1"
+	local default="${2:-n}"
+	local reply=""
+	if ! can_prompt; then
+		return 1
+	fi
+	local hint="y/N"
+	if [[ "$default" == "y" ]]; then
+		hint="Y/n"
+	fi
+	printf '%s [%s] ' "$question" "$hint" >/dev/tty
+	read_tty reply
+	reply="$(printf '%s' "$reply" | tr '[:upper:]' '[:lower:]' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
+	if [[ -z "$reply" ]]; then
+		[[ "$default" == "y" ]]
+		return
+	fi
+	[[ "$reply" == "y" || "$reply" == "yes" ]]
+}

package/types/src/add-api.action.d.ts

@@ -0,0 +1,13 @@
+import { type Action, ActionResponse } from "@decohere/nexus/cli";
+export type AddApiOptions = {
+    apiName?: string;
+    d?: string;
+    database?: string;
+    auth?: string;
+    postman?: string;
+    yes?: boolean;
+    install?: string;
+};
+export declare class AddApiAction implements Action<AddApiOptions> {
+    run(options: AddApiOptions): Promise<ActionResponse>;
+}

package/types/src/add-api.command.d.ts

@@ -0,0 +1,7 @@
+import { DecohereCommand } from "@decohere/nexus/cli";
+import { AddApiAction } from "./add-api.action.js";
+export declare class AddApiCommand extends DecohereCommand {
+    get actions(): (typeof AddApiAction)[];
+    constructor(name: string);
+    action(fn: (...args: unknown[]) => void | Promise<void>): this;
+}

package/types/src/add.command.d.ts

@@ -0,0 +1,6 @@
+import type { Actions } from "@decohere/nexus/cli";
+import { type CommandHandler, type CommandResponse, type CommandType, DecohereCommand } from "@decohere/nexus/cli";
+export declare class AddCommand extends DecohereCommand {
+    constructor(commands: Record<string, CommandType>, handler: CommandHandler);
+    run(_actions: Actions, _options: never): Promise<CommandResponse>;
+}

package/types/src/add.module.d.ts

@@ -0,0 +1,14 @@
+import { ModuleManifest } from "@decohere/nexus/cli";
+import { AddCommand } from "./add.command.js";
+import { AddApiAction } from "./add-api.action.js";
+import { AddApiCommand } from "./add-api.command.js";
+export declare class AddModule extends ModuleManifest {
+    readonly id = "add";
+    readonly command: typeof AddCommand;
+    readonly commands: {
+        api: typeof AddApiCommand;
+    };
+    readonly actions: {
+        api: typeof AddApiAction;
+    };
+}

package/types/src/auth0-configure.action.d.ts

@@ -0,0 +1,7 @@
+import { type Action, ActionResponse } from "@decohere/nexus/cli";
+export type Auth0ConfigureOptions = {
+    d?: string;
+};
+export declare class Auth0ConfigureAction implements Action<Auth0ConfigureOptions> {
+    run(options: Auth0ConfigureOptions): Promise<ActionResponse>;
+}

package/types/src/auth0-configure.command.d.ts

@@ -0,0 +1,6 @@
+import { DecohereCommand } from "@decohere/nexus/cli";
+import { Auth0ConfigureAction } from "./auth0-configure.action.js";
+export declare class Auth0ConfigureCommand extends DecohereCommand {
+    get actions(): (typeof Auth0ConfigureAction)[];
+    constructor(name: string);
+}

package/types/src/auth0-login.action.d.ts

@@ -0,0 +1,4 @@
+import { type Action, ActionResponse } from "@decohere/nexus/cli";
+export declare class Auth0LoginAction implements Action {
+    run(): Promise<ActionResponse>;
+}

package/types/src/auth0-login.command.d.ts

@@ -0,0 +1,6 @@
+import { DecohereCommand } from "@decohere/nexus/cli";
+import { Auth0LoginAction } from "./auth0-login.action.js";
+export declare class Auth0LoginCommand extends DecohereCommand {
+    get actions(): (typeof Auth0LoginAction)[];
+    constructor(name: string);
+}

package/types/src/auth0.command.d.ts

@@ -0,0 +1,6 @@
+import type { Actions } from "@decohere/nexus/cli";
+import { type CommandHandler, type CommandResponse, type CommandType, DecohereCommand } from "@decohere/nexus/cli";
+export declare class Auth0Command extends DecohereCommand {
+    constructor(commands: Record<string, CommandType>, handler: CommandHandler);
+    run(_actions: Actions, _options: never): Promise<CommandResponse>;
+}

package/types/src/auth0.module.d.ts

@@ -0,0 +1,18 @@
+import { ModuleManifest } from "@decohere/nexus/cli";
+import { Auth0Command } from "./auth0.command.js";
+import { Auth0ConfigureAction } from "./auth0-configure.action.js";
+import { Auth0ConfigureCommand } from "./auth0-configure.command.js";
+import { Auth0LoginAction } from "./auth0-login.action.js";
+import { Auth0LoginCommand } from "./auth0-login.command.js";
+export declare class Auth0Module extends ModuleManifest {
+    readonly id = "auth0";
+    readonly command: typeof Auth0Command;
+    readonly commands: {
+        login: typeof Auth0LoginCommand;
+        configure: typeof Auth0ConfigureCommand;
+    };
+    readonly actions: {
+        login: typeof Auth0LoginAction;
+        configure: typeof Auth0ConfigureAction;
+    };
+}

package/types/src/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/types/src/create.command.d.ts

@@ -0,0 +1,6 @@
+import type { Actions } from "@decohere/nexus/cli";
+import { type CommandHandler, type CommandResponse, type CommandType, DecohereCommand } from "@decohere/nexus/cli";
+export declare class CreateCommand extends DecohereCommand {
+    constructor(commands: Record<string, CommandType>, handler: CommandHandler);
+    run(_actions: Actions, _options: never): Promise<CommandResponse>;
+}

package/types/src/create.module.d.ts

@@ -0,0 +1,14 @@
+import { ModuleManifest } from "@decohere/nexus/cli";
+import { CreateCommand } from "./create.command.js";
+import { WebapiAction } from "./webapi.action.js";
+import { WebapiCommand } from "./webapi.command.js";
+export declare class CreateModule extends ModuleManifest {
+    readonly id = "create";
+    readonly command: typeof CreateCommand;
+    readonly commands: {
+        webapi: typeof WebapiCommand;
+    };
+    readonly actions: {
+        webapi: typeof WebapiAction;
+    };
+}

package/types/src/domain/prompt.d.ts

@@ -0,0 +1,4 @@
+/** Release stdin so the process can exit after interactive prompts. */
+export declare function closePrompt(): void;
+export declare function ask(question: string, fallback?: string): Promise<string>;
+export declare function pick<T>(label: string, items: T[], display: (item: T) => string): Promise<T | null>;

package/types/src/index.d.ts

@@ -0,0 +1,13 @@
+export { AddModule } from "./add.module.js";
+export type { AddApiOptions } from "./add-api.action.js";
+export { AddApiAction } from "./add-api.action.js";
+export { Auth0Module } from "./auth0.module.js";
+export type { Auth0ConfigureOptions } from "./auth0-configure.action.js";
+export { Auth0ConfigureAction } from "./auth0-configure.action.js";
+export { Auth0LoginAction } from "./auth0-login.action.js";
+export { CreateModule } from "./create.module.js";
+export { runCli } from "./program.js";
+export type { ApiOptions } from "./webapi/create-api.js";
+export { scaffoldApi } from "./webapi/create-api.js";
+export type { WebapiOptions } from "./webapi.action.js";
+export { WebapiAction } from "./webapi.action.js";

package/types/src/models/compose.model.d.ts

@@ -0,0 +1,73 @@
+import type { KeyedModel } from "./source-file.js";
+export type ComposeNetworkRef = string | {
+    /** Network key under `networks:` on this service */
+    [networkKey: string]: {
+        aliases?: string[];
+    };
+};
+export interface ComposeHealthcheck {
+    test: string[];
+    interval?: string;
+    timeout?: string;
+    retries?: number;
+}
+export interface ComposeService {
+    build?: string;
+    image?: string;
+    container_name?: string;
+    /** Quoted in YAML (`0:0` must not parse as a number). */
+    user?: string;
+    env_file?: string[];
+    environment?: Record<string, string>;
+    ports?: string[];
+    volumes?: string[];
+    command?: string;
+    restart?: string;
+    depends_on?: string[];
+    /** Compose profiles (service only starts when profile is enabled). */
+    profiles?: string[];
+    /** Attach to compose networks (string name or map with aliases). */
+    networks?: ComposeNetworkRef[];
+    healthcheck?: ComposeHealthcheck;
+}
+export type ComposeNetwork = {
+    /** Fixed Docker network name (shareable across compose projects). */
+    name: string;
+    external?: boolean;
+};
+/**
+ * Live builder for `docker-compose.yml`.
+ *
+ * Features call `addService` / `addVolume` / `addNetwork` in their scaffold phases.
+ * Loaded with `fromFile` (`decohere add api`), additions merge into the existing file:
+ * services, networks and volumes already there are left untouched, comments kept.
+ */
+export declare class DockerCompose implements KeyedModel {
+    readonly key: string;
+    private _projectName;
+    private readonly _headerComments;
+    private readonly _services;
+    private readonly _volumes;
+    private readonly _networks;
+    private readonly _envFiles;
+    private _existing;
+    /** Load an existing compose file so `decohere add api` can merge into it. */
+    static fromFile(absolutePath: string): DockerCompose;
+    /** True when the service is defined (in the loaded file or added since). */
+    hasService(name: string): boolean;
+    /** Compose project name (`name:` top-level) — isolates containers/volumes. */
+    setProjectName(name: string): this;
+    /** File-level `#` comments rendered above `name:` / `services:`. */
+    addHeaderComment(...lines: string[]): this;
+    addService(name: string, config: ComposeService): this;
+    files(): {
+        filePath: string;
+        content: string;
+    }[];
+    addVolume(name: string): this;
+    addNetwork(key: string, network: ComposeNetwork): this;
+    /** Append an env_file path to an existing service. */
+    addEnvFile(serviceName: string, filePath: string): this;
+    getContent(): string;
+    private mergeIntoExisting;
+}

package/types/src/models/config-yaml.model.d.ts

@@ -0,0 +1,27 @@
+import type { KeyedModel, SourceFile } from "./source-file.js";
+/**
+ * Builder for a YAML config file (e.g. config/config.yaml or config/config.dev.yaml).
+ *
+ * Starts with a base section passed to the constructor. Features call
+ * `addSection(yaml)` during their scaffold phase to append their own block.
+ * `files()` joins all sections with a blank line separator.
+ */
+export declare class ConfigYaml implements KeyedModel {
+    readonly key: string;
+    private readonly filePath;
+    private readonly _sections;
+    constructor(key: string, filePath: string, baseContent: string);
+    addSection(yaml: string): this;
+    /** True when a datasource with this `name:` already appears in the file. */
+    hasDataSource(name: string): boolean;
+    hasDataSources(): boolean;
+    /**
+     * Insert a `dataSources` list item. Used by `webapi add` so we do not write a
+     * second top-level `database:` key (YAML last-key-wins).
+     */
+    appendDataSource(item: string): this;
+    static fromFile(key: string, relativePath: string, absolutePath: string): ConfigYaml;
+    files(): SourceFile[];
+}
+/** Insert a YAML list item under `dataSources:`; append a new `database:` block if missing. */
+export declare function injectYamlDataSource(yaml: string, item: string): string;

package/types/src/models/const.d.ts

@@ -0,0 +1,20 @@
+export declare const WELL_KNOWN_FILES: {
+    VSCODE_SETTINGS: string;
+    LAUNCH_JSON: string;
+    DOCKER_COMPOSE: string;
+    DEVCONTAINER_JSON: string;
+    DOCKERFILE: string;
+    PRODUCTION_DOCKERFILE: string;
+    GITHUB_CI: string;
+    PACKAGE_JSON: string;
+    API_PACKAGE_JSON: string;
+    TSCONFIG: string;
+    VITEST_CONFIG: string;
+    MAIN_TS: string;
+    CONTROLLER_TS: string;
+    CONFIG_YAML: string;
+    CONFIG_DEV_YAML: string;
+    GITIGNORE: string;
+    AUTH_CONFIG: string;
+    ENV_FILE: string;
+};

package/types/src/models/dev-container.model.d.ts

@@ -0,0 +1,49 @@
+import type { KeyedModel, SourceFile } from "./source-file.js";
+/**
+ * Model for `.devcontainer/devcontainer.json`.
+ *
+ * Features call builder methods (`addExtension`, `forwardPort`, etc.) during
+ * their configure phase. `MonoRepoScaffold` calls `files()` at render time.
+ */
+export type PortAttributes = {
+    label?: string;
+    /** When true, host port must match the container port (no random remap). */
+    requireLocalPort?: boolean;
+    onAutoForward?: "notify" | "openBrowser" | "openPreview" | "silent" | "ignore";
+};
+export declare class DevContainer implements KeyedModel {
+    readonly key: string;
+    private readonly _extensions;
+    private readonly _ports;
+    private readonly _portAttributes;
+    private _mounts;
+    private _workspaceFolder;
+    private _postCreateCommand?;
+    private _updateContentCommand?;
+    private _postStartCommand?;
+    private _initializeCommand?;
+    private _remoteUser;
+    private _useCompose;
+    private _existing;
+    /**
+     * Load an existing devcontainer.json so `decohere add api` can merge into it.
+     * Only extensions, forwarded ports and port attributes are merged; everything else is kept.
+     */
+    static fromFile(absolutePath: string): DevContainer;
+    constructor();
+    /** In-container path Cursor/VS Code opens (Agents window uses the basename). */
+    setWorkspaceFolder(folder: string): this;
+    private bindMount;
+    addExtension(...ids: string[]): this;
+    forwardPort(...ports: number[]): this;
+    setPortAttributes(port: number, attrs: PortAttributes): this;
+    setPostCreateCommand(cmd: string): this;
+    setUpdateContentCommand(cmd: string): this;
+    setPostStartCommand(cmd: string): this;
+    setInitializeCommand(cmd: string): this;
+    setRemoteUser(user: string): this;
+    useCompose(): this;
+    files(): SourceFile[];
+    private mergeIntoExisting;
+    private build;
+}