@ekanos/cli 0.1.7 → 0.1.8

package/dist/commands/publish.d.ts

@@ -82,3 +82,8 @@ export declare function persistProjectFields(loaded: LoadedProject, source: stri
     host: boolean;
     hostOverride: string | null;
 };
+/**
+ * The submitted version is the project's own `package.json#version` — one
+ * source of truth, the same field npm would publish.
+ */
+export declare function readProjectVersion(projectDir: string): string;

package/dist/commands/publish.js

@@ -358,7 +358,7 @@ const SEMVER_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:
  * The submitted version is the project's own `package.json#version` — one
  * source of truth, the same field npm would publish.
  */
-function readProjectVersion(projectDir) {
+export function readProjectVersion(projectDir) {
     const manifestPath = path.join(projectDir, 'package.json');
     let parsed;
     try {

package/dist/commands/publish.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../src/commands/publish.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAEL,oBAAoB,EACpB,cAAc,EACd,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,eAAe,GAChB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAsB,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,GACd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,EAAmB,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAuC1D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAe,EACf,IAAiB;;IAEjB,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE;QAC3D,UAAU,EAAE,IAAI,CAAC,GAAG;KACrB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAErC,wEAAwE;IACxE,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAE3D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO;KACR,CAAC,CAAC;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE5B,uEAAuE;IACvE,4EAA4E;IAC5E,2EAA2E;IAC3E,0DAA0D;IAC1D,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,MAAK,aAAa,EAAE,CAAC;QACrC,MAAM,iBAAiB,CACrB,eAAe,MAAM,CAAC,OAAO,CAAC,GAAG,aAAa,GAAG,CAAC,IAAI,aAAa;YACjE,qCAAqC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,EAC5D,qEAAqE;YACnE,gDAAgD,CACnD,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;IAEjC,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,qBAAqB,CAAC,CAAC;IAEjD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IAEzE,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC,IAAI,CACb,eAAe,CACb,wBAAwB,UAAU,qBAAqB;YACrD,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,EACnC,iEAAiE;YAC/D,uDAAuD;YACvD,mBAAmB,CACtB,EACD,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAC5B,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,wEAAwE;IACxE,2EAA2E;IAC3E,yBAAyB;IACzB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,OAAO,EAAE;QACvE,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,IAAI;QACJ,OAAO;QACP,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,UAAU,EAAE,MAAA,IAAI,CAAC,UAAU,mCAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;QAC3D,OAAO,EAAE,MAAA,IAAI,CAAC,OAAO,mCAAI,WAAW;KACrC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;IAExC,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,OAAO,GAAG,CAAC,CAAC;IAEvC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAErD,GAAG,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC,IAAI,aAAa,MAAM,KAAK,CAAC,CAAC;IAE3D,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,EAAE;QAChE,MAAM;QACN,IAAI;QACJ,OAAO;QACP,QAAQ;QACR,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAEjE,MAAM,aAAa,GAAG;QACpB,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC;IAEF,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY;QACzC,CAAC,CAAC,+BAA+B,GAAG,CAAC,IAAI,0BAA0B;YACjE,YAAY,SAAS,CAAC,YAAY,+BAA+B;YACjE,yDAAyD;QAC3D,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO,GAAG,CAAC,OAAO,+BAEd,IAAI,EAAE,GAAG,CAAC,IAAI,EACd,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE;YAC1B,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI;YAC9B,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI;SAC/B,EACD,IAAI,EAAE,OAAO,CAAC,IAAI,EAClB,OAAO,EAAE,OAAO,CAAC,OAAO,EACxB,YAAY,EAAE,OAAO,CAAC,YAAY,EAClC,KAAK,EAAE,OAAO,CAAC,KAAK,EACpB,aAAa,EAAE,OAAO,CAAC,aAAa,EACpC,KAAK,EAAE,MAAM,CAAC,KAAK,EACnB,eAAe,EAAE,SAAS,CAAC,MAAM,EACjC,aAAa,EAAE,SAAS,CAAC,IAAI,EAC7B,YAAY,EAAE,SAAS,CAAC,YAAY,IACjC,CAAC,IAAI,CAAC,MAAM,KAAK,eAAe;QACjC,CAAC,CAAC;YACE,UAAU,EAAE;gBACV,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;aAChD;SACF;QACH,CAAC,CAAC,EAAE,CAAC,GACJ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAE1C,sBAAsB,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,OAAO,GAAG,CAAC,IAAI,GAAG;QACrE,YAAY,MAAM,aAAa,OAAO,CAAC,KAAK,KAAK;QACjD,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;YACvB,CAAC,CAAC,UAAU,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,2BAA2B;gBAChE,gCAAgC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;YAC1E,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,CACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,mBAAmB,CAChC,GAAe,EACf,GAAoB,EACpB,OAAsB,EACtB,IAOC;;IAED,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAE5D,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACrC,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;IAEhE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,cAAc,CAClB,gDAAgD,IAAI,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAI,GAAG,EAC9E,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CACpC,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,GAAG,CACL,iBAAiB,MAAA,IAAI,CAAC,IAAI,mCAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,gBAAgB;YACnE,iBAAiB,CACpB,CAAC;QACF,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACvD,CAAC;IAED,uDAAuD;IACvD,EAAE;IACF,sEAAsE;IACtE,qEAAqE;IACrE,0EAA0E;IAC1E,uEAAuE;IACvE,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC;IAEnD,IAAI,SAAS,EAAE,CAAC;QACd,GAAG,CAAC,GAAG,CACL,cAAc,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,cAAc,MAAA,IAAI,CAAC,IAAI,mCAAI,IAAI,CAAC,IAAI,GAAG;YAC5E,IAAI,IAAI,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,EAAE,CAClC,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAEvD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,eAAe,CACnB,eAAe,IAAI,CAAC,IAAI,sBAAsB,EAC9C,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAC9B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,eAAe,CACnB,gDAAgD,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG;QACtE,oEAAoE;QACpE,mBAAmB,EACrB,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,OAAqB,EAAE,IAAY;IACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CACL,sCAAsC,IAAI,6BAA6B;YACvE,kEAAkE,CACnE,CAAC;IACJ,CAAC;IAED,OAAO,CACL,uBAAuB,aAAa,CAAC,OAAO,CAAC,2BAA2B;QACxE,uEAAuE;QACvE,UAAU,CACX,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAAqB;IAC1C,OAAO,CACL,sBAAsB,aAAa,CAAC,OAAO,CAAC,2BAA2B;QACvE,mEAAmE;QACnE,uEAAuE;QACvE,kCAAkC,CACnC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAAqB;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB;IAChD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACxD,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;QAClC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;QACjD,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,GAA8C,EAC9C,OAAsB,EACtB,OAA4C;IAE5C,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAE1E,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IAEhD,uEAAuE;IACvE,gEAAgE;IAChE,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAE7E,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC;IAElD,OAAO,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB,CAC9B,GAAoB,EACpB,OAAsB,EACtB,IAAwB,EACxB,MAAqB;IAErB,MAAM,QAAQ,GAAG,IAAI,KAAK,SAAS,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;IAE1C,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,aAAa,CAC1B,GAAoB,EACpB,OAAsB;IAEtB,IAAI,SAAS,GAAG,EAAE,CAAC;IAEnB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAE5D,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC3B,SAAS;gBACP,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;oBACvB,CAAC,CAAC,wBAAwB,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG;oBAC1D,CAAC,CAAC,oDAAoD,CAAC;QAC7D,CAAC;IACH,CAAC;IAAC,WAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;IAED,MAAM,eAAe,CACnB,4CAA4C,EAC5C,kEAAkE;QAChE,mEAAmE;QACnE,iBAAiB,SAAS,EAAE,CAC/B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAqB,EACrB,MAAc,EACd,IAAY;IAEZ,MAAM,KAAK,GAAG;QACZ,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;QACxC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS;KACxC,CAAC;IAEF,MAAM,YAAY,GAChB,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI;QAC/D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI;QACrB,CAAC,CAAC,IAAI,CAAC;IAEX,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CACd,MAAM,CAAC,UAAU,EACjB,gBAAgB,iCACX,MAAM,CAAC,OAAO,KACjB,MAAM,EACN,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAC7C,CACH,CAAC;QAEF,uCAAY,KAAK,KAAE,YAAY,IAAG;IACpC,CAAC;IAAC,WAAM,CAAC;QACP,wEAAwE;QACxE,gDAAgD;QAChD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACtD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC;;;;;GAKG;AACH,SAAS,aAAa,CAAC,MAAqB,EAAE,KAAe;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,iBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,EACvB,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAC,EACH,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,IAC1C,CAAC,KAAK,CAAC,MAAM,GAAG,sBAAsB;QACvC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,MAAM,EAAE;QAClC,CAAC,CAAC,EAAE,CAAC,EACP,CAAC;IAEH,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAElD,IAAI,KAAK,GAAG,kBAAkB,EAAE,CAAC;QAC/B,MAAM,eAAe,CACnB,8BAA8B,KAAK,mBAAmB;YACpD,GAAG,kBAAkB,mBAAmB,EAC1C,qEAAqE;YACnE,mEAAmE,CACtE,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,cAAc,GAClB,gGAAgG,CAAC;AAEnG;;;GAGG;AACH,SAAS,kBAAkB,CAAC,UAAkB;IAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAE3D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,iBAAiB,CACrB,kBAAkB,YAAY,KAC5B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,uEAAuE;YACrE,sBAAsB,CACzB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GACX,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAC3C,CAAC,CAAE,MAAgC,CAAC,OAAO;QAC3C,CAAC,CAAC,SAAS,CAAC;IAEhB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,MAAM,eAAe,CACnB,6BACE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,SACjD,kCAAkC,EAClC,oBAAoB,YAAY,oCAAoC;YAClE,+BAA+B,CAClC,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport type { StoredSession } from '../auth/credential-store';\nimport {\n  type AuthEnvironment,\n  refreshStoredSession,\n  requireSession,\n  resolveAuthEnvironment,\n} from '../auth/session';\nimport type { CliContext } from '../context';\nimport {\n  forbiddenError,\n  gateFailedError,\n  preconditionError,\n  validationError,\n} from '../errors';\nimport type { ExitCode } from '../exit-codes';\nimport { packProject } from '../pack';\nimport { type LoadedProject, loadProject, serializeProject } from '../project';\nimport {\n  MAX_MANIFEST_BYTES,\n  stillUnauthorized,\n  submitArchive,\n} from '../publish-api';\nimport { assertSchemaNotSkewed } from '../schema-skew';\nimport { fetchSeatsWithOneRefresh } from '../seats';\nimport { type SourceSeat, stillUnauthorizedSourceSeats } from '../sources-api';\nimport { announceUpdate, checkForUpdate } from '../update-notice';\nimport { collectAllFindings } from '../validate-findings';\n\nexport interface PublishArgs {\n  host?: string;\n  /** Fusion source slug. Falls back to ekanos.json's \"source\" field. */\n  source?: string;\n  /** Project directory (contains ekanos.json). Defaults to cwd. */\n  dir: string;\n  /**\n   * Skips the interactive confirm when the source resolved IMPLICITLY (from\n   * ekanos.json) and the caller holds more than one developer seat. Has no\n   * effect when `--source` was passed this invocation (explicit is already\n   * consent) or when the caller holds exactly one seat (nothing to\n   * disambiguate).\n   */\n  yes: boolean;\n  env: Record<string, string | undefined>;\n  /**\n   * Whether stdin is a real interactive terminal — the SECOND condition (with\n   * human/non-JSON mode) required before publish will ever prompt. Defaults\n   * to `process.stdin.isTTY === true`. Injectable so tests can exercise the\n   * confirm branch without a real TTY.\n   */\n  stdinIsTTY?: boolean;\n  /**\n   * Injectable y/N prompt, for tests. Defaults to a real readline prompt over\n   * stdin/stderr. Never invoked unless BOTH human mode and a real stdin TTY\n   * are in play — see `canPrompt` in `verifyPublishTarget`.\n   */\n  confirm?: (question: string) => Promise<boolean>;\n}\n\n/** Where the resolved source slug came from — governs the confirmation rules below. */\ninterface SourceResolution {\n  source: string;\n  /** True iff `--source` was passed THIS invocation. */\n  explicit: boolean;\n}\n\n/**\n * `publish` — pack the project and submit it to a Fusion deployment.\n *\n * The submission gate is the SAME findings pass `validate` runs (one\n * implementation, `validate-findings.ts`): any error-severity finding refuses\n * the publish with GATE_FAILED (exit 10) and the findings in `data`, so an\n * agent can branch on the code and fix-then-retry without re-running validate.\n *\n * Authorization is server-side — the dev seat on the target source — and the\n * stored session is refreshed once on a 401, mirroring `whoami`. On the first\n * successful publish the chosen source slug is persisted into `ekanos.json`\n * so later publishes need no `--source`.\n */\nexport async function runPublish(\n  ctx: CliContext,\n  args: PublishArgs,\n): Promise<ExitCode> {\n  const env = resolveAuthEnvironment(ctx, args.host, args.env, {\n    projectDir: args.dir,\n  });\n  const session = requireSession(env.store, env.host);\n\n  const loaded = loadProject(args.dir);\n\n  // Fail fast, before anything else: a project whose schema is newer than\n  // this CLI bundles cannot be trusted to validate correctly, so publishing\n  // it — the one verb whose findings gate is meant to be authoritative —\n  // must refuse before packing or submitting anything. See `schema-skew.ts`.\n  const skew = assertSchemaNotSkewed(ctx, loaded.projectDir);\n\n  const notice = await checkForUpdate({\n    env: args.env,\n    host: env.host,\n    session,\n  });\n  announceUpdate(ctx, notice);\n\n  // The host would reject a build from a CLI it has declared unsupported\n  // anyway (see the wire contract in `toolchain-api.ts`) — refuse here with a\n  // hint naming the fix, rather than let the submission round-trip fail with\n  // whatever generic error the host happens to answer with.\n  if (notice?.status === 'unsupported') {\n    throw preconditionError(\n      `@ekanos/cli ${notice.current.cli} is below ${env.host}'s minimum ` +\n        `supported version (needs at least ${notice.target.cli}).`,\n      'Run \"ekanos upgrade\" before publishing — the host will refuse this ' +\n        'submission from an unsupported CLI regardless.',\n    );\n  }\n\n  const resolution = await resolveSourceSlug(env, session, args.source, loaded);\n  const version = readProjectVersion(loaded.projectDir);\n  const slug = loaded.primary.slug;\n\n  ctx.log(`Validating ${slug} before publishing…`);\n\n  const findings = await collectAllFindings(loaded);\n  const errorCount = findings.filter((f) => f.severity === 'error').length;\n\n  if (errorCount > 0) {\n    return ctx.fail(\n      gateFailedError(\n        `Refusing to publish: ${errorCount} validation finding` +\n          `${errorCount === 1 ? '' : 's'}.`,\n        'Resolve the error-severity findings in data.findings (they are ' +\n          'exactly what \"ekanos validate\" reports), then re-run ' +\n          '\"ekanos publish\".',\n      ),\n      { slug, version, findings },\n    );\n  }\n\n  // The 100%-certainty mechanism: confirm the resolved source is one the\n  // caller actually holds a seat on — and, when it was resolved IMPLICITLY\n  // from ekanos.json with more than one seat in play, that a human (or an\n  // explicit --yes) actually intends this target — BEFORE anything is packed\n  // or sent over the wire.\n  const verified = await verifyPublishTarget(ctx, env, resolution.session, {\n    source: resolution.source,\n    explicit: resolution.explicit,\n    slug,\n    version,\n    yes: args.yes,\n    stdinIsTTY: args.stdinIsTTY ?? process.stdin.isTTY === true,\n    confirm: args.confirm ?? promptYesNo,\n  });\n\n  const source = verified.sourceSeat.slug;\n\n  ctx.log(`Packing ${slug}@${version}…`);\n\n  const packed = packProject(loaded.projectDir);\n  const manifest = buildManifest(loaded, packed.files);\n\n  ctx.log(`Submitting to ${env.host} (source \"${source}\")…`);\n\n  const receipt = await submitWithOneRefresh(env, verified.session, {\n    source,\n    slug,\n    version,\n    manifest,\n    archive: packed.archive,\n  });\n\n  const persisted = persistProjectFields(loaded, source, env.host);\n\n  const persistedNote = [\n    ...(persisted.source ? [`\"source\": \"${source}\"`] : []),\n    ...(persisted.host ? [`\"host\": \"${env.host}\"`] : []),\n  ];\n\n  const overrideNote = persisted.hostOverride\n    ? ` NOTE: this publish went to ${env.host}, but ekanos.json keeps ` +\n      `\"host\": \"${persisted.hostOverride}\" — a one-off override never ` +\n      `replaces the saved host; edit ekanos.json to change it.`\n    : '';\n\n  return ctx.succeed(\n    {\n      host: env.host,\n      source: {\n        id: verified.sourceSeat.id,\n        slug: verified.sourceSeat.slug,\n        name: verified.sourceSeat.name,\n      },\n      slug: receipt.slug,\n      version: receipt.version,\n      submissionId: receipt.submissionId,\n      state: receipt.state,\n      archiveSha256: receipt.archiveSha256,\n      files: packed.files,\n      sourcePersisted: persisted.source,\n      hostPersisted: persisted.host,\n      hostOverride: persisted.hostOverride,\n      ...(skew.status === 'project-older'\n        ? {\n            schemaSkew: {\n              status: skew.status,\n              cliSchemaVersion: skew.cliSchemaVersion,\n              projectSchemaVersion: skew.projectSchemaVersion,\n            },\n          }\n        : {}),\n      ...(notice ? { toolchain: notice } : {}),\n    },\n    `publish: submitted ${receipt.slug}@${receipt.version} to ${env.host} ` +\n      `(source \"${source}\", state \"${receipt.state}\").` +\n      (persistedNote.length > 0\n        ? ` Saved ${persistedNote.join(' and ')} to ekanos.json — future ` +\n          `publishes won't need the flag${persistedNote.length === 1 ? '' : 's'}.`\n        : '') +\n      overrideNote,\n  );\n}\n\n/**\n * The publish-target verification gate.\n *\n * FORBIDDEN (exit 5) whenever the resolved source is not among the caller's\n * seats — regardless of whether it came from `--source` or ekanos.json.\n * Beyond that, the confirmation rules branch on how the source was resolved:\n *\n *  - `--source` THIS invocation: explicit is consent. Proceed.\n *  - ekanos.json, exactly one seat held (which must be the match, or the\n *    FORBIDDEN check above would have already fired): proceed, but say so —\n *    there is nothing to disambiguate, but the target should never be silent.\n *  - ekanos.json, multiple seats held: the ambiguous case this mechanism\n *    exists for. Only when BOTH human (non-JSON) mode AND stdin is a real\n *    TTY does it print the target and require an explicit y/N confirm\n *    (`--yes` skips it) — see `canPrompt` below for why stdin matters, not\n *    just stdout. Every other combination (JSON mode, or human mode with a\n *    closed/non-interactive stdin) NEVER prompts — it proceeds only with\n *    `--yes`, otherwise VALIDATION (exit 3) with the seat list, naming\n *    `--source`, `--yes` and `ekanos use`.\n */\nasync function verifyPublishTarget(\n  ctx: CliContext,\n  env: AuthEnvironment,\n  session: StoredSession,\n  args: SourceResolution & {\n    slug: string;\n    version: string;\n    yes: boolean;\n    /** Real interactivity signal for stdin — see `canPrompt` below. */\n    stdinIsTTY: boolean;\n    confirm: (question: string) => Promise<boolean>;\n  },\n): Promise<{ sourceSeat: SourceSeat; session: StoredSession }> {\n  const result = await fetchSeatsWithOneRefresh(env, session);\n\n  if (result.status === 'unauthorized') {\n    stillUnauthorizedSourceSeats(env.host);\n  }\n\n  const seat = result.sources.find((s) => s.slug === args.source);\n\n  if (!seat) {\n    throw forbiddenError(\n      `This account does not hold a seat on source \"${args.source}\" on ${env.host}.`,\n      seatsHint(result.sources, env.host),\n    );\n  }\n\n  if (args.explicit) {\n    return { sourceSeat: seat, session: result.session };\n  }\n\n  if (result.sources.length === 1) {\n    ctx.log(\n      `Publishing to ${seat.name ?? seat.slug} (${seat.slug}) — your only ` +\n        `developer seat.`,\n    );\n    return { sourceSeat: seat, session: result.session };\n  }\n\n  // Implicit source, multiple seats: the ambiguous case.\n  //\n  // `ctx.jsonMode` alone is NOT enough to decide whether an interactive\n  // confirm is safe: `--no-json` forces human mode even when stdout is\n  // piped, and neither `--no-json` nor a bare human run says anything about\n  // stdin. Prompting `readline`'s `.question()` against a closed/non-TTY\n  // stdin (a cron job, a wrapper script piping stdout but not attached to a\n  // terminal) never resolves — the process hangs instead of exiting with a\n  // clean code. So an actual prompt requires BOTH: human mode AND a real\n  // stdin TTY. Anything else — JSON mode, or human mode with non-interactive\n  // stdin — falls through to the same non-prompting `--yes`-or-refuse rule.\n  const canPrompt = !ctx.jsonMode && args.stdinIsTTY;\n\n  if (canPrompt) {\n    ctx.log(\n      `Publishing ${args.slug}@${args.version} to SOURCE ${seat.name ?? seat.slug} ` +\n        `(${seat.slug}) on ${env.host}`,\n    );\n\n    if (!args.yes) {\n      const confirmed = await args.confirm('Proceed? [y/N]');\n\n      if (!confirmed) {\n        throw validationError(\n          `Publish to \"${seat.slug}\" was not confirmed.`,\n          multiSeatHint(result.sources),\n        );\n      }\n    }\n\n    return { sourceSeat: seat, session: result.session };\n  }\n\n  if (args.yes) {\n    return { sourceSeat: seat, session: result.session };\n  }\n\n  throw validationError(\n    `Ambiguous publish target: this account holds ${result.sources.length} ` +\n      `developer seats and the source was resolved from ekanos.json, not ` +\n      `an explicit flag.`,\n    multiSeatHint(result.sources),\n  );\n}\n\nfunction seatsHint(sources: SourceSeat[], host: string): string {\n  if (sources.length === 0) {\n    return (\n      `You hold no seats on any source on ${host}. Ask a Fusion super-admin ` +\n      `to grant your account the developer seat on the intended source.`\n    );\n  }\n\n  return (\n    `You hold a seat on: ${describeSeats(sources)}. Pass \"--source <slug>\" ` +\n    `naming one of these, or run \"ekanos use <slug>\" to set the project's ` +\n    `default.`\n  );\n}\n\nfunction multiSeatHint(sources: SourceSeat[]): string {\n  return (\n    `You hold seats on: ${describeSeats(sources)}. Pass \"--source <slug>\" ` +\n    `to name the target explicitly, add \"--yes\" to confirm the target ` +\n    `already in ekanos.json non-interactively, or run \"ekanos use <slug>\" ` +\n    `to change the project's default.`\n  );\n}\n\nfunction describeSeats(sources: SourceSeat[]): string {\n  return sources.map((s) => `${s.slug} (${s.roles.join(', ')})`).join(', ');\n}\n\n/**\n * The real, non-test y/N prompt. Reads a line from stdin and writes the\n * question to stderr, so it never touches stdout — the one stream the JSON\n * envelope invariant depends on. Only reachable when `verifyPublishTarget`'s\n * `canPrompt` is true — human mode AND a real stdin TTY — so this never\n * blocks on a closed or non-interactive stdin.\n */\n/**\n * Exported so `upgrade` can reuse the exact same y/N prompt rather than\n * writing a second one — see `canPrompt` above for the stdin-TTY gating this\n * is only ever invoked behind.\n */\nexport async function promptYesNo(question: string): Promise<boolean> {\n  const readline = await import('node:readline/promises');\n  const rl = readline.createInterface({\n    input: process.stdin,\n    output: process.stderr,\n  });\n\n  try {\n    const answer = await rl.question(`${question} `);\n    return /^y(es)?$/i.test(answer.trim());\n  } finally {\n    rl.close();\n  }\n}\n\nasync function submitWithOneRefresh(\n  env: ReturnType<typeof resolveAuthEnvironment>,\n  session: StoredSession,\n  payload: Parameters<typeof submitArchive>[2],\n) {\n  const first = await submitArchive(env.host, session.accessToken, payload);\n\n  if (first.status === 'ok') return first.receipt;\n\n  // The access token no longer authenticates — an ordinary event, not an\n  // error. One refresh, one retry; a second 401 is authoritative.\n  const refreshed = await refreshStoredSession(env, session);\n  const second = await submitArchive(env.host, refreshed.accessToken, payload);\n\n  if (second.status === 'ok') return second.receipt;\n\n  return stillUnauthorized(env.host);\n}\n\n/**\n * Resolve the source slug (flag → ekanos.json) and whether it was given\n * EXPLICITLY this invocation — the fact `verifyPublishTarget` uses to decide\n * whether a confirmation is even in play. `flag !== undefined` (rather than\n * \"non-empty after trim\") is deliberate: an explicit `--source` that is\n * effectively empty is still a caller who typed the flag, not one who\n * fell through to ekanos.json.\n */\nasync function resolveSourceSlug(\n  env: AuthEnvironment,\n  session: StoredSession,\n  flag: string | undefined,\n  loaded: LoadedProject,\n): Promise<SourceResolution & { session: StoredSession }> {\n  const explicit = flag !== undefined;\n  const raw = flag ?? loaded.project.source;\n\n  if (!raw || raw.trim().length === 0) {\n    return noSourceError(env, session);\n  }\n\n  return { source: raw.trim(), explicit, session };\n}\n\n/**\n * The no-source validation error, enriched with the caller's seat list when\n * it can be fetched — best-effort, since a session is guaranteed to exist\n * here (publish already called `requireSession`) but the fetch itself can\n * still fail (network, MFA, a down deployment). A failure to enrich must\n * never mask or replace the primary \"no source given\" error.\n */\nasync function noSourceError(\n  env: AuthEnvironment,\n  session: StoredSession,\n): Promise<never> {\n  let seatsNote = '';\n\n  try {\n    const result = await fetchSeatsWithOneRefresh(env, session);\n\n    if (result.status === 'ok') {\n      seatsNote =\n        result.sources.length > 0\n          ? ` You hold a seat on: ${describeSeats(result.sources)}.`\n          : ' You hold no seats on any source on this host yet.';\n    }\n  } catch {\n    // Best-effort — the primary error below stands on its own.\n  }\n\n  throw validationError(\n    'No Fusion source given for the submission.',\n    'Pass \"--source <slug>\" (your operator names the source), or set ' +\n      '\"source\": \"<slug>\" in ekanos.json. A successful publish saves it ' +\n      `there for you.${seatsNote}`,\n  );\n}\n\n/**\n * Persist the chosen source AND host into ekanos.json after a SUCCESSFUL\n * publish, so the next publish — and every other host-taking verb — needs no\n * flag. Returns what was written. A write failure is reported but never fails\n * the command — the submission already landed.\n *\n * `publish` is the only verb that writes ekanos.json: it is the one verb that\n * proves the (host, source) pair actually works, and it always runs inside a\n * project. `login` deliberately never writes — it is routinely run outside\n * one, and the credential store's sole-host fallback covers it.\n *\n * `host` persists on FIRST WRITE ONLY. It decides where every future verb\n * sends the bearer token and the source archive, so a one-off `--host`\n * override (a staging test, say) must not silently become the project's\n * sticky default; when the override differs from the stored host, the stored\n * value is kept and the difference is called out in the result instead.\n * Changing it is an explicit edit of ekanos.json. `source` keeps the simpler\n * always-update semantics — it is scoped BY the host, and updating it is the\n * documented way to repoint a project.\n */\nexport function persistProjectFields(\n  loaded: LoadedProject,\n  source: string,\n  host: string,\n): { source: boolean; host: boolean; hostOverride: string | null } {\n  const wants = {\n    source: loaded.project.source !== source,\n    host: loaded.project.host === undefined,\n  };\n\n  const hostOverride =\n    loaded.project.host !== undefined && loaded.project.host !== host\n      ? loaded.project.host\n      : null;\n\n  if (!wants.source && !wants.host) {\n    return { source: false, host: false, hostOverride };\n  }\n\n  try {\n    fs.writeFileSync(\n      loaded.configPath,\n      serializeProject({\n        ...loaded.project,\n        source,\n        host: wants.host ? host : loaded.project.host,\n      }),\n    );\n\n    return { ...wants, hostOverride };\n  } catch {\n    // Diagnostics-only: the publish succeeded; a read-only ekanos.json just\n    // means the next publish needs the flags again.\n    return { source: false, host: false, hostOverride };\n  }\n}\n\n/**\n * How many packed paths the manifest embeds before switching to a truncated\n * list plus a `filesTruncated` total. The manifest is metadata — the archive\n * itself is the payload — and the server caps it at MAX_MANIFEST_BYTES, so a\n * many-small-files project must not be able to blow the cap with its file\n * list alone.\n */\nconst MANIFEST_FILE_LIST_CAP = 200;\n\n/**\n * The submission manifest: the parsed ekanos.json, the integration entries,\n * and (a bounded prefix of) the packed file list. Refuses to build one over\n * the server's byte cap — a clear VALIDATION error here beats the server's\n * generic 400 after a 4 MiB upload.\n */\nfunction buildManifest(loaded: LoadedProject, files: string[]): string {\n  const manifest = JSON.stringify({\n    project: loaded.project,\n    integrations: loaded.integrations.map((i) => ({\n      slug: i.slug,\n      entry: i.entry,\n    })),\n    files: files.slice(0, MANIFEST_FILE_LIST_CAP),\n    ...(files.length > MANIFEST_FILE_LIST_CAP\n      ? { filesTruncated: files.length }\n      : {}),\n  });\n\n  const bytes = Buffer.byteLength(manifest, 'utf8');\n\n  if (bytes > MAX_MANIFEST_BYTES) {\n    throw validationError(\n      `The submission manifest is ${bytes} bytes, over the ` +\n        `${MAX_MANIFEST_BYTES}-byte server cap.`,\n      'The manifest embeds your ekanos.json — trim oversized fields there ' +\n        '(sourceGlobs is the usual culprit), then re-run \"ekanos publish\".',\n    );\n  }\n\n  return manifest;\n}\n\nconst SEMVER_PATTERN =\n  /^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$/;\n\n/**\n * The submitted version is the project's own `package.json#version` — one\n * source of truth, the same field npm would publish.\n */\nfunction readProjectVersion(projectDir: string): string {\n  const manifestPath = path.join(projectDir, 'package.json');\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));\n  } catch (error) {\n    throw preconditionError(\n      `Could not read ${manifestPath}: ${\n        error instanceof Error ? error.message : String(error)\n      }`,\n      `Ensure the project has a valid package.json — its \"version\" field is ` +\n        `what gets submitted.`,\n    );\n  }\n\n  const version =\n    typeof parsed === 'object' && parsed !== null\n      ? (parsed as { version?: unknown }).version\n      : undefined;\n\n  if (typeof version !== 'string' || !SEMVER_PATTERN.test(version)) {\n    throw validationError(\n      `package.json \"version\" is ${\n        typeof version === 'string' ? `\"${version}\"` : 'missing'\n      }, which is not a semver version.`,\n      `Set \"version\" in ${manifestPath} to a semver string like \"0.1.0\", ` +\n        `then re-run \"ekanos publish\".`,\n    );\n  }\n\n  return version;\n}\n"]}
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../src/commands/publish.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAEL,oBAAoB,EACpB,cAAc,EACd,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,eAAe,GAChB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAsB,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,GACd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,EAAmB,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAuC1D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAe,EACf,IAAiB;;IAEjB,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE;QAC3D,UAAU,EAAE,IAAI,CAAC,GAAG;KACrB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAErC,wEAAwE;IACxE,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAE3D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO;KACR,CAAC,CAAC;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE5B,uEAAuE;IACvE,4EAA4E;IAC5E,2EAA2E;IAC3E,0DAA0D;IAC1D,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,MAAK,aAAa,EAAE,CAAC;QACrC,MAAM,iBAAiB,CACrB,eAAe,MAAM,CAAC,OAAO,CAAC,GAAG,aAAa,GAAG,CAAC,IAAI,aAAa;YACjE,qCAAqC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,EAC5D,qEAAqE;YACnE,gDAAgD,CACnD,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;IAEjC,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,qBAAqB,CAAC,CAAC;IAEjD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IAEzE,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC,IAAI,CACb,eAAe,CACb,wBAAwB,UAAU,qBAAqB;YACrD,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,EACnC,iEAAiE;YAC/D,uDAAuD;YACvD,mBAAmB,CACtB,EACD,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAC5B,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,wEAAwE;IACxE,2EAA2E;IAC3E,yBAAyB;IACzB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,OAAO,EAAE;QACvE,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,IAAI;QACJ,OAAO;QACP,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,UAAU,EAAE,MAAA,IAAI,CAAC,UAAU,mCAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;QAC3D,OAAO,EAAE,MAAA,IAAI,CAAC,OAAO,mCAAI,WAAW;KACrC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;IAExC,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,OAAO,GAAG,CAAC,CAAC;IAEvC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAErD,GAAG,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC,IAAI,aAAa,MAAM,KAAK,CAAC,CAAC;IAE3D,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,EAAE;QAChE,MAAM;QACN,IAAI;QACJ,OAAO;QACP,QAAQ;QACR,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAEjE,MAAM,aAAa,GAAG;QACpB,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC;IAEF,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY;QACzC,CAAC,CAAC,+BAA+B,GAAG,CAAC,IAAI,0BAA0B;YACjE,YAAY,SAAS,CAAC,YAAY,+BAA+B;YACjE,yDAAyD;QAC3D,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO,GAAG,CAAC,OAAO,+BAEd,IAAI,EAAE,GAAG,CAAC,IAAI,EACd,MAAM,EAAE;YACN,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE;YAC1B,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI;YAC9B,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI;SAC/B,EACD,IAAI,EAAE,OAAO,CAAC,IAAI,EAClB,OAAO,EAAE,OAAO,CAAC,OAAO,EACxB,YAAY,EAAE,OAAO,CAAC,YAAY,EAClC,KAAK,EAAE,OAAO,CAAC,KAAK,EACpB,aAAa,EAAE,OAAO,CAAC,aAAa,EACpC,KAAK,EAAE,MAAM,CAAC,KAAK,EACnB,eAAe,EAAE,SAAS,CAAC,MAAM,EACjC,aAAa,EAAE,SAAS,CAAC,IAAI,EAC7B,YAAY,EAAE,SAAS,CAAC,YAAY,IACjC,CAAC,IAAI,CAAC,MAAM,KAAK,eAAe;QACjC,CAAC,CAAC;YACE,UAAU,EAAE;gBACV,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;aAChD;SACF;QACH,CAAC,CAAC,EAAE,CAAC,GACJ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAE1C,sBAAsB,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,OAAO,GAAG,CAAC,IAAI,GAAG;QACrE,YAAY,MAAM,aAAa,OAAO,CAAC,KAAK,KAAK;QACjD,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;YACvB,CAAC,CAAC,UAAU,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,2BAA2B;gBAChE,gCAAgC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;YAC1E,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,CACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,mBAAmB,CAChC,GAAe,EACf,GAAoB,EACpB,OAAsB,EACtB,IAOC;;IAED,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAE5D,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACrC,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;IAEhE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,cAAc,CAClB,gDAAgD,IAAI,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAI,GAAG,EAC9E,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CACpC,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,GAAG,CACL,iBAAiB,MAAA,IAAI,CAAC,IAAI,mCAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,gBAAgB;YACnE,iBAAiB,CACpB,CAAC;QACF,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACvD,CAAC;IAED,uDAAuD;IACvD,EAAE;IACF,sEAAsE;IACtE,qEAAqE;IACrE,0EAA0E;IAC1E,uEAAuE;IACvE,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC;IAEnD,IAAI,SAAS,EAAE,CAAC;QACd,GAAG,CAAC,GAAG,CACL,cAAc,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,cAAc,MAAA,IAAI,CAAC,IAAI,mCAAI,IAAI,CAAC,IAAI,GAAG;YAC5E,IAAI,IAAI,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,EAAE,CAClC,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAEvD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,eAAe,CACnB,eAAe,IAAI,CAAC,IAAI,sBAAsB,EAC9C,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAC9B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,eAAe,CACnB,gDAAgD,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG;QACtE,oEAAoE;QACpE,mBAAmB,EACrB,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,OAAqB,EAAE,IAAY;IACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CACL,sCAAsC,IAAI,6BAA6B;YACvE,kEAAkE,CACnE,CAAC;IACJ,CAAC;IAED,OAAO,CACL,uBAAuB,aAAa,CAAC,OAAO,CAAC,2BAA2B;QACxE,uEAAuE;QACvE,UAAU,CACX,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAAqB;IAC1C,OAAO,CACL,sBAAsB,aAAa,CAAC,OAAO,CAAC,2BAA2B;QACvE,mEAAmE;QACnE,uEAAuE;QACvE,kCAAkC,CACnC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAAqB;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB;IAChD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACxD,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;QAClC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;QACjD,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,GAA8C,EAC9C,OAAsB,EACtB,OAA4C;IAE5C,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAE1E,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IAEhD,uEAAuE;IACvE,gEAAgE;IAChE,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAE7E,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC;IAElD,OAAO,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB,CAC9B,GAAoB,EACpB,OAAsB,EACtB,IAAwB,EACxB,MAAqB;IAErB,MAAM,QAAQ,GAAG,IAAI,KAAK,SAAS,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;IAE1C,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,aAAa,CAC1B,GAAoB,EACpB,OAAsB;IAEtB,IAAI,SAAS,GAAG,EAAE,CAAC;IAEnB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAE5D,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC3B,SAAS;gBACP,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;oBACvB,CAAC,CAAC,wBAAwB,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG;oBAC1D,CAAC,CAAC,oDAAoD,CAAC;QAC7D,CAAC;IACH,CAAC;IAAC,WAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;IAED,MAAM,eAAe,CACnB,4CAA4C,EAC5C,kEAAkE;QAChE,mEAAmE;QACnE,iBAAiB,SAAS,EAAE,CAC/B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAqB,EACrB,MAAc,EACd,IAAY;IAEZ,MAAM,KAAK,GAAG;QACZ,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;QACxC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS;KACxC,CAAC;IAEF,MAAM,YAAY,GAChB,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI;QAC/D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI;QACrB,CAAC,CAAC,IAAI,CAAC;IAEX,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CACd,MAAM,CAAC,UAAU,EACjB,gBAAgB,iCACX,MAAM,CAAC,OAAO,KACjB,MAAM,EACN,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAC7C,CACH,CAAC;QAEF,uCAAY,KAAK,KAAE,YAAY,IAAG;IACpC,CAAC;IAAC,WAAM,CAAC;QACP,wEAAwE;QACxE,gDAAgD;QAChD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACtD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC;;;;;GAKG;AACH,SAAS,aAAa,CAAC,MAAqB,EAAE,KAAe;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,iBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,EACvB,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAC,EACH,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,IAC1C,CAAC,KAAK,CAAC,MAAM,GAAG,sBAAsB;QACvC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,MAAM,EAAE;QAClC,CAAC,CAAC,EAAE,CAAC,EACP,CAAC;IAEH,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAElD,IAAI,KAAK,GAAG,kBAAkB,EAAE,CAAC;QAC/B,MAAM,eAAe,CACnB,8BAA8B,KAAK,mBAAmB;YACpD,GAAG,kBAAkB,mBAAmB,EAC1C,qEAAqE;YACnE,mEAAmE,CACtE,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,cAAc,GAClB,gGAAgG,CAAC;AAEnG;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAE3D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,iBAAiB,CACrB,kBAAkB,YAAY,KAC5B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,uEAAuE;YACrE,sBAAsB,CACzB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GACX,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAC3C,CAAC,CAAE,MAAgC,CAAC,OAAO;QAC3C,CAAC,CAAC,SAAS,CAAC;IAEhB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,MAAM,eAAe,CACnB,6BACE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,SACjD,kCAAkC,EAClC,oBAAoB,YAAY,oCAAoC;YAClE,+BAA+B,CAClC,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport type { StoredSession } from '../auth/credential-store';\nimport {\n  type AuthEnvironment,\n  refreshStoredSession,\n  requireSession,\n  resolveAuthEnvironment,\n} from '../auth/session';\nimport type { CliContext } from '../context';\nimport {\n  forbiddenError,\n  gateFailedError,\n  preconditionError,\n  validationError,\n} from '../errors';\nimport type { ExitCode } from '../exit-codes';\nimport { packProject } from '../pack';\nimport { type LoadedProject, loadProject, serializeProject } from '../project';\nimport {\n  MAX_MANIFEST_BYTES,\n  stillUnauthorized,\n  submitArchive,\n} from '../publish-api';\nimport { assertSchemaNotSkewed } from '../schema-skew';\nimport { fetchSeatsWithOneRefresh } from '../seats';\nimport { type SourceSeat, stillUnauthorizedSourceSeats } from '../sources-api';\nimport { announceUpdate, checkForUpdate } from '../update-notice';\nimport { collectAllFindings } from '../validate-findings';\n\nexport interface PublishArgs {\n  host?: string;\n  /** Fusion source slug. Falls back to ekanos.json's \"source\" field. */\n  source?: string;\n  /** Project directory (contains ekanos.json). Defaults to cwd. */\n  dir: string;\n  /**\n   * Skips the interactive confirm when the source resolved IMPLICITLY (from\n   * ekanos.json) and the caller holds more than one developer seat. Has no\n   * effect when `--source` was passed this invocation (explicit is already\n   * consent) or when the caller holds exactly one seat (nothing to\n   * disambiguate).\n   */\n  yes: boolean;\n  env: Record<string, string | undefined>;\n  /**\n   * Whether stdin is a real interactive terminal — the SECOND condition (with\n   * human/non-JSON mode) required before publish will ever prompt. Defaults\n   * to `process.stdin.isTTY === true`. Injectable so tests can exercise the\n   * confirm branch without a real TTY.\n   */\n  stdinIsTTY?: boolean;\n  /**\n   * Injectable y/N prompt, for tests. Defaults to a real readline prompt over\n   * stdin/stderr. Never invoked unless BOTH human mode and a real stdin TTY\n   * are in play — see `canPrompt` in `verifyPublishTarget`.\n   */\n  confirm?: (question: string) => Promise<boolean>;\n}\n\n/** Where the resolved source slug came from — governs the confirmation rules below. */\ninterface SourceResolution {\n  source: string;\n  /** True iff `--source` was passed THIS invocation. */\n  explicit: boolean;\n}\n\n/**\n * `publish` — pack the project and submit it to a Fusion deployment.\n *\n * The submission gate is the SAME findings pass `validate` runs (one\n * implementation, `validate-findings.ts`): any error-severity finding refuses\n * the publish with GATE_FAILED (exit 10) and the findings in `data`, so an\n * agent can branch on the code and fix-then-retry without re-running validate.\n *\n * Authorization is server-side — the dev seat on the target source — and the\n * stored session is refreshed once on a 401, mirroring `whoami`. On the first\n * successful publish the chosen source slug is persisted into `ekanos.json`\n * so later publishes need no `--source`.\n */\nexport async function runPublish(\n  ctx: CliContext,\n  args: PublishArgs,\n): Promise<ExitCode> {\n  const env = resolveAuthEnvironment(ctx, args.host, args.env, {\n    projectDir: args.dir,\n  });\n  const session = requireSession(env.store, env.host);\n\n  const loaded = loadProject(args.dir);\n\n  // Fail fast, before anything else: a project whose schema is newer than\n  // this CLI bundles cannot be trusted to validate correctly, so publishing\n  // it — the one verb whose findings gate is meant to be authoritative —\n  // must refuse before packing or submitting anything. See `schema-skew.ts`.\n  const skew = assertSchemaNotSkewed(ctx, loaded.projectDir);\n\n  const notice = await checkForUpdate({\n    env: args.env,\n    host: env.host,\n    session,\n  });\n  announceUpdate(ctx, notice);\n\n  // The host would reject a build from a CLI it has declared unsupported\n  // anyway (see the wire contract in `toolchain-api.ts`) — refuse here with a\n  // hint naming the fix, rather than let the submission round-trip fail with\n  // whatever generic error the host happens to answer with.\n  if (notice?.status === 'unsupported') {\n    throw preconditionError(\n      `@ekanos/cli ${notice.current.cli} is below ${env.host}'s minimum ` +\n        `supported version (needs at least ${notice.target.cli}).`,\n      'Run \"ekanos upgrade\" before publishing — the host will refuse this ' +\n        'submission from an unsupported CLI regardless.',\n    );\n  }\n\n  const resolution = await resolveSourceSlug(env, session, args.source, loaded);\n  const version = readProjectVersion(loaded.projectDir);\n  const slug = loaded.primary.slug;\n\n  ctx.log(`Validating ${slug} before publishing…`);\n\n  const findings = await collectAllFindings(loaded);\n  const errorCount = findings.filter((f) => f.severity === 'error').length;\n\n  if (errorCount > 0) {\n    return ctx.fail(\n      gateFailedError(\n        `Refusing to publish: ${errorCount} validation finding` +\n          `${errorCount === 1 ? '' : 's'}.`,\n        'Resolve the error-severity findings in data.findings (they are ' +\n          'exactly what \"ekanos validate\" reports), then re-run ' +\n          '\"ekanos publish\".',\n      ),\n      { slug, version, findings },\n    );\n  }\n\n  // The 100%-certainty mechanism: confirm the resolved source is one the\n  // caller actually holds a seat on — and, when it was resolved IMPLICITLY\n  // from ekanos.json with more than one seat in play, that a human (or an\n  // explicit --yes) actually intends this target — BEFORE anything is packed\n  // or sent over the wire.\n  const verified = await verifyPublishTarget(ctx, env, resolution.session, {\n    source: resolution.source,\n    explicit: resolution.explicit,\n    slug,\n    version,\n    yes: args.yes,\n    stdinIsTTY: args.stdinIsTTY ?? process.stdin.isTTY === true,\n    confirm: args.confirm ?? promptYesNo,\n  });\n\n  const source = verified.sourceSeat.slug;\n\n  ctx.log(`Packing ${slug}@${version}…`);\n\n  const packed = packProject(loaded.projectDir);\n  const manifest = buildManifest(loaded, packed.files);\n\n  ctx.log(`Submitting to ${env.host} (source \"${source}\")…`);\n\n  const receipt = await submitWithOneRefresh(env, verified.session, {\n    source,\n    slug,\n    version,\n    manifest,\n    archive: packed.archive,\n  });\n\n  const persisted = persistProjectFields(loaded, source, env.host);\n\n  const persistedNote = [\n    ...(persisted.source ? [`\"source\": \"${source}\"`] : []),\n    ...(persisted.host ? [`\"host\": \"${env.host}\"`] : []),\n  ];\n\n  const overrideNote = persisted.hostOverride\n    ? ` NOTE: this publish went to ${env.host}, but ekanos.json keeps ` +\n      `\"host\": \"${persisted.hostOverride}\" — a one-off override never ` +\n      `replaces the saved host; edit ekanos.json to change it.`\n    : '';\n\n  return ctx.succeed(\n    {\n      host: env.host,\n      source: {\n        id: verified.sourceSeat.id,\n        slug: verified.sourceSeat.slug,\n        name: verified.sourceSeat.name,\n      },\n      slug: receipt.slug,\n      version: receipt.version,\n      submissionId: receipt.submissionId,\n      state: receipt.state,\n      archiveSha256: receipt.archiveSha256,\n      files: packed.files,\n      sourcePersisted: persisted.source,\n      hostPersisted: persisted.host,\n      hostOverride: persisted.hostOverride,\n      ...(skew.status === 'project-older'\n        ? {\n            schemaSkew: {\n              status: skew.status,\n              cliSchemaVersion: skew.cliSchemaVersion,\n              projectSchemaVersion: skew.projectSchemaVersion,\n            },\n          }\n        : {}),\n      ...(notice ? { toolchain: notice } : {}),\n    },\n    `publish: submitted ${receipt.slug}@${receipt.version} to ${env.host} ` +\n      `(source \"${source}\", state \"${receipt.state}\").` +\n      (persistedNote.length > 0\n        ? ` Saved ${persistedNote.join(' and ')} to ekanos.json — future ` +\n          `publishes won't need the flag${persistedNote.length === 1 ? '' : 's'}.`\n        : '') +\n      overrideNote,\n  );\n}\n\n/**\n * The publish-target verification gate.\n *\n * FORBIDDEN (exit 5) whenever the resolved source is not among the caller's\n * seats — regardless of whether it came from `--source` or ekanos.json.\n * Beyond that, the confirmation rules branch on how the source was resolved:\n *\n *  - `--source` THIS invocation: explicit is consent. Proceed.\n *  - ekanos.json, exactly one seat held (which must be the match, or the\n *    FORBIDDEN check above would have already fired): proceed, but say so —\n *    there is nothing to disambiguate, but the target should never be silent.\n *  - ekanos.json, multiple seats held: the ambiguous case this mechanism\n *    exists for. Only when BOTH human (non-JSON) mode AND stdin is a real\n *    TTY does it print the target and require an explicit y/N confirm\n *    (`--yes` skips it) — see `canPrompt` below for why stdin matters, not\n *    just stdout. Every other combination (JSON mode, or human mode with a\n *    closed/non-interactive stdin) NEVER prompts — it proceeds only with\n *    `--yes`, otherwise VALIDATION (exit 3) with the seat list, naming\n *    `--source`, `--yes` and `ekanos use`.\n */\nasync function verifyPublishTarget(\n  ctx: CliContext,\n  env: AuthEnvironment,\n  session: StoredSession,\n  args: SourceResolution & {\n    slug: string;\n    version: string;\n    yes: boolean;\n    /** Real interactivity signal for stdin — see `canPrompt` below. */\n    stdinIsTTY: boolean;\n    confirm: (question: string) => Promise<boolean>;\n  },\n): Promise<{ sourceSeat: SourceSeat; session: StoredSession }> {\n  const result = await fetchSeatsWithOneRefresh(env, session);\n\n  if (result.status === 'unauthorized') {\n    stillUnauthorizedSourceSeats(env.host);\n  }\n\n  const seat = result.sources.find((s) => s.slug === args.source);\n\n  if (!seat) {\n    throw forbiddenError(\n      `This account does not hold a seat on source \"${args.source}\" on ${env.host}.`,\n      seatsHint(result.sources, env.host),\n    );\n  }\n\n  if (args.explicit) {\n    return { sourceSeat: seat, session: result.session };\n  }\n\n  if (result.sources.length === 1) {\n    ctx.log(\n      `Publishing to ${seat.name ?? seat.slug} (${seat.slug}) — your only ` +\n        `developer seat.`,\n    );\n    return { sourceSeat: seat, session: result.session };\n  }\n\n  // Implicit source, multiple seats: the ambiguous case.\n  //\n  // `ctx.jsonMode` alone is NOT enough to decide whether an interactive\n  // confirm is safe: `--no-json` forces human mode even when stdout is\n  // piped, and neither `--no-json` nor a bare human run says anything about\n  // stdin. Prompting `readline`'s `.question()` against a closed/non-TTY\n  // stdin (a cron job, a wrapper script piping stdout but not attached to a\n  // terminal) never resolves — the process hangs instead of exiting with a\n  // clean code. So an actual prompt requires BOTH: human mode AND a real\n  // stdin TTY. Anything else — JSON mode, or human mode with non-interactive\n  // stdin — falls through to the same non-prompting `--yes`-or-refuse rule.\n  const canPrompt = !ctx.jsonMode && args.stdinIsTTY;\n\n  if (canPrompt) {\n    ctx.log(\n      `Publishing ${args.slug}@${args.version} to SOURCE ${seat.name ?? seat.slug} ` +\n        `(${seat.slug}) on ${env.host}`,\n    );\n\n    if (!args.yes) {\n      const confirmed = await args.confirm('Proceed? [y/N]');\n\n      if (!confirmed) {\n        throw validationError(\n          `Publish to \"${seat.slug}\" was not confirmed.`,\n          multiSeatHint(result.sources),\n        );\n      }\n    }\n\n    return { sourceSeat: seat, session: result.session };\n  }\n\n  if (args.yes) {\n    return { sourceSeat: seat, session: result.session };\n  }\n\n  throw validationError(\n    `Ambiguous publish target: this account holds ${result.sources.length} ` +\n      `developer seats and the source was resolved from ekanos.json, not ` +\n      `an explicit flag.`,\n    multiSeatHint(result.sources),\n  );\n}\n\nfunction seatsHint(sources: SourceSeat[], host: string): string {\n  if (sources.length === 0) {\n    return (\n      `You hold no seats on any source on ${host}. Ask a Fusion super-admin ` +\n      `to grant your account the developer seat on the intended source.`\n    );\n  }\n\n  return (\n    `You hold a seat on: ${describeSeats(sources)}. Pass \"--source <slug>\" ` +\n    `naming one of these, or run \"ekanos use <slug>\" to set the project's ` +\n    `default.`\n  );\n}\n\nfunction multiSeatHint(sources: SourceSeat[]): string {\n  return (\n    `You hold seats on: ${describeSeats(sources)}. Pass \"--source <slug>\" ` +\n    `to name the target explicitly, add \"--yes\" to confirm the target ` +\n    `already in ekanos.json non-interactively, or run \"ekanos use <slug>\" ` +\n    `to change the project's default.`\n  );\n}\n\nfunction describeSeats(sources: SourceSeat[]): string {\n  return sources.map((s) => `${s.slug} (${s.roles.join(', ')})`).join(', ');\n}\n\n/**\n * The real, non-test y/N prompt. Reads a line from stdin and writes the\n * question to stderr, so it never touches stdout — the one stream the JSON\n * envelope invariant depends on. Only reachable when `verifyPublishTarget`'s\n * `canPrompt` is true — human mode AND a real stdin TTY — so this never\n * blocks on a closed or non-interactive stdin.\n */\n/**\n * Exported so `upgrade` can reuse the exact same y/N prompt rather than\n * writing a second one — see `canPrompt` above for the stdin-TTY gating this\n * is only ever invoked behind.\n */\nexport async function promptYesNo(question: string): Promise<boolean> {\n  const readline = await import('node:readline/promises');\n  const rl = readline.createInterface({\n    input: process.stdin,\n    output: process.stderr,\n  });\n\n  try {\n    const answer = await rl.question(`${question} `);\n    return /^y(es)?$/i.test(answer.trim());\n  } finally {\n    rl.close();\n  }\n}\n\nasync function submitWithOneRefresh(\n  env: ReturnType<typeof resolveAuthEnvironment>,\n  session: StoredSession,\n  payload: Parameters<typeof submitArchive>[2],\n) {\n  const first = await submitArchive(env.host, session.accessToken, payload);\n\n  if (first.status === 'ok') return first.receipt;\n\n  // The access token no longer authenticates — an ordinary event, not an\n  // error. One refresh, one retry; a second 401 is authoritative.\n  const refreshed = await refreshStoredSession(env, session);\n  const second = await submitArchive(env.host, refreshed.accessToken, payload);\n\n  if (second.status === 'ok') return second.receipt;\n\n  return stillUnauthorized(env.host);\n}\n\n/**\n * Resolve the source slug (flag → ekanos.json) and whether it was given\n * EXPLICITLY this invocation — the fact `verifyPublishTarget` uses to decide\n * whether a confirmation is even in play. `flag !== undefined` (rather than\n * \"non-empty after trim\") is deliberate: an explicit `--source` that is\n * effectively empty is still a caller who typed the flag, not one who\n * fell through to ekanos.json.\n */\nasync function resolveSourceSlug(\n  env: AuthEnvironment,\n  session: StoredSession,\n  flag: string | undefined,\n  loaded: LoadedProject,\n): Promise<SourceResolution & { session: StoredSession }> {\n  const explicit = flag !== undefined;\n  const raw = flag ?? loaded.project.source;\n\n  if (!raw || raw.trim().length === 0) {\n    return noSourceError(env, session);\n  }\n\n  return { source: raw.trim(), explicit, session };\n}\n\n/**\n * The no-source validation error, enriched with the caller's seat list when\n * it can be fetched — best-effort, since a session is guaranteed to exist\n * here (publish already called `requireSession`) but the fetch itself can\n * still fail (network, MFA, a down deployment). A failure to enrich must\n * never mask or replace the primary \"no source given\" error.\n */\nasync function noSourceError(\n  env: AuthEnvironment,\n  session: StoredSession,\n): Promise<never> {\n  let seatsNote = '';\n\n  try {\n    const result = await fetchSeatsWithOneRefresh(env, session);\n\n    if (result.status === 'ok') {\n      seatsNote =\n        result.sources.length > 0\n          ? ` You hold a seat on: ${describeSeats(result.sources)}.`\n          : ' You hold no seats on any source on this host yet.';\n    }\n  } catch {\n    // Best-effort — the primary error below stands on its own.\n  }\n\n  throw validationError(\n    'No Fusion source given for the submission.',\n    'Pass \"--source <slug>\" (your operator names the source), or set ' +\n      '\"source\": \"<slug>\" in ekanos.json. A successful publish saves it ' +\n      `there for you.${seatsNote}`,\n  );\n}\n\n/**\n * Persist the chosen source AND host into ekanos.json after a SUCCESSFUL\n * publish, so the next publish — and every other host-taking verb — needs no\n * flag. Returns what was written. A write failure is reported but never fails\n * the command — the submission already landed.\n *\n * `publish` is the only verb that writes ekanos.json: it is the one verb that\n * proves the (host, source) pair actually works, and it always runs inside a\n * project. `login` deliberately never writes — it is routinely run outside\n * one, and the credential store's sole-host fallback covers it.\n *\n * `host` persists on FIRST WRITE ONLY. It decides where every future verb\n * sends the bearer token and the source archive, so a one-off `--host`\n * override (a staging test, say) must not silently become the project's\n * sticky default; when the override differs from the stored host, the stored\n * value is kept and the difference is called out in the result instead.\n * Changing it is an explicit edit of ekanos.json. `source` keeps the simpler\n * always-update semantics — it is scoped BY the host, and updating it is the\n * documented way to repoint a project.\n */\nexport function persistProjectFields(\n  loaded: LoadedProject,\n  source: string,\n  host: string,\n): { source: boolean; host: boolean; hostOverride: string | null } {\n  const wants = {\n    source: loaded.project.source !== source,\n    host: loaded.project.host === undefined,\n  };\n\n  const hostOverride =\n    loaded.project.host !== undefined && loaded.project.host !== host\n      ? loaded.project.host\n      : null;\n\n  if (!wants.source && !wants.host) {\n    return { source: false, host: false, hostOverride };\n  }\n\n  try {\n    fs.writeFileSync(\n      loaded.configPath,\n      serializeProject({\n        ...loaded.project,\n        source,\n        host: wants.host ? host : loaded.project.host,\n      }),\n    );\n\n    return { ...wants, hostOverride };\n  } catch {\n    // Diagnostics-only: the publish succeeded; a read-only ekanos.json just\n    // means the next publish needs the flags again.\n    return { source: false, host: false, hostOverride };\n  }\n}\n\n/**\n * How many packed paths the manifest embeds before switching to a truncated\n * list plus a `filesTruncated` total. The manifest is metadata — the archive\n * itself is the payload — and the server caps it at MAX_MANIFEST_BYTES, so a\n * many-small-files project must not be able to blow the cap with its file\n * list alone.\n */\nconst MANIFEST_FILE_LIST_CAP = 200;\n\n/**\n * The submission manifest: the parsed ekanos.json, the integration entries,\n * and (a bounded prefix of) the packed file list. Refuses to build one over\n * the server's byte cap — a clear VALIDATION error here beats the server's\n * generic 400 after a 4 MiB upload.\n */\nfunction buildManifest(loaded: LoadedProject, files: string[]): string {\n  const manifest = JSON.stringify({\n    project: loaded.project,\n    integrations: loaded.integrations.map((i) => ({\n      slug: i.slug,\n      entry: i.entry,\n    })),\n    files: files.slice(0, MANIFEST_FILE_LIST_CAP),\n    ...(files.length > MANIFEST_FILE_LIST_CAP\n      ? { filesTruncated: files.length }\n      : {}),\n  });\n\n  const bytes = Buffer.byteLength(manifest, 'utf8');\n\n  if (bytes > MAX_MANIFEST_BYTES) {\n    throw validationError(\n      `The submission manifest is ${bytes} bytes, over the ` +\n        `${MAX_MANIFEST_BYTES}-byte server cap.`,\n      'The manifest embeds your ekanos.json — trim oversized fields there ' +\n        '(sourceGlobs is the usual culprit), then re-run \"ekanos publish\".',\n    );\n  }\n\n  return manifest;\n}\n\nconst SEMVER_PATTERN =\n  /^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$/;\n\n/**\n * The submitted version is the project's own `package.json#version` — one\n * source of truth, the same field npm would publish.\n */\nexport function readProjectVersion(projectDir: string): string {\n  const manifestPath = path.join(projectDir, 'package.json');\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));\n  } catch (error) {\n    throw preconditionError(\n      `Could not read ${manifestPath}: ${\n        error instanceof Error ? error.message : String(error)\n      }`,\n      `Ensure the project has a valid package.json — its \"version\" field is ` +\n        `what gets submitted.`,\n    );\n  }\n\n  const version =\n    typeof parsed === 'object' && parsed !== null\n      ? (parsed as { version?: unknown }).version\n      : undefined;\n\n  if (typeof version !== 'string' || !SEMVER_PATTERN.test(version)) {\n    throw validationError(\n      `package.json \"version\" is ${\n        typeof version === 'string' ? `\"${version}\"` : 'missing'\n      }, which is not a semver version.`,\n      `Set \"version\" in ${manifestPath} to a semver string like \"0.1.0\", ` +\n        `then re-run \"ekanos publish\".`,\n    );\n  }\n\n  return version;\n}\n"]}

package/dist/commands/status.d.ts

@@ -5,6 +5,16 @@ export interface StatusArgs {
     /** Project directory (may contain ekanos.json). Defaults to cwd. */
     dir: string;
     env: Record<string, string | undefined>;
+    /** Render each version's full finding list, not just error/warn counts. */
+    findings?: boolean;
+    /**
+     * Block until this project's current (slug, version) submission reaches a
+     * terminal-for-waiting state (gated, dev, rejected), polling every 30s.
+     * Changes the command's exit-code contract — see `runStatus`'s docstring.
+     */
+    watch?: boolean;
+    /** Injectable for tests — see `auth/device-flow.ts`'s identical pattern. */
+    sleep?: (ms: number) => Promise<void>;
 }
 /**
  * `status` — the read verb: where am I pointed, who am I, and what has this
@@ -23,6 +33,22 @@ export interface StatusArgs {
  *    Server errors here DO map through the taxonomy: an unreachable host or a
  *    missing source is a fault to surface, not a state to absorb.
  *
- * Exit 0 whenever the report itself could be assembled.
+ * Exit 0 whenever the report itself could be assembled — EXCEPT under
+ * `--watch` (see below), whose exit code carries the gate's verdict instead.
+ *
+ * `--findings` requests each version's full finding list (`?detail=findings`
+ * server-side) instead of just error/warn counts.
+ *
+ * `--watch` turns `status` into a blocking wait: it requires a project with
+ * a resolved source and a live session (both are PRECONDITIONs here, not
+ * degraded-to-false states — there is nothing to watch without them), then
+ * polls `GET /api/partner/submissions?detail=findings` every 30s for THIS
+ * project's current (slug, package.json version) submission until it reaches
+ * a terminal-for-waiting state: `gated`/`dev` exit 0, `rejected` exits 10
+ * (GATE_FAILED) with the findings carried in `data` — the same shape
+ * `publish`'s own gate refusal uses, so an agent's fix-then-retry loop
+ * branches on it identically whether the gate ran inline (future) or via
+ * this poll (today). `--json --watch` still emits exactly ONE envelope, at
+ * completion — the polling itself only ever writes to stderr via `ctx.log`.
  */
 export declare function runStatus(ctx: CliContext, args: StatusArgs): Promise<ExitCode>;

package/dist/commands/status.js

@@ -1,11 +1,20 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { refreshStoredSession, resolveAuthEnvironment, resolveIdentity, } from '../auth/session.js';
-import { CliError, authRequiredError } from '../errors.js';
+import { CliError, authRequiredError, gateFailedError, preconditionError, } from '../errors.js';
 import { ERROR_CODES } from '../exit-codes.js';
 import { EKANOS_CONFIG_FILENAME, loadProject } from '../project.js';
-import { listSubmissions } from '../publish-api.js';
+import { listSubmissions, } from '../publish-api.js';
 import { announceUpdate, checkForUpdate } from '../update-notice.js';
+import { readProjectVersion } from './publish.js';
+/** `--watch`'s poll interval — matches the mission brief exactly. */
+const WATCH_POLL_INTERVAL_MS = 30000;
+/**
+ * The states `--watch` stops on. `submitted` is the only non-terminal state
+ * a version can be in when watching starts (an already-`gated`/`dev`/
+ * `rejected` version resolves on the very first check, no polling needed).
+ */
+const WATCH_TERMINAL_STATES = new Set(['gated', 'dev', 'rejected']);
 /**
  * `status` — the read verb: where am I pointed, who am I, and what has this
  * project submitted?
@@ -23,10 +32,26 @@ import { announceUpdate, checkForUpdate } from '../update-notice.js';
  *    Server errors here DO map through the taxonomy: an unreachable host or a
  *    missing source is a fault to surface, not a state to absorb.
  *
- * Exit 0 whenever the report itself could be assembled.
+ * Exit 0 whenever the report itself could be assembled — EXCEPT under
+ * `--watch` (see below), whose exit code carries the gate's verdict instead.
+ *
+ * `--findings` requests each version's full finding list (`?detail=findings`
+ * server-side) instead of just error/warn counts.
+ *
+ * `--watch` turns `status` into a blocking wait: it requires a project with
+ * a resolved source and a live session (both are PRECONDITIONs here, not
+ * degraded-to-false states — there is nothing to watch without them), then
+ * polls `GET /api/partner/submissions?detail=findings` every 30s for THIS
+ * project's current (slug, package.json version) submission until it reaches
+ * a terminal-for-waiting state: `gated`/`dev` exit 0, `rejected` exits 10
+ * (GATE_FAILED) with the findings carried in `data` — the same shape
+ * `publish`'s own gate refusal uses, so an agent's fix-then-retry loop
+ * branches on it identically whether the gate ran inline (future) or via
+ * this poll (today). `--json --watch` still emits exactly ONE envelope, at
+ * completion — the polling itself only ever writes to stderr via `ctx.log`.
  */
 export async function runStatus(ctx, args) {
-    var _a, _b;
+    var _a, _b, _c;
     const env = resolveAuthEnvironment(ctx, args.host, args.env, {
         projectDir: args.dir,
     });
@@ -51,9 +76,23 @@ export async function runStatus(ctx, args) {
     // never to produce.
     const live = stored ? ((_a = env.store.read(env.host)) !== null && _a !== void 0 ? _a : stored) : null;
     const project = readProjectReport(args.dir);
+    const detail = args.findings || args.watch ? 'findings' : undefined;
+    if (args.watch) {
+        if (!session.authenticated || !live) {
+            throw authRequiredError(`"ekanos status --watch" needs a live session on ${env.host}.`, `Run "ekanos login --host ${env.host}" and retry.`);
+        }
+        if (!project) {
+            throw preconditionError(`No ekanos.json found in ${path.resolve(args.dir)}.`, 'Run "ekanos publish" at least once before watching its gate result.');
+        }
+        if (!project.source) {
+            throw preconditionError('This project has no "source" in ekanos.json yet.', 'Run "ekanos publish" at least once (it saves the source you ' +
+                'publish to) before watching its gate result.');
+        }
+        return runWatch(ctx, env, project, args);
+    }
     let submissions = null;
     if ((project === null || project === void 0 ? void 0 : project.source) && session.authenticated && live) {
-        submissions = await listWithOneRefresh(env, live, project.source);
+        submissions = await listWithOneRefresh(env, live, project.source, detail);
     }
     else if ((project === null || project === void 0 ? void 0 : project.source) && !session.authenticated) {
         ctx.log(`ekanos: not logged in to ${env.host} — skipping the submission list. ` +
@@ -65,7 +104,81 @@ export async function runStatus(ctx, args) {
             'submissions from then on.');
     }
     return ctx.succeed(Object.assign(Object.assign(Object.assign({ host: env.host }, session), { credentialsPath: env.store.filePath, project,
-        submissions }), (notice ? { toolchain: notice } : {})), humanSummary(env.host, session, project, submissions));
+        submissions }), (notice ? { toolchain: notice } : {})), humanSummary(env.host, session, project, submissions, (_c = args.findings) !== null && _c !== void 0 ? _c : false));
+}
+/**
+ * The `--watch` poll loop. Targets THIS project's current submission —
+ * `project.slug` + the version presently in `package.json` (the same value
+ * `publish` would submit right now) — not "whatever's most recent," so
+ * watching after a publish can never resolve against a stale prior version.
+ */
+async function runWatch(ctx, env, project, args) {
+    var _a;
+    const source = project.source;
+    if (!source) {
+        // Unreachable — the caller already checked — but keeps this function's
+        // own type honest without a non-null assertion.
+        throw preconditionError('This project has no "source" in ekanos.json yet.', 'Run "ekanos publish" at least once before watching its gate result.');
+    }
+    const targetVersion = readProjectVersion(project.dir);
+    const sleep = (_a = args.sleep) !== null && _a !== void 0 ? _a : defaultSleep;
+    ctx.log(`ekanos: watching ${project.slug}@${targetVersion} on ${env.host} ` +
+        `(polling every ${WATCH_POLL_INTERVAL_MS / 1000}s)…`);
+    for (;;) {
+        // Re-read the session from the credential store on EVERY iteration —
+        // never carry one over in a closure. Auth0 rotates the refresh token on
+        // every use (see `refreshStoredSession`'s docstring), so a token this
+        // loop already consumed is dead by the next iteration; the store is the
+        // persisted source of truth for whichever refresh most recently landed
+        // — this loop's own (via `listWithOneRefresh` below, which persists
+        // through `refreshStoredSession`), or a concurrent one from another
+        // process (another terminal running login/publish/status --watch
+        // against the same host). Threading the refreshed session back out of
+        // `listWithOneRefresh` instead would only cover the first case.
+        const current = env.store.read(env.host);
+        if (!current) {
+            throw authRequiredError(`The session for ${env.host} is gone — "ekanos status --watch" ` +
+                'cannot continue without it.', `Run "ekanos login --host ${env.host}" and retry.`);
+        }
+        const integrations = await listWithOneRefresh(env, current, source, 'findings');
+        const version = findVersion(integrations, project.slug, targetVersion);
+        if (version && WATCH_TERMINAL_STATES.has(version.state)) {
+            return reportWatchOutcome(ctx, project.slug, version);
+        }
+        ctx.log(`ekanos: ${project.slug}@${targetVersion} is ` +
+            `${version ? version.state : 'not visible yet'} — waiting…`);
+        await sleep(WATCH_POLL_INTERVAL_MS);
+    }
+}
+function findVersion(integrations, slug, version) {
+    var _a;
+    const integration = integrations.find((i) => i.slug === slug);
+    return (_a = integration === null || integration === void 0 ? void 0 : integration.versions.find((v) => v.version === version)) !== null && _a !== void 0 ? _a : null;
+}
+function reportWatchOutcome(ctx, slug, version) {
+    var _a, _b, _c;
+    const data = {
+        slug,
+        version: version.version,
+        state: version.state,
+        gatedAt: version.gatedAt,
+        errorCount: version.errorCount,
+        warnCount: version.warnCount,
+        findings: (_a = version.findings) !== null && _a !== void 0 ? _a : [],
+        stages: (_b = version.stages) !== null && _b !== void 0 ? _b : [],
+    };
+    if (version.state === 'rejected') {
+        return ctx.fail(gateFailedError(`${slug}@${version.version} was rejected by the gate ` +
+            `(${(_c = data.errorCount) !== null && _c !== void 0 ? _c : 0} error${data.errorCount === 1 ? '' : 's'}).`, 'Resolve the error-severity findings in data.findings, bump the ' +
+            'version, and re-run "ekanos publish".'), data);
+    }
+    return ctx.succeed(data, `status --watch: ${slug}@${version.version} is now "${version.state}"` +
+        `${data.warnCount ? ` (${data.warnCount} warning${data.warnCount === 1 ? '' : 's'})` : ''}.`);
+}
+function defaultSleep(ms) {
+    return new Promise((resolve) => {
+        setTimeout(resolve, ms);
+    });
 }
 /**
  * whoami's identity resolution, with AUTH_REQUIRED absorbed into
@@ -109,12 +222,16 @@ function readProjectReport(dir) {
     };
 }
 /** Mirrors publish's one-refresh-one-retry on a stale access token. */
-async function listWithOneRefresh(env, session, source) {
-    const first = await listSubmissions(env.host, session.accessToken, source);
+async function listWithOneRefresh(env, session, source, detail) {
+    const first = await listSubmissions(env.host, session.accessToken, source, {
+        detail,
+    });
     if (first.status === 'ok')
         return first.integrations;
     const refreshed = await refreshStoredSession(env, session);
-    const second = await listSubmissions(env.host, refreshed.accessToken, source);
+    const second = await listSubmissions(env.host, refreshed.accessToken, source, {
+        detail,
+    });
     if (second.status === 'ok')
         return second.integrations;
     // Authenticated a moment ago, unauthorized twice here: report the list as
@@ -122,8 +239,8 @@ async function listWithOneRefresh(env, session, source) {
     // it. This is unreachable in practice; belt and braces for a racing revoke.
     throw authRequiredError(`The session for ${env.host} could not authorize the submission list.`, `Run "ekanos login --host ${env.host}" and retry.`);
 }
-function humanSummary(host, session, project, submissions) {
-    var _a, _b, _c;
+function humanSummary(host, session, project, submissions, showFindings) {
+    var _a, _b, _c, _d;
     const lines = [];
     lines.push(session.authenticated
         ? `status: logged in to ${host} as ${(_b = (_a = session.user) === null || _a === void 0 ? void 0 : _a.email) !== null && _b !== void 0 ? _b : (_c = session.user) === null || _c === void 0 ? void 0 : _c.id}${session.expiresAt ? ` (session expires ${session.expiresAt})` : ''}.`
@@ -144,10 +261,26 @@ function humanSummary(host, session, project, submissions) {
         for (const integration of submissions) {
             for (const version of integration.versions) {
                 lines.push(`  submissions: ${integration.slug}@${version.version} — ` +
-                    `${version.state}${version.submittedAt ? ` (submitted ${version.submittedAt})` : ''}`);
+                    `${version.state}${version.submittedAt ? ` (submitted ${version.submittedAt})` : ''}${gateCountsSuffix(version)}`);
+                if (showFindings) {
+                    for (const finding of (_d = version.findings) !== null && _d !== void 0 ? _d : []) {
+                        lines.push(`    [${finding.severity}] ${finding.check}: ${finding.message} ` +
+                            `— ${finding.hint}`);
+                    }
+                }
             }
         }
     }
     return lines.join('\n');
 }
+/** ` (N errors, M warnings)`, omitted entirely until a gate has actually run. */
+function gateCountsSuffix(version) {
+    var _a, _b;
+    if (version.errorCount === null && version.warnCount === null)
+        return '';
+    const errorCount = (_a = version.errorCount) !== null && _a !== void 0 ? _a : 0;
+    const warnCount = (_b = version.warnCount) !== null && _b !== void 0 ? _b : 0;
+    return (` (${errorCount} error${errorCount === 1 ? '' : 's'}, ` +
+        `${warnCount} warning${warnCount === 1 ? '' : 's'})`);
+}
 //# sourceMappingURL=status.js.map

package/dist/commands/status.js.map

@@ -1 +1 @@
-{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,WAAW,EAAiB,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAA0B,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAsBlE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAe,EACf,IAAgB;;IAEhB,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE;QAC3D,UAAU,EAAE,IAAI,CAAC,GAAG;KACrB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAExC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,SAAS;KAC7B,CAAC,CAAC;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE5B,MAAM,OAAO,GAAG,MAAM;QACpB,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC;QACjC,CAAC,CAAC;YACE,aAAa,EAAE,KAAK;YACpB,IAAI,EAAE,4BAA4B,GAAG,CAAC,IAAI,eAAe;SAC1D,CAAC;IAEN,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,oBAAoB;IACpB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAA,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAI,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAElE,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE5C,IAAI,WAAW,GAA+B,IAAI,CAAC;IAEnD,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,KAAI,OAAO,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QACrD,WAAW,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;SAAM,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,KAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACrD,GAAG,CAAC,GAAG,CACL,4BAA4B,GAAG,CAAC,IAAI,mCAAmC;YACrE,CAAC,MAAA,OAAO,CAAC,IAAI,mCAAI,EAAE,CAAC,CACvB,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACtC,GAAG,CAAC,GAAG,CACL,sEAAsE;YACpE,mEAAmE;YACnE,2BAA2B,CAC9B,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,6CAEd,IAAI,EAAE,GAAG,CAAC,IAAI,IACX,OAAO,KACV,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,EACnC,OAAO;QACP,WAAW,KACR,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAE1C,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CACtD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CACzB,GAA8C,EAC9C,MAAqB;IAErB,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAEjE,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;YACrE,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,aAAa,EAAE,CAAC;YAC1E,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAW;;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAErC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IAEvC,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,UAAU;QACtB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QACzB,MAAM,EAAE,MAAA,MAAM,CAAC,OAAO,CAAC,MAAM,mCAAI,IAAI;KACtC,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,KAAK,UAAU,kBAAkB,CAC/B,GAA8C,EAC9C,OAAsB,EACtB,MAAc;IAEd,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAE3E,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,YAAY,CAAC;IAErD,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAE9E,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,YAAY,CAAC;IAEvD,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,iBAAiB,CACrB,mBAAmB,GAAG,CAAC,IAAI,2CAA2C,EACtE,4BAA4B,GAAG,CAAC,IAAI,cAAc,CACnD,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,IAAY,EACZ,OAAsB,EACtB,OAA6B,EAC7B,WAAuC;;IAEvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CACR,OAAO,CAAC,aAAa;QACnB,CAAC,CAAC,wBAAwB,IAAI,OAC1B,MAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,KAAK,mCAAI,MAAA,OAAO,CAAC,IAAI,0CAAE,EACvC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;QAC1E,CAAC,CAAC,4BAA4B,IAAI,GAAG,CACxC,CAAC;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,CAAC,IAAI,CACR,cAAc,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,GAAG,EAAE;YAC5C,CAAC,OAAO,CAAC,MAAM;gBACb,CAAC,CAAC,aAAa,OAAO,CAAC,MAAM,IAAI;gBACjC,CAAC,CAAC,6BAA6B,CAAC,CACrC,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACzC,CAAC;QAED,KAAK,MAAM,WAAW,IAAI,WAAW,EAAE,CAAC;YACtC,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;gBAC3C,KAAK,CAAC,IAAI,CACR,kBAAkB,WAAW,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK;oBACxD,GAAG,OAAO,CAAC,KAAK,GACd,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAChE,EAAE,CACL,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport type { StoredSession } from '../auth/credential-store';\nimport {\n  refreshStoredSession,\n  resolveAuthEnvironment,\n  resolveIdentity,\n} from '../auth/session';\nimport type { CliContext } from '../context';\nimport { CliError, authRequiredError } from '../errors';\nimport { ERROR_CODES, type ExitCode } from '../exit-codes';\nimport { EKANOS_CONFIG_FILENAME, loadProject } from '../project';\nimport { type SubmissionListing, listSubmissions } from '../publish-api';\nimport { announceUpdate, checkForUpdate } from '../update-notice';\n\nexport interface StatusArgs {\n  host?: string;\n  /** Project directory (may contain ekanos.json). Defaults to cwd. */\n  dir: string;\n  env: Record<string, string | undefined>;\n}\n\ninterface SessionReport {\n  authenticated: boolean;\n  user?: { id: string; email: string | null; name: string | null };\n  expiresAt?: string;\n  hint?: string;\n}\n\ninterface ProjectReport {\n  dir: string;\n  slug: string;\n  source: string | null;\n}\n\n/**\n * `status` — the read verb: where am I pointed, who am I, and what has this\n * project submitted?\n *\n * Three sections, each degrading gracefully rather than failing:\n *\n *  - **session** — whoami's server-side identity check, but an absent or dead\n *    session reports `authenticated: false` with a hint instead of exit 4. A\n *    partner asking \"what is my state?\" must get an answer, not an error whose\n *    answer it is.\n *  - **project** — the ekanos.json in `--dir` (default cwd), when there is\n *    one. No project is an ordinary state for `status`, never an error.\n *  - **submissions** — `GET /api/partner/submissions?source=…` for the\n *    project's resolved source, only when both a session and a source exist.\n *    Server errors here DO map through the taxonomy: an unreachable host or a\n *    missing source is a fault to surface, not a state to absorb.\n *\n * Exit 0 whenever the report itself could be assembled.\n */\nexport async function runStatus(\n  ctx: CliContext,\n  args: StatusArgs,\n): Promise<ExitCode> {\n  const env = resolveAuthEnvironment(ctx, args.host, args.env, {\n    projectDir: args.dir,\n  });\n\n  const stored = env.store.read(env.host);\n\n  const notice = await checkForUpdate({\n    env: args.env,\n    host: env.host,\n    session: stored ?? undefined,\n  });\n  announceUpdate(ctx, notice);\n\n  const session = stored\n    ? await probeSession(env, stored)\n    : {\n        authenticated: false,\n        hint: `Run \"ekanos login --host ${env.host}\" to sign in.`,\n      };\n\n  // probeSession may have refreshed the session — persisting a NEW access\n  // token and ROTATING the refresh token on disk. Re-read before using it:\n  // the pre-probe object now holds a dead access token and an already-spent\n  // refresh token, and presenting those would turn \"logged in, token was\n  // merely stale\" into a hard exit-4 — the one failure this command promises\n  // never to produce.\n  const live = stored ? (env.store.read(env.host) ?? stored) : null;\n\n  const project = readProjectReport(args.dir);\n\n  let submissions: SubmissionListing[] | null = null;\n\n  if (project?.source && session.authenticated && live) {\n    submissions = await listWithOneRefresh(env, live, project.source);\n  } else if (project?.source && !session.authenticated) {\n    ctx.log(\n      `ekanos: not logged in to ${env.host} — skipping the submission list. ` +\n        (session.hint ?? ''),\n    );\n  } else if (project && !project.source) {\n    ctx.log(\n      'ekanos: this project has no \"source\" in ekanos.json yet — the first ' +\n        '\"ekanos publish --source <slug>\" saves one, and status will list ' +\n        'submissions from then on.',\n    );\n  }\n\n  return ctx.succeed(\n    {\n      host: env.host,\n      ...session,\n      credentialsPath: env.store.filePath,\n      project,\n      submissions,\n      ...(notice ? { toolchain: notice } : {}),\n    },\n    humanSummary(env.host, session, project, submissions),\n  );\n}\n\n/**\n * whoami's identity resolution, with AUTH_REQUIRED absorbed into\n * `authenticated: false`. Anything else — network, precondition, MFA mapped\n * to auth by `fetchIdentity` — still propagates: \"the host was unreachable\"\n * must never be reported as \"you are logged out\".\n */\nasync function probeSession(\n  env: ReturnType<typeof resolveAuthEnvironment>,\n  stored: StoredSession,\n): Promise<SessionReport> {\n  try {\n    const { identity, session } = await resolveIdentity(env, stored);\n\n    return {\n      authenticated: true,\n      user: { id: identity.id, email: identity.email, name: identity.name },\n      expiresAt: session.expiresAt,\n    };\n  } catch (error) {\n    if (error instanceof CliError && error.code === ERROR_CODES.AUTH_REQUIRED) {\n      return { authenticated: false, hint: error.hint };\n    }\n\n    throw error;\n  }\n}\n\n/**\n * Lenient project read: no ekanos.json means \"not in a project\", which is an\n * answer, not an error. An ekanos.json that EXISTS but does not load keeps\n * `loadProject`'s strict behaviour — a broken project file is a fault the\n * partner needs named, whatever verb they ran.\n */\nfunction readProjectReport(dir: string): ProjectReport | null {\n  const projectDir = path.resolve(dir);\n\n  if (!fs.existsSync(path.join(projectDir, EKANOS_CONFIG_FILENAME))) {\n    return null;\n  }\n\n  const loaded = loadProject(projectDir);\n\n  return {\n    dir: loaded.projectDir,\n    slug: loaded.primary.slug,\n    source: loaded.project.source ?? null,\n  };\n}\n\n/** Mirrors publish's one-refresh-one-retry on a stale access token. */\nasync function listWithOneRefresh(\n  env: ReturnType<typeof resolveAuthEnvironment>,\n  session: StoredSession,\n  source: string,\n): Promise<SubmissionListing[]> {\n  const first = await listSubmissions(env.host, session.accessToken, source);\n\n  if (first.status === 'ok') return first.integrations;\n\n  const refreshed = await refreshStoredSession(env, session);\n  const second = await listSubmissions(env.host, refreshed.accessToken, source);\n\n  if (second.status === 'ok') return second.integrations;\n\n  // Authenticated a moment ago, unauthorized twice here: report the list as\n  // unavailable rather than the session as dead — probeSession already proved\n  // it. This is unreachable in practice; belt and braces for a racing revoke.\n  throw authRequiredError(\n    `The session for ${env.host} could not authorize the submission list.`,\n    `Run \"ekanos login --host ${env.host}\" and retry.`,\n  );\n}\n\nfunction humanSummary(\n  host: string,\n  session: SessionReport,\n  project: ProjectReport | null,\n  submissions: SubmissionListing[] | null,\n): string {\n  const lines: string[] = [];\n\n  lines.push(\n    session.authenticated\n      ? `status: logged in to ${host} as ${\n          session.user?.email ?? session.user?.id\n        }${session.expiresAt ? ` (session expires ${session.expiresAt})` : ''}.`\n      : `status: not logged in to ${host}.`,\n  );\n\n  if (project) {\n    lines.push(\n      `  project: ${project.slug} in ${project.dir}` +\n        (project.source\n          ? ` (source \"${project.source}\")`\n          : ' (no source configured yet)'),\n    );\n  } else {\n    lines.push('  project: none (no ekanos.json here).');\n  }\n\n  if (submissions) {\n    if (submissions.length === 0) {\n      lines.push('  submissions: none yet.');\n    }\n\n    for (const integration of submissions) {\n      for (const version of integration.versions) {\n        lines.push(\n          `  submissions: ${integration.slug}@${version.version} — ` +\n            `${version.state}${\n              version.submittedAt ? ` (submitted ${version.submittedAt})` : ''\n            }`,\n        );\n      }\n    }\n  }\n\n  return lines.join('\\n');\n}\n"]}
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,QAAQ,EACR,iBAAiB,EACjB,eAAe,EACf,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,WAAW,EAAiB,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAGL,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C,qEAAqE;AACrE,MAAM,sBAAsB,GAAG,KAAM,CAAC;AAEtC;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;AAgCpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAe,EACf,IAAgB;;IAEhB,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE;QAC3D,UAAU,EAAE,IAAI,CAAC,GAAG;KACrB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAExC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,SAAS;KAC7B,CAAC,CAAC;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE5B,MAAM,OAAO,GAAG,MAAM;QACpB,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC;QACjC,CAAC,CAAC;YACE,aAAa,EAAE,KAAK;YACpB,IAAI,EAAE,4BAA4B,GAAG,CAAC,IAAI,eAAe;SAC1D,CAAC;IAEN,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,oBAAoB;IACpB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAA,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAI,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAElE,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,iBAAiB,CACrB,mDAAmD,GAAG,CAAC,IAAI,GAAG,EAC9D,4BAA4B,GAAG,CAAC,IAAI,cAAc,CACnD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,iBAAiB,CACrB,2BAA2B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EACpD,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,iBAAiB,CACrB,kDAAkD,EAClD,8DAA8D;gBAC5D,8CAA8C,CACjD,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,WAAW,GAA+B,IAAI,CAAC;IAEnD,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,KAAI,OAAO,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QACrD,WAAW,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;SAAM,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,KAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACrD,GAAG,CAAC,GAAG,CACL,4BAA4B,GAAG,CAAC,IAAI,mCAAmC;YACrE,CAAC,MAAA,OAAO,CAAC,IAAI,mCAAI,EAAE,CAAC,CACvB,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACtC,GAAG,CAAC,GAAG,CACL,sEAAsE;YACpE,mEAAmE;YACnE,2BAA2B,CAC9B,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,6CAEd,IAAI,EAAE,GAAG,CAAC,IAAI,IACX,OAAO,KACV,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,EACnC,OAAO;QACP,WAAW,KACR,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAE1C,YAAY,CACV,GAAG,CAAC,IAAI,EACR,OAAO,EACP,OAAO,EACP,WAAW,EACX,MAAA,IAAI,CAAC,QAAQ,mCAAI,KAAK,CACvB,CACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,QAAQ,CACrB,GAAe,EACf,GAA8C,EAC9C,OAAsB,EACtB,IAAgB;;IAEhB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,uEAAuE;QACvE,gDAAgD;QAChD,MAAM,iBAAiB,CACrB,kDAAkD,EAClD,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,MAAA,IAAI,CAAC,KAAK,mCAAI,YAAY,CAAC;IAEzC,GAAG,CAAC,GAAG,CACL,oBAAoB,OAAO,CAAC,IAAI,IAAI,aAAa,OAAO,GAAG,CAAC,IAAI,GAAG;QACjE,kBAAkB,sBAAsB,GAAG,IAAI,KAAK,CACvD,CAAC;IAEF,SAAS,CAAC;QACR,qEAAqE;QACrE,wEAAwE;QACxE,sEAAsE;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,oEAAoE;QACpE,iEAAiE;QACjE,sEAAsE;QACtE,gEAAgE;QAChE,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,iBAAiB,CACrB,mBAAmB,GAAG,CAAC,IAAI,qCAAqC;gBAC9D,6BAA6B,EAC/B,4BAA4B,GAAG,CAAC,IAAI,cAAc,CACnD,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAC3C,GAAG,EACH,OAAO,EACP,MAAM,EACN,UAAU,CACX,CAAC;QACF,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAEvE,IAAI,OAAO,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,OAAO,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;QAED,GAAG,CAAC,GAAG,CACL,WAAW,OAAO,CAAC,IAAI,IAAI,aAAa,MAAM;YAC5C,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,aAAa,CAC9D,CAAC;QAEF,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,YAAiC,EACjC,IAAY,EACZ,OAAe;;IAEf,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC9D,OAAO,MAAA,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,mCAAI,IAAI,CAAC;AAC1E,CAAC;AAED,SAAS,kBAAkB,CACzB,GAAe,EACf,IAAY,EACZ,OAA0B;;IAE1B,MAAM,IAAI,GAAG;QACX,IAAI;QACJ,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ,EAAE,MAAA,OAAO,CAAC,QAAQ,mCAAI,EAAE;QAChC,MAAM,EAAE,MAAA,OAAO,CAAC,MAAM,mCAAI,EAAE;KAC7B,CAAC;IAEF,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,GAAG,CAAC,IAAI,CACb,eAAe,CACb,GAAG,IAAI,IAAI,OAAO,CAAC,OAAO,4BAA4B;YACpD,IAAI,MAAA,IAAI,CAAC,UAAU,mCAAI,CAAC,SAAS,IAAI,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,EACvE,iEAAiE;YAC/D,uCAAuC,CAC1C,EACD,IAAI,CACL,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,CAChB,IAAI,EACJ,mBAAmB,IAAI,IAAI,OAAO,CAAC,OAAO,YAAY,OAAO,CAAC,KAAK,GAAG;QACpE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,WAAW,IAAI,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAC/F,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CACzB,GAA8C,EAC9C,MAAqB;IAErB,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAEjE,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;YACrE,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,aAAa,EAAE,CAAC;YAC1E,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAW;;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAErC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IAEvC,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,UAAU;QACtB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QACzB,MAAM,EAAE,MAAA,MAAM,CAAC,OAAO,CAAC,MAAM,mCAAI,IAAI;KACtC,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,KAAK,UAAU,kBAAkB,CAC/B,GAA8C,EAC9C,OAAsB,EACtB,MAAc,EACd,MAAmB;IAEnB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE;QACzE,MAAM;KACP,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,YAAY,CAAC;IAErD,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,GAAG,CAAC,IAAI,EACR,SAAS,CAAC,WAAW,EACrB,MAAM,EACN;QACE,MAAM;KACP,CACF,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,YAAY,CAAC;IAEvD,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,iBAAiB,CACrB,mBAAmB,GAAG,CAAC,IAAI,2CAA2C,EACtE,4BAA4B,GAAG,CAAC,IAAI,cAAc,CACnD,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,IAAY,EACZ,OAAsB,EACtB,OAA6B,EAC7B,WAAuC,EACvC,YAAqB;;IAErB,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CACR,OAAO,CAAC,aAAa;QACnB,CAAC,CAAC,wBAAwB,IAAI,OAC1B,MAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,KAAK,mCAAI,MAAA,OAAO,CAAC,IAAI,0CAAE,EACvC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;QAC1E,CAAC,CAAC,4BAA4B,IAAI,GAAG,CACxC,CAAC;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,CAAC,IAAI,CACR,cAAc,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,GAAG,EAAE;YAC5C,CAAC,OAAO,CAAC,MAAM;gBACb,CAAC,CAAC,aAAa,OAAO,CAAC,MAAM,IAAI;gBACjC,CAAC,CAAC,6BAA6B,CAAC,CACrC,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACzC,CAAC;QAED,KAAK,MAAM,WAAW,IAAI,WAAW,EAAE,CAAC;YACtC,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;gBAC3C,KAAK,CAAC,IAAI,CACR,kBAAkB,WAAW,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK;oBACxD,GAAG,OAAO,CAAC,KAAK,GACd,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAChE,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,CACjC,CAAC;gBAEF,IAAI,YAAY,EAAE,CAAC;oBACjB,KAAK,MAAM,OAAO,IAAI,MAAA,OAAO,CAAC,QAAQ,mCAAI,EAAE,EAAE,CAAC;wBAC7C,KAAK,CAAC,IAAI,CACR,QAAQ,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,OAAO,GAAG;4BAC/D,KAAK,OAAO,CAAC,IAAI,EAAE,CACtB,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,OAA0B;;IAClD,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAEzE,MAAM,UAAU,GAAG,MAAA,OAAO,CAAC,UAAU,mCAAI,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,SAAS,mCAAI,CAAC,CAAC;IAEzC,OAAO,CACL,KAAK,UAAU,SAAS,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI;QACvD,GAAG,SAAS,WAAW,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CACrD,CAAC;AACJ,CAAC","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport type { StoredSession } from '../auth/credential-store';\nimport {\n  refreshStoredSession,\n  resolveAuthEnvironment,\n  resolveIdentity,\n} from '../auth/session';\nimport type { CliContext } from '../context';\nimport {\n  CliError,\n  authRequiredError,\n  gateFailedError,\n  preconditionError,\n} from '../errors';\nimport { ERROR_CODES, type ExitCode } from '../exit-codes';\nimport { EKANOS_CONFIG_FILENAME, loadProject } from '../project';\nimport {\n  type SubmissionListing,\n  type SubmissionVersion,\n  listSubmissions,\n} from '../publish-api';\nimport { announceUpdate, checkForUpdate } from '../update-notice';\nimport { readProjectVersion } from './publish';\n\n/** `--watch`'s poll interval — matches the mission brief exactly. */\nconst WATCH_POLL_INTERVAL_MS = 30_000;\n\n/**\n * The states `--watch` stops on. `submitted` is the only non-terminal state\n * a version can be in when watching starts (an already-`gated`/`dev`/\n * `rejected` version resolves on the very first check, no polling needed).\n */\nconst WATCH_TERMINAL_STATES = new Set(['gated', 'dev', 'rejected']);\n\nexport interface StatusArgs {\n  host?: string;\n  /** Project directory (may contain ekanos.json). Defaults to cwd. */\n  dir: string;\n  env: Record<string, string | undefined>;\n  /** Render each version's full finding list, not just error/warn counts. */\n  findings?: boolean;\n  /**\n   * Block until this project's current (slug, version) submission reaches a\n   * terminal-for-waiting state (gated, dev, rejected), polling every 30s.\n   * Changes the command's exit-code contract — see `runStatus`'s docstring.\n   */\n  watch?: boolean;\n  /** Injectable for tests — see `auth/device-flow.ts`'s identical pattern. */\n  sleep?: (ms: number) => Promise<void>;\n}\n\ninterface SessionReport {\n  authenticated: boolean;\n  user?: { id: string; email: string | null; name: string | null };\n  expiresAt?: string;\n  hint?: string;\n}\n\ninterface ProjectReport {\n  dir: string;\n  slug: string;\n  source: string | null;\n}\n\n/**\n * `status` — the read verb: where am I pointed, who am I, and what has this\n * project submitted?\n *\n * Three sections, each degrading gracefully rather than failing:\n *\n *  - **session** — whoami's server-side identity check, but an absent or dead\n *    session reports `authenticated: false` with a hint instead of exit 4. A\n *    partner asking \"what is my state?\" must get an answer, not an error whose\n *    answer it is.\n *  - **project** — the ekanos.json in `--dir` (default cwd), when there is\n *    one. No project is an ordinary state for `status`, never an error.\n *  - **submissions** — `GET /api/partner/submissions?source=…` for the\n *    project's resolved source, only when both a session and a source exist.\n *    Server errors here DO map through the taxonomy: an unreachable host or a\n *    missing source is a fault to surface, not a state to absorb.\n *\n * Exit 0 whenever the report itself could be assembled — EXCEPT under\n * `--watch` (see below), whose exit code carries the gate's verdict instead.\n *\n * `--findings` requests each version's full finding list (`?detail=findings`\n * server-side) instead of just error/warn counts.\n *\n * `--watch` turns `status` into a blocking wait: it requires a project with\n * a resolved source and a live session (both are PRECONDITIONs here, not\n * degraded-to-false states — there is nothing to watch without them), then\n * polls `GET /api/partner/submissions?detail=findings` every 30s for THIS\n * project's current (slug, package.json version) submission until it reaches\n * a terminal-for-waiting state: `gated`/`dev` exit 0, `rejected` exits 10\n * (GATE_FAILED) with the findings carried in `data` — the same shape\n * `publish`'s own gate refusal uses, so an agent's fix-then-retry loop\n * branches on it identically whether the gate ran inline (future) or via\n * this poll (today). `--json --watch` still emits exactly ONE envelope, at\n * completion — the polling itself only ever writes to stderr via `ctx.log`.\n */\nexport async function runStatus(\n  ctx: CliContext,\n  args: StatusArgs,\n): Promise<ExitCode> {\n  const env = resolveAuthEnvironment(ctx, args.host, args.env, {\n    projectDir: args.dir,\n  });\n\n  const stored = env.store.read(env.host);\n\n  const notice = await checkForUpdate({\n    env: args.env,\n    host: env.host,\n    session: stored ?? undefined,\n  });\n  announceUpdate(ctx, notice);\n\n  const session = stored\n    ? await probeSession(env, stored)\n    : {\n        authenticated: false,\n        hint: `Run \"ekanos login --host ${env.host}\" to sign in.`,\n      };\n\n  // probeSession may have refreshed the session — persisting a NEW access\n  // token and ROTATING the refresh token on disk. Re-read before using it:\n  // the pre-probe object now holds a dead access token and an already-spent\n  // refresh token, and presenting those would turn \"logged in, token was\n  // merely stale\" into a hard exit-4 — the one failure this command promises\n  // never to produce.\n  const live = stored ? (env.store.read(env.host) ?? stored) : null;\n\n  const project = readProjectReport(args.dir);\n\n  const detail = args.findings || args.watch ? 'findings' : undefined;\n\n  if (args.watch) {\n    if (!session.authenticated || !live) {\n      throw authRequiredError(\n        `\"ekanos status --watch\" needs a live session on ${env.host}.`,\n        `Run \"ekanos login --host ${env.host}\" and retry.`,\n      );\n    }\n\n    if (!project) {\n      throw preconditionError(\n        `No ekanos.json found in ${path.resolve(args.dir)}.`,\n        'Run \"ekanos publish\" at least once before watching its gate result.',\n      );\n    }\n\n    if (!project.source) {\n      throw preconditionError(\n        'This project has no \"source\" in ekanos.json yet.',\n        'Run \"ekanos publish\" at least once (it saves the source you ' +\n          'publish to) before watching its gate result.',\n      );\n    }\n\n    return runWatch(ctx, env, project, args);\n  }\n\n  let submissions: SubmissionListing[] | null = null;\n\n  if (project?.source && session.authenticated && live) {\n    submissions = await listWithOneRefresh(env, live, project.source, detail);\n  } else if (project?.source && !session.authenticated) {\n    ctx.log(\n      `ekanos: not logged in to ${env.host} — skipping the submission list. ` +\n        (session.hint ?? ''),\n    );\n  } else if (project && !project.source) {\n    ctx.log(\n      'ekanos: this project has no \"source\" in ekanos.json yet — the first ' +\n        '\"ekanos publish --source <slug>\" saves one, and status will list ' +\n        'submissions from then on.',\n    );\n  }\n\n  return ctx.succeed(\n    {\n      host: env.host,\n      ...session,\n      credentialsPath: env.store.filePath,\n      project,\n      submissions,\n      ...(notice ? { toolchain: notice } : {}),\n    },\n    humanSummary(\n      env.host,\n      session,\n      project,\n      submissions,\n      args.findings ?? false,\n    ),\n  );\n}\n\n/**\n * The `--watch` poll loop. Targets THIS project's current submission —\n * `project.slug` + the version presently in `package.json` (the same value\n * `publish` would submit right now) — not \"whatever's most recent,\" so\n * watching after a publish can never resolve against a stale prior version.\n */\nasync function runWatch(\n  ctx: CliContext,\n  env: ReturnType<typeof resolveAuthEnvironment>,\n  project: ProjectReport,\n  args: StatusArgs,\n): Promise<ExitCode> {\n  const source = project.source;\n  if (!source) {\n    // Unreachable — the caller already checked — but keeps this function's\n    // own type honest without a non-null assertion.\n    throw preconditionError(\n      'This project has no \"source\" in ekanos.json yet.',\n      'Run \"ekanos publish\" at least once before watching its gate result.',\n    );\n  }\n\n  const targetVersion = readProjectVersion(project.dir);\n  const sleep = args.sleep ?? defaultSleep;\n\n  ctx.log(\n    `ekanos: watching ${project.slug}@${targetVersion} on ${env.host} ` +\n      `(polling every ${WATCH_POLL_INTERVAL_MS / 1000}s)…`,\n  );\n\n  for (;;) {\n    // Re-read the session from the credential store on EVERY iteration —\n    // never carry one over in a closure. Auth0 rotates the refresh token on\n    // every use (see `refreshStoredSession`'s docstring), so a token this\n    // loop already consumed is dead by the next iteration; the store is the\n    // persisted source of truth for whichever refresh most recently landed\n    // — this loop's own (via `listWithOneRefresh` below, which persists\n    // through `refreshStoredSession`), or a concurrent one from another\n    // process (another terminal running login/publish/status --watch\n    // against the same host). Threading the refreshed session back out of\n    // `listWithOneRefresh` instead would only cover the first case.\n    const current = env.store.read(env.host);\n\n    if (!current) {\n      throw authRequiredError(\n        `The session for ${env.host} is gone — \"ekanos status --watch\" ` +\n          'cannot continue without it.',\n        `Run \"ekanos login --host ${env.host}\" and retry.`,\n      );\n    }\n\n    const integrations = await listWithOneRefresh(\n      env,\n      current,\n      source,\n      'findings',\n    );\n    const version = findVersion(integrations, project.slug, targetVersion);\n\n    if (version && WATCH_TERMINAL_STATES.has(version.state)) {\n      return reportWatchOutcome(ctx, project.slug, version);\n    }\n\n    ctx.log(\n      `ekanos: ${project.slug}@${targetVersion} is ` +\n        `${version ? version.state : 'not visible yet'} — waiting…`,\n    );\n\n    await sleep(WATCH_POLL_INTERVAL_MS);\n  }\n}\n\nfunction findVersion(\n  integrations: SubmissionListing[],\n  slug: string,\n  version: string,\n): SubmissionVersion | null {\n  const integration = integrations.find((i) => i.slug === slug);\n  return integration?.versions.find((v) => v.version === version) ?? null;\n}\n\nfunction reportWatchOutcome(\n  ctx: CliContext,\n  slug: string,\n  version: SubmissionVersion,\n): ExitCode {\n  const data = {\n    slug,\n    version: version.version,\n    state: version.state,\n    gatedAt: version.gatedAt,\n    errorCount: version.errorCount,\n    warnCount: version.warnCount,\n    findings: version.findings ?? [],\n    stages: version.stages ?? [],\n  };\n\n  if (version.state === 'rejected') {\n    return ctx.fail(\n      gateFailedError(\n        `${slug}@${version.version} was rejected by the gate ` +\n          `(${data.errorCount ?? 0} error${data.errorCount === 1 ? '' : 's'}).`,\n        'Resolve the error-severity findings in data.findings, bump the ' +\n          'version, and re-run \"ekanos publish\".',\n      ),\n      data,\n    );\n  }\n\n  return ctx.succeed(\n    data,\n    `status --watch: ${slug}@${version.version} is now \"${version.state}\"` +\n      `${data.warnCount ? ` (${data.warnCount} warning${data.warnCount === 1 ? '' : 's'})` : ''}.`,\n  );\n}\n\nfunction defaultSleep(ms: number): Promise<void> {\n  return new Promise((resolve) => {\n    setTimeout(resolve, ms);\n  });\n}\n\n/**\n * whoami's identity resolution, with AUTH_REQUIRED absorbed into\n * `authenticated: false`. Anything else — network, precondition, MFA mapped\n * to auth by `fetchIdentity` — still propagates: \"the host was unreachable\"\n * must never be reported as \"you are logged out\".\n */\nasync function probeSession(\n  env: ReturnType<typeof resolveAuthEnvironment>,\n  stored: StoredSession,\n): Promise<SessionReport> {\n  try {\n    const { identity, session } = await resolveIdentity(env, stored);\n\n    return {\n      authenticated: true,\n      user: { id: identity.id, email: identity.email, name: identity.name },\n      expiresAt: session.expiresAt,\n    };\n  } catch (error) {\n    if (error instanceof CliError && error.code === ERROR_CODES.AUTH_REQUIRED) {\n      return { authenticated: false, hint: error.hint };\n    }\n\n    throw error;\n  }\n}\n\n/**\n * Lenient project read: no ekanos.json means \"not in a project\", which is an\n * answer, not an error. An ekanos.json that EXISTS but does not load keeps\n * `loadProject`'s strict behaviour — a broken project file is a fault the\n * partner needs named, whatever verb they ran.\n */\nfunction readProjectReport(dir: string): ProjectReport | null {\n  const projectDir = path.resolve(dir);\n\n  if (!fs.existsSync(path.join(projectDir, EKANOS_CONFIG_FILENAME))) {\n    return null;\n  }\n\n  const loaded = loadProject(projectDir);\n\n  return {\n    dir: loaded.projectDir,\n    slug: loaded.primary.slug,\n    source: loaded.project.source ?? null,\n  };\n}\n\n/** Mirrors publish's one-refresh-one-retry on a stale access token. */\nasync function listWithOneRefresh(\n  env: ReturnType<typeof resolveAuthEnvironment>,\n  session: StoredSession,\n  source: string,\n  detail?: 'findings',\n): Promise<SubmissionListing[]> {\n  const first = await listSubmissions(env.host, session.accessToken, source, {\n    detail,\n  });\n\n  if (first.status === 'ok') return first.integrations;\n\n  const refreshed = await refreshStoredSession(env, session);\n  const second = await listSubmissions(\n    env.host,\n    refreshed.accessToken,\n    source,\n    {\n      detail,\n    },\n  );\n\n  if (second.status === 'ok') return second.integrations;\n\n  // Authenticated a moment ago, unauthorized twice here: report the list as\n  // unavailable rather than the session as dead — probeSession already proved\n  // it. This is unreachable in practice; belt and braces for a racing revoke.\n  throw authRequiredError(\n    `The session for ${env.host} could not authorize the submission list.`,\n    `Run \"ekanos login --host ${env.host}\" and retry.`,\n  );\n}\n\nfunction humanSummary(\n  host: string,\n  session: SessionReport,\n  project: ProjectReport | null,\n  submissions: SubmissionListing[] | null,\n  showFindings: boolean,\n): string {\n  const lines: string[] = [];\n\n  lines.push(\n    session.authenticated\n      ? `status: logged in to ${host} as ${\n          session.user?.email ?? session.user?.id\n        }${session.expiresAt ? ` (session expires ${session.expiresAt})` : ''}.`\n      : `status: not logged in to ${host}.`,\n  );\n\n  if (project) {\n    lines.push(\n      `  project: ${project.slug} in ${project.dir}` +\n        (project.source\n          ? ` (source \"${project.source}\")`\n          : ' (no source configured yet)'),\n    );\n  } else {\n    lines.push('  project: none (no ekanos.json here).');\n  }\n\n  if (submissions) {\n    if (submissions.length === 0) {\n      lines.push('  submissions: none yet.');\n    }\n\n    for (const integration of submissions) {\n      for (const version of integration.versions) {\n        lines.push(\n          `  submissions: ${integration.slug}@${version.version} — ` +\n            `${version.state}${\n              version.submittedAt ? ` (submitted ${version.submittedAt})` : ''\n            }${gateCountsSuffix(version)}`,\n        );\n\n        if (showFindings) {\n          for (const finding of version.findings ?? []) {\n            lines.push(\n              `    [${finding.severity}] ${finding.check}: ${finding.message} ` +\n                `— ${finding.hint}`,\n            );\n          }\n        }\n      }\n    }\n  }\n\n  return lines.join('\\n');\n}\n\n/** ` (N errors, M warnings)`, omitted entirely until a gate has actually run. */\nfunction gateCountsSuffix(version: SubmissionVersion): string {\n  if (version.errorCount === null && version.warnCount === null) return '';\n\n  const errorCount = version.errorCount ?? 0;\n  const warnCount = version.warnCount ?? 0;\n\n  return (\n    ` (${errorCount} error${errorCount === 1 ? '' : 's'}, ` +\n    `${warnCount} warning${warnCount === 1 ? '' : 's'})`\n  );\n}\n"]}

package/dist/index.d.ts

@@ -15,6 +15,12 @@ export interface RunOptions {
      */
     stdinIsTTY?: boolean;
     confirm?: (question: string) => Promise<boolean>;
+    /**
+     * Test-only override for `status --watch`'s poll delay — see `StatusArgs`
+     * in `commands/status.ts`. Never set this from real CLI wiring; it exists
+     * so a test can exercise the poll loop without waiting 30s per iteration.
+     */
+    sleep?: (ms: number) => Promise<void>;
 }
 /**
  * The single entry point. Resolves the agent-native envelope once, dispatches

package/dist/index.js

@@ -59,6 +59,8 @@ const COMMAND_SPECS = {
     status: {
         host: { type: 'string' },
         dir: { type: 'string' },
+        findings: { type: 'boolean' },
+        watch: { type: 'boolean' },
     },
     sources: {
         host: { type: 'string' },
@@ -102,6 +104,8 @@ const USAGE = [
     '  whoami     Print the identity the stored session authenticates as, plus',
     '             a compact list of the sources you hold a seat on',
     "  status     Show login state and this project's submissions on the host",
+    '             (--findings for full gate findings, --watch to block until',
+    "             this project's current version reaches a gate verdict)",
     '  sources    List every source you hold a developer/source-admin seat on',
     '  use        Set this project\'s publish target ("ekanos use <source-slug>")',
     '  publish    Validate, pack and submit the integration to a Fusion host',
@@ -248,6 +252,9 @@ export async function run(argv, options = {}) {
                     host: parsed.flags.host,
                     dir,
                     env,
+                    findings: parsed.flags.findings === true,
+                    watch: parsed.flags.watch === true,
+                    sleep: options.sleep,
                 });
             case 'sources':
                 return await runSources(ctx, {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAoB,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAkB,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGvD,MAAM,YAAY,GAAc;IAC9B,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;CAC7B,CAAC;AAEF,MAAM,aAAa,GAA8B;IAC/C,IAAI,EAAE;QACJ,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QACxB,sEAAsE;QACtE,uCAAuC;QACvC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE;KAC3C;IACD,QAAQ,EAAE;QACR,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACxB;IACD,GAAG,EAAE;QACH,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;KAC3B;IACD,IAAI,EAAE;QACJ,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACxB;IACD,KAAK,EAAE;QACL,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;KAC3B;IACD,MAAM,EAAE;QACN,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;KACzB;IACD,MAAM,EAAE;QACN,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACzB;IACD,MAAM,EAAE;QACN,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACxB;IACD,OAAO,EAAE;QACP,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACxB;IACD,GAAG,EAAE;QACH,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACxB;IACD,OAAO,EAAE;QACP,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvB,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;KACzB;IACD,OAAO,EAAE;QACP,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QACxB,qEAAqE;QACrE,wEAAwE;QACxE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;KAC5B;CACF,CAAC;AAEF,2GAA2G;AAC3G,MAAM,mBAAmB,GAA2B;IAClD,GAAG,EAAE,aAAa;CACnB,CAAC;AAEF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAE5C,MAAM,KAAK,GAAG;IACZ,mCAAmC;IACnC,EAAE;IACF,WAAW;IACX,qFAAqF;IACrF,yEAAyE;IACzE,qEAAqE;IACrE,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,2EAA2E;IAC3E,+DAA+D;IAC/D,0EAA0E;IAC1E,0EAA0E;IAC1E,8EAA8E;IAC9E,yEAAyE;IACzE,qEAAqE;IACrE,2EAA2E;IAC3E,EAAE;IACF,gCAAgC;IAChC,sEAAsE;IACtE,4EAA4E;IAC5E,sEAAsE;IACtE,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,EAAE;IACF,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,mEAAmE;IACnE,0EAA0E;IAC1E,qEAAqE;IACrE,EAAE;IACF,0DAA0D;IAC1D,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,uCAAuC;IACvC,EAAE;IACF,iBAAiB;IACjB,0EAA0E;IAC1E,uDAAuD;IACvD,oCAAoC;IACpC,6BAA6B;CAC9B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAiBb;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,IAAuB,EACvB,UAAsB,EAAE;;IAExB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC;QACzB,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,mCAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,mCAAI,OAAO,CAAC,GAAG,CAAC;IAEvC,IAAI,CAAC;QACH,2EAA2E;QAC3E,oEAAoE;QACpE,wDAAwD;QACxD,IAAI,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;YACtC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAE7C,+BAA+B;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YACD,6DAA6D;YAC7D,GAAG,CAAC,kBAAkB,CAAC;gBACrB,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,iBAAiB;gBACxB,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;YACH,MAAM,UAAU,CACd,4BAA4B,IAAI,CAAC,CAAC,CAAC,IAAI,EACvC,eAAe,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAC3D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,kBAAkB,CAAC;gBACrB,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,iBAAiB;gBACxB,KAAK,EAAE,OAAO;gBACd,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;YACH,MAAM,UAAU,CACd,oBAAoB,OAAO,IAAI,EAC/B,eAAe,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAC3D,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,mCAAmB,YAAY,GAAK,aAAa,CAAC,OAAO,CAAC,CAAE,CAAC;QACxE,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAEtC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAEpD,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,MAAM,UAAU,CACd,IAAI,OAAO,yCAAyC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,EAC9E,2DAA2D,OAAO,WAAW,CAC9E,CAAC;QACJ,CAAC;QAED,IAAI,cAAc,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,MAAM,UAAU,CACd,IAAI,OAAO,6CAA6C;gBACtD,GAAG,cAAc,UAAU,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,EACzD,kCAAkC,OAAO,KAAK,cAAc,MAAM;gBAChE,eAAe,OAAO,WAAW,CACpC,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,MAAC,MAAM,CAAC,KAAK,CAAC,GAA0B,mCAAI,GAAG,CAAC;QAE5D,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,MAAM;gBACT,OAAO,OAAO,CAAC,GAAG,EAAE;oBAClB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAyB;oBAC3C,GAAG;oBACH,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;oBAClC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI;oBAC9B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA4B;iBAChD,CAAC,CAAC;YACL,KAAK,UAAU;gBACb,OAAO,MAAM,WAAW,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9C,KAAK,KAAK;gBACR,OAAO,MAAM,MAAM,CAAC,GAAG,EAAE;oBACvB,GAAG;oBACH,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;oBAClC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAA4B;oBAChD,GAAG;iBACJ,CAAC,CAAC;YACL,KAAK,MAAM;gBACT,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;YACtE,KAAK,OAAO;gBACV,OAAO,MAAM,QAAQ,CAAC,GAAG,EAAE;oBACzB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;oBAClC,GAAG;oBACH,GAAG;iBACJ,CAAC,CAAC;YACL,KAAK,QAAQ;gBACX,OAAO,MAAM,SAAS,CAAC,GAAG,EAAE;oBAC1B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI;oBAC9B,GAAG;oBACH,GAAG;iBACJ,CAAC,CAAC;YACL,KAAK,QAAQ;gBACX,OAAO,MAAM,SAAS,CAAC,GAAG,EAAE;oBAC1B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,GAAG;oBACH,GAAG;iBACJ,CAAC,CAAC;YACL,KAAK,QAAQ;gBACX,OAAO,MAAM,SAAS,CAAC,GAAG,EAAE;oBAC1B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,GAAG;oBACH,GAAG;iBACJ,CAAC,CAAC;YACL,KAAK,SAAS;gBACZ,OAAO,MAAM,UAAU,CAAC,GAAG,EAAE;oBAC3B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,GAAG;oBACH,GAAG;iBACJ,CAAC,CAAC;YACL,KAAK,KAAK;gBACR,OAAO,MAAM,MAAM,CAAC,GAAG,EAAE;oBACvB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,GAAG;oBACH,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;oBAC3B,GAAG;iBACJ,CAAC,CAAC;YACL,KAAK,SAAS;gBACZ,OAAO,MAAM,UAAU,CAAC,GAAG,EAAE;oBAC3B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAA4B;oBACjD,GAAG;oBACH,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI;oBAC9B,GAAG;oBACH,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC,CAAC;YACL,KAAK,SAAS;gBACZ,OAAO,MAAM,UAAU,CAAC,GAAG,EAAE;oBAC3B,GAAG;oBACH,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,GAAG;oBACH,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;oBAClC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI;oBAC9B,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK;oBACvC,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC,CAAC;YACL;gBACE,kEAAkE;gBAClE,MAAM,UAAU,CACd,oBAAoB,OAAO,IAAI,EAC/B,eAAe,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACtC,CAAC;QACN,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,IAAuB;IAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM;QAC1B,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,KAAK,KAAK,WAAW;YAAE,OAAO,KAAK,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAuB,EAAE,IAAY;IAC7D,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM;QAC1B,IAAI,KAAK,KAAK,KAAK,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAAuB;IAI3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM;QAC1B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;aAClD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW;IAClB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAEtE,OAAO,OAAO,MAAM,KAAK,QAAQ;QAC/B,MAAM,KAAK,IAAI;QACf,SAAS,IAAI,MAAM;QACnB,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAClC,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,OAAO,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,GAAe;IAClC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAE9B,OAAO,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,QAAQ,CAAC,GAAe;IAC/B,GAAG,CAAC,kBAAkB,CAAC;QACrB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,KAAK;QACZ,SAAS,EAAE,UAAU;KACtB,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,eAAe,CAAC,GAAe,EAAE,OAAe;;IACvD,MAAM,KAAK,GAAG,MAAA,aAAa,CAAC,OAAO,CAAC,mCAAI,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,iBAAiB,OAAO,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;IAC/D,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,OAAO,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC","sourcesContent":["import * as fs from 'node:fs';\n\nimport { runDev } from './commands/dev';\nimport { runInit } from './commands/init';\nimport { runLogin } from './commands/login';\nimport { runLogout } from './commands/logout';\nimport { runPublish } from './commands/publish';\nimport { runSources } from './commands/sources';\nimport { runStatus } from './commands/status';\nimport { runTest } from './commands/test';\nimport { runUpgrade } from './commands/upgrade';\nimport { runUse } from './commands/use';\nimport { runValidate } from './commands/validate';\nimport { runWhoami } from './commands/whoami';\nimport { CliContext, type WriteStream } from './context';\nimport { toCliError, usageError } from './errors';\nimport { EXIT_CODES } from './exit-codes';\nimport { type FlagSpecs, parseArgv } from './parse-argv';\n\nexport { CliContext } from './context';\nexport { EXIT_CODES, ERROR_CODES } from './exit-codes';\nexport type { ExitCode, ErrorCode } from './exit-codes';\n\nconst GLOBAL_SPECS: FlagSpecs = {\n  json: { type: 'boolean' },\n  help: { type: 'boolean' },\n  version: { type: 'boolean' },\n};\n\nconst COMMAND_SPECS: Record<string, FlagSpecs> = {\n  init: {\n    slug: { type: 'string' },\n    dir: { type: 'string' },\n    force: { type: 'boolean' },\n    yes: { type: 'boolean' },\n    // Repeatable: each occurrence appends one docs entry (URL or relative\n    // path) to the scaffolded ekanos.json.\n    docs: { type: 'string', repeatable: true },\n  },\n  validate: {\n    dir: { type: 'string' },\n  },\n  dev: {\n    dir: { type: 'string' },\n    port: { type: 'string' },\n    host: { type: 'string' },\n    force: { type: 'boolean' },\n    start: { type: 'boolean' },\n  },\n  test: {\n    dir: { type: 'string' },\n  },\n  login: {\n    host: { type: 'string' },\n    force: { type: 'boolean' },\n  },\n  logout: {\n    host: { type: 'string' },\n    all: { type: 'boolean' },\n  },\n  whoami: {\n    host: { type: 'string' },\n  },\n  status: {\n    host: { type: 'string' },\n    dir: { type: 'string' },\n  },\n  sources: {\n    host: { type: 'string' },\n    dir: { type: 'string' },\n  },\n  use: {\n    host: { type: 'string' },\n    dir: { type: 'string' },\n  },\n  publish: {\n    host: { type: 'string' },\n    source: { type: 'string' },\n    dir: { type: 'string' },\n    yes: { type: 'boolean' },\n  },\n  upgrade: {\n    dir: { type: 'string' },\n    host: { type: 'string' },\n    check: { type: 'boolean' },\n    yes: { type: 'boolean' },\n    // `--no-verify` is the negation of this — parse-argv's `--no-<bool>`\n    // convention (same as `--no-json`/`--no-start`), not a flag of its own.\n    verify: { type: 'boolean' },\n  },\n};\n\n/** Commands that take a positional argument, and what it means. Every other command is positional-free. */\nconst POSITIONAL_COMMANDS: Record<string, string> = {\n  use: 'source-slug',\n};\n\nconst COMMANDS = Object.keys(COMMAND_SPECS);\n\nconst USAGE = [\n  'Usage: ekanos <command> [options]',\n  '',\n  'Commands:',\n  '  init       Scaffold a new integration project into ./<slug> (--slug <slug> --yes)',\n  '  validate   Validate ekanos.json + the integration definition (--json)',\n  '  dev        Scaffold .ekanos/harness and run it with your own Next',\n  '  test       Run the project test script via its package manager (--json)',\n  '  login      Authenticate against a Fusion host in a browser (--host <url>)',\n  '  logout     Revoke and delete the stored session (--host <url> | --all)',\n  '  whoami     Print the identity the stored session authenticates as, plus',\n  '             a compact list of the sources you hold a seat on',\n  \"  status     Show login state and this project's submissions on the host\",\n  '  sources    List every source you hold a developer/source-admin seat on',\n  '  use        Set this project\\'s publish target (\"ekanos use <source-slug>\")',\n  '  publish    Validate, pack and submit the integration to a Fusion host',\n  '  upgrade    Move this toolchain to a coherent target version, with',\n  '             verify-and-rollback (--check --yes --no-verify --host <url>)',\n  '',\n  'Keeping the toolchain current:',\n  '  validate, dev and publish all check for a newer @ekanos/cli in the',\n  '  background (never blocking, silenced by EKANOS_NO_UPDATE_CHECK) and warn',\n  '  on stderr when one exists. Run \"ekanos upgrade --check\" any time a',\n  '  validate finding smells like version skew (an unrecognized-key error you',\n  '  are confident is correct) — it is read-only and safe to run freely. A',\n  '  bare \"ekanos upgrade\" MUTATES the project (installs the target versions,',\n  '  verifies with validate + the test script, rolls back on any failure).',\n  '',\n  'Host resolution (logout, whoami, status, sources, use, publish, upgrade):',\n  '  --host, else EKANOS_HOST, else the \"host\" field in ekanos.json, else the',\n  '  sole stored login. \"ekanos publish\" saves host and source to ekanos.json.',\n  '  \"ekanos login\" never reads ekanos.json for a host (--host, else',\n  '  EKANOS_HOST, else the sole stored login) — it is the verb that creates',\n  '  credentials, so a committed file must never choose where they go.',\n  '',\n  'Publish targeting (see \"ekanos sources\" / \"ekanos use\"):',\n  '  publish refuses (FORBIDDEN) a source you hold no seat on. With multiple',\n  '  seats and an implicit (ekanos.json) source, a human run asks to confirm',\n  '  the target; a scripted/JSON run needs --source or --yes to proceed —',\n  '  it never prompts and never guesses.',\n  '',\n  'Global options:',\n  '  --json     Emit a single JSON envelope on stdout (auto-on when piped);',\n  '             --no-json forces the human-readable form',\n  '  --version  Print the CLI version',\n  '  --help     Show this help',\n].join('\\n');\n\nexport interface RunOptions {\n  stdout?: WriteStream;\n  stderr?: WriteStream;\n  env?: Record<string, string | undefined>;\n  cwd?: string;\n  /**\n   * Test-only overrides for `publish`'s interactive-confirm gate — see\n   * `PublishArgs` in `commands/publish.ts`. Never set these from real CLI\n   * wiring; they exist so a test can exercise the human y/N confirm branch\n   * without a real terminal.\n   */\n  stdinIsTTY?: boolean;\n  confirm?: (question: string) => Promise<boolean>;\n}\n\n/**\n * The single entry point. Resolves the agent-native envelope once, dispatches\n * to a verb, and guarantees exactly one terminal emission (success or error).\n * Returns the process exit code — `bin.ts` is the only place that calls\n * `process.exit`, so this stays fully testable.\n */\nexport async function run(\n  argv: readonly string[],\n  options: RunOptions = {},\n): Promise<number> {\n  const jsonFlag = scanJsonFlag(argv);\n  const ctx = new CliContext({\n    jsonFlag,\n    stdout: options.stdout,\n    stderr: options.stderr,\n    env: options.env,\n  });\n  const cwd = options.cwd ?? process.cwd();\n  const env = options.env ?? process.env;\n\n  try {\n    // `--version` is global and verb-independent, so it is answered before the\n    // command is even resolved: `ekanos --version` and `ekanos validate\n    // --version` both report the tool's version and exit 0.\n    if (scanFlagPresence(argv, 'version')) {\n      return emitVersion(ctx);\n    }\n\n    const { command, rest } = splitCommand(argv);\n\n    // Top-level help / no command.\n    if (!command) {\n      if (scanFlagPresence(rest, 'help') || argv.length === 0) {\n        return emitHelp(ctx);\n      }\n      // A leading token that is not a command (e.g. `--nonsense`).\n      ctx.emitClaudeCodeHint({\n        tool: 'ekanos',\n        error: 'unknown-command',\n        commands: COMMANDS,\n        usage: USAGE,\n      });\n      throw usageError(\n        `Unknown command or flag \"${argv[0]}\".`,\n        `Run one of: ${COMMANDS.join(', ')}. See \"ekanos --help\".`,\n      );\n    }\n\n    if (!COMMANDS.includes(command)) {\n      ctx.emitClaudeCodeHint({\n        tool: 'ekanos',\n        error: 'unknown-command',\n        given: command,\n        commands: COMMANDS,\n        usage: USAGE,\n      });\n      throw usageError(\n        `Unknown command \"${command}\".`,\n        `Run one of: ${COMMANDS.join(', ')}. See \"ekanos --help\".`,\n      );\n    }\n\n    const specs: FlagSpecs = { ...GLOBAL_SPECS, ...COMMAND_SPECS[command] };\n    const parsed = parseArgv(rest, specs);\n\n    if (parsed.flags.help === true) {\n      return emitCommandHelp(ctx, command);\n    }\n\n    const positionalName = POSITIONAL_COMMANDS[command];\n\n    if (!positionalName && parsed.positionals.length > 0) {\n      throw usageError(\n        `\"${command}\" takes no positional arguments (got \"${parsed.positionals[0]}\").`,\n        `Pass options as flags, e.g. \"--dir <path>\". See \"ekanos ${command} --help\".`,\n      );\n    }\n\n    if (positionalName && parsed.positionals.length > 1) {\n      throw usageError(\n        `\"${command}\" takes at most one positional argument (a ` +\n          `${positionalName}), got ${parsed.positionals.length}.`,\n        `Pass exactly one, e.g. \"ekanos ${command} <${positionalName}>\". ` +\n          `See \"ekanos ${command} --help\".`,\n      );\n    }\n\n    const dir = (parsed.flags.dir as string | undefined) ?? cwd;\n\n    switch (command) {\n      case 'init':\n        return runInit(ctx, {\n          slug: parsed.flags.slug as string | undefined,\n          dir: parsed.flags.dir as string | undefined,\n          cwd,\n          force: parsed.flags.force === true,\n          yes: parsed.flags.yes === true,\n          docs: parsed.flags.docs as string[] | undefined,\n        });\n      case 'validate':\n        return await runValidate(ctx, { dir, env });\n      case 'dev':\n        return await runDev(ctx, {\n          dir,\n          port: parsed.flags.port as string | undefined,\n          host: parsed.flags.host as string | undefined,\n          force: parsed.flags.force === true,\n          start: parsed.flags.start as boolean | undefined,\n          env,\n        });\n      case 'test':\n        return await runTest(ctx, { dir, passthrough: parsed.passthrough });\n      case 'login':\n        return await runLogin(ctx, {\n          host: parsed.flags.host as string | undefined,\n          force: parsed.flags.force === true,\n          cwd,\n          env,\n        });\n      case 'logout':\n        return await runLogout(ctx, {\n          host: parsed.flags.host as string | undefined,\n          all: parsed.flags.all === true,\n          cwd,\n          env,\n        });\n      case 'whoami':\n        return await runWhoami(ctx, {\n          host: parsed.flags.host as string | undefined,\n          cwd,\n          env,\n        });\n      case 'status':\n        return await runStatus(ctx, {\n          host: parsed.flags.host as string | undefined,\n          dir,\n          env,\n        });\n      case 'sources':\n        return await runSources(ctx, {\n          host: parsed.flags.host as string | undefined,\n          dir,\n          env,\n        });\n      case 'use':\n        return await runUse(ctx, {\n          host: parsed.flags.host as string | undefined,\n          dir,\n          slug: parsed.positionals[0],\n          env,\n        });\n      case 'publish':\n        return await runPublish(ctx, {\n          host: parsed.flags.host as string | undefined,\n          source: parsed.flags.source as string | undefined,\n          dir,\n          yes: parsed.flags.yes === true,\n          env,\n          stdinIsTTY: options.stdinIsTTY,\n          confirm: options.confirm,\n        });\n      case 'upgrade':\n        return await runUpgrade(ctx, {\n          dir,\n          host: parsed.flags.host as string | undefined,\n          env,\n          check: parsed.flags.check === true,\n          yes: parsed.flags.yes === true,\n          noVerify: parsed.flags.verify === false,\n          stdinIsTTY: options.stdinIsTTY,\n          confirm: options.confirm,\n        });\n      default:\n        // Unreachable — COMMANDS gate above — but keeps the switch total.\n        throw usageError(\n          `Unknown command \"${command}\".`,\n          `Run one of: ${COMMANDS.join(', ')}.`,\n        );\n    }\n  } catch (error) {\n    return ctx.fail(toCliError(error));\n  }\n}\n\n/**\n * Presence of `--json` (or `--no-json`) BEFORE the first `--` passthrough.\n *\n * Tri-state on purpose. `undefined` means \"the user expressed no preference\",\n * which is what lets the context fall back to inferring the mode from a\n * non-TTY stdout or CLAUDECODE. Collapsing `--no-json` to `false` here would\n * make it indistinguishable from absence, and the flag could then never turn\n * JSON mode OFF in exactly the cases it exists for.\n */\nfunction scanJsonFlag(argv: readonly string[]): boolean | undefined {\n  for (const token of argv) {\n    if (token === '--') break;\n    if (token === '--json') return true;\n    if (token === '--no-json') return false;\n  }\n  return undefined;\n}\n\nfunction scanFlagPresence(argv: readonly string[], name: string): boolean {\n  for (const token of argv) {\n    if (token === '--') break;\n    if (token === `--${name}`) return true;\n  }\n  return false;\n}\n\n/**\n * Split argv into the command (first bare token before `--`) and the rest\n * (everything else, order preserved, including global flags and the `--`\n * passthrough). Global flags are all booleans, so any bare token is the\n * command — no value-consumption ambiguity.\n */\nfunction splitCommand(argv: readonly string[]): {\n  command: string | null;\n  rest: string[];\n} {\n  for (let i = 0; i < argv.length; i++) {\n    const token = argv[i]!;\n    if (token === '--') break;\n    if (!token.startsWith('-')) {\n      return {\n        command: token,\n        rest: [...argv.slice(0, i), ...argv.slice(i + 1)],\n      };\n    }\n  }\n  return { command: null, rest: [...argv] };\n}\n\n/**\n * The CLI's own version, read from the package manifest at runtime rather than\n * baked in by the build — one source of truth, so a release bump cannot leave\n * `--version` reporting a stale number. The path resolves identically from\n * `src/index.ts` and from the emitted `dist/index.js`, both of which sit one\n * directory below the package root.\n */\nfunction readVersion(): string {\n  const manifest = new URL('../package.json', import.meta.url);\n  const parsed: unknown = JSON.parse(fs.readFileSync(manifest, 'utf8'));\n\n  return typeof parsed === 'object' &&\n    parsed !== null &&\n    'version' in parsed &&\n    typeof parsed.version === 'string'\n    ? parsed.version\n    : '0.0.0';\n}\n\nfunction emitVersion(ctx: CliContext): number {\n  const version = readVersion();\n\n  return ctx.succeed({ name: 'ekanos', version }, version);\n}\n\nfunction emitHelp(ctx: CliContext): number {\n  ctx.emitClaudeCodeHint({\n    tool: 'ekanos',\n    commands: COMMANDS,\n    usage: USAGE,\n    exitCodes: EXIT_CODES,\n  });\n  return ctx.succeed({ usage: USAGE, commands: COMMANDS }, USAGE);\n}\n\nfunction emitCommandHelp(ctx: CliContext, command: string): number {\n  const specs = COMMAND_SPECS[command] ?? {};\n  const flags = Object.keys(specs).map((name) => `--${name}`);\n  const help = `Usage: ekanos ${command} [${flags.join('] [')}]`;\n  ctx.emitClaudeCodeHint({ tool: 'ekanos', command, flags });\n  return ctx.succeed({ command, flags }, help);\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAoB,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAkB,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGvD,MAAM,YAAY,GAAc;IAC9B,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;CAC7B,CAAC;AAEF,MAAM,aAAa,GAA8B;IAC/C,IAAI,EAAE;QACJ,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QACxB,sEAAsE;QACtE,uCAAuC;QACvC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE;KAC3C;IACD,QAAQ,EAAE;QACR,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACxB;IACD,GAAG,EAAE;QACH,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;KAC3B;IACD,IAAI,EAAE;QACJ,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACxB;IACD,KAAK,EAAE;QACL,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;KAC3B;IACD,MAAM,EAAE;QACN,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;KACzB;IACD,MAAM,EAAE;QACN,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACzB;IACD,MAAM,EAAE;QACN,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC7B,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;KAC3B;IACD,OAAO,EAAE;QACP,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACxB;IACD,GAAG,EAAE;QACH,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACxB;IACD,OAAO,EAAE;QACP,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvB,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;KACzB;IACD,OAAO,EAAE;QACP,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QACxB,qEAAqE;QACrE,wEAAwE;QACxE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;KAC5B;CACF,CAAC;AAEF,2GAA2G;AAC3G,MAAM,mBAAmB,GAA2B;IAClD,GAAG,EAAE,aAAa;CACnB,CAAC;AAEF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAE5C,MAAM,KAAK,GAAG;IACZ,mCAAmC;IACnC,EAAE;IACF,WAAW;IACX,qFAAqF;IACrF,yEAAyE;IACzE,qEAAqE;IACrE,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,2EAA2E;IAC3E,+DAA+D;IAC/D,0EAA0E;IAC1E,yEAAyE;IACzE,qEAAqE;IACrE,0EAA0E;IAC1E,8EAA8E;IAC9E,yEAAyE;IACzE,qEAAqE;IACrE,2EAA2E;IAC3E,EAAE;IACF,gCAAgC;IAChC,sEAAsE;IACtE,4EAA4E;IAC5E,sEAAsE;IACtE,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,EAAE;IACF,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,mEAAmE;IACnE,0EAA0E;IAC1E,qEAAqE;IACrE,EAAE;IACF,0DAA0D;IAC1D,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,uCAAuC;IACvC,EAAE;IACF,iBAAiB;IACjB,0EAA0E;IAC1E,uDAAuD;IACvD,oCAAoC;IACpC,6BAA6B;CAC9B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAuBb;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,IAAuB,EACvB,UAAsB,EAAE;;IAExB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC;QACzB,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,mCAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,mCAAI,OAAO,CAAC,GAAG,CAAC;IAEvC,IAAI,CAAC;QACH,2EAA2E;QAC3E,oEAAoE;QACpE,wDAAwD;QACxD,IAAI,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;YACtC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAE7C,+BAA+B;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YACD,6DAA6D;YAC7D,GAAG,CAAC,kBAAkB,CAAC;gBACrB,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,iBAAiB;gBACxB,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;YACH,MAAM,UAAU,CACd,4BAA4B,IAAI,CAAC,CAAC,CAAC,IAAI,EACvC,eAAe,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAC3D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,kBAAkB,CAAC;gBACrB,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,iBAAiB;gBACxB,KAAK,EAAE,OAAO;gBACd,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;YACH,MAAM,UAAU,CACd,oBAAoB,OAAO,IAAI,EAC/B,eAAe,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAC3D,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,mCAAmB,YAAY,GAAK,aAAa,CAAC,OAAO,CAAC,CAAE,CAAC;QACxE,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAEtC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAEpD,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,MAAM,UAAU,CACd,IAAI,OAAO,yCAAyC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,EAC9E,2DAA2D,OAAO,WAAW,CAC9E,CAAC;QACJ,CAAC;QAED,IAAI,cAAc,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,MAAM,UAAU,CACd,IAAI,OAAO,6CAA6C;gBACtD,GAAG,cAAc,UAAU,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,EACzD,kCAAkC,OAAO,KAAK,cAAc,MAAM;gBAChE,eAAe,OAAO,WAAW,CACpC,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,MAAC,MAAM,CAAC,KAAK,CAAC,GAA0B,mCAAI,GAAG,CAAC;QAE5D,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,MAAM;gBACT,OAAO,OAAO,CAAC,GAAG,EAAE;oBAClB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAyB;oBAC3C,GAAG;oBACH,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;oBAClC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI;oBAC9B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA4B;iBAChD,CAAC,CAAC;YACL,KAAK,UAAU;gBACb,OAAO,MAAM,WAAW,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9C,KAAK,KAAK;gBACR,OAAO,MAAM,MAAM,CAAC,GAAG,EAAE;oBACvB,GAAG;oBACH,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;oBAClC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAA4B;oBAChD,GAAG;iBACJ,CAAC,CAAC;YACL,KAAK,MAAM;gBACT,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;YACtE,KAAK,OAAO;gBACV,OAAO,MAAM,QAAQ,CAAC,GAAG,EAAE;oBACzB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;oBAClC,GAAG;oBACH,GAAG;iBACJ,CAAC,CAAC;YACL,KAAK,QAAQ;gBACX,OAAO,MAAM,SAAS,CAAC,GAAG,EAAE;oBAC1B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI;oBAC9B,GAAG;oBACH,GAAG;iBACJ,CAAC,CAAC;YACL,KAAK,QAAQ;gBACX,OAAO,MAAM,SAAS,CAAC,GAAG,EAAE;oBAC1B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,GAAG;oBACH,GAAG;iBACJ,CAAC,CAAC;YACL,KAAK,QAAQ;gBACX,OAAO,MAAM,SAAS,CAAC,GAAG,EAAE;oBAC1B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,GAAG;oBACH,GAAG;oBACH,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI;oBACxC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;oBAClC,KAAK,EAAE,OAAO,CAAC,KAAK;iBACrB,CAAC,CAAC;YACL,KAAK,SAAS;gBACZ,OAAO,MAAM,UAAU,CAAC,GAAG,EAAE;oBAC3B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,GAAG;oBACH,GAAG;iBACJ,CAAC,CAAC;YACL,KAAK,KAAK;gBACR,OAAO,MAAM,MAAM,CAAC,GAAG,EAAE;oBACvB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,GAAG;oBACH,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;oBAC3B,GAAG;iBACJ,CAAC,CAAC;YACL,KAAK,SAAS;gBACZ,OAAO,MAAM,UAAU,CAAC,GAAG,EAAE;oBAC3B,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAA4B;oBACjD,GAAG;oBACH,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI;oBAC9B,GAAG;oBACH,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC,CAAC;YACL,KAAK,SAAS;gBACZ,OAAO,MAAM,UAAU,CAAC,GAAG,EAAE;oBAC3B,GAAG;oBACH,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAA0B;oBAC7C,GAAG;oBACH,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;oBAClC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI;oBAC9B,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK;oBACvC,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC,CAAC;YACL;gBACE,kEAAkE;gBAClE,MAAM,UAAU,CACd,oBAAoB,OAAO,IAAI,EAC/B,eAAe,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACtC,CAAC;QACN,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,IAAuB;IAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM;QAC1B,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,KAAK,KAAK,WAAW;YAAE,OAAO,KAAK,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAuB,EAAE,IAAY;IAC7D,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM;QAC1B,IAAI,KAAK,KAAK,KAAK,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAAuB;IAI3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM;QAC1B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;aAClD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW;IAClB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAEtE,OAAO,OAAO,MAAM,KAAK,QAAQ;QAC/B,MAAM,KAAK,IAAI;QACf,SAAS,IAAI,MAAM;QACnB,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAClC,CAAC,CAAC,MAAM,CAAC,OAAO;QAChB,CAAC,CAAC,OAAO,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,GAAe;IAClC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAE9B,OAAO,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,QAAQ,CAAC,GAAe;IAC/B,GAAG,CAAC,kBAAkB,CAAC;QACrB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,KAAK;QACZ,SAAS,EAAE,UAAU;KACtB,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,eAAe,CAAC,GAAe,EAAE,OAAe;;IACvD,MAAM,KAAK,GAAG,MAAA,aAAa,CAAC,OAAO,CAAC,mCAAI,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,iBAAiB,OAAO,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;IAC/D,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,OAAO,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC","sourcesContent":["import * as fs from 'node:fs';\n\nimport { runDev } from './commands/dev';\nimport { runInit } from './commands/init';\nimport { runLogin } from './commands/login';\nimport { runLogout } from './commands/logout';\nimport { runPublish } from './commands/publish';\nimport { runSources } from './commands/sources';\nimport { runStatus } from './commands/status';\nimport { runTest } from './commands/test';\nimport { runUpgrade } from './commands/upgrade';\nimport { runUse } from './commands/use';\nimport { runValidate } from './commands/validate';\nimport { runWhoami } from './commands/whoami';\nimport { CliContext, type WriteStream } from './context';\nimport { toCliError, usageError } from './errors';\nimport { EXIT_CODES } from './exit-codes';\nimport { type FlagSpecs, parseArgv } from './parse-argv';\n\nexport { CliContext } from './context';\nexport { EXIT_CODES, ERROR_CODES } from './exit-codes';\nexport type { ExitCode, ErrorCode } from './exit-codes';\n\nconst GLOBAL_SPECS: FlagSpecs = {\n  json: { type: 'boolean' },\n  help: { type: 'boolean' },\n  version: { type: 'boolean' },\n};\n\nconst COMMAND_SPECS: Record<string, FlagSpecs> = {\n  init: {\n    slug: { type: 'string' },\n    dir: { type: 'string' },\n    force: { type: 'boolean' },\n    yes: { type: 'boolean' },\n    // Repeatable: each occurrence appends one docs entry (URL or relative\n    // path) to the scaffolded ekanos.json.\n    docs: { type: 'string', repeatable: true },\n  },\n  validate: {\n    dir: { type: 'string' },\n  },\n  dev: {\n    dir: { type: 'string' },\n    port: { type: 'string' },\n    host: { type: 'string' },\n    force: { type: 'boolean' },\n    start: { type: 'boolean' },\n  },\n  test: {\n    dir: { type: 'string' },\n  },\n  login: {\n    host: { type: 'string' },\n    force: { type: 'boolean' },\n  },\n  logout: {\n    host: { type: 'string' },\n    all: { type: 'boolean' },\n  },\n  whoami: {\n    host: { type: 'string' },\n  },\n  status: {\n    host: { type: 'string' },\n    dir: { type: 'string' },\n    findings: { type: 'boolean' },\n    watch: { type: 'boolean' },\n  },\n  sources: {\n    host: { type: 'string' },\n    dir: { type: 'string' },\n  },\n  use: {\n    host: { type: 'string' },\n    dir: { type: 'string' },\n  },\n  publish: {\n    host: { type: 'string' },\n    source: { type: 'string' },\n    dir: { type: 'string' },\n    yes: { type: 'boolean' },\n  },\n  upgrade: {\n    dir: { type: 'string' },\n    host: { type: 'string' },\n    check: { type: 'boolean' },\n    yes: { type: 'boolean' },\n    // `--no-verify` is the negation of this — parse-argv's `--no-<bool>`\n    // convention (same as `--no-json`/`--no-start`), not a flag of its own.\n    verify: { type: 'boolean' },\n  },\n};\n\n/** Commands that take a positional argument, and what it means. Every other command is positional-free. */\nconst POSITIONAL_COMMANDS: Record<string, string> = {\n  use: 'source-slug',\n};\n\nconst COMMANDS = Object.keys(COMMAND_SPECS);\n\nconst USAGE = [\n  'Usage: ekanos <command> [options]',\n  '',\n  'Commands:',\n  '  init       Scaffold a new integration project into ./<slug> (--slug <slug> --yes)',\n  '  validate   Validate ekanos.json + the integration definition (--json)',\n  '  dev        Scaffold .ekanos/harness and run it with your own Next',\n  '  test       Run the project test script via its package manager (--json)',\n  '  login      Authenticate against a Fusion host in a browser (--host <url>)',\n  '  logout     Revoke and delete the stored session (--host <url> | --all)',\n  '  whoami     Print the identity the stored session authenticates as, plus',\n  '             a compact list of the sources you hold a seat on',\n  \"  status     Show login state and this project's submissions on the host\",\n  '             (--findings for full gate findings, --watch to block until',\n  \"             this project's current version reaches a gate verdict)\",\n  '  sources    List every source you hold a developer/source-admin seat on',\n  '  use        Set this project\\'s publish target (\"ekanos use <source-slug>\")',\n  '  publish    Validate, pack and submit the integration to a Fusion host',\n  '  upgrade    Move this toolchain to a coherent target version, with',\n  '             verify-and-rollback (--check --yes --no-verify --host <url>)',\n  '',\n  'Keeping the toolchain current:',\n  '  validate, dev and publish all check for a newer @ekanos/cli in the',\n  '  background (never blocking, silenced by EKANOS_NO_UPDATE_CHECK) and warn',\n  '  on stderr when one exists. Run \"ekanos upgrade --check\" any time a',\n  '  validate finding smells like version skew (an unrecognized-key error you',\n  '  are confident is correct) — it is read-only and safe to run freely. A',\n  '  bare \"ekanos upgrade\" MUTATES the project (installs the target versions,',\n  '  verifies with validate + the test script, rolls back on any failure).',\n  '',\n  'Host resolution (logout, whoami, status, sources, use, publish, upgrade):',\n  '  --host, else EKANOS_HOST, else the \"host\" field in ekanos.json, else the',\n  '  sole stored login. \"ekanos publish\" saves host and source to ekanos.json.',\n  '  \"ekanos login\" never reads ekanos.json for a host (--host, else',\n  '  EKANOS_HOST, else the sole stored login) — it is the verb that creates',\n  '  credentials, so a committed file must never choose where they go.',\n  '',\n  'Publish targeting (see \"ekanos sources\" / \"ekanos use\"):',\n  '  publish refuses (FORBIDDEN) a source you hold no seat on. With multiple',\n  '  seats and an implicit (ekanos.json) source, a human run asks to confirm',\n  '  the target; a scripted/JSON run needs --source or --yes to proceed —',\n  '  it never prompts and never guesses.',\n  '',\n  'Global options:',\n  '  --json     Emit a single JSON envelope on stdout (auto-on when piped);',\n  '             --no-json forces the human-readable form',\n  '  --version  Print the CLI version',\n  '  --help     Show this help',\n].join('\\n');\n\nexport interface RunOptions {\n  stdout?: WriteStream;\n  stderr?: WriteStream;\n  env?: Record<string, string | undefined>;\n  cwd?: string;\n  /**\n   * Test-only overrides for `publish`'s interactive-confirm gate — see\n   * `PublishArgs` in `commands/publish.ts`. Never set these from real CLI\n   * wiring; they exist so a test can exercise the human y/N confirm branch\n   * without a real terminal.\n   */\n  stdinIsTTY?: boolean;\n  confirm?: (question: string) => Promise<boolean>;\n  /**\n   * Test-only override for `status --watch`'s poll delay — see `StatusArgs`\n   * in `commands/status.ts`. Never set this from real CLI wiring; it exists\n   * so a test can exercise the poll loop without waiting 30s per iteration.\n   */\n  sleep?: (ms: number) => Promise<void>;\n}\n\n/**\n * The single entry point. Resolves the agent-native envelope once, dispatches\n * to a verb, and guarantees exactly one terminal emission (success or error).\n * Returns the process exit code — `bin.ts` is the only place that calls\n * `process.exit`, so this stays fully testable.\n */\nexport async function run(\n  argv: readonly string[],\n  options: RunOptions = {},\n): Promise<number> {\n  const jsonFlag = scanJsonFlag(argv);\n  const ctx = new CliContext({\n    jsonFlag,\n    stdout: options.stdout,\n    stderr: options.stderr,\n    env: options.env,\n  });\n  const cwd = options.cwd ?? process.cwd();\n  const env = options.env ?? process.env;\n\n  try {\n    // `--version` is global and verb-independent, so it is answered before the\n    // command is even resolved: `ekanos --version` and `ekanos validate\n    // --version` both report the tool's version and exit 0.\n    if (scanFlagPresence(argv, 'version')) {\n      return emitVersion(ctx);\n    }\n\n    const { command, rest } = splitCommand(argv);\n\n    // Top-level help / no command.\n    if (!command) {\n      if (scanFlagPresence(rest, 'help') || argv.length === 0) {\n        return emitHelp(ctx);\n      }\n      // A leading token that is not a command (e.g. `--nonsense`).\n      ctx.emitClaudeCodeHint({\n        tool: 'ekanos',\n        error: 'unknown-command',\n        commands: COMMANDS,\n        usage: USAGE,\n      });\n      throw usageError(\n        `Unknown command or flag \"${argv[0]}\".`,\n        `Run one of: ${COMMANDS.join(', ')}. See \"ekanos --help\".`,\n      );\n    }\n\n    if (!COMMANDS.includes(command)) {\n      ctx.emitClaudeCodeHint({\n        tool: 'ekanos',\n        error: 'unknown-command',\n        given: command,\n        commands: COMMANDS,\n        usage: USAGE,\n      });\n      throw usageError(\n        `Unknown command \"${command}\".`,\n        `Run one of: ${COMMANDS.join(', ')}. See \"ekanos --help\".`,\n      );\n    }\n\n    const specs: FlagSpecs = { ...GLOBAL_SPECS, ...COMMAND_SPECS[command] };\n    const parsed = parseArgv(rest, specs);\n\n    if (parsed.flags.help === true) {\n      return emitCommandHelp(ctx, command);\n    }\n\n    const positionalName = POSITIONAL_COMMANDS[command];\n\n    if (!positionalName && parsed.positionals.length > 0) {\n      throw usageError(\n        `\"${command}\" takes no positional arguments (got \"${parsed.positionals[0]}\").`,\n        `Pass options as flags, e.g. \"--dir <path>\". See \"ekanos ${command} --help\".`,\n      );\n    }\n\n    if (positionalName && parsed.positionals.length > 1) {\n      throw usageError(\n        `\"${command}\" takes at most one positional argument (a ` +\n          `${positionalName}), got ${parsed.positionals.length}.`,\n        `Pass exactly one, e.g. \"ekanos ${command} <${positionalName}>\". ` +\n          `See \"ekanos ${command} --help\".`,\n      );\n    }\n\n    const dir = (parsed.flags.dir as string | undefined) ?? cwd;\n\n    switch (command) {\n      case 'init':\n        return runInit(ctx, {\n          slug: parsed.flags.slug as string | undefined,\n          dir: parsed.flags.dir as string | undefined,\n          cwd,\n          force: parsed.flags.force === true,\n          yes: parsed.flags.yes === true,\n          docs: parsed.flags.docs as string[] | undefined,\n        });\n      case 'validate':\n        return await runValidate(ctx, { dir, env });\n      case 'dev':\n        return await runDev(ctx, {\n          dir,\n          port: parsed.flags.port as string | undefined,\n          host: parsed.flags.host as string | undefined,\n          force: parsed.flags.force === true,\n          start: parsed.flags.start as boolean | undefined,\n          env,\n        });\n      case 'test':\n        return await runTest(ctx, { dir, passthrough: parsed.passthrough });\n      case 'login':\n        return await runLogin(ctx, {\n          host: parsed.flags.host as string | undefined,\n          force: parsed.flags.force === true,\n          cwd,\n          env,\n        });\n      case 'logout':\n        return await runLogout(ctx, {\n          host: parsed.flags.host as string | undefined,\n          all: parsed.flags.all === true,\n          cwd,\n          env,\n        });\n      case 'whoami':\n        return await runWhoami(ctx, {\n          host: parsed.flags.host as string | undefined,\n          cwd,\n          env,\n        });\n      case 'status':\n        return await runStatus(ctx, {\n          host: parsed.flags.host as string | undefined,\n          dir,\n          env,\n          findings: parsed.flags.findings === true,\n          watch: parsed.flags.watch === true,\n          sleep: options.sleep,\n        });\n      case 'sources':\n        return await runSources(ctx, {\n          host: parsed.flags.host as string | undefined,\n          dir,\n          env,\n        });\n      case 'use':\n        return await runUse(ctx, {\n          host: parsed.flags.host as string | undefined,\n          dir,\n          slug: parsed.positionals[0],\n          env,\n        });\n      case 'publish':\n        return await runPublish(ctx, {\n          host: parsed.flags.host as string | undefined,\n          source: parsed.flags.source as string | undefined,\n          dir,\n          yes: parsed.flags.yes === true,\n          env,\n          stdinIsTTY: options.stdinIsTTY,\n          confirm: options.confirm,\n        });\n      case 'upgrade':\n        return await runUpgrade(ctx, {\n          dir,\n          host: parsed.flags.host as string | undefined,\n          env,\n          check: parsed.flags.check === true,\n          yes: parsed.flags.yes === true,\n          noVerify: parsed.flags.verify === false,\n          stdinIsTTY: options.stdinIsTTY,\n          confirm: options.confirm,\n        });\n      default:\n        // Unreachable — COMMANDS gate above — but keeps the switch total.\n        throw usageError(\n          `Unknown command \"${command}\".`,\n          `Run one of: ${COMMANDS.join(', ')}.`,\n        );\n    }\n  } catch (error) {\n    return ctx.fail(toCliError(error));\n  }\n}\n\n/**\n * Presence of `--json` (or `--no-json`) BEFORE the first `--` passthrough.\n *\n * Tri-state on purpose. `undefined` means \"the user expressed no preference\",\n * which is what lets the context fall back to inferring the mode from a\n * non-TTY stdout or CLAUDECODE. Collapsing `--no-json` to `false` here would\n * make it indistinguishable from absence, and the flag could then never turn\n * JSON mode OFF in exactly the cases it exists for.\n */\nfunction scanJsonFlag(argv: readonly string[]): boolean | undefined {\n  for (const token of argv) {\n    if (token === '--') break;\n    if (token === '--json') return true;\n    if (token === '--no-json') return false;\n  }\n  return undefined;\n}\n\nfunction scanFlagPresence(argv: readonly string[], name: string): boolean {\n  for (const token of argv) {\n    if (token === '--') break;\n    if (token === `--${name}`) return true;\n  }\n  return false;\n}\n\n/**\n * Split argv into the command (first bare token before `--`) and the rest\n * (everything else, order preserved, including global flags and the `--`\n * passthrough). Global flags are all booleans, so any bare token is the\n * command — no value-consumption ambiguity.\n */\nfunction splitCommand(argv: readonly string[]): {\n  command: string | null;\n  rest: string[];\n} {\n  for (let i = 0; i < argv.length; i++) {\n    const token = argv[i]!;\n    if (token === '--') break;\n    if (!token.startsWith('-')) {\n      return {\n        command: token,\n        rest: [...argv.slice(0, i), ...argv.slice(i + 1)],\n      };\n    }\n  }\n  return { command: null, rest: [...argv] };\n}\n\n/**\n * The CLI's own version, read from the package manifest at runtime rather than\n * baked in by the build — one source of truth, so a release bump cannot leave\n * `--version` reporting a stale number. The path resolves identically from\n * `src/index.ts` and from the emitted `dist/index.js`, both of which sit one\n * directory below the package root.\n */\nfunction readVersion(): string {\n  const manifest = new URL('../package.json', import.meta.url);\n  const parsed: unknown = JSON.parse(fs.readFileSync(manifest, 'utf8'));\n\n  return typeof parsed === 'object' &&\n    parsed !== null &&\n    'version' in parsed &&\n    typeof parsed.version === 'string'\n    ? parsed.version\n    : '0.0.0';\n}\n\nfunction emitVersion(ctx: CliContext): number {\n  const version = readVersion();\n\n  return ctx.succeed({ name: 'ekanos', version }, version);\n}\n\nfunction emitHelp(ctx: CliContext): number {\n  ctx.emitClaudeCodeHint({\n    tool: 'ekanos',\n    commands: COMMANDS,\n    usage: USAGE,\n    exitCodes: EXIT_CODES,\n  });\n  return ctx.succeed({ usage: USAGE, commands: COMMANDS }, USAGE);\n}\n\nfunction emitCommandHelp(ctx: CliContext, command: string): number {\n  const specs = COMMAND_SPECS[command] ?? {};\n  const flags = Object.keys(specs).map((name) => `--${name}`);\n  const help = `Usage: ekanos ${command} [${flags.join('] [')}]`;\n  ctx.emitClaudeCodeHint({ tool: 'ekanos', command, flags });\n  return ctx.succeed({ command, flags }, help);\n}\n"]}

package/dist/publish-api.d.ts

@@ -29,15 +29,26 @@
  *                                                 auth-gated Fusion page
  *                                                 answers 307)
  *
- *   GET /api/partner/submissions?source=<slug|id>  [Authorization: Bearer]
+ *   GET /api/partner/submissions?source=<slug|id>[&detail=findings]
+ *       [Authorization: Bearer]
  *     → 200 { ok: true, data: { source, integrations: [{ id, slug, name,
  *             createdAt, versions: [{ id, version, state, archiveSha256,
- *             submittedAt }] }] } }
+ *             submittedAt, gatedAt,
+ *             // present once a gate has run (gate_report is non-null):
+ *             errorCount?, warnCount?,
+ *             // present ONLY with ?detail=findings, alongside the above:
+ *             findings?, stages?
+ *           }] }] } }
  *     → 400 { error, code: "INVALID_REQUEST" }
  *     → 401 { error, code: "AUTH_REQUIRED" }      refresh once and retry
  *     → 403 { error, code: "MFA_REQUIRED" }
  *     → 404 { error, code: "SOURCE_NOT_FOUND" }
  *     → 3xx                                       treated as 401
+ *
+ *   `state` walks submitted -> gated|rejected -> dev -> prod -> revoked (see
+ *   the trigger in apps/web/supabase/schemas/110-partner-submissions.sql for
+ *   the full transition matrix). `gated`/`dev`/`rejected` are the
+ *   terminal-for-waiting states `ekanos status --watch` polls for.
  * ---------------------------------------------------------------------------
  */
 /**
@@ -71,12 +82,39 @@ export type SubmitResult = {
     status: 'unauthorized';
 };
 export declare function submitArchive(host: string, accessToken: string, payload: SubmissionPayload): Promise<SubmitResult>;
+/**
+ * One gate finding, mirroring `@ekanos/integration-schema`'s `Finding` shape
+ * (the same one `validate`/`publish` carry in `data.findings`). Declared
+ * locally rather than imported: the gate's own report type lives in
+ * `@ekanos/checks`, a server-side/toolchain package this partner-facing CLI
+ * has no business depending on — the wire shape is the only contract.
+ */
+export interface GateFinding {
+    check: string;
+    severity: 'error' | 'warn' | 'info';
+    file?: string;
+    line?: number;
+    message: string;
+    hint: string;
+}
+export interface GateStageResult {
+    id: string;
+    status: 'pass' | 'fail' | 'skipped';
+    durationMs: number;
+}
 export interface SubmissionVersion {
     id: string;
     version: string;
     state: string;
     archiveSha256: string | null;
     submittedAt: string | null;
+    gatedAt: string | null;
+    /** Present once a gate has run. */
+    errorCount: number | null;
+    warnCount: number | null;
+    /** Present only when the request passed `?detail=findings`. */
+    findings?: GateFinding[];
+    stages?: GateStageResult[];
 }
 export interface SubmissionListing {
     id: string;
@@ -97,7 +135,13 @@ export type ListResult = {
  * List the caller's visible submissions for a source. Same authorization model
  * as `submitArchive`: the seat SELECT policies filter server-side, so a caller
  * with no seat sees an empty list rather than an error.
+ *
+ * `detail: 'findings'` requests the full per-version findings/stages arrays
+ * (used by `status --findings` and `status --watch`); omitted, the server
+ * answers with counts only — see the wire contract above.
  */
-export declare function listSubmissions(host: string, accessToken: string, source: string): Promise<ListResult>;
+export declare function listSubmissions(host: string, accessToken: string, source: string, options?: {
+    detail?: 'findings';
+}): Promise<ListResult>;
 /** Guard for the "still unauthorized after one refresh" terminal case. */
 export declare function stillUnauthorized(host: string): never;

package/dist/publish-api.js

@@ -31,15 +31,26 @@ import { authRequiredError, forbiddenError, invalidStateError, networkError, not
  *                                                 auth-gated Fusion page
  *                                                 answers 307)
  *
- *   GET /api/partner/submissions?source=<slug|id>  [Authorization: Bearer]
+ *   GET /api/partner/submissions?source=<slug|id>[&detail=findings]
+ *       [Authorization: Bearer]
  *     → 200 { ok: true, data: { source, integrations: [{ id, slug, name,
  *             createdAt, versions: [{ id, version, state, archiveSha256,
- *             submittedAt }] }] } }
+ *             submittedAt, gatedAt,
+ *             // present once a gate has run (gate_report is non-null):
+ *             errorCount?, warnCount?,
+ *             // present ONLY with ?detail=findings, alongside the above:
+ *             findings?, stages?
+ *           }] }] } }
  *     → 400 { error, code: "INVALID_REQUEST" }
  *     → 401 { error, code: "AUTH_REQUIRED" }      refresh once and retry
  *     → 403 { error, code: "MFA_REQUIRED" }
  *     → 404 { error, code: "SOURCE_NOT_FOUND" }
  *     → 3xx                                       treated as 401
+ *
+ *   `state` walks submitted -> gated|rejected -> dev -> prod -> revoked (see
+ *   the trigger in apps/web/supabase/schemas/110-partner-submissions.sql for
+ *   the full transition matrix). `gated`/`dev`/`rejected` are the
+ *   terminal-for-waiting states `ekanos status --watch` polls for.
  * ---------------------------------------------------------------------------
  */
 /**
@@ -118,10 +129,17 @@ export async function submitArchive(host, accessToken, payload) {
  * List the caller's visible submissions for a source. Same authorization model
  * as `submitArchive`: the seat SELECT policies filter server-side, so a caller
  * with no seat sees an empty list rather than an error.
+ *
+ * `detail: 'findings'` requests the full per-version findings/stages arrays
+ * (used by `status --findings` and `status --watch`); omitted, the server
+ * answers with counts only — see the wire contract above.
  */
-export async function listSubmissions(host, accessToken, source) {
+export async function listSubmissions(host, accessToken, source, options = {}) {
     var _a;
-    const response = await request(`${host}/api/partner/submissions?source=${encodeURIComponent(source)}`, {
+    const query = new URLSearchParams({ source });
+    if (options.detail)
+        query.set('detail', options.detail);
+    const response = await request(`${host}/api/partner/submissions?${query.toString()}`, {
         method: 'GET',
         headers: {
             accept: 'application/json',
@@ -166,13 +184,11 @@ export async function listSubmissions(host, accessToken, source) {
                 .filter((version) => typeof version === 'object' && version !== null)
                 .map((version) => {
                 var _a, _b, _c;
-                return ({
-                    id: (_a = str(version.id)) !== null && _a !== void 0 ? _a : '',
-                    version: (_b = str(version.version)) !== null && _b !== void 0 ? _b : '',
-                    state: (_c = str(version.state)) !== null && _c !== void 0 ? _c : '',
-                    archiveSha256: str(version.archiveSha256),
-                    submittedAt: str(version.submittedAt),
-                });
+                return (Object.assign(Object.assign({ id: (_a = str(version.id)) !== null && _a !== void 0 ? _a : '', version: (_b = str(version.version)) !== null && _b !== void 0 ? _b : '', state: (_c = str(version.state)) !== null && _c !== void 0 ? _c : '', archiveSha256: str(version.archiveSha256), submittedAt: str(version.submittedAt), gatedAt: str(version.gatedAt), errorCount: num(version.errorCount), warnCount: num(version.warnCount) }, (Array.isArray(version.findings)
+                    ? { findings: version.findings }
+                    : {})), (Array.isArray(version.stages)
+                    ? { stages: version.stages }
+                    : {})));
             }),
         });
     });
@@ -199,4 +215,7 @@ function isRedirect(status) {
 function str(value) {
     return typeof value === 'string' && value.length > 0 ? value : null;
 }
+function num(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : null;
+}
 //# sourceMappingURL=publish-api.js.map

package/dist/publish-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish-api.js","sourceRoot":"","sources":["../src/publish-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,eAAe,GAChB,MAAM,UAAU,CAAC;AAElB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AAwB5C,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,WAAmB,EACnB,OAA0B;;IAE1B,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CACT,SAAS;IACT,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,IAAI,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,EACzE,aAAa,CACd,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,0BAA0B,EAAE;QAChE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;QACD,IAAI,EAAE,IAAI;KACX,CAAC,CAAC;IAEH,yEAAyE;IACzE,oEAAoE;IACpE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAEtC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,cAAc,CAClB,aAAa,aAAb,aAAa,cAAb,aAAa,GACX,GAAG,IAAI,0DAA0D;YAC/D,6BAA6B,OAAO,CAAC,MAAM,IAAI,EACnD,uEAAuE;YACrE,IAAI,OAAO,CAAC,MAAM,gBAAgB,CACrC,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,aAAa,CACjB,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,GAAG,IAAI,6BAA6B,OAAO,CAAC,MAAM,IAAI,EACvE,kEAAkE;YAChE,iDAAiD,CACpD,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,aAAa,aAAb,aAAa,cAAb,aAAa,GACX,WAAW,OAAO,CAAC,OAAO,QAAQ,OAAO,CAAC,IAAI,yBAAyB,EACzE,gEAAgE;YAC9D,iCAAiC,CACpC,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,MAAM,eAAe,CACnB,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,GAAG,IAAI,sCAAsC,EAC9D,uEAAuE;YACrE,qEAAqE,CACxE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,sCAAsC,QAAQ,CAAC,MAAM,GAAG,EAC/D,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,mEAAmE;gBACjE,8CAA8C;YAClD,CAAC,CAAC,+DAA+D;gBAC7D,yCAAyC,CAChD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAA,IAAI,CAAC,IAAI,mCAAI,EAAE,CAA4B,CAAC;IAC1D,MAAM,OAAO,GAAG;QACd,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;QACpC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QACpB,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;QAC1B,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QACtB,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC;KACvC,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,YAAY,CAChB,GAAG,IAAI,8DAA8D,EACrE,qEAAqE;YACnE,oEAAoE;YACpE,qCAAqC,CACxC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAA4B,EAAE,CAAC;AACjE,CAAC;AAuBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,WAAmB,EACnB,MAAc;;IAEd,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,mCAAmC,kBAAkB,CAAC,MAAM,CAAC,EAAE,EACtE;QACE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;KACF,CACF,CAAC;IAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAEtC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,cAAc,CAClB,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,GAAG,IAAI,qCAAqC,MAAM,IAAI,EACvE,gEAAgE;YAC9D,wBAAwB,IAAI,UAAU,CACzC,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,aAAa,CACjB,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,GAAG,IAAI,6BAA6B,MAAM,IAAI,EAC/D,oEAAoE;YAClE,qCAAqC,CACxC,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,eAAe,CACnB,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,GAAG,IAAI,kCAAkC,EAC1D,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,sCAAsC,QAAQ,CAAC,MAAM,GAAG,EAC/D,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,mEAAmE;gBACjE,8CAA8C;YAClD,CAAC,CAAC,+DAA+D;gBAC7D,yCAAyC,CAChD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAA,IAAI,CAAC,IAAI,mCAAI,EAAE,CAA4B,CAAC;IAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvE,MAAM,YAAY,GAAG,IAAI;SACtB,MAAM,CACL,CAAC,GAAG,EAAkC,EAAE,CACtC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAC1C;SACA,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;;QAAC,OAAA,CAAC;YACb,EAAE,EAAE,MAAA,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,mCAAI,EAAE;YACrB,IAAI,EAAE,MAAA,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAI,EAAE;YACzB,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YACnB,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC;YAC7B,QAAQ,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxD,MAAM,CACL,CAAC,OAAO,EAAsC,EAAE,CAC9C,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAClD;iBACA,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;;gBAAC,OAAA,CAAC;oBACjB,EAAE,EAAE,MAAA,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,mCAAI,EAAE;oBACzB,OAAO,EAAE,MAAA,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,mCAAI,EAAE;oBACnC,KAAK,EAAE,MAAA,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,mCAAI,EAAE;oBAC/B,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;oBACzC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC;iBACtC,CAAC,CAAA;aAAA,CAAC;SACN,CAAC,CAAA;KAAA,CAAC,CAAC;IAEN,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACxC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,iBAAiB,CACrB,mBAAmB,IAAI,sCAAsC,EAC7D,4BAA4B,IAAI,cAAc,CAC/C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;AACvC,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC","sourcesContent":["import { request } from './auth/fusion-api';\nimport {\n  authRequiredError,\n  forbiddenError,\n  invalidStateError,\n  networkError,\n  notFoundError,\n  validationError,\n} from './errors';\n\n/**\n * The CLI's client for the Fusion submission intake route.\n *\n * ---------------------------------------------------------------------------\n * WIRE CONTRACT — the seam between this package and the Fusion web app.\n *\n * The server side lives in `apps/web/app/api/partner/submissions/route.ts`.\n * As with the auth routes (see `auth/fusion-api.ts`), the two halves are\n * coupled only by HTTP; tests stub `fetch`, never the route.\n *\n *   POST /api/partner/submissions    [Authorization: Bearer <access_token>]\n *     ← multipart/form-data:\n *         source   — Fusion source slug\n *         slug     — integration slug (kebab-case)\n *         version  — semver\n *         manifest — JSON string (the parsed ekanos.json + declaration summary)\n *         archive  — gzipped tarball, ≤ 4 MiB\n *     → 201 { ok: true, data: { submissionId, slug, version, state,\n *                               archiveSha256 } }\n *     → 400 { error, code: \"INVALID_REQUEST\" | \"INVALID_ARCHIVE\" }\n *     → 401 { error, code: \"AUTH_REQUIRED\" }      token absent or expired —\n *                                                 refresh once and retry\n *     → 403 { error, code: \"FORBIDDEN\" }          no developer seat on the source\n *     → 404 { error, code: \"SOURCE_NOT_FOUND\" }\n *     → 409 { error, code: \"VERSION_EXISTS\" }     this (slug, version) is\n *                                                 already submitted\n *     → 413 { error, code: \"ARCHIVE_TOO_LARGE\" }\n *     → 3xx                                       treated as 401 (an\n *                                                 auth-gated Fusion page\n *                                                 answers 307)\n *\n *   GET /api/partner/submissions?source=<slug|id>  [Authorization: Bearer]\n *     → 200 { ok: true, data: { source, integrations: [{ id, slug, name,\n *             createdAt, versions: [{ id, version, state, archiveSha256,\n *             submittedAt }] }] } }\n *     → 400 { error, code: \"INVALID_REQUEST\" }\n *     → 401 { error, code: \"AUTH_REQUIRED\" }      refresh once and retry\n *     → 403 { error, code: \"MFA_REQUIRED\" }\n *     → 404 { error, code: \"SOURCE_NOT_FOUND\" }\n *     → 3xx                                       treated as 401\n * ---------------------------------------------------------------------------\n */\n\n/**\n * The server's manifest cap — 64 KiB of UTF-8, enforced in\n * `apps/web/app/api/partner/submissions/_lib/submission-validation.ts` against\n * `Buffer.byteLength`. Mirrored here so `publish` can refuse an oversized\n * manifest with a clear message instead of the server's generic 400.\n */\nexport const MAX_MANIFEST_BYTES = 64 * 1024;\n\nexport interface SubmissionPayload {\n  source: string;\n  slug: string;\n  version: string;\n  /** JSON string — already serialized by the caller. */\n  manifest: string;\n  archive: Uint8Array;\n}\n\nexport interface SubmissionReceipt {\n  submissionId: string;\n  slug: string;\n  version: string;\n  state: string;\n  archiveSha256: string;\n}\n\nexport type SubmitResult =\n  | { status: 'ok'; receipt: SubmissionReceipt }\n  /** The bearer token did not authenticate — refresh and retry, once. */\n  | { status: 'unauthorized' };\n\nexport async function submitArchive(\n  host: string,\n  accessToken: string,\n  payload: SubmissionPayload,\n): Promise<SubmitResult> {\n  const form = new FormData();\n  form.append('source', payload.source);\n  form.append('slug', payload.slug);\n  form.append('version', payload.version);\n  form.append('manifest', payload.manifest);\n  form.append(\n    'archive',\n    // Copy into a fresh Uint8Array: Buffer is Uint8Array<ArrayBufferLike>,\n    // which BlobPart refuses (a SharedArrayBuffer view is not a BlobPart).\n    new Blob([new Uint8Array(payload.archive)], { type: 'application/gzip' }),\n    'archive.tgz',\n  );\n\n  const response = await request(`${host}/api/partner/submissions`, {\n    method: 'POST',\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${accessToken}`,\n    },\n    body: form,\n  });\n\n  // 401, or the 307 an auth-gated Fusion route answers with: the token did\n  // not authenticate. The caller owns the refresh-and-retry decision.\n  if (response.status === 401 || isRedirect(response.status)) {\n    return { status: 'unauthorized' };\n  }\n\n  const body = await readOptionalJson(response);\n  const serverMessage = str(body.error);\n\n  if (response.status === 403) {\n    throw forbiddenError(\n      serverMessage ??\n        `${host} refused the submission: this account does not hold the ` +\n          `developer seat on source \"${payload.source}\".`,\n      `Ask the source operator to grant your account the developer seat for ` +\n        `\"${payload.source}\", then retry.`,\n    );\n  }\n\n  if (response.status === 404) {\n    throw notFoundError(\n      serverMessage ?? `${host} has no source with slug \"${payload.source}\".`,\n      `Check the --source value (or the \"source\" field in ekanos.json) ` +\n        `against the slug your Fusion operator gave you.`,\n    );\n  }\n\n  if (response.status === 409) {\n    throw invalidStateError(\n      serverMessage ??\n        `Version ${payload.version} of \"${payload.slug}\" is already submitted.`,\n      `Submitted versions are immutable. Bump the \"version\" field in ` +\n        `package.json and publish again.`,\n    );\n  }\n\n  if (response.status === 400 || response.status === 413) {\n    throw validationError(\n      serverMessage ?? `${host} rejected the submission as invalid.`,\n      `Fix the reported problem and re-run \"ekanos publish\". If the message ` +\n        `names the archive, re-check the project layout (\"ekanos validate\").`,\n    );\n  }\n\n  if (!response.ok) {\n    throw networkError(\n      `${host}/api/partner/submissions responded ${response.status}.`,\n      response.status >= 500\n        ? `The Fusion deployment returned a server error. Retry shortly; if ` +\n            `it persists, report it with the status code.`\n        : `Confirm the host is a Fusion deployment running a build that ` +\n            `includes the partner submissions route.`,\n    );\n  }\n\n  const data = (body.data ?? {}) as Record<string, unknown>;\n  const receipt = {\n    submissionId: str(data.submissionId),\n    slug: str(data.slug),\n    version: str(data.version),\n    state: str(data.state),\n    archiveSha256: str(data.archiveSha256),\n  };\n\n  if (Object.values(receipt).some((value) => value === null)) {\n    throw networkError(\n      `${host} accepted the submission but returned an incomplete receipt.`,\n      `Confirm the deployment is running a Fusion build that includes the ` +\n        `partner submissions route, then check the submission's state with ` +\n        `your operator before re-publishing.`,\n    );\n  }\n\n  return { status: 'ok', receipt: receipt as SubmissionReceipt };\n}\n\nexport interface SubmissionVersion {\n  id: string;\n  version: string;\n  state: string;\n  archiveSha256: string | null;\n  submittedAt: string | null;\n}\n\nexport interface SubmissionListing {\n  id: string;\n  slug: string;\n  name: string | null;\n  createdAt: string | null;\n  versions: SubmissionVersion[];\n}\n\nexport type ListResult =\n  | { status: 'ok'; integrations: SubmissionListing[] }\n  /** The bearer token did not authenticate — refresh and retry, once. */\n  | { status: 'unauthorized' };\n\n/**\n * List the caller's visible submissions for a source. Same authorization model\n * as `submitArchive`: the seat SELECT policies filter server-side, so a caller\n * with no seat sees an empty list rather than an error.\n */\nexport async function listSubmissions(\n  host: string,\n  accessToken: string,\n  source: string,\n): Promise<ListResult> {\n  const response = await request(\n    `${host}/api/partner/submissions?source=${encodeURIComponent(source)}`,\n    {\n      method: 'GET',\n      headers: {\n        accept: 'application/json',\n        authorization: `Bearer ${accessToken}`,\n      },\n    },\n  );\n\n  if (response.status === 401 || isRedirect(response.status)) {\n    return { status: 'unauthorized' };\n  }\n\n  const body = await readOptionalJson(response);\n  const serverMessage = str(body.error);\n\n  if (response.status === 403) {\n    throw forbiddenError(\n      serverMessage ?? `${host} refused to list submissions for \"${source}\".`,\n      `Complete MFA in the browser if the message names it, then run ` +\n        `\"ekanos login --host ${host}\" again.`,\n    );\n  }\n\n  if (response.status === 404) {\n    throw notFoundError(\n      serverMessage ?? `${host} has no source with slug \"${source}\".`,\n      `Check the \"source\" field in ekanos.json (or --source) against the ` +\n        `slug your Fusion operator gave you.`,\n    );\n  }\n\n  if (response.status === 400) {\n    throw validationError(\n      serverMessage ?? `${host} rejected the submissions query.`,\n      `Fix the reported problem and re-run \"ekanos status\".`,\n    );\n  }\n\n  if (!response.ok) {\n    throw networkError(\n      `${host}/api/partner/submissions responded ${response.status}.`,\n      response.status >= 500\n        ? `The Fusion deployment returned a server error. Retry shortly; if ` +\n            `it persists, report it with the status code.`\n        : `Confirm the host is a Fusion deployment running a build that ` +\n            `includes the partner submissions route.`,\n    );\n  }\n\n  const data = (body.data ?? {}) as Record<string, unknown>;\n  const rows = Array.isArray(data.integrations) ? data.integrations : [];\n\n  const integrations = rows\n    .filter(\n      (row): row is Record<string, unknown> =>\n        typeof row === 'object' && row !== null,\n    )\n    .map((row) => ({\n      id: str(row.id) ?? '',\n      slug: str(row.slug) ?? '',\n      name: str(row.name),\n      createdAt: str(row.createdAt),\n      versions: (Array.isArray(row.versions) ? row.versions : [])\n        .filter(\n          (version): version is Record<string, unknown> =>\n            typeof version === 'object' && version !== null,\n        )\n        .map((version) => ({\n          id: str(version.id) ?? '',\n          version: str(version.version) ?? '',\n          state: str(version.state) ?? '',\n          archiveSha256: str(version.archiveSha256),\n          submittedAt: str(version.submittedAt),\n        })),\n    }));\n\n  return { status: 'ok', integrations };\n}\n\n/** Guard for the \"still unauthorized after one refresh\" terminal case. */\nexport function stillUnauthorized(host: string): never {\n  throw authRequiredError(\n    `The session for ${host} could not authorize the submission.`,\n    `Run \"ekanos login --host ${host}\" and retry.`,\n  );\n}\n\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n\nfunction isRedirect(status: number): boolean {\n  return status >= 300 && status < 400;\n}\n\nfunction str(value: unknown): string | null {\n  return typeof value === 'string' && value.length > 0 ? value : null;\n}\n"]}
+{"version":3,"file":"publish-api.js","sourceRoot":"","sources":["../src/publish-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,eAAe,GAChB,MAAM,UAAU,CAAC;AAElB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AAwB5C,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,WAAmB,EACnB,OAA0B;;IAE1B,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CACT,SAAS;IACT,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,IAAI,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,EACzE,aAAa,CACd,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,0BAA0B,EAAE;QAChE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;QACD,IAAI,EAAE,IAAI;KACX,CAAC,CAAC;IAEH,yEAAyE;IACzE,oEAAoE;IACpE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAEtC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,cAAc,CAClB,aAAa,aAAb,aAAa,cAAb,aAAa,GACX,GAAG,IAAI,0DAA0D;YAC/D,6BAA6B,OAAO,CAAC,MAAM,IAAI,EACnD,uEAAuE;YACrE,IAAI,OAAO,CAAC,MAAM,gBAAgB,CACrC,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,aAAa,CACjB,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,GAAG,IAAI,6BAA6B,OAAO,CAAC,MAAM,IAAI,EACvE,kEAAkE;YAChE,iDAAiD,CACpD,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,aAAa,aAAb,aAAa,cAAb,aAAa,GACX,WAAW,OAAO,CAAC,OAAO,QAAQ,OAAO,CAAC,IAAI,yBAAyB,EACzE,gEAAgE;YAC9D,iCAAiC,CACpC,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,MAAM,eAAe,CACnB,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,GAAG,IAAI,sCAAsC,EAC9D,uEAAuE;YACrE,qEAAqE,CACxE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,sCAAsC,QAAQ,CAAC,MAAM,GAAG,EAC/D,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,mEAAmE;gBACjE,8CAA8C;YAClD,CAAC,CAAC,+DAA+D;gBAC7D,yCAAyC,CAChD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAA,IAAI,CAAC,IAAI,mCAAI,EAAE,CAA4B,CAAC;IAC1D,MAAM,OAAO,GAAG;QACd,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;QACpC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QACpB,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;QAC1B,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QACtB,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC;KACvC,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,YAAY,CAChB,GAAG,IAAI,8DAA8D,EACrE,qEAAqE;YACnE,oEAAoE;YACpE,qCAAqC,CACxC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAA4B,EAAE,CAAC;AACjE,CAAC;AAoDD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,WAAmB,EACnB,MAAc,EACd,UAAmC,EAAE;;IAErC,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,4BAA4B,KAAK,CAAC,QAAQ,EAAE,EAAE,EACrD;QACE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;KACF,CACF,CAAC;IAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAEtC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,cAAc,CAClB,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,GAAG,IAAI,qCAAqC,MAAM,IAAI,EACvE,gEAAgE;YAC9D,wBAAwB,IAAI,UAAU,CACzC,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,aAAa,CACjB,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,GAAG,IAAI,6BAA6B,MAAM,IAAI,EAC/D,oEAAoE;YAClE,qCAAqC,CACxC,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,eAAe,CACnB,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,GAAG,IAAI,kCAAkC,EAC1D,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,sCAAsC,QAAQ,CAAC,MAAM,GAAG,EAC/D,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,mEAAmE;gBACjE,8CAA8C;YAClD,CAAC,CAAC,+DAA+D;gBAC7D,yCAAyC,CAChD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAA,IAAI,CAAC,IAAI,mCAAI,EAAE,CAA4B,CAAC;IAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAEvE,MAAM,YAAY,GAAG,IAAI;SACtB,MAAM,CACL,CAAC,GAAG,EAAkC,EAAE,CACtC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAC1C;SACA,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;;QAAC,OAAA,CAAC;YACb,EAAE,EAAE,MAAA,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,mCAAI,EAAE;YACrB,IAAI,EAAE,MAAA,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAI,EAAE;YACzB,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YACnB,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC;YAC7B,QAAQ,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxD,MAAM,CACL,CAAC,OAAO,EAAsC,EAAE,CAC9C,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAClD;iBACA,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;;gBAAC,OAAA,+BAChB,EAAE,EAAE,MAAA,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,mCAAI,EAAE,EACzB,OAAO,EAAE,MAAA,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,mCAAI,EAAE,EACnC,KAAK,EAAE,MAAA,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,mCAAI,EAAE,EAC/B,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,EACzC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,EACrC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,EAC7B,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EACnC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,IAC9B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;oBACjC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAyB,EAAE;oBACjD,CAAC,CAAC,EAAE,CAAC,GACJ,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;oBAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAA2B,EAAE;oBACjD,CAAC,CAAC,EAAE,CAAC,EACP,CAAA;aAAA,CAAC;SACN,CAAC,CAAA;KAAA,CAAC,CAAC;IAEN,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACxC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,iBAAiB,CACrB,mBAAmB,IAAI,sCAAsC,EAC7D,4BAA4B,IAAI,cAAc,CAC/C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;AACvC,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5E,CAAC","sourcesContent":["import { request } from './auth/fusion-api';\nimport {\n  authRequiredError,\n  forbiddenError,\n  invalidStateError,\n  networkError,\n  notFoundError,\n  validationError,\n} from './errors';\n\n/**\n * The CLI's client for the Fusion submission intake route.\n *\n * ---------------------------------------------------------------------------\n * WIRE CONTRACT — the seam between this package and the Fusion web app.\n *\n * The server side lives in `apps/web/app/api/partner/submissions/route.ts`.\n * As with the auth routes (see `auth/fusion-api.ts`), the two halves are\n * coupled only by HTTP; tests stub `fetch`, never the route.\n *\n *   POST /api/partner/submissions    [Authorization: Bearer <access_token>]\n *     ← multipart/form-data:\n *         source   — Fusion source slug\n *         slug     — integration slug (kebab-case)\n *         version  — semver\n *         manifest — JSON string (the parsed ekanos.json + declaration summary)\n *         archive  — gzipped tarball, ≤ 4 MiB\n *     → 201 { ok: true, data: { submissionId, slug, version, state,\n *                               archiveSha256 } }\n *     → 400 { error, code: \"INVALID_REQUEST\" | \"INVALID_ARCHIVE\" }\n *     → 401 { error, code: \"AUTH_REQUIRED\" }      token absent or expired —\n *                                                 refresh once and retry\n *     → 403 { error, code: \"FORBIDDEN\" }          no developer seat on the source\n *     → 404 { error, code: \"SOURCE_NOT_FOUND\" }\n *     → 409 { error, code: \"VERSION_EXISTS\" }     this (slug, version) is\n *                                                 already submitted\n *     → 413 { error, code: \"ARCHIVE_TOO_LARGE\" }\n *     → 3xx                                       treated as 401 (an\n *                                                 auth-gated Fusion page\n *                                                 answers 307)\n *\n *   GET /api/partner/submissions?source=<slug|id>[&detail=findings]\n *       [Authorization: Bearer]\n *     → 200 { ok: true, data: { source, integrations: [{ id, slug, name,\n *             createdAt, versions: [{ id, version, state, archiveSha256,\n *             submittedAt, gatedAt,\n *             // present once a gate has run (gate_report is non-null):\n *             errorCount?, warnCount?,\n *             // present ONLY with ?detail=findings, alongside the above:\n *             findings?, stages?\n *           }] }] } }\n *     → 400 { error, code: \"INVALID_REQUEST\" }\n *     → 401 { error, code: \"AUTH_REQUIRED\" }      refresh once and retry\n *     → 403 { error, code: \"MFA_REQUIRED\" }\n *     → 404 { error, code: \"SOURCE_NOT_FOUND\" }\n *     → 3xx                                       treated as 401\n *\n *   `state` walks submitted -> gated|rejected -> dev -> prod -> revoked (see\n *   the trigger in apps/web/supabase/schemas/110-partner-submissions.sql for\n *   the full transition matrix). `gated`/`dev`/`rejected` are the\n *   terminal-for-waiting states `ekanos status --watch` polls for.\n * ---------------------------------------------------------------------------\n */\n\n/**\n * The server's manifest cap — 64 KiB of UTF-8, enforced in\n * `apps/web/app/api/partner/submissions/_lib/submission-validation.ts` against\n * `Buffer.byteLength`. Mirrored here so `publish` can refuse an oversized\n * manifest with a clear message instead of the server's generic 400.\n */\nexport const MAX_MANIFEST_BYTES = 64 * 1024;\n\nexport interface SubmissionPayload {\n  source: string;\n  slug: string;\n  version: string;\n  /** JSON string — already serialized by the caller. */\n  manifest: string;\n  archive: Uint8Array;\n}\n\nexport interface SubmissionReceipt {\n  submissionId: string;\n  slug: string;\n  version: string;\n  state: string;\n  archiveSha256: string;\n}\n\nexport type SubmitResult =\n  | { status: 'ok'; receipt: SubmissionReceipt }\n  /** The bearer token did not authenticate — refresh and retry, once. */\n  | { status: 'unauthorized' };\n\nexport async function submitArchive(\n  host: string,\n  accessToken: string,\n  payload: SubmissionPayload,\n): Promise<SubmitResult> {\n  const form = new FormData();\n  form.append('source', payload.source);\n  form.append('slug', payload.slug);\n  form.append('version', payload.version);\n  form.append('manifest', payload.manifest);\n  form.append(\n    'archive',\n    // Copy into a fresh Uint8Array: Buffer is Uint8Array<ArrayBufferLike>,\n    // which BlobPart refuses (a SharedArrayBuffer view is not a BlobPart).\n    new Blob([new Uint8Array(payload.archive)], { type: 'application/gzip' }),\n    'archive.tgz',\n  );\n\n  const response = await request(`${host}/api/partner/submissions`, {\n    method: 'POST',\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${accessToken}`,\n    },\n    body: form,\n  });\n\n  // 401, or the 307 an auth-gated Fusion route answers with: the token did\n  // not authenticate. The caller owns the refresh-and-retry decision.\n  if (response.status === 401 || isRedirect(response.status)) {\n    return { status: 'unauthorized' };\n  }\n\n  const body = await readOptionalJson(response);\n  const serverMessage = str(body.error);\n\n  if (response.status === 403) {\n    throw forbiddenError(\n      serverMessage ??\n        `${host} refused the submission: this account does not hold the ` +\n          `developer seat on source \"${payload.source}\".`,\n      `Ask the source operator to grant your account the developer seat for ` +\n        `\"${payload.source}\", then retry.`,\n    );\n  }\n\n  if (response.status === 404) {\n    throw notFoundError(\n      serverMessage ?? `${host} has no source with slug \"${payload.source}\".`,\n      `Check the --source value (or the \"source\" field in ekanos.json) ` +\n        `against the slug your Fusion operator gave you.`,\n    );\n  }\n\n  if (response.status === 409) {\n    throw invalidStateError(\n      serverMessage ??\n        `Version ${payload.version} of \"${payload.slug}\" is already submitted.`,\n      `Submitted versions are immutable. Bump the \"version\" field in ` +\n        `package.json and publish again.`,\n    );\n  }\n\n  if (response.status === 400 || response.status === 413) {\n    throw validationError(\n      serverMessage ?? `${host} rejected the submission as invalid.`,\n      `Fix the reported problem and re-run \"ekanos publish\". If the message ` +\n        `names the archive, re-check the project layout (\"ekanos validate\").`,\n    );\n  }\n\n  if (!response.ok) {\n    throw networkError(\n      `${host}/api/partner/submissions responded ${response.status}.`,\n      response.status >= 500\n        ? `The Fusion deployment returned a server error. Retry shortly; if ` +\n            `it persists, report it with the status code.`\n        : `Confirm the host is a Fusion deployment running a build that ` +\n            `includes the partner submissions route.`,\n    );\n  }\n\n  const data = (body.data ?? {}) as Record<string, unknown>;\n  const receipt = {\n    submissionId: str(data.submissionId),\n    slug: str(data.slug),\n    version: str(data.version),\n    state: str(data.state),\n    archiveSha256: str(data.archiveSha256),\n  };\n\n  if (Object.values(receipt).some((value) => value === null)) {\n    throw networkError(\n      `${host} accepted the submission but returned an incomplete receipt.`,\n      `Confirm the deployment is running a Fusion build that includes the ` +\n        `partner submissions route, then check the submission's state with ` +\n        `your operator before re-publishing.`,\n    );\n  }\n\n  return { status: 'ok', receipt: receipt as SubmissionReceipt };\n}\n\n/**\n * One gate finding, mirroring `@ekanos/integration-schema`'s `Finding` shape\n * (the same one `validate`/`publish` carry in `data.findings`). Declared\n * locally rather than imported: the gate's own report type lives in\n * `@ekanos/checks`, a server-side/toolchain package this partner-facing CLI\n * has no business depending on — the wire shape is the only contract.\n */\nexport interface GateFinding {\n  check: string;\n  severity: 'error' | 'warn' | 'info';\n  file?: string;\n  line?: number;\n  message: string;\n  hint: string;\n}\n\nexport interface GateStageResult {\n  id: string;\n  status: 'pass' | 'fail' | 'skipped';\n  durationMs: number;\n}\n\nexport interface SubmissionVersion {\n  id: string;\n  version: string;\n  state: string;\n  archiveSha256: string | null;\n  submittedAt: string | null;\n  gatedAt: string | null;\n  /** Present once a gate has run. */\n  errorCount: number | null;\n  warnCount: number | null;\n  /** Present only when the request passed `?detail=findings`. */\n  findings?: GateFinding[];\n  stages?: GateStageResult[];\n}\n\nexport interface SubmissionListing {\n  id: string;\n  slug: string;\n  name: string | null;\n  createdAt: string | null;\n  versions: SubmissionVersion[];\n}\n\nexport type ListResult =\n  | { status: 'ok'; integrations: SubmissionListing[] }\n  /** The bearer token did not authenticate — refresh and retry, once. */\n  | { status: 'unauthorized' };\n\n/**\n * List the caller's visible submissions for a source. Same authorization model\n * as `submitArchive`: the seat SELECT policies filter server-side, so a caller\n * with no seat sees an empty list rather than an error.\n *\n * `detail: 'findings'` requests the full per-version findings/stages arrays\n * (used by `status --findings` and `status --watch`); omitted, the server\n * answers with counts only — see the wire contract above.\n */\nexport async function listSubmissions(\n  host: string,\n  accessToken: string,\n  source: string,\n  options: { detail?: 'findings' } = {},\n): Promise<ListResult> {\n  const query = new URLSearchParams({ source });\n  if (options.detail) query.set('detail', options.detail);\n\n  const response = await request(\n    `${host}/api/partner/submissions?${query.toString()}`,\n    {\n      method: 'GET',\n      headers: {\n        accept: 'application/json',\n        authorization: `Bearer ${accessToken}`,\n      },\n    },\n  );\n\n  if (response.status === 401 || isRedirect(response.status)) {\n    return { status: 'unauthorized' };\n  }\n\n  const body = await readOptionalJson(response);\n  const serverMessage = str(body.error);\n\n  if (response.status === 403) {\n    throw forbiddenError(\n      serverMessage ?? `${host} refused to list submissions for \"${source}\".`,\n      `Complete MFA in the browser if the message names it, then run ` +\n        `\"ekanos login --host ${host}\" again.`,\n    );\n  }\n\n  if (response.status === 404) {\n    throw notFoundError(\n      serverMessage ?? `${host} has no source with slug \"${source}\".`,\n      `Check the \"source\" field in ekanos.json (or --source) against the ` +\n        `slug your Fusion operator gave you.`,\n    );\n  }\n\n  if (response.status === 400) {\n    throw validationError(\n      serverMessage ?? `${host} rejected the submissions query.`,\n      `Fix the reported problem and re-run \"ekanos status\".`,\n    );\n  }\n\n  if (!response.ok) {\n    throw networkError(\n      `${host}/api/partner/submissions responded ${response.status}.`,\n      response.status >= 500\n        ? `The Fusion deployment returned a server error. Retry shortly; if ` +\n            `it persists, report it with the status code.`\n        : `Confirm the host is a Fusion deployment running a build that ` +\n            `includes the partner submissions route.`,\n    );\n  }\n\n  const data = (body.data ?? {}) as Record<string, unknown>;\n  const rows = Array.isArray(data.integrations) ? data.integrations : [];\n\n  const integrations = rows\n    .filter(\n      (row): row is Record<string, unknown> =>\n        typeof row === 'object' && row !== null,\n    )\n    .map((row) => ({\n      id: str(row.id) ?? '',\n      slug: str(row.slug) ?? '',\n      name: str(row.name),\n      createdAt: str(row.createdAt),\n      versions: (Array.isArray(row.versions) ? row.versions : [])\n        .filter(\n          (version): version is Record<string, unknown> =>\n            typeof version === 'object' && version !== null,\n        )\n        .map((version) => ({\n          id: str(version.id) ?? '',\n          version: str(version.version) ?? '',\n          state: str(version.state) ?? '',\n          archiveSha256: str(version.archiveSha256),\n          submittedAt: str(version.submittedAt),\n          gatedAt: str(version.gatedAt),\n          errorCount: num(version.errorCount),\n          warnCount: num(version.warnCount),\n          ...(Array.isArray(version.findings)\n            ? { findings: version.findings as GateFinding[] }\n            : {}),\n          ...(Array.isArray(version.stages)\n            ? { stages: version.stages as GateStageResult[] }\n            : {}),\n        })),\n    }));\n\n  return { status: 'ok', integrations };\n}\n\n/** Guard for the \"still unauthorized after one refresh\" terminal case. */\nexport function stillUnauthorized(host: string): never {\n  throw authRequiredError(\n    `The session for ${host} could not authorize the submission.`,\n    `Run \"ekanos login --host ${host}\" and retry.`,\n  );\n}\n\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n\nfunction isRedirect(status: number): boolean {\n  return status >= 300 && status < 400;\n}\n\nfunction str(value: unknown): string | null {\n  return typeof value === 'string' && value.length > 0 ? value : null;\n}\n\nfunction num(value: unknown): number | null {\n  return typeof value === 'number' && Number.isFinite(value) ? value : null;\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ekanos/cli",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "type": "module",
   "description": "The Ekanos partner toolchain CLI: scaffold, validate, and test a Fusion integration against the published @ekanos packages. Agent-native — every verb speaks JSON with a stable exit-code taxonomy.",
   "license": "MIT",