npm - @girardmedia/bootspring - Versions diffs - 2.2.0 → 2.3.0 - Mend

@girardmedia/bootspring 2.2.0 → 2.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (50) hide show

package/README.md +2 -2
package/bin/bootspring.js +35 -96
package/claude-commands/agent.md +34 -0
package/claude-commands/bs.md +31 -0
package/claude-commands/build.md +25 -0
package/claude-commands/skill.md +31 -0
package/claude-commands/todo.md +25 -0
package/dist/cli/index.cjs +17808 -0
package/dist/core/index.d.ts +5814 -0
package/dist/core.js +5780 -0
package/dist/mcp/index.d.ts +1 -0
package/dist/mcp-server.js +2299 -0
package/generators/api-docs.js +2 -2
package/generators/decisions.js +3 -3
package/generators/health.js +16 -16
package/generators/sprint.js +2 -2
package/package.json +27 -59
package/core/api-client.d.ts +0 -69
package/core/api-client.js +0 -1482
package/core/auth.d.ts +0 -98
package/core/auth.js +0 -737
package/core/build-orchestrator.js +0 -508
package/core/build-state.js +0 -612
package/core/config.d.ts +0 -106
package/core/config.js +0 -1328
package/core/context-loader.js +0 -580
package/core/context.d.ts +0 -61
package/core/context.js +0 -327
package/core/entitlements.d.ts +0 -70
package/core/entitlements.js +0 -322
package/core/index.d.ts +0 -53
package/core/index.js +0 -62
package/core/mcp-config.js +0 -115
package/core/policies.d.ts +0 -43
package/core/policies.js +0 -113
package/core/policy-matrix.js +0 -303
package/core/project-activity.js +0 -175
package/core/redaction.d.ts +0 -5
package/core/redaction.js +0 -63
package/core/self-update.js +0 -259
package/core/session.js +0 -353
package/core/task-extractor.js +0 -1098
package/core/telemetry.d.ts +0 -55
package/core/telemetry.js +0 -617
package/core/tier-enforcement.js +0 -928
package/core/utils.d.ts +0 -90
package/core/utils.js +0 -455
package/core/validation.js +0 -572
package/mcp/server.d.ts +0 -57
package/mcp/server.js +0 -264

package/core/api-client.js DELETED Viewed

@@ -1,1482 +0,0 @@
-/**
- * Bootspring API Client
- *
- * Handles all communication with api.bootspring.com
- * This is the thin-client version that requires API for all operations.
- */
-const https = require('https');
-const http = require('http');
-const auth = require('./auth');
-const session = require('./session');
-const { redactSensitiveString, redactSensitiveData } = require('./redaction');
-const API_BASE = process.env.BOOTSPRING_API_URL || 'https://api.bootspring.com';
-const API_VERSION = 'v1'; // Note: auth routes don't use version prefix
-// Cache for API responses
-const cache = new Map();
-const CACHE_TTL = 60000; // 1 minute
-const PRESEED_CODEBASE_ENRICHMENT_PATHS = [
-  '/preseed/enrich/from-codebase',
-  '/preseed/from-codebase/enrich',
-  '/projects/preseed/enrich/from-codebase'
-];
-function getPackageVersion() {
-  try {
-    return require('../package.json').version;
-  } catch {
-    return '0.0.0';
-  }
-}
-function formatHttpErrorBody(body, statusCode) {
-  const raw = String(body || '').trim();
-  if (!raw) {
-    return `API Error (${statusCode || 'unknown'})`;
-  }
-  if (/^\s*<!doctype html/i.test(raw) || /^\s*<html/i.test(raw)) {
-    const titleMatch = raw.match(/<title[^>]*>([^<]+)<\/title>/i);
-    const title = titleMatch && titleMatch[1] ? `: ${titleMatch[1].trim()}` : '';
-    return `Bootspring API returned an HTML error page (HTTP ${statusCode || 'unknown'}${title})`;
-  }
-  return redactSensitiveString(raw);
-}
-function parseExpiresInSeconds(rawValue) {
-  if (typeof rawValue === 'number' && Number.isFinite(rawValue) && rawValue > 0) {
-    return rawValue;
-  }
-  if (typeof rawValue === 'string' && rawValue.trim().length > 0) {
-    const trimmed = rawValue.trim();
-    const asNumber = Number(trimmed);
-    if (Number.isFinite(asNumber) && asNumber > 0) {
-      return asNumber;
-    }
-    const match = trimmed.match(/^(\d+)([smhd])$/i);
-    if (match && match[1] && match[2]) {
-      const value = Number(match[1]);
-      if (!Number.isFinite(value) || value <= 0) {
-        return 15 * 60;
-      }
-      const unit = match[2].toLowerCase();
-      if (unit === 's') return value;
-      if (unit === 'm') return value * 60;
-      if (unit === 'h') return value * 60 * 60;
-      if (unit === 'd') return value * 24 * 60 * 60;
-    }
-  }
-  return 15 * 60;
-}
-function parseProjectScopedTokenPayload(raw) {
-  const payload = raw && typeof raw === 'object' && !Array.isArray(raw)
-    ? raw
-    : null;
-  if (!payload) {
-    return null;
-  }
-  const nestedData = payload.data;
-  const source = (nestedData && typeof nestedData === 'object' && !Array.isArray(nestedData))
-    ? nestedData
-    : payload;
-  const tokenCandidates = [
-    source.token,
-    source.sessionToken,
-    source.session_token,
-    source.accessToken,
-    source.access_token
-  ];
-  const token = tokenCandidates.find(value => typeof value === 'string' && value.length > 0);
-  if (!token) {
-    return null;
-  }
-  const explicitExpiresAt = [source.expiresAt, source.expires_at]
-    .find(value => typeof value === 'string' && value.length > 0);
-  const expiresInSeconds = parseExpiresInSeconds(
-    [source.expiresIn, source.expires_in, source.ttl, source.ttlSeconds].find(value => value !== undefined)
-  );
-  const expiresAt = explicitExpiresAt || new Date(Date.now() + expiresInSeconds * 1000).toISOString();
-  return {
-    token,
-    expiresAt,
-    expiresInSeconds
-  };
-}
-async function requestProjectScopedToken(pathname, apiKey, projectId) {
-  const url = new URL(pathname, API_BASE);
-  const isHttps = url.protocol === 'https:';
-  const httpModule = isHttps ? https : http;
-  const deviceContext = auth.getDeviceContext();
-  return new Promise((resolve, reject) => {
-    const requestBody = JSON.stringify({
-      apiKey,
-      projectId,
-      scope: 'project',
-      deviceFingerprint: deviceContext.deviceId,
-      deviceName: `CLI - ${deviceContext.hostname}`
-    });
-    const req = httpModule.request(url, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        'User-Agent': `bootspring-cli/${getPackageVersion()}`,
-        'Content-Length': Buffer.byteLength(requestBody).toString()
-      },
-      timeout: 10000
-    }, (res) => {
-      let body = '';
-      res.on('data', chunk => body += chunk);
-      res.on('end', () => {
-        let parsed = null;
-        try {
-          parsed = body ? JSON.parse(body) : {};
-        } catch {
-          parsed = {};
-        }
-        if (res.statusCode >= 400) {
-          const payload = parsed && typeof parsed === 'object' ? parsed : {};
-          const error = new Error(
-            redactSensitiveString(String(payload.message || payload.error || `Token exchange failed (${res.statusCode})`))
-          );
-          error.status = res.statusCode;
-          error.code = typeof payload.code === 'string' ? payload.code : undefined;
-          error.details = redactSensitiveData(payload.details);
-          reject(error);
-          return;
-        }
-        const exchange = parseProjectScopedTokenPayload(parsed);
-        if (!exchange) {
-          const error = new Error('Token exchange response did not include a scoped token');
-          error.status = res.statusCode;
-          reject(error);
-          return;
-        }
-        resolve(exchange);
-      });
-    });
-    req.on('error', (error) => {
-      reject(new Error(redactSensitiveString(error.message || String(error))));
-    });
-    req.on('timeout', () => {
-      req.destroy();
-      reject(new Error('Token exchange request timeout'));
-    });
-    req.write(requestBody);
-    req.end();
-  });
-}
-async function exchangeProjectScopedToken(apiKey, projectId = null) {
-  const paths = [
-    '/api/keys/scoped-token',
-    '/api/keys/exchange',
-    '/api/keys/session'
-  ];
-  let lastError = null;
-  for (const exchangePath of paths) {
-    try {
-      const exchange = await requestProjectScopedToken(exchangePath, apiKey, projectId);
-      return {
-        ...exchange,
-        sourcePath: exchangePath
-      };
-    } catch (error) {
-      lastError = error;
-      if (error.status && error.status >= 400 && error.status < 500 &&
-          error.status !== 404 && error.status !== 405) {
-        break;
-      }
-    }
-  }
-  throw lastError || new Error('Failed to exchange scoped token');
-}
-async function ensureProjectScopedToken() {
-  if (process.env.BOOTSPRING_API_KEY) {
-    return process.env.BOOTSPRING_API_KEY;
-  }
-  const scopedToken = auth.getProjectScopedToken ? auth.getProjectScopedToken() : null;
-  if (scopedToken) {
-    return scopedToken;
-  }
-  const project = session.getEffectiveProject ? session.getEffectiveProject() : null;
-  const projectId = project?.id || null;
-  const storedApiKey = auth.getStoredApiKey ? auth.getStoredApiKey() : null;
-  if (storedApiKey) {
-    try {
-      const exchanged = await exchangeProjectScopedToken(storedApiKey, projectId);
-      if (auth.saveProjectScopedSession) {
-        auth.saveProjectScopedSession(exchanged.token, {
-          expiresAt: exchanged.expiresAt,
-          source: exchanged.sourcePath
-        });
-      }
-      return exchanged.token;
-    } catch {
-      return storedApiKey;
-    }
-  }
-  const legacyProjectApiKey = auth.getLegacyProjectApiKey ? auth.getLegacyProjectApiKey() : null;
-  if (legacyProjectApiKey) {
-    try {
-      const exchanged = await exchangeProjectScopedToken(legacyProjectApiKey, projectId);
-      if (auth.saveProjectScopedSession) {
-        auth.saveProjectScopedSession(exchanged.token, {
-          expiresAt: exchanged.expiresAt,
-          source: exchanged.sourcePath,
-          migratedFromLegacyApiKey: true
-        });
-      }
-      if (auth.clearProjectApiKey) {
-        auth.clearProjectApiKey();
-      }
-      return exchanged.token;
-    } catch {
-      return legacyProjectApiKey;
-    }
-  }
-  return null;
-}
-/**
- * Proactively refresh token if expiring soon
- * @returns {Promise<boolean>} True if refresh was performed
- */
-async function proactiveTokenRefresh() {
-  const expiryStatus = auth.getTokenExpiryStatus ? auth.getTokenExpiryStatus(5 * 60 * 1000) : null;
-  if (!expiryStatus) {
-    return false;
-  }
-  // If token is expiring within 5 minutes but not yet expired, refresh it
-  if (expiryStatus.expiringSoon && !expiryStatus.expired) {
-    const refreshToken = auth.getRefreshToken();
-    if (refreshToken) {
-      try {
-        const deviceContext = auth.getDeviceContext();
-        const url = new URL('/api/v1/auth/refresh', API_BASE);
-        const isHttps = url.protocol === 'https:';
-        const httpModule = isHttps ? https : http;
-        const response = await new Promise((resolve, reject) => {
-          const requestBody = JSON.stringify({ refreshToken, device: deviceContext });
-          const req = httpModule.request(url, {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-              'User-Agent': `bootspring-cli/${getPackageVersion()}`,
-              'Content-Length': Buffer.byteLength(requestBody)
-            },
-            timeout: 10000
-          }, (res) => {
-            let body = '';
-            res.on('data', chunk => body += chunk);
-            res.on('end', () => {
-              try {
-                const json = JSON.parse(body);
-                if (res.statusCode >= 400) {
-                  reject(new Error(json.message || 'Token refresh failed'));
-                } else {
-                  resolve(json);
-                }
-              } catch {
-                reject(new Error('Invalid refresh response'));
-              }
-            });
-          });
-          req.on('error', reject);
-          req.on('timeout', () => { req.destroy(); reject(new Error('Timeout')); });
-          req.write(requestBody);
-          req.end();
-        });
-        auth.updateTokens(response);
-        return true;
-      } catch {
-        // Refresh failed - continue with existing token or fall back
-        return false;
-      }
-    }
-  }
-  return false;
-}
-async function resolveAuthHeaders() {
-  // Try to proactively refresh token if expiring soon
-  await proactiveTokenRefresh();
-  const token = auth.getToken();
-  if (token) {
-    return { Authorization: `Bearer ${token}` };
-  }
-  const scopedOrApiKey = await ensureProjectScopedToken();
-  if (scopedOrApiKey) {
-    return { 'X-API-Key': scopedOrApiKey };
-  }
-  const fallbackApiKey = auth.getApiKey();
-  if (fallbackApiKey) {
-    return { 'X-API-Key': fallbackApiKey };
-  }
-  return {};
-}
-/**
- * Make an API request (with version prefix)
- */
-async function request(method, path, data = null, options = {}) {
-  const authHeaders = await resolveAuthHeaders();
-  const url = new URL(`/api/${API_VERSION}${path}`, API_BASE);
-  const isHttps = url.protocol === 'https:';
-  const httpModule = isHttps ? https : http;
-  // Get device ID for request tracking
-  const deviceId = auth.getDeviceId();
-  // Get project context for tracking
-  const project = session.getEffectiveProject();
-  const projectId = project?.id || null;
-  const headers = {
-    'Content-Type': 'application/json',
-    'User-Agent': `bootspring-cli/${getPackageVersion()}`,
-    'X-Device-Id': deviceId,
-    ...(projectId && { 'X-Project-Id': projectId }),
-    ...authHeaders,
-    ...options.headers
-  };
-  // Check cache for GET requests
-  if (method === 'GET' && !options.noCache) {
-    const cacheKey = `${method}:${path}`;
-    const cached = cache.get(cacheKey);
-    if (cached && Date.now() - cached.time < CACHE_TTL) {
-      return cached.data;
-    }
-  }
-  return new Promise((resolve, reject) => {
-    const req = httpModule.request(url, {
-      method,
-      headers,
-      timeout: options.timeout || 30000
-    }, (res) => {
-      let body = '';
-      res.on('data', chunk => body += chunk);
-      res.on('end', () => {
-        try {
-          const json = JSON.parse(body);
-          if (res.statusCode >= 400) {
-            const error = new Error(
-              redactSensitiveString(String(json.message || json.error || 'API Error'))
-            );
-            error.status = res.statusCode;
-            error.code = json.error || json.code;
-            error.details = redactSensitiveData(json.details);
-            reject(error);
-          } else {
-            // Cache successful GET responses
-            if (method === 'GET' && !options.noCache) {
-              const cacheKey = `${method}:${path}`;
-              cache.set(cacheKey, { data: json, time: Date.now() });
-            }
-            resolve(json);
-          }
-        } catch {
-          if (res.statusCode >= 400) {
-            const error = new Error(formatHttpErrorBody(body, res.statusCode));
-            error.status = res.statusCode;
-            reject(error);
-          } else {
-            resolve(body);
-          }
-        }
-      });
-    });
-    req.on('error', (err) => {
-      if (err.code === 'ECONNREFUSED') {
-        reject(new Error('Cannot connect to Bootspring API. Please check your internet connection.'));
-      } else {
-        reject(new Error(redactSensitiveString(err.message || String(err))));
-      }
-    });
-    req.on('timeout', () => {
-      req.destroy();
-      reject(new Error('Request timeout'));
-    });
-    if (data) {
-      req.write(JSON.stringify(data));
-    }
-    req.end();
-  });
-}
-/**
- * Make a direct API request (without version prefix, for /api/projects etc.)
- */
-async function directRequest(method, path, data = null, options = {}) {
-  const authHeaders = await resolveAuthHeaders();
-  const url = new URL(`/api${path}`, API_BASE);
-  const isHttps = url.protocol === 'https:';
-  const httpModule = isHttps ? https : http;
-  const deviceId = auth.getDeviceId();
-  const project = session.getEffectiveProject();
-  const projectId = project?.id || null;
-  const headers = {
-    'Content-Type': 'application/json',
-    'User-Agent': `bootspring-cli/${getPackageVersion()}`,
-    'X-Device-Id': deviceId,
-    ...(projectId && { 'X-Project-Id': projectId }),
-    ...authHeaders,
-    ...options.headers
-  };
-  return new Promise((resolve, reject) => {
-    const req = httpModule.request(url, {
-      method,
-      headers,
-      timeout: options.timeout || 30000
-    }, (res) => {
-      let body = '';
-      res.on('data', chunk => body += chunk);
-      res.on('end', () => {
-        try {
-          const json = JSON.parse(body);
-          if (res.statusCode >= 400) {
-            const error = new Error(
-              redactSensitiveString(String(json.message || json.error || 'API Error'))
-            );
-            error.status = res.statusCode;
-            error.code = json.error || json.code;
-            error.details = redactSensitiveData(json.details);
-            reject(error);
-          } else {
-            resolve(json);
-          }
-        } catch {
-          if (res.statusCode >= 400) {
-            const error = new Error(formatHttpErrorBody(body, res.statusCode));
-            error.status = res.statusCode;
-            reject(error);
-          } else {
-            resolve(body);
-          }
-        }
-      });
-    });
-    req.on('error', (err) => {
-      if (err.code === 'ECONNREFUSED') {
-        reject(new Error('Cannot connect to Bootspring API. Please check your internet connection.'));
-      } else {
-        reject(new Error(redactSensitiveString(err.message || String(err))));
-      }
-    });
-    req.on('timeout', () => {
-      req.destroy();
-      reject(new Error('Request timeout'));
-    });
-    if (data) {
-      req.write(JSON.stringify(data));
-    }
-    req.end();
-  });
-}
-/**
- * Clear the cache
- */
-function clearCache() {
-  cache.clear();
-}
-/**
- * Check if API is reachable
- */
-async function healthCheck() {
-  try {
-    // Health endpoint is at /health, not under /api/v1
-    const url = new URL('/health', API_BASE);
-    const isHttps = url.protocol === 'https:';
-    const httpModule = isHttps ? https : http;
-    return new Promise((resolve) => {
-      const req = httpModule.request(url, {
-        method: 'GET',
-        timeout: 5000
-      }, (res) => {
-        let body = '';
-        res.on('data', chunk => body += chunk);
-        res.on('end', async () => {
-          try {
-            const json = JSON.parse(body);
-            resolve({ connected: true, version: json.version });
-          } catch {
-            resolve({ connected: false, error: 'Invalid response' });
-          }
-        });
-      });
-      req.on('error', (err) => {
-        resolve({ connected: false, error: redactSensitiveString(err.message) });
-      });
-      req.on('timeout', () => {
-        req.destroy();
-        resolve({ connected: false, error: 'Timeout' });
-      });
-      req.end();
-    });
-  } catch (error) {
-    return { connected: false, error: redactSensitiveString(error?.message || String(error)) };
-  }
-}
-/**
- * Require authentication - throws if not logged in
- */
-function requireAuth() {
-  if (!auth.isAuthenticated()) {
-    const error = new Error('Authentication required. Run: bootspring auth login');
-    error.code = 'AUTH_REQUIRED';
-    throw error;
-  }
-}
-/**
- * API methods
- */
-const api = {
-  // Device Authorization Flow
-  async requestDeviceCode() {
-    const deviceContext = auth.getDeviceContext();
-    const url = new URL('/api/v1/auth/device', API_BASE);
-    const isHttps = url.protocol === 'https:';
-    const httpModule = isHttps ? https : http;
-    return new Promise((resolve, reject) => {
-      const req = httpModule.request(url, {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-          'User-Agent': `bootspring-cli/${require('../package.json').version}`,
-        },
-        timeout: 10000
-      }, (res) => {
-        let body = '';
-        res.on('data', chunk => body += chunk);
-        res.on('end', async () => {
-          try {
-            const json = JSON.parse(body);
-            if (res.statusCode >= 400) {
-              const error = new Error(
-                redactSensitiveString(String(json.message || json.error || 'Failed to get device code'))
-              );
-              error.status = res.statusCode;
-              error.code = json.error;
-              reject(error);
-            } else {
-              resolve(json);
-            }
-          } catch {
-            reject(new Error('Invalid response from API'));
-          }
-        });
-      });
-      req.on('error', (error) => reject(new Error(redactSensitiveString(error.message || String(error)))));
-      req.on('timeout', () => {
-        req.destroy();
-        reject(new Error('Request timeout'));
-      });
-      req.write(JSON.stringify({ device: deviceContext }));
-      req.end();
-    });
-  },
-  async pollDeviceToken(deviceCode) {
-    const url = new URL('/api/v1/auth/device/token', API_BASE);
-    const isHttps = url.protocol === 'https:';
-    const httpModule = isHttps ? https : http;
-    return new Promise((resolve, reject) => {
-      const req = httpModule.request(url, {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-          'User-Agent': `bootspring-cli/${require('../package.json').version}`,
-        },
-        timeout: 10000
-      }, (res) => {
-        let body = '';
-        res.on('data', chunk => body += chunk);
-        res.on('end', () => {
-          try {
-            const json = JSON.parse(body);
-            if (res.statusCode >= 400) {
-              const error = new Error(
-                redactSensitiveString(String(json.message || json.error || 'Authorization pending'))
-              );
-              error.status = res.statusCode;
-              error.code = json.error;
-              error.details = redactSensitiveData(json);
-              reject(error);
-            } else {
-              resolve(json);
-            }
-          } catch {
-            reject(new Error('Invalid response from API'));
-          }
-        });
-      });
-      req.on('error', (error) => reject(new Error(redactSensitiveString(error.message || String(error)))));
-      req.on('timeout', () => {
-        req.destroy();
-        reject(new Error('Request timeout'));
-      });
-      req.write(JSON.stringify({ device_code: deviceCode }));
-      req.end();
-    });
-  },
-  // Auth
-  async login(email, password) {
-    const deviceContext = auth.getDeviceContext();
-    const response = await request('POST', '/auth/login', {
-      email,
-      password,
-      device: deviceContext
-    });
-    auth.login(response);
-    return response;
-  },
-  async loginWithApiKey(apiKey, options = {}) {
-    // Validate API key by calling /api/keys/validate
-    const url = new URL('/api/keys/validate', API_BASE);
-    const isHttps = url.protocol === 'https:';
-    const httpModule = isHttps ? https : http;
-    const deviceContext = auth.getDeviceContext();
-    return new Promise((resolve, reject) => {
-      const requestBody = JSON.stringify({
-        apiKey,
-        deviceFingerprint: deviceContext.deviceId,
-        deviceName: `CLI - ${deviceContext.hostname}`
-      });
-      const req = httpModule.request(url, {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-          'User-Agent': `bootspring-cli/${require('../package.json').version}`,
-          'Content-Length': Buffer.byteLength(requestBody)
-        },
-        timeout: 10000
-      }, (res) => {
-        let body = '';
-        res.on('data', chunk => body += chunk);
-        res.on('end', async () => {
-          try {
-            const json = JSON.parse(body);
-            if (res.statusCode >= 400 || !json.valid) {
-              const error = new Error(redactSensitiveString(json.error || 'Invalid API key'));
-              error.status = res.statusCode;
-              error.code = json.error;
-              reject(error);
-            } else {
-              const projectId = options?.projectId || json.project?.id || null;
-              // Build user info from response
-              const user = {
-                tier: json.tier,
-                scopes: json.scopes
-              };
-              // Save API key and user info
-              auth.loginWithApiKey(apiKey, user);
-              // If key has a project, auto-set project context
-              if (json.project) {
-                session.setCurrentProject(json.project);
-                session.addRecentProject(json.project);
-              }
-              if (projectId && auth.saveApiKeyToProject) {
-                auth.saveApiKeyToProject(apiKey);
-              }
-              // Best effort: exchange API key for short-lived project token.
-              try {
-                const exchanged = await exchangeProjectScopedToken(apiKey, projectId);
-                if (auth.saveProjectScopedSession) {
-                  auth.saveProjectScopedSession(exchanged.token, {
-                    expiresAt: exchanged.expiresAt,
-                    source: exchanged.sourcePath,
-                    migratedFromLegacyApiKey: true
-                  });
-                }
-              } catch {
-                // Keep project-bound API key fallback when scoped exchange is unavailable.
-              }
-              resolve({
-                user,
-                project: json.project,
-                device: json.device,
-                usage: json.usage
-              });
-            }
-          } catch {
-            reject(new Error('Invalid response from API'));
-          }
-        });
-      });
-      req.on('error', (error) => reject(new Error(redactSensitiveString(error.message || String(error)))));
-      req.on('timeout', () => {
-        req.destroy();
-        reject(new Error('Request timeout'));
-      });
-      req.write(requestBody);
-      req.end();
-    });
-  },
-  async register(email, password, name) {
-    const deviceContext = auth.getDeviceContext();
-    const response = await request('POST', '/auth/register', {
-      email,
-      password,
-      name,
-      device: deviceContext
-    });
-    auth.login(response);
-    return response;
-  },
-  async me() {
-    requireAuth();
-    return request('GET', '/auth/me');
-  },
-  /**
-   * Validate an API key and get its associated project
-   * @param {string} apiKey - The API key to validate
-   * @returns {Promise<{valid: boolean, tier: string, project: object|null}>}
-   */
-  async validateApiKey(apiKey) {
-    const url = new URL('/api/keys/validate', API_BASE);
-    const isHttps = url.protocol === 'https:';
-    const httpModule = isHttps ? https : http;
-    const deviceContext = auth.getDeviceContext();
-    return new Promise((resolve, reject) => {
-      const requestBody = JSON.stringify({
-        apiKey,
-        deviceFingerprint: deviceContext.deviceId,
-        deviceName: `CLI - ${deviceContext.hostname}`
-      });
-      const req = httpModule.request(url, {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-          'User-Agent': `bootspring-cli/${require('../package.json').version}`,
-          'Content-Length': Buffer.byteLength(requestBody)
-        },
-        timeout: 10000
-      }, (res) => {
-        let body = '';
-        res.on('data', chunk => body += chunk);
-        res.on('end', () => {
-          try {
-            const json = JSON.parse(body);
-            if (res.statusCode >= 400 || !json.valid) {
-              const error = new Error(redactSensitiveString(json.error || 'Invalid API key'));
-              error.status = res.statusCode;
-              reject(error);
-            } else {
-              resolve(json);
-            }
-          } catch {
-            reject(new Error('Invalid response from API'));
-          }
-        });
-      });
-      req.on('error', (error) => reject(new Error(redactSensitiveString(error.message || String(error)))));
-      req.on('timeout', () => {
-        req.destroy();
-        reject(new Error('Request timeout'));
-      });
-      req.write(requestBody);
-      req.end();
-    });
-  },
-  async refreshToken() {
-    const refreshToken = auth.getRefreshToken();
-    if (!refreshToken) {
-      throw new Error('No refresh token available');
-    }
-    const deviceContext = auth.getDeviceContext();
-    const response = await request('POST', '/auth/refresh', {
-      refreshToken,
-      device: deviceContext
-    });
-    auth.updateTokens(response);
-    return response;
-  },
-  async logout() {
-    if (auth.isAuthenticated()) {
-      try {
-        const refreshToken = auth.getRefreshToken();
-        await request('POST', '/auth/logout', { refreshToken });
-      } catch {
-        // Ignore logout API errors
-      }
-    }
-    auth.logout();
-  },
-  // Agents
-  async listAgents() {
-    requireAuth();
-    return request('GET', '/agents');
-  },
-  async getAgent(id) {
-    requireAuth();
-    return request('GET', `/agents/${encodeURIComponent(id)}`);
-  },
-  /**
-   * Get agent context content (requires auth, tier-gated)
-   * @param {string} id - Agent ID
-   * @returns {Promise<{id, name, description, context, tier, checksum?: string}>}
-   */
-  async getAgentContext(id) {
-    requireAuth();
-    const response = await request('GET', `/agents/${encodeURIComponent(id)}`);
-    return response.agent || response;
-  },
-  async invokeAgent(id, projectContext, task) {
-    requireAuth();
-    return request('POST', `/agents/${encodeURIComponent(id)}/invoke`, {
-      projectContext,
-      task
-    });
-  },
-  async getAgentCapabilities(id) {
-    requireAuth();
-    return request('GET', `/agents/${encodeURIComponent(id)}/capabilities`);
-  },
-  // Skills
-  /**
-   * List available skills with tier information
-   * @param {object} options - Filter options
-   * @returns {Promise<{skills: Array, categories: Array, userTier: string}>}
-   */
-  async listSkills(options = {}) {
-    requireAuth();
-    const params = new URLSearchParams();
-    if (options.category) params.append('category', options.category);
-    if (options.search) params.append('search', options.search);
-    const query = params.toString();
-    return request('GET', `/skills${query ? '?' + query : ''}`);
-  },
-  /**
-   * Get skill content (requires auth, tier-gated)
-   * @param {string} skillId - Skill ID (e.g., 'api/route-handler')
-   * @returns {Promise<{id, name, content, tier, checksum?: string}>}
-   */
-  async getSkillContent(skillId) {
-    requireAuth();
-    const response = await request('GET', `/skills/${skillId}`);
-    return response.skill || response;
-  },
-  /**
-   * @deprecated Use getSkillContent instead
-   */
-  async getSkill(category, name) {
-    requireAuth();
-    return request('GET', `/skills/${encodeURIComponent(category)}/${encodeURIComponent(name)}`);
-  },
-  async searchSkills(query, options = {}) {
-    requireAuth();
-    const params = new URLSearchParams();
-    params.append('search', query);
-    if (options.category) params.append('category', options.category);
-    return request('GET', `/skills?${params.toString()}`);
-  },
-  // Templates (thin client - served from API)
-  /**
-   * List available templates in a category
-   * @param {string} category - Template category (business, legal, fundraising, etc.)
-   * @returns {Promise<{templates: Array}>}
-   */
-  async listTemplates(category) {
-    requireAuth();
-    return request('GET', `/templates/${encodeURIComponent(category)}`);
-  },
-  /**
-   * Get template content
-   * @param {string} category - Template category
-   * @param {string} name - Template name/file
-   * @returns {Promise<{name, content, variables}>}
-   */
-  async getTemplate(category, name) {
-    requireAuth();
-    return request('GET', `/templates/${encodeURIComponent(category)}/${encodeURIComponent(name)}`);
-  },
-  // Orchestrator
-  async listWorkflows() {
-    requireAuth();
-    return request('GET', '/orchestrator/workflows');
-  },
-  async getWorkflow(id) {
-    requireAuth();
-    return request('GET', `/orchestrator/workflows/${encodeURIComponent(id)}`);
-  },
-  async analyzeContext(projectContext, currentTask, recentActions) {
-    requireAuth();
-    return request('POST', '/orchestrator/analyze', {
-      projectContext,
-      currentTask,
-      recentActions
-    });
-  },
-  async startWorkflow(workflowId, projectContext, parameters) {
-    requireAuth();
-    return request('POST', '/orchestrator/start', {
-      workflow: workflowId,
-      projectContext,
-      parameters
-    });
-  },
-  async getSuggestions(context, action) {
-    requireAuth();
-    return request('POST', '/orchestrator/suggest', { context, action });
-  },
-  // Quality
-  async listQualityGates() {
-    requireAuth();
-    return request('GET', '/quality/gates');
-  },
-  async runQualityGate(gateId, projectContext, options) {
-    requireAuth();
-    return request('POST', '/quality/run', {
-      gate: gateId,
-      projectContext,
-      options
-    });
-  },
-  async getLintBudgets() {
-    requireAuth();
-    return request('GET', '/quality/lint-budgets');
-  },
-  // MCP
-  async listMcpTools() {
-    requireAuth();
-    return request('GET', '/mcp/tools');
-  },
-  async callMcpTool(tool, args) {
-    requireAuth();
-    return request('POST', '/mcp/tool', { tool, arguments: args });
-  },
-  async listMcpResources() {
-    requireAuth();
-    return request('GET', '/mcp/resources');
-  },
-  async getMcpResource(uri) {
-    requireAuth();
-    const normalizedUri = String(uri || '').replace(/^bootspring:\/\//, '');
-    return request('GET', `/mcp/resources/${encodeURIComponent(normalizedUri)}`);
-  },
-  async listMcpConnectors() {
-    requireAuth();
-    return request('GET', '/mcp/connectors', null, { noCache: true });
-  },
-  async getActiveMcpConnectorMap() {
-    requireAuth();
-    return request('GET', '/mcp/connectors/active', null, { noCache: true });
-  },
-  async setMcpConnectorEnabled(connectorId, enabled) {
-    requireAuth();
-    return request('PATCH', `/mcp/connectors/${encodeURIComponent(connectorId)}`, { enabled });
-  },
-  // Billing
-  async getSubscription() {
-    requireAuth();
-    return request('GET', '/billing/subscription');
-  },
-  async createCheckout(plan) {
-    requireAuth();
-    return request('POST', '/billing/create-checkout', { plan });
-  },
-  async getPortalUrl() {
-    requireAuth();
-    return request('POST', '/billing/portal');
-  },
-  async getUsage() {
-    requireAuth();
-    return request('GET', '/billing/usage');
-  },
-  async getInvoices() {
-    requireAuth();
-    return request('GET', '/billing/invoices');
-  },
-  // Entitlements (v1)
-  async resolveEntitlements() {
-    requireAuth();
-    return request('GET', '/entitlements/resolve', null, { noCache: false });
-  },
-  // Usage Tracking (v1)
-  async trackUsage(type, metadata = {}) {
-    requireAuth();
-    return request('POST', '/track', { type, metadata });
-  },
-  // Telemetry Batch Upload (v1)
-  async uploadTelemetryBatch(events, batchInfo = {}) {
-    requireAuth();
-    const batchId = batchInfo.id || require('crypto').randomUUID();
-    return request('POST', '/events/batch', {
-      source: 'bootspring',
-      batch: {
-        index: batchInfo.index || 0,
-        total: batchInfo.total || 1,
-        id: batchId
-      },
-      events
-    }, {
-      headers: {
-        'X-Bootspring-Batch-Id': batchId
-      }
-    });
-  },
-  // Projects (from /api/auth/device/projects)
-  async listProjects() {
-    requireAuth();
-    // Projects endpoint is under auth, not v1
-    const url = new URL('/api/auth/device/projects', API_BASE);
-    const isHttps = url.protocol === 'https:';
-    const httpModule = isHttps ? https : http;
-    const authHeaders = await resolveAuthHeaders();
-    return new Promise((resolve, reject) => {
-      const headers = {
-        'Content-Type': 'application/json',
-        'User-Agent': `bootspring-cli/${require('../package.json').version}`,
-        ...authHeaders
-      };
-      const req = httpModule.request(url, {
-        method: 'GET',
-        headers,
-        timeout: 10000
-      }, (res) => {
-        let body = '';
-        res.on('data', chunk => body += chunk);
-        res.on('end', () => {
-          try {
-            const json = JSON.parse(body);
-            if (res.statusCode >= 400) {
-              const error = new Error(
-                redactSensitiveString(String(json.message || json.error || 'Failed to list projects'))
-              );
-              error.status = res.statusCode;
-              reject(error);
-            } else {
-              resolve(json);
-            }
-          } catch {
-            reject(new Error('Invalid response from API'));
-          }
-        });
-      });
-      req.on('error', (error) => reject(new Error(redactSensitiveString(error.message || String(error)))));
-      req.on('timeout', () => {
-        req.destroy();
-        reject(new Error('Request timeout'));
-      });
-      req.end();
-    });
-  },
-  // Project Members Management
-  async getProjectMembers(projectId) {
-    requireAuth();
-    return directRequest('GET', `/projects/${encodeURIComponent(projectId)}/members`);
-  },
-  async addProjectMember(projectId, email, role = 'member') {
-    requireAuth();
-    return directRequest('POST', `/projects/${encodeURIComponent(projectId)}/members`, {
-      email,
-      role
-    });
-  },
-  async updateProjectMember(projectId, userId, role) {
-    requireAuth();
-    return directRequest('PATCH', `/projects/${encodeURIComponent(projectId)}/members/${encodeURIComponent(userId)}`, {
-      role
-    });
-  },
-  async removeProjectMember(projectId, userId) {
-    requireAuth();
-    return directRequest('DELETE', `/projects/${encodeURIComponent(projectId)}/members/${encodeURIComponent(userId)}`);
-  },
-  async transferProjectOwnership(projectId, newOwnerId) {
-    requireAuth();
-    return directRequest('POST', `/projects/${encodeURIComponent(projectId)}/transfer`, {
-      newOwnerId
-    });
-  },
-  async listProjectInvitations(projectId) {
-    requireAuth();
-    return directRequest('GET', `/projects/${encodeURIComponent(projectId)}/invitations`);
-  },
-  async inviteProjectMember(projectId, email, role = 'member') {
-    requireAuth();
-    return directRequest('POST', `/projects/${encodeURIComponent(projectId)}/invitations`, {
-      email,
-      role
-    });
-  },
-  async respondToProjectInvitation(invitationId, decision) {
-    requireAuth();
-    return directRequest('POST', `/projects/invitations/${encodeURIComponent(invitationId)}/${decision}`);
-  },
-  async getProjectActivity(projectId, options = {}) {
-    requireAuth();
-    const limit = Number(options.limit);
-    const effectiveLimit = Number.isFinite(limit) && limit > 0 ? Math.min(limit, 200) : 50;
-    return directRequest('GET', `/projects/${encodeURIComponent(projectId)}/activity?limit=${effectiveLimit}`);
-  },
-  async findSimilarProjects(name, repoUrl) {
-    requireAuth();
-    const params = new URLSearchParams();
-    if (name) params.set('name', name);
-    if (repoUrl) params.set('repo', repoUrl);
-    return directRequest('GET', `/projects/similar?${params.toString()}`);
-  },
-  // Preseed Documents
-  /**
-   * List preseed documents for a project
-   * @param {string} projectId - Project ID
-   * @returns {Promise<{documents: Array, count: number, storage: object}>}
-   */
-  async listPreseedDocuments(projectId) {
-    requireAuth();
-    return directRequest('GET', `/projects/${encodeURIComponent(projectId)}/preseed/documents`);
-  },
-  /**
-   * Get a single preseed document content
-   * @param {string} projectId - Project ID
-   * @param {string} documentName - Document name (e.g., 'VISION', 'PRD')
-   * @returns {Promise<{name: string, content: string, format: string}>}
-   */
-  async getPreseedDocument(projectId, documentName) {
-    requireAuth();
-    return directRequest('GET', `/projects/${encodeURIComponent(projectId)}/preseed/documents?name=${encodeURIComponent(documentName)}`);
-  },
-  /**
-   * Download preseed documents as ZIP
-   * @param {string} projectId - Project ID
-   * @returns {Promise<Buffer>} ZIP file buffer
-   */
-  async downloadPreseedZip(projectId) {
-    requireAuth();
-    const authHeaders = await resolveAuthHeaders();
-    const url = new URL(`/api/projects/${encodeURIComponent(projectId)}/preseed/documents?format=zip`, API_BASE);
-    const isHttps = url.protocol === 'https:';
-    const httpModule = isHttps ? https : http;
-    return new Promise((resolve, reject) => {
-      const headers = {
-        'User-Agent': `bootspring-cli/${require('../package.json').version}`,
-        ...authHeaders
-      };
-      const req = httpModule.request(url, {
-        method: 'GET',
-        headers,
-        timeout: 60000
-      }, (res) => {
-        if (res.statusCode >= 400) {
-          let body = '';
-          res.on('data', chunk => body += chunk);
-          res.on('end', () => {
-            try {
-              const json = JSON.parse(body);
-              const error = new Error(
-                redactSensitiveString(String(json.message || json.error || 'Failed to download preseed documents'))
-              );
-              error.status = res.statusCode;
-              reject(error);
-            } catch {
-              reject(new Error(redactSensitiveString(`HTTP ${res.statusCode}: ${body}`)));
-            }
-          });
-          return;
-        }
-        const chunks = [];
-        res.on('data', chunk => chunks.push(chunk));
-        res.on('end', () => {
-          resolve(Buffer.concat(chunks));
-        });
-      });
-      req.on('error', (error) => reject(new Error(redactSensitiveString(error.message || String(error)))));
-      req.on('timeout', () => {
-        req.destroy();
-        reject(new Error('Request timeout'));
-      });
-      req.end();
-    });
-  },
-  /**
-   * Get preseed wizard data for a project
-   * @param {string} projectId - Project ID
-   * @returns {Promise<{wizardData: object, progress: object}>}
-   */
-  async getPreseedWizard(projectId) {
-    requireAuth();
-    return directRequest('GET', `/projects/${encodeURIComponent(projectId)}/preseed/wizard`);
-  },
-  /**
-   * Enrich preseed content generated from codebase analysis.
-   * Uses a versioned contract and endpoint fallback for bootspring-site rollouts.
-   * @param {object} payload - Enrichment request payload
-   * @param {object} options - Request options
-   * @returns {Promise<object>} Enrichment response
-   */
-  async enrichCodebasePreseed(payload = {}, options = {}) {
-    requireAuth();
-    const contractVersion = typeof payload.contractVersion === 'string' && payload.contractVersion.trim()
-      ? payload.contractVersion.trim()
-      : 'preseed-enrichment.v1';
-    const body = {
-      ...payload,
-      contractVersion
-    };
-    const requestedPaths = Array.isArray(options.paths)
-      ? options.paths.filter((candidate) => typeof candidate === 'string' && candidate.trim())
-      : [];
-    const candidatePaths = [...new Set([...requestedPaths, ...PRESEED_CODEBASE_ENRICHMENT_PATHS])];
-    const requestOptions = {
-      timeout: Number(options.timeout) > 0 ? Number(options.timeout) : 60000,
-      noCache: true,
-      headers: {
-        ...(options.headers || {}),
-        'X-Bootspring-Contract': contractVersion
-      }
-    };
-    let lastError = null;
-    for (const endpoint of candidatePaths) {
-      try {
-        return await request('POST', endpoint, body, requestOptions);
-      } catch (error) {
-        lastError = error;
-        const status = Number(error?.status);
-        if (status === 404 || status === 405 || status === 501) {
-          continue;
-        }
-        throw error;
-      }
-    }
-    const unavailable = new Error('Remote enrichment endpoint unavailable');
-    unavailable.code = 'ENRICHMENT_ENDPOINT_UNAVAILABLE';
-    unavailable.details = { attemptedPaths: candidatePaths };
-    if (lastError && typeof lastError.status === 'number') {
-      unavailable.status = lastError.status;
-    }
-    throw unavailable;
-  },
-  // =====================================================
-  // Organization Methods
-  // =====================================================
-  /**
-   * List organizations for current user
-   * @returns {Promise<Array>} List of organizations
-   */
-  async listOrganizations() {
-    requireAuth();
-    return request('GET', '/organizations');
-  },
-  /**
-   * Get organization details
-   * @param {string} orgId - Organization ID
-   * @returns {Promise<object>} Organization details with members
-   */
-  async getOrganization(orgId) {
-    requireAuth();
-    return request('GET', `/organizations/${encodeURIComponent(orgId)}`);
-  },
-  /**
-   * Get organization policy
-   * @param {string} orgId - Organization ID
-   * @returns {Promise<object>} Organization policy settings
-   */
-  async getOrgPolicy(orgId) {
-    requireAuth();
-    return request('GET', `/organizations/${encodeURIComponent(orgId)}/policy`);
-  },
-  /**
-   * Update organization policy
-   * @param {string} orgId - Organization ID
-   * @param {object} policy - Policy settings to update
-   * @returns {Promise<object>} Updated policy
-   */
-  async updateOrgPolicy(orgId, policy) {
-    requireAuth();
-    return request('PATCH', `/organizations/${encodeURIComponent(orgId)}/policy`, policy);
-  },
-  /**
-   * List organization members
-   * @param {string} orgId - Organization ID
-   * @returns {Promise<Array>} List of members
-   */
-  async listOrgMembers(orgId) {
-    requireAuth();
-    return request('GET', `/organizations/${encodeURIComponent(orgId)}/members`);
-  },
-  /**
-   * Get member policy overrides
-   * @param {string} orgId - Organization ID
-   * @param {string} userId - User ID
-   * @returns {Promise<object>} Member policy overrides
-   */
-  async getMemberPolicy(orgId, userId) {
-    requireAuth();
-    return request('GET', `/organizations/${encodeURIComponent(orgId)}/members/${encodeURIComponent(userId)}/policy`);
-  },
-  /**
-   * Update member policy overrides
-   * @param {string} orgId - Organization ID
-   * @param {string} userId - User ID
-   * @param {object} policy - Policy overrides
-   * @returns {Promise<object>} Updated member policy
-   */
-  async updateMemberPolicy(orgId, userId, policy) {
-    requireAuth();
-    return request('PATCH', `/organizations/${encodeURIComponent(orgId)}/members/${encodeURIComponent(userId)}/policy`, policy);
-  }
-};
-module.exports = {
-  API_BASE,
-  API_VERSION,
-  request,
-  directRequest,
-  clearCache,
-  healthCheck,
-  requireAuth,
-  ...api
-};