@purix/cli 0.1.0

package/dist/cli/commands/security.js

@@ -0,0 +1,27 @@
+import { setSecret, deleteSecret, listSecretStatus } from "@purix/core/security/secrets_manager";
+export function registerSecurityCommands(program) {
+    // ---------------------------------------------------------------------------
+    // Secrets Manager
+    // ---------------------------------------------------------------------------
+    program.command("secret-set <n> <value>").description("Store a credential, encrypted at rest").action((name, value) => {
+        setSecret(name, value);
+        console.log(`✅ Stored "${name}" encrypted. Remove it from any .env once you've confirmed this works.`);
+    });
+    program.command("secret-rotate <n> <newValue>").description("Rotate a stored credential").action((name, newValue) => {
+        setSecret(name, newValue);
+        console.log(`✅ Rotated "${name}".`);
+    });
+    program.command("secret-remove <n>").description("Delete a stored credential").action((name) => {
+        console.log(deleteSecret(name) ? `✅ Removed "${name}".` : `No secret stored as "${name}".`);
+    });
+    program.command("secrets-status").description("Show credential age / rotation status").action(() => {
+        const statuses = listSecretStatus();
+        if (statuses.length === 0) {
+            console.log("No secrets stored yet.");
+            return;
+        }
+        for (const s of statuses)
+            console.log(`${s.name}  set ${s.ageDays}d ago${s.rotationDue ? "  ⚠ ROTATION DUE" : ""}  (rotated ${s.rotationCount}x before)`);
+    });
+}
+//# sourceMappingURL=security.js.map

package/dist/cli/commands/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/cli/commands/security.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAEjG,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAC9E,OAAO,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,WAAW,CAAC,uCAAuC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE;QACpI,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,wEAAwE,CAAC,CAAC;IACzG,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC,IAAY,EAAE,QAAgB,EAAE,EAAE;QAClI,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;QACrG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,wBAAwB,IAAI,IAAI,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,WAAW,CAAC,uCAAuC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE;QACjG,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;QACpC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC7E,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,aAAa,WAAW,CAAC,CAAC;IAC5J,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/commands/tier.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from "commander";
+export declare function registerTierCommands(program: Command): void;
+//# sourceMappingURL=tier.d.ts.map

package/dist/cli/commands/tier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tier.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/tier.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,QAuBpD"}

package/dist/cli/commands/tier.js

@@ -0,0 +1,27 @@
+import { getEntitlements, refreshEntitlements } from "@purix/core/licensing/tier";
+export function registerTierCommands(program) {
+    program
+        .command("tier-status")
+        .description("Show current tier and what it unlocks (refreshes from the server if logged in)")
+        .action(async () => {
+        try {
+            await refreshEntitlements();
+        }
+        catch (err) {
+            // A real rejection (e.g. an expired/invalid session) still falls
+            // through to printing whatever's cached below, rather than
+            // aborting the whole command — tier-status should always show
+            // *something*, even a stale answer with a warning.
+            console.warn(`  (couldn't refresh from the server: ${err instanceof Error ? err.message : err})`);
+        }
+        const ent = getEntitlements();
+        console.log(`Tier: ${ent.tier}`);
+        console.log(`  Tracked components:     ${ent.componentLimit === null ? "unlimited" : ent.componentLimit}`);
+        console.log(`  Audit export:           ${ent.auditExport ? "✅" : "❌"}`);
+        console.log(`  Webhooks:               ${ent.webhooks ? "✅" : "❌"}`);
+        if (ent.tier === "free") {
+            console.log(`\nRun "purix login" to upgrade.`);
+        }
+    });
+}
+//# sourceMappingURL=tier.js.map

package/dist/cli/commands/tier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tier.js","sourceRoot":"","sources":["../../../src/cli/commands/tier.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAElF,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,gFAAgF,CAAC;SAC7F,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,mBAAmB,EAAE,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,iEAAiE;YACjE,2DAA2D;YAC3D,8DAA8D;YAC9D,mDAAmD;YACnD,OAAO,CAAC,IAAI,CAAC,wCAAwC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,6BAA6B,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;QAC3G,OAAO,CAAC,GAAG,CAAC,6BAA6B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,6BAA6B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACrE,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/commands/tools.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from "commander";
+export declare function registerToolsCommands(program: Command): void;
+//# sourceMappingURL=tools.d.ts.map

package/dist/cli/commands/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/tools.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGzC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,QAcrD"}

package/dist/cli/commands/tools.js

@@ -0,0 +1,18 @@
+import { suggestTools, formatSuggestions } from "@purix/core/tools/matchmaker";
+export function registerToolsCommands(program) {
+    program
+        .command("tools <purpose>")
+        .description("Tool Matchmaker: suggest vetted npm packages for a purpose (advisory only, never installs)")
+        .action(async (purpose) => {
+        try {
+            console.log(`Searching npm for vetted packages: "${purpose}"...`);
+            const suggestions = await suggestTools(purpose);
+            console.log(formatSuggestions(suggestions));
+        }
+        catch (err) {
+            console.error(`\n🛑 Tool search failed: ${err instanceof Error ? err.message : err}`);
+            process.exitCode = 1;
+        }
+    });
+}
+//# sourceMappingURL=tools.js.map

package/dist/cli/commands/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../../src/cli/commands/tools.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAE/E,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,OAAO;SACJ,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CAAC,4FAA4F,CAAC;SACzG,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,EAAE;QAChC,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,uCAAuC,OAAO,MAAM,CAAC,CAAC;YAClE,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YACtF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/output.d.ts

@@ -0,0 +1,5 @@
+/** Called once from cli.ts's preAction hook after Commander parses argv. */
+export declare function setQuiet(value: boolean): void;
+/** Checked by lifecycle.ts and any other command's narrative console.log calls. */
+export declare function isQuiet(): boolean;
+//# sourceMappingURL=output.d.ts.map

package/dist/cli/output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/cli/output.ts"],"names":[],"mappings":"AAcA,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAE7C;AAED,mFAAmF;AACnF,wBAAgB,OAAO,IAAI,OAAO,CAEjC"}

package/dist/cli/output.js

@@ -0,0 +1,22 @@
+// packages/cli/src/cli/output.ts
+//
+// Part 2: "read it once in that same [preAction] hook and store it
+// somewhere the output layer can check (a module-level flag or a small
+// context object), rather than checking program.opts() inside every
+// individual command." This is that module-level flag.
+//
+// Two ways quiet can be turned on, checked in this priority order:
+//   1. PURIX_QUIET=1 in the environment — checked first so it's never
+//      silently overridden by option-parsing order.
+//   2. -q/--quiet on the command line, read once in cli.ts's preAction
+//      hook via setQuiet().
+let quiet = process.env.PURIX_QUIET === "1";
+/** Called once from cli.ts's preAction hook after Commander parses argv. */
+export function setQuiet(value) {
+    quiet = quiet || value;
+}
+/** Checked by lifecycle.ts and any other command's narrative console.log calls. */
+export function isQuiet() {
+    return quiet;
+}
+//# sourceMappingURL=output.js.map

package/dist/cli/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/cli/output.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,EAAE;AACF,mEAAmE;AACnE,uEAAuE;AACvE,oEAAoE;AACpE,uDAAuD;AACvD,EAAE;AACF,mEAAmE;AACnE,sEAAsE;AACtE,oDAAoD;AACpD,uEAAuE;AACvE,4BAA4B;AAC5B,IAAI,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC;AAE5C,4EAA4E;AAC5E,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,KAAK,GAAG,KAAK,IAAI,KAAK,CAAC;AACzB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,OAAO;IACrB,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/cli/savings_output.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Captures the all-time savings total/count BEFORE a command's action
+ * runs. Diffing against the total AFTER is how "Savings This Run" is
+ * derived — there's no other reliable way to scope a query to "just this
+ * process's LLM calls" against a shared, cumulative SQLite ledger.
+ */
+export declare function snapshotSavings(): import("@purix/core/llm/budget").SavingsSummary;
+export declare function printRunSummary(before: ReturnType<typeof snapshotSavings>): void;
+//# sourceMappingURL=savings_output.d.ts.map

package/dist/cli/savings_output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"savings_output.d.ts","sourceRoot":"","sources":["../../src/cli/savings_output.ts"],"names":[],"mappings":"AAeA;;;;;GAKG;AACH,wBAAgB,eAAe,oDAE9B;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,GAAG,IAAI,CAyBhF"}

package/dist/cli/savings_output.js

@@ -0,0 +1,62 @@
+// packages/cli/src/cli/savings_output.ts
+//
+// Part 2: the "Savings This Run" / "Total Savings This Week" terminal
+// output and the milestone-upsell line. Shared by lifecycle.ts's command
+// actions (create, modify) rather than duplicated in each — both are
+// where an intent_refinement/escalation call could actually happen.
+import { getSavingsSummary } from "@purix/core/llm/budget";
+import { config } from "@purix/core/state/config";
+import { isLoggedIn } from "@purix/core/security/session";
+import { isQuiet } from "./output.js";
+const DEFAULT_MILESTONE_THRESHOLD_USD = 50;
+const MILESTONE_LAST_SHOWN_KEY = "milestone-upsell-last-shown";
+const MILESTONE_THRESHOLD_KEY = "milestone-threshold";
+/**
+ * Captures the all-time savings total/count BEFORE a command's action
+ * runs. Diffing against the total AFTER is how "Savings This Run" is
+ * derived — there's no other reliable way to scope a query to "just this
+ * process's LLM calls" against a shared, cumulative SQLite ledger.
+ */
+export function snapshotSavings() {
+    return getSavingsSummary(3650); // ~10 years ≈ "all time" for this project
+}
+export function printRunSummary(before) {
+    if (isQuiet() || config.get("show-savings") === "off")
+        return;
+    const after = getSavingsSummary(3650);
+    const thisRunDelta = after.totalSavingsUsd - before.totalSavingsUsd;
+    const thisRunCalls = after.callCount - before.callCount;
+    const weekly = getSavingsSummary(7);
+    // Per Part 2: on a run with no high-tier-eligible calls, omit the
+    // "Savings This Run" line entirely rather than printing a misleading
+    // $0.00 — a run that never touched intent_refinement/escalation, or
+    // touched them without a genuine downgrade, has nothing to report.
+    const lines = [];
+    if (thisRunCalls > 0) {
+        lines.push(`Savings This Run: $${thisRunDelta.toFixed(2)}`);
+    }
+    if (weekly.callCount > 0) {
+        lines.push(`Total Savings This Week: $${weekly.totalSavingsUsd.toFixed(2)}`);
+    }
+    if (lines.length === 0)
+        return; // nothing genuine to show at all
+    console.log(`\nPurix Verification Complete ✅`);
+    for (const line of lines)
+        console.log(line);
+    maybePrintMilestoneUpsell();
+}
+function maybePrintMilestoneUpsell() {
+    if (isLoggedIn())
+        return; // suppressed permanently once logged in
+    const threshold = Number(config.get(MILESTONE_THRESHOLD_KEY) ?? DEFAULT_MILESTONE_THRESHOLD_USD);
+    const allTime = getSavingsSummary(3650);
+    if (allTime.totalSavingsUsd < threshold)
+        return;
+    const lastShown = config.get(MILESTONE_LAST_SHOWN_KEY);
+    const today = new Date().toISOString().slice(0, 10); // YYYY-MM-DD
+    if (lastShown === today)
+        return; // rate-limited to once per day
+    console.log(`\nWant this data saved? Run \`purix login\` to unlock your web dashboard and get daily compute receipts sent to your inbox.`);
+    config.set(MILESTONE_LAST_SHOWN_KEY, today);
+}
+//# sourceMappingURL=savings_output.js.map

package/dist/cli/savings_output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"savings_output.js","sourceRoot":"","sources":["../../src/cli/savings_output.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,EAAE;AACF,sEAAsE;AACtE,yEAAyE;AACzE,qEAAqE;AACrE,oEAAoE;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAC3C,MAAM,wBAAwB,GAAG,6BAA6B,CAAC;AAC/D,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,0CAA0C;AAC5E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAA0C;IACxE,IAAI,OAAO,EAAE,IAAI,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,KAAK;QAAE,OAAO;IAE9D,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,KAAK,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;IACpE,MAAM,YAAY,GAAG,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACxD,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAEpC,kEAAkE;IAClE,qEAAqE;IACrE,oEAAoE;IACpE,mEAAmE;IACnE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,sBAAsB,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,6BAA6B,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,iCAAiC;IAEjE,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAE5C,yBAAyB,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,yBAAyB;IAChC,IAAI,UAAU,EAAE;QAAE,OAAO,CAAC,wCAAwC;IAElE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,+BAA+B,CAAC,CAAC;IACjG,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,eAAe,GAAG,SAAS;QAAE,OAAO;IAEhD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa;IAClE,IAAI,SAAS,KAAK,KAAK;QAAE,OAAO,CAAC,+BAA+B;IAEhE,OAAO,CAAC,GAAG,CACT,6HAA6H,CAC9H,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;AAC9C,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import "dotenv/config";
+import { Command } from "commander";
+/**
+ * Builds the configured Commander program without running it. Split out
+ * from the parseAsync call below so this file is importable in a test —
+ * `program.parseAsync(process.argv)` as a bare top-level side effect
+ * would otherwise run (and try to interpret the test runner's own argv)
+ * the moment anything imported this module.
+ */
+export declare function buildProgram(): Command;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAQA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAyDpC;;;;;;GAMG;AACH,wBAAgB,YAAY,IAAI,OAAO,CAoDtC"}

package/dist/cli.js

@@ -0,0 +1,155 @@
+#!/usr/bin/env node
+// packages/cli/src/cli.ts>COM
+// Must be the first import: loads .env from process.cwd() (the user's
+// project, where they'd put a real .env per .env.example) into
+// process.env before anything else runs. Several modules read
+// process.env.* at module-evaluation time (e.g. cli/output.ts's `quiet`
+// flag), so anything imported after this line sees the loaded values —
+// anything imported before it would not.
+import "dotenv/config";
+import { Command } from "commander";
+import { reconcilePendingOperations } from "@purix/core/state/reconcile";
+import { acquireRepoLock, releaseRepoLock } from "@purix/core/state/repo_lock";
+import { startScheduler } from "@purix/core/state/scheduler";
+import { setQuiet } from "./cli/output.js";
+import { registerLifecycleCommands } from "./cli/commands/lifecycle.js";
+import { registerMigrationsCommands } from "./cli/commands/migrations.js";
+import { registerObservabilityCommands } from "./cli/commands/observability.js";
+import { registerSecurityCommands } from "./cli/commands/security.js";
+import { registerProviderCommands } from "./cli/commands/provider.js";
+import { registerTierCommands } from "./cli/commands/tier.js";
+// registerMcpCommands intentionally not wired in for v1.0 launch — see
+// ADR-057 ("MCP Client Commands Governance Deferral"). The gateway/registry
+// code is intact and untouched; re-enable this import + the
+// registerMcpCommands(program) call below once the governance hardening
+// (identity-backed provenance, DLP scrub, escalation budget caps) ships.
+// import { registerMcpCommands } from "./cli/commands/mcp";
+import { registerBackupCommands } from "./cli/commands/backup.js";
+import { registerMemoryCommands } from "./cli/commands/memory.js";
+import { registerToolsCommands } from "./cli/commands/tools.js";
+import { registerConfigCommands } from "./cli/commands/config.js";
+import { registerAuthCommands } from "./cli/commands/auth.js";
+import { registerLangCommands } from "./cli/commands/lang.js";
+// registerDevCommands intentionally not wired in for beta — `purix dev
+// scaffold-language` is an internal codegen tool for Purix's own
+// contributors (generates provider/pack/fixture stubs for a new
+// language), not an end-user-facing command. It was previously
+// unconditionally registered with no gate, unlike every other
+// internal-only surface in this file (see registerMcpCommands above and
+// PURIX_INTERNAL_LANGUAGES in language/registry.ts for the established
+// pattern). Re-enable via an explicit internal/dev-mode flag if
+// contributor tooling needs it exposed through the published binary;
+// until then this is dead weight in the public `purix --help` output.
+// import { registerDevCommands } from "./cli/commands/dev";
+import { registerIndexCommands } from "./cli/commands/index.js";
+import { registerMcpServeCommand } from "./cli/commands/mcp_serve.js";
+import { fileURLToPath } from "node:url";
+import { realpathSync } from "node:fs";
+import { logError } from "./telemetry/log.js";
+import { registerConnectCommand } from "./cli/commands/connect.js";
+process.on("uncaughtException", (err) => {
+    logError(err, "uncaughtException");
+    console.error("\n🛑 Something went wrong. Details saved to ~/.purix/logs/. Run `purix diagnostics` to review or share them.");
+    releaseRepoLock();
+    process.exit(1);
+});
+process.on("unhandledRejection", (err) => {
+    logError(err, "unhandledRejection");
+    console.error("\n🛑 Something went wrong. Details saved to ~/.purix/logs/. Run `purix diagnostics` to review or share them.");
+    releaseRepoLock();
+    process.exit(1);
+});
+/**
+ * Builds the configured Commander program without running it. Split out
+ * from the parseAsync call below so this file is importable in a test —
+ * `program.parseAsync(process.argv)` as a bare top-level side effect
+ * would otherwise run (and try to interpret the test runner's own argv)
+ * the moment anything imported this module.
+ */
+export function buildProgram() {
+    const program = new Command();
+    program
+        .name("purix")
+        .description("Verification & Governance Layer for AI-Generated Code (Purix v0.1.0)")
+        .version("0.1.0");
+    // Part 2: global quiet flag, alongside the existing preAction hook.
+    program.option("-q, --quiet", "suppress non-essential output");
+    // §7.3: startup reconciliation runs before ANY command touches the
+    // manifest — a crash-interrupted operation from a prior run must be
+    // resolved before new work starts, or state drifts further. Reading
+    // --quiet here too, once, rather than in every individual command.
+    program.hook("preAction", async (thisCommand) => {
+        setQuiet(Boolean(thisCommand.opts().quiet));
+        await reconcilePendingOperations();
+        acquireRepoLock();
+        startScheduler();
+    });
+    program.hook("postAction", async () => {
+        releaseRepoLock();
+    });
+    process.on("SIGINT", () => {
+        releaseRepoLock();
+        process.exit(130);
+    });
+    process.on("SIGTERM", () => {
+        releaseRepoLock();
+        process.exit(143);
+    });
+    registerLifecycleCommands(program);
+    registerMigrationsCommands(program);
+    registerObservabilityCommands(program);
+    registerSecurityCommands(program);
+    registerProviderCommands(program);
+    registerTierCommands(program);
+    // registerMcpCommands(program); — gated off for v1.0, see note above import
+    registerBackupCommands(program);
+    registerMemoryCommands(program);
+    registerToolsCommands(program);
+    registerConfigCommands(program);
+    registerAuthCommands(program);
+    registerLangCommands(program);
+    // registerDevCommands(program); — gated off for beta, see note above import
+    registerIndexCommands(program);
+    registerMcpServeCommand(program);
+    registerConnectCommand(program);
+    return program;
+}
+// Real bug, found while verifying the published-package install path (not
+// hypothetical): `process.argv[1] === fileURLToPath(import.meta.url)` looks
+// like the standard "am I the directly-executed entry point, or just
+// imported for buildProgram() in tests" guard, but Node does NOT resolve
+// symlinks for argv[1] while it DOES resolve them for import.meta.url when
+// loading the module. Every real invocation of this CLI goes through a
+// symlink: `npm install -g purix` creates one in the global bin dir, `npx
+// purix` creates one in its cache, and even local `node_modules/.bin/purix`
+// is one. Under all three, argv[1] stays the symlink path while
+// import.meta.url resolves to the real target — they never match, the
+// guard silently evaluates false, and the CLI exits 0 with zero output no
+// matter what was asked for. realpath-ing argv[1] first makes the
+// comparison symlink-agnostic on both sides; buildProgram() itself is
+// untouched, so cli.test.ts / cli.integration.test.ts importing it directly
+// still don't trigger this block (there's no argv[1] file to realpath to
+// a match in that context).
+function isDirectlyExecuted() {
+    if (!process.argv[1])
+        return false;
+    try {
+        return realpathSync(process.argv[1]) === fileURLToPath(import.meta.url);
+    }
+    catch {
+        return false;
+    }
+}
+if (isDirectlyExecuted()) {
+    const program = buildProgram();
+    if (process.argv.length <= 2) {
+        program.help();
+    }
+    else {
+        program.parseAsync(process.argv).catch((err) => {
+            console.error(`\n🛑 Unhandled error: ${err instanceof Error ? err.message : err}`);
+            process.exitCode = 1;
+        });
+    }
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,8BAA8B;AAC9B,sEAAsE;AACtE,+DAA+D;AAC/D,8DAA8D;AAC9D,wEAAwE;AACxE,uEAAuE;AACvE,yCAAyC;AACzC,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,uEAAuE;AACvE,4EAA4E;AAC5E,4DAA4D;AAC5D,wEAAwE;AACxE,yEAAyE;AACzE,4DAA4D;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,uEAAuE;AACvE,iEAAiE;AACjE,gEAAgE;AAChE,+DAA+D;AAC/D,8DAA8D;AAC9D,wEAAwE;AACxE,uEAAuE;AACvE,gEAAgE;AAChE,qEAAqE;AACrE,sEAAsE;AACtE,4DAA4D;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAGnE,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,EAAE;IACtC,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IACnC,OAAO,CAAC,KAAK,CAAC,8GAA8G,CAAC,CAAC;IAC9H,eAAe,EAAE,CAAC;IAClB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,GAAG,EAAE,EAAE;IACvC,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACpC,OAAO,CAAC,KAAK,CAAC,8GAA8G,CAAC,CAAC;IAC9H,eAAe,EAAE,CAAC;IAClB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO;SACJ,IAAI,CAAC,OAAO,CAAC;SACb,WAAW,CAAC,sEAAsE,CAAC;SACnF,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB,oEAAoE;IACpE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;IAE/D,mEAAmE;IACnE,oEAAoE;IACpE,oEAAoE;IACpE,mEAAmE;IACnE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE;QAC9C,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,MAAM,0BAA0B,EAAE,CAAC;QACnC,eAAe,EAAE,CAAC;QAClB,cAAc,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;QACpC,eAAe,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,eAAe,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QACzB,eAAe,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACnC,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACpC,6BAA6B,CAAC,OAAO,CAAC,CAAC;IACvC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,4EAA4E;IAC5E,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,4EAA4E;IAC5E,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,0EAA0E;AAC1E,4EAA4E;AAC5E,qEAAqE;AACrE,yEAAyE;AACzE,2EAA2E;AAC3E,uEAAuE;AACvE,0EAA0E;AAC1E,4EAA4E;AAC5E,gEAAgE;AAChE,sEAAsE;AACtE,0EAA0E;AAC1E,kEAAkE;AAClE,sEAAsE;AACtE,4EAA4E;AAC5E,yEAAyE;AACzE,4BAA4B;AAC5B,SAAS,kBAAkB;IACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,kBAAkB,EAAE,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,EAAE,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC7C,OAAO,CAAC,KAAK,CAAC,yBAAyB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YACnF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/telemetry/log.d.ts

@@ -0,0 +1,4 @@
+export declare function logError(err: unknown, context?: string): void;
+export declare function getRecentLogs(maxLines?: number): string[];
+export declare function redactLogContent(line: string): string;
+//# sourceMappingURL=log.d.ts.map

package/dist/telemetry/log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../../src/telemetry/log.ts"],"names":[],"mappings":"AAoBA,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAgB7D;AA0BD,wBAAgB,aAAa,CAAC,QAAQ,SAAK,GAAG,MAAM,EAAE,CAqBrD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQrD"}

package/dist/telemetry/log.js

@@ -0,0 +1,92 @@
+// packages/cli/src/telemetry/log.ts
+import { appendFileSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+function getLogDir() {
+    const dir = join(homedir(), ".purix", "logs");
+    if (!existsSync(dir)) {
+        try {
+            mkdirSync(dir, { recursive: true });
+        }
+        catch { }
+    }
+    return dir;
+}
+function getLogFilePath() {
+    const dateStr = new Date().toISOString().split("T")[0]; // YYYY-MM-DD
+    return join(getLogDir(), `purix-${dateStr}.log`);
+}
+export function logError(err, context) {
+    try {
+        const dir = getLogDir();
+        const p = getLogFilePath();
+        const entry = {
+            timestamp: new Date().toISOString(),
+            context: context ?? "cli",
+            message: err instanceof Error ? err.message : String(err),
+            stack: err instanceof Error ? err.stack : undefined,
+            version: "0.1.0",
+        };
+        appendFileSync(p, JSON.stringify(entry) + "\n", "utf-8");
+        // Clean up logs older than 7 days
+        cleanupOldLogs(dir);
+    }
+    catch { }
+}
+function cleanupOldLogs(dir) {
+    try {
+        const files = readdirNames(dir);
+        const now = Date.now();
+        for (const file of files) {
+            if (file.startsWith("purix-") && file.endsWith(".log")) {
+                const fp = join(dir, file);
+                const stats = statSync(fp);
+                if (now - stats.mtimeMs > 7 * 24 * 60 * 60 * 1000) {
+                    rmSync(fp, { force: true });
+                }
+            }
+        }
+    }
+    catch { }
+}
+function readdirNames(dir) {
+    try {
+        return readdirSync(dir);
+    }
+    catch {
+        return [];
+    }
+}
+export function getRecentLogs(maxLines = 50) {
+    try {
+        const dir = getLogDir();
+        const files = readdirNames(dir)
+            .filter((f) => f.startsWith("purix-") && f.endsWith(".log"))
+            .sort()
+            .reverse();
+        const lines = [];
+        for (const file of files) {
+            const content = readFileSync(join(dir, file), "utf-8");
+            const fileLines = content.trim().split("\n").filter(Boolean);
+            for (const line of fileLines.reverse()) {
+                lines.push(line);
+                if (lines.length >= maxLines)
+                    return lines;
+            }
+        }
+        return lines;
+    }
+    catch {
+        return [];
+    }
+}
+export function redactLogContent(line) {
+    // Redact potential absolute paths, secrets, or api keys
+    return line
+        .replace(/[C-Z]:\\[^\s"']+/gi, "[REDACTED_PATH]")
+        .replace(/\/home\/[^\s"']+/gi, "[REDACTED_PATH]")
+        .replace(/\/Users\/[^\s"']+/gi, "[REDACTED_PATH]")
+        .replace(/AKIA[0-9A-Z]{16}/g, "[REDACTED_SECRET]")
+        .replace(/bearer\s+[a-zA-Z0-9_\-\.]+/gi, "bearer [REDACTED_TOKEN]");
+}
+//# sourceMappingURL=log.js.map

package/dist/telemetry/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../../src/telemetry/log.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC7G,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,SAAS,SAAS;IAChB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa;IACrE,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,OAAO,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAY,EAAE,OAAgB;IACrD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,cAAc,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,OAAO,IAAI,KAAK;YACzB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACzD,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YACnD,OAAO,EAAE,OAAO;SACjB,CAAC;QACF,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QAEzD,kCAAkC;QAClC,cAAc,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;AACZ,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC3B,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;oBAClD,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;AACZ,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAQ,GAAG,EAAE;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC;aAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aAC3D,IAAI,EAAE;aACN,OAAO,EAAE,CAAC;QAEb,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YACvD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7D,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;gBACvC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjB,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ;oBAAE,OAAO,KAAK,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,wDAAwD;IACxD,OAAO,IAAI;SACR,OAAO,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;SAChD,OAAO,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;SAChD,OAAO,CAAC,qBAAqB,EAAE,iBAAiB,CAAC;SACjD,OAAO,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;SACjD,OAAO,CAAC,8BAA8B,EAAE,yBAAyB,CAAC,CAAC;AACxE,CAAC"}

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@purix/cli",
+  "version": "0.1.0",
+  "description": "Governance-first AI coding agent CLI: classifies and verifies AI-driven code changes in a sandbox, against your test suite, before they land. Also runs as an MCP server for other coding agents.",
+  "keywords": [
+    "ai",
+    "cli",
+    "code-verification",
+    "governance",
+    "mcp",
+    "model-context-protocol",
+    "sandbox",
+    "typescript"
+  ],
+  "type": "module",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/purix-ai/purix.git",
+    "directory": "packages/cli"
+  },
+  "files": [
+    "dist"
+  ],
+  "bin": {
+    "purix": "./dist/cli.js"
+  },
+  "dependencies": {
+    "@purix/core": "^0.1.0",
+    "@purix/mcp-server": "^0.1.0",
+    "add-mcp": "^2.4.0",
+    "commander": "^15.0.0",
+    "dotenv": "^17.4.2"
+  },
+  "devDependencies": {
+    "@types/node": "22.13.0",
+    "typescript": "5.7.2",
+    "expect": "^29.7.0",
+    "tsx": "^4.19.2"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "purix": "tsx src/cli.ts",
+    "test": "tsx --test \"src/**/*.test.ts\"",
+    "typecheck": "tsc --noEmit"
+  }
+}