@ekanos/cli 0.16.0 → 0.17.1

package/dist/harness-scaffold.d.ts

@@ -15,25 +15,30 @@ export declare const BUILD_CACHE_DIR = ".next";
 export declare const VERSION_MARKER = ".ekanos-version";
 /** The partner-owned registry, at the PROJECT ROOT. Never regenerated. */
 export declare const HARNESS_CONFIG_FILENAME = "harness.config.ts";
+/** An experience's generated, empty registry, inside the shell. */
+export declare const SHELL_REGISTRY_FILENAME = "harness.config.ts";
 /**
- * Every file in the generated shell: bundled template → path inside
- * `.ekanos/harness/`. The ten route files are mechanically derivable from the
- * export map alone — which is the test of whether the package boundary is in
- * the right place. If a shell file ever needs a judgment call, the boundary
- * has moved, not the template.
- *
- * `app/api/integrations/[slug]/[...path]/route.ts` is the shell's one SERVER
- * route: it injects the registry into `@ekanos/harness/api`, which serves the
- * live-mode OAuth loop, storage bridge and trigger route over a server-held
- * context. It is the third registry injection point, beside the two pages.
- *
- * `app/harness-shell.tsx` exists because a `HarnessIntegration` holds React
- * component references and MCP `run` functions. Next cannot serialize those
- * across a server→client boundary, so the `'use client'` mark has to sit ABOVE
- * the point where the registry is injected — hence a client shell of its own
- * rather than a client `RootLayout` called from a server layout. Keeping
- * `app/page.tsx` a server component is what lets `/` prerender static.
+ * The Integration console (`/integrations/**`). Generated for every project:
+ * an integration repo's home, and half of an experience repo's.
  */
+export declare const CONSOLE_SHELL_FILES: readonly {
+    template: string;
+    dest: string;
+}[];
+/**
+ * The Experience view (`/experience/**`), generated only for `kind:
+ * "experience"`. Its layout imports the experience entry (the widgets and
+ * pages are React components that only the project's own module holds), and
+ * the home page redirects here.
+ */
+export declare const EXPERIENCE_SHELL_FILES: readonly {
+    template: string;
+    dest: string;
+}[];
+export declare const REPO_SHELL_ONLY_FILES: readonly {
+    template: string;
+    dest: string;
+}[];
 export declare const SHELL_FILES: readonly {
     template: string;
     dest: string;
@@ -140,6 +145,25 @@ export interface ScaffoldShellArgs {
     force: boolean;
     /** Extra Tailwind @source globs from ekanos.json, already validated. */
     sourceGlobs?: readonly string[];
+    /**
+     * Set for a `kind: "experience"` project: its entry (project-relative). The
+     * Experience view is generated, and mounts the entry's widgets and pages.
+     */
+    experienceEntry?: string;
+    /** Set when `projectDir` is a repo root: the packages the shell serves. */
+    repo?: RepoShellPackages;
+}
+/** Package directories and entries are relative to the repo root. */
+export interface RepoShellPackages {
+    integrations: readonly {
+        name: string;
+        dir: string;
+    }[];
+    experiences: readonly {
+        name: string;
+        dir: string;
+        entry: string;
+    }[];
 }
 export interface ScaffoldShellResult extends WrittenFiles {
     harnessDir: string;
@@ -164,6 +188,16 @@ export interface ScaffoldShellResult extends WrittenFiles {
  * source, and nothing else.
  */
 export declare function scaffoldShell(args: ScaffoldShellArgs): ScaffoldShellResult;
+/** The shell file set: the legacy shell + console, plus the Experience view for an experience. */
+export declare function shellFilesFor(experience: boolean): readonly {
+    template: string;
+    dest: string;
+}[];
+/** The repo shell file set. */
+export declare function repoShellFiles(): readonly {
+    template: string;
+    dest: string;
+}[];
 /**
  * Establish that `.ekanos/harness` is a tree WE generated before writing a
  * single byte into it, and return the version marker it carried.
@@ -201,7 +235,7 @@ export declare function entryImportSpecifier(entry: string): string;
  * unsandboxed anyway — but "the templates cannot be injected into" is a claim
  * we make, and it should be true.
  */
-export declare function entryImportLiteral(entry: string): string;
+export declare function entryImportLiteral(entry: string, prefix?: string): string;
 export interface BootstrapConfigResult {
     /** True only when this run created the file. */
     bootstrapped: boolean;

package/dist/harness-scaffold.js

@@ -21,6 +21,16 @@ export const BUILD_CACHE_DIR = '.next';
 export const VERSION_MARKER = '.ekanos-version';
 /** The partner-owned registry, at the PROJECT ROOT. Never regenerated. */
 export const HARNESS_CONFIG_FILENAME = 'harness.config.ts';
+/** An experience's generated, empty registry, inside the shell. */
+export const SHELL_REGISTRY_FILENAME = 'harness.config.ts';
+/**
+ * Re-point a shell file's import of the project-root registry at the shell's
+ * own: the shell sits two directories below the root, so the specifier loses
+ * exactly two `../`.
+ */
+function pointAtShellRegistry(source) {
+    return source.replace(/((?:\.\.\/){3,})harness\.config(['"])/g, (_match, ups, quote) => `${ups.slice(6)}harness.config${quote}`);
+}
 /**
  * Every file in the generated shell: bundled template → path inside
  * `.ekanos/harness/`. The ten route files are mechanically derivable from the
@@ -40,6 +50,89 @@ export const HARNESS_CONFIG_FILENAME = 'harness.config.ts';
  * rather than a client `RootLayout` called from a server layout. Keeping
  * `app/page.tsx` a server component is what lets `/` prerender static.
  */
+const consolePage = (dest) => ({
+    template: `harness/app/${dest}.tmpl`,
+    dest: `app/${dest}`,
+});
+/**
+ * The Integration console (`/integrations/**`). Generated for every project:
+ * an integration repo's home, and half of an experience repo's.
+ */
+export const CONSOLE_SHELL_FILES = [
+    'integrations/layout.tsx',
+    'integrations/page.tsx',
+    'integrations/[slug]/page.tsx',
+    'integrations/[slug]/connect/page.tsx',
+    'integrations/[slug]/operations/page.tsx',
+    'integrations/[slug]/operations/[kind]/[name]/page.tsx',
+    'integrations/[slug]/events/page.tsx',
+    'integrations/[slug]/health/page.tsx',
+    'integrations/[slug]/runs/page.tsx',
+    'integrations/[slug]/preview/layout.tsx',
+    'integrations/[slug]/preview/page.tsx',
+    'integrations/[slug]/preview/widgets/page.tsx',
+    'integrations/[slug]/preview/widgets/[widgetId]/page.tsx',
+    'integrations/[slug]/preview/tile/page.tsx',
+    'integrations/[slug]/preview/activation/page.tsx',
+    'integrations/[slug]/preview/triggers/page.tsx',
+].map(consolePage);
+/**
+ * The Experience view (`/experience/**`), generated only for `kind:
+ * "experience"`. Its layout imports the experience entry (the widgets and
+ * pages are React components that only the project's own module holds), and
+ * the home page redirects here.
+ */
+export const EXPERIENCE_SHELL_FILES = [
+    ...[
+        'experience/layout.tsx',
+        'experience/page.tsx',
+        'experience/widgets/page.tsx',
+        'experience/widgets/[id]/page.tsx',
+        'experience/pages/[id]/page.tsx',
+        'experience/workflows/page.tsx',
+        'experience/workflows/[id]/page.tsx',
+        'experience/review-queue/page.tsx',
+        'experience/runs/page.tsx',
+    ].map(consolePage),
+    { template: 'harness/app/page.experience.tsx.tmpl', dest: 'app/page.tsx' },
+];
+/**
+ * The repo shell (`ekanos dev` at a repo root). It is the ordinary shell with
+ * the single-project home, console layout and API route swapped for the repo's:
+ * the repo home and Connections under a `(repo)` route group, each integration
+ * package's console under `/integrations/<name>`, each experience package's
+ * view under `/experiences/<name>`, and one API route that answers the repo
+ * overview and forwards to a package's own harness API.
+ */
+const REPO_REPLACED_DESTS = new Set([
+    'app/page.tsx',
+    'app/harness-shell.tsx',
+    'app/integrations/layout.tsx',
+    'app/integrations/page.tsx',
+    'app/%5F%5Fekanos/api/[...path]/route.ts',
+]);
+const repoTemplate = (dest) => ({
+    template: `harness/repo/app/${dest}.tmpl`,
+    dest: `app/${dest}`,
+});
+export const REPO_SHELL_ONLY_FILES = [
+    'harness-shell.tsx',
+    '(repo)/layout.tsx',
+    '(repo)/page.tsx',
+    '(repo)/connections/page.tsx',
+    'integrations/page.tsx',
+    'integrations/[slug]/layout.tsx',
+    'experiences/page.tsx',
+    'experiences/[name]/layout.tsx',
+    'experiences/[name]/connect/page.tsx',
+    '%5F%5Fekanos/api/[...path]/route.ts',
+].map(repoTemplate);
+/** The Experience view's pages, re-homed under `/experiences/[name]`. */
+const REPO_EXPERIENCE_PAGES = EXPERIENCE_SHELL_FILES.filter((file) => file.dest.startsWith('app/experience/') &&
+    file.dest !== 'app/experience/layout.tsx').map((file) => ({
+    template: file.template,
+    dest: file.dest.replace('app/experience/', 'app/experiences/[name]/'),
+}));
 export const SHELL_FILES = [
     { template: 'harness/app/layout.tsx.tmpl', dest: 'app/layout.tsx' },
     {
@@ -79,6 +172,11 @@ export const SHELL_FILES = [
         template: 'harness/app/api/integrations/[slug]/[...path]/route.ts.tmpl',
         dest: 'app/api/integrations/[slug]/[...path]/route.ts',
     },
+    {
+        template: 'harness/app/%5F%5Fekanos/api/[...path]/route.ts.tmpl',
+        dest: 'app/%5F%5Fekanos/api/[...path]/route.ts',
+    },
+    ...CONSOLE_SHELL_FILES,
     { template: 'harness/next.config.mjs.tmpl', dest: 'next.config.mjs' },
     { template: 'harness/postcss.config.mjs.tmpl', dest: 'postcss.config.mjs' },
     { template: 'harness/tsconfig.json.tmpl', dest: 'tsconfig.json' },
@@ -228,10 +326,13 @@ export function scaffoldShell(args) {
     const markerState = readShellMarkerState(harnessDir);
     const previousMarker = markerState.kind === 'ok' ? markerState.marker : null;
     const previousVersion = (_a = previousMarker === null || previousMarker === void 0 ? void 0 : previousMarker.harness) !== null && _a !== void 0 ? _a : null;
+    const shellFiles = args.repo
+        ? repoShellFiles()
+        : shellFilesFor(args.experienceEntry !== undefined);
     const marker = {
         harness: args.harnessVersion,
         cli: cliVersion(),
-        templates: templatesFingerprint(SHELL_FILES.map((f) => f.template)),
+        templates: templatesFingerprint(shellFiles.map((f) => f.template)),
     };
     // A shell is current only if EVERYTHING that produced it is unchanged.
     // Checking the harness version alone certified shells generated by an older
@@ -264,12 +365,19 @@ export function scaffoldShell(args) {
         fs.rmSync(buildCacheDir, { recursive: true, force: true });
     }
     const files = { created: [], updated: [], unchanged: [] };
-    const vars = {
-        SLUG: args.slug,
-        SOURCE_GLOBS: renderSourceGlobs((_c = args.sourceGlobs) !== null && _c !== void 0 ? _c : []),
-    };
-    for (const { template, dest } of SHELL_FILES) {
-        writeIfChanged(args.projectDir, path.join(harnessDir, dest), readTemplate(template, vars), files, dest, args.force);
+    const vars = Object.assign({ SLUG: args.slug, SOURCE_GLOBS: renderSourceGlobs((_c = args.sourceGlobs) !== null && _c !== void 0 ? _c : []), EXPERIENCE_ENTRY: args.experienceEntry === undefined
+            ? '""'
+            : entryImportLiteral(args.experienceEntry, SHELL_APP_TO_PROJECT) }, (args.repo ? renderRepoExperiences(args.repo) : {}));
+    const experience = args.experienceEntry !== undefined || args.repo !== undefined;
+    for (const { template, dest } of shellFiles) {
+        const rendered = readTemplate(template, vars);
+        writeIfChanged(args.projectDir, path.join(harnessDir, dest), experience ? pointAtShellRegistry(rendered) : rendered, files, dest, args.force);
+    }
+    // An experience registers no integration, so it has no project-root
+    // `harness.config.ts` to own: the shell carries its own (generated, empty)
+    // registry and the files above import that instead.
+    if (experience) {
+        writeIfChanged(args.projectDir, path.join(harnessDir, SHELL_REGISTRY_FILENAME), args.repo ? renderRepoRegistry(args.repo) : renderHarnessConfig([]), files, SHELL_REGISTRY_FILENAME, args.force);
     }
     writeIfChanged(args.projectDir, path.join(harnessDir, VERSION_MARKER), serializeMarker(marker), files, VERSION_MARKER, args.force);
     return Object.assign(Object.assign({}, files), { harnessDir,
@@ -279,6 +387,49 @@ export function scaffoldShell(args) {
         staleReasons,
         buildCacheCleared });
 }
+/**
+ * `app/repo-experiences.ts`: the experience entries, imported statically (they
+ * hold React components, which cannot cross the server/client boundary).
+ */
+function renderRepoExperiences(repo) {
+    const imports = [];
+    const entries = [];
+    repo.experiences.forEach((experience, index) => {
+        const ident = `experience${index}`;
+        imports.push(`import ${ident} from ${entryImportLiteral(`${experience.dir}/${experience.entry}`, 
+        // app/repo-experiences.ts sits one level above app/experience/.
+        '../../../')};`);
+        entries.push(`  ${JSON.stringify(experience.name)}: { widgets: ${ident}.widgets ?? [], pages: ${ident}.pages ?? [] },\n`);
+    });
+    return {
+        EXPERIENCE_IMPORTS: imports.join('\n'),
+        EXPERIENCE_ENTRIES: entries.join(''),
+    };
+}
+/**
+ * The shell's registry at a repo root: every integration package's own
+ * `harness.config.ts`, concatenated, so each integration's widgets, tile and
+ * activation surfaces and its OAuth routes keep working.
+ */
+function renderRepoRegistry(repo) {
+    const imports = repo.integrations.map((integration, index) => {
+        const specifier = JSON.stringify(`${SHELL_TO_PROJECT_REGISTRY}${integration.dir}/${path.basename(HARNESS_CONFIG_FILENAME, '.ts')}`);
+        return `import { harnessIntegrations as integration${index} } from ${specifier};`;
+    });
+    const spread = repo.integrations
+        .map((_, index) => `...integration${index}`)
+        .join(', ');
+    return [
+        '// Generated by `ekanos dev` at a repo root. Each integration package owns its own harness.config.ts.',
+        "import { defineHarnessConfig } from '@ekanos/harness/config';",
+        ...imports,
+        '',
+        `export const harnessIntegrations = defineHarnessConfig([${spread}]);`,
+        '',
+    ].join('\n');
+}
+/** From `.ekanos/harness/` (where the shell registry sits) up to the repo root. */
+const SHELL_TO_PROJECT_REGISTRY = '../../';
 /**
  * Turn validated `sourceGlobs` into the `@source` lines the generated
  * stylesheet carries, each relative to the shell's `styles/` directory.
@@ -294,6 +445,33 @@ function renderSourceGlobs(globs) {
     const lines = globs.map((glob) => `@source '${SHELL_TO_PROJECT}${glob}';`);
     return `\n/* From "sourceGlobs" in ekanos.json. */\n${lines.join('\n')}\n`;
 }
+/**
+ * From `.ekanos/harness/app/experience/` back up to the project root: the
+ * experience layout imports the entry by this relative path.
+ */
+const SHELL_APP_TO_PROJECT = '../../../../';
+/** The shell file set: the legacy shell + console, plus the Experience view for an experience. */
+export function shellFilesFor(experience) {
+    if (!experience)
+        return SHELL_FILES;
+    const replaced = new Set(EXPERIENCE_SHELL_FILES.map((f) => f.dest));
+    return [
+        ...SHELL_FILES.filter((f) => !replaced.has(f.dest)),
+        ...EXPERIENCE_SHELL_FILES,
+    ];
+}
+/** The repo shell file set. */
+export function repoShellFiles() {
+    return [
+        ...SHELL_FILES.filter((f) => !REPO_REPLACED_DESTS.has(f.dest)),
+        ...REPO_SHELL_ONLY_FILES,
+        ...REPO_EXPERIENCE_PAGES,
+        {
+            template: 'harness/repo/app/repo-experiences.ts.tmpl',
+            dest: 'app/repo-experiences.ts',
+        },
+    ];
+}
 /** From `.ekanos/harness/styles/` back up to the project root. */
 const SHELL_TO_PROJECT = '../../../';
 /**
@@ -371,7 +549,7 @@ export function entryImportSpecifier(entry) {
  * unsandboxed anyway — but "the templates cannot be injected into" is a claim
  * we make, and it should be true.
  */
-export function entryImportLiteral(entry) {
+export function entryImportLiteral(entry, prefix = './') {
     const specifier = entryImportSpecifier(entry);
     // eslint-disable-next-line no-control-regex
     if (/["'`\\\n\r\u0000-\u001f]/.test(specifier)) {
@@ -379,7 +557,7 @@ export function entryImportLiteral(entry) {
             `an import specifier: ${JSON.stringify(specifier)}.`, 'Rename the file so its path has no quotes, backslashes or control ' +
             'characters, then update "entry" in ekanos.json to match.');
     }
-    return JSON.stringify(`./${specifier}`);
+    return JSON.stringify(`${prefix}${specifier}`);
 }
 /**
  * Write a starter `harness.config.ts` at the project root — ONCE.
@@ -390,6 +568,8 @@ export function entryImportLiteral(entry) {
  * shell, never this.
  */
 export function bootstrapHarnessConfig(projectDir, integrations) {
+    // An experience project has no integration of its own to register: the
+    // harness serves its integrations from `ekanos.json` through /__ekanos/api.
     const configPath = path.join(projectDir, HARNESS_CONFIG_FILENAME);
     const kind = classifyPath(configPath);
     // A symlink here — including a dangling one, which `existsSync` reports as

package/dist/harness-scaffold.js.map

@@ -1 +1 @@
-{"version":3,"file":"harness-scaffold.js","sourceRoot":"","sources":["../src/harness-scaffold.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,gEAAgE;AAChE,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAEjD,qEAAqE;AACrE,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAE3D,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAAG,UAAU,CAAC;AAE1C;;;;;GAKG;AACH,yDAAyD;AACzD,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEhD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,WAAW,GAAkD;IACxE,EAAE,QAAQ,EAAE,6BAA6B,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACnE;QACE,QAAQ,EAAE,oCAAoC;QAC9C,IAAI,EAAE,uBAAuB;KAC9B;IACD,EAAE,QAAQ,EAAE,2BAA2B,EAAE,IAAI,EAAE,cAAc,EAAE;IAC/D;QACE,QAAQ,EAAE,oCAAoC;QAC9C,IAAI,EAAE,uBAAuB;KAC9B;IACD;QACE,QAAQ,EAAE,kCAAkC;QAC5C,IAAI,EAAE,qBAAqB;KAC5B;IACD;QACE,QAAQ,EAAE,0CAA0C;QACpD,IAAI,EAAE,6BAA6B;KACpC;IACD;QACE,QAAQ,EAAE,qDAAqD;QAC/D,IAAI,EAAE,wCAAwC;KAC/C;IACD;QACE,QAAQ,EAAE,uCAAuC;QACjD,IAAI,EAAE,0BAA0B;KACjC;IACD;QACE,QAAQ,EAAE,6CAA6C;QACvD,IAAI,EAAE,gCAAgC;KACvC;IACD;QACE,QAAQ,EAAE,2CAA2C;QACrD,IAAI,EAAE,8BAA8B;KACrC;IACD;QACE,QAAQ,EAAE,6DAA6D;QACvE,IAAI,EAAE,gDAAgD;KACvD;IACD,EAAE,QAAQ,EAAE,8BAA8B,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACrE,EAAE,QAAQ,EAAE,iCAAiC,EAAE,IAAI,EAAE,oBAAoB,EAAE;IAC3E,EAAE,QAAQ,EAAE,4BAA4B,EAAE,IAAI,EAAE,eAAe,EAAE;IACjE,EAAE,QAAQ,EAAE,iCAAiC,EAAE,IAAI,EAAE,oBAAoB,EAAE;IAC3E,EAAE,QAAQ,EAAE,2BAA2B,EAAE,IAAI,EAAE,cAAc,EAAE;IAC/D;QACE,QAAQ,EAAE,uCAAuC;QACjD,IAAI,EAAE,0BAA0B;KACjC;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,eAAe;IACf,MAAM;IACN,OAAO;IACP,WAAW;IACX,aAAa;IACb,sBAAsB;CACd,CAAC;AAgCX,MAAM,UAAU,4BAA4B,CAC1C,UAAkB,EAClB,WAAmB;IAEnB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAC5B,UAAU,EACV,cAAc,EACd,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EACzB,cAAc,CACf,CAAC;IACF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1E,MAAM,OAAO,GACX,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAC3C,CAAC,CAAE,MAAgC,CAAC,OAAO;YAC3C,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,iBAAiB,CACrB,GAAG,WAAW,kDACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,6BAA6B,UAAU,OAAO,WAAW,YAAY,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAKD,MAAM,UAAU,oBAAoB,CAClC,UAAkB;IAElB,OAAO,4BAA4B,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;AACnE,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,2BAA2B,CAAC,UAAkB;;;IAC5D,aAAO,MAAA,oBAAoB,CAAC,UAAU,CAAC,0CAAE,OAAO,mCAAI,IAAI,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,OAAO,qBAAqB,CAAC,MAAM,CACjC,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,EAAE,CAAC,UAAU,CACZ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,CAAC,CAC5D,CACJ,CAAC;AACJ,CAAC;AAqCD,MAAM,UAAU,oBAAoB,CAAC,UAAkB;;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACrD,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAEhE,MAAM,GAAG,GAAG,OAAC,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAEjD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,6EAA6E;IAC7E,wEAAwE;IACxE,kEAAkE;IAClE,EAAE;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,6DAA6D;IAC7D,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;YAC1B,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;YAC9C,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAiC,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC7C,OAAO;YACL,OAAO;YACP,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YACvD,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;SAC1E,CAAC;IACJ,CAAC;eAAO,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,KAAK,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,UAAkB;;;IACjD,aAAO,MAAA,eAAe,CAAC,UAAU,CAAC,0CAAE,OAAO,mCAAI,IAAI,CAAC;AACtD,CAAC;AAED,SAAS,eAAe,CAAC,MAAmB;IAC1C,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,QAAgB,EAChB,QAAgB,EAChB,IAAkB,EAClB,KAAa,EACb,KAAc;IAEd,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,uBAAuB;IACvB,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC;IAElC,IACE,CAAC,KAAK;QACN,IAAI,KAAK,MAAM;QACf,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,QAAQ,EAC7C,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrD,CAAC;AA6BD;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAuB;;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAC3D,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAE7C,MAAM,WAAW,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,cAAc,GAAG,WAAW,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,MAAM,eAAe,SAAG,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,OAAO,mCAAI,IAAI,CAAC;IACxD,MAAM,MAAM,GAAgB;QAC1B,OAAO,EAAE,IAAI,CAAC,cAAc;QAC5B,GAAG,EAAE,UAAU,EAAE;QACjB,SAAS,EAAE,oBAAoB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;KACpE,CAAC;IAEF,uEAAuE;IACvE,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACnC,YAAY,CAAC,IAAI,CACf,GAAG,cAAc,sDAAsD;YACrE,WAAW,CACd,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,IAAI,cAAc,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9C,YAAY,CAAC,IAAI,CACf,mBAAmB,cAAc,CAAC,OAAO,MAAM,MAAM,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,IAAI,cAAc,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;YACtC,YAAY,CAAC,IAAI,CACf,eAAe,MAAA,cAAc,CAAC,GAAG,mCAAI,SAAS,MAAM,MAAM,CAAC,GAAG,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,cAAc,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAClD,YAAY,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IAEtC,uEAAuE;IACvE,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,sBAAsB;IACtB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAChE,IAAI,iBAAiB,EAAE,CAAC;QACtB,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,KAAK,GAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACxE,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,YAAY,EAAE,iBAAiB,OAAC,IAAI,CAAC,WAAW,mCAAI,EAAE,CAAC;KACxD,CAAC;IAEF,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7C,cAAc,CACZ,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAC3B,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,EAC5B,KAAK,EACL,IAAI,EACJ,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;IAED,cAAc,CACZ,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EACrC,eAAe,CAAC,MAAM,CAAC,EACvB,KAAK,EACL,cAAc,EACd,IAAI,CAAC,KAAK,CACX,CAAC;IAEF,uCACK,KAAK,KACR,UAAU;QACV,eAAe;QACf,cAAc;QACd,KAAK;QACL,YAAY;QACZ,iBAAiB,IACjB;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,KAAwB;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,gBAAgB,GAAG,IAAI,IAAI,CAAC,CAAC;IAC3E,OAAO,+CAA+C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAC7E,CAAC;AAED,kEAAkE;AAClE,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAErC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAkB,EAClB,KAAc;IAEd,wEAAwE;IACxE,wEAAwE;IACxE,uBAAuB;IACvB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,iBAAiB,CACrB,GAAG,SAAS,2DAA2D,EACvE,cAAc,SAAS,+CAA+C;YACpE,gCAAgC,CACnC,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;QAC3D,MAAM,iBAAiB,CACrB,GAAG,SAAS,iCAAiC,EAC7C,kBAAkB,SAAS,6BAA6B,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IAEtC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,iBAAiB,CACrB,GAAG,UAAU,2DAA2D,EACxE,UAAU,UAAU,qDAAqD;YACvE,qBAAqB,CACxB,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QAC/C,MAAM,iBAAiB,CACrB,GAAG,UAAU,iCAAiC,EAC9C,kBAAkB,UAAU,6BAA6B,CAC1D,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,KAAK,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAE/C,yEAAyE;IACzE,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;IACrD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC;IAEnD,IAAI,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzD,MAAM,iBAAiB,CACrB,GAAG,UAAU,kCAAkC,cAAc,WAAW;QACtE,0CAA0C,EAC5C,UAAU,UAAU,6CAA6C;QAC/D,mEAAmE;QACnE,gCAAgC,CACnC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACxE,OAAO,UAAU,CAAC,OAAO,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAE9C,4CAA4C;IAC5C,IAAI,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,iBAAiB,CACrB,uEAAuE;YACrE,wBAAwB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EACtD,oEAAoE;YAClE,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;AAC1C,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAkB,EAClB,YAAwD;IAExD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IAEtC,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,iBAAiB,CACrB,GAAG,UAAU,2DAA2D,EACxE,WAAW,UAAU,8CAA8C;YACjE,uCAAuC,CAC1C,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC7C,CAAC;IAED,iBAAiB,CAAC,UAAU,EAAE,UAAU,EAAE,mBAAmB,CAAC,YAAY,CAAC,CAAC,CAAC;IAE7E,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAC1B,YAAwD;IAExD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CACV,2BAA2B,KAAK,WAAW,kBAAkB,CAC3D,WAAW,CAAC,KAAK,CAClB,GAAG,CACL,CAAC;QACF,OAAO,CAAC,IAAI,CACV,YAAY,CAAC,8BAA8B,EAAE;YAC3C,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,WAAW,CAAC,IAAI;SACvB,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,YAAY,CAAC,wBAAwB,EAAE;QAC5C,mBAAmB,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QACvC,mBAAmB,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE,CAC7D,IAAI,CAAC,WAAW,EAAE,CACnB,CAAC;IACF,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;;IACrD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,2EAA2E,eAAe,IAAI,CAAC;IAE7G,MAAM,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAEzC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,iBAAiB,CACrB,GAAG,aAAa,uDAAuD,EACvE,QAAQ,eAAe,iDAAiD;YACtE,GAAG,aAAa,iDAAiD,CACpE,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,iBAAiB,CAAC,UAAU,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,SAAG,gBAAgB,CAAC,UAAU,EAAE,aAAa,CAAC,mCAAI,EAAE,CAAC;IACnE,IAAI,eAAe,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAE5C,MAAM,SAAS,GACb,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,kBAAkB,CAAC,UAAU,EAAE,aAAa,EAAE,GAAG,SAAS,KAAK,KAAK,EAAE,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;IAC9E,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport { cliVersion, templatesFingerprint } from './compatibility';\nimport { invalidStateError, preconditionError } from './errors';\nimport {\n  appendFileNoFollow,\n  classifyPath,\n  readFileNoFollow,\n  writeFileNoFollow,\n} from './safe-fs';\nimport { readTemplate } from './templates';\n\n/** The dependency that owns every line of harness behaviour. */\nexport const HARNESS_PACKAGE = '@ekanos/harness';\n\n/** Where the generated shell lives, relative to the project root. */\nexport const HARNESS_DIR = path.join('.ekanos', 'harness');\n\n/** The single `.gitignore` line that covers the whole generated tree. */\nexport const GITIGNORE_ENTRY = '.ekanos/';\n\n/**\n * The staleness marker, inside the generated tree so deleting the tree also\n * deletes the marker. Holds the `@ekanos/harness` version that generated the\n * shell — a version bump means the shell may be wired against an older export\n * surface, so it is regenerated.\n */\n/** Next's dev/build cache inside the generated shell. */\nexport const BUILD_CACHE_DIR = '.next';\n\nexport const VERSION_MARKER = '.ekanos-version';\n\n/** The partner-owned registry, at the PROJECT ROOT. Never regenerated. */\nexport const HARNESS_CONFIG_FILENAME = 'harness.config.ts';\n\n/**\n * Every file in the generated shell: bundled template → path inside\n * `.ekanos/harness/`. The ten route files are mechanically derivable from the\n * export map alone — which is the test of whether the package boundary is in\n * the right place. If a shell file ever needs a judgment call, the boundary\n * has moved, not the template.\n *\n * `app/api/integrations/[slug]/[...path]/route.ts` is the shell's one SERVER\n * route: it injects the registry into `@ekanos/harness/api`, which serves the\n * live-mode OAuth loop, storage bridge and trigger route over a server-held\n * context. It is the third registry injection point, beside the two pages.\n *\n * `app/harness-shell.tsx` exists because a `HarnessIntegration` holds React\n * component references and MCP `run` functions. Next cannot serialize those\n * across a server→client boundary, so the `'use client'` mark has to sit ABOVE\n * the point where the registry is injected — hence a client shell of its own\n * rather than a client `RootLayout` called from a server layout. Keeping\n * `app/page.tsx` a server component is what lets `/` prerender static.\n */\nexport const SHELL_FILES: readonly { template: string; dest: string }[] = [\n  { template: 'harness/app/layout.tsx.tmpl', dest: 'app/layout.tsx' },\n  {\n    template: 'harness/app/harness-shell.tsx.tmpl',\n    dest: 'app/harness-shell.tsx',\n  },\n  { template: 'harness/app/page.tsx.tmpl', dest: 'app/page.tsx' },\n  {\n    template: 'harness/app/[slug]/layout.tsx.tmpl',\n    dest: 'app/[slug]/layout.tsx',\n  },\n  {\n    template: 'harness/app/[slug]/page.tsx.tmpl',\n    dest: 'app/[slug]/page.tsx',\n  },\n  {\n    template: 'harness/app/[slug]/widgets/page.tsx.tmpl',\n    dest: 'app/[slug]/widgets/page.tsx',\n  },\n  {\n    template: 'harness/app/[slug]/widgets/[widgetId]/page.tsx.tmpl',\n    dest: 'app/[slug]/widgets/[widgetId]/page.tsx',\n  },\n  {\n    template: 'harness/app/[slug]/tile/page.tsx.tmpl',\n    dest: 'app/[slug]/tile/page.tsx',\n  },\n  {\n    template: 'harness/app/[slug]/activation/page.tsx.tmpl',\n    dest: 'app/[slug]/activation/page.tsx',\n  },\n  {\n    template: 'harness/app/[slug]/triggers/page.tsx.tmpl',\n    dest: 'app/[slug]/triggers/page.tsx',\n  },\n  {\n    template: 'harness/app/api/integrations/[slug]/[...path]/route.ts.tmpl',\n    dest: 'app/api/integrations/[slug]/[...path]/route.ts',\n  },\n  { template: 'harness/next.config.mjs.tmpl', dest: 'next.config.mjs' },\n  { template: 'harness/postcss.config.mjs.tmpl', dest: 'postcss.config.mjs' },\n  { template: 'harness/tsconfig.json.tmpl', dest: 'tsconfig.json' },\n  { template: 'harness/styles/globals.css.tmpl', dest: 'styles/globals.css' },\n  { template: 'harness/package.json.tmpl', dest: 'package.json' },\n  {\n    template: 'harness/types/team-accounts.d.ts.tmpl',\n    dest: 'types/team-accounts.d.ts',\n  },\n];\n\n/**\n * Packages the shell needs to resolve upward out of the partner's own\n * `node_modules`. The shell declares no dependencies of its own by design, so\n * a missing one shows up as an opaque Next resolution error at dev-server\n * start; checking here turns that into one precondition with one fix.\n */\nexport const REQUIRED_DEPENDENCIES = [\n  HARNESS_PACKAGE,\n  'next',\n  'react',\n  'react-dom',\n  'tailwindcss',\n  '@tailwindcss/postcss',\n] as const;\n\nexport interface WrittenFiles {\n  created: string[];\n  updated: string[];\n  unchanged: string[];\n}\n\n/**\n * Read an installed package's `package.json` out of a project's TOP-LEVEL\n * `node_modules`. Resolved by direct path join rather than `require.resolve`\n * on purpose, for two independent reasons:\n *\n *  - The CLI runs from its own install and must read the version of the copy\n *    in THE CALLER'S project, not one hoisted next to itself.\n *  - Several of the packages this reads (`@ekanos/integration-schema`\n *    included) declare an `exports` map with no `./package.json` subpath, so\n *    `require.resolve('<pkg>/package.json')` throws\n *    `ERR_PACKAGE_PATH_NOT_EXPORTED` under Node's ESM resolver. A plain file\n *    read is not subject to the export map at all.\n *\n * Shared by every \"what does this project have installed?\" check in the\n * CLI — `readInstalledHarness` below, the schema-skew gate, and `upgrade`'s\n * current-toolchain report — so there is exactly one implementation of \"read\n * a package's on-disk version\", not a subtly different one per call site.\n */\nexport interface InstalledPackage {\n  version: string;\n  /** The raw package.json, for callers that need more than the version. */\n  manifest: unknown;\n}\n\nexport function readInstalledPackageManifest(\n  projectDir: string,\n  packageName: string,\n): InstalledPackage | null {\n  const manifestPath = path.join(\n    projectDir,\n    'node_modules',\n    ...packageName.split('/'),\n    'package.json',\n  );\n  if (!fs.existsSync(manifestPath)) return null;\n\n  try {\n    const parsed: unknown = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));\n    const version =\n      typeof parsed === 'object' && parsed !== null\n        ? (parsed as { version?: unknown }).version\n        : undefined;\n    if (typeof version !== 'string' || version.length === 0) return null;\n    return { version, manifest: parsed };\n  } catch (error) {\n    throw preconditionError(\n      `${packageName}'s package.json in node_modules is unreadable: ${\n        error instanceof Error ? error.message : String(error)\n      }`,\n      `Reinstall dependencies in ${projectDir} so ${packageName} resolves.`,\n    );\n  }\n}\n\n/** Read the installed `@ekanos/harness` version out of the partner's project. */\nexport type InstalledHarness = InstalledPackage;\n\nexport function readInstalledHarness(\n  projectDir: string,\n): InstalledHarness | null {\n  return readInstalledPackageManifest(projectDir, HARNESS_PACKAGE);\n}\n\n/** Just the installed version, for callers that need nothing else. */\nexport function readInstalledHarnessVersion(projectDir: string): string | null {\n  return readInstalledHarness(projectDir)?.version ?? null;\n}\n\n/** Which of `REQUIRED_DEPENDENCIES` are not installed in the project root. */\nexport function missingDependencies(projectDir: string): string[] {\n  return REQUIRED_DEPENDENCIES.filter(\n    (name) =>\n      !fs.existsSync(\n        path.join(projectDir, 'node_modules', name, 'package.json'),\n      ),\n  );\n}\n\n/**\n * What generated an existing shell.\n *\n * All three fields matter, and recording only `harness` was a real hole: the\n * templates ship with the CLI, so a shell can be stale because the CLI changed\n * while the harness did not. `templates` is the authoritative one — it is a\n * hash of the template sources, so it moves whenever what we generate moves,\n * including for a CLI build that never shipped a version bump.\n */\nexport interface ShellMarker {\n  harness: string;\n  /** null for a legacy bare-version marker written before this was recorded. */\n  cli: string | null;\n  templates: string | null;\n}\n\n/**\n * Three outcomes, not two, because \"no marker\" and \"unreadable marker\" call\n * for opposite responses.\n *\n * A marker's PRESENCE is itself evidence the tree is ours — a squatter does\n * not write `.ekanos-version` — and the likeliest cause of an unreadable one\n * is our own interrupted write. Everything under `.ekanos/harness/` is\n * CLI-owned, gitignored and reproducible from the templates, so regenerating\n * destroys nothing: there is no value at risk to justify charging a partner a\n * confusing `--force` to recover from our own bad write.\n *\n * An ABSENT marker over a non-empty tree is the opposite: nothing says the\n * files are ours, so we refuse. That is the L1 rule and it stays.\n */\nexport type MarkerState =\n  | { kind: 'missing' }\n  | { kind: 'corrupt' }\n  | { kind: 'ok'; marker: ShellMarker };\n\nexport function readShellMarkerState(harnessDir: string): MarkerState {\n  const marker = path.join(harnessDir, VERSION_MARKER);\n  if (classifyPath(marker) !== 'file') return { kind: 'missing' };\n\n  const raw = (readFileNoFollow(harnessDir, marker) ?? '').trim();\n  if (raw.length === 0) return { kind: 'corrupt' };\n\n  const parsed = parseMarker(raw);\n  return parsed === null ? { kind: 'corrupt' } : { kind: 'ok', marker: parsed };\n}\n\nfunction parseMarker(raw: string): ShellMarker | null {\n  // v1 markers were a bare version string. Read them rather than crashing, and\n  // report the unknown fields as null so the shell counts as stale and is\n  // regenerated once — which is the correct outcome for an upgrade.\n  //\n  // It must actually LOOK like a version: without this, any garbage that does\n  // not happen to start with `{` — a truncated write, a stray word — reads as\n  // a legacy marker named after the garbage, and the corrupt-marker path never\n  // fires. That is how a truncated `.ekanos-version` was silently reported as\n  // \"@ekanos/harness truncat → 0.1.0\" instead of \"unreadable\".\n  if (!raw.startsWith('{')) {\n    return /^\\d+\\.\\d+/.test(raw)\n      ? { harness: raw, cli: null, templates: null }\n      : null;\n  }\n\n  try {\n    const parsed: unknown = JSON.parse(raw);\n    if (typeof parsed !== 'object' || parsed === null) return null;\n    const record = parsed as Record<string, unknown>;\n    const harness = record.harness;\n    if (typeof harness !== 'string') return null;\n    return {\n      harness,\n      cli: typeof record.cli === 'string' ? record.cli : null,\n      templates: typeof record.templates === 'string' ? record.templates : null,\n    };\n  } catch {\n    return null;\n  }\n}\n\n/** The parsed marker, or null when it is absent OR unreadable. */\nexport function readShellMarker(harnessDir: string): ShellMarker | null {\n  const state = readShellMarkerState(harnessDir);\n  return state.kind === 'ok' ? state.marker : null;\n}\n\n/** The `@ekanos/harness` version an existing shell was generated against. */\nexport function readShellVersion(harnessDir: string): string | null {\n  return readShellMarker(harnessDir)?.harness ?? null;\n}\n\nfunction serializeMarker(marker: ShellMarker): string {\n  return `${JSON.stringify(marker, null, 2)}\\n`;\n}\n\n/**\n * Write a generated file, but ONLY when its bytes would change.\n *\n * This is what makes a re-run cheap and a watcher quiet: an unchanged file is\n * not rewritten, so its mtime does not move and Next's dev server does not\n * rebuild. It also means a hand-edit inside the CLI-owned tree is silently\n * corrected on the next run, which is the intended contract for `.ekanos/`.\n */\nexport function writeIfChanged(\n  root: string,\n  destPath: string,\n  contents: string,\n  into: WrittenFiles,\n  label: string,\n  force: boolean,\n): void {\n  // `classifyPath` uses lstat, so a symlink here is reported as a symlink\n  // rather than as whatever it points at — including a DANGLING one, which\n  // `existsSync` would call absent and a plain write would then materialize\n  // outside the project.\n  const kind = classifyPath(destPath);\n  const exists = kind !== 'missing';\n\n  if (\n    !force &&\n    kind === 'file' &&\n    readFileNoFollow(root, destPath) === contents\n  ) {\n    into.unchanged.push(label);\n    return;\n  }\n\n  writeFileNoFollow(root, destPath, contents);\n  (exists ? into.updated : into.created).push(label);\n}\n\nexport interface ScaffoldShellArgs {\n  projectDir: string;\n  slug: string;\n  harnessVersion: string;\n  /** Rewrite every file even when its bytes already match. */\n  force: boolean;\n  /** Extra Tailwind @source globs from ekanos.json, already validated. */\n  sourceGlobs?: readonly string[];\n}\n\nexport interface ScaffoldShellResult extends WrittenFiles {\n  harnessDir: string;\n  /** The version the shell carried before this run — null on a first run. */\n  previousVersion: string | null;\n  /** What generated the previous shell, or null on a first run. */\n  previousMarker: ShellMarker | null;\n  /** True when anything that generated the shell has since changed. */\n  stale: boolean;\n  /** `.next` under the shell was deleted because the shell was stale. */\n  buildCacheCleared: boolean;\n  /**\n   * Which of harness / cli / templates moved. Empty on a first run; this is\n   * what lets `dev` say WHY it regenerated rather than just that it did.\n   */\n  staleReasons: string[];\n}\n\n/**\n * Generate `.ekanos/harness/**` for `harnessVersion`. Every file here is\n * CLI-owned and gitignored, so regeneration needs no permission and asks no\n * question — the partner owns `harness.config.ts` and their integration\n * source, and nothing else.\n */\nexport function scaffoldShell(args: ScaffoldShellArgs): ScaffoldShellResult {\n  const harnessDir = path.join(args.projectDir, HARNESS_DIR);\n  assertShellDirIsOurs(harnessDir, args.force);\n\n  const markerState = readShellMarkerState(harnessDir);\n  const previousMarker = markerState.kind === 'ok' ? markerState.marker : null;\n  const previousVersion = previousMarker?.harness ?? null;\n  const marker: ShellMarker = {\n    harness: args.harnessVersion,\n    cli: cliVersion(),\n    templates: templatesFingerprint(SHELL_FILES.map((f) => f.template)),\n  };\n\n  // A shell is current only if EVERYTHING that produced it is unchanged.\n  // Checking the harness version alone certified shells generated by an older\n  // CLI, against templates that had since moved, as up to date.\n  const staleReasons: string[] = [];\n  if (markerState.kind === 'corrupt') {\n    staleReasons.push(\n      `${VERSION_MARKER} was unreadable, so the existing shell could not be ` +\n        'certified',\n    );\n  }\n  if (previousMarker !== null) {\n    if (previousMarker.harness !== marker.harness) {\n      staleReasons.push(\n        `@ekanos/harness ${previousMarker.harness} → ${marker.harness}`,\n      );\n    }\n    if (previousMarker.cli !== marker.cli) {\n      staleReasons.push(\n        `@ekanos/cli ${previousMarker.cli ?? 'unknown'} → ${marker.cli}`,\n      );\n    }\n    if (previousMarker.templates !== marker.templates) {\n      staleReasons.push('the shell templates changed');\n    }\n  }\n  const stale = staleReasons.length > 0;\n\n  // Next's persistent dev cache was built from the OLD shell and the OLD\n  // toolchain. Keeping it across a regeneration served a corrupted Tailwind\n  // candidate on the 0.1 → 0.4 jump (every page a build-error overlay until\n  // someone deleted the directory by hand). The shell knows it is stale; the\n  // cache goes with it.\n  const buildCacheDir = path.join(harnessDir, BUILD_CACHE_DIR);\n  const buildCacheCleared = stale && fs.existsSync(buildCacheDir);\n  if (buildCacheCleared) {\n    fs.rmSync(buildCacheDir, { recursive: true, force: true });\n  }\n\n  const files: WrittenFiles = { created: [], updated: [], unchanged: [] };\n  const vars = {\n    SLUG: args.slug,\n    SOURCE_GLOBS: renderSourceGlobs(args.sourceGlobs ?? []),\n  };\n\n  for (const { template, dest } of SHELL_FILES) {\n    writeIfChanged(\n      args.projectDir,\n      path.join(harnessDir, dest),\n      readTemplate(template, vars),\n      files,\n      dest,\n      args.force,\n    );\n  }\n\n  writeIfChanged(\n    args.projectDir,\n    path.join(harnessDir, VERSION_MARKER),\n    serializeMarker(marker),\n    files,\n    VERSION_MARKER,\n    args.force,\n  );\n\n  return {\n    ...files,\n    harnessDir,\n    previousVersion,\n    previousMarker,\n    stale,\n    staleReasons,\n    buildCacheCleared,\n  };\n}\n\n/**\n * Turn validated `sourceGlobs` into the `@source` lines the generated\n * stylesheet carries, each relative to the shell's `styles/` directory.\n *\n * Tailwind never scans what it is not pointed at, and a glob that matches\n * nothing fails silently — so an integration living outside the default\n * layout renders completely unstyled with no error anywhere. That is what\n * `sourceGlobs` is for, and until now it was parsed and thrown away.\n */\nfunction renderSourceGlobs(globs: readonly string[]): string {\n  if (globs.length === 0) return '';\n  const lines = globs.map((glob) => `@source '${SHELL_TO_PROJECT}${glob}';`);\n  return `\\n/* From \"sourceGlobs\" in ekanos.json. */\\n${lines.join('\\n')}\\n`;\n}\n\n/** From `.ekanos/harness/styles/` back up to the project root. */\nconst SHELL_TO_PROJECT = '../../../';\n\n/**\n * Establish that `.ekanos/harness` is a tree WE generated before writing a\n * single byte into it, and return the version marker it carried.\n *\n * Path location alone is not ownership. A directory that exists but carries no\n * `.ekanos-version` was put there by something else — a partner, another tool,\n * a symlink — and clobbering it because it happens to sit at the path we like\n * is the same class of mistake as following a symlink. An empty directory is\n * fine (that is just `mkdir -p` having run), and `--force` is the explicit\n * override.\n *\n * Runs BEFORE `bootstrapHarnessConfig` in `dev`, so a shell that cannot be\n * written leaves the project completely untouched rather than half-scaffolded.\n */\nexport function assertShellDirIsOurs(\n  harnessDir: string,\n  force: boolean,\n): string | null {\n  // `.ekanos` first: through a symlinked `.ekanos`, the lstat below would\n  // describe the link's target, and the build-cache `rmSync` would delete\n  // outside the project.\n  const ekanosDir = path.dirname(harnessDir);\n  const parentKind = classifyPath(ekanosDir);\n  if (parentKind === 'symlink') {\n    throw invalidStateError(\n      `${ekanosDir} is a symlink, so \"ekanos dev\" will not write through it.`,\n      `Delete the ${ekanosDir} link and re-run \"ekanos dev\" — the shell is ` +\n        'generated, so nothing is lost.',\n    );\n  }\n  if (parentKind !== 'missing' && parentKind !== 'directory') {\n    throw invalidStateError(\n      `${ekanosDir} exists and is not a directory.`,\n      `Move or delete ${ekanosDir}, then re-run \"ekanos dev\".`,\n    );\n  }\n\n  const kind = classifyPath(harnessDir);\n\n  if (kind === 'symlink') {\n    throw invalidStateError(\n      `${harnessDir} is a symlink, so \"ekanos dev\" will not write through it.`,\n      `Delete ${harnessDir} and re-run \"ekanos dev\" — the shell is generated, ` +\n        'so nothing is lost.',\n    );\n  }\n\n  if (kind !== 'missing' && kind !== 'directory') {\n    throw invalidStateError(\n      `${harnessDir} exists and is not a directory.`,\n      `Move or delete ${harnessDir}, then re-run \"ekanos dev\".`,\n    );\n  }\n\n  if (kind === 'missing') return null;\n\n  const state = readShellMarkerState(harnessDir);\n\n  // A marker we wrote, however mangled, still identifies the tree as ours.\n  if (state.kind === 'ok') return state.marker.harness;\n  if (state.kind === 'corrupt' || force) return null;\n\n  if (fs.readdirSync(harnessDir).length === 0) return null;\n\n  throw invalidStateError(\n    `${harnessDir} already contains files but no ${VERSION_MARKER} marker, ` +\n      'so it was not generated by \"ekanos dev\".',\n    `Delete ${harnessDir} if you do not need it, or pass --force to ` +\n      'overwrite it. Everything \"ekanos dev\" generates is reproducible; ' +\n      'anything else in there is not.',\n  );\n}\n\n/**\n * The module specifier `harness.config.ts` uses to import the partner's\n * integration: the `entry` from ekanos.json, made relative and extension-free.\n * \"src/integration.ts\" → \"src/integration\".\n */\nexport function entryImportSpecifier(entry: string): string {\n  const normalized = entry.split(path.sep).join('/').replace(/^\\.\\//, '');\n  return normalized.replace(/\\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/, '');\n}\n\n/**\n * The same specifier as a JavaScript string LITERAL, ready to drop into a\n * generated `import` statement.\n *\n * `entry` is attacker-influenced data from `ekanos.json`, and a POSIX filename\n * may legally contain a quote or a newline. Interpolating it raw would let a\n * crafted-but-valid path close the string and append statements to the module\n * we generate. `JSON.stringify` produces a correctly escaped literal, which is\n * the actual fix; the explicit rejection below is a second line that also\n * gives the partner a comprehensible error instead of a bizarre filename\n * silently appearing, escaped, in their config.\n *\n * This does not cross a trust boundary on its own — a partner's own code runs\n * unsandboxed anyway — but \"the templates cannot be injected into\" is a claim\n * we make, and it should be true.\n */\nexport function entryImportLiteral(entry: string): string {\n  const specifier = entryImportSpecifier(entry);\n\n  // eslint-disable-next-line no-control-regex\n  if (/[\"'`\\\\\\n\\r\\u0000-\\u001f]/.test(specifier)) {\n    throw preconditionError(\n      `The \"entry\" in ekanos.json contains characters that cannot appear in ` +\n        `an import specifier: ${JSON.stringify(specifier)}.`,\n      'Rename the file so its path has no quotes, backslashes or control ' +\n        'characters, then update \"entry\" in ekanos.json to match.',\n    );\n  }\n\n  return JSON.stringify(`./${specifier}`);\n}\n\nexport interface BootstrapConfigResult {\n  /** True only when this run created the file. */\n  bootstrapped: boolean;\n  configPath: string;\n}\n\n/**\n * Write a starter `harness.config.ts` at the project root — ONCE.\n *\n * An existing file is left strictly alone, byte for byte, and no flag changes\n * that: it is the one harness file the partner owns, it is git-tracked, and\n * regenerating it would throw away their fixtures. `--force` regenerates the\n * shell, never this.\n */\nexport function bootstrapHarnessConfig(\n  projectDir: string,\n  integrations: readonly { slug: string; entry: string }[],\n): BootstrapConfigResult {\n  const configPath = path.join(projectDir, HARNESS_CONFIG_FILENAME);\n  const kind = classifyPath(configPath);\n\n  // A symlink here — including a dangling one, which `existsSync` reports as\n  // absent — would have us write through to its target. Since this file is the\n  // partner's to own, the only safe answer is to touch nothing and say why.\n  if (kind === 'symlink') {\n    throw invalidStateError(\n      `${configPath} is a symlink, so \"ekanos dev\" will not write through it.`,\n      `Replace ${configPath} with a real file (or delete it to have one ` +\n        'generated), then re-run \"ekanos dev\".',\n    );\n  }\n\n  if (kind !== 'missing') {\n    return { bootstrapped: false, configPath };\n  }\n\n  writeFileNoFollow(projectDir, configPath, renderHarnessConfig(integrations));\n\n  return { bootstrapped: true, configPath };\n}\n\n/**\n * Render the starter registry for EVERY integration the project declares.\n *\n * The harness registry is an array and `ekanos.json` can now hold a list, so a\n * project's second integration reaches the harness the same way its first\n * does. Each entry imports the definition under a distinct local identifier\n * derived from its slug, because two `integration` imports in one module do\n * not compile.\n */\nfunction renderHarnessConfig(\n  integrations: readonly { slug: string; entry: string }[],\n): string {\n  const imports: string[] = [];\n  const entries: string[] = [];\n\n  for (const integration of integrations) {\n    const ident = identifierForSlug(integration.slug);\n    imports.push(\n      `import { integration as ${ident} } from ${entryImportLiteral(\n        integration.entry,\n      )};`,\n    );\n    entries.push(\n      readTemplate('harness.config.entry.ts.tmpl', {\n        IDENT: ident,\n        SLUG: integration.slug,\n      }),\n    );\n  }\n\n  return readTemplate('harness.config.ts.tmpl', {\n    INTEGRATION_IMPORTS: imports.join('\\n'),\n    INTEGRATION_ENTRIES: entries.join(''),\n  });\n}\n\n/**\n * \"acme-crm\" → \"acmeCrm\". A slug is kebab-case by schema, so this only has to\n * handle hyphens, and a leading digit is impossible.\n */\nexport function identifierForSlug(slug: string): string {\n  const camel = slug.replace(/-([a-z0-9])/g, (_, char: string) =>\n    char.toUpperCase(),\n  );\n  return /^[0-9]/.test(camel) ? `i${camel}` : camel;\n}\n\n/**\n * Add `.ekanos/` to the project `.gitignore`, exactly once.\n *\n * Matching is line-wise over the spellings git treats as the same rule\n * (`.ekanos`, `.ekanos/`, `/.ekanos/`), so re-running never appends a\n * duplicate — the thing that makes a scaffold verb safe to run in a loop.\n * A negation (`!.ekanos/`) is deliberately NOT treated as a match: the\n * partner meant to un-ignore it, and we do not fight that silently.\n */\nexport function ensureGitignoreEntry(projectDir: string): boolean {\n  const gitignorePath = path.join(projectDir, '.gitignore');\n  const block = `# Ekanos dev harness — generated by \"ekanos dev\", never edited by hand\\n${GITIGNORE_ENTRY}\\n`;\n\n  const kind = classifyPath(gitignorePath);\n\n  if (kind === 'symlink') {\n    throw invalidStateError(\n      `${gitignorePath} is a symlink, so \"ekanos dev\" will not append to it.`,\n      `Add \"${GITIGNORE_ENTRY}\" to your real .gitignore yourself, or replace ` +\n        `${gitignorePath} with a regular file, then re-run \"ekanos dev\".`,\n    );\n  }\n\n  if (kind === 'missing') {\n    writeFileNoFollow(projectDir, gitignorePath, block);\n    return true;\n  }\n\n  const existing = readFileNoFollow(projectDir, gitignorePath) ?? '';\n  if (gitignoreCovers(existing)) return false;\n\n  const separator =\n    existing.length === 0 || existing.endsWith('\\n') ? '' : '\\n';\n  appendFileNoFollow(projectDir, gitignorePath, `${separator}\\n${block}`);\n  return true;\n}\n\nfunction gitignoreCovers(source: string): boolean {\n  const equivalents = new Set(['.ekanos', '.ekanos/', '/.ekanos', '/.ekanos/']);\n  return source\n    .split('\\n')\n    .map((line) => line.trim())\n    .some((line) => equivalents.has(line));\n}\n"]}
+{"version":3,"file":"harness-scaffold.js","sourceRoot":"","sources":["../src/harness-scaffold.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,gEAAgE;AAChE,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAEjD,qEAAqE;AACrE,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAE3D,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAAG,UAAU,CAAC;AAE1C;;;;;GAKG;AACH,yDAAyD;AACzD,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEhD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,MAAc;IAC1C,OAAO,MAAM,CAAC,OAAO,CACnB,wCAAwC,EACxC,CAAC,MAAM,EAAE,GAAW,EAAE,KAAa,EAAE,EAAE,CACrC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,KAAK,EAAE,CAC1C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC;IACrC,QAAQ,EAAE,eAAe,IAAI,OAAO;IACpC,IAAI,EAAE,OAAO,IAAI,EAAE;CACpB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAG1B;IACJ,yBAAyB;IACzB,uBAAuB;IACvB,8BAA8B;IAC9B,sCAAsC;IACtC,yCAAyC;IACzC,uDAAuD;IACvD,qCAAqC;IACrC,qCAAqC;IACrC,mCAAmC;IACnC,wCAAwC;IACxC,sCAAsC;IACtC,8CAA8C;IAC9C,yDAAyD;IACzD,2CAA2C;IAC3C,iDAAiD;IACjD,+CAA+C;CAChD,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAEnB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAG7B;IACJ,GAAG;QACD,uBAAuB;QACvB,qBAAqB;QACrB,6BAA6B;QAC7B,kCAAkC;QAClC,gCAAgC;QAChC,+BAA+B;QAC/B,oCAAoC;QACpC,kCAAkC;QAClC,0BAA0B;KAC3B,CAAC,GAAG,CAAC,WAAW,CAAC;IAClB,EAAE,QAAQ,EAAE,sCAAsC,EAAE,IAAI,EAAE,cAAc,EAAE;CAC3E,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,cAAc;IACd,uBAAuB;IACvB,6BAA6B;IAC7B,2BAA2B;IAC3B,yCAAyC;CAC1C,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC;IACtC,QAAQ,EAAE,oBAAoB,IAAI,OAAO;IACzC,IAAI,EAAE,OAAO,IAAI,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAG5B;IACJ,mBAAmB;IACnB,mBAAmB;IACnB,iBAAiB;IACjB,6BAA6B;IAC7B,uBAAuB;IACvB,gCAAgC;IAChC,sBAAsB;IACtB,+BAA+B;IAC/B,qCAAqC;IACrC,qCAAqC;CACtC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AAEpB,yEAAyE;AACzE,MAAM,qBAAqB,GAAG,sBAAsB,CAAC,MAAM,CACzD,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC;IACvC,IAAI,CAAC,IAAI,KAAK,2BAA2B,CAC5C,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;IACvB,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,yBAAyB,CAAC;CACtE,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,WAAW,GAAkD;IACxE,EAAE,QAAQ,EAAE,6BAA6B,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACnE;QACE,QAAQ,EAAE,oCAAoC;QAC9C,IAAI,EAAE,uBAAuB;KAC9B;IACD,EAAE,QAAQ,EAAE,2BAA2B,EAAE,IAAI,EAAE,cAAc,EAAE;IAC/D;QACE,QAAQ,EAAE,oCAAoC;QAC9C,IAAI,EAAE,uBAAuB;KAC9B;IACD;QACE,QAAQ,EAAE,kCAAkC;QAC5C,IAAI,EAAE,qBAAqB;KAC5B;IACD;QACE,QAAQ,EAAE,0CAA0C;QACpD,IAAI,EAAE,6BAA6B;KACpC;IACD;QACE,QAAQ,EAAE,qDAAqD;QAC/D,IAAI,EAAE,wCAAwC;KAC/C;IACD;QACE,QAAQ,EAAE,uCAAuC;QACjD,IAAI,EAAE,0BAA0B;KACjC;IACD;QACE,QAAQ,EAAE,6CAA6C;QACvD,IAAI,EAAE,gCAAgC;KACvC;IACD;QACE,QAAQ,EAAE,2CAA2C;QACrD,IAAI,EAAE,8BAA8B;KACrC;IACD;QACE,QAAQ,EAAE,6DAA6D;QACvE,IAAI,EAAE,gDAAgD;KACvD;IACD;QACE,QAAQ,EAAE,sDAAsD;QAChE,IAAI,EAAE,yCAAyC;KAChD;IACD,GAAG,mBAAmB;IACtB,EAAE,QAAQ,EAAE,8BAA8B,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACrE,EAAE,QAAQ,EAAE,iCAAiC,EAAE,IAAI,EAAE,oBAAoB,EAAE;IAC3E,EAAE,QAAQ,EAAE,4BAA4B,EAAE,IAAI,EAAE,eAAe,EAAE;IACjE,EAAE,QAAQ,EAAE,iCAAiC,EAAE,IAAI,EAAE,oBAAoB,EAAE;IAC3E,EAAE,QAAQ,EAAE,2BAA2B,EAAE,IAAI,EAAE,cAAc,EAAE;IAC/D;QACE,QAAQ,EAAE,uCAAuC;QACjD,IAAI,EAAE,0BAA0B;KACjC;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,eAAe;IACf,MAAM;IACN,OAAO;IACP,WAAW;IACX,aAAa;IACb,sBAAsB;CACd,CAAC;AAgCX,MAAM,UAAU,4BAA4B,CAC1C,UAAkB,EAClB,WAAmB;IAEnB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAC5B,UAAU,EACV,cAAc,EACd,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EACzB,cAAc,CACf,CAAC;IACF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1E,MAAM,OAAO,GACX,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAC3C,CAAC,CAAE,MAAgC,CAAC,OAAO;YAC3C,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,iBAAiB,CACrB,GAAG,WAAW,kDACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,6BAA6B,UAAU,OAAO,WAAW,YAAY,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAKD,MAAM,UAAU,oBAAoB,CAClC,UAAkB;IAElB,OAAO,4BAA4B,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;AACnE,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,2BAA2B,CAAC,UAAkB;;;IAC5D,aAAO,MAAA,oBAAoB,CAAC,UAAU,CAAC,0CAAE,OAAO,mCAAI,IAAI,CAAC;AAC3D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,OAAO,qBAAqB,CAAC,MAAM,CACjC,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,EAAE,CAAC,UAAU,CACZ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,CAAC,CAC5D,CACJ,CAAC;AACJ,CAAC;AAqCD,MAAM,UAAU,oBAAoB,CAAC,UAAkB;;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACrD,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAEhE,MAAM,GAAG,GAAG,OAAC,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAEjD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,6EAA6E;IAC7E,wEAAwE;IACxE,kEAAkE;IAClE,EAAE;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,6DAA6D;IAC7D,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;YAC1B,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;YAC9C,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAiC,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC7C,OAAO;YACL,OAAO;YACP,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YACvD,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;SAC1E,CAAC;IACJ,CAAC;eAAO,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,KAAK,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,UAAkB;;;IACjD,aAAO,MAAA,eAAe,CAAC,UAAU,CAAC,0CAAE,OAAO,mCAAI,IAAI,CAAC;AACtD,CAAC;AAED,SAAS,eAAe,CAAC,MAAmB;IAC1C,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,QAAgB,EAChB,QAAgB,EAChB,IAAkB,EAClB,KAAa,EACb,KAAc;IAEd,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,uBAAuB;IACvB,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC;IAElC,IACE,CAAC,KAAK;QACN,IAAI,KAAK,MAAM;QACf,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,QAAQ,EAC7C,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrD,CAAC;AA0CD;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAuB;;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAC3D,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAE7C,MAAM,WAAW,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,cAAc,GAAG,WAAW,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,MAAM,eAAe,SAAG,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,OAAO,mCAAI,IAAI,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI;QAC1B,CAAC,CAAC,cAAc,EAAE;QAClB,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC;IACtD,MAAM,MAAM,GAAgB;QAC1B,OAAO,EAAE,IAAI,CAAC,cAAc;QAC5B,GAAG,EAAE,UAAU,EAAE;QACjB,SAAS,EAAE,oBAAoB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;KACnE,CAAC;IAEF,uEAAuE;IACvE,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACnC,YAAY,CAAC,IAAI,CACf,GAAG,cAAc,sDAAsD;YACrE,WAAW,CACd,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,IAAI,cAAc,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9C,YAAY,CAAC,IAAI,CACf,mBAAmB,cAAc,CAAC,OAAO,MAAM,MAAM,CAAC,OAAO,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,IAAI,cAAc,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;YACtC,YAAY,CAAC,IAAI,CACf,eAAe,MAAA,cAAc,CAAC,GAAG,mCAAI,SAAS,MAAM,MAAM,CAAC,GAAG,EAAE,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,cAAc,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAClD,YAAY,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IAEtC,uEAAuE;IACvE,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,sBAAsB;IACtB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAChE,IAAI,iBAAiB,EAAE,CAAC;QACtB,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,KAAK,GAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACxE,MAAM,IAAI,mBACR,IAAI,EAAE,IAAI,CAAC,IAAI,EACf,YAAY,EAAE,iBAAiB,OAAC,IAAI,CAAC,WAAW,mCAAI,EAAE,CAAC,EACvD,gBAAgB,EACd,IAAI,CAAC,eAAe,KAAK,SAAS;YAChC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,eAAe,EAAE,oBAAoB,CAAC,IACjE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CACvD,CAAC;IAEF,MAAM,UAAU,GACd,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;IAChE,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9C,cAAc,CACZ,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAC3B,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,EACtD,KAAK,EACL,IAAI,EACJ,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,2EAA2E;IAC3E,oDAAoD;IACpD,IAAI,UAAU,EAAE,CAAC;QACf,cAAc,CACZ,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,uBAAuB,CAAC,EAC9C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,EAAE,CAAC,EACnE,KAAK,EACL,uBAAuB,EACvB,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;IAED,cAAc,CACZ,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EACrC,eAAe,CAAC,MAAM,CAAC,EACvB,KAAK,EACL,cAAc,EACd,IAAI,CAAC,KAAK,CACX,CAAC;IAEF,uCACK,KAAK,KACR,UAAU;QACV,eAAe;QACf,cAAc;QACd,KAAK;QACL,YAAY;QACZ,iBAAiB,IACjB;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,IAAuB;IAIpD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE;QAC7C,MAAM,KAAK,GAAG,aAAa,KAAK,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CACV,UAAU,KAAK,SAAS,kBAAkB,CACxC,GAAG,UAAU,CAAC,GAAG,IAAI,UAAU,CAAC,KAAK,EAAE;QACvC,gEAAgE;QAChE,WAAW,CACZ,GAAG,CACL,CAAC;QACF,OAAO,CAAC,IAAI,CACV,KAAK,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,KAAK,0BAA0B,KAAK,mBAAmB,CAC5G,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO;QACL,kBAAkB,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QACtC,kBAAkB,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;KACrC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,IAAuB;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAC9B,GAAG,yBAAyB,GAAG,WAAW,CAAC,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE,KAAK,CAAC,EAAE,CAClG,CAAC;QACF,OAAO,8CAA8C,KAAK,WAAW,SAAS,GAAG,CAAC;IACpF,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,iBAAiB,KAAK,EAAE,CAAC;SAC3C,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;QACL,uGAAuG;QACvG,+DAA+D;QAC/D,GAAG,OAAO;QACV,EAAE;QACF,2DAA2D,MAAM,KAAK;QACtE,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,mFAAmF;AACnF,MAAM,yBAAyB,GAAG,QAAQ,CAAC;AAE3C;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,KAAwB;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,gBAAgB,GAAG,IAAI,IAAI,CAAC,CAAC;IAC3E,OAAO,+CAA+C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAE5C,kGAAkG;AAClG,MAAM,UAAU,aAAa,CAC3B,UAAmB;IAEnB,IAAI,CAAC,UAAU;QAAE,OAAO,WAAW,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,OAAO;QACL,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,GAAG,sBAAsB;KAC1B,CAAC;AACJ,CAAC;AAED,+BAA+B;AAC/B,MAAM,UAAU,cAAc;IAI5B,OAAO;QACL,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9D,GAAG,qBAAqB;QACxB,GAAG,qBAAqB;QACxB;YACE,QAAQ,EAAE,2CAA2C;YACrD,IAAI,EAAE,yBAAyB;SAChC;KACF,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAErC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAkB,EAClB,KAAc;IAEd,wEAAwE;IACxE,wEAAwE;IACxE,uBAAuB;IACvB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,iBAAiB,CACrB,GAAG,SAAS,2DAA2D,EACvE,cAAc,SAAS,+CAA+C;YACpE,gCAAgC,CACnC,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;QAC3D,MAAM,iBAAiB,CACrB,GAAG,SAAS,iCAAiC,EAC7C,kBAAkB,SAAS,6BAA6B,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IAEtC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,iBAAiB,CACrB,GAAG,UAAU,2DAA2D,EACxE,UAAU,UAAU,qDAAqD;YACvE,qBAAqB,CACxB,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QAC/C,MAAM,iBAAiB,CACrB,GAAG,UAAU,iCAAiC,EAC9C,kBAAkB,UAAU,6BAA6B,CAC1D,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,KAAK,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAE/C,yEAAyE;IACzE,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;IACrD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC;IAEnD,IAAI,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzD,MAAM,iBAAiB,CACrB,GAAG,UAAU,kCAAkC,cAAc,WAAW;QACtE,0CAA0C,EAC5C,UAAU,UAAU,6CAA6C;QAC/D,mEAAmE;QACnE,gCAAgC,CACnC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACxE,OAAO,UAAU,CAAC,OAAO,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,MAAM,GAAG,IAAI;IAC7D,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAE9C,4CAA4C;IAC5C,IAAI,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,iBAAiB,CACrB,uEAAuE;YACrE,wBAAwB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EACtD,oEAAoE;YAClE,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,EAAE,CAAC,CAAC;AACjD,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAkB,EAClB,YAAwD;IAExD,uEAAuE;IACvE,4EAA4E;IAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IAEtC,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,iBAAiB,CACrB,GAAG,UAAU,2DAA2D,EACxE,WAAW,UAAU,8CAA8C;YACjE,uCAAuC,CAC1C,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC7C,CAAC;IAED,iBAAiB,CAAC,UAAU,EAAE,UAAU,EAAE,mBAAmB,CAAC,YAAY,CAAC,CAAC,CAAC;IAE7E,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAC1B,YAAwD;IAExD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CACV,2BAA2B,KAAK,WAAW,kBAAkB,CAC3D,WAAW,CAAC,KAAK,CAClB,GAAG,CACL,CAAC;QACF,OAAO,CAAC,IAAI,CACV,YAAY,CAAC,8BAA8B,EAAE;YAC3C,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,WAAW,CAAC,IAAI;SACvB,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,YAAY,CAAC,wBAAwB,EAAE;QAC5C,mBAAmB,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QACvC,mBAAmB,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE,CAC7D,IAAI,CAAC,WAAW,EAAE,CACnB,CAAC;IACF,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;;IACrD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,2EAA2E,eAAe,IAAI,CAAC;IAE7G,MAAM,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAEzC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,iBAAiB,CACrB,GAAG,aAAa,uDAAuD,EACvE,QAAQ,eAAe,iDAAiD;YACtE,GAAG,aAAa,iDAAiD,CACpE,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,iBAAiB,CAAC,UAAU,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,SAAG,gBAAgB,CAAC,UAAU,EAAE,aAAa,CAAC,mCAAI,EAAE,CAAC;IACnE,IAAI,eAAe,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAE5C,MAAM,SAAS,GACb,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,kBAAkB,CAAC,UAAU,EAAE,aAAa,EAAE,GAAG,SAAS,KAAK,KAAK,EAAE,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;IAC9E,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport { cliVersion, templatesFingerprint } from './compatibility';\nimport { invalidStateError, preconditionError } from './errors';\nimport {\n  appendFileNoFollow,\n  classifyPath,\n  readFileNoFollow,\n  writeFileNoFollow,\n} from './safe-fs';\nimport { readTemplate } from './templates';\n\n/** The dependency that owns every line of harness behaviour. */\nexport const HARNESS_PACKAGE = '@ekanos/harness';\n\n/** Where the generated shell lives, relative to the project root. */\nexport const HARNESS_DIR = path.join('.ekanos', 'harness');\n\n/** The single `.gitignore` line that covers the whole generated tree. */\nexport const GITIGNORE_ENTRY = '.ekanos/';\n\n/**\n * The staleness marker, inside the generated tree so deleting the tree also\n * deletes the marker. Holds the `@ekanos/harness` version that generated the\n * shell — a version bump means the shell may be wired against an older export\n * surface, so it is regenerated.\n */\n/** Next's dev/build cache inside the generated shell. */\nexport const BUILD_CACHE_DIR = '.next';\n\nexport const VERSION_MARKER = '.ekanos-version';\n\n/** The partner-owned registry, at the PROJECT ROOT. Never regenerated. */\nexport const HARNESS_CONFIG_FILENAME = 'harness.config.ts';\n\n/** An experience's generated, empty registry, inside the shell. */\nexport const SHELL_REGISTRY_FILENAME = 'harness.config.ts';\n\n/**\n * Re-point a shell file's import of the project-root registry at the shell's\n * own: the shell sits two directories below the root, so the specifier loses\n * exactly two `../`.\n */\nfunction pointAtShellRegistry(source: string): string {\n  return source.replace(\n    /((?:\\.\\.\\/){3,})harness\\.config(['\"])/g,\n    (_match, ups: string, quote: string) =>\n      `${ups.slice(6)}harness.config${quote}`,\n  );\n}\n\n/**\n * Every file in the generated shell: bundled template → path inside\n * `.ekanos/harness/`. The ten route files are mechanically derivable from the\n * export map alone — which is the test of whether the package boundary is in\n * the right place. If a shell file ever needs a judgment call, the boundary\n * has moved, not the template.\n *\n * `app/api/integrations/[slug]/[...path]/route.ts` is the shell's one SERVER\n * route: it injects the registry into `@ekanos/harness/api`, which serves the\n * live-mode OAuth loop, storage bridge and trigger route over a server-held\n * context. It is the third registry injection point, beside the two pages.\n *\n * `app/harness-shell.tsx` exists because a `HarnessIntegration` holds React\n * component references and MCP `run` functions. Next cannot serialize those\n * across a server→client boundary, so the `'use client'` mark has to sit ABOVE\n * the point where the registry is injected — hence a client shell of its own\n * rather than a client `RootLayout` called from a server layout. Keeping\n * `app/page.tsx` a server component is what lets `/` prerender static.\n */\nconst consolePage = (dest: string) => ({\n  template: `harness/app/${dest}.tmpl`,\n  dest: `app/${dest}`,\n});\n\n/**\n * The Integration console (`/integrations/**`). Generated for every project:\n * an integration repo's home, and half of an experience repo's.\n */\nexport const CONSOLE_SHELL_FILES: readonly {\n  template: string;\n  dest: string;\n}[] = [\n  'integrations/layout.tsx',\n  'integrations/page.tsx',\n  'integrations/[slug]/page.tsx',\n  'integrations/[slug]/connect/page.tsx',\n  'integrations/[slug]/operations/page.tsx',\n  'integrations/[slug]/operations/[kind]/[name]/page.tsx',\n  'integrations/[slug]/events/page.tsx',\n  'integrations/[slug]/health/page.tsx',\n  'integrations/[slug]/runs/page.tsx',\n  'integrations/[slug]/preview/layout.tsx',\n  'integrations/[slug]/preview/page.tsx',\n  'integrations/[slug]/preview/widgets/page.tsx',\n  'integrations/[slug]/preview/widgets/[widgetId]/page.tsx',\n  'integrations/[slug]/preview/tile/page.tsx',\n  'integrations/[slug]/preview/activation/page.tsx',\n  'integrations/[slug]/preview/triggers/page.tsx',\n].map(consolePage);\n\n/**\n * The Experience view (`/experience/**`), generated only for `kind:\n * \"experience\"`. Its layout imports the experience entry (the widgets and\n * pages are React components that only the project's own module holds), and\n * the home page redirects here.\n */\nexport const EXPERIENCE_SHELL_FILES: readonly {\n  template: string;\n  dest: string;\n}[] = [\n  ...[\n    'experience/layout.tsx',\n    'experience/page.tsx',\n    'experience/widgets/page.tsx',\n    'experience/widgets/[id]/page.tsx',\n    'experience/pages/[id]/page.tsx',\n    'experience/workflows/page.tsx',\n    'experience/workflows/[id]/page.tsx',\n    'experience/review-queue/page.tsx',\n    'experience/runs/page.tsx',\n  ].map(consolePage),\n  { template: 'harness/app/page.experience.tsx.tmpl', dest: 'app/page.tsx' },\n];\n\n/**\n * The repo shell (`ekanos dev` at a repo root). It is the ordinary shell with\n * the single-project home, console layout and API route swapped for the repo's:\n * the repo home and Connections under a `(repo)` route group, each integration\n * package's console under `/integrations/<name>`, each experience package's\n * view under `/experiences/<name>`, and one API route that answers the repo\n * overview and forwards to a package's own harness API.\n */\nconst REPO_REPLACED_DESTS = new Set([\n  'app/page.tsx',\n  'app/harness-shell.tsx',\n  'app/integrations/layout.tsx',\n  'app/integrations/page.tsx',\n  'app/%5F%5Fekanos/api/[...path]/route.ts',\n]);\n\nconst repoTemplate = (dest: string) => ({\n  template: `harness/repo/app/${dest}.tmpl`,\n  dest: `app/${dest}`,\n});\n\nexport const REPO_SHELL_ONLY_FILES: readonly {\n  template: string;\n  dest: string;\n}[] = [\n  'harness-shell.tsx',\n  '(repo)/layout.tsx',\n  '(repo)/page.tsx',\n  '(repo)/connections/page.tsx',\n  'integrations/page.tsx',\n  'integrations/[slug]/layout.tsx',\n  'experiences/page.tsx',\n  'experiences/[name]/layout.tsx',\n  'experiences/[name]/connect/page.tsx',\n  '%5F%5Fekanos/api/[...path]/route.ts',\n].map(repoTemplate);\n\n/** The Experience view's pages, re-homed under `/experiences/[name]`. */\nconst REPO_EXPERIENCE_PAGES = EXPERIENCE_SHELL_FILES.filter(\n  (file) =>\n    file.dest.startsWith('app/experience/') &&\n    file.dest !== 'app/experience/layout.tsx',\n).map((file) => ({\n  template: file.template,\n  dest: file.dest.replace('app/experience/', 'app/experiences/[name]/'),\n}));\n\nexport const SHELL_FILES: readonly { template: string; dest: string }[] = [\n  { template: 'harness/app/layout.tsx.tmpl', dest: 'app/layout.tsx' },\n  {\n    template: 'harness/app/harness-shell.tsx.tmpl',\n    dest: 'app/harness-shell.tsx',\n  },\n  { template: 'harness/app/page.tsx.tmpl', dest: 'app/page.tsx' },\n  {\n    template: 'harness/app/[slug]/layout.tsx.tmpl',\n    dest: 'app/[slug]/layout.tsx',\n  },\n  {\n    template: 'harness/app/[slug]/page.tsx.tmpl',\n    dest: 'app/[slug]/page.tsx',\n  },\n  {\n    template: 'harness/app/[slug]/widgets/page.tsx.tmpl',\n    dest: 'app/[slug]/widgets/page.tsx',\n  },\n  {\n    template: 'harness/app/[slug]/widgets/[widgetId]/page.tsx.tmpl',\n    dest: 'app/[slug]/widgets/[widgetId]/page.tsx',\n  },\n  {\n    template: 'harness/app/[slug]/tile/page.tsx.tmpl',\n    dest: 'app/[slug]/tile/page.tsx',\n  },\n  {\n    template: 'harness/app/[slug]/activation/page.tsx.tmpl',\n    dest: 'app/[slug]/activation/page.tsx',\n  },\n  {\n    template: 'harness/app/[slug]/triggers/page.tsx.tmpl',\n    dest: 'app/[slug]/triggers/page.tsx',\n  },\n  {\n    template: 'harness/app/api/integrations/[slug]/[...path]/route.ts.tmpl',\n    dest: 'app/api/integrations/[slug]/[...path]/route.ts',\n  },\n  {\n    template: 'harness/app/%5F%5Fekanos/api/[...path]/route.ts.tmpl',\n    dest: 'app/%5F%5Fekanos/api/[...path]/route.ts',\n  },\n  ...CONSOLE_SHELL_FILES,\n  { template: 'harness/next.config.mjs.tmpl', dest: 'next.config.mjs' },\n  { template: 'harness/postcss.config.mjs.tmpl', dest: 'postcss.config.mjs' },\n  { template: 'harness/tsconfig.json.tmpl', dest: 'tsconfig.json' },\n  { template: 'harness/styles/globals.css.tmpl', dest: 'styles/globals.css' },\n  { template: 'harness/package.json.tmpl', dest: 'package.json' },\n  {\n    template: 'harness/types/team-accounts.d.ts.tmpl',\n    dest: 'types/team-accounts.d.ts',\n  },\n];\n\n/**\n * Packages the shell needs to resolve upward out of the partner's own\n * `node_modules`. The shell declares no dependencies of its own by design, so\n * a missing one shows up as an opaque Next resolution error at dev-server\n * start; checking here turns that into one precondition with one fix.\n */\nexport const REQUIRED_DEPENDENCIES = [\n  HARNESS_PACKAGE,\n  'next',\n  'react',\n  'react-dom',\n  'tailwindcss',\n  '@tailwindcss/postcss',\n] as const;\n\nexport interface WrittenFiles {\n  created: string[];\n  updated: string[];\n  unchanged: string[];\n}\n\n/**\n * Read an installed package's `package.json` out of a project's TOP-LEVEL\n * `node_modules`. Resolved by direct path join rather than `require.resolve`\n * on purpose, for two independent reasons:\n *\n *  - The CLI runs from its own install and must read the version of the copy\n *    in THE CALLER'S project, not one hoisted next to itself.\n *  - Several of the packages this reads (`@ekanos/integration-schema`\n *    included) declare an `exports` map with no `./package.json` subpath, so\n *    `require.resolve('<pkg>/package.json')` throws\n *    `ERR_PACKAGE_PATH_NOT_EXPORTED` under Node's ESM resolver. A plain file\n *    read is not subject to the export map at all.\n *\n * Shared by every \"what does this project have installed?\" check in the\n * CLI — `readInstalledHarness` below, the schema-skew gate, and `upgrade`'s\n * current-toolchain report — so there is exactly one implementation of \"read\n * a package's on-disk version\", not a subtly different one per call site.\n */\nexport interface InstalledPackage {\n  version: string;\n  /** The raw package.json, for callers that need more than the version. */\n  manifest: unknown;\n}\n\nexport function readInstalledPackageManifest(\n  projectDir: string,\n  packageName: string,\n): InstalledPackage | null {\n  const manifestPath = path.join(\n    projectDir,\n    'node_modules',\n    ...packageName.split('/'),\n    'package.json',\n  );\n  if (!fs.existsSync(manifestPath)) return null;\n\n  try {\n    const parsed: unknown = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));\n    const version =\n      typeof parsed === 'object' && parsed !== null\n        ? (parsed as { version?: unknown }).version\n        : undefined;\n    if (typeof version !== 'string' || version.length === 0) return null;\n    return { version, manifest: parsed };\n  } catch (error) {\n    throw preconditionError(\n      `${packageName}'s package.json in node_modules is unreadable: ${\n        error instanceof Error ? error.message : String(error)\n      }`,\n      `Reinstall dependencies in ${projectDir} so ${packageName} resolves.`,\n    );\n  }\n}\n\n/** Read the installed `@ekanos/harness` version out of the partner's project. */\nexport type InstalledHarness = InstalledPackage;\n\nexport function readInstalledHarness(\n  projectDir: string,\n): InstalledHarness | null {\n  return readInstalledPackageManifest(projectDir, HARNESS_PACKAGE);\n}\n\n/** Just the installed version, for callers that need nothing else. */\nexport function readInstalledHarnessVersion(projectDir: string): string | null {\n  return readInstalledHarness(projectDir)?.version ?? null;\n}\n\n/** Which of `REQUIRED_DEPENDENCIES` are not installed in the project root. */\nexport function missingDependencies(projectDir: string): string[] {\n  return REQUIRED_DEPENDENCIES.filter(\n    (name) =>\n      !fs.existsSync(\n        path.join(projectDir, 'node_modules', name, 'package.json'),\n      ),\n  );\n}\n\n/**\n * What generated an existing shell.\n *\n * All three fields matter, and recording only `harness` was a real hole: the\n * templates ship with the CLI, so a shell can be stale because the CLI changed\n * while the harness did not. `templates` is the authoritative one — it is a\n * hash of the template sources, so it moves whenever what we generate moves,\n * including for a CLI build that never shipped a version bump.\n */\nexport interface ShellMarker {\n  harness: string;\n  /** null for a legacy bare-version marker written before this was recorded. */\n  cli: string | null;\n  templates: string | null;\n}\n\n/**\n * Three outcomes, not two, because \"no marker\" and \"unreadable marker\" call\n * for opposite responses.\n *\n * A marker's PRESENCE is itself evidence the tree is ours — a squatter does\n * not write `.ekanos-version` — and the likeliest cause of an unreadable one\n * is our own interrupted write. Everything under `.ekanos/harness/` is\n * CLI-owned, gitignored and reproducible from the templates, so regenerating\n * destroys nothing: there is no value at risk to justify charging a partner a\n * confusing `--force` to recover from our own bad write.\n *\n * An ABSENT marker over a non-empty tree is the opposite: nothing says the\n * files are ours, so we refuse. That is the L1 rule and it stays.\n */\nexport type MarkerState =\n  | { kind: 'missing' }\n  | { kind: 'corrupt' }\n  | { kind: 'ok'; marker: ShellMarker };\n\nexport function readShellMarkerState(harnessDir: string): MarkerState {\n  const marker = path.join(harnessDir, VERSION_MARKER);\n  if (classifyPath(marker) !== 'file') return { kind: 'missing' };\n\n  const raw = (readFileNoFollow(harnessDir, marker) ?? '').trim();\n  if (raw.length === 0) return { kind: 'corrupt' };\n\n  const parsed = parseMarker(raw);\n  return parsed === null ? { kind: 'corrupt' } : { kind: 'ok', marker: parsed };\n}\n\nfunction parseMarker(raw: string): ShellMarker | null {\n  // v1 markers were a bare version string. Read them rather than crashing, and\n  // report the unknown fields as null so the shell counts as stale and is\n  // regenerated once — which is the correct outcome for an upgrade.\n  //\n  // It must actually LOOK like a version: without this, any garbage that does\n  // not happen to start with `{` — a truncated write, a stray word — reads as\n  // a legacy marker named after the garbage, and the corrupt-marker path never\n  // fires. That is how a truncated `.ekanos-version` was silently reported as\n  // \"@ekanos/harness truncat → 0.1.0\" instead of \"unreadable\".\n  if (!raw.startsWith('{')) {\n    return /^\\d+\\.\\d+/.test(raw)\n      ? { harness: raw, cli: null, templates: null }\n      : null;\n  }\n\n  try {\n    const parsed: unknown = JSON.parse(raw);\n    if (typeof parsed !== 'object' || parsed === null) return null;\n    const record = parsed as Record<string, unknown>;\n    const harness = record.harness;\n    if (typeof harness !== 'string') return null;\n    return {\n      harness,\n      cli: typeof record.cli === 'string' ? record.cli : null,\n      templates: typeof record.templates === 'string' ? record.templates : null,\n    };\n  } catch {\n    return null;\n  }\n}\n\n/** The parsed marker, or null when it is absent OR unreadable. */\nexport function readShellMarker(harnessDir: string): ShellMarker | null {\n  const state = readShellMarkerState(harnessDir);\n  return state.kind === 'ok' ? state.marker : null;\n}\n\n/** The `@ekanos/harness` version an existing shell was generated against. */\nexport function readShellVersion(harnessDir: string): string | null {\n  return readShellMarker(harnessDir)?.harness ?? null;\n}\n\nfunction serializeMarker(marker: ShellMarker): string {\n  return `${JSON.stringify(marker, null, 2)}\\n`;\n}\n\n/**\n * Write a generated file, but ONLY when its bytes would change.\n *\n * This is what makes a re-run cheap and a watcher quiet: an unchanged file is\n * not rewritten, so its mtime does not move and Next's dev server does not\n * rebuild. It also means a hand-edit inside the CLI-owned tree is silently\n * corrected on the next run, which is the intended contract for `.ekanos/`.\n */\nexport function writeIfChanged(\n  root: string,\n  destPath: string,\n  contents: string,\n  into: WrittenFiles,\n  label: string,\n  force: boolean,\n): void {\n  // `classifyPath` uses lstat, so a symlink here is reported as a symlink\n  // rather than as whatever it points at — including a DANGLING one, which\n  // `existsSync` would call absent and a plain write would then materialize\n  // outside the project.\n  const kind = classifyPath(destPath);\n  const exists = kind !== 'missing';\n\n  if (\n    !force &&\n    kind === 'file' &&\n    readFileNoFollow(root, destPath) === contents\n  ) {\n    into.unchanged.push(label);\n    return;\n  }\n\n  writeFileNoFollow(root, destPath, contents);\n  (exists ? into.updated : into.created).push(label);\n}\n\nexport interface ScaffoldShellArgs {\n  projectDir: string;\n  slug: string;\n  harnessVersion: string;\n  /** Rewrite every file even when its bytes already match. */\n  force: boolean;\n  /** Extra Tailwind @source globs from ekanos.json, already validated. */\n  sourceGlobs?: readonly string[];\n  /**\n   * Set for a `kind: \"experience\"` project: its entry (project-relative). The\n   * Experience view is generated, and mounts the entry's widgets and pages.\n   */\n  experienceEntry?: string;\n  /** Set when `projectDir` is a repo root: the packages the shell serves. */\n  repo?: RepoShellPackages;\n}\n\n/** Package directories and entries are relative to the repo root. */\nexport interface RepoShellPackages {\n  integrations: readonly { name: string; dir: string }[];\n  experiences: readonly { name: string; dir: string; entry: string }[];\n}\n\nexport interface ScaffoldShellResult extends WrittenFiles {\n  harnessDir: string;\n  /** The version the shell carried before this run — null on a first run. */\n  previousVersion: string | null;\n  /** What generated the previous shell, or null on a first run. */\n  previousMarker: ShellMarker | null;\n  /** True when anything that generated the shell has since changed. */\n  stale: boolean;\n  /** `.next` under the shell was deleted because the shell was stale. */\n  buildCacheCleared: boolean;\n  /**\n   * Which of harness / cli / templates moved. Empty on a first run; this is\n   * what lets `dev` say WHY it regenerated rather than just that it did.\n   */\n  staleReasons: string[];\n}\n\n/**\n * Generate `.ekanos/harness/**` for `harnessVersion`. Every file here is\n * CLI-owned and gitignored, so regeneration needs no permission and asks no\n * question — the partner owns `harness.config.ts` and their integration\n * source, and nothing else.\n */\nexport function scaffoldShell(args: ScaffoldShellArgs): ScaffoldShellResult {\n  const harnessDir = path.join(args.projectDir, HARNESS_DIR);\n  assertShellDirIsOurs(harnessDir, args.force);\n\n  const markerState = readShellMarkerState(harnessDir);\n  const previousMarker = markerState.kind === 'ok' ? markerState.marker : null;\n  const previousVersion = previousMarker?.harness ?? null;\n  const shellFiles = args.repo\n    ? repoShellFiles()\n    : shellFilesFor(args.experienceEntry !== undefined);\n  const marker: ShellMarker = {\n    harness: args.harnessVersion,\n    cli: cliVersion(),\n    templates: templatesFingerprint(shellFiles.map((f) => f.template)),\n  };\n\n  // A shell is current only if EVERYTHING that produced it is unchanged.\n  // Checking the harness version alone certified shells generated by an older\n  // CLI, against templates that had since moved, as up to date.\n  const staleReasons: string[] = [];\n  if (markerState.kind === 'corrupt') {\n    staleReasons.push(\n      `${VERSION_MARKER} was unreadable, so the existing shell could not be ` +\n        'certified',\n    );\n  }\n  if (previousMarker !== null) {\n    if (previousMarker.harness !== marker.harness) {\n      staleReasons.push(\n        `@ekanos/harness ${previousMarker.harness} → ${marker.harness}`,\n      );\n    }\n    if (previousMarker.cli !== marker.cli) {\n      staleReasons.push(\n        `@ekanos/cli ${previousMarker.cli ?? 'unknown'} → ${marker.cli}`,\n      );\n    }\n    if (previousMarker.templates !== marker.templates) {\n      staleReasons.push('the shell templates changed');\n    }\n  }\n  const stale = staleReasons.length > 0;\n\n  // Next's persistent dev cache was built from the OLD shell and the OLD\n  // toolchain. Keeping it across a regeneration served a corrupted Tailwind\n  // candidate on the 0.1 → 0.4 jump (every page a build-error overlay until\n  // someone deleted the directory by hand). The shell knows it is stale; the\n  // cache goes with it.\n  const buildCacheDir = path.join(harnessDir, BUILD_CACHE_DIR);\n  const buildCacheCleared = stale && fs.existsSync(buildCacheDir);\n  if (buildCacheCleared) {\n    fs.rmSync(buildCacheDir, { recursive: true, force: true });\n  }\n\n  const files: WrittenFiles = { created: [], updated: [], unchanged: [] };\n  const vars = {\n    SLUG: args.slug,\n    SOURCE_GLOBS: renderSourceGlobs(args.sourceGlobs ?? []),\n    EXPERIENCE_ENTRY:\n      args.experienceEntry === undefined\n        ? '\"\"'\n        : entryImportLiteral(args.experienceEntry, SHELL_APP_TO_PROJECT),\n    ...(args.repo ? renderRepoExperiences(args.repo) : {}),\n  };\n\n  const experience =\n    args.experienceEntry !== undefined || args.repo !== undefined;\n  for (const { template, dest } of shellFiles) {\n    const rendered = readTemplate(template, vars);\n    writeIfChanged(\n      args.projectDir,\n      path.join(harnessDir, dest),\n      experience ? pointAtShellRegistry(rendered) : rendered,\n      files,\n      dest,\n      args.force,\n    );\n  }\n\n  // An experience registers no integration, so it has no project-root\n  // `harness.config.ts` to own: the shell carries its own (generated, empty)\n  // registry and the files above import that instead.\n  if (experience) {\n    writeIfChanged(\n      args.projectDir,\n      path.join(harnessDir, SHELL_REGISTRY_FILENAME),\n      args.repo ? renderRepoRegistry(args.repo) : renderHarnessConfig([]),\n      files,\n      SHELL_REGISTRY_FILENAME,\n      args.force,\n    );\n  }\n\n  writeIfChanged(\n    args.projectDir,\n    path.join(harnessDir, VERSION_MARKER),\n    serializeMarker(marker),\n    files,\n    VERSION_MARKER,\n    args.force,\n  );\n\n  return {\n    ...files,\n    harnessDir,\n    previousVersion,\n    previousMarker,\n    stale,\n    staleReasons,\n    buildCacheCleared,\n  };\n}\n\n/**\n * `app/repo-experiences.ts`: the experience entries, imported statically (they\n * hold React components, which cannot cross the server/client boundary).\n */\nfunction renderRepoExperiences(repo: RepoShellPackages): {\n  EXPERIENCE_IMPORTS: string;\n  EXPERIENCE_ENTRIES: string;\n} {\n  const imports: string[] = [];\n  const entries: string[] = [];\n  repo.experiences.forEach((experience, index) => {\n    const ident = `experience${index}`;\n    imports.push(\n      `import ${ident} from ${entryImportLiteral(\n        `${experience.dir}/${experience.entry}`,\n        // app/repo-experiences.ts sits one level above app/experience/.\n        '../../../',\n      )};`,\n    );\n    entries.push(\n      `  ${JSON.stringify(experience.name)}: { widgets: ${ident}.widgets ?? [], pages: ${ident}.pages ?? [] },\\n`,\n    );\n  });\n  return {\n    EXPERIENCE_IMPORTS: imports.join('\\n'),\n    EXPERIENCE_ENTRIES: entries.join(''),\n  };\n}\n\n/**\n * The shell's registry at a repo root: every integration package's own\n * `harness.config.ts`, concatenated, so each integration's widgets, tile and\n * activation surfaces and its OAuth routes keep working.\n */\nfunction renderRepoRegistry(repo: RepoShellPackages): string {\n  const imports = repo.integrations.map((integration, index) => {\n    const specifier = JSON.stringify(\n      `${SHELL_TO_PROJECT_REGISTRY}${integration.dir}/${path.basename(HARNESS_CONFIG_FILENAME, '.ts')}`,\n    );\n    return `import { harnessIntegrations as integration${index} } from ${specifier};`;\n  });\n  const spread = repo.integrations\n    .map((_, index) => `...integration${index}`)\n    .join(', ');\n  return [\n    '// Generated by `ekanos dev` at a repo root. Each integration package owns its own harness.config.ts.',\n    \"import { defineHarnessConfig } from '@ekanos/harness/config';\",\n    ...imports,\n    '',\n    `export const harnessIntegrations = defineHarnessConfig([${spread}]);`,\n    '',\n  ].join('\\n');\n}\n\n/** From `.ekanos/harness/` (where the shell registry sits) up to the repo root. */\nconst SHELL_TO_PROJECT_REGISTRY = '../../';\n\n/**\n * Turn validated `sourceGlobs` into the `@source` lines the generated\n * stylesheet carries, each relative to the shell's `styles/` directory.\n *\n * Tailwind never scans what it is not pointed at, and a glob that matches\n * nothing fails silently — so an integration living outside the default\n * layout renders completely unstyled with no error anywhere. That is what\n * `sourceGlobs` is for, and until now it was parsed and thrown away.\n */\nfunction renderSourceGlobs(globs: readonly string[]): string {\n  if (globs.length === 0) return '';\n  const lines = globs.map((glob) => `@source '${SHELL_TO_PROJECT}${glob}';`);\n  return `\\n/* From \"sourceGlobs\" in ekanos.json. */\\n${lines.join('\\n')}\\n`;\n}\n\n/**\n * From `.ekanos/harness/app/experience/` back up to the project root: the\n * experience layout imports the entry by this relative path.\n */\nconst SHELL_APP_TO_PROJECT = '../../../../';\n\n/** The shell file set: the legacy shell + console, plus the Experience view for an experience. */\nexport function shellFilesFor(\n  experience: boolean,\n): readonly { template: string; dest: string }[] {\n  if (!experience) return SHELL_FILES;\n  const replaced = new Set(EXPERIENCE_SHELL_FILES.map((f) => f.dest));\n  return [\n    ...SHELL_FILES.filter((f) => !replaced.has(f.dest)),\n    ...EXPERIENCE_SHELL_FILES,\n  ];\n}\n\n/** The repo shell file set. */\nexport function repoShellFiles(): readonly {\n  template: string;\n  dest: string;\n}[] {\n  return [\n    ...SHELL_FILES.filter((f) => !REPO_REPLACED_DESTS.has(f.dest)),\n    ...REPO_SHELL_ONLY_FILES,\n    ...REPO_EXPERIENCE_PAGES,\n    {\n      template: 'harness/repo/app/repo-experiences.ts.tmpl',\n      dest: 'app/repo-experiences.ts',\n    },\n  ];\n}\n\n/** From `.ekanos/harness/styles/` back up to the project root. */\nconst SHELL_TO_PROJECT = '../../../';\n\n/**\n * Establish that `.ekanos/harness` is a tree WE generated before writing a\n * single byte into it, and return the version marker it carried.\n *\n * Path location alone is not ownership. A directory that exists but carries no\n * `.ekanos-version` was put there by something else — a partner, another tool,\n * a symlink — and clobbering it because it happens to sit at the path we like\n * is the same class of mistake as following a symlink. An empty directory is\n * fine (that is just `mkdir -p` having run), and `--force` is the explicit\n * override.\n *\n * Runs BEFORE `bootstrapHarnessConfig` in `dev`, so a shell that cannot be\n * written leaves the project completely untouched rather than half-scaffolded.\n */\nexport function assertShellDirIsOurs(\n  harnessDir: string,\n  force: boolean,\n): string | null {\n  // `.ekanos` first: through a symlinked `.ekanos`, the lstat below would\n  // describe the link's target, and the build-cache `rmSync` would delete\n  // outside the project.\n  const ekanosDir = path.dirname(harnessDir);\n  const parentKind = classifyPath(ekanosDir);\n  if (parentKind === 'symlink') {\n    throw invalidStateError(\n      `${ekanosDir} is a symlink, so \"ekanos dev\" will not write through it.`,\n      `Delete the ${ekanosDir} link and re-run \"ekanos dev\" — the shell is ` +\n        'generated, so nothing is lost.',\n    );\n  }\n  if (parentKind !== 'missing' && parentKind !== 'directory') {\n    throw invalidStateError(\n      `${ekanosDir} exists and is not a directory.`,\n      `Move or delete ${ekanosDir}, then re-run \"ekanos dev\".`,\n    );\n  }\n\n  const kind = classifyPath(harnessDir);\n\n  if (kind === 'symlink') {\n    throw invalidStateError(\n      `${harnessDir} is a symlink, so \"ekanos dev\" will not write through it.`,\n      `Delete ${harnessDir} and re-run \"ekanos dev\" — the shell is generated, ` +\n        'so nothing is lost.',\n    );\n  }\n\n  if (kind !== 'missing' && kind !== 'directory') {\n    throw invalidStateError(\n      `${harnessDir} exists and is not a directory.`,\n      `Move or delete ${harnessDir}, then re-run \"ekanos dev\".`,\n    );\n  }\n\n  if (kind === 'missing') return null;\n\n  const state = readShellMarkerState(harnessDir);\n\n  // A marker we wrote, however mangled, still identifies the tree as ours.\n  if (state.kind === 'ok') return state.marker.harness;\n  if (state.kind === 'corrupt' || force) return null;\n\n  if (fs.readdirSync(harnessDir).length === 0) return null;\n\n  throw invalidStateError(\n    `${harnessDir} already contains files but no ${VERSION_MARKER} marker, ` +\n      'so it was not generated by \"ekanos dev\".',\n    `Delete ${harnessDir} if you do not need it, or pass --force to ` +\n      'overwrite it. Everything \"ekanos dev\" generates is reproducible; ' +\n      'anything else in there is not.',\n  );\n}\n\n/**\n * The module specifier `harness.config.ts` uses to import the partner's\n * integration: the `entry` from ekanos.json, made relative and extension-free.\n * \"src/integration.ts\" → \"src/integration\".\n */\nexport function entryImportSpecifier(entry: string): string {\n  const normalized = entry.split(path.sep).join('/').replace(/^\\.\\//, '');\n  return normalized.replace(/\\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/, '');\n}\n\n/**\n * The same specifier as a JavaScript string LITERAL, ready to drop into a\n * generated `import` statement.\n *\n * `entry` is attacker-influenced data from `ekanos.json`, and a POSIX filename\n * may legally contain a quote or a newline. Interpolating it raw would let a\n * crafted-but-valid path close the string and append statements to the module\n * we generate. `JSON.stringify` produces a correctly escaped literal, which is\n * the actual fix; the explicit rejection below is a second line that also\n * gives the partner a comprehensible error instead of a bizarre filename\n * silently appearing, escaped, in their config.\n *\n * This does not cross a trust boundary on its own — a partner's own code runs\n * unsandboxed anyway — but \"the templates cannot be injected into\" is a claim\n * we make, and it should be true.\n */\nexport function entryImportLiteral(entry: string, prefix = './'): string {\n  const specifier = entryImportSpecifier(entry);\n\n  // eslint-disable-next-line no-control-regex\n  if (/[\"'`\\\\\\n\\r\\u0000-\\u001f]/.test(specifier)) {\n    throw preconditionError(\n      `The \"entry\" in ekanos.json contains characters that cannot appear in ` +\n        `an import specifier: ${JSON.stringify(specifier)}.`,\n      'Rename the file so its path has no quotes, backslashes or control ' +\n        'characters, then update \"entry\" in ekanos.json to match.',\n    );\n  }\n\n  return JSON.stringify(`${prefix}${specifier}`);\n}\n\nexport interface BootstrapConfigResult {\n  /** True only when this run created the file. */\n  bootstrapped: boolean;\n  configPath: string;\n}\n\n/**\n * Write a starter `harness.config.ts` at the project root — ONCE.\n *\n * An existing file is left strictly alone, byte for byte, and no flag changes\n * that: it is the one harness file the partner owns, it is git-tracked, and\n * regenerating it would throw away their fixtures. `--force` regenerates the\n * shell, never this.\n */\nexport function bootstrapHarnessConfig(\n  projectDir: string,\n  integrations: readonly { slug: string; entry: string }[],\n): BootstrapConfigResult {\n  // An experience project has no integration of its own to register: the\n  // harness serves its integrations from `ekanos.json` through /__ekanos/api.\n  const configPath = path.join(projectDir, HARNESS_CONFIG_FILENAME);\n  const kind = classifyPath(configPath);\n\n  // A symlink here — including a dangling one, which `existsSync` reports as\n  // absent — would have us write through to its target. Since this file is the\n  // partner's to own, the only safe answer is to touch nothing and say why.\n  if (kind === 'symlink') {\n    throw invalidStateError(\n      `${configPath} is a symlink, so \"ekanos dev\" will not write through it.`,\n      `Replace ${configPath} with a real file (or delete it to have one ` +\n        'generated), then re-run \"ekanos dev\".',\n    );\n  }\n\n  if (kind !== 'missing') {\n    return { bootstrapped: false, configPath };\n  }\n\n  writeFileNoFollow(projectDir, configPath, renderHarnessConfig(integrations));\n\n  return { bootstrapped: true, configPath };\n}\n\n/**\n * Render the starter registry for EVERY integration the project declares.\n *\n * The harness registry is an array and `ekanos.json` can now hold a list, so a\n * project's second integration reaches the harness the same way its first\n * does. Each entry imports the definition under a distinct local identifier\n * derived from its slug, because two `integration` imports in one module do\n * not compile.\n */\nfunction renderHarnessConfig(\n  integrations: readonly { slug: string; entry: string }[],\n): string {\n  const imports: string[] = [];\n  const entries: string[] = [];\n\n  for (const integration of integrations) {\n    const ident = identifierForSlug(integration.slug);\n    imports.push(\n      `import { integration as ${ident} } from ${entryImportLiteral(\n        integration.entry,\n      )};`,\n    );\n    entries.push(\n      readTemplate('harness.config.entry.ts.tmpl', {\n        IDENT: ident,\n        SLUG: integration.slug,\n      }),\n    );\n  }\n\n  return readTemplate('harness.config.ts.tmpl', {\n    INTEGRATION_IMPORTS: imports.join('\\n'),\n    INTEGRATION_ENTRIES: entries.join(''),\n  });\n}\n\n/**\n * \"acme-crm\" → \"acmeCrm\". A slug is kebab-case by schema, so this only has to\n * handle hyphens, and a leading digit is impossible.\n */\nexport function identifierForSlug(slug: string): string {\n  const camel = slug.replace(/-([a-z0-9])/g, (_, char: string) =>\n    char.toUpperCase(),\n  );\n  return /^[0-9]/.test(camel) ? `i${camel}` : camel;\n}\n\n/**\n * Add `.ekanos/` to the project `.gitignore`, exactly once.\n *\n * Matching is line-wise over the spellings git treats as the same rule\n * (`.ekanos`, `.ekanos/`, `/.ekanos/`), so re-running never appends a\n * duplicate — the thing that makes a scaffold verb safe to run in a loop.\n * A negation (`!.ekanos/`) is deliberately NOT treated as a match: the\n * partner meant to un-ignore it, and we do not fight that silently.\n */\nexport function ensureGitignoreEntry(projectDir: string): boolean {\n  const gitignorePath = path.join(projectDir, '.gitignore');\n  const block = `# Ekanos dev harness — generated by \"ekanos dev\", never edited by hand\\n${GITIGNORE_ENTRY}\\n`;\n\n  const kind = classifyPath(gitignorePath);\n\n  if (kind === 'symlink') {\n    throw invalidStateError(\n      `${gitignorePath} is a symlink, so \"ekanos dev\" will not append to it.`,\n      `Add \"${GITIGNORE_ENTRY}\" to your real .gitignore yourself, or replace ` +\n        `${gitignorePath} with a regular file, then re-run \"ekanos dev\".`,\n    );\n  }\n\n  if (kind === 'missing') {\n    writeFileNoFollow(projectDir, gitignorePath, block);\n    return true;\n  }\n\n  const existing = readFileNoFollow(projectDir, gitignorePath) ?? '';\n  if (gitignoreCovers(existing)) return false;\n\n  const separator =\n    existing.length === 0 || existing.endsWith('\\n') ? '' : '\\n';\n  appendFileNoFollow(projectDir, gitignorePath, `${separator}\\n${block}`);\n  return true;\n}\n\nfunction gitignoreCovers(source: string): boolean {\n  const equivalents = new Set(['.ekanos', '.ekanos/', '/.ekanos', '/.ekanos/']);\n  return source\n    .split('\\n')\n    .map((line) => line.trim())\n    .some((line) => equivalents.has(line));\n}\n"]}