@stackbilt/cli 0.10.0 → 0.12.0

package/README.md

@@ -73,6 +73,21 @@ charter blast src/foo.ts --depth 3  # reverse dep graph → files affected by ch
 charter surface --markdown          # extract routes (Hono/Express) + D1 schema as markdown
 ```
 
+## Authentication (optional)
+
+Governance commands (`validate`, `drift`, `blast`, `surface`, etc.) run locally and require no authentication.
+
+Commands that reach the Stackbilt engine (`run`, `architect`) read their API key from the `STACKBILT_API_KEY` environment variable. A custom engine URL can be supplied via `STACKBILT_API_BASE_URL`:
+
+```bash
+export STACKBILT_API_KEY=ea_xxx                       # or sb_live_xxx, sb_test_xxx
+export STACKBILT_API_BASE_URL=https://engine.example  # optional, for self-hosted engines
+```
+
+Environment variables are inherited by any child processes spawned from the same shell and may appear in `/proc/<pid>/environ`. In CI, prefer setting the variable per-invocation (e.g., a job-scoped secret) rather than exporting it globally in a shared developer shell.
+
+The legacy `charter login --key …` command still works but is deprecated and will be removed in `@stackbilt/cli` 1.0 when gateway-bound commands move to a separate package.
+
 ## Human Onboarding (Copy/Paste)
 
 Run this in the target repository:

package/dist/__tests__/auth-wiring.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=auth-wiring.test.d.ts.map

package/dist/__tests__/auth-wiring.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-wiring.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/auth-wiring.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/auth-wiring.test.js

@@ -0,0 +1,158 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const vitest_1 = require("vitest");
+// Hoisted mock state: vi.mock factories run before any imports, so the
+// EngineClient class mock must reach these via vi.hoisted.
+const hoisted = vitest_1.vi.hoisted(() => ({
+    buildFn: vitest_1.vi.fn(),
+    scaffoldFn: vitest_1.vi.fn(),
+    constructorArgs: [],
+}));
+vitest_1.vi.mock('../credentials', async () => {
+    const actual = await vitest_1.vi.importActual('../credentials');
+    return { ...actual, resolveApiKey: vitest_1.vi.fn() };
+});
+vitest_1.vi.mock('../http-client', () => {
+    return {
+        EngineClient: class {
+            constructor(opts) {
+                hoisted.constructorArgs.push(opts);
+            }
+            build = hoisted.buildFn;
+            scaffold = hoisted.scaffoldFn;
+            health = vitest_1.vi.fn();
+            catalog = vitest_1.vi.fn();
+        },
+    };
+});
+const credentials_1 = require("../credentials");
+const architect_1 = require("../commands/architect");
+const run_1 = require("../commands/run");
+const mockedResolveApiKey = vitest_1.vi.mocked(credentials_1.resolveApiKey);
+const options = {
+    format: 'json',
+    configPath: '.charter',
+    ciMode: false,
+    yes: true,
+};
+function fakeBuildResult() {
+    return {
+        stack: [],
+        compatibility: {
+            pairs: [],
+            totalScore: 0,
+            normalizedScore: 0,
+            dominant: '',
+            tensions: [],
+        },
+        scaffold: {},
+        seed: 1,
+        receipt: 'receipt',
+        requirements: {
+            description: 'anything',
+            keywords: [],
+            constraints: {},
+            complexity: 'moderate',
+        },
+    };
+}
+function fakeScaffoldResult() {
+    return {
+        files: [],
+        fileSource: 'engine',
+        nextSteps: [],
+    };
+}
+let tmpCwd;
+(0, vitest_1.beforeEach)(() => {
+    tmpCwd = fs.mkdtempSync(path.join(os.tmpdir(), 'charter-wiring-'));
+    process.chdir(tmpCwd);
+    fs.mkdirSync(path.join(tmpCwd, '.charter'), { recursive: true });
+    hoisted.buildFn.mockReset().mockResolvedValue(fakeBuildResult());
+    hoisted.scaffoldFn.mockReset().mockResolvedValue(fakeScaffoldResult());
+    hoisted.constructorArgs.length = 0;
+    mockedResolveApiKey.mockReset();
+    vitest_1.vi.spyOn(console, 'log').mockImplementation(() => { });
+    vitest_1.vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+    vitest_1.vi.spyOn(process.stderr, 'write').mockImplementation(() => true);
+});
+(0, vitest_1.afterEach)(() => {
+    vitest_1.vi.restoreAllMocks();
+    process.chdir(os.tmpdir());
+    fs.rmSync(tmpCwd, { recursive: true, force: true });
+});
+(0, vitest_1.describe)('architect — auth wiring', () => {
+    (0, vitest_1.it)('forwards the env-sourced API key (and custom baseUrl) to EngineClient', async () => {
+        mockedResolveApiKey.mockReturnValue({
+            apiKey: 'ea_env_wiring',
+            source: 'env',
+            baseUrl: 'https://engine.example',
+        });
+        await (0, architect_1.architectCommand)(options, ['a simple project description']);
+        (0, vitest_1.expect)(hoisted.constructorArgs).toHaveLength(1);
+        (0, vitest_1.expect)(hoisted.constructorArgs[0].apiKey).toBe('ea_env_wiring');
+        (0, vitest_1.expect)(hoisted.constructorArgs[0].baseUrl).toBe('https://engine.example');
+    });
+    (0, vitest_1.it)('passes apiKey=null to EngineClient when resolveApiKey returns null', async () => {
+        mockedResolveApiKey.mockReturnValue(null);
+        await (0, architect_1.architectCommand)(options, ['unauthenticated fallback']);
+        (0, vitest_1.expect)(hoisted.constructorArgs[0].apiKey).toBeNull();
+    });
+});
+(0, vitest_1.describe)('run — gateway vs engine routing', () => {
+    (0, vitest_1.it)('uses the gateway (scaffold) when the env var provides an API key', async () => {
+        mockedResolveApiKey.mockReturnValue({ apiKey: 'ea_env_gateway', source: 'env' });
+        await (0, run_1.runCommand)(options, ['a description', '--dry-run']);
+        (0, vitest_1.expect)(hoisted.scaffoldFn).toHaveBeenCalledTimes(1);
+        (0, vitest_1.expect)(hoisted.buildFn).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)('falls back to engine /build when no API key is resolved', async () => {
+        mockedResolveApiKey.mockReturnValue(null);
+        await (0, run_1.runCommand)(options, ['a description', '--dry-run']);
+        (0, vitest_1.expect)(hoisted.buildFn).toHaveBeenCalledTimes(1);
+        (0, vitest_1.expect)(hoisted.scaffoldFn).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)('uses the gateway when login-stored credentials are resolved (parity with env path)', async () => {
+        mockedResolveApiKey.mockReturnValue({ apiKey: 'sb_live_stored', source: 'credentials' });
+        await (0, run_1.runCommand)(options, ['a description', '--dry-run']);
+        (0, vitest_1.expect)(hoisted.scaffoldFn).toHaveBeenCalledTimes(1);
+        (0, vitest_1.expect)(hoisted.buildFn).not.toHaveBeenCalled();
+    });
+});
+//# sourceMappingURL=auth-wiring.test.js.map

package/dist/__tests__/auth-wiring.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-wiring.test.js","sourceRoot":"","sources":["../../src/__tests__/auth-wiring.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,4CAA8B;AAC9B,4CAA8B;AAC9B,gDAAkC;AAClC,mCAAyE;AAEzE,uEAAuE;AACvE,2DAA2D;AAC3D,MAAM,OAAO,GAAG,WAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChC,OAAO,EAAE,WAAE,CAAC,EAAE,EAAE;IAChB,UAAU,EAAE,WAAE,CAAC,EAAE,EAAE;IACnB,eAAe,EAAE,EAAyD;CAC3E,CAAC,CAAC,CAAC;AAEJ,WAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,IAAI,EAAE;IACnC,MAAM,MAAM,GAAG,MAAM,WAAE,CAAC,YAAY,CAAkC,gBAAgB,CAAC,CAAC;IACxF,OAAO,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,WAAE,CAAC,EAAE,EAAE,EAAE,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEH,WAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC7B,OAAO;QACL,YAAY,EAAE;YACZ,YAAY,IAAkD;gBAC5D,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,CAAC;YACD,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC;YACxB,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;YAC9B,MAAM,GAAG,WAAE,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,GAAG,WAAE,CAAC,EAAE,EAAE,CAAC;SACnB;KACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,gDAA+C;AAC/C,qDAAyD;AACzD,yCAA6C;AAG7C,MAAM,mBAAmB,GAAG,WAAE,CAAC,MAAM,CAAC,2BAAa,CAAC,CAAC;AAErD,MAAM,OAAO,GAAe;IAC1B,MAAM,EAAE,MAAM;IACd,UAAU,EAAE,UAAU;IACtB,MAAM,EAAE,KAAK;IACb,GAAG,EAAE,IAAI;CACV,CAAC;AAEF,SAAS,eAAe;IACtB,OAAO;QACL,KAAK,EAAE,EAAE;QACT,aAAa,EAAE;YACb,KAAK,EAAE,EAAE;YACT,UAAU,EAAE,CAAC;YACb,eAAe,EAAE,CAAC;YAClB,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,EAAE;SACb;QACD,QAAQ,EAAE,EAAE;QACZ,IAAI,EAAE,CAAC;QACP,OAAO,EAAE,SAAS;QAClB,YAAY,EAAE;YACZ,WAAW,EAAE,UAAU;YACvB,QAAQ,EAAE,EAAE;YACZ,WAAW,EAAE,EAAE;YACf,UAAU,EAAE,UAAU;SACvB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO;QACL,KAAK,EAAE,EAAE;QACT,UAAU,EAAE,QAAiB;QAC7B,SAAS,EAAE,EAAE;KACd,CAAC;AACJ,CAAC;AAED,IAAI,MAAc,CAAC;AAEnB,IAAA,mBAAU,EAAC,GAAG,EAAE;IACd,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACnE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,iBAAiB,CAAC,eAAe,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IACnC,mBAAmB,CAAC,SAAS,EAAE,CAAC;IAChC,WAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtD,WAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACjE,WAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC,CAAC,CAAC;AAEH,IAAA,kBAAS,EAAC,GAAG,EAAE;IACb,WAAE,CAAC,eAAe,EAAE,CAAC;IACrB,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3B,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACtD,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,IAAA,WAAE,EAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,mBAAmB,CAAC,eAAe,CAAC;YAClC,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,wBAAwB;SAClC,CAAC,CAAC;QAEH,MAAM,IAAA,4BAAgB,EAAC,OAAO,EAAE,CAAC,8BAA8B,CAAC,CAAC,CAAC;QAElE,IAAA,eAAM,EAAC,OAAO,CAAC,eAAe,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAChD,IAAA,eAAM,EAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAChE,IAAA,eAAM,EAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,mBAAmB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAE1C,MAAM,IAAA,4BAAgB,EAAC,OAAO,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC;QAE9D,IAAA,eAAM,EAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,IAAA,WAAE,EAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,mBAAmB,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAEjF,MAAM,IAAA,gBAAU,EAAC,OAAO,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;QAE1D,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACpD,IAAA,eAAM,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,mBAAmB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAE1C,MAAM,IAAA,gBAAU,EAAC,OAAO,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;QAE1D,IAAA,eAAM,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACjD,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;QAClG,mBAAmB,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QAEzF,MAAM,IAAA,gBAAU,EAAC,OAAO,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;QAE1D,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACpD,IAAA,eAAM,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/credentials.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=credentials.test.d.ts.map

package/dist/__tests__/credentials.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/credentials.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/credentials.test.js

@@ -0,0 +1,145 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+// Isolate loadCredentials from the developer's real ~/.charter/credentials.json
+// by mocking node:fs. Each test configures the fs mock explicitly.
+vitest_1.vi.mock('node:fs', async () => {
+    const actual = await vitest_1.vi.importActual('node:fs');
+    return {
+        ...actual,
+        existsSync: vitest_1.vi.fn(() => false),
+        readFileSync: vitest_1.vi.fn(),
+    };
+});
+const fs = __importStar(require("node:fs"));
+const credentials_1 = require("../credentials");
+const mockedFs = fs;
+function stubStoredCredentials(apiKey, baseUrl) {
+    mockedFs.existsSync.mockReturnValue(true);
+    mockedFs.readFileSync.mockReturnValue(JSON.stringify({ apiKey, baseUrl }));
+}
+function stubNoStoredCredentials() {
+    mockedFs.existsSync.mockReturnValue(false);
+    mockedFs.readFileSync.mockImplementation(() => {
+        throw new Error('readFileSync should not be called when existsSync=false');
+    });
+}
+(0, vitest_1.describe)('resolveApiKey', () => {
+    const originalKeyEnv = process.env[credentials_1.API_KEY_ENV_VAR];
+    const originalBaseUrlEnv = process.env[credentials_1.API_BASE_URL_ENV_VAR];
+    (0, vitest_1.beforeEach)(() => {
+        delete process.env[credentials_1.API_KEY_ENV_VAR];
+        delete process.env[credentials_1.API_BASE_URL_ENV_VAR];
+        mockedFs.existsSync.mockReset();
+        mockedFs.readFileSync.mockReset();
+        stubNoStoredCredentials();
+    });
+    (0, vitest_1.afterEach)(() => {
+        if (originalKeyEnv === undefined)
+            delete process.env[credentials_1.API_KEY_ENV_VAR];
+        else
+            process.env[credentials_1.API_KEY_ENV_VAR] = originalKeyEnv;
+        if (originalBaseUrlEnv === undefined)
+            delete process.env[credentials_1.API_BASE_URL_ENV_VAR];
+        else
+            process.env[credentials_1.API_BASE_URL_ENV_VAR] = originalBaseUrlEnv;
+    });
+    (0, vitest_1.it)('returns env var when set', () => {
+        process.env[credentials_1.API_KEY_ENV_VAR] = 'ea_test_from_env_12345';
+        const result = (0, credentials_1.resolveApiKey)();
+        (0, vitest_1.expect)(result).not.toBeNull();
+        (0, vitest_1.expect)(result.source).toBe('env');
+        (0, vitest_1.expect)(result.apiKey).toBe('ea_test_from_env_12345');
+    });
+    (0, vitest_1.it)('env var wins when both env var and stored credentials are present', () => {
+        process.env[credentials_1.API_KEY_ENV_VAR] = 'ea_env_wins';
+        stubStoredCredentials('sb_live_should_be_ignored', 'https://stored.example');
+        const result = (0, credentials_1.resolveApiKey)();
+        (0, vitest_1.expect)(result).not.toBeNull();
+        (0, vitest_1.expect)(result.source).toBe('env');
+        (0, vitest_1.expect)(result.apiKey).toBe('ea_env_wins');
+    });
+    (0, vitest_1.it)('trims whitespace from the env var', () => {
+        process.env[credentials_1.API_KEY_ENV_VAR] = '  sb_test_abc  ';
+        const result = (0, credentials_1.resolveApiKey)();
+        (0, vitest_1.expect)(result).not.toBeNull();
+        (0, vitest_1.expect)(result.source).toBe('env');
+        (0, vitest_1.expect)(result.apiKey).toBe('sb_test_abc');
+    });
+    (0, vitest_1.it)('empty env var falls through to stored credentials', () => {
+        process.env[credentials_1.API_KEY_ENV_VAR] = '';
+        stubStoredCredentials('sb_live_from_disk');
+        const result = (0, credentials_1.resolveApiKey)();
+        (0, vitest_1.expect)(result).not.toBeNull();
+        (0, vitest_1.expect)(result.source).toBe('credentials');
+        (0, vitest_1.expect)(result.apiKey).toBe('sb_live_from_disk');
+    });
+    (0, vitest_1.it)('whitespace-only env var falls through to stored credentials', () => {
+        process.env[credentials_1.API_KEY_ENV_VAR] = '   \t  ';
+        stubStoredCredentials('sb_live_from_disk');
+        const result = (0, credentials_1.resolveApiKey)();
+        (0, vitest_1.expect)(result).not.toBeNull();
+        (0, vitest_1.expect)(result.source).toBe('credentials');
+        (0, vitest_1.expect)(result.apiKey).toBe('sb_live_from_disk');
+    });
+    (0, vitest_1.it)('returns null when neither env var nor stored credentials are present', () => {
+        stubNoStoredCredentials();
+        const result = (0, credentials_1.resolveApiKey)();
+        (0, vitest_1.expect)(result).toBeNull();
+    });
+    (0, vitest_1.it)('env-var path adopts STACKBILT_API_BASE_URL when set', () => {
+        process.env[credentials_1.API_KEY_ENV_VAR] = 'ea_with_custom_url';
+        process.env[credentials_1.API_BASE_URL_ENV_VAR] = 'https://engine.internal.example';
+        const result = (0, credentials_1.resolveApiKey)();
+        (0, vitest_1.expect)(result).not.toBeNull();
+        (0, vitest_1.expect)(result.source).toBe('env');
+        (0, vitest_1.expect)(result.baseUrl).toBe('https://engine.internal.example');
+    });
+    (0, vitest_1.it)('env-var path leaves baseUrl undefined when STACKBILT_API_BASE_URL is unset', () => {
+        process.env[credentials_1.API_KEY_ENV_VAR] = 'ea_without_custom_url';
+        const result = (0, credentials_1.resolveApiKey)();
+        (0, vitest_1.expect)(result).not.toBeNull();
+        (0, vitest_1.expect)(result.baseUrl).toBeUndefined();
+    });
+    (0, vitest_1.it)('credentials path carries baseUrl from the stored file', () => {
+        stubStoredCredentials('sb_live_from_disk', 'https://engine.custom.example');
+        const result = (0, credentials_1.resolveApiKey)();
+        (0, vitest_1.expect)(result).not.toBeNull();
+        (0, vitest_1.expect)(result.source).toBe('credentials');
+        (0, vitest_1.expect)(result.baseUrl).toBe('https://engine.custom.example');
+    });
+});
+//# sourceMappingURL=credentials.test.js.map

package/dist/__tests__/credentials.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.test.js","sourceRoot":"","sources":["../../src/__tests__/credentials.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mCAAyE;AAEzE,gFAAgF;AAChF,mEAAmE;AACnE,WAAE,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;IAC5B,MAAM,MAAM,GAAG,MAAM,WAAE,CAAC,YAAY,CAA2B,SAAS,CAAC,CAAC;IAC1E,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE,WAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;QAC9B,YAAY,EAAE,WAAE,CAAC,EAAE,EAAE;KACtB,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,4CAA8B;AAC9B,gDAAsF;AAEtF,MAAM,QAAQ,GAAG,EAGhB,CAAC;AAEF,SAAS,qBAAqB,CAAC,MAAc,EAAE,OAAgB;IAC7D,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC1C,QAAQ,CAAC,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,uBAAuB;IAC9B,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC3C,QAAQ,CAAC,YAAY,CAAC,kBAAkB,CAAC,GAAG,EAAE;QAC5C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAA,iBAAQ,EAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,CAAC;IACpD,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAoB,CAAC,CAAC;IAE7D,IAAA,mBAAU,EAAC,GAAG,EAAE;QACd,OAAO,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,CAAC;QACpC,OAAO,OAAO,CAAC,GAAG,CAAC,kCAAoB,CAAC,CAAC;QACzC,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;QAChC,QAAQ,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;QAClC,uBAAuB,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,IAAA,kBAAS,EAAC,GAAG,EAAE;QACb,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,CAAC;;YACjE,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,GAAG,cAAc,CAAC;QACnD,IAAI,kBAAkB,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,kCAAoB,CAAC,CAAC;;YAC1E,OAAO,CAAC,GAAG,CAAC,kCAAoB,CAAC,GAAG,kBAAkB,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,GAAG,wBAAwB,CAAC;QAExD,MAAM,MAAM,GAAG,IAAA,2BAAa,GAAE,CAAC;QAE/B,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,IAAA,eAAM,EAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,IAAA,eAAM,EAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,GAAG,aAAa,CAAC;QAC7C,qBAAqB,CAAC,2BAA2B,EAAE,wBAAwB,CAAC,CAAC;QAE7E,MAAM,MAAM,GAAG,IAAA,2BAAa,GAAE,CAAC;QAE/B,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,IAAA,eAAM,EAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,IAAA,eAAM,EAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,GAAG,iBAAiB,CAAC;QAEjD,MAAM,MAAM,GAAG,IAAA,2BAAa,GAAE,CAAC;QAE/B,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,IAAA,eAAM,EAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,IAAA,eAAM,EAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,GAAG,EAAE,CAAC;QAClC,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,IAAA,2BAAa,GAAE,CAAC;QAE/B,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,IAAA,eAAM,EAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3C,IAAA,eAAM,EAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,GAAG,SAAS,CAAC;QACzC,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,IAAA,2BAAa,GAAE,CAAC;QAE/B,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,IAAA,eAAM,EAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3C,IAAA,eAAM,EAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,uBAAuB,EAAE,CAAC;QAE1B,MAAM,MAAM,GAAG,IAAA,2BAAa,GAAE,CAAC;QAE/B,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,GAAG,oBAAoB,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,kCAAoB,CAAC,GAAG,iCAAiC,CAAC;QAEtE,MAAM,MAAM,GAAG,IAAA,2BAAa,GAAE,CAAC;QAE/B,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,IAAA,eAAM,EAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,IAAA,eAAM,EAAC,MAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,GAAG,uBAAuB,CAAC;QAEvD,MAAM,MAAM,GAAG,IAAA,2BAAa,GAAE,CAAC;QAE/B,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,IAAA,eAAM,EAAC,MAAO,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,qBAAqB,CAAC,mBAAmB,EAAE,+BAA+B,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAG,IAAA,2BAAa,GAAE,CAAC;QAE/B,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,IAAA,eAAM,EAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3C,IAAA,eAAM,EAAC,MAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/login.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=login.test.d.ts.map

package/dist/__tests__/login.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/login.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/login.test.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const login_1 = require("../commands/login");
+const credentials_1 = require("../credentials");
+const options = {
+    format: 'text',
+    configPath: '.charter',
+    ciMode: false,
+    yes: false,
+};
+(0, vitest_1.describe)('charter login — deprecation notice', () => {
+    const originalEnv = process.env[credentials_1.API_KEY_ENV_VAR];
+    (0, vitest_1.beforeEach)(() => {
+        delete process.env[credentials_1.API_KEY_ENV_VAR];
+    });
+    (0, vitest_1.afterEach)(() => {
+        if (originalEnv === undefined) {
+            delete process.env[credentials_1.API_KEY_ENV_VAR];
+        }
+        else {
+            process.env[credentials_1.API_KEY_ENV_VAR] = originalEnv;
+        }
+        vitest_1.vi.restoreAllMocks();
+    });
+    (0, vitest_1.it)('writes a deprecation notice to stderr when invoked without args', async () => {
+        const stderr = vitest_1.vi.spyOn(process.stderr, 'write').mockImplementation(() => true);
+        vitest_1.vi.spyOn(console, 'log').mockImplementation(() => { });
+        await (0, login_1.loginCommand)(options, []);
+        const stderrOutput = stderr.mock.calls.map((c) => String(c[0])).join('');
+        (0, vitest_1.expect)(stderrOutput).toMatch(/deprecated/i);
+        (0, vitest_1.expect)(stderrOutput).toContain(credentials_1.API_KEY_ENV_VAR);
+    });
+    (0, vitest_1.it)('reports env-var usage when STACKBILT_API_KEY is set and no --key flag', async () => {
+        process.env[credentials_1.API_KEY_ENV_VAR] = 'ea_login_test_key';
+        vitest_1.vi.spyOn(process.stderr, 'write').mockImplementation(() => true);
+        const log = vitest_1.vi.spyOn(console, 'log').mockImplementation(() => { });
+        await (0, login_1.loginCommand)(options, []);
+        const stdoutOutput = log.mock.calls.map((c) => String(c[0])).join('\n');
+        (0, vitest_1.expect)(stdoutOutput).toMatch(new RegExp(`Using ${credentials_1.API_KEY_ENV_VAR} from environment`));
+    });
+});
+//# sourceMappingURL=login.test.js.map

package/dist/__tests__/login.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.test.js","sourceRoot":"","sources":["../../src/__tests__/login.test.ts"],"names":[],"mappings":";;AAAA,mCAAyE;AACzE,6CAAiD;AAEjD,gDAAiD;AAEjD,MAAM,OAAO,GAAe;IAC1B,MAAM,EAAE,MAAM;IACd,UAAU,EAAE,UAAU;IACtB,MAAM,EAAE,KAAK;IACb,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,IAAA,iBAAQ,EAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,CAAC;IAEjD,IAAA,mBAAU,EAAC,GAAG,EAAE;QACd,OAAO,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,IAAA,kBAAS,EAAC,GAAG,EAAE;QACb,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,GAAG,WAAW,CAAC;QAC7C,CAAC;QACD,WAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,MAAM,GAAG,WAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAChF,WAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAEtD,MAAM,IAAA,oBAAY,EAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAEhC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzE,IAAA,eAAM,EAAC,YAAY,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC5C,IAAA,eAAM,EAAC,YAAY,CAAC,CAAC,SAAS,CAAC,6BAAe,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,GAAG,mBAAmB,CAAC;QACnD,WAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,WAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAElE,MAAM,IAAA,oBAAY,EAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAEhC,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxE,IAAA,eAAM,EAAC,YAAY,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,SAAS,6BAAe,mBAAmB,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/named-scaffolds.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=named-scaffolds.test.d.ts.map

package/dist/__tests__/named-scaffolds.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"named-scaffolds.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/named-scaffolds.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/named-scaffolds.test.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+const adf_named_scaffolds_1 = require("../commands/adf-named-scaffolds");
+(0, vitest_1.describe)('NAMED_MODULE_SCAFFOLDS registry', () => {
+    (0, vitest_1.it)('contains typed-data-access scaffold entry', () => {
+        (0, vitest_1.expect)(adf_named_scaffolds_1.NAMED_MODULE_SCAFFOLDS['typed-data-access']).toBeDefined();
+        (0, vitest_1.expect)(adf_named_scaffolds_1.NAMED_MODULE_SCAFFOLDS['typed-data-access']).toBe(adf_named_scaffolds_1.TYPED_DATA_ACCESS_SCAFFOLD);
+    });
+    (0, vitest_1.it)('typed-data-access scaffold is valid ADF 0.1', () => {
+        const scaffold = adf_named_scaffolds_1.NAMED_MODULE_SCAFFOLDS['typed-data-access'];
+        (0, vitest_1.expect)(scaffold).toMatch(/^ADF: 0\.1/);
+    });
+    (0, vitest_1.it)('typed-data-access scaffold declares the six sensitivity tiers', () => {
+        const scaffold = adf_named_scaffolds_1.NAMED_MODULE_SCAFFOLDS['typed-data-access'];
+        (0, vitest_1.expect)(scaffold).toContain('public');
+        (0, vitest_1.expect)(scaffold).toContain('service_internal');
+        (0, vitest_1.expect)(scaffold).toContain('cross_service_rpc');
+        (0, vitest_1.expect)(scaffold).toContain('pii_scoped');
+        (0, vitest_1.expect)(scaffold).toContain('billing_critical');
+        (0, vitest_1.expect)(scaffold).toContain('secrets');
+    });
+    (0, vitest_1.it)('typed-data-access scaffold references the canonical registry path', () => {
+        const scaffold = adf_named_scaffolds_1.NAMED_MODULE_SCAFFOLDS['typed-data-access'];
+        (0, vitest_1.expect)(scaffold).toContain('stackbilt_llc/policies/data-registry.yaml');
+    });
+    (0, vitest_1.it)('typed-data-access scaffold includes load-bearing disambiguation constraint', () => {
+        const scaffold = adf_named_scaffolds_1.NAMED_MODULE_SCAFFOLDS['typed-data-access'];
+        (0, vitest_1.expect)(scaffold).toMatch(/CONSTRAINTS \[load-bearing\]/);
+        (0, vitest_1.expect)(scaffold).toContain('HALT and ask');
+    });
+});
+(0, vitest_1.describe)('NAMED_MODULE_DEFAULT_TRIGGERS registry', () => {
+    (0, vitest_1.it)('contains typed-data-access trigger keywords', () => {
+        (0, vitest_1.expect)(adf_named_scaffolds_1.NAMED_MODULE_DEFAULT_TRIGGERS['typed-data-access']).toBeDefined();
+        (0, vitest_1.expect)(Array.isArray(adf_named_scaffolds_1.NAMED_MODULE_DEFAULT_TRIGGERS['typed-data-access'])).toBe(true);
+    });
+    (0, vitest_1.it)('typed-data-access triggers include canonical business concept names', () => {
+        const triggers = adf_named_scaffolds_1.NAMED_MODULE_DEFAULT_TRIGGERS['typed-data-access'];
+        (0, vitest_1.expect)(triggers).toContain('tenant');
+        (0, vitest_1.expect)(triggers).toContain('user');
+        (0, vitest_1.expect)(triggers).toContain('subscription');
+        (0, vitest_1.expect)(triggers).toContain('quota');
+    });
+    (0, vitest_1.it)('typed-data-access triggers include sensitivity and policy keywords', () => {
+        const triggers = adf_named_scaffolds_1.NAMED_MODULE_DEFAULT_TRIGGERS['typed-data-access'];
+        (0, vitest_1.expect)(triggers).toContain('sensitivity');
+        (0, vitest_1.expect)(triggers).toContain('DATA_AUTHORITY');
+        (0, vitest_1.expect)(triggers).toContain('disambiguation');
+    });
+    (0, vitest_1.it)('every named scaffold has default triggers registered', () => {
+        for (const name of Object.keys(adf_named_scaffolds_1.NAMED_MODULE_SCAFFOLDS)) {
+            (0, vitest_1.expect)(adf_named_scaffolds_1.NAMED_MODULE_DEFAULT_TRIGGERS[name]).toBeDefined();
+            (0, vitest_1.expect)(adf_named_scaffolds_1.NAMED_MODULE_DEFAULT_TRIGGERS[name].length).toBeGreaterThan(0);
+        }
+    });
+});
+//# sourceMappingURL=named-scaffolds.test.js.map

package/dist/__tests__/named-scaffolds.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"named-scaffolds.test.js","sourceRoot":"","sources":["../../src/__tests__/named-scaffolds.test.ts"],"names":[],"mappings":";;AAAA,mCAA8C;AAC9C,yEAIyC;AAEzC,IAAA,iBAAQ,EAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,IAAA,WAAE,EAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,IAAA,eAAM,EAAC,4CAAsB,CAAC,mBAAmB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,IAAA,eAAM,EAAC,4CAAsB,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,gDAA0B,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,QAAQ,GAAG,4CAAsB,CAAC,mBAAmB,CAAC,CAAC;QAC7D,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,QAAQ,GAAG,4CAAsB,CAAC,mBAAmB,CAAC,CAAC;QAC7D,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC/C,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAChD,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACzC,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC/C,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,QAAQ,GAAG,4CAAsB,CAAC,mBAAmB,CAAC,CAAC;QAC7D,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,2CAA2C,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,QAAQ,GAAG,4CAAsB,CAAC,mBAAmB,CAAC,CAAC;QAC7D,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;QACzD,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,IAAA,WAAE,EAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,IAAA,eAAM,EAAC,mDAA6B,CAAC,mBAAmB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACzE,IAAA,eAAM,EAAC,KAAK,CAAC,OAAO,CAAC,mDAA6B,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,QAAQ,GAAG,mDAA6B,CAAC,mBAAmB,CAAC,CAAC;QACpE,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACnC,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC3C,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,QAAQ,GAAG,mDAA6B,CAAC,mBAAmB,CAAC,CAAC;QACpE,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC1C,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC7C,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,4CAAsB,CAAC,EAAE,CAAC;YACvD,IAAA,eAAM,EAAC,mDAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAC1D,IAAA,eAAM,EAAC,mDAA6B,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/adf-named-scaffolds.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Named-module scaffold registry.
+ *
+ * Rich scaffolds for canonical policy modules that consumer repos can adopt
+ * with `charter adf create <name>`. The generic empty placeholder in
+ * buildModuleScaffold is the fallback; entries in NAMED_MODULE_SCAFFOLDS
+ * take precedence.
+ *
+ * Each named module also registers default manifest trigger keywords in
+ * NAMED_MODULE_DEFAULT_TRIGGERS. When `charter adf create <name>` is called
+ * without an explicit --triggers flag, these auto-populate the ON_DEMAND
+ * entry so the wiring is a one-command operation.
+ *
+ * Adding a new named module:
+ *   1. Add the scaffold content as an exported const
+ *   2. Register it in NAMED_MODULE_SCAFFOLDS
+ *   3. Register default triggers in NAMED_MODULE_DEFAULT_TRIGGERS
+ *   4. Add tests in __tests__/named-scaffolds.test.ts
+ */
+/**
+ * Typed data access and ontology enforcement policy (Stackbilt-dev/charter#69).
+ *
+ * Codifies the cross-repo policy for how services reference business concepts
+ * (tenant, user, subscription, quota, etc.) — derived from the canonical data
+ * registry at Stackbilt-dev/stackbilt_llc/policies/data-registry.yaml.
+ *
+ * Declares six sensitivity tiers, the disambiguation protocol, and RPC
+ * boundary rules. Consumed by charter validate / codebeast DATA_AUTHORITY /
+ * AEGIS disambiguation firewall as the single source of truth for data
+ * access policy across the ecosystem.
+ */
+export declare const TYPED_DATA_ACCESS_SCAFFOLD = "ADF: 0.1\n\n\uD83C\uDFAF TASK: Typed data access and ontology enforcement policy\n\n\uD83D\uDCCB CONTEXT:\n  - Business concepts (tenant, user, subscription, quota, credit, mrr, etc.) are defined in a canonical data registry \u2014 the single source of truth for ownership, sensitivity, and access shape across the ecosystem\n  - Reference registry location: Stackbilt-dev/stackbilt_llc/policies/data-registry.yaml (22+ concepts, 6 sensitivity tiers)\n  - Each concept declares: owner service, D1 table, sensitivity tier, definition, aliases, rpc_method, mcp_tool\n  - Consumer services derive their KNOWN_CONCEPTS and alias maps from the registry at build time (compiled-const snapshot)\n  - Disambiguation protocol halts on undefined concepts rather than guessing\n  - CodeBeast DATA_AUTHORITY sensitivity class escalates raw D1 access to owned tables\n\n\uD83D\uDD10 SENSITIVITY TIERS [load-bearing]:\n  - public            \u2014 readable from any service, no auth required (e.g., blog_post)\n  - service_internal  \u2014 readable/writable only by the owning service, raw D1 access is fine within the owner\n  - cross_service_rpc \u2014 accessible via declared rpc_method or Service Binding, never raw D1 from a non-owning service\n  - pii_scoped        \u2014 accessible only via owning service + audit_log entry required at the call site\n  - billing_critical  \u2014 writable only by the owning service plus the Stripe webhook handler; never leaves the owning service boundary even via RPC\n  - secrets           \u2014 never leaves the owning service boundary under any circumstance\n\n\u26A0\uFE0F CONSTRAINTS [load-bearing]:\n  - New code referencing a business concept MUST check the canonical registry first; terms not in the registry or its aliases MUST be added before the code lands\n  - Non-owning services reading or writing cross_service_rpc concepts MUST use the declared rpc_method or mcp_tool \u2014 raw D1 access to another service's table is a DATA_AUTHORITY violation\n  - pii_scoped access requires an audit_log entry at the call site \u2014 no silent reads\n  - billing_critical and secrets tiers NEVER cross the owning service boundary, even via RPC\n  - When encountering an undefined data concept in requirements, tasks, or user prompts, HALT and ask for clarification rather than guessing shape, ownership, or sensitivity\n  - Registry updates MUST come before consumer code updates \u2014 the source of truth leads, consumers follow\n  - When promoting a concept to a higher sensitivity tier, all existing consumers of raw D1 access must migrate to RPC in the same change set\n\n\uD83D\uDCD6 ADVISORY:\n  - Check the registry before reaching for a new type definition \u2014 the concept may already exist with a canonical shape\n  - Use charter surface --format json to discover what D1 tables a service currently exposes; cross-reference against registry ownership\n  - Aliases (e.g., \"credits\" for \"quota\") are semantically equivalent; prefer the canonical form in new code, accept aliases in user-facing copy\n  - The disambiguation protocol is load-bearing for autonomous agents \u2014 these systems cannot safely guess business term semantics\n\n\uD83D\uDCCA METRICS:\n  REGISTRY_PATH: stackbilt_llc/policies/data-registry.yaml\n  REGISTRY_REPO: Stackbilt-dev/stackbilt_llc\n  SENSITIVITY_TIERS: 6\n  DOCUMENTED_CONCEPTS: 22\n\n\uD83D\uDD17 REFERENCES:\n  - Stackbilt-dev/charter#69 \u2014 typed data access policy umbrella issue\n  - codebeast#9 \u2014 DATA_AUTHORITY sensitivity class (enforcement side)\n  - Stackbilt-dev/aegis#344 \u2014 disambiguation firewall (runtime halt mechanism)\n";
+/**
+ * Registry of rich named-module scaffolds. When `charter adf create <name>`
+ * matches a name in this map, the corresponding scaffold is written instead
+ * of the generic empty placeholder from buildModuleScaffold's fallback.
+ */
+export declare const NAMED_MODULE_SCAFFOLDS: Record<string, string>;
+/**
+ * Default manifest trigger keywords for named modules. Used when
+ * `charter adf create <name>` matches a known module and no explicit
+ * --triggers flag is provided.
+ */
+export declare const NAMED_MODULE_DEFAULT_TRIGGERS: Record<string, string[]>;
+//# sourceMappingURL=adf-named-scaffolds.d.ts.map

package/dist/commands/adf-named-scaffolds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adf-named-scaffolds.d.ts","sourceRoot":"","sources":["../../src/commands/adf-named-scaffolds.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,qjHA6CtC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAEzD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAmBlE,CAAC"}