@launchsecure/launch-kit 0.0.25 → 0.0.27

package/dist/server/init-entry.js

@@ -0,0 +1,609 @@
+#!/usr/bin/env node
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// src/server/init-entry.ts
+var import_node_child_process = require("node:child_process");
+var fs = __toESM(require("node:fs"));
+var import_node_http = require("node:http");
+var import_node_https = require("node:https");
+var path = __toESM(require("node:path"));
+var readline = __toESM(require("node:readline"));
+var import_node_url = require("node:url");
+var DEFAULT_SERVER_URL = "https://launchsecure-v2.vercel.app";
+var CONFIG_FILENAME = ".launch-secure.cred.config";
+var LEGACY_CONFIG_FILENAME = ".launch-secure.config";
+var ONBOARD_SCRIPT_NAME = "onboard";
+var LAUNCH_KIT_PKG = "@launchsecure/launch-kit";
+var LAUNCH_KIT_TOOLS_GUIDE = `
+Wired in Claude Code (.mcp.json):
+  launch-secure   \u2014 LS API: work items, comms, secrets, members, board
+  launch-chart    \u2014 code search + project graph (use instead of grep/glob)
+  launch-deck     \u2014 visual playground / blast-radius diagrams
+  launch-orbit    \u2014 git worktree orchestration (branch / merge gates)
+  launch-recall   \u2014 restore deleted/modified files from shadow git
+
+Other tools (run on demand via npx):
+  npx launch-pod radar       \u2014 webhook listener (LS pings \u2192 terminal/UI)
+  npx launch-pod             \u2014 full pipeline UI (separate launch-pod login)
+`;
+var PACKAGE_MANAGERS = [
+  { name: "pnpm", binary: "pnpm", lockfiles: ["pnpm-lock.yaml"], workspaceFiles: ["pnpm-workspace.yaml"], installArgs: ["install"] },
+  { name: "yarn", binary: "yarn", lockfiles: ["yarn.lock"], installArgs: ["install"] },
+  { name: "bun", binary: "bun", lockfiles: ["bun.lockb", "bun.lock"], installArgs: ["install"] },
+  { name: "npm", binary: "npm", lockfiles: ["package-lock.json"], installArgs: ["install"] }
+];
+function parseArgs(argv) {
+  const args = {
+    token: process.env.LS_PAT ?? null,
+    orgSlug: null,
+    projectSlug: null,
+    serverUrl: DEFAULT_SERVER_URL,
+    targetDir: null,
+    noInstall: false,
+    noRecall: false,
+    noMigrateSafety: false,
+    help: false
+  };
+  for (const raw of argv) {
+    if (raw === "--help" || raw === "-h") {
+      args.help = true;
+      continue;
+    }
+    if (raw === "--no-install") {
+      args.noInstall = true;
+      continue;
+    }
+    if (raw === "--no-recall") {
+      args.noRecall = true;
+      continue;
+    }
+    if (raw === "--no-migrate-safety") {
+      args.noMigrateSafety = true;
+      continue;
+    }
+    const eq = raw.indexOf("=");
+    if (!raw.startsWith("--") || eq < 0) continue;
+    const key = raw.slice(2, eq);
+    const val = raw.slice(eq + 1);
+    if (key === "token") args.token = val;
+    else if (key === "org") args.orgSlug = val;
+    else if (key === "project") args.projectSlug = val;
+    else if (key === "url") args.serverUrl = val.replace(/\/+$/, "");
+    else if (key === "dir") args.targetDir = val;
+  }
+  return args;
+}
+function printHelp() {
+  console.log(`launch-kit init \u2014 bootstrap a LaunchSecure project on this machine
+
+Usage:
+  npx launch-kit init --token=<pat> --org=<orgSlug> --project=<projectSlug> [options]
+
+Required:
+  --token=<pat>            LaunchSecure PAT (ls_pat_...). Or set LS_PAT env var.
+  --org=<orgSlug>          Organization slug.
+  --project=<projectSlug>  Project slug.
+
+Options:
+  --url=<serverUrl>        LaunchSecure base URL (default: ${DEFAULT_SERVER_URL}).
+  --dir=<path>             Target directory (default: ./<projectSlug>).
+  --no-install             Skip dependency install step.
+  --no-recall              Skip launch-recall (shadow git backup) scaffold.
+  --no-migrate-safety      Skip migrate-safety scaffold (pg_dump-before-migrate
+                           wrapper + GitHub Action + runbook).
+  --help                   Show this help.
+
+What it does:
+  1. Preflight: checks git + node + (optional) gh.
+  2. Calls LaunchSecure to resolve the project + its git remote.
+  3. Clones the repo (prefers gh, falls back to git) \u2014 skipped if dir already
+     contains the matching clone.
+  4. Writes .launch-secure.cred.config (gitignored). Auto-migrates any
+     legacy .launch-secure.config that contains a PAT.
+  5. Merges .mcp.json with 5 entries (launch-secure / -chart / -deck / -orbit /
+     -recall). Preserves your other MCP entries. Auth via headersHelper \u2014
+     no secrets written into .mcp.json.
+  6. Detects package manager (packageManager field > lockfile > npm fallback)
+     and runs install. Skip with --no-install.
+  7. If package.json declares a "${ONBOARD_SCRIPT_NAME}" script, runs it
+     (your repo's hook for codegen / env pull / db setup / etc.).
+  8. Scaffolds launch-recall (shadow git backup). Skip with --no-recall.
+  9. Scaffolds migrate-safety (pg_dump wrapper + GHA backup workflow +
+     runbook + .backups/ gitignore line). Skip with --no-migrate-safety.
+`);
+}
+async function prompt(question) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve2) => rl.question(question, (answer) => {
+    rl.close();
+    resolve2(answer.trim());
+  }));
+}
+function fail(msg) {
+  console.error(`[launch-kit] \u2717 ${msg}`);
+  process.exit(1);
+}
+function info(msg) {
+  console.log(`[launch-kit] ${msg}`);
+}
+function ok(msg) {
+  console.log(`[launch-kit] \u2713 ${msg}`);
+}
+function which(bin) {
+  const res = (0, import_node_child_process.spawnSync)(process.platform === "win32" ? "where" : "which", [bin], { encoding: "utf-8" });
+  if (res.status !== 0) return null;
+  return res.stdout.split(/\r?\n/)[0]?.trim() || null;
+}
+function preflight() {
+  const nodeMajor = parseInt(process.versions.node.split(".")[0], 10);
+  if (nodeMajor < 18) fail(`Node.js >= 18 required (current: ${process.versions.node}).`);
+  if (!which("git")) fail("git not found in PATH. Install git: https://git-scm.com/downloads");
+  const hasGh = which("gh") !== null;
+  ok(`preflight ok \u2014 node ${process.versions.node}, git present${hasGh ? ", gh present" : ", gh not found (will use git for clone)"}`);
+  return { hasGh };
+}
+function callProjectInfo(args) {
+  return new Promise((resolve2, reject) => {
+    const mcpUrl = new import_node_url.URL("/api/mcp/project", args.serverUrl);
+    const body = JSON.stringify({
+      jsonrpc: "2.0",
+      id: 1,
+      method: "tools/call",
+      params: {
+        name: "project_info",
+        arguments: { org_slug: args.orgSlug, project_slug: args.projectSlug }
+      }
+    });
+    const requester = mcpUrl.protocol === "https:" ? import_node_https.request : import_node_http.request;
+    const req = requester(
+      {
+        host: mcpUrl.hostname,
+        port: mcpUrl.port || (mcpUrl.protocol === "https:" ? 443 : 80),
+        path: mcpUrl.pathname,
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "Accept": "application/json, text/event-stream",
+          "Content-Length": String(Buffer.byteLength(body)),
+          "Authorization": `Bearer ${args.token}`,
+          "X-Org-Slug": args.orgSlug,
+          "X-Project-Slug": args.projectSlug
+        }
+      },
+      (res) => {
+        const chunks = [];
+        res.on("data", (c) => chunks.push(c));
+        res.on("end", () => {
+          const text = Buffer.concat(chunks).toString("utf-8");
+          if (res.statusCode === 401 || res.statusCode === 403) {
+            reject(new Error(`PAT rejected (${res.statusCode}). Check token + that it has access to ${args.orgSlug}/${args.projectSlug}.`));
+            return;
+          }
+          if (res.statusCode && res.statusCode >= 400) {
+            reject(new Error(`LaunchSecure responded ${res.statusCode}: ${text.slice(0, 300)}`));
+            return;
+          }
+          let json = text;
+          if (text.startsWith("event:") || text.includes("\ndata: ")) {
+            for (const line of text.split("\n")) {
+              if (line.startsWith("data: ")) {
+                json = line.slice(6);
+                break;
+              }
+            }
+          }
+          try {
+            const parsed = JSON.parse(json);
+            if (parsed.error) {
+              reject(new Error(`project_info error: ${parsed.error.message ?? "unknown"}`));
+              return;
+            }
+            const inner = parsed.result?.content?.[0]?.text;
+            if (!inner) {
+              reject(new Error("project_info returned no content"));
+              return;
+            }
+            if (inner.startsWith("\u2500\u2500 Error")) {
+              const firstLine = inner.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("\u2500\u2500"))[0];
+              reject(new Error(`project_info: ${firstLine ?? inner}`));
+              return;
+            }
+            const payload = JSON.parse(inner);
+            resolve2({
+              orgSlug: payload.org.slug,
+              projectSlug: payload.project.slug,
+              projectName: payload.project.name,
+              repositoryUrl: payload.project.repositoryUrl
+            });
+          } catch (err) {
+            reject(new Error(`Could not parse project_info response: ${err instanceof Error ? err.message : String(err)}`));
+          }
+        });
+      }
+    );
+    req.on("error", reject);
+    req.write(body);
+    req.end();
+  });
+}
+function gitRemoteUrl(dir) {
+  const res = (0, import_node_child_process.spawnSync)("git", ["-C", dir, "config", "--get", "remote.origin.url"], { encoding: "utf-8" });
+  if (res.status !== 0) return null;
+  return res.stdout.trim() || null;
+}
+function normalizeRepoUrl(url) {
+  let u = url.trim().replace(/\.git$/, "").replace(/\/+$/, "");
+  const sshMatch = u.match(/^git@([^:]+):(.+)$/);
+  if (sshMatch) u = `https://${sshMatch[1]}/${sshMatch[2]}`;
+  try {
+    const parsed = new import_node_url.URL(u);
+    return `${parsed.protocol}//${parsed.host.toLowerCase()}${parsed.pathname}`;
+  } catch {
+    return u;
+  }
+}
+function isGitRepo(dir) {
+  return fs.existsSync(path.join(dir, ".git"));
+}
+function dirIsEmpty(dir) {
+  if (!fs.existsSync(dir)) return true;
+  return fs.readdirSync(dir).length === 0;
+}
+function cloneRepo(repoUrl, targetDir, hasGh) {
+  const isGithub = /github\.com/i.test(repoUrl);
+  let cmd;
+  let args;
+  if (hasGh && isGithub) {
+    cmd = "gh";
+    args = ["repo", "clone", repoUrl, targetDir];
+    info(`cloning via gh: ${repoUrl} \u2192 ${targetDir}`);
+  } else {
+    cmd = "git";
+    args = ["clone", repoUrl, targetDir];
+    info(`cloning via git: ${repoUrl} \u2192 ${targetDir}`);
+  }
+  const res = (0, import_node_child_process.spawnSync)(cmd, args, { stdio: "inherit" });
+  if (res.status !== 0) {
+    fail(
+      `Clone failed (${cmd} exited ${res.status}). For private repos make sure your GitHub auth is set up: \`gh auth login\` or an SSH key on your GitHub account.`
+    );
+  }
+  ok(`cloned to ${targetDir}`);
+}
+function writeConfigFile(targetDir, cfg) {
+  migrateLegacyCredFile(targetDir);
+  const p = path.join(targetDir, CONFIG_FILENAME);
+  const existed = fs.existsSync(p);
+  fs.writeFileSync(p, JSON.stringify(cfg, null, 2) + "\n", "utf-8");
+  try {
+    fs.chmodSync(p, 384);
+  } catch {
+  }
+  ok(`${existed ? "updated" : "wrote"} ${CONFIG_FILENAME}`);
+}
+function migrateLegacyCredFile(targetDir) {
+  const legacy = path.join(targetDir, LEGACY_CONFIG_FILENAME);
+  const dest = path.join(targetDir, CONFIG_FILENAME);
+  if (!fs.existsSync(legacy) || fs.existsSync(dest)) return;
+  let parsed;
+  try {
+    parsed = JSON.parse(fs.readFileSync(legacy, "utf-8"));
+  } catch {
+    return;
+  }
+  const pat = parsed?.pat;
+  if (typeof pat !== "string" || !pat.startsWith("ls_pat_")) return;
+  fs.renameSync(legacy, dest);
+  removeGitignoreLine(targetDir, LEGACY_CONFIG_FILENAME);
+  ok(`migrated legacy ${LEGACY_CONFIG_FILENAME} \u2192 ${CONFIG_FILENAME} (the old name is now reserved for file-backed-config)`);
+}
+function removeGitignoreLine(targetDir, line) {
+  const p = path.join(targetDir, ".gitignore");
+  if (!fs.existsSync(p)) return;
+  const before = fs.readFileSync(p, "utf-8");
+  const after = before.split(/\r?\n/).filter((l) => l.trim() !== line).join("\n");
+  if (after === before) return;
+  fs.writeFileSync(p, after, "utf-8");
+  ok(`removed ${line} from .gitignore (now reserved for file-backed-config)`);
+}
+var LAUNCH_SECURE_HEADERS_HELPER = `node -e 'const j=JSON.parse(require("fs").readFileSync(".launch-secure.cred.config","utf-8"));process.stdout.write(JSON.stringify({Authorization:"Bearer "+j.pat,"X-Org-Slug":j.orgSlug,"X-Project-Slug":j.projectSlug}))'`;
+function buildLaunchKitMcpEntries(cfg) {
+  return {
+    "launch-secure": {
+      type: "http",
+      url: `${cfg.serverUrl}/api/mcp/project`,
+      headersHelper: LAUNCH_SECURE_HEADERS_HELPER
+    },
+    "launch-chart": {
+      command: "npx",
+      args: ["-y", "-p", LAUNCH_KIT_PKG, "launch-chart"],
+      env: { LAUNCH_CHART_AUTOSERVE: "1" }
+    },
+    "launch-deck": {
+      command: "npx",
+      args: ["-y", "-p", LAUNCH_KIT_PKG, "launch-deck"]
+    },
+    "launch-orbit": {
+      command: "npx",
+      args: ["-y", "-p", LAUNCH_KIT_PKG, "launch-orbit", "mcp"]
+    },
+    "launch-recall": {
+      command: "npx",
+      args: ["-y", "-p", LAUNCH_KIT_PKG, "launch-recall", "mcp"]
+    }
+  };
+}
+function mergeMcpFile(targetDir, launchKitEntries) {
+  const p = path.join(targetDir, ".mcp.json");
+  const hadExisting = fs.existsSync(p);
+  let existing = {};
+  if (hadExisting) {
+    try {
+      existing = JSON.parse(fs.readFileSync(p, "utf-8"));
+    } catch (err) {
+      fail(`Could not parse existing .mcp.json: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  const existingServerCount = Object.keys(existing.mcpServers ?? {}).length;
+  const merged = { ...existing, mcpServers: { ...existing.mcpServers ?? {} } };
+  for (const [name, entry] of Object.entries(launchKitEntries)) {
+    merged.mcpServers[name] = entry;
+  }
+  fs.writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+  const action = hadExisting && existingServerCount > 0 ? "merged into" : "wrote";
+  ok(`${action} .mcp.json (${Object.keys(launchKitEntries).length} launch-kit entries)`);
+}
+function detectPackageManager(repoDir) {
+  const pkgPath = path.join(repoDir, "package.json");
+  if (!fs.existsSync(pkgPath)) return null;
+  try {
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+    if (typeof pkg.packageManager === "string") {
+      const name = pkg.packageManager.split("@")[0];
+      const match = PACKAGE_MANAGERS.find((p) => p.name === name);
+      if (match) return { pm: match, source: `package.json packageManager (${pkg.packageManager})` };
+      info(`packageManager field "${pkg.packageManager}" is not recognized \u2014 falling back to lockfile detection`);
+    }
+  } catch {
+  }
+  const matches = PACKAGE_MANAGERS.map((pm) => ({ pm, lockfile: pm.lockfiles.find((lf) => fs.existsSync(path.join(repoDir, lf))) ?? null })).filter((m) => m.lockfile !== null);
+  if (matches.length === 1) {
+    return { pm: matches[0].pm, source: `lockfile ${matches[0].lockfile}` };
+  }
+  if (matches.length > 1) {
+    info(`multiple lockfiles found (${matches.map((m) => m.lockfile).join(", ")}) \u2014 picking ${matches[0].pm.name} by precedence`);
+    return { pm: matches[0].pm, source: `lockfile ${matches[0].lockfile} (multiple present)` };
+  }
+  for (const pm of PACKAGE_MANAGERS) {
+    if (pm.workspaceFiles?.some((wf) => fs.existsSync(path.join(repoDir, wf)))) {
+      return { pm, source: `workspace file (${pm.workspaceFiles.find((wf) => fs.existsSync(path.join(repoDir, wf)))})` };
+    }
+  }
+  const npm = PACKAGE_MANAGERS.find((p) => p.name === "npm");
+  return { pm: npm, source: "default (no signal found)" };
+}
+function runInstall(repoDir, detected) {
+  const { pm } = detected;
+  if (!which(pm.binary)) {
+    fail(
+      `${pm.name} not found on PATH. Configs and clone are intact. Install ${pm.name} (try \`corepack enable\` if you have Node \u226516), then run: cd ${path.basename(repoDir)} && ${pm.binary} ${pm.installArgs.join(" ")}`
+    );
+  }
+  info(`running ${pm.binary} ${pm.installArgs.join(" ")} \u2026`);
+  const res = (0, import_node_child_process.spawnSync)(pm.binary, pm.installArgs, { cwd: repoDir, stdio: "inherit" });
+  if (res.status !== 0) {
+    fail(
+      `${pm.name} install failed (exit ${res.status}). Configs and clone are intact \u2014 fix the underlying error and retry: cd ${path.basename(repoDir)} && ${pm.binary} ${pm.installArgs.join(" ")}`
+    );
+  }
+  ok(`${pm.name} install complete`);
+}
+function hasOnboardScript(repoDir) {
+  const pkgPath = path.join(repoDir, "package.json");
+  if (!fs.existsSync(pkgPath)) return false;
+  try {
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+    return typeof pkg.scripts?.[ONBOARD_SCRIPT_NAME] === "string";
+  } catch {
+    return false;
+  }
+}
+function runRecallInit(repoDir) {
+  info(`scaffolding launch-recall (shadow git backup) \u2026`);
+  const recallEntry = path.resolve(__dirname, "recall-entry.js");
+  const useSibling = fs.existsSync(recallEntry);
+  const cmd = useSibling ? process.execPath : "npx";
+  const args = useSibling ? [recallEntry, "init"] : ["-y", "-p", LAUNCH_KIT_PKG, "launch-recall", "init"];
+  const res = (0, import_node_child_process.spawnSync)(cmd, args, { cwd: repoDir, stdio: "inherit" });
+  if (res.status !== 0) {
+    info(`\u26A0 launch-recall init failed (exit ${res.status}). Main onboarding is complete \u2014 you can retry later: cd ${path.basename(repoDir)} && npx -y -p ${LAUNCH_KIT_PKG} launch-recall init`);
+    return;
+  }
+  ok(`launch-recall ready (shadow git initialized)`);
+}
+function runOnboard(repoDir, pm) {
+  info(`running ${pm.binary} run ${ONBOARD_SCRIPT_NAME} \u2026`);
+  const res = (0, import_node_child_process.spawnSync)(pm.binary, ["run", ONBOARD_SCRIPT_NAME], { cwd: repoDir, stdio: "inherit" });
+  if (res.status !== 0) {
+    fail(
+      `${pm.name} run ${ONBOARD_SCRIPT_NAME} failed (exit ${res.status}). Install completed but the onboard script errored. Fix and retry: cd ${path.basename(repoDir)} && ${pm.binary} run ${ONBOARD_SCRIPT_NAME}`
+    );
+  }
+  ok(`${ONBOARD_SCRIPT_NAME} script complete`);
+}
+function ensureGitignoreLine(targetDir, line) {
+  const p = path.join(targetDir, ".gitignore");
+  let content = fs.existsSync(p) ? fs.readFileSync(p, "utf-8") : "";
+  const lines = content.split(/\r?\n/);
+  if (lines.some((l) => l.trim() === line)) return;
+  if (content.length && !content.endsWith("\n")) content += "\n";
+  content += `${line}
+`;
+  fs.writeFileSync(p, content, "utf-8");
+  ok(`appended ${line} to .gitignore`);
+}
+function copyScaffoldIfMissing(srcPath, destPath, label) {
+  if (!fs.existsSync(srcPath)) return "missing-src";
+  if (fs.existsSync(destPath)) {
+    info(`${label} already present \u2014 leaving alone`);
+    return "existed";
+  }
+  fs.mkdirSync(path.dirname(destPath), { recursive: true });
+  fs.copyFileSync(srcPath, destPath);
+  try {
+    const srcMode = fs.statSync(srcPath).mode;
+    fs.chmodSync(destPath, srcMode);
+  } catch {
+  }
+  ok(`wrote ${label}`);
+  return "wrote";
+}
+function scaffoldMigrateSafety(targetDir) {
+  const scaffoldsRoot = path.resolve(__dirname, "..", "..", "scaffolds", "migrate-safety");
+  if (!fs.existsSync(scaffoldsRoot)) {
+    info(`\u26A0 migrate-safety scaffolds not found at ${scaffoldsRoot} \u2014 skipping (this is a packaging bug; main onboarding is unaffected)`);
+    return;
+  }
+  const files = [
+    {
+      src: path.join(scaffoldsRoot, ".github", "workflows", "backup-on-migration.yml"),
+      dest: path.join(targetDir, ".github", "workflows", "backup-on-migration.yml"),
+      label: ".github/workflows/backup-on-migration.yml"
+    },
+    {
+      src: path.join(scaffoldsRoot, "scripts", "migrate-with-backup.sh"),
+      dest: path.join(targetDir, "scripts", "migrate-with-backup.sh"),
+      label: "scripts/migrate-with-backup.sh"
+    },
+    {
+      src: path.join(scaffoldsRoot, "docs", "migrations-runbook.md"),
+      dest: path.join(targetDir, "docs", "migrations-runbook.md"),
+      label: "docs/migrations-runbook.md"
+    }
+  ];
+  info("scaffolding migrate-safety (pg_dump wrapper + GHA backup workflow + runbook) \u2026");
+  for (const f of files) copyScaffoldIfMissing(f.src, f.dest, f.label);
+  ensureGitignoreLine(targetDir, ".backups/");
+  ok("migrate-safety ready \u2014 see docs/migrations-runbook.md for db:migrate wiring + PROD_DATABASE_URL secret setup");
+}
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  if (args.help) {
+    printHelp();
+    return;
+  }
+  const subcommand = process.argv[2];
+  if (subcommand && subcommand !== "init" && !subcommand.startsWith("--")) {
+    fail(`Unknown subcommand "${subcommand}". Only "init" is supported. Run with --help for usage.`);
+  }
+  if (!args.token) {
+    const t = await prompt("LaunchSecure PAT (ls_pat_\u2026): ");
+    args.token = t || null;
+  }
+  if (!args.token) fail("--token (or LS_PAT env) is required.");
+  if (!/^ls_pat_/.test(args.token)) fail("Token does not look like a LaunchSecure PAT (expected prefix ls_pat_).");
+  if (!args.orgSlug) fail("--org=<orgSlug> is required.");
+  if (!args.projectSlug) fail("--project=<projectSlug> is required.");
+  const { hasGh } = preflight();
+  info(`resolving project ${args.orgSlug}/${args.projectSlug} on ${args.serverUrl} \u2026`);
+  let resolved;
+  try {
+    resolved = await callProjectInfo(args);
+  } catch (err) {
+    fail(err instanceof Error ? err.message : String(err));
+  }
+  ok(`resolved "${resolved.projectName}"`);
+  if (!resolved.repositoryUrl) {
+    fail(
+      `Project "${resolved.projectSlug}" has no GitHub repository configured. Connect GitHub at ${args.serverUrl}/${resolved.orgSlug}/projects/${resolved.projectSlug}/settings/integrations, then re-run init.`
+    );
+  }
+  const repoUrl = resolved.repositoryUrl;
+  const cwd = process.cwd();
+  const targetDir = path.resolve(args.targetDir ?? path.join(cwd, resolved.projectSlug));
+  const normalizedRemote = normalizeRepoUrl(repoUrl);
+  let skipClone = false;
+  if (fs.existsSync(targetDir)) {
+    if (isGitRepo(targetDir)) {
+      const existingRemote = gitRemoteUrl(targetDir);
+      if (existingRemote && normalizeRepoUrl(existingRemote) === normalizedRemote) {
+        ok(`${targetDir} is already a clone of ${repoUrl} \u2014 skipping clone, refreshing configs only`);
+        skipClone = true;
+      } else {
+        fail(`${targetDir} is a git repo but its remote (${existingRemote ?? "unknown"}) does not match ${repoUrl}. Refusing to overwrite. Pass --dir=<other-path>.`);
+      }
+    } else if (!dirIsEmpty(targetDir)) {
+      fail(`${targetDir} exists and is not empty (and not a matching git repo). Refusing to clone into it. Pass --dir=<other-path>.`);
+    }
+  }
+  if (!skipClone) cloneRepo(repoUrl, targetDir, hasGh);
+  const cfg = {
+    pat: args.token,
+    orgSlug: resolved.orgSlug,
+    projectSlug: resolved.projectSlug,
+    serverUrl: args.serverUrl
+  };
+  writeConfigFile(targetDir, cfg);
+  mergeMcpFile(targetDir, buildLaunchKitMcpEntries(cfg));
+  ensureGitignoreLine(targetDir, CONFIG_FILENAME);
+  let installSkippedReason = null;
+  const detected = detectPackageManager(targetDir);
+  if (detected) info(`detected package manager: ${detected.pm.name} (${detected.source})`);
+  if (args.noInstall) {
+    installSkippedReason = "--no-install passed";
+  } else if (!detected) {
+    installSkippedReason = "no package.json found";
+  } else {
+    runInstall(targetDir, detected);
+    if (hasOnboardScript(targetDir)) runOnboard(targetDir, detected.pm);
+  }
+  const hasOnboard = hasOnboardScript(targetDir);
+  if (!args.noRecall) runRecallInit(targetDir);
+  if (!args.noMigrateSafety) scaffoldMigrateSafety(targetDir);
+  const relTarget = path.relative(cwd, targetDir) || ".";
+  console.log("");
+  ok(`done \u2014 ${resolved.projectName} is ready at ${targetDir}`);
+  if (installSkippedReason) {
+    const installLine = detected ? `  ${detected.pm.binary} ${detected.pm.installArgs.join(" ")}` : `  npm install              # or your package manager of choice`;
+    const onboardLine = hasOnboard && detected ? `
+  ${detected.pm.binary} run ${ONBOARD_SCRIPT_NAME}      # project setup hook` : "";
+    console.log(`
+Next steps (install skipped: ${installSkippedReason}):
+  cd ${relTarget}
+${installLine}${onboardLine}
+  claude                   # launch Claude Code (5 MCPs wired)
+${LAUNCH_KIT_TOOLS_GUIDE}`);
+  } else {
+    console.log(`
+Next steps:
+  cd ${relTarget}
+  claude                   # launch Claude Code (5 MCPs wired)
+${LAUNCH_KIT_TOOLS_GUIDE}`);
+  }
+}
+main().catch((err) => {
+  console.error(`[launch-kit] unexpected error: ${err instanceof Error ? err.stack ?? err.message : String(err)}`);
+  process.exit(1);
+});