@vreko/cli 3.3.0 → 3.3.1

package/dist/init-command-ZUISJBCT.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+export { createInitCommand } from './chunk-2OPUNVDJ.js';
+import './chunk-EWOJGXRX.js';
+
+process.env.VREKO_CLI='true';process.env.NODE_NO_WARNINGS='1';
+//# sourceMappingURL=init-command-ZUISJBCT.js.map
+//# sourceMappingURL=init-command-ZUISJBCT.js.map

package/dist/{init-command-LXEBDSYX.js.map → init-command-ZUISJBCT.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"init-command-LXEBDSYX.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"init-command-ZUISJBCT.js"}

package/dist/{init-core-ETGVVENN.js → init-core-FQYDSJWC.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
-export { createInitCommand } from './chunk-FROYVC6U.js';
+export { createInitCommand } from './chunk-B42UQ2W7.js';
 import './chunk-GRMRYWYS.js';
-import './chunk-HEUTZR52.js';
-import './chunk-3YXBGNHD.js';
+import './chunk-MWTSOZTM.js';
+import './chunk-AXNZWZ26.js';
 import './chunk-AV5Y3YR6.js';
 import './chunk-AHZGBIQG.js';
 import './chunk-BZ7DRTR7.js';
 import './chunk-EWOJGXRX.js';
 
 process.env.VREKO_CLI='true';process.env.NODE_NO_WARNINGS='1';
-//# sourceMappingURL=init-core-ETGVVENN.js.map
-//# sourceMappingURL=init-core-ETGVVENN.js.map
+//# sourceMappingURL=init-core-FQYDSJWC.js.map
+//# sourceMappingURL=init-core-FQYDSJWC.js.map

package/dist/{init-core-ETGVVENN.js.map → init-core-FQYDSJWC.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"init-core-ETGVVENN.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"init-core-FQYDSJWC.js"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vreko/cli",
-  "version": "3.3.0",
+  "version": "3.3.1",
   "description": "Vreko CLI — AI-aware developer intelligence for the command line",
   "homepage": "https://vreko.dev",
   "repository": {

package/scripts/publish-clean.mjs

@@ -140,10 +140,21 @@ try {
 		if (v.startsWith("workspace:")) failures.push(`3a FAIL: ${k} still has workspace:${v.slice(10)}`);
 	}
 
-	// 3b: no bundled package appears in dependencies (avoids registry resolution conflicts)
-	for (const key of Object.keys(verifyDeps)) {
+	// 3b: real invariant — two sub-rules that together prevent E404 at install time:
+	//   (i)  bundled packages must be stripped from dependencies (strip step must have run)
+	//   (ii) any @vreko/* left in dependencies must be at a published semver, not * or workspace:
+	//        (an unbundled @vreko/* at * would 404 because no such version exists on npm)
+	for (const [key, ver] of Object.entries(verifyDeps)) {
 		if (verifyBundled.has(key)) {
-			failures.push(`3b FAIL: bundled ${key} still in dependencies as ${verifyDeps[key]}`);
+			failures.push(`3b FAIL: bundled ${key} still in dependencies as "${ver}" — strip step did not run`);
+			continue;
+		}
+		if (key.startsWith("@vreko/")) {
+			// Non-bundled @vreko/* must be at a real published semver (e.g. "1.1.0", "^1.0.0")
+			const isPublishedSemver = /^[\^~]?\d+\.\d+/.test(ver);
+			if (!isPublishedSemver) {
+				failures.push(`3b FAIL: ${key}@"${ver}" is not bundled and not a published semver — will E404 on install`);
+			}
 		}
 	}
 

package/dist/chunk-HEUTZR52.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/utils/workspace.ts"],"names":["validateWorkspacePath","workspacePath","normalizedPath","normalize","absolutePath","resolve","startsWith","process","cwd","valid","root","error","hasGit","existsSync","hasPackageJson","hasVreko","stat","lstatSync","isSymbolicLink","Error","message","resolveWorkspaceRoot","explicitPath","validation","currentPath","maxIterations","i","hasMarker","parent","findWorkspaceRoot","dir","join","findGitRoot","execSync","require","encoding","stdio","trim","resolveWorkspaceJsonPath","primary"],"mappings":";;;;;;AA0BO,SAASA,sBAAsBC,aAAAA,EAAqB;AAC1D,EAAA,IAAI;AACH,IAAA,MAAMC,cAAAA,GAAiBC,UAAUF,aAAAA,CAAAA;AACjC,IAAA,MAAMG,YAAAA,GAAeC,QAAQH,cAAAA,CAAAA;AAE7B,IAAA,IAAI,CAACE,YAAAA,CAAaE,UAAAA,CAAWC,OAAAA,CAAQC,GAAAA,EAAG,CAAA,IAAO,CAACJ,YAAAA,CAAaE,UAAAA,CAAW,GAAA,CAAA,EAAM;AAC7E,MAAA,OAAO;QAAEG,KAAAA,EAAO,KAAA;QAAOC,IAAAA,EAAM,EAAA;QAAIC,KAAAA,EAAO;AAAyB,OAAA;AAClE,IAAA;AAEA,IAAA,MAAMC,MAAAA,GAASC,UAAAA,CAAWR,OAAAA,CAAQD,YAAAA,EAAc,MAAA,CAAA,CAAA;AAChD,IAAA,MAAMU,cAAAA,GAAiBD,UAAAA,CAAWR,OAAAA,CAAQD,YAAAA,EAAc,cAAA,CAAA,CAAA;AACxD,IAAA,MAAMW,QAAAA,GAAWF,UAAAA,CAAWR,OAAAA,CAAQD,YAAAA,EAAc,QAAA,CAAA,CAAA;AAElD,IAAA,IAAI,CAACQ,MAAAA,IAAU,CAACE,cAAAA,IAAkB,CAACC,QAAAA,EAAU;AAC5C,MAAA,OAAO;QACNN,KAAAA,EAAO,KAAA;QACPC,IAAAA,EAAMN,YAAAA;QACNO,KAAAA,EAAO;AACR,OAAA;AACD,IAAA;AAEA,IAAA,IAAI;AACH,MAAA,MAAMK,IAAAA,GAAOC,UAAUb,YAAAA,CAAAA;AACvB,MAAA,IAAIY,IAAAA,CAAKE,gBAAc,EAAI;AAC1B,QAAA,OAAO;UACNT,KAAAA,EAAO,KAAA;UACPC,IAAAA,EAAMN,YAAAA;UACNO,KAAAA,EAAO;AACR,SAAA;AACD,MAAA;IACD,CAAA,CAAA,MAAQ;AACP,MAAA,OAAO;QAAEF,KAAAA,EAAO,KAAA;QAAOC,IAAAA,EAAMN,YAAAA;QAAcO,KAAAA,EAAO;AAA+B,OAAA;AAClF,IAAA;AAEA,IAAA,OAAO;MAAEF,KAAAA,EAAO,IAAA;MAAMC,IAAAA,EAAMN;AAAa,KAAA;AAC1C,EAAA,CAAA,CAAA,OAASO,KAAAA,EAAO;AACf,IAAA,OAAO;MACNF,KAAAA,EAAO,KAAA;MACPC,IAAAA,EAAM,EAAA;MACNC,KAAAA,EAAOA,KAAAA,YAAiBQ,KAAAA,GAAQR,KAAAA,CAAMS,OAAAA,GAAU;AACjD,KAAA;AACD,EAAA;AACD;AA1CgBpB,MAAAA,CAAAA,qBAAAA,EAAAA,uBAAAA,CAAAA;AAkDT,SAASqB,qBAAqBC,YAAAA,EAAqB;AACzD,EAAA,IAAIA,YAAAA,EAAc;AACjB,IAAA,MAAMC,UAAAA,GAAavB,sBAAsBsB,YAAAA,CAAAA;AACzC,IAAA,IAAIC,WAAWd,KAAAA,EAAO;AACrB,MAAA,OAAOc,UAAAA;AACR,IAAA;AACD,EAAA;AAGA,EAAA,IAAIC,WAAAA,GAAcnB,OAAAA,CAAQE,OAAAA,CAAQC,GAAAA,EAAG,CAAA;AACrC,EAAA,MAAMiB,aAAAA,GAAgB,EAAA;AACtB,EAAA,KAAA,IAASC,CAAAA,GAAI,CAAA,EAAGA,CAAAA,GAAID,aAAAA,EAAeC,CAAAA,EAAAA,EAAK;AACvC,IAAA,MAAMC,YACLd,UAAAA,CAAWR,OAAAA,CAAQmB,WAAAA,EAAa,MAAA,CAAA,CAAA,IAChCX,UAAAA,CAAWR,OAAAA,CAAQmB,WAAAA,EAAa,cAAA,CAAA,CAAA,IAChCX,WAAWR,OAAAA,CAAQmB,WAAAA,EAAa,QAAA,CAAA,CAAA;AACjC,IAAA,IAAIG,SAAAA,EAAW;AACd,MAAA,OAAO3B,sBAAsBwB,WAAAA,CAAAA;AAC9B,IAAA;AACA,IAAA,MAAMI,MAAAA,GAASvB,OAAAA,CAAQmB,WAAAA,EAAa,IAAA,CAAA;AACpC,IAAA,IAAII,WAAWJ,WAAAA,EAAa;AAC3B,MAAA;AACD,IAAA;AACAA,IAAAA,WAAAA,GAAcI,MAAAA;AACf,EAAA;AAGA,EAAA,OAAO5B,qBAAAA,CAAsBO,OAAAA,CAAQC,GAAAA,EAAG,CAAA;AACzC;AA5BgBa,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAqCT,SAASQ,kBAAkBrB,GAAAA,EAAW;AAC5C,EAAA,IAAIsB,GAAAA,GAAMtB,GAAAA;AACV,EAAA,OAAOsB,QAAQ,GAAA,EAAK;AACnB,IAAA,IAAIjB,UAAAA,CAAWkB,IAAAA,CAAKD,GAAAA,EAAK,QAAA,CAAA,CAAA,EAAY;AACpC,MAAA,OAAOA,GAAAA;AACR,IAAA;AACA,IAAA,MAAMF,MAAAA,GAASG,IAAAA,CAAKD,GAAAA,EAAK,IAAA,CAAA;AACzB,IAAA,IAAIF,WAAWE,GAAAA,EAAK;AACnB,MAAA;AACD,IAAA;AACAA,IAAAA,GAAAA,GAAMF,MAAAA;AACP,EAAA;AACA,EAAA,OAAO,IAAA;AACR;AAbgBC,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAqBT,SAASG,YAAYxB,GAAAA,EAAW;AACtC,EAAA,IAAI;AACH,IAAA,MAAM,EAAEyB,QAAAA,EAAQ,GAAKC,SAAAA,CAAQ,eAAA,CAAA;AAC7B,IAAA,OAAOD,SAAS,+BAAA,EAAiC;AAChDzB,MAAAA,GAAAA;MACA2B,QAAAA,EAAU,OAAA;MACVC,KAAAA,EAAO;AAAC,QAAA,MAAA;AAAQ,QAAA,MAAA;AAAQ,QAAA;;AACzB,KAAA,EAAGC,IAAAA,EAAI;EACR,CAAA,CAAA,MAAQ;AACP,IAAA,OAAO,IAAA;AACR,EAAA;AACD;AAXgBL,MAAAA,CAAAA,WAAAA,EAAAA,aAAAA,CAAAA;AAqBT,SAASM,yBAAyBrC,aAAAA,EAAqB;AAC7D,EAAA,MAAMsC,OAAAA,GAAUR,IAAAA,CAAK9B,aAAAA,EAAe,SAAA,EAAW,gBAAA,CAAA;AAC/C,EAAA,IAAIY,UAAAA,CAAW0B,OAAAA,CAAAA,EAAU;AACxB,IAAA,OAAOA,OAAAA;AACR,EAAA;AACA,EAAA,OAAOR,IAAAA,CAAK9B,aAAAA,EAAe,SAAA,EAAW,uBAAA,CAAA;AACvC;AANgBqC,MAAAA,CAAAA,wBAAAA,EAAAA,0BAAAA,CAAAA","file":"chunk-HEUTZR52.js","sourcesContent":["/**\n * Workspace Utilities\n *\n * Shared workspace detection and path utilities for CLI commands.\n * Supersedes @vreko/mcp/middleware workspace helpers  -  no transitive engine/intelligence deps.\n *\n * @module utils/workspace\n */\n\nimport { existsSync, lstatSync } from \"node:fs\";\nimport { join, normalize, resolve } from \"node:path\";\n\n// =============================================================================\n// WORKSPACE VALIDATION (migrated from @vreko/mcp/middleware  -  Phase 3A)\n// =============================================================================\n\nexport interface WorkspaceValidationResult {\n\tvalid: boolean;\n\troot: string;\n\terror?: string;\n}\n\n/**\n * Validate a workspace path according to security criteria.\n * Checks for .git, package.json, or .vreko markers; rejects symlinks.\n */\nexport function validateWorkspacePath(workspacePath: string): WorkspaceValidationResult {\n\ttry {\n\t\tconst normalizedPath = normalize(workspacePath);\n\t\tconst absolutePath = resolve(normalizedPath);\n\n\t\tif (!absolutePath.startsWith(process.cwd()) && !absolutePath.startsWith(\"/\")) {\n\t\t\treturn { valid: false, root: \"\", error: \"Invalid workspace path\" };\n\t\t}\n\n\t\tconst hasGit = existsSync(resolve(absolutePath, \".git\"));\n\t\tconst hasPackageJson = existsSync(resolve(absolutePath, \"package.json\"));\n\t\tconst hasVreko = existsSync(resolve(absolutePath, \".vreko\"));\n\n\t\tif (!hasGit && !hasPackageJson && !hasVreko) {\n\t\t\treturn {\n\t\t\t\tvalid: false,\n\t\t\t\troot: absolutePath,\n\t\t\t\terror: \"Workspace must contain at least one marker: .git, package.json, or .vreko\",\n\t\t\t};\n\t\t}\n\n\t\ttry {\n\t\t\tconst stat = lstatSync(absolutePath);\n\t\t\tif (stat.isSymbolicLink()) {\n\t\t\t\treturn {\n\t\t\t\t\tvalid: false,\n\t\t\t\t\troot: absolutePath,\n\t\t\t\t\terror: \"Workspace path cannot be a symbolic link\",\n\t\t\t\t};\n\t\t\t}\n\t\t} catch {\n\t\t\treturn { valid: false, root: absolutePath, error: \"Cannot access workspace path\" };\n\t\t}\n\n\t\treturn { valid: true, root: absolutePath };\n\t} catch (error) {\n\t\treturn {\n\t\t\tvalid: false,\n\t\t\troot: \"\",\n\t\t\terror: error instanceof Error ? error.message : \"Unknown error validating workspace\",\n\t\t};\n\t}\n}\n\n/**\n * Resolve workspace root with fallback chain:\n * 1. Explicit path (if provided and valid)\n * 2. Traversal upward from cwd looking for .git / package.json / .vreko\n * 3. cwd itself as last resort\n */\nexport function resolveWorkspaceRoot(explicitPath?: string): WorkspaceValidationResult {\n\tif (explicitPath) {\n\t\tconst validation = validateWorkspacePath(explicitPath);\n\t\tif (validation.valid) {\n\t\t\treturn validation;\n\t\t}\n\t}\n\n\t// Traverse upward\n\tlet currentPath = resolve(process.cwd());\n\tconst maxIterations = 50;\n\tfor (let i = 0; i < maxIterations; i++) {\n\t\tconst hasMarker =\n\t\t\texistsSync(resolve(currentPath, \".git\")) ||\n\t\t\texistsSync(resolve(currentPath, \"package.json\")) ||\n\t\t\texistsSync(resolve(currentPath, \".vreko\"));\n\t\tif (hasMarker) {\n\t\t\treturn validateWorkspacePath(currentPath);\n\t\t}\n\t\tconst parent = resolve(currentPath, \"..\");\n\t\tif (parent === currentPath) {\n\t\t\tbreak;\n\t\t}\n\t\tcurrentPath = parent;\n\t}\n\n\t// Fallback: cwd\n\treturn validateWorkspacePath(process.cwd());\n}\n\n/**\n * Find the workspace root by traversing up from the given directory\n * looking for a .vreko directory.\n *\n * @param cwd - Current working directory to start from\n * @returns Absolute path to workspace root, or null if not found\n */\nexport function findWorkspaceRoot(cwd: string): string | null {\n\tlet dir = cwd;\n\twhile (dir !== \"/\") {\n\t\tif (existsSync(join(dir, \".vreko\"))) {\n\t\t\treturn dir;\n\t\t}\n\t\tconst parent = join(dir, \"..\");\n\t\tif (parent === dir) {\n\t\t\tbreak;\n\t\t}\n\t\tdir = parent;\n\t}\n\treturn null;\n}\n\n/**\n * Find git root by traversing up from the given directory.\n *\n * @param cwd - Current working directory to start from\n * @returns Absolute path to git root, or null if not in a git repo\n */\nexport function findGitRoot(cwd: string): string | null {\n\ttry {\n\t\tconst { execSync } = require(\"node:child_process\");\n\t\treturn execSync(\"git rev-parse --show-toplevel\", {\n\t\t\tcwd,\n\t\t\tencoding: \"utf-8\",\n\t\t\tstdio: [\"pipe\", \"pipe\", \"pipe\"],\n\t\t}).trim();\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Resolve the canonical path to workspace.json.\n * Tries the v0.4 path first (`.agents/workspace.json`),\n * then falls back to the legacy path (`.agents/agents.workspace.json`).\n *\n * @param workspacePath - Absolute path to the workspace root\n * @returns Absolute path to workspace.json (may or may not exist)\n */\nexport function resolveWorkspaceJsonPath(workspacePath: string): string {\n\tconst primary = join(workspacePath, \".agents\", \"workspace.json\");\n\tif (existsSync(primary)) {\n\t\treturn primary;\n\t}\n\treturn join(workspacePath, \".agents\", \"agents.workspace.json\");\n}\n"]}

package/dist/init-command-LXEBDSYX.js

@@ -1,7 +0,0 @@
-#!/usr/bin/env node
-export { createInitCommand } from './chunk-53BJRUUT.js';
-import './chunk-EWOJGXRX.js';
-
-process.env.VREKO_CLI='true';process.env.NODE_NO_WARNINGS='1';
-//# sourceMappingURL=init-command-LXEBDSYX.js.map
-//# sourceMappingURL=init-command-LXEBDSYX.js.map