@ekanos/cli 0.13.0 → 0.14.0

package/dist/commands/use.js.map

@@ -1 +1 @@
-{"version":3,"file":"use.js","sourceRoot":"","sources":["../../src/commands/use.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,EAAmB,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClC,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAWjD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,GAAe,EACf,IAAa;IAEb,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,UAAU,CACd,uBAAuB,EACvB,gEAAgE;YAC9D,2BAA2B,CAC9B,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAE9B,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAErC,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE;QAC3D,UAAU,EAAE,IAAI,CAAC,GAAG;KACrB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAE5D,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACrC,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAEzD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,cAAc,CAClB,gDAAgD,IAAI,QAAQ,GAAG,CAAC,IAAI,GAAG,EACvE,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CACpC,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAEpE,OAAO,GAAG,CAAC,OAAO,CAChB;QACE,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE;YACN,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB;QACD,eAAe,EAAE,SAAS,CAAC,MAAM;QACjC,aAAa,EAAE,SAAS,CAAC,IAAI;KAC9B,EACD,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;QACZ,KAAK,EAAE,oBAAoB;QAC3B,IAAI,EAAE;YACJ,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACjE,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC,UAAU,EAAE,aAAa,CAAC;SAC5B;KACF,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,OAAqB,EAAE,IAAY;IACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CACL,sCAAsC,IAAI,8BAA8B;YACxE,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO;SACjB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;SAC/C,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO,uBAAuB,IAAI,8CAA8C,CAAC;AACnF,CAAC","sourcesContent":["import { requireSession, resolveAuthEnvironment } from '../auth/session';\nimport type { CliContext } from '../context';\nimport { forbiddenError, usageError } from '../errors';\nimport type { ExitCode } from '../exit-codes';\nimport { loadProject } from '../project';\nimport { fetchSeatsWithOneRefresh } from '../seats';\nimport { type SourceSeat, stillUnauthorizedSourceSeats } from '../sources-api';\nimport { shortHost } from '../ui';\nimport { persistProjectFields } from './publish';\n\nexport interface UseArgs {\n  host?: string;\n  /** Project directory (contains ekanos.json). Defaults to cwd. */\n  dir: string;\n  /** The source slug to switch this project's publish target to. */\n  slug?: string;\n  env: Record<string, string | undefined>;\n}\n\n/**\n * `use <source-slug>` — set this project's publish target, with the same\n * seat verification `publish` runs: the slug must name a source the caller\n * actually holds a seat on, so a project can never be pointed at a source by\n * a typo alone.\n *\n * Persisted via the exact same mechanics `publish` uses after a successful\n * submission (`persistProjectFields`), so `host` also sticks on first write\n * and a later `publish` needs neither flag.\n */\nexport async function runUse(\n  ctx: CliContext,\n  args: UseArgs,\n): Promise<ExitCode> {\n  if (!args.slug || args.slug.trim().length === 0) {\n    throw usageError(\n      'No source slug given.',\n      'Run \"ekanos use <source-slug>\" — see \"ekanos sources\" for the ' +\n        'slugs you hold a seat on.',\n    );\n  }\n\n  const slug = args.slug.trim();\n\n  // Requires a project up front: `use` sets ekanos.json's \"source\" field, so\n  // running it outside one is a precondition failure, not a network call.\n  const loaded = loadProject(args.dir);\n\n  const env = resolveAuthEnvironment(ctx, args.host, args.env, {\n    projectDir: args.dir,\n  });\n  const session = requireSession(env.store, env.host);\n\n  const result = await fetchSeatsWithOneRefresh(env, session);\n\n  if (result.status === 'unauthorized') {\n    stillUnauthorizedSourceSeats(env.host);\n  }\n\n  const seat = result.sources.find((s) => s.slug === slug);\n\n  if (!seat) {\n    throw forbiddenError(\n      `This account does not hold a seat on source \"${slug}\" on ${env.host}.`,\n      seatsHint(result.sources, env.host),\n    );\n  }\n\n  const persisted = persistProjectFields(loaded, seat.slug, env.host);\n\n  return ctx.succeed(\n    {\n      host: env.host,\n      source: {\n        id: seat.id,\n        slug: seat.slug,\n        name: seat.name,\n        roles: seat.roles,\n      },\n      sourcePersisted: persisted.source,\n      hostPersisted: persisted.host,\n    },\n    ctx.ui.result({\n      title: 'Publish target set',\n      rows: [\n        ['Source', seat.name ? `${seat.name} (${seat.slug})` : seat.slug],\n        ['Role', seat.roles.join(', ')],\n        ['Host', shortHost(env.host)],\n        ['Saved to', 'ekanos.json'],\n      ],\n    }),\n  );\n}\n\nfunction seatsHint(sources: SourceSeat[], host: string): string {\n  if (sources.length === 0) {\n    return (\n      `You hold no seats on any source on ${host}. Ask an Ekanos super-admin ` +\n      `to grant your account a seat on the intended source.`\n    );\n  }\n\n  const list = sources\n    .map((s) => `${s.slug} (${s.roles.join(', ')})`)\n    .join(', ');\n\n  return `You hold a seat on: ${list}. Run \"ekanos use <slug>\" with one of these.`;\n}\n"]}
+{"version":3,"file":"use.js","sourceRoot":"","sources":["../../src/commands/use.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,EAAmB,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClC,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAWjD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,GAAe,EACf,IAAa;IAEb,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,UAAU,CACd,uBAAuB,EACvB,gEAAgE;YAC9D,2BAA2B,CAC9B,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAE9B,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAErC,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE;QAC3D,UAAU,EAAE,IAAI,CAAC,GAAG;KACrB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAEpC,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAE5D,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACrC,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAEzD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,cAAc,CAClB,gDAAgD,IAAI,QAAQ,GAAG,CAAC,IAAI,GAAG,EACvE,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CACpC,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAEpE,OAAO,GAAG,CAAC,OAAO,CAChB;QACE,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE;YACN,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB;QACD,eAAe,EAAE,SAAS,CAAC,MAAM;QACjC,aAAa,EAAE,SAAS,CAAC,IAAI;KAC9B,EACD,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;QACZ,KAAK,EAAE,oBAAoB;QAC3B,IAAI,EAAE;YACJ,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACjE,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC,UAAU,EAAE,aAAa,CAAC;SAC5B;KACF,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,OAAqB,EAAE,IAAY;IACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CACL,sCAAsC,IAAI,8BAA8B;YACxE,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO;SACjB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;SAC/C,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO,uBAAuB,IAAI,8CAA8C,CAAC;AACnF,CAAC","sourcesContent":["import { requireSession, resolveAuthEnvironment } from '../auth/session';\nimport type { CliContext } from '../context';\nimport { forbiddenError, usageError } from '../errors';\nimport type { ExitCode } from '../exit-codes';\nimport { loadProject } from '../project';\nimport { fetchSeatsWithOneRefresh } from '../seats';\nimport { type SourceSeat, stillUnauthorizedSourceSeats } from '../sources-api';\nimport { shortHost } from '../ui';\nimport { persistProjectFields } from './publish';\n\nexport interface UseArgs {\n  host?: string;\n  /** Project directory (contains ekanos.json). Defaults to cwd. */\n  dir: string;\n  /** The source slug to switch this project's publish target to. */\n  slug?: string;\n  env: Record<string, string | undefined>;\n}\n\n/**\n * `use <source-slug>` — set this project's publish target, with the same\n * seat verification `publish` runs: the slug must name a source the caller\n * actually holds a seat on, so a project can never be pointed at a source by\n * a typo alone.\n *\n * Persisted via the exact same mechanics `publish` uses after a successful\n * submission (`persistProjectFields`), so `host` also sticks on first write\n * and a later `publish` needs neither flag.\n */\nexport async function runUse(\n  ctx: CliContext,\n  args: UseArgs,\n): Promise<ExitCode> {\n  if (!args.slug || args.slug.trim().length === 0) {\n    throw usageError(\n      'No source slug given.',\n      'Run \"ekanos use <source-slug>\" — see \"ekanos sources\" for the ' +\n        'slugs you hold a seat on.',\n    );\n  }\n\n  const slug = args.slug.trim();\n\n  // Requires a project up front: `use` sets ekanos.json's \"source\" field, so\n  // running it outside one is a precondition failure, not a network call.\n  const loaded = loadProject(args.dir);\n\n  const env = resolveAuthEnvironment(ctx, args.host, args.env, {\n    projectDir: args.dir,\n  });\n  const session = requireSession(env);\n\n  const result = await fetchSeatsWithOneRefresh(env, session);\n\n  if (result.status === 'unauthorized') {\n    stillUnauthorizedSourceSeats(env);\n  }\n\n  const seat = result.sources.find((s) => s.slug === slug);\n\n  if (!seat) {\n    throw forbiddenError(\n      `This account does not hold a seat on source \"${slug}\" on ${env.host}.`,\n      seatsHint(result.sources, env.host),\n    );\n  }\n\n  const persisted = persistProjectFields(loaded, seat.slug, env.host);\n\n  return ctx.succeed(\n    {\n      host: env.host,\n      source: {\n        id: seat.id,\n        slug: seat.slug,\n        name: seat.name,\n        roles: seat.roles,\n      },\n      sourcePersisted: persisted.source,\n      hostPersisted: persisted.host,\n    },\n    ctx.ui.result({\n      title: 'Publish target set',\n      rows: [\n        ['Source', seat.name ? `${seat.name} (${seat.slug})` : seat.slug],\n        ['Role', seat.roles.join(', ')],\n        ['Host', shortHost(env.host)],\n        ['Saved to', 'ekanos.json'],\n      ],\n    }),\n  );\n}\n\nfunction seatsHint(sources: SourceSeat[], host: string): string {\n  if (sources.length === 0) {\n    return (\n      `You hold no seats on any source on ${host}. Ask an Ekanos super-admin ` +\n      `to grant your account a seat on the intended source.`\n    );\n  }\n\n  const list = sources\n    .map((s) => `${s.slug} (${s.roles.join(', ')})`)\n    .join(', ');\n\n  return `You hold a seat on: ${list}. Run \"ekanos use <slug>\" with one of these.`;\n}\n"]}

package/dist/commands/whoami.js

@@ -23,7 +23,7 @@ export async function runWhoami(ctx, args) {
     const env = resolveAuthEnvironment(ctx, args.host, args.env, {
         projectDir: args.cwd,
     });
-    const stored = requireSession(env.store, env.host);
+    const stored = requireSession(env);
     const { identity, session } = await resolveIdentity(env, stored);
     const seats = await fetchSeatsQuietly(env, session);
     return ctx.succeed({

package/dist/commands/whoami.js.map

@@ -1 +1 @@
-{"version":3,"file":"whoami.js","sourceRoot":"","sources":["../../src/commands/whoami.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AASlC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAe,EACf,IAAgB;;IAEhB,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE;QAC3D,UAAU,EAAE,IAAI,CAAC,GAAG;KACrB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAEnD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAEjE,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEpD,OAAO,GAAG,CAAC,OAAO,CAChB;QACE,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE;YACJ,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB;QACD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ;QACnC,KAAK;KACN,EACD,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;QACZ,KAAK,EAAE,WAAW;QAClB,IAAI,EAAE;YACJ,CAAC,SAAS,QAAE,QAAQ,CAAC,KAAK,mCAAI,QAAQ,CAAC,EAAE,CAAC;YAC1C,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B;gBACE,OAAO;gBACP,KAAK;oBACH,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;wBAChB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvD,CAAC,CAAC,MAAM;oBACV,CAAC,CAAC,uBAAuB;aAC5B;SACF;KACF,CAAC,CACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAmD,EACnD,OAAuD;IAEvD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAE5D,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAExC,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;eAAO,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import {\n  requireSession,\n  resolveAuthEnvironment,\n  resolveIdentity,\n} from '../auth/session';\nimport type { CliContext } from '../context';\nimport type { ExitCode } from '../exit-codes';\nimport { fetchSeatsWithOneRefresh } from '../seats';\nimport { shortHost } from '../ui';\n\nexport interface WhoamiArgs {\n  host?: string;\n  /** Where a project's ekanos.json may sit, for its optional `host` field. */\n  cwd: string;\n  env: Record<string, string | undefined>;\n}\n\n/**\n * `whoami` — prove the stored session still authenticates against Ekanos.\n *\n * The identity is resolved server-side by `/api/auth/cli-whoami`, which reads\n * the account through RLS as the caller. Printing the locally cached email\n * would be a cheaper lie: it would keep saying \"logged in\" after the account\n * was deleted or the token revoked.\n *\n * Exit 4 (auth_required) when there is no session or it cannot be renewed —\n * the code a script should branch on to decide whether to run `ekanos login`.\n *\n * `seats` is a best-effort add-on from the same source-visibility endpoint\n * `ekanos sources` uses, compacted to slug+roles. Its failure — network, MFA,\n * a deployment that predates the route — must never turn a working `whoami`\n * into a failing one, so any error here degrades to `seats: null` rather than\n * propagating.\n */\nexport async function runWhoami(\n  ctx: CliContext,\n  args: WhoamiArgs,\n): Promise<ExitCode> {\n  const env = resolveAuthEnvironment(ctx, args.host, args.env, {\n    projectDir: args.cwd,\n  });\n  const stored = requireSession(env.store, env.host);\n\n  const { identity, session } = await resolveIdentity(env, stored);\n\n  const seats = await fetchSeatsQuietly(env, session);\n\n  return ctx.succeed(\n    {\n      host: env.host,\n      user: {\n        id: identity.id,\n        email: identity.email,\n        name: identity.name,\n      },\n      expiresAt: session.expiresAt,\n      credentialsPath: env.store.filePath,\n      seats,\n    },\n    ctx.ui.result({\n      title: 'Signed in',\n      rows: [\n        ['Account', identity.email ?? identity.id],\n        ['Host', shortHost(env.host)],\n        [\n          'Seats',\n          seats\n            ? seats.length > 0\n              ? seats.map((s) => `${s.slug} · ${s.roles.join(', ')}`)\n              : 'none'\n            : 'unavailable right now',\n        ],\n      ],\n    }),\n  );\n}\n\nasync function fetchSeatsQuietly(\n  env: Parameters<typeof fetchSeatsWithOneRefresh>[0],\n  session: Parameters<typeof fetchSeatsWithOneRefresh>[1],\n): Promise<{ slug: string; roles: string[] }[] | null> {\n  try {\n    const result = await fetchSeatsWithOneRefresh(env, session);\n\n    if (result.status !== 'ok') return null;\n\n    return result.sources.map((s) => ({ slug: s.slug, roles: s.roles }));\n  } catch {\n    return null;\n  }\n}\n"]}
+{"version":3,"file":"whoami.js","sourceRoot":"","sources":["../../src/commands/whoami.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AASlC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAe,EACf,IAAgB;;IAEhB,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE;QAC3D,UAAU,EAAE,IAAI,CAAC,GAAG;KACrB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAEnC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAEjE,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEpD,OAAO,GAAG,CAAC,OAAO,CAChB;QACE,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE;YACJ,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB;QACD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ;QACnC,KAAK;KACN,EACD,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;QACZ,KAAK,EAAE,WAAW;QAClB,IAAI,EAAE;YACJ,CAAC,SAAS,QAAE,QAAQ,CAAC,KAAK,mCAAI,QAAQ,CAAC,EAAE,CAAC;YAC1C,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B;gBACE,OAAO;gBACP,KAAK;oBACH,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;wBAChB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvD,CAAC,CAAC,MAAM;oBACV,CAAC,CAAC,uBAAuB;aAC5B;SACF;KACF,CAAC,CACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAmD,EACnD,OAAuD;IAEvD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAE5D,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAExC,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;eAAO,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import {\n  requireSession,\n  resolveAuthEnvironment,\n  resolveIdentity,\n} from '../auth/session';\nimport type { CliContext } from '../context';\nimport type { ExitCode } from '../exit-codes';\nimport { fetchSeatsWithOneRefresh } from '../seats';\nimport { shortHost } from '../ui';\n\nexport interface WhoamiArgs {\n  host?: string;\n  /** Where a project's ekanos.json may sit, for its optional `host` field. */\n  cwd: string;\n  env: Record<string, string | undefined>;\n}\n\n/**\n * `whoami` — prove the stored session still authenticates against Ekanos.\n *\n * The identity is resolved server-side by `/api/auth/cli-whoami`, which reads\n * the account through RLS as the caller. Printing the locally cached email\n * would be a cheaper lie: it would keep saying \"logged in\" after the account\n * was deleted or the token revoked.\n *\n * Exit 4 (auth_required) when there is no session or it cannot be renewed —\n * the code a script should branch on to decide whether to run `ekanos login`.\n *\n * `seats` is a best-effort add-on from the same source-visibility endpoint\n * `ekanos sources` uses, compacted to slug+roles. Its failure — network, MFA,\n * a deployment that predates the route — must never turn a working `whoami`\n * into a failing one, so any error here degrades to `seats: null` rather than\n * propagating.\n */\nexport async function runWhoami(\n  ctx: CliContext,\n  args: WhoamiArgs,\n): Promise<ExitCode> {\n  const env = resolveAuthEnvironment(ctx, args.host, args.env, {\n    projectDir: args.cwd,\n  });\n  const stored = requireSession(env);\n\n  const { identity, session } = await resolveIdentity(env, stored);\n\n  const seats = await fetchSeatsQuietly(env, session);\n\n  return ctx.succeed(\n    {\n      host: env.host,\n      user: {\n        id: identity.id,\n        email: identity.email,\n        name: identity.name,\n      },\n      expiresAt: session.expiresAt,\n      credentialsPath: env.store.filePath,\n      seats,\n    },\n    ctx.ui.result({\n      title: 'Signed in',\n      rows: [\n        ['Account', identity.email ?? identity.id],\n        ['Host', shortHost(env.host)],\n        [\n          'Seats',\n          seats\n            ? seats.length > 0\n              ? seats.map((s) => `${s.slug} · ${s.roles.join(', ')}`)\n              : 'none'\n            : 'unavailable right now',\n        ],\n      ],\n    }),\n  );\n}\n\nasync function fetchSeatsQuietly(\n  env: Parameters<typeof fetchSeatsWithOneRefresh>[0],\n  session: Parameters<typeof fetchSeatsWithOneRefresh>[1],\n): Promise<{ slug: string; roles: string[] }[] | null> {\n  try {\n    const result = await fetchSeatsWithOneRefresh(env, session);\n\n    if (result.status !== 'ok') return null;\n\n    return result.sources.map((s) => ({ slug: s.slug, roles: s.roles }));\n  } catch {\n    return null;\n  }\n}\n"]}

package/dist/connections-api.js

@@ -106,7 +106,7 @@ async function call(host, accessToken, schema, product, init) {
     }
     if (response.status === 404) {
         throw notFoundError(message !== null && message !== void 0 ? message : `"${product !== null && product !== void 0 ? product : 'the Source'}" was not found.`, code === 'PRODUCT_NOT_ENTITLED'
-            ? '"ekanos catalog" lists what this Source has; Ekanos enables a product for a Source.'
+            ? '"ekanos sources products" shows what this Source has; only a super-admin enables a product for a Source (in /admin).'
             : 'Run "ekanos sources" to list the sources you hold a seat on.');
     }
     if (response.status === 409 && code === 'NO_SOURCE_CONNECTION') {

package/dist/connections-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"connections-api.js","sourceRoot":"","sources":["../src/connections-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,UAAU,GACX,MAAM,UAAU,CAAC;AAElB;;;;;;;;;;;;GAYG;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,KAAK,CACb,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;QACtB,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC,CACH;IACD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAGH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,MAAM,EAAE,eAAe;IACvB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;CAC7C,CAAC,CAAC;AACH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,MAAM,EAAE,eAAe;IACvB,UAAU,EAAE,sBAAsB;IAClC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,MAAM,EAAE,eAAe;IACvB,UAAU,EAAE,sBAAsB;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAc5D,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa,EAAE,MAAc;IACzE,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;QACzC,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,4BAA4B,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;KACpE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,KAAa,EACb,MAAc,EACd,OAAe;IAEf,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE;QAC5C,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,KAAa,EACb,IAA0E;IAE1E,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE;QACpD,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;QACzB,IAAI,kBACF,MAAM,EAAE,IAAI,CAAC,MAAM,IAChB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAChD;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,KAAa,EACb,MAAc,EACd,OAAe;IAEf,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE;QAClD,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAC,OAAe;IAC5B,OAAO,4BAA4B,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;AACnE,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,IAAY,EACZ,WAAmB,EACnB,MAAoB,EACpB,OAAsB,EACtB,IAAyE;IAEzE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE;QACpD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,kBACL,MAAM,EAAE,kBAAkB,EAC1B,aAAa,EAAE,UAAU,WAAW,EAAE,IACnC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YACzB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAC5C;QACD,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;KACtE,CAAC,CAAC;IAEH,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;QACvB,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,EACjD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,OAAO,GACX,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAEnE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QACvD,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,GAAG,IAAI,wCAAwC,EAC1D,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,cAAc,CAClB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,IAAI,KAAK,uBAAuB;YAC9B,CAAC,CAAC,0EAA0E;YAC5E,CAAC,CAAC,8DAA8D,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,aAAa,CACjB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,IAAI,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,YAAY,kBAAkB,EACxD,IAAI,KAAK,sBAAsB;YAC7B,CAAC,CAAC,qFAAqF;YACvF,CAAC,CAAC,8DAA8D,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;QAC/D,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,OAAO,EACL,OAAO,aAAP,OAAO,cAAP,OAAO,GACP,IAAI,OAAO,mDAAmD;SACjE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjE,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;gBAClC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBAChE,CAAC,CAAC,EAAE;YACN,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;SAChD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,UAAU,CACd,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,QAAQ,CAAC,MAAM,GAAG,EACjE,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,+DAA+D;YACjE,CAAC,CAAC,gFAAgF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,YAAY,CAChB,GAAG,IAAI,sEAAsE,EAC7E,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;eAAO,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { request } from './auth/ekanos-api';\nimport {\n  authRequiredError,\n  forbiddenError,\n  invalidStateError,\n  networkError,\n  notFoundError,\n  usageError,\n} from './errors';\n\n/**\n * The CLI's client for a Source's connections (plan 241): an integration a\n * Source admin connects ONCE for the whole Source, used by the Source's\n * provided agents in every team whose template marks it `owner: \"source\"`.\n *\n *   GET    /api/partner/connections?source=<slug|id>\n *   GET    /api/partner/connections/<product>?source=<slug|id>\n *   POST   /api/partner/connections/<product>  { source, fields? }  → authorizeUrl\n *   DELETE /api/partner/connections/<product>?source=<slug|id>\n *\n * The shapes are read here rather than from `@ekanos/integration-schema`, so\n * this CLI works against a host without a schema release.\n */\n\nconst SourceRefSchema = z.object({\n  id: z.string(),\n  slug: z.string(),\n  name: z.string().nullable(),\n});\n\nexport const SourceConnectionSchema = z.object({\n  slug: z.string(),\n  name: z.string(),\n  connected: z.boolean(),\n  connectedBy: z.string().nullable(),\n  connectedAt: z.string().nullable(),\n  scope: z.string().nullable(),\n  app: z.enum(['source-app', 'fields']),\n  fields: z.array(\n    z.object({\n      name: z.string(),\n      label: z.string(),\n      description: z.string().nullable(),\n      sensitive: z.boolean(),\n      set: z.boolean(),\n      value: z.string().nullable(),\n    }),\n  ),\n  missing: z.array(z.string()),\n});\nexport type SourceConnection = z.infer<typeof SourceConnectionSchema>;\n\nconst ListSchema = z.object({\n  source: SourceRefSchema,\n  connections: z.array(SourceConnectionSchema),\n});\nconst ShowSchema = z.object({\n  source: SourceRefSchema,\n  connection: SourceConnectionSchema,\n  callbackUrls: z.array(z.string()),\n});\nconst ConnectSchema = z.object({\n  source: SourceRefSchema,\n  connection: SourceConnectionSchema,\n  authorizeUrl: z.string(),\n  callbackUrl: z.string(),\n});\nconst DisconnectSchema = z.object({ removed: z.boolean() });\n\nexport type ConnectionsApiResult<T> =\n  | { status: 'ok'; data: T }\n  | { status: 'unauthorized' }\n  /** The integration supports no Source connection (409 NO_SOURCE_CONNECTION). */\n  | { status: 'unsupported'; message: string }\n  /** App fields are still missing (409 NOT_CONFIGURED). */\n  | {\n      status: 'not-configured';\n      missing: string[];\n      connection: SourceConnection | null;\n    };\n\nexport function listConnections(host: string, token: string, source: string) {\n  return call(host, token, ListSchema, null, {\n    method: 'GET',\n    path: `/api/partner/connections?${new URLSearchParams({ source })}`,\n  });\n}\n\nexport function showConnection(\n  host: string,\n  token: string,\n  source: string,\n  product: string,\n) {\n  return call(host, token, ShowSchema, product, {\n    method: 'GET',\n    path: `${route(product)}?${new URLSearchParams({ source })}`,\n  });\n}\n\nexport function startConnection(\n  host: string,\n  token: string,\n  body: { source: string; product: string; fields?: Record<string, string> },\n) {\n  return call(host, token, ConnectSchema, body.product, {\n    method: 'POST',\n    path: route(body.product),\n    body: {\n      source: body.source,\n      ...(body.fields ? { fields: body.fields } : {}),\n    },\n  });\n}\n\nexport function deleteConnection(\n  host: string,\n  token: string,\n  source: string,\n  product: string,\n) {\n  return call(host, token, DisconnectSchema, product, {\n    method: 'DELETE',\n    path: `${route(product)}?${new URLSearchParams({ source })}`,\n  });\n}\n\nfunction route(product: string): string {\n  return `/api/partner/connections/${encodeURIComponent(product)}`;\n}\n\nasync function call<T>(\n  host: string,\n  accessToken: string,\n  schema: z.ZodType<T>,\n  product: string | null,\n  init: { method: 'GET' | 'POST' | 'DELETE'; path: string; body?: unknown },\n): Promise<ConnectionsApiResult<T>> {\n  const response = await request(`${host}${init.path}`, {\n    method: init.method,\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${accessToken}`,\n      ...(init.body === undefined\n        ? {}\n        : { 'content-type': 'application/json' }),\n    },\n    body: init.body === undefined ? undefined : JSON.stringify(init.body),\n  });\n\n  if (\n    response.status === 401 ||\n    (response.status >= 300 && response.status < 400)\n  ) {\n    return { status: 'unauthorized' };\n  }\n\n  const body = await readOptionalJson(response);\n  const code = typeof body.code === 'string' ? body.code : null;\n  const message =\n    typeof body.error === 'string' && body.error ? body.error : null;\n\n  if (response.status === 403 && code === 'MFA_REQUIRED') {\n    throw authRequiredError(\n      message ?? `${host} requires multi-factor authentication.`,\n      'Complete MFA in the browser, then run \"ekanos login\" again.',\n    );\n  }\n  if (response.status === 403) {\n    throw forbiddenError(\n      message ?? 'Not permitted on this Source.',\n      code === 'SOURCE_ADMIN_REQUIRED'\n        ? \"Only a Source admin manages the Source's connections. Ask one to run it.\"\n        : 'Run \"ekanos sources\" to list the sources you hold a seat on.',\n    );\n  }\n  if (response.status === 404) {\n    throw notFoundError(\n      message ?? `\"${product ?? 'the Source'}\" was not found.`,\n      code === 'PRODUCT_NOT_ENTITLED'\n        ? '\"ekanos catalog\" lists what this Source has; Ekanos enables a product for a Source.'\n        : 'Run \"ekanos sources\" to list the sources you hold a seat on.',\n    );\n  }\n  if (response.status === 409 && code === 'NO_SOURCE_CONNECTION') {\n    return {\n      status: 'unsupported',\n      message:\n        message ??\n        `\"${product}\" does not support one connection for the Source.`,\n    };\n  }\n  if (response.status === 409 && code === 'NOT_CONFIGURED') {\n    const parsed = SourceConnectionSchema.safeParse(body.connection);\n    return {\n      status: 'not-configured',\n      missing: Array.isArray(body.missing)\n        ? body.missing.filter((n): n is string => typeof n === 'string')\n        : [],\n      connection: parsed.success ? parsed.data : null,\n    };\n  }\n  if (response.status === 400) {\n    throw usageError(\n      message ?? 'The host refused the request.',\n      'See \"ekanos apps --help\".',\n    );\n  }\n  if (response.status === 409) {\n    throw invalidStateError(message ?? 'The host refused the request.', '');\n  }\n  if (!response.ok) {\n    throw networkError(\n      `${host}${init.path.split('?')[0]} responded ${response.status}.`,\n      response.status >= 500\n        ? 'The Ekanos deployment returned a server error. Retry shortly.'\n        : 'Confirm the host runs a build that includes the connections routes (plan 241).',\n    );\n  }\n\n  const parsed = schema.safeParse(body.data);\n  if (!parsed.success) {\n    throw networkError(\n      `${host}/api/partner/connections answered in a shape this CLI does not read.`,\n      'Run \"ekanos upgrade\" — the CLI and the host disagree on the connections contract.',\n    );\n  }\n  return { status: 'ok', data: parsed.data };\n}\n\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n"]}
+{"version":3,"file":"connections-api.js","sourceRoot":"","sources":["../src/connections-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,UAAU,GACX,MAAM,UAAU,CAAC;AAElB;;;;;;;;;;;;GAYG;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,KAAK,CACb,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;QACtB,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC,CACH;IACD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAGH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,MAAM,EAAE,eAAe;IACvB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;CAC7C,CAAC,CAAC;AACH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,MAAM,EAAE,eAAe;IACvB,UAAU,EAAE,sBAAsB;IAClC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,MAAM,EAAE,eAAe;IACvB,UAAU,EAAE,sBAAsB;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAc5D,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa,EAAE,MAAc;IACzE,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;QACzC,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,4BAA4B,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;KACpE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,KAAa,EACb,MAAc,EACd,OAAe;IAEf,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE;QAC5C,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,KAAa,EACb,IAA0E;IAE1E,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE;QACpD,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;QACzB,IAAI,kBACF,MAAM,EAAE,IAAI,CAAC,MAAM,IAChB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAChD;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,KAAa,EACb,MAAc,EACd,OAAe;IAEf,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE;QAClD,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAC,OAAe;IAC5B,OAAO,4BAA4B,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;AACnE,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,IAAY,EACZ,WAAmB,EACnB,MAAoB,EACpB,OAAsB,EACtB,IAAyE;IAEzE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE;QACpD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,kBACL,MAAM,EAAE,kBAAkB,EAC1B,aAAa,EAAE,UAAU,WAAW,EAAE,IACnC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YACzB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAC5C;QACD,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;KACtE,CAAC,CAAC;IAEH,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;QACvB,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,EACjD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,OAAO,GACX,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAEnE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QACvD,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,GAAG,IAAI,wCAAwC,EAC1D,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,cAAc,CAClB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,IAAI,KAAK,uBAAuB;YAC9B,CAAC,CAAC,0EAA0E;YAC5E,CAAC,CAAC,8DAA8D,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,aAAa,CACjB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,IAAI,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,YAAY,kBAAkB,EACxD,IAAI,KAAK,sBAAsB;YAC7B,CAAC,CAAC,sHAAsH;YACxH,CAAC,CAAC,8DAA8D,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;QAC/D,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,OAAO,EACL,OAAO,aAAP,OAAO,cAAP,OAAO,GACP,IAAI,OAAO,mDAAmD;SACjE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjE,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;gBAClC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBAChE,CAAC,CAAC,EAAE;YACN,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;SAChD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,UAAU,CACd,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,QAAQ,CAAC,MAAM,GAAG,EACjE,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,+DAA+D;YACjE,CAAC,CAAC,gFAAgF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,YAAY,CAChB,GAAG,IAAI,sEAAsE,EAC7E,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;eAAO,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { request } from './auth/ekanos-api';\nimport {\n  authRequiredError,\n  forbiddenError,\n  invalidStateError,\n  networkError,\n  notFoundError,\n  usageError,\n} from './errors';\n\n/**\n * The CLI's client for a Source's connections (plan 241): an integration a\n * Source admin connects ONCE for the whole Source, used by the Source's\n * provided agents in every team whose template marks it `owner: \"source\"`.\n *\n *   GET    /api/partner/connections?source=<slug|id>\n *   GET    /api/partner/connections/<product>?source=<slug|id>\n *   POST   /api/partner/connections/<product>  { source, fields? }  → authorizeUrl\n *   DELETE /api/partner/connections/<product>?source=<slug|id>\n *\n * The shapes are read here rather than from `@ekanos/integration-schema`, so\n * this CLI works against a host without a schema release.\n */\n\nconst SourceRefSchema = z.object({\n  id: z.string(),\n  slug: z.string(),\n  name: z.string().nullable(),\n});\n\nexport const SourceConnectionSchema = z.object({\n  slug: z.string(),\n  name: z.string(),\n  connected: z.boolean(),\n  connectedBy: z.string().nullable(),\n  connectedAt: z.string().nullable(),\n  scope: z.string().nullable(),\n  app: z.enum(['source-app', 'fields']),\n  fields: z.array(\n    z.object({\n      name: z.string(),\n      label: z.string(),\n      description: z.string().nullable(),\n      sensitive: z.boolean(),\n      set: z.boolean(),\n      value: z.string().nullable(),\n    }),\n  ),\n  missing: z.array(z.string()),\n});\nexport type SourceConnection = z.infer<typeof SourceConnectionSchema>;\n\nconst ListSchema = z.object({\n  source: SourceRefSchema,\n  connections: z.array(SourceConnectionSchema),\n});\nconst ShowSchema = z.object({\n  source: SourceRefSchema,\n  connection: SourceConnectionSchema,\n  callbackUrls: z.array(z.string()),\n});\nconst ConnectSchema = z.object({\n  source: SourceRefSchema,\n  connection: SourceConnectionSchema,\n  authorizeUrl: z.string(),\n  callbackUrl: z.string(),\n});\nconst DisconnectSchema = z.object({ removed: z.boolean() });\n\nexport type ConnectionsApiResult<T> =\n  | { status: 'ok'; data: T }\n  | { status: 'unauthorized' }\n  /** The integration supports no Source connection (409 NO_SOURCE_CONNECTION). */\n  | { status: 'unsupported'; message: string }\n  /** App fields are still missing (409 NOT_CONFIGURED). */\n  | {\n      status: 'not-configured';\n      missing: string[];\n      connection: SourceConnection | null;\n    };\n\nexport function listConnections(host: string, token: string, source: string) {\n  return call(host, token, ListSchema, null, {\n    method: 'GET',\n    path: `/api/partner/connections?${new URLSearchParams({ source })}`,\n  });\n}\n\nexport function showConnection(\n  host: string,\n  token: string,\n  source: string,\n  product: string,\n) {\n  return call(host, token, ShowSchema, product, {\n    method: 'GET',\n    path: `${route(product)}?${new URLSearchParams({ source })}`,\n  });\n}\n\nexport function startConnection(\n  host: string,\n  token: string,\n  body: { source: string; product: string; fields?: Record<string, string> },\n) {\n  return call(host, token, ConnectSchema, body.product, {\n    method: 'POST',\n    path: route(body.product),\n    body: {\n      source: body.source,\n      ...(body.fields ? { fields: body.fields } : {}),\n    },\n  });\n}\n\nexport function deleteConnection(\n  host: string,\n  token: string,\n  source: string,\n  product: string,\n) {\n  return call(host, token, DisconnectSchema, product, {\n    method: 'DELETE',\n    path: `${route(product)}?${new URLSearchParams({ source })}`,\n  });\n}\n\nfunction route(product: string): string {\n  return `/api/partner/connections/${encodeURIComponent(product)}`;\n}\n\nasync function call<T>(\n  host: string,\n  accessToken: string,\n  schema: z.ZodType<T>,\n  product: string | null,\n  init: { method: 'GET' | 'POST' | 'DELETE'; path: string; body?: unknown },\n): Promise<ConnectionsApiResult<T>> {\n  const response = await request(`${host}${init.path}`, {\n    method: init.method,\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${accessToken}`,\n      ...(init.body === undefined\n        ? {}\n        : { 'content-type': 'application/json' }),\n    },\n    body: init.body === undefined ? undefined : JSON.stringify(init.body),\n  });\n\n  if (\n    response.status === 401 ||\n    (response.status >= 300 && response.status < 400)\n  ) {\n    return { status: 'unauthorized' };\n  }\n\n  const body = await readOptionalJson(response);\n  const code = typeof body.code === 'string' ? body.code : null;\n  const message =\n    typeof body.error === 'string' && body.error ? body.error : null;\n\n  if (response.status === 403 && code === 'MFA_REQUIRED') {\n    throw authRequiredError(\n      message ?? `${host} requires multi-factor authentication.`,\n      'Complete MFA in the browser, then run \"ekanos login\" again.',\n    );\n  }\n  if (response.status === 403) {\n    throw forbiddenError(\n      message ?? 'Not permitted on this Source.',\n      code === 'SOURCE_ADMIN_REQUIRED'\n        ? \"Only a Source admin manages the Source's connections. Ask one to run it.\"\n        : 'Run \"ekanos sources\" to list the sources you hold a seat on.',\n    );\n  }\n  if (response.status === 404) {\n    throw notFoundError(\n      message ?? `\"${product ?? 'the Source'}\" was not found.`,\n      code === 'PRODUCT_NOT_ENTITLED'\n        ? '\"ekanos sources products\" shows what this Source has; only a super-admin enables a product for a Source (in /admin).'\n        : 'Run \"ekanos sources\" to list the sources you hold a seat on.',\n    );\n  }\n  if (response.status === 409 && code === 'NO_SOURCE_CONNECTION') {\n    return {\n      status: 'unsupported',\n      message:\n        message ??\n        `\"${product}\" does not support one connection for the Source.`,\n    };\n  }\n  if (response.status === 409 && code === 'NOT_CONFIGURED') {\n    const parsed = SourceConnectionSchema.safeParse(body.connection);\n    return {\n      status: 'not-configured',\n      missing: Array.isArray(body.missing)\n        ? body.missing.filter((n): n is string => typeof n === 'string')\n        : [],\n      connection: parsed.success ? parsed.data : null,\n    };\n  }\n  if (response.status === 400) {\n    throw usageError(\n      message ?? 'The host refused the request.',\n      'See \"ekanos apps --help\".',\n    );\n  }\n  if (response.status === 409) {\n    throw invalidStateError(message ?? 'The host refused the request.', '');\n  }\n  if (!response.ok) {\n    throw networkError(\n      `${host}${init.path.split('?')[0]} responded ${response.status}.`,\n      response.status >= 500\n        ? 'The Ekanos deployment returned a server error. Retry shortly.'\n        : 'Confirm the host runs a build that includes the connections routes (plan 241).',\n    );\n  }\n\n  const parsed = schema.safeParse(body.data);\n  if (!parsed.success) {\n    throw networkError(\n      `${host}/api/partner/connections answered in a shape this CLI does not read.`,\n      'Run \"ekanos upgrade\" — the CLI and the host disagree on the connections contract.',\n    );\n  }\n  return { status: 'ok', data: parsed.data };\n}\n\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n"]}

package/dist/delegate.js

@@ -10,17 +10,24 @@ import { readInstalledPackageManifest } from './harness-scaffold.js';
  * routinely serves N projects on different `@ekanos/sdk` versions — it
  * cannot be correct for all of them simultaneously (this is exactly the
  * failure mode `schema-skew.ts` detects). Delegation dissolves the tension:
- * `ekanos` stays on PATH for convenience, but the four verbs that actually
- * read or generate project files always run through the project's OWN
- * pinned copy when one is installed and differs from the invoked binary.
+ * `ekanos` stays on PATH for convenience, but the three verbs that read or
+ * generate project files and run its code anyway always run through the
+ * project's OWN pinned copy when one is installed and differs from the
+ * invoked binary.
  *
  * Machine-level verbs (`init`, `login`, `logout`, `whoami`, `sources`,
  * `use`, `status`, `upgrade`) are deliberately NEVER delegated: you never
  * want an old local copy handling credentials, and `upgrade` must always be
  * the newest logic doing the upgrading — delegating it could have an old CLI
  * "upgrade" a project using its own out-of-date resolution.
+ *
+ * `publish` is never delegated either. It sends the person's bearer token to
+ * the host, and `node_modules/@ekanos/cli` is whatever the project's lockfile
+ * (or anyone who can write to `node_modules`) put there — a copy that would
+ * be handed the token without ever being installed by the person. It runs on
+ * the binary they invoked.
  */
-const DELEGATABLE_VERBS = new Set(['validate', 'publish', 'dev', 'test']);
+const DELEGATABLE_VERBS = new Set(['validate', 'dev', 'test']);
 /** The first bare (non-flag) token before a standalone `--` — mirrors `splitCommand` in `index.ts`. */
 function firstCommand(argv) {
     for (const token of argv) {

package/dist/delegate.js.map

@@ -1 +1 @@
-{"version":3,"file":"delegate.js","sourceRoot":"","sources":["../src/delegate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAElE;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAU1E,uGAAuG;AACvG,SAAS,YAAY,CAAC,IAAuB;IAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM;QAC1B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iEAAiE;AACjE,SAAS,WAAW,CAAC,IAAuB;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM;QAC1B,IAAI,KAAK,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAuB,EACvB,GAAuC,EACvC,GAAW;;IAEX,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;IAEhC,yEAAyE;IACzE,IAAI,GAAG,CAAC,gBAAgB,KAAK,GAAG,IAAI,GAAG,CAAC,kBAAkB,KAAK,GAAG,EAAE,CAAC;QACnE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,QAAE,WAAW,CAAC,IAAI,CAAC,mCAAI,GAAG,CAAC,CAAC;IAC/D,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,oEAAoE;IACpE,mEAAmE;IACnE,IAAI,KAAK,GAAoD,IAAI,CAAC;IAClE,IAAI,CAAC;QACH,KAAK,GAAG,4BAA4B,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAClE,CAAC;eAAO,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3C,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,EAAE,CAAC;IAC7E,CAAC;IAED,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,UAAU;QACV,YAAY,EAAE,KAAK,CAAC,OAAO;QAC3B,YAAY,EAAE,IAAI,CAAC,IAAI,CACrB,UAAU,EACV,cAAc,EACd,SAAS,EACT,KAAK,EACL,MAAM,EACN,QAAQ,CACT;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CACxB,IAAuB,EACvB,GAAuC,EACvC,WAAoB;IAEpB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM;QAC1B,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,KAAK,KAAK,WAAW;YAAE,OAAO,KAAK,CAAC;IAC1C,CAAC;IACD,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAoB,EACpB,IAAuB,EACvB,GAAuC,EACvC,WAAoB;IAEpB,IAAI,CAAC,IAAI,CAAC,cAAc;QAAE,OAAO;IACjC,IAAI,iBAAiB,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC;QAAE,OAAO;IAEtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2CAA2C,IAAI,CAAC,YAAY,YAAY;QACtE,GAAG,IAAI,CAAC,UAAU,0CAA0C,CAC/D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CACtB,IAAoB,EACpB,IAAuB,EACvB,GAAsB,EACtB,OAAO,GAAiB,KAAK;IAE7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,YAAa,EAAE,GAAG,IAAI,CAAC,EAAE;YACrE,KAAK,EAAE,SAAS;YAChB,GAAG,kCAAO,GAAG,KAAE,gBAAgB,EAAE,GAAG,GAAE;SACvC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { spawn } from 'node:child_process';\nimport * as path from 'node:path';\n\nimport { cliVersion } from './compatibility';\nimport { readInstalledPackageManifest } from './harness-scaffold';\n\n/**\n * Wrapper-style delegation to the project-local `@ekanos/cli` — the\n * Gradle-wrapper / Yarn / `npx` pattern, applied to this CLI.\n *\n * A global install bundles ONE `@ekanos/integration-schema` version but\n * routinely serves N projects on different `@ekanos/sdk` versions — it\n * cannot be correct for all of them simultaneously (this is exactly the\n * failure mode `schema-skew.ts` detects). Delegation dissolves the tension:\n * `ekanos` stays on PATH for convenience, but the four verbs that actually\n * read or generate project files always run through the project's OWN\n * pinned copy when one is installed and differs from the invoked binary.\n *\n * Machine-level verbs (`init`, `login`, `logout`, `whoami`, `sources`,\n * `use`, `status`, `upgrade`) are deliberately NEVER delegated: you never\n * want an old local copy handling credentials, and `upgrade` must always be\n * the newest logic doing the upgrading — delegating it could have an old CLI\n * \"upgrade\" a project using its own out-of-date resolution.\n */\n\nconst DELEGATABLE_VERBS = new Set(['validate', 'publish', 'dev', 'test']);\n\nexport interface DelegationPlan {\n  shouldDelegate: boolean;\n  ownVersion: string;\n  localVersion?: string;\n  /** Absolute path to the local CLI's bin entry, when `shouldDelegate`. */\n  localBinPath?: string;\n}\n\n/** The first bare (non-flag) token before a standalone `--` — mirrors `splitCommand` in `index.ts`. */\nfunction firstCommand(argv: readonly string[]): string | null {\n  for (const token of argv) {\n    if (token === '--') break;\n    if (!token.startsWith('-')) return token;\n  }\n  return null;\n}\n\n/** `--dir <path>` / `--dir=<path>`, before a standalone `--`. */\nfunction scanDirFlag(argv: readonly string[]): string | undefined {\n  for (let i = 0; i < argv.length; i++) {\n    const token = argv[i]!;\n    if (token === '--') break;\n    if (token === '--dir') return argv[i + 1];\n    if (token.startsWith('--dir=')) return token.slice('--dir='.length);\n  }\n  return undefined;\n}\n\n/**\n * Decide whether this invocation should delegate. Pure and side-effect-free\n * (beyond the one file read of the local `@ekanos/cli` manifest, mirroring\n * `readInstalledHarness`/`dev`'s own project-package resolution rather than\n * writing a second one) so it is directly testable without spawning anything.\n */\nexport function planDelegation(\n  argv: readonly string[],\n  env: Record<string, string | undefined>,\n  cwd: string,\n): DelegationPlan {\n  const ownVersion = cliVersion();\n\n  // The recursion guard, and the explicit escape hatch, both win outright.\n  if (env.EKANOS_DELEGATED === '1' || env.EKANOS_NO_DELEGATE === '1') {\n    return { shouldDelegate: false, ownVersion };\n  }\n\n  const command = firstCommand(argv);\n  if (!command || !DELEGATABLE_VERBS.has(command)) {\n    return { shouldDelegate: false, ownVersion };\n  }\n\n  const projectDir = path.resolve(cwd, scanDirFlag(argv) ?? '.');\n  // Best-effort, like every other resolution this function does: a corrupt\n  // local manifest must fall through to \"don't delegate\", never throw. This\n  // runs in `bin.ts` BEFORE `run()`'s try/catch exists, so an uncaught throw\n  // here would bypass the JSON-envelope error machinery entirely and print a\n  // raw stderr string instead — a real regression in the \"exactly one\n  // terminal emission\" contract the rest of this package guarantees.\n  let local: ReturnType<typeof readInstalledPackageManifest> = null;\n  try {\n    local = readInstalledPackageManifest(projectDir, '@ekanos/cli');\n  } catch {\n    local = null;\n  }\n\n  if (!local || local.version === ownVersion) {\n    return { shouldDelegate: false, ownVersion, localVersion: local?.version };\n  }\n\n  return {\n    shouldDelegate: true,\n    ownVersion,\n    localVersion: local.version,\n    localBinPath: path.join(\n      projectDir,\n      'node_modules',\n      '@ekanos',\n      'cli',\n      'dist',\n      'bin.js',\n    ),\n  };\n}\n\n/**\n * Same JSON-mode inference `CliContext` uses (`context.ts`) — duplicated\n * deliberately rather than shared, because this runs BEFORE a `CliContext`\n * exists (delegation is decided ahead of the whole `run()` machinery). Keep\n * this in sync with `CliContext`'s constructor if that heuristic ever\n * changes: an explicit `--json`/`--no-json` wins, otherwise a non-TTY stdout\n * or `CLAUDECODE=1` means JSON mode.\n */\nfunction looksLikeJsonMode(\n  argv: readonly string[],\n  env: Record<string, string | undefined>,\n  stdoutIsTTY: boolean,\n): boolean {\n  for (const token of argv) {\n    if (token === '--') break;\n    if (token === '--json') return true;\n    if (token === '--no-json') return false;\n  }\n  return !stdoutIsTTY || env.CLAUDECODE === '1';\n}\n\n/**\n * The one-line stderr announcement — human mode only, and NEVER on stdout\n * (a delegated `validate --json` must still emit exactly one JSON object on\n * stdout, from the CHILD, with nothing of ours ahead of it).\n */\nexport function announceDelegation(\n  plan: DelegationPlan,\n  argv: readonly string[],\n  env: Record<string, string | undefined>,\n  stdoutIsTTY: boolean,\n): void {\n  if (!plan.shouldDelegate) return;\n  if (looksLikeJsonMode(argv, env, stdoutIsTTY)) return;\n\n  process.stderr.write(\n    `ekanos: using this project's pinned CLI ${plan.localVersion} (global: ` +\n      `${plan.ownVersion}). Set EKANOS_NO_DELEGATE=1 to bypass.\\n`,\n  );\n}\n\n/**\n * Spawn the local CLI's own bin entry with the SAME node executable,\n * `stdio: 'inherit'` so the JSON envelope and banner gating are\n * byte-identical to a direct run, and propagate its exit code exactly.\n * `spawnFn` is injectable so tests never actually fork a process.\n */\nexport function delegate(\n  plan: DelegationPlan,\n  argv: readonly string[],\n  env: NodeJS.ProcessEnv,\n  spawnFn: typeof spawn = spawn,\n): Promise<number> {\n  return new Promise((resolve) => {\n    const child = spawnFn(process.execPath, [plan.localBinPath!, ...argv], {\n      stdio: 'inherit',\n      env: { ...env, EKANOS_DELEGATED: '1' },\n    });\n    child.on('error', () => resolve(1));\n    child.on('exit', (code) => resolve(code ?? 1));\n  });\n}\n"]}
+{"version":3,"file":"delegate.js","sourceRoot":"","sources":["../src/delegate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAU/D,uGAAuG;AACvG,SAAS,YAAY,CAAC,IAAuB;IAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM;QAC1B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iEAAiE;AACjE,SAAS,WAAW,CAAC,IAAuB;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM;QAC1B,IAAI,KAAK,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAuB,EACvB,GAAuC,EACvC,GAAW;;IAEX,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;IAEhC,yEAAyE;IACzE,IAAI,GAAG,CAAC,gBAAgB,KAAK,GAAG,IAAI,GAAG,CAAC,kBAAkB,KAAK,GAAG,EAAE,CAAC;QACnE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,QAAE,WAAW,CAAC,IAAI,CAAC,mCAAI,GAAG,CAAC,CAAC;IAC/D,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,oEAAoE;IACpE,mEAAmE;IACnE,IAAI,KAAK,GAAoD,IAAI,CAAC;IAClE,IAAI,CAAC;QACH,KAAK,GAAG,4BAA4B,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAClE,CAAC;eAAO,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3C,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,EAAE,CAAC;IAC7E,CAAC;IAED,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,UAAU;QACV,YAAY,EAAE,KAAK,CAAC,OAAO;QAC3B,YAAY,EAAE,IAAI,CAAC,IAAI,CACrB,UAAU,EACV,cAAc,EACd,SAAS,EACT,KAAK,EACL,MAAM,EACN,QAAQ,CACT;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CACxB,IAAuB,EACvB,GAAuC,EACvC,WAAoB;IAEpB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM;QAC1B,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,KAAK,KAAK,WAAW;YAAE,OAAO,KAAK,CAAC;IAC1C,CAAC;IACD,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAoB,EACpB,IAAuB,EACvB,GAAuC,EACvC,WAAoB;IAEpB,IAAI,CAAC,IAAI,CAAC,cAAc;QAAE,OAAO;IACjC,IAAI,iBAAiB,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC;QAAE,OAAO;IAEtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2CAA2C,IAAI,CAAC,YAAY,YAAY;QACtE,GAAG,IAAI,CAAC,UAAU,0CAA0C,CAC/D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CACtB,IAAoB,EACpB,IAAuB,EACvB,GAAsB,EACtB,OAAO,GAAiB,KAAK;IAE7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,YAAa,EAAE,GAAG,IAAI,CAAC,EAAE;YACrE,KAAK,EAAE,SAAS;YAChB,GAAG,kCAAO,GAAG,KAAE,gBAAgB,EAAE,GAAG,GAAE;SACvC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { spawn } from 'node:child_process';\nimport * as path from 'node:path';\n\nimport { cliVersion } from './compatibility';\nimport { readInstalledPackageManifest } from './harness-scaffold';\n\n/**\n * Wrapper-style delegation to the project-local `@ekanos/cli` — the\n * Gradle-wrapper / Yarn / `npx` pattern, applied to this CLI.\n *\n * A global install bundles ONE `@ekanos/integration-schema` version but\n * routinely serves N projects on different `@ekanos/sdk` versions — it\n * cannot be correct for all of them simultaneously (this is exactly the\n * failure mode `schema-skew.ts` detects). Delegation dissolves the tension:\n * `ekanos` stays on PATH for convenience, but the three verbs that read or\n * generate project files and run its code anyway always run through the\n * project's OWN pinned copy when one is installed and differs from the\n * invoked binary.\n *\n * Machine-level verbs (`init`, `login`, `logout`, `whoami`, `sources`,\n * `use`, `status`, `upgrade`) are deliberately NEVER delegated: you never\n * want an old local copy handling credentials, and `upgrade` must always be\n * the newest logic doing the upgrading — delegating it could have an old CLI\n * \"upgrade\" a project using its own out-of-date resolution.\n *\n * `publish` is never delegated either. It sends the person's bearer token to\n * the host, and `node_modules/@ekanos/cli` is whatever the project's lockfile\n * (or anyone who can write to `node_modules`) put there — a copy that would\n * be handed the token without ever being installed by the person. It runs on\n * the binary they invoked.\n */\n\nconst DELEGATABLE_VERBS = new Set(['validate', 'dev', 'test']);\n\nexport interface DelegationPlan {\n  shouldDelegate: boolean;\n  ownVersion: string;\n  localVersion?: string;\n  /** Absolute path to the local CLI's bin entry, when `shouldDelegate`. */\n  localBinPath?: string;\n}\n\n/** The first bare (non-flag) token before a standalone `--` — mirrors `splitCommand` in `index.ts`. */\nfunction firstCommand(argv: readonly string[]): string | null {\n  for (const token of argv) {\n    if (token === '--') break;\n    if (!token.startsWith('-')) return token;\n  }\n  return null;\n}\n\n/** `--dir <path>` / `--dir=<path>`, before a standalone `--`. */\nfunction scanDirFlag(argv: readonly string[]): string | undefined {\n  for (let i = 0; i < argv.length; i++) {\n    const token = argv[i]!;\n    if (token === '--') break;\n    if (token === '--dir') return argv[i + 1];\n    if (token.startsWith('--dir=')) return token.slice('--dir='.length);\n  }\n  return undefined;\n}\n\n/**\n * Decide whether this invocation should delegate. Pure and side-effect-free\n * (beyond the one file read of the local `@ekanos/cli` manifest, mirroring\n * `readInstalledHarness`/`dev`'s own project-package resolution rather than\n * writing a second one) so it is directly testable without spawning anything.\n */\nexport function planDelegation(\n  argv: readonly string[],\n  env: Record<string, string | undefined>,\n  cwd: string,\n): DelegationPlan {\n  const ownVersion = cliVersion();\n\n  // The recursion guard, and the explicit escape hatch, both win outright.\n  if (env.EKANOS_DELEGATED === '1' || env.EKANOS_NO_DELEGATE === '1') {\n    return { shouldDelegate: false, ownVersion };\n  }\n\n  const command = firstCommand(argv);\n  if (!command || !DELEGATABLE_VERBS.has(command)) {\n    return { shouldDelegate: false, ownVersion };\n  }\n\n  const projectDir = path.resolve(cwd, scanDirFlag(argv) ?? '.');\n  // Best-effort, like every other resolution this function does: a corrupt\n  // local manifest must fall through to \"don't delegate\", never throw. This\n  // runs in `bin.ts` BEFORE `run()`'s try/catch exists, so an uncaught throw\n  // here would bypass the JSON-envelope error machinery entirely and print a\n  // raw stderr string instead — a real regression in the \"exactly one\n  // terminal emission\" contract the rest of this package guarantees.\n  let local: ReturnType<typeof readInstalledPackageManifest> = null;\n  try {\n    local = readInstalledPackageManifest(projectDir, '@ekanos/cli');\n  } catch {\n    local = null;\n  }\n\n  if (!local || local.version === ownVersion) {\n    return { shouldDelegate: false, ownVersion, localVersion: local?.version };\n  }\n\n  return {\n    shouldDelegate: true,\n    ownVersion,\n    localVersion: local.version,\n    localBinPath: path.join(\n      projectDir,\n      'node_modules',\n      '@ekanos',\n      'cli',\n      'dist',\n      'bin.js',\n    ),\n  };\n}\n\n/**\n * Same JSON-mode inference `CliContext` uses (`context.ts`) — duplicated\n * deliberately rather than shared, because this runs BEFORE a `CliContext`\n * exists (delegation is decided ahead of the whole `run()` machinery). Keep\n * this in sync with `CliContext`'s constructor if that heuristic ever\n * changes: an explicit `--json`/`--no-json` wins, otherwise a non-TTY stdout\n * or `CLAUDECODE=1` means JSON mode.\n */\nfunction looksLikeJsonMode(\n  argv: readonly string[],\n  env: Record<string, string | undefined>,\n  stdoutIsTTY: boolean,\n): boolean {\n  for (const token of argv) {\n    if (token === '--') break;\n    if (token === '--json') return true;\n    if (token === '--no-json') return false;\n  }\n  return !stdoutIsTTY || env.CLAUDECODE === '1';\n}\n\n/**\n * The one-line stderr announcement — human mode only, and NEVER on stdout\n * (a delegated `validate --json` must still emit exactly one JSON object on\n * stdout, from the CHILD, with nothing of ours ahead of it).\n */\nexport function announceDelegation(\n  plan: DelegationPlan,\n  argv: readonly string[],\n  env: Record<string, string | undefined>,\n  stdoutIsTTY: boolean,\n): void {\n  if (!plan.shouldDelegate) return;\n  if (looksLikeJsonMode(argv, env, stdoutIsTTY)) return;\n\n  process.stderr.write(\n    `ekanos: using this project's pinned CLI ${plan.localVersion} (global: ` +\n      `${plan.ownVersion}). Set EKANOS_NO_DELEGATE=1 to bypass.\\n`,\n  );\n}\n\n/**\n * Spawn the local CLI's own bin entry with the SAME node executable,\n * `stdio: 'inherit'` so the JSON envelope and banner gating are\n * byte-identical to a direct run, and propagate its exit code exactly.\n * `spawnFn` is injectable so tests never actually fork a process.\n */\nexport function delegate(\n  plan: DelegationPlan,\n  argv: readonly string[],\n  env: NodeJS.ProcessEnv,\n  spawnFn: typeof spawn = spawn,\n): Promise<number> {\n  return new Promise((resolve) => {\n    const child = spawnFn(process.execPath, [plan.localBinPath!, ...argv], {\n      stdio: 'inherit',\n      env: { ...env, EKANOS_DELEGATED: '1' },\n    });\n    child.on('error', () => resolve(1));\n    child.on('exit', (code) => resolve(code ?? 1));\n  });\n}\n"]}

package/dist/harness-scaffold.js

@@ -311,6 +311,18 @@ const SHELL_TO_PROJECT = '../../../';
  * written leaves the project completely untouched rather than half-scaffolded.
  */
 export function assertShellDirIsOurs(harnessDir, force) {
+    // `.ekanos` first: through a symlinked `.ekanos`, the lstat below would
+    // describe the link's target, and the build-cache `rmSync` would delete
+    // outside the project.
+    const ekanosDir = path.dirname(harnessDir);
+    const parentKind = classifyPath(ekanosDir);
+    if (parentKind === 'symlink') {
+        throw invalidStateError(`${ekanosDir} is a symlink, so "ekanos dev" will not write through it.`, `Delete the ${ekanosDir} link and re-run "ekanos dev" — the shell is ` +
+            'generated, so nothing is lost.');
+    }
+    if (parentKind !== 'missing' && parentKind !== 'directory') {
+        throw invalidStateError(`${ekanosDir} exists and is not a directory.`, `Move or delete ${ekanosDir}, then re-run "ekanos dev".`);
+    }
     const kind = classifyPath(harnessDir);
     if (kind === 'symlink') {
         throw invalidStateError(`${harnessDir} is a symlink, so "ekanos dev" will not write through it.`, `Delete ${harnessDir} and re-run "ekanos dev" — the shell is generated, ` +

package/dist/harness-scaffold.js.map

@@ -1 +1 @@
-{"version":3,"file":"harness-scaffold.js","sourceRoot":"","sources":["../src/harness-scaffold.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,gEAAgE;AAChE,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAEjD,qEAAqE;AACrE,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAE3D,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAAG,UAAU,CAAC;AAE1C;;;;;GAKG;AACH,yDAAyD;AACzD,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEhD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,WAAW,GAAkD;IACxE,EAAE,QAAQ,EAAE,6BAA6B,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACnE;QACE,QAAQ,EAAE,oCAAoC;QAC9C,IAAI,EAAE,uBAAuB;KAC9B;IACD,EAAE,QAAQ,EAAE,2BAA2B,EAAE,IAAI,EAAE,cAAc,EAAE;IAC/D;QACE,QAAQ,EAAE,oCAAoC;QAC9C,IAAI,EAAE,uBAAuB;KAC9B;IACD;QACE,QAAQ,EAAE,kCAAkC;QAC5C,IAAI,EAAE,qBAAqB;KAC5B;IACD;QACE,QAAQ,EAAE,0CAA0C;QACpD,IAAI,EAAE,6BAA6B;KACpC;IACD;QACE,QAAQ,EAAE,qDAAqD;QAC/D,IAAI,EAAE,wCAAwC;KAC/C;IACD;QACE,QAAQ,EAAE,uCAAuC;QACjD,IAAI,EAAE,0BAA0B;KACjC;IACD;QACE,QAAQ,EAAE,6CAA6C;QACvD,IAAI,EAAE,gCAAgC;KACvC;IACD;QACE,QAAQ,EAAE,2CAA2C;QACrD,IAAI,EAAE,8BAA8B;KACrC;IACD;QACE,QAAQ,EAAE,6DAA6D;QACvE,IAAI,EAAE,gDAAgD;KACvD;IACD,EAAE,QAAQ,EAAE,8BAA8B,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACrE,EAAE,QAAQ,EAAE,iCAAiC,EAAE,IAAI,EAAE,oBAAoB,EAAE;IAC3E,EAAE,QAAQ,EAAE,4BAA4B,EAAE,IAAI,EAAE,eAAe,EAAE;IACjE,EAAE,QAAQ,EAAE,iCAAiC,EAAE,IAAI,EAAE,oBAAoB,EAAE;IAC3E,EAAE,QAAQ,EAAE,2BAA2B,EAAE,IAAI,EAAE,cAAc,EAAE;IAC/D;QACE,QAAQ,EAAE,uCAAuC;QACjD,IAAI,EAAE,0BAA0B;KACjC;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,eAAe;IACf,MAAM;IACN,OAAO;IACP,WAAW;IACX,aAAa;IACb,sBAAsB;CACd,CAAC;AAgCX,MAAM,UAAU,4BAA4B,CAC1C,UAAkB,EAClB,WAAmB;IAEnB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAC5B,UAAU,EACV,cAAc,EACd,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EACzB,cAAc,CACf,CAAC;IACF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1E,MAAM,OAAO,GACX,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAC3C,CAAC,CAAE,MAAgC,CAAC,OAAO;YAC3C,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,iBAAiB,CACrB,GAAG,WAAW,kDACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,6BAA6B,UAAU,OAAO,WAAW,YAAY,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAKD,MAAM,UAAU,oBAAoB,CAClC,UAAkB;IAElB,OAAO,4BAA4B,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;AACnE,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,2BAA2B,CAAC,UAAkB;;;IAC5D,aAAO,MAAA,oBAAoB,CAAC,UAAU,CAAC,0CAAE,OAAO,mCAAI,IAAI,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,OAAO,qBAAqB,CAAC,MAAM,CACjC,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,EAAE,CAAC,UAAU,CACZ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,CAAC,CAC5D,CACJ,CAAC;AACJ,CAAC;AAqCD,MAAM,UAAU,oBAAoB,CAAC,UAAkB;;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACrD,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAEhE,MAAM,GAAG,GAAG,OAAC,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAEjD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,6EAA6E;IAC7E,wEAAwE;IACxE,kEAAkE;IAClE,EAAE;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,6DAA6D;IAC7D,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;YAC1B,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;YAC9C,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAiC,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC7C,OAAO;YACL,OAAO;YACP,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YACvD,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;SAC1E,CAAC;IACJ,CAAC;eAAO,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,KAAK,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,UAAkB;;;IACjD,aAAO,MAAA,eAAe,CAAC,UAAU,CAAC,0CAAE,OAAO,mCAAI,IAAI,CAAC;AACtD,CAAC;AAED,SAAS,eAAe,CAAC,MAAmB;IAC1C,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,QAAgB,EAChB,QAAgB,EAChB,IAAkB,EAClB,KAAa,EACb,KAAc;IAEd,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,uBAAuB;IACvB,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC;IAElC,IACE,CAAC,KAAK;QACN,IAAI,KAAK,MAAM;QACf,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,QAAQ,EAC7C,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrD,CAAC;AA6BD;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAuB;;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAC3D,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAE7C,MAAM,WAAW,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,cAAc,GAAG,WAAW,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,MAAM,eAAe,SAAG,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,OAAO,mCAAI,IAAI,CAAC;IACxD,MAAM,MAAM,GAAgB;QAC1B,OAAO,EAAE,IAAI,CAAC,cAAc;QAC5B,GAAG,EAAE,UAAU,EAAE;QACjB,SAAS,EAAE,oBAAoB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;KACpE,CAAC;IAEF,uEAAuE;IACvE,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACnC,YAAY,CAAC,IAAI,CACf,GAAG,cAAc,sDAAsD;YACrE,WAAW,CACd,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,IAAI,cAAc,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9C,YAAY,CAAC,IAAI,CACf,mBAAmB,cAAc,CAAC,OAAO,MAAM,MAAM,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,IAAI,cAAc,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;YACtC,YAAY,CAAC,IAAI,CACf,eAAe,MAAA,cAAc,CAAC,GAAG,mCAAI,SAAS,MAAM,MAAM,CAAC,GAAG,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,cAAc,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAClD,YAAY,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IAEtC,uEAAuE;IACvE,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,sBAAsB;IACtB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAChE,IAAI,iBAAiB,EAAE,CAAC;QACtB,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,KAAK,GAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACxE,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,YAAY,EAAE,iBAAiB,OAAC,IAAI,CAAC,WAAW,mCAAI,EAAE,CAAC;KACxD,CAAC;IAEF,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7C,cAAc,CACZ,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAC3B,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,EAC5B,KAAK,EACL,IAAI,EACJ,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;IAED,cAAc,CACZ,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EACrC,eAAe,CAAC,MAAM,CAAC,EACvB,KAAK,EACL,cAAc,EACd,IAAI,CAAC,KAAK,CACX,CAAC;IAEF,uCACK,KAAK,KACR,UAAU;QACV,eAAe;QACf,cAAc;QACd,KAAK;QACL,YAAY;QACZ,iBAAiB,IACjB;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,KAAwB;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,gBAAgB,GAAG,IAAI,IAAI,CAAC,CAAC;IAC3E,OAAO,+CAA+C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAC7E,CAAC;AAED,kEAAkE;AAClE,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAErC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAkB,EAClB,KAAc;IAEd,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IAEtC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,iBAAiB,CACrB,GAAG,UAAU,2DAA2D,EACxE,UAAU,UAAU,qDAAqD;YACvE,qBAAqB,CACxB,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QAC/C,MAAM,iBAAiB,CACrB,GAAG,UAAU,iCAAiC,EAC9C,kBAAkB,UAAU,6BAA6B,CAC1D,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,KAAK,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAE/C,yEAAyE;IACzE,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;IACrD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC;IAEnD,IAAI,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzD,MAAM,iBAAiB,CACrB,GAAG,UAAU,kCAAkC,cAAc,WAAW;QACtE,0CAA0C,EAC5C,UAAU,UAAU,6CAA6C;QAC/D,mEAAmE;QACnE,gCAAgC,CACnC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACxE,OAAO,UAAU,CAAC,OAAO,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAE9C,4CAA4C;IAC5C,IAAI,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,iBAAiB,CACrB,uEAAuE;YACrE,wBAAwB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EACtD,oEAAoE;YAClE,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;AAC1C,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAkB,EAClB,YAAwD;IAExD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IAEtC,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,iBAAiB,CACrB,GAAG,UAAU,2DAA2D,EACxE,WAAW,UAAU,8CAA8C;YACjE,uCAAuC,CAC1C,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC7C,CAAC;IAED,iBAAiB,CAAC,UAAU,EAAE,UAAU,EAAE,mBAAmB,CAAC,YAAY,CAAC,CAAC,CAAC;IAE7E,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAC1B,YAAwD;IAExD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CACV,2BAA2B,KAAK,WAAW,kBAAkB,CAC3D,WAAW,CAAC,KAAK,CAClB,GAAG,CACL,CAAC;QACF,OAAO,CAAC,IAAI,CACV,YAAY,CAAC,8BAA8B,EAAE;YAC3C,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,WAAW,CAAC,IAAI;SACvB,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,YAAY,CAAC,wBAAwB,EAAE;QAC5C,mBAAmB,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QACvC,mBAAmB,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE,CAC7D,IAAI,CAAC,WAAW,EAAE,CACnB,CAAC;IACF,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;;IACrD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,2EAA2E,eAAe,IAAI,CAAC;IAE7G,MAAM,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAEzC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,iBAAiB,CACrB,GAAG,aAAa,uDAAuD,EACvE,QAAQ,eAAe,iDAAiD;YACtE,GAAG,aAAa,iDAAiD,CACpE,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,iBAAiB,CAAC,UAAU,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,SAAG,gBAAgB,CAAC,UAAU,EAAE,aAAa,CAAC,mCAAI,EAAE,CAAC;IACnE,IAAI,eAAe,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAE5C,MAAM,SAAS,GACb,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,kBAAkB,CAAC,UAAU,EAAE,aAAa,EAAE,GAAG,SAAS,KAAK,KAAK,EAAE,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;IAC9E,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport { cliVersion, templatesFingerprint } from './compatibility';\nimport { invalidStateError, preconditionError } from './errors';\nimport {\n  appendFileNoFollow,\n  classifyPath,\n  readFileNoFollow,\n  writeFileNoFollow,\n} from './safe-fs';\nimport { readTemplate } from './templates';\n\n/** The dependency that owns every line of harness behaviour. */\nexport const HARNESS_PACKAGE = '@ekanos/harness';\n\n/** Where the generated shell lives, relative to the project root. */\nexport const HARNESS_DIR = path.join('.ekanos', 'harness');\n\n/** The single `.gitignore` line that covers the whole generated tree. */\nexport const GITIGNORE_ENTRY = '.ekanos/';\n\n/**\n * The staleness marker, inside the generated tree so deleting the tree also\n * deletes the marker. Holds the `@ekanos/harness` version that generated the\n * shell — a version bump means the shell may be wired against an older export\n * surface, so it is regenerated.\n */\n/** Next's dev/build cache inside the generated shell. */\nexport const BUILD_CACHE_DIR = '.next';\n\nexport const VERSION_MARKER = '.ekanos-version';\n\n/** The partner-owned registry, at the PROJECT ROOT. Never regenerated. */\nexport const HARNESS_CONFIG_FILENAME = 'harness.config.ts';\n\n/**\n * Every file in the generated shell: bundled template → path inside\n * `.ekanos/harness/`. The ten route files are mechanically derivable from the\n * export map alone — which is the test of whether the package boundary is in\n * the right place. If a shell file ever needs a judgment call, the boundary\n * has moved, not the template.\n *\n * `app/api/integrations/[slug]/[...path]/route.ts` is the shell's one SERVER\n * route: it injects the registry into `@ekanos/harness/api`, which serves the\n * live-mode OAuth loop, storage bridge and trigger route over a server-held\n * context. It is the third registry injection point, beside the two pages.\n *\n * `app/harness-shell.tsx` exists because a `HarnessIntegration` holds React\n * component references and MCP `run` functions. Next cannot serialize those\n * across a server→client boundary, so the `'use client'` mark has to sit ABOVE\n * the point where the registry is injected — hence a client shell of its own\n * rather than a client `RootLayout` called from a server layout. Keeping\n * `app/page.tsx` a server component is what lets `/` prerender static.\n */\nexport const SHELL_FILES: readonly { template: string; dest: string }[] = [\n  { template: 'harness/app/layout.tsx.tmpl', dest: 'app/layout.tsx' },\n  {\n    template: 'harness/app/harness-shell.tsx.tmpl',\n    dest: 'app/harness-shell.tsx',\n  },\n  { template: 'harness/app/page.tsx.tmpl', dest: 'app/page.tsx' },\n  {\n    template: 'harness/app/[slug]/layout.tsx.tmpl',\n    dest: 'app/[slug]/layout.tsx',\n  },\n  {\n    template: 'harness/app/[slug]/page.tsx.tmpl',\n    dest: 'app/[slug]/page.tsx',\n  },\n  {\n    template: 'harness/app/[slug]/widgets/page.tsx.tmpl',\n    dest: 'app/[slug]/widgets/page.tsx',\n  },\n  {\n    template: 'harness/app/[slug]/widgets/[widgetId]/page.tsx.tmpl',\n    dest: 'app/[slug]/widgets/[widgetId]/page.tsx',\n  },\n  {\n    template: 'harness/app/[slug]/tile/page.tsx.tmpl',\n    dest: 'app/[slug]/tile/page.tsx',\n  },\n  {\n    template: 'harness/app/[slug]/activation/page.tsx.tmpl',\n    dest: 'app/[slug]/activation/page.tsx',\n  },\n  {\n    template: 'harness/app/[slug]/triggers/page.tsx.tmpl',\n    dest: 'app/[slug]/triggers/page.tsx',\n  },\n  {\n    template: 'harness/app/api/integrations/[slug]/[...path]/route.ts.tmpl',\n    dest: 'app/api/integrations/[slug]/[...path]/route.ts',\n  },\n  { template: 'harness/next.config.mjs.tmpl', dest: 'next.config.mjs' },\n  { template: 'harness/postcss.config.mjs.tmpl', dest: 'postcss.config.mjs' },\n  { template: 'harness/tsconfig.json.tmpl', dest: 'tsconfig.json' },\n  { template: 'harness/styles/globals.css.tmpl', dest: 'styles/globals.css' },\n  { template: 'harness/package.json.tmpl', dest: 'package.json' },\n  {\n    template: 'harness/types/team-accounts.d.ts.tmpl',\n    dest: 'types/team-accounts.d.ts',\n  },\n];\n\n/**\n * Packages the shell needs to resolve upward out of the partner's own\n * `node_modules`. The shell declares no dependencies of its own by design, so\n * a missing one shows up as an opaque Next resolution error at dev-server\n * start; checking here turns that into one precondition with one fix.\n */\nexport const REQUIRED_DEPENDENCIES = [\n  HARNESS_PACKAGE,\n  'next',\n  'react',\n  'react-dom',\n  'tailwindcss',\n  '@tailwindcss/postcss',\n] as const;\n\nexport interface WrittenFiles {\n  created: string[];\n  updated: string[];\n  unchanged: string[];\n}\n\n/**\n * Read an installed package's `package.json` out of a project's TOP-LEVEL\n * `node_modules`. Resolved by direct path join rather than `require.resolve`\n * on purpose, for two independent reasons:\n *\n *  - The CLI runs from its own install and must read the version of the copy\n *    in THE CALLER'S project, not one hoisted next to itself.\n *  - Several of the packages this reads (`@ekanos/integration-schema`\n *    included) declare an `exports` map with no `./package.json` subpath, so\n *    `require.resolve('<pkg>/package.json')` throws\n *    `ERR_PACKAGE_PATH_NOT_EXPORTED` under Node's ESM resolver. A plain file\n *    read is not subject to the export map at all.\n *\n * Shared by every \"what does this project have installed?\" check in the\n * CLI — `readInstalledHarness` below, the schema-skew gate, and `upgrade`'s\n * current-toolchain report — so there is exactly one implementation of \"read\n * a package's on-disk version\", not a subtly different one per call site.\n */\nexport interface InstalledPackage {\n  version: string;\n  /** The raw package.json, for callers that need more than the version. */\n  manifest: unknown;\n}\n\nexport function readInstalledPackageManifest(\n  projectDir: string,\n  packageName: string,\n): InstalledPackage | null {\n  const manifestPath = path.join(\n    projectDir,\n    'node_modules',\n    ...packageName.split('/'),\n    'package.json',\n  );\n  if (!fs.existsSync(manifestPath)) return null;\n\n  try {\n    const parsed: unknown = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));\n    const version =\n      typeof parsed === 'object' && parsed !== null\n        ? (parsed as { version?: unknown }).version\n        : undefined;\n    if (typeof version !== 'string' || version.length === 0) return null;\n    return { version, manifest: parsed };\n  } catch (error) {\n    throw preconditionError(\n      `${packageName}'s package.json in node_modules is unreadable: ${\n        error instanceof Error ? error.message : String(error)\n      }`,\n      `Reinstall dependencies in ${projectDir} so ${packageName} resolves.`,\n    );\n  }\n}\n\n/** Read the installed `@ekanos/harness` version out of the partner's project. */\nexport type InstalledHarness = InstalledPackage;\n\nexport function readInstalledHarness(\n  projectDir: string,\n): InstalledHarness | null {\n  return readInstalledPackageManifest(projectDir, HARNESS_PACKAGE);\n}\n\n/** Just the installed version, for callers that need nothing else. */\nexport function readInstalledHarnessVersion(projectDir: string): string | null {\n  return readInstalledHarness(projectDir)?.version ?? null;\n}\n\n/** Which of `REQUIRED_DEPENDENCIES` are not installed in the project root. */\nexport function missingDependencies(projectDir: string): string[] {\n  return REQUIRED_DEPENDENCIES.filter(\n    (name) =>\n      !fs.existsSync(\n        path.join(projectDir, 'node_modules', name, 'package.json'),\n      ),\n  );\n}\n\n/**\n * What generated an existing shell.\n *\n * All three fields matter, and recording only `harness` was a real hole: the\n * templates ship with the CLI, so a shell can be stale because the CLI changed\n * while the harness did not. `templates` is the authoritative one — it is a\n * hash of the template sources, so it moves whenever what we generate moves,\n * including for a CLI build that never shipped a version bump.\n */\nexport interface ShellMarker {\n  harness: string;\n  /** null for a legacy bare-version marker written before this was recorded. */\n  cli: string | null;\n  templates: string | null;\n}\n\n/**\n * Three outcomes, not two, because \"no marker\" and \"unreadable marker\" call\n * for opposite responses.\n *\n * A marker's PRESENCE is itself evidence the tree is ours — a squatter does\n * not write `.ekanos-version` — and the likeliest cause of an unreadable one\n * is our own interrupted write. Everything under `.ekanos/harness/` is\n * CLI-owned, gitignored and reproducible from the templates, so regenerating\n * destroys nothing: there is no value at risk to justify charging a partner a\n * confusing `--force` to recover from our own bad write.\n *\n * An ABSENT marker over a non-empty tree is the opposite: nothing says the\n * files are ours, so we refuse. That is the L1 rule and it stays.\n */\nexport type MarkerState =\n  | { kind: 'missing' }\n  | { kind: 'corrupt' }\n  | { kind: 'ok'; marker: ShellMarker };\n\nexport function readShellMarkerState(harnessDir: string): MarkerState {\n  const marker = path.join(harnessDir, VERSION_MARKER);\n  if (classifyPath(marker) !== 'file') return { kind: 'missing' };\n\n  const raw = (readFileNoFollow(harnessDir, marker) ?? '').trim();\n  if (raw.length === 0) return { kind: 'corrupt' };\n\n  const parsed = parseMarker(raw);\n  return parsed === null ? { kind: 'corrupt' } : { kind: 'ok', marker: parsed };\n}\n\nfunction parseMarker(raw: string): ShellMarker | null {\n  // v1 markers were a bare version string. Read them rather than crashing, and\n  // report the unknown fields as null so the shell counts as stale and is\n  // regenerated once — which is the correct outcome for an upgrade.\n  //\n  // It must actually LOOK like a version: without this, any garbage that does\n  // not happen to start with `{` — a truncated write, a stray word — reads as\n  // a legacy marker named after the garbage, and the corrupt-marker path never\n  // fires. That is how a truncated `.ekanos-version` was silently reported as\n  // \"@ekanos/harness truncat → 0.1.0\" instead of \"unreadable\".\n  if (!raw.startsWith('{')) {\n    return /^\\d+\\.\\d+/.test(raw)\n      ? { harness: raw, cli: null, templates: null }\n      : null;\n  }\n\n  try {\n    const parsed: unknown = JSON.parse(raw);\n    if (typeof parsed !== 'object' || parsed === null) return null;\n    const record = parsed as Record<string, unknown>;\n    const harness = record.harness;\n    if (typeof harness !== 'string') return null;\n    return {\n      harness,\n      cli: typeof record.cli === 'string' ? record.cli : null,\n      templates: typeof record.templates === 'string' ? record.templates : null,\n    };\n  } catch {\n    return null;\n  }\n}\n\n/** The parsed marker, or null when it is absent OR unreadable. */\nexport function readShellMarker(harnessDir: string): ShellMarker | null {\n  const state = readShellMarkerState(harnessDir);\n  return state.kind === 'ok' ? state.marker : null;\n}\n\n/** The `@ekanos/harness` version an existing shell was generated against. */\nexport function readShellVersion(harnessDir: string): string | null {\n  return readShellMarker(harnessDir)?.harness ?? null;\n}\n\nfunction serializeMarker(marker: ShellMarker): string {\n  return `${JSON.stringify(marker, null, 2)}\\n`;\n}\n\n/**\n * Write a generated file, but ONLY when its bytes would change.\n *\n * This is what makes a re-run cheap and a watcher quiet: an unchanged file is\n * not rewritten, so its mtime does not move and Next's dev server does not\n * rebuild. It also means a hand-edit inside the CLI-owned tree is silently\n * corrected on the next run, which is the intended contract for `.ekanos/`.\n */\nexport function writeIfChanged(\n  root: string,\n  destPath: string,\n  contents: string,\n  into: WrittenFiles,\n  label: string,\n  force: boolean,\n): void {\n  // `classifyPath` uses lstat, so a symlink here is reported as a symlink\n  // rather than as whatever it points at — including a DANGLING one, which\n  // `existsSync` would call absent and a plain write would then materialize\n  // outside the project.\n  const kind = classifyPath(destPath);\n  const exists = kind !== 'missing';\n\n  if (\n    !force &&\n    kind === 'file' &&\n    readFileNoFollow(root, destPath) === contents\n  ) {\n    into.unchanged.push(label);\n    return;\n  }\n\n  writeFileNoFollow(root, destPath, contents);\n  (exists ? into.updated : into.created).push(label);\n}\n\nexport interface ScaffoldShellArgs {\n  projectDir: string;\n  slug: string;\n  harnessVersion: string;\n  /** Rewrite every file even when its bytes already match. */\n  force: boolean;\n  /** Extra Tailwind @source globs from ekanos.json, already validated. */\n  sourceGlobs?: readonly string[];\n}\n\nexport interface ScaffoldShellResult extends WrittenFiles {\n  harnessDir: string;\n  /** The version the shell carried before this run — null on a first run. */\n  previousVersion: string | null;\n  /** What generated the previous shell, or null on a first run. */\n  previousMarker: ShellMarker | null;\n  /** True when anything that generated the shell has since changed. */\n  stale: boolean;\n  /** `.next` under the shell was deleted because the shell was stale. */\n  buildCacheCleared: boolean;\n  /**\n   * Which of harness / cli / templates moved. Empty on a first run; this is\n   * what lets `dev` say WHY it regenerated rather than just that it did.\n   */\n  staleReasons: string[];\n}\n\n/**\n * Generate `.ekanos/harness/**` for `harnessVersion`. Every file here is\n * CLI-owned and gitignored, so regeneration needs no permission and asks no\n * question — the partner owns `harness.config.ts` and their integration\n * source, and nothing else.\n */\nexport function scaffoldShell(args: ScaffoldShellArgs): ScaffoldShellResult {\n  const harnessDir = path.join(args.projectDir, HARNESS_DIR);\n  assertShellDirIsOurs(harnessDir, args.force);\n\n  const markerState = readShellMarkerState(harnessDir);\n  const previousMarker = markerState.kind === 'ok' ? markerState.marker : null;\n  const previousVersion = previousMarker?.harness ?? null;\n  const marker: ShellMarker = {\n    harness: args.harnessVersion,\n    cli: cliVersion(),\n    templates: templatesFingerprint(SHELL_FILES.map((f) => f.template)),\n  };\n\n  // A shell is current only if EVERYTHING that produced it is unchanged.\n  // Checking the harness version alone certified shells generated by an older\n  // CLI, against templates that had since moved, as up to date.\n  const staleReasons: string[] = [];\n  if (markerState.kind === 'corrupt') {\n    staleReasons.push(\n      `${VERSION_MARKER} was unreadable, so the existing shell could not be ` +\n        'certified',\n    );\n  }\n  if (previousMarker !== null) {\n    if (previousMarker.harness !== marker.harness) {\n      staleReasons.push(\n        `@ekanos/harness ${previousMarker.harness} → ${marker.harness}`,\n      );\n    }\n    if (previousMarker.cli !== marker.cli) {\n      staleReasons.push(\n        `@ekanos/cli ${previousMarker.cli ?? 'unknown'} → ${marker.cli}`,\n      );\n    }\n    if (previousMarker.templates !== marker.templates) {\n      staleReasons.push('the shell templates changed');\n    }\n  }\n  const stale = staleReasons.length > 0;\n\n  // Next's persistent dev cache was built from the OLD shell and the OLD\n  // toolchain. Keeping it across a regeneration served a corrupted Tailwind\n  // candidate on the 0.1 → 0.4 jump (every page a build-error overlay until\n  // someone deleted the directory by hand). The shell knows it is stale; the\n  // cache goes with it.\n  const buildCacheDir = path.join(harnessDir, BUILD_CACHE_DIR);\n  const buildCacheCleared = stale && fs.existsSync(buildCacheDir);\n  if (buildCacheCleared) {\n    fs.rmSync(buildCacheDir, { recursive: true, force: true });\n  }\n\n  const files: WrittenFiles = { created: [], updated: [], unchanged: [] };\n  const vars = {\n    SLUG: args.slug,\n    SOURCE_GLOBS: renderSourceGlobs(args.sourceGlobs ?? []),\n  };\n\n  for (const { template, dest } of SHELL_FILES) {\n    writeIfChanged(\n      args.projectDir,\n      path.join(harnessDir, dest),\n      readTemplate(template, vars),\n      files,\n      dest,\n      args.force,\n    );\n  }\n\n  writeIfChanged(\n    args.projectDir,\n    path.join(harnessDir, VERSION_MARKER),\n    serializeMarker(marker),\n    files,\n    VERSION_MARKER,\n    args.force,\n  );\n\n  return {\n    ...files,\n    harnessDir,\n    previousVersion,\n    previousMarker,\n    stale,\n    staleReasons,\n    buildCacheCleared,\n  };\n}\n\n/**\n * Turn validated `sourceGlobs` into the `@source` lines the generated\n * stylesheet carries, each relative to the shell's `styles/` directory.\n *\n * Tailwind never scans what it is not pointed at, and a glob that matches\n * nothing fails silently — so an integration living outside the default\n * layout renders completely unstyled with no error anywhere. That is what\n * `sourceGlobs` is for, and until now it was parsed and thrown away.\n */\nfunction renderSourceGlobs(globs: readonly string[]): string {\n  if (globs.length === 0) return '';\n  const lines = globs.map((glob) => `@source '${SHELL_TO_PROJECT}${glob}';`);\n  return `\\n/* From \"sourceGlobs\" in ekanos.json. */\\n${lines.join('\\n')}\\n`;\n}\n\n/** From `.ekanos/harness/styles/` back up to the project root. */\nconst SHELL_TO_PROJECT = '../../../';\n\n/**\n * Establish that `.ekanos/harness` is a tree WE generated before writing a\n * single byte into it, and return the version marker it carried.\n *\n * Path location alone is not ownership. A directory that exists but carries no\n * `.ekanos-version` was put there by something else — a partner, another tool,\n * a symlink — and clobbering it because it happens to sit at the path we like\n * is the same class of mistake as following a symlink. An empty directory is\n * fine (that is just `mkdir -p` having run), and `--force` is the explicit\n * override.\n *\n * Runs BEFORE `bootstrapHarnessConfig` in `dev`, so a shell that cannot be\n * written leaves the project completely untouched rather than half-scaffolded.\n */\nexport function assertShellDirIsOurs(\n  harnessDir: string,\n  force: boolean,\n): string | null {\n  const kind = classifyPath(harnessDir);\n\n  if (kind === 'symlink') {\n    throw invalidStateError(\n      `${harnessDir} is a symlink, so \"ekanos dev\" will not write through it.`,\n      `Delete ${harnessDir} and re-run \"ekanos dev\" — the shell is generated, ` +\n        'so nothing is lost.',\n    );\n  }\n\n  if (kind !== 'missing' && kind !== 'directory') {\n    throw invalidStateError(\n      `${harnessDir} exists and is not a directory.`,\n      `Move or delete ${harnessDir}, then re-run \"ekanos dev\".`,\n    );\n  }\n\n  if (kind === 'missing') return null;\n\n  const state = readShellMarkerState(harnessDir);\n\n  // A marker we wrote, however mangled, still identifies the tree as ours.\n  if (state.kind === 'ok') return state.marker.harness;\n  if (state.kind === 'corrupt' || force) return null;\n\n  if (fs.readdirSync(harnessDir).length === 0) return null;\n\n  throw invalidStateError(\n    `${harnessDir} already contains files but no ${VERSION_MARKER} marker, ` +\n      'so it was not generated by \"ekanos dev\".',\n    `Delete ${harnessDir} if you do not need it, or pass --force to ` +\n      'overwrite it. Everything \"ekanos dev\" generates is reproducible; ' +\n      'anything else in there is not.',\n  );\n}\n\n/**\n * The module specifier `harness.config.ts` uses to import the partner's\n * integration: the `entry` from ekanos.json, made relative and extension-free.\n * \"src/integration.ts\" → \"src/integration\".\n */\nexport function entryImportSpecifier(entry: string): string {\n  const normalized = entry.split(path.sep).join('/').replace(/^\\.\\//, '');\n  return normalized.replace(/\\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/, '');\n}\n\n/**\n * The same specifier as a JavaScript string LITERAL, ready to drop into a\n * generated `import` statement.\n *\n * `entry` is attacker-influenced data from `ekanos.json`, and a POSIX filename\n * may legally contain a quote or a newline. Interpolating it raw would let a\n * crafted-but-valid path close the string and append statements to the module\n * we generate. `JSON.stringify` produces a correctly escaped literal, which is\n * the actual fix; the explicit rejection below is a second line that also\n * gives the partner a comprehensible error instead of a bizarre filename\n * silently appearing, escaped, in their config.\n *\n * This does not cross a trust boundary on its own — a partner's own code runs\n * unsandboxed anyway — but \"the templates cannot be injected into\" is a claim\n * we make, and it should be true.\n */\nexport function entryImportLiteral(entry: string): string {\n  const specifier = entryImportSpecifier(entry);\n\n  // eslint-disable-next-line no-control-regex\n  if (/[\"'`\\\\\\n\\r\\u0000-\\u001f]/.test(specifier)) {\n    throw preconditionError(\n      `The \"entry\" in ekanos.json contains characters that cannot appear in ` +\n        `an import specifier: ${JSON.stringify(specifier)}.`,\n      'Rename the file so its path has no quotes, backslashes or control ' +\n        'characters, then update \"entry\" in ekanos.json to match.',\n    );\n  }\n\n  return JSON.stringify(`./${specifier}`);\n}\n\nexport interface BootstrapConfigResult {\n  /** True only when this run created the file. */\n  bootstrapped: boolean;\n  configPath: string;\n}\n\n/**\n * Write a starter `harness.config.ts` at the project root — ONCE.\n *\n * An existing file is left strictly alone, byte for byte, and no flag changes\n * that: it is the one harness file the partner owns, it is git-tracked, and\n * regenerating it would throw away their fixtures. `--force` regenerates the\n * shell, never this.\n */\nexport function bootstrapHarnessConfig(\n  projectDir: string,\n  integrations: readonly { slug: string; entry: string }[],\n): BootstrapConfigResult {\n  const configPath = path.join(projectDir, HARNESS_CONFIG_FILENAME);\n  const kind = classifyPath(configPath);\n\n  // A symlink here — including a dangling one, which `existsSync` reports as\n  // absent — would have us write through to its target. Since this file is the\n  // partner's to own, the only safe answer is to touch nothing and say why.\n  if (kind === 'symlink') {\n    throw invalidStateError(\n      `${configPath} is a symlink, so \"ekanos dev\" will not write through it.`,\n      `Replace ${configPath} with a real file (or delete it to have one ` +\n        'generated), then re-run \"ekanos dev\".',\n    );\n  }\n\n  if (kind !== 'missing') {\n    return { bootstrapped: false, configPath };\n  }\n\n  writeFileNoFollow(projectDir, configPath, renderHarnessConfig(integrations));\n\n  return { bootstrapped: true, configPath };\n}\n\n/**\n * Render the starter registry for EVERY integration the project declares.\n *\n * The harness registry is an array and `ekanos.json` can now hold a list, so a\n * project's second integration reaches the harness the same way its first\n * does. Each entry imports the definition under a distinct local identifier\n * derived from its slug, because two `integration` imports in one module do\n * not compile.\n */\nfunction renderHarnessConfig(\n  integrations: readonly { slug: string; entry: string }[],\n): string {\n  const imports: string[] = [];\n  const entries: string[] = [];\n\n  for (const integration of integrations) {\n    const ident = identifierForSlug(integration.slug);\n    imports.push(\n      `import { integration as ${ident} } from ${entryImportLiteral(\n        integration.entry,\n      )};`,\n    );\n    entries.push(\n      readTemplate('harness.config.entry.ts.tmpl', {\n        IDENT: ident,\n        SLUG: integration.slug,\n      }),\n    );\n  }\n\n  return readTemplate('harness.config.ts.tmpl', {\n    INTEGRATION_IMPORTS: imports.join('\\n'),\n    INTEGRATION_ENTRIES: entries.join(''),\n  });\n}\n\n/**\n * \"acme-crm\" → \"acmeCrm\". A slug is kebab-case by schema, so this only has to\n * handle hyphens, and a leading digit is impossible.\n */\nexport function identifierForSlug(slug: string): string {\n  const camel = slug.replace(/-([a-z0-9])/g, (_, char: string) =>\n    char.toUpperCase(),\n  );\n  return /^[0-9]/.test(camel) ? `i${camel}` : camel;\n}\n\n/**\n * Add `.ekanos/` to the project `.gitignore`, exactly once.\n *\n * Matching is line-wise over the spellings git treats as the same rule\n * (`.ekanos`, `.ekanos/`, `/.ekanos/`), so re-running never appends a\n * duplicate — the thing that makes a scaffold verb safe to run in a loop.\n * A negation (`!.ekanos/`) is deliberately NOT treated as a match: the\n * partner meant to un-ignore it, and we do not fight that silently.\n */\nexport function ensureGitignoreEntry(projectDir: string): boolean {\n  const gitignorePath = path.join(projectDir, '.gitignore');\n  const block = `# Ekanos dev harness — generated by \"ekanos dev\", never edited by hand\\n${GITIGNORE_ENTRY}\\n`;\n\n  const kind = classifyPath(gitignorePath);\n\n  if (kind === 'symlink') {\n    throw invalidStateError(\n      `${gitignorePath} is a symlink, so \"ekanos dev\" will not append to it.`,\n      `Add \"${GITIGNORE_ENTRY}\" to your real .gitignore yourself, or replace ` +\n        `${gitignorePath} with a regular file, then re-run \"ekanos dev\".`,\n    );\n  }\n\n  if (kind === 'missing') {\n    writeFileNoFollow(projectDir, gitignorePath, block);\n    return true;\n  }\n\n  const existing = readFileNoFollow(projectDir, gitignorePath) ?? '';\n  if (gitignoreCovers(existing)) return false;\n\n  const separator =\n    existing.length === 0 || existing.endsWith('\\n') ? '' : '\\n';\n  appendFileNoFollow(projectDir, gitignorePath, `${separator}\\n${block}`);\n  return true;\n}\n\nfunction gitignoreCovers(source: string): boolean {\n  const equivalents = new Set(['.ekanos', '.ekanos/', '/.ekanos', '/.ekanos/']);\n  return source\n    .split('\\n')\n    .map((line) => line.trim())\n    .some((line) => equivalents.has(line));\n}\n"]}
+{"version":3,"file":"harness-scaffold.js","sourceRoot":"","sources":["../src/harness-scaffold.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,gEAAgE;AAChE,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAEjD,qEAAqE;AACrE,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAE3D,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAAG,UAAU,CAAC;AAE1C;;;;;GAKG;AACH,yDAAyD;AACzD,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEhD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,WAAW,GAAkD;IACxE,EAAE,QAAQ,EAAE,6BAA6B,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACnE;QACE,QAAQ,EAAE,oCAAoC;QAC9C,IAAI,EAAE,uBAAuB;KAC9B;IACD,EAAE,QAAQ,EAAE,2BAA2B,EAAE,IAAI,EAAE,cAAc,EAAE;IAC/D;QACE,QAAQ,EAAE,oCAAoC;QAC9C,IAAI,EAAE,uBAAuB;KAC9B;IACD;QACE,QAAQ,EAAE,kCAAkC;QAC5C,IAAI,EAAE,qBAAqB;KAC5B;IACD;QACE,QAAQ,EAAE,0CAA0C;QACpD,IAAI,EAAE,6BAA6B;KACpC;IACD;QACE,QAAQ,EAAE,qDAAqD;QAC/D,IAAI,EAAE,wCAAwC;KAC/C;IACD;QACE,QAAQ,EAAE,uCAAuC;QACjD,IAAI,EAAE,0BAA0B;KACjC;IACD;QACE,QAAQ,EAAE,6CAA6C;QACvD,IAAI,EAAE,gCAAgC;KACvC;IACD;QACE,QAAQ,EAAE,2CAA2C;QACrD,IAAI,EAAE,8BAA8B;KACrC;IACD;QACE,QAAQ,EAAE,6DAA6D;QACvE,IAAI,EAAE,gDAAgD;KACvD;IACD,EAAE,QAAQ,EAAE,8BAA8B,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACrE,EAAE,QAAQ,EAAE,iCAAiC,EAAE,IAAI,EAAE,oBAAoB,EAAE;IAC3E,EAAE,QAAQ,EAAE,4BAA4B,EAAE,IAAI,EAAE,eAAe,EAAE;IACjE,EAAE,QAAQ,EAAE,iCAAiC,EAAE,IAAI,EAAE,oBAAoB,EAAE;IAC3E,EAAE,QAAQ,EAAE,2BAA2B,EAAE,IAAI,EAAE,cAAc,EAAE;IAC/D;QACE,QAAQ,EAAE,uCAAuC;QACjD,IAAI,EAAE,0BAA0B;KACjC;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,eAAe;IACf,MAAM;IACN,OAAO;IACP,WAAW;IACX,aAAa;IACb,sBAAsB;CACd,CAAC;AAgCX,MAAM,UAAU,4BAA4B,CAC1C,UAAkB,EAClB,WAAmB;IAEnB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAC5B,UAAU,EACV,cAAc,EACd,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EACzB,cAAc,CACf,CAAC;IACF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1E,MAAM,OAAO,GACX,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAC3C,CAAC,CAAE,MAAgC,CAAC,OAAO;YAC3C,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,iBAAiB,CACrB,GAAG,WAAW,kDACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,6BAA6B,UAAU,OAAO,WAAW,YAAY,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAKD,MAAM,UAAU,oBAAoB,CAClC,UAAkB;IAElB,OAAO,4BAA4B,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;AACnE,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,2BAA2B,CAAC,UAAkB;;;IAC5D,aAAO,MAAA,oBAAoB,CAAC,UAAU,CAAC,0CAAE,OAAO,mCAAI,IAAI,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,OAAO,qBAAqB,CAAC,MAAM,CACjC,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,EAAE,CAAC,UAAU,CACZ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,CAAC,CAC5D,CACJ,CAAC;AACJ,CAAC;AAqCD,MAAM,UAAU,oBAAoB,CAAC,UAAkB;;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACrD,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAEhE,MAAM,GAAG,GAAG,OAAC,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAEjD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,6EAA6E;IAC7E,wEAAwE;IACxE,kEAAkE;IAClE,EAAE;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,6DAA6D;IAC7D,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;YAC1B,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;YAC9C,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAiC,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC7C,OAAO;YACL,OAAO;YACP,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YACvD,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;SAC1E,CAAC;IACJ,CAAC;eAAO,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,KAAK,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,UAAkB;;;IACjD,aAAO,MAAA,eAAe,CAAC,UAAU,CAAC,0CAAE,OAAO,mCAAI,IAAI,CAAC;AACtD,CAAC;AAED,SAAS,eAAe,CAAC,MAAmB;IAC1C,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,QAAgB,EAChB,QAAgB,EAChB,IAAkB,EAClB,KAAa,EACb,KAAc;IAEd,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,uBAAuB;IACvB,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC;IAElC,IACE,CAAC,KAAK;QACN,IAAI,KAAK,MAAM;QACf,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,QAAQ,EAC7C,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrD,CAAC;AA6BD;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAuB;;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAC3D,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAE7C,MAAM,WAAW,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,cAAc,GAAG,WAAW,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,MAAM,eAAe,SAAG,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,OAAO,mCAAI,IAAI,CAAC;IACxD,MAAM,MAAM,GAAgB;QAC1B,OAAO,EAAE,IAAI,CAAC,cAAc;QAC5B,GAAG,EAAE,UAAU,EAAE;QACjB,SAAS,EAAE,oBAAoB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;KACpE,CAAC;IAEF,uEAAuE;IACvE,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACnC,YAAY,CAAC,IAAI,CACf,GAAG,cAAc,sDAAsD;YACrE,WAAW,CACd,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,IAAI,cAAc,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9C,YAAY,CAAC,IAAI,CACf,mBAAmB,cAAc,CAAC,OAAO,MAAM,MAAM,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,IAAI,cAAc,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;YACtC,YAAY,CAAC,IAAI,CACf,eAAe,MAAA,cAAc,CAAC,GAAG,mCAAI,SAAS,MAAM,MAAM,CAAC,GAAG,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,cAAc,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAClD,YAAY,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IAEtC,uEAAuE;IACvE,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,sBAAsB;IACtB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAChE,IAAI,iBAAiB,EAAE,CAAC;QACtB,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,KAAK,GAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACxE,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,YAAY,EAAE,iBAAiB,OAAC,IAAI,CAAC,WAAW,mCAAI,EAAE,CAAC;KACxD,CAAC;IAEF,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7C,cAAc,CACZ,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAC3B,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,EAC5B,KAAK,EACL,IAAI,EACJ,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;IAED,cAAc,CACZ,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EACrC,eAAe,CAAC,MAAM,CAAC,EACvB,KAAK,EACL,cAAc,EACd,IAAI,CAAC,KAAK,CACX,CAAC;IAEF,uCACK,KAAK,KACR,UAAU;QACV,eAAe;QACf,cAAc;QACd,KAAK;QACL,YAAY;QACZ,iBAAiB,IACjB;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,KAAwB;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,gBAAgB,GAAG,IAAI,IAAI,CAAC,CAAC;IAC3E,OAAO,+CAA+C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAC7E,CAAC;AAED,kEAAkE;AAClE,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAErC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAkB,EAClB,KAAc;IAEd,wEAAwE;IACxE,wEAAwE;IACxE,uBAAuB;IACvB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,iBAAiB,CACrB,GAAG,SAAS,2DAA2D,EACvE,cAAc,SAAS,+CAA+C;YACpE,gCAAgC,CACnC,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;QAC3D,MAAM,iBAAiB,CACrB,GAAG,SAAS,iCAAiC,EAC7C,kBAAkB,SAAS,6BAA6B,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IAEtC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,iBAAiB,CACrB,GAAG,UAAU,2DAA2D,EACxE,UAAU,UAAU,qDAAqD;YACvE,qBAAqB,CACxB,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QAC/C,MAAM,iBAAiB,CACrB,GAAG,UAAU,iCAAiC,EAC9C,kBAAkB,UAAU,6BAA6B,CAC1D,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,KAAK,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAE/C,yEAAyE;IACzE,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;IACrD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC;IAEnD,IAAI,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzD,MAAM,iBAAiB,CACrB,GAAG,UAAU,kCAAkC,cAAc,WAAW;QACtE,0CAA0C,EAC5C,UAAU,UAAU,6CAA6C;QAC/D,mEAAmE;QACnE,gCAAgC,CACnC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACxE,OAAO,UAAU,CAAC,OAAO,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAE9C,4CAA4C;IAC5C,IAAI,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,iBAAiB,CACrB,uEAAuE;YACrE,wBAAwB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EACtD,oEAAoE;YAClE,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;AAC1C,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAkB,EAClB,YAAwD;IAExD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IAEtC,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,iBAAiB,CACrB,GAAG,UAAU,2DAA2D,EACxE,WAAW,UAAU,8CAA8C;YACjE,uCAAuC,CAC1C,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC7C,CAAC;IAED,iBAAiB,CAAC,UAAU,EAAE,UAAU,EAAE,mBAAmB,CAAC,YAAY,CAAC,CAAC,CAAC;IAE7E,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAC1B,YAAwD;IAExD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CACV,2BAA2B,KAAK,WAAW,kBAAkB,CAC3D,WAAW,CAAC,KAAK,CAClB,GAAG,CACL,CAAC;QACF,OAAO,CAAC,IAAI,CACV,YAAY,CAAC,8BAA8B,EAAE;YAC3C,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,WAAW,CAAC,IAAI;SACvB,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,YAAY,CAAC,wBAAwB,EAAE;QAC5C,mBAAmB,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QACvC,mBAAmB,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE,CAC7D,IAAI,CAAC,WAAW,EAAE,CACnB,CAAC;IACF,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;;IACrD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,2EAA2E,eAAe,IAAI,CAAC;IAE7G,MAAM,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAEzC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,iBAAiB,CACrB,GAAG,aAAa,uDAAuD,EACvE,QAAQ,eAAe,iDAAiD;YACtE,GAAG,aAAa,iDAAiD,CACpE,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,iBAAiB,CAAC,UAAU,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,SAAG,gBAAgB,CAAC,UAAU,EAAE,aAAa,CAAC,mCAAI,EAAE,CAAC;IACnE,IAAI,eAAe,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAE5C,MAAM,SAAS,GACb,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,kBAAkB,CAAC,UAAU,EAAE,aAAa,EAAE,GAAG,SAAS,KAAK,KAAK,EAAE,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;IAC9E,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport { cliVersion, templatesFingerprint } from './compatibility';\nimport { invalidStateError, preconditionError } from './errors';\nimport {\n  appendFileNoFollow,\n  classifyPath,\n  readFileNoFollow,\n  writeFileNoFollow,\n} from './safe-fs';\nimport { readTemplate } from './templates';\n\n/** The dependency that owns every line of harness behaviour. */\nexport const HARNESS_PACKAGE = '@ekanos/harness';\n\n/** Where the generated shell lives, relative to the project root. */\nexport const HARNESS_DIR = path.join('.ekanos', 'harness');\n\n/** The single `.gitignore` line that covers the whole generated tree. */\nexport const GITIGNORE_ENTRY = '.ekanos/';\n\n/**\n * The staleness marker, inside the generated tree so deleting the tree also\n * deletes the marker. Holds the `@ekanos/harness` version that generated the\n * shell — a version bump means the shell may be wired against an older export\n * surface, so it is regenerated.\n */\n/** Next's dev/build cache inside the generated shell. */\nexport const BUILD_CACHE_DIR = '.next';\n\nexport const VERSION_MARKER = '.ekanos-version';\n\n/** The partner-owned registry, at the PROJECT ROOT. Never regenerated. */\nexport const HARNESS_CONFIG_FILENAME = 'harness.config.ts';\n\n/**\n * Every file in the generated shell: bundled template → path inside\n * `.ekanos/harness/`. The ten route files are mechanically derivable from the\n * export map alone — which is the test of whether the package boundary is in\n * the right place. If a shell file ever needs a judgment call, the boundary\n * has moved, not the template.\n *\n * `app/api/integrations/[slug]/[...path]/route.ts` is the shell's one SERVER\n * route: it injects the registry into `@ekanos/harness/api`, which serves the\n * live-mode OAuth loop, storage bridge and trigger route over a server-held\n * context. It is the third registry injection point, beside the two pages.\n *\n * `app/harness-shell.tsx` exists because a `HarnessIntegration` holds React\n * component references and MCP `run` functions. Next cannot serialize those\n * across a server→client boundary, so the `'use client'` mark has to sit ABOVE\n * the point where the registry is injected — hence a client shell of its own\n * rather than a client `RootLayout` called from a server layout. Keeping\n * `app/page.tsx` a server component is what lets `/` prerender static.\n */\nexport const SHELL_FILES: readonly { template: string; dest: string }[] = [\n  { template: 'harness/app/layout.tsx.tmpl', dest: 'app/layout.tsx' },\n  {\n    template: 'harness/app/harness-shell.tsx.tmpl',\n    dest: 'app/harness-shell.tsx',\n  },\n  { template: 'harness/app/page.tsx.tmpl', dest: 'app/page.tsx' },\n  {\n    template: 'harness/app/[slug]/layout.tsx.tmpl',\n    dest: 'app/[slug]/layout.tsx',\n  },\n  {\n    template: 'harness/app/[slug]/page.tsx.tmpl',\n    dest: 'app/[slug]/page.tsx',\n  },\n  {\n    template: 'harness/app/[slug]/widgets/page.tsx.tmpl',\n    dest: 'app/[slug]/widgets/page.tsx',\n  },\n  {\n    template: 'harness/app/[slug]/widgets/[widgetId]/page.tsx.tmpl',\n    dest: 'app/[slug]/widgets/[widgetId]/page.tsx',\n  },\n  {\n    template: 'harness/app/[slug]/tile/page.tsx.tmpl',\n    dest: 'app/[slug]/tile/page.tsx',\n  },\n  {\n    template: 'harness/app/[slug]/activation/page.tsx.tmpl',\n    dest: 'app/[slug]/activation/page.tsx',\n  },\n  {\n    template: 'harness/app/[slug]/triggers/page.tsx.tmpl',\n    dest: 'app/[slug]/triggers/page.tsx',\n  },\n  {\n    template: 'harness/app/api/integrations/[slug]/[...path]/route.ts.tmpl',\n    dest: 'app/api/integrations/[slug]/[...path]/route.ts',\n  },\n  { template: 'harness/next.config.mjs.tmpl', dest: 'next.config.mjs' },\n  { template: 'harness/postcss.config.mjs.tmpl', dest: 'postcss.config.mjs' },\n  { template: 'harness/tsconfig.json.tmpl', dest: 'tsconfig.json' },\n  { template: 'harness/styles/globals.css.tmpl', dest: 'styles/globals.css' },\n  { template: 'harness/package.json.tmpl', dest: 'package.json' },\n  {\n    template: 'harness/types/team-accounts.d.ts.tmpl',\n    dest: 'types/team-accounts.d.ts',\n  },\n];\n\n/**\n * Packages the shell needs to resolve upward out of the partner's own\n * `node_modules`. The shell declares no dependencies of its own by design, so\n * a missing one shows up as an opaque Next resolution error at dev-server\n * start; checking here turns that into one precondition with one fix.\n */\nexport const REQUIRED_DEPENDENCIES = [\n  HARNESS_PACKAGE,\n  'next',\n  'react',\n  'react-dom',\n  'tailwindcss',\n  '@tailwindcss/postcss',\n] as const;\n\nexport interface WrittenFiles {\n  created: string[];\n  updated: string[];\n  unchanged: string[];\n}\n\n/**\n * Read an installed package's `package.json` out of a project's TOP-LEVEL\n * `node_modules`. Resolved by direct path join rather than `require.resolve`\n * on purpose, for two independent reasons:\n *\n *  - The CLI runs from its own install and must read the version of the copy\n *    in THE CALLER'S project, not one hoisted next to itself.\n *  - Several of the packages this reads (`@ekanos/integration-schema`\n *    included) declare an `exports` map with no `./package.json` subpath, so\n *    `require.resolve('<pkg>/package.json')` throws\n *    `ERR_PACKAGE_PATH_NOT_EXPORTED` under Node's ESM resolver. A plain file\n *    read is not subject to the export map at all.\n *\n * Shared by every \"what does this project have installed?\" check in the\n * CLI — `readInstalledHarness` below, the schema-skew gate, and `upgrade`'s\n * current-toolchain report — so there is exactly one implementation of \"read\n * a package's on-disk version\", not a subtly different one per call site.\n */\nexport interface InstalledPackage {\n  version: string;\n  /** The raw package.json, for callers that need more than the version. */\n  manifest: unknown;\n}\n\nexport function readInstalledPackageManifest(\n  projectDir: string,\n  packageName: string,\n): InstalledPackage | null {\n  const manifestPath = path.join(\n    projectDir,\n    'node_modules',\n    ...packageName.split('/'),\n    'package.json',\n  );\n  if (!fs.existsSync(manifestPath)) return null;\n\n  try {\n    const parsed: unknown = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));\n    const version =\n      typeof parsed === 'object' && parsed !== null\n        ? (parsed as { version?: unknown }).version\n        : undefined;\n    if (typeof version !== 'string' || version.length === 0) return null;\n    return { version, manifest: parsed };\n  } catch (error) {\n    throw preconditionError(\n      `${packageName}'s package.json in node_modules is unreadable: ${\n        error instanceof Error ? error.message : String(error)\n      }`,\n      `Reinstall dependencies in ${projectDir} so ${packageName} resolves.`,\n    );\n  }\n}\n\n/** Read the installed `@ekanos/harness` version out of the partner's project. */\nexport type InstalledHarness = InstalledPackage;\n\nexport function readInstalledHarness(\n  projectDir: string,\n): InstalledHarness | null {\n  return readInstalledPackageManifest(projectDir, HARNESS_PACKAGE);\n}\n\n/** Just the installed version, for callers that need nothing else. */\nexport function readInstalledHarnessVersion(projectDir: string): string | null {\n  return readInstalledHarness(projectDir)?.version ?? null;\n}\n\n/** Which of `REQUIRED_DEPENDENCIES` are not installed in the project root. */\nexport function missingDependencies(projectDir: string): string[] {\n  return REQUIRED_DEPENDENCIES.filter(\n    (name) =>\n      !fs.existsSync(\n        path.join(projectDir, 'node_modules', name, 'package.json'),\n      ),\n  );\n}\n\n/**\n * What generated an existing shell.\n *\n * All three fields matter, and recording only `harness` was a real hole: the\n * templates ship with the CLI, so a shell can be stale because the CLI changed\n * while the harness did not. `templates` is the authoritative one — it is a\n * hash of the template sources, so it moves whenever what we generate moves,\n * including for a CLI build that never shipped a version bump.\n */\nexport interface ShellMarker {\n  harness: string;\n  /** null for a legacy bare-version marker written before this was recorded. */\n  cli: string | null;\n  templates: string | null;\n}\n\n/**\n * Three outcomes, not two, because \"no marker\" and \"unreadable marker\" call\n * for opposite responses.\n *\n * A marker's PRESENCE is itself evidence the tree is ours — a squatter does\n * not write `.ekanos-version` — and the likeliest cause of an unreadable one\n * is our own interrupted write. Everything under `.ekanos/harness/` is\n * CLI-owned, gitignored and reproducible from the templates, so regenerating\n * destroys nothing: there is no value at risk to justify charging a partner a\n * confusing `--force` to recover from our own bad write.\n *\n * An ABSENT marker over a non-empty tree is the opposite: nothing says the\n * files are ours, so we refuse. That is the L1 rule and it stays.\n */\nexport type MarkerState =\n  | { kind: 'missing' }\n  | { kind: 'corrupt' }\n  | { kind: 'ok'; marker: ShellMarker };\n\nexport function readShellMarkerState(harnessDir: string): MarkerState {\n  const marker = path.join(harnessDir, VERSION_MARKER);\n  if (classifyPath(marker) !== 'file') return { kind: 'missing' };\n\n  const raw = (readFileNoFollow(harnessDir, marker) ?? '').trim();\n  if (raw.length === 0) return { kind: 'corrupt' };\n\n  const parsed = parseMarker(raw);\n  return parsed === null ? { kind: 'corrupt' } : { kind: 'ok', marker: parsed };\n}\n\nfunction parseMarker(raw: string): ShellMarker | null {\n  // v1 markers were a bare version string. Read them rather than crashing, and\n  // report the unknown fields as null so the shell counts as stale and is\n  // regenerated once — which is the correct outcome for an upgrade.\n  //\n  // It must actually LOOK like a version: without this, any garbage that does\n  // not happen to start with `{` — a truncated write, a stray word — reads as\n  // a legacy marker named after the garbage, and the corrupt-marker path never\n  // fires. That is how a truncated `.ekanos-version` was silently reported as\n  // \"@ekanos/harness truncat → 0.1.0\" instead of \"unreadable\".\n  if (!raw.startsWith('{')) {\n    return /^\\d+\\.\\d+/.test(raw)\n      ? { harness: raw, cli: null, templates: null }\n      : null;\n  }\n\n  try {\n    const parsed: unknown = JSON.parse(raw);\n    if (typeof parsed !== 'object' || parsed === null) return null;\n    const record = parsed as Record<string, unknown>;\n    const harness = record.harness;\n    if (typeof harness !== 'string') return null;\n    return {\n      harness,\n      cli: typeof record.cli === 'string' ? record.cli : null,\n      templates: typeof record.templates === 'string' ? record.templates : null,\n    };\n  } catch {\n    return null;\n  }\n}\n\n/** The parsed marker, or null when it is absent OR unreadable. */\nexport function readShellMarker(harnessDir: string): ShellMarker | null {\n  const state = readShellMarkerState(harnessDir);\n  return state.kind === 'ok' ? state.marker : null;\n}\n\n/** The `@ekanos/harness` version an existing shell was generated against. */\nexport function readShellVersion(harnessDir: string): string | null {\n  return readShellMarker(harnessDir)?.harness ?? null;\n}\n\nfunction serializeMarker(marker: ShellMarker): string {\n  return `${JSON.stringify(marker, null, 2)}\\n`;\n}\n\n/**\n * Write a generated file, but ONLY when its bytes would change.\n *\n * This is what makes a re-run cheap and a watcher quiet: an unchanged file is\n * not rewritten, so its mtime does not move and Next's dev server does not\n * rebuild. It also means a hand-edit inside the CLI-owned tree is silently\n * corrected on the next run, which is the intended contract for `.ekanos/`.\n */\nexport function writeIfChanged(\n  root: string,\n  destPath: string,\n  contents: string,\n  into: WrittenFiles,\n  label: string,\n  force: boolean,\n): void {\n  // `classifyPath` uses lstat, so a symlink here is reported as a symlink\n  // rather than as whatever it points at — including a DANGLING one, which\n  // `existsSync` would call absent and a plain write would then materialize\n  // outside the project.\n  const kind = classifyPath(destPath);\n  const exists = kind !== 'missing';\n\n  if (\n    !force &&\n    kind === 'file' &&\n    readFileNoFollow(root, destPath) === contents\n  ) {\n    into.unchanged.push(label);\n    return;\n  }\n\n  writeFileNoFollow(root, destPath, contents);\n  (exists ? into.updated : into.created).push(label);\n}\n\nexport interface ScaffoldShellArgs {\n  projectDir: string;\n  slug: string;\n  harnessVersion: string;\n  /** Rewrite every file even when its bytes already match. */\n  force: boolean;\n  /** Extra Tailwind @source globs from ekanos.json, already validated. */\n  sourceGlobs?: readonly string[];\n}\n\nexport interface ScaffoldShellResult extends WrittenFiles {\n  harnessDir: string;\n  /** The version the shell carried before this run — null on a first run. */\n  previousVersion: string | null;\n  /** What generated the previous shell, or null on a first run. */\n  previousMarker: ShellMarker | null;\n  /** True when anything that generated the shell has since changed. */\n  stale: boolean;\n  /** `.next` under the shell was deleted because the shell was stale. */\n  buildCacheCleared: boolean;\n  /**\n   * Which of harness / cli / templates moved. Empty on a first run; this is\n   * what lets `dev` say WHY it regenerated rather than just that it did.\n   */\n  staleReasons: string[];\n}\n\n/**\n * Generate `.ekanos/harness/**` for `harnessVersion`. Every file here is\n * CLI-owned and gitignored, so regeneration needs no permission and asks no\n * question — the partner owns `harness.config.ts` and their integration\n * source, and nothing else.\n */\nexport function scaffoldShell(args: ScaffoldShellArgs): ScaffoldShellResult {\n  const harnessDir = path.join(args.projectDir, HARNESS_DIR);\n  assertShellDirIsOurs(harnessDir, args.force);\n\n  const markerState = readShellMarkerState(harnessDir);\n  const previousMarker = markerState.kind === 'ok' ? markerState.marker : null;\n  const previousVersion = previousMarker?.harness ?? null;\n  const marker: ShellMarker = {\n    harness: args.harnessVersion,\n    cli: cliVersion(),\n    templates: templatesFingerprint(SHELL_FILES.map((f) => f.template)),\n  };\n\n  // A shell is current only if EVERYTHING that produced it is unchanged.\n  // Checking the harness version alone certified shells generated by an older\n  // CLI, against templates that had since moved, as up to date.\n  const staleReasons: string[] = [];\n  if (markerState.kind === 'corrupt') {\n    staleReasons.push(\n      `${VERSION_MARKER} was unreadable, so the existing shell could not be ` +\n        'certified',\n    );\n  }\n  if (previousMarker !== null) {\n    if (previousMarker.harness !== marker.harness) {\n      staleReasons.push(\n        `@ekanos/harness ${previousMarker.harness} → ${marker.harness}`,\n      );\n    }\n    if (previousMarker.cli !== marker.cli) {\n      staleReasons.push(\n        `@ekanos/cli ${previousMarker.cli ?? 'unknown'} → ${marker.cli}`,\n      );\n    }\n    if (previousMarker.templates !== marker.templates) {\n      staleReasons.push('the shell templates changed');\n    }\n  }\n  const stale = staleReasons.length > 0;\n\n  // Next's persistent dev cache was built from the OLD shell and the OLD\n  // toolchain. Keeping it across a regeneration served a corrupted Tailwind\n  // candidate on the 0.1 → 0.4 jump (every page a build-error overlay until\n  // someone deleted the directory by hand). The shell knows it is stale; the\n  // cache goes with it.\n  const buildCacheDir = path.join(harnessDir, BUILD_CACHE_DIR);\n  const buildCacheCleared = stale && fs.existsSync(buildCacheDir);\n  if (buildCacheCleared) {\n    fs.rmSync(buildCacheDir, { recursive: true, force: true });\n  }\n\n  const files: WrittenFiles = { created: [], updated: [], unchanged: [] };\n  const vars = {\n    SLUG: args.slug,\n    SOURCE_GLOBS: renderSourceGlobs(args.sourceGlobs ?? []),\n  };\n\n  for (const { template, dest } of SHELL_FILES) {\n    writeIfChanged(\n      args.projectDir,\n      path.join(harnessDir, dest),\n      readTemplate(template, vars),\n      files,\n      dest,\n      args.force,\n    );\n  }\n\n  writeIfChanged(\n    args.projectDir,\n    path.join(harnessDir, VERSION_MARKER),\n    serializeMarker(marker),\n    files,\n    VERSION_MARKER,\n    args.force,\n  );\n\n  return {\n    ...files,\n    harnessDir,\n    previousVersion,\n    previousMarker,\n    stale,\n    staleReasons,\n    buildCacheCleared,\n  };\n}\n\n/**\n * Turn validated `sourceGlobs` into the `@source` lines the generated\n * stylesheet carries, each relative to the shell's `styles/` directory.\n *\n * Tailwind never scans what it is not pointed at, and a glob that matches\n * nothing fails silently — so an integration living outside the default\n * layout renders completely unstyled with no error anywhere. That is what\n * `sourceGlobs` is for, and until now it was parsed and thrown away.\n */\nfunction renderSourceGlobs(globs: readonly string[]): string {\n  if (globs.length === 0) return '';\n  const lines = globs.map((glob) => `@source '${SHELL_TO_PROJECT}${glob}';`);\n  return `\\n/* From \"sourceGlobs\" in ekanos.json. */\\n${lines.join('\\n')}\\n`;\n}\n\n/** From `.ekanos/harness/styles/` back up to the project root. */\nconst SHELL_TO_PROJECT = '../../../';\n\n/**\n * Establish that `.ekanos/harness` is a tree WE generated before writing a\n * single byte into it, and return the version marker it carried.\n *\n * Path location alone is not ownership. A directory that exists but carries no\n * `.ekanos-version` was put there by something else — a partner, another tool,\n * a symlink — and clobbering it because it happens to sit at the path we like\n * is the same class of mistake as following a symlink. An empty directory is\n * fine (that is just `mkdir -p` having run), and `--force` is the explicit\n * override.\n *\n * Runs BEFORE `bootstrapHarnessConfig` in `dev`, so a shell that cannot be\n * written leaves the project completely untouched rather than half-scaffolded.\n */\nexport function assertShellDirIsOurs(\n  harnessDir: string,\n  force: boolean,\n): string | null {\n  // `.ekanos` first: through a symlinked `.ekanos`, the lstat below would\n  // describe the link's target, and the build-cache `rmSync` would delete\n  // outside the project.\n  const ekanosDir = path.dirname(harnessDir);\n  const parentKind = classifyPath(ekanosDir);\n  if (parentKind === 'symlink') {\n    throw invalidStateError(\n      `${ekanosDir} is a symlink, so \"ekanos dev\" will not write through it.`,\n      `Delete the ${ekanosDir} link and re-run \"ekanos dev\" — the shell is ` +\n        'generated, so nothing is lost.',\n    );\n  }\n  if (parentKind !== 'missing' && parentKind !== 'directory') {\n    throw invalidStateError(\n      `${ekanosDir} exists and is not a directory.`,\n      `Move or delete ${ekanosDir}, then re-run \"ekanos dev\".`,\n    );\n  }\n\n  const kind = classifyPath(harnessDir);\n\n  if (kind === 'symlink') {\n    throw invalidStateError(\n      `${harnessDir} is a symlink, so \"ekanos dev\" will not write through it.`,\n      `Delete ${harnessDir} and re-run \"ekanos dev\" — the shell is generated, ` +\n        'so nothing is lost.',\n    );\n  }\n\n  if (kind !== 'missing' && kind !== 'directory') {\n    throw invalidStateError(\n      `${harnessDir} exists and is not a directory.`,\n      `Move or delete ${harnessDir}, then re-run \"ekanos dev\".`,\n    );\n  }\n\n  if (kind === 'missing') return null;\n\n  const state = readShellMarkerState(harnessDir);\n\n  // A marker we wrote, however mangled, still identifies the tree as ours.\n  if (state.kind === 'ok') return state.marker.harness;\n  if (state.kind === 'corrupt' || force) return null;\n\n  if (fs.readdirSync(harnessDir).length === 0) return null;\n\n  throw invalidStateError(\n    `${harnessDir} already contains files but no ${VERSION_MARKER} marker, ` +\n      'so it was not generated by \"ekanos dev\".',\n    `Delete ${harnessDir} if you do not need it, or pass --force to ` +\n      'overwrite it. Everything \"ekanos dev\" generates is reproducible; ' +\n      'anything else in there is not.',\n  );\n}\n\n/**\n * The module specifier `harness.config.ts` uses to import the partner's\n * integration: the `entry` from ekanos.json, made relative and extension-free.\n * \"src/integration.ts\" → \"src/integration\".\n */\nexport function entryImportSpecifier(entry: string): string {\n  const normalized = entry.split(path.sep).join('/').replace(/^\\.\\//, '');\n  return normalized.replace(/\\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/, '');\n}\n\n/**\n * The same specifier as a JavaScript string LITERAL, ready to drop into a\n * generated `import` statement.\n *\n * `entry` is attacker-influenced data from `ekanos.json`, and a POSIX filename\n * may legally contain a quote or a newline. Interpolating it raw would let a\n * crafted-but-valid path close the string and append statements to the module\n * we generate. `JSON.stringify` produces a correctly escaped literal, which is\n * the actual fix; the explicit rejection below is a second line that also\n * gives the partner a comprehensible error instead of a bizarre filename\n * silently appearing, escaped, in their config.\n *\n * This does not cross a trust boundary on its own — a partner's own code runs\n * unsandboxed anyway — but \"the templates cannot be injected into\" is a claim\n * we make, and it should be true.\n */\nexport function entryImportLiteral(entry: string): string {\n  const specifier = entryImportSpecifier(entry);\n\n  // eslint-disable-next-line no-control-regex\n  if (/[\"'`\\\\\\n\\r\\u0000-\\u001f]/.test(specifier)) {\n    throw preconditionError(\n      `The \"entry\" in ekanos.json contains characters that cannot appear in ` +\n        `an import specifier: ${JSON.stringify(specifier)}.`,\n      'Rename the file so its path has no quotes, backslashes or control ' +\n        'characters, then update \"entry\" in ekanos.json to match.',\n    );\n  }\n\n  return JSON.stringify(`./${specifier}`);\n}\n\nexport interface BootstrapConfigResult {\n  /** True only when this run created the file. */\n  bootstrapped: boolean;\n  configPath: string;\n}\n\n/**\n * Write a starter `harness.config.ts` at the project root — ONCE.\n *\n * An existing file is left strictly alone, byte for byte, and no flag changes\n * that: it is the one harness file the partner owns, it is git-tracked, and\n * regenerating it would throw away their fixtures. `--force` regenerates the\n * shell, never this.\n */\nexport function bootstrapHarnessConfig(\n  projectDir: string,\n  integrations: readonly { slug: string; entry: string }[],\n): BootstrapConfigResult {\n  const configPath = path.join(projectDir, HARNESS_CONFIG_FILENAME);\n  const kind = classifyPath(configPath);\n\n  // A symlink here — including a dangling one, which `existsSync` reports as\n  // absent — would have us write through to its target. Since this file is the\n  // partner's to own, the only safe answer is to touch nothing and say why.\n  if (kind === 'symlink') {\n    throw invalidStateError(\n      `${configPath} is a symlink, so \"ekanos dev\" will not write through it.`,\n      `Replace ${configPath} with a real file (or delete it to have one ` +\n        'generated), then re-run \"ekanos dev\".',\n    );\n  }\n\n  if (kind !== 'missing') {\n    return { bootstrapped: false, configPath };\n  }\n\n  writeFileNoFollow(projectDir, configPath, renderHarnessConfig(integrations));\n\n  return { bootstrapped: true, configPath };\n}\n\n/**\n * Render the starter registry for EVERY integration the project declares.\n *\n * The harness registry is an array and `ekanos.json` can now hold a list, so a\n * project's second integration reaches the harness the same way its first\n * does. Each entry imports the definition under a distinct local identifier\n * derived from its slug, because two `integration` imports in one module do\n * not compile.\n */\nfunction renderHarnessConfig(\n  integrations: readonly { slug: string; entry: string }[],\n): string {\n  const imports: string[] = [];\n  const entries: string[] = [];\n\n  for (const integration of integrations) {\n    const ident = identifierForSlug(integration.slug);\n    imports.push(\n      `import { integration as ${ident} } from ${entryImportLiteral(\n        integration.entry,\n      )};`,\n    );\n    entries.push(\n      readTemplate('harness.config.entry.ts.tmpl', {\n        IDENT: ident,\n        SLUG: integration.slug,\n      }),\n    );\n  }\n\n  return readTemplate('harness.config.ts.tmpl', {\n    INTEGRATION_IMPORTS: imports.join('\\n'),\n    INTEGRATION_ENTRIES: entries.join(''),\n  });\n}\n\n/**\n * \"acme-crm\" → \"acmeCrm\". A slug is kebab-case by schema, so this only has to\n * handle hyphens, and a leading digit is impossible.\n */\nexport function identifierForSlug(slug: string): string {\n  const camel = slug.replace(/-([a-z0-9])/g, (_, char: string) =>\n    char.toUpperCase(),\n  );\n  return /^[0-9]/.test(camel) ? `i${camel}` : camel;\n}\n\n/**\n * Add `.ekanos/` to the project `.gitignore`, exactly once.\n *\n * Matching is line-wise over the spellings git treats as the same rule\n * (`.ekanos`, `.ekanos/`, `/.ekanos/`), so re-running never appends a\n * duplicate — the thing that makes a scaffold verb safe to run in a loop.\n * A negation (`!.ekanos/`) is deliberately NOT treated as a match: the\n * partner meant to un-ignore it, and we do not fight that silently.\n */\nexport function ensureGitignoreEntry(projectDir: string): boolean {\n  const gitignorePath = path.join(projectDir, '.gitignore');\n  const block = `# Ekanos dev harness — generated by \"ekanos dev\", never edited by hand\\n${GITIGNORE_ENTRY}\\n`;\n\n  const kind = classifyPath(gitignorePath);\n\n  if (kind === 'symlink') {\n    throw invalidStateError(\n      `${gitignorePath} is a symlink, so \"ekanos dev\" will not append to it.`,\n      `Add \"${GITIGNORE_ENTRY}\" to your real .gitignore yourself, or replace ` +\n        `${gitignorePath} with a regular file, then re-run \"ekanos dev\".`,\n    );\n  }\n\n  if (kind === 'missing') {\n    writeFileNoFollow(projectDir, gitignorePath, block);\n    return true;\n  }\n\n  const existing = readFileNoFollow(projectDir, gitignorePath) ?? '';\n  if (gitignoreCovers(existing)) return false;\n\n  const separator =\n    existing.length === 0 || existing.endsWith('\\n') ? '' : '\\n';\n  appendFileNoFollow(projectDir, gitignorePath, `${separator}\\n${block}`);\n  return true;\n}\n\nfunction gitignoreCovers(source: string): boolean {\n  const equivalents = new Set(['.ekanos', '.ekanos/', '/.ekanos', '/.ekanos/']);\n  return source\n    .split('\\n')\n    .map((line) => line.trim())\n    .some((line) => equivalents.has(line));\n}\n"]}

package/dist/index.d.ts

@@ -19,6 +19,12 @@ export interface RunOptions {
     /** Test-only answers for `apps set` / `teams app set` questions — never set from real CLI wiring. */
     ask?: (question: string) => Promise<string>;
     askSecret?: (question: string) => Promise<string>;
+    /**
+     * Test-only seams for `teams connect`: the browser opener and the wait
+     * between its polls. Never set from real CLI wiring.
+     */
+    openUrl?: (url: string) => void;
+    pollDelayMs?: number;
     /**
      * Test-only override for `status --watch`'s poll delay — see `StatusArgs`
      * in `commands/status.ts`. Never set this from real CLI wiring; it exists