@siteknock/cli 0.1.6

package/cli.js

@@ -0,0 +1,2223 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { existsSync as existsSync8, readFileSync as readFileSync4 } from "fs";
+import path12 from "path";
+import process6 from "process";
+import { fileURLToPath as fileURLToPath2 } from "url";
+
+// src/commands/app.ts
+import { existsSync } from "fs";
+import { spawn } from "child_process";
+import path2 from "path";
+import process2 from "process";
+import { parseArgs } from "util";
+
+// src/lib/workspace.ts
+import { createHash } from "crypto";
+import { mkdir, readFile, writeFile } from "fs/promises";
+import path from "path";
+import { z } from "zod";
+var WORKSPACE_CONFIG_FILENAME = "sk-cli.json";
+var projectFolderNameSchema = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/);
+var workspaceLicenseSchema = z.object({
+  token: z.string().min(1),
+  updatedAt: z.string().min(1).optional()
+});
+var workspaceProjectInputSchema = z.object({
+  path: z.string().min(1).optional(),
+  createdAt: z.string().min(1).optional(),
+  updatedAt: z.string().min(1).optional(),
+  bundleVersion: z.string().min(1).optional(),
+  licenseId: z.string().min(1).optional()
+});
+var workspaceProjectSchema = z.object({
+  path: z.string().min(1),
+  createdAt: z.string().min(1),
+  updatedAt: z.string().min(1),
+  bundleVersion: z.string().min(1).optional(),
+  licenseId: z.string().min(1).optional()
+});
+var studioModeSchema = z.enum(["docker", "app"]);
+var workspaceManifestInputSchema = z.object({
+  version: z.literal(1),
+  studio: z.object({
+    defaultProject: projectFolderNameSchema.optional(),
+    mode: studioModeSchema.optional(),
+    image: z.string().min(1).optional(),
+    appInstallUrl: z.string().url().optional(),
+    port: z.number().int().positive().max(65535).optional(),
+    containerName: z.string().min(1).optional()
+  }).default({}),
+  siteknockKb: z.object({
+    path: z.string().min(1),
+    version: z.string().min(1),
+    updatedAt: z.string().min(1)
+  }).optional(),
+  licenses: z.record(z.string().min(1), workspaceLicenseSchema).default({}),
+  projects: z.record(projectFolderNameSchema, workspaceProjectInputSchema).default({})
+});
+var workspaceManifestSchema = z.object({
+  version: z.literal(1),
+  studio: z.object({
+    defaultProject: projectFolderNameSchema.optional(),
+    mode: studioModeSchema.optional(),
+    image: z.string().min(1).optional(),
+    appInstallUrl: z.string().url().optional(),
+    port: z.number().int().positive().max(65535).optional(),
+    containerName: z.string().min(1).optional()
+  }).default({}),
+  siteknockKb: z.object({
+    path: z.string().min(1),
+    version: z.string().min(1),
+    updatedAt: z.string().min(1)
+  }).optional(),
+  licenses: z.record(z.string().min(1), workspaceLicenseSchema).default({}),
+  projects: z.record(projectFolderNameSchema, workspaceProjectSchema).default({})
+});
+function createDefaultWorkspaceManifest() {
+  return {
+    version: 1,
+    studio: {},
+    licenses: {},
+    projects: {}
+  };
+}
+function createWorkspaceLicenseId(input3) {
+  return createHash("sha256").update(input3.token).digest("hex");
+}
+function pruneUnusedLicenses(licenses, projects) {
+  const activeLicenseIds = new Set(
+    Object.values(projects).map((project) => project.licenseId).filter((licenseId) => typeof licenseId === "string" && licenseId.length > 0)
+  );
+  return Object.fromEntries(Object.entries(licenses).filter(([licenseId]) => activeLicenseIds.has(licenseId)));
+}
+async function resolveWorkspaceRoot(startDir) {
+  let currentDir = path.resolve(startDir);
+  for (; ; ) {
+    const configPath = path.join(currentDir, WORKSPACE_CONFIG_FILENAME);
+    if (await fileExists(configPath)) {
+      return currentDir;
+    }
+    const parentDir = path.dirname(currentDir);
+    if (parentDir === currentDir) {
+      return path.resolve(startDir);
+    }
+    currentDir = parentDir;
+  }
+}
+async function readWorkspaceManifest(workspaceRoot) {
+  const configPath = getWorkspaceConfigPath(workspaceRoot);
+  try {
+    const raw = await readFile(configPath, "utf8");
+    const parsed = workspaceManifestInputSchema.parse(JSON.parse(raw));
+    return normalizeWorkspaceManifest(parsed);
+  } catch (error) {
+    if (isMissingFileError(error)) {
+      return createDefaultWorkspaceManifest();
+    }
+    if (error instanceof z.ZodError) {
+      throw new Error(`Invalid ${WORKSPACE_CONFIG_FILENAME}: ${error.issues.map((issue) => issue.message).join("; ")}`);
+    }
+    if (error instanceof SyntaxError) {
+      throw new Error(`Invalid JSON in ${WORKSPACE_CONFIG_FILENAME}`);
+    }
+    throw error;
+  }
+}
+async function writeWorkspaceManifest(workspaceRoot, manifest) {
+  const configPath = getWorkspaceConfigPath(workspaceRoot);
+  await mkdir(workspaceRoot, { recursive: true });
+  await writeFile(configPath, `${JSON.stringify(workspaceManifestSchema.parse(manifest), null, 2)}
+`, {
+    encoding: "utf8",
+    mode: 384
+  });
+}
+function getWorkspaceConfigPath(workspaceRoot) {
+  return path.join(workspaceRoot, WORKSPACE_CONFIG_FILENAME);
+}
+function resolveTopLevelProjectDirectory(workspaceRoot, rawProjectDir) {
+  const trimmed = rawProjectDir.trim();
+  if (!trimmed) {
+    throw new Error("Missing project folder. Pass --project <folder-name> or -p <folder-name>.");
+  }
+  const resolvedPath = path.resolve(workspaceRoot, trimmed);
+  const relativePath = path.relative(workspaceRoot, resolvedPath);
+  const segments = relativePath.split(path.sep).filter(Boolean);
+  if (relativePath === "" || relativePath.startsWith("..") || path.isAbsolute(relativePath) || segments.length !== 1) {
+    throw new Error(`Project folder must be a direct child of ${workspaceRoot}`);
+  }
+  const [projectName] = segments;
+  projectFolderNameSchema.parse(projectName);
+  return {
+    projectName,
+    projectDir: path.join(workspaceRoot, projectName)
+  };
+}
+function getProjectNameFromDirectory(workspaceRoot, projectDir) {
+  return resolveTopLevelProjectDirectory(workspaceRoot, path.relative(workspaceRoot, projectDir)).projectName;
+}
+function listWorkspaceProjects(manifest) {
+  return Object.keys(manifest.projects).sort((left, right) => left.localeCompare(right));
+}
+function readProjectActivation(manifest, projectName) {
+  const licenseId = manifest.projects[projectName]?.licenseId;
+  if (!licenseId) {
+    return null;
+  }
+  return manifest.licenses[licenseId] ?? null;
+}
+function resolvePreferredProject(manifest) {
+  const configured = manifest.studio.defaultProject;
+  if (configured && manifest.projects[configured]) {
+    return configured;
+  }
+  return listWorkspaceProjects(manifest)[0] ?? null;
+}
+function withStudioSettings(manifest, input3) {
+  return {
+    ...manifest,
+    studio: {
+      ...manifest.studio,
+      ...input3.defaultProject ? { defaultProject: input3.defaultProject } : {},
+      ...input3.mode ? { mode: input3.mode } : {},
+      ...input3.image ? { image: input3.image } : {},
+      ...input3.appInstallUrl ? { appInstallUrl: input3.appInstallUrl } : {},
+      ...typeof input3.port === "number" ? { port: input3.port } : {},
+      ...input3.containerName ? { containerName: input3.containerName } : {}
+    }
+  };
+}
+function withRegisteredProject(manifest, input3) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const existing = manifest.projects[input3.projectName];
+  const licenseId = input3.activation ? createWorkspaceLicenseId(input3.activation) : existing?.licenseId;
+  const nextProject = {
+    path: input3.projectName,
+    createdAt: existing?.createdAt ?? now,
+    updatedAt: now,
+    ...input3.bundleVersion ? { bundleVersion: input3.bundleVersion } : existing?.bundleVersion ? { bundleVersion: existing.bundleVersion } : {},
+    ...licenseId ? { licenseId } : {}
+  };
+  const nextProjects = {
+    ...manifest.projects,
+    [input3.projectName]: nextProject
+  };
+  const nextLicenses = input3.activation && licenseId ? {
+    ...manifest.licenses,
+    [licenseId]: {
+      ...manifest.licenses[licenseId] ?? {},
+      token: input3.activation.token,
+      updatedAt: now
+    }
+  } : manifest.licenses;
+  return {
+    ...manifest,
+    licenses: pruneUnusedLicenses(nextLicenses, nextProjects),
+    projects: nextProjects,
+    studio: {
+      ...manifest.studio,
+      ...input3.selected === true ? { defaultProject: input3.projectName } : {}
+    }
+  };
+}
+function withSiteknockKb(manifest, input3) {
+  return {
+    ...manifest,
+    siteknockKb: {
+      path: input3.path,
+      version: input3.version,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    }
+  };
+}
+function normalizeWorkspaceManifest(manifest) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const projects = Object.fromEntries(
+    Object.entries(manifest.projects).map(([projectName, project]) => {
+      const createdAt = project.createdAt ?? project.updatedAt ?? now;
+      const updatedAt = project.updatedAt ?? project.createdAt ?? now;
+      const licenseId = project.licenseId && manifest.licenses[project.licenseId] ? project.licenseId : void 0;
+      return [
+        projectName,
+        {
+          path: project.path ?? projectName,
+          createdAt,
+          updatedAt,
+          ...project.bundleVersion ? { bundleVersion: project.bundleVersion } : {},
+          ...licenseId ? { licenseId } : {}
+        }
+      ];
+    })
+  );
+  return workspaceManifestSchema.parse({
+    ...manifest,
+    licenses: pruneUnusedLicenses(manifest.licenses, projects),
+    projects
+  });
+}
+function isMissingFileError(error) {
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+async function fileExists(filePath) {
+  try {
+    await readFile(filePath, "utf8");
+    return true;
+  } catch (error) {
+    if (isMissingFileError(error)) {
+      return false;
+    }
+    throw error;
+  }
+}
+
+// src/commands/app.ts
+var appFlags = {
+  project: { type: "string", short: "p" }
+};
+async function runAppCommand(argv) {
+  const subArgs = argv.slice(1);
+  const subcommand = subArgs.find((value) => !value.startsWith("-"));
+  if (!subcommand || subcommand === "help") {
+    printAppHelp();
+    return;
+  }
+  const parsed = parseArgs({ args: subArgs, options: appFlags, allowPositionals: true, strict: false });
+  const projectDir = await resolveProjectDir(parsed.values.project);
+  const appCliPath = path2.join(projectDir, "node_modules", "@siteknock", "generator", "app-cli.mjs");
+  if (!existsSync(appCliPath)) {
+    throw new Error(`Could not find @siteknock/generator in ${projectDir}. Run install in the project first.`);
+  }
+  const forwarded = stripProjectFlag(subArgs);
+  await delegate(appCliPath, projectDir, forwarded);
+}
+async function resolveProjectDir(projectFlag) {
+  const workspaceRoot = await resolveWorkspaceRoot(process2.cwd());
+  if (projectFlag) {
+    return resolveTopLevelProjectDirectory(workspaceRoot, projectFlag).projectDir;
+  }
+  if (existsSync(path2.join(process2.cwd(), "config", "sk-config.jsonc"))) {
+    return process2.cwd();
+  }
+  const manifest = await readWorkspaceManifest(workspaceRoot);
+  const defaultProject = manifest.studio.defaultProject;
+  if (defaultProject) {
+    return resolveTopLevelProjectDirectory(workspaceRoot, defaultProject).projectDir;
+  }
+  throw new Error("No project specified. Pass --project <folder> or run inside a project directory.");
+}
+function stripProjectFlag(args) {
+  const out = [];
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === "--project" || arg === "-p") {
+      i += 1;
+      continue;
+    }
+    if (arg.startsWith("--project=")) continue;
+    out.push(arg);
+  }
+  return out;
+}
+function delegate(appCliPath, projectDir, args) {
+  return new Promise((resolve, reject) => {
+    const child = spawn("node", [appCliPath, ...args], { cwd: projectDir, stdio: "inherit" });
+    child.on("error", reject);
+    child.on("exit", (code) => {
+      if (code === 0) resolve();
+      else reject(new Error(`app command exited with code ${code ?? "null"}`));
+    });
+  });
+}
+function printAppHelp() {
+  console.log(`
+  siteknock app \u2014 manage apps within a project
+
+  Usage:
+    siteknock app create --project <folder> --name <n> --type <fe|be|fe+be|e2e> [options]
+    siteknock app list   --project <folder>
+    siteknock app remove --project <folder> --name <n>
+
+  Create options:
+    --targets a,b       e2e: comma-separated target app names
+    --frontend <folder> override frontend folder name
+    --backend <folder>  override backend folder name
+    --fe-port <n>       frontend port
+    --be-port <n>       backend port
+    --no-generate       skip running the generator after creation
+`);
+}
+
+// src/commands/create.ts
+import { mkdir as mkdir3, mkdtemp as mkdtemp2, rm as rm2, stat } from "fs/promises";
+import { tmpdir as tmpdir2 } from "os";
+import { spawn as spawn2 } from "child_process";
+import path7 from "path";
+import { parseArgs as parseArgs2 } from "util";
+import semver from "semver";
+import { z as z4 } from "zod";
+
+// src/lib/config.ts
+import path3 from "path";
+import process3 from "process";
+import readline from "readline/promises";
+import { existsSync as existsSync2, readFileSync } from "fs";
+import { stdin as input, stdout as output } from "process";
+import { fileURLToPath } from "url";
+import { parseEnv } from "util";
+var DEV_LICENSE_URL_ENV = "SK_DEV_LICENSE_URL";
+var DEV_REGISTRY_URL_ENV = "SK_DEV_REGISTRY_URL";
+var DEV_GENERATOR_PACKAGE_ENV = "SK_DEV_GENERATOR_PACKAGE";
+var PRODUCTION_LICENSE_URL = "https://api.siteknock.com";
+var PRODUCTION_REGISTRY_URL = "https://registry.siteknock.com";
+var PRODUCTION_GENERATOR_PACKAGE = "@siteknock/generator";
+function loadEnvFile(explicitPath) {
+  if (!isInternalDevelopmentMode() || !explicitPath) {
+    return;
+  }
+  const layeredEnv = readEnvFile(explicitPath);
+  for (const [key, value] of Object.entries(layeredEnv)) {
+    if (process3.env[key] === void 0) {
+      process3.env[key] = value;
+    }
+  }
+}
+async function getConfig(input3) {
+  const workspaceRoot = await resolveWorkspaceRoot(input3.workspaceRoot ?? process3.cwd());
+  const manifest = await readWorkspaceManifest(workspaceRoot);
+  const selectedProjectName = input3.projectName ?? resolvePreferredProject(manifest) ?? void 0;
+  const projectDir = input3.projectDir ? resolveTopLevelProjectDirectory(workspaceRoot, input3.projectDir).projectDir : selectedProjectName ? path3.join(workspaceRoot, selectedProjectName) : workspaceRoot;
+  const licenseUrl = stripTrailingSlash(resolveLicenseUrl());
+  const registryUrl = stripTrailingSlash(resolveRegistryUrl());
+  const generatorPackage = resolveGeneratorPackage();
+  const manifestToken = selectedProjectName ? readProjectActivation(manifest, selectedProjectName)?.token : void 0;
+  return {
+    token: input3.token ?? manifestToken ?? process3.env.SITEKNOCK_TOKEN,
+    workspaceRoot,
+    projectDir,
+    licenseUrl,
+    registryUrl,
+    generatorPackage,
+    requestedVersion: input3.requestedVersion,
+    yes: input3.yes === true
+  };
+}
+async function promptForMissingFields(config) {
+  return promptForMissingFieldsWithOptions(config);
+}
+async function promptForMissingFieldsWithOptions(config, options) {
+  if (config.yes) {
+    return requireFields(config, options);
+  }
+  const rl = readline.createInterface({ input, output });
+  try {
+    const shouldAskForProjectFolder = !options?.skipProjectDirPrompt && config.projectDir === config.workspaceRoot;
+    const projectDirInput = shouldAskForProjectFolder ? await rl.question("Project folder: ") : "";
+    const projectDir = projectDirInput.trim() ? resolveTopLevelProjectDirectory(config.workspaceRoot, projectDirInput.trim()).projectDir : config.projectDir;
+    const shouldContinue = await rl.question(
+      "Continue with SiteKnock browser sign-in + entitlement verification? [y/N]: "
+    );
+    if (!/^y(es)?$/i.test(shouldContinue.trim())) {
+      throw new Error("Cancelled by user");
+    }
+    return requireFields(
+      {
+        ...config,
+        projectDir
+      },
+      options
+    );
+  } finally {
+    rl.close();
+  }
+}
+function requireFields(config, options) {
+  if (!options?.skipProjectDirPrompt && (!config.projectDir || config.projectDir === config.workspaceRoot)) {
+    throw new Error("Missing project folder. Pass --project <folder-name> or -p <folder-name>.");
+  }
+  if (!config.licenseUrl) throw new Error("Missing built-in licensing API URL.");
+  if (!config.registryUrl) throw new Error("Missing built-in registry URL.");
+  if (!config.generatorPackage) throw new Error("Missing built-in generator package.");
+  return {
+    token: config.token,
+    workspaceRoot: config.workspaceRoot,
+    projectDir: config.projectDir,
+    licenseUrl: config.licenseUrl,
+    registryUrl: config.registryUrl,
+    generatorPackage: config.generatorPackage,
+    requestedVersion: config.requestedVersion ?? "",
+    yes: config.yes
+  };
+}
+function stripTrailingSlash(value) {
+  return value.replace(/\/+$/, "");
+}
+function readHiddenOverride(envName) {
+  if (!isInternalDevelopmentMode()) {
+    return void 0;
+  }
+  const value = process3.env[envName]?.trim();
+  return value ? value : void 0;
+}
+function findInternalDevelopmentRoot() {
+  const moduleDir = path3.dirname(fileURLToPath(import.meta.url));
+  const packageRoot = findNearestPackageRoot(moduleDir);
+  if (!packageRoot) {
+    return void 0;
+  }
+  if (existsSync2(path3.join(packageRoot, "src", "cli.ts")) && existsSync2(path3.join(packageRoot, ".env.example"))) {
+    return packageRoot;
+  }
+  return void 0;
+}
+function isInternalDevelopmentMode() {
+  return findInternalDevelopmentRoot() !== void 0;
+}
+function findNearestPackageRoot(startDir) {
+  let currentDir = path3.resolve(startDir);
+  for (; ; ) {
+    if (existsSync2(path3.join(currentDir, "package.json"))) {
+      return currentDir;
+    }
+    const parentDir = path3.dirname(currentDir);
+    if (parentDir === currentDir) {
+      return void 0;
+    }
+    currentDir = parentDir;
+  }
+}
+function readEnvFile(filePath) {
+  if (!filePath || !existsSync2(filePath)) {
+    return {};
+  }
+  const parsed = parseEnv(readFileSync(filePath, "utf8"));
+  return Object.fromEntries(
+    Object.entries(parsed).filter((entry) => typeof entry[1] === "string")
+  );
+}
+function resolveLicenseUrl() {
+  return readHiddenOverride(DEV_LICENSE_URL_ENV) ?? readDevelopmentEnv("SK_LICENSE_API_URL") ?? PRODUCTION_LICENSE_URL;
+}
+function resolveRegistryUrl() {
+  return readHiddenOverride(DEV_REGISTRY_URL_ENV) ?? readDevelopmentEnv("SK_REGISTRY_URL") ?? PRODUCTION_REGISTRY_URL;
+}
+function resolveGeneratorPackage() {
+  return readHiddenOverride(DEV_GENERATOR_PACKAGE_ENV) ?? readDevelopmentEnv("SK_GENERATOR_PACKAGE") ?? PRODUCTION_GENERATOR_PACKAGE;
+}
+function readDevelopmentEnv(envName) {
+  if (!isInternalDevelopmentMode()) {
+    return void 0;
+  }
+  const value = process3.env[envName]?.trim();
+  return value ? value : void 0;
+}
+
+// src/lib/http.ts
+import { z as z2 } from "zod";
+var authorizedLicenseSchema = z2.object({
+  status: z2.literal("approved"),
+  token: z2.string().min(1),
+  customer_name: z2.string(),
+  plan: z2.string(),
+  min_version: z2.string(),
+  max_version: z2.string(),
+  project_seats: z2.number(),
+  seat_index: z2.number().int().nullable().optional(),
+  licensing_document: z2.unknown().nullable().optional(),
+  expires_at: z2.string().nullable().optional(),
+  registry_url: z2.string().url().optional(),
+  generator_package: z2.string().min(1).optional(),
+  studio_image: z2.string().min(1).optional(),
+  studio_app_install_url: z2.string().url().nullable().optional()
+});
+var deviceAuthorizationStartSchema = z2.object({
+  device_code: z2.string().min(1),
+  user_code: z2.string().min(1),
+  verification_uri: z2.string().url(),
+  verification_uri_complete: z2.string().url(),
+  interval: z2.number().int().positive(),
+  expires_at: z2.string()
+});
+var deviceAuthorizationPollSchema = z2.discriminatedUnion("status", [
+  z2.object({
+    status: z2.literal("pending")
+  }),
+  z2.object({
+    status: z2.literal("expired"),
+    error: z2.string().optional()
+  }),
+  authorizedLicenseSchema
+]);
+var entitlementSchema = z2.object({
+  valid: z2.literal(true),
+  customer_name: z2.string(),
+  plan: z2.string(),
+  min_version: z2.string(),
+  max_version: z2.string(),
+  cli_seats: z2.number().int().positive(),
+  studio_seats: z2.number().int().positive(),
+  renewal_active: z2.boolean(),
+  expires_at: z2.string().nullable().optional()
+});
+async function startDeviceAuthorization(input3) {
+  const response = await fetch(`${input3.licenseUrl}/api/cli/connect/start`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      requested_version: input3.requestedVersion ?? null,
+      purpose: input3.purpose ?? "create",
+      public_key: input3.publicKey ?? null,
+      machine_hash: input3.machineHash ?? null,
+      app_path_hash: input3.appPathHash ?? null,
+      project_name: input3.projectName ?? null,
+      workspace_name: input3.workspaceName ?? null,
+      workspace_path: input3.workspacePath ?? null
+    })
+  });
+  const body = await parseJson(response);
+  if (!response.ok) {
+    throw new Error(extractApiError(body, "Device authorization could not be started"));
+  }
+  const parsed = deviceAuthorizationStartSchema.parse(body);
+  return {
+    deviceCode: parsed.device_code,
+    userCode: parsed.user_code,
+    verificationUri: parsed.verification_uri,
+    verificationUriComplete: parsed.verification_uri_complete,
+    intervalSeconds: parsed.interval,
+    expiresAt: parsed.expires_at
+  };
+}
+async function pollDeviceAuthorization(input3) {
+  const response = await fetch(
+    `${input3.licenseUrl}/api/cli/connect/poll?device_code=${encodeURIComponent(input3.deviceCode)}`,
+    {
+      method: "GET"
+    }
+  );
+  const body = await parseJson(response);
+  if (!response.ok && response.status !== 404) {
+    throw new Error(extractApiError(body, "Device authorization polling failed"));
+  }
+  const parsed = deviceAuthorizationPollSchema.parse(body);
+  if (parsed.status === "pending") {
+    return { status: "pending" };
+  }
+  if (parsed.status === "expired") {
+    return {
+      status: "expired",
+      reason: parsed.error ?? "Authorization expired before approval completed"
+    };
+  }
+  return {
+    status: "approved",
+    token: parsed.token,
+    customerName: parsed.customer_name,
+    plan: parsed.plan,
+    minVersion: parsed.min_version,
+    maxVersion: parsed.max_version,
+    projectSeats: parsed.project_seats,
+    seatIndex: parsed.seat_index ?? null,
+    licensingDocument: parsed.licensing_document ?? null,
+    expiresAt: parsed.expires_at ?? null,
+    registryUrl: parsed.registry_url,
+    generatorPackage: parsed.generator_package,
+    studioImage: parsed.studio_image,
+    studioAppInstallUrl: parsed.studio_app_install_url ?? null
+  };
+}
+async function getEntitlement(input3) {
+  const response = await fetch(`${input3.licenseUrl}/api/entitlement`, {
+    method: "GET",
+    headers: {
+      Authorization: `Bearer ${input3.token}`
+    }
+  });
+  const body = await parseJson(response);
+  if (!response.ok) {
+    throw new Error(extractApiError(body, "Entitlement check failed"));
+  }
+  const parsed = entitlementSchema.parse(body);
+  return {
+    customerName: parsed.customer_name,
+    plan: parsed.plan,
+    minVersion: parsed.min_version,
+    maxVersion: parsed.max_version,
+    cliSeats: parsed.cli_seats,
+    studioSeats: parsed.studio_seats,
+    renewalActive: parsed.renewal_active,
+    expiresAt: parsed.expires_at ?? null
+  };
+}
+async function parseJson(response) {
+  const contentType = response.headers.get("content-type") ?? "";
+  if (!contentType.includes("application/json")) {
+    const text = await response.text();
+    return { error: text };
+  }
+  return response.json();
+}
+function extractApiError(body, fallback) {
+  if (typeof body === "object" && body !== null) {
+    const candidate = body;
+    const reason = candidate.reason;
+    const message = candidate.message;
+    const error = candidate.error;
+    if (typeof reason === "string" && reason) return reason;
+    if (typeof message === "string" && message) return message;
+    if (typeof error === "string" && error) return error;
+  }
+  return fallback;
+}
+
+// src/lib/device-auth.ts
+async function authorizeLicenseWithBrowser(config) {
+  const session = await startDeviceAuthorization({
+    licenseUrl: config.licenseUrl,
+    requestedVersion: config.requestedVersion || void 0,
+    purpose: config.purpose ?? "create",
+    publicKey: config.publicKey,
+    machineHash: config.machineHash,
+    appPathHash: config.appPathHash,
+    projectName: config.projectName,
+    workspaceName: config.workspaceName,
+    workspacePath: config.workspacePath
+  });
+  printAuthorizationInstructions(session);
+  for (; ; ) {
+    await sleep(session.intervalSeconds * 1e3);
+    const result = await pollDeviceAuthorization({
+      licenseUrl: config.licenseUrl,
+      deviceCode: session.deviceCode
+    });
+    if (result.status === "pending") {
+      continue;
+    }
+    if (result.status === "expired") {
+      throw new Error(result.reason);
+    }
+    return result;
+  }
+}
+function printAuthorizationInstructions(session) {
+  console.log("Sign in to SiteKnock in your browser and choose the license to use for this command.");
+  console.log(`Open: ${session.verificationUri}`);
+  console.log(`Code: ${session.userCode}`);
+  console.log(`Direct link: ${session.verificationUriComplete}`);
+  console.log(`This request expires at ${session.expiresAt}`);
+  console.log("Waiting for approval...");
+}
+async function sleep(ms) {
+  await new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/lib/cli-identity.ts
+import crypto2 from "crypto";
+import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import path4 from "path";
+import { z as z3 } from "zod";
+
+// ../packages/common-utils/src/machine.ts
+import cp from "child_process";
+import fs from "fs";
+import os from "os";
+var cachedMachineFingerprint = null;
+function getMachineFingerprint() {
+  if (cachedMachineFingerprint !== null) {
+    return cachedMachineFingerprint;
+  }
+  cachedMachineFingerprint = computeMachineFingerprint();
+  return cachedMachineFingerprint;
+}
+function computeMachineFingerprint() {
+  const platform = os.platform();
+  const arch = os.arch();
+  try {
+    if (platform === "darwin") {
+      const output3 = cp.execSync("ioreg -rd1 -c IOPlatformExpertDevice", {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 2e3
+      });
+      const match = output3.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/i);
+      if (match && match[1]) {
+        return `${platform}|${arch}|macos-uuid:${match[1].trim()}`;
+      }
+    } else if (platform === "linux") {
+      for (const idPath of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+        if (fs.existsSync(idPath)) {
+          const id = fs.readFileSync(idPath, "utf8").trim();
+          if (id) {
+            return `${platform}|${arch}|linux-id:${id}`;
+          }
+        }
+      }
+    } else if (platform === "win32") {
+      const output3 = cp.execSync("reg query HKLM\\SOFTWARE\\Microsoft\\Cryptography /v MachineGuid", {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 2e3
+      });
+      const match = output3.match(/MachineGuid\s+REG_SZ\s+([a-fA-F0-9-]+)/i);
+      if (match && match[1]) {
+        return `${platform}|${arch}|windows-guid:${match[1].trim()}`;
+      }
+    }
+  } catch {
+  }
+  const interfaces = os.networkInterfaces();
+  const macs = [];
+  for (const name of Object.keys(interfaces)) {
+    const lowerName = name.toLowerCase();
+    if (lowerName.startsWith("utun") || lowerName.startsWith("tun") || lowerName.startsWith("tap") || lowerName.startsWith("wg") || // WireGuard
+    lowerName.startsWith("ppp")) {
+      continue;
+    }
+    const list = interfaces[name];
+    if (!list) continue;
+    for (const info of list) {
+      if (info.mac && info.mac !== "00:00:00:00:00:00" && !info.internal) {
+        macs.push(info.mac);
+      }
+    }
+  }
+  const uniqueMacs = [...new Set(macs)].sort();
+  const macPart = uniqueMacs.length > 0 ? uniqueMacs.join(",") : os.homedir();
+  return `${platform}|${arch}|fallback-macs:${macPart}`;
+}
+
+// ../packages/common-utils/src/hash.ts
+import crypto from "crypto";
+function sha256(value, encoding = "hex") {
+  return crypto.createHash("sha256").update(value).digest(encoding);
+}
+
+// src/lib/cli-identity.ts
+var projectKeypairSchema = z3.object({
+  keyId: z3.string().min(1),
+  publicKey: z3.string().min(1),
+  privateKey: z3.string().min(1),
+  createdAt: z3.string().min(1)
+});
+function hashValue(value) {
+  return sha256(value);
+}
+function identityDir(projectDir) {
+  return path4.join(projectDir, ".siteknock");
+}
+function keypairPath(projectDir) {
+  return path4.join(identityDir(projectDir), "cli-identity.json");
+}
+function generateProjectKeypair() {
+  const { publicKey, privateKey } = crypto2.generateKeyPairSync("ed25519", {
+    publicKeyEncoding: { type: "spki", format: "pem" },
+    privateKeyEncoding: { type: "pkcs8", format: "pem" }
+  });
+  return {
+    keyId: hashValue(publicKey).slice(0, 24),
+    publicKey,
+    privateKey,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function writeProjectIdentity(projectDir, keypair, licensingDocument) {
+  const dir = identityDir(projectDir);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(path4.join(dir, ".gitignore"), "*\n", { encoding: "utf8" });
+  writeFileSync(keypairPath(projectDir), `${JSON.stringify(keypair, null, 2)}
+`, {
+    encoding: "utf8",
+    mode: 384
+  });
+  if (licensingDocument) {
+    writeFileSync(path4.join(dir, "licensing.json"), `${JSON.stringify(licensingDocument, null, 2)}
+`, {
+      encoding: "utf8",
+      mode: 384
+    });
+  }
+}
+function computeSeatIdentity(projectDir, publicKey, workspaceRoot) {
+  const projectPath = path4.resolve(projectDir);
+  const workspacePath = workspaceRoot ? path4.resolve(workspaceRoot) : null;
+  return {
+    publicKey,
+    machineHash: hashValue(getMachineFingerprint()),
+    appPathHash: hashValue(projectPath),
+    workspaceName: workspacePath ? path4.basename(workspacePath) : null,
+    workspacePath
+  };
+}
+
+// src/lib/registry.ts
+import { createWriteStream } from "fs";
+import { mkdir as mkdir2, mkdtemp, rm } from "fs/promises";
+import { tmpdir } from "os";
+import path5 from "path";
+import { pipeline } from "stream/promises";
+import * as tar from "tar";
+async function downloadPackageTarball(input3) {
+  const { version, tarballUrl } = await probePackageAccess(input3);
+  const tempDir = await mkdtemp(path5.join(tmpdir(), "siteknock-package-download-"));
+  const tarballPath = path5.join(tempDir, "package.tgz");
+  try {
+    await mkdir2(input3.destDir, { recursive: true });
+    await downloadTarball({ url: tarballUrl, token: input3.token, destination: tarballPath });
+    await tar.x({
+      file: tarballPath,
+      cwd: input3.destDir,
+      strip: 1,
+      filter: (entryPath) => entryPath.startsWith("package/")
+    });
+    return version;
+  } finally {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+}
+async function probePackageAccess(input3) {
+  const metadata = await fetchRegistryMetadata(input3);
+  const version = resolvePackageVersion(metadata, input3.requestedVersion);
+  const tarballUrl = metadata.versions?.[version]?.dist?.tarball;
+  if (!tarballUrl) {
+    throw new Error(`Registry metadata for ${input3.packageName}@${version} does not expose a tarball URL`);
+  }
+  return { version, tarballUrl };
+}
+async function fetchRegistryMetadata(input3) {
+  const registryMetadataUrl = `${input3.registryUrl}/${toRegistryPackagePath(input3.packageName)}`;
+  const response = await fetchWithRegistryContext(
+    registryMetadataUrl,
+    {
+      headers: {
+        Authorization: toNpmBasicAuth(input3.token),
+        Accept: "application/json"
+      }
+    },
+    "Registry metadata request"
+  );
+  const body = await response.text();
+  if (!response.ok) {
+    throw new Error(`Registry metadata request failed with status ${response.status}: ${body}`);
+  }
+  return JSON.parse(body);
+}
+function resolvePackageVersion(metadata, requestedVersion) {
+  if (requestedVersion) {
+    if (!metadata.versions?.[requestedVersion]) {
+      throw new Error(`Requested version ${requestedVersion} is not available for this token`);
+    }
+    return requestedVersion;
+  }
+  const latest = metadata["dist-tags"]?.latest;
+  if (latest && metadata.versions?.[latest]) {
+    return latest;
+  }
+  const versions = Object.keys(metadata.versions ?? {}).sort(versionCompare);
+  const fallback = versions.at(-1);
+  if (!fallback) {
+    throw new Error(`Registry returned no visible versions for ${metadata.name}`);
+  }
+  return fallback;
+}
+async function downloadTarball(input3) {
+  const response = await fetchWithRegistryContext(
+    input3.url,
+    {
+      headers: {
+        Authorization: toNpmBasicAuth(input3.token)
+      }
+    },
+    "Registry tarball request"
+  );
+  if (!response.ok || !response.body) {
+    const body = await response.text();
+    throw new Error(`Registry tarball request failed with status ${response.status}: ${body}`);
+  }
+  await pipeline(response.body, createWriteStream(input3.destination));
+}
+function versionCompare(left, right) {
+  return new Intl.Collator(void 0, { numeric: true, sensitivity: "base" }).compare(left, right);
+}
+function toRegistryPackagePath(packageName) {
+  const [scope, name] = packageName.split("/");
+  if (!scope || !name) {
+    throw new Error(`Expected scoped package name, received ${packageName}`);
+  }
+  return `${scope}%2f${name}`;
+}
+function toNpmBasicAuth(token) {
+  return `Basic ${Buffer.from(`npm:${token}`).toString("base64")}`;
+}
+async function fetchWithRegistryContext(url, init, label) {
+  try {
+    return await fetch(url, init);
+  } catch (error) {
+    throw new Error(`${label} failed for ${url}: ${describeFetchError(error)}`, {
+      cause: error instanceof Error ? error : void 0
+    });
+  }
+}
+function describeFetchError(error) {
+  if (!(error instanceof Error)) {
+    return String(error);
+  }
+  const parts = [error.message];
+  const cause = error.cause;
+  if (cause && typeof cause === "object") {
+    const causeRecord = cause;
+    const code = typeof causeRecord.code === "string" ? causeRecord.code : void 0;
+    const syscall = typeof causeRecord.syscall === "string" ? causeRecord.syscall : void 0;
+    const hostname = typeof causeRecord.hostname === "string" ? causeRecord.hostname : void 0;
+    if (code) {
+      parts.push(`code=${code}`);
+    }
+    if (hostname) {
+      parts.push(`hostname=${hostname}`);
+    }
+    if (syscall) {
+      parts.push(`syscall=${syscall}`);
+    }
+  }
+  return parts.join(", ");
+}
+
+// src/lib/project-files.ts
+import { readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import path6 from "path";
+async function bootstrapProjectFiles(input3) {
+  await ensureGitignoreEntries(input3.projectDir, [".npmrc"]);
+  await writeFile2(path6.join(input3.projectDir, ".npmrc"), createNpmrc(input3.registryUrl, input3.token), "utf8");
+}
+async function ensureGitignoreEntries(projectDir, entries) {
+  const gitignorePath = path6.join(projectDir, ".gitignore");
+  let content = "";
+  try {
+    content = await readFile2(gitignorePath, "utf8");
+  } catch {
+    content = "";
+  }
+  const existing = new Set(content.split(/\r?\n/).filter(Boolean));
+  let changed = false;
+  for (const entry of entries) {
+    if (!existing.has(entry)) {
+      content += `${content.endsWith("\n") || content.length === 0 ? "" : "\n"}${entry}
+`;
+      changed = true;
+    }
+  }
+  if (changed) {
+    await writeFile2(gitignorePath, content, "utf8");
+  }
+}
+function createNpmrc(registryUrl, token) {
+  const parsed = new URL(registryUrl);
+  const normalizedPath = parsed.pathname === "/" ? "/" : `${parsed.pathname.replace(/\/$/, "")}/`;
+  return [`@siteknock:registry=${registryUrl}`, `//${parsed.host}${normalizedPath}:_authToken=${token}`, ""].join("\n");
+}
+function folderNameToSlug(folderName) {
+  const slug = folderName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "");
+  if (!slug) return "app";
+  return /^[a-z]/.test(slug) ? slug : `app-${slug}`;
+}
+
+// src/commands/create.ts
+var createFlags = {
+  project: { type: "string", short: "p" },
+  version: { type: "string" },
+  yes: { type: "boolean" }
+};
+var requestedVersionSchema = z4.string().refine((value) => semver.valid(value), "Version must be valid semver");
+async function runCreateCommand(argv) {
+  const parsed = parseArgs2({
+    args: argv.slice(1),
+    options: createFlags,
+    allowPositionals: true
+  });
+  const config = await getConfig({
+    projectDir: parsed.values.project,
+    requestedVersion: parsed.values.version,
+    yes: parsed.values.yes === true
+  });
+  const resolved = await promptForMissingFields(config);
+  const targetState = await validateTargetFolder(resolved.projectDir);
+  const projectName = getProjectNameFromDirectory(resolved.workspaceRoot, resolved.projectDir);
+  if (resolved.requestedVersion) {
+    requestedVersionSchema.parse(resolved.requestedVersion);
+  }
+  const keypair = generateProjectKeypair();
+  const seatIdentity = computeSeatIdentity(resolved.projectDir, keypair.publicKey, resolved.workspaceRoot);
+  console.log(`Starting browser authorization against ${resolved.licenseUrl} ...`);
+  const license = await authorizeLicenseWithBrowser({
+    licenseUrl: resolved.licenseUrl,
+    requestedVersion: resolved.requestedVersion,
+    purpose: "create",
+    publicKey: seatIdentity.publicKey,
+    machineHash: seatIdentity.machineHash,
+    appPathHash: seatIdentity.appPathHash,
+    projectName,
+    workspaceName: seatIdentity.workspaceName,
+    workspacePath: seatIdentity.workspacePath
+  });
+  validateRequestedVersion(resolved.requestedVersion, license);
+  const registryUrl = license.registryUrl ?? resolved.registryUrl;
+  const generatorPackage = license.generatorPackage ?? resolved.generatorPackage;
+  const projectSlug = folderNameToSlug(projectName);
+  console.log(`Scaffolding project from ${generatorPackage} (registry ${registryUrl}) ...`);
+  let generatorVersion = "";
+  try {
+    generatorVersion = await scaffoldProjectFromGenerator({
+      registryUrl,
+      generatorPackage,
+      token: license.token,
+      requestedVersion: resolved.requestedVersion || void 0,
+      projectDir: resolved.projectDir,
+      slug: projectSlug,
+      name: projectName
+    });
+  } catch (error) {
+    if (targetState.createdDirectory) {
+      await rm2(resolved.projectDir, { recursive: true, force: true });
+    }
+    throw error;
+  }
+  await bootstrapProjectFiles({
+    projectDir: resolved.projectDir,
+    token: license.token,
+    registryUrl
+  });
+  writeProjectIdentity(resolved.projectDir, keypair, license.licensingDocument);
+  const manifest = await readWorkspaceManifest(resolved.workspaceRoot);
+  const registeredManifest = withRegisteredProject(manifest, {
+    projectName,
+    bundleVersion: generatorVersion,
+    activation: {
+      token: license.token,
+      customerName: license.customerName,
+      plan: license.plan,
+      minVersion: license.minVersion,
+      maxVersion: license.maxVersion,
+      projectSeats: license.projectSeats,
+      expiresAt: license.expiresAt
+    },
+    selected: true
+  });
+  const nextManifest = withStudioSettings(registeredManifest, {
+    image: license.studioImage,
+    appInstallUrl: license.studioAppInstallUrl ?? void 0
+  });
+  await writeWorkspaceManifest(resolved.workspaceRoot, nextManifest);
+  console.log(`Project created at ${resolved.projectDir}`);
+  console.log(`Registry token written to ${path7.join(resolved.projectDir, ".npmrc")}`);
+  console.log(`Workspace config updated at ${getWorkspaceConfigPath(resolved.workspaceRoot)}`);
+  console.log(`Scaffolded from ${generatorPackage}@${generatorVersion}`);
+  console.log(`Entitlement verified for ${license.plan} (${license.minVersion} -> ${license.maxVersion})`);
+  if (typeof license.seatIndex === "number") {
+    console.log(`Project seat #${license.seatIndex} activated for ${projectName}`);
+  }
+  console.log(`Next: cd ${path7.basename(resolved.projectDir)} && pnpm install && pnpm app create <name>`);
+}
+async function scaffoldProjectFromGenerator(input3) {
+  const generatorDir = await mkdtemp2(path7.join(tmpdir2(), "siteknock-generator-"));
+  try {
+    const version = await downloadPackageTarball({
+      registryUrl: input3.registryUrl,
+      packageName: input3.generatorPackage,
+      token: input3.token,
+      requestedVersion: input3.requestedVersion,
+      destDir: generatorDir
+    });
+    await runNode([
+      path7.join(generatorDir, "project-cli.mjs"),
+      "init",
+      "--slug",
+      input3.slug,
+      "--name",
+      input3.name,
+      "--version",
+      version,
+      "--dir",
+      input3.projectDir,
+      "--dep-mode",
+      "pinned"
+    ]);
+    return version;
+  } finally {
+    await rm2(generatorDir, { recursive: true, force: true });
+  }
+}
+function runNode(args) {
+  return new Promise((resolve, reject) => {
+    const child = spawn2(process.execPath, args, { stdio: "inherit" });
+    child.on("error", reject);
+    child.on("exit", (code) => {
+      if (code === 0) {
+        resolve();
+      } else {
+        reject(new Error(`sk-project init exited with code ${code ?? "unknown"}`));
+      }
+    });
+  });
+}
+async function validateTargetFolder(projectDir) {
+  const exists = await statSafe(projectDir);
+  if (!exists) {
+    await mkdir3(path7.dirname(projectDir), { recursive: true });
+    return { createdDirectory: true };
+  }
+  if (!await targetDirectoryExistsAndIsNonEmpty(projectDir)) {
+    return { createdDirectory: false };
+  }
+  throw new Error(`Target project directory already exists and is not empty: ${projectDir}`);
+}
+async function statSafe(targetPath) {
+  try {
+    await stat(targetPath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function targetDirectoryExistsAndIsNonEmpty(projectDir) {
+  try {
+    const entries = await (await import("fs/promises")).readdir(projectDir);
+    return entries.length > 0;
+  } catch {
+    return false;
+  }
+}
+function validateRequestedVersion(version, license) {
+  if (!version) return;
+  const minVersion = semver.valid(license.minVersion);
+  const maxVersion = semver.valid(license.maxVersion);
+  if (!minVersion || !maxVersion) {
+    throw new Error("Licensing server returned an invalid version range");
+  }
+  if (semver.lt(version, minVersion) || semver.gt(version, maxVersion)) {
+    throw new Error(`Requested version ${version} is outside the licensed range ${minVersion} -> ${maxVersion}`);
+  }
+}
+
+// src/commands/locale.ts
+import { existsSync as existsSync4 } from "fs";
+import { spawn as spawn3 } from "child_process";
+import path8 from "path";
+import process4 from "process";
+import { parseArgs as parseArgs3 } from "util";
+var localeFlags = {
+  project: { type: "string", short: "p" }
+};
+async function runLocaleCommand(argv) {
+  const subArgs = argv.slice(1);
+  const subcommand = subArgs.find((value) => !value.startsWith("-"));
+  if (!subcommand || subcommand === "help") {
+    printLocaleHelp();
+    return;
+  }
+  const parsed = parseArgs3({ args: subArgs, options: localeFlags, allowPositionals: true, strict: false });
+  const projectDir = await resolveProjectDir2(parsed.values.project);
+  const localeCliPath = path8.join(projectDir, "node_modules", "@siteknock", "generator", "locale-cli.mjs");
+  if (!existsSync4(localeCliPath)) {
+    throw new Error(`Could not find @siteknock/generator in ${projectDir}. Run install in the project first.`);
+  }
+  const forwarded = stripProjectFlag2(subArgs);
+  await delegate2(localeCliPath, projectDir, forwarded);
+}
+async function resolveProjectDir2(projectFlag) {
+  const workspaceRoot = await resolveWorkspaceRoot(process4.cwd());
+  if (projectFlag) {
+    return resolveTopLevelProjectDirectory(workspaceRoot, projectFlag).projectDir;
+  }
+  if (existsSync4(path8.join(process4.cwd(), "config", "sk-config.jsonc"))) {
+    return process4.cwd();
+  }
+  const manifest = await readWorkspaceManifest(workspaceRoot);
+  const defaultProject = manifest.studio.defaultProject;
+  if (defaultProject) {
+    return resolveTopLevelProjectDirectory(workspaceRoot, defaultProject).projectDir;
+  }
+  throw new Error("No project specified. Pass --project <folder> or run inside a project directory.");
+}
+function stripProjectFlag2(args) {
+  const out = [];
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === "--project" || arg === "-p") {
+      i += 1;
+      continue;
+    }
+    if (arg.startsWith("--project=")) continue;
+    out.push(arg);
+  }
+  return out;
+}
+function delegate2(localeCliPath, projectDir, args) {
+  return new Promise((resolve, reject) => {
+    const child = spawn3("node", [localeCliPath, ...args], { cwd: projectDir, stdio: "inherit" });
+    child.on("error", reject);
+    child.on("exit", (code) => {
+      if (code === 0) resolve();
+      else reject(new Error(`locale command exited with code ${code ?? "null"}`));
+    });
+  });
+}
+function printLocaleHelp() {
+  console.log(`
+  siteknock locale \u2014 manage per-app i18n languages within a project
+
+  Usage:
+    siteknock locale list --project <folder>
+    siteknock locale add <code> --project <folder> --app <name>
+
+  Notes:
+    --app selects which app to add the language to (defaults to the first app).
+    Adding a language seeds locales/<app>/<code>/ from the kit catalog.
+`);
+}
+
+// src/commands/probe.ts
+import { parseArgs as parseArgs4 } from "util";
+import semver2 from "semver";
+import { z as z5 } from "zod";
+var probeFlags = {
+  version: { type: "string" },
+  yes: { type: "boolean" }
+};
+var requestedVersionSchema2 = z5.string().refine((value) => semver2.valid(value), "Version must be valid semver");
+async function runProbeCommand(argv) {
+  const parsed = parseArgs4({
+    args: argv.slice(1),
+    options: probeFlags,
+    allowPositionals: true
+  });
+  const config = await getConfig({
+    requestedVersion: parsed.values.version,
+    yes: parsed.values.yes === true
+  });
+  const resolved = await promptForMissingFieldsWithOptions(config, { skipProjectDirPrompt: true });
+  if (resolved.requestedVersion) {
+    requestedVersionSchema2.parse(resolved.requestedVersion);
+  }
+  console.log(`Starting browser authorization against ${resolved.licenseUrl} ...`);
+  const license = await authorizeLicenseWithBrowser({
+    licenseUrl: resolved.licenseUrl,
+    requestedVersion: resolved.requestedVersion,
+    purpose: "probe"
+  });
+  validateRequestedVersion2(resolved.requestedVersion, license.minVersion, license.maxVersion);
+  const registryUrl = license.registryUrl ?? resolved.registryUrl;
+  const generatorPackage = resolved.generatorPackage;
+  console.log(`Checking registry visibility at ${registryUrl} ...`);
+  const probe = await probePackageAccess({
+    registryUrl,
+    packageName: generatorPackage,
+    token: license.token,
+    requestedVersion: resolved.requestedVersion || void 0
+  });
+  console.log("Probe succeeded");
+  console.log(`Customer: ${license.customerName}`);
+  console.log(`Plan: ${license.plan}`);
+  console.log(`Version range: ${license.minVersion} -> ${license.maxVersion}`);
+  console.log(`Visible package: ${generatorPackage}@${probe.version}`);
+}
+function validateRequestedVersion2(version, minVersionRaw, maxVersionRaw) {
+  if (!version) return;
+  const minVersion = semver2.valid(minVersionRaw);
+  const maxVersion = semver2.valid(maxVersionRaw);
+  if (!minVersion || !maxVersion) {
+    throw new Error("Licensing server returned an invalid version range");
+  }
+  if (semver2.lt(version, minVersion) || semver2.gt(version, maxVersion)) {
+    throw new Error(`Requested version ${version} is outside the licensed range ${minVersion} -> ${maxVersion}`);
+  }
+}
+
+// src/commands/studio.ts
+import { createHash as createHash2 } from "crypto";
+import { execFile, spawn as spawn4 } from "child_process";
+import { existsSync as existsSync5 } from "fs";
+import net from "net";
+import os2 from "os";
+import path9 from "path";
+import process5 from "process";
+import readline2 from "readline/promises";
+import { parseArgs as parseArgs5 } from "util";
+import { promisify } from "util";
+import { stdin as input2, stdout as output2 } from "process";
+var execFileAsync = promisify(execFile);
+var DEFAULT_STUDIO_IMAGE = "ghcr.io/siteknock/sk-studio";
+var DEV_STUDIO_IMAGE_ENV = "SK_DEV_STUDIO_IMAGE";
+var DEFAULT_STUDIO_PORT = 4875;
+var DEFAULT_HEALTH_TIMEOUT_MS = 6e4;
+var APP_HEALTH_PATH = "/api/health";
+var IS_TTY = process5.stdout.isTTY === true;
+var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+var Spinner = class {
+  frame = 0;
+  timer = null;
+  label = "";
+  startedAt = 0;
+  start(label) {
+    this.label = label;
+    this.startedAt = Date.now();
+    this.frame = 0;
+    if (!IS_TTY) {
+      process5.stdout.write(`${label}...
+`);
+      return;
+    }
+    this.timer = setInterval(() => this.tick(), 80);
+    this.tick();
+  }
+  succeed(label) {
+    const text = label ?? this.label;
+    this.clear();
+    process5.stdout.write(`\x1B[32m\u2713\x1B[0m ${text}
+`);
+  }
+  fail(label) {
+    const text = label ?? this.label;
+    this.clear();
+    process5.stdout.write(`\x1B[31m\u2717\x1B[0m ${text}
+`);
+  }
+  stop() {
+    this.clear();
+  }
+  tick() {
+    const elapsed = Math.floor((Date.now() - this.startedAt) / 1e3);
+    const suffix = elapsed > 0 ? ` (${elapsed}s)` : "";
+    const icon = SPINNER_FRAMES[this.frame % SPINNER_FRAMES.length];
+    this.frame++;
+    const line = `${icon} ${this.label}${suffix}   `;
+    process5.stdout.write(`\r${line}`);
+  }
+  clear() {
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = null;
+    }
+    if (IS_TTY) {
+      const width = process5.stdout.columns || 80;
+      process5.stdout.write("\r" + " ".repeat(width) + "\r");
+    }
+  }
+};
+async function pullImage(image) {
+  if (IS_TTY) {
+    process5.stdout.write(`\x1B[2mPulling image: ${image}\x1B[0m
+`);
+  } else {
+    process5.stdout.write(`Pulling image: ${image}
+`);
+  }
+  await new Promise((resolve, reject) => {
+    const child = spawn4("docker", ["pull", image], { stdio: "inherit" });
+    child.on("error", reject);
+    child.on("exit", (code) => {
+      if (code === 0) resolve();
+      else reject(new Error(`docker pull exited with code ${code}`));
+    });
+  });
+}
+var STUDIO_APP_INSTALL_URL = process5.env.SK_STUDIO_APP_INSTALL_URL?.trim() || null;
+var studioFlags = {
+  project: { type: "string", short: "p" },
+  mode: { type: "string", short: "m" },
+  port: { type: "string" },
+  image: { type: "string" },
+  "container-name": { type: "string" },
+  "no-open": { type: "boolean" }
+};
+async function runStudioCommand(argv) {
+  const parsed = parseArgs5({
+    args: argv.slice(1),
+    options: studioFlags,
+    allowPositionals: true
+  });
+  const action = normalizeAction(parsed.positionals[0]);
+  const config = await getConfig({ yes: true });
+  const manifest = await readWorkspaceManifest(config.workspaceRoot);
+  const registeredProjects = listWorkspaceProjects(manifest);
+  const targetProject = resolveStudioProject(manifest, parsed.values.project);
+  const noOpen = parsed.values["no-open"] === true;
+  const mode = resolveStudioMode(parsed.values.mode, manifest.studio.mode);
+  const appInstallUrl = STUDIO_APP_INSTALL_URL ?? manifest.studio.appInstallUrl ?? null;
+  if (mode === "app") {
+    await runStudioAppMode({
+      action,
+      workspaceRoot: config.workspaceRoot,
+      manifest,
+      targetProject,
+      noOpen,
+      appInstallUrl,
+      mode
+    });
+    return;
+  }
+  const image = parsed.values.image ?? readHiddenOverride(DEV_STUDIO_IMAGE_ENV) ?? manifest.studio.image ?? DEFAULT_STUDIO_IMAGE;
+  const containerName = parsed.values["container-name"] ?? manifest.studio.containerName ?? buildContainerName(config.workspaceRoot);
+  const requestedPort = parsePort(parsed.values.port);
+  if (action !== "stop" && action !== "status" && registeredProjects.length === 0) {
+    throw new Error(
+      `No projects are registered in ${getWorkspaceConfigPath(config.workspaceRoot)}. Run \`siteknock create --project <folder>\` from ${config.workspaceRoot} first.`
+    );
+  }
+  await ensureDockerAvailable();
+  if (action === "stop") {
+    await stopContainer(containerName);
+    console.log(`Stopped Studio container ${containerName}`);
+    return;
+  }
+  if (action === "status") {
+    const state = await inspectContainer(containerName);
+    if (!state.exists) {
+      console.log(`Studio container ${containerName} is not created`);
+      return;
+    }
+    console.log(
+      state.running ? `Studio container ${containerName} is running` : `Studio container ${containerName} is stopped`
+    );
+    return;
+  }
+  const port = requestedPort ?? manifest.studio.port ?? await findAvailablePort(DEFAULT_STUDIO_PORT);
+  await authenticateToGhcrIfNeeded(image);
+  if (action === "restart") {
+    await recreateContainer({ containerName, image, port, workspaceRoot: config.workspaceRoot });
+  } else {
+    const state = await inspectContainer(containerName);
+    if (!state.exists) {
+      await createContainer({ containerName, image, port, workspaceRoot: config.workspaceRoot });
+    } else if (!state.running) {
+      if (requestedPort || parsed.values.image || parsed.values["container-name"]) {
+        await recreateContainer({ containerName, image, port, workspaceRoot: config.workspaceRoot });
+      } else {
+        const startSpinner = new Spinner();
+        startSpinner.start("Starting Studio container");
+        await runDocker(["start", containerName]);
+        startSpinner.succeed("Container started");
+      }
+    }
+  }
+  await waitForStudio(port);
+  const nextManifest = withStudioSettings(manifest, {
+    defaultProject: targetProject ?? void 0,
+    mode: "docker",
+    image,
+    port,
+    containerName
+  });
+  await writeWorkspaceManifest(config.workspaceRoot, nextManifest);
+  const targetUrl = await buildStudioUrl({
+    projectName: targetProject,
+    port
+  });
+  console.log(`Studio workspace: ${config.workspaceRoot}`);
+  if (targetProject) {
+    console.log(`Selected project: ${targetProject}`);
+  }
+  console.log(`Studio URL: ${targetUrl}`);
+  if (!noOpen) {
+    openBrowser(targetUrl);
+  }
+}
+function resolveStudioMode(flagValue, persisted) {
+  if (flagValue === "docker" || flagValue === "app") return flagValue;
+  if (flagValue !== void 0) throw new Error(`Invalid --mode value: ${flagValue}. Use "docker" or "app".`);
+  return persisted ?? "docker";
+}
+function resolveElectronAppExecutable() {
+  switch (process5.platform) {
+    case "darwin": {
+      const candidates = [
+        "/Applications/SiteKnock Studio.app/Contents/MacOS/SiteKnock Studio",
+        path9.join(os2.homedir(), "Applications", "SiteKnock Studio.app", "Contents", "MacOS", "SiteKnock Studio")
+      ];
+      return candidates.find(existsSync5) ?? null;
+    }
+    case "win32": {
+      const candidates = [
+        path9.join(os2.homedir(), "AppData", "Local", "Programs", "SiteKnock Studio", "SiteKnock Studio.exe"),
+        path9.join("C:", "Program Files", "SiteKnock Studio", "SiteKnock Studio.exe")
+      ];
+      return candidates.find(existsSync5) ?? null;
+    }
+    default: {
+      const candidates = [
+        path9.join(os2.homedir(), ".local", "bin", "siteknock-studio"),
+        "/usr/bin/siteknock-studio",
+        "/opt/SiteKnock Studio/siteknock-studio"
+      ];
+      return candidates.find(existsSync5) ?? null;
+    }
+  }
+}
+function launchElectronApp(executable, workspaceRoot, projectName) {
+  if (process5.platform === "darwin") {
+    const appBundle = executable.replace(/\/Contents\/MacOS\/.*$/, "");
+    const extraArgs2 = ["--workspace", workspaceRoot, ...projectName ? ["--project", projectName] : []];
+    spawn4("open", ["-a", appBundle, "--args", ...extraArgs2], { detached: true, stdio: "ignore" }).unref();
+    return;
+  }
+  const extraArgs = ["--workspace", workspaceRoot, ...projectName ? ["--project", projectName] : []];
+  spawn4(executable, extraArgs, { detached: true, stdio: "ignore" }).unref();
+}
+async function runStudioAppMode(input3) {
+  const { action, workspaceRoot, manifest, targetProject, noOpen, appInstallUrl, mode } = input3;
+  const executable = resolveElectronAppExecutable();
+  if (action === "status") {
+    if (!executable) {
+      console.log("SiteKnock Studio app is not installed.");
+    } else {
+      console.log(`SiteKnock Studio app found: ${executable}`);
+    }
+    return;
+  }
+  if (action === "stop") {
+    if (process5.platform === "darwin") {
+      spawn4("osascript", ["-e", 'quit app "SiteKnock Studio"'], { detached: true, stdio: "ignore" }).unref();
+      console.log("Sent quit signal to SiteKnock Studio.");
+    } else {
+      console.log("Use your OS task manager to quit SiteKnock Studio.");
+    }
+    return;
+  }
+  if (!executable) {
+    console.log("SiteKnock Studio app is not installed.\n");
+    if (appInstallUrl) {
+      console.log(`Install it from:
+  ${appInstallUrl}
+`);
+    } else {
+      console.log("No desktop-app install URL is configured in SiteKnock.");
+      console.log("Desktop distribution should stay private and be wired through an internal release channel.");
+      console.log("For now, use --mode docker or set SK_STUDIO_APP_INSTALL_URL to your internal installer URL.");
+      console.log("A better long-term path is a CLI-managed install/update flow backed by private storage.");
+      console.log("");
+    }
+    console.log("After installation, run this command again.");
+    console.log("\nAlternatively, use --mode docker to run via Docker instead.");
+    return;
+  }
+  const nextManifest = withStudioSettings(manifest, { mode, defaultProject: targetProject ?? void 0 });
+  await writeWorkspaceManifest(workspaceRoot, nextManifest);
+  console.log(`Studio workspace: ${workspaceRoot}`);
+  if (targetProject) console.log(`Selected project: ${targetProject}`);
+  console.log(`Launching SiteKnock Studio app...`);
+  if (!noOpen) {
+    launchElectronApp(executable, workspaceRoot, targetProject);
+  }
+}
+function normalizeAction(rawAction) {
+  const action = rawAction?.trim().toLowerCase() || "start";
+  if (action === "start" || action === "stop" || action === "restart" || action === "status") {
+    return action;
+  }
+  throw new Error(`Unknown studio action: ${rawAction}`);
+}
+function resolveStudioProject(manifest, requestedProject) {
+  if (requestedProject) {
+    if (!manifest.projects[requestedProject]) {
+      throw new Error(`Project ${requestedProject} is not registered in ${WORKSPACE_CONFIG_FILENAME}`);
+    }
+    return requestedProject;
+  }
+  return resolvePreferredProject(manifest);
+}
+function parsePort(rawPort) {
+  if (!rawPort) {
+    return void 0;
+  }
+  const parsed = Number.parseInt(rawPort, 10);
+  if (!Number.isInteger(parsed) || parsed <= 0 || parsed > 65535) {
+    throw new Error(`Invalid port: ${rawPort}`);
+  }
+  return parsed;
+}
+function buildContainerName(workspaceRoot) {
+  const baseName = path9.basename(workspaceRoot).replace(/[^A-Za-z0-9_.-]+/g, "-").replace(/^-+|-+$/g, "") || "workspace";
+  const digest = createHash2("sha1").update(workspaceRoot).digest("hex").slice(0, 8);
+  return `sk-studio-${baseName}-${digest}`;
+}
+async function ensureDockerAvailable() {
+  try {
+    await runDocker(["info"]);
+  } catch {
+    throw new Error("Docker is not running. Start Docker Desktop or OrbStack and retry.");
+  }
+}
+async function authenticateToGhcrIfNeeded(image) {
+  const token = process5.env.GHCR_TOKEN ?? process5.env.GITHUB_TOKEN;
+  if (!token || !image.startsWith("ghcr.io/")) {
+    return;
+  }
+  const username = await resolveGhcrUsername();
+  const authSpinner = new Spinner();
+  authSpinner.start("Authenticating to ghcr.io");
+  await new Promise((resolve, reject) => {
+    const child = spawn4("docker", ["login", "ghcr.io", "-u", username, "--password-stdin"], {
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    let stderr = "";
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.on("error", (err) => {
+      authSpinner.fail("Authentication failed");
+      reject(err);
+    });
+    child.on("exit", (code) => {
+      if (code === 0) {
+        authSpinner.succeed("Authenticated to ghcr.io");
+        resolve();
+        return;
+      }
+      authSpinner.fail("Authentication failed");
+      reject(new Error(stderr.trim() || "Docker login failed"));
+    });
+    child.stdin.end(token);
+  });
+}
+async function resolveGhcrUsername() {
+  const envValue = process5.env.GHCR_USERNAME ?? process5.env.GH_USER ?? process5.env.GITHUB_ACTOR;
+  if (envValue) {
+    return envValue;
+  }
+  try {
+    const { stdout } = await execFileAsync("gh", ["api", "user", "--jq", ".login"], { encoding: "utf8" });
+    const ghUser = stdout.trim();
+    if (ghUser) {
+      return ghUser;
+    }
+  } catch {
+  }
+  const rl = readline2.createInterface({ input: input2, output: output2 });
+  try {
+    const reply = (await rl.question("GitHub username for ghcr.io login: ")).trim();
+    if (!reply) {
+      throw new Error("Missing GitHub username for ghcr.io login");
+    }
+    return reply;
+  } finally {
+    rl.close();
+  }
+}
+async function inspectContainer(containerName) {
+  try {
+    const { stdout } = await execFileAsync("docker", ["inspect", containerName, "--format", "{{json .State}}"], {
+      encoding: "utf8"
+    });
+    const state = JSON.parse(stdout.trim());
+    return {
+      exists: true,
+      running: state.Running === true
+    };
+  } catch {
+    return {
+      exists: false,
+      running: false
+    };
+  }
+}
+async function createContainer(input3) {
+  await pullImage(input3.image);
+  const spinner = new Spinner();
+  spinner.start("Creating Studio container");
+  try {
+    await runDocker([
+      "run",
+      "-d",
+      "--name",
+      input3.containerName,
+      "--init",
+      "--read-only",
+      "--restart",
+      "unless-stopped",
+      "--tmpfs",
+      "/tmp:size=64m,mode=1777",
+      "--tmpfs",
+      "/home/nonroot:size=16m,mode=0700",
+      "--security-opt",
+      "no-new-privileges:true",
+      "--cap-drop",
+      "ALL",
+      "--label",
+      `com.siteknock.sk-cli.workspace=${input3.workspaceRoot}`,
+      "--label",
+      `com.siteknock.sk-cli.port=${input3.port}`,
+      "--label",
+      `com.siteknock.sk-cli.image=${input3.image}`,
+      "--health-cmd",
+      `/nodejs/bin/node -e "fetch('http://127.0.0.1:5100/api/health').then((response)=>process.exit(response.ok?0:1)).catch(()=>process.exit(1))"`,
+      "--health-interval",
+      "30s",
+      "--health-timeout",
+      "5s",
+      "--health-start-period",
+      "20s",
+      "--health-retries",
+      "3",
+      "-p",
+      `${input3.port}:3100`,
+      "-e",
+      "WORKSPACE_DIR=/workspace",
+      "-e",
+      `STUDIO_INSTANCE_ID=${os2.hostname()}-${path9.basename(input3.workspaceRoot)}`,
+      "-v",
+      `${input3.workspaceRoot}:/workspace`,
+      input3.image
+    ]);
+    spinner.succeed("Studio container created");
+  } catch (err) {
+    spinner.fail("Failed to create Studio container");
+    throw err;
+  }
+}
+async function recreateContainer(input3) {
+  const stopSpinner = new Spinner();
+  stopSpinner.start("Stopping container");
+  await stopContainer(input3.containerName);
+  stopSpinner.succeed("Container stopped");
+  const removeSpinner = new Spinner();
+  removeSpinner.start("Removing container");
+  await removeContainer(input3.containerName);
+  removeSpinner.succeed("Container removed");
+  await createContainer(input3);
+}
+async function stopContainer(containerName) {
+  const state = await inspectContainer(containerName);
+  if (!state.exists || !state.running) {
+    return;
+  }
+  await runDocker(["stop", containerName]);
+}
+async function removeContainer(containerName) {
+  const state = await inspectContainer(containerName);
+  if (!state.exists) {
+    return;
+  }
+  await runDocker(["rm", "-f", containerName]);
+}
+async function runDocker(args) {
+  const { stdout } = await execFileAsync("docker", args, { encoding: "utf8" });
+  return stdout.trim();
+}
+async function waitForStudio(port) {
+  const spinner = new Spinner();
+  spinner.start("Starting Studio");
+  const startedAt = Date.now();
+  try {
+    while (Date.now() - startedAt < DEFAULT_HEALTH_TIMEOUT_MS) {
+      try {
+        const response = await fetch(`http://localhost:${port}${APP_HEALTH_PATH}`);
+        if (response.ok) {
+          const elapsed = Math.floor((Date.now() - startedAt) / 1e3);
+          spinner.succeed(`Studio is ready${elapsed > 0 ? ` (${elapsed}s)` : ""}`);
+          return;
+        }
+      } catch {
+      }
+      await sleep2(1e3);
+    }
+  } catch (err) {
+    spinner.fail("Studio failed to start");
+    throw err;
+  }
+  spinner.fail("Studio timed out");
+  throw new Error(`Studio did not become healthy within ${DEFAULT_HEALTH_TIMEOUT_MS / 1e3}s`);
+}
+async function buildStudioUrl(input3) {
+  if (!input3.projectName) {
+    return `http://localhost:${input3.port}`;
+  }
+  try {
+    const response = await fetch(`http://localhost:${input3.port}/api/studio/license/status`, {
+      headers: {
+        "x-project-folder": input3.projectName
+      }
+    });
+    if (!response.ok) {
+      return `http://localhost:${input3.port}/settings?tab=activation&project=${encodeURIComponent(input3.projectName)}`;
+    }
+    const status = await response.json();
+    const targetPath = status.valid ? `/?project=${encodeURIComponent(input3.projectName)}` : `/settings?tab=activation&project=${encodeURIComponent(input3.projectName)}`;
+    return `http://localhost:${input3.port}${targetPath}`;
+  } catch {
+    return `http://localhost:${input3.port}/?project=${encodeURIComponent(input3.projectName)}`;
+  }
+}
+function openBrowser(url) {
+  const child = process5.platform === "darwin" ? spawn4("open", [url], { detached: true, stdio: "ignore" }) : process5.platform === "win32" ? spawn4("cmd", ["/c", "start", "", url], { detached: true, stdio: "ignore" }) : spawn4("xdg-open", [url], { detached: true, stdio: "ignore" });
+  child.unref();
+}
+async function findAvailablePort(startPort) {
+  for (let port = startPort; port < startPort + 20; port += 1) {
+    if (await isPortAvailable(port)) {
+      return port;
+    }
+  }
+  throw new Error(`Could not find an available port starting at ${startPort}`);
+}
+async function isPortAvailable(port) {
+  return new Promise((resolve) => {
+    const server = net.createServer();
+    server.once("error", () => {
+      resolve(false);
+    });
+    server.once("listening", () => {
+      server.close(() => resolve(true));
+    });
+    server.listen(port, "127.0.0.1");
+  });
+}
+async function sleep2(ms) {
+  await new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/commands/verify.ts
+import { parseArgs as parseArgs6 } from "util";
+var verifyFlags = {
+  token: { type: "string" },
+  project: { type: "string", short: "p" }
+};
+async function runVerifyCommand(argv) {
+  const parsed = parseArgs6({
+    args: argv.slice(1),
+    options: verifyFlags,
+    allowPositionals: true
+  });
+  const config = await getConfig({
+    token: parsed.values.token,
+    projectName: parsed.values.project,
+    yes: true
+  });
+  if (!config.token) {
+    throw new Error("Missing SiteKnock token. Pass --token or set it in your env file.");
+  }
+  const result = await getEntitlement({
+    licenseUrl: config.licenseUrl,
+    token: config.token
+  });
+  console.log("License is valid");
+  console.log(`Customer: ${result.customerName}`);
+  console.log(`Plan: ${result.plan}`);
+  console.log(`Version range: ${result.minVersion} -> ${result.maxVersion}`);
+  console.log(`CLI seats (perpetual): ${result.cliSeats}`);
+  console.log(`Studio seats: ${result.studioSeats}`);
+  if (result.renewalActive) {
+    console.log("Seat renewal: active \u2014 Studio access enabled.");
+  } else {
+    const expiry = result.expiresAt ? ` (lapsed ${result.expiresAt})` : "";
+    console.log(`Seat renewal: inactive${expiry}.`);
+    console.log(
+      `Your perpetual license still lets you manage projects with siteknock on ${result.cliSeats} seat(s). Renew to restore Studio access and updates.`
+    );
+  }
+}
+
+// src/commands/kb.ts
+import { existsSync as existsSync7 } from "fs";
+import { mkdir as mkdir4 } from "fs/promises";
+import path11 from "path";
+import { parseArgs as parseArgs7 } from "util";
+import { pathToFileURL } from "url";
+
+// src/lib/version-guard.ts
+import { existsSync as existsSync6, readFileSync as readFileSync3 } from "fs";
+import path10 from "path";
+function readProjectSkVersion(projectDir) {
+  const pkgPath = path10.join(projectDir, "package.json");
+  if (!existsSync6(pkgPath)) return null;
+  try {
+    const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
+    const v = pkg["sk-version"];
+    return typeof v === "string" && v.trim() ? v.trim() : null;
+  } catch {
+    return null;
+  }
+}
+function readGeneratorVersion(generatorDir) {
+  const pkgPath = path10.join(generatorDir, "package.json");
+  if (!existsSync6(pkgPath)) return null;
+  try {
+    const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
+    const v = pkg.version;
+    return typeof v === "string" && v.trim() ? v.trim() : null;
+  } catch {
+    return null;
+  }
+}
+function checkVersionMatch(projectDir, generatorDir) {
+  const generatorVersion = readGeneratorVersion(generatorDir);
+  const projectVersion = projectDir ? readProjectSkVersion(projectDir) : null;
+  if (!generatorVersion) {
+    return {
+      match: false,
+      projectVersion,
+      generatorVersion: null,
+      message: "Could not read generator version."
+    };
+  }
+  if (!projectVersion) {
+    return {
+      match: true,
+      projectVersion: null,
+      generatorVersion,
+      message: `Using generator v${generatorVersion} (no project sk-version to compare).`
+    };
+  }
+  if (projectVersion === generatorVersion) {
+    return {
+      match: true,
+      projectVersion,
+      generatorVersion,
+      message: `Generator v${generatorVersion} matches project sk-version.`
+    };
+  }
+  return {
+    match: false,
+    projectVersion,
+    generatorVersion,
+    message: `Version mismatch: project sk-version is ${projectVersion} but resolved generator is v${generatorVersion}. The KB/agent guides may not match your project's capabilities. Run \`pnpm install\` in the project to install the correct generator version, or use --project <folder> to target a specific project.`
+  };
+}
+
+// src/commands/kb.ts
+var kbFlags = {
+  dir: { type: "string" },
+  project: { type: "string", short: "p" },
+  force: { type: "boolean", default: false }
+};
+function kbLifecycleCandidates(workspaceRoot, projectDir) {
+  const candidates = [];
+  if (projectDir) {
+    candidates.push(path11.join(workspaceRoot, projectDir, "node_modules", "@siteknock", "generator", "kb-lifecycle.mjs"));
+  }
+  candidates.push(path11.join(workspaceRoot, "node_modules", "@siteknock", "generator", "kb-lifecycle.mjs"));
+  candidates.push(path11.join(workspaceRoot, "packages", "generator", "kb-lifecycle.mjs"));
+  return candidates.filter((c) => existsSync7(c));
+}
+async function runKbCommand(argv) {
+  const parsed = parseArgs7({
+    args: argv.slice(1),
+    options: kbFlags,
+    allowPositionals: true
+  });
+  const subcommand = parsed.positionals[0];
+  if (!subcommand || subcommand === "help" || parsed.values.force === void 0 && subcommand !== "dump") {
+    if (subcommand !== "dump") {
+      printKbHelp();
+      return;
+    }
+  }
+  if (subcommand !== "dump") {
+    printKbHelp();
+    throw new Error(`Unknown kb subcommand: ${subcommand}`);
+  }
+  const workspaceRoot = await resolveWorkspaceRoot(process.cwd());
+  const projectDir = parsed.values.project ? path11.join(workspaceRoot, parsed.values.project) : void 0;
+  const candidates = kbLifecycleCandidates(workspaceRoot, projectDir);
+  if (candidates.length === 0) {
+    throw new Error(
+      "Could not find @siteknock/generator (kb-lifecycle). Run `pnpm install` in a project first, or run from within the dev workspace."
+    );
+  }
+  const kbLifecyclePath = candidates[0];
+  const generatorDir = path11.dirname(kbLifecyclePath);
+  const versionCheck = checkVersionMatch(projectDir, generatorDir);
+  if (!versionCheck.match) {
+    console.warn(`\x1B[33m\u26A0 Version mismatch\x1B[0m: ${versionCheck.message}`);
+    console.warn(`\x1B[33m\u26A0\x1B[0m The dumped KB may not match your project's capabilities.`);
+  } else if (versionCheck.projectVersion) {
+    console.log(
+      `\x1B[32m\u2713\x1B[0m Generator v${versionCheck.generatorVersion} matches project sk-version ${versionCheck.projectVersion}`
+    );
+  }
+  const mod = await import(pathToFileURL(kbLifecyclePath).href);
+  const targetDir = parsed.values.dir ? path11.resolve(parsed.values.dir) : path11.join(workspaceRoot, ".agent", "siteknock-kb");
+  await mkdir4(targetDir, { recursive: true });
+  const result = await mod.dumpSiteknockKb(targetDir, { force: parsed.values.force });
+  const manifest = await readWorkspaceManifest(workspaceRoot);
+  const relativeTarget = path11.relative(workspaceRoot, targetDir) || ".";
+  const updated = withSiteknockKb(manifest, { path: relativeTarget, version: result.version });
+  await writeWorkspaceManifest(workspaceRoot, updated);
+  console.log(`\x1B[32m\u2713\x1B[0m Dumped SiteKnock KB v${result.version} to ${targetDir}`);
+  console.log(`\x1B[32m\u2713\x1B[0m ${result.written.length} file(s) written, ${result.skipped.length} preserved`);
+  console.log(`\x1B[32m\u2713\x1B[0m Saved KB reference to ${path11.join(workspaceRoot, "sk-cli.json")}`);
+}
+function printKbHelp() {
+  console.info(`
+  \x1B[1m\x1B[36msiteknock kb\x1B[0m \u2014 SiteKnock Common KB management
+
+  \x1B[1mCommands:\x1B[0m
+    dump [--dir <path>] [--project <folder>] [--force]    Dump the Common KB
+
+  \x1B[1mOptions:\x1B[0m
+    --dir <path>           Target directory (default: <workspace>/.agent/siteknock-kb/)
+    --project, -p <folder> Project to resolve generator from
+    --force                Overwrite existing files
+  `);
+}
+
+// src/cli.ts
+var cliPackageInfo = getCliPackageInfo();
+async function main() {
+  const args = process6.argv.slice(2);
+  const envFile = getFlagValue(args, "--env-file");
+  const commandArgs = stripFlagWithValue(args, "--env-file");
+  const command = getCommand(commandArgs);
+  if (!command && hasGlobalVersionFlag(commandArgs)) {
+    printVersionBanner();
+    return;
+  }
+  loadEnvFile(envFile);
+  if (command === "create") {
+    await runCreateCommand(commandArgs);
+    return;
+  }
+  if (command === "app") {
+    await runAppCommand(commandArgs);
+    return;
+  }
+  if (command === "locale") {
+    await runLocaleCommand(commandArgs);
+    return;
+  }
+  if (command === "verify") {
+    await runVerifyCommand(commandArgs);
+    return;
+  }
+  if (command === "studio") {
+    await runStudioCommand(commandArgs);
+    return;
+  }
+  if (command === "probe") {
+    await runProbeCommand(commandArgs);
+    return;
+  }
+  if (command === "kb") {
+    await runKbCommand(commandArgs);
+    return;
+  }
+  if (!command || command === "help" || commandArgs.includes("--help") || commandArgs.includes("-h")) {
+    printHelp();
+    return;
+  }
+  throw new Error(`Unknown command: ${command}`);
+}
+function getFlagValue(args, flag) {
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === flag) {
+      return args[index + 1];
+    }
+    if (arg.startsWith(`${flag}=`)) {
+      return arg.slice(flag.length + 1);
+    }
+  }
+  return void 0;
+}
+function stripFlagWithValue(args, flag) {
+  const nextArgs = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === flag) {
+      index += 1;
+      continue;
+    }
+    if (arg.startsWith(`${flag}=`)) {
+      continue;
+    }
+    nextArgs.push(arg);
+  }
+  return nextArgs;
+}
+function getCommand(args) {
+  return args.find((value) => !value.startsWith("-"));
+}
+function hasGlobalVersionFlag(args) {
+  return args.includes("--version") || args.includes("-v");
+}
+function printVersionBanner() {
+  const currentYear = (/* @__PURE__ */ new Date()).getFullYear();
+  console.log(String.raw`  ____  _ _         _  __                 _    
+ / ___|(_) |_ ___  | |/ /_ __   ___   ___| | __
+ \___ \| | __/ _ \ | ' /| '_ \ / _ \ / __| |/ /
+  ___) | | ||  __/ | . \| | | | (_) | (__|   < 
+ |____/|_|\__\___| |_|\_\_| |_|\___/ \___|_|\_\
+
+ SiteKnock CLI v${cliPackageInfo.version}
+ Copyright (c) ${currentYear} Coversine LLC. All rights reserved.`);
+}
+function getCliPackageInfo() {
+  const currentFilePath = fileURLToPath2(import.meta.url);
+  let searchDirectory = path12.dirname(currentFilePath);
+  while (true) {
+    const packageJsonPath = path12.join(searchDirectory, "package.json");
+    if (existsSync8(packageJsonPath)) {
+      const packageJson = JSON.parse(readFileSync4(packageJsonPath, "utf8"));
+      if (typeof packageJson.version === "string" && packageJson.version.length > 0) {
+        return { version: packageJson.version };
+      }
+    }
+    const parentDirectory = path12.dirname(searchDirectory);
+    if (parentDirectory === searchDirectory) {
+      break;
+    }
+    searchDirectory = parentDirectory;
+  }
+  return { version: "unknown" };
+}
+function printHelp() {
+  console.log(`Usage:
+  siteknock --version
+  siteknock create [options]
+  siteknock app <create|list|remove> [options]
+  siteknock locale <list|add> [options]
+  siteknock probe [options]
+  siteknock studio [start|stop|restart|status] [options]
+  siteknock verify [options]
+  siteknock kb dump [options]
+
+  sk-cli is available as a backwards-compatible alias for siteknock.
+
+Commands:
+  create    Sign in through SiteKnock, download the licensed core bundle, and configure registry access
+  app       Create, list, or remove apps within a project (frontend / backend / fullstack / e2e)
+  locale    List kit languages or add a language to an app (seeds its locale files)
+  probe     Sign in through SiteKnock and verify registry visibility without creating files
+  studio    Run Studio against the current SiteKnock workspace (Docker container or Electron app)
+  verify    Verify token entitlement against the licensing server
+  kb        Dump the SiteKnock Common KB to a target directory
+
+Common options:
+  -h, --help              Show help
+  -v, --version           Show the SiteKnock CLI version banner
+
+Create options:
+  --project, -p <folder>  Top-level project folder inside the current SiteKnock workspace
+  --version <semver>      Requested SiteKnock version; validated against license range
+  --yes                   Skip interactive confirmation prompts
+
+Studio options:
+  --mode, -m <mode>       Launch mode: "docker" (default) or "app" (Electron desktop)
+  --project, -p <folder>  Project folder to open after Studio starts
+  --port <port>           Host port for Studio container (docker mode; saved in workspace)
+  --container-name <id>   Override the generated Studio container name (docker mode)
+  --no-open               Start Studio without opening the browser / app
+
+Verify options:
+  --token <token>         SiteKnock license token
+  --project, -p <folder>  Read the saved token for a registered project from sk-cli.json
+
+KB options:
+  --dir <path>           Target directory (default: <workspace>/.agent/siteknock-kb/)
+  --project, -p <folder> Project to resolve generator from
+  --force                Overwrite existing files
+  `);
+}
+main().catch((error) => {
+  const message = error instanceof Error ? error.message : String(error);
+  console.error(`ERROR: ${message}`);
+  process6.exitCode = 1;
+});