@sponsio/sdk 0.1.0-alpha.3 → 0.1.0

package/dist/cli/extractors/langchain.js

@@ -0,0 +1,86 @@
+"use strict";
+/**
+ * LangChain.js tool extractor.
+ *
+ * Matches:
+ *
+ *   new DynamicStructuredTool({ name, description, schema, func })
+ *   new DynamicTool({ name, description, func })
+ *   tool(fn, { name, description, schema })       — LangGraph.js v0.2+
+ *
+ * The ``schema`` field is a Zod object we convert via ``zod.ts``.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractLangChainTools = extractLangChainTools;
+const ts_morph_1 = require("ts-morph");
+const common_1 = require("./common");
+const STRUCTURED_NAMES = new Set([
+    "DynamicStructuredTool",
+    "StructuredTool",
+]);
+const BASIC_NAMES = new Set(["DynamicTool"]);
+function extractLangChainTools(sourceFile) {
+    const found = [];
+    // --- 1.  new DynamicStructuredTool({...}) / new DynamicTool({...}) ---
+    sourceFile.forEachDescendant((node) => {
+        if (!ts_morph_1.Node.isNewExpression(node))
+            return;
+        const ctor = node.getExpression();
+        if (!ts_morph_1.Node.isIdentifier(ctor))
+            return;
+        const ctorName = ctor.getText();
+        if (!STRUCTURED_NAMES.has(ctorName) && !BASIC_NAMES.has(ctorName))
+            return;
+        const arg = node.getArguments()[0];
+        if (!arg || !ts_morph_1.Node.isObjectLiteralExpression(arg))
+            return;
+        const inferred = (0, common_1.inferNameFromAssignment)(node);
+        const tool = (0, common_1.objectArgToTool)(arg, inferred, {
+            schemaKeys: ["schema", "parameters", "inputSchema"],
+        });
+        if (!tool)
+            return;
+        found.push({
+            tool,
+            provenance: {
+                filepath: sourceFile.getFilePath(),
+                line: node.getStartLineNumber(),
+                extractor: "langchain_js",
+            },
+        });
+    });
+    // --- 2.  tool(fn, { name, description, schema }) — LangGraph.js v0.2+
+    //
+    // Distinguished from Vercel's ``tool({...})`` by the arity and the
+    // shape of the *first* argument: LangGraph takes the function first
+    // and the config second; Vercel passes a single object.
+    sourceFile.forEachDescendant((node) => {
+        if (!ts_morph_1.Node.isCallExpression(node))
+            return;
+        const callee = node.getExpression();
+        if (!ts_morph_1.Node.isIdentifier(callee) || callee.getText() !== "tool")
+            return;
+        const args = node.getArguments();
+        if (args.length < 2)
+            return;
+        const config = args[1];
+        if (!ts_morph_1.Node.isObjectLiteralExpression(config))
+            return;
+        const inferred = (0, common_1.inferNameFromAssignment)(node);
+        const tool = (0, common_1.objectArgToTool)(config, inferred, {
+            schemaKeys: ["schema", "parameters", "inputSchema"],
+        });
+        if (!tool)
+            return;
+        found.push({
+            tool,
+            provenance: {
+                filepath: sourceFile.getFilePath(),
+                line: node.getStartLineNumber(),
+                extractor: "langchain_js",
+            },
+        });
+    });
+    return found;
+}
+//# sourceMappingURL=langchain.js.map

package/dist/cli/extractors/langchain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"langchain.js","sourceRoot":"","sources":["../../../src/cli/extractors/langchain.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AAYH,sDAkEC;AA5ED,uCAA4C;AAC5C,qCAAoE;AAGpE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,uBAAuB;IACvB,gBAAgB;CACjB,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;AAE7C,SAAgB,qBAAqB,CACnC,UAAsB;IAEtB,MAAM,KAAK,GAAuD,EAAE,CAAC;IAErE,wEAAwE;IACxE,UAAU,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,EAAE;QACpC,IAAI,CAAC,eAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAAE,OAAO;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC,eAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,OAAO;QAErC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QAE1E,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,IAAI,CAAC,eAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC;YAAE,OAAO;QAEzD,MAAM,QAAQ,GAAG,IAAA,gCAAuB,EAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAA,wBAAe,EAAC,GAAG,EAAE,QAAQ,EAAE;YAC1C,UAAU,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,aAAa,CAAC;SACpD,CAAC,CAAC;QACH,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,KAAK,CAAC,IAAI,CAAC;YACT,IAAI;YACJ,UAAU,EAAE;gBACV,QAAQ,EAAE,UAAU,CAAC,WAAW,EAAE;gBAClC,IAAI,EAAE,IAAI,CAAC,kBAAkB,EAAE;gBAC/B,SAAS,EAAE,cAAc;aAC1B;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,EAAE;IACF,mEAAmE;IACnE,oEAAoE;IACpE,wDAAwD;IACxD,UAAU,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,EAAE;QACpC,IAAI,CAAC,eAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;YAAE,OAAO;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACpC,IAAI,CAAC,eAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,KAAK,MAAM;YAAE,OAAO;QAEtE,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO;QAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,eAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC;YAAE,OAAO;QAEpD,MAAM,QAAQ,GAAG,IAAA,gCAAuB,EAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAA,wBAAe,EAAC,MAAM,EAAE,QAAQ,EAAE;YAC7C,UAAU,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,aAAa,CAAC;SACpD,CAAC,CAAC;QACH,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,KAAK,CAAC,IAAI,CAAC;YACT,IAAI;YACJ,UAAU,EAAE;gBACV,QAAQ,EAAE,UAAU,CAAC,WAAW,EAAE;gBAClC,IAAI,EAAE,IAAI,CAAC,kBAAkB,EAAE;gBAC/B,SAAS,EAAE,cAAc;aAC1B;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/cli/extractors/vercel.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Vercel AI SDK tool extractor.
+ *
+ * Matches ``tool({ description, parameters, execute })`` — the shape
+ * documented at https://sdk.vercel.ai/docs/ai-sdk-core/tools.  The
+ * ``name`` is usually inferred from the variable the call is assigned
+ * to (``const lookupCustomer = tool({...})``) because Vercel's SDK
+ * uses the object key in ``tools: { foo: tool({...}) }`` as the
+ * canonical tool name.
+ */
+import { SourceFile } from "ts-morph";
+import type { OpenAITool, ToolProvenance } from "../types";
+export declare function extractVercelTools(sourceFile: SourceFile): {
+    tool: OpenAITool;
+    provenance: ToolProvenance;
+}[];
+//# sourceMappingURL=vercel.d.ts.map

package/dist/cli/extractors/vercel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel.d.ts","sourceRoot":"","sources":["../../../src/cli/extractors/vercel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAQ,UAAU,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE3D,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,UAAU,GACrB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,cAAc,CAAA;CAAE,EAAE,CA6BpD"}

package/dist/cli/extractors/vercel.js

@@ -0,0 +1,46 @@
+"use strict";
+/**
+ * Vercel AI SDK tool extractor.
+ *
+ * Matches ``tool({ description, parameters, execute })`` — the shape
+ * documented at https://sdk.vercel.ai/docs/ai-sdk-core/tools.  The
+ * ``name`` is usually inferred from the variable the call is assigned
+ * to (``const lookupCustomer = tool({...})``) because Vercel's SDK
+ * uses the object key in ``tools: { foo: tool({...}) }`` as the
+ * canonical tool name.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractVercelTools = extractVercelTools;
+const ts_morph_1 = require("ts-morph");
+const common_1 = require("./common");
+function extractVercelTools(sourceFile) {
+    const found = [];
+    sourceFile.forEachDescendant((node) => {
+        if (!ts_morph_1.Node.isCallExpression(node))
+            return;
+        const callee = node.getExpression();
+        if (!ts_morph_1.Node.isIdentifier(callee))
+            return;
+        if (callee.getText() !== "tool")
+            return;
+        const arg = node.getArguments()[0];
+        if (!arg || !ts_morph_1.Node.isObjectLiteralExpression(arg))
+            return;
+        const name = (0, common_1.inferNameFromAssignment)(node);
+        const tool = (0, common_1.objectArgToTool)(arg, name, {
+            schemaKeys: ["parameters", "inputSchema"],
+        });
+        if (!tool)
+            return;
+        found.push({
+            tool,
+            provenance: {
+                filepath: sourceFile.getFilePath(),
+                line: node.getStartLineNumber(),
+                extractor: "vercel_ai",
+            },
+        });
+    });
+    return found;
+}
+//# sourceMappingURL=vercel.js.map

package/dist/cli/extractors/vercel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel.js","sourceRoot":"","sources":["../../../src/cli/extractors/vercel.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;AAMH,gDA+BC;AAnCD,uCAA4C;AAC5C,qCAAoE;AAGpE,SAAgB,kBAAkB,CAChC,UAAsB;IAEtB,MAAM,KAAK,GAAuD,EAAE,CAAC;IAErE,UAAU,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,EAAE;QACpC,IAAI,CAAC,eAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;YAAE,OAAO;QAEzC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACpC,IAAI,CAAC,eAAI,CAAC,YAAY,CAAC,MAAM,CAAC;YAAE,OAAO;QACvC,IAAI,MAAM,CAAC,OAAO,EAAE,KAAK,MAAM;YAAE,OAAO;QAExC,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,IAAI,CAAC,eAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC;YAAE,OAAO;QAEzD,MAAM,IAAI,GAAG,IAAA,gCAAuB,EAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAA,wBAAe,EAAC,GAAG,EAAE,IAAI,EAAE;YACtC,UAAU,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC;SAC1C,CAAC,CAAC;QACH,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,KAAK,CAAC,IAAI,CAAC;YACT,IAAI;YACJ,UAAU,EAAE;gBACV,QAAQ,EAAE,UAAU,CAAC,WAAW,EAAE;gBAClC,IAAI,EAAE,IAAI,CAAC,kBAAkB,EAAE;gBAC/B,SAAS,EAAE,WAAW;aACvB;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/cli/index.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Public API for ``@sponsio/sdk``.
+ *
+ * Usage:
+ *
+ *   import { scan } from "@sponsio/sdk";
+ *   const result = await scan(["src/**\/*.ts"]);
+ *   console.log(JSON.stringify(result, null, 2));
+ *
+ * The emitted ``{ tools: [...] }`` object is directly consumable by
+ * ``sponsio scan <file.json>`` — see the Python-side loader at
+ * ``sponsio/discovery/extractors/tool_inventory.py``.
+ */
+import type { Diagnostic, OpenAITool, ScanOutput, ToolProvenance } from "./types";
+export type { OpenAITool, ScanOutput, ToolProvenance, Diagnostic };
+export interface ScanOptions {
+    /** Working directory used to resolve relative globs.  Defaults to ``process.cwd()``. */
+    cwd?: string;
+    /** Glob patterns to exclude (applied on top of defaults). */
+    ignore?: string[];
+}
+/**
+ * Scan one or more file globs for agent tool definitions.
+ *
+ * Only static AST inspection — we never execute user code, so
+ * dynamically-constructed tools (computed names, schemas built at
+ * runtime) won't be picked up.  For those, emit the tool inventory
+ * by running the Node process directly and calling ``JSON.stringify``
+ * on your tools array.
+ */
+export declare function scan(patterns: string[], options?: ScanOptions): Promise<ScanOutput>;
+/**
+ * Re-exported after ``scan`` is defined to avoid a circular
+ * `index → onboard → index` import while ``scan`` is still in TDZ.
+ */
+export { runOnboard, suggestDetNlContracts, buildFallbackPayload, detectFramework, } from "./onboard";
+export type { OnboardOptions, OnboardResult, TsOnboardFramework } from "./onboard";
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAQH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAElF,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;AAEnE,MAAM,WAAW,WAAW;IAC1B,wFAAwF;IACxF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAYD;;;;;;;;GAQG;AACH,wBAAsB,IAAI,CACxB,QAAQ,EAAE,MAAM,EAAE,EAClB,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,UAAU,CAAC,CA8DrB;AAED;;;GAGG;AACH,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,GAChB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC"}

package/dist/cli/index.js

@@ -0,0 +1,146 @@
+"use strict";
+/**
+ * Public API for ``@sponsio/sdk``.
+ *
+ * Usage:
+ *
+ *   import { scan } from "@sponsio/sdk";
+ *   const result = await scan(["src/**\/*.ts"]);
+ *   console.log(JSON.stringify(result, null, 2));
+ *
+ * The emitted ``{ tools: [...] }`` object is directly consumable by
+ * ``sponsio scan <file.json>`` — see the Python-side loader at
+ * ``sponsio/discovery/extractors/tool_inventory.py``.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectFramework = exports.buildFallbackPayload = exports.suggestDetNlContracts = exports.runOnboard = void 0;
+exports.scan = scan;
+const fast_glob_1 = __importDefault(require("fast-glob"));
+const path = __importStar(require("path"));
+const ts_morph_1 = require("ts-morph");
+const generic_1 = require("./extractors/generic");
+const langchain_1 = require("./extractors/langchain");
+const vercel_1 = require("./extractors/vercel");
+const DEFAULT_IGNORE = [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    "**/*.d.ts",
+    "**/*.test.ts",
+    "**/*.spec.ts",
+];
+/**
+ * Scan one or more file globs for agent tool definitions.
+ *
+ * Only static AST inspection — we never execute user code, so
+ * dynamically-constructed tools (computed names, schemas built at
+ * runtime) won't be picked up.  For those, emit the tool inventory
+ * by running the Node process directly and calling ``JSON.stringify``
+ * on your tools array.
+ */
+async function scan(patterns, options = {}) {
+    const cwd = options.cwd ?? process.cwd();
+    const files = await (0, fast_glob_1.default)(patterns, {
+        cwd,
+        absolute: true,
+        ignore: [...DEFAULT_IGNORE, ...(options.ignore ?? [])],
+        onlyFiles: true,
+    });
+    const project = new ts_morph_1.Project({
+        // Skip loading tsconfig.json — we only need to parse, not type-check.
+        skipAddingFilesFromTsConfig: true,
+        skipFileDependencyResolution: true,
+        compilerOptions: {
+            allowJs: true,
+            noEmit: true,
+            target: 99, // ESNext
+            module: 99, // ESNext
+        },
+    });
+    const tools = [];
+    const provenance = {};
+    const diagnostics = [];
+    for (const file of files) {
+        let source;
+        try {
+            source = project.addSourceFileAtPath(file);
+        }
+        catch (err) {
+            diagnostics.push({
+                filepath: file,
+                line: 0,
+                level: "warn",
+                message: `failed to parse: ${err.message}`,
+            });
+            continue;
+        }
+        // Order matters: framework-specific extractors run first so the
+        // dedupe layer below keeps their richer ``provenance.extractor``
+        // label (``"vercel_ai"`` / ``"langchain_js"``) instead of the
+        // generic fallback.
+        const hits = [
+            ...(0, vercel_1.extractVercelTools)(source),
+            ...(0, langchain_1.extractLangChainTools)(source),
+            ...(0, generic_1.extractGenericTools)(source),
+        ];
+        for (const { tool, provenance: prov } of hits) {
+            // Dedup: multiple extractors may match the same call site (e.g.
+            // Vercel's ``tool({...})`` looks like LangGraph's
+            // ``tool(fn, cfg)`` for a moment).  First-writer wins, keyed on
+            // (name, filepath, line).
+            const key = `${tool.function.name}@${path.relative(cwd, prov.filepath)}:${prov.line}`;
+            if (provenance[key])
+                continue;
+            tools.push(tool);
+            provenance[key] = prov;
+        }
+    }
+    return { tools, provenance, diagnostics };
+}
+/**
+ * Re-exported after ``scan`` is defined to avoid a circular
+ * `index → onboard → index` import while ``scan`` is still in TDZ.
+ */
+var onboard_1 = require("./onboard");
+Object.defineProperty(exports, "runOnboard", { enumerable: true, get: function () { return onboard_1.runOnboard; } });
+Object.defineProperty(exports, "suggestDetNlContracts", { enumerable: true, get: function () { return onboard_1.suggestDetNlContracts; } });
+Object.defineProperty(exports, "buildFallbackPayload", { enumerable: true, get: function () { return onboard_1.buildFallbackPayload; } });
+Object.defineProperty(exports, "detectFramework", { enumerable: true, get: function () { return onboard_1.detectFramework; } });
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCH,oBAiEC;AArGD,0DAA2B;AAC3B,2CAA6B;AAC7B,uCAAmC;AACnC,kDAA2D;AAC3D,sDAA+D;AAC/D,gDAAyD;AAYzD,MAAM,cAAc,GAAG;IACrB,oBAAoB;IACpB,YAAY;IACZ,aAAa;IACb,aAAa;IACb,WAAW;IACX,cAAc;IACd,cAAc;CACf,CAAC;AAEF;;;;;;;;GAQG;AACI,KAAK,UAAU,IAAI,CACxB,QAAkB,EAClB,UAAuB,EAAE;IAEzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAE,EAAC,QAAQ,EAAE;QAC/B,GAAG;QACH,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,CAAC,GAAG,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACtD,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,kBAAO,CAAC;QAC1B,sEAAsE;QACtE,2BAA2B,EAAE,IAAI;QACjC,4BAA4B,EAAE,IAAI;QAClC,eAAe,EAAE;YACf,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,EAAE,EAAE,SAAS;YACrB,MAAM,EAAE,EAAE,EAAE,SAAS;SACtB;KACF,CAAC,CAAC;IAEH,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAmC,EAAE,CAAC;IACtD,MAAM,WAAW,GAAiB,EAAE,CAAC;IAErC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,IAAI,CAAC;gBACf,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,oBAAqB,GAAa,CAAC,OAAO,EAAE;aACtD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,gEAAgE;QAChE,iEAAiE;QACjE,8DAA8D;QAC9D,oBAAoB;QACpB,MAAM,IAAI,GAAG;YACX,GAAG,IAAA,2BAAkB,EAAC,MAAM,CAAC;YAC7B,GAAG,IAAA,iCAAqB,EAAC,MAAM,CAAC;YAChC,GAAG,IAAA,6BAAmB,EAAC,MAAM,CAAC;SAC/B,CAAC;QAEF,KAAK,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;YAC9C,gEAAgE;YAChE,kDAAkD;YAClD,gEAAgE;YAChE,0BAA0B;YAC1B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACtF,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC9B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,qCAKmB;AAJjB,qGAAA,UAAU,OAAA;AACV,gHAAA,qBAAqB,OAAA;AACrB,+GAAA,oBAAoB,OAAA;AACpB,0GAAA,eAAe,OAAA"}

package/dist/cli/init.d.ts

@@ -0,0 +1,2 @@
+export declare function runInitCli(argv: string[]): Promise<void>;
+//# sourceMappingURL=init.d.ts.map

package/dist/cli/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/cli/init.ts"],"names":[],"mappings":"AAuHA,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA+C9D"}

package/dist/cli/init.js

@@ -0,0 +1,177 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runInitCli = runInitCli;
+/**
+ * ``sponsio init`` — generate a starter ``sponsio.yaml`` skeleton.
+ *
+ * Mirrors the Python ``sponsio init`` command's non-interactive flag
+ * surface: ``--mode``, ``--provider``, ``--judge-fallback``,
+ * ``--no-sample``, ``--force``. The TS implementation is non-
+ * interactive only — flags are required, no prompts. Use ``onboard``
+ * if you want framework detection + tool scanning.
+ *
+ * Output is a minimal yaml the TS SDK can load: ``runtime.mode`` plus
+ * an ``agents.<id>`` block with a sample contract (unless --no-sample).
+ */
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const yaml = __importStar(require("js-yaml"));
+const HELP = "sponsio init — generate a starter sponsio.yaml skeleton\n" +
+    "\n" +
+    "USAGE:\n" +
+    "  sponsio init [target] [options]    # target = directory or yaml path\n" +
+    "\n" +
+    "OPTIONS:\n" +
+    "  -a, --agent <id>                  Agent identifier (default: agent)\n" +
+    "      --mode <observe|enforce>      Runtime mode (default: observe)\n" +
+    "      --provider <name>             LLM provider hint for downstream\n" +
+    "                                    `scan --llm` (openai|anthropic|gemini|none)\n" +
+    "      --judge-fallback <a|d|s>      allow|deny|skip on judge failure\n" +
+    "      --no-sample                   Don't include a starter contract\n" +
+    "      --force                       Overwrite existing sponsio.yaml\n" +
+    "  -h, --help                        Show this help\n" +
+    "\n" +
+    "EXAMPLES:\n" +
+    "  sponsio init\n" +
+    "  sponsio init --mode enforce --no-sample\n" +
+    "  sponsio init src/ --provider gemini --judge-fallback allow --force\n";
+function parseArgs(argv) {
+    const opts = {
+        target: ".",
+        agent: "agent",
+        mode: "observe",
+        provider: "none",
+        judgeFallback: "allow",
+        noSample: false,
+        force: false,
+    };
+    let positional = false;
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === "-h" || a === "--help") {
+            process.stdout.write(HELP);
+            process.exit(0);
+        }
+        if (a === "-a" || a === "--agent") {
+            opts.agent = argv[++i];
+            continue;
+        }
+        if (a === "--mode") {
+            const v = argv[++i];
+            if (v !== "observe" && v !== "enforce") {
+                process.stderr.write(`--mode must be observe|enforce (got ${v})\n`);
+                process.exit(2);
+            }
+            opts.mode = v;
+            continue;
+        }
+        if (a === "--provider") {
+            const v = argv[++i];
+            if (!["openai", "anthropic", "gemini", "none"].includes(v)) {
+                process.stderr.write(`--provider must be openai|anthropic|gemini|none (got ${v})\n`);
+                process.exit(2);
+            }
+            opts.provider = v;
+            continue;
+        }
+        if (a === "--judge-fallback") {
+            const v = argv[++i];
+            if (!["allow", "deny", "skip"].includes(v)) {
+                process.stderr.write(`--judge-fallback must be allow|deny|skip (got ${v})\n`);
+                process.exit(2);
+            }
+            opts.judgeFallback = v;
+            continue;
+        }
+        if (a === "--no-sample") {
+            opts.noSample = true;
+            continue;
+        }
+        if (a === "--force") {
+            opts.force = true;
+            continue;
+        }
+        if (!positional && !a.startsWith("-")) {
+            opts.target = a;
+            positional = true;
+            continue;
+        }
+        process.stderr.write(`unknown argument: ${a}\n${HELP}`);
+        process.exit(2);
+    }
+    return opts;
+}
+function resolveOutPath(target) {
+    const abs = (0, node_path_1.resolve)(target);
+    return abs.endsWith(".yaml") || abs.endsWith(".yml") ? abs : (0, node_path_1.resolve)(abs, "sponsio.yaml");
+}
+async function runInitCli(argv) {
+    const opts = parseArgs(argv);
+    const outPath = resolveOutPath(opts.target);
+    if ((0, node_fs_1.existsSync)(outPath) && !opts.force) {
+        process.stderr.write(`✗ ${outPath} already exists. Pass --force to overwrite, or delete the file.\n`);
+        process.exit(1);
+    }
+    if (opts.force && (0, node_fs_1.existsSync)(outPath)) {
+        (0, node_fs_1.unlinkSync)(outPath);
+    }
+    const contracts = opts.noSample
+        ? []
+        : [{ E: "tool `check_policy` must precede `issue_refund`" }];
+    const payload = {
+        version: 1,
+        runtime: { mode: opts.mode },
+        judge: { fallback_mode: opts.judgeFallback, circuit_breaker: true },
+        agents: {
+            [opts.agent]: { contracts },
+        },
+    };
+    if (opts.provider !== "none") {
+        payload.extractor = { provider: opts.provider };
+    }
+    const header = "# Generated by: sponsio init\n" +
+        "# Starter sponsio.yaml — edit contracts: to add deterministic rules.\n" +
+        "# See `sponsio patterns` for the supported NL pattern catalog.\n\n";
+    (0, node_fs_1.writeFileSync)(outPath, header + yaml.dump(payload, { lineWidth: 100 }), "utf-8");
+    process.stdout.write(`✓ wrote ${outPath} (mode: ${opts.mode}, agent: ${opts.agent})\n`);
+    if (contracts.length === 0) {
+        process.stdout.write(`  tip: add at least one contract under agents.${opts.agent}.contracts:\n` +
+            `       - E: "tool \`<gate>\` must precede \`<action>\`"\n`);
+    }
+    process.stdout.write(`\nNext: run \`sponsio scan <src>\` to mine contracts from your code, or\n` +
+        `      edit the file by hand and validate with \`sponsio validate\`.\n`);
+}
+//# sourceMappingURL=init.js.map

package/dist/cli/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/cli/init.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuHA,gCA+CC;AAtKD;;;;;;;;;;;GAWG;AACH,qCAAgE;AAChE,yCAAoC;AACpC,8CAAgC;AAEhC,MAAM,IAAI,GACR,2DAA2D;IAC3D,IAAI;IACJ,UAAU;IACV,0EAA0E;IAC1E,IAAI;IACJ,YAAY;IACZ,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,mFAAmF;IACnF,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,sDAAsD;IACtD,IAAI;IACJ,aAAa;IACb,kBAAkB;IAClB,6CAA6C;IAC7C,wEAAwE,CAAC;AAY3E,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,IAAI,GAAgB;QACxB,MAAM,EAAE,GAAG;QACX,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,MAAM;QAChB,aAAa,EAAE,OAAO;QACtB,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,KAAK;KACb,CAAC;IACF,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YACnB,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,KAAK,CAAC,CAAC;gBACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,YAAY,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,KAAK,CAAC,CAAC;gBACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,IAAI,CAAC,QAAQ,GAAG,CAA4B,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,kBAAkB,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,KAAK,CAAC,CAAC;gBAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,IAAI,CAAC,aAAa,GAAG,CAAiC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,aAAa,EAAE,CAAC;YACxB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;YAChB,UAAU,GAAG,IAAI,CAAC;YAClB,SAAS;QACX,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,GAAG,GAAG,IAAA,mBAAO,EAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAA,mBAAO,EAAC,GAAG,EAAE,cAAc,CAAC,CAAC;AAC5F,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,IAAc;IAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAE7B,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAE5C,IAAI,IAAA,oBAAU,EAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,OAAO,mEAAmE,CAChF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,IAAI,IAAA,oBAAU,EAAC,OAAO,CAAC,EAAE,CAAC;QACtC,IAAA,oBAAU,EAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,SAAS,GAAoB,IAAI,CAAC,QAAQ;QAC9C,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,iDAAiD,EAAE,CAAC,CAAC;IAE/D,MAAM,OAAO,GAA4B;QACvC,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,eAAe,EAAE,IAAI,EAAE;QACnE,MAAM,EAAE;YACN,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE;SAC5B;KACF,CAAC;IACF,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC7B,OAAO,CAAC,SAAS,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GACV,gCAAgC;QAChC,wEAAwE;QACxE,oEAAoE,CAAC;IACvE,IAAA,uBAAa,EAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACjF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,OAAO,WAAW,IAAI,CAAC,IAAI,YAAY,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;IACxF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iDAAiD,IAAI,CAAC,KAAK,eAAe;YACxE,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2EAA2E;QACzE,uEAAuE,CAC1E,CAAC;AACJ,CAAC"}

package/dist/cli/mode.d.ts

@@ -0,0 +1,2 @@
+export declare function runModeCli(argv: string[]): Promise<void>;
+//# sourceMappingURL=mode.d.ts.map

package/dist/cli/mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode.d.ts","sourceRoot":"","sources":["../../src/cli/mode.ts"],"names":[],"mappings":"AA0BA,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAiD9D"}

package/dist/cli/mode.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runModeCli = runModeCli;
+/**
+ * ``sponsio mode`` — flip a sponsio.yaml between observe and enforce.
+ *
+ * Mirrors the Python ``sponsio mode`` command: a single in-place edit
+ * of the ``mode:`` line, with surrounding comments preserved. Works
+ * for both the TS-onboard layout (``runtime: { mode: ... }``) and
+ * the Python-onboard layout (``defaults: { mode: ... }``) — the
+ * regex matches any ``mode:`` line at any indentation.
+ */
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const HELP = "sponsio mode — flip sponsio.yaml between observe and enforce\n" +
+    "\n" +
+    "USAGE:\n" +
+    "  sponsio mode <observe|enforce> [options]\n" +
+    "\n" +
+    "OPTIONS:\n" +
+    "  -c, --config <file>  Path to sponsio.yaml (default: sponsio.yaml)\n" +
+    "  -h, --help           Show this help\n" +
+    "\n" +
+    "EXAMPLES:\n" +
+    "  sponsio mode enforce\n" +
+    "  sponsio mode observe -c contracts/sponsio.yaml\n";
+async function runModeCli(argv) {
+    let target = null;
+    let configPath = "sponsio.yaml";
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === "-h" || a === "--help") {
+            process.stdout.write(HELP);
+            return;
+        }
+        if (a === "-c" || a === "--config") {
+            configPath = argv[++i];
+            continue;
+        }
+        if (a === "observe" || a === "enforce") {
+            target = a;
+            continue;
+        }
+        process.stderr.write(`unknown argument: ${a}\n${HELP}`);
+        process.exit(2);
+    }
+    if (!target) {
+        process.stderr.write(`missing target mode (observe|enforce)\n\n${HELP}`);
+        process.exit(2);
+    }
+    const path = (0, node_path_1.resolve)(configPath);
+    if (!(0, node_fs_1.existsSync)(path)) {
+        process.stderr.write(`✗ ${path} not found — run 'sponsio onboard .' first\n`);
+        process.exit(1);
+    }
+    const text = (0, node_fs_1.readFileSync)(path, "utf8");
+    const re = /^(\s*mode:\s*)(observe|enforce)(\s*(?:#.*)?)$/m;
+    const match = text.match(re);
+    if (!match) {
+        process.stderr.write(`✗ no \`mode:\` line found in ${path} — edit by hand or re-run \`sponsio onboard --force\`\n`);
+        process.exit(1);
+    }
+    if (match[2] === target) {
+        process.stdout.write(`✓ ${path} is already \`mode: ${target}\` (no change)\n`);
+        return;
+    }
+    const newText = text.replace(re, (_full, p1, _p2, p3) => `${p1}${target}${p3}`);
+    (0, node_fs_1.writeFileSync)(path, newText, "utf8");
+    process.stdout.write(`✓ ${path} → mode: ${target}\n`);
+}
+//# sourceMappingURL=mode.js.map

package/dist/cli/mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode.js","sourceRoot":"","sources":["../../src/cli/mode.ts"],"names":[],"mappings":";;AA0BA,gCAiDC;AA3ED;;;;;;;;GAQG;AACH,qCAAkE;AAClE,yCAAoC;AAEpC,MAAM,IAAI,GACR,gEAAgE;IAChE,IAAI;IACJ,UAAU;IACV,8CAA8C;IAC9C,IAAI;IACJ,YAAY;IACZ,uEAAuE;IACvE,yCAAyC;IACzC,IAAI;IACJ,aAAa;IACb,0BAA0B;IAC1B,oDAAoD,CAAC;AAEhD,KAAK,UAAU,UAAU,CAAC,IAAc;IAC7C,IAAI,MAAM,GAAiC,IAAI,CAAC;IAChD,IAAI,UAAU,GAAG,cAAc,CAAC;IAEhC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YACnC,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,GAAG,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,IAAA,mBAAO,EAAC,UAAU,CAAC,CAAC;IACjC,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,8CAA8C,CAAC,CAAC;QAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,gDAAgD,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gCAAgC,IAAI,yDAAyD,CAC9F,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,uBAAuB,MAAM,kBAAkB,CAAC,CAAC;QAC/E,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,EAAU,EAAE,GAAW,EAAE,EAAU,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,MAAM,GAAG,EAAE,EAAE,CAAC,CAAC;IACxG,IAAA,uBAAa,EAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,YAAY,MAAM,IAAI,CAAC,CAAC;AACxD,CAAC"}