@cat-factory/cli 0.10.3 → 0.10.5

package/dist/bin.js

@@ -4,6 +4,10 @@ import { fileURLToPath } from 'node:url';
 import { ArgError, HELP_TEXT, parseArgs } from './args.js';
 import { bootstrap } from './bootstrap.js';
 import { generateEnv } from './envCommand.js';
+// Kernel's describer, COPIED into this package rather than imported: `@cat-factory/kernel` is a
+// devDependency here and this file is the published `bin`, so a runtime import would resolve
+// through pnpm's workspace link locally and fail with ERR_MODULE_NOT_FOUND off the registry.
+import { getErrorMessage } from './errorText.js';
 import { setupK3s } from './k3s.js';
 import { supervise } from './superviseCommand.js';
 function readVersion() {
@@ -51,7 +55,9 @@ async function main() {
     await bootstrap(options);
 }
 main().catch((err) => {
-    process.stderr.write(`\ncat-factory: ${err instanceof Error ? err.message : String(err)}\n`);
+    // An error that describes itself as nothing (an empty message with no cause) says so as an
+    // empty string, so the fallback is what stops the last line of a failed run being a bare prefix.
+    process.stderr.write(`\ncat-factory: ${getErrorMessage(err) || 'failed for an unreported reason'}\n`);
     process.exit(1);
 });
 //# sourceMappingURL=bin.js.map

package/dist/bin.js.map

@@ -1 +1 @@
-{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAEjD,SAAS,WAAW;IAClB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,iBAAiB,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAA;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAyB,CAAA;QAC3F,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAA;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAA;IAChB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,OAAO,CAAA;IACX,IAAI,CAAC;QACH,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,OAAO,SAAS,EAAE,CAAC,CAAA;YACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC/B,OAAM;IACR,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,EAAE,IAAI,CAAC,CAAA;QAC1C,OAAM;IACR,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC9B,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;QAC1B,OAAM;IACR,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC9B,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;QACvB,OAAM;IACR,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;QACpC,MAAM,SAAS,CAAC,OAAO,CAAC,CAAA;QACxB,OAAM;IACR,CAAC;IAED,MAAM,SAAS,CAAC,OAAO,CAAC,CAAA;AAC1B,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC7C,gGAAgG;AAChG,6FAA6F;AAC7F,6FAA6F;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAEjD,SAAS,WAAW;IAClB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,iBAAiB,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAA;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAyB,CAAA;QAC3F,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAA;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAA;IAChB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,OAAO,CAAA;IACX,IAAI,CAAC;QACH,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,OAAO,SAAS,EAAE,CAAC,CAAA;YACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC/B,OAAM;IACR,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,EAAE,IAAI,CAAC,CAAA;QAC1C,OAAM;IACR,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC9B,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;QAC1B,OAAM;IACR,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC9B,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;QACvB,OAAM;IACR,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;QACpC,MAAM,SAAS,CAAC,OAAO,CAAC,CAAA;QACxB,OAAM;IACR,CAAC;IAED,MAAM,SAAS,CAAC,OAAO,CAAC,CAAA;AAC1B,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,2FAA2F;IAC3F,iGAAiG;IACjG,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kBAAkB,eAAe,CAAC,GAAG,CAAC,IAAI,iCAAiC,IAAI,CAChF,CAAA;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}

package/dist/errorText.d.ts

@@ -0,0 +1,6 @@
+/**
+ * A thrown value as ONE line: its own message, then each cause beneath it, scrubbed and capped.
+ * Byte-for-byte kernel's `getErrorMessage` — see the header, and the conformity test beside it.
+ */
+export declare function getErrorMessage(error: unknown): string;
+//# sourceMappingURL=errorText.d.ts.map

package/dist/errorText.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorText.d.ts","sourceRoot":"","sources":["../src/errorText.ts"],"names":[],"mappings":"AA4KA;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQtD"}

package/dist/errorText.js

@@ -0,0 +1,175 @@
+// How the CLI turns a THROWN VALUE into the one line it writes to stderr before exiting.
+//
+// This is a deliberate COPY of `getErrorMessage` in `@cat-factory/kernel`
+// (`src/shared/error-chain.logic.ts` over `src/shared/redact-secrets.logic.ts`), for the same
+// reason the executor-harness copies `hostMarkdown`: this package is PUBLISHED and stays runtime
+// dependency-free (its only `dependencies` entry is `@clack/prompts`), so a `workspace:*` package
+// it imports at runtime would resolve locally through pnpm's link and be missing the moment
+// someone runs `npx cat-factory` off the registry. `errorText.conformity.test.ts` pins the two to
+// byte-identical output over a shared corpus, so the copy cannot drift: change one, change the
+// other. Kernel stays a devDependency, which is what lets that test import it.
+//
+// Why the CLI wants the chain at all: on Node a transport failure IS a bare `TypeError: fetch
+// failed`, and what actually happened (`connect ECONNREFUSED`, `self-signed certificate`,
+// `getaddrinfo ENOTFOUND`) hangs off `.cause`. `cat-factory` bootstraps against GitHub, a Docker
+// daemon and a k3s cluster, so "fetch failed" as the last thing a failed bootstrap prints is the
+// least useful sentence available.
+const REPLACEMENT = '[REDACTED]';
+const PEM_PRIVATE_KEY_BEGIN = /-----BEGIN[ A-Z0-9]*PRIVATE KEY[ A-Z0-9]*-----/g;
+const PEM_PRIVATE_KEY_END = /-----END[ A-Z0-9]*PRIVATE KEY[ A-Z0-9]*-----/g;
+/** Drop PEM-armored private keys pasted verbatim, block and all (kernel's `redactPrivateKeyBlocks`). */
+function redactPrivateKeyBlocks(value) {
+    PEM_PRIVATE_KEY_BEGIN.lastIndex = 0;
+    let begin = PEM_PRIVATE_KEY_BEGIN.exec(value);
+    if (begin === null)
+        return value;
+    let out = '';
+    let copiedTo = 0;
+    while (begin !== null) {
+        PEM_PRIVATE_KEY_END.lastIndex = begin.index + begin[0].length;
+        const end = PEM_PRIVATE_KEY_END.exec(value);
+        if (end === null)
+            break;
+        out += value.slice(copiedTo, begin.index) + REPLACEMENT;
+        copiedTo = end.index + end[0].length;
+        PEM_PRIVATE_KEY_BEGIN.lastIndex = copiedTo;
+        begin = PEM_PRIVATE_KEY_BEGIN.exec(value);
+    }
+    return copiedTo === 0 ? value : out + value.slice(copiedTo);
+}
+const ENV_VAR_NAME = /^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/;
+const PROSE_WORD = /^(?:[a-z]+|[A-Z]+|[A-Z][a-z]+)$/;
+const MIN_ALPHABETIC_SECRET_CHARS = 16;
+/** Whether a field-name rule's captured value is a credential rather than the next word of a sentence. */
+function looksLikeSecretValue(value) {
+    if (ENV_VAR_NAME.test(value))
+        return false;
+    return !(value.length < MIN_ALPHABETIC_SECRET_CHARS && PROSE_WORD.test(value));
+}
+const RULES = [
+    {
+        pattern: /\b(bearer|basic|token)\s+([A-Za-z0-9._+/=~-]{8,})/gi,
+        replace: (m) => (looksLikeSecretValue(m[2] ?? '') ? `${m[1]} ${REPLACEMENT}` : (m[0] ?? '')),
+    },
+    {
+        pattern: /\b(authorization|x-api-key|x-auth-token|proxy-authorization)(["']?\s*[:=]\s*["']?)([^\s"',}]+)/gi,
+        replace: (m) => `${m[1]}${m[2]}${REPLACEMENT}`,
+    },
+    {
+        pattern: /(?<=[a-z][a-z0-9+.-]{0,39}:\/\/)([^/\s:@]+):([^/\s@]+)@/gi,
+        replace: (m) => `${m[1]}:${REPLACEMENT}@`,
+    },
+    {
+        pattern: /\b((?:access[_-]?)?(?:api[_-]?)?(?:client[_-]?)?(?:token|secret|password|passwd|pwd|sig|signature|key|apikey|auth))(["']?\s*[:=]\s*["']?)([^\s"',&}@/]{4,})/gi,
+        replace: (m) => looksLikeSecretValue(m[3] ?? '') ? `${m[1]}${m[2]}${REPLACEMENT}` : (m[0] ?? ''),
+    },
+    { pattern: /\b(sk|rk|pk)-[A-Za-z0-9_-]{16,}/g, replace: () => REPLACEMENT },
+    { pattern: /\bgh[pousr]_[A-Za-z0-9]{20,}/g, replace: () => REPLACEMENT },
+    { pattern: /\bgithub_pat_[A-Za-z0-9_]{20,}/g, replace: () => REPLACEMENT },
+    { pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}/g, replace: () => REPLACEMENT },
+    { pattern: /\bAKIA[0-9A-Z]{16}\b/g, replace: () => REPLACEMENT },
+    {
+        pattern: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+        replace: () => REPLACEMENT,
+    },
+];
+/** Best-effort scrub of credentials from a string (kernel's `redactSecrets`, non-null input only). */
+function redactSecrets(value) {
+    let out = redactPrivateKeyBlocks(value);
+    for (const rule of RULES) {
+        out = out.replace(rule.pattern, (...args) => {
+            const groups = args.slice(0, -2);
+            return rule.replace(groups);
+        });
+    }
+    return out;
+}
+const MAX_ERROR_CHAIN_CHARS = 400;
+const MAX_CHAIN_DEPTH = 6;
+const MAX_AGGREGATE_BRANCHES = 8;
+const TRANSPORT_CODE = /^[A-Z][A-Z0-9_]*$/;
+function readProperty(value, key) {
+    if (value === null || (typeof value !== 'object' && typeof value !== 'function'))
+        return undefined;
+    try {
+        return value[key];
+    }
+    catch {
+        return undefined;
+    }
+}
+function safeText(value) {
+    try {
+        return String(value);
+    }
+    catch {
+        return '';
+    }
+}
+function errorCode(error) {
+    const code = readProperty(error, 'code');
+    return typeof code === 'string' && code ? code : undefined;
+}
+function aggregated(error) {
+    const errors = readProperty(error, 'errors');
+    return Array.isArray(errors) ? errors : [];
+}
+function flattenErrorChain(error, depth = 0, out = [], seen = new Set()) {
+    if (error === null || error === undefined || depth > MAX_CHAIN_DEPTH)
+        return out;
+    if (typeof error === 'object') {
+        if (seen.has(error))
+            return out;
+        seen.add(error);
+    }
+    out.push(error);
+    const branches = aggregated(error);
+    for (const branch of branches.slice(0, MAX_AGGREGATE_BRANCHES))
+        flattenErrorChain(branch, depth + 1, out, seen);
+    if (branches.length > MAX_AGGREGATE_BRANCHES)
+        out.push(`[…${branches.length - MAX_AGGREGATE_BRANCHES} more branches not read]`);
+    flattenErrorChain(readProperty(error, 'cause'), depth + 1, out, seen);
+    return out;
+}
+function describeErrorLink(link) {
+    const message = link instanceof Error ? readProperty(link, 'message') : link;
+    const code = errorCode(link);
+    const text = safeText(message ?? '').trim();
+    if (!code || !TRANSPORT_CODE.test(code))
+        return text || code || '';
+    if (!text)
+        return code;
+    return text.includes(code) ? text : `${text} (${code})`;
+}
+function renderErrorChainLinks(links) {
+    const counts = new Map();
+    for (const link of links) {
+        const text = describeErrorLink(link);
+        if (!text)
+            continue;
+        counts.set(text, (counts.get(text) ?? 0) + 1);
+    }
+    return [...counts].map(([text, count]) => (count > 1 ? `${text} (x${count})` : text));
+}
+function joinErrorChain(parts) {
+    const text = redactSecrets(parts.join(': '));
+    if (text.length <= MAX_ERROR_CHAIN_CHARS)
+        return text;
+    const dropped = text.length - MAX_ERROR_CHAIN_CHARS;
+    return `${text.slice(0, MAX_ERROR_CHAIN_CHARS)} […${dropped} more characters of the cause chain]`;
+}
+/**
+ * A thrown value as ONE line: its own message, then each cause beneath it, scrubbed and capped.
+ * Byte-for-byte kernel's `getErrorMessage` — see the header, and the conformity test beside it.
+ */
+export function getErrorMessage(error) {
+    const parts = renderErrorChainLinks(flattenErrorChain(error));
+    if (parts.length > 0)
+        return joinErrorChain(parts);
+    if (error instanceof Error) {
+        const name = readProperty(error, 'name');
+        return typeof name === 'string' && name && name !== Error.name ? joinErrorChain([name]) : '';
+    }
+    return joinErrorChain([safeText(error)]);
+}
+//# sourceMappingURL=errorText.js.map

package/dist/errorText.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorText.js","sourceRoot":"","sources":["../src/errorText.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,EAAE;AACF,0EAA0E;AAC1E,8FAA8F;AAC9F,iGAAiG;AACjG,kGAAkG;AAClG,4FAA4F;AAC5F,kGAAkG;AAClG,+FAA+F;AAC/F,+EAA+E;AAC/E,EAAE;AACF,8FAA8F;AAC9F,0FAA0F;AAC1F,iGAAiG;AACjG,iGAAiG;AACjG,mCAAmC;AAEnC,MAAM,WAAW,GAAG,YAAY,CAAA;AAChC,MAAM,qBAAqB,GAAG,iDAAiD,CAAA;AAC/E,MAAM,mBAAmB,GAAG,+CAA+C,CAAA;AAE3E,wGAAwG;AACxG,SAAS,sBAAsB,CAAC,KAAa;IAC3C,qBAAqB,CAAC,SAAS,GAAG,CAAC,CAAA;IACnC,IAAI,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC7C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAChC,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,OAAO,KAAK,KAAK,IAAI,EAAE,CAAC;QACtB,mBAAmB,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QAC7D,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3C,IAAI,GAAG,KAAK,IAAI;YAAE,MAAK;QACvB,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,WAAW,CAAA;QACvD,QAAQ,GAAG,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QACpC,qBAAqB,CAAC,SAAS,GAAG,QAAQ,CAAA;QAC1C,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;AAC7D,CAAC;AAED,MAAM,YAAY,GAAG,iCAAiC,CAAA;AACtD,MAAM,UAAU,GAAG,iCAAiC,CAAA;AACpD,MAAM,2BAA2B,GAAG,EAAE,CAAA;AAEtC,0GAA0G;AAC1G,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1C,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,2BAA2B,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;AAChF,CAAC;AAED,MAAM,KAAK,GAAoE;IAC7E;QACE,OAAO,EAAE,qDAAqD;QAC9D,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;KAC7F;IACD;QACE,OAAO,EACL,kGAAkG;QACpG,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,EAAE;KAC/C;IACD;QACE,OAAO,EAAE,2DAA2D;QACpE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,GAAG;KAC1C;IACD;QACE,OAAO,EACL,+JAA+J;QACjK,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CACb,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KACnF;IACD,EAAE,OAAO,EAAE,kCAAkC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3E,EAAE,OAAO,EAAE,+BAA+B,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;IACxE,EAAE,OAAO,EAAE,iCAAiC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1E,EAAE,OAAO,EAAE,iCAAiC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1E,EAAE,OAAO,EAAE,uBAAuB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;IAChE;QACE,OAAO,EAAE,sDAAsD;QAC/D,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW;KAC3B;CACF,CAAA;AAED,sGAAsG;AACtG,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,GAAG,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAA;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAa,CAAA;YAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAqC,CAAC,CAAA;QAC5D,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,qBAAqB,GAAG,GAAG,CAAA;AACjC,MAAM,eAAe,GAAG,CAAC,CAAA;AACzB,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAChC,MAAM,cAAc,GAAG,mBAAmB,CAAA;AAE1C,SAAS,YAAY,CAAC,KAAc,EAAE,GAAW;IAC/C,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,UAAU,CAAC;QAAE,OAAO,SAAS,CAAA;IAClG,IAAI,CAAC;QACH,OAAQ,KAAiC,CAAC,GAAG,CAAC,CAAA;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACxC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5D,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;AAC5C,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAc,EACd,KAAK,GAAG,CAAC,EACT,GAAG,GAAc,EAAE,EACnB,IAAI,GAAiB,IAAI,GAAG,EAAE;IAE9B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,eAAe;QAAE,OAAO,GAAG,CAAA;IAChF,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,GAAG,CAAA;QAC/B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACjB,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACf,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;IAClC,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC;QAC5D,iBAAiB,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IACjD,IAAI,QAAQ,CAAC,MAAM,GAAG,sBAAsB;QAC1C,GAAG,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,sBAAsB,0BAA0B,CAAC,CAAA;IACnF,iBAAiB,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IACrE,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAa;IACtC,MAAM,OAAO,GAAG,IAAI,YAAY,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5E,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAC3C,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,IAAI,IAAI,IAAI,EAAE,CAAA;IAClE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,GAAG,CAAA;AACzD,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAyB;IACtD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;AACvF,CAAC;AAED,SAAS,cAAc,CAAC,KAAwB;IAC9C,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAC5C,IAAI,IAAI,CAAC,MAAM,IAAI,qBAAqB;QAAE,OAAO,IAAI,CAAA;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,qBAAqB,CAAA;IACnD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,MAAM,OAAO,sCAAsC,CAAA;AACnG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,MAAM,KAAK,GAAG,qBAAqB,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAA;IAC7D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,cAAc,CAAC,KAAK,CAAC,CAAA;IAClD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACxC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9F,CAAC;IACD,OAAO,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC1C,CAAC"}

package/dist/io.d.ts

@@ -20,6 +20,41 @@ export interface Io {
     /** Open a URL in the user's default browser (best-effort; resolves even if it can't). */
     openBrowser(url: string): Promise<void>;
 }
+/** How to spawn the OS's URL opener: the command, its argv, and Windows' verbatim-argv flag. */
+export interface OpenBrowserCommand {
+    cmd: string;
+    args: string[];
+    /**
+     * Windows only: hand the joined argv to `CreateProcess` unchanged instead of re-quoting each
+     * argument for `CommandLineToArgvW`, whose rules `cmd` does not follow.
+     */
+    windowsVerbatimArguments?: boolean;
+}
+/**
+ * The OS-appropriate command for opening a URL in the default browser.
+ *
+ * Windows goes through `cmd`, and cmd splits an UNQUOTED command line on `&` before the `start`
+ * builtin ever sees it. Every URL we open carries more than one query parameter, so this used to
+ * open the browser at everything up to the first `&` and then try to RUN each remaining parameter
+ * as a command: `cat-factory k3s` landed on a bare `?infraSetup=local-k3s` with none of the values
+ * the connect form prefills from, and the PAT links dropped their `scopes`.
+ *
+ * So the URL is quoted, which is also why `start`'s first argument is an empty quoted window title
+ * (it reads a leading quoted token as one). The quotes have to reach cmd verbatim, hence the flag.
+ *
+ * The quoting holds only while the URL carries no `"` of its own, so this SERIALIZES the input
+ * rather than trusting the caller to have done it: WHATWG serialization percent-encodes `"` in
+ * every component that can carry one and rejects it in a host, so no argument can close the quote
+ * and have cmd read the rest as a second command. Input that is not a URL at all throws, rather
+ * than reaching a shell as a command line whose meaning nobody has checked; `openBrowser` is
+ * best-effort and both call sites print the link before opening it. Inside the quotes cmd still
+ * expands a `%NAME%` reference, but the expansion is literal text there: quotes make `&` and its
+ * friends inert, and no Windows environment value can contain a `"` to close them, so the worst
+ * case is a wrong URL, never a second command.
+ *
+ * @throws {TypeError} if `url` is not a parsable absolute URL.
+ */
+export declare function openCommand(url: string, platform: NodeJS.Platform): OpenBrowserCommand;
 /** The real, console-backed {@link Io}, implemented with `@clack/prompts`. */
 export declare function createConsoleIo(): Io;
 //# sourceMappingURL=io.d.ts.map

package/dist/io.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"io.d.ts","sourceRoot":"","sources":["../src/io.ts"],"names":[],"mappings":"AAYA;;;;GAIG;AACH,MAAM,WAAW,EAAE;IACjB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAChE,+DAA+D;IAC/D,MAAM,CAAC,CAAC,SAAS,MAAM,EACrB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,SAAS;QAAE,KAAK,EAAE,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,EAC/C,YAAY,EAAE,CAAC,GACd,OAAO,CAAC,CAAC,CAAC,CAAA;IACb,yFAAyF;IACzF,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACvC,qBAAqB;IACrB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAChE,yFAAyF;IACzF,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACxC;AAwBD,8EAA8E;AAC9E,wBAAgB,eAAe,IAAI,EAAE,CAwDpC"}
+{"version":3,"file":"io.d.ts","sourceRoot":"","sources":["../src/io.ts"],"names":[],"mappings":"AAYA;;;;GAIG;AACH,MAAM,WAAW,EAAE;IACjB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAChE,+DAA+D;IAC/D,MAAM,CAAC,CAAC,SAAS,MAAM,EACrB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,SAAS;QAAE,KAAK,EAAE,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,EAC/C,YAAY,EAAE,CAAC,GACd,OAAO,CAAC,CAAC,CAAC,CAAA;IACb,yFAAyF;IACzF,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACvC,qBAAqB;IACrB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAChE,yFAAyF;IACzF,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACxC;AAED,gGAAgG;AAChG,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,EAAE,CAAA;IACd;;;OAGG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,kBAAkB,CActF;AAWD,8EAA8E;AAC9E,wBAAgB,eAAe,IAAI,EAAE,CA4DpC"}

package/dist/io.js

@@ -1,15 +1,42 @@
 import { spawn } from 'node:child_process';
 import { cancel, confirm as clackConfirm, isCancel, log, password, select as clackSelect, text, } from '@clack/prompts';
-/** The OS-appropriate command for opening a URL in the default browser. */
-function openCommand(url) {
-    switch (process.platform) {
+/**
+ * The OS-appropriate command for opening a URL in the default browser.
+ *
+ * Windows goes through `cmd`, and cmd splits an UNQUOTED command line on `&` before the `start`
+ * builtin ever sees it. Every URL we open carries more than one query parameter, so this used to
+ * open the browser at everything up to the first `&` and then try to RUN each remaining parameter
+ * as a command: `cat-factory k3s` landed on a bare `?infraSetup=local-k3s` with none of the values
+ * the connect form prefills from, and the PAT links dropped their `scopes`.
+ *
+ * So the URL is quoted, which is also why `start`'s first argument is an empty quoted window title
+ * (it reads a leading quoted token as one). The quotes have to reach cmd verbatim, hence the flag.
+ *
+ * The quoting holds only while the URL carries no `"` of its own, so this SERIALIZES the input
+ * rather than trusting the caller to have done it: WHATWG serialization percent-encodes `"` in
+ * every component that can carry one and rejects it in a host, so no argument can close the quote
+ * and have cmd read the rest as a second command. Input that is not a URL at all throws, rather
+ * than reaching a shell as a command line whose meaning nobody has checked; `openBrowser` is
+ * best-effort and both call sites print the link before opening it. Inside the quotes cmd still
+ * expands a `%NAME%` reference, but the expansion is literal text there: quotes make `&` and its
+ * friends inert, and no Windows environment value can contain a `"` to close them, so the worst
+ * case is a wrong URL, never a second command.
+ *
+ * @throws {TypeError} if `url` is not a parsable absolute URL.
+ */
+export function openCommand(url, platform) {
+    const href = new URL(url).href;
+    switch (platform) {
         case 'darwin':
-            return { cmd: 'open', args: [url] };
+            return { cmd: 'open', args: [href] };
         case 'win32':
-            // `start` is a cmd builtin; the empty "" is the window title arg it requires.
-            return { cmd: 'cmd', args: ['/c', 'start', '', url] };
+            return {
+                cmd: 'cmd',
+                args: ['/c', 'start', '""', `"${href}"`],
+                windowsVerbatimArguments: true,
+            };
         default:
-            return { cmd: 'xdg-open', args: [url] };
+            return { cmd: 'xdg-open', args: [href] };
     }
 }
 /** A clack prompt resolved to a cancel symbol (Ctrl-C / Esc): print a notice and exit cleanly. */
@@ -58,8 +85,12 @@ export function createConsoleIo() {
         openBrowser(url) {
             return new Promise((resolve) => {
                 try {
-                    const { cmd, args } = openCommand(url);
-                    const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
+                    const { cmd, args, windowsVerbatimArguments } = openCommand(url, process.platform);
+                    const child = spawn(cmd, args, {
+                        stdio: 'ignore',
+                        detached: true,
+                        windowsVerbatimArguments,
+                    });
                     child.on('error', () => resolve());
                     child.unref();
                     resolve();

package/dist/io.js.map

@@ -1 +1 @@
-{"version":3,"file":"io.js","sourceRoot":"","sources":["../src/io.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EACL,MAAM,EACN,OAAO,IAAI,YAAY,EACvB,QAAQ,EACR,GAAG,EAEH,QAAQ,EACR,MAAM,IAAI,WAAW,EACrB,IAAI,GACL,MAAM,gBAAgB,CAAA;AA0BvB,2EAA2E;AAC3E,SAAS,WAAW,CAAC,GAAW;IAC9B,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,QAAQ;YACX,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAA;QACrC,KAAK,OAAO;YACV,8EAA8E;YAC9E,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,CAAA;QACvD;YACE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAA;IAC3C,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,SAAS,eAAe,CAAI,KAAiB;IAC3C,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,CAAC,YAAY,CAAC,CAAA;QACpB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnB,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,IAAI,CAAC,OAAO;YACV,4FAA4F;YAC5F,0DAA0D;YAC1D,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAA;QAChD,CAAC;QACD,IAAI,CAAC,OAAO;YACV,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAA;QAC7C,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY;YACjC,MAAM,KAAK,GAAG,eAAe,CAC3B,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CACzE,CAAA;YACD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YACpC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAA;QAC5D,CAAC;QACD,KAAK,CAAC,MAAM,CACV,MAAc,EACd,OAA+C,EAC/C,YAAe;YAEf,oFAAoF;YACpF,0FAA0F;YAC1F,wDAAwD;YACxD,MAAM,KAAK,GAAG,eAAe,CAC3B,MAAM,WAAW,CAAI;gBACnB,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE,CAAC,GAAG,OAAO,CAAgB;gBACpC,YAAY,EAAE,YAAY;aAC3B,CAAC,CACH,CAAA;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,iFAAiF;YACjF,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;YAClE,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QAC7B,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY;YAChC,OAAO,eAAe,CAAC,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC,CAAA;QAC7F,CAAC;QACD,WAAW,CAAC,GAAG;YACb,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBACnC,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;oBACtC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;oBACnE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;oBAClC,KAAK,CAAC,KAAK,EAAE,CAAA;oBACb,OAAO,EAAE,CAAA;gBACX,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,CAAA;gBACX,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"io.js","sourceRoot":"","sources":["../src/io.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EACL,MAAM,EACN,OAAO,IAAI,YAAY,EACvB,QAAQ,EACR,GAAG,EAEH,QAAQ,EACR,MAAM,IAAI,WAAW,EACrB,IAAI,GACL,MAAM,gBAAgB,CAAA;AAqCvB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,QAAyB;IAChE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAA;IAC9B,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAA;QACtC,KAAK,OAAO;YACV,OAAO;gBACL,GAAG,EAAE,KAAK;gBACV,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,CAAC;gBACxC,wBAAwB,EAAE,IAAI;aAC/B,CAAA;QACH;YACE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAA;IAC5C,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,SAAS,eAAe,CAAI,KAAiB;IAC3C,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,CAAC,YAAY,CAAC,CAAA;QACpB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnB,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,IAAI,CAAC,OAAO;YACV,4FAA4F;YAC5F,0DAA0D;YAC1D,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAA;QAChD,CAAC;QACD,IAAI,CAAC,OAAO;YACV,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAA;QAC7C,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY;YACjC,MAAM,KAAK,GAAG,eAAe,CAC3B,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CACzE,CAAA;YACD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YACpC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAA;QAC5D,CAAC;QACD,KAAK,CAAC,MAAM,CACV,MAAc,EACd,OAA+C,EAC/C,YAAe;YAEf,oFAAoF;YACpF,0FAA0F;YAC1F,wDAAwD;YACxD,MAAM,KAAK,GAAG,eAAe,CAC3B,MAAM,WAAW,CAAI;gBACnB,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE,CAAC,GAAG,OAAO,CAAgB;gBACpC,YAAY,EAAE,YAAY;aAC3B,CAAC,CACH,CAAA;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,iFAAiF;YACjF,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;YAClE,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QAC7B,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY;YAChC,OAAO,eAAe,CAAC,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC,CAAA;QAC7F,CAAC;QACD,WAAW,CAAC,GAAG;YACb,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBACnC,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;oBAClF,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;wBAC7B,KAAK,EAAE,QAAQ;wBACf,QAAQ,EAAE,IAAI;wBACd,wBAAwB;qBACzB,CAAC,CAAA;oBACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;oBAClC,KAAK,CAAC,KAAK,EAAE,CAAA;oBACb,OAAO,EAAE,CAAA;gBACX,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,CAAA;gBACX,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/cli",
-  "version": "0.10.3",
+  "version": "0.10.5",
   "description": "Bootstrap CLI for the Agent Architecture Board: scaffold a local-mode deployment (Node/local backend + frontend SPA) on your own machine — generates the crypto secrets, populates and gitignores the .env files, and mints a GitHub/GitLab personal access token by opening the browser at the right pre-scoped URL.",
   "keywords": [
     "bootstrap",
@@ -41,8 +41,8 @@
     "typescript": "7.0.2",
     "valibot": "^1.4.2",
     "vitest": "^4.1.10",
-    "@cat-factory/contracts": "0.292.1",
-    "@cat-factory/kernel": "0.285.2"
+    "@cat-factory/contracts": "0.293.0",
+    "@cat-factory/kernel": "0.286.1"
   },
   "scripts": {
     "build": "tsc -b tsconfig.build.json",