@rness/cli 0.4.0 → 0.5.1

package/README.md

@@ -6,7 +6,8 @@ Not an agent — no LLM loop.
 
 ## Install
 
-    npm create rness <org>     # start a workspace for github.com/<org>, or join its .rness
+    npm create rness           # prompts for the organization, then the repositories for your workspace
+    npm create rness acme      # the organization github.com/acme, no first prompt
     npm i -g @rness/cli        # the command is `rness`
     npx @rness/cli --help
 
@@ -15,9 +16,12 @@ Inside a workspace, every `rness` delegates to the copy pinned in
 
 ## Commands
 
-    rness create <org> [--dir <path>] [--repos a,b] [--pm npm|pnpm|yarn|bun] [--ssh] [--skip-install] -y
-    rness add <repo> [--scopes apps/web,packages/ui] [--ssh] -y
-    rness sync [--scope <name>] [--check] [--pull] -y
+    rness create [<org>] [--repos a,b] [--pm npm|pnpm|yarn|bun] [--ssh|--https] [--skip-install] -y
+    rness add <repo> [--scopes apps/web,packages/ui] [--ssh|--https] -y
+    rness sync [--all] [--scope <name>] [--check] [--pull] -y
+    rness upgrade [<version>] -y
+    rness login [--setup-git|--no-setup-git]
+    rness logout
     rness context [--scope <name>] [--json]
     rness validate
 
@@ -25,9 +29,185 @@ Inside a workspace, every `rness` delegates to the copy pinned in
 confirmation in a terminal; pass `-y`/`--yes` in scripts. `sync --check`
 writes nothing and exits 1 when a block is out of date — use it in CI.
 
+### Log in
+
+    rness login     # shows a code and https://github.com/login/device
+    rness logout
+
+`rness login` connects rness to your GitHub account (OAuth device flow: you
+approve a code in a browser, on any machine). Logged in, `create` lists the
+private repositories you can access, offers your organizations to choose
+from, and says as whom it looks at one (`member   acme (as you)`). The
+`create` wizard offers the login itself when it would otherwise list
+anonymously.
+
+- The login is one file, `~/.config/rness/auth.json` (`$XDG_CONFIG_HOME`,
+  `%APPDATA%` on Windows), readable by you only. The access token lives 8
+  hours and is renewed on its own. `GITHUB_TOKEN`, then `GH_TOKEN`, win over
+  it — CI needs no login.
+- rness asks for `repo` and `read:org`: GitHub has no read-only scope for
+  private repositories. It only lists and clones.
+- A new workspace has to reach GitHub before teammates can join it. Logged
+  in, the `create` wizard offers to do it: it creates the private repository
+  `<org>/.rness` and pushes the context with `git`. Declined, refused by
+  GitHub, anonymous or with `--yes`, it prints the two manual steps instead
+  — create the empty repository on github.com, then `git remote add origin …
+&& git push`. No other tool is ever needed.
+- An organization that restricts OAuth apps hides its private repositories
+  until an owner approves "Rness"; `create` says so, with the link.
+- Over HTTPS, rness's own clones and pulls carry the login — through the
+  environment of that one git command, never in a URL or `.git/config`. For
+  your own `git pull` and `git push`, `login` offers to make rness git's
+  credential helper for github.com (`--setup-git`, `--no-setup-git`);
+  `logout` undoes it. It needs a global install (`npm i -g @rness/cli`): a
+  copy run through `npx` lives in a cache. Over SSH none of this is needed.
+  The helper names `node` by its absolute path: after a Node upgrade through
+  a version manager (mise, nvm), run `rness login --setup-git` again.
+- `rness logout` forgets the login; revoke the authorization itself in
+  GitHub's settings (the command prints the link).
+
+### SSH or HTTPS
+
+`create` and `add` test your SSH access to github.com once
+(`ssh -T git@github.com`) and write `git@github.com:` URLs when GitHub accepts
+your key, `https://github.com/` ones otherwise; `--ssh` and `--https` decide
+without the test. In a terminal `ssh` may ask for your key's passphrase;
+without one (`--yes`, CI) it never prompts, so a key that needs a passphrase
+counts as no access unless an agent holds it.
+
+`rness.json` is authoritative: a URL written there is cloned as written, never
+converted. In a workspace whose catalogue clones over SSH, `create` (joining)
+and `sync` stop before the first clone when the SSH test fails and say how to
+set up a key; `add` offers "Clone <name> over HTTPS instead?" (or `--https`),
+which writes an HTTPS URL for that repository only.
+
+Without an agent, a protected key is asked for again by every `git clone`.
+Load it once per session: `ssh-add --apple-use-keychain ~/.ssh/id_ed25519` on
+macOS, `ssh-add ~/.ssh/id_ed25519` elsewhere.
+
+### Colour
+
+In a terminal `create`, `login`, `add`, `sync` and `upgrade` run as one
+session: an intro, a line per finished step, spinners, a "Next" box, an
+outro — in the same gutter as the questions. A spinner never animates while
+git might ask for a passphrase: rness first tests SSH unattended, and clones
+animate only when that passed. The help and the banner are coloured. Through a pipe, in CI, or with `NO_COLOR=1`, the output is plain text —
+the same bytes as before 0.5.0; `FORCE_COLOR=1` paints it anyway. No
+dependency does this: `util.styleText`, and a banner kept as a constant.
+
+### Upgrade
+
+    rness upgrade            # the latest release; `rness upgrade 0.5.0` for another
+    npx @rness/cli@latest upgrade     # from a workspace pinned below 0.5.0
+
+The version is written in one place, `.rness/package.json`. `upgrade` pins it
+there (exact, the rest of the file untouched), installs with the workspace's
+package manager, then syncs through the new copy; a failed install restores
+the file. Commit `.rness`. Teammates pull, and the next `rness` command in that
+workspace installs the new pin itself — frozen, so the working tree stays
+clean — and carries on: nothing to remember, nothing to run.
+`RNESS_NO_INSTALL=1` turns that off and restores the warning, for CI, a
+container image, or a machine that cannot install. A workspace still on 0.5.0
+has no such catch-up: moving it to 0.5.1 is the last manual install.
+
+Usually nobody runs `upgrade` at all. A workspace ships
+`.github/dependabot.yml`, so each release opens a pull request on the
+organization's `.rness`: the pin and the lockfile in the diff, `validate`
+running on the new version, review, merge. `upgrade` writes that file into
+workspaces created before 0.5.1.
+
+`upgrade` is never delegated to the pinned copy, which is what it replaces
+— so a workspace pinned below 0.5.0, whose copy has no such command, starts
+with the `npx` form.
+
+An upgrade touches `.rness` only: a generated block is current when its hash
+is, whatever wrote it, so no `AGENTS.md` of the organization changes unless
+its content does.
+
 Exit codes: 0 success, 1 failure, 2 usage — or a refusal without a TTY.
 `RNESS_DEBUG=1` adds stack traces; `RNESS_NO_DELEGATE=1` skips the delegation.
 
+## 0.5.1 — the version of a workspace moves by pull request
+
+- Joining an organization pinned to an older `@rness/cli` no longer mentions
+  versions, and no longer invites a newcomer to move the whole team: the
+  workspace is served by the version the organization agreed on.
+- A workspace whose pin moved is reinstalled on the next command, with the
+  package manager's frozen install so the working tree stays clean. Set
+  `RNESS_NO_INSTALL=1` to keep the old warning instead — for CI, a container
+  image, or a machine that cannot install.
+- New workspaces ship `.github/dependabot.yml`, and `rness upgrade` writes it
+  into workspaces created earlier: a pull request per release, reviewed, with
+  `validate` running on the new version before the merge.
+- A delegated child can no longer wait on an invisible SSH passphrase prompt:
+  it fails with a readable line instead of hanging.
+- A join that wrote its blocks succeeds even when a repository nobody picked
+  failed to clone; those failures are hints.
+
+## 0.5.0 — the organization is the workspace; rness.json is its catalogue
+
+- `create <org>` names the organization, not a directory any more (`--org
+<org>` and the prompt "What is your GitHub organization named?" do the
+  same). The workspace directory is `./<org>`, with the organization's exact
+  name; `--dir` is removed. With `npm create`, flags go after `--`:
+  `npm create rness acme -- --yes`.
+- SSH first: `create` and `add` write `git@github.com:` URLs when
+  `ssh -T git@github.com` accepts your key, HTTPS ones otherwise (0.4.0
+  wrote HTTPS unless `--ssh`). `--https` is new. A private `.rness` you reach
+  over SSH is now found when joining. See "SSH or HTTPS" above.
+- `create` does not offer repositories whose name starts with a dot
+  (`.github`, …).
+- Colour, a banner and progress lines in a terminal (see "Colour" above);
+  nothing changes for scripts.
+- `rness login` / `rness logout` are new: private repositories are listed,
+  and cloned over HTTPS with the login (see "Log in" above). Without a login
+  the note reads `rness login lists the private ones you can access`.
+- `rness upgrade` is new (see "Upgrade" above). From 0.4.0:
+  `npx @rness/cli@latest upgrade`.
+- The header of a generated block no longer names the CLI version
+  (`<!-- rness · scope: … -->`), and `sync` decides by the hash like
+  `validate`: upgrading rewrites no `AGENTS.md`. Blocks written by 0.2–0.4
+  stay as they are until their content changes. A 0.4.0 CLI calls the new
+  header stale — upgrade every copy together.
+- The scaffold's CI workflow reads the version from `package.json` instead of
+  naming it; `upgrade` migrates the old line.
+- `.rness/rness.json` is the organization's catalogue — every repository
+  rness knows about, shared by the team. Your workspace is the part of it
+  you cloned into `org/`; two teammates can clone different repositories,
+  and nothing but `org/` records the choice. A choice never removes a
+  repository from the catalogue.
+- `create` lists the organization's repositories to search and pick from,
+  with every catalogue repository pre-selected when joining (a catalogue
+  repository the listing does not return is still offered, marked
+  `in .rness`). A picked catalogue repository is cloned; a picked new one is
+  added to the catalogue, as `rness add` does. Without a picker, `--repos`
+  is the selection; a join without `--repos` clones the whole catalogue. A
+  cancelled or declined prompt writes nothing and exits 0.
+- The listing needs no credentials. Without a `GITHUB_TOKEN` (or `GH_TOKEN`)
+  only public repositories are listed — and a personal account always lists
+  only its public ones; add the others later with `rness add <repo>`.
+- `rness sync` works on your clones: it writes the blocks of the repositories
+  in `org/`, never of `rness.json` as a whole. In a terminal it asks "Do you
+  want to sync as well?" with the catalogue repositories you have not cloned
+  ("Select all", or pick some); what you pick is cloned first. With `--yes`,
+  or `--check`, nothing is cloned and one `not cloned:` line names them
+  (`--check` does not fail on it). `rness sync --all` clones them all without
+  asking. A clone `rness.json` does not know gets no block and a
+  `not in rness.json:` line pointing at `rness add`.
+- A workspace pinned to 0.4.x clones every catalogue repository on sync —
+  `create` runs the pinned copy's sync after joining.
+- Joining a workspace whose `.rness` pins an older `@rness/cli` than the one
+  you run says so, and that `rness upgrade` moves it.
+- Repository and scope names take what GitHub allows, in lowercase: letters,
+  digits, `.`, `_` and `-` (`my_lib`, `angular.js`). A name that differs only
+  by case is declared in lowercase. A 0.4.0 CLI rejects a `rness.json` that
+  holds a `.` or a `_` in a name — upgrade every copy together.
+- Organization names follow GitHub's rule — letters, digits and single
+  hyphens, not at either end, at most 39 characters — in `--org` and in
+  `rness.json`'s `"org"`; the case is kept as typed.
+- `"org"` in `rness.json` now accepts uppercase letters: a 0.4.0 CLI rejects
+  a workspace whose `"org"` has any, so upgrade every copy together.
+
 ## 0.4.0 — create, add, the shims
 
 - `npm create rness <org>` starts a new workspace for `github.com/<org>` or
@@ -57,9 +237,26 @@ Exit codes: 0 success, 1 failure, 2 usage — or a refusal without a TTY.
     pnpm --filter @rness/cli test     # node:test on the TypeScript sources
     pnpm --filter @rness/cli typecheck
     pnpm --filter @rness/cli build    # tsup → dist/
-    RNESS_NO_DELEGATE=1 node packages/cli/src/bin/rness.ts --help
+    pnpm dev --help                   # the CLI, straight from these sources
+
+`pnpm dev` runs `packages/cli/src/bin/rness.ts`: Node ≥ 24 strips the types,
+so nothing is built between an edit and the next run. It turns delegation off,
+because inside a workspace the launcher would otherwise hand the command to the
+published `@rness/cli` pinned in `.rness/` rather than to the sources under
+test; `RNESS_NO_DELEGATE=0 pnpm dev …` puts it back, to exercise delegation
+itself.
+
+To reach it from a workspace elsewhere on the machine, link it once:
+
+    ln -s "$PWD/scripts/dev.mjs" ~/.local/bin/rness-dev   # from the repository root
+    cd ~/somewhere/acme && rness-dev validate
+
+`create` is never delegated, so it always runs these sources — and it refuses
+to run inside a workspace, so call it from an empty directory.
 
-Inside a workspace whose `.rness/` pins a published `@rness/cli`, set
-`RNESS_NO_DELEGATE=1` to run this source tree instead of delegating.
+`pnpm verdaccio` is the other loop: a local registry that serves this build as
+a real package, for what only shows up through an install (`npm create rness`,
+the pinned copy, a version bump). It is slower, and its caches have to be
+forgotten on every redeploy, which `deploy` now does.
 
 Node ≥ 24. MIT.

package/dist/bin/rness.js

@@ -1,12 +1,18 @@
 #!/usr/bin/env node
 import {
   VERSION,
+  driftWarning,
+  ensureInstalled,
   findDelegate,
+  findWorkspace,
+  pinDrift,
+  pinnedBinPath,
   reportError,
   run
-} from "../chunk-IW5IHSPC.js";
+} from "../chunk-C6HBGV5V.js";
 
 // src/bin/rness.ts
+import { spawnSync } from "child_process";
 import { pathToFileURL } from "url";
 
 // src/core/node-version.ts
@@ -33,7 +39,39 @@ async function main() {
     return 1;
   }
   const argv = process.argv.slice(2);
-  const skipDelegation = argv[0] === "create" || process.env["RNESS_NO_DELEGATE"] === "1";
+  const own = [
+    "create",
+    "upgrade",
+    "update",
+    "login",
+    "logout",
+    "git-credential"
+  ].includes(argv[0] ?? "");
+  const noDelegate = process.env["RNESS_NO_DELEGATE"] === "1";
+  const skipDelegation = own || noDelegate;
+  const command = argv[0];
+  if (command !== void 0 && !command.startsWith("-") && !skipDelegation) {
+    const ws = await findWorkspace(process.cwd()).catch(() => null);
+    const outcome = ws === null ? null : await ensureInstalled(ws.rnessDir, {
+      announce: (pin) => process.stderr.write(`installing @rness/cli ${pin} in .rness\u2026
+`)
+    });
+    if (outcome !== null && !outcome.installed) {
+      const warning = await driftWarning(process.cwd());
+      if (warning !== null) process.stderr.write(`${warning}
+`);
+    }
+    if (ws !== null && outcome?.installed === true && await pinDrift(ws.rnessDir) === null) {
+      const pinnedBin = await pinnedBinPath(ws.rnessDir);
+      if (pinnedBin !== null) {
+        const { status } = spawnSync(process.execPath, [pinnedBin, ...argv], {
+          cwd: process.cwd(),
+          stdio: "inherit"
+        });
+        return status ?? 1;
+      }
+    }
+  }
   const delegate = skipDelegation ? null : await findDelegate(process.cwd(), VERSION);
   if (delegate !== null) {
     const broken = (reason) => new Error(

package/dist/bin/rness.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/bin/rness.ts","../../src/core/node-version.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { pathToFileURL } from 'node:url'\n\nimport { run } from '../cli.ts'\nimport { findDelegate } from '../core/delegate.ts'\nimport { MIN_NODE_MAJOR, isSupportedNode } from '../core/node-version.ts'\nimport { reportError } from '../report.ts'\nimport { VERSION } from '../version.ts'\n\n// `rness context | head`: once the reader has its lines it closes the pipe and\n// every further write emits EPIPE on stdout. Nothing is left to deliver, so end\n// quietly with success. This is the one process.exit() in the code base — it\n// runs only when there is no output left to drain (see main() below).\nprocess.stdout.on('error', (e: NodeJS.ErrnoException) => {\n  if (e.code === 'EPIPE') process.exit(0)\n  throw e\n})\n\n// Set process.exitCode rather than calling process.exit(): process.exit()\n// terminates before Node drains an async stdout pipe, truncating piped output\n// at the ~64 KiB pipe buffer (breaks `rness context --json | jq`, `$(...)`).\nasync function main(): Promise<number> {\n  if (!isSupportedNode(process.versions.node)) {\n    process.stderr.write(\n      `rness needs Node ${MIN_NODE_MAJOR} or newer (running ${process.version})\\n`\n    )\n    return 1\n  }\n  const argv = process.argv.slice(2)\n  const skipDelegation =\n    argv[0] === 'create' || process.env['RNESS_NO_DELEGATE'] === '1'\n  const delegate = skipDelegation\n    ? null\n    : await findDelegate(process.cwd(), VERSION)\n  if (delegate !== null) {\n    const broken = (reason: string): Error =>\n      new Error(\n        `@rness/cli ${delegate.version} pinned in ${delegate.root}/.rness is not installed correctly (${reason}); reinstall in .rness/`\n      )\n    if (process.env['RNESS_DEBUG'] === '1') {\n      process.stderr.write(\n        `rness: delegating to @rness/cli ${delegate.version} (${delegate.entry})\\n`\n      )\n    }\n    let mod: Record<string, unknown>\n    try {\n      mod = (await import(pathToFileURL(delegate.entry).href)) as Record<\n        string,\n        unknown\n      >\n    } catch (e) {\n      throw broken(e instanceof Error ? e.message : String(e))\n    }\n    if (typeof mod['run'] !== 'function')\n      throw broken('dist/index.js does not export run')\n    const delegateRun = mod['run'] as (argv: string[]) => Promise<unknown>\n    const code = await delegateRun(argv)\n    return typeof code === 'number' ? code : 1\n  }\n  return run(argv)\n}\n\nmain()\n  .then((code) => {\n    process.exitCode = code\n  })\n  .catch((e: unknown) => {\n    process.exitCode = reportError(e)\n  })\n","export const MIN_NODE_MAJOR = 24\n\nexport function nodeMajor(version: string): number {\n  const major = Number.parseInt(version.split('.')[0] ?? '', 10)\n  return Number.isNaN(major) ? 0 : major\n}\n\nexport function isSupportedNode(version: string): boolean {\n  return nodeMajor(version) >= MIN_NODE_MAJOR\n}\n"],"mappings":";;;;;;;;;AACA,SAAS,qBAAqB;;;ACDvB,IAAM,iBAAiB;AAEvB,SAAS,UAAU,SAAyB;AACjD,QAAM,QAAQ,OAAO,SAAS,QAAQ,MAAM,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE;AAC7D,SAAO,OAAO,MAAM,KAAK,IAAI,IAAI;AACnC;AAEO,SAAS,gBAAgB,SAA0B;AACxD,SAAO,UAAU,OAAO,KAAK;AAC/B;;;ADIA,QAAQ,OAAO,GAAG,SAAS,CAAC,MAA6B;AACvD,MAAI,EAAE,SAAS,QAAS,SAAQ,KAAK,CAAC;AACtC,QAAM;AACR,CAAC;AAKD,eAAe,OAAwB;AACrC,MAAI,CAAC,gBAAgB,QAAQ,SAAS,IAAI,GAAG;AAC3C,YAAQ,OAAO;AAAA,MACb,oBAAoB,cAAc,sBAAsB,QAAQ,OAAO;AAAA;AAAA,IACzE;AACA,WAAO;AAAA,EACT;AACA,QAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;AACjC,QAAM,iBACJ,KAAK,CAAC,MAAM,YAAY,QAAQ,IAAI,mBAAmB,MAAM;AAC/D,QAAM,WAAW,iBACb,OACA,MAAM,aAAa,QAAQ,IAAI,GAAG,OAAO;AAC7C,MAAI,aAAa,MAAM;AACrB,UAAM,SAAS,CAAC,WACd,IAAI;AAAA,MACF,cAAc,SAAS,OAAO,cAAc,SAAS,IAAI,uCAAuC,MAAM;AAAA,IACxG;AACF,QAAI,QAAQ,IAAI,aAAa,MAAM,KAAK;AACtC,cAAQ,OAAO;AAAA,QACb,mCAAmC,SAAS,OAAO,KAAK,SAAS,KAAK;AAAA;AAAA,MACxE;AAAA,IACF;AACA,QAAI;AACJ,QAAI;AACF,YAAO,MAAM,OAAO,cAAc,SAAS,KAAK,EAAE;AAAA,IAIpD,SAAS,GAAG;AACV,YAAM,OAAO,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC;AAAA,IACzD;AACA,QAAI,OAAO,IAAI,KAAK,MAAM;AACxB,YAAM,OAAO,mCAAmC;AAClD,UAAM,cAAc,IAAI,KAAK;AAC7B,UAAM,OAAO,MAAM,YAAY,IAAI;AACnC,WAAO,OAAO,SAAS,WAAW,OAAO;AAAA,EAC3C;AACA,SAAO,IAAI,IAAI;AACjB;AAEA,KAAK,EACF,KAAK,CAAC,SAAS;AACd,UAAQ,WAAW;AACrB,CAAC,EACA,MAAM,CAAC,MAAe;AACrB,UAAQ,WAAW,YAAY,CAAC;AAClC,CAAC;","names":[]}
+{"version":3,"sources":["../../src/bin/rness.ts","../../src/core/node-version.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { spawnSync } from 'node:child_process'\nimport { pathToFileURL } from 'node:url'\n\nimport { run } from '../cli.ts'\nimport { findDelegate, pinnedBinPath } from '../core/delegate.ts'\nimport { MIN_NODE_MAJOR, isSupportedNode } from '../core/node-version.ts'\nimport { driftWarning, ensureInstalled, pinDrift } from '../core/pinned.ts'\nimport { findWorkspace } from '../core/workspace.ts'\nimport { reportError } from '../report.ts'\nimport { VERSION } from '../version.ts'\n\n// `rness context | head`: once the reader has its lines it closes the pipe and\n// every further write emits EPIPE on stdout. Nothing is left to deliver, so end\n// quietly with success. This is the one process.exit() in the code base — it\n// runs only when there is no output left to drain (see main() below).\nprocess.stdout.on('error', (e: NodeJS.ErrnoException) => {\n  if (e.code === 'EPIPE') process.exit(0)\n  throw e\n})\n\n// Set process.exitCode rather than calling process.exit(): process.exit()\n// terminates before Node drains an async stdout pipe, truncating piped output\n// at the ~64 KiB pipe buffer (breaks `rness context --json | jq`, `$(...)`).\nasync function main(): Promise<number> {\n  if (!isSupportedNode(process.versions.node)) {\n    process.stderr.write(\n      `rness needs Node ${MIN_NODE_MAJOR} or newer (running ${process.version})\\n`\n    )\n    return 1\n  }\n  const argv = process.argv.slice(2)\n  // `create` makes a workspace and `upgrade` replaces the pinned copy: both\n  // are served by the copy the user invoked (spec 0006 §3). The login concerns\n  // the machine, not a workspace — and git runs `git-credential` from inside\n  // a clone, on every fetch: no delegation, and no warning there either.\n  const own = [\n    'create',\n    'upgrade',\n    'update',\n    'login',\n    'logout',\n    'git-credential',\n  ].includes(argv[0] ?? '')\n  const noDelegate = process.env['RNESS_NO_DELEGATE'] === '1'\n  const skipDelegation = own || noDelegate\n  const command = argv[0]\n  if (command !== undefined && !command.startsWith('-') && !skipDelegation) {\n    const ws = await findWorkspace(process.cwd()).catch(() => null)\n    // The version was decided by the pull request that moved the pin, so\n    // catching up asks nothing (spec 0008 §4).\n    const outcome =\n      ws === null\n        ? null\n        : await ensureInstalled(ws.rnessDir, {\n            announce: (pin) =>\n              process.stderr.write(`installing @rness/cli ${pin} in .rness…\\n`),\n          })\n    if (outcome !== null && !outcome.installed) {\n      const warning = await driftWarning(process.cwd())\n      if (warning !== null) process.stderr.write(`${warning}\\n`)\n    }\n    // The pinned tree was just rebuilt: importing out of it in this process is\n    // fragile, so the freshly installed copy runs as its own process.\n    // Only hand off when the install actually closed the drift: a child that\n    // would install again on every run must never be spawned.\n    if (\n      ws !== null &&\n      outcome?.installed === true &&\n      (await pinDrift(ws.rnessDir)) === null\n    ) {\n      const pinnedBin = await pinnedBinPath(ws.rnessDir)\n      if (pinnedBin !== null) {\n        const { status } = spawnSync(process.execPath, [pinnedBin, ...argv], {\n          cwd: process.cwd(),\n          stdio: 'inherit',\n        })\n        return status ?? 1\n      }\n    }\n  }\n  const delegate = skipDelegation\n    ? null\n    : await findDelegate(process.cwd(), VERSION)\n  if (delegate !== null) {\n    const broken = (reason: string): Error =>\n      new Error(\n        `@rness/cli ${delegate.version} pinned in ${delegate.root}/.rness is not installed correctly (${reason}); reinstall in .rness/`\n      )\n    if (process.env['RNESS_DEBUG'] === '1') {\n      process.stderr.write(\n        `rness: delegating to @rness/cli ${delegate.version} (${delegate.entry})\\n`\n      )\n    }\n    let mod: Record<string, unknown>\n    try {\n      mod = (await import(pathToFileURL(delegate.entry).href)) as Record<\n        string,\n        unknown\n      >\n    } catch (e) {\n      throw broken(e instanceof Error ? e.message : String(e))\n    }\n    if (typeof mod['run'] !== 'function')\n      throw broken('dist/index.js does not export run')\n    const delegateRun = mod['run'] as (argv: string[]) => Promise<unknown>\n    const code = await delegateRun(argv)\n    return typeof code === 'number' ? code : 1\n  }\n  return run(argv)\n}\n\nmain()\n  .then((code) => {\n    process.exitCode = code\n  })\n  .catch((e: unknown) => {\n    process.exitCode = reportError(e)\n  })\n","export const MIN_NODE_MAJOR = 24\n\nexport function nodeMajor(version: string): number {\n  const major = Number.parseInt(version.split('.')[0] ?? '', 10)\n  return Number.isNaN(major) ? 0 : major\n}\n\nexport function isSupportedNode(version: string): boolean {\n  return nodeMajor(version) >= MIN_NODE_MAJOR\n}\n"],"mappings":";;;;;;;;;;;;;;AACA,SAAS,iBAAiB;AAC1B,SAAS,qBAAqB;;;ACFvB,IAAM,iBAAiB;AAEvB,SAAS,UAAU,SAAyB;AACjD,QAAM,QAAQ,OAAO,SAAS,QAAQ,MAAM,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE;AAC7D,SAAO,OAAO,MAAM,KAAK,IAAI,IAAI;AACnC;AAEO,SAAS,gBAAgB,SAA0B;AACxD,SAAO,UAAU,OAAO,KAAK;AAC/B;;;ADOA,QAAQ,OAAO,GAAG,SAAS,CAAC,MAA6B;AACvD,MAAI,EAAE,SAAS,QAAS,SAAQ,KAAK,CAAC;AACtC,QAAM;AACR,CAAC;AAKD,eAAe,OAAwB;AACrC,MAAI,CAAC,gBAAgB,QAAQ,SAAS,IAAI,GAAG;AAC3C,YAAQ,OAAO;AAAA,MACb,oBAAoB,cAAc,sBAAsB,QAAQ,OAAO;AAAA;AAAA,IACzE;AACA,WAAO;AAAA,EACT;AACA,QAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;AAKjC,QAAM,MAAM;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,SAAS,KAAK,CAAC,KAAK,EAAE;AACxB,QAAM,aAAa,QAAQ,IAAI,mBAAmB,MAAM;AACxD,QAAM,iBAAiB,OAAO;AAC9B,QAAM,UAAU,KAAK,CAAC;AACtB,MAAI,YAAY,UAAa,CAAC,QAAQ,WAAW,GAAG,KAAK,CAAC,gBAAgB;AACxE,UAAM,KAAK,MAAM,cAAc,QAAQ,IAAI,CAAC,EAAE,MAAM,MAAM,IAAI;AAG9D,UAAM,UACJ,OAAO,OACH,OACA,MAAM,gBAAgB,GAAG,UAAU;AAAA,MACjC,UAAU,CAAC,QACT,QAAQ,OAAO,MAAM,yBAAyB,GAAG;AAAA,CAAe;AAAA,IACpE,CAAC;AACP,QAAI,YAAY,QAAQ,CAAC,QAAQ,WAAW;AAC1C,YAAM,UAAU,MAAM,aAAa,QAAQ,IAAI,CAAC;AAChD,UAAI,YAAY,KAAM,SAAQ,OAAO,MAAM,GAAG,OAAO;AAAA,CAAI;AAAA,IAC3D;AAKA,QACE,OAAO,QACP,SAAS,cAAc,QACtB,MAAM,SAAS,GAAG,QAAQ,MAAO,MAClC;AACA,YAAM,YAAY,MAAM,cAAc,GAAG,QAAQ;AACjD,UAAI,cAAc,MAAM;AACtB,cAAM,EAAE,OAAO,IAAI,UAAU,QAAQ,UAAU,CAAC,WAAW,GAAG,IAAI,GAAG;AAAA,UACnE,KAAK,QAAQ,IAAI;AAAA,UACjB,OAAO;AAAA,QACT,CAAC;AACD,eAAO,UAAU;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AACA,QAAM,WAAW,iBACb,OACA,MAAM,aAAa,QAAQ,IAAI,GAAG,OAAO;AAC7C,MAAI,aAAa,MAAM;AACrB,UAAM,SAAS,CAAC,WACd,IAAI;AAAA,MACF,cAAc,SAAS,OAAO,cAAc,SAAS,IAAI,uCAAuC,MAAM;AAAA,IACxG;AACF,QAAI,QAAQ,IAAI,aAAa,MAAM,KAAK;AACtC,cAAQ,OAAO;AAAA,QACb,mCAAmC,SAAS,OAAO,KAAK,SAAS,KAAK;AAAA;AAAA,MACxE;AAAA,IACF;AACA,QAAI;AACJ,QAAI;AACF,YAAO,MAAM,OAAO,cAAc,SAAS,KAAK,EAAE;AAAA,IAIpD,SAAS,GAAG;AACV,YAAM,OAAO,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC;AAAA,IACzD;AACA,QAAI,OAAO,IAAI,KAAK,MAAM;AACxB,YAAM,OAAO,mCAAmC;AAClD,UAAM,cAAc,IAAI,KAAK;AAC7B,UAAM,OAAO,MAAM,YAAY,IAAI;AACnC,WAAO,OAAO,SAAS,WAAW,OAAO;AAAA,EAC3C;AACA,SAAO,IAAI,IAAI;AACjB;AAEA,KAAK,EACF,KAAK,CAAC,SAAS;AACd,UAAQ,WAAW;AACrB,CAAC,EACA,MAAM,CAAC,MAAe;AACrB,UAAQ,WAAW,YAAY,CAAC;AAClC,CAAC;","names":[]}