@rulemetric/cli 0.6.0 → 0.6.1

package/dist/chunk-3AEVHOTS.js

@@ -0,0 +1,33 @@
+import {
+  apiPost
+} from "./chunk-ZRLYHBPN.js";
+import {
+  __resetEnvFileAuthCache,
+  loadEnvFileAuth,
+  saveApiKey
+} from "./chunk-W2YERO7E.js";
+
+// src/lib/ensure-api-key.ts
+import { hostname } from "node:os";
+async function ensureDeviceApiKey(log, warn) {
+  __resetEnvFileAuthCache();
+  const existing = process.env.RULEMETRIC_API_KEY || loadEnvFileAuth().apiKey;
+  if (existing) return;
+  const name = `${hostname()} (auto)`;
+  try {
+    const data = await apiPost("/api/auth/api-keys", { name });
+    saveApiKey(data.key, process.env.RULEMETRIC_API_URL);
+    __resetEnvFileAuthCache();
+    log(`Created API key "${name}" for hooks + proxy auth (saved to your config).`);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    warn(
+      `Could not auto-create an API key (${msg}). Hooks/proxy still work via your session token; run \`rulemetric auth create-key --name "my-laptop"\` if capture auth fails.`
+    );
+  }
+}
+
+export {
+  ensureDeviceApiKey
+};
+//# sourceMappingURL=chunk-3AEVHOTS.js.map

package/dist/chunk-3AEVHOTS.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/lib/ensure-api-key.ts"],
+  "sourcesContent": ["import { hostname } from 'node:os';\nimport { apiPost } from './api-client.js';\nimport { saveApiKey, loadEnvFileAuth, __resetEnvFileAuthCache } from './auth.js';\n\ninterface CreateKeyResponse {\n  key: string;\n  name: string;\n}\n\n/**\n * Best-effort: mint a long-lived API key for hooks/proxy auth right after\n * login/signup, so `auth create-key` isn't a separate manual step a new user\n * has to discover. No-ops when a key already exists (env var or on-disk env\n * file) so repeated logins never pile up duplicate keys. NEVER throws \u2014 a key\n * failure must not fail the auth flow; the user can always run\n * `rulemetric auth create-key` by hand.\n */\nexport async function ensureDeviceApiKey(\n  log: (msg: string) => void,\n  warn: (msg: string) => void,\n): Promise<void> {\n  // Re-read the env file we just wrote (login/signup saved the token there).\n  __resetEnvFileAuthCache();\n  const existing = process.env.RULEMETRIC_API_KEY || loadEnvFileAuth().apiKey;\n  if (existing) return;\n\n  const name = `${hostname()} (auto)`;\n  try {\n    const data = await apiPost<CreateKeyResponse>('/api/auth/api-keys', { name });\n    saveApiKey(data.key, process.env.RULEMETRIC_API_URL);\n    __resetEnvFileAuthCache();\n    log(`Created API key \"${name}\" for hooks + proxy auth (saved to your config).`);\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    warn(\n      `Could not auto-create an API key (${msg}). Hooks/proxy still work via your ` +\n        'session token; run `rulemetric auth create-key --name \"my-laptop\"` if capture auth fails.',\n    );\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;AAAA,SAAS,gBAAgB;AAiBzB,eAAsB,mBACpB,KACA,MACe;AAEf,0BAAwB;AACxB,QAAM,WAAW,QAAQ,IAAI,sBAAsB,gBAAgB,EAAE;AACrE,MAAI,SAAU;AAEd,QAAM,OAAO,GAAG,SAAS,CAAC;AAC1B,MAAI;AACF,UAAM,OAAO,MAAM,QAA2B,sBAAsB,EAAE,KAAK,CAAC;AAC5E,eAAW,KAAK,KAAK,QAAQ,IAAI,kBAAkB;AACnD,4BAAwB;AACxB,QAAI,oBAAoB,IAAI,kDAAkD;AAAA,EAChF,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D;AAAA,MACE,qCAAqC,GAAG;AAAA,IAE1C;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/{chunk-WLFX4PYR.js → chunk-6TPJGYFF.js}

@@ -1,14 +1,14 @@
 import {
   removeWorktree
 } from "./chunk-Y4BJXXYV.js";
+import {
+  PermanentJobError
+} from "./chunk-DGHWRQXL.js";
 import {
   agentRuns,
   getDb,
   sessions
 } from "./chunk-QNSVCSHG.js";
-import {
-  PermanentJobError
-} from "./chunk-DGHWRQXL.js";
 
 // src/lib/handlers/process-run-cleanup.ts
 import { and, eq, isNotNull } from "drizzle-orm";
@@ -96,4 +96,4 @@ async function processRunCleanup(payload, deps = {}) {
 export {
   processRunCleanup
 };
-//# sourceMappingURL=chunk-WLFX4PYR.js.map
+//# sourceMappingURL=chunk-6TPJGYFF.js.map

package/dist/{chunk-4LHEN2FS.js → chunk-CVMRMSV4.js}

@@ -1,39 +1,39 @@
 import {
   startTerminalTargetHeartbeat
 } from "./chunk-JEJ3J5J6.js";
+import {
+  processEval
+} from "./chunk-RCMXTLQF.js";
+import {
+  processInsights
+} from "./chunk-N5A2IQAK.js";
 import {
   processLaunch
 } from "./chunk-OTOWLUOJ.js";
 import {
   processRunCleanup
-} from "./chunk-WLFX4PYR.js";
+} from "./chunk-6TPJGYFF.js";
 import {
   processSendMessage
 } from "./chunk-W53GKIZQ.js";
 import {
   processSessionGoal
-} from "./chunk-H3C6EGR2.js";
+} from "./chunk-MUOUV5LY.js";
 import {
   cronRefreshSkills
 } from "./chunk-RQ2TMLKG.js";
 import {
   cronSuggestInstructions
-} from "./chunk-IATQXFJA.js";
+} from "./chunk-VBGUNFKY.js";
 import {
   processAnnouncement
-} from "./chunk-BCIUSUEV.js";
-import {
-  processConversation
-} from "./chunk-3POYC5NA.js";
-import {
-  processEval
-} from "./chunk-RCMXTLQF.js";
-import {
-  processInsights
-} from "./chunk-N5A2IQAK.js";
+} from "./chunk-VIYUIQHW.js";
 import {
   isPermanentJobError
 } from "./chunk-DGHWRQXL.js";
+import {
+  processConversation
+} from "./chunk-3POYC5NA.js";
 import {
   ApiError,
   apiGet,
@@ -267,4 +267,4 @@ export {
   pollForWork,
   runAgentLoop
 };
-//# sourceMappingURL=chunk-4LHEN2FS.js.map
+//# sourceMappingURL=chunk-CVMRMSV4.js.map

package/dist/{chunk-H3C6EGR2.js → chunk-MUOUV5LY.js}

@@ -1,11 +1,11 @@
+import {
+  runLlmPrompt
+} from "./chunk-FZKLLNDS.js";
 import {
   getDb,
   sessionEvents,
   sessions
 } from "./chunk-QNSVCSHG.js";
-import {
-  runLlmPrompt
-} from "./chunk-FZKLLNDS.js";
 
 // src/lib/handlers/process-session-goal.ts
 import { eq, asc, sql } from "drizzle-orm";
@@ -52,4 +52,4 @@ async function processSessionGoal(payload, deps = {}) {
 export {
   processSessionGoal
 };
-//# sourceMappingURL=chunk-H3C6EGR2.js.map
+//# sourceMappingURL=chunk-MUOUV5LY.js.map

package/dist/{chunk-7K4ILWS7.js → chunk-UPXIO7CG.js}

@@ -1,3 +1,6 @@
+import {
+  ActiveJobsList
+} from "./chunk-QD6X4L4L.js";
 import {
   NewLaunchForm
 } from "./chunk-DTFXCHHI.js";
@@ -9,9 +12,6 @@ import {
   createLaunchJob,
   listLaunchers
 } from "./chunk-W4MZXKZ2.js";
-import {
-  ActiveJobsList
-} from "./chunk-QD6X4L4L.js";
 import {
   ORANGE
 } from "./chunk-QJQS6TUN.js";
@@ -158,4 +158,4 @@ function LauncherOverlay({
 export {
   LauncherOverlay
 };
-//# sourceMappingURL=chunk-7K4ILWS7.js.map
+//# sourceMappingURL=chunk-UPXIO7CG.js.map

package/dist/{chunk-IATQXFJA.js → chunk-VBGUNFKY.js}

@@ -1,10 +1,10 @@
-import {
-  buildRecommendationPrompt
-} from "./chunk-E3BIT53W.js";
 import {
   detectLlmBackend,
   runLlmPrompt
 } from "./chunk-FZKLLNDS.js";
+import {
+  buildRecommendationPrompt
+} from "./chunk-E3BIT53W.js";
 import {
   detectLanguages
 } from "./chunk-OQSQC7VB.js";
@@ -164,4 +164,4 @@ var cronSuggestInstructions = async (_payload, helpers) => {
 export {
   cronSuggestInstructions
 };
-//# sourceMappingURL=chunk-IATQXFJA.js.map
+//# sourceMappingURL=chunk-VBGUNFKY.js.map

package/dist/{chunk-BCIUSUEV.js → chunk-VIYUIQHW.js}

@@ -1,3 +1,6 @@
+import {
+  PermanentJobError
+} from "./chunk-DGHWRQXL.js";
 import {
   sendEmail
 } from "./chunk-QSN77T7C.js";
@@ -8,9 +11,6 @@ import {
   notificationPreferences,
   profiles
 } from "./chunk-QNSVCSHG.js";
-import {
-  PermanentJobError
-} from "./chunk-DGHWRQXL.js";
 
 // src/lib/handlers/process-announcement.ts
 import { and, asc, eq, gt, isNotNull } from "drizzle-orm";
@@ -154,4 +154,4 @@ async function sendOne(args) {
 export {
   processAnnouncement
 };
-//# sourceMappingURL=chunk-BCIUSUEV.js.map
+//# sourceMappingURL=chunk-VIYUIQHW.js.map

package/dist/{chunk-JCYCAQ6U.js → chunk-YDTUPCBL.js}

@@ -4,8 +4,7 @@ import {
   mergeClaudeCodeHooks
 } from "./chunk-HWGRTIXN.js";
 import {
-  GATEWAY_PORT,
-  isGatewayListening
+  GATEWAY_PORT
 } from "./chunk-OVGP4OGK.js";
 import {
   apiGet
@@ -21,7 +20,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 var CORE_STEP_IDS = ["install", "auth", "hooks", "worker"];
-var OPTIONAL_STEP_IDS = ["deep-capture"];
+var OPTIONAL_STEP_IDS = [];
 var ALL_STEP_IDS = [...CORE_STEP_IDS, ...OPTIONAL_STEP_IDS];
 function defaultContext() {
   return {
@@ -199,12 +198,17 @@ var STEPS = [
   },
   {
     id: "hooks",
-    title: "Install hooks",
-    // Default onboarding is hooks-only: full session capture WITHOUT the MITM
-    // proxy. The proxy/CA is a separate, explicitly-consented `deep-capture`
-    // step (below) so the invasive machine-wide + keychain changes are never
-    // bundled silently into the core path.
-    command: "rulemetric hooks install --no-proxy",
+    title: "Install hooks + capture proxy",
+    // Default onboarding installs the FULL capture path: session hooks PLUS the
+    // MITM proxy (rendered-system-prompt / instruction linking + cross-tool
+    // capture). Every invasive side effect is disclosed up front in plan()
+    // below — nothing is silent. `hooks install` fails SAFE: if the CA sudo
+    // trust is declined it degrades to hooks-only (no machine-wide proxy pin),
+    // and HTTPS_PROXY is only pinned once the gateway actually answers on
+    // :8787 — so the default never bricks Claude Code. detect() greens on the
+    // capture hooks being present, so `coreComplete` is reachable even when the
+    // user declines the proxy.
+    command: "rulemetric hooks install",
     async detect(ctx) {
       const settingsPath = join(ctx.projectPath, ".claude", "settings.json");
       if (!existsSync(settingsPath)) return false;
@@ -218,95 +222,38 @@ var STEPS = [
     async plan(ctx) {
       const settingsPath = join(ctx.projectPath, ".claude", "settings.json");
       const { before, after } = projectHooksSettings(ctx.projectPath);
-      return {
-        id: "hooks",
-        title: "Install hooks",
-        command: "rulemetric hooks install --no-proxy",
-        artifacts: [
-          { path: settingsPath, kind: "file", before, after },
-          // Disclose what the hooks DO, not just that they're registered — these
-          // are the privacy-relevant behaviors a user is consenting to.
-          {
-            path: "what these hooks capture",
-            kind: "service",
-            before: null,
-            after: "session-end reimports the FULL transcript to the API; post-tool-use records each tool call and snapshots the working tree to a LOCAL shadow git ref (paper-trail, never pushed); user-prompt posts prompt text. All scoped to sessions in this project."
-          }
-        ]
-      };
-    },
-    async apply() {
-      runCommand("rulemetric hooks install --no-proxy");
-    }
-  },
-  {
-    id: "worker",
-    title: "Run the worker",
-    command: "rulemetric service install --worker-only",
-    async detect() {
-      return workerActive();
-    },
-    async plan() {
-      const isMac = process.platform === "darwin";
-      const servicePath = isMac ? WORKER_PLIST_PATH : WORKER_SYSTEMD_PATH;
-      const before = existsSync(servicePath) ? `(service already installed at ${servicePath})` : null;
-      const after = isMac ? [
-        `Label: com.rulemetric.worker`,
-        `ProgramArguments: <node> <cli>/bin/run.js evals agent`,
-        `RunAtLoad: true, KeepAlive: true`
-      ].join("\n") : [
-        `[Service]`,
-        `ExecStart=<node> <cli>/bin/run.js evals agent`,
-        `Restart=on-failure`
-      ].join("\n");
-      return {
-        id: "worker",
-        title: "Run the worker",
-        command: "rulemetric service install --worker-only",
-        artifacts: [
-          { path: servicePath, kind: "service", before, after }
-        ]
-      };
-    },
-    async apply() {
-      runCommand("rulemetric service install --worker-only");
-    }
-  },
-  {
-    id: "deep-capture",
-    title: "Enable deep capture (proxy) \u2014 optional",
-    optional: true,
-    // The full (proxy-enabled) install. Distinct from the core `hooks` step so
-    // the invasive side effects below are an explicit, disclosed opt-in.
-    command: "rulemetric hooks install",
-    async detect(ctx) {
-      const settingsPath = join(ctx.projectPath, ".claude", "settings.json");
-      if (!existsSync(settingsPath)) return false;
-      try {
-        const settings = JSON.parse(readFileSync(settingsPath, "utf-8"));
-        const env = settings.env ?? {};
-        if (typeof env.HTTPS_PROXY !== "string") return false;
-      } catch {
-        return false;
-      }
-      return isGatewayListening(GATEWAY_PORT);
-    },
-    async plan(ctx) {
-      const settingsPath = join(ctx.projectPath, ".claude", "settings.json");
-      const { before, after } = projectProxyEnvSettings(ctx.projectPath);
       const artifacts = [
         { path: settingsPath, kind: "file", before, after },
+        // Disclose what the hooks DO, not just that they're registered — these
+        // are the privacy-relevant behaviors a user is consenting to.
         {
-          path: "macOS System keychain \u2014 mitmproxy root CA",
+          path: "what these hooks capture",
+          kind: "service",
+          before: null,
+          after: "session-end reimports the FULL transcript to the API; post-tool-use records each tool call and snapshots the working tree to a LOCAL shadow git ref (paper-trail, never pushed); user-prompt posts prompt text. All scoped to sessions in this project."
+        },
+        // FULL DISCLOSURE of the proxy layer — every invasive side effect of
+        // `hooks install` §2 is enumerated here so the default path hides
+        // nothing. Each degrades gracefully (see the step comment): a declined
+        // CA-trust sudo skips the machine-wide layer and stays hooks-only.
+        {
+          // The proxy env block `hooks install` §2 adds to the SAME
+          // .claude/settings.json (HTTPS_PROXY / NO_PROXY / NODE_EXTRA_CA_CERTS).
+          path: `${settingsPath} (proxy env block)`,
+          kind: "file",
+          ...projectProxyEnvSettings(ctx.projectPath)
+        },
+        {
+          path: "system keychain \u2014 mitmproxy root CA",
           kind: "service",
           before: existsSync(CERT_PATH) ? "(CA generated; trust state unchanged)" : "(no CA yet)",
-          after: "Installs + trusts the mitmproxy CA (requires sudo). This lets the proxy DECRYPT Claude Code HTTPS request/response bodies \u2014 the capability that powers rendered-system-prompt / instruction linking."
+          after: "Installs + trusts the mitmproxy CA (requires sudo). This lets the proxy DECRYPT Claude Code HTTPS request/response bodies \u2014 the capability that powers rendered-system-prompt / instruction linking. Decline the sudo prompt and setup stays hooks-only (still fully onboarded)."
         },
         {
           path: "launchctl setenv HTTPS_PROXY (machine-wide, all GUI apps)",
           kind: "command",
           before: null,
-          after: `http://localhost:${GATEWAY_PORT}  \u2014 routes every GUI app's HTTPS through the local gateway`
+          after: `http://localhost:${GATEWAY_PORT}  \u2014 routes every GUI app's HTTPS through the local gateway (only when the CA is trusted AND :${GATEWAY_PORT} is live)`
         },
         {
           path: "VS Code + Cursor user settings (http.proxy)",
@@ -330,8 +277,8 @@ var STEPS = [
         });
       }
       return {
-        id: "deep-capture",
-        title: "Enable deep capture (proxy) \u2014 optional",
+        id: "hooks",
+        title: "Install hooks + capture proxy",
         command: "rulemetric hooks install",
         artifacts
       };
@@ -339,6 +286,39 @@ var STEPS = [
     async apply() {
       runCommand("rulemetric hooks install");
     }
+  },
+  {
+    id: "worker",
+    title: "Run the worker",
+    command: "rulemetric service install --worker-only",
+    async detect() {
+      return workerActive();
+    },
+    async plan() {
+      const isMac = process.platform === "darwin";
+      const servicePath = isMac ? WORKER_PLIST_PATH : WORKER_SYSTEMD_PATH;
+      const before = existsSync(servicePath) ? `(service already installed at ${servicePath})` : null;
+      const after = isMac ? [
+        `Label: com.rulemetric.worker`,
+        `ProgramArguments: <node> <cli>/bin/run.js evals agent`,
+        `RunAtLoad: true, KeepAlive: true`
+      ].join("\n") : [
+        `[Service]`,
+        `ExecStart=<node> <cli>/bin/run.js evals agent`,
+        `Restart=on-failure`
+      ].join("\n");
+      return {
+        id: "worker",
+        title: "Run the worker",
+        command: "rulemetric service install --worker-only",
+        artifacts: [
+          { path: servicePath, kind: "service", before, after }
+        ]
+      };
+    },
+    async apply() {
+      runCommand("rulemetric service install --worker-only");
+    }
   }
 ];
 var STEP_BY_ID = new Map(STEPS.map((s) => [s.id, s]));
@@ -399,4 +379,4 @@ export {
   isStepId,
   computeStatus
 };
-//# sourceMappingURL=chunk-JCYCAQ6U.js.map
+//# sourceMappingURL=chunk-YDTUPCBL.js.map

package/dist/chunk-YDTUPCBL.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/lib/setup-steps.ts"],
+  "sourcesContent": ["import { execSync } from 'node:child_process';\nimport { existsSync, readFileSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join } from 'node:path';\nimport { isAuthenticated, getDefaultConfigDir } from './auth.js';\nimport { apiGet } from './api-client.js';\nimport { GATEWAY_PORT, isGatewayListening } from './gateway-lifecycle.js';\nimport { detectInstalledTools, mergeClaudeCodeHooks, hasRulemetricClaudeHooks } from './hooks-config.js';\n\n/**\n * Data model for the four core onboarding steps, shared (by step-ID list +\n * install-monotonicity) with the web reducer `deriveSetupProgress()`.\n *\n * The two surfaces are separate implementations by necessity, but they no\n * longer read *different sources* for the same fact:\n *   - Server-observable signals (cli-worker heartbeat / captured session) are\n *     unified through the shared `GET /api/setup/status` endpoint \u2014 the CLI's\n *     `workerActive()` and the web's `use-setup-progress.ts` both bottom out on\n *     that one server-side authority, so they cannot drift on it.\n *   - Local signals (auth = `~/.config/rulemetric` creds via `isAuthenticated()`,\n *     hooks = cwd `.claude/settings.json`) stay machine-local: the browser\n *     cannot read the user's filesystem, so these legitimately differ from the\n *     web's account-scoped proxies for the same step (see the design doc's\n *     \"Shared step model, two implementations\").\n * Each step exposes:\n *   - detect(): is it done? (reads a local/remote signal, never mutates)\n *   - plan():   what would apply() write? (read-only, returns diffs/artifacts)\n *   - apply():  perform the step (thin \u2014 shells out to existing commands)\n */\n\nexport const CORE_STEP_IDS = ['install', 'auth', 'hooks', 'worker'] as const;\n// Optional steps live in the walk (offered, recommended) but do NOT gate\n// `coreComplete` \u2014 declining them still leaves the user fully onboarded. The\n// proxy/CA capture now ships as the DEFAULT of the core `hooks` step (see that\n// step's plan(), which fully discloses the invasive MITM/keychain side effects\n// up front); it is not a separate opt-in step. The mechanism is retained for\n// any future optional step.\nexport const OPTIONAL_STEP_IDS = [] as const;\nexport const ALL_STEP_IDS = [...CORE_STEP_IDS, ...OPTIONAL_STEP_IDS] as const;\nexport type StepId = (typeof ALL_STEP_IDS)[number];\n\nexport type ArtifactKind = 'file' | 'command' | 'service';\n\nexport interface Artifact {\n  path: string;\n  kind: ArtifactKind;\n  before: string | null;\n  after: string | null;\n  /** True when `after` contains a masked secret (never the raw value). */\n  masked?: boolean;\n}\n\nexport interface StepPlan {\n  id: StepId;\n  title: string;\n  command?: string;\n  artifacts: Artifact[];\n}\n\nexport interface SetupContext {\n  projectPath: string;\n  configDir: string;\n}\n\nexport interface SetupStep {\n  id: StepId;\n  title: string;\n  command?: string;\n  /** Optional steps are offered in the walk but never gate `coreComplete`. */\n  optional?: boolean;\n  detect(ctx: SetupContext): Promise<boolean>;\n  plan(ctx: SetupContext): Promise<StepPlan>;\n  apply(ctx: SetupContext): Promise<void>;\n}\n\nexport interface StepStatus {\n  id: StepId;\n  done: boolean;\n}\n\nexport interface SetupStatus {\n  steps: StepStatus[];\n  coreComplete: boolean;\n  currentStepId: StepId | null;\n}\n\n/** Build the default context from the current process (cwd + config dir). */\nexport function defaultContext(): SetupContext {\n  return {\n    projectPath: process.cwd(),\n    configDir: getDefaultConfigDir(),\n  };\n}\n\nconst CERT_PATH = join(homedir(), '.mitmproxy', 'mitmproxy-ca-cert.pem');\n\n/**\n * Mask a secret: keep the first 4 and last 4 characters, replace the middle\n * with asterisks. Strings too short to reveal safely are fully masked.\n */\nexport function maskToken(s: string): string {\n  if (!s) return '';\n  if (s.length <= 8) return '*'.repeat(s.length);\n  const head = s.slice(0, 4);\n  const tail = s.slice(-4);\n  return `${head}${'*'.repeat(Math.max(4, s.length - 8))}${tail}`;\n}\n\n/**\n * Simple line-oriented +/- diff for terminal display. Not a real LCS \u2014 good\n * enough to show a human/agent exactly which lines an artifact would change.\n */\nexport function renderDiff(before: string | null, after: string | null): string {\n  const beforeLines = before === null ? [] : before.replace(/\\n$/, '').split('\\n');\n  const afterLines = after === null ? [] : after.replace(/\\n$/, '').split('\\n');\n  const out: string[] = [];\n  const max = Math.max(beforeLines.length, afterLines.length);\n  for (let i = 0; i < max; i++) {\n    const b = beforeLines[i];\n    const a = afterLines[i];\n    if (b === a) {\n      out.push(` ${b}`);\n    } else {\n      if (b !== undefined) out.push(`-${b}`);\n      if (a !== undefined) out.push(`+${a}`);\n    }\n  }\n  return out.join('\\n');\n}\n\n/** Read a single KEY=value from the env file, or null if absent. */\nfunction readEnvValue(configDir: string, key: string): string | null {\n  const envPath = join(configDir, 'env');\n  if (!existsSync(envPath)) return null;\n  try {\n    const content = readFileSync(envPath, 'utf-8');\n    const match = content.match(new RegExp(`^${key}=(.+)$`, 'm'));\n    return match ? match[1] : null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Is a CLI worker heartbeat active for the caller? (best-effort, network)\n *\n * Reads the shared `GET /api/setup/status` endpoint's `workerActive` field\n * rather than re-deriving it from `/api/workers/status`. That endpoint computes\n * the cli-worker heartbeat signal server-side using the SAME window +\n * staleness thresholds + `workerType === 'cli-worker'` filter the web strip\n * uses, so the CLI and web can't drift on this fact by construction (they used\n * to each filter/threshold client-side, which is exactly how they could\n * disagree). Fast-fails after 2.5s so `setup --json` / `setup plan` degrade to\n * \"not running\" instead of blocking on a stalled connection \u2014 detection is a\n * UX signal, not a correctness gate; offline \u2192 false.\n */\nasync function workerActive(): Promise<boolean> {\n  if (!isAuthenticated()) return false;\n  try {\n    const status = await Promise.race([\n      apiGet<{\n        cliEverConnected?: boolean;\n        anyCapturedSession?: boolean;\n        workerActive?: boolean;\n      }>('/api/setup/status'),\n      new Promise<never>((_, reject) =>\n        setTimeout(() => reject(new Error('setup/status timeout')), 2500),\n      ),\n    ]);\n    return status?.workerActive === true;\n  } catch {\n    return false;\n  }\n}\n\n/** Read the project's `.claude/settings.json` for a read-only preview (no throw). */\nfunction readProjectSettings(projectPath: string): { settings: Record<string, unknown>; before: string | null } {\n  const settingsPath = join(projectPath, '.claude', 'settings.json');\n  let settings: Record<string, unknown> = {};\n  let before: string | null = null;\n  if (existsSync(settingsPath)) {\n    try {\n      before = readFileSync(settingsPath, 'utf-8').replace(/\\n$/, '');\n      settings = JSON.parse(before) as Record<string, unknown>;\n    } catch {\n      settings = {};\n    }\n  }\n  return { settings, before };\n}\n\n/**\n * Compute the in-memory `.claude/settings.json` after the RuleMetric session\n * HOOKS are merged, WITHOUT touching disk. This is the \u00A71 (hooks) portion of\n * the diff; the proxy env block that `hooks install` \u00A72 also writes is disclosed\n * separately via projectProxyEnvSettings so the two changes read distinctly.\n */\nfunction projectHooksSettings(projectPath: string): { before: string | null; after: string } {\n  const { settings, before } = readProjectSettings(projectPath);\n  mergeClaudeCodeHooks(settings);\n  return { before, after: JSON.stringify(settings, null, 2) };\n}\n\n/**\n * The proxy-env addition to `.claude/settings.json` that `hooks install` \u00A72\n * makes on the default path \u2014 for the disclosure diff only. Read-only.\n */\nfunction projectProxyEnvSettings(projectPath: string): { before: string | null; after: string } {\n  const { settings, before } = readProjectSettings(projectPath);\n  const env = { ...((settings.env as Record<string, string>) ?? {}) };\n  env.HTTPS_PROXY = `http://localhost:${GATEWAY_PORT}`;\n  env.NO_PROXY = 'localhost,127.0.0.1,*.supabase.co,*.supabase.in';\n  env.NODE_EXTRA_CA_CERTS = CERT_PATH;\n  return { before, after: JSON.stringify({ ...settings, env }, null, 2) };\n}\n\nconst WORKER_PLIST_PATH = join(homedir(), 'Library', 'LaunchAgents', 'com.rulemetric.worker.plist');\nconst WORKER_SYSTEMD_PATH = join(homedir(), '.config', 'systemd', 'user', 'rulemetric-worker.service');\n\n/** Run a command with inherited stdio (interactive-friendly). Thin apply(). */\nfunction runCommand(cmd: string): void {\n  execSync(cmd, { stdio: 'inherit' });\n}\n\nexport const STEPS: SetupStep[] = [\n  {\n    id: 'install',\n    title: 'Install the CLI',\n    command: 'npm install -g @rulemetric/cli',\n    // Monotonic: the CLI must exist to produce any downstream signal, so it\n    // greens off auth or worker presence (nothing local phones home before).\n    async detect(): Promise<boolean> {\n      return isAuthenticated() || (await workerActive());\n    },\n    async plan(): Promise<StepPlan> {\n      return {\n        id: 'install',\n        title: 'Install the CLI',\n        command: 'npm install -g @rulemetric/cli',\n        artifacts: [\n          {\n            path: 'npm install -g @rulemetric/cli',\n            kind: 'command',\n            before: null,\n            after: 'rulemetric --version   # verifies the binary is on PATH',\n          },\n        ],\n      };\n    },\n    async apply(): Promise<void> {\n      runCommand('npm install -g @rulemetric/cli');\n    },\n  },\n  {\n    id: 'auth',\n    title: 'Authenticate',\n    command: 'rulemetric auth login',\n    async detect(): Promise<boolean> {\n      return isAuthenticated();\n    },\n    async plan(ctx): Promise<StepPlan> {\n      const envPath = join(ctx.configDir, 'env');\n      // Guard the read like the sibling helpers (readEnvValue /\n      // projectHooksSettings) do: a TOCTOU race or permission error between\n      // existsSync and readFileSync must NOT throw out of plan(). Fall back to\n      // a secret-free marker rather than crashing `setup plan`/`--show`.\n      let before: string | null = null;\n      if (existsSync(envPath)) {\n        try {\n          before = maskEnvFile(readFileSync(envPath, 'utf-8'));\n        } catch {\n          before = '(unreadable)';\n        }\n      }\n      const rawToken = readEnvValue(ctx.configDir, 'RULEMETRIC_ACCESS_TOKEN');\n      const tokenDisplay = rawToken ? maskToken(rawToken) : maskToken('<token-from-login>');\n      // Reconstruct EXACTLY what `auth login`'s saveEnvFile writes so the diff\n      // doesn't show phantom changes: line order [TOKEN, KEY?, URL?], the key\n      // preserved (masked) when present, and the URL sourced from\n      // process.env.RULEMETRIC_API_URL \u2014 the same value login passes \u2014 and OMITTED\n      // when unset (login writes no URL line then). All masking preserved; the raw\n      // token/key are never emitted.\n      const afterLines = [`RULEMETRIC_ACCESS_TOKEN=${tokenDisplay}`];\n      const rawApiKey = readEnvValue(ctx.configDir, 'RULEMETRIC_API_KEY');\n      if (rawApiKey) {\n        afterLines.push(`RULEMETRIC_API_KEY=${maskToken(rawApiKey)}`);\n      }\n      const loginUrl = process.env.RULEMETRIC_API_URL;\n      if (loginUrl) {\n        afterLines.push(`RULEMETRIC_API_URL=${loginUrl}`);\n      }\n      const after = afterLines.join('\\n');\n      return {\n        id: 'auth',\n        title: 'Authenticate',\n        command: 'rulemetric auth login',\n        artifacts: [\n          {\n            path: envPath,\n            kind: 'file',\n            before,\n            after,\n            masked: true,\n          },\n          // `auth login` (saveToken) also writes auth.json \u2014 disclose it so the\n          // plan matches every file apply() touches.\n          {\n            path: join(ctx.configDir, 'auth.json'),\n            kind: 'file',\n            before: existsSync(join(ctx.configDir, 'auth.json')) ? '(existing session tokens)' : null,\n            after: '{ accessToken, refreshToken, expiresAt, email }  \u2014 OAuth session tokens (secret)',\n            masked: true,\n          },\n        ],\n      };\n    },\n    async apply(): Promise<void> {\n      runCommand('rulemetric auth login');\n    },\n  },\n  {\n    id: 'hooks',\n    title: 'Install hooks + capture proxy',\n    // Default onboarding installs the FULL capture path: session hooks PLUS the\n    // MITM proxy (rendered-system-prompt / instruction linking + cross-tool\n    // capture). Every invasive side effect is disclosed up front in plan()\n    // below \u2014 nothing is silent. `hooks install` fails SAFE: if the CA sudo\n    // trust is declined it degrades to hooks-only (no machine-wide proxy pin),\n    // and HTTPS_PROXY is only pinned once the gateway actually answers on\n    // :8787 \u2014 so the default never bricks Claude Code. detect() greens on the\n    // capture hooks being present, so `coreComplete` is reachable even when the\n    // user declines the proxy.\n    command: 'rulemetric hooks install',\n    async detect(ctx): Promise<boolean> {\n      const settingsPath = join(ctx.projectPath, '.claude', 'settings.json');\n      if (!existsSync(settingsPath)) return false;\n      try {\n        const settings = JSON.parse(readFileSync(settingsPath, 'utf-8')) as Record<string, unknown>;\n        // Ready when capture hooks are actually wired up \u2014 NOT when a proxy env\n        // var was written (that greened even against a dead proxy port). The\n        // proxy is a best-effort upgrade layered on top; hooks presence is the\n        // honest \"capture is working\" signal.\n        return hasRulemetricClaudeHooks(settings);\n      } catch {\n        return false;\n      }\n    },\n    async plan(ctx): Promise<StepPlan> {\n      const settingsPath = join(ctx.projectPath, '.claude', 'settings.json');\n      const { before, after } = projectHooksSettings(ctx.projectPath);\n      const artifacts: Artifact[] = [\n        { path: settingsPath, kind: 'file', before, after },\n        // Disclose what the hooks DO, not just that they're registered \u2014 these\n        // are the privacy-relevant behaviors a user is consenting to.\n        {\n          path: 'what these hooks capture',\n          kind: 'service',\n          before: null,\n          after:\n            'session-end reimports the FULL transcript to the API; post-tool-use records each ' +\n            'tool call and snapshots the working tree to a LOCAL shadow git ref (paper-trail, ' +\n            'never pushed); user-prompt posts prompt text. All scoped to sessions in this project.',\n        },\n        // FULL DISCLOSURE of the proxy layer \u2014 every invasive side effect of\n        // `hooks install` \u00A72 is enumerated here so the default path hides\n        // nothing. Each degrades gracefully (see the step comment): a declined\n        // CA-trust sudo skips the machine-wide layer and stays hooks-only.\n        {\n          // The proxy env block `hooks install` \u00A72 adds to the SAME\n          // .claude/settings.json (HTTPS_PROXY / NO_PROXY / NODE_EXTRA_CA_CERTS).\n          path: `${settingsPath} (proxy env block)`,\n          kind: 'file',\n          ...projectProxyEnvSettings(ctx.projectPath),\n        },\n        {\n          path: 'system keychain \u2014 mitmproxy root CA',\n          kind: 'service',\n          before: existsSync(CERT_PATH) ? '(CA generated; trust state unchanged)' : '(no CA yet)',\n          after:\n            'Installs + trusts the mitmproxy CA (requires sudo). This lets the ' +\n            'proxy DECRYPT Claude Code HTTPS request/response bodies \u2014 the ' +\n            'capability that powers rendered-system-prompt / instruction linking. ' +\n            'Decline the sudo prompt and setup stays hooks-only (still fully onboarded).',\n        },\n        {\n          path: 'launchctl setenv HTTPS_PROXY (machine-wide, all GUI apps)',\n          kind: 'command',\n          before: null,\n          after: `http://localhost:${GATEWAY_PORT}  \u2014 routes every GUI app's HTTPS through the local gateway (only when the CA is trusted AND :${GATEWAY_PORT} is live)`,\n        },\n        {\n          path: 'VS Code + Cursor user settings (http.proxy)',\n          kind: 'file',\n          before: null,\n          after: `http.proxy \u2192 http://localhost:${GATEWAY_PORT} (+ http.proxyStrictSSL=false)`,\n        },\n        {\n          path: `gateway process on :${GATEWAY_PORT}`,\n          kind: 'service',\n          before: null,\n          after: 'started (routes Claude Code \u2192 mitmproxy \u2192 Anthropic; falls back to direct if mitmproxy is down)',\n        },\n      ];\n      // Workspace-level editor configs, only if those dirs exist here.\n      for (const tool of detectInstalledTools(ctx.projectPath).filter((t) => t === 'cursor' || t === 'copilot_agent')) {\n        artifacts.push({\n          path: `${ctx.projectPath} (${tool} workspace proxy config)`,\n          kind: 'file',\n          before: null,\n          after: `proxy \u2192 http://localhost:${GATEWAY_PORT}`,\n        });\n      }\n      return {\n        id: 'hooks',\n        title: 'Install hooks + capture proxy',\n        command: 'rulemetric hooks install',\n        artifacts,\n      };\n    },\n    async apply(): Promise<void> {\n      runCommand('rulemetric hooks install');\n    },\n  },\n  {\n    id: 'worker',\n    title: 'Run the worker',\n    command: 'rulemetric service install --worker-only',\n    async detect(): Promise<boolean> {\n      return workerActive();\n    },\n    async plan(): Promise<StepPlan> {\n      const isMac = process.platform === 'darwin';\n      const servicePath = isMac ? WORKER_PLIST_PATH : WORKER_SYSTEMD_PATH;\n      // SECURITY: never read the installed plist/systemd unit into `before` \u2014\n      // those files embed RULEMETRIC_ACCESS_TOKEN / RULEMETRIC_API_KEY verbatim\n      // (service/install.ts writes them from ALLOWED_ENV_VARS), so echoing the\n      // file contents would leak the raw secret through `plan`, `--show`, and\n      // `--json`. Use a synthetic, secret-free marker for the current state.\n      const before = existsSync(servicePath)\n        ? `(service already installed at ${servicePath})`\n        : null;\n      // Concise representation (path + ExecStart node/cli invocation) rather\n      // than reconstructing the full plist \u2014 keep read-only + legible.\n      const after = isMac\n        ? [\n            `Label: com.rulemetric.worker`,\n            `ProgramArguments: <node> <cli>/bin/run.js evals agent`,\n            `RunAtLoad: true, KeepAlive: true`,\n          ].join('\\n')\n        : [\n            `[Service]`,\n            `ExecStart=<node> <cli>/bin/run.js evals agent`,\n            `Restart=on-failure`,\n          ].join('\\n');\n      return {\n        id: 'worker',\n        title: 'Run the worker',\n        command: 'rulemetric service install --worker-only',\n        artifacts: [\n          { path: servicePath, kind: 'service', before, after },\n        ],\n      };\n    },\n    async apply(): Promise<void> {\n      runCommand('rulemetric service install --worker-only');\n    },\n  },\n];\n\nconst STEP_BY_ID = new Map<StepId, SetupStep>(STEPS.map((s) => [s.id, s]));\n\nexport function getStep(id: StepId): SetupStep {\n  const step = STEP_BY_ID.get(id);\n  if (!step) throw new Error(`Unknown setup step: ${id}`);\n  return step;\n}\n\nexport function isStepId(value: string): value is StepId {\n  return (ALL_STEP_IDS as readonly string[]).includes(value);\n}\n\n/**\n * Keys whose values are safe to show verbatim in the env-file diff. Everything\n * NOT in this set is masked. Deny-by-default is deliberate: `~/.config/rulemetric/env`\n * can legitimately hold DATABASE_URL, SUPABASE_SERVICE_ROLE_KEY, SUPABASE_JWT_SECRET,\n * GITHUB_TOKEN, RESEND_API_KEY, etc. (see ALLOWED_ENV_VARS in service/install.ts),\n * so an allowlist-to-hide would leak any secret we forgot to enumerate. Revealing\n * only known-safe keys means a future secret added to the file is masked automatically.\n */\nconst SAFE_ENV_KEYS = new Set([\n  'RULEMETRIC_API_URL',\n  'RULEMETRIC_USER_ID',\n  'RULEMETRIC_CLIENT_NAME',\n  'RESEND_FROM_EMAIL',\n  'SENTRY_DSN', // a DSN is not a secret\n  'PG_POOL_MAX',\n  'PG_IDLE_TIMEOUT',\n  'PG_STATEMENT_TIMEOUT_MS',\n  'NODE_ENV',\n]);\n\n/**\n * Mask secret-bearing lines in a raw env file for display. Deny-by-default:\n * every `KEY=value` line has its value masked unless KEY is in SAFE_ENV_KEYS.\n * Non-assignment lines (comments, blanks) pass through untouched.\n */\nfunction maskEnvFile(content: string): string {\n  return content\n    .replace(/\\n$/, '')\n    .split('\\n')\n    .map((line) => {\n      const match = line.match(/^([A-Z0-9_]+)=(.+)$/);\n      if (!match) return line; // comment / blank / non-assignment\n      const [, key, value] = match;\n      return SAFE_ENV_KEYS.has(key) ? line : `${key}=${maskToken(value)}`;\n    })\n    .join('\\n');\n}\n\n/**\n * Run every step's detect() and derive the overall status. `currentStepId` is\n * the first incomplete step in core order (mirrors the web reducer).\n */\nexport async function computeStatus(ctx: SetupContext = defaultContext()): Promise<SetupStatus> {\n  const steps: StepStatus[] = [];\n  for (const step of STEPS) {\n    // Sequential: detect() may hit the network; order is stable + cheap.\n    // eslint-disable-next-line no-await-in-loop\n    const done = await step.detect(ctx);\n    steps.push({ id: step.id, done });\n  }\n  // Monotonicity (mirrors the web reducer's `cliDetected`): the CLI binary must\n  // exist to produce ANY downstream signal, so `install` greens whenever auth,\n  // hooks, or worker is detected \u2014 even if `install.detect()` alone (which only\n  // sees auth/worker, not hooks) came back false. Without this, a user with\n  // hooks installed but no live worker sees \"Install the CLI: waiting\" while\n  // \"Install hooks: done\" \u2014 a contradiction.\n  const install = steps.find((s) => s.id === 'install');\n  if (install && !install.done) {\n    install.done = steps.some((s) => s.id !== 'install' && s.done);\n  }\n\n  // coreComplete + currentStepId are derived from CORE steps only. The proxy now\n  // ships inside the `hooks` step (whose detect() greens on hooks-presence, so a\n  // declined CA still completes it); any future OPTIONAL_STEP_IDS never block\n  // \"done\" or steal the cursor. Mirrors the web reducer's optional-step handling.\n  const coreIds = new Set<string>(CORE_STEP_IDS);\n  const coreSteps = steps.filter((s) => coreIds.has(s.id));\n  const currentStepId = coreSteps.find((s) => !s.done)?.id ?? null;\n  const coreComplete = coreSteps.every((s) => s.done);\n  return { steps, coreComplete, currentStepId };\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA,SAAS,gBAAgB;AACzB,SAAS,YAAY,oBAAoB;AACzC,SAAS,eAAe;AACxB,SAAS,YAAY;AA2Bd,IAAM,gBAAgB,CAAC,WAAW,QAAQ,SAAS,QAAQ;AAO3D,IAAM,oBAAoB,CAAC;AAC3B,IAAM,eAAe,CAAC,GAAG,eAAe,GAAG,iBAAiB;AAiD5D,SAAS,iBAA+B;AAC7C,SAAO;AAAA,IACL,aAAa,QAAQ,IAAI;AAAA,IACzB,WAAW,oBAAoB;AAAA,EACjC;AACF;AAEA,IAAM,YAAY,KAAK,QAAQ,GAAG,cAAc,uBAAuB;AAMhE,SAAS,UAAU,GAAmB;AAC3C,MAAI,CAAC,EAAG,QAAO;AACf,MAAI,EAAE,UAAU,EAAG,QAAO,IAAI,OAAO,EAAE,MAAM;AAC7C,QAAM,OAAO,EAAE,MAAM,GAAG,CAAC;AACzB,QAAM,OAAO,EAAE,MAAM,EAAE;AACvB,SAAO,GAAG,IAAI,GAAG,IAAI,OAAO,KAAK,IAAI,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI;AAC/D;AAMO,SAAS,WAAW,QAAuB,OAA8B;AAC9E,QAAM,cAAc,WAAW,OAAO,CAAC,IAAI,OAAO,QAAQ,OAAO,EAAE,EAAE,MAAM,IAAI;AAC/E,QAAM,aAAa,UAAU,OAAO,CAAC,IAAI,MAAM,QAAQ,OAAO,EAAE,EAAE,MAAM,IAAI;AAC5E,QAAM,MAAgB,CAAC;AACvB,QAAM,MAAM,KAAK,IAAI,YAAY,QAAQ,WAAW,MAAM;AAC1D,WAAS,IAAI,GAAG,IAAI,KAAK,KAAK;AAC5B,UAAM,IAAI,YAAY,CAAC;AACvB,UAAM,IAAI,WAAW,CAAC;AACtB,QAAI,MAAM,GAAG;AACX,UAAI,KAAK,IAAI,CAAC,EAAE;AAAA,IAClB,OAAO;AACL,UAAI,MAAM,OAAW,KAAI,KAAK,IAAI,CAAC,EAAE;AACrC,UAAI,MAAM,OAAW,KAAI,KAAK,IAAI,CAAC,EAAE;AAAA,IACvC;AAAA,EACF;AACA,SAAO,IAAI,KAAK,IAAI;AACtB;AAGA,SAAS,aAAa,WAAmB,KAA4B;AACnE,QAAM,UAAU,KAAK,WAAW,KAAK;AACrC,MAAI,CAAC,WAAW,OAAO,EAAG,QAAO;AACjC,MAAI;AACF,UAAM,UAAU,aAAa,SAAS,OAAO;AAC7C,UAAM,QAAQ,QAAQ,MAAM,IAAI,OAAO,IAAI,GAAG,UAAU,GAAG,CAAC;AAC5D,WAAO,QAAQ,MAAM,CAAC,IAAI;AAAA,EAC5B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAeA,eAAe,eAAiC;AAC9C,MAAI,CAAC,gBAAgB,EAAG,QAAO;AAC/B,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,KAAK;AAAA,MAChC,OAIG,mBAAmB;AAAA,MACtB,IAAI;AAAA,QAAe,CAAC,GAAG,WACrB,WAAW,MAAM,OAAO,IAAI,MAAM,sBAAsB,CAAC,GAAG,IAAI;AAAA,MAClE;AAAA,IACF,CAAC;AACD,WAAO,QAAQ,iBAAiB;AAAA,EAClC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,oBAAoB,aAAmF;AAC9G,QAAM,eAAe,KAAK,aAAa,WAAW,eAAe;AACjE,MAAI,WAAoC,CAAC;AACzC,MAAI,SAAwB;AAC5B,MAAI,WAAW,YAAY,GAAG;AAC5B,QAAI;AACF,eAAS,aAAa,cAAc,OAAO,EAAE,QAAQ,OAAO,EAAE;AAC9D,iBAAW,KAAK,MAAM,MAAM;AAAA,IAC9B,QAAQ;AACN,iBAAW,CAAC;AAAA,IACd;AAAA,EACF;AACA,SAAO,EAAE,UAAU,OAAO;AAC5B;AAQA,SAAS,qBAAqB,aAA+D;AAC3F,QAAM,EAAE,UAAU,OAAO,IAAI,oBAAoB,WAAW;AAC5D,uBAAqB,QAAQ;AAC7B,SAAO,EAAE,QAAQ,OAAO,KAAK,UAAU,UAAU,MAAM,CAAC,EAAE;AAC5D;AAMA,SAAS,wBAAwB,aAA+D;AAC9F,QAAM,EAAE,UAAU,OAAO,IAAI,oBAAoB,WAAW;AAC5D,QAAM,MAAM,EAAE,GAAK,SAAS,OAAkC,CAAC,EAAG;AAClE,MAAI,cAAc,oBAAoB,YAAY;AAClD,MAAI,WAAW;AACf,MAAI,sBAAsB;AAC1B,SAAO,EAAE,QAAQ,OAAO,KAAK,UAAU,EAAE,GAAG,UAAU,IAAI,GAAG,MAAM,CAAC,EAAE;AACxE;AAEA,IAAM,oBAAoB,KAAK,QAAQ,GAAG,WAAW,gBAAgB,6BAA6B;AAClG,IAAM,sBAAsB,KAAK,QAAQ,GAAG,WAAW,WAAW,QAAQ,2BAA2B;AAGrG,SAAS,WAAW,KAAmB;AACrC,WAAS,KAAK,EAAE,OAAO,UAAU,CAAC;AACpC;AAEO,IAAM,QAAqB;AAAA,EAChC;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,SAAS;AAAA;AAAA;AAAA,IAGT,MAAM,SAA2B;AAC/B,aAAO,gBAAgB,KAAM,MAAM,aAAa;AAAA,IAClD;AAAA,IACA,MAAM,OAA0B;AAC9B,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,SAAS;AAAA,QACT,WAAW;AAAA,UACT;AAAA,YACE,MAAM;AAAA,YACN,MAAM;AAAA,YACN,QAAQ;AAAA,YACR,OAAO;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,QAAuB;AAC3B,iBAAW,gCAAgC;AAAA,IAC7C;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,SAAS;AAAA,IACT,MAAM,SAA2B;AAC/B,aAAO,gBAAgB;AAAA,IACzB;AAAA,IACA,MAAM,KAAK,KAAwB;AACjC,YAAM,UAAU,KAAK,IAAI,WAAW,KAAK;AAKzC,UAAI,SAAwB;AAC5B,UAAI,WAAW,OAAO,GAAG;AACvB,YAAI;AACF,mBAAS,YAAY,aAAa,SAAS,OAAO,CAAC;AAAA,QACrD,QAAQ;AACN,mBAAS;AAAA,QACX;AAAA,MACF;AACA,YAAM,WAAW,aAAa,IAAI,WAAW,yBAAyB;AACtE,YAAM,eAAe,WAAW,UAAU,QAAQ,IAAI,UAAU,oBAAoB;AAOpF,YAAM,aAAa,CAAC,2BAA2B,YAAY,EAAE;AAC7D,YAAM,YAAY,aAAa,IAAI,WAAW,oBAAoB;AAClE,UAAI,WAAW;AACb,mBAAW,KAAK,sBAAsB,UAAU,SAAS,CAAC,EAAE;AAAA,MAC9D;AACA,YAAM,WAAW,QAAQ,IAAI;AAC7B,UAAI,UAAU;AACZ,mBAAW,KAAK,sBAAsB,QAAQ,EAAE;AAAA,MAClD;AACA,YAAM,QAAQ,WAAW,KAAK,IAAI;AAClC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,SAAS;AAAA,QACT,WAAW;AAAA,UACT;AAAA,YACE,MAAM;AAAA,YACN,MAAM;AAAA,YACN;AAAA,YACA;AAAA,YACA,QAAQ;AAAA,UACV;AAAA;AAAA;AAAA,UAGA;AAAA,YACE,MAAM,KAAK,IAAI,WAAW,WAAW;AAAA,YACrC,MAAM;AAAA,YACN,QAAQ,WAAW,KAAK,IAAI,WAAW,WAAW,CAAC,IAAI,8BAA8B;AAAA,YACrF,OAAO;AAAA,YACP,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,QAAuB;AAC3B,iBAAW,uBAAuB;AAAA,IACpC;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUP,SAAS;AAAA,IACT,MAAM,OAAO,KAAuB;AAClC,YAAM,eAAe,KAAK,IAAI,aAAa,WAAW,eAAe;AACrE,UAAI,CAAC,WAAW,YAAY,EAAG,QAAO;AACtC,UAAI;AACF,cAAM,WAAW,KAAK,MAAM,aAAa,cAAc,OAAO,CAAC;AAK/D,eAAO,yBAAyB,QAAQ;AAAA,MAC1C,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,MAAM,KAAK,KAAwB;AACjC,YAAM,eAAe,KAAK,IAAI,aAAa,WAAW,eAAe;AACrE,YAAM,EAAE,QAAQ,MAAM,IAAI,qBAAqB,IAAI,WAAW;AAC9D,YAAM,YAAwB;AAAA,QAC5B,EAAE,MAAM,cAAc,MAAM,QAAQ,QAAQ,MAAM;AAAA;AAAA;AAAA,QAGlD;AAAA,UACE,MAAM;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,OACE;AAAA,QAGJ;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA;AAAA;AAAA;AAAA,UAGE,MAAM,GAAG,YAAY;AAAA,UACrB,MAAM;AAAA,UACN,GAAG,wBAAwB,IAAI,WAAW;AAAA,QAC5C;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,MAAM;AAAA,UACN,QAAQ,WAAW,SAAS,IAAI,0CAA0C;AAAA,UAC1E,OACE;AAAA,QAIJ;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,OAAO,oBAAoB,YAAY,qGAAgG,YAAY;AAAA,QACrJ;AAAA,QACA;AAAA,UACE,MAAM;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,OAAO,sCAAiC,YAAY;AAAA,QACtD;AAAA,QACA;AAAA,UACE,MAAM,uBAAuB,YAAY;AAAA,UACzC,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,OAAO;AAAA,QACT;AAAA,MACF;AAEA,iBAAW,QAAQ,qBAAqB,IAAI,WAAW,EAAE,OAAO,CAAC,MAAM,MAAM,YAAY,MAAM,eAAe,GAAG;AAC/G,kBAAU,KAAK;AAAA,UACb,MAAM,GAAG,IAAI,WAAW,KAAK,IAAI;AAAA,UACjC,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,OAAO,iCAA4B,YAAY;AAAA,QACjD,CAAC;AAAA,MACH;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,SAAS;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,QAAuB;AAC3B,iBAAW,0BAA0B;AAAA,IACvC;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,SAAS;AAAA,IACT,MAAM,SAA2B;AAC/B,aAAO,aAAa;AAAA,IACtB;AAAA,IACA,MAAM,OAA0B;AAC9B,YAAM,QAAQ,QAAQ,aAAa;AACnC,YAAM,cAAc,QAAQ,oBAAoB;AAMhD,YAAM,SAAS,WAAW,WAAW,IACjC,iCAAiC,WAAW,MAC5C;AAGJ,YAAM,QAAQ,QACV;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI,IACX;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI;AACf,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,SAAS;AAAA,QACT,WAAW;AAAA,UACT,EAAE,MAAM,aAAa,MAAM,WAAW,QAAQ,MAAM;AAAA,QACtD;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,QAAuB;AAC3B,iBAAW,0CAA0C;AAAA,IACvD;AAAA,EACF;AACF;AAEA,IAAM,aAAa,IAAI,IAAuB,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAElE,SAAS,QAAQ,IAAuB;AAC7C,QAAM,OAAO,WAAW,IAAI,EAAE;AAC9B,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,uBAAuB,EAAE,EAAE;AACtD,SAAO;AACT;AAEO,SAAS,SAAS,OAAgC;AACvD,SAAQ,aAAmC,SAAS,KAAK;AAC3D;AAUA,IAAM,gBAAgB,oBAAI,IAAI;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOD,SAAS,YAAY,SAAyB;AAC5C,SAAO,QACJ,QAAQ,OAAO,EAAE,EACjB,MAAM,IAAI,EACV,IAAI,CAAC,SAAS;AACb,UAAM,QAAQ,KAAK,MAAM,qBAAqB;AAC9C,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,CAAC,EAAE,KAAK,KAAK,IAAI;AACvB,WAAO,cAAc,IAAI,GAAG,IAAI,OAAO,GAAG,GAAG,IAAI,UAAU,KAAK,CAAC;AAAA,EACnE,CAAC,EACA,KAAK,IAAI;AACd;AAMA,eAAsB,cAAc,MAAoB,eAAe,GAAyB;AAC9F,QAAM,QAAsB,CAAC;AAC7B,aAAW,QAAQ,OAAO;AAGxB,UAAM,OAAO,MAAM,KAAK,OAAO,GAAG;AAClC,UAAM,KAAK,EAAE,IAAI,KAAK,IAAI,KAAK,CAAC;AAAA,EAClC;AAOA,QAAM,UAAU,MAAM,KAAK,CAAC,MAAM,EAAE,OAAO,SAAS;AACpD,MAAI,WAAW,CAAC,QAAQ,MAAM;AAC5B,YAAQ,OAAO,MAAM,KAAK,CAAC,MAAM,EAAE,OAAO,aAAa,EAAE,IAAI;AAAA,EAC/D;AAMA,QAAM,UAAU,IAAI,IAAY,aAAa;AAC7C,QAAM,YAAY,MAAM,OAAO,CAAC,MAAM,QAAQ,IAAI,EAAE,EAAE,CAAC;AACvD,QAAM,gBAAgB,UAAU,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,MAAM;AAC5D,QAAM,eAAe,UAAU,MAAM,CAAC,MAAM,EAAE,IAAI;AAClD,SAAO,EAAE,OAAO,cAAc,cAAc;AAC9C;",
+  "names": []
+}

package/dist/commands/auth/login.js

@@ -1,3 +1,6 @@
+import {
+  ensureDeviceApiKey
+} from "../../chunk-3AEVHOTS.js";
 import {
   BaseCommand
 } from "../../chunk-SZ7VDCD6.js";
@@ -64,6 +67,7 @@ var AuthLogin = class _AuthLogin extends BaseCommand {
     });
     saveEnvFile(data.accessToken, process.env.RULEMETRIC_API_URL);
     await bootstrapActiveOrg();
+    await ensureDeviceApiKey(this.log.bind(this), this.warn.bind(this));
     this.log(`Logged in as ${data.email}`);
   }
 };

package/dist/commands/auth/login.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/commands/auth/login.ts"],
-  "sourcesContent": ["import { Flags } from '@oclif/core';\nimport { BaseCommand } from '../../base-command.js';\nimport { saveToken, saveEnvFile } from '../../lib/auth.js';\nimport { apiPost, ApiError } from '../../lib/api-client.js';\nimport { bootstrapActiveOrg } from '../../lib/active-org-refresh.js';\n\ninterface LoginResponse {\n  accessToken: string;\n  refreshToken: string;\n  expiresAt: string | null;\n  email: string;\n}\n\nexport default class AuthLogin extends BaseCommand {\n  static override description = 'Log in to RuleMetric';\n\n  static override examples = [\n    '<%= config.bin %> auth login',\n    '<%= config.bin %> auth login -e user@example.com',\n  ];\n\n  static override flags = {\n    email: Flags.string({ char: 'e', description: 'Email address' }),\n    password: Flags.string({ char: 'p', description: 'Password (for non-interactive use)' }),\n  };\n\n  async run(): Promise<void> {\n    const { flags } = await this.parse(AuthLogin);\n\n    let email = flags.email;\n    let password = flags.password;\n\n    if (!email || !password) {\n      // Interactive prompts hang forever with no output in a non-TTY (CI, SSH\n      // pipe, an agent driving the CLI). Fail fast with actionable guidance\n      // instead of appearing to freeze.\n      if (!process.stdin.isTTY) {\n        this.error(\n          'Missing credentials in a non-interactive shell. Pass --email/-e and --password/-p, ' +\n            'or set RULEMETRIC_API_KEY (create a key at https://rulemetric.com/settings).',\n        );\n      }\n      const { input, password: passwordPrompt } = await import('@inquirer/prompts');\n\n      if (!email) {\n        email = await input({ message: 'Email:' });\n      }\n\n      if (!password) {\n        password = await passwordPrompt({ message: 'Password:' });\n      }\n    }\n\n    let data: LoginResponse;\n    try {\n      data = await apiPost<LoginResponse>('/auth/login', { email, password });\n    } catch (err) {\n      // A 401 HERE means the email/password were rejected \u2014 not that a prior\n      // session expired. base-command's generic catch maps every 401 to\n      // \"Session expired. Run auth login\", which is nonsensical mid-login and\n      // loops the user. Give the real reason.\n      if (err instanceof ApiError && err.statusCode === 401) {\n        this.error('Invalid email or password.');\n      }\n      throw err;\n    }\n\n    const expiresAt = data.expiresAt ?? new Date(Date.now() + 3600 * 1000).toISOString();\n\n    saveToken({\n      accessToken: data.accessToken,\n      refreshToken: data.refreshToken,\n      expiresAt,\n      email: data.email,\n    });\n\n    saveEnvFile(data.accessToken, process.env.RULEMETRIC_API_URL);\n\n    // Bootstrap the active-org cache now that auth is available. BaseCommand\n    // fired the guarded refresh BEFORE login completed (no creds \u2192 401 \u2192\n    // swallowed); without this explicit retry, the cache stays empty until\n    // the user runs another CLI command, and any Claude Code session that\n    // fires in the meantime lands with org_id = NULL.\n    await bootstrapActiveOrg();\n\n    this.log(`Logged in as ${data.email}`);\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;AAAA,SAAS,aAAa;AAatB,IAAqB,YAArB,MAAqB,mBAAkB,YAAY;AAAA,EACjD,OAAgB,cAAc;AAAA,EAE9B,OAAgB,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,EACF;AAAA,EAEA,OAAgB,QAAQ;AAAA,IACtB,OAAO,MAAM,OAAO,EAAE,MAAM,KAAK,aAAa,gBAAgB,CAAC;AAAA,IAC/D,UAAU,MAAM,OAAO,EAAE,MAAM,KAAK,aAAa,qCAAqC,CAAC;AAAA,EACzF;AAAA,EAEA,MAAM,MAAqB;AACzB,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,MAAM,UAAS;AAE5C,QAAI,QAAQ,MAAM;AAClB,QAAI,WAAW,MAAM;AAErB,QAAI,CAAC,SAAS,CAAC,UAAU;AAIvB,UAAI,CAAC,QAAQ,MAAM,OAAO;AACxB,aAAK;AAAA,UACH;AAAA,QAEF;AAAA,MACF;AACA,YAAM,EAAE,OAAO,UAAU,eAAe,IAAI,MAAM,OAAO,mBAAmB;AAE5E,UAAI,CAAC,OAAO;AACV,gBAAQ,MAAM,MAAM,EAAE,SAAS,SAAS,CAAC;AAAA,MAC3C;AAEA,UAAI,CAAC,UAAU;AACb,mBAAW,MAAM,eAAe,EAAE,SAAS,YAAY,CAAC;AAAA,MAC1D;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,QAAuB,eAAe,EAAE,OAAO,SAAS,CAAC;AAAA,IACxE,SAAS,KAAK;AAKZ,UAAI,eAAe,YAAY,IAAI,eAAe,KAAK;AACrD,aAAK,MAAM,4BAA4B;AAAA,MACzC;AACA,YAAM;AAAA,IACR;AAEA,UAAM,YAAY,KAAK,aAAa,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,GAAI,EAAE,YAAY;AAEnF,cAAU;AAAA,MACR,aAAa,KAAK;AAAA,MAClB,cAAc,KAAK;AAAA,MACnB;AAAA,MACA,OAAO,KAAK;AAAA,IACd,CAAC;AAED,gBAAY,KAAK,aAAa,QAAQ,IAAI,kBAAkB;AAO5D,UAAM,mBAAmB;AAEzB,SAAK,IAAI,gBAAgB,KAAK,KAAK,EAAE;AAAA,EACvC;AACF;",
+  "sourcesContent": ["import { Flags } from '@oclif/core';\nimport { BaseCommand } from '../../base-command.js';\nimport { saveToken, saveEnvFile } from '../../lib/auth.js';\nimport { apiPost, ApiError } from '../../lib/api-client.js';\nimport { bootstrapActiveOrg } from '../../lib/active-org-refresh.js';\nimport { ensureDeviceApiKey } from '../../lib/ensure-api-key.js';\n\ninterface LoginResponse {\n  accessToken: string;\n  refreshToken: string;\n  expiresAt: string | null;\n  email: string;\n}\n\nexport default class AuthLogin extends BaseCommand {\n  static override description = 'Log in to RuleMetric';\n\n  static override examples = [\n    '<%= config.bin %> auth login',\n    '<%= config.bin %> auth login -e user@example.com',\n  ];\n\n  static override flags = {\n    email: Flags.string({ char: 'e', description: 'Email address' }),\n    password: Flags.string({ char: 'p', description: 'Password (for non-interactive use)' }),\n  };\n\n  async run(): Promise<void> {\n    const { flags } = await this.parse(AuthLogin);\n\n    let email = flags.email;\n    let password = flags.password;\n\n    if (!email || !password) {\n      // Interactive prompts hang forever with no output in a non-TTY (CI, SSH\n      // pipe, an agent driving the CLI). Fail fast with actionable guidance\n      // instead of appearing to freeze.\n      if (!process.stdin.isTTY) {\n        this.error(\n          'Missing credentials in a non-interactive shell. Pass --email/-e and --password/-p, ' +\n            'or set RULEMETRIC_API_KEY (create a key at https://rulemetric.com/settings).',\n        );\n      }\n      const { input, password: passwordPrompt } = await import('@inquirer/prompts');\n\n      if (!email) {\n        email = await input({ message: 'Email:' });\n      }\n\n      if (!password) {\n        password = await passwordPrompt({ message: 'Password:' });\n      }\n    }\n\n    let data: LoginResponse;\n    try {\n      data = await apiPost<LoginResponse>('/auth/login', { email, password });\n    } catch (err) {\n      // A 401 HERE means the email/password were rejected \u2014 not that a prior\n      // session expired. base-command's generic catch maps every 401 to\n      // \"Session expired. Run auth login\", which is nonsensical mid-login and\n      // loops the user. Give the real reason.\n      if (err instanceof ApiError && err.statusCode === 401) {\n        this.error('Invalid email or password.');\n      }\n      throw err;\n    }\n\n    const expiresAt = data.expiresAt ?? new Date(Date.now() + 3600 * 1000).toISOString();\n\n    saveToken({\n      accessToken: data.accessToken,\n      refreshToken: data.refreshToken,\n      expiresAt,\n      email: data.email,\n    });\n\n    saveEnvFile(data.accessToken, process.env.RULEMETRIC_API_URL);\n\n    // Bootstrap the active-org cache now that auth is available. BaseCommand\n    // fired the guarded refresh BEFORE login completed (no creds \u2192 401 \u2192\n    // swallowed); without this explicit retry, the cache stays empty until\n    // the user runs another CLI command, and any Claude Code session that\n    // fires in the meantime lands with org_id = NULL.\n    await bootstrapActiveOrg();\n\n    // Auto-mint a hooks/proxy API key so create-key isn't a separate manual\n    // step (best-effort; no-ops if a key already exists, never fails login).\n    await ensureDeviceApiKey(this.log.bind(this), this.warn.bind(this));\n\n    this.log(`Logged in as ${data.email}`);\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,aAAa;AActB,IAAqB,YAArB,MAAqB,mBAAkB,YAAY;AAAA,EACjD,OAAgB,cAAc;AAAA,EAE9B,OAAgB,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,EACF;AAAA,EAEA,OAAgB,QAAQ;AAAA,IACtB,OAAO,MAAM,OAAO,EAAE,MAAM,KAAK,aAAa,gBAAgB,CAAC;AAAA,IAC/D,UAAU,MAAM,OAAO,EAAE,MAAM,KAAK,aAAa,qCAAqC,CAAC;AAAA,EACzF;AAAA,EAEA,MAAM,MAAqB;AACzB,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,MAAM,UAAS;AAE5C,QAAI,QAAQ,MAAM;AAClB,QAAI,WAAW,MAAM;AAErB,QAAI,CAAC,SAAS,CAAC,UAAU;AAIvB,UAAI,CAAC,QAAQ,MAAM,OAAO;AACxB,aAAK;AAAA,UACH;AAAA,QAEF;AAAA,MACF;AACA,YAAM,EAAE,OAAO,UAAU,eAAe,IAAI,MAAM,OAAO,mBAAmB;AAE5E,UAAI,CAAC,OAAO;AACV,gBAAQ,MAAM,MAAM,EAAE,SAAS,SAAS,CAAC;AAAA,MAC3C;AAEA,UAAI,CAAC,UAAU;AACb,mBAAW,MAAM,eAAe,EAAE,SAAS,YAAY,CAAC;AAAA,MAC1D;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,QAAuB,eAAe,EAAE,OAAO,SAAS,CAAC;AAAA,IACxE,SAAS,KAAK;AAKZ,UAAI,eAAe,YAAY,IAAI,eAAe,KAAK;AACrD,aAAK,MAAM,4BAA4B;AAAA,MACzC;AACA,YAAM;AAAA,IACR;AAEA,UAAM,YAAY,KAAK,aAAa,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,GAAI,EAAE,YAAY;AAEnF,cAAU;AAAA,MACR,aAAa,KAAK;AAAA,MAClB,cAAc,KAAK;AAAA,MACnB;AAAA,MACA,OAAO,KAAK;AAAA,IACd,CAAC;AAED,gBAAY,KAAK,aAAa,QAAQ,IAAI,kBAAkB;AAO5D,UAAM,mBAAmB;AAIzB,UAAM,mBAAmB,KAAK,IAAI,KAAK,IAAI,GAAG,KAAK,KAAK,KAAK,IAAI,CAAC;AAElE,SAAK,IAAI,gBAAgB,KAAK,KAAK,EAAE;AAAA,EACvC;AACF;",
   "names": []
 }

package/dist/commands/auth/signup.js

@@ -0,0 +1,81 @@
+import {
+  ensureDeviceApiKey
+} from "../../chunk-3AEVHOTS.js";
+import {
+  BaseCommand
+} from "../../chunk-SZ7VDCD6.js";
+import "../../chunk-R56PH7YE.js";
+import {
+  bootstrapActiveOrg
+} from "../../chunk-SLL3OBKN.js";
+import "../../chunk-EKJ2CABV.js";
+import {
+  ApiError,
+  apiPost
+} from "../../chunk-ZRLYHBPN.js";
+import {
+  saveEnvFile,
+  saveToken
+} from "../../chunk-W2YERO7E.js";
+import "../../chunk-NSBPE2FW.js";
+
+// src/commands/auth/signup.ts
+import { Flags } from "@oclif/core";
+var AuthSignup = class _AuthSignup extends BaseCommand {
+  static description = "Create a RuleMetric account from the CLI";
+  static examples = [
+    "<%= config.bin %> auth signup",
+    "<%= config.bin %> auth signup -e user@example.com"
+  ];
+  static flags = {
+    email: Flags.string({ char: "e", description: "Email address" }),
+    password: Flags.string({ char: "p", description: "Password (min 8 chars; for non-interactive use)" })
+  };
+  async run() {
+    const { flags } = await this.parse(_AuthSignup);
+    let email = flags.email;
+    let password = flags.password;
+    if (!email || !password) {
+      if (!process.stdin.isTTY) {
+        this.error("Missing credentials in a non-interactive shell. Pass --email/-e and --password/-p.");
+      }
+      const { input, password: passwordPrompt } = await import("@inquirer/prompts");
+      if (!email) {
+        email = await input({ message: "Email:" });
+      }
+      if (!password) {
+        password = await passwordPrompt({ message: "Password (min 8 chars):" });
+      }
+    }
+    let data;
+    try {
+      data = await apiPost("/auth/signup", { email, password });
+    } catch (err) {
+      if (err instanceof ApiError && err.statusCode === 409) {
+        this.error(`An account with ${email} already exists. Run: rulemetric auth login -e ${email}`);
+      }
+      throw err;
+    }
+    if (data.confirmationRequired || !data.accessToken || !data.refreshToken) {
+      this.log(`Account created for ${data.email}.`);
+      this.log("Check your email and click the confirmation link, then run:");
+      this.log(`  rulemetric auth login -e ${data.email}`);
+      return;
+    }
+    const expiresAt = data.expiresAt ?? new Date(Date.now() + 3600 * 1e3).toISOString();
+    saveToken({
+      accessToken: data.accessToken,
+      refreshToken: data.refreshToken,
+      expiresAt,
+      email: data.email
+    });
+    saveEnvFile(data.accessToken, process.env.RULEMETRIC_API_URL);
+    await bootstrapActiveOrg();
+    await ensureDeviceApiKey(this.log.bind(this), this.warn.bind(this));
+    this.log(`Signed up and logged in as ${data.email}`);
+  }
+};
+export {
+  AuthSignup as default
+};
+//# sourceMappingURL=signup.js.map