@knowzai/cli 0.1.0

package/dist/lib/platform-frontdoor-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-frontdoor-runtime.js","sourceRoot":"","sources":["../../src/lib/platform-frontdoor-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,UAAU,EACV,+BAA+B,GAEhC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAuB,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAsB,MAAM,yBAAyB,CAAC;AAOtF,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,iBAAiB,GAElB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAC;AAejF,SAAS,IAAI,CAAC,KAAc,EAAE,IAA4B;IACxD,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,KAAsB,EACtB,WAAmB,EACnB,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,EAClE;YACE,KAAK;YACL,MAAM,EAAE,UAAU,EAAE;YACpB,UAAU;YACV,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;YAC1F,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;SACnF,CACF,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAsB,EAAE,MAAc,EAAE,WAAmB;IAC7E,IAAI,MAA2C,CAAC;IAChD,MAAM,MAAM,GAAG,GAA4B,EAAE;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACpD,eAAe,CAAC;gBACd,OAAO,EAAE,MAAM;gBACf,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;aAC1E,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,OAAO;QACL,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;QAC9E,SAAS,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;QACpF,aAAa,EAAE,KAAK,IAAI,EAAE;YACxB,MAAM,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,uCAAuC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACjG,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,KAAsB,EACtB,MAAc,EACd,oBAAwC,EACxC,KAAc,EACd,qBAA8B,EAC9B,gBAAyB,EACzB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,OAAO;QACL,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,eAAe,CAAC,CAAC;gBACrD,OAAO,QAAQ,CAAC,EAAE,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,YAAY,EAAE,CAAC,UAAU,EAAE,EAAE,CAC3B,YAAY,CAAC,UAAU,EAAE;YACvB,KAAK;YACL,MAAM,EAAE,UAAU,EAAE;YACpB,UAAU;YACV,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;YAC1F,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;SACnF,CAAC;QACJ,YAAY,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC;QACrE,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC;QACtC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC;QACtB,WAAW,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAE,CAAC;QACjE,cAAc,EAAE,oBAAoB;YAClC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,MAAM,EAAE,oBAAoB,EAAE,KAAK,CAAC;YACxE,CAAC,CAAC,SAAS;QACb,aAAa,EAAE,gBAAgB;YAC7B,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;gBACf,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC;oBAC/B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBACtB,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;gBACvB,CAAC;YACH,CAAC;YACH,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAc,EACd,UAAkB,EAClB,KAA0B,EAC1B,UAAwB,KAAK;IAE7B,cAAc,CAAC,UAAU,CAAC,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,yBAAyB,EAAE;YACpF,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,UAAU;aAC/B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAC5B,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACzD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC7C,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAuD,CAAC;YACxF,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5D,cAAc,CAAC,MAAM,CAAC,CAAC;YACvB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QACvC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,MAAM,kBAAkB,GACtB,iEAAiE,CAAC;AAEpE,SAAS,eAAe,CACtB,UAAmB,EACnB,cAAuB;IAEvB,IACE,OAAO,UAAU,KAAK,QAAQ;QAC9B,CAAC,+BAA+B,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE;QACtD,OAAO,cAAc,KAAK,QAAQ;QAClC,CAAC,kBAAkB,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,EAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE;QAC7B,cAAc,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;KACpD,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,KAItD;IACC,MAAM,eAAe,GAAG,eAAe,CACrC,KAAK,CAAC,GAAG,CAAC,kCAAkC,EAC5C,KAAK,CAAC,GAAG,CAAC,+BAA+B,CAC1C,CAAC;IACF,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvE,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,0BAA0B,CAAC;IAC9D,MAAM,iBAAiB,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC;IACzD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,iBAAiB,CACvD,OAAO,EACP,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,EAC7B;QACE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,KAAK,EAAE,KAAK;QACZ,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CACF,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,OAAO,EAAE;QAC9D,KAAK;QACL,MAAM;QACN,IAAI;QACJ,GAAG,MAAM,eAAe;QACxB,QAAQ;QACR,IAAI;QACJ,IAAI;QACJ,kFAAkF;KACnF,EAAE;QACD,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,KAAK,EAAE,KAAK;QACZ,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC,CAAC,CAAC;IACJ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,CAAC,cAAc,EAAE,GAAG,SAAS,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAiC,CAAC;QAClF,OAAO,eAAe,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAIjD;IACC,MAAM,aAAa,GAAG,yBAAyB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,GAAG,KAAK,CAAC,UAAU,CAAC,cAAc,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,EAAE,EACnE,MAAM,CACP,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrB,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,CAC7C,GAAG,aAAa,8CAA8C,EAC9D;YACE,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,SAAS,KAAK,EAAE;aAChC;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CACF,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IACvC,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,2BAA2B,CAAC,OAAwC;IAClF,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IAC1E,OAAO;QACL,GAAG;QACH,GAAG;QACH,KAAK;QACL,MAAM,EAAE,sBAAsB,EAAE;QAChC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,GAAoB,EAAE,CAAC,YAAY,CAAC,uCAAuC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5G,mBAAmB,EAAE,uBAAuB,EAAE;QAC9C,UAAU;QACV,UAAU;QACV,MAAM,EAAE,iBAAiB;QACzB,iBAAiB,EAAE,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAAE,CAC/C,cAAc,CACZ,KAAK,EACL,MAAM,EACN,iBAAiB,EAAE,oBAAoB,EACvC,KAAK,EACL,OAAO,CAAC,qBAAqB,KAAK,KAAK,EACvC,gBAAgB,EAChB,IAAI,CACL;QACH,oBAAoB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC;QAC/F,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAClC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,+BAA+B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC7E,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC;QACD,oBAAoB,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CAChD,gCAAgC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAChE,oBAAoB,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE;YAChF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,aAAa,EAAE;gBACpD,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,MAAM,EAAE,iBAAiB;gBACzB,WAAW;gBACX,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC5D,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC;aACxB,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC,CAAC;YACtC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAClC,MAAM,iBAAiB,CAAC;gBACtB,KAAK,EAAE,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC;gBACnD,WAAW;gBACX,aAAa;gBACb,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,KAAK,EAAE,UAAU;gBACjB,MAAM;gBACN,MAAM,EAAE,iBAAiB;aAC1B,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,2BAA2B,EAAE,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,CAC7D,2BAA2B,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;QAC5D,mBAAmB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;YAC5C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACtD,OAAO,OAAO,CAAC;gBACb,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,uBAAuB,cAAc,sCAAsC;aACrF,CAAC,CAAC;QACL,CAAC;QACD,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC;QACtB,SAAS,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QAC1F,aAAa,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC;QACtD,eAAe,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,GAAG,CAAC,8BAA8B,IAAI,sBAAsB,EAC5D;gBACE,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,MAAM,EAAE,iBAAiB;gBACzB,WAAW;gBACX,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC5D,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC;aACxB,EACD,EAAE,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,CACxC,CAAC;YACF,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAClC,OAAO,MAAM,CAAC,UAAU,CAAC;QAC3B,CAAC;QACD,qBAAqB,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,wBAAwB,CAAC,UAAU,CAAC;QAC3E,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC/B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC;YACvE,OAAO,OAAO,CAAC;gBACb,OAAO,EAAE,IAAI;gBACb,OAAO,EACL,6BAA6B,OAAO,CAAC,QAAQ,WAAW,OAAO,CAAC,SAAS,aAAa,OAAO,CAAC,OAAO,IAAI;oBACzG,SAAS,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI;oBACxE,WAAW,OAAO,CAAC,WAAW,aAAa,OAAO,GAAG;aACxD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/lib/platform-frontdoor.d.ts

@@ -0,0 +1,155 @@
+import { type KnowzConfig } from '@knowzai/core';
+import { applyPlatform, type PlatformApplyInput } from './platform-lifecycle.js';
+import { type PlatformProviderPreset, type PlatformState, type ProcessRunner } from './platform-runtime.js';
+import { resolveProviderSelection, type ProviderFlags, type PromptFn, type ResolveProviderSelectionInput } from './platform-provider-prompt.js';
+import { type OnboardingDeps, type OnboardingResult } from './platform-onboarding.js';
+import type { PreflightInput, PreflightReport } from './platform-preflight.js';
+import type { ProviderProbeResult } from './platform-provider-probe.js';
+import { ensureEngineReady as ensureContainerEngineReady, type EngineStatus } from './container-engine.js';
+import { type InstallationActivationResult } from './activate.js';
+/**
+ * `knowz up` front-door orchestration — the opinionated one-command onboarding
+ * that composes the AI-provider picker (N1) → image-source resolution (N2) →
+ * `applyPlatform` lifecycle → post-boot onboarding (N3) into a single flow.
+ *
+ * PURE orchestration: every side effect (prompt, process runner, config I/O,
+ * onboarding deps) is injected, so the whole flow runs with no real Docker,
+ * network, or browser in tests. Pull mode stays byte-identical to `platform up`
+ * (the image-source seam only overrides the compose file + cwd in build mode).
+ */
+/**
+ * Pinned default portable release for the friendly front door. Unlike
+ * `platform up` (which fails closed without `--version`), `knowz up` supplies a
+ * concrete, deliberately-bumped version so a first-time user gets a working
+ * stack — NEVER a floating tag like `latest`. Override with `--version`.
+ */
+export declare const STABLE_PORTABLE_RELEASE = "0.35.2";
+export declare const DEFAULT_PORTABLE_VERSION = "0.35.2";
+export declare function resolveDefaultPortableVersion(env: Readonly<Record<string, string | undefined>>): string;
+/** Compose/registry failures that warrant a one-shot authenticated pull retry. */
+export declare function isRegistryAuthError(err: unknown): boolean;
+export interface FrontDoorInput {
+    /** Flag-derived plan base (version already defaulted); the picker overrides its provider slice. */
+    base: PlatformApplyInput;
+    providerFlags: ProviderFlags;
+    imageFlags: {
+        build?: boolean;
+        pull?: boolean;
+        preloaded?: boolean;
+    };
+    seedDemo: boolean;
+    open: boolean;
+    profileName?: string;
+    reconfigure?: boolean;
+    /** Effective validation choice; callers apply the TTY/JSON/explicit-flag policy. */
+    validate?: boolean;
+    identity?: {
+        name: string;
+        email: string;
+    };
+    yes?: boolean;
+    /** Suppresses every interactive surface and preserves the one-object JSON envelope. */
+    json?: boolean;
+    /** Browser-collected GHCR pull token; used only for stdin login after an anonymous 401. */
+    ghcrToken?: string;
+    /** Optional browser-collected override for the otherwise machine-minted local SuperAdmin secret. */
+    superAdminPassphrase?: string;
+    /** Running oclif package version used for minCliVersion checks. */
+    cliVersion?: string;
+    /** True only for --version or KNOWZ_PLATFORM_VERSION, never the built-in default. */
+    versionExplicit?: boolean;
+}
+export interface FrontDoorSummary {
+    provider: PlatformProviderPreset;
+    imageMode: 'build' | 'pull' | 'preloaded';
+    version: string;
+    ports: {
+        api: number;
+        web: number;
+        mcp: number;
+        publicSite: number;
+    };
+    profileName: string;
+    identity: {
+        name: string;
+        email: string;
+    };
+}
+export interface FrontDoorDeps {
+    cwd: string;
+    env: Readonly<Record<string, string | undefined>>;
+    isTty: boolean;
+    /** Interactive AI-provider picker prompt (N1). */
+    prompt: PromptFn;
+    /** Hidden GHCR-token prompt used only on an authenticated pull retry (TTY only). */
+    ghcrPrompt?: () => Promise<string | undefined>;
+    requiredEnvByPreset: Record<string, string[]>;
+    loadConfig: () => KnowzConfig;
+    saveConfig: (cfg: KnowzConfig) => void;
+    runner: ProcessRunner;
+    /** Bound with the resolved public API URL (known only after `applyPlatform`). */
+    onboardingDepsFor: (apiUrl: string, options?: {
+        superAdminPassphrase?: string;
+    }) => OnboardingDeps;
+    /**
+     * Probe (and refresh) an existing CLI profile before onboarding. Returns a non-null result
+     * when the profile's stored key still authenticates against `apiUrl` — i.e. a prior `up`
+     * already signed in — in which case the front door SKIPS register entirely. Returns null
+     * when the profile is absent/stale so onboarding runs normally.
+     */
+    reuseExistingProfile?: (profileName: string, apiUrl: string) => Promise<{
+        tenantId?: string;
+    } | null>;
+    assetsDir?: string;
+    packagedAssetsDir?: string;
+    pathExists?: (path: string) => boolean;
+    randomBytes?: (size: number) => Uint8Array;
+    now?: () => Date;
+    log?: (line: string) => void;
+    preflight?: (input: PreflightInput) => Promise<PreflightReport>;
+    probeProvider?: (selection: Awaited<ReturnType<typeof resolveProviderSelection>>) => Promise<ProviderProbeResult>;
+    activateCloudAi?: (installationName: string) => Promise<string>;
+    discoverCloudAiModels?: ResolveProviderSelectionInput['discoverCloudAiModels'];
+    confirmPrompt?: (summary: FrontDoorSummary) => Promise<boolean>;
+    ensureEngineReady?: typeof ensureContainerEngineReady;
+    applyPlatform?: typeof applyPlatform;
+    fetchReleaseManifest?: (url: string) => Promise<unknown>;
+    loadPackagedReleaseManifest?: (path: string) => unknown | Promise<unknown>;
+    loadStoredActivation?: (input: {
+        projectName: string;
+        configDir?: string;
+        engine: EngineStatus;
+    }) => Promise<InstallationActivationResult | null>;
+    activateInstallation?: (input: {
+        projectName: string;
+        configDir?: string;
+        mothershipUrl: string;
+        engine: EngineStatus;
+    }) => Promise<InstallationActivationResult>;
+    preflightRegistryCredential?: (input: {
+        mothershipUrl: string;
+        activation: InstallationActivationResult;
+    }) => Promise<RegistryCredentialPreflightResult>;
+    confirmReactivation?: (installationId: string) => Promise<boolean>;
+}
+export type RegistryCredentialPreflightResult = {
+    kind: 'http-response';
+    status: number;
+} | {
+    kind: 'transport-failure';
+};
+/** `existing` = a prior `up`'s CLI profile already authenticated, so register was skipped. */
+export type FrontDoorLoginMode = OnboardingResult['loginMode'] | 'existing';
+export interface FrontDoorResult {
+    state: PlatformState;
+    imageMode: 'build' | 'pull' | 'preloaded';
+    provider: PlatformProviderPreset;
+    /** The CLI profile that ended up authenticated (null on a manual degrade). */
+    profile: string | null;
+    loginMode: FrontDoorLoginMode;
+    seeded: boolean;
+}
+export declare function runFrontDoor(input: FrontDoorInput, deps: FrontDoorDeps): Promise<FrontDoorResult>;
+/** Read the packaged runtime contract's `providerPresets.{preset}.requiredEnvironment` map (drift-fenced source). */
+export declare function loadRequiredEnvByPreset(assetsDir?: string): Record<string, string[]>;
+//# sourceMappingURL=platform-frontdoor.d.ts.map

package/dist/lib/platform-frontdoor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-frontdoor.d.ts","sourceRoot":"","sources":["../../src/lib/platform-frontdoor.ts"],"names":[],"mappings":"AAEA,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,aAAa,EAEb,KAAK,kBAAkB,EAIxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,KAAK,aAAa,EACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,wBAAwB,EACxB,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,6BAA6B,EACnC,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAKL,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EACL,iBAAiB,IAAI,0BAA0B,EAC/C,KAAK,YAAY,EAClB,MAAM,uBAAuB,CAAC;AAW/B,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,eAAe,CAAC;AAEvB;;;;;;;;;GASG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,WAAW,CAAC;AAChD,eAAO,MAAM,wBAAwB,WAA0B,CAAC;AAEhE,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GAChD,MAAM,CASR;AAED,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAKzD;AAED,MAAM,WAAW,cAAc;IAC7B,mGAAmG;IACnG,IAAI,EAAE,kBAAkB,CAAC;IACzB,aAAa,EAAE,aAAa,CAAC;IAC7B,UAAU,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACrE,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,uFAAuF;IACvF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,2FAA2F;IAC3F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oGAAoG;IACpG,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qFAAqF;IACrF,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAClD,KAAK,EAAE,OAAO,CAAC;IACf,kDAAkD;IAClD,MAAM,EAAE,QAAQ,CAAC;IACjB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9C,UAAU,EAAE,MAAM,WAAW,CAAC;IAC9B,UAAU,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,CAAC;IACvC,MAAM,EAAE,aAAa,CAAC;IACtB,iFAAiF;IACjF,iBAAiB,EAAE,CACjB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;QAAE,oBAAoB,CAAC,EAAE,MAAM,CAAA;KAAE,KACxC,cAAc,CAAC;IACpB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACtG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,CAAC;IAC3C,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAChE,aAAa,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAClH,eAAe,CAAC,EAAE,CAAC,gBAAgB,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChE,qBAAqB,CAAC,EAAE,6BAA6B,CAAC,uBAAuB,CAAC,CAAC;IAC/E,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,iBAAiB,CAAC,EAAE,OAAO,0BAA0B,CAAC;IACtD,aAAa,CAAC,EAAE,OAAO,aAAa,CAAC;IACrC,oBAAoB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,2BAA2B,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE;QAC7B,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,YAAY,CAAC;KACtB,KAAK,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CAAC;IACnD,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE;QAC7B,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;QACtB,MAAM,EAAE,YAAY,CAAC;KACtB,KAAK,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC5C,2BAA2B,CAAC,EAAE,CAAC,KAAK,EAAE;QACpC,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,4BAA4B,CAAC;KAC1C,KAAK,OAAO,CAAC,iCAAiC,CAAC,CAAC;IACjD,mBAAmB,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACpE;AAED,MAAM,MAAM,iCAAiC,GACzC;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAelC,8FAA8F;AAC9F,MAAM,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,WAAW,CAAC,GAAG,UAAU,CAAC;AAE5E,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC;IAC1C,QAAQ,EAAE,sBAAsB,CAAC;IACjC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,kBAAkB,CAAC;IAC9B,MAAM,EAAE,OAAO,CAAC;CACjB;AAiDD,wBAAsB,YAAY,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CAwavG;AAED,qHAAqH;AACrH,wBAAgB,uBAAuB,CAAC,SAAS,GAAE,MAAmC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAQhH"}

package/dist/lib/platform-frontdoor.js

@@ -0,0 +1,467 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { registerSecret, getPlatformDefaultProvider, setPlatformDefaultProvider, } from '@knowzai/core';
+import { applyPlatform, resolvePackagedAssetsDir, } from './platform-lifecycle.js';
+import { parseEnv, redactPlatformSecrets, } from './platform-runtime.js';
+import { resolveProviderSelection, } from './platform-provider-prompt.js';
+import { acquireGhcrLogin, resolveImageSource } from './platform-image-source.js';
+import { runOnboarding, runOnboardingProviderProbe, waitForOnboardingReady, DEFAULT_LOCAL_PROFILE, } from './platform-onboarding.js';
+import { ensureEngineReady as ensureContainerEngineReady, } from './container-engine.js';
+import { withSpinner } from './ui.js';
+import { buildRegistryLoginInvocation } from './platform-image-source.js';
+import { parsePlatformReleaseManifest, PlatformReleaseCatalogHttpError, resolvePlatformRelease, SelfServeResolutionError, } from './platform-release-manifest.js';
+import { normalizeMothershipOrigin, } from './activate.js';
+/**
+ * `knowz up` front-door orchestration — the opinionated one-command onboarding
+ * that composes the AI-provider picker (N1) → image-source resolution (N2) →
+ * `applyPlatform` lifecycle → post-boot onboarding (N3) into a single flow.
+ *
+ * PURE orchestration: every side effect (prompt, process runner, config I/O,
+ * onboarding deps) is injected, so the whole flow runs with no real Docker,
+ * network, or browser in tests. Pull mode stays byte-identical to `platform up`
+ * (the image-source seam only overrides the compose file + cwd in build mode).
+ */
+/**
+ * Pinned default portable release for the friendly front door. Unlike
+ * `platform up` (which fails closed without `--version`), `knowz up` supplies a
+ * concrete, deliberately-bumped version so a first-time user gets a working
+ * stack — NEVER a floating tag like `latest`. Override with `--version`.
+ */
+export const STABLE_PORTABLE_RELEASE = '0.35.2';
+export const DEFAULT_PORTABLE_VERSION = STABLE_PORTABLE_RELEASE;
+export function resolveDefaultPortableVersion(env) {
+    const value = env.KNOWZ_PLATFORM_VERSION?.trim();
+    if (!value)
+        return DEFAULT_PORTABLE_VERSION;
+    if (!/^\d+\.\d+\.\d+$/.test(value)) {
+        throw new Error(`Invalid KNOWZ_PLATFORM_VERSION value '${value}'. Expected a bare X.Y.Z version matching ^\\d+\\.\\d+\\.\\d+$.`);
+    }
+    return value;
+}
+/** Compose/registry failures that warrant a one-shot authenticated pull retry. */
+export function isRegistryAuthError(err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return /denied|unauthor|authentication required|forbidden|\b401\b|\b403\b|no basic auth|access to the resource/i.test(message);
+}
+const LEGACY_DOCKER_ENGINE = {
+    engine: 'docker',
+    daemonReachable: true,
+    composeFront: { command: 'docker', baseArgs: ['compose'] },
+};
+function throwPreflightFailure(report) {
+    const failure = report.checks.find((check) => !check.ok);
+    throw new Error([failure?.message ?? 'Portable platform preflight failed.', failure?.remedy].filter(Boolean).join(' '));
+}
+const DEFAULT_MOTHERSHIP_URL = 'https://api.knowz.io';
+const RELEASE_MANIFEST_PATH = '/api/v1/platform-releases';
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function e1(manifestUrl) {
+    return new SelfServeResolutionError(`Could not resolve a Knowz Platform release: ${manifestUrl} is unreachable and this CLI has no usable packaged release list. ` +
+        'If you are offline, use --preloaded with a loaded image bundle, or set GHCR_PULL_TOKEN for direct registry access, ' +
+        'or run from a source checkout with --build.', 'RELEASE_CATALOG_UNAVAILABLE');
+}
+function e4(installationId) {
+    return new SelfServeResolutionError(`This installation's access was revoked or has expired (installation ${installationId}). Image pulls and entitlement leases are both refused. ` +
+        "Run 'knowz activate' to link this device again, or contact your account owner.", 'INSTALLATION_REVOKED');
+}
+function e5() {
+    return new SelfServeResolutionError("Device linking was not completed — nothing was linked and no images were pulled. Run 'knowz up' again to retry.", 'DEVICE_LINK_INCOMPLETE');
+}
+function activationRequired() {
+    return new SelfServeResolutionError("This device is not linked to a Knowz account. Run 'knowz activate' in an interactive terminal, then retry 'knowz up --json'.", 'ACTIVATION_REQUIRED');
+}
+async function defaultFetchReleaseManifest(url) {
+    const response = await fetch(url, {
+        headers: { accept: 'application/json' },
+        signal: AbortSignal.timeout(10_000),
+    });
+    if (!response.ok)
+        throw new PlatformReleaseCatalogHttpError(response.status);
+    return response.json();
+}
+export async function runFrontDoor(input, deps) {
+    const log = input.json
+        ? (_line) => { }
+        : deps.log ?? ((line) => console.log(line));
+    const ports = {
+        api: input.base.ports?.api ?? 5000,
+        web: input.base.ports?.web ?? 3000,
+        mcp: input.base.ports?.mcp ?? 3001,
+        publicSite: input.base.ports?.publicSite ?? 3002,
+    };
+    // 0) Environment-only preflight. It deliberately runs before config loading
+    // or provider prompting so credentials are never collected on an unusable host.
+    let engine;
+    if (deps.preflight) {
+        let report = await deps.preflight({ name: input.base.name, configDir: input.base.configDir, ports });
+        engine = report.engine;
+        if (!report.ok) {
+            const machineIsFixable = report.engine?.engine === 'podman'
+                && report.engine.machine !== undefined
+                && report.engine.machine.state !== 'running';
+            if (!machineIsFixable)
+                throwPreflightFailure(report);
+            const progress = process.stdout.isTTY
+                ? withSpinner
+                : async (_text, run) => run();
+            await (deps.ensureEngineReady ?? ensureContainerEngineReady)(report.engine, deps.runner, progress);
+            report = await deps.preflight({ name: input.base.name, configDir: input.base.configDir, ports });
+            engine = report.engine;
+            if (!report.ok)
+                throwPreflightFailure(report);
+        }
+    }
+    // 1) AI-provider picker (flags → persisted default → interactive → offline fallback).
+    const cfg = deps.loadConfig();
+    const cfgDefault = getPlatformDefaultProvider(cfg);
+    const canPrompt = deps.isTty && !input.json;
+    const interactivePromptOccurred = canPrompt &&
+        !input.providerFlags.offline &&
+        !input.providerFlags.ai?.trim() &&
+        (input.reconfigure === true || !cfgDefault);
+    const selection = await resolveProviderSelection({
+        flags: input.providerFlags,
+        prompt: deps.prompt,
+        cfgDefault,
+        requiredEnvByPreset: deps.requiredEnvByPreset,
+        isTty: canPrompt,
+        activateCloudAi: deps.activateCloudAi
+            ? () => deps.activateCloudAi(input.base.name)
+            : undefined,
+        discoverCloudAiModels: deps.discoverCloudAiModels,
+        reconfigure: input.reconfigure,
+    });
+    const providerSecrets = [selection.azure?.apiKey, selection.openAiCompatible?.apiKey].filter((value) => Boolean(value));
+    for (const secret of providerSecrets)
+        registerSecret(secret);
+    if (input.ghcrToken)
+        registerSecret(input.ghcrToken);
+    const requestedSuperAdminPassphrase = input.superAdminPassphrase ?? input.base.superAdminPassphrase;
+    if (requestedSuperAdminPassphrase)
+        registerSecret(requestedSuperAdminPassphrase);
+    let identity = input.identity;
+    if (!identity && interactivePromptOccurred) {
+        const name = (await deps.prompt.text({ message: 'First account name:', default: 'Local' })).trim();
+        const email = (await deps.prompt.text({ message: 'First account email:', default: 'local@knowz.local' })).trim();
+        identity = {
+            name: name || 'Local',
+            email: email || 'local@knowz.local',
+        };
+    }
+    // Discoverability: when a saved default was silently reused (no --offline/--ai/--provider,
+    // where --provider folds into providerFlags.ai), explain why no prompt appeared.
+    if (cfgDefault && !interactivePromptOccurred && !input.providerFlags.offline && !input.providerFlags.ai) {
+        log(`Using saved AI provider '${selection.provider}' (override with --ai/--offline).`);
+    }
+    const applyInput = {
+        ...input.base,
+        provider: selection.provider,
+        azure: selection.azure ?? input.base.azure,
+        gcp: selection.gcp ?? input.base.gcp,
+        openAiCompatible: selection.openAiCompatible ?? input.base.openAiCompatible,
+        axes: selection.axes ?? input.base.axes,
+        superAdminPassphrase: requestedSuperAdminPassphrase,
+    };
+    // 2) Image source: build-from-checkout runs in place at the repo root; pull keeps
+    //    the byte-identical copy-into-runtime-dir seam (so we only override the plan).
+    const source = resolveImageSource({
+        cwd: deps.cwd,
+        flags: input.imageFlags,
+        canPrompt: deps.isTty && Boolean(deps.ghcrPrompt),
+        pathExists: deps.pathExists,
+        packagedAssetsDir: deps.packagedAssetsDir,
+        env: input.ghcrToken
+            ? { ...deps.env, GHCR_PULL_TOKEN: input.ghcrToken }
+            : deps.env,
+    });
+    const seam = source.mode === 'build'
+        ? { composeFile: source.composeFile, projectDir: source.projectDir, composePlan: source.composePlan }
+        : source.mode === 'pull'
+            ? { composePlan: source.composePlan, registry: source.registry ?? null }
+            : { composePlan: source.composePlan };
+    const selfServePlan = source.loginPlan?.kind === 'self-serve' ? source.loginPlan : undefined;
+    if (selfServePlan) {
+        const mothershipUrl = normalizeMothershipOrigin(deps.env.KNOWZ_LICENSING_MOTHERSHIP_URL?.trim() || DEFAULT_MOTHERSHIP_URL);
+        const manifestUrl = `${mothershipUrl}${RELEASE_MANIFEST_PATH}`;
+        log('◇ Checking Knowz releases…');
+        let manifest;
+        try {
+            const raw = await (deps.fetchReleaseManifest ?? defaultFetchReleaseManifest)(manifestUrl);
+            // Parsing stays outside the fallback contract: a malformed 200 is a server
+            // contract failure, not permission to use stale packaged data.
+            manifest = parsePlatformReleaseManifest(raw);
+        }
+        catch (fetchError) {
+            const looksLikeParsedContractFailure = fetchError instanceof SelfServeResolutionError;
+            if (looksLikeParsedContractFailure)
+                throw fetchError;
+            if (fetchError instanceof SyntaxError) {
+                throw new SelfServeResolutionError(`The Knowz release catalog at ${manifestUrl} returned invalid JSON in a successful response; this CLI did not substitute a stale packaged release list.`, 'RELEASE_CATALOG_UNAVAILABLE');
+            }
+            if (fetchError instanceof PlatformReleaseCatalogHttpError &&
+                (fetchError.status === 401 || fetchError.status === 403)) {
+                throw new SelfServeResolutionError(`This Knowz deployment does not serve a public release catalog at ${manifestUrl} ` +
+                    `(HTTP ${fetchError.status}; licensing is disabled or unavailable). ` +
+                    'Use a licensing-enabled mothership or set GHCR_PULL_TOKEN for direct registry access.', 'RELEASE_CATALOG_DISABLED');
+            }
+            if (fetchError instanceof PlatformReleaseCatalogHttpError &&
+                fetchError.status !== 404 &&
+                fetchError.status < 500) {
+                throw new SelfServeResolutionError(`The Knowz release catalog at ${manifestUrl} returned HTTP ${fetchError.status}; this CLI did not substitute a stale packaged release list.`, 'RELEASE_CATALOG_UNAVAILABLE');
+            }
+            try {
+                const fallbackPath = join(source.projectDir, 'releases.json');
+                const fallback = deps.loadPackagedReleaseManifest
+                    ? await deps.loadPackagedReleaseManifest(fallbackPath)
+                    : JSON.parse(readFileSync(fallbackPath, 'utf8'));
+                manifest = parsePlatformReleaseManifest(fallback);
+            }
+            catch {
+                throw e1(manifestUrl);
+            }
+            log(`Warning: could not reach the Knowz release catalog at ${manifestUrl} — using the release list packaged with this CLI, which may be out of date.`);
+        }
+        const flavor = selection.provider === 'gcp' ? 'portable-gcp' : 'portable';
+        const resolved = resolvePlatformRelease({
+            manifest,
+            requestedVersion: input.versionExplicit ? input.base.version : undefined,
+            requiredFlavor: flavor,
+            cliVersion: input.cliVersion ?? '0.0.0',
+            manifestUrl,
+        });
+        applyInput.version = resolved.release.version;
+        if (resolved.note)
+            log(resolved.note);
+        log(`✓ Knowz Platform ${resolved.release.version} (${flavor}) — released ${resolved.release.releasedAt.slice(0, 10)}`);
+    }
+    // Advisory credential reachability check. Failure is intentionally warn-only.
+    if (input.validate === true && deps.probeProvider) {
+        const probe = await deps.probeProvider(selection);
+        if (!probe.ok && probe.warning) {
+            log(`Warning: ${redactPlatformSecrets(probe.warning, providerSecrets)}`);
+        }
+    }
+    const shouldConfirm = Boolean(deps.confirmPrompt) &&
+        canPrompt &&
+        !input.yes &&
+        !input.json &&
+        (interactivePromptOccurred || input.reconfigure === true);
+    if (shouldConfirm) {
+        const accepted = await deps.confirmPrompt({
+            provider: selection.provider,
+            imageMode: source.mode,
+            version: applyInput.version ?? DEFAULT_PORTABLE_VERSION,
+            ports,
+            profileName: input.profileName ?? DEFAULT_LOCAL_PROFILE,
+            identity: identity ?? { name: 'Local', email: 'local@knowz.local' },
+        });
+        if (!accepted)
+            throw new Error('Setup aborted — nothing was changed.');
+    }
+    // Persistence is confirm-gated: a declined wizard never mutates config.
+    setPlatformDefaultProvider(cfg, selection.provider);
+    deps.saveConfig(cfg);
+    const applyDeps = {
+        runner: deps.runner,
+        assetsDir: deps.assetsDir,
+        randomBytes: deps.randomBytes,
+        now: deps.now,
+        // Real front-door bindings always supply preflight. The Docker default keeps
+        // legacy injected front-door tests and custom embedders byte-identical when
+        // they intentionally omit that environment gate.
+        engine: engine ?? LEGACY_DOCKER_ENGINE,
+    };
+    // 3) Bring the stack up; anonymous pull first, authenticate + retry once on auth failure.
+    let applied;
+    if (selfServePlan)
+        log(`◇ Pulling images from ${selfServePlan.registry}…`);
+    try {
+        applied = await (deps.applyPlatform ?? applyPlatform)(applyInput, applyDeps, seam);
+        if (selfServePlan)
+            log(`◇ Pulling images from ${selfServePlan.registry}… ✓`);
+    }
+    catch (error) {
+        if (source.mode === 'pull' &&
+            source.loginPlan?.kind === 'ghcr' &&
+            isRegistryAuthError(error)) {
+            const loginEnv = input.ghcrToken
+                ? { ...deps.env, GHCR_PULL_TOKEN: input.ghcrToken }
+                : deps.env;
+            const login = await acquireGhcrLogin(source.loginPlan, deps.ghcrPrompt, loginEnv);
+            if (!login)
+                throw error;
+            log('Registry rejected an anonymous pull; authenticating and retrying…');
+            applied = await (deps.applyPlatform ?? applyPlatform)(applyInput, applyDeps, { ...seam, login });
+        }
+        else if (source.mode === 'pull' && selfServePlan && isRegistryAuthError(error)) {
+            const activeEngine = engine ?? LEGACY_DOCKER_ENGINE;
+            const mothershipUrl = normalizeMothershipOrigin(deps.env.KNOWZ_LICENSING_MOTHERSHIP_URL?.trim() || DEFAULT_MOTHERSHIP_URL);
+            if (!deps.loadStoredActivation ||
+                !deps.activateInstallation ||
+                !deps.preflightRegistryCredential) {
+                throw new Error('Self-serve registry authentication dependencies are not configured.');
+            }
+            let activation = await deps.loadStoredActivation({
+                projectName: input.base.name,
+                configDir: input.base.configDir,
+                engine: activeEngine,
+            });
+            let activatedNow = false;
+            if (!activation) {
+                if (input.json)
+                    throw activationRequired();
+                log("This device isn't linked to a Knowz account yet.");
+                log('Linking is free and takes about a minute — your browser will open so you can approve this device.');
+                log('');
+                try {
+                    activation = await deps.activateInstallation({
+                        projectName: input.base.name,
+                        configDir: input.base.configDir,
+                        mothershipUrl,
+                        engine: activeEngine,
+                    });
+                    activatedNow = true;
+                }
+                catch {
+                    throw e5();
+                }
+            }
+            let preflight = await deps.preflightRegistryCredential({ mothershipUrl, activation });
+            if (preflight.kind === 'transport-failure') {
+                throw new SelfServeResolutionError(`Could not reach the Knowz image authorization service at ${mothershipUrl}/api/v1/registry/token. ` +
+                    'Check your network connection, then retry.', 'REGISTRY_AUTH_UNREACHABLE');
+            }
+            let preflightStatus = preflight.status;
+            if (preflightStatus === 410)
+                throw e4(activation.installationId);
+            if (preflightStatus === 401) {
+                if (activatedNow || !canPrompt || !deps.confirmReactivation) {
+                    throw new SelfServeResolutionError(`Stored installation ${activation.installationId} is no longer valid. Run 'knowz activate' to link this device again.`, 'INSTALLATION_INVALID');
+                }
+                const accepted = await deps.confirmReactivation(activation.installationId);
+                if (!accepted)
+                    throw e5();
+                try {
+                    activation = await deps.activateInstallation({
+                        projectName: input.base.name,
+                        configDir: input.base.configDir,
+                        mothershipUrl,
+                        engine: activeEngine,
+                    });
+                    activatedNow = true;
+                }
+                catch {
+                    throw e5();
+                }
+                preflight = await deps.preflightRegistryCredential({ mothershipUrl, activation });
+                if (preflight.kind === 'transport-failure') {
+                    throw new SelfServeResolutionError(`Could not reach the Knowz image authorization service at ${mothershipUrl}/api/v1/registry/token. ` +
+                        'Check your network connection, then retry.', 'REGISTRY_AUTH_UNREACHABLE');
+                }
+                preflightStatus = preflight.status;
+                if (preflightStatus === 410)
+                    throw e4(activation.installationId);
+            }
+            if (preflightStatus !== 200) {
+                throw new SelfServeResolutionError(`Knowz could not authorize installation ${activation.installationId} for image pulls (HTTP ${preflightStatus}).`, 'INSTALLATION_INVALID');
+            }
+            registerSecret(activation.credential);
+            if (activatedNow)
+                log(`✓ Linked — installation "${input.base.name}"`);
+            const login = buildRegistryLoginInvocation(selfServePlan.registry, activation.installationId, activation.credential);
+            try {
+                applied = await (deps.applyPlatform ?? applyPlatform)(applyInput, applyDeps, {
+                    ...seam,
+                    login,
+                });
+            }
+            catch (retryError) {
+                throw new SelfServeResolutionError('Knowz could not pull the published platform images after signing in. The container engine reported: ' +
+                    redactPlatformSecrets(errorMessage(retryError), [activation.credential]), 'REGISTRY_PULL_FAILED');
+            }
+            log(`◇ Signing in to ${selfServePlan.registry}… ✓`);
+            log(`◇ Pulling images from ${selfServePlan.registry}… ✓`);
+        }
+        else if (source.mode === 'pull' &&
+            source.registry &&
+            !source.loginPlan &&
+            isRegistryAuthError(error)) {
+            throw new Error(`Registry override ${source.registry} refused image access: ${errorMessage(error)}`);
+        }
+        else {
+            throw error;
+        }
+    }
+    for (const line of applied.output.split('\n'))
+        log(line);
+    const profileName = input.profileName ?? DEFAULT_LOCAL_PROFILE;
+    const apiUrl = applied.state.serviceUrls.api;
+    const webUrl = applied.state.serviceUrls.web;
+    const renderedEnv = parseEnv(readFileSync(applied.paths.envFile, 'utf8'));
+    const superAdminPassphrase = renderedEnv.SUPERADMIN_PASSPHRASE;
+    const rawOnboardingDeps = deps.onboardingDepsFor(apiUrl, { superAdminPassphrase });
+    const onboardingDeps = input.validate === true
+        ? rawOnboardingDeps
+        : { ...rawOnboardingDeps, providerProbe: undefined };
+    const onboardingInput = {
+        apiUrl,
+        webUrl,
+        adminUsername: renderedEnv.ADMIN_USERNAME ?? 'admin@knowz.local',
+        adminPassword: renderedEnv.ADMIN_PASSWORD ?? '',
+        superAdminPassphrase,
+        seedDemo: input.seedDemo,
+        open: input.open,
+        profileName: input.profileName,
+        register: identity,
+        provider: selection.provider,
+    };
+    // 4a) The same bounded health gate precedes every credential path, including
+    //     profile reuse. Passing the result into onboarding avoids a second poll.
+    const apiReady = await waitForOnboardingReady({}, onboardingDeps);
+    if (!apiReady) {
+        const onboarding = await runOnboarding({ ...onboardingInput, apiReady }, onboardingDeps);
+        return {
+            state: applied.state,
+            imageMode: source.mode,
+            provider: selection.provider,
+            profile: onboarding.profile ?? null,
+            loginMode: onboarding.loginMode,
+            seeded: onboarding.seeded,
+        };
+    }
+    // 4b) If a prior `up` already signed the CLI profile in and its key still authenticates,
+    //     skip the register/onboarding dance entirely — avoids the register → "Email already
+    //     registered" → manual-degrade noise on every idempotent re-up.
+    const reused = deps.reuseExistingProfile ? await deps.reuseExistingProfile(profileName, apiUrl) : null;
+    if (reused) {
+        await runOnboardingProviderProbe(selection.provider, () => onboardingDeps.apiClientFor(profileName), onboardingDeps);
+        log(`Already signed in — reusing the '${profileName}' CLI profile${reused.tenantId ? ` (tenant ${reused.tenantId})` : ''}.`);
+        log(`  Web UI: ${webUrl}`);
+        log(`  API:    ${apiUrl}`);
+        if (input.open)
+            onboardingDeps.openBrowser(webUrl);
+        return { state: applied.state, imageMode: source.mode, provider: selection.provider, profile: profileName, loginMode: 'existing', seeded: false };
+    }
+    // 4c) Onboarding: bootstrap → register fallback → manual degrade.
+    const onboarding = await runOnboarding({ ...onboardingInput, apiReady }, onboardingDeps);
+    return {
+        state: applied.state,
+        imageMode: source.mode,
+        provider: selection.provider,
+        profile: onboarding.profile ?? null,
+        loginMode: onboarding.loginMode,
+        seeded: onboarding.seeded,
+    };
+}
+/** Read the packaged runtime contract's `providerPresets.{preset}.requiredEnvironment` map (drift-fenced source). */
+export function loadRequiredEnvByPreset(assetsDir = resolvePackagedAssetsDir()) {
+    const contract = JSON.parse(readFileSync(join(assetsDir, 'runtime-contract.json'), 'utf8'));
+    const presets = contract.providerPresets ?? {};
+    const out = {};
+    for (const [preset, meta] of Object.entries(presets))
+        out[preset] = meta.requiredEnvironment ?? [];
+    return out;
+}
+//# sourceMappingURL=platform-frontdoor.js.map