@iamsaroj/replicax 0.0.1

package/dist/index.js

@@ -0,0 +1,1562 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { readFileSync } from "fs";
+import { Command } from "commander";
+
+// src/utils/errors.ts
+var ReplicaxError = class extends Error {
+  /** Optional follow-up lines shown under the main message as hints. */
+  hints;
+  constructor(message, hints = []) {
+    super(message);
+    this.name = "ReplicaxError";
+    this.hints = hints;
+  }
+};
+
+// src/utils/logger.ts
+import pc from "picocolors";
+var verbose = false;
+function setVerbose(value) {
+  verbose = value;
+}
+function isVerbose() {
+  return verbose;
+}
+function write(line) {
+  process.stderr.write(line + "\n");
+}
+var logger = {
+  /** Plain informational line. */
+  info(message) {
+    write(`${pc.blue("\u2139")} ${message}`);
+  },
+  success(message) {
+    write(`${pc.green("\u2714")} ${message}`);
+  },
+  warn(message) {
+    write(`${pc.yellow("\u26A0")} ${pc.yellow(message)}`);
+  },
+  error(message) {
+    write(`${pc.red("\u2716")} ${pc.red(message)}`);
+  },
+  /** A nested detail line, only shown in verbose mode. */
+  detail(message) {
+    if (verbose) write(`  ${pc.dim(message)}`);
+  },
+  /** Always-shown dim hint, e.g. follow-up suggestions. */
+  hint(message) {
+    write(`  ${pc.dim(message)}`);
+  },
+  /** A blank separator line. */
+  newline() {
+    write("");
+  },
+  /** Write a raw line to stdout (for results meant to be piped/captured). */
+  out(line) {
+    process.stdout.write(line + "\n");
+  }
+};
+
+// src/commands/init.ts
+import path6 from "path";
+import fs5 from "fs-extra";
+import ora from "ora";
+import { confirm } from "@inquirer/prompts";
+
+// src/constants.ts
+var REPLICAX_DIR = ".replicax";
+var IGNORE_FILE = ".replicaxignore";
+var REPLICAX_VERSION = "2.0.0";
+var PROFILE_FILES = {
+  profile: "profile.json",
+  tooling: "tooling.json",
+  structure: "structure.json",
+  metadata: "metadata.json",
+  checksum: "checksum.json"
+};
+var SCAN_PRUNE_GLOBS = [
+  "**/node_modules/**",
+  "**/.git/**",
+  "**/dist/**",
+  "**/build/**",
+  "**/out/**",
+  "**/coverage/**",
+  "**/.next/**",
+  "**/.nuxt/**",
+  "**/.svelte-kit/**",
+  "**/.turbo/**",
+  "**/.cache/**",
+  "**/.vercel/**",
+  "**/.output/**",
+  "**/.parcel-cache/**",
+  `**/${REPLICAX_DIR}/**`,
+  "**/.husky/_/**",
+  "**/.vscode/**",
+  "**/.idea/**",
+  "**/.vs/**",
+  "**/.fleet/**",
+  "**/.zed/**"
+];
+var DEFAULT_IGNORE_PATTERNS = [
+  "node_modules/",
+  ".git/",
+  "dist/",
+  "build/",
+  "out/",
+  "coverage/",
+  ".next/",
+  ".nuxt/",
+  ".svelte-kit/",
+  ".turbo/",
+  ".cache/",
+  ".vercel/",
+  ".output/",
+  ".parcel-cache/",
+  `${REPLICAX_DIR}/`,
+  ".husky/_/",
+  ".vscode/",
+  ".idea/",
+  ".vs/",
+  ".fleet/",
+  ".zed/"
+];
+var SECRET_GUARD_GLOBS = [
+  "**/.env",
+  "**/.env.*",
+  "**/*.pem",
+  "**/*.key",
+  "**/*.p12",
+  "**/*.pfx",
+  "**/*.cert",
+  "**/*.crt",
+  "**/*.keystore",
+  "**/*.jks",
+  "**/id_rsa*",
+  "**/id_dsa*",
+  "**/id_ecdsa*",
+  "**/id_ed25519*",
+  "**/.netrc",
+  "**/secrets.*",
+  "**/*.secret",
+  "**/*.secrets"
+];
+var DEFAULT_IGNORE_FILE_CONTENTS = `# .replicaxignore \u2014 control what ReplicaX exports into a profile.
+# Uses .gitignore syntax. Matched files are excluded from the profile,
+# though ReplicaX may still scan them to infer project metadata.
+
+# Business logic & application source (structure is kept, contents are not)
+src/features/**
+src/services/**
+src/api/**
+src/**/*.ts
+src/**/*.tsx
+src/**/*.js
+src/**/*.jsx
+
+# Secrets (also enforced unconditionally by ReplicaX)
+.env
+.env.*
+*.pem
+*.key
+
+# Dependencies & build output
+node_modules/
+dist/
+build/
+coverage/
+.next/
+.nuxt/
+
+# Logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+`;
+
+// src/core/scanner.ts
+import path4 from "path";
+import fs3 from "fs-extra";
+import fg from "fast-glob";
+
+// src/config/supported-files.ts
+var CONFIG_CATEGORIES = [
+  {
+    id: "typescript",
+    label: "Language & Type Checking",
+    patterns: ["tsconfig.json", "tsconfig.*.json", "jsconfig.json"]
+  },
+  {
+    id: "prettier",
+    label: "Formatting",
+    patterns: [".prettierrc", ".prettierrc.*", "prettier.config.*", ".prettierignore"]
+  },
+  {
+    id: "eslint",
+    label: "Linting",
+    patterns: ["eslint.config.*", ".eslintrc", ".eslintrc.*", ".eslintignore"]
+  },
+  {
+    id: "build",
+    label: "Build Tools",
+    patterns: [
+      "vite.config.*",
+      "webpack.config.*",
+      "rollup.config.*",
+      "esbuild.config.*",
+      "turbo.json"
+    ]
+  },
+  {
+    id: "styling",
+    label: "Styling",
+    patterns: ["tailwind.config.*", "postcss.config.*"]
+  },
+  {
+    id: "package",
+    label: "Package Management & Monorepos",
+    patterns: [
+      // package.json is handled specially (curated template), not here.
+      "pnpm-workspace.yaml",
+      "nx.json",
+      "lerna.json",
+      ".npmrc",
+      ".nvmrc",
+      ".node-version"
+    ]
+  },
+  {
+    id: "docker",
+    label: "Docker",
+    patterns: [
+      "Dockerfile",
+      "Dockerfile.*",
+      "docker-compose.yml",
+      "docker-compose.yaml",
+      "docker-compose.*.yml",
+      "docker-compose.*",
+      "compose.yml",
+      "compose.yaml",
+      ".dockerignore"
+    ]
+  },
+  {
+    id: "git",
+    label: "Git",
+    patterns: [".gitignore", ".gitattributes", ".gitmessage"]
+  },
+  {
+    id: "editor",
+    label: "Editor",
+    // Only the portable, cross-editor `.editorconfig` is captured. IDE-specific
+    // folders (`.vscode/`, `.idea/`, …) are intentionally excluded — see the IDE
+    // entries in DEFAULT_IGNORE_PATTERNS / SCAN_PRUNE_GLOBS.
+    patterns: [".editorconfig"]
+  },
+  {
+    id: "testing",
+    label: "Testing",
+    patterns: [
+      "vitest.config.*",
+      "vitest.workspace.*",
+      "jest.config.*",
+      "jest.setup.*",
+      "playwright.config.*",
+      "cypress.config.*"
+    ]
+  },
+  {
+    id: "cicd",
+    label: "CI/CD",
+    patterns: [
+      ".github/workflows/*.yml",
+      ".github/workflows/*.yaml",
+      ".gitlab-ci.yml",
+      ".circleci/config.yml",
+      "Jenkinsfile",
+      "azure-pipelines.yml"
+    ]
+  },
+  {
+    id: "husky",
+    label: "Git Hooks",
+    patterns: [".husky/*"]
+  },
+  {
+    id: "misc",
+    label: "Miscellaneous Tooling",
+    patterns: [
+      "commitlint.config.*",
+      "lint-staged.config.*",
+      ".lintstagedrc",
+      ".lintstagedrc.*",
+      "release.config.*",
+      ".releaserc",
+      ".releaserc.*",
+      "knip.config.*",
+      "knip.json",
+      "renovate.json",
+      ".czrc"
+    ]
+  }
+];
+var ALL_CONFIG_PATTERNS = CONFIG_CATEGORIES.flatMap((c) => c.patterns);
+var CATEGORY_BY_ID = new Map(CONFIG_CATEGORIES.map((c) => [c.id, c]));
+
+// src/utils/paths.ts
+import path from "path";
+function toPosix(p) {
+  return p.replace(/\\/g, "/");
+}
+function relPosix(root, target) {
+  return toPosix(path.relative(root, target));
+}
+function detectVariant(filePath) {
+  const ext = path.extname(filePath).toLowerCase();
+  switch (ext) {
+    case ".ts":
+    case ".cts":
+    case ".mts":
+      return ext === ".cts" ? "cjs" : ext === ".mts" ? "mjs" : "ts";
+    case ".js":
+      return "js";
+    case ".mjs":
+      return "mjs";
+    case ".cjs":
+      return "cjs";
+    case ".json":
+      return "json";
+    case ".yml":
+    case ".yaml":
+      return "yaml";
+    default:
+      return "other";
+  }
+}
+function safeJoinable(relPath) {
+  const normalized = toPosix(relPath).replace(/^\.\//, "");
+  if (normalized.length === 0 || path.isAbsolute(normalized) || normalized.startsWith("/") || /^[a-zA-Z]:/.test(normalized) || normalized.split("/").some((seg) => seg === "..")) {
+    return null;
+  }
+  return normalized;
+}
+
+// src/core/ignore-engine.ts
+import path2 from "path";
+import fs from "fs-extra";
+import ignore from "ignore";
+var IgnoreEngine = class _IgnoreEngine {
+  ig;
+  secrets;
+  userPatterns;
+  constructor(userPatterns = []) {
+    this.userPatterns = userPatterns.filter((line) => {
+      const t = line.trim();
+      return t.length > 0 && !t.startsWith("#");
+    });
+    this.ig = ignore().add(DEFAULT_IGNORE_PATTERNS).add(this.userPatterns);
+    this.secrets = ignore().add(SECRET_GUARD_GLOBS);
+  }
+  /** Build an engine from a project's `.replicaxignore`, if present. */
+  static async fromProject(root) {
+    const file = path2.join(root, IGNORE_FILE);
+    if (await fs.pathExists(file)) {
+      const content = await fs.readFile(file, "utf8");
+      return new _IgnoreEngine(content.split(/\r?\n/));
+    }
+    return new _IgnoreEngine([]);
+  }
+  /** Whether a path is excluded by default or user ignore rules. */
+  isIgnored(relPosixPath) {
+    if (!relPosixPath || relPosixPath === ".") return false;
+    return this.ig.ignores(relPosixPath);
+  }
+  /** Whether a path is a protected secret that must never be captured. */
+  isSecret(relPosixPath) {
+    if (!relPosixPath || relPosixPath === ".") return false;
+    return this.secrets.ignores(relPosixPath);
+  }
+};
+
+// src/core/detect.ts
+import path3 from "path";
+import fs2 from "fs-extra";
+async function readPackageJson(root) {
+  const file = path3.join(root, "package.json");
+  if (!await fs2.pathExists(file)) return null;
+  try {
+    return await fs2.readJson(file);
+  } catch {
+    return null;
+  }
+}
+function allDeps(pkg) {
+  return { ...pkg?.dependencies ?? {}, ...pkg?.devDependencies ?? {} };
+}
+async function detectPackageManager(root, pkg) {
+  const field = pkg?.packageManager;
+  if (typeof field === "string") {
+    const name = field.split("@")[0]?.trim().toLowerCase();
+    if (name === "pnpm" || name === "yarn" || name === "npm" || name === "bun") return name;
+  }
+  const lockfiles = [
+    ["pnpm-lock.yaml", "pnpm"],
+    ["bun.lockb", "bun"],
+    ["bun.lock", "bun"],
+    ["yarn.lock", "yarn"],
+    ["package-lock.json", "npm"],
+    ["npm-shrinkwrap.json", "npm"]
+  ];
+  for (const [file, manager] of lockfiles) {
+    if (await fs2.pathExists(path3.join(root, file))) return manager;
+  }
+  return pkg ? "npm" : "unknown";
+}
+async function detectNodeVersion(root, pkg) {
+  for (const file of [".nvmrc", ".node-version"]) {
+    const full = path3.join(root, file);
+    if (await fs2.pathExists(full)) {
+      const value = (await fs2.readFile(full, "utf8")).trim();
+      if (value) return value;
+    }
+  }
+  const enginesNode = pkg?.engines?.node;
+  if (enginesNode) return enginesNode;
+  const major = process.versions.node.split(".")[0];
+  return `${major}.x`;
+}
+async function detectLanguage(root, pkg) {
+  const deps = allDeps(pkg);
+  if ("typescript" in deps) return "typescript";
+  for (const file of ["tsconfig.json", "tsconfig.base.json", "jsconfig.json"]) {
+    if (await fs2.pathExists(path3.join(root, file))) {
+      return file === "jsconfig.json" ? "javascript" : "typescript";
+    }
+  }
+  return "javascript";
+}
+function detectFramework(pkg) {
+  const deps = allDeps(pkg);
+  const has = (name) => name in deps;
+  const checks = [
+    [has("next"), "next"],
+    [has("nuxt") || has("nuxt3"), "nuxt"],
+    [has("@remix-run/react"), "remix"],
+    [has("astro"), "astro"],
+    [has("@angular/core"), "angular"],
+    [has("@sveltejs/kit"), "sveltekit"],
+    [has("@nestjs/core"), "nestjs"],
+    [has("expo"), "expo"],
+    [has("react-native"), "react-native"],
+    [has("vue"), "vue"],
+    [has("svelte"), "svelte"],
+    [has("solid-js"), "solid"],
+    [has("react"), "react"],
+    [has("@fastify/fastify") || has("fastify"), "fastify"],
+    [has("koa"), "koa"],
+    [has("express"), "express"]
+  ];
+  for (const [matched, name] of checks) {
+    if (matched) return name;
+  }
+  return pkg ? "node" : "unknown";
+}
+async function detectMetadata(root, pkg) {
+  const [packageManager, nodeVersion, language] = await Promise.all([
+    detectPackageManager(root, pkg),
+    detectNodeVersion(root, pkg),
+    detectLanguage(root, pkg)
+  ]);
+  return {
+    nodeVersion,
+    packageManager,
+    framework: detectFramework(pkg),
+    language,
+    platform: process.platform
+  };
+}
+
+// src/core/package-template.ts
+var PASSTHROUGH_CONFIG_KEYS = [
+  "lint-staged",
+  "nano-staged",
+  "prettier",
+  "eslintConfig",
+  "commitlint",
+  "release",
+  "husky",
+  "browserslist",
+  "c8",
+  "jest"
+];
+function nonEmptyRecord(value) {
+  if (!value || typeof value !== "object") return void 0;
+  const entries = Object.entries(value).filter(
+    ([, v]) => typeof v === "string"
+  );
+  return entries.length ? Object.fromEntries(entries) : void 0;
+}
+function buildPackageTemplate(pkg) {
+  if (!pkg) return void 0;
+  const template = {};
+  if (typeof pkg.type === "string") template.type = pkg.type;
+  if (typeof pkg.packageManager === "string") template.packageManager = pkg.packageManager;
+  const scripts = nonEmptyRecord(pkg.scripts);
+  if (scripts) template.scripts = scripts;
+  const devDependencies = nonEmptyRecord(pkg.devDependencies);
+  if (devDependencies) template.devDependencies = devDependencies;
+  const engines = nonEmptyRecord(pkg.engines);
+  if (engines) template.engines = engines;
+  const config = {};
+  for (const key of PASSTHROUGH_CONFIG_KEYS) {
+    if (key in pkg && pkg[key] !== void 0) config[key] = pkg[key];
+  }
+  if (Object.keys(config).length) template.config = config;
+  return template;
+}
+function stableStringify(value) {
+  return JSON.stringify(sortDeep(value));
+}
+function sortDeep(value) {
+  if (Array.isArray(value)) return value.map(sortDeep);
+  if (value && typeof value === "object") {
+    const sorted = {};
+    for (const key of Object.keys(value).sort()) {
+      sorted[key] = sortDeep(value[key]);
+    }
+    return sorted;
+  }
+  return value;
+}
+function canonicalPackageJson(template) {
+  return stableStringify(template);
+}
+function renderPackageJson(template, projectName) {
+  const ordered = {
+    name: projectName,
+    version: "0.1.0",
+    private: true
+  };
+  if (template.type) ordered.type = template.type;
+  if (template.packageManager) ordered.packageManager = template.packageManager;
+  if (template.engines) ordered.engines = template.engines;
+  if (template.scripts) ordered.scripts = template.scripts;
+  for (const [key, value] of Object.entries(template.config ?? {})) {
+    ordered[key] = value;
+  }
+  if (template.devDependencies) ordered.devDependencies = template.devDependencies;
+  return JSON.stringify(ordered, null, 2) + "\n";
+}
+
+// src/core/scanner.ts
+var FG_BASE_OPTIONS = {
+  dot: true,
+  followSymbolicLinks: false,
+  suppressErrors: true,
+  ignore: SCAN_PRUNE_GLOBS
+};
+function sanitizeNpmrc(content) {
+  const lines = content.split(/\r?\n/);
+  const sensitive = /(_auth(token)?|_password|:_secret|:always-auth=)/i;
+  const assignment = /^\s*[^#;=\s]*(token|password|secret|api[-_]?key)\s*=/i;
+  const kept = lines.filter((line) => {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith(";")) return true;
+    return !sensitive.test(trimmed) && !assignment.test(trimmed);
+  });
+  return kept.join("\n");
+}
+async function scanToolingFiles(root, ignore2) {
+  const categoryOf = /* @__PURE__ */ new Map();
+  for (const category of CONFIG_CATEGORIES) {
+    const found = await fg(category.patterns, {
+      cwd: root,
+      onlyFiles: true,
+      unique: true,
+      ...FG_BASE_OPTIONS
+    });
+    for (const rel of found) {
+      const norm = toPosix(rel);
+      if (!categoryOf.has(norm)) categoryOf.set(norm, category.id);
+    }
+  }
+  const files = [];
+  const skippedSecrets = [];
+  for (const rel of [...categoryOf.keys()].sort()) {
+    if (rel === "package.json") continue;
+    if (ignore2.isSecret(rel)) {
+      skippedSecrets.push(rel);
+      logger.detail(`skipped (secret guard): ${rel}`);
+      continue;
+    }
+    if (ignore2.isIgnored(rel)) {
+      logger.detail(`skipped (.replicaxignore): ${rel}`);
+      continue;
+    }
+    const abs = path4.join(root, rel);
+    let stat;
+    try {
+      stat = await fs3.stat(abs);
+    } catch {
+      continue;
+    }
+    if (!stat.isFile()) continue;
+    let content = await fs3.readFile(abs, "utf8");
+    if (path4.basename(rel) === ".npmrc") content = sanitizeNpmrc(content);
+    files.push({
+      path: rel,
+      category: categoryOf.get(rel) ?? "misc",
+      variant: detectVariant(rel),
+      encoding: "utf8",
+      content,
+      bytes: Buffer.byteLength(content, "utf8")
+    });
+    logger.detail(`captured: ${rel}`);
+  }
+  return { files, skippedSecrets };
+}
+async function scanStructure(root, ignore2) {
+  const dirs = await fg("**", {
+    cwd: root,
+    onlyDirectories: true,
+    unique: true,
+    ...FG_BASE_OPTIONS
+  });
+  const directories = dirs.map(toPosix).filter((d) => d.length > 0 && d !== ".").filter((d) => !ignore2.isIgnored(d)).sort();
+  return {
+    root: path4.basename(path4.resolve(root)) || "project",
+    directories
+  };
+}
+async function scanProject(root) {
+  const resolved = path4.resolve(root);
+  if (!await fs3.pathExists(resolved)) {
+    throw new Error(`Directory does not exist: ${resolved}`);
+  }
+  const ignore2 = await IgnoreEngine.fromProject(resolved);
+  const pkg = await readPackageJson(resolved);
+  const [{ files, skippedSecrets }, structure, metadata] = await Promise.all([
+    scanToolingFiles(resolved, ignore2),
+    scanStructure(resolved, ignore2),
+    detectMetadata(resolved, pkg)
+  ]);
+  const tooling = {
+    files,
+    packageJson: buildPackageTemplate(pkg)
+  };
+  return { tooling, structure, metadata, pkg, skippedSecrets };
+}
+
+// src/core/checksum.ts
+import { createHash } from "crypto";
+var PACKAGE_JSON_KEY = "package.json";
+function sha256(content) {
+  return createHash("sha256").update(content, "utf8").digest("hex");
+}
+function computeChecksum(tooling) {
+  const files = {};
+  for (const file of tooling.files) {
+    files[file.path] = sha256(file.content);
+  }
+  if (tooling.packageJson) {
+    files[PACKAGE_JSON_KEY] = sha256(canonicalPackageJson(tooling.packageJson));
+  }
+  return { algorithm: "sha256", files };
+}
+function verifyChecksum(tooling, stored) {
+  const current = computeChecksum(tooling);
+  const mismatches = [];
+  for (const [key, hash] of Object.entries(stored.files)) {
+    const actual = current.files[key];
+    if (actual === void 0) {
+      mismatches.push({ path: key, reason: "missing" });
+    } else if (actual !== hash) {
+      mismatches.push({ path: key, reason: "altered" });
+    }
+  }
+  for (const key of Object.keys(current.files)) {
+    if (!(key in stored.files)) {
+      mismatches.push({ path: key, reason: "unexpected" });
+    }
+  }
+  return mismatches;
+}
+
+// src/core/profile-generator.ts
+function buildBundle(args) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const profile = args.existing ? {
+    ...args.existing,
+    name: args.name,
+    description: args.description ?? args.existing.description,
+    replicaxVersion: REPLICAX_VERSION,
+    updatedAt: now
+  } : {
+    name: args.name,
+    version: "1.0.0",
+    createdAt: now,
+    replicaxVersion: REPLICAX_VERSION,
+    ...args.description ? { description: args.description } : {}
+  };
+  return {
+    profile,
+    tooling: args.tooling,
+    structure: args.structure,
+    metadata: args.metadata,
+    checksum: computeChecksum(args.tooling)
+  };
+}
+
+// src/core/profile-store.ts
+import path5 from "path";
+import fs4 from "fs-extra";
+
+// src/schema.ts
+import { z } from "zod";
+var ProfileSchema = z.object({
+  name: z.string().min(1),
+  version: z.string().min(1),
+  createdAt: z.string().min(1),
+  updatedAt: z.string().optional(),
+  replicaxVersion: z.string().min(1),
+  description: z.string().optional()
+});
+var FileVariantSchema = z.enum(["ts", "js", "mjs", "cjs", "json", "yaml", "other"]);
+var ToolingFileSchema = z.object({
+  /** POSIX-style path relative to the project root. */
+  path: z.string().min(1),
+  /** High-level grouping, e.g. "typescript", "eslint", "docker". */
+  category: z.string().min(1),
+  /** Detected file flavour, used purely for display/inspection. */
+  variant: FileVariantSchema,
+  /** Text encoding of {@link content}. */
+  encoding: z.enum(["utf8", "base64"]),
+  /** Verbatim file contents. */
+  content: z.string(),
+  /** Original size in bytes. */
+  bytes: z.number().int().nonnegative()
+});
+var PackageTemplateSchema = z.object({
+  type: z.string().optional(),
+  scripts: z.record(z.string(), z.string()).optional(),
+  devDependencies: z.record(z.string(), z.string()).optional(),
+  engines: z.record(z.string(), z.string()).optional(),
+  packageManager: z.string().optional(),
+  /** Pass-through config blocks that legitimately live in package.json. */
+  config: z.record(z.string(), z.unknown()).optional()
+});
+var ToolingSchema = z.object({
+  files: z.array(ToolingFileSchema),
+  packageJson: PackageTemplateSchema.optional()
+});
+var StructureSchema = z.object({
+  root: z.string(),
+  directories: z.array(z.string())
+});
+var MetadataSchema = z.object({
+  nodeVersion: z.string(),
+  packageManager: z.enum(["npm", "yarn", "pnpm", "bun", "unknown"]),
+  framework: z.string(),
+  language: z.enum(["typescript", "javascript"]),
+  platform: z.string()
+});
+var ChecksumSchema = z.object({
+  algorithm: z.literal("sha256"),
+  files: z.record(z.string(), z.string())
+});
+
+// src/core/profile-store.ts
+function profileDir(root) {
+  return path5.join(path5.resolve(root), REPLICAX_DIR);
+}
+async function profileExists(dir) {
+  return fs4.pathExists(path5.join(dir, PROFILE_FILES.profile));
+}
+async function resolveProfileDir(input) {
+  const resolved = path5.resolve(input);
+  if (!await fs4.pathExists(resolved)) {
+    throw new ReplicaxError(`Profile path not found: ${input}`);
+  }
+  if (await profileExists(resolved)) return resolved;
+  const nested = path5.join(resolved, REPLICAX_DIR);
+  if (await profileExists(nested)) return nested;
+  throw new ReplicaxError(`No ReplicaX profile found at: ${input}`, [
+    `Looked for ${PROFILE_FILES.profile} in ${resolved} and ${nested}.`,
+    "Run `replicax init` in the source project first."
+  ]);
+}
+async function saveBundle(dir, bundle) {
+  await fs4.ensureDir(dir);
+  await Promise.all([
+    fs4.writeJson(path5.join(dir, PROFILE_FILES.profile), bundle.profile, { spaces: 2 }),
+    fs4.writeJson(path5.join(dir, PROFILE_FILES.tooling), bundle.tooling, { spaces: 2 }),
+    fs4.writeJson(path5.join(dir, PROFILE_FILES.structure), bundle.structure, { spaces: 2 }),
+    fs4.writeJson(path5.join(dir, PROFILE_FILES.metadata), bundle.metadata, { spaces: 2 }),
+    fs4.writeJson(path5.join(dir, PROFILE_FILES.checksum), bundle.checksum, { spaces: 2 })
+  ]);
+}
+async function readAndParse(dir, file, schema) {
+  const full = path5.join(dir, file);
+  if (!await fs4.pathExists(full)) {
+    throw new ReplicaxError(`Profile is missing ${file}`, [`Expected at ${full}.`]);
+  }
+  let raw;
+  try {
+    raw = await fs4.readJson(full);
+  } catch {
+    throw new ReplicaxError(`Profile file ${file} is not valid JSON`, [`Path: ${full}`]);
+  }
+  const result = schema.safeParse(raw);
+  if (!result.success) {
+    const issues = result.error.issues.slice(0, 5).map((i) => `  - ${i.path.join(".") || "(root)"}: ${i.message}`);
+    throw new ReplicaxError(`Profile file ${file} failed validation`, issues);
+  }
+  return result.data;
+}
+async function loadBundle(dir) {
+  if (!await profileExists(dir)) {
+    throw new ReplicaxError(`No ReplicaX profile found in ${dir}`, [
+      "Run `replicax init` to create one."
+    ]);
+  }
+  const [profile, tooling, structure, metadata, checksum] = await Promise.all([
+    readAndParse(dir, PROFILE_FILES.profile, ProfileSchema),
+    readAndParse(dir, PROFILE_FILES.tooling, ToolingSchema),
+    readAndParse(dir, PROFILE_FILES.structure, StructureSchema),
+    readAndParse(dir, PROFILE_FILES.metadata, MetadataSchema),
+    readAndParse(dir, PROFILE_FILES.checksum, ChecksumSchema)
+  ]);
+  return { profile, tooling, structure, metadata, checksum };
+}
+
+// src/commands/report.ts
+function toolingByCategory(tooling) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const file of tooling.files) {
+    counts.set(file.category, (counts.get(file.category) ?? 0) + 1);
+  }
+  if (tooling.packageJson) {
+    counts.set("package", (counts.get("package") ?? 0) + 1);
+  }
+  return [...counts.entries()].map(([id, n]) => [CATEGORY_BY_ID.get(id)?.label ?? id, n]).sort((a, b) => a[0].localeCompare(b[0]));
+}
+function printScanSummary(bundle) {
+  const { metadata, tooling, structure } = bundle;
+  logger.newline();
+  logger.info(pc.bold("Captured setup"));
+  logger.hint(`language       ${metadata.language}`);
+  logger.hint(`framework      ${metadata.framework}`);
+  logger.hint(`packageManager ${metadata.packageManager}`);
+  logger.hint(`nodeVersion    ${metadata.nodeVersion}`);
+  logger.newline();
+  logger.info(pc.bold(`Tooling (${tooling.files.length + (tooling.packageJson ? 1 : 0)} files)`));
+  for (const [label, count] of toolingByCategory(tooling)) {
+    logger.hint(`${label.padEnd(32)} ${count}`);
+  }
+  logger.newline();
+  logger.info(pc.bold(`Structure (${structure.directories.length} directories)`));
+}
+function reportSkippedSecrets(skipped) {
+  if (skipped.length === 0) return;
+  logger.warn(`Excluded ${skipped.length} protected file(s) from the profile:`);
+  for (const file of skipped) logger.hint(file);
+}
+
+// src/utils/tree.ts
+function emptyNode(name) {
+  return { name, children: /* @__PURE__ */ new Map() };
+}
+function renderTree(directories, rootLabel = ".") {
+  const root = emptyNode(rootLabel);
+  for (const dir of directories) {
+    let cursor = root;
+    for (const segment of dir.split("/")) {
+      if (!segment) continue;
+      let child = cursor.children.get(segment);
+      if (!child) {
+        child = emptyNode(segment);
+        cursor.children.set(segment, child);
+      }
+      cursor = child;
+    }
+  }
+  const lines = [root.name + "/"];
+  const walk = (node, prefix) => {
+    const children = [...node.children.values()].sort((a, b) => a.name.localeCompare(b.name));
+    children.forEach((child, index) => {
+      const last = index === children.length - 1;
+      lines.push(`${prefix}${last ? "\u2514\u2500\u2500 " : "\u251C\u2500\u2500 "}${child.name}/`);
+      walk(child, `${prefix}${last ? "    " : "\u2502   "}`);
+    });
+  };
+  walk(root, "");
+  return lines.join("\n");
+}
+
+// src/commands/init.ts
+async function initCommand(options) {
+  if (options.verbose) setVerbose(true);
+  const root = process.cwd();
+  const dir = profileDir(root);
+  const alreadyExists = await profileExists(dir);
+  const spinner = ora({ text: "Scanning project\u2026", isEnabled: !options.verbose }).start();
+  const scan = await scanProject(root);
+  spinner.succeed(
+    `Scanned ${scan.tooling.files.length} config file(s) and ${scan.structure.directories.length} director(ies)`
+  );
+  const name = options.name ?? path6.basename(path6.resolve(root)) ?? "project";
+  const bundle = buildBundle({
+    name,
+    tooling: scan.tooling,
+    structure: scan.structure,
+    metadata: scan.metadata
+  });
+  reportSkippedSecrets(scan.skippedSecrets);
+  printScanSummary(bundle);
+  logger.out(renderTree(bundle.structure.directories, bundle.structure.root));
+  if (options.dryRun) {
+    logger.newline();
+    logger.info("Dry run \u2014 no files were written.");
+    return;
+  }
+  if (alreadyExists) {
+    logger.warn("A ReplicaX profile already exists here and will be replaced.");
+  }
+  await saveBundle(dir, bundle);
+  await maybeWriteIgnoreFile(root);
+  logger.newline();
+  logger.success(`Profile "${name}" written to ${relPosix(root, dir)}/`);
+  logger.hint("Create a project from it with: replicax create <project-name>");
+}
+async function maybeWriteIgnoreFile(root) {
+  const file = path6.join(root, IGNORE_FILE);
+  if (await fs5.pathExists(file)) return;
+  const create = process.stdin.isTTY ? await confirm({
+    message: `Create a starter ${IGNORE_FILE} to control what gets exported?`,
+    default: true
+  }) : false;
+  if (create) {
+    await fs5.writeFile(file, DEFAULT_IGNORE_FILE_CONTENTS, "utf8");
+    logger.success(`Wrote ${IGNORE_FILE}`);
+  }
+}
+
+// src/commands/create.ts
+import path8 from "path";
+import fs7 from "fs-extra";
+
+// src/core/conflict-resolver.ts
+import { select } from "@inquirer/prompts";
+var ConflictResolver = class {
+  constructor(policy) {
+    this.policy = policy;
+    this.interactive = Boolean(process.stdin.isTTY);
+  }
+  policy;
+  blanket = null;
+  interactive;
+  async resolve(relPath) {
+    if (this.policy === "overwrite") return "overwrite";
+    if (this.policy === "skip") return "skip";
+    if (this.blanket) return this.blanket;
+    if (!this.interactive) {
+      logger.warn(`${relPath} exists; skipping (non-interactive shell, use --force to overwrite).`);
+      return "skip";
+    }
+    const answer = await select({
+      message: `${relPath} already exists. What should ReplicaX do?`,
+      choices: [
+        { name: "Skip this file", value: "skip" },
+        { name: "Overwrite this file", value: "overwrite" },
+        { name: "Skip all remaining conflicts", value: "skip-all" },
+        { name: "Overwrite all remaining conflicts", value: "overwrite-all" }
+      ]
+    });
+    if (answer === "overwrite-all") {
+      this.blanket = "overwrite";
+      return "overwrite";
+    }
+    if (answer === "skip-all") {
+      this.blanket = "skip";
+      return "skip";
+    }
+    return answer;
+  }
+};
+
+// src/core/project-generator.ts
+import path7 from "path";
+import fs6 from "fs-extra";
+async function generateProject(options) {
+  const { bundle, targetDir, projectName, dryRun, conflict } = options;
+  const result = {
+    entries: [],
+    dirsCreated: 0,
+    filesWritten: 0,
+    filesSkipped: 0,
+    unsafeSkipped: []
+  };
+  if (!dryRun) await fs6.ensureDir(targetDir);
+  for (const dir of bundle.structure.directories) {
+    const safe = safeJoinable(dir);
+    if (!safe) {
+      result.unsafeSkipped.push(dir);
+      continue;
+    }
+    const full = path7.join(targetDir, safe);
+    const existed = await fs6.pathExists(full);
+    if (!dryRun) await fs6.ensureDir(full);
+    if (!existed) result.dirsCreated += 1;
+    result.entries.push({ kind: "dir", path: safe, action: existed ? "skip" : "create" });
+  }
+  if (bundle.tooling.packageJson) {
+    await writeFile(
+      "package.json",
+      renderPackageJson(bundle.tooling.packageJson, projectName),
+      options,
+      result
+    );
+  }
+  for (const file of bundle.tooling.files) {
+    await writeFile(file.path, file.content, options, result);
+  }
+  return result;
+}
+async function writeFile(relPath, content, options, result) {
+  const safe = safeJoinable(relPath);
+  if (!safe) {
+    result.unsafeSkipped.push(relPath);
+    logger.warn(`Refusing to write unsafe path from profile: ${relPath}`);
+    return;
+  }
+  const full = path7.join(options.targetDir, safe);
+  const exists = await fs6.pathExists(full);
+  let action2 = exists ? "overwrite" : "create";
+  if (exists) {
+    const decision = await options.conflict.resolve(safe);
+    if (decision === "skip") {
+      result.filesSkipped += 1;
+      result.entries.push({ kind: "file", path: safe, action: "skip" });
+      logger.detail(`skip: ${safe}`);
+      return;
+    }
+    action2 = "overwrite";
+  }
+  if (!options.dryRun) {
+    await fs6.ensureDir(path7.dirname(full));
+    await fs6.writeFile(full, content, "utf8");
+  }
+  result.filesWritten += 1;
+  result.entries.push({ kind: "file", path: safe, action: action2 });
+  logger.detail(`${action2}: ${safe}`);
+}
+
+// src/core/installer.ts
+import { spawn } from "child_process";
+var COMMANDS = {
+  npm: ["npm", "install"],
+  pnpm: ["pnpm", "install"],
+  yarn: ["yarn"],
+  bun: ["bun", "install"]
+};
+function installDependencies(cwd, manager) {
+  if (manager === "unknown") return Promise.resolve(false);
+  const [command, ...args] = COMMANDS[manager];
+  return new Promise((resolve) => {
+    const child = spawn(command, args, {
+      cwd,
+      stdio: "inherit",
+      // npm/pnpm/yarn are .cmd shims on Windows; a shell resolves them.
+      shell: process.platform === "win32"
+    });
+    child.on("error", () => resolve(false));
+    child.on("close", (code) => resolve(code === 0));
+  });
+}
+
+// src/commands/create.ts
+async function createCommand(projectName, options) {
+  if (options.verbose) setVerbose(true);
+  if (!projectName || projectName.trim().length === 0) {
+    throw new ReplicaxError("A project name is required: replicax create <project-name>");
+  }
+  const dir = options.profile ? await resolveProfileDir(options.profile) : profileDir(process.cwd());
+  if (!await profileExists(dir)) {
+    throw new ReplicaxError("No ReplicaX profile found.", [
+      "Run `replicax init` in a source project first,",
+      "or point at one with `replicax create <name> --profile <path>`."
+    ]);
+  }
+  const bundle = await loadBundle(dir);
+  const mismatches = verifyChecksum(bundle.tooling, bundle.checksum);
+  if (mismatches.length > 0) {
+    logger.warn(`Profile integrity check found ${mismatches.length} issue(s); continuing anyway.`);
+    logger.hint("Run `replicax validate` for details.");
+  }
+  const targetDir = path8.resolve(process.cwd(), projectName);
+  const leafName = path8.basename(targetDir);
+  if (path8.resolve(process.cwd()) === targetDir) {
+    throw new ReplicaxError("Refusing to scaffold into the current directory.", [
+      "Pass a new project name, e.g. `replicax create my-app`."
+    ]);
+  }
+  const policy = options.force ? "overwrite" : "prompt";
+  const conflict = new ConflictResolver(policy);
+  logger.info(
+    `Creating ${pc.bold(leafName)} from profile ${pc.bold(bundle.profile.name)}${options.dryRun ? pc.dim(" (dry run)") : ""}`
+  );
+  const result = await generateProject({
+    bundle,
+    targetDir,
+    projectName: leafName,
+    dryRun: Boolean(options.dryRun),
+    conflict
+  });
+  if (result.unsafeSkipped.length > 0) {
+    logger.warn(`Skipped ${result.unsafeSkipped.length} unsafe path(s) in the profile.`);
+  }
+  logger.newline();
+  logger.success(
+    `${result.dirsCreated} director(ies) and ${result.filesWritten} file(s) ${options.dryRun ? "would be written" : "written"}` + (result.filesSkipped ? `, ${result.filesSkipped} skipped` : "")
+  );
+  if (options.dryRun) {
+    logger.newline();
+    logger.info("Dry run \u2014 no files were written.");
+    return;
+  }
+  logger.hint(`Location: ${relPosix(process.cwd(), targetDir)}/`);
+  await maybeInstall(
+    bundle.metadata.packageManager,
+    targetDir,
+    options,
+    Boolean(bundle.tooling.packageJson)
+  );
+  logger.newline();
+  logger.success(`Project ${pc.bold(leafName)} is ready.`);
+}
+async function maybeInstall(manager, targetDir, options, hasPackageJson) {
+  if (options.skipInstall) {
+    logger.hint("Skipped dependency install (--skip-install).");
+    return;
+  }
+  if (!hasPackageJson) return;
+  if (manager === "unknown") {
+    logger.hint("No package manager detected; run your install command manually.");
+    return;
+  }
+  const pkgPath = path8.join(targetDir, "package.json");
+  const pkg = await fs7.readJson(pkgPath).catch(() => null);
+  if (!pkg?.devDependencies || Object.keys(pkg.devDependencies).length === 0) {
+    logger.hint("No dependencies to install.");
+    return;
+  }
+  logger.newline();
+  logger.info(`Installing dependencies with ${manager}\u2026`);
+  const ok = await installDependencies(targetDir, manager);
+  if (ok) logger.success("Dependencies installed.");
+  else logger.warn("Dependency install did not complete; run it manually.");
+}
+
+// src/commands/sync.ts
+import ora2 from "ora";
+
+// src/core/diff.ts
+function diffChecksums(prev, next) {
+  const added = [];
+  const removed = [];
+  const changed = [];
+  let packageJsonChanged = false;
+  const keys = /* @__PURE__ */ new Set([...Object.keys(prev.files), ...Object.keys(next.files)]);
+  for (const key of keys) {
+    const before = prev.files[key];
+    const after = next.files[key];
+    if (key === PACKAGE_JSON_KEY) {
+      if (before !== after) packageJsonChanged = true;
+      continue;
+    }
+    if (before === void 0) added.push(key);
+    else if (after === void 0) removed.push(key);
+    else if (before !== after) changed.push(key);
+  }
+  return {
+    files: { added: added.sort(), removed: removed.sort(), changed: changed.sort() },
+    packageJsonChanged
+  };
+}
+function diffStructure(prev, next) {
+  const before = new Set(prev.directories);
+  const after = new Set(next.directories);
+  const added = next.directories.filter((d) => !before.has(d));
+  const removed = prev.directories.filter((d) => !after.has(d));
+  return { added, removed };
+}
+function diffMetadata(prev, next) {
+  const fields = [
+    "nodeVersion",
+    "packageManager",
+    "framework",
+    "language",
+    "platform"
+  ];
+  const changes = [];
+  for (const field of fields) {
+    if (prev[field] !== next[field]) {
+      changes.push({ field, from: String(prev[field]), to: String(next[field]) });
+    }
+  }
+  return changes;
+}
+function diffBundles(prev, next) {
+  const checksums = diffChecksums(prev.checksum, next.checksum);
+  return {
+    files: checksums.files,
+    packageJsonChanged: checksums.packageJsonChanged,
+    directories: diffStructure(prev.structure, next.structure),
+    metadataChanges: diffMetadata(prev.metadata, next.metadata)
+  };
+}
+function hasChanges(diff) {
+  return diff.files.added.length > 0 || diff.files.removed.length > 0 || diff.files.changed.length > 0 || diff.directories.added.length > 0 || diff.directories.removed.length > 0 || diff.packageJsonChanged || diff.metadataChanges.length > 0;
+}
+
+// src/commands/sync.ts
+async function syncCommand(options) {
+  if (options.verbose) setVerbose(true);
+  const root = process.cwd();
+  const dir = profileDir(root);
+  if (!await profileExists(dir)) {
+    throw new ReplicaxError("No ReplicaX profile to sync.", ["Run `replicax init` first."]);
+  }
+  const existing = await loadBundle(dir);
+  const spinner = ora2({ text: "Re-scanning project\u2026", isEnabled: !options.verbose }).start();
+  const scan = await scanProject(root);
+  spinner.succeed("Re-scan complete");
+  const next = buildBundle({
+    name: existing.profile.name,
+    description: existing.profile.description,
+    tooling: scan.tooling,
+    structure: scan.structure,
+    metadata: scan.metadata,
+    existing: existing.profile
+  });
+  const diff = diffBundles(existing, next);
+  if (!hasChanges(diff) && !options.force) {
+    logger.success("Profile is already up to date.");
+    return;
+  }
+  reportSkippedSecrets(scan.skippedSecrets);
+  printDiff(diff, Boolean(options.diff));
+  await saveBundle(dir, next);
+  logger.newline();
+  logger.success("Profile updated.");
+}
+function printDiff(diff, detailed) {
+  const { files, directories, metadataChanges, packageJsonChanged } = diff;
+  logger.newline();
+  logger.info(pc.bold("Changes since last sync"));
+  logger.hint(
+    `files     ${pc.green(`+${files.added.length}`)} ${pc.yellow(`~${files.changed.length}`)} ${pc.red(`-${files.removed.length}`)}`
+  );
+  logger.hint(
+    `dirs      ${pc.green(`+${directories.added.length}`)} ${pc.red(`-${directories.removed.length}`)}`
+  );
+  if (packageJsonChanged) logger.hint("package.json template changed");
+  if (metadataChanges.length) {
+    for (const change of metadataChanges) {
+      logger.hint(`metadata  ${change.field}: ${change.from} \u2192 ${change.to}`);
+    }
+  }
+  if (!detailed) return;
+  logger.newline();
+  printList("added files", files.added, pc.green("+"));
+  printList("changed files", files.changed, pc.yellow("~"));
+  printList("removed files", files.removed, pc.red("-"));
+  printList("added directories", directories.added, pc.green("+"));
+  printList("removed directories", directories.removed, pc.red("-"));
+}
+function printList(title, items, marker) {
+  if (items.length === 0) return;
+  logger.info(pc.bold(title));
+  for (const item of items) logger.hint(`${marker} ${item}`);
+}
+
+// src/commands/inspect.ts
+import Table from "cli-table3";
+var SECTIONS = ["profile", "tooling", "structure", "metadata"];
+async function inspectCommand(options) {
+  const dir = options.profile ? await resolveProfileDir(options.profile) : profileDir(process.cwd());
+  if (!await profileExists(dir)) {
+    throw new ReplicaxError("No ReplicaX profile found.", ["Run `replicax init` first."]);
+  }
+  if (options.section && !SECTIONS.includes(options.section)) {
+    throw new ReplicaxError(`Unknown section "${options.section}".`, [
+      `Valid sections: ${SECTIONS.join(", ")}.`
+    ]);
+  }
+  const bundle = await loadBundle(dir);
+  const section = options.section;
+  if (options.json) {
+    const payload = section ? { [section]: bundle[section] } : bundle;
+    logger.out(JSON.stringify(payload, null, 2));
+    return;
+  }
+  if (!section || section === "profile") printProfile(bundle);
+  if (!section || section === "metadata") printMetadata(bundle);
+  if (!section || section === "tooling") printTooling(bundle);
+  if (!section || section === "structure") printStructure(bundle);
+}
+function printProfile(bundle) {
+  const p = bundle.profile;
+  logger.out(pc.bold("Profile"));
+  logger.out(`  name             ${p.name}`);
+  logger.out(`  version          ${p.version}`);
+  if (p.description) logger.out(`  description      ${p.description}`);
+  logger.out(`  createdAt        ${p.createdAt}`);
+  if (p.updatedAt) logger.out(`  updatedAt        ${p.updatedAt}`);
+  logger.out(`  replicaxVersion  ${p.replicaxVersion}`);
+  logger.out("");
+}
+function printMetadata(bundle) {
+  const m = bundle.metadata;
+  logger.out(pc.bold("Metadata"));
+  logger.out(`  language         ${m.language}`);
+  logger.out(`  framework        ${m.framework}`);
+  logger.out(`  packageManager   ${m.packageManager}`);
+  logger.out(`  nodeVersion      ${m.nodeVersion}`);
+  logger.out(`  platform         ${m.platform}`);
+  logger.out("");
+}
+function printTooling(bundle) {
+  const { tooling } = bundle;
+  const total = tooling.files.length + (tooling.packageJson ? 1 : 0);
+  logger.out(pc.bold(`Tooling (${total} file(s))`));
+  const table = new Table({
+    head: ["Category", "File", "Variant", "Size"],
+    style: { head: ["cyan"], border: ["dim"] }
+  });
+  if (tooling.packageJson) {
+    table.push(["Package Management & Monorepos", "package.json", "json", "template"]);
+  }
+  for (const file of [...tooling.files].sort((a, b) => a.path.localeCompare(b.path))) {
+    table.push([
+      CATEGORY_BY_ID.get(file.category)?.label ?? file.category,
+      file.path,
+      file.variant,
+      formatBytes(file.bytes)
+    ]);
+  }
+  logger.out(table.toString());
+  logger.out("");
+}
+function printStructure(bundle) {
+  const { structure } = bundle;
+  logger.out(pc.bold(`Structure (${structure.directories.length} director(ies))`));
+  logger.out(renderTree(structure.directories, structure.root));
+  logger.out("");
+}
+function formatBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+
+// src/commands/validate.ts
+async function validateCommand(options) {
+  const dir = options.profile ? await resolveProfileDir(options.profile) : profileDir(process.cwd());
+  if (!await profileExists(dir)) {
+    throw new ReplicaxError("No ReplicaX profile found.", ["Run `replicax init` first."]);
+  }
+  const bundle = await loadBundle(dir);
+  logger.success("Schema validation passed (profile, tooling, structure, metadata, checksum).");
+  const issues = [];
+  const secretGuard = new IgnoreEngine();
+  const mismatches = verifyChecksum(bundle.tooling, bundle.checksum);
+  for (const m of mismatches) {
+    issues.push(`checksum ${m.reason}: ${m.path}`);
+  }
+  for (const file of bundle.tooling.files) {
+    if (safeJoinable(file.path) === null) issues.push(`unsafe file path: ${file.path}`);
+    if (secretGuard.isSecret(file.path)) issues.push(`secret leaked into profile: ${file.path}`);
+  }
+  for (const dirPath of bundle.structure.directories) {
+    if (safeJoinable(dirPath) === null) issues.push(`unsafe directory path: ${dirPath}`);
+  }
+  if (issues.length === 0) {
+    logger.success("Integrity checks passed \u2014 checksums match and no unsafe paths.");
+    logger.newline();
+    logger.success(pc.bold(`Profile "${bundle.profile.name}" is valid.`));
+    return;
+  }
+  logger.newline();
+  logger.error(`Found ${issues.length} issue(s):`);
+  for (const issue of issues) logger.hint(issue);
+  throw new ReplicaxError("Profile validation failed.", [
+    "Re-run `replicax sync` to regenerate from the current project."
+  ]);
+}
+
+// src/commands/export.ts
+import path10 from "path";
+import fs9 from "fs-extra";
+import ora3 from "ora";
+
+// src/core/archive.ts
+import os from "os";
+import path9 from "path";
+import fs8 from "fs-extra";
+import { create as tarCreate, extract as tarExtract } from "tar";
+async function exportProfile(profileDirectory, outPath) {
+  const resolvedOut = path9.resolve(outPath);
+  await fs8.ensureDir(path9.dirname(resolvedOut));
+  const parent = path9.dirname(profileDirectory);
+  const base = path9.basename(profileDirectory);
+  await tarCreate(
+    {
+      gzip: true,
+      file: resolvedOut,
+      cwd: parent,
+      // tar strips leading "/" and ".." by default, so extraction stays scoped.
+      portable: true
+    },
+    [base]
+  );
+}
+async function extractToTemp(archivePath) {
+  const resolved = path9.resolve(archivePath);
+  if (!await fs8.pathExists(resolved)) {
+    throw new Error(`Archive not found: ${archivePath}`);
+  }
+  const tmp = await fs8.mkdtemp(path9.join(os.tmpdir(), "replicax-import-"));
+  await tarExtract({ file: resolved, cwd: tmp, strip: 0 });
+  return tmp;
+}
+async function findProfileRoot(dir) {
+  const hasProfile = async (d) => fs8.pathExists(path9.join(d, PROFILE_FILES.profile));
+  if (await hasProfile(dir)) return dir;
+  const entries = await fs8.readdir(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      const candidate = path9.join(dir, entry.name);
+      if (await hasProfile(candidate)) return candidate;
+    }
+  }
+  return null;
+}
+
+// src/commands/export.ts
+function slug(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "profile";
+}
+async function exportCommand(options) {
+  const dir = options.profile ? await resolveProfileDir(options.profile) : profileDir(process.cwd());
+  if (!await profileExists(dir)) {
+    throw new ReplicaxError("No ReplicaX profile found to export.", ["Run `replicax init` first."]);
+  }
+  const bundle = await loadBundle(dir);
+  const outPath = path10.resolve(options.out ?? `${slug(bundle.profile.name)}.replicax.tar.gz`);
+  const spinner = ora3({ text: "Packaging profile\u2026" }).start();
+  await exportProfile(dir, outPath);
+  spinner.stop();
+  const { size } = await fs9.stat(outPath);
+  logger.success(
+    `Exported "${bundle.profile.name}" \u2192 ${path10.relative(process.cwd(), outPath)} (${formatBytes2(size)})`
+  );
+  logger.hint("Share it, then `replicax import <file>` elsewhere.");
+}
+function formatBytes2(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+
+// src/commands/import.ts
+import fs10 from "fs-extra";
+import ora4 from "ora";
+import { confirm as confirm2 } from "@inquirer/prompts";
+async function importCommand(archivePath, options) {
+  if (!archivePath) {
+    throw new ReplicaxError("An archive path is required: replicax import <file>");
+  }
+  const spinner = ora4({ text: "Extracting archive\u2026" }).start();
+  const tmp = await extractToTemp(archivePath);
+  try {
+    const source = await findProfileRoot(tmp);
+    if (!source) {
+      spinner.fail("No profile found in archive");
+      throw new ReplicaxError("The archive does not contain a ReplicaX profile.");
+    }
+    const bundle = await loadBundle(source);
+    spinner.succeed(`Validated profile "${bundle.profile.name}"`);
+    const dest = profileDir(process.cwd());
+    if (await profileExists(dest)) {
+      const overwrite = options.force || (process.stdin.isTTY ? await confirm2({
+        message: "A profile already exists here. Overwrite it?",
+        default: false
+      }) : false);
+      if (!overwrite) {
+        throw new ReplicaxError("A profile already exists.", [
+          "Re-run with --force to overwrite it."
+        ]);
+      }
+      await fs10.remove(dest);
+    }
+    await saveBundle(dest, bundle);
+    logger.newline();
+    logger.success(
+      `Imported "${pc.bold(bundle.profile.name)}" into ${relPosix(process.cwd(), dest)}/`
+    );
+    logger.hint("Create a project with: replicax create <project-name>");
+  } finally {
+    await fs10.remove(tmp).catch(() => void 0);
+  }
+}
+
+// src/index.ts
+function packageVersion() {
+  try {
+    const raw = readFileSync(new URL("../package.json", import.meta.url), "utf8");
+    return JSON.parse(raw).version ?? "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+function action(fn) {
+  return async (...args) => {
+    try {
+      await fn(...args);
+    } catch (err) {
+      handleError(err);
+    }
+  };
+}
+function handleError(err) {
+  if (err instanceof ReplicaxError) {
+    logger.error(err.message);
+    for (const hint of err.hints) logger.hint(hint);
+  } else if (err instanceof Error && err.name === "ExitPromptError") {
+    logger.newline();
+    logger.warn("Cancelled.");
+  } else if (err instanceof Error) {
+    logger.error(err.message);
+    if (isVerbose() && err.stack) logger.hint(err.stack);
+  } else {
+    logger.error(String(err));
+  }
+  process.exitCode = 1;
+}
+var program = new Command();
+program.name("replicax").description("Copy the setup, not the code.").version(packageVersion(), "-v, --version", "Print the ReplicaX version").showHelpAfterError("(run `replicax --help` for usage)");
+program.command("init").description("Scan the current project and create a ReplicaX profile in .replicax/").option("--name <name>", "Name the profile").option("--dry-run", "Preview what would be captured without writing").option("--verbose", "Show every detected file").action(action(initCommand));
+program.command("create").argument("<project-name>", "Directory/name for the new project").description("Create a new project from a profile").option("--profile <path>", "Use a profile from a custom path").option("--skip-install", "Do not run the package manager install step").option("--dry-run", "Preview the output without writing").option("--force", "Overwrite conflicting files without prompting").option("--verbose", "Show every written file").action(action(createCommand));
+program.command("sync").description("Update the profile from the current project state").option("--diff", "Show a detailed list of what changed").option("--force", "Rewrite the profile even if nothing changed").option("--verbose", "Show every detected file").action(action(syncCommand));
+program.command("inspect").description("Display captured configuration and structure").option("--json", "Output as JSON").option("--section <section>", "Inspect one section: profile|tooling|structure|metadata").option("--profile <path>", "Inspect a profile at a custom path").action(action(inspectCommand));
+program.command("validate").description("Check profile schema and integrity").option("--profile <path>", "Validate a profile at a custom path").action(action(validateCommand));
+program.command("export").description("Export the profile as a portable .tar.gz archive").option("--out <file>", "Output archive path").option("--profile <path>", "Export a profile from a custom path").action(action(exportCommand));
+program.command("import").argument("<archive>", "Path to a .tar.gz profile archive").description("Import a portable profile archive into .replicax/").option("--force", "Overwrite an existing profile").action(action(importCommand));
+if (process.argv.slice(2).length === 0) {
+  program.outputHelp();
+  process.exit(0);
+}
+program.parseAsync(process.argv).catch(handleError);