@ekanos/cli 0.1.9 → 0.2.0

package/dist/source-locator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-locator.js","sourceRoot":"","sources":["../src/source-locator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AASH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GACzB,2DAA2D,CAAC;AAE9D,sGAAsG;AACtG,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,OAAO,KAAK,QAAQ,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;;IAC1C,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,MAAA,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,mCAAI,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAe;IAEf,MAAM,KAAK,GACT,oEAAoE,CAAC,IAAI,CACvE,OAAO,CACR,CAAC;IACJ,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;IAC7B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAE1D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAUD;;;;;;;;GAQG;AACH,SAAS,IAAI,CAAC,MAAc;IAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IACxB,IAAI,CAAC,GAAG,CAAC,CAAC;IAEV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAE3B,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC/B,qEAAqE;YACrE,kEAAkE;YAClE,qEAAqE;YACrE,+BAA+B;YAC/B,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;YACb,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;YACjB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACnC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;gBACb,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC/B,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;YACb,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;YACjB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;gBAC9D,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;gBACrC,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;YACD,IAAI,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;YAChC,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,EAAE,CAAC;YACjB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;gBACpC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACvB,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;wBAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;oBAC1D,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;gBACrC,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;YACD,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QAED,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC;AAED,oLAAoL;AACpL,SAAS,iBAAiB,CAAC,MAAc,EAAE,SAAiB;IAC1D,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;aAC3B,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;aAChC,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;aAChC,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAChD,IAAI,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE;gBAAE,OAAO,CAAC,CAAC,CAAC;YAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,qLAAqL;AACrL,SAAS,oBAAoB,CAC3B,MAAc,EACd,KAAY;IAEZ,MAAM,OAAO,GAA0C,EAAE,CAAC;IAC1D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,WAAW,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aAClD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aACvD,IAAI,EAAE,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC7C,WAAW,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAErD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,KAAa;IAC5C,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/C,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;;IACnC,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACtC,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,MAAA,MAAM,CAAC,CAAC,CAAC,mCAAI,EAAE,CAAC;QAAE,CAAC,IAAI,CAAC,CAAC;IAE/D,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,GACf,4DAA4D,CAAC;AAE/D,uNAAuN;AACvN,SAAS,oBAAoB,CAC3B,MAAc,EACd,KAAa,EACb,GAAW;;IAEX,IAAI,CAAC,GAAG,KAAK,CAAC;IACd,OAAO,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,MAAA,MAAM,CAAC,CAAC,CAAC,mCAAI,EAAE,CAAC;QAAE,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO,CAAC,CAAC;AACX,CAAC;AAKD,SAAS,OAAO,CACd,MAAc,EACd,MAAc,EACd,KAAY,EACZ,OAAe;;IAEf,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAEpD,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,UAAU,CAAC;QAE9C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM;YAAE,OAAO,WAAW,CAAC;QAEhC,MAAM,WAAW,GAAG,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3E,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;IACnE,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,MAAM,OAAO,GAAG,MAAA,KAAK,CAAC,CAAC,CAAC,mCAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,OAAO;YAAE,SAAS;QAElC,MAAM,UAAU,GAAG,oBAAoB,CACrC,MAAM,EACN,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAC9B,MAAM,CAAC,GAAG,CACX,CAAC;QAEF,OAAO;YACL,WAAW,EAAE,YAAY;YACzB,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC;SACxC,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,KAAa;IAC3C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,IAAI,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,OAAe;IAC3D,0EAA0E;IAC1E,yEAAyE;IACzE,uDAAuD;IACvD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAE9E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAEzC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACvE,CAAC;IAED,IAAI,KAAK,GAAU,IAAI,CAAC;IAExB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM;QAEjC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAEvD,IAAI,MAAM,KAAK,UAAU;YAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACzD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QACzC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3E,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAC9D,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC;IAC5B,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAChC,CAAC","sourcesContent":["/**\n * Best-effort zod dot-path → source line resolution for `validate`'s\n * schema findings.\n *\n * `collectDefinitionFindings` (in `@ekanos/integration-schema`) bakes a zod\n * PATH into `Finding.message` (`\"components.widgets.0.id: Required\"`), never\n * a source offset — zod reports a `path`, not a byte offset, and fabricating\n * a line number would be a lie (see the `Finding` doc comment there). This\n * module recovers a plausible line by scanning the partner's declaration\n * source text: no AST, no new dependency — TypeScript's compiler API is a\n * devDep in this workspace, not a runtime one, and the published CLI never\n * ships it, so it is never imported here. Just a brace-tracking scan of the\n * object/array literal passed to `defineIntegration(...)`.\n *\n * The rule that matters more than any mechanic below: a WRONG line number is\n * worse than none. Anything this module can't resolve with confidence\n * returns `{ confidence: 'none' }` — never a guess.\n */\n\nexport type LocateConfidence = 'exact' | 'enclosing' | 'none';\n\nexport type LocateResult =\n  | { confidence: 'exact'; line: number }\n  | { confidence: 'enclosing'; line: number }\n  | { confidence: 'none' };\n\n/**\n * Appended, PLAIN TEXT (no ANSI — this module never touches color; see\n * `ui.ts`'s doc comment on why nothing outside it may), to a finding's\n * message when only the enclosing object/array was found, not the missing\n * key itself. `findings-renderer.ts` recognizes this literal suffix and dims\n * it at render time.\n */\nexport const ENCLOSING_NOTE =\n  '(showing the enclosing object — add the missing key here)';\n\n/** The literal path `collectDefinitionFindings` emits for a zod issue whose `path` array is empty. */\nexport function isRootPath(dotPath: string): boolean {\n  return dotPath === '(root)';\n}\n\n/**\n * `\"components.widgets[0].id\"` and `\"components.widgets.0.id\"` both split to\n * `['components', 'widgets', '0', 'id']` — `collectDefinitionFindings` only\n * ever emits the dot form (a plain `issue.path.join('.')`), but this accepts\n * either, matching the pattern `findings-renderer.ts`'s dot-path detector\n * already tolerates.\n */\nexport function splitDotPath(dotPath: string): string[] {\n  if (isRootPath(dotPath)) return [];\n  return dotPath.match(/[^.[\\]]+/g) ?? [];\n}\n\n/**\n * A finding message is `\"<dot-path>: <zod message>\"` (or `(root): …` for an\n * empty path) — see the `Finding` doc comment in `@ekanos/integration-schema`.\n * Splits the two apart; `null` for a message with no such prefix (every\n * finding NOT built from a zod issue, e.g. `definition.plain-data`).\n */\nexport function extractPathFromMessage(\n  message: string,\n): { path: string; rest: string } | null {\n  const match =\n    /^((?:\\(root\\))|[A-Za-z0-9_]+(?:\\.[A-Za-z0-9_]+|\\[\\d+\\])*): ([^]+)$/.exec(\n      message,\n    );\n  if (!match) return null;\n\n  const [, path, rest] = match;\n  if (path === undefined || rest === undefined) return null;\n\n  return { path, rest };\n}\n\ninterface Scope {\n  /** Index of the opening delimiter (`{` or `[`) in both `source` and the masked text. */\n  start: number;\n  /** Index of the matching closing delimiter. */\n  end: number;\n  kind: '{' | '[';\n}\n\n/**\n * Replaces the CONTENTS of every string/template literal and comment with a\n * neutral filler, preserving length, newlines, and every character outside\n * those regions verbatim — so a later brace-depth scan never miscounts a\n * `{`/`}`/`,` that only appears inside a string, while every index computed\n * against the result still points at the same character in the original\n * `source`. Delimiter characters (quotes, `/*`, `//`) are kept as-is; only\n * their insides are masked.\n */\nfunction mask(source: string): string {\n  const out = source.split('');\n  const n = source.length;\n  let i = 0;\n\n  while (i < n) {\n    const ch = source[i];\n    const next = source[i + 1];\n\n    if (ch === '/' && next === '/') {\n      // Mask the `//` marker itself too, not just what follows it — a bare\n      // `/` isn't whitespace, so `skipMaskedWhitespace` needs the WHOLE\n      // comment (marker included) to read as blank in order to skip past a\n      // comment that precedes a key.\n      out[i] = ' ';\n      out[i + 1] = ' ';\n      i += 2;\n      while (i < n && source[i] !== '\\n') {\n        out[i] = ' ';\n        i += 1;\n      }\n      continue;\n    }\n\n    if (ch === '/' && next === '*') {\n      out[i] = ' ';\n      out[i + 1] = ' ';\n      i += 2;\n      while (i < n && !(source[i] === '*' && source[i + 1] === '/')) {\n        if (source[i] !== '\\n') out[i] = ' ';\n        i += 1;\n      }\n      if (i < n) out[i] = ' ';\n      if (i + 1 < n) out[i + 1] = ' ';\n      i += 2;\n      continue;\n    }\n\n    if (ch === \"'\" || ch === '\"' || ch === '`') {\n      const quote = ch;\n      i += 1;\n      while (i < n && source[i] !== quote) {\n        if (source[i] === '\\\\') {\n          if (source[i + 1] !== '\\n' && i + 1 < n) out[i + 1] = 'x';\n          i += 2;\n          continue;\n        }\n        if (source[i] !== '\\n') out[i] = 'x';\n        i += 1;\n      }\n      i += 1;\n      continue;\n    }\n\n    i += 1;\n  }\n\n  return out.join('');\n}\n\n/** Index of the delimiter matching `masked[openIndex]`, or `-1` for unbalanced/malformed input. Operates on masked text so a bracket inside a string never throws off the count. */\nfunction findMatchingClose(masked: string, openIndex: number): number {\n  const stack: string[] = [];\n\n  for (let i = openIndex; i < masked.length; i += 1) {\n    const ch = masked[i];\n    if (ch === '{') stack.push('}');\n    else if (ch === '[') stack.push(']');\n    else if (ch === '(') stack.push(')');\n    else if (ch === '}' || ch === ']' || ch === ')') {\n      if (stack.pop() !== ch) return -1;\n      if (stack.length === 0) return i;\n    }\n  }\n\n  return -1;\n}\n\n/** Top-level (depth-0-relative-to-the-scope) member spans between a scope's delimiters, split at depth-0 commas — one span per object property or array element, in source order. */\nfunction splitTopLevelMembers(\n  masked: string,\n  scope: Scope,\n): Array<{ start: number; end: number }> {\n  const members: Array<{ start: number; end: number }> = [];\n  let depth = 0;\n  let memberStart = scope.start + 1;\n\n  for (let i = scope.start + 1; i < scope.end; i += 1) {\n    const ch = masked[i];\n    if (ch === '{' || ch === '[' || ch === '(') depth += 1;\n    else if (ch === '}' || ch === ']' || ch === ')') depth -= 1;\n    else if (ch === ',' && depth === 0) {\n      members.push({ start: memberStart, end: i });\n      memberStart = i + 1;\n    }\n  }\n  members.push({ start: memberStart, end: scope.end });\n\n  return members.filter((m) => masked.slice(m.start, m.end).trim() !== '');\n}\n\nfunction scopeAt(masked: string, index: number): Scope | null {\n  const ch = masked[index];\n  if (ch !== '{' && ch !== '[') return null;\n\n  const close = findMatchingClose(masked, index);\n  if (close === -1) return null;\n\n  return { start: index, end: close, kind: ch };\n}\n\nfunction findRootScope(masked: string): Scope | null {\n  const match = /defineIntegration\\s*\\(/.exec(masked);\n  if (!match) return null;\n\n  let i = match.index + match[0].length;\n  while (i < masked.length && /\\s/.test(masked[i] ?? '')) i += 1;\n\n  return scopeAt(masked, i);\n}\n\n/**\n * A quoted (`'id'`/`\"id\"`) or bare (`id`) object key immediately followed by\n * `:`, anchored at the very start of the string it's matched against — the\n * caller is responsible for having already skipped past any leading\n * whitespace AND leading comment (both of which read as whitespace in the\n * MASKED text, see `skipMaskedWhitespace`). Matched against the RAW source\n * slice, never the masked one — masking a quoted key's own text would\n * destroy the very name being compared.\n */\nconst KEY_PATTERN =\n  /^(?:(['\"])((?:\\\\.|(?!\\1)[^\\\\])*)\\1|([A-Za-z_$][\\w$]*))\\s*:/;\n\n/** First index at or after `start` (and before `end`) whose MASKED character is not whitespace — a masked comment reads as whitespace here too, so this skips leading comments along with real whitespace/newlines. */\nfunction skipMaskedWhitespace(\n  masked: string,\n  start: number,\n  end: number,\n): number {\n  let i = start;\n  while (i < end && /\\s/.test(masked[i] ?? '')) i += 1;\n  return i;\n}\n\ntype DescendResult =\n  'not-found' | 'mismatch' | { targetStart: number; valueScope: Scope | null };\n\nfunction descend(\n  source: string,\n  masked: string,\n  scope: Scope,\n  segment: string,\n): DescendResult {\n  const members = splitTopLevelMembers(masked, scope);\n\n  if (scope.kind === '[') {\n    if (!/^\\d+$/.test(segment)) return 'mismatch';\n\n    const member = members[Number(segment)];\n    if (!member) return 'not-found';\n\n    const targetStart = skipMaskedWhitespace(masked, member.start, member.end);\n    return { targetStart, valueScope: scopeAt(masked, targetStart) };\n  }\n\n  for (const member of members) {\n    const contentStart = skipMaskedWhitespace(masked, member.start, member.end);\n    const raw = source.slice(contentStart, member.end);\n    const match = KEY_PATTERN.exec(raw);\n    if (!match) continue;\n\n    const keyName = match[2] ?? match[3];\n    if (keyName !== segment) continue;\n\n    const valueStart = skipMaskedWhitespace(\n      masked,\n      contentStart + match[0].length,\n      member.end,\n    );\n\n    return {\n      targetStart: contentStart,\n      valueScope: scopeAt(masked, valueStart),\n    };\n  }\n\n  return 'not-found';\n}\n\nfunction lineAt(source: string, index: number): number {\n  let line = 1;\n  for (let i = 0; i < index && i < source.length; i += 1) {\n    if (source[i] === '\\n') line += 1;\n  }\n  return line;\n}\n\n/**\n * Locates `dotPath` (a zod path string, e.g. `\"components.widgets.0.id\"` or\n * `\"(root)\"`) within `source`, the declaration file's full text. `source`\n * MUST contain an inline `defineIntegration({ … })` call — a definition\n * built from a variable, spread, or factory function can't be resolved\n * statically and always comes back `none`. A one-line (minified/no-newline)\n * source also always comes back `none`: a codeframe there can't isolate\n * anything the reader couldn't already see, so it isn't worth the risk of a\n * technically-correct-but-useless \"line 1\" frame.\n */\nexport function locateDotPath(source: string, dotPath: string): LocateResult {\n  // Strip trailing newline(s) before checking: a one-line declaration saved\n  // with a normal trailing EOF newline must still count as \"one line,\" not\n  // \"multi-line\" by virtue of that single trailing `\\n`.\n  if (!source.replace(/\\n+$/, '').includes('\\n')) return { confidence: 'none' };\n\n  const masked = mask(source);\n  const root = findRootScope(masked);\n  if (!root) return { confidence: 'none' };\n\n  const segments = splitDotPath(dotPath);\n  if (segments.length === 0) {\n    return { confidence: 'enclosing', line: lineAt(source, root.start) };\n  }\n\n  let scope: Scope = root;\n\n  for (let i = 0; i < segments.length; i += 1) {\n    const segment = segments[i];\n    if (segment === undefined) break;\n\n    const result = descend(source, masked, scope, segment);\n\n    if (result === 'mismatch') return { confidence: 'none' };\n    if (result === 'not-found') {\n      return { confidence: 'enclosing', line: lineAt(source, scope.start) };\n    }\n\n    const isLast = i === segments.length - 1;\n    if (isLast) {\n      return { confidence: 'exact', line: lineAt(source, result.targetStart) };\n    }\n\n    if (result.valueScope === null) return { confidence: 'none' };\n    scope = result.valueScope;\n  }\n\n  return { confidence: 'none' };\n}\n"]}

package/dist/sources-api.d.ts

@@ -4,9 +4,9 @@
  * ---------------------------------------------------------------------------
  * WIRE CONTRACT — the seam between this package and the Fusion web app.
  *
- * The server side lives in `apps/web/app/api/partner/sources/route.ts`. As
- * with the auth routes and `publish-api.ts`, the two halves are coupled only
- * by HTTP; tests stub `fetch`, never the route.
+ * The server side is the host's `/api/partner/sources` route. As with the
+ * auth routes and `publish-api.ts`, the two halves are coupled only by
+ * HTTP; tests stub `fetch`, never the route.
  *
  *   GET /api/partner/sources        [Authorization: Bearer <access_token>]
  *     → 200 { ok: true, data: { sources: [{ id, slug, name, roles }] } }

package/dist/sources-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"sources-api.js","sourceRoot":"","sources":["../src/sources-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAqC3D;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY,EACZ,WAAmB;;IAEnB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,sBAAsB,EAAE;QAC5D,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;KACF,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAE9C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,MAAA,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,mCACb,GAAG,IAAI,yDAAyD,EAClE,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,kCAAkC,QAAQ,CAAC,MAAM,GAAG,EAC3D,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,mEAAmE;gBACjE,8CAA8C;YAClD,CAAC,CAAC,+DAA+D;gBAC7D,qCAAqC,CAC5C,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAA,IAAI,CAAC,IAAI,mCAAI,EAAE,CAA4B,CAAC;IAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAE7D,MAAM,OAAO,GAAG,IAAI;SACjB,MAAM,CACL,CAAC,GAAG,EAAkC,EAAE,CACtC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAC1C;SACA,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;;QAAC,OAAA,CAAC;YACb,EAAE,EAAE,MAAA,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,mCAAI,EAAE;YACrB,IAAI,EAAE,MAAA,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAI,EAAE;YACzB,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;gBAC7B,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;gBACtE,CAAC,CAAC,EAAE;SACP,CAAC,CAAA;KAAA,CAAC,CAAC;IAEN,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACvD,MAAM,iBAAiB,CACrB,mBAAmB,IAAI,8CAA8C,EACrE,4BAA4B,IAAI,cAAc,CAC/C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;AACvC,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC","sourcesContent":["import { request } from './auth/fusion-api';\nimport { authRequiredError, networkError } from './errors';\n\n/**\n * The CLI's client for the Fusion source-seat visibility route.\n *\n * ---------------------------------------------------------------------------\n * WIRE CONTRACT — the seam between this package and the Fusion web app.\n *\n * The server side lives in `apps/web/app/api/partner/sources/route.ts`. As\n * with the auth routes and `publish-api.ts`, the two halves are coupled only\n * by HTTP; tests stub `fetch`, never the route.\n *\n *   GET /api/partner/sources        [Authorization: Bearer <access_token>]\n *     → 200 { ok: true, data: { sources: [{ id, slug, name, roles }] } }\n *           roles is a non-empty array of \"developer\" | \"source_admin\", sorted; sources\n *           is sorted by slug. Empty array means no seats anywhere.\n *     → 401 { error, code: \"AUTH_REQUIRED\" }      token absent or expired —\n *                                                 refresh once and retry\n *     → 403 { error, code: \"MFA_REQUIRED\" }\n *     → 3xx                                       treated as 401 (an\n *                                                 auth-gated Fusion page\n *                                                 answers 307)\n * ---------------------------------------------------------------------------\n */\n\nexport interface SourceSeat {\n  id: string;\n  slug: string;\n  name: string | null;\n  roles: string[];\n}\n\nexport type FetchSourceSeatsResult =\n  | { status: 'ok'; sources: SourceSeat[] }\n  /** The bearer token did not authenticate — refresh and retry, once. */\n  | { status: 'unauthorized' };\n\n/**\n * List the sources the caller holds a seat on (any role). Authorization is\n * entirely server-side (RLS on `source_memberships`): there is no client-side\n * filter to get wrong here.\n */\nexport async function fetchSourceSeats(\n  host: string,\n  accessToken: string,\n): Promise<FetchSourceSeatsResult> {\n  const response = await request(`${host}/api/partner/sources`, {\n    method: 'GET',\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${accessToken}`,\n    },\n  });\n\n  if (response.status === 401 || isRedirect(response.status)) {\n    return { status: 'unauthorized' };\n  }\n\n  const body = await readOptionalJson(response);\n\n  if (response.status === 403) {\n    throw authRequiredError(\n      str(body.error) ??\n        `${host} requires multi-factor authentication for this account.`,\n      `Complete MFA in the browser, then run \"ekanos login\" again.`,\n    );\n  }\n\n  if (!response.ok) {\n    throw networkError(\n      `${host}/api/partner/sources responded ${response.status}.`,\n      response.status >= 500\n        ? `The Fusion deployment returned a server error. Retry shortly; if ` +\n            `it persists, report it with the status code.`\n        : `Confirm the host is a Fusion deployment running a build that ` +\n            `includes the partner sources route.`,\n    );\n  }\n\n  const data = (body.data ?? {}) as Record<string, unknown>;\n  const rows = Array.isArray(data.sources) ? data.sources : [];\n\n  const sources = rows\n    .filter(\n      (row): row is Record<string, unknown> =>\n        typeof row === 'object' && row !== null,\n    )\n    .map((row) => ({\n      id: str(row.id) ?? '',\n      slug: str(row.slug) ?? '',\n      name: str(row.name),\n      roles: Array.isArray(row.roles)\n        ? row.roles.filter((role): role is string => typeof role === 'string')\n        : [],\n    }));\n\n  return { status: 'ok', sources };\n}\n\n/** Guard for the \"still unauthorized after one refresh\" terminal case. */\nexport function stillUnauthorizedSourceSeats(host: string): never {\n  throw authRequiredError(\n    `The session for ${host} could not authorize the source seat lookup.`,\n    `Run \"ekanos login --host ${host}\" and retry.`,\n  );\n}\n\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n\nfunction isRedirect(status: number): boolean {\n  return status >= 300 && status < 400;\n}\n\nfunction str(value: unknown): string | null {\n  return typeof value === 'string' && value.length > 0 ? value : null;\n}\n"]}
+{"version":3,"file":"sources-api.js","sourceRoot":"","sources":["../src/sources-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAqC3D;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY,EACZ,WAAmB;;IAEnB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,sBAAsB,EAAE;QAC5D,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;KACF,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAE9C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,MAAA,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,mCACb,GAAG,IAAI,yDAAyD,EAClE,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,kCAAkC,QAAQ,CAAC,MAAM,GAAG,EAC3D,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,mEAAmE;gBACjE,8CAA8C;YAClD,CAAC,CAAC,+DAA+D;gBAC7D,qCAAqC,CAC5C,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAA,IAAI,CAAC,IAAI,mCAAI,EAAE,CAA4B,CAAC;IAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAE7D,MAAM,OAAO,GAAG,IAAI;SACjB,MAAM,CACL,CAAC,GAAG,EAAkC,EAAE,CACtC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAC1C;SACA,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;;QAAC,OAAA,CAAC;YACb,EAAE,EAAE,MAAA,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,mCAAI,EAAE;YACrB,IAAI,EAAE,MAAA,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAI,EAAE;YACzB,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;gBAC7B,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;gBACtE,CAAC,CAAC,EAAE;SACP,CAAC,CAAA;KAAA,CAAC,CAAC;IAEN,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACvD,MAAM,iBAAiB,CACrB,mBAAmB,IAAI,8CAA8C,EACrE,4BAA4B,IAAI,cAAc,CAC/C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;AACvC,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC","sourcesContent":["import { request } from './auth/fusion-api';\nimport { authRequiredError, networkError } from './errors';\n\n/**\n * The CLI's client for the Fusion source-seat visibility route.\n *\n * ---------------------------------------------------------------------------\n * WIRE CONTRACT — the seam between this package and the Fusion web app.\n *\n * The server side is the host's `/api/partner/sources` route. As with the\n * auth routes and `publish-api.ts`, the two halves are coupled only by\n * HTTP; tests stub `fetch`, never the route.\n *\n *   GET /api/partner/sources        [Authorization: Bearer <access_token>]\n *     → 200 { ok: true, data: { sources: [{ id, slug, name, roles }] } }\n *           roles is a non-empty array of \"developer\" | \"source_admin\", sorted; sources\n *           is sorted by slug. Empty array means no seats anywhere.\n *     → 401 { error, code: \"AUTH_REQUIRED\" }      token absent or expired —\n *                                                 refresh once and retry\n *     → 403 { error, code: \"MFA_REQUIRED\" }\n *     → 3xx                                       treated as 401 (an\n *                                                 auth-gated Fusion page\n *                                                 answers 307)\n * ---------------------------------------------------------------------------\n */\n\nexport interface SourceSeat {\n  id: string;\n  slug: string;\n  name: string | null;\n  roles: string[];\n}\n\nexport type FetchSourceSeatsResult =\n  | { status: 'ok'; sources: SourceSeat[] }\n  /** The bearer token did not authenticate — refresh and retry, once. */\n  | { status: 'unauthorized' };\n\n/**\n * List the sources the caller holds a seat on (any role). Authorization is\n * entirely server-side (RLS on `source_memberships`): there is no client-side\n * filter to get wrong here.\n */\nexport async function fetchSourceSeats(\n  host: string,\n  accessToken: string,\n): Promise<FetchSourceSeatsResult> {\n  const response = await request(`${host}/api/partner/sources`, {\n    method: 'GET',\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${accessToken}`,\n    },\n  });\n\n  if (response.status === 401 || isRedirect(response.status)) {\n    return { status: 'unauthorized' };\n  }\n\n  const body = await readOptionalJson(response);\n\n  if (response.status === 403) {\n    throw authRequiredError(\n      str(body.error) ??\n        `${host} requires multi-factor authentication for this account.`,\n      `Complete MFA in the browser, then run \"ekanos login\" again.`,\n    );\n  }\n\n  if (!response.ok) {\n    throw networkError(\n      `${host}/api/partner/sources responded ${response.status}.`,\n      response.status >= 500\n        ? `The Fusion deployment returned a server error. Retry shortly; if ` +\n            `it persists, report it with the status code.`\n        : `Confirm the host is a Fusion deployment running a build that ` +\n            `includes the partner sources route.`,\n    );\n  }\n\n  const data = (body.data ?? {}) as Record<string, unknown>;\n  const rows = Array.isArray(data.sources) ? data.sources : [];\n\n  const sources = rows\n    .filter(\n      (row): row is Record<string, unknown> =>\n        typeof row === 'object' && row !== null,\n    )\n    .map((row) => ({\n      id: str(row.id) ?? '',\n      slug: str(row.slug) ?? '',\n      name: str(row.name),\n      roles: Array.isArray(row.roles)\n        ? row.roles.filter((role): role is string => typeof role === 'string')\n        : [],\n    }));\n\n  return { status: 'ok', sources };\n}\n\n/** Guard for the \"still unauthorized after one refresh\" terminal case. */\nexport function stillUnauthorizedSourceSeats(host: string): never {\n  throw authRequiredError(\n    `The session for ${host} could not authorize the source seat lookup.`,\n    `Run \"ekanos login --host ${host}\" and retry.`,\n  );\n}\n\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n\nfunction isRedirect(status: number): boolean {\n  return status >= 300 && status < 400;\n}\n\nfunction str(value: unknown): string | null {\n  return typeof value === 'string' && value.length > 0 ? value : null;\n}\n"]}

package/dist/test-report.d.ts

@@ -0,0 +1,32 @@
+import type { RenderableFinding } from './findings-renderer.js';
+export interface TestSummary {
+    passed: number;
+    failed: number;
+    files: number;
+}
+export interface ParsedTestReport {
+    /** One finding per failing test, grouped (via `check`) per test FILE. */
+    findings: RenderableFinding[];
+    /** Relative paths of files with at least one failure, first-seen order. */
+    failingFiles: string[];
+    summary: TestSummary | null;
+}
+/**
+ * Whether the project's OWN `test` script names vitest — the one signal
+ * used to decide whether to inject the JSON reporter at all. Deliberately
+ * conservative: a jest project, a custom node runner, or a shell wrapper is
+ * left completely alone, with no reporter flags appended and no report
+ * parsed — `ekanos test` behaves exactly as it did before this feature.
+ */
+export declare function projectTestScriptUsesVitest(projectDir: string): boolean;
+/** A fresh, unique path for the JSON report — one per invocation. The caller owns cleanup. */
+export declare function newReportPath(): string;
+/** The extra argv that makes vitest ALSO emit a JSON report alongside its normal terminal output. */
+export declare function reporterArgs(outputFilePath: string): string[];
+/**
+ * Reads and parses `reportPath` end to end. `null` on ANY failure (missing
+ * file — vitest crashed before writing it; malformed JSON; a shape this
+ * function doesn't recognize) so the caller falls back to the raw runner
+ * output instead of the curated appendix, and never to a crash.
+ */
+export declare function parseTestReport(reportPath: string, projectDir: string): ParsedTestReport | null;

package/dist/test-report.js

@@ -0,0 +1,255 @@
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+/**
+ * Parses vitest's `--reporter=json` output into the curated-failures
+ * appendix `ekanos test` renders locally, giving a partner the same
+ * per-test intelligence the server-side gate already has.
+ *
+ * This is a DELIBERATE, small duplication of the parsing the host's own
+ * gate uses to grade a submission's test run — not an import. `@ekanos/
+ * checks` is never published and never a dependency of a partner's project
+ * or of this CLI; keep the two in sync by eye if vitest's JSON reporter
+ * shape ever changes.
+ *
+ * Every entry point here is defensive end to end: a missing report file,
+ * malformed JSON, or an unrecognized shape all resolve to `null` rather than
+ * throwing. A partner's toolchain misbehaving must never crash `ekanos
+ * test` — it can only mean the curated appendix is unavailable, with the
+ * command falling back to exactly today's raw-passthrough behavior.
+ */
+/** Cap on assertion-diff lines shown per finding — see `extractDiff`. */
+const MAX_DIFF_LINES = 10;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+/**
+ * Whether the project's OWN `test` script names vitest — the one signal
+ * used to decide whether to inject the JSON reporter at all. Deliberately
+ * conservative: a jest project, a custom node runner, or a shell wrapper is
+ * left completely alone, with no reporter flags appended and no report
+ * parsed — `ekanos test` behaves exactly as it did before this feature.
+ */
+export function projectTestScriptUsesVitest(projectDir) {
+    const manifestPath = path.join(projectDir, 'package.json');
+    try {
+        const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+        if (!isRecord(manifest) || !isRecord(manifest.scripts))
+            return false;
+        const script = manifest.scripts.test;
+        return typeof script === 'string' && script.includes('vitest');
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/** A fresh, unique path for the JSON report — one per invocation. The caller owns cleanup. */
+export function newReportPath() {
+    return path.join(os.tmpdir(), `ekanos-test-vitest-${crypto.randomUUID()}.json`);
+}
+/** The extra argv that makes vitest ALSO emit a JSON report alongside its normal terminal output. */
+export function reporterArgs(outputFilePath) {
+    return [
+        '--reporter=default',
+        '--reporter=json',
+        `--outputFile=${outputFilePath}`,
+    ];
+}
+/** The first non-empty line of a vitest failure message/stack — the
+ * assertion or thrown error itself, not the frames beneath it. */
+function firstMeaningfulLine(text) {
+    const line = text
+        .split('\n')
+        .map((entry) => entry.trim())
+        .find((entry) => entry.length > 0);
+    return line !== null && line !== void 0 ? line : 'Test failed with no error message.';
+}
+/**
+ * Vitest's failure stacks always include the absolute test file path at
+ * least once — at the failure site itself — with the frames beneath it
+ * being the runner's own internals. The FIRST occurrence is the line that
+ * matters.
+ */
+function lineForFile(stack, absoluteFile) {
+    const escaped = absoluteFile.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const match = new RegExp(`${escaped}:(\\d+):\\d+`).exec(stack);
+    return match ? Number(match[1]) : undefined;
+}
+/**
+ * Up to `MAX_DIFF_LINES` lines of an expected/received diff block from one
+ * vitest failure message, or `null` when the message doesn't carry one.
+ *
+ * NOTE (found via manual end-to-end verification, not a hypothetical):
+ * vitest's OWN `toBe`/`toEqual`-family matchers never put this in the JSON
+ * reporter's `failureMessages` — the pretty "- Expected / + Received" block
+ * is a terminal-only rendering vitest's default reporter computes live from
+ * the error's `expected`/`actual`, and is never serialized into the report
+ * (checked vitest 3.2.7 and 4.1.10; `message`/`stack` is all that ships).
+ * This function still earns its place: a thrown `AssertionError` whose
+ * `.message` already embeds diff-formatted text — a custom matcher, a
+ * different assertion library layered on top of vitest, a hand-built
+ * `expect.extend` — DOES carry it verbatim in `failureMessages`, and this is
+ * what picks it up. It is intentionally a no-op for the common case rather
+ * than reconstructing a diff ourselves (a real diff needs the actual/expected
+ * values, which the JSON reporter doesn't expose, and computing one would
+ * mean a new dependency, and this package deliberately keeps its runtime
+ * dependency set to picocolors + @clack/prompts only).
+ *
+ * The diff sits between the failure's own title line and the stack frames
+ * (`at ...`) beneath it; within that span, only unified-diff-style `-`/`+`
+ * lines are kept — the jest-diff format such a message would use.
+ */
+function extractDiff(failureMessage) {
+    const lines = failureMessage
+        .split('\n')
+        .map((line) => line.replace(/\r$/, ''));
+    const stackStart = lines.findIndex((line) => /^\s*at\s/.test(line));
+    const body = stackStart === -1 ? lines.slice(1) : lines.slice(1, stackStart);
+    const diffLines = body.filter((line) => /^\s*[-+]/.test(line) &&
+        !line.startsWith('---') &&
+        !line.startsWith('+++'));
+    if (diffLines.length === 0)
+        return null;
+    const capped = diffLines.slice(0, MAX_DIFF_LINES);
+    const overflow = diffLines.length - capped.length;
+    if (overflow > 0) {
+        capped.push(`… and ${overflow} more diff line${overflow === 1 ? '' : 's'}`);
+    }
+    return capped.join('\n');
+}
+/** `path.relative` against the project root, falling back to the raw
+ * absolute path if the two disagree on realpath-vs-given-path (a symlinked
+ * temp dir resolving differently between this process and the child)
+ * rather than emitting a `../../../`-laden mess. */
+function archiveRelative(projectDir, absoluteFile) {
+    const direct = path.relative(projectDir, absoluteFile);
+    if (!direct.startsWith('..'))
+        return direct;
+    try {
+        const realProjectDir = fs.realpathSync(projectDir);
+        const viaRealpath = path.relative(realProjectDir, absoluteFile);
+        if (!viaRealpath.startsWith('..'))
+            return viaRealpath;
+    }
+    catch (_a) {
+        // realpathSync failing (e.g. the directory was already torn down) just
+        // means we fall through to the direct (if imperfect) relative path.
+    }
+    return direct;
+}
+/**
+ * Turns a parsed `--reporter=json` report into one `ParsedFailure` per
+ * failed test, across every test file in the run. Returns `null` — not
+ * `[]` — for anything that isn't recognizably a vitest JSON report at all,
+ * so the caller can tell "a real report with zero structured failures"
+ * apart from "not a report" (the latter falls back to the raw runner
+ * output; the former is a genuinely clean, if unexpected, run).
+ */
+function extractFailures(report) {
+    var _a;
+    if (!isRecord(report) || !Array.isArray(report.testResults))
+        return null;
+    const failures = [];
+    for (const fileResult of report.testResults) {
+        if (!isRecord(fileResult))
+            continue;
+        const file = fileResult.name;
+        const assertionResults = fileResult.assertionResults;
+        if (typeof file !== 'string' || !Array.isArray(assertionResults))
+            continue;
+        for (const assertion of assertionResults) {
+            if (!isRecord(assertion) || assertion.status !== 'failed')
+                continue;
+            const ancestorTitles = Array.isArray(assertion.ancestorTitles)
+                ? assertion.ancestorTitles.filter((entry) => typeof entry === 'string')
+                : [];
+            const title = typeof assertion.title === 'string'
+                ? assertion.title
+                : '(unnamed test)';
+            const failureMessages = Array.isArray(assertion.failureMessages)
+                ? assertion.failureMessages.filter((entry) => typeof entry === 'string')
+                : [];
+            const firstError = (_a = failureMessages[0]) !== null && _a !== void 0 ? _a : '';
+            const failure = {
+                file,
+                suite: ancestorTitles.join(' > '),
+                title,
+                message: firstMeaningfulLine(firstError),
+            };
+            const line = lineForFile(firstError, file);
+            if (line !== undefined)
+                failure.line = line;
+            const detail = extractDiff(firstError);
+            if (detail !== null)
+                failure.detail = detail;
+            failures.push(failure);
+        }
+    }
+    return failures;
+}
+/** `null` unless the report carries vitest's own aggregate pass/fail counts. */
+function extractSummary(report) {
+    if (!isRecord(report) || !Array.isArray(report.testResults))
+        return null;
+    const passed = report.numPassedTests;
+    const failed = report.numFailedTests;
+    if (typeof passed !== 'number' || typeof failed !== 'number')
+        return null;
+    return { passed, failed, files: report.testResults.length };
+}
+/**
+ * Reads and parses `reportPath` end to end. `null` on ANY failure (missing
+ * file — vitest crashed before writing it; malformed JSON; a shape this
+ * function doesn't recognize) so the caller falls back to the raw runner
+ * output instead of the curated appendix, and never to a crash.
+ */
+export function parseTestReport(reportPath, projectDir) {
+    let raw;
+    try {
+        raw = fs.readFileSync(reportPath, 'utf8');
+    }
+    catch (_a) {
+        return null;
+    }
+    let report;
+    try {
+        report = JSON.parse(raw);
+    }
+    catch (_b) {
+        return null;
+    }
+    const failures = extractFailures(report);
+    if (failures === null)
+        return null;
+    const findings = [];
+    const failingFiles = [];
+    const seenFiles = new Set();
+    for (const failure of failures) {
+        const relFile = archiveRelative(projectDir, failure.file);
+        if (!seenFiles.has(relFile)) {
+            seenFiles.add(relFile);
+            failingFiles.push(relFile);
+        }
+        const label = failure.suite
+            ? `${failure.suite} > ${failure.title}`
+            : failure.title;
+        const finding = {
+            // Grouping by test FILE (not by suite/title) is deliberate — the
+            // shared renderer groups by `check`, so this makes the group header
+            // show the file once with every failing test beneath it.
+            check: `tests/${relFile}`,
+            severity: 'error',
+            file: relFile,
+            message: `${label}: ${failure.message}`,
+            hint: 'Fix the failing assertion, then re-run "ekanos test".',
+        };
+        if (failure.line !== undefined)
+            finding.line = failure.line;
+        if (failure.detail !== undefined)
+            finding.detail = failure.detail;
+        findings.push(finding);
+    }
+    return { findings, failingFiles, summary: extractSummary(report) };
+}
+//# sourceMappingURL=test-report.js.map

package/dist/test-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-report.js","sourceRoot":"","sources":["../src/test-report.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAIlC;;;;;;;;;;;;;;;;GAgBG;AAEH,yEAAyE;AACzE,MAAM,cAAc,GAAG,EAAE,CAAC;AA0B1B,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAAkB;IAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAE3D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAErE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;QACrC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjE,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,IAAI,CACd,EAAE,CAAC,MAAM,EAAE,EACX,sBAAsB,MAAM,CAAC,UAAU,EAAE,OAAO,CACjD,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,YAAY,CAAC,cAAsB;IACjD,OAAO;QACL,oBAAoB;QACpB,iBAAiB;QACjB,gBAAgB,cAAc,EAAE;KACjC,CAAC;AACJ,CAAC;AAED;kEACkE;AAClE,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,IAAI,GAAG,IAAI;SACd,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,OAAO,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,oCAAoC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAa,EAAE,YAAoB;IACtD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,OAAO,cAAc,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,WAAW,CAAC,cAAsB;IACzC,MAAM,KAAK,GAAG,cAAc;SACzB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAE7E,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAC3B,CAAC,IAAI,EAAE,EAAE,CACP,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QACrB,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QACvB,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAC1B,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAExC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAClD,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,SAAS,QAAQ,kBAAkB,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;;oDAGoD;AACpD,SAAS,eAAe,CAAC,UAAkB,EAAE,YAAoB;IAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,WAAW,CAAC;IACxD,CAAC;IAAC,WAAM,CAAC;QACP,uEAAuE;QACvE,oEAAoE;IACtE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,MAAe;;IACtC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzE,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,WAAwB,EAAE,CAAC;QACzD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,SAAS;QACpC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC7B,MAAM,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;QACrD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAAE,SAAS;QAE3E,KAAK,MAAM,SAAS,IAAI,gBAA6B,EAAE,CAAC;YACtD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ;gBAAE,SAAS;YAEpE,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC;gBAC5D,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAC7B,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CACtD;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,KAAK,GACT,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ;gBACjC,CAAC,CAAC,SAAS,CAAC,KAAK;gBACjB,CAAC,CAAC,gBAAgB,CAAC;YACvB,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,eAAe,CAAC;gBAC9D,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,MAAM,CAC9B,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CACtD;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,UAAU,GAAG,MAAA,eAAe,CAAC,CAAC,CAAC,mCAAI,EAAE,CAAC;YAE5C,MAAM,OAAO,GAAkB;gBAC7B,IAAI;gBACJ,KAAK,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;gBACjC,KAAK;gBACL,OAAO,EAAE,mBAAmB,CAAC,UAAU,CAAC;aACzC,CAAC;YACF,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAC3C,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;YACvC,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;YAE7C,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,SAAS,cAAc,CAAC,MAAe;IACrC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzE,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC;IACrC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1E,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,UAAkB,EAClB,UAAkB;IAElB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACvB,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK;YACzB,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,MAAM,OAAO,CAAC,KAAK,EAAE;YACvC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAClB,MAAM,OAAO,GAAsB;YACjC,iEAAiE;YACjE,oEAAoE;YACpE,yDAAyD;YACzD,KAAK,EAAE,SAAS,OAAO,EAAE;YACzB,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,GAAG,KAAK,KAAK,OAAO,CAAC,OAAO,EAAE;YACvC,IAAI,EAAE,uDAAuD;SAC9D,CAAC;QACF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC5D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAClE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;AACrE,CAAC","sourcesContent":["import * as crypto from 'node:crypto';\nimport * as fs from 'node:fs';\nimport * as os from 'node:os';\nimport * as path from 'node:path';\n\nimport type { RenderableFinding } from './findings-renderer';\n\n/**\n * Parses vitest's `--reporter=json` output into the curated-failures\n * appendix `ekanos test` renders locally, giving a partner the same\n * per-test intelligence the server-side gate already has.\n *\n * This is a DELIBERATE, small duplication of the parsing the host's own\n * gate uses to grade a submission's test run — not an import. `@ekanos/\n * checks` is never published and never a dependency of a partner's project\n * or of this CLI; keep the two in sync by eye if vitest's JSON reporter\n * shape ever changes.\n *\n * Every entry point here is defensive end to end: a missing report file,\n * malformed JSON, or an unrecognized shape all resolve to `null` rather than\n * throwing. A partner's toolchain misbehaving must never crash `ekanos\n * test` — it can only mean the curated appendix is unavailable, with the\n * command falling back to exactly today's raw-passthrough behavior.\n */\n\n/** Cap on assertion-diff lines shown per finding — see `extractDiff`. */\nconst MAX_DIFF_LINES = 10;\n\nexport interface TestSummary {\n  passed: number;\n  failed: number;\n  files: number;\n}\n\nexport interface ParsedTestReport {\n  /** One finding per failing test, grouped (via `check`) per test FILE. */\n  findings: RenderableFinding[];\n  /** Relative paths of files with at least one failure, first-seen order. */\n  failingFiles: string[];\n  summary: TestSummary | null;\n}\n\ninterface ParsedFailure {\n  /** Absolute path, exactly as vitest reported it. */\n  file: string;\n  suite: string;\n  title: string;\n  message: string;\n  line?: number;\n  detail?: string;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null;\n}\n\n/**\n * Whether the project's OWN `test` script names vitest — the one signal\n * used to decide whether to inject the JSON reporter at all. Deliberately\n * conservative: a jest project, a custom node runner, or a shell wrapper is\n * left completely alone, with no reporter flags appended and no report\n * parsed — `ekanos test` behaves exactly as it did before this feature.\n */\nexport function projectTestScriptUsesVitest(projectDir: string): boolean {\n  const manifestPath = path.join(projectDir, 'package.json');\n\n  try {\n    const manifest: unknown = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));\n    if (!isRecord(manifest) || !isRecord(manifest.scripts)) return false;\n\n    const script = manifest.scripts.test;\n    return typeof script === 'string' && script.includes('vitest');\n  } catch {\n    return false;\n  }\n}\n\n/** A fresh, unique path for the JSON report — one per invocation. The caller owns cleanup. */\nexport function newReportPath(): string {\n  return path.join(\n    os.tmpdir(),\n    `ekanos-test-vitest-${crypto.randomUUID()}.json`,\n  );\n}\n\n/** The extra argv that makes vitest ALSO emit a JSON report alongside its normal terminal output. */\nexport function reporterArgs(outputFilePath: string): string[] {\n  return [\n    '--reporter=default',\n    '--reporter=json',\n    `--outputFile=${outputFilePath}`,\n  ];\n}\n\n/** The first non-empty line of a vitest failure message/stack — the\n * assertion or thrown error itself, not the frames beneath it. */\nfunction firstMeaningfulLine(text: string): string {\n  const line = text\n    .split('\\n')\n    .map((entry) => entry.trim())\n    .find((entry) => entry.length > 0);\n  return line ?? 'Test failed with no error message.';\n}\n\n/**\n * Vitest's failure stacks always include the absolute test file path at\n * least once — at the failure site itself — with the frames beneath it\n * being the runner's own internals. The FIRST occurrence is the line that\n * matters.\n */\nfunction lineForFile(stack: string, absoluteFile: string): number | undefined {\n  const escaped = absoluteFile.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n  const match = new RegExp(`${escaped}:(\\\\d+):\\\\d+`).exec(stack);\n  return match ? Number(match[1]) : undefined;\n}\n\n/**\n * Up to `MAX_DIFF_LINES` lines of an expected/received diff block from one\n * vitest failure message, or `null` when the message doesn't carry one.\n *\n * NOTE (found via manual end-to-end verification, not a hypothetical):\n * vitest's OWN `toBe`/`toEqual`-family matchers never put this in the JSON\n * reporter's `failureMessages` — the pretty \"- Expected / + Received\" block\n * is a terminal-only rendering vitest's default reporter computes live from\n * the error's `expected`/`actual`, and is never serialized into the report\n * (checked vitest 3.2.7 and 4.1.10; `message`/`stack` is all that ships).\n * This function still earns its place: a thrown `AssertionError` whose\n * `.message` already embeds diff-formatted text — a custom matcher, a\n * different assertion library layered on top of vitest, a hand-built\n * `expect.extend` — DOES carry it verbatim in `failureMessages`, and this is\n * what picks it up. It is intentionally a no-op for the common case rather\n * than reconstructing a diff ourselves (a real diff needs the actual/expected\n * values, which the JSON reporter doesn't expose, and computing one would\n * mean a new dependency, and this package deliberately keeps its runtime\n * dependency set to picocolors + @clack/prompts only).\n *\n * The diff sits between the failure's own title line and the stack frames\n * (`at ...`) beneath it; within that span, only unified-diff-style `-`/`+`\n * lines are kept — the jest-diff format such a message would use.\n */\nfunction extractDiff(failureMessage: string): string | null {\n  const lines = failureMessage\n    .split('\\n')\n    .map((line) => line.replace(/\\r$/, ''));\n  const stackStart = lines.findIndex((line) => /^\\s*at\\s/.test(line));\n  const body = stackStart === -1 ? lines.slice(1) : lines.slice(1, stackStart);\n\n  const diffLines = body.filter(\n    (line) =>\n      /^\\s*[-+]/.test(line) &&\n      !line.startsWith('---') &&\n      !line.startsWith('+++'),\n  );\n  if (diffLines.length === 0) return null;\n\n  const capped = diffLines.slice(0, MAX_DIFF_LINES);\n  const overflow = diffLines.length - capped.length;\n  if (overflow > 0) {\n    capped.push(`… and ${overflow} more diff line${overflow === 1 ? '' : 's'}`);\n  }\n  return capped.join('\\n');\n}\n\n/** `path.relative` against the project root, falling back to the raw\n * absolute path if the two disagree on realpath-vs-given-path (a symlinked\n * temp dir resolving differently between this process and the child)\n * rather than emitting a `../../../`-laden mess. */\nfunction archiveRelative(projectDir: string, absoluteFile: string): string {\n  const direct = path.relative(projectDir, absoluteFile);\n  if (!direct.startsWith('..')) return direct;\n  try {\n    const realProjectDir = fs.realpathSync(projectDir);\n    const viaRealpath = path.relative(realProjectDir, absoluteFile);\n    if (!viaRealpath.startsWith('..')) return viaRealpath;\n  } catch {\n    // realpathSync failing (e.g. the directory was already torn down) just\n    // means we fall through to the direct (if imperfect) relative path.\n  }\n  return direct;\n}\n\n/**\n * Turns a parsed `--reporter=json` report into one `ParsedFailure` per\n * failed test, across every test file in the run. Returns `null` — not\n * `[]` — for anything that isn't recognizably a vitest JSON report at all,\n * so the caller can tell \"a real report with zero structured failures\"\n * apart from \"not a report\" (the latter falls back to the raw runner\n * output; the former is a genuinely clean, if unexpected, run).\n */\nfunction extractFailures(report: unknown): ParsedFailure[] | null {\n  if (!isRecord(report) || !Array.isArray(report.testResults)) return null;\n\n  const failures: ParsedFailure[] = [];\n  for (const fileResult of report.testResults as unknown[]) {\n    if (!isRecord(fileResult)) continue;\n    const file = fileResult.name;\n    const assertionResults = fileResult.assertionResults;\n    if (typeof file !== 'string' || !Array.isArray(assertionResults)) continue;\n\n    for (const assertion of assertionResults as unknown[]) {\n      if (!isRecord(assertion) || assertion.status !== 'failed') continue;\n\n      const ancestorTitles = Array.isArray(assertion.ancestorTitles)\n        ? assertion.ancestorTitles.filter(\n            (entry): entry is string => typeof entry === 'string',\n          )\n        : [];\n      const title =\n        typeof assertion.title === 'string'\n          ? assertion.title\n          : '(unnamed test)';\n      const failureMessages = Array.isArray(assertion.failureMessages)\n        ? assertion.failureMessages.filter(\n            (entry): entry is string => typeof entry === 'string',\n          )\n        : [];\n      const firstError = failureMessages[0] ?? '';\n\n      const failure: ParsedFailure = {\n        file,\n        suite: ancestorTitles.join(' > '),\n        title,\n        message: firstMeaningfulLine(firstError),\n      };\n      const line = lineForFile(firstError, file);\n      if (line !== undefined) failure.line = line;\n      const detail = extractDiff(firstError);\n      if (detail !== null) failure.detail = detail;\n\n      failures.push(failure);\n    }\n  }\n  return failures;\n}\n\n/** `null` unless the report carries vitest's own aggregate pass/fail counts. */\nfunction extractSummary(report: unknown): TestSummary | null {\n  if (!isRecord(report) || !Array.isArray(report.testResults)) return null;\n\n  const passed = report.numPassedTests;\n  const failed = report.numFailedTests;\n  if (typeof passed !== 'number' || typeof failed !== 'number') return null;\n\n  return { passed, failed, files: report.testResults.length };\n}\n\n/**\n * Reads and parses `reportPath` end to end. `null` on ANY failure (missing\n * file — vitest crashed before writing it; malformed JSON; a shape this\n * function doesn't recognize) so the caller falls back to the raw runner\n * output instead of the curated appendix, and never to a crash.\n */\nexport function parseTestReport(\n  reportPath: string,\n  projectDir: string,\n): ParsedTestReport | null {\n  let raw: string;\n  try {\n    raw = fs.readFileSync(reportPath, 'utf8');\n  } catch {\n    return null;\n  }\n\n  let report: unknown;\n  try {\n    report = JSON.parse(raw);\n  } catch {\n    return null;\n  }\n\n  const failures = extractFailures(report);\n  if (failures === null) return null;\n\n  const findings: RenderableFinding[] = [];\n  const failingFiles: string[] = [];\n  const seenFiles = new Set<string>();\n\n  for (const failure of failures) {\n    const relFile = archiveRelative(projectDir, failure.file);\n    if (!seenFiles.has(relFile)) {\n      seenFiles.add(relFile);\n      failingFiles.push(relFile);\n    }\n\n    const label = failure.suite\n      ? `${failure.suite} > ${failure.title}`\n      : failure.title;\n    const finding: RenderableFinding = {\n      // Grouping by test FILE (not by suite/title) is deliberate — the\n      // shared renderer groups by `check`, so this makes the group header\n      // show the file once with every failing test beneath it.\n      check: `tests/${relFile}`,\n      severity: 'error',\n      file: relFile,\n      message: `${label}: ${failure.message}`,\n      hint: 'Fix the failing assertion, then re-run \"ekanos test\".',\n    };\n    if (failure.line !== undefined) finding.line = failure.line;\n    if (failure.detail !== undefined) finding.detail = failure.detail;\n    findings.push(finding);\n  }\n\n  return { findings, failingFiles, summary: extractSummary(report) };\n}\n"]}

package/dist/toolchain-api.d.ts

@@ -5,11 +5,11 @@ import { type ToolchainNote, type ToolchainVersions } from './toolchain.js';
  * ---------------------------------------------------------------------------
  * WIRE CONTRACT — the seam between this package and the Fusion web app.
  *
- * The server side lives in `apps/web/app/api/partner/toolchain/route.ts` and
- * ships on a DIFFERENT BRANCH from this file, same as every other route in
- * `auth/fusion-api.ts` and `publish-api.ts`. Nothing here imports from
- * `apps/web`; the two halves are coupled only by HTTP, and the tests stub
- * `fetch`, never the route.
+ * The server side is the host's `/api/partner/toolchain` route and ships on
+ * a DIFFERENT BRANCH from this file, same as every other route in
+ * `auth/fusion-api.ts` and `publish-api.ts`. Nothing here imports host code;
+ * the two halves are coupled only by HTTP, and the tests stub `fetch`,
+ * never the route.
  *
  *   GET /api/partner/toolchain   [Authorization: Bearer <access_token>]
  *     → 200 { ok: true, data: {

package/dist/toolchain-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"toolchain-api.js","sourceRoot":"","sources":["../src/toolchain-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EACL,kBAAkB,GAGnB,MAAM,aAAa,CAAC;AAqDrB,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,wBAAwB,EAAE;YAC9D,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAEnD,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAEjC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACvE,CAAC;IAAC,WAAM,CAAC;QACP,uEAAuE;QACvE,qEAAqE;QACrE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAa;IAChC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,IAAI,GAAI,IAA2B,CAAC,IAAI,CAAC;IAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE3D,MAAM,OAAO,GAAG,aAAa,CAAE,IAA8B,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,aAAa,CAAE,IAA8B,CAAC,OAAO,CAAC,CAAC;IACvE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,QAAQ,GAAI,IAA4B,CAAC,KAAK,CAAC;IACrD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAErE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,MAAM,GAA+B,EAAE,CAAC;IAE9C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAC3B,kBAAkB,CACY,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACpB,CAAC;IAED,OAAO,MAA2B,CAAC;AACrC,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,IAAI,GAAG,KAA+C,CAAC;IAC7D,OAAO,CACL,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC;QAChD,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CACjC,CAAC;AACJ,CAAC","sourcesContent":["import { request } from './auth/fusion-api';\nimport {\n  TOOLCHAIN_PACKAGES,\n  type ToolchainNote,\n  type ToolchainVersions,\n} from './toolchain';\n\n/**\n * The CLI's client for the Fusion toolchain-advisory route.\n *\n * ---------------------------------------------------------------------------\n * WIRE CONTRACT — the seam between this package and the Fusion web app.\n *\n * The server side lives in `apps/web/app/api/partner/toolchain/route.ts` and\n * ships on a DIFFERENT BRANCH from this file, same as every other route in\n * `auth/fusion-api.ts` and `publish-api.ts`. Nothing here imports from\n * `apps/web`; the two halves are coupled only by HTTP, and the tests stub\n * `fetch`, never the route.\n *\n *   GET /api/partner/toolchain   [Authorization: Bearer <access_token>]\n *     → 200 { ok: true, data: {\n *         current:  { cli, sdk, ui, integrationSchema, harness },  // the\n *                                                                  // coherent\n *                                                                  // set the\n *                                                                  // host\n *                                                                  // recommends\n *         minimum:  { cli, sdk, ui, integrationSchema, harness },  // below\n *                                                                  // this the\n *                                                                  // host\n *                                                                  // refuses\n *         notes?:   [{ level: \"warn\" | \"info\", message: string }],\n *       } }\n *     → any other status, or a body that fails to parse or match this shape\n *\n * This endpoint is treated as ADVISORY, not authoritative in the way the auth\n * and submission routes are: a 404 (an older Fusion deployment that predates\n * this route) or a 501 (deliberately unimplemented) are both entirely\n * ordinary, and a 4xx/5xx/network failure/malformed body all mean exactly the\n * same thing to every caller — \"the endpoint is unavailable, fall back to the\n * npm registry\" — so this module never throws. There is no not-configured\n * distinction to make here the way `cli-config` has: a caller with no way to\n * reach this route at all (no host, no session) never calls it in the first\n * place; see `toolchain-resolve.ts`.\n *\n * Unknown extra fields in the response are tolerated (only the fields above\n * are read); a missing `notes` defaults to an empty array.\n * ---------------------------------------------------------------------------\n */\n\nexport interface ToolchainReport {\n  current: ToolchainVersions;\n  minimum: ToolchainVersions;\n  notes: ToolchainNote[];\n}\n\nexport type FetchToolchainResult =\n  { status: 'ok'; report: ToolchainReport } | { status: 'unavailable' };\n\nexport async function fetchToolchainReport(\n  host: string,\n  accessToken: string,\n): Promise<FetchToolchainResult> {\n  try {\n    const response = await request(`${host}/api/partner/toolchain`, {\n      method: 'GET',\n      headers: {\n        accept: 'application/json',\n        authorization: `Bearer ${accessToken}`,\n      },\n    });\n\n    if (!response.ok) return { status: 'unavailable' };\n\n    const body: unknown = await response.json();\n    const report = parseReport(body);\n\n    return report ? { status: 'ok', report } : { status: 'unavailable' };\n  } catch {\n    // Network failure, timeout, or a body that is not even JSON — all read\n    // the same: the endpoint is unavailable this time, fall back to npm.\n    return { status: 'unavailable' };\n  }\n}\n\nfunction parseReport(body: unknown): ToolchainReport | null {\n  if (typeof body !== 'object' || body === null) return null;\n  const data = (body as { data?: unknown }).data;\n  if (typeof data !== 'object' || data === null) return null;\n\n  const current = parseVersions((data as { current?: unknown }).current);\n  const minimum = parseVersions((data as { minimum?: unknown }).minimum);\n  if (!current || !minimum) return null;\n\n  const rawNotes = (data as { notes?: unknown }).notes;\n  const notes = Array.isArray(rawNotes) ? rawNotes.filter(isNote) : [];\n\n  return { current, minimum, notes };\n}\n\nfunction parseVersions(value: unknown): ToolchainVersions | null {\n  if (typeof value !== 'object' || value === null) return null;\n  const record = value as Record<string, unknown>;\n  const result: Partial<ToolchainVersions> = {};\n\n  for (const key of Object.keys(\n    TOOLCHAIN_PACKAGES,\n  ) as (keyof ToolchainVersions)[]) {\n    const raw = record[key];\n    if (typeof raw !== 'string' || raw.length === 0) return null;\n    result[key] = raw;\n  }\n\n  return result as ToolchainVersions;\n}\n\nfunction isNote(value: unknown): value is ToolchainNote {\n  if (typeof value !== 'object' || value === null) return false;\n  const note = value as { level?: unknown; message?: unknown };\n  return (\n    (note.level === 'warn' || note.level === 'info') &&\n    typeof note.message === 'string'\n  );\n}\n"]}
+{"version":3,"file":"toolchain-api.js","sourceRoot":"","sources":["../src/toolchain-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EACL,kBAAkB,GAGnB,MAAM,aAAa,CAAC;AAqDrB,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,wBAAwB,EAAE;YAC9D,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAEnD,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAEjC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACvE,CAAC;IAAC,WAAM,CAAC;QACP,uEAAuE;QACvE,qEAAqE;QACrE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAa;IAChC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,IAAI,GAAI,IAA2B,CAAC,IAAI,CAAC;IAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE3D,MAAM,OAAO,GAAG,aAAa,CAAE,IAA8B,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,aAAa,CAAE,IAA8B,CAAC,OAAO,CAAC,CAAC;IACvE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,QAAQ,GAAI,IAA4B,CAAC,KAAK,CAAC;IACrD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAErE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,MAAM,GAA+B,EAAE,CAAC;IAE9C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAC3B,kBAAkB,CACY,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACpB,CAAC;IAED,OAAO,MAA2B,CAAC;AACrC,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,IAAI,GAAG,KAA+C,CAAC;IAC7D,OAAO,CACL,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC;QAChD,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CACjC,CAAC;AACJ,CAAC","sourcesContent":["import { request } from './auth/fusion-api';\nimport {\n  TOOLCHAIN_PACKAGES,\n  type ToolchainNote,\n  type ToolchainVersions,\n} from './toolchain';\n\n/**\n * The CLI's client for the Fusion toolchain-advisory route.\n *\n * ---------------------------------------------------------------------------\n * WIRE CONTRACT — the seam between this package and the Fusion web app.\n *\n * The server side is the host's `/api/partner/toolchain` route and ships on\n * a DIFFERENT BRANCH from this file, same as every other route in\n * `auth/fusion-api.ts` and `publish-api.ts`. Nothing here imports host code;\n * the two halves are coupled only by HTTP, and the tests stub `fetch`,\n * never the route.\n *\n *   GET /api/partner/toolchain   [Authorization: Bearer <access_token>]\n *     → 200 { ok: true, data: {\n *         current:  { cli, sdk, ui, integrationSchema, harness },  // the\n *                                                                  // coherent\n *                                                                  // set the\n *                                                                  // host\n *                                                                  // recommends\n *         minimum:  { cli, sdk, ui, integrationSchema, harness },  // below\n *                                                                  // this the\n *                                                                  // host\n *                                                                  // refuses\n *         notes?:   [{ level: \"warn\" | \"info\", message: string }],\n *       } }\n *     → any other status, or a body that fails to parse or match this shape\n *\n * This endpoint is treated as ADVISORY, not authoritative in the way the auth\n * and submission routes are: a 404 (an older Fusion deployment that predates\n * this route) or a 501 (deliberately unimplemented) are both entirely\n * ordinary, and a 4xx/5xx/network failure/malformed body all mean exactly the\n * same thing to every caller — \"the endpoint is unavailable, fall back to the\n * npm registry\" — so this module never throws. There is no not-configured\n * distinction to make here the way `cli-config` has: a caller with no way to\n * reach this route at all (no host, no session) never calls it in the first\n * place; see `toolchain-resolve.ts`.\n *\n * Unknown extra fields in the response are tolerated (only the fields above\n * are read); a missing `notes` defaults to an empty array.\n * ---------------------------------------------------------------------------\n */\n\nexport interface ToolchainReport {\n  current: ToolchainVersions;\n  minimum: ToolchainVersions;\n  notes: ToolchainNote[];\n}\n\nexport type FetchToolchainResult =\n  { status: 'ok'; report: ToolchainReport } | { status: 'unavailable' };\n\nexport async function fetchToolchainReport(\n  host: string,\n  accessToken: string,\n): Promise<FetchToolchainResult> {\n  try {\n    const response = await request(`${host}/api/partner/toolchain`, {\n      method: 'GET',\n      headers: {\n        accept: 'application/json',\n        authorization: `Bearer ${accessToken}`,\n      },\n    });\n\n    if (!response.ok) return { status: 'unavailable' };\n\n    const body: unknown = await response.json();\n    const report = parseReport(body);\n\n    return report ? { status: 'ok', report } : { status: 'unavailable' };\n  } catch {\n    // Network failure, timeout, or a body that is not even JSON — all read\n    // the same: the endpoint is unavailable this time, fall back to npm.\n    return { status: 'unavailable' };\n  }\n}\n\nfunction parseReport(body: unknown): ToolchainReport | null {\n  if (typeof body !== 'object' || body === null) return null;\n  const data = (body as { data?: unknown }).data;\n  if (typeof data !== 'object' || data === null) return null;\n\n  const current = parseVersions((data as { current?: unknown }).current);\n  const minimum = parseVersions((data as { minimum?: unknown }).minimum);\n  if (!current || !minimum) return null;\n\n  const rawNotes = (data as { notes?: unknown }).notes;\n  const notes = Array.isArray(rawNotes) ? rawNotes.filter(isNote) : [];\n\n  return { current, minimum, notes };\n}\n\nfunction parseVersions(value: unknown): ToolchainVersions | null {\n  if (typeof value !== 'object' || value === null) return null;\n  const record = value as Record<string, unknown>;\n  const result: Partial<ToolchainVersions> = {};\n\n  for (const key of Object.keys(\n    TOOLCHAIN_PACKAGES,\n  ) as (keyof ToolchainVersions)[]) {\n    const raw = record[key];\n    if (typeof raw !== 'string' || raw.length === 0) return null;\n    result[key] = raw;\n  }\n\n  return result as ToolchainVersions;\n}\n\nfunction isNote(value: unknown): value is ToolchainNote {\n  if (typeof value !== 'object' || value === null) return false;\n  const note = value as { level?: unknown; message?: unknown };\n  return (\n    (note.level === 'warn' || note.level === 'info') &&\n    typeof note.message === 'string'\n  );\n}\n"]}

package/dist/ui.d.ts

@@ -0,0 +1,75 @@
+/**
+ * The CLI's sole style layer. Every color, glyph, and human-output component
+ * lives here — nothing else in this package may `import 'picocolors'` or
+ * write a raw ANSI escape (the gradient banner in `banner.ts` is the one
+ * documented exception: it paints a true-color gradient picocolors cannot
+ * express, but even it asks THIS module's `colorsEnabled` for the on/off
+ * decision, so there is exactly one gate).
+ *
+ * Everything here renders plain strings. Printing is still `CliContext`'s
+ * job (`ctx.log`) — this module never touches a stream directly, so the
+ * stdout-purity invariant in `context.ts` cannot be bypassed by a stray
+ * color call.
+ */
+/** What `colorsEnabled` needs to know to decide — never the real stream. */
+export interface ColorProbe {
+    /** Whether the destination (stderr, always — see `context.ts`) is a TTY. */
+    isTTY: boolean;
+    env: Readonly<Record<string, string | undefined>>;
+}
+/**
+ * The one color-on/off decision for the whole CLI. True only when the
+ * stream is a real terminal AND `NO_COLOR` is unset AND `TERM` is not
+ * `"dumb"` — EXCEPT `FORCE_COLOR`, which overrides everything else on when
+ * set to anything other than `"0"` (matching the de facto convention: Node,
+ * chalk, and picocolors itself all treat a defined-and-nonzero `FORCE_COLOR`
+ * as "yes, even if you don't think you can").
+ */
+export declare function colorsEnabled(probe: ColorProbe): boolean;
+export interface Glyphs {
+    ok: string;
+    err: string;
+    warn: string;
+    info: string;
+}
+/** One row of `ui.keyValue`. */
+export type KeyValueRow = readonly [key: string, value: string];
+export interface CodeframeOptions {
+    /** Not rendered directly — callers already print `file:line` above/around this. Kept for future use and self-documentation at call sites. */
+    file?: string;
+    /** 1-indexed line to highlight. */
+    line: number;
+    /** The full source text of `file`. */
+    source: string;
+    /** Lines of context above/below the target line. Defaults to 2. */
+    contextLines?: number;
+}
+export type BadgeKind = 'dim' | 'accent' | 'warn' | 'err';
+export interface Ui {
+    readonly colors: boolean;
+    readonly glyphs: Glyphs;
+    err(text: string): string;
+    warn(text: string): string;
+    ok(text: string): string;
+    accent(text: string): string;
+    dim(text: string): string;
+    bold(text: string): string;
+    /** A dim, uppercased section header. */
+    section(title: string): string;
+    /** Aligned `key  value` rows, 2-space gutter, keys dimmed. */
+    keyValue(rows: readonly KeyValueRow[]): string;
+    /** A header-having, left/right-aligned table with no box-drawing. */
+    table(headers: readonly string[], rows: readonly (readonly (string | number)[])[]): string;
+    /** A `→ ` prefixed, accent-colored hint line. */
+    hint(text: string): string;
+    /**
+     * THE closing line of any failure path: a blank line, then a dim
+     * `→ <why>: ` (or bare `→ `) followed by the bold remediation command.
+     */
+    nextAction(cmd: string, why?: string): string;
+    /** A Prisma/Vite-style source snippet around one line. */
+    codeframe(opts: CodeframeOptions): string;
+    /** A bracketed, dim-by-default tag: `[gate · 2h ago]`. */
+    badge(text: string, kind?: BadgeKind): string;
+}
+export declare function createUi(probe: ColorProbe): Ui;