lattris 0.1.3 → 0.2.0

package/dist/entry/session.js

@@ -0,0 +1,219 @@
+import { randomBytes } from 'node:crypto';
+import { join } from 'node:path';
+import { emit } from "../render/output.js";
+import { base64url, makePkce, sanitizeForTerminal } from "../render/text.js";
+import { AuthorizationError, openBrowser, waitForCode } from "../request/callback.js";
+import { pollDeviceToken, requestDeviceAuth, waitForPastedCode } from "../request/paste-and-device.js";
+import { authCodeExchangeBody, emailFromIdToken, hostedRedirectUri, loginIdentityGate, postToken, toSession } from "../request/token.js";
+import { EXIT, refusal } from "../store/exit.js";
+import { resolveSessionHome } from "../store/session-home.js";
+import { clearLeftovers } from "../store/session-lock.js";
+import { clearSession, saveSession } from "../store/session.js";
+import { SESSION_ID_DOOR, resolveWriteIdentityDetail } from "../store/write-identity.js";
+import { refusalOf } from "../request/api-fetch.js";
+import { signedIn } from "../request/access-token.js";
+export const formatPerson = (p) => {
+    const line = `${p.label} · lattris number ${p.lattrisNo} · lattris.com/by/${p.handle}`;
+    if (p.rootBlockId === undefined)
+        return line;
+    return p.rootBlockId === null
+        ? `${line} · no root block set`
+        : `${line} · root ${sanitizeForTerminal(p.rootBlockId)}`;
+};
+export const loginGate = (args, envName) => {
+    args = args.filter((a) => a !== '--device');
+    const passwordish = args.find((a) => a.toLowerCase().includes('password'));
+    if (passwordish !== undefined && envName === 'prod') {
+        const flagOnly = passwordish.split('=')[0];
+        return {
+            proceed: true,
+            message: `prod login requires browser authentication — passwords are never accepted or ` +
+                `stored for prod. Ignoring ${flagOnly}; opening the browser (PKCE).\n`
+        };
+    }
+    if (args.length > 0) {
+        return {
+            proceed: false,
+            message: 'Usage: lattris login (no arguments — the browser flow signs you in).\n'
+        };
+    }
+    return { proceed: true };
+};
+export const buildAuthUrl = (cfg, p) => {
+    const authUrl = new URL(`${cfg.issuer}/oauth2/auth`);
+    authUrl.search = new URLSearchParams({
+        response_type: 'code',
+        client_id: cfg.clientId,
+        redirect_uri: p.redirectUri,
+        scope: cfg.scopes,
+        state: p.state,
+        nonce: p.nonce,
+        audience: cfg.audience,
+        code_challenge: p.challenge,
+        code_challenge_method: 'S256',
+        prompt: 'consent'
+    }).toString();
+    if (cfg.rememberFor !== undefined) {
+        authUrl.searchParams.set('remember_for', String(cfg.rememberFor));
+    }
+    return authUrl;
+};
+const LOOPBACK_TIMEOUT_MESSAGE = 'login window expired — run lattris login again.\n';
+const finishLogin = async (cfg, io, homeDir, token) => {
+    const tokenEmail = token.id_token ? emailFromIdToken(token.id_token) : null;
+    const identityGate = loginIdentityGate(homeDir, tokenEmail);
+    if (!identityGate.save)
+        return refusal(identityGate.message ?? '', EXIT.NOAUTH);
+    const session = toSession(token, io.store.now());
+    if (tokenEmail)
+        session.email = tokenEmail;
+    clearLeftovers(io.store);
+    saveSession(io.store, session);
+    let unrefused;
+    try {
+        const meResult = await io.api(session.accessToken, `${cfg.apiUrl}/person/me`);
+        if (meResult.ok) {
+            session.personId = meResult.data.id;
+            session.handle = meResult.data.handle;
+            saveSession(io.store, session);
+        }
+        else {
+            unrefused = { ...refusalOf(meResult), exit: EXIT.OK };
+        }
+    }
+    catch { }
+    io.stdout.write('Logged in.\n');
+    return unrefused;
+};
+const deviceLogin = async (cfg, io, homeDir) => {
+    const auth = await requestDeviceAuth(io.network, cfg);
+    const where = auth.verification_uri_complete ?? `${auth.verification_uri} and enter ${auth.user_code}`;
+    io.stderr.write(`On any device, visit:\n  ${where}\n`);
+    if (auth.verification_uri_complete) {
+        io.stderr.write(`(code: ${auth.user_code})\n`);
+    }
+    io.stderr.write('Waiting for the sign-in to complete…\n');
+    let token;
+    try {
+        token = await pollDeviceToken({ network: io.network, now: io.store.now }, cfg, auth);
+    }
+    catch (e) {
+        return refusal(`${e instanceof Error ? e.message : 'Sign-in failed.'}\n`, EXIT.NOAUTH);
+    }
+    return finishLogin(cfg, io, homeDir, token);
+};
+export const LOGIN_HELP = [
+    'Usage: lattris login [--device]',
+    '',
+    'Opens the browser to sign in. On the same device the sign-in completes',
+    'itself; from another device, paste the code the browser page shows into',
+    'the waiting prompt.',
+    '',
+    '  --device   code-based sign-in for a machine with no browser at all:',
+    '             visit the printed address on any device and enter the code.'
+].join('\n');
+export const WHOAMI_HELP = [
+    'Usage: lattris whoami [--session]',
+    '',
+    '  --session   the write identity this command would name on a note write',
+    '              (session and agent), with no network: lines at a terminal,',
+    '              JSON on a pipe, exit 2 when there is none to name.',
+    '',
+    'Prints who this machine dir is logged in as (label, lattris number,',
+    'address). Exit 3 when not logged in.'
+].join('\n');
+export const login = async (cfg, io, args = []) => {
+    const gate = loginGate(args, cfg.env);
+    if (!gate.proceed)
+        return refusal(gate.message ?? '', EXIT.USAGE);
+    if (gate.message)
+        io.stderr.write(gate.message);
+    const home = resolveSessionHome(io.store);
+    if (io.store.files.existsSync(join(home.dir, 'credentials'))) {
+        io.stderr.write(`Note: ${join(home.dir, 'credentials')} exists but is ignored — the CLI never uses stored passwords.\n`);
+    }
+    if (args.includes('--device')) {
+        return deviceLogin(cfg, io, home.dir);
+    }
+    const pkce = makePkce();
+    const state = base64url(randomBytes(16));
+    const nonce = base64url(randomBytes(16));
+    const redirectUri = hostedRedirectUri(cfg);
+    const authUrl = buildAuthUrl(cfg, { state, nonce, challenge: pkce.challenge, redirectUri });
+    const listener = {};
+    const codePromise = waitForCode(cfg.redirectPort, state, undefined, listener);
+    const paste = waitForPastedCode(state, io.stdin.stream, io.stderr);
+    io.stderr.write('Opening your browser to sign in…\n');
+    io.stderr.write(`If it doesn't open, visit:\n  ${authUrl.toString()}\n`);
+    io.stderr.write('…or paste the code from the browser page here and press Enter:\n');
+    openBrowser(io.store, authUrl.toString());
+    let code;
+    try {
+        code = await Promise.race([codePromise, paste.code]);
+    }
+    catch (e) {
+        const msg = e instanceof AuthorizationError
+            ? `authorization error: ${sanitizeForTerminal(e.error)}`
+            : e instanceof Error
+                ? e.message
+                : '';
+        return refusal(msg.includes('timed out') ? LOOPBACK_TIMEOUT_MESSAGE : `${msg || 'Sign-in failed.'}\n`, EXIT.NOAUTH);
+    }
+    finally {
+        paste.close();
+        listener.close?.();
+    }
+    const token = await postToken(io.network, cfg, authCodeExchangeBody(cfg, code, pkce.verifier, redirectUri));
+    return finishLogin(cfg, io, home.dir, token);
+};
+export const formatWriteIdentity = (r) => r.kind === 'ok'
+    ? [
+        `session   ${r.identity.sessionId}`,
+        `agent     ${r.identity.agentLabel ?? '(none — LATTRIS_AGENT sets one)'}`
+    ].join('\n')
+    : r.kind === 'invalid'
+        ? r.words
+        : 'session   (none off a terminal — set LATTRIS_SESSION_ID for note writes)';
+const whoamiSession = (io) => {
+    const r = resolveWriteIdentityDetail(io.store, io.stdin.isTTY);
+    if (io.stdout.isTTY) {
+        io.stdout.write(`${formatWriteIdentity(r)}\n`);
+    }
+    else {
+        io.stdout.write(`${JSON.stringify(r.kind === 'ok'
+            ? { sessionId: r.identity.sessionId, agentLabel: r.identity.agentLabel ?? null }
+            : {
+                sessionId: null,
+                agentLabel: null,
+                problem: r.kind === 'invalid' ? r.words : SESSION_ID_DOOR
+            })}\n`);
+    }
+    if (r.kind !== 'ok')
+        return refusal('', EXIT.USAGE);
+};
+export const whoami = async (cfg, io, args = []) => {
+    if (args.includes('--session')) {
+        return whoamiSession(io);
+    }
+    const accessToken = await signedIn(io, cfg);
+    if (typeof accessToken !== 'string')
+        return accessToken;
+    const result = await io.api(accessToken, `${cfg.apiUrl}/person/me`);
+    if (!result.ok)
+        return refusalOf(result);
+    emit(io, result.data, result.rawText, (p) => [
+        formatPerson(p),
+        formatWriteIdentity(resolveWriteIdentityDetail(io.store, io.stdin.isTTY))
+    ].join('\n'));
+};
+export const logout = (io) => {
+    try {
+        clearSession(io.store);
+    }
+    catch (e) {
+        const code = e.code ?? 'error';
+        return refusal(`Logout failed: could not remove the session file (${code}). Your credentials are still stored.\n`, EXIT.GENERIC);
+    }
+    io.stdout.write('Logged out.\n');
+};
+//# sourceMappingURL=session.js.map

package/dist/entry/set.js

@@ -0,0 +1,130 @@
+import { parseArgs } from "../request/flags.js";
+import { emit } from "../render/output.js";
+import { renderRunHint, sanitizeForTerminal } from "../render/text.js";
+import { isUuidKey } from "../store/write-identity.js";
+import { refusal } from "../store/exit.js";
+import { refusalOf } from "../request/api-fetch.js";
+import { signedIn } from "../request/access-token.js";
+export const SET_HELP = [
+    'set — change something about your account.',
+    '',
+    'Fields:',
+    '  name           the name shown on your public page (lattris.com/by/<handle>)',
+    '  root           the block a walker starts from on your tree \u2014 one of your',
+    '                 own blocks, by its full id; `lattris whoami` shows it',
+    '  banned-words   words this account refuses in its OWN notes; the note door',
+    '                 asks you to override or rephrase when the text uses one',
+    '',
+    'Usage:',
+    '  lattris set name "<value>"',
+    '  lattris set root <id>',
+    '',
+    '  lattris set banned-words                       show the current list',
+    '  lattris set banned-words prose doctrine        replace the WHOLE list',
+    '  printf "prose\\ndoctrine\\n" | lattris set banned-words',
+    '                                                 one word per line from stdin',
+    '  lattris set banned-words --clear               remove them all (never gated)',
+    '',
+    '  The list is replaced whole every time — the words you pass ARE the list,',
+    '  not additions to it. Each is a single WORD: the gate matches whole words,',
+    '  so a value with spaces can never fire and the server refuses it. Empty is',
+    '  off: an account that sets none is never gated.'
+].join('\n');
+export const buildBannedWordsBody = (words) => ({
+    preferences: { banned_words: words }
+});
+export const formatBannedWords = (words) => words.length === 0
+    ? 'Banned words: (none — this account is never gated)'
+    : `Banned words (${words.length}):\n${words.map((w) => `  ${sanitizeForTerminal(w)}`).join('\n')}`;
+const setNameTo = async (cfg, io, value) => {
+    const accessToken = await signedIn(io, cfg);
+    if (typeof accessToken !== 'string')
+        return accessToken;
+    const result = await io.api(accessToken, `${cfg.apiUrl}/person/me`, {
+        method: 'PATCH',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ displayName: value })
+    });
+    if (!result.ok)
+        return refusalOf(result);
+    emit(io, result.data, result.rawText, (p) => `Set name. Your public page: lattris.com/by/${p.handle}`);
+};
+export const setRoot = async (cfg, io, rest) => {
+    const { positionals, unknown } = parseArgs({}, rest);
+    if (unknown) {
+        return refusal(`Unknown flag: ${unknown}\n`);
+    }
+    if (positionals.length !== 1) {
+        return refusal(`Usage: lattris set root <id>\n`);
+    }
+    const id = positionals[0];
+    if (!isUuidKey(id)) {
+        return refusal(`set root takes the full id of one of your own blocks, never a prefix: every walker reads the root back, so it must name one block exactly.\nUsage: lattris set root <id>\n`);
+    }
+    const accessToken = await signedIn(io, cfg);
+    if (typeof accessToken !== 'string')
+        return accessToken;
+    const result = await io.api(accessToken, `${cfg.apiUrl}/person/me`, {
+        method: 'PATCH',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ rootBlockId: id })
+    });
+    if (!result.ok)
+        return refusalOf(result);
+    emit(io, result.data, result.rawText, (p) => `Set root block ${sanitizeForTerminal(p.rootBlockId ?? id)}. ${renderRunHint(['whoami'])} shows it.`);
+};
+export const setBannedWords = async (cfg, io, rest) => {
+    const clear = rest.includes('--clear');
+    const { positionals, unknown } = parseArgs({}, rest.filter((a) => a !== '--clear'));
+    if (unknown) {
+        return refusal(`Unknown flag: ${unknown}\n`);
+    }
+    const piped = !io.stdin.isTTY;
+    const stdinWords = piped
+        ? (await io.stdin.read())
+            .split('\n')
+            .map((w) => w.trim())
+            .filter((w) => w.length > 0)
+        : [];
+    if (positionals.length > 0 && stdinWords.length > 0) {
+        return refusal('Words on the command line and on stdin are two sources for one list — pass one.\n');
+    }
+    if (clear && (positionals.length > 0 || stdinWords.length > 0)) {
+        return refusal('--clear sets the list empty; do not also name words.\n');
+    }
+    const accessToken = await signedIn(io, cfg);
+    if (typeof accessToken !== 'string')
+        return accessToken;
+    const setting = clear || positionals.length > 0 || stdinWords.length > 0;
+    if (!setting) {
+        const result = await io.api(accessToken, `${cfg.apiUrl}/person/me`, {
+            method: 'GET'
+        });
+        if (!result.ok)
+            return refusalOf(result);
+        emit(io, result.data, result.rawText, (p) => formatBannedWords(p.preferences?.banned_words ?? []));
+        return;
+    }
+    const words = clear ? [] : positionals.length > 0 ? positionals : stdinWords;
+    const result = await io.api(accessToken, `${cfg.apiUrl}/person/me`, {
+        method: 'PATCH',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(buildBannedWordsBody(words))
+    });
+    if (!result.ok)
+        return refusalOf(result);
+    emit(io, result.data, result.rawText, (p) => words.length === 0
+        ? 'Cleared. This account is no longer gated on its own words.'
+        : `Set. ${formatBannedWords(p.preferences?.banned_words ?? words)}`);
+};
+export const setName = async (cfg, io, rest) => {
+    const { positionals, unknown } = parseArgs({}, rest);
+    if (unknown) {
+        return refusal(`Unknown flag: ${unknown}\n`);
+    }
+    if (positionals.length !== 1) {
+        return refusal(`Usage: lattris set name "<value>"\n`);
+    }
+    return setNameTo(cfg, io, positionals[0]);
+};
+//# sourceMappingURL=set.js.map

package/dist/entry/setup-boot.js

@@ -0,0 +1,151 @@
+import { renderRunHint } from "../render/text.js";
+export const SETUP_HELP = [
+    'setup — transition this repo’s Claude to Lattris as its memory system.',
+    '',
+    'Usage:',
+    '  lattris setup --name "<title>" [--file <path>] [--root <id>]',
+    '',
+    'What it does:',
+    '  1. Creates your ROOT node (or adopts an existing one via --root).',
+    '  2. If <path> (default ./CLAUDE.md) exists: prints the transition',
+    '     instructions for the AI to execute — back up, extract into the graph',
+    '     with full fidelity, then replace the file with the boot template.',
+    '     The file itself is not touched; the AI performs the replacement.',
+    '  3. If it does not exist: writes the boot template there directly (a',
+    '     fresh start has nothing to extract).',
+    '  4. Allows lattris commands in Claude Code: adds "Bash(lattris *)" to',
+    '     .claude/settings.json (beside the memory file) under permissions.allow,',
+    '     creating the file and the key if needed, keeping everything else in',
+    '     it — only on a person’s word: asked on a terminal (Y/n), or passed',
+    '     as --allow-lattris. Off a terminal with no flag nothing is written',
+    '     and one line says how to add it. Without the rule, the first lattris',
+    '     command in a repo is refused by Claude Code’s classifier before',
+    '     anyone is asked.',
+    '  Rerunning against an already-transitioned file prints the existing root',
+    '  and changes nothing but the permission, if it is missing.',
+    '',
+    'Flags:',
+    '  --name "<title>"   The root node’s title (prompted for on a terminal).',
+    '  --file <path>      The memory file to transition (default ./CLAUDE.md).',
+    '  --root <id>        Adopt an existing memory as the root instead of creating.',
+    '  --allow-lattris    Write the Claude Code permission without a terminal to ask on.',
+    '  --no-permissions   Leave .claude/settings.json alone, and say nothing.'
+].join('\n');
+export const SETUP_FLAG_NAMES = {
+    '--name': 'name',
+    '--file': 'file',
+    '--root': 'root'
+};
+export const buildBootFile = (name, rootId) => [
+    `# ${name}`,
+    '',
+    'Your memory lives in **Lattris**, not in this file. Boot from the graph, act',
+    'from the graph, record to the graph.',
+    '',
+    '## Start here',
+    '',
+    'Fetch your root node — its content orients you, its links index everything else:',
+    '',
+    '```',
+    `${renderRunHint(['get', 'memory', rootId, '--links'])}`,
+    '```',
+    '',
+    'Auth is handled by the CLI — a 401 means `lattris login`. The tree is **private**',
+    '— anonymous reads 404 by design. Never read session.json or construct',
+    'Authorization headers yourself; the CLI is the credential boundary.',
+    '',
+    '## The walking discipline',
+    '',
+    '- Each link carries a **reason** saying when to follow it. Fetch a linked node',
+    '  with `lattris get memory <id> --links` only when the conversation needs that',
+    '  aspect. Never bulk-fetch the tree.',
+    '- Use the CLI for all reads and writes: `lattris get memory`, `lattris capture`,',
+    '  `lattris update`, `lattris get memories`. The CLI handles auth, piped output',
+    '  is the API wire verbatim.',
+    '- The graph is present-tense truth. What you learn that changes it, fold back',
+    '  (`lattris update memory <id>`); what happened belongs in captured records,',
+    '  not in doctrine prose.',
+    '- Where the graph and this repo’s own files disagree on operational detail,',
+    '  the repo is the runtime truth — raise the drift, then fold the graph.',
+    ''
+].join('\n');
+const BOOT_ROOT_RE = /(?:lattris get memory|GET\s+\S+\/memories\/)\s*([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})/i;
+export const parseBootRootId = (text) => BOOT_ROOT_RE.exec(text)?.[1];
+export const buildTransitionInstructions = (file, apiUrl, rootId) => [
+    '── Transition instructions — for the AI executing this setup ──',
+    '',
+    `Your root node exists: ${rootId}.`,
+    `The file to transition: ${file}`,
+    '',
+    'Do this, in order. The laws are not stylistic — each one exists because its',
+    'violation produced a tree that misled a real session.',
+    '',
+    `1. BACK UP FIRST: copy ${file} to ${file}.bak before touching anything.`,
+    '',
+    '2. Read the original in full, then build the tree using the CLI:',
+    '   - The ROOT is a high-level extraction — accurate to the original, routing',
+    '     to tier-1 nodes. Write it with:',
+    `       echo "<content>" | ${renderRunHint(['update', 'memory', rootId])}`,
+    '   - TIER-1 nodes carry the SUBSTANCE — near-verbatim, not summaries of it:',
+    '       echo "<content>" | lattris capture memory --title "<title>"',
+    `       # then link: use the API for edges (the CLI doesn\u2019t have an edge command yet)`,
+    '   - Never read session.json or construct Authorization headers yourself;',
+    '     the CLI is the credential boundary.',
+    '',
+    '3. THE RECOGNITION LAYER IS SACRED. Never abstract away:',
+    '   - routers and registries — concept→tool maps belong IN the tree, whole;',
+    '   - trigger and intent phrases ("I observed …", "I want to record this");',
+    '   - spec pointers and argument conventions.',
+    '   Compression that drops what lets a reader DECIDE is amputation, not',
+    '   summary.',
+    '',
+    '4. The user’s own words go in VERBATIM — voice is the irreplaceable signal.',
+    '',
+    '5. PRIVATE BY DEFAULT. Create nothing public; nothing becomes public without',
+    '   the human’s word. Verify it: an anonymous GET of any node you created',
+    '   must 404.',
+    '',
+    `6. FINISH: replace ${file} with the boot file below (the backup keeps the`,
+    '   original), then verify the boot actually works — run',
+    `   \`${renderRunHint(['get', 'memory', rootId, '--links'])}\` and confirm the root comes`,
+    '   back with its links.',
+    '',
+    '── The boot file (write this as the file’s entire new content) ──',
+    ''
+].join('\n');
+export const LATTRIS_PERMISSION_RULE = 'Bash(lattris *)';
+const PERMISSION_RULES_THAT_ALLOW = new Set([LATTRIS_PERMISSION_RULE, 'Bash(lattris:*)']);
+export const withLattrisPermission = (existing) => {
+    let doc = {};
+    if (existing !== undefined) {
+        try {
+            doc = JSON.parse(existing);
+        }
+        catch {
+            return { refused: 'is not valid JSON' };
+        }
+    }
+    if (typeof doc !== 'object' || doc === null || Array.isArray(doc)) {
+        return { refused: 'is not a JSON object' };
+    }
+    const settings = doc;
+    const permissions = 'permissions' in settings ? settings.permissions : {};
+    if (typeof permissions !== 'object' || permissions === null || Array.isArray(permissions)) {
+        return { refused: 'has a "permissions" that is not an object' };
+    }
+    const allow = 'allow' in permissions ? permissions.allow : [];
+    if (!Array.isArray(allow))
+        return { refused: 'has a "permissions.allow" that is not an array' };
+    if (allow.some((rule) => typeof rule === 'string' && PERMISSION_RULES_THAT_ALLOW.has(rule))) {
+        return { text: existing ?? '', changed: false };
+    }
+    const next = {
+        ...settings,
+        permissions: {
+            ...permissions,
+            allow: [...allow, LATTRIS_PERMISSION_RULE]
+        }
+    };
+    return { text: `${JSON.stringify(next, null, 2)}\n`, changed: true };
+};
+//# sourceMappingURL=setup-boot.js.map

package/dist/entry/setup.js

@@ -0,0 +1,145 @@
+import { dirname, join, resolve } from 'node:path';
+import { promptLine } from "../render/prompt.js";
+import { LATTRIS_PERMISSION_RULE, SETUP_FLAG_NAMES, SETUP_HELP, buildBootFile, buildTransitionInstructions, parseBootRootId, withLattrisPermission } from "../entry/setup-boot.js";
+import { parseArgs } from "../request/flags.js";
+import { HELP_TOKENS } from "../request/flags.js";
+import { sanitizeForTerminal } from "../render/text.js";
+import { refusal } from "../store/exit.js";
+import { refusalOf } from "../request/api-fetch.js";
+import { signedIn } from "../request/access-token.js";
+export const promptAnswer = (answer) => {
+    if (answer === null)
+        return 'no';
+    const a = answer.trim().toLowerCase();
+    if (a === '' || a === 'y' || a === 'yes')
+        return 'yes';
+    if (a === 'n' || a === 'no')
+        return 'no';
+    return 'again';
+};
+const allowLattrisInClaudeCode = async (io, memoryFile, allowedByFlag) => {
+    const settingsPath = join(dirname(resolve(io.store.cwd, memoryFile)), '.claude', 'settings.json');
+    let existing;
+    try {
+        existing = io.store.files.readFileSync(settingsPath, 'utf8');
+    }
+    catch (e) {
+        const code = e.code ?? 'error';
+        if (code !== 'ENOENT') {
+            io.stderr.write(`Left ${settingsPath} alone: it could not be read (${code}). Add "${LATTRIS_PERMISSION_RULE}" to permissions.allow by hand.\n`);
+            return;
+        }
+        existing = undefined;
+    }
+    const edit = withLattrisPermission(existing);
+    if ('refused' in edit) {
+        io.stderr.write(`Left ${settingsPath} alone: it ${edit.refused}. Add "${LATTRIS_PERMISSION_RULE}" to permissions.allow by hand.\n`);
+        return;
+    }
+    if (!edit.changed)
+        return;
+    if (!allowedByFlag) {
+        if (!io.stdin.isTTY) {
+            io.stderr.write(`Not added: "${LATTRIS_PERMISSION_RULE}" is missing from ${settingsPath} permissions.allow, and only a person adds it. ` +
+                'Rerun `lattris setup` in a terminal to be asked, or pass --allow-lattris.\n');
+            return;
+        }
+        const question = `Allow lattris CLI commands in Claude Code? Adds "${LATTRIS_PERMISSION_RULE}" to ${settingsPath} (Y/n) `;
+        let verdict = 'again';
+        for (let asked = 0; asked < 3 && verdict === 'again'; asked++) {
+            verdict = promptAnswer(await promptLine(io, question));
+            if (verdict === 'again')
+                io.stderr.write('Answer y or n.\n');
+        }
+        if (verdict !== 'yes') {
+            io.stderr.write(`Left ${settingsPath} alone.\n`);
+            return;
+        }
+    }
+    io.store.files.mkdirSync(dirname(settingsPath), { recursive: true });
+    io.store.files.writeFileSync(settingsPath, edit.text);
+    io.stderr.write(`Allowed lattris in Claude Code: "${LATTRIS_PERMISSION_RULE}" added to ${settingsPath} under permissions.allow.\n`);
+};
+export const setup = async (cfg, io, args) => {
+    if (args.some((a) => HELP_TOKENS.has(a))) {
+        io.stdout.write(`${SETUP_HELP}\n`);
+        return;
+    }
+    const permissions = !args.includes('--no-permissions');
+    const allowedByFlag = args.includes('--allow-lattris');
+    const { flags, positionals, unknown } = parseArgs(SETUP_FLAG_NAMES, args.filter((a) => a !== '--no-permissions' && a !== '--allow-lattris'));
+    if (unknown) {
+        return refusal(`Unknown or valueless flag: ${unknown}\n\n${SETUP_HELP}\n`);
+    }
+    if (positionals.length > 0) {
+        return refusal(`Unexpected argument: ${positionals[0]}\n\n${SETUP_HELP}\n`);
+    }
+    const file = flags.file ?? 'CLAUDE.md';
+    let existing;
+    try {
+        existing = io.store.files.readFileSync(file, 'utf8');
+    }
+    catch {
+        existing = undefined;
+    }
+    if (existing !== undefined) {
+        const alreadyRoot = parseBootRootId(existing);
+        if (alreadyRoot) {
+            if (permissions)
+                await allowLattrisInClaudeCode(io, file, allowedByFlag);
+            io.stdout.write(`Already transitioned — ${file} boots from root ${alreadyRoot}. Nothing changed.\n`);
+            return;
+        }
+    }
+    let name = flags.name;
+    if (flags.root === undefined && name === undefined) {
+        if (!io.stdin.isTTY) {
+            return refusal('A root needs a title. Pass --name "<title>" (prompting needs a terminal).\n');
+        }
+        name = (await promptLine(io, 'What should your root be called? ')) ?? '';
+        if (name.length === 0) {
+            return refusal('A root needs a title.\n');
+        }
+    }
+    if (permissions)
+        await allowLattrisInClaudeCode(io, file, allowedByFlag);
+    const accessToken = await signedIn(io, cfg);
+    if (typeof accessToken !== 'string')
+        return accessToken;
+    let rootId;
+    let rootTitle;
+    if (flags.root !== undefined) {
+        const got = await io.api(accessToken, `${cfg.apiUrl}/memories/${encodeURIComponent(flags.root)}?content=0`);
+        if (!got.ok)
+            return refusalOf(got);
+        rootId = got.data.id;
+        rootTitle = got.data.title;
+    }
+    else {
+        const created = await io.api(accessToken, `${cfg.apiUrl}/memories/notes`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                title: name,
+                content: 'Root of this memory tree. Freshly scaffolded by `lattris setup` — ' +
+                    'the high-level orientation that routes to everything else lands here.'
+            })
+        });
+        if (!created.ok)
+            return refusalOf(created);
+        rootId = created.data.id;
+        rootTitle = created.data.title;
+    }
+    const bootName = name ?? rootTitle ?? 'Memory';
+    const boot = buildBootFile(bootName, rootId);
+    if (existing === undefined) {
+        io.store.files.writeFileSync(file, boot);
+        io.stdout.write(`Root ${rootId} ("${sanitizeForTerminal(bootName)}") is live.\n` +
+            `Wrote ${file} — this repo now boots its memory from Lattris.\n`);
+        return;
+    }
+    io.stdout.write(`Root ${rootId} ("${sanitizeForTerminal(bootName)}") is live. ${file} detected — ` +
+        `transition instructions follow.\n\n` +
+        `${buildTransitionInstructions(file, cfg.apiUrl, rootId)}\n${boot}`);
+};
+//# sourceMappingURL=setup.js.map