@ait-co/devtools 0.1.116 → 0.1.118

package/dist/{cli-BLBo0lkP.js → attach-orchestrator-qFEMBUwb.js}

@@ -1,14 +1,7 @@
 #!/usr/bin/env node
 import { r as generateTotp } from "./totp-DvOYkYim.js";
-import { parseArgs } from "node:util";
-import { accessSync } from "node:fs";
-import * as path from "node:path";
-import { isAbsolute, resolve } from "node:path";
 import { randomBytes } from "node:crypto";
 import { Tunnel, bin, install } from "cloudflared";
-import * as fs from "node:fs/promises";
-import { glob } from "node:fs/promises";
-import { fileURLToPath } from "node:url";
 //#region src/mcp/deeplink.ts
 /**
 * URL of the AITC Sandbox launcher PWA.
@@ -1477,7 +1470,7 @@ async function prepareAttach(deps, env, args, conn) {
 		const buildProjectRoot = typeof rawProjectRoot === "string" ? rawProjectRoot : void 0;
 		let tunnelHttpUrl = process.env.AIT_TUNNEL_BASE_URL?.trim() ?? "";
 		if (tunnelHttpUrl === "" && buildProjectRoot !== void 0) {
-			const { readRelayUrls } = await import("./relay-url-store-NDtEcOE-.js");
+			const { readRelayUrls } = await import("./relay-url-store-DGQ-HPQC.js");
 			tunnelHttpUrl = (await readRelayUrls({ projectRoot: buildProjectRoot }))?.tunnelBaseUrl ?? "";
 		}
 		if (tunnelHttpUrl === "") return {
@@ -1723,744 +1716,35 @@ async function renderAndMaybeWait(deps, prep, waitForAttach, callTimeoutMs, conn
 		...totpResult() ? { totp: totpResult() } : {}
 	}, null, 2)}\n\n${qr}`);
 }
-//#endregion
-//#region src/test-runner/cell.ts
-/**
-* Injects each key of `globals` into `globalThis` in the page via a single
-* `Runtime.evaluate` call. Must be called BEFORE the first `bundleTestFile`
-* inject — the cell is session-global and applies to all subsequent files.
-*
-* Throws if the CDP evaluate returns an exception.
-*
-* @param conn    - The live CDP connection (relay-attached page).
-* @param globals - Plain-JSON-serialisable key→value map to assign onto `globalThis`.
-*/
-async function injectGlobals(conn, globals) {
-	const expr = `(() => { Object.assign(globalThis, ${JSON.stringify(globals)}); return true; })()`;
-	const result = await conn.send("Runtime.evaluate", {
-		expression: expr,
-		returnByValue: true
-	});
-	if (result.exceptionDetails) {
-		const msg = result.exceptionDetails.exception?.description ?? result.exceptionDetails.text ?? "unknown error";
-		throw new Error(`injectGlobals: Runtime.evaluate threw: ${msg}`);
-	}
-}
-//#endregion
-//#region src/test-runner/discover.ts
-/**
-* Test-file discovery shared by the `devtools-test` CLI and the `run_tests`
-* MCP tool, so both expand glob patterns with identical semantics.
-*
-* Uses Node's built-in `fs/promises` `glob` (Node 22+) — no extra dependency,
-* which keeps the MCP daemon install graph lean (a plain glob lib would land in
-* the `npx … devtools-mcp` path for no benefit).
-*
-* Pure Node IO only (`node:fs/promises` + `node:path`) — react-free, so it is
-* safe to import from the MCP daemon graph.
-*/
-/**
-* Expands `patterns` (globs or plain paths) into a sorted, de-duplicated list of
-* ABSOLUTE test file paths, resolved relative to `cwd`.
-*
-* A plain (non-glob) path passes through when it matches a real file; a glob
-* expands against `cwd`. Absolute matches are kept as-is; relative matches are
-* resolved against `cwd`. `bundleTestFile` requires an absolute path, so the
-* absolute output feeds it directly.
-*
-* @param patterns Glob patterns or file paths (e.g. `['src/**\/*.ait.test.ts']`).
-* @param cwd      Base directory for relative patterns/results.
-* @returns Sorted, de-duplicated absolute file paths. Empty when nothing matches.
-*/
-async function discoverTestFiles(patterns, cwd) {
-	const out = /* @__PURE__ */ new Set();
-	for await (const match of glob(patterns, { cwd })) out.add(isAbsolute(match) ? match : resolve(cwd, match));
-	return [...out].sort();
-}
-//#endregion
-//#region src/test-runner/bundle.ts
-/**
-* esbuild-based bundler for user test files.
-*
-* Bundles a single test file into a self-contained IIFE string that can be
-* injected into a WebView via `Runtime.evaluate`. The bundle includes the
-* test runtime (`runtime.ts`), which provides `describe/it/test/expect` and
-* the `runTestModule(factory)` entry point.
-*
-* ## How the wiring works
-*
-* The bundle exposes two exports on `globalThis.__testBundle`:
-*   - `runTestModule` — the runtime's entry function.
-*   - `__userFactory`  — an async function whose body is the user's top-level
-*     test registration code (describe/it/test calls).
-*
-* The Node-side RPC (`rpc.ts`) calls:
-*   `globalThis.__testBundle.runTestModule(globalThis.__testBundle.__userFactory)`
-*
-* `runTestModule` then installs `describe/it/test/expect` as globals, invokes
-* the factory (which registers all tests), runs them, and returns a `RunReport`.
-*
-* ## Why a factory wrapper is needed
-*
-* Naively adding the runtime to `entryPoints` and bundling the user file would
-* fail for two reasons:
-*   1. `describe/it/test/expect` from the runtime are module-local in the IIFE
-*      scope. The user's top-level `describe(...)` calls expect them as globals —
-*      they are not globals until `runTestModule` installs them.
-*   2. Even with globals pre-installed, the user file runs at IIFE-evaluation
-*      time, before the RPC layer calls `runTestModule` to reset state and start
-*      the test clock.
-*
-* The factory approach solves both: the user's registration code is deferred
-* into a function that `runTestModule` calls AFTER installing the globals.
-*
-* ## Factory extraction algorithm
-*
-* The `userFactoryPlugin` reads the user file and splits lines into:
-*   - **top-level**: `import …` and re-export lines — kept at module scope
-*     (the only valid position for static `import` in ESM).
-*   - **body**: all other statements — moved into the body of the exported
-*     `__userFactory` async function.
-*
-* esbuild processes the re-generated module, following each static import
-* through the normal dependency graph (including the SDK-redirect plugin).
-*
-* ## SDK redirect
-*
-* Imports of `@apps-in-toss/web-framework` (and sub-paths) are intercepted via
-* the `sdkRedirectPlugin` and replaced with a virtual `window.__sdk` proxy that
-* `src/in-app/auto.ts` installs at runtime. This works for both 2.x and 3.x SDK.
-*
-* SECRET-HANDLING: the returned bundle code is caller-managed; never log it.
-*/
-/** The SDK package name that mini-app test code imports from. */
-const SDK_PACKAGE = "@apps-in-toss/web-framework";
-/**
-* Names the runtime installs as globals before invoking the user factory.
-* The `vitest` virtual module re-exports each as a lazy getter that reads from
-* `globalThis` at access time. Keep in sync with the globals installed in
-* `runtime.ts#runTestModule`.
-*/
-const VITEST_GLOBAL_NAMES = [
-	"describe",
-	"it",
-	"test",
-	"expect",
-	"beforeAll",
-	"afterAll",
-	"beforeEach",
-	"afterEach",
-	"vi"
-];
-/**
-* Matches the bare SDK package and any sub-path import
-* (`@apps-in-toss/web-framework`, `@apps-in-toss/web-framework/foo`).
-* Built from {@link SDK_PACKAGE} so the package name has a single source.
-*/
-const SDK_IMPORT_FILTER = new RegExp(`^${SDK_PACKAGE.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`);
-/**
-* esbuild plugin that intercepts SDK imports and redirects them to the
-* `window.__sdk` proxy that `src/in-app/auto.ts` installs at runtime.
-*
-* Strategy: for every import of `@apps-in-toss/web-framework` (or sub-paths),
-* esbuild resolves it to a virtual module that re-exports all named exports
-* via `window.__sdk[name]`. This avoids bundling the real SDK (which may not
-* be available in the test environment) while still making named imports work.
-*
-* If `window.__sdk` is absent (non-dog-food build), every access throws a
-* descriptive error rather than returning `undefined` silently.
-*/
-function sdkRedirectPlugin() {
-	return {
-		name: "sdk-redirect",
-		setup(build) {
-			build.onResolve({ filter: SDK_IMPORT_FILTER }, (args) => ({
-				path: args.path,
-				namespace: "sdk-redirect"
-			}));
-			build.onLoad({
-				filter: /.*/,
-				namespace: "sdk-redirect"
-			}, () => ({
-				contents: `
-var __proxy = (typeof window !== 'undefined' && window.__sdk)
-  ? window.__sdk
-  : new Proxy({}, {
-      get: function(_t, p) {
-        throw new Error('window.__sdk is not installed — run in a dog-food build. Missing: ' + String(p));
-      }
-    });
-module.exports = __proxy;
-`,
-				loader: "js"
-			}));
-		}
-	};
-}
-/**
-* esbuild plugin that intercepts `import … from 'vitest'` and replaces it with
-* a virtual module that delegates every named import to `globalThis` at ACCESS
-* time (not at bundle-evaluation time).
-*
-* The runtime installs `describe/it/test/expect/beforeAll/afterAll/beforeEach/
-* afterEach/vi` as globals inside `runTestModule`, which runs AFTER the bundle
-* IIFE is evaluated. A value-copy redirect (`export var describe =
-* globalThis.describe`) would therefore capture `undefined` at evaluation time
-* and the user's `describe(...)` calls would be no-ops — registering zero tests.
-*
-* The fix defers the lookup to call time using per-name **getter** exports.
-* We emit a CommonJS module that:
-*   1. sets `__esModule = true` so esbuild's `__toESM` interop maps each named
-*      import directly to a property access on the module (NOT wrapped under a
-*      `default` shim — which is what happens for a bare Proxy whose own-keys
-*      are empty, leaving every named import `undefined`);
-*   2. defines each global name as a getter that reads `globalThis[name]` on
-*      every access. So `import { describe } from 'vitest'` compiles to
-*      `import_vitest.describe`, whose getter returns the real `describe` only
-*      when the factory calls it — after `runTestModule` installs the globals.
-*
-* A plain `module.exports = new Proxy(...)` does NOT work here: esbuild routes
-* the virtual module through `__toESM`, which enumerates own-keys (none on an
-* empty Proxy target) and therefore exposes zero named exports. Explicit getter
-* properties give `__toESM` real keys to map while keeping access lazy.
-*/
-function vitestRedirectPlugin() {
-	return {
-		name: "vitest-redirect",
-		setup(build) {
-			build.onResolve({ filter: /^vitest$/ }, () => ({
-				path: "vitest",
-				namespace: "vitest-redirect"
-			}));
-			build.onLoad({
-				filter: /^vitest$/,
-				namespace: "vitest-redirect"
-			}, () => {
-				return {
-					contents: `Object.defineProperty(exports, '__esModule', { value: true });\n${VITEST_GLOBAL_NAMES.map((name) => `Object.defineProperty(exports, ${JSON.stringify(name)}, { enumerable: true, get: function() { return globalThis[${JSON.stringify(name)}]; } });`).join("\n")}\n`,
-					loader: "js"
-				};
-			});
-		}
-	};
-}
-/**
-* esbuild plugin that transforms the user test file into a module that exports
-* an async `__userFactory` function. The factory defers the user's top-level
-* test registration code (describe/it/test calls) so it only runs when
-* `runTestModule(__userFactory)` explicitly invokes it — AFTER the runtime has
-* installed describe/it/test/expect as globals.
-*
-* Algorithm:
-*   - Import declarations and re-export statements are kept at module top-level
-*     (the only valid ESM position for static `import`). A statement that spans
-*     multiple lines — e.g. a named import with one member per line:
-*       import {
-*         appLogin,
-*         getAnonymousKey,
-*       } from '@apps-in-toss/web-framework';
-*     is tracked as a single block: every line from the opening `import {` /
-*     `export {` through the closing `from '…'` (or side-effect `'…'`) line is
-*     kept together at top-level. This prevents the member lines and the
-*     closing `} from '…'` line from leaking into the factory body, which would
-*     leave an unterminated `import {` at module scope (the #678 env3 failure:
-*     esbuild threw `Expected "as" but found "{"` on multi-line SDK imports).
-*   - All other lines (describe/it/test calls, local declarations, etc.) are
-*     moved into the body of the exported async factory function.
-*
-* This preserves SDK import resolution (the sdk-redirect plugin processes
-* top-level imports normally) while deferring test registration to the factory.
-*/
-function userFactoryPlugin(absPath) {
-	const NAMESPACE = "user-test-factory";
-	return {
-		name: "user-test-factory",
-		setup(build) {
-			build.onResolve({ filter: /^user-test-factory$/ }, () => ({
-				path: absPath,
-				namespace: NAMESPACE
-			}));
-			build.onLoad({
-				filter: /.*/,
-				namespace: NAMESPACE
-			}, async (args) => {
-				const lines = (await fs.readFile(args.path, "utf8")).split("\n");
-				const topLevelLines = [];
-				const bodyLines = [];
-				const EXPORT_DECLARATION_RE = /^(export\s+)(default\s+|async\s+function\s+|function\s+|class\s+|const\s+|let\s+|var\s+)/;
-				const isImportStart = (trimmed) => trimmed.startsWith("import ") || trimmed.startsWith("import{") || trimmed.startsWith("import'") || trimmed.startsWith("import\"");
-				const endsStatement = (trimmed) => /['"]\s*;?\s*$/.test(trimmed.replace(/\/\/.*$/, "").trimEnd());
-				let inImportBlock = false;
-				for (const line of lines) {
-					const trimmed = line.trimStart();
-					const indent = line.slice(0, line.length - trimmed.length);
-					if (inImportBlock) {
-						topLevelLines.push(line);
-						if (endsStatement(trimmed)) inImportBlock = false;
-						continue;
-					}
-					if (isImportStart(trimmed)) {
-						topLevelLines.push(line);
-						if (!endsStatement(trimmed)) inImportBlock = true;
-					} else if (trimmed.startsWith("export ")) if (trimmed.match(EXPORT_DECLARATION_RE)) bodyLines.push(indent + trimmed.slice(7));
-					else {
-						topLevelLines.push(line);
-						if (/\bfrom\b/.test(trimmed) ? !endsStatement(trimmed) : trimmed.endsWith("{")) inImportBlock = true;
-					}
-					else bodyLines.push(line);
-				}
-				return {
-					contents: [
-						...topLevelLines,
-						"",
-						"// biome-ignore lint: generated factory wrapper",
-						"export default async function __userFactory(): Promise<void> {",
-						...bodyLines.map((l) => `  ${l}`),
-						"}"
-					].join("\n"),
-					loader: "ts",
-					resolveDir: path.dirname(absPath)
-				};
-			});
-		}
-	};
-}
-/**
-* Returns the absolute path to the test-runner runtime module.
-*
-* Searches candidates in priority order:
-*   1. Co-located `runtime.ts` / `runtime.js` — covers the source tree
-*      (tsx / ts-node) and the `dist/test-runner/` entry.
-*   2. `../test-runner/runtime.js` — covers the `dist/mcp/cli.js` entry,
-*      where `import.meta.url` resolves to `dist/mcp/` (a sibling directory
-*      of `dist/test-runner/`). Without this second candidate the MCP entry
-*      point would look for `dist/mcp/runtime.js`, which does not exist, and
-*      every `run_tests` call would fail with an esbuild "Could not resolve"
-*      error (#678).
-*
-* Returns the first candidate that exists on disk. Falls back to the
-* co-located `runtime.js` path so esbuild produces a clear "file not found"
-* error rather than a cryptic failure.
-*/
-function getRuntimePath() {
-	const dir = path.dirname(fileURLToPath(import.meta.url));
-	const candidates = [
-		path.join(dir, "runtime.ts"),
-		path.join(dir, "runtime.js"),
-		path.join(dir, "..", "test-runner", "runtime.js")
-	];
-	for (const candidate of candidates) try {
-		accessSync(candidate);
-		return candidate;
-	} catch {}
-	return path.join(dir, "runtime.js");
-}
-/**
-* Bundles `absPath` into a single IIFE string suitable for `Runtime.evaluate`.
-*
-* The IIFE installs `window.__testBundle` (or the custom `globalName`) with:
-*   - `runTestModule` — the runtime entry (from `runtime.ts`).
-*   - `__userFactory` — an async function wrapping the user's test registration
-*     code so it runs AFTER `runTestModule` installs the globals.
-*
-* Callers (rpc.ts) invoke:
-*   `globalThis.__testBundle.runTestModule(globalThis.__testBundle.__userFactory)`
-*
-* @param absPath - Absolute path to the user test file.
-* @param opts    - Optional bundling overrides.
-*/
-async function bundleTestFile(absPath, opts) {
-	const globalName = opts?.globalName ?? "__testBundle";
-	const extraExternals = opts?.extraExternals ?? [];
-	const esbuild = await import("esbuild");
-	const runtimePath = getRuntimePath();
-	const wrapperContent = [
-		`import { runTestModule } from ${JSON.stringify(runtimePath)};`,
-		`import __userFactory from "user-test-factory";`,
-		`export { runTestModule, __userFactory };`
-	].join("\n");
-	const result = await esbuild.build({
-		stdin: {
-			contents: wrapperContent,
-			loader: "ts",
-			resolveDir: path.dirname(absPath)
-		},
-		bundle: true,
-		format: "iife",
-		globalName,
-		platform: "browser",
-		target: "es2022",
-		write: false,
-		plugins: [
-			userFactoryPlugin(absPath),
-			vitestRedirectPlugin(),
-			sdkRedirectPlugin()
-		],
-		external: extraExternals,
-		treeShaking: true,
-		footer: { js: `globalThis[${JSON.stringify(globalName)}] = ${globalName};` }
-	});
-	const warnings = result.warnings.map((w) => `${path.relative(process.cwd(), w.location?.file ?? "")}:${w.location?.line ?? "?"}: ${w.text}`);
-	const outputFile = result.outputFiles?.[0];
-	if (!outputFile) throw new Error("bundleTestFile: esbuild produced no output — check entryPoints");
-	return {
-		code: outputFile.text,
-		warnings
-	};
-}
-//#endregion
-//#region src/test-runner/rpc.ts
-/** Maximum milliseconds to wait for a single evaluate round-trip. */
-const DEFAULT_TIMEOUT_MS = 3e4;
-/**
-* Wraps bundle code in a self-executing IIFE that:
-*   1. Evaluates the bundle (registering describe/it/test).
-*   2. Calls `__testBundle.runTestModule(...)` — the entry the runtime exports.
-*   3. Returns a JSON-serialised `RunReport` string.
-*
-* The double-serialisation (RunReport → JSON string → returnByValue string)
-* is intentional: CDP `returnByValue` reliably transports strings; deeply
-* nested objects can lose fidelity across the Chii relay.
-*
-* SECRET-HANDLING: `bundleCode` MUST NOT be logged by callers.
-*/
-function buildRunTestsExpression(bundleCode) {
-	return `(async () => {  try { ${bundleCode} } catch(e) {    return JSON.stringify({ok:false,error:'bundle-eval: ' + String(e && e.message || e)});  }  if (typeof globalThis.__testBundle !== 'object' || typeof globalThis.__testBundle.runTestModule !== 'function' || typeof globalThis.__testBundle.__userFactory !== 'function') {    return JSON.stringify({ok:false,error:'bundle-missing-export: __testBundle.runTestModule or __userFactory is not a function'});  }  try {    const report = await globalThis.__testBundle.runTestModule(globalThis.__testBundle.__userFactory);    return JSON.stringify({ok:true,value:report});  } catch(e) {    return JSON.stringify({ok:false,error:'test-run: ' + String(e && e.message || e)});  }})()`;
-}
-/**
-* Parses the raw CDP `returnByValue` result from a `buildRunTestsExpression`
-* evaluate call into a typed `RpcRunResult`.
-*
-* Throws only on parse failure — an `ok:false` envelope is a normal result.
-*
-* SECRET-HANDLING: `rawValue` is not included in error messages.
-*/
-function parseRunTestsResult(rawValue) {
-	if (typeof rawValue !== "string") throw new Error(`rpc.parseRunTestsResult: unexpected return type "${typeof rawValue}" — expected JSON string`);
-	let parsed;
-	try {
-		parsed = JSON.parse(rawValue);
-	} catch {
-		throw new Error("rpc.parseRunTestsResult: bridge returned non-JSON string");
-	}
-	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("rpc.parseRunTestsResult: parsed result is not an object");
-	const obj = parsed;
-	if (obj.ok === true) return {
-		ok: true,
-		report: obj.value
-	};
-	if (obj.ok === false) return {
-		ok: false,
-		error: typeof obj.error === "string" ? obj.error : String(obj.error)
-	};
-	throw new Error("rpc.parseRunTestsResult: result missing \"ok\" field");
-}
-/**
-* Injects `bundleCode` into the attached page and awaits test execution.
-*
-* Uses `Runtime.evaluate` with `awaitPromise: true` to wait for the
-* async IIFE to settle.  The 30-second CDP command timeout covers even
-* long-running test suites; split into smaller files if you hit it.
-*
-* @param connection   - Active CDP connection (relay or local).
-* @param bundleCode   - IIFE bundle string from `bundleTestFile`.
-* @param timeoutMs    - Override the default 30 s timeout.
-*
-* SECRET-HANDLING: `bundleCode` and the raw CDP result value are never logged.
-*/
-async function injectAndRunBundle(connection, bundleCode, timeoutMs = DEFAULT_TIMEOUT_MS) {
-	const expression = buildRunTestsExpression(bundleCode);
-	const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(/* @__PURE__ */ new Error(`rpc: evaluate timed out after ${timeoutMs}ms`)), timeoutMs));
-	const evalPromise = connection.send("Runtime.evaluate", {
-		expression,
-		returnByValue: true,
-		awaitPromise: true
-	});
-	const cdpResult = await Promise.race([evalPromise, timeoutPromise]);
-	if (cdpResult.exceptionDetails) {
-		const msg = cdpResult.exceptionDetails.exception?.description ?? cdpResult.exceptionDetails.text ?? "Runtime.evaluate threw an exception";
-		throw new Error(`rpc.injectAndRunBundle: ${msg}`);
-	}
-	return parseRunTestsResult(cdpResult.result.value);
-}
-//#endregion
-//#region src/test-runner/relay-worker.ts
-/**
-* Runs all `files` sequentially over the given CDP `connection`.
-*
-* For each file:
-*   1. Bundle with esbuild (includes SDK shim + runtime).
-*   2. Inject into the attached page via `Runtime.evaluate`.
-*   3. Await the `RunReport` JSON response.
-*   4. Accumulate results.
-*
-* Returns a `RelayRunReport` with per-file results and flattened totals.
-*
-* This function does NOT open or manage the relay connection — the caller
-* is responsible for attaching and closing it.
-*
-* TODO (#645): implement the Vitest `PoolRunnerInitializer` interface here
-* so that `runTestFilesOverRelay` can be used as a Vitest pool entry.
-*
-* @param connection - Active CDP connection (relay or local kind).
-* @param files      - Absolute paths to test files, run in order.
-* @param opts       - Optional per-run overrides.
-*/
-async function runTestFilesOverRelay(connection, files, opts) {
-	const wallStart = Date.now();
-	const startedAt = new Date(wallStart).toISOString();
-	const fileResults = [];
-	for (const file of files) {
-		let fileEntry;
-		try {
-			const { code } = await bundleTestFile(file, opts?.bundleOptions);
-			const rpcResult = await injectAndRunBundle(connection, code, opts?.timeoutMs);
-			if (rpcResult.ok) fileEntry = {
-				file,
-				result: rpcResult.report
-			};
-			else fileEntry = {
-				file,
-				result: { error: rpcResult.error }
-			};
-		} catch (e) {
-			fileEntry = {
-				file,
-				result: { error: e instanceof Error ? e.message : String(e) }
-			};
-		}
-		fileResults.push(fileEntry);
-	}
-	const totals = fileResults.reduce((acc, { result }) => {
-		if ("error" in result) {
-			acc.failed += 1;
-			acc.total += 1;
-		} else {
-			acc.passed += result.passed;
-			acc.failed += result.failed;
-			acc.skipped += result.skipped;
-			acc.total += result.passed + result.failed + result.skipped;
-		}
-		return acc;
-	}, {
-		passed: 0,
-		failed: 0,
-		skipped: 0,
-		total: 0
-	});
-	return {
-		startedAt,
-		duration: Date.now() - wallStart,
-		files: fileResults,
-		totals
-	};
-}
-//#endregion
-//#region src/test-runner/cli.ts
 /**
-* `devtools-test` CLI.
+* Builds a self-contained IIFE DOM expression that renders a dismissible
+* "Debugger Connected" badge on the bottom-left of the phone screen.
 *
-* Shares test-file discovery with the `run_tests` MCP tool (`discoverTestFiles`)
-* and exposes `runWithConnection` — the pure run core that bundles, injects, and
-* collects each file over a CDP connection. The CLI's `main()` performs a
-* standalone relay attach (boot relay → QR → phone scan → cell inject → run).
+* **Pure function** — returns a JS expression string; does NOT inject it.
+* Injection is performed by {@link injectDebugIndicator} in `cell.ts`.
 *
-* NOTE: no shebang in this source file — the tsdown entry's `banner` option
-* injects `#!/usr/bin/env node` into the compiled output (same pattern as
-* `src/mcp/cli.ts`).
-*/
-const USAGE = `
-devtools-test — run mini-app tests on a real device WebView over the CDP relay
-
-USAGE
-  devtools-test <glob> [<glob> ...] [options]
-
-OPTIONS
-  --scheme-url <url>      intoss-private:// URL from \`ait deploy --scheme-only\`
-                          (required for standalone relay attach / env3)
-  --timeout <ms>          Per-file evaluate timeout in ms (default: 30000)
-  --cell-sdk-line <line>  SDK line to inject as __AIT_CELL__.sdkLine (2.x|3.x)
-  --cell-platform <plat>  Platform to inject as __AIT_CELL__.platform
-                          (mock|ios|android, default: AIT_CELL_PLATFORM env)
-  --headless              Disable browser auto-open (text QR only)
-  --project-root <dir>    Project root for .ait_relay secret lookup
-                          (default: current working directory)
-  --help, -h              Show this help message
-
-DESCRIPTION
-  Boots a Chii relay + cloudflared tunnel, renders a QR code, waits for a real
-  device to scan and attach, injects the cell globals (__AIT_CELL__), bundles
-  each matched test file with esbuild (SDK imports redirected to window.__sdk),
-  injects the bundle into the attached WebView via Runtime.evaluate, and prints
-  a summary.
-
-  The test files run against the live relay connection started by this process;
-  no separate MCP daemon is required.
-
-EXAMPLE
-  devtools-test 'src/**/*.ait.test.ts' \\
-    --scheme-url "intoss-private://..." \\
-    --cell-platform ios \\
-    --timeout 60000
-
-`.trimStart();
-/**
-* Runs `files` over `connection` and returns the aggregate report.
-* This pure function is the testable core of the CLI (and is what the
-* `run_tests` MCP tool calls against the daemon's attached connection); it is
-* separate from `main()` so tests can call it without spawning a subprocess.
-*/
-async function runWithConnection(connection, files, opts) {
-	const report = await runTestFilesOverRelay(connection, files, opts);
-	if (opts?.printSummary) {
-		const { totals } = report;
-		process.stdout.write(`\ndevtools-test: ${totals.passed} passed, ${totals.failed} failed, ${totals.skipped} skipped (${report.duration}ms)\n`);
-	}
-	return report;
-}
-/**
-* CLI entry point.
+* The expression, when evaluated on the page, does the following:
+*   1. Early-returns if `#__ait_debug_indicator` already exists (idempotent —
+*      prevents duplicate badges on re-injection after page reload).
+*   2. Appends a fixed-position `<div id="__ait_debug_indicator">` at the
+*      bottom-left, accounting for safe-area insets.
+*   3. Attaches a `{ once: true }` `pointerdown` listener that removes the
+*      badge on first touch — one-tap dismiss.
 *
-* Performs a standalone relay attach → run lifecycle:
+* The expression intentionally contains NO relay URLs, wss addresses, TOTP
+* codes, or any other secrets. It is pure DOM UI text only.
 *
-* 1. Parse args: globs, --timeout, --cell-sdk-line, --cell-platform,
-*    --scheme-url (required for env3), --headless, --project-root.
-* 2. Discover test files; exit 1 if none.
-* 3. Load .ait_relay secret into AIT_DEBUG_TOTP_SECRET, then boot relay family.
-* 4. Assemble AttachDeps (no qrHttpServer → text QR).
-* 5. prepareAttach(deps, 'relay-dev', { scheme_url }, conn).
-* 6. renderAndMaybeWait(deps, prep, true, timeoutMs, conn) — text QR + wait.
-* 7. If cell flags present, injectGlobals({ __AIT_CELL__: cell }) before run.
-* 8. runWithConnection(conn, files, { timeoutMs, printSummary: true }).
-* 9. family.stop(); process.exitCode = failed > 0 ? 1 : 0.
+* SECRET-HANDLING: this expression contains no secrets, relay URLs, wss
+* addresses, or TOTP codes whatsoever — DOM label text only.
 *
-* The CLI is not a daemon — no lock, router, SSE, or tools_list is needed.
-* Attach timeout exits with code 1; test failures exit with code 1.
-*
-* SECRET-HANDLING: scheme_url / relay wssUrl / TOTP codes are never written to
-* stdout/stderr directly. text QR renders via renderAndMaybeWait which encodes
-* the TOTP `at=` code inside the QR payload (not in plain log lines).
+* @param opts.label - Badge text (default: `'Debugger Connected'`).
+* @returns A JS expression string suitable for `Runtime.evaluate`.
 */
-async function main(argv = process.argv.slice(2)) {
-	let parsed;
-	try {
-		parsed = parseArgs({
-			args: argv,
-			options: {
-				help: {
-					type: "boolean",
-					short: "h"
-				},
-				timeout: { type: "string" },
-				"scheme-url": { type: "string" },
-				"cell-sdk-line": { type: "string" },
-				"cell-platform": { type: "string" },
-				headless: { type: "boolean" },
-				"project-root": { type: "string" }
-			},
-			allowPositionals: true
-		});
-	} catch (e) {
-		process.stderr.write(`devtools-test: ${e instanceof Error ? e.message : String(e)}\n`);
-		process.exitCode = 1;
-		return;
-	}
-	if (parsed.values.help || argv.length === 0) {
-		process.stdout.write(USAGE);
-		return;
-	}
-	const vals = parsed.values;
-	const rawTimeout = typeof vals.timeout === "string" ? vals.timeout : void 0;
-	const timeoutMs = rawTimeout !== void 0 ? parseInt(rawTimeout, 10) : 3e4;
-	if (Number.isNaN(timeoutMs) || timeoutMs <= 0) {
-		process.stderr.write(`devtools-test: --timeout must be a positive integer\n`);
-		process.exitCode = 1;
-		return;
-	}
-	const schemeUrl = typeof vals["scheme-url"] === "string" ? vals["scheme-url"] : "";
-	if (schemeUrl === "") {
-		process.stderr.write("devtools-test: --scheme-url is required for standalone relay attach.\n  Pass the intoss-private:// URL from `ait deploy --scheme-only`.\n");
-		process.exitCode = 1;
-		return;
-	}
-	const headless = vals.headless === true;
-	const projectRoot = typeof vals["project-root"] === "string" ? vals["project-root"] : process.cwd();
-	const cellSdkLine = typeof vals["cell-sdk-line"] === "string" ? vals["cell-sdk-line"] : void 0;
-	const cellPlatform = typeof vals["cell-platform"] === "string" ? vals["cell-platform"] : process.env.AIT_CELL_PLATFORM;
-	const hasCell = cellSdkLine !== void 0 || cellPlatform !== void 0;
-	const globs = parsed.positionals;
-	if (globs.length === 0) {
-		process.stderr.write(`devtools-test: at least one glob pattern is required\n`);
-		process.stdout.write(USAGE);
-		process.exitCode = 1;
-		return;
-	}
-	const files = await discoverTestFiles(globs, process.cwd());
-	if (files.length === 0) {
-		process.stderr.write(`devtools-test: no test files matched ${globs.join(", ")}\n`);
-		process.exitCode = 1;
-		return;
-	}
-	process.stderr.write(`devtools-test: found ${files.length} test file(s)\n`);
-	const { loadRelaySecretReadOnly } = await import("./relay-secret-store-CmqchhR5.js");
-	await loadRelaySecretReadOnly({ projectRoot });
-	const { bootRelayFamily, buildRelayVerifyAuth } = await import("./debug-server-DcAKrbnq.js");
-	let family;
-	try {
-		family = await bootRelayFamily({ verifyAuth: buildRelayVerifyAuth() });
-	} catch (e) {
-		process.stderr.write(`devtools-test: failed to boot relay: ${e instanceof Error ? e.message : String(e)}\n`);
-		process.exitCode = 1;
-		return;
-	}
-	let exitCode = 0;
-	try {
-		const attachDeps = {
-			getTunnelStatus: family.getTunnelStatus ?? (() => ({
-				up: false,
-				wssUrl: null
-			})),
-			getTotpSecret: () => process.env.AIT_DEBUG_TOTP_SECRET,
-			qrHttpServer: void 0,
-			onAttachUrlBuilt: void 0,
-			canOpenBrowser: () => !headless
-		};
-		const prep = await prepareAttach(attachDeps, "relay-dev", { scheme_url: schemeUrl }, family.connection);
-		if (!prep.ok) {
-			const errText = prep.error.content.filter((c) => c.type === "text").map((c) => c.text).join("\n");
-			process.stderr.write(`devtools-test: attach preparation failed:\n${errText}\n`);
-			exitCode = 1;
-			return;
-		}
-		const waitResult = await renderAndMaybeWait(attachDeps, prep, true, timeoutMs, family.connection);
-		if (waitResult.isError) {
-			const errText = waitResult.content.filter((c) => c.type === "text").map((c) => c.text).join("\n");
-			process.stderr.write(`devtools-test: attach timed out or failed:\n${errText}\n`);
-			exitCode = 1;
-			return;
-		}
-		for (const chunk of waitResult.content) if (chunk.type === "text") process.stdout.write(`${chunk.text}\n`);
-		if (hasCell) {
-			const cell = {};
-			if (cellSdkLine !== void 0) cell.sdkLine = cellSdkLine;
-			if (cellPlatform !== void 0) cell.platform = cellPlatform;
-			process.stderr.write(`devtools-test: injecting __AIT_CELL__ = ${JSON.stringify(cell)}\n`);
-			await injectGlobals(family.connection, { __AIT_CELL__: cell });
-		}
-		exitCode = (await runWithConnection(family.connection, files, {
-			timeoutMs,
-			printSummary: true
-		})).totals.failed > 0 ? 1 : 0;
-	} finally {
-		family.stop();
-		process.exitCode = exitCode;
-	}
+function buildIndicatorExpression(opts) {
+	const label = opts?.label ?? "Debugger Connected";
+	return `(() => {if (document.getElementById('__ait_debug_indicator')) return;const el = document.createElement('div');el.id = '__ait_debug_indicator';el.style.cssText = ['position:fixed','left:max(12px,calc(env(safe-area-inset-left,0px) + 8px))','bottom:max(12px,calc(env(safe-area-inset-bottom,0px) + 8px))','z-index:2147483647','background:#e5484d','color:#fff','font:bold 11px/1 system-ui,sans-serif','padding:5px 9px','border-radius:6px','pointer-events:auto','user-select:none',].join(';');el.textContent = ${JSON.stringify(label)};el.addEventListener('pointerdown', () => el.remove(), { once: true });document.body.appendChild(el);})()`;
 }
-if (import.meta.url === new URL(process.argv[1], "file://").href) main().catch((e) => {
-	process.stderr.write(`devtools-test: unexpected error: ${e instanceof Error ? e.message : String(e)}\n`);
-	process.exitCode = 1;
-});
 //#endregion
-export { START_ATTACH_SEGMENT_MS as a, generateAttachToken as c, startQuickTunnel as d, startTunnelHealthProbe as f, START_ATTACH_REMINT_THRESHOLD_MS as i, makeTunnelStatus as l, logInfo as m, runWithConnection as n, extractDeploymentId as o, logError as p, RELAY_SANDBOX_STALE_PAGE_MS as r, isSandboxPageFresh as s, main as t, printAttachBanner as u };
+export { RELAY_SANDBOX_STALE_PAGE_MS, START_ATTACH_REMINT_THRESHOLD_MS, START_ATTACH_SEGMENT_MS, startTunnelHealthProbe as a, buildIndicatorExpression, extractDeploymentId, startQuickTunnel as i, isSandboxPageFresh, makeTunnelStatus as n, logError as o, prepareAttach, printAttachBanner as r, renderAndMaybeWait, logInfo as s, generateAttachToken as t };
 
-//# sourceMappingURL=cli-BLBo0lkP.js.map
+//# sourceMappingURL=attach-orchestrator-qFEMBUwb.js.map