@stackbilt/cli 0.9.2 → 0.11.0

package/LICENSE

@@ -1,3 +1,19 @@
+Copyright 2026 Stackbilt LLC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+---
+
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -175,7 +191,7 @@
 
    END OF TERMS AND CONDITIONS
 
-   Copyright 2026 StackBilt, Smart Brand Strategies LLC
+   Copyright 2026 Stackbilt LLC
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

package/README.md

@@ -69,8 +69,25 @@ charter adf migrate --dry-run  # preview agent config → ADF migration
 charter adf sync --check     # verify .adf files match locked hashes
 charter adf evidence --auto-measure --format json  # validate metric ceilings
 charter telemetry report --period 24h --format json  # passive local usage summary
+charter blast src/foo.ts --depth 3  # reverse dep graph → files affected by changing this seed
+charter surface --markdown          # extract routes (Hono/Express) + D1 schema as markdown
 ```
 
+## Authentication (optional)
+
+Governance commands (`validate`, `drift`, `blast`, `surface`, etc.) run locally and require no authentication.
+
+Commands that reach the Stackbilt engine (`run`, `architect`) read their API key from the `STACKBILT_API_KEY` environment variable. A custom engine URL can be supplied via `STACKBILT_API_BASE_URL`:
+
+```bash
+export STACKBILT_API_KEY=ea_xxx                       # or sb_live_xxx, sb_test_xxx
+export STACKBILT_API_BASE_URL=https://engine.example  # optional, for self-hosted engines
+```
+
+Environment variables are inherited by any child processes spawned from the same shell and may appear in `/proc/<pid>/environ`. In CI, prefer setting the variable per-invocation (e.g., a job-scoped secret) rather than exporting it globally in a shared developer shell.
+
+The legacy `charter login --key …` command still works but is deprecated and will be removed in `@stackbilt/cli` 1.0 when gateway-bound commands move to a separate package.
+
 ## Human Onboarding (Copy/Paste)
 
 Run this in the target repository:
@@ -299,6 +316,44 @@ charter adf migrate [--dry-run] [--source <file>] [--no-backup]
 - `metrics recalibrate`: Re-measure current LOC from manifest metric sources, propose and apply new ceilings using configurable headroom, and append rationale records to `BUDGET_RATIONALES`. Requires explicit rationale (`--reason`) unless `--auto-rationale` is used.
 - `migrate`: Scan existing agent config files (CLAUDE.md, .cursorrules, agents.md, GEMINI.md, copilot-instructions.md), classify content using the ADX-002 decision tree, and migrate into ADF modules. `--dry-run` previews the migration plan without writing files. `--source <file>` targets a single file. `--no-backup` skips `.pre-adf-migrate.bak` creation. `--merge-strategy` controls deduplication: `dedupe` (default, skip items already in ADF), `append` (always add), or `replace`. Environment-specific rules (WSL, PATH, credential helpers) are retained in the thin pointer.
 
+### `charter blast`
+
+Compute the blast radius of a change: which files transitively depend on the given seed files? Builds a reverse dependency graph (TS/JS imports — handles ESM `.js → .ts`, tsconfig path aliases including `extends` chains, `src/index.*` fallback, cycles, comments) and BFS-traverses up to a configurable depth.
+
+```bash
+charter blast src/kernel/dispatch.ts            # default depth 3
+charter blast src/a.ts src/b.ts --depth 4       # multi-seed
+charter blast src/foo.ts --format json          # structured output
+charter blast src/foo.ts --root ./packages/x    # scan a subdirectory
+```
+
+Reports:
+- `affected` — relative paths of transitively dependent files
+- `hotFiles` — top 20 most-imported files in the graph (architectural hubs)
+- `summary.totalAffected`, `summary.depthHistogram`
+
+Blast radius ≥20 files triggers a `CROSS_CUTTING` warning — a signal for governance gates to escalate the change. Pure heuristic, no LLM calls, zero runtime dependencies. Backed by `@stackbilt/blast`.
+
+### `charter surface`
+
+Extract the API surface of a project: HTTP routes and database schema. Designed for Cloudflare Worker projects but works on any Node.js HTTP backend.
+
+```bash
+charter surface                                 # text summary
+charter surface --format json                   # machine-readable
+charter surface --markdown                      # for .ai/surface.adf injection
+charter surface --root ./packages/worker        # scan a subdirectory
+charter surface --schema db/schema.sql          # explicit schema path
+```
+
+Detects:
+- **Routes** — Hono, Express, itty-router via regex (requires `/` path prefix; strips comments before scanning)
+- **Schema** — D1/SQLite `CREATE TABLE` statements with column flags (pk, unique, nullable, default)
+
+Ignores `__tests__/`, `*.test.*`, `*.spec.*` to avoid false positives from test fixtures.
+
+Use cases: breaking change detection (diff surfaces before/after a PR), auto-generated AI context maps, deploy pipeline gates, mission brief fingerprinting for autonomous task runners. Backed by `@stackbilt/surface`.
+
 ### `charter telemetry`
 
 Passive local observability for Charter/ADF usage. Every CLI run appends command metadata (timestamp, command path, flags, duration, exit code) to `.charter/telemetry/events.ndjson`.
@@ -372,6 +427,8 @@ Setup-only options:
 - `@stackbilt/drift` -- blessed-stack pattern drift detection
 - `@stackbilt/validate` -- citation validation and intent classification
 - `@stackbilt/adf` -- ADF parser, formatter, patcher, and bundler
+- `@stackbilt/blast` -- reverse dependency graph + blast radius analysis
+- `@stackbilt/surface` -- API surface extraction (routes + D1 schema)
 - `@stackbilt/ci` -- GitHub Actions integration helpers
 
 ## License

package/dist/__tests__/auth-wiring.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=auth-wiring.test.d.ts.map

package/dist/__tests__/auth-wiring.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-wiring.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/auth-wiring.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/auth-wiring.test.js

@@ -0,0 +1,158 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const vitest_1 = require("vitest");
+// Hoisted mock state: vi.mock factories run before any imports, so the
+// EngineClient class mock must reach these via vi.hoisted.
+const hoisted = vitest_1.vi.hoisted(() => ({
+    buildFn: vitest_1.vi.fn(),
+    scaffoldFn: vitest_1.vi.fn(),
+    constructorArgs: [],
+}));
+vitest_1.vi.mock('../credentials', async () => {
+    const actual = await vitest_1.vi.importActual('../credentials');
+    return { ...actual, resolveApiKey: vitest_1.vi.fn() };
+});
+vitest_1.vi.mock('../http-client', () => {
+    return {
+        EngineClient: class {
+            constructor(opts) {
+                hoisted.constructorArgs.push(opts);
+            }
+            build = hoisted.buildFn;
+            scaffold = hoisted.scaffoldFn;
+            health = vitest_1.vi.fn();
+            catalog = vitest_1.vi.fn();
+        },
+    };
+});
+const credentials_1 = require("../credentials");
+const architect_1 = require("../commands/architect");
+const run_1 = require("../commands/run");
+const mockedResolveApiKey = vitest_1.vi.mocked(credentials_1.resolveApiKey);
+const options = {
+    format: 'json',
+    configPath: '.charter',
+    ciMode: false,
+    yes: true,
+};
+function fakeBuildResult() {
+    return {
+        stack: [],
+        compatibility: {
+            pairs: [],
+            totalScore: 0,
+            normalizedScore: 0,
+            dominant: '',
+            tensions: [],
+        },
+        scaffold: {},
+        seed: 1,
+        receipt: 'receipt',
+        requirements: {
+            description: 'anything',
+            keywords: [],
+            constraints: {},
+            complexity: 'moderate',
+        },
+    };
+}
+function fakeScaffoldResult() {
+    return {
+        files: [],
+        fileSource: 'engine',
+        nextSteps: [],
+    };
+}
+let tmpCwd;
+(0, vitest_1.beforeEach)(() => {
+    tmpCwd = fs.mkdtempSync(path.join(os.tmpdir(), 'charter-wiring-'));
+    process.chdir(tmpCwd);
+    fs.mkdirSync(path.join(tmpCwd, '.charter'), { recursive: true });
+    hoisted.buildFn.mockReset().mockResolvedValue(fakeBuildResult());
+    hoisted.scaffoldFn.mockReset().mockResolvedValue(fakeScaffoldResult());
+    hoisted.constructorArgs.length = 0;
+    mockedResolveApiKey.mockReset();
+    vitest_1.vi.spyOn(console, 'log').mockImplementation(() => { });
+    vitest_1.vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+    vitest_1.vi.spyOn(process.stderr, 'write').mockImplementation(() => true);
+});
+(0, vitest_1.afterEach)(() => {
+    vitest_1.vi.restoreAllMocks();
+    process.chdir(os.tmpdir());
+    fs.rmSync(tmpCwd, { recursive: true, force: true });
+});
+(0, vitest_1.describe)('architect — auth wiring', () => {
+    (0, vitest_1.it)('forwards the env-sourced API key (and custom baseUrl) to EngineClient', async () => {
+        mockedResolveApiKey.mockReturnValue({
+            apiKey: 'ea_env_wiring',
+            source: 'env',
+            baseUrl: 'https://engine.example',
+        });
+        await (0, architect_1.architectCommand)(options, ['a simple project description']);
+        (0, vitest_1.expect)(hoisted.constructorArgs).toHaveLength(1);
+        (0, vitest_1.expect)(hoisted.constructorArgs[0].apiKey).toBe('ea_env_wiring');
+        (0, vitest_1.expect)(hoisted.constructorArgs[0].baseUrl).toBe('https://engine.example');
+    });
+    (0, vitest_1.it)('passes apiKey=null to EngineClient when resolveApiKey returns null', async () => {
+        mockedResolveApiKey.mockReturnValue(null);
+        await (0, architect_1.architectCommand)(options, ['unauthenticated fallback']);
+        (0, vitest_1.expect)(hoisted.constructorArgs[0].apiKey).toBeNull();
+    });
+});
+(0, vitest_1.describe)('run — gateway vs engine routing', () => {
+    (0, vitest_1.it)('uses the gateway (scaffold) when the env var provides an API key', async () => {
+        mockedResolveApiKey.mockReturnValue({ apiKey: 'ea_env_gateway', source: 'env' });
+        await (0, run_1.runCommand)(options, ['a description', '--dry-run']);
+        (0, vitest_1.expect)(hoisted.scaffoldFn).toHaveBeenCalledTimes(1);
+        (0, vitest_1.expect)(hoisted.buildFn).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)('falls back to engine /build when no API key is resolved', async () => {
+        mockedResolveApiKey.mockReturnValue(null);
+        await (0, run_1.runCommand)(options, ['a description', '--dry-run']);
+        (0, vitest_1.expect)(hoisted.buildFn).toHaveBeenCalledTimes(1);
+        (0, vitest_1.expect)(hoisted.scaffoldFn).not.toHaveBeenCalled();
+    });
+    (0, vitest_1.it)('uses the gateway when login-stored credentials are resolved (parity with env path)', async () => {
+        mockedResolveApiKey.mockReturnValue({ apiKey: 'sb_live_stored', source: 'credentials' });
+        await (0, run_1.runCommand)(options, ['a description', '--dry-run']);
+        (0, vitest_1.expect)(hoisted.scaffoldFn).toHaveBeenCalledTimes(1);
+        (0, vitest_1.expect)(hoisted.buildFn).not.toHaveBeenCalled();
+    });
+});
+//# sourceMappingURL=auth-wiring.test.js.map

package/dist/__tests__/auth-wiring.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-wiring.test.js","sourceRoot":"","sources":["../../src/__tests__/auth-wiring.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,4CAA8B;AAC9B,4CAA8B;AAC9B,gDAAkC;AAClC,mCAAyE;AAEzE,uEAAuE;AACvE,2DAA2D;AAC3D,MAAM,OAAO,GAAG,WAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChC,OAAO,EAAE,WAAE,CAAC,EAAE,EAAE;IAChB,UAAU,EAAE,WAAE,CAAC,EAAE,EAAE;IACnB,eAAe,EAAE,EAAyD;CAC3E,CAAC,CAAC,CAAC;AAEJ,WAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,IAAI,EAAE;IACnC,MAAM,MAAM,GAAG,MAAM,WAAE,CAAC,YAAY,CAAkC,gBAAgB,CAAC,CAAC;IACxF,OAAO,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,WAAE,CAAC,EAAE,EAAE,EAAE,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEH,WAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC7B,OAAO;QACL,YAAY,EAAE;YACZ,YAAY,IAAkD;gBAC5D,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,CAAC;YACD,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC;YACxB,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;YAC9B,MAAM,GAAG,WAAE,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,GAAG,WAAE,CAAC,EAAE,EAAE,CAAC;SACnB;KACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,gDAA+C;AAC/C,qDAAyD;AACzD,yCAA6C;AAG7C,MAAM,mBAAmB,GAAG,WAAE,CAAC,MAAM,CAAC,2BAAa,CAAC,CAAC;AAErD,MAAM,OAAO,GAAe;IAC1B,MAAM,EAAE,MAAM;IACd,UAAU,EAAE,UAAU;IACtB,MAAM,EAAE,KAAK;IACb,GAAG,EAAE,IAAI;CACV,CAAC;AAEF,SAAS,eAAe;IACtB,OAAO;QACL,KAAK,EAAE,EAAE;QACT,aAAa,EAAE;YACb,KAAK,EAAE,EAAE;YACT,UAAU,EAAE,CAAC;YACb,eAAe,EAAE,CAAC;YAClB,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,EAAE;SACb;QACD,QAAQ,EAAE,EAAE;QACZ,IAAI,EAAE,CAAC;QACP,OAAO,EAAE,SAAS;QAClB,YAAY,EAAE;YACZ,WAAW,EAAE,UAAU;YACvB,QAAQ,EAAE,EAAE;YACZ,WAAW,EAAE,EAAE;YACf,UAAU,EAAE,UAAU;SACvB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO;QACL,KAAK,EAAE,EAAE;QACT,UAAU,EAAE,QAAiB;QAC7B,SAAS,EAAE,EAAE;KACd,CAAC;AACJ,CAAC;AAED,IAAI,MAAc,CAAC;AAEnB,IAAA,mBAAU,EAAC,GAAG,EAAE;IACd,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACnE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,iBAAiB,CAAC,eAAe,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IACnC,mBAAmB,CAAC,SAAS,EAAE,CAAC;IAChC,WAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtD,WAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACjE,WAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC,CAAC,CAAC;AAEH,IAAA,kBAAS,EAAC,GAAG,EAAE;IACb,WAAE,CAAC,eAAe,EAAE,CAAC;IACrB,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3B,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACtD,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,IAAA,WAAE,EAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,mBAAmB,CAAC,eAAe,CAAC;YAClC,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,wBAAwB;SAClC,CAAC,CAAC;QAEH,MAAM,IAAA,4BAAgB,EAAC,OAAO,EAAE,CAAC,8BAA8B,CAAC,CAAC,CAAC;QAElE,IAAA,eAAM,EAAC,OAAO,CAAC,eAAe,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAChD,IAAA,eAAM,EAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAChE,IAAA,eAAM,EAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,mBAAmB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAE1C,MAAM,IAAA,4BAAgB,EAAC,OAAO,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC;QAE9D,IAAA,eAAM,EAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAA,iBAAQ,EAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,IAAA,WAAE,EAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,mBAAmB,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAEjF,MAAM,IAAA,gBAAU,EAAC,OAAO,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;QAE1D,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACpD,IAAA,eAAM,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,mBAAmB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAE1C,MAAM,IAAA,gBAAU,EAAC,OAAO,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;QAE1D,IAAA,eAAM,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACjD,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;QAClG,mBAAmB,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QAEzF,MAAM,IAAA,gBAAU,EAAC,OAAO,EAAE,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;QAE1D,IAAA,eAAM,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACpD,IAAA,eAAM,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/bootstrap.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=bootstrap.test.d.ts.map

package/dist/__tests__/bootstrap.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/bootstrap.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/bootstrap.test.js

@@ -0,0 +1,134 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const vitest_1 = require("vitest");
+const bootstrap_1 = require("../commands/bootstrap");
+const baseOptions = {
+    configPath: '.charter',
+    format: 'text',
+    ciMode: false,
+    yes: false,
+};
+(0, vitest_1.describe)('bootstrapCommand', () => {
+    let originalCwd;
+    let tempDir;
+    let logs;
+    (0, vitest_1.beforeEach)(() => {
+        originalCwd = process.cwd();
+        tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'charter-bootstrap-test-'));
+        process.chdir(tempDir);
+        logs = [];
+        vitest_1.vi.spyOn(console, 'log').mockImplementation((...args) => {
+            logs.push(args.map(String).join(' '));
+        });
+    });
+    (0, vitest_1.afterEach)(() => {
+        process.chdir(originalCwd);
+        fs.rmSync(tempDir, { recursive: true, force: true });
+        vitest_1.vi.restoreAllMocks();
+    });
+    (0, vitest_1.it)('keeps custom ADF files when run with --yes but without --force', async () => {
+        fs.mkdirSync('.ai', { recursive: true });
+        const customCore = `ADF: 0.1
+
+CONTEXT:
+  - Custom core instructions
+`;
+        fs.writeFileSync(path.join('.ai', 'core.adf'), customCore);
+        const exitCode = await (0, bootstrap_1.bootstrapCommand)({ ...baseOptions, yes: true }, ['--yes', '--preset', 'worker', '--skip-install', '--skip-doctor']);
+        (0, vitest_1.expect)(exitCode).toBe(0);
+        (0, vitest_1.expect)(fs.readFileSync(path.join('.ai', 'core.adf'), 'utf-8')).toBe(customCore);
+        (0, vitest_1.expect)(fs.existsSync(path.join('.ai', '.backup'))).toBe(false);
+        (0, vitest_1.expect)(fs.existsSync(path.join('.ai', 'manifest.adf'))).toBe(true);
+        (0, vitest_1.expect)(fs.existsSync(path.join('.ai', 'state.adf'))).toBe(true);
+        const skipWarning = logs.find(l => l.includes('.ai/core.adf has custom content') && l.includes('skipping scaffold overwrite'));
+        (0, vitest_1.expect)(skipWarning).toBeDefined();
+        (0, vitest_1.expect)(skipWarning).toMatch(/\d+ bytes/);
+    });
+    (0, vitest_1.it)('backs up and overwrites custom ADF files when run with --force', async () => {
+        fs.mkdirSync('.ai', { recursive: true });
+        const customCore = `ADF: 0.1
+
+CONTEXT:
+  - Preserve me in backup
+`;
+        const customState = `ADF: 0.1
+STATE:
+  CURRENT: Custom state
+`;
+        fs.writeFileSync(path.join('.ai', 'core.adf'), customCore);
+        fs.writeFileSync(path.join('.ai', 'state.adf'), customState);
+        const exitCode = await (0, bootstrap_1.bootstrapCommand)(baseOptions, ['--force', '--preset', 'worker', '--skip-install', '--skip-doctor']);
+        (0, vitest_1.expect)(exitCode).toBe(0);
+        // Backup files should exist with timestamp suffix
+        const backupDir = path.join('.ai', '.backup');
+        (0, vitest_1.expect)(fs.existsSync(backupDir)).toBe(true);
+        const backupFiles = fs.readdirSync(backupDir);
+        const coreBackup = backupFiles.find(f => f.startsWith('core.adf.'));
+        const stateBackup = backupFiles.find(f => f.startsWith('state.adf.'));
+        (0, vitest_1.expect)(coreBackup).toBeDefined();
+        (0, vitest_1.expect)(stateBackup).toBeDefined();
+        (0, vitest_1.expect)(fs.readFileSync(path.join(backupDir, coreBackup), 'utf-8')).toBe(customCore);
+        (0, vitest_1.expect)(fs.readFileSync(path.join(backupDir, stateBackup), 'utf-8')).toBe(customState);
+        // Originals should be overwritten with scaffold content
+        (0, vitest_1.expect)(fs.readFileSync(path.join('.ai', 'core.adf'), 'utf-8')).not.toBe(customCore);
+        (0, vitest_1.expect)(fs.readFileSync(path.join('.ai', 'state.adf'), 'utf-8')).not.toBe(customState);
+        (0, vitest_1.expect)(logs).toContain('  Backed up 2 files to .ai/.backup/');
+    });
+    (0, vitest_1.it)('detects orphaned .adf modules and auto-registers them in --yes mode', async () => {
+        // Pre-create .ai/ with extra modules that won't be in the scaffold manifest
+        fs.mkdirSync('.ai', { recursive: true });
+        fs.writeFileSync(path.join('.ai', 'agent.adf'), 'ADF: 0.1\n\nCONTEXT:\n  - Agent rules\n');
+        fs.writeFileSync(path.join('.ai', 'persona.adf'), 'ADF: 0.1\n\nCONTEXT:\n  - Persona rules\n');
+        const exitCode = await (0, bootstrap_1.bootstrapCommand)({ ...baseOptions, yes: true }, ['--yes', '--preset', 'worker', '--skip-install', '--skip-doctor']);
+        (0, vitest_1.expect)(exitCode).toBe(0);
+        // Should warn about the two unregistered modules
+        const orphanWarning = logs.find(l => l.includes('unregistered .adf module'));
+        (0, vitest_1.expect)(orphanWarning).toBeDefined();
+        (0, vitest_1.expect)(orphanWarning).toContain('agent.adf');
+        (0, vitest_1.expect)(orphanWarning).toContain('persona.adf');
+        // In --yes mode, orphans should be auto-registered in manifest
+        const registerLog = logs.find(l => l.includes('Registered 2 module(s) as ON_DEMAND'));
+        (0, vitest_1.expect)(registerLog).toBeDefined();
+        // Verify manifest contains the orphan entries
+        const manifest = fs.readFileSync(path.join('.ai', 'manifest.adf'), 'utf-8');
+        (0, vitest_1.expect)(manifest).toContain('agent.adf');
+        (0, vitest_1.expect)(manifest).toContain('persona.adf');
+    });
+});
+//# sourceMappingURL=bootstrap.test.js.map

package/dist/__tests__/bootstrap.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.test.js","sourceRoot":"","sources":["../../src/__tests__/bootstrap.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,4CAA8B;AAC9B,4CAA8B;AAC9B,gDAAkC;AAClC,mCAAyE;AACzE,qDAAyD;AAGzD,MAAM,WAAW,GAAe;IAC9B,UAAU,EAAE,UAAU;IACtB,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,KAAK;IACb,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,IAAA,iBAAQ,EAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,IAAI,WAAmB,CAAC;IACxB,IAAI,OAAe,CAAC;IACpB,IAAI,IAAc,CAAC;IAEnB,IAAA,mBAAU,EAAC,GAAG,EAAE;QACd,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC5B,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;QAC5E,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,GAAG,EAAE,CAAC;QACV,WAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,CAAC,GAAG,IAAe,EAAE,EAAE;YACjE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAA,kBAAS,EAAC,GAAG,EAAE;QACb,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3B,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,WAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG;;;;CAItB,CAAC;QACE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;QAE3D,MAAM,QAAQ,GAAG,MAAM,IAAA,4BAAgB,EACrC,EAAE,GAAG,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,EAC7B,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,EAAE,eAAe,CAAC,CACnE,CAAC;QAEF,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,IAAA,eAAM,EAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAChF,IAAA,eAAM,EAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,IAAA,eAAM,EAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,IAAA,eAAM,EAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC,CAAC;QAC/H,IAAA,eAAM,EAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QAClC,IAAA,eAAM,EAAC,WAAW,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG;;;;CAItB,CAAC;QACE,MAAM,WAAW,GAAG;;;CAGvB,CAAC;QACE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;QAC3D,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;QAE7D,MAAM,QAAQ,GAAG,MAAM,IAAA,4BAAgB,EACrC,WAAW,EACX,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,EAAE,eAAe,CAAC,CACrE,CAAC;QAEF,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEzB,kDAAkD;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC9C,IAAA,eAAM,EAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QACpE,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;QACtE,IAAA,eAAM,EAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QACjC,IAAA,eAAM,EAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QAClC,IAAA,eAAM,EAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAW,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrF,IAAA,eAAM,EAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAY,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAEvF,wDAAwD;QACxD,IAAA,eAAM,EAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpF,IAAA,eAAM,EAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtF,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,4EAA4E;QAC5E,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,yCAAyC,CAAC,CAAC;QAC3F,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,2CAA2C,CAAC,CAAC;QAE/F,MAAM,QAAQ,GAAG,MAAM,IAAA,4BAAgB,EACrC,EAAE,GAAG,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,EAC7B,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,EAAE,eAAe,CAAC,CACnE,CAAC;QAEF,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,iDAAiD;QACjD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC,CAAC;QAC7E,IAAA,eAAM,EAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,IAAA,eAAM,EAAC,aAAa,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAA,eAAM,EAAC,aAAa,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAE/C,+DAA+D;QAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,qCAAqC,CAAC,CAAC,CAAC;QACtF,IAAA,eAAM,EAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QAElC,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;QAC5E,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACxC,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/credentials.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=credentials.test.d.ts.map

package/dist/__tests__/credentials.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/credentials.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/credentials.test.js

@@ -0,0 +1,145 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const vitest_1 = require("vitest");
+// Isolate loadCredentials from the developer's real ~/.charter/credentials.json
+// by mocking node:fs. Each test configures the fs mock explicitly.
+vitest_1.vi.mock('node:fs', async () => {
+    const actual = await vitest_1.vi.importActual('node:fs');
+    return {
+        ...actual,
+        existsSync: vitest_1.vi.fn(() => false),
+        readFileSync: vitest_1.vi.fn(),
+    };
+});
+const fs = __importStar(require("node:fs"));
+const credentials_1 = require("../credentials");
+const mockedFs = fs;
+function stubStoredCredentials(apiKey, baseUrl) {
+    mockedFs.existsSync.mockReturnValue(true);
+    mockedFs.readFileSync.mockReturnValue(JSON.stringify({ apiKey, baseUrl }));
+}
+function stubNoStoredCredentials() {
+    mockedFs.existsSync.mockReturnValue(false);
+    mockedFs.readFileSync.mockImplementation(() => {
+        throw new Error('readFileSync should not be called when existsSync=false');
+    });
+}
+(0, vitest_1.describe)('resolveApiKey', () => {
+    const originalKeyEnv = process.env[credentials_1.API_KEY_ENV_VAR];
+    const originalBaseUrlEnv = process.env[credentials_1.API_BASE_URL_ENV_VAR];
+    (0, vitest_1.beforeEach)(() => {
+        delete process.env[credentials_1.API_KEY_ENV_VAR];
+        delete process.env[credentials_1.API_BASE_URL_ENV_VAR];
+        mockedFs.existsSync.mockReset();
+        mockedFs.readFileSync.mockReset();
+        stubNoStoredCredentials();
+    });
+    (0, vitest_1.afterEach)(() => {
+        if (originalKeyEnv === undefined)
+            delete process.env[credentials_1.API_KEY_ENV_VAR];
+        else
+            process.env[credentials_1.API_KEY_ENV_VAR] = originalKeyEnv;
+        if (originalBaseUrlEnv === undefined)
+            delete process.env[credentials_1.API_BASE_URL_ENV_VAR];
+        else
+            process.env[credentials_1.API_BASE_URL_ENV_VAR] = originalBaseUrlEnv;
+    });
+    (0, vitest_1.it)('returns env var when set', () => {
+        process.env[credentials_1.API_KEY_ENV_VAR] = 'ea_test_from_env_12345';
+        const result = (0, credentials_1.resolveApiKey)();
+        (0, vitest_1.expect)(result).not.toBeNull();
+        (0, vitest_1.expect)(result.source).toBe('env');
+        (0, vitest_1.expect)(result.apiKey).toBe('ea_test_from_env_12345');
+    });
+    (0, vitest_1.it)('env var wins when both env var and stored credentials are present', () => {
+        process.env[credentials_1.API_KEY_ENV_VAR] = 'ea_env_wins';
+        stubStoredCredentials('sb_live_should_be_ignored', 'https://stored.example');
+        const result = (0, credentials_1.resolveApiKey)();
+        (0, vitest_1.expect)(result).not.toBeNull();
+        (0, vitest_1.expect)(result.source).toBe('env');
+        (0, vitest_1.expect)(result.apiKey).toBe('ea_env_wins');
+    });
+    (0, vitest_1.it)('trims whitespace from the env var', () => {
+        process.env[credentials_1.API_KEY_ENV_VAR] = '  sb_test_abc  ';
+        const result = (0, credentials_1.resolveApiKey)();
+        (0, vitest_1.expect)(result).not.toBeNull();
+        (0, vitest_1.expect)(result.source).toBe('env');
+        (0, vitest_1.expect)(result.apiKey).toBe('sb_test_abc');
+    });
+    (0, vitest_1.it)('empty env var falls through to stored credentials', () => {
+        process.env[credentials_1.API_KEY_ENV_VAR] = '';
+        stubStoredCredentials('sb_live_from_disk');
+        const result = (0, credentials_1.resolveApiKey)();
+        (0, vitest_1.expect)(result).not.toBeNull();
+        (0, vitest_1.expect)(result.source).toBe('credentials');
+        (0, vitest_1.expect)(result.apiKey).toBe('sb_live_from_disk');
+    });
+    (0, vitest_1.it)('whitespace-only env var falls through to stored credentials', () => {
+        process.env[credentials_1.API_KEY_ENV_VAR] = '   \t  ';
+        stubStoredCredentials('sb_live_from_disk');
+        const result = (0, credentials_1.resolveApiKey)();
+        (0, vitest_1.expect)(result).not.toBeNull();
+        (0, vitest_1.expect)(result.source).toBe('credentials');
+        (0, vitest_1.expect)(result.apiKey).toBe('sb_live_from_disk');
+    });
+    (0, vitest_1.it)('returns null when neither env var nor stored credentials are present', () => {
+        stubNoStoredCredentials();
+        const result = (0, credentials_1.resolveApiKey)();
+        (0, vitest_1.expect)(result).toBeNull();
+    });
+    (0, vitest_1.it)('env-var path adopts STACKBILT_API_BASE_URL when set', () => {
+        process.env[credentials_1.API_KEY_ENV_VAR] = 'ea_with_custom_url';
+        process.env[credentials_1.API_BASE_URL_ENV_VAR] = 'https://engine.internal.example';
+        const result = (0, credentials_1.resolveApiKey)();
+        (0, vitest_1.expect)(result).not.toBeNull();
+        (0, vitest_1.expect)(result.source).toBe('env');
+        (0, vitest_1.expect)(result.baseUrl).toBe('https://engine.internal.example');
+    });
+    (0, vitest_1.it)('env-var path leaves baseUrl undefined when STACKBILT_API_BASE_URL is unset', () => {
+        process.env[credentials_1.API_KEY_ENV_VAR] = 'ea_without_custom_url';
+        const result = (0, credentials_1.resolveApiKey)();
+        (0, vitest_1.expect)(result).not.toBeNull();
+        (0, vitest_1.expect)(result.baseUrl).toBeUndefined();
+    });
+    (0, vitest_1.it)('credentials path carries baseUrl from the stored file', () => {
+        stubStoredCredentials('sb_live_from_disk', 'https://engine.custom.example');
+        const result = (0, credentials_1.resolveApiKey)();
+        (0, vitest_1.expect)(result).not.toBeNull();
+        (0, vitest_1.expect)(result.source).toBe('credentials');
+        (0, vitest_1.expect)(result.baseUrl).toBe('https://engine.custom.example');
+    });
+});
+//# sourceMappingURL=credentials.test.js.map

package/dist/__tests__/credentials.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.test.js","sourceRoot":"","sources":["../../src/__tests__/credentials.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,mCAAyE;AAEzE,gFAAgF;AAChF,mEAAmE;AACnE,WAAE,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;IAC5B,MAAM,MAAM,GAAG,MAAM,WAAE,CAAC,YAAY,CAA2B,SAAS,CAAC,CAAC;IAC1E,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE,WAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;QAC9B,YAAY,EAAE,WAAE,CAAC,EAAE,EAAE;KACtB,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,4CAA8B;AAC9B,gDAAsF;AAEtF,MAAM,QAAQ,GAAG,EAGhB,CAAC;AAEF,SAAS,qBAAqB,CAAC,MAAc,EAAE,OAAgB;IAC7D,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC1C,QAAQ,CAAC,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,uBAAuB;IAC9B,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC3C,QAAQ,CAAC,YAAY,CAAC,kBAAkB,CAAC,GAAG,EAAE;QAC5C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAA,iBAAQ,EAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,CAAC;IACpD,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAoB,CAAC,CAAC;IAE7D,IAAA,mBAAU,EAAC,GAAG,EAAE;QACd,OAAO,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,CAAC;QACpC,OAAO,OAAO,CAAC,GAAG,CAAC,kCAAoB,CAAC,CAAC;QACzC,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;QAChC,QAAQ,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;QAClC,uBAAuB,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,IAAA,kBAAS,EAAC,GAAG,EAAE;QACb,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,CAAC;;YACjE,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,GAAG,cAAc,CAAC;QACnD,IAAI,kBAAkB,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,kCAAoB,CAAC,CAAC;;YAC1E,OAAO,CAAC,GAAG,CAAC,kCAAoB,CAAC,GAAG,kBAAkB,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,GAAG,wBAAwB,CAAC;QAExD,MAAM,MAAM,GAAG,IAAA,2BAAa,GAAE,CAAC;QAE/B,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,IAAA,eAAM,EAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,IAAA,eAAM,EAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,GAAG,aAAa,CAAC;QAC7C,qBAAqB,CAAC,2BAA2B,EAAE,wBAAwB,CAAC,CAAC;QAE7E,MAAM,MAAM,GAAG,IAAA,2BAAa,GAAE,CAAC;QAE/B,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,IAAA,eAAM,EAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,IAAA,eAAM,EAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,GAAG,iBAAiB,CAAC;QAEjD,MAAM,MAAM,GAAG,IAAA,2BAAa,GAAE,CAAC;QAE/B,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,IAAA,eAAM,EAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,IAAA,eAAM,EAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,GAAG,EAAE,CAAC;QAClC,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,IAAA,2BAAa,GAAE,CAAC;QAE/B,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,IAAA,eAAM,EAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3C,IAAA,eAAM,EAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,GAAG,SAAS,CAAC;QACzC,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,IAAA,2BAAa,GAAE,CAAC;QAE/B,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,IAAA,eAAM,EAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3C,IAAA,eAAM,EAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,uBAAuB,EAAE,CAAC;QAE1B,MAAM,MAAM,GAAG,IAAA,2BAAa,GAAE,CAAC;QAE/B,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,GAAG,oBAAoB,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,kCAAoB,CAAC,GAAG,iCAAiC,CAAC;QAEtE,MAAM,MAAM,GAAG,IAAA,2BAAa,GAAE,CAAC;QAE/B,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,IAAA,eAAM,EAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,IAAA,eAAM,EAAC,MAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,OAAO,CAAC,GAAG,CAAC,6BAAe,CAAC,GAAG,uBAAuB,CAAC;QAEvD,MAAM,MAAM,GAAG,IAAA,2BAAa,GAAE,CAAC;QAE/B,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,IAAA,eAAM,EAAC,MAAO,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,IAAA,WAAE,EAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,qBAAqB,CAAC,mBAAmB,EAAE,+BAA+B,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAG,IAAA,2BAAa,GAAE,CAAC;QAE/B,IAAA,eAAM,EAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,IAAA,eAAM,EAAC,MAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3C,IAAA,eAAM,EAAC,MAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/integration/precommit-hook.test.js

@@ -170,7 +170,7 @@ function writeHookFixtureRepo(tmp) {
 // v3 Pre-commit Hook Simulation
 // ============================================================================
 (0, vitest_1.describe)('pre-commit hook auto-tidy (integration)', () => {
-    (0, vitest_1.it)('auto-tidies bloated CLAUDE.md during git commit', { timeout: 30000 }, () => {
+    (0, vitest_1.it)('auto-tidies bloated CLAUDE.md during git commit', { timeout: 60000 }, () => {
         const tmp = makeTempDir('hook-tidy');
         writeHookFixtureRepo(tmp);
         // Inject bloat into CLAUDE.md
@@ -197,7 +197,7 @@ function writeHookFixtureRepo(tmp) {
         (0, vitest_1.expect)(finalContent).not.toContain('## Database Rules');
         (0, vitest_1.expect)(finalContent).toContain('## Environment');
     });
-    (0, vitest_1.it)('passes through cleanly when CLAUDE.md has no bloat', { timeout: 30000 }, () => {
+    (0, vitest_1.it)('passes through cleanly when CLAUDE.md has no bloat', { timeout: 60000 }, () => {
         const tmp = makeTempDir('hook-clean');
         writeHookFixtureRepo(tmp);
         // Make a trivial change to CLAUDE.md (add env item, not bloat)
@@ -210,7 +210,7 @@ function writeHookFixtureRepo(tmp) {
         const finalContent = fs.readFileSync(path.join(tmp, 'CLAUDE.md'), 'utf-8');
         (0, vitest_1.expect)(finalContent).toContain('DO NOT add rules');
     });
-    (0, vitest_1.it)('skips tidy when CHARTER_SKIP_TIDY=1 is set', { timeout: 30000 }, () => {
+    (0, vitest_1.it)('skips tidy when CHARTER_SKIP_TIDY=1 is set', { timeout: 60000 }, () => {
         const tmp = makeTempDir('hook-skip');
         writeHookFixtureRepo(tmp);
         // Inject bloat
@@ -237,7 +237,7 @@ function writeHookFixtureRepo(tmp) {
         const finalContent = fs.readFileSync(path.join(tmp, 'CLAUDE.md'), 'utf-8');
         (0, vitest_1.expect)(finalContent).toContain('## Architecture');
     });
-    (0, vitest_1.it)('re-stages modified .adf modules after tidy', { timeout: 30000 }, () => {
+    (0, vitest_1.it)('re-stages modified .adf modules after tidy', { timeout: 60000 }, () => {
         const tmp = makeTempDir('hook-restage');
         writeHookFixtureRepo(tmp);
         // Inject bloat with trigger keywords that route to backend.adf

package/dist/__tests__/login.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=login.test.d.ts.map

package/dist/__tests__/login.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/login.test.ts"],"names":[],"mappings":""}