@ekanos/cli 0.1.0 → 0.1.2

package/dist/errors.js

@@ -83,6 +83,15 @@ export function forbiddenError(message, hint) {
         hint,
     });
 }
+/** A publish gate rejected the submission. Exit 10. */
+export function gateFailedError(message, hint) {
+    return new CliError({
+        code: ERROR_CODES.GATE_FAILED,
+        exitCode: EXIT_CODES.GATE_FAILED,
+        message,
+        hint,
+    });
+}
 /** A network operation failed (DNS, TLS, timeout, 5xx). Exit 8. */
 export function networkError(message, hint) {
     return new CliError({

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,UAAU,GAGX,MAAM,cAAc,CAAC;AAEtB;;;;;;;GAOG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IAKjC,YAAY,MAKX;QACC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QAEvB,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CACb,iBAAiB,MAAM,CAAC,OAAO,wCAAwC;gBACrE,uDAAuD,CAC1D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;CACF;AAED,kEAAkE;AAClE,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,IAAY;IACtD,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,WAAW,CAAC,KAAK;QACvB,QAAQ,EAAE,UAAU,CAAC,KAAK;QAC1B,OAAO;QACP,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,IAAY;IAC3D,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,WAAW,CAAC,UAAU;QAC5B,QAAQ,EAAE,UAAU,CAAC,UAAU;QAC/B,OAAO;QACP,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,IAAY;IAC7D,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,WAAW,CAAC,mBAAmB;QACrC,QAAQ,EAAE,UAAU,CAAC,mBAAmB;QACxC,OAAO;QACP,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,IAAY;IAC7D,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,WAAW,CAAC,aAAa;QAC/B,QAAQ,EAAE,UAAU,CAAC,aAAa;QAClC,OAAO;QACP,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,IAAY;IACzD,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,WAAW,CAAC,SAAS;QAC3B,QAAQ,EAAE,UAAU,CAAC,SAAS;QAC9B,OAAO;QACP,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,IAAY;IAC7D,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,WAAW,CAAC,aAAa;QAC/B,QAAQ,EAAE,UAAU,CAAC,aAAa;QAClC,OAAO;QACP,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,IAAY;IAC1D,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,WAAW,CAAC,SAAS;QAC3B,QAAQ,EAAE,UAAU,CAAC,SAAS;QAC9B,OAAO;QACP,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,IAAY;IACxD,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,WAAW,CAAC,OAAO;QACzB,QAAQ,EAAE,UAAU,CAAC,OAAO;QAC5B,OAAO;QACP,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,IAAI,KAAK,YAAY,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,WAAW,CAAC,QAAQ;QAC1B,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,OAAO;QACP,IAAI,EACF,wEAAwE;YACxE,4DAA4D;KAC/D,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  ERROR_CODES,\n  EXIT_CODES,\n  type ErrorCode,\n  type ExitCode,\n} from './exit-codes';\n\n/**\n * The one error type every command path throws. It carries the three things\n * the envelope needs — a stable string `code`, a human `message`, and a\n * non-empty imperative `hint` — plus the numeric `exitCode` the process ends\n * with. Constructing one with an empty hint is a programming error and throws\n * immediately, which is what lets `context.fail()` guarantee the envelope's\n * \"every error has a hint\" invariant without a runtime check at the edge.\n */\nexport class CliError extends Error {\n  readonly code: ErrorCode;\n  readonly exitCode: ExitCode;\n  readonly hint: string;\n\n  constructor(params: {\n    code: ErrorCode;\n    exitCode: ExitCode;\n    message: string;\n    hint: string;\n  }) {\n    super(params.message);\n    this.name = 'CliError';\n\n    if (!params.hint || params.hint.trim().length === 0) {\n      throw new Error(\n        `CliError for \"${params.message}\" was constructed with an empty hint. ` +\n          'Every CLI error must carry an imperative remediation.',\n      );\n    }\n\n    this.code = params.code;\n    this.exitCode = params.exitCode;\n    this.hint = params.hint;\n  }\n}\n\n/** A usage error (unknown flag/command, bad argument). Exit 2. */\nexport function usageError(message: string, hint: string): CliError {\n  return new CliError({\n    code: ERROR_CODES.USAGE,\n    exitCode: EXIT_CODES.USAGE,\n    message,\n    hint,\n  });\n}\n\n/** Validation produced error-severity findings. Exit 3. */\nexport function validationError(message: string, hint: string): CliError {\n  return new CliError({\n    code: ERROR_CODES.VALIDATION,\n    exitCode: EXIT_CODES.VALIDATION,\n    message,\n    hint,\n  });\n}\n\n/** A precondition failure (missing tool, config, or file). Exit 9. */\nexport function preconditionError(message: string, hint: string): CliError {\n  return new CliError({\n    code: ERROR_CODES.PRECONDITION_FAILED,\n    exitCode: EXIT_CODES.PRECONDITION_FAILED,\n    message,\n    hint,\n  });\n}\n\n/** An invalid-state failure (idempotency / ordering). Exit 7. */\nexport function invalidStateError(message: string, hint: string): CliError {\n  return new CliError({\n    code: ERROR_CODES.INVALID_STATE,\n    exitCode: EXIT_CODES.INVALID_STATE,\n    message,\n    hint,\n  });\n}\n\n/** A not-found failure. Exit 6. */\nexport function notFoundError(message: string, hint: string): CliError {\n  return new CliError({\n    code: ERROR_CODES.NOT_FOUND,\n    exitCode: EXIT_CODES.NOT_FOUND,\n    message,\n    hint,\n  });\n}\n\n/** Authentication is required but absent or expired. Exit 4. */\nexport function authRequiredError(message: string, hint: string): CliError {\n  return new CliError({\n    code: ERROR_CODES.AUTH_REQUIRED,\n    exitCode: EXIT_CODES.AUTH_REQUIRED,\n    message,\n    hint,\n  });\n}\n\n/** Authenticated, but the server refused. Exit 5. */\nexport function forbiddenError(message: string, hint: string): CliError {\n  return new CliError({\n    code: ERROR_CODES.FORBIDDEN,\n    exitCode: EXIT_CODES.FORBIDDEN,\n    message,\n    hint,\n  });\n}\n\n/** A network operation failed (DNS, TLS, timeout, 5xx). Exit 8. */\nexport function networkError(message: string, hint: string): CliError {\n  return new CliError({\n    code: ERROR_CODES.NETWORK,\n    exitCode: EXIT_CODES.NETWORK,\n    message,\n    hint,\n  });\n}\n\n/**\n * Coerce anything thrown into a CliError. A thrown CliError passes through; a\n * plain Error becomes an INTERNAL (exit 1) with a generic-but-non-empty hint.\n */\nexport function toCliError(error: unknown): CliError {\n  if (error instanceof CliError) return error;\n\n  const message = error instanceof Error ? error.message : String(error);\n  return new CliError({\n    code: ERROR_CODES.INTERNAL,\n    exitCode: EXIT_CODES.INTERNAL,\n    message,\n    hint:\n      'This is an internal CLI error. Re-run with --json to capture the full ' +\n      'envelope and report it at npm@govastly.com if it persists.',\n  });\n}\n"]}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,UAAU,GAGX,MAAM,cAAc,CAAC;AAEtB;;;;;;;GAOG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IAKjC,YAAY,MAKX;QACC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QAEvB,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CACb,iBAAiB,MAAM,CAAC,OAAO,wCAAwC;gBACrE,uDAAuD,CAC1D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;CACF;AAED,kEAAkE;AAClE,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,IAAY;IACtD,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,WAAW,CAAC,KAAK;QACvB,QAAQ,EAAE,UAAU,CAAC,KAAK;QAC1B,OAAO;QACP,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,IAAY;IAC3D,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,WAAW,CAAC,UAAU;QAC5B,QAAQ,EAAE,UAAU,CAAC,UAAU;QAC/B,OAAO;QACP,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,IAAY;IAC7D,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,WAAW,CAAC,mBAAmB;QACrC,QAAQ,EAAE,UAAU,CAAC,mBAAmB;QACxC,OAAO;QACP,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,IAAY;IAC7D,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,WAAW,CAAC,aAAa;QAC/B,QAAQ,EAAE,UAAU,CAAC,aAAa;QAClC,OAAO;QACP,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,IAAY;IACzD,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,WAAW,CAAC,SAAS;QAC3B,QAAQ,EAAE,UAAU,CAAC,SAAS;QAC9B,OAAO;QACP,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,IAAY;IAC7D,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,WAAW,CAAC,aAAa;QAC/B,QAAQ,EAAE,UAAU,CAAC,aAAa;QAClC,OAAO;QACP,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,IAAY;IAC1D,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,WAAW,CAAC,SAAS;QAC3B,QAAQ,EAAE,UAAU,CAAC,SAAS;QAC9B,OAAO;QACP,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,IAAY;IAC3D,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,WAAW,CAAC,WAAW;QAC7B,QAAQ,EAAE,UAAU,CAAC,WAAW;QAChC,OAAO;QACP,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,IAAY;IACxD,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,WAAW,CAAC,OAAO;QACzB,QAAQ,EAAE,UAAU,CAAC,OAAO;QAC5B,OAAO;QACP,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,IAAI,KAAK,YAAY,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,IAAI,QAAQ,CAAC;QAClB,IAAI,EAAE,WAAW,CAAC,QAAQ;QAC1B,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,OAAO;QACP,IAAI,EACF,wEAAwE;YACxE,4DAA4D;KAC/D,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  ERROR_CODES,\n  EXIT_CODES,\n  type ErrorCode,\n  type ExitCode,\n} from './exit-codes';\n\n/**\n * The one error type every command path throws. It carries the three things\n * the envelope needs — a stable string `code`, a human `message`, and a\n * non-empty imperative `hint` — plus the numeric `exitCode` the process ends\n * with. Constructing one with an empty hint is a programming error and throws\n * immediately, which is what lets `context.fail()` guarantee the envelope's\n * \"every error has a hint\" invariant without a runtime check at the edge.\n */\nexport class CliError extends Error {\n  readonly code: ErrorCode;\n  readonly exitCode: ExitCode;\n  readonly hint: string;\n\n  constructor(params: {\n    code: ErrorCode;\n    exitCode: ExitCode;\n    message: string;\n    hint: string;\n  }) {\n    super(params.message);\n    this.name = 'CliError';\n\n    if (!params.hint || params.hint.trim().length === 0) {\n      throw new Error(\n        `CliError for \"${params.message}\" was constructed with an empty hint. ` +\n          'Every CLI error must carry an imperative remediation.',\n      );\n    }\n\n    this.code = params.code;\n    this.exitCode = params.exitCode;\n    this.hint = params.hint;\n  }\n}\n\n/** A usage error (unknown flag/command, bad argument). Exit 2. */\nexport function usageError(message: string, hint: string): CliError {\n  return new CliError({\n    code: ERROR_CODES.USAGE,\n    exitCode: EXIT_CODES.USAGE,\n    message,\n    hint,\n  });\n}\n\n/** Validation produced error-severity findings. Exit 3. */\nexport function validationError(message: string, hint: string): CliError {\n  return new CliError({\n    code: ERROR_CODES.VALIDATION,\n    exitCode: EXIT_CODES.VALIDATION,\n    message,\n    hint,\n  });\n}\n\n/** A precondition failure (missing tool, config, or file). Exit 9. */\nexport function preconditionError(message: string, hint: string): CliError {\n  return new CliError({\n    code: ERROR_CODES.PRECONDITION_FAILED,\n    exitCode: EXIT_CODES.PRECONDITION_FAILED,\n    message,\n    hint,\n  });\n}\n\n/** An invalid-state failure (idempotency / ordering). Exit 7. */\nexport function invalidStateError(message: string, hint: string): CliError {\n  return new CliError({\n    code: ERROR_CODES.INVALID_STATE,\n    exitCode: EXIT_CODES.INVALID_STATE,\n    message,\n    hint,\n  });\n}\n\n/** A not-found failure. Exit 6. */\nexport function notFoundError(message: string, hint: string): CliError {\n  return new CliError({\n    code: ERROR_CODES.NOT_FOUND,\n    exitCode: EXIT_CODES.NOT_FOUND,\n    message,\n    hint,\n  });\n}\n\n/** Authentication is required but absent or expired. Exit 4. */\nexport function authRequiredError(message: string, hint: string): CliError {\n  return new CliError({\n    code: ERROR_CODES.AUTH_REQUIRED,\n    exitCode: EXIT_CODES.AUTH_REQUIRED,\n    message,\n    hint,\n  });\n}\n\n/** Authenticated, but the server refused. Exit 5. */\nexport function forbiddenError(message: string, hint: string): CliError {\n  return new CliError({\n    code: ERROR_CODES.FORBIDDEN,\n    exitCode: EXIT_CODES.FORBIDDEN,\n    message,\n    hint,\n  });\n}\n\n/** A publish gate rejected the submission. Exit 10. */\nexport function gateFailedError(message: string, hint: string): CliError {\n  return new CliError({\n    code: ERROR_CODES.GATE_FAILED,\n    exitCode: EXIT_CODES.GATE_FAILED,\n    message,\n    hint,\n  });\n}\n\n/** A network operation failed (DNS, TLS, timeout, 5xx). Exit 8. */\nexport function networkError(message: string, hint: string): CliError {\n  return new CliError({\n    code: ERROR_CODES.NETWORK,\n    exitCode: EXIT_CODES.NETWORK,\n    message,\n    hint,\n  });\n}\n\n/**\n * Coerce anything thrown into a CliError. A thrown CliError passes through; a\n * plain Error becomes an INTERNAL (exit 1) with a generic-but-non-empty hint.\n */\nexport function toCliError(error: unknown): CliError {\n  if (error instanceof CliError) return error;\n\n  const message = error instanceof Error ? error.message : String(error);\n  return new CliError({\n    code: ERROR_CODES.INTERNAL,\n    exitCode: EXIT_CODES.INTERNAL,\n    message,\n    hint:\n      'This is an internal CLI error. Re-run with --json to capture the full ' +\n      'envelope and report it at npm@govastly.com if it persists.',\n  });\n}\n"]}

package/dist/index.js

@@ -3,6 +3,8 @@ import { runDev } from './commands/dev.js';
 import { runInit } from './commands/init.js';
 import { runLogin } from './commands/login.js';
 import { runLogout } from './commands/logout.js';
+import { runPublish } from './commands/publish.js';
+import { runStatus } from './commands/status.js';
 import { runTest } from './commands/test.js';
 import { runValidate } from './commands/validate.js';
 import { runWhoami } from './commands/whoami.js';
@@ -48,19 +50,38 @@ const COMMAND_SPECS = {
     whoami: {
         host: { type: 'string' },
     },
+    status: {
+        host: { type: 'string' },
+        dir: { type: 'string' },
+    },
+    publish: {
+        host: { type: 'string' },
+        source: { type: 'string' },
+        dir: { type: 'string' },
+        yes: { type: 'boolean' },
+    },
 };
 const COMMANDS = Object.keys(COMMAND_SPECS);
 const USAGE = [
     'Usage: ekanos <command> [options]',
     '',
     'Commands:',
-    '  init       Scaffold a new integration project (--slug <slug> --yes)',
+    '  init       Scaffold a new integration project into ./<slug> (--slug <slug> --yes)',
     '  validate   Validate ekanos.json + the integration definition (--json)',
     '  dev        Scaffold .ekanos/harness and run it with your own Next',
     '  test       Run the project test script via its package manager (--json)',
     '  login      Authenticate against a Fusion host in a browser (--host <url>)',
     '  logout     Revoke and delete the stored session (--host <url> | --all)',
     '  whoami     Print the identity the stored session authenticates as',
+    "  status     Show login state and this project's submissions on the host",
+    '  publish    Validate, pack and submit the integration to a Fusion host',
+    '',
+    'Host resolution (logout, whoami, status, publish):',
+    '  --host, else EKANOS_HOST, else the "host" field in ekanos.json, else the',
+    '  sole stored login. "ekanos publish" saves host and source to ekanos.json.',
+    '  "ekanos login" never reads ekanos.json for a host (--host, else',
+    '  EKANOS_HOST, else the sole stored login) — it is the verb that creates',
+    '  credentials, so a committed file must never choose where they go.',
     '',
     'Global options:',
     '  --json     Emit a single JSON envelope on stdout (auto-on when piped);',
@@ -130,7 +151,8 @@ export async function run(argv, options = {}) {
             case 'init':
                 return runInit(ctx, {
                     slug: parsed.flags.slug,
-                    dir,
+                    dir: parsed.flags.dir,
+                    cwd,
                     force: parsed.flags.force === true,
                     yes: parsed.flags.yes === true,
                 });
@@ -150,17 +172,34 @@ export async function run(argv, options = {}) {
                 return await runLogin(ctx, {
                     host: parsed.flags.host,
                     force: parsed.flags.force === true,
+                    cwd,
                     env,
                 });
             case 'logout':
                 return await runLogout(ctx, {
                     host: parsed.flags.host,
                     all: parsed.flags.all === true,
+                    cwd,
                     env,
                 });
             case 'whoami':
                 return await runWhoami(ctx, {
                     host: parsed.flags.host,
+                    cwd,
+                    env,
+                });
+            case 'status':
+                return await runStatus(ctx, {
+                    host: parsed.flags.host,
+                    dir,
+                    env,
+                });
+            case 'publish':
+                return await runPublish(ctx, {
+                    host: parsed.flags.host,
+                    source: parsed.flags.source,
+                    dir,
+                    yes: parsed.flags.yes === true,
                     env,
                 });
             default:

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAoB,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAkB,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGvD,MAAM,YAAY,GAAc;IAC9B,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;CAC7B,CAAC;AAEF,MAAM,aAAa,GAA8B;IAC/C,IAAI,EAAE;QACJ,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;KACzB;IACD,QAAQ,EAAE;QACR,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACxB;IACD,GAAG,EAAE;QACH,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;KAC3B;IACD,IAAI,EAAE;QACJ,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACxB;IACD,KAAK,EAAE;QACL,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;KAC3B;IACD,MAAM,EAAE;QACN,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;KACzB;IACD,MAAM,EAAE;QACN,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACzB;CACF,CAAC;AAEF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAE5C,MAAM,KAAK,GAAG;IACZ,mCAAmC;IACnC,EAAE;IACF,WAAW;IACX,uEAAuE;IACvE,yEAAyE;IACzE,qEAAqE;IACrE,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,qEAAqE;IACrE,EAAE;IACF,iBAAiB;IACjB,0EAA0E;IAC1E,uDAAuD;IACvD,oCAAoC;IACpC,6BAA6B;CAC9B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AASb;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,IAAuB,EACvB,UAAsB,EAAE;;IAExB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC;QACzB,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,mCAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,mCAAI,OAAO,CAAC,GAAG,CAAC;IAEvC,IAAI,CAAC;QACH,2EAA2E;QAC3E,oEAAoE;QACpE,wDAAwD;QACxD,IAAI,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;YACtC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAE7C,+BAA+B;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YACD,6DAA6D;YAC7D,GAAG,CAAC,kBAAkB,CAAC;gBACrB,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,iBAAiB;gBACxB,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;YACH,MAAM,UAAU,CACd,4BAA4B,IAAI,CAAC,CAAC,CAAC,IAAI,EACvC,eAAe,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAC3D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,kBAAkB,CAAC;gBACrB,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,iBAAiB;gBACxB,KAAK,EAAE,OAAO;gBACd,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;YACH,MAAM,UAAU,CACd,oBAAoB,OAAO,IAAI,EAC/B,eAAe,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAC3D,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,mCAAmB,YAAY,GAAK,aAAa,CAAC,OAAO,CAAC,CAAE,CAAC;QACxE,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAEtC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,UAAU,CACd,IAAI,OAAO,yCAAyC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,EAC9E,2DAA2D,OAAO,WAAW,CAC9E,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,MAAC,MAAM,CAAC,KAAK,CAAC,GAA0B,mCAAI,GAAG,CAAC;QAE5D,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,MAAM;gBACT,OAAO,OAAO,CAAC,GAAG,EAAE;oBAClB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,GAAG;oBACH,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;oBAClC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI;iBAC/B,CAAC,CAAC;YACL,KAAK,UAAU;gBACb,OAAO,MAAM,WAAW,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACzC,KAAK,KAAK;gBACR,OAAO,MAAM,MAAM,CAAC,GAAG,EAAE;oBACvB,GAAG;oBACH,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;oBAClC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAA4B;iBACjD,CAAC,CAAC;YACL,KAAK,MAAM;gBACT,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;YACtE,KAAK,OAAO;gBACV,OAAO,MAAM,QAAQ,CAAC,GAAG,EAAE;oBACzB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;oBAClC,GAAG;iBACJ,CAAC,CAAC;YACL,KAAK,QAAQ;gBACX,OAAO,MAAM,SAAS,CAAC,GAAG,EAAE;oBAC1B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI;oBAC9B,GAAG;iBACJ,CAAC,CAAC;YACL,KAAK,QAAQ;gBACX,OAAO,MAAM,SAAS,CAAC,GAAG,EAAE;oBAC1B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,GAAG;iBACJ,CAAC,CAAC;YACL;gBACE,kEAAkE;gBAClE,MAAM,UAAU,CACd,oBAAoB,OAAO,IAAI,EAC/B,eAAe,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACtC,CAAC;QACN,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,IAAuB;IAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM;QAC1B,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,KAAK,KAAK,WAAW;YAAE,OAAO,KAAK,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAuB,EAAE,IAAY;IAC7D,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM;QAC1B,IAAI,KAAK,KAAK,KAAK,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAAuB;IAI3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM;QAC1B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;aAClD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW;IAClB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAEtE,OAAO,OAAO,MAAM,KAAK,QAAQ;QAC/B,MAAM,KAAK,IAAI;QACf,SAAS,IAAI,MAAM;QACnB,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAClC,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,OAAO,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,GAAe;IAClC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAE9B,OAAO,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,QAAQ,CAAC,GAAe;IAC/B,GAAG,CAAC,kBAAkB,CAAC;QACrB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,KAAK;QACZ,SAAS,EAAE,UAAU;KACtB,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,eAAe,CAAC,GAAe,EAAE,OAAe;;IACvD,MAAM,KAAK,GAAG,MAAA,aAAa,CAAC,OAAO,CAAC,mCAAI,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,iBAAiB,OAAO,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;IAC/D,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,OAAO,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC","sourcesContent":["import * as fs from 'node:fs';\n\nimport { runDev } from './commands/dev';\nimport { runInit } from './commands/init';\nimport { runLogin } from './commands/login';\nimport { runLogout } from './commands/logout';\nimport { runTest } from './commands/test';\nimport { runValidate } from './commands/validate';\nimport { runWhoami } from './commands/whoami';\nimport { CliContext, type WriteStream } from './context';\nimport { toCliError, usageError } from './errors';\nimport { EXIT_CODES } from './exit-codes';\nimport { type FlagSpecs, parseArgv } from './parse-argv';\n\nexport { CliContext } from './context';\nexport { EXIT_CODES, ERROR_CODES } from './exit-codes';\nexport type { ExitCode, ErrorCode } from './exit-codes';\n\nconst GLOBAL_SPECS: FlagSpecs = {\n  json: { type: 'boolean' },\n  help: { type: 'boolean' },\n  version: { type: 'boolean' },\n};\n\nconst COMMAND_SPECS: Record<string, FlagSpecs> = {\n  init: {\n    slug: { type: 'string' },\n    dir: { type: 'string' },\n    force: { type: 'boolean' },\n    yes: { type: 'boolean' },\n  },\n  validate: {\n    dir: { type: 'string' },\n  },\n  dev: {\n    dir: { type: 'string' },\n    port: { type: 'string' },\n    host: { type: 'string' },\n    force: { type: 'boolean' },\n    start: { type: 'boolean' },\n  },\n  test: {\n    dir: { type: 'string' },\n  },\n  login: {\n    host: { type: 'string' },\n    force: { type: 'boolean' },\n  },\n  logout: {\n    host: { type: 'string' },\n    all: { type: 'boolean' },\n  },\n  whoami: {\n    host: { type: 'string' },\n  },\n};\n\nconst COMMANDS = Object.keys(COMMAND_SPECS);\n\nconst USAGE = [\n  'Usage: ekanos <command> [options]',\n  '',\n  'Commands:',\n  '  init       Scaffold a new integration project (--slug <slug> --yes)',\n  '  validate   Validate ekanos.json + the integration definition (--json)',\n  '  dev        Scaffold .ekanos/harness and run it with your own Next',\n  '  test       Run the project test script via its package manager (--json)',\n  '  login      Authenticate against a Fusion host in a browser (--host <url>)',\n  '  logout     Revoke and delete the stored session (--host <url> | --all)',\n  '  whoami     Print the identity the stored session authenticates as',\n  '',\n  'Global options:',\n  '  --json     Emit a single JSON envelope on stdout (auto-on when piped);',\n  '             --no-json forces the human-readable form',\n  '  --version  Print the CLI version',\n  '  --help     Show this help',\n].join('\\n');\n\nexport interface RunOptions {\n  stdout?: WriteStream;\n  stderr?: WriteStream;\n  env?: Record<string, string | undefined>;\n  cwd?: string;\n}\n\n/**\n * The single entry point. Resolves the agent-native envelope once, dispatches\n * to a verb, and guarantees exactly one terminal emission (success or error).\n * Returns the process exit code — `bin.ts` is the only place that calls\n * `process.exit`, so this stays fully testable.\n */\nexport async function run(\n  argv: readonly string[],\n  options: RunOptions = {},\n): Promise<number> {\n  const jsonFlag = scanJsonFlag(argv);\n  const ctx = new CliContext({\n    jsonFlag,\n    stdout: options.stdout,\n    stderr: options.stderr,\n    env: options.env,\n  });\n  const cwd = options.cwd ?? process.cwd();\n  const env = options.env ?? process.env;\n\n  try {\n    // `--version` is global and verb-independent, so it is answered before the\n    // command is even resolved: `ekanos --version` and `ekanos validate\n    // --version` both report the tool's version and exit 0.\n    if (scanFlagPresence(argv, 'version')) {\n      return emitVersion(ctx);\n    }\n\n    const { command, rest } = splitCommand(argv);\n\n    // Top-level help / no command.\n    if (!command) {\n      if (scanFlagPresence(rest, 'help') || argv.length === 0) {\n        return emitHelp(ctx);\n      }\n      // A leading token that is not a command (e.g. `--nonsense`).\n      ctx.emitClaudeCodeHint({\n        tool: 'ekanos',\n        error: 'unknown-command',\n        commands: COMMANDS,\n        usage: USAGE,\n      });\n      throw usageError(\n        `Unknown command or flag \"${argv[0]}\".`,\n        `Run one of: ${COMMANDS.join(', ')}. See \"ekanos --help\".`,\n      );\n    }\n\n    if (!COMMANDS.includes(command)) {\n      ctx.emitClaudeCodeHint({\n        tool: 'ekanos',\n        error: 'unknown-command',\n        given: command,\n        commands: COMMANDS,\n        usage: USAGE,\n      });\n      throw usageError(\n        `Unknown command \"${command}\".`,\n        `Run one of: ${COMMANDS.join(', ')}. See \"ekanos --help\".`,\n      );\n    }\n\n    const specs: FlagSpecs = { ...GLOBAL_SPECS, ...COMMAND_SPECS[command] };\n    const parsed = parseArgv(rest, specs);\n\n    if (parsed.flags.help === true) {\n      return emitCommandHelp(ctx, command);\n    }\n\n    if (parsed.positionals.length > 0) {\n      throw usageError(\n        `\"${command}\" takes no positional arguments (got \"${parsed.positionals[0]}\").`,\n        `Pass options as flags, e.g. \"--dir <path>\". See \"ekanos ${command} --help\".`,\n      );\n    }\n\n    const dir = (parsed.flags.dir as string | undefined) ?? cwd;\n\n    switch (command) {\n      case 'init':\n        return runInit(ctx, {\n          slug: parsed.flags.slug as string | undefined,\n          dir,\n          force: parsed.flags.force === true,\n          yes: parsed.flags.yes === true,\n        });\n      case 'validate':\n        return await runValidate(ctx, { dir });\n      case 'dev':\n        return await runDev(ctx, {\n          dir,\n          port: parsed.flags.port as string | undefined,\n          host: parsed.flags.host as string | undefined,\n          force: parsed.flags.force === true,\n          start: parsed.flags.start as boolean | undefined,\n        });\n      case 'test':\n        return await runTest(ctx, { dir, passthrough: parsed.passthrough });\n      case 'login':\n        return await runLogin(ctx, {\n          host: parsed.flags.host as string | undefined,\n          force: parsed.flags.force === true,\n          env,\n        });\n      case 'logout':\n        return await runLogout(ctx, {\n          host: parsed.flags.host as string | undefined,\n          all: parsed.flags.all === true,\n          env,\n        });\n      case 'whoami':\n        return await runWhoami(ctx, {\n          host: parsed.flags.host as string | undefined,\n          env,\n        });\n      default:\n        // Unreachable — COMMANDS gate above — but keeps the switch total.\n        throw usageError(\n          `Unknown command \"${command}\".`,\n          `Run one of: ${COMMANDS.join(', ')}.`,\n        );\n    }\n  } catch (error) {\n    return ctx.fail(toCliError(error));\n  }\n}\n\n/**\n * Presence of `--json` (or `--no-json`) BEFORE the first `--` passthrough.\n *\n * Tri-state on purpose. `undefined` means \"the user expressed no preference\",\n * which is what lets the context fall back to inferring the mode from a\n * non-TTY stdout or CLAUDECODE. Collapsing `--no-json` to `false` here would\n * make it indistinguishable from absence, and the flag could then never turn\n * JSON mode OFF in exactly the cases it exists for.\n */\nfunction scanJsonFlag(argv: readonly string[]): boolean | undefined {\n  for (const token of argv) {\n    if (token === '--') break;\n    if (token === '--json') return true;\n    if (token === '--no-json') return false;\n  }\n  return undefined;\n}\n\nfunction scanFlagPresence(argv: readonly string[], name: string): boolean {\n  for (const token of argv) {\n    if (token === '--') break;\n    if (token === `--${name}`) return true;\n  }\n  return false;\n}\n\n/**\n * Split argv into the command (first bare token before `--`) and the rest\n * (everything else, order preserved, including global flags and the `--`\n * passthrough). Global flags are all booleans, so any bare token is the\n * command — no value-consumption ambiguity.\n */\nfunction splitCommand(argv: readonly string[]): {\n  command: string | null;\n  rest: string[];\n} {\n  for (let i = 0; i < argv.length; i++) {\n    const token = argv[i]!;\n    if (token === '--') break;\n    if (!token.startsWith('-')) {\n      return {\n        command: token,\n        rest: [...argv.slice(0, i), ...argv.slice(i + 1)],\n      };\n    }\n  }\n  return { command: null, rest: [...argv] };\n}\n\n/**\n * The CLI's own version, read from the package manifest at runtime rather than\n * baked in by the build — one source of truth, so a release bump cannot leave\n * `--version` reporting a stale number. The path resolves identically from\n * `src/index.ts` and from the emitted `dist/index.js`, both of which sit one\n * directory below the package root.\n */\nfunction readVersion(): string {\n  const manifest = new URL('../package.json', import.meta.url);\n  const parsed: unknown = JSON.parse(fs.readFileSync(manifest, 'utf8'));\n\n  return typeof parsed === 'object' &&\n    parsed !== null &&\n    'version' in parsed &&\n    typeof parsed.version === 'string'\n    ? parsed.version\n    : '0.0.0';\n}\n\nfunction emitVersion(ctx: CliContext): number {\n  const version = readVersion();\n\n  return ctx.succeed({ name: 'ekanos', version }, version);\n}\n\nfunction emitHelp(ctx: CliContext): number {\n  ctx.emitClaudeCodeHint({\n    tool: 'ekanos',\n    commands: COMMANDS,\n    usage: USAGE,\n    exitCodes: EXIT_CODES,\n  });\n  return ctx.succeed({ usage: USAGE, commands: COMMANDS }, USAGE);\n}\n\nfunction emitCommandHelp(ctx: CliContext, command: string): number {\n  const specs = COMMAND_SPECS[command] ?? {};\n  const flags = Object.keys(specs).map((name) => `--${name}`);\n  const help = `Usage: ekanos ${command} [${flags.join('] [')}]`;\n  ctx.emitClaudeCodeHint({ tool: 'ekanos', command, flags });\n  return ctx.succeed({ command, flags }, help);\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAoB,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAkB,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGvD,MAAM,YAAY,GAAc;IAC9B,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;CAC7B,CAAC;AAEF,MAAM,aAAa,GAA8B;IAC/C,IAAI,EAAE;QACJ,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;KACzB;IACD,QAAQ,EAAE;QACR,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACxB;IACD,GAAG,EAAE;QACH,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;KAC3B;IACD,IAAI,EAAE;QACJ,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACxB;IACD,KAAK,EAAE;QACL,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;KAC3B;IACD,MAAM,EAAE;QACN,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;KACzB;IACD,MAAM,EAAE;QACN,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACzB;IACD,MAAM,EAAE;QACN,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACxB;IACD,OAAO,EAAE;QACP,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvB,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;KACzB;CACF,CAAC;AAEF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAE5C,MAAM,KAAK,GAAG;IACZ,mCAAmC;IACnC,EAAE;IACF,WAAW;IACX,qFAAqF;IACrF,yEAAyE;IACzE,qEAAqE;IACrE,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,qEAAqE;IACrE,0EAA0E;IAC1E,yEAAyE;IACzE,EAAE;IACF,oDAAoD;IACpD,4EAA4E;IAC5E,6EAA6E;IAC7E,mEAAmE;IACnE,0EAA0E;IAC1E,qEAAqE;IACrE,EAAE;IACF,iBAAiB;IACjB,0EAA0E;IAC1E,uDAAuD;IACvD,oCAAoC;IACpC,6BAA6B;CAC9B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AASb;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,IAAuB,EACvB,UAAsB,EAAE;;IAExB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC;QACzB,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,mCAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,mCAAI,OAAO,CAAC,GAAG,CAAC;IAEvC,IAAI,CAAC;QACH,2EAA2E;QAC3E,oEAAoE;QACpE,wDAAwD;QACxD,IAAI,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;YACtC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAE7C,+BAA+B;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YACD,6DAA6D;YAC7D,GAAG,CAAC,kBAAkB,CAAC;gBACrB,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,iBAAiB;gBACxB,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;YACH,MAAM,UAAU,CACd,4BAA4B,IAAI,CAAC,CAAC,CAAC,IAAI,EACvC,eAAe,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAC3D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,kBAAkB,CAAC;gBACrB,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,iBAAiB;gBACxB,KAAK,EAAE,OAAO;gBACd,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;YACH,MAAM,UAAU,CACd,oBAAoB,OAAO,IAAI,EAC/B,eAAe,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAC3D,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,mCAAmB,YAAY,GAAK,aAAa,CAAC,OAAO,CAAC,CAAE,CAAC;QACxE,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAEtC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,UAAU,CACd,IAAI,OAAO,yCAAyC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,EAC9E,2DAA2D,OAAO,WAAW,CAC9E,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,MAAC,MAAM,CAAC,KAAK,CAAC,GAA0B,mCAAI,GAAG,CAAC;QAE5D,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,MAAM;gBACT,OAAO,OAAO,CAAC,GAAG,EAAE;oBAClB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAyB;oBAC3C,GAAG;oBACH,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;oBAClC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI;iBAC/B,CAAC,CAAC;YACL,KAAK,UAAU;gBACb,OAAO,MAAM,WAAW,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACzC,KAAK,KAAK;gBACR,OAAO,MAAM,MAAM,CAAC,GAAG,EAAE;oBACvB,GAAG;oBACH,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;oBAClC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAA4B;iBACjD,CAAC,CAAC;YACL,KAAK,MAAM;gBACT,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;YACtE,KAAK,OAAO;gBACV,OAAO,MAAM,QAAQ,CAAC,GAAG,EAAE;oBACzB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;oBAClC,GAAG;oBACH,GAAG;iBACJ,CAAC,CAAC;YACL,KAAK,QAAQ;gBACX,OAAO,MAAM,SAAS,CAAC,GAAG,EAAE;oBAC1B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI;oBAC9B,GAAG;oBACH,GAAG;iBACJ,CAAC,CAAC;YACL,KAAK,QAAQ;gBACX,OAAO,MAAM,SAAS,CAAC,GAAG,EAAE;oBAC1B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,GAAG;oBACH,GAAG;iBACJ,CAAC,CAAC;YACL,KAAK,QAAQ;gBACX,OAAO,MAAM,SAAS,CAAC,GAAG,EAAE;oBAC1B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,GAAG;oBACH,GAAG;iBACJ,CAAC,CAAC;YACL,KAAK,SAAS;gBACZ,OAAO,MAAM,UAAU,CAAC,GAAG,EAAE;oBAC3B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAA4B;oBACjD,GAAG;oBACH,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI;oBAC9B,GAAG;iBACJ,CAAC,CAAC;YACL;gBACE,kEAAkE;gBAClE,MAAM,UAAU,CACd,oBAAoB,OAAO,IAAI,EAC/B,eAAe,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACtC,CAAC;QACN,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,IAAuB;IAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM;QAC1B,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,KAAK,KAAK,WAAW;YAAE,OAAO,KAAK,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAuB,EAAE,IAAY;IAC7D,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM;QAC1B,IAAI,KAAK,KAAK,KAAK,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAAuB;IAI3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM;QAC1B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;aAClD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW;IAClB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAEtE,OAAO,OAAO,MAAM,KAAK,QAAQ;QAC/B,MAAM,KAAK,IAAI;QACf,SAAS,IAAI,MAAM;QACnB,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAClC,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,OAAO,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,GAAe;IAClC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAE9B,OAAO,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,QAAQ,CAAC,GAAe;IAC/B,GAAG,CAAC,kBAAkB,CAAC;QACrB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,KAAK;QACZ,SAAS,EAAE,UAAU;KACtB,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,eAAe,CAAC,GAAe,EAAE,OAAe;;IACvD,MAAM,KAAK,GAAG,MAAA,aAAa,CAAC,OAAO,CAAC,mCAAI,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,iBAAiB,OAAO,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;IAC/D,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,OAAO,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC","sourcesContent":["import * as fs from 'node:fs';\n\nimport { runDev } from './commands/dev';\nimport { runInit } from './commands/init';\nimport { runLogin } from './commands/login';\nimport { runLogout } from './commands/logout';\nimport { runPublish } from './commands/publish';\nimport { runStatus } from './commands/status';\nimport { runTest } from './commands/test';\nimport { runValidate } from './commands/validate';\nimport { runWhoami } from './commands/whoami';\nimport { CliContext, type WriteStream } from './context';\nimport { toCliError, usageError } from './errors';\nimport { EXIT_CODES } from './exit-codes';\nimport { type FlagSpecs, parseArgv } from './parse-argv';\n\nexport { CliContext } from './context';\nexport { EXIT_CODES, ERROR_CODES } from './exit-codes';\nexport type { ExitCode, ErrorCode } from './exit-codes';\n\nconst GLOBAL_SPECS: FlagSpecs = {\n  json: { type: 'boolean' },\n  help: { type: 'boolean' },\n  version: { type: 'boolean' },\n};\n\nconst COMMAND_SPECS: Record<string, FlagSpecs> = {\n  init: {\n    slug: { type: 'string' },\n    dir: { type: 'string' },\n    force: { type: 'boolean' },\n    yes: { type: 'boolean' },\n  },\n  validate: {\n    dir: { type: 'string' },\n  },\n  dev: {\n    dir: { type: 'string' },\n    port: { type: 'string' },\n    host: { type: 'string' },\n    force: { type: 'boolean' },\n    start: { type: 'boolean' },\n  },\n  test: {\n    dir: { type: 'string' },\n  },\n  login: {\n    host: { type: 'string' },\n    force: { type: 'boolean' },\n  },\n  logout: {\n    host: { type: 'string' },\n    all: { type: 'boolean' },\n  },\n  whoami: {\n    host: { type: 'string' },\n  },\n  status: {\n    host: { type: 'string' },\n    dir: { type: 'string' },\n  },\n  publish: {\n    host: { type: 'string' },\n    source: { type: 'string' },\n    dir: { type: 'string' },\n    yes: { type: 'boolean' },\n  },\n};\n\nconst COMMANDS = Object.keys(COMMAND_SPECS);\n\nconst USAGE = [\n  'Usage: ekanos <command> [options]',\n  '',\n  'Commands:',\n  '  init       Scaffold a new integration project into ./<slug> (--slug <slug> --yes)',\n  '  validate   Validate ekanos.json + the integration definition (--json)',\n  '  dev        Scaffold .ekanos/harness and run it with your own Next',\n  '  test       Run the project test script via its package manager (--json)',\n  '  login      Authenticate against a Fusion host in a browser (--host <url>)',\n  '  logout     Revoke and delete the stored session (--host <url> | --all)',\n  '  whoami     Print the identity the stored session authenticates as',\n  \"  status     Show login state and this project's submissions on the host\",\n  '  publish    Validate, pack and submit the integration to a Fusion host',\n  '',\n  'Host resolution (logout, whoami, status, publish):',\n  '  --host, else EKANOS_HOST, else the \"host\" field in ekanos.json, else the',\n  '  sole stored login. \"ekanos publish\" saves host and source to ekanos.json.',\n  '  \"ekanos login\" never reads ekanos.json for a host (--host, else',\n  '  EKANOS_HOST, else the sole stored login) — it is the verb that creates',\n  '  credentials, so a committed file must never choose where they go.',\n  '',\n  'Global options:',\n  '  --json     Emit a single JSON envelope on stdout (auto-on when piped);',\n  '             --no-json forces the human-readable form',\n  '  --version  Print the CLI version',\n  '  --help     Show this help',\n].join('\\n');\n\nexport interface RunOptions {\n  stdout?: WriteStream;\n  stderr?: WriteStream;\n  env?: Record<string, string | undefined>;\n  cwd?: string;\n}\n\n/**\n * The single entry point. Resolves the agent-native envelope once, dispatches\n * to a verb, and guarantees exactly one terminal emission (success or error).\n * Returns the process exit code — `bin.ts` is the only place that calls\n * `process.exit`, so this stays fully testable.\n */\nexport async function run(\n  argv: readonly string[],\n  options: RunOptions = {},\n): Promise<number> {\n  const jsonFlag = scanJsonFlag(argv);\n  const ctx = new CliContext({\n    jsonFlag,\n    stdout: options.stdout,\n    stderr: options.stderr,\n    env: options.env,\n  });\n  const cwd = options.cwd ?? process.cwd();\n  const env = options.env ?? process.env;\n\n  try {\n    // `--version` is global and verb-independent, so it is answered before the\n    // command is even resolved: `ekanos --version` and `ekanos validate\n    // --version` both report the tool's version and exit 0.\n    if (scanFlagPresence(argv, 'version')) {\n      return emitVersion(ctx);\n    }\n\n    const { command, rest } = splitCommand(argv);\n\n    // Top-level help / no command.\n    if (!command) {\n      if (scanFlagPresence(rest, 'help') || argv.length === 0) {\n        return emitHelp(ctx);\n      }\n      // A leading token that is not a command (e.g. `--nonsense`).\n      ctx.emitClaudeCodeHint({\n        tool: 'ekanos',\n        error: 'unknown-command',\n        commands: COMMANDS,\n        usage: USAGE,\n      });\n      throw usageError(\n        `Unknown command or flag \"${argv[0]}\".`,\n        `Run one of: ${COMMANDS.join(', ')}. See \"ekanos --help\".`,\n      );\n    }\n\n    if (!COMMANDS.includes(command)) {\n      ctx.emitClaudeCodeHint({\n        tool: 'ekanos',\n        error: 'unknown-command',\n        given: command,\n        commands: COMMANDS,\n        usage: USAGE,\n      });\n      throw usageError(\n        `Unknown command \"${command}\".`,\n        `Run one of: ${COMMANDS.join(', ')}. See \"ekanos --help\".`,\n      );\n    }\n\n    const specs: FlagSpecs = { ...GLOBAL_SPECS, ...COMMAND_SPECS[command] };\n    const parsed = parseArgv(rest, specs);\n\n    if (parsed.flags.help === true) {\n      return emitCommandHelp(ctx, command);\n    }\n\n    if (parsed.positionals.length > 0) {\n      throw usageError(\n        `\"${command}\" takes no positional arguments (got \"${parsed.positionals[0]}\").`,\n        `Pass options as flags, e.g. \"--dir <path>\". See \"ekanos ${command} --help\".`,\n      );\n    }\n\n    const dir = (parsed.flags.dir as string | undefined) ?? cwd;\n\n    switch (command) {\n      case 'init':\n        return runInit(ctx, {\n          slug: parsed.flags.slug as string | undefined,\n          dir: parsed.flags.dir as string | undefined,\n          cwd,\n          force: parsed.flags.force === true,\n          yes: parsed.flags.yes === true,\n        });\n      case 'validate':\n        return await runValidate(ctx, { dir });\n      case 'dev':\n        return await runDev(ctx, {\n          dir,\n          port: parsed.flags.port as string | undefined,\n          host: parsed.flags.host as string | undefined,\n          force: parsed.flags.force === true,\n          start: parsed.flags.start as boolean | undefined,\n        });\n      case 'test':\n        return await runTest(ctx, { dir, passthrough: parsed.passthrough });\n      case 'login':\n        return await runLogin(ctx, {\n          host: parsed.flags.host as string | undefined,\n          force: parsed.flags.force === true,\n          cwd,\n          env,\n        });\n      case 'logout':\n        return await runLogout(ctx, {\n          host: parsed.flags.host as string | undefined,\n          all: parsed.flags.all === true,\n          cwd,\n          env,\n        });\n      case 'whoami':\n        return await runWhoami(ctx, {\n          host: parsed.flags.host as string | undefined,\n          cwd,\n          env,\n        });\n      case 'status':\n        return await runStatus(ctx, {\n          host: parsed.flags.host as string | undefined,\n          dir,\n          env,\n        });\n      case 'publish':\n        return await runPublish(ctx, {\n          host: parsed.flags.host as string | undefined,\n          source: parsed.flags.source as string | undefined,\n          dir,\n          yes: parsed.flags.yes === true,\n          env,\n        });\n      default:\n        // Unreachable — COMMANDS gate above — but keeps the switch total.\n        throw usageError(\n          `Unknown command \"${command}\".`,\n          `Run one of: ${COMMANDS.join(', ')}.`,\n        );\n    }\n  } catch (error) {\n    return ctx.fail(toCliError(error));\n  }\n}\n\n/**\n * Presence of `--json` (or `--no-json`) BEFORE the first `--` passthrough.\n *\n * Tri-state on purpose. `undefined` means \"the user expressed no preference\",\n * which is what lets the context fall back to inferring the mode from a\n * non-TTY stdout or CLAUDECODE. Collapsing `--no-json` to `false` here would\n * make it indistinguishable from absence, and the flag could then never turn\n * JSON mode OFF in exactly the cases it exists for.\n */\nfunction scanJsonFlag(argv: readonly string[]): boolean | undefined {\n  for (const token of argv) {\n    if (token === '--') break;\n    if (token === '--json') return true;\n    if (token === '--no-json') return false;\n  }\n  return undefined;\n}\n\nfunction scanFlagPresence(argv: readonly string[], name: string): boolean {\n  for (const token of argv) {\n    if (token === '--') break;\n    if (token === `--${name}`) return true;\n  }\n  return false;\n}\n\n/**\n * Split argv into the command (first bare token before `--`) and the rest\n * (everything else, order preserved, including global flags and the `--`\n * passthrough). Global flags are all booleans, so any bare token is the\n * command — no value-consumption ambiguity.\n */\nfunction splitCommand(argv: readonly string[]): {\n  command: string | null;\n  rest: string[];\n} {\n  for (let i = 0; i < argv.length; i++) {\n    const token = argv[i]!;\n    if (token === '--') break;\n    if (!token.startsWith('-')) {\n      return {\n        command: token,\n        rest: [...argv.slice(0, i), ...argv.slice(i + 1)],\n      };\n    }\n  }\n  return { command: null, rest: [...argv] };\n}\n\n/**\n * The CLI's own version, read from the package manifest at runtime rather than\n * baked in by the build — one source of truth, so a release bump cannot leave\n * `--version` reporting a stale number. The path resolves identically from\n * `src/index.ts` and from the emitted `dist/index.js`, both of which sit one\n * directory below the package root.\n */\nfunction readVersion(): string {\n  const manifest = new URL('../package.json', import.meta.url);\n  const parsed: unknown = JSON.parse(fs.readFileSync(manifest, 'utf8'));\n\n  return typeof parsed === 'object' &&\n    parsed !== null &&\n    'version' in parsed &&\n    typeof parsed.version === 'string'\n    ? parsed.version\n    : '0.0.0';\n}\n\nfunction emitVersion(ctx: CliContext): number {\n  const version = readVersion();\n\n  return ctx.succeed({ name: 'ekanos', version }, version);\n}\n\nfunction emitHelp(ctx: CliContext): number {\n  ctx.emitClaudeCodeHint({\n    tool: 'ekanos',\n    commands: COMMANDS,\n    usage: USAGE,\n    exitCodes: EXIT_CODES,\n  });\n  return ctx.succeed({ usage: USAGE, commands: COMMANDS }, USAGE);\n}\n\nfunction emitCommandHelp(ctx: CliContext, command: string): number {\n  const specs = COMMAND_SPECS[command] ?? {};\n  const flags = Object.keys(specs).map((name) => `--${name}`);\n  const help = `Usage: ekanos ${command} [${flags.join('] [')}]`;\n  ctx.emitClaudeCodeHint({ tool: 'ekanos', command, flags });\n  return ctx.succeed({ command, flags }, help);\n}\n"]}

package/dist/pack.d.ts

@@ -0,0 +1,14 @@
+/** The server refuses archives over 5 MiB; fail fast on the client too. */
+export declare const MAX_ARCHIVE_BYTES: number;
+export interface PackedProject {
+    /** The gzipped tarball. */
+    archive: Buffer;
+    /** Project-relative POSIX paths, in the order they were packed. */
+    files: string[];
+}
+export declare function packProject(projectDir: string): PackedProject;
+/**
+ * The whitelist walk. Exported for tests: the selection rules are the part
+ * with security consequences, so they are asserted directly.
+ */
+export declare function selectProjectFiles(projectDir: string): string[];

package/dist/pack.js

@@ -0,0 +1,157 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as zlib from 'node:zlib';
+import { preconditionError, validationError } from './errors.js';
+/**
+ * Deterministic project packing for `ekanos publish`.
+ *
+ * A minimal ustar writer over Node's built-ins — no `tar` dependency. The
+ * selection is deliberately a WHITELIST, not "everything minus a blocklist":
+ * the submission is reviewed by an operator and installed into Fusion, so the
+ * archive must contain exactly the files the toolchain knows about and
+ * nothing a working directory happens to hold.
+ *
+ *   - `ekanos.json`, `package.json` (required)
+ *   - `README.md` (when present)
+ *   - everything under `src/`, recursively
+ *
+ * Excluded everywhere: dotfiles and dot-directories (which covers `.ekanos`,
+ * `.git`, `.env`), `node_modules`, and anything that is not a regular file
+ * (symlinks are skipped, not followed — a link pointing outside the project
+ * must never pull foreign bytes into a submission).
+ *
+ * Determinism: entries are sorted by path and every header carries a fixed
+ * mtime, so packing the same tree twice yields byte-identical archives and a
+ * stable sha256.
+ */
+const BLOCK_SIZE = 512;
+/** Fixed header mtime — determinism over provenance (the VCS owns history). */
+const FIXED_MTIME_SECONDS = 0;
+/** The server refuses archives over 5 MiB; fail fast on the client too. */
+// 4 MiB — mirrors the server route's cap, which itself sits under Vercel's
+// ~4.5 MB request-body ceiling so oversize is caught here with a clear error
+// instead of by an opaque platform 413.
+export const MAX_ARCHIVE_BYTES = 4 * 1024 * 1024;
+export function packProject(projectDir) {
+    const files = selectProjectFiles(projectDir);
+    const blocks = [];
+    for (const relative of files) {
+        const absolute = path.join(projectDir, relative);
+        const content = fs.readFileSync(absolute);
+        blocks.push(tarHeader(relative, content.length));
+        blocks.push(content);
+        const remainder = content.length % BLOCK_SIZE;
+        if (remainder !== 0) {
+            blocks.push(Buffer.alloc(BLOCK_SIZE - remainder));
+        }
+    }
+    // End-of-archive: two zero blocks.
+    blocks.push(Buffer.alloc(BLOCK_SIZE * 2));
+    const archive = zlib.gzipSync(Buffer.concat(blocks), { level: 9 });
+    if (archive.length > MAX_ARCHIVE_BYTES) {
+        throw validationError(`The packed archive is ${archive.length} bytes, over the ` +
+            `${MAX_ARCHIVE_BYTES}-byte submission limit.`, 'Reduce the project to source only — large binary assets do not ' +
+            'belong in an integration submission.');
+    }
+    return { archive, files };
+}
+/**
+ * The whitelist walk. Exported for tests: the selection rules are the part
+ * with security consequences, so they are asserted directly.
+ */
+export function selectProjectFiles(projectDir) {
+    for (const required of ['ekanos.json', 'package.json']) {
+        if (!isRegularFile(path.join(projectDir, required))) {
+            throw preconditionError(`Cannot pack ${projectDir}: ${required} is missing.`, `Run "ekanos publish" from an integration project (or pass --dir), ` +
+                `and run "ekanos init" first if this is a new project.`);
+        }
+    }
+    const selected = ['ekanos.json', 'package.json'];
+    if (isRegularFile(path.join(projectDir, 'README.md'))) {
+        selected.push('README.md');
+    }
+    const srcDir = path.join(projectDir, 'src');
+    // lstat, not stat: `src` itself as a symlink must not pull a foreign tree
+    // into the archive — the same rule walk() applies to every entry inside.
+    if (fs.existsSync(srcDir) && fs.lstatSync(srcDir).isDirectory()) {
+        selected.push(...walk(projectDir, 'src'));
+    }
+    return selected.sort();
+}
+function walk(projectDir, relativeDir) {
+    const absoluteDir = path.join(projectDir, relativeDir);
+    const collected = [];
+    for (const entry of fs.readdirSync(absoluteDir, { withFileTypes: true })) {
+        if (entry.name.startsWith('.'))
+            continue;
+        if (entry.name === 'node_modules')
+            continue;
+        const relative = `${relativeDir}/${entry.name}`;
+        if (entry.isDirectory()) {
+            collected.push(...walk(projectDir, relative));
+            continue;
+        }
+        // Regular files only. `isFile()` is false for symlinks under
+        // `withFileTypes`, so a link — wherever it points — is skipped here.
+        if (entry.isFile()) {
+            collected.push(relative);
+        }
+    }
+    return collected;
+}
+function isRegularFile(absolute) {
+    try {
+        return fs.lstatSync(absolute).isFile();
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/**
+ * One 512-byte ustar header. Long paths use the ustar `prefix` field
+ * (155 + '/' + 100); a path that fits neither is refused with a clear error
+ * rather than silently truncated.
+ */
+function tarHeader(relativePath, size) {
+    const { name, prefix } = splitUstarPath(relativePath);
+    const header = Buffer.alloc(BLOCK_SIZE);
+    header.write(name, 0, 100, 'utf8');
+    writeOctal(header, 100, 8, 0o644); // mode
+    writeOctal(header, 108, 8, 0); // uid
+    writeOctal(header, 116, 8, 0); // gid
+    writeOctal(header, 124, 12, size);
+    writeOctal(header, 136, 12, FIXED_MTIME_SECONDS);
+    header.fill(' ', 148, 156); // checksum placeholder: eight spaces
+    header.write('0', 156, 1, 'utf8'); // typeflag: regular file
+    header.write('ustar', 257, 5, 'utf8');
+    header.write('00', 263, 2, 'utf8'); // version
+    header.write(prefix, 345, 155, 'utf8');
+    let checksum = 0;
+    for (const byte of header)
+        checksum += byte;
+    // Six octal digits, NUL, space — the historical checksum encoding.
+    header.write(`${checksum.toString(8).padStart(6, '0')}\0 `, 148, 8, 'latin1');
+    return header;
+}
+function splitUstarPath(relativePath) {
+    if (Buffer.byteLength(relativePath, 'utf8') <= 100) {
+        return { name: relativePath, prefix: '' };
+    }
+    // Split at a '/' so that name ≤ 100 bytes and prefix ≤ 155 bytes.
+    for (let i = relativePath.length - 1; i > 0; i--) {
+        if (relativePath[i] !== '/')
+            continue;
+        const prefix = relativePath.slice(0, i);
+        const name = relativePath.slice(i + 1);
+        if (Buffer.byteLength(name, 'utf8') <= 100 &&
+            Buffer.byteLength(prefix, 'utf8') <= 155) {
+            return { name, prefix };
+        }
+    }
+    throw validationError(`Cannot pack "${relativePath}": the path is too long for a tar entry.`, 'Shorten the file path (tar limits one segment to 100 bytes and the ' +
+        'directory prefix to 155).');
+}
+function writeOctal(header, offset, length, value) {
+    header.write(`${value.toString(8).padStart(length - 1, '0')}\0`, offset, length, 'latin1');
+}
+//# sourceMappingURL=pack.js.map

package/dist/pack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack.js","sourceRoot":"","sources":["../src/pack.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,+EAA+E;AAC/E,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,wCAAwC;AACxC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AASjD,MAAM,UAAU,WAAW,CAAC,UAAkB;IAC5C,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAE7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAE1C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAErB,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC;QAC9C,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC;IAE1C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAEnE,IAAI,OAAO,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACvC,MAAM,eAAe,CACnB,yBAAyB,OAAO,CAAC,MAAM,mBAAmB;YACxD,GAAG,iBAAiB,yBAAyB,EAC/C,iEAAiE;YAC/D,sCAAsC,CACzC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,KAAK,MAAM,QAAQ,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YACpD,MAAM,iBAAiB,CACrB,eAAe,UAAU,KAAK,QAAQ,cAAc,EACpD,oEAAoE;gBAClE,uDAAuD,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAEjD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;QACtD,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC5C,0EAA0E;IAC1E,yEAAyE;IACzE,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAChE,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,IAAI,CAAC,UAAkB,EAAE,WAAmB;IACnD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACvD,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACzE,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACzC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;YAAE,SAAS;QAE5C,MAAM,QAAQ,GAAG,GAAG,WAAW,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAEhD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC9C,SAAS;QACX,CAAC;QAED,6DAA6D;QAC7D,qEAAqE;QACrE,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACnB,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;IACzC,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,YAAoB,EAAE,IAAY;IACnD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAExC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACnC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO;IAC1C,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM;IACrC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM;IACrC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAClC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,mBAAmB,CAAC,CAAC;IACjD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,qCAAqC;IACjE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,yBAAyB;IAC5D,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU;IAC9C,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAEvC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,MAAM;QAAE,QAAQ,IAAI,IAAI,CAAC;IAE5C,mEAAmE;IACnE,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IAE9E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,YAAoB;IAI1C,IAAI,MAAM,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACnD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC5C,CAAC;IAED,kEAAkE;IAClE,KAAK,IAAI,CAAC,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACjD,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,SAAS;QAEtC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAEvC,IACE,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,GAAG;YACtC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,GAAG,EACxC,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,MAAM,eAAe,CACnB,gBAAgB,YAAY,0CAA0C,EACtE,qEAAqE;QACnE,2BAA2B,CAC9B,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,MAAc,EACd,MAAc,EACd,MAAc,EACd,KAAa;IAEb,MAAM,CAAC,KAAK,CACV,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,EAClD,MAAM,EACN,MAAM,EACN,QAAQ,CACT,CAAC;AACJ,CAAC","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\nimport * as zlib from 'node:zlib';\n\nimport { preconditionError, validationError } from './errors';\n\n/**\n * Deterministic project packing for `ekanos publish`.\n *\n * A minimal ustar writer over Node's built-ins — no `tar` dependency. The\n * selection is deliberately a WHITELIST, not \"everything minus a blocklist\":\n * the submission is reviewed by an operator and installed into Fusion, so the\n * archive must contain exactly the files the toolchain knows about and\n * nothing a working directory happens to hold.\n *\n *   - `ekanos.json`, `package.json` (required)\n *   - `README.md` (when present)\n *   - everything under `src/`, recursively\n *\n * Excluded everywhere: dotfiles and dot-directories (which covers `.ekanos`,\n * `.git`, `.env`), `node_modules`, and anything that is not a regular file\n * (symlinks are skipped, not followed — a link pointing outside the project\n * must never pull foreign bytes into a submission).\n *\n * Determinism: entries are sorted by path and every header carries a fixed\n * mtime, so packing the same tree twice yields byte-identical archives and a\n * stable sha256.\n */\n\nconst BLOCK_SIZE = 512;\n\n/** Fixed header mtime — determinism over provenance (the VCS owns history). */\nconst FIXED_MTIME_SECONDS = 0;\n\n/** The server refuses archives over 5 MiB; fail fast on the client too. */\n// 4 MiB — mirrors the server route's cap, which itself sits under Vercel's\n// ~4.5 MB request-body ceiling so oversize is caught here with a clear error\n// instead of by an opaque platform 413.\nexport const MAX_ARCHIVE_BYTES = 4 * 1024 * 1024;\n\nexport interface PackedProject {\n  /** The gzipped tarball. */\n  archive: Buffer;\n  /** Project-relative POSIX paths, in the order they were packed. */\n  files: string[];\n}\n\nexport function packProject(projectDir: string): PackedProject {\n  const files = selectProjectFiles(projectDir);\n\n  const blocks: Buffer[] = [];\n\n  for (const relative of files) {\n    const absolute = path.join(projectDir, relative);\n    const content = fs.readFileSync(absolute);\n\n    blocks.push(tarHeader(relative, content.length));\n    blocks.push(content);\n\n    const remainder = content.length % BLOCK_SIZE;\n    if (remainder !== 0) {\n      blocks.push(Buffer.alloc(BLOCK_SIZE - remainder));\n    }\n  }\n\n  // End-of-archive: two zero blocks.\n  blocks.push(Buffer.alloc(BLOCK_SIZE * 2));\n\n  const archive = zlib.gzipSync(Buffer.concat(blocks), { level: 9 });\n\n  if (archive.length > MAX_ARCHIVE_BYTES) {\n    throw validationError(\n      `The packed archive is ${archive.length} bytes, over the ` +\n        `${MAX_ARCHIVE_BYTES}-byte submission limit.`,\n      'Reduce the project to source only — large binary assets do not ' +\n        'belong in an integration submission.',\n    );\n  }\n\n  return { archive, files };\n}\n\n/**\n * The whitelist walk. Exported for tests: the selection rules are the part\n * with security consequences, so they are asserted directly.\n */\nexport function selectProjectFiles(projectDir: string): string[] {\n  for (const required of ['ekanos.json', 'package.json']) {\n    if (!isRegularFile(path.join(projectDir, required))) {\n      throw preconditionError(\n        `Cannot pack ${projectDir}: ${required} is missing.`,\n        `Run \"ekanos publish\" from an integration project (or pass --dir), ` +\n          `and run \"ekanos init\" first if this is a new project.`,\n      );\n    }\n  }\n\n  const selected = ['ekanos.json', 'package.json'];\n\n  if (isRegularFile(path.join(projectDir, 'README.md'))) {\n    selected.push('README.md');\n  }\n\n  const srcDir = path.join(projectDir, 'src');\n  // lstat, not stat: `src` itself as a symlink must not pull a foreign tree\n  // into the archive — the same rule walk() applies to every entry inside.\n  if (fs.existsSync(srcDir) && fs.lstatSync(srcDir).isDirectory()) {\n    selected.push(...walk(projectDir, 'src'));\n  }\n\n  return selected.sort();\n}\n\nfunction walk(projectDir: string, relativeDir: string): string[] {\n  const absoluteDir = path.join(projectDir, relativeDir);\n  const collected: string[] = [];\n\n  for (const entry of fs.readdirSync(absoluteDir, { withFileTypes: true })) {\n    if (entry.name.startsWith('.')) continue;\n    if (entry.name === 'node_modules') continue;\n\n    const relative = `${relativeDir}/${entry.name}`;\n\n    if (entry.isDirectory()) {\n      collected.push(...walk(projectDir, relative));\n      continue;\n    }\n\n    // Regular files only. `isFile()` is false for symlinks under\n    // `withFileTypes`, so a link — wherever it points — is skipped here.\n    if (entry.isFile()) {\n      collected.push(relative);\n    }\n  }\n\n  return collected;\n}\n\nfunction isRegularFile(absolute: string): boolean {\n  try {\n    return fs.lstatSync(absolute).isFile();\n  } catch {\n    return false;\n  }\n}\n\n/**\n * One 512-byte ustar header. Long paths use the ustar `prefix` field\n * (155 + '/' + 100); a path that fits neither is refused with a clear error\n * rather than silently truncated.\n */\nfunction tarHeader(relativePath: string, size: number): Buffer {\n  const { name, prefix } = splitUstarPath(relativePath);\n  const header = Buffer.alloc(BLOCK_SIZE);\n\n  header.write(name, 0, 100, 'utf8');\n  writeOctal(header, 100, 8, 0o644); // mode\n  writeOctal(header, 108, 8, 0); // uid\n  writeOctal(header, 116, 8, 0); // gid\n  writeOctal(header, 124, 12, size);\n  writeOctal(header, 136, 12, FIXED_MTIME_SECONDS);\n  header.fill(' ', 148, 156); // checksum placeholder: eight spaces\n  header.write('0', 156, 1, 'utf8'); // typeflag: regular file\n  header.write('ustar', 257, 5, 'utf8');\n  header.write('00', 263, 2, 'utf8'); // version\n  header.write(prefix, 345, 155, 'utf8');\n\n  let checksum = 0;\n  for (const byte of header) checksum += byte;\n\n  // Six octal digits, NUL, space — the historical checksum encoding.\n  header.write(`${checksum.toString(8).padStart(6, '0')}\\0 `, 148, 8, 'latin1');\n\n  return header;\n}\n\nfunction splitUstarPath(relativePath: string): {\n  name: string;\n  prefix: string;\n} {\n  if (Buffer.byteLength(relativePath, 'utf8') <= 100) {\n    return { name: relativePath, prefix: '' };\n  }\n\n  // Split at a '/' so that name ≤ 100 bytes and prefix ≤ 155 bytes.\n  for (let i = relativePath.length - 1; i > 0; i--) {\n    if (relativePath[i] !== '/') continue;\n\n    const prefix = relativePath.slice(0, i);\n    const name = relativePath.slice(i + 1);\n\n    if (\n      Buffer.byteLength(name, 'utf8') <= 100 &&\n      Buffer.byteLength(prefix, 'utf8') <= 155\n    ) {\n      return { name, prefix };\n    }\n  }\n\n  throw validationError(\n    `Cannot pack \"${relativePath}\": the path is too long for a tar entry.`,\n    'Shorten the file path (tar limits one segment to 100 bytes and the ' +\n      'directory prefix to 155).',\n  );\n}\n\nfunction writeOctal(\n  header: Buffer,\n  offset: number,\n  length: number,\n  value: number,\n): void {\n  header.write(\n    `${value.toString(8).padStart(length - 1, '0')}\\0`,\n    offset,\n    length,\n    'latin1',\n  );\n}\n"]}

package/dist/project.d.ts

@@ -11,28 +11,6 @@ declare const IntegrationEntrySchema: z.ZodObject<{
     entry: string;
 }>;
 export type IntegrationEntry = z.infer<typeof IntegrationEntrySchema>;
-/**
- * `ekanos.json` — the project contract. Written by `init`, read by `validate`,
- * `dev` and `test`.
- *
- * Two shapes, because a project can hold more than one integration and the
- * single-integration form is what `init` writes and what most projects keep:
- *
- * ```json
- * { "slug": "acme-crm", "entry": "src/integration.ts" }
- *
- * { "integrations": [
- *     { "slug": "acme-crm",    "entry": "src/crm.ts" },
- *     { "slug": "acme-billing", "entry": "src/billing.ts" }
- * ] }
- * ```
- *
- * A second integration used to be invisible to the CLI entirely — the harness
- * registry is an array and `collectCollisionFindings` exists precisely to
- * cross-check several definitions against each other, but `validate` could
- * only ever see one. Both forms normalise to the same list, so nothing
- * downstream has to know which was written.
- */
 export declare const EkanosProjectSchema: z.ZodEffects<z.ZodObject<{
     $schema: z.ZodOptional<z.ZodString>;
     slug: z.ZodOptional<z.ZodString>;
@@ -47,6 +25,18 @@ export declare const EkanosProjectSchema: z.ZodEffects<z.ZodObject<{
         slug: string;
         entry: string;
     }>, "many">>;
+    /**
+     * Written by the first successful `ekanos publish --source <slug>` so
+     * later publishes need no flag. Read only by `publish`.
+     */
+    source: z.ZodOptional<z.ZodString>;
+    /**
+     * The Fusion host this project publishes to — an http(s) origin, e.g.
+     * "https://app.example.com". Written by the first successful `ekanos
+     * publish` (alongside `source`), read by every host-taking verb as the
+     * fallback after `--host` and `EKANOS_HOST`.
+     */
+    host: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
     sourceGlobs: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, "many">>;
 }, "strict", z.ZodTypeAny, {
     slug?: string | undefined;
@@ -56,6 +46,8 @@ export declare const EkanosProjectSchema: z.ZodEffects<z.ZodObject<{
         slug: string;
         entry: string;
     }[] | undefined;
+    source?: string | undefined;
+    host?: string | undefined;
     sourceGlobs?: string[] | undefined;
 }, {
     slug?: string | undefined;
@@ -65,6 +57,8 @@ export declare const EkanosProjectSchema: z.ZodEffects<z.ZodObject<{
         slug: string;
         entry: string;
     }[] | undefined;
+    source?: string | undefined;
+    host?: string | undefined;
     sourceGlobs?: string[] | undefined;
 }>, {
     slug?: string | undefined;
@@ -74,6 +68,8 @@ export declare const EkanosProjectSchema: z.ZodEffects<z.ZodObject<{
         slug: string;
         entry: string;
     }[] | undefined;
+    source?: string | undefined;
+    host?: string | undefined;
     sourceGlobs?: string[] | undefined;
 }, {
     slug?: string | undefined;
@@ -83,6 +79,8 @@ export declare const EkanosProjectSchema: z.ZodEffects<z.ZodObject<{
         slug: string;
         entry: string;
     }[] | undefined;
+    source?: string | undefined;
+    host?: string | undefined;
     sourceGlobs?: string[] | undefined;
 }>;
 export type EkanosProject = z.infer<typeof EkanosProjectSchema>;

package/dist/project.js

@@ -60,12 +60,54 @@ const IntegrationEntrySchema = z
  * only ever see one. Both forms normalise to the same list, so nothing
  * downstream has to know which was written.
  */
+/**
+ * The Fusion source this project publishes to, by slug. Fusion source slugs
+ * are opaque server-side identifiers, so the only local claims are "one
+ * token, sanely sized" — the server resolves and authorizes it.
+ */
+const SourceSlugSchema = z
+    .string()
+    .min(1, { message: 'source must not be empty.' })
+    .max(255, { message: 'source must be at most 255 characters.' })
+    .regex(/^\S+$/, { message: 'source must not contain whitespace.' });
+/**
+ * The Fusion host this project publishes to. Origin-shaped: the same
+ * normalization the credential store applies (`normalizeHost`) accepts it, so
+ * "valid here" and "usable as a session key" cannot drift apart.
+ */
+const HostSchema = z
+    .string()
+    .min(1, { message: 'host must not be empty.' })
+    .max(255, { message: 'host must be at most 255 characters.' })
+    .refine((value) => {
+    try {
+        const url = new URL(value);
+        return url.protocol === 'https:' || url.protocol === 'http:';
+    }
+    catch (_a) {
+        return false;
+    }
+}, {
+    message: 'host must be a full http(s) origin, e.g. "https://app.example.com".',
+});
 export const EkanosProjectSchema = z
     .object({
     $schema: z.string().optional(),
     slug: SlugSchema.optional(),
     entry: EntrySchema.optional(),
     integrations: z.array(IntegrationEntrySchema).optional(),
+    /**
+     * Written by the first successful `ekanos publish --source <slug>` so
+     * later publishes need no flag. Read only by `publish`.
+     */
+    source: SourceSlugSchema.optional(),
+    /**
+     * The Fusion host this project publishes to — an http(s) origin, e.g.
+     * "https://app.example.com". Written by the first successful `ekanos
+     * publish` (alongside `source`), read by every host-taking verb as the
+     * fallback after `--host` and `EKANOS_HOST`.
+     */
+    host: HostSchema.optional(),
     // There is deliberately no `harness` field. One existed, accepted by the
     // schema and read by nothing — the same accept-and-ignore that made
     // `sourceGlobs` cost a partner a silently unstyled integration. `.strict()`
@@ -157,7 +199,7 @@ export function loadProject(dir) {
         const where = first && first.path.length > 0 ? first.path.join('.') : '(root)';
         throw preconditionError(`${EKANOS_CONFIG_FILENAME} is invalid at "${where}": ${(_a = first === null || first === void 0 ? void 0 : first.message) !== null && _a !== void 0 ? _a : 'schema violation'}`, `Correct ${configPath} so it matches the ekanos.json schema ` +
             `({ slug, entry } or { integrations: [...] }, plus optional ` +
-            `harness and sourceGlobs).`);
+            `source, host and sourceGlobs).`);
     }
     const project = result.data;
     const integrations = projectIntegrations(project).map((declared) => {