@ekanos/cli 0.1.9 → 0.2.0

package/dist/auth/fusion-api.js

@@ -5,10 +5,10 @@ import { authRequiredError, networkError, preconditionError } from '../errors.js
  * ---------------------------------------------------------------------------
  * WIRE CONTRACT — the seam between this package and the Fusion web app.
  *
- * The server side lives in `apps/web/app/api/auth/cli-<verb>/route.ts` and ships on
+ * The server side is the host's `/api/auth/cli-<verb>` routes, and it ships on
  * a DIFFERENT BRANCH from this file. This block is the single place the shapes
  * are written down on the client side; if you change one side, change the
- * other and update this block. Nothing here imports from `apps/web` — the two
+ * other and update this block. Nothing here imports host code — the two
  * halves are coupled only by HTTP, and the tests stub `fetch`, never the route.
  *
  *   GET /api/auth/cli-config                                   [no auth]

package/dist/auth/fusion-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"fusion-api.js","sourceRoot":"","sources":["../../src/auth/fusion-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AAEH,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAuBlC,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY;IACnD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,sBAAsB,EAAE;QAC5D,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACxC,CAAC,CAAC;IAEH,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAErC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,gBAAgB,CAAC,IAAI,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,sBAAsB,CAAC,CAAC;IAErE,MAAM,MAAM,GAAG;QACb,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;QACnC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;QAC7B,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QACtB,2BAA2B,EAAE,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC;QACpE,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC;KACxC,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,iBAAiB,CACrB,GAAG,IAAI,kDAAkD,EACzD,qEAAqE;YACnE,6BAA6B,CAChC,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,sDAAsD;IACtD,cAAc,CAAC,MAAM,CAAC,2BAA4B,EAAE,MAAM,CAAC,WAAY,CAAC,CAAC;IACzE,cAAc,CAAC,MAAM,CAAC,aAAc,EAAE,MAAM,CAAC,WAAY,CAAC,CAAC;IAE3D,OAAO,MAAuB,CAAC;AACjC,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,gBAAwB;IAExB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,uBAAuB,EAAE;QAC7D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAC;KAC/D,CAAC,CAAC;IAEH,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAErC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,GAAG,IAAI,+BAA+B,EACtC,sEAAsE;YACpE,aAAa,IAAI,mDAAmD;YACpE,6BAA6B,CAChC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,SAAS,CACd,MAAM,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,uBAAuB,CAAC,EACxD,IAAI,CACL,CAAC;AACJ,CAAC;AAqBD,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,iBAAyB,EACzB,UAA0B,EAAE;;IAE5B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,uBAAuB,EAAE;QAC7D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC;KACjE,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6EAA6E;IAC7E,kCAAkC;IAClC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAE9C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAA,OAAO,CAAC,cAAc,wDAAG,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,oBAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAE3C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,0BAA0B,IAAI,sBAAsB,EACpD,kEAAkE;YAChE,iEAAiE;YACjE,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAClE,uEAAuE;QACvE,4EAA4E;QAC5E,MAAM,YAAY,CAChB,GAAG,IAAI,oEAAoE,EAC3E,qEAAqE;YACnE,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,GAAG,IAAI,oDAAoD,EAC3D,cAAc,IAAI,kDAAkD;YAClE,aAAa,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,YAAY,CAChB,GAAG,IAAI,mEAAmE,EAC1E,qEAAqE;YACnE,mEAAmE,CACtE,CAAC;IACJ,CAAC;IAED,uCAAY,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,KAAE,iBAAiB,EAAE,OAAO,IAAG;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,WAAmB;;IAEnB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,sBAAsB,EAAE;QAC5D,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;KACF,CAAC,CAAC;IAEH,0EAA0E;IAC1E,qCAAqC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,GAAG,IAAI,yDAAyD,EAChE,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,GAAG,IAAI,6CAA6C,EACpD,cAAc,IAAI,kDAAkD;YAClE,gCAAgC,CACnC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,gBAAgB,CAAC,IAAI,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,sBAAsB,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,CAAC,MAAA,IAAI,CAAC,IAAI,mCAAI,EAAE,CAA4B,CAAC;IAC1D,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAExB,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,YAAY,CAChB,GAAG,IAAI,0CAA0C,EACjD,qEAAqE;YACnE,6BAA6B,CAChC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,IAA6B,EAAE,IAAY;;IAC5D,MAAM,IAAI,GAAG,CAAC,MAAA,IAAI,CAAC,IAAI,mCAAI,EAAE,CAA4B,CAAC;IAE1D,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE5B,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,YAAY,CAChB,GAAG,IAAI,kCAAkC,EACzC,qEAAqE;YACnE,8BAA8B,CACjC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,IAAiB;IAEjB,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,kCACjB,IAAI,KACP,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAC/C,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEtE,MAAM,YAAY,CAChB,mBAAmB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,EACnD,4DAA4D;YAC1D,gCAAgC,CACnC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,QAAkB,EAClB,IAAY;IAEZ,IAAI,MAAe,CAAC;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,YAAY,CAChB,GAAG,IAAI,uBAAuB,EAC9B,qEAAqE;YACnE,iCAAiC,CACpC,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,YAAY,CAChB,GAAG,IAAI,kCAAkC,EACzC,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAED,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAC3B,QAAkB,EAClB,IAAY,EACZ,IAA8B;IAE9B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO;IAEpC,yEAAyE;IACzE,2EAA2E;IAC3E,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO;IAEvD,MAAM,iBAAiB,CACrB,GAAG,IAAI,sCAAsC,EAC7C,8DAA8D;QAC5D,6DAA6D,CAChE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,KAAa,EAAE,MAAc;IACnE,OAAO,YAAY,CACjB,GAAG,IAAI,GAAG,KAAK,cAAc,MAAM,GAAG,EACtC,MAAM,IAAI,GAAG;QACX,CAAC,CAAC,sEAAsE;YACpE,2CAA2C;QAC/C,CAAC,CAAC,+DAA+D;YAC7D,YAAY,KAAK,GAAG,CAC3B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,MAAc;IACtD,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,iBAAiB,CACrB,wDAAwD,EACxD,uDAAuD,CACxD,CAAC;IACJ,CAAC;IAED,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,EAC/C,CAAC;QACD,MAAM,iBAAiB,CACrB,sEAAsE;YACpE,WAAW,GAAG,CAAC,IAAI,IAAI,EACzB,6DAA6D;YAC3D,sDAAsD,CACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;AACvC,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC","sourcesContent":["import { authRequiredError, networkError, preconditionError } from '../errors';\n\n/**\n * The CLI's client for the four Fusion auth routes.\n *\n * ---------------------------------------------------------------------------\n * WIRE CONTRACT — the seam between this package and the Fusion web app.\n *\n * The server side lives in `apps/web/app/api/auth/cli-<verb>/route.ts` and ships on\n * a DIFFERENT BRANCH from this file. This block is the single place the shapes\n * are written down on the client side; if you change one side, change the\n * other and update this block. Nothing here imports from `apps/web` — the two\n * halves are coupled only by HTTP, and the tests stub `fetch`, never the route.\n *\n *   GET /api/auth/cli-config                                   [no auth]\n *     → 200 { auth0_domain, client_id, scope,\n *             device_authorization_endpoint, token_endpoint }   all strings\n *     → 503 { error, code: \"CLI_NOT_CONFIGURED\" }   deployment not provisioned\n *\n *   POST /api/auth/cli-session                                 [no auth]\n *     ← { auth0_access_token: string }\n *     → 200 { access_token, expires_at, user: { id, email } }\n *     → 400 { error, code: \"INVALID_REQUEST\" }      malformed / wrong shape\n *     → 401 { error, code: \"SESSION_EXPIRED\" }      Auth0 said no, OR no\n *                                                   Fusion account for it\n *     → 503 { error, code: \"CLI_NOT_CONFIGURED\" }   deployment not provisioned\n *     → 500 { error, code: \"INTERNAL_ERROR\" }\n *\n *   POST /api/auth/cli-refresh                                 [no auth]\n *     ← { auth0_refresh_token: string }\n *     → 200 { access_token, expires_at, user: { id, email },\n *             auth0_refresh_token }   ← ROTATED; the presented one is dead\n *     → 400 { error, code: \"INVALID_REQUEST\" }\n *     → 401 { error, code: \"SESSION_EXPIRED\" }      expired or revoked\n *     → 404 { error, code: \"ACCOUNT_NOT_FOUND\",\n *             auth0_refresh_token }                 no Fusion account\n *     → 502 { error, code: \"TOKEN_EXCHANGE_FAILED\" } Auth0 returned no\n *                                                   rotated token\n *     → 503 { error, code: \"CLI_NOT_CONFIGURED\" }   deployment not provisioned\n *     → 503 { error, code: \"REFRESH_INCOMPLETE\",\n *             auth0_refresh_token }                 rotated, but /userinfo\n *                                                   did not answer; RETRYABLE\n *     → 500 { error, code: \"INTERNAL_ERROR\",\n *             auth0_refresh_token? }                present iff rotation\n *                                                   completed before the throw\n *\n *   !! cli-refresh MAY RETURN `auth0_refresh_token` ON ERROR RESPONSES, and a\n *      client MUST persist it before surfacing the error. Once the server's\n *      exchange with Auth0 succeeds the presented token is dead and the value\n *      in that body is the ONLY copy in existence; discarding it on a failure\n *      path destroys the session permanently. Note 503 has TWO codes here —\n *      branch on `code`, not on the status alone.\n *\n *   All three routes above read the Fusion CLI Auth0 application config, so all\n *   three can answer 503 CLI_NOT_CONFIGURED. cli-whoami cannot — it reads no\n *   Auth0 config, only the caller's bearer token.\n *\n *   GET /api/auth/cli-whoami        [Authorization: Bearer <access_token>]\n *     → 200 { user: { id, email, name } }\n *     → 401 { error, code: \"AUTH_REQUIRED\" }        token absent or invalid\n *     → 403 { error, code: \"MFA_REQUIRED\" }\n *     → 404 { error, code: \"ACCOUNT_NOT_FOUND\" }\n *     → 3xx                                         treated as 401, see below\n *\n * `access_token` is a Fusion HS256 JWT. Every authenticated Fusion route\n * accepts it as `Authorization: Bearer` — see `resolveRequestSupabaseJwt` in\n * `@kit/supabase`, which both `requireUser` and the RLS server client consume.\n * ---------------------------------------------------------------------------\n *\n * Two rules hold everywhere in this file:\n *\n *  - `redirect: 'manual'`. Fusion answers an unauthenticated page request with\n *    a 307 to `/auth/sign-in`; Node's fetch follows redirects by default, so\n *    without this a stale token would come back as a 200 full of HTML and be\n *    read as success. A 3xx here is treated as \"not authenticated\", full stop.\n *\n *  - No token is ever interpolated into an error message. The server's error\n *    bodies are `{ error, code }` documents that do not echo credentials, and\n *    the request bodies that DO carry credentials are never included in a\n *    thrown message.\n */\n\nconst REQUEST_TIMEOUT_MS = 15_000;\n\nexport interface CliAuthConfig {\n  auth0Domain: string;\n  clientId: string;\n  scope: string;\n  deviceAuthorizationEndpoint: string;\n  tokenEndpoint: string;\n}\n\nexport interface FusionSession {\n  accessToken: string;\n  expiresAt: string;\n  userId: string;\n  email: string | null;\n}\n\nexport interface FusionIdentity {\n  id: string;\n  email: string | null;\n  name: string | null;\n}\n\n/** Fetch the device-flow parameters for a host. */\nexport async function fetchCliAuthConfig(host: string): Promise<CliAuthConfig> {\n  const response = await request(`${host}/api/auth/cli-config`, {\n    method: 'GET',\n    headers: { accept: 'application/json' },\n  });\n\n  throwIfNotConfigured(response, host);\n\n  if (!response.ok) {\n    throw unexpectedStatus(host, '/api/auth/cli-config', response.status);\n  }\n\n  const body = await readJson(response, `${host}/api/auth/cli-config`);\n\n  const config = {\n    auth0Domain: str(body.auth0_domain),\n    clientId: str(body.client_id),\n    scope: str(body.scope),\n    deviceAuthorizationEndpoint: str(body.device_authorization_endpoint),\n    tokenEndpoint: str(body.token_endpoint),\n  };\n\n  if (Object.values(config).some((value) => value === null)) {\n    throw preconditionError(\n      `${host} returned an incomplete CLI login configuration.`,\n      `Confirm the deployment is running a Fusion build that includes the ` +\n        `/api/auth/cli-config route.`,\n    );\n  }\n\n  // The endpoints come from the server, so they are attacker-controlled if the\n  // host is. Pin them to the Auth0 domain the same response declares, so a\n  // compromised or misconfigured Fusion cannot redirect the device flow — and\n  // the resulting credentials — to an arbitrary origin.\n  assertOnDomain(config.deviceAuthorizationEndpoint!, config.auth0Domain!);\n  assertOnDomain(config.tokenEndpoint!, config.auth0Domain!);\n\n  return config as CliAuthConfig;\n}\n\n/** Exchange a verified Auth0 access token for a Fusion JWT. */\nexport async function createFusionSession(\n  host: string,\n  auth0AccessToken: string,\n): Promise<FusionSession> {\n  const response = await request(`${host}/api/auth/cli-session`, {\n    method: 'POST',\n    headers: { 'content-type': 'application/json', accept: 'application/json' },\n    body: JSON.stringify({ auth0_access_token: auth0AccessToken }),\n  });\n\n  throwIfNotConfigured(response, host);\n\n  if (response.status === 401) {\n    throw authRequiredError(\n      `${host} rejected the Auth0 identity.`,\n      `Run \"ekanos login\" again. If it keeps failing, confirm your account ` +\n        `exists on ${host} — the browser login can succeed for an identity ` +\n        `that has no Fusion account.`,\n    );\n  }\n\n  if (!response.ok) {\n    throw unexpectedStatus(host, '/api/auth/cli-session', response.status);\n  }\n\n  return toSession(\n    await readJson(response, `${host}/api/auth/cli-session`),\n    host,\n  );\n}\n\nexport interface RefreshedSession extends FusionSession {\n  /** The ROTATED refresh token. The presented one is already invalid. */\n  auth0RefreshToken: string;\n}\n\nexport interface RefreshOptions {\n  /**\n   * Called the INSTANT a rotated refresh token is seen in the response — on\n   * success and on failure alike, before anything is thrown.\n   *\n   * Persist-on-learn, not persist-on-success. Once the server's exchange with\n   * Auth0 succeeds the presented token is dead and the replacement in that\n   * body is the only copy in existence, so a client that only saves it on the\n   * happy path destroys the partner's credential the first time /userinfo\n   * blips. The callback runs before any throw so no error path can skip it.\n   */\n  onRotatedToken?: (rotated: string) => void;\n}\n\n/** Re-mint a Fusion JWT from the stored Auth0 refresh token. */\nexport async function refreshFusionSession(\n  host: string,\n  auth0RefreshToken: string,\n  options: RefreshOptions = {},\n): Promise<RefreshedSession> {\n  const response = await request(`${host}/api/auth/cli-refresh`, {\n    method: 'POST',\n    headers: { 'content-type': 'application/json', accept: 'application/json' },\n    body: JSON.stringify({ auth0_refresh_token: auth0RefreshToken }),\n  });\n\n  // Read the body FIRST, whatever the status: the rotated token can arrive on\n  // a 503, a 404 or a 500 just as readily as on a 200, and it must be captured\n  // before any branch below throws.\n  const body = await readOptionalJson(response);\n  const rotated = str(body.auth0_refresh_token);\n\n  if (rotated) {\n    options.onRotatedToken?.(rotated);\n  }\n\n  throwIfNotConfigured(response, host, body);\n\n  if (response.status === 401) {\n    throw authRequiredError(\n      `The stored session for ${host} is no longer valid.`,\n      `Run \"ekanos login\" to sign in again. This is expected after the ` +\n        `refresh token expires, after it is revoked in Auth0, or if two ` +\n        `machines used the same credentials file.`,\n    );\n  }\n\n  if (response.status === 503 && body.code === 'REFRESH_INCOMPLETE') {\n    // NOT an auth failure. The credential was renewed — and, thanks to the\n    // callback above, already saved. Auth0's /userinfo is simply not answering.\n    throw networkError(\n      `${host} renewed the session but could not verify the identity with Auth0.`,\n      `Retry in a moment — your credentials are still valid and have been ` +\n        `updated. You do NOT need to run \"ekanos login\" again.`,\n    );\n  }\n\n  if (response.status === 404) {\n    throw authRequiredError(\n      `${host} has no Fusion account for the signed-in identity.`,\n      `Sign in to ${host} in a browser once to have the account created, ` +\n        `then retry.`,\n    );\n  }\n\n  if (!response.ok) {\n    throw unexpectedStatus(host, '/api/auth/cli-refresh', response.status);\n  }\n\n  if (!rotated) {\n    throw networkError(\n      `${host} refreshed the session without returning a rotated refresh token.`,\n      `Run \"ekanos login\" to start a fresh session, and report this — the ` +\n        `deployment's Auth0 CLI application may not have rotation enabled.`,\n    );\n  }\n\n  return { ...toSession(body, host), auth0RefreshToken: rotated };\n}\n\n/**\n * Prove the Fusion JWT authenticates. Returns null on 401 so the caller can\n * decide whether to refresh and retry — an expired access token is an ordinary\n * event, not an error.\n */\nexport async function fetchIdentity(\n  host: string,\n  accessToken: string,\n): Promise<FusionIdentity | null> {\n  const response = await request(`${host}/api/auth/cli-whoami`, {\n    method: 'GET',\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${accessToken}`,\n    },\n  });\n\n  // 401, or the 307 that an auth-gated Fusion route answers with. Both mean\n  // \"this token did not authenticate\".\n  if (response.status === 401 || isRedirect(response.status)) {\n    return null;\n  }\n\n  if (response.status === 403) {\n    throw authRequiredError(\n      `${host} requires multi-factor authentication for this account.`,\n      `Complete MFA in the browser, then run \"ekanos login\" again.`,\n    );\n  }\n\n  if (response.status === 404) {\n    throw authRequiredError(\n      `${host} has no account for the signed-in identity.`,\n      `Sign in to ${host} in a browser once to have the account created, ` +\n        `then run \"ekanos login\" again.`,\n    );\n  }\n\n  if (!response.ok) {\n    throw unexpectedStatus(host, '/api/auth/cli-whoami', response.status);\n  }\n\n  const body = await readJson(response, `${host}/api/auth/cli-whoami`);\n  const user = (body.user ?? {}) as Record<string, unknown>;\n  const id = str(user.id);\n\n  if (!id) {\n    throw networkError(\n      `${host} returned an identity without a user id.`,\n      `Confirm the deployment is running a Fusion build that includes the ` +\n        `/api/auth/cli-whoami route.`,\n    );\n  }\n\n  return { id, email: str(user.email), name: str(user.name) };\n}\n\nfunction toSession(body: Record<string, unknown>, host: string): FusionSession {\n  const user = (body.user ?? {}) as Record<string, unknown>;\n\n  const accessToken = str(body.access_token);\n  const expiresAt = str(body.expires_at);\n  const userId = str(user.id);\n\n  if (!accessToken || !expiresAt || !userId) {\n    throw networkError(\n      `${host} returned an incomplete session.`,\n      `Confirm the deployment is running a Fusion build that includes the ` +\n        `CLI auth routes, then retry.`,\n    );\n  }\n\n  return { accessToken, expiresAt, userId, email: str(user.email) };\n}\n\nexport async function request(\n  url: string,\n  init: RequestInit,\n): Promise<Response> {\n  try {\n    return await fetch(url, {\n      ...init,\n      redirect: 'manual',\n      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),\n    });\n  } catch (error) {\n    const reason = error instanceof Error ? error.message : String(error);\n\n    throw networkError(\n      `Could not reach ${new URL(url).origin}: ${reason}`,\n      `Check the host is correct and reachable from this machine ` +\n        `(proxy, VPN, DNS), then retry.`,\n    );\n  }\n}\n\n/**\n * Best-effort body read for a response whose status may be an error. Returns\n * an empty object rather than throwing, because the caller needs to inspect\n * the body BEFORE deciding what the status means — and a 500 from a proxy may\n * carry no JSON at all.\n */\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n\nasync function readJson(\n  response: Response,\n  what: string,\n): Promise<Record<string, unknown>> {\n  let parsed: unknown;\n\n  try {\n    parsed = await response.json();\n  } catch {\n    throw networkError(\n      `${what} did not return JSON.`,\n      `Confirm the host is a Fusion deployment and not a proxy or captive ` +\n        `portal sitting in front of one.`,\n    );\n  }\n\n  if (typeof parsed !== 'object' || parsed === null) {\n    throw networkError(\n      `${what} returned an unexpected payload.`,\n      `Confirm the host is a Fusion deployment, then retry.`,\n    );\n  }\n\n  return parsed as Record<string, unknown>;\n}\n\n/**\n * 503 means the deployment is not provisioned for CLI login — an operator\n * action that has not happened, not a fault in the request.\n *\n * Every route that reads the Fusion CLI Auth0 config can answer this, so every\n * caller has to check for it. Falling through to `unexpectedStatus` would tell\n * a partner \"confirm the host is a Fusion deployment\" when the host is a\n * perfectly good Fusion deployment that is simply missing one env var — and\n * would exit 8 (network, retryable) instead of 9 (precondition, not).\n */\nfunction throwIfNotConfigured(\n  response: Response,\n  host: string,\n  body?: Record<string, unknown>,\n): void {\n  if (response.status !== 503) return;\n\n  // 503 carries two meanings on these routes. Only CLI_NOT_CONFIGURED is a\n  // precondition; REFRESH_INCOMPLETE is transient and handled by its caller.\n  if (body && body.code !== 'CLI_NOT_CONFIGURED') return;\n\n  throw preconditionError(\n    `${host} does not have CLI login configured.`,\n    `Ask the Fusion operator to provision the \"Fusion CLI\" Auth0 ` +\n      `application and set AUTH0_CLI_CLIENT_ID on that deployment.`,\n  );\n}\n\nfunction unexpectedStatus(host: string, route: string, status: number) {\n  return networkError(\n    `${host}${route} responded ${status}.`,\n    status >= 500\n      ? `The Fusion deployment returned a server error. Retry shortly; if it ` +\n          `persists, report it with the status code.`\n      : `Confirm the host is a Fusion deployment running a build that ` +\n          `includes ${route}.`,\n  );\n}\n\nfunction assertOnDomain(endpoint: string, domain: string): void {\n  let url: URL;\n\n  try {\n    url = new URL(endpoint);\n  } catch {\n    throw preconditionError(\n      `The login configuration contains a malformed endpoint.`,\n      `Report this to the operator of the Fusion deployment.`,\n    );\n  }\n\n  if (\n    url.protocol !== 'https:' ||\n    url.host.toLowerCase() !== domain.toLowerCase()\n  ) {\n    throw preconditionError(\n      `The login configuration points at an endpoint outside its own Auth0 ` +\n        `domain (${url.host}).`,\n      `Do not continue. Report this to the operator of the Fusion ` +\n        `deployment — it may be misconfigured or compromised.`,\n    );\n  }\n}\n\nfunction isRedirect(status: number): boolean {\n  return status >= 300 && status < 400;\n}\n\nfunction str(value: unknown): string | null {\n  return typeof value === 'string' && value.length > 0 ? value : null;\n}\n"]}
+{"version":3,"file":"fusion-api.js","sourceRoot":"","sources":["../../src/auth/fusion-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AAEH,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAuBlC,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY;IACnD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,sBAAsB,EAAE;QAC5D,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACxC,CAAC,CAAC;IAEH,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAErC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,gBAAgB,CAAC,IAAI,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,sBAAsB,CAAC,CAAC;IAErE,MAAM,MAAM,GAAG;QACb,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;QACnC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;QAC7B,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QACtB,2BAA2B,EAAE,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC;QACpE,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC;KACxC,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,iBAAiB,CACrB,GAAG,IAAI,kDAAkD,EACzD,qEAAqE;YACnE,6BAA6B,CAChC,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,sDAAsD;IACtD,cAAc,CAAC,MAAM,CAAC,2BAA4B,EAAE,MAAM,CAAC,WAAY,CAAC,CAAC;IACzE,cAAc,CAAC,MAAM,CAAC,aAAc,EAAE,MAAM,CAAC,WAAY,CAAC,CAAC;IAE3D,OAAO,MAAuB,CAAC;AACjC,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,gBAAwB;IAExB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,uBAAuB,EAAE;QAC7D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAC;KAC/D,CAAC,CAAC;IAEH,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAErC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,GAAG,IAAI,+BAA+B,EACtC,sEAAsE;YACpE,aAAa,IAAI,mDAAmD;YACpE,6BAA6B,CAChC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,SAAS,CACd,MAAM,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,uBAAuB,CAAC,EACxD,IAAI,CACL,CAAC;AACJ,CAAC;AAqBD,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,iBAAyB,EACzB,UAA0B,EAAE;;IAE5B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,uBAAuB,EAAE;QAC7D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC;KACjE,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6EAA6E;IAC7E,kCAAkC;IAClC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAE9C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAA,OAAO,CAAC,cAAc,wDAAG,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,oBAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAE3C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,0BAA0B,IAAI,sBAAsB,EACpD,kEAAkE;YAChE,iEAAiE;YACjE,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAClE,uEAAuE;QACvE,4EAA4E;QAC5E,MAAM,YAAY,CAChB,GAAG,IAAI,oEAAoE,EAC3E,qEAAqE;YACnE,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,GAAG,IAAI,oDAAoD,EAC3D,cAAc,IAAI,kDAAkD;YAClE,aAAa,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,YAAY,CAChB,GAAG,IAAI,mEAAmE,EAC1E,qEAAqE;YACnE,mEAAmE,CACtE,CAAC;IACJ,CAAC;IAED,uCAAY,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,KAAE,iBAAiB,EAAE,OAAO,IAAG;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,WAAmB;;IAEnB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,sBAAsB,EAAE;QAC5D,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;KACF,CAAC,CAAC;IAEH,0EAA0E;IAC1E,qCAAqC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,GAAG,IAAI,yDAAyD,EAChE,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,GAAG,IAAI,6CAA6C,EACpD,cAAc,IAAI,kDAAkD;YAClE,gCAAgC,CACnC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,gBAAgB,CAAC,IAAI,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,sBAAsB,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,CAAC,MAAA,IAAI,CAAC,IAAI,mCAAI,EAAE,CAA4B,CAAC;IAC1D,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAExB,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,YAAY,CAChB,GAAG,IAAI,0CAA0C,EACjD,qEAAqE;YACnE,6BAA6B,CAChC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,IAA6B,EAAE,IAAY;;IAC5D,MAAM,IAAI,GAAG,CAAC,MAAA,IAAI,CAAC,IAAI,mCAAI,EAAE,CAA4B,CAAC;IAE1D,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE5B,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,YAAY,CAChB,GAAG,IAAI,kCAAkC,EACzC,qEAAqE;YACnE,8BAA8B,CACjC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,IAAiB;IAEjB,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,kCACjB,IAAI,KACP,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAC/C,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEtE,MAAM,YAAY,CAChB,mBAAmB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,EACnD,4DAA4D;YAC1D,gCAAgC,CACnC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,QAAkB,EAClB,IAAY;IAEZ,IAAI,MAAe,CAAC;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,YAAY,CAChB,GAAG,IAAI,uBAAuB,EAC9B,qEAAqE;YACnE,iCAAiC,CACpC,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,YAAY,CAChB,GAAG,IAAI,kCAAkC,EACzC,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAED,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAC3B,QAAkB,EAClB,IAAY,EACZ,IAA8B;IAE9B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO;IAEpC,yEAAyE;IACzE,2EAA2E;IAC3E,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO;IAEvD,MAAM,iBAAiB,CACrB,GAAG,IAAI,sCAAsC,EAC7C,8DAA8D;QAC5D,6DAA6D,CAChE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,KAAa,EAAE,MAAc;IACnE,OAAO,YAAY,CACjB,GAAG,IAAI,GAAG,KAAK,cAAc,MAAM,GAAG,EACtC,MAAM,IAAI,GAAG;QACX,CAAC,CAAC,sEAAsE;YACpE,2CAA2C;QAC/C,CAAC,CAAC,+DAA+D;YAC7D,YAAY,KAAK,GAAG,CAC3B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,MAAc;IACtD,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,iBAAiB,CACrB,wDAAwD,EACxD,uDAAuD,CACxD,CAAC;IACJ,CAAC;IAED,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,EAC/C,CAAC;QACD,MAAM,iBAAiB,CACrB,sEAAsE;YACpE,WAAW,GAAG,CAAC,IAAI,IAAI,EACzB,6DAA6D;YAC3D,sDAAsD,CACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;AACvC,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC","sourcesContent":["import { authRequiredError, networkError, preconditionError } from '../errors';\n\n/**\n * The CLI's client for the four Fusion auth routes.\n *\n * ---------------------------------------------------------------------------\n * WIRE CONTRACT — the seam between this package and the Fusion web app.\n *\n * The server side is the host's `/api/auth/cli-<verb>` routes, and it ships on\n * a DIFFERENT BRANCH from this file. This block is the single place the shapes\n * are written down on the client side; if you change one side, change the\n * other and update this block. Nothing here imports host code — the two\n * halves are coupled only by HTTP, and the tests stub `fetch`, never the route.\n *\n *   GET /api/auth/cli-config                                   [no auth]\n *     → 200 { auth0_domain, client_id, scope,\n *             device_authorization_endpoint, token_endpoint }   all strings\n *     → 503 { error, code: \"CLI_NOT_CONFIGURED\" }   deployment not provisioned\n *\n *   POST /api/auth/cli-session                                 [no auth]\n *     ← { auth0_access_token: string }\n *     → 200 { access_token, expires_at, user: { id, email } }\n *     → 400 { error, code: \"INVALID_REQUEST\" }      malformed / wrong shape\n *     → 401 { error, code: \"SESSION_EXPIRED\" }      Auth0 said no, OR no\n *                                                   Fusion account for it\n *     → 503 { error, code: \"CLI_NOT_CONFIGURED\" }   deployment not provisioned\n *     → 500 { error, code: \"INTERNAL_ERROR\" }\n *\n *   POST /api/auth/cli-refresh                                 [no auth]\n *     ← { auth0_refresh_token: string }\n *     → 200 { access_token, expires_at, user: { id, email },\n *             auth0_refresh_token }   ← ROTATED; the presented one is dead\n *     → 400 { error, code: \"INVALID_REQUEST\" }\n *     → 401 { error, code: \"SESSION_EXPIRED\" }      expired or revoked\n *     → 404 { error, code: \"ACCOUNT_NOT_FOUND\",\n *             auth0_refresh_token }                 no Fusion account\n *     → 502 { error, code: \"TOKEN_EXCHANGE_FAILED\" } Auth0 returned no\n *                                                   rotated token\n *     → 503 { error, code: \"CLI_NOT_CONFIGURED\" }   deployment not provisioned\n *     → 503 { error, code: \"REFRESH_INCOMPLETE\",\n *             auth0_refresh_token }                 rotated, but /userinfo\n *                                                   did not answer; RETRYABLE\n *     → 500 { error, code: \"INTERNAL_ERROR\",\n *             auth0_refresh_token? }                present iff rotation\n *                                                   completed before the throw\n *\n *   !! cli-refresh MAY RETURN `auth0_refresh_token` ON ERROR RESPONSES, and a\n *      client MUST persist it before surfacing the error. Once the server's\n *      exchange with Auth0 succeeds the presented token is dead and the value\n *      in that body is the ONLY copy in existence; discarding it on a failure\n *      path destroys the session permanently. Note 503 has TWO codes here —\n *      branch on `code`, not on the status alone.\n *\n *   All three routes above read the Fusion CLI Auth0 application config, so all\n *   three can answer 503 CLI_NOT_CONFIGURED. cli-whoami cannot — it reads no\n *   Auth0 config, only the caller's bearer token.\n *\n *   GET /api/auth/cli-whoami        [Authorization: Bearer <access_token>]\n *     → 200 { user: { id, email, name } }\n *     → 401 { error, code: \"AUTH_REQUIRED\" }        token absent or invalid\n *     → 403 { error, code: \"MFA_REQUIRED\" }\n *     → 404 { error, code: \"ACCOUNT_NOT_FOUND\" }\n *     → 3xx                                         treated as 401, see below\n *\n * `access_token` is a Fusion HS256 JWT. Every authenticated Fusion route\n * accepts it as `Authorization: Bearer` — see `resolveRequestSupabaseJwt` in\n * `@kit/supabase`, which both `requireUser` and the RLS server client consume.\n * ---------------------------------------------------------------------------\n *\n * Two rules hold everywhere in this file:\n *\n *  - `redirect: 'manual'`. Fusion answers an unauthenticated page request with\n *    a 307 to `/auth/sign-in`; Node's fetch follows redirects by default, so\n *    without this a stale token would come back as a 200 full of HTML and be\n *    read as success. A 3xx here is treated as \"not authenticated\", full stop.\n *\n *  - No token is ever interpolated into an error message. The server's error\n *    bodies are `{ error, code }` documents that do not echo credentials, and\n *    the request bodies that DO carry credentials are never included in a\n *    thrown message.\n */\n\nconst REQUEST_TIMEOUT_MS = 15_000;\n\nexport interface CliAuthConfig {\n  auth0Domain: string;\n  clientId: string;\n  scope: string;\n  deviceAuthorizationEndpoint: string;\n  tokenEndpoint: string;\n}\n\nexport interface FusionSession {\n  accessToken: string;\n  expiresAt: string;\n  userId: string;\n  email: string | null;\n}\n\nexport interface FusionIdentity {\n  id: string;\n  email: string | null;\n  name: string | null;\n}\n\n/** Fetch the device-flow parameters for a host. */\nexport async function fetchCliAuthConfig(host: string): Promise<CliAuthConfig> {\n  const response = await request(`${host}/api/auth/cli-config`, {\n    method: 'GET',\n    headers: { accept: 'application/json' },\n  });\n\n  throwIfNotConfigured(response, host);\n\n  if (!response.ok) {\n    throw unexpectedStatus(host, '/api/auth/cli-config', response.status);\n  }\n\n  const body = await readJson(response, `${host}/api/auth/cli-config`);\n\n  const config = {\n    auth0Domain: str(body.auth0_domain),\n    clientId: str(body.client_id),\n    scope: str(body.scope),\n    deviceAuthorizationEndpoint: str(body.device_authorization_endpoint),\n    tokenEndpoint: str(body.token_endpoint),\n  };\n\n  if (Object.values(config).some((value) => value === null)) {\n    throw preconditionError(\n      `${host} returned an incomplete CLI login configuration.`,\n      `Confirm the deployment is running a Fusion build that includes the ` +\n        `/api/auth/cli-config route.`,\n    );\n  }\n\n  // The endpoints come from the server, so they are attacker-controlled if the\n  // host is. Pin them to the Auth0 domain the same response declares, so a\n  // compromised or misconfigured Fusion cannot redirect the device flow — and\n  // the resulting credentials — to an arbitrary origin.\n  assertOnDomain(config.deviceAuthorizationEndpoint!, config.auth0Domain!);\n  assertOnDomain(config.tokenEndpoint!, config.auth0Domain!);\n\n  return config as CliAuthConfig;\n}\n\n/** Exchange a verified Auth0 access token for a Fusion JWT. */\nexport async function createFusionSession(\n  host: string,\n  auth0AccessToken: string,\n): Promise<FusionSession> {\n  const response = await request(`${host}/api/auth/cli-session`, {\n    method: 'POST',\n    headers: { 'content-type': 'application/json', accept: 'application/json' },\n    body: JSON.stringify({ auth0_access_token: auth0AccessToken }),\n  });\n\n  throwIfNotConfigured(response, host);\n\n  if (response.status === 401) {\n    throw authRequiredError(\n      `${host} rejected the Auth0 identity.`,\n      `Run \"ekanos login\" again. If it keeps failing, confirm your account ` +\n        `exists on ${host} — the browser login can succeed for an identity ` +\n        `that has no Fusion account.`,\n    );\n  }\n\n  if (!response.ok) {\n    throw unexpectedStatus(host, '/api/auth/cli-session', response.status);\n  }\n\n  return toSession(\n    await readJson(response, `${host}/api/auth/cli-session`),\n    host,\n  );\n}\n\nexport interface RefreshedSession extends FusionSession {\n  /** The ROTATED refresh token. The presented one is already invalid. */\n  auth0RefreshToken: string;\n}\n\nexport interface RefreshOptions {\n  /**\n   * Called the INSTANT a rotated refresh token is seen in the response — on\n   * success and on failure alike, before anything is thrown.\n   *\n   * Persist-on-learn, not persist-on-success. Once the server's exchange with\n   * Auth0 succeeds the presented token is dead and the replacement in that\n   * body is the only copy in existence, so a client that only saves it on the\n   * happy path destroys the partner's credential the first time /userinfo\n   * blips. The callback runs before any throw so no error path can skip it.\n   */\n  onRotatedToken?: (rotated: string) => void;\n}\n\n/** Re-mint a Fusion JWT from the stored Auth0 refresh token. */\nexport async function refreshFusionSession(\n  host: string,\n  auth0RefreshToken: string,\n  options: RefreshOptions = {},\n): Promise<RefreshedSession> {\n  const response = await request(`${host}/api/auth/cli-refresh`, {\n    method: 'POST',\n    headers: { 'content-type': 'application/json', accept: 'application/json' },\n    body: JSON.stringify({ auth0_refresh_token: auth0RefreshToken }),\n  });\n\n  // Read the body FIRST, whatever the status: the rotated token can arrive on\n  // a 503, a 404 or a 500 just as readily as on a 200, and it must be captured\n  // before any branch below throws.\n  const body = await readOptionalJson(response);\n  const rotated = str(body.auth0_refresh_token);\n\n  if (rotated) {\n    options.onRotatedToken?.(rotated);\n  }\n\n  throwIfNotConfigured(response, host, body);\n\n  if (response.status === 401) {\n    throw authRequiredError(\n      `The stored session for ${host} is no longer valid.`,\n      `Run \"ekanos login\" to sign in again. This is expected after the ` +\n        `refresh token expires, after it is revoked in Auth0, or if two ` +\n        `machines used the same credentials file.`,\n    );\n  }\n\n  if (response.status === 503 && body.code === 'REFRESH_INCOMPLETE') {\n    // NOT an auth failure. The credential was renewed — and, thanks to the\n    // callback above, already saved. Auth0's /userinfo is simply not answering.\n    throw networkError(\n      `${host} renewed the session but could not verify the identity with Auth0.`,\n      `Retry in a moment — your credentials are still valid and have been ` +\n        `updated. You do NOT need to run \"ekanos login\" again.`,\n    );\n  }\n\n  if (response.status === 404) {\n    throw authRequiredError(\n      `${host} has no Fusion account for the signed-in identity.`,\n      `Sign in to ${host} in a browser once to have the account created, ` +\n        `then retry.`,\n    );\n  }\n\n  if (!response.ok) {\n    throw unexpectedStatus(host, '/api/auth/cli-refresh', response.status);\n  }\n\n  if (!rotated) {\n    throw networkError(\n      `${host} refreshed the session without returning a rotated refresh token.`,\n      `Run \"ekanos login\" to start a fresh session, and report this — the ` +\n        `deployment's Auth0 CLI application may not have rotation enabled.`,\n    );\n  }\n\n  return { ...toSession(body, host), auth0RefreshToken: rotated };\n}\n\n/**\n * Prove the Fusion JWT authenticates. Returns null on 401 so the caller can\n * decide whether to refresh and retry — an expired access token is an ordinary\n * event, not an error.\n */\nexport async function fetchIdentity(\n  host: string,\n  accessToken: string,\n): Promise<FusionIdentity | null> {\n  const response = await request(`${host}/api/auth/cli-whoami`, {\n    method: 'GET',\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${accessToken}`,\n    },\n  });\n\n  // 401, or the 307 that an auth-gated Fusion route answers with. Both mean\n  // \"this token did not authenticate\".\n  if (response.status === 401 || isRedirect(response.status)) {\n    return null;\n  }\n\n  if (response.status === 403) {\n    throw authRequiredError(\n      `${host} requires multi-factor authentication for this account.`,\n      `Complete MFA in the browser, then run \"ekanos login\" again.`,\n    );\n  }\n\n  if (response.status === 404) {\n    throw authRequiredError(\n      `${host} has no account for the signed-in identity.`,\n      `Sign in to ${host} in a browser once to have the account created, ` +\n        `then run \"ekanos login\" again.`,\n    );\n  }\n\n  if (!response.ok) {\n    throw unexpectedStatus(host, '/api/auth/cli-whoami', response.status);\n  }\n\n  const body = await readJson(response, `${host}/api/auth/cli-whoami`);\n  const user = (body.user ?? {}) as Record<string, unknown>;\n  const id = str(user.id);\n\n  if (!id) {\n    throw networkError(\n      `${host} returned an identity without a user id.`,\n      `Confirm the deployment is running a Fusion build that includes the ` +\n        `/api/auth/cli-whoami route.`,\n    );\n  }\n\n  return { id, email: str(user.email), name: str(user.name) };\n}\n\nfunction toSession(body: Record<string, unknown>, host: string): FusionSession {\n  const user = (body.user ?? {}) as Record<string, unknown>;\n\n  const accessToken = str(body.access_token);\n  const expiresAt = str(body.expires_at);\n  const userId = str(user.id);\n\n  if (!accessToken || !expiresAt || !userId) {\n    throw networkError(\n      `${host} returned an incomplete session.`,\n      `Confirm the deployment is running a Fusion build that includes the ` +\n        `CLI auth routes, then retry.`,\n    );\n  }\n\n  return { accessToken, expiresAt, userId, email: str(user.email) };\n}\n\nexport async function request(\n  url: string,\n  init: RequestInit,\n): Promise<Response> {\n  try {\n    return await fetch(url, {\n      ...init,\n      redirect: 'manual',\n      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),\n    });\n  } catch (error) {\n    const reason = error instanceof Error ? error.message : String(error);\n\n    throw networkError(\n      `Could not reach ${new URL(url).origin}: ${reason}`,\n      `Check the host is correct and reachable from this machine ` +\n        `(proxy, VPN, DNS), then retry.`,\n    );\n  }\n}\n\n/**\n * Best-effort body read for a response whose status may be an error. Returns\n * an empty object rather than throwing, because the caller needs to inspect\n * the body BEFORE deciding what the status means — and a 500 from a proxy may\n * carry no JSON at all.\n */\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n\nasync function readJson(\n  response: Response,\n  what: string,\n): Promise<Record<string, unknown>> {\n  let parsed: unknown;\n\n  try {\n    parsed = await response.json();\n  } catch {\n    throw networkError(\n      `${what} did not return JSON.`,\n      `Confirm the host is a Fusion deployment and not a proxy or captive ` +\n        `portal sitting in front of one.`,\n    );\n  }\n\n  if (typeof parsed !== 'object' || parsed === null) {\n    throw networkError(\n      `${what} returned an unexpected payload.`,\n      `Confirm the host is a Fusion deployment, then retry.`,\n    );\n  }\n\n  return parsed as Record<string, unknown>;\n}\n\n/**\n * 503 means the deployment is not provisioned for CLI login — an operator\n * action that has not happened, not a fault in the request.\n *\n * Every route that reads the Fusion CLI Auth0 config can answer this, so every\n * caller has to check for it. Falling through to `unexpectedStatus` would tell\n * a partner \"confirm the host is a Fusion deployment\" when the host is a\n * perfectly good Fusion deployment that is simply missing one env var — and\n * would exit 8 (network, retryable) instead of 9 (precondition, not).\n */\nfunction throwIfNotConfigured(\n  response: Response,\n  host: string,\n  body?: Record<string, unknown>,\n): void {\n  if (response.status !== 503) return;\n\n  // 503 carries two meanings on these routes. Only CLI_NOT_CONFIGURED is a\n  // precondition; REFRESH_INCOMPLETE is transient and handled by its caller.\n  if (body && body.code !== 'CLI_NOT_CONFIGURED') return;\n\n  throw preconditionError(\n    `${host} does not have CLI login configured.`,\n    `Ask the Fusion operator to provision the \"Fusion CLI\" Auth0 ` +\n      `application and set AUTH0_CLI_CLIENT_ID on that deployment.`,\n  );\n}\n\nfunction unexpectedStatus(host: string, route: string, status: number) {\n  return networkError(\n    `${host}${route} responded ${status}.`,\n    status >= 500\n      ? `The Fusion deployment returned a server error. Retry shortly; if it ` +\n          `persists, report it with the status code.`\n      : `Confirm the host is a Fusion deployment running a build that ` +\n          `includes ${route}.`,\n  );\n}\n\nfunction assertOnDomain(endpoint: string, domain: string): void {\n  let url: URL;\n\n  try {\n    url = new URL(endpoint);\n  } catch {\n    throw preconditionError(\n      `The login configuration contains a malformed endpoint.`,\n      `Report this to the operator of the Fusion deployment.`,\n    );\n  }\n\n  if (\n    url.protocol !== 'https:' ||\n    url.host.toLowerCase() !== domain.toLowerCase()\n  ) {\n    throw preconditionError(\n      `The login configuration points at an endpoint outside its own Auth0 ` +\n        `domain (${url.host}).`,\n      `Do not continue. Report this to the operator of the Fusion ` +\n        `deployment — it may be misconfigured or compromised.`,\n    );\n  }\n}\n\nfunction isRedirect(status: number): boolean {\n  return status >= 300 && status < 400;\n}\n\nfunction str(value: unknown): string | null {\n  return typeof value === 'string' && value.length > 0 ? value : null;\n}\n"]}

package/dist/banner.d.ts

@@ -14,7 +14,11 @@ export declare function paintBanner(lines: readonly string[], color: boolean): s
  *   - `EKANOS_NO_BANNER` unset (any value at all suppresses it entirely)
  *
  * `NO_COLOR` does not suppress the banner — it renders the same art with zero
- * escape codes, per the standard (https://no-color.org).
+ * escape codes, per the standard (https://no-color.org). The actual on/off
+ * call is `ui.ts`'s `colorsEnabled` — the one gate every color decision in
+ * this package flows through — so the banner also honours `TERM=dumb` and
+ * `FORCE_COLOR` the same way the findings renderer and everything else does,
+ * without duplicating the rule here.
  *
  * Call sites stay a single line: all gating lives here, not at the call site.
  */

package/dist/banner.js

@@ -1,3 +1,4 @@
+import { colorsEnabled } from './ui.js';
 /** The website's brand gradient: teal → mauve → red, left to right. */
 const GRADIENT_STOPS = [
     [0x70, 0xa5, 0xab],
@@ -68,7 +69,11 @@ function dim(text, color) {
  *   - `EKANOS_NO_BANNER` unset (any value at all suppresses it entirely)
  *
  * `NO_COLOR` does not suppress the banner — it renders the same art with zero
- * escape codes, per the standard (https://no-color.org).
+ * escape codes, per the standard (https://no-color.org). The actual on/off
+ * call is `ui.ts`'s `colorsEnabled` — the one gate every color decision in
+ * this package flows through — so the banner also honours `TERM=dumb` and
+ * `FORCE_COLOR` the same way the findings renderer and everything else does,
+ * without duplicating the rule here.
  *
  * Call sites stay a single line: all gating lives here, not at the call site.
  */
@@ -79,7 +84,7 @@ export function printBanner(ctx, kind) {
         return;
     if (ctx.env.EKANOS_NO_BANNER !== undefined)
         return;
-    const color = ctx.env.NO_COLOR === undefined;
+    const color = colorsEnabled({ isTTY: ctx.stderrIsTTY, env: ctx.env });
     const art = kind === 'full' ? FULL_ART : MINI_ART;
     ctx.log(paintBanner(art, color));
     if (kind === 'full') {

package/dist/banner.js.map

@@ -1 +1 @@
-{"version":3,"file":"banner.js","sourceRoot":"","sources":["../src/banner.ts"],"names":[],"mappings":"AAeA,uEAAuE;AACvE,MAAM,cAAc,GAA6B;IAC/C,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IAClB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IAClB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;CACnB,CAAC;AAEF,0EAA0E;AAC1E,MAAM,QAAQ,GAAsB;IAClC,wDAAwD;IACxD,wDAAwD;IACxD,wDAAwD;IACxD,wDAAwD;IACxD,yDAAyD;CAC1D,CAAC;AAEF,mEAAmE;AACnE,MAAM,QAAQ,GAAsB;IAClC,0BAA0B;IAC1B,0BAA0B;IAC1B,0BAA0B;CAC3B,CAAC;AAEF,MAAM,OAAO,GAAG,8BAA8B,CAAC;AAE/C,SAAS,IAAI,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS;IAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,2EAA2E;AAC3E,SAAS,OAAO,CAAC,CAAS;IACxB,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,cAAc,CAAC;IACzC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,GACtB,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5D,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAwB,EAAE,KAAc;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAE5D,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAElC,IAAI,CAAC,KAAK;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC;aACxB,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;YACb,IAAI,EAAE,KAAK,GAAG;gBAAE,OAAO,EAAE,CAAC;YAC1B,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;YAC5D,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,CAAC,CAAC;aACD,IAAI,CAAC,EAAE,CAAC,CAAC;QAEZ,OAAO,GAAG,OAAO,SAAS,CAAC;IAC7B,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,GAAG,CAAC,IAAY,EAAE,KAAc;IACvC,OAAO,KAAK,CAAC,CAAC,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,GAAe,EAAE,IAAqB;IAChE,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO;IACzB,IAAI,CAAC,GAAG,CAAC,WAAW;QAAE,OAAO;IAC7B,IAAI,GAAG,CAAC,GAAG,CAAC,gBAAgB,KAAK,SAAS;QAAE,OAAO;IAEnD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IAElD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAEjC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC","sourcesContent":["import type { CliContext } from './context';\n\n/**\n * The gradient ASCII banner shown on a first-time `ekanos init` / `login`.\n *\n * Every gate here matters more than the art: this is decoration on stderr,\n * and it must never leak into an agent's view of the CLI. In particular it\n * must NEVER print in JSON mode (stdout carries exactly one JSON object for\n * the whole process, and this is stderr noise an agent has no reason to\n * parse) and it must never print when stderr is not a TTY (piped into a log\n * file, captured by a harness, redirected in CI).\n */\n\ntype RGB = readonly [number, number, number];\n\n/** The website's brand gradient: teal → mauve → red, left to right. */\nconst GRADIENT_STOPS: readonly [RGB, RGB, RGB] = [\n  [0x70, 0xa5, 0xab],\n  [0x9f, 0x70, 0x77],\n  [0xed, 0x1c, 0x24],\n];\n\n/** Option C (\"colossal\") — the full banner, shown on first init/login. */\nconst FULL_ART: readonly string[] = [\n  ' .d88b.  888  888  8888b.  88888b.   .d88b.  .d8888b  ',\n  'd8P  Y8b 888 .88P     \"88b 888 \"88b d88\"\"88b 88K      ',\n  '88888888 888888K  .d888888 888  888 888  888 \"Y8888b. ',\n  'Y8b.     888 \"88b 888  888 888  888 Y88..88P      X88 ',\n  ' \"Y8888  888  888 \"Y888888 888  888  \"Y88P\"   88888P\\' ',\n];\n\n/** Option D (\"pagga\") — the mini-mark, shown on a repeat login. */\nconst MINI_ART: readonly string[] = [\n  '░█▀▀░█░█░█▀█░█▀█░█▀█░█▀▀',\n  '░█▀▀░█▀▄░█▀█░█░█░█░█░▀▀█',\n  '░▀▀▀░▀░▀░▀░▀░▀░▀░▀▀▀░▀▀▀',\n];\n\nconst TAGLINE = 'The SDK with a skill-full DX';\n\nfunction lerp(a: number, b: number, t: number): number {\n  return Math.round(a + (b - a) * t);\n}\n\n/** The gradient color at position `t` (0..1) along the three-stop ramp. */\nfunction colorAt(t: number): RGB {\n  const [start, mid, end] = GRADIENT_STOPS;\n  const [from, to, localT]: [RGB, RGB, number] =\n    t < 0.5 ? [start, mid, t * 2] : [mid, end, (t - 0.5) * 2];\n\n  return [\n    lerp(from[0], to[0], localT),\n    lerp(from[1], to[1], localT),\n    lerp(from[2], to[2], localT),\n  ];\n}\n\n/**\n * Paint ASCII art lines with the gradient, one color per column, left to\n * right. `color: false` renders the raw art with zero escape codes — the\n * `NO_COLOR` and non-TTY paths. Pure and exported so the gradient math is\n * unit-testable independent of the printing gate in `printBanner`.\n */\nexport function paintBanner(lines: readonly string[], color: boolean): string {\n  const width = Math.max(...lines.map((line) => line.length));\n\n  return lines\n    .map((line) => {\n      const padded = line.padEnd(width);\n\n      if (!color) return padded;\n\n      const painted = [...padded]\n        .map((ch, x) => {\n          if (ch === ' ') return ch;\n          const [r, g, b] = colorAt(width <= 1 ? 0 : x / (width - 1));\n          return `\\x1b[38;2;${r};${g};${b}m${ch}`;\n        })\n        .join('');\n\n      return `${painted}\\x1b[0m`;\n    })\n    .join('\\n');\n}\n\nfunction dim(text: string, color: boolean): string {\n  return color ? `\\x1b[2m${text}\\x1b[0m` : text;\n}\n\n/**\n * Print the gradient banner to stderr, gated on ALL of:\n *\n *   - human mode (never in JSON mode — an agent must never see this)\n *   - stderr being a TTY (never when piped, redirected, or captured)\n *   - `EKANOS_NO_BANNER` unset (any value at all suppresses it entirely)\n *\n * `NO_COLOR` does not suppress the banner — it renders the same art with zero\n * escape codes, per the standard (https://no-color.org).\n *\n * Call sites stay a single line: all gating lives here, not at the call site.\n */\nexport function printBanner(ctx: CliContext, kind: 'full' | 'mini'): void {\n  if (ctx.jsonMode) return;\n  if (!ctx.stderrIsTTY) return;\n  if (ctx.env.EKANOS_NO_BANNER !== undefined) return;\n\n  const color = ctx.env.NO_COLOR === undefined;\n  const art = kind === 'full' ? FULL_ART : MINI_ART;\n\n  ctx.log(paintBanner(art, color));\n\n  if (kind === 'full') {\n    ctx.log(dim(TAGLINE, color));\n  }\n}\n"]}
+{"version":3,"file":"banner.js","sourceRoot":"","sources":["../src/banner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAerC,uEAAuE;AACvE,MAAM,cAAc,GAA6B;IAC/C,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IAClB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IAClB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;CACnB,CAAC;AAEF,0EAA0E;AAC1E,MAAM,QAAQ,GAAsB;IAClC,wDAAwD;IACxD,wDAAwD;IACxD,wDAAwD;IACxD,wDAAwD;IACxD,yDAAyD;CAC1D,CAAC;AAEF,mEAAmE;AACnE,MAAM,QAAQ,GAAsB;IAClC,0BAA0B;IAC1B,0BAA0B;IAC1B,0BAA0B;CAC3B,CAAC;AAEF,MAAM,OAAO,GAAG,8BAA8B,CAAC;AAE/C,SAAS,IAAI,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS;IAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,2EAA2E;AAC3E,SAAS,OAAO,CAAC,CAAS;IACxB,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,cAAc,CAAC;IACzC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,GACtB,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5D,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAwB,EAAE,KAAc;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAE5D,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAElC,IAAI,CAAC,KAAK;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC;aACxB,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;YACb,IAAI,EAAE,KAAK,GAAG;gBAAE,OAAO,EAAE,CAAC;YAC1B,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;YAC5D,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,CAAC,CAAC;aACD,IAAI,CAAC,EAAE,CAAC,CAAC;QAEZ,OAAO,GAAG,OAAO,SAAS,CAAC;IAC7B,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,GAAG,CAAC,IAAY,EAAE,KAAc;IACvC,OAAO,KAAK,CAAC,CAAC,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,WAAW,CAAC,GAAe,EAAE,IAAqB;IAChE,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO;IACzB,IAAI,CAAC,GAAG,CAAC,WAAW;QAAE,OAAO;IAC7B,IAAI,GAAG,CAAC,GAAG,CAAC,gBAAgB,KAAK,SAAS;QAAE,OAAO;IAEnD,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IAElD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAEjC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC","sourcesContent":["import type { CliContext } from './context';\nimport { colorsEnabled } from './ui';\n\n/**\n * The gradient ASCII banner shown on a first-time `ekanos init` / `login`.\n *\n * Every gate here matters more than the art: this is decoration on stderr,\n * and it must never leak into an agent's view of the CLI. In particular it\n * must NEVER print in JSON mode (stdout carries exactly one JSON object for\n * the whole process, and this is stderr noise an agent has no reason to\n * parse) and it must never print when stderr is not a TTY (piped into a log\n * file, captured by a harness, redirected in CI).\n */\n\ntype RGB = readonly [number, number, number];\n\n/** The website's brand gradient: teal → mauve → red, left to right. */\nconst GRADIENT_STOPS: readonly [RGB, RGB, RGB] = [\n  [0x70, 0xa5, 0xab],\n  [0x9f, 0x70, 0x77],\n  [0xed, 0x1c, 0x24],\n];\n\n/** Option C (\"colossal\") — the full banner, shown on first init/login. */\nconst FULL_ART: readonly string[] = [\n  ' .d88b.  888  888  8888b.  88888b.   .d88b.  .d8888b  ',\n  'd8P  Y8b 888 .88P     \"88b 888 \"88b d88\"\"88b 88K      ',\n  '88888888 888888K  .d888888 888  888 888  888 \"Y8888b. ',\n  'Y8b.     888 \"88b 888  888 888  888 Y88..88P      X88 ',\n  ' \"Y8888  888  888 \"Y888888 888  888  \"Y88P\"   88888P\\' ',\n];\n\n/** Option D (\"pagga\") — the mini-mark, shown on a repeat login. */\nconst MINI_ART: readonly string[] = [\n  '░█▀▀░█░█░█▀█░█▀█░█▀█░█▀▀',\n  '░█▀▀░█▀▄░█▀█░█░█░█░█░▀▀█',\n  '░▀▀▀░▀░▀░▀░▀░▀░▀░▀▀▀░▀▀▀',\n];\n\nconst TAGLINE = 'The SDK with a skill-full DX';\n\nfunction lerp(a: number, b: number, t: number): number {\n  return Math.round(a + (b - a) * t);\n}\n\n/** The gradient color at position `t` (0..1) along the three-stop ramp. */\nfunction colorAt(t: number): RGB {\n  const [start, mid, end] = GRADIENT_STOPS;\n  const [from, to, localT]: [RGB, RGB, number] =\n    t < 0.5 ? [start, mid, t * 2] : [mid, end, (t - 0.5) * 2];\n\n  return [\n    lerp(from[0], to[0], localT),\n    lerp(from[1], to[1], localT),\n    lerp(from[2], to[2], localT),\n  ];\n}\n\n/**\n * Paint ASCII art lines with the gradient, one color per column, left to\n * right. `color: false` renders the raw art with zero escape codes — the\n * `NO_COLOR` and non-TTY paths. Pure and exported so the gradient math is\n * unit-testable independent of the printing gate in `printBanner`.\n */\nexport function paintBanner(lines: readonly string[], color: boolean): string {\n  const width = Math.max(...lines.map((line) => line.length));\n\n  return lines\n    .map((line) => {\n      const padded = line.padEnd(width);\n\n      if (!color) return padded;\n\n      const painted = [...padded]\n        .map((ch, x) => {\n          if (ch === ' ') return ch;\n          const [r, g, b] = colorAt(width <= 1 ? 0 : x / (width - 1));\n          return `\\x1b[38;2;${r};${g};${b}m${ch}`;\n        })\n        .join('');\n\n      return `${painted}\\x1b[0m`;\n    })\n    .join('\\n');\n}\n\nfunction dim(text: string, color: boolean): string {\n  return color ? `\\x1b[2m${text}\\x1b[0m` : text;\n}\n\n/**\n * Print the gradient banner to stderr, gated on ALL of:\n *\n *   - human mode (never in JSON mode — an agent must never see this)\n *   - stderr being a TTY (never when piped, redirected, or captured)\n *   - `EKANOS_NO_BANNER` unset (any value at all suppresses it entirely)\n *\n * `NO_COLOR` does not suppress the banner — it renders the same art with zero\n * escape codes, per the standard (https://no-color.org). The actual on/off\n * call is `ui.ts`'s `colorsEnabled` — the one gate every color decision in\n * this package flows through — so the banner also honours `TERM=dumb` and\n * `FORCE_COLOR` the same way the findings renderer and everything else does,\n * without duplicating the rule here.\n *\n * Call sites stay a single line: all gating lives here, not at the call site.\n */\nexport function printBanner(ctx: CliContext, kind: 'full' | 'mini'): void {\n  if (ctx.jsonMode) return;\n  if (!ctx.stderrIsTTY) return;\n  if (ctx.env.EKANOS_NO_BANNER !== undefined) return;\n\n  const color = colorsEnabled({ isTTY: ctx.stderrIsTTY, env: ctx.env });\n  const art = kind === 'full' ? FULL_ART : MINI_ART;\n\n  ctx.log(paintBanner(art, color));\n\n  if (kind === 'full') {\n    ctx.log(dim(TAGLINE, color));\n  }\n}\n"]}

package/dist/commands/init.d.ts

@@ -32,6 +32,12 @@ export interface InitArgs {
      * prompts for it.
      */
     docs?: string[];
+    /**
+     * Test-only override for the clack wizard gate (`canWizard` in
+     * `wizard.ts`) — never set from real CLI wiring. See `RunOptions` in
+     * `index.ts`.
+     */
+    stdinIsTTY?: boolean;
 }
 /**
  * The files init writes: template basename → destination path.
@@ -79,8 +85,14 @@ export declare const DOCS_GROUNDING_FILES: {
  * published deps. Idempotent: an existing file is left untouched (reported as
  * skipped) unless --force is passed. Never prompts — a missing --slug fails
  * with a usage error naming the flag.
+ *
+ * In human mode at a real TTY (`canWizard`), the scaffold runs behind a
+ * clack `intro`/spinner/`outro` flow instead of the flat `ctx.log` lines
+ * below — see `wizard.ts`. This is a restyle, not a new interaction: the
+ * data written to disk and the JSON/human-non-TTY envelope are identical
+ * either way, and nothing here ever waits on a prompt.
  */
-export declare function runInit(ctx: CliContext, args: InitArgs): ExitCode;
+export declare function runInit(ctx: CliContext, args: InitArgs): Promise<ExitCode>;
 /**
  * Copy every bundled skill tree (`templates/skills/<name>/`) into the
  * scaffolded project at `.claude/skills/<name>/`, verbatim — see

package/dist/commands/init.js

@@ -7,6 +7,7 @@ import { mergeManifest, serializeManifest, } from '../merge-manifest.js';
 import { docEntryProblem, serializeProject, } from '../project.js';
 import { classifyPath, readFileNoFollow, writeFileNoFollow } from '../safe-fs.js';
 import { readTemplate, templatesDir, toDisplayName } from '../templates.js';
+import { canWizard, wizard } from '../wizard.js';
 const SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 /**
  * The files init writes: template basename → destination path.
@@ -59,6 +60,9 @@ const FILES = [
     // and, worse, no type error in the scaffold ever surfaces.
     { template: 'tsconfig.json.tmpl', dest: 'tsconfig.json' },
     { template: 'vitest.config.ts.tmpl', dest: 'vitest.config.ts' },
+    // Wired via package.json's "prepare" script — see setup-hooks.mjs.tmpl's
+    // own header for what it does and why it tolerates a non-git directory.
+    { template: 'scripts/setup-hooks.mjs.tmpl', dest: 'scripts/setup-hooks.mjs' },
     { template: 'src/integration.ts.tmpl', dest: 'src/integration.ts' },
     {
         template: 'src/integration.test.ts.tmpl',
@@ -74,8 +78,14 @@ const FILES = [
  * published deps. Idempotent: an existing file is left untouched (reported as
  * skipped) unless --force is passed. Never prompts — a missing --slug fails
  * with a usage error naming the flag.
+ *
+ * In human mode at a real TTY (`canWizard`), the scaffold runs behind a
+ * clack `intro`/spinner/`outro` flow instead of the flat `ctx.log` lines
+ * below — see `wizard.ts`. This is a restyle, not a new interaction: the
+ * data written to disk and the JSON/human-non-TTY envelope are identical
+ * either way, and nothing here ever waits on a prompt.
  */
-export function runInit(ctx, args) {
+export async function runInit(ctx, args) {
     var _a;
     const slug = args.slug;
     if (!slug) {
@@ -98,6 +108,9 @@ export function runInit(ctx, args) {
                 '"--docs docs/api.md". Repeat the flag for multiple entries.');
         }
     }
+    const useWizard = canWizard(ctx, { stdinIsTTY: args.stdinIsTTY });
+    if (useWizard)
+        wizard.intro('ekanos init');
     // Default to `./<slug>`, not the cwd: scaffolding six files into whatever
     // directory the partner happened to be sitting in is how a real project got
     // polluted. `--dir .` remains the explicit way to scaffold in place.
@@ -129,6 +142,8 @@ export function runInit(ctx, args) {
             'or remove the symlink first.');
     }
     fs.mkdirSync(targetDir, { recursive: true });
+    const spinner = useWizard ? wizard.spinner() : null;
+    spinner === null || spinner === void 0 ? void 0 : spinner.start(`Scaffolding "${slug}"…`);
     for (const { template, dest } of FILES) {
         const destPath = path.join(targetDir, dest);
         const kind = classifyPath(destPath);
@@ -154,19 +169,29 @@ export function runInit(ctx, args) {
     const manifest = writeManifest(targetDir, vars, args.force);
     if (manifest.kind === 'created')
         created.push('package.json');
-    for (const file of created)
-        ctx.log(`  created ${file}`);
-    if (manifest.kind === 'merged') {
-        ctx.log(`  merged package.json (added ${manifest.added.length} field${manifest.added.length === 1 ? '' : 's'})`);
-    }
-    if (manifest.kind === 'unchanged') {
-        ctx.log('  package.json already had everything the scaffold adds');
+    spinner === null || spinner === void 0 ? void 0 : spinner.stop(`Scaffolded "${slug}"`);
+    if (useWizard) {
+        // Per-file "created" detail stays collapsed into the count above — the
+        // note surfaces only what needs a partner's attention: skips (they hid
+        // real data loss before, see `SkippedFile`'s doc comment) and manifest
+        // notes.
+        wizard.note(wizardSummaryDetail({ created, skipped, manifest }), 'Summary');
     }
-    for (const skip of skipped) {
-        ctx.log(`  skipped ${skip.file} — ${skip.reason}. ${skip.hint}`);
-    }
-    for (const note of manifest.notes) {
-        ctx.warn(`  ${note.message} ${note.hint}`);
+    else {
+        for (const file of created)
+            ctx.log(`  created ${file}`);
+        if (manifest.kind === 'merged') {
+            ctx.log(`  merged package.json (added ${manifest.added.length} field${manifest.added.length === 1 ? '' : 's'})`);
+        }
+        if (manifest.kind === 'unchanged') {
+            ctx.log('  package.json already had everything the scaffold adds');
+        }
+        for (const skip of skipped) {
+            ctx.log(`  skipped ${skip.file} — ${skip.reason}. ${skip.hint}`);
+        }
+        for (const note of manifest.notes) {
+            ctx.warn(`  ${note.message} ${note.hint}`);
+        }
     }
     const data = {
         slug,
@@ -190,8 +215,40 @@ export function runInit(ctx, args) {
         noteCount: manifest.notes.length,
     });
     printBanner(ctx, 'full');
+    if (useWizard) {
+        const relDir = path.relative(args.cwd, targetDir) || '.';
+        wizard.outro(`Next steps:\n\n  cd ${relDir}\n  ekanos dev`);
+    }
     return ctx.succeed(data, summary);
 }
+/**
+ * The clack `note()` body for a successful wizard-mode scaffold — collapses
+ * "created" down to a count (the flat per-file lines this replaces are the
+ * `else` branch above) and surfaces only what needs a partner's attention:
+ * skips and manifest notes, each with its full hint.
+ */
+function wizardSummaryDetail(params) {
+    const { created, skipped, manifest } = params;
+    const lines = [
+        `${created.length} file${created.length === 1 ? '' : 's'} written`,
+    ];
+    if (manifest.kind === 'merged') {
+        lines.push(`package.json merged (+${manifest.added.length} field${manifest.added.length === 1 ? '' : 's'})`);
+    }
+    else if (manifest.kind === 'unchanged') {
+        lines.push('package.json already had everything the scaffold adds');
+    }
+    if (skipped.length > 0) {
+        lines.push('', 'Skipped (already existed):');
+        for (const skip of skipped) {
+            lines.push(`  ${skip.file} — ${skip.hint}`);
+        }
+    }
+    for (const note of manifest.notes) {
+        lines.push('', `⚠ ${note.message} ${note.hint}`);
+    }
+    return lines.join('\n');
+}
 /**
  * The scaffolded ekanos.json: the template, plus the collected `--docs`
  * entries when there are any. Parse-then-serialize (rather than string

package/dist/commands/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE1D,OAAO,EAGL,aAAa,EACb,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAqCzE,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAElD;;;;;;;GAOG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAyC;IACvE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE;IACjD,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE;IACjD,EAAE,QAAQ,EAAE,sBAAsB,EAAE,IAAI,EAAE,gCAAgC,EAAE;CAC7E,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAyC;IACxE,0EAA0E;IAC1E,kEAAkE;IAClE,EAAE,QAAQ,EAAE,wBAAwB,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACjE,oEAAoE;IACpE,+DAA+D;IAC/D,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE;CACjD,CAAC;AAEF,MAAM,KAAK,GAAyC;IAClD,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,aAAa,EAAE;IACrD,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,EAAE;IAClD,6EAA6E;IAC7E,2DAA2D;IAC3D,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,eAAe,EAAE;IACzD,EAAE,QAAQ,EAAE,uBAAuB,EAAE,IAAI,EAAE,kBAAkB,EAAE;IAC/D,EAAE,QAAQ,EAAE,yBAAyB,EAAE,IAAI,EAAE,oBAAoB,EAAE;IACnE;QACE,QAAQ,EAAE,8BAA8B;QACxC,IAAI,EAAE,yBAAyB;KAChC;IACD,GAAG,oBAAoB;IACvB,GAAG,mBAAmB;CACvB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CAAC,GAAe,EAAE,IAAc;;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,UAAU,CACd,uBAAuB,EACvB,qEAAqE;YACnE,iEAAiE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,UAAU,CACd,iBAAiB,IAAI,IAAI,EACzB,wEAAwE;YACtE,kBAAkB,CACrB,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,IAAI,GAAG,MAAA,IAAI,CAAC,IAAI,mCAAI,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,UAAU,CACd,yBAAyB,OAAO,EAAE,EAClC,8DAA8D;gBAC5D,yDAAyD;gBACzD,6DAA6D,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,SAAS,GACb,IAAI,CAAC,GAAG,KAAK,SAAS;QACpB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;IAE/D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,0EAA0E;IAC1E,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,YAAY;IACZ,IAAI,WAAW,GAAoB,IAAI,CAAC;IACxC,IAAI,CAAC;QACH,WAAW,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAAC,WAAM,CAAC;QACP,WAAW,GAAG,IAAI,CAAC,CAAC,sCAAsC;IAC5D,CAAC;IACD,IAAI,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,cAAc,EAAE,EAAE,CAAC;QAClC,MAAM,iBAAiB,CACrB,wBAAwB,SAAS,mCAAmC;YAClE,iDAAiD,EACnD,sEAAsE;YACpE,8BAA8B,CACjC,CAAC;IACJ,CAAC;IACD,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7C,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,0EAA0E;QAC1E,mEAAmE;QACnE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,mBAAmB;gBAC3B,IAAI,EACF,6DAA6D;oBAC7D,gDAAgD,IAAI,GAAG;aAC1D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,iBAAiB,CACf,SAAS,EACT,QAAQ,EACR,IAAI,KAAK,aAAa;YACpB,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC;YAChC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CACjC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAEhC,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAE9D,KAAK,MAAM,IAAI,IAAI,OAAO;QAAE,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,GAAG,CAAC,GAAG,CACL,gCAAgC,QAAQ,CAAC,KAAK,CAAC,MAAM,SACnD,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACrC,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAClC,GAAG,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IACrE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,IAAI,GAAG;QACX,IAAI;QACJ,GAAG,EAAE,SAAS;QACd,OAAO;QACP,OAAO;QACP,QAAQ,EAAE;YACR,MAAM,EAAE,QAAQ,CAAC,IAAI;YACrB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB;KACF,CAAC;IAEF,MAAM,OAAO,GAAG,SAAS,CAAC;QACxB,IAAI;QACJ,GAAG,EAAE,SAAS;QACd,OAAO;QACP,OAAO;QACP,cAAc,EAAE,QAAQ,CAAC,IAAI;QAC7B,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;QACpC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;KACjC,CAAC,CAAC;IAEH,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAEzB,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,IAAsC,EACtC,IAAc;IAEd,MAAM,QAAQ,GAAG,YAAY,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAkB,CAAC;IACtD,OAAO,gBAAgB,iCAAM,OAAO,KAAE,IAAI,IAAG,CAAC;AAChD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAiB,EACjB,KAAc,EACd,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,QAAQ,CAAC,EAChD,YAAiC,OAAO;IAExC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAEnD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,MAAM,SAAS,GAAG,EAAE;SACjB,WAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAChD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SACtC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,IAAI,EAAE,CAAC;IAEV,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,gBAAgB,CAC7B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAC3B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAC9B,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CACtC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CACV,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACtC,OAAO;gBACL,IAAI;gBACJ,MAAM,EAAE,mBAAmB;gBAC3B,IAAI,EACF,8DAA8D;oBAC9D,oDAAoD,IAAI,GAAG;aAC9D,CAAC;QACJ,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACvC,CAAC;AASD;;;;;;;;GAQG;AACH,SAAS,aAAa,CACpB,SAAiB,EACjB,IAAsC,EACtC,KAAc;IAEd,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,YAAY,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;IAEzD,2EAA2E;IAC3E,kEAAkE;IAClE,MAAM,WAAW,GAAG,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAE1D,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK,EAAE,CAAC;QAClC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAa,CAAC;IAElD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAa,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+DAA+D;QAC/D,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,EAAE;YACR,KAAK,EAAE;gBACL;oBACE,KAAK,EAAE,QAAQ;oBACf,OAAO,EAAE,mCACP,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE;oBACF,IAAI,EACF,6DAA6D;wBAC7D,gDAAgD;iBACnD;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC;IACJ,CAAC;IAED,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3E,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,MAQlB;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CACR,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,QAAQ,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,CACjF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,aAAa,+BAA+B,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,+BAA+B,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,0BAA0B,MAAM,CAAC,IAAI,8BAA8B,MAAM,CAAC,GAAG,GAAG,CAAC;IAC1F,CAAC;IACD,OAAO,qBAAqB,MAAM,CAAC,IAAI,UAAU,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACvF,CAAC","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport { printBanner } from '../banner';\nimport type { CliContext } from '../context';\nimport { copyTreeVerbatim } from '../copy-tree';\nimport { invalidStateError, usageError } from '../errors';\nimport type { ExitCode } from '../exit-codes';\nimport {\n  type Manifest,\n  type ManifestNote,\n  mergeManifest,\n  serializeManifest,\n} from '../merge-manifest';\nimport {\n  type EkanosProject,\n  docEntryProblem,\n  serializeProject,\n} from '../project';\nimport { classifyPath, readFileNoFollow, writeFileNoFollow } from '../safe-fs';\nimport { readTemplate, templatesDir, toDisplayName } from '../templates';\n\n/**\n * A file init did not write, and what the partner should do about it.\n *\n * Every ERROR path in this CLI carries an imperative hint; a skip did not, and\n * that asymmetry was the bug — `skipped package.json (already exists)` hid the\n * loss of eleven dependencies and the project's module type.\n */\nexport interface SkippedFile {\n  file: string;\n  reason: string;\n  hint: string;\n}\n\nexport interface InitArgs {\n  slug?: string;\n  /**\n   * Explicit target directory. When omitted, init scaffolds into `./<slug>`\n   * under `cwd` — never into `cwd` itself. A real partner ran `init` in a\n   * populated directory and got six files sprayed into it; `--dir .` is the\n   * explicit opt-in for that.\n   */\n  dir?: string;\n  cwd: string;\n  force: boolean;\n  /** Accepted for non-interactive ergonomics; init never prompts regardless. */\n  yes: boolean;\n  /**\n   * Repeatable `--docs` entries — http(s) URLs or project-relative paths to\n   * the target API's documentation, written into the scaffolded ekanos.json\n   * as `docs`. Absent flag means the field is simply omitted; init never\n   * prompts for it.\n   */\n  docs?: string[];\n}\n\nconst SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;\n\n/**\n * The files init writes: template basename → destination path.\n *\n * `package.json` is handled separately (see `writeManifest`) because it is the\n * one file a partner plausibly already has — `npm init -y` before `ekanos\n * init` is the ordinary way to start — and skipping it silently costs them\n * every dependency and script.\n */\n/**\n * The agent-context files. The SDK's day-1 users are coding agents, so the\n * scaffold ships the authoring contract alongside the code: AGENTS.md is the\n * contract, CLAUDE.md points at it, and the Claude Code skill teaches the\n * iterate-validate-publish loop. Version-matched to the CLI because they live\n * in its templates.\n *\n * Exported so `ekanos upgrade` can regenerate exactly this set from the\n * NEWLY installed CLI's templates after a version bump — a stale AGENTS.md\n * teaches an agent yesterday's contract, which is as harmful as a stale\n * binary. One list, so `init` and `upgrade` can never disagree on what \"the\n * agent-context files\" even are.\n */\nexport const AGENT_CONTEXT_FILES: { template: string; dest: string }[] = [\n  { template: 'AGENTS.md.tmpl', dest: 'AGENTS.md' },\n  { template: 'CLAUDE.md.tmpl', dest: 'CLAUDE.md' },\n  { template: 'claude-skill.md.tmpl', dest: '.claude/skills/ekanos/SKILL.md' },\n];\n\n/**\n * The docs-grounding artifacts, exported for the same reason as\n * `AGENT_CONTEXT_FILES`: `upgrade` must create these when they are missing\n * (an older project upgrading into a toolchain whose AGENTS.md and skills\n * now reference them), and one list keeps `init` and `upgrade` from ever\n * disagreeing on what they are. Unlike the agent-context files these are\n * NEVER regenerated — `docs/api-notes.md` is agent/partner-authored after\n * the scaffold and `.mcp.json` may carry local additions — only created\n * when absent.\n */\nexport const DOCS_GROUNDING_FILES: { template: string; dest: string }[] = [\n  // The agent-authored snapshot of the target API — see the template itself\n  // and AGENTS.md's \"API documentation\" section for the convention.\n  { template: 'docs/api-notes.md.tmpl', dest: 'docs/api-notes.md' },\n  // Per-project MCP config so Claude Code picks up Context7 (the docs\n  // fallback in the resolution ladder) without any global setup.\n  { template: 'mcp.json.tmpl', dest: '.mcp.json' },\n];\n\nconst FILES: { template: string; dest: string }[] = [\n  { template: 'ekanos.json.tmpl', dest: 'ekanos.json' },\n  { template: 'gitignore.tmpl', dest: '.gitignore' },\n  // Without this, the `typecheck` script below prints tsc's help and exits 1 —\n  // and, worse, no type error in the scaffold ever surfaces.\n  { template: 'tsconfig.json.tmpl', dest: 'tsconfig.json' },\n  { template: 'vitest.config.ts.tmpl', dest: 'vitest.config.ts' },\n  { template: 'src/integration.ts.tmpl', dest: 'src/integration.ts' },\n  {\n    template: 'src/integration.test.ts.tmpl',\n    dest: 'src/integration.test.ts',\n  },\n  ...DOCS_GROUNDING_FILES,\n  ...AGENT_CONTEXT_FILES,\n];\n\n/**\n * `init` — instantiate a project from the bundled template: ekanos.json, a\n * working minimal defineIntegration, a test, a vitest config (with the\n * required SDK inline block), a .gitignore, and a package.json with real\n * published deps. Idempotent: an existing file is left untouched (reported as\n * skipped) unless --force is passed. Never prompts — a missing --slug fails\n * with a usage error naming the flag.\n */\nexport function runInit(ctx: CliContext, args: InitArgs): ExitCode {\n  const slug = args.slug;\n  if (!slug) {\n    throw usageError(\n      'init requires a slug.',\n      'Pass it explicitly: \"ekanos init --slug <your-integration> --yes\". ' +\n        'The CLI never prompts, so the slug must be on the command line.',\n    );\n  }\n  if (!SLUG_PATTERN.test(slug)) {\n    throw usageError(\n      `Invalid slug \"${slug}\".`,\n      'Use kebab-case: lowercase [a-z0-9] segments joined by single hyphens, ' +\n        'e.g. \"acme-crm\".',\n    );\n  }\n\n  // Same rule the ekanos.json schema enforces, applied at the flag so a bad\n  // entry fails HERE (usage, exit 2) instead of scaffolding a project whose\n  // very first `ekanos validate` cannot even load its config.\n  const docs = args.docs ?? [];\n  for (const entry of docs) {\n    const problem = docEntryProblem(entry);\n    if (problem) {\n      throw usageError(\n        `Invalid --docs value: ${problem}`,\n        'Pass --docs an http(s) URL or a project-relative path, e.g. ' +\n          '\"--docs https://developer.example.com/openapi.json\" or ' +\n          '\"--docs docs/api.md\". Repeat the flag for multiple entries.',\n      );\n    }\n  }\n\n  // Default to `./<slug>`, not the cwd: scaffolding six files into whatever\n  // directory the partner happened to be sitting in is how a real project got\n  // polluted. `--dir .` remains the explicit way to scaffold in place.\n  const targetDir =\n    args.dir !== undefined\n      ? path.resolve(args.cwd, args.dir)\n      : path.resolve(args.cwd, slug);\n  const vars = { SLUG: slug, DISPLAY_NAME: toDisplayName(slug) };\n\n  const created: string[] = [];\n  const skipped: SkippedFile[] = [];\n\n  // The project root is the guard for every write below: creating it raw is\n  // fine (it is the boundary, not inside it), but everything under it goes\n  // through safe-fs so a planted symlink refuses loudly instead of teleporting\n  // a write outside the project. See safe-fs.ts for the threat model. The one\n  // case the guard cannot see is the boundary ITSELF being a symlink — the\n  // containment math is lexical against `targetDir`, so a planted link there\n  // would relocate every \"contained\" write wholesale. Refuse it. (A symlinked\n  // ANCESTOR — macOS's /tmp, a linked home — stays fine: only the leaf is\n  // checked.)\n  let targetStats: fs.Stats | null = null;\n  try {\n    targetStats = fs.lstatSync(targetDir);\n  } catch {\n    targetStats = null; // does not exist yet — ours to create\n  }\n  if (targetStats?.isSymbolicLink()) {\n    throw invalidStateError(\n      `The target directory ${targetDir} is a symlink, so the scaffold's ` +\n        'write-containment guarantees cannot hold there.',\n      'Scaffold into the real directory (pass its resolved path to --dir), ' +\n        'or remove the symlink first.',\n    );\n  }\n  fs.mkdirSync(targetDir, { recursive: true });\n\n  for (const { template, dest } of FILES) {\n    const destPath = path.join(targetDir, dest);\n    const kind = classifyPath(destPath);\n    // A symlink is never \"already exists\": skipping would keep the plant, and\n    // writing through it is the attack — writeFileNoFollow refuses it.\n    if (kind !== 'missing' && kind !== 'symlink' && !args.force) {\n      skipped.push({\n        file: dest,\n        reason: 'it already exists',\n        hint:\n          `Compare it against the scaffold and merge anything you are ` +\n          `missing, or re-run with --force to overwrite ${dest}.`,\n      });\n      continue;\n    }\n\n    writeFileNoFollow(\n      targetDir,\n      destPath,\n      dest === 'ekanos.json'\n        ? renderEkanosConfig(vars, docs)\n        : readTemplate(template, vars),\n    );\n    created.push(dest);\n  }\n\n  const skills = copyBundledSkillTrees(targetDir, args.force);\n  created.push(...skills.created);\n  skipped.push(...skills.skipped);\n\n  const manifest = writeManifest(targetDir, vars, args.force);\n  if (manifest.kind === 'created') created.push('package.json');\n\n  for (const file of created) ctx.log(`  created ${file}`);\n  if (manifest.kind === 'merged') {\n    ctx.log(\n      `  merged package.json (added ${manifest.added.length} field${\n        manifest.added.length === 1 ? '' : 's'\n      })`,\n    );\n  }\n  if (manifest.kind === 'unchanged') {\n    ctx.log('  package.json already had everything the scaffold adds');\n  }\n  for (const skip of skipped) {\n    ctx.log(`  skipped ${skip.file} — ${skip.reason}. ${skip.hint}`);\n  }\n  for (const note of manifest.notes) {\n    ctx.warn(`  ${note.message} ${note.hint}`);\n  }\n\n  const data = {\n    slug,\n    dir: targetDir,\n    created,\n    skipped,\n    manifest: {\n      action: manifest.kind,\n      added: manifest.added,\n      kept: manifest.kept,\n      notes: manifest.notes,\n    },\n  };\n\n  const summary = summarize({\n    slug,\n    dir: targetDir,\n    created,\n    skipped,\n    manifestAction: manifest.kind,\n    manifestAdded: manifest.added.length,\n    noteCount: manifest.notes.length,\n  });\n\n  printBanner(ctx, 'full');\n\n  return ctx.succeed(data, summary);\n}\n\n/**\n * The scaffolded ekanos.json: the template, plus the collected `--docs`\n * entries when there are any. Parse-then-serialize (rather than string\n * surgery) so the written file is exactly what `loadProject` will read back.\n */\nfunction renderEkanosConfig(\n  vars: Readonly<Record<string, string>>,\n  docs: string[],\n): string {\n  const rendered = readTemplate('ekanos.json.tmpl', vars);\n  if (docs.length === 0) return rendered;\n  const project = JSON.parse(rendered) as EkanosProject;\n  return serializeProject({ ...project, docs });\n}\n\n/**\n * Copy every bundled skill tree (`templates/skills/<name>/`) into the\n * scaffolded project at `.claude/skills/<name>/`, verbatim — see\n * `copyTreeVerbatim` for why these are bytes, never rendered templates. The\n * walk is generic: a skill directory added to the published templates ships\n * with no code change here. A CLI build with no `templates/skills/` at all\n * (today's) scaffolds nothing and reports nothing.\n *\n * `skillsRoot` is injectable for tests; real callers take the default.\n */\nexport function copyBundledSkillTrees(\n  targetDir: string,\n  force: boolean,\n  skillsRoot = path.join(templatesDir(), 'skills'),\n  onRefusal: 'throw' | 'collect' = 'throw',\n): { created: string[]; skipped: SkippedFile[]; refused: string[] } {\n  if (!fs.existsSync(skillsRoot))\n    return { created: [], skipped: [], refused: [] };\n\n  const created: string[] = [];\n  const skipped: SkippedFile[] = [];\n  const refused: string[] = [];\n\n  const skillDirs = fs\n    .readdirSync(skillsRoot, { withFileTypes: true })\n    .filter((entry) => entry.isDirectory())\n    .map((entry) => entry.name)\n    .sort();\n\n  for (const name of skillDirs) {\n    const destBase = path.join('.claude', 'skills', name);\n    const result = copyTreeVerbatim(\n      path.join(skillsRoot, name),\n      path.join(targetDir, destBase),\n      { force, root: targetDir, onRefusal },\n    );\n    created.push(...result.created.map((rel) => path.join(destBase, rel)));\n    refused.push(...result.refused.map((rel) => path.join(destBase, rel)));\n    skipped.push(\n      ...result.skipped.map((rel) => {\n        const file = path.join(destBase, rel);\n        return {\n          file,\n          reason: 'it already exists',\n          hint:\n            `Compare it against the bundled skill and merge anything you ` +\n            `are missing, or re-run with --force to overwrite ${file}.`,\n        };\n      }),\n    );\n  }\n\n  return { created, skipped, refused };\n}\n\ntype ManifestOutcome = {\n  kind: 'created' | 'merged' | 'unchanged';\n  added: string[];\n  kept: string[];\n  notes: ManifestNote[];\n};\n\n/**\n * Write or MERGE package.json.\n *\n * A partner who ran `npm init -y` first had a manifest with none of the\n * scaffold's dependencies and `\"type\": \"commonjs\"` under ESM sources, and the\n * old behaviour reported that as one word: \"skipped\". Merging is additive — a\n * version or script they already set is theirs and is never touched — so the\n * ordinary `npm init -y` path now lands somewhere that installs and runs.\n */\nfunction writeManifest(\n  targetDir: string,\n  vars: Readonly<Record<string, string>>,\n  force: boolean,\n): ManifestOutcome {\n  const destPath = path.join(targetDir, 'package.json');\n  const rendered = readTemplate('package.json.tmpl', vars);\n\n  // readFileNoFollow refuses a symlinked package.json outright, so the write\n  // below can never follow one either; null means genuinely absent.\n  const existingRaw = readFileNoFollow(targetDir, destPath);\n\n  if (existingRaw === null || force) {\n    writeFileNoFollow(targetDir, destPath, rendered);\n    return { kind: 'created', added: [], kept: [], notes: [] };\n  }\n\n  const template = JSON.parse(rendered) as Manifest;\n\n  let existing: Manifest;\n  try {\n    existing = JSON.parse(existingRaw) as Manifest;\n  } catch (error) {\n    // Unparseable: do not guess, and do not clobber. Name the fix.\n    return {\n      kind: 'unchanged',\n      added: [],\n      kept: [],\n      notes: [\n        {\n          field: '(root)',\n          message: `package.json is not valid JSON: ${\n            error instanceof Error ? error.message : String(error)\n          }`,\n          hint:\n            'Fix the JSON syntax, then re-run \"ekanos init\" to have the ' +\n            \"scaffold's dependencies and scripts merged in.\",\n        },\n      ],\n    };\n  }\n\n  const result = mergeManifest(existing, template);\n  if (!result.changed) {\n    return {\n      kind: 'unchanged',\n      added: [],\n      kept: result.kept,\n      notes: result.notes,\n    };\n  }\n\n  writeFileNoFollow(targetDir, destPath, serializeManifest(result.manifest));\n  return {\n    kind: 'merged',\n    added: result.added,\n    kept: result.kept,\n    notes: result.notes,\n  };\n}\n\nfunction summarize(params: {\n  slug: string;\n  dir: string;\n  created: string[];\n  skipped: SkippedFile[];\n  manifestAction: ManifestOutcome['kind'];\n  manifestAdded: number;\n  noteCount: number;\n}): string {\n  const parts: string[] = [];\n  if (params.created.length > 0) {\n    parts.push(\n      `${params.created.length} file${params.created.length === 1 ? '' : 's'} written`,\n    );\n  }\n  if (params.manifestAction === 'merged') {\n    parts.push(`${params.manifestAdded} package.json field(s) merged`);\n  }\n  if (params.skipped.length > 0) {\n    parts.push(`${params.skipped.length} skipped`);\n  }\n  if (params.noteCount > 0) {\n    parts.push(`${params.noteCount} thing(s) need your attention`);\n  }\n\n  if (parts.length === 0) {\n    return `init: nothing to do — \"${params.slug}\" is already scaffolded in ${params.dir}.`;\n  }\n  return `init: scaffolded \"${params.slug}\" into ${params.dir} (${parts.join(', ')}).`;\n}\n"]}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE1D,OAAO,EAGL,aAAa,EACb,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AA2C9C,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAElD;;;;;;;GAOG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAyC;IACvE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE;IACjD,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE;IACjD,EAAE,QAAQ,EAAE,sBAAsB,EAAE,IAAI,EAAE,gCAAgC,EAAE;CAC7E,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAyC;IACxE,0EAA0E;IAC1E,kEAAkE;IAClE,EAAE,QAAQ,EAAE,wBAAwB,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACjE,oEAAoE;IACpE,+DAA+D;IAC/D,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE;CACjD,CAAC;AAEF,MAAM,KAAK,GAAyC;IAClD,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,aAAa,EAAE;IACrD,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,EAAE;IAClD,6EAA6E;IAC7E,2DAA2D;IAC3D,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,eAAe,EAAE;IACzD,EAAE,QAAQ,EAAE,uBAAuB,EAAE,IAAI,EAAE,kBAAkB,EAAE;IAC/D,yEAAyE;IACzE,wEAAwE;IACxE,EAAE,QAAQ,EAAE,8BAA8B,EAAE,IAAI,EAAE,yBAAyB,EAAE;IAC7E,EAAE,QAAQ,EAAE,yBAAyB,EAAE,IAAI,EAAE,oBAAoB,EAAE;IACnE;QACE,QAAQ,EAAE,8BAA8B;QACxC,IAAI,EAAE,yBAAyB;KAChC;IACD,GAAG,oBAAoB;IACvB,GAAG,mBAAmB;CACvB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAe,EACf,IAAc;;IAEd,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,UAAU,CACd,uBAAuB,EACvB,qEAAqE;YACnE,iEAAiE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,UAAU,CACd,iBAAiB,IAAI,IAAI,EACzB,wEAAwE;YACtE,kBAAkB,CACrB,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,IAAI,GAAG,MAAA,IAAI,CAAC,IAAI,mCAAI,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,UAAU,CACd,yBAAyB,OAAO,EAAE,EAClC,8DAA8D;gBAC5D,yDAAyD;gBACzD,6DAA6D,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAClE,IAAI,SAAS;QAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAE3C,0EAA0E;IAC1E,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,SAAS,GACb,IAAI,CAAC,GAAG,KAAK,SAAS;QACpB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;IAE/D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,0EAA0E;IAC1E,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,YAAY;IACZ,IAAI,WAAW,GAAoB,IAAI,CAAC;IACxC,IAAI,CAAC;QACH,WAAW,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAAC,WAAM,CAAC;QACP,WAAW,GAAG,IAAI,CAAC,CAAC,sCAAsC;IAC5D,CAAC;IACD,IAAI,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,cAAc,EAAE,EAAE,CAAC;QAClC,MAAM,iBAAiB,CACrB,wBAAwB,SAAS,mCAAmC;YAClE,iDAAiD,EACnD,sEAAsE;YACpE,8BAA8B,CACjC,CAAC;IACJ,CAAC;IACD,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7C,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC;IAEzC,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,0EAA0E;QAC1E,mEAAmE;QACnE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,mBAAmB;gBAC3B,IAAI,EACF,6DAA6D;oBAC7D,gDAAgD,IAAI,GAAG;aAC1D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,iBAAiB,CACf,SAAS,EACT,QAAQ,EACR,IAAI,KAAK,aAAa;YACpB,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC;YAChC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CACjC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAEhC,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAE9D,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,CAAC,eAAe,IAAI,GAAG,CAAC,CAAC;IAEtC,IAAI,SAAS,EAAE,CAAC;QACd,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,SAAS;QACT,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IAC9E,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,IAAI,IAAI,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,GAAG,CAAC,GAAG,CACL,gCAAgC,QAAQ,CAAC,KAAK,CAAC,MAAM,SACnD,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACrC,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAClC,GAAG,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAClC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG;QACX,IAAI;QACJ,GAAG,EAAE,SAAS;QACd,OAAO;QACP,OAAO;QACP,QAAQ,EAAE;YACR,MAAM,EAAE,QAAQ,CAAC,IAAI;YACrB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB;KACF,CAAC;IAEF,MAAM,OAAO,GAAG,SAAS,CAAC;QACxB,IAAI;QACJ,GAAG,EAAE,SAAS;QACd,OAAO;QACP,OAAO;QACP,cAAc,EAAE,QAAQ,CAAC,IAAI;QAC7B,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;QACpC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;KACjC,CAAC,CAAC;IAEH,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAEzB,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,GAAG,CAAC;QACzD,MAAM,CAAC,KAAK,CAAC,uBAAuB,MAAM,gBAAgB,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,MAI5B;IACC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC9C,MAAM,KAAK,GAAa;QACtB,GAAG,OAAO,CAAC,MAAM,QAAQ,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU;KACnE,CAAC;IAEF,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CACR,yBAAyB,QAAQ,CAAC,KAAK,CAAC,MAAM,SAC5C,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACrC,GAAG,CACJ,CAAC;IACJ,CAAC;SAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,4BAA4B,CAAC,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,IAAsC,EACtC,IAAc;IAEd,MAAM,QAAQ,GAAG,YAAY,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAkB,CAAC;IACtD,OAAO,gBAAgB,iCAAM,OAAO,KAAE,IAAI,IAAG,CAAC;AAChD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAiB,EACjB,KAAc,EACd,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,QAAQ,CAAC,EAChD,YAAiC,OAAO;IAExC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAEnD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,MAAM,SAAS,GAAG,EAAE;SACjB,WAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAChD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SACtC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,IAAI,EAAE,CAAC;IAEV,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,gBAAgB,CAC7B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAC3B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAC9B,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CACtC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CACV,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACtC,OAAO;gBACL,IAAI;gBACJ,MAAM,EAAE,mBAAmB;gBAC3B,IAAI,EACF,8DAA8D;oBAC9D,oDAAoD,IAAI,GAAG;aAC9D,CAAC;QACJ,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACvC,CAAC;AASD;;;;;;;;GAQG;AACH,SAAS,aAAa,CACpB,SAAiB,EACjB,IAAsC,EACtC,KAAc;IAEd,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,YAAY,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;IAEzD,2EAA2E;IAC3E,kEAAkE;IAClE,MAAM,WAAW,GAAG,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAE1D,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK,EAAE,CAAC;QAClC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAa,CAAC;IAElD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAa,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+DAA+D;QAC/D,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,EAAE;YACR,KAAK,EAAE;gBACL;oBACE,KAAK,EAAE,QAAQ;oBACf,OAAO,EAAE,mCACP,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE;oBACF,IAAI,EACF,6DAA6D;wBAC7D,gDAAgD;iBACnD;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC;IACJ,CAAC;IAED,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3E,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,MAQlB;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CACR,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,QAAQ,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,CACjF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,aAAa,+BAA+B,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,+BAA+B,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,0BAA0B,MAAM,CAAC,IAAI,8BAA8B,MAAM,CAAC,GAAG,GAAG,CAAC;IAC1F,CAAC;IACD,OAAO,qBAAqB,MAAM,CAAC,IAAI,UAAU,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACvF,CAAC","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport { printBanner } from '../banner';\nimport type { CliContext } from '../context';\nimport { copyTreeVerbatim } from '../copy-tree';\nimport { invalidStateError, usageError } from '../errors';\nimport type { ExitCode } from '../exit-codes';\nimport {\n  type Manifest,\n  type ManifestNote,\n  mergeManifest,\n  serializeManifest,\n} from '../merge-manifest';\nimport {\n  type EkanosProject,\n  docEntryProblem,\n  serializeProject,\n} from '../project';\nimport { classifyPath, readFileNoFollow, writeFileNoFollow } from '../safe-fs';\nimport { readTemplate, templatesDir, toDisplayName } from '../templates';\nimport { canWizard, wizard } from '../wizard';\n\n/**\n * A file init did not write, and what the partner should do about it.\n *\n * Every ERROR path in this CLI carries an imperative hint; a skip did not, and\n * that asymmetry was the bug — `skipped package.json (already exists)` hid the\n * loss of eleven dependencies and the project's module type.\n */\nexport interface SkippedFile {\n  file: string;\n  reason: string;\n  hint: string;\n}\n\nexport interface InitArgs {\n  slug?: string;\n  /**\n   * Explicit target directory. When omitted, init scaffolds into `./<slug>`\n   * under `cwd` — never into `cwd` itself. A real partner ran `init` in a\n   * populated directory and got six files sprayed into it; `--dir .` is the\n   * explicit opt-in for that.\n   */\n  dir?: string;\n  cwd: string;\n  force: boolean;\n  /** Accepted for non-interactive ergonomics; init never prompts regardless. */\n  yes: boolean;\n  /**\n   * Repeatable `--docs` entries — http(s) URLs or project-relative paths to\n   * the target API's documentation, written into the scaffolded ekanos.json\n   * as `docs`. Absent flag means the field is simply omitted; init never\n   * prompts for it.\n   */\n  docs?: string[];\n  /**\n   * Test-only override for the clack wizard gate (`canWizard` in\n   * `wizard.ts`) — never set from real CLI wiring. See `RunOptions` in\n   * `index.ts`.\n   */\n  stdinIsTTY?: boolean;\n}\n\nconst SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;\n\n/**\n * The files init writes: template basename → destination path.\n *\n * `package.json` is handled separately (see `writeManifest`) because it is the\n * one file a partner plausibly already has — `npm init -y` before `ekanos\n * init` is the ordinary way to start — and skipping it silently costs them\n * every dependency and script.\n */\n/**\n * The agent-context files. The SDK's day-1 users are coding agents, so the\n * scaffold ships the authoring contract alongside the code: AGENTS.md is the\n * contract, CLAUDE.md points at it, and the Claude Code skill teaches the\n * iterate-validate-publish loop. Version-matched to the CLI because they live\n * in its templates.\n *\n * Exported so `ekanos upgrade` can regenerate exactly this set from the\n * NEWLY installed CLI's templates after a version bump — a stale AGENTS.md\n * teaches an agent yesterday's contract, which is as harmful as a stale\n * binary. One list, so `init` and `upgrade` can never disagree on what \"the\n * agent-context files\" even are.\n */\nexport const AGENT_CONTEXT_FILES: { template: string; dest: string }[] = [\n  { template: 'AGENTS.md.tmpl', dest: 'AGENTS.md' },\n  { template: 'CLAUDE.md.tmpl', dest: 'CLAUDE.md' },\n  { template: 'claude-skill.md.tmpl', dest: '.claude/skills/ekanos/SKILL.md' },\n];\n\n/**\n * The docs-grounding artifacts, exported for the same reason as\n * `AGENT_CONTEXT_FILES`: `upgrade` must create these when they are missing\n * (an older project upgrading into a toolchain whose AGENTS.md and skills\n * now reference them), and one list keeps `init` and `upgrade` from ever\n * disagreeing on what they are. Unlike the agent-context files these are\n * NEVER regenerated — `docs/api-notes.md` is agent/partner-authored after\n * the scaffold and `.mcp.json` may carry local additions — only created\n * when absent.\n */\nexport const DOCS_GROUNDING_FILES: { template: string; dest: string }[] = [\n  // The agent-authored snapshot of the target API — see the template itself\n  // and AGENTS.md's \"API documentation\" section for the convention.\n  { template: 'docs/api-notes.md.tmpl', dest: 'docs/api-notes.md' },\n  // Per-project MCP config so Claude Code picks up Context7 (the docs\n  // fallback in the resolution ladder) without any global setup.\n  { template: 'mcp.json.tmpl', dest: '.mcp.json' },\n];\n\nconst FILES: { template: string; dest: string }[] = [\n  { template: 'ekanos.json.tmpl', dest: 'ekanos.json' },\n  { template: 'gitignore.tmpl', dest: '.gitignore' },\n  // Without this, the `typecheck` script below prints tsc's help and exits 1 —\n  // and, worse, no type error in the scaffold ever surfaces.\n  { template: 'tsconfig.json.tmpl', dest: 'tsconfig.json' },\n  { template: 'vitest.config.ts.tmpl', dest: 'vitest.config.ts' },\n  // Wired via package.json's \"prepare\" script — see setup-hooks.mjs.tmpl's\n  // own header for what it does and why it tolerates a non-git directory.\n  { template: 'scripts/setup-hooks.mjs.tmpl', dest: 'scripts/setup-hooks.mjs' },\n  { template: 'src/integration.ts.tmpl', dest: 'src/integration.ts' },\n  {\n    template: 'src/integration.test.ts.tmpl',\n    dest: 'src/integration.test.ts',\n  },\n  ...DOCS_GROUNDING_FILES,\n  ...AGENT_CONTEXT_FILES,\n];\n\n/**\n * `init` — instantiate a project from the bundled template: ekanos.json, a\n * working minimal defineIntegration, a test, a vitest config (with the\n * required SDK inline block), a .gitignore, and a package.json with real\n * published deps. Idempotent: an existing file is left untouched (reported as\n * skipped) unless --force is passed. Never prompts — a missing --slug fails\n * with a usage error naming the flag.\n *\n * In human mode at a real TTY (`canWizard`), the scaffold runs behind a\n * clack `intro`/spinner/`outro` flow instead of the flat `ctx.log` lines\n * below — see `wizard.ts`. This is a restyle, not a new interaction: the\n * data written to disk and the JSON/human-non-TTY envelope are identical\n * either way, and nothing here ever waits on a prompt.\n */\nexport async function runInit(\n  ctx: CliContext,\n  args: InitArgs,\n): Promise<ExitCode> {\n  const slug = args.slug;\n  if (!slug) {\n    throw usageError(\n      'init requires a slug.',\n      'Pass it explicitly: \"ekanos init --slug <your-integration> --yes\". ' +\n        'The CLI never prompts, so the slug must be on the command line.',\n    );\n  }\n  if (!SLUG_PATTERN.test(slug)) {\n    throw usageError(\n      `Invalid slug \"${slug}\".`,\n      'Use kebab-case: lowercase [a-z0-9] segments joined by single hyphens, ' +\n        'e.g. \"acme-crm\".',\n    );\n  }\n\n  // Same rule the ekanos.json schema enforces, applied at the flag so a bad\n  // entry fails HERE (usage, exit 2) instead of scaffolding a project whose\n  // very first `ekanos validate` cannot even load its config.\n  const docs = args.docs ?? [];\n  for (const entry of docs) {\n    const problem = docEntryProblem(entry);\n    if (problem) {\n      throw usageError(\n        `Invalid --docs value: ${problem}`,\n        'Pass --docs an http(s) URL or a project-relative path, e.g. ' +\n          '\"--docs https://developer.example.com/openapi.json\" or ' +\n          '\"--docs docs/api.md\". Repeat the flag for multiple entries.',\n      );\n    }\n  }\n\n  const useWizard = canWizard(ctx, { stdinIsTTY: args.stdinIsTTY });\n  if (useWizard) wizard.intro('ekanos init');\n\n  // Default to `./<slug>`, not the cwd: scaffolding six files into whatever\n  // directory the partner happened to be sitting in is how a real project got\n  // polluted. `--dir .` remains the explicit way to scaffold in place.\n  const targetDir =\n    args.dir !== undefined\n      ? path.resolve(args.cwd, args.dir)\n      : path.resolve(args.cwd, slug);\n  const vars = { SLUG: slug, DISPLAY_NAME: toDisplayName(slug) };\n\n  const created: string[] = [];\n  const skipped: SkippedFile[] = [];\n\n  // The project root is the guard for every write below: creating it raw is\n  // fine (it is the boundary, not inside it), but everything under it goes\n  // through safe-fs so a planted symlink refuses loudly instead of teleporting\n  // a write outside the project. See safe-fs.ts for the threat model. The one\n  // case the guard cannot see is the boundary ITSELF being a symlink — the\n  // containment math is lexical against `targetDir`, so a planted link there\n  // would relocate every \"contained\" write wholesale. Refuse it. (A symlinked\n  // ANCESTOR — macOS's /tmp, a linked home — stays fine: only the leaf is\n  // checked.)\n  let targetStats: fs.Stats | null = null;\n  try {\n    targetStats = fs.lstatSync(targetDir);\n  } catch {\n    targetStats = null; // does not exist yet — ours to create\n  }\n  if (targetStats?.isSymbolicLink()) {\n    throw invalidStateError(\n      `The target directory ${targetDir} is a symlink, so the scaffold's ` +\n        'write-containment guarantees cannot hold there.',\n      'Scaffold into the real directory (pass its resolved path to --dir), ' +\n        'or remove the symlink first.',\n    );\n  }\n  fs.mkdirSync(targetDir, { recursive: true });\n\n  const spinner = useWizard ? wizard.spinner() : null;\n  spinner?.start(`Scaffolding \"${slug}\"…`);\n\n  for (const { template, dest } of FILES) {\n    const destPath = path.join(targetDir, dest);\n    const kind = classifyPath(destPath);\n    // A symlink is never \"already exists\": skipping would keep the plant, and\n    // writing through it is the attack — writeFileNoFollow refuses it.\n    if (kind !== 'missing' && kind !== 'symlink' && !args.force) {\n      skipped.push({\n        file: dest,\n        reason: 'it already exists',\n        hint:\n          `Compare it against the scaffold and merge anything you are ` +\n          `missing, or re-run with --force to overwrite ${dest}.`,\n      });\n      continue;\n    }\n\n    writeFileNoFollow(\n      targetDir,\n      destPath,\n      dest === 'ekanos.json'\n        ? renderEkanosConfig(vars, docs)\n        : readTemplate(template, vars),\n    );\n    created.push(dest);\n  }\n\n  const skills = copyBundledSkillTrees(targetDir, args.force);\n  created.push(...skills.created);\n  skipped.push(...skills.skipped);\n\n  const manifest = writeManifest(targetDir, vars, args.force);\n  if (manifest.kind === 'created') created.push('package.json');\n\n  spinner?.stop(`Scaffolded \"${slug}\"`);\n\n  if (useWizard) {\n    // Per-file \"created\" detail stays collapsed into the count above — the\n    // note surfaces only what needs a partner's attention: skips (they hid\n    // real data loss before, see `SkippedFile`'s doc comment) and manifest\n    // notes.\n    wizard.note(wizardSummaryDetail({ created, skipped, manifest }), 'Summary');\n  } else {\n    for (const file of created) ctx.log(`  created ${file}`);\n    if (manifest.kind === 'merged') {\n      ctx.log(\n        `  merged package.json (added ${manifest.added.length} field${\n          manifest.added.length === 1 ? '' : 's'\n        })`,\n      );\n    }\n    if (manifest.kind === 'unchanged') {\n      ctx.log('  package.json already had everything the scaffold adds');\n    }\n    for (const skip of skipped) {\n      ctx.log(`  skipped ${skip.file} — ${skip.reason}. ${skip.hint}`);\n    }\n    for (const note of manifest.notes) {\n      ctx.warn(`  ${note.message} ${note.hint}`);\n    }\n  }\n\n  const data = {\n    slug,\n    dir: targetDir,\n    created,\n    skipped,\n    manifest: {\n      action: manifest.kind,\n      added: manifest.added,\n      kept: manifest.kept,\n      notes: manifest.notes,\n    },\n  };\n\n  const summary = summarize({\n    slug,\n    dir: targetDir,\n    created,\n    skipped,\n    manifestAction: manifest.kind,\n    manifestAdded: manifest.added.length,\n    noteCount: manifest.notes.length,\n  });\n\n  printBanner(ctx, 'full');\n\n  if (useWizard) {\n    const relDir = path.relative(args.cwd, targetDir) || '.';\n    wizard.outro(`Next steps:\\n\\n  cd ${relDir}\\n  ekanos dev`);\n  }\n\n  return ctx.succeed(data, summary);\n}\n\n/**\n * The clack `note()` body for a successful wizard-mode scaffold — collapses\n * \"created\" down to a count (the flat per-file lines this replaces are the\n * `else` branch above) and surfaces only what needs a partner's attention:\n * skips and manifest notes, each with its full hint.\n */\nfunction wizardSummaryDetail(params: {\n  created: string[];\n  skipped: SkippedFile[];\n  manifest: ManifestOutcome;\n}): string {\n  const { created, skipped, manifest } = params;\n  const lines: string[] = [\n    `${created.length} file${created.length === 1 ? '' : 's'} written`,\n  ];\n\n  if (manifest.kind === 'merged') {\n    lines.push(\n      `package.json merged (+${manifest.added.length} field${\n        manifest.added.length === 1 ? '' : 's'\n      })`,\n    );\n  } else if (manifest.kind === 'unchanged') {\n    lines.push('package.json already had everything the scaffold adds');\n  }\n\n  if (skipped.length > 0) {\n    lines.push('', 'Skipped (already existed):');\n    for (const skip of skipped) {\n      lines.push(`  ${skip.file} — ${skip.hint}`);\n    }\n  }\n\n  for (const note of manifest.notes) {\n    lines.push('', `⚠ ${note.message} ${note.hint}`);\n  }\n\n  return lines.join('\\n');\n}\n\n/**\n * The scaffolded ekanos.json: the template, plus the collected `--docs`\n * entries when there are any. Parse-then-serialize (rather than string\n * surgery) so the written file is exactly what `loadProject` will read back.\n */\nfunction renderEkanosConfig(\n  vars: Readonly<Record<string, string>>,\n  docs: string[],\n): string {\n  const rendered = readTemplate('ekanos.json.tmpl', vars);\n  if (docs.length === 0) return rendered;\n  const project = JSON.parse(rendered) as EkanosProject;\n  return serializeProject({ ...project, docs });\n}\n\n/**\n * Copy every bundled skill tree (`templates/skills/<name>/`) into the\n * scaffolded project at `.claude/skills/<name>/`, verbatim — see\n * `copyTreeVerbatim` for why these are bytes, never rendered templates. The\n * walk is generic: a skill directory added to the published templates ships\n * with no code change here. A CLI build with no `templates/skills/` at all\n * (today's) scaffolds nothing and reports nothing.\n *\n * `skillsRoot` is injectable for tests; real callers take the default.\n */\nexport function copyBundledSkillTrees(\n  targetDir: string,\n  force: boolean,\n  skillsRoot = path.join(templatesDir(), 'skills'),\n  onRefusal: 'throw' | 'collect' = 'throw',\n): { created: string[]; skipped: SkippedFile[]; refused: string[] } {\n  if (!fs.existsSync(skillsRoot))\n    return { created: [], skipped: [], refused: [] };\n\n  const created: string[] = [];\n  const skipped: SkippedFile[] = [];\n  const refused: string[] = [];\n\n  const skillDirs = fs\n    .readdirSync(skillsRoot, { withFileTypes: true })\n    .filter((entry) => entry.isDirectory())\n    .map((entry) => entry.name)\n    .sort();\n\n  for (const name of skillDirs) {\n    const destBase = path.join('.claude', 'skills', name);\n    const result = copyTreeVerbatim(\n      path.join(skillsRoot, name),\n      path.join(targetDir, destBase),\n      { force, root: targetDir, onRefusal },\n    );\n    created.push(...result.created.map((rel) => path.join(destBase, rel)));\n    refused.push(...result.refused.map((rel) => path.join(destBase, rel)));\n    skipped.push(\n      ...result.skipped.map((rel) => {\n        const file = path.join(destBase, rel);\n        return {\n          file,\n          reason: 'it already exists',\n          hint:\n            `Compare it against the bundled skill and merge anything you ` +\n            `are missing, or re-run with --force to overwrite ${file}.`,\n        };\n      }),\n    );\n  }\n\n  return { created, skipped, refused };\n}\n\ntype ManifestOutcome = {\n  kind: 'created' | 'merged' | 'unchanged';\n  added: string[];\n  kept: string[];\n  notes: ManifestNote[];\n};\n\n/**\n * Write or MERGE package.json.\n *\n * A partner who ran `npm init -y` first had a manifest with none of the\n * scaffold's dependencies and `\"type\": \"commonjs\"` under ESM sources, and the\n * old behaviour reported that as one word: \"skipped\". Merging is additive — a\n * version or script they already set is theirs and is never touched — so the\n * ordinary `npm init -y` path now lands somewhere that installs and runs.\n */\nfunction writeManifest(\n  targetDir: string,\n  vars: Readonly<Record<string, string>>,\n  force: boolean,\n): ManifestOutcome {\n  const destPath = path.join(targetDir, 'package.json');\n  const rendered = readTemplate('package.json.tmpl', vars);\n\n  // readFileNoFollow refuses a symlinked package.json outright, so the write\n  // below can never follow one either; null means genuinely absent.\n  const existingRaw = readFileNoFollow(targetDir, destPath);\n\n  if (existingRaw === null || force) {\n    writeFileNoFollow(targetDir, destPath, rendered);\n    return { kind: 'created', added: [], kept: [], notes: [] };\n  }\n\n  const template = JSON.parse(rendered) as Manifest;\n\n  let existing: Manifest;\n  try {\n    existing = JSON.parse(existingRaw) as Manifest;\n  } catch (error) {\n    // Unparseable: do not guess, and do not clobber. Name the fix.\n    return {\n      kind: 'unchanged',\n      added: [],\n      kept: [],\n      notes: [\n        {\n          field: '(root)',\n          message: `package.json is not valid JSON: ${\n            error instanceof Error ? error.message : String(error)\n          }`,\n          hint:\n            'Fix the JSON syntax, then re-run \"ekanos init\" to have the ' +\n            \"scaffold's dependencies and scripts merged in.\",\n        },\n      ],\n    };\n  }\n\n  const result = mergeManifest(existing, template);\n  if (!result.changed) {\n    return {\n      kind: 'unchanged',\n      added: [],\n      kept: result.kept,\n      notes: result.notes,\n    };\n  }\n\n  writeFileNoFollow(targetDir, destPath, serializeManifest(result.manifest));\n  return {\n    kind: 'merged',\n    added: result.added,\n    kept: result.kept,\n    notes: result.notes,\n  };\n}\n\nfunction summarize(params: {\n  slug: string;\n  dir: string;\n  created: string[];\n  skipped: SkippedFile[];\n  manifestAction: ManifestOutcome['kind'];\n  manifestAdded: number;\n  noteCount: number;\n}): string {\n  const parts: string[] = [];\n  if (params.created.length > 0) {\n    parts.push(\n      `${params.created.length} file${params.created.length === 1 ? '' : 's'} written`,\n    );\n  }\n  if (params.manifestAction === 'merged') {\n    parts.push(`${params.manifestAdded} package.json field(s) merged`);\n  }\n  if (params.skipped.length > 0) {\n    parts.push(`${params.skipped.length} skipped`);\n  }\n  if (params.noteCount > 0) {\n    parts.push(`${params.noteCount} thing(s) need your attention`);\n  }\n\n  if (parts.length === 0) {\n    return `init: nothing to do — \"${params.slug}\" is already scaffolded in ${params.dir}.`;\n  }\n  return `init: scaffolded \"${params.slug}\" into ${params.dir} (${parts.join(', ')}).`;\n}\n"]}

package/dist/commands/login.d.ts

@@ -7,6 +7,12 @@ export interface LoginArgs {
     /** Where a project's ekanos.json may sit — read-only here, never written. */
     cwd: string;
     env: Record<string, string | undefined>;
+    /**
+     * Test-only override for the clack wizard gate (`canWizard` in
+     * `wizard.ts`) — never set from real CLI wiring. See `RunOptions` in
+     * `index.ts`.
+     */
+    stdinIsTTY?: boolean;
 }
 /**
  * `login` — authenticate this machine against a Fusion deployment via the
@@ -18,5 +24,12 @@ export interface LoginArgs {
  * The user code and verification URL go to STDERR. They have to be visible
  * even when stdout is a pipe into an agent, and stdout in this CLI carries
  * exactly one JSON object.
+ *
+ * In human mode at a real TTY (`canWizard`), this runs behind a clack
+ * `intro`/`outro` flow with a spinner over the approval wait — see
+ * `wizard.ts`. The device code and URL themselves stay plain, copy-pasteable
+ * text (a clack `note`, not a prompt) either way: a partner needs to select
+ * and open them, not interact with them through clack. JSON mode and human
+ * non-TTY mode are byte-for-byte what they were before this existed.
  */
 export declare function runLogin(ctx: CliContext, args: LoginArgs): Promise<ExitCode>;