@slip-stream-kit/config 0.13.0 → 0.15.0

package/dist/entry/index.d.ts

@@ -1,4 +1,4 @@
 export { defineConfig } from '../lib/package-config/package-config';
-export type { InfraKitDev, InfraKitDevProxy, InfraKitDevProxyRoute, InfraKitDevProxySource, InfraKitE2e, InfraKitPackageConfig, InfraKitPackageConfigInput, InfraKitPackageType, } from '../lib/package-config/package-config';
+export type { InfraKitDev, InfraKitDevEnv, InfraKitDevProxy, InfraKitDevProxyRoute, InfraKitDevProxySource, InfraKitE2e, InfraKitPackageConfig, InfraKitPackageConfigInput, InfraKitPackageType, } from '../lib/package-config/package-config';
 export { defineVendorConfig } from '../lib/vendor/config-schema';
 export type { VendorConfig, VendorCopyItem } from '../lib/vendor/config-schema';

package/dist/entry/internal.d.ts

@@ -1,7 +1,10 @@
 export { packageConfigSchema } from '../lib/package-config/package-config-schema';
 export { DEV_SERVING_MARKER, E2E_MODE_ENV } from '../lib/playwright/playwright';
+export { readAppAliasHost, readAppAliasName } from '../lib/release-slug/app-alias';
 export { readRelease } from '../lib/release-slug/read-release';
 export { DEFAULT_RELEASE_SLUG, slugifyHostLabel, slugifyRelease } from '../lib/release-slug/release-slug';
+export { DEFAULT_REPO_SLUG, readRepoIdentity, readRepoSlug } from '../lib/release-slug/repo-slug';
+export type { RepoIdentity } from '../lib/release-slug/repo-slug';
 export { defineVendorConfig, VENDOR_CONFIG_FILE, vendorConfigSchema, vendorCopyItemSchema, } from '../lib/vendor/config-schema';
 export type { VendorConfig, VendorCopyItem } from '../lib/vendor/config-schema';
 export { describeProxyRoutes, DEV_CONTEXT_WIRE_VERSION, loadDev, loadPackageConfig, readCloudOrigin, readLocalContext, readLocalSet, } from '../lib/vite/vite';

package/dist/entry/vite.d.ts

@@ -1,2 +1,2 @@
-export { infraKitDev, infraKitProxy, resolveProxyConfig, slugifyRelease } from '../lib/vite/vite';
+export { infraKitDev, infraKitProxy, loadPackageConfig, resolveProxyConfig, slugifyRelease } from '../lib/vite/vite';
 export type { InfraKitBasicAuth, InfraKitDevOptions, InfraKitViteProxy, InfraKitViteProxyEntry } from '../lib/vite/vite';

package/dist/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/lib/package-config/package-config.ts", "../src/lib/vendor/config-schema.ts"],
-  "sourcesContent": ["/**\n * Validation rules for a single workspace package, declared in its\n * `infra-kit.config.ts`. Every field is optional: a key left unset falls back to\n * the active baseline, and a key set replaces that default wholesale (per-key, no\n * array concatenation) so a package can opt out with an explicit empty array.\n *\n * The baselines themselves (`DEFAULT_RULES` / `ROOT_DEFAULT_RULES`) deliberately do\n * NOT live here \u2014 they are audit POLICY, and policy belongs to the `infra-kit` CLI\n * that enforces it, not to the package a consumer installs to author a config.\n *\n * Most packages need none of these \u2014 the standard rules live in the baseline, so\n * a typical config is just `defineConfig(() => ({}))`.\n *\n * @example\n * // infra-kit.config.ts\n * import { defineConfig } from '@slip-stream-kit/config'\n *\n * export default defineConfig(() => ({}))\n */\nexport interface InfraKitPackageConfig {\n  /** Scripts that must be present in the package's package.json `scripts` map. */\n  requiredScripts?: string[]\n  /** Files (relative to the package root) that must exist on disk. */\n  requiredFiles?: string[]\n  /** Turborepo expectations \u2014 only meaningful where a turbo.json lives (the root). */\n  turbo?: {\n    /** Tasks that must be defined in turbo.json `tasks`. */\n    requiredTasks?: string[]\n  }\n  /**\n   * The env var holding this app part's deployed URL, e.g. `CLIENT_URL`. The value lives in Doppler, per\n   * environment \u2014 prod's host is not `<env>`-shaped, so no template in code can name it. The dev proxy sends\n   * a UI's cloud routes there, and e2e runs against it in cloud mode. Required on a UI whose `dev.proxy`\n   * has a route that can go to cloud, and on any `e2e.target`.\n   */\n  deployedUrlEnv?: string\n  /** Local-dev configuration. Accepted-and-inert to the audit; consumed by the dev server. */\n  dev?: InfraKitDev\n  /** Which app part this e2e package tests. Consumed by `infraKitE2e()` and the CLI, inert to the audit. */\n  e2e?: InfraKitE2e\n  /**\n   * Explicit override for infra-kit's directory/dependency-based package-type detection (used to\n   * pick the agent guidance rendered into this package's `CLAUDE.md`). Detection already covers\n   * both consumer repos untouched, so this is an escape hatch for the cases it gets wrong \u2014 leaving\n   * it unset is never an error.\n   *\n   * **Ordering precondition:** the CLI's own pinned `packageConfigSchema` \u2014 not this package's\n   * version \u2014 governs what a consumer's `infra-kit.config.ts` may contain, and it is a\n   * `z.strictObject`. Only write `type` here once the CLI in use is a version that carries this\n   * key; an older CLI rejects the key outright and skips the rest of that package's audit checks.\n   *\n   * @example\n   * // infra-kit.config.ts\n   * export default defineConfig(() => ({ type: 'frontend' }))\n   */\n  type?: InfraKitPackageType\n}\n\n/** Package kinds infra-kit's agent guidance renders type-specific rules for. */\nexport type InfraKitPackageType = 'frontend' | 'backend' | 'lib' | 'e2e' | 'mobile'\n\n/** A proxy route's allowed backend source. */\nexport type InfraKitDevProxySource = 'local' | 'cloud'\n\nexport interface InfraKitDevProxyRoute {\n  /** Backend package this route targets when resolved locally. */\n  packageName: string\n  /** Capabilities this route can resolve to. Must be non-empty. */\n  from: InfraKitDevProxySource[]\n  /**\n   * Source used when a local backend for this package isn't active. Required when\n   * `from` lists more than one source; redundant (and omitted) for a single-source\n   * route. When set, must be one of `from`.\n   */\n  default?: InfraKitDevProxySource\n}\n\nexport interface InfraKitDevProxy {\n  /**\n   * The local backend's URL template \u2014 `<release>`/`<packageName>` are substituted at dev time. A cloud route\n   * goes to the package's `deployedUrlEnv` instead.\n   */\n  templates: {\n    local: string\n  }\n  /** Path-prefix (e.g. `/api`, `/api/v1`, `/media`) \u2192 route definition. */\n  routes: Record<string, InfraKitDevProxyRoute>\n}\n\nexport interface InfraKitDev {\n  proxy?: InfraKitDevProxy\n}\n\n/**\n * The e2e package's target. `infraKitE2e()` (`@slip-stream-kit/config/playwright`) reads it: a run is local\n * by default \u2014 `target` on this worktree, served by `infra-kit dev <app>` \u2014 and cloud only when asked\n * (`INFRA_KIT_E2E=cloud`, or CI), against the URL in the target package's `deployedUrlEnv`.\n *\n * @example\n * // apps/client/tests/infra-kit.config.ts\n * export default defineConfig(() => ({ e2e: { target: 'client/ui' } }))\n */\nexport interface InfraKitE2e {\n  /** The package under test, `<app>/ui` or `<app>/api`. */\n  target: string\n}\n\n/**\n * Accepted shapes for a package config's default export \u2014 mirrors Vite's\n * `defineConfig` input: a plain object, a sync factory, or an async factory.\n */\nexport type InfraKitPackageConfigInput =\n  InfraKitPackageConfig | (() => InfraKitPackageConfig) | (() => Promise<InfraKitPackageConfig>)\n\n/**\n * Identity helper that gives `infra-kit.config.ts` authors full type inference\n * and editor autocomplete without changing the value \u2014 exactly like Vite's\n * `defineConfig`. Resolution of the factory form happens in the CLI's loader, not here.\n *\n * @example\n * export default defineConfig(() => ({}))\n * @example\n * export default defineConfig(() => ({ requiredScripts: [] }))\n */\nexport const defineConfig = (config: InfraKitPackageConfigInput): InfraKitPackageConfigInput => {\n  return config\n}\n", "import { z } from 'zod'\n\n/**\n * Pure (node-free) vendor config schema + authoring helper. Kept separate from\n * `config.ts` (which imports node builtins for the runtime loader) so the public\n * lib entry can re-export `defineVendorConfig` without dragging node types into\n * the emitted `.d.ts`.\n */\n\n/**\n * Filename a source repo provides at its root to declare WHAT `vendor sync`\n * copies (`copy[]`). Lives ONLY on the write path \u2014 `vendor check` never loads it.\n * WHERE/WHICH to stamp (`workspaceDir` + `targets`) is machine-local and lives in\n * the user-global factory config (`~/.infra-kit/vendor.json`).\n */\nexport const VENDOR_CONFIG_FILE = 'vendor.config.ts'\n\n/**\n * A non-empty, repo-relative path with no `..` segments and no absolute prefix\n * (POSIX `/`, UNC/`\\`, or a Windows drive like `C:`). Containment guard for\n * vendor copy items so a malicious/typo config can't read or write outside the\n * source/target repo roots. Kept as a string/regex check (no `node:path`) to\n * respect this file's node-free constraint \u2014 `sync-ops.ts` does the resolved\n * runtime containment assert as defense in depth.\n */\nconst safeRelPath = z.string().refine(\n  (p) => {\n    const isAbsolute = /^(?:[/\\\\]|[a-z]:)/i.test(p)\n    const hasDotDotSegment = p.split(/[\\\\/]/).includes('..')\n\n    return !isAbsolute && !hasDotDotSegment && p.trim().length > 0\n  },\n  { message: 'must be a non-empty repo-relative path without \"..\" segments' },\n)\n\n/**\n * One item to sync from the source repo into each target. `vendored: true` marks\n * workspace packages that must land under `vendor/` (the single-source-of-truth\n * code); everything else is root-level tooling that stays at the repo root.\n */\nexport const vendorCopyItemSchema = z.object({\n  name: z.string(),\n  source: safeRelPath,\n  target: safeRelPath,\n  type: z.enum(['file', 'directory']),\n  vendored: z.boolean().optional(),\n})\n\nexport const vendorConfigSchema = z\n  .object({\n    /** Files/dirs to copy. Items with `vendored: true` land under `vendor/`. */\n    copy: z.array(vendorCopyItemSchema),\n  })\n  // Reject stray keys so a leftover `targets` (now machine-local, in\n  // ~/.infra-kit/vendor.json) yields a clear \"unrecognized key\" error rather\n  // than being silently ignored.\n  .strict()\n\nexport type VendorCopyItem = z.infer<typeof vendorCopyItemSchema>\nexport type VendorConfig = z.infer<typeof vendorConfigSchema>\n\n/**\n * Identity helper for authoring a type-safe `vendor.config.ts` in a source repo.\n * Re-exported from the public lib entry so a source repo can\n * `import { defineVendorConfig } from 'infra-kit'`.\n *\n * NOTE: a `vendor.config.ts` must be type-strippable \u2014 Node's native type\n * stripping (Node >= 24) loads it without a build step, which forbids `enum`,\n * `namespace`, and parameter properties.\n *\n * @example\n * export default defineVendorConfig({\n *   copy: [{ name: 'Configs', source: 'vendor/configs', target: 'vendor/configs', type: 'directory', vendored: true }],\n * })\n */\nexport const defineVendorConfig = (config: VendorConfig): VendorConfig => {\n  return config\n}\n"],
-  "mappings": ";AA4HO,IAAM,eAAe,CAAC,WAAmE;AAC9F,SAAO;AACT;;;AC9HA,SAAS,SAAS;AAyBlB,IAAM,cAAc,EAAE,OAAO,EAAE;AAAA,EAC7B,CAAC,MAAM;AACL,UAAM,aAAa,qBAAqB,KAAK,CAAC;AAC9C,UAAM,mBAAmB,EAAE,MAAM,OAAO,EAAE,SAAS,IAAI;AAEvD,WAAO,CAAC,cAAc,CAAC,oBAAoB,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/D;AAAA,EACA,EAAE,SAAS,+DAA+D;AAC5E;AAOO,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,MAAM,EAAE,OAAO;AAAA,EACf,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,MAAM,EAAE,KAAK,CAAC,QAAQ,WAAW,CAAC;AAAA,EAClC,UAAU,EAAE,QAAQ,EAAE,SAAS;AACjC,CAAC;AAEM,IAAM,qBAAqB,EAC/B,OAAO;AAAA;AAAA,EAEN,MAAM,EAAE,MAAM,oBAAoB;AACpC,CAAC,EAIA,OAAO;AAmBH,IAAM,qBAAqB,CAAC,WAAuC;AACxE,SAAO;AACT;",
+  "sourcesContent": ["/**\n * Validation rules for a single workspace package, declared in its\n * `infra-kit.config.ts`. Every field is optional: a key left unset falls back to\n * the active baseline, and a key set replaces that default wholesale (per-key, no\n * array concatenation) so a package can opt out with an explicit empty array.\n *\n * The baselines themselves (`DEFAULT_RULES` / `ROOT_DEFAULT_RULES`) deliberately do\n * NOT live here \u2014 they are audit POLICY, and policy belongs to the `infra-kit` CLI\n * that enforces it, not to the package a consumer installs to author a config.\n *\n * Most packages need none of these \u2014 the standard rules live in the baseline, so\n * a typical config is just `defineConfig(() => ({}))`.\n *\n * @example\n * // infra-kit.config.ts\n * import { defineConfig } from '@slip-stream-kit/config'\n *\n * export default defineConfig(() => ({}))\n */\nexport interface InfraKitPackageConfig {\n  /** Scripts that must be present in the package's package.json `scripts` map. */\n  requiredScripts?: string[]\n  /** Files (relative to the package root) that must exist on disk. */\n  requiredFiles?: string[]\n  /** Turborepo expectations \u2014 only meaningful where a turbo.json lives (the root). */\n  turbo?: {\n    /** Tasks that must be defined in turbo.json `tasks`. */\n    requiredTasks?: string[]\n  }\n  /**\n   * The env var holding this app part's deployed URL, e.g. `CLIENT_URL`. The value lives in Doppler, per\n   * environment \u2014 prod's host is not `<env>`-shaped, so no template in code can name it. The dev proxy sends\n   * a UI's cloud routes there, and e2e runs against it in cloud mode. Required on a UI whose `dev.proxy`\n   * has a route that can go to cloud, and on any `e2e.target`.\n   */\n  deployedUrlEnv?: string\n  /** Local-dev configuration. Accepted-and-inert to the audit; consumed by the dev server. */\n  dev?: InfraKitDev\n  /** Which app part this e2e package tests. Consumed by `infraKitE2e()` and the CLI, inert to the audit. */\n  e2e?: InfraKitE2e\n  /**\n   * Explicit override for infra-kit's directory/dependency-based package-type detection (used to\n   * pick the agent guidance rendered into this package's `CLAUDE.md`). Detection already covers\n   * both consumer repos untouched, so this is an escape hatch for the cases it gets wrong \u2014 leaving\n   * it unset is never an error.\n   *\n   * **Ordering precondition:** the CLI's own pinned `packageConfigSchema` \u2014 not this package's\n   * version \u2014 governs what a consumer's `infra-kit.config.ts` may contain, and it is a\n   * `z.strictObject`. Only write `type` here once the CLI in use is a version that carries this\n   * key; an older CLI rejects the key outright and skips the rest of that package's audit checks.\n   *\n   * @example\n   * // infra-kit.config.ts\n   * export default defineConfig(() => ({ type: 'frontend' }))\n   */\n  type?: InfraKitPackageType\n}\n\n/** Package kinds infra-kit's agent guidance renders type-specific rules for. */\nexport type InfraKitPackageType = 'frontend' | 'backend' | 'lib' | 'e2e' | 'mobile'\n\n/** A proxy route's allowed backend source. */\nexport type InfraKitDevProxySource = 'local' | 'cloud'\n\nexport interface InfraKitDevProxyRoute {\n  /** Backend package this route targets when resolved locally. */\n  packageName: string\n  /** Capabilities this route can resolve to. Must be non-empty. */\n  from: InfraKitDevProxySource[]\n  /**\n   * Source used when a local backend for this package isn't active. Required when\n   * `from` lists more than one source; redundant (and omitted) for a single-source\n   * route. When set, must be one of `from`.\n   */\n  default?: InfraKitDevProxySource\n}\n\nexport interface InfraKitDevProxy {\n  /**\n   * The local backend's URL template \u2014 `<release>`/`<packageName>` are substituted at dev time. A cloud route\n   * goes to the package's `deployedUrlEnv` instead. Consulted only for a fragment from a pre-v2 CLI: a\n   * current one publishes the exact `origin` (`<release>.<packageName>.<repo>.localhost`) it registered.\n   */\n  templates: {\n    local: string\n  }\n  /** Path-prefix (e.g. `/api`, `/api/v1`, `/media`) \u2192 route definition. */\n  routes: Record<string, InfraKitDevProxyRoute>\n}\n\nexport interface InfraKitDev {\n  proxy?: InfraKitDevProxy\n  env?: InfraKitDevEnv\n}\n\n/**\n * Env overrides for this package's dev server only, applied over the loaded (Doppler) env when vite starts\n * it \u2014 never on `build`. For variables another build mode needs that break local dev, e.g. a mobile-only\n * absolute origin that sends requests around the dev proxy.\n *\n * @example\n * // apps/client/ui/infra-kit.config.ts\n * export default defineConfig(() => ({ dev: { env: { unset: ['VITE_ORIGIN_DOMAIN'] } } }))\n */\nexport interface InfraKitDevEnv {\n  /** Variables removed from the dev server's env. */\n  unset?: string[]\n  /** Variables set (or overridden) in the dev server's env. A name cannot also be in `unset`. */\n  set?: Record<string, string>\n}\n\n/**\n * The e2e package's target. `infraKitE2e()` (`@slip-stream-kit/config/playwright`) reads it: a run is local\n * by default \u2014 `target` on this worktree, served by `infra-kit dev <app>` \u2014 and cloud only when asked\n * (`INFRA_KIT_E2E=cloud`, or CI), against the URL in the target package's `deployedUrlEnv`.\n *\n * @example\n * // apps/client/tests/infra-kit.config.ts\n * export default defineConfig(() => ({ e2e: { target: 'client/ui' } }))\n */\nexport interface InfraKitE2e {\n  /** The package under test, `<app>/ui` or `<app>/api`. */\n  target: string\n}\n\n/**\n * Accepted shapes for a package config's default export \u2014 mirrors Vite's\n * `defineConfig` input: a plain object, a sync factory, or an async factory.\n */\nexport type InfraKitPackageConfigInput =\n  InfraKitPackageConfig | (() => InfraKitPackageConfig) | (() => Promise<InfraKitPackageConfig>)\n\n/**\n * Identity helper that gives `infra-kit.config.ts` authors full type inference\n * and editor autocomplete without changing the value \u2014 exactly like Vite's\n * `defineConfig`. Resolution of the factory form happens in the CLI's loader, not here.\n *\n * @example\n * export default defineConfig(() => ({}))\n * @example\n * export default defineConfig(() => ({ requiredScripts: [] }))\n */\nexport const defineConfig = (config: InfraKitPackageConfigInput): InfraKitPackageConfigInput => {\n  return config\n}\n", "import { z } from 'zod'\n\n/**\n * Pure (node-free) vendor config schema + authoring helper. Kept separate from\n * `config.ts` (which imports node builtins for the runtime loader) so the public\n * lib entry can re-export `defineVendorConfig` without dragging node types into\n * the emitted `.d.ts`.\n */\n\n/**\n * Filename a source repo provides at its root to declare WHAT `vendor sync`\n * copies (`copy[]`). Lives ONLY on the write path \u2014 `vendor check` never loads it.\n * WHERE/WHICH to stamp (`workspaceDir` + `targets`) is machine-local and lives in\n * the user-global factory config (`~/.infra-kit/vendor.json`).\n */\nexport const VENDOR_CONFIG_FILE = 'vendor.config.ts'\n\n/**\n * A non-empty, repo-relative path with no `..` segments and no absolute prefix\n * (POSIX `/`, UNC/`\\`, or a Windows drive like `C:`). Containment guard for\n * vendor copy items so a malicious/typo config can't read or write outside the\n * source/target repo roots. Kept as a string/regex check (no `node:path`) to\n * respect this file's node-free constraint \u2014 `sync-ops.ts` does the resolved\n * runtime containment assert as defense in depth.\n */\nconst safeRelPath = z.string().refine(\n  (p) => {\n    const isAbsolute = /^(?:[/\\\\]|[a-z]:)/i.test(p)\n    const hasDotDotSegment = p.split(/[\\\\/]/).includes('..')\n\n    return !isAbsolute && !hasDotDotSegment && p.trim().length > 0\n  },\n  { message: 'must be a non-empty repo-relative path without \"..\" segments' },\n)\n\n/**\n * One item to sync from the source repo into each target. `vendored: true` marks\n * workspace packages that must land under `vendor/` (the single-source-of-truth\n * code); everything else is root-level tooling that stays at the repo root.\n */\nexport const vendorCopyItemSchema = z.object({\n  name: z.string(),\n  source: safeRelPath,\n  target: safeRelPath,\n  type: z.enum(['file', 'directory']),\n  vendored: z.boolean().optional(),\n})\n\nexport const vendorConfigSchema = z\n  .object({\n    /** Files/dirs to copy. Items with `vendored: true` land under `vendor/`. */\n    copy: z.array(vendorCopyItemSchema),\n  })\n  // Reject stray keys so a leftover `targets` (now machine-local, in\n  // ~/.infra-kit/vendor.json) yields a clear \"unrecognized key\" error rather\n  // than being silently ignored.\n  .strict()\n\nexport type VendorCopyItem = z.infer<typeof vendorCopyItemSchema>\nexport type VendorConfig = z.infer<typeof vendorConfigSchema>\n\n/**\n * Identity helper for authoring a type-safe `vendor.config.ts` in a source repo.\n * Re-exported from the public lib entry so a source repo can\n * `import { defineVendorConfig } from 'infra-kit'`.\n *\n * NOTE: a `vendor.config.ts` must be type-strippable \u2014 Node's native type\n * stripping (Node >= 24) loads it without a build step, which forbids `enum`,\n * `namespace`, and parameter properties.\n *\n * @example\n * export default defineVendorConfig({\n *   copy: [{ name: 'Configs', source: 'vendor/configs', target: 'vendor/configs', type: 'directory', vendored: true }],\n * })\n */\nexport const defineVendorConfig = (config: VendorConfig): VendorConfig => {\n  return config\n}\n"],
+  "mappings": ";AA8IO,IAAM,eAAe,CAAC,WAAmE;AAC9F,SAAO;AACT;;;AChJA,SAAS,SAAS;AAyBlB,IAAM,cAAc,EAAE,OAAO,EAAE;AAAA,EAC7B,CAAC,MAAM;AACL,UAAM,aAAa,qBAAqB,KAAK,CAAC;AAC9C,UAAM,mBAAmB,EAAE,MAAM,OAAO,EAAE,SAAS,IAAI;AAEvD,WAAO,CAAC,cAAc,CAAC,oBAAoB,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/D;AAAA,EACA,EAAE,SAAS,+DAA+D;AAC5E;AAOO,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,MAAM,EAAE,OAAO;AAAA,EACf,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,MAAM,EAAE,KAAK,CAAC,QAAQ,WAAW,CAAC;AAAA,EAClC,UAAU,EAAE,QAAQ,EAAE,SAAS;AACjC,CAAC;AAEM,IAAM,qBAAqB,EAC/B,OAAO;AAAA;AAAA,EAEN,MAAM,EAAE,MAAM,oBAAoB;AACpC,CAAC,EAIA,OAAO;AAmBH,IAAM,qBAAqB,CAAC,WAAuC;AACxE,SAAO;AACT;",
   "names": []
 }

package/dist/internal.js

@@ -51,7 +51,18 @@ var packageConfigSchema = z.strictObject({
           }
         )
       )
-    }).optional()
+    }).optional(),
+    env: z.strictObject({
+      unset: z.array(z.string().regex(ENV_VAR_NAME, "dev.env.unset entries must be env var names")).optional(),
+      set: z.record(z.string().regex(ENV_VAR_NAME, "dev.env.set keys must be env var names"), z.string()).optional()
+    }).refine(
+      (env) => {
+        return !env.unset?.some((name) => {
+          return env.set?.[name] !== void 0;
+        });
+      },
+      { message: "a variable cannot be in both `dev.env.unset` and `dev.env.set`" }
+    ).optional()
   }).optional(),
   e2e: z.strictObject({
     target: z.string().regex(/^[^/\s]+\/(?:ui|api)$/, "target must be `<app>/ui` or `<app>/api` (e.g. `client/ui`)"),
@@ -77,9 +88,11 @@ var packageConfigSchema = z.strictObject({
 import { execFileSync } from "node:child_process";
 
 // src/lib/release-slug/release-slug.ts
+var MAX_DNS_LABEL_LENGTH = 63;
 var slugifyHostLabel = (label) => {
   const runs = label.toLowerCase().match(/[a-z0-9]+/g);
-  return runs ? runs.join("-") : "";
+  const capped = runs ? runs.join("-").slice(0, MAX_DNS_LABEL_LENGTH) : "";
+  return capped.endsWith("-") ? capped.slice(0, -1) : capped;
 };
 var slugifyRelease = (branch) => {
   return slugifyHostLabel(branch.replace(/^(?:feature|feat|release|hotfix|bugfix|fix|chore)\//i, ""));
@@ -100,15 +113,53 @@ var readRelease = (cwd) => {
   }
 };
 
+// src/lib/release-slug/repo-slug.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
+import path from "node:path";
+var DEFAULT_REPO_SLUG = "repo";
+var readRepoIdentity = (cwd) => {
+  let commonDir;
+  try {
+    commonDir = execFileSync2("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return { root: null, slug: DEFAULT_REPO_SLUG };
+  }
+  const name = path.basename(commonDir);
+  if (commonDir.includes(`${path.sep}.git${path.sep}modules${path.sep}`)) {
+    return { root: null, slug: slugifyHostLabel(name) || DEFAULT_REPO_SLUG };
+  }
+  const root = name.startsWith(".") ? path.dirname(commonDir) : commonDir;
+  return { root, slug: slugifyHostLabel(path.basename(root).replace(/\.git$/, "")) || DEFAULT_REPO_SLUG };
+};
+var readRepoSlug = (cwd) => {
+  return readRepoIdentity(cwd).slug;
+};
+
+// src/lib/release-slug/app-alias.ts
+var readAppAliasName = (packageName, appDir) => {
+  const label = slugifyHostLabel(packageName);
+  if (label === "") {
+    throw new Error(`infra-kit: package name "${packageName}" has no letters or digits to build a hostname from.`);
+  }
+  return `${readRelease(appDir)}.${label}.${readRepoSlug(appDir)}`;
+};
+var readAppAliasHost = (packageName, appDir) => {
+  return `${readAppAliasName(packageName, appDir)}.localhost`;
+};
+
 // src/lib/vite/vite.ts
 import fs from "node:fs";
-import path from "node:path";
+import path2 from "node:path";
 import process from "node:process";
 import { pathToFileURL } from "node:url";
 import { z as z2 } from "zod";
 var PACKAGE_CONFIG_FILE = "infra-kit.config.ts";
-var DEV_CONTEXT_DIR = path.join(".infra-kit", "dev-context");
-var DEV_CONTEXT_FILE = path.join(".infra-kit", "dev-context.json");
+var DEV_CONTEXT_DIR = path2.join(".infra-kit", "dev-context");
+var DEV_CONTEXT_FILE = path2.join(".infra-kit", "dev-context.json");
 var devContextFragmentSchema = z2.object({
   package: z2.string(),
   port: z2.number(),
@@ -163,6 +214,8 @@ var resolveLocalTarget = (args) => {
     // The local template resolves to a `<release>.<packageName>.localhost` alias the dev-server
     // registered with portless — which slugifies the package name to a legal DNS label. Slugify
     // identically here or a scoped name (`@hulyo/client-ui`) emits a target that no alias backs.
+    // There is no `<repo>` token on purpose: only a pre-v2 CLI writes an origin-less fragment, and that
+    // CLI registered its aliases without a repo label, so the legacy template is exact for it.
     packageName: slugifyHostLabel(route.packageName),
     env: env ?? ""
   });
@@ -216,7 +269,7 @@ var readCloudOrigin = (envVar, env = process.env) => {
   return { envVar, url: envVar ? env[envVar] || void 0 : void 0 };
 };
 var loadPackageConfig = async (cwd) => {
-  const configPath = path.join(cwd, PACKAGE_CONFIG_FILE);
+  const configPath = path2.join(cwd, PACKAGE_CONFIG_FILE);
   if (!fs.existsSync(configPath)) return void 0;
   const stat = fs.statSync(configPath);
   const moduleUrl = `${pathToFileURL(configPath).href}?mtime=${Number(stat.mtimeMs)}`;
@@ -234,7 +287,7 @@ var loadPackageConfig = async (cwd) => {
 };
 var loadDev = async (cwd) => {
   const dev = (await loadPackageConfig(cwd))?.dev;
-  warnIfNonHttpsLocalTemplate(dev, path.join(cwd, PACKAGE_CONFIG_FILE));
+  warnIfNonHttpsLocalTemplate(dev, path2.join(cwd, PACKAGE_CONFIG_FILE));
   return dev;
 };
 var extractPackages = (parsed) => {
@@ -254,11 +307,11 @@ var extractPackages = (parsed) => {
   return [];
 };
 var findUp = (start, relative) => {
-  let dir = path.resolve(start);
+  let dir = path2.resolve(start);
   for (; ; ) {
-    const candidate = path.join(dir, relative);
+    const candidate = path2.join(dir, relative);
     if (fs.existsSync(candidate)) return candidate;
-    const parent = path.dirname(dir);
+    const parent = path2.dirname(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
@@ -287,7 +340,7 @@ var readFragmentDir = (dir) => {
   for (const name of entries) {
     if (!name.endsWith(".json")) continue;
     try {
-      const parsed = devContextFragmentSchema.safeParse(JSON.parse(fs.readFileSync(path.join(dir, name), "utf-8")));
+      const parsed = devContextFragmentSchema.safeParse(JSON.parse(fs.readFileSync(path2.join(dir, name), "utf-8")));
       if (!parsed.success) continue;
       if (!isFragmentWriterAlive(parsed.data.pid)) continue;
       packages.add(parsed.data.package);
@@ -351,6 +404,7 @@ var defineVendorConfig = (config) => {
 };
 export {
   DEFAULT_RELEASE_SLUG,
+  DEFAULT_REPO_SLUG,
   DEV_CONTEXT_WIRE_VERSION,
   DEV_SERVING_MARKER,
   E2E_MODE_ENV,
@@ -360,10 +414,14 @@ export {
   loadDev,
   loadPackageConfig,
   packageConfigSchema,
+  readAppAliasHost,
+  readAppAliasName,
   readCloudOrigin,
   readLocalContext,
   readLocalSet,
   readRelease,
+  readRepoIdentity,
+  readRepoSlug,
   slugifyHostLabel,
   slugifyRelease,
   vendorConfigSchema,