@somewhere-cloud/cli 0.38.4 → 0.38.6

package/dist/lib/temp-auth.js

@@ -4,8 +4,7 @@
  *  src/commands/deploy.ts for how the minted credential is cached/reused and
  *  wired into the normal deploy flow. */
 import { createHash } from 'node:crypto';
-import { API_BASE_URL } from './client.js';
-import { fetchWithProxy } from './http.js';
+import { ApiClient, CliApiError } from './client.js';
 /** Count LEADING ZERO BITS (not hex chars — the server's difficulty unit is
  *  bits) in a digest. Walks bytes most-significant-first and stops counting
  *  at the first 1 bit, whether that's mid-byte or in a later byte. */
@@ -41,33 +40,26 @@ export function solvePow(nonce, difficulty) {
     }
 }
 /** Mint a temporary, no-login developer credential: GET the PoW challenge,
- *  solve it locally, POST the solution for a bearer key. `fetchImpl` is
- *  injectable so tests never touch
- *  the network. Throws a clear Error — including the server's own message
- *  where available — on any failure at either step. */
-export async function mintTempAccount(fetchImpl = fetchWithProxy) {
-    const challengeRes = await fetchImpl(`${API_BASE_URL}/auth/pow/challenge`);
-    const challengeBody = (await challengeRes.json());
-    if (!challengeRes.ok || challengeBody.ok !== true || !challengeBody.data) {
-        throw new Error(`Could not fetch a proof-of-work challenge: ${challengeBody.message ?? challengeBody.error ?? challengeRes.statusText}`);
+ *  solve it locally, POST the solution for a bearer key.
+ *
+ *  Both routes are public: the request carries no credential, never runs the
+ *  stored login's refresh, and is never resent. Failures are the platform's
+ *  typed errors (pfb_011a9fd3f5f3): CliApiError with the documented `code`
+ *  (RATE_LIMITED, INVALID_POW, TEMP_DEPLOYS_DISABLED, ...), HTTP status,
+ *  retry / retry_after_ms and request/trace ids, and INVALID_RESPONSE with
+ *  the status for a body that is not JSON. */
+export async function mintTempAccount(client = new ApiClient(null)) {
+    const challenge = await client.call('GET', '/auth/pow/challenge', undefined, undefined, { refresh: false });
+    if (!challenge || typeof challenge.nonce !== 'string' || typeof challenge.difficulty !== 'number') {
+        throw new CliApiError('INVALID_RESPONSE', 'The proof-of-work challenge response had no nonce or difficulty.', 200);
     }
-    const challenge = challengeBody.data;
     const { suffix } = solvePow(challenge.nonce, challenge.difficulty);
-    const createRes = await fetchImpl(`${API_BASE_URL}/auth/temp-create`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ nonce: challenge.nonce, suffix }),
-    });
-    const createBody = (await createRes.json());
-    if (!createRes.ok || createBody.ok !== true || !createBody.data) {
-        throw new Error(`Could not create a temporary session: ${createBody.message ?? createBody.error ?? createRes.statusText}`);
-    }
-    const data = createBody.data;
+    const data = await client.call('POST', '/auth/temp-create', { nonce: challenge.nonce, suffix }, undefined, { refresh: false });
     // Prefer `key` (the field name every other stored CLI credential uses);
     // fall back to `access_token` — the contract names both.
-    const key = data.key ?? data.access_token;
+    const key = data?.key ?? data?.access_token;
     if (!key) {
-        throw new Error('Temp-create response had neither `key` nor `access_token`.');
+        throw new CliApiError('INVALID_RESPONSE', 'The temporary account response had neither `key` nor `access_token`.', 200);
     }
     return {
         key,

package/dist/lib/temp-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"temp-auth.js","sourceRoot":"","sources":["../../src/lib/temp-auth.ts"],"names":[],"mappings":"AAAA;;;;yCAIyC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AA4B3C;;sEAEsE;AACtE,MAAM,UAAU,eAAe,CAAC,GAAe;IAC7C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,IAAI,EAAE,CAAC;YACP,IAAI,KAAK,CAAC,CAAC;QACb,CAAC;QACD,MAAM;IACR,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;wEAIwE;AACxE,MAAM,UAAU,QAAQ,CAAC,KAAa,EAAE,UAAkB;IACxD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QAChF,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;YACxC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,CAAC;IACH,CAAC;AACH,CAAC;AASD;;;;uDAIuD;AACvD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,YAAmC,cAAc;IAEjD,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,GAAG,YAAY,qBAAqB,CAAC,CAAC;IAC3E,MAAM,aAAa,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAA2B,CAAC;IAC5E,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,aAAa,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CACb,8CAA8C,aAAa,CAAC,OAAO,IAAI,aAAa,CAAC,KAAK,IAAI,YAAY,CAAC,UAAU,EAAE,CACxH,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC;IACrC,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IAEnE,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,GAAG,YAAY,mBAAmB,EAAE;QACpE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;KACzD,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAsC,CAAC;IACjF,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,UAAU,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,yCAAyC,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,IAAI,SAAS,CAAC,UAAU,EAAE,CAC1G,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAC7B,wEAAwE;IACxE,yDAAyD;IACzD,MAAM,GAAG,GAAI,IAAI,CAAC,GAA0B,IAAK,IAAI,CAAC,YAAmC,CAAC;IAC1F,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO;QACL,GAAG;QACH,UAAU,EAAE,IAAI,CAAC,UAAgC;QACjD,MAAM,EAAE,IAAI,CAAC,MAA4B;QACzC,MAAM,EAAG,IAAI,CAAC,MAA+B,IAAI,EAAE;QACnD,UAAU,EAAE,IAAI,CAAC,UAAoB;QACrC,WAAW,EAAE,IAAI,CAAC,WAAqB;QACvC,WAAW,EAAE,IAAI,CAAC,WAAqB;QACvC,SAAS,EAAE,IAAI,CAAC,SAAmB;KACpC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"temp-auth.js","sourceRoot":"","sources":["../../src/lib/temp-auth.ts"],"names":[],"mappings":"AAAA;;;;yCAIyC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA4BrD;;sEAEsE;AACtE,MAAM,UAAU,eAAe,CAAC,GAAe;IAC7C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,IAAI,EAAE,CAAC;YACP,IAAI,KAAK,CAAC,CAAC;QACb,CAAC;QACD,MAAM;IACR,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;wEAIwE;AACxE,MAAM,UAAU,QAAQ,CAAC,KAAa,EAAE,UAAkB;IACxD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QAChF,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;YACxC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;8CAQ8C;AAC9C,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAkC,IAAI,SAAS,CAAC,IAAI,CAAC;IACzF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAwB,KAAK,EAAE,qBAAqB,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACnI,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClG,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE,kEAAkE,EAAE,GAAG,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IAEnE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAC5B,MAAM,EAAE,mBAAmB,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAC/F,CAAC;IACF,wEAAwE;IACxE,yDAAyD;IACzD,MAAM,GAAG,GAAI,IAAI,EAAE,GAA0B,IAAK,IAAI,EAAE,YAAmC,CAAC;IAC5F,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE,sEAAsE,EAAE,GAAG,CAAC,CAAC;IACzH,CAAC;IACD,OAAO;QACL,GAAG;QACH,UAAU,EAAE,IAAI,CAAC,UAAgC;QACjD,MAAM,EAAE,IAAI,CAAC,MAA4B;QACzC,MAAM,EAAG,IAAI,CAAC,MAA+B,IAAI,EAAE;QACnD,UAAU,EAAE,IAAI,CAAC,UAAoB;QACrC,WAAW,EAAE,IAAI,CAAC,WAAqB;QACvC,WAAW,EAAE,IAAI,CAAC,WAAqB;QACvC,SAAS,EAAE,IAAI,CAAC,SAAmB;KACpC,CAAC;AACJ,CAAC"}

package/dist/lib/typecheck.js

@@ -108,24 +108,13 @@ export function planDeclaredTypePackages(projectDir) {
     }
     return { specs, missing };
 }
-function npmInstallTypePackages(specs, projectDir) {
-    const result = spawnSync(process.platform === 'win32' ? 'npm.cmd' : 'npm', ['install', '--no-save', '--no-audit', '--no-fund', '--loglevel', 'error', ...specs], {
-        cwd: projectDir,
-        stdio: 'ignore',
-        shell: process.platform === 'win32',
-    });
-    if (result.error)
-        throw result.error;
-    if (result.status !== 0)
-        throw new Error(`npm install exited ${result.status}`);
-}
 /**
- * Resolve declared-but-missing type packages. Fail-OPEN by contract: if the
- * install cannot run (offline, no npm, a private registry) the typecheck still
- * proceeds and reports whatever tsc finds. This step may never be the reason a
- * check does not happen.
+ * Resolve declared-but-missing type packages with a caller-supplied installer.
+ * The CLI's own commands never install into a project (tsk_97979518,
+ * pfb_8f0f7cdd04a1): they refuse with missingTypePackagesMessage instead.
+ * Fail-open: an installer that throws never blocks the check.
  */
-export function ensureDeclaredTypePackages(projectDir, install = npmInstallTypePackages) {
+export function ensureDeclaredTypePackages(projectDir, install) {
     const plan = planDeclaredTypePackages(projectDir);
     if (plan.specs.length === 0)
         return { ...plan, installed: false };
@@ -137,6 +126,169 @@ export function ensureDeclaredTypePackages(projectDir, install = npmInstallTypeP
         return { ...plan, installed: false };
     }
 }
+/** Why a check did not run: declared type packages are not installed. The
+ *  typecheck never installs them itself (it would change the project tree and
+ *  run package scripts). */
+export function missingTypePackagesMessage(missing, projectDir) {
+    return `Not checked: this project's declared type packages are not installed (${missing.join(', ')}). `
+        + `somewhere typecheck does not install the project's dependencies. Install them (npm install in ${projectDir}), then run it again.`;
+}
+/** Longest a typecheck child may run before it and its children are stopped.
+ *  SOMEWHERE_TYPECHECK_TIMEOUT_MS overrides it. */
+export function typecheckTimeoutMs() {
+    const parsed = Number(process.env.SOMEWHERE_TYPECHECK_TIMEOUT_MS);
+    return Number.isFinite(parsed) && parsed > 0 ? Math.floor(parsed) : 300_000;
+}
+/** How long a stopped child tree gets after TERM before KILL, and after KILL
+ *  before the run is reported. */
+const STOP_GRACE_MS = 2_000;
+/**
+ * Run a typecheck child (tsc, or npx fetching it) with a deadline.
+ *
+ * POSIX: the child leads its own process group. A timeout, Ctrl-C or TERM
+ * sends TERM to that group, waits (bounded) for it to empty, sends KILL to
+ * what remains, and waits (bounded) again. This reaches descendants that stay
+ * in the group; one that moved to another group or session is not reached.
+ * If the group still has members after the final wait, the run reports that
+ * some processes may still be running instead of claiming they stopped.
+ * The group is signalled only after a membership check and no timer outlives
+ * the run, which narrows (does not eliminate) the chance of signalling a
+ * recycled group id. Windows: `taskkill /T /F` (not exercised by this CLI's
+ * tests). `onAbort` runs before the CLI exits on Ctrl-C/TERM, for the
+ * caller's temporary files.
+ */
+export function runBounded(command, args, cwd, options = {}) {
+    const timeoutMs = options.timeoutMs ?? typecheckTimeoutMs();
+    return new Promise((resolve) => {
+        const posixGroup = process.platform !== 'win32';
+        let child;
+        try {
+            child = spawn(command, args, {
+                cwd, env: process.env, stdio: ['ignore', 'pipe', 'pipe'], detached: posixGroup,
+                // Windows: tsc.cmd / npx.cmd are batch shims, and since Node 18.20/20.12
+                // (CVE-2024-27980) spawning a .cmd/.bat without a shell throws EINVAL.
+                // The bundled path runs node directly (process.execPath) and must NOT
+                // shell — its arg is a resolved file path that a shell could mis-split.
+                shell: /\.(cmd|bat)$/i.test(command),
+            });
+        }
+        catch (err) {
+            resolve({ code: null, out: '', stdout: '', error: err instanceof Error ? err : new Error(String(err)), timedOut: false });
+            return;
+        }
+        let out = '', stdout = '', timedOut = false, closed = false, settled = false, aborting = false, stopping = null, stopIncomplete = false;
+        let closeCode = null, spawnError;
+        const pid = child.pid;
+        const treeAlive = () => {
+            if (!pid)
+                return false;
+            if (!posixGroup)
+                return !closed;
+            try {
+                process.kill(-pid, 0);
+                return true;
+            }
+            catch (err) {
+                return err.code === 'EPERM';
+            }
+        };
+        const signalTree = (signal) => {
+            if (!pid || !treeAlive())
+                return;
+            if (posixGroup) {
+                try {
+                    process.kill(-pid, signal);
+                }
+                catch { /* emptied meanwhile */ }
+            }
+            else {
+                spawnSync('taskkill', ['/pid', String(pid), '/T', '/F'], { stdio: 'ignore', windowsHide: true });
+            }
+        };
+        const waitEmpty = async (ms) => {
+            const until = Date.now() + ms;
+            while (treeAlive() && Date.now() < until)
+                await new Promise((r) => setTimeout(r, 50));
+            return !treeAlive();
+        };
+        /** Resolves false when the group still had members after the final wait. */
+        const stopTree = () => {
+            stopping ??= (async () => {
+                signalTree('SIGTERM');
+                if (await waitEmpty(STOP_GRACE_MS))
+                    return true;
+                signalTree('SIGKILL');
+                return waitEmpty(STOP_GRACE_MS);
+            })();
+            return stopping;
+        };
+        const finish = () => {
+            // An interrupted run never reports: the CLI exits from onSignal once the
+            // tree is stopped and temporary files are removed.
+            if (settled || aborting)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            process.off('SIGINT', onInt);
+            process.off('SIGTERM', onTerm);
+            resolve({ code: closeCode, out, stdout, timedOut, ...(spawnError ? { error: spawnError } : {}),
+                ...(stopIncomplete && pid ? { stopIncomplete: { pid } } : {}) });
+        };
+        const onSignal = (exitCode) => {
+            if (aborting)
+                return;
+            aborting = true;
+            clearTimeout(timer);
+            void stopTree().then((gone) => {
+                if (!gone && pid)
+                    process.stderr.write(`${stopIncompleteMessage(pid)}\n`);
+                try {
+                    options.onAbort?.();
+                }
+                finally {
+                    process.exit(exitCode);
+                }
+            });
+        };
+        const onInt = () => onSignal(130);
+        const onTerm = () => onSignal(143);
+        process.on('SIGINT', onInt);
+        process.on('SIGTERM', onTerm);
+        const timer = setTimeout(() => {
+            timedOut = true;
+            void stopTree().then(async (gone) => {
+                stopIncomplete = !gone;
+                // A descendant holding the output pipes can delay 'close'; the tree is
+                // gone, so report after a bounded wait either way.
+                const until = Date.now() + STOP_GRACE_MS;
+                while (!closed && Date.now() < until)
+                    await new Promise((r) => setTimeout(r, 50));
+                finish();
+            });
+        }, timeoutMs);
+        child.stdout?.on('data', (d) => { out += d.toString(); stdout += d.toString(); });
+        child.stderr?.on('data', (d) => (out += d.toString()));
+        child.on('error', (error) => { spawnError = error; closed = true; if (!timedOut)
+            finish(); });
+        child.on('close', (code) => {
+            closed = true;
+            closeCode = code;
+            // A timed-out run reports once its tree is stopped (above).
+            if (!timedOut)
+                finish();
+        });
+    });
+}
+/** Said instead of "stopped" when processes may have survived the stop. */
+export function stopIncompleteMessage(pid) {
+    return `Some typecheck processes did not stop and may still be running (process group ${pid}); check with \`ps -g ${pid}\` and stop them if they are.`;
+}
+export function timedOutMessage(via, run) {
+    const seconds = Math.round(typecheckTimeoutMs() / 1000);
+    const stopped = run?.stopIncomplete ? `was stopped, but ${stopIncompleteMessage(run.stopIncomplete.pid).replace(/^Some/, 'some')}` : 'was stopped.';
+    return `The typecheck did not finish within ${seconds}s and ${stopped}${via === 'npx' ? ' (Fetching TypeScript with npx needs the npm registry.)' : ''} `
+        + 'Set SOMEWHERE_TYPECHECK_TIMEOUT_MS to allow longer.';
+}
 /**
  * Parse tsc's default (non-pretty) diagnostic lines:
  *   path/to/file.ts(12,5): error TS2304: Cannot find name 'sanitizeForSpeech'.
@@ -171,24 +323,38 @@ export function runTypecheck(projectDir, options = {}) {
         const message = error instanceof Error ? error.message : String(error);
         return Promise.resolve({ ok: false, errors: [{ file: 'db/schema.ts', line: 1, column: 1, code: 'SCHEMA_DECLARATION_INVALID', message }], via: 'bundled', raw: message });
     }
-    // Declared type packages first, so the FIRST check is a real verdict rather
-    // than a report that the tree is not installed yet.
-    if (options.installTypePackages !== false) {
+    // Only a caller-supplied installer resolves declared type packages; the
+    // default never installs into the project.
+    if (options.installTypePackages) {
         ensureDeclaredTypePackages(projectDir, options.installTypePackages);
     }
     const { command, args, via } = resolveTsc(projectDir);
+    return runTypecheckWith(projectDir, command, args, via, declaredData);
+}
+/** Announce, on stderr so JSON on stdout is untouched, that TypeScript is
+ *  about to be fetched with npx: a network step that also writes npm's cache.
+ *  The project's own dependencies are never installed. */
+export function announceNpxTypeScriptFetch(version) {
+    process.stderr.write(`TypeScript is not installed in this project; fetching typescript@${version} with npx (needs the npm registry; npm keeps it in its cache). Nothing is installed into the project.\n`);
+}
+/** How this project's typecheck will get its compiler: 'npx' means a
+ *  network fetch of TypeScript, which commands announce before running. */
+export function typecheckCompilerSource(projectDir) {
+    return resolveTsc(projectDir).via;
+}
+async function runTypecheckWith(projectDir, command, args, via, declaredData) {
     // --pretty false → stable, parseable one-line diagnostics regardless of TTY.
     const fullArgs = typecheckArgs(args);
     let overlay;
     if (declaredData) {
         // TypeScript resolves JSONC, inherited configs and explicit files itself.
         // Preserve that complete file set, adding only our declaration and schema.
-        const config = spawnSync(command, [...args, '--project', SCAFFOLD_TSCONFIG_FILENAME, '--showConfig'], {
-            cwd: projectDir, encoding: 'utf8', shell: /\.(cmd|bat)$/i.test(command),
-        });
-        if (config.error || config.status !== 0) {
-            return Promise.resolve({ ok: false, errors: [], via, raw: config.stdout + config.stderr,
-                ...(config.error ? { spawnError: config.error.message } : {}) });
+        const config = await runBounded(command, [...args, '--project', SCAFFOLD_TSCONFIG_FILENAME, '--showConfig'], projectDir);
+        if (config.timedOut)
+            return { ok: false, errors: [], via, raw: config.out, spawnError: timedOutMessage(via, config) };
+        if (config.error || config.code !== 0) {
+            return { ok: false, errors: [], via, raw: config.out,
+                ...(config.error ? { spawnError: config.error.message } : {}) };
         }
         try {
             const parsed = JSON.parse(config.stdout);
@@ -211,63 +377,28 @@ export function runTypecheck(projectDir, options = {}) {
         catch (error) {
             if (overlay)
                 rmSync(overlay, { force: true });
-            return Promise.resolve({ ok: false, errors: [], via, raw: error instanceof Error ? error.message : String(error) });
+            return { ok: false, errors: [], via, raw: error instanceof Error ? error.message : String(error) };
         }
     }
     const cleanup = () => { if (overlay)
         rmSync(overlay, { force: true }); };
-    return new Promise((resolve) => {
-        let child;
-        try {
-            child = spawn(command, fullArgs, {
-                cwd: projectDir,
-                env: process.env,
-                stdio: ['ignore', 'pipe', 'pipe'],
-                // Windows: tsc.cmd / npx.cmd are batch shims, and since Node 18.20/20.12
-                // (CVE-2024-27980) spawning a .cmd/.bat without a shell throws EINVAL.
-                // The bundled path runs node directly (process.execPath) and must NOT
-                // shell — its arg is a resolved file path that a shell could mis-split.
-                shell: /\.(cmd|bat)$/i.test(command),
-            });
-        }
-        catch (err) {
-            cleanup();
-            resolve({
-                ok: false,
-                errors: [],
-                via,
-                raw: '',
-                spawnError: err instanceof Error ? err.message : String(err),
-            });
-            return;
-        }
-        let out = '';
-        child.stdout?.on('data', (d) => (out += d.toString()));
-        child.stderr?.on('data', (d) => (out += d.toString()));
-        child.on('error', (err) => {
-            cleanup();
-            resolve({ ok: false, errors: [], via, raw: out, spawnError: err.message });
-        });
-        child.on('close', (code) => {
-            cleanup();
-            const allErrors = parseTscOutput(out);
-            // Drop locally-unresolvable bare-import diagnostics (they resolve on
-            // deploy via esm.sh) so they don't bury the real bugs. Undefined symbols
-            // (TS2304) survive the filter.
-            const errors = allErrors.filter((e) => !UNRESOLVED_DEP_CODES.has(e.code)
-                || /['"]somewhere(?::data|:files|\/db)['"]/.test(e.message));
-            // tsc exits non-zero whenever it emits diagnostics. If it failed but we
-            // parsed NONE (a config/crash failure, not type errors), don't claim
-            // "clean" — surface it via raw output so the user sees something's wrong.
-            const unexplainedFailure = code !== 0 && allErrors.length === 0;
-            resolve({
-                ok: errors.length === 0 && !unexplainedFailure,
-                errors,
-                via,
-                raw: out,
-            });
-        });
-    });
+    const run = await runBounded(command, fullArgs, projectDir, { onAbort: cleanup });
+    cleanup();
+    if (run.timedOut)
+        return { ok: false, errors: [], via, raw: run.out, spawnError: timedOutMessage(via, run) };
+    if (run.error)
+        return { ok: false, errors: [], via, raw: run.out, spawnError: run.error.message };
+    const allErrors = parseTscOutput(run.out);
+    // Drop locally-unresolvable bare-import diagnostics (they resolve on
+    // deploy via esm.sh) so they don't bury the real bugs. Undefined symbols
+    // (TS2304) survive the filter.
+    const errors = allErrors.filter((e) => !UNRESOLVED_DEP_CODES.has(e.code)
+        || /['"]somewhere(?::data|:files|\/db)['"]/.test(e.message));
+    // tsc exits non-zero whenever it emits diagnostics. If it failed but we
+    // parsed NONE (a config/crash failure, not type errors), don't claim
+    // "clean" — surface it via raw output so the user sees something's wrong.
+    const unexplainedFailure = run.code !== 0 && allErrors.length === 0;
+    return { ok: errors.length === 0 && !unexplainedFailure, errors, via, raw: run.out };
 }
 /** Where this module lives — used by tests that need the CLI package root. */
 export function cliPackageRoot() {

package/dist/lib/typecheck.js.map

@@ -1 +1 @@
-{"version":3,"file":"typecheck.js","sourceRoot":"","sources":["../../src/lib/typecheck.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAA0B,MAAM,oBAAoB,CAAC;AAUjF;;;;;;;;;;;GAWG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAoB/E,MAAM,UAAU,gBAAgB,CAC9B,WAA4B,OAAO,CAAC,QAAQ;IAE5C,OAAO;QACL,OAAO,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK;QACjD,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,4BAA4B,EAAE,EAAE,KAAK,CAAC;QACvE,GAAG,EAAE,KAAK;KACX,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,aAAgC,EAAE;IAC9D,OAAO;QACL,GAAG,UAAU;QACb,WAAW;QACX,0BAA0B;QAC1B,UAAU;QACV,UAAU;QACV,OAAO;KACR,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,UAAU,CAAC,UAAkB;IACpC,MAAM,UAAU,GAAG,IAAI,CACrB,UAAU,EACV,cAAc,EACd,MAAM,EACN,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CACjD,CAAC;IACF,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;IAC3D,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,0DAA0D;IAC1D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,qEAAqE;QACrE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACrD,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;QACvE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;IAED,OAAO,gBAAgB,EAAE,CAAC;AAC5B,CAAC;AA2BD,MAAM,UAAU,wBAAwB,CAAC,UAAkB;IACzD,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,gCAAgC;IACrE,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACjF,MAAM,MAAM,GAAG,QAAmC,CAAC;IACnD,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YAC7E,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC/F,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC/E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,0EAA0E;QAC1E,oEAAoE;QACpE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAe,EAAE,UAAkB;IACjE,MAAM,MAAM,GAAG,SAAS,CACtB,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAChD,CAAC,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,EACpF;QACE,GAAG,EAAE,UAAU;QACf,KAAK,EAAE,QAAQ;QACf,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;KACpC,CACF,CAAC;IACF,IAAI,MAAM,CAAC,KAAK;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAkB,EAClB,UAAgC,sBAAsB;IAEtD,MAAM,IAAI,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAClE,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAChC,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,6CAA6C,CAAC;IACzD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACV,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACV,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;SACd,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,UAAkB,EAClB,UAAkE,EAAE;IAEpE,IAAI,YAA2C,CAAC;IAChD,IAAI,CAAC;QAAC,YAAY,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAAC,CAAC;IACvD,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3K,CAAC;IACD,4EAA4E;IAC5E,oDAAoD;IACpD,IAAI,OAAO,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;QAC1C,0BAA0B,CAAC,UAAU,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACtD,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,OAA2B,CAAC;IAChC,IAAI,YAAY,EAAE,CAAC;QACjB,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,WAAW,EAAE,0BAA0B,EAAE,cAAc,CAAC,EAAE;YACpG,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;SACxE,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;gBACrF,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAwB,CAAC;YAChE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAC5G,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,0BAA0B,UAAU,EAAE,OAAO,CAAC,CAAC;YAC1E,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpC,OAAO,EAAE,IAAI,GAAG,0BAA0B;gBAC1C,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC;wBACjB,GAAG,MAAM,CAAC,KAAK;wBACf,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,eAAe,CAAC;wBAClD,GAAG,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBACvG,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;qBACpF,CAAC,CAAC;gBACH,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;aACzB,CAAC,CAAC,CAAC;YACJ,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO;gBAAE,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtH,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,IAAI,OAAO;QAAE,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE;gBAC/B,GAAG,EAAE,UAAU;gBACf,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACjC,yEAAyE;gBACzE,uEAAuE;gBACvE,sEAAsE;gBACtE,wEAAwE;gBACxE,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;aACrC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,CAAC;YACV,OAAO,CAAC;gBACN,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,EAAE;gBACV,GAAG;gBACH,GAAG,EAAE,EAAE;gBACP,UAAU,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aAC7D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAE/D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;YAC/B,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE;YACxC,OAAO,EAAE,CAAC;YACV,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YACtC,qEAAqE;YACrE,yEAAyE;YACzE,+BAA+B;YAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;mBACnE,wCAAwC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAE/D,wEAAwE;YACxE,qEAAqE;YACrE,0EAA0E;YAC1E,MAAM,kBAAkB,GAAG,IAAI,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC;YAEhE,OAAO,CAAC;gBACN,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,kBAAkB;gBAC9C,MAAM;gBACN,GAAG;gBACH,GAAG,EAAE,GAAG;aACT,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACnE,CAAC"}
+{"version":3,"file":"typecheck.js","sourceRoot":"","sources":["../../src/lib/typecheck.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAA0B,MAAM,oBAAoB,CAAC;AAUjF;;;;;;;;;;;GAWG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAoB/E,MAAM,UAAU,gBAAgB,CAC9B,WAA4B,OAAO,CAAC,QAAQ;IAE5C,OAAO;QACL,OAAO,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK;QACjD,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,4BAA4B,EAAE,EAAE,KAAK,CAAC;QACvE,GAAG,EAAE,KAAK;KACX,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,aAAgC,EAAE;IAC9D,OAAO;QACL,GAAG,UAAU;QACb,WAAW;QACX,0BAA0B;QAC1B,UAAU;QACV,UAAU;QACV,OAAO;KACR,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,UAAU,CAAC,UAAkB;IACpC,MAAM,UAAU,GAAG,IAAI,CACrB,UAAU,EACV,cAAc,EACd,MAAM,EACN,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CACjD,CAAC;IACF,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;IAC3D,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,0DAA0D;IAC1D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,qEAAqE;QACrE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACrD,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;QACvE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;IAED,OAAO,gBAAgB,EAAE,CAAC;AAC5B,CAAC;AA2BD,MAAM,UAAU,wBAAwB,CAAC,UAAkB;IACzD,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,gCAAgC;IACrE,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACjF,MAAM,MAAM,GAAG,QAAmC,CAAC;IACnD,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YAC7E,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC/F,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC/E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,0EAA0E;QAC1E,oEAAoE;QACpE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAkB,EAClB,OAA6B;IAE7B,MAAM,IAAI,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAClE,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAChC,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;AACH,CAAC;AAED;;4BAE4B;AAC5B,MAAM,UAAU,0BAA0B,CAAC,OAAiB,EAAE,UAAkB;IAC9E,OAAO,yEAAyE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;UACnG,iGAAiG,UAAU,uBAAuB,CAAC;AACzI,CAAC;AAED;mDACmD;AACnD,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9E,CAAC;AASD;kCACkC;AAClC,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,UAAU,CACxB,OAAe,EACf,IAAc,EACd,GAAW,EACX,UAAwD,EAAE;IAE1D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,EAAE,CAAC;IAC5D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;QAChD,IAAI,KAA+B,CAAC;QACpC,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;gBAC3B,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,UAAU;gBAC9E,yEAAyE;gBACzE,uEAAuE;gBACvE,sEAAsE;gBACtE,wEAAwE;gBACxE,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;aACrC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1H,OAAO;QACT,CAAC;QACD,IAAI,GAAG,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,QAAQ,GAAG,KAAK,EAAE,MAAM,GAAG,KAAK,EAAE,OAAO,GAAG,KAAK,EAAE,QAAQ,GAAG,KAAK,EAAE,QAAQ,GAA4B,IAAI,EAAE,cAAc,GAAG,KAAK,CAAC;QACjK,IAAI,SAAS,GAAkB,IAAI,EAAE,UAA6B,CAAC;QACnE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QACtB,MAAM,SAAS,GAAG,GAAY,EAAE;YAC9B,IAAI,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC;YACvB,IAAI,CAAC,UAAU;gBAAE,OAAO,CAAC,MAAM,CAAC;YAChC,IAAI,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAC;YAAC,CAAC;YAC3C,OAAO,GAAG,EAAE,CAAC;gBAAC,OAAQ,GAA6B,CAAC,IAAI,KAAK,OAAO,CAAC;YAAC,CAAC;QACzE,CAAC,CAAC;QACF,MAAM,UAAU,GAAG,CAAC,MAAsB,EAAE,EAAE;YAC5C,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,EAAE;gBAAE,OAAO;YACjC,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;YACvE,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YACnG,CAAC;QACH,CAAC,CAAC;QACF,MAAM,SAAS,GAAG,KAAK,EAAE,EAAU,EAAoB,EAAE;YACvD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;YAC9B,OAAO,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YACtF,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,CAAC,CAAC;QACF,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,GAAqB,EAAE;YACtC,QAAQ,KAAK,CAAC,KAAK,IAAI,EAAE;gBACvB,UAAU,CAAC,SAAS,CAAC,CAAC;gBACtB,IAAI,MAAM,SAAS,CAAC,aAAa,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAChD,UAAU,CAAC,SAAS,CAAC,CAAC;gBACtB,OAAO,SAAS,CAAC,aAAa,CAAC,CAAC;YAClC,CAAC,CAAC,EAAE,CAAC;YACL,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,yEAAyE;YACzE,mDAAmD;YACnD,IAAI,OAAO,IAAI,QAAQ;gBAAE,OAAO;YAChC,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC/B,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5F,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAE,EAAE;YACpC,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,KAAK,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;gBAC5B,IAAI,CAAC,IAAI,IAAI,GAAG;oBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1E,IAAI,CAAC;oBAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBAAC,CAAC;wBAAS,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAAC,CAAC;YAClE,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC5B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,QAAQ,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBAClC,cAAc,GAAG,CAAC,IAAI,CAAC;gBACvB,uEAAuE;gBACvE,mDAAmD;gBACnD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC;gBACzC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;oBAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBAClF,MAAM,EAAE,CAAC;YACX,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1F,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACrG,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAmB,EAAE,EAAE;YACxC,MAAM,GAAG,IAAI,CAAC;YACd,SAAS,GAAG,IAAI,CAAC;YACjB,4DAA4D;YAC5D,IAAI,CAAC,QAAQ;gBAAE,MAAM,EAAE,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,iFAAiF,GAAG,yBAAyB,GAAG,+BAA+B,CAAC;AACzJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAyB,EAAE,GAA2C;IACpG,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,IAAI,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,oBAAoB,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IACpJ,OAAO,uCAAuC,OAAO,SAAS,OAAO,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,yDAAyD,CAAC,CAAC,CAAC,EAAE,GAAG;UACrJ,qDAAqD,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,6CAA6C,CAAC;IACzD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACV,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACV,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;SACd,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,UAAkB,EAClB,UAAkE,EAAE;IAEpE,IAAI,YAA2C,CAAC;IAChD,IAAI,CAAC;QAAC,YAAY,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAAC,CAAC;IACvD,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3K,CAAC;IACD,wEAAwE;IACxE,2CAA2C;IAC3C,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;QAChC,0BAA0B,CAAC,UAAU,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACtD,OAAO,gBAAgB,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;AACxE,CAAC;AAED;;0DAE0D;AAC1D,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oEAAoE,OAAO,yGAAyG,CAAC,CAAC;AAC7M,CAAC;AAED;2EAC2E;AAC3E,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,UAAkB,EAClB,OAAe,EACf,IAAc,EACd,GAAyB,EACzB,YAA2C;IAE3C,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,OAA2B,CAAC;IAChC,IAAI,YAAY,EAAE,CAAC;QACjB,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,WAAW,EAAE,0BAA0B,EAAE,cAAc,CAAC,EAAE,UAAU,CAAC,CAAC;QACzH,IAAI,MAAM,CAAC,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;QACtH,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG;gBAClD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACpE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAwB,CAAC;YAChE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAC5G,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,0BAA0B,UAAU,EAAE,OAAO,CAAC,CAAC;YAC1E,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpC,OAAO,EAAE,IAAI,GAAG,0BAA0B;gBAC1C,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC;wBACjB,GAAG,MAAM,CAAC,KAAK;wBACf,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,eAAe,CAAC;wBAClD,GAAG,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBACvG,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;qBACpF,CAAC,CAAC;gBACH,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;aACzB,CAAC,CAAC,CAAC;YACJ,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO;gBAAE,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACrG,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,IAAI,OAAO;QAAE,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzE,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAClF,OAAO,EAAE,CAAC;IACV,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;IAC7G,IAAI,GAAG,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAClG,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1C,qEAAqE;IACrE,yEAAyE;IACzE,+BAA+B;IAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;WACnE,wCAAwC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/D,wEAAwE;IACxE,qEAAqE;IACrE,0EAA0E;IAC1E,MAAM,kBAAkB,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC;IACpE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;AACvF,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACnE,CAAC"}

package/dist/lib/vendor/deploy-paths.js

@@ -0,0 +1,121 @@
+/**
+ * Deploy-relative path policy.
+ *
+ * Deploy maps become object-store keys and are later returned by source export
+ * for local writes. Accept only already-normalized, project-relative paths so
+ * neither side has to guess whether `..`, a backslash, or a control character
+ * is data or navigation. Sensitive paths are rejected separately so secrets
+ * never enter the public deploy namespace in the first place.
+ */
+const MAX_DEPLOY_PATH_LENGTH = 1024;
+const MAX_DEPLOY_SEGMENT_LENGTH = 255;
+const RAW_STATIC_MARKER = '.somewhere/raw-static';
+const PRIVATE_KEY_NAME_RE = /^id_(?:rsa|dsa|ecdsa|ed25519)$/i;
+const SENSITIVE_EXTENSION_RE = /\.(?:pem|key|p12|pfx)$/i;
+// `credentials` is only a secret when it carries a DATA extension (or none).
+// `credentials.ts` / `.tsx` / `.md` are source and docs — a component that
+// renders a credentials form, or a page documenting them, is normal customer
+// code (rule 9: the guard must not reject the legitimate pattern). Bare
+// `credentials` with no extension stays blocked: that shape is a secrets file.
+// The Firebase Admin SDK key file is downloaded as
+// `<project>-firebase-adminsdk-<id>-<hex>.json` (pfb_eabb4ff5c759). Only that
+// name shape: firebase.json, firebase-config.json, google-services.json and
+// other client config stay deployable. A key renamed to anything else is not
+// covered by this name rule.
+const SENSITIVE_BASENAME_RE = /^(?:credentials(?:\.(?:json|ya?ml|toml|ini|txt|env|cfg|conf|properties))?|secrets?(?:\.(?:json|ya?ml|toml|ini))?|service[-_.]?account(?:[-_.]?key)?\.json|(?:[a-z0-9][a-z0-9-]*-)?firebase-adminsdk(?:-[a-z0-9]+)*\.json)$/i;
+// `.env.example` / `.env.sample` / `.env.template` exist SPECIFICALLY to carry
+// no secrets — they are the committed placeholder every real repo ships, so
+// blocking them failed a customer's first deploy with a message implying we
+// found a live secret (rule 9). Every other `.env*` variant stays blocked.
+const SENSITIVE_ENV_TEMPLATE_RE = /^\.env\.(?:example|sample|template|dist)$/i;
+const SENSITIVE_DOT_SEGMENT_RE = /^(?:\.env(?:\..*)?|\.git|\.ssh|\.aws|\.npmrc|\.yarnrc|\.pypirc|\.netrc|\.dockerconfigjson|\.htpasswd)$/i;
+function isSensitiveDotSegment(segment) {
+    if (SENSITIVE_ENV_TEMPLATE_RE.test(segment))
+        return false;
+    return SENSITIVE_DOT_SEGMENT_RE.test(segment);
+}
+function decodeForInspection(path) {
+    try {
+        return decodeURIComponent(path);
+    }
+    catch {
+        return null;
+    }
+}
+function unsafePathReason(path) {
+    if (path.length === 0)
+        return 'path must not be empty';
+    if (path.length > MAX_DEPLOY_PATH_LENGTH) {
+        return `path exceeds ${MAX_DEPLOY_PATH_LENGTH} characters`;
+    }
+    if (path.startsWith('/') || /^[A-Za-z]:/.test(path)) {
+        return 'path must be relative to the project root';
+    }
+    if (/[\\\x00-\x1f\x7f]/.test(path)) {
+        return 'path contains a backslash or control character';
+    }
+    const segments = path.split('/');
+    for (const segment of segments) {
+        if (segment === '' || segment === '.')
+            return 'path must be normalized (no empty or "." segments)';
+        if (segment === '..')
+            return 'path may not contain ".." segments';
+        if (segment.length > MAX_DEPLOY_SEGMENT_LENGTH) {
+            return `path segment exceeds ${MAX_DEPLOY_SEGMENT_LENGTH} characters`;
+        }
+    }
+    const decoded = decodeForInspection(path);
+    if (decoded === null)
+        return 'path contains invalid percent encoding';
+    if (decoded !== path) {
+        if (decoded.startsWith('/') || /^[A-Za-z]:/.test(decoded)) {
+            return 'path decodes to an absolute path';
+        }
+        if (/%2f/i.test(path) || /[\\\x00-\x1f\x7f]/.test(decoded)) {
+            return 'path decodes to a separator or control character';
+        }
+        const decodedSegments = decoded.split('/');
+        if (decodedSegments.some((segment) => segment === '' || segment === '.' || segment === '..')) {
+            return 'path decodes to a non-normalized or traversal path';
+        }
+    }
+    return null;
+}
+/** High-confidence secret/dotfile detection after path safety is established. */
+export function isSensitiveDeployPath(path) {
+    const inspected = decodeForInspection(path) ?? path;
+    const lowerPath = inspected.toLowerCase();
+    if (lowerPath === RAW_STATIC_MARKER)
+        return false;
+    const segments = inspected.split('/');
+    for (const segment of segments) {
+        const lower = segment.toLowerCase();
+        // ACME/security metadata must remain deployable. The segment is public by
+        // definition and is not a credential container like other dot-directories.
+        if (lower === '.well-known')
+            continue;
+        if (isSensitiveDotSegment(segment))
+            return true;
+        if (PRIVATE_KEY_NAME_RE.test(segment))
+            return true;
+        if (SENSITIVE_EXTENSION_RE.test(segment))
+            return true;
+        if (SENSITIVE_BASENAME_RE.test(segment))
+            return true;
+    }
+    return false;
+}
+export function inspectDeployPath(path, options = {}) {
+    const unsafe = unsafePathReason(path);
+    if (unsafe)
+        return { kind: 'unsafe', reason: unsafe };
+    if (!options.allowSensitive && isSensitiveDeployPath(path)) {
+        return { kind: 'sensitive', reason: 'secret-bearing dotfiles, credentials, and private-key files cannot be deployed' };
+    }
+    return null;
+}
+/** True only for a path safe to return from source export / local pull. */
+export function isSafeDeployExportPath(path) {
+    return inspectDeployPath(path) === null;
+}
+//# sourceMappingURL=deploy-paths.js.map

package/dist/lib/vendor/deploy-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-paths.js","sourceRoot":"","sources":["../../../src/lib/vendor/deploy-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AASH,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACpC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAClD,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAC9D,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AACzD,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,wEAAwE;AACxE,+EAA+E;AAC/E,mDAAmD;AACnD,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,6BAA6B;AAC7B,MAAM,qBAAqB,GAAG,6NAA6N,CAAC;AAC5P,+EAA+E;AAC/E,4EAA4E;AAC5E,4EAA4E;AAC5E,2EAA2E;AAC3E,MAAM,yBAAyB,GAAG,4CAA4C,CAAC;AAC/E,MAAM,wBAAwB,GAAG,yGAAyG,CAAC;AAE3I,SAAS,qBAAqB,CAAC,OAAe;IAC5C,IAAI,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAO,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,wBAAwB,CAAC;IACvD,IAAI,IAAI,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;QACzC,OAAO,gBAAgB,sBAAsB,aAAa,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,OAAO,2CAA2C,CAAC;IACrD,CAAC;IACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO,gDAAgD,CAAC;IAC1D,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG;YAAE,OAAO,oDAAoD,CAAC;QACnG,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,oCAAoC,CAAC;QAClE,IAAI,OAAO,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;YAC/C,OAAO,wBAAwB,yBAAyB,aAAa,CAAC;QACxE,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,wCAAwC,CAAC;IACtE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1D,OAAO,kCAAkC,CAAC;QAC5C,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3D,OAAO,kDAAkD,CAAC;QAC5D,CAAC;QACD,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;YAC7F,OAAO,oDAAoD,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACpD,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,SAAS,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAElD,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACpC,0EAA0E;QAC1E,2EAA2E;QAC3E,IAAI,KAAK,KAAK,aAAa;YAAE,SAAS;QACtC,IAAI,qBAAqB,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,UAAwC,EAAE;IACxF,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,gFAAgF,EAAE,CAAC;IACzH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AAC1C,CAAC"}

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@somewhere-cloud/cli",
-  "version": "0.38.4",
+  "version": "0.38.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@somewhere-cloud/cli",
-      "version": "0.38.4",
+      "version": "0.38.6",
       "bundleDependencies": [
         "@modelcontextprotocol/sdk",
         "chokidar",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@somewhere-cloud/cli",
-  "version": "0.38.4",
+  "version": "0.38.6",
   "description": "CLI for somewhere.cloud — auth, projects, deploy, pull, promote, db, logs, env, MCP bridge.",
   "keywords": [
     "somewhere",