@warlock.js/core 5.29.0 → 5.30.0

package/esm/dev-server/update-check-cache.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"update-check-cache.mjs","names":[],"sources":["../../../../../../../core/src/dev-server/update-check-cache.ts"],"sourcesContent":["import {\n  ensureDirectoryAsync,\n  fileExistsAsync,\n  getJsonFileAsync,\n  putJsonFileAsync,\n  unlinkAsync,\n} from \"@warlock.js/fs\";\nimport { warlockPath } from \"../utils/paths\";\n\n/** Where the last registry answer is remembered, inside the project's `.warlock/`. */\nconst CACHE_PATH = warlockPath(\"update-check.json\");\n\n/**\n * How long a registry answer stays good. A day matches npm's own\n * update-notifier: long enough that a normal day of `warlock dev` restarts\n * costs one lookup, short enough that a release never goes unnoticed for long.\n */\nexport const CACHE_TTL_MS = 24 * 60 * 60 * 1000;\n\n/** What we remember between runs. Only successful lookups are ever stored. */\ntype UpdateCheckCache = {\n  /** Epoch millis of the lookup. */\n  checkedAt: number;\n  /** The version the registry reported. */\n  latest: string;\n};\n\n/**\n * The remembered latest version, or `undefined` when there is nothing usable —\n * no cache, a stale one, or a corrupt one. Callers treat `undefined` as\n * \"ask npm\".\n */\nexport async function readCachedLatestVersion(\n  now: number = Date.now(),\n): Promise<string | undefined> {\n  try {\n    if (!(await fileExistsAsync(CACHE_PATH))) {\n      return undefined;\n    }\n\n    const cache = (await getJsonFileAsync(CACHE_PATH)) as Partial<UpdateCheckCache>;\n\n    if (typeof cache?.checkedAt !== \"number\" || typeof cache?.latest !== \"string\") {\n      return undefined;\n    }\n\n    // A clock that moved backwards (timezone change, VM resume, a hand-edited\n    // file) would otherwise pin the cache as \"fresh\" indefinitely.\n    const age = now - cache.checkedAt;\n\n    if (age < 0 || age > CACHE_TTL_MS) {\n      return undefined;\n    }\n\n    return cache.latest;\n  } catch {\n    // The cache is an optimisation — an unreadable one just means \"ask npm\".\n    return undefined;\n  }\n}\n\n/** Remember a successful registry answer. Failures are silent by design. */\nexport async function writeCachedLatestVersion(\n  latest: string,\n  now: number = Date.now(),\n): Promise<void> {\n  try {\n    await ensureDirectoryAsync(warlockPath());\n    await putJsonFileAsync(CACHE_PATH, { checkedAt: now, latest } satisfies UpdateCheckCache);\n  } catch {\n    // Not being able to remember is not a reason to fail the check.\n  }\n}\n\n/**\n * Forget the cached answer — called once an update has actually been applied,\n * so the next boot re-checks against the version we just installed instead of\n * reasoning from an answer that predates it.\n */\nexport async function clearCachedLatestVersion(): Promise<void> {\n  try {\n    if (await fileExistsAsync(CACHE_PATH)) {\n      await unlinkAsync(CACHE_PATH);\n    }\n  } catch {\n    // Worst case the next boot reads a stale-but-harmless entry.\n  }\n}\n"],"mappings":";;;;;AAUA,MAAM,aAAa,YAAY,mBAAmB;;;;;;AAOlD,MAAa,eAAe,OAAU,KAAK;;;;;;AAe3C,eAAsB,wBACpB,MAAc,KAAK,IAAI,GACM;CAC7B,IAAI;EACF,IAAI,CAAE,MAAM,gBAAgB,UAAU,GACpC;EAGF,MAAM,QAAS,MAAM,iBAAiB,UAAU;EAEhD,IAAI,OAAO,OAAO,cAAc,YAAY,OAAO,OAAO,WAAW,UACnE;EAKF,MAAM,MAAM,MAAM,MAAM;EAExB,IAAI,MAAM,KAAK,aACb;EAGF,OAAO,MAAM;CACf,QAAQ;EAEN;CACF;AACF;;AAGA,eAAsB,yBACpB,QACA,MAAc,KAAK,IAAI,GACR;CACf,IAAI;EACF,MAAM,qBAAqB,YAAY,CAAC;EACxC,MAAM,iBAAiB,YAAY;GAAE,WAAW;GAAK;EAAO,CAA4B;CAC1F,QAAQ,CAER;AACF;;;;;;AAOA,eAAsB,2BAA0C;CAC9D,IAAI;EACF,IAAI,MAAM,gBAAgB,UAAU,GAClC,MAAM,YAAY,UAAU;CAEhC,QAAQ,CAER;AACF"}
+{"version":3,"file":"update-check-cache.mjs","names":[],"sources":["../../../../../../../../packages/core/src/dev-server/update-check-cache.ts"],"sourcesContent":["import {\n  ensureDirectoryAsync,\n  fileExistsAsync,\n  getJsonFileAsync,\n  putJsonFileAsync,\n  unlinkAsync,\n} from \"@warlock.js/fs\";\nimport { warlockPath } from \"../utils/paths\";\n\n/** Where the last registry answer is remembered, inside the project's `.warlock/`. */\nconst CACHE_PATH = warlockPath(\"update-check.json\");\n\n/**\n * How long a registry answer stays good. A day matches npm's own\n * update-notifier: long enough that a normal day of `warlock dev` restarts\n * costs one lookup, short enough that a release never goes unnoticed for long.\n */\nexport const CACHE_TTL_MS = 24 * 60 * 60 * 1000;\n\n/** What we remember between runs. Only successful lookups are ever stored. */\ntype UpdateCheckCache = {\n  /** Epoch millis of the lookup. */\n  checkedAt: number;\n  /** The version the registry reported. */\n  latest: string;\n};\n\n/**\n * The remembered latest version, or `undefined` when there is nothing usable —\n * no cache, a stale one, or a corrupt one. Callers treat `undefined` as\n * \"ask npm\".\n */\nexport async function readCachedLatestVersion(\n  now: number = Date.now(),\n): Promise<string | undefined> {\n  try {\n    if (!(await fileExistsAsync(CACHE_PATH))) {\n      return undefined;\n    }\n\n    const cache = (await getJsonFileAsync(CACHE_PATH)) as Partial<UpdateCheckCache>;\n\n    if (typeof cache?.checkedAt !== \"number\" || typeof cache?.latest !== \"string\") {\n      return undefined;\n    }\n\n    // A clock that moved backwards (timezone change, VM resume, a hand-edited\n    // file) would otherwise pin the cache as \"fresh\" indefinitely.\n    const age = now - cache.checkedAt;\n\n    if (age < 0 || age > CACHE_TTL_MS) {\n      return undefined;\n    }\n\n    return cache.latest;\n  } catch {\n    // The cache is an optimisation — an unreadable one just means \"ask npm\".\n    return undefined;\n  }\n}\n\n/** Remember a successful registry answer. Failures are silent by design. */\nexport async function writeCachedLatestVersion(\n  latest: string,\n  now: number = Date.now(),\n): Promise<void> {\n  try {\n    await ensureDirectoryAsync(warlockPath());\n    await putJsonFileAsync(CACHE_PATH, { checkedAt: now, latest } satisfies UpdateCheckCache);\n  } catch {\n    // Not being able to remember is not a reason to fail the check.\n  }\n}\n\n/**\n * Forget the cached answer — called once an update has actually been applied,\n * so the next boot re-checks against the version we just installed instead of\n * reasoning from an answer that predates it.\n */\nexport async function clearCachedLatestVersion(): Promise<void> {\n  try {\n    if (await fileExistsAsync(CACHE_PATH)) {\n      await unlinkAsync(CACHE_PATH);\n    }\n  } catch {\n    // Worst case the next boot reads a stale-but-harmless entry.\n  }\n}\n"],"mappings":";;;;;AAUA,MAAM,aAAa,YAAY,mBAAmB;;;;;;AAOlD,MAAa,eAAe,OAAU,KAAK;;;;;;AAe3C,eAAsB,wBACpB,MAAc,KAAK,IAAI,GACM;CAC7B,IAAI;EACF,IAAI,CAAE,MAAM,gBAAgB,UAAU,GACpC;EAGF,MAAM,QAAS,MAAM,iBAAiB,UAAU;EAEhD,IAAI,OAAO,OAAO,cAAc,YAAY,OAAO,OAAO,WAAW,UACnE;EAKF,MAAM,MAAM,MAAM,MAAM;EAExB,IAAI,MAAM,KAAK,aACb;EAGF,OAAO,MAAM;CACf,QAAQ;EAEN;CACF;AACF;;AAGA,eAAsB,yBACpB,QACA,MAAc,KAAK,IAAI,GACR;CACf,IAAI;EACF,MAAM,qBAAqB,YAAY,CAAC;EACxC,MAAM,iBAAiB,YAAY;GAAE,WAAW;GAAK;EAAO,CAA4B;CAC1F,QAAQ,CAER;AACF;;;;;;AAOA,eAAsB,2BAA0C;CAC9D,IAAI;EACF,IAAI,MAAM,gBAAgB,UAAU,GAClC,MAAM,YAAY,UAAU;CAEhC,QAAQ,CAER;AACF"}

package/esm/dev-server/utils.mjs

@@ -4,7 +4,7 @@ import "../utils/index.mjs";
 import { ensureDirectoryAsync } from "@warlock.js/fs";
 import glob from "fast-glob";
 
-//#region ../core/src/dev-server/utils.ts
+//#region ../../packages/core/src/dev-server/utils.ts
 /**
 * Ensure the .warlock/ directory exists. Used by the loader-hook
 * registration which writes its bundled hook file into this directory.

package/esm/dev-server/utils.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"utils.mjs","names":[],"sources":["../../../../../../../core/src/dev-server/utils.ts"],"sourcesContent":["import { ensureDirectoryAsync } from \"@warlock.js/fs\";\nimport glob from \"fast-glob\";\nimport { srcPath, warlockPath } from \"../utils\";\nimport { Path } from \"../utils/normalized-path\";\n\n/**\n * Ensure the .warlock/ directory exists. Used by the loader-hook\n * registration which writes its bundled hook file into this directory.\n */\nexport async function ensureWarlockDirectory() {\n  await ensureDirectoryAsync(warlockPath());\n}\n\n/**\n * Glob the project's `src/` directory for `.ts`/`.tsx` files. Returns\n * normalised absolute paths.\n */\nexport async function getFilesFromDirectory(directoryPath = srcPath(), pattern = \"**/*.{ts,tsx}\") {\n  const files = await glob(`${Path.normalize(directoryPath)}/${pattern}`, { absolute: true });\n  return files.map((file) => Path.normalize(file));\n}\n\nexport async function getCertainFilesFromDirectory(directoryPath: string, filesNames: string[]) {\n  const pattern = filesNames.length === 1 ? filesNames[0] : `(${filesNames.join(\"|\")})`;\n  return getFilesFromDirectory(directoryPath, pattern + \".{ts,tsx}\");\n}\n\nexport function areSetsEqual<T>(set1: Set<T>, set2: Set<T>): boolean {\n  if (set1.size !== set2.size) return false;\n  for (const item of set1) {\n    if (!set2.has(item)) return false;\n  }\n  return true;\n}\n"],"mappings":";;;;;;;;;;;AASA,eAAsB,yBAAyB;CAC7C,MAAM,qBAAqB,YAAY,CAAC;AAC1C;;;;;AAMA,eAAsB,sBAAsB,gBAAgB,QAAQ,GAAG,UAAU,iBAAiB;CAEhG,QAAO,MADa,KAAK,GAAG,KAAK,UAAU,aAAa,EAAE,GAAG,WAAW,EAAE,UAAU,KAAK,CAAC,EAC9E,CAAC,KAAK,SAAS,KAAK,UAAU,IAAI,CAAC;AACjD;AAEA,eAAsB,6BAA6B,eAAuB,YAAsB;CAE9F,OAAO,sBAAsB,gBADb,WAAW,WAAW,IAAI,WAAW,KAAK,IAAI,WAAW,KAAK,GAAG,EAAE,MAC7B,WAAW;AACnE;AAEA,SAAgB,aAAgB,MAAc,MAAuB;CACnE,IAAI,KAAK,SAAS,KAAK,MAAM,OAAO;CACpC,KAAK,MAAM,QAAQ,MACjB,IAAI,CAAC,KAAK,IAAI,IAAI,GAAG,OAAO;CAE9B,OAAO;AACT"}
+{"version":3,"file":"utils.mjs","names":[],"sources":["../../../../../../../../packages/core/src/dev-server/utils.ts"],"sourcesContent":["import { ensureDirectoryAsync } from \"@warlock.js/fs\";\nimport glob from \"fast-glob\";\nimport { srcPath, warlockPath } from \"../utils\";\nimport { Path } from \"../utils/normalized-path\";\n\n/**\n * Ensure the .warlock/ directory exists. Used by the loader-hook\n * registration which writes its bundled hook file into this directory.\n */\nexport async function ensureWarlockDirectory() {\n  await ensureDirectoryAsync(warlockPath());\n}\n\n/**\n * Glob the project's `src/` directory for `.ts`/`.tsx` files. Returns\n * normalised absolute paths.\n */\nexport async function getFilesFromDirectory(directoryPath = srcPath(), pattern = \"**/*.{ts,tsx}\") {\n  const files = await glob(`${Path.normalize(directoryPath)}/${pattern}`, { absolute: true });\n  return files.map((file) => Path.normalize(file));\n}\n\nexport async function getCertainFilesFromDirectory(directoryPath: string, filesNames: string[]) {\n  const pattern = filesNames.length === 1 ? filesNames[0] : `(${filesNames.join(\"|\")})`;\n  return getFilesFromDirectory(directoryPath, pattern + \".{ts,tsx}\");\n}\n\nexport function areSetsEqual<T>(set1: Set<T>, set2: Set<T>): boolean {\n  if (set1.size !== set2.size) return false;\n  for (const item of set1) {\n    if (!set2.has(item)) return false;\n  }\n  return true;\n}\n"],"mappings":";;;;;;;;;;;AASA,eAAsB,yBAAyB;CAC7C,MAAM,qBAAqB,YAAY,CAAC;AAC1C;;;;;AAMA,eAAsB,sBAAsB,gBAAgB,QAAQ,GAAG,UAAU,iBAAiB;CAEhG,QAAO,MADa,KAAK,GAAG,KAAK,UAAU,aAAa,EAAE,GAAG,WAAW,EAAE,UAAU,KAAK,CAAC,EAC9E,CAAC,KAAK,SAAS,KAAK,UAAU,IAAI,CAAC;AACjD;AAEA,eAAsB,6BAA6B,eAAuB,YAAsB;CAE9F,OAAO,sBAAsB,gBADb,WAAW,WAAW,IAAI,WAAW,KAAK,IAAI,WAAW,KAAK,GAAG,EAAE,MAC7B,WAAW;AACnE;AAEA,SAAgB,aAAgB,MAAc,MAAuB;CACnE,IAAI,KAAK,SAAS,KAAK,MAAM,OAAO;CACpC,KAAK,MAAM,QAAQ,MACjB,IAAI,CAAC,KAAK,IAAI,IAAI,GAAG,OAAO;CAE9B,OAAO;AACT"}

package/esm/encryption/encrypt.d.mts

@@ -1,4 +1,4 @@
-//#region ../core/src/encryption/encrypt.d.ts
+//#region ../../packages/core/src/encryption/encrypt.d.ts
 /**
  * Encrypts a plaintext string using AES-256-GCM (or the configured algorithm).
  * Returns a combined string in the format `iv:ciphertext:authTag`.

package/esm/encryption/encrypt.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"encrypt.d.mts","names":[],"sources":["../../../../../../../core/src/encryption/encrypt.ts"],"mappings":";;AAuEA;;;;AAAyC;AAiCzC;;;;iBAjCgB,OAAA,CAAQ,SAAiB;;;;;;;;;;;iBAiCzB,OAAA,CAAQ,UAAkB"}
+{"version":3,"file":"encrypt.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/encryption/encrypt.ts"],"mappings":";;AAuEA;;;;AAAyC;AAiCzC;;;;iBAjCgB,OAAA,CAAQ,SAAiB;;;;;;;;;;;iBAiCzB,OAAA,CAAQ,UAAkB"}

package/esm/encryption/encrypt.mjs

@@ -2,7 +2,7 @@ import { config } from "../config/config-getter.mjs";
 import "../config/index.mjs";
 import crypto from "crypto";
 
-//#region ../core/src/encryption/encrypt.ts
+//#region ../../packages/core/src/encryption/encrypt.ts
 /**
 * Default encryption algorithm.
 */

package/esm/encryption/encrypt.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"encrypt.mjs","names":[],"sources":["../../../../../../../core/src/encryption/encrypt.ts"],"sourcesContent":["import crypto from \"crypto\";\nimport { config } from \"../config\";\nimport { type EncryptionConfigurations } from \"./types\";\n\n/**\n * Default encryption algorithm.\n */\nconst DEFAULT_ALGORITHM = \"aes-256-gcm\";\n\n/**\n * Get the encryption key from config, validated as a 32-byte hex string.\n */\nfunction getEncryptionKey(keyBytes: number): Buffer {\n  const key = config.key<EncryptionConfigurations[\"key\"]>(\"encryption.key\");\n\n  if (!key) {\n    throw new Error(\n      \"Missing encryption key. Set 'encryption.key' in your config (64 hex characters = 32 bytes).\",\n    );\n  }\n\n  const buffer = Buffer.from(key, \"hex\");\n\n  if (buffer.length !== keyBytes) {\n    // Never include the key itself: this message reaches logs and error pages.\n    throw new Error(\n      `Encryption key must be exactly ${keyBytes} bytes (${keyBytes * 2} hex characters). Got ${buffer.length} bytes.`,\n    );\n  }\n\n  return buffer;\n}\n\n/**\n * Supported algorithms (the format assumes GCM: 16-byte IV + auth tag)\n * mapped to their required key size in bytes.\n */\nconst ALGORITHM_KEY_BYTES: Record<string, number> = {\n  \"aes-128-gcm\": 16,\n  \"aes-192-gcm\": 24,\n  \"aes-256-gcm\": 32,\n};\n\n/**\n * Get the configured encryption algorithm, defaults to aes-256-gcm.\n */\nfunction getAlgorithm(): string {\n  const algorithm = config.key<EncryptionConfigurations[\"algorithm\"]>(\n    \"encryption.algorithm\",\n    DEFAULT_ALGORITHM,\n  )!;\n\n  if (!(algorithm in ALGORITHM_KEY_BYTES)) {\n    throw new Error(\n      `Unsupported encryption algorithm '${algorithm}'. Supported: ${Object.keys(ALGORITHM_KEY_BYTES).join(\", \")}.`,\n    );\n  }\n\n  return algorithm;\n}\n\n/**\n * Encrypts a plaintext string using AES-256-GCM (or the configured algorithm).\n * Returns a combined string in the format `iv:ciphertext:authTag`.\n *\n * @example\n * import { encrypt } from \"@warlock.js/core\";\n *\n * const encrypted = encrypt(\"sk-proj-12345\");\n * // => \"a1b2c3...:d4e5f6...:g7h8i9...\"\n */\nexport function encrypt(plainText: string): string {\n  if (!plainText) return plainText;\n\n  const algorithm = getAlgorithm();\n  const keyBuffer = getEncryptionKey(ALGORITHM_KEY_BYTES[algorithm]!);\n\n  try {\n    // IV must be unique per encryption. 16 bytes is standard for AES.\n    const iv = crypto.randomBytes(16);\n    const cipher = crypto.createCipheriv(algorithm, keyBuffer, iv);\n\n    let encrypted = cipher.update(plainText, \"utf8\", \"hex\");\n    encrypted += cipher.final(\"hex\");\n\n    // Auth tag validates ciphertext integrity (tamper detection)\n    const authTag = (cipher as crypto.CipherGCM).getAuthTag().toString(\"hex\");\n\n    return `${iv.toString(\"hex\")}:${encrypted}:${authTag}`;\n  } catch (error) {\n    throw new Error(`Encryption failed: ${(error as Error).message}`);\n  }\n}\n\n/**\n * Decrypts a string previously encrypted with {@link encrypt}.\n * Expects the format `iv:ciphertext:authTag`.\n *\n * @example\n * import { decrypt } from \"@warlock.js/core\";\n *\n * const original = decrypt(encryptedString);\n * // => \"sk-proj-12345\"\n */\nexport function decrypt(cipherText: string): string {\n  if (!cipherText) return cipherText;\n\n  const algorithm = getAlgorithm();\n  const keyBuffer = getEncryptionKey(ALGORITHM_KEY_BYTES[algorithm]!);\n\n  try {\n    const parts = cipherText.split(\":\");\n\n    if (parts.length !== 3) {\n      throw new Error(\"Invalid encrypted format. Expected iv:ciphertext:authTag\");\n    }\n\n    const [ivHex, encryptedHex, authTagHex] = parts;\n\n    if (ivHex === undefined || encryptedHex === undefined || authTagHex === undefined) {\n      throw new Error(\"Invalid encrypted format. Expected iv:ciphertext:authTag\");\n    }\n\n    const decipher = crypto.createDecipheriv(algorithm, keyBuffer, Buffer.from(ivHex, \"hex\"));\n\n    (decipher as crypto.DecipherGCM).setAuthTag(Buffer.from(authTagHex, \"hex\"));\n\n    let decrypted = decipher.update(encryptedHex, \"hex\", \"utf8\");\n    // .final() throws if auth tag is invalid (data tampered)\n    decrypted += decipher.final(\"utf8\");\n\n    return decrypted;\n  } catch (error) {\n    throw new Error(`Decryption failed: ${(error as Error).message}`);\n  }\n}\n"],"mappings":";;;;;;;;AAOA,MAAM,oBAAoB;;;;AAK1B,SAAS,iBAAiB,UAA0B;CAClD,MAAM,MAAM,OAAO,IAAqC,gBAAgB;CAExE,IAAI,CAAC,KACH,MAAM,IAAI,MACR,6FACF;CAGF,MAAM,SAAS,OAAO,KAAK,KAAK,KAAK;CAErC,IAAI,OAAO,WAAW,UAEpB,MAAM,IAAI,MACR,kCAAkC,SAAS,UAAU,WAAW,EAAE,wBAAwB,OAAO,OAAO,QAC1G;CAGF,OAAO;AACT;;;;;AAMA,MAAM,sBAA8C;CAClD,eAAe;CACf,eAAe;CACf,eAAe;AACjB;;;;AAKA,SAAS,eAAuB;CAC9B,MAAM,YAAY,OAAO,IACvB,wBACA,iBACF;CAEA,IAAI,EAAE,aAAa,sBACjB,MAAM,IAAI,MACR,qCAAqC,UAAU,gBAAgB,OAAO,KAAK,mBAAmB,CAAC,CAAC,KAAK,IAAI,EAAE,EAC7G;CAGF,OAAO;AACT;;;;;;;;;;;AAYA,SAAgB,QAAQ,WAA2B;CACjD,IAAI,CAAC,WAAW,OAAO;CAEvB,MAAM,YAAY,aAAa;CAC/B,MAAM,YAAY,iBAAiB,oBAAoB,UAAW;CAElE,IAAI;EAEF,MAAM,KAAK,OAAO,YAAY,EAAE;EAChC,MAAM,SAAS,OAAO,eAAe,WAAW,WAAW,EAAE;EAE7D,IAAI,YAAY,OAAO,OAAO,WAAW,QAAQ,KAAK;EACtD,aAAa,OAAO,MAAM,KAAK;EAG/B,MAAM,UAAW,OAA4B,WAAW,CAAC,CAAC,SAAS,KAAK;EAExE,OAAO,GAAG,GAAG,SAAS,KAAK,EAAE,GAAG,UAAU,GAAG;CAC/C,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,sBAAuB,MAAgB,SAAS;CAClE;AACF;;;;;;;;;;;AAYA,SAAgB,QAAQ,YAA4B;CAClD,IAAI,CAAC,YAAY,OAAO;CAExB,MAAM,YAAY,aAAa;CAC/B,MAAM,YAAY,iBAAiB,oBAAoB,UAAW;CAElE,IAAI;EACF,MAAM,QAAQ,WAAW,MAAM,GAAG;EAElC,IAAI,MAAM,WAAW,GACnB,MAAM,IAAI,MAAM,0DAA0D;EAG5E,MAAM,CAAC,OAAO,cAAc,cAAc;EAE1C,IAAI,UAAU,UAAa,iBAAiB,UAAa,eAAe,QACtE,MAAM,IAAI,MAAM,0DAA0D;EAG5E,MAAM,WAAW,OAAO,iBAAiB,WAAW,WAAW,OAAO,KAAK,OAAO,KAAK,CAAC;EAExF,AAAC,SAAgC,WAAW,OAAO,KAAK,YAAY,KAAK,CAAC;EAE1E,IAAI,YAAY,SAAS,OAAO,cAAc,OAAO,MAAM;EAE3D,aAAa,SAAS,MAAM,MAAM;EAElC,OAAO;CACT,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,sBAAuB,MAAgB,SAAS;CAClE;AACF"}
+{"version":3,"file":"encrypt.mjs","names":[],"sources":["../../../../../../../../packages/core/src/encryption/encrypt.ts"],"sourcesContent":["import crypto from \"crypto\";\nimport { config } from \"../config\";\nimport { type EncryptionConfigurations } from \"./types\";\n\n/**\n * Default encryption algorithm.\n */\nconst DEFAULT_ALGORITHM = \"aes-256-gcm\";\n\n/**\n * Get the encryption key from config, validated as a 32-byte hex string.\n */\nfunction getEncryptionKey(keyBytes: number): Buffer {\n  const key = config.key<EncryptionConfigurations[\"key\"]>(\"encryption.key\");\n\n  if (!key) {\n    throw new Error(\n      \"Missing encryption key. Set 'encryption.key' in your config (64 hex characters = 32 bytes).\",\n    );\n  }\n\n  const buffer = Buffer.from(key, \"hex\");\n\n  if (buffer.length !== keyBytes) {\n    // Never include the key itself: this message reaches logs and error pages.\n    throw new Error(\n      `Encryption key must be exactly ${keyBytes} bytes (${keyBytes * 2} hex characters). Got ${buffer.length} bytes.`,\n    );\n  }\n\n  return buffer;\n}\n\n/**\n * Supported algorithms (the format assumes GCM: 16-byte IV + auth tag)\n * mapped to their required key size in bytes.\n */\nconst ALGORITHM_KEY_BYTES: Record<string, number> = {\n  \"aes-128-gcm\": 16,\n  \"aes-192-gcm\": 24,\n  \"aes-256-gcm\": 32,\n};\n\n/**\n * Get the configured encryption algorithm, defaults to aes-256-gcm.\n */\nfunction getAlgorithm(): string {\n  const algorithm = config.key<EncryptionConfigurations[\"algorithm\"]>(\n    \"encryption.algorithm\",\n    DEFAULT_ALGORITHM,\n  )!;\n\n  if (!(algorithm in ALGORITHM_KEY_BYTES)) {\n    throw new Error(\n      `Unsupported encryption algorithm '${algorithm}'. Supported: ${Object.keys(ALGORITHM_KEY_BYTES).join(\", \")}.`,\n    );\n  }\n\n  return algorithm;\n}\n\n/**\n * Encrypts a plaintext string using AES-256-GCM (or the configured algorithm).\n * Returns a combined string in the format `iv:ciphertext:authTag`.\n *\n * @example\n * import { encrypt } from \"@warlock.js/core\";\n *\n * const encrypted = encrypt(\"sk-proj-12345\");\n * // => \"a1b2c3...:d4e5f6...:g7h8i9...\"\n */\nexport function encrypt(plainText: string): string {\n  if (!plainText) return plainText;\n\n  const algorithm = getAlgorithm();\n  const keyBuffer = getEncryptionKey(ALGORITHM_KEY_BYTES[algorithm]!);\n\n  try {\n    // IV must be unique per encryption. 16 bytes is standard for AES.\n    const iv = crypto.randomBytes(16);\n    const cipher = crypto.createCipheriv(algorithm, keyBuffer, iv);\n\n    let encrypted = cipher.update(plainText, \"utf8\", \"hex\");\n    encrypted += cipher.final(\"hex\");\n\n    // Auth tag validates ciphertext integrity (tamper detection)\n    const authTag = (cipher as crypto.CipherGCM).getAuthTag().toString(\"hex\");\n\n    return `${iv.toString(\"hex\")}:${encrypted}:${authTag}`;\n  } catch (error) {\n    throw new Error(`Encryption failed: ${(error as Error).message}`);\n  }\n}\n\n/**\n * Decrypts a string previously encrypted with {@link encrypt}.\n * Expects the format `iv:ciphertext:authTag`.\n *\n * @example\n * import { decrypt } from \"@warlock.js/core\";\n *\n * const original = decrypt(encryptedString);\n * // => \"sk-proj-12345\"\n */\nexport function decrypt(cipherText: string): string {\n  if (!cipherText) return cipherText;\n\n  const algorithm = getAlgorithm();\n  const keyBuffer = getEncryptionKey(ALGORITHM_KEY_BYTES[algorithm]!);\n\n  try {\n    const parts = cipherText.split(\":\");\n\n    if (parts.length !== 3) {\n      throw new Error(\"Invalid encrypted format. Expected iv:ciphertext:authTag\");\n    }\n\n    const [ivHex, encryptedHex, authTagHex] = parts;\n\n    if (ivHex === undefined || encryptedHex === undefined || authTagHex === undefined) {\n      throw new Error(\"Invalid encrypted format. Expected iv:ciphertext:authTag\");\n    }\n\n    const decipher = crypto.createDecipheriv(algorithm, keyBuffer, Buffer.from(ivHex, \"hex\"));\n\n    (decipher as crypto.DecipherGCM).setAuthTag(Buffer.from(authTagHex, \"hex\"));\n\n    let decrypted = decipher.update(encryptedHex, \"hex\", \"utf8\");\n    // .final() throws if auth tag is invalid (data tampered)\n    decrypted += decipher.final(\"utf8\");\n\n    return decrypted;\n  } catch (error) {\n    throw new Error(`Decryption failed: ${(error as Error).message}`);\n  }\n}\n"],"mappings":";;;;;;;;AAOA,MAAM,oBAAoB;;;;AAK1B,SAAS,iBAAiB,UAA0B;CAClD,MAAM,MAAM,OAAO,IAAqC,gBAAgB;CAExE,IAAI,CAAC,KACH,MAAM,IAAI,MACR,6FACF;CAGF,MAAM,SAAS,OAAO,KAAK,KAAK,KAAK;CAErC,IAAI,OAAO,WAAW,UAEpB,MAAM,IAAI,MACR,kCAAkC,SAAS,UAAU,WAAW,EAAE,wBAAwB,OAAO,OAAO,QAC1G;CAGF,OAAO;AACT;;;;;AAMA,MAAM,sBAA8C;CAClD,eAAe;CACf,eAAe;CACf,eAAe;AACjB;;;;AAKA,SAAS,eAAuB;CAC9B,MAAM,YAAY,OAAO,IACvB,wBACA,iBACF;CAEA,IAAI,EAAE,aAAa,sBACjB,MAAM,IAAI,MACR,qCAAqC,UAAU,gBAAgB,OAAO,KAAK,mBAAmB,CAAC,CAAC,KAAK,IAAI,EAAE,EAC7G;CAGF,OAAO;AACT;;;;;;;;;;;AAYA,SAAgB,QAAQ,WAA2B;CACjD,IAAI,CAAC,WAAW,OAAO;CAEvB,MAAM,YAAY,aAAa;CAC/B,MAAM,YAAY,iBAAiB,oBAAoB,UAAW;CAElE,IAAI;EAEF,MAAM,KAAK,OAAO,YAAY,EAAE;EAChC,MAAM,SAAS,OAAO,eAAe,WAAW,WAAW,EAAE;EAE7D,IAAI,YAAY,OAAO,OAAO,WAAW,QAAQ,KAAK;EACtD,aAAa,OAAO,MAAM,KAAK;EAG/B,MAAM,UAAW,OAA4B,WAAW,CAAC,CAAC,SAAS,KAAK;EAExE,OAAO,GAAG,GAAG,SAAS,KAAK,EAAE,GAAG,UAAU,GAAG;CAC/C,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,sBAAuB,MAAgB,SAAS;CAClE;AACF;;;;;;;;;;;AAYA,SAAgB,QAAQ,YAA4B;CAClD,IAAI,CAAC,YAAY,OAAO;CAExB,MAAM,YAAY,aAAa;CAC/B,MAAM,YAAY,iBAAiB,oBAAoB,UAAW;CAElE,IAAI;EACF,MAAM,QAAQ,WAAW,MAAM,GAAG;EAElC,IAAI,MAAM,WAAW,GACnB,MAAM,IAAI,MAAM,0DAA0D;EAG5E,MAAM,CAAC,OAAO,cAAc,cAAc;EAE1C,IAAI,UAAU,UAAa,iBAAiB,UAAa,eAAe,QACtE,MAAM,IAAI,MAAM,0DAA0D;EAG5E,MAAM,WAAW,OAAO,iBAAiB,WAAW,WAAW,OAAO,KAAK,OAAO,KAAK,CAAC;EAExF,AAAC,SAAgC,WAAW,OAAO,KAAK,YAAY,KAAK,CAAC;EAE1E,IAAI,YAAY,SAAS,OAAO,cAAc,OAAO,MAAM;EAE3D,aAAa,SAAS,MAAM,MAAM;EAElC,OAAO;CACT,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,sBAAuB,MAAgB,SAAS;CAClE;AACF"}

package/esm/encryption/hash.d.mts

@@ -1,4 +1,4 @@
-//#region ../core/src/encryption/hash.d.ts
+//#region ../../packages/core/src/encryption/hash.d.ts
 /**
  * Creates a deterministic HMAC-SHA256 hash of the given string.
  *

package/esm/encryption/hash.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"hash.d.mts","names":[],"sources":["../../../../../../../core/src/encryption/hash.ts"],"mappings":";;AAqBA;;;;AAA0C;;;;;;;;;;iBAA1B,QAAA,CAAS,SAAiB"}
+{"version":3,"file":"hash.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/encryption/hash.ts"],"mappings":";;AAqBA;;;;AAA0C;;;;;;;;;;iBAA1B,QAAA,CAAS,SAAiB"}

package/esm/encryption/hash.mjs

@@ -2,7 +2,7 @@ import { config } from "../config/config-getter.mjs";
 import "../config/index.mjs";
 import crypto from "crypto";
 
-//#region ../core/src/encryption/hash.ts
+//#region ../../packages/core/src/encryption/hash.ts
 const MIN_HMAC_KEY_BYTES = 16;
 /**
 * Creates a deterministic HMAC-SHA256 hash of the given string.

package/esm/encryption/hash.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"hash.mjs","names":[],"sources":["../../../../../../../core/src/encryption/hash.ts"],"sourcesContent":["import crypto from \"crypto\";\nimport { config } from \"../config\";\nimport { type EncryptionConfigurations } from \"./types\";\n\nconst MIN_HMAC_KEY_BYTES = 16;\n\n/**\n * Creates a deterministic HMAC-SHA256 hash of the given string.\n *\n * Useful for creating searchable, unique fingerprints of sensitive data\n * (e.g., an API key) without storing the plaintext.\n *\n * Uses a dedicated HMAC key from config. Falls back to the encryption key\n * if no separate HMAC key is configured.\n *\n * @example\n * import { hmacHash } from \"@warlock.js/core\";\n *\n * const fingerprint = hmacHash(\"sk-proj-12345\");\n * // Store `fingerprint` in DB for lookups, store encrypted value separately\n */\nexport function hmacHash(plainText: string): string {\n  if (!plainText) return plainText;\n\n  const hmacKey =\n    config.key<EncryptionConfigurations[\"hmacKey\"]>(\"encryption.hmacKey\") ||\n    config.key<EncryptionConfigurations[\"key\"]>(\"encryption.key\");\n\n  if (!hmacKey) {\n    throw new Error(\n      \"Missing HMAC key. Set 'encryption.hmacKey' (or 'encryption.key') in your config.\",\n    );\n  }\n\n  if (!/^(?:[0-9a-fA-F]{2})+$/.test(hmacKey) || hmacKey.length / 2 < MIN_HMAC_KEY_BYTES) {\n    throw new Error(\n      \"Invalid HMAC key. 'encryption.hmacKey' (or 'encryption.key') must be an even-length hex string of at least 16 bytes. Generate one with: openssl rand -hex 32\",\n    );\n  }\n\n  const keyBuffer = Buffer.from(hmacKey, \"hex\");\n\n  return crypto.createHmac(\"sha256\", keyBuffer).update(plainText).digest(\"hex\");\n}\n"],"mappings":";;;;;AAIA,MAAM,qBAAqB;;;;;;;;;;;;;;;;AAiB3B,SAAgB,SAAS,WAA2B;CAClD,IAAI,CAAC,WAAW,OAAO;CAEvB,MAAM,UACJ,OAAO,IAAyC,oBAAoB,KACpE,OAAO,IAAqC,gBAAgB;CAE9D,IAAI,CAAC,SACH,MAAM,IAAI,MACR,kFACF;CAGF,IAAI,CAAC,wBAAwB,KAAK,OAAO,KAAK,QAAQ,SAAS,IAAI,oBACjE,MAAM,IAAI,MACR,8JACF;CAGF,MAAM,YAAY,OAAO,KAAK,SAAS,KAAK;CAE5C,OAAO,OAAO,WAAW,UAAU,SAAS,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,OAAO,KAAK;AAC9E"}
+{"version":3,"file":"hash.mjs","names":[],"sources":["../../../../../../../../packages/core/src/encryption/hash.ts"],"sourcesContent":["import crypto from \"crypto\";\nimport { config } from \"../config\";\nimport { type EncryptionConfigurations } from \"./types\";\n\nconst MIN_HMAC_KEY_BYTES = 16;\n\n/**\n * Creates a deterministic HMAC-SHA256 hash of the given string.\n *\n * Useful for creating searchable, unique fingerprints of sensitive data\n * (e.g., an API key) without storing the plaintext.\n *\n * Uses a dedicated HMAC key from config. Falls back to the encryption key\n * if no separate HMAC key is configured.\n *\n * @example\n * import { hmacHash } from \"@warlock.js/core\";\n *\n * const fingerprint = hmacHash(\"sk-proj-12345\");\n * // Store `fingerprint` in DB for lookups, store encrypted value separately\n */\nexport function hmacHash(plainText: string): string {\n  if (!plainText) return plainText;\n\n  const hmacKey =\n    config.key<EncryptionConfigurations[\"hmacKey\"]>(\"encryption.hmacKey\") ||\n    config.key<EncryptionConfigurations[\"key\"]>(\"encryption.key\");\n\n  if (!hmacKey) {\n    throw new Error(\n      \"Missing HMAC key. Set 'encryption.hmacKey' (or 'encryption.key') in your config.\",\n    );\n  }\n\n  if (!/^(?:[0-9a-fA-F]{2})+$/.test(hmacKey) || hmacKey.length / 2 < MIN_HMAC_KEY_BYTES) {\n    throw new Error(\n      \"Invalid HMAC key. 'encryption.hmacKey' (or 'encryption.key') must be an even-length hex string of at least 16 bytes. Generate one with: openssl rand -hex 32\",\n    );\n  }\n\n  const keyBuffer = Buffer.from(hmacKey, \"hex\");\n\n  return crypto.createHmac(\"sha256\", keyBuffer).update(plainText).digest(\"hex\");\n}\n"],"mappings":";;;;;AAIA,MAAM,qBAAqB;;;;;;;;;;;;;;;;AAiB3B,SAAgB,SAAS,WAA2B;CAClD,IAAI,CAAC,WAAW,OAAO;CAEvB,MAAM,UACJ,OAAO,IAAyC,oBAAoB,KACpE,OAAO,IAAqC,gBAAgB;CAE9D,IAAI,CAAC,SACH,MAAM,IAAI,MACR,kFACF;CAGF,IAAI,CAAC,wBAAwB,KAAK,OAAO,KAAK,QAAQ,SAAS,IAAI,oBACjE,MAAM,IAAI,MACR,8JACF;CAGF,MAAM,YAAY,OAAO,KAAK,SAAS,KAAK;CAE5C,OAAO,OAAO,WAAW,UAAU,SAAS,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,OAAO,KAAK;AAC9E"}

package/esm/encryption/password.d.mts

@@ -1,4 +1,4 @@
-//#region ../core/src/encryption/password.d.ts
+//#region ../../packages/core/src/encryption/password.d.ts
 /**
  * Hashes a password using bcrypt (async — does not block the event loop).
  *

package/esm/encryption/password.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"password.d.mts","names":[],"sources":["../../../../../../../core/src/encryption/password.ts"],"mappings":";;AA6DA;;;;AAA6D;AAuB7D;;;;;;iBAvBsB,YAAA,CAAa,QAAA,WAAmB,OAAO;;AA0BnD;;;;;;;iBAHY,cAAA,CACpB,aAAA,UACA,cAAA,WACC,OAAO"}
+{"version":3,"file":"password.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/encryption/password.ts"],"mappings":";;AA6DA;;;;AAA6D;AAuB7D;;;;;;iBAvBsB,YAAA,CAAa,QAAA,WAAmB,OAAO;;AA0BnD;;;;;;;iBAHY,cAAA,CACpB,aAAA,UACA,cAAA,WACC,OAAO"}

package/esm/encryption/password.mjs

@@ -1,7 +1,7 @@
 import { config } from "../config/config-getter.mjs";
 import "../config/index.mjs";
 
-//#region ../core/src/encryption/password.ts
+//#region ../../packages/core/src/encryption/password.ts
 /**
 * Default bcrypt salt rounds.
 */

package/esm/encryption/password.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"password.mjs","names":[],"sources":["../../../../../../../core/src/encryption/password.ts"],"sourcesContent":["import { config } from \"../config\";\nimport { type EncryptionPasswordConfigurations } from \"./types\";\n\n/**\n * Default bcrypt salt rounds.\n */\nconst DEFAULT_SALT_ROUNDS = 12;\n\n// ============================================================\n// Lazy-loaded bcryptjs SDK Types\n// ============================================================\n\n/**\n * Cached bcryptjs module (loaded once, reused)\n */\nlet Bcryptjs: typeof import(\"bcryptjs\");\n\nlet isModuleExists: boolean | null = null;\n\n/**\n * Installation instructions for bcryptjs package\n */\nconst BCRYPTJS_INSTALL_INSTRUCTIONS = `\nPassword encryption requires the bcryptjs package.\nInstall it with:\n\n  yarn add bcryptjs\n\nOr with your preferred package manager:\n\n  npm install bcryptjs\n  pnpm add bcryptjs\n  yarn add bcryptjs\n`.trim();\n\n/**\n * Load bcryptjs module\n */\nasync function loadBcryptjs() {\n  try {\n    Bcryptjs = await import(\"bcryptjs\");\n    isModuleExists = true;\n  } catch {\n    isModuleExists = false;\n  }\n}\n\nconst bcryptjsLoading = loadBcryptjs();\n\n/**\n * Hashes a password using bcrypt (async — does not block the event loop).\n *\n * Salt rounds are read from \\`encryption.password.saltRounds\\` config,\n * defaulting to 12.\n *\n * @example\n * import { hashPassword } from \"@warlock.js/core\";\n *\n * const hashed = await hashPassword(\"user-password-123\");\n * // Store \\`hashed\\` in the database\n */\nexport async function hashPassword(password: string): Promise<string> {\n  await bcryptjsLoading;\n\n  if (!isModuleExists) {\n    throw new Error(BCRYPTJS_INSTALL_INSTRUCTIONS);\n  }\n\n  const saltRounds = config.key<EncryptionPasswordConfigurations[\"salt\"]>(\n    \"encryption.password.salt\",\n    DEFAULT_SALT_ROUNDS,\n  )!;\n\n  return Bcryptjs.hash(String(password), saltRounds);\n}\n\n/**\n * Verifies a plain password against a bcrypt hash (async — does not block the event loop).\n *\n * @example\n * import { verifyPassword } from \"@warlock.js/core\";\n *\n * const isValid = await verifyPassword(\"user-password-123\", storedHash);\n */\nexport async function verifyPassword(\n  plainPassword: string,\n  hashedPassword: string,\n): Promise<boolean> {\n  await bcryptjsLoading;\n\n  if (!isModuleExists) {\n    throw new Error(BCRYPTJS_INSTALL_INSTRUCTIONS);\n  }\n\n  return Bcryptjs.compare(String(plainPassword), String(hashedPassword));\n}\n"],"mappings":";;;;;;;AAMA,MAAM,sBAAsB;;;;AAS5B,IAAI;AAEJ,IAAI,iBAAiC;;;;AAKrC,MAAM,gCAAgC;;;;;;;;;;;EAWpC,KAAK;;;;AAKP,eAAe,eAAe;CAC5B,IAAI;EACF,WAAW,MAAM,OAAO;EACxB,iBAAiB;CACnB,QAAQ;EACN,iBAAiB;CACnB;AACF;AAEA,MAAM,kBAAkB,aAAa;;;;;;;;;;;;;AAcrC,eAAsB,aAAa,UAAmC;CACpE,MAAM;CAEN,IAAI,CAAC,gBACH,MAAM,IAAI,MAAM,6BAA6B;CAG/C,MAAM,aAAa,OAAO,IACxB,4BACA,mBACF;CAEA,OAAO,SAAS,KAAK,OAAO,QAAQ,GAAG,UAAU;AACnD;;;;;;;;;AAUA,eAAsB,eACpB,eACA,gBACkB;CAClB,MAAM;CAEN,IAAI,CAAC,gBACH,MAAM,IAAI,MAAM,6BAA6B;CAG/C,OAAO,SAAS,QAAQ,OAAO,aAAa,GAAG,OAAO,cAAc,CAAC;AACvE"}
+{"version":3,"file":"password.mjs","names":[],"sources":["../../../../../../../../packages/core/src/encryption/password.ts"],"sourcesContent":["import { config } from \"../config\";\nimport { type EncryptionPasswordConfigurations } from \"./types\";\n\n/**\n * Default bcrypt salt rounds.\n */\nconst DEFAULT_SALT_ROUNDS = 12;\n\n// ============================================================\n// Lazy-loaded bcryptjs SDK Types\n// ============================================================\n\n/**\n * Cached bcryptjs module (loaded once, reused)\n */\nlet Bcryptjs: typeof import(\"bcryptjs\");\n\nlet isModuleExists: boolean | null = null;\n\n/**\n * Installation instructions for bcryptjs package\n */\nconst BCRYPTJS_INSTALL_INSTRUCTIONS = `\nPassword encryption requires the bcryptjs package.\nInstall it with:\n\n  yarn add bcryptjs\n\nOr with your preferred package manager:\n\n  npm install bcryptjs\n  pnpm add bcryptjs\n  yarn add bcryptjs\n`.trim();\n\n/**\n * Load bcryptjs module\n */\nasync function loadBcryptjs() {\n  try {\n    Bcryptjs = await import(\"bcryptjs\");\n    isModuleExists = true;\n  } catch {\n    isModuleExists = false;\n  }\n}\n\nconst bcryptjsLoading = loadBcryptjs();\n\n/**\n * Hashes a password using bcrypt (async — does not block the event loop).\n *\n * Salt rounds are read from \\`encryption.password.saltRounds\\` config,\n * defaulting to 12.\n *\n * @example\n * import { hashPassword } from \"@warlock.js/core\";\n *\n * const hashed = await hashPassword(\"user-password-123\");\n * // Store \\`hashed\\` in the database\n */\nexport async function hashPassword(password: string): Promise<string> {\n  await bcryptjsLoading;\n\n  if (!isModuleExists) {\n    throw new Error(BCRYPTJS_INSTALL_INSTRUCTIONS);\n  }\n\n  const saltRounds = config.key<EncryptionPasswordConfigurations[\"salt\"]>(\n    \"encryption.password.salt\",\n    DEFAULT_SALT_ROUNDS,\n  )!;\n\n  return Bcryptjs.hash(String(password), saltRounds);\n}\n\n/**\n * Verifies a plain password against a bcrypt hash (async — does not block the event loop).\n *\n * @example\n * import { verifyPassword } from \"@warlock.js/core\";\n *\n * const isValid = await verifyPassword(\"user-password-123\", storedHash);\n */\nexport async function verifyPassword(\n  plainPassword: string,\n  hashedPassword: string,\n): Promise<boolean> {\n  await bcryptjsLoading;\n\n  if (!isModuleExists) {\n    throw new Error(BCRYPTJS_INSTALL_INSTRUCTIONS);\n  }\n\n  return Bcryptjs.compare(String(plainPassword), String(hashedPassword));\n}\n"],"mappings":";;;;;;;AAMA,MAAM,sBAAsB;;;;AAS5B,IAAI;AAEJ,IAAI,iBAAiC;;;;AAKrC,MAAM,gCAAgC;;;;;;;;;;;EAWpC,KAAK;;;;AAKP,eAAe,eAAe;CAC5B,IAAI;EACF,WAAW,MAAM,OAAO;EACxB,iBAAiB;CACnB,QAAQ;EACN,iBAAiB;CACnB;AACF;AAEA,MAAM,kBAAkB,aAAa;;;;;;;;;;;;;AAcrC,eAAsB,aAAa,UAAmC;CACpE,MAAM;CAEN,IAAI,CAAC,gBACH,MAAM,IAAI,MAAM,6BAA6B;CAG/C,MAAM,aAAa,OAAO,IACxB,4BACA,mBACF;CAEA,OAAO,SAAS,KAAK,OAAO,QAAQ,GAAG,UAAU;AACnD;;;;;;;;;AAUA,eAAsB,eACpB,eACA,gBACkB;CAClB,MAAM;CAEN,IAAI,CAAC,gBACH,MAAM,IAAI,MAAM,6BAA6B;CAG/C,OAAO,SAAS,QAAQ,OAAO,aAAa,GAAG,OAAO,cAAc,CAAC;AACvE"}

package/esm/encryption/types.d.mts

@@ -1,4 +1,4 @@
-//#region ../core/src/encryption/types.d.ts
+//#region ../../packages/core/src/encryption/types.d.ts
 /**
  * Configuration for the encryption module.
  *

package/esm/encryption/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../../core/src/encryption/types.ts"],"mappings":";;AAmBA;;;;;;;;;;AAyB6C;AAG7C;;;;AAKM;;;KAjCM,wBAAA;;;;;;EAMV,GAAA;;;;;EAMA,SAAA;;;;;;;EAQA,OAAA;;;;EAKA,QAAA,GAAW,gCAAgC;AAAA;AAAA,KAGjC,gCAAA;;;;;EAKV,IAAI;AAAA"}
+{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/encryption/types.ts"],"mappings":";;AAmBA;;;;;;;;;;AAyB6C;AAG7C;;;;AAKM;;;KAjCM,wBAAA;;;;;;EAMV,GAAA;;;;;EAMA,SAAA;;;;;;;EAQA,OAAA;;;;EAKA,QAAA,GAAW,gCAAgC;AAAA;AAAA,KAGjC,gCAAA;;;;;EAKV,IAAI;AAAA"}

package/esm/errors/container-key-missing-error.mjs

@@ -1,4 +1,4 @@
-//#region ../core/src/errors/container-key-missing-error.ts
+//#region ../../packages/core/src/errors/container-key-missing-error.ts
 /**
 * Maximum number of registered keys named in a {@link ContainerKeyMissingError}
 * message. Bounded so a container with hundreds of registrations doesn't

package/esm/errors/container-key-missing-error.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"container-key-missing-error.mjs","names":[],"sources":["../../../../../../../core/src/errors/container-key-missing-error.ts"],"sourcesContent":["/**\n * Maximum number of registered keys named in a {@link ContainerKeyMissingError}\n * message. Bounded so a container with hundreds of registrations doesn't\n * turn a diagnostic message into a wall of text.\n */\nconst MAX_LISTED_KEYS = 20;\n\n/**\n * Thrown by `container.get(key)` when `key` is not registered.\n *\n * On a single-instance runtime this is an ordinary \"you forgot to register\n * this\" error, worded exactly as before. When more than one copy of\n * `@warlock.js/core`'s container module is loaded in the same process —\n * confirmed via `container-instance-registry.ts`, which every loaded copy\n * registers itself into through `globalThis` — the miss may instead mean\n * the value WAS set, just on the other instance. That is a dev/\n * source-consumption condition only: a published install resolves to a\n * single `node_modules` copy, so a single instance is always registered\n * there.\n */\nexport class ContainerKeyMissingError extends Error {\n  public constructor(key: string, instanceCount: number, registeredKeys: readonly string[] = []) {\n    super(ContainerKeyMissingError.buildMessage(key, instanceCount, registeredKeys));\n    this.name = \"ContainerKeyMissingError\";\n  }\n\n  private static buildMessage(\n    key: string,\n    instanceCount: number,\n    registeredKeys: readonly string[],\n  ): string {\n    const base =\n      instanceCount <= 1\n        ? `Container key \"${key}\" is not registered.`\n        : `Container key \"${key}\" is not registered on this instance, but ${instanceCount} ` +\n          `separate copies of @warlock.js/core's container are currently loaded in this ` +\n          `process. The value may have been set on one of the other instances, not this ` +\n          `one — this happens when a source-consumption dev path (e.g. Vite's SSR module ` +\n          `runner alongside Node's ESM loader) evaluates the package more than once. A ` +\n          `published install resolves to a single copy and is not affected.`;\n\n    return `${base} ${ContainerKeyMissingError.describeRegisteredKeys(registeredKeys)}`;\n  }\n\n  private static describeRegisteredKeys(registeredKeys: readonly string[]): string {\n    if (registeredKeys.length === 0) {\n      return \"No keys are registered.\";\n    }\n\n    const listed = registeredKeys.slice(0, MAX_LISTED_KEYS);\n    const remaining = registeredKeys.length - listed.length;\n    const suffix = remaining > 0 ? `, and ${remaining} more` : \"\";\n\n    return `Registered keys: ${listed.map((registeredKey) => `\"${registeredKey}\"`).join(\", \")}${suffix}.`;\n  }\n}\n"],"mappings":";;;;;;AAKA,MAAM,kBAAkB;;;;;;;;;;;;;;AAexB,IAAa,2BAAb,MAAa,iCAAiC,MAAM;CAClD,AAAO,YAAY,KAAa,eAAuB,iBAAoC,CAAC,GAAG;EAC7F,MAAM,yBAAyB,aAAa,KAAK,eAAe,cAAc,CAAC;EAC/E,KAAK,OAAO;CACd;CAEA,OAAe,aACb,KACA,eACA,gBACQ;EAWR,OAAO,GATL,iBAAiB,IACb,kBAAkB,IAAI,wBACtB,kBAAkB,IAAI,4CAA4C,cAAc,uXAOvE,GAAG,yBAAyB,uBAAuB,cAAc;CAClF;CAEA,OAAe,uBAAuB,gBAA2C;EAC/E,IAAI,eAAe,WAAW,GAC5B,OAAO;EAGT,MAAM,SAAS,eAAe,MAAM,GAAG,eAAe;EACtD,MAAM,YAAY,eAAe,SAAS,OAAO;EACjD,MAAM,SAAS,YAAY,IAAI,SAAS,UAAU,SAAS;EAE3D,OAAO,oBAAoB,OAAO,KAAK,kBAAkB,IAAI,cAAc,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO;CACrG;AACF"}
+{"version":3,"file":"container-key-missing-error.mjs","names":[],"sources":["../../../../../../../../packages/core/src/errors/container-key-missing-error.ts"],"sourcesContent":["/**\n * Maximum number of registered keys named in a {@link ContainerKeyMissingError}\n * message. Bounded so a container with hundreds of registrations doesn't\n * turn a diagnostic message into a wall of text.\n */\nconst MAX_LISTED_KEYS = 20;\n\n/**\n * Thrown by `container.get(key)` when `key` is not registered.\n *\n * On a single-instance runtime this is an ordinary \"you forgot to register\n * this\" error, worded exactly as before. When more than one copy of\n * `@warlock.js/core`'s container module is loaded in the same process —\n * confirmed via `container-instance-registry.ts`, which every loaded copy\n * registers itself into through `globalThis` — the miss may instead mean\n * the value WAS set, just on the other instance. That is a dev/\n * source-consumption condition only: a published install resolves to a\n * single `node_modules` copy, so a single instance is always registered\n * there.\n */\nexport class ContainerKeyMissingError extends Error {\n  public constructor(key: string, instanceCount: number, registeredKeys: readonly string[] = []) {\n    super(ContainerKeyMissingError.buildMessage(key, instanceCount, registeredKeys));\n    this.name = \"ContainerKeyMissingError\";\n  }\n\n  private static buildMessage(\n    key: string,\n    instanceCount: number,\n    registeredKeys: readonly string[],\n  ): string {\n    const base =\n      instanceCount <= 1\n        ? `Container key \"${key}\" is not registered.`\n        : `Container key \"${key}\" is not registered on this instance, but ${instanceCount} ` +\n          `separate copies of @warlock.js/core's container are currently loaded in this ` +\n          `process. The value may have been set on one of the other instances, not this ` +\n          `one — this happens when a source-consumption dev path (e.g. Vite's SSR module ` +\n          `runner alongside Node's ESM loader) evaluates the package more than once. A ` +\n          `published install resolves to a single copy and is not affected.`;\n\n    return `${base} ${ContainerKeyMissingError.describeRegisteredKeys(registeredKeys)}`;\n  }\n\n  private static describeRegisteredKeys(registeredKeys: readonly string[]): string {\n    if (registeredKeys.length === 0) {\n      return \"No keys are registered.\";\n    }\n\n    const listed = registeredKeys.slice(0, MAX_LISTED_KEYS);\n    const remaining = registeredKeys.length - listed.length;\n    const suffix = remaining > 0 ? `, and ${remaining} more` : \"\";\n\n    return `Registered keys: ${listed.map((registeredKey) => `\"${registeredKey}\"`).join(\", \")}${suffix}.`;\n  }\n}\n"],"mappings":";;;;;;AAKA,MAAM,kBAAkB;;;;;;;;;;;;;;AAexB,IAAa,2BAAb,MAAa,iCAAiC,MAAM;CAClD,AAAO,YAAY,KAAa,eAAuB,iBAAoC,CAAC,GAAG;EAC7F,MAAM,yBAAyB,aAAa,KAAK,eAAe,cAAc,CAAC;EAC/E,KAAK,OAAO;CACd;CAEA,OAAe,aACb,KACA,eACA,gBACQ;EAWR,OAAO,GATL,iBAAiB,IACb,kBAAkB,IAAI,wBACtB,kBAAkB,IAAI,4CAA4C,cAAc,uXAOvE,GAAG,yBAAyB,uBAAuB,cAAc;CAClF;CAEA,OAAe,uBAAuB,gBAA2C;EAC/E,IAAI,eAAe,WAAW,GAC5B,OAAO;EAGT,MAAM,SAAS,eAAe,MAAM,GAAG,eAAe;EACtD,MAAM,YAAY,eAAe,SAAS,OAAO;EACjD,MAAM,SAAS,YAAY,IAAI,SAAS,UAAU,SAAS;EAE3D,OAAO,oBAAoB,OAAO,KAAK,kBAAkB,IAAI,cAAc,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO;CACrG;AACF"}

package/esm/errors/esbuild-binary-missing-error.mjs

@@ -1,4 +1,4 @@
-//#region ../core/src/errors/esbuild-binary-missing-error.ts
+//#region ../../packages/core/src/errors/esbuild-binary-missing-error.ts
 /**
 * Raised when `warlock dev` / `warlock build` cannot use esbuild because its
 * platform-native binary was never installed or linked.

package/esm/errors/esbuild-binary-missing-error.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"esbuild-binary-missing-error.mjs","names":[],"sources":["../../../../../../../core/src/errors/esbuild-binary-missing-error.ts"],"sourcesContent":["/**\n * Raised when `warlock dev` / `warlock build` cannot use esbuild because its\n * platform-native binary was never installed or linked.\n *\n * The message names what is missing and the exact fix — reinstall with the\n * package manager without skipping install scripts — so the failure is\n * actionable at the point it is thrown, instead of surfacing later as an\n * opaque low-level error from deep inside the bundler.\n */\nexport class EsbuildBinaryMissingError extends Error {\n  public constructor(options?: { cause?: unknown }) {\n    super(\n      \"esbuild's native binary is not installed or linked for this platform, so \" +\n        \"`warlock dev` / `warlock build` cannot run.\\n\\n\" +\n        \"This usually happens when a platform package such as `@esbuild/win32-x64` \" +\n        \"was never installed, or the package manager skipped esbuild's postinstall \" +\n        \"script that links it. Fix it with:\\n\\n\" +\n        \"  pnpm approve-builds\\n\\n\" +\n        \"then reinstall dependencies (do not skip install scripts), \" +\n        \"or reinstall with your package manager's equivalent of allowing build scripts.\",\n      options,\n    );\n\n    this.name = \"EsbuildBinaryMissingError\";\n  }\n}\n"],"mappings":";;;;;;;;;;AASA,IAAa,4BAAb,cAA+C,MAAM;CACnD,AAAO,YAAY,SAA+B;EAChD,MACE,wdAQA,OACF;EAEA,KAAK,OAAO;CACd;AACF"}
+{"version":3,"file":"esbuild-binary-missing-error.mjs","names":[],"sources":["../../../../../../../../packages/core/src/errors/esbuild-binary-missing-error.ts"],"sourcesContent":["/**\n * Raised when `warlock dev` / `warlock build` cannot use esbuild because its\n * platform-native binary was never installed or linked.\n *\n * The message names what is missing and the exact fix — reinstall with the\n * package manager without skipping install scripts — so the failure is\n * actionable at the point it is thrown, instead of surfacing later as an\n * opaque low-level error from deep inside the bundler.\n */\nexport class EsbuildBinaryMissingError extends Error {\n  public constructor(options?: { cause?: unknown }) {\n    super(\n      \"esbuild's native binary is not installed or linked for this platform, so \" +\n        \"`warlock dev` / `warlock build` cannot run.\\n\\n\" +\n        \"This usually happens when a platform package such as `@esbuild/win32-x64` \" +\n        \"was never installed, or the package manager skipped esbuild's postinstall \" +\n        \"script that links it. Fix it with:\\n\\n\" +\n        \"  pnpm approve-builds\\n\\n\" +\n        \"then reinstall dependencies (do not skip install scripts), \" +\n        \"or reinstall with your package manager's equivalent of allowing build scripts.\",\n      options,\n    );\n\n    this.name = \"EsbuildBinaryMissingError\";\n  }\n}\n"],"mappings":";;;;;;;;;;AASA,IAAa,4BAAb,cAA+C,MAAM;CACnD,AAAO,YAAY,SAA+B;EAChD,MACE,wdAQA,OACF;EAEA,KAAK,OAAO;CACd;AACF"}

package/esm/errors/index.d.mts

@@ -0,0 +1,2 @@
+import { BadRequestError, ConflictError, CookieJarUnavailableError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, ResourceNotFoundError, ServerError, UnAuthorizedError } from "../http/errors/errors.mjs";
+export { BadRequestError, ConflictError, CookieJarUnavailableError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, ResourceNotFoundError, ServerError, UnAuthorizedError };

package/esm/errors/index.mjs

@@ -0,0 +1,3 @@
+import { BadRequestError, ConflictError, CookieJarUnavailableError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, ResourceNotFoundError, ServerError, UnAuthorizedError } from "../http/errors/errors.mjs";
+
+export { BadRequestError, ConflictError, CookieJarUnavailableError, ForbiddenError, HttpError, NotAcceptableError, NotAllowedError, ResourceNotFoundError, ServerError, UnAuthorizedError };

package/esm/errors/unknown-locale-error.mjs

@@ -1,4 +1,4 @@
-//#region ../core/src/errors/unknown-locale-error.ts
+//#region ../../packages/core/src/errors/unknown-locale-error.ts
 /**
 * Thrown by `response.setLocale(locale)` when `locale` is outside the
 * application's declared `app.localeCodes` allow-list.

package/esm/errors/unknown-locale-error.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"unknown-locale-error.mjs","names":[],"sources":["../../../../../../../core/src/errors/unknown-locale-error.ts"],"sourcesContent":["/**\n * Thrown by `response.setLocale(locale)` when `locale` is outside the\n * application's declared `app.localeCodes` allow-list.\n *\n * Silently writing a locale cookie for a locale the app cannot serve is a\n * NEW silent failure — `request.locale` would read the cookie back, fail its\n * own allow-list check (`Request.cacheLocale`), and fall back to the default\n * with nothing telling the caller why the switch never took. Failing here,\n * at the write, names the mistake at its source instead of downstream.\n *\n * Only raised when `app.localeCodes` is declared — with no list declared\n * there is nothing to fail against, matching `Request.cacheLocale`'s own\n * fail-open rule.\n */\nexport class UnknownLocaleError extends Error {\n  public constructor(locale: string, localeCodes: string[]) {\n    super(UnknownLocaleError.buildMessage(locale, localeCodes));\n    this.name = \"UnknownLocaleError\";\n  }\n\n  private static buildMessage(locale: string, localeCodes: string[]): string {\n    return (\n      `Cannot set locale \"${locale}\": it is not in the configured \"app.localeCodes\" list ` +\n      `(${localeCodes.map((code) => `\"${code}\"`).join(\", \")}). Add \"${locale}\" to ` +\n      `\"app.localeCodes\" or pass one of the configured locales instead.`\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAcA,IAAa,qBAAb,MAAa,2BAA2B,MAAM;CAC5C,AAAO,YAAY,QAAgB,aAAuB;EACxD,MAAM,mBAAmB,aAAa,QAAQ,WAAW,CAAC;EAC1D,KAAK,OAAO;CACd;CAEA,OAAe,aAAa,QAAgB,aAA+B;EACzE,OACE,sBAAsB,OAAO,yDACzB,YAAY,KAAK,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,UAAU,OAAO;CAG3E;AACF"}
+{"version":3,"file":"unknown-locale-error.mjs","names":[],"sources":["../../../../../../../../packages/core/src/errors/unknown-locale-error.ts"],"sourcesContent":["/**\n * Thrown by `response.setLocale(locale)` when `locale` is outside the\n * application's declared `app.localeCodes` allow-list.\n *\n * Silently writing a locale cookie for a locale the app cannot serve is a\n * NEW silent failure — `request.locale` would read the cookie back, fail its\n * own allow-list check (`Request.cacheLocale`), and fall back to the default\n * with nothing telling the caller why the switch never took. Failing here,\n * at the write, names the mistake at its source instead of downstream.\n *\n * Only raised when `app.localeCodes` is declared — with no list declared\n * there is nothing to fail against, matching `Request.cacheLocale`'s own\n * fail-open rule.\n */\nexport class UnknownLocaleError extends Error {\n  public constructor(locale: string, localeCodes: string[]) {\n    super(UnknownLocaleError.buildMessage(locale, localeCodes));\n    this.name = \"UnknownLocaleError\";\n  }\n\n  private static buildMessage(locale: string, localeCodes: string[]): string {\n    return (\n      `Cannot set locale \"${locale}\": it is not in the configured \"app.localeCodes\" list ` +\n      `(${localeCodes.map((code) => `\"${code}\"`).join(\", \")}). Add \"${locale}\" to ` +\n      `\"app.localeCodes\" or pass one of the configured locales instead.`\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAcA,IAAa,qBAAb,MAAa,2BAA2B,MAAM;CAC5C,AAAO,YAAY,QAAgB,aAAuB;EACxD,MAAM,mBAAmB,aAAa,QAAQ,WAAW,CAAC;EAC1D,KAAK,OAAO;CACd;CAEA,OAAe,aAAa,QAAgB,aAA+B;EACzE,OACE,sBAAsB,OAAO,yDACzB,YAAY,KAAK,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,UAAU,OAAO;CAG3E;AACF"}

package/esm/generations/add-command.action.mjs

@@ -3,12 +3,12 @@ import "../utils/index.mjs";
 import { getWarlockVersion } from "../utils/framework-vesion.mjs";
 import { detectPackageManager, getAddCommand, getExactAddCommand } from "../updater/package-manager.mjs";
 import { featuresMap } from "./features/index.mjs";
-import { mergePnpmSharpApproval } from "./pnpm-build-approvals.mjs";
+import { getPnpmVersion, isInsideParentPnpmWorkspace, mergeOnlyBuiltDependencies, mergePackageJsonBuildApprovals, mergePnpmSharpApproval, pnpmBuildApprovalLayout } from "./pnpm-build-approvals.mjs";
 import { colors } from "@mongez/copper";
 import { fileExistsAsync, getFileAsync, getJsonFileAsync, putFileAsync, putJsonFileAsync } from "@warlock.js/fs";
 import { execSync } from "node:child_process";
 
-//#region ../core/src/generations/add-command.action.ts
+//#region ../../packages/core/src/generations/add-command.action.ts
 const allowedFeatures = Object.keys(featuresMap);
 function isWarlockPackage(packageName) {
 	return packageName.startsWith("@warlock.js/");
@@ -75,10 +75,7 @@ async function addCommandAction(options) {
 	}
 	if (noInstall) await recordDependencies(dependencies, devDependencies);
 	else {
-		if ((packageManager ?? await detectPackageManager()) === "pnpm" && dependencies.sharp !== void 0) {
-			const workspacePath = rootPath("pnpm-workspace.yaml");
-			await putFileAsync(workspacePath, mergePnpmSharpApproval(await fileExistsAsync(workspacePath) ? await getFileAsync(workspacePath) : ""));
-		}
+		if ((packageManager ?? await detectPackageManager()) === "pnpm" && dependencies.sharp !== void 0) await approvePnpmSharpBuild();
 		await installDependencies(packageManager, dependencies, devDependencies);
 	}
 	for (const [name, config] of Object.entries(ejectConfigs)) {
@@ -107,6 +104,32 @@ async function addCommandAction(options) {
 	}
 }
 /**
+* Let pnpm run sharp's install script, written where the INSTALLED pnpm reads
+* approvals (see `pnpmBuildApprovalLayout`). pnpm 9 and 10.0–10.4 reject a
+* settings-only `pnpm-workspace.yaml`, so for them the approval goes into
+* package.json and no workspace file is created.
+*
+* An app inside a parent pnpm workspace gets no per-app policy: the parent's
+* workspace owns it, and a nested workspace file would make a second root.
+*/
+async function approvePnpmSharpBuild() {
+	const workspacePath = rootPath("pnpm-workspace.yaml");
+	const hasWorkspaceFile = await fileExistsAsync(workspacePath);
+	if (!hasWorkspaceFile && isInsideParentPnpmWorkspace(rootPath())) {
+		console.log(`${colors.yellowBright("sharp")} needs its install script approved in the parent pnpm workspace's settings.`);
+		return;
+	}
+	const layout = pnpmBuildApprovalLayout(getPnpmVersion(rootPath()));
+	if (layout === "packageJson") {
+		const packageJsonPath = rootPath("package.json");
+		await putJsonFileAsync(packageJsonPath, mergePackageJsonBuildApprovals(await getJsonFileAsync(packageJsonPath), ["sharp"]));
+		return;
+	}
+	const current = hasWorkspaceFile ? await getFileAsync(workspacePath) : "";
+	const updated = layout === "onlyBuiltDependencies" ? mergeOnlyBuiltDependencies(current, ["sharp"]) : mergePnpmSharpApproval(current);
+	if (updated !== current) await putFileAsync(workspacePath, updated);
+}
+/**
 * Install the resolved dependency sets through the project's package manager.
 * Runs two passes (prod then dev) so each lands in the correct section.
 */

package/esm/generations/add-command.action.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"add-command.action.mjs","names":[],"sources":["../../../../../../../core/src/generations/add-command.action.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\nimport {\n  fileExistsAsync,\n  getFileAsync,\n  getJsonFileAsync,\n  putFileAsync,\n  putJsonFileAsync,\n} from \"@warlock.js/fs\";\nimport { execSync } from \"node:child_process\";\nimport type { CommandActionData } from \"../commands/types\";\nimport {\n  detectPackageManager,\n  getAddCommand,\n  getExactAddCommand,\n  type PackageManager,\n} from \"../updater/package-manager\";\nimport { rootPath, srcPath } from \"../utils\";\nimport { getWarlockVersion } from \"../utils/framework-vesion\";\nimport { featuresMap } from \"./features\";\nimport { mergePnpmSharpApproval } from \"./pnpm-build-approvals\";\n\nexport { featuresMap };\nexport type { FeatureDefinition } from \"./features\";\n\n/**\n * The parts of a project `package.json` this action reads or writes. Deliberately\n * partial — it describes what we touch, not the whole manifest.\n */\ntype ProjectPackageJson = {\n  dependencies?: Record<string, string>;\n  devDependencies?: Record<string, string>;\n  scripts?: Record<string, string>;\n};\n\nexport const allowedFeatures = Object.keys(featuresMap);\n\nfunction isWarlockPackage(packageName: string): boolean {\n  return packageName.startsWith(\"@warlock.js/\");\n}\n\n/**\n * Resolve the internal feature-map placeholder to the version of Core that is\n * actually executing the command. Every @warlock.js package is lockstep, so\n * Core is the single source of truth; non-Warlock dependencies are untouched.\n */\nexport function resolveWarlockDependencyVersions(\n  dependencies: Record<string, string>,\n  frameworkVersion: string,\n): void {\n  for (const dependency of Object.keys(dependencies)) {\n    if (isWarlockPackage(dependency)) {\n      dependencies[dependency] = frameworkVersion;\n    }\n  }\n}\n\nfunction resolveFeatures(features: string[], visited = new Set<string>()): string[] {\n  const resolved: string[] = [];\n\n  for (const feature of features) {\n    if (visited.has(feature)) continue;\n    visited.add(feature);\n\n    const def = featuresMap[feature];\n\n    // `addCommandAction` runs `validateFeatures()` before calling this, and the\n    // recursive calls below pass `requires` entries that come out of the map\n    // itself — so every lookup resolves. Skipping an unresolvable one keeps a\n    // typo from crashing the command with `Cannot read properties of\n    // undefined`, which names neither the feature nor the fact that it was the\n    // ARGUMENT that was wrong.\n    if (def === undefined) continue;\n\n    if (def.requires?.length) {\n      resolved.push(...resolveFeatures(def.requires, visited));\n    }\n\n    resolved.push(feature);\n  }\n\n  return resolved;\n}\n\nexport async function addCommandAction(options: CommandActionData) {\n  const features = options.args;\n  const { packageManager, list, noInstall } = options.options;\n\n  if (list) {\n    console.log(\"Available Features:\");\n\n    for (const feature of allowedFeatures) {\n      const definition = featuresMap[feature];\n\n      // `allowedFeatures` is derived from this same map, so this resolves.\n      if (definition === undefined) continue;\n\n      console.log(`- ${colors.yellowBright(feature)}: ${colors.green(definition.description)}`);\n    }\n\n    process.exit(0);\n  }\n\n  validateFeatures(features);\n\n  const resolvedFeatures = resolveFeatures(features);\n\n  const dependencies: Record<string, string> = {};\n  const devDependencies: Record<string, string> = {};\n  const ejectConfigs: Record<string, { content: string; name: string }> = {};\n  const scripts: Record<string, string> = {};\n\n  for (const feature of resolvedFeatures) {\n    const featurePackages = featuresMap[feature as keyof typeof featuresMap];\n\n    // Validated upstream; see the note in resolveFeatures above.\n    if (featurePackages === undefined) continue;\n\n    Object.assign(dependencies, featurePackages.dependencies);\n    if (featurePackages.devDependencies) {\n      Object.assign(devDependencies, featurePackages.devDependencies);\n    }\n\n    if (featurePackages.ejectConfig) {\n      ejectConfigs[featurePackages.ejectConfig.name] = featurePackages.ejectConfig;\n    }\n\n    if (featurePackages.script) {\n      Object.assign(scripts, featurePackages.script);\n    }\n  }\n\n  // Pin every @warlock.js/* feature package to the INSTALLED framework version so\n  // a scaffolded project's features match its core version instead of drifting to\n  // the feature map's static range.\n  const frameworkVersion = await getWarlockVersion();\n  resolveWarlockDependencyVersions(dependencies, frameworkVersion);\n  resolveWarlockDependencyVersions(devDependencies, frameworkVersion);\n\n  const currentPackageJson = await getJsonFileAsync<ProjectPackageJson>(rootPath(\"package.json\"));\n\n  // Fresh templates may omit one of the maps — guard before reading.\n  currentPackageJson.dependencies = currentPackageJson.dependencies ?? {};\n  currentPackageJson.devDependencies = currentPackageJson.devDependencies ?? {};\n\n  // Skip anything already present so we never downgrade an existing pin.\n  for (const dependency of Object.keys(dependencies)) {\n    if (currentPackageJson.dependencies[dependency]) {\n      console.log(`${colors.yellowBright(dependency)} is already installed, skipping...`);\n      delete dependencies[dependency];\n    }\n  }\n\n  for (const devDependency of Object.keys(devDependencies)) {\n    if (currentPackageJson.devDependencies[devDependency]) {\n      console.log(`${colors.yellowBright(devDependency)} is already installed, skipping...`);\n      delete devDependencies[devDependency];\n    }\n  }\n\n  if (noInstall) {\n    await recordDependencies(dependencies, devDependencies);\n  } else {\n    const resolvedPackageManager =\n      (packageManager as PackageManager | undefined) ?? (await detectPackageManager());\n    if (resolvedPackageManager === \"pnpm\" && dependencies.sharp !== undefined) {\n      const workspacePath = rootPath(\"pnpm-workspace.yaml\");\n      const current = (await fileExistsAsync(workspacePath))\n        ? await getFileAsync(workspacePath)\n        : \"\";\n      await putFileAsync(workspacePath, mergePnpmSharpApproval(current));\n    }\n    await installDependencies(\n      packageManager as PackageManager | undefined,\n      dependencies,\n      devDependencies,\n    );\n  }\n\n  for (const [name, config] of Object.entries(ejectConfigs)) {\n    if (await fileExistsAsync(srcPath(`config/${name}.ts`))) {\n      console.log(`${colors.yellowBright(name)} config already exists, skipping...`);\n      continue;\n    }\n\n    console.log(`Creating ${colors.magenta(name)} config...`);\n\n    await putFileAsync(srcPath(`config/${name}.ts`), config.content);\n\n    console.log(`${colors.green(name)} config created successfully`);\n  }\n\n  // now loop again over features to execute onExecuting\n  for (const feature of resolvedFeatures) {\n    const featurePackages = featuresMap[feature as keyof typeof featuresMap];\n\n    if (featurePackages?.onExecuting) {\n      await featurePackages.onExecuting(options);\n    }\n  }\n\n  if (Object.keys(scripts).length > 0) {\n    console.log(`Adding scripts ${colors.magenta(Object.keys(scripts).join(\", \"))}`);\n    const packageJsonPath = rootPath(\"package.json\");\n    const packageJson = await getJsonFileAsync<ProjectPackageJson>(packageJsonPath);\n    packageJson.scripts = { ...(packageJson.scripts ?? {}), ...scripts };\n    await putJsonFileAsync(packageJsonPath, packageJson);\n\n    console.log(`Scripts added successfully ${colors.green(Object.keys(scripts).join(\", \"))}`);\n  }\n}\n\n/**\n * Install the resolved dependency sets through the project's package manager.\n * Runs two passes (prod then dev) so each lands in the correct section.\n */\nexport async function installDependencies(\n  packageManager: PackageManager | undefined,\n  dependencies: Record<string, string>,\n  devDependencies: Record<string, string>,\n  exec: (command: string, options: { cwd: string; stdio: \"inherit\" }) => unknown = execSync,\n) {\n  // `--package-manager` is optional; without it, fall back to the lockfile.\n  const resolvedPackageManager = packageManager ?? (await detectPackageManager());\n  const packageManagerCommand = getAddCommand(resolvedPackageManager);\n  const exactPackageManagerCommand = getExactAddCommand(resolvedPackageManager);\n\n  const installDependencySet = (dependencySet: Record<string, string>, development: boolean) => {\n    const regularSpecs: string[] = [];\n    const exactWarlockSpecs: string[] = [];\n\n    for (const [name, version] of Object.entries(dependencySet)) {\n      const spec = `${name}@${version}`;\n      (isWarlockPackage(name) ? exactWarlockSpecs : regularSpecs).push(spec);\n    }\n\n    const developmentFlag = development ? \" -D\" : \"\";\n    const runInstall = (command: string, specs: string[]) => {\n      if (specs.length === 0) return;\n\n      exec(`${command} ${specs.join(\" \")}${developmentFlag}`, {\n        cwd: process.cwd(),\n        stdio: \"inherit\",\n      });\n    };\n\n    runInstall(packageManagerCommand, regularSpecs);\n    runInstall(exactPackageManagerCommand, exactWarlockSpecs);\n  };\n\n  if (Object.keys(dependencies).length > 0) {\n    console.log(`Installing dependencies ${colors.magenta(Object.keys(dependencies).join(\", \"))}`);\n\n    installDependencySet(dependencies, false);\n\n    console.log(\n      `Dependencies installed successfully ${colors.green(Object.keys(dependencies).join(\", \"))}`,\n    );\n  }\n\n  if (Object.keys(devDependencies).length > 0) {\n    console.log(\n      `Installing dev dependencies ${colors.magenta(Object.keys(devDependencies).join(\", \"))}`,\n    );\n\n    installDependencySet(devDependencies, true);\n\n    console.log(\n      `Dev dependencies installed successfully ${colors.green(Object.keys(devDependencies).join(\", \"))}`,\n    );\n  }\n}\n\n/**\n * Write the resolved dependency sets into package.json without installing.\n * Used by `--no-install` so a scaffolder can batch every feature into one\n * install pass after the command returns. Versions come from the feature map.\n */\nasync function recordDependencies(\n  dependencies: Record<string, string>,\n  devDependencies: Record<string, string>,\n) {\n  if (Object.keys(dependencies).length === 0 && Object.keys(devDependencies).length === 0) {\n    return;\n  }\n\n  const packageJsonPath = rootPath(\"package.json\");\n  const packageJson = await getJsonFileAsync<ProjectPackageJson>(packageJsonPath);\n\n  packageJson.dependencies = packageJson.dependencies ?? {};\n  packageJson.devDependencies = packageJson.devDependencies ?? {};\n\n  Object.assign(packageJson.dependencies, dependencies);\n  Object.assign(packageJson.devDependencies, devDependencies);\n\n  await putJsonFileAsync(packageJsonPath, packageJson);\n\n  const recorded = [...Object.keys(dependencies), ...Object.keys(devDependencies)];\n\n  console.log(\n    `Recorded ${colors.green(recorded.join(\", \"))} in package.json (install skipped via --no-install)`,\n  );\n}\n\nfunction validateFeatures(features: string[]) {\n  for (const feature of features) {\n    if (!allowedFeatures.includes(feature)) {\n      console.log(\n        `Feature ${colors.redBright(feature)} is not allowed, allowed features are: ${colors.green(allowedFeatures.join(\", \"))}`,\n      );\n      process.exit(1);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;AAkCA,MAAa,kBAAkB,OAAO,KAAK,WAAW;AAEtD,SAAS,iBAAiB,aAA8B;CACtD,OAAO,YAAY,WAAW,cAAc;AAC9C;;;;;;AAOA,SAAgB,iCACd,cACA,kBACM;CACN,KAAK,MAAM,cAAc,OAAO,KAAK,YAAY,GAC/C,IAAI,iBAAiB,UAAU,GAC7B,aAAa,cAAc;AAGjC;AAEA,SAAS,gBAAgB,UAAoB,0BAAU,IAAI,IAAY,GAAa;CAClF,MAAM,WAAqB,CAAC;CAE5B,KAAK,MAAM,WAAW,UAAU;EAC9B,IAAI,QAAQ,IAAI,OAAO,GAAG;EAC1B,QAAQ,IAAI,OAAO;EAEnB,MAAM,MAAM,YAAY;EAQxB,IAAI,QAAQ,QAAW;EAEvB,IAAI,IAAI,UAAU,QAChB,SAAS,KAAK,GAAG,gBAAgB,IAAI,UAAU,OAAO,CAAC;EAGzD,SAAS,KAAK,OAAO;CACvB;CAEA,OAAO;AACT;AAEA,eAAsB,iBAAiB,SAA4B;CACjE,MAAM,WAAW,QAAQ;CACzB,MAAM,EAAE,gBAAgB,MAAM,cAAc,QAAQ;CAEpD,IAAI,MAAM;EACR,QAAQ,IAAI,qBAAqB;EAEjC,KAAK,MAAM,WAAW,iBAAiB;GACrC,MAAM,aAAa,YAAY;GAG/B,IAAI,eAAe,QAAW;GAE9B,QAAQ,IAAI,KAAK,OAAO,aAAa,OAAO,EAAE,IAAI,OAAO,MAAM,WAAW,WAAW,GAAG;EAC1F;EAEA,QAAQ,KAAK,CAAC;CAChB;CAEA,iBAAiB,QAAQ;CAEzB,MAAM,mBAAmB,gBAAgB,QAAQ;CAEjD,MAAM,eAAuC,CAAC;CAC9C,MAAM,kBAA0C,CAAC;CACjD,MAAM,eAAkE,CAAC;CACzE,MAAM,UAAkC,CAAC;CAEzC,KAAK,MAAM,WAAW,kBAAkB;EACtC,MAAM,kBAAkB,YAAY;EAGpC,IAAI,oBAAoB,QAAW;EAEnC,OAAO,OAAO,cAAc,gBAAgB,YAAY;EACxD,IAAI,gBAAgB,iBAClB,OAAO,OAAO,iBAAiB,gBAAgB,eAAe;EAGhE,IAAI,gBAAgB,aAClB,aAAa,gBAAgB,YAAY,QAAQ,gBAAgB;EAGnE,IAAI,gBAAgB,QAClB,OAAO,OAAO,SAAS,gBAAgB,MAAM;CAEjD;CAKA,MAAM,mBAAmB,MAAM,kBAAkB;CACjD,iCAAiC,cAAc,gBAAgB;CAC/D,iCAAiC,iBAAiB,gBAAgB;CAElE,MAAM,qBAAqB,MAAM,iBAAqC,SAAS,cAAc,CAAC;CAG9F,mBAAmB,eAAe,mBAAmB,gBAAgB,CAAC;CACtE,mBAAmB,kBAAkB,mBAAmB,mBAAmB,CAAC;CAG5E,KAAK,MAAM,cAAc,OAAO,KAAK,YAAY,GAC/C,IAAI,mBAAmB,aAAa,aAAa;EAC/C,QAAQ,IAAI,GAAG,OAAO,aAAa,UAAU,EAAE,mCAAmC;EAClF,OAAO,aAAa;CACtB;CAGF,KAAK,MAAM,iBAAiB,OAAO,KAAK,eAAe,GACrD,IAAI,mBAAmB,gBAAgB,gBAAgB;EACrD,QAAQ,IAAI,GAAG,OAAO,aAAa,aAAa,EAAE,mCAAmC;EACrF,OAAO,gBAAgB;CACzB;CAGF,IAAI,WACF,MAAM,mBAAmB,cAAc,eAAe;MACjD;EAGL,KADG,kBAAkD,MAAM,qBAAqB,OACjD,UAAU,aAAa,UAAU,QAAW;GACzE,MAAM,gBAAgB,SAAS,qBAAqB;GAIpD,MAAM,aAAa,eAAe,uBAHjB,MAAM,gBAAgB,aAAa,IAChD,MAAM,aAAa,aAAa,IAChC,EAC4D,CAAC;EACnE;EACA,MAAM,oBACJ,gBACA,cACA,eACF;CACF;CAEA,KAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,YAAY,GAAG;EACzD,IAAI,MAAM,gBAAgB,QAAQ,UAAU,KAAK,IAAI,CAAC,GAAG;GACvD,QAAQ,IAAI,GAAG,OAAO,aAAa,IAAI,EAAE,oCAAoC;GAC7E;EACF;EAEA,QAAQ,IAAI,YAAY,OAAO,QAAQ,IAAI,EAAE,WAAW;EAExD,MAAM,aAAa,QAAQ,UAAU,KAAK,IAAI,GAAG,OAAO,OAAO;EAE/D,QAAQ,IAAI,GAAG,OAAO,MAAM,IAAI,EAAE,6BAA6B;CACjE;CAGA,KAAK,MAAM,WAAW,kBAAkB;EACtC,MAAM,kBAAkB,YAAY;EAEpC,IAAI,iBAAiB,aACnB,MAAM,gBAAgB,YAAY,OAAO;CAE7C;CAEA,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,GAAG;EACnC,QAAQ,IAAI,kBAAkB,OAAO,QAAQ,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG;EAC/E,MAAM,kBAAkB,SAAS,cAAc;EAC/C,MAAM,cAAc,MAAM,iBAAqC,eAAe;EAC9E,YAAY,UAAU;GAAE,GAAI,YAAY,WAAW,CAAC;GAAI,GAAG;EAAQ;EACnE,MAAM,iBAAiB,iBAAiB,WAAW;EAEnD,QAAQ,IAAI,8BAA8B,OAAO,MAAM,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG;CAC3F;AACF;;;;;AAMA,eAAsB,oBACpB,gBACA,cACA,iBACA,OAAiF,UACjF;CAEA,MAAM,yBAAyB,kBAAmB,MAAM,qBAAqB;CAC7E,MAAM,wBAAwB,cAAc,sBAAsB;CAClE,MAAM,6BAA6B,mBAAmB,sBAAsB;CAE5E,MAAM,wBAAwB,eAAuC,gBAAyB;EAC5F,MAAM,eAAyB,CAAC;EAChC,MAAM,oBAA8B,CAAC;EAErC,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,aAAa,GAAG;GAC3D,MAAM,OAAO,GAAG,KAAK,GAAG;GACxB,CAAC,iBAAiB,IAAI,IAAI,oBAAoB,aAAY,CAAE,KAAK,IAAI;EACvE;EAEA,MAAM,kBAAkB,cAAc,QAAQ;EAC9C,MAAM,cAAc,SAAiB,UAAoB;GACvD,IAAI,MAAM,WAAW,GAAG;GAExB,KAAK,GAAG,QAAQ,GAAG,MAAM,KAAK,GAAG,IAAI,mBAAmB;IACtD,KAAK,QAAQ,IAAI;IACjB,OAAO;GACT,CAAC;EACH;EAEA,WAAW,uBAAuB,YAAY;EAC9C,WAAW,4BAA4B,iBAAiB;CAC1D;CAEA,IAAI,OAAO,KAAK,YAAY,CAAC,CAAC,SAAS,GAAG;EACxC,QAAQ,IAAI,2BAA2B,OAAO,QAAQ,OAAO,KAAK,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG;EAE7F,qBAAqB,cAAc,KAAK;EAExC,QAAQ,IACN,uCAAuC,OAAO,MAAM,OAAO,KAAK,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC,GAC1F;CACF;CAEA,IAAI,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,GAAG;EAC3C,QAAQ,IACN,+BAA+B,OAAO,QAAQ,OAAO,KAAK,eAAe,CAAC,CAAC,KAAK,IAAI,CAAC,GACvF;EAEA,qBAAqB,iBAAiB,IAAI;EAE1C,QAAQ,IACN,2CAA2C,OAAO,MAAM,OAAO,KAAK,eAAe,CAAC,CAAC,KAAK,IAAI,CAAC,GACjG;CACF;AACF;;;;;;AAOA,eAAe,mBACb,cACA,iBACA;CACA,IAAI,OAAO,KAAK,YAAY,CAAC,CAAC,WAAW,KAAK,OAAO,KAAK,eAAe,CAAC,CAAC,WAAW,GACpF;CAGF,MAAM,kBAAkB,SAAS,cAAc;CAC/C,MAAM,cAAc,MAAM,iBAAqC,eAAe;CAE9E,YAAY,eAAe,YAAY,gBAAgB,CAAC;CACxD,YAAY,kBAAkB,YAAY,mBAAmB,CAAC;CAE9D,OAAO,OAAO,YAAY,cAAc,YAAY;CACpD,OAAO,OAAO,YAAY,iBAAiB,eAAe;CAE1D,MAAM,iBAAiB,iBAAiB,WAAW;CAEnD,MAAM,WAAW,CAAC,GAAG,OAAO,KAAK,YAAY,GAAG,GAAG,OAAO,KAAK,eAAe,CAAC;CAE/E,QAAQ,IACN,YAAY,OAAO,MAAM,SAAS,KAAK,IAAI,CAAC,EAAE,oDAChD;AACF;AAEA,SAAS,iBAAiB,UAAoB;CAC5C,KAAK,MAAM,WAAW,UACpB,IAAI,CAAC,gBAAgB,SAAS,OAAO,GAAG;EACtC,QAAQ,IACN,WAAW,OAAO,UAAU,OAAO,EAAE,yCAAyC,OAAO,MAAM,gBAAgB,KAAK,IAAI,CAAC,GACvH;EACA,QAAQ,KAAK,CAAC;CAChB;AAEJ"}
+{"version":3,"file":"add-command.action.mjs","names":[],"sources":["../../../../../../../../packages/core/src/generations/add-command.action.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\nimport {\n  fileExistsAsync,\n  getFileAsync,\n  getJsonFileAsync,\n  putFileAsync,\n  putJsonFileAsync,\n} from \"@warlock.js/fs\";\nimport { execSync } from \"node:child_process\";\nimport type { CommandActionData } from \"../commands/types\";\nimport {\n  detectPackageManager,\n  getAddCommand,\n  getExactAddCommand,\n  type PackageManager,\n} from \"../updater/package-manager\";\nimport { rootPath, srcPath } from \"../utils\";\nimport { getWarlockVersion } from \"../utils/framework-vesion\";\nimport { featuresMap } from \"./features\";\nimport {\n  getPnpmVersion,\n  isInsideParentPnpmWorkspace,\n  mergeOnlyBuiltDependencies,\n  mergePackageJsonBuildApprovals,\n  mergePnpmSharpApproval,\n  pnpmBuildApprovalLayout,\n} from \"./pnpm-build-approvals\";\n\nexport { featuresMap };\nexport type { FeatureDefinition } from \"./features\";\n\n/**\n * The parts of a project `package.json` this action reads or writes. Deliberately\n * partial — it describes what we touch, not the whole manifest.\n */\ntype ProjectPackageJson = {\n  dependencies?: Record<string, string>;\n  devDependencies?: Record<string, string>;\n  scripts?: Record<string, string>;\n};\n\nexport const allowedFeatures = Object.keys(featuresMap);\n\nfunction isWarlockPackage(packageName: string): boolean {\n  return packageName.startsWith(\"@warlock.js/\");\n}\n\n/**\n * Resolve the internal feature-map placeholder to the version of Core that is\n * actually executing the command. Every @warlock.js package is lockstep, so\n * Core is the single source of truth; non-Warlock dependencies are untouched.\n */\nexport function resolveWarlockDependencyVersions(\n  dependencies: Record<string, string>,\n  frameworkVersion: string,\n): void {\n  for (const dependency of Object.keys(dependencies)) {\n    if (isWarlockPackage(dependency)) {\n      dependencies[dependency] = frameworkVersion;\n    }\n  }\n}\n\nfunction resolveFeatures(features: string[], visited = new Set<string>()): string[] {\n  const resolved: string[] = [];\n\n  for (const feature of features) {\n    if (visited.has(feature)) continue;\n    visited.add(feature);\n\n    const def = featuresMap[feature];\n\n    // `addCommandAction` runs `validateFeatures()` before calling this, and the\n    // recursive calls below pass `requires` entries that come out of the map\n    // itself — so every lookup resolves. Skipping an unresolvable one keeps a\n    // typo from crashing the command with `Cannot read properties of\n    // undefined`, which names neither the feature nor the fact that it was the\n    // ARGUMENT that was wrong.\n    if (def === undefined) continue;\n\n    if (def.requires?.length) {\n      resolved.push(...resolveFeatures(def.requires, visited));\n    }\n\n    resolved.push(feature);\n  }\n\n  return resolved;\n}\n\nexport async function addCommandAction(options: CommandActionData) {\n  const features = options.args;\n  const { packageManager, list, noInstall } = options.options;\n\n  if (list) {\n    console.log(\"Available Features:\");\n\n    for (const feature of allowedFeatures) {\n      const definition = featuresMap[feature];\n\n      // `allowedFeatures` is derived from this same map, so this resolves.\n      if (definition === undefined) continue;\n\n      console.log(`- ${colors.yellowBright(feature)}: ${colors.green(definition.description)}`);\n    }\n\n    process.exit(0);\n  }\n\n  validateFeatures(features);\n\n  const resolvedFeatures = resolveFeatures(features);\n\n  const dependencies: Record<string, string> = {};\n  const devDependencies: Record<string, string> = {};\n  const ejectConfigs: Record<string, { content: string; name: string }> = {};\n  const scripts: Record<string, string> = {};\n\n  for (const feature of resolvedFeatures) {\n    const featurePackages = featuresMap[feature as keyof typeof featuresMap];\n\n    // Validated upstream; see the note in resolveFeatures above.\n    if (featurePackages === undefined) continue;\n\n    Object.assign(dependencies, featurePackages.dependencies);\n    if (featurePackages.devDependencies) {\n      Object.assign(devDependencies, featurePackages.devDependencies);\n    }\n\n    if (featurePackages.ejectConfig) {\n      ejectConfigs[featurePackages.ejectConfig.name] = featurePackages.ejectConfig;\n    }\n\n    if (featurePackages.script) {\n      Object.assign(scripts, featurePackages.script);\n    }\n  }\n\n  // Pin every @warlock.js/* feature package to the INSTALLED framework version so\n  // a scaffolded project's features match its core version instead of drifting to\n  // the feature map's static range.\n  const frameworkVersion = await getWarlockVersion();\n  resolveWarlockDependencyVersions(dependencies, frameworkVersion);\n  resolveWarlockDependencyVersions(devDependencies, frameworkVersion);\n\n  const currentPackageJson = await getJsonFileAsync<ProjectPackageJson>(rootPath(\"package.json\"));\n\n  // Fresh templates may omit one of the maps — guard before reading.\n  currentPackageJson.dependencies = currentPackageJson.dependencies ?? {};\n  currentPackageJson.devDependencies = currentPackageJson.devDependencies ?? {};\n\n  // Skip anything already present so we never downgrade an existing pin.\n  for (const dependency of Object.keys(dependencies)) {\n    if (currentPackageJson.dependencies[dependency]) {\n      console.log(`${colors.yellowBright(dependency)} is already installed, skipping...`);\n      delete dependencies[dependency];\n    }\n  }\n\n  for (const devDependency of Object.keys(devDependencies)) {\n    if (currentPackageJson.devDependencies[devDependency]) {\n      console.log(`${colors.yellowBright(devDependency)} is already installed, skipping...`);\n      delete devDependencies[devDependency];\n    }\n  }\n\n  if (noInstall) {\n    await recordDependencies(dependencies, devDependencies);\n  } else {\n    const resolvedPackageManager =\n      (packageManager as PackageManager | undefined) ?? (await detectPackageManager());\n    if (resolvedPackageManager === \"pnpm\" && dependencies.sharp !== undefined) {\n      await approvePnpmSharpBuild();\n    }\n    await installDependencies(\n      packageManager as PackageManager | undefined,\n      dependencies,\n      devDependencies,\n    );\n  }\n\n  for (const [name, config] of Object.entries(ejectConfigs)) {\n    if (await fileExistsAsync(srcPath(`config/${name}.ts`))) {\n      console.log(`${colors.yellowBright(name)} config already exists, skipping...`);\n      continue;\n    }\n\n    console.log(`Creating ${colors.magenta(name)} config...`);\n\n    await putFileAsync(srcPath(`config/${name}.ts`), config.content);\n\n    console.log(`${colors.green(name)} config created successfully`);\n  }\n\n  // now loop again over features to execute onExecuting\n  for (const feature of resolvedFeatures) {\n    const featurePackages = featuresMap[feature as keyof typeof featuresMap];\n\n    if (featurePackages?.onExecuting) {\n      await featurePackages.onExecuting(options);\n    }\n  }\n\n  if (Object.keys(scripts).length > 0) {\n    console.log(`Adding scripts ${colors.magenta(Object.keys(scripts).join(\", \"))}`);\n    const packageJsonPath = rootPath(\"package.json\");\n    const packageJson = await getJsonFileAsync<ProjectPackageJson>(packageJsonPath);\n    packageJson.scripts = { ...(packageJson.scripts ?? {}), ...scripts };\n    await putJsonFileAsync(packageJsonPath, packageJson);\n\n    console.log(`Scripts added successfully ${colors.green(Object.keys(scripts).join(\", \"))}`);\n  }\n}\n\n/**\n * Let pnpm run sharp's install script, written where the INSTALLED pnpm reads\n * approvals (see `pnpmBuildApprovalLayout`). pnpm 9 and 10.0–10.4 reject a\n * settings-only `pnpm-workspace.yaml`, so for them the approval goes into\n * package.json and no workspace file is created.\n *\n * An app inside a parent pnpm workspace gets no per-app policy: the parent's\n * workspace owns it, and a nested workspace file would make a second root.\n */\nasync function approvePnpmSharpBuild(): Promise<void> {\n  const workspacePath = rootPath(\"pnpm-workspace.yaml\");\n  const hasWorkspaceFile = await fileExistsAsync(workspacePath);\n\n  if (!hasWorkspaceFile && isInsideParentPnpmWorkspace(rootPath())) {\n    console.log(\n      `${colors.yellowBright(\"sharp\")} needs its install script approved in the parent pnpm workspace's settings.`,\n    );\n    return;\n  }\n\n  const layout = pnpmBuildApprovalLayout(getPnpmVersion(rootPath()));\n\n  if (layout === \"packageJson\") {\n    const packageJsonPath = rootPath(\"package.json\");\n    const packageJson = await getJsonFileAsync<ProjectPackageJson>(packageJsonPath);\n\n    await putJsonFileAsync(packageJsonPath, mergePackageJsonBuildApprovals(packageJson, [\"sharp\"]));\n    return;\n  }\n\n  const current = hasWorkspaceFile ? await getFileAsync(workspacePath) : \"\";\n  const updated =\n    layout === \"onlyBuiltDependencies\"\n      ? mergeOnlyBuiltDependencies(current, [\"sharp\"])\n      : mergePnpmSharpApproval(current);\n\n  if (updated !== current) await putFileAsync(workspacePath, updated);\n}\n\n/**\n * Install the resolved dependency sets through the project's package manager.\n * Runs two passes (prod then dev) so each lands in the correct section.\n */\nexport async function installDependencies(\n  packageManager: PackageManager | undefined,\n  dependencies: Record<string, string>,\n  devDependencies: Record<string, string>,\n  exec: (command: string, options: { cwd: string; stdio: \"inherit\" }) => unknown = execSync,\n) {\n  // `--package-manager` is optional; without it, fall back to the lockfile.\n  const resolvedPackageManager = packageManager ?? (await detectPackageManager());\n  const packageManagerCommand = getAddCommand(resolvedPackageManager);\n  const exactPackageManagerCommand = getExactAddCommand(resolvedPackageManager);\n\n  const installDependencySet = (dependencySet: Record<string, string>, development: boolean) => {\n    const regularSpecs: string[] = [];\n    const exactWarlockSpecs: string[] = [];\n\n    for (const [name, version] of Object.entries(dependencySet)) {\n      const spec = `${name}@${version}`;\n      (isWarlockPackage(name) ? exactWarlockSpecs : regularSpecs).push(spec);\n    }\n\n    const developmentFlag = development ? \" -D\" : \"\";\n    const runInstall = (command: string, specs: string[]) => {\n      if (specs.length === 0) return;\n\n      exec(`${command} ${specs.join(\" \")}${developmentFlag}`, {\n        cwd: process.cwd(),\n        stdio: \"inherit\",\n      });\n    };\n\n    runInstall(packageManagerCommand, regularSpecs);\n    runInstall(exactPackageManagerCommand, exactWarlockSpecs);\n  };\n\n  if (Object.keys(dependencies).length > 0) {\n    console.log(`Installing dependencies ${colors.magenta(Object.keys(dependencies).join(\", \"))}`);\n\n    installDependencySet(dependencies, false);\n\n    console.log(\n      `Dependencies installed successfully ${colors.green(Object.keys(dependencies).join(\", \"))}`,\n    );\n  }\n\n  if (Object.keys(devDependencies).length > 0) {\n    console.log(\n      `Installing dev dependencies ${colors.magenta(Object.keys(devDependencies).join(\", \"))}`,\n    );\n\n    installDependencySet(devDependencies, true);\n\n    console.log(\n      `Dev dependencies installed successfully ${colors.green(Object.keys(devDependencies).join(\", \"))}`,\n    );\n  }\n}\n\n/**\n * Write the resolved dependency sets into package.json without installing.\n * Used by `--no-install` so a scaffolder can batch every feature into one\n * install pass after the command returns. Versions come from the feature map.\n */\nasync function recordDependencies(\n  dependencies: Record<string, string>,\n  devDependencies: Record<string, string>,\n) {\n  if (Object.keys(dependencies).length === 0 && Object.keys(devDependencies).length === 0) {\n    return;\n  }\n\n  const packageJsonPath = rootPath(\"package.json\");\n  const packageJson = await getJsonFileAsync<ProjectPackageJson>(packageJsonPath);\n\n  packageJson.dependencies = packageJson.dependencies ?? {};\n  packageJson.devDependencies = packageJson.devDependencies ?? {};\n\n  Object.assign(packageJson.dependencies, dependencies);\n  Object.assign(packageJson.devDependencies, devDependencies);\n\n  await putJsonFileAsync(packageJsonPath, packageJson);\n\n  const recorded = [...Object.keys(dependencies), ...Object.keys(devDependencies)];\n\n  console.log(\n    `Recorded ${colors.green(recorded.join(\", \"))} in package.json (install skipped via --no-install)`,\n  );\n}\n\nfunction validateFeatures(features: string[]) {\n  for (const feature of features) {\n    if (!allowedFeatures.includes(feature)) {\n      console.log(\n        `Feature ${colors.redBright(feature)} is not allowed, allowed features are: ${colors.green(allowedFeatures.join(\", \"))}`,\n      );\n      process.exit(1);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;AAyCA,MAAa,kBAAkB,OAAO,KAAK,WAAW;AAEtD,SAAS,iBAAiB,aAA8B;CACtD,OAAO,YAAY,WAAW,cAAc;AAC9C;;;;;;AAOA,SAAgB,iCACd,cACA,kBACM;CACN,KAAK,MAAM,cAAc,OAAO,KAAK,YAAY,GAC/C,IAAI,iBAAiB,UAAU,GAC7B,aAAa,cAAc;AAGjC;AAEA,SAAS,gBAAgB,UAAoB,0BAAU,IAAI,IAAY,GAAa;CAClF,MAAM,WAAqB,CAAC;CAE5B,KAAK,MAAM,WAAW,UAAU;EAC9B,IAAI,QAAQ,IAAI,OAAO,GAAG;EAC1B,QAAQ,IAAI,OAAO;EAEnB,MAAM,MAAM,YAAY;EAQxB,IAAI,QAAQ,QAAW;EAEvB,IAAI,IAAI,UAAU,QAChB,SAAS,KAAK,GAAG,gBAAgB,IAAI,UAAU,OAAO,CAAC;EAGzD,SAAS,KAAK,OAAO;CACvB;CAEA,OAAO;AACT;AAEA,eAAsB,iBAAiB,SAA4B;CACjE,MAAM,WAAW,QAAQ;CACzB,MAAM,EAAE,gBAAgB,MAAM,cAAc,QAAQ;CAEpD,IAAI,MAAM;EACR,QAAQ,IAAI,qBAAqB;EAEjC,KAAK,MAAM,WAAW,iBAAiB;GACrC,MAAM,aAAa,YAAY;GAG/B,IAAI,eAAe,QAAW;GAE9B,QAAQ,IAAI,KAAK,OAAO,aAAa,OAAO,EAAE,IAAI,OAAO,MAAM,WAAW,WAAW,GAAG;EAC1F;EAEA,QAAQ,KAAK,CAAC;CAChB;CAEA,iBAAiB,QAAQ;CAEzB,MAAM,mBAAmB,gBAAgB,QAAQ;CAEjD,MAAM,eAAuC,CAAC;CAC9C,MAAM,kBAA0C,CAAC;CACjD,MAAM,eAAkE,CAAC;CACzE,MAAM,UAAkC,CAAC;CAEzC,KAAK,MAAM,WAAW,kBAAkB;EACtC,MAAM,kBAAkB,YAAY;EAGpC,IAAI,oBAAoB,QAAW;EAEnC,OAAO,OAAO,cAAc,gBAAgB,YAAY;EACxD,IAAI,gBAAgB,iBAClB,OAAO,OAAO,iBAAiB,gBAAgB,eAAe;EAGhE,IAAI,gBAAgB,aAClB,aAAa,gBAAgB,YAAY,QAAQ,gBAAgB;EAGnE,IAAI,gBAAgB,QAClB,OAAO,OAAO,SAAS,gBAAgB,MAAM;CAEjD;CAKA,MAAM,mBAAmB,MAAM,kBAAkB;CACjD,iCAAiC,cAAc,gBAAgB;CAC/D,iCAAiC,iBAAiB,gBAAgB;CAElE,MAAM,qBAAqB,MAAM,iBAAqC,SAAS,cAAc,CAAC;CAG9F,mBAAmB,eAAe,mBAAmB,gBAAgB,CAAC;CACtE,mBAAmB,kBAAkB,mBAAmB,mBAAmB,CAAC;CAG5E,KAAK,MAAM,cAAc,OAAO,KAAK,YAAY,GAC/C,IAAI,mBAAmB,aAAa,aAAa;EAC/C,QAAQ,IAAI,GAAG,OAAO,aAAa,UAAU,EAAE,mCAAmC;EAClF,OAAO,aAAa;CACtB;CAGF,KAAK,MAAM,iBAAiB,OAAO,KAAK,eAAe,GACrD,IAAI,mBAAmB,gBAAgB,gBAAgB;EACrD,QAAQ,IAAI,GAAG,OAAO,aAAa,aAAa,EAAE,mCAAmC;EACrF,OAAO,gBAAgB;CACzB;CAGF,IAAI,WACF,MAAM,mBAAmB,cAAc,eAAe;MACjD;EAGL,KADG,kBAAkD,MAAM,qBAAqB,OACjD,UAAU,aAAa,UAAU,QAC9D,MAAM,sBAAsB;EAE9B,MAAM,oBACJ,gBACA,cACA,eACF;CACF;CAEA,KAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,YAAY,GAAG;EACzD,IAAI,MAAM,gBAAgB,QAAQ,UAAU,KAAK,IAAI,CAAC,GAAG;GACvD,QAAQ,IAAI,GAAG,OAAO,aAAa,IAAI,EAAE,oCAAoC;GAC7E;EACF;EAEA,QAAQ,IAAI,YAAY,OAAO,QAAQ,IAAI,EAAE,WAAW;EAExD,MAAM,aAAa,QAAQ,UAAU,KAAK,IAAI,GAAG,OAAO,OAAO;EAE/D,QAAQ,IAAI,GAAG,OAAO,MAAM,IAAI,EAAE,6BAA6B;CACjE;CAGA,KAAK,MAAM,WAAW,kBAAkB;EACtC,MAAM,kBAAkB,YAAY;EAEpC,IAAI,iBAAiB,aACnB,MAAM,gBAAgB,YAAY,OAAO;CAE7C;CAEA,IAAI,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,GAAG;EACnC,QAAQ,IAAI,kBAAkB,OAAO,QAAQ,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG;EAC/E,MAAM,kBAAkB,SAAS,cAAc;EAC/C,MAAM,cAAc,MAAM,iBAAqC,eAAe;EAC9E,YAAY,UAAU;GAAE,GAAI,YAAY,WAAW,CAAC;GAAI,GAAG;EAAQ;EACnE,MAAM,iBAAiB,iBAAiB,WAAW;EAEnD,QAAQ,IAAI,8BAA8B,OAAO,MAAM,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG;CAC3F;AACF;;;;;;;;;;AAWA,eAAe,wBAAuC;CACpD,MAAM,gBAAgB,SAAS,qBAAqB;CACpD,MAAM,mBAAmB,MAAM,gBAAgB,aAAa;CAE5D,IAAI,CAAC,oBAAoB,4BAA4B,SAAS,CAAC,GAAG;EAChE,QAAQ,IACN,GAAG,OAAO,aAAa,OAAO,EAAE,4EAClC;EACA;CACF;CAEA,MAAM,SAAS,wBAAwB,eAAe,SAAS,CAAC,CAAC;CAEjE,IAAI,WAAW,eAAe;EAC5B,MAAM,kBAAkB,SAAS,cAAc;EAG/C,MAAM,iBAAiB,iBAAiB,+BAA+B,MAF7C,iBAAqC,eAAe,GAEM,CAAC,OAAO,CAAC,CAAC;EAC9F;CACF;CAEA,MAAM,UAAU,mBAAmB,MAAM,aAAa,aAAa,IAAI;CACvE,MAAM,UACJ,WAAW,0BACP,2BAA2B,SAAS,CAAC,OAAO,CAAC,IAC7C,uBAAuB,OAAO;CAEpC,IAAI,YAAY,SAAS,MAAM,aAAa,eAAe,OAAO;AACpE;;;;;AAMA,eAAsB,oBACpB,gBACA,cACA,iBACA,OAAiF,UACjF;CAEA,MAAM,yBAAyB,kBAAmB,MAAM,qBAAqB;CAC7E,MAAM,wBAAwB,cAAc,sBAAsB;CAClE,MAAM,6BAA6B,mBAAmB,sBAAsB;CAE5E,MAAM,wBAAwB,eAAuC,gBAAyB;EAC5F,MAAM,eAAyB,CAAC;EAChC,MAAM,oBAA8B,CAAC;EAErC,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,aAAa,GAAG;GAC3D,MAAM,OAAO,GAAG,KAAK,GAAG;GACxB,CAAC,iBAAiB,IAAI,IAAI,oBAAoB,aAAY,CAAE,KAAK,IAAI;EACvE;EAEA,MAAM,kBAAkB,cAAc,QAAQ;EAC9C,MAAM,cAAc,SAAiB,UAAoB;GACvD,IAAI,MAAM,WAAW,GAAG;GAExB,KAAK,GAAG,QAAQ,GAAG,MAAM,KAAK,GAAG,IAAI,mBAAmB;IACtD,KAAK,QAAQ,IAAI;IACjB,OAAO;GACT,CAAC;EACH;EAEA,WAAW,uBAAuB,YAAY;EAC9C,WAAW,4BAA4B,iBAAiB;CAC1D;CAEA,IAAI,OAAO,KAAK,YAAY,CAAC,CAAC,SAAS,GAAG;EACxC,QAAQ,IAAI,2BAA2B,OAAO,QAAQ,OAAO,KAAK,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG;EAE7F,qBAAqB,cAAc,KAAK;EAExC,QAAQ,IACN,uCAAuC,OAAO,MAAM,OAAO,KAAK,YAAY,CAAC,CAAC,KAAK,IAAI,CAAC,GAC1F;CACF;CAEA,IAAI,OAAO,KAAK,eAAe,CAAC,CAAC,SAAS,GAAG;EAC3C,QAAQ,IACN,+BAA+B,OAAO,QAAQ,OAAO,KAAK,eAAe,CAAC,CAAC,KAAK,IAAI,CAAC,GACvF;EAEA,qBAAqB,iBAAiB,IAAI;EAE1C,QAAQ,IACN,2CAA2C,OAAO,MAAM,OAAO,KAAK,eAAe,CAAC,CAAC,KAAK,IAAI,CAAC,GACjG;CACF;AACF;;;;;;AAOA,eAAe,mBACb,cACA,iBACA;CACA,IAAI,OAAO,KAAK,YAAY,CAAC,CAAC,WAAW,KAAK,OAAO,KAAK,eAAe,CAAC,CAAC,WAAW,GACpF;CAGF,MAAM,kBAAkB,SAAS,cAAc;CAC/C,MAAM,cAAc,MAAM,iBAAqC,eAAe;CAE9E,YAAY,eAAe,YAAY,gBAAgB,CAAC;CACxD,YAAY,kBAAkB,YAAY,mBAAmB,CAAC;CAE9D,OAAO,OAAO,YAAY,cAAc,YAAY;CACpD,OAAO,OAAO,YAAY,iBAAiB,eAAe;CAE1D,MAAM,iBAAiB,iBAAiB,WAAW;CAEnD,MAAM,WAAW,CAAC,GAAG,OAAO,KAAK,YAAY,GAAG,GAAG,OAAO,KAAK,eAAe,CAAC;CAE/E,QAAQ,IACN,YAAY,OAAO,MAAM,SAAS,KAAK,IAAI,CAAC,EAAE,oDAChD;AACF;AAEA,SAAS,iBAAiB,UAAoB;CAC5C,KAAK,MAAM,WAAW,UACpB,IAAI,CAAC,gBAAgB,SAAS,OAAO,GAAG;EACtC,QAAQ,IACN,WAAW,OAAO,UAAU,OAAO,EAAE,yCAAyC,OAAO,MAAM,gBAAgB,KAAK,IAAI,CAAC,GACvH;EACA,QAAQ,KAAK,CAAC;CAChB;AAEJ"}

package/esm/generations/features/access.feature.mjs

@@ -6,7 +6,7 @@ import { INSTALLED_WARLOCK_VERSION } from "./types.mjs";
 import { colors } from "@mongez/copper";
 import { ensureDirectoryAsync, fileExistsAsync, getFileAsync, putFileAsync } from "@warlock.js/fs";
 
-//#region ../core/src/generations/features/access.feature.ts
+//#region ../../packages/core/src/generations/features/access.feature.ts
 async function registerAccessLocale() {
 	const legacyLocalesPath = srcPath("app/shared/utils/locales.ts");
 	const localesPath = srcPath("app/access/utils/locales.json");

package/esm/generations/features/access.feature.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"access.feature.mjs","names":[],"sources":["../../../../../../../../core/src/generations/features/access.feature.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\nimport { ensureDirectoryAsync, fileExistsAsync, getFileAsync, putFileAsync } from \"@warlock.js/fs\";\nimport type { CommandActionData } from \"../../commands/types\";\nimport { srcPath } from \"../../utils\";\nimport {\n  accessConfigStub,\n  accessResolverStub,\n  accessRoleMigrationStub,\n  accessRoleModelIndexStub,\n  accessRoleModelStub,\n  accessUserRoleMigrationStub,\n  accessUserRoleModelIndexStub,\n  accessUserRoleModelStub,\n} from \"../stubs\";\nimport { migrationTimestamp } from \"./shared/migration-timestamp\";\nimport { type FeatureDefinition, INSTALLED_WARLOCK_VERSION } from \"./types\";\n\nasync function registerAccessLocale() {\n  const legacyLocalesPath = srcPath(\"app/shared/utils/locales.ts\");\n  const localesPath = srcPath(\"app/access/utils/locales.json\");\n  const forbidden = {\n    en: \"You do not have permission to perform this action.\",\n    ar: \"ليس لديك صلاحية لتنفيذ هذا الإجراء.\",\n  };\n\n  if (await fileExistsAsync(legacyLocalesPath)) {\n    const legacy = await getFileAsync(legacyLocalesPath);\n    if (legacy.includes(`groupedTranslations(\"access\"`)) {\n      console.log(`${colors.yellowBright(\"access\")} locale already registered, skipping...`);\n      return;\n    }\n  }\n\n  if (await fileExistsAsync(localesPath)) {\n    const current = await getFileAsync(localesPath);\n    let dictionary: Record<string, unknown>;\n    try {\n      const parsed: unknown = JSON.parse(current);\n      if (parsed === null || Array.isArray(parsed) || typeof parsed !== \"object\") throw new Error();\n      dictionary = parsed as Record<string, unknown>;\n    } catch {\n      console.log(\n        `${colors.yellowBright(\"access\")} locale JSON is invalid; add errors.forbidden to src/app/access/utils/locales.json manually.`,\n      );\n      return;\n    }\n\n    // A root `$group` renames the whole file's namespace; merging there would\n    // register the sentence under a key the access checks never read.\n    if (dictionary.$group !== undefined && dictionary.$group !== \"access\") {\n      console.log(\n        `${colors.yellowBright(\"access\")} locale JSON declares a different $group; add access.errors.forbidden manually.`,\n      );\n      return;\n    }\n\n    const errors = dictionary.errors;\n    if (\n      errors !== undefined &&\n      (errors === null || Array.isArray(errors) || typeof errors !== \"object\")\n    ) {\n      console.log(\n        `${colors.yellowBright(\"access\")} locale JSON cannot safely add errors.forbidden; update src/app/access/utils/locales.json manually.`,\n      );\n      return;\n    }\n    const entries = (errors ?? {}) as Record<string, unknown>;\n    if (entries.forbidden !== undefined) return;\n\n    entries.forbidden = forbidden;\n    dictionary.errors = entries;\n    await putFileAsync(localesPath, `${JSON.stringify(dictionary, null, 2)}\\n`);\n    console.log(\n      `${colors.green(\"✓\")} Registered the access locale in src/app/access/utils/locales.json`,\n    );\n    return;\n  }\n\n  await ensureDirectoryAsync(srcPath(\"app/access/utils\"));\n  await putFileAsync(localesPath, `${JSON.stringify({ errors: { forbidden } }, null, 2)}\\n`);\n  console.log(\n    `${colors.green(\"✓\")} Created src/app/access/utils/locales.json with the access locale`,\n  );\n}\n\nasync function scaffoldAccessFiles() {\n  // The resolver file is the sentinel for \"access already scaffolded\" — its\n  // presence means the role/user-role model folders and their timestamped\n  // migrations were created too, so we must not re-emit duplicate migrations on\n  // a second run.\n  const resolverPath = srcPath(\"app/access/services/access-resolver.ts\");\n\n  if (await fileExistsAsync(resolverPath)) {\n    console.log(\n      `${colors.yellowBright(\"src/app/access\")} already scaffolded, skipping resolver + role tables...`,\n    );\n\n    return;\n  }\n\n  // 1. Role catalog model folder (model + barrel + migration). The catalog row\n  //    is role name → granted permissions; managed at runtime in the DB.\n  await ensureDirectoryAsync(srcPath(\"app/access/models/role\"));\n  await putFileAsync(srcPath(\"app/access/models/role/role.model.ts\"), accessRoleModelStub);\n  await putFileAsync(srcPath(\"app/access/models/role/index.ts\"), accessRoleModelIndexStub);\n  console.log(`${colors.green(\"✓\")} Created src/app/access/models/role`);\n\n  await ensureDirectoryAsync(srcPath(\"app/access/models/role/migrations\"));\n\n  // Migration filenames carry a MM-DD-YYYY_HH-MM-SS prefix so cascade infers\n  // their createdAt and orders them deterministically (the migrate action\n  // discovers src/app/*/models/*/migrations/*). The two tables are independent\n  // (no FK between them), but the user-role migration is stamped a second later\n  // so the relative order is stable.\n  const roleMigrationFile = `${migrationTimestamp()}-role.migration.ts`;\n  await putFileAsync(\n    srcPath(\"app/access/models/role/migrations\", roleMigrationFile),\n    accessRoleMigrationStub,\n  );\n  console.log(\n    `${colors.green(\"✓\")} Created src/app/access/models/role/migrations/${roleMigrationFile}`,\n  );\n\n  // 2. UserRole assignment model folder (model + barrel + migration). The model\n  //    statics scope an unresolved tenant to GLOBAL rows only (security\n  //    invariant) — see the stub for the reasoning.\n  await ensureDirectoryAsync(srcPath(\"app/access/models/user-role\"));\n  await putFileAsync(\n    srcPath(\"app/access/models/user-role/user-role.model.ts\"),\n    accessUserRoleModelStub,\n  );\n  await putFileAsync(srcPath(\"app/access/models/user-role/index.ts\"), accessUserRoleModelIndexStub);\n  console.log(`${colors.green(\"✓\")} Created src/app/access/models/user-role`);\n\n  await ensureDirectoryAsync(srcPath(\"app/access/models/user-role/migrations\"));\n\n  const userRoleMigrationFile = `${migrationTimestamp(1)}-user-role.migration.ts`;\n  await putFileAsync(\n    srcPath(\"app/access/models/user-role/migrations\", userRoleMigrationFile),\n    accessUserRoleMigrationStub,\n  );\n  console.log(\n    `${colors.green(\"✓\")} Created src/app/access/models/user-role/migrations/${userRoleMigrationFile}`,\n  );\n\n  // 3. The DatabaseAccessResolver — the one required config seam, wired into\n  //    config/access.ts by the ejected stub.\n  await ensureDirectoryAsync(srcPath(\"app/access/services\"));\n  await putFileAsync(resolverPath, accessResolverStub);\n  console.log(`${colors.green(\"✓\")} Created src/app/access/services/access-resolver.ts`);\n}\n\nasync function completeAccessInstallation(_options: CommandActionData) {\n  await registerAccessLocale();\n  await scaffoldAccessFiles();\n}\n\nexport const accessFeature: FeatureDefinition = {\n  description:\n    \"Installs @warlock.js/access — authorization (RBAC + ABAC): permission checks, ABAC policies, and roles. Ejects config/access.ts, the DatabaseAccessResolver + Role/UserRole models and migrations into src/app/access, and registers the access locale in src/app/access/utils/locales.json\",\n  dependencies: {\n    \"@warlock.js/access\": INSTALLED_WARLOCK_VERSION,\n  },\n  ejectConfig: {\n    content: accessConfigStub,\n    name: \"access\",\n  },\n  onExecuting: completeAccessInstallation,\n};\n"],"mappings":";;;;;;;;;AAiBA,eAAe,uBAAuB;CACpC,MAAM,oBAAoB,QAAQ,6BAA6B;CAC/D,MAAM,cAAc,QAAQ,+BAA+B;CAC3D,MAAM,YAAY;EAChB,IAAI;EACJ,IAAI;CACN;CAEA,IAAI,MAAM,gBAAgB,iBAAiB,GAEzC;OAAI,MADiB,aAAa,iBAAiB,EACzC,CAAC,SAAS,8BAA8B,GAAG;GACnD,QAAQ,IAAI,GAAG,OAAO,aAAa,QAAQ,EAAE,wCAAwC;GACrF;EACF;;CAGF,IAAI,MAAM,gBAAgB,WAAW,GAAG;EACtC,MAAM,UAAU,MAAM,aAAa,WAAW;EAC9C,IAAI;EACJ,IAAI;GACF,MAAM,SAAkB,KAAK,MAAM,OAAO;GAC1C,IAAI,WAAW,QAAQ,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,UAAU,MAAM,IAAI,MAAM;GAC5F,aAAa;EACf,QAAQ;GACN,QAAQ,IACN,GAAG,OAAO,aAAa,QAAQ,EAAE,6FACnC;GACA;EACF;EAIA,IAAI,WAAW,WAAW,UAAa,WAAW,WAAW,UAAU;GACrE,QAAQ,IACN,GAAG,OAAO,aAAa,QAAQ,EAAE,gFACnC;GACA;EACF;EAEA,MAAM,SAAS,WAAW;EAC1B,IACE,WAAW,WACV,WAAW,QAAQ,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,WAC/D;GACA,QAAQ,IACN,GAAG,OAAO,aAAa,QAAQ,EAAE,oGACnC;GACA;EACF;EACA,MAAM,UAAW,UAAU,CAAC;EAC5B,IAAI,QAAQ,cAAc,QAAW;EAErC,QAAQ,YAAY;EACpB,WAAW,SAAS;EACpB,MAAM,aAAa,aAAa,GAAG,KAAK,UAAU,YAAY,MAAM,CAAC,EAAE,GAAG;EAC1E,QAAQ,IACN,GAAG,OAAO,MAAM,GAAG,EAAE,mEACvB;EACA;CACF;CAEA,MAAM,qBAAqB,QAAQ,kBAAkB,CAAC;CACtD,MAAM,aAAa,aAAa,GAAG,KAAK,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG;CACzF,QAAQ,IACN,GAAG,OAAO,MAAM,GAAG,EAAE,kEACvB;AACF;AAEA,eAAe,sBAAsB;CAKnC,MAAM,eAAe,QAAQ,wCAAwC;CAErE,IAAI,MAAM,gBAAgB,YAAY,GAAG;EACvC,QAAQ,IACN,GAAG,OAAO,aAAa,gBAAgB,EAAE,wDAC3C;EAEA;CACF;CAIA,MAAM,qBAAqB,QAAQ,wBAAwB,CAAC;CAC5D,MAAM,aAAa,QAAQ,sCAAsC,GAAG,mBAAmB;CACvF,MAAM,aAAa,QAAQ,iCAAiC,GAAG,wBAAwB;CACvF,QAAQ,IAAI,GAAG,OAAO,MAAM,GAAG,EAAE,oCAAoC;CAErE,MAAM,qBAAqB,QAAQ,mCAAmC,CAAC;CAOvE,MAAM,oBAAoB,GAAG,mBAAmB,EAAE;CAClD,MAAM,aACJ,QAAQ,qCAAqC,iBAAiB,GAC9D,uBACF;CACA,QAAQ,IACN,GAAG,OAAO,MAAM,GAAG,EAAE,iDAAiD,mBACxE;CAKA,MAAM,qBAAqB,QAAQ,6BAA6B,CAAC;CACjE,MAAM,aACJ,QAAQ,gDAAgD,GACxD,uBACF;CACA,MAAM,aAAa,QAAQ,sCAAsC,GAAG,4BAA4B;CAChG,QAAQ,IAAI,GAAG,OAAO,MAAM,GAAG,EAAE,yCAAyC;CAE1E,MAAM,qBAAqB,QAAQ,wCAAwC,CAAC;CAE5E,MAAM,wBAAwB,GAAG,mBAAmB,CAAC,EAAE;CACvD,MAAM,aACJ,QAAQ,0CAA0C,qBAAqB,GACvE,2BACF;CACA,QAAQ,IACN,GAAG,OAAO,MAAM,GAAG,EAAE,sDAAsD,uBAC7E;CAIA,MAAM,qBAAqB,QAAQ,qBAAqB,CAAC;CACzD,MAAM,aAAa,cAAc,kBAAkB;CACnD,QAAQ,IAAI,GAAG,OAAO,MAAM,GAAG,EAAE,oDAAoD;AACvF;AAEA,eAAe,2BAA2B,UAA6B;CACrE,MAAM,qBAAqB;CAC3B,MAAM,oBAAoB;AAC5B;AAEA,MAAa,gBAAmC;CAC9C,aACE;CACF,cAAc,EACZ,sBAAsB,0BACxB;CACA,aAAa;EACX,SAAS;EACT,MAAM;CACR;CACA,aAAa;AACf"}
+{"version":3,"file":"access.feature.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/generations/features/access.feature.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\nimport { ensureDirectoryAsync, fileExistsAsync, getFileAsync, putFileAsync } from \"@warlock.js/fs\";\nimport type { CommandActionData } from \"../../commands/types\";\nimport { srcPath } from \"../../utils\";\nimport {\n  accessConfigStub,\n  accessResolverStub,\n  accessRoleMigrationStub,\n  accessRoleModelIndexStub,\n  accessRoleModelStub,\n  accessUserRoleMigrationStub,\n  accessUserRoleModelIndexStub,\n  accessUserRoleModelStub,\n} from \"../stubs\";\nimport { migrationTimestamp } from \"./shared/migration-timestamp\";\nimport { type FeatureDefinition, INSTALLED_WARLOCK_VERSION } from \"./types\";\n\nasync function registerAccessLocale() {\n  const legacyLocalesPath = srcPath(\"app/shared/utils/locales.ts\");\n  const localesPath = srcPath(\"app/access/utils/locales.json\");\n  const forbidden = {\n    en: \"You do not have permission to perform this action.\",\n    ar: \"ليس لديك صلاحية لتنفيذ هذا الإجراء.\",\n  };\n\n  if (await fileExistsAsync(legacyLocalesPath)) {\n    const legacy = await getFileAsync(legacyLocalesPath);\n    if (legacy.includes(`groupedTranslations(\"access\"`)) {\n      console.log(`${colors.yellowBright(\"access\")} locale already registered, skipping...`);\n      return;\n    }\n  }\n\n  if (await fileExistsAsync(localesPath)) {\n    const current = await getFileAsync(localesPath);\n    let dictionary: Record<string, unknown>;\n    try {\n      const parsed: unknown = JSON.parse(current);\n      if (parsed === null || Array.isArray(parsed) || typeof parsed !== \"object\") throw new Error();\n      dictionary = parsed as Record<string, unknown>;\n    } catch {\n      console.log(\n        `${colors.yellowBright(\"access\")} locale JSON is invalid; add errors.forbidden to src/app/access/utils/locales.json manually.`,\n      );\n      return;\n    }\n\n    // A root `$group` renames the whole file's namespace; merging there would\n    // register the sentence under a key the access checks never read.\n    if (dictionary.$group !== undefined && dictionary.$group !== \"access\") {\n      console.log(\n        `${colors.yellowBright(\"access\")} locale JSON declares a different $group; add access.errors.forbidden manually.`,\n      );\n      return;\n    }\n\n    const errors = dictionary.errors;\n    if (\n      errors !== undefined &&\n      (errors === null || Array.isArray(errors) || typeof errors !== \"object\")\n    ) {\n      console.log(\n        `${colors.yellowBright(\"access\")} locale JSON cannot safely add errors.forbidden; update src/app/access/utils/locales.json manually.`,\n      );\n      return;\n    }\n    const entries = (errors ?? {}) as Record<string, unknown>;\n    if (entries.forbidden !== undefined) return;\n\n    entries.forbidden = forbidden;\n    dictionary.errors = entries;\n    await putFileAsync(localesPath, `${JSON.stringify(dictionary, null, 2)}\\n`);\n    console.log(\n      `${colors.green(\"✓\")} Registered the access locale in src/app/access/utils/locales.json`,\n    );\n    return;\n  }\n\n  await ensureDirectoryAsync(srcPath(\"app/access/utils\"));\n  await putFileAsync(localesPath, `${JSON.stringify({ errors: { forbidden } }, null, 2)}\\n`);\n  console.log(\n    `${colors.green(\"✓\")} Created src/app/access/utils/locales.json with the access locale`,\n  );\n}\n\nasync function scaffoldAccessFiles() {\n  // The resolver file is the sentinel for \"access already scaffolded\" — its\n  // presence means the role/user-role model folders and their timestamped\n  // migrations were created too, so we must not re-emit duplicate migrations on\n  // a second run.\n  const resolverPath = srcPath(\"app/access/services/access-resolver.ts\");\n\n  if (await fileExistsAsync(resolverPath)) {\n    console.log(\n      `${colors.yellowBright(\"src/app/access\")} already scaffolded, skipping resolver + role tables...`,\n    );\n\n    return;\n  }\n\n  // 1. Role catalog model folder (model + barrel + migration). The catalog row\n  //    is role name → granted permissions; managed at runtime in the DB.\n  await ensureDirectoryAsync(srcPath(\"app/access/models/role\"));\n  await putFileAsync(srcPath(\"app/access/models/role/role.model.ts\"), accessRoleModelStub);\n  await putFileAsync(srcPath(\"app/access/models/role/index.ts\"), accessRoleModelIndexStub);\n  console.log(`${colors.green(\"✓\")} Created src/app/access/models/role`);\n\n  await ensureDirectoryAsync(srcPath(\"app/access/models/role/migrations\"));\n\n  // Migration filenames carry a MM-DD-YYYY_HH-MM-SS prefix so cascade infers\n  // their createdAt and orders them deterministically (the migrate action\n  // discovers src/app/*/models/*/migrations/*). The two tables are independent\n  // (no FK between them), but the user-role migration is stamped a second later\n  // so the relative order is stable.\n  const roleMigrationFile = `${migrationTimestamp()}-role.migration.ts`;\n  await putFileAsync(\n    srcPath(\"app/access/models/role/migrations\", roleMigrationFile),\n    accessRoleMigrationStub,\n  );\n  console.log(\n    `${colors.green(\"✓\")} Created src/app/access/models/role/migrations/${roleMigrationFile}`,\n  );\n\n  // 2. UserRole assignment model folder (model + barrel + migration). The model\n  //    statics scope an unresolved tenant to GLOBAL rows only (security\n  //    invariant) — see the stub for the reasoning.\n  await ensureDirectoryAsync(srcPath(\"app/access/models/user-role\"));\n  await putFileAsync(\n    srcPath(\"app/access/models/user-role/user-role.model.ts\"),\n    accessUserRoleModelStub,\n  );\n  await putFileAsync(srcPath(\"app/access/models/user-role/index.ts\"), accessUserRoleModelIndexStub);\n  console.log(`${colors.green(\"✓\")} Created src/app/access/models/user-role`);\n\n  await ensureDirectoryAsync(srcPath(\"app/access/models/user-role/migrations\"));\n\n  const userRoleMigrationFile = `${migrationTimestamp(1)}-user-role.migration.ts`;\n  await putFileAsync(\n    srcPath(\"app/access/models/user-role/migrations\", userRoleMigrationFile),\n    accessUserRoleMigrationStub,\n  );\n  console.log(\n    `${colors.green(\"✓\")} Created src/app/access/models/user-role/migrations/${userRoleMigrationFile}`,\n  );\n\n  // 3. The DatabaseAccessResolver — the one required config seam, wired into\n  //    config/access.ts by the ejected stub.\n  await ensureDirectoryAsync(srcPath(\"app/access/services\"));\n  await putFileAsync(resolverPath, accessResolverStub);\n  console.log(`${colors.green(\"✓\")} Created src/app/access/services/access-resolver.ts`);\n}\n\nasync function completeAccessInstallation(_options: CommandActionData) {\n  await registerAccessLocale();\n  await scaffoldAccessFiles();\n}\n\nexport const accessFeature: FeatureDefinition = {\n  description:\n    \"Installs @warlock.js/access — authorization (RBAC + ABAC): permission checks, ABAC policies, and roles. Ejects config/access.ts, the DatabaseAccessResolver + Role/UserRole models and migrations into src/app/access, and registers the access locale in src/app/access/utils/locales.json\",\n  dependencies: {\n    \"@warlock.js/access\": INSTALLED_WARLOCK_VERSION,\n  },\n  ejectConfig: {\n    content: accessConfigStub,\n    name: \"access\",\n  },\n  onExecuting: completeAccessInstallation,\n};\n"],"mappings":";;;;;;;;;AAiBA,eAAe,uBAAuB;CACpC,MAAM,oBAAoB,QAAQ,6BAA6B;CAC/D,MAAM,cAAc,QAAQ,+BAA+B;CAC3D,MAAM,YAAY;EAChB,IAAI;EACJ,IAAI;CACN;CAEA,IAAI,MAAM,gBAAgB,iBAAiB,GAEzC;OAAI,MADiB,aAAa,iBAAiB,EACzC,CAAC,SAAS,8BAA8B,GAAG;GACnD,QAAQ,IAAI,GAAG,OAAO,aAAa,QAAQ,EAAE,wCAAwC;GACrF;EACF;;CAGF,IAAI,MAAM,gBAAgB,WAAW,GAAG;EACtC,MAAM,UAAU,MAAM,aAAa,WAAW;EAC9C,IAAI;EACJ,IAAI;GACF,MAAM,SAAkB,KAAK,MAAM,OAAO;GAC1C,IAAI,WAAW,QAAQ,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,UAAU,MAAM,IAAI,MAAM;GAC5F,aAAa;EACf,QAAQ;GACN,QAAQ,IACN,GAAG,OAAO,aAAa,QAAQ,EAAE,6FACnC;GACA;EACF;EAIA,IAAI,WAAW,WAAW,UAAa,WAAW,WAAW,UAAU;GACrE,QAAQ,IACN,GAAG,OAAO,aAAa,QAAQ,EAAE,gFACnC;GACA;EACF;EAEA,MAAM,SAAS,WAAW;EAC1B,IACE,WAAW,WACV,WAAW,QAAQ,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,WAC/D;GACA,QAAQ,IACN,GAAG,OAAO,aAAa,QAAQ,EAAE,oGACnC;GACA;EACF;EACA,MAAM,UAAW,UAAU,CAAC;EAC5B,IAAI,QAAQ,cAAc,QAAW;EAErC,QAAQ,YAAY;EACpB,WAAW,SAAS;EACpB,MAAM,aAAa,aAAa,GAAG,KAAK,UAAU,YAAY,MAAM,CAAC,EAAE,GAAG;EAC1E,QAAQ,IACN,GAAG,OAAO,MAAM,GAAG,EAAE,mEACvB;EACA;CACF;CAEA,MAAM,qBAAqB,QAAQ,kBAAkB,CAAC;CACtD,MAAM,aAAa,aAAa,GAAG,KAAK,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG;CACzF,QAAQ,IACN,GAAG,OAAO,MAAM,GAAG,EAAE,kEACvB;AACF;AAEA,eAAe,sBAAsB;CAKnC,MAAM,eAAe,QAAQ,wCAAwC;CAErE,IAAI,MAAM,gBAAgB,YAAY,GAAG;EACvC,QAAQ,IACN,GAAG,OAAO,aAAa,gBAAgB,EAAE,wDAC3C;EAEA;CACF;CAIA,MAAM,qBAAqB,QAAQ,wBAAwB,CAAC;CAC5D,MAAM,aAAa,QAAQ,sCAAsC,GAAG,mBAAmB;CACvF,MAAM,aAAa,QAAQ,iCAAiC,GAAG,wBAAwB;CACvF,QAAQ,IAAI,GAAG,OAAO,MAAM,GAAG,EAAE,oCAAoC;CAErE,MAAM,qBAAqB,QAAQ,mCAAmC,CAAC;CAOvE,MAAM,oBAAoB,GAAG,mBAAmB,EAAE;CAClD,MAAM,aACJ,QAAQ,qCAAqC,iBAAiB,GAC9D,uBACF;CACA,QAAQ,IACN,GAAG,OAAO,MAAM,GAAG,EAAE,iDAAiD,mBACxE;CAKA,MAAM,qBAAqB,QAAQ,6BAA6B,CAAC;CACjE,MAAM,aACJ,QAAQ,gDAAgD,GACxD,uBACF;CACA,MAAM,aAAa,QAAQ,sCAAsC,GAAG,4BAA4B;CAChG,QAAQ,IAAI,GAAG,OAAO,MAAM,GAAG,EAAE,yCAAyC;CAE1E,MAAM,qBAAqB,QAAQ,wCAAwC,CAAC;CAE5E,MAAM,wBAAwB,GAAG,mBAAmB,CAAC,EAAE;CACvD,MAAM,aACJ,QAAQ,0CAA0C,qBAAqB,GACvE,2BACF;CACA,QAAQ,IACN,GAAG,OAAO,MAAM,GAAG,EAAE,sDAAsD,uBAC7E;CAIA,MAAM,qBAAqB,QAAQ,qBAAqB,CAAC;CACzD,MAAM,aAAa,cAAc,kBAAkB;CACnD,QAAQ,IAAI,GAAG,OAAO,MAAM,GAAG,EAAE,oDAAoD;AACvF;AAEA,eAAe,2BAA2B,UAA6B;CACrE,MAAM,qBAAqB;CAC3B,MAAM,oBAAoB;AAC5B;AAEA,MAAa,gBAAmC;CAC9C,aACE;CACF,cAAc,EACZ,sBAAsB,0BACxB;CACA,aAAa;EACX,SAAS;EACT,MAAM;CACR;CACA,aAAa;AACf"}

package/esm/generations/features/ai-anthropic.feature.mjs

@@ -1,6 +1,6 @@
 import { INSTALLED_WARLOCK_VERSION } from "./types.mjs";
 
-//#region ../core/src/generations/features/ai-anthropic.feature.ts
+//#region ../../packages/core/src/generations/features/ai-anthropic.feature.ts
 const aiAnthropicFeature = {
 	description: "Anthropic (Claude) provider for @warlock.js/ai (pulls the core ai package)",
 	requires: ["ai"],

package/esm/generations/features/ai-anthropic.feature.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ai-anthropic.feature.mjs","names":[],"sources":["../../../../../../../../core/src/generations/features/ai-anthropic.feature.ts"],"sourcesContent":["import { type FeatureDefinition, INSTALLED_WARLOCK_VERSION } from \"./types\";\n\nexport const aiAnthropicFeature: FeatureDefinition = {\n  description: \"Anthropic (Claude) provider for @warlock.js/ai (pulls the core ai package)\",\n  requires: [\"ai\"],\n  dependencies: {\n    \"@warlock.js/ai-anthropic\": INSTALLED_WARLOCK_VERSION,\n  },\n};\n"],"mappings":";;;AAEA,MAAa,qBAAwC;CACnD,aAAa;CACb,UAAU,CAAC,IAAI;CACf,cAAc,EACZ,4BAA4B,0BAC9B;AACF"}
+{"version":3,"file":"ai-anthropic.feature.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/generations/features/ai-anthropic.feature.ts"],"sourcesContent":["import { type FeatureDefinition, INSTALLED_WARLOCK_VERSION } from \"./types\";\n\nexport const aiAnthropicFeature: FeatureDefinition = {\n  description: \"Anthropic (Claude) provider for @warlock.js/ai (pulls the core ai package)\",\n  requires: [\"ai\"],\n  dependencies: {\n    \"@warlock.js/ai-anthropic\": INSTALLED_WARLOCK_VERSION,\n  },\n};\n"],"mappings":";;;AAEA,MAAa,qBAAwC;CACnD,aAAa;CACb,UAAU,CAAC,IAAI;CACf,cAAc,EACZ,4BAA4B,0BAC9B;AACF"}

package/esm/generations/features/ai-bedrock.feature.mjs

@@ -1,6 +1,6 @@
 import { INSTALLED_WARLOCK_VERSION } from "./types.mjs";
 
-//#region ../core/src/generations/features/ai-bedrock.feature.ts
+//#region ../../packages/core/src/generations/features/ai-bedrock.feature.ts
 const aiBedrockFeature = {
 	description: "AWS Bedrock provider for @warlock.js/ai (pulls the core ai package)",
 	requires: ["ai"],

package/esm/generations/features/ai-bedrock.feature.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ai-bedrock.feature.mjs","names":[],"sources":["../../../../../../../../core/src/generations/features/ai-bedrock.feature.ts"],"sourcesContent":["import { type FeatureDefinition, INSTALLED_WARLOCK_VERSION } from \"./types\";\n\nexport const aiBedrockFeature: FeatureDefinition = {\n  description: \"AWS Bedrock provider for @warlock.js/ai (pulls the core ai package)\",\n  requires: [\"ai\"],\n  dependencies: {\n    \"@warlock.js/ai-bedrock\": INSTALLED_WARLOCK_VERSION,\n  },\n};\n"],"mappings":";;;AAEA,MAAa,mBAAsC;CACjD,aAAa;CACb,UAAU,CAAC,IAAI;CACf,cAAc,EACZ,0BAA0B,0BAC5B;AACF"}
+{"version":3,"file":"ai-bedrock.feature.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/generations/features/ai-bedrock.feature.ts"],"sourcesContent":["import { type FeatureDefinition, INSTALLED_WARLOCK_VERSION } from \"./types\";\n\nexport const aiBedrockFeature: FeatureDefinition = {\n  description: \"AWS Bedrock provider for @warlock.js/ai (pulls the core ai package)\",\n  requires: [\"ai\"],\n  dependencies: {\n    \"@warlock.js/ai-bedrock\": INSTALLED_WARLOCK_VERSION,\n  },\n};\n"],"mappings":";;;AAEA,MAAa,mBAAsC;CACjD,aAAa;CACb,UAAU,CAAC,IAAI;CACf,cAAc,EACZ,0BAA0B,0BAC5B;AACF"}

package/esm/generations/features/ai-google.feature.mjs

@@ -1,6 +1,6 @@
 import { INSTALLED_WARLOCK_VERSION } from "./types.mjs";
 
-//#region ../core/src/generations/features/ai-google.feature.ts
+//#region ../../packages/core/src/generations/features/ai-google.feature.ts
 const aiGoogleFeature = {
 	description: "Google (Gemini) provider for @warlock.js/ai (pulls the core ai package)",
 	requires: ["ai"],

package/esm/generations/features/ai-google.feature.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ai-google.feature.mjs","names":[],"sources":["../../../../../../../../core/src/generations/features/ai-google.feature.ts"],"sourcesContent":["import { type FeatureDefinition, INSTALLED_WARLOCK_VERSION } from \"./types\";\n\nexport const aiGoogleFeature: FeatureDefinition = {\n  description: \"Google (Gemini) provider for @warlock.js/ai (pulls the core ai package)\",\n  requires: [\"ai\"],\n  dependencies: {\n    \"@warlock.js/ai-google\": INSTALLED_WARLOCK_VERSION,\n  },\n};\n"],"mappings":";;;AAEA,MAAa,kBAAqC;CAChD,aAAa;CACb,UAAU,CAAC,IAAI;CACf,cAAc,EACZ,yBAAyB,0BAC3B;AACF"}
+{"version":3,"file":"ai-google.feature.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/generations/features/ai-google.feature.ts"],"sourcesContent":["import { type FeatureDefinition, INSTALLED_WARLOCK_VERSION } from \"./types\";\n\nexport const aiGoogleFeature: FeatureDefinition = {\n  description: \"Google (Gemini) provider for @warlock.js/ai (pulls the core ai package)\",\n  requires: [\"ai\"],\n  dependencies: {\n    \"@warlock.js/ai-google\": INSTALLED_WARLOCK_VERSION,\n  },\n};\n"],"mappings":";;;AAEA,MAAa,kBAAqC;CAChD,aAAa;CACb,UAAU,CAAC,IAAI;CACf,cAAc,EACZ,yBAAyB,0BAC3B;AACF"}

package/esm/generations/features/ai-ollama.feature.mjs

@@ -1,6 +1,6 @@
 import { INSTALLED_WARLOCK_VERSION } from "./types.mjs";
 
-//#region ../core/src/generations/features/ai-ollama.feature.ts
+//#region ../../packages/core/src/generations/features/ai-ollama.feature.ts
 const aiOllamaFeature = {
 	description: "Ollama provider for @warlock.js/ai (pulls the core ai package)",
 	requires: ["ai"],

package/esm/generations/features/ai-ollama.feature.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ai-ollama.feature.mjs","names":[],"sources":["../../../../../../../../core/src/generations/features/ai-ollama.feature.ts"],"sourcesContent":["import { type FeatureDefinition, INSTALLED_WARLOCK_VERSION } from \"./types\";\n\nexport const aiOllamaFeature: FeatureDefinition = {\n  description: \"Ollama provider for @warlock.js/ai (pulls the core ai package)\",\n  requires: [\"ai\"],\n  dependencies: {\n    \"@warlock.js/ai-ollama\": INSTALLED_WARLOCK_VERSION,\n  },\n};\n"],"mappings":";;;AAEA,MAAa,kBAAqC;CAChD,aAAa;CACb,UAAU,CAAC,IAAI;CACf,cAAc,EACZ,yBAAyB,0BAC3B;AACF"}
+{"version":3,"file":"ai-ollama.feature.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/generations/features/ai-ollama.feature.ts"],"sourcesContent":["import { type FeatureDefinition, INSTALLED_WARLOCK_VERSION } from \"./types\";\n\nexport const aiOllamaFeature: FeatureDefinition = {\n  description: \"Ollama provider for @warlock.js/ai (pulls the core ai package)\",\n  requires: [\"ai\"],\n  dependencies: {\n    \"@warlock.js/ai-ollama\": INSTALLED_WARLOCK_VERSION,\n  },\n};\n"],"mappings":";;;AAEA,MAAa,kBAAqC;CAChD,aAAa;CACb,UAAU,CAAC,IAAI;CACf,cAAc,EACZ,yBAAyB,0BAC3B;AACF"}

package/esm/generations/features/ai-openai.feature.mjs

@@ -1,6 +1,6 @@
 import { INSTALLED_WARLOCK_VERSION } from "./types.mjs";
 
-//#region ../core/src/generations/features/ai-openai.feature.ts
+//#region ../../packages/core/src/generations/features/ai-openai.feature.ts
 const aiOpenaiFeature = {
 	description: "OpenAI provider for @warlock.js/ai (pulls the core ai package)",
 	requires: ["ai"],

package/esm/generations/features/ai-openai.feature.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ai-openai.feature.mjs","names":[],"sources":["../../../../../../../../core/src/generations/features/ai-openai.feature.ts"],"sourcesContent":["import { type FeatureDefinition, INSTALLED_WARLOCK_VERSION } from \"./types\";\n\nexport const aiOpenaiFeature: FeatureDefinition = {\n  description: \"OpenAI provider for @warlock.js/ai (pulls the core ai package)\",\n  requires: [\"ai\"],\n  dependencies: {\n    \"@warlock.js/ai-openai\": INSTALLED_WARLOCK_VERSION,\n  },\n};\n"],"mappings":";;;AAEA,MAAa,kBAAqC;CAChD,aAAa;CACb,UAAU,CAAC,IAAI;CACf,cAAc,EACZ,yBAAyB,0BAC3B;AACF"}
+{"version":3,"file":"ai-openai.feature.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/generations/features/ai-openai.feature.ts"],"sourcesContent":["import { type FeatureDefinition, INSTALLED_WARLOCK_VERSION } from \"./types\";\n\nexport const aiOpenaiFeature: FeatureDefinition = {\n  description: \"OpenAI provider for @warlock.js/ai (pulls the core ai package)\",\n  requires: [\"ai\"],\n  dependencies: {\n    \"@warlock.js/ai-openai\": INSTALLED_WARLOCK_VERSION,\n  },\n};\n"],"mappings":";;;AAEA,MAAa,kBAAqC;CAChD,aAAa;CACb,UAAU,CAAC,IAAI;CACf,cAAc,EACZ,yBAAyB,0BAC3B;AACF"}

package/esm/generations/features/ai-panoptic.feature.mjs

@@ -1,7 +1,7 @@
 import { INSTALLED_WARLOCK_VERSION } from "./types.mjs";
 import { linkAiPackageImport } from "./shared/link-ai-package-import.mjs";
 
-//#region ../core/src/generations/features/ai-panoptic.feature.ts
+//#region ../../packages/core/src/generations/features/ai-panoptic.feature.ts
 const aiPanopticFeature = {
 	description: "Installs @warlock.js/ai-panoptic — observability for @warlock.js/ai (collector, exporters, zero-setup local dashboard) via ai.config({ panoptic }) (pulls the core ai package)",
 	requires: ["ai"],

package/esm/generations/features/ai-panoptic.feature.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ai-panoptic.feature.mjs","names":[],"sources":["../../../../../../../../core/src/generations/features/ai-panoptic.feature.ts"],"sourcesContent":["import { linkAiPackageImport } from \"./shared/link-ai-package-import\";\nimport { type FeatureDefinition, INSTALLED_WARLOCK_VERSION } from \"./types\";\n\nexport const aiPanopticFeature: FeatureDefinition = {\n  description:\n    \"Installs @warlock.js/ai-panoptic — observability for @warlock.js/ai (collector, exporters, zero-setup local dashboard) via ai.config({ panoptic }) (pulls the core ai package)\",\n  requires: [\"ai\"],\n  dependencies: {\n    \"@warlock.js/ai-panoptic\": INSTALLED_WARLOCK_VERSION,\n  },\n  onExecuting: () => linkAiPackageImport(\"@warlock.js/ai-panoptic\"),\n};\n"],"mappings":";;;;AAGA,MAAa,oBAAuC;CAClD,aACE;CACF,UAAU,CAAC,IAAI;CACf,cAAc,EACZ,2BAA2B,0BAC7B;CACA,mBAAmB,oBAAoB,yBAAyB;AAClE"}
+{"version":3,"file":"ai-panoptic.feature.mjs","names":[],"sources":["../../../../../../../../../packages/core/src/generations/features/ai-panoptic.feature.ts"],"sourcesContent":["import { linkAiPackageImport } from \"./shared/link-ai-package-import\";\nimport { type FeatureDefinition, INSTALLED_WARLOCK_VERSION } from \"./types\";\n\nexport const aiPanopticFeature: FeatureDefinition = {\n  description:\n    \"Installs @warlock.js/ai-panoptic — observability for @warlock.js/ai (collector, exporters, zero-setup local dashboard) via ai.config({ panoptic }) (pulls the core ai package)\",\n  requires: [\"ai\"],\n  dependencies: {\n    \"@warlock.js/ai-panoptic\": INSTALLED_WARLOCK_VERSION,\n  },\n  onExecuting: () => linkAiPackageImport(\"@warlock.js/ai-panoptic\"),\n};\n"],"mappings":";;;;AAGA,MAAa,oBAAuC;CAClD,aACE;CACF,UAAU,CAAC,IAAI;CACf,cAAc,EACZ,2BAA2B,0BAC7B;CACA,mBAAmB,oBAAoB,yBAAyB;AAClE"}