@rness/cli 0.3.0 → 0.5.0

package/README.md

@@ -6,6 +6,8 @@ Not an agent — no LLM loop.
 
 ## Install
 
+    npm create rness           # prompts for the organization, then the repositories for your workspace
+    npm create rness acme      # the organization github.com/acme, no first prompt
     npm i -g @rness/cli        # the command is `rness`
     npx @rness/cli --help
 
@@ -14,14 +16,182 @@ Inside a workspace, every `rness` delegates to the copy pinned in
 
 ## Commands
 
-    rness context [--scope <name>] [--json]           Resolve the context for a scope
-    rness validate                                    Check .rness/ and every generated block
-    rness sync [--scope <name>] [--check] [--pull] -y Clone repositories, write the blocks
+    rness create [<org>] [--repos a,b] [--pm npm|pnpm|yarn|bun] [--ssh|--https] [--skip-install] -y
+    rness add <repo> [--scopes apps/web,packages/ui] [--ssh|--https] -y
+    rness sync [--all] [--scope <name>] [--check] [--pull] -y
+    rness upgrade [<version>] -y
+    rness login [--setup-git|--no-setup-git]
+    rness logout
+    rness context [--scope <name>] [--json]
+    rness validate
 
-Exit codes: 0 success, 1 handled error, 2 bad usage. `RNESS_DEBUG=1` adds
-stack traces; `RNESS_NO_DELEGATE=1` skips the delegation. `sync` asks for
-confirmation in a terminal; pass `-y`/`--yes` in scripts. `--check` writes
-nothing and exits 1 when a block is out of date — use it in CI.
+`create` never runs inside a workspace. `add`, `sync` and `create` ask for
+confirmation in a terminal; pass `-y`/`--yes` in scripts. `sync --check`
+writes nothing and exits 1 when a block is out of date — use it in CI.
+
+### Log in
+
+    rness login     # shows a code and https://github.com/login/device
+    rness logout
+
+`rness login` connects rness to your GitHub account (OAuth device flow: you
+approve a code in a browser, on any machine). Logged in, `create` lists the
+private repositories you can access, offers your organizations to choose
+from, and says as whom it looks at one (`member   acme (as you)`). The
+`create` wizard offers the login itself when it would otherwise list
+anonymously.
+
+- The login is one file, `~/.config/rness/auth.json` (`$XDG_CONFIG_HOME`,
+  `%APPDATA%` on Windows), readable by you only. The access token lives 8
+  hours and is renewed on its own. `GITHUB_TOKEN`, then `GH_TOKEN`, win over
+  it — CI needs no login.
+- rness asks for `repo` and `read:org`: GitHub has no read-only scope for
+  private repositories. It only lists and clones.
+- A new workspace has to reach GitHub before teammates can join it. Logged
+  in, the `create` wizard offers to do it: it creates the private repository
+  `<org>/.rness` and pushes the context with `git`. Declined, refused by
+  GitHub, anonymous or with `--yes`, it prints the two manual steps instead
+  — create the empty repository on github.com, then `git remote add origin …
+&& git push`. No other tool is ever needed.
+- An organization that restricts OAuth apps hides its private repositories
+  until an owner approves "Rness"; `create` says so, with the link.
+- Over HTTPS, rness's own clones and pulls carry the login — through the
+  environment of that one git command, never in a URL or `.git/config`. For
+  your own `git pull` and `git push`, `login` offers to make rness git's
+  credential helper for github.com (`--setup-git`, `--no-setup-git`);
+  `logout` undoes it. It needs a global install (`npm i -g @rness/cli`): a
+  copy run through `npx` lives in a cache. Over SSH none of this is needed.
+  The helper names `node` by its absolute path: after a Node upgrade through
+  a version manager (mise, nvm), run `rness login --setup-git` again.
+- `rness logout` forgets the login; revoke the authorization itself in
+  GitHub's settings (the command prints the link).
+
+### SSH or HTTPS
+
+`create` and `add` test your SSH access to github.com once
+(`ssh -T git@github.com`) and write `git@github.com:` URLs when GitHub accepts
+your key, `https://github.com/` ones otherwise; `--ssh` and `--https` decide
+without the test. In a terminal `ssh` may ask for your key's passphrase;
+without one (`--yes`, CI) it never prompts, so a key that needs a passphrase
+counts as no access unless an agent holds it.
+
+`rness.json` is authoritative: a URL written there is cloned as written, never
+converted. In a workspace whose catalogue clones over SSH, `create` (joining)
+and `sync` stop before the first clone when the SSH test fails and say how to
+set up a key; `add` offers "Clone <name> over HTTPS instead?" (or `--https`),
+which writes an HTTPS URL for that repository only.
+
+Without an agent, a protected key is asked for again by every `git clone`.
+Load it once per session: `ssh-add --apple-use-keychain ~/.ssh/id_ed25519` on
+macOS, `ssh-add ~/.ssh/id_ed25519` elsewhere.
+
+### Colour
+
+In a terminal `create`, `login`, `add`, `sync` and `upgrade` run as one
+session: an intro, a line per finished step, spinners, a "Next" box, an
+outro — in the same gutter as the questions. A spinner never animates while
+git might ask for a passphrase: rness first tests SSH unattended, and clones
+animate only when that passed. The help and the banner are coloured. Through a pipe, in CI, or with `NO_COLOR=1`, the output is plain text —
+the same bytes as before 0.5.0; `FORCE_COLOR=1` paints it anyway. No
+dependency does this: `util.styleText`, and a banner kept as a constant.
+
+### Upgrade
+
+    rness upgrade            # the latest release; `rness upgrade 0.5.0` for another
+    npx @rness/cli@latest upgrade     # from a workspace pinned below 0.5.0
+
+The version is written in one place, `.rness/package.json`. `upgrade` pins it
+there (exact, the rest of the file untouched), installs with the workspace's
+package manager, then syncs through the new copy; a failed install restores
+the file. Commit `.rness`; teammates pull and install in `.rness`. Until they
+do, every command warns that the workspace pins one version and holds
+another. It is never delegated to the pinned copy, which is what it replaces
+— so a workspace pinned below 0.5.0, whose copy has no such command, starts
+with the `npx` form.
+
+An upgrade touches `.rness` only: a generated block is current when its hash
+is, whatever wrote it, so no `AGENTS.md` of the organization changes unless
+its content does.
+
+Exit codes: 0 success, 1 failure, 2 usage — or a refusal without a TTY.
+`RNESS_DEBUG=1` adds stack traces; `RNESS_NO_DELEGATE=1` skips the delegation.
+
+## 0.5.0 — the organization is the workspace; rness.json is its catalogue
+
+- `create <org>` names the organization, not a directory any more (`--org
+<org>` and the prompt "What is your GitHub organization named?" do the
+  same). The workspace directory is `./<org>`, with the organization's exact
+  name; `--dir` is removed. With `npm create`, flags go after `--`:
+  `npm create rness acme -- --yes`.
+- SSH first: `create` and `add` write `git@github.com:` URLs when
+  `ssh -T git@github.com` accepts your key, HTTPS ones otherwise (0.4.0
+  wrote HTTPS unless `--ssh`). `--https` is new. A private `.rness` you reach
+  over SSH is now found when joining. See "SSH or HTTPS" above.
+- `create` does not offer repositories whose name starts with a dot
+  (`.github`, …).
+- Colour, a banner and progress lines in a terminal (see "Colour" above);
+  nothing changes for scripts.
+- `rness login` / `rness logout` are new: private repositories are listed,
+  and cloned over HTTPS with the login (see "Log in" above). Without a login
+  the note reads `rness login lists the private ones you can access`.
+- `rness upgrade` is new (see "Upgrade" above). From 0.4.0:
+  `npx @rness/cli@latest upgrade`.
+- The header of a generated block no longer names the CLI version
+  (`<!-- rness · scope: … -->`), and `sync` decides by the hash like
+  `validate`: upgrading rewrites no `AGENTS.md`. Blocks written by 0.2–0.4
+  stay as they are until their content changes. A 0.4.0 CLI calls the new
+  header stale — upgrade every copy together.
+- The scaffold's CI workflow reads the version from `package.json` instead of
+  naming it; `upgrade` migrates the old line.
+- `.rness/rness.json` is the organization's catalogue — every repository
+  rness knows about, shared by the team. Your workspace is the part of it
+  you cloned into `org/`; two teammates can clone different repositories,
+  and nothing but `org/` records the choice. A choice never removes a
+  repository from the catalogue.
+- `create` lists the organization's repositories to search and pick from,
+  with every catalogue repository pre-selected when joining (a catalogue
+  repository the listing does not return is still offered, marked
+  `in .rness`). A picked catalogue repository is cloned; a picked new one is
+  added to the catalogue, as `rness add` does. Without a picker, `--repos`
+  is the selection; a join without `--repos` clones the whole catalogue. A
+  cancelled or declined prompt writes nothing and exits 0.
+- The listing needs no credentials. Without a `GITHUB_TOKEN` (or `GH_TOKEN`)
+  only public repositories are listed — and a personal account always lists
+  only its public ones; add the others later with `rness add <repo>`.
+- `rness sync` works on your clones: it writes the blocks of the repositories
+  in `org/`, never of `rness.json` as a whole. In a terminal it asks "Do you
+  want to sync as well?" with the catalogue repositories you have not cloned
+  ("Select all", or pick some); what you pick is cloned first. With `--yes`,
+  or `--check`, nothing is cloned and one `not cloned:` line names them
+  (`--check` does not fail on it). `rness sync --all` clones them all without
+  asking. A clone `rness.json` does not know gets no block and a
+  `not in rness.json:` line pointing at `rness add`.
+- A workspace pinned to 0.4.x clones every catalogue repository on sync —
+  `create` runs the pinned copy's sync after joining.
+- Joining a workspace whose `.rness` pins an older `@rness/cli` than the one
+  you run says so, and that `rness upgrade` moves it.
+- Repository and scope names take what GitHub allows, in lowercase: letters,
+  digits, `.`, `_` and `-` (`my_lib`, `angular.js`). A name that differs only
+  by case is declared in lowercase. A 0.4.0 CLI rejects a `rness.json` that
+  holds a `.` or a `_` in a name — upgrade every copy together.
+- Organization names follow GitHub's rule — letters, digits and single
+  hyphens, not at either end, at most 39 characters — in `--org` and in
+  `rness.json`'s `"org"`; the case is kept as typed.
+- `"org"` in `rness.json` now accepts uppercase letters: a 0.4.0 CLI rejects
+  a workspace whose `"org"` has any, so upgrade every copy together.
+
+## 0.4.0 — create, add, the shims
+
+- `npm create rness <org>` starts a new workspace for `github.com/<org>` or
+  joins its existing `.rness`.
+- `rness add <repo>` clones (or adopts) a repository under `org/`, declares
+  it and any `--scopes` sub-directories, then syncs.
+- `create-rness` and `@rness/create` are two-file shims pinned to the exact
+  same version as `@rness/cli`, so the short `npm create` commands run this
+  CLI.
+- A new workspace's scaffold ships a `pnpm-workspace.yaml`
+  (`minimumReleaseAgeExclude: ['@rness/cli']`) — pnpm 12 otherwise refuses a
+  version published less than 24h earlier.
 
 ## 0.3.0 — what changed for a 0.2.0 workspace
 

package/dist/bin/rness.js

@@ -1,38 +1,15 @@
 #!/usr/bin/env node
 import {
   VERSION,
-  findWorkspace,
+  driftWarning,
+  findDelegate,
   reportError,
   run
-} from "../chunk-4KNZT4G4.js";
+} from "../chunk-WSGPDTPQ.js";
 
 // src/bin/rness.ts
 import { pathToFileURL } from "url";
 
-// src/core/delegate.ts
-import { readFile } from "fs/promises";
-import { join } from "path";
-async function findDelegate(cwd, ownVersion) {
-  let root;
-  let rnessDir;
-  try {
-    const ws = await findWorkspace(cwd);
-    root = ws.root;
-    rnessDir = ws.rnessDir;
-  } catch {
-    return null;
-  }
-  const pkgDir = join(rnessDir, "node_modules", "@rness", "cli");
-  let version;
-  try {
-    version = JSON.parse(await readFile(join(pkgDir, "package.json"), "utf8")).version;
-  } catch {
-    return null;
-  }
-  if (typeof version !== "string" || version === ownVersion) return null;
-  return { entry: join(pkgDir, "dist", "index.js"), version, root };
-}
-
 // src/core/node-version.ts
 var MIN_NODE_MAJOR = 24;
 function nodeMajor(version) {
@@ -50,18 +27,39 @@ process.stdout.on("error", (e) => {
 });
 async function main() {
   if (!isSupportedNode(process.versions.node)) {
-    process.stderr.write(`rness needs Node ${MIN_NODE_MAJOR} or newer (running ${process.version})
-`);
+    process.stderr.write(
+      `rness needs Node ${MIN_NODE_MAJOR} or newer (running ${process.version})
+`
+    );
     return 1;
   }
   const argv = process.argv.slice(2);
-  const skipDelegation = argv[0] === "create" || process.env["RNESS_NO_DELEGATE"] === "1";
+  const own = [
+    "create",
+    "upgrade",
+    "update",
+    "login",
+    "logout",
+    "git-credential"
+  ].includes(argv[0] ?? "");
+  const noDelegate = process.env["RNESS_NO_DELEGATE"] === "1";
+  const skipDelegation = own || noDelegate;
+  const command = argv[0];
+  if (command !== void 0 && !command.startsWith("-") && !own && !noDelegate) {
+    const warning = await driftWarning(process.cwd());
+    if (warning !== null) process.stderr.write(`${warning}
+`);
+  }
   const delegate = skipDelegation ? null : await findDelegate(process.cwd(), VERSION);
   if (delegate !== null) {
-    const broken = (reason) => new Error(`@rness/cli ${delegate.version} pinned in ${delegate.root}/.rness is not installed correctly (${reason}); reinstall in .rness/`);
+    const broken = (reason) => new Error(
+      `@rness/cli ${delegate.version} pinned in ${delegate.root}/.rness is not installed correctly (${reason}); reinstall in .rness/`
+    );
     if (process.env["RNESS_DEBUG"] === "1") {
-      process.stderr.write(`rness: delegating to @rness/cli ${delegate.version} (${delegate.entry})
-`);
+      process.stderr.write(
+        `rness: delegating to @rness/cli ${delegate.version} (${delegate.entry})
+`
+      );
     }
     let mod;
     try {
@@ -69,7 +67,8 @@ async function main() {
     } catch (e) {
       throw broken(e instanceof Error ? e.message : String(e));
     }
-    if (typeof mod["run"] !== "function") throw broken("dist/index.js does not export run");
+    if (typeof mod["run"] !== "function")
+      throw broken("dist/index.js does not export run");
     const delegateRun = mod["run"];
     const code = await delegateRun(argv);
     return typeof code === "number" ? code : 1;

package/dist/bin/rness.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/bin/rness.ts","../../src/core/delegate.ts","../../src/core/node-version.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { pathToFileURL } from 'node:url'\nimport { run } from '../cli.ts'\nimport { VERSION } from '../version.ts'\nimport { findDelegate } from '../core/delegate.ts'\nimport { isSupportedNode, MIN_NODE_MAJOR } from '../core/node-version.ts'\nimport { reportError } from '../report.ts'\n\n// `rness context | head`: once the reader has its lines it closes the pipe and\n// every further write emits EPIPE on stdout. Nothing is left to deliver, so end\n// quietly with success. This is the one process.exit() in the code base — it\n// runs only when there is no output left to drain (see main() below).\nprocess.stdout.on('error', (e: NodeJS.ErrnoException) => {\n  if (e.code === 'EPIPE') process.exit(0)\n  throw e\n})\n\n// Set process.exitCode rather than calling process.exit(): process.exit()\n// terminates before Node drains an async stdout pipe, truncating piped output\n// at the ~64 KiB pipe buffer (breaks `rness context --json | jq`, `$(...)`).\nasync function main(): Promise<number> {\n  if (!isSupportedNode(process.versions.node)) {\n    process.stderr.write(`rness needs Node ${MIN_NODE_MAJOR} or newer (running ${process.version})\\n`)\n    return 1\n  }\n  const argv = process.argv.slice(2)\n  const skipDelegation = argv[0] === 'create' || process.env['RNESS_NO_DELEGATE'] === '1'\n  const delegate = skipDelegation ? null : await findDelegate(process.cwd(), VERSION)\n  if (delegate !== null) {\n    const broken = (reason: string): Error =>\n      new Error(`@rness/cli ${delegate.version} pinned in ${delegate.root}/.rness is not installed correctly (${reason}); reinstall in .rness/`)\n    if (process.env['RNESS_DEBUG'] === '1') {\n      process.stderr.write(`rness: delegating to @rness/cli ${delegate.version} (${delegate.entry})\\n`)\n    }\n    let mod: Record<string, unknown>\n    try {\n      mod = (await import(pathToFileURL(delegate.entry).href)) as Record<string, unknown>\n    } catch (e) {\n      throw broken(e instanceof Error ? e.message : String(e))\n    }\n    if (typeof mod['run'] !== 'function') throw broken('dist/index.js does not export run')\n    const delegateRun = mod['run'] as (argv: string[]) => Promise<unknown>\n    const code = await delegateRun(argv)\n    return typeof code === 'number' ? code : 1\n  }\n  return run(argv)\n}\n\nmain()\n  .then((code) => {\n    process.exitCode = code\n  })\n  .catch((e: unknown) => {\n    process.exitCode = reportError(e)\n  })\n","import { readFile } from 'node:fs/promises'\nimport { join } from 'node:path'\nimport { findWorkspace } from './workspace.ts'\n\nexport interface Delegate {\n  /** Absolute path of the pinned copy's `dist/index.js`. */\n  entry: string\n  version: string\n  /** Workspace root (the directory holding `.rness/`). */\n  root: string\n}\n\n/**\n * The `@rness/cli` pinned in `<workspace>/.rness/package.json` (installed under\n * `.rness/node_modules`), when it exists and is not the running version. The\n * pinned copy is the only one that should ever act on a workspace.\n */\nexport async function findDelegate(cwd: string, ownVersion: string): Promise<Delegate | null> {\n  let root: string\n  let rnessDir: string\n  try {\n    const ws = await findWorkspace(cwd)\n    root = ws.root\n    rnessDir = ws.rnessDir\n  } catch {\n    return null\n  }\n  const pkgDir = join(rnessDir, 'node_modules', '@rness', 'cli')\n  let version: unknown\n  try {\n    version = (JSON.parse(await readFile(join(pkgDir, 'package.json'), 'utf8')) as { version?: unknown }).version\n  } catch {\n    return null\n  }\n  if (typeof version !== 'string' || version === ownVersion) return null\n  return { entry: join(pkgDir, 'dist', 'index.js'), version, root }\n}\n","export const MIN_NODE_MAJOR = 24\n\nexport function nodeMajor(version: string): number {\n  const major = Number.parseInt(version.split('.')[0] ?? '', 10)\n  return Number.isNaN(major) ? 0 : major\n}\n\nexport function isSupportedNode(version: string): boolean {\n  return nodeMajor(version) >= MIN_NODE_MAJOR\n}\n"],"mappings":";;;;;;;;;AACA,SAAS,qBAAqB;;;ACD9B,SAAS,gBAAgB;AACzB,SAAS,YAAY;AAgBrB,eAAsB,aAAa,KAAa,YAA8C;AAC5F,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,cAAc,GAAG;AAClC,WAAO,GAAG;AACV,eAAW,GAAG;AAAA,EAChB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,SAAS,KAAK,UAAU,gBAAgB,UAAU,KAAK;AAC7D,MAAI;AACJ,MAAI;AACF,cAAW,KAAK,MAAM,MAAM,SAAS,KAAK,QAAQ,cAAc,GAAG,MAAM,CAAC,EAA4B;AAAA,EACxG,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,YAAY,YAAY,YAAY,WAAY,QAAO;AAClE,SAAO,EAAE,OAAO,KAAK,QAAQ,QAAQ,UAAU,GAAG,SAAS,KAAK;AAClE;;;ACpCO,IAAM,iBAAiB;AAEvB,SAAS,UAAU,SAAyB;AACjD,QAAM,QAAQ,OAAO,SAAS,QAAQ,MAAM,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE;AAC7D,SAAO,OAAO,MAAM,KAAK,IAAI,IAAI;AACnC;AAEO,SAAS,gBAAgB,SAA0B;AACxD,SAAO,UAAU,OAAO,KAAK;AAC/B;;;AFGA,QAAQ,OAAO,GAAG,SAAS,CAAC,MAA6B;AACvD,MAAI,EAAE,SAAS,QAAS,SAAQ,KAAK,CAAC;AACtC,QAAM;AACR,CAAC;AAKD,eAAe,OAAwB;AACrC,MAAI,CAAC,gBAAgB,QAAQ,SAAS,IAAI,GAAG;AAC3C,YAAQ,OAAO,MAAM,oBAAoB,cAAc,sBAAsB,QAAQ,OAAO;AAAA,CAAK;AACjG,WAAO;AAAA,EACT;AACA,QAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;AACjC,QAAM,iBAAiB,KAAK,CAAC,MAAM,YAAY,QAAQ,IAAI,mBAAmB,MAAM;AACpF,QAAM,WAAW,iBAAiB,OAAO,MAAM,aAAa,QAAQ,IAAI,GAAG,OAAO;AAClF,MAAI,aAAa,MAAM;AACrB,UAAM,SAAS,CAAC,WACd,IAAI,MAAM,cAAc,SAAS,OAAO,cAAc,SAAS,IAAI,uCAAuC,MAAM,yBAAyB;AAC3I,QAAI,QAAQ,IAAI,aAAa,MAAM,KAAK;AACtC,cAAQ,OAAO,MAAM,mCAAmC,SAAS,OAAO,KAAK,SAAS,KAAK;AAAA,CAAK;AAAA,IAClG;AACA,QAAI;AACJ,QAAI;AACF,YAAO,MAAM,OAAO,cAAc,SAAS,KAAK,EAAE;AAAA,IACpD,SAAS,GAAG;AACV,YAAM,OAAO,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC;AAAA,IACzD;AACA,QAAI,OAAO,IAAI,KAAK,MAAM,WAAY,OAAM,OAAO,mCAAmC;AACtF,UAAM,cAAc,IAAI,KAAK;AAC7B,UAAM,OAAO,MAAM,YAAY,IAAI;AACnC,WAAO,OAAO,SAAS,WAAW,OAAO;AAAA,EAC3C;AACA,SAAO,IAAI,IAAI;AACjB;AAEA,KAAK,EACF,KAAK,CAAC,SAAS;AACd,UAAQ,WAAW;AACrB,CAAC,EACA,MAAM,CAAC,MAAe;AACrB,UAAQ,WAAW,YAAY,CAAC;AAClC,CAAC;","names":[]}
+{"version":3,"sources":["../../src/bin/rness.ts","../../src/core/node-version.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { pathToFileURL } from 'node:url'\n\nimport { run } from '../cli.ts'\nimport { findDelegate } from '../core/delegate.ts'\nimport { MIN_NODE_MAJOR, isSupportedNode } from '../core/node-version.ts'\nimport { driftWarning } from '../core/pinned.ts'\nimport { reportError } from '../report.ts'\nimport { VERSION } from '../version.ts'\n\n// `rness context | head`: once the reader has its lines it closes the pipe and\n// every further write emits EPIPE on stdout. Nothing is left to deliver, so end\n// quietly with success. This is the one process.exit() in the code base — it\n// runs only when there is no output left to drain (see main() below).\nprocess.stdout.on('error', (e: NodeJS.ErrnoException) => {\n  if (e.code === 'EPIPE') process.exit(0)\n  throw e\n})\n\n// Set process.exitCode rather than calling process.exit(): process.exit()\n// terminates before Node drains an async stdout pipe, truncating piped output\n// at the ~64 KiB pipe buffer (breaks `rness context --json | jq`, `$(...)`).\nasync function main(): Promise<number> {\n  if (!isSupportedNode(process.versions.node)) {\n    process.stderr.write(\n      `rness needs Node ${MIN_NODE_MAJOR} or newer (running ${process.version})\\n`\n    )\n    return 1\n  }\n  const argv = process.argv.slice(2)\n  // `create` makes a workspace and `upgrade` replaces the pinned copy: both\n  // are served by the copy the user invoked (spec 0006 §3). The login concerns\n  // the machine, not a workspace — and git runs `git-credential` from inside\n  // a clone, on every fetch: no delegation, and no warning there either.\n  const own = [\n    'create',\n    'upgrade',\n    'update',\n    'login',\n    'logout',\n    'git-credential',\n  ].includes(argv[0] ?? '')\n  const noDelegate = process.env['RNESS_NO_DELEGATE'] === '1'\n  const skipDelegation = own || noDelegate\n  const command = argv[0]\n  if (\n    command !== undefined &&\n    !command.startsWith('-') &&\n    !own &&\n    !noDelegate\n  ) {\n    const warning = await driftWarning(process.cwd())\n    if (warning !== null) process.stderr.write(`${warning}\\n`)\n  }\n  const delegate = skipDelegation\n    ? null\n    : await findDelegate(process.cwd(), VERSION)\n  if (delegate !== null) {\n    const broken = (reason: string): Error =>\n      new Error(\n        `@rness/cli ${delegate.version} pinned in ${delegate.root}/.rness is not installed correctly (${reason}); reinstall in .rness/`\n      )\n    if (process.env['RNESS_DEBUG'] === '1') {\n      process.stderr.write(\n        `rness: delegating to @rness/cli ${delegate.version} (${delegate.entry})\\n`\n      )\n    }\n    let mod: Record<string, unknown>\n    try {\n      mod = (await import(pathToFileURL(delegate.entry).href)) as Record<\n        string,\n        unknown\n      >\n    } catch (e) {\n      throw broken(e instanceof Error ? e.message : String(e))\n    }\n    if (typeof mod['run'] !== 'function')\n      throw broken('dist/index.js does not export run')\n    const delegateRun = mod['run'] as (argv: string[]) => Promise<unknown>\n    const code = await delegateRun(argv)\n    return typeof code === 'number' ? code : 1\n  }\n  return run(argv)\n}\n\nmain()\n  .then((code) => {\n    process.exitCode = code\n  })\n  .catch((e: unknown) => {\n    process.exitCode = reportError(e)\n  })\n","export const MIN_NODE_MAJOR = 24\n\nexport function nodeMajor(version: string): number {\n  const major = Number.parseInt(version.split('.')[0] ?? '', 10)\n  return Number.isNaN(major) ? 0 : major\n}\n\nexport function isSupportedNode(version: string): boolean {\n  return nodeMajor(version) >= MIN_NODE_MAJOR\n}\n"],"mappings":";;;;;;;;;;AACA,SAAS,qBAAqB;;;ACDvB,IAAM,iBAAiB;AAEvB,SAAS,UAAU,SAAyB;AACjD,QAAM,QAAQ,OAAO,SAAS,QAAQ,MAAM,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE;AAC7D,SAAO,OAAO,MAAM,KAAK,IAAI,IAAI;AACnC;AAEO,SAAS,gBAAgB,SAA0B;AACxD,SAAO,UAAU,OAAO,KAAK;AAC/B;;;ADKA,QAAQ,OAAO,GAAG,SAAS,CAAC,MAA6B;AACvD,MAAI,EAAE,SAAS,QAAS,SAAQ,KAAK,CAAC;AACtC,QAAM;AACR,CAAC;AAKD,eAAe,OAAwB;AACrC,MAAI,CAAC,gBAAgB,QAAQ,SAAS,IAAI,GAAG;AAC3C,YAAQ,OAAO;AAAA,MACb,oBAAoB,cAAc,sBAAsB,QAAQ,OAAO;AAAA;AAAA,IACzE;AACA,WAAO;AAAA,EACT;AACA,QAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;AAKjC,QAAM,MAAM;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,SAAS,KAAK,CAAC,KAAK,EAAE;AACxB,QAAM,aAAa,QAAQ,IAAI,mBAAmB,MAAM;AACxD,QAAM,iBAAiB,OAAO;AAC9B,QAAM,UAAU,KAAK,CAAC;AACtB,MACE,YAAY,UACZ,CAAC,QAAQ,WAAW,GAAG,KACvB,CAAC,OACD,CAAC,YACD;AACA,UAAM,UAAU,MAAM,aAAa,QAAQ,IAAI,CAAC;AAChD,QAAI,YAAY,KAAM,SAAQ,OAAO,MAAM,GAAG,OAAO;AAAA,CAAI;AAAA,EAC3D;AACA,QAAM,WAAW,iBACb,OACA,MAAM,aAAa,QAAQ,IAAI,GAAG,OAAO;AAC7C,MAAI,aAAa,MAAM;AACrB,UAAM,SAAS,CAAC,WACd,IAAI;AAAA,MACF,cAAc,SAAS,OAAO,cAAc,SAAS,IAAI,uCAAuC,MAAM;AAAA,IACxG;AACF,QAAI,QAAQ,IAAI,aAAa,MAAM,KAAK;AACtC,cAAQ,OAAO;AAAA,QACb,mCAAmC,SAAS,OAAO,KAAK,SAAS,KAAK;AAAA;AAAA,MACxE;AAAA,IACF;AACA,QAAI;AACJ,QAAI;AACF,YAAO,MAAM,OAAO,cAAc,SAAS,KAAK,EAAE;AAAA,IAIpD,SAAS,GAAG;AACV,YAAM,OAAO,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC;AAAA,IACzD;AACA,QAAI,OAAO,IAAI,KAAK,MAAM;AACxB,YAAM,OAAO,mCAAmC;AAClD,UAAM,cAAc,IAAI,KAAK;AAC7B,UAAM,OAAO,MAAM,YAAY,IAAI;AACnC,WAAO,OAAO,SAAS,WAAW,OAAO;AAAA,EAC3C;AACA,SAAO,IAAI,IAAI;AACjB;AAEA,KAAK,EACF,KAAK,CAAC,SAAS;AACd,UAAQ,WAAW;AACrB,CAAC,EACA,MAAM,CAAC,MAAe;AACrB,UAAQ,WAAW,YAAY,CAAC;AAClC,CAAC;","names":[]}