@ekanos/cli 0.1.0 → 0.1.2

package/dist/commands/publish.js

@@ -0,0 +1,196 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { refreshStoredSession, requireSession, resolveAuthEnvironment, } from '../auth/session.js';
+import { gateFailedError, preconditionError, validationError } from '../errors.js';
+import { packProject } from '../pack.js';
+import { loadProject, serializeProject } from '../project.js';
+import { MAX_MANIFEST_BYTES, stillUnauthorized, submitArchive, } from '../publish-api.js';
+import { collectAllFindings } from '../validate-findings.js';
+/**
+ * `publish` — pack the project and submit it to a Fusion deployment.
+ *
+ * The submission gate is the SAME findings pass `validate` runs (one
+ * implementation, `validate-findings.ts`): any error-severity finding refuses
+ * the publish with GATE_FAILED (exit 10) and the findings in `data`, so an
+ * agent can branch on the code and fix-then-retry without re-running validate.
+ *
+ * Authorization is server-side — the dev seat on the target source — and the
+ * stored session is refreshed once on a 401, mirroring `whoami`. On the first
+ * successful publish the chosen source slug is persisted into `ekanos.json`
+ * so later publishes need no `--source`.
+ */
+export async function runPublish(ctx, args) {
+    const env = resolveAuthEnvironment(ctx, args.host, args.env, {
+        projectDir: args.dir,
+    });
+    const session = requireSession(env.store, env.host);
+    const loaded = loadProject(args.dir);
+    const source = resolveSourceSlug(args.source, loaded);
+    const version = readProjectVersion(loaded.projectDir);
+    const slug = loaded.primary.slug;
+    ctx.log(`Validating ${slug} before publishing…`);
+    const findings = await collectAllFindings(loaded);
+    const errorCount = findings.filter((f) => f.severity === 'error').length;
+    if (errorCount > 0) {
+        return ctx.fail(gateFailedError(`Refusing to publish: ${errorCount} validation finding` +
+            `${errorCount === 1 ? '' : 's'}.`, 'Resolve the error-severity findings in data.findings (they are ' +
+            'exactly what "ekanos validate" reports), then re-run ' +
+            '"ekanos publish".'), { slug, version, findings });
+    }
+    ctx.log(`Packing ${slug}@${version}…`);
+    const packed = packProject(loaded.projectDir);
+    const manifest = buildManifest(loaded, packed.files);
+    ctx.log(`Submitting to ${env.host} (source "${source}")…`);
+    const receipt = await submitWithOneRefresh(env, session, {
+        source,
+        slug,
+        version,
+        manifest,
+        archive: packed.archive,
+    });
+    const persisted = persistProjectFields(loaded, source, env.host);
+    const persistedNote = [
+        ...(persisted.source ? [`"source": "${source}"`] : []),
+        ...(persisted.host ? [`"host": "${env.host}"`] : []),
+    ];
+    const overrideNote = persisted.hostOverride
+        ? ` NOTE: this publish went to ${env.host}, but ekanos.json keeps ` +
+            `"host": "${persisted.hostOverride}" — a one-off override never ` +
+            `replaces the saved host; edit ekanos.json to change it.`
+        : '';
+    return ctx.succeed({
+        host: env.host,
+        source,
+        slug: receipt.slug,
+        version: receipt.version,
+        submissionId: receipt.submissionId,
+        state: receipt.state,
+        archiveSha256: receipt.archiveSha256,
+        files: packed.files,
+        sourcePersisted: persisted.source,
+        hostPersisted: persisted.host,
+        hostOverride: persisted.hostOverride,
+    }, `publish: submitted ${receipt.slug}@${receipt.version} to ${env.host} ` +
+        `(source "${source}", state "${receipt.state}").` +
+        (persistedNote.length > 0
+            ? ` Saved ${persistedNote.join(' and ')} to ekanos.json — future ` +
+                `publishes won't need the flag${persistedNote.length === 1 ? '' : 's'}.`
+            : '') +
+        overrideNote);
+}
+async function submitWithOneRefresh(env, session, payload) {
+    const first = await submitArchive(env.host, session.accessToken, payload);
+    if (first.status === 'ok')
+        return first.receipt;
+    // The access token no longer authenticates — an ordinary event, not an
+    // error. One refresh, one retry; a second 401 is authoritative.
+    const refreshed = await refreshStoredSession(env, session);
+    const second = await submitArchive(env.host, refreshed.accessToken, payload);
+    if (second.status === 'ok')
+        return second.receipt;
+    return stillUnauthorized(env.host);
+}
+function resolveSourceSlug(flag, loaded) {
+    const source = flag !== null && flag !== void 0 ? flag : loaded.project.source;
+    if (!source || source.trim().length === 0) {
+        throw validationError('No Fusion source given for the submission.', 'Pass "--source <slug>" (your operator names the source), or set ' +
+            '"source": "<slug>" in ekanos.json. A successful publish saves it ' +
+            'there for you.');
+    }
+    return source.trim();
+}
+/**
+ * Persist the chosen source AND host into ekanos.json after a SUCCESSFUL
+ * publish, so the next publish — and every other host-taking verb — needs no
+ * flag. Returns what was written. A write failure is reported but never fails
+ * the command — the submission already landed.
+ *
+ * `publish` is the only verb that writes ekanos.json: it is the one verb that
+ * proves the (host, source) pair actually works, and it always runs inside a
+ * project. `login` deliberately never writes — it is routinely run outside
+ * one, and the credential store's sole-host fallback covers it.
+ *
+ * `host` persists on FIRST WRITE ONLY. It decides where every future verb
+ * sends the bearer token and the source archive, so a one-off `--host`
+ * override (a staging test, say) must not silently become the project's
+ * sticky default; when the override differs from the stored host, the stored
+ * value is kept and the difference is called out in the result instead.
+ * Changing it is an explicit edit of ekanos.json. `source` keeps the simpler
+ * always-update semantics — it is scoped BY the host, and updating it is the
+ * documented way to repoint a project.
+ */
+function persistProjectFields(loaded, source, host) {
+    const wants = {
+        source: loaded.project.source !== source,
+        host: loaded.project.host === undefined,
+    };
+    const hostOverride = loaded.project.host !== undefined && loaded.project.host !== host
+        ? loaded.project.host
+        : null;
+    if (!wants.source && !wants.host) {
+        return { source: false, host: false, hostOverride };
+    }
+    try {
+        fs.writeFileSync(loaded.configPath, serializeProject(Object.assign(Object.assign({}, loaded.project), { source, host: wants.host ? host : loaded.project.host })));
+        return Object.assign(Object.assign({}, wants), { hostOverride });
+    }
+    catch (_a) {
+        // Diagnostics-only: the publish succeeded; a read-only ekanos.json just
+        // means the next publish needs the flags again.
+        return { source: false, host: false, hostOverride };
+    }
+}
+/**
+ * How many packed paths the manifest embeds before switching to a truncated
+ * list plus a `filesTruncated` total. The manifest is metadata — the archive
+ * itself is the payload — and the server caps it at MAX_MANIFEST_BYTES, so a
+ * many-small-files project must not be able to blow the cap with its file
+ * list alone.
+ */
+const MANIFEST_FILE_LIST_CAP = 200;
+/**
+ * The submission manifest: the parsed ekanos.json, the integration entries,
+ * and (a bounded prefix of) the packed file list. Refuses to build one over
+ * the server's byte cap — a clear VALIDATION error here beats the server's
+ * generic 400 after a 4 MiB upload.
+ */
+function buildManifest(loaded, files) {
+    const manifest = JSON.stringify(Object.assign({ project: loaded.project, integrations: loaded.integrations.map((i) => ({
+            slug: i.slug,
+            entry: i.entry,
+        })), files: files.slice(0, MANIFEST_FILE_LIST_CAP) }, (files.length > MANIFEST_FILE_LIST_CAP
+        ? { filesTruncated: files.length }
+        : {})));
+    const bytes = Buffer.byteLength(manifest, 'utf8');
+    if (bytes > MAX_MANIFEST_BYTES) {
+        throw validationError(`The submission manifest is ${bytes} bytes, over the ` +
+            `${MAX_MANIFEST_BYTES}-byte server cap.`, 'The manifest embeds your ekanos.json — trim oversized fields there ' +
+            '(sourceGlobs is the usual culprit), then re-run "ekanos publish".');
+    }
+    return manifest;
+}
+const SEMVER_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+/**
+ * The submitted version is the project's own `package.json#version` — one
+ * source of truth, the same field npm would publish.
+ */
+function readProjectVersion(projectDir) {
+    const manifestPath = path.join(projectDir, 'package.json');
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    }
+    catch (error) {
+        throw preconditionError(`Could not read ${manifestPath}: ${error instanceof Error ? error.message : String(error)}`, `Ensure the project has a valid package.json — its "version" field is ` +
+            `what gets submitted.`);
+    }
+    const version = typeof parsed === 'object' && parsed !== null
+        ? parsed.version
+        : undefined;
+    if (typeof version !== 'string' || !SEMVER_PATTERN.test(version)) {
+        throw validationError(`package.json "version" is ${typeof version === 'string' ? `"${version}"` : 'missing'}, which is not a semver version.`, `Set "version" in ${manifestPath} to a semver string like "0.1.0", ` +
+            `then re-run "ekanos publish".`);
+    }
+    return version;
+}
+//# sourceMappingURL=publish.js.map

package/dist/commands/publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../src/commands/publish.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEhF,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAsB,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,GACd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAa1D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAe,EACf,IAAiB;IAEjB,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE;QAC3D,UAAU,EAAE,IAAI,CAAC,GAAG;KACrB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;IAEjC,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,qBAAqB,CAAC,CAAC;IAEjD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IAEzE,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC,IAAI,CACb,eAAe,CACb,wBAAwB,UAAU,qBAAqB;YACrD,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,EACnC,iEAAiE;YAC/D,uDAAuD;YACvD,mBAAmB,CACtB,EACD,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAC5B,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,OAAO,GAAG,CAAC,CAAC;IAEvC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAErD,GAAG,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC,IAAI,aAAa,MAAM,KAAK,CAAC,CAAC;IAE3D,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE;QACvD,MAAM;QACN,IAAI;QACJ,OAAO;QACP,QAAQ;QACR,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAEjE,MAAM,aAAa,GAAG;QACpB,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC;IAEF,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY;QACzC,CAAC,CAAC,+BAA+B,GAAG,CAAC,IAAI,0BAA0B;YACjE,YAAY,SAAS,CAAC,YAAY,+BAA+B;YACjE,yDAAyD;QAC3D,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO,GAAG,CAAC,OAAO,CAChB;QACE,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM;QACN,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,eAAe,EAAE,SAAS,CAAC,MAAM;QACjC,aAAa,EAAE,SAAS,CAAC,IAAI;QAC7B,YAAY,EAAE,SAAS,CAAC,YAAY;KACrC,EACD,sBAAsB,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,OAAO,GAAG,CAAC,IAAI,GAAG;QACrE,YAAY,MAAM,aAAa,OAAO,CAAC,KAAK,KAAK;QACjD,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;YACvB,CAAC,CAAC,UAAU,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,2BAA2B;gBAChE,gCAAgC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;YAC1E,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,CACf,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,GAA8C,EAC9C,OAAsB,EACtB,OAA4C;IAE5C,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAE1E,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IAEhD,uEAAuE;IACvE,gEAAgE;IAChE,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAE7E,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC;IAElD,OAAO,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAwB,EACxB,MAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;IAE7C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,eAAe,CACnB,4CAA4C,EAC5C,kEAAkE;YAChE,mEAAmE;YACnE,gBAAgB,CACnB,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,oBAAoB,CAC3B,MAAqB,EACrB,MAAc,EACd,IAAY;IAEZ,MAAM,KAAK,GAAG;QACZ,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;QACxC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS;KACxC,CAAC;IAEF,MAAM,YAAY,GAChB,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI;QAC/D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI;QACrB,CAAC,CAAC,IAAI,CAAC;IAEX,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CACd,MAAM,CAAC,UAAU,EACjB,gBAAgB,iCACX,MAAM,CAAC,OAAO,KACjB,MAAM,EACN,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAC7C,CACH,CAAC;QAEF,uCAAY,KAAK,KAAE,YAAY,IAAG;IACpC,CAAC;IAAC,WAAM,CAAC;QACP,wEAAwE;QACxE,gDAAgD;QAChD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACtD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC;;;;;GAKG;AACH,SAAS,aAAa,CAAC,MAAqB,EAAE,KAAe;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,iBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,EACvB,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAC,EACH,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,IAC1C,CAAC,KAAK,CAAC,MAAM,GAAG,sBAAsB;QACvC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,MAAM,EAAE;QAClC,CAAC,CAAC,EAAE,CAAC,EACP,CAAC;IAEH,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAElD,IAAI,KAAK,GAAG,kBAAkB,EAAE,CAAC;QAC/B,MAAM,eAAe,CACnB,8BAA8B,KAAK,mBAAmB;YACpD,GAAG,kBAAkB,mBAAmB,EAC1C,qEAAqE;YACnE,mEAAmE,CACtE,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,cAAc,GAClB,gGAAgG,CAAC;AAEnG;;;GAGG;AACH,SAAS,kBAAkB,CAAC,UAAkB;IAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAE3D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,iBAAiB,CACrB,kBAAkB,YAAY,KAC5B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,uEAAuE;YACrE,sBAAsB,CACzB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GACX,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAC3C,CAAC,CAAE,MAAgC,CAAC,OAAO;QAC3C,CAAC,CAAC,SAAS,CAAC;IAEhB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,MAAM,eAAe,CACnB,6BACE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,SACjD,kCAAkC,EAClC,oBAAoB,YAAY,oCAAoC;YAClE,+BAA+B,CAClC,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport type { StoredSession } from '../auth/credential-store';\nimport {\n  refreshStoredSession,\n  requireSession,\n  resolveAuthEnvironment,\n} from '../auth/session';\nimport type { CliContext } from '../context';\nimport { gateFailedError, preconditionError, validationError } from '../errors';\nimport type { ExitCode } from '../exit-codes';\nimport { packProject } from '../pack';\nimport { type LoadedProject, loadProject, serializeProject } from '../project';\nimport {\n  MAX_MANIFEST_BYTES,\n  stillUnauthorized,\n  submitArchive,\n} from '../publish-api';\nimport { collectAllFindings } from '../validate-findings';\n\nexport interface PublishArgs {\n  host?: string;\n  /** Fusion source slug. Falls back to ekanos.json's \"source\" field. */\n  source?: string;\n  /** Project directory (contains ekanos.json). Defaults to cwd. */\n  dir: string;\n  /** Accepted for non-interactive ergonomics; publish never prompts regardless. */\n  yes: boolean;\n  env: Record<string, string | undefined>;\n}\n\n/**\n * `publish` — pack the project and submit it to a Fusion deployment.\n *\n * The submission gate is the SAME findings pass `validate` runs (one\n * implementation, `validate-findings.ts`): any error-severity finding refuses\n * the publish with GATE_FAILED (exit 10) and the findings in `data`, so an\n * agent can branch on the code and fix-then-retry without re-running validate.\n *\n * Authorization is server-side — the dev seat on the target source — and the\n * stored session is refreshed once on a 401, mirroring `whoami`. On the first\n * successful publish the chosen source slug is persisted into `ekanos.json`\n * so later publishes need no `--source`.\n */\nexport async function runPublish(\n  ctx: CliContext,\n  args: PublishArgs,\n): Promise<ExitCode> {\n  const env = resolveAuthEnvironment(ctx, args.host, args.env, {\n    projectDir: args.dir,\n  });\n  const session = requireSession(env.store, env.host);\n\n  const loaded = loadProject(args.dir);\n  const source = resolveSourceSlug(args.source, loaded);\n  const version = readProjectVersion(loaded.projectDir);\n  const slug = loaded.primary.slug;\n\n  ctx.log(`Validating ${slug} before publishing…`);\n\n  const findings = await collectAllFindings(loaded);\n  const errorCount = findings.filter((f) => f.severity === 'error').length;\n\n  if (errorCount > 0) {\n    return ctx.fail(\n      gateFailedError(\n        `Refusing to publish: ${errorCount} validation finding` +\n          `${errorCount === 1 ? '' : 's'}.`,\n        'Resolve the error-severity findings in data.findings (they are ' +\n          'exactly what \"ekanos validate\" reports), then re-run ' +\n          '\"ekanos publish\".',\n      ),\n      { slug, version, findings },\n    );\n  }\n\n  ctx.log(`Packing ${slug}@${version}…`);\n\n  const packed = packProject(loaded.projectDir);\n  const manifest = buildManifest(loaded, packed.files);\n\n  ctx.log(`Submitting to ${env.host} (source \"${source}\")…`);\n\n  const receipt = await submitWithOneRefresh(env, session, {\n    source,\n    slug,\n    version,\n    manifest,\n    archive: packed.archive,\n  });\n\n  const persisted = persistProjectFields(loaded, source, env.host);\n\n  const persistedNote = [\n    ...(persisted.source ? [`\"source\": \"${source}\"`] : []),\n    ...(persisted.host ? [`\"host\": \"${env.host}\"`] : []),\n  ];\n\n  const overrideNote = persisted.hostOverride\n    ? ` NOTE: this publish went to ${env.host}, but ekanos.json keeps ` +\n      `\"host\": \"${persisted.hostOverride}\" — a one-off override never ` +\n      `replaces the saved host; edit ekanos.json to change it.`\n    : '';\n\n  return ctx.succeed(\n    {\n      host: env.host,\n      source,\n      slug: receipt.slug,\n      version: receipt.version,\n      submissionId: receipt.submissionId,\n      state: receipt.state,\n      archiveSha256: receipt.archiveSha256,\n      files: packed.files,\n      sourcePersisted: persisted.source,\n      hostPersisted: persisted.host,\n      hostOverride: persisted.hostOverride,\n    },\n    `publish: submitted ${receipt.slug}@${receipt.version} to ${env.host} ` +\n      `(source \"${source}\", state \"${receipt.state}\").` +\n      (persistedNote.length > 0\n        ? ` Saved ${persistedNote.join(' and ')} to ekanos.json — future ` +\n          `publishes won't need the flag${persistedNote.length === 1 ? '' : 's'}.`\n        : '') +\n      overrideNote,\n  );\n}\n\nasync function submitWithOneRefresh(\n  env: ReturnType<typeof resolveAuthEnvironment>,\n  session: StoredSession,\n  payload: Parameters<typeof submitArchive>[2],\n) {\n  const first = await submitArchive(env.host, session.accessToken, payload);\n\n  if (first.status === 'ok') return first.receipt;\n\n  // The access token no longer authenticates — an ordinary event, not an\n  // error. One refresh, one retry; a second 401 is authoritative.\n  const refreshed = await refreshStoredSession(env, session);\n  const second = await submitArchive(env.host, refreshed.accessToken, payload);\n\n  if (second.status === 'ok') return second.receipt;\n\n  return stillUnauthorized(env.host);\n}\n\nfunction resolveSourceSlug(\n  flag: string | undefined,\n  loaded: LoadedProject,\n): string {\n  const source = flag ?? loaded.project.source;\n\n  if (!source || source.trim().length === 0) {\n    throw validationError(\n      'No Fusion source given for the submission.',\n      'Pass \"--source <slug>\" (your operator names the source), or set ' +\n        '\"source\": \"<slug>\" in ekanos.json. A successful publish saves it ' +\n        'there for you.',\n    );\n  }\n\n  return source.trim();\n}\n\n/**\n * Persist the chosen source AND host into ekanos.json after a SUCCESSFUL\n * publish, so the next publish — and every other host-taking verb — needs no\n * flag. Returns what was written. A write failure is reported but never fails\n * the command — the submission already landed.\n *\n * `publish` is the only verb that writes ekanos.json: it is the one verb that\n * proves the (host, source) pair actually works, and it always runs inside a\n * project. `login` deliberately never writes — it is routinely run outside\n * one, and the credential store's sole-host fallback covers it.\n *\n * `host` persists on FIRST WRITE ONLY. It decides where every future verb\n * sends the bearer token and the source archive, so a one-off `--host`\n * override (a staging test, say) must not silently become the project's\n * sticky default; when the override differs from the stored host, the stored\n * value is kept and the difference is called out in the result instead.\n * Changing it is an explicit edit of ekanos.json. `source` keeps the simpler\n * always-update semantics — it is scoped BY the host, and updating it is the\n * documented way to repoint a project.\n */\nfunction persistProjectFields(\n  loaded: LoadedProject,\n  source: string,\n  host: string,\n): { source: boolean; host: boolean; hostOverride: string | null } {\n  const wants = {\n    source: loaded.project.source !== source,\n    host: loaded.project.host === undefined,\n  };\n\n  const hostOverride =\n    loaded.project.host !== undefined && loaded.project.host !== host\n      ? loaded.project.host\n      : null;\n\n  if (!wants.source && !wants.host) {\n    return { source: false, host: false, hostOverride };\n  }\n\n  try {\n    fs.writeFileSync(\n      loaded.configPath,\n      serializeProject({\n        ...loaded.project,\n        source,\n        host: wants.host ? host : loaded.project.host,\n      }),\n    );\n\n    return { ...wants, hostOverride };\n  } catch {\n    // Diagnostics-only: the publish succeeded; a read-only ekanos.json just\n    // means the next publish needs the flags again.\n    return { source: false, host: false, hostOverride };\n  }\n}\n\n/**\n * How many packed paths the manifest embeds before switching to a truncated\n * list plus a `filesTruncated` total. The manifest is metadata — the archive\n * itself is the payload — and the server caps it at MAX_MANIFEST_BYTES, so a\n * many-small-files project must not be able to blow the cap with its file\n * list alone.\n */\nconst MANIFEST_FILE_LIST_CAP = 200;\n\n/**\n * The submission manifest: the parsed ekanos.json, the integration entries,\n * and (a bounded prefix of) the packed file list. Refuses to build one over\n * the server's byte cap — a clear VALIDATION error here beats the server's\n * generic 400 after a 4 MiB upload.\n */\nfunction buildManifest(loaded: LoadedProject, files: string[]): string {\n  const manifest = JSON.stringify({\n    project: loaded.project,\n    integrations: loaded.integrations.map((i) => ({\n      slug: i.slug,\n      entry: i.entry,\n    })),\n    files: files.slice(0, MANIFEST_FILE_LIST_CAP),\n    ...(files.length > MANIFEST_FILE_LIST_CAP\n      ? { filesTruncated: files.length }\n      : {}),\n  });\n\n  const bytes = Buffer.byteLength(manifest, 'utf8');\n\n  if (bytes > MAX_MANIFEST_BYTES) {\n    throw validationError(\n      `The submission manifest is ${bytes} bytes, over the ` +\n        `${MAX_MANIFEST_BYTES}-byte server cap.`,\n      'The manifest embeds your ekanos.json — trim oversized fields there ' +\n        '(sourceGlobs is the usual culprit), then re-run \"ekanos publish\".',\n    );\n  }\n\n  return manifest;\n}\n\nconst SEMVER_PATTERN =\n  /^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$/;\n\n/**\n * The submitted version is the project's own `package.json#version` — one\n * source of truth, the same field npm would publish.\n */\nfunction readProjectVersion(projectDir: string): string {\n  const manifestPath = path.join(projectDir, 'package.json');\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));\n  } catch (error) {\n    throw preconditionError(\n      `Could not read ${manifestPath}: ${\n        error instanceof Error ? error.message : String(error)\n      }`,\n      `Ensure the project has a valid package.json — its \"version\" field is ` +\n        `what gets submitted.`,\n    );\n  }\n\n  const version =\n    typeof parsed === 'object' && parsed !== null\n      ? (parsed as { version?: unknown }).version\n      : undefined;\n\n  if (typeof version !== 'string' || !SEMVER_PATTERN.test(version)) {\n    throw validationError(\n      `package.json \"version\" is ${\n        typeof version === 'string' ? `\"${version}\"` : 'missing'\n      }, which is not a semver version.`,\n      `Set \"version\" in ${manifestPath} to a semver string like \"0.1.0\", ` +\n        `then re-run \"ekanos publish\".`,\n    );\n  }\n\n  return version;\n}\n"]}

package/dist/commands/status.d.ts

@@ -0,0 +1,28 @@
+import type { CliContext } from '../context.js';
+import { type ExitCode } from '../exit-codes.js';
+export interface StatusArgs {
+    host?: string;
+    /** Project directory (may contain ekanos.json). Defaults to cwd. */
+    dir: string;
+    env: Record<string, string | undefined>;
+}
+/**
+ * `status` — the read verb: where am I pointed, who am I, and what has this
+ * project submitted?
+ *
+ * Three sections, each degrading gracefully rather than failing:
+ *
+ *  - **session** — whoami's server-side identity check, but an absent or dead
+ *    session reports `authenticated: false` with a hint instead of exit 4. A
+ *    partner asking "what is my state?" must get an answer, not an error whose
+ *    answer it is.
+ *  - **project** — the ekanos.json in `--dir` (default cwd), when there is
+ *    one. No project is an ordinary state for `status`, never an error.
+ *  - **submissions** — `GET /api/partner/submissions?source=…` for the
+ *    project's resolved source, only when both a session and a source exist.
+ *    Server errors here DO map through the taxonomy: an unreachable host or a
+ *    missing source is a fault to surface, not a state to absorb.
+ *
+ * Exit 0 whenever the report itself could be assembled.
+ */
+export declare function runStatus(ctx: CliContext, args: StatusArgs): Promise<ExitCode>;

package/dist/commands/status.js

@@ -0,0 +1,146 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { refreshStoredSession, resolveAuthEnvironment, resolveIdentity, } from '../auth/session.js';
+import { CliError, authRequiredError } from '../errors.js';
+import { ERROR_CODES } from '../exit-codes.js';
+import { EKANOS_CONFIG_FILENAME, loadProject } from '../project.js';
+import { listSubmissions } from '../publish-api.js';
+/**
+ * `status` — the read verb: where am I pointed, who am I, and what has this
+ * project submitted?
+ *
+ * Three sections, each degrading gracefully rather than failing:
+ *
+ *  - **session** — whoami's server-side identity check, but an absent or dead
+ *    session reports `authenticated: false` with a hint instead of exit 4. A
+ *    partner asking "what is my state?" must get an answer, not an error whose
+ *    answer it is.
+ *  - **project** — the ekanos.json in `--dir` (default cwd), when there is
+ *    one. No project is an ordinary state for `status`, never an error.
+ *  - **submissions** — `GET /api/partner/submissions?source=…` for the
+ *    project's resolved source, only when both a session and a source exist.
+ *    Server errors here DO map through the taxonomy: an unreachable host or a
+ *    missing source is a fault to surface, not a state to absorb.
+ *
+ * Exit 0 whenever the report itself could be assembled.
+ */
+export async function runStatus(ctx, args) {
+    var _a, _b;
+    const env = resolveAuthEnvironment(ctx, args.host, args.env, {
+        projectDir: args.dir,
+    });
+    const stored = env.store.read(env.host);
+    const session = stored
+        ? await probeSession(env, stored)
+        : {
+            authenticated: false,
+            hint: `Run "ekanos login --host ${env.host}" to sign in.`,
+        };
+    // probeSession may have refreshed the session — persisting a NEW access
+    // token and ROTATING the refresh token on disk. Re-read before using it:
+    // the pre-probe object now holds a dead access token and an already-spent
+    // refresh token, and presenting those would turn "logged in, token was
+    // merely stale" into a hard exit-4 — the one failure this command promises
+    // never to produce.
+    const live = stored ? ((_a = env.store.read(env.host)) !== null && _a !== void 0 ? _a : stored) : null;
+    const project = readProjectReport(args.dir);
+    let submissions = null;
+    if ((project === null || project === void 0 ? void 0 : project.source) && session.authenticated && live) {
+        submissions = await listWithOneRefresh(env, live, project.source);
+    }
+    else if ((project === null || project === void 0 ? void 0 : project.source) && !session.authenticated) {
+        ctx.log(`ekanos: not logged in to ${env.host} — skipping the submission list. ` +
+            ((_b = session.hint) !== null && _b !== void 0 ? _b : ''));
+    }
+    else if (project && !project.source) {
+        ctx.log('ekanos: this project has no "source" in ekanos.json yet — the first ' +
+            '"ekanos publish --source <slug>" saves one, and status will list ' +
+            'submissions from then on.');
+    }
+    return ctx.succeed(Object.assign(Object.assign({ host: env.host }, session), { credentialsPath: env.store.filePath, project,
+        submissions }), humanSummary(env.host, session, project, submissions));
+}
+/**
+ * whoami's identity resolution, with AUTH_REQUIRED absorbed into
+ * `authenticated: false`. Anything else — network, precondition, MFA mapped
+ * to auth by `fetchIdentity` — still propagates: "the host was unreachable"
+ * must never be reported as "you are logged out".
+ */
+async function probeSession(env, stored) {
+    try {
+        const { identity, session } = await resolveIdentity(env, stored);
+        return {
+            authenticated: true,
+            user: { id: identity.id, email: identity.email, name: identity.name },
+            expiresAt: session.expiresAt,
+        };
+    }
+    catch (error) {
+        if (error instanceof CliError && error.code === ERROR_CODES.AUTH_REQUIRED) {
+            return { authenticated: false, hint: error.hint };
+        }
+        throw error;
+    }
+}
+/**
+ * Lenient project read: no ekanos.json means "not in a project", which is an
+ * answer, not an error. An ekanos.json that EXISTS but does not load keeps
+ * `loadProject`'s strict behaviour — a broken project file is a fault the
+ * partner needs named, whatever verb they ran.
+ */
+function readProjectReport(dir) {
+    var _a;
+    const projectDir = path.resolve(dir);
+    if (!fs.existsSync(path.join(projectDir, EKANOS_CONFIG_FILENAME))) {
+        return null;
+    }
+    const loaded = loadProject(projectDir);
+    return {
+        dir: loaded.projectDir,
+        slug: loaded.primary.slug,
+        source: (_a = loaded.project.source) !== null && _a !== void 0 ? _a : null,
+    };
+}
+/** Mirrors publish's one-refresh-one-retry on a stale access token. */
+async function listWithOneRefresh(env, session, source) {
+    const first = await listSubmissions(env.host, session.accessToken, source);
+    if (first.status === 'ok')
+        return first.integrations;
+    const refreshed = await refreshStoredSession(env, session);
+    const second = await listSubmissions(env.host, refreshed.accessToken, source);
+    if (second.status === 'ok')
+        return second.integrations;
+    // Authenticated a moment ago, unauthorized twice here: report the list as
+    // unavailable rather than the session as dead — probeSession already proved
+    // it. This is unreachable in practice; belt and braces for a racing revoke.
+    throw authRequiredError(`The session for ${env.host} could not authorize the submission list.`, `Run "ekanos login --host ${env.host}" and retry.`);
+}
+function humanSummary(host, session, project, submissions) {
+    var _a, _b, _c;
+    const lines = [];
+    lines.push(session.authenticated
+        ? `status: logged in to ${host} as ${(_b = (_a = session.user) === null || _a === void 0 ? void 0 : _a.email) !== null && _b !== void 0 ? _b : (_c = session.user) === null || _c === void 0 ? void 0 : _c.id}${session.expiresAt ? ` (session expires ${session.expiresAt})` : ''}.`
+        : `status: not logged in to ${host}.`);
+    if (project) {
+        lines.push(`  project: ${project.slug} in ${project.dir}` +
+            (project.source
+                ? ` (source "${project.source}")`
+                : ' (no source configured yet)'));
+    }
+    else {
+        lines.push('  project: none (no ekanos.json here).');
+    }
+    if (submissions) {
+        if (submissions.length === 0) {
+            lines.push('  submissions: none yet.');
+        }
+        for (const integration of submissions) {
+            for (const version of integration.versions) {
+                lines.push(`  submissions: ${integration.slug}@${version.version} — ` +
+                    `${version.state}${version.submittedAt ? ` (submitted ${version.submittedAt})` : ''}`);
+            }
+        }
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=status.js.map

package/dist/commands/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,WAAW,EAAiB,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAA0B,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAsBzE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAe,EACf,IAAgB;;IAEhB,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE;QAC3D,UAAU,EAAE,IAAI,CAAC,GAAG;KACrB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM;QACpB,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC;QACjC,CAAC,CAAC;YACE,aAAa,EAAE,KAAK;YACpB,IAAI,EAAE,4BAA4B,GAAG,CAAC,IAAI,eAAe;SAC1D,CAAC;IAEN,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,oBAAoB;IACpB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAA,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAI,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAElE,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE5C,IAAI,WAAW,GAA+B,IAAI,CAAC;IAEnD,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,KAAI,OAAO,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QACrD,WAAW,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;SAAM,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,KAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACrD,GAAG,CAAC,GAAG,CACL,4BAA4B,GAAG,CAAC,IAAI,mCAAmC;YACrE,CAAC,MAAA,OAAO,CAAC,IAAI,mCAAI,EAAE,CAAC,CACvB,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACtC,GAAG,CAAC,GAAG,CACL,sEAAsE;YACpE,mEAAmE;YACnE,2BAA2B,CAC9B,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,+BAEd,IAAI,EAAE,GAAG,CAAC,IAAI,IACX,OAAO,KACV,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,EACnC,OAAO;QACP,WAAW,KAEb,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CACtD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CACzB,GAA8C,EAC9C,MAAqB;IAErB,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAEjE,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;YACrE,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,aAAa,EAAE,CAAC;YAC1E,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAW;;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAErC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IAEvC,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,UAAU;QACtB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QACzB,MAAM,EAAE,MAAA,MAAM,CAAC,OAAO,CAAC,MAAM,mCAAI,IAAI;KACtC,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,KAAK,UAAU,kBAAkB,CAC/B,GAA8C,EAC9C,OAAsB,EACtB,MAAc;IAEd,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAE3E,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,YAAY,CAAC;IAErD,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAE9E,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,YAAY,CAAC;IAEvD,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,iBAAiB,CACrB,mBAAmB,GAAG,CAAC,IAAI,2CAA2C,EACtE,4BAA4B,GAAG,CAAC,IAAI,cAAc,CACnD,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,IAAY,EACZ,OAAsB,EACtB,OAA6B,EAC7B,WAAuC;;IAEvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CACR,OAAO,CAAC,aAAa;QACnB,CAAC,CAAC,wBAAwB,IAAI,OAC1B,MAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,KAAK,mCAAI,MAAA,OAAO,CAAC,IAAI,0CAAE,EACvC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;QAC1E,CAAC,CAAC,4BAA4B,IAAI,GAAG,CACxC,CAAC;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,CAAC,IAAI,CACR,cAAc,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,GAAG,EAAE;YAC5C,CAAC,OAAO,CAAC,MAAM;gBACb,CAAC,CAAC,aAAa,OAAO,CAAC,MAAM,IAAI;gBACjC,CAAC,CAAC,6BAA6B,CAAC,CACrC,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACzC,CAAC;QAED,KAAK,MAAM,WAAW,IAAI,WAAW,EAAE,CAAC;YACtC,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;gBAC3C,KAAK,CAAC,IAAI,CACR,kBAAkB,WAAW,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK;oBACxD,GAAG,OAAO,CAAC,KAAK,GACd,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAChE,EAAE,CACL,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport type { StoredSession } from '../auth/credential-store';\nimport {\n  refreshStoredSession,\n  resolveAuthEnvironment,\n  resolveIdentity,\n} from '../auth/session';\nimport type { CliContext } from '../context';\nimport { CliError, authRequiredError } from '../errors';\nimport { ERROR_CODES, type ExitCode } from '../exit-codes';\nimport { EKANOS_CONFIG_FILENAME, loadProject } from '../project';\nimport { type SubmissionListing, listSubmissions } from '../publish-api';\n\nexport interface StatusArgs {\n  host?: string;\n  /** Project directory (may contain ekanos.json). Defaults to cwd. */\n  dir: string;\n  env: Record<string, string | undefined>;\n}\n\ninterface SessionReport {\n  authenticated: boolean;\n  user?: { id: string; email: string | null; name: string | null };\n  expiresAt?: string;\n  hint?: string;\n}\n\ninterface ProjectReport {\n  dir: string;\n  slug: string;\n  source: string | null;\n}\n\n/**\n * `status` — the read verb: where am I pointed, who am I, and what has this\n * project submitted?\n *\n * Three sections, each degrading gracefully rather than failing:\n *\n *  - **session** — whoami's server-side identity check, but an absent or dead\n *    session reports `authenticated: false` with a hint instead of exit 4. A\n *    partner asking \"what is my state?\" must get an answer, not an error whose\n *    answer it is.\n *  - **project** — the ekanos.json in `--dir` (default cwd), when there is\n *    one. No project is an ordinary state for `status`, never an error.\n *  - **submissions** — `GET /api/partner/submissions?source=…` for the\n *    project's resolved source, only when both a session and a source exist.\n *    Server errors here DO map through the taxonomy: an unreachable host or a\n *    missing source is a fault to surface, not a state to absorb.\n *\n * Exit 0 whenever the report itself could be assembled.\n */\nexport async function runStatus(\n  ctx: CliContext,\n  args: StatusArgs,\n): Promise<ExitCode> {\n  const env = resolveAuthEnvironment(ctx, args.host, args.env, {\n    projectDir: args.dir,\n  });\n\n  const stored = env.store.read(env.host);\n  const session = stored\n    ? await probeSession(env, stored)\n    : {\n        authenticated: false,\n        hint: `Run \"ekanos login --host ${env.host}\" to sign in.`,\n      };\n\n  // probeSession may have refreshed the session — persisting a NEW access\n  // token and ROTATING the refresh token on disk. Re-read before using it:\n  // the pre-probe object now holds a dead access token and an already-spent\n  // refresh token, and presenting those would turn \"logged in, token was\n  // merely stale\" into a hard exit-4 — the one failure this command promises\n  // never to produce.\n  const live = stored ? (env.store.read(env.host) ?? stored) : null;\n\n  const project = readProjectReport(args.dir);\n\n  let submissions: SubmissionListing[] | null = null;\n\n  if (project?.source && session.authenticated && live) {\n    submissions = await listWithOneRefresh(env, live, project.source);\n  } else if (project?.source && !session.authenticated) {\n    ctx.log(\n      `ekanos: not logged in to ${env.host} — skipping the submission list. ` +\n        (session.hint ?? ''),\n    );\n  } else if (project && !project.source) {\n    ctx.log(\n      'ekanos: this project has no \"source\" in ekanos.json yet — the first ' +\n        '\"ekanos publish --source <slug>\" saves one, and status will list ' +\n        'submissions from then on.',\n    );\n  }\n\n  return ctx.succeed(\n    {\n      host: env.host,\n      ...session,\n      credentialsPath: env.store.filePath,\n      project,\n      submissions,\n    },\n    humanSummary(env.host, session, project, submissions),\n  );\n}\n\n/**\n * whoami's identity resolution, with AUTH_REQUIRED absorbed into\n * `authenticated: false`. Anything else — network, precondition, MFA mapped\n * to auth by `fetchIdentity` — still propagates: \"the host was unreachable\"\n * must never be reported as \"you are logged out\".\n */\nasync function probeSession(\n  env: ReturnType<typeof resolveAuthEnvironment>,\n  stored: StoredSession,\n): Promise<SessionReport> {\n  try {\n    const { identity, session } = await resolveIdentity(env, stored);\n\n    return {\n      authenticated: true,\n      user: { id: identity.id, email: identity.email, name: identity.name },\n      expiresAt: session.expiresAt,\n    };\n  } catch (error) {\n    if (error instanceof CliError && error.code === ERROR_CODES.AUTH_REQUIRED) {\n      return { authenticated: false, hint: error.hint };\n    }\n\n    throw error;\n  }\n}\n\n/**\n * Lenient project read: no ekanos.json means \"not in a project\", which is an\n * answer, not an error. An ekanos.json that EXISTS but does not load keeps\n * `loadProject`'s strict behaviour — a broken project file is a fault the\n * partner needs named, whatever verb they ran.\n */\nfunction readProjectReport(dir: string): ProjectReport | null {\n  const projectDir = path.resolve(dir);\n\n  if (!fs.existsSync(path.join(projectDir, EKANOS_CONFIG_FILENAME))) {\n    return null;\n  }\n\n  const loaded = loadProject(projectDir);\n\n  return {\n    dir: loaded.projectDir,\n    slug: loaded.primary.slug,\n    source: loaded.project.source ?? null,\n  };\n}\n\n/** Mirrors publish's one-refresh-one-retry on a stale access token. */\nasync function listWithOneRefresh(\n  env: ReturnType<typeof resolveAuthEnvironment>,\n  session: StoredSession,\n  source: string,\n): Promise<SubmissionListing[]> {\n  const first = await listSubmissions(env.host, session.accessToken, source);\n\n  if (first.status === 'ok') return first.integrations;\n\n  const refreshed = await refreshStoredSession(env, session);\n  const second = await listSubmissions(env.host, refreshed.accessToken, source);\n\n  if (second.status === 'ok') return second.integrations;\n\n  // Authenticated a moment ago, unauthorized twice here: report the list as\n  // unavailable rather than the session as dead — probeSession already proved\n  // it. This is unreachable in practice; belt and braces for a racing revoke.\n  throw authRequiredError(\n    `The session for ${env.host} could not authorize the submission list.`,\n    `Run \"ekanos login --host ${env.host}\" and retry.`,\n  );\n}\n\nfunction humanSummary(\n  host: string,\n  session: SessionReport,\n  project: ProjectReport | null,\n  submissions: SubmissionListing[] | null,\n): string {\n  const lines: string[] = [];\n\n  lines.push(\n    session.authenticated\n      ? `status: logged in to ${host} as ${\n          session.user?.email ?? session.user?.id\n        }${session.expiresAt ? ` (session expires ${session.expiresAt})` : ''}.`\n      : `status: not logged in to ${host}.`,\n  );\n\n  if (project) {\n    lines.push(\n      `  project: ${project.slug} in ${project.dir}` +\n        (project.source\n          ? ` (source \"${project.source}\")`\n          : ' (no source configured yet)'),\n    );\n  } else {\n    lines.push('  project: none (no ekanos.json here).');\n  }\n\n  if (submissions) {\n    if (submissions.length === 0) {\n      lines.push('  submissions: none yet.');\n    }\n\n    for (const integration of submissions) {\n      for (const version of integration.versions) {\n        lines.push(\n          `  submissions: ${integration.slug}@${version.version} — ` +\n            `${version.state}${\n              version.submittedAt ? ` (submitted ${version.submittedAt})` : ''\n            }`,\n        );\n      }\n    }\n  }\n\n  return lines.join('\\n');\n}\n"]}

package/dist/commands/validate.d.ts

@@ -10,5 +10,8 @@ export interface ValidateArgs {
  * findings, and add project-level integrity checks (the vitest inline-SDK
  * check). Exit 0 with `findings: []` when clean; exit 3 when any error-severity
  * finding is present, with the findings carried in the envelope's `data`.
+ *
+ * The findings pass itself lives in `validate-findings.ts`, shared with
+ * `publish` so the publish gate cannot drift from what validate checks.
  */
 export declare function runValidate(ctx: CliContext, args: ValidateArgs): Promise<ExitCode>;

package/dist/commands/validate.js

@@ -1,55 +1,22 @@
-import { collectCollisionFindings, collectDefinitionFindings, } from '@ekanos/integration-schema';
-import { preconditionError, validationError } from '../errors.js';
-import { loadDefinition } from '../load-definition.js';
+import { validationError } from '../errors.js';
 import { loadProject } from '../project.js';
-import { collectProjectFindings } from '../project-checks.js';
+import { collectAllFindings } from '../validate-findings.js';
 /**
  * `validate` — parse the declaration with the REAL zod schemas from
  * `@ekanos/integration-schema` (never a reimplementation), gather structured
  * findings, and add project-level integrity checks (the vitest inline-SDK
  * check). Exit 0 with `findings: []` when clean; exit 3 when any error-severity
  * finding is present, with the findings carried in the envelope's `data`.
+ *
+ * The findings pass itself lives in `validate-findings.ts`, shared with
+ * `publish` so the publish gate cannot drift from what validate checks.
  */
 export async function runValidate(ctx, args) {
     const loaded = loadProject(args.dir);
     const slugs = loaded.integrations.map((i) => i.slug).join(', ');
     ctx.log(`Validating ${loaded.integrations.length} integration` +
         `${loaded.integrations.length === 1 ? '' : 's'} (${slugs})…`);
-    const findings = [];
-    const definitions = [];
-    for (const integration of loaded.integrations) {
-        const result = await loadDefinition(integration.entryPath, loaded.projectDir);
-        if (result.ok) {
-            findings.push(...collectDefinitionFindings(result.definition, {
-                file: integration.entryPath,
-            }));
-            findings.push(...collectSlugAgreementFindings(integration, result.definition));
-            definitions.push(result.definition);
-            continue;
-        }
-        if (result.kind === 'rejected') {
-            // The module loaded but the SDK/schema rejected the definition at import
-            // time — surface it as a validation finding rather than a crash.
-            findings.push({
-                check: 'definition.load',
-                severity: 'error',
-                file: integration.entryPath,
-                message: result.message,
-                hint: 'Fix the integration definition so defineIntegration() accepts it, ' +
-                    'then re-run validate.',
-            });
-            continue;
-        }
-        // A genuine module-load failure is a precondition, not a finding.
-        throw preconditionError(`Could not load the integration definition for "${integration.slug}": ` +
-            result.message, 'Ensure the entry module and its installed dependencies load under ' +
-            'Node, then re-run validate.');
-    }
-    // Cross-checks only mean something with more than one definition in hand —
-    // which is exactly what this verb could not see before, since ekanos.json
-    // held a single { slug, entry } and a second integration was invisible.
-    findings.push(...collectCollisionFindings(definitions));
-    findings.push(...collectProjectFindings(loaded.projectDir));
+    const findings = await collectAllFindings(loaded);
     const errorCount = findings.filter((f) => f.severity === 'error').length;
     const data = {
         slug: loaded.primary.slug,
@@ -65,34 +32,4 @@ export async function runValidate(ctx, args) {
     }
     return ctx.succeed(data, `validate: OK — no findings for ${slugs}.`);
 }
-/**
- * `ekanos.json` and the definition each carry a slug, and nothing compared
- * them: a project could declare `something-else` while the definition said
- * `repo-activity` and validate would report `{ ok: true, findings: [] }`.
- *
- * That is the identifier every surface addresses the integration by — the
- * harness route, the product slug, the widget id prefix, the MCP server — so
- * two sources of truth disagreeing is not a style question. It is an error,
- * not a warning, for the same reason a silent default is worse than a loud
- * one: the failure it causes shows up somewhere else entirely.
- */
-function collectSlugAgreementFindings(integration, definition) {
-    const declared = definition.slug;
-    if (typeof declared !== 'string' || declared === integration.slug)
-        return [];
-    return [
-        {
-            check: 'project.slug-agreement',
-            severity: 'error',
-            file: integration.entryPath,
-            message: `ekanos.json declares slug "${integration.slug}" for this entry, but ` +
-                `the definition says "${declared}". The slug addresses the ` +
-                'integration everywhere — its harness route, its product record, its ' +
-                'widget ids — so the two must agree.',
-            hint: `Change one to match the other: either set "slug": "${declared}" in ` +
-                `ekanos.json, or pass slug: '${integration.slug}' to ` +
-                'defineIntegration().',
-        },
-    ];
-}
 //# sourceMappingURL=validate.js.map

package/dist/commands/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE/D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAO3D;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAe,EACf,IAAkB;IAElB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,GAAG,CAAC,GAAG,CACL,cAAc,MAAM,CAAC,YAAY,CAAC,MAAM,cAAc;QACpD,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,IAAI,CAC/D,CAAC;IAEF,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,WAAW,GAA+B,EAAE,CAAC;IAEnD,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,WAAW,CAAC,SAAS,EACrB,MAAM,CAAC,UAAU,CAClB,CAAC;QAEF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CACX,GAAG,yBAAyB,CAAC,MAAM,CAAC,UAAU,EAAE;gBAC9C,IAAI,EAAE,WAAW,CAAC,SAAS;aAC5B,CAAC,CACH,CAAC;YACF,QAAQ,CAAC,IAAI,CACX,GAAG,4BAA4B,CAC7B,WAAW,EACX,MAAM,CAAC,UAAgC,CACxC,CACF,CAAC;YACF,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,UAAsC,CAAC,CAAC;YAChE,SAAS;QACX,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,yEAAyE;YACzE,iEAAiE;YACjE,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,iBAAiB;gBACxB,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,WAAW,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EACF,oEAAoE;oBACpE,uBAAuB;aAC1B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,kEAAkE;QAClE,MAAM,iBAAiB,CACrB,kDAAkD,WAAW,CAAC,IAAI,KAAK;YACrE,MAAM,CAAC,OAAO,EAChB,oEAAoE;YAClE,6BAA6B,CAChC,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,QAAQ,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC,CAAC;IACxD,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAE5D,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACzE,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAC;QACH,QAAQ;KACT,CAAC;IAEF,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC,IAAI,CACb,eAAe,CACb,GAAG,UAAU,sBAAsB,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,EACjE,oEAAoE;YAClE,oBAAoB,CACvB,EACD,IAAI,CACL,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,kCAAkC,KAAK,GAAG,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,4BAA4B,CACnC,WAA+D,EAC/D,UAA8B;IAE9B,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC;IACjC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,WAAW,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAE7E,OAAO;QACL;YACE,KAAK,EAAE,wBAAwB;YAC/B,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,WAAW,CAAC,SAAS;YAC3B,OAAO,EACL,8BAA8B,WAAW,CAAC,IAAI,wBAAwB;gBACtE,wBAAwB,QAAQ,4BAA4B;gBAC5D,sEAAsE;gBACtE,qCAAqC;YACvC,IAAI,EACF,sDAAsD,QAAQ,OAAO;gBACrE,+BAA+B,WAAW,CAAC,IAAI,OAAO;gBACtD,sBAAsB;SACzB;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n  DefinitionCollisionInput,\n  Finding,\n} from '@ekanos/integration-schema';\nimport {\n  collectCollisionFindings,\n  collectDefinitionFindings,\n} from '@ekanos/integration-schema';\n\nimport type { CliContext } from '../context';\nimport { preconditionError, validationError } from '../errors';\nimport type { ExitCode } from '../exit-codes';\nimport { loadDefinition } from '../load-definition';\nimport { loadProject } from '../project';\nimport { collectProjectFindings } from '../project-checks';\n\nexport interface ValidateArgs {\n  /** Project directory (contains ekanos.json). Defaults to cwd. */\n  dir: string;\n}\n\n/**\n * `validate` — parse the declaration with the REAL zod schemas from\n * `@ekanos/integration-schema` (never a reimplementation), gather structured\n * findings, and add project-level integrity checks (the vitest inline-SDK\n * check). Exit 0 with `findings: []` when clean; exit 3 when any error-severity\n * finding is present, with the findings carried in the envelope's `data`.\n */\nexport async function runValidate(\n  ctx: CliContext,\n  args: ValidateArgs,\n): Promise<ExitCode> {\n  const loaded = loadProject(args.dir);\n  const slugs = loaded.integrations.map((i) => i.slug).join(', ');\n  ctx.log(\n    `Validating ${loaded.integrations.length} integration` +\n      `${loaded.integrations.length === 1 ? '' : 's'} (${slugs})…`,\n  );\n\n  const findings: Finding[] = [];\n  const definitions: DefinitionCollisionInput[] = [];\n\n  for (const integration of loaded.integrations) {\n    const result = await loadDefinition(\n      integration.entryPath,\n      loaded.projectDir,\n    );\n\n    if (result.ok) {\n      findings.push(\n        ...collectDefinitionFindings(result.definition, {\n          file: integration.entryPath,\n        }),\n      );\n      findings.push(\n        ...collectSlugAgreementFindings(\n          integration,\n          result.definition as { slug?: unknown },\n        ),\n      );\n      definitions.push(result.definition as DefinitionCollisionInput);\n      continue;\n    }\n\n    if (result.kind === 'rejected') {\n      // The module loaded but the SDK/schema rejected the definition at import\n      // time — surface it as a validation finding rather than a crash.\n      findings.push({\n        check: 'definition.load',\n        severity: 'error',\n        file: integration.entryPath,\n        message: result.message,\n        hint:\n          'Fix the integration definition so defineIntegration() accepts it, ' +\n          'then re-run validate.',\n      });\n      continue;\n    }\n\n    // A genuine module-load failure is a precondition, not a finding.\n    throw preconditionError(\n      `Could not load the integration definition for \"${integration.slug}\": ` +\n        result.message,\n      'Ensure the entry module and its installed dependencies load under ' +\n        'Node, then re-run validate.',\n    );\n  }\n\n  // Cross-checks only mean something with more than one definition in hand —\n  // which is exactly what this verb could not see before, since ekanos.json\n  // held a single { slug, entry } and a second integration was invisible.\n  findings.push(...collectCollisionFindings(definitions));\n  findings.push(...collectProjectFindings(loaded.projectDir));\n\n  const errorCount = findings.filter((f) => f.severity === 'error').length;\n  const data = {\n    slug: loaded.primary.slug,\n    integrations: loaded.integrations.map((i) => ({\n      slug: i.slug,\n      entry: i.entry,\n    })),\n    findings,\n  };\n\n  if (errorCount > 0) {\n    return ctx.fail(\n      validationError(\n        `${errorCount} validation finding${errorCount === 1 ? '' : 's'}.`,\n        'Resolve the error-severity findings in data.findings, then re-run ' +\n          '\"ekanos validate\".',\n      ),\n      data,\n    );\n  }\n\n  return ctx.succeed(data, `validate: OK — no findings for ${slugs}.`);\n}\n\n/**\n * `ekanos.json` and the definition each carry a slug, and nothing compared\n * them: a project could declare `something-else` while the definition said\n * `repo-activity` and validate would report `{ ok: true, findings: [] }`.\n *\n * That is the identifier every surface addresses the integration by — the\n * harness route, the product slug, the widget id prefix, the MCP server — so\n * two sources of truth disagreeing is not a style question. It is an error,\n * not a warning, for the same reason a silent default is worse than a loud\n * one: the failure it causes shows up somewhere else entirely.\n */\nfunction collectSlugAgreementFindings(\n  integration: { slug: string; entry: string; entryPath: string },\n  definition: { slug?: unknown },\n): Finding[] {\n  const declared = definition.slug;\n  if (typeof declared !== 'string' || declared === integration.slug) return [];\n\n  return [\n    {\n      check: 'project.slug-agreement',\n      severity: 'error',\n      file: integration.entryPath,\n      message:\n        `ekanos.json declares slug \"${integration.slug}\" for this entry, but ` +\n        `the definition says \"${declared}\". The slug addresses the ` +\n        'integration everywhere — its harness route, its product record, its ' +\n        'widget ids — so the two must agree.',\n      hint:\n        `Change one to match the other: either set \"slug\": \"${declared}\" in ` +\n        `ekanos.json, or pass slug: '${integration.slug}' to ` +\n        'defineIntegration().',\n    },\n  ];\n}\n"]}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAO1D;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAe,EACf,IAAkB;IAElB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,GAAG,CAAC,GAAG,CACL,cAAc,MAAM,CAAC,YAAY,CAAC,MAAM,cAAc;QACpD,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,IAAI,CAC/D,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAElD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACzE,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAC;QACH,QAAQ;KACT,CAAC;IAEF,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC,IAAI,CACb,eAAe,CACb,GAAG,UAAU,sBAAsB,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,EACjE,oEAAoE;YAClE,oBAAoB,CACvB,EACD,IAAI,CACL,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,kCAAkC,KAAK,GAAG,CAAC,CAAC;AACvE,CAAC","sourcesContent":["import type { CliContext } from '../context';\nimport { validationError } from '../errors';\nimport type { ExitCode } from '../exit-codes';\nimport { loadProject } from '../project';\nimport { collectAllFindings } from '../validate-findings';\n\nexport interface ValidateArgs {\n  /** Project directory (contains ekanos.json). Defaults to cwd. */\n  dir: string;\n}\n\n/**\n * `validate` — parse the declaration with the REAL zod schemas from\n * `@ekanos/integration-schema` (never a reimplementation), gather structured\n * findings, and add project-level integrity checks (the vitest inline-SDK\n * check). Exit 0 with `findings: []` when clean; exit 3 when any error-severity\n * finding is present, with the findings carried in the envelope's `data`.\n *\n * The findings pass itself lives in `validate-findings.ts`, shared with\n * `publish` so the publish gate cannot drift from what validate checks.\n */\nexport async function runValidate(\n  ctx: CliContext,\n  args: ValidateArgs,\n): Promise<ExitCode> {\n  const loaded = loadProject(args.dir);\n  const slugs = loaded.integrations.map((i) => i.slug).join(', ');\n  ctx.log(\n    `Validating ${loaded.integrations.length} integration` +\n      `${loaded.integrations.length === 1 ? '' : 's'} (${slugs})…`,\n  );\n\n  const findings = await collectAllFindings(loaded);\n\n  const errorCount = findings.filter((f) => f.severity === 'error').length;\n  const data = {\n    slug: loaded.primary.slug,\n    integrations: loaded.integrations.map((i) => ({\n      slug: i.slug,\n      entry: i.entry,\n    })),\n    findings,\n  };\n\n  if (errorCount > 0) {\n    return ctx.fail(\n      validationError(\n        `${errorCount} validation finding${errorCount === 1 ? '' : 's'}.`,\n        'Resolve the error-severity findings in data.findings, then re-run ' +\n          '\"ekanos validate\".',\n      ),\n      data,\n    );\n  }\n\n  return ctx.succeed(data, `validate: OK — no findings for ${slugs}.`);\n}\n"]}

package/dist/commands/whoami.d.ts

@@ -2,6 +2,8 @@ import type { CliContext } from '../context.js';
 import type { ExitCode } from '../exit-codes.js';
 export interface WhoamiArgs {
     host?: string;
+    /** Where a project's ekanos.json may sit, for its optional `host` field. */
+    cwd: string;
     env: Record<string, string | undefined>;
 }
 /**

package/dist/commands/whoami.js

@@ -12,7 +12,9 @@ import { requireSession, resolveAuthEnvironment, resolveIdentity, } from '../aut
  */
 export async function runWhoami(ctx, args) {
     var _a;
-    const env = resolveAuthEnvironment(ctx, args.host, args.env);
+    const env = resolveAuthEnvironment(ctx, args.host, args.env, {
+        projectDir: args.cwd,
+    });
     const stored = requireSession(env.store, env.host);
     const { identity, session } = await resolveIdentity(env, stored);
     return ctx.succeed({

package/dist/commands/whoami.js.map

@@ -1 +1 @@
-{"version":3,"file":"whoami.js","sourceRoot":"","sources":["../../src/commands/whoami.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AASzB;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAe,EACf,IAAgB;;IAEhB,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAEnD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAEjE,OAAO,GAAG,CAAC,OAAO,CAChB;QACE,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE;YACJ,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB;QACD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ;KACpC,EACD,WAAW,MAAA,QAAQ,CAAC,KAAK,mCAAI,QAAQ,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,GAAG,CAC3D,CAAC;AACJ,CAAC","sourcesContent":["import {\n  requireSession,\n  resolveAuthEnvironment,\n  resolveIdentity,\n} from '../auth/session';\nimport type { CliContext } from '../context';\nimport type { ExitCode } from '../exit-codes';\n\nexport interface WhoamiArgs {\n  host?: string;\n  env: Record<string, string | undefined>;\n}\n\n/**\n * `whoami` — prove the stored session still authenticates against Fusion.\n *\n * The identity is resolved server-side by `/api/auth/cli-whoami`, which reads\n * the account through RLS as the caller. Printing the locally cached email\n * would be a cheaper lie: it would keep saying \"logged in\" after the account\n * was deleted or the token revoked.\n *\n * Exit 4 (auth_required) when there is no session or it cannot be renewed —\n * the code a script should branch on to decide whether to run `ekanos login`.\n */\nexport async function runWhoami(\n  ctx: CliContext,\n  args: WhoamiArgs,\n): Promise<ExitCode> {\n  const env = resolveAuthEnvironment(ctx, args.host, args.env);\n  const stored = requireSession(env.store, env.host);\n\n  const { identity, session } = await resolveIdentity(env, stored);\n\n  return ctx.succeed(\n    {\n      host: env.host,\n      user: {\n        id: identity.id,\n        email: identity.email,\n        name: identity.name,\n      },\n      expiresAt: session.expiresAt,\n      credentialsPath: env.store.filePath,\n    },\n    `whoami: ${identity.email ?? identity.id} on ${env.host}.`,\n  );\n}\n"]}
+{"version":3,"file":"whoami.js","sourceRoot":"","sources":["../../src/commands/whoami.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAWzB;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAe,EACf,IAAgB;;IAEhB,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE;QAC3D,UAAU,EAAE,IAAI,CAAC,GAAG;KACrB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAEnD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAEjE,OAAO,GAAG,CAAC,OAAO,CAChB;QACE,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE;YACJ,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB;QACD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ;KACpC,EACD,WAAW,MAAA,QAAQ,CAAC,KAAK,mCAAI,QAAQ,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,GAAG,CAC3D,CAAC;AACJ,CAAC","sourcesContent":["import {\n  requireSession,\n  resolveAuthEnvironment,\n  resolveIdentity,\n} from '../auth/session';\nimport type { CliContext } from '../context';\nimport type { ExitCode } from '../exit-codes';\n\nexport interface WhoamiArgs {\n  host?: string;\n  /** Where a project's ekanos.json may sit, for its optional `host` field. */\n  cwd: string;\n  env: Record<string, string | undefined>;\n}\n\n/**\n * `whoami` — prove the stored session still authenticates against Fusion.\n *\n * The identity is resolved server-side by `/api/auth/cli-whoami`, which reads\n * the account through RLS as the caller. Printing the locally cached email\n * would be a cheaper lie: it would keep saying \"logged in\" after the account\n * was deleted or the token revoked.\n *\n * Exit 4 (auth_required) when there is no session or it cannot be renewed —\n * the code a script should branch on to decide whether to run `ekanos login`.\n */\nexport async function runWhoami(\n  ctx: CliContext,\n  args: WhoamiArgs,\n): Promise<ExitCode> {\n  const env = resolveAuthEnvironment(ctx, args.host, args.env, {\n    projectDir: args.cwd,\n  });\n  const stored = requireSession(env.store, env.host);\n\n  const { identity, session } = await resolveIdentity(env, stored);\n\n  return ctx.succeed(\n    {\n      host: env.host,\n      user: {\n        id: identity.id,\n        email: identity.email,\n        name: identity.name,\n      },\n      expiresAt: session.expiresAt,\n      credentialsPath: env.store.filePath,\n    },\n    `whoami: ${identity.email ?? identity.id} on ${env.host}.`,\n  );\n}\n"]}

package/dist/errors.d.ts

@@ -32,6 +32,8 @@ export declare function notFoundError(message: string, hint: string): CliError;
 export declare function authRequiredError(message: string, hint: string): CliError;
 /** Authenticated, but the server refused. Exit 5. */
 export declare function forbiddenError(message: string, hint: string): CliError;
+/** A publish gate rejected the submission. Exit 10. */
+export declare function gateFailedError(message: string, hint: string): CliError;
 /** A network operation failed (DNS, TLS, timeout, 5xx). Exit 8. */
 export declare function networkError(message: string, hint: string): CliError;
 /**