@latysh-development/monolith 0.0.0-stage → 0.1.0-alpha.0

package/dist/http/server.js

@@ -0,0 +1,195 @@
+/**
+ * Secure read-only HTTP transport for Mission Control (UI-001B.2, ADR-010 G2).
+ *
+ * One endpoint, `GET /api/dashboard`, serves the existing `DashboardReadModel`
+ * exactly as `readDashboardModel(projectRoot)` returns it. This module is a
+ * transport only:
+ *  - it reads no file and imports no filesystem module; every byte of project
+ *    data arrives through `readDashboardModel` (ADR-014 safe read);
+ *  - it knows nothing about `state.json`, its schema or its physical layout, so
+ *    the Core storage can change (STATE-003) without touching this layer;
+ *  - the project root is fixed when the server starts and is never taken from a
+ *    request (query, body, header or cookie are not read for that purpose).
+ *
+ * With `options.assets` it also serves the built UI from memory (`monolith ui`);
+ * the API route, the Host/Origin checks and the loopback bind are unchanged.
+ *
+ * Security boundary (G2): bound to 127.0.0.1 only; `Host` allowlist (loopback
+ * name + the real port, against DNS rebinding); `Origin` checked when present
+ * and never reflected; no CORS headers at all; GET only; fixed response
+ * headers; bounded response size with no partial JSON; errors are fixed codes,
+ * never exception text or paths. Loopback is NOT treated as authentication.
+ *
+ * Source failures (absent / forbidden / corrupt / unreadable) are part of the
+ * DTO (`SourceReport`) and keep their Typed Read Model semantics: they are a
+ * valid 200 response carrying `data: null` and a typed code, never project
+ * content. Threat model (ADR-013): TM-A supported with limitations, TM-B
+ * partially supported, TM-C (concurrent adversarial mutation) NOT supported;
+ * dynamic TOCTOU is not closed here, nor by Core.
+ */
+import { createServer } from 'http';
+import { isAbsolute } from 'path';
+import { readDashboardModel } from '../readmodel/index.js';
+export const DASHBOARD_PATH = '/api/dashboard';
+/** The only bind address; there is deliberately no option to change it. */
+export const LOOPBACK_HOST = '127.0.0.1';
+/**
+ * Hard ceiling for one serialized response. The Core read limits (state 16 MiB,
+ * active.md/roadmap 256 KiB) are protective ceilings of their own and can exceed
+ * it; an over-limit DTO is refused whole, never truncated.
+ */
+export const MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+const ERROR_STATUS = {
+    HOST_NOT_ALLOWED: 403,
+    ORIGIN_NOT_ALLOWED: 403,
+    NOT_FOUND: 404,
+    METHOD_NOT_ALLOWED: 405,
+    RESPONSE_TOO_LARGE: 500,
+    INTERNAL_ERROR: 500,
+};
+const ERROR_KIND = {
+    HOST_NOT_ALLOWED: 'security',
+    ORIGIN_NOT_ALLOWED: 'security',
+    NOT_FOUND: 'request',
+    METHOD_NOT_ALLOWED: 'request',
+    RESPONSE_TOO_LARGE: 'dashboard',
+    INTERNAL_ERROR: 'internal',
+};
+function send(res, status, body, extra = {}) {
+    const buf = Buffer.from(body, 'utf8');
+    res.writeHead(status, {
+        'Content-Type': 'application/json; charset=utf-8',
+        'Content-Length': String(buf.length),
+        'X-Content-Type-Options': 'nosniff',
+        'Cache-Control': 'no-store',
+        'Content-Security-Policy': "default-src 'none'",
+        ...extra,
+    });
+    res.end(buf);
+}
+/** CSP of the UI document and its assets: self-hosted code only, no framing, no form posts. */
+const UI_CSP = "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; " +
+    "font-src 'self' data:; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'";
+function sendAsset(res, body, contentType) {
+    res.writeHead(200, {
+        'Content-Type': contentType,
+        'Content-Length': String(body.length),
+        'X-Content-Type-Options': 'nosniff',
+        'Cache-Control': 'no-store',
+        'Content-Security-Policy': UI_CSP,
+        'Referrer-Policy': 'no-referrer',
+        'Cross-Origin-Resource-Policy': 'same-origin',
+    });
+    res.end(body);
+}
+function sendError(res, code) {
+    const body = { error: { kind: ERROR_KIND[code], code } };
+    // An unread request body must not keep the connection busy.
+    const extra = { Connection: 'close' };
+    if (code === 'METHOD_NOT_ALLOWED')
+        extra.Allow = 'GET';
+    send(res, ERROR_STATUS[code], JSON.stringify(body), extra);
+}
+function single(h) {
+    return typeof h === 'string' ? h : undefined;
+}
+/**
+ * Node exposes only the first `Host` in `req.headers`, so duplicates must be
+ * counted on the raw header list (names are case-insensitive; values are
+ * ignored here and never echoed).
+ */
+function hostHeaderCount(rawHeaders) {
+    let count = 0;
+    for (let i = 0; i < rawHeaders.length; i += 2) {
+        if (rawHeaders[i].toLowerCase() === 'host')
+            count++;
+    }
+    return count;
+}
+/** Path of the request target without its query; the query is never interpreted. */
+function pathOf(target) {
+    if (target === undefined)
+        return '';
+    const q = target.indexOf('?');
+    return q === -1 ? target : target.slice(0, q);
+}
+export async function startDashboardServer(options) {
+    const { projectRoot } = options;
+    if (typeof projectRoot !== 'string' || !isAbsolute(projectRoot)) {
+        throw new TypeError('projectRoot must be an absolute path');
+    }
+    const maxBytes = options.maxResponseBytes ?? MAX_RESPONSE_BYTES;
+    let allowedHosts = new Set();
+    let allowedOrigins = new Set();
+    function handle(req, res) {
+        // 1. Security preconditions, before anything about the route is revealed.
+        // Exactly one Host: a duplicate is ambiguous (proxies may pick another one).
+        const host = single(req.headers.host)?.toLowerCase();
+        if (hostHeaderCount(req.rawHeaders) !== 1 || host === undefined || !allowedHosts.has(host))
+            return sendError(res, 'HOST_NOT_ALLOWED');
+        if (req.headers.origin !== undefined && !allowedOrigins.has(single(req.headers.origin)?.toLowerCase() ?? '')) {
+            return sendError(res, 'ORIGIN_NOT_ALLOWED');
+        }
+        // 2. Route and method. Exact match only: no trailing slash, no decoding.
+        const path = pathOf(req.url);
+        if (path !== DASHBOARD_PATH) {
+            const asset = options.assets?.get(path === '/' ? '/index.html' : path);
+            if (asset === undefined)
+                return sendError(res, 'NOT_FOUND');
+            if (req.method !== 'GET')
+                return sendError(res, 'METHOD_NOT_ALLOWED');
+            return sendAsset(res, asset.body, asset.contentType);
+        }
+        if (req.method !== 'GET')
+            return sendError(res, 'METHOD_NOT_ALLOWED');
+        // 3. The DTO, whole or not at all.
+        let body;
+        try {
+            body = JSON.stringify(readDashboardModel(projectRoot));
+        }
+        catch {
+            return sendError(res, 'INTERNAL_ERROR');
+        }
+        if (Buffer.byteLength(body, 'utf8') > maxBytes)
+            return sendError(res, 'RESPONSE_TOO_LARGE');
+        send(res, 200, body);
+    }
+    const server = createServer((req, res) => {
+        try {
+            handle(req, res);
+        }
+        catch {
+            if (!res.headersSent)
+                sendError(res, 'INTERNAL_ERROR');
+            else
+                res.destroy();
+        }
+    });
+    server.requestTimeout = 10_000;
+    server.headersTimeout = 5_000;
+    const port = await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(options.port ?? 0, LOOPBACK_HOST, () => {
+            server.off('error', reject);
+            const addr = server.address();
+            if (addr === null || typeof addr === 'string')
+                reject(new Error('unexpected listen address'));
+            else
+                resolve(addr.port);
+        });
+    }).catch((err) => {
+        server.close();
+        throw err;
+    });
+    allowedHosts = new Set([`${LOOPBACK_HOST}:${port}`, `localhost:${port}`]);
+    allowedOrigins = new Set([`http://${LOOPBACK_HOST}:${port}`, `http://localhost:${port}`]);
+    return {
+        host: LOOPBACK_HOST,
+        port,
+        url: `http://${LOOPBACK_HOST}:${port}`,
+        close: () => new Promise((resolve, reject) => {
+            server.close((err) => (err ? reject(err) : resolve()));
+            server.closeAllConnections();
+        }),
+    };
+}

package/dist/http/ui-assets.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Loader for the built Mission Control UI (`dist/ui`), used by `monolith ui`.
+ *
+ * The HTTP transport (`server.ts`) imports no filesystem module on purpose, so
+ * the static files are read here, once, at startup, into memory. The server
+ * then serves them by exact key: a request path is never joined to a directory,
+ * so path traversal has nothing to traverse.
+ *
+ * What is accepted: regular files only (no symlink, no special file, one link),
+ * a fixed extension allowlist, a bounded directory depth, file count and size.
+ * Anything else is skipped, except that a missing or unsafe `index.html` is an
+ * error. Assets are read once; later changes on disk are not picked up.
+ */
+import type { UiAssets } from './server.js';
+export type UiAssetsErrorCode = 'UI_BUILD_MISSING' | 'UI_BUILD_UNSAFE' | 'UI_BUILD_TOO_LARGE';
+export declare class UiAssetsError extends Error {
+    readonly code: UiAssetsErrorCode;
+    constructor(code: UiAssetsErrorCode, message: string);
+}
+/** Reads `dir` (the built UI) into memory. Throws `UiAssetsError` if there is no usable `index.html`. */
+export declare function loadUiAssets(dir: string): UiAssets;
+//# sourceMappingURL=ui-assets.d.ts.map

package/dist/http/ui-assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui-assets.d.ts","sourceRoot":"","sources":["../../src/http/ui-assets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAW,QAAQ,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AAE9F,qBAAa,aAAc,SAAQ,KAAK;IAC1B,QAAQ,CAAC,IAAI,EAAE,iBAAiB;gBAAvB,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM;CAI9D;AAiCD,yGAAyG;AACzG,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,CAwClD"}

package/dist/http/ui-assets.js

@@ -0,0 +1,100 @@
+/**
+ * Loader for the built Mission Control UI (`dist/ui`), used by `monolith ui`.
+ *
+ * The HTTP transport (`server.ts`) imports no filesystem module on purpose, so
+ * the static files are read here, once, at startup, into memory. The server
+ * then serves them by exact key: a request path is never joined to a directory,
+ * so path traversal has nothing to traverse.
+ *
+ * What is accepted: regular files only (no symlink, no special file, one link),
+ * a fixed extension allowlist, a bounded directory depth, file count and size.
+ * Anything else is skipped, except that a missing or unsafe `index.html` is an
+ * error. Assets are read once; later changes on disk are not picked up.
+ */
+import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, readdirSync } from 'fs';
+import { join, extname } from 'path';
+export class UiAssetsError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'UiAssetsError';
+    }
+}
+const CONTENT_TYPES = {
+    '.html': 'text/html; charset=utf-8',
+    '.js': 'text/javascript; charset=utf-8',
+    '.css': 'text/css; charset=utf-8',
+    '.webp': 'image/webp',
+    '.png': 'image/png',
+    '.svg': 'image/svg+xml',
+    '.ico': 'image/x-icon',
+    '.woff2': 'font/woff2',
+};
+const MAX_DEPTH = 3;
+const MAX_FILES = 200;
+const MAX_FILE_BYTES = 8 * 1024 * 1024;
+const MAX_TOTAL_BYTES = 32 * 1024 * 1024;
+function readRegular(abs) {
+    // lstat first so a symlink is refused rather than followed.
+    const st = lstatSync(abs);
+    if (!st.isFile() || st.nlink !== 1)
+        return null;
+    if (st.size > MAX_FILE_BYTES)
+        throw new UiAssetsError('UI_BUILD_TOO_LARGE', `UI build file is larger than ${MAX_FILE_BYTES} bytes.`);
+    const fd = openSync(abs, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        const fst = fstatSync(fd);
+        if (!fst.isFile() || fst.dev !== st.dev || fst.ino !== st.ino)
+            return null;
+        return readFileSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Reads `dir` (the built UI) into memory. Throws `UiAssetsError` if there is no usable `index.html`. */
+export function loadUiAssets(dir) {
+    const assets = new Map();
+    let total = 0;
+    const walk = (abs, rel, depth) => {
+        for (const name of readdirSync(abs).sort()) {
+            const childAbs = join(abs, name);
+            const childRel = `${rel}/${name}`;
+            const st = lstatSync(childAbs);
+            if (st.isDirectory()) {
+                if (depth < MAX_DEPTH)
+                    walk(childAbs, childRel, depth + 1);
+                continue;
+            }
+            const contentType = CONTENT_TYPES[extname(name).toLowerCase()];
+            if (contentType === undefined)
+                continue;
+            const body = readRegular(childAbs);
+            if (body === null)
+                continue;
+            total += body.length;
+            if (assets.size >= MAX_FILES || total > MAX_TOTAL_BYTES) {
+                throw new UiAssetsError('UI_BUILD_TOO_LARGE', 'UI build has too many or too large files.');
+            }
+            assets.set(childRel, { body, contentType });
+        }
+    };
+    try {
+        if (!lstatSync(dir).isDirectory())
+            throw new UiAssetsError('UI_BUILD_MISSING', 'UI build directory is not a directory.');
+        walk(dir, '', 0);
+    }
+    catch (err) {
+        if (err instanceof UiAssetsError)
+            throw err;
+        if (err.code === 'ENOENT') {
+            throw new UiAssetsError('UI_BUILD_MISSING', 'UI build directory does not exist.');
+        }
+        throw new UiAssetsError('UI_BUILD_UNSAFE', 'UI build directory could not be read safely.');
+    }
+    if (!assets.has('/index.html')) {
+        throw new UiAssetsError('UI_BUILD_MISSING', 'UI build has no index.html.');
+    }
+    return assets;
+}

package/dist/index.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @latysh-development/monolith — Public API surface
+ *
+ * This file is the package entrypoint. Exports grow here as Kernel modules
+ * are extracted from project instances into this package.
+ *
+ * Current state: Phase 6 — validate implemented; Scriptorium (Story 1.2) and
+ * Explicit Relationship Graph (Story 1.3) integrated.
+ * See Phase 7+ roadmap for Kernel extraction.
+ *
+ * Webway (the frequency-based "meaning linker" prototype from Story 1.1) was
+ * extracted into its own repository: https://github.com/Demion-L/webway —
+ * it was an independent research track with zero runtime coupling to
+ * Scriptorium/Graph, see docs/webway-v0.md for the historical record.
+ */
+export type { ProjectDefinition } from './types/project-definition.js';
+export type { GateCheckResult } from './types/enforcement.js';
+export type { VerificationContext, VerificationReport } from './types/integrity.js';
+export type { ProjectConfig, InitOptions } from './init/types.js';
+export { MONOLITH_VERSION } from './version.js';
+export { runInit } from './init/index.js';
+export type { ScriptoriumInput, ScriptoriumResult, ConceptCandidate, RelationshipCandidate, Evidence, SourceReference, ScriptoriumDiagnostic, ConceptSource, EvidenceSource, HeadingLevel, ObjectDeclaration, DeclaredObjectKind, } from './scriptorium/index.js';
+export { compileMarkdownArtifact, isStructuralHeadingNoise } from './scriptorium/index.js';
+export type { GraphNode, GraphEdge, GraphDiagnostic, ExplicitRelationshipGraph, UnresolvedReference, IdentityConflict, KnowledgeObject, KnowledgeObjectKind, Resolution, UnresolvedResolution, ObjectIndex, } from './graph/index.js';
+export { buildGraph, buildObjectIndex, resolveRef, makeRef, parseRef, isValidIdentifier } from './graph/index.js';
+export type { CoordinatoriumState, Mission, MissionStatus, MissionResult, CoordinatoriumErrorCode, StartMissionInput, FinishMissionInput, StateWriteTarget, StateReadTarget, } from './coordinatorium/index.js';
+export { createInitialState, CoordinatoriumError, StateCorruptedError, StateSchemaError, LockTimeoutError, MissionNotFoundError, InvalidTransitionError, ValidationError, readState, mutateState, projectTarget, trustedDirectoryTarget, startMission, listMissions, getMission, finishMission, } from './coordinatorium/index.js';
+export { SafeWriteError } from './root/index.js';
+export type { WriteErrorCode, WriteWarning, WriteWarningCode, PublicationState } from './root/index.js';
+export * as durable from './durable/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,YAAY,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACpF,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAElE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAG1C,YAAY,EACV,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,QAAQ,EACR,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAG3F,YAAY,EACV,SAAS,EACT,SAAS,EACT,eAAe,EACf,yBAAyB,EACzB,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,UAAU,EACV,oBAAoB,EACpB,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAIlH,YAAY,EACV,mBAAmB,EACnB,OAAO,EACP,aAAa,EACb,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,GAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACtB,eAAe,EACf,SAAS,EACT,WAAW,EACX,aAAa,EACb,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,aAAa,GACd,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAKxG,OAAO,KAAK,OAAO,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -0,0 +1,26 @@
+/**
+ * @latysh-development/monolith — Public API surface
+ *
+ * This file is the package entrypoint. Exports grow here as Kernel modules
+ * are extracted from project instances into this package.
+ *
+ * Current state: Phase 6 — validate implemented; Scriptorium (Story 1.2) and
+ * Explicit Relationship Graph (Story 1.3) integrated.
+ * See Phase 7+ roadmap for Kernel extraction.
+ *
+ * Webway (the frequency-based "meaning linker" prototype from Story 1.1) was
+ * extracted into its own repository: https://github.com/Demion-L/webway —
+ * it was an independent research track with zero runtime coupling to
+ * Scriptorium/Graph, see docs/webway-v0.md for the historical record.
+ */
+export { MONOLITH_VERSION } from './version.js';
+export { runInit } from './init/index.js';
+export { compileMarkdownArtifact, isStructuralHeadingNoise } from './scriptorium/index.js';
+export { buildGraph, buildObjectIndex, resolveRef, makeRef, parseRef, isValidIdentifier } from './graph/index.js';
+export { createInitialState, CoordinatoriumError, StateCorruptedError, StateSchemaError, LockTimeoutError, MissionNotFoundError, InvalidTransitionError, ValidationError, readState, mutateState, projectTarget, trustedDirectoryTarget, startMission, listMissions, getMission, finishMission, } from './coordinatorium/index.js';
+// Safe writes — explicit write scope and publication states (SEC-001B.2, ADR-012)
+export { SafeWriteError } from './root/index.js';
+// Durable State — domain-neutral, crash-safe execution record for long-running agentic tasks (ADR-017).
+// Namespaced: its error taxonomy deliberately shares names (e.g. ValidationError) with Coordinatorium's.
+// EXPERIMENTAL. Security acceptance pending (see AGENTS.md → Durable State); the API may change in any alpha.
+export * as durable from './durable/index.js';

package/dist/init/index.d.ts

@@ -0,0 +1,12 @@
+import type { InitOptions } from './types.js';
+/**
+ * Thrown when `monolith init` would overwrite existing tracked files.
+ * Raised strictly before any write — see planScaffoldConflicts. Carries a
+ * non-zero exit via the CLI's top-level main().catch handler.
+ */
+export declare class InitConflictError extends Error {
+    readonly conflicts: string[];
+    constructor(conflicts: string[]);
+}
+export declare function runInit(options?: InitOptions): Promise<void>;
+//# sourceMappingURL=index.d.ts.map

package/dist/init/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/init/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAK9C;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;gBAEjB,SAAS,EAAE,MAAM,EAAE;CAmBhC;AAED,wBAAsB,OAAO,CAAC,OAAO,GAAE,WAA0C,GAAG,OAAO,CAAC,IAAI,CAAC,CA+DhG"}

package/dist/init/index.js

@@ -0,0 +1,90 @@
+/* eslint-disable no-console */
+import { resolve } from 'path';
+import { promptProjectConfig } from './prompts.js';
+import { scaffoldInstance, planScaffoldConflicts } from './scaffold.js';
+import { reportWriteWarning } from '../root/index.js';
+const CONFLICT_LIST_LIMIT = 20;
+/**
+ * Thrown when `monolith init` would overwrite existing tracked files.
+ * Raised strictly before any write — see planScaffoldConflicts. Carries a
+ * non-zero exit via the CLI's top-level main().catch handler.
+ */
+export class InitConflictError extends Error {
+    conflicts;
+    constructor(conflicts) {
+        const shown = conflicts.slice(0, CONFLICT_LIST_LIMIT);
+        const more = conflicts.length - shown.length;
+        const list = shown.map((c) => `    - ${c}`).join('\n');
+        super(`Refusing to initialize: ${conflicts.length} existing or unsafe path(s) (already present, or a symlink / special file that must not be written through):\n` +
+            `${list}\n` +
+            (more > 0 ? `    ...and ${more} more\n` : '') +
+            '\n' +
+            '  monolith init always scaffolds the current working directory and never\n' +
+            '  overwrites existing tracked files (re-running it is not an upgrade/force\n' +
+            '  mechanism). --yes only skips interactive prompts for a clean directory;\n' +
+            '  it does not authorize overwriting existing data.\n' +
+            '  Remove, rename, or back up the conflicting file(s) yourself, or run init\n' +
+            '  in an empty directory, then re-run.');
+        this.name = 'InitConflictError';
+        this.conflicts = conflicts;
+    }
+}
+export async function runInit(options = { targetDir: process.cwd() }) {
+    const targetDir = resolve(options.targetDir);
+    console.log('  Initializing MONOLITH instance...');
+    console.log('');
+    let config;
+    if (options.yes) {
+        // Non-interactive: use all defaults
+        const { basename } = await import('path');
+        config = {
+            projectName: basename(targetDir),
+            language: 'typescript',
+            packageManager: 'pnpm',
+            aiTool: 'claude',
+            finalizationProtocol: 'finalize-story',
+            protocols: ['finalize-story', 'failure-memory-logging', 'governance-evaluation', 'integrity-verification'],
+            monolithRoot: '.monolith',
+        };
+        console.log(`  Project:  ${config.projectName} (defaults applied)`);
+        console.log('');
+    }
+    else {
+        config = await promptProjectConfig();
+    }
+    // Preflight: must run — and find zero conflicts — before any write, so a
+    // conflict is never discovered after half the instance has already been
+    // scaffolded (see LESSON-2026-0006 / TD-007).
+    const conflicts = planScaffoldConflicts(targetDir, config);
+    if (conflicts.length > 0) {
+        throw new InitConflictError(conflicts);
+    }
+    console.log('  Scaffolding instance...');
+    console.log('');
+    const result = await scaffoldInstance(targetDir, config);
+    for (const w of result.warnings)
+        reportWriteWarning(w);
+    console.log('');
+    console.log('  ✅ MONOLITH instance initialized!');
+    console.log('');
+    console.log(`  Project:       ${config.projectName}`);
+    console.log(`  Root:          ${config.monolithRoot}/`);
+    console.log(`  Files created: ${result.filesCreated}`);
+    console.log('');
+    const instructionFileMap = {
+        claude: 'CLAUDE.md',
+        cursor: '.cursorrules',
+        windsurf: '.windsurfrules',
+    };
+    const instructionFile = instructionFileMap[config.aiTool] ?? 'AGENTS.md';
+    console.log(`  AI tool:       ${config.aiTool} → ${instructionFile}`);
+    console.log('');
+    console.log('  Next steps:');
+    console.log(`    1. Edit ${instructionFile} — verify skill triggers and paths`);
+    console.log('    2. Edit AGENTS.md — add project description');
+    console.log(`    3. Edit ${config.monolithRoot}/context/maps/project-map.md — describe your structure`);
+    console.log(`    4. Edit ${config.monolithRoot}/context/maps/roadmap-index.md — add your phases`);
+    console.log(`    5. Edit ${config.monolithRoot}/protocols/governance/core-invariants.md — set Current Focus`);
+    console.log(`    6. Start first story: edit ${config.monolithRoot}/memory/working/active.md`);
+    console.log('');
+}

package/dist/init/prompts.d.ts

@@ -0,0 +1,3 @@
+import type { ProjectConfig } from './types.js';
+export declare function promptProjectConfig(): Promise<ProjectConfig>;
+//# sourceMappingURL=prompts.d.ts.map

package/dist/init/prompts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../../src/init/prompts.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AA+BhD,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,aAAa,CAAC,CAuClE"}

package/dist/init/prompts.js

@@ -0,0 +1,47 @@
+/* eslint-disable no-console */
+import { createInterface } from 'readline';
+import { basename } from 'path';
+function createPrompter() {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const ask = (question, defaultValue) => new Promise((resolve) => {
+        const hint = defaultValue ? ` (${defaultValue})` : '';
+        rl.question(`  ${question}${hint}: `, (answer) => {
+            resolve(answer.trim() || defaultValue || '');
+        });
+    });
+    const askChoice = (question, choices, defaultChoice) => new Promise((resolve) => {
+        const choiceStr = choices.map((c) => (c === defaultChoice ? `[${c}]` : c)).join(' | ');
+        rl.question(`  ${question} (${choiceStr}): `, (answer) => {
+            const trimmed = answer.trim().toLowerCase();
+            if (!trimmed)
+                return resolve(defaultChoice);
+            const match = choices.find((c) => c.toLowerCase() === trimmed);
+            resolve(match ?? defaultChoice);
+        });
+    });
+    return { ask, askChoice, close: () => rl.close() };
+}
+export async function promptProjectConfig() {
+    const p = createPrompter();
+    console.log('');
+    const projectName = await p.ask('Project name', basename(process.cwd()));
+    const language = await p.askChoice('Primary language', ['typescript', 'javascript', 'python', 'other'], 'typescript');
+    const packageManager = await p.askChoice('Package manager', ['pnpm', 'npm', 'yarn', 'other'], 'pnpm');
+    const aiTool = await p.askChoice('AI assistant tool', ['claude', 'cursor', 'windsurf', 'other'], 'claude');
+    p.close();
+    console.log('');
+    return {
+        projectName,
+        language,
+        packageManager,
+        aiTool,
+        finalizationProtocol: 'finalize-story',
+        protocols: [
+            'finalize-story',
+            'failure-memory-logging',
+            'governance-evaluation',
+            'integrity-verification',
+        ],
+        monolithRoot: '.monolith',
+    };
+}

package/dist/init/scaffold.d.ts

@@ -0,0 +1,25 @@
+import type { ProjectConfig } from './types.js';
+import { type WriteWarning } from '../root/index.js';
+export interface ScaffoldResult {
+    filesCreated: number;
+    dirsCreated: string[];
+    /** Non-fatal write findings (e.g. best-effort platform). */
+    warnings: WriteWarning[];
+}
+/**
+ * Preflight: compute every tracked template target path scaffoldInstance
+ * would write, and return the ones that already exist on disk — or that cannot
+ * be written safely (a symlink, including a dangling one, at the target or in
+ * a parent component; a FIFO or other special file). Must be called — and
+ * found empty — before scaffoldInstance runs, so a conflict is caught before
+ * any file is written (no half-scaffolded instance). This is advice for a
+ * clean error message; the exclusive creation in scaffoldInstance is the
+ * authoritative check.
+ *
+ * `state.json` is intentionally excluded when it is a regular file:
+ * scaffoldInstance never overwrites it (mutable Coordinatorium runtime data,
+ * ADR-008), so its presence is not a conflict. A symlink there still is.
+ */
+export declare function planScaffoldConflicts(targetDir: string, config: ProjectConfig): string[];
+export declare function scaffoldInstance(targetDir: string, config: ProjectConfig): Promise<ScaffoldResult>;
+//# sourceMappingURL=scaffold.d.ts.map

package/dist/init/scaffold.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffold.d.ts","sourceRoot":"","sources":["../../src/init/scaffold.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAQL,KAAK,YAAY,EAClB,MAAM,kBAAkB,CAAC;AA+H1B,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,MAAM,EAAE,CAqCxF;AAED,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,cAAc,CAAC,CA4EzB"}