@superblocksteam/sdk 2.0.123 → 2.0.124-next.1

package/dist/cli-replacement/post-upgrade-lockfile-strip.mjs

@@ -0,0 +1,224 @@
+/**
+ * Post-CLI-upgrade lockfile normalization for the dev-server pod's globally
+ * installed Superblocks CLI.
+ *
+ * npm honors `resolved` URLs verbatim, so a tarball whose bundled lockfile
+ * entries point at `registry.npmjs.org` keeps fetching from public npm even
+ * after we've written a private `.npmrc`. This module strips those URLs
+ * post-upgrade so subsequent installs re-resolve through the active registry.
+ *
+ * The walk from the resolved `superblocks` binary up to the CLI package root
+ * is bounded so a misconfigured layout can never mutate arbitrary lockfiles
+ * on the filesystem.
+ *
+ * All failures are logged and swallowed — a failed post-strip must not crash
+ * the pod after a working upgrade. The next dev startup repeats the strip
+ * idempotently.
+ */
+import * as child_process from "node:child_process";
+import fs from "node:fs/promises";
+import * as path from "node:path";
+import { promisify } from "node:util";
+import { stripResolvedFromLockfile, stripResolvedFromLockfilePath, } from "@superblocksteam/vite-plugin-file-sync/npm-registry";
+import { getErrorMeta } from "../telemetry/logging.js";
+const exec = promisify(child_process.exec);
+const LOG_PREFIX = "[post-upgrade-lockfile-strip]";
+/**
+ * Upper bound on the post-upgrade strip. The I/O is local and small, but the
+ * CLI install can live on a network-mounted prefix (custom `npm prefix`,
+ * Volta cache, etc.) where a hung `fs.realpath` or `fs.readFile` would
+ * otherwise extend `cliUpgradePromise` and block dev-server startup. A
+ * timeout keeps the boot path bounded; the underlying I/O is left to settle
+ * in the background since every step is idempotent and individually error-
+ * swallowing.
+ */
+const STRIP_TIMEOUT_MS = 5_000;
+/**
+ * Upper bound on `package.json` lookups when walking up from the resolved
+ * `superblocks` binary. The expected path depth is 3 levels
+ * (`<prefix>/lib/node_modules/@superblocksteam/cli/bin/run.js` ->
+ *  `<prefix>/lib/node_modules/@superblocksteam/cli`); 8 leaves headroom for
+ * non-standard layouts (Volta, nvm, custom prefixes) without ever climbing
+ * out of the install tree.
+ */
+const MAX_PACKAGE_ROOT_WALK_DEPTH = 8;
+// Both names are valid CLI install roots: `cli-ephemeral` is the alias used
+// for snapshot builds (see the alias detection in `version-detection.ts`),
+// and either may appear in the global install depending on which channel the
+// pod was provisioned against.
+const CLI_PACKAGE_NAMES = new Set([
+    "@superblocksteam/cli",
+    "@superblocksteam/cli-ephemeral",
+]);
+const defaultWhichRunner = async (binary) => {
+    const cmd = process.platform === "win32" ? "where" : "which";
+    const { stdout } = await exec(`${cmd} ${binary}`);
+    return stdout;
+};
+/**
+ * Discovers the absolute path of the `@superblocksteam/cli` install root
+ * (the directory containing the CLI's `package.json`), or returns `undefined`
+ * if discovery fails. Discovery failures are non-fatal — the caller logs and
+ * skips the strip rather than aborting.
+ */
+export async function findGlobalCliInstallDir(logger, whichRunner = defaultWhichRunner) {
+    let binStdout;
+    try {
+        binStdout = await whichRunner("superblocks");
+    }
+    catch (error) {
+        logger.warn(`${LOG_PREFIX} which/where superblocks failed; skipping strip`, {
+            ...getErrorMeta(error),
+        });
+        return undefined;
+    }
+    // `which`/`where` may emit multiple lines (e.g. shim + real path on
+    // Windows). The first line wins; matches the existing pattern in
+    // `version-detection.ts`.
+    const binPath = binStdout.trim().split(/\r?\n/)[0]?.trim();
+    if (!binPath) {
+        logger.warn(`${LOG_PREFIX} superblocks binary not found in PATH; skipping strip`);
+        return undefined;
+    }
+    let realBinPath;
+    try {
+        realBinPath = await fs.realpath(binPath);
+    }
+    catch (error) {
+        logger.warn(`${LOG_PREFIX} realpath failed for superblocks binary; skipping strip`, {
+            binPath,
+            ...getErrorMeta(error),
+        });
+        return undefined;
+    }
+    let dir = path.dirname(realBinPath);
+    for (let i = 0; i < MAX_PACKAGE_ROOT_WALK_DEPTH; i++) {
+        const candidate = path.join(dir, "package.json");
+        let raw;
+        try {
+            raw = await fs.readFile(candidate, "utf-8");
+        }
+        catch (error) {
+            const code = error?.code;
+            if (code === "ENOENT") {
+                const parent = path.dirname(dir);
+                if (parent === dir) {
+                    break;
+                }
+                dir = parent;
+                continue;
+            }
+            logger.warn(`${LOG_PREFIX} failed to read candidate package.json; skipping strip`, {
+                candidate,
+                code,
+                ...getErrorMeta(error),
+            });
+            return undefined;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch (error) {
+            logger.warn(`${LOG_PREFIX} candidate package.json is not valid JSON; skipping strip`, {
+                candidate,
+                ...getErrorMeta(error),
+            });
+            return undefined;
+        }
+        if (typeof parsed.name === "string" && CLI_PACKAGE_NAMES.has(parsed.name)) {
+            return dir;
+        }
+        // Found a `package.json` that isn't the CLI's — keep walking up. Some
+        // layouts (oclif's update channel) nest the binary under a wrapper
+        // package; we don't want to bail on the first unrelated manifest.
+        const parent = path.dirname(dir);
+        if (parent === dir) {
+            break;
+        }
+        dir = parent;
+    }
+    logger.warn(`${LOG_PREFIX} could not locate @superblocksteam/cli install root; skipping strip`, {
+        startedAt: realBinPath,
+    });
+    return undefined;
+}
+/**
+ * Strips public-host `resolved` URLs from every lockfile under the global
+ * CLI install that the auto-upgrade could have refreshed. Returns the
+ * resolved install root on success, or `undefined` when discovery failed.
+ *
+ * Non-fatal: every individual strip already swallows lockfile-level errors
+ * (logged in `stripResolvedFromLockfilePath`); this wrapper additionally
+ * swallows discovery failures and any unexpected throw from the inner
+ * helpers so a successful upgrade is never demoted to a crash by a post-step
+ * problem.
+ */
+export async function stripUpgradedCliLockfiles(logger, options = {}) {
+    const installDir = options.installDir ??
+        (await findGlobalCliInstallDir(logger, options.whichRunner));
+    if (!installDir) {
+        return {};
+    }
+    const timeoutMs = options.timeoutMs ?? STRIP_TIMEOUT_MS;
+    const start = Date.now();
+    // The hidden lockfile listing the CLI itself lives two levels up from
+    // installDir under the npm-global layout
+    // (<prefix>/lib/node_modules/.package-lock.json).
+    const globalHiddenLockfile = path.join(path.dirname(path.dirname(installDir)), ".package-lock.json");
+    const STRIP_TIMED_OUT = Symbol("STRIP_TIMED_OUT");
+    let timeoutHandle;
+    const timeoutPromise = new Promise((resolve) => {
+        timeoutHandle = setTimeout(() => resolve(STRIP_TIMED_OUT), timeoutMs);
+    });
+    try {
+        const stripWork = Promise.all([
+            stripResolvedFromLockfile(installDir),
+            stripResolvedFromLockfilePath(globalHiddenLockfile),
+        ]);
+        const outcome = await Promise.race([stripWork, timeoutPromise]);
+        if (outcome === STRIP_TIMED_OUT) {
+            logger.warn(`${LOG_PREFIX} strip exceeded timeout; continuing without waiting`, {
+                installDir,
+                timeoutMs,
+                elapsedMs: Date.now() - start,
+            });
+            // We're abandoning `stripWork` after the timeout won the race. The
+            // inner helpers swallow per-file errors, but their atomic `writeFile`
+            // / `rename` calls can still throw (EACCES, EXDEV, ENOSPC, …) — and
+            // with no subscriber left on `stripWork`, a late rejection would
+            // surface as an unhandled rejection and crash the pod under Node's
+            // default policy. Attach a tail handler to keep the post-step
+            // non-fatal even when the timeout path is taken.
+            stripWork.catch((error) => {
+                logger.warn(`${LOG_PREFIX} background strip rejected after timeout; ignoring`, {
+                    ...getErrorMeta(error),
+                    installDir,
+                });
+            });
+        }
+        else {
+            logger.info(`${LOG_PREFIX} stripped resolved URLs from upgraded CLI lockfiles`, {
+                installDir,
+                elapsedMs: Date.now() - start,
+            });
+        }
+    }
+    catch (error) {
+        // The lower-level helpers already swallow per-file errors; this catches
+        // any unexpected throw so a post-step problem never surfaces as a failed
+        // upgrade.
+        logger.warn(`${LOG_PREFIX} unexpected error during strip; continuing`, {
+            ...getErrorMeta(error),
+            installDir,
+            elapsedMs: Date.now() - start,
+        });
+    }
+    finally {
+        if (timeoutHandle) {
+            clearTimeout(timeoutHandle);
+        }
+    }
+    return { installDir };
+}
+//# sourceMappingURL=post-upgrade-lockfile-strip.mjs.map

package/dist/cli-replacement/post-upgrade-lockfile-strip.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"post-upgrade-lockfile-strip.mjs","sourceRoot":"","sources":["../../src/cli-replacement/post-upgrade-lockfile-strip.mts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EACL,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,qDAAqD,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAe,MAAM,yBAAyB,CAAC;AAEpE,MAAM,IAAI,GAAG,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;AAE3C,MAAM,UAAU,GAAG,+BAA+B,CAAC;AAEnD;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B;;;;;;;GAOG;AACH,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAEtC,4EAA4E;AAC5E,2EAA2E;AAC3E,6EAA6E;AAC7E,+BAA+B;AAC/B,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS;IACxC,sBAAsB;IACtB,gCAAgC;CACjC,CAAC,CAAC;AAQH,MAAM,kBAAkB,GAAgB,KAAK,EAAE,MAAM,EAAE,EAAE;IACvD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,GAAG,IAAI,MAAM,EAAE,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,EACd,cAA2B,kBAAkB;IAE7C,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CACT,GAAG,UAAU,iDAAiD,EAC9D;YACE,GAAG,YAAY,CAAC,KAAK,CAAC;SACvB,CACF,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,oEAAoE;IACpE,iEAAiE;IACjE,0BAA0B;IAC1B,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,GAAG,UAAU,uDAAuD,CACrE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CACT,GAAG,UAAU,yDAAyD,EACtE;YACE,OAAO;YACP,GAAG,YAAY,CAAC,KAAK,CAAC;SACvB,CACF,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,2BAA2B,EAAE,CAAC,EAAE,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACjD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,IAAI,GAAI,KAA2C,EAAE,IAAI,CAAC;YAChE,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACjC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;oBACnB,MAAM;gBACR,CAAC;gBACD,GAAG,GAAG,MAAM,CAAC;gBACb,SAAS;YACX,CAAC;YACD,MAAM,CAAC,IAAI,CACT,GAAG,UAAU,wDAAwD,EACrE;gBACE,SAAS;gBACT,IAAI;gBACJ,GAAG,YAAY,CAAC,KAAK,CAAC;aACvB,CACF,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,MAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,GAAG,UAAU,2DAA2D,EACxE;gBACE,SAAS;gBACT,GAAG,YAAY,CAAC,KAAK,CAAC;aACvB,CACF,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1E,OAAO,GAAG,CAAC;QACb,CAAC;QAED,sEAAsE;QACtE,mEAAmE;QACnE,kEAAkE;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,MAAM;QACR,CAAC;QACD,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IAED,MAAM,CAAC,IAAI,CACT,GAAG,UAAU,qEAAqE,EAClF;QACE,SAAS,EAAE,WAAW;KACvB,CACF,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC;AAgBD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAc,EACd,UAA4C,EAAE;IAE9C,MAAM,UAAU,GACd,OAAO,CAAC,UAAU;QAClB,CAAC,MAAM,uBAAuB,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC;IACxD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,sEAAsE;IACtE,yCAAyC;IACzC,kDAAkD;IAClD,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CACpC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EACtC,oBAAoB,CACrB,CAAC;IAEF,MAAM,eAAe,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAClD,IAAI,aAAyC,CAAC;IAC9C,MAAM,cAAc,GAAG,IAAI,OAAO,CAAyB,CAAC,OAAO,EAAE,EAAE;QACrE,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,SAAS,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC;YAC5B,yBAAyB,CAAC,UAAU,CAAC;YACrC,6BAA6B,CAAC,oBAAoB,CAAC;SACpD,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;QAChE,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CACT,GAAG,UAAU,qDAAqD,EAClE;gBACE,UAAU;gBACV,SAAS;gBACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;aAC9B,CACF,CAAC;YACF,mEAAmE;YACnE,sEAAsE;YACtE,oEAAoE;YACpE,iEAAiE;YACjE,mEAAmE;YACnE,8DAA8D;YAC9D,iDAAiD;YACjD,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACxB,MAAM,CAAC,IAAI,CACT,GAAG,UAAU,oDAAoD,EACjE;oBACE,GAAG,YAAY,CAAC,KAAK,CAAC;oBACtB,UAAU;iBACX,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CACT,GAAG,UAAU,qDAAqD,EAClE;gBACE,UAAU;gBACV,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;aAC9B,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,yEAAyE;QACzE,WAAW;QACX,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,4CAA4C,EAAE;YACrE,GAAG,YAAY,CAAC,KAAK,CAAC;YACtB,UAAU;YACV,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC9B,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,aAAa,EAAE,CAAC;YAClB,YAAY,CAAC,aAAa,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,CAAC;AACxB,CAAC"}

package/dist/cli-replacement/post-upgrade-lockfile-strip.test.d.mts

@@ -0,0 +1,11 @@
+/**
+ * Tests for post-upgrade-lockfile-strip.
+ *
+ * Strategy: stand up a real on-disk fixture mimicking the dev-server pod
+ * layout (`<prefix>/lib/node_modules/@superblocksteam/cli/...`), then assert
+ * the strip mutates the right files and is idempotent / non-fatal on edge
+ * cases. Avoids mocking the strip helpers because the disk-shape they expect
+ * is the actual contract under test.
+ */
+export {};
+//# sourceMappingURL=post-upgrade-lockfile-strip.test.d.mts.map

package/dist/cli-replacement/post-upgrade-lockfile-strip.test.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"post-upgrade-lockfile-strip.test.d.mts","sourceRoot":"","sources":["../../src/cli-replacement/post-upgrade-lockfile-strip.test.mts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/cli-replacement/post-upgrade-lockfile-strip.test.mjs

@@ -0,0 +1,317 @@
+/**
+ * Tests for post-upgrade-lockfile-strip.
+ *
+ * Strategy: stand up a real on-disk fixture mimicking the dev-server pod
+ * layout (`<prefix>/lib/node_modules/@superblocksteam/cli/...`), then assert
+ * the strip mutates the right files and is idempotent / non-fatal on edge
+ * cases. Avoids mocking the strip helpers because the disk-shape they expect
+ * is the actual contract under test.
+ */
+import { mkdir, mkdtemp, readFile, realpath, rm, symlink, writeFile, } from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { findGlobalCliInstallDir, stripUpgradedCliLockfiles, } from "./post-upgrade-lockfile-strip.mjs";
+function makeLogger() {
+    return {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn(),
+    };
+}
+function asLogger(mock) {
+    return mock;
+}
+/**
+ * Lockfile fixture with mixed registries — only public-host `resolved` URLs
+ * should be stripped; `integrity` must survive.
+ */
+function lockfile(version) {
+    return {
+        name: "@superblocksteam/cli",
+        version,
+        lockfileVersion: 3,
+        requires: true,
+        packages: {
+            "": {
+                name: "@superblocksteam/cli",
+                version,
+            },
+            "node_modules/some-dep": {
+                version: "1.0.0",
+                resolved: "https://registry.npmjs.org/some-dep/-/some-dep-1.0.0.tgz",
+                integrity: "sha512-abc",
+            },
+            "node_modules/already-stripped": {
+                version: "2.0.0",
+                integrity: "sha512-def",
+            },
+        },
+    };
+}
+async function makeCliInstallTree(root) {
+    const prefix = path.join(root, ".npm-global");
+    const cliDir = path.join(prefix, "lib", "node_modules", "@superblocksteam", "cli");
+    await mkdir(cliDir, { recursive: true });
+    await mkdir(path.join(cliDir, "node_modules"), { recursive: true });
+    await mkdir(path.join(cliDir, "bin"), { recursive: true });
+    await mkdir(path.join(prefix, "bin"), { recursive: true });
+    // package.json identifying this as @superblocksteam/cli
+    await writeFile(path.join(cliDir, "package.json"), JSON.stringify({ name: "@superblocksteam/cli", version: "2.1.0" }, null, 2));
+    // CLI's own lockfile, with stale public-host resolved URLs
+    const cliLockfile = path.join(cliDir, "package-lock.json");
+    await writeFile(cliLockfile, JSON.stringify(lockfile("2.1.0"), null, 2) + "\n");
+    // CLI's bundled hidden lockfile
+    const cliHiddenLockfile = path.join(cliDir, "node_modules", ".package-lock.json");
+    await writeFile(cliHiddenLockfile, JSON.stringify(lockfile("2.1.0"), null, 2) + "\n");
+    // npm-global hidden lockfile (lists @superblocksteam/cli itself)
+    const globalHiddenLockfile = path.join(prefix, "lib", "node_modules", ".package-lock.json");
+    await writeFile(globalHiddenLockfile, JSON.stringify({
+        name: "global-prefix",
+        lockfileVersion: 3,
+        packages: {
+            "node_modules/@superblocksteam/cli": {
+                version: "2.1.0",
+                resolved: "https://registry.npmjs.org/@superblocksteam/cli/-/cli-2.1.0.tgz",
+                integrity: "sha512-cli",
+            },
+        },
+    }, null, 2) + "\n");
+    // Real binary the shim points at
+    const realBin = path.join(cliDir, "bin", "run.js");
+    await writeFile(realBin, "#!/usr/bin/env node\n");
+    // The PATH-resolved shim is a symlink under <prefix>/bin
+    const binShim = path.join(prefix, "bin", "superblocks");
+    await symlink(realBin, binShim);
+    return {
+        prefix,
+        cliDir,
+        cliLockfile,
+        cliHiddenLockfile,
+        globalHiddenLockfile,
+        binShim,
+        realBin,
+    };
+}
+describe("post-upgrade-lockfile-strip", () => {
+    let tmpRoot;
+    let logger;
+    beforeEach(async () => {
+        // Realpath up front so test expectations match `fs.realpath` output on
+        // macOS, where `/var` is a symlink to `/private/var` and any subsequent
+        // realpath() resolves through it. Without this every "expect dir" line
+        // would have to manually realpath() each comparison.
+        tmpRoot = await realpath(await mkdtemp(path.join(os.tmpdir(), "apps-4196-")));
+        logger = makeLogger();
+    });
+    afterEach(async () => {
+        await rm(tmpRoot, { recursive: true, force: true });
+    });
+    describe("findGlobalCliInstallDir", () => {
+        it("resolves the CLI install root via which + realpath + walkup", async () => {
+            const tree = await makeCliInstallTree(tmpRoot);
+            const which = vi.fn(async () => `${tree.binShim}\n`);
+            const result = await findGlobalCliInstallDir(asLogger(logger), which);
+            expect(result).toBe(tree.cliDir);
+            expect(which).toHaveBeenCalledWith("superblocks");
+        });
+        it("returns undefined when which/where fails (binary not in PATH)", async () => {
+            const which = vi.fn(async () => {
+                throw new Error("not found");
+            });
+            const result = await findGlobalCliInstallDir(asLogger(logger), which);
+            expect(result).toBeUndefined();
+            expect(logger.warn).toHaveBeenCalledWith(expect.stringContaining("which/where superblocks failed"), expect.any(Object));
+        });
+        it("returns undefined when which stdout is empty", async () => {
+            const which = vi.fn(async () => "\n");
+            const result = await findGlobalCliInstallDir(asLogger(logger), which);
+            expect(result).toBeUndefined();
+            expect(logger.warn).toHaveBeenCalledWith(expect.stringContaining("superblocks binary not found in PATH"));
+        });
+        it("uses only the first line when which returns multiple paths", async () => {
+            const tree = await makeCliInstallTree(tmpRoot);
+            const which = vi.fn(async () => `${tree.binShim}\n/another/path/superblocks\n`);
+            const result = await findGlobalCliInstallDir(asLogger(logger), which);
+            expect(result).toBe(tree.cliDir);
+        });
+        it("accepts @superblocksteam/cli-ephemeral as the CLI package name", async () => {
+            const tree = await makeCliInstallTree(tmpRoot);
+            // Rewrite the manifest as the ephemeral alias
+            await writeFile(path.join(tree.cliDir, "package.json"), JSON.stringify({ name: "@superblocksteam/cli-ephemeral", version: "2.1.0" }, null, 2));
+            const which = vi.fn(async () => `${tree.binShim}\n`);
+            const result = await findGlobalCliInstallDir(asLogger(logger), which);
+            expect(result).toBe(tree.cliDir);
+        });
+        it("returns undefined when no CLI manifest is found within the walk bound", async () => {
+            // Symlink targets a path whose ancestors carry no @superblocksteam/cli manifest.
+            const wrongRoot = path.join(tmpRoot, "wrong");
+            await mkdir(wrongRoot, { recursive: true });
+            const realBin = path.join(wrongRoot, "bin");
+            await writeFile(realBin, "#!/usr/bin/env node\n");
+            const shim = path.join(tmpRoot, "shim");
+            await symlink(realBin, shim);
+            const which = vi.fn(async () => `${shim}\n`);
+            const result = await findGlobalCliInstallDir(asLogger(logger), which);
+            expect(result).toBeUndefined();
+        });
+    });
+    describe("stripUpgradedCliLockfiles", () => {
+        it("strips resolved from all three lockfile locations", async () => {
+            const tree = await makeCliInstallTree(tmpRoot);
+            const result = await stripUpgradedCliLockfiles(asLogger(logger), {
+                installDir: tree.cliDir,
+            });
+            expect(result.installDir).toBe(tree.cliDir);
+            // The success info log is the operator-facing signal that the strip
+            // ran; assert it fires exactly once on the happy path.
+            expect(logger.info).toHaveBeenCalledTimes(1);
+            expect(logger.warn).not.toHaveBeenCalled();
+            // CLI's own lockfile: public-host resolved gone, integrity preserved
+            const cli = JSON.parse(await readFile(tree.cliLockfile, "utf-8"));
+            expect(cli.packages["node_modules/some-dep"].resolved).toBeUndefined();
+            expect(cli.packages["node_modules/some-dep"].integrity).toBe("sha512-abc");
+            // CLI's hidden lockfile
+            const hidden = JSON.parse(await readFile(tree.cliHiddenLockfile, "utf-8"));
+            expect(hidden.packages["node_modules/some-dep"].resolved).toBeUndefined();
+            // Global hidden lockfile (the @superblocksteam/cli listing itself)
+            const global = JSON.parse(await readFile(tree.globalHiddenLockfile, "utf-8"));
+            expect(global.packages["node_modules/@superblocksteam/cli"].resolved).toBeUndefined();
+            expect(global.packages["node_modules/@superblocksteam/cli"].integrity).toBe("sha512-cli");
+        });
+        it("is idempotent — second call produces no further changes", async () => {
+            const tree = await makeCliInstallTree(tmpRoot);
+            await stripUpgradedCliLockfiles(asLogger(logger), {
+                installDir: tree.cliDir,
+            });
+            const after1 = await readFile(tree.cliLockfile, "utf-8");
+            await stripUpgradedCliLockfiles(asLogger(logger), {
+                installDir: tree.cliDir,
+            });
+            const after2 = await readFile(tree.cliLockfile, "utf-8");
+            expect(after2).toBe(after1);
+        });
+        it("returns no installDir and does not throw when discovery fails", async () => {
+            const which = vi.fn(async () => {
+                throw new Error("not found");
+            });
+            const result = await stripUpgradedCliLockfiles(asLogger(logger), {
+                whichRunner: which,
+            });
+            expect(result).toEqual({});
+            // No success log should fire when there was no work to do.
+            expect(logger.info).not.toHaveBeenCalled();
+        });
+        it("does not throw when global hidden lockfile is absent (npm v6 layout)", async () => {
+            const tree = await makeCliInstallTree(tmpRoot);
+            await rm(tree.globalHiddenLockfile);
+            await expect(stripUpgradedCliLockfiles(asLogger(logger), {
+                installDir: tree.cliDir,
+            })).resolves.toEqual({ installDir: tree.cliDir });
+            // The other two were still stripped
+            const cli = JSON.parse(await readFile(tree.cliLockfile, "utf-8"));
+            expect(cli.packages["node_modules/some-dep"].resolved).toBeUndefined();
+        });
+        it("returns and warns when the inner strip exceeds the timeout", async () => {
+            // Simulate a hung strip (e.g. wedged I/O on a network-mounted prefix).
+            // Without the timeout, this would extend `cliUpgradePromise` and block
+            // dev-server startup; the timeout converts that into a bounded warn.
+            const tree = await makeCliInstallTree(tmpRoot);
+            const stripModule = await import("@superblocksteam/vite-plugin-file-sync/npm-registry");
+            const stripSpy = vi
+                .spyOn(stripModule, "stripResolvedFromLockfile")
+                .mockImplementation(() => new Promise(() => { }));
+            try {
+                const result = await stripUpgradedCliLockfiles(asLogger(logger), {
+                    installDir: tree.cliDir,
+                    timeoutMs: 10,
+                });
+                expect(result).toEqual({ installDir: tree.cliDir });
+                expect(logger.warn).toHaveBeenCalledTimes(1);
+                expect(logger.warn).toHaveBeenCalledWith(expect.stringContaining("strip exceeded timeout"), expect.objectContaining({
+                    installDir: tree.cliDir,
+                    timeoutMs: 10,
+                }));
+                expect(logger.info).not.toHaveBeenCalled();
+            }
+            finally {
+                stripSpy.mockRestore();
+            }
+        });
+        it("suppresses a post-timeout rejection so the abandoned strip cannot crash the pod", async () => {
+            // After the timeout wins the race we abandon `stripWork`. If a later
+            // rejection from the inner helpers (e.g. EACCES on the atomic rename)
+            // had no subscriber, Node would surface it as an unhandled rejection
+            // and exit the dev-server process. This test wires up a strip that
+            // rejects strictly after the timeout fires, then asserts the wrapper
+            // resolves cleanly AND logs the post-timeout rejection via its tail
+            // handler.
+            const tree = await makeCliInstallTree(tmpRoot);
+            let rejectStrip = () => { };
+            const pendingStrip = new Promise((_, reject) => {
+                rejectStrip = reject;
+            });
+            const unhandled = [];
+            const onUnhandled = (reason) => {
+                unhandled.push(reason);
+            };
+            process.on("unhandledRejection", onUnhandled);
+            const stripModule = await import("@superblocksteam/vite-plugin-file-sync/npm-registry");
+            const stripSpy = vi
+                .spyOn(stripModule, "stripResolvedFromLockfile")
+                .mockImplementation(() => pendingStrip);
+            try {
+                const result = await stripUpgradedCliLockfiles(asLogger(logger), {
+                    installDir: tree.cliDir,
+                    timeoutMs: 10,
+                });
+                expect(result).toEqual({ installDir: tree.cliDir });
+                expect(logger.warn).toHaveBeenCalledWith(expect.stringContaining("strip exceeded timeout"), expect.objectContaining({ installDir: tree.cliDir }));
+                rejectStrip(new Error("simulated post-timeout rejection"));
+                // Let the rejection propagate and the tail .catch() run.
+                await new Promise((resolve) => setImmediate(resolve));
+                expect(unhandled).toEqual([]);
+                expect(logger.warn).toHaveBeenCalledWith(expect.stringContaining("background strip rejected after timeout"), expect.objectContaining({
+                    installDir: tree.cliDir,
+                    error: expect.objectContaining({
+                        message: "simulated post-timeout rejection",
+                    }),
+                }));
+            }
+            finally {
+                process.off("unhandledRejection", onUnhandled);
+                stripSpy.mockRestore();
+            }
+        });
+        it("does not throw or emit the success log when an inner strip rejects unexpectedly", async () => {
+            // Replace the CLI's lockfile with a directory at the same path — the
+            // inner helper's readFile will see EISDIR. The lower-level helpers
+            // documented as swallowing errors should keep the Promise.all from
+            // rejecting, but if a future refactor changes that, this test asserts
+            // the wrapper's belt-and-suspenders catch still keeps the function
+            // non-fatal AND suppresses the success log.
+            const tree = await makeCliInstallTree(tmpRoot);
+            await rm(tree.cliLockfile);
+            await mkdir(tree.cliLockfile);
+            const stripModule = await import("@superblocksteam/vite-plugin-file-sync/npm-registry");
+            const stripSpy = vi
+                .spyOn(stripModule, "stripResolvedFromLockfile")
+                .mockRejectedValue(new Error("simulated unexpected throw"));
+            try {
+                await expect(stripUpgradedCliLockfiles(asLogger(logger), {
+                    installDir: tree.cliDir,
+                })).resolves.toEqual({ installDir: tree.cliDir });
+                // Wrapper logged a warn for the unexpected error; the success info
+                // log MUST NOT have fired (otherwise pod logs would falsely claim
+                // the strip completed).
+                expect(logger.warn).toHaveBeenCalledTimes(1);
+                expect(logger.info).not.toHaveBeenCalled();
+            }
+            finally {
+                stripSpy.mockRestore();
+            }
+        });
+    });
+});
+//# sourceMappingURL=post-upgrade-lockfile-strip.test.mjs.map

package/dist/cli-replacement/post-upgrade-lockfile-strip.test.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"post-upgrade-lockfile-strip.test.mjs","sourceRoot":"","sources":["../../src/cli-replacement/post-upgrade-lockfile-strip.test.mts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,KAAK,EACL,OAAO,EACP,QAAQ,EACR,QAAQ,EACR,EAAE,EACF,OAAO,EACP,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAGzE,OAAO,EACL,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAgB3C,SAAS,UAAU;IACjB,OAAO;QACL,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;QACb,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;QACb,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;QACd,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;KACf,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAgB;IAChC,OAAO,IAAyB,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,OAAe;IAC/B,OAAO;QACL,IAAI,EAAE,sBAAsB;QAC5B,OAAO;QACP,eAAe,EAAE,CAAC;QAClB,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE;YACR,EAAE,EAAE;gBACF,IAAI,EAAE,sBAAsB;gBAC5B,OAAO;aACR;YACD,uBAAuB,EAAE;gBACvB,OAAO,EAAE,OAAO;gBAChB,QAAQ,EAAE,0DAA0D;gBACpE,SAAS,EAAE,YAAY;aACxB;YACD,+BAA+B,EAAE;gBAC/B,OAAO,EAAE,OAAO;gBAChB,SAAS,EAAE,YAAY;aACxB;SACF;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAAY;IAS5C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CACtB,MAAM,EACN,KAAK,EACL,cAAc,EACd,kBAAkB,EAClB,KAAK,CACN,CAAC;IACF,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3D,wDAAwD;IACxD,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EACjC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAC5E,CAAC;IAEF,2DAA2D;IAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC3D,MAAM,SAAS,CACb,WAAW,EACX,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAClD,CAAC;IAEF,gCAAgC;IAChC,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CACjC,MAAM,EACN,cAAc,EACd,oBAAoB,CACrB,CAAC;IACF,MAAM,SAAS,CACb,iBAAiB,EACjB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAClD,CAAC;IAEF,iEAAiE;IACjE,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CACpC,MAAM,EACN,KAAK,EACL,cAAc,EACd,oBAAoB,CACrB,CAAC;IACF,MAAM,SAAS,CACb,oBAAoB,EACpB,IAAI,CAAC,SAAS,CACZ;QACE,IAAI,EAAE,eAAe;QACrB,eAAe,EAAE,CAAC;QAClB,QAAQ,EAAE;YACR,mCAAmC,EAAE;gBACnC,OAAO,EAAE,OAAO;gBAChB,QAAQ,EACN,iEAAiE;gBACnE,SAAS,EAAE,YAAY;aACxB;SACF;KACF,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CACT,CAAC;IAEF,iCAAiC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACnD,MAAM,SAAS,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;IAElD,yDAAyD;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IACxD,MAAM,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAEhC,OAAO;QACL,MAAM;QACN,MAAM;QACN,WAAW;QACX,iBAAiB;QACjB,oBAAoB;QACpB,OAAO;QACP,OAAO;KACR,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,IAAI,OAAe,CAAC;IACpB,IAAI,MAAkB,CAAC;IAEvB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,qDAAqD;QACrD,OAAO,GAAG,MAAM,QAAQ,CACtB,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CACpD,CAAC;QACF,MAAM,GAAG,UAAU,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACvC,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;YAC3E,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAE/C,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;YAEtE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;YAC7E,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;gBAC7B,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;YAC/B,CAAC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;YAEtE,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,MAAM,CAAC,gBAAgB,CAAC,gCAAgC,CAAC,EACzD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CACnB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;YAEtE,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,MAAM,CAAC,gBAAgB,CAAC,sCAAsC,CAAC,CAChE,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;YAC1E,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,CACjB,KAAK,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,+BAA+B,CAC3D,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;YACtE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;YAC9E,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC/C,8CAA8C;YAC9C,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EACtC,IAAI,CAAC,SAAS,CACZ,EAAE,IAAI,EAAE,gCAAgC,EAAE,OAAO,EAAE,OAAO,EAAE,EAC5D,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YAEF,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;YACtE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;YACrF,iFAAiF;YACjF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC5C,MAAM,SAAS,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxC,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAE7B,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;YAC7C,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;YACtE,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACzC,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;YACjE,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAE/C,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;gBAC/D,UAAU,EAAE,IAAI,CAAC,MAAM;aACxB,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5C,oEAAoE;YACpE,uDAAuD;YACvD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;YAC7C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAE3C,qEAAqE;YACrE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;YAClE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;YACvE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAC1D,YAAY,CACb,CAAC;YAEF,wBAAwB;YACxB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,MAAM,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAChD,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;YAE1E,mEAAmE;YACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,MAAM,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE,OAAO,CAAC,CACnD,CAAC;YACF,MAAM,CACJ,MAAM,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC,QAAQ,CAC9D,CAAC,aAAa,EAAE,CAAC;YAClB,MAAM,CACJ,MAAM,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC,SAAS,CAC/D,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;YACvE,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAE/C,MAAM,yBAAyB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;gBAChD,UAAU,EAAE,IAAI,CAAC,MAAM;aACxB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAEzD,MAAM,yBAAyB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;gBAChD,UAAU,EAAE,IAAI,CAAC,MAAM;aACxB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAEzD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;YAC7E,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;gBAC7B,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;YAC/B,CAAC,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;gBAC/D,WAAW,EAAE,KAAK;aACnB,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3B,2DAA2D;YAC3D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;YACpF,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC/C,MAAM,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YAEpC,MAAM,MAAM,CACV,yBAAyB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;gBAC1C,UAAU,EAAE,IAAI,CAAC,MAAM;aACxB,CAAC,CACH,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAEhD,oCAAoC;YACpC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;YAClE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;YAC1E,uEAAuE;YACvE,uEAAuE;YACvE,qEAAqE;YACrE,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAE/C,MAAM,WAAW,GACf,MAAM,MAAM,CAAC,qDAAqD,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAG,EAAE;iBAChB,KAAK,CAAC,WAAW,EAAE,2BAA2B,CAAC;iBAC/C,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC;YAEnD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;oBAC/D,UAAU,EAAE,IAAI,CAAC,MAAM;oBACvB,SAAS,EAAE,EAAE;iBACd,CAAC,CAAC;gBAEH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;gBAC7C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,MAAM,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,EACjD,MAAM,CAAC,gBAAgB,CAAC;oBACtB,UAAU,EAAE,IAAI,CAAC,MAAM;oBACvB,SAAS,EAAE,EAAE;iBACd,CAAC,CACH,CAAC;gBACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAC7C,CAAC;oBAAS,CAAC;gBACT,QAAQ,CAAC,WAAW,EAAE,CAAC;YACzB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;YAC/F,qEAAqE;YACrE,sEAAsE;YACtE,qEAAqE;YACrE,mEAAmE;YACnE,qEAAqE;YACrE,oEAAoE;YACpE,WAAW;YACX,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAE/C,IAAI,WAAW,GAA2B,GAAG,EAAE,GAAE,CAAC,CAAC;YACnD,MAAM,YAAY,GAAG,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBACnD,WAAW,GAAG,MAAM,CAAC;YACvB,CAAC,CAAC,CAAC;YAEH,MAAM,SAAS,GAAc,EAAE,CAAC;YAChC,MAAM,WAAW,GAAG,CAAC,MAAe,EAAQ,EAAE;gBAC5C,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC,CAAC;YACF,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;YAE9C,MAAM,WAAW,GACf,MAAM,MAAM,CAAC,qDAAqD,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAG,EAAE;iBAChB,KAAK,CAAC,WAAW,EAAE,2BAA2B,CAAC;iBAC/C,kBAAkB,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;YAE1C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;oBAC/D,UAAU,EAAE,IAAI,CAAC,MAAM;oBACvB,SAAS,EAAE,EAAE;iBACd,CAAC,CAAC;gBAEH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,MAAM,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,EACjD,MAAM,CAAC,gBAAgB,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CACrD,CAAC;gBAEF,WAAW,CAAC,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC;gBAC3D,yDAAyD;gBACzD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;gBAEtD,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CACtC,MAAM,CAAC,gBAAgB,CAAC,yCAAyC,CAAC,EAClE,MAAM,CAAC,gBAAgB,CAAC;oBACtB,UAAU,EAAE,IAAI,CAAC,MAAM;oBACvB,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC;wBAC7B,OAAO,EAAE,kCAAkC;qBAC5C,CAAC;iBACH,CAAC,CACH,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;gBAC/C,QAAQ,CAAC,WAAW,EAAE,CAAC;YACzB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;YAC/F,qEAAqE;YACrE,mEAAmE;YACnE,mEAAmE;YACnE,sEAAsE;YACtE,mEAAmE;YACnE,4CAA4C;YAC5C,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC/C,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC3B,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAE9B,MAAM,WAAW,GACf,MAAM,MAAM,CAAC,qDAAqD,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAG,EAAE;iBAChB,KAAK,CAAC,WAAW,EAAE,2BAA2B,CAAC;iBAC/C,iBAAiB,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC;YAE9D,IAAI,CAAC;gBACH,MAAM,MAAM,CACV,yBAAyB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;oBAC1C,UAAU,EAAE,IAAI,CAAC,MAAM;iBACxB,CAAC,CACH,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBAEhD,mEAAmE;gBACnE,kEAAkE;gBAClE,wBAAwB;gBACxB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;gBAC7C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAC7C,CAAC;oBAAS,CAAC;gBACT,QAAQ,CAAC,WAAW,EAAE,CAAC;YACzB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/cli-replacement/userconfig-env.integration.test.d.mts

@@ -0,0 +1,26 @@
+/**
+ * Integration test: real `npm` and `pnpm` subprocesses read the
+ * Superblocks-owned userconfig when our env overlay is set. Pins the
+ * contract that `buildInstallEnv` and the dev-server startup install
+ * rely on.
+ *
+ * Why this exists:
+ *   - Unit tests assert the spawned `env` includes the userconfig keys,
+ *     but they cannot tell us whether npm/pnpm actually *honor* them.
+ *     Earlier iterations of this PR tripped on two real CLI gaps that
+ *     the unit tests missed:
+ *       1. pnpm rejects `--userconfig=` as a CLI flag (pnpm/pnpm#6036)
+ *       2. pnpm 11 stopped honouring `NPM_CONFIG_USERCONFIG` (config
+ *          keys must now be `pnpm_config_*` instead).
+ *   - This file spawns the real binaries and asserts the registry
+ *     comes back from our fixture userconfig.
+ *
+ * Env scrubbing: pnpm/npm inject many `(npm|pnpm)_config_*` env vars
+ * into spawned child processes. Those take precedence over userconfig
+ * (env > userconfig in the npm config priority chain), which means the
+ * fixture would be silently overridden if we forwarded the test
+ * runner's env as-is. We strip those vars on the spawn so the assertion
+ * exercises the userconfig pathway in isolation.
+ */
+export {};
+//# sourceMappingURL=userconfig-env.integration.test.d.mts.map

package/dist/cli-replacement/userconfig-env.integration.test.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userconfig-env.integration.test.d.mts","sourceRoot":"","sources":["../../src/cli-replacement/userconfig-env.integration.test.mts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG"}