apiforge-analyzer 1.1.0 → 1.2.1

package/dist/esm/cli.js

@@ -1,245 +1,382 @@
 #!/usr/bin/env node
-import { group, intro, outro, text, select, password, tasks, note, log, isCancel, cancel, } from '@clack/prompts';
-import { readFileSync, existsSync, writeFileSync } from 'fs';
+import { group, intro, outro, text, select, password, confirm, tasks, note, log, isCancel, cancel, spinner, } from '@clack/prompts';
+import { readFileSync, existsSync, writeFileSync, unlinkSync } from 'fs';
 import { join } from 'path';
-// ─── ANSI helpers ─────────────────────────────────────────────────────────────
+import { spawn } from 'child_process';
+import axios from 'axios';
+// ─── ANSI colour helpers ──────────────────────────────────────────────────────
 const r = '\x1b[0m';
 const b = '\x1b[1m';
 const d = '\x1b[2m';
 const cy = '\x1b[36m';
 const gn = '\x1b[32m';
 const yl = '\x1b[33m';
-const mg = '\x1b[35m';
+const rd = '\x1b[31m';
 const wh = '\x1b[97m';
 const bold = (s) => `${b}${s}${r}`;
 const dim = (s) => `${d}${s}${r}`;
 const cyan = (s) => `${cy}${s}${r}`;
 const green = (s) => `${gn}${s}${r}`;
 const yellow = (s) => `${yl}${s}${r}`;
-const magenta = (s) => `${mg}${s}${r}`;
+const red = (s) => `${rd}${s}${r}`;
 const white = (s) => `${wh}${s}${r}`;
-// ─── Brand header ─────────────────────────────────────────────────────────────
+const VERSION = '1.2.0';
+// Built-in URLs — users never need to configure these
+const BACKEND_PROD = 'https://apiforgeapi.brainfogagency.com';
+const DASHBOARD_PROD = 'https://apiforge.brainfogagency.com/dashboard';
+// Local overrides — only used when testing APIForge itself
+const BACKEND_LOCAL = 'http://localhost:4000';
+const DASHBOARD_LOCAL = 'http://localhost:3000/dashboard';
+const STATUS_FILE = '.apiforge-status.json';
+const LOCK_FILE = '.apiforge-last-run.json';
+// ─── Header ───────────────────────────────────────────────────────────────────
 function printHeader() {
-    const lines = [
+    console.log([
         '',
         `  ${cyan('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━')}`,
         '',
-        `  ${bold(white('⚡  APIForge'))}   ${dim('v1.1.0')}`,
+        `  ${bold(white('⚡  APIForge'))}   ${dim(`v${VERSION}`)}`,
         `  ${dim('AI-powered API documentation, auto-generated')}`,
         '',
         `  ${dim('Your entire API, documented in under 60 seconds.')}`,
         '',
         `  ${cyan('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━')}`,
         '',
-    ];
-    console.log(lines.join('\n'));
+    ].join('\n'));
 }
-// ─── Shared state across tasks ────────────────────────────────────────────────
-let detectedEntry = '';
-let detectedAppVar = 'app';
-let detectedIsESM = false;
-let detectedFramework = 'unknown';
-let injectionPoint = '';
-let wasAlreadySetup = false;
-let linesAdded = 0;
-// ─── Main ─────────────────────────────────────────────────────────────────────
+// ─── Entry point ─────────────────────────────────────────────────────────────
 async function main() {
-    process.stdout.write('\x1Bc'); // clear screen
+    process.stdout.write('\x1Bc');
     printHeader();
-    intro(bold(` ${cyan('⚡')} APIForge Setup `));
-    // ── Questions (grouped so cancel is handled once) ──────────────────────────
+    intro(bold(` ${cyan('⚡')} APIForge Analyzer `));
+    // ── Collect setup answers ─────────────────────────────────────────────────
     const answers = await group({
         projectName: () => text({
-            message: 'Name your project',
-            placeholder: 'My Awesome API',
-            validate: (v) => (!v.trim() ? 'Project name cannot be empty' : undefined),
+            message: 'Project name',
+            placeholder: 'My API',
+            validate: v => (!v.trim() ? 'Required' : undefined),
         }),
         apiKey: () => password({
             message: `APIForge API key  ${dim('(get one at apiforge.brainfogagency.com/dashboard)')}`,
-            validate: (v) => {
+            validate: v => {
                 if (!v.trim())
-                    return 'API key is required';
+                    return 'Required';
                 if (!v.trim().startsWith('afg_'))
                     return 'Key must start with afg_';
             },
         }),
         baseUrl: () => text({
-            message: 'Your server base URL',
+            message: 'Your server base URL  (for documentation)',
             placeholder: 'https://api.myapp.com',
             initialValue: 'http://localhost:3000',
-            validate: (v) => (!v.trim() ? 'Base URL is required' : undefined),
-        }),
-        method: () => select({
-            message: 'Sync method',
-            options: [
-                {
-                    value: 'runtime',
-                    label: `${bold('Runtime')}  ${dim('→')}  auto-syncs on every server start`,
-                    hint: 'recommended',
-                },
-                {
-                    value: 'json',
-                    label: `${bold('Export JSON')}  ${dim('→')}  write api-export.json, import to dashboard`,
-                },
-            ],
+            validate: v => (!v.trim() ? 'Required' : undefined),
         }),
     }, {
         onCancel: () => {
-            cancel(dim('Setup cancelled. Come back when you\'re ready.'));
+            cancel(dim('Cancelled.'));
             process.exit(0);
         },
     });
     if (isCancel(answers))
         process.exit(0);
-    const { projectName, apiKey, baseUrl, method } = answers;
+    const { projectName, apiKey, baseUrl } = answers;
+    // ── Select run command ────────────────────────────────────────────────────
+    const scripts = detectScripts();
+    const scriptOptions = scripts.map(s => ({
+        value: s.command,
+        label: `${bold(s.name)}  ${dim('→')}  ${dim(s.command)}`,
+    }));
+    if (scriptOptions.length === 0) {
+        log.warn('No scripts found in package.json — please ensure you have a start/dev script.');
+        cancel('No run script available.');
+        process.exit(1);
+    }
+    const runCommand = await select({
+        message: 'Which command starts your server?',
+        options: scriptOptions,
+    });
+    if (isCancel(runCommand)) {
+        cancel('Cancelled.');
+        process.exit(0);
+    }
+    // ── Select backend ────────────────────────────────────────────────────────
+    const backendChoice = await select({
+        message: 'Send routes to',
+        options: [
+            {
+                value: 'production',
+                label: `${bold('Production')}  ${dim('→')}  ${dim(BACKEND_PROD)}`,
+                hint: 'recommended',
+            },
+            {
+                value: 'local',
+                label: `${bold('Local')}  ${dim('→')}  ${dim(BACKEND_LOCAL)}`,
+                hint: 'for testing APIForge locally',
+            },
+        ],
+    });
+    if (isCancel(backendChoice)) {
+        cancel('Cancelled.');
+        process.exit(0);
+    }
+    const isLocal = backendChoice === 'local';
+    const backendUrl = isLocal ? BACKEND_LOCAL : BACKEND_PROD;
+    const dashboardUrl = isLocal ? DASHBOARD_LOCAL : DASHBOARD_PROD;
     log.info(dim('─────────────────────────────────────────────────'));
     log.info(`${dim('Project:')}  ${bold(projectName)}`);
-    log.info(`${dim('Mode:')}     ${bold(method === 'runtime' ? 'Runtime sync' : 'Export JSON')}`);
-    log.info(`${dim('Base URL:')} ${cyan(baseUrl)}`);
+    log.info(`${dim('Command:')}  ${bold(runCommand)}`);
+    log.info(`${dim('Backend:')}  ${cyan(backendUrl)}`);
     log.info(dim('─────────────────────────────────────────────────'));
-    // ── Need to ask for entry file? Do pre-scan first ─────────────────────────
-    const preDetected = detectEntryFile();
-    let entryFile;
-    if (!preDetected) {
-        log.warn('Could not auto-detect your server entry file.');
-        const custom = await text({
-            message: 'Path to your server entry file',
-            placeholder: 'src/index.ts',
-            validate: (v) => {
-                if (!v.trim())
-                    return 'Required';
-                if (!existsSync(join(process.cwd(), v.trim())))
-                    return `Not found: ${v.trim()}`;
-            },
-        });
-        if (isCancel(custom)) {
-            cancel('Setup cancelled.');
-            process.exit(0);
-        }
-        entryFile = custom.trim();
-    }
-    else {
-        entryFile = preDetected;
-    }
-    // ── Multi-step animated tasks ──────────────────────────────────────────────
+    // ── Detect & patch entry file ─────────────────────────────────────────────
+    const entryFile = detectEntryFile() ?? await askEntryFile();
+    let injected = false;
+    let linesAdded = 0;
     await tasks([
         {
-            title: `Scanning project`,
-            task: async (msg) => {
-                await sleep(350);
-                detectedEntry = entryFile;
-                msg(`Reading ${detectedEntry}`);
-                await sleep(250);
-                return `${green('✓')} Entry file: ${bold(detectedEntry)}`;
-            },
-        },
-        {
-            title: 'Analysing server file',
+            title: 'Scanning project',
             task: async (msg) => {
                 await sleep(200);
-                const fullPath = join(process.cwd(), detectedEntry);
-                const src = readFileSync(fullPath, 'utf-8');
-                detectedIsESM = detectESM(detectedEntry, src);
-                detectedAppVar = detectAppVariable(src) ?? 'app';
-                detectedFramework = detectFramework(src);
-                msg(`Detected ${detectedFramework}`);
-                await sleep(300);
-                const moduleType = detectedIsESM ? 'ESM' : 'CJS';
-                return [
-                    `${green('✓')} Framework: ${bold(detectedFramework)}`,
-                    `   Module:    ${bold(moduleType)}`,
-                    `   App var:   ${bold(detectedAppVar)}`,
-                ].join('\n');
+                msg(`Found entry file: ${entryFile}`);
+                await sleep(150);
+                return `${green('✓')} Entry: ${bold(entryFile)}`;
             },
         },
         {
             title: 'Patching server file',
             task: async (msg) => {
-                await sleep(300);
-                msg('Generating snippet…');
-                await sleep(200);
-                const result = injectCode(detectedEntry, projectName, apiKey, baseUrl, method);
-                wasAlreadySetup = result.alreadyInjected;
-                injectionPoint = result.injectionPoint ?? 'end of file';
+                msg('Injecting analyzer…');
+                await sleep(100);
+                // Clear stale status + lock files before starting
+                tryUnlink(join(process.cwd(), STATUS_FILE));
+                tryUnlink(join(process.cwd(), LOCK_FILE));
+                // Store API key in .env.local — never embed it in source code
+                persistApiKeyToEnv(apiKey);
+                const result = injectCode(entryFile, projectName, apiKey, baseUrl, backendUrl);
+                injected = !result.alreadyInjected;
                 linesAdded = result.linesAdded ?? 0;
-                msg(result.alreadyInjected ? 'Already configured' : `Writing to ${detectedEntry}`);
-                await sleep(300);
                 if (result.alreadyInjected) {
-                    return `${yellow('◌')} Already set up — no changes made`;
+                    return `${yellow('◌')} Already configured — no changes made`;
                 }
                 return [
-                    `${green('✓')} Patched: ${bold(detectedEntry)}  ${dim(`+${linesAdded} lines`)}`,
-                    `   At:      ${dim(injectionPoint)}`,
+                    `${green('✓')} Patched ${bold(entryFile)}  ${dim(`+${linesAdded} lines`)}`,
+                    `   ${green('✓')} API key saved to ${bold('.env.local')}  ${dim('(gitignored)')}`,
                 ].join('\n');
             },
         },
-        {
-            title: 'Verifying patch',
-            task: async (msg) => {
-                await sleep(200);
-                if (wasAlreadySetup) {
-                    return `${yellow('◌')} Skipped — file was already configured`;
-                }
-                const src = readFileSync(join(process.cwd(), detectedEntry), 'utf-8');
-                if (!src.includes('apiforge-analyzer')) {
-                    throw new Error('Patch verification failed — please add the snippet manually');
-                }
-                msg('Confirmed apiforge-analyzer in file');
-                await sleep(200);
-                return `${green('✓')} Verified`;
-            },
-        },
     ]);
-    // ── Summary note ───────────────────────────────────────────────────────────
-    if (wasAlreadySetup) {
-        note([
-            bold('Already good to go!'),
-            '',
-            dim(`APIForge is already configured in ${bold(detectedEntry)}.`),
-            dim('No changes were made.'),
-        ].join('\n'), 'Status');
+    // ── Start server + wait for analysis ──────────────────────────────────────
+    note([
+        bold('Starting your server…'),
+        '',
+        `  ${dim('Command:')}  ${cyan(runCommand)}`,
+        `  ${dim('Watching')} .apiforge-status.json ${dim('for completion signal')}`,
+    ].join('\n'), 'Running');
+    const s = spinner();
+    s.start('Starting server and analyzing routes…');
+    const serverResult = await startAndWaitForAnalysis(runCommand, 90000);
+    if (serverResult.status === 'error') {
+        s.stop(red(`✗ ${serverResult.message}`));
+        // Give a targeted hint for common failure modes
+        if (serverResult.message.includes('API key')) {
+            log.warn(yellow('Hint: The CLI wrote your key to .env.local — but your server may not load it.'));
+            log.warn(yellow('      Add this at the top of your entry file before calling analyze():'));
+            log.info(`      ${cyan("require('dotenv').config({ path: '.env.local' })")}`);
+            log.warn(yellow('      Or install dotenv:  npm install dotenv'));
+        }
+        else if (serverResult.message.includes('No routes')) {
+            log.warn(yellow('Hint: Make sure all routes are registered before analyze() is called.'));
+            log.warn(yellow('      The analyze() call should come AFTER all router.use() / app.get() etc.'));
+        }
+        else if (serverResult.message.includes('Timed out')) {
+            log.warn(yellow('Hint: Your server might be taking too long to start, or the analyzer'));
+            log.warn(yellow('      is not being called. Check your server logs for APIForge messages.'));
+        }
+        await offerCleanup(entryFile, injected);
+        outro(red('Analysis failed.'));
+        process.exit(1);
     }
-    else {
-        const snippetPreview = getSnippetPreview(method, detectedAppVar);
+    s.stop(green(`✓ ${serverResult.routeCount} routes submitted to APIForge`));
+    // ── Poll for dashboard approval ───────────────────────────────────────────
+    const { pendingImportId } = serverResult;
+    note([
+        bold('Open your dashboard to review:'),
+        '',
+        `  ${cyan(dashboardUrl)}`,
+        '',
+        dim(`In "Import JSON" → "Pending CLI Imports"`),
+        dim('Accept to start AI processing  ·  Deny to discard.'),
+    ].join('\n'), 'Action required');
+    const poll = spinner();
+    poll.start('Waiting for your decision in the dashboard…  (5 min timeout)');
+    const approval = await pollForApproval(pendingImportId, apiKey, backendUrl, 5 * 60000);
+    if (approval.status === 'approved') {
+        poll.stop(green('✓ Accepted — AI processing started!'));
         note([
-            `  ${dim('File')}     ${bold(detectedEntry)}  ${dim(`+${linesAdded} lines`)}`,
-            `  ${dim('Mode')}     ${bold(method === 'json' ? 'Export JSON' : 'Runtime sync')}`,
-            `  ${dim('App var')}  ${bold(detectedAppVar)}  ${dim('(auto-detected)')}`,
-            `  ${dim('Format')}   ${bold(detectedIsESM ? 'ESM (import)' : 'CJS (require)')}`,
+            bold('Your API is being documented.'),
             '',
-            dim('Injected snippet:'),
-            '',
-            ...snippetPreview.map(line => `  ${cyan('│')} ${dim(line)}`),
-        ].join('\n'), 'Patch summary');
+            `  ${dim('Track progress:')}  ${cyan(dashboardUrl)}`,
+            `  ${dim('Import ID:')}       ${dim(pendingImportId)}`,
+        ].join('\n'), 'Processing');
     }
-    // ── Next steps + outro ─────────────────────────────────────────────────────
-    if (method === 'json') {
+    else if (approval.status === 'denied') {
+        poll.stop(red('✗ Import denied by dashboard.'));
         note([
-            bold('What to do next:'),
-            '',
-            `  ${dim('1.')} Start your server once:`,
-            `     ${cyan(getStartCommand())}`,
+            `  ${bold('You denied this import from the dashboard.')}`,
             '',
-            `  ${dim('2.')} Upload ${bold('api-export.json')} to the dashboard:`,
-            `     ${cyan('https://apiforge.brainfogagency.com/dashboard')}`,
-            '',
-            `  ${dim('3.')} Your AI-enhanced docs appear in seconds.`,
-        ].join('\n'), 'Next steps');
-        outro(`${green('✓')}  All set — run your server to generate the export.`);
+            `  ${dim('No documentation was generated.')}`,
+            `  ${dim('Run')} ${cyan('npx apiforge')} ${dim('again whenever you\'re ready.')}`,
+        ].join('\n'), 'Denied');
     }
     else {
+        poll.stop(yellow('◌ Timed out — no decision made within 5 minutes.'));
         note([
-            bold('What to do next:'),
-            '',
-            `  ${dim('1.')} Start your server as normal:`,
-            `     ${cyan(getStartCommand())}`,
+            `  ${dim('Your import is still pending:')}`,
+            `  ${cyan(dashboardUrl)}`,
             '',
-            `  ${dim('2.')} APIForge detects all routes automatically.`,
-            '',
-            `  ${dim('3.')} View your live docs:`,
-            `     ${cyan('https://apiforge.brainfogagency.com/dashboard')}`,
-        ].join('\n'), 'Next steps');
-        outro(`${green('✓')}  All set — start your server and docs will sync automatically.`);
+            `  ${dim('Import ID:')}  ${cyan(pendingImportId)}`,
+            `  ${dim('You can still accept or deny it from the dashboard.')}`,
+        ].join('\n'), 'Pending');
+    }
+    // ── Cleanup ───────────────────────────────────────────────────────────────
+    await offerCleanup(entryFile, injected);
+    tryUnlink(join(process.cwd(), STATUS_FILE));
+    tryUnlink(join(process.cwd(), LOCK_FILE));
+    const outroMsg = {
+        approved: `${green('✓')}  Done! View your AI docs at ${cyan(dashboardUrl)}`,
+        denied: `${red('✗')}  Import denied. No changes were made.`,
+        timeout: `${yellow('◌')}  Timed out. Your import is still pending at ${cyan(dashboardUrl)}`,
+    }[approval.status];
+    outro(outroMsg);
+}
+function startAndWaitForAnalysis(command, timeoutMs) {
+    return new Promise(resolve => {
+        const statusPath = join(process.cwd(), STATUS_FILE);
+        const child = spawn(command, {
+            cwd: process.cwd(),
+            stdio: 'ignore',
+            shell: true,
+            env: { ...process.env },
+            detached: false,
+        });
+        let resolved = false;
+        function finish(result) {
+            if (resolved)
+                return;
+            resolved = true;
+            clearInterval(poller);
+            clearTimeout(timeout);
+            try {
+                child.kill('SIGTERM');
+            }
+            catch { }
+            resolve(result);
+        }
+        // Poll for the status file every 500 ms
+        const poller = setInterval(() => {
+            try {
+                if (!existsSync(statusPath))
+                    return;
+                const data = JSON.parse(readFileSync(statusPath, 'utf-8'));
+                if (data.status === 'submitted') {
+                    finish({
+                        status: 'submitted',
+                        pendingImportId: data.pendingImportId ?? '',
+                        routeCount: data.routeCount ?? 0,
+                        message: `${data.routeCount ?? 0} routes submitted`,
+                    });
+                }
+                else if (data.status === 'error') {
+                    finish({
+                        status: 'error',
+                        pendingImportId: '',
+                        routeCount: 0,
+                        message: data.error ?? 'Upload failed',
+                    });
+                }
+            }
+            catch { }
+        }, 500);
+        const timeout = setTimeout(() => {
+            finish({
+                status: 'error',
+                pendingImportId: '',
+                routeCount: 0,
+                message: 'Timed out waiting for analysis (90 s). Is the server starting correctly?',
+            });
+        }, timeoutMs);
+        child.on('error', err => {
+            finish({ status: 'error', pendingImportId: '', routeCount: 0, message: err.message });
+        });
+        child.on('exit', (code, signal) => {
+            if (!resolved && signal !== 'SIGTERM' && code !== 0) {
+                finish({
+                    status: 'error',
+                    pendingImportId: '',
+                    routeCount: 0,
+                    message: `Server exited unexpectedly (code ${code})`,
+                });
+            }
+        });
+    });
+}
+// ─── Backend polling ──────────────────────────────────────────────────────────
+async function pollForApproval(pendingImportId, apiKey, backendUrl, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        try {
+            const res = await axios.get(`${backendUrl}/api/cli/${pendingImportId}/status`, {
+                headers: { 'X-API-Key': apiKey },
+                timeout: 8000,
+            });
+            const { status } = res.data?.data ?? {};
+            if (status === 'approved')
+                return { status: 'approved' };
+            if (status === 'denied')
+                return { status: 'denied' };
+        }
+        catch { }
+        await sleep(3000);
+    }
+    return { status: 'timeout' };
+}
+// ─── Cleanup helpers ──────────────────────────────────────────────────────────
+async function offerCleanup(entryFile, wasInjected) {
+    if (!wasInjected)
+        return;
+    const shouldClean = await confirm({
+        message: `Remove APIForge code changes from ${bold(entryFile)}?`,
+        initialValue: true,
+    });
+    if (isCancel(shouldClean) || !shouldClean)
+        return;
+    const removed = removeInjectedCode(entryFile);
+    if (removed) {
+        log.success(green(`✓ Removed code changes from ${entryFile}`));
+    }
+    else {
+        log.warn(yellow('Could not auto-remove — please delete the APIForge block manually.'));
+    }
+}
+function removeInjectedCode(filePath) {
+    const fullPath = join(process.cwd(), filePath);
+    try {
+        const content = readFileSync(fullPath, 'utf-8');
+        const startIdx = content.indexOf('// APIForge');
+        if (startIdx === -1)
+            return false;
+        const afterStart = content.slice(startIdx);
+        const endMatch = /\.catch\s*\(\s*\(\s*\)\s*=>\s*\{?\s*\}?\s*\)\s*\n?/.exec(afterStart);
+        if (!endMatch)
+            return false;
+        const endIdx = startIdx + endMatch.index + endMatch[0].length;
+        const cleaned = (content.slice(0, startIdx) + content.slice(endIdx))
+            .replace(/\n{3,}/g, '\n\n')
+            .trimEnd() + '\n';
+        writeFileSync(fullPath, cleaned, 'utf-8');
+        return true;
+    }
+    catch {
+        return false;
     }
 }
 // ─── Entry file detection ─────────────────────────────────────────────────────
@@ -249,9 +386,9 @@ function detectEntryFile() {
         const pkg = JSON.parse(readFileSync(join(cwd, 'package.json'), 'utf-8'));
         if (pkg.main && existsSync(join(cwd, pkg.main)))
             return pkg.main;
-        for (const script of ['start', 'dev', 'serve']) {
-            const cmd = pkg.scripts?.[script] ?? '';
-            const m = cmd.match(/(?:node|tsx|ts-node)\s+([^\s&|;]+\.(js|ts|mjs|cjs))/);
+        for (const s of ['start', 'dev', 'serve']) {
+            const cmd = pkg.scripts?.[s] ?? '';
+            const m = cmd.match(/(?:node|tsx|ts-node|nodemon)\s+([^\s&|;]+\.(js|ts|mjs|cjs))/);
             if (m && existsSync(join(cwd, m[1])))
                 return m[1];
         }
@@ -263,36 +400,60 @@ function detectEntryFile() {
         'src/index.ts', 'src/server.ts', 'src/app.ts',
         'src/index.js', 'src/server.js', 'src/app.js',
     ];
-    for (const c of candidates)
-        if (existsSync(join(cwd, c)))
-            return c;
-    return null;
+    return candidates.find(c => existsSync(join(cwd, c))) ?? null;
 }
-// ─── Framework detection from source ─────────────────────────────────────────
-function detectFramework(src) {
-    if (/require\s*\(\s*['"]express['"]\s*\)|from\s+['"]express['"]/.test(src))
-        return 'Express';
-    if (/require\s*\(\s*['"]fastify['"]\s*\)|from\s+['"]fastify['"]/.test(src))
-        return 'Fastify';
-    if (/require\s*\(\s*['"]koa['"]\s*\)|from\s+['"]koa['"]/.test(src))
-        return 'Koa';
-    if (/require\s*\(\s*['"]hapi['"]\s*\)|from\s+['"]@hapi\/hapi['"]/.test(src))
-        return 'Hapi';
-    if (/from\s+['"]next\/server['"]|NextResponse/.test(src))
-        return 'Next.js';
-    if (/createServer|http\.createServer/.test(src))
-        return 'Node HTTP';
-    return 'Node.js';
+async function askEntryFile() {
+    log.warn('Could not auto-detect your server entry file.');
+    const custom = await text({
+        message: 'Path to your server entry file',
+        placeholder: 'src/index.ts',
+        validate: v => {
+            if (!v.trim())
+                return 'Required';
+            if (!existsSync(join(process.cwd(), v.trim())))
+                return `Not found: ${v.trim()}`;
+        },
+    });
+    if (isCancel(custom)) {
+        cancel('Cancelled.');
+        process.exit(0);
+    }
+    return custom.trim();
 }
-function injectCode(filePath, projectName, apiKey, baseUrl, method) {
+function detectScripts() {
+    try {
+        const pkg = JSON.parse(readFileSync(join(process.cwd(), 'package.json'), 'utf-8'));
+        const scripts = pkg.scripts ?? {};
+        const preferred = ['dev', 'start', 'serve', 'run', 'develop'];
+        const result = [];
+        // Preferred scripts first
+        for (const name of preferred) {
+            if (scripts[name])
+                result.push({ name, command: `npm run ${name}` });
+        }
+        // Then any remaining scripts that look like server starters
+        for (const [name, cmd] of Object.entries(scripts)) {
+            if (preferred.includes(name))
+                continue;
+            if (/node|tsx|ts-node|nodemon|server/i.test(cmd)) {
+                result.push({ name, command: `npm run ${name}` });
+            }
+        }
+        return result;
+    }
+    catch {
+        return [];
+    }
+}
+function injectCode(filePath, projectName, apiKey, baseUrl, backendUrl) {
     const fullPath = join(process.cwd(), filePath);
     const content = readFileSync(fullPath, 'utf-8');
     if (content.includes('apiforge-analyzer')) {
-        return { message: 'Already configured', alreadyInjected: true };
+        return { alreadyInjected: true };
     }
     const isESM = detectESM(filePath, content);
     const appVar = detectAppVariable(content) ?? 'app';
-    const snippet = getCodeSnippet(projectName, apiKey, baseUrl, method, appVar, isESM);
+    const snippet = buildSnippet(projectName, apiKey, baseUrl, backendUrl, appVar, isESM);
     const listenRe = /\b(?:app|server|httpServer|http)\s*\.listen\s*\(/;
     const listenMatch = listenRe.exec(content);
     let newContent;
@@ -307,59 +468,55 @@ function injectCode(filePath, projectName, apiKey, baseUrl, method) {
         injectionPoint = 'end of file';
     }
     writeFileSync(fullPath, newContent, 'utf-8');
-    const linesAdded = snippet.split('\n').length;
-    return {
-        message: `Patched ${filePath}`,
-        alreadyInjected: false,
-        appVar,
-        injectionPoint,
-        linesAdded,
-    };
+    return { alreadyInjected: false, injectionPoint, linesAdded: snippet.split('\n').length };
 }
-function detectESM(filePath, content) {
+/**
+ * Write (or overwrite) the API key in .env.local.
+ * Always overwrites so the key stays in sync with what the user entered —
+ * keeping a stale key would cause submit/poll key mismatch and 401s.
+ */
+function persistApiKeyToEnv(apiKey) {
+    const envPath = join(process.cwd(), '.env.local');
+    const marker = 'APIFORGE_API_KEY=';
     try {
-        const pkg = JSON.parse(readFileSync(join(process.cwd(), 'package.json'), 'utf-8'));
-        if (pkg.type === 'module')
-            return true;
+        let content = existsSync(envPath) ? readFileSync(envPath, 'utf-8') : '';
+        if (content.includes(marker)) {
+            // Replace existing value — regex matches the whole line
+            content = content.replace(/^APIFORGE_API_KEY=.*/m, `${marker}${apiKey}`);
+        }
+        else {
+            content = content.trimEnd() + `\n# APIForge CLI key (safe to delete after analysis)\n${marker}${apiKey}\n`;
+        }
+        writeFileSync(envPath, content, 'utf-8');
     }
     catch { }
-    if (filePath.endsWith('.mjs'))
-        return true;
-    if (filePath.endsWith('.cjs'))
-        return false;
-    return /^(?:import|export)\s+/m.test(content);
+    addToGitignore('.env.local');
+    addToGitignore('.apiforge-status.json');
+    addToGitignore('.apiforge-last-run.json');
 }
-function detectAppVariable(content) {
-    let m = content.match(/(?:const|let|var)\s+(\w+)\s*=\s*express\s*(?:\.default)?\s*\(/);
-    if (m)
-        return m[1];
-    m = content.match(/(?:const|let|var)\s+(\w+)\s*=\s*(?:fastify|Fastify)\s*\(/);
-    if (m)
-        return m[1];
-    m = content.match(/(?:const|let|var)\s+(\w+)\s*=\s*new\s+Koa\s*\(/);
-    if (m)
-        return m[1];
-    return null;
+function addToGitignore(pattern) {
+    const giPath = join(process.cwd(), '.gitignore');
+    try {
+        const current = existsSync(giPath) ? readFileSync(giPath, 'utf-8') : '';
+        if (!current.split('\n').some(l => l.trim() === pattern)) {
+            writeFileSync(giPath, current.trimEnd() + `\n${pattern}\n`, 'utf-8');
+        }
+    }
+    catch { }
 }
-// ─── Snippet builder ──────────────────────────────────────────────────────────
-function getCodeSnippet(projectName, apiKey, baseUrl, method, appVar, isESM) {
-    const isJson = method === 'json';
-    const opts = isJson
-        ? [
-            `    apiKey: '${apiKey}',`,
-            `    projectName: '${projectName}',`,
-            `    baseUrl: '${baseUrl}',`,
-            `    saveJson: true,`,
-            `    jsonPath: './api-export.json',`,
-            `    upload: false,`,
-        ].join('\n')
-        : [
-            `    apiKey: '${apiKey}',`,
-            `    projectName: '${projectName}',`,
-            `    baseUrl: '${baseUrl}',`,
-            `    apiForgeUrl: 'https://apiforge.brainfogagency.com',`,
-            `    upload: true,`,
-        ].join('\n');
+function buildSnippet(projectName, apiKey, baseUrl, backendUrl, appVar, isESM) {
+    // The API key is embedded directly — this snippet is TEMPORARY (auto-removed after analysis).
+    // Hardcoding guarantees the same key is used for both submit and CLI status polling,
+    // eliminating the mismatch that causes 401s when .env.local already has a different key.
+    const isProd = backendUrl === BACKEND_PROD;
+    const opts = [
+        `    apiKey: '${apiKey}',`,
+        `    projectName: '${projectName}',`,
+        `    baseUrl: '${baseUrl}',`,
+        ...(isProd ? [] : [`    apiForgeUrl: '${backendUrl}',`]),
+        `    upload: true,`,
+        `    runOnce: true,`,
+    ].join('\n');
     if (isESM) {
         return [
             `// APIForge — https://apiforge.brainfogagency.com`,
@@ -382,36 +539,46 @@ function getCodeSnippet(projectName, apiKey, baseUrl, method, appVar, isESM) {
         '',
     ].join('\n');
 }
-/** First 4 lines of the injected snippet for the summary preview. */
-function getSnippetPreview(method, appVar) {
-    const isJson = method === 'json';
-    return [
-        `// APIForge — https://apiforge.brainfogagency.com`,
-        `import('apiforge-analyzer').then(({ default: APIForge }) => {`,
-        `  APIForge.analyze(${appVar}, {`,
-        `    ${isJson ? 'saveJson: true, upload: false,' : 'upload: true,'}`,
-        `  …`,
+function detectESM(filePath, content) {
+    try {
+        const pkg = JSON.parse(readFileSync(join(process.cwd(), 'package.json'), 'utf-8'));
+        if (pkg.type === 'module')
+            return true;
+    }
+    catch { }
+    if (filePath.endsWith('.mjs'))
+        return true;
+    if (filePath.endsWith('.cjs'))
+        return false;
+    return /^(?:import|export)\s+/m.test(content);
+}
+function detectAppVariable(content) {
+    const patterns = [
+        /(?:const|let|var)\s+(\w+)\s*=\s*express\s*(?:\.default)?\s*\(/,
+        /(?:const|let|var)\s+(\w+)\s*=\s*(?:fastify|Fastify)\s*\(/,
+        /(?:const|let|var)\s+(\w+)\s*=\s*new\s+Koa\s*\(/,
+        /(?:const|let|var)\s+(\w+)\s*=\s*(?:Router|createApp|createServer)\s*\(/,
     ];
+    for (const re of patterns) {
+        const m = content.match(re);
+        if (m)
+            return m[1];
+    }
+    return null;
 }
-/** Best-guess start command from package.json scripts. */
-function getStartCommand() {
+// ─── Utilities ────────────────────────────────────────────────────────────────
+function tryUnlink(p) {
     try {
-        const pkg = JSON.parse(readFileSync(join(process.cwd(), 'package.json'), 'utf-8'));
-        if (pkg.scripts?.start)
-            return 'npm start';
-        if (pkg.scripts?.dev)
-            return 'npm run dev';
-        if (pkg.scripts?.serve)
-            return 'npm run serve';
+        if (existsSync(p))
+            unlinkSync(p);
     }
     catch { }
-    return 'node ' + (detectedEntry || 'index.js');
 }
-// ─── Util ─────────────────────────────────────────────────────────────────────
 function sleep(ms) {
-    return new Promise((r) => setTimeout(r, ms));
+    return new Promise(res => setTimeout(res, ms));
 }
-main().catch((err) => {
+// ─── Boot ─────────────────────────────────────────────────────────────────────
+main().catch(err => {
     console.error(err);
     process.exit(1);
 });