@ekanos/cli 0.3.3 → 0.3.4

package/dist/auth/session.js

@@ -1,6 +1,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { authRequiredError, usageError } from '../errors.js';
+import { shortHost } from '../ui.js';
 import { CredentialStore, normalizeHost, resolveEkanosHome, } from './credential-store.js';
 import { fetchIdentity, refreshEkanosSession, } from './ekanos-api.js';
 /**
@@ -39,16 +40,24 @@ export function resolveHost(ctx, flag, env, options = {}) {
             // host can change under a developer via an ordinary merge or an
             // agent-applied patch — and this is where login sends the OAuth flow
             // and publish sends the bearer token and archive.
-            ctx.log(`ekanos: using ${host} — the host saved in ekanos.json. ` +
-                `Pass --host to override for one command.`);
+            ctx.log(ctx.jsonMode
+                ? `ekanos: using ${host} — the host saved in ekanos.json. ` +
+                    `Pass --host to override for one command.`
+                : ctx.ui.dim(`Using ${shortHost(host)} from ekanos.json. ` +
+                    `Pass --host to override for one command.`));
             return host;
         }
     }
     const stored = (_b = (_a = options.store) === null || _a === void 0 ? void 0 : _a.hosts()) !== null && _b !== void 0 ? _b : [];
     if (stored.length === 1) {
         const host = stored[0];
-        ctx.log(`ekanos: using ${host} — the only host you are logged in to. ` +
-            `Pass --host to target a different one.`);
+        // A person at a terminal sees this host in the result block of every
+        // verb, and it is the only one they are signed in to, so naming it
+        // again is noise. JSON callers get no result block, so they keep it.
+        if (ctx.jsonMode) {
+            ctx.log(`ekanos: using ${host} — the only host you are logged in to. ` +
+                `Pass --host to target a different one.`);
+        }
         return host;
     }
     throw usageError('No Ekanos host given.', stored.length > 1

package/dist/auth/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EACL,eAAe,EAEf,aAAa,EACb,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,aAAa,EACb,oBAAoB,GACrB,MAAM,cAAc,CAAC;AAatB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,WAAW,CACzB,GAAe,EACf,IAAwB,EACxB,GAAuC,EACvC,OAAO,GAKH,EAAE;;;IAEN,MAAM,GAAG,GAAG,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,GAAG,CAAC,WAAW,CAAC;IAEpC,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAErD,IAAI,QAAQ,EAAE,CAAC;YACb,oEAAoE;YACpE,kEAAkE;YAClE,8DAA8D;YAC9D,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YAErC,oEAAoE;YACpE,mEAAmE;YACnE,gEAAgE;YAChE,qEAAqE;YACrE,kDAAkD;YAClD,GAAG,CAAC,GAAG,CACL,iBAAiB,IAAI,oCAAoC;gBACvD,0CAA0C,CAC7C,CAAC;YAEF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,MAAM,SAAG,MAAA,OAAO,CAAC,KAAK,0CAAE,KAAK,EAAE,mCAAI,EAAE,CAAC;IAE5C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QAExB,GAAG,CAAC,GAAG,CACL,iBAAiB,IAAI,yCAAyC;YAC5D,wCAAwC,CAC3C,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,CACd,uBAAuB,EACvB,MAAM,CAAC,MAAM,GAAG,CAAC;QACf,CAAC,CAAC,wBAAwB,MAAM,CAAC,MAAM,WAAW,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;YACrE,wDAAwD;QAC5D,CAAC,CAAC,+DAA+D;YAC7D,iEAAiE;YACjE,cAAc,CACrB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAExD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;eAAO,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;eAAO,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GACR,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAC3C,CAAC,CAAE,MAA6B,CAAC,IAAI;QACrC,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE;QACb,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAOD,MAAM,UAAU,sBAAsB,CACpC,GAAe,EACf,QAA4B,EAC5B,GAAuC,EACvC,OAAO,GAAuB,EAAE;IAEhC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE;QAC3C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK;KACN,CAAC,CAAC;IAEH,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE/B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,QAAQ,CACtB,GAAe,EACf,GAAuC;IAEvC,OAAO,IAAI,eAAe,CAAC;QACzB,IAAI,EAAE,iBAAiB,CAAC,GAAG,CAAC;QAC5B,oEAAoE;QACpE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;KACrC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,GAAe,EAAE,IAAY;IACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAE1B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IAErC,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAEhE,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3E,OAAO;IACT,CAAC;IAED,GAAG,CAAC,IAAI,CACN,WAAW,IAAI,sDAAsD;QACnE,gEAAgE,CACnE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAsB,EACtB,IAAY;IAEZ,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEjC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,iBAAiB,CACrB,oBAAoB,IAAI,GAAG,EAC3B,4BAA4B,IAAI,IAAI,CACrC,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAoB,EACpB,OAAsB;IAEtB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAEpE,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;IAErE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,iBAAiB,CACrB,mBAAmB,GAAG,CAAC,IAAI,wBAAwB,EACnD,6BAA6B,GAAG,CAAC,IAAI,+BAA+B,GAAG,CAAC,IAAI,IAAI,CACjF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAoB,EACpB,OAAsB;IAEtB,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,EAAE;QACzC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,kCACnB,OAAO,KACV,iBAAiB,EAAE,OAAO,EAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IACnC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAC1C,GAAG,CAAC,IAAI,EACR,OAAO,CAAC,iBAAiB,EACzB,EAAE,cAAc,EAAE,cAAc,EAAE,CACnC,CAAC;IAEF,MAAM,IAAI,GAAkB;QAC1B,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEhC,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport type { CliContext } from '../context';\nimport { authRequiredError, usageError } from '../errors';\nimport {\n  CredentialStore,\n  type StoredSession,\n  normalizeHost,\n  resolveEkanosHome,\n} from './credential-store';\nimport {\n  type EkanosIdentity,\n  fetchIdentity,\n  refreshEkanosSession,\n} from './ekanos-api';\n\n/**\n * Session plumbing shared by `login`, `logout` and `whoami`: where the Ekanos\n * host comes from, where credentials live, and how a stale access token is\n * silently replaced.\n */\n\nexport interface AuthEnvironment {\n  store: CredentialStore;\n  host: string;\n}\n\n/**\n * Resolve the Ekanos host, in this order:\n *\n *   1. the `--host` flag\n *   2. the `EKANOS_HOST` environment variable\n *   3. the `host` field of the project's `ekanos.json` (written by the first\n *      successful `ekanos publish`, or by hand)\n *   4. the credential store, when it holds EXACTLY one host — a partner logged\n *      in to a single deployment should not have to repeat its URL on every\n *      verb, and one stored host is unambiguous\n *\n * Deliberately no default beyond those. A baked-in default would be wrong for\n * every partner running against their own sandbox, and — worse — a CLI that\n * silently picks a host is a CLI that can send a developer's credentials\n * somewhere they did not intend. Two or more stored hosts is exactly that\n * ambiguity, so it stays a usage error that LISTS them rather than a guess.\n */\nexport function resolveHost(\n  ctx: CliContext,\n  flag: string | undefined,\n  env: Record<string, string | undefined>,\n  options: {\n    /** Directory whose ekanos.json may carry a `host` field. */\n    projectDir?: string;\n    /** The credential store, for the sole-stored-host fallback. */\n    store?: CredentialStore;\n  } = {},\n): string {\n  const raw = flag ?? env.EKANOS_HOST;\n\n  if (raw && raw.trim().length > 0) {\n    return normalizeHost(raw.trim());\n  }\n\n  if (options.projectDir) {\n    const declared = readProjectHost(options.projectDir);\n\n    if (declared) {\n      // normalizeHost throws a precondition error for a malformed value —\n      // an EXPLICIT host in ekanos.json that is wrong deserves an error\n      // naming it, never a silent fall-through to a different host.\n      const host = normalizeHost(declared);\n\n      // Announce the choice, like the sole-stored-host branch below. This\n      // source deserves it MOST: ekanos.json is a committed file, so its\n      // host can change under a developer via an ordinary merge or an\n      // agent-applied patch — and this is where login sends the OAuth flow\n      // and publish sends the bearer token and archive.\n      ctx.log(\n        `ekanos: using ${host} — the host saved in ekanos.json. ` +\n          `Pass --host to override for one command.`,\n      );\n\n      return host;\n    }\n  }\n\n  const stored = options.store?.hosts() ?? [];\n\n  if (stored.length === 1) {\n    const host = stored[0]!;\n\n    ctx.log(\n      `ekanos: using ${host} — the only host you are logged in to. ` +\n        `Pass --host to target a different one.`,\n    );\n\n    return host;\n  }\n\n  throw usageError(\n    'No Ekanos host given.',\n    stored.length > 1\n      ? `You are logged in to ${stored.length} hosts (${stored.join(', ')}) — ` +\n          `pass \"--host <url>\" to choose one, or set EKANOS_HOST.`\n      : 'Pass \"--host https://<your-ekanos-host>\" or set EKANOS_HOST. ' +\n          '\"ekanos login --host <url>\" stores the host, so later commands ' +\n          'can omit it.',\n  );\n}\n\n/**\n * Best-effort read of the `host` field from a directory's ekanos.json.\n *\n * Lenient on purpose: host resolution runs for verbs like `login` that are\n * routinely run OUTSIDE a project, so a missing, unparseable, or host-less\n * ekanos.json is simply \"no answer here\", never an error — the verbs that\n * require a valid project (`publish`, `validate`) load it strictly themselves.\n */\nfunction readProjectHost(projectDir: string): string | null {\n  const configPath = path.join(projectDir, 'ekanos.json');\n\n  let raw: string;\n  try {\n    raw = fs.readFileSync(configPath, 'utf8');\n  } catch {\n    return null;\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    return null;\n  }\n\n  const host =\n    typeof parsed === 'object' && parsed !== null\n      ? (parsed as { host?: unknown }).host\n      : undefined;\n\n  return typeof host === 'string' && host.trim().length > 0\n    ? host.trim()\n    : null;\n}\n\nexport interface ResolveAuthOptions {\n  /** Directory whose ekanos.json may carry a `host` field. */\n  projectDir?: string;\n}\n\nexport function resolveAuthEnvironment(\n  ctx: CliContext,\n  hostFlag: string | undefined,\n  env: Record<string, string | undefined>,\n  options: ResolveAuthOptions = {},\n): AuthEnvironment {\n  const store = newStore(ctx, env);\n  const host = resolveHost(ctx, hostFlag, env, {\n    projectDir: options.projectDir,\n    store,\n  });\n\n  warnOnPlaintextHost(ctx, host);\n\n  return { host, store };\n}\n\n/** A store with no host attached — for `logout --all`. */\nexport function newStore(\n  ctx: CliContext,\n  env: Record<string, string | undefined>,\n): CredentialStore {\n  return new CredentialStore({\n    home: resolveEkanosHome(env),\n    // Permission warnings are diagnostics, not results: stderr, always.\n    warn: (message) => ctx.warn(message),\n  });\n}\n\n/**\n * `http://` is allowed because local development needs it, but sending a\n * bearer token to a plaintext REMOTE host puts it on the wire in the clear.\n * Warn rather than refuse: refusing would break `--host http://localhost:3000`\n * for anyone whose loopback resolves to something other than the names below.\n */\nfunction warnOnPlaintextHost(ctx: CliContext, host: string): void {\n  const url = new URL(host);\n\n  if (url.protocol !== 'http:') return;\n\n  const loopback = ['localhost', '127.0.0.1', '[::1]', '0.0.0.0'];\n\n  if (loopback.includes(url.hostname) || url.hostname.endsWith('.localhost')) {\n    return;\n  }\n\n  ctx.warn(\n    `ekanos: ${host} is plaintext HTTP. Your credentials will cross the ` +\n      `network unencrypted. Use https:// unless this is a local host.`,\n  );\n}\n\nexport function requireSession(\n  store: CredentialStore,\n  host: string,\n): StoredSession {\n  const session = store.read(host);\n\n  if (!session) {\n    throw authRequiredError(\n      `Not logged in to ${host}.`,\n      `Run \"ekanos login --host ${host}\".`,\n    );\n  }\n\n  return session;\n}\n\n/**\n * Resolve the caller's identity, refreshing the access token once if the\n * stored one no longer authenticates.\n *\n * Validity is decided by the SERVER, not by comparing `expiresAt` to the local\n * clock. A container with a skewed clock — the exact environment this flow\n * exists to support — would otherwise either refuse a perfectly good token or\n * keep presenting a dead one. A 401 is the authoritative answer; one refresh\n * and one retry is the whole recovery.\n */\nexport async function resolveIdentity(\n  env: AuthEnvironment,\n  session: StoredSession,\n): Promise<{ identity: EkanosIdentity; session: StoredSession }> {\n  const identity = await fetchIdentity(env.host, session.accessToken);\n\n  if (identity) {\n    return { identity, session };\n  }\n\n  const refreshed = await refreshStoredSession(env, session);\n  const retried = await fetchIdentity(env.host, refreshed.accessToken);\n\n  if (!retried) {\n    throw authRequiredError(\n      `The session for ${env.host} could not be renewed.`,\n      `Run \"ekanos logout --host ${env.host}\" then \"ekanos login --host ${env.host}\".`,\n    );\n  }\n\n  return { identity: retried, session: refreshed };\n}\n\n/**\n * Refresh and persist.\n *\n * The rotated refresh token is written the MOMENT the server reports it, not\n * when the refresh finishes. Auth0 rotates as soon as the server's exchange\n * succeeds, so from that instant the presented token is dead and the\n * replacement is the only copy in existence — and `cli-refresh` can still fail\n * afterwards (a `/userinfo` blip, a missing account, an unexpected throw) and\n * return that replacement on an ERROR response. Saving only on success would\n * discard it and lock the partner out for good over a transient upstream\n * hiccup: one process, no concurrency needed.\n *\n * So `onRotatedToken` writes it immediately and `refreshEkanosSession` invokes\n * that before it throws. The write keeps the OLD access token, which is\n * correct: that token is merely expired, while the refresh token is current\n * and is what the next attempt needs.\n */\nexport async function refreshStoredSession(\n  env: AuthEnvironment,\n  session: StoredSession,\n): Promise<StoredSession> {\n  const persistRotated = (rotated: string) => {\n    env.store.write(env.host, {\n      ...session,\n      auth0RefreshToken: rotated,\n      updatedAt: new Date().toISOString(),\n    });\n  };\n\n  const refreshed = await refreshEkanosSession(\n    env.host,\n    session.auth0RefreshToken,\n    { onRotatedToken: persistRotated },\n  );\n\n  const next: StoredSession = {\n    auth0RefreshToken: refreshed.auth0RefreshToken,\n    accessToken: refreshed.accessToken,\n    expiresAt: refreshed.expiresAt,\n    userId: refreshed.userId,\n    email: refreshed.email,\n    updatedAt: new Date().toISOString(),\n  };\n\n  env.store.write(env.host, next);\n\n  return next;\n}\n"]}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClC,OAAO,EACL,eAAe,EAEf,aAAa,EACb,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,aAAa,EACb,oBAAoB,GACrB,MAAM,cAAc,CAAC;AAatB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,WAAW,CACzB,GAAe,EACf,IAAwB,EACxB,GAAuC,EACvC,OAAO,GAKH,EAAE;;;IAEN,MAAM,GAAG,GAAG,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,GAAG,CAAC,WAAW,CAAC;IAEpC,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAErD,IAAI,QAAQ,EAAE,CAAC;YACb,oEAAoE;YACpE,kEAAkE;YAClE,8DAA8D;YAC9D,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YAErC,oEAAoE;YACpE,mEAAmE;YACnE,gEAAgE;YAChE,qEAAqE;YACrE,kDAAkD;YAClD,GAAG,CAAC,GAAG,CACL,GAAG,CAAC,QAAQ;gBACV,CAAC,CAAC,iBAAiB,IAAI,oCAAoC;oBACvD,0CAA0C;gBAC9C,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,SAAS,SAAS,CAAC,IAAI,CAAC,qBAAqB;oBAC3C,0CAA0C,CAC7C,CACN,CAAC;YAEF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,MAAM,SAAG,MAAA,OAAO,CAAC,KAAK,0CAAE,KAAK,EAAE,mCAAI,EAAE,CAAC;IAE5C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QAExB,qEAAqE;QACrE,mEAAmE;QACnE,qEAAqE;QACrE,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjB,GAAG,CAAC,GAAG,CACL,iBAAiB,IAAI,yCAAyC;gBAC5D,wCAAwC,CAC3C,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,CACd,uBAAuB,EACvB,MAAM,CAAC,MAAM,GAAG,CAAC;QACf,CAAC,CAAC,wBAAwB,MAAM,CAAC,MAAM,WAAW,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;YACrE,wDAAwD;QAC5D,CAAC,CAAC,+DAA+D;YAC7D,iEAAiE;YACjE,cAAc,CACrB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAExD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;eAAO,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;eAAO,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GACR,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAC3C,CAAC,CAAE,MAA6B,CAAC,IAAI;QACrC,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE;QACb,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAOD,MAAM,UAAU,sBAAsB,CACpC,GAAe,EACf,QAA4B,EAC5B,GAAuC,EACvC,OAAO,GAAuB,EAAE;IAEhC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE;QAC3C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK;KACN,CAAC,CAAC;IAEH,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE/B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,QAAQ,CACtB,GAAe,EACf,GAAuC;IAEvC,OAAO,IAAI,eAAe,CAAC;QACzB,IAAI,EAAE,iBAAiB,CAAC,GAAG,CAAC;QAC5B,oEAAoE;QACpE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;KACrC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,GAAe,EAAE,IAAY;IACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAE1B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IAErC,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAEhE,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3E,OAAO;IACT,CAAC;IAED,GAAG,CAAC,IAAI,CACN,WAAW,IAAI,sDAAsD;QACnE,gEAAgE,CACnE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAsB,EACtB,IAAY;IAEZ,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEjC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,iBAAiB,CACrB,oBAAoB,IAAI,GAAG,EAC3B,4BAA4B,IAAI,IAAI,CACrC,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAoB,EACpB,OAAsB;IAEtB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAEpE,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;IAErE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,iBAAiB,CACrB,mBAAmB,GAAG,CAAC,IAAI,wBAAwB,EACnD,6BAA6B,GAAG,CAAC,IAAI,+BAA+B,GAAG,CAAC,IAAI,IAAI,CACjF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAoB,EACpB,OAAsB;IAEtB,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,EAAE;QACzC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,kCACnB,OAAO,KACV,iBAAiB,EAAE,OAAO,EAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IACnC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAC1C,GAAG,CAAC,IAAI,EACR,OAAO,CAAC,iBAAiB,EACzB,EAAE,cAAc,EAAE,cAAc,EAAE,CACnC,CAAC;IAEF,MAAM,IAAI,GAAkB;QAC1B,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEhC,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport type { CliContext } from '../context';\nimport { authRequiredError, usageError } from '../errors';\nimport { shortHost } from '../ui';\nimport {\n  CredentialStore,\n  type StoredSession,\n  normalizeHost,\n  resolveEkanosHome,\n} from './credential-store';\nimport {\n  type EkanosIdentity,\n  fetchIdentity,\n  refreshEkanosSession,\n} from './ekanos-api';\n\n/**\n * Session plumbing shared by `login`, `logout` and `whoami`: where the Ekanos\n * host comes from, where credentials live, and how a stale access token is\n * silently replaced.\n */\n\nexport interface AuthEnvironment {\n  store: CredentialStore;\n  host: string;\n}\n\n/**\n * Resolve the Ekanos host, in this order:\n *\n *   1. the `--host` flag\n *   2. the `EKANOS_HOST` environment variable\n *   3. the `host` field of the project's `ekanos.json` (written by the first\n *      successful `ekanos publish`, or by hand)\n *   4. the credential store, when it holds EXACTLY one host — a partner logged\n *      in to a single deployment should not have to repeat its URL on every\n *      verb, and one stored host is unambiguous\n *\n * Deliberately no default beyond those. A baked-in default would be wrong for\n * every partner running against their own sandbox, and — worse — a CLI that\n * silently picks a host is a CLI that can send a developer's credentials\n * somewhere they did not intend. Two or more stored hosts is exactly that\n * ambiguity, so it stays a usage error that LISTS them rather than a guess.\n */\nexport function resolveHost(\n  ctx: CliContext,\n  flag: string | undefined,\n  env: Record<string, string | undefined>,\n  options: {\n    /** Directory whose ekanos.json may carry a `host` field. */\n    projectDir?: string;\n    /** The credential store, for the sole-stored-host fallback. */\n    store?: CredentialStore;\n  } = {},\n): string {\n  const raw = flag ?? env.EKANOS_HOST;\n\n  if (raw && raw.trim().length > 0) {\n    return normalizeHost(raw.trim());\n  }\n\n  if (options.projectDir) {\n    const declared = readProjectHost(options.projectDir);\n\n    if (declared) {\n      // normalizeHost throws a precondition error for a malformed value —\n      // an EXPLICIT host in ekanos.json that is wrong deserves an error\n      // naming it, never a silent fall-through to a different host.\n      const host = normalizeHost(declared);\n\n      // Announce the choice, like the sole-stored-host branch below. This\n      // source deserves it MOST: ekanos.json is a committed file, so its\n      // host can change under a developer via an ordinary merge or an\n      // agent-applied patch — and this is where login sends the OAuth flow\n      // and publish sends the bearer token and archive.\n      ctx.log(\n        ctx.jsonMode\n          ? `ekanos: using ${host} — the host saved in ekanos.json. ` +\n              `Pass --host to override for one command.`\n          : ctx.ui.dim(\n              `Using ${shortHost(host)} from ekanos.json. ` +\n                `Pass --host to override for one command.`,\n            ),\n      );\n\n      return host;\n    }\n  }\n\n  const stored = options.store?.hosts() ?? [];\n\n  if (stored.length === 1) {\n    const host = stored[0]!;\n\n    // A person at a terminal sees this host in the result block of every\n    // verb, and it is the only one they are signed in to, so naming it\n    // again is noise. JSON callers get no result block, so they keep it.\n    if (ctx.jsonMode) {\n      ctx.log(\n        `ekanos: using ${host} — the only host you are logged in to. ` +\n          `Pass --host to target a different one.`,\n      );\n    }\n\n    return host;\n  }\n\n  throw usageError(\n    'No Ekanos host given.',\n    stored.length > 1\n      ? `You are logged in to ${stored.length} hosts (${stored.join(', ')}) — ` +\n          `pass \"--host <url>\" to choose one, or set EKANOS_HOST.`\n      : 'Pass \"--host https://<your-ekanos-host>\" or set EKANOS_HOST. ' +\n          '\"ekanos login --host <url>\" stores the host, so later commands ' +\n          'can omit it.',\n  );\n}\n\n/**\n * Best-effort read of the `host` field from a directory's ekanos.json.\n *\n * Lenient on purpose: host resolution runs for verbs like `login` that are\n * routinely run OUTSIDE a project, so a missing, unparseable, or host-less\n * ekanos.json is simply \"no answer here\", never an error — the verbs that\n * require a valid project (`publish`, `validate`) load it strictly themselves.\n */\nfunction readProjectHost(projectDir: string): string | null {\n  const configPath = path.join(projectDir, 'ekanos.json');\n\n  let raw: string;\n  try {\n    raw = fs.readFileSync(configPath, 'utf8');\n  } catch {\n    return null;\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    return null;\n  }\n\n  const host =\n    typeof parsed === 'object' && parsed !== null\n      ? (parsed as { host?: unknown }).host\n      : undefined;\n\n  return typeof host === 'string' && host.trim().length > 0\n    ? host.trim()\n    : null;\n}\n\nexport interface ResolveAuthOptions {\n  /** Directory whose ekanos.json may carry a `host` field. */\n  projectDir?: string;\n}\n\nexport function resolveAuthEnvironment(\n  ctx: CliContext,\n  hostFlag: string | undefined,\n  env: Record<string, string | undefined>,\n  options: ResolveAuthOptions = {},\n): AuthEnvironment {\n  const store = newStore(ctx, env);\n  const host = resolveHost(ctx, hostFlag, env, {\n    projectDir: options.projectDir,\n    store,\n  });\n\n  warnOnPlaintextHost(ctx, host);\n\n  return { host, store };\n}\n\n/** A store with no host attached — for `logout --all`. */\nexport function newStore(\n  ctx: CliContext,\n  env: Record<string, string | undefined>,\n): CredentialStore {\n  return new CredentialStore({\n    home: resolveEkanosHome(env),\n    // Permission warnings are diagnostics, not results: stderr, always.\n    warn: (message) => ctx.warn(message),\n  });\n}\n\n/**\n * `http://` is allowed because local development needs it, but sending a\n * bearer token to a plaintext REMOTE host puts it on the wire in the clear.\n * Warn rather than refuse: refusing would break `--host http://localhost:3000`\n * for anyone whose loopback resolves to something other than the names below.\n */\nfunction warnOnPlaintextHost(ctx: CliContext, host: string): void {\n  const url = new URL(host);\n\n  if (url.protocol !== 'http:') return;\n\n  const loopback = ['localhost', '127.0.0.1', '[::1]', '0.0.0.0'];\n\n  if (loopback.includes(url.hostname) || url.hostname.endsWith('.localhost')) {\n    return;\n  }\n\n  ctx.warn(\n    `ekanos: ${host} is plaintext HTTP. Your credentials will cross the ` +\n      `network unencrypted. Use https:// unless this is a local host.`,\n  );\n}\n\nexport function requireSession(\n  store: CredentialStore,\n  host: string,\n): StoredSession {\n  const session = store.read(host);\n\n  if (!session) {\n    throw authRequiredError(\n      `Not logged in to ${host}.`,\n      `Run \"ekanos login --host ${host}\".`,\n    );\n  }\n\n  return session;\n}\n\n/**\n * Resolve the caller's identity, refreshing the access token once if the\n * stored one no longer authenticates.\n *\n * Validity is decided by the SERVER, not by comparing `expiresAt` to the local\n * clock. A container with a skewed clock — the exact environment this flow\n * exists to support — would otherwise either refuse a perfectly good token or\n * keep presenting a dead one. A 401 is the authoritative answer; one refresh\n * and one retry is the whole recovery.\n */\nexport async function resolveIdentity(\n  env: AuthEnvironment,\n  session: StoredSession,\n): Promise<{ identity: EkanosIdentity; session: StoredSession }> {\n  const identity = await fetchIdentity(env.host, session.accessToken);\n\n  if (identity) {\n    return { identity, session };\n  }\n\n  const refreshed = await refreshStoredSession(env, session);\n  const retried = await fetchIdentity(env.host, refreshed.accessToken);\n\n  if (!retried) {\n    throw authRequiredError(\n      `The session for ${env.host} could not be renewed.`,\n      `Run \"ekanos logout --host ${env.host}\" then \"ekanos login --host ${env.host}\".`,\n    );\n  }\n\n  return { identity: retried, session: refreshed };\n}\n\n/**\n * Refresh and persist.\n *\n * The rotated refresh token is written the MOMENT the server reports it, not\n * when the refresh finishes. Auth0 rotates as soon as the server's exchange\n * succeeds, so from that instant the presented token is dead and the\n * replacement is the only copy in existence — and `cli-refresh` can still fail\n * afterwards (a `/userinfo` blip, a missing account, an unexpected throw) and\n * return that replacement on an ERROR response. Saving only on success would\n * discard it and lock the partner out for good over a transient upstream\n * hiccup: one process, no concurrency needed.\n *\n * So `onRotatedToken` writes it immediately and `refreshEkanosSession` invokes\n * that before it throws. The write keeps the OLD access token, which is\n * correct: that token is merely expired, while the refresh token is current\n * and is what the next attempt needs.\n */\nexport async function refreshStoredSession(\n  env: AuthEnvironment,\n  session: StoredSession,\n): Promise<StoredSession> {\n  const persistRotated = (rotated: string) => {\n    env.store.write(env.host, {\n      ...session,\n      auth0RefreshToken: rotated,\n      updatedAt: new Date().toISOString(),\n    });\n  };\n\n  const refreshed = await refreshEkanosSession(\n    env.host,\n    session.auth0RefreshToken,\n    { onRotatedToken: persistRotated },\n  );\n\n  const next: StoredSession = {\n    auth0RefreshToken: refreshed.auth0RefreshToken,\n    accessToken: refreshed.accessToken,\n    expiresAt: refreshed.expiresAt,\n    userId: refreshed.userId,\n    email: refreshed.email,\n    updatedAt: new Date().toISOString(),\n  };\n\n  env.store.write(env.host, next);\n\n  return next;\n}\n"]}

package/dist/banner.d.ts

@@ -22,4 +22,4 @@ export declare function paintBanner(lines: readonly string[], color: boolean): s
  *
  * Call sites stay a single line: all gating lives here, not at the call site.
  */
-export declare function printBanner(ctx: CliContext, kind: 'full' | 'mini'): void;
+export declare function printBanner(ctx: CliContext): void;

package/dist/banner.js

@@ -5,7 +5,7 @@ const GRADIENT_STOPS = [
     [0x9f, 0x70, 0x77],
     [0xed, 0x1c, 0x24],
 ];
-/** Option C ("colossal") — the full banner, shown on first init/login. */
+/** Option C ("colossal") — the banner, shown on every init and login. */
 const FULL_ART = [
     ' .d88b.  888  888  8888b.  88888b.   .d88b.  .d8888b  ',
     'd8P  Y8b 888 .88P     "88b 888 "88b d88""88b 88K      ',
@@ -13,12 +13,6 @@ const FULL_ART = [
     'Y8b.     888 "88b 888  888 888  888 Y88..88P      X88 ',
     ' "Y8888  888  888 "Y888888 888  888  "Y88P"   88888P\' ',
 ];
-/** Option D ("pagga") — the mini-mark, shown on a repeat login. */
-const MINI_ART = [
-    '░█▀▀░█░█░█▀█░█▀█░█▀█░█▀▀',
-    '░█▀▀░█▀▄░█▀█░█░█░█░█░▀▀█',
-    '░▀▀▀░▀░▀░▀░▀░▀░▀░▀▀▀░▀▀▀',
-];
 const TAGLINE = 'The SDK with a skill-full DX';
 function lerp(a, b, t) {
     return Math.round(a + (b - a) * t);
@@ -77,7 +71,7 @@ function dim(text, color) {
  *
  * Call sites stay a single line: all gating lives here, not at the call site.
  */
-export function printBanner(ctx, kind) {
+export function printBanner(ctx) {
     if (ctx.jsonMode)
         return;
     if (!ctx.stderrIsTTY)
@@ -85,10 +79,7 @@ export function printBanner(ctx, kind) {
     if (ctx.env.EKANOS_NO_BANNER !== undefined)
         return;
     const color = colorsEnabled({ isTTY: ctx.stderrIsTTY, env: ctx.env });
-    const art = kind === 'full' ? FULL_ART : MINI_ART;
-    ctx.log(paintBanner(art, color));
-    if (kind === 'full') {
-        ctx.log(dim(TAGLINE, color));
-    }
+    ctx.log(paintBanner(FULL_ART, color));
+    ctx.log(dim(TAGLINE, color));
 }
 //# sourceMappingURL=banner.js.map

package/dist/banner.js.map

@@ -1 +1 @@
-{"version":3,"file":"banner.js","sourceRoot":"","sources":["../src/banner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAerC,uEAAuE;AACvE,MAAM,cAAc,GAA6B;IAC/C,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IAClB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IAClB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;CACnB,CAAC;AAEF,0EAA0E;AAC1E,MAAM,QAAQ,GAAsB;IAClC,wDAAwD;IACxD,wDAAwD;IACxD,wDAAwD;IACxD,wDAAwD;IACxD,yDAAyD;CAC1D,CAAC;AAEF,mEAAmE;AACnE,MAAM,QAAQ,GAAsB;IAClC,0BAA0B;IAC1B,0BAA0B;IAC1B,0BAA0B;CAC3B,CAAC;AAEF,MAAM,OAAO,GAAG,8BAA8B,CAAC;AAE/C,SAAS,IAAI,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS;IAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,2EAA2E;AAC3E,SAAS,OAAO,CAAC,CAAS;IACxB,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,cAAc,CAAC;IACzC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,GACtB,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5D,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAwB,EAAE,KAAc;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAE5D,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAElC,IAAI,CAAC,KAAK;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC;aACxB,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;YACb,IAAI,EAAE,KAAK,GAAG;gBAAE,OAAO,EAAE,CAAC;YAC1B,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;YAC5D,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,CAAC,CAAC;aACD,IAAI,CAAC,EAAE,CAAC,CAAC;QAEZ,OAAO,GAAG,OAAO,SAAS,CAAC;IAC7B,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,GAAG,CAAC,IAAY,EAAE,KAAc;IACvC,OAAO,KAAK,CAAC,CAAC,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,WAAW,CAAC,GAAe,EAAE,IAAqB;IAChE,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO;IACzB,IAAI,CAAC,GAAG,CAAC,WAAW;QAAE,OAAO;IAC7B,IAAI,GAAG,CAAC,GAAG,CAAC,gBAAgB,KAAK,SAAS;QAAE,OAAO;IAEnD,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IAElD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAEjC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC","sourcesContent":["import type { CliContext } from './context';\nimport { colorsEnabled } from './ui';\n\n/**\n * The gradient ASCII banner shown on a first-time `ekanos init` / `login`.\n *\n * Every gate here matters more than the art: this is decoration on stderr,\n * and it must never leak into an agent's view of the CLI. In particular it\n * must NEVER print in JSON mode (stdout carries exactly one JSON object for\n * the whole process, and this is stderr noise an agent has no reason to\n * parse) and it must never print when stderr is not a TTY (piped into a log\n * file, captured by a harness, redirected in CI).\n */\n\ntype RGB = readonly [number, number, number];\n\n/** The website's brand gradient: teal → mauve → red, left to right. */\nconst GRADIENT_STOPS: readonly [RGB, RGB, RGB] = [\n  [0x70, 0xa5, 0xab],\n  [0x9f, 0x70, 0x77],\n  [0xed, 0x1c, 0x24],\n];\n\n/** Option C (\"colossal\") — the full banner, shown on first init/login. */\nconst FULL_ART: readonly string[] = [\n  ' .d88b.  888  888  8888b.  88888b.   .d88b.  .d8888b  ',\n  'd8P  Y8b 888 .88P     \"88b 888 \"88b d88\"\"88b 88K      ',\n  '88888888 888888K  .d888888 888  888 888  888 \"Y8888b. ',\n  'Y8b.     888 \"88b 888  888 888  888 Y88..88P      X88 ',\n  ' \"Y8888  888  888 \"Y888888 888  888  \"Y88P\"   88888P\\' ',\n];\n\n/** Option D (\"pagga\") — the mini-mark, shown on a repeat login. */\nconst MINI_ART: readonly string[] = [\n  '░█▀▀░█░█░█▀█░█▀█░█▀█░█▀▀',\n  '░█▀▀░█▀▄░█▀█░█░█░█░█░▀▀█',\n  '░▀▀▀░▀░▀░▀░▀░▀░▀░▀▀▀░▀▀▀',\n];\n\nconst TAGLINE = 'The SDK with a skill-full DX';\n\nfunction lerp(a: number, b: number, t: number): number {\n  return Math.round(a + (b - a) * t);\n}\n\n/** The gradient color at position `t` (0..1) along the three-stop ramp. */\nfunction colorAt(t: number): RGB {\n  const [start, mid, end] = GRADIENT_STOPS;\n  const [from, to, localT]: [RGB, RGB, number] =\n    t < 0.5 ? [start, mid, t * 2] : [mid, end, (t - 0.5) * 2];\n\n  return [\n    lerp(from[0], to[0], localT),\n    lerp(from[1], to[1], localT),\n    lerp(from[2], to[2], localT),\n  ];\n}\n\n/**\n * Paint ASCII art lines with the gradient, one color per column, left to\n * right. `color: false` renders the raw art with zero escape codes — the\n * `NO_COLOR` and non-TTY paths. Pure and exported so the gradient math is\n * unit-testable independent of the printing gate in `printBanner`.\n */\nexport function paintBanner(lines: readonly string[], color: boolean): string {\n  const width = Math.max(...lines.map((line) => line.length));\n\n  return lines\n    .map((line) => {\n      const padded = line.padEnd(width);\n\n      if (!color) return padded;\n\n      const painted = [...padded]\n        .map((ch, x) => {\n          if (ch === ' ') return ch;\n          const [r, g, b] = colorAt(width <= 1 ? 0 : x / (width - 1));\n          return `\\x1b[38;2;${r};${g};${b}m${ch}`;\n        })\n        .join('');\n\n      return `${painted}\\x1b[0m`;\n    })\n    .join('\\n');\n}\n\nfunction dim(text: string, color: boolean): string {\n  return color ? `\\x1b[2m${text}\\x1b[0m` : text;\n}\n\n/**\n * Print the gradient banner to stderr, gated on ALL of:\n *\n *   - human mode (never in JSON mode — an agent must never see this)\n *   - stderr being a TTY (never when piped, redirected, or captured)\n *   - `EKANOS_NO_BANNER` unset (any value at all suppresses it entirely)\n *\n * `NO_COLOR` does not suppress the banner — it renders the same art with zero\n * escape codes, per the standard (https://no-color.org). The actual on/off\n * call is `ui.ts`'s `colorsEnabled` — the one gate every color decision in\n * this package flows through — so the banner also honours `TERM=dumb` and\n * `FORCE_COLOR` the same way the findings renderer and everything else does,\n * without duplicating the rule here.\n *\n * Call sites stay a single line: all gating lives here, not at the call site.\n */\nexport function printBanner(ctx: CliContext, kind: 'full' | 'mini'): void {\n  if (ctx.jsonMode) return;\n  if (!ctx.stderrIsTTY) return;\n  if (ctx.env.EKANOS_NO_BANNER !== undefined) return;\n\n  const color = colorsEnabled({ isTTY: ctx.stderrIsTTY, env: ctx.env });\n  const art = kind === 'full' ? FULL_ART : MINI_ART;\n\n  ctx.log(paintBanner(art, color));\n\n  if (kind === 'full') {\n    ctx.log(dim(TAGLINE, color));\n  }\n}\n"]}
+{"version":3,"file":"banner.js","sourceRoot":"","sources":["../src/banner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAerC,uEAAuE;AACvE,MAAM,cAAc,GAA6B;IAC/C,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IAClB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IAClB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;CACnB,CAAC;AAEF,yEAAyE;AACzE,MAAM,QAAQ,GAAsB;IAClC,wDAAwD;IACxD,wDAAwD;IACxD,wDAAwD;IACxD,wDAAwD;IACxD,yDAAyD;CAC1D,CAAC;AAEF,MAAM,OAAO,GAAG,8BAA8B,CAAC;AAE/C,SAAS,IAAI,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS;IAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,2EAA2E;AAC3E,SAAS,OAAO,CAAC,CAAS;IACxB,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,cAAc,CAAC;IACzC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,GACtB,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5D,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAwB,EAAE,KAAc;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAE5D,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAElC,IAAI,CAAC,KAAK;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC;aACxB,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;YACb,IAAI,EAAE,KAAK,GAAG;gBAAE,OAAO,EAAE,CAAC;YAC1B,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;YAC5D,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,CAAC,CAAC;aACD,IAAI,CAAC,EAAE,CAAC,CAAC;QAEZ,OAAO,GAAG,OAAO,SAAS,CAAC;IAC7B,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,GAAG,CAAC,IAAY,EAAE,KAAc;IACvC,OAAO,KAAK,CAAC,CAAC,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,WAAW,CAAC,GAAe;IACzC,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO;IACzB,IAAI,CAAC,GAAG,CAAC,WAAW;QAAE,OAAO;IAC7B,IAAI,GAAG,CAAC,GAAG,CAAC,gBAAgB,KAAK,SAAS;QAAE,OAAO;IAEnD,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACtE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACtC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAC/B,CAAC","sourcesContent":["import type { CliContext } from './context';\nimport { colorsEnabled } from './ui';\n\n/**\n * The gradient ASCII banner shown on `ekanos init` and `ekanos login`.\n *\n * Every gate here matters more than the art: this is decoration on stderr,\n * and it must never leak into an agent's view of the CLI. In particular it\n * must NEVER print in JSON mode (stdout carries exactly one JSON object for\n * the whole process, and this is stderr noise an agent has no reason to\n * parse) and it must never print when stderr is not a TTY (piped into a log\n * file, captured by a harness, redirected in CI).\n */\n\ntype RGB = readonly [number, number, number];\n\n/** The website's brand gradient: teal → mauve → red, left to right. */\nconst GRADIENT_STOPS: readonly [RGB, RGB, RGB] = [\n  [0x70, 0xa5, 0xab],\n  [0x9f, 0x70, 0x77],\n  [0xed, 0x1c, 0x24],\n];\n\n/** Option C (\"colossal\") — the banner, shown on every init and login. */\nconst FULL_ART: readonly string[] = [\n  ' .d88b.  888  888  8888b.  88888b.   .d88b.  .d8888b  ',\n  'd8P  Y8b 888 .88P     \"88b 888 \"88b d88\"\"88b 88K      ',\n  '88888888 888888K  .d888888 888  888 888  888 \"Y8888b. ',\n  'Y8b.     888 \"88b 888  888 888  888 Y88..88P      X88 ',\n  ' \"Y8888  888  888 \"Y888888 888  888  \"Y88P\"   88888P\\' ',\n];\n\nconst TAGLINE = 'The SDK with a skill-full DX';\n\nfunction lerp(a: number, b: number, t: number): number {\n  return Math.round(a + (b - a) * t);\n}\n\n/** The gradient color at position `t` (0..1) along the three-stop ramp. */\nfunction colorAt(t: number): RGB {\n  const [start, mid, end] = GRADIENT_STOPS;\n  const [from, to, localT]: [RGB, RGB, number] =\n    t < 0.5 ? [start, mid, t * 2] : [mid, end, (t - 0.5) * 2];\n\n  return [\n    lerp(from[0], to[0], localT),\n    lerp(from[1], to[1], localT),\n    lerp(from[2], to[2], localT),\n  ];\n}\n\n/**\n * Paint ASCII art lines with the gradient, one color per column, left to\n * right. `color: false` renders the raw art with zero escape codes — the\n * `NO_COLOR` and non-TTY paths. Pure and exported so the gradient math is\n * unit-testable independent of the printing gate in `printBanner`.\n */\nexport function paintBanner(lines: readonly string[], color: boolean): string {\n  const width = Math.max(...lines.map((line) => line.length));\n\n  return lines\n    .map((line) => {\n      const padded = line.padEnd(width);\n\n      if (!color) return padded;\n\n      const painted = [...padded]\n        .map((ch, x) => {\n          if (ch === ' ') return ch;\n          const [r, g, b] = colorAt(width <= 1 ? 0 : x / (width - 1));\n          return `\\x1b[38;2;${r};${g};${b}m${ch}`;\n        })\n        .join('');\n\n      return `${painted}\\x1b[0m`;\n    })\n    .join('\\n');\n}\n\nfunction dim(text: string, color: boolean): string {\n  return color ? `\\x1b[2m${text}\\x1b[0m` : text;\n}\n\n/**\n * Print the gradient banner to stderr, gated on ALL of:\n *\n *   - human mode (never in JSON mode — an agent must never see this)\n *   - stderr being a TTY (never when piped, redirected, or captured)\n *   - `EKANOS_NO_BANNER` unset (any value at all suppresses it entirely)\n *\n * `NO_COLOR` does not suppress the banner — it renders the same art with zero\n * escape codes, per the standard (https://no-color.org). The actual on/off\n * call is `ui.ts`'s `colorsEnabled` — the one gate every color decision in\n * this package flows through — so the banner also honours `TERM=dumb` and\n * `FORCE_COLOR` the same way the findings renderer and everything else does,\n * without duplicating the rule here.\n *\n * Call sites stay a single line: all gating lives here, not at the call site.\n */\nexport function printBanner(ctx: CliContext): void {\n  if (ctx.jsonMode) return;\n  if (!ctx.stderrIsTTY) return;\n  if (ctx.env.EKANOS_NO_BANNER !== undefined) return;\n\n  const color = colorsEnabled({ isTTY: ctx.stderrIsTTY, env: ctx.env });\n  ctx.log(paintBanner(FULL_ART, color));\n  ctx.log(dim(TAGLINE, color));\n}\n"]}

package/dist/commands/dev.js

@@ -5,6 +5,7 @@ import { preconditionError, usageError } from '../errors.js';
 import { HARNESS_DIR, HARNESS_PACKAGE, assertShellDirIsOurs, bootstrapHarnessConfig, ensureGitignoreEntry, missingDependencies, readInstalledHarness, scaffoldShell, } from '../harness-scaffold.js';
 import { detectPackageManager, execArgs, formatCommand, installCommand, } from '../package-manager.js';
 import { loadProject } from '../project.js';
+import { displayPath } from '../ui.js';
 import { announceUpdate, checkForUpdate } from '../update-notice.js';
 const DEFAULT_PORT = 3100;
 /**
@@ -133,9 +134,16 @@ export async function runDev(ctx, args) {
     // running it. `--start` overrides; `--no-start` opts out in a terminal.
     const shouldStart = (_c = args.start) !== null && _c !== void 0 ? _c : !ctx.jsonMode;
     if (!shouldStart) {
-        return ctx.succeed(Object.assign(Object.assign({}, scaffold), { server: { started: false, command, url, port, host, exposed } }), `dev: harness ready in ${shell.harnessDir}. Start it with: ${command}`);
+        return ctx.succeed(Object.assign(Object.assign({}, scaffold), { server: { started: false, command, url, port, host, exposed } }), ctx.ui.result({
+            title: 'Harness ready',
+            rows: [
+                ['Directory', displayPath(shell.harnessDir, process.cwd())],
+                ['URL', url],
+                ['Start', command],
+            ],
+        }));
     }
-    ctx.log(`Starting the harness on ${url} (${command})…`);
+    ctx.log(ctx.ui.dim(`Starting the harness on ${url} (${command})…`));
     const exitCode = await spawnServer({
         ctx,
         bin: pm.bin,
@@ -145,7 +153,7 @@ export async function runDev(ctx, args) {
     });
     const data = Object.assign(Object.assign({}, scaffold), { server: { started: true, command, url, port, host, exposed, exitCode } });
     if (exitCode === 0) {
-        return ctx.succeed(data, `dev: harness stopped cleanly.`);
+        return ctx.succeed(data, ctx.ui.result({ title: 'Harness stopped', rows: [['URL', url]] }));
     }
     return ctx.failWith({
         code: 'dev_server_failed',

package/dist/commands/dev.js.map

@@ -1 +1 @@
-{"version":3,"file":"dev.js","sourceRoot":"","sources":["../../src/commands/dev.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EACL,WAAW,EACX,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,QAAQ,EACR,aAAa,EACb,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AA0BlE,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B;;;;;;;;;;GAUG;AACH,MAAM,YAAY,GAAG,WAAW,CAAC;AAEjC,2DAA2D;AAC3D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;AAElE;;;;;;GAMG;AACH,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAE7C,qEAAqE;AACrE,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;AAEtE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,IAAa;;IACzD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEnD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,GAAG,QAAE,IAAI,CAAC,GAAG,mCAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACtE,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE5B,0EAA0E;IAC1E,kEAAkE;IAClE,kCAAkC;IAClC,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,iBAAiB,CACrB,GAAG,OAAO,CAAC,MAAM,WAAW,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO;YAChE,iBAAiB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,iBAAiB;YACrE,MAAM,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EACnD,QAAQ,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,MAAM,CAAC,UAAU,SAAS;YACnE,sBAAsB,CACzB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAC;IACxC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,iBAAiB,CACrB,GAAG,eAAe,wCAAwC,EAC1D,sBAAsB,cAAc,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,OAAO;YAChE,GAAG,MAAM,CAAC,UAAU,6BAA6B,CACpD,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,qEAAqE;IACrE,4EAA4E;IAC5E,2DAA2D;IAC3D,uBAAuB,CAAC;QACtB,cAAc;QACd,eAAe,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ;QAClC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;KAClD,CAAC,CAAC;IAEH,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAE5E,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,aAAa,CAAC;QAC1B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QACzB,cAAc;QACd,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;KACxC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEjE,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,GAAG,CACL,gBAAgB,WAAW,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAChE,4BAA4B,MAAM,CAAC,UAAU,gBAAgB,CAChE,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO;QAAE,GAAG,CAAC,GAAG,CAAC,aAAa,WAAW,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO;QAAE,GAAG,CAAC,GAAG,CAAC,aAAa,WAAW,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9E,IAAI,gBAAgB;QAAE,GAAG,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACjE,GAAG,CAAC,GAAG,CACL,4CAA4C,kBAAkB,YAAY;QACxE,sEAAsE,CACzE,CAAC;IAEF,0EAA0E;IAC1E,+CAA+C;IAC/C,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IACvE,MAAM,SAAS,GAA2B,OAAO;QAC/C,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE;QACxB,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,OAAO,GACX,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,WAAW,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,UAAU,WAAW,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;IAElD,MAAM,QAAQ,mBACZ,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EACzB,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EACpD,UAAU,EAAE,MAAM,CAAC,UAAU,EAC7B,UAAU,EAAE,KAAK,CAAC,UAAU,EAC5B,cAAc,EACd,eAAe,EAAE,KAAK,CAAC,eAAe,EACtC,cAAc,EAAE,KAAK,CAAC,cAAc,EACpC,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,YAAY,EAAE,KAAK,CAAC,YAAY,EAChC,WAAW,QAAE,MAAM,CAAC,OAAO,CAAC,WAAW,mCAAI,EAAE,EAC7C,OAAO,EAAE,KAAK,CAAC,OAAO,EACtB,OAAO,EAAE,KAAK,CAAC,OAAO,EACtB,SAAS,EAAE,KAAK,CAAC,SAAS,EAC1B,kBAAkB,EAAE,MAAM,CAAC,YAAY,EACvC,UAAU,EAAE,MAAM,CAAC,UAAU,EAC7B,gBAAgB,IACb,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACzC,CAAC;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,CAAC,IAAI,CACN,mBAAmB,IAAI,+CAA+C;YACpE,oEAAoE;YACpE,sEAAsE;YACtE,sBAAsB,kBAAkB,gCAAgC;YACxE,qEAAqE;YACrE,UAAU,WAAW,4CAA4C;YACjE,GAAG,GAAG,oDAAoD,YAAY,GAAG,CAC5E,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,oEAAoE;IACpE,sEAAsE;IACtE,wEAAwE;IACxE,MAAM,WAAW,SAAG,IAAI,CAAC,KAAK,mCAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,GAAG,CAAC,OAAO,iCAEX,QAAQ,KACX,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAE/D,yBAAyB,KAAK,CAAC,UAAU,oBAAoB,OAAO,EAAE,CACvE,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,2BAA2B,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC;QACjC,GAAG;QACH,GAAG,EAAE,EAAE,CAAC,GAAG;QACX,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC;QACtC,GAAG,EAAE,KAAK,CAAC,UAAU;QACrB,GAAG,EAAE,SAAS;KACf,CAAC,CAAC;IAEH,MAAM,IAAI,mCACL,QAAQ,KACX,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GACvE,CAAC;IAEF,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,CAAC;QAClB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,IAAI,OAAO,sBAAsB,QAAQ,GAAG;QACrD,IAAI,EACF,uEAAuE;YACvE,sCAAsC,MAAM,CAAC,UAAU,eAAe;YACtE,4BAA4B,KAAK,CAAC,UAAU,2BAA2B;QACzE,mDAAmD;QACnD,QAAQ;QACR,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAMpB;IACC,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;QAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE;YAC3C,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,kCAAO,OAAO,CAAC,GAAG,GAAK,MAAM,CAAC,GAAG,CAAE;YACtC,wEAAwE;YACxE,sEAAsE;YACtE,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC;SACnC,CAAC,CAAC;QAEH,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QACH,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAChE,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAE3C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,UAAU,CACd,oBAAoB,EACpB,iEAAiE;YAC/D,+CAA+C,YAAY,GAAG,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAE3C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACxD,MAAM,UAAU,CACd,mBAAmB,GAAG,IAAI,EAC1B,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { spawn } from 'node:child_process';\nimport * as path from 'node:path';\n\nimport { assertHarnessCompatible } from '../compatibility';\nimport type { CliContext } from '../context';\nimport { preconditionError, usageError } from '../errors';\nimport {\n  HARNESS_DIR,\n  HARNESS_PACKAGE,\n  assertShellDirIsOurs,\n  bootstrapHarnessConfig,\n  ensureGitignoreEntry,\n  missingDependencies,\n  readInstalledHarness,\n  scaffoldShell,\n} from '../harness-scaffold';\nimport {\n  detectPackageManager,\n  execArgs,\n  formatCommand,\n  installCommand,\n} from '../package-manager';\nimport { loadProject } from '../project';\nimport { announceUpdate, checkForUpdate } from '../update-notice';\n\nexport interface DevArgs {\n  /** Project directory (contains ekanos.json). Defaults to cwd. */\n  dir: string;\n  /** Port for the dev server. */\n  port?: string;\n  /**\n   * Interface to bind. Defaults to loopback — see `resolveHost`. Anything\n   * else is an explicit, warned-about decision to expose the harness.\n   *\n   * NOTE: unrelated to the Ekanos HOST the update notice checks against —\n   * this is the local bind address for `next dev`, never an Ekanos origin.\n   */\n  host?: string;\n  /** Rewrite every generated file even when its bytes already match. */\n  force: boolean;\n  /**\n   * Explicit `--start` / `--no-start`. Undefined means \"decide from the\n   * output mode\": a JSON caller is an agent or a pipe and must not be handed\n   * a process that never exits.\n   */\n  start?: boolean;\n  env?: Record<string, string | undefined>;\n}\n\nconst DEFAULT_PORT = 3100;\n\n/**\n * Loopback, NOT Next's default.\n *\n * `next dev` binds 0.0.0.0 unless told otherwise, so the harness would be\n * reachable by anyone on the same network — a coffee-shop Wi-Fi, a shared\n * office VLAN — while we printed \"http://localhost:3100\" and implied\n * otherwise. It renders a partner's integration with their fixtures and, in\n * live mode, whatever their vendor API returns; there is no auth in front of\n * any of it. Binding loopback by default costs a partner nothing and makes\n * exposure a thing they ask for.\n */\nconst DEFAULT_HOST = '127.0.0.1';\n\n/** Addresses that are only reachable from this machine. */\nconst LOOPBACK_HOSTS = new Set(['127.0.0.1', '::1', 'localhost']);\n\n/**\n * Set for the dev server when `--host` binds beyond loopback. The shell's\n * API routes (`@ekanos/harness/api`) refuse non-loopback `Host` headers\n * unless this is `1`: they hold the partner's local OAuth credentials and\n * run handlers on request, so exposing them has to be a decision — this one,\n * made after the warning below — rather than a side effect of the bind.\n */\nconst EXPOSED_ENV = 'EKANOS_HARNESS_EXPOSED';\n\n/** Where the harness generates, and reads, local dev credentials. */\nconst LOCAL_SECRETS_PATH = path.join('.ekanos', 'local-secrets.json');\n\n/**\n * `dev` — scaffold the local harness shell into the partner's project, then\n * run it with their own Next.\n *\n * The shape of this verb follows from one rule: we must be able to ship a\n * harness bugfix as an `@ekanos/harness` version bump that a partner picks up\n * with `pnpm up`, with zero edits to any file they own. So everything under\n * `.ekanos/` is generated, gitignored and rewritten freely, `harness.config.ts`\n * at the project root is written once and never touched again, and all actual\n * harness behaviour lives in the installed package.\n *\n * Two idempotency properties matter and are both tested: a second run produces\n * byte-identical files and rewrites nothing (so Next's watcher stays quiet),\n * and `.gitignore` never grows a duplicate line.\n */\nexport async function runDev(ctx: CliContext, args: DevArgs): Promise<number> {\n  const loaded = loadProject(args.dir);\n  const port = parsePort(args.port);\n  const host = parseHost(args.host);\n  const exposed = !LOOPBACK_HOSTS.has(host);\n  const pm = detectPackageManager(loaded.projectDir);\n\n  const notice = await checkForUpdate({ env: args.env ?? process.env });\n  announceUpdate(ctx, notice);\n\n  // Fail before writing anything: the shell declares no dependencies of its\n  // own, so a missing one would otherwise surface as an opaque Next\n  // resolution error minutes later.\n  const missing = missingDependencies(loaded.projectDir);\n  if (missing.length > 0) {\n    throw preconditionError(\n      `${missing.length} package${missing.length === 1 ? '' : 's'} the ` +\n        `harness needs ${missing.length === 1 ? 'is' : 'are'} not installed ` +\n        `in ${loaded.projectDir}: ${missing.join(', ')}.`,\n      `Run \"${installCommand(pm, missing)}\" in ${loaded.projectDir}, then ` +\n        're-run \"ekanos dev\".',\n    );\n  }\n\n  const harness = readInstalledHarness(loaded.projectDir);\n  const harnessVersion = harness?.version;\n  if (!harnessVersion) {\n    throw preconditionError(\n      `${HARNESS_PACKAGE} is installed but declares no version.`,\n      `Reinstall it with \"${installCommand(pm, [HARNESS_PACKAGE])}\" in ` +\n        `${loaded.projectDir}, then re-run \"ekanos dev\".`,\n    );\n  }\n\n  // The templates ship with the CLI and the code they import ships with the\n  // harness, so a partner can upgrade one without the other. Name that\n  // mismatch here rather than letting it surface later as a module-resolution\n  // error inside a shell we cheerfully certified as current.\n  assertHarnessCompatible({\n    harnessVersion,\n    harnessManifest: harness?.manifest,\n    installHint: (spec) => installCommand(pm, [spec]),\n  });\n\n  // Validate the shell target BEFORE writing anything at all. Bootstrapping\n  // harness.config.ts first and only then discovering that .ekanos/harness is\n  // a file or someone else's tree would leave the project half-scaffolded.\n  assertShellDirIsOurs(path.join(loaded.projectDir, HARNESS_DIR), args.force);\n\n  const config = bootstrapHarnessConfig(loaded.projectDir, loaded.integrations);\n  const shell = scaffoldShell({\n    projectDir: loaded.projectDir,\n    slug: loaded.primary.slug,\n    harnessVersion,\n    force: args.force,\n    sourceGlobs: loaded.project.sourceGlobs,\n  });\n  const gitignoreUpdated = ensureGitignoreEntry(loaded.projectDir);\n\n  if (shell.stale) {\n    ctx.log(\n      `Regenerating ${HARNESS_DIR} — ${shell.staleReasons.join('; ')}. ` +\n        `Nothing you own changed; ${config.configPath} is untouched.`,\n    );\n  }\n\n  if (config.bootstrapped) {\n    ctx.log(`  created harness.config.ts (yours — edit it, we never will)`);\n  }\n  for (const file of shell.created) ctx.log(`  created ${HARNESS_DIR}/${file}`);\n  for (const file of shell.updated) ctx.log(`  updated ${HARNESS_DIR}/${file}`);\n  if (gitignoreUpdated) ctx.log('  updated .gitignore (.ekanos/)');\n  ctx.log(\n    `  live-mode OAuth: the harness generates ${LOCAL_SECRETS_PATH} on first ` +\n      'use — fill it in and follow \"Local OAuth\" on the Activation surface.',\n  );\n\n  // `--hostname` is passed ALWAYS, never left to Next's default, so the URL\n  // we print is the URL that is actually served.\n  const serverArgs = ['dev', '--port', String(port), '--hostname', host];\n  const serverEnv: Record<string, string> = exposed\n    ? { [EXPOSED_ENV]: '1' }\n    : {};\n  const command =\n    (exposed ? `${EXPOSED_ENV}=1 ` : '') +\n    formatCommand(pm.bin, execArgs(pm, 'next', serverArgs));\n  const url = `http://${displayHost(host)}:${port}`;\n\n  const scaffold = {\n    slug: loaded.primary.slug,\n    integrations: loaded.integrations.map((i) => i.slug),\n    projectDir: loaded.projectDir,\n    harnessDir: shell.harnessDir,\n    harnessVersion,\n    previousVersion: shell.previousVersion,\n    previousMarker: shell.previousMarker,\n    stale: shell.stale,\n    staleReasons: shell.staleReasons,\n    sourceGlobs: loaded.project.sourceGlobs ?? [],\n    created: shell.created,\n    updated: shell.updated,\n    unchanged: shell.unchanged,\n    configBootstrapped: config.bootstrapped,\n    configPath: config.configPath,\n    gitignoreUpdated,\n    ...(notice ? { toolchain: notice } : {}),\n  };\n\n  if (exposed) {\n    ctx.warn(\n      `WARNING: --host ${host} exposes the harness beyond this machine. It ` +\n        'has no authentication, and it renders your fixtures and — in live ' +\n        'mode — real responses from your vendor API. Its API routes hold the ' +\n        `client secret from ${LOCAL_SECRETS_PATH}, the tokens onTokens stored, ` +\n        'and run your handlers on request; they refuse non-loopback callers ' +\n        `unless ${EXPOSED_ENV}=1, which this sets. Anyone who can reach ` +\n        `${url} can read and run all of it. Omit --host to bind ${DEFAULT_HOST}.`,\n    );\n  }\n\n  // A JSON caller is an agent or a pipe. Handing it a dev server that never\n  // exits would hang its tool call forever and it would never see the\n  // envelope, so JSON mode scaffolds and reports the command instead of\n  // running it. `--start` overrides; `--no-start` opts out in a terminal.\n  const shouldStart = args.start ?? !ctx.jsonMode;\n  if (!shouldStart) {\n    return ctx.succeed(\n      {\n        ...scaffold,\n        server: { started: false, command, url, port, host, exposed },\n      },\n      `dev: harness ready in ${shell.harnessDir}. Start it with: ${command}`,\n    );\n  }\n\n  ctx.log(`Starting the harness on ${url} (${command})…`);\n  const exitCode = await spawnServer({\n    ctx,\n    bin: pm.bin,\n    argv: execArgs(pm, 'next', serverArgs),\n    cwd: shell.harnessDir,\n    env: serverEnv,\n  });\n\n  const data = {\n    ...scaffold,\n    server: { started: true, command, url, port, host, exposed, exitCode },\n  };\n\n  if (exitCode === 0) {\n    return ctx.succeed(data, `dev: harness stopped cleanly.`);\n  }\n\n  return ctx.failWith({\n    code: 'dev_server_failed',\n    message: `\"${command}\" exited with code ${exitCode}.`,\n    hint:\n      'Read the Next output on stderr. If it cannot resolve @ekanos/harness ' +\n      `or next, reinstall dependencies in ${loaded.projectDir}; if a route ` +\n      `fails to compile, delete ${shell.harnessDir} and re-run \"ekanos dev\".`,\n    // Transparent passthrough of Next's own exit code.\n    exitCode,\n    data,\n  });\n}\n\nfunction spawnServer(params: {\n  ctx: CliContext;\n  bin: string;\n  argv: string[];\n  cwd: string;\n  env: Record<string, string>;\n}): Promise<number> {\n  return new Promise<number>((resolve, reject) => {\n    const child = spawn(params.bin, params.argv, {\n      cwd: params.cwd,\n      env: { ...process.env, ...params.env },\n      // stdin inherited so Next's own key handling works; stdout/stderr piped\n      // so we can route them and keep OUR stdout reserved for the envelope.\n      stdio: ['inherit', 'pipe', 'pipe'],\n    });\n\n    child.stdout?.on('data', (chunk: Buffer) => {\n      (params.ctx.jsonMode ? process.stderr : process.stdout).write(chunk);\n    });\n    child.stderr?.on('data', (chunk: Buffer) => {\n      process.stderr.write(chunk);\n    });\n\n    child.on('error', (error) => reject(error));\n    child.on('close', (code) => resolve(code ?? 1));\n  });\n}\n\n/**\n * The hostname to show a human. `127.0.0.1` is spelled `localhost` because\n * that is what people type; a wildcard bind is spelled `localhost` too, but\n * only after `exposed` has already been warned about — printing `0.0.0.0` as\n * a URL is not useful.\n */\nfunction displayHost(host: string): string {\n  if (host === '127.0.0.1' || host === '0.0.0.0' || host === '::') {\n    return 'localhost';\n  }\n  if (host === '::1') return '[::1]';\n  return host;\n}\n\nfunction parseHost(raw: string | undefined): string {\n  if (raw === undefined) return DEFAULT_HOST;\n\n  const host = raw.trim();\n  if (host.length === 0) {\n    throw usageError(\n      'Invalid --host \"\".',\n      `Pass an interface to bind, e.g. \"--host 0.0.0.0\" to expose the ` +\n        `harness on your network, or omit it to bind ${DEFAULT_HOST}.`,\n    );\n  }\n  return host;\n}\n\nfunction parsePort(raw: string | undefined): number {\n  if (raw === undefined) return DEFAULT_PORT;\n\n  const port = Number(raw);\n  if (!Number.isInteger(port) || port < 1 || port > 65535) {\n    throw usageError(\n      `Invalid --port \"${raw}\".`,\n      'Pass an integer between 1 and 65535, e.g. \"--port 3100\".',\n    );\n  }\n  return port;\n}\n"]}
+{"version":3,"file":"dev.js","sourceRoot":"","sources":["../../src/commands/dev.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EACL,WAAW,EACX,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,QAAQ,EACR,aAAa,EACb,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AA0BlE,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B;;;;;;;;;;GAUG;AACH,MAAM,YAAY,GAAG,WAAW,CAAC;AAEjC,2DAA2D;AAC3D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;AAElE;;;;;;GAMG;AACH,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAE7C,qEAAqE;AACrE,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;AAEtE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,IAAa;;IACzD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEnD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,GAAG,QAAE,IAAI,CAAC,GAAG,mCAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACtE,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE5B,0EAA0E;IAC1E,kEAAkE;IAClE,kCAAkC;IAClC,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,iBAAiB,CACrB,GAAG,OAAO,CAAC,MAAM,WAAW,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO;YAChE,iBAAiB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,iBAAiB;YACrE,MAAM,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EACnD,QAAQ,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,MAAM,CAAC,UAAU,SAAS;YACnE,sBAAsB,CACzB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAC;IACxC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,iBAAiB,CACrB,GAAG,eAAe,wCAAwC,EAC1D,sBAAsB,cAAc,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,OAAO;YAChE,GAAG,MAAM,CAAC,UAAU,6BAA6B,CACpD,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,qEAAqE;IACrE,4EAA4E;IAC5E,2DAA2D;IAC3D,uBAAuB,CAAC;QACtB,cAAc;QACd,eAAe,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ;QAClC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;KAClD,CAAC,CAAC;IAEH,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAE5E,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,aAAa,CAAC;QAC1B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QACzB,cAAc;QACd,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;KACxC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEjE,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC,GAAG,CACL,gBAAgB,WAAW,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAChE,4BAA4B,MAAM,CAAC,UAAU,gBAAgB,CAChE,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO;QAAE,GAAG,CAAC,GAAG,CAAC,aAAa,WAAW,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO;QAAE,GAAG,CAAC,GAAG,CAAC,aAAa,WAAW,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9E,IAAI,gBAAgB;QAAE,GAAG,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACjE,GAAG,CAAC,GAAG,CACL,4CAA4C,kBAAkB,YAAY;QACxE,sEAAsE,CACzE,CAAC;IAEF,0EAA0E;IAC1E,+CAA+C;IAC/C,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IACvE,MAAM,SAAS,GAA2B,OAAO;QAC/C,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE;QACxB,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,OAAO,GACX,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,WAAW,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,UAAU,WAAW,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;IAElD,MAAM,QAAQ,mBACZ,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EACzB,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EACpD,UAAU,EAAE,MAAM,CAAC,UAAU,EAC7B,UAAU,EAAE,KAAK,CAAC,UAAU,EAC5B,cAAc,EACd,eAAe,EAAE,KAAK,CAAC,eAAe,EACtC,cAAc,EAAE,KAAK,CAAC,cAAc,EACpC,KAAK,EAAE,KAAK,CAAC,KAAK,EAClB,YAAY,EAAE,KAAK,CAAC,YAAY,EAChC,WAAW,QAAE,MAAM,CAAC,OAAO,CAAC,WAAW,mCAAI,EAAE,EAC7C,OAAO,EAAE,KAAK,CAAC,OAAO,EACtB,OAAO,EAAE,KAAK,CAAC,OAAO,EACtB,SAAS,EAAE,KAAK,CAAC,SAAS,EAC1B,kBAAkB,EAAE,MAAM,CAAC,YAAY,EACvC,UAAU,EAAE,MAAM,CAAC,UAAU,EAC7B,gBAAgB,IACb,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACzC,CAAC;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,CAAC,IAAI,CACN,mBAAmB,IAAI,+CAA+C;YACpE,oEAAoE;YACpE,sEAAsE;YACtE,sBAAsB,kBAAkB,gCAAgC;YACxE,qEAAqE;YACrE,UAAU,WAAW,4CAA4C;YACjE,GAAG,GAAG,oDAAoD,YAAY,GAAG,CAC5E,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,oEAAoE;IACpE,sEAAsE;IACtE,wEAAwE;IACxE,MAAM,WAAW,SAAG,IAAI,CAAC,KAAK,mCAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;IAChD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,GAAG,CAAC,OAAO,iCAEX,QAAQ,KACX,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAE/D,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;YACZ,KAAK,EAAE,eAAe;YACtB,IAAI,EAAE;gBACJ,CAAC,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC3D,CAAC,KAAK,EAAE,GAAG,CAAC;gBACZ,CAAC,OAAO,EAAE,OAAO,CAAC;aACnB;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,2BAA2B,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC;QACjC,GAAG;QACH,GAAG,EAAE,EAAE,CAAC,GAAG;QACX,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC;QACtC,GAAG,EAAE,KAAK,CAAC,UAAU;QACrB,GAAG,EAAE,SAAS;KACf,CAAC,CAAC;IAEH,MAAM,IAAI,mCACL,QAAQ,KACX,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GACvE,CAAC;IAEF,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC,OAAO,CAChB,IAAI,EACJ,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAClE,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,CAAC;QAClB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,IAAI,OAAO,sBAAsB,QAAQ,GAAG;QACrD,IAAI,EACF,uEAAuE;YACvE,sCAAsC,MAAM,CAAC,UAAU,eAAe;YACtE,4BAA4B,KAAK,CAAC,UAAU,2BAA2B;QACzE,mDAAmD;QACnD,QAAQ;QACR,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAMpB;IACC,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;QAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE;YAC3C,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,kCAAO,OAAO,CAAC,GAAG,GAAK,MAAM,CAAC,GAAG,CAAE;YACtC,wEAAwE;YACxE,sEAAsE;YACtE,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC;SACnC,CAAC,CAAC;QAEH,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QACH,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAChE,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAE3C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,UAAU,CACd,oBAAoB,EACpB,iEAAiE;YAC/D,+CAA+C,YAAY,GAAG,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAE3C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACxD,MAAM,UAAU,CACd,mBAAmB,GAAG,IAAI,EAC1B,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { spawn } from 'node:child_process';\nimport * as path from 'node:path';\n\nimport { assertHarnessCompatible } from '../compatibility';\nimport type { CliContext } from '../context';\nimport { preconditionError, usageError } from '../errors';\nimport {\n  HARNESS_DIR,\n  HARNESS_PACKAGE,\n  assertShellDirIsOurs,\n  bootstrapHarnessConfig,\n  ensureGitignoreEntry,\n  missingDependencies,\n  readInstalledHarness,\n  scaffoldShell,\n} from '../harness-scaffold';\nimport {\n  detectPackageManager,\n  execArgs,\n  formatCommand,\n  installCommand,\n} from '../package-manager';\nimport { loadProject } from '../project';\nimport { displayPath } from '../ui';\nimport { announceUpdate, checkForUpdate } from '../update-notice';\n\nexport interface DevArgs {\n  /** Project directory (contains ekanos.json). Defaults to cwd. */\n  dir: string;\n  /** Port for the dev server. */\n  port?: string;\n  /**\n   * Interface to bind. Defaults to loopback — see `resolveHost`. Anything\n   * else is an explicit, warned-about decision to expose the harness.\n   *\n   * NOTE: unrelated to the Ekanos HOST the update notice checks against —\n   * this is the local bind address for `next dev`, never an Ekanos origin.\n   */\n  host?: string;\n  /** Rewrite every generated file even when its bytes already match. */\n  force: boolean;\n  /**\n   * Explicit `--start` / `--no-start`. Undefined means \"decide from the\n   * output mode\": a JSON caller is an agent or a pipe and must not be handed\n   * a process that never exits.\n   */\n  start?: boolean;\n  env?: Record<string, string | undefined>;\n}\n\nconst DEFAULT_PORT = 3100;\n\n/**\n * Loopback, NOT Next's default.\n *\n * `next dev` binds 0.0.0.0 unless told otherwise, so the harness would be\n * reachable by anyone on the same network — a coffee-shop Wi-Fi, a shared\n * office VLAN — while we printed \"http://localhost:3100\" and implied\n * otherwise. It renders a partner's integration with their fixtures and, in\n * live mode, whatever their vendor API returns; there is no auth in front of\n * any of it. Binding loopback by default costs a partner nothing and makes\n * exposure a thing they ask for.\n */\nconst DEFAULT_HOST = '127.0.0.1';\n\n/** Addresses that are only reachable from this machine. */\nconst LOOPBACK_HOSTS = new Set(['127.0.0.1', '::1', 'localhost']);\n\n/**\n * Set for the dev server when `--host` binds beyond loopback. The shell's\n * API routes (`@ekanos/harness/api`) refuse non-loopback `Host` headers\n * unless this is `1`: they hold the partner's local OAuth credentials and\n * run handlers on request, so exposing them has to be a decision — this one,\n * made after the warning below — rather than a side effect of the bind.\n */\nconst EXPOSED_ENV = 'EKANOS_HARNESS_EXPOSED';\n\n/** Where the harness generates, and reads, local dev credentials. */\nconst LOCAL_SECRETS_PATH = path.join('.ekanos', 'local-secrets.json');\n\n/**\n * `dev` — scaffold the local harness shell into the partner's project, then\n * run it with their own Next.\n *\n * The shape of this verb follows from one rule: we must be able to ship a\n * harness bugfix as an `@ekanos/harness` version bump that a partner picks up\n * with `pnpm up`, with zero edits to any file they own. So everything under\n * `.ekanos/` is generated, gitignored and rewritten freely, `harness.config.ts`\n * at the project root is written once and never touched again, and all actual\n * harness behaviour lives in the installed package.\n *\n * Two idempotency properties matter and are both tested: a second run produces\n * byte-identical files and rewrites nothing (so Next's watcher stays quiet),\n * and `.gitignore` never grows a duplicate line.\n */\nexport async function runDev(ctx: CliContext, args: DevArgs): Promise<number> {\n  const loaded = loadProject(args.dir);\n  const port = parsePort(args.port);\n  const host = parseHost(args.host);\n  const exposed = !LOOPBACK_HOSTS.has(host);\n  const pm = detectPackageManager(loaded.projectDir);\n\n  const notice = await checkForUpdate({ env: args.env ?? process.env });\n  announceUpdate(ctx, notice);\n\n  // Fail before writing anything: the shell declares no dependencies of its\n  // own, so a missing one would otherwise surface as an opaque Next\n  // resolution error minutes later.\n  const missing = missingDependencies(loaded.projectDir);\n  if (missing.length > 0) {\n    throw preconditionError(\n      `${missing.length} package${missing.length === 1 ? '' : 's'} the ` +\n        `harness needs ${missing.length === 1 ? 'is' : 'are'} not installed ` +\n        `in ${loaded.projectDir}: ${missing.join(', ')}.`,\n      `Run \"${installCommand(pm, missing)}\" in ${loaded.projectDir}, then ` +\n        're-run \"ekanos dev\".',\n    );\n  }\n\n  const harness = readInstalledHarness(loaded.projectDir);\n  const harnessVersion = harness?.version;\n  if (!harnessVersion) {\n    throw preconditionError(\n      `${HARNESS_PACKAGE} is installed but declares no version.`,\n      `Reinstall it with \"${installCommand(pm, [HARNESS_PACKAGE])}\" in ` +\n        `${loaded.projectDir}, then re-run \"ekanos dev\".`,\n    );\n  }\n\n  // The templates ship with the CLI and the code they import ships with the\n  // harness, so a partner can upgrade one without the other. Name that\n  // mismatch here rather than letting it surface later as a module-resolution\n  // error inside a shell we cheerfully certified as current.\n  assertHarnessCompatible({\n    harnessVersion,\n    harnessManifest: harness?.manifest,\n    installHint: (spec) => installCommand(pm, [spec]),\n  });\n\n  // Validate the shell target BEFORE writing anything at all. Bootstrapping\n  // harness.config.ts first and only then discovering that .ekanos/harness is\n  // a file or someone else's tree would leave the project half-scaffolded.\n  assertShellDirIsOurs(path.join(loaded.projectDir, HARNESS_DIR), args.force);\n\n  const config = bootstrapHarnessConfig(loaded.projectDir, loaded.integrations);\n  const shell = scaffoldShell({\n    projectDir: loaded.projectDir,\n    slug: loaded.primary.slug,\n    harnessVersion,\n    force: args.force,\n    sourceGlobs: loaded.project.sourceGlobs,\n  });\n  const gitignoreUpdated = ensureGitignoreEntry(loaded.projectDir);\n\n  if (shell.stale) {\n    ctx.log(\n      `Regenerating ${HARNESS_DIR} — ${shell.staleReasons.join('; ')}. ` +\n        `Nothing you own changed; ${config.configPath} is untouched.`,\n    );\n  }\n\n  if (config.bootstrapped) {\n    ctx.log(`  created harness.config.ts (yours — edit it, we never will)`);\n  }\n  for (const file of shell.created) ctx.log(`  created ${HARNESS_DIR}/${file}`);\n  for (const file of shell.updated) ctx.log(`  updated ${HARNESS_DIR}/${file}`);\n  if (gitignoreUpdated) ctx.log('  updated .gitignore (.ekanos/)');\n  ctx.log(\n    `  live-mode OAuth: the harness generates ${LOCAL_SECRETS_PATH} on first ` +\n      'use — fill it in and follow \"Local OAuth\" on the Activation surface.',\n  );\n\n  // `--hostname` is passed ALWAYS, never left to Next's default, so the URL\n  // we print is the URL that is actually served.\n  const serverArgs = ['dev', '--port', String(port), '--hostname', host];\n  const serverEnv: Record<string, string> = exposed\n    ? { [EXPOSED_ENV]: '1' }\n    : {};\n  const command =\n    (exposed ? `${EXPOSED_ENV}=1 ` : '') +\n    formatCommand(pm.bin, execArgs(pm, 'next', serverArgs));\n  const url = `http://${displayHost(host)}:${port}`;\n\n  const scaffold = {\n    slug: loaded.primary.slug,\n    integrations: loaded.integrations.map((i) => i.slug),\n    projectDir: loaded.projectDir,\n    harnessDir: shell.harnessDir,\n    harnessVersion,\n    previousVersion: shell.previousVersion,\n    previousMarker: shell.previousMarker,\n    stale: shell.stale,\n    staleReasons: shell.staleReasons,\n    sourceGlobs: loaded.project.sourceGlobs ?? [],\n    created: shell.created,\n    updated: shell.updated,\n    unchanged: shell.unchanged,\n    configBootstrapped: config.bootstrapped,\n    configPath: config.configPath,\n    gitignoreUpdated,\n    ...(notice ? { toolchain: notice } : {}),\n  };\n\n  if (exposed) {\n    ctx.warn(\n      `WARNING: --host ${host} exposes the harness beyond this machine. It ` +\n        'has no authentication, and it renders your fixtures and — in live ' +\n        'mode — real responses from your vendor API. Its API routes hold the ' +\n        `client secret from ${LOCAL_SECRETS_PATH}, the tokens onTokens stored, ` +\n        'and run your handlers on request; they refuse non-loopback callers ' +\n        `unless ${EXPOSED_ENV}=1, which this sets. Anyone who can reach ` +\n        `${url} can read and run all of it. Omit --host to bind ${DEFAULT_HOST}.`,\n    );\n  }\n\n  // A JSON caller is an agent or a pipe. Handing it a dev server that never\n  // exits would hang its tool call forever and it would never see the\n  // envelope, so JSON mode scaffolds and reports the command instead of\n  // running it. `--start` overrides; `--no-start` opts out in a terminal.\n  const shouldStart = args.start ?? !ctx.jsonMode;\n  if (!shouldStart) {\n    return ctx.succeed(\n      {\n        ...scaffold,\n        server: { started: false, command, url, port, host, exposed },\n      },\n      ctx.ui.result({\n        title: 'Harness ready',\n        rows: [\n          ['Directory', displayPath(shell.harnessDir, process.cwd())],\n          ['URL', url],\n          ['Start', command],\n        ],\n      }),\n    );\n  }\n\n  ctx.log(ctx.ui.dim(`Starting the harness on ${url} (${command})…`));\n  const exitCode = await spawnServer({\n    ctx,\n    bin: pm.bin,\n    argv: execArgs(pm, 'next', serverArgs),\n    cwd: shell.harnessDir,\n    env: serverEnv,\n  });\n\n  const data = {\n    ...scaffold,\n    server: { started: true, command, url, port, host, exposed, exitCode },\n  };\n\n  if (exitCode === 0) {\n    return ctx.succeed(\n      data,\n      ctx.ui.result({ title: 'Harness stopped', rows: [['URL', url]] }),\n    );\n  }\n\n  return ctx.failWith({\n    code: 'dev_server_failed',\n    message: `\"${command}\" exited with code ${exitCode}.`,\n    hint:\n      'Read the Next output on stderr. If it cannot resolve @ekanos/harness ' +\n      `or next, reinstall dependencies in ${loaded.projectDir}; if a route ` +\n      `fails to compile, delete ${shell.harnessDir} and re-run \"ekanos dev\".`,\n    // Transparent passthrough of Next's own exit code.\n    exitCode,\n    data,\n  });\n}\n\nfunction spawnServer(params: {\n  ctx: CliContext;\n  bin: string;\n  argv: string[];\n  cwd: string;\n  env: Record<string, string>;\n}): Promise<number> {\n  return new Promise<number>((resolve, reject) => {\n    const child = spawn(params.bin, params.argv, {\n      cwd: params.cwd,\n      env: { ...process.env, ...params.env },\n      // stdin inherited so Next's own key handling works; stdout/stderr piped\n      // so we can route them and keep OUR stdout reserved for the envelope.\n      stdio: ['inherit', 'pipe', 'pipe'],\n    });\n\n    child.stdout?.on('data', (chunk: Buffer) => {\n      (params.ctx.jsonMode ? process.stderr : process.stdout).write(chunk);\n    });\n    child.stderr?.on('data', (chunk: Buffer) => {\n      process.stderr.write(chunk);\n    });\n\n    child.on('error', (error) => reject(error));\n    child.on('close', (code) => resolve(code ?? 1));\n  });\n}\n\n/**\n * The hostname to show a human. `127.0.0.1` is spelled `localhost` because\n * that is what people type; a wildcard bind is spelled `localhost` too, but\n * only after `exposed` has already been warned about — printing `0.0.0.0` as\n * a URL is not useful.\n */\nfunction displayHost(host: string): string {\n  if (host === '127.0.0.1' || host === '0.0.0.0' || host === '::') {\n    return 'localhost';\n  }\n  if (host === '::1') return '[::1]';\n  return host;\n}\n\nfunction parseHost(raw: string | undefined): string {\n  if (raw === undefined) return DEFAULT_HOST;\n\n  const host = raw.trim();\n  if (host.length === 0) {\n    throw usageError(\n      'Invalid --host \"\".',\n      `Pass an interface to bind, e.g. \"--host 0.0.0.0\" to expose the ` +\n        `harness on your network, or omit it to bind ${DEFAULT_HOST}.`,\n    );\n  }\n  return host;\n}\n\nfunction parsePort(raw: string | undefined): number {\n  if (raw === undefined) return DEFAULT_PORT;\n\n  const port = Number(raw);\n  if (!Number.isInteger(port) || port < 1 || port > 65535) {\n    throw usageError(\n      `Invalid --port \"${raw}\".`,\n      'Pass an integer between 1 and 65535, e.g. \"--port 3100\".',\n    );\n  }\n  return port;\n}\n"]}

package/dist/commands/init.js

@@ -7,6 +7,7 @@ import { mergeManifest, serializeManifest, } from '../merge-manifest.js';
 import { docEntryProblem, serializeProject, } from '../project.js';
 import { classifyPath, readFileNoFollow, writeFileNoFollow } from '../safe-fs.js';
 import { readTemplate, templatesDir, toDisplayName } from '../templates.js';
+import { displayPath, pluralize } from '../ui.js';
 import { canWizard, wizard } from '../wizard.js';
 const SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 /**
@@ -209,21 +210,24 @@ export async function runInit(ctx, args) {
             notes: manifest.notes,
         },
     };
-    const summary = summarize({
-        slug,
-        dir: targetDir,
-        created,
-        skipped,
-        manifestAction: manifest.kind,
-        manifestAdded: manifest.added.length,
-        noteCount: manifest.notes.length,
-    });
-    printBanner(ctx, 'full');
+    printBanner(ctx);
     if (useWizard) {
         const relDir = path.relative(args.cwd, targetDir) || '.';
-        wizard.outro(`Next steps:\n\n  cd ${relDir}\n  ekanos dev`);
+        wizard.outro(`Next steps:\n\n  cd ${relDir}\n  npm install\n  ekanos dev`);
     }
-    return ctx.succeed(data, summary);
+    // The wizard's note + outro already said everything; a trailing line would
+    // only repeat them.
+    return ctx.succeed(data, useWizard
+        ? ''
+        : humanResult(ctx.ui, {
+            slug,
+            dir: displayPath(targetDir, args.cwd),
+            created: created.length,
+            skipped: skipped.length,
+            manifestAction: manifest.kind,
+            manifestAdded: manifest.added.length,
+            noteCount: manifest.notes.length,
+        }));
 }
 /**
  * The clack `note()` body for a successful wizard-mode scaffold — collapses
@@ -232,6 +236,7 @@ export async function runInit(ctx, args) {
  * skips and manifest notes, each with its full hint.
  */
 function wizardSummaryDetail(params) {
+    var _a;
     const { created, skipped, manifest } = params;
     const lines = [
         `${created.length} file${created.length === 1 ? '' : 's'} written`,
@@ -244,8 +249,20 @@ function wizardSummaryDetail(params) {
     }
     if (skipped.length > 0) {
         lines.push('', 'Skipped (already existed):');
+        // Identical advice that only differs by file name is said once, not
+        // once per file — twenty near-identical sentences hide the files.
+        const groups = new Map();
         for (const skip of skipped) {
-            lines.push(`  ${skip.file} — ${skip.hint}`);
+            const key = skip.hint.split(skip.file).join('{file}');
+            groups.set(key, [...((_a = groups.get(key)) !== null && _a !== void 0 ? _a : []), skip.file]);
+        }
+        for (const [hint, files] of groups) {
+            if (files.length === 1) {
+                lines.push(`  ${files[0]} — ${hint.replace('{file}', files[0])}`);
+                continue;
+            }
+            lines.push(...files.map((file) => `  ${file}`));
+            lines.push(`  ${hint.split('{file}').join('each file')}`);
         }
     }
     for (const note of manifest.notes) {
@@ -360,23 +377,44 @@ function writeManifest(targetDir, vars, force) {
         notes: result.notes,
     };
 }
-function summarize(params) {
-    const parts = [];
-    if (params.created.length > 0) {
-        parts.push(`${params.created.length} file${params.created.length === 1 ? '' : 's'} written`);
-    }
-    if (params.manifestAction === 'merged') {
-        parts.push(`${params.manifestAdded} package.json field(s) merged`);
-    }
-    if (params.skipped.length > 0) {
-        parts.push(`${params.skipped.length} skipped`);
-    }
-    if (params.noteCount > 0) {
-        parts.push(`${params.noteCount} thing(s) need your attention`);
-    }
-    if (parts.length === 0) {
-        return `init: nothing to do — "${params.slug}" is already scaffolded in ${params.dir}.`;
+function humanResult(ui, params) {
+    const files = [
+        ...(params.created > 0 ? [`${params.created} written`] : []),
+        ...(params.manifestAction === 'merged'
+            ? [`${pluralize(params.manifestAdded, 'package.json field')} merged`]
+            : []),
+        ...(params.skipped > 0 ? [`${params.skipped} skipped`] : []),
+    ];
+    const attention = params.skipped > 0 || params.noteCount > 0;
+    if (files.length === 0 && params.noteCount === 0) {
+        return ui.result({
+            title: `${params.slug} is already scaffolded`,
+            rows: [['Directory', params.dir]],
+        });
     }
-    return `init: scaffolded "${params.slug}" into ${params.dir} (${parts.join(', ')}).`;
+    return ui.result({
+        title: `Scaffolded ${params.slug}`,
+        tone: attention ? 'warn' : 'ok',
+        rows: [
+            ['Directory', params.dir],
+            ...(files.length > 0 ? [['Files', files.join(' · ')]] : []),
+            ...(params.noteCount > 0
+                ? [
+                    [
+                        'Attention',
+                        `${pluralize(params.noteCount, 'note')} above`,
+                    ],
+                ]
+                : []),
+            [
+                'Next',
+                [
+                    ...(params.dir === '.' ? [] : [`cd ${params.dir}`]),
+                    'npm install',
+                    'ekanos dev',
+                ],
+            ],
+        ],
+    });
 }
 //# sourceMappingURL=init.js.map