@softwareseva/cli 0.1.0

package/dist/commands/update.js

@@ -0,0 +1,57 @@
+/** `kashi update`: bump every @softwareseva package, copy new migrations, report app-side template drift. */
+import { execSync } from "node:child_process";
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { join, relative } from "node:path";
+import { installedPackages, log, packageManager } from "../util.js";
+import { migrate } from "./migrate.js";
+import { updateModules } from "./modules.js";
+export function update(cwd, options, cliVersion = "0.0.0") {
+    log.title("kashi update");
+    const pm = packageManager(cwd);
+    if (options.install !== false) {
+        const cmd = pm === "pnpm" ? 'pnpm up "@softwareseva/*" --latest' : pm === "yarn" ? 'yarn up "@softwareseva/*"' : pm === "bun" ? 'bun update "@softwareseva/*"' : 'npm update "@softwareseva/*"';
+        log.info(`running: ${cmd}`);
+        execSync(cmd, { cwd, stdio: "inherit" });
+    }
+    for (const pkg of installedPackages(cwd))
+        log.ok(`${pkg.name}@${pkg.version}`);
+    migrate(cwd, {});
+    updateModules(cwd, cliVersion);
+    reportDrift(cwd, cliVersion);
+}
+/** Files copied by `kashi add` carry `kashi:<package>@<version>`; flag those behind the installed version. */
+function reportDrift(cwd, cliVersion) {
+    const versions = new Map(installedPackages(cwd).map((p) => [p.name, p.version]));
+    versions.set("@softwareseva/cli", cliVersion);
+    const stale = [];
+    walk(cwd, (file) => {
+        let head = "";
+        try {
+            head = readFileSync(file, "utf8").slice(0, 400);
+        }
+        catch {
+            return;
+        }
+        const m = head.match(/kashi:(@softwareseva\/[a-z-]+)@(\d+\.\d+\.\d+)/);
+        if (m && versions.get(m[1]) && versions.get(m[1]) !== m[2])
+            stale.push(`${relative(cwd, file)} (from ${m[1]}@${m[2]}, installed ${versions.get(m[1])})`);
+    });
+    if (stale.length) {
+        log.title("template files written by an older package version (review the package CHANGELOG, re-run `kashi add --force` to overwrite):");
+        stale.forEach((s) => log.warn(s));
+    }
+    else
+        log.ok("no template drift");
+}
+function walk(dir, visit, depth = 0) {
+    if (depth > 6)
+        return;
+    for (const name of readdirSync(dir)) {
+        if (["node_modules", ".git", "dist", "build", ".dart_tool", ".wrangler"].includes(name))
+            continue;
+        const path = join(dir, name);
+        const st = statSync(path);
+        st.isDirectory() ? walk(path, visit, depth + 1) : visit(path);
+    }
+}
+//# sourceMappingURL=update.js.map

package/dist/commands/update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../../src/commands/update.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,UAAU,MAAM,CAAC,GAAW,EAAE,OAA8B,EAAE,UAAU,GAAG,OAAO;IACtF,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,8BAA8B,CAAC;QAChM,GAAG,CAAC,IAAI,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC;QAC5B,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,iBAAiB,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACjB,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC/B,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AAC/B,CAAC;AAED,8GAA8G;AAC9G,SAAS,WAAW,CAAC,GAAW,EAAE,UAAkB;IAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACjF,QAAQ,CAAC,GAAG,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;QACjB,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YAAC,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO;QAAC,CAAC;QAC1E,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACvE,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC;IAC9J,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,KAAK,CAAC,6HAA6H,CAAC,CAAC;QAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;;QAC7L,GAAG,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,IAAI,CAAC,GAAW,EAAE,KAA6B,EAAE,KAAK,GAAG,CAAC;IACjE,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO;IACtB,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QAClG,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1B,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;AACH,CAAC"}

package/dist/modules.d.ts

@@ -0,0 +1,42 @@
+import { type SecretsManifest } from "./util.js";
+export type ModuleVar = {
+    detect?: string;
+    default?: string;
+    help?: string;
+};
+export type ModuleFile = {
+    from: string;
+    to: string;
+    when?: string;
+    ifMissing?: boolean;
+};
+export type ModuleSpec = {
+    name: string;
+    description: string;
+    vars: Record<string, ModuleVar>;
+    files: ModuleFile[];
+    next?: string[];
+};
+export type RenderedFile = {
+    dest: string;
+    content: string;
+    ifMissing: boolean;
+};
+export type LockModule = {
+    version: string;
+    vars: Record<string, string>;
+    files: Record<string, string>;
+};
+export type Lock = {
+    migrations: Record<string, string>;
+    modules?: Record<string, LockModule>;
+};
+export declare const listModules: () => string[];
+export declare const loadModule: (name: string) => ModuleSpec | null;
+export declare const moduleSecrets: (name: string) => SecretsManifest | null;
+export declare const sha: (text: string) => string;
+export declare function resolveVars(spec: ModuleSpec, cwd: string, given: Record<string, string>, previous?: Record<string, string>): Record<string, string>;
+export declare function renderModule(spec: ModuleSpec, vars: Record<string, string>): RenderedFile[];
+export declare const renderNext: (spec: ModuleSpec, vars: Record<string, string>) => string[];
+export declare const moduleFileDir: (dest: string) => string;
+//# sourceMappingURL=modules.d.ts.map

package/dist/modules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAIA,OAAO,EAA0B,KAAK,eAAe,EAAE,MAAM,WAAW,CAAC;AAEzE,MAAM,MAAM,SAAS,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAC7E,MAAM,MAAM,UAAU,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAC1F,MAAM,MAAM,UAAU,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAAC,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AACtI,MAAM,MAAM,YAAY,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC;AACjF,MAAM,MAAM,UAAU,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC;AAC1G,MAAM,MAAM,IAAI,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;CAAE,CAAC;AAIhG,eAAO,MAAM,WAAW,QAAO,MAAM,EAA2H,CAAC;AACjK,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,KAAG,UAAU,GAAG,IAAmE,CAAC;AAC3H,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,eAAe,GAAG,IAAyE,CAAC;AAEzI,eAAO,MAAM,GAAG,GAAI,MAAM,MAAM,WAAiE,CAAC;AAwClG,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMvJ;AAKD,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,YAAY,EAAE,CAI3F;AAED,eAAO,MAAM,UAAU,GAAI,MAAM,UAAU,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,aAAwD,CAAC;AAClI,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,WAAkB,CAAC"}

package/dist/modules.js

@@ -0,0 +1,69 @@
+/** Deploy and scaffold modules: templates rendered with project values, tracked by content hash for safe updates. */
+import { createHash } from "node:crypto";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { dirname, join, relative } from "node:path";
+import { readJson, templatesDir } from "./util.js";
+const modulesDir = join(templatesDir, "modules");
+export const listModules = () => (existsSync(modulesDir) ? readdirSync(modulesDir).filter((n) => existsSync(join(modulesDir, n, "module.json"))) : []);
+export const loadModule = (name) => readJson(join(modulesDir, name, "module.json"));
+export const moduleSecrets = (name) => readJson(join(modulesDir, name, "secrets.json"));
+export const sha = (text) => createHash("sha256").update(text).digest("hex").slice(0, 16);
+/** Values from the project: where wrangler/flutter live, bundle ids, package names. */
+const detectors = {
+    wranglerDir: (cwd) => findUp(cwd, (d) => ["wrangler.jsonc", "wrangler.json", "wrangler.toml"].some((f) => existsSync(join(d, f)))),
+    flutterDir: (cwd) => findUp(cwd, (d) => existsSync(join(d, "pubspec.yaml")) && existsSync(join(d, "ios")) && existsSync(join(d, "android"))),
+    iosBundleId: (cwd) => {
+        const dir = detectors.flutterDir(cwd);
+        const pbx = dir !== undefined ? join(cwd, dir, "ios/Runner.xcodeproj/project.pbxproj") : "";
+        if (!pbx || !existsSync(pbx))
+            return undefined;
+        const ids = [...readFileSync(pbx, "utf8").matchAll(/PRODUCT_BUNDLE_IDENTIFIER = "?([A-Za-z0-9.\-]+)"?;/g)].map((m) => m[1]).filter((id) => !/Tests$/.test(id));
+        return ids[0];
+    },
+    androidPackage: (cwd) => {
+        const dir = detectors.flutterDir(cwd);
+        if (dir === undefined)
+            return undefined;
+        for (const f of ["android/app/build.gradle.kts", "android/app/build.gradle"]) {
+            const p = join(cwd, dir, f);
+            if (existsSync(p))
+                return readFileSync(p, "utf8").match(/applicationId\s*=?\s*"([^"]+)"/)?.[1];
+        }
+        return undefined;
+    },
+};
+/** Breadth-first search (depth 3) for a directory matching `test`; returns a path relative to cwd. */
+function findUp(cwd, test) {
+    const queue = [[cwd, 0]];
+    const skip = new Set(["node_modules", ".git", "build", "dist", ".dart_tool", "ios", "android", ".wrangler"]);
+    while (queue.length) {
+        const [dir, depth] = queue.shift();
+        if (test(dir))
+            return relative(cwd, dir) || ".";
+        if (depth >= 3)
+            continue;
+        for (const name of readdirSync(dir)) {
+            const p = join(dir, name);
+            if (!skip.has(name) && !name.startsWith(".") && statSync(p).isDirectory())
+                queue.push([p, depth + 1]);
+        }
+    }
+    return undefined;
+}
+export function resolveVars(spec, cwd, given, previous = {}) {
+    const vars = {};
+    for (const [name, v] of Object.entries(spec.vars)) {
+        vars[name] = given[name] ?? previous[name] ?? (v.detect ? detectors[v.detect]?.(cwd) : undefined) ?? v.default ?? "";
+    }
+    return vars;
+}
+const render = (text, vars) => text.replace(/\{\{([A-Z_][A-Z0-9_]*)\}\}/g, (m, name) => (name in vars ? vars[name] : m));
+const normalizePath = (p) => p.replace(/^\.\//, "").replace(/\/\.\//g, "/").replace(/\/+/g, "/");
+export function renderModule(spec, vars) {
+    return spec.files
+        .filter((f) => !f.when || vars[f.when])
+        .map((f) => ({ dest: normalizePath(render(f.to, vars)), content: render(readFileSync(join(modulesDir, spec.name, "files", f.from), "utf8"), vars), ifMissing: Boolean(f.ifMissing) }));
+}
+export const renderNext = (spec, vars) => (spec.next ?? []).map((line) => render(line, vars));
+export const moduleFileDir = (dest) => dirname(dest);
+//# sourceMappingURL=modules.js.map

package/dist/modules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"modules.js","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAAA,qHAAqH;AACrH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAwB,MAAM,WAAW,CAAC;AASzE,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AAEjD,MAAM,CAAC,MAAM,WAAW,GAAG,GAAa,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACjK,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAqB,EAAE,CAAC,QAAQ,CAAa,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;AAC3H,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAA0B,EAAE,CAAC,QAAQ,CAAkB,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;AAEzI,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAElG,uFAAuF;AACvF,MAAM,SAAS,GAAwD;IACrE,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAClI,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5I,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE;QACnB,MAAM,GAAG,GAAG,SAAS,CAAC,UAAW,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,sCAAsC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC/C,MAAM,GAAG,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,qDAAqD,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAChK,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;IACD,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE;QACtB,MAAM,GAAG,GAAG,SAAS,CAAC,UAAW,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,0BAA0B,CAAC,EAAE,CAAC;YAC7E,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YAC5B,IAAI,UAAU,CAAC,CAAC,CAAC;gBAAE,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF,CAAC;AAEF,sGAAsG;AACtG,SAAS,MAAM,CAAC,GAAW,EAAE,IAA8B;IACzD,MAAM,KAAK,GAAuB,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAC7G,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;QACpC,IAAI,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC;QAChD,IAAI,KAAK,IAAI,CAAC;YAAE,SAAS;QACzB,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAgB,EAAE,GAAW,EAAE,KAA6B,EAAE,WAAmC,EAAE;IAC7H,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;IACvH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,IAA4B,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,6BAA6B,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClK,MAAM,aAAa,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAEzG,MAAM,UAAU,YAAY,CAAC,IAAgB,EAAE,IAA4B;IACzE,OAAO,IAAI,CAAC,KAAK;SACd,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3L,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAgB,EAAE,IAA4B,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAClI,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/util.d.ts

@@ -0,0 +1,38 @@
+export declare const templatesDir: string;
+export type SecretEntry = {
+    name: string;
+    usedBy?: string;
+    description: string;
+    generate: string;
+    store: string[];
+    rotate?: string;
+    optional?: boolean;
+    when?: string;
+    gitignore?: string[];
+};
+export type SecretsManifest = {
+    package: string;
+    secrets: SecretEntry[];
+};
+export type InstalledPackage = {
+    name: string;
+    version: string;
+    dir: string;
+    migrations: string[];
+    secrets: SecretsManifest | null;
+};
+export declare function readJson<T>(path: string): T | null;
+export declare function ensureLines(path: string, lines: string[], header?: string): string[];
+export declare function writeIfAbsent(path: string, content: string, force?: boolean): boolean;
+/** Every installed `@softwareseva/*` package (excluding the CLI) with its shipped migrations and secrets. */
+export declare function installedPackages(cwd: string): InstalledPackage[];
+export declare function packageManager(cwd: string): "pnpm" | "npm" | "yarn" | "bun";
+/** Migrations directory from wrangler config, default `migrations`. */
+export declare function migrationsDir(cwd: string): string;
+export declare const log: {
+    ok: (msg: string) => void;
+    warn: (msg: string) => void;
+    info: (msg: string) => void;
+    title: (msg: string) => void;
+};
+//# sourceMappingURL=util.d.ts.map

package/dist/util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,YAAY,QAAmE,CAAC;AAE7F,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAC9L,MAAM,MAAM,eAAe,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC;AAC1E,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAAA;CAAE,CAAC;AAErI,wBAAgB,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI,CAElD;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CASpF;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,UAAQ,GAAG,OAAO,CAKnF;AAED,6GAA6G;AAC7G,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAajE;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,CAK3E;AAED,uEAAuE;AACvE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQjD;AAED,eAAO,MAAM,GAAG;cACJ,MAAM;gBACJ,MAAM;gBACN,MAAM;iBACL,MAAM;CACpB,CAAC"}

package/dist/util.js

@@ -0,0 +1,74 @@
+/** Filesystem and package-manager helpers shared by the commands. */
+import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+export const templatesDir = join(dirname(fileURLToPath(import.meta.url)), "..", "templates");
+export function readJson(path) {
+    try {
+        return JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+export function ensureLines(path, lines, header) {
+    const existing = existsSync(path) ? readFileSync(path, "utf8") : "";
+    const present = new Set(existing.split(/\r?\n/).map((l) => l.trim()));
+    const missing = lines.filter((l) => !present.has(l.trim()));
+    if (missing.length) {
+        const body = `${existing.endsWith("\n") || existing === "" ? existing : existing + "\n"}${header ? `\n${header}\n` : ""}${missing.join("\n")}\n`;
+        writeFileSync(path, body);
+    }
+    return missing;
+}
+export function writeIfAbsent(path, content, force = false) {
+    if (existsSync(path) && !force)
+        return false;
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, content);
+    return true;
+}
+/** Every installed `@softwareseva/*` package (excluding the CLI) with its shipped migrations and secrets. */
+export function installedPackages(cwd) {
+    const scopeDir = join(cwd, "node_modules", "@softwareseva");
+    if (!existsSync(scopeDir))
+        return [];
+    return readdirSync(scopeDir)
+        .filter((name) => name !== "cli" && statSync(join(scopeDir, name)).isDirectory())
+        .map((name) => {
+        const dir = join(scopeDir, name);
+        const pkg = readJson(join(dir, "package.json"));
+        const migrationsDir = join(dir, "migrations");
+        const migrations = existsSync(migrationsDir) ? readdirSync(migrationsDir).filter((f) => f.endsWith(".sql")).sort() : [];
+        return { name: pkg?.name ?? `@softwareseva/${name}`, version: pkg?.version ?? "0.0.0", dir, migrations, secrets: readJson(join(dir, "secrets.json")) };
+    })
+        .sort((a, b) => a.name.localeCompare(b.name));
+}
+export function packageManager(cwd) {
+    if (existsSync(join(cwd, "pnpm-lock.yaml")))
+        return "pnpm";
+    if (existsSync(join(cwd, "yarn.lock")))
+        return "yarn";
+    if (existsSync(join(cwd, "bun.lock")) || existsSync(join(cwd, "bun.lockb")))
+        return "bun";
+    return "npm";
+}
+/** Migrations directory from wrangler config, default `migrations`. */
+export function migrationsDir(cwd) {
+    for (const file of ["wrangler.jsonc", "wrangler.json", "wrangler.toml"]) {
+        const path = join(cwd, file);
+        if (!existsSync(path))
+            continue;
+        const match = readFileSync(path, "utf8").match(/migrations_dir"?\s*[:=]\s*"([^"]+)"/);
+        if (match?.[1])
+            return join(cwd, match[1]);
+    }
+    return join(cwd, "migrations");
+}
+export const log = {
+    ok: (msg) => console.log(`  ✓ ${msg}`),
+    warn: (msg) => console.log(`  ! ${msg}`),
+    info: (msg) => console.log(`  - ${msg}`),
+    title: (msg) => console.log(`\n${msg}`),
+};
+//# sourceMappingURL=util.js.map

package/dist/util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;AAM7F,MAAM,UAAU,QAAQ,CAAI,IAAY;IACtC,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,KAAe,EAAE,MAAe;IACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QACjJ,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAe,EAAE,KAAK,GAAG,KAAK;IACxE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAC7C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,WAAW,CAAC,QAAQ,CAAC;SACzB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SAChF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,QAAQ,CAAoC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC;QACnF,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,IAAI,iBAAiB,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,IAAI,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAkB,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;IAC1K,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3D,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACtD,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,KAAK,MAAM,IAAI,IAAI,CAAC,gBAAgB,EAAE,eAAe,EAAE,eAAe,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACtF,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG;IACjB,EAAE,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC;IAC9C,IAAI,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC;IAChD,IAAI,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC;IAChD,KAAK,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;CAChD,CAAC"}

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@softwareseva/cli",
+  "version": "0.1.0",
+  "description": "kashi command line: init a project, copy package migrations, print the secrets checklist, check gitignore and secrets, update every @softwareseva package.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/softwareseva/kashi",
+    "directory": "packages/cli"
+  },
+  "type": "module",
+  "bin": {
+    "kashi": "./dist/bin.js"
+  },
+  "files": [
+    "dist",
+    "templates",
+    "secrets.schema.json",
+    "README.md"
+  ],
+  "dependencies": {
+    "commander": "^15.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "typescript": "^5.9.0",
+    "vitest": "^4.1.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json && chmod +x dist/bin.js",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
+}

package/secrets.schema.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "kashi secrets manifest",
+  "type": "object",
+  "required": ["package", "secrets"],
+  "properties": {
+    "package": { "type": "string" },
+    "secrets": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["name", "description", "generate", "store"],
+        "properties": {
+          "name": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]*$" },
+          "usedBy": { "type": "string", "description": "Feature or subpath that reads it" },
+          "description": { "type": "string" },
+          "generate": { "type": "string", "description": "How to obtain or generate the value" },
+          "store": { "type": "array", "items": { "enum": ["wrangler-secret", "dev-vars", "ci-secret", "env", "match", "keychain"] } },
+          "rotate": { "type": "string" },
+          "optional": { "type": "boolean" },
+          "when": { "type": "string", "description": "Only needed when this feature is enabled" },
+          "gitignore": { "type": "array", "items": { "type": "string" } }
+        }
+      }
+    }
+  }
+}

package/templates/AGENTS.md

@@ -0,0 +1,31 @@
+# Repository agent guide
+
+This file is the canonical instruction entry point for any coding agent working in this repository. It is tool- and vendor-neutral. `CLAUDE.md` and `GEMINI.md` point here.
+
+## Product and current state
+
+<!-- Two or three sentences: what the product does, who uses it, what is live and what is in progress. -->
+
+## Start here
+
+1. Read this file and the closest relevant code and tests.
+2. Load the kashi skills that apply to this project: `kashi`, <!-- e.g. `hono-d1-api`, `auth-sessions`, `d1-list-pagination`, `react-data-table`, `flutter-auth` -->.
+3. Read the matching repo-local skill when the task fits one: <!-- `skills/<name>/SKILL.md` -->.
+4. Check `git status --short` and preserve unrelated changes.
+5. The code and migrations are the source of truth; planning docs are context.
+
+## Repository map
+
+<!-- One line per top-level directory: what lives there and what must not be hand-edited. -->
+
+## Rules specific to this project
+
+<!-- Domain invariants, identity model, external integrations, anything an agent would otherwise get wrong. -->
+
+## Verification
+
+```bash
+<!-- the one command that runs typecheck, tests and policy checks -->
+```
+
+Deployments, production migrations and secret changes are explicit external actions. Report what changed, what was verified, and what still needs to run.

package/templates/CLAUDE.md

@@ -0,0 +1,3 @@
+# CLAUDE.md
+
+Read `AGENTS.md`. It is the canonical guide for this repository.

package/templates/GEMINI.md

@@ -0,0 +1,3 @@
+# GEMINI.md
+
+Read `AGENTS.md`. It is the canonical guide for this repository.

package/templates/gitignore

@@ -0,0 +1,19 @@
+# kashi: secrets and local config
+.dev.vars
+.env
+.env.*
+!.env.example
+!.dev.vars.example
+*.p8
+*.p12
+*.keystore
+*.jks
+*.mobileprovision
+fastlane/report.xml
+fastlane/*.json
+# build output
+node_modules/
+dist/
+.wrangler/
+build/
+.dart_tool/

package/templates/modules/deploy-cloudflare/files/deploy-api.yml

@@ -0,0 +1,45 @@
+name: deploy-api
+
+# Staging on every push to main; production when a GitHub release is published (or run manually).
+on:
+  push:
+    branches: [main]
+    paths: ["{{API_DIR}}/**", ".github/workflows/deploy-api.yml"]
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: Target environment
+        type: choice
+        options: [staging, production]
+        default: staging
+
+concurrency:
+  group: deploy-api-${{ github.event_name == 'release' && 'production' || inputs.environment || 'staging' }}
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment: ${{ github.event_name == 'release' && 'production' || inputs.environment || 'staging' }}
+    env:
+      TARGET: ${{ github.event_name == 'release' && 'production' || inputs.environment || 'staging' }}
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+    defaults:
+      run:
+        working-directory: {{API_DIR}}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: {{NODE_VERSION}}
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run typecheck
+      - run: pnpm run test
+      # Migrations run before the new code so the code never sees an older schema.
+      - run: pnpm exec wrangler d1 migrations apply DB --remote --env "$TARGET"
+      - run: pnpm exec wrangler deploy --env "$TARGET"

package/templates/modules/deploy-cloudflare/files/deploy-web.yml

@@ -0,0 +1,44 @@
+name: deploy-web
+
+# Builds the Vite app and serves it with Workers static assets (SPA fallback to index.html).
+on:
+  push:
+    branches: [main]
+    paths: ["{{WEB_DIR}}/**", ".github/workflows/deploy-web.yml"]
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: Target environment
+        type: choice
+        options: [staging, production]
+        default: staging
+
+concurrency:
+  group: deploy-web-${{ github.event_name == 'release' && 'production' || inputs.environment || 'staging' }}
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment: ${{ github.event_name == 'release' && 'production' || inputs.environment || 'staging' }}
+    env:
+      TARGET: ${{ github.event_name == 'release' && 'production' || inputs.environment || 'staging' }}
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+    defaults:
+      run:
+        working-directory: {{WEB_DIR}}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: {{NODE_VERSION}}
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run build
+        env:
+          VITE_API_URL: ${{ vars.VITE_API_URL }}
+      - run: pnpm exec wrangler deploy --env "$TARGET"

package/templates/modules/deploy-cloudflare/files/web-wrangler.jsonc

@@ -0,0 +1,10 @@
+{
+  "$schema": "node_modules/wrangler/config-schema.json",
+  "name": "my-web",
+  "compatibility_date": "2026-09-01",
+  "assets": { "directory": "./dist", "not_found_handling": "single-page-application" },
+  "env": {
+    "staging": { "name": "my-web-staging" },
+    "production": { "name": "my-web", "routes": [{ "pattern": "app.example.com", "custom_domain": true }] }
+  }
+}

package/templates/modules/deploy-cloudflare/module.json

@@ -0,0 +1,21 @@
+{
+  "name": "deploy-cloudflare",
+  "description": "GitHub Actions that test, apply D1 migrations and deploy the Worker API (and optionally a static web app) to staging on every push to main and to production on a release.",
+  "vars": {
+    "API_DIR": { "detect": "wranglerDir", "default": ".", "help": "directory with the Worker's wrangler.jsonc, relative to the repo root" },
+    "WEB_DIR": { "default": "", "help": "directory of a Vite web app to deploy with Workers static assets; empty to skip" },
+    "NODE_VERSION": { "default": "22" }
+  },
+  "files": [
+    { "from": "deploy-api.yml", "to": ".github/workflows/deploy-api.yml" },
+    { "from": "deploy-web.yml", "to": ".github/workflows/deploy-web.yml", "when": "WEB_DIR" },
+    { "from": "web-wrangler.jsonc", "to": "{{WEB_DIR}}/wrangler.jsonc", "when": "WEB_DIR", "ifMissing": true }
+  ],
+  "next": [
+    "Add \"env\": { \"staging\": {...}, \"production\": {...} } to {{API_DIR}}/wrangler.jsonc with one D1 database per environment (see the deploy-cloudflare skill).",
+    "Create the databases: wrangler d1 create <name>-staging and wrangler d1 create <name>-production; paste their ids into the env sections.",
+    "Set repository secrets CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID (gh secret set NAME).",
+    "Create GitHub environments 'staging' and 'production'; add required reviewers to production.",
+    "Set each Worker secret per environment: wrangler secret put NAME --env staging (and --env production)."
+  ]
+}

package/templates/modules/deploy-cloudflare/secrets.json

@@ -0,0 +1,7 @@
+{
+  "package": "deploy-cloudflare",
+  "secrets": [
+    { "name": "CLOUDFLARE_API_TOKEN", "usedBy": "GitHub Actions deploy", "description": "API token that can edit Workers scripts and D1.", "generate": "Cloudflare dashboard > My Profile > API Tokens > Create Token > template 'Edit Cloudflare Workers', add permission Account > D1 > Edit, restrict to your account.", "store": ["ci-secret"], "rotate": "yearly, or when someone with access leaves" },
+    { "name": "CLOUDFLARE_ACCOUNT_ID", "usedBy": "GitHub Actions deploy", "description": "Your Cloudflare account id.", "generate": "Cloudflare dashboard > Workers & Pages > right sidebar 'Account ID', or: wrangler whoami", "store": ["ci-secret"] }
+  ]
+}

package/templates/modules/deploy-fastlane/files/Gemfile

@@ -0,0 +1,3 @@
+source "https://rubygems.org"
+
+gem "fastlane", "~> 2.240"

package/templates/modules/deploy-fastlane/files/android/Appfile

@@ -0,0 +1 @@
+package_name("{{PACKAGE_NAME}}")

package/templates/modules/deploy-fastlane/files/android/Fastfile

@@ -0,0 +1,33 @@
+# Android lanes. Run from android/: bundle exec fastlane <lane>. Needs key.properties (see the skill) and PLAY_SERVICE_ACCOUNT_JSON.
+default_platform(:android)
+
+APP_ROOT = File.expand_path("../..", __dir__)
+AAB = File.join(APP_ROOT, "build/app/outputs/bundle/release/app-release.aab")
+
+platform :android do
+  def play_key
+    ENV.fetch("PLAY_SERVICE_ACCOUNT_JSON")
+  end
+
+  def build_aab(track)
+    build_number = ENV["BUILD_NUMBER"] || begin
+      codes = google_play_track_version_codes(track: track, json_key_data: play_key) rescue [0]
+      (codes.map(&:to_i).max.to_i + 1).to_s
+    end
+    Dir.chdir(APP_ROOT) do
+      sh("flutter", "build", "appbundle", "--release", "--build-number=#{build_number}")
+    end
+    UI.user_error!("No .aab produced at #{AAB}") unless File.exist?(AAB)
+    AAB
+  end
+
+  desc "Build and upload to the internal testing track"
+  lane :beta do
+    upload_to_play_store(track: "internal", aab: build_aab("internal"), json_key_data: play_key, release_status: ENV.fetch("PLAY_RELEASE_STATUS", "completed"), skip_upload_metadata: true, skip_upload_images: true, skip_upload_screenshots: true)
+  end
+
+  desc "Promote the latest internal build to production (staged rollout)"
+  lane :release do
+    upload_to_play_store(track: "internal", track_promote_to: "production", rollout: ENV.fetch("PLAY_ROLLOUT", "0.2"), json_key_data: play_key, skip_upload_changelogs: true, skip_upload_metadata: true, skip_upload_images: true, skip_upload_screenshots: true, skip_upload_aab: true)
+  end
+end

package/templates/modules/deploy-fastlane/files/android/key.properties.example

@@ -0,0 +1,5 @@
+# Copy to key.properties (gitignored) for local release builds. CI writes it from secrets.
+storePassword=
+keyPassword=
+keyAlias=upload
+storeFile=upload-keystore.jks

package/templates/modules/deploy-fastlane/files/ios/Appfile

@@ -0,0 +1,2 @@
+app_identifier("{{BUNDLE_ID}}")
+team_id("{{APPLE_TEAM_ID}}")