@decohere/scaffold 0.0.1-dev.126 → 0.0.1-dev.80

package/types/src/models/docker-image.model.d.ts

@@ -59,13 +59,7 @@ export declare class DockerfileModel implements KeyedModel {
     private readonly _layerWriters;
     private _fromImage;
     private _layerCounter;
-    private _existing;
     constructor(baseImage: string);
-    /**
-     * Load an existing Dockerfile so `decohere add api` can append feature layers.
-     * The new steps are appended as one block, unless the file already contains it.
-     */
-    static fromFile(absolutePath: string, filePath: string): DockerfileModel;
     from(baseImage: string): this;
     addLayer(layer: LayerWriter | string, order?: 5000): this;
     addStep(step: DockerStep): this;

package/types/src/models/gitignore.model.d.ts

@@ -2,8 +2,6 @@ import type { KeyedModel, SourceFile } from "./source-file.js";
 export declare class Gitignore implements KeyedModel {
     readonly key: string;
     private ignoreList;
-    /** Load an existing .gitignore so `decohere add api` appends instead of replacing. */
-    static fromFile(absolutePath: string): Gitignore;
     add(...patterns: string[]): this;
     files(): SourceFile[];
 }

package/types/src/models/package-json.model.d.ts

@@ -33,4 +33,3 @@ export declare class PackageJson implements KeyedModel {
 }
 /** Stable A→Z key order for package.json dependency maps. */
 export declare function sortStringMap(map: Record<string, string>): Record<string, string>;
-export declare function packageScript(workspaceName: string, apiName: string): string;

package/types/src/program.d.ts

@@ -1,8 +1,3 @@
 import { Command } from "commander";
 export declare function createProgram(): Command;
-/**
- * Runs the CLI and returns its exit code; the bin (`cli.ts`) exits with it. Returning instead
- * of calling `process.exit` here lets tests run it in process: a run that finished after its
- * test had timed out used to call `process.exit` in whichever test came next.
- */
-export declare function runCli(argv?: string[]): Promise<number>;
+export declare function runCli(argv?: string[]): Promise<void>;

package/types/src/webapi/const.d.ts

@@ -7,8 +7,6 @@ export declare function webapiProjectDir(name: string): string;
  * Keep in sync with root `package.json` `"start"` / `"start:<name>"` and Dockerfiles.
  */
 export declare function webapiReleaseEntry(name: string): string;
-/** The same entry inside `.package/` (`forge package`), which is what the Dockerfile runs. */
-export declare function webapiPackagedEntry(): string;
 /** npm package name for a scaffolded API (`flux serve --project`). */
 export declare function webapiPackageName(workspaceName: string, apiName: string): string;
 /** Local listen port for the nth API (0-based). Production uses `PORT`. */

package/types/src/webapi/create-api.d.ts

@@ -1,7 +1,7 @@
 export { WEBAPI_PROJECT_DIR, WEBAPI_RELEASE_ENTRY } from "./const.js";
 export type ApiOptions = {
     d?: string;
-    /** Host project name (directory basename). Required when scaffolding into the create-builder `/workspace` mount. */
+    /** Host project name (directory basename). Required when scaffolding into `/workspace`. */
     projectName?: string;
     /** API slugs under `projects/`. Default `["api"]`. Repeatable `--name`. */
     names?: string[];

package/types/src/webapi/features/auth0-cli.d.ts

@@ -12,7 +12,6 @@ export interface Auth0Tenant {
 }
 export declare function isInstalled(): boolean;
 export declare function listTenants(): Auth0Tenant[];
-/** Device/URL login (`--no-input`) so Docker can print a host-browser URL. */
 export declare function login(): boolean;
 export declare function listApis(): Array<{
     identifier: string;
@@ -21,9 +20,6 @@ export declare function listApis(): Array<{
 export declare function createApi(name: string, identifier: string, scopes?: readonly string[]): {
     identifier: string;
 };
-export declare function listApiScopes(identifier: string): string[];
-/** Assign API permissions to a user (Authorization Core). Idempotent when already granted. */
-export declare function assignUserPermissions(userId: string, audience: string, permissions: readonly string[]): void;
 /**
  * Replace an API's scopes and enable RBAC policy enforcement.
  * Auth0 CLI `--scopes` replaces the full set.

package/types/src/webapi/models/api-package-json.model.d.ts

@@ -2,7 +2,7 @@ import type { KeyedModel, SourceFile } from "../../models/source-file.js";
 /**
  * Builder for `projects/<api>/package.json`.
  *
- * Starts with the core `@decohere/http` + `@decohere/crucible` deps. Features can call
+ * Starts with the core cortex + crucible deps. Features can call
  * `addDependency` / `addDevDependency` to extend.
  */
 export declare class ApiPackageJson implements KeyedModel {

package/types/src/webapi/models/controller-source-file.model.d.ts

@@ -29,14 +29,14 @@ export declare class ControllerSourceFile implements KeyedModel {
     private readonly _cortexImports;
     private readonly _extraImportGroups;
     private readonly _classDecorators;
-    /** Explicit @inject(SampleService): using the class as a value keeps its import, which SWC can drop when the class is only a type (design:paramtypes then collapses to Object). */
+    /** Explicit @inject — design:paramtypes can collapse to Object under SWC when the class is still undefined at decorate time. */
     private readonly _ctorParams;
     private readonly _methods;
     /** Retrieve a method by name to mutate its decorators. */
     getMethod(name: string): ControllerMethod;
     /** Add a class-level decorator (e.g. `@Authorize`). */
     addDecorator(decorator: string): this;
-    /** Add a named import from `@decohere/http`. */
+    /** Add a named import from `@decohere/cortex`. */
     addCortexImport(name: string, typeOnly?: boolean): this;
     /** Add a named import from any other module. */
     addImport(name: string, from: string, typeOnly?: boolean): this;

package/types/src/webapi/models/main-source-file.model.d.ts

@@ -25,7 +25,7 @@ export declare class MainSourceFile implements KeyedModel {
     private _dataSourceName;
     private _typeOrmSeed;
     constructor(appName: string);
-    /** Adds a bare side-effect import, e.g. `@decohere/http/auth`. */
+    /** Adds a bare side-effect import, e.g. `@decohere/cortex/auth`. */
     addSideEffectImport(path: string): this;
     /** Adds a named import, e.g. `import { Foo } from "bar"`. */
     addImport(name: string, from: string, typeOnly?: boolean): this;

package/types/src/webapi/models/production-dockerfile.model.d.ts

@@ -1,18 +1,23 @@
 import type { KeyedModel, SourceFile } from "../../models/source-file.js";
+export type ProductionDockerfileOptions = {
+    /** When true, only write `Dockerfile.<name>` (existing workspace — do not replace root Dockerfile). */
+    namedOnly?: boolean;
+};
 /**
- * Production Dockerfile for each API, in the API's own folder: `projects/<name>/Dockerfile`.
- * That is where `forge docker` and `forge package` look for a deployable, and the folder is
- * the Docker build context.
+ * Production Dockerfiles for PaaS (Railway/Fly) and local `docker build`.
  *
- * The image copies `.package/`, which `forge package` writes before Docker runs: the API's
- * compiled code, the workspace libraries it imports, and a real (symlink-free) `node_modules`
- * of the third-party packages it reaches. So the image build installs nothing, runs no
- * workspace tooling, and needs no npm token.
+ * Context is always the **repo root** (`docker build -f Dockerfile.billing .`).
+ * Root `Dockerfile` is the first API (`pnpm start`). Extra or custom-named APIs
+ * also get `Dockerfile.<name>` so each service can be deployed on its own.
+ *
+ * Runtime `node_modules` come from a **prod-deps** stage (`pnpm install --prod`),
+ * not the full build install (Forge, TypeScript, Biome, Vitest).
  */
 export declare class WebapiProductionDockerfile implements KeyedModel {
     private readonly apiNames;
+    private readonly options;
     readonly key: string;
-    constructor(apiNames?: readonly string[]);
+    constructor(apiNames?: readonly string[], options?: ProductionDockerfileOptions);
     files(): SourceFile[];
 }
-export declare function renderProductionDockerfile(apiName: string): string;
+export declare function renderProductionDockerfile(apiName: string, startScript: string): string;

package/types/src/webapi.action.d.ts

@@ -1,4 +1,4 @@
-import { type Action, ActionResponse } from "@decohere/devkit/cli";
+import { type Action, ActionResponse } from "@decohere/nexus/cli";
 export type WebapiOptions = {
     directory?: string;
     d?: string;

package/types/src/webapi.command.d.ts

@@ -1,4 +1,4 @@
-import { DecohereCommand } from "@decohere/devkit/cli";
+import { DecohereCommand } from "@decohere/nexus/cli";
 import { WebapiAction } from "./webapi.action.js";
 export declare class WebapiCommand extends DecohereCommand {
     get actions(): (typeof WebapiAction)[];

package/LICENSE

@@ -1,15 +0,0 @@
-ISC License
-
-Copyright (c) 2025-2026 Typesmiths
-
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

package/commonjs/src/auth0-configure.action.js

@@ -1,28 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "Auth0ConfigureAction", {
-    enumerable: true,
-    get: function() {
-        return Auth0ConfigureAction;
-    }
-});
-const _decorators = require("@decohere/crucible/decorators");
-const _cli = require("@decohere/devkit/cli");
-const _auth0commands = require("./webapi/auth0-commands.js");
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-class Auth0ConfigureAction {
-    async run(options) {
-        (0, _auth0commands.runAuth0Configure)(typeof options.d === "string" ? options.d : ".");
-        return _cli.ActionResponse.Success("configure");
-    }
-}
-Auth0ConfigureAction = _ts_decorate([
-    (0, _decorators.injectable)()
-], Auth0ConfigureAction);

package/commonjs/src/auth0-configure.command.js

@@ -1,24 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "Auth0ConfigureCommand", {
-    enumerable: true,
-    get: function() {
-        return Auth0ConfigureCommand;
-    }
-});
-const _cli = require("@decohere/devkit/cli");
-const _auth0configureaction = require("./auth0-configure.action.js");
-class Auth0ConfigureCommand extends _cli.DecohereCommand {
-    get actions() {
-        return [
-            _auth0configureaction.Auth0ConfigureAction
-        ];
-    }
-    constructor(name){
-        super(name);
-        this.description("Update Auth0 API permissions and Postman SPA from @Authorize in this workspace");
-        this.option("-d <directory>", "Workspace directory (default: current directory)", ".");
-    }
-}

package/commonjs/src/auth0-login.action.js

@@ -1,28 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "Auth0LoginAction", {
-    enumerable: true,
-    get: function() {
-        return Auth0LoginAction;
-    }
-});
-const _decorators = require("@decohere/crucible/decorators");
-const _cli = require("@decohere/devkit/cli");
-const _auth0commands = require("./webapi/auth0-commands.js");
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-class Auth0LoginAction {
-    async run() {
-        (0, _auth0commands.runAuth0Login)();
-        return _cli.ActionResponse.Success("login");
-    }
-}
-Auth0LoginAction = _ts_decorate([
-    (0, _decorators.injectable)()
-], Auth0LoginAction);

package/commonjs/src/auth0-login.command.js

@@ -1,23 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "Auth0LoginCommand", {
-    enumerable: true,
-    get: function() {
-        return Auth0LoginCommand;
-    }
-});
-const _cli = require("@decohere/devkit/cli");
-const _auth0loginaction = require("./auth0-login.action.js");
-class Auth0LoginCommand extends _cli.DecohereCommand {
-    get actions() {
-        return [
-            _auth0loginaction.Auth0LoginAction
-        ];
-    }
-    constructor(name){
-        super(name);
-        this.description("Authenticate the Auth0 CLI (device URL; tokens persist on the host)");
-    }
-}

package/commonjs/src/auth0.command.js

@@ -1,22 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "Auth0Command", {
-    enumerable: true,
-    get: function() {
-        return Auth0Command;
-    }
-});
-const _cli = require("@decohere/devkit/cli");
-class Auth0Command extends _cli.DecohereCommand {
-    constructor(commands, handler){
-        super(Auth0Command);
-        this.description("Log in to Auth0 and update a scaffolded client");
-        this.exitOverride();
-        this.registerSubcommand(commands, handler);
-    }
-    run(_actions, _options) {
-        return this.help();
-    }
-}

package/commonjs/src/auth0.module.js

@@ -1,28 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "Auth0Module", {
-    enumerable: true,
-    get: function() {
-        return Auth0Module;
-    }
-});
-const _cli = require("@decohere/devkit/cli");
-const _auth0command = require("./auth0.command.js");
-const _auth0configureaction = require("./auth0-configure.action.js");
-const _auth0configurecommand = require("./auth0-configure.command.js");
-const _auth0loginaction = require("./auth0-login.action.js");
-const _auth0logincommand = require("./auth0-login.command.js");
-class Auth0Module extends _cli.ModuleManifest {
-    id = "auth0";
-    command = _auth0command.Auth0Command;
-    commands = {
-        login: _auth0logincommand.Auth0LoginCommand,
-        configure: _auth0configurecommand.Auth0ConfigureCommand
-    };
-    actions = {
-        login: _auth0loginaction.Auth0LoginAction,
-        configure: _auth0configureaction.Auth0ConfigureAction
-    };
-}

package/commonjs/src/webapi/auth0-commands.js

@@ -1,250 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-function _export(target, all) {
-    for(var name in all)Object.defineProperty(target, name, {
-        enumerable: true,
-        get: Object.getOwnPropertyDescriptor(all, name).get
-    });
-}
-_export(exports, {
-    get AUTH0_CLI_INSTALL_MESSAGE () {
-        return AUTH0_CLI_INSTALL_MESSAGE;
-    },
-    get ensureLoggedIn () {
-        return ensureLoggedIn;
-    },
-    get requireInstalled () {
-        return requireInstalled;
-    },
-    get runAuth0Configure () {
-        return runAuth0Configure;
-    },
-    get runAuth0Login () {
-        return runAuth0Login;
-    }
-});
-const _nodefs = require("node:fs");
-const _nodepath = require("node:path");
-const _apiname = require("./api-name.js");
-const _authorizescopes = require("./authorize-scopes.js");
-const _auth0cli = /*#__PURE__*/ _interop_require_wildcard(require("./features/auth0-cli.js"));
-function _getRequireWildcardCache(nodeInterop) {
-    if (typeof WeakMap !== "function") return null;
-    var cacheBabelInterop = new WeakMap();
-    var cacheNodeInterop = new WeakMap();
-    return (_getRequireWildcardCache = function(nodeInterop) {
-        return nodeInterop ? cacheNodeInterop : cacheBabelInterop;
-    })(nodeInterop);
-}
-function _interop_require_wildcard(obj, nodeInterop) {
-    if (!nodeInterop && obj && obj.__esModule) {
-        return obj;
-    }
-    if (obj === null || typeof obj !== "object" && typeof obj !== "function") {
-        return {
-            default: obj
-        };
-    }
-    var cache = _getRequireWildcardCache(nodeInterop);
-    if (cache && cache.has(obj)) {
-        return cache.get(obj);
-    }
-    var newObj = {
-        __proto__: null
-    };
-    var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor;
-    for(var key in obj){
-        if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) {
-            var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null;
-            if (desc && (desc.get || desc.set)) {
-                Object.defineProperty(newObj, key, desc);
-            } else {
-                newObj[key] = obj[key];
-            }
-        }
-    }
-    newObj.default = obj;
-    if (cache) {
-        cache.set(obj, newObj);
-    }
-    return newObj;
-}
-/** Same Postman OAuth callbacks as `PostmanFeature`. */ const POSTMAN_CALLBACKS = [
-    "https://oauth.pstmn.io/v1/callback",
-    "https://oauth.pstmn.io/v1/browser-callback"
-];
-const SPA_SUFFIX = " Postman";
-const AUTH0_CLI_INSTALL_MESSAGE = "The Auth0 CLI is required.\n" + "  It is bundled in the Decohere create image (`npx @decohere/create auth0 login`).\n" + "  Host install: brew install auth0/auth0-cli/auth0\n" + "  Or visit: https://github.com/auth0/auth0-cli";
-function fail(message) {
-    throw new _apiname.CreateCliError(message);
-}
-function requireInstalled() {
-    if (_auth0cli.isInstalled()) return;
-    fail(AUTH0_CLI_INSTALL_MESSAGE);
-}
-function ensureLoggedIn() {
-    requireInstalled();
-    process.stdout.write("\n  Checking Auth0 credentials...");
-    let tenants = _auth0cli.listTenants();
-    if (tenants.length === 0) {
-        process.stdout.write(" not logged in.\n");
-        console.log("  Logging in to Auth0 (open the URL in your browser)...");
-        if (!_auth0cli.login()) fail("Auth0 login failed.");
-        tenants = _auth0cli.listTenants();
-    }
-    try {
-        _auth0cli.listApis();
-        process.stdout.write(" ok.\n");
-    } catch (err) {
-        if (err instanceof _auth0cli.Auth0AuthError) {
-            process.stdout.write(" token expired.\n");
-            console.log("  Re-authenticating (open the URL in your browser)...");
-            if (!_auth0cli.login()) fail("Auth0 login failed.");
-            tenants = _auth0cli.listTenants();
-        }
-    }
-    const active = tenants.find((t)=>t.active) ?? tenants[0];
-    if (active == null) fail("No Auth0 tenant after login.");
-    return active;
-}
-function runAuth0Login() {
-    requireInstalled();
-    console.log("  Logging in to Auth0 (open the URL in your browser)...");
-    if (!_auth0cli.login()) fail("Auth0 login failed.");
-    const tenants = _auth0cli.listTenants();
-    const active = tenants.find((t)=>t.active) ?? tenants[0];
-    if (active == null) fail("No Auth0 tenant after login.");
-    console.log(`\n  ✓ Auth0 tenant: https://${active.name}`);
-    console.log("    Tokens are stored in ~/.config/auth0 (mounted into the create image).");
-    console.log("    Next: npx @decohere/create auth0 configure");
-}
-function runAuth0Configure(directory = ".") {
-    const targetDir = (0, _nodepath.resolve)(directory);
-    if (!(0, _apiname.isDecohereWorkspace)(targetDir)) {
-        throw new _apiname.CreateCliError(`Not a Decohere workspace: ${targetDir}. Scaffold one first with \`npx @decohere/create webapi\`.`);
-    }
-    const active = ensureLoggedIn();
-    const issuerBaseUrl = `https://${active.name}`;
-    const projectName = process.env.DECOHERE_PROJECT_NAME?.trim() || (0, _nodepath.basename)(targetDir);
-    const envPath = (0, _nodepath.join)(targetDir, ".env");
-    const existing = readEnvFile(envPath);
-    const existingAudience = existing.AUTH0_AUDIENCE?.trim();
-    const discovered = (0, _authorizescopes.discoverAuthorizeScopes)(targetDir);
-    let existingScopes = [];
-    if (existingAudience) {
-        try {
-            existingScopes = _auth0cli.listApiScopes(existingAudience);
-        } catch (err) {
-            if (err instanceof _auth0cli.Auth0AuthError) throw err;
-        }
-    }
-    const apiScopes = resolveApiScopes(discovered, existingScopes);
-    console.log(discovered.length > 0 ? `  ✓ Scanned @Authorize — ${discovered.length} scope(s) from controllers` : "  ✓ No @Authorize in projects/*/src — keeping existing / Hello scopes");
-    let audience = existingAudience;
-    if (audience) {
-        try {
-            _auth0cli.updateApiScopes(audience, apiScopes);
-            console.log(`  ✓ API scopes ensured (${apiScopes.join(", ")})`);
-        } catch (err) {
-            console.error(`  ✗ Failed to update API scopes: ${err instanceof Error ? err.message : err}`);
-        }
-    } else {
-        const identifier = `https://api.${projectName}`;
-        console.log(`\n  Creating Auth0 API ${identifier}...`);
-        audience = _auth0cli.createApi(`${projectName} API`, identifier, apiScopes).identifier;
-        console.log(`  ✓ API created: ${audience}`);
-    }
-    const appName = `${projectName}${SPA_SUFFIX}`;
-    const app = _auth0cli.ensureSpaApp(appName, [
-        ...POSTMAN_CALLBACKS
-    ]);
-    console.log(app.reused ? `  ✓ Reusing Auth0 SPA app (${app.client_id})` : `  ✓ Auth0 SPA app created (${app.client_id})`);
-    try {
-        _auth0cli.enableConnectionForClient(_auth0cli.DB_CONNECTION_NAME, app.client_id);
-        console.log(`  ✓ Enabled ${_auth0cli.DB_CONNECTION_NAME} on SPA`);
-    } catch (err) {
-        console.error(`  ✗ Failed to enable DB connection on SPA: ${err instanceof Error ? err.message : err}`);
-    }
-    upsertEnv(envPath, {
-        AUTH0_ISSUER_BASE_URL: issuerBaseUrl,
-        AUTH0_AUDIENCE: audience
-    });
-    console.log(`  ✓ Wrote AUTH0_ISSUER_BASE_URL and AUTH0_AUDIENCE to .env`);
-    const adminSub = existing.AUTH0_ADMIN_USER_SUB?.trim();
-    if (adminSub) {
-        try {
-            _auth0cli.assignUserPermissions(adminSub, audience, apiScopes);
-            console.log(`  ✓ Assigned ${apiScopes.length} API permission(s) to admin user`);
-        } catch (err) {
-            console.error(`  ✗ Failed to assign admin permissions: ${err instanceof Error ? err.message : err}`);
-        }
-    }
-    const domain = issuerBaseUrl.replace(/^https?:\/\//, "");
-    patchPostmanAuth(targetDir, projectName, {
-        domain,
-        audience,
-        clientId: app.client_id,
-        scopes: (0, _authorizescopes.postmanRequestedScopes)(apiScopes)
-    });
-}
-function readEnvFile(path) {
-    if (!(0, _nodefs.existsSync)(path)) return {};
-    const out = {};
-    for (const line of (0, _nodefs.readFileSync)(path, "utf8").split("\n")){
-        const trimmed = line.trim();
-        if (trimmed === "" || trimmed.startsWith("#")) continue;
-        const eq = line.indexOf("=");
-        if (eq <= 0) continue;
-        out[line.slice(0, eq).trim()] = line.slice(eq + 1);
-    }
-    return out;
-}
-function resolveApiScopes(discovered, existing) {
-    const merged = (0, _authorizescopes.mergeApiScopes)(discovered, existing);
-    return merged.length > 0 ? merged : [
-        ..._auth0cli.HELLO_API_SCOPES
-    ].sort();
-}
-function upsertEnv(path, entries) {
-    let text = (0, _nodefs.existsSync)(path) ? (0, _nodefs.readFileSync)(path, "utf8") : "";
-    for (const [key, value] of Object.entries(entries)){
-        const re = new RegExp(`^${key}=.*$`, "m");
-        if (re.test(text)) {
-            text = text.replace(re, `${key}=${value}`);
-        } else {
-            text = `${text}${text === "" || text.endsWith("\n") ? "" : "\n"}${key}=${value}\n`;
-        }
-    }
-    if (text !== "" && !text.endsWith("\n")) text = `${text}\n`;
-    (0, _nodefs.writeFileSync)(path, text);
-}
-function patchPostmanAuth(targetDir, projectName, auth) {
-    const envYaml = (0, _nodepath.join)(targetDir, "postman/environments", `${projectName}-Local.environment.yaml`);
-    if ((0, _nodefs.existsSync)(envYaml)) {
-        let yaml = (0, _nodefs.readFileSync)(envYaml, "utf8");
-        yaml = replaceYamlKeyedValue(yaml, "auth0Domain", auth.domain);
-        yaml = replaceYamlKeyedValue(yaml, "auth0Audience", auth.audience);
-        yaml = replaceYamlKeyedValue(yaml, "auth0ClientId", auth.clientId);
-        yaml = replaceYamlKeyedValue(yaml, "authUrl", `https://${auth.domain}/authorize?audience=${auth.audience}`);
-        yaml = replaceYamlKeyedValue(yaml, "accessTokenUrl", `https://${auth.domain}/oauth/token`);
-        yaml = replaceYamlKeyedValue(yaml, "scope", auth.scopes);
-        (0, _nodefs.writeFileSync)(envYaml, yaml);
-        console.log(`  ✓ Updated Postman environment auth0ClientId (${auth.clientId})`);
-        console.log(`  ✓ Updated Postman token scopes`);
-    }
-    const collectionDef = (0, _nodepath.join)(targetDir, "postman/collections", `${projectName} WebAPI`, ".resources/definition.yaml");
-    if ((0, _nodefs.existsSync)(collectionDef)) {
-        let yaml = (0, _nodefs.readFileSync)(collectionDef, "utf8");
-        yaml = yaml.replace(/^(\s*clientId:\s*).+$/m, `$1${JSON.stringify(auth.clientId)}`);
-        yaml = yaml.replace(/^(\s*scope:\s*).+$/m, `$1${JSON.stringify(auth.scopes)}`);
-        (0, _nodefs.writeFileSync)(collectionDef, yaml);
-    }
-}
-/** Replace `key: <name>` / `value: …` pairs in Postman Local View environment YAML. */ function replaceYamlKeyedValue(yaml, key, value) {
-    const quoted = JSON.stringify(value);
-    const re = new RegExp(`(key:\\s*${key}\\s*\\n\\s*value:\\s*)[^\\n]+`, "m");
-    if (!re.test(yaml)) return yaml;
-    return yaml.replace(re, `$1${quoted}`);
-}