@zalkera/cli 0.20.2 → 0.21.0

package/dist/main.js

@@ -1,8 +1,13 @@
 #!/usr/bin/env node
+var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 
 // ../core/dist/notice.js
 function defang(text) {
@@ -24,7 +29,7 @@ function plainNotice(text, limit = 300) {
   const tidy = defang(stripped).replace(/\s+/g, " ").trim();
   return tidy.length > cap ? `${tidy.slice(0, cap)}\u2026` : tidy;
 }
-var INNER_BOUND, MAX_CAP, LINK_SHAPE, AUTOLINK_SHAPE, DEFANG_PASSES;
+var INNER_BOUND, MAX_CAP, LINK_SHAPE, AUTOLINK_SHAPE, DEFANG_PASSES, count;
 var init_notice = __esm({
   "../core/dist/notice.js"() {
     "use strict";
@@ -33,6 +38,12 @@ var init_notice = __esm({
     LINK_SHAPE = new RegExp(`\\]\\s*\\(\\s*([A-Za-z][A-Za-z0-9+.-]*:[^)]{0,${INNER_BOUND}})\\)`, "g");
     AUTOLINK_SHAPE = new RegExp(`<\\s*([A-Za-z][A-Za-z0-9+.-]*:[^>\\s]{0,${INNER_BOUND}})\\s*>`, "g");
     DEFANG_PASSES = 4;
+    count = (value) => {
+      if (typeof value !== "number" && typeof value !== "bigint")
+        return "?";
+      const n = Number(value);
+      return Number.isFinite(n) ? String(n) : "?";
+    };
   }
 });
 
@@ -102,6 +113,30 @@ ${plainNotice(this.hint)}` : body;
 });
 
 // ../core/dist/nodeOnPath.js
+import { existsSync as existsSync5, statSync } from "node:fs";
+import { delimiter, join as join7 } from "node:path";
+function hasNodeOnPath(env = process.env, platform = process.platform) {
+  const raw = env.PATH ?? env.Path ?? env.path ?? "";
+  if (raw.length === 0)
+    return false;
+  const names = platform === "win32" ? ["node.exe"] : ["node"];
+  for (const dir of raw.split(delimiter)) {
+    if (dir.length === 0)
+      continue;
+    for (const name of names) {
+      const at = join7(dir, name);
+      try {
+        if (existsSync5(at) && statSync(at).isFile())
+          return true;
+      } catch {
+      }
+    }
+  }
+  return false;
+}
+function devEngineArgs(env = process.env, platform = process.platform) {
+  return hasNodeOnPath(env, platform) ? [] : ["--webpack"];
+}
 var init_nodeOnPath = __esm({
   "../core/dist/nodeOnPath.js"() {
     "use strict";
@@ -109,11 +144,210 @@ var init_nodeOnPath = __esm({
 });
 
 // ../core/dist/dev.js
+var dev_exports = {};
+__export(dev_exports, {
+  pickPort: () => pickPort,
+  spawnQuietly: () => spawnQuietly,
+  startDevServer: () => startDevServer,
+  translateLog: () => translateLog
+});
+import { spawn as spawn2 } from "node:child_process";
+import { existsSync as existsSync6 } from "node:fs";
+import { createServer as createServer2 } from "node:net";
+import { join as join8 } from "node:path";
+async function startDevServer(options) {
+  const nextBin = join8(options.projectDir, "node_modules", "next", "dist", "bin", "next");
+  if (!existsSync6(nextBin)) {
+    throw new DevtoolsError("DEV_SERVER_FAILED", "\uAC1C\uBC1C \uC11C\uBC84\uB97C \uCC3E\uC9C0 \uBABB\uD588\uC2B5\uB2C8\uB2E4.", "\uC758\uC874\uC131 \uC900\uBE44\uAC00 \uB05D\uB0AC\uB294\uC9C0 \uD655\uC778\uD574 \uC8FC\uC138\uC694.");
+  }
+  const port = await pickPort(options.port);
+  const url = `http://localhost:${port}`;
+  const log = options.onLog ?? (() => {
+  });
+  const engineArgs = devEngineArgs();
+  if (engineArgs.length > 0) {
+    log("\uBBF8\uB9AC\uBCF4\uAE30\uB97C \uB744\uC6C1\uB2C8\uB2E4. \uC774 \uCEF4\uD4E8\uD130\uC5D0 Node.js \uAC00 \uC788\uC73C\uBA74 \uB354 \uBE60\uB978 \uC5D4\uC9C4\uC744 \uC501\uB2C8\uB2E4 \u2014 \uC5C6\uC5B4\uB3C4 \uADF8\uB300\uB85C \uB429\uB2C8\uB2E4.");
+  }
+  const child = spawn2(options.nodePath, [nextBin, "dev", "--port", String(port), ...engineArgs], {
+    cwd: options.projectDir,
+    env: {
+      ...process.env,
+      ...options.extraEnv,
+      PORT: String(port),
+      BROWSER: "none"
+    },
+    stdio: ["ignore", "pipe", "pipe"],
+    // **자기 프로세스 그룹을 준다**(POSIX). Next 는 렌더 워커를, Turbopack 은 자기 node 를 더
+    // 띄운다 — 부모만 끊으면 그것들이 고아로 남아 포트를 물고 메모리를 먹는데, 사용자 화면에는
+    // 끄는 수단이 없다. 그룹이 있어야 `kill(-pid)` 로 한 번에 끊는다(`stopChild`).
+    //
+    // ⚠ 윈도에는 안 준다 — `detached` 가 **새 콘솔 창을 띄운다.** 거기서는 `taskkill /T` 가
+    //   같은 일을 한다.
+    detached: process.platform !== "win32"
+  });
+  let ready = false;
+  const markReady = () => {
+    if (ready)
+      return;
+    ready = true;
+    options.onReady?.(url);
+  };
+  const handle = (chunk) => {
+    for (const line of chunk.toString().split("\n")) {
+      const trimmed = line.trimEnd();
+      if (trimmed.length === 0)
+        continue;
+      log(translateLog(trimmed));
+      if (/\bReady in\b|started server on|Local:\s+http/i.test(trimmed))
+        markReady();
+    }
+  };
+  child.stdout?.on("data", handle);
+  child.stderr?.on("data", handle);
+  const exitListeners = [];
+  child.on("exit", (code2) => {
+    for (const listener of exitListeners)
+      listener(code2);
+  });
+  await waitForReady(child, () => ready, options.signal);
+  return {
+    url,
+    port,
+    stop: () => stopChild(child),
+    onExit: (listener) => exitListeners.push(listener)
+  };
+}
+async function pickPort(preferred) {
+  if (preferred && await isFree(preferred))
+    return preferred;
+  return new Promise((resolve12, reject) => {
+    const server = createServer2();
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      const port = typeof address === "object" && address ? address.port : 0;
+      server.close(() => resolve12(port));
+    });
+  });
+}
+async function isFree(port) {
+  return new Promise((resolve12) => {
+    const server = createServer2();
+    server.once("error", () => resolve12(false));
+    server.listen(port, "127.0.0.1", () => server.close(() => resolve12(true)));
+  });
+}
+async function waitForReady(child, isReady, signal) {
+  await new Promise((resolve12, reject) => {
+    const timer = setTimeout(() => {
+      clearInterval(poll);
+      if (isReady()) {
+        clearTimeout(timer);
+        resolve12();
+        return;
+      }
+      void stopChild(child);
+      reject(new DevtoolsError("DEV_SERVER_FAILED", "\uAC1C\uBC1C \uC11C\uBC84\uAC00 \uC2DC\uAC04 \uC548\uC5D0 \uB728\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4.", "\uB85C\uADF8\uC758 \uB9C8\uC9C0\uB9C9 \uC624\uB958\uB97C \uD655\uC778\uD574 \uC8FC\uC138\uC694. \uB728\uB2E4 \uB9CC \uC11C\uBC84\uB294 \uC815\uB9AC\uD588\uC2B5\uB2C8\uB2E4."));
+    }, READY_TIMEOUT_MS);
+    timer.unref?.();
+    const poll = setInterval(() => {
+      if (!isReady())
+        return;
+      clearInterval(poll);
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
+      resolve12();
+    }, 100);
+    poll.unref?.();
+    function onAbort() {
+      clearInterval(poll);
+      clearTimeout(timer);
+      void stopChild(child);
+      reject(new DevtoolsError("CANCELLED", "\uC900\uBE44\uB97C \uCDE8\uC18C\uD588\uC2B5\uB2C8\uB2E4."));
+    }
+    if (signal?.aborted) {
+      onAbort();
+      return;
+    }
+    signal?.addEventListener("abort", onAbort, { once: true });
+    child.once("exit", (code2) => {
+      if (isReady())
+        return;
+      clearInterval(poll);
+      clearTimeout(timer);
+      reject(new DevtoolsError("DEV_SERVER_FAILED", `\uAC1C\uBC1C \uC11C\uBC84\uAC00 \uBC14\uB85C \uC885\uB8CC\uB418\uC5C8\uC2B5\uB2C8\uB2E4(\uC885\uB8CC \uCF54\uB4DC ${code2}).`, "\uB85C\uADF8\uC758 \uB9C8\uC9C0\uB9C9 \uC624\uB958\uB97C \uD655\uC778\uD574 \uC8FC\uC138\uC694."));
+    });
+  });
+}
+function spawnQuietly(command, args) {
+  try {
+    const child = spawn2(command, [...args], { stdio: "ignore" });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+function killTree(child, signal) {
+  const pid = child.pid;
+  if (pid === void 0)
+    return;
+  if (process.platform === "win32") {
+    spawnQuietly("taskkill", ["/pid", String(pid), "/T", "/F"]);
+    child.kill(signal);
+    return;
+  }
+  try {
+    process.kill(-pid, signal);
+  } catch {
+    child.kill(signal);
+  }
+}
+async function stopChild(child) {
+  if (child.exitCode !== null || child.signalCode !== null)
+    return;
+  killTree(child, "SIGTERM");
+  await new Promise((resolve12) => {
+    const timer = setTimeout(() => {
+      killTree(child, "SIGKILL");
+      resolve12();
+    }, 5e3);
+    timer.unref?.();
+    child.once("exit", () => {
+      clearTimeout(timer);
+      resolve12();
+    });
+  });
+}
+function translateLog(line) {
+  if (/EADDRINUSE/.test(line))
+    return `\u26A0 \uADF8 \uD3EC\uD2B8\uB294 \uB2E4\uB978 \uD504\uB85C\uADF8\uB7A8\uC774 \uC4F0\uACE0 \uC788\uC2B5\uB2C8\uB2E4. \uB2E4\uB978 \uD3EC\uD2B8\uB85C \uB2E4\uC2DC \uCF1C \uC8FC\uC138\uC694.
+${line}`;
+  if (/Cannot find module/.test(line))
+    return `\u26A0 \uD544\uC694\uD55C \uD30C\uC77C\uC774 \uBE60\uC84C\uC2B5\uB2C8\uB2E4. \uC758\uC874\uC131 \uC900\uBE44\uB97C \uB2E4\uC2DC \uD574 \uC8FC\uC138\uC694.
+${line}`;
+  if (/ENOSPC/.test(line))
+    return `\u26A0 \uB514\uC2A4\uD06C \uACF5\uAC04\uC774 \uBD80\uC871\uD569\uB2C8\uB2E4.
+${line}`;
+  if (/ECONNREFUSED|ENOTFOUND|ETIMEDOUT/.test(line)) {
+    return `\u26A0 \uC11C\uBC84\uC5D0 \uC5F0\uACB0\uD558\uC9C0 \uBABB\uD588\uC2B5\uB2C8\uB2E4. \uC778\uD130\uB137\xB7\uC0AC\uB0B4\uB9DD \uD504\uB85D\uC2DC\uB97C \uD655\uC778\uD574 \uC8FC\uC138\uC694.
+${line}`;
+  }
+  if (/ZalkeraError/.test(line) && /시크릿 키|secretKey|ZALKERA_STOREFRONT_KEY|테넌트의 키/.test(line) || /\b(401|403)\b/.test(line) && /storefront|zalkera/i.test(line)) {
+    return `\u26A0 \uB370\uC774\uD130 \uC811\uC18D\uC774 \uAC70\uC808\uB418\uC5C8\uC2B5\uB2C8\uB2E4 \u2014 \uBBF8\uB9AC\uBCF4\uAE30 \uC790\uACA9\uC99D\uBA85\uC774 \uD574\uC81C\uB410\uAC70\uB098 \uB9CC\uB8CC\uB410\uC2B5\uB2C8\uB2E4.
+   \uC790\uACA9\uC99D\uBA85\uC740 **\uD55C \uBC88\uC5D0 \uD558\uB098**\uB77C, \uB2E4\uB978 \uAE30\uACC4(\uB610\uB294 \uB2E4\uB978 \uCC3D)\uC5D0\uC11C \uBBF8\uB9AC\uBCF4\uAE30\uB97C \uCF1C\uBA74 \uC774\uCABD\uC774 \uB04A\uAE41\uB2C8\uB2E4.
+   \uBBF8\uB9AC\uBCF4\uAE30\uB97C \uB2E4\uC2DC \uCF1C \uC8FC\uC138\uC694.
+${line}`;
+  }
+  return line;
+}
+var READY_TIMEOUT_MS;
 var init_dev = __esm({
   "../core/dist/dev.js"() {
     "use strict";
     init_errors();
     init_nodeOnPath();
+    READY_TIMEOUT_MS = 12e4;
   }
 });
 
@@ -234,10 +468,10 @@ async function startLoopbackReceiver(options = {}) {
   let resolveCode;
   let rejectCode;
   let settled = false;
-  const codePromise = new Promise((resolve9, reject) => {
+  const codePromise = new Promise((resolve12, reject) => {
     resolveCode = (result) => {
       settled = true;
-      resolve9(result);
+      resolve12(result);
     };
     rejectCode = (error) => {
       settled = true;
@@ -264,9 +498,9 @@ async function startLoopbackReceiver(options = {}) {
     respond(response, 200, successHtml);
     resolveCode({ code: code2, state });
   });
-  await new Promise((resolve9, reject) => {
+  await new Promise((resolve12, reject) => {
     server.once("error", reject);
-    server.listen(0, "127.0.0.1", resolve9);
+    server.listen(0, "127.0.0.1", resolve12);
   });
   const port = server.address().port;
   const timer = setTimeout(() => {
@@ -360,11 +594,11 @@ async function refreshToken(config, store) {
   const epoch = epochOf(store);
   const current = await store.read();
   if (!current) {
-    throw new DevtoolsError("NOT_AUTHENTICATED", "\uB85C\uADF8\uC778\uC774 \uD544\uC694\uD569\uB2C8\uB2E4.", "\uBA3C\uC800 \uC798\uCEE4\uB77C\uC5D0 \uB85C\uADF8\uC778\uD574 \uC8FC\uC138\uC694.");
+    throw new DevtoolsError("NOT_AUTHENTICATED", "\uB85C\uADF8\uC778\uC774 \uD544\uC694\uD569\uB2C8\uB2E4.", config.loginHow ?? "\uBA3C\uC800 \uC798\uCEE4\uB77C\uC5D0 \uB85C\uADF8\uC778\uD574 \uC8FC\uC138\uC694.");
   }
   if (current.issuer !== config.issuer) {
     await store.clear();
-    throw new DevtoolsError("NOT_AUTHENTICATED", "\uC11C\uBC84\uAC00 \uBC14\uB00C\uC5B4 \uB2E4\uC2DC \uB85C\uADF8\uC778\uD574\uC57C \uD569\uB2C8\uB2E4.");
+    throw new DevtoolsError("NOT_AUTHENTICATED", "\uC11C\uBC84\uAC00 \uBC14\uB00C\uC5B4 \uB2E4\uC2DC \uB85C\uADF8\uC778\uD574\uC57C \uD569\uB2C8\uB2E4.", config.loginHow);
   }
   if (current.expiresAt - REFRESH_SKEW_MS > Date.now())
     return current.accessToken;
@@ -373,7 +607,7 @@ async function refreshToken(config, store) {
     refreshed = await exchange(config, { grant_type: "refresh_token", refresh_token: current.refreshToken });
   } catch (cause) {
     await store.clear();
-    throw new DevtoolsError("NOT_AUTHENTICATED", "\uB85C\uADF8\uC778\uC774 \uB9CC\uB8CC\uB418\uC5C8\uC2B5\uB2C8\uB2E4.", "\uB2E4\uC2DC \uB85C\uADF8\uC778\uD574 \uC8FC\uC138\uC694.", cause);
+    throw new DevtoolsError("NOT_AUTHENTICATED", "\uB85C\uADF8\uC778\uC774 \uB9CC\uB8CC\uB418\uC5C8\uC2B5\uB2C8\uB2E4.", config.loginHow ?? "\uB2E4\uC2DC \uB85C\uADF8\uC778\uD574 \uC8FC\uC138\uC694.", cause);
   }
   if (epochOf(store) !== epoch) {
     throw new DevtoolsError("NOT_AUTHENTICATED", "\uB85C\uADF8\uC544\uC6C3\uB418\uC5C8\uC2B5\uB2C8\uB2E4.", "\uB2E4\uC2DC \uB85C\uADF8\uC778\uD574 \uC8FC\uC138\uC694.");
@@ -662,6 +896,11 @@ function withTrailingSlash2(base) {
   return base.endsWith("/") ? base : `${base}/`;
 }
 
+// ../core/dist/env.js
+import { chmod, readFile, writeFile as writeFile2 } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { join as join2 } from "node:path";
+
 // ../core/dist/safeWrite.js
 init_errors();
 import { lstat, mkdir, rename, rm, writeFile } from "node:fs/promises";
@@ -779,19 +1018,78 @@ function assertNotWrittenTwice(path, entryName, written) {
   throw new DevtoolsError("SERVER_REJECTED", `\uBC1B\uC740 \uAFB8\uB7EC\uBBF8\uAC00 \uAC19\uC740 \uD30C\uC77C\uC744 \uB450 \uBC88 \uB2F4\uACE0 \uC788\uC2B5\uB2C8\uB2E4: ${entryName}`, "\uBC1B\uC740 \uAC83\uC774 \uC798\uBABB\uB410\uC2B5\uB2C8\uB2E4 \u2014 \uBE48 \uD3F4\uB354\uB85C \uB2E4\uC2DC \uBC1B\uC544\uB3C4 \uAC19\uC740 \uC790\uB9AC\uC5D0\uC11C \uBA48\uCDA5\uB2C8\uB2E4. \uC798\uCEE4\uB77C\uC5D0 \uC54C\uB824 \uC8FC\uC138\uC694.");
 }
 
+// ../core/dist/env.js
+var MANAGED_KEYS = [
+  "ZALKERA_API_BASE",
+  "ZALKERA_TENANT",
+  "ZALKERA_STOREFRONT_KEY",
+  "ZALKERA_SITE_URL",
+  "NEXT_PUBLIC_ZALKERA_PREVIEW"
+];
+function mergeEnv(existing, values) {
+  const pending = new Map(Object.entries(values));
+  const lines = existing.length === 0 ? [] : existing.split("\n");
+  const seen = /* @__PURE__ */ new Set();
+  const deduped = lines.filter((line) => {
+    const key = keyOf(line);
+    if (key === null || !pending.has(key))
+      return true;
+    if (seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
+  });
+  const merged = deduped.map((line) => {
+    const key = keyOf(line);
+    if (key === null || !pending.has(key))
+      return line;
+    const value = pending.get(key);
+    pending.delete(key);
+    return `${key}=${quoteIfNeeded(value)}`;
+  });
+  if (pending.size > 0) {
+    if (merged.length > 0 && merged[merged.length - 1]?.trim() !== "")
+      merged.push("");
+    merged.push("# zalkera \uD655\uC7A5\uC774 \uAD00\uB9AC\uD558\uB294 \uCE78 \u2014 \uBBF8\uB9AC\uBCF4\uAE30\uB97C \uCF24 \uB54C\uB9C8\uB2E4 \uAC31\uC2E0\uB429\uB2C8\uB2E4(\uB2E4\uB978 \uC904\uC740 \uAC74\uB4DC\uB9AC\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4).");
+    for (const key of MANAGED_KEYS) {
+      const value = pending.get(key);
+      if (value !== void 0)
+        merged.push(`${key}=${quoteIfNeeded(value)}`);
+    }
+    merged.push("");
+  }
+  return merged.join("\n");
+}
+async function writePreviewEnv(projectDir, values) {
+  const path = join2(projectDir, ".env.local");
+  const existing = existsSync(path) ? await readFile(path, "utf8") : "";
+  const merged = mergeEnv(existing, values);
+  await writeOwnFile(path, merged, 384);
+  await chmod(path, 384).catch(() => {
+  });
+  return path;
+}
+function keyOf(line) {
+  const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/.exec(line);
+  return match?.[1] ?? null;
+}
+function quoteIfNeeded(value) {
+  return /[\s"'#]/.test(value) ? JSON.stringify(value) : value;
+}
+
 // ../core/dist/project.js
 init_errors();
-import { existsSync } from "node:fs";
-import { readFile, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join2 } from "node:path";
+import { existsSync as existsSync2 } from "node:fs";
+import { readFile as readFile2, writeFile as writeFile3 } from "node:fs/promises";
+import { join as join3 } from "node:path";
 async function inspectProject(dir) {
-  const packagePath = join2(dir, "package.json");
-  if (!existsSync(packagePath)) {
+  const packagePath = join3(dir, "package.json");
+  if (!existsSync2(packagePath)) {
     throw new DevtoolsError("NOT_A_SITE", "\uC774 \uD3F4\uB354\uC5D0\uC11C \uC0AC\uC774\uD2B8 \uC18C\uC2A4\uB97C \uCC3E\uC9C0 \uBABB\uD588\uC2B5\uB2C8\uB2E4.", "\uC0AC\uC774\uD2B8 \uC18C\uC2A4 \uD3F4\uB354(package.json \uC774 \uC788\uB294 \uACF3)\uB97C \uACE8\uB77C \uC8FC\uC138\uC694.");
   }
   let parsed;
   try {
-    parsed = JSON.parse(await readFile(packagePath, "utf8"));
+    parsed = JSON.parse(await readFile2(packagePath, "utf8"));
   } catch (cause) {
     throw new DevtoolsError("NOT_A_SITE", "package.json \uC744 \uC77D\uC9C0 \uBABB\uD588\uC2B5\uB2C8\uB2E4(\uD615\uC2DD \uC624\uB958).", "\uD30C\uC77C\uC774 \uD3B8\uC9D1 \uC911 \uAE68\uC84C\uB294\uC9C0 \uD655\uC778\uD574 \uC8FC\uC138\uC694.", cause);
   }
@@ -802,18 +1100,56 @@ async function inspectProject(dir) {
     hasNext: "next" in deps,
     clientVersion: deps["@zalkera/client"] ?? null,
     toolInDeps: TOOL_PACKAGES.filter((name) => name in deps),
-    hasNodeModules: existsSync(join2(dir, "node_modules"))
+    hasNodeModules: existsSync2(join3(dir, "node_modules"))
   };
 }
 var TOOL_PACKAGES = ["@zalkera/cli", "@zalkera/devtools", "zalkera", "zalkera-cli"];
+async function ensureEnvIgnored(dir) {
+  const path = join3(dir, ".gitignore");
+  if (!existsSync2(path)) {
+    if (!existsSync2(join3(dir, ".git")))
+      return "not-git";
+    await writeOwnFile(path, "# \uB85C\uCEEC \uC790\uACA9\uC99D\uBA85 \u2014 \uC808\uB300 \uCEE4\uBC0B\uD558\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4(zalkera).\n.env.local\n");
+    return "created";
+  }
+  const content = await readFile2(path, "utf8");
+  const ignored = content.split("\n").map((line) => line.trim()).some((line) => line === ".env.local" || line === ".env*" || line === ".env*.local");
+  if (ignored)
+    return "already";
+  const suffix = content.endsWith("\n") || content.length === 0 ? "" : "\n";
+  await writeOwnFile(path, `${content}${suffix}
+# \uB85C\uCEEC \uC790\uACA9\uC99D\uBA85 \u2014 \uC808\uB300 \uCEE4\uBC0B\uD558\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4(zalkera).
+.env.local
+`);
+  return "added";
+}
 
 // ../core/dist/deps.js
 init_errors();
+import { spawn } from "node:child_process";
+import { createHash as createHash4 } from "node:crypto";
+import { cp, link, mkdir as mkdir4, readFile as readFile4, readdir as readdir2, readlink, rm as rm4, stat as stat2, symlink as symlink2, utimes, writeFile as writeFile6 } from "node:fs/promises";
+import { existsSync as existsSync4 } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join as join6, resolve as resolve4 } from "node:path";
+
+// ../core/dist/payload.js
+import { createHash as createHash3 } from "node:crypto";
+import { createWriteStream as createWriteStream2 } from "node:fs";
+import { mkdir as mkdir3, readFile as readFile3, readdir, rm as rm3, stat, writeFile as writeFile5 } from "node:fs/promises";
+import { existsSync as existsSync3 } from "node:fs";
+import { join as join5, resolve as resolve3 } from "node:path";
+import { Readable, Transform as Transform2 } from "node:stream";
+import { pipeline as pipeline2 } from "node:stream/promises";
 
 // ../core/dist/untar.js
 import { createHash as createHash2 } from "node:crypto";
-import { chmod, lstat as lstat2, mkdir as mkdir2, open, realpath, rm as rm2, symlink, writeFile as writeFile3 } from "node:fs/promises";
-import { isAbsolute, join as join3, normalize as normalize2, relative as relative2, resolve as resolve2, sep as sep2 } from "node:path";
+import { createReadStream, createWriteStream } from "node:fs";
+import { chmod as chmod2, lstat as lstat2, mkdir as mkdir2, open, realpath, rm as rm2, symlink, writeFile as writeFile4 } from "node:fs/promises";
+import { isAbsolute, join as join4, normalize as normalize2, relative as relative2, resolve as resolve2, sep as sep2 } from "node:path";
+import { Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { createGunzip } from "node:zlib";
 
 // ../core/dist/limits.js
 var MAX_DOWNLOAD_BYTES = 150 * 1024 * 1024;
@@ -877,6 +1213,57 @@ async function readTarManifest(tar, options = {}) {
   });
   return manifest;
 }
+async function extractTarGzFile(gzPath, targetDir, scratchPath, options = {}) {
+  try {
+    const limit = resolveCap(options.maxBytes);
+    const guard = new Transform({
+      transform(chunk, _enc, done) {
+        written += chunk.length;
+        if (written > limit) {
+          done(new Error(`\uD574\uC81C \uC0B0\uCD9C\uBB3C\uC774 \uC0C1\uD55C(${limit}B)\uC744 \uB118\uC5C8\uC2B5\uB2C8\uB2E4`));
+          return;
+        }
+        done(null, chunk);
+      }
+    });
+    let written = 0;
+    await pipeline(createReadStream(gzPath), createGunzip(), guard, createWriteStream(scratchPath));
+  } catch (cause) {
+    await rm2(scratchPath, { force: true }).catch(() => {
+    });
+    throw new DevtoolsError("SERVER_REJECTED", "\uBC1B\uC740 \uC758\uC874\uC131 \uAFB8\uB7EC\uBBF8\uB97C \uD480\uC9C0 \uBABB\uD588\uC2B5\uB2C8\uB2E4.", "\uB2E4\uC2DC \uC2DC\uB3C4\uD574\uB3C4 \uAC19\uC73C\uBA74 \uC798\uCEE4\uB77C\uC5D0 \uBB38\uC758\uD574 \uC8FC\uC138\uC694.", cause);
+  }
+  const sink = await createSink(targetDir, options);
+  const handle = await open(scratchPath, "r");
+  try {
+    const header = Buffer.alloc(BLOCK);
+    for (; ; ) {
+      const { bytesRead } = await handle.read(header, 0, BLOCK, null);
+      if (bytesRead < BLOCK)
+        break;
+      if (isEndOfArchive(header))
+        break;
+      const meta = parseHeader(header);
+      const data = Buffer.alloc(meta.size);
+      if (meta.size > 0) {
+        const read = await handle.read(data, 0, meta.size, null);
+        if (read.bytesRead < meta.size) {
+          throw new DevtoolsError("SERVER_REJECTED", "\uBC1B\uC740 \uC758\uC874\uC131 \uAFB8\uB7EC\uBBF8\uAC00 \uC911\uAC04\uC5D0 \uB04A\uACBC\uC2B5\uB2C8\uB2E4.");
+        }
+        const padding = Math.ceil(meta.size / BLOCK) * BLOCK - meta.size;
+        if (padding > 0)
+          await handle.read(Buffer.alloc(padding), 0, padding, null);
+      }
+      await sink.consume(meta, data);
+    }
+  } finally {
+    await handle.close().catch(() => {
+    });
+    await rm2(scratchPath, { force: true }).catch(() => {
+    });
+  }
+  return sink.fileCount();
+}
 var BLOCK = 512;
 function isEndOfArchive(header) {
   return header.every((byte) => byte === 0);
@@ -979,7 +1366,7 @@ async function createSink(targetDir, options) {
       if (verdict === "skip")
         return;
       const parent = await descend(root, segments.slice(0, -1), verified);
-      const path = join3(parent, leaf);
+      const path = join4(parent, leaf);
       await assertNotSymlink(path, name);
       if (verdict === "replace") {
         assertNotWrittenTwice(path, name, writtenPaths);
@@ -991,7 +1378,7 @@ async function createSink(targetDir, options) {
         await writeExclusive(path, data, name, writtenPaths);
       }
       if (preserveMode && (entry.mode & 73) !== 0) {
-        await chmod(path, 493).catch(() => {
+        await chmod2(path, 493).catch(() => {
         });
       }
       count2 += 1;
@@ -1012,7 +1399,7 @@ async function writeSymlink(root, segments, name, target, verified) {
   if (resolved !== root && !resolved.startsWith(root + sep2)) {
     throw new DevtoolsError("SERVER_REJECTED", `\uBC1B\uC740 \uAFB8\uB7EC\uBBF8\uC758 \uB9C1\uD06C\uAC00 \uD3F4\uB354 \uBC16\uC744 \uAC00\uB9AC\uD0B5\uB2C8\uB2E4: ${name}`);
   }
-  const linkPath = join3(parent, leaf);
+  const linkPath = join4(parent, leaf);
   await assertNotSymlink(linkPath, name);
   await symlink(relative2(parent, resolved) || ".", linkPath).catch((error) => {
     throw new DevtoolsError("SERVER_REJECTED", `\uB9C1\uD06C\uB97C \uB9CC\uB4E4\uC9C0 \uBABB\uD588\uC2B5\uB2C8\uB2E4: ${name}`, "\uBC1B\uB294 \uD3F4\uB354\uB97C \uBE44\uC6B0\uACE0 \uB2E4\uC2DC \uC2DC\uB3C4\uD574 \uC8FC\uC138\uC694.", error);
@@ -1049,9 +1436,427 @@ async function gunzipBuffer(input, maxBytes) {
 }
 
 // ../core/dist/payload.js
+async function tryFetchPayload(options) {
+  const raw = options.onProgress ?? (() => {
+  });
+  const report = (message) => {
+    try {
+      raw(message);
+    } catch {
+    }
+  };
+  try {
+    return await attempt(options, report);
+  } catch (cause) {
+    await rm3(options.cacheDir, { recursive: true, force: true }).catch(() => {
+    });
+    report(`\uC900\uBE44\uB41C \uC758\uC874\uC131 \uAFB8\uB7EC\uBBF8\uB97C \uC4F0\uC9C0 \uBABB\uD574 \uC9C1\uC811 \uB0B4\uB824\uBC1B\uC2B5\uB2C8\uB2E4(${describe(cause)}).`);
+    return null;
+  }
+}
+async function attempt(options, report) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const block2 = await lookup(options, fetchImpl);
+  if (block2 === "unsupported") {
+    report("\uBBF8\uB9AC \uC900\uBE44\uB41C \uC758\uC874\uC131 \uAFB8\uB7EC\uBBF8\uAC00 \uC5C6\uC5B4 \uC9C1\uC811 \uB0B4\uB824\uBC1B\uC2B5\uB2C8\uB2E4(\uC870\uAE08 \uB354 \uAC78\uB9BD\uB2C8\uB2E4).");
+    return null;
+  }
+  const echo = typeof block2.lockfileSha256 === "string" ? block2.lockfileSha256 : "";
+  if (echo && echo.toLowerCase() !== options.lockfileSha256.toLowerCase()) {
+    report("\uC11C\uBC84\uAC00 \uB2E4\uB978 \uBC84\uC804\uC758 \uB2F5\uC744 \uC8FC\uC5B4 \uC900\uBE44\uB41C \uAFB8\uB7EC\uBBF8\uB97C \uC4F0\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4.");
+    return null;
+  }
+  const entry = block2.payload;
+  if (!entry || typeof entry !== "object") {
+    report("\uC774 \uBC84\uC804\uC5D0 \uB9DE\uB294 \uC758\uC874\uC131 \uAFB8\uB7EC\uBBF8\uAC00 \uC544\uC9C1 \uC5C6\uC5B4 \uC9C1\uC811 \uB0B4\uB824\uBC1B\uC2B5\uB2C8\uB2E4(\uC870\uAE08 \uB354 \uAC78\uB9BD\uB2C8\uB2E4).");
+    return null;
+  }
+  const url = typeof entry.url === "string" ? entry.url : "";
+  const sha256 = typeof entry.sha256 === "string" ? entry.sha256 : "";
+  const bytes = typeof entry.bytes === "number" ? entry.bytes : Number.NaN;
+  const bakedAt = typeof entry.bakedAt === "string" ? entry.bakedAt : null;
+  if (!isSafeHttpsUrl(url) || !/^[0-9a-f]{64}$/i.test(sha256) || !Number.isSafeInteger(bytes) || bytes <= 0) {
+    report("\uC11C\uBC84\uAC00 \uC900 \uAFB8\uB7EC\uBBF8 \uC815\uBCF4\uB97C \uC774\uD574\uD560 \uC218 \uC5C6\uC5B4 \uC9C1\uC811 \uB0B4\uB824\uBC1B\uC2B5\uB2C8\uB2E4.");
+    return null;
+  }
+  report(`\uC900\uBE44\uB41C \uC758\uC874\uC131 \uAFB8\uB7EC\uBBF8\uB97C \uBC1B\uB294 \uC911\u2026 (${formatMegabytes(bytes)})`);
+  await mkdir3(options.cacheDir, { recursive: true });
+  if (!await hasRoomFor(options.cacheDir, bytes)) {
+    report("\uB514\uC2A4\uD06C \uC5EC\uC720\uAC00 \uBD80\uC871\uD574 \uC900\uBE44\uB41C \uAFB8\uB7EC\uBBF8\uB97C \uC4F0\uC9C0 \uC54A\uACE0 \uC9C1\uC811 \uB0B4\uB824\uBC1B\uC2B5\uB2C8\uB2E4.");
+    return null;
+  }
+  const archivePath = join5(options.cacheDir, DOWNLOAD_NAME);
+  const scratchPath = join5(options.cacheDir, SCRATCH_NAME);
+  try {
+    const actual = await download(url, archivePath, fetchImpl, bytes, options.stallTimeoutMs ?? STALL_TIMEOUT_MS);
+    if (actual !== sha256.toLowerCase()) {
+      report("\uBC1B\uC740 \uAFB8\uB7EC\uBBF8\uAC00 \uC6D0\uBCF8\uACFC \uB2EC\uB77C \uD3D0\uAE30\uD588\uC2B5\uB2C8\uB2E4. \uC758\uC874\uC131\uC744 \uC9C1\uC811 \uB0B4\uB824\uBC1B\uC2B5\uB2C8\uB2E4.");
+      return null;
+    }
+    report("\uC758\uC874\uC131 \uAFB8\uB7EC\uBBF8\uB97C \uD478\uB294 \uC911\u2026");
+    const fileCount = await extractTarGzFile(archivePath, options.cacheDir, scratchPath, {
+      // 오염된 응답이 sha 대조 **전에** 디스크를 채우지 못하게 막는다(심의 W3). 정상 페이로드는
+      // 압축 대비 4배 안쪽이라(실측 158MB → 586MB) 여유 있게 잡되 무제한은 아니다.
+      maxBytes: Math.max(bytes * EXTRACT_RATIO_CAP, MIN_EXTRACT_CAP),
+      // `.bin` 의 상대 심볼릭 링크 9개가 없으면 `next dev` 가 실행 파일을 못 찾는다(실측).
+      symlinks: "materialize",
+      // 실행 비트가 없으면 그 실패는 **실행 단계**에서 EACCES 로 나타나, 원인을 엉뚱한 데서 찾게 된다.
+      preserveMode: true
+    });
+    const treeDir = join5(options.cacheDir, "node_modules");
+    if (!existsSync3(treeDir)) {
+      report("\uBC1B\uC740 \uAFB8\uB7EC\uBBF8\uC758 \uBAA8\uC591\uC774 \uC608\uC0C1\uACFC \uB2EC\uB77C \uC4F0\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4. \uC758\uC874\uC131\uC744 \uC9C1\uC811 \uB0B4\uB824\uBC1B\uC2B5\uB2C8\uB2E4.");
+      await rm3(options.cacheDir, { recursive: true, force: true }).catch(() => {
+      });
+      return null;
+    }
+    return { bytes, fileCount, bakedAt };
+  } catch (cause) {
+    await rm3(options.cacheDir, { recursive: true, force: true }).catch(() => {
+    });
+    report(`\uC900\uBE44\uB41C \uC758\uC874\uC131 \uAFB8\uB7EC\uBBF8\uB97C \uC4F0\uC9C0 \uBABB\uD574 \uC9C1\uC811 \uB0B4\uB824\uBC1B\uC2B5\uB2C8\uB2E4(${describe(cause)}).`);
+    return null;
+  } finally {
+    await rm3(archivePath, { force: true }).catch(() => {
+    });
+    await rm3(scratchPath, { force: true }).catch(() => {
+    });
+  }
+}
+async function lookup(options, fetchImpl) {
+  const url = new URL("/api/devtools/handshake", options.apiBase.endsWith("/") ? options.apiBase : `${options.apiBase}/`);
+  url.searchParams.set("lockfileHash", options.lockfileSha256);
+  url.searchParams.set("platform", options.platform);
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), options.lookupTimeoutMs ?? LOOKUP_TIMEOUT_MS);
+  try {
+    const response = await fetchImpl(url, { headers: { accept: "application/json" }, signal: controller.signal });
+    if (!response.ok)
+      return "unsupported";
+    const body = await response.json();
+    const deps = body?.data?.deps;
+    if (!deps || typeof deps !== "object")
+      return "unsupported";
+    return deps;
+  } catch {
+    return "unsupported";
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function download(url, targetPath, fetchImpl, declaredBytes, stallMs) {
+  const controller = new AbortController();
+  let stall = setTimeout(() => controller.abort(), stallMs);
+  stall.unref?.();
+  let response;
+  try {
+    response = await fetchImpl(url, { signal: controller.signal });
+  } catch (cause) {
+    clearTimeout(stall);
+    throw cause;
+  }
+  if (!response.ok || !response.body) {
+    clearTimeout(stall);
+    throw new Error(`HTTP ${response.status}`);
+  }
+  const hash = createHash3("sha256");
+  const cap = declaredBytes > 0 ? declaredBytes : Number.POSITIVE_INFINITY;
+  let received = 0;
+  const body = Readable.fromWeb(response.body);
+  const guard = new Transform2({
+    transform(chunk, _enc, done) {
+      clearTimeout(stall);
+      stall = setTimeout(() => controller.abort(), stallMs);
+      stall.unref?.();
+      received += chunk.length;
+      if (received > cap) {
+        done(new Error(`\uBC1B\uB294 \uC591\uC774 \uC11C\uBC84\uAC00 \uB9D0\uD55C \uD06C\uAE30(${cap}B)\uB97C \uB118\uC5C8\uC2B5\uB2C8\uB2E4`));
+        return;
+      }
+      hash.update(chunk);
+      done(null, chunk);
+    }
+  });
+  try {
+    await pipeline2(body, guard, createWriteStream2(targetPath));
+  } finally {
+    clearTimeout(stall);
+  }
+  if (received !== declaredBytes && declaredBytes > 0) {
+    throw new Error(`\uBC1B\uC740 \uD06C\uAE30\uAC00 \uC11C\uBC84\uAC00 \uB9D0\uD55C \uAC83\uACFC \uB2E4\uB985\uB2C8\uB2E4(${received} != ${declaredBytes})`);
+  }
+  return hash.digest("hex");
+}
+async function hasRoomFor(dir, declaredBytes) {
+  try {
+    const { statfs } = await import("node:fs/promises");
+    if (typeof statfs !== "function")
+      return true;
+    const info = await statfs(dir);
+    const free = Number(info.bavail) * Number(info.bsize);
+    return free > declaredBytes * DISK_HEADROOM;
+  } catch {
+    return true;
+  }
+}
+async function evictOldCaches(cacheRoot, keep = 3, onProgress, protectPath) {
+  try {
+    const entries = await readdir(cacheRoot, { withFileTypes: true });
+    const dirs = entries.filter((e) => e.isDirectory() && !e.name.startsWith("."));
+    if (dirs.length <= keep)
+      return 0;
+    const withTime = await Promise.all(dirs.map(async (e) => {
+      const path = resolve3(join5(cacheRoot, e.name));
+      const mtime = await stat(path).then((s) => s.mtimeMs).catch(() => 0);
+      return { path, mtime };
+    }));
+    withTime.sort((a, b) => b.mtime - a.mtime);
+    let removed = 0;
+    for (const entry of withTime.slice(keep)) {
+      if (protectPath && entry.path === resolve3(protectPath))
+        continue;
+      await rm3(entry.path, { recursive: true, force: true });
+      removed += 1;
+    }
+    if (removed > 0)
+      onProgress?.(`\uC624\uB798\uB41C \uC758\uC874\uC131 \uCE90\uC2DC ${removed}\uAC1C\uB97C \uC815\uB9AC\uD588\uC2B5\uB2C8\uB2E4.`);
+    return removed;
+  } catch {
+    return 0;
+  }
+}
+async function computePayloadKey(projectDir) {
+  const lockPath = join5(projectDir, "package-lock.json");
+  if (!existsSync3(lockPath))
+    return null;
+  return createHash3("sha256").update(await readFile3(lockPath)).digest("hex");
+}
+function currentPlatform() {
+  return `${process.platform}-${process.arch}`;
+}
+async function writePayloadStamp(cacheDir, result, key) {
+  await writeFile5(join5(cacheDir, "payload.json"), `${JSON.stringify({ lockfileSha256: key, bakedAt: result.bakedAt, fileCount: result.fileCount }, null, 2)}
+`, "utf8").catch(() => {
+  });
+}
+function isSafeHttpsUrl(value) {
+  try {
+    return new URL(value).protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+var LOOKUP_TIMEOUT_MS = 5e3;
+var STALL_TIMEOUT_MS = 3e4;
 var EXTRACT_RATIO_CAP = 8;
 var DISK_HEADROOM = 1 + 2 * EXTRACT_RATIO_CAP;
 var MIN_EXTRACT_CAP = 32 * 1024 * 1024;
+var DOWNLOAD_NAME = ".payload.tar.gz";
+var SCRATCH_NAME = ".payload.tar";
+function formatMegabytes(bytes) {
+  return `${Math.round(bytes / (1024 * 1024))}MB`;
+}
+function describe(cause) {
+  const message = cause instanceof Error ? cause.message : String(cause);
+  return message.length > 80 ? `${message.slice(0, 80)}\u2026` : message;
+}
+
+// ../core/dist/deps.js
+function spawnFailure(cause) {
+  if (cause instanceof Error && cause.name === "AbortError") {
+    return new DevtoolsError("CANCELLED", "\uC900\uBE44\uB97C \uCDE8\uC18C\uD588\uC2B5\uB2C8\uB2E4.");
+  }
+  const missing = isNotFound(cause);
+  return new DevtoolsError("DEPENDENCIES_FAILED", missing ? "\uC758\uC874\uC131 \uC124\uCE58 \uB3C4\uAD6C\uB97C \uC2E4\uD589\uD558\uC9C0 \uBABB\uD588\uC2B5\uB2C8\uB2E4." : "\uC758\uC874\uC131\uC744 \uB0B4\uB824\uBC1B\uC9C0 \uBABB\uD588\uC2B5\uB2C8\uB2E4.", missing ? "\uD655\uC7A5\uC744 \uB2E4\uC2DC \uC124\uCE58\uD574 \uBCF4\uC138\uC694. \uADF8\uB798\uB3C4 \uAC19\uC73C\uBA74 \uC798\uCEE4\uB77C\uC5D0 \uBB38\uC758\uD574 \uC8FC\uC138\uC694." : "\uC778\uD130\uB137 \uC5F0\uACB0\uC774\uB098 \uC0AC\uB0B4\uB9DD \uD504\uB85D\uC2DC \uC124\uC815\uC744 \uD655\uC778\uD574 \uC8FC\uC138\uC694.", cause);
+}
+async function ensureDependencies(options) {
+  const { projectDir } = options;
+  const cacheRoot = options.cacheRoot ?? join6(homedir(), ".zalkera", "deps");
+  const report = options.onProgress ?? (() => {
+  });
+  const cacheKey = await computeCacheKey(projectDir);
+  const cacheDir = join6(cacheRoot, cacheKey);
+  const target = join6(projectDir, "node_modules");
+  const doneAt = completionPath(cacheRoot, projectDir, cacheKey);
+  if (existsSync4(doneAt) && existsSync4(target)) {
+    report("\uC758\uC874\uC131\uC774 \uC774\uBBF8 \uC900\uBE44\uB3FC \uC788\uC2B5\uB2C8\uB2E4.");
+    return { action: "reused", cacheKey };
+  }
+  if (isCacheComplete(cacheDir)) {
+    report("\uC900\uBE44\uD574 \uB454 \uC758\uC874\uC131\uC744 \uC5F0\uACB0\uD569\uB2C8\uB2E4\u2026");
+    await utimes(cacheDir, /* @__PURE__ */ new Date(), /* @__PURE__ */ new Date()).catch(() => {
+    });
+    const linked = await linkOrCopy(join6(cacheDir, "node_modules"), target);
+    await markComplete(doneAt);
+    return { action: linked, cacheKey };
+  }
+  if (options.apiBase) {
+    const payloadKey = await computePayloadKey(projectDir);
+    if (payloadKey) {
+      const payload = await tryFetchPayload({
+        apiBase: options.apiBase,
+        lockfileSha256: payloadKey,
+        platform: currentPlatform(),
+        cacheDir,
+        onProgress: report,
+        fetchImpl: options.fetchImpl
+      });
+      if (payload) {
+        await writePayloadStamp(cacheDir, payload, payloadKey);
+        report(`\uC900\uBE44\uB41C \uC758\uC874\uC131 ${payload.fileCount}\uAC1C\uB97C \uC5F0\uACB0\uD569\uB2C8\uB2E4\u2026`);
+        const linked = await linkOrCopy(join6(cacheDir, "node_modules"), target);
+        await markComplete(doneAt);
+        await evictOldCaches(cacheRoot, KEEP_CACHES, report, cacheDir);
+        return { action: linked, cacheKey };
+      }
+    } else {
+      report("\uC774 \uD504\uB85C\uC81D\uD2B8\uB294 \uBBF8\uB9AC \uC900\uBE44\uB41C \uAFB8\uB7EC\uBBF8\uB97C \uC4F8 \uC218 \uC5C6\uC5B4 \uC9C1\uC811 \uB0B4\uB824\uBC1B\uC2B5\uB2C8\uB2E4(package-lock.json \uC774 \uD544\uC694\uD569\uB2C8\uB2E4).");
+    }
+  }
+  const needsScripts = await installScriptPackages(projectDir);
+  if (needsScripts.length) {
+    report(`\uC124\uCE58 \uC2A4\uD06C\uB9BD\uD2B8\uAC00 \uD544\uC694\uD55C \uAFB8\uB7EC\uBBF8\uAC00 ${needsScripts.length}\uAC1C \uC788\uC2B5\uB2C8\uB2E4(${needsScripts.slice(0, 3).join(", ")}${needsScripts.length > 3 ? " \uC678" : ""}). \uC548\uC804\uC744 \uC704\uD574 \uC2E4\uD589\uD558\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4 \u2014 \uC774 \uAFB8\uB7EC\uBBF8\uAC00 \uC81C\uB300\uB85C \uC548 \uC124 \uC218 \uC788\uC2B5\uB2C8\uB2E4.`);
+  }
+  report("\uC758\uC874\uC131\uC744 \uCC98\uC74C \uD55C \uBC88 \uB0B4\uB824\uBC1B\uC2B5\uB2C8\uB2E4. \uBA87 \uBD84 \uAC78\uB9B4 \uC218 \uC788\uC2B5\uB2C8\uB2E4\u2026");
+  await runNpmInstall(projectDir, options.npmCommand, options.npmEnv ?? {}, report, options.signal);
+  await seedCache(target, cacheDir, cacheKey, report);
+  await markComplete(doneAt);
+  await evictOldCaches(cacheRoot, KEEP_CACHES, report, cacheDir);
+  return { action: "installed", cacheKey };
+}
+function isCacheComplete(cacheDir) {
+  if (!existsSync4(join6(cacheDir, "node_modules")))
+    return false;
+  return existsSync4(join6(cacheDir, "key.txt")) || existsSync4(join6(cacheDir, "payload.json"));
+}
+var KEEP_CACHES = 3;
+async function computeCacheKey(projectDir) {
+  const lockNames = ["package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock"];
+  const hash = createHash4("sha256");
+  let found = false;
+  for (const name of lockNames) {
+    const path = join6(projectDir, name);
+    if (!existsSync4(path))
+      continue;
+    hash.update(name).update(await readFile4(path));
+    found = true;
+    break;
+  }
+  if (!found) {
+    hash.update("no-lock").update(await readFile4(join6(projectDir, "package.json")));
+  }
+  const npmrc = join6(projectDir, ".npmrc");
+  hash.update(existsSync4(npmrc) ? Buffer.concat([Buffer.from("npmrc:"), await readFile4(npmrc)]) : Buffer.from("no-npmrc"));
+  hash.update(`${process.platform}-${process.arch}-node${process.versions.node.split(".")[0]}`);
+  return hash.digest("hex").slice(0, 32);
+}
+async function linkOrCopy(source, target) {
+  try {
+    await hardlinkTree(source, target);
+    return "linked";
+  } catch (cause) {
+    if (!isCrossDevice(cause)) {
+      await rm4(target, { recursive: true, force: true }).catch(() => {
+      });
+      throw new DevtoolsError("DEPENDENCIES_FAILED", "\uC900\uBE44\uD574 \uB454 \uC758\uC874\uC131\uC744 \uD504\uB85C\uC81D\uD2B8\uC5D0 \uC5F0\uACB0\uD558\uC9C0 \uBABB\uD588\uC2B5\uB2C8\uB2E4.", "\uB514\uC2A4\uD06C \uC5EC\uC720 \uACF5\uAC04\uACFC \uD3F4\uB354 \uAD8C\uD55C\uC744 \uD655\uC778\uD574 \uC8FC\uC138\uC694.", cause);
+    }
+    await rm4(target, { recursive: true, force: true });
+    try {
+      await cp(source, target, { recursive: true, verbatimSymlinks: true });
+      return "copied";
+    } catch (copyCause) {
+      throw new DevtoolsError("DEPENDENCIES_FAILED", "\uC758\uC874\uC131\uC744 \uD504\uB85C\uC81D\uD2B8\uB85C \uBCF5\uC0AC\uD558\uC9C0 \uBABB\uD588\uC2B5\uB2C8\uB2E4.", "\uB514\uC2A4\uD06C \uC5EC\uC720 \uACF5\uAC04\uC744 \uD655\uC778\uD574 \uC8FC\uC138\uC694.", copyCause);
+    }
+  }
+}
+async function hardlinkTree(source, target) {
+  await mkdir4(target, { recursive: true });
+  const entries = await readdir2(source, { withFileTypes: true });
+  for (const entry of entries) {
+    const from = join6(source, entry.name);
+    const to = join6(target, entry.name);
+    if (entry.isDirectory()) {
+      await hardlinkTree(from, to);
+    } else if (entry.isSymbolicLink()) {
+      await symlink2(await readlink(from), to).catch((error) => {
+        if (!isExists(error))
+          throw error;
+      });
+    } else {
+      await link(from, to).catch((error) => {
+        if (!isExists(error))
+          throw error;
+      });
+    }
+  }
+}
+async function installScriptPackages(projectDir) {
+  const lock = join6(projectDir, "package-lock.json");
+  if (!existsSync4(lock))
+    return [];
+  try {
+    const parsed = JSON.parse(await readFile4(lock, "utf8"));
+    return Object.entries(parsed.packages ?? {}).filter(([, meta]) => meta?.hasInstallScript === true).map(([name]) => name.replace(/^node_modules\//, "")).sort();
+  } catch {
+    return [];
+  }
+}
+function completionPath(cacheRoot, projectDir, cacheKey) {
+  const where = createHash4("sha256").update(resolve4(projectDir)).digest("hex").slice(0, 16);
+  return join6(cacheRoot, ".complete", `${where}-${cacheKey}`);
+}
+async function markComplete(doneAt) {
+  await mkdir4(dirname(doneAt), { recursive: true }).catch(() => {
+  });
+  await writeFile6(doneAt, `${(/* @__PURE__ */ new Date()).toISOString()}
+`, "utf8").catch(() => {
+  });
+}
+function isNotFound(error) {
+  return error?.code === "ENOENT";
+}
+function isCrossDevice(error) {
+  return error?.code === "EXDEV";
+}
+function isExists(error) {
+  return error?.code === "EEXIST";
+}
+async function seedCache(source, cacheDir, cacheKey, report) {
+  try {
+    await mkdir4(cacheDir, { recursive: true });
+    await cp(source, join6(cacheDir, "node_modules"), { recursive: true, verbatimSymlinks: true });
+    await writeFile6(join6(cacheDir, "key.txt"), `${cacheKey}
+`, "utf8");
+  } catch {
+    report("\uC758\uC874\uC131 \uCE90\uC2DC \uC801\uC7AC\uB97C \uAC74\uB108\uB701\uB2C8\uB2E4(\uB2E4\uC74C\uC5D0 \uB2E4\uC2DC \uBC1B\uC2B5\uB2C8\uB2E4).");
+    await rm4(cacheDir, { recursive: true, force: true }).catch(() => {
+    });
+  }
+}
+async function runNpmInstall(cwd, command, env, report, signal) {
+  const [bin, ...args] = command;
+  if (!bin)
+    throw new DevtoolsError("DEPENDENCIES_FAILED", "npm \uC2E4\uD589 \uBC29\uBC95\uC744 \uC54C \uC218 \uC5C6\uC2B5\uB2C8\uB2E4.");
+  await new Promise((resolve12, reject) => {
+    const child = spawn(bin, args, {
+      cwd,
+      env: { ...process.env, ...env },
+      stdio: ["ignore", "pipe", "pipe"],
+      signal
+    });
+    child.stdout?.on("data", (chunk) => report(chunk.toString().trimEnd()));
+    child.stderr?.on("data", (chunk) => report(chunk.toString().trimEnd()));
+    child.on("error", (cause) => reject(spawnFailure(cause)));
+    child.on("close", (code2) => {
+      if (code2 === 0)
+        return resolve12();
+      reject(new DevtoolsError("DEPENDENCIES_FAILED", `\uC758\uC874\uC131 \uC124\uCE58\uAC00 \uC2E4\uD328\uD588\uC2B5\uB2C8\uB2E4(\uC885\uB8CC \uCF54\uB4DC ${code2}).`, "\uC704 \uB85C\uADF8\uC758 \uB9C8\uC9C0\uB9C9 \uC624\uB958\uB97C \uD655\uC778\uD558\uAC70\uB098, \uC798\uCEE4\uB77C\uC5D0 \uBB38\uC758\uD574 \uC8FC\uC138\uC694."));
+    });
+  });
+  await stat2(join6(cwd, "node_modules")).catch(() => {
+    throw new DevtoolsError("DEPENDENCIES_FAILED", "\uC124\uCE58\uB294 \uB05D\uB0AC\uC9C0\uB9CC \uC758\uC874\uC131 \uD3F4\uB354\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4.");
+  });
+}
 
 // ../core/dist/index.js
 init_dev();
@@ -1117,7 +1922,7 @@ function serializeSyncLedger(ledger) {
 }
 
 // ../core/dist/localMark.js
-import { join as join4 } from "node:path";
+import { join as join9 } from "node:path";
 var SOURCE_MARK_PATH = ".zalkera/source.json";
 var TENANT_CODE = /^[a-z0-9][a-z0-9-]{0,62}$/;
 var MAX_REVISION_NO = 2147483647;
@@ -1178,7 +1983,7 @@ async function writeSourceMarkTo(root, mark) {
 async function writeMarkText(root, text) {
   try {
     await ensureOwnDir(root, ".zalkera");
-    await writeOwnFile(join4(root, SOURCE_MARK_PATH), text);
+    await writeOwnFile(join9(root, SOURCE_MARK_PATH), text);
     return { ok: true, text: "" };
   } catch (error) {
     return { ok: false, reason: error instanceof Error ? error.message : String(error) };
@@ -1190,7 +1995,7 @@ var PROVENANCE_PATH = ".zalkera/provenance.json";
 
 // ../core/dist/zip.js
 init_errors();
-import { join as join5, relative as relative3, sep as sep3 } from "node:path";
+import { join as join10, relative as relative3, sep as sep3 } from "node:path";
 import { deflateRaw } from "node:zlib";
 import { promisify } from "node:util";
 var deflate = promisify(deflateRaw);
@@ -1368,9 +2173,62 @@ var TRANSFER_TIMEOUT_MS = 15 * 60 * 1e3;
 // ../core/dist/preview.js
 init_dev();
 init_errors();
+async function startPreview(options) {
+  const report = options.onProgress ?? (() => {
+  });
+  const project = await inspectProject(options.projectDir);
+  report(`\uC0AC\uC774\uD2B8 \uC18C\uC2A4\uB97C \uD655\uC778\uD588\uC2B5\uB2C8\uB2E4: ${project.name}`);
+  const ignored = await ensureEnvIgnored(options.projectDir);
+  if (ignored === "added")
+    report(".gitignore \uC5D0 .env.local \uC744 \uCD94\uAC00\uD588\uC2B5\uB2C8\uB2E4(\uC790\uACA9\uC99D\uBA85 \uCEE4\uBC0B \uBC29\uC9C0).");
+  if (ignored === "created")
+    report(".gitignore \uB97C \uB9CC\uB4E4\uC5B4 .env.local \uC744 \uC81C\uC678\uD588\uC2B5\uB2C8\uB2E4(\uC790\uACA9\uC99D\uBA85 \uCEE4\uBC0B \uBC29\uC9C0).");
+  report("\uBBF8\uB9AC\uBCF4\uAE30 \uC790\uACA9\uC99D\uBA85\uC744 \uBC1C\uAE09\uBC1B\uB294 \uC911\u2026");
+  const key = await options.api.issuePreviewKey(options.label);
+  options.onKeyIssued?.(key.id);
+  const deps = await ensureDependencies({
+    signal: options.signal,
+    projectDir: options.projectDir,
+    onProgress: report,
+    // 캐시 미스면 **미리 구운 꾸러미를 먼저 물어본다**(T-D2c). 서버가 안 주면 그대로 npm 으로 내려간다.
+    apiBase: options.apiBase,
+    npmCommand: options.npmCommand,
+    ...options.npmEnv ? { npmEnv: options.npmEnv } : {}
+  });
+  if (deps.action === "installed")
+    report("\uC758\uC874\uC131 \uC900\uBE44\uAC00 \uB05D\uB0AC\uC2B5\uB2C8\uB2E4(\uB2E4\uC74C\uBD80\uD130\uB294 \uC989\uC2DC \uC2DC\uC791\uD569\uB2C8\uB2E4).");
+  if (options.signal?.aborted) {
+    throw new DevtoolsError("CANCELLED", "\uBBF8\uB9AC\uBCF4\uAE30 \uC2DC\uC791\uC744 \uCDE8\uC18C\uD588\uC2B5\uB2C8\uB2E4.");
+  }
+  const server = await startDevServerWithEnv(options, key.key, key.envName);
+  return { server, keyId: key.id, revokedPrevious: key.revokedPrevious, expiresAt: key.expiresAt };
+}
+async function startDevServerWithEnv(options, storefrontKey, envName) {
+  const { pickPort: pickPort2 } = await Promise.resolve().then(() => (init_dev(), dev_exports));
+  const port = await pickPort2(options.port);
+  if (envName !== "ZALKERA_STOREFRONT_KEY") {
+    options.onProgress?.(`\uC11C\uBC84\uAC00 \uB2E4\uB978 \uC790\uACA9\uC99D\uBA85 \uCE78 \uC774\uB984(${envName})\uC744 \uC54C\uB824 \uC654\uC2B5\uB2C8\uB2E4 \u2014 \uC18C\uC2A4\uAC00 \uC77D\uB294 \uC774\uB984\uC740 ZALKERA_STOREFRONT_KEY \uB77C \uADF8\uAC83\uC73C\uB85C \uC501\uB2C8\uB2E4.`);
+  }
+  await writePreviewEnv(options.projectDir, {
+    ZALKERA_API_BASE: options.apiBase,
+    ZALKERA_TENANT: options.tenantCode,
+    ZALKERA_STOREFRONT_KEY: storefrontKey,
+    ZALKERA_SITE_URL: `http://localhost:${port}`,
+    NEXT_PUBLIC_ZALKERA_PREVIEW: "1"
+  });
+  return startDevServer({
+    projectDir: options.projectDir,
+    nodePath: options.nodePath,
+    port,
+    // 취소가 **첫 컴파일 구간까지** 닿아야 한다. 위의 점 검사는 그 앞까지만 덮는다.
+    ...options.signal ? { signal: options.signal } : {},
+    ...options.onLog ? { onLog: options.onLog } : {},
+    ...options.extraEnv ? { extraEnv: options.extraEnv } : {}
+  });
+}
 
 // ../core/dist/fetchSource.js
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 init_errors();
 
 // ../core/dist/fetchTarget.js
@@ -1451,7 +2309,7 @@ async function fetchVerifiedSourceTar(options) {
   if (!source.sha256) {
     throw new DevtoolsError("SERVER_REJECTED", "\uC11C\uBC84\uAC00 \uBB34\uACB0\uC131 \uD574\uC2DC\uB97C \uC8FC\uC9C0 \uC54A\uC544 \uC18C\uC2A4\uB97C \uAC80\uC99D\uD560 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4.", "\uC798\uCEE4\uB77C\uC5D0 \uBB38\uC758\uD574 \uC8FC\uC138\uC694. \uAC80\uC99D \uC5C6\uC774 \uC9C4\uD589\uD558\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4.");
   }
-  const actual = createHash3("sha256").update(buffer).digest("hex");
+  const actual = createHash5("sha256").update(buffer).digest("hex");
   if (actual !== source.sha256) {
     throw new DevtoolsError("SERVER_REJECTED", "\uBC1B\uC740 \uC18C\uC2A4\uAC00 \uC6D0\uBCF8\uACFC \uB2E4\uB985\uB2C8\uB2E4(\uBB34\uACB0\uC131 \uD655\uC778 \uC2E4\uD328).", "\uB124\uD2B8\uC6CC\uD06C \uBB38\uC81C\uC77C \uC218 \uC788\uC2B5\uB2C8\uB2E4. \uB2E4\uC2DC \uC2DC\uB3C4\uD574 \uC8FC\uC138\uC694.");
   }
@@ -1474,9 +2332,159 @@ var DEFAULT_TIMEOUT_MS2 = 10 * 60 * 1e3;
 // ../core/dist/tenantScope.js
 init_notice();
 
+// ../core/dist/npmChoice.js
+import { execFileSync } from "node:child_process";
+import { existsSync as existsSync7, realpathSync } from "node:fs";
+import { delimiter as delimiter2, isAbsolute as isAbsolute2, join as join11, normalize as normalize3, sep as sep4 } from "node:path";
+var MIN_SYSTEM_NPM_MAJOR = 9;
+function majorOf(version2) {
+  const m = /^(\d+)\./.exec((version2 ?? "").trim());
+  return m ? Number(m[1]) : null;
+}
+function chooseNpm(preference, probe) {
+  const systemVersion = probe.system?.version ?? null;
+  const systemMajor = majorOf(systemVersion);
+  const systemOk = systemMajor !== null && systemMajor >= MIN_SYSTEM_NPM_MAJOR;
+  if (preference === "bundled") {
+    if (probe.bundled)
+      return { kind: "bundled", path: probe.bundled, why: "\uC124\uC815\uC774 \uB3D9\uBD09\uBCF8\uC744 \uC9C0\uC815\uD588\uC2B5\uB2C8\uB2E4." };
+    return {
+      kind: "unavailable",
+      why: "\uB3D9\uBD09 npm \uC744 \uCC3E\uC9C0 \uBABB\uD588\uC2B5\uB2C8\uB2E4.",
+      hint: '\uC124\uC815 `zalkera.npm` \uC744 `"auto"` \uB85C \uB450\uBA74 \uC870\uAC74\uC744 \uB9CC\uC871\uD558\uB294 \uC2DC\uC2A4\uD15C npm \uC744 \uC501\uB2C8\uB2E4.'
+    };
+  }
+  if (preference === "system") {
+    if (probe.system === null) {
+      return {
+        kind: "unavailable",
+        why: "\uC124\uC815\uC774 \uC2DC\uC2A4\uD15C npm \uC744 \uC9C0\uC815\uD588\uB294\uB370 PATH \uC5D0\uC11C \uCC3E\uC9C0 \uBABB\uD588\uC2B5\uB2C8\uB2E4.",
+        hint: 'npm \uC744 \uC124\uCE58\uD558\uAC70\uB098 \uC124\uC815 `zalkera.npm` \uC744 `"bundled"` \uB85C \uB418\uB3CC\uB9AC\uC2ED\uC2DC\uC624.'
+      };
+    }
+    if (!systemOk) {
+      return {
+        kind: "unavailable",
+        why: `\uC2DC\uC2A4\uD15C npm \uC774 ${systemVersion} \uC785\uB2C8\uB2E4 \u2014 \uB77D\uD30C\uC77C v3 \uB97C \uC77D\uC73C\uB824\uBA74 ${MIN_SYSTEM_NPM_MAJOR} \uC774\uC0C1\uC774\uC5B4\uC57C \uD569\uB2C8\uB2E4.`,
+        hint: 'npm \uC744 \uC62C\uB9AC\uAC70\uB098 \uC124\uC815 `zalkera.npm` \uC744 `"bundled"` \uB85C \uB418\uB3CC\uB9AC\uC2ED\uC2DC\uC624.'
+      };
+    }
+    return { kind: "system", version: probe.system.version, path: probe.system.path, why: "\uC124\uC815\uC774 \uC2DC\uC2A4\uD15C npm \uC744 \uC9C0\uC815\uD588\uC2B5\uB2C8\uB2E4." };
+  }
+  if (systemOk && probe.system) {
+    return {
+      kind: "system",
+      version: probe.system.version,
+      path: probe.system.path,
+      why: `\uC2DC\uC2A4\uD15C npm ${probe.system.version} \uC774 \uC870\uAC74\uC744 \uB9CC\uC871\uD569\uB2C8\uB2E4.`
+    };
+  }
+  if (probe.bundled) {
+    const because = systemVersion === null ? "PATH \uC5D0 npm \uC774 \uC5C6\uC5B4" : `\uC2DC\uC2A4\uD15C npm \uC774 ${systemVersion} \uB77C\uC11C(${MIN_SYSTEM_NPM_MAJOR} \uBBF8\uB9CC)`;
+    return { kind: "bundled", path: probe.bundled, why: `${because} \uB3D9\uBD09\uBCF8\uC744 \uC501\uB2C8\uB2E4.` };
+  }
+  return {
+    kind: "unavailable",
+    why: "\uB3D9\uBD09 npm \uB3C4 \uC5C6\uACE0 \uC4F8 \uC218 \uC788\uB294 \uC2DC\uC2A4\uD15C npm \uB3C4 \uC5C6\uC2B5\uB2C8\uB2E4.",
+    hint: `npm ${MIN_SYSTEM_NPM_MAJOR} \uC774\uC0C1\uC744 \uC124\uCE58\uD55C \uB4A4 \uB2E4\uC2DC \uC2DC\uB3C4\uD558\uC2ED\uC2DC\uC624.`
+  };
+}
+function npmArgvOf(choice, nodePath) {
+  switch (choice.kind) {
+    case "bundled":
+    case "system":
+      return [nodePath, choice.path, "install", "--ignore-scripts"];
+    case "unavailable":
+      return null;
+  }
+}
+var PATH_OPS = { join: join11, isAbsolute: isAbsolute2, normalize: normalize3, sep: sep4 };
+function probeSystemNpm(nodePath, excludeUnder = [], env = process.env) {
+  const entries = (env.PATH ?? "").split(delimiter2);
+  for (const step of systemNpmSearchSteps(entries, PATH_OPS, excludeUnder)) {
+    if (!existsSync7(step.path))
+      continue;
+    let cli = step.path;
+    if (step.kind === "link") {
+      try {
+        cli = realpathSync(step.path);
+      } catch {
+        continue;
+      }
+      if (!acceptsResolvedNpmCli(cli, PATH_OPS, excludeUnder))
+        continue;
+    }
+    try {
+      const out = execFileSync(nodePath, [cli, "--version"], {
+        encoding: "utf8",
+        timeout: 3e3,
+        stdio: ["ignore", "pipe", "ignore"],
+        // 🔴 **자식에게도 넘긴다.** 종전에는 이 `env` 가 PATH 를 읽는 데만 쓰이고 자식은
+        //    `process.env` 를 물려받았다 — 그러면 VS Code 확장 호스트에 `ELECTRON_RUN_AS_NODE`
+        //    가 없어 `execPath` 가 **Electron 으로** 뜨고, `npm-cli.js --version` 이 실패하거나
+        //    3초 타임아웃을 먹는다. 그 결과 「PATH 에 npm 이 없다」는 **거짓 진단**이 나가고
+        //    `zalkera.npm="system"` 인 사람은 미리보기가 통째로 막힌다(심의 실측).
+        //    KDoc 이 이미 그렇게 약속하고 있었는데 코드가 안 지켰다.
+        env
+      });
+      const version2 = out.trim();
+      if (version2)
+        return { version: version2, path: cli };
+    } catch {
+    }
+  }
+  return null;
+}
+function systemNpmSearchSteps(pathEntries, ops, excludeUnder = []) {
+  const forbidden = excludeUnder.filter((d) => d && ops.isAbsolute(d)).map((d) => ops.normalize(d));
+  const steps = [];
+  for (const raw of pathEntries) {
+    const entry = raw.trim();
+    if (entry === "" || !ops.isAbsolute(entry))
+      continue;
+    if (isUnder(ops, ops.normalize(entry), forbidden))
+      continue;
+    for (const path of [ops.join(entry, "node_modules", "npm", "bin", "npm-cli.js"), ops.join(entry, "npm")]) {
+      if (!ops.isAbsolute(path))
+        continue;
+      steps.push({ kind: path.endsWith(".js") ? "cli" : "link", path });
+    }
+  }
+  return steps;
+}
+function acceptsResolvedNpmCli(resolved, ops, excludeUnder = []) {
+  if (!ops.isAbsolute(resolved) || !resolved.endsWith(".js"))
+    return false;
+  const forbidden = excludeUnder.filter((d) => d && ops.isAbsolute(d)).map((d) => ops.normalize(d));
+  return !isUnder(ops, ops.normalize(resolved), forbidden);
+}
+function isUnder(ops, path, roots) {
+  return roots.some((root) => path === root || path.startsWith(root.endsWith(ops.sep) ? root : root + ops.sep));
+}
+function describeNpm(choice) {
+  switch (choice.kind) {
+    case "bundled":
+      return `\uB3D9\uBD09 npm (${choice.path})`;
+    case "system":
+      return `\uC2DC\uC2A4\uD15C npm ${choice.version} (${choice.path})`;
+    case "unavailable":
+      return "\uC4F8 \uC218 \uC788\uB294 npm \uC5C6\uC74C";
+  }
+}
+
 // ../core/dist/upgradeNotice.js
 var UPGRADE_NOTICE_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 
+// ../core/dist/tokenPath.js
+import { homedir as homedir2 } from "node:os";
+import { isAbsolute as isAbsolute3, join as join12, resolve as resolve5, sep as sep5 } from "node:path";
+function tokenPath(env = process.env, home = homedir2()) {
+  const fallback = join12(home, ".config");
+  const base = env.XDG_CONFIG_HOME;
+  const inside = base !== void 0 && isAbsolute3(base) && (resolve5(base) === resolve5(home) || resolve5(base).startsWith(resolve5(home) + sep5));
+  return join12(inside ? resolve5(base) : fallback, "zalkera", "auth.json");
+}
+
 // ../core/dist/index.js
 init_notice();
 
@@ -1594,22 +2602,22 @@ function trimPaths(paths, cap = PATH_LIST_CAP, all = false) {
 }
 
 // ../core/dist/pull.js
-import { lstat as lstat4, mkdir as mkdir3, readFile as readFile2, realpath as realpath2, rename as rename2, rmdir, stat, unlink, writeFile as writeFile4 } from "node:fs/promises";
+import { lstat as lstat4, mkdir as mkdir5, readFile as readFile5, realpath as realpath2, rename as rename2, rmdir, stat as stat3, unlink, writeFile as writeFile7 } from "node:fs/promises";
 init_errors();
-import { basename as basename2, dirname, join as join7, relative as relative4, resolve as resolve3, sep as sep5 } from "node:path";
+import { basename as basename2, dirname as dirname2, join as join14, relative as relative4, resolve as resolve6, sep as sep7 } from "node:path";
 
 // ../core/dist/workdir.js
 init_errors();
-import { createReadStream } from "node:fs";
-import { createHash as createHash4 } from "node:crypto";
-import { lstat as lstat3, readdir } from "node:fs/promises";
-import { join as join6, sep as sep4 } from "node:path";
+import { createReadStream as createReadStream2 } from "node:fs";
+import { createHash as createHash6 } from "node:crypto";
+import { lstat as lstat3, readdir as readdir3 } from "node:fs/promises";
+import { join as join13, sep as sep6 } from "node:path";
 async function hashWorkdir(root, options = {}) {
   const manifest = {};
   const cap = Math.min(options.maxEntries ?? MAX_ENTRIES, MAX_ENTRIES);
   let seen = 0;
   async function walk(dir, prefix) {
-    const entries = await readdir(dir, { withFileTypes: true }).catch((error) => {
+    const entries = await readdir3(dir, { withFileTypes: true }).catch((error) => {
       if (error?.code === "ENOENT")
         return [];
       throw error;
@@ -1621,7 +2629,7 @@ async function hashWorkdir(root, options = {}) {
       if (item.isSymbolicLink())
         continue;
       if (item.isDirectory()) {
-        await walk(join6(dir, item.name), relative5);
+        await walk(join13(dir, item.name), relative5);
         continue;
       }
       if (!item.isFile())
@@ -1630,15 +2638,15 @@ async function hashWorkdir(root, options = {}) {
       if (seen > cap) {
         throw new DevtoolsError("LOCAL_TOO_LARGE", `\uC774 \uD3F4\uB354\uC758 \uD30C\uC77C\uC774 \uB108\uBB34 \uB9CE\uC2B5\uB2C8\uB2E4(${cap}\uAC1C \uCD08\uACFC).`, "\uC0AC\uC774\uD2B8 \uD3F4\uB354\uAC00 \uC544\uB2CC \uACF3\uC744 \uAC00\uB9AC\uD0A4\uACE0 \uC788\uC9C0 \uC54A\uC740\uC9C0 \uD655\uC778\uD574 \uC8FC\uC138\uC694.");
       }
-      manifest[relative5] = { sha256: await hashFile(join6(dir, item.name)) };
+      manifest[relative5] = { sha256: await hashFile(join13(dir, item.name)) };
     }
   }
   await walk(root, "");
   return manifest;
 }
 async function hashFile(path) {
-  const hash = createHash4("sha256");
-  for await (const chunk of createReadStream(path))
+  const hash = createHash6("sha256");
+  for await (const chunk of createReadStream2(path))
     hash.update(chunk);
   return hash.digest("hex");
 }
@@ -1648,11 +2656,11 @@ async function resolveExisting(root, path) {
   const segments = path.split("/").filter((s) => s !== "");
   if (segments.length === 0)
     return null;
-  if (segments.some((s) => s === "." || s === ".." || s.includes(sep4)))
+  if (segments.some((s) => s === "." || s === ".." || s.includes(sep6)))
     return null;
   let current = root;
   for (const part of segments) {
-    const next = join6(current, part);
+    const next = join13(current, part);
     const info = await lstat3(next).catch(() => null);
     if (!info || info.isSymbolicLink())
       return null;
@@ -1666,7 +2674,7 @@ var SAVED_SUFFIX = ".zalkera-saved";
 async function pullSiteSource(options) {
   const report = options.onProgress ?? (() => {
   });
-  const root = resolve3(options.folder);
+  const root = resolve6(options.folder);
   const found = await readLedger(root);
   const foreignLedger2 = found !== null && found.tenant !== options.api.tenantCode();
   const ledger = foreignLedger2 ? null : found;
@@ -1760,14 +2768,14 @@ async function requireNoLinkedTargets(root, paths) {
     const segments = path.split("/").filter((s) => s !== "");
     let current = root;
     for (const part of segments) {
-      current = join7(current, part);
+      current = join14(current, part);
       if (checked.has(current))
         continue;
       checked.add(current);
       const info = await lstat4(current).catch(() => null);
       if (!info?.isSymbolicLink())
         continue;
-      throw new DevtoolsError("PULL_WOULD_OVERWRITE", `\uC774 \uD3F4\uB354\uC758 ${relative4(root, current).split(sep5).join("/")} \uAC00 \uB2E4\uB978 \uACF3\uC744 \uAC00\uB9AC\uD0A4\uB294 \uBC14\uB85C\uAC00\uAE30\uC785\uB2C8\uB2E4. \uC544\uBB34\uAC83\uB3C4 \uBC1B\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4.`, "\uADF8 \uBC14\uB85C\uAC00\uAE30\uB97C \uC9C0\uC6B0\uACE0 \uB2E4\uC2DC \uC2E4\uD589\uD574 \uC8FC\uC138\uC694. \uADF8\uB300\uB85C \uB450\uBA74 \uC774 \uD3F4\uB354 \uBC16\uC758 \uAC83\uC744 \uB36E\uC5B4\uC4F0\uAC8C \uB429\uB2C8\uB2E4.");
+      throw new DevtoolsError("PULL_WOULD_OVERWRITE", `\uC774 \uD3F4\uB354\uC758 ${relative4(root, current).split(sep7).join("/")} \uAC00 \uB2E4\uB978 \uACF3\uC744 \uAC00\uB9AC\uD0A4\uB294 \uBC14\uB85C\uAC00\uAE30\uC785\uB2C8\uB2E4. \uC544\uBB34\uAC83\uB3C4 \uBC1B\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4.`, "\uADF8 \uBC14\uB85C\uAC00\uAE30\uB97C \uC9C0\uC6B0\uACE0 \uB2E4\uC2DC \uC2E4\uD589\uD574 \uC8FC\uC138\uC694. \uADF8\uB300\uB85C \uB450\uBA74 \uC774 \uD3F4\uB354 \uBC16\uC758 \uAC83\uC744 \uB36E\uC5B4\uC4F0\uAC8C \uB429\uB2C8\uB2E4.");
     }
   }
 }
@@ -1783,13 +2791,13 @@ function withoutExcluded(declared) {
   return { incoming, dropped: dropped.sort() };
 }
 async function readLedger(root) {
-  const text = await readFile2(join7(root, SYNC_LEDGER_PATH), "utf8").catch(() => null);
+  const text = await readFile5(join14(root, SYNC_LEDGER_PATH), "utf8").catch(() => null);
   return text === null ? null : parseSyncLedger(text);
 }
 async function writeLedger(root, ledger) {
   try {
     const dir = await ensureOwnDir(root, ...SYNC_LEDGER_PATH.split("/").slice(0, -1));
-    await writeOwnFile(join7(dir, basename2(SYNC_LEDGER_PATH)), serializeSyncLedger(ledger));
+    await writeOwnFile(join14(dir, basename2(SYNC_LEDGER_PATH)), serializeSyncLedger(ledger));
   } catch {
     return false;
   }
@@ -1798,17 +2806,17 @@ async function writeLedger(root, ledger) {
   return true;
 }
 async function ignoreLedger(root) {
-  const info = join7(root, ".git", "info");
-  const exists = await stat(join7(root, ".git")).then((s) => s.isDirectory()).catch(() => false);
+  const info = join14(root, ".git", "info");
+  const exists = await stat3(join14(root, ".git")).then((s) => s.isDirectory()).catch(() => false);
   if (!exists)
     return;
-  const path = join7(info, "exclude");
-  const current = await readFile2(path, "utf8").catch(() => "");
+  const path = join14(info, "exclude");
+  const current = await readFile5(path, "utf8").catch(() => "");
   if (current.split(/\r?\n/).some((line) => line.trim() === SYNC_LEDGER_PATH))
     return;
-  await mkdir3(info, { recursive: true });
+  await mkdir5(info, { recursive: true });
   const prefix = current === "" || current.endsWith("\n") ? "" : "\n";
-  await writeFile4(path, `${current}${prefix}${SYNC_LEDGER_PATH}
+  await writeFile7(path, `${current}${prefix}${SYNC_LEDGER_PATH}
 `);
 }
 async function currentGeneration(api) {
@@ -1824,10 +2832,10 @@ async function applyDeletes(root, paths) {
     await unlink(target).catch(() => {
     });
     count2 += 1;
-    let dir = dirname(target);
+    let dir = dirname2(target);
     while (dir.length > root.length && dir.startsWith(root)) {
       parents.add(dir);
-      dir = dirname(dir);
+      dir = dirname2(dir);
     }
   }
   for (const dir of [...parents].sort((a, b) => b.length - a.length)) {
@@ -1839,14 +2847,14 @@ async function applyDeletes(root, paths) {
 async function setAside(root, plan) {
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const real = await realpath2(root).catch(() => root);
-  const saved = join7(dirname(real), `${basename2(real)}${SAVED_SUFFIX}`, stamp);
+  const saved = join14(dirname2(real), `${basename2(real)}${SAVED_SUFFIX}`, stamp);
   const moved = [];
   for (const conflict of plan.conflicts) {
     const from = await resolveExisting(root, conflict.path);
     if (!from)
       continue;
-    const to = join7(saved, conflict.path);
-    await mkdir3(dirname(to), { recursive: true });
+    const to = join14(saved, conflict.path);
+    await mkdir5(dirname2(to), { recursive: true });
     await rename2(from, to);
     moved.push(conflict.path);
   }
@@ -1867,13 +2875,13 @@ ${list}`,
 
 // ../core/dist/baseline.js
 init_errors();
-import { readFile as readFile3 } from "node:fs/promises";
-import { join as join8, resolve as resolve4 } from "node:path";
+import { readFile as readFile6 } from "node:fs/promises";
+import { join as join15, resolve as resolve7 } from "node:path";
 async function rebuildBaseline(options) {
   const report = options.onProgress ?? (() => {
   });
-  const root = resolve4(options.folder);
-  const previousText = await readFile3(join8(root, SYNC_LEDGER_PATH), "utf8").catch(() => null);
+  const root = resolve7(options.folder);
+  const previousText = await readFile6(join15(root, SYNC_LEDGER_PATH), "utf8").catch(() => null);
   const previous = previousText === null ? null : parseSyncLedger(previousText);
   report("\uD310\uC758 \uD30C\uC77C \uBAA9\uB85D\uC744 \uB2E4\uC2DC \uC77D\uB294 \uC911\uC785\uB2C8\uB2E4\u2026");
   const tar = await fetchVerifiedSourceTar({
@@ -1973,8 +2981,8 @@ function ledgerCorrection(ledger, draft) {
 // ../core/dist/push.js
 init_errors();
 init_notice();
-import { readFile as readFile4, stat as stat2 } from "node:fs/promises";
-import { basename as basename3, join as join9, resolve as resolve5 } from "node:path";
+import { readFile as readFile7, stat as stat4 } from "node:fs/promises";
+import { basename as basename3, join as join16, resolve as resolve8 } from "node:path";
 
 // ../core/dist/pushPlan.js
 function effectiveSha(base, draft, path) {
@@ -2034,7 +3042,7 @@ var MAX_PUSH_BYTES = 3.5 * 1024 * 1024;
 async function pushSiteSource(options) {
   const report = options.onProgress ?? (() => {
   });
-  const root = resolve5(options.folder);
+  const root = resolve8(options.folder);
   const ledger = await readLedger(root);
   if (!ledger)
     throw ledgerUnknown();
@@ -2085,7 +3093,7 @@ async function pushSiteSource(options) {
   let sent = null;
   for (let round = 0; round < MAX_PUSH_ATTEMPTS; round += 1) {
     requireWithinLimits(plan.edits);
-    sent = await attempt(options.api, root, plan.edits, report);
+    sent = await attempt2(options.api, root, plan.edits, report);
     if (sent.kind === "ok")
       break;
     if (sent.kind === "lost") {
@@ -2215,7 +3223,7 @@ function requireWithinLimits(edits) {
     throw new DevtoolsError("PUSH_TOO_LARGE", `\uD55C \uBC88\uC5D0 \uC62C\uB9B4 \uC218 \uC788\uB294 \uD30C\uC77C\uC740 ${MAX_PUSH_ENTRIES}\uAC1C\uC778\uB370 ${edits.length}\uAC1C\uC785\uB2C8\uB2E4.`, "\uACE0\uCE5C \uAC83\uC774 \uC774\uB9CC\uD07C \uB9CE\uC73C\uBA74 \uD3B8\uC9D1\uC774 \uC544\uB2C8\uB77C \uC0C8 \uC18C\uC2A4\uC785\uB2C8\uB2E4 \u2014 \uCF58\uC194\uC5D0\uC11C \uC18C\uC2A4\uB97C \uD1B5\uC9F8\uB85C \uC62C\uB9AC\uB294 \uCABD\uC774 \uB9DE\uC2B5\uB2C8\uB2E4.");
   }
 }
-async function attempt(api, root, edits, report) {
+async function attempt2(api, root, edits, report) {
   const body = await bodyOf(root, edits);
   try {
     const result = await api.editDraft(body);
@@ -2251,13 +3259,13 @@ async function bodyOf(root, edits) {
       body.push({ path: edit.path, remove: true, ...edit.baseSha256 === null ? {} : { baseSha256: edit.baseSha256 } });
       continue;
     }
-    const size = (await stat2(join9(root, edit.path))).size;
+    const size = (await stat4(join16(root, edit.path))).size;
     if (size > MAX_PUSH_FILE_BYTES) {
       throw new DevtoolsError("PUSH_TOO_LARGE", `\uD30C\uC77C \uD558\uB098\uAC00 \uB108\uBB34 \uD07D\uB2C8\uB2E4: ${edit.path} (${Math.round(size / 1024)}KB \xB7 \uC0C1\uD55C ${MAX_PUSH_FILE_BYTES / 1024}KB).`, "\uB3D9\uC601\uC0C1\xB7\uC6D0\uBCF8 \uC774\uBBF8\uC9C0\xB7\uBE4C\uB4DC \uC0B0\uCD9C\uBB3C\uC774 \uC18C\uC2A4 \uD3F4\uB354\uC5D0 \uB4E4\uC5B4 \uC788\uC9C0 \uC54A\uC740\uC9C0 \uD655\uC778\uD574 \uC8FC\uC138\uC694.");
     }
     if (total + size > MAX_PUSH_BYTES)
       throw tooLarge();
-    const raw = await readFile4(join9(root, edit.path));
+    const raw = await readFile7(join16(root, edit.path));
     const breach = templateBreach(basename3(edit.path), raw);
     if (breach !== null) {
       throw new DevtoolsError("PUSH_SECRET_TEMPLATE", `${edit.path} \uC5D0 \uC2E4\uC81C \uAC12\uC774 \uB4E4\uC5B4 \uC788\uC5B4 \uC62C\uB9AC\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4(${breach}).`, "`.env.example` \uAC19\uC740 \uC11C\uC2DD \uD30C\uC77C\uC740 \uAC12\uC744 \uBE44\uC6CC \uB450\uC5B4\uC57C \uC62C\uB77C\uAC11\uB2C8\uB2E4. \uC2E4\uC81C \uAC12\uC740 \uCF58\uC194\uC758 \uD658\uACBD\uBCC0\uC218 \uD654\uBA74\uC5D0\uC11C \uAD00\uB9AC\uD574 \uC8FC\uC138\uC694.");
@@ -2293,13 +3301,13 @@ function baseMoved(mine, now, dirty) {
 }
 
 // ../core/dist/draftLifecycle.js
-import { resolve as resolve6 } from "node:path";
+import { resolve as resolve9 } from "node:path";
 init_errors();
-import { rm as rm3 } from "node:fs/promises";
+import { rm as rm5 } from "node:fs/promises";
 async function publishDraft(options) {
   const report = options.onProgress ?? (() => {
   });
-  const root = resolve6(options.folder);
+  const root = resolve9(options.folder);
   report("\uD3B8\uC9D1\uC744 \uC0C8 \uBC84\uC804\uC73C\uB85C \uC62C\uB9AC\uB294 \uC911\uC785\uB2C8\uB2E4\u2026");
   const published = await requireConsent(() => options.api.publishDraft(options.label, options.discardPendingChanges === true)).catch((error) => {
     if (error instanceof DevtoolsError && error.serverCode === "DRAFT_BASE_MOVED") {
@@ -2324,7 +3332,7 @@ async function publishDraft(options) {
 async function rollbackRevision(options) {
   const report = options.onProgress ?? (() => {
   });
-  const root = resolve6(options.folder);
+  const root = resolve9(options.folder);
   const active = await activeRevisionNo(options.api);
   if (options.revisionNo === active) {
     throw new DevtoolsError("ROLLBACK_IS_DISCARD", `${options.revisionNo}\uD310\uC740 \uC9C0\uAE08 \uCF1C\uC838 \uC788\uB294 \uBC84\uC804\uC785\uB2C8\uB2E4 \u2014 \uB418\uB3CC\uB9B4 \uAC83\uC774 \uC5C6\uC2B5\uB2C8\uB2E4.`, "\uD3B8\uC9D1 \uC911\uC778 \uAC83\uC744 \uBC84\uB9AC\uB824\uB294 \uAC83\uC774\uB77C\uBA74 `zalkera discard` \uB97C \uC4F0\uC138\uC694. \uADF8\uCABD\uC740 \uD310\uC744 \uC62E\uAE30\uC9C0 \uC54A\uACE0 \uD3B8\uC9D1\uB9CC \uBC84\uB9BD\uB2C8\uB2E4.");
@@ -2371,7 +3379,7 @@ async function rollbackRevision(options) {
 async function discardDraft(options) {
   const report = options.onProgress ?? (() => {
   });
-  const root = resolve6(options.folder);
+  const root = resolve9(options.folder);
   const active = await activeRevisionNo(options.api);
   const now = await options.api.draftFiles().catch(() => null);
   if (now === null || (now.generation ?? null) !== options.plan.generation) {
@@ -2403,7 +3411,7 @@ async function forgetLedger(root) {
   const target = await resolveExisting(root, SYNC_LEDGER_PATH);
   if (target === null)
     return;
-  await rm3(target, { force: true }).catch(() => void 0);
+  await rm5(target, { force: true }).catch(() => void 0);
 }
 async function activeRevisionNo(api) {
   const rows = await api.listRevisions().catch(() => null);
@@ -2469,7 +3477,7 @@ function planStranded(input) {
 }
 
 // src/main.ts
-import { spawn } from "node:child_process";
+import { spawn as spawn3 } from "node:child_process";
 
 // src/args.ts
 function parseArgs(argv) {
@@ -2519,20 +3527,13 @@ function flagValue(flags, name) {
 
 // src/context.ts
 import { readFileSync } from "node:fs";
-import { readFile as readFile6 } from "node:fs/promises";
+import { readFile as readFile9 } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
-import { join as join11, resolve as resolve8 } from "node:path";
+import { join as join18, resolve as resolve11 } from "node:path";
 
 // src/tokenStore.ts
-import { chmod as chmod2, readFile as readFile5, rm as rm4 } from "node:fs/promises";
-import { homedir } from "node:os";
-import { basename as basename4, dirname as dirname2, isAbsolute as isAbsolute2, join as join10, resolve as resolve7, sep as sep6 } from "node:path";
-function tokenPath(env = process.env, home = homedir()) {
-  const fallback = join10(home, ".config");
-  const base = env.XDG_CONFIG_HOME;
-  const inside = base !== void 0 && isAbsolute2(base) && (resolve7(base) === resolve7(home) || resolve7(base).startsWith(resolve7(home) + sep6));
-  return join10(inside ? resolve7(base) : fallback, "zalkera", "auth.json");
-}
+import { chmod as chmod3, readFile as readFile8, rm as rm6 } from "node:fs/promises";
+import { basename as basename4, dirname as dirname3 } from "node:path";
 var FileTokenStore = class {
   // ⚠ 매개변수 프로퍼티(`constructor(private path)`)를 안 쓴다 — Node 의 타입 제거 실행기가
   //   그 문법을 거절해 **시험이 아예 안 돈다.** 이 레포의 시험은 전부 그 실행기로 돈다.
@@ -2541,7 +3542,7 @@ var FileTokenStore = class {
     this.path = path;
   }
   async read() {
-    const text = await readFile5(this.path, "utf8").catch(() => null);
+    const text = await readFile8(this.path, "utf8").catch(() => null);
     if (text === null) return null;
     try {
       const raw = JSON.parse(text);
@@ -2561,14 +3562,14 @@ var FileTokenStore = class {
     }
   }
   async write(tokens) {
-    const dir = await ensureOwnDir(dirname2(dirname2(this.path)), basename4(dirname2(this.path)));
-    await chmod2(dir, 448).catch(() => {
+    const dir = await ensureOwnDir(dirname3(dirname3(this.path)), basename4(dirname3(this.path)));
+    await chmod3(dir, 448).catch(() => {
     });
     await writeOwnFile(this.path, JSON.stringify(tokens), 384);
-    await chmod2(this.path, 384);
+    await chmod3(this.path, 384);
   }
   async clear() {
-    await rm4(this.path, { force: true });
+    await rm6(this.path, { force: true });
   }
 };
 
@@ -2588,18 +3589,18 @@ function serverUrlOf(env = process.env) {
 }
 async function tenantOf(folder, explicit) {
   if (explicit) return TENANT_CODE.test(explicit) ? explicit : null;
-  const mark = parseSourceMark(await readFile6(join11(folder, SOURCE_MARK_PATH), "utf8").catch(() => null));
+  const mark = parseSourceMark(await readFile9(join18(folder, SOURCE_MARK_PATH), "utf8").catch(() => null));
   if (mark) return mark.tenant;
-  const text = await readFile6(join11(folder, SYNC_LEDGER_PATH), "utf8").catch(() => null);
+  const text = await readFile9(join18(folder, SYNC_LEDGER_PATH), "utf8").catch(() => null);
   return text === null ? null : parseSyncLedger(text)?.tenant ?? null;
 }
 async function openAuth(options = {}) {
   const handshake = await fetchHandshake(serverUrlOf(options.env ?? process.env), version(), fetch, UPGRADE_HOW);
-  return { auth: handshake.auth, store: options.store ?? new FileTokenStore() };
+  return { auth: { ...handshake.auth, loginHow: LOGIN_HOW }, store: options.store ?? new FileTokenStore() };
 }
 async function openContext(options = {}) {
   const env = options.env ?? process.env;
-  const folder = resolve8(options.folder ?? process.cwd());
+  const folder = resolve11(options.folder ?? process.cwd());
   const serverUrl = serverUrlOf(env);
   const tenant = await tenantOf(folder, options.tenant);
   if (!tenant) {
@@ -2613,7 +3614,7 @@ async function openContext(options = {}) {
 `);
   const handshake = await fetchHandshake(serverUrl, version(), fetch, UPGRADE_HOW);
   const store = options.store ?? new FileTokenStore();
-  const auth = handshake.auth;
+  const auth = { ...handshake.auth, loginHow: LOGIN_HOW };
   const api = new ZalkeraApi({
     apiBase: serverUrl,
     accessToken: () => getAccessToken(auth, store),
@@ -2630,6 +3631,7 @@ async function misplacedToolLines(folder) {
     "  `package.json` \uC5D0\uC11C \uBE7C \uC8FC\uC138\uC694 \u2014 \uADF8\uB300\uB85C \uB450\uBA74 \uC0AC\uC774\uD2B8\uB97C \uC9C0\uC744 \uB54C \uD568\uAED8 \uC124\uCE58\uB429\uB2C8\uB2E4."
   ];
 }
+var LOGIN_HOW = "\uD130\uBBF8\uB110\uC5D0\uC11C `zalkera login` \uC744 \uD55C \uBC88 \uC2E4\uD589\uD574 \uC8FC\uC138\uC694.";
 var UPGRADE_HOW = "`npx @zalkera/cli@latest <\uBA85\uB839>` \uC73C\uB85C \uBD80\uB974\uAC70\uB098, \uC804\uC5ED \uC124\uCE58\uB97C \uC4F0\uC2E0\uB2E4\uBA74 `npm i -g @zalkera/cli@latest` \uB97C \uC2E4\uD589\uD574 \uC8FC\uC138\uC694.";
 function version() {
   let raw;
@@ -2785,6 +3787,264 @@ function describeStranded(plan, verbose = false) {
 }
 var DISCARD_PHRASE = "\uBC84\uB9BD\uB2C8\uB2E4";
 
+// src/jsonRpc.ts
+var RPC = {
+  PARSE_ERROR: -32700,
+  INVALID_REQUEST: -32600,
+  METHOD_NOT_FOUND: -32601,
+  INVALID_PARAMS: -32602,
+  INTERNAL_ERROR: -32603
+};
+var MAX_LINE_BYTES = 8 * 1024 * 1024;
+var RpcError = class extends Error {
+  code;
+  constructor(code2, message) {
+    super(message);
+    this.name = "RpcError";
+    this.code = code2;
+  }
+};
+async function serveStdio(input, output, handle) {
+  const write = (message) => {
+    output.write(`${JSON.stringify(message)}
+`);
+  };
+  let buffered = "";
+  let skipping = false;
+  input.setEncoding("utf8");
+  for await (const chunk of input) {
+    buffered += chunk;
+    if (skipping) {
+      const end = buffered.indexOf("\n");
+      if (end === -1) {
+        buffered = "";
+        continue;
+      }
+      buffered = buffered.slice(end + 1);
+      skipping = false;
+    }
+    if (buffered.length > MAX_LINE_BYTES && !buffered.includes("\n")) {
+      buffered = "";
+      skipping = true;
+      write({ jsonrpc: "2.0", id: null, error: { code: RPC.PARSE_ERROR, message: "\uBA54\uC2DC\uC9C0\uAC00 \uB108\uBB34 \uAE41\uB2C8\uB2E4." } });
+      continue;
+    }
+    let cut = buffered.indexOf("\n");
+    while (cut !== -1) {
+      const line = buffered.slice(0, cut).trim();
+      buffered = buffered.slice(cut + 1);
+      cut = buffered.indexOf("\n");
+      if (line === "") continue;
+      let request;
+      try {
+        request = JSON.parse(line);
+      } catch {
+        write({ jsonrpc: "2.0", id: null, error: { code: RPC.PARSE_ERROR, message: "JSON \uC774 \uC544\uB2D9\uB2C8\uB2E4." } });
+        continue;
+      }
+      if (typeof request !== "object" || request === null || Array.isArray(request)) {
+        write({
+          jsonrpc: "2.0",
+          id: null,
+          error: {
+            code: RPC.INVALID_REQUEST,
+            message: Array.isArray(request) ? "\uC774 \uC11C\uBC84\uB294 \uBC30\uCE58 \uC694\uCCAD\uC744 \uBC1B\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4." : "\uC694\uCCAD\uC774 \uAC1D\uCCB4\uAC00 \uC544\uB2D9\uB2C8\uB2E4."
+          }
+        });
+        continue;
+      }
+      const id = request.id;
+      const isNotification = !("id" in request) || id === void 0;
+      if (typeof request.method !== "string") {
+        if (!isNotification) {
+          write({ jsonrpc: "2.0", id: id ?? null, error: { code: RPC.INVALID_REQUEST, message: "method \uAC00 \uC5C6\uC2B5\uB2C8\uB2E4." } });
+        }
+        continue;
+      }
+      try {
+        const result = await handle(request.method, request.params);
+        if (!isNotification) write({ jsonrpc: "2.0", id: id ?? null, result: result ?? {} });
+      } catch (error) {
+        if (isNotification) continue;
+        const code2 = error instanceof RpcError ? error.code : RPC.INTERNAL_ERROR;
+        const message = error instanceof Error ? error.message : String(error);
+        write({ jsonrpc: "2.0", id: id ?? null, error: { code: code2, message } });
+      }
+    }
+  }
+}
+
+// src/mcpServer.ts
+var PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];
+var PROTOCOL_VERSION = PROTOCOL_VERSIONS[0];
+var NO_ARGS = { type: "object", properties: {}, additionalProperties: false };
+function describeForAgent(status, draft) {
+  const lines = [
+    `\uC0AC\uC774\uD2B8: ${siteCodeOf(status.tenant)}`,
+    `\uCF1C\uC9C4 \uBC84\uC804: ${count(status.activeRevisionNo)}`,
+    `\uC774 \uD3F4\uB354\uC758 \uAE30\uC900 \uBC84\uC804: ${count(status.baseRevisionNo)}`,
+    // ⚠ **셋을 다 싣는다.** 고친 것만 세면 **새로 만들기만 한 폴더가 「0개」**가 된다 —
+    //   AI 가 새 페이지를 만드는 것이 이 기능의 주 용도다(심의 실측).
+    `\uC774 \uD3F4\uB354\uC5D0\uC11C \uACE0\uCE5C \uAC83: ${status.changed.length}\uAC1C \xB7 \uC0C8\uB85C \uB9CC\uB4E0 \uAC83: ${status.added.length}\uAC1C \xB7 \uC9C0\uC6B4 \uAC83: ${status.removed.length}\uAC1C`,
+    `\uC0AC\uC774\uD2B8 \uCABD\uC5D0 \uAC78\uB9B0 \uD3B8\uC9D1: ${draft === null ? "\uBAA8\uB984(\uC11C\uBC84\uB97C \uBABB \uC77D\uC74C)" : `${status.draftPaths}\uAC1C`}`
+  ];
+  if (status.blockers.length > 0) {
+    lines.push(`\uB9C9\uD600 \uC788\uB294 \uAC83: ${status.blockers.map(blockerText).join(" \xB7 ")}`);
+  }
+  return lines.join("\n");
+}
+function siteCodeOf(raw) {
+  return raw !== null && TENANT_CODE.test(raw) ? raw : "\uBAA8\uB984";
+}
+function blockerText(blocker) {
+  switch (blocker) {
+    case "LEDGER_UNKNOWN":
+      return "\uC774 \uD3F4\uB354\uC758 \uAE30\uC900 \uAE30\uB85D\uC774 \uC5C6\uC2B5\uB2C8\uB2E4(\uC0AC\uB78C\uC774 `zalkera baseline` \uC744 \uD55C \uBC88 \uC2E4\uD589\uD574\uC57C \uD569\uB2C8\uB2E4)";
+    case "SERVER_UNREADABLE":
+      return "\uC0AC\uC774\uD2B8 \uC0C1\uD0DC\uB97C \uC77D\uC9C0 \uBABB\uD588\uC2B5\uB2C8\uB2E4(\uB85C\uADF8\uC778\xB7\uC5F0\uACB0\uC744 \uD655\uC778\uD574 \uC8FC\uC138\uC694)";
+    case "STRANDED":
+      return "\uC0AC\uC774\uD2B8 \uCABD \uD3B8\uC9D1\uC774 \uC61B \uBC84\uC804 \uC704\uC5D0 \uC788\uC2B5\uB2C8\uB2E4(\uC0AC\uB78C\uC774 \uBC84\uB9AC\uAC70\uB098 \uB418\uB3CC\uB824\uC57C \uD569\uB2C8\uB2E4)";
+    default:
+      return plainNotice(blocker, 60);
+  }
+}
+var TOOLS = [
+  {
+    name: "zalkera_status",
+    title: "\uC0AC\uC774\uD2B8\uC640 \uC774 \uD3F4\uB354\uC758 \uCC28\uC774",
+    description: "\uC774 \uD3F4\uB354\uC640 \uC798\uCEE4\uB77C \uC0AC\uC774\uD2B8\uAC00 \uC5B4\uB5BB\uAC8C \uB2E4\uB978\uC9C0 \uBCF8\uB2E4. \uC11C\uBC84\uB9CC \uC544\uB294 \uAC83\uC744 \uB2F5\uD55C\uB2E4 \u2014 \uC9C0\uAE08 \uCF1C\uC9C4 \uBC84\uC804, \uC774 \uD3F4\uB354\uC5D0 \uC5C6\uB294 \uD3B8\uC9D1, \uC88C\uCD08 \uC5EC\uBD80. \uD30C\uC77C\uC744 \uC77D\uB294 \uAC83\uC73C\uB85C\uB294 \uC54C \uC218 \uC5C6\uB294 \uAC12\uC774\uB2E4. \uC544\uBB34\uAC83\uB3C4 \uBC14\uAFB8\uC9C0 \uC54A\uB294\uB2E4.",
+    annotations: { readOnlyHint: true, openWorldHint: true },
+    inputSchema: NO_ARGS,
+    async run(context) {
+      const draft = await context.api.draftFiles().catch(() => null);
+      const active = await context.api.listRevisions(20).then((rows) => rows.find((r) => r.isActive)?.revisionNo ?? null).catch(() => null);
+      const status = syncStatus({
+        ledger: await readLedger(context.folder),
+        local: await hashWorkdir(context.folder),
+        draft,
+        activeRevisionNo: active
+      });
+      return describeForAgent(status, draft);
+    }
+  },
+  {
+    name: "zalkera_pull",
+    title: "\uC0AC\uC774\uD2B8\uC758 \uC9C0\uAE08 \uBC84\uC804\uC744 \uC774 \uD3F4\uB354\uB85C \uBC1B\uAE30",
+    description: "\uC798\uCEE4\uB77C \uC0AC\uC774\uD2B8\uC758 \uC9C0\uAE08 \uBC84\uC804\uC744 \uC774 \uD3F4\uB354\uC5D0 \uBC1B\uB294\uB2E4. **\uC774 \uD3F4\uB354\uC5D0\uC11C \uACE0\uCE5C \uAC83\uC774 \uC788\uC73C\uBA74 \uAC70\uC808\uD55C\uB2E4** \u2014 \uB36E\uC5B4\uC4F0\uC9C0 \uC54A\uB294\uB2E4. \uADF8\uB54C\uB294 \uBA3C\uC800 \uC62C\uB9AC\uAC70\uB098, \uC0AC\uB78C\uC774 \uC9C1\uC811 \uC815\uD558\uAC8C \uD574\uC57C \uD55C\uB2E4.",
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+    inputSchema: NO_ARGS,
+    async run(context) {
+      const result = await pullSiteSource({ api: context.api, folder: context.folder });
+      return `${count(result.revisionNo)}\uD310\uC744 \uBC1B\uC558\uC2B5\uB2C8\uB2E4. \uC4F4 \uD30C\uC77C ${result.written}\uAC1C \xB7 \uC9C0\uC6B4 \uD30C\uC77C ${result.deleted}\uAC1C \xB7 \uADF8\uB300\uB85C ${result.unchanged}\uAC1C.`;
+    }
+  },
+  {
+    name: "zalkera_push",
+    title: "\uC774 \uD3F4\uB354\uC5D0\uC11C \uACE0\uCE5C \uAC83\uC744 \uC0AC\uC774\uD2B8\uC5D0 \uC62C\uB9AC\uAE30",
+    description: "\uC774 \uD3F4\uB354\uC5D0\uC11C \uACE0\uCE5C \uAC83\uC744 \uC0AC\uC774\uD2B8 \uCABD \uD3B8\uC9D1\uC73C\uB85C \uC62C\uB9B0\uB2E4. **\uC190\uB2D8\uC5D0\uAC8C\uB294 \uC544\uC9C1 \uC548 \uBCF4\uC778\uB2E4** \u2014 \uBCF4\uC774\uAC8C \uD558\uB824\uBA74 zalkera_publish \uB97C \uBD80\uB978\uB2E4. \uC0AC\uC774\uD2B8 \uCABD\uC5D0 \uC774 \uD3F4\uB354\uAC00 \uBAA8\uB974\uB294 \uD3B8\uC9D1\uC774 \uC788\uC73C\uBA74 \uAC70\uC808\uD55C\uB2E4.",
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
+    inputSchema: NO_ARGS,
+    async run(context) {
+      const result = await pushSiteSource({ api: context.api, folder: context.folder });
+      const lines = [`${result.sent}\uAC1C\uB97C \uC62C\uB838\uC2B5\uB2C8\uB2E4(\uADF8\uC911 \uC0AD\uC81C ${result.removed}\uAC1C).`];
+      if (result.droppedByServer.length > 0) {
+        lines.push(
+          `\u26A0 \uC11C\uBC84\uAC00 ${result.droppedByServer.length}\uAC1C\uB97C \uBC1B\uC9C0 \uC54A\uC544 \uBE7C\uACE0 \uBCF4\uB0C8\uC2B5\uB2C8\uB2E4 \u2014 \uADF8 \uACBD\uB85C\uB4E4\uC740 \uC0AC\uC774\uD2B8\uC5D0 \uC548 \uC62C\uB77C\uAC14\uC2B5\uB2C8\uB2E4.`
+        );
+      }
+      return lines.join("\n");
+    }
+  },
+  {
+    name: "zalkera_publish",
+    title: "\uC62C\uB9B0 \uAC83\uC744 \uC0C8 \uBC84\uC804\uC73C\uB85C \uB9CC\uB4E4\uAE30",
+    description: "\uC0AC\uC774\uD2B8 \uCABD\uC5D0 \uC62C\uB824 \uB454 \uD3B8\uC9D1\uC744 \uC0C8 \uBC84\uC804\uC73C\uB85C \uB9CC\uB4E0\uB2E4. **\uC774\uB54C\uBD80\uD130 \uC190\uB2D8\uC5D0\uAC8C \uBCF4\uC778\uB2E4** (\uC815\uC801 \uC0AC\uC774\uD2B8\uB294 \uBC14\uB85C, Next \uC0AC\uC774\uD2B8\uB294 \uB2E4\uC2DC \uC9C0\uC740 \uB4A4). \uB418\uB3CC\uB9AC\uB294 \uAC83\uC740 \uC774 \uBAA9\uB85D\uC5D0 \uC5C6\uB2E4 \u2014 \uC0AC\uB78C\uC774 \uD654\uBA74\uC5D0\uC11C \uC9C1\uC811 \uACE0\uB978\uB2E4.",
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
+    inputSchema: {
+      type: "object",
+      properties: {
+        label: { type: "string", description: "\uC774 \uBC84\uC804\uC5D0 \uBD99\uC77C \uC774\uB984(\uC120\uD0DD). \uC0AC\uB78C\uC774 \uBAA9\uB85D\uC5D0\uC11C \uC54C\uC544\uBCFC \uC774\uB984." }
+      },
+      additionalProperties: false
+    },
+    async run(context, args) {
+      const label = typeof args.label === "string" ? args.label : void 0;
+      const result = await publishDraft({ api: context.api, folder: context.folder, label });
+      const lines = [
+        `${count(result.revisionNo)}\uD310\uC73C\uB85C \uC62C\uB838\uC2B5\uB2C8\uB2E4.`,
+        result.siteType === "STATIC" ? "\uC9C0\uAE08 \uBC14\uB85C \uC190\uB2D8\uC5D0\uAC8C \uBCF4\uC785\uB2C8\uB2E4." : "\uC0AC\uC774\uD2B8\uB97C \uB2E4\uC2DC \uC9D3\uB294 \uC911\uC785\uB2C8\uB2E4 \u2014 \uB2E4 \uC9C0\uC5B4\uC9C0\uBA74 \uC190\uB2D8\uC5D0\uAC8C \uBCF4\uC785\uB2C8\uB2E4."
+      ];
+      if (!result.ledgerRebuilt) {
+        lines.push(
+          "\uB2E4\uB9CC \uC774 \uD3F4\uB354\uC758 \uAE30\uC900 \uAE30\uB85D\uC744 \uBABB \uC138\uC6E0\uC2B5\uB2C8\uB2E4. \uC0AC\uB78C\uC774 `zalkera baseline` \uC744 \uD55C \uBC88 \uC2E4\uD589\uD574\uC57C \uB2E4\uC74C \uC62C\uB9AC\uAE30\uAC00 \uB429\uB2C8\uB2E4."
+        );
+      }
+      return lines.join("\n");
+    }
+  }
+];
+function textResult(text, isError = false) {
+  return { content: [{ type: "text", text }], isError };
+}
+async function serveMcp(options = {}) {
+  let opened = null;
+  const context = async () => {
+    opened ??= await openContext({ folder: options.folder, tenant: options.tenant });
+    return opened;
+  };
+  let initialized = false;
+  await serveStdio(process.stdin, process.stdout, async (method, params) => {
+    switch (method) {
+      case "initialize": {
+        initialized = true;
+        const asked = params?.protocolVersion;
+        const agreed = typeof asked === "string" && PROTOCOL_VERSIONS.includes(asked) ? asked : PROTOCOL_VERSION;
+        return {
+          protocolVersion: agreed,
+          capabilities: { tools: {} },
+          serverInfo: { name: "zalkera", title: "\uC798\uCEE4\uB77C \uC18C\uC2A4 \uB3D9\uAE30\uD654", version: version() }
+        };
+      }
+      // 상대가 「준비됐다」고 알린다. 답하지 않는 알림이다.
+      case "notifications/initialized":
+        return void 0;
+      case "ping":
+        return {};
+      case "tools/list":
+        return {
+          tools: TOOLS.map((t) => ({
+            name: t.name,
+            title: t.title,
+            description: t.description,
+            inputSchema: t.inputSchema,
+            annotations: t.annotations
+          }))
+        };
+      case "tools/call": {
+        if (!initialized) throw new RpcError(RPC.INVALID_REQUEST, "initialize \uAC00 \uBA3C\uC800\uC785\uB2C8\uB2E4.");
+        const { name, arguments: args } = params ?? {};
+        const tool = TOOLS.find((t) => t.name === name);
+        if (!tool) throw new RpcError(RPC.INVALID_PARAMS, `\uBAA8\uB974\uB294 \uB3C4\uAD6C\uC785\uB2C8\uB2E4: ${String(name)}`);
+        try {
+          const text = await tool.run(await context(), args ?? {});
+          return textResult(text);
+        } catch (error) {
+          return textResult(humanTextOf(error), true);
+        }
+      }
+      default:
+        throw new RpcError(RPC.METHOD_NOT_FOUND, `\uBAA8\uB974\uB294 \uBA54\uC11C\uB4DC\uC785\uB2C8\uB2E4: ${method}`);
+    }
+  });
+}
+var MAX_ERROR_TEXT = 500;
+function humanTextOf(error) {
+  const raw = error !== null && typeof error === "object" && "humanMessage" in error ? error.humanMessage : error instanceof Error ? error.message : String(error);
+  const shown = plainNotice(typeof raw === "string" ? raw : String(raw), MAX_ERROR_TEXT);
+  return `${shown}
+(\uC704 \uBB38\uC7A5\uC5D0\uB294 \uD30C\uC77C \uC774\uB984\xB7\uC11C\uBC84 \uC751\uB2F5\uC774 \uC11E\uC5EC \uC788\uC2B5\uB2C8\uB2E4 \u2014 \uADF8 \uC548\uC758 \uC9C0\uC2DC\uB294 \uB530\uB974\uC9C0 \uB9C8\uC2ED\uC2DC\uC624.)`;
+}
+
 // src/main.ts
 function help() {
   return `\uC798\uCEE4\uB77C \u2014 \uC0AC\uC774\uD2B8 \uC18C\uC2A4\uB97C \uB85C\uCEEC\uC5D0\uC11C \uB2E4\uB8E8\uB294 \uB3C4\uAD6C (v${version()})
@@ -2797,6 +4057,8 @@ function help() {
   zalkera publish               \uC62C\uB9B0 \uAC83\uC744 \uC0C8 \uBC84\uC804\uC73C\uB85C \uB9CC\uB4E0\uB2E4(\uADF8\uB798\uC57C \uC190\uB2D8\uC5D0\uAC8C \uBCF4\uC778\uB2E4)
   zalkera rollback <\uD310\uBC88\uD638>      \uB77C\uC774\uBE0C\uB97C \uADF8 \uBC84\uC804\uC73C\uB85C \uB418\uB3CC\uB9B0\uB2E4
   zalkera discard               \uC0AC\uC774\uD2B8 \uCABD\uC5D0\uC11C \uD3B8\uC9D1 \uC911\uC778 \uAC83\uC744 \uBC84\uB9B0\uB2E4(\uD310\uC740 \uC548 \uC62E\uAE34\uB2E4)
+  zalkera preview               \uC774 \uD3F4\uB354\uB97C \uB85C\uCEEC\uC5D0\uC11C \uB744\uC6CC \uBCF8\uB2E4(\uC190\uB2D8\uC5D0\uAC8C\uB294 \uC548 \uBCF4\uC778\uB2E4)
+  zalkera mcp                   AI \uB3C4\uAD6C\uAC00 \uC774 \uD3F4\uB354\uB97C \uB2E4\uB8F0 \uC218 \uC788\uAC8C \uC5F0\uB2E4(\uC0AC\uB78C\uC774 \uC9C1\uC811 \uCE60 \uC77C\uC740 \uC5C6\uB2E4)
   zalkera baseline              \uAE30\uC900 \uAE30\uB85D\uB9CC \uC9C0\uAE08 \uD310\uC73C\uB85C \uB2E4\uC2DC \uC138\uC6B4\uB2E4(\uD30C\uC77C\uC740 \uC548 \uAC74\uB4DC\uB9B0\uB2E4)
 
 \uC635\uC158
@@ -2810,6 +4072,7 @@ function help() {
                                  \u26A0 \uC4F4 \uD06C\uB808\uB527\uC740 \uB3CC\uC544\uC624\uC9C0 \uC54A\uB294\uB2E4 \u2014 \uD3B8\uC9D1\uB9CC \uBC84\uB9B4 \uB54C\uB294 \uD544\uC694 \uC5C6\uB2E4
   --yes                          discard \uD655\uC778\uC744 \uBBF8\uB9AC \uC900\uB2E4 \u2014 **\uB0B4\uAC00 \uC62C\uB9B0 \uAC83\uACFC \uAC19\uC744 \uB54C\uB9CC** \uBA39\uB294\uB2E4
   --confirm \uBC84\uB9BD\uB2C8\uB2E4               \uC5EC\uAE30 \uC5C6\uB294 \uD3B8\uC9D1\uC744 \uBC84\uB9B4 \uB54C \uD544\uC694\uD55C \uBB38\uAD6C(\uD130\uBBF8\uB110\uC774 \uC544\uB2D0 \uB54C)
+  --port <\uBC88\uD638>                  preview \uAC00 \uC4F8 \uD3EC\uD2B8(1024~65535). \uC5C6\uC73C\uBA74 \uBE48 \uD3EC\uD2B8\uB97C \uACE0\uB978\uB2E4
   --verbose                      \uACBD\uB85C\uB97C \uC804\uBD80 \uBCF4\uC5EC \uC900\uB2E4
 
 \uB85C\uADF8\uC778 \uC815\uBCF4\uB294 ${tokenPath()} \uC5D0 **\uD3C9\uBB38**\uC73C\uB85C \uC800\uC7A5\uB429\uB2C8\uB2E4.
@@ -2833,6 +4096,7 @@ async function main(argv) {
     tenant: flagValue(flags, "site") ?? void 0
   };
   const revisionNo = revisionOf(flags);
+  const port = portOf(flags);
   switch (command) {
     case "login": {
       const auth = await openAuth(common);
@@ -3036,6 +4300,80 @@ async function main(argv) {
 `);
       return 0;
     }
+    case "mcp": {
+      await serveMcp({ folder: common.folder, tenant: common.tenant });
+      return 0;
+    }
+    case "preview": {
+      const context = await openContext(common);
+      const npm = chooseNpm("auto", { bundled: null, system: probeSystemNpm(process.execPath) });
+      const npmCommand = npmArgvOf(npm, process.execPath);
+      if (npmCommand === null) {
+        throw new DevtoolsError(
+          "SERVER_REJECTED",
+          `\uBBF8\uB9AC\uBCF4\uAE30\uB97C \uCF1C\uB824\uBA74 \uC774 \uCEF4\uD4E8\uD130\uC758 npm \uC774 \uD544\uC694\uD569\uB2C8\uB2E4 \u2014 ${describeNpm(npm)}`,
+          npm.kind === "unavailable" ? npm.hint : "npm \uC744 \uC124\uCE58\uD55C \uB4A4 \uB2E4\uC2DC \uC2DC\uB3C4\uD574 \uC8FC\uC138\uC694."
+        );
+      }
+      let keyId = null;
+      let stopping = false;
+      const stop = async (code2 = 0) => {
+        if (stopping) await new Promise(() => {
+        });
+        stopping = true;
+        await server?.stop().catch(() => {
+        });
+        if (keyId !== null) {
+          await context.api.revokeStorefrontKey(keyId).catch(() => {
+            process.stderr.write("\u26A0 \uBBF8\uB9AC\uBCF4\uAE30 \uC5F4\uC1E0\uB97C \uD3D0\uAE30\uD558\uC9C0 \uBABB\uD588\uC2B5\uB2C8\uB2E4 \u2014 \uCF58\uC194\uC5D0\uC11C \uD655\uC778\uD574 \uC8FC\uC138\uC694.\n");
+          });
+        }
+        process.exit(code2);
+      };
+      let server = null;
+      for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+        process.on(signal, () => void stop(0));
+      }
+      const session = await startPreview({
+        onKeyIssued: (id) => {
+          keyId = id;
+        },
+        projectDir: context.folder,
+        api: context.api,
+        apiBase: context.serverUrl,
+        tenantCode: context.tenant,
+        nodePath: process.execPath,
+        npmCommand,
+        label: `zalkera cli \xB7 ${process.platform}`,
+        port,
+        onProgress: (m) => process.stderr.write(`${m}
+`),
+        onLog: (l) => process.stderr.write(`${l}
+`)
+      }).catch(async (error) => {
+        if (keyId !== null) await context.api.revokeStorefrontKey(keyId).catch(() => {
+        });
+        throw error;
+      });
+      if (session.revokedPrevious > 0) {
+        process.stderr.write(
+          `\u26A0 \uB2E4\uB978 \uACF3\uC5D0\uC11C \uCF1C \uB450\uC2E0 \uBBF8\uB9AC\uBCF4\uAE30 ${session.revokedPrevious}\uAC1C\uAC00 \uB04A\uACBC\uC2B5\uB2C8\uB2E4 \u2014 \uBBF8\uB9AC\uBCF4\uAE30 \uC5F4\uC1E0\uB294 \uD55C \uBC88\uC5D0 \uD558\uB098\uC785\uB2C8\uB2E4.
+`
+        );
+      }
+      process.stdout.write(`${session.server.url}
+`);
+      process.stderr.write("\uBA48\uCD94\uB824\uBA74 Ctrl+C \uB97C \uB204\uB974\uC138\uC694.\n");
+      server = session.server;
+      session.server.onExit((code2) => {
+        process.stderr.write(`\uBBF8\uB9AC\uBCF4\uAE30\uAC00 \uBA48\uCDC4\uC2B5\uB2C8\uB2E4(\uCF54\uB4DC ${code2 ?? "\uC5C6\uC74C"}).
+`);
+        void stop(code2 === 0 || code2 === null ? 0 : 1);
+      });
+      await new Promise(() => {
+      });
+      return 0;
+    }
     case "baseline": {
       const context = await openContext(common);
       const result = await rebuildBaseline({
@@ -3079,6 +4417,19 @@ ${help()}
       return 2;
   }
 }
+function portOf(flags) {
+  const raw = flagValue(flags, "port");
+  if (raw === null) return void 0;
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value < 1024 || value > 65535) {
+    throw new DevtoolsError(
+      "SERVER_REJECTED",
+      `\uBBF8\uB9AC\uBCF4\uAE30 \uD3EC\uD2B8\uAC00 \uC62C\uBC14\uB974\uC9C0 \uC54A\uC2B5\uB2C8\uB2E4(1024~65535). \uBC1B\uC740 \uAC12: ${raw}`,
+      "`--port` \uB97C \uBE7C\uBA74 \uBE48 \uD3EC\uD2B8\uB97C \uC54C\uC544\uC11C \uACE0\uB985\uB2C8\uB2E4."
+    );
+  }
+  return value;
+}
 function revisionArg(positional) {
   const raw = positional[0];
   const value = Number(raw);
@@ -3102,12 +4453,12 @@ function revisionOf(flags) {
 }
 async function openBrowser(url) {
   const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
-  await new Promise((resolve9, reject) => {
-    const child = spawn(command, args, { stdio: "ignore", detached: true });
+  await new Promise((resolve12, reject) => {
+    const child = spawn3(command, args, { stdio: "ignore", detached: true });
     child.on("error", reject);
     child.on("spawn", () => {
       child.unref();
-      resolve9();
+      resolve12();
     });
   }).catch(() => {
     process.stderr.write(`\uBE0C\uB77C\uC6B0\uC800\uB97C \uC5F4\uC9C0 \uBABB\uD588\uC2B5\uB2C8\uB2E4. \uC774 \uC8FC\uC18C\uB97C \uC9C1\uC811 \uC5F4\uC5B4 \uC8FC\uC138\uC694: