superslate 0.1.0

package/dist/cli.js

@@ -0,0 +1,2172 @@
+#!/usr/bin/env node
+// @bun
+
+// src/cli.ts
+import * as prompts5 from "@clack/prompts";
+import { mkdir as mkdir5, mkdtemp as mkdtemp2, readFile as readFile6, readdir as readdir2, rename as rename2, rm as rm4, rmdir, stat as stat5 } from "fs/promises";
+import { createConnection, createServer } from "net";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import { dirname as dirname2, join as join7, relative as relative2, resolve as resolve4, sep } from "path";
+
+// src/constants.ts
+var CLI_NAME = "superslate";
+
+// src/constants.ts
+var CLI_NAME2 = "superslate";
+var CLI_PACKAGE_NAME = "superslate";
+var BUYER_CLI_NAME = "create-app";
+var BUYER_CLI_PACKAGE_NAME = "create-app";
+var DEFAULT_SCOPE = "@app";
+var SOURCE_BRAND_NAME = "superslate";
+var TEMPLATE_REPOSITORY = "superslate-dev/superslate";
+
+// src/core.ts
+function validateAppName(value) {
+  if (!value)
+    return "App name is required.";
+  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(value)) {
+    return "App name must be kebab-case (lowercase letters, numbers, and single hyphens).";
+  }
+  return;
+}
+function normalizeScope(value) {
+  const scope = value.startsWith("@") ? value : `@${value}`;
+  if (/\s/.test(scope)) {
+    throw new Error("Use hyphens instead of spaces, for example test-package.");
+  }
+  if (!/^@[a-z0-9][a-z0-9._-]*$/.test(scope)) {
+    throw new Error("Use lowercase letters and numbers, with optional periods, underscores, or hyphens.");
+  }
+  return scope;
+}
+function validateBrandName(value) {
+  if (!value.trim())
+    return "Brand name cannot be empty.";
+  if (/\r|\n/.test(value))
+    return "Brand name must fit on one line.";
+  if (value !== value.trim())
+    return "Brand name cannot start or end with whitespace.";
+  if (value.length > 48)
+    return "Brand name must be 48 characters or less.";
+  if (!/^[\p{L}\p{N}](?:[\p{L}\p{N} ._-]*[\p{L}\p{N}])?$/u.test(value)) {
+    return "Brand name may contain letters, numbers, spaces, periods, underscores, and hyphens.";
+  }
+  return;
+}
+var SCOPE_EXTENSIONS = new Set([".json", ".jsonc", ".md", ".ts", ".tsx", ".yaml", ".yml"]);
+
+// src/agent-setup.ts
+import * as prompts from "@clack/prompts";
+import { mkdir, readFile, rename, stat, writeFile } from "node:fs/promises";
+import { dirname, join as join2, resolve } from "node:path";
+
+// src/runtime.ts
+import { spawn } from "node:child_process";
+import { accessSync, constants } from "node:fs";
+import { delimiter, join, resolve as resolvePath } from "node:path";
+function runCaptured(command, options) {
+  const [file, ...args] = command;
+  if (!file)
+    throw new Error("runCaptured requires a command");
+  return new Promise((resolve, reject) => {
+    const child = spawn(file, args, {
+      cwd: options.cwd,
+      env: options.env ?? process.env,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.setEncoding("utf8");
+    child.stderr.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk;
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk;
+    });
+    child.on("error", reject);
+    child.on("close", (code, signal) => {
+      resolve({ exitCode: code ?? (signal ? 1 : 0), stdout, stderr });
+    });
+  });
+}
+function which(command) {
+  if (command.includes("/"))
+    return isExecutable(command) ? command : null;
+  const extensions = process.platform === "win32" ? (process.env.PATHEXT ?? "").split(";") : [""];
+  for (const directory of (process.env.PATH ?? "").split(delimiter)) {
+    if (!directory)
+      continue;
+    for (const extension of extensions) {
+      const candidate = join(directory, `${command}${extension}`);
+      if (isExecutable(candidate))
+        return candidate;
+    }
+  }
+  return null;
+}
+function isExecutable(path) {
+  try {
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/agent-setup.ts
+var CLIENTS = ["codex", "claude", "cursor"];
+var SERVER_NAME = "superslate-docs";
+var CODEX_START = "# superslate-agent-context:start";
+var CODEX_END = "# superslate-agent-context:end";
+function takeValue(args, index, flag) {
+  const value = args[index + 1];
+  if (!value || value.startsWith("-"))
+    throw new Error(`${flag} requires a value.`);
+  return value;
+}
+function parseAgentSetupArguments(argv) {
+  const parsed = { yes: false, dryRun: false, help: false };
+  for (let index = 0;index < argv.length; index += 1) {
+    const argument = argv[index];
+    if (argument === "--clients") {
+      const values = takeValue(argv, index++, argument).split(",").map((value) => value.trim()).filter(Boolean);
+      const invalid = values.filter((value) => !CLIENTS.includes(value));
+      if (invalid.length > 0)
+        throw new Error(`Unknown agent client: ${invalid.join(", ")}`);
+      parsed.clients = [...new Set(values)];
+    } else if (argument === "--yes" || argument === "-y")
+      parsed.yes = true;
+    else if (argument === "--dry-run")
+      parsed.dryRun = true;
+    else if (argument === "--help" || argument === "-h")
+      parsed.help = true;
+    else
+      throw new Error(`Unknown agent setup option: ${argument}`);
+  }
+  return parsed;
+}
+function agentSetupUsage(cliName) {
+  return `Usage: ${cliName} agent setup [options]
+
+Connect local coding clients to this checkout's read-only superslate documentation server.
+
+Options:
+  --clients <list>  Comma-separated clients: codex,claude,cursor
+  --yes              Configure every detected client without prompting
+  --dry-run          Show the selected configuration without changing client settings
+  -h, --help         Show this help`;
+}
+async function pathExists(path) {
+  return Boolean(await stat(path).catch(() => {
+    return;
+  }));
+}
+async function findAgentRepositoryRoot(start = process.cwd()) {
+  let current = resolve(start);
+  while (true) {
+    if (await pathExists(join2(current, "AGENTS.md")) && await pathExists(join2(current, "packages/agent-context/package.json")) && await pathExists(join2(current, "agent-tooling/manifest.json"))) {
+      return current;
+    }
+    const parent = dirname(current);
+    if (parent === current)
+      throw new Error("Run agent setup inside a superslate repository.");
+    current = parent;
+  }
+}
+function serverCommand(root) {
+  return { command: "pnpm", args: ["--dir", resolve(root), "superslate:mcp"] };
+}
+function codexManagedBlock(root) {
+  const server = serverCommand(root);
+  const args = server.args.map((argument) => JSON.stringify(argument)).join(", ");
+  return `${CODEX_START}
+[mcp_servers.${SERVER_NAME}]
+command = ${JSON.stringify(server.command)}
+args = [${args}]
+required = false
+enabled_tools = ["search_docs", "get_repository_map", "plan_change", "get_invariants", "get_verification"]
+${CODEX_END}`;
+}
+function mergeCodexConfig(existing, root) {
+  const managed = codexManagedBlock(root);
+  const start = existing.indexOf(CODEX_START);
+  const end = existing.indexOf(CODEX_END);
+  if (start >= 0 || end >= 0) {
+    if (start < 0 || end < start)
+      throw new Error("Codex config has an incomplete superslate block.");
+    const after = end + CODEX_END.length;
+    return `${existing.slice(0, start).trimEnd()}
+
+${managed}${existing.slice(after)}`.trimStart();
+  }
+  if (/^\[mcp_servers\.(?:superslate-docs|superslate_docs|"superslate-docs")\]$/m.test(existing)) {
+    throw new Error("Codex already has an unmanaged superslate-docs server; remove or rename it first.");
+  }
+  return `${existing.trimEnd()}${existing.trim() ? `
+
+` : ""}${managed}
+`;
+}
+function mergeCursorConfig(existing, root) {
+  let config = {};
+  if (existing?.trim()) {
+    try {
+      const parsed = JSON.parse(existing);
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("Cursor MCP configuration must be a JSON object.");
+      }
+      config = parsed;
+    } catch (error) {
+      if (error instanceof SyntaxError)
+        throw new Error("Cursor MCP configuration is invalid JSON.");
+      throw error;
+    }
+  }
+  const servers = config.mcpServers ?? {};
+  const current = servers[SERVER_NAME];
+  const desired = serverCommand(root);
+  if (current !== undefined && JSON.stringify(current) !== JSON.stringify(desired)) {
+    throw new Error("Cursor already has a different superslate-docs server; remove or rename it first.");
+  }
+  config.mcpServers = { ...servers, [SERVER_NAME]: desired };
+  return `${JSON.stringify(config, null, 2)}
+`;
+}
+async function atomicWrite(path, content) {
+  await mkdir(dirname(path), { recursive: true });
+  const temporary = `${path}.${process.pid}.tmp`;
+  await writeFile(temporary, content, { mode: 384 });
+  await rename(temporary, path);
+}
+async function capture(command, cwd) {
+  return runCaptured(command, { cwd });
+}
+async function addGitInfoExcludes(root, paths) {
+  const result = await capture(["git", "rev-parse", "--git-path", "info/exclude"], root);
+  if (result.exitCode !== 0)
+    return false;
+  const rawPath = result.stdout.trim();
+  if (!rawPath)
+    return false;
+  const excludePath = resolve(root, rawPath);
+  const existing = await readFile(excludePath, "utf8").catch(() => "");
+  const missing = paths.filter((path) => !existing.split(/\r?\n/).includes(path));
+  if (missing.length === 0)
+    return true;
+  const prefix = existing && !existing.endsWith(`
+`) ? `
+` : "";
+  const marker = "# superslate local agent configuration";
+  const heading = existing.split(/\r?\n/).includes(marker) ? "" : `${marker}
+`;
+  await atomicWrite(excludePath, `${existing}${prefix}${heading}${missing.join(`
+`)}
+`);
+  return true;
+}
+async function configureCodex(root) {
+  const path = join2(root, ".codex/config.toml");
+  const existing = await readFile(path, "utf8").catch(() => "");
+  await atomicWrite(path, mergeCodexConfig(existing, root));
+  const excluded = await addGitInfoExcludes(root, [".codex/config.toml"]);
+  return excluded ? "Configured project-local .codex/config.toml (excluded from Git)." : "Configured project-local .codex/config.toml; review Git status before committing it.";
+}
+async function configureCursor(root) {
+  const path = join2(root, ".cursor/mcp.json");
+  const existing = await readFile(path, "utf8").catch(() => {
+    return;
+  });
+  await atomicWrite(path, mergeCursorConfig(existing, root));
+  const excluded = await addGitInfoExcludes(root, [".cursor/mcp.json"]);
+  return excluded ? "Configured project-local .cursor/mcp.json (excluded from Git)." : "Configured project-local .cursor/mcp.json; review Git status before committing it.";
+}
+async function configureClaude(root) {
+  if (!which("claude"))
+    throw new Error("Claude Code CLI is not installed or not on PATH.");
+  const existing = await capture(["claude", "mcp", "get", SERVER_NAME], root);
+  if (existing.exitCode === 0) {
+    const combined = `${existing.stdout}
+${existing.stderr}`;
+    if (combined.includes("superslate:mcp") && combined.includes(root)) {
+      return "Claude Code already has the matching local server.";
+    }
+    throw new Error("Claude Code already has a different superslate-docs server; remove it first.");
+  }
+  const server = serverCommand(root);
+  const result = await capture(["claude", "mcp", "add", SERVER_NAME, "--scope", "local", "--", server.command, ...server.args], root);
+  if (result.exitCode !== 0) {
+    const output = result.stderr.trim() || result.stdout.trim();
+    throw new Error(`Claude Code MCP setup failed${output ? `: ${output}` : "."}`);
+  }
+  return "Configured Claude Code local project scope.";
+}
+async function smokeServer(root) {
+  const result = await capture(["pnpm", "--dir", root, "superslate:mcp", "--check", "--root", root], root);
+  if (result.exitCode !== 0) {
+    const output = result.stderr.trim() || result.stdout.trim();
+    throw new Error(`superslate MCP self-check failed${output ? `: ${output}` : "."}`);
+  }
+  const report = JSON.parse(result.stdout);
+  if (!report.ok || report.tools !== 5)
+    throw new Error("superslate MCP self-check was incomplete.");
+}
+function detectedClients() {
+  return CLIENTS.filter((client) => {
+    if (client === "cursor")
+      return Boolean(which("cursor"));
+    return Boolean(which(client));
+  });
+}
+async function chooseClients(parsed) {
+  if (parsed.clients) {
+    if (parsed.clients.length === 0)
+      throw new Error("--clients must select at least one client.");
+    return parsed.clients;
+  }
+  const detected = detectedClients();
+  if (parsed.yes) {
+    if (detected.length === 0) {
+      throw new Error("No supported client was detected. Pass --clients codex,claude,cursor.");
+    }
+    return detected;
+  }
+  if (!process.stdin.isTTY) {
+    throw new Error("Interactive setup needs a terminal. Pass --clients and --yes instead.");
+  }
+  const selected = await prompts.multiselect({
+    message: "Connect which local coding clients?",
+    required: true,
+    options: CLIENTS.map((client) => ({
+      value: client,
+      label: client === "claude" ? "Claude Code" : `${client[0].toUpperCase()}${client.slice(1)}`,
+      hint: detected.includes(client) ? "detected" : "not detected on PATH"
+    })),
+    initialValues: detected
+  });
+  if (prompts.isCancel(selected)) {
+    prompts.cancel("No agent clients were configured.");
+    return;
+  }
+  return selected;
+}
+function dryRunDescription(client, root) {
+  if (client === "codex")
+    return mergeCodexConfig("", root).trim();
+  if (client === "cursor")
+    return mergeCursorConfig(undefined, root).trim();
+  const server = serverCommand(root);
+  return [
+    "claude",
+    "mcp",
+    "add",
+    SERVER_NAME,
+    "--scope",
+    "local",
+    "--",
+    server.command,
+    ...server.args
+  ].map((value) => value.includes(" ") ? JSON.stringify(value) : value).join(" ");
+}
+async function runAgentSetup(argv, cliName) {
+  const parsed = parseAgentSetupArguments(argv);
+  if (parsed.help) {
+    process.stdout.write(`${agentSetupUsage(cliName)}
+`);
+    return;
+  }
+  const root = await findAgentRepositoryRoot();
+  const clients = await chooseClients(parsed);
+  if (!clients)
+    return;
+  prompts.intro("superslate local agent context");
+  if (parsed.dryRun) {
+    for (const client of clients) {
+      prompts.log.info(`${client}
+${dryRunDescription(client, root)}`);
+    }
+    prompts.outro("Dry run complete. No client configuration was changed.");
+    return;
+  }
+  const progress = prompts.spinner();
+  progress.start("Testing the local MCP server");
+  await smokeServer(root);
+  progress.stop("Local MCP server passed its protocol self-check");
+  for (const client of clients) {
+    const result = client === "codex" ? await configureCodex(root) : client === "cursor" ? await configureCursor(root) : await configureClaude(root);
+    prompts.log.success(`${client}: ${result}`);
+  }
+  prompts.log.info("Restart configured clients, then ask: “Use plan_change for my next feature.”");
+  prompts.outro("superslate agent context is ready.");
+}
+
+// src/deployment-cli.ts
+import * as prompts3 from "@clack/prompts";
+import { readFile as readFile3 } from "node:fs/promises";
+import { resolve as resolve2 } from "node:path";
+
+// src/deployment.ts
+import { mkdir as mkdir2, readFile as readFile2, rm, stat as stat2, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join3 } from "node:path";
+var deploymentClouds = ["aws", "gcp", "azure"];
+var frontendTargets = ["native", "vercel", "cloudflare"];
+var storageProviders = ["r2", "s3", "gcs"];
+var defaultRegions = {
+  aws: "us-east-1",
+  gcp: "us-central1",
+  azure: "eastus2"
+};
+var defaultStorageProviders = {
+  aws: "s3",
+  gcp: "gcs",
+  azure: "r2"
+};
+var storageProvidersByCloud = {
+  aws: ["s3", "r2"],
+  gcp: ["gcs", "r2"],
+  azure: ["r2"]
+};
+function isDeploymentCloud(value) {
+  return deploymentClouds.some((cloud) => cloud === value);
+}
+function isFrontendTarget(value) {
+  return frontendTargets.some((target) => target === value);
+}
+function isStorageProvider(value) {
+  return storageProviders.some((provider) => provider === value);
+}
+function parseDeploymentCloud(value) {
+  if (!isDeploymentCloud(value))
+    throw new Error("Cloud must be aws, gcp, or azure.");
+  return value;
+}
+function parseFrontendTarget(value) {
+  if (!isFrontendTarget(value)) {
+    throw new Error("Frontend target must be native, vercel, or cloudflare.");
+  }
+  return value;
+}
+function parseStorageProvider(value) {
+  if (!isStorageProvider(value))
+    throw new Error("Storage provider must be r2, s3, or gcs.");
+  return value;
+}
+function validateDeploymentEnvironment(value) {
+  if (!/^[a-z][a-z0-9-]{1,30}$/.test(value)) {
+    return "Environment must use 2-31 lowercase letters, numbers, or hyphens.";
+  }
+  return;
+}
+function validateRegion(value) {
+  if (!/^[a-z0-9][a-z0-9-]{1,31}$/.test(value)) {
+    return "Region must use 2-32 lowercase letters, numbers, or hyphens.";
+  }
+  return;
+}
+function validateDomain(value) {
+  if (value.length > 80 || !/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(value)) {
+    return "Enter a lowercase hostname such as api.example.com, without a protocol or path.";
+  }
+  return;
+}
+function validateDeploymentSelection(selection) {
+  if (!storageProvidersByCloud[selection.cloud].includes(selection.storageProvider)) {
+    throw new Error(`${selection.storageProvider} storage is not supported for ${selection.cloud} deployments.`);
+  }
+  const environmentError = validateDeploymentEnvironment(selection.environment);
+  if (environmentError)
+    throw new Error(environmentError);
+  const regionError = validateRegion(selection.region);
+  if (regionError)
+    throw new Error(regionError);
+  const apiError = validateDomain(selection.apiDomain);
+  if (apiError)
+    throw new Error(`API domain: ${apiError}`);
+  const frontendError = validateDomain(selection.frontendDomain);
+  if (frontendError)
+    throw new Error(`Frontend domain: ${frontendError}`);
+  if (selection.apiDomain === selection.frontendDomain) {
+    throw new Error("API and frontend domains must be different hostnames.");
+  }
+  const apiSite = selection.apiDomain.split(".").slice(1).join(".");
+  const frontendSite = selection.frontendDomain.split(".").slice(1).join(".");
+  if (apiSite !== frontendSite) {
+    throw new Error("API and frontend domains must be sibling hosts under the same site.");
+  }
+}
+function createDeploymentConfig(projectName, selection) {
+  validateDeploymentSelection(selection);
+  return {
+    schema_version: 2,
+    cloud: selection.cloud,
+    storage_provider: selection.storageProvider,
+    project_name: projectName,
+    environment: selection.environment,
+    region: selection.region,
+    frontend_target: selection.frontendTarget,
+    external_frontend_origin: selection.frontendTarget === "native" ? null : `https://${selection.frontendDomain}`,
+    api_domain: selection.apiDomain,
+    frontend_domain: selection.frontendDomain,
+    ha_enabled: selection.haEnabled
+  };
+}
+function deploymentReadme(config) {
+  const identity = config.cloud === "aws" ? "`AWS_ROLE_ARN` secret" : config.cloud === "gcp" ? "`GCP_WORKLOAD_IDENTITY_PROVIDER` and `GCP_SERVICE_ACCOUNT` secrets" : "`AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, and `AZURE_SUBSCRIPTION_ID` secrets";
+  const providerInputs = config.cloud === "aws" ? "Route 53 zone or certificate identifiers and runtime Secrets Manager ARNs" : config.cloud === "gcp" ? "GCP project, Cloud DNS zone, and runtime Secret Manager names" : "Azure DNS zone ID and runtime Key Vault secret identifiers";
+  const storageSetup = config.storage_provider === "r2" ? `Create private staging and public Cloudflare R2 buckets, then store the required storage
+   variables in the runtime secret container.` : `${config.storage_provider.toUpperCase()} application buckets, lifecycle policy, CORS, public access, and workload permissions are
+   managed by the selected OpenTofu root.`;
+  return `# Deployment setup
+
+The deployment target is locked:
+
+- backend: **${config.cloud.toUpperCase()}**;
+- storage: **${config.storage_provider}**;
+- frontend: **${config.frontend_target}**;
+- environment: **${config.environment}**.
+
+## Protected GitHub environment
+
+Create a GitHub environment named \`${config.environment}\` and configure:
+
+- ${identity};
+- a \`BACKEND_HCL\` secret containing the selected remote-state backend configuration;
+- a \`TFVARS_JSON\` secret containing only:
+  - ${providerInputs};
+- \`VITE_TERMS_URL\` and \`VITE_PRIVACY_URL\`.
+
+## Cloud preparation
+
+1. Run \`infra/bootstrap/${config.cloud}\` once with an administrator identity.
+2. Configure OIDC trust for this repository and the \`${config.environment}\` GitHub environment.
+3. Create the DNS zone or supply the existing zone identifier required by the selected root.
+4. ${storageSetup}
+5. Create application secret entries for Better Auth and enabled email, billing, monitoring, OAuth,
+   and credential-based providers.
+6. Put only secret identifiers in \`TFVARS_JSON\`; write secret values directly through the cloud
+   provider.
+7. Dispatch \`.github/workflows/deploy-cloud.yml\` with:
+   - cloud: \`${config.cloud}\`;
+   - environment: \`${config.environment}\`;
+   - frontend: \`${config.frontend_target}\`.
+
+The workflow creates the registry first, pushes an immutable image, provisions the API with public
+traffic disabled, runs migrations, and admits traffic only after migration succeeds.
+
+The provider lock is deliberate. Restore the deployment directories from a fresh licensed release
+before changing cloud providers.
+`;
+}
+async function removeIfPresent(target) {
+  if (!await stat2(target).catch(() => {
+    return;
+  }))
+    return false;
+  await rm(target, { recursive: true, force: true });
+  return true;
+}
+async function applyDeploymentSelection(repositoryRoot, projectName, selection) {
+  const config = createDeploymentConfig(projectName, selection);
+  const configPath = join3(repositoryRoot, "deployment/config.json");
+  if (await stat2(configPath).catch(() => {
+    return;
+  })) {
+    throw new Error("Deployment is already locked. Restore a fresh release to change providers.");
+  }
+  await mkdir2(join3(repositoryRoot, "deployment"), { recursive: true });
+  await writeFile2(configPath, `${JSON.stringify(config, null, 2)}
+`);
+  await writeFile2(join3(repositoryRoot, "deployment/README.md"), deploymentReadme(config));
+  const removed = [];
+  for (const cloud of deploymentClouds) {
+    if (cloud === selection.cloud)
+      continue;
+    for (const relativePath of [
+      `infra/bootstrap/${cloud}`,
+      `infra/modules/${cloud}`,
+      `infra/roots/${cloud}`,
+      `scripts/deploy/release-${cloud}.sh`,
+      `scripts/deploy/frontend-${cloud}.sh`
+    ]) {
+      if (await removeIfPresent(join3(repositoryRoot, relativePath)))
+        removed.push(relativePath);
+    }
+  }
+  const adapters = [
+    { target: "vercel", path: "apps/web/vercel.json" },
+    { target: "cloudflare", path: "apps/web/wrangler.toml" },
+    {
+      target: "azure-native",
+      path: "apps/web/public/staticwebapp.config.json"
+    }
+  ];
+  const selectedAdapter = selection.frontendTarget === "native" ? selection.cloud === "azure" ? "azure-native" : undefined : selection.frontendTarget;
+  for (const adapter of adapters) {
+    if (adapter.target === selectedAdapter)
+      continue;
+    if (await removeIfPresent(join3(repositoryRoot, adapter.path)))
+      removed.push(adapter.path);
+  }
+  if (selection.frontendTarget !== "native") {
+    const nativeScript = `scripts/deploy/frontend-${selection.cloud}.sh`;
+    if (await removeIfPresent(join3(repositoryRoot, nativeScript)))
+      removed.push(nativeScript);
+  }
+  return removed;
+}
+
+// src/deployment-prompts.ts
+import * as prompts2 from "@clack/prompts";
+class DeploymentPromptCancelled extends Error {
+}
+async function unwrap(value) {
+  if (prompts2.isCancel(value)) {
+    prompts2.cancel("Deployment configuration was not changed.");
+    throw new DeploymentPromptCancelled;
+  }
+  return value;
+}
+async function collectDeploymentSelection(defaults = {}, nonInteractive = false) {
+  if (nonInteractive) {
+    if (!defaults.cloud || !defaults.apiDomain || !defaults.frontendDomain) {
+      throw new Error("Non-interactive deployment setup requires --cloud, --api-domain, and --frontend-domain.");
+    }
+    return {
+      cloud: defaults.cloud,
+      storageProvider: defaults.storageProvider ?? defaultStorageProviders[defaults.cloud],
+      frontendTarget: defaults.frontendTarget ?? "native",
+      environment: defaults.environment ?? "production",
+      region: defaults.region ?? defaultRegions[defaults.cloud],
+      apiDomain: defaults.apiDomain,
+      frontendDomain: defaults.frontendDomain,
+      haEnabled: defaults.haEnabled ?? false
+    };
+  }
+  const cloud = defaults.cloud ?? parseDeploymentCloud(await unwrap(await prompts2.select({
+    message: "Backend cloud",
+    options: [
+      { value: "aws", label: "AWS", hint: "ECS Fargate + RDS PostgreSQL" },
+      { value: "gcp", label: "Google Cloud", hint: "Cloud Run + Cloud SQL" },
+      { value: "azure", label: "Azure", hint: "Container Apps + Flexible Server" }
+    ]
+  })));
+  const frontendTarget = defaults.frontendTarget ?? parseFrontendTarget(await unwrap(await prompts2.select({
+    message: "Frontend host",
+    options: [
+      { value: "native", label: "Cloud native", hint: "Managed with the backend" },
+      { value: "vercel", label: "Vercel SPA", hint: "Static frontend only" },
+      {
+        value: "cloudflare",
+        label: "Cloudflare static assets",
+        hint: "No API Worker"
+      }
+    ]
+  })));
+  const storageProvider = defaults.storageProvider ?? (storageProvidersByCloud[cloud].length === 1 ? storageProvidersByCloud[cloud][0] ?? defaultStorageProviders[cloud] : parseStorageProvider(await unwrap(await prompts2.select({
+    message: "Object storage",
+    options: storageProvidersByCloud[cloud].map((provider) => ({
+      value: provider,
+      label: provider === "s3" ? "Amazon S3" : provider === "gcs" ? "Google Cloud Storage" : "Cloudflare R2",
+      hint: provider === defaultStorageProviders[cloud] ? "Cloud-native default" : ""
+    }))
+  }))));
+  const environment = defaults.environment ?? await unwrap(await prompts2.text({
+    message: "Deployment environment",
+    placeholder: "production",
+    defaultValue: "production",
+    validate: (value) => validateDeploymentEnvironment(value || "production")
+  }));
+  const region = defaults.region ?? await unwrap(await prompts2.text({
+    message: `${cloud.toUpperCase()} region`,
+    placeholder: defaultRegions[cloud],
+    defaultValue: defaultRegions[cloud],
+    validate: (value) => validateRegion(value || defaultRegions[cloud])
+  }));
+  const apiDomain = defaults.apiDomain ?? await unwrap(await prompts2.text({
+    message: "Production API domain",
+    placeholder: "api.example.com",
+    validate: (value) => validateDomain(value ?? "")
+  }));
+  const frontendDomain = defaults.frontendDomain ?? await unwrap(await prompts2.text({
+    message: "Production frontend domain",
+    placeholder: "app.example.com",
+    validate: (value) => validateDomain(value ?? "")
+  }));
+  const haEnabled = defaults.haEnabled ?? await unwrap(await prompts2.confirm({
+    message: "Enable the higher-availability profile?",
+    initialValue: false
+  }));
+  return {
+    cloud,
+    storageProvider,
+    frontendTarget,
+    environment,
+    region,
+    apiDomain,
+    frontendDomain,
+    haEnabled
+  };
+}
+
+// src/deployment-cli.ts
+function takeValue2(args, index, flag) {
+  const value = args[index + 1];
+  if (!value || value.startsWith("--"))
+    throw new Error(`${flag} requires a value.`);
+  return value;
+}
+function parseDeploymentArguments(argv) {
+  const parsed = { yes: false };
+  for (let index = 0;index < argv.length; index += 1) {
+    const argument = argv[index];
+    if (argument === "--cloud") {
+      parsed.cloud = parseDeploymentCloud(takeValue2(argv, index++, argument));
+    } else if (argument === "--frontend") {
+      parsed.frontendTarget = parseFrontendTarget(takeValue2(argv, index++, argument));
+    } else if (argument === "--storage") {
+      parsed.storageProvider = parseStorageProvider(takeValue2(argv, index++, argument));
+    } else if (argument === "--environment") {
+      parsed.environment = takeValue2(argv, index++, argument);
+    } else if (argument === "--region") {
+      parsed.region = takeValue2(argv, index++, argument);
+    } else if (argument === "--api-domain") {
+      parsed.apiDomain = takeValue2(argv, index++, argument);
+    } else if (argument === "--frontend-domain") {
+      parsed.frontendDomain = takeValue2(argv, index++, argument);
+    } else if (argument === "--ha")
+      parsed.haEnabled = true;
+    else if (argument === "--no-ha")
+      parsed.haEnabled = false;
+    else if (argument === "--yes" || argument === "-y")
+      parsed.yes = true;
+    else
+      throw new Error(`Unknown deployment option: ${argument}`);
+  }
+  return parsed;
+}
+async function runDeploymentConfigure(argv, productName, repositoryRoot = process.cwd()) {
+  const parsed = parseDeploymentArguments(argv);
+  const root = resolve2(repositoryRoot);
+  const rootPackage = JSON.parse(await readFile3(`${root}/package.json`, "utf8"));
+  if (!rootPackage.name)
+    throw new Error("Root package name is required for deployment setup.");
+  prompts3.intro(`${productName} deployment setup`);
+  try {
+    const selection = await collectDeploymentSelection(parsed, parsed.yes);
+    const removed = await applyDeploymentSelection(root, rootPackage.name, selection);
+    prompts3.log.success(`${selection.cloud.toUpperCase()} + ${selection.storageProvider} + ${selection.frontendTarget} is locked for ${selection.environment}.`);
+    prompts3.log.info(`${removed.length} unused deployment paths removed.`);
+    prompts3.log.step("Next");
+    prompts3.log.message(`Review deployment/config.json
+Configure the protected GitHub environment
+Dispatch .github/workflows/deploy-cloud.yml`);
+    prompts3.outro("Deployment configuration is ready to commit.");
+  } catch (error) {
+    if (error instanceof DeploymentPromptCancelled)
+      return;
+    throw error;
+  }
+}
+
+// src/runtime.ts
+import { spawn as spawn2 } from "node:child_process";
+import { delimiter as delimiter2, join as join4, resolve as resolvePath2 } from "node:path";
+import { fileURLToPath } from "node:url";
+function runCaptured2(command, options) {
+  const [file, ...args] = command;
+  if (!file)
+    throw new Error("runCaptured requires a command");
+  return new Promise((resolve3, reject) => {
+    const child = spawn2(file, args, {
+      cwd: options.cwd,
+      env: options.env ?? process.env,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.setEncoding("utf8");
+    child.stderr.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk;
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk;
+    });
+    child.on("error", reject);
+    child.on("close", (code, signal) => {
+      resolve3({ exitCode: code ?? (signal ? 1 : 0), stdout, stderr });
+    });
+  });
+}
+function runInherited(command, options) {
+  const [file, ...args] = command;
+  if (!file)
+    throw new Error("runInherited requires a command");
+  return new Promise((resolve3, reject) => {
+    const child = spawn2(file, args, {
+      cwd: options.cwd,
+      env: options.env ?? process.env,
+      stdio: "inherit"
+    });
+    child.on("error", reject);
+    child.on("close", (code, signal) => {
+      resolve3(code ?? (signal === "SIGINT" ? 130 : 1));
+    });
+  });
+}
+function isEntrypoint(moduleUrl) {
+  const entry = process.argv[1];
+  if (!entry)
+    return false;
+  try {
+    return resolvePath2(fileURLToPath(moduleUrl)) === resolvePath2(entry);
+  } catch {
+    return false;
+  }
+}
+
+// src/deployment-prompts.ts
+import * as prompts4 from "@clack/prompts";
+class DeploymentPromptCancelled2 extends Error {
+}
+async function unwrap2(value) {
+  if (prompts4.isCancel(value)) {
+    prompts4.cancel("Deployment configuration was not changed.");
+    throw new DeploymentPromptCancelled2;
+  }
+  return value;
+}
+async function collectDeploymentSelection2(defaults = {}, nonInteractive = false) {
+  if (nonInteractive) {
+    if (!defaults.cloud || !defaults.apiDomain || !defaults.frontendDomain) {
+      throw new Error("Non-interactive deployment setup requires --cloud, --api-domain, and --frontend-domain.");
+    }
+    return {
+      cloud: defaults.cloud,
+      storageProvider: defaults.storageProvider ?? defaultStorageProviders[defaults.cloud],
+      frontendTarget: defaults.frontendTarget ?? "native",
+      environment: defaults.environment ?? "production",
+      region: defaults.region ?? defaultRegions[defaults.cloud],
+      apiDomain: defaults.apiDomain,
+      frontendDomain: defaults.frontendDomain,
+      haEnabled: defaults.haEnabled ?? false
+    };
+  }
+  const cloud = defaults.cloud ?? parseDeploymentCloud(await unwrap2(await prompts4.select({
+    message: "Backend cloud",
+    options: [
+      { value: "aws", label: "AWS", hint: "ECS Fargate + RDS PostgreSQL" },
+      { value: "gcp", label: "Google Cloud", hint: "Cloud Run + Cloud SQL" },
+      { value: "azure", label: "Azure", hint: "Container Apps + Flexible Server" }
+    ]
+  })));
+  const frontendTarget = defaults.frontendTarget ?? parseFrontendTarget(await unwrap2(await prompts4.select({
+    message: "Frontend host",
+    options: [
+      { value: "native", label: "Cloud native", hint: "Managed with the backend" },
+      { value: "vercel", label: "Vercel SPA", hint: "Static frontend only" },
+      {
+        value: "cloudflare",
+        label: "Cloudflare static assets",
+        hint: "No API Worker"
+      }
+    ]
+  })));
+  const storageProvider = defaults.storageProvider ?? (storageProvidersByCloud[cloud].length === 1 ? storageProvidersByCloud[cloud][0] ?? defaultStorageProviders[cloud] : parseStorageProvider(await unwrap2(await prompts4.select({
+    message: "Object storage",
+    options: storageProvidersByCloud[cloud].map((provider) => ({
+      value: provider,
+      label: provider === "s3" ? "Amazon S3" : provider === "gcs" ? "Google Cloud Storage" : "Cloudflare R2",
+      hint: provider === defaultStorageProviders[cloud] ? "Cloud-native default" : ""
+    }))
+  }))));
+  const environment = defaults.environment ?? await unwrap2(await prompts4.text({
+    message: "Deployment environment",
+    placeholder: "production",
+    defaultValue: "production",
+    validate: (value) => validateDeploymentEnvironment(value || "production")
+  }));
+  const region = defaults.region ?? await unwrap2(await prompts4.text({
+    message: `${cloud.toUpperCase()} region`,
+    placeholder: defaultRegions[cloud],
+    defaultValue: defaultRegions[cloud],
+    validate: (value) => validateRegion(value || defaultRegions[cloud])
+  }));
+  const apiDomain = defaults.apiDomain ?? await unwrap2(await prompts4.text({
+    message: "Production API domain",
+    placeholder: "api.example.com",
+    validate: (value) => validateDomain(value ?? "")
+  }));
+  const frontendDomain = defaults.frontendDomain ?? await unwrap2(await prompts4.text({
+    message: "Production frontend domain",
+    placeholder: "app.example.com",
+    validate: (value) => validateDomain(value ?? "")
+  }));
+  const haEnabled = defaults.haEnabled ?? await unwrap2(await prompts4.confirm({
+    message: "Enable the higher-availability profile?",
+    initialValue: false
+  }));
+  return {
+    cloud,
+    storageProvider,
+    frontendTarget,
+    environment,
+    region,
+    apiDomain,
+    frontendDomain,
+    haEnabled
+  };
+}
+
+// src/deployment.ts
+import { mkdir as mkdir3, readFile as readFile4, rm as rm2, stat as stat3, writeFile as writeFile3 } from "node:fs/promises";
+import { join as join5 } from "node:path";
+var deploymentClouds2 = ["aws", "gcp", "azure"];
+var frontendTargets2 = ["native", "vercel", "cloudflare"];
+var storageProviders2 = ["r2", "s3", "gcs"];
+var storageProvidersByCloud2 = {
+  aws: ["s3", "r2"],
+  gcp: ["gcs", "r2"],
+  azure: ["r2"]
+};
+function isDeploymentCloud2(value) {
+  return deploymentClouds2.some((cloud) => cloud === value);
+}
+function isFrontendTarget2(value) {
+  return frontendTargets2.some((target) => target === value);
+}
+function isStorageProvider2(value) {
+  return storageProviders2.some((provider) => provider === value);
+}
+function parseDeploymentCloud2(value) {
+  if (!isDeploymentCloud2(value))
+    throw new Error("Cloud must be aws, gcp, or azure.");
+  return value;
+}
+function parseFrontendTarget2(value) {
+  if (!isFrontendTarget2(value)) {
+    throw new Error("Frontend target must be native, vercel, or cloudflare.");
+  }
+  return value;
+}
+function parseStorageProvider2(value) {
+  if (!isStorageProvider2(value))
+    throw new Error("Storage provider must be r2, s3, or gcs.");
+  return value;
+}
+function validateDeploymentEnvironment2(value) {
+  if (!/^[a-z][a-z0-9-]{1,30}$/.test(value)) {
+    return "Environment must use 2-31 lowercase letters, numbers, or hyphens.";
+  }
+  return;
+}
+function validateRegion2(value) {
+  if (!/^[a-z0-9][a-z0-9-]{1,31}$/.test(value)) {
+    return "Region must use 2-32 lowercase letters, numbers, or hyphens.";
+  }
+  return;
+}
+function validateDomain2(value) {
+  if (value.length > 80 || !/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(value)) {
+    return "Enter a lowercase hostname such as api.example.com, without a protocol or path.";
+  }
+  return;
+}
+function validateDeploymentSelection2(selection) {
+  if (!storageProvidersByCloud2[selection.cloud].includes(selection.storageProvider)) {
+    throw new Error(`${selection.storageProvider} storage is not supported for ${selection.cloud} deployments.`);
+  }
+  const environmentError = validateDeploymentEnvironment2(selection.environment);
+  if (environmentError)
+    throw new Error(environmentError);
+  const regionError = validateRegion2(selection.region);
+  if (regionError)
+    throw new Error(regionError);
+  const apiError = validateDomain2(selection.apiDomain);
+  if (apiError)
+    throw new Error(`API domain: ${apiError}`);
+  const frontendError = validateDomain2(selection.frontendDomain);
+  if (frontendError)
+    throw new Error(`Frontend domain: ${frontendError}`);
+  if (selection.apiDomain === selection.frontendDomain) {
+    throw new Error("API and frontend domains must be different hostnames.");
+  }
+  const apiSite = selection.apiDomain.split(".").slice(1).join(".");
+  const frontendSite = selection.frontendDomain.split(".").slice(1).join(".");
+  if (apiSite !== frontendSite) {
+    throw new Error("API and frontend domains must be sibling hosts under the same site.");
+  }
+}
+function createDeploymentConfig2(projectName, selection) {
+  validateDeploymentSelection2(selection);
+  return {
+    schema_version: 2,
+    cloud: selection.cloud,
+    storage_provider: selection.storageProvider,
+    project_name: projectName,
+    environment: selection.environment,
+    region: selection.region,
+    frontend_target: selection.frontendTarget,
+    external_frontend_origin: selection.frontendTarget === "native" ? null : `https://${selection.frontendDomain}`,
+    api_domain: selection.apiDomain,
+    frontend_domain: selection.frontendDomain,
+    ha_enabled: selection.haEnabled
+  };
+}
+function deploymentReadme2(config) {
+  const identity = config.cloud === "aws" ? "`AWS_ROLE_ARN` secret" : config.cloud === "gcp" ? "`GCP_WORKLOAD_IDENTITY_PROVIDER` and `GCP_SERVICE_ACCOUNT` secrets" : "`AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, and `AZURE_SUBSCRIPTION_ID` secrets";
+  const providerInputs = config.cloud === "aws" ? "Route 53 zone or certificate identifiers and runtime Secrets Manager ARNs" : config.cloud === "gcp" ? "GCP project, Cloud DNS zone, and runtime Secret Manager names" : "Azure DNS zone ID and runtime Key Vault secret identifiers";
+  const storageSetup = config.storage_provider === "r2" ? `Create private staging and public Cloudflare R2 buckets, then store the required storage
+   variables in the runtime secret container.` : `${config.storage_provider.toUpperCase()} application buckets, lifecycle policy, CORS, public access, and workload permissions are
+   managed by the selected OpenTofu root.`;
+  return `# Deployment setup
+
+The deployment target is locked:
+
+- backend: **${config.cloud.toUpperCase()}**;
+- storage: **${config.storage_provider}**;
+- frontend: **${config.frontend_target}**;
+- environment: **${config.environment}**.
+
+## Protected GitHub environment
+
+Create a GitHub environment named \`${config.environment}\` and configure:
+
+- ${identity};
+- a \`BACKEND_HCL\` secret containing the selected remote-state backend configuration;
+- a \`TFVARS_JSON\` secret containing only:
+  - ${providerInputs};
+- \`VITE_TERMS_URL\` and \`VITE_PRIVACY_URL\`.
+
+## Cloud preparation
+
+1. Run \`infra/bootstrap/${config.cloud}\` once with an administrator identity.
+2. Configure OIDC trust for this repository and the \`${config.environment}\` GitHub environment.
+3. Create the DNS zone or supply the existing zone identifier required by the selected root.
+4. ${storageSetup}
+5. Create application secret entries for Better Auth and enabled email, billing, monitoring, OAuth,
+   and credential-based providers.
+6. Put only secret identifiers in \`TFVARS_JSON\`; write secret values directly through the cloud
+   provider.
+7. Dispatch \`.github/workflows/deploy-cloud.yml\` with:
+   - cloud: \`${config.cloud}\`;
+   - environment: \`${config.environment}\`;
+   - frontend: \`${config.frontend_target}\`.
+
+The workflow creates the registry first, pushes an immutable image, provisions the API with public
+traffic disabled, runs migrations, and admits traffic only after migration succeeds.
+
+The provider lock is deliberate. Restore the deployment directories from a fresh licensed release
+before changing cloud providers.
+`;
+}
+async function removeIfPresent2(target) {
+  if (!await stat3(target).catch(() => {
+    return;
+  }))
+    return false;
+  await rm2(target, { recursive: true, force: true });
+  return true;
+}
+async function applyDeploymentSelection2(repositoryRoot, projectName, selection) {
+  const config = createDeploymentConfig2(projectName, selection);
+  const configPath = join5(repositoryRoot, "deployment/config.json");
+  if (await stat3(configPath).catch(() => {
+    return;
+  })) {
+    throw new Error("Deployment is already locked. Restore a fresh release to change providers.");
+  }
+  await mkdir3(join5(repositoryRoot, "deployment"), { recursive: true });
+  await writeFile3(configPath, `${JSON.stringify(config, null, 2)}
+`);
+  await writeFile3(join5(repositoryRoot, "deployment/README.md"), deploymentReadme2(config));
+  const removed = [];
+  for (const cloud of deploymentClouds2) {
+    if (cloud === selection.cloud)
+      continue;
+    for (const relativePath of [
+      `infra/bootstrap/${cloud}`,
+      `infra/modules/${cloud}`,
+      `infra/roots/${cloud}`,
+      `scripts/deploy/release-${cloud}.sh`,
+      `scripts/deploy/frontend-${cloud}.sh`
+    ]) {
+      if (await removeIfPresent2(join5(repositoryRoot, relativePath)))
+        removed.push(relativePath);
+    }
+  }
+  const adapters = [
+    { target: "vercel", path: "apps/web/vercel.json" },
+    { target: "cloudflare", path: "apps/web/wrangler.toml" },
+    {
+      target: "azure-native",
+      path: "apps/web/public/staticwebapp.config.json"
+    }
+  ];
+  const selectedAdapter = selection.frontendTarget === "native" ? selection.cloud === "azure" ? "azure-native" : undefined : selection.frontendTarget;
+  for (const adapter of adapters) {
+    if (adapter.target === selectedAdapter)
+      continue;
+    if (await removeIfPresent2(join5(repositoryRoot, adapter.path)))
+      removed.push(adapter.path);
+  }
+  if (selection.frontendTarget !== "native") {
+    const nativeScript = `scripts/deploy/frontend-${selection.cloud}.sh`;
+    if (await removeIfPresent2(join5(repositoryRoot, nativeScript)))
+      removed.push(nativeScript);
+  }
+  return removed;
+}
+
+// src/scaffold.ts
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { cp, lstat, mkdir as mkdir4, mkdtemp, readFile as readFile5, readdir, rm as rm3, stat as stat4, writeFile as writeFile4 } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, join as join6, relative, resolve as resolve3 } from "node:path";
+import { promisify } from "node:util";
+
+// src/core.ts
+import { randomBytes } from "node:crypto";
+import { extname } from "node:path";
+var BRAND_MANIFEST = [
+  { path: "apps/web/src/configs/config.ts", occurrences: 2 },
+  { path: "apps/web/index.html", occurrences: 4 },
+  { path: "apps/web/public/favicon/site.webmanifest", occurrences: 2 },
+  { path: "apps/web/public/offline.html", occurrences: 2 },
+  { path: "apps/docs/lib/shared.ts", occurrences: 1 },
+  { path: "apps/server/.env.example", occurrences: 1 },
+  { path: "apps/server/src/config/env.ts", occurrences: 2 },
+  { path: "apps/server/src/config/env.test.ts", occurrences: 1 },
+  { path: "packages/email/src/billing-payment-failed.tsx", occurrences: 2 },
+  { path: "packages/email/src/login-email.tsx", occurrences: 3 },
+  { path: "packages/email/src/verify-email.tsx", occurrences: 1 },
+  { path: "packages/email/src/reset-password.tsx", occurrences: 1 },
+  { path: "packages/email/src/security-alert.tsx", occurrences: 1 },
+  { path: "packages/email/src/components/EmailSignature.tsx", occurrences: 1 },
+  { path: "packages/email/src/components/EmailLayout.tsx", occurrences: 1 },
+  { path: "packages/email/src/components/EmailCopyright.tsx", occurrences: 1 },
+  { path: "packages/email/src/welcome-email.tsx", occurrences: 4 },
+  { path: "packages/email/src/billing-payment-successful.tsx", occurrences: 1 },
+  { path: "packages/email/src/billing-subscription-created.tsx", occurrences: 2 },
+  { path: "packages/email/src/billing-subscription-canceled.tsx", occurrences: 2 },
+  { path: "apps/server/email-templates/billing-payment-failed.html", occurrences: 6 },
+  { path: "apps/server/email-templates/billing-payment-successful.html", occurrences: 5 },
+  { path: "apps/server/email-templates/billing-subscription-canceled.html", occurrences: 6 },
+  { path: "apps/server/email-templates/billing-subscription-created.html", occurrences: 6 },
+  { path: "apps/server/email-templates/login-email.html", occurrences: 7 },
+  { path: "apps/server/email-templates/security-alert.html", occurrences: 4 },
+  { path: "apps/server/email-templates/verify-email.html", occurrences: 5 },
+  { path: "apps/server/email-templates/reset-password.html", occurrences: 5 },
+  { path: "apps/server/email-templates/welcome-email.html", occurrences: 8 }
+];
+function validateAppName2(value) {
+  if (!value)
+    return "App name is required.";
+  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(value)) {
+    return "App name must be kebab-case (lowercase letters, numbers, and single hyphens).";
+  }
+  return;
+}
+function normalizeScope2(value) {
+  const scope = value.startsWith("@") ? value : `@${value}`;
+  if (/\s/.test(scope)) {
+    throw new Error("Use hyphens instead of spaces, for example test-package.");
+  }
+  if (!/^@[a-z0-9][a-z0-9._-]*$/.test(scope)) {
+    throw new Error("Use lowercase letters and numbers, with optional periods, underscores, or hyphens.");
+  }
+  return scope;
+}
+function validateBrandName2(value) {
+  if (!value.trim())
+    return "Brand name cannot be empty.";
+  if (/\r|\n/.test(value))
+    return "Brand name must fit on one line.";
+  if (value !== value.trim())
+    return "Brand name cannot start or end with whitespace.";
+  if (value.length > 48)
+    return "Brand name must be 48 characters or less.";
+  if (!/^[\p{L}\p{N}](?:[\p{L}\p{N} ._-]*[\p{L}\p{N}])?$/u.test(value)) {
+    return "Brand name may contain letters, numbers, spaces, periods, underscores, and hyphens.";
+  }
+  return;
+}
+function replaceLiteral(content, search, replacement) {
+  if (search === replacement || !content.includes(search))
+    return { content, replacements: 0 };
+  const parts = content.split(search);
+  return { content: parts.join(replacement), replacements: parts.length - 1 };
+}
+function rewriteScopeContent(content, scope, originalScope = DEFAULT_SCOPE) {
+  return replaceLiteral(content, `${originalScope}/`, `${normalizeScope2(scope)}/`);
+}
+function rewriteBrandContent(content, brandName) {
+  const error = validateBrandName2(brandName);
+  if (error)
+    throw new Error(error);
+  const escapedSourceBrand = SOURCE_BRAND_NAME.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const sourceBrandPattern = new RegExp(`\\b${escapedSourceBrand}\\b`, "g");
+  const matches = content.match(sourceBrandPattern);
+  if (brandName === SOURCE_BRAND_NAME || !matches)
+    return { content, replacements: 0 };
+  return {
+    content: content.replace(sourceBrandPattern, () => brandName),
+    replacements: matches.length
+  };
+}
+function formatRewrittenPackageJson(content) {
+  const parsed = JSON.parse(content);
+  for (const key of [
+    "dependencies",
+    "devDependencies",
+    "optionalDependencies",
+    "peerDependencies"
+  ]) {
+    const values = parsed[key];
+    if (values && typeof values === "object" && !Array.isArray(values)) {
+      parsed[key] = Object.fromEntries(Object.entries(values).sort(([left], [right]) => left.localeCompare(right)));
+    }
+  }
+  return `${JSON.stringify(parsed, null, 2)}
+`;
+}
+function wrapLongNamedImports(content, width = 100) {
+  return content.split(`
+`).map((line) => {
+    if (line.length <= width)
+      return line;
+    const match = line.match(/^(\s*)(import(?:\s+type)?\s+)\{([^}]+)\}(\s+from\s+.+)$/);
+    if (!match)
+      return line;
+    const [, indentation = "", prefix = "", names = "", suffix = ""] = match;
+    const members = names.split(",").map((name) => name.trim());
+    return [
+      `${indentation}${prefix}{`,
+      ...members.map((name) => `${indentation}  ${name},`),
+      `${indentation}}${suffix}`
+    ].join(`
+`);
+  }).join(`
+`);
+}
+function wrapBrandedJsxText(content, brandName, width = 100) {
+  const lines = content.split(`
+`);
+  const output = [];
+  for (let index = 0;index < lines.length; ) {
+    const line = lines[index] ?? "";
+    const text3 = line.trim();
+    if (!text3 || text3.startsWith("<") || text3.startsWith("{") || text3.startsWith("//") || text3.includes("<") || text3.includes(">")) {
+      output.push(line);
+      index += 1;
+      continue;
+    }
+    const paragraph = [];
+    const originalParagraph = [];
+    const indentation = line.slice(0, line.length - line.trimStart().length);
+    while (index < lines.length) {
+      const candidate = lines[index] ?? "";
+      const candidateText = candidate.trim();
+      if (!candidateText || candidateText.startsWith("<") || candidateText.startsWith("{"))
+        break;
+      paragraph.push(candidateText);
+      originalParagraph.push(candidate);
+      index += 1;
+    }
+    const joined = paragraph.join(" ");
+    if (!joined.includes(brandName)) {
+      output.push(...originalParagraph);
+      continue;
+    }
+    let current = indentation;
+    for (const word of joined.split(/\s+/)) {
+      const candidate = current === indentation ? `${indentation}${word}` : `${current} ${word}`;
+      if (candidate.length > width && current !== indentation) {
+        output.push(current);
+        current = `${indentation}${word}`;
+      } else
+        current = candidate;
+    }
+    output.push(current);
+  }
+  return output.join(`
+`);
+}
+function rewriteRootPackageName(content, appName) {
+  const error = validateAppName2(appName);
+  if (error)
+    throw new Error(error);
+  const parsed = JSON.parse(content);
+  if (parsed.name === appName)
+    return { content, replacements: 0 };
+  parsed.name = appName;
+  return { content: `${JSON.stringify(parsed, null, 2)}
+`, replacements: 1 };
+}
+function replaceMarkdownSection(content, heading, replacement) {
+  const marker = `## ${heading}
+`;
+  const start = content.indexOf(marker);
+  if (start === -1)
+    throw new Error(`Agent instructions are missing the "${heading}" section.`);
+  const end = content.indexOf(`
+## `, start + marker.length);
+  if (end === -1)
+    throw new Error(`Agent instructions cannot delimit the "${heading}" section.`);
+  const sections = [content.slice(0, start).trim(), replacement.trim(), content.slice(end).trim()];
+  return `${sections.filter(Boolean).join(`
+
+`)}
+`;
+}
+function removeParagraphContaining(content, fragment) {
+  const paragraphs = content.split(`
+
+`);
+  const index = paragraphs.findIndex((paragraph) => paragraph.includes(fragment));
+  if (index === -1)
+    throw new Error(`Agent instructions are missing expected text: ${fragment}`);
+  paragraphs.splice(index, 1);
+  return paragraphs.join(`
+
+`);
+}
+function rewriteBuyerAgentInstructions(content) {
+  if (content.includes("Audit and remediate the complete buyer-owned SaaS application") && !/landing\/|seller-surface|studio-owned/i.test(content)) {
+    return content;
+  }
+  let rewritten = removeParagraphContaining(content, "`landing/` is the source repository's commercial sales application");
+  rewritten = removeParagraphContaining(rewritten, "The root pnpm workspace includes only `apps/*` and `packages/*`.");
+  rewritten = replaceMarkdownSection(rewritten, "Product security audit scope", `## Product security audit scope
+
+Audit and remediate the complete buyer-owned SaaS application: \`apps/\`, \`packages/\`, buyer
+documentation, and the configuration and deployment files that ship with it. \`agent-tooling/\` and
+\`packages/agent-context\` are optional, buyer-distributed development tooling; review them when agent
+behavior or distribution changes, but do not treat them as application runtime code. Do not vendor
+machine-local installed copies, compatibility symlinks, client configuration, or skill lock records
+into this repository.
+`);
+  rewritten = replaceMarkdownSection(rewritten, "Landing boundary", "");
+  rewritten = rewritten.split(`
+`).filter((line) => !line.includes("| `landing`")).join(`
+`).replace("real env files, `landing/`, or\n  `bun.lock`", "real env files, or `bun.lock`");
+  if (/landing\/|seller-surface|studio-owned/i.test(rewritten)) {
+    throw new Error("Buyer agent instructions still contain seller-only guidance.");
+  }
+  return rewritten;
+}
+function rewriteBuyerClaudeInstructions(content) {
+  if (!/landing\/|studio-owned/i.test(content))
+    return content;
+  const rewritten = removeParagraphContaining(content, "`landing/AGENTS.md`");
+  if (/landing\/|studio-owned/i.test(rewritten)) {
+    throw new Error("Buyer Claude instructions still contain seller-only guidance.");
+  }
+  return rewritten;
+}
+function rewriteBuyerSetupInstructions(content) {
+  if (!content.includes("## Create a product repository"))
+    return content;
+  const rewritten = replaceMarkdownSection(content, "Create a product repository", "");
+  const escapedCliName = CLI_NAME2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  if (new RegExp(`pnpm dlx ${escapedCliName}|bunx ${escapedCliName}|${escapedCliName} repository`, "i").test(rewritten)) {
+    throw new Error("Buyer setup instructions still contain source-delivery guidance.");
+  }
+  return rewritten;
+}
+function rewriteBuyerReleaseInstructions(content) {
+  if (!content.includes("## npm bootstrapper"))
+    return content;
+  const rewritten = replaceMarkdownSection(content, "npm bootstrapper", "");
+  const escapedCliName = CLI_NAME2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  if (new RegExp(`${escapedCliName}@\\d|public \`${escapedCliName}\` npm package`, "i").test(rewritten)) {
+    throw new Error("Buyer release instructions still contain vendor bootstrapper guidance.");
+  }
+  return rewritten;
+}
+function generateServerEnv(example, secret = randomBytes(32).toString("hex"), databasePort = 5432) {
+  if (!/^[a-f0-9]{64}$/.test(secret)) {
+    throw new Error("Better Auth secret must be 32 bytes encoded as hex.");
+  }
+  if (!/^DATABASE_URL=.*$/m.test(example) || !/^BETTER_AUTH_SECRET=.*$/m.test(example)) {
+    throw new Error("Server .env.example must contain DATABASE_URL and BETTER_AUTH_SECRET entries.");
+  }
+  if (!Number.isInteger(databasePort) || databasePort < 1 || databasePort > 65535) {
+    throw new Error("Database port must be an integer between 1 and 65535.");
+  }
+  const databaseUrl = `postgresql://app:app@localhost:${databasePort}/app?sslmode=disable`;
+  return example.replace(/^DATABASE_URL=.*$/m, `DATABASE_URL=${databaseUrl}`).replace(/^BETTER_AUTH_SECRET=.*$/m, `BETTER_AUTH_SECRET=${secret}`);
+}
+var SCOPE_EXTENSIONS2 = new Set([".json", ".jsonc", ".md", ".ts", ".tsx", ".yaml", ".yml"]);
+function isScopeRewriteFile(path) {
+  return SCOPE_EXTENSIONS2.has(extname(path)) || path.replaceAll("\\", "/").endsWith("/.vite-hooks/pre-commit");
+}
+function isTemplatePathExcluded(relativePath) {
+  const normalized = relativePath.replaceAll("\\", "/");
+  const parts = normalized.split("/").filter(Boolean);
+  const basename = parts.at(-1) ?? "";
+  if (parts.includes(".git") || parts.includes(".worktrees") || parts.includes("node_modules"))
+    return true;
+  if (parts.includes(".terraform"))
+    return true;
+  if (parts.includes(".impeccable"))
+    return true;
+  if (parts.includes(".agent-evals") || parts.includes(".agents") || parts.includes(".claude"))
+    return true;
+  if (normalized === "skills-lock.json")
+    return true;
+  if (normalized === "operations" || normalized.startsWith("operations/"))
+    return true;
+  if (normalized === "apps/worker" || normalized.startsWith("apps/worker/"))
+    return true;
+  if (parts.includes("dist") || parts.includes("out"))
+    return true;
+  if (normalized === "landing" || normalized.startsWith("landing/"))
+    return true;
+  if (normalized === "bun.lock")
+    return true;
+  if (normalized === ".vercelignore")
+    return true;
+  if (basename.endsWith(".tfvars") || basename === "backend.hcl")
+    return true;
+  if (basename.includes(".tfstate") || /^gha-creds-.*\.json$/.test(basename))
+    return true;
+  if (normalized === "PLAN.md" || normalized === "comments.md")
+    return true;
+  if (normalized === "packages/create-app/src/cli-brand-contract.test.ts")
+    return true;
+  if (normalized === "packages/create-app/LICENSE")
+    return true;
+  if (normalized === "packages/create-app/README.md")
+    return true;
+  if (normalized === "docs/phase2" || normalized.startsWith("docs/phase2/"))
+    return true;
+  if (/^docs\/evaluations\/(?:tec|pro2)-[^/]+\.md$/.test(normalized))
+    return true;
+  if (normalized === "apps/server/server")
+    return true;
+  if (basename.endsWith(".tsbuildinfo"))
+    return true;
+  if (basename === ".env" || basename.startsWith(".env.") && basename !== ".env.example")
+    return true;
+  return false;
+}
+
+// src/scaffold.ts
+var execFileAsync = promisify(execFile);
+async function assertEmptyTarget(targetDirectory) {
+  try {
+    const targetStat = await stat4(targetDirectory);
+    if (!targetStat.isDirectory())
+      throw new Error(`Target exists and is not a directory: ${targetDirectory}`);
+    if ((await readdir(targetDirectory)).length > 0) {
+      throw new Error(`Refusing to overwrite non-empty directory: ${targetDirectory}`);
+    }
+  } catch (error) {
+    if (error.code !== "ENOENT")
+      throw error;
+  }
+}
+async function copyLocalTemplate(source, target) {
+  const sourceDirectory = resolve3(source);
+  const sourceStat = await lstat(sourceDirectory).catch(() => {
+    return;
+  });
+  if (!sourceStat?.isDirectory())
+    throw new Error(`Template path is not a directory: ${sourceDirectory}`);
+  await assertNoSymbolicLinks(sourceDirectory, sourceDirectory, true);
+  await mkdir4(target, { recursive: true });
+  await cp(sourceDirectory, target, {
+    recursive: true,
+    filter: (path) => {
+      const relativePath = relative(sourceDirectory, path);
+      return relativePath === "" || !isTemplatePathExcluded(relativePath);
+    }
+  });
+  await assertNoSymbolicLinks(target);
+}
+async function assertNoSymbolicLinks(directory, root = directory, skipExcludedPaths = false) {
+  const entries = await readdir(directory, { withFileTypes: true });
+  for (const entry of entries) {
+    const path = join6(directory, entry.name);
+    const relativePath = relative(root, path);
+    if (skipExcludedPaths && isTemplatePathExcluded(relativePath))
+      continue;
+    if (entry.isSymbolicLink()) {
+      throw new Error(`Template contains a symbolic link, which is not supported: ${path}`);
+    }
+    if (entry.isDirectory())
+      await assertNoSymbolicLinks(path, root, skipExcludedPaths);
+  }
+}
+function verifyReleaseMetadata(checksum, manifest, artifactName, digest, templateRef) {
+  const checksumMatch = checksum.trim().match(/^([a-f0-9]{64})\s+\*?([^\s]+)$/i);
+  if (!checksumMatch || checksumMatch[2] !== artifactName) {
+    throw new Error(`${CLI_NAME2} release checksum metadata is malformed.`);
+  }
+  if (checksumMatch[1]?.toLowerCase() !== digest) {
+    throw new Error(`${CLI_NAME2} release checksum verification failed.`);
+  }
+  if (String(manifest.schemaVersion) !== "1" || manifest.tag !== templateRef || manifest.artifact.file !== artifactName || manifest.artifact.sha256.toLowerCase() !== digest) {
+    throw new Error(`${CLI_NAME2} release manifest does not match the downloaded source artifact.`);
+  }
+}
+async function downloadReleaseAsset(templateRef, fileName, directory) {
+  try {
+    await execFileAsync("gh", [
+      "release",
+      "download",
+      templateRef,
+      "--repo",
+      TEMPLATE_REPOSITORY,
+      "--pattern",
+      fileName,
+      "--dir",
+      directory
+    ]);
+  } catch {
+    throw new Error(`Unable to download ${templateRef}. Confirm that GitHub CLI is installed, run ` + `\`gh auth login\`, and accept your ${CLI_NAME2} repository invitation.`);
+  }
+}
+async function downloadGitHubTemplate(target, templateRef) {
+  if (!/^v\d+\.\d+\.\d+(?:-rc\.\d+)?$/.test(templateRef)) {
+    throw new Error(`${CLI_NAME2} template reference must be an immutable release tag: ${templateRef}`);
+  }
+  const temporaryDirectory = await mkdtemp(join6(tmpdir(), `${CLI_NAME2}-`));
+  const artifactName = `foundation-source-${templateRef}.tar.gz`;
+  const checksumName = `${artifactName}.sha256`;
+  const manifestName = `foundation-source-${templateRef}.manifest.json`;
+  const archivePath = join6(temporaryDirectory, artifactName);
+  const extractedPath = join6(temporaryDirectory, "template");
+  try {
+    await execFileAsync("gh", ["auth", "status", "--hostname", "github.com"]).catch(() => {
+      throw new Error(`${CLI_NAME2} source access requires GitHub CLI authentication. Run \`gh auth login\` first.`);
+    });
+    await downloadReleaseAsset(templateRef, artifactName, temporaryDirectory);
+    await downloadReleaseAsset(templateRef, checksumName, temporaryDirectory);
+    await downloadReleaseAsset(templateRef, manifestName, temporaryDirectory);
+    const archive = await readFile5(archivePath);
+    const digest = createHash("sha256").update(archive).digest("hex");
+    const checksum = await readFile5(join6(temporaryDirectory, checksumName), "utf8");
+    const manifest = JSON.parse(await readFile5(join6(temporaryDirectory, manifestName), "utf8"));
+    verifyReleaseMetadata(checksum, manifest, artifactName, digest, templateRef);
+    await mkdir4(extractedPath);
+    await execFileAsync("tar", ["-xzf", archivePath, "-C", extractedPath, "--strip-components=1"]);
+    await copyLocalTemplate(extractedPath, target);
+  } finally {
+    await rm3(temporaryDirectory, { recursive: true, force: true });
+  }
+}
+async function walk(directory) {
+  const entries = await readdir(directory, { withFileTypes: true });
+  const paths = [];
+  for (const entry of entries) {
+    const path = join6(directory, entry.name);
+    if (entry.isSymbolicLink()) {
+      throw new Error(`Generated template contains a symbolic link: ${path}`);
+    }
+    if (entry.isDirectory())
+      paths.push(...await walk(path));
+    else if (entry.isFile())
+      paths.push(path);
+  }
+  return paths;
+}
+async function rewriteFile(path, rewrite) {
+  const content = await readFile5(path, "utf8");
+  const result = rewrite(content);
+  if (result.replacements > 0)
+    await writeFile4(path, result.content);
+  return result.replacements;
+}
+async function applyScopeRewrite(target, scope) {
+  const report = { files: 0, replacements: 0 };
+  for (const path of await walk(target)) {
+    if (!isScopeRewriteFile(path))
+      continue;
+    const replacements = await rewriteFile(path, (content) => {
+      const result = rewriteScopeContent(content, scope);
+      if (result.replacements > 0 && path.endsWith("/package.json")) {
+        result.content = formatRewrittenPackageJson(result.content);
+      }
+      if (result.replacements > 0 && (path.endsWith(".ts") || path.endsWith(".tsx"))) {
+        result.content = wrapLongNamedImports(result.content);
+      }
+      if (result.replacements > 0 && path.endsWith("/apps/docs/README.md")) {
+        result.content = result.content.replace("root workspace filter: `pnpm", "root workspace filter:\n`pnpm").replace("<command>`.\nThe product deployment", "<command>`. The product deployment").replace("not deploy this Next.js application. See `docs/docs-site.md`\nfor publication", "not deploy this\nNext.js application. See `docs/docs-site.md` for publication");
+      }
+      return result;
+    });
+    if (replacements > 0)
+      report.files += 1;
+    report.replacements += replacements;
+  }
+  return report;
+}
+async function applyBrandRewrite(target, brandName) {
+  const report = { files: 0, replacements: 0 };
+  for (const entry of BRAND_MANIFEST) {
+    const path = join6(target, entry.path);
+    const replacements = await rewriteFile(path, (content) => {
+      const result = rewriteBrandContent(content, brandName);
+      if (result.replacements > 0 && path.endsWith(".tsx")) {
+        result.content = wrapBrandedJsxText(result.content, brandName);
+      }
+      return result;
+    });
+    if (replacements > 0)
+      report.files += 1;
+    report.replacements += replacements;
+  }
+  return report;
+}
+async function generateEnvironmentFiles(target, databasePort = 5432) {
+  const serverExample = await readFile5(join6(target, "apps/server/.env.example"), "utf8");
+  await writeFile4(join6(target, "apps/server/.env"), generateServerEnv(serverExample, undefined, databasePort));
+  const webExample = await readFile5(join6(target, "apps/web/.env.example"), "utf8");
+  await writeFile4(join6(target, "apps/web/.env"), webExample);
+  const docsExample = await readFile5(join6(target, "apps/docs/.env.example"), "utf8");
+  await writeFile4(join6(target, "apps/docs/.env"), docsExample);
+  await writeFile4(join6(target, ".env"), `POSTGRES_PORT=${databasePort}
+`);
+}
+async function neutralizeAgentInstructions(target) {
+  const agentPath = join6(target, "AGENTS.md");
+  const claudePath = join6(target, "CLAUDE.md");
+  await writeFile4(agentPath, rewriteBuyerAgentInstructions(await readFile5(agentPath, "utf8")));
+  await writeFile4(claudePath, rewriteBuyerClaudeInstructions(await readFile5(claudePath, "utf8")));
+}
+async function neutralizeSourceCli(target, scope, brandName) {
+  if (String(CLI_NAME2) === BUYER_CLI_NAME && String(CLI_PACKAGE_NAME) === BUYER_CLI_PACKAGE_NAME)
+    return;
+  const rootPackagePath = join6(target, "package.json");
+  const rootPackage = JSON.parse(await readFile5(rootPackagePath, "utf8"));
+  const sourceScript = rootPackage.scripts?.[CLI_NAME2];
+  if (!sourceScript)
+    throw new Error(`Root package is missing the ${CLI_NAME2} script.`);
+  rootPackage.scripts[BUYER_CLI_NAME] = sourceScript;
+  delete rootPackage.scripts[CLI_NAME2];
+  await writeFile4(rootPackagePath, `${JSON.stringify(rootPackage, null, 2)}
+`);
+  const cliPackagePath = join6(target, "packages/create-app/package.json");
+  const cliPackage = JSON.parse(await readFile5(cliPackagePath, "utf8"));
+  if (cliPackage.name !== CLI_PACKAGE_NAME || !cliPackage.bin?.[CLI_NAME2]) {
+    throw new Error(`Source CLI package must expose ${CLI_PACKAGE_NAME} as ${CLI_NAME2}.`);
+  }
+  const executable = cliPackage.bin[CLI_NAME2];
+  cliPackage.name = BUYER_CLI_PACKAGE_NAME;
+  cliPackage.private = true;
+  cliPackage.bin = { [BUYER_CLI_NAME]: executable };
+  delete cliPackage.description;
+  delete cliPackage.homepage;
+  delete cliPackage.repository;
+  delete cliPackage.keywords;
+  delete cliPackage.files;
+  delete cliPackage.publishConfig;
+  await writeFile4(cliPackagePath, `${JSON.stringify(cliPackage, null, 2)}
+`);
+  const constantsPath = join6(target, "packages/create-app/src/constants.ts");
+  const constants2 = await readFile5(constantsPath, "utf8");
+  const cliDeclaration = `export const CLI_NAME = '${CLI_NAME2}'`;
+  const packageDeclaration = `export const CLI_PACKAGE_NAME = '${CLI_PACKAGE_NAME}'`;
+  const scopeDeclaration = `export const DEFAULT_SCOPE = '@app'`;
+  const repositoryDeclaration = `export const TEMPLATE_REPOSITORY = '${TEMPLATE_REPOSITORY}'`;
+  const brandDeclaration = `export const SOURCE_BRAND_NAME = '${SOURCE_BRAND_NAME}'`;
+  if (!constants2.includes(cliDeclaration) || !constants2.includes(packageDeclaration) || !constants2.includes(scopeDeclaration) || !constants2.includes(repositoryDeclaration) || !constants2.includes(brandDeclaration)) {
+    throw new Error("Source CLI constants do not match the package identity.");
+  }
+  await writeFile4(constantsPath, constants2.replace(cliDeclaration, `export const CLI_NAME = '${BUYER_CLI_NAME}'`).replace(packageDeclaration, `export const CLI_PACKAGE_NAME = '${BUYER_CLI_PACKAGE_NAME}'`).replace(scopeDeclaration, `export const DEFAULT_SCOPE = '${normalizeScope2(scope)}'`).replace(repositoryDeclaration, "export const TEMPLATE_REPOSITORY = 'OWNER/REPOSITORY'").replace(brandDeclaration, `export const SOURCE_BRAND_NAME = '${brandName}'`));
+  const brandingPath = join6(target, "docs/golden-paths/customize-branding-design-tokens.md");
+  const branding = await readFile5(brandingPath, "utf8");
+  await writeFile4(brandingPath, branding.replaceAll(`pnpm ${CLI_NAME2}`, `pnpm ${BUYER_CLI_NAME}`));
+  const setupPath = join6(target, "docs/setup.md");
+  await writeFile4(setupPath, rewriteBuyerSetupInstructions(await readFile5(setupPath, "utf8")));
+  const releasesPath = join6(target, "docs/releases.md");
+  await writeFile4(releasesPath, rewriteBuyerReleaseInstructions(await readFile5(releasesPath, "utf8")));
+}
+async function initializeRepository(target) {
+  await execFileAsync("git", ["init"], { cwd: target });
+  await execFileAsync("git", ["add", "-A"], { cwd: target });
+  await execFileAsync("git", [
+    "-c",
+    `user.name=${CLI_NAME2}`,
+    "-c",
+    `user.email=${CLI_NAME2}@localhost`,
+    "commit",
+    "-m",
+    "Initial commit"
+  ], { cwd: target });
+}
+async function scaffold(options) {
+  const target = resolve3(options.targetDirectory);
+  await assertEmptyTarget(target);
+  try {
+    if (options.from)
+      await copyLocalTemplate(options.from, target);
+    else if (options.templateRef)
+      await downloadGitHubTemplate(target, options.templateRef);
+    else {
+      throw new Error(`A local source path or immutable ${CLI_NAME2} release is required.`);
+    }
+    const packagePath = join6(target, "package.json");
+    const packageReplacements = await rewriteFile(packagePath, (content) => rewriteRootPackageName(content, options.appName));
+    const scope = await applyScopeRewrite(target, options.scope);
+    await neutralizeAgentInstructions(target);
+    await neutralizeSourceCli(target, options.scope, options.brandName);
+    const brand = await applyBrandRewrite(target, options.brandName);
+    await generateEnvironmentFiles(target, options.databasePort);
+    if (options.initializeGit)
+      await initializeRepository(target);
+    return {
+      targetDirectory: target,
+      packageName: { files: packageReplacements > 0 ? 1 : 0, replacements: packageReplacements },
+      scope,
+      brand
+    };
+  } catch (error) {
+    if ((await stat4(target).catch(() => {
+      return;
+    }))?.isDirectory()) {
+      const entries = await readdir(target);
+      if (entries.length === 0)
+        await rm3(target, { recursive: true, force: true });
+    }
+    throw error;
+  }
+}
+
+// src/cli.ts
+class CliCancelled extends Error {
+}
+function usage() {
+  return `Usage: ${CLI_NAME} [app-name] [options]
+       ${CLI_NAME} agent setup [options]
+       ${CLI_NAME} deploy configure [options]
+
+Create a buyer-owned SaaS application from your licensed ${suggestBrandName(CLI_NAME)} release.
+
+Options:
+  --from <path>       Use a local source checkout (maintainer/testing)
+  --scope <namespace> Advanced workspace namespace override (default: derived from brand)
+  --brand <name>      Display name (default: derived from app name)
+  --yes               Accept recommended defaults for omitted options
+  --git / --no-git    Enable or disable Git initialization (default: enabled)
+  --install           Install dependencies (default: enabled)
+  --no-install        Skip dependency installation
+  --start             Start Postgres and development servers after creation
+  --no-start          Create the application without starting it
+  --cloud <provider>  Configure AWS, GCP, or Azure deployment during setup
+  --storage <provider> Select r2, s3, or gcs object storage
+  --no-deploy         Keep every cloud option for later deployment setup
+  --frontend <target> Select native, vercel, or cloudflare frontend hosting
+  --deploy-environment <name> Deployment environment (default: production)
+  --region <name>      Cloud region
+  --api-domain <host>  Stable production API hostname
+  --frontend-domain <host> Stable production frontend hostname
+  --ha / --no-ha      Enable or disable the higher-availability profile
+  -v, --version       Print the CLI version
+  -h, --help          Show this help
+
+Agent tooling:
+  ${agentSetupUsage(CLI_NAME)}
+
+Deployment:
+  Run pnpm deploy:configure inside a generated app to make a deferred cloud selection.`;
+}
+function takeValue3(args, index, flag) {
+  const value = args[index + 1];
+  if (!value || value.startsWith("--"))
+    throw new Error(`${flag} requires a value.`);
+  return value;
+}
+function parseArguments(argv) {
+  const parsed = {
+    yes: false,
+    deployment: {},
+    help: false,
+    version: false
+  };
+  for (let index = 0;index < argv.length; index += 1) {
+    const argument = argv[index];
+    if (argument === "--from")
+      parsed.from = takeValue3(argv, index++, argument);
+    else if (argument === "--scope")
+      parsed.scope = takeValue3(argv, index++, argument);
+    else if (argument === "--brand")
+      parsed.brandName = takeValue3(argv, index++, argument);
+    else if (argument === "--yes" || argument === "-y")
+      parsed.yes = true;
+    else if (argument === "--git")
+      parsed.initializeGit = true;
+    else if (argument === "--no-git")
+      parsed.initializeGit = false;
+    else if (argument === "--install")
+      parsed.installDependencies = true;
+    else if (argument === "--no-install")
+      parsed.installDependencies = false;
+    else if (argument === "--start")
+      parsed.startDevelopment = true;
+    else if (argument === "--no-start")
+      parsed.startDevelopment = false;
+    else if (argument === "--cloud") {
+      parsed.deployment.cloud = parseDeploymentCloud2(takeValue3(argv, index++, argument));
+      parsed.setupDeployment = true;
+    } else if (argument === "--no-deploy")
+      parsed.setupDeployment = false;
+    else if (argument === "--storage") {
+      parsed.deployment.storageProvider = parseStorageProvider2(takeValue3(argv, index++, argument));
+    } else if (argument === "--frontend") {
+      parsed.deployment.frontendTarget = parseFrontendTarget2(takeValue3(argv, index++, argument));
+    } else if (argument === "--deploy-environment") {
+      parsed.deployment.environment = takeValue3(argv, index++, argument);
+    } else if (argument === "--region")
+      parsed.deployment.region = takeValue3(argv, index++, argument);
+    else if (argument === "--api-domain") {
+      parsed.deployment.apiDomain = takeValue3(argv, index++, argument);
+    } else if (argument === "--frontend-domain") {
+      parsed.deployment.frontendDomain = takeValue3(argv, index++, argument);
+    } else if (argument === "--ha")
+      parsed.deployment.haEnabled = true;
+    else if (argument === "--no-ha")
+      parsed.deployment.haEnabled = false;
+    else if (argument === "--version" || argument === "-v")
+      parsed.version = true;
+    else if (argument === "--help" || argument === "-h")
+      parsed.help = true;
+    else if (argument?.startsWith("-"))
+      throw new Error(`Unknown option: ${argument}`);
+    else if (!parsed.appName)
+      parsed.appName = argument;
+    else
+      throw new Error(`Unexpected argument: ${argument}`);
+  }
+  return parsed;
+}
+function suggestBrandName(appName) {
+  const productAcronyms = {
+    ai: "AI",
+    api: "API",
+    b2b: "B2B",
+    b2c: "B2C",
+    crm: "CRM",
+    saas: "SaaS"
+  };
+  return appName.split("-").map((segment) => productAcronyms[segment] ?? `${segment.charAt(0).toUpperCase()}${segment.slice(1)}`).join(" ");
+}
+function suggestScope(brandName, fallbackAppName) {
+  const namespace = brandName.normalize("NFKD").replace(/\p{Mark}/gu, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return namespace || fallbackAppName;
+}
+async function unwrapPrompt(value) {
+  if (prompts5.isCancel(value)) {
+    prompts5.cancel("No project was created.");
+    throw new CliCancelled;
+  }
+  return value;
+}
+async function collectOptions(parsed) {
+  if (parsed.yes && !parsed.appName)
+    throw new Error("Pass an app name when using --yes.");
+  if (!parsed.yes && !process.stdin.isTTY && !parsed.appName) {
+    throw new Error("Interactive prompts need a terminal. Pass an app name and --yes instead.");
+  }
+  const appName = parsed.appName ?? await unwrapPrompt(await prompts5.text({
+    message: "App name",
+    placeholder: "my-saas",
+    validate: (value) => validateAppName(value ?? "")
+  }));
+  const appNameError = validateAppName(appName);
+  if (appNameError)
+    throw new Error(appNameError);
+  const suggestedBrand = suggestBrandName(appName);
+  const brandName = parsed.brandName ?? (parsed.yes ? suggestedBrand : await unwrapPrompt(await prompts5.text({
+    message: "Brand name",
+    placeholder: suggestedBrand,
+    defaultValue: suggestedBrand,
+    validate: (value) => validateBrandName(value || suggestedBrand)
+  })));
+  const brandError = validateBrandName(brandName);
+  if (brandError)
+    throw new Error(brandError);
+  const scope = normalizeScope(parsed.scope ?? suggestScope(brandName, appName));
+  const initializeGit = parsed.initializeGit ?? (parsed.yes ? true : await unwrapPrompt(await prompts5.confirm({
+    message: "Initialize a Git repository?",
+    initialValue: true
+  })));
+  const installDependencies = parsed.installDependencies ?? (parsed.yes ? true : await unwrapPrompt(await prompts5.confirm({
+    message: "Install dependencies with pnpm?",
+    initialValue: true
+  })));
+  if (parsed.startDevelopment && !installDependencies) {
+    throw new Error("--start requires dependency installation. Remove --no-install.");
+  }
+  const startDevelopment = parsed.startDevelopment ?? (parsed.yes || !installDependencies ? false : await unwrapPrompt(await prompts5.confirm({
+    message: "Start local development now?",
+    initialValue: true
+  })));
+  const setupDeployment = parsed.setupDeployment ?? (parsed.yes ? false : await unwrapPrompt(await prompts5.confirm({
+    message: "Set up cloud deployment now?",
+    initialValue: false
+  })));
+  const deployment = setupDeployment ? await collectDeploymentSelection2(parsed.deployment, parsed.yes) : undefined;
+  return {
+    appName,
+    from: parsed.from ? resolve4(parsed.from) : undefined,
+    scope,
+    brandName,
+    initializeGit,
+    installDependencies,
+    startDevelopment,
+    deployment
+  };
+}
+async function readCliVersion() {
+  const packageJson = JSON.parse(await readFile6(resolve4(dirname2(fileURLToPath2(import.meta.url)), "../package.json"), "utf8"));
+  if (!packageJson.version)
+    throw new Error(`${CLI_NAME} package version is missing.`);
+  return packageJson.version;
+}
+function templateRefForVersion(version) {
+  if (!/^\d+\.\d+\.\d+(?:-rc\.\d+)?$/.test(version)) {
+    throw new Error(`${CLI_NAME} package version is not release-compatible: ${version}`);
+  }
+  if (version === "0.0.0") {
+    throw new Error(`This pre-release ${CLI_NAME} checkout requires --from <local-source-path>.`);
+  }
+  return `v${version}`;
+}
+async function assertTargetAvailable(target) {
+  const targetStat = await stat5(target).catch(() => {
+    return;
+  });
+  if (!targetStat)
+    return;
+  if (!targetStat.isDirectory())
+    throw new Error(`Target exists and is not a directory: ${target}`);
+  if ((await readdir2(target)).length > 0) {
+    throw new Error(`Refusing to overwrite non-empty directory: ${target}`);
+  }
+}
+async function hasListeningServiceOnHost(port, host) {
+  return await new Promise((resolvePort) => {
+    let settled = false;
+    const socket = createConnection({ host, port });
+    const finish = (listening) => {
+      if (settled)
+        return;
+      settled = true;
+      socket.destroy();
+      resolvePort(listening);
+    };
+    socket.setTimeout(250);
+    socket.once("connect", () => finish(true));
+    socket.once("timeout", () => finish(false));
+    socket.once("error", () => finish(false));
+  });
+}
+async function hasListeningService(port) {
+  const results = await Promise.all(["127.0.0.1", "::1"].map((host) => hasListeningServiceOnHost(port, host)));
+  return results.some(Boolean);
+}
+async function isPortAvailable(port) {
+  if (await hasListeningService(port))
+    return false;
+  return await new Promise((resolvePort) => {
+    const server = createServer();
+    server.unref();
+    server.once("error", () => resolvePort(false));
+    server.listen({ host: "127.0.0.1", port, exclusive: true }, () => {
+      server.close(() => resolvePort(true));
+    });
+  });
+}
+async function findAvailablePort(preferredPort = 5432) {
+  for (let port = preferredPort;port < preferredPort + 100; port += 1) {
+    if (await isPortAvailable(port))
+      return port;
+  }
+  throw new Error(`No available local Postgres port found from ${preferredPort}.`);
+}
+function assertSiblingTarget(source, target) {
+  if (!source)
+    return;
+  const normalizedSource = resolve4(source);
+  const normalizedTarget = resolve4(target);
+  if (normalizedTarget.startsWith(`${normalizedSource}${sep}`)) {
+    throw new Error(`Create the new app beside the ${CLI_NAME} source checkout, not inside it.`);
+  }
+}
+function commandFailureOutput(stdout, stderr) {
+  const output = (stderr.trim() || stdout.trim()).split(`
+`).slice(-12).join(`
+`);
+  return output ? `
+
+${output}` : "";
+}
+async function installDependencies(target) {
+  const { stdout, stderr, exitCode } = await runCaptured2(["pnpm", "install", "--frozen-lockfile"], {
+    cwd: target,
+    env: { ...process.env, CI: "1" }
+  });
+  if (exitCode !== 0) {
+    throw new Error(`Dependency installation failed.${commandFailureOutput(stdout, stderr)}`);
+  }
+}
+async function runCapturedCommand(command, target) {
+  const { stdout, stderr, exitCode } = await runCaptured2(command, { cwd: target });
+  if (exitCode !== 0) {
+    throw new Error(`${command.join(" ")} failed.${commandFailureOutput(stdout, stderr)}`);
+  }
+}
+async function startDevelopment(target) {
+  const occupiedPorts = (await Promise.all([5173, 8000].map(async (port) => ({
+    port,
+    available: await isPortAvailable(port)
+  })))).filter((result) => !result.available).map((result) => result.port);
+  if (occupiedPorts.length > 0) {
+    throw new Error(`Cannot start development because port ${occupiedPorts.join(", ")} is in use.`);
+  }
+  await runStep("Starting local Postgres", "Local Postgres is ready", () => runCapturedCommand(["docker", "compose", "up", "-d", "--wait", "postgres"], target));
+  prompts5.log.info(`Web  http://localhost:5173
+API  http://localhost:8000`);
+  prompts5.outro("Development servers are starting. Ctrl+C stops app servers; Postgres stays running.");
+  const exitCode = await runInherited(["vp", "run", "-r", "--parallel", "dev"], { cwd: target });
+  if (exitCode !== 0 && exitCode !== 130) {
+    throw new Error(`Development servers exited with code ${exitCode}.`);
+  }
+}
+async function runStep(pending, complete, action, indicator = "dots") {
+  const progress = prompts5.spinner({ indicator });
+  progress.start(pending);
+  try {
+    const result = await action();
+    progress.stop(complete);
+    return result;
+  } catch (error) {
+    progress.error(`${pending} failed`);
+    throw error;
+  }
+}
+async function createApplication(options, version) {
+  const target = resolve4(process.cwd(), options.appName);
+  await assertTargetAvailable(target);
+  assertSiblingTarget(options.from, target);
+  const databasePort = await findAvailablePort();
+  await mkdir5(dirname2(target), { recursive: true });
+  const staging = await mkdtemp2(join7(dirname2(target), `.${options.appName}-${CLI_NAME}-`));
+  try {
+    const templateRef = options.from ? undefined : templateRefForVersion(version);
+    await runStep("Preparing your application", "Application source prepared", () => scaffold({
+      appName: options.appName,
+      scope: options.scope,
+      brandName: options.brandName,
+      targetDirectory: staging,
+      from: options.from,
+      templateRef,
+      initializeGit: options.initializeGit,
+      databasePort
+    }));
+    if (options.deployment) {
+      await runStep("Configuring deployment", "Deployment target locked", () => applyDeploymentSelection2(staging, options.appName, options.deployment));
+    }
+    if (options.installDependencies) {
+      await runStep("Installing dependencies with pnpm", "Dependencies installed with pnpm", () => installDependencies(staging), "timer");
+    }
+    if (await stat5(target).catch(() => {
+      return;
+    }))
+      await rmdir(target);
+    await rename2(staging, target);
+    return { target, databasePort };
+  } catch (error) {
+    await rm4(staging, { recursive: true, force: true });
+    throw error;
+  }
+}
+function completionDetails(target, options, databasePort) {
+  const targetName = relative2(process.cwd(), target) || options.appName;
+  const install = options.installDependencies ? [] : ["vp install --frozen-lockfile"];
+  return {
+    directory: `./${targetName}`,
+    commands: [
+      `cd ${targetName}`,
+      ...install,
+      "docker compose up -d postgres",
+      "vp run -r --parallel dev"
+    ].join(`
+`),
+    database: `Postgres  localhost:${databasePort}`
+  };
+}
+async function main() {
+  const argv = process.argv.slice(2);
+  if (argv[0] === "agent") {
+    if (argv[1] !== "setup")
+      throw new Error("Unknown agent command. Use `agent setup`.");
+    await runAgentSetup(argv.slice(2), CLI_NAME);
+    return;
+  }
+  if (argv[0] === "deploy") {
+    if (argv[1] !== "configure")
+      throw new Error("Unknown deploy command. Use `deploy configure`.");
+    await runDeploymentConfigure(argv.slice(2), suggestBrandName(CLI_NAME));
+    return;
+  }
+  const parsed = parseArguments(argv);
+  const version = await readCliVersion();
+  if (parsed.help) {
+    console.log(usage());
+    return;
+  }
+  if (parsed.version) {
+    console.log(version);
+    return;
+  }
+  prompts5.intro(`${suggestBrandName(CLI_NAME)} ${version} \xB7 production SaaS foundation`);
+  const options = await collectOptions(parsed);
+  const { target, databasePort } = await createApplication(options, version);
+  const completion = completionDetails(target, options, databasePort);
+  prompts5.log.success(`Created ${completion.directory}`);
+  if (!options.startDevelopment) {
+    prompts5.log.step("Run locally");
+    prompts5.log.message(completion.commands);
+    prompts5.log.info(`Web       http://localhost:5173
+API       http://localhost:8000
+${completion.database}`);
+    if (options.deployment) {
+      prompts5.log.info(`Deployment ${options.deployment.cloud.toUpperCase()} + ${options.deployment.storageProvider} + ${options.deployment.frontendTarget} locked. Review deployment/README.md.`);
+    } else {
+      prompts5.log.info("Deployment deferred. Run `pnpm deploy:configure` when you are ready.");
+    }
+    prompts5.outro(`${options.brandName} is ready.`);
+    return;
+  }
+  try {
+    await startDevelopment(target);
+  } catch (error) {
+    prompts5.log.error(error instanceof Error ? error.message : String(error));
+    prompts5.log.info(`The application was created at ${completion.directory}.`);
+    prompts5.log.step("Start it manually");
+    prompts5.log.message(completion.commands);
+    process.exitCode = 1;
+  }
+}
+if (isEntrypoint(import.meta.url)) {
+  main().catch((error) => {
+    if (error instanceof CliCancelled)
+      return;
+    prompts5.log.error(error instanceof Error ? error.message : String(error));
+    prompts5.outro("No project was created.");
+    process.exitCode = 1;
+  });
+}
+export {
+  usage,
+  templateRefForVersion,
+  suggestScope,
+  suggestBrandName,
+  parseArguments,
+  findAvailablePort
+};