gherkin-ai 2.6.4 → 3.0.0

package/CHANGELOG.md

@@ -0,0 +1,231 @@
+# Changelog
+
+All notable changes to this project will be documented in this file. See [commit-and-tag-version](https://github.com/absolute-version/commit-and-tag-version) for commit guidelines.
+
+## [3.0.0] - 2026-10-05
+
+Enterprise-readiness release, driven by the reviews of 2.6.x. Contains breaking changes: see `docs/MIGRATION-3.0.md`. For operators: `docs/ENTERPRISE.md`. Support and versioning policy: `SUPPORT.md`.
+
+### Added
+- **Runtime kernel for every backend:**
+  - **What it is.** A verified path for persistence, messaging and tracing (`docs/RUNTIME-KERNEL.md`):
+    - a PostgreSQL command service with idempotency claims and a transactional outbox;
+    - an outbox relay with `FOR UPDATE SKIP LOCKED` leases and publisher confirms;
+    - an inbox consumer with deduplication and a dead-letter queue;
+    - a saga orchestrator with reverse compensation;
+    - W3C trace context across the command, publish and consume spans.
+  - **Where.** Implemented with each language's standard driver, AMQP client and OpenTelemetry SDK: NestJS, Express, ASP.NET Core, Spring Boot (Java, Kotlin), FastAPI, Django, Go, Laravel, Rails, Phoenix and Axum.
+  - **Verification.** The integration suite (IT1–IT7) runs in every backend golden build against PostgreSQL 17 and RabbitMQ 4.
+- **OpenTelemetry in the frontends:** the generated API clients (React, Vue, Angular, Next.js, React Native, Flutter) send a `traceparent` header, and their generated tests assert it.
+- **Agent firewall:**
+  - **What it decides.** One decision point for agent writes, commands, network access, secrets and MCP tools: ALLOW, REQUIRE_APPROVAL or DENY.
+  - **Policy sources.** Built-in rules, `policy.firewall`, `.ghkgovernance.yaml` and the impact scope of the feature being implemented.
+  - **Where it applies.** The MCP server, `verify --auto-fix --apply` and `autopilot --apply` (blocked files become proposals), and `ghk firewall check|policy|hook`, including a Claude Code `PreToolUse` hook.
+  - **Self-protection.** Agents cannot edit `.ghkgovernance.yaml`.
+- **Delivery risk (`ghk risk`):**
+  - **Input.** The git change set, an explicit file list or the working tree.
+  - **Scoring.** LOW to CRITICAL across six weighted dimensions, each with evidence: security, business criticality, change radius, test weakness, contract drift and architecture drift.
+  - **Policy and CI.** `policy.risk.requireApprovalAt` and `policy.risk.criticalPaths` configure approval; `--fail-on` gates CI with exit code 4.
+- **Traceability graph (`ghk graph`):**
+  - **What it links.** Feature → scenario → command / event / endpoint, connected to the files and tests that reference them.
+  - **Output.** A summary, JSON, Mermaid or DOT; `--trace` for one symbol and `--scope` for a feature's change scope.
+- **GitHub Spec Kit interop:** `ghk speckit import` (spec.md → .feature) and `ghk speckit export`, round-tripping user stories, priorities and FR-### requirements.
+- **A/B benchmark harness (`ghk bench`):**
+  - **What it compares.** The same agent on the same task, with and without gherkin-ai.
+  - **Scoring.** Deterministic: build, tests, hidden acceptance tests (copied in after the agent finishes), convergence, files changed and time.
+  - **Cost.** No LLM is called by the harness itself.
+- **Hardened Docker sandbox for `verify --docker`:**
+  - no network by default (`--docker-network`);
+  - memory, CPU and process limits;
+  - all capabilities dropped, `no-new-privileges` and a read-only root filesystem;
+  - the stack's verified toolchain image;
+  - configurable in `sandbox.*`.
+- **AWS CDK infrastructure is opt-in** (`infrastructure.awsCdk`, default on for SQS/SNS messaging). The generated app (EKS with IRSA, DLQ alarm) has its own golden build with CDK assertions and `cdk synth`.
+- **`converge` measures generated contracts:** OpenAPI operations and status codes, AsyncAPI events, and domain types in the generated sources. Each dimension reports its basis (`artifacts`, `specification` or `reports`).
+- `SUPPORT.md` (semver contract and support windows) and issue templates.
+- **Layered, validated configuration:** defaults → organization (`GHK_ORG_CONFIG`) → user → project → environment, validated with zod; organization `locked` paths; published JSON Schema (`schemas/config.schema.json`); `ghk config show|validate|schema`.
+- **LLM providers:** Azure OpenAI (API key or Entra ID), Amazon Bedrock, Google Gemini and Vertex AI, OpenAI-compatible gateways (`llm.baseUrl` + `llm.headers`), alongside OpenAI, Anthropic and Ollama. Per-request timeouts, a single retry layer honoring `Retry-After`, per-run token budgets, and allow-lists for providers, models and endpoints.
+- **Corporate networking:** `HTTPS_PROXY`/`NO_PROXY` and `network.proxy` for all providers; extra trusted CAs via `network.caFile`.
+- **Credentials:** OS keychain storage (`ghk login`, `--api-key-stdin`), `ghk logout`, `ghk auth status`.
+- **Automation contract:** documented exit codes (2 usage, 3 config, 4 gate, 5 policy, 6 provider, 7 drift); `--json` prints exactly one JSON document on stdout for every command; `--quiet`; `NO_COLOR`.
+- **Audit and telemetry:** structured `audit.jsonl` and `telemetry.jsonl` (local only) with execution ids; LLM calls, MCP calls, agent write decisions and plugin loads are audited; `ghk audit export --format jsonl|csv --since`.
+- **Agent write guards:** `autopilot` is dry-run by default (`--apply`); `--apply` is refused in CI (`--allow-unattended-writes`) and on protected branches (`--force-branch`).
+- **Governed plugins:** `plugins.load` with an organization allow-list (`plugins.allow`).
+- **Every stack is stable:** 13 backends (NestJS, Express, ASP.NET Core, Spring Boot Java and Kotlin, FastAPI, Django, Go, Laravel 13, Rails 8, Phoenix, Axum, Flutter), 7 frontends (React, Vue, Angular 22, Next.js 16, React Native/Expo 57, Flutter, Phoenix LiveView) and gRPC/GraphQL contracts. CI generates each one and builds it and runs its generated tests in the stack's official Docker image (`scripts/golden-build.js`); `ghk stacks` lists them.
+- **Shared domain kernel:** every stack renders the same aggregate, unit tests, HTTP contract test and pending BDD steps bound to the feature file.
+- **Opt-in gRPC and GraphQL contracts** (`contracts.grpc`, `contracts.graphql`), validated with buf and graphql-js.
+- **Web Studio works offline:** Tailwind and Font Awesome are bundled instead of loaded from a CDN; Playwright end-to-end tests assert that no external request is made.
+- **CI/release:** OS × Node 22/24 matrix, blocking `npm audit`, golden builds, CLI contract tests against the built binary, and a release workflow with npm provenance and a CycloneDX SBOM.
+- `--threshold` for `lint` and `converge`.
+- **`ghk upgrade`: assisted upgrade of 2.x projects.**
+  - Reports what the project needs: generated-file versions, config, CI scripts, MCP clients and legacy credential files.
+  - With `--apply`, regenerates on a new git branch and removes stale generated files only when they were never edited.
+  - `--check` gates CI.
+- **NestJS 12 and Prisma 7 (opt-in):**
+  - New config keys `stack.frameworkVersion` (`"11"` default, `"12"`) and `stack.ormVersion` (`"6"` default, `"7"`), also settable with `ghk init --frameworkVersion/--ormVersion`.
+  - NestJS 12 projects are generated as ES modules.
+  - Prisma 7 projects use the `prisma-client` generator, `prisma.config.ts` and the driver adapter for the configured database.
+  - All four NestJS combinations and Express with Prisma 7 have their own golden build.
+- **`@aggregate:Name` feature tag** sets the type name used by every generator, instead of the name derived from a long feature title.
+
+### Changed
+- **Startup time** reduced from about 0.7 s to about 0.15 s: command handlers and networking are loaded lazily.
+- **MCP server rebuilt on `@modelcontextprotocol/sdk`:**
+  - Read-only by default; write tools need `mcp.allowWrite`, and destructive tools also need `GHK_ALLOW_DESTRUCTIVE`.
+  - Central path containment, agent policy and auditing on every call.
+  - Command output is captured instead of corrupting the stdio protocol.
+  - Commands are invoked in-process, so the server works when installed globally.
+  - `ghk mcp install` pins the package version.
+- **Web Studio:** per-session token, exact Host and Origin checks, path containment, no shell execution.
+- **Security patterns unified** in `src/core/security`. Secrets are redacted from LLM prompts, log files and audit records.
+- **Logger:** levels, stderr for diagnostics, opt-in rotated log file; no longer writes `.ghe/logs` into the working directory on every run.
+- **Single version source:** the CLI banner, `--version` and the MCP `serverInfo` all read the version from `package.json`. The MCP server previously reported a hardcoded value.
+- **Package contents:** `CHANGELOG.md`, `LICENSE`, `SECURITY.md` and `schemas/` are now published.
+- **Generated NestJS and Express projects use current dependencies:**
+  - NestJS 11, Express 5, Prisma 6.19, Zod 4 (`z.uuid()`, `z.email()`, `z.iso.datetime()`), Jest 30, Cucumber 13, TypeScript 6 (`module: nodenext`), `@types/node` 22.
+  - Step definitions load through `tsx` instead of the unmaintained `ts-node`.
+  - Tenant scoping moved from the removed Prisma `$use` middleware to a client extension (`PrismaService.tenant`). The generated repository uses it.
+  - NestJS 12 and Prisma 7 are opt-in (see Added). NestJS 11 and Prisma 6 stay the defaults.
+- **TypeScript projects without a NestJS or Express backend:**
+  - A frontend framework in `stack.framework` (`react`, `vue`, `angular`, `nextjs`, `react-native`) generates that stable frontend project.
+  - Other backends (`fastify`, `node-native`) generate contracts and prompts only, and are reported as experimental.
+  - Previously both got a Playwright spec containing only comments. `nest` is accepted as an alias of `nestjs`.
+
+### Fixed
+- **`autopilot --apply` skipped the CI and protected-branch guards.** It imported the write guard but never called it, and did not pass `--allow-unattended-writes` / `--force-branch` on to its verify step.
+- **`.ghkgovernance.yaml` `allowedPaths` was never enforced.** Only protected paths were checked. The glob matcher also accepted any path containing the pattern text.
+- **Documentation:** the architecture page listed MCP tools that do not exist; the README listed container images the CLI does not use; the evaluation report was a self-scored rubric. They were replaced by documents that match the code and by reproducible evidence (`docs/EVALUATION_REPORT.md`).
+- **Credential leak between providers:** a key belonging to another provider could be sent to the selected one (for example, the OpenAI key sent to Anthropic). `--apiKey` was silently ignored.
+- **NestJS idempotency race:** expired or failed keys could be re-claimed by two concurrent requests.
+- **Generated NestJS projects did not compile:**
+  - inconsistent `PrismaService` paths;
+  - missing dependencies;
+  - escaped `\n` inside step definitions;
+  - missing Prisma models;
+  - wrong Prisma delegate casing.
+- **Generated .NET projects did not compile:**
+  - non-existent `Microsoft.EntityFrameworkCore.PostgreSQL` package;
+  - invalid root namespace for hyphenated project names;
+  - Aspire AppHost compiled into the API project;
+  - wrong command namespaces;
+  - missing event record;
+  - missing OpenTelemetry, Testcontainers, ServiceDiscovery and Swashbuckle packages.
+- **Unhandled async errors:** `program.parse()` → `parseAsync()`.
+- **Help and workspace detection:** workspace detection no longer prompts or changes directory for `--help` or in CI. `--project` no longer creates directories (except for `init`).
+- **Web Studio path traversal:** `/api/features/*` and `/api/file` were affected (sibling-prefix bypass).
+- **Portability:** `verify` no longer shells out to `sleep`, which is not available on Windows.
+- **Dependency vulnerabilities:** resolved transitive advisories (brace-expansion, fast-uri, hono, ip-address).
+
+### Fixed (generation)
+- Localized features (`# language: es` or any leading comment) were parsed as Markdown, producing names like `LanguageEs`.
+- Identifiers kept broken fragments of accented words (`CreaciN`); one-letter words were glued to the next (`yrenderizado`).
+- Decimal amounts before a quoted value produced invalid field types (`00DTO`).
+- Connection URLs without credentials (`amqp://rabbitmq:5672`) were rejected as leaked secrets.
+- Generators derived the feature's type names differently, so .NET handlers referenced commands and read models the contracts never declared; all generators now share one naming helper.
+- Features outside `outputDir` were not found by the generated test runners; they are now copied into `<outputDir>/features/`.
+- Go contracts imported `uuid` without using it when a feature declared no events (`go vet` failure).
+- Prisma schemas redeclared `id`/`tenantId` when the feature mentioned an `ID` value.
+- Ruby and Elixir step definitions double-escaped `/` and `|`, breaking steps that contain URL paths; Go dropped backticks from step patterns.
+
+### Removed
+- **Node.js 20 support** (end-of-life); the CLI requires Node.js 22.12 or later.
+- Superseded frontend generators (`react-generator`, `vue-pinia-generator`, `angular-ngrx-generator`, `angular-signalr-service`) and the classic NgRx store mode.
+- `ghk login --apiKey/--token/--user/--endpoint/--server` and the `auth` alias of `login`.
+- MCP tool `run_cli_login`; `clear` on `run_cli_audit`.
+- Legacy hook manager `src/core/hooks.ts`.
+- Stray development files from the repository root (`cdk-test-out.ts`, `scratch/`, `specs/`, pack logs).
+
+## [2.6.5] - 2026-09-28
+
+> Published to npm without a changelog entry; reconstructed from git history.
+
+### Added
+- Kotlin contract generation integrated with the contract generation system.
+- Markdown EARS parser (`src/core/parsers/markdown-ears-parser.ts`).
+- Plugin management in `ghk generate`.
+- AWS CDK infrastructure stack (SNS, SQS, DynamoDB, EKS, Secrets Manager).
+- Multi-tenancy support for Go, Java, Python and NestJS generators; Prisma multi-tenancy and relation tracking.
+- OpenTelemetry Jaeger exporter and additional instrumentations.
+- `ghk audit` HTML report generation.
+- Coverage analysis in `ghk quality` and `--isolated` mode in `ghk verify`.
+
+### Changed
+- NestJS Outbox and Saga infrastructure with atomic claims and idempotency patterns.
+- API keys are no longer persisted in `auth.json`; Row-Level Security enforcement and governance checks for destructive MCP operations.
+- Deprecation warnings for manual prompt workflows.
+
+## [2.6.4] - 2026-09-16
+
+### Fixed
+- README explicitly included in the npm bundle.
+
+### Docs
+- Multi-stack evaluation report (`docs/EVALUATION_REPORT.md`) and updated command documentation.
+
+## [2.6.3](https://github.com/FennerEduardo/gherkin-ai-cli/compare/v2.6.2...v2.6.3) (2026-09-15)
+
+
+### Bug Fixes
+
+* correct package.json files array to ensure npm registry parses README.md ([78f34fa](https://github.com/FennerEduardo/gherkin-ai-cli/commit/78f34fa5fe41b4cd718b7341aa3a42f8e24e0c71))
+
+## [2.6.2] - 2026-09-15
+
+### Added
+- **Docker Validation Script (`validate.sh`):** C# and .NET generators now emit a `validate.sh` script to verify compilation cleanly inside an isolated Docker container without relying on host SDKs.
+- **Git Commit Suggester:** `ghk generate` now intelligently outputs a draft commit message in `.ghe/suggested_commit.md` documenting the scaffolds, features generated, and CI validations.
+- **Atomic Concurrency Handlers (C#):** Replaced in-memory Idempotency and Outbox implementations with robust PostgreSQL atomic locks (`FOR UPDATE SKIP LOCKED` and `TryAddAsync`).
+
+### Changed
+- **BDD Framework Migration:** Replaced deprecated `SpecFlow.xUnit` with `Reqnroll.xUnit` as the standard BDD C# framework for generated step definitions.
+- **Improved C# Scaffolding:** Cleaned up stubs (`Task.CompletedTask`) and replaced them with functional Entity Framework Core snippets (`ApplicationDbContext`, DbSets) and explicit Scaffolding exceptions to pass the internal Anti-Stub Guardrail.
+- **Dynamic Brokers:** `preset-csharp-dotnet.ts` now injects `MassTransit` configuration (RabbitMQ vs SQS) dynamically based on `gherkin-ai.config.json` instead of hardcoding.
+- **Docker Compose Security:** Database passwords are no longer hardcoded in `docker-compose.yml`; the generator now uses shell variables (`${POSTGRES_PASSWORD:-dev_password}`).
+
+### Fixed
+- **CS0111 Step Duplication:** C# Step Definitions generator now uses a `Set` to prevent duplicate method generation when scenarios share the same BDD steps.
+- **MediatR Contract Constraints:** Fixed `IRequest` inheritance bounds for Commands and Queries in C# contracts to satisfy MediatR `IRequestHandler` type constraints.
+- **AWS CDK Naming Bug:** Fixed PascalCase conversion for project names with hyphens (e.g., `transactional-system` -> `TransactionalSystemInfrastructureStack`) to prevent invalid TS identifiers in CDK.
+- **Artifact Sprawl:** Forced default `outputDir` in config to `./` to prevent split-brain architecture where `.feature` files live in the root and code lives inside a nested `generated-specs` folder.
+- **TS Leak in C#:** Prevented Node.js/Zod `contracts.ts` files from being incorrectly emitted into C# project trees.
+
+## [2.6.1] - 2026-09-07
+
+### Fixed
+- Added `@vitest/coverage-v8` to devDependencies.
+- Migrated Vitest configuration to `vitest.config.mts` for native ESM compatibility.
+- Updated local `publish:prod` script to remove `--provenance` flag for CLI terminal execution.
+
+## [2.6.0] - 2026-09-07 - Official Enterprise Release
+
+### Added
+- **Semantic Intermediate Representation (IR Engine):** Rich 37KB AST & NLP extractor (`src/core/ir-builder.ts`) for state machines, domain events, invariants, and traceability.
+- **Enterprise Constitution & Guardrails (`.gherkin-ai/`):** Full YAML governance schema (`src/core/constitution.ts`), agent role permissions, LLM policies, and compliance framework schemas.
+- **Specification Linter (`ghk lint`):** 14 linting rules for Gherkin specifications with quality scoring and CLI diagnostic outputs.
+- **Specification Convergence Engine (`ghk converge`):** 6-dimensional spec-to-code alignment verification system with CONVERGED / DIVERGED status badges.
+- **OpenAPI Schema Validator (`src/core/openapi-validator.ts`):** Validates generated OpenAPI 3.0 specs against Gherkin endpoints.
+- **Plugin Architecture (`src/core/plugin-system.ts`):** Extensible plugin interface for third-party generators and presets.
+- **Impact Analysis (`ghk impact`) & PR Reviewer (`ghk pr-review`):** Blast radius analyzer and automated PR review bot.
+- **Prisma Schema & Zod Generator (`src/generators/prisma-generator.ts`):** Auto-generates `schema.prisma` from IR entities and state machines, with conditional `npx prisma format` execution.
+- **Failed Attempt Diagnostics Logging:** Automatically logs raw prompts, responses, and diffs to `.gherkin-ai/logs/autopilot/` pre-rollback on agent failures.
+- **Supply Chain Security & Provenance:** Published with npm `--provenance` and included GitHub Actions CI workflow generator.
+
+### Fixed
+- **Dynamic Spec Directory Resolver (`src/utils/spec-dir-resolver.ts`):** Fixed critical `ENOENT: specs/` bug by auto-resolving `features/`, `specs/`, or `specDir` in configuration.
+- **Non-Interactive CI Mode:** Automatic directory suggestion/selection in headless mode without prompt locks.
+- **Clean Architecture Import Compliance:** Removed `@nestjs/common` imports from step definition presets to guarantee 0 layer violations in `ghk validate`.
+
+## [2.3.1] - 2026-09-02
+### Changed
+- Promoted self-healing engine from beta to stable.
+- Minor performance patches.
+
+## [2.2.0] - 2026-08-15
+### Added
+- Web Studio UI (`ghk web`) for visual orchestrating.
+- AST Step Definitions Indexer for hallucination prevention via `ts-morph`.
+- DOM & Data Model Anchor for precise test generation.
+- `ghk skill` command for IDE (.cursorrules) integration.
+- Headless CI/CD Mode.
+- Official `@cucumber/gherkin` parser support.
+- Initial multi-stack templates (Rust, Go, Mobile, React, Java).

package/README.md

@@ -1,78 +1,126 @@
-# 🥒 `gherkin-ai` CLI & Agentic Verification Engine
+# gherkin-ai
 
 [![npm version](https://img.shields.io/npm/v/gherkin-ai.svg)](https://www.npmjs.com/package/gherkin-ai)
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![CI](https://github.com/FennerEduardo/gherkin-ai-cli/actions/workflows/ci.yml/badge.svg)](https://github.com/FennerEduardo/gherkin-ai-cli/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 
-> **The Closed-Loop Agentic Testing & Orchestration Engine for Full-Stack Applications.**
-> Turn product requirements into verifiable Gherkin specifications, execute 15+ multi-stack implementations (React/Vue/Angular + Java / Kotlin / Go / Elixir / PHP / Ruby / Python / .NET / Flutter / React Native, plus gRPC & GraphQL contracts), and experiment with self-healing agent loops.
-> 
-> [![CI](https://github.com/FennerEduardo/gherkin-ai-cli/actions/workflows/ci.yml/badge.svg)](https://github.com/FennerEduardo/gherkin-ai-cli/actions/workflows/ci.yml)
-> [![Coverage Status](https://img.shields.io/badge/coverage-100%25-brightgreen.svg)]()
+**Spec-driven verification and governance for AI-assisted software delivery.**
 
----
+gherkin-ai turns requirements into executable Gherkin specifications and generates verified contracts and code for 20+ stacks. It gates changes on specification quality, drift and delivery risk, and controls what AI coding agents may change.
 
-## 🌟 Strategic Capabilities
+- **Specify.** Write or import (GitHub Spec Kit) `.feature` files, lint them, and build a semantic model of commands, events, endpoints, states and rules.
+- **Generate.** Contracts, a domain kernel, tests bound to the feature, and a runtime for persistence, messaging and tracing. Every stable stack is built and tested in CI.
+- **Govern.** An agent firewall for MCP clients, IDE agents and the CLI's own agent loops. Risk scoring of every change, traceability from requirement to code to tests, and a local audit trail.
+- **Verify.** Spec-to-code convergence, drift detection and sandboxed test runs, with stable exit codes and `--json` for CI.
 
-While basic AI spec tools only generate text prompts, `gherkin-ai` acts as an **executable contract and verification harness** between Product Intent, AI Agents (Cursor, Antigravity, Claude Code, Windsurf, Copilot), Code Implementation, and CI/CD Quality Gates:
+Rolling it out in a company? Start with [docs/ENTERPRISE.md](docs/ENTERPRISE.md). Upgrading from 2.x? See [docs/MIGRATION-3.0.md](docs/MIGRATION-3.0.md).
 
-- 🤖 **AI Agent Implementation Orchestration (`ghk implement`)**: Compiles `.ghkgovernance.yaml`, domain contracts (`*.contract.php`, `.ts`, `.py`, `.java`, `.go`, `.ex`, `.kt`, `.proto`, `.graphql`), ADRs, and Gherkin features into a copy-pasteable Master Agent Implementation Prompt.
-- 🐳 **Docker Container Sandbox & Host Protection (`--docker`)**: Generates stack-specific dev container environments (`mcr.microsoft.com/dotnet/sdk`, `eclipse-temurin:21`, `elixir:1.16`, `golang:1.22`, `php:8.3`, `python:3.12`, `ruby:3.3`, `node:20`) so AI agents run tests inside isolated Docker containers without polluting host OS.
-- 📋 **Feature Inventory & Developer Audit Trail (`ghk audit`)**: Auto-detects developer identity (`git config user.name`/`email`), SHA-256 spec & prompt hashes, timestamps, and execution records stored in `.ghe/inventory.json` with LRU retention limit (`maxEntries: 50`) and `--json` export for CI/CD audit pipelines.
-- ⚡ **Token Efficiency & Ultra-Compact Mode (`-C, --compact`)**: Uses direct `@` context pointers (`@.ghkgovernance.yaml`, `@features/*.feature`) for on-demand resolution to radically reduce token footprint vs. code dumping, providing an ultra-compact prompt mode for cost-sensitive LLMs.
-- 🌐 **Multilingual CLI & English Prompt Rationale (`ghk lang`)**: Full interactive CLI support in Spanish (`es`) and English (`en`). Master AI Prompts are intentionally generated in **English** for maximum BPE token density (~30% cheaper) and LLM reasoning accuracy.
-- 🤖 **True Agentic Engine & Self-Healing (EXPERIMENTAL - `ghk verify --auto-fix` & `ghk autopilot`)**: Connects natively with LLMs (OpenAI, Anthropic, Ollama), modifies source code, intercepts test failures, and recursively applies repairs in a true **Closed-Loop**. *Note: Agentic execution is currently experimental and should be run with human supervision.*
-- 🌐 **Web Studio UI (`ghk web`)**: Launch a premium local graphical interface to interactively generate your Gherkin specifications, detect your stack, and orchestrate agent prompts visually.
-- 🌳 **Official Cucumber AST Parser**: 100% compliant with the Gherkin standard using the official `@cucumber/gherkin` package.
+## Installation
 
----
-
-## 📥 Installation & Execution
+Requires Node.js 22.12 or later.
 
 ```bash
-# Global Installation
-npm install -g gherkin-ai
-
-# Or Zero-Install On-Demand
-npx -y gherkin-ai implement --feature ./features/01-customer-management.feature
+npm install -g gherkin-ai     # installs the `gherkin-ai` and `ghk` commands
+npx -y gherkin-ai@3 --help    # or run without installing
 ```
 
----
-
-## 🚀 Quick Start Commands
+## Quick start
 
 ```bash
-# 1. Initialize Stack Architecture (Supports 14+ Stacks)
-ghk init --stack=java-springboot_vue-pinia
-
-# 2. Generate Master Agent Implementation Prompt (Docker Sandbox & Compact Mode)
-ghk implement --docker -C --feature ./features/01-customer-management.feature --contract ./contracts/customer.contract.java
-
-# 3. View Feature Inventory & Developer Audit Trail History
-ghk audit
-
-# 4. Export Audit History as JSON for CI/CD Compliance Pipelines
-ghk audit --json
-
-# 5. Configure CLI Language (English or Spanish)
-ghk lang --set en
-
-# 6. Run Closed-Loop Test Verification with Auto-Fix Loop
-ghk verify --docker --auto-fix
+ghk init --yes -l typescript -f nestjs          # project configuration (gherkin-ai.config.json)
+ghk create                                      # write a feature interactively, or:
+ghk speckit import                              # convert Spec Kit specs/NNN-*/spec.md into features
+ghk lint --threshold 80                         # specification quality gate (exit 4 below threshold)
+ghk generate -f features/orders.feature         # contracts, domain kernel, tests, runtime
+ghk implement -f features/orders.feature        # implementation prompt and context for your agent
+ghk converge --threshold 80                     # spec-to-code convergence (exit 7 below threshold)
+ghk risk --base origin/main --fail-on HIGH      # delivery risk of the change (exit 4 at HIGH or above)
+ghk graph --trace OrderPlaced                   # requirement -> code -> tests
 ```
 
----
-
-## 📖 Comprehensive Documentation
-
-- [Multi-Stack Evaluation Report (15 Projects)](docs/EVALUATION_REPORT.md)
-- [CLI Commands Reference Guide](docs/COMMANDS.md)
-- [Model Context Protocol (MCP) Integration Guide](docs/MCP_GUIDE.md)
-- [Closed-Loop Verification & Auto-Repair Guide](docs/USAGE_GUIDE.md)
-- [Architecture & Agent Pipeline Design](docs/ARCHITECTURE.md)
-- [Live Web SPA Playground](https://fennereduardo.com/pages/gherkin-ai-agent-architect)
+Connect your coding agent:
 
----
-
-## 📄 License
+```bash
+ghk mcp install                                 # least-privilege MCP server for Cursor, Claude Desktop and others
+ghk firewall check --exec "npm test && git push"  # what an agent may write, run, reach and read
+```
 
-Distributed under the [MIT License](LICENSE). Created by [Fenner Eduardo](https://fennereduardo.com).
+## Capabilities
+
+| Capability | Commands | Status |
+|---|---|---|
+| Specification lint, semantic model, validation | `lint`, `validate`, `create`, `export` | Stable |
+| Code generation for the supported stacks | `init`, `generate`, `add`, `upgrade` | Stable |
+| Runtime kernel: PostgreSQL, RabbitMQ outbox/inbox, sagas, OpenTelemetry | generated with each backend | Stable |
+| Spec-to-code convergence and drift | `converge`, `diff`, `impact` | Stable |
+| Agent prompts and context packages | `implement`, `context`, `skill` | Stable |
+| MCP server (read-only by default) | `mcp` | Stable |
+| Agent firewall (MCP, CLI agent loops, Claude Code hook) | `firewall` | Stable |
+| Configuration layers, organization locks, provider policy | `config`, `login`, `auth` | Stable |
+| Audit trail and SIEM export | `audit`, `audit export` | Stable |
+| Delivery risk scoring | `risk`, `quality` | Beta |
+| Traceability graph | `graph` | Beta |
+| GitHub Spec Kit import / export | `speckit` | Beta |
+| A/B benchmark of an agent with and without gherkin-ai | `bench` | Beta |
+| Web Studio (local UI) | `web` | Beta |
+| LLM repair loops | `verify --auto-fix`, `autopilot` | Experimental |
+
+- **Stable:** covered by tests and by the golden builds, with the CLI contract (exit codes, `--json`) kept across 3.x.
+- **Beta:** complete and tested; output formats may still change in a minor release.
+- **Experimental:** use with human review only.
+
+The LLM repair loops write `.patch` proposals by default. `--apply` is refused in CI and on protected branches unless explicitly allowed, and every file goes through the agent firewall.
+
+## Supported stacks
+
+Every stack below is built and tested in CI. A sample project is generated, built in the stack's official Docker image, and its generated test suite is run. For backends, the runtime integration suite also runs against real PostgreSQL and RabbitMQ containers.
+
+| Kind | Stacks |
+|---|---|
+| Backends | TypeScript (NestJS 11 or 12, Express 5; Prisma 6 or 7), C# (ASP.NET Core 8), Java and Kotlin (Spring Boot 3), Python (FastAPI, Django), Go (chi), PHP (Laravel 13), Ruby (Rails 8), Elixir (Phoenix), Rust (Axum) |
+| Frontends and apps | React 19, Vue 3, Angular 22, Next.js 16, React Native (Expo 57), Flutter, Phoenix LiveView |
+| Contracts and infrastructure | gRPC (Protobuf, buf-linted), GraphQL SDL, AWS CDK (opt-in, synthesized in CI) |
+
+Other combinations generate contracts and prompts only and are reported as experimental. `ghk stacks` lists the current matrix. The evidence behind these claims, and how to reproduce it, is in [docs/EVALUATION_REPORT.md](docs/EVALUATION_REPORT.md).
+
+## Automation contract
+
+| Exit code | Meaning |
+|---|---|
+| 0 | success |
+| 2 | usage error |
+| 3 | invalid configuration |
+| 4 | quality gate failed (`lint`, `validate`, `risk --fail-on`, …) |
+| 5 | denied by policy (firewall, organization allow-lists, protected branch) |
+| 6 | LLM provider or network failure |
+| 7 | specification drift |
+
+With `--json`, stdout carries exactly one JSON document and diagnostics go to stderr. Details: [docs/ENTERPRISE.md#5-automation-contract-exit-codes-and---json](docs/ENTERPRISE.md#5-automation-contract-exit-codes-and---json).
+
+## Known limitations
+
+- **Semantic model.** It is extracted from Gherkin with deterministic rules. Unusual phrasing can produce generic command names. `ghk lint` reports specifications that are too vague to model, and the `@aggregate:Name` tag sets the type name explicitly.
+- **Generated runtime.** It is a verified starting point, not a framework. The runtime kernel covers one aggregate per feature with PostgreSQL and RabbitMQ. Other databases and brokers generate contracts and configuration only.
+- **Traceability graph.** It links code by symbol names. Code that does not use the domain names from the specification is not linked.
+- **Risk scores.** They are heuristics with documented weights and evidence. Calibrate the approval threshold (`policy.risk`) to your organization.
+- **LLM repair loops.** They depend on the model and can fail to converge. They are experimental and always need review.
+- **Benchmarks.** `ghk bench` measures your agent on your tasks. gherkin-ai does not publish model-quality claims of its own.
+
+## Documentation
+
+- [Enterprise guide](docs/ENTERPRISE.md): configuration and policy, providers, network, credentials, firewall, risk, MCP, audit, CI
+- [Commands](docs/COMMANDS.md)
+- [Runtime kernel](docs/RUNTIME-KERNEL.md)
+- [Verification evidence](docs/EVALUATION_REPORT.md)
+- [MCP guide](docs/MCP_GUIDE.md)
+- [Architecture](docs/ARCHITECTURE.md)
+- [Migration to 3.0](docs/MIGRATION-3.0.md)
+- [Changelog](CHANGELOG.md)
+
+## Support and security
+
+See [SUPPORT.md](SUPPORT.md) for the support and versioning policy and for how to get help. Report vulnerabilities privately as described in [SECURITY.md](SECURITY.md).
+
+## License
+
+[MIT](LICENSE). Published on npm by the [fenner](https://www.npmjs.com/org/fenner) organization. Product page: <https://fennereduardo.com/pages/gherkin-ai-agent-architect>.

package/SECURITY.md

@@ -0,0 +1,55 @@
+# Security Policy
+
+## Supported versions
+
+| Version | Supported |
+|---|---|
+| 3.x | ✅ security fixes |
+| 2.6.x | ⚠️ critical fixes only, until 2027-03-31 |
+| < 2.6 | ❌ |
+
+## Reporting a vulnerability
+
+**Do not open a public issue.** Report privately through one of these channels:
+
+1. GitHub: **Security → Report a vulnerability** on this repository (private advisory). This is the preferred channel.
+2. Email: **security@gherkin-ai.com**.
+
+Please include the affected version, the configuration needed to reproduce, steps or a proof of concept, and the impact you observed.
+
+### What happens next
+
+| Step | Target |
+|---|---|
+| Acknowledgement | within 2 business days |
+| Triage and severity (CVSS v3.1) | within 5 business days |
+| Fix for critical / high severity | within 30 days |
+| Fix for medium / low severity | next minor release |
+
+Fixes are released as patch versions and published with a GitHub Security Advisory. We request a CVE when one applies. Reporters are credited unless they prefer otherwise. Please give us 90 days, or until a fix is released if sooner, before public disclosure.
+
+## In scope
+
+We treat any of the following as a vulnerability:
+
+- **MCP:** bypass of the server's least-privilege model, for example
+  - running a write or destructive tool while it is disabled;
+  - path arguments escaping the workspace;
+  - clearing or forging audit records.
+- **Credentials:** API keys written to disk, logs, telemetry or audit files; or a key sent to a provider other than the one it belongs to.
+- **Prompt redaction:** secrets reaching an LLM provider despite redaction.
+- **Web Studio:** access without the session token, cross-origin or DNS-rebinding access, or path traversal.
+- **Agent writes:** LLM output written outside the workspace, or written while the dry-run, unattended-write or protected-branch guards apply.
+- **Organization policy:** bypass of `locked` settings, provider or model allow-lists, or the plugin allow-list.
+- **Supply chain:** issues in our release process, such as provenance or package contents.
+
+## Security controls (overview)
+
+Details are in [docs/ENTERPRISE.md](docs/ENTERPRISE.md).
+
+- **Credentials.** Keys come from environment variables or the OS keychain only, and are resolved per provider. The CLI never writes them to disk.
+- **Redaction.** Secrets are redacted from LLM prompts, log files and audit details. PII redaction is optional.
+- **MCP.** The server is read-only by default. Write and destructive tools need explicit configuration. Every call checks path containment and the agent policy, and is audited.
+- **Agent-driven changes.** They are dry-run by default. CI and protected-branch guards apply. Model-proposed paths outside the workspace are dropped.
+- **Web Studio.** It binds to localhost and requires a per-session token, an exact Host match and a same-origin Origin. Commands run without a shell.
+- **Releases.** They are published from CI with npm provenance and a CycloneDX SBOM. `npm audit --audit-level=high` blocks CI.

package/SUPPORT.md

@@ -0,0 +1,54 @@
+# Support
+
+## Getting help
+
+| Need | Where |
+|---|---|
+| Bug report | [GitHub issue](../../issues/new?template=bug_report.yml) (use the template, and include `ghk --version` and `ghk config show --sources`) |
+| Feature request | [GitHub issue](../../issues/new?template=feature_request.yml) |
+| Usage question | [GitHub Discussions](../../discussions) |
+| Security vulnerability | **Never a public issue.** Follow [SECURITY.md](SECURITY.md) |
+
+Before opening an issue, run the failing command with `--verbose`, and for CI with `--json`. Remove secrets and internal hostnames from what you paste. `ghk auth status` and `ghk config show` never print credentials.
+
+## Versioning
+
+gherkin-ai follows [Semantic Versioning](https://semver.org/).
+
+**Public contract.** Breaking it requires a major version:
+
+- command names, flags and their documented defaults;
+- exit codes (`docs/ENTERPRISE.md` §5);
+- the `--json` envelope, and the documented JSON fields of `lint`, `converge`, `risk`, `firewall`, `graph`, `audit export` and `config`;
+- the configuration schema (`schemas/config.schema.json`): keys are only added in minor versions, and are removed only after a deprecation warning in a previous minor version;
+- MCP tool names and their safety level;
+- the stable stacks listed by `ghk stacks`. A stack is only demoted from stable in a major version.
+
+**Not part of the public contract:**
+
+- the text of generated code, prompts and human-readable output;
+- the exact weights of the risk dimensions, which are documented and may be calibrated in minor versions;
+- features marked beta or experimental.
+
+**Generated projects** record the generator version. `ghk upgrade` reports, and on request applies, the changes between versions on a separate branch.
+
+## Release and support policy
+
+| Version | Status | Fixes |
+|---|---|---|
+| 3.x (latest minor) | Active | bug and security fixes |
+| 3.x (previous minor) | Maintenance for 3 months after the next minor | security and critical fixes |
+| 2.6.x | Maintenance until 2027-03-31 | critical security fixes only |
+| < 2.6 | End of life | none |
+
+Supported environments:
+
+- **Node.js:** active LTS versions (currently 22 and 24).
+- **Operating systems:** Linux, macOS and Windows, all tested in CI.
+- **Toolchains:** the generated stacks follow the toolchain images listed in `docs/ENTERPRISE.md` §11.
+
+Releases are cut from CI with npm provenance and a CycloneDX SBOM. Each release is described in [CHANGELOG.md](CHANGELOG.md).
+
+## Commercial and organizational use
+
+The package is MIT-licensed and published on npm by the [fenner](https://www.npmjs.com/org/fenner) organization. Product page: <https://fennereduardo.com/pages/gherkin-ai-agent-architect>. For organization-wide rollout (central configuration, policy locks, providers, proxies, audit), see [docs/ENTERPRISE.md](docs/ENTERPRISE.md).

package/bin/gherkin-ai.js

@@ -7,15 +7,18 @@ const fs = require('fs');
 const distIndex = path.join(__dirname, '../dist/index.js');
 const srcIndex = path.join(__dirname, '../src/index.ts');
 
+let cli;
 if (fs.existsSync(distIndex)) {
-  require(distIndex);
+  cli = require(distIndex);
 } else {
   try {
     require('ts-node/register');
-    require(srcIndex);
+    cli = require(srcIndex);
   } catch (err) {
     console.error('Error starting gherkin-ai CLI. Please build the project first using "npm run build".');
     console.error(err);
     process.exit(1);
   }
 }
+
+cli.main(process.argv);

package/dist/commands/add.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../src/commands/add.ts"],"names":[],"mappings":"AAgBA,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsG9J"}
+{"version":3,"file":"add.d.ts","sourceRoot":"","sources":["../../src/commands/add.ts"],"names":[],"mappings":"AAmBA,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAqG9J"}

package/dist/commands/add.js

@@ -7,6 +7,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleAddCommand = handleAddCommand;
+const errors_1 = require("../core/errors");
+const path_guard_1 = require("../utils/path-guard");
 const path_1 = __importDefault(require("path"));
 const config_1 = require("../core/config");
 const stack_detector_1 = require("../core/stack-detector");
@@ -17,6 +19,7 @@ const ir_builder_1 = require("../core/ir-builder");
 const create_1 = require("./create");
 const file_system_1 = require("../utils/file-system");
 const logger_1 = require("../utils/logger");
+const naming_1 = require("../utils/naming");
 async function handleAddCommand(options) {
     logger_1.logger.banner();
     const { promptOrFallback } = require('../utils/i18n-cli');
@@ -41,7 +44,7 @@ async function handleAddCommand(options) {
             return;
         }
         else {
-            process.exit(1);
+            throw new errors_1.UsageError(`Feature file not found: ${options.feature ?? '(none)'}`, { hint: 'Pass an existing file with --feature or create one with `ghk create`.' });
         }
     }
     // Load config or auto-detect if config doesn't exist
@@ -53,13 +56,12 @@ async function handleAddCommand(options) {
     logger_1.logger.info(`Reading Gherkin spec from: ${featurePath}`);
     const gherkinText = (0, file_system_1.readFileSync)(featurePath);
     const parsed = (0, gherkin_parser_1.parseGherkinText)(gherkinText);
-    const featurePascal = parsed.featureName.replace(/[^a-zA-Z0-9]/g, '') || 'Feature';
+    const featurePascal = (0, naming_1.featurePascalName)(parsed) || 'Feature';
     let targetDir = options.target
         ? path_1.default.resolve(process.cwd(), options.target)
         : path_1.default.resolve(process.cwd(), 'src', 'modules', featurePascal.toLowerCase());
-    if (!targetDir.startsWith(process.cwd())) {
-        logger_1.logger.error(`Security Violation: Target path escapes the current workspace: ${targetDir}`);
-        process.exit(1);
+    if (!(0, path_guard_1.isPathInside)(process.cwd(), targetDir)) {
+        throw new errors_1.PolicyError(`Security Violation: Target path escapes the current workspace: ${targetDir}`);
     }
     (0, file_system_1.ensureDirSync)(targetDir);
     logger_1.logger.info(`Injecting contracts & AI prompts into: ${targetDir}`);

package/dist/commands/add.js.map

@@ -1 +1 @@
-{"version":3,"file":"add.js","sourceRoot":"","sources":["../../src/commands/add.ts"],"names":[],"mappings":";AAAA;;gFAEgF;;;;;AAchF,4CAsGC;AAlHD,gDAAwB;AAExB,2CAA4C;AAC5C,2DAA6D;AAC7D,2DAA0D;AAC1D,uDAA4D;AAC5D,mDAAwD;AACxD,mDAA0D;AAC1D,qCAA+C;AAC/C,sDAAkG;AAClG,4CAAyC;AAElC,KAAK,UAAU,gBAAgB,CAAC,OAAwG;IAC7I,eAAM,CAAC,MAAM,EAAE,CAAC;IAEhB,MAAM,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAE1D,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,eAAM,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;QACjF,MAAM,IAAA,4BAAmB,EAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QAChH,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAEjE,IAAI,CAAC,IAAA,4BAAc,EAAC,WAAW,CAAC,EAAE,CAAC;QACjC,eAAM,CAAC,IAAI,CAAC,8BAA8B,WAAW,EAAE,CAAC,CAAC;QAEzD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;YACpC;gBACE,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,iFAAiF;gBAC1F,OAAO,EAAE,IAAI;aACd;SACF,EAAE,OAAO,CAAC,CAAC;QAEZ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,IAAA,4BAAmB,EAAC,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;YACzI,OAAO;QACT,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,IAAI,MAAM,GAAG,IAAA,mBAAU,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,IAAA,4BAAc,EAAC,cAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,wBAAwB,CAAC,CAAC,EAAE,CAAC;QAC3F,eAAM,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;QAC9E,MAAM,GAAG,IAAA,oCAAmB,EAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,eAAM,CAAC,IAAI,CAAC,8BAA8B,WAAW,EAAE,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,IAAA,0BAAY,EAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAA,iCAAgB,EAAC,WAAW,CAAC,CAAC;IAE7C,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;IACnF,IAAI,SAAS,GAAG,OAAO,CAAC,MAAM;QAC5B,CAAC,CAAC,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC;QAC7C,CAAC,CAAC,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,CAAC,WAAW,EAAE,CAAC,CAAC;IAE/E,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QACzC,eAAM,CAAC,KAAK,CAAC,kEAAkE,SAAS,EAAE,CAAC,CAAC;QAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAA,2BAAa,EAAC,SAAS,CAAC,CAAC;IACzB,eAAM,CAAC,IAAI,CAAC,0CAA0C,SAAS,EAAE,CAAC,CAAC;IAEnE,sEAAsE;IACtE,MAAM,EAAE,GAAG,IAAA,iCAAoB,EAAC,MAAM,EAAE,WAAW,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;IAC9F,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,IAAA,6BAAiB,EAAC,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAChH,MAAM,gBAAgB,GAAG,GAAG,aAAa,CAAC,WAAW,EAAE,cAAc,CAAC;IAEtE,IAAA,2BAAa,EAAC,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,EAAE,WAAW,CAAC,CAAC;IACnE,IAAA,2BAAa,EAAC,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,aAAa,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,WAAW,CAAC,CAAC;IAChG,IAAA,2BAAa,EAAC,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,aAAa,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE,YAAY,CAAC,CAAC;IAClG,IAAA,2BAAa,EAAC,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,aAAa,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACtE,eAAM,CAAC,OAAO,CAAC,0BAA0B,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAEnF,IAAI,cAAc,EAAE,CAAC;QACnB,IAAA,2BAAa,EAAC,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;QACrF,eAAM,CAAC,OAAO,CAAC,0CAA0C,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,yBAAyB;IACzB,MAAM,QAAQ,GAAG,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACnD,IAAA,2BAAa,EAAC,QAAQ,CAAC,CAAC;IACxB,IAAI,WAAW,GAAG,mCAAmC,aAAa,MAAM,CAAC;IACzE,WAAW,IAAI,aAAa,MAAM,CAAC,WAAW,cAAc,CAAC;IAC7D,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE;QAC5B,WAAW,IAAI,yBAAyB,EAAE,CAAC,IAAI,cAAc,CAAC;QAC9D,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE;YACpB,WAAW,IAAI,WAAW,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,4DAA4D,CAAC;QACnI,CAAC,CAAC,CAAC;QACH,WAAW,IAAI,SAAS,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,WAAW,IAAI,OAAO,CAAC;IACvB,IAAA,2BAAa,EAAC,cAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,aAAa,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,WAAW,CAAC,CAAC;IAC/F,eAAM,CAAC,OAAO,CAAC,8BAA8B,QAAQ,EAAE,CAAC,CAAC;IAEzD,iDAAiD;IACjD,MAAM,UAAU,GAAG,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACnD,IAAA,2BAAa,EAAC,UAAU,CAAC,CAAC;IAE1B,MAAM,OAAO,GAAG,IAAA,yBAAe,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;QACtC,IAAA,2BAAa,EAAC,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IACH,eAAM,CAAC,OAAO,CAAC,0CAA0C,UAAU,EAAE,CAAC,CAAC;IAEvE,eAAM,CAAC,MAAM,EAAE,CAAC;IAChB,eAAM,CAAC,OAAO,CAAC,4DAA4D,SAAS,GAAG,CAAC,CAAC;IACzF,eAAM,CAAC,IAAI,CAAC,wCAAwC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,+BAA+B,CAAC,CAAC;AAClJ,CAAC"}
+{"version":3,"file":"add.js","sourceRoot":"","sources":["../../src/commands/add.ts"],"names":[],"mappings":";AAAA;;gFAEgF;;;;;AAiBhF,4CAqGC;AApHD,2CAAyD;AACzD,oDAAmD;AACnD,gDAAwB;AAExB,2CAA4C;AAC5C,2DAA6D;AAC7D,2DAA0D;AAC1D,uDAA4D;AAC5D,mDAAwD;AACxD,mDAA0D;AAC1D,qCAA+C;AAC/C,sDAAkG;AAClG,4CAAyC;AACzC,4CAAoD;AAE7C,KAAK,UAAU,gBAAgB,CAAC,OAAwG;IAC7I,eAAM,CAAC,MAAM,EAAE,CAAC;IAEhB,MAAM,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAE1D,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,eAAM,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;QACjF,MAAM,IAAA,4BAAmB,EAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QAChH,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAEjE,IAAI,CAAC,IAAA,4BAAc,EAAC,WAAW,CAAC,EAAE,CAAC;QACjC,eAAM,CAAC,IAAI,CAAC,8BAA8B,WAAW,EAAE,CAAC,CAAC;QAEzD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;YACpC;gBACE,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,iFAAiF;gBAC1F,OAAO,EAAE,IAAI;aACd;SACF,EAAE,OAAO,CAAC,CAAC;QAEZ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,IAAA,4BAAmB,EAAC,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;YACzI,OAAO;QACT,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,mBAAU,CAAC,2BAA2B,OAAO,CAAC,OAAO,IAAI,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,uEAAuE,EAAE,CAAC,CAAC;QACpK,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,IAAI,MAAM,GAAG,IAAA,mBAAU,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,IAAA,4BAAc,EAAC,cAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,wBAAwB,CAAC,CAAC,EAAE,CAAC;QAC3F,eAAM,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;QAC9E,MAAM,GAAG,IAAA,oCAAmB,EAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,eAAM,CAAC,IAAI,CAAC,8BAA8B,WAAW,EAAE,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,IAAA,0BAAY,EAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAA,iCAAgB,EAAC,WAAW,CAAC,CAAC;IAE7C,MAAM,aAAa,GAAG,IAAA,0BAAiB,EAAC,MAAM,CAAC,IAAI,SAAS,CAAC;IAC7D,IAAI,SAAS,GAAG,OAAO,CAAC,MAAM;QAC5B,CAAC,CAAC,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC;QAC7C,CAAC,CAAC,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,CAAC,WAAW,EAAE,CAAC,CAAC;IAE/E,IAAI,CAAC,IAAA,yBAAY,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,oBAAW,CAAC,kEAAkE,SAAS,EAAE,CAAC,CAAC;IACvG,CAAC;IAED,IAAA,2BAAa,EAAC,SAAS,CAAC,CAAC;IACzB,eAAM,CAAC,IAAI,CAAC,0CAA0C,SAAS,EAAE,CAAC,CAAC;IAEnE,sEAAsE;IACtE,MAAM,EAAE,GAAG,IAAA,iCAAoB,EAAC,MAAM,EAAE,WAAW,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;IAC9F,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,IAAA,6BAAiB,EAAC,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAChH,MAAM,gBAAgB,GAAG,GAAG,aAAa,CAAC,WAAW,EAAE,cAAc,CAAC;IAEtE,IAAA,2BAAa,EAAC,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,EAAE,WAAW,CAAC,CAAC;IACnE,IAAA,2BAAa,EAAC,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,aAAa,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,WAAW,CAAC,CAAC;IAChG,IAAA,2BAAa,EAAC,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,aAAa,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE,YAAY,CAAC,CAAC;IAClG,IAAA,2BAAa,EAAC,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,aAAa,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACtE,eAAM,CAAC,OAAO,CAAC,0BAA0B,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAEnF,IAAI,cAAc,EAAE,CAAC;QACnB,IAAA,2BAAa,EAAC,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;QACrF,eAAM,CAAC,OAAO,CAAC,0CAA0C,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,yBAAyB;IACzB,MAAM,QAAQ,GAAG,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACnD,IAAA,2BAAa,EAAC,QAAQ,CAAC,CAAC;IACxB,IAAI,WAAW,GAAG,mCAAmC,aAAa,MAAM,CAAC;IACzE,WAAW,IAAI,aAAa,MAAM,CAAC,WAAW,cAAc,CAAC;IAC7D,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE;QAC5B,WAAW,IAAI,yBAAyB,EAAE,CAAC,IAAI,cAAc,CAAC;QAC9D,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE;YACpB,WAAW,IAAI,WAAW,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,4DAA4D,CAAC;QACnI,CAAC,CAAC,CAAC;QACH,WAAW,IAAI,SAAS,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,WAAW,IAAI,OAAO,CAAC;IACvB,IAAA,2BAAa,EAAC,cAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,aAAa,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,WAAW,CAAC,CAAC;IAC/F,eAAM,CAAC,OAAO,CAAC,8BAA8B,QAAQ,EAAE,CAAC,CAAC;IAEzD,iDAAiD;IACjD,MAAM,UAAU,GAAG,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACnD,IAAA,2BAAa,EAAC,UAAU,CAAC,CAAC;IAE1B,MAAM,OAAO,GAAG,IAAA,yBAAe,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;QACtC,IAAA,2BAAa,EAAC,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IACH,eAAM,CAAC,OAAO,CAAC,0CAA0C,UAAU,EAAE,CAAC,CAAC;IAEvE,eAAM,CAAC,MAAM,EAAE,CAAC;IAChB,eAAM,CAAC,OAAO,CAAC,4DAA4D,SAAS,GAAG,CAAC,CAAC;IACzF,eAAM,CAAC,IAAI,CAAC,wCAAwC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,+BAA+B,CAAC,CAAC;AAClJ,CAAC"}