crumbtrail 0.1.0

package/dist/cli.js

@@ -0,0 +1,2048 @@
+#!/usr/bin/env node
+import {
+  DENO_UNSUPPORTED_REASON,
+  RECIPE_REGISTRY,
+  buildPlan,
+  defaultInjectIO,
+  detect,
+  executePlan,
+  projectAlreadyWired
+} from "./chunk-UFJ2BODB.js";
+
+// src/cli.ts
+import { readFileSync as readFileSync2 } from "fs";
+import path4 from "path";
+import { spawnSync } from "child_process";
+
+// src/auth.ts
+import { createHash, randomBytes } from "crypto";
+import { spawn } from "child_process";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import http from "http";
+import os from "os";
+import path from "path";
+
+// src/net.ts
+var DEFAULT_ENDPOINT = "https://crumbtrail-cloud-production.up.railway.app";
+function normalizeBase(base) {
+  return base.replace(/\/+$/, "");
+}
+function resolveEndpoint(flagEndpoint, env = process.env) {
+  const chosen = flagEndpoint && flagEndpoint.trim() || env.CRUMBTRAIL_BASE_URL && env.CRUMBTRAIL_BASE_URL.trim() || DEFAULT_ENDPOINT;
+  return normalizeBase(chosen);
+}
+var ApiError = class extends Error {
+  status;
+  /** Machine-readable `code` from the cloud jsonError envelope, when present. */
+  code;
+  /** Parsed JSON body, when the response carried one. */
+  body;
+  constructor(message, opts) {
+    super(message);
+    this.name = "ApiError";
+    this.status = opts.status;
+    this.code = opts.code;
+    this.body = opts.body;
+  }
+};
+var NetworkError = class extends Error {
+  cause;
+  constructor(message, cause) {
+    super(message);
+    this.name = "NetworkError";
+    this.cause = cause;
+  }
+};
+function isTransient(err) {
+  const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
+  const causeCode = err && typeof err === "object" && "cause" in err && err.cause && typeof err.cause === "object" && "code" in err.cause ? String(
+    err.cause.code
+  ) : "";
+  return [code, causeCode].some(
+    (c) => ["ECONNREFUSED", "ECONNRESET", "ETIMEDOUT", "EPIPE"].includes(c)
+  );
+}
+async function rawRequest(method, url, opts) {
+  const doFetch = opts.fetchImpl ?? fetch;
+  const headers = { ...opts.headers ?? {} };
+  if (opts.token) headers.authorization = `Bearer ${opts.token}`;
+  let bodyInit;
+  if (opts.body !== void 0) {
+    headers["content-type"] = headers["content-type"] ?? "application/json";
+    bodyInit = JSON.stringify(opts.body);
+  }
+  const res = await doFetch(url, {
+    method,
+    headers,
+    body: bodyInit,
+    signal: opts.signal
+  });
+  const text = await res.text();
+  return { status: res.status, text };
+}
+function parseJson(text) {
+  if (!text) return void 0;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+async function requestJson(url, opts = {}) {
+  const method = (opts.method ?? "GET").toUpperCase();
+  const retry = opts.retry !== false;
+  const where = `${method} ${url}`;
+  let raw;
+  try {
+    raw = await rawRequest(method, url, opts);
+  } catch (err) {
+    if (retry && isTransient(err)) {
+      try {
+        raw = await rawRequest(method, url, opts);
+      } catch (err2) {
+        throw new NetworkError(
+          `Request failed (${where}): ${describe(err2)}`,
+          err2
+        );
+      }
+    } else {
+      throw new NetworkError(
+        `Request failed (${where}): ${describe(err)}`,
+        err
+      );
+    }
+  }
+  if (raw.status >= 500 && retry) {
+    try {
+      raw = await rawRequest(method, url, opts);
+    } catch (err) {
+      throw new NetworkError(
+        `Request failed (${where}): ${describe(err)}`,
+        err
+      );
+    }
+  }
+  const parsed = parseJson(raw.text);
+  if (raw.status >= 200 && raw.status < 300) {
+    return parsed;
+  }
+  const envelope = parsed && typeof parsed === "object" ? parsed : {};
+  const code = typeof envelope.code === "string" ? envelope.code : void 0;
+  const errMsg = typeof envelope.error === "string" ? envelope.error : typeof envelope.message === "string" ? envelope.message : raw.text || "request failed";
+  throw new ApiError(`${errMsg} (${where}) [${raw.status}]`, {
+    status: raw.status,
+    code,
+    body: parsed
+  });
+}
+function describe(err) {
+  if (err instanceof Error) return err.message;
+  return String(err);
+}
+
+// src/ui.ts
+import readline from "readline";
+var useColor = process.stdout.isTTY === true && process.env.NO_COLOR == null;
+function paint(code, s) {
+  return useColor ? `\x1B[${code}m${s}\x1B[0m` : s;
+}
+var color = {
+  bold: (s) => paint("1", s),
+  dim: (s) => paint("2", s),
+  green: (s) => paint("32", s),
+  cyan: (s) => paint("36", s),
+  yellow: (s) => paint("33", s),
+  red: (s) => paint("31", s)
+};
+function maskKey(key) {
+  if (key.length <= 12) return "\u2022".repeat(key.length);
+  return `${key.slice(0, 8)}\u2026${key.slice(-4)}`;
+}
+var consoleUi = {
+  out: (line = "") => process.stdout.write(line + "\n"),
+  err: (line = "") => process.stderr.write(line + "\n"),
+  status: (line = "") => {
+    if (process.stdout.isTTY !== true) return;
+    process.stdout.write(`\r\x1B[2K${line}`);
+  }
+};
+function parseSelection(input, items) {
+  const trimmed = input.trim().toLowerCase();
+  const selectable = (i) => items[i].selectable;
+  if (!trimmed) {
+    return {
+      ok: true,
+      indices: items.map((it, i) => it.checked && it.selectable ? i : -1).filter((i) => i >= 0)
+    };
+  }
+  if (trimmed === "none") return { ok: true, indices: [] };
+  if (trimmed === "all") {
+    return {
+      ok: true,
+      indices: items.map((_, i) => i).filter(selectable)
+    };
+  }
+  const picked = /* @__PURE__ */ new Set();
+  for (const token of trimmed.split(/[,\s]+/).filter(Boolean)) {
+    const range = token.match(/^(\d+)-(\d+)$/);
+    const bounds = range ? [Number(range[1]), Number(range[2])] : /^\d+$/.test(token) ? [Number(token), Number(token)] : null;
+    if (!bounds) {
+      return {
+        ok: false,
+        error: `"${token}" isn't a number, a range like 1-3, "all", or "none".`
+      };
+    }
+    const [lo, hi] = bounds;
+    if (lo < 1 || hi > items.length || lo > hi) {
+      return {
+        ok: false,
+        error: `"${token}" is out of range \u2014 pick between 1 and ${items.length}.`
+      };
+    }
+    for (let n = lo; n <= hi; n += 1) {
+      const i = n - 1;
+      if (!selectable(i)) {
+        return {
+          ok: false,
+          error: `${n} (${items[i].label}) has no supported framework \u2014 it can't be wired.`
+        };
+      }
+      picked.add(i);
+    }
+  }
+  return { ok: true, indices: [...picked].sort((a, b) => a - b) };
+}
+function renderItem(item, index) {
+  const hint = item.hint ? `  ${color.dim(item.hint)}` : "";
+  if (!item.selectable) {
+    return `   ${color.dim("-")}  ${color.dim("\xB7")}  ${color.dim(item.label)}${hint}`;
+  }
+  const n = color.cyan(String(index + 1).padStart(2));
+  return `  ${n}. ${item.checked ? "[x]" : "[ ]"} ${item.label}${hint}`;
+}
+function rl() {
+  return readline.createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+}
+function question(prompt) {
+  const r = rl();
+  return new Promise((resolve) => {
+    r.question(prompt, (answer) => {
+      r.close();
+      resolve(answer);
+    });
+  });
+}
+var stdinPrompter = {
+  async ask(q, def) {
+    const suffix = def ? ` ${color.dim(`(${def})`)}` : "";
+    const answer = (await question(`${q}${suffix} `)).trim();
+    return answer || def || "";
+  },
+  async confirm(q, def = true) {
+    const hint = def ? "Y/n" : "y/N";
+    const answer = (await question(`${q} ${color.dim(`[${hint}]`)} `)).trim().toLowerCase();
+    if (!answer) return def;
+    return answer === "y" || answer === "yes";
+  },
+  async select(q, labels, def = 0) {
+    const r = rl();
+    try {
+      while (true) {
+        const lines = [
+          q,
+          ...labels.map((l, i) => `  ${color.cyan(String(i + 1))}. ${l}`)
+        ];
+        process.stdout.write(lines.join("\n") + "\n");
+        const answer = await new Promise((resolve) => {
+          r.question(
+            `Choose ${color.dim(`(1-${labels.length}, default ${def + 1})`)}: `,
+            resolve
+          );
+        });
+        const trimmed = answer.trim();
+        if (!trimmed) return def;
+        const n = Number(trimmed);
+        if (Number.isInteger(n) && n >= 1 && n <= labels.length) return n - 1;
+        process.stdout.write(
+          color.yellow(`Enter a number between 1 and ${labels.length}.
+`)
+        );
+      }
+    } finally {
+      r.close();
+    }
+  },
+  async multiSelect(q, items) {
+    const r = rl();
+    try {
+      while (true) {
+        const lines = [q, ...items.map(renderItem)];
+        process.stdout.write(lines.join("\n") + "\n");
+        const answer = await new Promise((resolve) => {
+          r.question(
+            `Enter numbers ${color.dim('(e.g. 1,3 or 1-2), "all", "none", or Enter for the checked defaults')}: `,
+            resolve
+          );
+        });
+        const parsed = parseSelection(answer, items);
+        if (parsed.ok) return parsed.indices;
+        process.stdout.write(color.yellow(`${parsed.error}
+`));
+      }
+    } finally {
+      r.close();
+    }
+  }
+};
+function readStdinLine() {
+  const stdin = process.stdin;
+  let settled = false;
+  let onData;
+  let onEnd;
+  let buffer = "";
+  const promise = new Promise((resolve) => {
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      if (onData) stdin.off("data", onData);
+      if (onEnd) stdin.off("end", onEnd);
+      stdin.pause();
+      resolve(value);
+    };
+    onData = (chunk) => {
+      buffer += chunk.toString("utf8");
+      const nl = buffer.indexOf("\n");
+      if (nl >= 0) finish(buffer.slice(0, nl).trim());
+    };
+    onEnd = () => finish(buffer.trim() || void 0);
+    stdin.resume();
+    stdin.on("data", onData);
+    stdin.on("end", onEnd);
+  });
+  const cancel = () => {
+    if (settled) return;
+    settled = true;
+    if (onData) stdin.off("data", onData);
+    if (onEnd) stdin.off("end", onEnd);
+    stdin.pause();
+  };
+  return { promise, cancel };
+}
+
+// src/auth.ts
+function pkcePair() {
+  const verifier = randomBytes(32).toString("base64url");
+  const challenge = createHash("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge };
+}
+function configDir(env = process.env) {
+  const xdg = env.XDG_CONFIG_HOME && env.XDG_CONFIG_HOME.trim();
+  const base = xdg || path.join(env.HOME || os.homedir(), ".config");
+  return path.join(base, "crumbtrail");
+}
+function authFilePath(env = process.env) {
+  return path.join(configDir(env), "auth.json");
+}
+function loadAuth(env = process.env) {
+  try {
+    const raw = readFileSync(authFilePath(env), "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.token === "string" && parsed.token) {
+      return {
+        token: parsed.token,
+        expiresAt: String(parsed.expiresAt ?? ""),
+        endpoint: String(parsed.endpoint ?? "")
+      };
+    }
+  } catch {
+  }
+  return void 0;
+}
+function saveAuth(auth, env = process.env) {
+  const dir = configDir(env);
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  const file = authFilePath(env);
+  writeFileSync(file, JSON.stringify(auth, null, 2) + "\n", { mode: 384 });
+  chmodSync(file, 384);
+}
+function clearAuth(env = process.env) {
+  const file = authFilePath(env);
+  if (!existsSync(file)) return false;
+  rmSync(file, { force: true });
+  return true;
+}
+function openBrowser(url, spawnFn = spawn) {
+  const platform = process.platform;
+  let cmd;
+  let args;
+  if (platform === "darwin") {
+    cmd = "open";
+    args = [url];
+  } else if (platform === "win32") {
+    cmd = "cmd";
+    args = ["/c", "start", "", url];
+  } else {
+    cmd = "xdg-open";
+    args = [url];
+  }
+  return new Promise((resolve) => {
+    try {
+      const child = spawnFn(cmd, args, { stdio: "ignore", detached: true });
+      let settled = false;
+      child.on("error", () => {
+        if (settled) return;
+        settled = true;
+        resolve(false);
+      });
+      child.on("spawn", () => {
+        if (settled) return;
+        settled = true;
+        resolve(true);
+      });
+      child.unref();
+    } catch {
+      resolve(false);
+    }
+  });
+}
+function canUseBrowser(noBrowser, env = process.env) {
+  if (noBrowser) return false;
+  if (process.platform === "linux" && !env.DISPLAY && !env.WAYLAND_DISPLAY) {
+    return false;
+  }
+  return true;
+}
+var CALLBACK_PAGE = `<!doctype html><html><head><meta charset="utf-8"><title>Crumbtrail CLI</title>
+<style>body{font-family:system-ui,sans-serif;background:#0f172a;color:#e2e8f0;display:grid;place-items:center;height:100vh;margin:0}
+.card{background:#1e293b;padding:2rem 2.5rem;border-radius:12px;text-align:center;box-shadow:0 10px 40px rgba(0,0,0,.4)}
+h1{color:#319B7C;margin:0 0 .5rem;font-size:1.25rem}p{margin:0;color:#94a3b8}</style></head>
+<body><div class="card"><h1>Crumbtrail connected \u2713</h1><p>You can close this tab and return to your terminal.</p></div></body></html>`;
+function startCallbackServer() {
+  return new Promise((resolve, reject) => {
+    let resolveCode;
+    let rejectCode;
+    const waitForCode = new Promise((res, rej) => {
+      resolveCode = res;
+      rejectCode = rej;
+    });
+    waitForCode.catch(() => {
+    });
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (url.pathname !== "/callback") {
+        res.writeHead(404);
+        res.end();
+        return;
+      }
+      const code = url.searchParams.get("code");
+      res.writeHead(code ? 200 : 400, {
+        "Content-Type": "text/html; charset=utf-8"
+      });
+      res.end(CALLBACK_PAGE);
+      if (code) resolveCode(code);
+    });
+    server.on("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      if (!addr || typeof addr !== "object") {
+        reject(new Error("callback server failed to bind"));
+        return;
+      }
+      resolve({
+        port: addr.port,
+        waitForCode,
+        close: () => {
+          rejectCode(new Error("cancelled"));
+          server.close();
+        }
+      });
+    });
+  });
+}
+async function exchangeCode(base, args, fetchImpl) {
+  return requestJson(`${base}/api/cli/token`, {
+    method: "POST",
+    body: { code: args.code, verifier: args.verifier },
+    fetchImpl
+  });
+}
+async function validateToken(base, token, fetchImpl) {
+  try {
+    await requestJson(`${base}/api/projects`, { token, fetchImpl });
+    return "valid";
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 401) return "invalid";
+    throw err;
+  }
+}
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function loginBrowser(opts) {
+  const { verifier, challenge } = pkcePair();
+  const server = await startCallbackServer();
+  const authorizeUrl = `${opts.base}/cli/authorize?port=${server.port}&challenge=${challenge}`;
+  const open = opts.openFn ?? openBrowser;
+  const opened = await open(authorizeUrl);
+  if (!opened) {
+    server.close();
+    throw new Error("could not open a browser");
+  }
+  opts.ui.out(`Opened your browser to authorize the CLI:`);
+  opts.ui.out(`  ${color.cyan(authorizeUrl)}`);
+  opts.ui.out(
+    color.dim(`Waiting for approval\u2026 (or paste the code shown in the browser)`)
+  );
+  const stdin = readStdinLine();
+  const pastedCode = stdin.promise.then(
+    (line) => line ? line : new Promise(() => {
+    })
+  );
+  const deadlineMs = opts.browserDeadlineMs ?? 5 * 60 * 1e3;
+  let deadlineTimer;
+  const deadline = new Promise((_, reject) => {
+    deadlineTimer = setTimeout(() => {
+      reject(
+        new Error(
+          "Browser authorization timed out \u2014 run `crumbtrail login` again."
+        )
+      );
+    }, deadlineMs);
+    deadlineTimer.unref?.();
+  });
+  try {
+    const code = await Promise.race([server.waitForCode, pastedCode, deadline]);
+    return await exchangeCode(opts.base, { code, verifier }, opts.fetchImpl);
+  } finally {
+    if (deadlineTimer) clearTimeout(deadlineTimer);
+    stdin.cancel();
+    server.close();
+  }
+}
+async function loginDevice(opts) {
+  const device = await requestJson(`${opts.base}/api/cli/device`, {
+    method: "POST",
+    body: {},
+    fetchImpl: opts.fetchImpl
+  });
+  opts.ui.out("");
+  opts.ui.out(`To authorize this CLI, visit:`);
+  opts.ui.out(`  ${color.cyan(device.verificationUri)}`);
+  opts.ui.out(`and enter the code:  ${color.bold(device.userCode)}`);
+  opts.ui.out(color.dim("Waiting for approval\u2026"));
+  const intervalMs = opts.pollIntervalMs ?? Math.max(1, device.interval) * 1e3;
+  const deadline = Date.now() + Math.max(1, device.expiresIn) * 1e3;
+  while (true) {
+    if (Date.now() > deadline) {
+      throw new Error(
+        "Device authorization expired \u2014 run `crumbtrail login` again."
+      );
+    }
+    await sleep(intervalMs);
+    try {
+      return await requestJson(`${opts.base}/api/cli/token`, {
+        method: "POST",
+        body: { deviceCode: device.deviceCode },
+        fetchImpl: opts.fetchImpl,
+        // Don't retry-on-5xx here; the polling loop is the retry.
+        retry: false
+      });
+    } catch (err) {
+      if (err instanceof ApiError && err.code === "authorization_pending") {
+        continue;
+      }
+      throw err;
+    }
+  }
+}
+async function login(opts) {
+  const env = opts.env ?? process.env;
+  if (canUseBrowser(opts.noBrowser ?? false, env)) {
+    try {
+      return await loginBrowser(opts);
+    } catch {
+      opts.ui.out(
+        color.dim(
+          "Browser hand-off unavailable \u2014 falling back to device code."
+        )
+      );
+      return loginDevice(opts);
+    }
+  }
+  return loginDevice(opts);
+}
+async function ensureToken(opts) {
+  const env = opts.env ?? process.env;
+  const stored = loadAuth(env);
+  if (stored && stored.token && stored.endpoint === opts.base) {
+    const state = await validateToken(opts.base, stored.token, opts.fetchImpl);
+    if (state === "valid") {
+      opts.ui.out(color.dim("Using your saved Crumbtrail login."));
+      return stored.token;
+    }
+    clearAuth(env);
+    opts.ui.out(color.dim("Saved login expired \u2014 signing in again."));
+  }
+  const minted = await login(opts);
+  saveAuth(
+    { token: minted.token, expiresAt: minted.expiresAt, endpoint: opts.base },
+    env
+  );
+  opts.ui.out(color.green("Logged in \u2713"));
+  return minted.token;
+}
+
+// src/provision.ts
+var UpgradeRequiredError = class extends Error {
+  upgradeUrl;
+  constructor(message, upgradeUrl) {
+    super(message);
+    this.name = "UpgradeRequiredError";
+    this.upgradeUrl = upgradeUrl;
+  }
+};
+function inferProjectName(pkgName, gitDirBasename) {
+  const fromPkg = pkgName?.trim();
+  if (fromPkg) {
+    const last = fromPkg.split("/").pop();
+    if (last) return last;
+  }
+  const fromDir = gitDirBasename?.trim();
+  if (fromDir) return fromDir;
+  return "my-app";
+}
+function inferServiceName(recipe, workspaceName) {
+  const ws = workspaceName?.trim();
+  if (ws) {
+    const last = ws.split("/").pop();
+    if (last) return last;
+  }
+  return RECIPE_REGISTRY[recipe].serviceName;
+}
+async function listProjects(base, token, fetchImpl) {
+  const res = await requestJson(
+    `${base}/api/projects`,
+    { token, fetchImpl }
+  );
+  return Array.isArray(res.projects) ? res.projects : [];
+}
+async function createProject(base, token, name, fetchImpl) {
+  try {
+    return await requestJson(`${base}/api/projects`, {
+      method: "POST",
+      token,
+      body: { name },
+      fetchImpl
+    });
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 402) {
+      const body = err.body && typeof err.body === "object" ? err.body : {};
+      const copy = typeof body.error === "string" ? body.error : "The free tier includes one project. Upgrade to add more.";
+      const url = typeof body.upgradeUrl === "string" ? body.upgradeUrl : typeof body.billingUrl === "string" ? body.billingUrl : void 0;
+      throw new UpgradeRequiredError(copy, url);
+    }
+    throw err;
+  }
+}
+async function createService(base, token, projectId, args, fetchImpl) {
+  return requestJson(`${base}/api/projects/${projectId}/services`, {
+    method: "POST",
+    token,
+    body: { name: args.name, stack: args.stack },
+    fetchImpl
+  });
+}
+async function createServiceKey(base, token, serviceId, fetchImpl) {
+  const res = await requestJson(
+    `${base}/api/services/${serviceId}/keys`,
+    { method: "POST", token, body: {}, fetchImpl }
+  );
+  return res.apiKey;
+}
+async function resolveProject(input) {
+  const { base, token, ui, prompter, fetchImpl } = input;
+  let project;
+  if (input.projectId) {
+    project = { id: input.projectId, name: input.projectId };
+  } else {
+    const existing = await listProjects(base, token, fetchImpl);
+    if (existing.length > 0 && !input.assumeYes) {
+      const labels = [
+        `Create a new project (${input.defaultProjectName})`,
+        ...existing.map((p) => p.name)
+      ];
+      const choice = await prompter.select(
+        "Which project should this app report to?",
+        labels,
+        0
+      );
+      if (choice === 0) {
+        const name = await prompter.ask(
+          "New project name",
+          input.defaultProjectName
+        );
+        project = await createProject(base, token, name, fetchImpl);
+      } else {
+        project = existing[choice - 1];
+      }
+    } else {
+      project = await createProject(
+        base,
+        token,
+        input.defaultProjectName,
+        fetchImpl
+      );
+    }
+  }
+  ui.out(`${color.green("\u2713")} Project: ${color.bold(project.name)}`);
+  return project;
+}
+async function provisionService(input) {
+  const { base, token, ui, fetchImpl } = input;
+  const serviceStack = input.stack ?? RECIPE_REGISTRY[input.recipe].stack;
+  const service = await createService(
+    base,
+    token,
+    input.projectId,
+    { name: input.serviceName, stack: serviceStack },
+    fetchImpl
+  );
+  ui.out(`${color.green("\u2713")} Service: ${color.bold(service.name)}`);
+  const apiKey = await createServiceKey(base, token, service.id, fetchImpl);
+  ui.out(`${color.green("\u2713")} Minted an ingest key.`);
+  return { serviceId: service.id, serviceName: service.name, apiKey };
+}
+function uniqueServiceNames(candidates) {
+  const taken = /* @__PURE__ */ new Set();
+  return candidates.map((c) => {
+    const options = [
+      c.name,
+      c.relDir.split("/").filter(Boolean).pop() ?? c.name,
+      // Distinguish apps/web from packages/web: use the parent too.
+      c.relDir.split("/").filter(Boolean).join("-")
+    ];
+    for (const option of options) {
+      if (option && !taken.has(option)) {
+        taken.add(option);
+        return option;
+      }
+    }
+    let n = 2;
+    while (taken.has(`${c.name}-${n}`)) n += 1;
+    const fallback = `${c.name}-${n}`;
+    taken.add(fallback);
+    return fallback;
+  });
+}
+async function provisionFlow(input) {
+  const project = await resolveProject(input);
+  let serviceName = input.defaultServiceName;
+  if (!input.assumeYes) {
+    serviceName = await input.prompter.ask(
+      "Service name",
+      input.defaultServiceName
+    );
+  }
+  const service = await provisionService({
+    base: input.base,
+    token: input.token,
+    projectId: project.id,
+    recipe: input.recipe,
+    stack: input.stack,
+    serviceName,
+    ui: input.ui,
+    fetchImpl: input.fetchImpl
+  });
+  return {
+    projectId: project.id,
+    projectName: project.name,
+    serviceId: service.serviceId,
+    serviceName: service.serviceName,
+    apiKey: service.apiKey
+  };
+}
+
+// src/verify.ts
+import { randomBytes as randomBytes2 } from "crypto";
+
+// src/poll.ts
+var DEFAULT_INGEST_POLL_CONFIG = {
+  initialDelayMs: 3e3,
+  maxDelayMs: 1e4,
+  timeoutMs: 5 * 60 * 1e3
+};
+function initialIngestPollState() {
+  return { status: "waiting", attempts: 0, elapsedMs: 0 };
+}
+function nextPollDelayMs(state, config = DEFAULT_INGEST_POLL_CONFIG) {
+  if (state.status !== "waiting") return 0;
+  const grown = config.initialDelayMs * (state.attempts + 1);
+  return Math.min(grown, config.maxDelayMs);
+}
+function recordPollAttempt(state, found, waitedMs, config = DEFAULT_INGEST_POLL_CONFIG) {
+  if (state.status !== "waiting") return state;
+  const attempts = state.attempts + 1;
+  const elapsedMs = state.elapsedMs + Math.max(0, waitedMs);
+  if (found) return { status: "found", attempts, elapsedMs };
+  if (elapsedMs >= config.timeoutMs)
+    return { status: "timedout", attempts, elapsedMs };
+  return { status: "waiting", attempts, elapsedMs };
+}
+
+// src/verify.ts
+var CLI_CHECK_PREFIX = "cli-check-";
+function syntheticSessionId() {
+  return `${CLI_CHECK_PREFIX}${randomBytes2(8).toString("hex")}`;
+}
+function firstRealSession(sessions, wizardStart) {
+  return sessions.find((s) => {
+    if (s.id.startsWith(CLI_CHECK_PREFIX)) return false;
+    if (wizardStart == null) return true;
+    const started = s.startedAt ? Date.parse(s.startedAt) : NaN;
+    return Number.isFinite(started) && started >= wizardStart;
+  });
+}
+async function syntheticCheck(base, apiKey, fetchImpl) {
+  const sessionId = syntheticSessionId();
+  const headers = { "X-Crumbtrail-Auth": apiKey };
+  await requestJson(`${base}/api/session/start`, {
+    method: "POST",
+    headers,
+    body: { sessionId, metadata: { source: "cli-check" } },
+    fetchImpl
+  });
+  await requestJson(`${base}/api/events`, {
+    method: "POST",
+    headers,
+    body: {
+      sessionId,
+      events: [
+        { t: Date.now(), k: "con", d: { level: "log", args: ["cli-check"] } }
+      ]
+    },
+    fetchImpl
+  });
+  await requestJson(`${base}/api/session/end`, {
+    method: "POST",
+    headers,
+    body: { sessionId },
+    fetchImpl
+  });
+}
+function realSleep(ms, signal) {
+  return new Promise((resolve) => {
+    if (signal?.aborted) return resolve();
+    const timer = setTimeout(resolve, ms);
+    signal?.addEventListener(
+      "abort",
+      () => {
+        clearTimeout(timer);
+        resolve();
+      },
+      { once: true }
+    );
+  });
+}
+async function fetchSessions(base, token, projectId, fetchImpl) {
+  const res = await requestJson(
+    `${base}/api/sessions?projectId=${encodeURIComponent(projectId)}`,
+    { token, fetchImpl }
+  );
+  return Array.isArray(res.sessions) ? res.sessions : [];
+}
+async function pollForRealEvent(opts) {
+  const config = opts.config ?? DEFAULT_INGEST_POLL_CONFIG;
+  const sleep2 = opts.sleepFn ?? realSleep;
+  opts.ui.out("");
+  opts.ui.out(
+    color.bold("Now start your dev server and load a page in your browser.")
+  );
+  if (!opts.ui.status) {
+    opts.ui.out(
+      color.dim("Waiting for the first real event\u2026 (Ctrl-C to skip)")
+    );
+  }
+  let state = initialIngestPollState();
+  let sessionId;
+  while (state.status === "waiting") {
+    const delay = nextPollDelayMs(state, config);
+    opts.ui.status?.(
+      color.dim(
+        `Waiting for the first real event\u2026 ${Math.round((state.elapsedMs + delay) / 1e3)}s (Ctrl-C to skip)`
+      )
+    );
+    await sleep2(delay, opts.signal);
+    if (opts.signal?.aborted) {
+      opts.ui.status?.();
+      return { outcome: "cancelled" };
+    }
+    let found;
+    try {
+      const sessions = await fetchSessions(
+        opts.base,
+        opts.token,
+        opts.projectId,
+        opts.fetchImpl
+      );
+      const real = firstRealSession(sessions, opts.wizardStart);
+      found = real !== void 0;
+      if (real) sessionId = real.id;
+    } catch {
+      found = false;
+    }
+    state = recordPollAttempt(state, found, delay, config);
+  }
+  opts.ui.status?.();
+  return state.status === "found" ? { outcome: "found", sessionId } : { outcome: "timedout" };
+}
+function realSessionsByService(sessions, wizardStart) {
+  const found = /* @__PURE__ */ new Map();
+  for (const s of [...sessions].reverse()) {
+    if (!s.serviceId || found.has(s.serviceId)) continue;
+    if (s.id.startsWith(CLI_CHECK_PREFIX)) continue;
+    if (wizardStart != null) {
+      const started = s.startedAt ? Date.parse(s.startedAt) : NaN;
+      if (!Number.isFinite(started) || started < wizardStart) continue;
+    }
+    found.set(s.serviceId, s.id);
+  }
+  return found;
+}
+async function pollForServices(opts) {
+  const config = opts.config ?? DEFAULT_INGEST_POLL_CONFIG;
+  const sleep2 = opts.sleepFn ?? realSleep;
+  const total = opts.serviceIds.length;
+  const wanted = new Set(opts.serviceIds);
+  const found = /* @__PURE__ */ new Map();
+  opts.ui.out("");
+  opts.ui.out(color.bold("Now start your services so they can report in."));
+  if (!opts.ui.status) {
+    opts.ui.out(color.dim("Waiting for first events\u2026 (Ctrl-C to skip)"));
+  }
+  let state = initialIngestPollState();
+  while (state.status === "waiting") {
+    const delay = nextPollDelayMs(state, config);
+    opts.ui.status?.(
+      color.dim(
+        `Waiting for first events\u2026 ${found.size}/${total} services \xB7 ${Math.round((state.elapsedMs + delay) / 1e3)}s (Ctrl-C to skip)`
+      )
+    );
+    await sleep2(delay, opts.signal);
+    if (opts.signal?.aborted) {
+      opts.ui.status?.();
+      return { outcome: "cancelled", found: Object.fromEntries(found) };
+    }
+    try {
+      const sessions = await fetchSessions(
+        opts.base,
+        opts.token,
+        opts.projectId,
+        opts.fetchImpl
+      );
+      for (const [serviceId, sessionId] of realSessionsByService(
+        sessions,
+        opts.wizardStart
+      )) {
+        if (!wanted.has(serviceId) || found.has(serviceId)) continue;
+        found.set(serviceId, sessionId);
+        opts.ui.status?.();
+        opts.onFound?.(serviceId, sessionId);
+      }
+    } catch {
+    }
+    state = recordPollAttempt(state, found.size === total, delay, config);
+  }
+  opts.ui.status?.();
+  return {
+    outcome: state.status === "found" ? "found" : "timedout",
+    found: Object.fromEntries(found)
+  };
+}
+
+// src/discover.ts
+import fs from "fs";
+import path3 from "path";
+
+// src/otlp-guide.ts
+import path2 from "path";
+var OTLP_GUIDE_FILENAME = "CRUMBTRAIL-OTLP.md";
+function renderOtlpGuide(input) {
+  return [
+    `# Crumbtrail \u2014 ${input.serviceName}`,
+    "",
+    `Detected stack: **${input.stack}**`,
+    `Ingest endpoint: ${input.endpoint}`,
+    "",
+    `This service is already provisioned in Crumbtrail and has its own ingest key.`,
+    `There is no SDK to install: ${input.stack} speaks OpenTelemetry, so Crumbtrail`,
+    `accepts its traces directly. Everything below is the one manual step.`,
+    "",
+    "## 1. Configure the OTLP exporter",
+    "",
+    "```sh",
+    input.snippet,
+    "```",
+    "",
+    "## 2. Or hand this to a coding agent",
+    "",
+    "```",
+    input.agentPrompt,
+    "```",
+    "",
+    "## Keep the key out of git",
+    "",
+    "The ingest key above is a live credential. Move it into your secret store or",
+    "environment config and make sure this file (or wherever the key lands) is not",
+    "committed to a public repository.",
+    ""
+  ].join("\n");
+}
+function otlpGuidePlan(dir, body) {
+  return {
+    recipe: "otlp",
+    kind: "create",
+    targetPath: path2.join(dir, OTLP_GUIDE_FILENAME),
+    content: body,
+    warnings: []
+  };
+}
+
+// src/discover.ts
+var SCAN_PARENTS = ["apps", "services", "packages"];
+var SKIP_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  "dist",
+  "build",
+  "out",
+  "coverage",
+  "target",
+  "vendor",
+  "__pycache__",
+  ".next",
+  ".git"
+]);
+var MAX_SCAN_DIRS = 200;
+function defaultReadDir(dir) {
+  try {
+    return fs.readdirSync(dir);
+  } catch {
+    return [];
+  }
+}
+function defaultIsDir(p) {
+  try {
+    return fs.statSync(p).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function defaultIsFile(p) {
+  try {
+    return fs.statSync(p).isFile();
+  } catch {
+    return false;
+  }
+}
+function looksLikeLibrary(recipe, pkg) {
+  if (recipe !== "node" || !pkg) return false;
+  if (pkg.bin) return false;
+  const scripts = pkg.scripts ?? {};
+  return !["start", "dev", "serve", "start:prod"].some((s) => scripts[s]);
+}
+function readPkg(dir, isFile) {
+  const file = path3.join(dir, "package.json");
+  if (!isFile(file)) return null;
+  try {
+    return JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function classify(root, dir, source, fallbackName, deps) {
+  const detected = deps.detect(dir);
+  const recipe = detected.recipe;
+  const pkg = readPkg(dir, deps.isFile);
+  const flags = [];
+  const isOtlp = recipe === "otlp";
+  const wired = isOtlp ? deps.isFile(path3.join(dir, OTLP_GUIDE_FILENAME)) : recipe != null && deps.alreadyWired(dir);
+  if (recipe == null) flags.push("no-recipe");
+  if (isOtlp) flags.push("otlp");
+  if (looksLikeLibrary(recipe, pkg)) flags.push("likely-library");
+  if (detected.ambiguous && recipe != null) flags.push("ambiguous");
+  if (wired) flags.push("already-wired");
+  const selectable = recipe != null;
+  const defaultChecked = selectable && source === "workspace" && RECIPE_REGISTRY[recipe].kind === "inject" && !detected.ambiguous && !flags.includes("likely-library") && !wired;
+  return {
+    dir,
+    name: pkg?.name?.split("/").pop() ?? fallbackName,
+    relDir: path3.relative(root, dir) || ".",
+    source,
+    detected,
+    recipe,
+    flags,
+    defaultChecked,
+    selectable
+  };
+}
+function discoverServices(root, rootResult, overrides = {}) {
+  const isFile = overrides.isFile ?? defaultIsFile;
+  const isDir = overrides.isDir ?? defaultIsDir;
+  const readDir = overrides.readDir ?? defaultReadDir;
+  const deps = {
+    detect: overrides.detect ?? detect,
+    alreadyWired: overrides.alreadyWired ?? ((dir) => projectAlreadyWired(dir, defaultInjectIO)),
+    isFile
+  };
+  const byDir = /* @__PURE__ */ new Map();
+  for (const ws of rootResult.workspaces) {
+    const dir = path3.resolve(ws.dir);
+    if (byDir.has(dir)) continue;
+    byDir.set(dir, classify(root, dir, "workspace", ws.name, deps));
+  }
+  let scanned = 0;
+  const parents = [
+    ...SCAN_PARENTS.map((p) => path3.join(root, p)).filter(isDir),
+    root
+  ];
+  for (const parent of parents) {
+    for (const entry of readDir(parent)) {
+      if (scanned >= MAX_SCAN_DIRS) break;
+      if (entry.startsWith(".") || SKIP_DIRS.has(entry)) continue;
+      const dir = path3.join(parent, entry);
+      if (!isDir(dir) || byDir.has(dir)) continue;
+      scanned += 1;
+      const candidate = classify(root, dir, "scan", entry, deps);
+      if (candidate.recipe === "otlp") byDir.set(dir, candidate);
+    }
+  }
+  return [...byDir.values()].sort((a, b) => {
+    if (a.source !== b.source) return a.source === "workspace" ? -1 : 1;
+    return a.relDir.localeCompare(b.relDir);
+  });
+}
+
+// src/cli.ts
+function readVersion() {
+  try {
+    const pkg = JSON.parse(
+      readFileSync2(path4.join(__dirnameCompat(), "..", "package.json"), "utf8")
+    );
+    return pkg.version ?? "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+function __dirnameCompat() {
+  if (typeof __dirname !== "undefined") return __dirname;
+  return process.cwd();
+}
+function parseArgs(argv) {
+  const args = argv.slice(2);
+  const parsed = {
+    command: "wizard",
+    yes: false,
+    noBrowser: false,
+    skipVerify: false,
+    all: false
+  };
+  let commandSet = false;
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    switch (a) {
+      case "--help":
+      case "-h":
+        parsed.command = "help";
+        return parsed;
+      case "--version":
+      case "-v":
+        parsed.command = "version";
+        return parsed;
+      case "--yes":
+      case "-y":
+        parsed.yes = true;
+        break;
+      case "--no-browser":
+        parsed.noBrowser = true;
+        break;
+      case "--skip-verify":
+        parsed.skipVerify = true;
+        break;
+      case "--project":
+        parsed.project = args[++i];
+        break;
+      case "--endpoint":
+        parsed.endpoint = args[++i];
+        break;
+      case "--all":
+        parsed.all = true;
+        break;
+      case "--only":
+        (parsed.only ??= []).push(args[++i]);
+        break;
+      default:
+        if (a.startsWith("--project=")) {
+          parsed.project = a.slice("--project=".length);
+        } else if (a.startsWith("--endpoint=")) {
+          parsed.endpoint = a.slice("--endpoint=".length);
+        } else if (a.startsWith("--only=")) {
+          (parsed.only ??= []).push(a.slice("--only=".length));
+        } else if (!commandSet && (a === "login" || a === "logout")) {
+          parsed.command = a;
+          commandSet = true;
+        } else if (!a.startsWith("-")) {
+          parsed.unknown = a;
+        } else {
+          parsed.unknown = a;
+        }
+    }
+  }
+  return parsed;
+}
+var USAGE = `crumbtrail \u2014 set up Crumbtrail in your app
+
+Usage:
+  crumbtrail [options]        Run the setup wizard (detect \u2192 login \u2192 wire \u2192 verify)
+  crumbtrail login            Log in and cache a token, nothing else
+  crumbtrail logout           Delete the cached token
+
+In a monorepo, run it from the repo root: it scans every workspace and service,
+shows you what it found, and wires the ones you pick.
+
+Options:
+  --yes, -y                  Skip confirmations (required with --project in CI)
+  --project <id>             Attach to an existing project (skip creation)
+  --only <name>              Monorepo: wire only this service (repeatable)
+  --all                      Monorepo: wire every service it can, no prompt
+  --no-browser               Use the device-code login flow
+  --skip-verify              Don't wait for the first event
+  --endpoint <url>           Cloud endpoint (else $CRUMBTRAIL_BASE_URL, else default)
+  --help, -h                 Show this help
+  --version, -v              Print the version`;
+function sdkPackagesFor(recipe) {
+  return RECIPE_REGISTRY[recipe].sdkPackages;
+}
+function pmInvocation(pm) {
+  switch (pm) {
+    case "pnpm":
+      return { cmd: "pnpm", add: "add" };
+    case "yarn":
+      return { cmd: "yarn", add: "add" };
+    case "bun":
+      return { cmd: "bun", add: "add" };
+    default:
+      return { cmd: "npm", add: "install" };
+  }
+}
+function realSpawn(cmd, args, cwd) {
+  const res = spawnSync(cmd, args, { cwd, stdio: "inherit" });
+  if (res.error) return 1;
+  return res.status ?? 1;
+}
+async function discoverTarballUrls(base, packages, fetchImpl) {
+  try {
+    const doFetch = fetchImpl ?? fetch;
+    const res = await doFetch(`${base}/install/manifest.json`);
+    if (!res.ok) return [];
+    const body = await res.json();
+    const files = Array.isArray(body.files) ? body.files.filter((f) => typeof f === "string") : [];
+    const urls = [];
+    for (const pkg of packages) {
+      const file = files.find(
+        (f) => f.startsWith(`${pkg}-`) && f.endsWith(".tgz")
+      );
+      if (!file) return [];
+      urls.push(`${base}/install/${file}`);
+    }
+    return urls;
+  } catch {
+    return [];
+  }
+}
+async function installSdk(input) {
+  const packages = sdkPackagesFor(input.recipe);
+  if (packages.length === 0) {
+    return { installed: false, packages: [] };
+  }
+  const { cmd, add } = pmInvocation(input.packageManager);
+  const run = input.spawnFn ?? realSpawn;
+  input.ui.out(
+    `Installing SDK: ${color.cyan(`${cmd} ${add} ${packages.join(" ")}`)}`
+  );
+  const code = run(cmd, [add, ...packages], input.cwd);
+  if (code === 0) {
+    return { installed: true, packages };
+  }
+  const tarballs = await discoverTarballUrls(
+    input.base,
+    packages,
+    input.fetchImpl
+  );
+  if (tarballs.length === packages.length) {
+    input.ui.out(
+      color.dim(
+        `Registry unavailable \u2014 installing from ${input.base}/install tarballs\u2026`
+      )
+    );
+    const fallbackCode = run(cmd, [add, ...tarballs], input.cwd);
+    if (fallbackCode === 0) {
+      return {
+        installed: true,
+        packages,
+        note: `Installed ${packages.join(", ")} from the deploy's install tarballs (registry unavailable).`
+      };
+    }
+    return {
+      installed: false,
+      packages,
+      note: `SDK install via ${cmd} failed; the ${input.base}/install tarball fallback also failed \u2014 wire manually or run: curl -fsSL ${input.base}/install.sh | sh`
+    };
+  }
+  return {
+    installed: false,
+    packages,
+    note: `SDK install via ${cmd} failed \u2014 install the tarballs instead: curl -fsSL ${input.base}/install.sh | sh`
+  };
+}
+function defaultDeps() {
+  return {
+    detect,
+    ensureToken,
+    provisionFlow,
+    installSdk,
+    buildPlan,
+    executePlan,
+    syntheticCheck,
+    pollForRealEvent,
+    discoverServices,
+    resolveProject,
+    provisionService,
+    pollForServices,
+    openBrowserFn: openBrowser,
+    ui: consoleUi,
+    prompter: stdinPrompter,
+    env: process.env,
+    cwd: process.cwd(),
+    isTTY: !!(process.stdout.isTTY && process.stdin.isTTY),
+    fetchImpl: void 0
+  };
+}
+function readPkgName(dir) {
+  try {
+    const pkg = JSON.parse(
+      readFileSync2(path4.join(dir, "package.json"), "utf8")
+    );
+    return typeof pkg.name === "string" ? pkg.name : null;
+  } catch {
+    return null;
+  }
+}
+async function runWizard(parsed, deps) {
+  const { ui } = deps;
+  const base = resolveEndpoint(parsed.endpoint, deps.env);
+  const wizardStart = Date.now();
+  ui.out(color.bold("\nCrumbtrail setup"));
+  ui.out(color.dim(`Endpoint: ${base}
+`));
+  const cwd = deps.cwd;
+  const result = deps.detect(cwd);
+  if (result.isMonorepo) {
+    return runBatchWizard(parsed, deps, { base, wizardStart, root: result });
+  }
+  if (!result.recipe) {
+    const isDeno = result.reasons.includes(DENO_UNSUPPORTED_REASON);
+    if (isDeno) {
+      ui.err(
+        color.red(
+          "Deno projects aren't supported yet \u2014 Crumbtrail can't wire this one."
+        )
+      );
+    } else {
+      ui.err(color.red("Couldn't detect a supported framework here."));
+    }
+    for (const r of result.reasons) ui.err(color.dim(`  \xB7 ${r}`));
+    for (const n of result.notes) ui.err(color.dim(`  \xB7 ${n}`));
+    if (!isDeno) {
+      ui.err(
+        "Supported: Next.js, SvelteKit, Nuxt, Remix, Astro, Angular, Vite SPA, NestJS, Express, Hono, Fastify, a Node server, or a non-JS backend that speaks OpenTelemetry (Django, Flask, FastAPI, Go, Rails, .NET)."
+      );
+    }
+    return 1;
+  }
+  ui.out(`${color.green("\u2713")} Detected ${color.bold(result.recipe)} project.`);
+  for (const n of result.notes) ui.out(color.dim(`  \xB7 ${n}`));
+  let token;
+  try {
+    token = await deps.ensureToken({
+      base,
+      ui,
+      noBrowser: parsed.noBrowser,
+      fetchImpl: deps.fetchImpl,
+      env: deps.env
+    });
+  } catch (err) {
+    ui.err(color.red(`Login failed: ${errMessage(err)}`));
+    return 1;
+  }
+  const pkgName = readPkgName(cwd);
+  const defaultProjectName = inferProjectName(pkgName, path4.basename(cwd));
+  const defaultServiceName = inferServiceName(result.recipe);
+  let provisioned;
+  try {
+    provisioned = await deps.provisionFlow({
+      base,
+      token,
+      recipe: result.recipe,
+      stack: result.otlpStack,
+      ui,
+      prompter: deps.prompter,
+      assumeYes: parsed.yes,
+      projectId: parsed.project,
+      defaultProjectName,
+      defaultServiceName,
+      fetchImpl: deps.fetchImpl
+    });
+  } catch (err) {
+    if (err instanceof UpgradeRequiredError) {
+      ui.err("");
+      ui.err(color.yellow(err.message));
+      if (err.upgradeUrl) ui.err(`Upgrade: ${color.cyan(err.upgradeUrl)}`);
+      return 1;
+    }
+    ui.err(color.red(`Provisioning failed: ${errMessage(err)}`));
+    return 1;
+  }
+  const plan = deps.buildPlan({
+    cwd,
+    recipe: result.recipe,
+    endpoint: base,
+    apiKey: provisioned.apiKey,
+    entryFile: result.entryFile,
+    nextVersion: result.nextVersion,
+    stack: result.otlpStack ?? void 0,
+    options: { force: parsed.yes }
+  });
+  const install = await deps.installSdk({
+    cwd,
+    packageManager: result.packageManager,
+    recipe: result.recipe,
+    base,
+    ui,
+    fetchImpl: deps.fetchImpl
+  });
+  if (install.installed) {
+    ui.out(`${color.green("\u2713")} Installed ${install.packages.join(", ")}.`);
+  } else if (install.note) {
+    ui.out(color.yellow(`! ${install.note}`));
+  }
+  const inject = await applyInjection(plan, parsed, deps);
+  const notes = [];
+  if (!install.installed && install.note) notes.push(install.note);
+  notes.push(...inject.notes);
+  let sessionUrl;
+  if (parsed.skipVerify) {
+    notes.push("Verification skipped (--skip-verify).");
+  } else {
+    try {
+      await deps.syntheticCheck(base, provisioned.apiKey, deps.fetchImpl);
+      ui.out(
+        `${color.green("\u2713")} Synthetic ingest check passed (key + endpoint OK).`
+      );
+    } catch (err) {
+      ui.err(color.red(`Synthetic ingest check failed: ${errMessage(err)}`));
+      notes.push(
+        "Synthetic ingest check failed \u2014 verify your network/endpoint."
+      );
+    }
+    const poll = await pollWithSigint(
+      base,
+      token,
+      provisioned.projectId,
+      deps,
+      wizardStart
+    );
+    if (poll.outcome === "found") {
+      sessionUrl = poll.sessionId ? `${base}/sessions/${encodeURIComponent(poll.sessionId)}` : `${base}/bugs`;
+      ui.out(`${color.green("\u2713")} First real event received!`);
+      ui.out(`  Watch it live: ${color.cyan(sessionUrl)}`);
+      if (canUseBrowser(parsed.noBrowser, deps.env)) {
+        const open = deps.openBrowserFn ?? openBrowser;
+        if (await open(sessionUrl)) {
+          ui.out(color.dim("  Opened your dashboard in the browser."));
+        }
+      }
+    } else if (poll.outcome === "cancelled") {
+      notes.push(
+        "Stopped waiting for the first event \u2014 load your app any time."
+      );
+    } else {
+      notes.push("No event yet \u2014 start your app and check the dashboard.");
+    }
+  }
+  printSummary(ui, base, provisioned, inject.filesTouched, notes, sessionUrl);
+  return 0;
+}
+function stackLabel(c) {
+  if (c.recipe == null) return "\u2014";
+  if (c.recipe === "otlp") return c.detected.otlpStack ?? "otlp";
+  return c.recipe;
+}
+function candidateHint(c) {
+  const stack = stackLabel(c);
+  if (c.flags.includes("no-recipe")) return "no supported framework";
+  if (c.flags.includes("already-wired")) return `${stack} \xB7 already wired`;
+  if (c.flags.includes("otlp"))
+    return `${stack} \xB7 OTLP guidance, no code changes`;
+  if (c.flags.includes("likely-library"))
+    return `${stack} \xB7 library? probably not an app`;
+  if (c.flags.includes("ambiguous")) return `${stack} \xB7 entry file unclear`;
+  return stack;
+}
+function toMultiSelectItems(candidates) {
+  return candidates.map((c) => ({
+    label: c.relDir,
+    hint: candidateHint(c),
+    checked: c.defaultChecked,
+    selectable: c.selectable
+  }));
+}
+function resolveSelection(parsed, candidates) {
+  if (parsed.only && parsed.only.length > 0) {
+    const indices = [];
+    for (const want of parsed.only) {
+      const needle = want.toLowerCase();
+      const i = candidates.findIndex(
+        (c) => c.name.toLowerCase() === needle || c.relDir.toLowerCase() === needle
+      );
+      if (i < 0) {
+        return {
+          error: `--only ${want}: no such service. Found: ${candidates.map((c) => c.relDir).join(", ")}`
+        };
+      }
+      if (!candidates[i].selectable) {
+        return {
+          error: `--only ${want}: no supported framework detected there \u2014 it can't be wired.`
+        };
+      }
+      if (!indices.includes(i)) indices.push(i);
+    }
+    return { indices };
+  }
+  if (parsed.all) {
+    return {
+      indices: candidates.map((c, i) => c.selectable ? i : -1).filter((i) => i >= 0)
+    };
+  }
+  return null;
+}
+async function runBatchWizard(parsed, deps, ctx) {
+  const { ui } = deps;
+  const { base, wizardStart } = ctx;
+  const root = deps.cwd;
+  const candidates = deps.discoverServices(root, ctx.root);
+  const selectableCount = candidates.filter((c) => c.selectable).length;
+  ui.out(
+    `${color.green("\u2713")} Monorepo \u2014 found ${color.bold(String(candidates.length))} package(s), ${color.bold(String(selectableCount))} wireable.`
+  );
+  if (selectableCount === 0) {
+    ui.err("");
+    ui.err(color.red("Nothing here can be wired."));
+    for (const c of candidates) {
+      ui.err(color.dim(`  \xB7 ${c.relDir} \u2014 ${candidateHint(c)}`));
+    }
+    ui.err(
+      "Supported: Next.js, SvelteKit, Nuxt, Remix, Astro, Angular, Vite SPA, NestJS, Express, Hono, Fastify, a Node server, or a non-JS backend that speaks OpenTelemetry (Django, Flask, FastAPI, Go, Rails, .NET)."
+    );
+    return 1;
+  }
+  const preset = resolveSelection(parsed, candidates);
+  if (preset && "error" in preset) {
+    ui.err(color.red(preset.error));
+    return 1;
+  }
+  let indices;
+  if (preset) {
+    indices = preset.indices;
+  } else if (!deps.isTTY) {
+    ui.err("");
+    ui.err(
+      color.red(
+        "Monorepo root, but there's no TTY to pick services. Pass --only <service> (repeatable) or --all."
+      )
+    );
+    for (const c of candidates) {
+      if (c.selectable) ui.err(color.dim(`  \xB7 ${c.relDir}`));
+    }
+    return 1;
+  } else {
+    ui.out("");
+    indices = await deps.prompter.multiSelect(
+      "Which services should Crumbtrail wire?",
+      toMultiSelectItems(candidates)
+    );
+  }
+  const selected = indices.map((i) => candidates[i]);
+  if (selected.length === 0) {
+    ui.out(color.yellow("Nothing selected \u2014 no changes made."));
+    return 0;
+  }
+  let token;
+  try {
+    token = await deps.ensureToken({
+      base,
+      ui,
+      noBrowser: parsed.noBrowser,
+      fetchImpl: deps.fetchImpl,
+      env: deps.env
+    });
+  } catch (err) {
+    ui.err(color.red(`Login failed: ${errMessage(err)}`));
+    return 1;
+  }
+  const defaultProjectName = inferProjectName(
+    readPkgName(root),
+    path4.basename(root)
+  );
+  let project;
+  try {
+    project = await deps.resolveProject({
+      base,
+      token,
+      ui,
+      prompter: deps.prompter,
+      assumeYes: parsed.yes,
+      projectId: parsed.project,
+      defaultProjectName,
+      fetchImpl: deps.fetchImpl
+    });
+  } catch (err) {
+    if (err instanceof UpgradeRequiredError) {
+      ui.err("");
+      ui.err(color.yellow(err.message));
+      if (err.upgradeUrl) ui.err(`Upgrade: ${color.cyan(err.upgradeUrl)}`);
+      return 1;
+    }
+    ui.err(color.red(`Provisioning failed: ${errMessage(err)}`));
+    return 1;
+  }
+  const serviceNames = uniqueServiceNames(
+    selected.map((c) => ({
+      name: inferServiceName(c.recipe, c.name),
+      relDir: c.relDir
+    }))
+  );
+  const outcomes = [];
+  for (const [i, c] of selected.entries()) {
+    const recipe = c.recipe;
+    const name = serviceNames[i];
+    ui.out("");
+    ui.out(
+      color.bold(`[${i + 1}/${selected.length}] ${c.relDir}`) + color.dim(` \u2014 ${stackLabel(c)}`)
+    );
+    if (c.flags.includes("already-wired")) {
+      ui.out(`${color.green("\u2713")} Already wired \u2014 leaving it untouched.`);
+      outcomes.push({
+        name,
+        relDir: c.relDir,
+        recipe,
+        status: "skipped-already-wired",
+        filesTouched: [],
+        notes: []
+      });
+      continue;
+    }
+    try {
+      const svc = await deps.provisionService({
+        base,
+        token,
+        projectId: project.id,
+        recipe,
+        stack: c.detected.otlpStack,
+        serviceName: name,
+        ui,
+        fetchImpl: deps.fetchImpl
+      });
+      const plan = deps.buildPlan({
+        cwd: c.dir,
+        recipe,
+        endpoint: base,
+        apiKey: svc.apiKey,
+        entryFile: c.detected.entryFile,
+        nextVersion: c.detected.nextVersion,
+        stack: c.detected.otlpStack ?? void 0,
+        options: { force: parsed.yes }
+      });
+      const install = await deps.installSdk({
+        cwd: c.dir,
+        packageManager: c.detected.packageManager ?? ctx.root.packageManager,
+        recipe,
+        base,
+        ui,
+        fetchImpl: deps.fetchImpl
+      });
+      if (install.installed) {
+        ui.out(`${color.green("\u2713")} Installed ${install.packages.join(", ")}.`);
+      } else if (install.note) {
+        ui.out(color.yellow(`! ${install.note}`));
+      }
+      const applied = await applyBatchInjection(plan, c, svc.serviceName, {
+        parsed,
+        deps,
+        base
+      });
+      outcomes.push({
+        name: svc.serviceName,
+        relDir: c.relDir,
+        recipe,
+        status: applied.status,
+        serviceId: svc.serviceId,
+        apiKey: svc.apiKey,
+        filesTouched: applied.filesTouched,
+        notes: [
+          ...!install.installed && install.note ? [install.note] : [],
+          ...applied.notes
+        ]
+      });
+    } catch (err) {
+      const message = errMessage(err);
+      ui.err(color.red(`\u2717 ${c.relDir}: ${message}`));
+      outcomes.push({
+        name,
+        relDir: c.relDir,
+        recipe,
+        status: "failed",
+        filesTouched: [],
+        notes: [],
+        error: message
+      });
+    }
+  }
+  const reporting = outcomes.filter(
+    (o) => o.status === "wired" || o.status === "guidance"
+  );
+  const batchNotes = [];
+  if (parsed.skipVerify) {
+    batchNotes.push("Verification skipped (--skip-verify).");
+  } else if (reporting.length > 0) {
+    for (const o of reporting) {
+      if (!o.apiKey) continue;
+      try {
+        await deps.syntheticCheck(base, o.apiKey, deps.fetchImpl);
+        ui.out(`${color.green("\u2713")} ${o.name}: key + endpoint OK.`);
+      } catch (err) {
+        ui.err(
+          color.red(`\u2717 ${o.name}: ingest check failed: ${errMessage(err)}`)
+        );
+        o.notes.push("Synthetic ingest check failed \u2014 check network/endpoint.");
+      }
+    }
+    const byServiceId = new Map(
+      reporting.filter((o) => o.serviceId).map((o) => [o.serviceId, o])
+    );
+    const poll = await pollServicesWithSigint(
+      {
+        base,
+        token,
+        projectId: project.id,
+        ui,
+        wizardStart,
+        serviceIds: [...byServiceId.keys()],
+        onFound: (serviceId, sessionId) => {
+          const o = byServiceId.get(serviceId);
+          if (!o) return;
+          o.sessionUrl = `${base}/sessions/${encodeURIComponent(sessionId)}`;
+          ui.out(`${color.green("\u2713")} ${o.name}: first event received.`);
+        },
+        fetchImpl: deps.fetchImpl
+      },
+      deps
+    );
+    if (poll.outcome !== "found") {
+      for (const o of byServiceId.values()) {
+        if (!o.sessionUrl) o.notes.push("No event yet \u2014 start this service.");
+      }
+    }
+  }
+  printBatchSummary(ui, base, root, project.name, outcomes, batchNotes);
+  const attempted = outcomes.filter(
+    (o) => o.status !== "skipped-already-wired"
+  );
+  const anyGood = outcomes.some(
+    (o) => o.status === "wired" || o.status === "guidance"
+  );
+  return attempted.length > 0 && !anyGood ? 1 : 0;
+}
+async function applyBatchInjection(plan, candidate, serviceName, ctx) {
+  const { parsed, deps, base } = ctx;
+  if (plan.kind === "otlp-guidance") {
+    const body = renderOtlpGuide({
+      stack: candidate.detected.otlpStack ?? RECIPE_REGISTRY.otlp.stack,
+      serviceName,
+      endpoint: base,
+      snippet: plan.snippet ?? "",
+      agentPrompt: plan.agentPrompt ?? ""
+    });
+    const res = deps.executePlan(otlpGuidePlan(candidate.dir, body));
+    deps.ui.out(
+      `${color.green("\u2713")} Speaks OpenTelemetry \u2014 no SDK needed. Wrote ${color.cyan(res.written.join(", "))}.`
+    );
+    return {
+      status: "guidance",
+      filesTouched: res.written,
+      // The summary already prefixes each note with the service name.
+      notes: ["add the OTLP exporter from the guide file to start reporting."]
+    };
+  }
+  const applied = await applyInjection(plan, parsed, deps);
+  const status = plan.kind === "fallback-ai" ? "guidance" : applied.filesTouched.length > 0 ? "wired" : "skipped-already-wired";
+  return { status, filesTouched: applied.filesTouched, notes: applied.notes };
+}
+function printBatchSummary(ui, base, root, projectName, outcomes, batchNotes = []) {
+  const mark = {
+    wired: color.green("\u2713"),
+    guidance: color.green("\u2713"),
+    "skipped-already-wired": color.dim("\xB7"),
+    failed: color.red("\u2717")
+  };
+  const width = Math.max(...outcomes.map((o) => o.name.length), 4);
+  const rel = (p) => path4.relative(root, p) || p;
+  ui.out("");
+  ui.out(color.bold(`Setup complete \u2014 project "${projectName}"`));
+  ui.out("");
+  for (const o of outcomes) {
+    const detail = o.status === "failed" ? color.red(`failed: ${o.error}`) : o.status === "skipped-already-wired" ? color.dim("already wired \u2014 skipped") : o.sessionUrl ? color.cyan(o.sessionUrl) : o.filesTouched.length > 0 ? color.dim(o.filesTouched.map(rel).join(", ")) : "";
+    ui.out(
+      `  ${mark[o.status]} ${o.name.padEnd(width)}  ${color.dim(o.relDir.padEnd(24))} ${detail}`
+    );
+  }
+  const count = (s) => outcomes.filter((o) => o.status === s).length;
+  const parts = [
+    `${count("wired")} wired`,
+    ...count("guidance") > 0 ? [`${count("guidance")} guidance`] : [],
+    ...count("failed") > 0 ? [`${count("failed")} failed`] : [],
+    ...count("skipped-already-wired") > 0 ? [`${count("skipped-already-wired")} skipped`] : []
+  ];
+  ui.out("");
+  ui.out(`  ${parts.join(" \xB7 ")}`);
+  ui.out(`  Dashboard: ${color.cyan(`${base}/bugs`)}`);
+  const notes = [
+    ...outcomes.flatMap((o) => o.notes.map((n) => `${o.name}: ${n}`)),
+    ...batchNotes
+  ];
+  if (count("failed") > 0) {
+    notes.push("Re-run `crumbtrail` to retry \u2014 wired services are skipped.");
+  }
+  if (notes.length > 0) {
+    ui.out("");
+    for (const n of notes) ui.out(color.dim(`  note: ${n}`));
+  }
+}
+async function applyInjection(plan, parsed, deps) {
+  const { ui } = deps;
+  const filesTouched = [];
+  const notes = [];
+  for (const w of plan.warnings) ui.out(color.dim(`  \xB7 ${w}`));
+  if (plan.kind === "skip-already-wired") {
+    ui.out(`${color.green("\u2713")} Already wired \u2014 leaving your code untouched.`);
+    return { filesTouched, notes };
+  }
+  if (plan.kind === "fallback-ai") {
+    ui.out(color.yellow("Couldn't safely edit your code automatically."));
+    if (plan.snippet) {
+      ui.out(color.dim("Paste this into your entry file:"));
+      ui.out(plan.snippet);
+    }
+    if (plan.agentPrompt) {
+      ui.out(color.dim("\nOr hand this to your coding agent:"));
+      ui.out(plan.agentPrompt);
+    }
+    notes.push("Injection fell back to a manual snippet / AI prompt.");
+    return { filesTouched, notes };
+  }
+  if (plan.kind === "otlp-guidance") {
+    ui.out(
+      `${color.green("\u2713")} Detected a non-JS backend that already speaks OpenTelemetry \u2014 no SDK needed.`
+    );
+    ui.out(color.dim("Point your existing OTLP exporter at Crumbtrail:"));
+    if (plan.snippet) ui.out(plan.snippet);
+    if (plan.agentPrompt) {
+      ui.out(color.dim("\nOr hand this to your coding agent:"));
+      ui.out(plan.agentPrompt);
+    }
+    notes.push(
+      "OTLP backend \u2014 printed OpenTelemetry setup guidance; no files were changed."
+    );
+    return { filesTouched, notes };
+  }
+  if (plan.kind === "needs-confirm-dirty") {
+    const ok = parsed.yes ? true : await deps.prompter.confirm(
+      `${plan.targetPath} has uncommitted changes \u2014 prepend into it anyway?`,
+      false
+    );
+    if (!ok) {
+      ui.out(
+        color.yellow("Left your file untouched. Add this to the top yourself:")
+      );
+      if (plan.content) ui.out(plan.content);
+      notes.push(`Skipped editing ${plan.targetPath} (dirty). Apply manually.`);
+      return { filesTouched, notes };
+    }
+    const res2 = deps.executePlan(plan, void 0, { confirmDirty: true });
+    filesTouched.push(...res2.written);
+    ui.out(`${color.green("\u2713")} ${describeWrites(res2)}`);
+    return { filesTouched, notes };
+  }
+  if (plan.targetPath) {
+    ui.out(
+      `${plan.kind === "create" ? "Creating" : "Editing"} ${color.cyan(plan.targetPath)}\u2026`
+    );
+  }
+  if (plan.envAction) {
+    ui.out(
+      `Appending CRUMBTRAIL_KEY to ${color.cyan(plan.envAction.targetPath)}\u2026`
+    );
+    if (plan.envAction.gitignoreWarning) {
+      notes.push(plan.envAction.gitignoreWarning);
+    }
+  }
+  const res = deps.executePlan(plan);
+  filesTouched.push(...res.written);
+  ui.out(`${color.green("\u2713")} ${describeWrites(res)}`);
+  return { filesTouched, notes };
+}
+function describeWrites(res) {
+  if (res.written.length === 0) return res.message;
+  return `Crumbtrail wired in \u2014 wrote ${res.written.join(", ")}.`;
+}
+async function pollWithSigint(base, token, projectId, deps, wizardStart) {
+  const controller = new AbortController();
+  const onSigint = () => controller.abort();
+  process.once("SIGINT", onSigint);
+  try {
+    return await deps.pollForRealEvent({
+      base,
+      token,
+      projectId,
+      ui: deps.ui,
+      wizardStart,
+      signal: controller.signal,
+      fetchImpl: deps.fetchImpl
+    });
+  } finally {
+    process.removeListener("SIGINT", onSigint);
+  }
+}
+async function pollServicesWithSigint(opts, deps) {
+  const controller = new AbortController();
+  const onSigint = () => controller.abort();
+  process.once("SIGINT", onSigint);
+  try {
+    return await deps.pollForServices({ ...opts, signal: controller.signal });
+  } finally {
+    process.removeListener("SIGINT", onSigint);
+  }
+}
+function printSummary(ui, base, p, filesTouched, notes, sessionUrl) {
+  ui.out("");
+  ui.out(color.bold("Setup complete"));
+  ui.out(`  Project:   ${p.projectName}`);
+  ui.out(`  Service:   ${p.serviceName}`);
+  ui.out(
+    `  Key:       ${maskKey(p.apiKey)} ${color.dim("(already wired into your code)")}`
+  );
+  if (filesTouched.length > 0) {
+    ui.out(`  Files:     ${filesTouched.join("\n             ")}`);
+  }
+  if (sessionUrl) {
+    ui.out(`  Session:   ${color.cyan(sessionUrl)}`);
+  }
+  ui.out(`  Dashboard: ${color.cyan(`${base}/bugs`)}`);
+  if (notes.length > 0) {
+    ui.out("");
+    for (const n of notes) ui.out(color.dim(`  note: ${n}`));
+  }
+}
+function errMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+async function runLogin(parsed, deps) {
+  const base = resolveEndpoint(parsed.endpoint, deps.env);
+  try {
+    await deps.ensureToken({
+      base,
+      ui: deps.ui,
+      noBrowser: parsed.noBrowser,
+      fetchImpl: deps.fetchImpl,
+      env: deps.env
+    });
+    return 0;
+  } catch (err) {
+    deps.ui.err(color.red(`Login failed: ${errMessage(err)}`));
+    return 1;
+  }
+}
+function runLogout(deps) {
+  const cleared = clearAuth(deps.env);
+  deps.ui.out(cleared ? "Logged out." : "No saved login to clear.");
+  return 0;
+}
+async function runCli(argv, deps = defaultDeps()) {
+  const parsed = parseArgs(argv);
+  if (parsed.command === "version") {
+    deps.ui.out(readVersion());
+    return 0;
+  }
+  if (parsed.command === "help") {
+    deps.ui.out(USAGE);
+    return 0;
+  }
+  if (parsed.unknown) {
+    deps.ui.err(`Unknown argument: ${parsed.unknown}
+`);
+    deps.ui.err(USAGE);
+    return 1;
+  }
+  if (parsed.command === "login") return runLogin(parsed, deps);
+  if (parsed.command === "logout") return runLogout(deps);
+  if (!deps.isTTY && !(parsed.yes && parsed.project)) {
+    deps.ui.err(
+      color.red(
+        "Non-interactive shell detected. Pass --yes and --project <id> to run without prompts."
+      )
+    );
+    deps.ui.err("");
+    deps.ui.err(USAGE);
+    return 1;
+  }
+  return runWizard(parsed, deps);
+}
+function isCliEntrypoint(argv1) {
+  if (!argv1) return false;
+  return ["cli.ts", "cli.js", "cli.cjs", "cli.mjs", "crumbtrail"].includes(
+    path4.basename(argv1)
+  );
+}
+if (isCliEntrypoint(process.argv[1])) {
+  runCli(process.argv).then((code) => process.exit(code)).catch((err) => {
+    process.stderr.write(`crumbtrail: ${errMessage(err)}
+`);
+    process.exit(1);
+  });
+}
+export {
+  defaultDeps,
+  installSdk,
+  isCliEntrypoint,
+  parseArgs,
+  resolveSelection,
+  runBatchWizard,
+  runCli,
+  runWizard
+};