@habemus-papadum/aiui 0.3.0 → 0.6.0

package/dist/commands/browser.d.ts

@@ -45,10 +45,12 @@ export interface StartSessionBrowserOptions {
  * it:
  *
  *  1. Resolve settings from flags + config.
- *  2. Prefer the managed Chrome for Testing unless config names a browser
- *     explicitly (the sync may prompt to install/update — only when
- *     `interactive`; otherwise it just reports what's installed).
- *  3. Rebuild and load the aiui devtools extension (dev checkouts only).
+ *  2. Prefer the managed browser (Chromium by default, or Chrome for Testing
+ *     per chrome.managed) unless config names a browser explicitly (the sync
+ *     may prompt to install/update — only when `interactive`; otherwise it just
+ *     reports what's installed).
+ *  3. Load the intent client's MV3 bundle if it has been built (dev checkouts
+ *     only).
  *  4. Launch on the profile's user data dir and wait for the debug endpoint.
  *
  * Throws with a remediation-bearing message when no browser can be found or

package/dist/commands/clean.d.ts

@@ -3,7 +3,7 @@ export interface CleanOptions {
     projectOnly?: boolean;
     /** Limit the reset to the user cache (`~/.cache/aiui`). */
     userOnly?: boolean;
-    /** Keep the managed Chrome for Testing install (skip the ~160 MB re-download). */
+    /** Keep the managed browser installs (skip the ~150-160 MB re-download). */
     keepBrowser?: boolean;
     /** Print what would be deleted, then stop. */
     dryRun?: boolean;
@@ -16,8 +16,8 @@ export interface CleanRoots {
     project: string;
     /** `~/.cache/aiui` (respects `$AIUI_CACHE` / `$XDG_CACHE_HOME`). */
     user: string;
-    /** The managed Chrome for Testing dir — a child of {@link CleanRoots.user}. */
-    browser: string;
+    /** The managed-browser dirs (chromium/, chrome/) — children of {@link CleanRoots.user}. */
+    browsers: string[];
 }
 /** One thing `clean` will delete: a root path, optionally sparing some children. */
 export interface CleanTarget {
@@ -27,7 +27,8 @@ export interface CleanTarget {
     path: string;
     /**
      * Absolute child paths to preserve instead of deleting `path` wholesale. Used
-     * by `--keep-browser` to clear the user cache while keeping `chrome/`.
+     * by `--keep-browser` to clear the user cache while keeping the managed
+     * browser dirs (`chromium/`, `chrome/`).
      */
     keep?: string[];
 }

package/dist/commands/debug.d.ts

@@ -1,15 +1,7 @@
 export interface DebugOptions {
     /** Target a channel by its registry tag instead of the interactive selector. */
     mcp?: string;
-    /** UI port for the viewer's dev server (default {@link DEFAULT_UI_PORT}). */
-    port?: string;
-    /** Open the browser at the viewer (default true; `--no-open` skips). */
+    /** Open the browser at the console (default true; `--no-open` skips). */
     open?: boolean;
 }
-/**
- * This package's root — the Vite server root, found by walking up from this
- * module to the `@habemus-papadum/aiui` package.json (two levels in the
- * source tree, but the walk keeps it honest against dist layouts too).
- */
-export declare function packageRoot(): string | undefined;
 export declare function runDebug(opts?: DebugOptions): Promise<void>;

package/dist/commands/env.d.ts

@@ -0,0 +1,36 @@
+/** The env files read from the workspace root, in load order (later wins). */
+export declare const ENV_FILES: readonly [".env", ".env.local", ".env.dev", ".env.dev.local"];
+/**
+ * Find the workspace root: the nearest ancestor of `start` carrying a
+ * `pnpm-workspace.yaml` or a `.git`. Falls back to `start` itself (a bare
+ * consumer project without either still gets its own ./node_modules/.bin).
+ */
+export declare function findWorkspaceRoot(start: string): string;
+/**
+ * Parse one dotenv file's text into ordered KEY → value entries. Deliberately
+ * minimal (the files here hold API keys, not programs): `KEY=VALUE` lines, an
+ * optional `export ` prefix, `#` comment lines and blanks skipped, one pair of
+ * matching single or double outer quotes stripped. No escape processing, no
+ * multiline values, no inline comments after unquoted values.
+ */
+export declare function parseDotenv(text: string): Map<string, string>;
+/** Single-quote `value` for POSIX shells (embedded `'` becomes `'\''`). */
+export declare function shQuote(value: string): string;
+/**
+ * Render the activation script. Pure — the command resolves dirs and reads
+ * files, this just writes shell. Every line ends in `;` (see the module
+ * header: unquoted `eval` survival), and each PATH prepend is wrapped in a
+ * containment check so activation is idempotent.
+ */
+export declare function buildEnvScript(input: {
+    /** Directories to prepend to PATH, highest priority first. */
+    pathDirs: string[];
+    /** Env entries to export (already merged across files, later-file wins). */
+    vars: Map<string, string>;
+}): string;
+/**
+ * The command: resolve the workspace root from the cwd, collect the PATH dirs
+ * that exist, merge the env files, and print the script (stdout) + a summary
+ * of what it does (stderr, names only — never a value).
+ */
+export declare function runEnv(): void;

package/dist/commands/extension.d.ts

@@ -0,0 +1,46 @@
+/** The NM host name (lowercase alphanumerics, dots, underscores only). */
+export declare const NATIVE_HOST_NAME = "com.habemus_papadum.aiui";
+/**
+ * The intent client's stable unpacked-extension id (see
+ * `packages/aiui-intent-client/src/ext/manifest.ts`, which owns the key this
+ * is derived from). Duplicated rather than imported: `aiui` does not depend on
+ * the intent client, and this is a 32-char constant that changes only if the
+ * key does.
+ */
+export declare const INTENT_CLIENT_EXTENSION_ID = "cdpbfpcelmifhagikjlfpgfipggcmdeg";
+export interface ExtensionOptions {
+    extensionId?: string;
+}
+/**
+ * Browser NM manifest directories, user-level, per platform.
+ *
+ * Deliberately NO Chrome for Testing entry: CfT does not read a fixed
+ * user-level directory — it looks in `<user-data-dir>/NativeMessagingHosts`
+ * (measured on macOS; an earlier `Google/ChromeForTesting` guess here was
+ * never read by anything). aiui-launched browsers get the manifest written
+ * into their profile at launch instead ({@link installProfileNativeHost}).
+ */
+export declare function nativeHostManifestDirs(platform: NodeJS.Platform, home: string): string[];
+/** The wrapper script body. Exported for tests. */
+export declare function wrapperScript(cwd: string, command: string, args: string[]): string;
+export declare function runExtension(action: string, options?: ExtensionOptions): Promise<void>;
+/**
+ * Install the NM manifest into a session-browser profile
+ * (`<user-data-dir>/NativeMessagingHosts/`) — the directory Chrome for
+ * Testing actually consults (measured; see the module doc). Called by the
+ * launchers whenever they load the intent client's extension: the profile
+ * lives in aiui's own project-local cache, so unlike the global install this
+ * needs no user decision — it is the same class of write as creating the
+ * profile. Quiet and idempotent; no browser restart needed (NM manifests are
+ * read per `connectNative`/`sendNativeMessage` call).
+ */
+export declare function installProfileNativeHost(userDataDir: string, options?: ExtensionOptions): void;
+/**
+ * {@link installProfileNativeHost} as the launchers call it: only when the
+ * intent client's extension is actually loadable (no point granting a host to
+ * an extension that won't be there), and never fatal — a failed write
+ * degrades to the panel's type-a-port fallback, with a note saying so. Called
+ * on both the launch and the attach-to-running paths, so a profile whose
+ * browser outlives many sessions still converges on a current manifest.
+ */
+export declare function ensureProfileNativeHost(userDataDir: string, intentReady: boolean, warn: (title: string, detail: string) => void): void;

package/dist/commands/mcp.d.ts

@@ -7,6 +7,16 @@
  * user-facing channel commands under `aiui` without moving them out of the
  * package that owns the MCP server Claude Code spawns.
  *
+ * **One thing is not verbatim.** The subcommands that *are* a channel process —
+ * `serve` (standalone debug channel) and `mcp` (the stdio MCP server) — get the
+ * same config-derived `--bind` that `aiui claude` computes when it tells Claude
+ * Code how to spawn the channel (see util/channel-launch), so both ways of
+ * starting a channel honor `channel.bind` identically. (Sidecars need no such
+ * plumbing: the channel imports and mounts its own standard set — paint, intent,
+ * bar, pencil — so every channel hosts all four.) Flags you pass explicitly
+ * always win. Every other subcommand (`quick`, `config`) talks to a channel
+ * someone *else* is running and forwards untouched.
+ *
  * Like `aiui vite`, the channel CLI is a declared dependency, so we resolve it
  * from node_modules (tsx-from-source in a dev checkout, the built `dist` when
  * installed; see {@link resolvePackageCli}) rather than looking on the PATH.

package/dist/commands/native-host.d.ts

@@ -0,0 +1,16 @@
+/** Encode one native-messaging frame (native-endian u32 length + JSON). Pure. */
+export declare function encodeNativeFrame(message: unknown): Buffer;
+/**
+ * Split complete frames off an accumulating buffer. Returns the parsed
+ * messages and the unconsumed remainder (a partial frame stays buffered).
+ * Unparseable JSON inside a complete frame yields `undefined` in its slot —
+ * the caller answers with an error rather than dying. Pure.
+ */
+export declare function decodeNativeFrames(buffer: Buffer): {
+    messages: unknown[];
+    rest: Buffer;
+};
+/** Answer one request. Exported for tests. */
+export declare function handleNativeRequest(message: unknown): Record<string, unknown>;
+/** The stdio loop. Never resolves until stdin ends (Chrome closes it). */
+export declare function runNativeHost(): Promise<void>;

package/dist/commands/pencil-url.d.ts

@@ -0,0 +1,18 @@
+/** A network interface the channel's bind makes reachable, as offered in the picker. */
+interface HostInterface {
+    /** The OS interface name (`en0`, `lo0`) or a synthetic label (`loopback`). */
+    name: string;
+    address: string;
+}
+/**
+ * The interfaces the channel is actually reachable on, given its bind:
+ *  - loopback (`127.0.0.1`) → only the loopback address; an iPad can't reach it
+ *    without a tunnel, but we still offer it (the user may have one).
+ *  - host (`0.0.0.0`) → every non-internal IPv4 the machine holds, named by its
+ *    OS interface, plus loopback last for on-machine testing.
+ */
+export declare function boundInterfaces(bindHost: string | undefined): HostInterface[];
+export declare function runPencilUrl(opts?: {
+    json?: boolean;
+}): Promise<void>;
+export {};

package/dist/commands/vite.d.ts

@@ -1,35 +1,8 @@
-import type { RunningServer } from "@habemus-papadum/aiui-claude-channel";
-/** The channel server `runVite` should point Vite at, or why it couldn't. */
-export interface ChannelTarget {
-    /** The server resolved without prompting (by tag). */
-    server?: RunningServer;
-    /** Servers to offer in the interactive selector (no tag given, ≥1 running). */
-    select?: RunningServer[];
-    /** A human-readable reason a requested server couldn't be resolved. */
-    error?: string;
-}
-/**
- * Decide which running channel server Vite should connect to.
- *
- * Pure so it can be unit-tested without spawning anything:
- *  - With a `targetTag`, return the server whose `tag` matches exactly; if none
- *    matches, return an `error` naming the tag and the tags that *are* running.
- *  - Without a `targetTag`, don't guess: return `{}` when nothing is running, or
- *    `{ select }` so the caller runs the same selector as `quick` (which
- *    auto-picks a lone server and prompts when there are several).
- */
-export declare function resolveChannelTarget(servers: RunningServer[], targetTag: string | undefined): ChannelTarget;
+import { type AiuiArgs } from "../util/aiui-args";
 /**
  * Launch Vite, forwarding any extra args (e.g. `aiui vite dev`,
  * `aiui vite --port 3000`, `aiui vite --version`).
  *
- * Before launching, resolve which running aiui channel server the dev server
- * should talk to — either the one named by `--aiui-mcp <tag>` (or `--aiui-tag`),
- * or, with no tag, the one you pick from the same selector `quick` uses (which
- * auto-selects when only one is running) — and inject its port as
- * {@link VITE_PORT_ENV} so the app can reach it. When a specific tag was asked
- * for but isn't running, we fail loudly instead of connecting to the wrong one.
- *
  * Unlike `claude` — an external tool we look up on the PATH — Vite is a declared
  * dependency of this package, so we resolve it straight out of node_modules and
  * run it via the current Node with an absolute path. Resolving it also doubles
@@ -60,7 +33,7 @@ export declare function runVite(rawArgs?: string[]): Promise<void>;
  * stripped *first*: Vite colors the host and the port separately, so escape
  * sequences sit in the middle of the URL text and no pattern would survive
  * matching against the raw bytes. Returns undefined for anything that isn't
- * the ready line — the same shape as the workbench's parseServeReadyLine, the
+ * the ready line — the same shape the retired workbench lab used, the
  * house pattern for these one-line protocols.
  */
 export declare function parseViteLocalUrl(line: string): string | undefined;
@@ -75,3 +48,18 @@ export declare function parseViteLocalUrl(line: string): string | undefined;
  * process).
  */
 export declare function teeAndDetectLocalUrl(source: NodeJS.ReadableStream, sink: NodeJS.WritableStream, onUrl: (url: string) => void): void;
+/**
+ * The browser sidecar: once the dev server's URL is known, put it in front of
+ * the user — in the *session browser* (the shared window `aiui claude`
+ * attaches the agent to; see aiui-util's browser module and `aiui open`),
+ * never their default browser. A running session browser gets a new tab; none running
+ * means launching one exactly the way `aiui browser` does
+ * ({@link startSessionBrowser}), with the app as its first tab.
+ *
+ * Runs concurrently with Vite and must never interfere with it: everything is
+ * caught, failures print a warning, and the dev server keeps the terminal and
+ * keeps running either way. It is also deliberately non-interactive — Vite
+ * owns stdin — so the Chrome for Testing sync never prompts here; it just
+ * uses whatever browser is already available.
+ */
+export declare function openAppInBrowser(url: string, aiuiArgs: AiuiArgs): Promise<void>;

package/dist/config-xLcoLiLT.js

@@ -0,0 +1,315 @@
+import { readFileSync as E, mkdirSync as x, writeFileSync as S } from "node:fs";
+import { join as p, dirname as A } from "node:path";
+import { projectCacheDir as N } from "@habemus-papadum/aiui-claude-channel";
+import { CHROME_CHANNELS as $, cacheDir as D } from "@habemus-papadum/aiui-util";
+const O = ["chromium", "chrome-for-testing"], b = "chromium", y = ["prompt", "auto", "off"], P = ["attach", "launch"], M = ["loopback", "host"], u = [
+  {
+    name: "claude",
+    summary: "how `aiui claude` launches Claude Code",
+    fields: [
+      {
+        key: "skipPermissions",
+        type: "boolean",
+        default: !0,
+        defaultText: "true (unset: the first interactive launch asks, then persists the answer)",
+        summary: "Launch Claude Code with --dangerously-skip-permissions.",
+        doc: "A personal preference with real consequences (docs/guide/warning): every agent action — shell commands, file writes, network, the browser — runs without asking first. aiui works fine either way. The first interactive launch asks and persists the answer at the user level; when unset, non-interactive sessions fall back to true."
+      },
+      {
+        key: "enterNudge",
+        type: "boolean",
+        default: !0,
+        defaultText: "true (unset: the first interactive launch asks, then persists the answer)",
+        summary: "Auto-dismiss Claude Code's development-channel acknowledgement prompt.",
+        doc: "aiui loads a custom development channel, so Claude Code shows a one-key acknowledgement at every startup; this injects a single Enter keystroke into the terminal to dismiss it (best-effort TIOCSTI on /dev/tty — platforms that forbid it harmlessly do nothing). Saying no just means pressing Enter yourself each launch."
+      }
+    ]
+  },
+  {
+    name: "channel",
+    summary: "the channel server's web backend",
+    fields: [
+      {
+        key: "bind",
+        type: "enum",
+        values: M,
+        default: "loopback",
+        defaultText: '"loopback" (unset: the first interactive launch asks, then persists the answer)',
+        summary: "Which interface the channel web server binds: loopback, or host (LAN).",
+        doc: '"host" (0.0.0.0) makes the session\'s whole web surface — the iPad paint page, but also prompt injection, /debug, and every sidecar — reachable by anyone on your network, UNAUTHENTICATED. That is the trusted-LAN posture (docs/guide/warning): right on a network that is yours alone, wrong on shared Wi-Fi. "loopback" keeps everything this-machine-only; reaching the paint page from an iPad is then up to you — tunnel the channel port however you like (Tailscale, `ssh -L`). The first interactive launch asks and persists the answer at the user level. Per-launch flag: --aiui-bind.'
+      }
+    ]
+  },
+  {
+    name: "chrome",
+    summary: "the agent's browser and the Chrome DevTools MCP",
+    fields: [
+      {
+        key: "enabled",
+        type: "boolean",
+        default: !0,
+        summary: "Attach the Chrome DevTools MCP.",
+        doc: "false turns it off everywhere; true restates the default and does NOT override the CI default-off — only the --aiui-chrome flag forces it on under CI."
+      },
+      {
+        key: "mode",
+        type: "enum",
+        values: P,
+        default: "attach",
+        summary: "How the MCP reaches a browser: shared session browser, or its own.",
+        doc: `"attach" shares a user-visible session browser: an already-running one is discovered by profile, or an interactive launch starts one eagerly. "launch" is the hands-off mode: chrome-devtools-mcp launches its own private browser lazily, on the agent's first browser tool call.`
+      },
+      {
+        key: "browserUrl",
+        type: "string",
+        defaultText: "unset (manage a browser locally)",
+        summary: "Attach to this DevTools endpoint instead of managing a browser at all.",
+        doc: 'The remote-development key (docs/guide/remote): the browser runs on another machine (started there with `aiui browser`) and its debug port is tunneled over. Setting it implies mode: "attach" and makes every local-browser setting (profile, executablePath, channel, forTesting…) irrelevant. Per-launch flag: --aiui-browser-url.',
+        validate: (e) => j(String(e)) ? void 0 : 'expected an http(s) URL like "http://127.0.0.1:9222"'
+      },
+      {
+        key: "debugPort",
+        type: "number",
+        default: 0,
+        defaultText: "0 (an OS-assigned free port)",
+        summary: "Fixed DevTools debug port for session browsers aiui launches.",
+        doc: "Pin it (e.g. 9222) when something external must find the port — an ssh tunnel, a VS Code attach-to-Chrome launch config. 0 means an OS-assigned free port.",
+        validate: (e) => Number.isInteger(e) && e >= 0 && e <= 65535 ? void 0 : "expected 0..65535"
+      },
+      {
+        key: "profile",
+        type: "string",
+        default: "default",
+        summary: "Named profile under .aiui-cache/chrome/.",
+        doc: "Per-launch flag: --aiui-chrome-profile."
+      },
+      {
+        key: "dataDir",
+        type: "string",
+        defaultText: "unset (derived from chrome.profile)",
+        summary: "Explicit Chrome user data dir; takes precedence over chrome.profile.",
+        doc: "Per-launch flag: --aiui-chrome-data-dir."
+      },
+      {
+        key: "executablePath",
+        type: "string",
+        defaultText: "unset (the managed browser — see chrome.managed — else installed Chrome)",
+        summary: "Explicit browser binary to launch — e.g. a Chrome for Testing install.",
+        doc: "Overrides chrome.managed. Chrome for Testing and Chromium both honor --load-extension, so the intent client auto-loads. Mutually exclusive with chrome.channel."
+      },
+      {
+        key: "channel",
+        type: "enum",
+        values: $,
+        defaultText: 'unset ("stable" when launching an installed Chrome)',
+        summary: "Installed Chrome release channel to launch.",
+        doc: "Overrides chrome.managed. Mutually exclusive with chrome.executablePath."
+      },
+      {
+        key: "managed",
+        type: "enum",
+        values: O,
+        default: b,
+        summary: "Which browser aiui downloads and manages: Chromium, or Chrome for Testing.",
+        doc: `"chromium" (default) is the open-source build — it dodges the "verify you're human" reCAPTCHA that Google serves to the Chrome-for-Testing automation build, at the cost of Widevine DRM, some proprietary codecs, and Google account sign-in. "chrome-for-testing" is Google's branded automation build. Both auto-load the intent client and take the media auto-accept flags. Ignored when executablePath or channel names a browser explicitly. Each flavor keeps its own project profile under .aiui-cache/chrome/<flavor>/.`
+      },
+      {
+        key: "manage",
+        type: "enum",
+        values: y,
+        default: "prompt",
+        summary: "How `aiui claude` keeps the managed browser (chrome.managed) installed/current.",
+        doc: '"prompt" asks before installing or updating it — interactive sessions only, never under CI; "auto" installs/updates without asking; "off" never checks. Prompt answers ("automatically", "never ask again") persist here at the user level. Skipped entirely when executablePath or channel picks a browser explicitly. (Was chrome.forTesting.)'
+      },
+      {
+        key: "forTesting",
+        type: "enum",
+        values: y,
+        defaultText: "unset (deprecated alias for chrome.manage)",
+        summary: "DEPRECATED — old name for chrome.manage; still honored when manage is unset.",
+        doc: "Renamed to chrome.manage now that Chromium is also a managed flavor. Old configs keep working: when chrome.manage is unset, this value is used."
+      },
+      {
+        key: "headless",
+        type: "boolean",
+        default: !1,
+        summary: "Launch Chrome with no UI."
+      }
+      // NOTE: `chrome.buildExtension` and `chrome.autoCapture` were removed here
+      // (owner, 2026-07-17) — both had long been parsed-and-ignored (the DevTools
+      // extension is deleted; page-side getDisplayMedia capture is gone). A config
+      // still carrying either is tolerated and dropped by validation, not a hard
+      // error — see DEPRECATED_FIELDS in util/config.ts.
+    ]
+  }
+];
+function J() {
+  return u.flatMap(
+    (e) => e.fields.map((t) => ({ section: e, field: t, path: `${e.name}.${t.key}` }))
+  );
+}
+function k(e) {
+  return e.type === "enum" ? "string" : e.type;
+}
+function v(e, t) {
+  var n;
+  return e.type === "enum" && !(e.values ?? []).includes(String(t)) ? `expected one of: ${(e.values ?? []).join(", ")}` : (n = e.validate) == null ? void 0 : n.call(e, t);
+}
+function B(e, t) {
+  let n;
+  switch (k(e)) {
+    case "boolean": {
+      if (t !== "true" && t !== "false")
+        return { error: "expected true or false" };
+      n = t === "true";
+      break;
+    }
+    case "number": {
+      if (n = Number(t), t.trim() === "" || Number.isNaN(n))
+        return { error: "expected a number" };
+      break;
+    }
+    default:
+      n = t;
+  }
+  const a = v(e, n);
+  return a ? { error: a } : { value: n };
+}
+function C(e) {
+  return typeof e == "string" ? JSON.stringify(e) : String(e);
+}
+function q(e) {
+  return e.defaultText ? e.defaultText : e.default === void 0 ? "unset" : C(e.default);
+}
+function j(e) {
+  try {
+    const t = new URL(e);
+    return t.protocol === "http:" || t.protocol === "https:";
+  } catch {
+    return !1;
+  }
+}
+const g = "config.json", I = /* @__PURE__ */ new Set(["sidecars"]), F = {
+  chrome: ["buildExtension", "autoCapture"]
+};
+function T(e = process.cwd()) {
+  return {
+    user: p(D(void 0, { create: !1 }), g),
+    project: p(N(e), g)
+  };
+}
+function z(e = process.cwd()) {
+  const t = T(e);
+  return L(c(t.user) ?? {}, c(t.project) ?? {});
+}
+function L(e, t) {
+  const n = {};
+  for (const a of u)
+    n[a.name] = {
+      ...e[a.name],
+      ...t[a.name]
+    };
+  return n;
+}
+function c(e) {
+  let t;
+  try {
+    t = E(e, "utf8");
+  } catch {
+    return;
+  }
+  let n;
+  try {
+    n = JSON.parse(t);
+  } catch (a) {
+    throw new Error(
+      `invalid JSON in ${e}: ${a instanceof Error ? a.message : String(a)}`
+    );
+  }
+  return R(n, e);
+}
+function R(e, t) {
+  const n = w(e, t, "the top level"), a = u.map((r) => r.name);
+  for (const r of Object.keys(n))
+    if (!(a.includes(r) || I.has(r)))
+      throw new Error(
+        `unknown key "${r}" at the top level of ${t} — known keys: ${a.join(", ")}`
+      );
+  const s = {};
+  for (const r of u) {
+    if (n[r.name] === void 0)
+      continue;
+    const l = w(n[r.name], t, `"${r.name}"`);
+    U(
+      l,
+      // Known leaf keys PLUS any retired-but-tolerated ones for this section;
+      // the copy loop below only carries `section.fields`, so a deprecated key
+      // is accepted here and then dropped.
+      [...r.fields.map((o) => o.key), ...F[r.name] ?? []],
+      t,
+      `"${r.name}"`
+    );
+    const h = {};
+    for (const o of r.fields) {
+      const i = l[o.key];
+      if (i === void 0)
+        continue;
+      const d = `${r.name}.${o.key}`, m = k(o);
+      if (typeof i !== m)
+        throw new Error(`expected a ${m} for ${d} in ${t}`);
+      const f = v(o, i);
+      if (f)
+        throw new Error(
+          `invalid ${d} ${C(i)} in ${t} — ${f}`
+        );
+      h[o.key] = i;
+    }
+    s[r.name] = h;
+  }
+  return s;
+}
+function K(e) {
+  return _(T().user, e);
+}
+function _(e, t) {
+  const n = c(e) ?? {};
+  return t(n), x(A(e), { recursive: !0 }), S(e, `${JSON.stringify(n, null, 2)}
+`), e;
+}
+function Q(e = {}) {
+  return e.managed ?? b;
+}
+function X(e = {}) {
+  return e.manage ?? e.forTesting ?? "prompt";
+}
+function w(e, t, n) {
+  if (typeof e != "object" || e === null || Array.isArray(e))
+    throw new Error(`expected an object at ${n} of ${t}`);
+  return e;
+}
+function U(e, t, n, a) {
+  for (const s of Object.keys(e))
+    if (!t.includes(s))
+      throw new Error(
+        `unknown key "${s}" at ${a} of ${n} — known keys: ${t.join(", ")}`
+      );
+}
+export {
+  M as C,
+  b as D,
+  O as M,
+  X as a,
+  c as b,
+  T as c,
+  q as d,
+  J as e,
+  C as f,
+  _ as g,
+  u as h,
+  z as l,
+  L as m,
+  B as p,
+  Q as r,
+  K as u
+};
+//# sourceMappingURL=config-xLcoLiLT.js.map