@nac3/forge-cli 0.2.0-alpha.4 → 0.2.0-alpha.59z.118

package/dist/deploy/aws_adapter.d.ts

@@ -0,0 +1,28 @@
+/**
+ * AWS ECS Fargate adapter.
+ *
+ * Thin DeployAdapter shell over the existing imperative
+ * `src/deploy/aws.ts` (planDeploy + applyDeploy). The original
+ * code stays the source of truth; this file gives it the
+ * DeployAdapter interface so the tier-aware picker can compare
+ * adapters apples-to-apples.
+ *
+ * Heavy / persistent / stateful workloads go here. Free tier
+ * does NOT cover Fargate -- expect ~$0.04/hour per task even at
+ * idle. Cost estimates below assume 1 task in always-on mode.
+ *
+ * ASCII-only.
+ */
+import type { DeployAdapter, DeployInput, DeployPlan, DeployResult, Tier } from './adapter.js';
+export declare class AwsEcsAdapter implements DeployAdapter {
+    readonly id: "aws";
+    readonly description: string;
+    tierFit(): Tier[];
+    readyToRun(): Promise<{
+        ok: boolean;
+        reason?: string;
+    }>;
+    plan(input: DeployInput): Promise<DeployPlan>;
+    apply(input: DeployInput): Promise<DeployResult>;
+}
+//# sourceMappingURL=aws_adapter.d.ts.map

package/dist/deploy/aws_adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws_adapter.d.ts","sourceRoot":"","sources":["../../src/deploy/aws_adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EACV,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAC3D,MAAM,cAAc,CAAC;AAEtB,qBAAa,aAAc,YAAW,aAAa;IACjD,QAAQ,CAAC,EAAE,EAAG,KAAK,CAAU;IAC7B,QAAQ,CAAC,WAAW,SAEqC;IAEzD,OAAO,IAAI,IAAI,EAAE;IAEX,UAAU,IAAI,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAgBvD,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAuB7C,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;CAqDvD"}

package/dist/deploy/aws_adapter.js

@@ -0,0 +1,98 @@
+export class AwsEcsAdapter {
+    id = 'aws';
+    description = 'AWS ECS Fargate -- always-on container, persistent state, custom networking. '
+        + 'For full-tier projects with workers / queues / DB.';
+    tierFit() { return ['medium', 'full']; }
+    async readyToRun() {
+        /* Delegate to the AWS SDK's credential chain -- importing
+         * the existing aws.ts function would trigger a heavy SDK
+         * load even for cheap "plan" calls. We do a light check via
+         * env vars + ~/.aws/credentials presence. */
+        const hasEnv = !!(process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY);
+        if (hasEnv)
+            return { ok: true };
+        /* Without env, fall back to checking ~/.aws/credentials. */
+        const fs = await import('node:fs');
+        const path = await import('node:path');
+        const os = await import('node:os');
+        const credPath = path.join(os.homedir(), '.aws', 'credentials');
+        try {
+            await fs.promises.access(credPath);
+            return { ok: true };
+        }
+        catch {
+            return { ok: false, reason: 'no AWS_ACCESS_KEY_ID env and no ~/.aws/credentials' };
+        }
+    }
+    async plan(input) {
+        return {
+            resources: [
+                'ECS cluster: ' + input.projectSlug + '-cluster',
+                'ECS service: ' + input.projectSlug + '-service (Fargate)',
+                'CloudWatch log group: /yujin/' + input.projectSlug,
+                'IAM role: ' + input.projectSlug + '-task-role',
+                ...(input.env ? ['Secrets: ' + Object.keys(input.env).join(', ')] : []),
+            ],
+            /* 1 Fargate task, 0.25 vCPU + 0.5GB RAM, on 24/7:
+             * ~$8.50/mo compute + ~$0.50 CloudWatch + ~$0.50 ECR =
+             * ~$10/mo. */
+            estimated_cost_usd: 10,
+            estimated_minutes: 10,
+            notes: [
+                'Fargate baseline ~$0.04/hour per always-on task.',
+                'Includes CloudWatch logs ($0.50/GB ingested) + ECR ($0.10/GB-month).',
+                'Custom domain + ACM cert + Route53 zone are NOT included; configure once via console.',
+                'First-time deploy provisions IAM + cluster + service (~10 min); subsequent deploys ~3 min rolling update.',
+            ],
+        };
+    }
+    async apply(input) {
+        /* alpha.23+: AwsEcsAdapter.apply() wires through to the
+         * existing aws.ts imperative path. Returns the unified
+         * DeployResult shape the DeployAdapter contract expects.
+         *
+         * The user MUST have `yujin.forge.json::deploys.aws`
+         * populated (region + cluster + service + image) -- we
+         * read it via readDeployConfig() + use input.projectSlug
+         * as the override for the service name if the config
+         * doesn't set one. */
+        const { resolveAwsCredentials, readDeployConfig, planDeploy, applyDeploy } = await import('./aws.js');
+        const creds = await resolveAwsCredentials();
+        if (!creds) {
+            throw new Error('AwsEcsAdapter.apply: aws_access_key_id / aws_secret_access_key '
+                + 'missing from vault. Run `yf vault set aws_access_key_id` and '
+                + '`yf vault set aws_secret_access_key`.');
+        }
+        /* Look up the canonical config from yujin.forge.json. The
+         * adapter contract does not carry region / cluster / image
+         * because those are AWS-specific. The project config is the
+         * source of truth. */
+        const cwd = process.cwd();
+        const config = await readDeployConfig(cwd);
+        if (!config) {
+            throw new Error('AwsEcsAdapter.apply: yujin.forge.json::deploys.aws missing. '
+                + 'Add: { "deploys": { "aws": { "region": "...", "cluster": "...", '
+                + '"service": "' + input.projectSlug + '", "image": "..." } } }');
+        }
+        const plan = planDeploy(config);
+        const t0 = Date.now();
+        const r = await applyDeploy(plan, creds);
+        const seconds = Math.round((Date.now() - t0) / 1000);
+        if (!r.ok) {
+            throw new Error('AwsEcsAdapter.apply failed: ' + r.message
+                + (r.detail ? ' -- ' + r.detail : ''));
+        }
+        /* AWS ECS does not expose a service URL directly. The
+         * canonical "where is my app" is the ALB DNS name -- not
+         * known here without a separate ELB lookup. Return a
+         * descriptive identifier so callers can show something
+         * useful + look up the real URL in the dashboard. */
+        return {
+            url: 'arn://' + (r.task_definition_arn ?? plan.config.service),
+            deployed_at: new Date().toISOString(),
+            build_seconds: seconds,
+            logs_tail: [r.message],
+        };
+    }
+}
+//# sourceMappingURL=aws_adapter.js.map

package/dist/deploy/aws_adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws_adapter.js","sourceRoot":"","sources":["../../src/deploy/aws_adapter.ts"],"names":[],"mappings":"AAmBA,MAAM,OAAO,aAAa;IACf,EAAE,GAAG,KAAc,CAAC;IACpB,WAAW,GAClB,+EAA+E;UAC7E,oDAAoD,CAAC;IAEzD,OAAO,KAAa,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAEhD,KAAK,CAAC,UAAU;QACd;;;qDAG6C;QAC7C,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACtF,IAAI,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAChC,4DAA4D;QAC5D,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;QAChE,IAAI,CAAC;YAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAAC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAAC,CAAC;QAChE,MAAM,CAAC;YAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAC;QAAC,CAAC;IAC/F,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAkB;QAC3B,OAAO;YACL,SAAS,EAAE;gBACT,eAAe,GAAG,KAAK,CAAC,WAAW,GAAG,UAAU;gBAChD,eAAe,GAAG,KAAK,CAAC,WAAW,GAAG,oBAAoB;gBAC1D,+BAA+B,GAAG,KAAK,CAAC,WAAW;gBACnD,YAAY,GAAG,KAAK,CAAC,WAAW,GAAG,YAAY;gBAC/C,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE;YACD;;0BAEc;YACd,kBAAkB,EAAE,EAAE;YACtB,iBAAiB,EAAG,EAAE;YACtB,KAAK,EAAE;gBACL,kDAAkD;gBAClD,sEAAsE;gBACtE,uFAAuF;gBACvF,2GAA2G;aAC5G;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAkB;QAC5B;;;;;;;;8BAQsB;QACtB,MAAM,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,GACxE,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,iEAAiE;kBAC/D,+DAA+D;kBAC/D,uCAAuC,CAC1C,CAAC;QACJ,CAAC;QACD;;;8BAGsB;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,8DAA8D;kBAC5D,kEAAkE;kBAClE,cAAc,GAAG,KAAK,CAAC,WAAW,GAAG,yBAAyB,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,CAAC,CAAC,OAAO;kBACtD,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD;;;;6DAIqD;QACrD,OAAO;YACL,GAAG,EAAY,QAAQ,GAAG,CAAC,CAAC,CAAC,mBAAmB,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YACxE,WAAW,EAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACvC,aAAa,EAAE,OAAO;YACtB,SAAS,EAAM,CAAC,CAAC,CAAC,OAAO,CAAC;SAC3B,CAAC;IACJ,CAAC;CACF"}

package/dist/deploy/cloudflare.d.ts

@@ -0,0 +1,24 @@
+import type { DeployAdapter, DeployInput, DeployPlan, DeployResult, Tier } from './adapter.js';
+export interface CloudflareAdapterOptions {
+    /** Override the wrangler binary path (defaults to "wrangler"). */
+    wranglerBin?: string;
+    /** Override the wrangler config dir (for tests). */
+    configDir?: string;
+}
+export declare class CloudflareAdapter implements DeployAdapter {
+    private opts;
+    readonly id: "cloudflare";
+    readonly description: string;
+    constructor(opts?: CloudflareAdapterOptions);
+    tierFit(): Tier[];
+    readyToRun(): Promise<{
+        ok: boolean;
+        reason?: string;
+    }>;
+    plan(input: DeployInput): Promise<DeployPlan>;
+    apply(input: DeployInput): Promise<DeployResult>;
+    private runWrangler;
+    private dirExists;
+    private countFiles;
+}
+//# sourceMappingURL=cloudflare.d.ts.map

package/dist/deploy/cloudflare.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../src/deploy/cloudflare.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAE/F,MAAM,WAAW,wBAAwB;IACvC,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,SAAS,CAAC,EAAI,MAAM,CAAC;CACtB;AAED,qBAAa,iBAAkB,YAAW,aAAa;IAMzC,OAAO,CAAC,IAAI;IALxB,QAAQ,CAAC,EAAE,EAAG,YAAY,CAAU;IACpC,QAAQ,CAAC,WAAW,SAE8C;gBAE9C,IAAI,GAAE,wBAA6B;IAEvD,OAAO,IAAI,IAAI,EAAE;IAEX,UAAU,IAAI,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA8BvD,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IA2B7C,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;YA2BxC,WAAW;YAiBX,SAAS;YAOT,UAAU;CAezB"}

package/dist/deploy/cloudflare.js

@@ -0,0 +1,169 @@
+/**
+ * Cloudflare Pages adapter (default for Simple + Medium projects).
+ *
+ * Implementation strategy: shell out to `wrangler pages deploy`.
+ * Wrangler handles authentication (oauth token at
+ * ~/.config/.wrangler/config/default.toml) + the project upload.
+ * We invoke + parse its output.
+ *
+ * Why Cloudflare for default:
+ *   - Free tier covers 5M req/day -- 12+ months runway for new
+ *     projects.
+ *   - 20-40s typical deploy time.
+ *   - Edge-deployed across 250+ POPs by default; no CDN setup.
+ *   - DNS + ACM cert auto-managed under *.pages.dev.
+ *   - Pablo's account is already wrangler-authed.
+ *
+ * What this adapter does NOT do today:
+ *   - Custom domains (requires zone owned by the user's CF account).
+ *   - Server-side workers (would need a separate `wrangler deploy`
+ *     for the Worker bundle; the Pages adapter is static-only).
+ *   - Environment variable updates (the user has to set those
+ *     manually for now via the CF dashboard or `wrangler pages
+ *     project create --variable`).
+ *
+ * ASCII-only.
+ */
+import { spawn } from 'node:child_process';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+export class CloudflareAdapter {
+    opts;
+    id = 'cloudflare';
+    description = 'Cloudflare Pages + Workers -- free tier, edge-deployed, 20-40s deploys. '
+        + 'Best for simple + medium projects without persistent state.';
+    constructor(opts = {}) {
+        this.opts = opts;
+    }
+    tierFit() { return ['simple', 'medium']; }
+    async readyToRun() {
+        const wranglerBin = this.opts.wranglerBin ?? 'wrangler';
+        /* Check that wrangler is on PATH + has an OAuth/API token
+         * available. We rely on `wrangler whoami` to do this for us
+         * -- exit code 0 means authed. */
+        return new Promise((resolve) => {
+            let stdout = '';
+            let stderr = '';
+            const ps = spawn(wranglerBin, ['whoami'], { shell: true });
+            ps.stdout.on('data', (d) => { stdout += d.toString(); });
+            ps.stderr.on('data', (d) => { stderr += d.toString(); });
+            ps.on('error', (err) => {
+                resolve({ ok: false, reason: 'wrangler not runnable: ' + err.message });
+            });
+            ps.on('close', (code) => {
+                if (code !== 0) {
+                    resolve({
+                        ok: false,
+                        reason: 'wrangler whoami exit ' + code + '. Run `wrangler login` first. stderr: '
+                            + stderr.slice(0, 200),
+                    });
+                }
+                else if (/not authenticated|no.*token/i.test(stdout)) {
+                    resolve({ ok: false, reason: 'wrangler not authenticated. Run `wrangler login`.' });
+                }
+                else {
+                    resolve({ ok: true });
+                }
+            });
+        });
+    }
+    async plan(input) {
+        const exists = await this.dirExists(input.buildDir);
+        if (!exists) {
+            throw new Error('cloudflare.plan: buildDir does not exist: ' + input.buildDir);
+        }
+        const fileCount = await this.countFiles(input.buildDir);
+        return {
+            resources: [
+                'Cloudflare Pages project: ' + input.projectSlug,
+                'Static assets: ' + fileCount + ' files',
+                'Edge-deployed at ' + input.projectSlug + '.pages.dev',
+                ...(input.env && Object.keys(input.env).length > 0
+                    ? ['Env vars (set separately via wrangler pages project create): ' + Object.keys(input.env).join(', ')]
+                    : []),
+            ],
+            /* Free tier covers 500 builds/month + 5M req/day. New
+             * projects expect $0/mo for ~12+ months. */
+            estimated_cost_usd: 0,
+            estimated_minutes: Math.max(1, Math.ceil(fileCount / 200)),
+            notes: [
+                'Cloudflare Pages free tier covers 500 builds/month + 5M requests/day.',
+                'Above the free tier, Pages overage = $5/1M requests; build minutes overage = $0.005/min.',
+                'Workers (if added) free 100k req/day; $0.30 per million above.',
+            ],
+        };
+    }
+    async apply(input) {
+        const exists = await this.dirExists(input.buildDir);
+        if (!exists) {
+            throw new Error('cloudflare.apply: buildDir does not exist: ' + input.buildDir);
+        }
+        const wranglerBin = this.opts.wranglerBin ?? 'wrangler';
+        const args = ['pages', 'deploy', input.buildDir,
+            '--project-name', input.projectSlug,
+            '--branch', 'main'];
+        const t0 = Date.now();
+        const out = await this.runWrangler(wranglerBin, args);
+        const seconds = Math.round((Date.now() - t0) / 1000);
+        /* Parse the URL out of wrangler's output. */
+        const urlMatch = out.combined.match(/https:\/\/[a-z0-9-]+\.[a-z0-9-]+\.pages\.dev/i);
+        if (!urlMatch) {
+            throw new Error('cloudflare.apply: could not parse deploy URL from wrangler output. '
+                + 'Tail: ' + out.combined.slice(-500));
+        }
+        return {
+            url: urlMatch[0],
+            deployed_at: new Date().toISOString(),
+            build_seconds: seconds,
+            logs_tail: out.combined.split('\n').slice(-20),
+        };
+    }
+    async runWrangler(bin, args) {
+        return new Promise((resolve, reject) => {
+            let combined = '';
+            const ps = spawn(bin, args, { shell: true });
+            ps.stdout.on('data', (d) => { combined += d.toString(); });
+            ps.stderr.on('data', (d) => { combined += d.toString(); });
+            ps.on('error', (err) => reject(new Error('wrangler spawn failed: ' + err.message)));
+            ps.on('close', (code) => {
+                if (code !== 0) {
+                    reject(new Error('wrangler exit ' + code + '. Tail: ' + combined.slice(-500)));
+                    return;
+                }
+                resolve({ exit: code ?? 0, combined });
+            });
+        });
+    }
+    async dirExists(p) {
+        try {
+            const st = await fs.stat(p);
+            return st.isDirectory();
+        }
+        catch {
+            return false;
+        }
+    }
+    async countFiles(p) {
+        let count = 0;
+        const walk = async (dir) => {
+            let entries;
+            try {
+                entries = await fs.readdir(dir, { withFileTypes: true });
+            }
+            catch {
+                return;
+            }
+            for (const e of entries) {
+                if (e.name === 'node_modules' || e.name.startsWith('.'))
+                    continue;
+                if (e.isDirectory())
+                    await walk(path.join(dir, e.name));
+                else if (e.isFile())
+                    count++;
+            }
+        };
+        await walk(p);
+        return count;
+    }
+}
+//# sourceMappingURL=cloudflare.js.map

package/dist/deploy/cloudflare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare.js","sourceRoot":"","sources":["../../src/deploy/cloudflare.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAU7B,MAAM,OAAO,iBAAiB;IAMR;IALX,EAAE,GAAG,YAAqB,CAAC;IAC3B,WAAW,GAClB,0EAA0E;UACxE,6DAA6D,CAAC;IAElE,YAAoB,OAAiC,EAAE;QAAnC,SAAI,GAAJ,IAAI,CAA+B;IAAG,CAAC;IAE3D,OAAO,KAAa,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAElD,KAAK,CAAC,UAAU;QACd,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,UAAU,CAAC;QACxD;;0CAEkC;QAClC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACrB,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1E,CAAC,CAAC,CAAC;YACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACtB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBACf,OAAO,CAAC;wBACN,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,uBAAuB,GAAG,IAAI,GAAG,wCAAwC;8BAC7E,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;qBACzB,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBACvD,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mDAAmD,EAAE,CAAC,CAAC;gBACtF,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAkB;QAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,4CAA4C,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxD,OAAO;YACL,SAAS,EAAE;gBACT,4BAA4B,GAAG,KAAK,CAAC,WAAW;gBAChD,iBAAiB,GAAG,SAAS,GAAG,QAAQ;gBACxC,mBAAmB,GAAG,KAAK,CAAC,WAAW,GAAG,YAAY;gBACtD,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;oBAChD,CAAC,CAAC,CAAC,+DAA+D,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACvG,CAAC,CAAC,EAAE,CAAC;aACR;YACD;wDAC4C;YAC5C,kBAAkB,EAAE,CAAC;YACrB,iBAAiB,EAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;YAC3D,KAAK,EAAE;gBACL,uEAAuE;gBACvE,0FAA0F;gBAC1F,gEAAgE;aACjE;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAkB;QAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,6CAA6C,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,UAAU,CAAC;QACxD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACjC,gBAAgB,EAAE,KAAK,CAAC,WAAW;YACnC,UAAU,EAAE,MAAM,CAAC,CAAC;QAClC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAErD,6CAA6C;QAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACrF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,qEAAqE;kBACjF,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO;YACL,GAAG,EAAY,QAAQ,CAAC,CAAC,CAAC;YAC1B,WAAW,EAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACvC,aAAa,EAAE,OAAO;YACtB,SAAS,EAAM,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;SACnD,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,IAAc;QACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7C,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACpF,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACtB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,GAAG,IAAI,GAAG,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBAC/E,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,CAAS;QAC/B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5B,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,CAAS;QAChC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,IAAI,GAAG,KAAK,EAAE,GAAW,EAAiB,EAAE;YAChD,IAAI,OAAmC,CAAC;YACxC,IAAI,CAAC;gBAAC,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YACjE,MAAM,CAAC;gBAAC,OAAO;YAAC,CAAC;YACjB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAClE,IAAI,CAAC,CAAC,WAAW,EAAE;oBAAE,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;qBACnD,IAAI,CAAC,CAAC,MAAM,EAAE;oBAAE,KAAK,EAAE,CAAC;YAC/B,CAAC;QACH,CAAC,CAAC;QACF,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/docs/LIMITED_RESPONSIBILITY.md

@@ -0,0 +1,216 @@
+# Yujin Forge -- Limitation of Liability
+
+Effective date: 2026-06-04
+
+This document describes the limits of Yujin's responsibility
+when you use `@nac3/forge-cli` ("Forge") or any service it
+connects to (`prompts.yujin.app`, the managed brain, the
+license server). It complements `docs/PRIVACY_POLICY.md` and
+sits inside the product itself under **Config -> About**.
+
+By installing or using Forge, you agree to this limitation.
+If you do not agree, do not install, and contact
+contact@yujin.app to request removal of any account /
+license records.
+
+## 1. Forge is provided "AS IS"
+
+Forge is a development tool. It is provided as-is, without
+warranty of any kind, express or implied, including but not
+limited to:
+
+- merchantability,
+- fitness for a particular purpose,
+- non-infringement,
+- accuracy of generated output,
+- compatibility with your specific stack, OS, or workflow.
+
+This applies to every part of the product: the CLI, the
+chat panel, voice features, MCP bridges, the agent
+orchestrator, the managed flows (`spec-extract`,
+`spec-plan`, `ai-decorate`), and any default content shipped
+in the installer.
+
+## 2. You are responsible for your data
+
+Forge runs on your machine and edits files in your project
+root. You are responsible for:
+
+- maintaining backups of any code, specs, or documents you
+  feed into Forge.
+- reviewing every change Forge proposes before applying it
+  (the approval modal exists for this; do not bypass it for
+  destructive operations).
+- verifying the correctness, security, and licensing of any
+  code Forge generates, decorates, or migrates.
+- complying with the terms of any third-party libraries,
+  models, or APIs you connect through Forge (your Anthropic
+  / OpenAI / Gemini key, your GitHub PAT, your MCP bridges,
+  etc).
+
+Yujin does not store your project files. We do not have
+copies to restore from if you lose data due to a Forge
+action, a hardware failure, an OS crash, or a mistake of
+your own.
+
+## 3. No liability for indirect or consequential damages
+
+To the maximum extent permitted by law, Yujin (and its
+founder, employees, contractors, affiliates) is not liable
+for any:
+
+- indirect damages,
+- incidental damages,
+- consequential damages,
+- punitive damages,
+- loss of profit, revenue, business, data, or goodwill,
+- cost of substitute services,
+
+arising out of or in any way connected with your use of
+Forge, even if Yujin has been advised of the possibility
+of such damages.
+
+If applicable law restricts the above exclusion, Yujin's
+total cumulative liability for all claims arising under or
+related to Forge is limited to the lesser of:
+
+- the amount you paid Yujin for Forge subscriptions during
+  the 12 months immediately preceding the claim, OR
+- USD 100.
+
+This cap applies regardless of the legal theory of the
+claim (contract, tort, statute, or otherwise).
+
+## 4. Third-party services
+
+Forge connects to third-party services that have their own
+terms:
+
+| Service | When used | Their terms |
+|---|---|---|
+| Anthropic Claude | BYOK chat + 3 managed flows | https://www.anthropic.com/legal |
+| OpenAI (optional) | BYOK chat tier | https://openai.com/policies |
+| Google Gemini (optional) | BYOK chat tier | https://policies.google.com |
+| GitHub | `yf agent` GitHub verbs | https://docs.github.com/site-policy |
+| Polar | License + subscription | https://polar.sh/legal |
+| MCP bridges | User-installed | Per-bridge license |
+
+Yujin is not responsible for outages, changes, or actions
+of these third parties. Yujin does not guarantee continued
+availability of any third-party integration.
+
+## 5. Right to modify or discontinue
+
+Yujin may, at any time and without prior notice:
+
+- modify Forge features (CLI commands, verbs, panel
+  surfaces, prompts on the managed server),
+- modify pricing or subscription terms (existing
+  subscriptions honor their billing period; renewals
+  reflect new pricing),
+- discontinue specific managed flows (with a 30-day
+  deprecation notice posted via the panel banner and a
+  commit in this repo),
+- discontinue Forge entirely (with 90-day notice and a
+  one-time export of your local data via `yf export
+  --all`).
+
+Material breaking changes ship under a clear "BREAKING"
+tag in git commit messages and a banner in `yf chat`.
+
+## 6. Generated content disclaimer
+
+Forge uses LLMs (Claude, OpenAI, Gemini) to generate code,
+explanations, spec extractions, decorations, and chat
+replies. These outputs are:
+
+- not guaranteed to be correct,
+- not guaranteed to be secure,
+- not guaranteed to be free of bugs,
+- not guaranteed to compile, lint, or pass tests,
+- not legal advice, financial advice, or medical advice,
+- not a substitute for human review.
+
+You must review every generated output before adopting it.
+LLMs can:
+
+- hallucinate facts that look plausible,
+- invent APIs that do not exist,
+- produce code that compiles but does the wrong thing,
+- echo training-data licensing concerns into your project.
+
+Yujin is not liable for output you accept without review.
+
+## 7. License key + subscription
+
+Your license key controls access to the managed flows. If
+your subscription lapses:
+
+- BYOK chat keeps working.
+- The 3 managed flows return 402 (Payment Required) until
+  the subscription resumes.
+- Local agents keep running with BYOK; managed agents
+  pause.
+
+We do not retroactively bill for usage during a lapse, and
+we do not delete your license key on lapse -- it goes
+inactive, and the same key works when you resume the
+subscription.
+
+## 8. Indemnification
+
+You agree to indemnify and hold Yujin harmless from any
+claim brought by a third party (including but not limited
+to your end-users) arising out of:
+
+- your use of Forge,
+- your distribution of products built using Forge,
+- any code, content, or data you fed into Forge,
+- your breach of this limitation of liability or the
+  privacy policy.
+
+This means: if your customer sues you over something they
+got from a product you built with Forge, that is between
+you and your customer; Yujin is not on the hook.
+
+## 9. Governing law + dispute resolution
+
+This limitation of liability is governed by the laws of
+the Argentine Republic. Disputes that cannot be resolved by
+direct contact at contact@yujin.app are subject to the
+exclusive jurisdiction of the courts of the City of Buenos
+Aires.
+
+If your local consumer-protection law grants you stronger
+rights than this document, those local rights apply
+(this clause does not override them).
+
+## 10. Changes to this document
+
+Material changes ship with at least 30 days notice via:
+
+- A banner in `yf chat` panel.
+- An email to the address on file with your license.
+- A git commit to `docs/LIMITED_RESPONSIBILITY.md` with a
+  `BREAKING:` tag in the message.
+
+Continued use after a material change constitutes
+acceptance. If you do not accept, contact
+contact@yujin.app within the notice period for refund of
+the unused portion of your subscription.
+
+Cosmetic edits (typos, clarifications) ship silently with
+their git commits.
+
+## 11. Contact
+
+All requests go to **contact@yujin.app**.
+
+For legal or compliance inquiries, use subject prefix
+`[LEGAL]`.
+
+---
+
+This document is the source of truth. The version available
+inside Forge (`Config -> About -> Limitation of liability`)
+is a mirror of this markdown, refreshed on every commit.