@softwareseva/cli 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Dinesh Kashikar and contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,19 @@
+# @softwareseva/cli
+
+```bash
+npx @softwareseva/cli init            # AGENTS.md, CLAUDE.md, GEMINI.md, .gitignore lines, renovate.json
+npx @softwareseva/cli add auth        # install @softwareseva/auth, copy its migrations, print its secrets checklist and mount snippet
+npx @softwareseva/cli add deploy-cloudflare   # GitHub Actions: test, migrate D1, deploy Worker (+ web) to staging/production
+npx @softwareseva/cli add deploy-fastlane     # fastlane lanes + workflow for TestFlight/App Store and Google Play
+npx @softwareseva/cli modules         # list template modules
+npx @softwareseva/cli migrate         # copy new package migrations into your migrations dir (tracked in kashi.lock.json)
+npx @softwareseva/cli secrets         # every secret your installed packages need: how to generate, where to store
+npx @softwareseva/cli doctor          # gitignore coverage, tracked secret files, missing secrets, pending migrations
+npx @softwareseva/cli update          # bump every @softwareseva/* package, copy new migrations, refresh module files you have not edited
+```
+
+Packages declare their secrets in `secrets.json` (schema: `secrets.schema.json`) and ship SQL in `migrations/`. The CLI never prints secret values.
+
+## Template modules
+
+Modules render templates with values detected from your project (`--var KEY=VALUE` overrides) and record a hash of each written file in `kashi.lock.json`. On `kashi update`, a file whose content still matches the recorded hash is replaced with the new template; a file you edited keeps your version and receives `<file>.kashi-new` to merge. Module secrets appear in `kashi secrets` and are checked by `kashi doctor` (including GitHub repository secrets via `gh`).

package/dist/bin.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=bin.d.ts.map

package/dist/bin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.d.ts","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":""}

package/dist/bin.js

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+/** kashi CLI entry. */
+import { Command } from "commander";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { add } from "./commands/add.js";
+import { doctor } from "./commands/doctor.js";
+import { init } from "./commands/init.js";
+import { migrate } from "./commands/migrate.js";
+import { secrets } from "./commands/secrets.js";
+import { update } from "./commands/update.js";
+import { listModules, loadModule } from "./modules.js";
+const pkg = JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), "..", "package.json"), "utf8"));
+const program = new Command("kashi").version(pkg.version).description("kashi: updatable feature packages and agent skills for Hono + D1, React and Flutter");
+const cwd = process.cwd();
+program.command("init").description("write AGENTS.md, CLAUDE.md, GEMINI.md, .gitignore lines and renovate.json").option("--force", "overwrite existing files").option("--no-renovate", "skip renovate.json").action((o) => init(cwd, o));
+program.command("add <feature>").description("install a feature package (core, list, auth, sync, ui) or a template module (deploy-cloudflare, deploy-fastlane)").option("--no-install", "skip the package manager").option("--force", "overwrite existing module files").option("--var <KEY=VALUE...>", "set a module variable, e.g. --var APP_DIR=apps/mobile").action((f, o) => { process.exit(add(cwd, f, o, pkg.version)); });
+program.command("modules").description("list template modules").action(() => { for (const m of listModules())
+    console.log(`  ${m.padEnd(20)} ${loadModule(m)?.description ?? ""}`); });
+program.command("migrate").description("copy new package migrations into the migrations directory").option("--dry-run").option("--dir <dir>", "migrations directory").action((o) => { migrate(cwd, o); });
+program.command("secrets").description("list every secret installed packages need; update .dev.vars.example and .gitignore").option("--no-write", "print only").action((o) => secrets(cwd, o));
+program.command("doctor").description("check gitignore, tracked secret files, missing secrets and pending migrations").action(() => { process.exit(doctor(cwd)); });
+program.command("update").description("bump every @softwareseva package, copy new migrations, refresh module templates you have not edited").option("--no-install", "skip the package manager").action((o) => update(cwd, o, pkg.version));
+program.parseAsync(process.argv);
+//# sourceMappingURL=bin.js.map

package/dist/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA,uBAAuB;AACvB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAwB,CAAC;AACzI,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,qFAAqF,CAAC,CAAC;AAC7J,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AAE1B,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,2EAA2E,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AACzO,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,WAAW,CAAC,kHAAkH,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,iCAAiC,CAAC,CAAC,MAAM,CAAC,sBAAsB,EAAE,uDAAuD,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACla,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE;IAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvL,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,2DAA2D,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1M,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,oFAAoF,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/L,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,+EAA+E,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,qGAAqG,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AAC3O,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/commands/add.d.ts

@@ -0,0 +1,6 @@
+export declare function add(cwd: string, feature: string, options: {
+    install?: boolean;
+    force?: boolean;
+    var?: string[];
+}, version?: string): number;
+//# sourceMappingURL=add.d.ts.map

package/dist/commands/add.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../src/commands/add.ts"],"names":[],"mappings":"AAgBA,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,OAAO,SAAU,UAqBnI"}

package/dist/commands/add.js

@@ -0,0 +1,44 @@
+/** `kashi add <feature>`: install the package, copy migrations, print secrets and the mount snippet. */
+import { execSync } from "node:child_process";
+import { log, packageManager } from "../util.js";
+import { migrate } from "./migrate.js";
+import { secrets } from "./secrets.js";
+import { addModule } from "./modules.js";
+import { listModules } from "../modules.js";
+const FEATURES = {
+    core: { pkg: "@softwareseva/core" },
+    list: { pkg: "@softwareseva/list" },
+    auth: { pkg: "@softwareseva/auth", mount: 'app.route("/v1/auth", authRouter({ /* see the auth-sessions skill */ }));' },
+    sync: { pkg: "@softwareseva/sync", mount: 'app.route("/v1/sync", syncRouter({ handlers }));' },
+    ui: { pkg: "@softwareseva/ui" },
+};
+export function add(cwd, feature, options, version = "0.0.0") {
+    if (listModules().includes(feature)) {
+        const vars = Object.fromEntries((options.var ?? []).map((kv) => { const i = kv.indexOf("="); return [kv.slice(0, i), kv.slice(i + 1)]; }));
+        const code = addModule(cwd, feature, version, { force: options.force, vars });
+        if (code === 0)
+            secrets(cwd, { only: feature });
+        return code;
+    }
+    const spec = FEATURES[feature];
+    if (!spec) {
+        log.warn(`unknown feature "${feature}". Known: ${[...Object.keys(FEATURES), ...listModules()].join(", ")}`);
+        return 1;
+    }
+    log.title(`kashi add ${feature}`);
+    if (options.install !== false) {
+        const pm = packageManager(cwd);
+        const cmd = `${pm} add ${spec.pkg}`;
+        log.info(`running: ${cmd}`);
+        execSync(cmd, { cwd, stdio: "inherit" });
+    }
+    migrate(cwd, {});
+    secrets(cwd, {});
+    if (spec.mount) {
+        log.title("mount in your composition root:");
+        console.log(`  ${spec.mount}`);
+    }
+    log.info(`then load the matching skill (e.g. \`${feature === "auth" ? "auth-sessions" : feature}\`) for wiring details`);
+    return 0;
+}
+//# sourceMappingURL=add.js.map

package/dist/commands/add.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.js","sourceRoot":"","sources":["../../src/commands/add.ts"],"names":[],"mappings":"AAAA,wGAAwG;AACxG,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,MAAM,QAAQ,GAAoD;IAChE,IAAI,EAAE,EAAE,GAAG,EAAE,oBAAoB,EAAE;IACnC,IAAI,EAAE,EAAE,GAAG,EAAE,oBAAoB,EAAE;IACnC,IAAI,EAAE,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,2EAA2E,EAAE;IACvH,IAAI,EAAE,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,kDAAkD,EAAE;IAC9F,EAAE,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE;CAChC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,OAAe,EAAE,OAA+D,EAAE,OAAO,GAAG,OAAO;IAClI,IAAI,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3I,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;QAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,OAAO,aAAa,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACrI,GAAG,CAAC,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;IAClC,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,GAAG,EAAE,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC;QAC5B,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACjB,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACjB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,GAAG,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAAC,CAAC;IACjG,GAAG,CAAC,IAAI,CAAC,wCAAwC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,wBAAwB,CAAC,CAAC;IACzH,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/doctor.d.ts

@@ -0,0 +1,2 @@
+export declare function doctor(cwd: string): number;
+//# sourceMappingURL=doctor.d.ts.map

package/dist/commands/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AASA,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CA2D1C"}

package/dist/commands/doctor.js

@@ -0,0 +1,97 @@
+/** `kashi doctor`: gitignore coverage, tracked secret files, missing local secrets, pending migrations. */
+import { execSync } from "node:child_process";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { installedPackages, log, migrationsDir, readJson } from "../util.js";
+import { collectSecrets } from "./secrets.js";
+const SECRET_GLOBS = [".dev.vars", ".env", ".env.local", ".env.production", "*.p8", "*.p12", "*.keystore", "*.jks", "*.mobileprovision"];
+export function doctor(cwd) {
+    log.title("kashi doctor");
+    let problems = 0;
+    const fail = (msg) => { log.warn(msg); problems += 1; };
+    // 1. gitignore (ask git so parent and global ignore files count; fall back to reading .gitignore)
+    const sample = (g) => (g.startsWith("*") ? `kashi-doctor-sample${g.slice(1)}` : g);
+    let uncovered;
+    try {
+        execSync("git rev-parse --is-inside-work-tree", { cwd, stdio: "ignore" });
+        uncovered = SECRET_GLOBS.filter((g) => { try {
+            execSync(`git check-ignore -q "${sample(g)}"`, { cwd, stdio: "ignore" });
+            return false;
+        }
+        catch {
+            return true;
+        } });
+    }
+    catch {
+        const lines = existsSync(join(cwd, ".gitignore")) ? readFileSync(join(cwd, ".gitignore"), "utf8").split(/\r?\n/).map((l) => l.trim()) : [];
+        uncovered = SECRET_GLOBS.filter((g) => !lines.includes(g) && !lines.includes(`/${g}`) && !(g.startsWith(".env.") && lines.includes(".env.*")));
+    }
+    uncovered.length ? fail(`.gitignore does not cover: ${uncovered.join(", ")} (run: kashi secrets)`) : log.ok(".gitignore covers secret files");
+    // 2. tracked secret files
+    try {
+        const tracked = execSync("git ls-files", { cwd, encoding: "utf8" }).split("\n").filter(Boolean);
+        const leaked = tracked.filter((f) => SECRET_GLOBS.some((g) => (g.startsWith("*") ? f.endsWith(g.slice(1)) : f === g || f.endsWith(`/${g}`))));
+        leaked.length ? fail(`secret files are tracked by git: ${leaked.join(", ")} (git rm --cached them and rotate the secrets)`) : log.ok("no secret files tracked by git");
+    }
+    catch {
+        log.info("not a git repository; skipped tracked-file check");
+    }
+    // 3. required secrets present locally
+    const declared = collectSecrets(cwd);
+    const required = declared.filter(({ entry }) => !entry.optional && !entry.when);
+    const conditional = declared.filter(({ entry }) => !entry.optional && entry.when);
+    if (conditional.length)
+        log.info(`conditional secrets (needed only when the feature is on): ${conditional.map((s) => `${s.entry.name} [${s.entry.when}]`).join(", ")}`);
+    if (required.length) {
+        const devVars = existsSync(join(cwd, ".dev.vars")) ? readFileSync(join(cwd, ".dev.vars"), "utf8") : "";
+        const missing = required.filter(({ entry }) => entry.store.includes("dev-vars") && !new RegExp(`^${entry.name}=.+`, "m").test(devVars));
+        missing.length ? fail(`.dev.vars is missing values for: ${missing.map((m) => m.entry.name).join(", ")}`) : log.ok("all required local secrets are set in .dev.vars");
+        const remote = wranglerSecretNames(cwd);
+        if (remote) {
+            const missingRemote = required.filter(({ entry }) => entry.store.includes("wrangler-secret") && !remote.has(entry.name));
+            missingRemote.length ? fail(`deployed Worker is missing secrets: ${missingRemote.map((m) => m.entry.name).join(", ")} (wrangler secret put NAME)`) : log.ok("deployed Worker has every required secret");
+        }
+    }
+    else
+        log.info("no required secrets declared by installed packages");
+    // 4. CI secrets (GitHub) for declared ci-secret entries
+    const ciRequired = collectSecrets(cwd).filter(({ entry }) => entry.store.includes("ci-secret") && !entry.optional && !entry.when);
+    if (ciRequired.length) {
+        const names = ghSecretNames(cwd);
+        if (names) {
+            const missingCi = [...new Set(ciRequired.map((s) => s.entry.name))].filter((n) => !names.has(n));
+            missingCi.length ? fail(`GitHub is missing repository secrets: ${missingCi.join(", ")} (gh secret set NAME)`) : log.ok("GitHub has every required CI secret");
+        }
+    }
+    // 5. pending migrations
+    const lock = readJson(join(cwd, "kashi.lock.json")) ?? { migrations: {} };
+    const dir = migrationsDir(cwd);
+    const present = existsSync(dir) ? readdirSync(dir) : [];
+    const pending = installedPackages(cwd).flatMap((p) => p.migrations.filter((m) => !lock.migrations[`${p.name}/${m}`] && !present.some((f) => f.endsWith(`_${m}`))).map((m) => `${p.name}/${m}`));
+    pending.length ? fail(`package migrations not yet copied: ${pending.join(", ")} (run: kashi migrate)`) : log.ok("all package migrations are copied");
+    console.log(problems ? `\n${problems} problem(s) found` : "\nall good");
+    return problems ? 1 : 0;
+}
+function wranglerSecretNames(cwd) {
+    if (!["wrangler.jsonc", "wrangler.json", "wrangler.toml"].some((f) => existsSync(join(cwd, f))))
+        return null;
+    try {
+        const out = execSync("wrangler secret list --format json 2>/dev/null", { cwd, encoding: "utf8", timeout: 20_000 });
+        return new Set(JSON.parse(out).map((s) => s.name));
+    }
+    catch {
+        log.info("could not read deployed secrets (wrangler not logged in?); skipped");
+        return null;
+    }
+}
+function ghSecretNames(cwd) {
+    try {
+        const out = execSync("gh secret list --json name", { cwd, encoding: "utf8", timeout: 20_000, stdio: ["ignore", "pipe", "ignore"] });
+        return new Set(JSON.parse(out).map((s) => s.name));
+    }
+    catch {
+        log.info("could not read GitHub secrets (gh not logged in or no remote); skipped");
+        return null;
+    }
+}
+//# sourceMappingURL=doctor.js.map

package/dist/commands/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,YAAY,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAEzI,MAAM,UAAU,MAAM,CAAC,GAAW;IAChC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC1B,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhE,kGAAkG;IAClG,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,SAAmB,CAAC;IACxB,IAAI,CAAC;QACH,QAAQ,CAAC,qCAAqC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1E,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC;YAAC,QAAQ,CAAC,wBAAwB,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrK,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3I,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACjJ,CAAC;IACD,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,8BAA8B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,gCAAgC,CAAC,CAAC;IAE9I,0BAA0B;IAC1B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,QAAQ,CAAC,cAAc,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9I,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,oCAAoC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,gCAAgC,CAAC,CAAC;IACzK,CAAC;IAAC,MAAM,CAAC;QAAC,GAAG,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAAC,CAAC;IAEzE,sCAAsC;IACtC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChF,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;IAClF,IAAI,WAAW,CAAC,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,6DAA6D,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACxI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,oCAAoC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,iDAAiD,CAAC,CAAC;QACrK,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACzH,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,uCAAuC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,2CAA2C,CAAC,CAAC;QAC3M,CAAC;IACH,CAAC;;QAAM,GAAG,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IAEtE,wDAAwD;IACxD,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClI,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,yCAAyC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,qCAAqC,CAAC,CAAC;QAChK,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,MAAM,IAAI,GAAG,QAAQ,CAAyC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAClH,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAChM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,sCAAsC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,mCAAmC,CAAC,CAAC;IAErJ,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACxE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,CAAC,CAAC,gBAAgB,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7G,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,gDAAgD,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACnH,OAAO,IAAI,GAAG,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QAAC,GAAG,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1G,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,4BAA4B,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACpI,OAAO,IAAI,GAAG,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QAAC,GAAG,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC9G,CAAC"}

package/dist/commands/init.d.ts

@@ -0,0 +1,5 @@
+export declare function init(cwd: string, options: {
+    force?: boolean;
+    renovate?: boolean;
+}): void;
+//# sourceMappingURL=init.d.ts.map

package/dist/commands/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAKA,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,QAcjF"}

package/dist/commands/init.js

@@ -0,0 +1,20 @@
+/** `kashi init`: AGENTS.md, CLAUDE.md, GEMINI.md, .gitignore lines, renovate.json. */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { ensureLines, log, templatesDir, writeIfAbsent } from "../util.js";
+export function init(cwd, options) {
+    log.title("kashi init");
+    for (const file of ["AGENTS.md", "CLAUDE.md", "GEMINI.md"]) {
+        const written = writeIfAbsent(join(cwd, file), readFileSync(join(templatesDir, file), "utf8"), options.force);
+        written ? log.ok(`wrote ${file}`) : log.info(`${file} exists (use --force to overwrite)`);
+    }
+    const ignore = readFileSync(join(templatesDir, "gitignore"), "utf8").split("\n").filter((l) => l && !l.startsWith("#"));
+    const added = ensureLines(join(cwd, ".gitignore"), ignore, "# kashi: secrets and build output");
+    added.length ? log.ok(`added ${added.length} .gitignore lines`) : log.info(".gitignore already covers kashi secrets");
+    if (options.renovate !== false) {
+        const written = writeIfAbsent(join(cwd, "renovate.json"), readFileSync(join(templatesDir, "renovate.json"), "utf8"), options.force);
+        written ? log.ok("wrote renovate.json (groups @softwareseva/* and kashi_* bumps)") : log.info("renovate.json exists");
+    }
+    log.info("next: fill the product and repository-map sections of AGENTS.md, then `npx @softwareseva/cli add <feature>`");
+}
+//# sourceMappingURL=init.js.map

package/dist/commands/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,UAAU,IAAI,CAAC,GAAW,EAAE,OAAgD;IAChF,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACxB,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9G,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,oCAAoC,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACxH,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,mCAAmC,CAAC,CAAC;IAChG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,KAAK,CAAC,MAAM,mBAAmB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACtH,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACpI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,gEAAgE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACxH,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,6GAA6G,CAAC,CAAC;AAC1H,CAAC"}

package/dist/commands/migrate.d.ts

@@ -0,0 +1,6 @@
+export declare function migrate(cwd: string, options: {
+    dryRun?: boolean;
+    dir?: string;
+}): number;
+export declare const hasMigrations: (cwd: string) => boolean;
+//# sourceMappingURL=migrate.d.ts.map

package/dist/commands/migrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/commands/migrate.ts"],"names":[],"mappings":"AAOA,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,UAwB/E;AAED,eAAO,MAAM,aAAa,GAAI,KAAK,MAAM,YAAmC,CAAC"}

package/dist/commands/migrate.js

@@ -0,0 +1,37 @@
+/** `kashi migrate`: copy package-shipped SQL migrations into the project's migrations directory. */
+import { copyFileSync, existsSync, mkdirSync, readdirSync, writeFileSync } from "node:fs";
+import { join, relative } from "node:path";
+import { installedPackages, log, migrationsDir, readJson } from "../util.js";
+export function migrate(cwd, options) {
+    log.title("kashi migrate");
+    const target = options.dir ? join(cwd, options.dir) : migrationsDir(cwd);
+    mkdirSync(target, { recursive: true });
+    const lockPath = join(cwd, "kashi.lock.json");
+    const lock = readJson(lockPath) ?? { migrations: {} };
+    const existing = readdirSync(target).filter((f) => f.endsWith(".sql")).sort();
+    let next = existing.reduce((max, f) => Math.max(max, Number(f.match(/^(\d+)_/)?.[1] ?? 0)), 0) + 1;
+    let copied = 0;
+    for (const pkg of installedPackages(cwd)) {
+        for (const file of pkg.migrations) {
+            const key = `${pkg.name}/${file}`;
+            if (lock.migrations[key] || existing.some((f) => f.endsWith(`_${file}`)))
+                continue;
+            const name = `${String(next).padStart(4, "0")}_${file}`;
+            if (!options.dryRun)
+                copyFileSync(join(pkg.dir, "migrations", file), join(target, name));
+            lock.migrations[key] = name;
+            log.ok(`${options.dryRun ? "would copy" : "copied"} ${key} -> ${relative(cwd, join(target, name))}`);
+            next += 1;
+            copied += 1;
+        }
+    }
+    if (!options.dryRun && copied)
+        writeFileSync(lockPath, JSON.stringify(lock, null, 2) + "\n");
+    if (!copied)
+        log.info("no new package migrations");
+    else
+        log.info(`apply with: wrangler d1 migrations apply <DB_NAME> --local (then --remote when ready)`);
+    return copied;
+}
+export const hasMigrations = (cwd) => existsSync(migrationsDir(cwd));
+//# sourceMappingURL=migrate.js.map

package/dist/commands/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../src/commands/migrate.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAI7E,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,OAA2C;IAC9E,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IACzE,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,QAAQ,CAAO,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9E,IAAI,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACnG,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,GAAG,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;YAClC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;gBAAE,SAAS;YACnF,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YACxD,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YACzF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,OAAO,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;YACrG,IAAI,IAAI,CAAC,CAAC;YAAC,MAAM,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,MAAM;QAAE,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC7F,IAAI,CAAC,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;;QAC9C,GAAG,CAAC,IAAI,CAAC,uFAAuF,CAAC,CAAC;IACvG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC"}

package/dist/commands/modules.d.ts

@@ -0,0 +1,14 @@
+export declare function addModule(cwd: string, name: string, version: string, options: {
+    force?: boolean;
+    vars?: Record<string, string>;
+}): number;
+/**
+ * Re-render every installed module with the current templates. Files you have not edited are
+ * updated in place; edited files get the new version next to them as `<file>.kashi-new`.
+ */
+export declare function updateModules(cwd: string, version: string): {
+    updated: string[];
+    conflicts: string[];
+};
+export declare const installedModules: (cwd: string) => string[];
+//# sourceMappingURL=modules.d.ts.map

package/dist/commands/modules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../../src/commands/modules.ts"],"names":[],"mappings":"AAUA,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,MAAM,CAiCzI;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA+BtG;AAED,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,aAA6C,CAAC"}

package/dist/commands/modules.js

@@ -0,0 +1,104 @@
+/** `kashi add <module>` for template modules and the module half of `kashi update`. */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { ensureLines, log, readJson } from "../util.js";
+import { loadModule, moduleSecrets, renderModule, renderNext, resolveVars, sha } from "../modules.js";
+const lockPath = (cwd) => join(cwd, "kashi.lock.json");
+const readLock = (cwd) => readJson(lockPath(cwd)) ?? { migrations: {} };
+const writeLock = (cwd, lock) => writeFileSync(lockPath(cwd), JSON.stringify(lock, null, 2) + "\n");
+export function addModule(cwd, name, version, options) {
+    const spec = loadModule(name);
+    if (!spec)
+        return -1;
+    log.title(`kashi add ${name}`);
+    log.info(spec.description);
+    const lock = readLock(cwd);
+    const vars = resolveVars(spec, cwd, options.vars ?? {}, lock.modules?.[name]?.vars);
+    for (const [k, v] of Object.entries(vars))
+        log.info(`${k} = ${v || "(empty)"}${spec.vars[k]?.help ? `  — ${spec.vars[k].help}` : ""}`);
+    const files = {};
+    for (const file of renderModule(spec, vars)) {
+        const path = join(cwd, file.dest);
+        if (existsSync(path) && (file.ifMissing || !options.force) && readFileSync(path, "utf8") !== file.content) {
+            log.warn(`${file.dest} exists; left unchanged${file.ifMissing ? "" : " (use --force to overwrite)"}`);
+            files[file.dest] = lock.modules?.[name]?.files[file.dest] ?? sha(readFileSync(path, "utf8"));
+            continue;
+        }
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, file.content);
+        files[file.dest] = sha(file.content);
+        log.ok(`wrote ${file.dest}`);
+    }
+    const manifest = moduleSecrets(name);
+    const ignore = (manifest?.secrets ?? []).flatMap((s) => s.gitignore ?? []);
+    if (ignore.length) {
+        const added = ensureLines(join(cwd, ".gitignore"), [...new Set(ignore)], `# kashi: ${name} secrets`);
+        if (added.length)
+            log.ok(`added ${added.length} .gitignore line(s)`);
+    }
+    lock.modules = { ...(lock.modules ?? {}), [name]: { version, vars, files } };
+    writeLock(cwd, lock);
+    const next = renderNext(spec, vars);
+    if (next.length) {
+        log.title("next steps:");
+        next.forEach((n, i) => console.log(`  ${i + 1}. ${n}`));
+    }
+    log.info("secrets for this module: npx @softwareseva/cli secrets");
+    return 0;
+}
+/**
+ * Re-render every installed module with the current templates. Files you have not edited are
+ * updated in place; edited files get the new version next to them as `<file>.kashi-new`.
+ */
+export function updateModules(cwd, version) {
+    const lock = readLock(cwd);
+    const updated = [];
+    const conflicts = [];
+    for (const [name, installed] of Object.entries(lock.modules ?? {})) {
+        const spec = loadModule(name);
+        if (!spec) {
+            log.warn(`module ${name} is no longer shipped by @softwareseva/cli; left as is`);
+            continue;
+        }
+        const vars = resolveVars(spec, cwd, {}, installed.vars);
+        for (const file of renderModule(spec, vars)) {
+            const path = join(cwd, file.dest);
+            const nextHash = sha(file.content);
+            const baseHash = installed.files[file.dest];
+            if (!existsSync(path)) {
+                if (file.ifMissing && baseHash)
+                    continue;
+                mkdirSync(dirname(path), { recursive: true });
+                writeFileSync(path, file.content);
+                installed.files[file.dest] = nextHash;
+                updated.push(file.dest);
+                continue;
+            }
+            const current = readFileSync(path, "utf8");
+            if (sha(current) === nextHash) {
+                installed.files[file.dest] = nextHash;
+                continue;
+            }
+            if (file.ifMissing)
+                continue;
+            if (sha(current) === baseHash) {
+                writeFileSync(path, file.content);
+                installed.files[file.dest] = nextHash;
+                updated.push(file.dest);
+            }
+            else if (baseHash !== nextHash) {
+                writeFileSync(`${path}.kashi-new`, file.content);
+                conflicts.push(file.dest);
+            }
+        }
+        installed.version = version;
+    }
+    writeLock(cwd, lock);
+    updated.forEach((f) => log.ok(`updated ${f}`));
+    conflicts.forEach((f) => log.warn(`${f} has local edits; the new template is in ${f}.kashi-new — merge it, then delete the .kashi-new file`));
+    if (!updated.length && !conflicts.length && Object.keys(lock.modules ?? {}).length)
+        log.ok("module templates are current");
+    return { updated, conflicts };
+}
+export const installedModules = (cwd) => Object.keys(readLock(cwd).modules ?? {});
+//# sourceMappingURL=modules.js.map

package/dist/commands/modules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"modules.js","sourceRoot":"","sources":["../../src/commands/modules.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAa,MAAM,eAAe,CAAC;AAEjH,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;AAC/D,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAQ,EAAE,CAAC,QAAQ,CAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AAC5F,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,IAAU,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAElH,MAAM,UAAU,SAAS,CAAC,GAAW,EAAE,IAAY,EAAE,OAAe,EAAE,OAA2D;IAC/H,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,CAAC;IACrB,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAC/B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACpF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxI,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1G,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,0BAA0B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,6BAA6B,EAAE,CAAC,CAAC;YACtG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC7F,SAAS;QACX,CAAC;QACD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,GAAG,CAAC,EAAE,CAAC,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,YAAY,IAAI,UAAU,CAAC,CAAC;QACrG,IAAI,KAAK,CAAC,MAAM;YAAE,GAAG,CAAC,EAAE,CAAC,SAAS,KAAK,CAAC,MAAM,qBAAqB,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;IAC7E,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrB,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IACvG,GAAG,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACnE,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,OAAe;IACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAAC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,wDAAwD,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC1G,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACxD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnC,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,IAAI,IAAI,CAAC,SAAS,IAAI,QAAQ;oBAAE,SAAS;gBACzC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAC,SAAS;YAC7J,CAAC;YACD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC3C,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;gBAAC,SAAS;YAAC,CAAC;YACnF,IAAI,IAAI,CAAC,SAAS;gBAAE,SAAS;YAC7B,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC9B,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpG,CAAC;iBAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACjC,aAAa,CAAC,GAAG,IAAI,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QACD,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC;IAC9B,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/C,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,4CAA4C,CAAC,wDAAwD,CAAC,CAAC,CAAC;IAC9I,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM;QAAE,GAAG,CAAC,EAAE,CAAC,8BAA8B,CAAC,CAAC;IAC3H,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC"}

package/dist/commands/secrets.d.ts

@@ -0,0 +1,10 @@
+import { type SecretEntry } from "../util.js";
+export declare function collectSecrets(cwd: string): {
+    pkg: string;
+    entry: SecretEntry;
+}[];
+export declare function secrets(cwd: string, options: {
+    write?: boolean;
+    only?: string;
+}): void;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/commands/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/commands/secrets.ts"],"names":[],"mappings":"AAGA,OAAO,EAAiD,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAG7F,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,EAAE,CAKjF;AAED,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,QAyB/E"}

package/dist/commands/secrets.js

@@ -0,0 +1,55 @@
+/** `kashi secrets`: checklist of every secret installed packages need, plus .dev.vars.example and .gitignore upkeep. */
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { ensureLines, installedPackages, log, readJson } from "../util.js";
+import { moduleSecrets } from "../modules.js";
+export function collectSecrets(cwd) {
+    const fromPackages = installedPackages(cwd).flatMap((pkg) => (pkg.secrets?.secrets ?? []).map((entry) => ({ pkg: pkg.name, entry })));
+    const modules = Object.keys(readJson(join(cwd, "kashi.lock.json"))?.modules ?? {});
+    const fromModules = modules.flatMap((m) => (moduleSecrets(m)?.secrets ?? []).map((entry) => ({ pkg: m, entry })));
+    return [...fromPackages, ...fromModules];
+}
+export function secrets(cwd, options) {
+    log.title("kashi secrets");
+    const all = collectSecrets(cwd).filter(({ pkg }) => !options.only || pkg === options.only);
+    if (!all.length) {
+        log.info("no installed @softwareseva package declares secrets");
+        return;
+    }
+    for (const { pkg, entry } of all) {
+        console.log(`\n  ${entry.name}${entry.optional ? " (optional)" : ""}  [${pkg}${entry.usedBy ? ` ${entry.usedBy}` : ""}]`);
+        console.log(`    ${entry.description}`);
+        console.log(`    generate: ${entry.generate}`);
+        console.log(`    store:    ${entry.store.map(storeHint).join("; ")}`);
+        if (entry.rotate)
+            console.log(`    rotate:   ${entry.rotate}`);
+        if (entry.when)
+            console.log(`    when:     ${entry.when}`);
+    }
+    if (options.write !== false) {
+        const names = [...new Set(all.filter(({ entry }) => entry.store.includes("dev-vars")).map(({ entry }) => entry.name))];
+        const examplePath = join(cwd, ".dev.vars.example");
+        const existing = existsSync(examplePath) ? readFileSync(examplePath, "utf8") : "";
+        const missing = names.filter((n) => !new RegExp(`^${n}=`, "m").test(existing));
+        if (missing.length && names.length) {
+            writeFileSync(examplePath, `${existing.trimEnd()}${existing ? "\n" : ""}${missing.map((n) => `${n}=`).join("\n")}\n`);
+            log.ok(`added ${missing.length} placeholder(s) to .dev.vars.example`);
+        }
+        const ignore = [".dev.vars", ".env", ...all.flatMap(({ entry }) => entry.gitignore ?? [])];
+        const added = ensureLines(join(cwd, ".gitignore"), [...new Set(ignore)], "# kashi: secrets");
+        if (added.length)
+            log.ok(`added ${added.length} .gitignore line(s)`);
+    }
+}
+function storeHint(store) {
+    switch (store) {
+        case "wrangler-secret": return "production: wrangler secret put NAME";
+        case "dev-vars": return "local: NAME=value in .dev.vars";
+        case "ci-secret": return "CI: repository secret (gh secret set NAME)";
+        case "env": return "environment variable";
+        case "match": return "fastlane match (encrypted certificates repo)";
+        case "keychain": return "developer keychain, never in the repo";
+        default: return store;
+    }
+}
+//# sourceMappingURL=secrets.js.map

package/dist/commands/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/commands/secrets.ts"],"names":[],"mappings":"AAAA,wHAAwH;AACxH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,EAAE,QAAQ,EAAoB,MAAM,YAAY,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAa,MAAM,eAAe,CAAC;AAEzD,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACtI,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IACzF,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAClH,OAAO,CAAC,GAAG,YAAY,EAAE,GAAG,WAAW,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,OAA2C;IAC9E,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3F,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAC7F,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1H,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtE,IAAI,KAAK,CAAC,MAAM;YAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/D,IAAI,KAAK,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvH,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/E,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACnC,aAAa,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtH,GAAG,CAAC,EAAE,CAAC,SAAS,OAAO,CAAC,MAAM,sCAAsC,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;QAC7F,IAAI,KAAK,CAAC,MAAM;YAAE,GAAG,CAAC,EAAE,CAAC,SAAS,KAAK,CAAC,MAAM,qBAAqB,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,iBAAiB,CAAC,CAAC,OAAO,sCAAsC,CAAC;QACtE,KAAK,UAAU,CAAC,CAAC,OAAO,gCAAgC,CAAC;QACzD,KAAK,WAAW,CAAC,CAAC,OAAO,4CAA4C,CAAC;QACtE,KAAK,KAAK,CAAC,CAAC,OAAO,sBAAsB,CAAC;QAC1C,KAAK,OAAO,CAAC,CAAC,OAAO,8CAA8C,CAAC;QACpE,KAAK,UAAU,CAAC,CAAC,OAAO,uCAAuC,CAAC;QAChE,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC;IACxB,CAAC;AACH,CAAC"}

package/dist/commands/update.d.ts

@@ -0,0 +1,4 @@
+export declare function update(cwd: string, options: {
+    install?: boolean;
+}, cliVersion?: string): void;
+//# sourceMappingURL=update.d.ts.map

package/dist/commands/update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/commands/update.ts"],"names":[],"mappings":"AAQA,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,EAAE,UAAU,SAAU,QAYvF"}