create-maestro-app 0.0.2

package/dist/platform-client.js

@@ -0,0 +1,76 @@
+export class PlatformRequestError extends Error {
+    status;
+    error;
+    constructor(status, error) {
+        super(error.message);
+        this.status = status;
+        this.error = error;
+        this.name = 'PlatformRequestError';
+    }
+}
+async function parseError(res) {
+    try {
+        const body = (await res.json());
+        if (body?.error?.code)
+            return body.error;
+    }
+    catch {
+        // fall through to a synthetic envelope
+    }
+    return { code: 'INTERNAL', message: res.statusText || 'Request failed' };
+}
+export class PlatformClient {
+    baseUrl;
+    fetchImpl;
+    constructor(options) {
+        this.baseUrl = options.baseUrl.replace(/\/+$/, '');
+        this.fetchImpl = options.fetchImpl ?? fetch;
+    }
+    async request(method, path, init) {
+        const res = await this.fetchImpl(`${this.baseUrl}${path}`, {
+            method,
+            headers: {
+                'Content-Type': 'application/json',
+                ...(init?.accessToken ? { Authorization: `Bearer ${init.accessToken}` } : {}),
+            },
+            body: init?.body === undefined ? undefined : JSON.stringify(init.body),
+        });
+        if (!res.ok)
+            throw new PlatformRequestError(res.status, await parseError(res));
+        if (res.status === 204)
+            return undefined;
+        return (await res.json());
+    }
+    // --- Auth (spec 01) -------------------------------------------------------
+    login(email, password) {
+        return this.request('POST', '/v1/platform/auth/login', {
+            body: { email, password },
+        });
+    }
+    refresh(refreshToken) {
+        return this.request('POST', '/v1/platform/auth/refresh', { body: { refreshToken } });
+    }
+    async logout(refreshToken) {
+        await this.request('POST', '/v1/platform/auth/logout', { body: { refreshToken } });
+    }
+    // --- App templates (spec 16 US-16.1) --------------------------------------
+    async listTemplates(accessToken) {
+        const res = await this.request('GET', '/v1/platform/app-templates', { accessToken });
+        return res.data;
+    }
+    // --- App creation (spec 16 US-16.2) ---------------------------------------
+    createApp(accessToken, input) {
+        return this.request('POST', '/v1/platform/apps', {
+            accessToken,
+            body: input,
+        });
+    }
+    // --- Apply an additional blueprint to an existing app (spec 16 US-16.3) ----
+    applyTemplate(accessToken, appKey, input) {
+        return this.request('POST', `/v1/platform/apps/${appKey}/templates:apply`, {
+            accessToken,
+            body: input,
+        });
+    }
+}
+//# sourceMappingURL=platform-client.js.map

package/dist/platform-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-client.js","sourceRoot":"","sources":["../src/platform-client.ts"],"names":[],"mappings":"AAeA,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAElC;IACA;IAFX,YACW,MAAc,EACd,KAAoB;QAE7B,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHZ,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAe;QAG7B,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAuBD,KAAK,UAAU,UAAU,CAAC,GAAa;IACrC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8B,CAAC;QAC7D,IAAI,IAAI,EAAE,KAAK,EAAE,IAAI;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,IAAI,gBAAgB,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,OAAO,cAAc;IACR,OAAO,CAAS;IAChB,SAAS,CAAY;IAEtC,YAAY,OAA8B;QACxC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC9C,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,IAAY,EACZ,IAA+C;QAE/C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YACzD,MAAM;YACN,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9E;YACD,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;SACvE,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/E,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC9C,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;IACjC,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,KAAa,EAAE,QAAgB;QACnC,OAAO,IAAI,CAAC,OAAO,CAAkB,MAAM,EAAE,yBAAyB,EAAE;YACtE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,YAAoB;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,2BAA2B,EAAE,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAoB;QAC/B,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,0BAA0B,EAAE,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,aAAa,CAAC,WAAmB;QACrC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAC5B,KAAK,EACL,4BAA4B,EAC5B,EAAE,WAAW,EAAE,CAChB,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED,6EAA6E;IAE7E,SAAS,CACP,WAAmB,EACnB,KAA0E;QAE1E,OAAO,IAAI,CAAC,OAAO,CAAa,MAAM,EAAE,mBAAmB,EAAE;YAC3D,WAAW;YACX,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAE9E,aAAa,CACX,WAAmB,EACnB,MAAc,EACd,KAA6E;QAE7E,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,MAAM,kBAAkB,EAAE;YACzE,WAAW;YACX,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/project.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Project-name / app-key derivation and the non-secret env the scaffold writes
+ * (spec 18 US-18.4/US-18.5). v1 auth is user-JWT, so `.env` carries only
+ * non-secret values — no API key is issued (§Decisions 2).
+ */
+/** Derive a valid snake_case app key from a free-form project name. */
+export declare function deriveAppKey(name: string): string;
+export declare function isValidAppKey(key: string): boolean;
+/** The template variables every client template consumes. */
+export interface ProjectVars {
+    /** Index signature so a `ProjectVars` is assignable to `ScaffoldVars`. */
+    [key: string]: string;
+    PROJECT_NAME: string;
+    APP_KEY: string;
+    APP_NAME: string;
+    API_URL: string;
+}
+export declare function buildProjectVars(input: {
+    projectName: string;
+    appKey: string;
+    appName: string;
+    apiUrl: string;
+}): ProjectVars;
+/** The git-ignored `.env` (non-secret in user-JWT mode). */
+export declare function renderDotEnv(vars: ProjectVars): string;
+//# sourceMappingURL=project.d.ts.map

package/dist/project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUjD;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,6DAA6D;AAC7D,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,WAAW,CAOd;AAED,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAOtD"}

package/dist/project.js

@@ -0,0 +1,40 @@
+/**
+ * Project-name / app-key derivation and the non-secret env the scaffold writes
+ * (spec 18 US-18.4/US-18.5). v1 auth is user-JWT, so `.env` carries only
+ * non-secret values — no API key is issued (§Decisions 2).
+ */
+const APP_KEY_RE = /^[a-z][a-z0-9_]{1,62}$/;
+/** Derive a valid snake_case app key from a free-form project name. */
+export function deriveAppKey(name) {
+    const key = name
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '_')
+        .replace(/^_+|_+$/g, '')
+        .replace(/_{2,}/g, '_');
+    if (!key)
+        return 'app';
+    const prefixed = /^[a-z]/.test(key) ? key : `app_${key}`;
+    return prefixed.slice(0, 63);
+}
+export function isValidAppKey(key) {
+    return APP_KEY_RE.test(key);
+}
+export function buildProjectVars(input) {
+    return {
+        PROJECT_NAME: input.projectName,
+        APP_KEY: input.appKey,
+        APP_NAME: input.appName,
+        API_URL: input.apiUrl,
+    };
+}
+/** The git-ignored `.env` (non-secret in user-JWT mode). */
+export function renderDotEnv(vars) {
+    return [
+        `VITE_API_BASE_URL=${vars.API_URL}`,
+        `VITE_APP_KEY=${vars.APP_KEY}`,
+        `VITE_APP_NAME=${vars.APP_NAME}`,
+        '',
+    ].join('\n');
+}
+//# sourceMappingURL=project.js.map

package/dist/project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.js","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAE5C,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAAG,IAAI;SACb,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC;IACzD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAYD,MAAM,UAAU,gBAAgB,CAAC,KAKhC;IACC,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,OAAO,EAAE,KAAK,CAAC,MAAM;QACrB,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,OAAO,EAAE,KAAK,CAAC,MAAM;KACtB,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,YAAY,CAAC,IAAiB;IAC5C,OAAO;QACL,qBAAqB,IAAI,CAAC,OAAO,EAAE;QACnC,gBAAgB,IAAI,CAAC,OAAO,EAAE;QAC9B,iBAAiB,IAAI,CAAC,QAAQ,EAAE;QAChC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/scaffold.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Deterministic template copy + variable substitution (spec 18 US-18.4, NFR
+ * "reproducible & offline-safe"). Walks a template directory, substitutes
+ * `__PLACEHOLDER__` tokens, and writes the result into the target directory.
+ *
+ * npm strips `.gitignore` and `.env*` from published tarballs, so templates ship
+ * them under safe names that are restored on write (the create-* convention):
+ *   `_gitignore`   → `.gitignore`
+ *   `_env.example` → `.env.example`
+ */
+export type ScaffoldVars = Record<string, string>;
+/** Replace every `__NAME__` token that has a matching var. Unknown tokens stay. */
+export declare function substitute(content: string, vars: ScaffoldVars): string;
+export interface ScaffoldPlanEntry {
+    /** Path relative to the target directory. */
+    path: string;
+    bytes: number;
+}
+export interface ScaffoldResult {
+    files: ScaffoldPlanEntry[];
+}
+export interface ScaffoldOptions {
+    templateDir: string;
+    targetDir: string;
+    vars: ScaffoldVars;
+    /** Extra files to write (e.g. a generated `.env`), keyed by target-relative path. */
+    extraFiles?: Record<string, string>;
+    /** When true, compute the plan without writing anything. */
+    dryRun?: boolean;
+}
+/**
+ * Scaffold a project. Returns the ordered list of files that were (or, in
+ * `dryRun`, would be) written, so the caller can print a plan.
+ */
+export declare function scaffoldProject(options: ScaffoldOptions): Promise<ScaffoldResult>;
+//# sourceMappingURL=scaffold.d.ts.map

package/dist/scaffold.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffold.d.ts","sourceRoot":"","sources":["../src/scaffold.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AAEH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AASlD,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,MAAM,CAItE;AA8BD,MAAM,WAAW,iBAAiB;IAChC,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,iBAAiB,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,YAAY,CAAC;IACnB,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,4DAA4D;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CA2BvF"}

package/dist/scaffold.js

@@ -0,0 +1,67 @@
+import { mkdir, readdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname, join, relative } from 'node:path';
+/** Files renamed on write so npm doesn't strip them from the published package. */
+const RENAME_ON_WRITE = {
+    _gitignore: '.gitignore',
+    '_env.example': '.env.example',
+    _npmrc: '.npmrc',
+};
+/** Replace every `__NAME__` token that has a matching var. Unknown tokens stay. */
+export function substitute(content, vars) {
+    return content.replace(/__([A-Z0-9_]+)__/g, (match, name) => Object.prototype.hasOwnProperty.call(vars, name) ? vars[name] : match);
+}
+/** Apply the publish-safe rename to a single path segment. */
+function targetName(name) {
+    return RENAME_ON_WRITE[name] ?? name;
+}
+async function walk(dir) {
+    const entries = await readdir(dir, { withFileTypes: true });
+    const files = [];
+    for (const entry of entries) {
+        const full = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            files.push(...(await walk(full)));
+        }
+        else if (entry.isFile()) {
+            files.push(full);
+        }
+    }
+    return files.sort(); // deterministic order
+}
+/** Map a template file's absolute path to its target-relative path (renamed). */
+function toTargetRelative(templateDir, file) {
+    const rel = relative(templateDir, file);
+    return rel
+        .split('/')
+        .map((segment) => targetName(segment))
+        .join('/');
+}
+/**
+ * Scaffold a project. Returns the ordered list of files that were (or, in
+ * `dryRun`, would be) written, so the caller can print a plan.
+ */
+export async function scaffoldProject(options) {
+    const { templateDir, targetDir, vars, extraFiles, dryRun } = options;
+    const templateFiles = await walk(templateDir);
+    const planned = new Map();
+    for (const file of templateFiles) {
+        const rel = toTargetRelative(templateDir, file);
+        const raw = await readFile(file, 'utf8');
+        planned.set(rel, substitute(raw, vars));
+    }
+    for (const [rel, content] of Object.entries(extraFiles ?? {})) {
+        planned.set(rel, content); // extras win over template files at the same path
+    }
+    const entries = [...planned.entries()]
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+        .map(([path, content]) => ({ path, bytes: Buffer.byteLength(content, 'utf8') }));
+    if (!dryRun) {
+        for (const [rel, content] of planned) {
+            const dest = join(targetDir, rel);
+            await mkdir(dirname(dest), { recursive: true });
+            await writeFile(dest, content);
+        }
+    }
+    return { files: entries };
+}
+//# sourceMappingURL=scaffold.js.map

package/dist/scaffold.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffold.js","sourceRoot":"","sources":["../src/scaffold.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAepD,mFAAmF;AACnF,MAAM,eAAe,GAA2B;IAC9C,UAAU,EAAE,YAAY;IACxB,cAAc,EAAE,cAAc;IAC9B,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF,mFAAmF;AACnF,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,IAAkB;IAC5D,OAAO,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE,CAClE,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAE,CAAC,CAAC,CAAC,KAAK,CACvE,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,GAAW;IAC7B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,sBAAsB;AAC7C,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,WAAmB,EAAE,IAAY;IACzD,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACxC,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;SACrC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAsBD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAwB;IAC5D,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACrE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC;IAE9C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,kDAAkD;IAC/E,CAAC;IAED,MAAM,OAAO,GAAwB,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;SACxD,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAEnF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,OAAO,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAClC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC"}

package/dist/session.d.ts

@@ -0,0 +1,24 @@
+import { CredentialStore } from './credentials.js';
+import { PlatformClient, type OperatorSession } from './platform-client.js';
+/**
+ * Ties the credential store to the platform client (spec 18 US-18.2): a cached
+ * refresh token is exchanged for an access token on demand; a fresh login is
+ * persisted; logout revokes and clears. The access token stays in memory only.
+ */
+export declare class SessionManager {
+    private readonly baseUrl;
+    private readonly platform;
+    private readonly store;
+    private accessToken?;
+    constructor(baseUrl: string, platform: PlatformClient, store?: CredentialStore);
+    /** Persist a fresh operator login. */
+    signIn(email: string, password: string): Promise<OperatorSession>;
+    /**
+     * Return a usable access token: reuse the in-memory one, else exchange the
+     * cached refresh token. Returns undefined when there is no cached session
+     * (the caller should then prompt a fresh login).
+     */
+    getAccessToken(): Promise<string | undefined>;
+    signOut(): Promise<void>;
+}
+//# sourceMappingURL=session.d.ts.map

package/dist/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAwB,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAElG;;;;GAIG;AACH,qBAAa,cAAc;IAIvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IALxB,OAAO,CAAC,WAAW,CAAC,CAAS;gBAGV,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,cAAc,EACxB,KAAK,GAAE,eAAuC;IAGjE,sCAAsC;IAChC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAWvE;;;;OAIG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAuB7C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAY/B"}

package/dist/session.js

@@ -0,0 +1,73 @@
+import { CredentialStore } from './credentials.js';
+import { PlatformRequestError } from './platform-client.js';
+/**
+ * Ties the credential store to the platform client (spec 18 US-18.2): a cached
+ * refresh token is exchanged for an access token on demand; a fresh login is
+ * persisted; logout revokes and clears. The access token stays in memory only.
+ */
+export class SessionManager {
+    baseUrl;
+    platform;
+    store;
+    accessToken;
+    constructor(baseUrl, platform, store = new CredentialStore()) {
+        this.baseUrl = baseUrl;
+        this.platform = platform;
+        this.store = store;
+    }
+    /** Persist a fresh operator login. */
+    async signIn(email, password) {
+        const session = await this.platform.login(email, password);
+        this.accessToken = session.accessToken;
+        await this.store.set(this.baseUrl, {
+            kind: 'operator_refresh',
+            refreshToken: session.refreshToken,
+            operator: session.operator,
+        });
+        return session;
+    }
+    /**
+     * Return a usable access token: reuse the in-memory one, else exchange the
+     * cached refresh token. Returns undefined when there is no cached session
+     * (the caller should then prompt a fresh login).
+     */
+    async getAccessToken() {
+        if (this.accessToken)
+            return this.accessToken;
+        const cached = await this.store.get(this.baseUrl);
+        if (!cached)
+            return undefined;
+        try {
+            const tokens = await this.platform.refresh(cached.refreshToken);
+            this.accessToken = tokens.accessToken;
+            await this.store.set(this.baseUrl, {
+                kind: 'operator_refresh',
+                refreshToken: tokens.refreshToken,
+                operator: cached.operator,
+            });
+            return tokens.accessToken;
+        }
+        catch (err) {
+            // A dead/rotated refresh token ⇒ drop it so the caller re-prompts login.
+            if (err instanceof PlatformRequestError && err.status === 401) {
+                await this.store.clear(this.baseUrl);
+                return undefined;
+            }
+            throw err;
+        }
+    }
+    async signOut() {
+        const cached = await this.store.get(this.baseUrl);
+        if (cached) {
+            try {
+                await this.platform.logout(cached.refreshToken);
+            }
+            catch {
+                // Best-effort revoke; clear locally regardless.
+            }
+        }
+        this.accessToken = undefined;
+        await this.store.clear(this.baseUrl);
+    }
+}
+//# sourceMappingURL=session.js.map

package/dist/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAkB,oBAAoB,EAAwB,MAAM,sBAAsB,CAAC;AAElG;;;;GAIG;AACH,MAAM,OAAO,cAAc;IAIN;IACA;IACA;IALX,WAAW,CAAU;IAE7B,YACmB,OAAe,EACf,QAAwB,EACxB,QAAyB,IAAI,eAAe,EAAE;QAF9C,YAAO,GAAP,OAAO,CAAQ;QACf,aAAQ,GAAR,QAAQ,CAAgB;QACxB,UAAK,GAAL,KAAK,CAAyC;IAC9D,CAAC;IAEJ,sCAAsC;IACtC,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,QAAgB;QAC1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE;YACjC,IAAI,EAAE,kBAAkB;YACxB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc;QAClB,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAChE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;YACtC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE;gBACjC,IAAI,EAAE,kBAAkB;gBACxB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,IAAI,GAAG,YAAY,oBAAoB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC9D,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACrC,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;YAClD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;CACF"}

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "create-maestro-app",
+  "version": "0.0.2",
+  "license": "Apache-2.0",
+  "type": "module",
+  "description": "Scaffold a client app wired to the hosted Maestro Core.",
+  "bin": {
+    "create-maestro-app": "./dist/bin.js",
+    "maestro": "./dist/bin.js"
+  },
+  "files": [
+    "dist",
+    "templates"
+  ],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.8.0",
+    "vitest": "^3.2.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src",
+    "test": "vitest run"
+  }
+}

package/templates/app/README.md

@@ -0,0 +1,44 @@
+# __APP_NAME__
+
+End-User app for the Maestro App **`__APP_KEY__`**, scaffolded by
+[`create-maestro-app`](https://www.npmjs.com/package/create-maestro-app).
+
+It is **one integrated app** for every capability you selected (SaaS, site, e-learning, …), all
+applied to the same App on the hosted Core and rendered from `/runtime` through the shared
+`@bemaestro/saas-ui` shell — the same shell the hosted Maestro client uses. Reads from `__API_URL__`.
+
+## Develop
+
+```bash
+pnpm install
+pnpm dev
+```
+
+Sign in with an End-User account of an organization on your App. The shell loads your surfaces and the
+account area (profile, members, plans, billing, activity, notifications).
+
+## Configuration
+
+Runtime config lives in `.env` (git-ignored). Copy `.env.example` to `.env` to override:
+
+| Variable            | Meaning                      |
+| ------------------- | ---------------------------- |
+| `VITE_API_BASE_URL` | Hosted Maestro Core base URL |
+| `VITE_APP_KEY`      | This project's App key       |
+| `VITE_APP_NAME`     | Display name                 |
+
+### Server-to-server access (optional)
+
+This app authenticates End Users via JWT and needs no secret. For a backend integration, create a
+least-privilege, org-scoped API key in the hosted admin console (never commit it).
+
+## Managing the App
+
+Schema, capabilities, orgs, users, plans and billing are managed on the **hosted Maestro platform**,
+not from this project. This repository is only the End-User app.
+
+## Build
+
+```bash
+pnpm build   # static bundle in dist/, Cloudflare Pages-ready
+```

package/templates/app/_env.example

@@ -0,0 +1,5 @@
+# Non-secret runtime config (spec 18 US-18.5). Copy to `.env` to override.
+# End Users sign in with a JWT — no API key lives here.
+VITE_API_BASE_URL=__API_URL__
+VITE_APP_KEY=__APP_KEY__
+VITE_APP_NAME=__APP_NAME__

package/templates/app/_gitignore

@@ -0,0 +1,15 @@
+node_modules
+dist
+dist-ssr
+*.local
+
+# Secrets — never commit
+.env
+.env.*
+!.env.example
+
+# Editors
+.vscode/*
+!.vscode/extensions.json
+.idea
+.DS_Store

package/templates/app/index.html

@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>__APP_NAME__</title>
+  </head>
+  <body>
+    <div id="app"></div>
+    <script type="module" src="/src/main.ts"></script>
+  </body>
+</html>

package/templates/app/maestro.config.ts

@@ -0,0 +1,13 @@
+/**
+ * Maestro wiring for this app (spec 18). No secrets live here — End Users
+ * authenticate via JWT (spec 04). Values below were filled in by
+ * `create-maestro-app`.
+ */
+export const maestroConfig = {
+  /** Hosted Maestro Core base URL. */
+  baseUrl:
+    (import.meta.env.VITE_API_BASE_URL as string | undefined)?.replace(/\/$/, '') ?? '__API_URL__',
+  /** This project's App key on the platform. */
+  app: (import.meta.env.VITE_APP_KEY as string | undefined) ?? '__APP_KEY__',
+  appName: (import.meta.env.VITE_APP_NAME as string | undefined) ?? '__APP_NAME__',
+} as const

package/templates/app/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "__PROJECT_NAME__",
+  "private": true,
+  "type": "module",
+  "version": "0.0.0",
+  "scripts": {
+    "dev": "vite",
+    "build": "vite build && vue-tsc -b",
+    "typecheck": "vue-tsc -b --noEmit",
+    "preview": "vite preview"
+  },
+  "dependencies": {
+    "@bemaestro/saas-ui": "^0.0.1",
+    "@bemaestro/sdk": "^0.0.1",
+    "@bemaestro/views": "^0.0.1",
+    "vue": "^3.5.25"
+  },
+  "devDependencies": {
+    "@vitejs/plugin-vue": "^6.0.1",
+    "@vue/tsconfig": "^0.8.1",
+    "typescript": "~5.8.3",
+    "vite": "^7.0.0",
+    "vue-tsc": "^3.1.1"
+  }
+}

package/templates/app/src/App.vue

@@ -0,0 +1,19 @@
+<script setup lang="ts">
+/**
+ * Integrated Maestro app (spec 18). One Vue app for every capability you picked
+ * (saas / site / elearning / …), all applied to the same App and rendered from
+ * `/runtime`. The shared `@bemaestro/saas-ui` shell — the same one the hosted Maestro
+ * client uses — handles End-User auth + account area + the product surfaces
+ * (`web`/`pwa`). A public `site` surface, when present, exposes a login/sign-up
+ * hand-off into this shell.
+ *
+ * Owner/creator management (schema, orgs, plans) stays in the hosted Maestro admin
+ * — this project is only the End-User app.
+ */
+import { SaasShell } from '@bemaestro/saas-ui'
+import { maestroConfig } from '../maestro.config'
+</script>
+
+<template>
+  <SaasShell :config="maestroConfig" mode="web" />
+</template>

package/templates/app/src/main.ts

@@ -0,0 +1,6 @@
+import { createApp } from 'vue'
+import App from './App.vue'
+import '@bemaestro/saas-ui/styles.css'
+import '@bemaestro/views/styles.css'
+
+createApp(App).mount('#app')

package/templates/app/src/vite-env.d.ts

@@ -0,0 +1,11 @@
+/// <reference types="vite/client" />
+
+interface ImportMetaEnv {
+  readonly VITE_API_BASE_URL?: string
+  readonly VITE_APP_KEY?: string
+  readonly VITE_APP_NAME?: string
+}
+
+interface ImportMeta {
+  readonly env: ImportMetaEnv
+}

package/templates/app/tsconfig.json

@@ -0,0 +1,17 @@
+{
+  "extends": "@vue/tsconfig/tsconfig.dom.json",
+  "compilerOptions": {
+    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.app.tsbuildinfo",
+    "baseUrl": ".",
+    "paths": {
+      "@/*": ["./src/*"]
+    },
+    "strict": true,
+    "noEmit": true,
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "skipLibCheck": true,
+    "types": ["vite/client"]
+  },
+  "include": ["src/**/*.ts", "src/**/*.vue", "maestro.config.ts", "vite.config.ts"]
+}

package/templates/app/vite.config.ts

@@ -0,0 +1,17 @@
+import path from 'node:path'
+import vue from '@vitejs/plugin-vue'
+import { defineConfig } from 'vite'
+
+// Cloudflare Pages-ready static build (spec 18), mirroring the hosted client.
+export default defineConfig({
+  plugins: [vue()],
+  resolve: {
+    alias: {
+      '@': path.resolve(__dirname, './src'),
+    },
+  },
+  // Source-exported Maestro packages: let Vite compile their .vue on the fly.
+  optimizeDeps: {
+    exclude: ['@bemaestro/views', '@bemaestro/saas-ui'],
+  },
+})