@dreamboard-games/cli 0.1.30-alpha.4 → 0.1.30-alpha.40

package/skills/dreamboard/references/quickstart.md

@@ -3,9 +3,9 @@
 
 # Quickstart
 
-Install Dreamboard CLI, create a game, and iterate on manifest-driven scaffolding.
+Install Dreamboard, create a game, and iterate on manifest-driven scaffolding.
 
-Install the CLI:
+Install Dreamboard:
 
 ```bash
 npm install -g dreamboard
@@ -14,13 +14,13 @@ npm install -g dreamboard
 Log in:
 
 ```bash
-dreamboard login
+dreamboard auth login
 ```
 
-Create a game:
+Create a project:
 
 ```bash
-dreamboard new my-game --description "A trick-taking card game"
+dreamboard project create my-game --description "A trick-taking card game"
 cd my-game
 ```
 
@@ -30,25 +30,27 @@ Edit `rule.md` and `manifest.json`. Use
 [Manifest authoring](./manifest-authoring.md) for the manifest
 schema.
 
-Regenerate scaffolded files from your authored source:
+Commit and push your authored source with Git:
 
 ```bash
-dreamboard sync
+git add .
+git commit -m "Create my game"
+git push -u origin main
 ```
 
-Compile the current authored head:
+Check server state for the pushed commit:
 
 ```bash
-dreamboard compile
+dreamboard project status --commit HEAD --wait
 ```
 
-Run the game locally:
+Verify the exact commit:
 
 ```bash
-dreamboard run
+dreamboard verify --commit HEAD
 ```
 
-Start a local server to play the compiled game
+Start a local server to play the project:
 
 ```bash
 dreamboard dev
@@ -56,11 +58,12 @@ dreamboard dev
 
 Useful follow-up commands:
 
-- `dreamboard pull` reconciles authored changes when the remote has advanced.
-- `dreamboard status` compares local and remote state.
-- `dreamboard clone <game-slug>` pulls an existing game into a local workspace.
+- `dreamboard project clone <project>` clones an existing project repository.
+- `dreamboard test` runs offline reducer tests.
+- `dreamboard build --commit HEAD` creates a server build for a pushed commit.
+- `dreamboard preview --commit HEAD` creates a preview for a pushed commit.
 
-For a concise command reference, see [CLI](./cli.md).
+For a concise command reference, see [Dreamboard command reference](./cli.md).
 
 For a full walkthrough, continue with
 [Building your first game](./building-your-first-game.md).

package/skills/dreamboard/references/testing.md

@@ -34,26 +34,20 @@ be edited manually.
 
 ## Command flow
 
-Generate reducer-native test artifacts:
-
-```bash
-dreamboard test generate
-```
-
 Run all scenarios:
 
 ```bash
-dreamboard test run
+dreamboard test
 ```
 
 Run one scenario:
 
 ```bash
-dreamboard test run --scenario test/scenarios/win-the-game.scenario.ts
+dreamboard test --scenario test/scenarios/win-the-game.scenario.ts
 ```
 
-Re-run `dreamboard test generate` after changes that affect the runtime shape of
-the game, including:
+`dreamboard test` regenerates reducer-native artifacts automatically when
+changes affect the runtime shape of the game, including:
 
 - `manifest.json`
 - reducer code under `app/`
@@ -111,7 +105,6 @@ Use `defineScenario(...)` from `test/testing-types.ts`.
 | `id` | Yes | Scenario identifier |
 | `description` | No | Short human-readable summary |
 | `from` | Yes | Base ID from `test/bases/*.base.ts` |
-| `runners` | No | Defaults to reducer runner |
 | `when` | Yes | Async action flow |
 | `then` | Yes | Assertions over state, view, and history |
 
@@ -232,7 +225,7 @@ then: ({ phase, history, expect, publicState }) => {
 
 If the generated test artifacts no longer match the compiled game, refresh them:
 
-- `dreamboard test generate`
+- `dreamboard test`
 
 Common symptoms:
 
@@ -244,6 +237,6 @@ Common symptoms:
 
 This page documents the scaffolded reducer-native test workspace.
 
-If you also use `dreamboard run` for manual debugging or operational inspection,
+If you also use `dreamboard dev` for manual debugging or operational inspection,
 treat that as a separate workflow. It is useful for ad hoc runtime exploration,
 but it is not the primary authored test surface for a new Dreamboard project.

package/dist/agent-verifier/chunk-27EEIZCI.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/services/project/local-files.ts"],"sourcesContent":["import { readdir, unlink } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport type { GameTopologyManifest } from \"@dreamboard-games/sdk/types\";\nimport {\n  PROJECT_DIR_NAME,\n  MANIFEST_FILE,\n  RULE_FILE,\n  SNAPSHOT_FILE,\n  LOCAL_IGNORE_DIRS,\n} from \"../../constants.js\";\nimport type { Snapshot } from \"../../types.js\";\nimport {\n  readJsonFile,\n  readTextFile,\n  readTextFileIfExists,\n  writeTextFile,\n} from \"../../utils/fs.js\";\nimport { atomicWriteFile } from \"../../utils/atomic-file.js\";\nimport { hashContent } from \"../../utils/crypto.js\";\nimport {\n  computeManifestHash,\n  materializeManifest,\n  writeManifestSource,\n} from \"./manifest-authoring.js\";\nimport {\n  isAllowedGamePath as isAllowedPathFromOwnership,\n  isDynamicGeneratedPath,\n  isLibraryPath as isLibraryPathFromOwnership,\n} from \"./scaffold-ownership.js\";\n\n/**\n * Returns true when a path is inside the canonical game project structure.\n * Anything outside app/, ui/, shared/, or the known root files is rejected.\n */\nexport function isAllowedGamePath(filePath: string): boolean {\n  return isAllowedPathFromOwnership(filePath);\n}\n\nexport function isLibraryPath(filePath: string): boolean {\n  return isLibraryPathFromOwnership(filePath);\n}\n\ntype WriteDecision = \"write\" | \"skip\";\n\n/**\n * Decide whether a file from the scaffold response should be written to disk.\n *\n * - Library files     → always overwrite (they are fully generated).\n * - Everything else   → only write if the file does not yet exist or is empty\n *                        locally (first-time seeding; preserves user edits).\n */\nfunction shouldWriteScaffoldFile(\n  filePath: string,\n  existingContent: string | null,\n): WriteDecision {\n  if (isLibraryPath(filePath)) return \"write\";\n  const hasContent =\n    existingContent !== null && existingContent.trim().length > 0;\n  return hasContent ? \"skip\" : \"write\";\n}\n\nexport async function writeSourceFiles(\n  rootDir: string,\n  files: Record<string, string | null>,\n): Promise<void> {\n  for (const [relativePath, content] of Object.entries(files)) {\n    if (content === null || content === undefined) continue;\n    const filePath = path.join(rootDir, relativePath);\n    await writeTextFile(filePath, content);\n  }\n}\n\nexport interface ScaffoldWriteResult {\n  written: string[];\n  skipped: string[];\n}\n\n/**\n * Write scaffold files using local-merge logic.\n *\n * - Library files are always overwritten.\n * - User-owned files (phases, components, etc.) are only written when the\n *   local file does not exist or is empty.  Files with content are skipped\n *   so user edits are never lost.\n *\n * Returns lists of files that were written (and actually changed) and files\n * that were skipped because a non-empty local copy already exists.\n */\nexport async function writeScaffoldFiles(\n  rootDir: string,\n  files: Record<string, string | null>,\n): Promise<ScaffoldWriteResult> {\n  const written: string[] = [];\n  const skipped: string[] = [];\n\n  for (const [relativePath, content] of Object.entries(files)) {\n    if (content === null || content === undefined) continue;\n\n    const fullPath = path.join(rootDir, relativePath);\n    const existingContent = await readTextFileIfExists(fullPath);\n\n    const decision = shouldWriteScaffoldFile(relativePath, existingContent);\n\n    if (decision === \"skip\") {\n      skipped.push(relativePath);\n      continue;\n    }\n\n    await writeTextFile(fullPath, content);\n\n    if (existingContent !== content) {\n      written.push(relativePath);\n    }\n  }\n\n  written.sort();\n  skipped.sort();\n  return { written, skipped };\n}\n\nexport async function removeExtraneousFiles(\n  rootDir: string,\n  keep: Set<string>,\n): Promise<void> {\n  const localFiles = await collectLocalFiles(rootDir);\n  for (const filePath of Object.keys(localFiles)) {\n    if (filePath === MANIFEST_FILE || filePath === RULE_FILE) continue;\n    if (!keep.has(filePath)) {\n      await unlink(path.join(rootDir, filePath));\n    }\n  }\n}\n\nexport async function collectLocalFiles(\n  rootDir: string,\n): Promise<Record<string, string>> {\n  const result: Record<string, string> = {};\n  await walkDir(rootDir, rootDir, result);\n  return result;\n}\n\nexport async function walkDir(\n  rootDir: string,\n  currentDir: string,\n  result: Record<string, string>,\n): Promise<void> {\n  const entries = await readdir(currentDir, { withFileTypes: true });\n  for (const entry of entries) {\n    if (entry.isDirectory()) {\n      if (LOCAL_IGNORE_DIRS.has(entry.name)) continue;\n      await walkDir(rootDir, path.join(currentDir, entry.name), result);\n    } else if (entry.isFile()) {\n      const filePath = path.join(currentDir, entry.name);\n      const relativePath = path.relative(rootDir, filePath);\n      result[relativePath] = await readTextFile(filePath);\n    }\n  }\n}\n\nexport async function writeManifest(\n  rootDir: string,\n  manifest: GameTopologyManifest,\n): Promise<void> {\n  await writeManifestSource(rootDir, manifest);\n}\n\nexport async function writeRule(\n  rootDir: string,\n  ruleText: string,\n): Promise<void> {\n  const filePath = path.join(rootDir, RULE_FILE);\n  await writeTextFile(filePath, ruleText);\n}\n\nexport async function loadManifest(\n  rootDir: string,\n): Promise<GameTopologyManifest> {\n  return materializeManifest(rootDir);\n}\n\nexport { computeManifestHash };\n\nexport async function loadRule(rootDir: string): Promise<string> {\n  const filePath = path.join(rootDir, RULE_FILE);\n  return readTextFile(filePath);\n}\n\nexport async function writeSnapshot(rootDir: string): Promise<void> {\n  const files = await collectLocalFiles(rootDir);\n  await writeSnapshotFromFiles(rootDir, files);\n}\n\nexport async function writeSnapshotFromFiles(\n  rootDir: string,\n  files: Record<string, string>,\n): Promise<void> {\n  const snapshot: Snapshot = {\n    files: {},\n  };\n\n  for (const [filePath, content] of Object.entries(files)) {\n    if (filePath.startsWith(`${PROJECT_DIR_NAME}/`)) continue;\n    if (isDynamicGeneratedPath(filePath)) continue;\n    snapshot.files[filePath] = hashContent(content);\n  }\n\n  const snapshotPath = path.join(rootDir, PROJECT_DIR_NAME, SNAPSHOT_FILE);\n  // Atomic write: a crash mid-snapshot (e.g. user kills a long `dreamboard\n  // sync`) must not leave `.dreamboard/snapshot.json` truncated, or\n  // `getLocalDiff` will silently report everything as \"added\" on the\n  // next run and force a full re-sync.\n  await atomicWriteFile(\n    snapshotPath,\n    `${JSON.stringify(snapshot, null, 2)}\\n`,\n    { mode: 0o644 },\n  );\n}\n\nfunction isIgnorableLocalDiffPath(filePath: string): boolean {\n  return (\n    filePath.startsWith(\"test/generated/\") ||\n    filePath.startsWith(\".playwright-cli/\")\n  );\n}\n\nexport async function getLocalDiff(rootDir: string): Promise<{\n  modified: string[];\n  added: string[];\n  deleted: string[];\n}> {\n  const snapshotPath = path.join(rootDir, PROJECT_DIR_NAME, SNAPSHOT_FILE);\n  const snapshot = await readJsonFile<Snapshot>(snapshotPath).catch(() => null);\n  if (!snapshot) {\n    return { modified: [], added: [], deleted: [] };\n  }\n\n  const files = await collectLocalFiles(rootDir);\n  const currentHashes: Record<string, string> = {};\n\n  for (const [filePath, content] of Object.entries(files)) {\n    if (filePath.startsWith(`${PROJECT_DIR_NAME}/`)) continue;\n    if (isIgnorableLocalDiffPath(filePath)) continue;\n    if (isDynamicGeneratedPath(filePath)) continue;\n    currentHashes[filePath] = hashContent(content);\n  }\n\n  const modified: string[] = [];\n  const added: string[] = [];\n  const deleted: string[] = [];\n\n  for (const [filePath, hash] of Object.entries(currentHashes)) {\n    const prevHash = snapshot.files[filePath];\n    if (!prevHash) {\n      added.push(filePath);\n    } else if (prevHash !== hash) {\n      modified.push(filePath);\n    }\n  }\n\n  for (const filePath of Object.keys(snapshot.files)) {\n    if (isIgnorableLocalDiffPath(filePath)) continue;\n    if (isDynamicGeneratedPath(filePath)) continue;\n    if (!currentHashes[filePath]) {\n      deleted.push(filePath);\n    }\n  }\n\n  return { modified, added, deleted };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS,cAAc;AAChC,OAAO,UAAU;AAiCV,SAASA,mBAAkB,UAA2B;AAC3D,SAAO,kBAA2B,QAAQ;AAC5C;AAEO,SAASC,eAAc,UAA2B;AACvD,SAAO,cAA2B,QAAQ;AAC5C;AAWA,SAAS,wBACP,UACA,iBACe;AACf,MAAIA,eAAc,QAAQ,EAAG,QAAO;AACpC,QAAM,aACJ,oBAAoB,QAAQ,gBAAgB,KAAK,EAAE,SAAS;AAC9D,SAAO,aAAa,SAAS;AAC/B;AAEA,eAAsB,iBACpB,SACA,OACe;AACf,aAAW,CAAC,cAAc,OAAO,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC3D,QAAI,YAAY,QAAQ,YAAY,OAAW;AAC/C,UAAM,WAAW,KAAK,KAAK,SAAS,YAAY;AAChD,UAAM,cAAc,UAAU,OAAO;AAAA,EACvC;AACF;AAkBA,eAAsB,mBACpB,SACA,OAC8B;AAC9B,QAAM,UAAoB,CAAC;AAC3B,QAAM,UAAoB,CAAC;AAE3B,aAAW,CAAC,cAAc,OAAO,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC3D,QAAI,YAAY,QAAQ,YAAY,OAAW;AAE/C,UAAM,WAAW,KAAK,KAAK,SAAS,YAAY;AAChD,UAAM,kBAAkB,MAAM,qBAAqB,QAAQ;AAE3D,UAAM,WAAW,wBAAwB,cAAc,eAAe;AAEtE,QAAI,aAAa,QAAQ;AACvB,cAAQ,KAAK,YAAY;AACzB;AAAA,IACF;AAEA,UAAM,cAAc,UAAU,OAAO;AAErC,QAAI,oBAAoB,SAAS;AAC/B,cAAQ,KAAK,YAAY;AAAA,IAC3B;AAAA,EACF;AAEA,UAAQ,KAAK;AACb,UAAQ,KAAK;AACb,SAAO,EAAE,SAAS,QAAQ;AAC5B;AAEA,eAAsB,sBACpB,SACA,MACe;AACf,QAAM,aAAa,MAAM,kBAAkB,OAAO;AAClD,aAAW,YAAY,OAAO,KAAK,UAAU,GAAG;AAC9C,QAAI,aAAa,iBAAiB,aAAa,UAAW;AAC1D,QAAI,CAAC,KAAK,IAAI,QAAQ,GAAG;AACvB,YAAM,OAAO,KAAK,KAAK,SAAS,QAAQ,CAAC;AAAA,IAC3C;AAAA,EACF;AACF;AAEA,eAAsB,kBACpB,SACiC;AACjC,QAAM,SAAiC,CAAC;AACxC,QAAM,QAAQ,SAAS,SAAS,MAAM;AACtC,SAAO;AACT;AAEA,eAAsB,QACpB,SACA,YACA,QACe;AACf,QAAM,UAAU,MAAM,QAAQ,YAAY,EAAE,eAAe,KAAK,CAAC;AACjE,aAAW,SAAS,SAAS;AAC3B,QAAI,MAAM,YAAY,GAAG;AACvB,UAAI,kBAAkB,IAAI,MAAM,IAAI,EAAG;AACvC,YAAM,QAAQ,SAAS,KAAK,KAAK,YAAY,MAAM,IAAI,GAAG,MAAM;AAAA,IAClE,WAAW,MAAM,OAAO,GAAG;AACzB,YAAM,WAAW,KAAK,KAAK,YAAY,MAAM,IAAI;AACjD,YAAM,eAAe,KAAK,SAAS,SAAS,QAAQ;AACpD,aAAO,YAAY,IAAI,MAAM,aAAa,QAAQ;AAAA,IACpD;AAAA,EACF;AACF;AAEA,eAAsB,cACpB,SACA,UACe;AACf,QAAM,oBAAoB,SAAS,QAAQ;AAC7C;AAEA,eAAsB,UACpB,SACA,UACe;AACf,QAAM,WAAW,KAAK,KAAK,SAAS,SAAS;AAC7C,QAAM,cAAc,UAAU,QAAQ;AACxC;AAEA,eAAsB,aACpB,SAC+B;AAC/B,SAAO,oBAAoB,OAAO;AACpC;AAIA,eAAsB,SAAS,SAAkC;AAC/D,QAAM,WAAW,KAAK,KAAK,SAAS,SAAS;AAC7C,SAAO,aAAa,QAAQ;AAC9B;AAEA,eAAsB,cAAc,SAAgC;AAClE,QAAM,QAAQ,MAAM,kBAAkB,OAAO;AAC7C,QAAM,uBAAuB,SAAS,KAAK;AAC7C;AAEA,eAAsB,uBACpB,SACA,OACe;AACf,QAAM,WAAqB;AAAA,IACzB,OAAO,CAAC;AAAA,EACV;AAEA,aAAW,CAAC,UAAU,OAAO,KAAK,OAAO,QAAQ,KAAK,GAAG;AACvD,QAAI,SAAS,WAAW,GAAG,gBAAgB,GAAG,EAAG;AACjD,QAAI,uBAAuB,QAAQ,EAAG;AACtC,aAAS,MAAM,QAAQ,IAAI,YAAY,OAAO;AAAA,EAChD;AAEA,QAAM,eAAe,KAAK,KAAK,SAAS,kBAAkB,aAAa;AAKvE,QAAM;AAAA,IACJ;AAAA,IACA,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA;AAAA,IACpC,EAAE,MAAM,IAAM;AAAA,EAChB;AACF;AAEA,SAAS,yBAAyB,UAA2B;AAC3D,SACE,SAAS,WAAW,iBAAiB,KACrC,SAAS,WAAW,kBAAkB;AAE1C;AAEA,eAAsB,aAAa,SAIhC;AACD,QAAM,eAAe,KAAK,KAAK,SAAS,kBAAkB,aAAa;AACvE,QAAM,WAAW,MAAM,aAAuB,YAAY,EAAE,MAAM,MAAM,IAAI;AAC5E,MAAI,CAAC,UAAU;AACb,WAAO,EAAE,UAAU,CAAC,GAAG,OAAO,CAAC,GAAG,SAAS,CAAC,EAAE;AAAA,EAChD;AAEA,QAAM,QAAQ,MAAM,kBAAkB,OAAO;AAC7C,QAAM,gBAAwC,CAAC;AAE/C,aAAW,CAAC,UAAU,OAAO,KAAK,OAAO,QAAQ,KAAK,GAAG;AACvD,QAAI,SAAS,WAAW,GAAG,gBAAgB,GAAG,EAAG;AACjD,QAAI,yBAAyB,QAAQ,EAAG;AACxC,QAAI,uBAAuB,QAAQ,EAAG;AACtC,kBAAc,QAAQ,IAAI,YAAY,OAAO;AAAA,EAC/C;AAEA,QAAM,WAAqB,CAAC;AAC5B,QAAM,QAAkB,CAAC;AACzB,QAAM,UAAoB,CAAC;AAE3B,aAAW,CAAC,UAAU,IAAI,KAAK,OAAO,QAAQ,aAAa,GAAG;AAC5D,UAAM,WAAW,SAAS,MAAM,QAAQ;AACxC,QAAI,CAAC,UAAU;AACb,YAAM,KAAK,QAAQ;AAAA,IACrB,WAAW,aAAa,MAAM;AAC5B,eAAS,KAAK,QAAQ;AAAA,IACxB;AAAA,EACF;AAEA,aAAW,YAAY,OAAO,KAAK,SAAS,KAAK,GAAG;AAClD,QAAI,yBAAyB,QAAQ,EAAG;AACxC,QAAI,uBAAuB,QAAQ,EAAG;AACtC,QAAI,CAAC,cAAc,QAAQ,GAAG;AAC5B,cAAQ,KAAK,QAAQ;AAAA,IACvB;AAAA,EACF;AAEA,SAAO,EAAE,UAAU,OAAO,QAAQ;AACpC;","names":["isAllowedGamePath","isLibraryPath"]}

package/dist/agent-verifier/chunk-5NYBTZB4.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/config/global-config.ts","../../src/config/credential-store.ts"],"sourcesContent":["import os from \"node:os\";\nimport path from \"node:path\";\nimport type { CredentialBackendPreference, GlobalConfig } from \"../types.js\";\nimport { PROJECT_DIR_NAME } from \"../constants.js\";\nimport { ensureDir, readJsonFile } from \"../utils/fs.js\";\nimport { atomicWriteFile } from \"../utils/atomic-file.js\";\nimport { getCredentialFilePath } from \"./credential-store.js\";\n\nfunction normalizeCredentialBackend(\n  value: unknown,\n): CredentialBackendPreference | undefined {\n  if (value === \"file\" || value === \"keychain\") return value;\n  // Tolerate unknown / malformed values rather than refusing to load the\n  // whole config - an unrecognised backend name should degrade to \"use\n  // the default\" instead of locking the user out of their CLI.\n  return undefined;\n}\n\nexport function getGlobalConfigPath(): string {\n  return path.join(os.homedir(), PROJECT_DIR_NAME, \"config.json\");\n}\n\n/**\n * Path to the on-disk credential file used by the file backend of\n * `CredentialStore`. Re-exported here to avoid circular / ad-hoc imports\n * in UI surface (`auth status`, `config show`, etc).\n */\nexport function getGlobalAuthPath(): string {\n  return getCredentialFilePath();\n}\n\n/**\n * Load non-credential CLI configuration.\n *\n * Note: this function used to also load `authToken` / `refreshToken`\n * from `auth.json` and flatten them onto `GlobalConfig`. That shape\n * enabled the refresh-token-wipe bug: `saveGlobalConfig({ ...config })`\n * without explicit auth fields erased the stored refresh token.\n *\n * Credentials are now owned exclusively by `CredentialStore`. Callers\n * that need them must import `getCredentials()` directly.\n */\nexport async function loadGlobalConfig(): Promise<GlobalConfig> {\n  const config = await readJsonFile<GlobalConfig>(getGlobalConfigPath()).catch(\n    () => ({}) as GlobalConfig,\n  );\n  return {\n    environment: config.environment,\n    credentialBackend: normalizeCredentialBackend(config.credentialBackend),\n  };\n}\n\n/**\n * Persist non-credential CLI configuration.\n *\n * This function cannot write credentials, by construction: the\n * `GlobalConfig` type has no credential fields. Credentials must be\n * persisted through `setCredentials` / `clearCredentials` from\n * `credential-store.ts`.\n */\nexport async function saveGlobalConfig(config: GlobalConfig): Promise<void> {\n  const configDir = path.join(os.homedir(), PROJECT_DIR_NAME);\n  await ensureDir(configDir);\n  const normalized: GlobalConfig = {\n    environment: config.environment,\n    credentialBackend: normalizeCredentialBackend(config.credentialBackend),\n  };\n  await atomicWriteFile(\n    getGlobalConfigPath(),\n    `${JSON.stringify(normalized, null, 2)}\\n`,\n    { mode: 0o600 },\n  );\n}\n","/**\n * Single writer for the long-lived Dreamboard session credentials.\n *\n * Design invariants (enforced at the type level and tested in\n * `credential-store.test.ts`):\n *\n * 1. This module is the ONLY place in the CLI that writes credentials to\n *    disk or the OS keychain. `global-config.ts` used to own both the\n *    config and the credentials via `saveGlobalConfig`, which made it\n *    trivial to wipe a refresh token by accident. The `GlobalConfig` type\n *    no longer carries credentials, so attempting to persist one through\n *    the config path is a type error.\n *\n * 2. The mutating surface is intentionally narrow:\n *      - `setCredentials(c)` for refreshable sessions (both tokens present)\n *      - `setAccessOnlySession(accessToken)` for the `auth set` / `config set\n *        --token` power-user path, which has no refresh token by\n *        construction\n *      - `clearCredentials()` wipes the file entirely\n *    There is no \"partial update\" API. `Credentials` requires both\n *    `accessToken` and `refreshToken`, so it is impossible to persist a\n *    half-populated refreshable session.\n *\n * 3. Writes go through `atomicWriteFile` + `withFileLock`, so a crash or\n *    interrupt during `dreamboard sync`/`compile` cannot leave `auth.json`\n *    truncated, and parallel CLI invocations cannot clobber each other's\n *    rotated refresh tokens.\n *\n * 4. The on-disk JSON shape for the file backend is kept backward\n *    compatible: we continue to read/write `authToken` + `refreshToken`\n *    so existing users are not forced to log in again after this change.\n *    A newer `accessToken` key is also accepted for read to ease any\n *    future format bump.\n *\n * 5. The file backend is the default. The OS keychain is opt-in via\n *    `credentialBackend: \"keychain\"` in `~/.dreamboard/config.json`\n *    because on macOS the first keychain write triggers a login-password\n *    prompt, and re-prompts whenever the executing Node binary's code\n *    signature changes (e.g. after an `nvm`/`volta` upgrade). Users who\n *    want encrypted-at-rest storage can opt in explicitly; everyone else\n *    gets a zero-prompt experience.\n */\n\nimport os from \"node:os\";\nimport path from \"node:path\";\nimport { promises as fs } from \"node:fs\";\nimport { PROJECT_DIR_NAME } from \"../constants.js\";\nimport {\n  atomicWriteFile,\n  withFileLock,\n  type FileLockOptions,\n} from \"../utils/atomic-file.js\";\n\n/** Fully refreshable session: both tokens required. */\nexport type Credentials = {\n  readonly accessToken: string;\n  readonly refreshToken: string;\n  readonly tokenExpiresAt?: string;\n  readonly clerkOAuthIssuer?: string;\n  readonly clerkOAuthClientId?: string;\n  readonly clerkOAuthTokenUrl?: string;\n  readonly environment?: string;\n};\n\n/**\n * Raw on-disk snapshot. Either or both fields may be present. The refresh\n * coordinator only acts on snapshots that have both tokens populated.\n */\nexport type StoredSessionSnapshot = {\n  readonly accessToken?: string;\n  readonly refreshToken?: string;\n  readonly tokenExpiresAt?: string;\n  readonly clerkOAuthIssuer?: string;\n  readonly clerkOAuthClientId?: string;\n  readonly clerkOAuthTokenUrl?: string;\n  readonly environment?: string;\n};\n\nexport type CredentialBackendName = \"file\" | \"keychain\";\n\nexport type CredentialBackend = {\n  readonly name: CredentialBackendName;\n  read(): Promise<StoredSessionSnapshot | null>;\n  writeFull(creds: Credentials): Promise<void>;\n  writeAccessOnly(accessToken: string): Promise<void>;\n  clear(): Promise<void>;\n};\n\nexport type CredentialLockOps = {\n  readonly backendName: CredentialBackendName;\n  read(): Promise<StoredSessionSnapshot | null>;\n  writeFull(creds: Credentials): Promise<void>;\n  writeAccessOnly(accessToken: string): Promise<void>;\n  clear(): Promise<void>;\n};\n\ntype DiskShape = Partial<{\n  accessToken: string;\n  authToken: string;\n  refreshToken: string;\n  tokenExpiresAt: string;\n  clerkOAuthIssuer: string;\n  clerkOAuthClientId: string;\n  clerkOAuthTokenUrl: string;\n  environment: string;\n}>;\n\nexport function getCredentialFilePath(): string {\n  return path.join(os.homedir(), PROJECT_DIR_NAME, \"auth.json\");\n}\n\nfunction getCredentialLockPath(): string {\n  return `${getCredentialFilePath()}.lock`;\n}\n\nasync function fileRead(): Promise<StoredSessionSnapshot | null> {\n  const filePath = getCredentialFilePath();\n  let data: string;\n  try {\n    data = await fs.readFile(filePath, \"utf8\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return null;\n    throw err;\n  }\n  if (data.trim().length === 0) {\n    return null;\n  }\n  let parsed: DiskShape;\n  try {\n    parsed = JSON.parse(data) as DiskShape;\n  } catch {\n    return null;\n  }\n  const accessToken = parsed.accessToken ?? parsed.authToken;\n  const refreshToken = parsed.refreshToken;\n  if (!accessToken && !refreshToken) return null;\n  return {\n    accessToken: accessToken || undefined,\n    refreshToken: refreshToken || undefined,\n    tokenExpiresAt: parsed.tokenExpiresAt || undefined,\n    clerkOAuthIssuer: parsed.clerkOAuthIssuer || undefined,\n    clerkOAuthClientId: parsed.clerkOAuthClientId || undefined,\n    clerkOAuthTokenUrl: parsed.clerkOAuthTokenUrl || undefined,\n    environment: parsed.environment || undefined,\n  };\n}\n\nasync function writeFilePayload(payload: DiskShape): Promise<void> {\n  await atomicWriteFile(\n    getCredentialFilePath(),\n    `${JSON.stringify(payload, null, 2)}\\n`,\n    { mode: 0o600 },\n  );\n}\n\nasync function fileWriteFull(creds: Credentials): Promise<void> {\n  if (!creds.accessToken || !creds.refreshToken) {\n    throw new Error(\n      \"Refusing to persist credentials with an empty accessToken or refreshToken.\",\n    );\n  }\n  await writeFilePayload({\n    authToken: creds.accessToken,\n    refreshToken: creds.refreshToken,\n    tokenExpiresAt: creds.tokenExpiresAt,\n    clerkOAuthIssuer: creds.clerkOAuthIssuer,\n    clerkOAuthClientId: creds.clerkOAuthClientId,\n    clerkOAuthTokenUrl: creds.clerkOAuthTokenUrl,\n    environment: creds.environment,\n  });\n}\n\nasync function fileWriteAccessOnly(accessToken: string): Promise<void> {\n  if (!accessToken) {\n    throw new Error(\"Refusing to persist an empty access token.\");\n  }\n  await writeFilePayload({ authToken: accessToken });\n}\n\nasync function fileClear(): Promise<void> {\n  const filePath = getCredentialFilePath();\n  try {\n    await fs.unlink(filePath);\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code !== \"ENOENT\") throw err;\n  }\n}\n\nexport const fileCredentialBackend: CredentialBackend = {\n  name: \"file\",\n  read: fileRead,\n  writeFull: fileWriteFull,\n  writeAccessOnly: fileWriteAccessOnly,\n  clear: fileClear,\n};\n\nexport type BackendResolver = () =>\n  | CredentialBackend\n  | Promise<CredentialBackend>;\n\nlet cachedBackend: CredentialBackend | null = null;\nlet migrationCompleted = false;\nlet backendResolver: BackendResolver = defaultBackendResolver;\n\n/**\n * Default resolver precedence:\n *\n *   1. `DREAMBOARD_CREDENTIAL_BACKEND` env var (debugging / CI override).\n *        - \"file\"     -> force file\n *        - \"keychain\" -> force keychain (falls back to file if the native\n *                        module or the OS keyring is unavailable)\n *        - \"auto\"     -> same as unset (use config)\n *        - unknown    -> throw so typos fail loud\n *   2. `credentialBackend` in `~/.dreamboard/config.json`.\n *        - \"keychain\" -> opt in to the OS keychain (with file fallback)\n *        - \"file\" / unset / malformed -> file\n *   3. Default: file backend.\n *\n * Keychain is opt-in because on macOS the OS login-keychain prompts for\n * the user's password the first time a new binary tries to write to an\n * item, and re-prompts whenever the Node binary signature changes. We\n * would rather ship a zero-prompt default and let users who care about\n * encrypted-at-rest storage enable it.\n *\n * The resolver is async because the keychain probe requires a dynamic\n * `@napi-rs/keyring` import.\n */\nasync function defaultBackendResolver(): Promise<CredentialBackend> {\n  const override = (process.env.DREAMBOARD_CREDENTIAL_BACKEND ?? \"\")\n    .trim()\n    .toLowerCase();\n  if (override === \"file\") {\n    return fileCredentialBackend;\n  }\n  if (override && override !== \"keychain\" && override !== \"auto\") {\n    // Fail loud on typos rather than silently falling back: this env\n    // var exists specifically for users who are debugging auth issues\n    // and need to know their override took effect.\n    throw new Error(\n      `Unknown DREAMBOARD_CREDENTIAL_BACKEND value \"${override}\" (expected \"file\", \"keychain\", or \"auto\").`,\n    );\n  }\n\n  const useKeychain =\n    override === \"keychain\" || (await readCredentialBackendPreference());\n  if (!useKeychain) {\n    return fileCredentialBackend;\n  }\n\n  const { tryKeychainBackend } = await import(\"./keychain-backend.js\");\n  const keychain = await tryKeychainBackend();\n  if (keychain.available) {\n    return keychain.backend;\n  }\n  // The user explicitly asked for keychain but the platform can't\n  // provide one (no libsecret on Linux, missing native module, etc).\n  // Silently degrade to the file backend so the CLI stays usable; the\n  // active backend is still visible through `dreamboard auth status`.\n  return fileCredentialBackend;\n}\n\nasync function readCredentialBackendPreference(): Promise<boolean> {\n  try {\n    // Dynamic import to avoid a top-level cycle with `global-config.ts`\n    // (which imports `getCredentialFilePath` from this module). Using\n    // the async path keeps the cycle purely lazy.\n    const { loadGlobalConfig } = await import(\"./global-config.js\");\n    const config = await loadGlobalConfig();\n    return config.credentialBackend === \"keychain\";\n  } catch {\n    // If the config file is unreadable or the dynamic import fails\n    // (e.g. during early bootstrap), fall back to the file-backed\n    // default rather than crashing credential lookups.\n    return false;\n  }\n}\n\n/**\n * Override which backend is used. Tests use this to inject in-memory\n * backends; production code uses the default keychain-first resolver.\n */\nexport function setCredentialBackendResolver(resolver: BackendResolver): void {\n  backendResolver = resolver;\n  cachedBackend = null;\n  migrationCompleted = false;\n}\n\nexport async function getCredentialBackend(): Promise<CredentialBackend> {\n  if (cachedBackend === null) {\n    cachedBackend = await backendResolver();\n    // One-time migration: if we resolved to a non-file backend and\n    // `auth.json` still has credentials from the old layout, copy them\n    // over and remove the file. We only do this when the new backend is\n    // empty, so repeated migrations cannot stomp a newer keychain\n    // session with a stale file session.\n    if (!migrationCompleted && cachedBackend.name !== \"file\") {\n      await migrateFromFileBackendIfNeeded(cachedBackend);\n    }\n    migrationCompleted = true;\n  }\n  return cachedBackend;\n}\n\nasync function migrateFromFileBackendIfNeeded(\n  target: CredentialBackend,\n): Promise<void> {\n  try {\n    const [onDisk, onTarget] = await Promise.all([\n      fileCredentialBackend.read(),\n      target.read(),\n    ]);\n    if (!onDisk) return;\n    if (onTarget) {\n      // Target already has a session - the user has already migrated.\n      // Remove the file so it cannot get re-used accidentally.\n      await fileCredentialBackend.clear();\n      return;\n    }\n    if (onDisk.accessToken && onDisk.refreshToken) {\n      await target.writeFull({\n        accessToken: onDisk.accessToken,\n        refreshToken: onDisk.refreshToken,\n      });\n    } else if (onDisk.accessToken) {\n      await target.writeAccessOnly(onDisk.accessToken);\n    } else {\n      return;\n    }\n    await fileCredentialBackend.clear();\n  } catch {\n    // Migration is best-effort. A failure here should not block CLI\n    // operation; on next run the file backend is still consulted\n    // directly because the keychain backend's `read` returns null and\n    // callers fall through to \"missing session\" → login prompt.\n  }\n}\n\nexport async function getActiveCredentialBackendName(): Promise<CredentialBackendName> {\n  const backend = await getCredentialBackend();\n  return backend.name;\n}\n\n/** Loose read: returns whatever is on disk, including access-only sessions. */\nexport async function getStoredSession(): Promise<StoredSessionSnapshot | null> {\n  const backend = await getCredentialBackend();\n  return backend.read();\n}\n\n/** Strict read: returns a refreshable pair, or null if either token is missing. */\nexport async function getCredentials(): Promise<Credentials | null> {\n  const snapshot = await getStoredSession();\n  if (!snapshot) return null;\n  const { accessToken, refreshToken } = snapshot;\n  if (!accessToken || !refreshToken) return null;\n  return { accessToken, refreshToken };\n}\n\nexport async function setCredentials(creds: Credentials): Promise<void> {\n  await withFileLock(getCredentialLockPath(), async () => {\n    const backend = await getCredentialBackend();\n    await backend.writeFull(creds);\n  });\n}\n\nexport async function setAccessOnlySession(accessToken: string): Promise<void> {\n  await withFileLock(getCredentialLockPath(), async () => {\n    const backend = await getCredentialBackend();\n    await backend.writeAccessOnly(accessToken);\n  });\n}\n\nexport async function clearCredentials(): Promise<void> {\n  await withFileLock(getCredentialLockPath(), async () => {\n    const backend = await getCredentialBackend();\n    await backend.clear();\n  });\n}\n\n/**\n * Run `fn` while holding the cross-process credential lock. `fn` receives\n * an ops handle that reads/writes the active backend without re-acquiring\n * the lock (avoiding deadlock).\n *\n * This is the only correct way to perform a read-modify-write on stored\n * credentials (e.g. CLI refresh rotation) in the presence of\n * concurrent CLI invocations.\n */\nexport async function withCredentialLock<T>(\n  fn: (ops: CredentialLockOps) => Promise<T>,\n  options?: FileLockOptions,\n): Promise<T> {\n  return withFileLock(\n    getCredentialLockPath(),\n    async () => {\n      const backend = await getCredentialBackend();\n      const ops: CredentialLockOps = {\n        backendName: backend.name,\n        read: () => backend.read(),\n        writeFull: (creds) => backend.writeFull(creds),\n        writeAccessOnly: (accessToken) => backend.writeAccessOnly(accessToken),\n        clear: () => backend.clear(),\n      };\n      return fn(ops);\n    },\n    options,\n  );\n}\n\n/** Test-only reset of module state. Not exported through the barrel. */\nexport function _resetCredentialStoreForTests(): void {\n  cachedBackend = null;\n  migrationCompleted = false;\n  backendResolver = defaultBackendResolver;\n}\n"],"mappings":";;;;;;;;;;;;;;AAAA,OAAOA,SAAQ;AACf,OAAOC,WAAU;;;AC0CjB,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,SAAS,YAAY,UAAU;AA8DxB,SAAS,wBAAgC;AAC9C,SAAO,KAAK,KAAK,GAAG,QAAQ,GAAG,kBAAkB,WAAW;AAC9D;AAEA,SAAS,wBAAgC;AACvC,SAAO,GAAG,sBAAsB,CAAC;AACnC;AAEA,eAAe,WAAkD;AAC/D,QAAM,WAAW,sBAAsB;AACvC,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,GAAG,SAAS,UAAU,MAAM;AAAA,EAC3C,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,UAAM;AAAA,EACR;AACA,MAAI,KAAK,KAAK,EAAE,WAAW,GAAG;AAC5B,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,cAAc,OAAO,eAAe,OAAO;AACjD,QAAM,eAAe,OAAO;AAC5B,MAAI,CAAC,eAAe,CAAC,aAAc,QAAO;AAC1C,SAAO;AAAA,IACL,aAAa,eAAe;AAAA,IAC5B,cAAc,gBAAgB;AAAA,IAC9B,gBAAgB,OAAO,kBAAkB;AAAA,IACzC,kBAAkB,OAAO,oBAAoB;AAAA,IAC7C,oBAAoB,OAAO,sBAAsB;AAAA,IACjD,oBAAoB,OAAO,sBAAsB;AAAA,IACjD,aAAa,OAAO,eAAe;AAAA,EACrC;AACF;AAEA,eAAe,iBAAiB,SAAmC;AACjE,QAAM;AAAA,IACJ,sBAAsB;AAAA,IACtB,GAAG,KAAK,UAAU,SAAS,MAAM,CAAC,CAAC;AAAA;AAAA,IACnC,EAAE,MAAM,IAAM;AAAA,EAChB;AACF;AAEA,eAAe,cAAc,OAAmC;AAC9D,MAAI,CAAC,MAAM,eAAe,CAAC,MAAM,cAAc;AAC7C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,iBAAiB;AAAA,IACrB,WAAW,MAAM;AAAA,IACjB,cAAc,MAAM;AAAA,IACpB,gBAAgB,MAAM;AAAA,IACtB,kBAAkB,MAAM;AAAA,IACxB,oBAAoB,MAAM;AAAA,IAC1B,oBAAoB,MAAM;AAAA,IAC1B,aAAa,MAAM;AAAA,EACrB,CAAC;AACH;AAEA,eAAe,oBAAoB,aAAoC;AACrE,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AACA,QAAM,iBAAiB,EAAE,WAAW,YAAY,CAAC;AACnD;AAEA,eAAe,YAA2B;AACxC,QAAM,WAAW,sBAAsB;AACvC,MAAI;AACF,UAAM,GAAG,OAAO,QAAQ;AAAA,EAC1B,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,OAAM;AAAA,EAC9D;AACF;AAEO,IAAM,wBAA2C;AAAA,EACtD,MAAM;AAAA,EACN,MAAM;AAAA,EACN,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,OAAO;AACT;AAMA,IAAI,gBAA0C;AAC9C,IAAI,qBAAqB;AACzB,IAAI,kBAAmC;AAyBvC,eAAe,yBAAqD;AAClE,QAAM,YAAY,QAAQ,IAAI,iCAAiC,IAC5D,KAAK,EACL,YAAY;AACf,MAAI,aAAa,QAAQ;AACvB,WAAO;AAAA,EACT;AACA,MAAI,YAAY,aAAa,cAAc,aAAa,QAAQ;AAI9D,UAAM,IAAI;AAAA,MACR,gDAAgD,QAAQ;AAAA,IAC1D;AAAA,EACF;AAEA,QAAM,cACJ,aAAa,cAAe,MAAM,gCAAgC;AACpE,MAAI,CAAC,aAAa;AAChB,WAAO;AAAA,EACT;AAEA,QAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,iCAAuB;AACnE,QAAM,WAAW,MAAM,mBAAmB;AAC1C,MAAI,SAAS,WAAW;AACtB,WAAO,SAAS;AAAA,EAClB;AAKA,SAAO;AACT;AAEA,eAAe,kCAAoD;AACjE,MAAI;AAIF,UAAM,EAAE,kBAAAC,kBAAiB,IAAI,MAAM,OAAO,8BAAoB;AAC9D,UAAM,SAAS,MAAMA,kBAAiB;AACtC,WAAO,OAAO,sBAAsB;AAAA,EACtC,QAAQ;AAIN,WAAO;AAAA,EACT;AACF;AAYA,eAAsB,uBAAmD;AACvE,MAAI,kBAAkB,MAAM;AAC1B,oBAAgB,MAAM,gBAAgB;AAMtC,QAAI,CAAC,sBAAsB,cAAc,SAAS,QAAQ;AACxD,YAAM,+BAA+B,aAAa;AAAA,IACpD;AACA,yBAAqB;AAAA,EACvB;AACA,SAAO;AACT;AAEA,eAAe,+BACb,QACe;AACf,MAAI;AACF,UAAM,CAAC,QAAQ,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC3C,sBAAsB,KAAK;AAAA,MAC3B,OAAO,KAAK;AAAA,IACd,CAAC;AACD,QAAI,CAAC,OAAQ;AACb,QAAI,UAAU;AAGZ,YAAM,sBAAsB,MAAM;AAClC;AAAA,IACF;AACA,QAAI,OAAO,eAAe,OAAO,cAAc;AAC7C,YAAM,OAAO,UAAU;AAAA,QACrB,aAAa,OAAO;AAAA,QACpB,cAAc,OAAO;AAAA,MACvB,CAAC;AAAA,IACH,WAAW,OAAO,aAAa;AAC7B,YAAM,OAAO,gBAAgB,OAAO,WAAW;AAAA,IACjD,OAAO;AACL;AAAA,IACF;AACA,UAAM,sBAAsB,MAAM;AAAA,EACpC,QAAQ;AAAA,EAKR;AACF;AAQA,eAAsB,mBAA0D;AAC9E,QAAM,UAAU,MAAM,qBAAqB;AAC3C,SAAO,QAAQ,KAAK;AACtB;AAWA,eAAsB,eAAe,OAAmC;AACtE,QAAM,aAAa,sBAAsB,GAAG,YAAY;AACtD,UAAM,UAAU,MAAM,qBAAqB;AAC3C,UAAM,QAAQ,UAAU,KAAK;AAAA,EAC/B,CAAC;AACH;;;ADlWA,SAAS,2BACP,OACyC;AACzC,MAAI,UAAU,UAAU,UAAU,WAAY,QAAO;AAIrD,SAAO;AACT;AAEO,SAAS,sBAA8B;AAC5C,SAAOC,MAAK,KAAKC,IAAG,QAAQ,GAAG,kBAAkB,aAAa;AAChE;AAOO,SAAS,oBAA4B;AAC1C,SAAO,sBAAsB;AAC/B;AAaA,eAAsB,mBAA0C;AAC9D,QAAM,SAAS,MAAM,aAA2B,oBAAoB,CAAC,EAAE;AAAA,IACrE,OAAO,CAAC;AAAA,EACV;AACA,SAAO;AAAA,IACL,aAAa,OAAO;AAAA,IACpB,mBAAmB,2BAA2B,OAAO,iBAAiB;AAAA,EACxE;AACF;AAUA,eAAsB,iBAAiB,QAAqC;AAC1E,QAAM,YAAYD,MAAK,KAAKC,IAAG,QAAQ,GAAG,gBAAgB;AAC1D,QAAM,UAAU,SAAS;AACzB,QAAM,aAA2B;AAAA,IAC/B,aAAa,OAAO;AAAA,IACpB,mBAAmB,2BAA2B,OAAO,iBAAiB;AAAA,EACxE;AACA,QAAM;AAAA,IACJ,oBAAoB;AAAA,IACpB,GAAG,KAAK,UAAU,YAAY,MAAM,CAAC,CAAC;AAAA;AAAA,IACtC,EAAE,MAAM,IAAM;AAAA,EAChB;AACF;","names":["os","path","loadGlobalConfig","path","os"]}

package/dist/agent-verifier/chunk-776W3UGV.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/build-target.ts","../../src/config/project-config.ts"],"sourcesContent":["declare const __DREAMBOARD_BUILD_CHANNEL__: string | undefined;\n\nconst injectedBuildChannel =\n  typeof __DREAMBOARD_BUILD_CHANNEL__ === \"string\"\n    ? __DREAMBOARD_BUILD_CHANNEL__\n    : undefined;\n\nexport const BUILD_CHANNEL =\n  injectedBuildChannel === \"published\" ? \"published\" : \"development\";\n\nexport const IS_PUBLISHED_BUILD = BUILD_CHANNEL === \"published\";\nexport const PUBLISHED_ENVIRONMENT = \"prod\" as const;\n","import path from \"node:path\";\nimport type {\n  LegacyProjectConfigV1,\n  ProjectConfig,\n  ProjectEnvironmentBindingV1,\n  ProjectEnvironmentStateV1,\n  ProjectManifestV2,\n} from \"../types.js\";\nimport {\n  PROJECT_DIR_NAME,\n  PROJECT_CONFIG_FILE,\n  PROJECT_STATE_FILE,\n} from \"../constants.js\";\nimport { ensureDir, exists, readJsonFile } from \"../utils/fs.js\";\nimport { atomicWriteFile } from \"../utils/atomic-file.js\";\n\nconst LEGACY_DEFAULT_DEPLOYMENT_ID = \"legacy\";\nconst LEGACY_DEFAULT_OWNER_SCOPE_ID = \"default\";\nconst LEGACY_DEFAULT_BINDING_KEY = `${LEGACY_DEFAULT_DEPLOYMENT_ID}:${LEGACY_DEFAULT_OWNER_SCOPE_ID}`;\n\nfunction normalizeProjectManifest(config: ProjectConfig): ProjectManifestV2 {\n  return {\n    schemaVersion: 2,\n    projectId: config.projectId,\n    slug: config.slug,\n  };\n}\n\nfunction normalizeProjectBinding(\n  config: ProjectConfig,\n): ProjectEnvironmentBindingV1 {\n  return {\n    deploymentId: config.deploymentId ?? LEGACY_DEFAULT_DEPLOYMENT_ID,\n    ownerScopeId: config.ownerScopeId ?? LEGACY_DEFAULT_OWNER_SCOPE_ID,\n    gameId: config.gameId,\n    remoteHeadDigest: config.remoteHeadDigest,\n    jobId: config.jobId,\n    agentManaged: config.agentManaged,\n    workspacePrepared: config.workspacePrepared,\n    allowCreateGame: config.allowCreateGame,\n    environment: config.environment,\n    authoring: config.authoring,\n    compile: config.compile,\n    localMaintainerRegistry: config.localMaintainerRegistry,\n    apiBaseUrl: config.apiBaseUrl,\n    webBaseUrl: config.webBaseUrl,\n    packageManifest: config.packageManifest,\n    environmentManifest: config.environmentManifest,\n  };\n}\n\nfunction normalizeProjectState(\n  config: ProjectConfig,\n  existing?: ProjectEnvironmentStateV1,\n): ProjectEnvironmentStateV1 {\n  const binding = normalizeProjectBinding(config);\n  const bindingKey =\n    config.bindingKey || `${binding.deploymentId}:${binding.ownerScopeId}`;\n  return {\n    schemaVersion: 1,\n    bindings: {\n      ...(existing?.bindings ?? {}),\n      [bindingKey]: binding,\n    },\n  };\n}\n\nfunction mergeManifestAndBinding(\n  manifest: ProjectManifestV2,\n  binding: ProjectEnvironmentBindingV1 | undefined,\n  bindingKey: string | undefined,\n): ProjectConfig {\n  return {\n    ...manifest,\n    ...(binding ?? {\n      deploymentId: LEGACY_DEFAULT_DEPLOYMENT_ID,\n      ownerScopeId: LEGACY_DEFAULT_OWNER_SCOPE_ID,\n    }),\n    gameId: binding?.gameId ?? manifest.projectId,\n    bindingKey:\n      bindingKey ??\n      `${binding?.deploymentId ?? LEGACY_DEFAULT_DEPLOYMENT_ID}:${\n        binding?.ownerScopeId ?? LEGACY_DEFAULT_OWNER_SCOPE_ID\n      }`,\n  };\n}\n\nfunction isProjectManifestV2(value: unknown): value is ProjectManifestV2 {\n  const candidate = value as Partial<ProjectManifestV2>;\n  return (\n    candidate?.schemaVersion === 2 &&\n    typeof candidate.projectId === \"string\" &&\n    typeof candidate.slug === \"string\"\n  );\n}\n\nfunction normalizeLegacyProjectConfig(\n  config: LegacyProjectConfigV1 & { projectId?: string },\n): ProjectConfig {\n  return {\n    schemaVersion: 2,\n    projectId: config.projectId ?? config.gameId,\n    slug: config.slug,\n    bindingKey: LEGACY_DEFAULT_BINDING_KEY,\n    deploymentId: LEGACY_DEFAULT_DEPLOYMENT_ID,\n    ownerScopeId: LEGACY_DEFAULT_OWNER_SCOPE_ID,\n    gameId: config.gameId,\n    jobId: config.jobId,\n    agentManaged: config.agentManaged,\n    workspacePrepared: config.workspacePrepared,\n    allowCreateGame: config.allowCreateGame,\n    environment: config.environment,\n    authoring: config.authoring,\n    compile: config.compile,\n    localMaintainerRegistry: config.localMaintainerRegistry,\n    apiBaseUrl: config.apiBaseUrl,\n    webBaseUrl: config.webBaseUrl,\n    packageManifest: config.packageManifest,\n    environmentManifest: config.environmentManifest,\n  };\n}\n\nasync function loadProjectEnvironmentState(\n  rootDir: string,\n): Promise<ProjectEnvironmentStateV1> {\n  const filePath = path.join(rootDir, PROJECT_DIR_NAME, PROJECT_STATE_FILE);\n  if (!(await exists(filePath))) {\n    return { schemaVersion: 1, bindings: {} };\n  }\n  const state = await readJsonFile<ProjectEnvironmentStateV1>(filePath);\n  return state.schemaVersion === 1 && state.bindings\n    ? state\n    : { schemaVersion: 1, bindings: {} };\n}\n\nexport async function loadProjectConfig(\n  rootDir: string,\n): Promise<ProjectConfig> {\n  const filePath = path.join(rootDir, PROJECT_DIR_NAME, PROJECT_CONFIG_FILE);\n  const rawConfig = await readJsonFile<ProjectManifestV2 | LegacyProjectConfigV1>(\n    filePath,\n  );\n  if (!isProjectManifestV2(rawConfig)) {\n    const migrated = normalizeLegacyProjectConfig(\n      rawConfig as LegacyProjectConfigV1,\n    );\n    await updateProjectState(rootDir, migrated);\n    return migrated;\n  }\n\n  const state = await loadProjectEnvironmentState(rootDir);\n  const entries = Object.entries(state.bindings);\n  const [bindingKey, binding] =\n    entries.find(([key]) => key !== LEGACY_DEFAULT_BINDING_KEY) ??\n    entries.find(([key]) => key === LEGACY_DEFAULT_BINDING_KEY) ??\n    [];\n  return mergeManifestAndBinding(rawConfig, binding, bindingKey);\n}\n\nexport async function updateProjectState(\n  rootDir: string,\n  config: ProjectConfig,\n): Promise<void> {\n  const dir = path.join(rootDir, PROJECT_DIR_NAME);\n  await ensureDir(dir);\n  const existingState = await loadProjectEnvironmentState(rootDir);\n  await atomicWriteFile(\n    path.join(dir, PROJECT_CONFIG_FILE),\n    `${JSON.stringify(normalizeProjectManifest(config), null, 2)}\\n`,\n    { mode: 0o644 },\n  );\n  await atomicWriteFile(\n    path.join(dir, PROJECT_STATE_FILE),\n    `${JSON.stringify(normalizeProjectState(config, existingState), null, 2)}\\n`,\n    { mode: 0o600 },\n  );\n}\n\nexport async function findProjectRoot(\n  startDir: string,\n): Promise<string | null> {\n  let current = path.resolve(startDir);\n  for (let i = 0; i < 25; i++) {\n    const candidate = path.join(current, PROJECT_DIR_NAME, PROJECT_CONFIG_FILE);\n    if (await exists(candidate)) {\n      return current;\n    }\n    const parent = path.dirname(current);\n    if (parent === current) break;\n    current = parent;\n  }\n  return null;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAEA,IAAM,uBACJ,OACI,gBACA;AAEC,IAAM,gBACX,yBAAyB,cAAc,cAAc;AAEhD,IAAM,qBAAqB,kBAAkB;AAC7C,IAAM,wBAAwB;;;ACXrC,OAAO,UAAU;AAgBjB,IAAM,+BAA+B;AACrC,IAAM,gCAAgC;AACtC,IAAM,6BAA6B,GAAG,4BAA4B,IAAI,6BAA6B;AAEnG,SAAS,yBAAyB,QAA0C;AAC1E,SAAO;AAAA,IACL,eAAe;AAAA,IACf,WAAW,OAAO;AAAA,IAClB,MAAM,OAAO;AAAA,EACf;AACF;AAEA,SAAS,wBACP,QAC6B;AAC7B,SAAO;AAAA,IACL,cAAc,OAAO,gBAAgB;AAAA,IACrC,cAAc,OAAO,gBAAgB;AAAA,IACrC,QAAQ,OAAO;AAAA,IACf,kBAAkB,OAAO;AAAA,IACzB,OAAO,OAAO;AAAA,IACd,cAAc,OAAO;AAAA,IACrB,mBAAmB,OAAO;AAAA,IAC1B,iBAAiB,OAAO;AAAA,IACxB,aAAa,OAAO;AAAA,IACpB,WAAW,OAAO;AAAA,IAClB,SAAS,OAAO;AAAA,IAChB,yBAAyB,OAAO;AAAA,IAChC,YAAY,OAAO;AAAA,IACnB,YAAY,OAAO;AAAA,IACnB,iBAAiB,OAAO;AAAA,IACxB,qBAAqB,OAAO;AAAA,EAC9B;AACF;AAEA,SAAS,sBACP,QACA,UAC2B;AAC3B,QAAM,UAAU,wBAAwB,MAAM;AAC9C,QAAM,aACJ,OAAO,cAAc,GAAG,QAAQ,YAAY,IAAI,QAAQ,YAAY;AACtE,SAAO;AAAA,IACL,eAAe;AAAA,IACf,UAAU;AAAA,MACR,GAAI,UAAU,YAAY,CAAC;AAAA,MAC3B,CAAC,UAAU,GAAG;AAAA,IAChB;AAAA,EACF;AACF;AAEA,SAAS,wBACP,UACA,SACA,YACe;AACf,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAI,WAAW;AAAA,MACb,cAAc;AAAA,MACd,cAAc;AAAA,IAChB;AAAA,IACA,QAAQ,SAAS,UAAU,SAAS;AAAA,IACpC,YACE,cACA,GAAG,SAAS,gBAAgB,4BAA4B,IACtD,SAAS,gBAAgB,6BAC3B;AAAA,EACJ;AACF;AAEA,SAAS,oBAAoB,OAA4C;AACvE,QAAM,YAAY;AAClB,SACE,WAAW,kBAAkB,KAC7B,OAAO,UAAU,cAAc,YAC/B,OAAO,UAAU,SAAS;AAE9B;AAEA,SAAS,6BACP,QACe;AACf,SAAO;AAAA,IACL,eAAe;AAAA,IACf,WAAW,OAAO,aAAa,OAAO;AAAA,IACtC,MAAM,OAAO;AAAA,IACb,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,cAAc;AAAA,IACd,QAAQ,OAAO;AAAA,IACf,OAAO,OAAO;AAAA,IACd,cAAc,OAAO;AAAA,IACrB,mBAAmB,OAAO;AAAA,IAC1B,iBAAiB,OAAO;AAAA,IACxB,aAAa,OAAO;AAAA,IACpB,WAAW,OAAO;AAAA,IAClB,SAAS,OAAO;AAAA,IAChB,yBAAyB,OAAO;AAAA,IAChC,YAAY,OAAO;AAAA,IACnB,YAAY,OAAO;AAAA,IACnB,iBAAiB,OAAO;AAAA,IACxB,qBAAqB,OAAO;AAAA,EAC9B;AACF;AAEA,eAAe,4BACb,SACoC;AACpC,QAAM,WAAW,KAAK,KAAK,SAAS,kBAAkB,kBAAkB;AACxE,MAAI,CAAE,MAAM,OAAO,QAAQ,GAAI;AAC7B,WAAO,EAAE,eAAe,GAAG,UAAU,CAAC,EAAE;AAAA,EAC1C;AACA,QAAM,QAAQ,MAAM,aAAwC,QAAQ;AACpE,SAAO,MAAM,kBAAkB,KAAK,MAAM,WACtC,QACA,EAAE,eAAe,GAAG,UAAU,CAAC,EAAE;AACvC;AAEA,eAAsB,kBACpB,SACwB;AACxB,QAAM,WAAW,KAAK,KAAK,SAAS,kBAAkB,mBAAmB;AACzE,QAAM,YAAY,MAAM;AAAA,IACtB;AAAA,EACF;AACA,MAAI,CAAC,oBAAoB,SAAS,GAAG;AACnC,UAAM,WAAW;AAAA,MACf;AAAA,IACF;AACA,UAAM,mBAAmB,SAAS,QAAQ;AAC1C,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,MAAM,4BAA4B,OAAO;AACvD,QAAM,UAAU,OAAO,QAAQ,MAAM,QAAQ;AAC7C,QAAM,CAAC,YAAY,OAAO,IACxB,QAAQ,KAAK,CAAC,CAAC,GAAG,MAAM,QAAQ,0BAA0B,KAC1D,QAAQ,KAAK,CAAC,CAAC,GAAG,MAAM,QAAQ,0BAA0B,KAC1D,CAAC;AACH,SAAO,wBAAwB,WAAW,SAAS,UAAU;AAC/D;AAEA,eAAsB,mBACpB,SACA,QACe;AACf,QAAM,MAAM,KAAK,KAAK,SAAS,gBAAgB;AAC/C,QAAM,UAAU,GAAG;AACnB,QAAM,gBAAgB,MAAM,4BAA4B,OAAO;AAC/D,QAAM;AAAA,IACJ,KAAK,KAAK,KAAK,mBAAmB;AAAA,IAClC,GAAG,KAAK,UAAU,yBAAyB,MAAM,GAAG,MAAM,CAAC,CAAC;AAAA;AAAA,IAC5D,EAAE,MAAM,IAAM;AAAA,EAChB;AACA,QAAM;AAAA,IACJ,KAAK,KAAK,KAAK,kBAAkB;AAAA,IACjC,GAAG,KAAK,UAAU,sBAAsB,QAAQ,aAAa,GAAG,MAAM,CAAC,CAAC;AAAA;AAAA,IACxE,EAAE,MAAM,IAAM;AAAA,EAChB;AACF;AAEA,eAAsB,gBACpB,UACwB;AACxB,MAAI,UAAU,KAAK,QAAQ,QAAQ;AACnC,WAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,UAAM,YAAY,KAAK,KAAK,SAAS,kBAAkB,mBAAmB;AAC1E,QAAI,MAAM,OAAO,SAAS,GAAG;AAC3B,aAAO;AAAA,IACT;AACA,UAAM,SAAS,KAAK,QAAQ,OAAO;AACnC,QAAI,WAAW,QAAS;AACxB,cAAU;AAAA,EACZ;AACA,SAAO;AACT;","names":[]}