@graph8/sdk 0.370.0 → 0.374.0

package/dist/cli.js

@@ -36,8 +36,8 @@ __export(cli_exports, {
 });
 module.exports = __toCommonJS(cli_exports);
 var import_node_child_process = require("child_process");
-var import_node_fs9 = __toESM(require("fs"));
-var import_node_path10 = __toESM(require("path"));
+var import_node_fs11 = __toESM(require("fs"));
+var import_node_path12 = __toESM(require("path"));
 
 // src/agentSetup.ts
 var ALL_TARGETS = ["claude", "codex", "cursor"];
@@ -119,9 +119,9 @@ ${section}
 }
 function planAgentSetup(targets, read, catalog) {
   const plans = [];
-  const add = (target, path11, next) => {
-    const current = read(path11);
-    plans.push({ target, path: path11, content: next, action: current === null ? "create" : current === next ? "unchanged" : "update" });
+  const add = (target, path13, next) => {
+    const current = read(path13);
+    plans.push({ target, path: path13, content: next, action: current === null ? "create" : current === next ? "unchanged" : "update" });
   };
   for (const target of targets) {
     if (target === "claude") add(target, ".claude/skills/graph8-sdk/SKILL.md", claudeSkill(catalog));
@@ -158,7 +158,7 @@ var import_node_fs4 = __toESM(require("fs"));
 var import_node_path5 = __toESM(require("path"));
 
 // src/version.ts
-var SDK_VERSION = "0.370.0";
+var SDK_VERSION = "0.374.0";
 var SDK_CLIENT_ID = `js-sdk/${SDK_VERSION}`;
 
 // src/blocks/paths.ts
@@ -4618,6 +4618,10 @@ Brand an app made by \`create\` (run it in the app's root). Every option is opti
   --logo <path>              an svg, png, jpg, webp or gif (max 512 KB), copied to public/brand/ and shown in the sidebar
   --app-url <url>            white-label: where link-outs go (default https://app.graph8.com)
   --link-label <text>        white-label: what the platform is called in copy and links (default graph8)
+  --from-org                 fill in what you did not pass from the organization's Brand Kit (needs G8_API_KEY in the
+                             environment or .env.local): name, primary colour, logo. Running brand with no options
+                             does the same when the kit has something. Values you pass always win; they replace what the app has now.
+  --no-org-brand             never read the Brand Kit
   --dir <path>               the app's root (default: current directory)
   --dry-run                  print what would change, write nothing
 Running it again with the same options changes nothing.`;
@@ -4650,17 +4654,30 @@ ${BRAND_USAGE}`);
     if (takeBrandFlag(o, flag, next)) continue;
     if (flag === "--dir") o.dir = next();
     else if (arg === "--dry-run") o.dryRun = true;
+    else if (arg === "--from-org") o.fromOrg = true;
+    else if (arg === "--no-org-brand") o.noOrgBrand = true;
     else throw new Error(`unknown option ${arg}
 
 ${BRAND_USAGE}`);
   }
-  if (!hasBrandInput(o)) throw new Error(`brand needs at least one of --name, --brand-color, --dark-brand-color, --logo, --app-url, --link-label
+  if (o.fromOrg && o.noOrgBrand) throw new Error(`--from-org and --no-org-brand contradict each other
+
+${BRAND_USAGE}`);
+  if (!hasBrandInput(o) && !o.fromOrg) throw new Error(`brand needs at least one of --name, --brand-color, --dark-brand-color, --logo, --app-url, --link-label
 
 ${BRAND_USAGE}`);
   return o;
 }
 var LOGO_TYPES = ["svg", "png", "jpg", "jpeg", "webp", "gif"];
 var MAX_LOGO_BYTES = 512 * 1024;
+function mergeOrgBrand(explicit, org, skip = {}) {
+  const e = explicit ?? {};
+  const out = { ...e };
+  if (e.name === void 0 && !skip.name && org.name) out.name = org.name;
+  if (e.color === void 0 && e.darkColor === void 0 && org.color) out.color = org.color;
+  if (e.logo === void 0 && org.logo) out.logo = org.logo;
+  return out;
+}
 function brandProblem(o, cwd) {
   if (o.name !== void 0 && !o.name.trim()) return "--name cannot be empty";
   if (o.linkLabel !== void 0 && !o.linkLabel.trim()) return "--link-label cannot be empty";
@@ -4731,7 +4748,11 @@ function same(abs, content) {
   const cur = import_node_fs5.default.readFileSync(abs);
   return Buffer.isBuffer(content) ? cur.equals(content) : cur.toString("utf8") === content;
 }
-function runBrand(o, io, cwd, fallbackName) {
+function runBrand(given, io, cwd, fallbackName, org) {
+  const o = org && given.fromOrg ? mergeOrgBrand(given, org) : given;
+  if (given.fromOrg && !hasBrandInput(o)) {
+    return io.out("nothing to apply from the Brand Kit"), 0;
+  }
   const root = import_node_path6.default.resolve(cwd, o.dir);
   if (!import_node_fs5.default.existsSync(import_node_path6.default.join(root, "package.json"))) {
     io.err(`no package.json in ${root}. Run this from your app's root, or pass --dir.`);
@@ -4769,348 +4790,10 @@ ${BRAND_USAGE}`), 1;
   return 0;
 }
 
-// src/blocks/create.ts
-var import_node_fs6 = __toESM(require("fs"));
-var import_node_path7 = __toESM(require("path"));
-var CREATE_USAGE = `Usage: npx @graph8/sdk create <stack> <dir> [options]
-
-Scaffold a Next.js (App Router, TypeScript, Tailwind CSS v4) app for a stack and
-install the stack's blocks into it. Run \`graph8-sdk list\` to see the stacks.
-  --package-manager <npm|pnpm|yarn|bun>   default: the one running the command, else npm
-  --no-install      write the files and blocks, do not install dependencies
-  --dry-run         print what would be written, write and install nothing
-  --force           allow a non-empty <dir> (template files are overwritten, and graph8.json
-                    is reset: blocks you added to that app earlier are no longer recorded)
-Then: \`npm run dev\` in <dir>, open http://localhost:3000 and paste a graph8 API key (local preview), and run
-\`npx @graph8/sdk doctor --stack <stack>\` (add --production before going live).
-
-Or pick the features yourself, for any app (also: \`create custom --blocks ...\`):
-  npx @graph8/sdk create --blocks <id,id,...> [--title "Acme CRM"] <dir> [options]
-Every requested block's dependencies come with it. The app gets one route and one sidebar entry per finished
-Screen of the requested blocks, plus the user-facing Screens of their dependencies (asking for deals also gives
-you crm's screens). \`/\` opens the analytics screen if you asked for one, else the first screen.
-  --title <text>          the app's name (default: graph8 app)
-  --with-deps-screens     also add the plain fallback page of dependency blocks that have no Screen
-  --no-deps-screens       add screens only for the blocks you named
-Run \`graph8-sdk list\` to see each block and which have Screens.
-
-Brand it (any stack or --blocks; the same as running \`graph8-sdk brand\` in the new app afterwards):
-  --name <text>             the app's name (with --blocks, the same as --title)
-  --brand-color <hex>       primary colour, AA-checked; --dark-brand-color <hex> for dark mode
-  --logo <path>             svg/png/jpg/webp/gif, shown in the sidebar
-  --app-url <url>           white-label: where "Open in graph8" links go; --link-label <text>: what they call it
-A directory literally named \`custom\` would read as the alias: pass \`--blocks crm ./custom\`.`;
-var PACKAGE_MANAGERS = ["npm", "pnpm", "yarn", "bun"];
-function parseCreateArgs(argv) {
-  const o = { stack: "", dir: "", install: true, dryRun: false, force: false };
-  const positional = [];
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i];
-    const eq = arg.startsWith("--") ? arg.indexOf("=") : -1;
-    const [flag, inline] = eq > 0 ? [arg.slice(0, eq), arg.slice(eq + 1)] : [arg, void 0];
-    if (flag === "--package-manager") {
-      const v = inline ?? argv[++i];
-      if (!PACKAGE_MANAGERS.includes(v)) throw new Error(`--package-manager must be one of ${PACKAGE_MANAGERS.join(", ")}
-
-${CREATE_USAGE}`);
-      o.packageManager = v;
-    } else if (flag === "--blocks") {
-      const v = inline ?? argv[++i];
-      if (v === void 0 || v.startsWith("--")) throw new Error(`--blocks needs a comma-separated list of block ids
-
-${CREATE_USAGE}`);
-      o.blocks = [...o.blocks ?? [], ...v.split(",").map((x) => x.trim()).filter(Boolean)];
-    } else if (flag === "--title") {
-      const v = inline ?? argv[++i];
-      if (v === void 0 || v.startsWith("--")) throw new Error(`--title needs a value
-
-${CREATE_USAGE}`);
-      o.title = v;
-    } else if (takeBrandFlag(o.brand ??= {}, flag, () => {
-      const v = inline ?? argv[++i];
-      if (v === void 0 || v.startsWith("--")) throw new Error(`${flag} needs a value
-
-${CREATE_USAGE}`);
-      return v;
-    })) {
-    } else if (arg === "--with-deps-screens") o.depsScreens = "with";
-    else if (arg === "--no-deps-screens") o.depsScreens = "none";
-    else if (arg === "--no-install") o.install = false;
-    else if (arg === "--dry-run") o.dryRun = true;
-    else if (arg === "--force") o.force = true;
-    else if (arg.startsWith("-")) throw new Error(`unknown option ${arg}
-
-${CREATE_USAGE}`);
-    else positional.push(arg);
-  }
-  if (o.brand && !hasBrandInput(o.brand)) delete o.brand;
-  if (o.brand?.name !== void 0 && o.title !== void 0 && o.brand.name !== o.title) throw new Error(`--name and --title name the same thing: pass one
-
-${CREATE_USAGE}`);
-  if (o.blocks || positional[0] === "custom") return parseCustom(o, positional);
-  if (o.title || o.depsScreens) throw new Error(`--title, --with-deps-screens and --no-deps-screens go with --blocks
-
-${CREATE_USAGE}`);
-  if (positional.length !== 2) throw new Error(`create needs a stack and a directory
-
-${CREATE_USAGE}`);
-  [o.stack, o.dir] = positional;
-  return o;
-}
-function parseCustom(o, positional) {
-  const rest = positional[0] === "custom" ? positional.slice(1) : positional;
-  if (!o.blocks?.length) throw new Error(`create custom needs --blocks <id,id,...> (see \`graph8-sdk list\`)
-
-${CREATE_USAGE}`);
-  if (rest.length !== 1) {
-    throw new Error(`${rest.length ? "a stack name cannot be combined with --blocks; pass only the directory" : "create --blocks needs a directory"}
-
-${CREATE_USAGE}`);
-  }
-  return { ...o, stack: "custom", dir: rest[0] };
-}
-function packageManagerFromUserAgent(ua) {
-  const name = /^(npm|pnpm|yarn|bun)\//.exec(ua ?? "")?.[1];
-  return name ?? "npm";
-}
-function appNameFor(dir) {
-  const base = import_node_path7.default.basename(import_node_path7.default.resolve(dir)).toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^[._-]+|-+$/g, "");
-  return base || "g8-app";
-}
-var quoted = (p) => /^[\w@%+=:,./-]+$/.test(p) ? p : JSON.stringify(p);
-function walk(dir, base = dir) {
-  const out = [];
-  for (const e of import_node_fs6.default.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-    const full = import_node_path7.default.join(dir, e.name);
-    if (e.isDirectory()) out.push(...walk(full, base));
-    else out.push(posix(import_node_path7.default.relative(base, full)));
-  }
-  return out;
-}
-function outputName(rel) {
-  const noExt = rel.replace(/\.tmpl$/, "");
-  const dir = import_node_path7.default.posix.dirname(noExt);
-  const base = import_node_path7.default.posix.basename(noExt).replace(/^dot-/, ".");
-  return dir === "." ? base : `${dir}/${base}`;
-}
-function stackProblem(reg, stack) {
-  const { missing } = stackStatus(reg, stack);
-  if (missing.length) {
-    const ready = reg.stacks.filter((s) => !stackStatus(reg, s).missing.length).map((s) => s.id);
-    return [
-      `stack "${stack.id}" is planned: these blocks are not in this version of @graph8/sdk yet: ${missing.join(", ")}.`,
-      `Stacks you can create now: ${ready.join(", ") || "none"}. Or create one of those and add blocks as they ship (\`graph8-sdk add <block>\`).`
-    ].join("\n");
-  }
-  const seen = /* @__PURE__ */ new Set();
-  const homeIssue = homeProblem(stack);
-  if (homeIssue) return homeIssue;
-  for (const n of stack.nav) {
-    const block = findBlock(reg, n.block);
-    if (!stack.blocks.includes(n.block)) return `stack "${stack.id}" nav "${n.label}" uses block "${n.block}" which the stack does not include.`;
-    if (!block?.components.some((c) => c.name === n.component)) return `stack "${stack.id}" nav "${n.label}" uses ${n.component}, which block "${n.block}" does not declare.`;
-    if (/[\[\]]/.test(n.path)) return `stack "${stack.id}" nav "${n.label}" uses ${n.path}: dynamic segments cannot be a sidebar link.`;
-    if (seen.has(n.path)) return `stack "${stack.id}" has two nav entries at ${n.path}.`;
-    seen.add(n.path);
-    if (n.page && (!reg.stacksRoot || !import_node_fs6.default.existsSync(import_node_path7.default.join(reg.stacksRoot, stack.id, n.page)))) {
-      return `stack "${stack.id}" nav "${n.label}" uses page ${n.page}, which does not exist under stacks/${stack.id}/.`;
-    }
-  }
-  return null;
-}
-function homeProblem(stack) {
-  if (!stack.home) return null;
-  if (!stack.nav.some((n) => n.path === stack.home)) return `stack "${stack.id}" has home ${stack.home}, which is not one of its nav paths.`;
-  if (stack.home !== "/" && stack.nav.some((n) => n.path === "/")) return `stack "${stack.id}" has home ${stack.home} but also a nav entry at "/": drop one.`;
-  return null;
-}
-function stackPageFile(reg, stack, n) {
-  return n.page && reg.stacksRoot ? import_node_path7.default.join(reg.stacksRoot, stack.id, n.page) : null;
-}
-function homeRedirect(stack) {
-  if (stack.home) return stack.home === "/" ? null : stack.home;
-  return stack.nav.length && !stack.nav.some((n) => n.path === "/") ? stack.nav[0].path : null;
-}
-function renderPages(reg, stack, templates) {
-  const pageTpl = import_node_fs6.default.readFileSync(import_node_path7.default.join(templates, "_pages", "route-page.tsx.tmpl"), "utf8");
-  const files = stack.nav.map((n) => {
-    const block = findBlock(reg, n.block);
-    const comp = block.components.find((c) => c.name === n.component);
-    const custom = stackPageFile(reg, stack, n);
-    const vars2 = {
-      stackId: stack.id,
-      block: block.id,
-      blockDir: `components/g8/${block.dir}`,
-      component: n.component,
-      importPath: componentImportPath(block, comp.file),
-      propsJson: JSON.stringify(n.props ?? {}, null, 2)
-    };
-    return { rel: pageFileFor(n.path), content: render(custom ? import_node_fs6.default.readFileSync(custom, "utf8") : pageTpl, vars2) };
-  });
-  const to = homeRedirect(stack);
-  if (to) {
-    const redirect = import_node_fs6.default.readFileSync(import_node_path7.default.join(templates, "_pages", "redirect-page.tsx.tmpl"), "utf8");
-    files.push({ rel: "app/page.tsx", content: render(redirect, { firstPathJson: JSON.stringify(to) }) });
-  }
-  return files;
-}
-function peerDependenciesFor(blocks, io, stack) {
-  const peers = {};
-  for (const b of blocks) for (const [name, range] of Object.entries(b.peerDependencies)) peers[name] ??= range;
-  const usesUi = blocks.some((b) => walk(b.root).some((f) => /\.(tsx?|jsx?)$/.test(f) && /["']@graph8\/sdk\/ui["'/]/.test(import_node_fs6.default.readFileSync(import_node_path7.default.join(b.root, f), "utf8"))));
-  if (usesUi && io.sdkPackageJson && import_node_fs6.default.existsSync(io.sdkPackageJson)) {
-    const sdk = JSON.parse(import_node_fs6.default.readFileSync(io.sdkPackageJson, "utf8"));
-    for (const [name, range] of Object.entries(sdk.peerDependencies ?? {})) peers[name] ??= range;
-  }
-  if (navUsesExtras(stack.nav)) peers["lucide-react"] ??= lucideRange(io);
-  return peers;
-}
-function lucideRange(io) {
-  try {
-    const sdk = JSON.parse(import_node_fs6.default.readFileSync(io.sdkPackageJson ?? "", "utf8"));
-    return sdk.peerDependencies?.["lucide-react"] ?? ">=0.400.0";
-  } catch {
-    return ">=0.400.0";
-  }
-}
-function mergedPackageJson(rendered, peers) {
-  const pkg = JSON.parse(rendered);
-  for (const [name, range] of Object.entries(peers)) pkg.dependencies[name] ??= range;
-  pkg.dependencies = Object.fromEntries(Object.entries(pkg.dependencies).sort(([a], [b]) => a.localeCompare(b)));
-  return `${JSON.stringify(pkg, null, 2)}
-`;
-}
-function planCreate(reg, stack, appName, pm, io, app) {
-  const templates = import_node_path7.default.join(io.templatesRoot, "next-app");
-  const blocks = resolveWithDeps(reg, stack.blocks);
-  const devCommand = pm === "npm" ? "npm run dev" : `${pm} dev`;
-  const vars2 = {
-    appName,
-    sdkVersion: SDK_VERSION,
-    stackId: stack.id,
-    title: stack.title,
-    titleJson: JSON.stringify(stack.title),
-    ...navParts(stack),
-    devCommand,
-    installCommand: `${pm} install`,
-    doctorCommand: app ? "npx @graph8/sdk doctor" : `npx @graph8/sdk doctor --stack ${stack.id}`,
-    screens: stack.nav.map((n) => `- ${n.label}: \`${n.path}\` (${n.block} block, \`${n.component}\`)`).join("\n") || "- (none yet: add a block with `npx @graph8/sdk add <block>`)"
-  };
-  const files = [];
-  for (const rel of walk(templates).filter((f) => !f.startsWith("_pages/"))) {
-    let content = render(import_node_fs6.default.readFileSync(import_node_path7.default.join(templates, rel), "utf8"), vars2);
-    if (rel === "package.json.tmpl") content = mergedPackageJson(content, peerDependenciesFor(blocks, io, stack));
-    files.push({ rel: outputName(rel), content });
-  }
-  files.push(...renderPages(reg, stack, templates));
-  files.push({ rel: CONFIG_FILE, content: renderBrandConfig({ name: stack.title, ...DEFAULT_FIELDS }) });
-  const ledger = { sdkVersion: SDK_VERSION, target: "components/g8", stack: stack.id, ...app ? { app } : {}, blocks: {} };
-  files.push({ rel: "graph8.json", content: `${JSON.stringify(ledger, null, 2)}
-` });
-  return files;
-}
-function dirProblem(abs, force) {
-  if (!import_node_fs6.default.existsSync(abs)) return null;
-  if (!import_node_fs6.default.statSync(abs).isDirectory()) return `${abs} exists and is not a directory.`;
-  if (force || import_node_fs6.default.readdirSync(abs).length === 0) return null;
-  return `${abs} is not empty. Pick a new directory, or pass --force to write into it (template files are overwritten).`;
-}
-function runCreate(opts, reg, io, cwd) {
-  let app;
-  let stack = opts.blocks ? void 0 : reg.stacks.find((s) => s.id === opts.stack);
-  if (opts.blocks) {
-    let composed;
-    try {
-      composed = composeApp(reg, opts.blocks, { title: opts.title, withDepsScreens: opts.depsScreens === "with", noDepsScreens: opts.depsScreens === "none" });
-    } catch (e) {
-      io.err(e.message);
-      return 1;
-    }
-    stack = composed.stack;
-    app = { title: stack.title, blocks: [...new Set(opts.blocks)], screens: composed.screens.map((x) => ({ block: x.block, component: x.component, path: x.path })) };
-    composed.warnings.forEach((w) => io.err(`warning: ${w}`));
-  } else if (!stack) {
-    io.err(`unknown stack "${opts.stack}". Stacks: ${reg.stacks.map((s) => s.id).join(", ") || "none"} (\`graph8-sdk list\`).`);
-    return 1;
-  }
-  if (!stack) return 1;
-  const name = opts.brand?.name?.trim();
-  if (name) {
-    stack = { ...stack, title: name };
-    if (app) app = { ...app, title: name };
-  }
-  const problem = stackProblem(reg, stack);
-  if (problem) return io.err(problem), 1;
-  const abs = import_node_path7.default.resolve(cwd, opts.dir);
-  const dirIssue = dirProblem(abs, opts.force);
-  if (dirIssue) return io.err(dirIssue), 1;
-  const brandIssue = opts.brand ? brandProblem(opts.brand, cwd) : null;
-  if (brandIssue) return io.err(brandIssue), 1;
-  const pm = opts.packageManager ?? packageManagerFromUserAgent(io.userAgent);
-  let files;
-  try {
-    files = planCreate(reg, stack, appNameFor(opts.dir), pm, io, app);
-  } catch (e) {
-    io.err(e.message);
-    return 1;
-  }
-  const blocks = resolveWithDeps(reg, stack.blocks);
-  io.out(`${opts.dryRun ? "Dry run: " : ""}creating "${stack.title}" (${app ? `custom: ${app.blocks.join(", ")}` : stack.id}) in ${opts.dir}`);
-  for (const f of files) io.out(`${opts.dryRun ? "would write" : "write"} ${f.rel}`);
-  if (opts.dryRun) {
-    io.out(`would add blocks: ${blocks.map((b) => b.id).join(", ")}`);
-    if (opts.brand) io.out(`would brand the app: ${Object.entries(opts.brand).map(([k, v]) => `${k} ${v}`).join(", ")}`);
-    io.out(opts.install ? `would run: ${pm} install` : "would not install dependencies (--no-install)");
-    return 0;
-  }
-  for (const f of files) {
-    const dest = import_node_path7.default.join(abs, f.rel);
-    import_node_fs6.default.mkdirSync(import_node_path7.default.dirname(dest), { recursive: true });
-    import_node_fs6.default.writeFileSync(dest, f.content, "utf8");
-  }
-  return finish(opts, reg, stack, blocks, abs, pm, io, cwd);
-}
-function finish(opts, reg, stack, blocks, abs, pm, io, cwd) {
-  for (const b of blocks) {
-    const code = runAdd({ spec: b.id, dir: abs, target: "components/g8", dryRun: false, force: opts.force, install: false, wireScreens: false }, reg, io, cwd);
-    if (code !== 0) {
-      io.err(`adding block "${b.id}" failed; the app in ${opts.dir} is incomplete.`);
-      return code;
-    }
-  }
-  if (opts.brand) {
-    io.out("branding the app (graph8-sdk brand)");
-    const code = runBrand({ ...opts.brand, dir: abs }, io, cwd, stack.title);
-    if (code !== 0) {
-      io.err(`branding failed; the app in ${opts.dir} is complete but unbranded. Fix the option and run \`npx @graph8/sdk brand\` in it.`);
-      return code;
-    }
-  }
-  if (opts.install) {
-    io.out(`installing dependencies: ${pm} install`);
-    const code = io.spawn(pm, ["install"], abs);
-    if (code !== 0) {
-      io.err(`dependency install failed (exit ${code}). Run it yourself: cd ${quoted(opts.dir)} && ${pm} install`);
-      return 1;
-    }
-  }
-  const cd = opts.dir === "." ? "" : `cd ${quoted(opts.dir)} && `;
-  io.out(
-    [
-      "",
-      `Done. Next:`,
-      `  1. ${cd}${opts.install ? "" : `${pm} install && `}${pm === "npm" ? "npm run dev" : `${pm} dev`}`,
-      `  2. open http://localhost:3000 and paste a graph8 API key in the Connect graph8 screen (local preview: only`,
-      `     this computer can reach the app's /api/g8 route), or set G8_API_KEY in ${import_node_path7.default.posix.join(opts.dir, ".env.local")}`,
-      `  3. ${cd}npx @graph8/sdk doctor${opts.blocks ? "" : ` --stack ${stack.id}`}   (before going live: add --production)`
-    ].join("\n")
-  );
-  return 0;
-}
-
-// src/blocks/doctor.ts
-var import_node_fs8 = __toESM(require("fs"));
-var import_node_path9 = __toESM(require("path"));
+// src/blocks/orgBrand.ts
+var import_node_fs8 = __toESM(require("fs"));
+var import_node_os = __toESM(require("os"));
+var import_node_path9 = __toESM(require("path"));
 
 // src/generated/billable.ts
 var BILLABLE_ROUTES = {
@@ -5935,7 +5618,7 @@ function warnIfTargetOrgIgnored(apiKey, headers) {
     );
   }
 }
-async function request(baseUrl, path11, apiKey, opts = {}) {
+async function request(baseUrl, path13, apiKey, opts = {}) {
   const {
     method = "GET",
     body,
@@ -5948,7 +5631,7 @@ async function request(baseUrl, path11, apiKey, opts = {}) {
     fetchImpl = fetch,
     sleepImpl = defaultSleep
   } = opts;
-  const url = baseUrl.replace(/\/+$/, "") + path11 + buildQuery(query);
+  const url = baseUrl.replace(/\/+$/, "") + path13 + buildQuery(query);
   const finalHeaders = {
     "Content-Type": "application/json",
     Authorization: `Bearer ${apiKey}`,
@@ -6108,9 +5791,13 @@ function createApiClient(apiKey, apiUrl) {
   return client;
 }
 
-// src/blocks/flows.ts
+// src/blocks/doctor.ts
 var import_node_fs7 = __toESM(require("fs"));
 var import_node_path8 = __toESM(require("path"));
+
+// src/blocks/flows.ts
+var import_node_fs6 = __toESM(require("fs"));
+var import_node_path7 = __toESM(require("path"));
 var IMPORT_RE2 = /(?:^|\n)\s*(?:import|export)\s[^'"`;]*?from\s*["']([^"']+)["']|(?:^|\n)\s*import\s*["']([^"']+)["']|import\(\s*["']([^"']+)["']\s*\)/g;
 var EXTENSIONS = ["", ".tsx", ".ts", "/index.tsx", "/index.ts"];
 function specifiers(source) {
@@ -6119,18 +5806,18 @@ function specifiers(source) {
 function resolveFile(base) {
   for (const ext of EXTENSIONS) {
     const candidate = base + ext;
-    if (import_node_fs7.default.existsSync(candidate) && import_node_fs7.default.statSync(candidate).isFile()) return candidate;
+    if (import_node_fs6.default.existsSync(candidate) && import_node_fs6.default.statSync(candidate).isFile()) return candidate;
   }
   return null;
 }
 function resolveImport(spec, from, reg) {
-  if (spec.startsWith(".")) return resolveFile(import_node_path8.default.resolve(import_node_path8.default.dirname(from), spec));
+  if (spec.startsWith(".")) return resolveFile(import_node_path7.default.resolve(import_node_path7.default.dirname(from), spec));
   const g8 = /^@\/g8\/([^/]+)\/(.+)$/.exec(spec);
   if (!g8) return null;
   const owner = findBlock(reg, g8[1]);
-  if (owner) return resolveFile(import_node_path8.default.join(owner.root, "components", g8[2])) ?? resolveFile(import_node_path8.default.join(owner.root, g8[2]));
+  if (owner) return resolveFile(import_node_path7.default.join(owner.root, "components", g8[2])) ?? resolveFile(import_node_path7.default.join(owner.root, g8[2]));
   const foundation = findBlock(reg, "foundation");
-  return foundation ? resolveFile(import_node_path8.default.join(foundation.root, g8[1], g8[2])) : null;
+  return foundation ? resolveFile(import_node_path7.default.join(foundation.root, g8[1], g8[2])) : null;
 }
 function resolveInstalled(spec, reg) {
   const m = /^@\/components\/g8\/([^/]+)\/(.+)$/.exec(spec);
@@ -6138,7 +5825,7 @@ function resolveInstalled(spec, reg) {
   if (!m || !block) return null;
   const files = [...block.components, ...block.hooks, ...block.lib].map((x) => x.file);
   const hit = files.find((f) => (installedRel(f) ?? f).replace(/\.(tsx|ts|jsx|js)$/, "") === m[2]);
-  return hit ? import_node_path8.default.join(block.root, hit) : null;
+  return hit ? import_node_path7.default.join(block.root, hit) : null;
 }
 function seeds(reg, stack) {
   const out = [];
@@ -6146,13 +5833,13 @@ function seeds(reg, stack) {
     const comp = findBlock(reg, n.block)?.components.find((c) => c.name === n.component);
     const block = findBlock(reg, n.block);
     if (!block || !comp) continue;
-    const pageFile = n.page && reg.stacksRoot ? import_node_path8.default.join(reg.stacksRoot, stack.id, n.page) : null;
-    if (!pageFile || !import_node_fs7.default.existsSync(pageFile)) {
-      out.push(import_node_path8.default.join(block.root, comp.file));
+    const pageFile = n.page && reg.stacksRoot ? import_node_path7.default.join(reg.stacksRoot, stack.id, n.page) : null;
+    if (!pageFile || !import_node_fs6.default.existsSync(pageFile)) {
+      out.push(import_node_path7.default.join(block.root, comp.file));
       continue;
     }
-    const source = import_node_fs7.default.readFileSync(pageFile, "utf8");
-    if (source.includes("{{importPath}}")) out.push(import_node_path8.default.join(block.root, comp.file));
+    const source = import_node_fs6.default.readFileSync(pageFile, "utf8");
+    if (source.includes("{{importPath}}")) out.push(import_node_path7.default.join(block.root, comp.file));
     for (const spec of specifiers(source)) {
       const hit = resolveInstalled(spec, reg);
       if (hit) out.push(hit);
@@ -6168,17 +5855,18 @@ function reachedFiles(reg, stack) {
     if (seen.has(file)) continue;
     seen.add(file);
     if (!/\.(tsx?|jsx?)$/.test(file)) continue;
-    for (const spec of specifiers(import_node_fs7.default.readFileSync(file, "utf8"))) {
+    for (const spec of specifiers(import_node_fs6.default.readFileSync(file, "utf8"))) {
       const next = resolveImport(spec, file, reg);
       if (next && !seen.has(next)) queue.push(next);
     }
   }
   return seen;
 }
+var LIBRARY_BLOCKS = /* @__PURE__ */ new Set(["foundation", "pickers"]);
 function unreachedComponents(reg, stack) {
   const reached = reachedFiles(reg, stack);
-  const blocks = resolveWithDeps(reg, stack.blocks).filter((b) => b.id !== "foundation" && stack.blocks.includes(b.id));
-  return blocks.flatMap((b) => b.components.filter((c) => !reached.has(import_node_path8.default.join(b.root, c.file))).map((c) => ({ block: b.id, component: c.name })));
+  const blocks = resolveWithDeps(reg, stack.blocks).filter((b) => !LIBRARY_BLOCKS.has(b.id) && stack.blocks.includes(b.id));
+  return blocks.flatMap((b) => b.components.filter((c) => !reached.has(import_node_path7.default.join(b.root, c.file))).map((c) => ({ block: b.id, component: c.name })));
 }
 
 // src/blocks/doctor.ts
@@ -6236,9 +5924,9 @@ function parseEnvFile(text) {
 function readSetting(name, root, env) {
   if (env[name]) return env[name];
   for (const f of [".env.local"]) {
-    const file = import_node_path9.default.join(root, f);
-    if (import_node_fs8.default.existsSync(file)) {
-      const v = parseEnvFile(import_node_fs8.default.readFileSync(file, "utf8"))[name];
+    const file = import_node_path8.default.join(root, f);
+    if (import_node_fs7.default.existsSync(file)) {
+      const v = parseEnvFile(import_node_fs7.default.readFileSync(file, "utf8"))[name];
       if (v) return v;
     }
   }
@@ -6259,7 +5947,7 @@ function selectBlocks(opts, reg, root) {
   }
   if (!ids.length) {
     try {
-      const ledger = JSON.parse(import_node_fs8.default.readFileSync(import_node_path9.default.join(root, "graph8.json"), "utf8"));
+      const ledger = JSON.parse(import_node_fs7.default.readFileSync(import_node_path8.default.join(root, "graph8.json"), "utf8"));
       ids = Object.keys(ledger.blocks ?? {});
     } catch {
       ids = [];
@@ -6273,7 +5961,7 @@ function errorText(e, key) {
   return `${status ? `HTTP ${status}: ` : ""}${msg}`.split(key).join("[redacted]");
 }
 async function runDoctor(opts, reg, io, cwd) {
-  const root = import_node_path9.default.resolve(cwd, opts.dir);
+  const root = import_node_path8.default.resolve(cwd, opts.dir);
   let blocks;
   try {
     blocks = selectBlocks(opts, reg, root);
@@ -6304,7 +5992,7 @@ async function runDoctor(opts, reg, io, cwd) {
     await checkKey(call, blocks, key, line);
     await checkSubscription(call, key, line);
   }
-  checkRoute(root, blocks, opts.production === true, io.out, line);
+  checkRoute(root, blocks, opts.production === true, io.out, line, io.env);
   if (opts.stack) printFlows(opts, reg, io.out, line);
   else if (!opts.blocks.length) printAppScreens(root, reg, io.out);
   printChecklist(blocks, io.out);
@@ -6359,7 +6047,7 @@ function printFlows(opts, reg, out, line) {
 function printAppScreens(root, reg, out) {
   let app;
   try {
-    app = JSON.parse(import_node_fs8.default.readFileSync(import_node_path9.default.join(root, "graph8.json"), "utf8")).app;
+    app = JSON.parse(import_node_fs7.default.readFileSync(import_node_path8.default.join(root, "graph8.json"), "utf8")).app;
   } catch {
     return;
   }
@@ -6382,22 +6070,22 @@ function printChecklist(blocks, out) {
 }
 function readLocalKey(root) {
   try {
-    return import_node_fs8.default.readFileSync(import_node_path9.default.join(root, ".g8", "local-key"), "utf8").trim() || void 0;
+    return import_node_fs7.default.readFileSync(import_node_path8.default.join(root, ".g8", "local-key"), "utf8").trim() || void 0;
   } catch {
     return void 0;
   }
 }
 var ROUTE_FILES = ["app/api/g8/[...path]/route.ts", "src/app/api/g8/[...path]/route.ts"];
 function findRoute(root) {
-  return ROUTE_FILES.find((f) => import_node_fs8.default.existsSync(import_node_path9.default.join(root, f))) ?? null;
+  return ROUTE_FILES.find((f) => import_node_fs7.default.existsSync(import_node_path8.default.join(root, f))) ?? null;
 }
-function checkRoute(root, blocks, production, out, line) {
+function checkRoute(root, blocks, production, out, line, env = {}) {
   const rel = findRoute(root);
   if (!rel) {
     if (production) line(false, `no proxy route found (${ROUTE_FILES[0]}): run doctor from the app's root or pass --dir`);
     return;
   }
-  const facts = inspectRoute(import_node_fs8.default.readFileSync(import_node_path9.default.join(root, rel), "utf8"));
+  const facts = inspectRoute(import_node_fs7.default.readFileSync(import_node_path8.default.join(root, rel), "utf8"));
   out(`
 Proxy route (${rel})${production ? ", production gate" : ""}:`);
   const problem = (text) => production ? line(false, text) : out(`warn  ${text}`);
@@ -6406,6 +6094,7 @@ Proxy route (${rel})${production ? ", production gate" : ""}:`);
       facts.localPreview ? "`authorize` is not set: local preview (this computer, `next dev` only) is the only gate. Set `authorize` before going live; a production build refuses every call until you do" : "`authorize` is not set: the route refuses every call until you set it (check your app's session)"
     );
   } else line(true, "`authorize` is set");
+  checkAuthConfig(root, problem, out, env);
   if (facts.dangerouslyAllowUnauthenticated) problem("dangerouslyAllowUnauthenticated is on: anyone who can reach the route can use the key");
   if (facts.dangerouslyAllowAllPaths) problem("dangerouslyAllowAllPaths is on: every /api/v1 area is reachable from the browser");
   const need = derivePrefixes(blocks);
@@ -6421,6 +6110,21 @@ Proxy route (${rel})${production ? ", production gate" : ""}:`);
     if (extra.length && blocks.length) out(`warn  allowedPrefixes allows areas no installed block declares: ${extra.join(", ")}`);
   }
 }
+function checkAuthConfig(root, problem, out, env = {}) {
+  const rel = ["g8.auth.ts", "src/g8.auth.ts"].find((f) => import_node_fs7.default.existsSync(import_node_path8.default.join(root, f)));
+  if (!rel) return;
+  const source = import_node_fs7.default.readFileSync(import_node_path8.default.join(root, rel), "utf8");
+  const code = source.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:"'`])\/\/[^\n]*/g, "$1");
+  if (/\ballowAnonymous\s*\(/.test(code)) {
+    out(`warn  ${rel} uses allowAnonymous(): NO sign-in. Anyone who can reach this app can use its graph8 API key through /api/g8. Use a narrowly scoped key with a spend cap, or switch to a sign-in preset`);
+  }
+  if (/\bjwtAuth\s*\(/.test(code) && !/\bclaims\s*:/.test(code) && !/\b(audience|secret)\s*:/.test(code)) {
+    if (!readSetting("G8_JWT_AUDIENCE", root, env) && !readSetting("G8_JWT_SECRET", root, env)) {
+      out(`warn  ${rel} uses jwtAuth() with no audience: set G8_JWT_AUDIENCE (or a claims check), otherwise tokens your identity provider minted for other apps on the same tenant are accepted`);
+    }
+  }
+  if (source.includes("graph8:auth-todo")) problem(`${rel} still has the sessionAuth stub (graph8:auth-todo): it refuses everyone until you wire your session library`);
+}
 function fixPrefixes(root, blocks, io) {
   const rel = findRoute(root);
   if (!rel) {
@@ -6431,8 +6135,8 @@ function fixPrefixes(root, blocks, io) {
     io.err("no blocks found: graph8.json lists none (or pass --blocks / --stack).");
     return 1;
   }
-  const file = import_node_path9.default.join(root, rel);
-  const source = import_node_fs8.default.readFileSync(file, "utf8");
+  const file = import_node_path8.default.join(root, rel);
+  const source = import_node_fs7.default.readFileSync(file, "utf8");
   const prefixes = derivePrefixes(blocks);
   const next = applyPrefixes(source, prefixes) ?? upgradeLegacyRoute(source, prefixes);
   if (next === null) {
@@ -6442,12 +6146,638 @@ function fixPrefixes(root, blocks, io) {
   }
   if (next === source) io.out(`keep ${rel}  (allowedPrefixes already match the ${prefixes.length} areas of the installed blocks)`);
   else {
-    import_node_fs8.default.writeFileSync(file, next, "utf8");
+    import_node_fs7.default.writeFileSync(file, next, "utf8");
     io.out(`update ${rel}  (allowedPrefixes: ${prefixes.join(", ")})`);
   }
   return 0;
 }
 
+// src/blocks/orgBrand.ts
+var TIMEOUT_MS = 8e3;
+var NONE = (info) => ({ values: {}, info, cleanup: () => {
+} });
+function colorOf(v) {
+  const raw = typeof v === "string" ? v : v && typeof v === "object" ? v.value : null;
+  return typeof raw === "string" ? normalizeHex(raw) : null;
+}
+function pickColor(tokens) {
+  const t = tokens ?? {};
+  for (const k of ["primary", "brand", "accent"]) {
+    const c = colorOf(t.colors?.[k]);
+    if (c) return c;
+  }
+  return colorOf(t.components?.button?.background);
+}
+function cleanName(v) {
+  if (typeof v !== "string") return null;
+  const s = v.replace(/[\u0000-\u001f\u007f<>`$\\]/g, "").replace(/\s+/g, " ").trim().slice(0, 60);
+  return s || null;
+}
+var MIME = { "image/svg+xml": "svg", "image/png": "png", "image/jpeg": "jpg", "image/webp": "webp", "image/gif": "gif" };
+function privateHost(host) {
+  const h = host.toLowerCase().replace(/^\[|\]$/g, "");
+  return h === "localhost" || h.endsWith(".localhost") || h.endsWith(".internal") || /^(127\.|10\.|0\.|169\.254\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/.test(h) || h === "::1" || /^(fc|fd|fe80)/.test(h);
+}
+async function downloadLogo(url, f) {
+  let bytes;
+  let ext;
+  if (url.startsWith("data:")) {
+    const m = /^data:([^;,]+)(;base64)?,(.*)$/s.exec(url);
+    if (!m) return null;
+    ext = MIME[m[1].toLowerCase()];
+    bytes = m[2] ? Buffer.from(m[3], "base64") : Buffer.from(decodeURIComponent(m[3]));
+  } else {
+    const u = new URL(url);
+    if (u.protocol !== "https:" || privateHost(u.hostname)) return null;
+    const res = await f(u, { redirect: "error", signal: AbortSignal.timeout(TIMEOUT_MS) });
+    if (!res.ok) return null;
+    const type = (res.headers.get("content-type") ?? "").split(";")[0].trim().toLowerCase();
+    ext = MIME[type] ?? (type && type !== "application/octet-stream" ? void 0 : LOGO_TYPES.find((e) => u.pathname.toLowerCase().endsWith(`.${e}`)));
+    bytes = Buffer.from(await res.arrayBuffer());
+  }
+  if (!ext || !LOGO_TYPES.includes(ext) || !bytes.length || bytes.length > MAX_LOGO_BYTES) return null;
+  const dir = import_node_fs8.default.mkdtempSync(import_node_path9.default.join(import_node_os.default.tmpdir(), "g8-org-logo-"));
+  const file = import_node_path9.default.join(dir, `logo.${ext}`);
+  import_node_fs8.default.writeFileSync(file, bytes);
+  return { file, dir };
+}
+async function tryCall(call, op) {
+  try {
+    return { data: (await call(op))?.data };
+  } catch (e) {
+    return { status: e.status ?? 0 };
+  }
+}
+async function pullOrgBrand(io, root) {
+  try {
+    const key = readSetting("G8_API_KEY", root, io.env);
+    if (!key) return NONE("org brand: no G8_API_KEY found, using the default look (set one to pick up your Brand Kit, or pass --no-org-brand)");
+    const api = createApiClient(key, readSetting("G8_API_URL", root, io.env));
+    const f = io.fetch ?? fetch;
+    const call = (op) => api.call(op, void 0, { fetchImpl: (u, i) => f(u, { ...i, signal: AbortSignal.timeout(TIMEOUT_MS) }), maxRetries: 0 });
+    const [kit, me] = await Promise.all([tryCall(call, "get_brand_kit_overview_brand_kit_get"), tryCall(call, "describe_current_key_me_get")]);
+    if (!kit.data) return NONE(`org brand: the Brand Kit could not be read (${kit.status ? `HTTP ${kit.status}` : "unreachable"}), using the default look`);
+    const values = {};
+    const color = pickColor(kit.data.design_tokens);
+    if (color) values.color = color;
+    const name = cleanName(me.data?.org_name);
+    if (name) values.name = name;
+    let dir = null;
+    const logoUrl = typeof kit.data.logo_url === "string" ? kit.data.logo_url.trim() : "";
+    if (logoUrl) {
+      try {
+        const dl = await downloadLogo(logoUrl, f);
+        if (dl) values.logo = dl.file, dir = dl.dir;
+      } catch {
+      }
+    }
+    const got = [values.name && "name", values.color && "colour", values.logo && "logo"].filter(Boolean);
+    const cleanup = () => dir && import_node_fs8.default.rmSync(dir, { recursive: true, force: true });
+    if (!got.length) return NONE("org brand: the Brand Kit is empty, using the default look");
+    return { values, info: `org brand: using your Brand Kit (${got.join(", ")}); explicit flags win, --no-org-brand skips this`, cleanup };
+  } catch {
+    return NONE("org brand: could not reach the Brand Kit, using the default look");
+  }
+}
+
+// src/blocks/create.ts
+var import_node_fs10 = __toESM(require("fs"));
+var import_node_path11 = __toESM(require("path"));
+
+// src/blocks/auth.ts
+var import_node_crypto2 = require("crypto");
+var import_node_fs9 = __toESM(require("fs"));
+var import_node_path10 = __toESM(require("path"));
+var AUTH_PRESETS = ["password", "basic", "jwt", "session", "anonymous"];
+var AUTH_CONFIG_FILE = "g8.auth.ts";
+var AUTH_ROUTE_FILE = "app/api/g8-auth/route.ts";
+function isAuthPreset(v) {
+  return AUTH_PRESETS.includes(v);
+}
+function usesSignInScreen(p) {
+  return p === "password" || p === "jwt" || p === "session";
+}
+var SUMMARY = {
+  password: "one shared team password, a signed HttpOnly session cookie and a sign-in screen",
+  basic: "HTTP Basic auth: the browser asks for a user and password on every page",
+  jwt: "your identity provider's JWT (OIDC: Auth0, Okta, Cognito, Keycloak, Clerk...), checked against its keys",
+  session: "your own session library (Clerk, NextAuth, Supabase...): wire one function in g8.auth.ts",
+  anonymous: "NO sign-in: anyone who can reach the app can use its key (public demos only)"
+};
+function authSummary(p) {
+  return SUMMARY[p];
+}
+var ENV = {
+  password: [
+    "# Sign-in (create --auth password): the team password (12+ characters) and the cookie signing secret",
+    "# (32+ random characters: openssl rand -base64 48). create wrote fresh values to .env.local.",
+    "G8_APP_PASSWORD=",
+    "G8_SESSION_SECRET="
+  ],
+  basic: ["# Sign-in (create --auth basic): user:password (12+ character passwords, no commas), comma-separated for several users.", "G8_BASIC_AUTH="],
+  jwt: [
+    "# Sign-in (create --auth jwt): your identity provider. See g8.auth.ts for examples.",
+    "G8_JWT_ISSUER=",
+    "G8_JWT_JWKS_URL=",
+    "G8_JWT_AUDIENCE=",
+    "G8_JWT_COOKIE=",
+    "# Or an HS256 secret instead of a JWKS (32+ characters):",
+    "G8_JWT_SECRET=",
+    "G8_SIGN_IN_URL=",
+    "G8_SIGN_OUT_URL="
+  ],
+  session: ["# Sign-in (create --auth session): where the sign-in screen sends people, and the Sign out link.", "G8_SIGN_IN_URL=", "G8_SIGN_OUT_URL="],
+  anonymous: []
+};
+function authEnvLines(p) {
+  return ENV[p];
+}
+function planAuthFiles(p, templatesRoot) {
+  const dir = import_node_path10.default.join(templatesRoot, "auth");
+  const read = (f) => render(import_node_fs9.default.readFileSync(import_node_path10.default.join(dir, f), "utf8"), { preset: p });
+  const files = [{ rel: AUTH_CONFIG_FILE, content: read(`g8.auth.${p}.ts.tmpl`) }];
+  if (usesSignInScreen(p)) files.push({ rel: AUTH_ROUTE_FILE, content: read("auth-route.ts.tmpl") });
+  if (p === "basic") files.push({ rel: "middleware.ts", content: read("middleware.ts.tmpl") });
+  return files;
+}
+var AUTHORIZE_HINT = /^[ \t]*\/\/ authorize: async \(request\) => \{[^\n]*\n/m;
+var LAST_IMPORT = /^import [^\n]+;\n(?![\s\S]*^import )/m;
+function applyAuthToRoute(source) {
+  if (!AUTHORIZE_HINT.test(source) || !LAST_IMPORT.test(source) || source.includes('from "@/g8.auth"')) return null;
+  return source.replace(LAST_IMPORT, (m) => `${m}import { appAuth } from "@/g8.auth";
+`).replace(AUTHORIZE_HINT, "  authorize: appAuth.authorize, // g8.auth.ts: who may use this route (npx @graph8/sdk create --auth)\n");
+}
+var LAYOUT_IMPORT = 'import { G8ConnectGate } from "@/components/g8/_foundation/connect-graph8";\n';
+var LAYOUT_BODY = /^([ \t]*)<AppShell>\n([\s\S]*?)^\1<\/AppShell>\n/m;
+function applyAuthToLayout(source) {
+  const m = LAYOUT_BODY.exec(source);
+  if (!m || !source.includes(LAYOUT_IMPORT)) return null;
+  const pad = m[1];
+  const inner = m[2].split("\n").map((l) => l ? `    ${l}` : l).join("\n");
+  const body = [
+    `${pad}{/* Sign-in (g8.auth.ts): the sign-in screen until the visitor is signed in. The proxy enforces it on the server. */}`,
+    `${pad}<BrandProvider brand={brand}>`,
+    `${pad}  <G8AuthGate>`,
+    `${pad}    <AppShell headerSlot={<G8SignOutButton />}>`,
+    `${inner}${pad}    </AppShell>`,
+    `${pad}  </G8AuthGate>`,
+    `${pad}</BrandProvider>`,
+    ""
+  ].join("\n");
+  const imports = `${LAYOUT_IMPORT}import { G8AuthGate, G8SignOutButton } from "@/components/g8/_foundation/auth-gate";
+import { BrandProvider } from "@/components/g8/_foundation/brand-provider";
+`;
+  return source.replace(LAYOUT_IMPORT, imports).replace(LAYOUT_BODY, body);
+}
+var GO_LIVE_ITEM = /^- \[ \] Set `authorize` in `app\/api\/g8\/\[\.\.\.path\]\/route\.ts`[^\n]*\n(?: {6}[^\n]*\n)*/m;
+function readmeSection(p) {
+  const vars2 = authEnvLines(p).filter((l) => !l.startsWith("#")).map((l) => `\`${l.replace(/=$/, "")}\``);
+  const lines = [
+    "## Sign-in",
+    "",
+    `This app was created with \`--auth ${p}\`: ${authSummary(p)}. \`g8.auth.ts\` holds the preset, and`,
+    "`app/api/g8/[...path]/route.ts` runs its `authorize` before it forwards any call with the server's graph8 API key.",
+    ""
+  ];
+  if (vars2.length) lines.push(`Server environment (\`.env.local\` while developing, your host's settings in production): ${vars2.join(", ")}.`, "");
+  if (p === "password") lines.push("`create` wrote a fresh team password and session secret to `.env.local` (git-ignored): read the password there, and set your own values on the host before deploying.", "");
+  if (p === "basic") lines.push("`create` wrote a fresh `admin:<random>` login to `.env.local` (git-ignored). `middleware.ts` makes the browser ask for it on every page. Serve the app over HTTPS only.", "");
+  if (p === "jwt") lines.push("Set the issuer (or JWKS URL), the audience and the cookie your provider uses; examples are in `g8.auth.ts`.", "");
+  if (p === "session") lines.push("Wire your session library in `g8.auth.ts` (Clerk, NextAuth and Supabase examples inside). Until then it refuses everyone and `doctor --production` fails.", "");
+  if (p === "anonymous") lines.push("**Warning: no sign-in.** Anyone who can reach the app can use its key through `/api/g8`. Use a narrowly scoped key with a spend cap, or switch preset in `g8.auth.ts`.", "");
+  lines.push('Switch preset or tune it (session length, extra JWT claim checks): `components/g8/_foundation/README.md`, "Sign-in presets".', "", "");
+  return lines.join("\n");
+}
+function applyAuthToReadme(source, p) {
+  if (!source.includes("\n## Go live\n") || !GO_LIVE_ITEM.test(source)) return null;
+  const item = p === "anonymous" ? "- [ ] `authorize` is set by `--auth anonymous`: NO sign-in. Make sure that is what you want (see Sign-in above).\n" : `- [x] \`authorize\` is set by the \`--auth ${p}\` preset (\`g8.auth.ts\`). Set its variables on your host (see Sign-in above).
+`;
+  return source.replace("\n## Go live\n", `
+${readmeSection(p)}## Go live
+`).replace(GO_LIVE_ITEM, item);
+}
+function applyAuthToEnvExample(source, p) {
+  const lines = authEnvLines(p);
+  return lines.length ? `${source.replace(/\n*$/, "\n")}${lines.join("\n")}
+` : source;
+}
+var secret = (bytes) => (0, import_node_crypto2.randomBytes)(bytes).toString("base64url");
+function writeAuthSecrets(root, p) {
+  const wanted = p === "password" ? { G8_APP_PASSWORD: secret(18), G8_SESSION_SECRET: secret(48) } : p === "basic" ? { G8_BASIC_AUTH: `admin:${secret(18)}` } : {};
+  const file = import_node_path10.default.join(root, ".env.local");
+  const current = import_node_fs9.default.existsSync(file) ? import_node_fs9.default.readFileSync(file, "utf8") : "";
+  const has = (name) => new RegExp(`^\\s*(?:export\\s+)?${name}\\s*=\\s*\\S`, "m").test(current);
+  const add = Object.entries(wanted).filter(([name]) => !has(name));
+  if (!add.length) return [];
+  const block = [`# Written by \`npx @graph8/sdk create --auth ${p}\` for local development. Set your own values on your host.`, ...add.map(([k, v]) => `${k}=${v}`)].join("\n");
+  import_node_fs9.default.writeFileSync(file, `${current ? `${current.replace(/\n*$/, "\n")}
+` : ""}${block}
+`, { encoding: "utf8", mode: 384 });
+  return add.map(([k]) => k);
+}
+
+// src/blocks/create.ts
+var CREATE_USAGE = `Usage: npx @graph8/sdk create <stack> <dir> [options]
+
+Scaffold a Next.js (App Router, TypeScript, Tailwind CSS v4) app for a stack and
+install the stack's blocks into it. Run \`graph8-sdk list\` to see the stacks.
+  --package-manager <npm|pnpm|yarn|bun>   default: the one running the command, else npm
+  --no-install      write the files and blocks, do not install dependencies
+  --dry-run         print what would be written, write and install nothing
+  --force           allow a non-empty <dir> (template files are overwritten, and graph8.json
+                    is reset: blocks you added to that app earlier are no longer recorded)
+  --auth <preset>   scaffold sign-in so the app can go live (sets \`authorize\` on the proxy route):
+                      password   one shared team password, session cookie, sign-in screen
+                      basic      HTTP Basic auth on every page (the browser asks)
+                      jwt        your identity provider's JWT (OIDC JWKS or an HS256 secret)
+                      session    your own session library (Clerk, NextAuth, Supabase): wire g8.auth.ts
+                      anonymous  NO sign-in: anyone who can reach the app uses its key (public demos)
+                    Without --auth: local preview only, and a production build refuses /api/g8 until you
+                    set \`authorize\` yourself (unchanged).
+Then: \`npm run dev\` in <dir>, open http://localhost:3000 and paste a graph8 API key (local preview), and run
+\`npx @graph8/sdk doctor --stack <stack>\` (add --production before going live).
+
+Or pick the features yourself, for any app (also: \`create custom --blocks ...\`):
+  npx @graph8/sdk create --blocks <id,id,...> [--title "Acme CRM"] <dir> [options]
+Every requested block's dependencies come with it. The app gets one route and one sidebar entry per finished
+Screen of the requested blocks, plus the user-facing Screens of their dependencies (asking for deals also gives
+you crm's screens). \`/\` opens the analytics screen if you asked for one, else the first screen.
+  --title <text>          the app's name (default: graph8 app)
+  --with-deps-screens     also add the plain fallback page of dependency blocks that have no Screen
+  --no-deps-screens       add screens only for the blocks you named
+Run \`graph8-sdk list\` to see each block and which have Screens.
+
+Brand it (any stack or --blocks; the same as running \`graph8-sdk brand\` in the new app afterwards):
+  --name <text>             the app's name (with --blocks, the same as --title)
+  --brand-color <hex>       primary colour, AA-checked; --dark-brand-color <hex> for dark mode
+  --logo <path>             svg/png/jpg/webp/gif, shown in the sidebar
+  --app-url <url>           white-label: where "Open in graph8" links go; --link-label <text>: what they call it
+With a graph8 API key (G8_API_KEY in the environment or .env.local) the org's Brand Kit fills in what you did not
+pass: the app name, the primary colour and the logo (downloaded into public/brand/). No key, no kit or an error:
+the default look, one info line, never a failure. --no-org-brand skips it.
+A directory literally named \`custom\` would read as the alias: pass \`--blocks crm ./custom\`.`;
+var PACKAGE_MANAGERS = ["npm", "pnpm", "yarn", "bun"];
+function parseCreateArgs(argv) {
+  const o = { stack: "", dir: "", install: true, dryRun: false, force: false };
+  const positional = [];
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    const eq = arg.startsWith("--") ? arg.indexOf("=") : -1;
+    const [flag, inline] = eq > 0 ? [arg.slice(0, eq), arg.slice(eq + 1)] : [arg, void 0];
+    if (flag === "--package-manager") {
+      const v = inline ?? argv[++i];
+      if (!PACKAGE_MANAGERS.includes(v)) throw new Error(`--package-manager must be one of ${PACKAGE_MANAGERS.join(", ")}
+
+${CREATE_USAGE}`);
+      o.packageManager = v;
+    } else if (flag === "--blocks") {
+      const v = inline ?? argv[++i];
+      if (v === void 0 || v.startsWith("--")) throw new Error(`--blocks needs a comma-separated list of block ids
+
+${CREATE_USAGE}`);
+      o.blocks = [...o.blocks ?? [], ...v.split(",").map((x) => x.trim()).filter(Boolean)];
+    } else if (flag === "--auth") {
+      const v = inline ?? argv[++i];
+      if (v === void 0 || !isAuthPreset(v)) throw new Error(`--auth must be one of ${AUTH_PRESETS.join(", ")}
+
+${CREATE_USAGE}`);
+      o.auth = v;
+    } else if (flag === "--title") {
+      const v = inline ?? argv[++i];
+      if (v === void 0 || v.startsWith("--")) throw new Error(`--title needs a value
+
+${CREATE_USAGE}`);
+      o.title = v;
+    } else if (takeBrandFlag(o.brand ??= {}, flag, () => {
+      const v = inline ?? argv[++i];
+      if (v === void 0 || v.startsWith("--")) throw new Error(`${flag} needs a value
+
+${CREATE_USAGE}`);
+      return v;
+    })) {
+    } else if (arg === "--no-org-brand") o.orgBrand = false;
+    else if (arg === "--with-deps-screens") o.depsScreens = "with";
+    else if (arg === "--no-deps-screens") o.depsScreens = "none";
+    else if (arg === "--no-install") o.install = false;
+    else if (arg === "--dry-run") o.dryRun = true;
+    else if (arg === "--force") o.force = true;
+    else if (arg.startsWith("-")) throw new Error(`unknown option ${arg}
+
+${CREATE_USAGE}`);
+    else positional.push(arg);
+  }
+  if (o.brand && !hasBrandInput(o.brand)) delete o.brand;
+  if (o.brand?.name !== void 0 && o.title !== void 0 && o.brand.name !== o.title) throw new Error(`--name and --title name the same thing: pass one
+
+${CREATE_USAGE}`);
+  if (o.blocks || positional[0] === "custom") return parseCustom(o, positional);
+  if (o.title || o.depsScreens) throw new Error(`--title, --with-deps-screens and --no-deps-screens go with --blocks
+
+${CREATE_USAGE}`);
+  if (positional.length !== 2) throw new Error(`create needs a stack and a directory
+
+${CREATE_USAGE}`);
+  [o.stack, o.dir] = positional;
+  return o;
+}
+function parseCustom(o, positional) {
+  const rest = positional[0] === "custom" ? positional.slice(1) : positional;
+  if (!o.blocks?.length) throw new Error(`create custom needs --blocks <id,id,...> (see \`graph8-sdk list\`)
+
+${CREATE_USAGE}`);
+  if (rest.length !== 1) {
+    throw new Error(`${rest.length ? "a stack name cannot be combined with --blocks; pass only the directory" : "create --blocks needs a directory"}
+
+${CREATE_USAGE}`);
+  }
+  return { ...o, stack: "custom", dir: rest[0] };
+}
+function packageManagerFromUserAgent(ua) {
+  const name = /^(npm|pnpm|yarn|bun)\//.exec(ua ?? "")?.[1];
+  return name ?? "npm";
+}
+function appNameFor(dir) {
+  const base = import_node_path11.default.basename(import_node_path11.default.resolve(dir)).toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^[._-]+|-+$/g, "");
+  return base || "g8-app";
+}
+var quoted = (p) => /^[\w@%+=:,./-]+$/.test(p) ? p : JSON.stringify(p);
+function walk(dir, base = dir) {
+  const out = [];
+  for (const e of import_node_fs10.default.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+    const full = import_node_path11.default.join(dir, e.name);
+    if (e.isDirectory()) out.push(...walk(full, base));
+    else out.push(posix(import_node_path11.default.relative(base, full)));
+  }
+  return out;
+}
+function outputName(rel) {
+  const noExt = rel.replace(/\.tmpl$/, "");
+  const dir = import_node_path11.default.posix.dirname(noExt);
+  const base = import_node_path11.default.posix.basename(noExt).replace(/^dot-/, ".");
+  return dir === "." ? base : `${dir}/${base}`;
+}
+function stackProblem(reg, stack) {
+  const { missing } = stackStatus(reg, stack);
+  if (missing.length) {
+    const ready = reg.stacks.filter((s) => !stackStatus(reg, s).missing.length).map((s) => s.id);
+    return [
+      `stack "${stack.id}" is planned: these blocks are not in this version of @graph8/sdk yet: ${missing.join(", ")}.`,
+      `Stacks you can create now: ${ready.join(", ") || "none"}. Or create one of those and add blocks as they ship (\`graph8-sdk add <block>\`).`
+    ].join("\n");
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const homeIssue = homeProblem(stack);
+  if (homeIssue) return homeIssue;
+  for (const n of stack.nav) {
+    const block = findBlock(reg, n.block);
+    if (!stack.blocks.includes(n.block)) return `stack "${stack.id}" nav "${n.label}" uses block "${n.block}" which the stack does not include.`;
+    if (!block?.components.some((c) => c.name === n.component)) return `stack "${stack.id}" nav "${n.label}" uses ${n.component}, which block "${n.block}" does not declare.`;
+    if (/[\[\]]/.test(n.path)) return `stack "${stack.id}" nav "${n.label}" uses ${n.path}: dynamic segments cannot be a sidebar link.`;
+    if (seen.has(n.path)) return `stack "${stack.id}" has two nav entries at ${n.path}.`;
+    seen.add(n.path);
+    if (n.page && (!reg.stacksRoot || !import_node_fs10.default.existsSync(import_node_path11.default.join(reg.stacksRoot, stack.id, n.page)))) {
+      return `stack "${stack.id}" nav "${n.label}" uses page ${n.page}, which does not exist under stacks/${stack.id}/.`;
+    }
+  }
+  return null;
+}
+function homeProblem(stack) {
+  if (!stack.home) return null;
+  if (!stack.nav.some((n) => n.path === stack.home)) return `stack "${stack.id}" has home ${stack.home}, which is not one of its nav paths.`;
+  if (stack.home !== "/" && stack.nav.some((n) => n.path === "/")) return `stack "${stack.id}" has home ${stack.home} but also a nav entry at "/": drop one.`;
+  return null;
+}
+function stackPageFile(reg, stack, n) {
+  return n.page && reg.stacksRoot ? import_node_path11.default.join(reg.stacksRoot, stack.id, n.page) : null;
+}
+function homeRedirect(stack) {
+  if (stack.home) return stack.home === "/" ? null : stack.home;
+  return stack.nav.length && !stack.nav.some((n) => n.path === "/") ? stack.nav[0].path : null;
+}
+function renderPages(reg, stack, templates) {
+  const pageTpl = import_node_fs10.default.readFileSync(import_node_path11.default.join(templates, "_pages", "route-page.tsx.tmpl"), "utf8");
+  const files = stack.nav.map((n) => {
+    const block = findBlock(reg, n.block);
+    const comp = block.components.find((c) => c.name === n.component);
+    const custom = stackPageFile(reg, stack, n);
+    const vars2 = {
+      stackId: stack.id,
+      block: block.id,
+      blockDir: `components/g8/${block.dir}`,
+      component: n.component,
+      importPath: componentImportPath(block, comp.file),
+      propsJson: JSON.stringify(n.props ?? {}, null, 2)
+    };
+    return { rel: pageFileFor(n.path), content: render(custom ? import_node_fs10.default.readFileSync(custom, "utf8") : pageTpl, vars2) };
+  });
+  const to = homeRedirect(stack);
+  if (to) {
+    const redirect = import_node_fs10.default.readFileSync(import_node_path11.default.join(templates, "_pages", "redirect-page.tsx.tmpl"), "utf8");
+    files.push({ rel: "app/page.tsx", content: render(redirect, { firstPathJson: JSON.stringify(to) }) });
+  }
+  return files;
+}
+function peerDependenciesFor(blocks, io, stack) {
+  const peers = {};
+  for (const b of blocks) for (const [name, range] of Object.entries(b.peerDependencies)) peers[name] ??= range;
+  const usesUi = blocks.some((b) => walk(b.root).some((f) => /\.(tsx?|jsx?)$/.test(f) && /["']@graph8\/sdk\/ui["'/]/.test(import_node_fs10.default.readFileSync(import_node_path11.default.join(b.root, f), "utf8"))));
+  if (usesUi && io.sdkPackageJson && import_node_fs10.default.existsSync(io.sdkPackageJson)) {
+    const sdk = JSON.parse(import_node_fs10.default.readFileSync(io.sdkPackageJson, "utf8"));
+    for (const [name, range] of Object.entries(sdk.peerDependencies ?? {})) peers[name] ??= range;
+  }
+  if (navUsesExtras(stack.nav)) peers["lucide-react"] ??= lucideRange(io);
+  return peers;
+}
+function lucideRange(io) {
+  try {
+    const sdk = JSON.parse(import_node_fs10.default.readFileSync(io.sdkPackageJson ?? "", "utf8"));
+    return sdk.peerDependencies?.["lucide-react"] ?? ">=0.400.0";
+  } catch {
+    return ">=0.400.0";
+  }
+}
+function mergedPackageJson(rendered, peers) {
+  const pkg = JSON.parse(rendered);
+  for (const [name, range] of Object.entries(peers)) pkg.dependencies[name] ??= range;
+  pkg.dependencies = Object.fromEntries(Object.entries(pkg.dependencies).sort(([a], [b]) => a.localeCompare(b)));
+  return `${JSON.stringify(pkg, null, 2)}
+`;
+}
+function withAuth(files, auth, templatesRoot) {
+  const patch = (rel, fn) => {
+    const f = files.find((x) => x.rel === rel);
+    if (!f) throw new Error(`--auth ${auth}: the template has no ${rel}`);
+    const next = fn(f.content);
+    if (next === null) throw new Error(`--auth ${auth}: ${rel} does not have the generated shape`);
+    f.content = next;
+  };
+  patch("README.md", (s) => applyAuthToReadme(s, auth));
+  patch(".env.local.example", (s) => applyAuthToEnvExample(s, auth));
+  if (usesSignInScreen(auth)) patch("app/layout.tsx", applyAuthToLayout);
+  return [...files, ...planAuthFiles(auth, templatesRoot)];
+}
+function planCreate(reg, stack, appName, pm, io, app, auth) {
+  const templates = import_node_path11.default.join(io.templatesRoot, "next-app");
+  const blocks = resolveWithDeps(reg, stack.blocks);
+  const devCommand = pm === "npm" ? "npm run dev" : `${pm} dev`;
+  const vars2 = {
+    appName,
+    sdkVersion: SDK_VERSION,
+    stackId: stack.id,
+    title: stack.title,
+    titleJson: JSON.stringify(stack.title),
+    ...navParts(stack),
+    devCommand,
+    installCommand: `${pm} install`,
+    doctorCommand: app ? "npx @graph8/sdk doctor" : `npx @graph8/sdk doctor --stack ${stack.id}`,
+    screens: stack.nav.map((n) => `- ${n.label}: \`${n.path}\` (${n.block} block, \`${n.component}\`)`).join("\n") || "- (none yet: add a block with `npx @graph8/sdk add <block>`)"
+  };
+  const files = [];
+  for (const rel of walk(templates).filter((f) => !f.startsWith("_pages/"))) {
+    let content = render(import_node_fs10.default.readFileSync(import_node_path11.default.join(templates, rel), "utf8"), vars2);
+    if (rel === "package.json.tmpl") content = mergedPackageJson(content, peerDependenciesFor(blocks, io, stack));
+    files.push({ rel: outputName(rel), content });
+  }
+  files.push(...renderPages(reg, stack, templates));
+  files.push({ rel: CONFIG_FILE, content: renderBrandConfig({ name: stack.title, ...DEFAULT_FIELDS }) });
+  const ledger = { sdkVersion: SDK_VERSION, target: "components/g8", stack: stack.id, ...app ? { app } : {}, blocks: {} };
+  files.push({ rel: "graph8.json", content: `${JSON.stringify(ledger, null, 2)}
+` });
+  return auth ? withAuth(files, auth, io.templatesRoot) : files;
+}
+function dirProblem(abs, force) {
+  if (!import_node_fs10.default.existsSync(abs)) return null;
+  if (!import_node_fs10.default.statSync(abs).isDirectory()) return `${abs} exists and is not a directory.`;
+  if (force || import_node_fs10.default.readdirSync(abs).length === 0) return null;
+  return `${abs} is not empty. Pick a new directory, or pass --force to write into it (template files are overwritten).`;
+}
+function runCreate(given, reg, io, cwd) {
+  let opts = given;
+  if (io.orgBrand && given.orgBrand !== false) {
+    const brand = mergeOrgBrand(given.brand, io.orgBrand, { name: given.title !== void 0 });
+    if (hasBrandInput(brand)) opts = { ...given, brand };
+  }
+  let app;
+  let stack = opts.blocks ? void 0 : reg.stacks.find((s) => s.id === opts.stack);
+  if (opts.blocks) {
+    let composed;
+    try {
+      composed = composeApp(reg, opts.blocks, { title: opts.title, withDepsScreens: opts.depsScreens === "with", noDepsScreens: opts.depsScreens === "none" });
+    } catch (e) {
+      io.err(e.message);
+      return 1;
+    }
+    stack = composed.stack;
+    app = { title: stack.title, blocks: [...new Set(opts.blocks)], screens: composed.screens.map((x) => ({ block: x.block, component: x.component, path: x.path })) };
+    composed.warnings.forEach((w) => io.err(`warning: ${w}`));
+  } else if (!stack) {
+    io.err(`unknown stack "${opts.stack}". Stacks: ${reg.stacks.map((s) => s.id).join(", ") || "none"} (\`graph8-sdk list\`).`);
+    return 1;
+  }
+  if (!stack) return 1;
+  const name = opts.brand?.name?.trim();
+  if (name) {
+    stack = { ...stack, title: name };
+    if (app) app = { ...app, title: name };
+  }
+  const problem = stackProblem(reg, stack);
+  if (problem) return io.err(problem), 1;
+  const abs = import_node_path11.default.resolve(cwd, opts.dir);
+  const dirIssue = dirProblem(abs, opts.force);
+  if (dirIssue) return io.err(dirIssue), 1;
+  const brandIssue = opts.brand ? brandProblem(opts.brand, cwd) : null;
+  if (brandIssue) return io.err(brandIssue), 1;
+  const pm = opts.packageManager ?? packageManagerFromUserAgent(io.userAgent);
+  let files;
+  try {
+    files = planCreate(reg, stack, appNameFor(opts.dir), pm, io, app, opts.auth);
+  } catch (e) {
+    io.err(e.message);
+    return 1;
+  }
+  const blocks = resolveWithDeps(reg, stack.blocks);
+  io.out(`${opts.dryRun ? "Dry run: " : ""}creating "${stack.title}" (${app ? `custom: ${app.blocks.join(", ")}` : stack.id}) in ${opts.dir}`);
+  for (const f of files) io.out(`${opts.dryRun ? "would write" : "write"} ${f.rel}`);
+  if (opts.dryRun) {
+    io.out(`would add blocks: ${blocks.map((b) => b.id).join(", ")}`);
+    if (opts.brand) io.out(`would brand the app: ${Object.entries(opts.brand).map(([k, v]) => `${k} ${v}`).join(", ")}`);
+    if (opts.auth) io.out(`would set up sign-in (--auth ${opts.auth}): ${authSummary(opts.auth)}; authorize: appAuth.authorize in app/api/g8/[...path]/route.ts`);
+    io.out(opts.install ? `would run: ${pm} install` : "would not install dependencies (--no-install)");
+    return 0;
+  }
+  for (const f of files) {
+    const dest = import_node_path11.default.join(abs, f.rel);
+    import_node_fs10.default.mkdirSync(import_node_path11.default.dirname(dest), { recursive: true });
+    import_node_fs10.default.writeFileSync(dest, f.content, "utf8");
+  }
+  return finish(opts, reg, stack, blocks, abs, pm, io, cwd);
+}
+function finish(opts, reg, stack, blocks, abs, pm, io, cwd) {
+  for (const b of blocks) {
+    const code = runAdd({ spec: b.id, dir: abs, target: "components/g8", dryRun: false, force: opts.force, install: false, wireScreens: false }, reg, io, cwd);
+    if (code !== 0) {
+      io.err(`adding block "${b.id}" failed; the app in ${opts.dir} is incomplete.`);
+      return code;
+    }
+  }
+  if (opts.auth) {
+    const code = finishAuth(opts.auth, abs, io);
+    if (code !== 0) return code;
+  }
+  if (opts.brand) {
+    io.out("branding the app (graph8-sdk brand)");
+    const code = runBrand({ ...opts.brand, dir: abs }, io, cwd, stack.title);
+    if (code !== 0) {
+      io.err(`branding failed; the app in ${opts.dir} is complete but unbranded. Fix the option and run \`npx @graph8/sdk brand\` in it.`);
+      return code;
+    }
+  }
+  if (opts.install) {
+    io.out(`installing dependencies: ${pm} install`);
+    const code = io.spawn(pm, ["install"], abs);
+    if (code !== 0) {
+      io.err(`dependency install failed (exit ${code}). Run it yourself: cd ${quoted(opts.dir)} && ${pm} install`);
+      return 1;
+    }
+  }
+  const cd = opts.dir === "." ? "" : `cd ${quoted(opts.dir)} && `;
+  io.out(
+    [
+      "",
+      `Done. Next:`,
+      `  1. ${cd}${opts.install ? "" : `${pm} install && `}${pm === "npm" ? "npm run dev" : `${pm} dev`}`,
+      ...opts.auth ? authOutro(opts.auth, opts.dir) : [],
+      `  2. open http://localhost:3000 and paste a graph8 API key in the Connect graph8 screen (local preview: only`,
+      `     this computer can reach the app's /api/g8 route), or set G8_API_KEY in ${import_node_path11.default.posix.join(opts.dir, ".env.local")}`,
+      `  3. ${cd}npx @graph8/sdk doctor${opts.blocks ? "" : ` --stack ${stack.id}`}   (before going live: add --production)`
+    ].join("\n")
+  );
+  return 0;
+}
+function finishAuth(auth, abs, io) {
+  const rel = "app/api/g8/[...path]/route.ts";
+  const file = import_node_path11.default.join(abs, rel);
+  const next = import_node_fs10.default.existsSync(file) ? applyAuthToRoute(import_node_fs10.default.readFileSync(file, "utf8")) : null;
+  if (next === null) {
+    io.err(`--auth ${auth}: ${rel} does not have the generated shape; set \`authorize: appAuth.authorize\` (import { appAuth } from "@/g8.auth") in it yourself.`);
+    return 1;
+  }
+  import_node_fs10.default.writeFileSync(file, next, "utf8");
+  io.out(`sign-in (--auth ${auth}): ${authSummary(auth)}`);
+  io.out(`update ${rel}  (authorize: appAuth.authorize, from g8.auth.ts)`);
+  const written = writeAuthSecrets(abs, auth);
+  if (written.length) io.out(`write .env.local  (fresh ${written.join(" and ")} for local development; git-ignored, not printed)`);
+  return 0;
+}
+function authOutro(auth, dir) {
+  const env = import_node_path11.default.posix.join(dir, ".env.local");
+  if (auth === "password") return [`     sign in with G8_APP_PASSWORD from ${env} (set your own G8_APP_PASSWORD and G8_SESSION_SECRET on your host)`];
+  if (auth === "basic") return [`     the browser asks for the G8_BASIC_AUTH user and password in ${env}`];
+  if (auth === "jwt") return [`     set your identity provider in ${env} (G8_JWT_ISSUER, G8_JWT_AUDIENCE, G8_JWT_COOKIE, G8_SIGN_IN_URL; see g8.auth.ts)`];
+  if (auth === "session") return ["     wire your session library in g8.auth.ts (Clerk, NextAuth, Supabase examples inside); until then it refuses everyone"];
+  return ["     WARNING: --auth anonymous: anyone who can reach this app can use its graph8 API key. Use a narrow key with a spend cap."];
+}
+
 // src/cli.ts
 var LIST_USAGE = `Usage: npx @graph8/sdk list [--json]
 
@@ -6471,7 +6801,7 @@ Run a command with --help for its options.
 
 ${INIT_AGENT_USAGE}`;
 function registryFor(io) {
-  const root = io.blocksRoot ?? process.env.G8_BLOCKS_DIR ?? import_node_path10.default.resolve(__dirname, "..", "blocks");
+  const root = io.blocksRoot ?? process.env.G8_BLOCKS_DIR ?? import_node_path12.default.resolve(__dirname, "..", "blocks");
   return loadRegistry(root);
 }
 function defaultSpawn(cmd, args, cwd) {
@@ -6545,14 +6875,15 @@ function runCreateCommand(rest, io) {
   if (wantsHelp(rest)) return io.out(CREATE_USAGE), 0;
   try {
     const opts = parseCreateArgs(rest);
-    const packageRoot = import_node_path10.default.resolve(__dirname, "..");
+    const packageRoot = import_node_path12.default.resolve(__dirname, "..");
     const cio = {
       out: io.out,
       err: io.err,
       spawn: io.spawn ?? defaultSpawn,
-      templatesRoot: io.templatesRoot ?? process.env.G8_TEMPLATES_DIR ?? import_node_path10.default.join(packageRoot, "templates"),
-      sdkPackageJson: import_node_path10.default.join(packageRoot, "package.json"),
-      userAgent: io.userAgent ?? process.env.npm_config_user_agent
+      templatesRoot: io.templatesRoot ?? process.env.G8_TEMPLATES_DIR ?? import_node_path12.default.join(packageRoot, "templates"),
+      sdkPackageJson: import_node_path12.default.join(packageRoot, "package.json"),
+      userAgent: io.userAgent ?? process.env.npm_config_user_agent,
+      orgBrand: io.orgBrand
     };
     return runCreate(opts, registryFor(io), cio, io.cwd);
   } catch (e) {
@@ -6563,13 +6894,13 @@ function runAddCommand(rest, io) {
   if (wantsHelp(rest)) return io.out(ADD_USAGE), 0;
   try {
     const opts = parseAddArgs(rest);
-    const packageRoot = import_node_path10.default.resolve(__dirname, "..");
+    const packageRoot = import_node_path12.default.resolve(__dirname, "..");
     const aio = {
       out: io.out,
       err: io.err,
       spawn: io.spawn ?? defaultSpawn,
-      templatesRoot: io.templatesRoot ?? process.env.G8_TEMPLATES_DIR ?? import_node_path10.default.join(packageRoot, "templates"),
-      sdkPackageJson: import_node_path10.default.join(packageRoot, "package.json")
+      templatesRoot: io.templatesRoot ?? process.env.G8_TEMPLATES_DIR ?? import_node_path12.default.join(packageRoot, "templates"),
+      sdkPackageJson: import_node_path12.default.join(packageRoot, "package.json")
     };
     return runAdd(opts, registryFor(io), aio, io.cwd);
   } catch (e) {
@@ -6589,7 +6920,7 @@ function runCli(argv, io) {
   if (command === "brand") {
     if (wantsHelp(rest)) return io.out(BRAND_USAGE), 0;
     try {
-      return runBrand(parseBrandArgs(rest), { out: io.out, err: io.err }, io.cwd);
+      return runBrand(parseBrandArgs(rest), { out: io.out, err: io.err }, io.cwd, void 0, io.orgBrand);
     } catch (e) {
       return fail(io, e.message);
     }
@@ -6613,8 +6944,8 @@ ${USAGE}`);
     return 1;
   }
   const read = (rel) => {
-    const full = import_node_path10.default.join(io.cwd, rel);
-    return import_node_fs9.default.existsSync(full) ? import_node_fs9.default.readFileSync(full, "utf8") : null;
+    const full = import_node_path12.default.join(io.cwd, rel);
+    return import_node_fs11.default.existsSync(full) ? import_node_fs11.default.readFileSync(full, "utf8") : null;
   };
   let plans;
   try {
@@ -6625,17 +6956,36 @@ ${USAGE}`);
   }
   for (const plan of plans) {
     if (!options.dryRun && plan.action !== "unchanged") {
-      const full = import_node_path10.default.join(io.cwd, plan.path);
-      import_node_fs9.default.mkdirSync(import_node_path10.default.dirname(full), { recursive: true });
-      import_node_fs9.default.writeFileSync(full, plan.content, "utf8");
+      const full = import_node_path12.default.join(io.cwd, plan.path);
+      import_node_fs11.default.mkdirSync(import_node_path12.default.dirname(full), { recursive: true });
+      import_node_fs11.default.writeFileSync(full, plan.content, "utf8");
     }
     io.out(`${options.dryRun ? "would " : ""}${plan.action === "unchanged" ? "keep" : plan.action} ${plan.path}  (${plan.target})`);
   }
   if (!options.dryRun) io.out("\nDone. The full guide is node_modules/@graph8/sdk/docs/agents.md.");
   return 0;
 }
+function brandRoot(command, rest, io) {
+  const at = rest.findIndex((a) => a === "--dir" || a.startsWith("--dir="));
+  const dir = at < 0 ? void 0 : rest[at].includes("=") ? rest[at].slice(6) : rest[at + 1];
+  return command === "brand" && dir ? import_node_path12.default.resolve(io.cwd, dir) : io.cwd;
+}
+async function runWithOrgBrand(command, rest, argv, io) {
+  const wants = !wantsHelp(rest) && !rest.includes("--no-org-brand") && (command === "brand" || !rest.includes("--dry-run")) && (command === "create" || rest.includes("--from-org") || !rest.some((a) => a.startsWith("--") && a !== "--dir" && !a.startsWith("--dir=")));
+  if (!wants) return runCli(argv, io);
+  const pull = await pullOrgBrand({ env: io.env ?? process.env, fetch: io.fetch }, brandRoot(command, rest, io));
+  io.out(pull.info);
+  const bare = command === "brand" && !rest.includes("--from-org") && !rest.some((a) => a.startsWith("--") && a !== "--dir" && !a.startsWith("--dir="));
+  if (bare && !Object.keys(pull.values).length) return runCli(argv, io);
+  try {
+    return runCli(bare ? [...argv, "--from-org"] : argv, { ...io, orgBrand: pull.values });
+  } finally {
+    pull.cleanup();
+  }
+}
 async function runCliAsync(argv, io) {
   const [command, ...rest] = argv;
+  if (command === "create" || command === "brand") return runWithOrgBrand(command, rest, argv, io);
   if (command !== "doctor") return runCli(argv, io);
   if (wantsHelp(rest)) return io.out(DOCTOR_USAGE), 0;
   try {