@slip-stream-kit/config 0.1.136

package/dist/entry/index.d.ts

@@ -0,0 +1,4 @@
+export { defineConfig } from '../lib/package-config/package-config';
+export type { InfraKitDev, InfraKitDevProxy, InfraKitDevProxyRoute, InfraKitDevProxySource, InfraKitPackageConfig, InfraKitPackageConfigInput, } from '../lib/package-config/package-config';
+export { defineVendorConfig } from '../lib/vendor/config-schema';
+export type { VendorConfig, VendorCopyItem } from '../lib/vendor/config-schema';

package/dist/entry/internal.d.ts

@@ -0,0 +1,5 @@
+export { packageConfigSchema } from '../lib/package-config/package-config-schema';
+export { DEFAULT_RELEASE_SLUG, slugifyHostLabel, slugifyRelease } from '../lib/release-slug/release-slug';
+export { defineVendorConfig, VENDOR_CONFIG_FILE, vendorConfigSchema, vendorCopyItemSchema, } from '../lib/vendor/config-schema';
+export type { VendorConfig, VendorCopyItem } from '../lib/vendor/config-schema';
+export { DEV_CONTEXT_WIRE_VERSION, loadDev, readLocalContext, readLocalSet } from '../lib/vite/vite';

package/dist/entry/vite.d.ts

@@ -0,0 +1,2 @@
+export { infraKitDev, infraKitProxy, resolveProxyConfig, slugifyRelease } from '../lib/vite/vite';
+export type { InfraKitBasicAuth, InfraKitDevOptions, InfraKitViteProxy, InfraKitViteProxyEntry } from '../lib/vite/vite';

package/dist/index.js

@@ -0,0 +1,34 @@
+// src/lib/package-config/package-config.ts
+var defineConfig = (config) => {
+  return config;
+};
+
+// src/lib/vendor/config-schema.ts
+import { z } from "zod";
+var safeRelPath = z.string().refine(
+  (p) => {
+    const isAbsolute = /^(?:[/\\]|[a-z]:)/i.test(p);
+    const hasDotDotSegment = p.split(/[\\/]/).includes("..");
+    return !isAbsolute && !hasDotDotSegment && p.trim().length > 0;
+  },
+  { message: 'must be a non-empty repo-relative path without ".." segments' }
+);
+var vendorCopyItemSchema = z.object({
+  name: z.string(),
+  source: safeRelPath,
+  target: safeRelPath,
+  type: z.enum(["file", "directory"]),
+  vendored: z.boolean().optional()
+});
+var vendorConfigSchema = z.object({
+  /** Files/dirs to copy. Items with `vendored: true` land under `vendor/`. */
+  copy: z.array(vendorCopyItemSchema)
+}).strict();
+var defineVendorConfig = (config) => {
+  return config;
+};
+export {
+  defineConfig,
+  defineVendorConfig
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/lib/package-config/package-config.ts", "../src/lib/vendor/config-schema.ts"],
+  "sourcesContent": ["/**\n * Validation rules for a single workspace package, declared in its\n * `infra-kit.config.ts`. Every field is optional: a key left unset falls back to\n * the active baseline, and a key set replaces that default wholesale (per-key, no\n * array concatenation) so a package can opt out with an explicit empty array.\n *\n * The baselines themselves (`DEFAULT_RULES` / `ROOT_DEFAULT_RULES`) deliberately do\n * NOT live here \u2014 they are audit POLICY, and policy belongs to the `infra-kit` CLI\n * that enforces it, not to the package a consumer installs to author a config.\n *\n * Most packages need none of these \u2014 the standard rules live in the baseline, so\n * a typical config is just `defineConfig(() => ({}))`.\n *\n * @example\n * // infra-kit.config.ts\n * import { defineConfig } from '@slip-stream-kit/config'\n *\n * export default defineConfig(() => ({}))\n */\nexport interface InfraKitPackageConfig {\n  /** Scripts that must be present in the package's package.json `scripts` map. */\n  requiredScripts?: string[]\n  /** Files (relative to the package root) that must exist on disk. */\n  requiredFiles?: string[]\n  /** Turborepo expectations \u2014 only meaningful where a turbo.json lives (the root). */\n  turbo?: {\n    /** Tasks that must be defined in turbo.json `tasks`. */\n    requiredTasks?: string[]\n  }\n  /** Local-dev configuration. Accepted-and-inert to the audit; consumed by the dev server. */\n  dev?: InfraKitDev\n}\n\n/** A proxy route's allowed backend source. */\nexport type InfraKitDevProxySource = 'local' | 'cloud'\n\nexport interface InfraKitDevProxyRoute {\n  /** Backend package this route targets when resolved locally. */\n  packageName: string\n  /** Capabilities this route can resolve to. Must be non-empty. */\n  from: InfraKitDevProxySource[]\n  /**\n   * Source used when a local backend for this package isn't active. Required when\n   * `from` lists more than one source; redundant (and omitted) for a single-source\n   * route. When set, must be one of `from`.\n   */\n  default?: InfraKitDevProxySource\n}\n\nexport interface InfraKitDevProxy {\n  /** URL templates. Placeholders like `<release>`/`<packageName>`/`<env>` are substituted at dev time. */\n  templates: {\n    local: string\n    cloud: string\n  }\n  /** Path-prefix (e.g. `/api`, `/api/v1`, `/media`) \u2192 route definition. */\n  routes: Record<string, InfraKitDevProxyRoute>\n}\n\nexport interface InfraKitDev {\n  proxy?: InfraKitDevProxy\n}\n\n/**\n * Accepted shapes for a package config's default export \u2014 mirrors Vite's\n * `defineConfig` input: a plain object, a sync factory, or an async factory.\n */\nexport type InfraKitPackageConfigInput =\n  InfraKitPackageConfig | (() => InfraKitPackageConfig) | (() => Promise<InfraKitPackageConfig>)\n\n/**\n * Identity helper that gives `infra-kit.config.ts` authors full type inference\n * and editor autocomplete without changing the value \u2014 exactly like Vite's\n * `defineConfig`. Resolution of the factory form happens in the CLI's loader, not here.\n *\n * @example\n * export default defineConfig(() => ({}))\n *\n * @example\n * export default defineConfig(() => ({ requiredScripts: [] }))\n */\nexport const defineConfig = (config: InfraKitPackageConfigInput): InfraKitPackageConfigInput => {\n  return config\n}\n", "import { z } from 'zod'\n\n/**\n * Pure (node-free) vendor config schema + authoring helper. Kept separate from\n * `config.ts` (which imports node builtins for the runtime loader) so the public\n * lib entry can re-export `defineVendorConfig` without dragging node types into\n * the emitted `.d.ts`.\n */\n\n/**\n * Filename a source repo provides at its root to declare WHAT `vendor sync`\n * copies (`copy[]`). Lives ONLY on the write path \u2014 `vendor check` never loads it.\n * WHERE/WHICH to stamp (`workspaceDir` + `targets`) is machine-local and lives in\n * the user-global factory config (`~/.infra-kit/vendor.json`).\n */\nexport const VENDOR_CONFIG_FILE = 'vendor.config.ts'\n\n/**\n * A non-empty, repo-relative path with no `..` segments and no absolute prefix\n * (POSIX `/`, UNC/`\\`, or a Windows drive like `C:`). Containment guard for\n * vendor copy items so a malicious/typo config can't read or write outside the\n * source/target repo roots. Kept as a string/regex check (no `node:path`) to\n * respect this file's node-free constraint \u2014 `sync-ops.ts` does the resolved\n * runtime containment assert as defense in depth.\n */\nconst safeRelPath = z.string().refine(\n  (p) => {\n    const isAbsolute = /^(?:[/\\\\]|[a-z]:)/i.test(p)\n    const hasDotDotSegment = p.split(/[\\\\/]/).includes('..')\n\n    return !isAbsolute && !hasDotDotSegment && p.trim().length > 0\n  },\n  { message: 'must be a non-empty repo-relative path without \"..\" segments' },\n)\n\n/**\n * One item to sync from the source repo into each target. `vendored: true` marks\n * workspace packages that must land under `vendor/` (the single-source-of-truth\n * code); everything else is root-level tooling that stays at the repo root.\n */\nexport const vendorCopyItemSchema = z.object({\n  name: z.string(),\n  source: safeRelPath,\n  target: safeRelPath,\n  type: z.enum(['file', 'directory']),\n  vendored: z.boolean().optional(),\n})\n\nexport const vendorConfigSchema = z\n  .object({\n    /** Files/dirs to copy. Items with `vendored: true` land under `vendor/`. */\n    copy: z.array(vendorCopyItemSchema),\n  })\n  // Reject stray keys so a leftover `targets` (now machine-local, in\n  // ~/.infra-kit/vendor.json) yields a clear \"unrecognized key\" error rather\n  // than being silently ignored.\n  .strict()\n\nexport type VendorCopyItem = z.infer<typeof vendorCopyItemSchema>\nexport type VendorConfig = z.infer<typeof vendorConfigSchema>\n\n/**\n * Identity helper for authoring a type-safe `vendor.config.ts` in a source repo.\n * Re-exported from the public lib entry so a source repo can\n * `import { defineVendorConfig } from 'infra-kit'`.\n *\n * NOTE: a `vendor.config.ts` must be type-strippable \u2014 Node's native type\n * stripping (Node >= 24) loads it without a build step, which forbids `enum`,\n * `namespace`, and parameter properties.\n *\n * @example\n * export default defineVendorConfig({\n *   copy: [{ name: 'Configs', source: 'vendor/configs', target: 'vendor/configs', type: 'directory', vendored: true }],\n * })\n */\nexport const defineVendorConfig = (config: VendorConfig): VendorConfig => {\n  return config\n}\n"],
+  "mappings": ";AAiFO,IAAM,eAAe,CAAC,WAAmE;AAC9F,SAAO;AACT;;;ACnFA,SAAS,SAAS;AAyBlB,IAAM,cAAc,EAAE,OAAO,EAAE;AAAA,EAC7B,CAAC,MAAM;AACL,UAAM,aAAa,qBAAqB,KAAK,CAAC;AAC9C,UAAM,mBAAmB,EAAE,MAAM,OAAO,EAAE,SAAS,IAAI;AAEvD,WAAO,CAAC,cAAc,CAAC,oBAAoB,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/D;AAAA,EACA,EAAE,SAAS,+DAA+D;AAC5E;AAOO,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,MAAM,EAAE,OAAO;AAAA,EACf,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,MAAM,EAAE,KAAK,CAAC,QAAQ,WAAW,CAAC;AAAA,EAClC,UAAU,EAAE,QAAQ,EAAE,SAAS;AACjC,CAAC;AAEM,IAAM,qBAAqB,EAC/B,OAAO;AAAA;AAAA,EAEN,MAAM,EAAE,MAAM,oBAAoB;AACpC,CAAC,EAIA,OAAO;AAmBH,IAAM,qBAAqB,CAAC,WAAuC;AACxE,SAAO;AACT;",
+  "names": []
+}

package/dist/internal.js

@@ -0,0 +1,211 @@
+// src/lib/package-config/package-config-schema.ts
+import { z } from "zod";
+var packageConfigSchema = z.strictObject({
+  requiredScripts: z.array(z.string().min(1)).optional(),
+  requiredFiles: z.array(z.string().min(1)).optional(),
+  turbo: z.strictObject({
+    requiredTasks: z.array(z.string().min(1)).optional()
+  }).optional(),
+  dev: z.strictObject({
+    proxy: z.strictObject({
+      templates: z.strictObject({
+        local: z.string().min(1),
+        cloud: z.string().min(1)
+      }),
+      routes: z.record(
+        z.string().min(1),
+        z.strictObject({
+          packageName: z.string().min(1),
+          from: z.array(z.enum(["local", "cloud"])).min(1),
+          default: z.enum(["local", "cloud"]).optional()
+        }).refine(
+          (route) => {
+            return route.from.length <= 1 || route.default !== void 0;
+          },
+          {
+            message: "default is required when `from` has more than one source"
+          }
+        ).refine(
+          (route) => {
+            return route.default === void 0 || route.from.includes(route.default);
+          },
+          {
+            message: "default must be listed in `from`"
+          }
+        )
+      )
+    }).optional()
+  }).optional()
+});
+
+// src/lib/release-slug/release-slug.ts
+var slugifyHostLabel = (label) => {
+  const runs = label.toLowerCase().match(/[a-z0-9]+/g);
+  return runs ? runs.join("-") : "";
+};
+var slugifyRelease = (branch) => {
+  return slugifyHostLabel(branch.replace(/^(?:feature|feat|release|hotfix|bugfix|fix|chore)\//i, ""));
+};
+var DEFAULT_RELEASE_SLUG = "local";
+
+// src/lib/vendor/config-schema.ts
+import { z as z2 } from "zod";
+var VENDOR_CONFIG_FILE = "vendor.config.ts";
+var safeRelPath = z2.string().refine(
+  (p) => {
+    const isAbsolute = /^(?:[/\\]|[a-z]:)/i.test(p);
+    const hasDotDotSegment = p.split(/[\\/]/).includes("..");
+    return !isAbsolute && !hasDotDotSegment && p.trim().length > 0;
+  },
+  { message: 'must be a non-empty repo-relative path without ".." segments' }
+);
+var vendorCopyItemSchema = z2.object({
+  name: z2.string(),
+  source: safeRelPath,
+  target: safeRelPath,
+  type: z2.enum(["file", "directory"]),
+  vendored: z2.boolean().optional()
+});
+var vendorConfigSchema = z2.object({
+  /** Files/dirs to copy. Items with `vendored: true` land under `vendor/`. */
+  copy: z2.array(vendorCopyItemSchema)
+}).strict();
+var defineVendorConfig = (config) => {
+  return config;
+};
+
+// src/lib/vite/vite.ts
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { pathToFileURL } from "node:url";
+import { z as z3 } from "zod";
+var PACKAGE_CONFIG_FILE = "infra-kit.config.ts";
+var DEV_CONTEXT_DIR = path.join(".infra-kit", "dev-context");
+var DEV_CONTEXT_FILE = path.join(".infra-kit", "dev-context.json");
+var devContextFragmentSchema = z3.object({
+  package: z3.string(),
+  port: z3.number(),
+  pid: z3.number().optional(),
+  writtenAt: z3.number().optional(),
+  release: z3.string().optional(),
+  alias: z3.string().optional(),
+  proxyPort: z3.number().optional(),
+  origin: z3.string().optional(),
+  v: z3.number().optional()
+});
+var DEV_CONTEXT_WIRE_VERSION = 2;
+var loadDev = async (cwd) => {
+  const configPath = path.join(cwd, PACKAGE_CONFIG_FILE);
+  if (!fs.existsSync(configPath)) return void 0;
+  const stat = fs.statSync(configPath);
+  const moduleUrl = `${pathToFileURL(configPath).href}?mtime=${Number(stat.mtimeMs)}`;
+  const imported = await import(moduleUrl);
+  const rawExport = imported.default;
+  if (rawExport === void 0) return void 0;
+  const resolved = typeof rawExport === "function" ? await rawExport() : rawExport;
+  const parsed = packageConfigSchema.safeParse(resolved);
+  if (!parsed.success) {
+    throw new Error(
+      `@slip-stream-kit/config/vite: invalid ${PACKAGE_CONFIG_FILE} at ${configPath}: ${z3.prettifyError(parsed.error)}`
+    );
+  }
+  return parsed.data.dev;
+};
+var extractPackages = (parsed) => {
+  if (Array.isArray(parsed)) {
+    return parsed.filter((v) => {
+      return typeof v === "string";
+    });
+  }
+  if (parsed !== null && typeof parsed === "object") {
+    const candidate = parsed.packages ?? parsed.localPackages;
+    if (Array.isArray(candidate)) {
+      return candidate.filter((v) => {
+        return typeof v === "string";
+      });
+    }
+  }
+  return [];
+};
+var findUp = (start, relative) => {
+  let dir = path.resolve(start);
+  for (; ; ) {
+    const candidate = path.join(dir, relative);
+    if (fs.existsSync(candidate)) return candidate;
+    const parent = path.dirname(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+};
+var emptyLocalContext = () => {
+  return { packages: /* @__PURE__ */ new Set(), info: /* @__PURE__ */ new Map() };
+};
+var isFragmentWriterAlive = (pid) => {
+  if (pid == null) return true;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+};
+var readFragmentDir = (dir) => {
+  let entries;
+  try {
+    entries = fs.readdirSync(dir);
+  } catch {
+    return emptyLocalContext();
+  }
+  const packages = /* @__PURE__ */ new Set();
+  const info = /* @__PURE__ */ new Map();
+  for (const name of entries) {
+    if (!name.endsWith(".json")) continue;
+    try {
+      const parsed = devContextFragmentSchema.safeParse(JSON.parse(fs.readFileSync(path.join(dir, name), "utf-8")));
+      if (!parsed.success) continue;
+      if (!isFragmentWriterAlive(parsed.data.pid)) continue;
+      packages.add(parsed.data.package);
+      info.set(parsed.data.package, {
+        port: parsed.data.port,
+        origin: parsed.data.origin,
+        release: parsed.data.release,
+        alias: parsed.data.alias,
+        proxyPort: parsed.data.proxyPort,
+        wire: parsed.data.v
+      });
+    } catch {
+      continue;
+    }
+  }
+  return { packages, info };
+};
+var readLocalContext = (cwd) => {
+  const dir = findUp(cwd, DEV_CONTEXT_DIR);
+  if (dir) return readFragmentDir(dir);
+  const legacy = findUp(cwd, DEV_CONTEXT_FILE);
+  if (!legacy) return emptyLocalContext();
+  try {
+    return { packages: new Set(extractPackages(JSON.parse(fs.readFileSync(legacy, "utf-8")))), info: /* @__PURE__ */ new Map() };
+  } catch {
+    return emptyLocalContext();
+  }
+};
+var readLocalSet = (cwd) => {
+  return readLocalContext(cwd).packages;
+};
+export {
+  DEFAULT_RELEASE_SLUG,
+  DEV_CONTEXT_WIRE_VERSION,
+  VENDOR_CONFIG_FILE,
+  defineVendorConfig,
+  loadDev,
+  packageConfigSchema,
+  readLocalContext,
+  readLocalSet,
+  slugifyHostLabel,
+  slugifyRelease,
+  vendorConfigSchema,
+  vendorCopyItemSchema
+};
+//# sourceMappingURL=internal.js.map

package/dist/internal.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/lib/package-config/package-config-schema.ts", "../src/lib/release-slug/release-slug.ts", "../src/lib/vendor/config-schema.ts", "../src/lib/vite/vite.ts"],
+  "sourcesContent": ["import { z } from 'zod'\n\n/**\n * Schema for the resolved (post-factory) package config object. `strictObject`\n * rejects unknown keys so typos in `infra-kit.config.ts` surface as validation\n * errors instead of being silently ignored.\n *\n * Kept in its own module \u2014 separate from the public `defineConfig`/types entry \u2014\n * so the published `infra-kit` type surface stays free of a `zod` import.\n */\nexport const packageConfigSchema = z.strictObject({\n  requiredScripts: z.array(z.string().min(1)).optional(),\n  requiredFiles: z.array(z.string().min(1)).optional(),\n  turbo: z\n    .strictObject({\n      requiredTasks: z.array(z.string().min(1)).optional(),\n    })\n    .optional(),\n  dev: z\n    .strictObject({\n      proxy: z\n        .strictObject({\n          templates: z.strictObject({\n            local: z.string().min(1),\n            cloud: z.string().min(1),\n          }),\n          routes: z.record(\n            z.string().min(1),\n            z\n              .strictObject({\n                packageName: z.string().min(1),\n                from: z.array(z.enum(['local', 'cloud'])).min(1),\n                default: z.enum(['local', 'cloud']).optional(),\n              })\n              .refine(\n                (route) => {\n                  return route.from.length <= 1 || route.default !== undefined\n                },\n                {\n                  message: 'default is required when `from` has more than one source',\n                },\n              )\n              .refine(\n                (route) => {\n                  return route.default === undefined || route.from.includes(route.default)\n                },\n                {\n                  message: 'default must be listed in `from`',\n                },\n              ),\n          ),\n        })\n        .optional(),\n    })\n    .optional(),\n})\n", "/**\n * Shared, dependency-light release-slug helper.\n *\n * Extracted from `lib/vite/vite.ts` so BOTH the published `infra-kit/vite` helper\n * (which re-exports it) and the dev-server's dev-context fragment writer derive the\n * `<release>` hostname segment from ONE implementation \u2014 the recorded slug and the\n * helper-computed slug can never drift. Pure (regex only, no imports) so importing it\n * into the lightweight `infra-kit/vite` bundle stays cheap.\n */\n\n/**\n * Slugify an arbitrary string into a single DNS label: lowercase, collapse every\n * non-alphanumeric run to `-`, and drop leading/trailing separators. Returns `''`\n * when the input carries no alphanumeric run (the caller must treat that as \"no label\").\n *\n * portless rejects any hostname outside `[a-z0-9.-]`, so every segment fed into a\n * `<release>.<packageName>.localhost` alias must pass through here. A scoped npm name\n * (`@hulyo/client-ui`) is the motivating case: registering it raw fails with\n * `Invalid hostname`, and because the driver swallows that into a best-effort `false`,\n * the whole hero-URL path degrades silently to `localhost:<port>`.\n *\n * Distinct from {@link slugifyRelease}: this does NOT strip a git-flow prefix, so a\n * package legitimately named `fix-utils` keeps its `fix-` prefix.\n *\n * @example\n * slugifyHostLabel('@hulyo/client-ui') // => 'hulyo-client-ui'\n * slugifyHostLabel('backend-api')      // => 'backend-api'\n */\nexport const slugifyHostLabel = (label: string): string => {\n  // Collect the alphanumeric runs and join with `-`. Doing it this way (rather\n  // than collapse-then-trim) is linear and sidesteps a super-linear trim regex,\n  // while inherently dropping any leading/trailing separators.\n  const runs = label.toLowerCase().match(/[a-z0-9]+/g)\n\n  return runs ? runs.join('-') : ''\n}\n\n/**\n * Slugify a git branch into a `<release>` token: strip a leading git-flow prefix\n * (`feature/`, `release/`, \u2026), then reduce the remainder to a single DNS label.\n *\n * @example\n * slugifyRelease('release/2.4')     // => '2-4'\n * slugifyRelease('feature/HUL-123') // => 'hul-123'\n */\nexport const slugifyRelease = (branch: string): string => {\n  return slugifyHostLabel(branch.replace(/^(?:feature|feat|release|hotfix|bugfix|fix|chore)\\//i, ''))\n}\n\n/**\n * The `<release>` label used when no git branch resolves (outside a repo, or a branch that slugifies to\n * nothing). Both the dev-server's alias writer and `infra-kit/vite`'s template interpolation fall back\n * to this SAME constant \u2014 a divergence here would emit a hostname no alias backs.\n */\nexport const DEFAULT_RELEASE_SLUG = 'local'\n", "import { z } from 'zod'\n\n/**\n * Pure (node-free) vendor config schema + authoring helper. Kept separate from\n * `config.ts` (which imports node builtins for the runtime loader) so the public\n * lib entry can re-export `defineVendorConfig` without dragging node types into\n * the emitted `.d.ts`.\n */\n\n/**\n * Filename a source repo provides at its root to declare WHAT `vendor sync`\n * copies (`copy[]`). Lives ONLY on the write path \u2014 `vendor check` never loads it.\n * WHERE/WHICH to stamp (`workspaceDir` + `targets`) is machine-local and lives in\n * the user-global factory config (`~/.infra-kit/vendor.json`).\n */\nexport const VENDOR_CONFIG_FILE = 'vendor.config.ts'\n\n/**\n * A non-empty, repo-relative path with no `..` segments and no absolute prefix\n * (POSIX `/`, UNC/`\\`, or a Windows drive like `C:`). Containment guard for\n * vendor copy items so a malicious/typo config can't read or write outside the\n * source/target repo roots. Kept as a string/regex check (no `node:path`) to\n * respect this file's node-free constraint \u2014 `sync-ops.ts` does the resolved\n * runtime containment assert as defense in depth.\n */\nconst safeRelPath = z.string().refine(\n  (p) => {\n    const isAbsolute = /^(?:[/\\\\]|[a-z]:)/i.test(p)\n    const hasDotDotSegment = p.split(/[\\\\/]/).includes('..')\n\n    return !isAbsolute && !hasDotDotSegment && p.trim().length > 0\n  },\n  { message: 'must be a non-empty repo-relative path without \"..\" segments' },\n)\n\n/**\n * One item to sync from the source repo into each target. `vendored: true` marks\n * workspace packages that must land under `vendor/` (the single-source-of-truth\n * code); everything else is root-level tooling that stays at the repo root.\n */\nexport const vendorCopyItemSchema = z.object({\n  name: z.string(),\n  source: safeRelPath,\n  target: safeRelPath,\n  type: z.enum(['file', 'directory']),\n  vendored: z.boolean().optional(),\n})\n\nexport const vendorConfigSchema = z\n  .object({\n    /** Files/dirs to copy. Items with `vendored: true` land under `vendor/`. */\n    copy: z.array(vendorCopyItemSchema),\n  })\n  // Reject stray keys so a leftover `targets` (now machine-local, in\n  // ~/.infra-kit/vendor.json) yields a clear \"unrecognized key\" error rather\n  // than being silently ignored.\n  .strict()\n\nexport type VendorCopyItem = z.infer<typeof vendorCopyItemSchema>\nexport type VendorConfig = z.infer<typeof vendorConfigSchema>\n\n/**\n * Identity helper for authoring a type-safe `vendor.config.ts` in a source repo.\n * Re-exported from the public lib entry so a source repo can\n * `import { defineVendorConfig } from 'infra-kit'`.\n *\n * NOTE: a `vendor.config.ts` must be type-strippable \u2014 Node's native type\n * stripping (Node >= 24) loads it without a build step, which forbids `enum`,\n * `namespace`, and parameter properties.\n *\n * @example\n * export default defineVendorConfig({\n *   copy: [{ name: 'Configs', source: 'vendor/configs', target: 'vendor/configs', type: 'directory', vendored: true }],\n * })\n */\nexport const defineVendorConfig = (config: VendorConfig): VendorConfig => {\n  return config\n}\n", "import { Buffer } from 'node:buffer'\nimport { execFileSync } from 'node:child_process'\nimport fs from 'node:fs'\nimport net from 'node:net'\nimport path from 'node:path'\nimport process from 'node:process'\nimport { pathToFileURL } from 'node:url'\nimport { z } from 'zod'\n\nimport type {\n  InfraKitDev,\n  InfraKitDevProxy,\n  InfraKitDevProxyRoute,\n  InfraKitDevProxySource,\n} from '../package-config/package-config'\nimport { packageConfigSchema } from '../package-config/package-config-schema'\nimport { DEFAULT_RELEASE_SLUG, slugifyHostLabel, slugifyRelease } from '../release-slug/release-slug'\n\n/**\n * Env-name handle read at vite-config time to fill the `<env>` placeholder in a\n * cloud proxy target. Inlined (not imported from `src/lib/constants`) to keep the\n * `infra-kit/vite` bundle's import graph tiny \u2014 see the module header. Kept\n * byte-identical to `INFRA_KIT_ENV_VAR` in `src/lib/constants/constants.ts`.\n */\nconst INFRA_KIT_ENV = 'INFRA_KIT_ENV'\n\n/** Per-package config filename, mirrored from the CLI's `PACKAGE_CONFIG_FILE`. */\nconst PACKAGE_CONFIG_FILE = 'infra-kit.config.ts'\n\n/**\n * Repo-relative dev-context fragment DIRECTORY, searched upward from cwd. Each\n * runner (single-process or cmux pane) writes its OWN `<app>.json` fragment here\n * recording its real bound port + release; the helper merges them (see\n * {@link readLocalContext}). This is the current source of truth.\n */\nconst DEV_CONTEXT_DIR = path.join('.infra-kit', 'dev-context')\n\n/**\n * Legacy single-file dev-context manifest, searched upward from cwd. Read only as\n * a transitional back-compat path when {@link DEV_CONTEXT_DIR} is absent (the\n * directory wins per-package when both exist).\n */\nconst DEV_CONTEXT_FILE = path.join('.infra-kit', 'dev-context.json')\n\n/**\n * One `.infra-kit/dev-context/<app>.json` fragment. `package` is the load-bearing\n * field the helper reads (\u2192 localSet); `origin` is **the authoritative local target** \u2014\n * the exact origin the runner registered, obeyed verbatim by {@link resolveLocalTarget}.\n * The runner is the only party that knows the scheme and port its alias is really served\n * on, so the helper never re-derives them when `origin` is present.\n *\n * `release`, `alias` and `proxyPort` are the LEGACY inputs, read only when `origin` is\n * absent \u2014 which can only happen when an OLD CLI wrote the fragment (a CLI-only rollback).\n * `port` is no longer a proxy target (the direct `127.0.0.1:<port>` branch is gone) \u2014 it\n * survives as diagnostic provenance. `pid` is the staleness guard: {@link readFragmentDir}\n * drops a fragment whose writer is no longer alive, so a crashed runner cannot keep a\n * package pinned `local` at a dead alias. `writtenAt` is provenance only.\n *\n * Kept lenient (not `.strict()`) so extra writer fields never reject a valid fragment, and\n * deliberately un-`refine`d: a rejected fragment would drop a started package to `cloud`\n * instead of falling into legacy mode, which is what makes the rollback path work.\n */\nconst devContextFragmentSchema = z.object({\n  package: z.string(),\n  port: z.number(),\n  pid: z.number().optional(),\n  writtenAt: z.number().optional(),\n  release: z.string().optional(),\n  alias: z.string().optional(),\n  proxyPort: z.number().optional(),\n  origin: z.string().optional(),\n  v: z.number().optional(),\n})\n\n/**\n * Wire version of the dev-context fragment \u2014 the ONE contract between the `infra-kit` CLI (which writes\n * fragments) and this helper (which reads them). They ship as SEPARATE npm packages on separate cadences,\n * so this number is the only thing either side can trust about the other.\n *\n * `v >= 2` is a PROMISE that `origin` is present and authoritative.\n *\n * That promise is what makes the guard in {@link resolveLocalTarget} possible. Without it, a missing\n * `origin` is ambiguous \u2014 it means BOTH \"an old CLI wrote this, legacy mode is correct\" AND \"a current\n * CLI wrote a broken fragment, legacy mode is catastrophic\" \u2014 and the helper has to guess. It guesses\n * legacy, rebuilds the target from a `templates.local` that says `http://`, and proxies plain HTTP into\n * a TLS listener. Silently, because portless answers :80 with a 302 rather than refusing.\n *\n * A fragment with NO `v` is a pre-v2 (legacy) writer and must still be honoured: rejecting it would drop\n * a running package to `cloud` instead of falling into legacy mode, and that rollback path is exactly why\n * the schema above is lenient and un-`refine`d. Absent or unknown `v` therefore NEVER rejects.\n */\nexport const DEV_CONTEXT_WIRE_VERSION = 2\n\n/**\n * A single Vite `server.proxy` entry. `changeOrigin` is always set. `cookieDomainRewrite` is cloud-only\n * (it keeps an HTTPS cloud BE's cookies usable from a local FE). `secure: false` appears on BOTH sources\n * but for different reasons: a cloud target may serve a cert the local store rejects, and a local target\n * is served by portless from its own private CA \u2014 set there only for a loopback host (see\n * {@link isLoopbackTarget}). `headers` is present only when HTTP Basic Auth is injected (see\n * {@link buildBasicAuthHeader}) \u2014 it carries the `Authorization` header applied\n * uniformly to every route so upstream environments behind auth (e2e/staging)\n * stay reachable.\n */\nexport interface InfraKitViteProxyEntry {\n  target: string\n  changeOrigin: true\n  secure?: false\n  cookieDomainRewrite?: 'localhost'\n  headers?: Record<string, string>\n}\n\n/** A Vite `server.proxy`-shaped map: path-prefix \u2192 proxy entry. */\nexport type InfraKitViteProxy = Record<string, InfraKitViteProxyEntry>\n\n/** Explicit HTTP Basic Auth credentials, overriding the `E2E__BASIC_AUTH_*` env vars. */\nexport interface InfraKitBasicAuth {\n  username: string\n  password: string\n}\n\nexport interface InfraKitDevOptions {\n  /** Package dir whose `infra-kit.config.ts` is loaded. Defaults to `process.cwd()`. */\n  cwd?: string\n  /**\n   * Explicit HTTP Basic Auth credentials injected into every proxy route as an\n   * `Authorization` header. Takes precedence over the `E2E__BASIC_AUTH_USERNAME`\n   * / `E2E__BASIC_AUTH_PASSWORD` env vars. Omit to use the env-based default.\n   */\n  basicAuth?: InfraKitBasicAuth\n  /**\n   * Vite's `command`. Pass it (`defineConfig(async ({ command }) => ({ server: await infraKitDev({ command }) }))`)\n   * so `build` is a no-op: `server` is irrelevant to a build and proxy resolution would otherwise\n   * fail-fast on a cloud route with no sourced env. Omit (or `'serve'`) for the dev-server config.\n   */\n  command?: 'build' | 'serve'\n  /**\n   * Explicit dev-server port. Omit for a **per-worktree dynamic** free port (a fresh OS-assigned\n   * port) so N simultaneous git worktrees never collide on Vite's default `5173`; Vite prints the\n   * chosen URL. Pass a fixed number only when an external contract pins the port.\n   */\n  port?: number\n  /**\n   * Interface the dev server binds. Defaults to {@link LOOPBACK_V4} so a portless alias can reach it\n   * (Vite's own `localhost` default binds `[::1]` only, which the proxy cannot dial). Override when\n   * the dev server must be reachable off the loopback \u2014 `'0.0.0.0'` or `true` inside a container, on\n   * a LAN, or for an e2e runner on another host.\n   */\n  host?: string | boolean\n}\n\n/**\n * Build the `Authorization: Basic <base64(user:pass)>` header value. Credentials\n * come from `override` when given, else from `E2E__BASIC_AUTH_USERNAME` /\n * `E2E__BASIC_AUTH_PASSWORD` (NOTE: double underscore). Returns `undefined` when\n * either half is missing, so callers add no `headers` key at all.\n */\nconst buildBasicAuthHeader = (env: NodeJS.ProcessEnv, override?: InfraKitBasicAuth): string | undefined => {\n  const username = override?.username ?? env.E2E__BASIC_AUTH_USERNAME\n  const password = override?.password ?? env.E2E__BASIC_AUTH_PASSWORD\n\n  if (!username || !password) return undefined\n\n  const encoded = Buffer.from(`${username}:${password}`).toString('base64')\n\n  return `Basic ${encoded}`\n}\n\n/**\n * Re-exported from the shared, dependency-light `lib/release-slug` module so the\n * published `infra-kit/vite` surface (`entry/vite.ts:7`) is unchanged while the\n * dev-server's fragment writer derives `<release>` from the SAME implementation\n * (no slug drift). See {@link slugifyRelease}.\n */\nexport { slugifyRelease }\n\n/** Fill the `<release>`/`<packageName>`/`<env>` placeholders in a URL template. */\nconst interpolate = (template: string, values: { release: string; packageName: string; env: string }): string => {\n  return template\n    .replaceAll('<release>', values.release)\n    .replaceAll('<packageName>', values.packageName)\n    .replaceAll('<env>', values.env)\n}\n\n/** The port a bare `http://` target implies, and the proxy's default \u2014 never spelled out in a URL. */\nconst DEFAULT_HTTP_PORT = 80\n\n/**\n * The interface the vite dev server binds. Pinned to IPv4 loopback because portless dials its routes\n * on `127.0.0.1`, while vite's default `host: 'localhost'` combined with its\n * `dns.setDefaultResultOrder('verbatim')` binds `[::1]` ONLY \u2014 the alias then resolves, the proxy\n * connects, and the connection is refused, surfacing as a 502 on every UI request. Backends never hit\n * this because `ServerlessLocalRun` already binds `127.0.0.1`. Still loopback-only: this narrows the\n * address family, it does not expose the dev server to the network.\n */\nconst LOOPBACK_V4 = '127.0.0.1'\n\n/**\n * Graft the proxy's listen port onto an interpolated local target. The `dev.proxy` local template is\n * written port-free (`https://<release>.<packageName>.localhost`) because the proxy serves TLS on `:443`,\n * the only port a port-free HTTPS URL can come from. A consumer who trades the clean URL for a zero-sudo\n * unprivileged port still needs the frontend to reach it, so the runner records the port it actually bound\n * and we append it here. A template that already pins its own port keeps it.\n */\nconst withProxyPort = (target: string, proxyPort: number | undefined): string => {\n  if (proxyPort == null || proxyPort === DEFAULT_HTTP_PORT) return target\n\n  let url: URL\n\n  try {\n    url = new URL(target)\n  } catch {\n    throw new Error(\n      `@slip-stream-kit/config/vite: dev.proxy templates.local resolved to \"${target}\", which is not a valid URL, so the proxy port ${proxyPort} cannot be applied.`,\n    )\n  }\n\n  if (url.port !== '') return target\n  url.port = String(proxyPort)\n\n  // `URL.toString()` synthesizes a `/` pathname for an authority-only URL, so the common port-free\n  // template would come back as `\u2026localhost:1355/`. Strip that ONLY when the template had no trailing\n  // slash of its own \u2014 a template ending in `/` (e.g. `\u2026localhost/base/`) means it, and silently\n  // trimming it would change the path the frontend proxies to.\n  const grafted = url.toString()\n\n  return !target.endsWith('/') && grafted.endsWith('/') ? grafted.slice(0, -1) : grafted\n}\n\n/**\n * The lowest port a daemon can bind without root. An origin-less fragment recording a port AT OR ABOVE\n * this was written by an old CLI whose `spawnDaemon` always passed `--no-tls`, so infra-kit itself could\n * only ever have put PLAIN HTTP there. Below it (80/443) the daemon was installed out-of-band, where\n * portless defaults to TLS ON \u2014 which is precisely why the legacy scheme is left alone down there.\n */\nconst LEGACY_SELF_SPAWNED_PORT_FLOOR = 1024\n\n/**\n * Legacy target resolution \u2014 reached ONLY for an origin-less fragment, i.e. one written by an OLD CLI\n * (a CLI-only rollback). It must reproduce the old helper rather than reject anything, because that is\n * what lets the CLI be reverted without touching a single consumer repo.\n *\n * `proxyPort >= 1024`: force the scheme to `http`. **Mitigation, not a proof** \u2014 infra-kit's own\n * `spawnDaemon` always passed `--no-tls`, so an unprivileged daemon *infra-kit created* was always plain\n * HTTP; a HAND-STARTED TLS daemon on such a port (portless's own default is TLS) would be wrongly\n * downgraded here. That corner is accepted: forcing `http` reproduces what the old CLI + old helper\n * already emitted, so it regresses nothing that worked.\n *\n * `proxyPort < 1024` (80/443) or absent: the daemon was installed out-of-band and may well be TLS, and we\n * cannot know. Reproduce the old helper verbatim and NEVER rewrite the scheme \u2014 forcing `http` on a `:443`\n * fragment would emit `http://<alias>:443`, plain HTTP into a TLS listener, the exact silent failure this\n * design exists to remove.\n */\nconst resolveLegacyTarget = (target: string, proxyPort: number | undefined): string => {\n  if (proxyPort != null && proxyPort >= LEGACY_SELF_SPAWNED_PORT_FLOOR) {\n    return withProxyPort(target.replace(/^https:\\/\\//iu, 'http://'), proxyPort)\n  }\n\n  return withProxyPort(target, proxyPort)\n}\n\n/**\n * The proxy target for a route resolved to `local`. The runner PUBLISHES the contract and the helper OBEYS\n * it: when the fragment carries an `origin`, that string is the target verbatim \u2014 the runner is the only\n * party that knows the scheme and port the alias it registered is actually served on, and this helper ships\n * on its own release cadence, so any re-derivation here is a guess that can silently disagree.\n *\n * `templates.local` is consulted ONLY in legacy mode (see {@link resolveLegacyTarget}).\n *\n * The target proxies to a stable HOSTNAME, and the runner re-points that alias at the freshly-bound port\n * on every `--watch` restart, so it self-heals without Vite reloading its config.\n */\nconst resolveLocalTarget = (args: {\n  route: InfraKitDevProxyRoute\n  templates: InfraKitDevProxy['templates']\n  env: string | undefined\n  getRelease: () => string\n  info: LocalPackageInfo | undefined\n}): string => {\n  const { route, templates, env, getRelease, info } = args\n\n  if (info?.origin) return info.origin\n\n  // The fragment declared a wire version, which PROMISES an `origin` \u2014 and there isn't one. Falling into\n  // legacy mode here would rebuild the target from `templates.local` and downgrade it to `http://`, i.e.\n  // proxy plain HTTP into portless's TLS listener. That failure is silent (:80 answers with a 302 rather\n  // than refusing), so nothing downstream would catch it. A fragment with NO `v` is a genuinely old writer\n  // and still falls through to legacy below \u2014 that rollback path is intact. This branch is only the\n  // impossible one: a writer that announced v2 and then broke its own promise.\n  if (info?.wire != null) {\n    throw new Error(\n      `@slip-stream-kit/config/vite: the dev-context fragment for \"${route.packageName}\" declares wire v${info.wire} but ` +\n        `carries no \\`origin\\`. A v${DEV_CONTEXT_WIRE_VERSION} writer must publish the exact origin it ` +\n        `registered. Refusing to guess a target rather than silently proxy plain HTTP at a TLS listener \u2014 ` +\n        `restart \\`infra-kit dev\\`, and if it persists the CLI and this helper are incompatible.`,\n    )\n  }\n\n  const target = interpolate(templates.local, {\n    // Prefer THIS package's runner-recorded release slug (R4) over the single global git derivation,\n    // so cross-branch FE/BE pairings don't drift the emitted `<release>` from the segment the runner\n    // aliased. Fall back to the global git slug only when the fragment carried no release.\n    release: info?.release ?? getRelease(),\n    // The local template resolves to a `<release>.<packageName>.localhost` alias the dev-server\n    // registered with portless \u2014 which slugifies the package name to a legal DNS label. Slugify\n    // identically here or a scoped name (`@hulyo/client-ui`) emits a target that no alias backs.\n    packageName: slugifyHostLabel(route.packageName),\n    env: env ?? '',\n  })\n\n  return resolveLegacyTarget(target, info?.proxyPort)\n}\n\n/**\n * Pick the effective source for a route: `local` when the route lists `local` as\n * a capability AND its packageName is in the local dev set; otherwise the fallback\n * \u2014 the declared `default` for a multi-source route, or the sole `from` entry for\n * a single-source one. Always resolves (the schema guarantees a usable fallback).\n */\nconst pickSource = (route: InfraKitDevProxyRoute, localSet: ReadonlySet<string>): InfraKitDevProxySource => {\n  // `from` is guaranteed non-empty by the schema, so `from[0]` is always present.\n  const fallback = route.default ?? route.from[0]!\n\n  return route.from.includes('local') && localSet.has(route.packageName) ? 'local' : fallback\n}\n\ninterface ResolveRouteArgs {\n  routePath: string\n  route: InfraKitDevProxyRoute\n  templates: InfraKitDevProxy['templates']\n  localSet: ReadonlySet<string>\n  env: string | undefined\n  getRelease: () => string\n  /** Per-package runtime data (recorded release/port) from the dev-context merge. */\n  localInfo?: ReadonlyMap<string, LocalPackageInfo>\n}\n\n/** Hostnames that can only be this machine \u2014 the only ones a private-CA cert is allowed to go unchecked on. */\nconst LOOPBACK_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1'])\n\n/**\n * Is `target` unambiguously on this machine? Only then may {@link resolveRoute} disable cert validation:\n * `templates.local` is an unconstrained string in a consumer-authored config, so an unconditional\n * `secure: false` in a PUBLISHED helper would silently switch off validation for whatever URL a consumer\n * wrote there. Scoping it to `.localhost`/loopback is what makes \"no MITM surface\" true by construction.\n * An unparseable target is NOT local (the caller then leaves `secure` unset \u2014 fail closed).\n */\nconst isLoopbackTarget = (target: string): boolean => {\n  let hostname: string\n\n  try {\n    hostname = new URL(target).hostname.toLowerCase()\n  } catch {\n    return false\n  }\n\n  // `URL.hostname` brackets an IPv6 literal (`[::1]`); compare the bare address.\n  const bare = hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname\n\n  return bare.endsWith('.localhost') || LOOPBACK_HOSTNAMES.has(bare)\n}\n\n/** Resolve one route into a Vite proxy entry (or throw an actionable error). */\nconst resolveRoute = ({\n  routePath,\n  route,\n  templates,\n  localSet,\n  env,\n  getRelease,\n  localInfo,\n}: ResolveRouteArgs): InfraKitViteProxyEntry => {\n  const source = pickSource(route, localSet)\n\n  if (source === 'local') {\n    const target = resolveLocalTarget({ route, templates, env, getRelease, info: localInfo?.get(route.packageName) })\n\n    // The local target is now HTTPS, served with a cert minted by portless's own private CA. Node's\n    // http-proxy validates the upstream chain against the system store, which does not contain that CA,\n    // so every proxied request fails with SELF_SIGNED_CERT_IN_CHAIN (confirmed empirically \u2014 see\n    // `.omc/research/portless-https-spike.md`). Only a loopback target earns the exemption.\n    return isLoopbackTarget(target) ? { target, changeOrigin: true, secure: false } : { target, changeOrigin: true }\n  }\n\n  if (!env) {\n    throw new Error(\n      `@slip-stream-kit/config/vite: proxy route \"${routePath}\" resolves to a cloud backend but ${INFRA_KIT_ENV} is not set. Source an environment from Doppler first (e.g. \\`infra-kit env-load -c dev\\`).`,\n    )\n  }\n\n  const target = interpolate(templates.cloud, { release: '', packageName: route.packageName, env })\n\n  return { target, changeOrigin: true, secure: false, cookieDomainRewrite: 'localhost' }\n}\n\ninterface ResolveProxyArgs {\n  proxy: InfraKitDevProxy\n  localSet: ReadonlySet<string>\n  env: string | undefined\n  getRelease: () => string\n  /** Pre-computed `Authorization` header value applied uniformly to every route. */\n  authHeader?: string\n  /** Per-package runtime data (recorded release/port) from the dev-context merge. */\n  localInfo?: ReadonlyMap<string, LocalPackageInfo>\n}\n\n/**\n * Pure resolver: turn a `dev.proxy` config + resolved inputs (local set, env,\n * lazy release) into a Vite `server.proxy` map. Side-effect-free so the\n * resolution shape is fully unit-testable. When `authHeader` is set, every route\n * entry gets a matching `headers.Authorization`; otherwise no `headers` key.\n */\nexport const resolveProxyConfig = ({\n  proxy,\n  localSet,\n  env,\n  getRelease,\n  authHeader,\n  localInfo,\n}: ResolveProxyArgs): InfraKitViteProxy => {\n  const result: InfraKitViteProxy = {}\n  const headers = authHeader ? { Authorization: authHeader } : undefined\n\n  for (const [routePath, route] of Object.entries(proxy.routes)) {\n    const entry = resolveRoute({ routePath, route, templates: proxy.templates, localSet, env, getRelease, localInfo })\n\n    result[routePath] = headers ? { ...entry, headers } : entry\n  }\n\n  return result\n}\n\n/** Memoize a zero-arg thunk so `<release>` git resolution runs at most once. */\nconst once = <T>(fn: () => T): (() => T) => {\n  let cached: { value: T } | undefined\n\n  return () => {\n    cached ??= { value: fn() }\n\n    return cached.value\n  }\n}\n\n/**\n * Load a package's `infra-kit.config.ts` and return its `dev` block, or\n * `undefined` when the config or the `dev` key is absent. The `.ts` config is\n * evaluated via Node's native type stripping (Node >= 24) \u2014 the same mechanism\n * the CLI's config loader uses. Cache-busted by mtime so repeated dev-server\n * reloads pick up edits.\n *\n * Reached from two different processes, and only one of them is ours. Under the\n * CLI (`infra-kit dev`, `audit`) the entry has installed\n * {@link ../node-warnings.suppressTypelessPackageJsonWarning}, so a consumer package\n * with no `\"type\"` loads quietly. Under `infraKitDev()` in a consumer's own\n * `vite.config.ts` we are a library in their process and do NOT patch their globals,\n * so such a package still prints Node's MODULE_TYPELESS_PACKAGE_JSON banner there.\n * Harmless (it is a double-parse notice), and latent while consumer UI packages\n * declare `\"type\": \"module\"`.\n */\nexport const loadDev = async (cwd: string): Promise<InfraKitDev | undefined> => {\n  const configPath = path.join(cwd, PACKAGE_CONFIG_FILE)\n\n  if (!fs.existsSync(configPath)) return undefined\n\n  const stat = fs.statSync(configPath)\n  const moduleUrl = `${pathToFileURL(configPath).href}?mtime=${Number(stat.mtimeMs)}`\n\n  const imported = (await import(moduleUrl)) as { default?: unknown }\n  const rawExport = imported.default\n\n  if (rawExport === undefined) return undefined\n\n  const resolved = typeof rawExport === 'function' ? await (rawExport as () => unknown)() : rawExport\n\n  const parsed = packageConfigSchema.safeParse(resolved)\n\n  if (!parsed.success) {\n    throw new Error(\n      `@slip-stream-kit/config/vite: invalid ${PACKAGE_CONFIG_FILE} at ${configPath}: ${z.prettifyError(parsed.error)}`,\n    )\n  }\n\n  return parsed.data.dev\n}\n\n/** Coerce a parsed dev-context.json into the set of locally-running package names. */\nconst extractPackages = (parsed: unknown): string[] => {\n  if (Array.isArray(parsed)) {\n    return parsed.filter((v): v is string => {\n      return typeof v === 'string'\n    })\n  }\n\n  if (parsed !== null && typeof parsed === 'object') {\n    const candidate = (parsed as Record<string, unknown>).packages ?? (parsed as Record<string, unknown>).localPackages\n\n    if (Array.isArray(candidate)) {\n      return candidate.filter((v): v is string => {\n        return typeof v === 'string'\n      })\n    }\n  }\n\n  return []\n}\n\n/** Search upward from `start` for `relative`, returning the first hit or undefined. */\nconst findUp = (start: string, relative: string): string | undefined => {\n  let dir = path.resolve(start)\n\n  for (;;) {\n    const candidate = path.join(dir, relative)\n\n    if (fs.existsSync(candidate)) return candidate\n\n    const parent = path.dirname(dir)\n\n    if (parent === dir) return undefined\n\n    dir = parent\n  }\n}\n\n/** Per-package runtime data merged from the dev-context fragment directory. */\nexport interface LocalPackageInfo {\n  /** The real bound port the runner recorded. Provenance only \u2014 the proxy target is the alias host. */\n  port: number\n  /**\n   * The authoritative local target (`https://<release>.<packageName>.localhost`), published by the\n   * runner. Present \u2192 {@link resolveLocalTarget} uses it verbatim and consults no template. Absent \u2192\n   * the fragment came from an old CLI and the legacy template path runs.\n   */\n  origin?: string\n  /**\n   * The fragment's declared wire version (see {@link DEV_CONTEXT_WIRE_VERSION}). Absent \u2192 a pre-v2 writer,\n   * so legacy mode is the correct reading. Present \u2192 the writer PROMISED an `origin`, and a missing one is\n   * a broken fragment rather than an old one.\n   */\n  wire?: number\n  /** LEGACY (no `origin`): the runner-recorded release slug, preferred over the helper's git derivation. */\n  release?: string\n  /** LEGACY (no `origin`): `<release>.<packageName>.localhost`, present only when an alias was registered. */\n  alias?: string\n  /** LEGACY (no `origin`): the port {@link alias} resolves on. `80` (the default) is implicit in the template. */\n  proxyPort?: number\n}\n\n/**\n * The locally-running package set plus a `package \u2192 { port, release }` map merged\n * from the dev-context fragments. `packages` feeds `pickSource`; `info` lets a\n * `local` route emit the per-package recorded release (see {@link resolveRoute}).\n */\nexport interface LocalContext {\n  packages: ReadonlySet<string>\n  info: ReadonlyMap<string, LocalPackageInfo>\n}\n\n/** An empty {@link LocalContext} (frontend-only / dev-context absent). */\nconst emptyLocalContext = (): LocalContext => {\n  return { packages: new Set(), info: new Map() }\n}\n\n/**\n * Is the runner that wrote a fragment still alive? Signal `0` performs the permission and existence\n * checks without delivering anything. `ESRCH` is the one answer that means \"gone\"; `EPERM` means the\n * pid exists under another uid, which is still a live process. A fragment with no `pid` predates the\n * field and is trusted (back-compat) rather than dropped.\n */\nconst isFragmentWriterAlive = (pid: number | undefined): boolean => {\n  if (pid == null) return true\n\n  try {\n    process.kill(pid, 0)\n\n    return true\n  } catch (error) {\n    return (error as NodeJS.ErrnoException).code === 'EPERM'\n  }\n}\n\n/**\n * Merge every `<app>.json` fragment in the dev-context directory into a\n * {@link LocalContext}. Two DISTINCT failure branches (do NOT collapse them into\n * one directory-wide catch):\n *  - `readdir`-ENOENT (directory vanished mid-race) \u2192 empty context, matching the\n *    dir-absent back-compat behaviour.\n *  - a single corrupt/truncated/invalid `<app>.json` \u2192 that ONE fragment is\n *    SKIPPED (per-fragment `safeParse` isolation); the rest still merge, so one bad\n *    fragment never collapses the whole localSet to empty (which would silently\n *    drop a started package to cloud).\n */\nconst readFragmentDir = (dir: string): LocalContext => {\n  let entries: string[]\n\n  try {\n    entries = fs.readdirSync(dir)\n  } catch {\n    return emptyLocalContext()\n  }\n\n  const packages = new Set<string>()\n  const info = new Map<string, LocalPackageInfo>()\n\n  for (const name of entries) {\n    if (!name.endsWith('.json')) continue\n\n    try {\n      const parsed = devContextFragmentSchema.safeParse(JSON.parse(fs.readFileSync(path.join(dir, name), 'utf-8')))\n\n      if (!parsed.success) continue\n\n      // A runner killed with SIGKILL (or crashed) leaves its fragment AND its portless alias behind.\n      // Trusting it would route this package's `/api` at an alias nothing serves \u2014 a silent 502 with\n      // no diagnostic. The writer already stamps its pid; honour it.\n      if (!isFragmentWriterAlive(parsed.data.pid)) continue\n\n      packages.add(parsed.data.package)\n      info.set(parsed.data.package, {\n        port: parsed.data.port,\n        origin: parsed.data.origin,\n        release: parsed.data.release,\n        alias: parsed.data.alias,\n        proxyPort: parsed.data.proxyPort,\n        wire: parsed.data.v,\n      })\n    } catch {\n      // Corrupt/truncated fragment (JSON.parse / read failure): skip ONLY this one.\n      continue\n    }\n  }\n\n  return { packages, info }\n}\n\n/**\n * Read the locally-running package context, searched upward from `cwd`. Prefers\n * the `.infra-kit/dev-context/` fragment DIRECTORY (merged via\n * {@link readFragmentDir}); when it is absent, falls back to the legacy single\n * `.infra-kit/dev-context.json` file (read as before \u2014 no per-package release);\n * when neither exists \u2192 empty context (frontend-only, every route resolves cloud).\n */\nexport const readLocalContext = (cwd: string): LocalContext => {\n  const dir = findUp(cwd, DEV_CONTEXT_DIR)\n\n  if (dir) return readFragmentDir(dir)\n\n  const legacy = findUp(cwd, DEV_CONTEXT_FILE)\n\n  if (!legacy) return emptyLocalContext()\n\n  try {\n    return { packages: new Set(extractPackages(JSON.parse(fs.readFileSync(legacy, 'utf-8')))), info: new Map() }\n  } catch {\n    return emptyLocalContext()\n  }\n}\n\n/**\n * Read the set of locally-running packages (searched upward from `cwd`). Thin\n * wrapper over {@link readLocalContext} preserving the historical `Set`-returning\n * contract. Absent dev-context \u2192 empty set (frontend-only cloud resolution).\n */\nexport const readLocalSet = (cwd: string): ReadonlySet<string> => {\n  return readLocalContext(cwd).packages\n}\n\n/** Current git branch of `cwd` (raw, un-slugified). */\nconst readGitBranch = (cwd: string): string => {\n  // eslint-disable-next-line sonarjs/no-os-command-from-path\n  return execFileSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { cwd, encoding: 'utf-8' }).trim()\n}\n\n/**\n * An OS-assigned free TCP port on 127.0.0.1 \u2014 the per-worktree dev-server port (mirrors the\n * backend's `listen(0)`). This probes then releases the port, so there is a small TOCTOU window\n * before Vite binds it; Vite's default `strictPort: false` absorbs a lost race by stepping to the\n * next free port. Only a consumer that sets `strictPort: true` would hard-fail on the rare collision.\n */\nconst getFreePort = (): Promise<number> => {\n  return new Promise((resolve, reject) => {\n    const srv = net.createServer()\n\n    srv.unref()\n    srv.on('error', reject)\n    srv.listen(0, '127.0.0.1', () => {\n      const address = srv.address()\n      const port = typeof address === 'object' && address !== null ? address.port : 0\n\n      srv.close(() => {\n        return resolve(port)\n      })\n    })\n  })\n}\n\n/** Env var carrying the runner-assigned `{ \"<ui-package>\": <port> }` map (Layer B). */\nconst UI_PORTS_ENV = 'INFRA_KIT_UI_PORTS'\n\n/** This package's `package.json` `name`, or `null` (unreadable / nameless). */\nconst readPackageName = (cwd: string): string | null => {\n  try {\n    const parsed = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf-8')) as { name?: unknown }\n\n    return typeof parsed.name === 'string' ? parsed.name : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * What the runner assigned THIS UI. `alias` is present only in the widened record form, i.e. only when the\n * runner both assigned the port AND registered the hostname \u2014 which is exactly the condition for pointing\n * HMR at that hostname. The legacy bare-number form yields no alias.\n */\ninterface ManagedUi {\n  port: number\n  alias?: string\n}\n\n/**\n * What `infra-kit dev` assigned THIS UI via `INFRA_KIT_UI_PORTS` (Layer B), or `null` when the map is\n * absent / this package isn't in it / it's malformed. Present \u2192 the helper binds the port with\n * `strictPort` so vite lands on exactly the port the runner already aliased. Absent (a standalone\n * `vite dev`) \u2192 the caller falls back to a free port, byte-identical to today.\n *\n * Accepts BOTH the widened `{ port, alias }` record and the legacy bare `<port>` number an older runner\n * writes \u2014 a new helper paired with an old CLI must still bind the assigned port.\n */\nconst resolveManagedUi = (cwd: string): ManagedUi | null => {\n  const raw = process.env[UI_PORTS_ENV]\n\n  if (raw == null || raw === '') return null\n\n  const name = readPackageName(cwd)\n\n  if (name == null) return null\n\n  try {\n    const entry = (JSON.parse(raw) as Record<string, unknown>)[name]\n\n    if (typeof entry === 'number') return { port: entry }\n\n    if (entry === null || typeof entry !== 'object') return null\n\n    const { port, alias } = entry as { port?: unknown; alias?: unknown }\n\n    if (typeof port !== 'number') return null\n\n    return { port, alias: typeof alias === 'string' ? alias : undefined }\n  } catch {\n    return null\n  }\n}\n\n/** The port an `https://` alias is served on \u2014 never spelled out in a URL, and what the HMR client dials. */\nconst HTTPS_PORT = 443\n\n/**\n * Vite's `server.hmr` override, pointing the HMR client at the alias instead of at the raw dev-server port.\n * The page is loaded over `https://<alias>`, so its websocket must be `wss://` on the same origin or the\n * browser blocks it as mixed content; `clientPort` is the proxy's implicit `:443`, not vite's bound port.\n */\nexport interface InfraKitViteHmr {\n  protocol: 'wss'\n  host: string\n  clientPort: number\n}\n\n/**\n * Resolve a package's `dev` block into a ready-made Vite `server` config: a per-worktree dev-server\n * `port` plus the `proxy` map. Loads the package's `infra-kit.config.ts`, merges the local dev set\n * from the `.infra-kit/dev-context/` fragment directory, and interpolates the local/cloud templates.\n * `<env>` comes from `INFRA_KIT_ENV`; `<release>` from each package's runner-recorded fragment when\n * present, else the slugified git branch (computed lazily, only when a local route needs it).\n *\n * `port` defaults to a fresh OS-assigned free port so simultaneous git worktrees never collide on\n * Vite's `5173` (override via `options.port`). `host` defaults to {@link LOOPBACK_V4} so the portless\n * alias can actually reach it (override via `options.host` for containers/LAN). `hmr` is emitted only\n * when `infra-kit dev` registered an alias for this UI, so a bare `vite dev` keeps vite's own HMR\n * defaults. Pass `command` so `build` is a no-op (empty proxy, no port) \u2014 a build ignores `server` and\n * proxy resolution would otherwise fail-fast on a cloud route with no sourced env.\n *\n * @example\n * // vite.config.ts \u2014 the whole `server` field is the helper's output\n * import { infraKitDev } from 'infra-kit/vite'\n * export default defineConfig(async ({ command }) => ({ server: await infraKitDev({ command }) }))\n */\nexport const infraKitDev = async (\n  options: InfraKitDevOptions = {},\n): Promise<{\n  port?: number\n  host?: string | boolean\n  strictPort?: boolean\n  hmr?: InfraKitViteHmr\n  proxy: InfraKitViteProxy\n}> => {\n  const cwd = options.cwd ?? process.cwd()\n\n  // A build ignores `server`; skip the port + proxy work (proxy resolution would fail-fast on a\n  // cloud route with no sourced env).\n  if (options.command === 'build') return { proxy: {} }\n\n  // Port precedence: explicit `options.port` > the runner-assigned Layer-B port (bound `strictPort` so\n  // vite lands on exactly the aliased port) > a fresh free port (today's default; the portless-off path).\n  const managed = options.port == null ? resolveManagedUi(cwd) : null\n  const port = options.port ?? managed?.port ?? (await getFreePort())\n  const strictPort = managed != null\n  const host = options.host ?? LOOPBACK_V4\n\n  // Override HMR ONLY when the runner handed us the alias it registered. A bare `vite dev` (no runner)\n  // has no alias, and a computable hostname is not a registered one \u2014 pointing the HMR client at a\n  // hostname nothing resolves would break hot reload on a path that works today.\n  const hmr: InfraKitViteHmr | undefined =\n    managed?.alias == null ? undefined : { protocol: 'wss', host: managed.alias, clientPort: HTTPS_PORT }\n  const server = { port, host, ...(strictPort ? { strictPort } : {}), ...(hmr ? { hmr } : {}) }\n  const dev = await loadDev(cwd)\n\n  if (!dev?.proxy) return { ...server, proxy: {} }\n\n  const { packages: localSet, info: localInfo } = readLocalContext(cwd)\n  const env = process.env[INFRA_KIT_ENV]\n  const authHeader = buildBasicAuthHeader(process.env, options.basicAuth)\n  const getRelease = once(() => {\n    // Mirrors the dev-server's `readAppRelease`: outside a git repo both sides must land on the SAME\n    // label, or this target names a host the runner never aliased.\n    try {\n      return slugifyRelease(readGitBranch(cwd)) || DEFAULT_RELEASE_SLUG\n    } catch {\n      return DEFAULT_RELEASE_SLUG\n    }\n  })\n\n  return {\n    ...server,\n    proxy: resolveProxyConfig({ proxy: dev.proxy, localSet, env, getRelease, authHeader, localInfo }),\n  }\n}\n\n/**\n * Convenience wrapper returning just the proxy map (for spreading into\n * `server.proxy` directly). Equivalent to `(await infraKitDev(options)).proxy`.\n */\nexport const infraKitProxy = async (options: InfraKitDevOptions = {}): Promise<InfraKitViteProxy> => {\n  return (await infraKitDev(options)).proxy\n}\n"],
+  "mappings": ";AAAA,SAAS,SAAS;AAUX,IAAM,sBAAsB,EAAE,aAAa;AAAA,EAChD,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EACrD,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EACnD,OAAO,EACJ,aAAa;AAAA,IACZ,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAAA,EACrD,CAAC,EACA,SAAS;AAAA,EACZ,KAAK,EACF,aAAa;AAAA,IACZ,OAAO,EACJ,aAAa;AAAA,MACZ,WAAW,EAAE,aAAa;AAAA,QACxB,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,QACvB,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACzB,CAAC;AAAA,MACD,QAAQ,EAAE;AAAA,QACR,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,QAChB,EACG,aAAa;AAAA,UACZ,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,UAC7B,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC;AAAA,UAC/C,SAAS,EAAE,KAAK,CAAC,SAAS,OAAO,CAAC,EAAE,SAAS;AAAA,QAC/C,CAAC,EACA;AAAA,UACC,CAAC,UAAU;AACT,mBAAO,MAAM,KAAK,UAAU,KAAK,MAAM,YAAY;AAAA,UACrD;AAAA,UACA;AAAA,YACE,SAAS;AAAA,UACX;AAAA,QACF,EACC;AAAA,UACC,CAAC,UAAU;AACT,mBAAO,MAAM,YAAY,UAAa,MAAM,KAAK,SAAS,MAAM,OAAO;AAAA,UACzE;AAAA,UACA;AAAA,YACE,SAAS;AAAA,UACX;AAAA,QACF;AAAA,MACJ;AAAA,IACF,CAAC,EACA,SAAS;AAAA,EACd,CAAC,EACA,SAAS;AACd,CAAC;;;AC3BM,IAAM,mBAAmB,CAAC,UAA0B;AAIzD,QAAM,OAAO,MAAM,YAAY,EAAE,MAAM,YAAY;AAEnD,SAAO,OAAO,KAAK,KAAK,GAAG,IAAI;AACjC;AAUO,IAAM,iBAAiB,CAAC,WAA2B;AACxD,SAAO,iBAAiB,OAAO,QAAQ,wDAAwD,EAAE,CAAC;AACpG;AAOO,IAAM,uBAAuB;;;ACtDpC,SAAS,KAAAA,UAAS;AAeX,IAAM,qBAAqB;AAUlC,IAAM,cAAcA,GAAE,OAAO,EAAE;AAAA,EAC7B,CAAC,MAAM;AACL,UAAM,aAAa,qBAAqB,KAAK,CAAC;AAC9C,UAAM,mBAAmB,EAAE,MAAM,OAAO,EAAE,SAAS,IAAI;AAEvD,WAAO,CAAC,cAAc,CAAC,oBAAoB,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/D;AAAA,EACA,EAAE,SAAS,+DAA+D;AAC5E;AAOO,IAAM,uBAAuBA,GAAE,OAAO;AAAA,EAC3C,MAAMA,GAAE,OAAO;AAAA,EACf,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,MAAMA,GAAE,KAAK,CAAC,QAAQ,WAAW,CAAC;AAAA,EAClC,UAAUA,GAAE,QAAQ,EAAE,SAAS;AACjC,CAAC;AAEM,IAAM,qBAAqBA,GAC/B,OAAO;AAAA;AAAA,EAEN,MAAMA,GAAE,MAAM,oBAAoB;AACpC,CAAC,EAIA,OAAO;AAmBH,IAAM,qBAAqB,CAAC,WAAuC;AACxE,SAAO;AACT;;;AC3EA,OAAO,QAAQ;AAEf,OAAO,UAAU;AACjB,OAAO,aAAa;AACpB,SAAS,qBAAqB;AAC9B,SAAS,KAAAC,UAAS;AAoBlB,IAAM,sBAAsB;AAQ5B,IAAM,kBAAkB,KAAK,KAAK,cAAc,aAAa;AAO7D,IAAM,mBAAmB,KAAK,KAAK,cAAc,kBAAkB;AAoBnE,IAAM,2BAA2BC,GAAE,OAAO;AAAA,EACxC,SAASA,GAAE,OAAO;AAAA,EAClB,MAAMA,GAAE,OAAO;AAAA,EACf,KAAKA,GAAE,OAAO,EAAE,SAAS;AAAA,EACzB,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAASA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,OAAOA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,WAAWA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,QAAQA,GAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,GAAGA,GAAE,OAAO,EAAE,SAAS;AACzB,CAAC;AAmBM,IAAM,2BAA2B;AA+WjC,IAAM,UAAU,OAAO,QAAkD;AAC9E,QAAM,aAAa,KAAK,KAAK,KAAK,mBAAmB;AAErD,MAAI,CAAC,GAAG,WAAW,UAAU,EAAG,QAAO;AAEvC,QAAM,OAAO,GAAG,SAAS,UAAU;AACnC,QAAM,YAAY,GAAG,cAAc,UAAU,EAAE,IAAI,UAAU,OAAO,KAAK,OAAO,CAAC;AAEjF,QAAM,WAAY,MAAM,OAAO;AAC/B,QAAM,YAAY,SAAS;AAE3B,MAAI,cAAc,OAAW,QAAO;AAEpC,QAAM,WAAW,OAAO,cAAc,aAAa,MAAO,UAA4B,IAAI;AAE1F,QAAM,SAAS,oBAAoB,UAAU,QAAQ;AAErD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI;AAAA,MACR,yCAAyC,mBAAmB,OAAO,UAAU,KAAKC,GAAE,cAAc,OAAO,KAAK,CAAC;AAAA,IACjH;AAAA,EACF;AAEA,SAAO,OAAO,KAAK;AACrB;AAGA,IAAM,kBAAkB,CAAC,WAA8B;AACrD,MAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,WAAO,OAAO,OAAO,CAAC,MAAmB;AACvC,aAAO,OAAO,MAAM;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,MAAI,WAAW,QAAQ,OAAO,WAAW,UAAU;AACjD,UAAM,YAAa,OAAmC,YAAa,OAAmC;AAEtG,QAAI,MAAM,QAAQ,SAAS,GAAG;AAC5B,aAAO,UAAU,OAAO,CAAC,MAAmB;AAC1C,eAAO,OAAO,MAAM;AAAA,MACtB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,CAAC;AACV;AAGA,IAAM,SAAS,CAAC,OAAe,aAAyC;AACtE,MAAI,MAAM,KAAK,QAAQ,KAAK;AAE5B,aAAS;AACP,UAAM,YAAY,KAAK,KAAK,KAAK,QAAQ;AAEzC,QAAI,GAAG,WAAW,SAAS,EAAG,QAAO;AAErC,UAAM,SAAS,KAAK,QAAQ,GAAG;AAE/B,QAAI,WAAW,IAAK,QAAO;AAE3B,UAAM;AAAA,EACR;AACF;AAqCA,IAAM,oBAAoB,MAAoB;AAC5C,SAAO,EAAE,UAAU,oBAAI,IAAI,GAAG,MAAM,oBAAI,IAAI,EAAE;AAChD;AAQA,IAAM,wBAAwB,CAAC,QAAqC;AAClE,MAAI,OAAO,KAAM,QAAO;AAExB,MAAI;AACF,YAAQ,KAAK,KAAK,CAAC;AAEnB,WAAO;AAAA,EACT,SAAS,OAAO;AACd,WAAQ,MAAgC,SAAS;AAAA,EACnD;AACF;AAaA,IAAM,kBAAkB,CAAC,QAA8B;AACrD,MAAI;AAEJ,MAAI;AACF,cAAU,GAAG,YAAY,GAAG;AAAA,EAC9B,QAAQ;AACN,WAAO,kBAAkB;AAAA,EAC3B;AAEA,QAAM,WAAW,oBAAI,IAAY;AACjC,QAAM,OAAO,oBAAI,IAA8B;AAE/C,aAAW,QAAQ,SAAS;AAC1B,QAAI,CAAC,KAAK,SAAS,OAAO,EAAG;AAE7B,QAAI;AACF,YAAM,SAAS,yBAAyB,UAAU,KAAK,MAAM,GAAG,aAAa,KAAK,KAAK,KAAK,IAAI,GAAG,OAAO,CAAC,CAAC;AAE5G,UAAI,CAAC,OAAO,QAAS;AAKrB,UAAI,CAAC,sBAAsB,OAAO,KAAK,GAAG,EAAG;AAE7C,eAAS,IAAI,OAAO,KAAK,OAAO;AAChC,WAAK,IAAI,OAAO,KAAK,SAAS;AAAA,QAC5B,MAAM,OAAO,KAAK;AAAA,QAClB,QAAQ,OAAO,KAAK;AAAA,QACpB,SAAS,OAAO,KAAK;AAAA,QACrB,OAAO,OAAO,KAAK;AAAA,QACnB,WAAW,OAAO,KAAK;AAAA,QACvB,MAAM,OAAO,KAAK;AAAA,MACpB,CAAC;AAAA,IACH,QAAQ;AAEN;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,UAAU,KAAK;AAC1B;AASO,IAAM,mBAAmB,CAAC,QAA8B;AAC7D,QAAM,MAAM,OAAO,KAAK,eAAe;AAEvC,MAAI,IAAK,QAAO,gBAAgB,GAAG;AAEnC,QAAM,SAAS,OAAO,KAAK,gBAAgB;AAE3C,MAAI,CAAC,OAAQ,QAAO,kBAAkB;AAEtC,MAAI;AACF,WAAO,EAAE,UAAU,IAAI,IAAI,gBAAgB,KAAK,MAAM,GAAG,aAAa,QAAQ,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,oBAAI,IAAI,EAAE;AAAA,EAC7G,QAAQ;AACN,WAAO,kBAAkB;AAAA,EAC3B;AACF;AAOO,IAAM,eAAe,CAAC,QAAqC;AAChE,SAAO,iBAAiB,GAAG,EAAE;AAC/B;",
+  "names": ["z", "z", "z", "z"]
+}

package/dist/lib/package-config/package-config-schema.d.ts

@@ -0,0 +1,35 @@
+import { z } from 'zod';
+/**
+ * Schema for the resolved (post-factory) package config object. `strictObject`
+ * rejects unknown keys so typos in `infra-kit.config.ts` surface as validation
+ * errors instead of being silently ignored.
+ *
+ * Kept in its own module — separate from the public `defineConfig`/types entry —
+ * so the published `infra-kit` type surface stays free of a `zod` import.
+ */
+export declare const packageConfigSchema: z.ZodObject<{
+    requiredScripts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    requiredFiles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    turbo: z.ZodOptional<z.ZodObject<{
+        requiredTasks: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    dev: z.ZodOptional<z.ZodObject<{
+        proxy: z.ZodOptional<z.ZodObject<{
+            templates: z.ZodObject<{
+                local: z.ZodString;
+                cloud: z.ZodString;
+            }, z.core.$strict>;
+            routes: z.ZodRecord<z.ZodString, z.ZodObject<{
+                packageName: z.ZodString;
+                from: z.ZodArray<z.ZodEnum<{
+                    local: "local";
+                    cloud: "cloud";
+                }>>;
+                default: z.ZodOptional<z.ZodEnum<{
+                    local: "local";
+                    cloud: "cloud";
+                }>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;

package/dist/lib/package-config/package-config.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Validation rules for a single workspace package, declared in its
+ * `infra-kit.config.ts`. Every field is optional: a key left unset falls back to
+ * the active baseline, and a key set replaces that default wholesale (per-key, no
+ * array concatenation) so a package can opt out with an explicit empty array.
+ *
+ * The baselines themselves (`DEFAULT_RULES` / `ROOT_DEFAULT_RULES`) deliberately do
+ * NOT live here — they are audit POLICY, and policy belongs to the `infra-kit` CLI
+ * that enforces it, not to the package a consumer installs to author a config.
+ *
+ * Most packages need none of these — the standard rules live in the baseline, so
+ * a typical config is just `defineConfig(() => ({}))`.
+ *
+ * @example
+ * // infra-kit.config.ts
+ * import { defineConfig } from '@slip-stream-kit/config'
+ *
+ * export default defineConfig(() => ({}))
+ */
+export interface InfraKitPackageConfig {
+    /** Scripts that must be present in the package's package.json `scripts` map. */
+    requiredScripts?: string[];
+    /** Files (relative to the package root) that must exist on disk. */
+    requiredFiles?: string[];
+    /** Turborepo expectations — only meaningful where a turbo.json lives (the root). */
+    turbo?: {
+        /** Tasks that must be defined in turbo.json `tasks`. */
+        requiredTasks?: string[];
+    };
+    /** Local-dev configuration. Accepted-and-inert to the audit; consumed by the dev server. */
+    dev?: InfraKitDev;
+}
+/** A proxy route's allowed backend source. */
+export type InfraKitDevProxySource = 'local' | 'cloud';
+export interface InfraKitDevProxyRoute {
+    /** Backend package this route targets when resolved locally. */
+    packageName: string;
+    /** Capabilities this route can resolve to. Must be non-empty. */
+    from: InfraKitDevProxySource[];
+    /**
+     * Source used when a local backend for this package isn't active. Required when
+     * `from` lists more than one source; redundant (and omitted) for a single-source
+     * route. When set, must be one of `from`.
+     */
+    default?: InfraKitDevProxySource;
+}
+export interface InfraKitDevProxy {
+    /** URL templates. Placeholders like `<release>`/`<packageName>`/`<env>` are substituted at dev time. */
+    templates: {
+        local: string;
+        cloud: string;
+    };
+    /** Path-prefix (e.g. `/api`, `/api/v1`, `/media`) → route definition. */
+    routes: Record<string, InfraKitDevProxyRoute>;
+}
+export interface InfraKitDev {
+    proxy?: InfraKitDevProxy;
+}
+/**
+ * Accepted shapes for a package config's default export — mirrors Vite's
+ * `defineConfig` input: a plain object, a sync factory, or an async factory.
+ */
+export type InfraKitPackageConfigInput = InfraKitPackageConfig | (() => InfraKitPackageConfig) | (() => Promise<InfraKitPackageConfig>);
+/**
+ * Identity helper that gives `infra-kit.config.ts` authors full type inference
+ * and editor autocomplete without changing the value — exactly like Vite's
+ * `defineConfig`. Resolution of the factory form happens in the CLI's loader, not here.
+ *
+ * @example
+ * export default defineConfig(() => ({}))
+ *
+ * @example
+ * export default defineConfig(() => ({ requiredScripts: [] }))
+ */
+export declare const defineConfig: (config: InfraKitPackageConfigInput) => InfraKitPackageConfigInput;

package/dist/lib/release-slug/release-slug.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Shared, dependency-light release-slug helper.
+ *
+ * Extracted from `lib/vite/vite.ts` so BOTH the published `infra-kit/vite` helper
+ * (which re-exports it) and the dev-server's dev-context fragment writer derive the
+ * `<release>` hostname segment from ONE implementation — the recorded slug and the
+ * helper-computed slug can never drift. Pure (regex only, no imports) so importing it
+ * into the lightweight `infra-kit/vite` bundle stays cheap.
+ */
+/**
+ * Slugify an arbitrary string into a single DNS label: lowercase, collapse every
+ * non-alphanumeric run to `-`, and drop leading/trailing separators. Returns `''`
+ * when the input carries no alphanumeric run (the caller must treat that as "no label").
+ *
+ * portless rejects any hostname outside `[a-z0-9.-]`, so every segment fed into a
+ * `<release>.<packageName>.localhost` alias must pass through here. A scoped npm name
+ * (`@hulyo/client-ui`) is the motivating case: registering it raw fails with
+ * `Invalid hostname`, and because the driver swallows that into a best-effort `false`,
+ * the whole hero-URL path degrades silently to `localhost:<port>`.
+ *
+ * Distinct from {@link slugifyRelease}: this does NOT strip a git-flow prefix, so a
+ * package legitimately named `fix-utils` keeps its `fix-` prefix.
+ *
+ * @example
+ * slugifyHostLabel('@hulyo/client-ui') // => 'hulyo-client-ui'
+ * slugifyHostLabel('backend-api')      // => 'backend-api'
+ */
+export declare const slugifyHostLabel: (label: string) => string;
+/**
+ * Slugify a git branch into a `<release>` token: strip a leading git-flow prefix
+ * (`feature/`, `release/`, …), then reduce the remainder to a single DNS label.
+ *
+ * @example
+ * slugifyRelease('release/2.4')     // => '2-4'
+ * slugifyRelease('feature/HUL-123') // => 'hul-123'
+ */
+export declare const slugifyRelease: (branch: string) => string;
+/**
+ * The `<release>` label used when no git branch resolves (outside a repo, or a branch that slugifies to
+ * nothing). Both the dev-server's alias writer and `infra-kit/vite`'s template interpolation fall back
+ * to this SAME constant — a divergence here would emit a hostname no alias backs.
+ */
+export declare const DEFAULT_RELEASE_SLUG = "local";

package/dist/lib/vendor/config-schema.d.ts

@@ -0,0 +1,58 @@
+import { z } from 'zod';
+/**
+ * Pure (node-free) vendor config schema + authoring helper. Kept separate from
+ * `config.ts` (which imports node builtins for the runtime loader) so the public
+ * lib entry can re-export `defineVendorConfig` without dragging node types into
+ * the emitted `.d.ts`.
+ */
+/**
+ * Filename a source repo provides at its root to declare WHAT `vendor sync`
+ * copies (`copy[]`). Lives ONLY on the write path — `vendor check` never loads it.
+ * WHERE/WHICH to stamp (`workspaceDir` + `targets`) is machine-local and lives in
+ * the user-global factory config (`~/.infra-kit/vendor.json`).
+ */
+export declare const VENDOR_CONFIG_FILE = "vendor.config.ts";
+/**
+ * One item to sync from the source repo into each target. `vendored: true` marks
+ * workspace packages that must land under `vendor/` (the single-source-of-truth
+ * code); everything else is root-level tooling that stays at the repo root.
+ */
+export declare const vendorCopyItemSchema: z.ZodObject<{
+    name: z.ZodString;
+    source: z.ZodString;
+    target: z.ZodString;
+    type: z.ZodEnum<{
+        file: "file";
+        directory: "directory";
+    }>;
+    vendored: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const vendorConfigSchema: z.ZodObject<{
+    copy: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        source: z.ZodString;
+        target: z.ZodString;
+        type: z.ZodEnum<{
+            file: "file";
+            directory: "directory";
+        }>;
+        vendored: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+}, z.core.$strict>;
+export type VendorCopyItem = z.infer<typeof vendorCopyItemSchema>;
+export type VendorConfig = z.infer<typeof vendorConfigSchema>;
+/**
+ * Identity helper for authoring a type-safe `vendor.config.ts` in a source repo.
+ * Re-exported from the public lib entry so a source repo can
+ * `import { defineVendorConfig } from 'infra-kit'`.
+ *
+ * NOTE: a `vendor.config.ts` must be type-strippable — Node's native type
+ * stripping (Node >= 24) loads it without a build step, which forbids `enum`,
+ * `namespace`, and parameter properties.
+ *
+ * @example
+ * export default defineVendorConfig({
+ *   copy: [{ name: 'Configs', source: 'vendor/configs', target: 'vendor/configs', type: 'directory', vendored: true }],
+ * })
+ */
+export declare const defineVendorConfig: (config: VendorConfig) => VendorConfig;