aw-spec-cli 0.1.9 → 0.1.11

package/assets/guardrails/technology/java-spring/zero-trust.md

@@ -0,0 +1,210 @@
+# Zero-Trust Security Architectural Specification (Rule)
+
+## 1. Purpose
+
+Define a mandatory Zero-Trust security posture for the application. The Zero-Trust model assumes
+that no user, workload, or network location is inherently trusted and requires explicit
+authentication, least-privilege authorization, secure transport, and continuous validation of
+security-sensitive interactions.
+
+## 2. Applicability
+
+This rule applies to application APIs, external integrations, inter-module interactions where
+authentication is applicable, service-to-service communication, and infrastructure boundaries.
+
+The rule MUST be applied consistently with the application's deployment model. A modular monolith
+MAY use in-process module communication without service-to-service authentication. Authentication
+requirements become applicable when a module or capability crosses a separately secured process or
+network boundary.
+
+## 3. Transport Security
+
+- All network communication MUST be encrypted in transit using approved cryptographic protocols.
+- HTTPS MUST be enforced for external API traffic.
+- Internal network traffic MUST use TLS when it crosses a separately secured process, host, or
+  network boundary, unless an explicitly approved platform security control provides equivalent
+  protection.
+- TLS 1.2 is the absolute minimum requirement; TLS 1.3 SHOULD be targeted.
+- Cross-Origin Resource Sharing (CORS) MUST use explicit allow-lists.
+- Wildcard (`*`) CORS origins MUST NOT be used for authenticated application APIs.
+
+Strictly isolated local development MAY use HTTP where required for developer productivity.
+
+## 4. Identity and Authentication
+
+- Human and workload authentication MUST use an approved Identity Provider (IdP) or approved
+  workload identity mechanism.
+- Production authentication MUST NOT rely on locally stored user passwords or application-managed
+  credential databases.
+- Workloads SHOULD authenticate using short-lived, scoped credentials where supported by the
+  deployment platform.
+- Authentication mechanisms MUST be externalized from Domain and business logic.
+
+For local development, explicitly approved development-only authentication mechanisms MAY be used,
+provided they cannot be accidentally enabled in production.
+
+## 5. Service Authentication and Configuration
+
+- Separately deployed services MUST authenticate before exchanging protected data.
+- A modular monolith MAY use direct in-process application-service or event-based communication
+  between modules without network authentication.
+- Backing services, databases, external APIs, and IdPs MUST NOT have connection credentials or
+  environment-specific connection parameters hardcoded in source code.
+- Runtime configuration MUST be externalized through approved configuration mechanisms.
+- Service discovery MAY be used when required by the deployment architecture.
+- A modular monolith MUST NOT be required to introduce service discovery solely to satisfy this
+  rule.
+
+## 6. Token and Security Context Propagation
+
+- Authentication tokens, scopes, and claims MUST be securely propagated where a request crosses
+  an authenticated integration boundary.
+- Every protected endpoint MUST validate the applicable authentication and authorization context.
+- Tokens MUST NOT be propagated to an unrelated downstream service unless that propagation is
+  explicitly required and authorized.
+- Distributed trace context MAY be propagated alongside authenticated requests, but tracing
+  remains the responsibility of the observability/tracing capability.
+- Security context propagation MUST NOT cause credentials or tokens to be written to logs.
+
+## 7. Internal Authorization
+
+- Authorization MUST enforce the Principle of Least Privilege.
+- Protected operations MUST use explicit authorization policies.
+- Role-based and scope-based authorization SHOULD both be used where the application's identity
+  model provides both concepts.
+- A requirement for both role and scope validation MUST only be applied where both are meaningful
+  security dimensions for the protected operation.
+- Authorization MUST be enforced at the appropriate application/API boundary.
+- Security-sensitive data MUST NOT intentionally appear in application logs, metrics, traces, or
+  unhandled error responses.
+
+## 8. Secrets Management
+
+- Production secrets MUST be provisioned through an approved Secrets Manager, platform secret
+  facility, or equivalent secure runtime mechanism.
+- Secrets MUST NOT be committed to source control.
+- Secrets MUST NOT be hardcoded in Java source code.
+- Secrets MUST NOT be stored as plain-text production configuration values.
+- Development-only placeholder credentials MAY be used in isolated development/test environments
+  when they contain no production secrets.
+- Database passwords, API keys, private keys, client secrets, and similar credentials MUST be
+  externally configurable.
+
+Examples of approved mechanisms MAY include:
+
+- Azure Key Vault
+- AWS Secrets Manager
+- HashiCorp Vault
+- Cloud/platform-managed secret stores
+
+The specific provider is an implementation/deployment decision.
+
+## 9. Architectural Boundaries and Dependencies
+
+### Domain Boundary
+
+Zero-Trust enforcement MUST NOT bleed into the Domain layer.
+
+The Domain MUST NOT depend on:
+
+- Spring Security
+- HTTP authentication types
+- JWT implementation types
+- Servlet security APIs
+- IdP-specific SDKs
+- Secrets Manager SDKs
+- TLS configuration
+- Infrastructure security implementations
+
+Domain logic MUST operate independently of the mechanism used to authenticate the caller.
+
+### Application Boundary
+
+The Application layer MAY consume technology-neutral authenticated identity/context information
+when authorization or application policy requires it.
+
+Application code MUST NOT depend directly on a concrete IdP SDK or infrastructure-specific
+authentication implementation.
+
+### Infrastructure / Presentation
+
+The Infrastructure and Presentation/Inbound Adapter layers are responsible for:
+
+- Authentication configuration
+- Token validation
+- Security filter configuration
+- CORS enforcement
+- TLS configuration
+- Secrets integration
+- Security context integration
+- Framework-specific authorization configuration
+
+## 10. Relationship with Other Cross-Cutting Concerns
+
+This rule does not replace other technical concerns.
+
+- **Logging** owns log formatting, masking, and logging behaviour.
+- **Distributed tracing** owns trace propagation.
+- **Problem Details** owns safe HTTP error representation.
+- **Authorization** owns detailed authorization policy and enforcement.
+- **Persistence** owns database and transaction behaviour.
+- **Modular Monolith** owns module boundaries and inter-module communication patterns.
+
+Zero-Trust security requirements apply across these capabilities without duplicating their
+implementation responsibilities.
+
+## 11. Prohibited Behavior
+
+The architecture MUST NOT:
+
+- Permit unauthenticated access to protected production APIs.
+- Use wildcard CORS origins for authenticated APIs.
+- Store production credentials in source control.
+- Hardcode production secrets or credentials in source code.
+- Hardcode environment-specific connection credentials in application source code.
+- Expose authentication tokens, passwords, private keys, or client secrets in logs.
+- Expose sensitive security information through unhandled HTTP error responses.
+- Allow separately deployed protected services to communicate without the required authentication.
+- Introduce security infrastructure dependencies into the Domain layer.
+- Require service discovery for an in-process modular monolith.
+- Propagate authentication tokens to downstream systems without an approved security requirement.
+
+## 12. Implementation Boundary
+
+This specification defines architectural security constraints and MUST NOT prescribe a specific
+security vendor or implementation unless required by the project architecture.
+
+The exact implementation details remain configurable, including:
+
+- Identity Provider vendor
+- Spring Security configuration
+- OAuth2/OIDC implementation
+- Secrets Manager
+- HTTP client
+- Service discovery mechanism
+- API gateway
+- TLS certificate management
+- Workload identity mechanism
+
+Selected implementations MUST comply with the security requirements defined by this rule.
+
+## 13. Acceptance Criteria
+
+- [ ] Protected production APIs require explicit authentication.
+- [ ] HTTPS/TLS is enforced at applicable network boundaries.
+- [ ] CORS policies use explicit allow-lists.
+- [ ] Production authentication uses an approved external IdP or approved workload identity
+      mechanism.
+- [ ] Production applications do not maintain local user credential stores.
+- [ ] Production secrets are supplied through approved secure runtime mechanisms.
+- [ ] Production credentials and secrets are not hardcoded or committed to source control.
+- [ ] Environment-specific connection configuration is externally supplied.
+- [ ] Separately deployed protected services authenticate before exchanging protected data.
+- [ ] Modular-monolith in-process communication is not incorrectly treated as a network boundary.
+- [ ] Protected endpoints enforce applicable authorization policies.
+- [ ] Authentication tokens are not unnecessarily propagated to downstream systems.
+- [ ] Security context is not exposed through logs or error responses.
+- [ ] Domain code has zero dependencies on Spring Security, IdP SDKs, HTTP security types, or
+      secrets-management implementations.
+- [ ] Security responsibilities remain separated from Logging, Tracing, Problem Details,
+      Persistence, and Modular Monolith responsibilities.

package/dist/utils/config.d.ts

@@ -0,0 +1,22 @@
+export interface CliConfig {
+    /** Path to the source spec repo (where .appweaver, foundations, guardrails live) */
+    sourceRepo: string;
+    /** Folders to include when bundling content for npm publish */
+    foldersToBundle: string[];
+    /** Folders always copied during `aw-spec init` */
+    alwaysCopy: string[];
+    /** Mapping from agent name to its folder name */
+    agentFolderMap: Record<string, string>;
+    /** Paths to verify after bundling */
+    verifyPaths: string[];
+    /** Folders checked by `aw-spec doctor` */
+    requiredFolders: string[];
+    /** Files checked by `aw-spec doctor` */
+    requiredFiles: string[];
+    /** Agent folder names checked by doctor */
+    doctorAgentFolders: string[];
+}
+export declare function getCliConfig(): CliConfig;
+/** Reset cache — useful in tests */
+export declare function resetConfigCache(): void;
+//# sourceMappingURL=config.d.ts.map

package/dist/utils/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,SAAS;IACxB,oFAAoF;IACpF,UAAU,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,kDAAkD;IAClD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,iDAAiD;IACjD,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,qCAAqC;IACrC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,0CAA0C;IAC1C,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,wCAAwC;IACxC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,2CAA2C;IAC3C,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAID,wBAAgB,YAAY,IAAI,SAAS,CA8DxC;AAED,oCAAoC;AACpC,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC"}

package/dist/utils/config.js

@@ -0,0 +1,76 @@
+import path from 'path';
+import { fileURLToPath } from 'url';
+import dotenv from 'dotenv';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const PROJECT_ROOT = path.resolve(__dirname, '../..');
+// Auto-load .env file from CLI project root
+dotenv.config({ path: path.resolve(PROJECT_ROOT, '.env') });
+function getEnvArray(key, defaultVal) {
+    const val = process.env[key];
+    if (!val || val.trim() === '')
+        return defaultVal;
+    return val.split(',').map(s => s.trim());
+}
+function getEnvString(key, defaultVal) {
+    return process.env[key] || defaultVal;
+}
+let cachedConfig = null;
+export function getCliConfig() {
+    if (cachedConfig)
+        return cachedConfig;
+    const defaultSourceRepo = path.resolve(PROJECT_ROOT, '../AppWeaver.Spec');
+    cachedConfig = {
+        sourceRepo: getEnvString('AW_SOURCE_REPO', defaultSourceRepo),
+        foldersToBundle: getEnvArray('AW_FOLDERS_TO_BUNDLE', [
+            '.appweaver',
+            'foundations',
+            'guardrails',
+            '.agents',
+            '.claude',
+            '.kilocode',
+        ]),
+        alwaysCopy: getEnvArray('AW_ALWAYS_COPY', [
+            '.appweaver',
+            'foundations',
+            'guardrails',
+        ]),
+        agentFolderMap: {
+            claude: getEnvString('AW_CLAUDE_FOLDER', '.claude'),
+            antigravity: getEnvString('AW_AGENTS_FOLDER', '.agents'),
+            kilocode: getEnvString('AW_KILOCODE_FOLDER', '.kilocode'),
+        },
+        verifyPaths: getEnvArray('AW_VERIFY_PATHS', [
+            '.appweaver/extensions.yml',
+            '.appweaver/feature.json',
+            '.appweaver/init-options.json',
+            '.appweaver/integration.json',
+            '.appweaver/workflows/workflow-registry.json',
+            '.appweaver/templates/spec-template.md',
+            '.appweaver/templates/plan-template.md',
+            '.appweaver/templates/tasks-template.md',
+            '.appweaver/scripts/bash/common.sh',
+            'foundations/dotnet/README.md',
+            'guardrails/domain/REQUIREMENTS.md',
+        ]),
+        requiredFolders: getEnvArray('AW_DOCTOR_REQUIRED_FOLDERS', [
+            '.appweaver',
+        ]),
+        requiredFiles: getEnvArray('AW_DOCTOR_REQUIRED_FILES', [
+            '.appweaver/extensions.yml',
+            '.appweaver/feature.json',
+            '.appweaver/init-options.json',
+            '.appweaver/integration.json',
+        ]),
+        doctorAgentFolders: getEnvArray('AW_DOCTOR_AGENT_FOLDERS', [
+            '.claude',
+            '.agents',
+            '.kilocode',
+        ]),
+    };
+    return cachedConfig;
+}
+/** Reset cache — useful in tests */
+export function resetConfigCache() {
+    cachedConfig = null;
+}
+//# sourceMappingURL=config.js.map

package/dist/utils/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/utils/config.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAEtD,4CAA4C;AAC5C,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;AAE5D,SAAS,WAAW,CAAC,GAAW,EAAE,UAAoB;IACpD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,UAAU,CAAC;IACjD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,UAAkB;IACnD,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC;AACxC,CAAC;AAqBD,IAAI,YAAY,GAAqB,IAAI,CAAC;AAE1C,MAAM,UAAU,YAAY;IAC1B,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;IAE1E,YAAY,GAAG;QACb,UAAU,EAAE,YAAY,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;QAE7D,eAAe,EAAE,WAAW,CAAC,sBAAsB,EAAE;YACnD,YAAY;YACZ,aAAa;YACb,YAAY;YACZ,SAAS;YACT,SAAS;YACT,WAAW;SACZ,CAAC;QAEF,UAAU,EAAE,WAAW,CAAC,gBAAgB,EAAE;YACxC,YAAY;YACZ,aAAa;YACb,YAAY;SACb,CAAC;QAEF,cAAc,EAAE;YACd,MAAM,EAAE,YAAY,CAAC,kBAAkB,EAAE,SAAS,CAAC;YACnD,WAAW,EAAE,YAAY,CAAC,kBAAkB,EAAE,SAAS,CAAC;YACxD,QAAQ,EAAE,YAAY,CAAC,oBAAoB,EAAE,WAAW,CAAC;SAC1D;QAED,WAAW,EAAE,WAAW,CAAC,iBAAiB,EAAE;YAC1C,2BAA2B;YAC3B,yBAAyB;YACzB,8BAA8B;YAC9B,6BAA6B;YAC7B,6CAA6C;YAC7C,uCAAuC;YACvC,uCAAuC;YACvC,wCAAwC;YACxC,mCAAmC;YACnC,8BAA8B;YAC9B,mCAAmC;SACpC,CAAC;QAEF,eAAe,EAAE,WAAW,CAAC,4BAA4B,EAAE;YACzD,YAAY;SACb,CAAC;QAEF,aAAa,EAAE,WAAW,CAAC,0BAA0B,EAAE;YACrD,2BAA2B;YAC3B,yBAAyB;YACzB,8BAA8B;YAC9B,6BAA6B;SAC9B,CAAC;QAEF,kBAAkB,EAAE,WAAW,CAAC,yBAAyB,EAAE;YACzD,SAAS;YACT,SAAS;YACT,WAAW;SACZ,CAAC;KACH,CAAC;IAEF,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,gBAAgB;IAC9B,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC"}

package/dist/utils/copy-assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"copy-assets.d.ts","sourceRoot":"","sources":["../../src/utils/copy-assets.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,SAAS,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,QAAA,MAAM,gBAAgB;;;;CAIZ,CAAC;AAEX,KAAK,SAAS,GAAG,MAAM,OAAO,gBAAgB,CAAC;AAyG/C,wBAAsB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2C1E"}
+{"version":3,"file":"copy-assets.d.ts","sourceRoot":"","sources":["../../src/utils/copy-assets.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,SAAS,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,QAAA,MAAM,gBAAgB;;;;CAIZ,CAAC;AAEX,KAAK,SAAS,GAAG,MAAM,OAAO,gBAAgB,CAAC;AAuG/C,wBAAsB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkC1E"}

package/dist/utils/copy-assets.js

@@ -2,12 +2,12 @@ import fs from 'fs-extra';
 import path from 'path';
 import inquirer from 'inquirer';
 import chalk from 'chalk';
+import { getCliConfig } from './config.js';
 const AGENT_FOLDER_MAP = {
     claude: '.claude',
     antigravity: '.agents',
     kilocode: '.kilocode',
 };
-const ALWAYS_COPY = ['.appweaver', 'foundations', 'guardrails'];
 const EXCLUDE_PATTERNS = [
     '**/.git/**',
     '**/node_modules/**',
@@ -100,9 +100,10 @@ async function copyFolder(source, target, options) {
 export async function copyAssets(options) {
     const { sourceRoot, targetRoot, agent, overwrite = true } = options;
     const agentFolder = AGENT_FOLDER_MAP[agent];
+    const config = getCliConfig();
     console.log(chalk.bold('\n📦 Copying project assets...\n'));
-    // Always copy .aw-spec and docs
-    for (const folder of ALWAYS_COPY) {
+    // Always copy default folders (configurable via AW_ALWAYS_COPY env var)
+    for (const folder of config.alwaysCopy) {
         const source = path.join(sourceRoot, folder);
         const target = path.join(targetRoot, folder);
         if (await fs.pathExists(source)) {
@@ -125,14 +126,6 @@ export async function copyAssets(options) {
     else {
         console.log(chalk.yellow(`  ⚠ Source not found: ${agentFolder}/`));
     }
-    // Copy VerticalSlice from docs
-    // const vsSource = path.join(sourceRoot, 'docs', 'VerticalSlice');
-    // const vsTarget = path.join(targetRoot, 'docs', 'VerticalSlice');
-    // if (await fs.pathExists(vsSource)) {
-    //   console.log(chalk.cyan(`Copying docs/VerticalSlice/...`));
-    //   await fs.ensureDir(vsTarget);
-    //   await copyFolder(vsSource, vsTarget, { overwrite, baseSource: sourceRoot });
-    // }
     console.log();
 }
 //# sourceMappingURL=copy-assets.js.map

package/dist/utils/copy-assets.js.map

@@ -1 +1 @@
-{"version":3,"file":"copy-assets.js","sourceRoot":"","sources":["../../src/utils/copy-assets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,MAAM,OAAO,CAAC;AAS1B,MAAM,gBAAgB,GAAG;IACvB,MAAM,EAAE,SAAS;IACjB,WAAW,EAAE,SAAS;IACtB,QAAQ,EAAE,WAAW;CACb,CAAC;AAIX,MAAM,WAAW,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;AAEhE,MAAM,gBAAgB,GAAG;IACvB,YAAY;IACZ,oBAAoB;IACpB,WAAW;IACX,WAAW;IACX,WAAW;IACX,aAAa;IACb,eAAe;IACf,mBAAmB;IACnB,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,aAAa;IACb,YAAY;IACZ,WAAW;IACX,UAAU;IACV,uBAAuB;IACvB,SAAS;IACT,aAAa;IACb,aAAa;IACb,aAAa;IACb,UAAU;IACV,WAAW;IACX,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,WAAW;IACX,eAAe;IACf,iBAAiB;CAClB,CAAC;AAEF,KAAK,UAAU,aAAa,CAAC,YAAoB;IAC/C,4CAA4C;IAC5C,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;QACvF,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,MAAc,EACd,MAAc,EACd,OAAmD;IAEnD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAElE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAE3D,IAAI,MAAM,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAE/C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC7B,MAAM,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,4CAA4C;YAC5C,IAAI,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;oBACvB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;wBAC1C;4BACE,IAAI,EAAE,SAAS;4BACf,IAAI,EAAE,WAAW;4BACjB,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,cAAc;4BAChG,OAAO,EAAE,KAAK;yBACf;qBACF,CAAC,CAAC;oBACH,IAAI,CAAC,SAAS,EAAE,CAAC;wBACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,OAAO,EAAE,CAAC,CAAC,CAAC;wBACnD,SAAS;oBACX,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAEtD,8CAA8C;YAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxD,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBACrC,IAAI,KAAK,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,sBAAsB;wBAC9C,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;oBAClC,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,sBAAsB;gBACxB,CAAC;YACH,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAA0B;IACzD,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IACpE,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAE5C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,CAAC;IAE5D,gCAAgC;IAChC,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAE7C,IAAI,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,MAAM,CAAC,CAAC,CAAC;YACjD,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC3B,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,MAAM,GAAG,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,6BAA6B;IAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAEvD,IAAI,MAAM,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,WAAW,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC;QACxE,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAChC,MAAM,UAAU,CAAC,WAAW,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;IACpF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,WAAW,GAAG,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,+BAA+B;IAC/B,mEAAmE;IACnE,mEAAmE;IAEnE,uCAAuC;IACvC,+DAA+D;IAC/D,kCAAkC;IAClC,iFAAiF;IACjF,IAAI;IAEJ,OAAO,CAAC,GAAG,EAAE,CAAC;AAChB,CAAC"}
+{"version":3,"file":"copy-assets.js","sourceRoot":"","sources":["../../src/utils/copy-assets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAS3C,MAAM,gBAAgB,GAAG;IACvB,MAAM,EAAE,SAAS;IACjB,WAAW,EAAE,SAAS;IACtB,QAAQ,EAAE,WAAW;CACb,CAAC;AAIX,MAAM,gBAAgB,GAAG;IACvB,YAAY;IACZ,oBAAoB;IACpB,WAAW;IACX,WAAW;IACX,WAAW;IACX,aAAa;IACb,eAAe;IACf,mBAAmB;IACnB,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,aAAa;IACb,YAAY;IACZ,WAAW;IACX,UAAU;IACV,uBAAuB;IACvB,SAAS;IACT,aAAa;IACb,aAAa;IACb,aAAa;IACb,UAAU;IACV,WAAW;IACX,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,WAAW;IACX,eAAe;IACf,iBAAiB;CAClB,CAAC;AAEF,KAAK,UAAU,aAAa,CAAC,YAAoB;IAC/C,4CAA4C;IAC5C,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;QACvF,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,MAAc,EACd,MAAc,EACd,OAAmD;IAEnD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAElE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAE3D,IAAI,MAAM,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAE/C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC7B,MAAM,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,4CAA4C;YAC5C,IAAI,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;oBACvB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;wBAC1C;4BACE,IAAI,EAAE,SAAS;4BACf,IAAI,EAAE,WAAW;4BACjB,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,cAAc;4BAChG,OAAO,EAAE,KAAK;yBACf;qBACF,CAAC,CAAC;oBACH,IAAI,CAAC,SAAS,EAAE,CAAC;wBACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,OAAO,EAAE,CAAC,CAAC,CAAC;wBACnD,SAAS;oBACX,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAEtD,8CAA8C;YAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxD,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBACrC,IAAI,KAAK,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,sBAAsB;wBAC9C,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;oBAClC,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,sBAAsB;gBACxB,CAAC;YACH,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAA0B;IACzD,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IACpE,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAE9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,CAAC;IAE5D,wEAAwE;IACxE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAE7C,IAAI,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,MAAM,CAAC,CAAC,CAAC;YACjD,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC3B,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,MAAM,GAAG,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,6BAA6B;IAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAEvD,IAAI,MAAM,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,WAAW,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC;QACxE,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAChC,MAAM,UAAU,CAAC,WAAW,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;IACpF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,WAAW,GAAG,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAC;AAChB,CAAC"}

package/dist/utils/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/utils/paths.ts"],"names":[],"mappings":"AAMA;;;;GAIG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,CAwBzD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/utils/paths.ts"],"names":[],"mappings":"AAQA;;;;GAIG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,CAyBzD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAG1C"}

package/dist/utils/paths.js

@@ -1,7 +1,9 @@
 import path from 'path';
 import { fileURLToPath } from 'url';
 import fs from 'fs-extra';
+import { getCliConfig } from './config.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const PROJECT_ROOT = path.resolve(__dirname, '../..');
 /**
  * Resolve the path to the bundled assets directory.
  * In development: points to the source AppWeaver.Spec repo
@@ -13,24 +15,26 @@ export async function resolveAssetsPath() {
     if (await fs.pathExists(distAssets)) {
         return distAssets;
     }
-    // Development mode: use the source AppWeaver.Spec repo
-    const sourceRepo = path.resolve(__dirname, '../../../AppWeaver.Spec.Orchestration');
+    // Development mode: use the configured source repo
+    const config = getCliConfig();
+    const sourceRepo = path.resolve(PROJECT_ROOT, config.sourceRepo);
     if (await fs.pathExists(sourceRepo)) {
         return sourceRepo;
     }
     // Fallback: check relative to package root
-    const pkgRoot = path.resolve(__dirname, '../..');
-    const pkgAssets = path.join(pkgRoot, 'assets');
+    const pkgAssets = path.join(PROJECT_ROOT, 'assets');
     if (await fs.pathExists(pkgAssets)) {
         return pkgAssets;
     }
-    throw new Error(`Could not locate AppWeaver.Spec.Orchestration assets. ` +
-        `Tried: ${distAssets}, ${sourceRepo}, ${pkgAssets}`);
+    throw new Error(`Could not locate AppWeaver.Spec assets. ` +
+        `Tried: ${distAssets}, ${sourceRepo}, ${pkgAssets}` +
+        `\nSet AW_SOURCE_REPO env variable if your source folder is elsewhere.`);
 }
 /**
  * Get the source AppWeaver.Spec repository path (for bundling script)
  */
 export function getSourceRepoPath() {
-    return path.resolve(__dirname, '../../AppWeaver.Spec.Orchestration');
+    const config = getCliConfig();
+    return path.resolve(PROJECT_ROOT, config.sourceRepo);
 }
 //# sourceMappingURL=paths.js.map

package/dist/utils/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/utils/paths.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,MAAM,UAAU,CAAC;AAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE/D;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,oEAAoE;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC3D,IAAI,MAAM,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,uDAAuD;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,uCAAuC,CAAC,CAAC;IACpF,IAAI,MAAM,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,2CAA2C;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,MAAM,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,KAAK,CACb,wDAAwD;QACxD,UAAU,UAAU,KAAK,UAAU,KAAK,SAAS,EAAE,CACpD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,oCAAoC,CAAC,CAAC;AACvE,CAAC"}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/utils/paths.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAEtD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,oEAAoE;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC3D,IAAI,MAAM,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,mDAAmD;IACnD,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IACjE,IAAI,MAAM,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,2CAA2C;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,MAAM,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,KAAK,CACb,0CAA0C;QAC1C,UAAU,UAAU,KAAK,UAAU,KAAK,SAAS,EAAE;QACnD,uEAAuE,CACxE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;AACvD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aw-spec-cli",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "description": "AppWeaver Spec-Driven Development CLI - scaffolds projects with vertical slices, DDD, CQRS, and agent skills",
   "type": "module",
   "main": "dist/index.js",
@@ -60,6 +60,7 @@
   "dependencies": {
     "chalk": "^5.3.0",
     "commander": "^12.0.0",
+    "dotenv": "^17.4.2",
     "fs-extra": "^11.2.0",
     "glob": "^10.3.10",
     "inquirer": "^9.2.12",

package/assets/guardrails/technology/java-spring/README.md

@@ -1,62 +0,0 @@
-# java-spring — unauthored corpus
-
-This corpus is **empty on purpose**. It is the worked example of the kit's extension point:
-adding a technology means adding a folder here and mapping it from a project, and nothing else.
-No workflow, script, engine or schema change is involved, and no existing project is touched.
-
-Nothing in this folder is loaded by any command — a rule reaches a phase only by being listed in
-a project's `tech-rule-bindings.md`, and no shipped project lists anything here. (A Spring
-backend paired with the `nextjs` frontend lane is not left ungoverned by that: see below.) This file is the
-corpus index, in the same sense as [`../../README.md`](../../README.md); it is not a rule.
-
-## What already exists for a Spring lane
-
-One rule file for a Spring Boot backend is authored, and it does **not** live here — it lives
-in the corpus of the lane that reads it:
-[`../nextjs/api-integration.java-spring.md`](../nextjs/api-integration.java-spring.md), the
-cross-lane pairing rules for a `nextjs` frontend consuming a `java-spring` service. It is
-mapped from the frontend lane's `## /aw-spec-design-ui` and `## /aw-spec-implement-ui`
-headings through the `{{backend_stack}}` placeholder, so **it loads automatically the moment
-`.appweaver/stacks.json` declares a `java-spring` backend beside a `nextjs` frontend** — no
-project pack change, no workflow change.
-
-That file states what the UI may assume of a Spring service and where Spring's own defaults
-(0-based `Pageable`, `Page<T>` field names, `ProblemDetail`, `long` ids, `BigDecimal`,
-`LocalDateTime`, the `302`-to-login trap) will break the pairing if nothing was configured.
-It is written contract-first precisely because this corpus is unauthored: it defers to the
-service's published OpenAPI document rather than citing a rule file that does not exist yet.
-
-Authoring the service-side corpus below is what would let those rules be **enforced** at
-`design` and `implement` rather than only **expected** at `design-ui` and `implement-ui`.
-
-## Authoring it
-
-The corpus is keyed on the stack id `java-spring`, which is
-[`.appweaver/stack-profiles/java-spring.json`](../../../.appweaver/stack-profiles/java-spring.json)
-— the same id `select-stack` writes into `.appweaver/stacks.json` for a Spring Boot lane. Keep the
-folder name and the profile id the same word.
-
-Mirror the shape of [`../dotnet-webapi/`](../dotnet-webapi/), which is the reference corpus:
-
-| File | Role |
-|---|---|
-| `technology-constitution.md` | the ratified technology base — the one file `## /aw-spec-constitution` needs |
-| `<concern>.md` | one rule file per technical concern (architecture, persistence, testing, …) |
-| `examples/<concern>.md` | the worked `<SampleProjectName>` sample for the rule file beside it |
-
-Write the rules **domain-free**. A technology corpus is shared by every project that maps it, so a
-sentence about prescriptions or patients belongs in `guardrails/domain/<industry>/`, not here.
-The dotnet-webapi corpus holds zero domain words, and that is the property that let two packs
-collapse into one.
-
-There is no `technical-requirements.md` here: that file is the project owner's, and it lives in
-the project folder that maps this corpus.
-
-## Mapping it
-
-In a project's `tech-rule-bindings.md`, list the files under the command headings that should load
-them. A Spring Boot service project would start from
-[`../../projects/dotnet-default-project/tech-rule-bindings.md`](../../projects/dotnet-default-project/tech-rule-bindings.md)
-and repoint its `## /aw-spec-design`, `## /aw-spec-implement`, `## /aw-spec-build` and
-`## /aw-spec-constitution` bullets at `guardrails/technology/java-spring/…`. The domain map needs
-no edit at all — the domain is orthogonal to the stack, which is the whole point of the split.

package/dist/commands/update.d.ts

@@ -1,3 +0,0 @@
-import { Command } from 'commander';
-export declare const updateCommand: Command;
-//# sourceMappingURL=update.d.ts.map

package/dist/commands/update.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/commands/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsBpC,eAAO,MAAM,aAAa,SA6ItB,CAAC"}