@ekanos/cli 0.3.1 → 0.3.3

package/dist/auth/ekanos-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ekanos-api.js","sourceRoot":"","sources":["../../src/auth/ekanos-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AAEH,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAuBlC,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY;IACnD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,sBAAsB,EAAE;QAC5D,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACxC,CAAC,CAAC;IAEH,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAErC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,gBAAgB,CAAC,IAAI,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,sBAAsB,CAAC,CAAC;IAErE,MAAM,MAAM,GAAG;QACb,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;QACnC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;QAC7B,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;QACtB,2BAA2B,EAAE,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC;QACpE,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC;KACxC,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,iBAAiB,CACrB,GAAG,IAAI,kDAAkD,EACzD,sEAAsE;YACpE,6BAA6B,CAChC,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,sDAAsD;IACtD,cAAc,CAAC,MAAM,CAAC,2BAA4B,EAAE,MAAM,CAAC,WAAY,CAAC,CAAC;IACzE,cAAc,CAAC,MAAM,CAAC,aAAc,EAAE,MAAM,CAAC,WAAY,CAAC,CAAC;IAE3D,OAAO,MAAuB,CAAC;AACjC,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,gBAAwB;IAExB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,uBAAuB,EAAE;QAC7D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAC;KAC/D,CAAC,CAAC;IAEH,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAErC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,GAAG,IAAI,+BAA+B,EACtC,sEAAsE;YACpE,aAAa,IAAI,mDAAmD;YACpE,6BAA6B,CAChC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,SAAS,CACd,MAAM,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,uBAAuB,CAAC,EACxD,IAAI,CACL,CAAC;AACJ,CAAC;AAqBD,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,iBAAyB,EACzB,OAAO,GAAmB,EAAE;;IAE5B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,uBAAuB,EAAE;QAC7D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC;KACjE,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6EAA6E;IAC7E,kCAAkC;IAClC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAE9C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAA,OAAO,CAAC,cAAc,+CAAtB,OAAO,EAAkB,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,oBAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAE3C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,0BAA0B,IAAI,sBAAsB,EACpD,kEAAkE;YAChE,iEAAiE;YACjE,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAClE,uEAAuE;QACvE,4EAA4E;QAC5E,MAAM,YAAY,CAChB,GAAG,IAAI,oEAAoE,EAC3E,qEAAqE;YACnE,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,GAAG,IAAI,oDAAoD,EAC3D,cAAc,IAAI,kDAAkD;YAClE,aAAa,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,YAAY,CAChB,GAAG,IAAI,mEAAmE,EAC1E,qEAAqE;YACnE,mEAAmE,CACtE,CAAC;IACJ,CAAC;IAED,uCAAY,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,KAAE,iBAAiB,EAAE,OAAO,IAAG;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,WAAmB;;IAEnB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,sBAAsB,EAAE;QAC5D,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;KACF,CAAC,CAAC;IAEH,0EAA0E;IAC1E,qCAAqC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,GAAG,IAAI,yDAAyD,EAChE,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,GAAG,IAAI,6CAA6C,EACpD,cAAc,IAAI,kDAAkD;YAClE,gCAAgC,CACnC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,gBAAgB,CAAC,IAAI,EAAE,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,GAAG,IAAI,sBAAsB,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,OAAC,IAAI,CAAC,IAAI,mCAAI,EAAE,CAA4B,CAAC;IAC1D,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAExB,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,YAAY,CAChB,GAAG,IAAI,0CAA0C,EACjD,sEAAsE;YACpE,6BAA6B,CAChC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,IAA6B,EAAE,IAAY;;IAC5D,MAAM,IAAI,GAAG,OAAC,IAAI,CAAC,IAAI,mCAAI,EAAE,CAA4B,CAAC;IAE1D,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE5B,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,YAAY,CAChB,GAAG,IAAI,kCAAkC,EACzC,sEAAsE;YACpE,8BAA8B,CACjC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,IAAiB;IAEjB,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,kCACjB,IAAI,KACP,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAC/C,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEtE,MAAM,YAAY,CAChB,mBAAmB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,EACnD,4DAA4D;YAC1D,gCAAgC,CACnC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;eAAO,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,QAAkB,EAClB,IAAY;IAEZ,IAAI,MAAe,CAAC;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;eAAO,CAAC;QACP,MAAM,YAAY,CAChB,GAAG,IAAI,uBAAuB,EAC9B,sEAAsE;YACpE,iCAAiC,CACpC,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,YAAY,CAChB,GAAG,IAAI,kCAAkC,EACzC,uDAAuD,CACxD,CAAC;IACJ,CAAC;IAED,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAC3B,QAAkB,EAClB,IAAY,EACZ,IAA8B;IAE9B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO;IAEpC,yEAAyE;IACzE,2EAA2E;IAC3E,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO;IAEvD,MAAM,iBAAiB,CACrB,GAAG,IAAI,sCAAsC,EAC7C,8DAA8D;QAC5D,6DAA6D,CAChE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,KAAa,EAAE,MAAc;IACnE,OAAO,YAAY,CACjB,GAAG,IAAI,GAAG,KAAK,cAAc,MAAM,GAAG,EACtC,MAAM,IAAI,GAAG;QACX,CAAC,CAAC,sEAAsE;YACpE,2CAA2C;QAC/C,CAAC,CAAC,gEAAgE;YAC9D,YAAY,KAAK,GAAG,CAC3B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,MAAc;IACtD,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;eAAO,CAAC;QACP,MAAM,iBAAiB,CACrB,wDAAwD,EACxD,uDAAuD,CACxD,CAAC;IACJ,CAAC;IAED,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,EAC/C,CAAC;QACD,MAAM,iBAAiB,CACrB,sEAAsE;YACpE,WAAW,GAAG,CAAC,IAAI,IAAI,EACzB,6DAA6D;YAC3D,sDAAsD,CACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;AACvC,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC","sourcesContent":["import { authRequiredError, networkError, preconditionError } from '../errors';\n\n/**\n * The CLI's client for the four Ekanos auth routes.\n *\n * ---------------------------------------------------------------------------\n * WIRE CONTRACT — the seam between this package and the Ekanos web app.\n *\n * The server side is the host's `/api/auth/cli-<verb>` routes, and it ships on\n * a DIFFERENT BRANCH from this file. This block is the single place the shapes\n * are written down on the client side; if you change one side, change the\n * other and update this block. Nothing here imports host code — the two\n * halves are coupled only by HTTP, and the tests stub `fetch`, never the route.\n *\n *   GET /api/auth/cli-config                                   [no auth]\n *     → 200 { auth0_domain, client_id, scope,\n *             device_authorization_endpoint, token_endpoint }   all strings\n *     → 503 { error, code: \"CLI_NOT_CONFIGURED\" }   deployment not provisioned\n *\n *   POST /api/auth/cli-session                                 [no auth]\n *     ← { auth0_access_token: string }\n *     → 200 { access_token, expires_at, user: { id, email } }\n *     → 400 { error, code: \"INVALID_REQUEST\" }      malformed / wrong shape\n *     → 401 { error, code: \"SESSION_EXPIRED\" }      Auth0 said no, OR no\n *                                                   Ekanos account for it\n *     → 503 { error, code: \"CLI_NOT_CONFIGURED\" }   deployment not provisioned\n *     → 500 { error, code: \"INTERNAL_ERROR\" }\n *\n *   POST /api/auth/cli-refresh                                 [no auth]\n *     ← { auth0_refresh_token: string }\n *     → 200 { access_token, expires_at, user: { id, email },\n *             auth0_refresh_token }   ← ROTATED; the presented one is dead\n *     → 400 { error, code: \"INVALID_REQUEST\" }\n *     → 401 { error, code: \"SESSION_EXPIRED\" }      expired or revoked\n *     → 404 { error, code: \"ACCOUNT_NOT_FOUND\",\n *             auth0_refresh_token }                 no Ekanos account\n *     → 502 { error, code: \"TOKEN_EXCHANGE_FAILED\" } Auth0 returned no\n *                                                   rotated token\n *     → 503 { error, code: \"CLI_NOT_CONFIGURED\" }   deployment not provisioned\n *     → 503 { error, code: \"REFRESH_INCOMPLETE\",\n *             auth0_refresh_token }                 rotated, but /userinfo\n *                                                   did not answer; RETRYABLE\n *     → 500 { error, code: \"INTERNAL_ERROR\",\n *             auth0_refresh_token? }                present iff rotation\n *                                                   completed before the throw\n *\n *   !! cli-refresh MAY RETURN `auth0_refresh_token` ON ERROR RESPONSES, and a\n *      client MUST persist it before surfacing the error. Once the server's\n *      exchange with Auth0 succeeds the presented token is dead and the value\n *      in that body is the ONLY copy in existence; discarding it on a failure\n *      path destroys the session permanently. Note 503 has TWO codes here —\n *      branch on `code`, not on the status alone.\n *\n *   All three routes above read the Fusion CLI Auth0 application config, so all\n *   three can answer 503 CLI_NOT_CONFIGURED. cli-whoami cannot — it reads no\n *   Auth0 config, only the caller's bearer token.\n *\n *   GET /api/auth/cli-whoami        [Authorization: Bearer <access_token>]\n *     → 200 { user: { id, email, name } }\n *     → 401 { error, code: \"AUTH_REQUIRED\" }        token absent or invalid\n *     → 403 { error, code: \"MFA_REQUIRED\" }\n *     → 404 { error, code: \"ACCOUNT_NOT_FOUND\" }\n *     → 3xx                                         treated as 401, see below\n *\n * `access_token` is an Ekanos HS256 JWT. Every authenticated Ekanos route\n * accepts it as `Authorization: Bearer` — see `resolveRequestSupabaseJwt` in\n * `@kit/supabase`, which both `requireUser` and the RLS server client consume.\n * ---------------------------------------------------------------------------\n *\n * Two rules hold everywhere in this file:\n *\n *  - `redirect: 'manual'`. Ekanos answers an unauthenticated page request with\n *    a 307 to `/auth/sign-in`; Node's fetch follows redirects by default, so\n *    without this a stale token would come back as a 200 full of HTML and be\n *    read as success. A 3xx here is treated as \"not authenticated\", full stop.\n *\n *  - No token is ever interpolated into an error message. The server's error\n *    bodies are `{ error, code }` documents that do not echo credentials, and\n *    the request bodies that DO carry credentials are never included in a\n *    thrown message.\n */\n\nconst REQUEST_TIMEOUT_MS = 15_000;\n\nexport interface CliAuthConfig {\n  auth0Domain: string;\n  clientId: string;\n  scope: string;\n  deviceAuthorizationEndpoint: string;\n  tokenEndpoint: string;\n}\n\nexport interface EkanosSession {\n  accessToken: string;\n  expiresAt: string;\n  userId: string;\n  email: string | null;\n}\n\nexport interface EkanosIdentity {\n  id: string;\n  email: string | null;\n  name: string | null;\n}\n\n/** Fetch the device-flow parameters for a host. */\nexport async function fetchCliAuthConfig(host: string): Promise<CliAuthConfig> {\n  const response = await request(`${host}/api/auth/cli-config`, {\n    method: 'GET',\n    headers: { accept: 'application/json' },\n  });\n\n  throwIfNotConfigured(response, host);\n\n  if (!response.ok) {\n    throw unexpectedStatus(host, '/api/auth/cli-config', response.status);\n  }\n\n  const body = await readJson(response, `${host}/api/auth/cli-config`);\n\n  const config = {\n    auth0Domain: str(body.auth0_domain),\n    clientId: str(body.client_id),\n    scope: str(body.scope),\n    deviceAuthorizationEndpoint: str(body.device_authorization_endpoint),\n    tokenEndpoint: str(body.token_endpoint),\n  };\n\n  if (Object.values(config).some((value) => value === null)) {\n    throw preconditionError(\n      `${host} returned an incomplete CLI login configuration.`,\n      `Confirm the deployment is running an Ekanos build that includes the ` +\n        `/api/auth/cli-config route.`,\n    );\n  }\n\n  // The endpoints come from the server, so they are attacker-controlled if the\n  // host is. Pin them to the Auth0 domain the same response declares, so a\n  // compromised or misconfigured Ekanos cannot redirect the device flow — and\n  // the resulting credentials — to an arbitrary origin.\n  assertOnDomain(config.deviceAuthorizationEndpoint!, config.auth0Domain!);\n  assertOnDomain(config.tokenEndpoint!, config.auth0Domain!);\n\n  return config as CliAuthConfig;\n}\n\n/** Exchange a verified Auth0 access token for an Ekanos JWT. */\nexport async function createEkanosSession(\n  host: string,\n  auth0AccessToken: string,\n): Promise<EkanosSession> {\n  const response = await request(`${host}/api/auth/cli-session`, {\n    method: 'POST',\n    headers: { 'content-type': 'application/json', accept: 'application/json' },\n    body: JSON.stringify({ auth0_access_token: auth0AccessToken }),\n  });\n\n  throwIfNotConfigured(response, host);\n\n  if (response.status === 401) {\n    throw authRequiredError(\n      `${host} rejected the Auth0 identity.`,\n      `Run \"ekanos login\" again. If it keeps failing, confirm your account ` +\n        `exists on ${host} — the browser login can succeed for an identity ` +\n        `that has no Ekanos account.`,\n    );\n  }\n\n  if (!response.ok) {\n    throw unexpectedStatus(host, '/api/auth/cli-session', response.status);\n  }\n\n  return toSession(\n    await readJson(response, `${host}/api/auth/cli-session`),\n    host,\n  );\n}\n\nexport interface RefreshedSession extends EkanosSession {\n  /** The ROTATED refresh token. The presented one is already invalid. */\n  auth0RefreshToken: string;\n}\n\nexport interface RefreshOptions {\n  /**\n   * Called the INSTANT a rotated refresh token is seen in the response — on\n   * success and on failure alike, before anything is thrown.\n   *\n   * Persist-on-learn, not persist-on-success. Once the server's exchange with\n   * Auth0 succeeds the presented token is dead and the replacement in that\n   * body is the only copy in existence, so a client that only saves it on the\n   * happy path destroys the partner's credential the first time /userinfo\n   * blips. The callback runs before any throw so no error path can skip it.\n   */\n  onRotatedToken?: (rotated: string) => void;\n}\n\n/** Re-mint an Ekanos JWT from the stored Auth0 refresh token. */\nexport async function refreshEkanosSession(\n  host: string,\n  auth0RefreshToken: string,\n  options: RefreshOptions = {},\n): Promise<RefreshedSession> {\n  const response = await request(`${host}/api/auth/cli-refresh`, {\n    method: 'POST',\n    headers: { 'content-type': 'application/json', accept: 'application/json' },\n    body: JSON.stringify({ auth0_refresh_token: auth0RefreshToken }),\n  });\n\n  // Read the body FIRST, whatever the status: the rotated token can arrive on\n  // a 503, a 404 or a 500 just as readily as on a 200, and it must be captured\n  // before any branch below throws.\n  const body = await readOptionalJson(response);\n  const rotated = str(body.auth0_refresh_token);\n\n  if (rotated) {\n    options.onRotatedToken?.(rotated);\n  }\n\n  throwIfNotConfigured(response, host, body);\n\n  if (response.status === 401) {\n    throw authRequiredError(\n      `The stored session for ${host} is no longer valid.`,\n      `Run \"ekanos login\" to sign in again. This is expected after the ` +\n        `refresh token expires, after it is revoked in Auth0, or if two ` +\n        `machines used the same credentials file.`,\n    );\n  }\n\n  if (response.status === 503 && body.code === 'REFRESH_INCOMPLETE') {\n    // NOT an auth failure. The credential was renewed — and, thanks to the\n    // callback above, already saved. Auth0's /userinfo is simply not answering.\n    throw networkError(\n      `${host} renewed the session but could not verify the identity with Auth0.`,\n      `Retry in a moment — your credentials are still valid and have been ` +\n        `updated. You do NOT need to run \"ekanos login\" again.`,\n    );\n  }\n\n  if (response.status === 404) {\n    throw authRequiredError(\n      `${host} has no Ekanos account for the signed-in identity.`,\n      `Sign in to ${host} in a browser once to have the account created, ` +\n        `then retry.`,\n    );\n  }\n\n  if (!response.ok) {\n    throw unexpectedStatus(host, '/api/auth/cli-refresh', response.status);\n  }\n\n  if (!rotated) {\n    throw networkError(\n      `${host} refreshed the session without returning a rotated refresh token.`,\n      `Run \"ekanos login\" to start a fresh session, and report this — the ` +\n        `deployment's Auth0 CLI application may not have rotation enabled.`,\n    );\n  }\n\n  return { ...toSession(body, host), auth0RefreshToken: rotated };\n}\n\n/**\n * Prove the Ekanos JWT authenticates. Returns null on 401 so the caller can\n * decide whether to refresh and retry — an expired access token is an ordinary\n * event, not an error.\n */\nexport async function fetchIdentity(\n  host: string,\n  accessToken: string,\n): Promise<EkanosIdentity | null> {\n  const response = await request(`${host}/api/auth/cli-whoami`, {\n    method: 'GET',\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${accessToken}`,\n    },\n  });\n\n  // 401, or the 307 that an auth-gated Ekanos route answers with. Both mean\n  // \"this token did not authenticate\".\n  if (response.status === 401 || isRedirect(response.status)) {\n    return null;\n  }\n\n  if (response.status === 403) {\n    throw authRequiredError(\n      `${host} requires multi-factor authentication for this account.`,\n      `Complete MFA in the browser, then run \"ekanos login\" again.`,\n    );\n  }\n\n  if (response.status === 404) {\n    throw authRequiredError(\n      `${host} has no account for the signed-in identity.`,\n      `Sign in to ${host} in a browser once to have the account created, ` +\n        `then run \"ekanos login\" again.`,\n    );\n  }\n\n  if (!response.ok) {\n    throw unexpectedStatus(host, '/api/auth/cli-whoami', response.status);\n  }\n\n  const body = await readJson(response, `${host}/api/auth/cli-whoami`);\n  const user = (body.user ?? {}) as Record<string, unknown>;\n  const id = str(user.id);\n\n  if (!id) {\n    throw networkError(\n      `${host} returned an identity without a user id.`,\n      `Confirm the deployment is running an Ekanos build that includes the ` +\n        `/api/auth/cli-whoami route.`,\n    );\n  }\n\n  return { id, email: str(user.email), name: str(user.name) };\n}\n\nfunction toSession(body: Record<string, unknown>, host: string): EkanosSession {\n  const user = (body.user ?? {}) as Record<string, unknown>;\n\n  const accessToken = str(body.access_token);\n  const expiresAt = str(body.expires_at);\n  const userId = str(user.id);\n\n  if (!accessToken || !expiresAt || !userId) {\n    throw networkError(\n      `${host} returned an incomplete session.`,\n      `Confirm the deployment is running an Ekanos build that includes the ` +\n        `CLI auth routes, then retry.`,\n    );\n  }\n\n  return { accessToken, expiresAt, userId, email: str(user.email) };\n}\n\nexport async function request(\n  url: string,\n  init: RequestInit,\n): Promise<Response> {\n  try {\n    return await fetch(url, {\n      ...init,\n      redirect: 'manual',\n      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),\n    });\n  } catch (error) {\n    const reason = error instanceof Error ? error.message : String(error);\n\n    throw networkError(\n      `Could not reach ${new URL(url).origin}: ${reason}`,\n      `Check the host is correct and reachable from this machine ` +\n        `(proxy, VPN, DNS), then retry.`,\n    );\n  }\n}\n\n/**\n * Best-effort body read for a response whose status may be an error. Returns\n * an empty object rather than throwing, because the caller needs to inspect\n * the body BEFORE deciding what the status means — and a 500 from a proxy may\n * carry no JSON at all.\n */\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n\nasync function readJson(\n  response: Response,\n  what: string,\n): Promise<Record<string, unknown>> {\n  let parsed: unknown;\n\n  try {\n    parsed = await response.json();\n  } catch {\n    throw networkError(\n      `${what} did not return JSON.`,\n      `Confirm the host is an Ekanos deployment and not a proxy or captive ` +\n        `portal sitting in front of one.`,\n    );\n  }\n\n  if (typeof parsed !== 'object' || parsed === null) {\n    throw networkError(\n      `${what} returned an unexpected payload.`,\n      `Confirm the host is an Ekanos deployment, then retry.`,\n    );\n  }\n\n  return parsed as Record<string, unknown>;\n}\n\n/**\n * 503 means the deployment is not provisioned for CLI login — an operator\n * action that has not happened, not a fault in the request.\n *\n * Every route that reads the Fusion CLI Auth0 config can answer this, so every\n * caller has to check for it. Falling through to `unexpectedStatus` would tell\n * a partner \"confirm the host is an Ekanos deployment\" when the host is a\n * perfectly good Ekanos deployment that is simply missing one env var — and\n * would exit 8 (network, retryable) instead of 9 (precondition, not).\n */\nfunction throwIfNotConfigured(\n  response: Response,\n  host: string,\n  body?: Record<string, unknown>,\n): void {\n  if (response.status !== 503) return;\n\n  // 503 carries two meanings on these routes. Only CLI_NOT_CONFIGURED is a\n  // precondition; REFRESH_INCOMPLETE is transient and handled by its caller.\n  if (body && body.code !== 'CLI_NOT_CONFIGURED') return;\n\n  throw preconditionError(\n    `${host} does not have CLI login configured.`,\n    `Ask the Ekanos operator to provision the \"Fusion CLI\" Auth0 ` +\n      `application and set AUTH0_CLI_CLIENT_ID on that deployment.`,\n  );\n}\n\nfunction unexpectedStatus(host: string, route: string, status: number) {\n  return networkError(\n    `${host}${route} responded ${status}.`,\n    status >= 500\n      ? `The Ekanos deployment returned a server error. Retry shortly; if it ` +\n          `persists, report it with the status code.`\n      : `Confirm the host is an Ekanos deployment running a build that ` +\n          `includes ${route}.`,\n  );\n}\n\nfunction assertOnDomain(endpoint: string, domain: string): void {\n  let url: URL;\n\n  try {\n    url = new URL(endpoint);\n  } catch {\n    throw preconditionError(\n      `The login configuration contains a malformed endpoint.`,\n      `Report this to the operator of the Ekanos deployment.`,\n    );\n  }\n\n  if (\n    url.protocol !== 'https:' ||\n    url.host.toLowerCase() !== domain.toLowerCase()\n  ) {\n    throw preconditionError(\n      `The login configuration points at an endpoint outside its own Auth0 ` +\n        `domain (${url.host}).`,\n      `Do not continue. Report this to the operator of the Ekanos ` +\n        `deployment — it may be misconfigured or compromised.`,\n    );\n  }\n}\n\nfunction isRedirect(status: number): boolean {\n  return status >= 300 && status < 400;\n}\n\nfunction str(value: unknown): string | null {\n  return typeof value === 'string' && value.length > 0 ? value : null;\n}\n"]}

package/dist/auth/session.d.ts

@@ -1,8 +1,8 @@
 import type { CliContext } from '../context.js';
 import { CredentialStore, type StoredSession } from './credential-store.js';
-import { type FusionIdentity } from './fusion-api.js';
+import { type EkanosIdentity } from './ekanos-api.js';
 /**
- * Session plumbing shared by `login`, `logout` and `whoami`: where the Fusion
+ * Session plumbing shared by `login`, `logout` and `whoami`: where the Ekanos
  * host comes from, where credentials live, and how a stale access token is
  * silently replaced.
  */
@@ -11,7 +11,7 @@ export interface AuthEnvironment {
     host: string;
 }
 /**
- * Resolve the Fusion host, in this order:
+ * Resolve the Ekanos host, in this order:
  *
  *   1. the `--host` flag
  *   2. the `EKANOS_HOST` environment variable
@@ -52,7 +52,7 @@ export declare function requireSession(store: CredentialStore, host: string): St
  * and one retry is the whole recovery.
  */
 export declare function resolveIdentity(env: AuthEnvironment, session: StoredSession): Promise<{
-    identity: FusionIdentity;
+    identity: EkanosIdentity;
     session: StoredSession;
 }>;
 /**
@@ -67,7 +67,7 @@ export declare function resolveIdentity(env: AuthEnvironment, session: StoredSes
  * discard it and lock the partner out for good over a transient upstream
  * hiccup: one process, no concurrency needed.
  *
- * So `onRotatedToken` writes it immediately and `refreshFusionSession` invokes
+ * So `onRotatedToken` writes it immediately and `refreshEkanosSession` invokes
  * that before it throws. The write keeps the OLD access token, which is
  * correct: that token is merely expired, while the refresh token is current
  * and is what the next attempt needs.

package/dist/auth/session.js

@@ -2,9 +2,9 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { authRequiredError, usageError } from '../errors.js';
 import { CredentialStore, normalizeHost, resolveEkanosHome, } from './credential-store.js';
-import { fetchIdentity, refreshFusionSession, } from './fusion-api.js';
+import { fetchIdentity, refreshEkanosSession, } from './ekanos-api.js';
 /**
- * Resolve the Fusion host, in this order:
+ * Resolve the Ekanos host, in this order:
  *
  *   1. the `--host` flag
  *   2. the `EKANOS_HOST` environment variable
@@ -21,7 +21,8 @@ import { fetchIdentity, refreshFusionSession, } from './fusion-api.js';
  * ambiguity, so it stays a usage error that LISTS them rather than a guess.
  */
 export function resolveHost(ctx, flag, env, options = {}) {
-    var _a, _b;
+    var _a;
+    var _b;
     const raw = flag !== null && flag !== void 0 ? flag : env.EKANOS_HOST;
     if (raw && raw.trim().length > 0) {
         return normalizeHost(raw.trim());
@@ -50,10 +51,10 @@ export function resolveHost(ctx, flag, env, options = {}) {
             `Pass --host to target a different one.`);
         return host;
     }
-    throw usageError('No Fusion host given.', stored.length > 1
+    throw usageError('No Ekanos host given.', stored.length > 1
         ? `You are logged in to ${stored.length} hosts (${stored.join(', ')}) — ` +
             `pass "--host <url>" to choose one, or set EKANOS_HOST.`
-        : 'Pass "--host https://<your-fusion-host>" or set EKANOS_HOST. ' +
+        : 'Pass "--host https://<your-ekanos-host>" or set EKANOS_HOST. ' +
             '"ekanos login --host <url>" stores the host, so later commands ' +
             'can omit it.');
 }
@@ -163,7 +164,7 @@ export async function resolveIdentity(env, session) {
  * discard it and lock the partner out for good over a transient upstream
  * hiccup: one process, no concurrency needed.
  *
- * So `onRotatedToken` writes it immediately and `refreshFusionSession` invokes
+ * So `onRotatedToken` writes it immediately and `refreshEkanosSession` invokes
  * that before it throws. The write keeps the OLD access token, which is
  * correct: that token is merely expired, while the refresh token is current
  * and is what the next attempt needs.
@@ -172,7 +173,7 @@ export async function refreshStoredSession(env, session) {
     const persistRotated = (rotated) => {
         env.store.write(env.host, Object.assign(Object.assign({}, session), { auth0RefreshToken: rotated, updatedAt: new Date().toISOString() }));
     };
-    const refreshed = await refreshFusionSession(env.host, session.auth0RefreshToken, { onRotatedToken: persistRotated });
+    const refreshed = await refreshEkanosSession(env.host, session.auth0RefreshToken, { onRotatedToken: persistRotated });
     const next = {
         auth0RefreshToken: refreshed.auth0RefreshToken,
         accessToken: refreshed.accessToken,

package/dist/auth/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EACL,eAAe,EAEf,aAAa,EACb,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,aAAa,EACb,oBAAoB,GACrB,MAAM,cAAc,CAAC;AAatB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,WAAW,CACzB,GAAe,EACf,IAAwB,EACxB,GAAuC,EACvC,UAKI,EAAE;;IAEN,MAAM,GAAG,GAAG,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,GAAG,CAAC,WAAW,CAAC;IAEpC,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAErD,IAAI,QAAQ,EAAE,CAAC;YACb,oEAAoE;YACpE,kEAAkE;YAClE,8DAA8D;YAC9D,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YAErC,oEAAoE;YACpE,mEAAmE;YACnE,gEAAgE;YAChE,qEAAqE;YACrE,kDAAkD;YAClD,GAAG,CAAC,GAAG,CACL,iBAAiB,IAAI,oCAAoC;gBACvD,0CAA0C,CAC7C,CAAC;YAEF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAA,MAAA,OAAO,CAAC,KAAK,0CAAE,KAAK,EAAE,mCAAI,EAAE,CAAC;IAE5C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QAExB,GAAG,CAAC,GAAG,CACL,iBAAiB,IAAI,yCAAyC;YAC5D,wCAAwC,CAC3C,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,CACd,uBAAuB,EACvB,MAAM,CAAC,MAAM,GAAG,CAAC;QACf,CAAC,CAAC,wBAAwB,MAAM,CAAC,MAAM,WAAW,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;YACrE,wDAAwD;QAC5D,CAAC,CAAC,+DAA+D;YAC7D,iEAAiE;YACjE,cAAc,CACrB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAExD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GACR,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAC3C,CAAC,CAAE,MAA6B,CAAC,IAAI;QACrC,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE;QACb,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAOD,MAAM,UAAU,sBAAsB,CACpC,GAAe,EACf,QAA4B,EAC5B,GAAuC,EACvC,UAA8B,EAAE;IAEhC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE;QAC3C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK;KACN,CAAC,CAAC;IAEH,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE/B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,QAAQ,CACtB,GAAe,EACf,GAAuC;IAEvC,OAAO,IAAI,eAAe,CAAC;QACzB,IAAI,EAAE,iBAAiB,CAAC,GAAG,CAAC;QAC5B,oEAAoE;QACpE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;KACrC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,GAAe,EAAE,IAAY;IACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAE1B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IAErC,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAEhE,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3E,OAAO;IACT,CAAC;IAED,GAAG,CAAC,IAAI,CACN,WAAW,IAAI,sDAAsD;QACnE,gEAAgE,CACnE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAsB,EACtB,IAAY;IAEZ,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEjC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,iBAAiB,CACrB,oBAAoB,IAAI,GAAG,EAC3B,4BAA4B,IAAI,IAAI,CACrC,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAoB,EACpB,OAAsB;IAEtB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAEpE,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;IAErE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,iBAAiB,CACrB,mBAAmB,GAAG,CAAC,IAAI,wBAAwB,EACnD,6BAA6B,GAAG,CAAC,IAAI,+BAA+B,GAAG,CAAC,IAAI,IAAI,CACjF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAoB,EACpB,OAAsB;IAEtB,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,EAAE;QACzC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,kCACnB,OAAO,KACV,iBAAiB,EAAE,OAAO,EAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IACnC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAC1C,GAAG,CAAC,IAAI,EACR,OAAO,CAAC,iBAAiB,EACzB,EAAE,cAAc,EAAE,cAAc,EAAE,CACnC,CAAC;IAEF,MAAM,IAAI,GAAkB;QAC1B,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEhC,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport type { CliContext } from '../context';\nimport { authRequiredError, usageError } from '../errors';\nimport {\n  CredentialStore,\n  type StoredSession,\n  normalizeHost,\n  resolveEkanosHome,\n} from './credential-store';\nimport {\n  type FusionIdentity,\n  fetchIdentity,\n  refreshFusionSession,\n} from './fusion-api';\n\n/**\n * Session plumbing shared by `login`, `logout` and `whoami`: where the Fusion\n * host comes from, where credentials live, and how a stale access token is\n * silently replaced.\n */\n\nexport interface AuthEnvironment {\n  store: CredentialStore;\n  host: string;\n}\n\n/**\n * Resolve the Fusion host, in this order:\n *\n *   1. the `--host` flag\n *   2. the `EKANOS_HOST` environment variable\n *   3. the `host` field of the project's `ekanos.json` (written by the first\n *      successful `ekanos publish`, or by hand)\n *   4. the credential store, when it holds EXACTLY one host — a partner logged\n *      in to a single deployment should not have to repeat its URL on every\n *      verb, and one stored host is unambiguous\n *\n * Deliberately no default beyond those. A baked-in default would be wrong for\n * every partner running against their own sandbox, and — worse — a CLI that\n * silently picks a host is a CLI that can send a developer's credentials\n * somewhere they did not intend. Two or more stored hosts is exactly that\n * ambiguity, so it stays a usage error that LISTS them rather than a guess.\n */\nexport function resolveHost(\n  ctx: CliContext,\n  flag: string | undefined,\n  env: Record<string, string | undefined>,\n  options: {\n    /** Directory whose ekanos.json may carry a `host` field. */\n    projectDir?: string;\n    /** The credential store, for the sole-stored-host fallback. */\n    store?: CredentialStore;\n  } = {},\n): string {\n  const raw = flag ?? env.EKANOS_HOST;\n\n  if (raw && raw.trim().length > 0) {\n    return normalizeHost(raw.trim());\n  }\n\n  if (options.projectDir) {\n    const declared = readProjectHost(options.projectDir);\n\n    if (declared) {\n      // normalizeHost throws a precondition error for a malformed value —\n      // an EXPLICIT host in ekanos.json that is wrong deserves an error\n      // naming it, never a silent fall-through to a different host.\n      const host = normalizeHost(declared);\n\n      // Announce the choice, like the sole-stored-host branch below. This\n      // source deserves it MOST: ekanos.json is a committed file, so its\n      // host can change under a developer via an ordinary merge or an\n      // agent-applied patch — and this is where login sends the OAuth flow\n      // and publish sends the bearer token and archive.\n      ctx.log(\n        `ekanos: using ${host} — the host saved in ekanos.json. ` +\n          `Pass --host to override for one command.`,\n      );\n\n      return host;\n    }\n  }\n\n  const stored = options.store?.hosts() ?? [];\n\n  if (stored.length === 1) {\n    const host = stored[0]!;\n\n    ctx.log(\n      `ekanos: using ${host} — the only host you are logged in to. ` +\n        `Pass --host to target a different one.`,\n    );\n\n    return host;\n  }\n\n  throw usageError(\n    'No Fusion host given.',\n    stored.length > 1\n      ? `You are logged in to ${stored.length} hosts (${stored.join(', ')}) — ` +\n          `pass \"--host <url>\" to choose one, or set EKANOS_HOST.`\n      : 'Pass \"--host https://<your-fusion-host>\" or set EKANOS_HOST. ' +\n          '\"ekanos login --host <url>\" stores the host, so later commands ' +\n          'can omit it.',\n  );\n}\n\n/**\n * Best-effort read of the `host` field from a directory's ekanos.json.\n *\n * Lenient on purpose: host resolution runs for verbs like `login` that are\n * routinely run OUTSIDE a project, so a missing, unparseable, or host-less\n * ekanos.json is simply \"no answer here\", never an error — the verbs that\n * require a valid project (`publish`, `validate`) load it strictly themselves.\n */\nfunction readProjectHost(projectDir: string): string | null {\n  const configPath = path.join(projectDir, 'ekanos.json');\n\n  let raw: string;\n  try {\n    raw = fs.readFileSync(configPath, 'utf8');\n  } catch {\n    return null;\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    return null;\n  }\n\n  const host =\n    typeof parsed === 'object' && parsed !== null\n      ? (parsed as { host?: unknown }).host\n      : undefined;\n\n  return typeof host === 'string' && host.trim().length > 0\n    ? host.trim()\n    : null;\n}\n\nexport interface ResolveAuthOptions {\n  /** Directory whose ekanos.json may carry a `host` field. */\n  projectDir?: string;\n}\n\nexport function resolveAuthEnvironment(\n  ctx: CliContext,\n  hostFlag: string | undefined,\n  env: Record<string, string | undefined>,\n  options: ResolveAuthOptions = {},\n): AuthEnvironment {\n  const store = newStore(ctx, env);\n  const host = resolveHost(ctx, hostFlag, env, {\n    projectDir: options.projectDir,\n    store,\n  });\n\n  warnOnPlaintextHost(ctx, host);\n\n  return { host, store };\n}\n\n/** A store with no host attached — for `logout --all`. */\nexport function newStore(\n  ctx: CliContext,\n  env: Record<string, string | undefined>,\n): CredentialStore {\n  return new CredentialStore({\n    home: resolveEkanosHome(env),\n    // Permission warnings are diagnostics, not results: stderr, always.\n    warn: (message) => ctx.warn(message),\n  });\n}\n\n/**\n * `http://` is allowed because local development needs it, but sending a\n * bearer token to a plaintext REMOTE host puts it on the wire in the clear.\n * Warn rather than refuse: refusing would break `--host http://localhost:3000`\n * for anyone whose loopback resolves to something other than the names below.\n */\nfunction warnOnPlaintextHost(ctx: CliContext, host: string): void {\n  const url = new URL(host);\n\n  if (url.protocol !== 'http:') return;\n\n  const loopback = ['localhost', '127.0.0.1', '[::1]', '0.0.0.0'];\n\n  if (loopback.includes(url.hostname) || url.hostname.endsWith('.localhost')) {\n    return;\n  }\n\n  ctx.warn(\n    `ekanos: ${host} is plaintext HTTP. Your credentials will cross the ` +\n      `network unencrypted. Use https:// unless this is a local host.`,\n  );\n}\n\nexport function requireSession(\n  store: CredentialStore,\n  host: string,\n): StoredSession {\n  const session = store.read(host);\n\n  if (!session) {\n    throw authRequiredError(\n      `Not logged in to ${host}.`,\n      `Run \"ekanos login --host ${host}\".`,\n    );\n  }\n\n  return session;\n}\n\n/**\n * Resolve the caller's identity, refreshing the access token once if the\n * stored one no longer authenticates.\n *\n * Validity is decided by the SERVER, not by comparing `expiresAt` to the local\n * clock. A container with a skewed clock — the exact environment this flow\n * exists to support — would otherwise either refuse a perfectly good token or\n * keep presenting a dead one. A 401 is the authoritative answer; one refresh\n * and one retry is the whole recovery.\n */\nexport async function resolveIdentity(\n  env: AuthEnvironment,\n  session: StoredSession,\n): Promise<{ identity: FusionIdentity; session: StoredSession }> {\n  const identity = await fetchIdentity(env.host, session.accessToken);\n\n  if (identity) {\n    return { identity, session };\n  }\n\n  const refreshed = await refreshStoredSession(env, session);\n  const retried = await fetchIdentity(env.host, refreshed.accessToken);\n\n  if (!retried) {\n    throw authRequiredError(\n      `The session for ${env.host} could not be renewed.`,\n      `Run \"ekanos logout --host ${env.host}\" then \"ekanos login --host ${env.host}\".`,\n    );\n  }\n\n  return { identity: retried, session: refreshed };\n}\n\n/**\n * Refresh and persist.\n *\n * The rotated refresh token is written the MOMENT the server reports it, not\n * when the refresh finishes. Auth0 rotates as soon as the server's exchange\n * succeeds, so from that instant the presented token is dead and the\n * replacement is the only copy in existence — and `cli-refresh` can still fail\n * afterwards (a `/userinfo` blip, a missing account, an unexpected throw) and\n * return that replacement on an ERROR response. Saving only on success would\n * discard it and lock the partner out for good over a transient upstream\n * hiccup: one process, no concurrency needed.\n *\n * So `onRotatedToken` writes it immediately and `refreshFusionSession` invokes\n * that before it throws. The write keeps the OLD access token, which is\n * correct: that token is merely expired, while the refresh token is current\n * and is what the next attempt needs.\n */\nexport async function refreshStoredSession(\n  env: AuthEnvironment,\n  session: StoredSession,\n): Promise<StoredSession> {\n  const persistRotated = (rotated: string) => {\n    env.store.write(env.host, {\n      ...session,\n      auth0RefreshToken: rotated,\n      updatedAt: new Date().toISOString(),\n    });\n  };\n\n  const refreshed = await refreshFusionSession(\n    env.host,\n    session.auth0RefreshToken,\n    { onRotatedToken: persistRotated },\n  );\n\n  const next: StoredSession = {\n    auth0RefreshToken: refreshed.auth0RefreshToken,\n    accessToken: refreshed.accessToken,\n    expiresAt: refreshed.expiresAt,\n    userId: refreshed.userId,\n    email: refreshed.email,\n    updatedAt: new Date().toISOString(),\n  };\n\n  env.store.write(env.host, next);\n\n  return next;\n}\n"]}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EACL,eAAe,EAEf,aAAa,EACb,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,aAAa,EACb,oBAAoB,GACrB,MAAM,cAAc,CAAC;AAatB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,WAAW,CACzB,GAAe,EACf,IAAwB,EACxB,GAAuC,EACvC,OAAO,GAKH,EAAE;;;IAEN,MAAM,GAAG,GAAG,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,GAAG,CAAC,WAAW,CAAC;IAEpC,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAErD,IAAI,QAAQ,EAAE,CAAC;YACb,oEAAoE;YACpE,kEAAkE;YAClE,8DAA8D;YAC9D,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YAErC,oEAAoE;YACpE,mEAAmE;YACnE,gEAAgE;YAChE,qEAAqE;YACrE,kDAAkD;YAClD,GAAG,CAAC,GAAG,CACL,iBAAiB,IAAI,oCAAoC;gBACvD,0CAA0C,CAC7C,CAAC;YAEF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,MAAM,SAAG,MAAA,OAAO,CAAC,KAAK,0CAAE,KAAK,EAAE,mCAAI,EAAE,CAAC;IAE5C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QAExB,GAAG,CAAC,GAAG,CACL,iBAAiB,IAAI,yCAAyC;YAC5D,wCAAwC,CAC3C,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,CACd,uBAAuB,EACvB,MAAM,CAAC,MAAM,GAAG,CAAC;QACf,CAAC,CAAC,wBAAwB,MAAM,CAAC,MAAM,WAAW,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;YACrE,wDAAwD;QAC5D,CAAC,CAAC,+DAA+D;YAC7D,iEAAiE;YACjE,cAAc,CACrB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAExD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;eAAO,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;eAAO,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GACR,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAC3C,CAAC,CAAE,MAA6B,CAAC,IAAI;QACrC,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE;QACb,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAOD,MAAM,UAAU,sBAAsB,CACpC,GAAe,EACf,QAA4B,EAC5B,GAAuC,EACvC,OAAO,GAAuB,EAAE;IAEhC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE;QAC3C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK;KACN,CAAC,CAAC;IAEH,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE/B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,QAAQ,CACtB,GAAe,EACf,GAAuC;IAEvC,OAAO,IAAI,eAAe,CAAC;QACzB,IAAI,EAAE,iBAAiB,CAAC,GAAG,CAAC;QAC5B,oEAAoE;QACpE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;KACrC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,GAAe,EAAE,IAAY;IACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAE1B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IAErC,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAEhE,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3E,OAAO;IACT,CAAC;IAED,GAAG,CAAC,IAAI,CACN,WAAW,IAAI,sDAAsD;QACnE,gEAAgE,CACnE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAsB,EACtB,IAAY;IAEZ,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEjC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,iBAAiB,CACrB,oBAAoB,IAAI,GAAG,EAC3B,4BAA4B,IAAI,IAAI,CACrC,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAoB,EACpB,OAAsB;IAEtB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAEpE,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;IAErE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,iBAAiB,CACrB,mBAAmB,GAAG,CAAC,IAAI,wBAAwB,EACnD,6BAA6B,GAAG,CAAC,IAAI,+BAA+B,GAAG,CAAC,IAAI,IAAI,CACjF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAoB,EACpB,OAAsB;IAEtB,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,EAAE;QACzC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,kCACnB,OAAO,KACV,iBAAiB,EAAE,OAAO,EAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IACnC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAC1C,GAAG,CAAC,IAAI,EACR,OAAO,CAAC,iBAAiB,EACzB,EAAE,cAAc,EAAE,cAAc,EAAE,CACnC,CAAC;IAEF,MAAM,IAAI,GAAkB;QAC1B,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEhC,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport type { CliContext } from '../context';\nimport { authRequiredError, usageError } from '../errors';\nimport {\n  CredentialStore,\n  type StoredSession,\n  normalizeHost,\n  resolveEkanosHome,\n} from './credential-store';\nimport {\n  type EkanosIdentity,\n  fetchIdentity,\n  refreshEkanosSession,\n} from './ekanos-api';\n\n/**\n * Session plumbing shared by `login`, `logout` and `whoami`: where the Ekanos\n * host comes from, where credentials live, and how a stale access token is\n * silently replaced.\n */\n\nexport interface AuthEnvironment {\n  store: CredentialStore;\n  host: string;\n}\n\n/**\n * Resolve the Ekanos host, in this order:\n *\n *   1. the `--host` flag\n *   2. the `EKANOS_HOST` environment variable\n *   3. the `host` field of the project's `ekanos.json` (written by the first\n *      successful `ekanos publish`, or by hand)\n *   4. the credential store, when it holds EXACTLY one host — a partner logged\n *      in to a single deployment should not have to repeat its URL on every\n *      verb, and one stored host is unambiguous\n *\n * Deliberately no default beyond those. A baked-in default would be wrong for\n * every partner running against their own sandbox, and — worse — a CLI that\n * silently picks a host is a CLI that can send a developer's credentials\n * somewhere they did not intend. Two or more stored hosts is exactly that\n * ambiguity, so it stays a usage error that LISTS them rather than a guess.\n */\nexport function resolveHost(\n  ctx: CliContext,\n  flag: string | undefined,\n  env: Record<string, string | undefined>,\n  options: {\n    /** Directory whose ekanos.json may carry a `host` field. */\n    projectDir?: string;\n    /** The credential store, for the sole-stored-host fallback. */\n    store?: CredentialStore;\n  } = {},\n): string {\n  const raw = flag ?? env.EKANOS_HOST;\n\n  if (raw && raw.trim().length > 0) {\n    return normalizeHost(raw.trim());\n  }\n\n  if (options.projectDir) {\n    const declared = readProjectHost(options.projectDir);\n\n    if (declared) {\n      // normalizeHost throws a precondition error for a malformed value —\n      // an EXPLICIT host in ekanos.json that is wrong deserves an error\n      // naming it, never a silent fall-through to a different host.\n      const host = normalizeHost(declared);\n\n      // Announce the choice, like the sole-stored-host branch below. This\n      // source deserves it MOST: ekanos.json is a committed file, so its\n      // host can change under a developer via an ordinary merge or an\n      // agent-applied patch — and this is where login sends the OAuth flow\n      // and publish sends the bearer token and archive.\n      ctx.log(\n        `ekanos: using ${host} — the host saved in ekanos.json. ` +\n          `Pass --host to override for one command.`,\n      );\n\n      return host;\n    }\n  }\n\n  const stored = options.store?.hosts() ?? [];\n\n  if (stored.length === 1) {\n    const host = stored[0]!;\n\n    ctx.log(\n      `ekanos: using ${host} — the only host you are logged in to. ` +\n        `Pass --host to target a different one.`,\n    );\n\n    return host;\n  }\n\n  throw usageError(\n    'No Ekanos host given.',\n    stored.length > 1\n      ? `You are logged in to ${stored.length} hosts (${stored.join(', ')}) — ` +\n          `pass \"--host <url>\" to choose one, or set EKANOS_HOST.`\n      : 'Pass \"--host https://<your-ekanos-host>\" or set EKANOS_HOST. ' +\n          '\"ekanos login --host <url>\" stores the host, so later commands ' +\n          'can omit it.',\n  );\n}\n\n/**\n * Best-effort read of the `host` field from a directory's ekanos.json.\n *\n * Lenient on purpose: host resolution runs for verbs like `login` that are\n * routinely run OUTSIDE a project, so a missing, unparseable, or host-less\n * ekanos.json is simply \"no answer here\", never an error — the verbs that\n * require a valid project (`publish`, `validate`) load it strictly themselves.\n */\nfunction readProjectHost(projectDir: string): string | null {\n  const configPath = path.join(projectDir, 'ekanos.json');\n\n  let raw: string;\n  try {\n    raw = fs.readFileSync(configPath, 'utf8');\n  } catch {\n    return null;\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    return null;\n  }\n\n  const host =\n    typeof parsed === 'object' && parsed !== null\n      ? (parsed as { host?: unknown }).host\n      : undefined;\n\n  return typeof host === 'string' && host.trim().length > 0\n    ? host.trim()\n    : null;\n}\n\nexport interface ResolveAuthOptions {\n  /** Directory whose ekanos.json may carry a `host` field. */\n  projectDir?: string;\n}\n\nexport function resolveAuthEnvironment(\n  ctx: CliContext,\n  hostFlag: string | undefined,\n  env: Record<string, string | undefined>,\n  options: ResolveAuthOptions = {},\n): AuthEnvironment {\n  const store = newStore(ctx, env);\n  const host = resolveHost(ctx, hostFlag, env, {\n    projectDir: options.projectDir,\n    store,\n  });\n\n  warnOnPlaintextHost(ctx, host);\n\n  return { host, store };\n}\n\n/** A store with no host attached — for `logout --all`. */\nexport function newStore(\n  ctx: CliContext,\n  env: Record<string, string | undefined>,\n): CredentialStore {\n  return new CredentialStore({\n    home: resolveEkanosHome(env),\n    // Permission warnings are diagnostics, not results: stderr, always.\n    warn: (message) => ctx.warn(message),\n  });\n}\n\n/**\n * `http://` is allowed because local development needs it, but sending a\n * bearer token to a plaintext REMOTE host puts it on the wire in the clear.\n * Warn rather than refuse: refusing would break `--host http://localhost:3000`\n * for anyone whose loopback resolves to something other than the names below.\n */\nfunction warnOnPlaintextHost(ctx: CliContext, host: string): void {\n  const url = new URL(host);\n\n  if (url.protocol !== 'http:') return;\n\n  const loopback = ['localhost', '127.0.0.1', '[::1]', '0.0.0.0'];\n\n  if (loopback.includes(url.hostname) || url.hostname.endsWith('.localhost')) {\n    return;\n  }\n\n  ctx.warn(\n    `ekanos: ${host} is plaintext HTTP. Your credentials will cross the ` +\n      `network unencrypted. Use https:// unless this is a local host.`,\n  );\n}\n\nexport function requireSession(\n  store: CredentialStore,\n  host: string,\n): StoredSession {\n  const session = store.read(host);\n\n  if (!session) {\n    throw authRequiredError(\n      `Not logged in to ${host}.`,\n      `Run \"ekanos login --host ${host}\".`,\n    );\n  }\n\n  return session;\n}\n\n/**\n * Resolve the caller's identity, refreshing the access token once if the\n * stored one no longer authenticates.\n *\n * Validity is decided by the SERVER, not by comparing `expiresAt` to the local\n * clock. A container with a skewed clock — the exact environment this flow\n * exists to support — would otherwise either refuse a perfectly good token or\n * keep presenting a dead one. A 401 is the authoritative answer; one refresh\n * and one retry is the whole recovery.\n */\nexport async function resolveIdentity(\n  env: AuthEnvironment,\n  session: StoredSession,\n): Promise<{ identity: EkanosIdentity; session: StoredSession }> {\n  const identity = await fetchIdentity(env.host, session.accessToken);\n\n  if (identity) {\n    return { identity, session };\n  }\n\n  const refreshed = await refreshStoredSession(env, session);\n  const retried = await fetchIdentity(env.host, refreshed.accessToken);\n\n  if (!retried) {\n    throw authRequiredError(\n      `The session for ${env.host} could not be renewed.`,\n      `Run \"ekanos logout --host ${env.host}\" then \"ekanos login --host ${env.host}\".`,\n    );\n  }\n\n  return { identity: retried, session: refreshed };\n}\n\n/**\n * Refresh and persist.\n *\n * The rotated refresh token is written the MOMENT the server reports it, not\n * when the refresh finishes. Auth0 rotates as soon as the server's exchange\n * succeeds, so from that instant the presented token is dead and the\n * replacement is the only copy in existence — and `cli-refresh` can still fail\n * afterwards (a `/userinfo` blip, a missing account, an unexpected throw) and\n * return that replacement on an ERROR response. Saving only on success would\n * discard it and lock the partner out for good over a transient upstream\n * hiccup: one process, no concurrency needed.\n *\n * So `onRotatedToken` writes it immediately and `refreshEkanosSession` invokes\n * that before it throws. The write keeps the OLD access token, which is\n * correct: that token is merely expired, while the refresh token is current\n * and is what the next attempt needs.\n */\nexport async function refreshStoredSession(\n  env: AuthEnvironment,\n  session: StoredSession,\n): Promise<StoredSession> {\n  const persistRotated = (rotated: string) => {\n    env.store.write(env.host, {\n      ...session,\n      auth0RefreshToken: rotated,\n      updatedAt: new Date().toISOString(),\n    });\n  };\n\n  const refreshed = await refreshEkanosSession(\n    env.host,\n    session.auth0RefreshToken,\n    { onRotatedToken: persistRotated },\n  );\n\n  const next: StoredSession = {\n    auth0RefreshToken: refreshed.auth0RefreshToken,\n    accessToken: refreshed.accessToken,\n    expiresAt: refreshed.expiresAt,\n    userId: refreshed.userId,\n    email: refreshed.email,\n    updatedAt: new Date().toISOString(),\n  };\n\n  env.store.write(env.host, next);\n\n  return next;\n}\n"]}

package/dist/bin.js.map

@@ -1 +1 @@
-{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,CAAC;AAE9B;;;;;;;GAOG;AACH,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAE9D,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;QAC3E,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,IAAI,EAAE;KACH,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;IACb,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;AAC1B,CAAC,CAAC;KACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;;IACxB,2EAA2E;IAC3E,oEAAoE;IACpE,uCAAuC;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iCACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,MAAA,KAAK,CAAC,KAAK,mCAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACxE,IAAI,CACL,CAAC;IACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC","sourcesContent":["#!/usr/bin/env node\nimport { announceDelegation, delegate, planDelegation } from './delegate';\nimport { run } from './index';\n\n/**\n * The bin entry — the ONLY place that calls process.exit, so `run()` stays a\n * pure, testable function that returns an exit code. Argv is sliced to drop\n * the node executable and this script path.\n *\n * Before dispatching, check whether this invocation should delegate to the\n * current project's OWN pinned `@ekanos/cli` — see `delegate.ts` for why.\n */\nasync function main(): Promise<number> {\n  const argv = process.argv.slice(2);\n  const plan = planDelegation(argv, process.env, process.cwd());\n\n  if (plan.shouldDelegate) {\n    announceDelegation(plan, argv, process.env, process.stdout.isTTY === true);\n    return delegate(plan, argv, process.env);\n  }\n\n  return run(argv);\n}\n\nmain()\n  .then((code) => {\n    process.exitCode = code;\n  })\n  .catch((error: unknown) => {\n    // run() catches its own errors and emits the envelope; reaching here means\n    // the envelope machinery itself threw. Fail loudly on stderr (never\n    // stdout) with the internal exit code.\n    process.stderr.write(\n      `ekanos: fatal internal error: ${\n        error instanceof Error ? (error.stack ?? error.message) : String(error)\n      }\\n`,\n    );\n    process.exitCode = 1;\n  });\n"]}
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,CAAC;AAE9B;;;;;;;GAOG;AACH,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAE9D,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;QAC3E,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,IAAI,EAAE;KACH,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;IACb,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;AAC1B,CAAC,CAAC;KACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;;IACxB,2EAA2E;IAC3E,oEAAoE;IACpE,uCAAuC;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iCACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,OAAC,KAAK,CAAC,KAAK,mCAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACxE,IAAI,CACL,CAAC;IACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC","sourcesContent":["#!/usr/bin/env node\nimport { announceDelegation, delegate, planDelegation } from './delegate';\nimport { run } from './index';\n\n/**\n * The bin entry — the ONLY place that calls process.exit, so `run()` stays a\n * pure, testable function that returns an exit code. Argv is sliced to drop\n * the node executable and this script path.\n *\n * Before dispatching, check whether this invocation should delegate to the\n * current project's OWN pinned `@ekanos/cli` — see `delegate.ts` for why.\n */\nasync function main(): Promise<number> {\n  const argv = process.argv.slice(2);\n  const plan = planDelegation(argv, process.env, process.cwd());\n\n  if (plan.shouldDelegate) {\n    announceDelegation(plan, argv, process.env, process.stdout.isTTY === true);\n    return delegate(plan, argv, process.env);\n  }\n\n  return run(argv);\n}\n\nmain()\n  .then((code) => {\n    process.exitCode = code;\n  })\n  .catch((error: unknown) => {\n    // run() catches its own errors and emits the envelope; reaching here means\n    // the envelope machinery itself threw. Fail loudly on stderr (never\n    // stdout) with the internal exit code.\n    process.stderr.write(\n      `ekanos: fatal internal error: ${\n        error instanceof Error ? (error.stack ?? error.message) : String(error)\n      }\\n`,\n    );\n    process.exitCode = 1;\n  });\n"]}

package/dist/commands/dev.d.ts

@@ -8,8 +8,8 @@ export interface DevArgs {
      * Interface to bind. Defaults to loopback — see `resolveHost`. Anything
      * else is an explicit, warned-about decision to expose the harness.
      *
-     * NOTE: unrelated to the Fusion HOST the update notice checks against —
-     * this is the local bind address for `next dev`, never a Fusion origin.
+     * NOTE: unrelated to the Ekanos HOST the update notice checks against —
+     * this is the local bind address for `next dev`, never an Ekanos origin.
      */
     host?: string;
     /** Rewrite every generated file even when its bytes already match. */

package/dist/commands/dev.js.map

@@ -1 +1 @@
-{"version":3,"file":"dev.js","sourceRoot":"","sources":["../../src/commands/dev.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EACL,WAAW,EACX,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,QAAQ,EACR,aAAa,EACb,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AA0BlE,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B;;;;;;;;;;GAUG;AACH,MAAM,YAAY,GAAG,WAAW,CAAC;AAEjC,2DAA2D;AAC3D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;AAElE;;;;;;GAMG;AACH,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAE7C,qEAAqE;AACrE,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;AAEtE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,IAAa;;IACzD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEnD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,GAAG,EAAE,MAAA,IAAI,CAAC,GAAG,mCAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACtE,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE5B,0EAA0E;IAC1E,kEAAkE;IAClE,kCAAkC;IAClC,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,iBAAiB,CACrB,GAAG,OAAO,CAAC,MAAM,WAAW,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO;YAChE,iBAAiB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,iBAAiB;YACrE,MAAM,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EACnD,QAAQ,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,MAAM,CAAC,UAAU,SAAS;YACnE,sBAAsB,CACzB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAC;IACxC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,iBAAiB,CACrB,GAAG,eAAe,wCAAwC,EAC1D,sBAAsB,cAAc,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,OAAO;YAChE,GAAG,MAAM,CAAC,UAAU,6BAA6B,CACpD,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,qEAAqE;IACrE,4EAA4E;IAC5E,2DAA2D;IAC3D,uBAAuB,CAAC;QACtB,cAAc;QACd,eAAe,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ;QAClC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;KAClD,CAAC,CAAC;IAEH,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAE5E,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,aAAa,CAAC;QAC1B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QACzB,cAAc;QACd,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;KACxC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEjE,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,GAAG,CACL,gBAAgB,WAAW,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAChE,4BAA4B,MAAM,CAAC,UAAU,gBAAgB,CAChE,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO;QAAE,GAAG,CAAC,GAAG,CAAC,aAAa,WAAW,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO;QAAE,GAAG,CAAC,GAAG,CAAC,aAAa,WAAW,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9E,IAAI,gBAAgB;QAAE,GAAG,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACjE,GAAG,CAAC,GAAG,CACL,4CAA4C,kBAAkB,YAAY;QACxE,sEAAsE,CACzE,CAAC;IAEF,0EAA0E;IAC1E,+CAA+C;IAC/C,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IACvE,MAAM,SAAS,GAA2B,OAAO;QAC/C,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE;QACxB,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,OAAO,GACX,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,WAAW,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,UAAU,WAAW,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;IAElD,MAAM,QAAQ,mBACZ,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EACzB,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EACpD,UAAU,EAAE,MAAM,CAAC,UAAU,EAC7B,UAAU,EAAE,KAAK,CAAC,UAAU,EAC5B,cAAc,EACd,eAAe,EAAE,KAAK,CAAC,eAAe,EACtC,cAAc,EAAE,KAAK,CAAC,cAAc,EACpC,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,YAAY,EAAE,KAAK,CAAC,YAAY,EAChC,WAAW,EAAE,MAAA,MAAM,CAAC,OAAO,CAAC,WAAW,mCAAI,EAAE,EAC7C,OAAO,EAAE,KAAK,CAAC,OAAO,EACtB,OAAO,EAAE,KAAK,CAAC,OAAO,EACtB,SAAS,EAAE,KAAK,CAAC,SAAS,EAC1B,kBAAkB,EAAE,MAAM,CAAC,YAAY,EACvC,UAAU,EAAE,MAAM,CAAC,UAAU,EAC7B,gBAAgB,IACb,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACzC,CAAC;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,CAAC,IAAI,CACN,mBAAmB,IAAI,+CAA+C;YACpE,oEAAoE;YACpE,sEAAsE;YACtE,sBAAsB,kBAAkB,gCAAgC;YACxE,qEAAqE;YACrE,UAAU,WAAW,4CAA4C;YACjE,GAAG,GAAG,oDAAoD,YAAY,GAAG,CAC5E,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,oEAAoE;IACpE,sEAAsE;IACtE,wEAAwE;IACxE,MAAM,WAAW,GAAG,MAAA,IAAI,CAAC,KAAK,mCAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,GAAG,CAAC,OAAO,iCAEX,QAAQ,KACX,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAE/D,yBAAyB,KAAK,CAAC,UAAU,oBAAoB,OAAO,EAAE,CACvE,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,2BAA2B,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC;QACjC,GAAG;QACH,GAAG,EAAE,EAAE,CAAC,GAAG;QACX,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC;QACtC,GAAG,EAAE,KAAK,CAAC,UAAU;QACrB,GAAG,EAAE,SAAS;KACf,CAAC,CAAC;IAEH,MAAM,IAAI,mCACL,QAAQ,KACX,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GACvE,CAAC;IAEF,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,CAAC;QAClB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,IAAI,OAAO,sBAAsB,QAAQ,GAAG;QACrD,IAAI,EACF,uEAAuE;YACvE,sCAAsC,MAAM,CAAC,UAAU,eAAe;YACtE,4BAA4B,KAAK,CAAC,UAAU,2BAA2B;QACzE,mDAAmD;QACnD,QAAQ;QACR,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAMpB;IACC,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;QAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE;YAC3C,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,kCAAO,OAAO,CAAC,GAAG,GAAK,MAAM,CAAC,GAAG,CAAE;YACtC,wEAAwE;YACxE,sEAAsE;YACtE,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC;SACnC,CAAC,CAAC;QAEH,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QACH,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAChE,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAE3C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,UAAU,CACd,oBAAoB,EACpB,iEAAiE;YAC/D,+CAA+C,YAAY,GAAG,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAE3C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACxD,MAAM,UAAU,CACd,mBAAmB,GAAG,IAAI,EAC1B,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { spawn } from 'node:child_process';\nimport * as path from 'node:path';\n\nimport { assertHarnessCompatible } from '../compatibility';\nimport type { CliContext } from '../context';\nimport { preconditionError, usageError } from '../errors';\nimport {\n  HARNESS_DIR,\n  HARNESS_PACKAGE,\n  assertShellDirIsOurs,\n  bootstrapHarnessConfig,\n  ensureGitignoreEntry,\n  missingDependencies,\n  readInstalledHarness,\n  scaffoldShell,\n} from '../harness-scaffold';\nimport {\n  detectPackageManager,\n  execArgs,\n  formatCommand,\n  installCommand,\n} from '../package-manager';\nimport { loadProject } from '../project';\nimport { announceUpdate, checkForUpdate } from '../update-notice';\n\nexport interface DevArgs {\n  /** Project directory (contains ekanos.json). Defaults to cwd. */\n  dir: string;\n  /** Port for the dev server. */\n  port?: string;\n  /**\n   * Interface to bind. Defaults to loopback — see `resolveHost`. Anything\n   * else is an explicit, warned-about decision to expose the harness.\n   *\n   * NOTE: unrelated to the Fusion HOST the update notice checks against —\n   * this is the local bind address for `next dev`, never a Fusion origin.\n   */\n  host?: string;\n  /** Rewrite every generated file even when its bytes already match. */\n  force: boolean;\n  /**\n   * Explicit `--start` / `--no-start`. Undefined means \"decide from the\n   * output mode\": a JSON caller is an agent or a pipe and must not be handed\n   * a process that never exits.\n   */\n  start?: boolean;\n  env?: Record<string, string | undefined>;\n}\n\nconst DEFAULT_PORT = 3100;\n\n/**\n * Loopback, NOT Next's default.\n *\n * `next dev` binds 0.0.0.0 unless told otherwise, so the harness would be\n * reachable by anyone on the same network — a coffee-shop Wi-Fi, a shared\n * office VLAN — while we printed \"http://localhost:3100\" and implied\n * otherwise. It renders a partner's integration with their fixtures and, in\n * live mode, whatever their vendor API returns; there is no auth in front of\n * any of it. Binding loopback by default costs a partner nothing and makes\n * exposure a thing they ask for.\n */\nconst DEFAULT_HOST = '127.0.0.1';\n\n/** Addresses that are only reachable from this machine. */\nconst LOOPBACK_HOSTS = new Set(['127.0.0.1', '::1', 'localhost']);\n\n/**\n * Set for the dev server when `--host` binds beyond loopback. The shell's\n * API routes (`@ekanos/harness/api`) refuse non-loopback `Host` headers\n * unless this is `1`: they hold the partner's local OAuth credentials and\n * run handlers on request, so exposing them has to be a decision — this one,\n * made after the warning below — rather than a side effect of the bind.\n */\nconst EXPOSED_ENV = 'EKANOS_HARNESS_EXPOSED';\n\n/** Where the harness generates, and reads, local dev credentials. */\nconst LOCAL_SECRETS_PATH = path.join('.ekanos', 'local-secrets.json');\n\n/**\n * `dev` — scaffold the local harness shell into the partner's project, then\n * run it with their own Next.\n *\n * The shape of this verb follows from one rule: we must be able to ship a\n * harness bugfix as an `@ekanos/harness` version bump that a partner picks up\n * with `pnpm up`, with zero edits to any file they own. So everything under\n * `.ekanos/` is generated, gitignored and rewritten freely, `harness.config.ts`\n * at the project root is written once and never touched again, and all actual\n * harness behaviour lives in the installed package.\n *\n * Two idempotency properties matter and are both tested: a second run produces\n * byte-identical files and rewrites nothing (so Next's watcher stays quiet),\n * and `.gitignore` never grows a duplicate line.\n */\nexport async function runDev(ctx: CliContext, args: DevArgs): Promise<number> {\n  const loaded = loadProject(args.dir);\n  const port = parsePort(args.port);\n  const host = parseHost(args.host);\n  const exposed = !LOOPBACK_HOSTS.has(host);\n  const pm = detectPackageManager(loaded.projectDir);\n\n  const notice = await checkForUpdate({ env: args.env ?? process.env });\n  announceUpdate(ctx, notice);\n\n  // Fail before writing anything: the shell declares no dependencies of its\n  // own, so a missing one would otherwise surface as an opaque Next\n  // resolution error minutes later.\n  const missing = missingDependencies(loaded.projectDir);\n  if (missing.length > 0) {\n    throw preconditionError(\n      `${missing.length} package${missing.length === 1 ? '' : 's'} the ` +\n        `harness needs ${missing.length === 1 ? 'is' : 'are'} not installed ` +\n        `in ${loaded.projectDir}: ${missing.join(', ')}.`,\n      `Run \"${installCommand(pm, missing)}\" in ${loaded.projectDir}, then ` +\n        're-run \"ekanos dev\".',\n    );\n  }\n\n  const harness = readInstalledHarness(loaded.projectDir);\n  const harnessVersion = harness?.version;\n  if (!harnessVersion) {\n    throw preconditionError(\n      `${HARNESS_PACKAGE} is installed but declares no version.`,\n      `Reinstall it with \"${installCommand(pm, [HARNESS_PACKAGE])}\" in ` +\n        `${loaded.projectDir}, then re-run \"ekanos dev\".`,\n    );\n  }\n\n  // The templates ship with the CLI and the code they import ships with the\n  // harness, so a partner can upgrade one without the other. Name that\n  // mismatch here rather than letting it surface later as a module-resolution\n  // error inside a shell we cheerfully certified as current.\n  assertHarnessCompatible({\n    harnessVersion,\n    harnessManifest: harness?.manifest,\n    installHint: (spec) => installCommand(pm, [spec]),\n  });\n\n  // Validate the shell target BEFORE writing anything at all. Bootstrapping\n  // harness.config.ts first and only then discovering that .ekanos/harness is\n  // a file or someone else's tree would leave the project half-scaffolded.\n  assertShellDirIsOurs(path.join(loaded.projectDir, HARNESS_DIR), args.force);\n\n  const config = bootstrapHarnessConfig(loaded.projectDir, loaded.integrations);\n  const shell = scaffoldShell({\n    projectDir: loaded.projectDir,\n    slug: loaded.primary.slug,\n    harnessVersion,\n    force: args.force,\n    sourceGlobs: loaded.project.sourceGlobs,\n  });\n  const gitignoreUpdated = ensureGitignoreEntry(loaded.projectDir);\n\n  if (shell.stale) {\n    ctx.log(\n      `Regenerating ${HARNESS_DIR} — ${shell.staleReasons.join('; ')}. ` +\n        `Nothing you own changed; ${config.configPath} is untouched.`,\n    );\n  }\n\n  if (config.bootstrapped) {\n    ctx.log(`  created harness.config.ts (yours — edit it, we never will)`);\n  }\n  for (const file of shell.created) ctx.log(`  created ${HARNESS_DIR}/${file}`);\n  for (const file of shell.updated) ctx.log(`  updated ${HARNESS_DIR}/${file}`);\n  if (gitignoreUpdated) ctx.log('  updated .gitignore (.ekanos/)');\n  ctx.log(\n    `  live-mode OAuth: the harness generates ${LOCAL_SECRETS_PATH} on first ` +\n      'use — fill it in and follow \"Local OAuth\" on the Activation surface.',\n  );\n\n  // `--hostname` is passed ALWAYS, never left to Next's default, so the URL\n  // we print is the URL that is actually served.\n  const serverArgs = ['dev', '--port', String(port), '--hostname', host];\n  const serverEnv: Record<string, string> = exposed\n    ? { [EXPOSED_ENV]: '1' }\n    : {};\n  const command =\n    (exposed ? `${EXPOSED_ENV}=1 ` : '') +\n    formatCommand(pm.bin, execArgs(pm, 'next', serverArgs));\n  const url = `http://${displayHost(host)}:${port}`;\n\n  const scaffold = {\n    slug: loaded.primary.slug,\n    integrations: loaded.integrations.map((i) => i.slug),\n    projectDir: loaded.projectDir,\n    harnessDir: shell.harnessDir,\n    harnessVersion,\n    previousVersion: shell.previousVersion,\n    previousMarker: shell.previousMarker,\n    stale: shell.stale,\n    staleReasons: shell.staleReasons,\n    sourceGlobs: loaded.project.sourceGlobs ?? [],\n    created: shell.created,\n    updated: shell.updated,\n    unchanged: shell.unchanged,\n    configBootstrapped: config.bootstrapped,\n    configPath: config.configPath,\n    gitignoreUpdated,\n    ...(notice ? { toolchain: notice } : {}),\n  };\n\n  if (exposed) {\n    ctx.warn(\n      `WARNING: --host ${host} exposes the harness beyond this machine. It ` +\n        'has no authentication, and it renders your fixtures and — in live ' +\n        'mode — real responses from your vendor API. Its API routes hold the ' +\n        `client secret from ${LOCAL_SECRETS_PATH}, the tokens onTokens stored, ` +\n        'and run your handlers on request; they refuse non-loopback callers ' +\n        `unless ${EXPOSED_ENV}=1, which this sets. Anyone who can reach ` +\n        `${url} can read and run all of it. Omit --host to bind ${DEFAULT_HOST}.`,\n    );\n  }\n\n  // A JSON caller is an agent or a pipe. Handing it a dev server that never\n  // exits would hang its tool call forever and it would never see the\n  // envelope, so JSON mode scaffolds and reports the command instead of\n  // running it. `--start` overrides; `--no-start` opts out in a terminal.\n  const shouldStart = args.start ?? !ctx.jsonMode;\n  if (!shouldStart) {\n    return ctx.succeed(\n      {\n        ...scaffold,\n        server: { started: false, command, url, port, host, exposed },\n      },\n      `dev: harness ready in ${shell.harnessDir}. Start it with: ${command}`,\n    );\n  }\n\n  ctx.log(`Starting the harness on ${url} (${command})…`);\n  const exitCode = await spawnServer({\n    ctx,\n    bin: pm.bin,\n    argv: execArgs(pm, 'next', serverArgs),\n    cwd: shell.harnessDir,\n    env: serverEnv,\n  });\n\n  const data = {\n    ...scaffold,\n    server: { started: true, command, url, port, host, exposed, exitCode },\n  };\n\n  if (exitCode === 0) {\n    return ctx.succeed(data, `dev: harness stopped cleanly.`);\n  }\n\n  return ctx.failWith({\n    code: 'dev_server_failed',\n    message: `\"${command}\" exited with code ${exitCode}.`,\n    hint:\n      'Read the Next output on stderr. If it cannot resolve @ekanos/harness ' +\n      `or next, reinstall dependencies in ${loaded.projectDir}; if a route ` +\n      `fails to compile, delete ${shell.harnessDir} and re-run \"ekanos dev\".`,\n    // Transparent passthrough of Next's own exit code.\n    exitCode,\n    data,\n  });\n}\n\nfunction spawnServer(params: {\n  ctx: CliContext;\n  bin: string;\n  argv: string[];\n  cwd: string;\n  env: Record<string, string>;\n}): Promise<number> {\n  return new Promise<number>((resolve, reject) => {\n    const child = spawn(params.bin, params.argv, {\n      cwd: params.cwd,\n      env: { ...process.env, ...params.env },\n      // stdin inherited so Next's own key handling works; stdout/stderr piped\n      // so we can route them and keep OUR stdout reserved for the envelope.\n      stdio: ['inherit', 'pipe', 'pipe'],\n    });\n\n    child.stdout?.on('data', (chunk: Buffer) => {\n      (params.ctx.jsonMode ? process.stderr : process.stdout).write(chunk);\n    });\n    child.stderr?.on('data', (chunk: Buffer) => {\n      process.stderr.write(chunk);\n    });\n\n    child.on('error', (error) => reject(error));\n    child.on('close', (code) => resolve(code ?? 1));\n  });\n}\n\n/**\n * The hostname to show a human. `127.0.0.1` is spelled `localhost` because\n * that is what people type; a wildcard bind is spelled `localhost` too, but\n * only after `exposed` has already been warned about — printing `0.0.0.0` as\n * a URL is not useful.\n */\nfunction displayHost(host: string): string {\n  if (host === '127.0.0.1' || host === '0.0.0.0' || host === '::') {\n    return 'localhost';\n  }\n  if (host === '::1') return '[::1]';\n  return host;\n}\n\nfunction parseHost(raw: string | undefined): string {\n  if (raw === undefined) return DEFAULT_HOST;\n\n  const host = raw.trim();\n  if (host.length === 0) {\n    throw usageError(\n      'Invalid --host \"\".',\n      `Pass an interface to bind, e.g. \"--host 0.0.0.0\" to expose the ` +\n        `harness on your network, or omit it to bind ${DEFAULT_HOST}.`,\n    );\n  }\n  return host;\n}\n\nfunction parsePort(raw: string | undefined): number {\n  if (raw === undefined) return DEFAULT_PORT;\n\n  const port = Number(raw);\n  if (!Number.isInteger(port) || port < 1 || port > 65535) {\n    throw usageError(\n      `Invalid --port \"${raw}\".`,\n      'Pass an integer between 1 and 65535, e.g. \"--port 3100\".',\n    );\n  }\n  return port;\n}\n"]}
+{"version":3,"file":"dev.js","sourceRoot":"","sources":["../../src/commands/dev.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EACL,WAAW,EACX,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,QAAQ,EACR,aAAa,EACb,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AA0BlE,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B;;;;;;;;;;GAUG;AACH,MAAM,YAAY,GAAG,WAAW,CAAC;AAEjC,2DAA2D;AAC3D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;AAElE;;;;;;GAMG;AACH,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAE7C,qEAAqE;AACrE,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;AAEtE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,IAAa;;IACzD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEnD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,GAAG,QAAE,IAAI,CAAC,GAAG,mCAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACtE,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE5B,0EAA0E;IAC1E,kEAAkE;IAClE,kCAAkC;IAClC,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,iBAAiB,CACrB,GAAG,OAAO,CAAC,MAAM,WAAW,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO;YAChE,iBAAiB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,iBAAiB;YACrE,MAAM,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EACnD,QAAQ,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,MAAM,CAAC,UAAU,SAAS;YACnE,sBAAsB,CACzB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAC;IACxC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,iBAAiB,CACrB,GAAG,eAAe,wCAAwC,EAC1D,sBAAsB,cAAc,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,OAAO;YAChE,GAAG,MAAM,CAAC,UAAU,6BAA6B,CACpD,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,qEAAqE;IACrE,4EAA4E;IAC5E,2DAA2D;IAC3D,uBAAuB,CAAC;QACtB,cAAc;QACd,eAAe,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ;QAClC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;KAClD,CAAC,CAAC;IAEH,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAE5E,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,aAAa,CAAC;QAC1B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QACzB,cAAc;QACd,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;KACxC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEjE,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,GAAG,CACL,gBAAgB,WAAW,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAChE,4BAA4B,MAAM,CAAC,UAAU,gBAAgB,CAChE,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO;QAAE,GAAG,CAAC,GAAG,CAAC,aAAa,WAAW,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO;QAAE,GAAG,CAAC,GAAG,CAAC,aAAa,WAAW,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9E,IAAI,gBAAgB;QAAE,GAAG,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACjE,GAAG,CAAC,GAAG,CACL,4CAA4C,kBAAkB,YAAY;QACxE,sEAAsE,CACzE,CAAC;IAEF,0EAA0E;IAC1E,+CAA+C;IAC/C,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IACvE,MAAM,SAAS,GAA2B,OAAO;QAC/C,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE;QACxB,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,OAAO,GACX,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,WAAW,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,UAAU,WAAW,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;IAElD,MAAM,QAAQ,mBACZ,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EACzB,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EACpD,UAAU,EAAE,MAAM,CAAC,UAAU,EAC7B,UAAU,EAAE,KAAK,CAAC,UAAU,EAC5B,cAAc,EACd,eAAe,EAAE,KAAK,CAAC,eAAe,EACtC,cAAc,EAAE,KAAK,CAAC,cAAc,EACpC,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,YAAY,EAAE,KAAK,CAAC,YAAY,EAChC,WAAW,QAAE,MAAM,CAAC,OAAO,CAAC,WAAW,mCAAI,EAAE,EAC7C,OAAO,EAAE,KAAK,CAAC,OAAO,EACtB,OAAO,EAAE,KAAK,CAAC,OAAO,EACtB,SAAS,EAAE,KAAK,CAAC,SAAS,EAC1B,kBAAkB,EAAE,MAAM,CAAC,YAAY,EACvC,UAAU,EAAE,MAAM,CAAC,UAAU,EAC7B,gBAAgB,IACb,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACzC,CAAC;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,CAAC,IAAI,CACN,mBAAmB,IAAI,+CAA+C;YACpE,oEAAoE;YACpE,sEAAsE;YACtE,sBAAsB,kBAAkB,gCAAgC;YACxE,qEAAqE;YACrE,UAAU,WAAW,4CAA4C;YACjE,GAAG,GAAG,oDAAoD,YAAY,GAAG,CAC5E,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,oEAAoE;IACpE,sEAAsE;IACtE,wEAAwE;IACxE,MAAM,WAAW,SAAG,IAAI,CAAC,KAAK,mCAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,GAAG,CAAC,OAAO,iCAEX,QAAQ,KACX,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAE/D,yBAAyB,KAAK,CAAC,UAAU,oBAAoB,OAAO,EAAE,CACvE,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,2BAA2B,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC;QACjC,GAAG;QACH,GAAG,EAAE,EAAE,CAAC,GAAG;QACX,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC;QACtC,GAAG,EAAE,KAAK,CAAC,UAAU;QACrB,GAAG,EAAE,SAAS;KACf,CAAC,CAAC;IAEH,MAAM,IAAI,mCACL,QAAQ,KACX,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GACvE,CAAC;IAEF,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,CAAC;QAClB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,IAAI,OAAO,sBAAsB,QAAQ,GAAG;QACrD,IAAI,EACF,uEAAuE;YACvE,sCAAsC,MAAM,CAAC,UAAU,eAAe;YACtE,4BAA4B,KAAK,CAAC,UAAU,2BAA2B;QACzE,mDAAmD;QACnD,QAAQ;QACR,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAMpB;IACC,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;QAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE;YAC3C,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,kCAAO,OAAO,CAAC,GAAG,GAAK,MAAM,CAAC,GAAG,CAAE;YACtC,wEAAwE;YACxE,sEAAsE;YACtE,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC;SACnC,CAAC,CAAC;QAEH,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QACH,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAChE,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAE3C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,UAAU,CACd,oBAAoB,EACpB,iEAAiE;YAC/D,+CAA+C,YAAY,GAAG,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAE3C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACxD,MAAM,UAAU,CACd,mBAAmB,GAAG,IAAI,EAC1B,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { spawn } from 'node:child_process';\nimport * as path from 'node:path';\n\nimport { assertHarnessCompatible } from '../compatibility';\nimport type { CliContext } from '../context';\nimport { preconditionError, usageError } from '../errors';\nimport {\n  HARNESS_DIR,\n  HARNESS_PACKAGE,\n  assertShellDirIsOurs,\n  bootstrapHarnessConfig,\n  ensureGitignoreEntry,\n  missingDependencies,\n  readInstalledHarness,\n  scaffoldShell,\n} from '../harness-scaffold';\nimport {\n  detectPackageManager,\n  execArgs,\n  formatCommand,\n  installCommand,\n} from '../package-manager';\nimport { loadProject } from '../project';\nimport { announceUpdate, checkForUpdate } from '../update-notice';\n\nexport interface DevArgs {\n  /** Project directory (contains ekanos.json). Defaults to cwd. */\n  dir: string;\n  /** Port for the dev server. */\n  port?: string;\n  /**\n   * Interface to bind. Defaults to loopback — see `resolveHost`. Anything\n   * else is an explicit, warned-about decision to expose the harness.\n   *\n   * NOTE: unrelated to the Ekanos HOST the update notice checks against —\n   * this is the local bind address for `next dev`, never an Ekanos origin.\n   */\n  host?: string;\n  /** Rewrite every generated file even when its bytes already match. */\n  force: boolean;\n  /**\n   * Explicit `--start` / `--no-start`. Undefined means \"decide from the\n   * output mode\": a JSON caller is an agent or a pipe and must not be handed\n   * a process that never exits.\n   */\n  start?: boolean;\n  env?: Record<string, string | undefined>;\n}\n\nconst DEFAULT_PORT = 3100;\n\n/**\n * Loopback, NOT Next's default.\n *\n * `next dev` binds 0.0.0.0 unless told otherwise, so the harness would be\n * reachable by anyone on the same network — a coffee-shop Wi-Fi, a shared\n * office VLAN — while we printed \"http://localhost:3100\" and implied\n * otherwise. It renders a partner's integration with their fixtures and, in\n * live mode, whatever their vendor API returns; there is no auth in front of\n * any of it. Binding loopback by default costs a partner nothing and makes\n * exposure a thing they ask for.\n */\nconst DEFAULT_HOST = '127.0.0.1';\n\n/** Addresses that are only reachable from this machine. */\nconst LOOPBACK_HOSTS = new Set(['127.0.0.1', '::1', 'localhost']);\n\n/**\n * Set for the dev server when `--host` binds beyond loopback. The shell's\n * API routes (`@ekanos/harness/api`) refuse non-loopback `Host` headers\n * unless this is `1`: they hold the partner's local OAuth credentials and\n * run handlers on request, so exposing them has to be a decision — this one,\n * made after the warning below — rather than a side effect of the bind.\n */\nconst EXPOSED_ENV = 'EKANOS_HARNESS_EXPOSED';\n\n/** Where the harness generates, and reads, local dev credentials. */\nconst LOCAL_SECRETS_PATH = path.join('.ekanos', 'local-secrets.json');\n\n/**\n * `dev` — scaffold the local harness shell into the partner's project, then\n * run it with their own Next.\n *\n * The shape of this verb follows from one rule: we must be able to ship a\n * harness bugfix as an `@ekanos/harness` version bump that a partner picks up\n * with `pnpm up`, with zero edits to any file they own. So everything under\n * `.ekanos/` is generated, gitignored and rewritten freely, `harness.config.ts`\n * at the project root is written once and never touched again, and all actual\n * harness behaviour lives in the installed package.\n *\n * Two idempotency properties matter and are both tested: a second run produces\n * byte-identical files and rewrites nothing (so Next's watcher stays quiet),\n * and `.gitignore` never grows a duplicate line.\n */\nexport async function runDev(ctx: CliContext, args: DevArgs): Promise<number> {\n  const loaded = loadProject(args.dir);\n  const port = parsePort(args.port);\n  const host = parseHost(args.host);\n  const exposed = !LOOPBACK_HOSTS.has(host);\n  const pm = detectPackageManager(loaded.projectDir);\n\n  const notice = await checkForUpdate({ env: args.env ?? process.env });\n  announceUpdate(ctx, notice);\n\n  // Fail before writing anything: the shell declares no dependencies of its\n  // own, so a missing one would otherwise surface as an opaque Next\n  // resolution error minutes later.\n  const missing = missingDependencies(loaded.projectDir);\n  if (missing.length > 0) {\n    throw preconditionError(\n      `${missing.length} package${missing.length === 1 ? '' : 's'} the ` +\n        `harness needs ${missing.length === 1 ? 'is' : 'are'} not installed ` +\n        `in ${loaded.projectDir}: ${missing.join(', ')}.`,\n      `Run \"${installCommand(pm, missing)}\" in ${loaded.projectDir}, then ` +\n        're-run \"ekanos dev\".',\n    );\n  }\n\n  const harness = readInstalledHarness(loaded.projectDir);\n  const harnessVersion = harness?.version;\n  if (!harnessVersion) {\n    throw preconditionError(\n      `${HARNESS_PACKAGE} is installed but declares no version.`,\n      `Reinstall it with \"${installCommand(pm, [HARNESS_PACKAGE])}\" in ` +\n        `${loaded.projectDir}, then re-run \"ekanos dev\".`,\n    );\n  }\n\n  // The templates ship with the CLI and the code they import ships with the\n  // harness, so a partner can upgrade one without the other. Name that\n  // mismatch here rather than letting it surface later as a module-resolution\n  // error inside a shell we cheerfully certified as current.\n  assertHarnessCompatible({\n    harnessVersion,\n    harnessManifest: harness?.manifest,\n    installHint: (spec) => installCommand(pm, [spec]),\n  });\n\n  // Validate the shell target BEFORE writing anything at all. Bootstrapping\n  // harness.config.ts first and only then discovering that .ekanos/harness is\n  // a file or someone else's tree would leave the project half-scaffolded.\n  assertShellDirIsOurs(path.join(loaded.projectDir, HARNESS_DIR), args.force);\n\n  const config = bootstrapHarnessConfig(loaded.projectDir, loaded.integrations);\n  const shell = scaffoldShell({\n    projectDir: loaded.projectDir,\n    slug: loaded.primary.slug,\n    harnessVersion,\n    force: args.force,\n    sourceGlobs: loaded.project.sourceGlobs,\n  });\n  const gitignoreUpdated = ensureGitignoreEntry(loaded.projectDir);\n\n  if (shell.stale) {\n    ctx.log(\n      `Regenerating ${HARNESS_DIR} — ${shell.staleReasons.join('; ')}. ` +\n        `Nothing you own changed; ${config.configPath} is untouched.`,\n    );\n  }\n\n  if (config.bootstrapped) {\n    ctx.log(`  created harness.config.ts (yours — edit it, we never will)`);\n  }\n  for (const file of shell.created) ctx.log(`  created ${HARNESS_DIR}/${file}`);\n  for (const file of shell.updated) ctx.log(`  updated ${HARNESS_DIR}/${file}`);\n  if (gitignoreUpdated) ctx.log('  updated .gitignore (.ekanos/)');\n  ctx.log(\n    `  live-mode OAuth: the harness generates ${LOCAL_SECRETS_PATH} on first ` +\n      'use — fill it in and follow \"Local OAuth\" on the Activation surface.',\n  );\n\n  // `--hostname` is passed ALWAYS, never left to Next's default, so the URL\n  // we print is the URL that is actually served.\n  const serverArgs = ['dev', '--port', String(port), '--hostname', host];\n  const serverEnv: Record<string, string> = exposed\n    ? { [EXPOSED_ENV]: '1' }\n    : {};\n  const command =\n    (exposed ? `${EXPOSED_ENV}=1 ` : '') +\n    formatCommand(pm.bin, execArgs(pm, 'next', serverArgs));\n  const url = `http://${displayHost(host)}:${port}`;\n\n  const scaffold = {\n    slug: loaded.primary.slug,\n    integrations: loaded.integrations.map((i) => i.slug),\n    projectDir: loaded.projectDir,\n    harnessDir: shell.harnessDir,\n    harnessVersion,\n    previousVersion: shell.previousVersion,\n    previousMarker: shell.previousMarker,\n    stale: shell.stale,\n    staleReasons: shell.staleReasons,\n    sourceGlobs: loaded.project.sourceGlobs ?? [],\n    created: shell.created,\n    updated: shell.updated,\n    unchanged: shell.unchanged,\n    configBootstrapped: config.bootstrapped,\n    configPath: config.configPath,\n    gitignoreUpdated,\n    ...(notice ? { toolchain: notice } : {}),\n  };\n\n  if (exposed) {\n    ctx.warn(\n      `WARNING: --host ${host} exposes the harness beyond this machine. It ` +\n        'has no authentication, and it renders your fixtures and — in live ' +\n        'mode — real responses from your vendor API. Its API routes hold the ' +\n        `client secret from ${LOCAL_SECRETS_PATH}, the tokens onTokens stored, ` +\n        'and run your handlers on request; they refuse non-loopback callers ' +\n        `unless ${EXPOSED_ENV}=1, which this sets. Anyone who can reach ` +\n        `${url} can read and run all of it. Omit --host to bind ${DEFAULT_HOST}.`,\n    );\n  }\n\n  // A JSON caller is an agent or a pipe. Handing it a dev server that never\n  // exits would hang its tool call forever and it would never see the\n  // envelope, so JSON mode scaffolds and reports the command instead of\n  // running it. `--start` overrides; `--no-start` opts out in a terminal.\n  const shouldStart = args.start ?? !ctx.jsonMode;\n  if (!shouldStart) {\n    return ctx.succeed(\n      {\n        ...scaffold,\n        server: { started: false, command, url, port, host, exposed },\n      },\n      `dev: harness ready in ${shell.harnessDir}. Start it with: ${command}`,\n    );\n  }\n\n  ctx.log(`Starting the harness on ${url} (${command})…`);\n  const exitCode = await spawnServer({\n    ctx,\n    bin: pm.bin,\n    argv: execArgs(pm, 'next', serverArgs),\n    cwd: shell.harnessDir,\n    env: serverEnv,\n  });\n\n  const data = {\n    ...scaffold,\n    server: { started: true, command, url, port, host, exposed, exitCode },\n  };\n\n  if (exitCode === 0) {\n    return ctx.succeed(data, `dev: harness stopped cleanly.`);\n  }\n\n  return ctx.failWith({\n    code: 'dev_server_failed',\n    message: `\"${command}\" exited with code ${exitCode}.`,\n    hint:\n      'Read the Next output on stderr. If it cannot resolve @ekanos/harness ' +\n      `or next, reinstall dependencies in ${loaded.projectDir}; if a route ` +\n      `fails to compile, delete ${shell.harnessDir} and re-run \"ekanos dev\".`,\n    // Transparent passthrough of Next's own exit code.\n    exitCode,\n    data,\n  });\n}\n\nfunction spawnServer(params: {\n  ctx: CliContext;\n  bin: string;\n  argv: string[];\n  cwd: string;\n  env: Record<string, string>;\n}): Promise<number> {\n  return new Promise<number>((resolve, reject) => {\n    const child = spawn(params.bin, params.argv, {\n      cwd: params.cwd,\n      env: { ...process.env, ...params.env },\n      // stdin inherited so Next's own key handling works; stdout/stderr piped\n      // so we can route them and keep OUR stdout reserved for the envelope.\n      stdio: ['inherit', 'pipe', 'pipe'],\n    });\n\n    child.stdout?.on('data', (chunk: Buffer) => {\n      (params.ctx.jsonMode ? process.stderr : process.stdout).write(chunk);\n    });\n    child.stderr?.on('data', (chunk: Buffer) => {\n      process.stderr.write(chunk);\n    });\n\n    child.on('error', (error) => reject(error));\n    child.on('close', (code) => resolve(code ?? 1));\n  });\n}\n\n/**\n * The hostname to show a human. `127.0.0.1` is spelled `localhost` because\n * that is what people type; a wildcard bind is spelled `localhost` too, but\n * only after `exposed` has already been warned about — printing `0.0.0.0` as\n * a URL is not useful.\n */\nfunction displayHost(host: string): string {\n  if (host === '127.0.0.1' || host === '0.0.0.0' || host === '::') {\n    return 'localhost';\n  }\n  if (host === '::1') return '[::1]';\n  return host;\n}\n\nfunction parseHost(raw: string | undefined): string {\n  if (raw === undefined) return DEFAULT_HOST;\n\n  const host = raw.trim();\n  if (host.length === 0) {\n    throw usageError(\n      'Invalid --host \"\".',\n      `Pass an interface to bind, e.g. \"--host 0.0.0.0\" to expose the ` +\n        `harness on your network, or omit it to bind ${DEFAULT_HOST}.`,\n    );\n  }\n  return host;\n}\n\nfunction parsePort(raw: string | undefined): number {\n  if (raw === undefined) return DEFAULT_PORT;\n\n  const port = Number(raw);\n  if (!Number.isInteger(port) || port < 1 || port > 65535) {\n    throw usageError(\n      `Invalid --port \"${raw}\".`,\n      'Pass an integer between 1 and 65535, e.g. \"--port 3100\".',\n    );\n  }\n  return port;\n}\n"]}

package/dist/commands/init.js

@@ -56,6 +56,10 @@ export const DOCS_GROUNDING_FILES = [
 const FILES = [
     { template: 'ekanos.json.tmpl', dest: 'ekanos.json' },
     { template: 'gitignore.tmpl', dest: '.gitignore' },
+    // pnpm's build-script approval for esbuild (vitest's dependency). Without
+    // it a fresh scaffold's `ekanos test` fails on the first run under pnpm —
+    // see the template's own header.
+    { template: 'pnpm-workspace.yaml.tmpl', dest: 'pnpm-workspace.yaml' },
     // Without this, the `typecheck` script below prints tsc's help and exits 1 —
     // and, worse, no type error in the scaffold ever surfaces.
     { template: 'tsconfig.json.tmpl', dest: 'tsconfig.json' },

package/dist/commands/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE1D,OAAO,EAGL,aAAa,EACb,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AA2C9C,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAElD;;;;;;;GAOG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAyC;IACvE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE;IACjD,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE;IACjD,EAAE,QAAQ,EAAE,sBAAsB,EAAE,IAAI,EAAE,gCAAgC,EAAE;CAC7E,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAyC;IACxE,0EAA0E;IAC1E,kEAAkE;IAClE,EAAE,QAAQ,EAAE,wBAAwB,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACjE,oEAAoE;IACpE,+DAA+D;IAC/D,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE;CACjD,CAAC;AAEF,MAAM,KAAK,GAAyC;IAClD,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,aAAa,EAAE;IACrD,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,EAAE;IAClD,6EAA6E;IAC7E,2DAA2D;IAC3D,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,eAAe,EAAE;IACzD,EAAE,QAAQ,EAAE,uBAAuB,EAAE,IAAI,EAAE,kBAAkB,EAAE;IAC/D,yEAAyE;IACzE,wEAAwE;IACxE,EAAE,QAAQ,EAAE,8BAA8B,EAAE,IAAI,EAAE,yBAAyB,EAAE;IAC7E,EAAE,QAAQ,EAAE,yBAAyB,EAAE,IAAI,EAAE,oBAAoB,EAAE;IACnE;QACE,QAAQ,EAAE,8BAA8B;QACxC,IAAI,EAAE,yBAAyB;KAChC;IACD,GAAG,oBAAoB;IACvB,GAAG,mBAAmB;CACvB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAe,EACf,IAAc;;IAEd,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,UAAU,CACd,uBAAuB,EACvB,qEAAqE;YACnE,iEAAiE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,UAAU,CACd,iBAAiB,IAAI,IAAI,EACzB,wEAAwE;YACtE,kBAAkB,CACrB,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,IAAI,GAAG,MAAA,IAAI,CAAC,IAAI,mCAAI,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,UAAU,CACd,yBAAyB,OAAO,EAAE,EAClC,8DAA8D;gBAC5D,yDAAyD;gBACzD,6DAA6D,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAClE,IAAI,SAAS;QAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAE3C,0EAA0E;IAC1E,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,SAAS,GACb,IAAI,CAAC,GAAG,KAAK,SAAS;QACpB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;IAE/D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,0EAA0E;IAC1E,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,YAAY;IACZ,IAAI,WAAW,GAAoB,IAAI,CAAC;IACxC,IAAI,CAAC;QACH,WAAW,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAAC,WAAM,CAAC;QACP,WAAW,GAAG,IAAI,CAAC,CAAC,sCAAsC;IAC5D,CAAC;IACD,IAAI,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,cAAc,EAAE,EAAE,CAAC;QAClC,MAAM,iBAAiB,CACrB,wBAAwB,SAAS,mCAAmC;YAClE,iDAAiD,EACnD,sEAAsE;YACpE,8BAA8B,CACjC,CAAC;IACJ,CAAC;IACD,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7C,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC;IAEzC,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,0EAA0E;QAC1E,mEAAmE;QACnE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,mBAAmB;gBAC3B,IAAI,EACF,6DAA6D;oBAC7D,gDAAgD,IAAI,GAAG;aAC1D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,iBAAiB,CACf,SAAS,EACT,QAAQ,EACR,IAAI,KAAK,aAAa;YACpB,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC;YAChC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CACjC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAEhC,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAE9D,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,CAAC,eAAe,IAAI,GAAG,CAAC,CAAC;IAEtC,IAAI,SAAS,EAAE,CAAC;QACd,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,SAAS;QACT,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IAC9E,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,IAAI,IAAI,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,GAAG,CAAC,GAAG,CACL,gCAAgC,QAAQ,CAAC,KAAK,CAAC,MAAM,SACnD,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACrC,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAClC,GAAG,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAClC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG;QACX,IAAI;QACJ,GAAG,EAAE,SAAS;QACd,OAAO;QACP,OAAO;QACP,QAAQ,EAAE;YACR,MAAM,EAAE,QAAQ,CAAC,IAAI;YACrB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB;KACF,CAAC;IAEF,MAAM,OAAO,GAAG,SAAS,CAAC;QACxB,IAAI;QACJ,GAAG,EAAE,SAAS;QACd,OAAO;QACP,OAAO;QACP,cAAc,EAAE,QAAQ,CAAC,IAAI;QAC7B,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;QACpC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;KACjC,CAAC,CAAC;IAEH,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAEzB,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,GAAG,CAAC;QACzD,MAAM,CAAC,KAAK,CAAC,uBAAuB,MAAM,gBAAgB,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,MAI5B;IACC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC9C,MAAM,KAAK,GAAa;QACtB,GAAG,OAAO,CAAC,MAAM,QAAQ,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU;KACnE,CAAC;IAEF,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CACR,yBAAyB,QAAQ,CAAC,KAAK,CAAC,MAAM,SAC5C,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACrC,GAAG,CACJ,CAAC;IACJ,CAAC;SAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,4BAA4B,CAAC,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,IAAsC,EACtC,IAAc;IAEd,MAAM,QAAQ,GAAG,YAAY,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAkB,CAAC;IACtD,OAAO,gBAAgB,iCAAM,OAAO,KAAE,IAAI,IAAG,CAAC;AAChD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAiB,EACjB,KAAc,EACd,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,QAAQ,CAAC,EAChD,YAAiC,OAAO;IAExC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAEnD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,MAAM,SAAS,GAAG,EAAE;SACjB,WAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAChD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SACtC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,IAAI,EAAE,CAAC;IAEV,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,gBAAgB,CAC7B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAC3B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAC9B,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CACtC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CACV,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACtC,OAAO;gBACL,IAAI;gBACJ,MAAM,EAAE,mBAAmB;gBAC3B,IAAI,EACF,8DAA8D;oBAC9D,oDAAoD,IAAI,GAAG;aAC9D,CAAC;QACJ,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACvC,CAAC;AASD;;;;;;;;GAQG;AACH,SAAS,aAAa,CACpB,SAAiB,EACjB,IAAsC,EACtC,KAAc;IAEd,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,YAAY,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;IAEzD,2EAA2E;IAC3E,kEAAkE;IAClE,MAAM,WAAW,GAAG,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAE1D,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK,EAAE,CAAC;QAClC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAa,CAAC;IAElD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAa,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+DAA+D;QAC/D,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,EAAE;YACR,KAAK,EAAE;gBACL;oBACE,KAAK,EAAE,QAAQ;oBACf,OAAO,EAAE,mCACP,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE;oBACF,IAAI,EACF,6DAA6D;wBAC7D,gDAAgD;iBACnD;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC;IACJ,CAAC;IAED,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3E,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,MAQlB;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CACR,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,QAAQ,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,CACjF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,aAAa,+BAA+B,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,+BAA+B,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,0BAA0B,MAAM,CAAC,IAAI,8BAA8B,MAAM,CAAC,GAAG,GAAG,CAAC;IAC1F,CAAC;IACD,OAAO,qBAAqB,MAAM,CAAC,IAAI,UAAU,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACvF,CAAC","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport { printBanner } from '../banner';\nimport type { CliContext } from '../context';\nimport { copyTreeVerbatim } from '../copy-tree';\nimport { invalidStateError, usageError } from '../errors';\nimport type { ExitCode } from '../exit-codes';\nimport {\n  type Manifest,\n  type ManifestNote,\n  mergeManifest,\n  serializeManifest,\n} from '../merge-manifest';\nimport {\n  type EkanosProject,\n  docEntryProblem,\n  serializeProject,\n} from '../project';\nimport { classifyPath, readFileNoFollow, writeFileNoFollow } from '../safe-fs';\nimport { readTemplate, templatesDir, toDisplayName } from '../templates';\nimport { canWizard, wizard } from '../wizard';\n\n/**\n * A file init did not write, and what the partner should do about it.\n *\n * Every ERROR path in this CLI carries an imperative hint; a skip did not, and\n * that asymmetry was the bug — `skipped package.json (already exists)` hid the\n * loss of eleven dependencies and the project's module type.\n */\nexport interface SkippedFile {\n  file: string;\n  reason: string;\n  hint: string;\n}\n\nexport interface InitArgs {\n  slug?: string;\n  /**\n   * Explicit target directory. When omitted, init scaffolds into `./<slug>`\n   * under `cwd` — never into `cwd` itself. A real partner ran `init` in a\n   * populated directory and got six files sprayed into it; `--dir .` is the\n   * explicit opt-in for that.\n   */\n  dir?: string;\n  cwd: string;\n  force: boolean;\n  /** Accepted for non-interactive ergonomics; init never prompts regardless. */\n  yes: boolean;\n  /**\n   * Repeatable `--docs` entries — http(s) URLs or project-relative paths to\n   * the target API's documentation, written into the scaffolded ekanos.json\n   * as `docs`. Absent flag means the field is simply omitted; init never\n   * prompts for it.\n   */\n  docs?: string[];\n  /**\n   * Test-only override for the clack wizard gate (`canWizard` in\n   * `wizard.ts`) — never set from real CLI wiring. See `RunOptions` in\n   * `index.ts`.\n   */\n  stdinIsTTY?: boolean;\n}\n\nconst SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;\n\n/**\n * The files init writes: template basename → destination path.\n *\n * `package.json` is handled separately (see `writeManifest`) because it is the\n * one file a partner plausibly already has — `npm init -y` before `ekanos\n * init` is the ordinary way to start — and skipping it silently costs them\n * every dependency and script.\n */\n/**\n * The agent-context files. The SDK's day-1 users are coding agents, so the\n * scaffold ships the authoring contract alongside the code: AGENTS.md is the\n * contract, CLAUDE.md points at it, and the Claude Code skill teaches the\n * iterate-validate-publish loop. Version-matched to the CLI because they live\n * in its templates.\n *\n * Exported so `ekanos upgrade` can regenerate exactly this set from the\n * NEWLY installed CLI's templates after a version bump — a stale AGENTS.md\n * teaches an agent yesterday's contract, which is as harmful as a stale\n * binary. One list, so `init` and `upgrade` can never disagree on what \"the\n * agent-context files\" even are.\n */\nexport const AGENT_CONTEXT_FILES: { template: string; dest: string }[] = [\n  { template: 'AGENTS.md.tmpl', dest: 'AGENTS.md' },\n  { template: 'CLAUDE.md.tmpl', dest: 'CLAUDE.md' },\n  { template: 'claude-skill.md.tmpl', dest: '.claude/skills/ekanos/SKILL.md' },\n];\n\n/**\n * The docs-grounding artifacts, exported for the same reason as\n * `AGENT_CONTEXT_FILES`: `upgrade` must create these when they are missing\n * (an older project upgrading into a toolchain whose AGENTS.md and skills\n * now reference them), and one list keeps `init` and `upgrade` from ever\n * disagreeing on what they are. Unlike the agent-context files these are\n * NEVER regenerated — `docs/api-notes.md` is agent/partner-authored after\n * the scaffold and `.mcp.json` may carry local additions — only created\n * when absent.\n */\nexport const DOCS_GROUNDING_FILES: { template: string; dest: string }[] = [\n  // The agent-authored snapshot of the target API — see the template itself\n  // and AGENTS.md's \"API documentation\" section for the convention.\n  { template: 'docs/api-notes.md.tmpl', dest: 'docs/api-notes.md' },\n  // Per-project MCP config so Claude Code picks up Context7 (the docs\n  // fallback in the resolution ladder) without any global setup.\n  { template: 'mcp.json.tmpl', dest: '.mcp.json' },\n];\n\nconst FILES: { template: string; dest: string }[] = [\n  { template: 'ekanos.json.tmpl', dest: 'ekanos.json' },\n  { template: 'gitignore.tmpl', dest: '.gitignore' },\n  // Without this, the `typecheck` script below prints tsc's help and exits 1 —\n  // and, worse, no type error in the scaffold ever surfaces.\n  { template: 'tsconfig.json.tmpl', dest: 'tsconfig.json' },\n  { template: 'vitest.config.ts.tmpl', dest: 'vitest.config.ts' },\n  // Wired via package.json's \"prepare\" script — see setup-hooks.mjs.tmpl's\n  // own header for what it does and why it tolerates a non-git directory.\n  { template: 'scripts/setup-hooks.mjs.tmpl', dest: 'scripts/setup-hooks.mjs' },\n  { template: 'src/integration.ts.tmpl', dest: 'src/integration.ts' },\n  {\n    template: 'src/integration.test.ts.tmpl',\n    dest: 'src/integration.test.ts',\n  },\n  ...DOCS_GROUNDING_FILES,\n  ...AGENT_CONTEXT_FILES,\n];\n\n/**\n * `init` — instantiate a project from the bundled template: ekanos.json, a\n * working minimal defineIntegration, a test, a vitest config (with the\n * required SDK inline block), a .gitignore, and a package.json with real\n * published deps. Idempotent: an existing file is left untouched (reported as\n * skipped) unless --force is passed. Never prompts — a missing --slug fails\n * with a usage error naming the flag.\n *\n * In human mode at a real TTY (`canWizard`), the scaffold runs behind a\n * clack `intro`/spinner/`outro` flow instead of the flat `ctx.log` lines\n * below — see `wizard.ts`. This is a restyle, not a new interaction: the\n * data written to disk and the JSON/human-non-TTY envelope are identical\n * either way, and nothing here ever waits on a prompt.\n */\nexport async function runInit(\n  ctx: CliContext,\n  args: InitArgs,\n): Promise<ExitCode> {\n  const slug = args.slug;\n  if (!slug) {\n    throw usageError(\n      'init requires a slug.',\n      'Pass it explicitly: \"ekanos init --slug <your-integration> --yes\". ' +\n        'The CLI never prompts, so the slug must be on the command line.',\n    );\n  }\n  if (!SLUG_PATTERN.test(slug)) {\n    throw usageError(\n      `Invalid slug \"${slug}\".`,\n      'Use kebab-case: lowercase [a-z0-9] segments joined by single hyphens, ' +\n        'e.g. \"acme-crm\".',\n    );\n  }\n\n  // Same rule the ekanos.json schema enforces, applied at the flag so a bad\n  // entry fails HERE (usage, exit 2) instead of scaffolding a project whose\n  // very first `ekanos validate` cannot even load its config.\n  const docs = args.docs ?? [];\n  for (const entry of docs) {\n    const problem = docEntryProblem(entry);\n    if (problem) {\n      throw usageError(\n        `Invalid --docs value: ${problem}`,\n        'Pass --docs an http(s) URL or a project-relative path, e.g. ' +\n          '\"--docs https://developer.example.com/openapi.json\" or ' +\n          '\"--docs docs/api.md\". Repeat the flag for multiple entries.',\n      );\n    }\n  }\n\n  const useWizard = canWizard(ctx, { stdinIsTTY: args.stdinIsTTY });\n  if (useWizard) wizard.intro('ekanos init');\n\n  // Default to `./<slug>`, not the cwd: scaffolding six files into whatever\n  // directory the partner happened to be sitting in is how a real project got\n  // polluted. `--dir .` remains the explicit way to scaffold in place.\n  const targetDir =\n    args.dir !== undefined\n      ? path.resolve(args.cwd, args.dir)\n      : path.resolve(args.cwd, slug);\n  const vars = { SLUG: slug, DISPLAY_NAME: toDisplayName(slug) };\n\n  const created: string[] = [];\n  const skipped: SkippedFile[] = [];\n\n  // The project root is the guard for every write below: creating it raw is\n  // fine (it is the boundary, not inside it), but everything under it goes\n  // through safe-fs so a planted symlink refuses loudly instead of teleporting\n  // a write outside the project. See safe-fs.ts for the threat model. The one\n  // case the guard cannot see is the boundary ITSELF being a symlink — the\n  // containment math is lexical against `targetDir`, so a planted link there\n  // would relocate every \"contained\" write wholesale. Refuse it. (A symlinked\n  // ANCESTOR — macOS's /tmp, a linked home — stays fine: only the leaf is\n  // checked.)\n  let targetStats: fs.Stats | null = null;\n  try {\n    targetStats = fs.lstatSync(targetDir);\n  } catch {\n    targetStats = null; // does not exist yet — ours to create\n  }\n  if (targetStats?.isSymbolicLink()) {\n    throw invalidStateError(\n      `The target directory ${targetDir} is a symlink, so the scaffold's ` +\n        'write-containment guarantees cannot hold there.',\n      'Scaffold into the real directory (pass its resolved path to --dir), ' +\n        'or remove the symlink first.',\n    );\n  }\n  fs.mkdirSync(targetDir, { recursive: true });\n\n  const spinner = useWizard ? wizard.spinner() : null;\n  spinner?.start(`Scaffolding \"${slug}\"…`);\n\n  for (const { template, dest } of FILES) {\n    const destPath = path.join(targetDir, dest);\n    const kind = classifyPath(destPath);\n    // A symlink is never \"already exists\": skipping would keep the plant, and\n    // writing through it is the attack — writeFileNoFollow refuses it.\n    if (kind !== 'missing' && kind !== 'symlink' && !args.force) {\n      skipped.push({\n        file: dest,\n        reason: 'it already exists',\n        hint:\n          `Compare it against the scaffold and merge anything you are ` +\n          `missing, or re-run with --force to overwrite ${dest}.`,\n      });\n      continue;\n    }\n\n    writeFileNoFollow(\n      targetDir,\n      destPath,\n      dest === 'ekanos.json'\n        ? renderEkanosConfig(vars, docs)\n        : readTemplate(template, vars),\n    );\n    created.push(dest);\n  }\n\n  const skills = copyBundledSkillTrees(targetDir, args.force);\n  created.push(...skills.created);\n  skipped.push(...skills.skipped);\n\n  const manifest = writeManifest(targetDir, vars, args.force);\n  if (manifest.kind === 'created') created.push('package.json');\n\n  spinner?.stop(`Scaffolded \"${slug}\"`);\n\n  if (useWizard) {\n    // Per-file \"created\" detail stays collapsed into the count above — the\n    // note surfaces only what needs a partner's attention: skips (they hid\n    // real data loss before, see `SkippedFile`'s doc comment) and manifest\n    // notes.\n    wizard.note(wizardSummaryDetail({ created, skipped, manifest }), 'Summary');\n  } else {\n    for (const file of created) ctx.log(`  created ${file}`);\n    if (manifest.kind === 'merged') {\n      ctx.log(\n        `  merged package.json (added ${manifest.added.length} field${\n          manifest.added.length === 1 ? '' : 's'\n        })`,\n      );\n    }\n    if (manifest.kind === 'unchanged') {\n      ctx.log('  package.json already had everything the scaffold adds');\n    }\n    for (const skip of skipped) {\n      ctx.log(`  skipped ${skip.file} — ${skip.reason}. ${skip.hint}`);\n    }\n    for (const note of manifest.notes) {\n      ctx.warn(`  ${note.message} ${note.hint}`);\n    }\n  }\n\n  const data = {\n    slug,\n    dir: targetDir,\n    created,\n    skipped,\n    manifest: {\n      action: manifest.kind,\n      added: manifest.added,\n      kept: manifest.kept,\n      notes: manifest.notes,\n    },\n  };\n\n  const summary = summarize({\n    slug,\n    dir: targetDir,\n    created,\n    skipped,\n    manifestAction: manifest.kind,\n    manifestAdded: manifest.added.length,\n    noteCount: manifest.notes.length,\n  });\n\n  printBanner(ctx, 'full');\n\n  if (useWizard) {\n    const relDir = path.relative(args.cwd, targetDir) || '.';\n    wizard.outro(`Next steps:\\n\\n  cd ${relDir}\\n  ekanos dev`);\n  }\n\n  return ctx.succeed(data, summary);\n}\n\n/**\n * The clack `note()` body for a successful wizard-mode scaffold — collapses\n * \"created\" down to a count (the flat per-file lines this replaces are the\n * `else` branch above) and surfaces only what needs a partner's attention:\n * skips and manifest notes, each with its full hint.\n */\nfunction wizardSummaryDetail(params: {\n  created: string[];\n  skipped: SkippedFile[];\n  manifest: ManifestOutcome;\n}): string {\n  const { created, skipped, manifest } = params;\n  const lines: string[] = [\n    `${created.length} file${created.length === 1 ? '' : 's'} written`,\n  ];\n\n  if (manifest.kind === 'merged') {\n    lines.push(\n      `package.json merged (+${manifest.added.length} field${\n        manifest.added.length === 1 ? '' : 's'\n      })`,\n    );\n  } else if (manifest.kind === 'unchanged') {\n    lines.push('package.json already had everything the scaffold adds');\n  }\n\n  if (skipped.length > 0) {\n    lines.push('', 'Skipped (already existed):');\n    for (const skip of skipped) {\n      lines.push(`  ${skip.file} — ${skip.hint}`);\n    }\n  }\n\n  for (const note of manifest.notes) {\n    lines.push('', `⚠ ${note.message} ${note.hint}`);\n  }\n\n  return lines.join('\\n');\n}\n\n/**\n * The scaffolded ekanos.json: the template, plus the collected `--docs`\n * entries when there are any. Parse-then-serialize (rather than string\n * surgery) so the written file is exactly what `loadProject` will read back.\n */\nfunction renderEkanosConfig(\n  vars: Readonly<Record<string, string>>,\n  docs: string[],\n): string {\n  const rendered = readTemplate('ekanos.json.tmpl', vars);\n  if (docs.length === 0) return rendered;\n  const project = JSON.parse(rendered) as EkanosProject;\n  return serializeProject({ ...project, docs });\n}\n\n/**\n * Copy every bundled skill tree (`templates/skills/<name>/`) into the\n * scaffolded project at `.claude/skills/<name>/`, verbatim — see\n * `copyTreeVerbatim` for why these are bytes, never rendered templates. The\n * walk is generic: a skill directory added to the published templates ships\n * with no code change here. A CLI build with no `templates/skills/` at all\n * (today's) scaffolds nothing and reports nothing.\n *\n * `skillsRoot` is injectable for tests; real callers take the default.\n */\nexport function copyBundledSkillTrees(\n  targetDir: string,\n  force: boolean,\n  skillsRoot = path.join(templatesDir(), 'skills'),\n  onRefusal: 'throw' | 'collect' = 'throw',\n): { created: string[]; skipped: SkippedFile[]; refused: string[] } {\n  if (!fs.existsSync(skillsRoot))\n    return { created: [], skipped: [], refused: [] };\n\n  const created: string[] = [];\n  const skipped: SkippedFile[] = [];\n  const refused: string[] = [];\n\n  const skillDirs = fs\n    .readdirSync(skillsRoot, { withFileTypes: true })\n    .filter((entry) => entry.isDirectory())\n    .map((entry) => entry.name)\n    .sort();\n\n  for (const name of skillDirs) {\n    const destBase = path.join('.claude', 'skills', name);\n    const result = copyTreeVerbatim(\n      path.join(skillsRoot, name),\n      path.join(targetDir, destBase),\n      { force, root: targetDir, onRefusal },\n    );\n    created.push(...result.created.map((rel) => path.join(destBase, rel)));\n    refused.push(...result.refused.map((rel) => path.join(destBase, rel)));\n    skipped.push(\n      ...result.skipped.map((rel) => {\n        const file = path.join(destBase, rel);\n        return {\n          file,\n          reason: 'it already exists',\n          hint:\n            `Compare it against the bundled skill and merge anything you ` +\n            `are missing, or re-run with --force to overwrite ${file}.`,\n        };\n      }),\n    );\n  }\n\n  return { created, skipped, refused };\n}\n\ntype ManifestOutcome = {\n  kind: 'created' | 'merged' | 'unchanged';\n  added: string[];\n  kept: string[];\n  notes: ManifestNote[];\n};\n\n/**\n * Write or MERGE package.json.\n *\n * A partner who ran `npm init -y` first had a manifest with none of the\n * scaffold's dependencies and `\"type\": \"commonjs\"` under ESM sources, and the\n * old behaviour reported that as one word: \"skipped\". Merging is additive — a\n * version or script they already set is theirs and is never touched — so the\n * ordinary `npm init -y` path now lands somewhere that installs and runs.\n */\nfunction writeManifest(\n  targetDir: string,\n  vars: Readonly<Record<string, string>>,\n  force: boolean,\n): ManifestOutcome {\n  const destPath = path.join(targetDir, 'package.json');\n  const rendered = readTemplate('package.json.tmpl', vars);\n\n  // readFileNoFollow refuses a symlinked package.json outright, so the write\n  // below can never follow one either; null means genuinely absent.\n  const existingRaw = readFileNoFollow(targetDir, destPath);\n\n  if (existingRaw === null || force) {\n    writeFileNoFollow(targetDir, destPath, rendered);\n    return { kind: 'created', added: [], kept: [], notes: [] };\n  }\n\n  const template = JSON.parse(rendered) as Manifest;\n\n  let existing: Manifest;\n  try {\n    existing = JSON.parse(existingRaw) as Manifest;\n  } catch (error) {\n    // Unparseable: do not guess, and do not clobber. Name the fix.\n    return {\n      kind: 'unchanged',\n      added: [],\n      kept: [],\n      notes: [\n        {\n          field: '(root)',\n          message: `package.json is not valid JSON: ${\n            error instanceof Error ? error.message : String(error)\n          }`,\n          hint:\n            'Fix the JSON syntax, then re-run \"ekanos init\" to have the ' +\n            \"scaffold's dependencies and scripts merged in.\",\n        },\n      ],\n    };\n  }\n\n  const result = mergeManifest(existing, template);\n  if (!result.changed) {\n    return {\n      kind: 'unchanged',\n      added: [],\n      kept: result.kept,\n      notes: result.notes,\n    };\n  }\n\n  writeFileNoFollow(targetDir, destPath, serializeManifest(result.manifest));\n  return {\n    kind: 'merged',\n    added: result.added,\n    kept: result.kept,\n    notes: result.notes,\n  };\n}\n\nfunction summarize(params: {\n  slug: string;\n  dir: string;\n  created: string[];\n  skipped: SkippedFile[];\n  manifestAction: ManifestOutcome['kind'];\n  manifestAdded: number;\n  noteCount: number;\n}): string {\n  const parts: string[] = [];\n  if (params.created.length > 0) {\n    parts.push(\n      `${params.created.length} file${params.created.length === 1 ? '' : 's'} written`,\n    );\n  }\n  if (params.manifestAction === 'merged') {\n    parts.push(`${params.manifestAdded} package.json field(s) merged`);\n  }\n  if (params.skipped.length > 0) {\n    parts.push(`${params.skipped.length} skipped`);\n  }\n  if (params.noteCount > 0) {\n    parts.push(`${params.noteCount} thing(s) need your attention`);\n  }\n\n  if (parts.length === 0) {\n    return `init: nothing to do — \"${params.slug}\" is already scaffolded in ${params.dir}.`;\n  }\n  return `init: scaffolded \"${params.slug}\" into ${params.dir} (${parts.join(', ')}).`;\n}\n"]}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE1D,OAAO,EAGL,aAAa,EACb,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AA2C9C,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAElD;;;;;;;GAOG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAyC;IACvE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE;IACjD,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE;IACjD,EAAE,QAAQ,EAAE,sBAAsB,EAAE,IAAI,EAAE,gCAAgC,EAAE;CAC7E,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAyC;IACxE,0EAA0E;IAC1E,kEAAkE;IAClE,EAAE,QAAQ,EAAE,wBAAwB,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACjE,oEAAoE;IACpE,+DAA+D;IAC/D,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE;CACjD,CAAC;AAEF,MAAM,KAAK,GAAyC;IAClD,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,aAAa,EAAE;IACrD,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,EAAE;IAClD,0EAA0E;IAC1E,0EAA0E;IAC1E,iCAAiC;IACjC,EAAE,QAAQ,EAAE,0BAA0B,EAAE,IAAI,EAAE,qBAAqB,EAAE;IACrE,6EAA6E;IAC7E,2DAA2D;IAC3D,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,eAAe,EAAE;IACzD,EAAE,QAAQ,EAAE,uBAAuB,EAAE,IAAI,EAAE,kBAAkB,EAAE;IAC/D,yEAAyE;IACzE,wEAAwE;IACxE,EAAE,QAAQ,EAAE,8BAA8B,EAAE,IAAI,EAAE,yBAAyB,EAAE;IAC7E,EAAE,QAAQ,EAAE,yBAAyB,EAAE,IAAI,EAAE,oBAAoB,EAAE;IACnE;QACE,QAAQ,EAAE,8BAA8B;QACxC,IAAI,EAAE,yBAAyB;KAChC;IACD,GAAG,oBAAoB;IACvB,GAAG,mBAAmB;CACvB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAe,EACf,IAAc;;IAEd,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,UAAU,CACd,uBAAuB,EACvB,qEAAqE;YACnE,iEAAiE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,UAAU,CACd,iBAAiB,IAAI,IAAI,EACzB,wEAAwE;YACtE,kBAAkB,CACrB,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,IAAI,SAAG,IAAI,CAAC,IAAI,mCAAI,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,UAAU,CACd,yBAAyB,OAAO,EAAE,EAClC,8DAA8D;gBAC5D,yDAAyD;gBACzD,6DAA6D,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAClE,IAAI,SAAS;QAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAE3C,0EAA0E;IAC1E,4EAA4E;IAC5E,qEAAqE;IACrE,MAAM,SAAS,GACb,IAAI,CAAC,GAAG,KAAK,SAAS;QACpB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;IAE/D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,0EAA0E;IAC1E,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,YAAY;IACZ,IAAI,WAAW,GAAoB,IAAI,CAAC;IACxC,IAAI,CAAC;QACH,WAAW,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;eAAO,CAAC;QACP,WAAW,GAAG,IAAI,CAAC,CAAC,sCAAsC;IAC5D,CAAC;IACD,IAAI,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,cAAc,EAAE,EAAE,CAAC;QAClC,MAAM,iBAAiB,CACrB,wBAAwB,SAAS,mCAAmC;YAClE,iDAAiD,EACnD,sEAAsE;YACpE,8BAA8B,CACjC,CAAC;IACJ,CAAC;IACD,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7C,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC;IAEzC,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,0EAA0E;QAC1E,mEAAmE;QACnE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,mBAAmB;gBAC3B,IAAI,EACF,6DAA6D;oBAC7D,gDAAgD,IAAI,GAAG;aAC1D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,iBAAiB,CACf,SAAS,EACT,QAAQ,EACR,IAAI,KAAK,aAAa;YACpB,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC;YAChC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CACjC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAEhC,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAE9D,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,CAAC,eAAe,IAAI,GAAG,CAAC,CAAC;IAEtC,IAAI,SAAS,EAAE,CAAC;QACd,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,SAAS;QACT,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IAC9E,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,IAAI,IAAI,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,GAAG,CAAC,GAAG,CACL,gCAAgC,QAAQ,CAAC,KAAK,CAAC,MAAM,SACnD,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACrC,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAClC,GAAG,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAClC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG;QACX,IAAI;QACJ,GAAG,EAAE,SAAS;QACd,OAAO;QACP,OAAO;QACP,QAAQ,EAAE;YACR,MAAM,EAAE,QAAQ,CAAC,IAAI;YACrB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB;KACF,CAAC;IAEF,MAAM,OAAO,GAAG,SAAS,CAAC;QACxB,IAAI;QACJ,GAAG,EAAE,SAAS;QACd,OAAO;QACP,OAAO;QACP,cAAc,EAAE,QAAQ,CAAC,IAAI;QAC7B,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;QACpC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;KACjC,CAAC,CAAC;IAEH,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAEzB,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,GAAG,CAAC;QACzD,MAAM,CAAC,KAAK,CAAC,uBAAuB,MAAM,gBAAgB,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,MAI5B;IACC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC9C,MAAM,KAAK,GAAa;QACtB,GAAG,OAAO,CAAC,MAAM,QAAQ,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU;KACnE,CAAC;IAEF,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CACR,yBAAyB,QAAQ,CAAC,KAAK,CAAC,MAAM,SAC5C,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACrC,GAAG,CACJ,CAAC;IACJ,CAAC;SAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,4BAA4B,CAAC,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,IAAsC,EACtC,IAAc;IAEd,MAAM,QAAQ,GAAG,YAAY,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAkB,CAAC;IACtD,OAAO,gBAAgB,iCAAM,OAAO,KAAE,IAAI,IAAG,CAAC;AAChD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAiB,EACjB,KAAc,EACd,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,QAAQ,CAAC,EAChD,SAAS,GAAwB,OAAO;IAExC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAEnD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,MAAM,SAAS,GAAG,EAAE;SACjB,WAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAChD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SACtC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,IAAI,EAAE,CAAC;IAEV,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,gBAAgB,CAC7B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAC3B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAC9B,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CACtC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CACV,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACtC,OAAO;gBACL,IAAI;gBACJ,MAAM,EAAE,mBAAmB;gBAC3B,IAAI,EACF,8DAA8D;oBAC9D,oDAAoD,IAAI,GAAG;aAC9D,CAAC;QACJ,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACvC,CAAC;AASD;;;;;;;;GAQG;AACH,SAAS,aAAa,CACpB,SAAiB,EACjB,IAAsC,EACtC,KAAc;IAEd,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,YAAY,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;IAEzD,2EAA2E;IAC3E,kEAAkE;IAClE,MAAM,WAAW,GAAG,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAE1D,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK,EAAE,CAAC;QAClC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAa,CAAC;IAElD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAa,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+DAA+D;QAC/D,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,EAAE;YACR,KAAK,EAAE;gBACL;oBACE,KAAK,EAAE,QAAQ;oBACf,OAAO,EAAE,mCACP,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE;oBACF,IAAI,EACF,6DAA6D;wBAC7D,gDAAgD;iBACnD;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC;IACJ,CAAC;IAED,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3E,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,MAQlB;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CACR,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,QAAQ,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,CACjF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,aAAa,+BAA+B,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,+BAA+B,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,0BAA0B,MAAM,CAAC,IAAI,8BAA8B,MAAM,CAAC,GAAG,GAAG,CAAC;IAC1F,CAAC;IACD,OAAO,qBAAqB,MAAM,CAAC,IAAI,UAAU,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACvF,CAAC","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport { printBanner } from '../banner';\nimport type { CliContext } from '../context';\nimport { copyTreeVerbatim } from '../copy-tree';\nimport { invalidStateError, usageError } from '../errors';\nimport type { ExitCode } from '../exit-codes';\nimport {\n  type Manifest,\n  type ManifestNote,\n  mergeManifest,\n  serializeManifest,\n} from '../merge-manifest';\nimport {\n  type EkanosProject,\n  docEntryProblem,\n  serializeProject,\n} from '../project';\nimport { classifyPath, readFileNoFollow, writeFileNoFollow } from '../safe-fs';\nimport { readTemplate, templatesDir, toDisplayName } from '../templates';\nimport { canWizard, wizard } from '../wizard';\n\n/**\n * A file init did not write, and what the partner should do about it.\n *\n * Every ERROR path in this CLI carries an imperative hint; a skip did not, and\n * that asymmetry was the bug — `skipped package.json (already exists)` hid the\n * loss of eleven dependencies and the project's module type.\n */\nexport interface SkippedFile {\n  file: string;\n  reason: string;\n  hint: string;\n}\n\nexport interface InitArgs {\n  slug?: string;\n  /**\n   * Explicit target directory. When omitted, init scaffolds into `./<slug>`\n   * under `cwd` — never into `cwd` itself. A real partner ran `init` in a\n   * populated directory and got six files sprayed into it; `--dir .` is the\n   * explicit opt-in for that.\n   */\n  dir?: string;\n  cwd: string;\n  force: boolean;\n  /** Accepted for non-interactive ergonomics; init never prompts regardless. */\n  yes: boolean;\n  /**\n   * Repeatable `--docs` entries — http(s) URLs or project-relative paths to\n   * the target API's documentation, written into the scaffolded ekanos.json\n   * as `docs`. Absent flag means the field is simply omitted; init never\n   * prompts for it.\n   */\n  docs?: string[];\n  /**\n   * Test-only override for the clack wizard gate (`canWizard` in\n   * `wizard.ts`) — never set from real CLI wiring. See `RunOptions` in\n   * `index.ts`.\n   */\n  stdinIsTTY?: boolean;\n}\n\nconst SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;\n\n/**\n * The files init writes: template basename → destination path.\n *\n * `package.json` is handled separately (see `writeManifest`) because it is the\n * one file a partner plausibly already has — `npm init -y` before `ekanos\n * init` is the ordinary way to start — and skipping it silently costs them\n * every dependency and script.\n */\n/**\n * The agent-context files. The SDK's day-1 users are coding agents, so the\n * scaffold ships the authoring contract alongside the code: AGENTS.md is the\n * contract, CLAUDE.md points at it, and the Claude Code skill teaches the\n * iterate-validate-publish loop. Version-matched to the CLI because they live\n * in its templates.\n *\n * Exported so `ekanos upgrade` can regenerate exactly this set from the\n * NEWLY installed CLI's templates after a version bump — a stale AGENTS.md\n * teaches an agent yesterday's contract, which is as harmful as a stale\n * binary. One list, so `init` and `upgrade` can never disagree on what \"the\n * agent-context files\" even are.\n */\nexport const AGENT_CONTEXT_FILES: { template: string; dest: string }[] = [\n  { template: 'AGENTS.md.tmpl', dest: 'AGENTS.md' },\n  { template: 'CLAUDE.md.tmpl', dest: 'CLAUDE.md' },\n  { template: 'claude-skill.md.tmpl', dest: '.claude/skills/ekanos/SKILL.md' },\n];\n\n/**\n * The docs-grounding artifacts, exported for the same reason as\n * `AGENT_CONTEXT_FILES`: `upgrade` must create these when they are missing\n * (an older project upgrading into a toolchain whose AGENTS.md and skills\n * now reference them), and one list keeps `init` and `upgrade` from ever\n * disagreeing on what they are. Unlike the agent-context files these are\n * NEVER regenerated — `docs/api-notes.md` is agent/partner-authored after\n * the scaffold and `.mcp.json` may carry local additions — only created\n * when absent.\n */\nexport const DOCS_GROUNDING_FILES: { template: string; dest: string }[] = [\n  // The agent-authored snapshot of the target API — see the template itself\n  // and AGENTS.md's \"API documentation\" section for the convention.\n  { template: 'docs/api-notes.md.tmpl', dest: 'docs/api-notes.md' },\n  // Per-project MCP config so Claude Code picks up Context7 (the docs\n  // fallback in the resolution ladder) without any global setup.\n  { template: 'mcp.json.tmpl', dest: '.mcp.json' },\n];\n\nconst FILES: { template: string; dest: string }[] = [\n  { template: 'ekanos.json.tmpl', dest: 'ekanos.json' },\n  { template: 'gitignore.tmpl', dest: '.gitignore' },\n  // pnpm's build-script approval for esbuild (vitest's dependency). Without\n  // it a fresh scaffold's `ekanos test` fails on the first run under pnpm —\n  // see the template's own header.\n  { template: 'pnpm-workspace.yaml.tmpl', dest: 'pnpm-workspace.yaml' },\n  // Without this, the `typecheck` script below prints tsc's help and exits 1 —\n  // and, worse, no type error in the scaffold ever surfaces.\n  { template: 'tsconfig.json.tmpl', dest: 'tsconfig.json' },\n  { template: 'vitest.config.ts.tmpl', dest: 'vitest.config.ts' },\n  // Wired via package.json's \"prepare\" script — see setup-hooks.mjs.tmpl's\n  // own header for what it does and why it tolerates a non-git directory.\n  { template: 'scripts/setup-hooks.mjs.tmpl', dest: 'scripts/setup-hooks.mjs' },\n  { template: 'src/integration.ts.tmpl', dest: 'src/integration.ts' },\n  {\n    template: 'src/integration.test.ts.tmpl',\n    dest: 'src/integration.test.ts',\n  },\n  ...DOCS_GROUNDING_FILES,\n  ...AGENT_CONTEXT_FILES,\n];\n\n/**\n * `init` — instantiate a project from the bundled template: ekanos.json, a\n * working minimal defineIntegration, a test, a vitest config (with the\n * required SDK inline block), a .gitignore, and a package.json with real\n * published deps. Idempotent: an existing file is left untouched (reported as\n * skipped) unless --force is passed. Never prompts — a missing --slug fails\n * with a usage error naming the flag.\n *\n * In human mode at a real TTY (`canWizard`), the scaffold runs behind a\n * clack `intro`/spinner/`outro` flow instead of the flat `ctx.log` lines\n * below — see `wizard.ts`. This is a restyle, not a new interaction: the\n * data written to disk and the JSON/human-non-TTY envelope are identical\n * either way, and nothing here ever waits on a prompt.\n */\nexport async function runInit(\n  ctx: CliContext,\n  args: InitArgs,\n): Promise<ExitCode> {\n  const slug = args.slug;\n  if (!slug) {\n    throw usageError(\n      'init requires a slug.',\n      'Pass it explicitly: \"ekanos init --slug <your-integration> --yes\". ' +\n        'The CLI never prompts, so the slug must be on the command line.',\n    );\n  }\n  if (!SLUG_PATTERN.test(slug)) {\n    throw usageError(\n      `Invalid slug \"${slug}\".`,\n      'Use kebab-case: lowercase [a-z0-9] segments joined by single hyphens, ' +\n        'e.g. \"acme-crm\".',\n    );\n  }\n\n  // Same rule the ekanos.json schema enforces, applied at the flag so a bad\n  // entry fails HERE (usage, exit 2) instead of scaffolding a project whose\n  // very first `ekanos validate` cannot even load its config.\n  const docs = args.docs ?? [];\n  for (const entry of docs) {\n    const problem = docEntryProblem(entry);\n    if (problem) {\n      throw usageError(\n        `Invalid --docs value: ${problem}`,\n        'Pass --docs an http(s) URL or a project-relative path, e.g. ' +\n          '\"--docs https://developer.example.com/openapi.json\" or ' +\n          '\"--docs docs/api.md\". Repeat the flag for multiple entries.',\n      );\n    }\n  }\n\n  const useWizard = canWizard(ctx, { stdinIsTTY: args.stdinIsTTY });\n  if (useWizard) wizard.intro('ekanos init');\n\n  // Default to `./<slug>`, not the cwd: scaffolding six files into whatever\n  // directory the partner happened to be sitting in is how a real project got\n  // polluted. `--dir .` remains the explicit way to scaffold in place.\n  const targetDir =\n    args.dir !== undefined\n      ? path.resolve(args.cwd, args.dir)\n      : path.resolve(args.cwd, slug);\n  const vars = { SLUG: slug, DISPLAY_NAME: toDisplayName(slug) };\n\n  const created: string[] = [];\n  const skipped: SkippedFile[] = [];\n\n  // The project root is the guard for every write below: creating it raw is\n  // fine (it is the boundary, not inside it), but everything under it goes\n  // through safe-fs so a planted symlink refuses loudly instead of teleporting\n  // a write outside the project. See safe-fs.ts for the threat model. The one\n  // case the guard cannot see is the boundary ITSELF being a symlink — the\n  // containment math is lexical against `targetDir`, so a planted link there\n  // would relocate every \"contained\" write wholesale. Refuse it. (A symlinked\n  // ANCESTOR — macOS's /tmp, a linked home — stays fine: only the leaf is\n  // checked.)\n  let targetStats: fs.Stats | null = null;\n  try {\n    targetStats = fs.lstatSync(targetDir);\n  } catch {\n    targetStats = null; // does not exist yet — ours to create\n  }\n  if (targetStats?.isSymbolicLink()) {\n    throw invalidStateError(\n      `The target directory ${targetDir} is a symlink, so the scaffold's ` +\n        'write-containment guarantees cannot hold there.',\n      'Scaffold into the real directory (pass its resolved path to --dir), ' +\n        'or remove the symlink first.',\n    );\n  }\n  fs.mkdirSync(targetDir, { recursive: true });\n\n  const spinner = useWizard ? wizard.spinner() : null;\n  spinner?.start(`Scaffolding \"${slug}\"…`);\n\n  for (const { template, dest } of FILES) {\n    const destPath = path.join(targetDir, dest);\n    const kind = classifyPath(destPath);\n    // A symlink is never \"already exists\": skipping would keep the plant, and\n    // writing through it is the attack — writeFileNoFollow refuses it.\n    if (kind !== 'missing' && kind !== 'symlink' && !args.force) {\n      skipped.push({\n        file: dest,\n        reason: 'it already exists',\n        hint:\n          `Compare it against the scaffold and merge anything you are ` +\n          `missing, or re-run with --force to overwrite ${dest}.`,\n      });\n      continue;\n    }\n\n    writeFileNoFollow(\n      targetDir,\n      destPath,\n      dest === 'ekanos.json'\n        ? renderEkanosConfig(vars, docs)\n        : readTemplate(template, vars),\n    );\n    created.push(dest);\n  }\n\n  const skills = copyBundledSkillTrees(targetDir, args.force);\n  created.push(...skills.created);\n  skipped.push(...skills.skipped);\n\n  const manifest = writeManifest(targetDir, vars, args.force);\n  if (manifest.kind === 'created') created.push('package.json');\n\n  spinner?.stop(`Scaffolded \"${slug}\"`);\n\n  if (useWizard) {\n    // Per-file \"created\" detail stays collapsed into the count above — the\n    // note surfaces only what needs a partner's attention: skips (they hid\n    // real data loss before, see `SkippedFile`'s doc comment) and manifest\n    // notes.\n    wizard.note(wizardSummaryDetail({ created, skipped, manifest }), 'Summary');\n  } else {\n    for (const file of created) ctx.log(`  created ${file}`);\n    if (manifest.kind === 'merged') {\n      ctx.log(\n        `  merged package.json (added ${manifest.added.length} field${\n          manifest.added.length === 1 ? '' : 's'\n        })`,\n      );\n    }\n    if (manifest.kind === 'unchanged') {\n      ctx.log('  package.json already had everything the scaffold adds');\n    }\n    for (const skip of skipped) {\n      ctx.log(`  skipped ${skip.file} — ${skip.reason}. ${skip.hint}`);\n    }\n    for (const note of manifest.notes) {\n      ctx.warn(`  ${note.message} ${note.hint}`);\n    }\n  }\n\n  const data = {\n    slug,\n    dir: targetDir,\n    created,\n    skipped,\n    manifest: {\n      action: manifest.kind,\n      added: manifest.added,\n      kept: manifest.kept,\n      notes: manifest.notes,\n    },\n  };\n\n  const summary = summarize({\n    slug,\n    dir: targetDir,\n    created,\n    skipped,\n    manifestAction: manifest.kind,\n    manifestAdded: manifest.added.length,\n    noteCount: manifest.notes.length,\n  });\n\n  printBanner(ctx, 'full');\n\n  if (useWizard) {\n    const relDir = path.relative(args.cwd, targetDir) || '.';\n    wizard.outro(`Next steps:\\n\\n  cd ${relDir}\\n  ekanos dev`);\n  }\n\n  return ctx.succeed(data, summary);\n}\n\n/**\n * The clack `note()` body for a successful wizard-mode scaffold — collapses\n * \"created\" down to a count (the flat per-file lines this replaces are the\n * `else` branch above) and surfaces only what needs a partner's attention:\n * skips and manifest notes, each with its full hint.\n */\nfunction wizardSummaryDetail(params: {\n  created: string[];\n  skipped: SkippedFile[];\n  manifest: ManifestOutcome;\n}): string {\n  const { created, skipped, manifest } = params;\n  const lines: string[] = [\n    `${created.length} file${created.length === 1 ? '' : 's'} written`,\n  ];\n\n  if (manifest.kind === 'merged') {\n    lines.push(\n      `package.json merged (+${manifest.added.length} field${\n        manifest.added.length === 1 ? '' : 's'\n      })`,\n    );\n  } else if (manifest.kind === 'unchanged') {\n    lines.push('package.json already had everything the scaffold adds');\n  }\n\n  if (skipped.length > 0) {\n    lines.push('', 'Skipped (already existed):');\n    for (const skip of skipped) {\n      lines.push(`  ${skip.file} — ${skip.hint}`);\n    }\n  }\n\n  for (const note of manifest.notes) {\n    lines.push('', `⚠ ${note.message} ${note.hint}`);\n  }\n\n  return lines.join('\\n');\n}\n\n/**\n * The scaffolded ekanos.json: the template, plus the collected `--docs`\n * entries when there are any. Parse-then-serialize (rather than string\n * surgery) so the written file is exactly what `loadProject` will read back.\n */\nfunction renderEkanosConfig(\n  vars: Readonly<Record<string, string>>,\n  docs: string[],\n): string {\n  const rendered = readTemplate('ekanos.json.tmpl', vars);\n  if (docs.length === 0) return rendered;\n  const project = JSON.parse(rendered) as EkanosProject;\n  return serializeProject({ ...project, docs });\n}\n\n/**\n * Copy every bundled skill tree (`templates/skills/<name>/`) into the\n * scaffolded project at `.claude/skills/<name>/`, verbatim — see\n * `copyTreeVerbatim` for why these are bytes, never rendered templates. The\n * walk is generic: a skill directory added to the published templates ships\n * with no code change here. A CLI build with no `templates/skills/` at all\n * (today's) scaffolds nothing and reports nothing.\n *\n * `skillsRoot` is injectable for tests; real callers take the default.\n */\nexport function copyBundledSkillTrees(\n  targetDir: string,\n  force: boolean,\n  skillsRoot = path.join(templatesDir(), 'skills'),\n  onRefusal: 'throw' | 'collect' = 'throw',\n): { created: string[]; skipped: SkippedFile[]; refused: string[] } {\n  if (!fs.existsSync(skillsRoot))\n    return { created: [], skipped: [], refused: [] };\n\n  const created: string[] = [];\n  const skipped: SkippedFile[] = [];\n  const refused: string[] = [];\n\n  const skillDirs = fs\n    .readdirSync(skillsRoot, { withFileTypes: true })\n    .filter((entry) => entry.isDirectory())\n    .map((entry) => entry.name)\n    .sort();\n\n  for (const name of skillDirs) {\n    const destBase = path.join('.claude', 'skills', name);\n    const result = copyTreeVerbatim(\n      path.join(skillsRoot, name),\n      path.join(targetDir, destBase),\n      { force, root: targetDir, onRefusal },\n    );\n    created.push(...result.created.map((rel) => path.join(destBase, rel)));\n    refused.push(...result.refused.map((rel) => path.join(destBase, rel)));\n    skipped.push(\n      ...result.skipped.map((rel) => {\n        const file = path.join(destBase, rel);\n        return {\n          file,\n          reason: 'it already exists',\n          hint:\n            `Compare it against the bundled skill and merge anything you ` +\n            `are missing, or re-run with --force to overwrite ${file}.`,\n        };\n      }),\n    );\n  }\n\n  return { created, skipped, refused };\n}\n\ntype ManifestOutcome = {\n  kind: 'created' | 'merged' | 'unchanged';\n  added: string[];\n  kept: string[];\n  notes: ManifestNote[];\n};\n\n/**\n * Write or MERGE package.json.\n *\n * A partner who ran `npm init -y` first had a manifest with none of the\n * scaffold's dependencies and `\"type\": \"commonjs\"` under ESM sources, and the\n * old behaviour reported that as one word: \"skipped\". Merging is additive — a\n * version or script they already set is theirs and is never touched — so the\n * ordinary `npm init -y` path now lands somewhere that installs and runs.\n */\nfunction writeManifest(\n  targetDir: string,\n  vars: Readonly<Record<string, string>>,\n  force: boolean,\n): ManifestOutcome {\n  const destPath = path.join(targetDir, 'package.json');\n  const rendered = readTemplate('package.json.tmpl', vars);\n\n  // readFileNoFollow refuses a symlinked package.json outright, so the write\n  // below can never follow one either; null means genuinely absent.\n  const existingRaw = readFileNoFollow(targetDir, destPath);\n\n  if (existingRaw === null || force) {\n    writeFileNoFollow(targetDir, destPath, rendered);\n    return { kind: 'created', added: [], kept: [], notes: [] };\n  }\n\n  const template = JSON.parse(rendered) as Manifest;\n\n  let existing: Manifest;\n  try {\n    existing = JSON.parse(existingRaw) as Manifest;\n  } catch (error) {\n    // Unparseable: do not guess, and do not clobber. Name the fix.\n    return {\n      kind: 'unchanged',\n      added: [],\n      kept: [],\n      notes: [\n        {\n          field: '(root)',\n          message: `package.json is not valid JSON: ${\n            error instanceof Error ? error.message : String(error)\n          }`,\n          hint:\n            'Fix the JSON syntax, then re-run \"ekanos init\" to have the ' +\n            \"scaffold's dependencies and scripts merged in.\",\n        },\n      ],\n    };\n  }\n\n  const result = mergeManifest(existing, template);\n  if (!result.changed) {\n    return {\n      kind: 'unchanged',\n      added: [],\n      kept: result.kept,\n      notes: result.notes,\n    };\n  }\n\n  writeFileNoFollow(targetDir, destPath, serializeManifest(result.manifest));\n  return {\n    kind: 'merged',\n    added: result.added,\n    kept: result.kept,\n    notes: result.notes,\n  };\n}\n\nfunction summarize(params: {\n  slug: string;\n  dir: string;\n  created: string[];\n  skipped: SkippedFile[];\n  manifestAction: ManifestOutcome['kind'];\n  manifestAdded: number;\n  noteCount: number;\n}): string {\n  const parts: string[] = [];\n  if (params.created.length > 0) {\n    parts.push(\n      `${params.created.length} file${params.created.length === 1 ? '' : 's'} written`,\n    );\n  }\n  if (params.manifestAction === 'merged') {\n    parts.push(`${params.manifestAdded} package.json field(s) merged`);\n  }\n  if (params.skipped.length > 0) {\n    parts.push(`${params.skipped.length} skipped`);\n  }\n  if (params.noteCount > 0) {\n    parts.push(`${params.noteCount} thing(s) need your attention`);\n  }\n\n  if (parts.length === 0) {\n    return `init: nothing to do — \"${params.slug}\" is already scaffolded in ${params.dir}.`;\n  }\n  return `init: scaffolded \"${params.slug}\" into ${params.dir} (${parts.join(', ')}).`;\n}\n"]}

package/dist/commands/login.d.ts

@@ -15,7 +15,7 @@ export interface LoginArgs {
     stdinIsTTY?: boolean;
 }
 /**
- * `login` — authenticate this machine against a Fusion deployment via the
+ * `login` — authenticate this machine against an Ekanos deployment via the
  * Auth0 device authorization flow.
  *
  * Idempotent: with a stored session that still authenticates, it reports that

package/dist/commands/login.js

@@ -1,12 +1,12 @@
 import { pollForDeviceTokens, startDeviceAuthorization, } from '../auth/device-flow.js';
-import { createFusionSession, fetchCliAuthConfig } from '../auth/fusion-api.js';
+import { createEkanosSession, fetchCliAuthConfig } from '../auth/ekanos-api.js';
 import { resolveAuthEnvironment, resolveIdentity } from '../auth/session.js';
 import { printBanner } from '../banner.js';
 import { CliError } from '../errors.js';
 import { ERROR_CODES } from '../exit-codes.js';
 import { canWizard, wizard } from '../wizard.js';
 /**
- * `login` — authenticate this machine against a Fusion deployment via the
+ * `login` — authenticate this machine against an Ekanos deployment via the
  * Auth0 device authorization flow.
  *
  * Idempotent: with a stored session that still authenticates, it reports that
@@ -86,7 +86,7 @@ export async function runLogin(ctx, args) {
     const spinner = useWizard ? wizard.spinner() : null;
     spinner === null || spinner === void 0 ? void 0 : spinner.start('Waiting for approval…');
     const tokens = await pollForDeviceTokens(config, authorization);
-    const session = await createFusionSession(env.host, tokens.accessToken);
+    const session = await createEkanosSession(env.host, tokens.accessToken);
     spinner === null || spinner === void 0 ? void 0 : spinner.stop(`✓ authenticated as ${(_c = session.email) !== null && _c !== void 0 ? _c : session.userId}`);
     const stored = {
         auth0RefreshToken: tokens.refreshToken,