infra-kit 0.1.132 → 0.1.134

package/dist/chunk-3OMHS5RE.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/lib/install-manager/install-manager.ts", "../src/lib/install-manager/safe-realpath.ts", "../src/lib/install-manager/npm-root.ts", "../src/lib/update-check/run-update-check.ts", "../src/lib/update-check/lock.ts", "../src/lib/update-check/registry.ts", "../src/lib/update-check/semver.ts", "../src/lib/update-check/update-cache.ts"],
+  "sourcesContent": ["/**\n * Pure detection of *how* this CLI was installed, so a self-update advisory can name the one command\n * that will actually work. No fs, no spawn, no `process.env` read \u2014 every input is injected, which is\n * what lets the whole matrix be table-tested.\n *\n * Detection is env-first and LAZY: the only signal that costs a subprocess (`npm root -g`) is passed in\n * as `lazyNpmRoot` and consulted solely when every cheaper matcher has missed.\n */\nimport path from 'node:path'\n\n/** The published package this CLI updates itself to. Single source for every suggested argv. */\nexport const PACKAGE_NAME = 'infra-kit'\n\nconst LATEST = `${PACKAGE_NAME}@latest`\n\nexport type InstallManager = 'npm' | 'pnpm' | 'yarn' | 'bun' | 'volta' | 'homebrew' | 'unknown'\n\nexport interface InstallManagerInfo {\n  manager: InstallManager\n  /** The command to run. Only safe to spawn ourselves when `canSelfSpawn`; otherwise print it. */\n  updateCommand: string[]\n  /** False when we must not run the command for the user \u2014 either it needs sudo/a tap, or we guessed. */\n  canSelfSpawn: boolean\n}\n\n/**\n * Canonicalises a candidate *root* directory. Required, not optional: `selfRealPath` has already had its\n * symlinks followed, so comparing it against a raw `PNPM_HOME`/`npm root -g`/`cwd` compares a resolved\n * path to an unresolved one and silently never matches. macOS is the everyday proof \u2014 `/var` is a symlink\n * to `/private/var`, so a global install under `/var/...` reports `unknown` unless both sides are resolved.\n * Callers inject the real thing; tests inject a stub.\n */\nexport type RealpathFn = (dir: string) => string\n\nexport interface DetectInstallManagerInput {\n  /** Fully-resolved (symlinks followed) path to this CLI's entry file. */\n  selfRealPath: string\n  env: NodeJS.ProcessEnv\n  /** Canonicalises each candidate root before comparison. See {@link RealpathFn}. */\n  realpath: RealpathFn\n  /** `npm root -g`, deferred: invoked at most once, and only when no cheaper matcher hit. */\n  lazyNpmRoot?: () => string | undefined\n}\n\n/**\n * Is `child` inside the `parent` subtree? Boundary-aware: a naive `startsWith` would call\n * `/Users/x/pnpm-ish` a child of `/Users/x/pnpm`. `parent` is canonicalised first because it arrives raw\n * from the environment while `child` is already a realpath.\n */\nconst isWithin = (parent: string, child: string, realpath: RealpathFn): boolean => {\n  const rel = path.relative(realpath(path.resolve(parent)), path.resolve(child))\n\n  return rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel)\n}\n\n/** Does `p` contain `name` as a whole path SEGMENT? `/a/node_modules_backup/b` must not match `node_modules`. */\nconst hasSegment = (p: string, name: string): boolean => {\n  return path.resolve(p).split(path.sep).includes(name)\n}\n\n/**\n * Is `p` inside a Homebrew keg belonging to the `name` FORMULA \u2014 i.e. `.../Cellar/<name>/<version>/...`?\n *\n * The formula name is what makes this sound. A bare `Cellar` segment says only \"somewhere under a keg\",\n * and the keg it lands in is routinely someone else's: when npm's global prefix is a node keg\n * (`npm config set prefix \"$(brew --prefix node)\"`, or any keg-only `node@X`), an `npm i -g` package\n * installs to `Cellar/node/<v>/lib/node_modules/<pkg>/...` \u2014 brew has never heard of it, yet the segment\n * is right there. Requiring `<name>` to sit directly after `Cellar` is what separates \"brew installed\n * THIS\" from \"brew installed the runtime that installed this\".\n *\n * Works for both keg layouts, since each is rooted at the formula: a plain formula\n * (`Cellar/infra-kit/1.2.3/bin/infra-kit`) and brew's node-CLI layout\n * (`Cellar/infra-kit/1.2.3/libexec/lib/node_modules/infra-kit/dist/cli.js`). Do NOT try to tell them\n * apart by excluding `node_modules` \u2014 the second one contains it.\n */\nconst isBrewKegOf = (p: string, name: string): boolean => {\n  const segments = path.resolve(p).split(path.sep)\n  const cellar = segments.indexOf('Cellar')\n\n  return cellar !== -1 && segments[cellar + 1] === name\n}\n\n/** `env[key]` names a directory that contains `selfRealPath`. Absent/empty env var \u2192 no match. */\nconst underEnvDir = (env: NodeJS.ProcessEnv, key: string, selfRealPath: string, realpath: RealpathFn): boolean => {\n  const dir = env[key]\n\n  return dir != null && dir !== '' && isWithin(dir, selfRealPath, realpath)\n}\n\ninterface Matcher extends Omit<InstallManagerInfo, 'manager'> {\n  manager: InstallManager\n  test: (input: Required<Pick<DetectInstallManagerInput, 'selfRealPath' | 'env' | 'realpath'>>) => boolean\n}\n\n/**\n * Ordered, first-hit-wins. Order matters: volta and homebrew wrap an npm-shaped layout, so they must be\n * consulted before the generic npm prefix matcher would claim them.\n */\nconst MATCHERS: Matcher[] = [\n  {\n    manager: 'volta',\n    // volta owns the shim; `volta install` is the correct tool, not a workaround \u2014 so we may run it.\n    test: ({ selfRealPath, env, realpath }) => {\n      return (\n        underEnvDir(env, 'VOLTA_HOME', selfRealPath, realpath) ||\n        hasSegment(selfRealPath, '.volta') ||\n        hasSegment(selfRealPath, 'volta')\n      )\n    },\n    updateCommand: ['volta', 'install', PACKAGE_NAME],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'homebrew',\n    // `brew upgrade` can touch the prefix, relink, and prompt \u2014 never ours to run unattended.\n    //\n    // Our own keg is the ONLY sound signal \u2014 see {@link isBrewKegOf}. Two broader tests look plausible\n    // and are both wrong, because each answers \"did brew put something here?\" when the question is \"does\n    // brew own THIS package?\":\n    //   - `HOMEBREW_PREFIX` containment: when node comes from brew, npm's global prefix IS\n    //     $HOMEBREW_PREFIX, so EVERY `npm i -g` package lands under it, unknown to brew.\n    //   - a bare `Cellar` segment: an npm prefix pointed at a node keg puts packages inside that keg.\n    // Either misfire tells macOS users to run `brew upgrade infra-kit` \u2014 a formula that does not exist \u2014\n    // and, far worse, makes the background auto-updater bail with `cannot-self-spawn` forever, so the\n    // very fix for it can never reach them. Detection runs on the realpath, and a linked brew bin always\n    // resolves into its own keg, so the narrow test has no false negatives to trade for this.\n    test: ({ selfRealPath }) => {\n      return isBrewKegOf(selfRealPath, PACKAGE_NAME)\n    },\n    updateCommand: ['brew', 'upgrade', PACKAGE_NAME],\n    canSelfSpawn: false,\n  },\n  {\n    manager: 'pnpm',\n    test: ({ selfRealPath, env, realpath }) => {\n      return (\n        underEnvDir(env, 'PNPM_HOME', selfRealPath, realpath) ||\n        (hasSegment(selfRealPath, 'pnpm') && hasSegment(selfRealPath, 'global'))\n      )\n    },\n    updateCommand: ['pnpm', 'add', '-g', LATEST],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'bun',\n    test: ({ selfRealPath, env, realpath }) => {\n      return underEnvDir(env, 'BUN_INSTALL', selfRealPath, realpath) || hasSegment(selfRealPath, '.bun')\n    },\n    updateCommand: ['bun', 'add', '-g', LATEST],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'yarn',\n    test: ({ selfRealPath }) => {\n      return (\n        hasSegment(selfRealPath, '.yarn') || (hasSegment(selfRealPath, 'yarn') && hasSegment(selfRealPath, 'global'))\n      )\n    },\n    updateCommand: ['yarn', 'global', 'add', LATEST],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'npm',\n    test: ({ selfRealPath, env, realpath }) => {\n      return underEnvDir(env, 'npm_config_prefix', selfRealPath, realpath)\n    },\n    updateCommand: ['npm', 'install', '-g', LATEST],\n    canSelfSpawn: true,\n  },\n]\n\nconst NPM_UPDATE_COMMAND = ['npm', 'install', '-g', LATEST]\n\n/**\n * Identify the package manager that owns `selfRealPath`.\n *\n * `lazyNpmRoot` is the fallback probe and is invoked at most once, only after every env/path matcher has\n * missed \u2014 a global `npm root -g` subprocess is never paid for a pnpm or volta install. When nothing\n * matches we report `unknown` with an npm command that is a *suggestion only* (`canSelfSpawn: false`):\n * running a guessed global install is worse than printing one.\n *\n * @example\n * detectInstallManager({ selfRealPath: '/Users/x/Library/pnpm/global/5/node_modules/infra-kit/dist/cli.js', env: {} })\n * // => { manager: 'pnpm', updateCommand: ['pnpm', 'add', '-g', 'infra-kit@latest'], canSelfSpawn: true }\n */\nexport const detectInstallManager = (input: DetectInstallManagerInput): InstallManagerInfo => {\n  const { selfRealPath, env, realpath, lazyNpmRoot } = input\n  const hit = MATCHERS.find(({ test }) => {\n    return test({ selfRealPath, env, realpath })\n  })\n\n  if (hit) return { manager: hit.manager, updateCommand: hit.updateCommand, canSelfSpawn: hit.canSelfSpawn }\n\n  const npmRoot = lazyNpmRoot?.()\n\n  if (npmRoot != null && npmRoot !== '' && isWithin(npmRoot, selfRealPath, realpath)) {\n    return { manager: 'npm', updateCommand: NPM_UPDATE_COMMAND, canSelfSpawn: true }\n  }\n\n  return { manager: 'unknown', updateCommand: NPM_UPDATE_COMMAND, canSelfSpawn: false }\n}\n\n/**\n * Is this CLI running from a *project-local* `node_modules` (as opposed to a global root)?\n *\n * The cwd clause is what does the distinguishing \u2014 BOTH a project install and a global root contain a\n * `/node_modules/` segment (`pnpm root -g` is `~/Library/pnpm/global/5/node_modules`). Without it we\n * would nag every global pnpm user to stop using a local install they do not have.\n *\n * Accepted false-negative: invoked from a subdirectory (cwd `project/apps/x`, deps at\n * `project/node_modules`) this returns false and the advisory stays silent. Under-warning is the safe\n * direction for a best-effort, never-throwing advisory \u2014 do not \"fix\" it by dropping the cwd clause.\n *\n * `cwd` is canonicalised before comparison for the same reason `detectInstallManager` canonicalises its\n * roots: `selfRealPath` is a realpath, and comparing it to an unresolved cwd never matches.\n *\n * @example\n * isLocalNodeModulesInstall('/repo/node_modules/infra-kit/dist/cli.js', '/repo', (p) => p) // => true\n */\nexport const isLocalNodeModulesInstall = (selfRealPath: string, cwd: string, realpath: RealpathFn): boolean => {\n  return hasSegment(selfRealPath, 'node_modules') && isWithin(cwd, selfRealPath, realpath)\n}\n", "import { realpathSync } from 'node:fs'\nimport path from 'node:path'\n\n/**\n * The impure companion to the pure detection module: canonicalise a directory that may not exist.\n *\n * `realpathSync` throws on a missing path, and candidate roots routinely miss \u2014 `PNPM_HOME` can point at a\n * directory the user never created, `npm root -g` can name a prefix that was removed. A throw there would\n * turn \"we could not identify your install\" into a crash, so an unresolvable path falls back to\n * `path.resolve`, which still normalises `.`/`..` and yields a usable, non-matching absolute path.\n */\nexport const safeRealpath = (dir: string): string => {\n  try {\n    return realpathSync(dir)\n  } catch {\n    return path.resolve(dir)\n  }\n}\n", "/* eslint-disable sonarjs/no-os-command-from-path */\n/**\n * `npm root -g`, the LAZY fallback for {@link detectInstallManager}.\n *\n * Why it is indispensable: the `npm` matcher keys off `npm_config_prefix`, which npm sets only while npm\n * itself is running. A user who ran `npm i -g infra-kit` months ago and now types `ik` has no such var,\n * so every cheap matcher misses and detection reports `unknown` / `canSelfSpawn: false`. Without this\n * probe the single most common install method can never update itself.\n *\n * Shared by `self-update` (interactive) and the background update worker so the two can never disagree\n * about who owns the install.\n */\nimport { execFileSync } from 'node:child_process'\nimport process from 'node:process'\n\nconst NPM_ROOT_TIMEOUT_MS = 3_000\n\n/**\n * The global npm root, or undefined when npm is absent, slow, or errors. Costs a subprocess, so\n * `detectInstallManager` invokes it at most once and only after every env/path matcher has missed \u2014 a\n * pnpm or volta install never pays for it.\n *\n * Resolving the user's `npm` from PATH is inherent here: we must ask the very package manager that owns\n * this install where its global root is. Pinning an absolute path would defeat the detection.\n *\n * @example\n * defaultLazyNpmRoot() // => '/usr/local/lib/node_modules' | undefined\n */\nexport const defaultLazyNpmRoot = (): string | undefined => {\n  try {\n    const out = execFileSync('npm', ['root', '-g'], {\n      encoding: 'utf-8',\n      timeout: NPM_ROOT_TIMEOUT_MS,\n      stdio: ['ignore', 'pipe', 'ignore'],\n      shell: process.platform === 'win32',\n    })\n    const trimmed = out.trim()\n\n    return trimmed === '' ? undefined : trimmed\n  } catch {\n    return undefined\n  }\n}\n", "/**\n * The CHILD half of the auto-update, spawned detached by `maybeAutoUpdate`. It outlives the CLI\n * invocation that started it, so it may take its time and it may replace the binary.\n *\n * WHY IT WAITS FOR THE PARENT TO EXIT \u2014 the load-bearing invariant of this whole feature:\n * `scripts/build.js` sets esbuild `splitting: true`, so `dist/cli.js` lazily imports sibling\n * `chunk-*.js` files at runtime (that is how the Ink TUI stays off the fast path). A package manager\n * installing over `dist/` mid-command deletes chunks the parent has not imported yet, and the parent\n * dies on a dynamic import of a file that no longer exists. Waiting for the parent to exit is what\n * makes a silent background install safe rather than a random crash under `infra-kit dev`.\n */\nimport { spawnSync } from 'node:child_process'\nimport { homedir } from 'node:os'\nimport process from 'node:process'\n\nimport { defaultLazyNpmRoot, detectInstallManager, safeRealpath } from 'src/lib/install-manager'\nimport { withoutPackageManagerEnv } from 'src/lib/pm-env'\n\nimport { acquireUpdateLock } from './lock'\nimport { fetchLatestVersion } from './registry'\nimport { isNewerVersion } from './semver'\nimport { writeUpdateCache } from './update-cache'\nimport type { UpdateCache } from './update-cache'\n\n/** How often to re-check whether the parent is gone. */\nexport const PARENT_POLL_INTERVAL_MS = 200\n\n/**\n * Give up waiting after this long. A long-lived parent (`infra-kit dev` runs for hours) must not leave\n * an immortal child pinned to a stale version: we simply skip this cycle. `lastCheckMs` is already\n * persisted by then, so the next short-lived command re-checks after the normal 24h window.\n */\nexport const PARENT_WAIT_TIMEOUT_MS = 5 * 60 * 1000\n\nexport interface RunUpdateCheckDeps {\n  env?: NodeJS.ProcessEnv\n  nowMs?: number\n  fetchLatest?: (env: NodeJS.ProcessEnv) => Promise<string | null>\n  writeCache?: typeof writeUpdateCache\n  isProcessAlive?: (pid: number) => boolean\n  sleep?: (ms: number) => Promise<void>\n  /** Monotonic-ish source for the parent-wait deadline. Injected so the timeout is testable without real time. */\n  clock?: () => number\n  /** `npm root -g` probe. Defaults to the real subprocess; this child is detached, so it can afford one. */\n  lazyNpmRoot?: () => string | undefined\n  /** Single-flight guard. Returns a release fn, or null when another worker already holds the lock. */\n  acquireLock?: () => (() => void) | null\n  spawnSync?: typeof spawnSync\n  /** Realpath of the installed `dist/cli.js`, used to identify the owning package manager. */\n  selfRealPath: string\n  parentPid?: number\n}\n\n/** Signal 0 performs the permission/existence check without delivering anything. */\nconst defaultIsProcessAlive = (pid: number): boolean => {\n  try {\n    process.kill(pid, 0)\n\n    return true\n  } catch {\n    return false\n  }\n}\n\nconst defaultSleep = (ms: number): Promise<void> => {\n  return new Promise((resolve) => {\n    setTimeout(resolve, ms)\n  })\n}\n\n/**\n * Block until `parentPid` exits or {@link PARENT_WAIT_TIMEOUT_MS} elapses. Returns whether the parent\n * is actually gone \u2014 the caller must not install on a timeout.\n */\nconst waitForParentExit = async (\n  parentPid: number,\n  deps: Required<Pick<RunUpdateCheckDeps, 'isProcessAlive' | 'sleep' | 'clock'>>,\n): Promise<boolean> => {\n  const deadline = deps.clock() + PARENT_WAIT_TIMEOUT_MS\n\n  while (deps.clock() < deadline) {\n    if (!deps.isProcessAlive(parentPid)) return true\n\n    await deps.sleep(PARENT_POLL_INTERVAL_MS)\n  }\n\n  return !deps.isProcessAlive(parentPid)\n}\n\nexport type UpdateCheckOutcome =\n  | 'installed'\n  | 'install-failed'\n  | 'up-to-date'\n  | 'fetch-failed'\n  | 'cannot-self-spawn'\n  | 'parent-still-running'\n  | 'parent-unknown'\n  | 'already-running'\n\n/**\n * Fetch, decide, and (when safe) install \u2014 returning WHY it did what it did so tests can distinguish\n * \"no update\" from \"could not install\". Never throws.\n *\n * `lastCheckMs` is written from the ATTEMPT, before any early return. If it were written only on\n * success, an offline user would re-spawn a doomed child on every single command.\n *\n * @example\n * await runUpdateCheck('0.1.130', { selfRealPath: '/usr/local/lib/node_modules/infra-kit/dist/cli.js' })\n * // => 'installed'\n */\nexport const runUpdateCheck = async (currentVersion: string, deps: RunUpdateCheckDeps): Promise<UpdateCheckOutcome> => {\n  const acquireLock = deps.acquireLock ?? acquireUpdateLock\n\n  // Single-flight. N shells launched at once all read the same stale cache and each spawns a worker;\n  // the cache throttle cannot stop them because it is only written after the fetch returns. Without\n  // this, a pending update means N concurrent `npm install -g` over one global directory.\n  const release = acquireLock()\n\n  if (!release) return 'already-running'\n\n  try {\n    return await runUpdateCheckLocked(currentVersion, deps)\n  } finally {\n    release()\n  }\n}\n\nconst runUpdateCheckLocked = async (currentVersion: string, deps: RunUpdateCheckDeps): Promise<UpdateCheckOutcome> => {\n  const env = deps.env ?? process.env\n  const nowMs = deps.nowMs ?? Date.now()\n  const fetchLatest = deps.fetchLatest ?? fetchLatestVersion\n  const writeCache = deps.writeCache ?? writeUpdateCache\n  const isProcessAlive = deps.isProcessAlive ?? defaultIsProcessAlive\n  const sleep = deps.sleep ?? defaultSleep\n  const clock = deps.clock ?? Date.now\n  const lazyNpmRoot = deps.lazyNpmRoot ?? defaultLazyNpmRoot\n  const spawn = deps.spawnSync ?? spawnSync\n\n  const latestVersion = await fetchLatest(env)\n\n  // Every path below writes the cache EXACTLY once, and always with `lastCheckMs: nowMs` \u2014 the throttle\n  // burns on the ATTEMPT, never on success. If it burned only on success, an offline user would respawn\n  // a doomed child on every command.\n  const finish = (outcome: UpdateCheckOutcome, cache: Omit<UpdateCache, 'lastCheckMs'>): UpdateCheckOutcome => {\n    writeCache({ lastCheckMs: nowMs, ...cache })\n\n    return outcome\n  }\n\n  if (latestVersion === null) return finish('fetch-failed', { latestVersion: null, updateCommand: null })\n  if (!isNewerVersion(latestVersion, currentVersion))\n    return finish('up-to-date', { latestVersion, updateCommand: null })\n\n  // `lazyNpmRoot` is what makes the COMMON case work: a plain `npm i -g infra-kit` leaves no\n  // `npm_config_prefix` in the user's shell, so every cheap matcher misses and detection would report\n  // `unknown` / `canSelfSpawn: false`. Without this probe the auto-update would silently degrade to a\n  // notice for the majority of installs. The subprocess is affordable here and nowhere else.\n  const { canSelfSpawn, updateCommand } = detectInstallManager({\n    selfRealPath: deps.selfRealPath,\n    env,\n    realpath: safeRealpath,\n    lazyNpmRoot,\n  })\n\n  // Homebrew relinks its prefix and may prompt; an unknown location means the command is a guess.\n  // Both stay the user's call, so record the command for `maybeAutoUpdate` to print next invocation.\n  if (!canSelfSpawn) return finish('cannot-self-spawn', { latestVersion, updateCommand })\n\n  // Fail SAFE. Without a parent to outlive we cannot know whether a live CLI is still lazily importing\n  // `chunk-*.js` out of the `dist/` we are about to replace, so we skip the cycle rather than install\n  // blind. The real spawn always passes `--parent-pid`; only a hand-run worker lands here.\n  if (deps.parentPid == null) return finish('parent-unknown', { latestVersion, updateCommand: null })\n\n  const parentGone = await waitForParentExit(deps.parentPid, { isProcessAlive, sleep, clock })\n\n  // A long-lived parent (`infra-kit dev`) outlasted the wait. Stay silent and retry next window.\n  if (!parentGone) return finish('parent-still-running', { latestVersion, updateCommand: null })\n\n  // `shell` on win32 so the `.cmd` shims npm/pnpm/yarn ship as global bins resolve.\n  // `withoutPackageManagerEnv` strips inherited `npm_*` vars, which otherwise make pnpm/portless-style\n  // tools believe they were invoked via `npx`/`dlx` and refuse to run.\n  //\n  // `cwd` is pinned to the home directory, and this is a SECURITY control, not tidiness: npm resolves\n  // `registry=` from an `.npmrc` on disk relative to the cwd. Inheriting the caller's cwd would let any\n  // repo containing a hostile `.npmrc` silently redirect this unattended `install -g` to an attacker's\n  // registry, executing its lifecycle scripts. Stripping `npm_config_registry` from the env does NOT\n  // close that hole, because the redirect lives in a file, not the environment.\n  const result = spawn(updateCommand[0] as string, updateCommand.slice(1), {\n    stdio: 'ignore',\n    shell: process.platform === 'win32',\n    cwd: homedir(),\n    env: withoutPackageManagerEnv(env),\n    windowsHide: true,\n  })\n\n  // Record the manual command so a persistently failing silent install (EACCES on a root-owned global\n  // dir, say) still surfaces ONE actionable line, instead of failing invisibly forever.\n  if (result.error || result.signal || result.status !== 0) {\n    return finish('install-failed', { latestVersion, updateCommand })\n  }\n\n  // The installed version is now `latestVersion`; clear it so the next run does not re-notify.\n  return finish('installed', { latestVersion: null, updateCommand: null })\n}\n", "/**\n * Single-flight lock for the background update worker.\n *\n * Without it, N shells starting at once all read the same stale cache and each spawns a worker \u2014 and\n * once a newer version exists, each of those runs `npm install -g` concurrently, over the same global\n * directory. (Measured: five concurrent `ik` invocations spawn five workers.) The throttle in the cache\n * cannot prevent this: it is only written AFTER the fetch returns, long after the other workers launched.\n *\n * `openSync(path, 'wx')` is the primitive \u2014 an atomic create-if-absent, so exactly one worker wins even\n * if all of them call it in the same millisecond.\n */\nimport fs from 'node:fs'\nimport path from 'node:path'\nimport process from 'node:process'\n\nimport { getCacheRoot } from 'src/lib/constants'\n\nexport const LOCK_FILE_NAME = 'update-check.lock'\n\n/**\n * A lock older than this is assumed to belong to a worker that was killed before it could clean up.\n * Must exceed the worker's own worst case (a 5-minute parent wait plus a 2.5s fetch), or a long-lived\n * `infra-kit dev` session would let a healthy lock be stolen out from under its worker.\n */\nexport const LOCK_STALE_MS = 10 * 60 * 1000\n\nexport const lockFilePath = (): string => {\n  return path.join(getCacheRoot(), LOCK_FILE_NAME)\n}\n\nexport interface LockDeps {\n  nowMs?: number\n  lockPath?: string\n}\n\n/** Delete a lock whose mtime predates the staleness window. Best-effort: losing the race is harmless. */\nconst reapIfStale = (lockPath: string, nowMs: number): void => {\n  try {\n    if (nowMs - fs.statSync(lockPath).mtimeMs > LOCK_STALE_MS) fs.rmSync(lockPath, { force: true })\n  } catch {\n    // Vanished under us \u2014 another worker reaped it. Nothing to do.\n  }\n}\n\n/**\n * Take the lock, or return null when another worker already holds it.\n *\n * Returns a release function rather than a boolean so the caller cannot forget which path releases:\n * there is exactly one handle, and it is the only thing that can unlink the file.\n *\n * @example\n * const release = acquireUpdateLock()\n * if (!release) return 'already-running'\n * try { ... } finally { release() }\n */\nexport const acquireUpdateLock = (deps: LockDeps = {}): (() => void) | null => {\n  const nowMs = deps.nowMs ?? Date.now()\n  const lockPath = deps.lockPath ?? lockFilePath()\n\n  try {\n    fs.mkdirSync(path.dirname(lockPath), { recursive: true })\n  } catch {\n    return null\n  }\n\n  const open = (): number | null => {\n    try {\n      // 'wx' fails with EEXIST if the file is already there: an atomic test-and-set.\n      return fs.openSync(lockPath, 'wx', 0o600)\n    } catch {\n      return null\n    }\n  }\n\n  let fd = open()\n\n  if (fd === null) {\n    reapIfStale(lockPath, nowMs)\n    // One retry only. If a live worker holds the lock, we are the loser and must simply stand down.\n    fd = open()\n  }\n\n  if (fd === null) return null\n\n  try {\n    fs.writeFileSync(fd, String(process.pid))\n  } catch {\n    // The pid is a debugging aid, not part of the protocol; the lock is held either way.\n  }\n\n  return () => {\n    try {\n      fs.closeSync(fd)\n    } catch {\n      // Already closed.\n    }\n\n    try {\n      fs.rmSync(lockPath, { force: true })\n    } catch {\n      // Already gone; a later worker will reap it via LOCK_STALE_MS regardless.\n    }\n  }\n}\n", "/**\n * Ask the npm registry for the `latest` dist-tag. Node >= 24 (see `engines`), so global `fetch` is\n * available and this needs no dependency.\n */\nimport { PACKAGE_NAME } from 'src/lib/install-manager'\n\nexport const DEFAULT_REGISTRY = 'https://registry.npmjs.org'\n\n/** Bounded so a hanging registry can never keep a detached child alive indefinitely. */\nexport const FETCH_TIMEOUT_MS = 2_500\n\n/**\n * The registry this install actually talks to. A user behind a corporate mirror has `npm_config_registry`\n * set; hitting registry.npmjs.org directly would either fail closed (firewall) or, worse, report a public\n * version they cannot install.\n *\n * @example\n * registryUrl({ npm_config_registry: 'https://nexus.corp/repo/npm/' }) // => 'https://nexus.corp/repo/npm'\n */\nexport const registryUrl = (env: NodeJS.ProcessEnv): string => {\n  const configured = env.npm_config_registry\n\n  let base = configured != null && configured !== '' ? configured : DEFAULT_REGISTRY\n\n  // A `/\\/+$/` regex would do this in one line, but its backtracking is super-linear on a hostile input.\n  while (base.endsWith('/')) {\n    base = base.slice(0, -1)\n  }\n\n  return base\n}\n\n/**\n * The published `latest` version, or null on ANY failure (offline, timeout, non-200, malformed body).\n * Never throws: a failed check must be indistinguishable from \"no update available\" to every caller.\n *\n * @example\n * await fetchLatestVersion(process.env) // => '0.1.131' | null\n */\nexport const fetchLatestVersion = async (\n  env: NodeJS.ProcessEnv,\n  fetchFn: typeof fetch = fetch,\n): Promise<string | null> => {\n  const controller = new AbortController()\n  const timer = setTimeout(() => {\n    controller.abort()\n  }, FETCH_TIMEOUT_MS)\n\n  try {\n    const response = await fetchFn(`${registryUrl(env)}/${PACKAGE_NAME}/latest`, {\n      signal: controller.signal,\n      headers: { accept: 'application/json' },\n    })\n\n    if (!response.ok) return null\n\n    const body: unknown = await response.json()\n    const version = (body as { version?: unknown } | null)?.version\n\n    return typeof version === 'string' && version !== '' ? version : null\n  } catch {\n    return null\n  } finally {\n    clearTimeout(timer)\n  }\n}\n", "/**\n * Registry-safe version comparison for the auto-update check.\n *\n * Deliberately NOT `src/lib/version-utils`: `parseVersion` there does `versionStr.slice(1)` because it\n * only ever sees `v`-prefixed release tags, so it turns a bare registry version (`0.1.130`) into\n * `[NaN, 1, 130]`. Feeding npm's `dist-tags.latest` through it silently compares NaNs and never fires.\n * These inputs are bare semver from `registry.npmjs.org` and from our own `package.json`.\n */\n\n/** `1.2.3-beta.4+build` \u2192 the `[1, 2, 3]` release triple and the `beta.4` prerelease, or null if unparsable. */\ninterface ParsedVersion {\n  release: [number, number, number]\n  /** Dot-separated prerelease identifiers, empty when this is a final release. */\n  prerelease: string[]\n}\n\nconst RELEASE_PATTERN = /^(\\d+)\\.(\\d+)\\.(\\d+)$/\n\n/**\n * Parse bare semver. Returns null (never throws, never NaNs) for anything that is not\n * `major.minor.patch` with optional `-prerelease` and `+build` \u2014 a garbled registry body must read as\n * \"no update\", not as \"update to NaN\".\n *\n * @example\n * parseSemver('0.1.130') // => { release: [0, 1, 130], prerelease: [] }\n * parseSemver('1.0.0-rc.1+abc') // => { release: [1, 0, 0], prerelease: ['rc', '1'] }\n * parseSemver('v1.0.0') // => null\n */\nexport const parseSemver = (version: string): ParsedVersion | null => {\n  // Build metadata is ignored entirely by semver precedence rules.\n  const [withoutBuild = ''] = version.trim().split('+')\n  const [core = '', ...prereleaseParts] = withoutBuild.split('-')\n  const match = RELEASE_PATTERN.exec(core)\n\n  if (!match) return null\n\n  const [major, minor, patch] = [match[1], match[2], match[3]].map(Number) as [number, number, number]\n\n  return {\n    release: [major, minor, patch],\n    // Re-join on '-' so `1.0.0-rc-1` keeps its hyphen inside a single identifier.\n    prerelease: prereleaseParts.length > 0 ? prereleaseParts.join('-').split('.') : [],\n  }\n}\n\nconst NUMERIC_IDENTIFIER = /^\\d+$/\n\n/** Compare two unequal prerelease identifiers per semver \u00A711. Numeric ones rank below alphanumeric ones. */\nconst compareIdentifier = (left: string, right: string): number => {\n  const leftNumeric = NUMERIC_IDENTIFIER.test(left)\n  const rightNumeric = NUMERIC_IDENTIFIER.test(right)\n\n  if (leftNumeric && rightNumeric) return Number(left) - Number(right)\n  if (leftNumeric !== rightNumeric) return leftNumeric ? -1 : 1\n\n  return left < right ? -1 : 1\n}\n\n/** Compare prerelease identifier lists. A shorter list has lower precedence: `1.0.0-rc` < `1.0.0-rc.1`. */\nconst comparePrerelease = (a: string[], b: string[]): number => {\n  for (let index = 0; index < Math.max(a.length, b.length); index += 1) {\n    const left = a[index]\n    const right = b[index]\n\n    if (left === undefined) return -1\n    if (right === undefined) return 1\n    if (left !== right) return compareIdentifier(left, right)\n  }\n\n  return 0\n}\n\n/**\n * Is `latest` strictly newer than `current`? False when either is unparsable, so a bad registry\n * response can never trigger an install.\n *\n * The load-bearing case is NUMERIC, not lexical, comparison: `0.1.9` must be older than `0.1.130`.\n * A string compare would order them the other way and pin every user to the older build forever.\n *\n * A final release outranks its own prereleases (`1.0.0` > `1.0.0-rc.1`), so a user on `rc` is offered\n * the release, and a user on the release is never \"downgraded\" to an rc.\n *\n * @example\n * isNewerVersion('0.1.130', '0.1.9') // => true  (numeric, not lexical)\n * isNewerVersion('1.0.0', '1.0.0-rc.1') // => true\n * isNewerVersion('0.1.130', '0.1.130') // => false\n * isNewerVersion('garbage', '0.1.0') // => false\n */\nexport const isNewerVersion = (latest: string, current: string): boolean => {\n  const parsedLatest = parseSemver(latest)\n  const parsedCurrent = parseSemver(current)\n\n  if (!parsedLatest || !parsedCurrent) return false\n\n  for (let index = 0; index < 3; index += 1) {\n    const left = parsedLatest.release[index] as number\n    const right = parsedCurrent.release[index] as number\n\n    if (left !== right) return left > right\n  }\n\n  const latestIsFinal = parsedLatest.prerelease.length === 0\n  const currentIsFinal = parsedCurrent.prerelease.length === 0\n\n  if (latestIsFinal !== currentIsFinal) return latestIsFinal\n\n  return comparePrerelease(parsedLatest.prerelease, parsedCurrent.prerelease) > 0\n}\n", "/**\n * The throttle + notice state for the auto-update check, at `$cacheRoot/update-check.json`.\n *\n * `getCacheRoot()` \u2014 NOT `getSessionCacheDir()`, which throws unless `INFRA_KIT_SESSION` is set. A user\n * who installed this CLI globally and never ran `infra-kit init` has no session, and the update check\n * must still work for exactly that person.\n */\nimport fs from 'node:fs'\nimport path from 'node:path'\n\nimport { atomicWriteFileSync, getCacheRoot } from 'src/lib/constants'\n\nexport const CACHE_FILE_NAME = 'update-check.json'\n\n/** Refresh at most once a day. A background check is cheap, but not once per shell command. */\nexport const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000\n\nexport interface UpdateCache {\n  /**\n   * When the last check was ATTEMPTED \u2014 never \"when it last succeeded\". An offline user whose fetch\n   * throws must still burn their 24h window, or every single command spawns another doomed child.\n   */\n  lastCheckMs: number\n  /** Latest version seen on the registry, or null when the last attempt failed. */\n  latestVersion: string | null\n  /**\n   * The command the USER must run, set only when the worker was not allowed to install for them\n   * (Homebrew, or an install location it could not identify). Null means \"handled, say nothing\".\n   *\n   * The worker decides this, not the reader: identifying the owning package manager can cost an\n   * `npm root -g` subprocess, and the CLI startup path must never pay for one. The background child\n   * already pays it, so it writes the verdict down.\n   */\n  updateCommand: string[] | null\n}\n\nexport const cacheFilePath = (): string => {\n  return path.join(getCacheRoot(), CACHE_FILE_NAME)\n}\n\nconst isStringArray = (value: unknown): value is string[] => {\n  return (\n    Array.isArray(value) &&\n    value.every((entry) => {\n      return typeof entry === 'string'\n    })\n  )\n}\n\nconst isUpdateCache = (value: unknown): value is UpdateCache => {\n  if (typeof value !== 'object' || value === null) return false\n\n  const { lastCheckMs, latestVersion, updateCommand } = value as Partial<UpdateCache>\n\n  return (\n    typeof lastCheckMs === 'number' &&\n    Number.isFinite(lastCheckMs) &&\n    (latestVersion === null || typeof latestVersion === 'string') &&\n    (updateCommand === null || isStringArray(updateCommand))\n  )\n}\n\n/**\n * Read the cache, or null when it is missing/unreadable/corrupt. A null read means \"stale\" to every\n * caller, so a first run and a hand-mangled file behave identically: check again.\n *\n * @example\n * readUpdateCache() // => { lastCheckMs: 1770000000000, latestVersion: '0.1.131' } | null\n */\nexport const readUpdateCache = (\n  readFile: (p: string) => string = (p) => {\n    return fs.readFileSync(p, 'utf8')\n  },\n): UpdateCache | null => {\n  try {\n    const parsed: unknown = JSON.parse(readFile(cacheFilePath()))\n\n    return isUpdateCache(parsed) ? parsed : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Persist the check result. Creates `$cacheRoot` first: `atomicWriteFileSync` writes a temp file\n * beside the target and renames, so it throws ENOENT on a machine that has never had a `~/.cache/infra-kit`.\n * Without this mkdir the write fails, `lastCheckMs` never lands, and the throttle degrades into a\n * detached-child spawn on every invocation.\n *\n * @example\n * writeUpdateCache({ lastCheckMs: Date.now(), latestVersion: '0.1.131' })\n */\nexport const writeUpdateCache = (cache: UpdateCache): void => {\n  const root = getCacheRoot()\n\n  fs.mkdirSync(root, { recursive: true })\n  atomicWriteFileSync(path.join(root, CACHE_FILE_NAME), JSON.stringify(cache), 0o600)\n}\n\n/**\n * Has the throttle window elapsed? A missing cache is stale by definition (first run).\n *\n * A `lastCheckMs` in the future (clock skew, or a restored backup) also reads as stale rather than\n * locking the user out of updates until their clock catches up.\n *\n * @example\n * isStale(null, 1_000) // => true\n * isStale({ lastCheckMs: 0, latestVersion: null }, CHECK_INTERVAL_MS + 1) // => true\n */\nexport const isStale = (cache: UpdateCache | null, nowMs: number): boolean => {\n  if (!cache) return true\n\n  const elapsed = nowMs - cache.lastCheckMs\n\n  return elapsed >= CHECK_INTERVAL_MS || elapsed < 0\n}\n"],
+  "mappings": "uFAQA,OAAOA,MAAU,YAGV,IAAMC,EAAe,YAEtBC,EAAS,GAAGD,CAAY,UAoCxBE,EAAW,CAACC,EAAgBC,EAAeC,IAAkC,CACjF,IAAMC,EAAMP,EAAK,SAASM,EAASN,EAAK,QAAQI,CAAM,CAAC,EAAGJ,EAAK,QAAQK,CAAK,CAAC,EAE7E,OAAOE,IAAQ,IAAM,CAACA,EAAI,WAAW,IAAI,GAAK,CAACP,EAAK,WAAWO,CAAG,CACpE,EAGMC,EAAa,CAACC,EAAWC,IACtBV,EAAK,QAAQS,CAAC,EAAE,MAAMT,EAAK,GAAG,EAAE,SAASU,CAAI,EAkBhDC,EAAc,CAACF,EAAWC,IAA0B,CACxD,IAAME,EAAWZ,EAAK,QAAQS,CAAC,EAAE,MAAMT,EAAK,GAAG,EACzCa,EAASD,EAAS,QAAQ,QAAQ,EAExC,OAAOC,IAAW,IAAMD,EAASC,EAAS,CAAC,IAAMH,CACnD,EAGMI,EAAc,CAACC,EAAwBC,EAAaC,EAAsBX,IAAkC,CAChH,IAAMY,EAAMH,EAAIC,CAAG,EAEnB,OAAOE,GAAO,MAAQA,IAAQ,IAAMf,EAASe,EAAKD,EAAcX,CAAQ,CAC1E,EAWMa,EAAsB,CAC1B,CACE,QAAS,QAET,KAAM,CAAC,CAAE,aAAAF,EAAc,IAAAF,EAAK,SAAAT,CAAS,IAEjCQ,EAAYC,EAAK,aAAcE,EAAcX,CAAQ,GACrDE,EAAWS,EAAc,QAAQ,GACjCT,EAAWS,EAAc,OAAO,EAGpC,cAAe,CAAC,QAAS,UAAWhB,CAAY,EAChD,aAAc,EAChB,EACA,CACE,QAAS,WAaT,KAAM,CAAC,CAAE,aAAAgB,CAAa,IACbN,EAAYM,EAAchB,CAAY,EAE/C,cAAe,CAAC,OAAQ,UAAWA,CAAY,EAC/C,aAAc,EAChB,EACA,CACE,QAAS,OACT,KAAM,CAAC,CAAE,aAAAgB,EAAc,IAAAF,EAAK,SAAAT,CAAS,IAEjCQ,EAAYC,EAAK,YAAaE,EAAcX,CAAQ,GACnDE,EAAWS,EAAc,MAAM,GAAKT,EAAWS,EAAc,QAAQ,EAG1E,cAAe,CAAC,OAAQ,MAAO,KAAMf,CAAM,EAC3C,aAAc,EAChB,EACA,CACE,QAAS,MACT,KAAM,CAAC,CAAE,aAAAe,EAAc,IAAAF,EAAK,SAAAT,CAAS,IAC5BQ,EAAYC,EAAK,cAAeE,EAAcX,CAAQ,GAAKE,EAAWS,EAAc,MAAM,EAEnG,cAAe,CAAC,MAAO,MAAO,KAAMf,CAAM,EAC1C,aAAc,EAChB,EACA,CACE,QAAS,OACT,KAAM,CAAC,CAAE,aAAAe,CAAa,IAElBT,EAAWS,EAAc,OAAO,GAAMT,EAAWS,EAAc,MAAM,GAAKT,EAAWS,EAAc,QAAQ,EAG/G,cAAe,CAAC,OAAQ,SAAU,MAAOf,CAAM,EAC/C,aAAc,EAChB,EACA,CACE,QAAS,MACT,KAAM,CAAC,CAAE,aAAAe,EAAc,IAAAF,EAAK,SAAAT,CAAS,IAC5BQ,EAAYC,EAAK,oBAAqBE,EAAcX,CAAQ,EAErE,cAAe,CAAC,MAAO,UAAW,KAAMJ,CAAM,EAC9C,aAAc,EAChB,CACF,EAEMkB,EAAqB,CAAC,MAAO,UAAW,KAAMlB,CAAM,EAc7CmB,EAAwBC,GAAyD,CAC5F,GAAM,CAAE,aAAAL,EAAc,IAAAF,EAAK,SAAAT,EAAU,YAAAiB,CAAY,EAAID,EAC/CE,EAAML,EAAS,KAAK,CAAC,CAAE,KAAAM,CAAK,IACzBA,EAAK,CAAE,aAAAR,EAAc,IAAAF,EAAK,SAAAT,CAAS,CAAC,CAC5C,EAED,GAAIkB,EAAK,MAAO,CAAE,QAASA,EAAI,QAAS,cAAeA,EAAI,cAAe,aAAcA,EAAI,YAAa,EAEzG,IAAME,EAAUH,IAAc,EAE9B,OAAIG,GAAW,MAAQA,IAAY,IAAMvB,EAASuB,EAAST,EAAcX,CAAQ,EACxE,CAAE,QAAS,MAAO,cAAec,EAAoB,aAAc,EAAK,EAG1E,CAAE,QAAS,UAAW,cAAeA,EAAoB,aAAc,EAAM,CACtF,EAmBaO,EAA4B,CAACV,EAAsBW,EAAatB,IACpEE,EAAWS,EAAc,cAAc,GAAKd,EAASyB,EAAKX,EAAcX,CAAQ,EC5NzF,OAAS,gBAAAuB,MAAoB,UAC7B,OAAOC,MAAU,YAUV,IAAMC,EAAgBC,GAAwB,CACnD,GAAI,CACF,OAAOH,EAAaG,CAAG,CACzB,MAAQ,CACN,OAAOF,EAAK,QAAQE,CAAG,CACzB,CACF,ECLA,OAAS,gBAAAC,MAAoB,qBAC7B,OAAOC,MAAa,eAEpB,IAAMC,EAAsB,IAafC,EAAqB,IAA0B,CAC1D,GAAI,CAOF,IAAMC,EANMJ,EAAa,MAAO,CAAC,OAAQ,IAAI,EAAG,CAC9C,SAAU,QACV,QAASE,EACT,MAAO,CAAC,SAAU,OAAQ,QAAQ,EAClC,MAAOD,EAAQ,WAAa,OAC9B,CAAC,EACmB,KAAK,EAEzB,OAAOG,IAAY,GAAK,OAAYA,CACtC,MAAQ,CACN,MACF,CACF,EC/BA,OAAS,aAAAC,OAAiB,qBAC1B,OAAS,WAAAC,OAAe,UACxB,OAAOC,MAAa,eCFpB,OAAOC,MAAQ,UACf,OAAOC,MAAU,YACjB,OAAOC,MAAa,eAIb,IAAMC,EAAiB,oBAOjBC,EAAgB,IAAU,IAE1BC,GAAe,IACnBC,EAAK,KAAKC,EAAa,EAAGJ,CAAc,EAS3CK,GAAc,CAACC,EAAkBC,IAAwB,CAC7D,GAAI,CACEA,EAAQC,EAAG,SAASF,CAAQ,EAAE,QAAUL,GAAeO,EAAG,OAAOF,EAAU,CAAE,MAAO,EAAK,CAAC,CAChG,MAAQ,CAER,CACF,EAaaG,EAAoB,CAACC,EAAiB,CAAC,IAA2B,CAC7E,IAAMH,EAAQG,EAAK,OAAS,KAAK,IAAI,EAC/BJ,EAAWI,EAAK,UAAYR,GAAa,EAE/C,GAAI,CACFM,EAAG,UAAUL,EAAK,QAAQG,CAAQ,EAAG,CAAE,UAAW,EAAK,CAAC,CAC1D,MAAQ,CACN,OAAO,IACT,CAEA,IAAMK,EAAO,IAAqB,CAChC,GAAI,CAEF,OAAOH,EAAG,SAASF,EAAU,KAAM,GAAK,CAC1C,MAAQ,CACN,OAAO,IACT,CACF,EAEIM,EAAKD,EAAK,EAQd,GANIC,IAAO,OACTP,GAAYC,EAAUC,CAAK,EAE3BK,EAAKD,EAAK,GAGRC,IAAO,KAAM,OAAO,KAExB,GAAI,CACFJ,EAAG,cAAcI,EAAI,OAAOC,EAAQ,GAAG,CAAC,CAC1C,MAAQ,CAER,CAEA,MAAO,IAAM,CACX,GAAI,CACFL,EAAG,UAAUI,CAAE,CACjB,MAAQ,CAER,CAEA,GAAI,CACFJ,EAAG,OAAOF,EAAU,CAAE,MAAO,EAAK,CAAC,CACrC,MAAQ,CAER,CACF,CACF,ECjGO,IAAMQ,GAAmB,6BAGnBC,GAAmB,KAUnBC,GAAeC,GAAmC,CAC7D,IAAMC,EAAaD,EAAI,oBAEnBE,EAAOD,GAAc,MAAQA,IAAe,GAAKA,EAAaJ,GAGlE,KAAOK,EAAK,SAAS,GAAG,GACtBA,EAAOA,EAAK,MAAM,EAAG,EAAE,EAGzB,OAAOA,CACT,EASaC,EAAqB,MAChCH,EACAI,EAAwB,QACG,CAC3B,IAAMC,EAAa,IAAI,gBACjBC,EAAQ,WAAW,IAAM,CAC7BD,EAAW,MAAM,CACnB,EAAGP,EAAgB,EAEnB,GAAI,CACF,IAAMS,EAAW,MAAMH,EAAQ,GAAGL,GAAYC,CAAG,CAAC,IAAIQ,CAAY,UAAW,CAC3E,OAAQH,EAAW,OACnB,QAAS,CAAE,OAAQ,kBAAmB,CACxC,CAAC,EAED,GAAI,CAACE,EAAS,GAAI,OAAO,KAGzB,IAAME,GADgB,MAAMF,EAAS,KAAK,IACc,QAExD,OAAO,OAAOE,GAAY,UAAYA,IAAY,GAAKA,EAAU,IACnE,MAAQ,CACN,OAAO,IACT,QAAE,CACA,aAAaH,CAAK,CACpB,CACF,ECjDA,IAAMI,GAAkB,wBAYXC,EAAeC,GAA0C,CAEpE,GAAM,CAACC,EAAe,EAAE,EAAID,EAAQ,KAAK,EAAE,MAAM,GAAG,EAC9C,CAACE,EAAO,GAAI,GAAGC,CAAe,EAAIF,EAAa,MAAM,GAAG,EACxDG,EAAQN,GAAgB,KAAKI,CAAI,EAEvC,GAAI,CAACE,EAAO,OAAO,KAEnB,GAAM,CAACC,EAAOC,EAAOC,CAAK,EAAI,CAACH,EAAM,CAAC,EAAGA,EAAM,CAAC,EAAGA,EAAM,CAAC,CAAC,EAAE,IAAI,MAAM,EAEvE,MAAO,CACL,QAAS,CAACC,EAAOC,EAAOC,CAAK,EAE7B,WAAYJ,EAAgB,OAAS,EAAIA,EAAgB,KAAK,GAAG,EAAE,MAAM,GAAG,EAAI,CAAC,CACnF,CACF,EAEMK,EAAqB,QAGrBC,GAAoB,CAACC,EAAcC,IAA0B,CACjE,IAAMC,EAAcJ,EAAmB,KAAKE,CAAI,EAC1CG,EAAeL,EAAmB,KAAKG,CAAK,EAElD,OAAIC,GAAeC,EAAqB,OAAOH,CAAI,EAAI,OAAOC,CAAK,EAC/DC,IAAgBC,EAAqBD,EAAc,GAAK,EAErDF,EAAOC,EAAQ,GAAK,CAC7B,EAGMG,GAAoB,CAACC,EAAaC,IAAwB,CAC9D,QAASC,EAAQ,EAAGA,EAAQ,KAAK,IAAIF,EAAE,OAAQC,EAAE,MAAM,EAAGC,GAAS,EAAG,CACpE,IAAMP,EAAOK,EAAEE,CAAK,EACdN,EAAQK,EAAEC,CAAK,EAErB,GAAIP,IAAS,OAAW,MAAO,GAC/B,GAAIC,IAAU,OAAW,MAAO,GAChC,GAAID,IAASC,EAAO,OAAOF,GAAkBC,EAAMC,CAAK,CAC1D,CAEA,MAAO,EACT,EAkBaO,EAAiB,CAACC,EAAgBC,IAA6B,CAC1E,IAAMC,EAAetB,EAAYoB,CAAM,EACjCG,EAAgBvB,EAAYqB,CAAO,EAEzC,GAAI,CAACC,GAAgB,CAACC,EAAe,MAAO,GAE5C,QAASL,EAAQ,EAAGA,EAAQ,EAAGA,GAAS,EAAG,CACzC,IAAMP,EAAOW,EAAa,QAAQJ,CAAK,EACjCN,EAAQW,EAAc,QAAQL,CAAK,EAEzC,GAAIP,IAASC,EAAO,OAAOD,EAAOC,CACpC,CAEA,IAAMY,EAAgBF,EAAa,WAAW,SAAW,EACnDG,EAAiBF,EAAc,WAAW,SAAW,EAE3D,OAAIC,IAAkBC,EAAuBD,EAEtCT,GAAkBO,EAAa,WAAYC,EAAc,UAAU,EAAI,CAChF,ECpGA,OAAOG,MAAQ,UACf,OAAOC,MAAU,YAIV,IAAMC,EAAkB,oBAGlBC,GAAoB,KAAU,GAAK,IAqBnCC,GAAgB,IACpBC,EAAK,KAAKC,EAAa,EAAGJ,CAAe,EAG5CK,GAAiBC,GAEnB,MAAM,QAAQA,CAAK,GACnBA,EAAM,MAAOC,GACJ,OAAOA,GAAU,QACzB,EAICC,GAAiBF,GAAyC,CAC9D,GAAI,OAAOA,GAAU,UAAYA,IAAU,KAAM,MAAO,GAExD,GAAM,CAAE,YAAAG,EAAa,cAAAC,EAAe,cAAAC,CAAc,EAAIL,EAEtD,OACE,OAAOG,GAAgB,UACvB,OAAO,SAASA,CAAW,IAC1BC,IAAkB,MAAQ,OAAOA,GAAkB,YACnDC,IAAkB,MAAQN,GAAcM,CAAa,EAE1D,EASaC,GAAkB,CAC7BC,EAAmCC,GAC1BC,EAAG,aAAaD,EAAG,MAAM,IAEX,CACvB,GAAI,CACF,IAAME,EAAkB,KAAK,MAAMH,EAASX,GAAc,CAAC,CAAC,EAE5D,OAAOM,GAAcQ,CAAM,EAAIA,EAAS,IAC1C,MAAQ,CACN,OAAO,IACT,CACF,EAWaC,EAAoBC,GAA6B,CAC5D,IAAMC,EAAOf,EAAa,EAE1BW,EAAG,UAAUI,EAAM,CAAE,UAAW,EAAK,CAAC,EACtCC,EAAoBjB,EAAK,KAAKgB,EAAMnB,CAAe,EAAG,KAAK,UAAUkB,CAAK,EAAG,GAAK,CACpF,EAYaG,GAAU,CAACH,EAA2BI,IAA2B,CAC5E,GAAI,CAACJ,EAAO,MAAO,GAEnB,IAAMK,EAAUD,EAAQJ,EAAM,YAE9B,OAAOK,GAAWtB,IAAqBsB,EAAU,CACnD,EJ1FO,IAAMC,GAA0B,IAO1BC,GAAyB,IAAS,IAsBzCC,GAAyBC,GAAyB,CACtD,GAAI,CACF,OAAAC,EAAQ,KAAKD,EAAK,CAAC,EAEZ,EACT,MAAQ,CACN,MAAO,EACT,CACF,EAEME,GAAgBC,GACb,IAAI,QAASC,GAAY,CAC9B,WAAWA,EAASD,CAAE,CACxB,CAAC,EAOGE,GAAoB,MACxBC,EACAC,IACqB,CACrB,IAAMC,EAAWD,EAAK,MAAM,EAAIT,GAEhC,KAAOS,EAAK,MAAM,EAAIC,GAAU,CAC9B,GAAI,CAACD,EAAK,eAAeD,CAAS,EAAG,MAAO,GAE5C,MAAMC,EAAK,MAAMV,EAAuB,CAC1C,CAEA,MAAO,CAACU,EAAK,eAAeD,CAAS,CACvC,EAuBaG,GAAiB,MAAOC,EAAwBH,IAA0D,CAMrH,IAAMI,GALcJ,EAAK,aAAeK,GAKZ,EAE5B,GAAI,CAACD,EAAS,MAAO,kBAErB,GAAI,CACF,OAAO,MAAME,GAAqBH,EAAgBH,CAAI,CACxD,QAAE,CACAI,EAAQ,CACV,CACF,EAEME,GAAuB,MAAOH,EAAwBH,IAA0D,CACpH,IAAMO,EAAMP,EAAK,KAAON,EAAQ,IAC1Bc,EAAQR,EAAK,OAAS,KAAK,IAAI,EAC/BS,EAAcT,EAAK,aAAeU,EAClCC,EAAaX,EAAK,YAAcY,EAChCC,EAAiBb,EAAK,gBAAkBR,GACxCsB,EAAQd,EAAK,OAASL,GACtBoB,EAAQf,EAAK,OAAS,KAAK,IAC3BgB,EAAchB,EAAK,aAAeiB,EAClCC,EAAQlB,EAAK,WAAamB,GAE1BC,EAAgB,MAAMX,EAAYF,CAAG,EAKrCc,EAAS,CAACC,EAA6BC,KAC3CZ,EAAW,CAAE,YAAaH,EAAO,GAAGe,CAAM,CAAC,EAEpCD,GAGT,GAAIF,IAAkB,KAAM,OAAOC,EAAO,eAAgB,CAAE,cAAe,KAAM,cAAe,IAAK,CAAC,EACtG,GAAI,CAACG,EAAeJ,EAAejB,CAAc,EAC/C,OAAOkB,EAAO,aAAc,CAAE,cAAAD,EAAe,cAAe,IAAK,CAAC,EAMpE,GAAM,CAAE,aAAAK,EAAc,cAAAC,CAAc,EAAIC,EAAqB,CAC3D,aAAc3B,EAAK,aACnB,IAAAO,EACA,SAAUqB,EACV,YAAAZ,CACF,CAAC,EAID,GAAI,CAACS,EAAc,OAAOJ,EAAO,oBAAqB,CAAE,cAAAD,EAAe,cAAAM,CAAc,CAAC,EAKtF,GAAI1B,EAAK,WAAa,KAAM,OAAOqB,EAAO,iBAAkB,CAAE,cAAAD,EAAe,cAAe,IAAK,CAAC,EAKlG,GAAI,CAHe,MAAMtB,GAAkBE,EAAK,UAAW,CAAE,eAAAa,EAAgB,MAAAC,EAAO,MAAAC,CAAM,CAAC,EAG1E,OAAOM,EAAO,uBAAwB,CAAE,cAAAD,EAAe,cAAe,IAAK,CAAC,EAW7F,IAAMS,EAASX,EAAMQ,EAAc,CAAC,EAAaA,EAAc,MAAM,CAAC,EAAG,CACvE,MAAO,SACP,MAAOhC,EAAQ,WAAa,QAC5B,IAAKoC,GAAQ,EACb,IAAKC,EAAyBxB,CAAG,EACjC,YAAa,EACf,CAAC,EAID,OAAIsB,EAAO,OAASA,EAAO,QAAUA,EAAO,SAAW,EAC9CR,EAAO,iBAAkB,CAAE,cAAAD,EAAe,cAAAM,CAAc,CAAC,EAI3DL,EAAO,YAAa,CAAE,cAAe,KAAM,cAAe,IAAK,CAAC,CACzE",
+  "names": ["path", "PACKAGE_NAME", "LATEST", "isWithin", "parent", "child", "realpath", "rel", "hasSegment", "p", "name", "isBrewKegOf", "segments", "cellar", "underEnvDir", "env", "key", "selfRealPath", "dir", "MATCHERS", "NPM_UPDATE_COMMAND", "detectInstallManager", "input", "lazyNpmRoot", "hit", "test", "npmRoot", "isLocalNodeModulesInstall", "cwd", "realpathSync", "path", "safeRealpath", "dir", "execFileSync", "process", "NPM_ROOT_TIMEOUT_MS", "defaultLazyNpmRoot", "trimmed", "spawnSync", "homedir", "process", "fs", "path", "process", "LOCK_FILE_NAME", "LOCK_STALE_MS", "lockFilePath", "path", "getCacheRoot", "reapIfStale", "lockPath", "nowMs", "fs", "acquireUpdateLock", "deps", "open", "fd", "process", "DEFAULT_REGISTRY", "FETCH_TIMEOUT_MS", "registryUrl", "env", "configured", "base", "fetchLatestVersion", "fetchFn", "controller", "timer", "response", "PACKAGE_NAME", "version", "RELEASE_PATTERN", "parseSemver", "version", "withoutBuild", "core", "prereleaseParts", "match", "major", "minor", "patch", "NUMERIC_IDENTIFIER", "compareIdentifier", "left", "right", "leftNumeric", "rightNumeric", "comparePrerelease", "a", "b", "index", "isNewerVersion", "latest", "current", "parsedLatest", "parsedCurrent", "latestIsFinal", "currentIsFinal", "fs", "path", "CACHE_FILE_NAME", "CHECK_INTERVAL_MS", "cacheFilePath", "path", "getCacheRoot", "isStringArray", "value", "entry", "isUpdateCache", "lastCheckMs", "latestVersion", "updateCommand", "readUpdateCache", "readFile", "p", "fs", "parsed", "writeUpdateCache", "cache", "root", "atomicWriteFileSync", "isStale", "nowMs", "elapsed", "PARENT_POLL_INTERVAL_MS", "PARENT_WAIT_TIMEOUT_MS", "defaultIsProcessAlive", "pid", "process", "defaultSleep", "ms", "resolve", "waitForParentExit", "parentPid", "deps", "deadline", "runUpdateCheck", "currentVersion", "release", "acquireUpdateLock", "runUpdateCheckLocked", "env", "nowMs", "fetchLatest", "fetchLatestVersion", "writeCache", "writeUpdateCache", "isProcessAlive", "sleep", "clock", "lazyNpmRoot", "defaultLazyNpmRoot", "spawn", "spawnSync", "latestVersion", "finish", "outcome", "cache", "isNewerVersion", "canSelfSpawn", "updateCommand", "detectInstallManager", "safeRealpath", "result", "homedir", "withoutPackageManagerEnv"]
+}

package/dist/{chunk-LSEYIAWK.js → chunk-DOG3OPNW.js}

@@ -1,2 +1,2 @@
-var i={name:"infra-kit",type:"module",version:"0.1.132",files:["dist"],description:"infra-kit",main:"dist/index.js",module:"dist/index.js",types:"dist/entry/index.d.ts",exports:{".":{types:"./dist/entry/index.d.ts",import:"./dist/index.js"},"./vite":{types:"./dist/entry/vite.d.ts",import:"./dist/vite.js"}},bin:{"infra-kit":"dist/cli.js",ik:"dist/cli.js"},engines:{node:">=24.x"},scripts:{inspector:"npx @modelcontextprotocol/inspector node ./dist/mcp.js --debug",build:"pnpm run clean-artifacts && node ./scripts/build.js",prepack:"pnpm run build",prepublishOnly:"pnpm run build","infra-kit-check":"pnpm exec infra-kit audit","clean-artifacts":"rm -rf dist","clean-cache":"rm -rf node_modules/.cache .eslintcache tsconfig.tsbuildinfo .turbo .swc","prettier-fix":"pnpm exec prettier **/* --write --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore","prettier-check":"pnpm exec prettier **/* --check --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore","eslint-check":"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src","eslint-fix":"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src --fix","ts-check":"tsc --noEmit",test:"pnpm exec vitest run --reporter=minimal","test-watch":"pnpm exec vitest --watch --silent passed-only","test-ui":"pnpm exec vitest --ui --silent passed-only","test-report":"pnpm exec vitest run --coverage --silent passed-only",qa:"pnpm run prettier-check && pnpm run eslint-check && pnpm run ts-check && pnpm run test && echo \u2705 Success",fix:"pnpm run prettier-fix && pnpm run eslint-fix && pnpm run qa"},dependencies:{"@aws-lambda-powertools/logger":"^2.33.1","@inquirer/checkbox":"^5.2.1","@inquirer/confirm":"^6.1.1","@inquirer/select":"^5.2.1","@modelcontextprotocol/sdk":"^1.29.0",chalk:"^5.6.2",chokidar:"^5.0.0",commander:"^15.0.0",fastify:"5.10.0",ink:"^7.1.0",pino:"^10.3.1","pino-pretty":"^13.1.3",portless:"^0.15.1",react:"19.2.7",yaml:"^2.9.0",zod:"^4.4.3",zx:"^8.8.5"},devDependencies:{"@types/aws-lambda":"^8.10.162","@types/react":"19.2.17","@wl/eslint-config":"workspace:*","@wl/vitest-config":"workspace:*",esbuild:"^0.28.1","ink-testing-library":"^4.0.0",typescript:"^6.0.3"}};export{i as a};
-//# sourceMappingURL=chunk-LSEYIAWK.js.map
+var i={name:"infra-kit",type:"module",version:"0.1.134",files:["dist"],description:"infra-kit",main:"dist/index.js",module:"dist/index.js",types:"dist/entry/index.d.ts",exports:{".":{types:"./dist/entry/index.d.ts",import:"./dist/index.js"},"./vite":{types:"./dist/entry/vite.d.ts",import:"./dist/vite.js"}},bin:{"infra-kit":"dist/cli.js",ik:"dist/cli.js"},engines:{node:">=24.x"},scripts:{inspector:"npx @modelcontextprotocol/inspector node ./dist/mcp.js --debug",build:"pnpm run clean-artifacts && node ./scripts/build.js",prepack:"pnpm run build",prepublishOnly:"pnpm run build","infra-kit-check":"pnpm exec infra-kit audit","clean-artifacts":"rm -rf dist","clean-cache":"rm -rf node_modules/.cache .eslintcache tsconfig.tsbuildinfo .turbo .swc","prettier-fix":"pnpm exec prettier **/* --write --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore","prettier-check":"pnpm exec prettier **/* --check --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore","eslint-check":"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src","eslint-fix":"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src --fix","ts-check":"tsc --noEmit",test:"pnpm exec vitest run --reporter=minimal","test-watch":"pnpm exec vitest --watch --silent passed-only","test-ui":"pnpm exec vitest --ui --silent passed-only","test-report":"pnpm exec vitest run --coverage --silent passed-only",qa:"pnpm run prettier-check && pnpm run eslint-check && pnpm run ts-check && pnpm run test && echo \u2705 Success",fix:"pnpm run prettier-fix && pnpm run eslint-fix && pnpm run qa"},dependencies:{"@aws-lambda-powertools/logger":"^2.33.1","@inquirer/checkbox":"^5.2.1","@inquirer/confirm":"^6.1.1","@inquirer/select":"^5.2.1","@modelcontextprotocol/sdk":"^1.29.0",chalk:"^5.6.2",chokidar:"^5.0.0",commander:"^15.0.0",fastify:"5.10.0",ink:"^7.1.0",pino:"^10.3.1","pino-pretty":"^13.1.3",portless:"^0.15.1",react:"19.2.7",yaml:"^2.9.0",zod:"^4.4.3",zx:"^8.8.5"},devDependencies:{"@types/aws-lambda":"^8.10.162","@types/react":"19.2.17","@wl/eslint-config":"workspace:*","@wl/vitest-config":"workspace:*",esbuild:"^0.28.1","ink-testing-library":"^4.0.0",typescript:"^6.0.3"}};export{i as a};
+//# sourceMappingURL=chunk-DOG3OPNW.js.map

package/dist/{chunk-LSEYIAWK.js.map → chunk-DOG3OPNW.js.map}

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../package.json"],
-  "sourcesContent": ["{\n  \"name\": \"infra-kit\",\n  \"type\": \"module\",\n  \"version\": \"0.1.132\",\n  \"files\": [\n    \"dist\"\n  ],\n  \"description\": \"infra-kit\",\n  \"main\": \"dist/index.js\",\n  \"module\": \"dist/index.js\",\n  \"types\": \"dist/entry/index.d.ts\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/entry/index.d.ts\",\n      \"import\": \"./dist/index.js\"\n    },\n    \"./vite\": {\n      \"types\": \"./dist/entry/vite.d.ts\",\n      \"import\": \"./dist/vite.js\"\n    }\n  },\n  \"bin\": {\n    \"infra-kit\": \"dist/cli.js\",\n    \"ik\": \"dist/cli.js\"\n  },\n  \"engines\": {\n    \"node\": \">=24.x\"\n  },\n  \"scripts\": {\n    \"inspector\": \"npx @modelcontextprotocol/inspector node ./dist/mcp.js --debug\",\n    \"build\": \"pnpm run clean-artifacts && node ./scripts/build.js\",\n    \"prepack\": \"pnpm run build\",\n    \"prepublishOnly\": \"pnpm run build\",\n    \"infra-kit-check\": \"pnpm exec infra-kit audit\",\n    \"clean-artifacts\": \"rm -rf dist\",\n    \"clean-cache\": \"rm -rf node_modules/.cache .eslintcache tsconfig.tsbuildinfo .turbo .swc\",\n    \"prettier-fix\": \"pnpm exec prettier **/* --write --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore\",\n    \"prettier-check\": \"pnpm exec prettier **/* --check --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore\",\n    \"eslint-check\": \"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src\",\n    \"eslint-fix\": \"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src --fix\",\n    \"ts-check\": \"tsc --noEmit\",\n    \"test\": \"pnpm exec vitest run --reporter=minimal\",\n    \"test-watch\": \"pnpm exec vitest --watch --silent passed-only\",\n    \"test-ui\": \"pnpm exec vitest --ui --silent passed-only\",\n    \"test-report\": \"pnpm exec vitest run --coverage --silent passed-only\",\n    \"qa\": \"pnpm run prettier-check && pnpm run eslint-check && pnpm run ts-check && pnpm run test && echo \u2705 Success\",\n    \"fix\": \"pnpm run prettier-fix && pnpm run eslint-fix && pnpm run qa\"\n  },\n  \"dependencies\": {\n    \"@aws-lambda-powertools/logger\": \"^2.33.1\",\n    \"@inquirer/checkbox\": \"^5.2.1\",\n    \"@inquirer/confirm\": \"^6.1.1\",\n    \"@inquirer/select\": \"^5.2.1\",\n    \"@modelcontextprotocol/sdk\": \"^1.29.0\",\n    \"chalk\": \"^5.6.2\",\n    \"chokidar\": \"^5.0.0\",\n    \"commander\": \"^15.0.0\",\n    \"fastify\": \"5.10.0\",\n    \"ink\": \"^7.1.0\",\n    \"pino\": \"^10.3.1\",\n    \"pino-pretty\": \"^13.1.3\",\n    \"portless\": \"^0.15.1\",\n    \"react\": \"19.2.7\",\n    \"yaml\": \"^2.9.0\",\n    \"zod\": \"^4.4.3\",\n    \"zx\": \"^8.8.5\"\n  },\n  \"devDependencies\": {\n    \"@types/aws-lambda\": \"^8.10.162\",\n    \"@types/react\": \"19.2.17\",\n    \"@wl/eslint-config\": \"workspace:*\",\n    \"@wl/vitest-config\": \"workspace:*\",\n    \"esbuild\": \"^0.28.1\",\n    \"ink-testing-library\": \"^4.0.0\",\n    \"typescript\": \"^6.0.3\"\n  }\n}\n"],
+  "sourcesContent": ["{\n  \"name\": \"infra-kit\",\n  \"type\": \"module\",\n  \"version\": \"0.1.134\",\n  \"files\": [\n    \"dist\"\n  ],\n  \"description\": \"infra-kit\",\n  \"main\": \"dist/index.js\",\n  \"module\": \"dist/index.js\",\n  \"types\": \"dist/entry/index.d.ts\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/entry/index.d.ts\",\n      \"import\": \"./dist/index.js\"\n    },\n    \"./vite\": {\n      \"types\": \"./dist/entry/vite.d.ts\",\n      \"import\": \"./dist/vite.js\"\n    }\n  },\n  \"bin\": {\n    \"infra-kit\": \"dist/cli.js\",\n    \"ik\": \"dist/cli.js\"\n  },\n  \"engines\": {\n    \"node\": \">=24.x\"\n  },\n  \"scripts\": {\n    \"inspector\": \"npx @modelcontextprotocol/inspector node ./dist/mcp.js --debug\",\n    \"build\": \"pnpm run clean-artifacts && node ./scripts/build.js\",\n    \"prepack\": \"pnpm run build\",\n    \"prepublishOnly\": \"pnpm run build\",\n    \"infra-kit-check\": \"pnpm exec infra-kit audit\",\n    \"clean-artifacts\": \"rm -rf dist\",\n    \"clean-cache\": \"rm -rf node_modules/.cache .eslintcache tsconfig.tsbuildinfo .turbo .swc\",\n    \"prettier-fix\": \"pnpm exec prettier **/* --write --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore\",\n    \"prettier-check\": \"pnpm exec prettier **/* --check --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore\",\n    \"eslint-check\": \"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src\",\n    \"eslint-fix\": \"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src --fix\",\n    \"ts-check\": \"tsc --noEmit\",\n    \"test\": \"pnpm exec vitest run --reporter=minimal\",\n    \"test-watch\": \"pnpm exec vitest --watch --silent passed-only\",\n    \"test-ui\": \"pnpm exec vitest --ui --silent passed-only\",\n    \"test-report\": \"pnpm exec vitest run --coverage --silent passed-only\",\n    \"qa\": \"pnpm run prettier-check && pnpm run eslint-check && pnpm run ts-check && pnpm run test && echo \u2705 Success\",\n    \"fix\": \"pnpm run prettier-fix && pnpm run eslint-fix && pnpm run qa\"\n  },\n  \"dependencies\": {\n    \"@aws-lambda-powertools/logger\": \"^2.33.1\",\n    \"@inquirer/checkbox\": \"^5.2.1\",\n    \"@inquirer/confirm\": \"^6.1.1\",\n    \"@inquirer/select\": \"^5.2.1\",\n    \"@modelcontextprotocol/sdk\": \"^1.29.0\",\n    \"chalk\": \"^5.6.2\",\n    \"chokidar\": \"^5.0.0\",\n    \"commander\": \"^15.0.0\",\n    \"fastify\": \"5.10.0\",\n    \"ink\": \"^7.1.0\",\n    \"pino\": \"^10.3.1\",\n    \"pino-pretty\": \"^13.1.3\",\n    \"portless\": \"^0.15.1\",\n    \"react\": \"19.2.7\",\n    \"yaml\": \"^2.9.0\",\n    \"zod\": \"^4.4.3\",\n    \"zx\": \"^8.8.5\"\n  },\n  \"devDependencies\": {\n    \"@types/aws-lambda\": \"^8.10.162\",\n    \"@types/react\": \"19.2.17\",\n    \"@wl/eslint-config\": \"workspace:*\",\n    \"@wl/vitest-config\": \"workspace:*\",\n    \"esbuild\": \"^0.28.1\",\n    \"ink-testing-library\": \"^4.0.0\",\n    \"typescript\": \"^6.0.3\"\n  }\n}\n"],
   "mappings": "AAAA,IAAAA,EAAA,CACE,KAAQ,YACR,KAAQ,SACR,QAAW,UACX,MAAS,CACP,MACF,EACA,YAAe,YACf,KAAQ,gBACR,OAAU,gBACV,MAAS,wBACT,QAAW,CACT,IAAK,CACH,MAAS,0BACT,OAAU,iBACZ,EACA,SAAU,CACR,MAAS,yBACT,OAAU,gBACZ,CACF,EACA,IAAO,CACL,YAAa,cACb,GAAM,aACR,EACA,QAAW,CACT,KAAQ,QACV,EACA,QAAW,CACT,UAAa,iEACb,MAAS,sDACT,QAAW,iBACX,eAAkB,iBAClB,kBAAmB,4BACnB,kBAAmB,cACnB,cAAe,2EACf,eAAgB,4HAChB,iBAAkB,4HAClB,eAAgB,4EAChB,aAAc,kFACd,WAAY,eACZ,KAAQ,0CACR,aAAc,gDACd,UAAW,6CACX,cAAe,uDACf,GAAM,gHACN,IAAO,6DACT,EACA,aAAgB,CACd,gCAAiC,UACjC,qBAAsB,SACtB,oBAAqB,SACrB,mBAAoB,SACpB,4BAA6B,UAC7B,MAAS,SACT,SAAY,SACZ,UAAa,UACb,QAAW,SACX,IAAO,SACP,KAAQ,UACR,cAAe,UACf,SAAY,UACZ,MAAS,SACT,KAAQ,SACR,IAAO,SACP,GAAM,QACR,EACA,gBAAmB,CACjB,oBAAqB,YACrB,eAAgB,UAChB,oBAAqB,cACrB,oBAAqB,cACrB,QAAW,UACX,sBAAuB,SACvB,WAAc,QAChB,CACF",
   "names": ["package_default"]
 }

package/dist/chunk-FAR2L74S.js

@@ -0,0 +1,2 @@
+import a from"node:process";var i="\x1B[3J",S=n=>typeof n=="string"?n.split(i).join(""):n,w=n=>new Proxy(n,{get(e,t,o){if(t==="write")return(s,...u)=>e.write(S(s),...u);let r=Reflect.get(e,t,o);return typeof r=="function"?r.bind(e):r}}),f=()=>w(a.stderr);export{w as a,f as b};
+//# sourceMappingURL=chunk-FAR2L74S.js.map

package/dist/chunk-FAR2L74S.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/tui/safe-stderr.ts"],
+  "sourcesContent": ["import process from 'node:process'\n\n/**\n * The stream Ink renders into \u2014 stderr, with the one escape that can destroy the user's terminal\n * history filtered out.\n *\n * Ink erases the whole terminal whenever a frame overflows the viewport: `renderInteractiveFrame`\n * writes `ansiEscapes.clearTerminal`, which on POSIX is `ESC[2J ESC[3J ESC[H`. The middle one is\n * DECSED 3 \u2014 \"erase saved lines\" \u2014 and it wipes the SCROLLBACK BUFFER, not just the visible region.\n * The session shell puts every command's real output in that scrollback, so a palette frame taller\n * than the window (25 commands vs an 80x24 terminal or a tmux split) would erase the very transcript\n * the shell exists to produce, plus whatever the user had on screen before launching `infra-kit`.\n *\n * Bounding the frame height is NOT a sufficient guard: Ink re-renders on SIGWINCH using the PREVIOUS\n * frame's height against the NEW viewport, so shrinking the window trips the overflow check\n * retroactively, and no window fits a terminal of a handful of rows. So the guard is applied to the\n * bytes instead of the geometry \u2014 `ESC[3J` never reaches the terminal, whatever Ink decides to draw.\n * What survives (`ESC[2J ESC[H`: erase viewport, home cursor) is exactly Ink's intent.\n */\n\n/** DECSED 3 \u2014 \"erase saved lines\". The only escape that can destroy scrollback. */\nconst ERASE_SCROLLBACK = '\\u001B[3J'\n\n/** Drop every scrollback-erasing escape from a frame (split/join: a regex here holds a control char). */\nconst scrub = (chunk: unknown): unknown => {\n  return typeof chunk === 'string' ? chunk.split(ERASE_SCROLLBACK).join('') : chunk\n}\n\n/**\n * Wrap a stream so it can never erase scrollback. Everything except `write` is forwarded to the real\n * stream \u2014 Ink reads `columns`/`rows`/`isTTY` afresh on every frame and subscribes to `'resize'`, so\n * this must be a live view of the stream, not a snapshot of it.\n *\n * @example\n * const written: string[] = []\n * const safe = createSafeStream({ write: (s) => written.push(s) } as unknown as NodeJS.WriteStream)\n * safe.write('\\u001B[2J\\u001B[3J\\u001B[H')\n * written[0] // => '\\u001B[2J\\u001B[H'  (the scrollback-erasing escape is gone)\n */\nexport const createSafeStream = (stream: NodeJS.WriteStream): NodeJS.WriteStream => {\n  return new Proxy(stream, {\n    get(target, property, receiver) {\n      if (property === 'write') {\n        return (chunk: unknown, ...rest: unknown[]): boolean => {\n          return (target.write as (...args: unknown[]) => boolean)(scrub(chunk), ...rest)\n        }\n      }\n\n      const value = Reflect.get(target, property, receiver) as unknown\n\n      // Methods must keep their original `this` (an EventEmitter bound to the proxy would register\n      // listeners on the wrong object), so bind them back to the real stream.\n      return typeof value === 'function' ? value.bind(target) : value\n    },\n  })\n}\n\n/** Ink's render target for the whole CLI: stderr, minus the scrollback-erasing escape. */\nexport const safeStderr = (): NodeJS.WriteStream => {\n  return createSafeStream(process.stderr as unknown as NodeJS.WriteStream)\n}\n"],
+  "mappings": "AAAA,OAAOA,MAAa,eAqBpB,IAAMC,EAAmB,UAGnBC,EAASC,GACN,OAAOA,GAAU,SAAWA,EAAM,MAAMF,CAAgB,EAAE,KAAK,EAAE,EAAIE,EAcjEC,EAAoBC,GACxB,IAAI,MAAMA,EAAQ,CACvB,IAAIC,EAAQC,EAAUC,EAAU,CAC9B,GAAID,IAAa,QACf,MAAO,CAACJ,KAAmBM,IACjBH,EAAO,MAA0CJ,EAAMC,CAAK,EAAG,GAAGM,CAAI,EAIlF,IAAMC,EAAQ,QAAQ,IAAIJ,EAAQC,EAAUC,CAAQ,EAIpD,OAAO,OAAOE,GAAU,WAAaA,EAAM,KAAKJ,CAAM,EAAII,CAC5D,CACF,CAAC,EAIUC,EAAa,IACjBP,EAAiBJ,EAAQ,MAAuC",
+  "names": ["process", "ERASE_SCROLLBACK", "scrub", "chunk", "createSafeStream", "stream", "target", "property", "receiver", "rest", "value", "safeStderr"]
+}

package/dist/{chunk-RXEMP3VI.js → chunk-TFHVQOVF.js}

@@ -1,4 +1,4 @@
-import{v as e}from"./chunk-V37MZDFR.js";var s=()=>{let n="",r=[],o=!1;return{start(t){n=t,r=[],o=!1},setInteractive(){o=!0},addOption(t,a){r.push({flag:t,value:a})},formatOptions(){return r.map(t=>typeof t.value=="boolean"?t.value?t.flag:"":Array.isArray(t.value)?`${t.flag} "${t.value.join(", ")}"`:`${t.flag} "${t.value}"`).filter(Boolean).join(" ")},snapshot(){return r.length===0?null:{formattedOptions:this.formatOptions()}},print(){!o||r.length===0||e.info(`\u{1F4DF} Equivalent command: 
+import{v as i}from"./chunk-3F7XYJWY.js";var s=()=>{let n="",r=[],o=!1;return{start(t){n=t,r=[],o=!1},setInteractive(){o=!0},addOption(t,a){r.push({flag:t,value:a})},formatOptions(){return r.map(t=>typeof t.value=="boolean"?t.value?t.flag:"":Array.isArray(t.value)?`${t.flag} "${t.value.join(", ")}"`:`${t.flag} "${t.value}"`).filter(Boolean).join(" ")},snapshot(){return r.length===0?null:{formattedOptions:this.formatOptions()}},print(){!o||r.length===0||!n||i.info(`\u{1F4DF} Equivalent command: 
 pnpm exec infra-kit ${n} ${this.formatOptions()}
-`)},reset(){n="",r=[],o=!1}}},i=s();import m from"@inquirer/confirm";import f from"node:process";var l=async(n,r)=>{let o=n?!0:await m({message:r});n||i.setInteractive(),o||(e.info("Operation cancelled. Exiting..."),f.exit(0))};export{i as a,l as b};
-//# sourceMappingURL=chunk-RXEMP3VI.js.map
+`)},reset(){n="",r=[],o=!1}}},e=s();import f from"@inquirer/confirm";import l from"node:process";var m=async(n,r)=>{let o=n?!0:await f({message:r});n||e.setInteractive(),o||(i.info("Operation cancelled. Exiting..."),l.exit(0))};export{e as a,m as b};
+//# sourceMappingURL=chunk-TFHVQOVF.js.map

package/dist/chunk-TFHVQOVF.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/lib/command-echo/command-echo.ts", "../src/lib/command-echo/confirm-or-exit.ts"],
+  "sourcesContent": ["import { logger } from 'src/lib/logger'\n\ninterface CommandOption {\n  flag: string\n  value: string | string[] | boolean\n}\n\nconst createCommandEcho = () => {\n  let cliPath = ''\n  let options: CommandOption[] = []\n  let isInteractive = false\n\n  return {\n    /**\n     * Bind the echo to the command about to run, and clear the previous one's recording.\n     *\n     * `cliPath` must be the argv Commander actually parsed (`release create`), which is why the ONLY\n     * caller is program.ts's `preAction` hook, feeding it `commandPath(actionCommand)`. Commands used to\n     * name themselves here, and that is precisely how the printed line rotted: they passed the flat\n     * `release-create`, which stopped being a command the day the flat aliases were dropped, so the\n     * \"equivalent command\" we told the user to retype no longer parsed. Commander is the only thing that\n     * knows the real path, so it is the only thing allowed to say it.\n     */\n    start(path: string): void {\n      cliPath = path\n      options = []\n      isInteractive = false\n    },\n\n    /**\n     * Mark that the command had interactive input (prompts)\n     * Call this once when ANY prompt happens\n     */\n    setInteractive(): void {\n      isInteractive = true\n    },\n\n    /**\n     * Track an option selection\n     * @param flag The CLI flag (e.g., \"--versions\")\n     * @param value The selected value\n     */\n    addOption(flag: string, value: string | string[] | boolean): void {\n      options.push({ flag, value })\n    },\n\n    /**\n     * Format the tracked options into a replayable flag string (empty when none).\n     */\n    formatOptions(): string {\n      return options\n        .map((opt) => {\n          if (typeof opt.value === 'boolean') {\n            return opt.value ? opt.flag : ''\n          }\n\n          if (Array.isArray(opt.value)) {\n            return `${opt.flag} \"${opt.value.join(', ')}\"`\n          }\n\n          return `${opt.flag} \"${opt.value}\"`\n        })\n        .filter(Boolean)\n        .join(' ')\n    },\n\n    /**\n     * The recorded interactive flags for the session shell's report side channel, so the transcript's\n     * equivalent line carries the resolved options (`--versions \"1.2.5\"`), not just the bare command.\n     * `null` when nothing was recorded \u2014 the caller then falls back to the bare spawned argv.\n     */\n    snapshot(): { formattedOptions: string } | null {\n      if (options.length === 0) {\n        return null\n      }\n\n      return { formattedOptions: this.formatOptions() }\n    },\n\n    /**\n     * Print the equivalent CLI command if there was interactive input.\n     *\n     * Silent without a bound `cliPath`: the only caller that binds one is Commander's `preAction`, so an\n     * unbound echo means the command ran off the CLI (an MCP tool), where a `pnpm exec` line would be\n     * nonsense. Printing a path-less `pnpm exec infra-kit --yes` would be worse than printing nothing.\n     */\n    print(): void {\n      if (!isInteractive || options.length === 0 || !cliPath) {\n        return\n      }\n\n      logger.info(`\uD83D\uDCDF Equivalent command: \\npnpm exec infra-kit ${cliPath} ${this.formatOptions()}\\n`)\n    },\n\n    /**\n     * Reset state (useful for testing)\n     */\n    reset(): void {\n      cliPath = ''\n      options = []\n      isInteractive = false\n    },\n  }\n}\n\n// Singleton instance (same pattern as logger)\nexport const commandEcho = createCommandEcho()\n", "import confirm from '@inquirer/confirm'\nimport process from 'node:process'\n\nimport { logger } from 'src/lib/logger'\n\nimport { commandEcho } from './command-echo'\n\n/**\n * Shared interactive-confirmation gate for mutating commands.\n *\n * When `confirmedCommand` is truthy (CLI `--yes` or an MCP call, which always\n * injects `confirmedCommand: true`) the prompt is skipped and execution\n * proceeds. Otherwise it prompts the user, marks the echo as interactive, and\n * exits cleanly if the user declines.\n *\n * The `process.exit(0)` only runs on the interactive-decline path, which is\n * unreachable under MCP \u2014 so this stays safe for the long-lived MCP server.\n *\n * Callers remain responsible for their own `commandEcho.addOption('--yes', \u2026)`\n * bookkeeping, which varies between commands.\n */\nexport const confirmOrExit = async (confirmedCommand: boolean | undefined, message: string): Promise<void> => {\n  const answer = confirmedCommand ? true : await confirm({ message })\n\n  if (!confirmedCommand) {\n    commandEcho.setInteractive()\n  }\n\n  if (!answer) {\n    logger.info('Operation cancelled. Exiting...')\n    process.exit(0)\n  }\n}\n"],
+  "mappings": "wCAOA,IAAMA,EAAoB,IAAM,CAC9B,IAAIC,EAAU,GACVC,EAA2B,CAAC,EAC5BC,EAAgB,GAEpB,MAAO,CAWL,MAAMC,EAAoB,CACxBH,EAAUG,EACVF,EAAU,CAAC,EACXC,EAAgB,EAClB,EAMA,gBAAuB,CACrBA,EAAgB,EAClB,EAOA,UAAUE,EAAcC,EAA0C,CAChEJ,EAAQ,KAAK,CAAE,KAAAG,EAAM,MAAAC,CAAM,CAAC,CAC9B,EAKA,eAAwB,CACtB,OAAOJ,EACJ,IAAKK,GACA,OAAOA,EAAI,OAAU,UAChBA,EAAI,MAAQA,EAAI,KAAO,GAG5B,MAAM,QAAQA,EAAI,KAAK,EAClB,GAAGA,EAAI,IAAI,KAAKA,EAAI,MAAM,KAAK,IAAI,CAAC,IAGtC,GAAGA,EAAI,IAAI,KAAKA,EAAI,KAAK,GACjC,EACA,OAAO,OAAO,EACd,KAAK,GAAG,CACb,EAOA,UAAgD,CAC9C,OAAIL,EAAQ,SAAW,EACd,KAGF,CAAE,iBAAkB,KAAK,cAAc,CAAE,CAClD,EASA,OAAc,CACR,CAACC,GAAiBD,EAAQ,SAAW,GAAK,CAACD,GAI/CO,EAAO,KAAK;AAAA,sBAAgDP,CAAO,IAAI,KAAK,cAAc,CAAC;AAAA,CAAI,CACjG,EAKA,OAAc,CACZA,EAAU,GACVC,EAAU,CAAC,EACXC,EAAgB,EAClB,CACF,CACF,EAGaM,EAAcT,EAAkB,EC1G7C,OAAOU,MAAa,oBACpB,OAAOC,MAAa,eAoBb,IAAMC,EAAgB,MAAOC,EAAuCC,IAAmC,CAC5G,IAAMC,EAASF,EAAmB,GAAO,MAAMG,EAAQ,CAAE,QAAAF,CAAQ,CAAC,EAE7DD,GACHI,EAAY,eAAe,EAGxBF,IACHG,EAAO,KAAK,iCAAiC,EAC7CC,EAAQ,KAAK,CAAC,EAElB",
+  "names": ["createCommandEcho", "cliPath", "options", "isInteractive", "path", "flag", "value", "opt", "logger", "commandEcho", "confirm", "process", "confirmOrExit", "confirmedCommand", "message", "answer", "confirm", "commandEcho", "logger", "process"]
+}

package/dist/{chunk-6EPRH34O.js → chunk-TUVUKM4K.js}

@@ -1,2 +1,2 @@
 import{a as v,b as x,c as y}from"./chunk-LTKR3F4N.js";import{Buffer as K}from"node:buffer";import{execFileSync as L}from"node:child_process";import g from"node:fs";import O from"node:net";import u from"node:path";import p from"node:process";import{pathToFileURL as _}from"node:url";import{z as l}from"zod";import{z as i}from"zod";var P=i.strictObject({requiredScripts:i.array(i.string().min(1)).optional(),requiredFiles:i.array(i.string().min(1)).optional(),turbo:i.strictObject({requiredTasks:i.array(i.string().min(1)).optional()}).optional(),dev:i.strictObject({proxy:i.strictObject({templates:i.strictObject({local:i.string().min(1),cloud:i.string().min(1)}),routes:i.record(i.string().min(1),i.strictObject({packageName:i.string().min(1),from:i.array(i.enum(["local","cloud"])).min(1),default:i.enum(["local","cloud"]).optional()}).refine(e=>e.from.length<=1||e.default!==void 0,{message:"default is required when `from` has more than one source"}).refine(e=>e.default===void 0||e.from.includes(e.default),{message:"default must be listed in `from`"}))}).optional()}).optional()});var R="INFRA_KIT_ENV",k="infra-kit.config.ts",N=u.join(".infra-kit","dev-context"),T=u.join(".infra-kit","dev-context.json"),D=l.object({package:l.string(),port:l.number(),pid:l.number().optional(),writtenAt:l.number().optional(),release:l.string().optional(),alias:l.string().optional(),proxyPort:l.number().optional(),origin:l.string().optional()}),j=(e,t)=>{let r=t?.username??e.E2E__BASIC_AUTH_USERNAME,n=t?.password??e.E2E__BASIC_AUTH_PASSWORD;return!r||!n?void 0:`Basic ${K.from(`${r}:${n}`).toString("base64")}`};var b=(e,t)=>e.replaceAll("<release>",t.release).replaceAll("<packageName>",t.packageName).replaceAll("<env>",t.env),C=80,F="127.0.0.1",S=(e,t)=>{if(t==null||t===C)return e;let r;try{r=new URL(e)}catch{throw new Error(`infra-kit/vite: dev.proxy templates.local resolved to "${e}", which is not a valid URL, so the proxy port ${t} cannot be applied.`)}if(r.port!=="")return e;r.port=String(t);let n=r.toString();return!e.endsWith("/")&&n.endsWith("/")?n.slice(0,-1):n},U=1024,V=(e,t)=>t!=null&&t>=U?S(e.replace(/^https:\/\//iu,"http://"),t):S(e,t),M=e=>{let{route:t,templates:r,env:n,getRelease:a,info:o}=e;if(o?.origin)return o.origin;let s=b(r.local,{release:o?.release??a(),packageName:v(t.packageName),env:n??""});return V(s,o?.proxyPort)},H=(e,t)=>{let r=e.default??e.from[0];return e.from.includes("local")&&t.has(e.packageName)?"local":r},$=new Set(["localhost","127.0.0.1","::1"]),B=e=>{let t;try{t=new URL(e).hostname.toLowerCase()}catch{return!1}let r=t.startsWith("[")&&t.endsWith("]")?t.slice(1,-1):t;return r.endsWith(".localhost")||$.has(r)},W=({routePath:e,route:t,templates:r,localSet:n,env:a,getRelease:o,localInfo:s})=>{if(H(t,n)==="local"){let f=M({route:t,templates:r,env:a,getRelease:o,info:s?.get(t.packageName)});return B(f)?{target:f,changeOrigin:!0,secure:!1}:{target:f,changeOrigin:!0}}if(!a)throw new Error(`infra-kit/vite: proxy route "${e}" resolves to a cloud backend but ${R} is not set. Source an environment from Doppler first (e.g. \`infra-kit env-load -c dev\`).`);return{target:b(r.cloud,{release:"",packageName:t.packageName,env:a}),changeOrigin:!0,secure:!1,cookieDomainRewrite:"localhost"}},J=({proxy:e,localSet:t,env:r,getRelease:n,authHeader:a,localInfo:o})=>{let s={},c=a?{Authorization:a}:void 0;for(let[d,f]of Object.entries(e.routes)){let m=W({routePath:d,route:f,templates:e.templates,localSet:t,env:r,getRelease:n,localInfo:o});s[d]=c?{...m,headers:c}:m}return s},G=e=>{let t;return()=>(t??={value:e()},t.value)},q=async e=>{let t=u.join(e,k);if(!g.existsSync(t))return;let r=g.statSync(t),o=(await import(`${_(t).href}?mtime=${Number(r.mtimeMs)}`)).default;if(o===void 0)return;let s=typeof o=="function"?await o():o,c=P.safeParse(s);if(!c.success)throw new Error(`infra-kit/vite: invalid ${k} at ${t}: ${l.prettifyError(c.error)}`);return c.data.dev},z=e=>{if(Array.isArray(e))return e.filter(t=>typeof t=="string");if(e!==null&&typeof e=="object"){let t=e.packages??e.localPackages;if(Array.isArray(t))return t.filter(r=>typeof r=="string")}return[]},I=(e,t)=>{let r=u.resolve(e);for(;;){let n=u.join(r,t);if(g.existsSync(n))return n;let a=u.dirname(r);if(a===r)return;r=a}},h=()=>({packages:new Set,info:new Map}),X=e=>{if(e==null)return!0;try{return p.kill(e,0),!0}catch(t){return t.code==="EPERM"}},Y=e=>{let t;try{t=g.readdirSync(e)}catch{return h()}let r=new Set,n=new Map;for(let a of t)if(a.endsWith(".json"))try{let o=D.safeParse(JSON.parse(g.readFileSync(u.join(e,a),"utf-8")));if(!o.success||!X(o.data.pid))continue;r.add(o.data.package),n.set(o.data.package,{port:o.data.port,origin:o.data.origin,release:o.data.release,alias:o.data.alias,proxyPort:o.data.proxyPort})}catch{continue}return{packages:r,info:n}},Q=e=>{let t=I(e,N);if(t)return Y(t);let r=I(e,T);if(!r)return h();try{return{packages:new Set(z(JSON.parse(g.readFileSync(r,"utf-8")))),info:new Map}}catch{return h()}};var Z=e=>L("git",["rev-parse","--abbrev-ref","HEAD"],{cwd:e,encoding:"utf-8"}).trim(),ee=()=>new Promise((e,t)=>{let r=O.createServer();r.unref(),r.on("error",t),r.listen(0,"127.0.0.1",()=>{let n=r.address(),a=typeof n=="object"&&n!==null?n.port:0;r.close(()=>e(a))})}),te="INFRA_KIT_UI_PORTS",re=e=>{try{let t=JSON.parse(g.readFileSync(u.join(e,"package.json"),"utf-8"));return typeof t.name=="string"?t.name:null}catch{return null}},ne=e=>{let t=p.env[te];if(t==null||t==="")return null;let r=re(e);if(r==null)return null;try{let n=JSON.parse(t)[r];if(typeof n=="number")return{port:n};if(n===null||typeof n!="object")return null;let{port:a,alias:o}=n;return typeof a!="number"?null:{port:a,alias:typeof o=="string"?o:void 0}}catch{return null}},oe=443,ae=async(e={})=>{let t=e.cwd??p.cwd();if(e.command==="build")return{proxy:{}};let r=e.port==null?ne(t):null,n=e.port??r?.port??await ee(),a=r!=null,o=e.host??F,s=r?.alias==null?void 0:{protocol:"wss",host:r.alias,clientPort:oe},c={port:n,host:o,...a?{strictPort:a}:{},...s?{hmr:s}:{}},d=await q(t);if(!d?.proxy)return{...c,proxy:{}};let{packages:f,info:m}=Q(t),w=p.env[R],A=j(p.env,e.basicAuth),E=G(()=>{try{return x(Z(t))||y}catch{return y}});return{...c,proxy:J({proxy:d.proxy,localSet:f,env:w,getRelease:E,authHeader:A,localInfo:m})}},ve=async(e={})=>(await ae(e)).proxy;export{P as a,J as b,q as c,ae as d,ve as e};
-//# sourceMappingURL=chunk-6EPRH34O.js.map
+//# sourceMappingURL=chunk-TUVUKM4K.js.map

package/dist/chunk-TUVUKM4K.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/lib/vite/vite.ts", "../src/lib/package-config/package-config-schema.ts"],
+  "sourcesContent": ["import { Buffer } from 'node:buffer'\nimport { execFileSync } from 'node:child_process'\nimport fs from 'node:fs'\nimport net from 'node:net'\nimport path from 'node:path'\nimport process from 'node:process'\nimport { pathToFileURL } from 'node:url'\nimport { z } from 'zod'\n\nimport type {\n  InfraKitDev,\n  InfraKitDevProxy,\n  InfraKitDevProxyRoute,\n  InfraKitDevProxySource,\n} from '../package-config/package-config'\nimport { packageConfigSchema } from '../package-config/package-config-schema'\nimport { DEFAULT_RELEASE_SLUG, slugifyHostLabel, slugifyRelease } from '../release-slug/release-slug'\n\n/**\n * Env-name handle read at vite-config time to fill the `<env>` placeholder in a\n * cloud proxy target. Inlined (not imported from `src/lib/constants`) to keep the\n * `infra-kit/vite` bundle's import graph tiny \u2014 see the module header. Kept\n * byte-identical to `INFRA_KIT_ENV_VAR` in `src/lib/constants/constants.ts`.\n */\nconst INFRA_KIT_ENV = 'INFRA_KIT_ENV'\n\n/** Per-package config filename, mirrored from the CLI's `PACKAGE_CONFIG_FILE`. */\nconst PACKAGE_CONFIG_FILE = 'infra-kit.config.ts'\n\n/**\n * Repo-relative dev-context fragment DIRECTORY, searched upward from cwd. Each\n * runner (single-process or cmux pane) writes its OWN `<app>.json` fragment here\n * recording its real bound port + release; the helper merges them (see\n * {@link readLocalContext}). This is the current source of truth.\n */\nconst DEV_CONTEXT_DIR = path.join('.infra-kit', 'dev-context')\n\n/**\n * Legacy single-file dev-context manifest, searched upward from cwd. Read only as\n * a transitional back-compat path when {@link DEV_CONTEXT_DIR} is absent (the\n * directory wins per-package when both exist).\n */\nconst DEV_CONTEXT_FILE = path.join('.infra-kit', 'dev-context.json')\n\n/**\n * One `.infra-kit/dev-context/<app>.json` fragment. `package` is the load-bearing\n * field the helper reads (\u2192 localSet); `origin` is **the authoritative local target** \u2014\n * the exact origin the runner registered, obeyed verbatim by {@link resolveLocalTarget}.\n * The runner is the only party that knows the scheme and port its alias is really served\n * on, so the helper never re-derives them when `origin` is present.\n *\n * `release`, `alias` and `proxyPort` are the LEGACY inputs, read only when `origin` is\n * absent \u2014 which can only happen when an OLD CLI wrote the fragment (a CLI-only rollback).\n * `port` is no longer a proxy target (the direct `127.0.0.1:<port>` branch is gone) \u2014 it\n * survives as diagnostic provenance. `pid` is the staleness guard: {@link readFragmentDir}\n * drops a fragment whose writer is no longer alive, so a crashed runner cannot keep a\n * package pinned `local` at a dead alias. `writtenAt` is provenance only.\n *\n * Kept lenient (not `.strict()`) so extra writer fields never reject a valid fragment, and\n * deliberately un-`refine`d: a rejected fragment would drop a started package to `cloud`\n * instead of falling into legacy mode, which is what makes the rollback path work.\n */\nconst devContextFragmentSchema = z.object({\n  package: z.string(),\n  port: z.number(),\n  pid: z.number().optional(),\n  writtenAt: z.number().optional(),\n  release: z.string().optional(),\n  alias: z.string().optional(),\n  proxyPort: z.number().optional(),\n  origin: z.string().optional(),\n})\n\n/**\n * A single Vite `server.proxy` entry. `changeOrigin` is always set. `cookieDomainRewrite` is cloud-only\n * (it keeps an HTTPS cloud BE's cookies usable from a local FE). `secure: false` appears on BOTH sources\n * but for different reasons: a cloud target may serve a cert the local store rejects, and a local target\n * is served by portless from its own private CA \u2014 set there only for a loopback host (see\n * {@link isLoopbackTarget}). `headers` is present only when HTTP Basic Auth is injected (see\n * {@link buildBasicAuthHeader}) \u2014 it carries the `Authorization` header applied\n * uniformly to every route so upstream environments behind auth (e2e/staging)\n * stay reachable.\n */\nexport interface InfraKitViteProxyEntry {\n  target: string\n  changeOrigin: true\n  secure?: false\n  cookieDomainRewrite?: 'localhost'\n  headers?: Record<string, string>\n}\n\n/** A Vite `server.proxy`-shaped map: path-prefix \u2192 proxy entry. */\nexport type InfraKitViteProxy = Record<string, InfraKitViteProxyEntry>\n\n/** Explicit HTTP Basic Auth credentials, overriding the `E2E__BASIC_AUTH_*` env vars. */\nexport interface InfraKitBasicAuth {\n  username: string\n  password: string\n}\n\nexport interface InfraKitDevOptions {\n  /** Package dir whose `infra-kit.config.ts` is loaded. Defaults to `process.cwd()`. */\n  cwd?: string\n  /**\n   * Explicit HTTP Basic Auth credentials injected into every proxy route as an\n   * `Authorization` header. Takes precedence over the `E2E__BASIC_AUTH_USERNAME`\n   * / `E2E__BASIC_AUTH_PASSWORD` env vars. Omit to use the env-based default.\n   */\n  basicAuth?: InfraKitBasicAuth\n  /**\n   * Vite's `command`. Pass it (`defineConfig(async ({ command }) => ({ server: await infraKitDev({ command }) }))`)\n   * so `build` is a no-op: `server` is irrelevant to a build and proxy resolution would otherwise\n   * fail-fast on a cloud route with no sourced env. Omit (or `'serve'`) for the dev-server config.\n   */\n  command?: 'build' | 'serve'\n  /**\n   * Explicit dev-server port. Omit for a **per-worktree dynamic** free port (a fresh OS-assigned\n   * port) so N simultaneous git worktrees never collide on Vite's default `5173`; Vite prints the\n   * chosen URL. Pass a fixed number only when an external contract pins the port.\n   */\n  port?: number\n  /**\n   * Interface the dev server binds. Defaults to {@link LOOPBACK_V4} so a portless alias can reach it\n   * (Vite's own `localhost` default binds `[::1]` only, which the proxy cannot dial). Override when\n   * the dev server must be reachable off the loopback \u2014 `'0.0.0.0'` or `true` inside a container, on\n   * a LAN, or for an e2e runner on another host.\n   */\n  host?: string | boolean\n}\n\n/**\n * Build the `Authorization: Basic <base64(user:pass)>` header value. Credentials\n * come from `override` when given, else from `E2E__BASIC_AUTH_USERNAME` /\n * `E2E__BASIC_AUTH_PASSWORD` (NOTE: double underscore). Returns `undefined` when\n * either half is missing, so callers add no `headers` key at all.\n */\nconst buildBasicAuthHeader = (env: NodeJS.ProcessEnv, override?: InfraKitBasicAuth): string | undefined => {\n  const username = override?.username ?? env.E2E__BASIC_AUTH_USERNAME\n  const password = override?.password ?? env.E2E__BASIC_AUTH_PASSWORD\n\n  if (!username || !password) return undefined\n\n  const encoded = Buffer.from(`${username}:${password}`).toString('base64')\n\n  return `Basic ${encoded}`\n}\n\n/**\n * Re-exported from the shared, dependency-light `lib/release-slug` module so the\n * published `infra-kit/vite` surface (`entry/vite.ts:7`) is unchanged while the\n * dev-server's fragment writer derives `<release>` from the SAME implementation\n * (no slug drift). See {@link slugifyRelease}.\n */\nexport { slugifyRelease }\n\n/** Fill the `<release>`/`<packageName>`/`<env>` placeholders in a URL template. */\nconst interpolate = (template: string, values: { release: string; packageName: string; env: string }): string => {\n  return template\n    .replaceAll('<release>', values.release)\n    .replaceAll('<packageName>', values.packageName)\n    .replaceAll('<env>', values.env)\n}\n\n/** The port a bare `http://` target implies, and the proxy's default \u2014 never spelled out in a URL. */\nconst DEFAULT_HTTP_PORT = 80\n\n/**\n * The interface the vite dev server binds. Pinned to IPv4 loopback because portless dials its routes\n * on `127.0.0.1`, while vite's default `host: 'localhost'` combined with its\n * `dns.setDefaultResultOrder('verbatim')` binds `[::1]` ONLY \u2014 the alias then resolves, the proxy\n * connects, and the connection is refused, surfacing as a 502 on every UI request. Backends never hit\n * this because `ServerlessLocalRun` already binds `127.0.0.1`. Still loopback-only: this narrows the\n * address family, it does not expose the dev server to the network.\n */\nconst LOOPBACK_V4 = '127.0.0.1'\n\n/**\n * Graft the proxy's listen port onto an interpolated local target. The `dev.proxy` local template is\n * written port-free (`https://<release>.<packageName>.localhost`) because the proxy serves TLS on `:443`,\n * the only port a port-free HTTPS URL can come from. A consumer who trades the clean URL for a zero-sudo\n * unprivileged port still needs the frontend to reach it, so the runner records the port it actually bound\n * and we append it here. A template that already pins its own port keeps it.\n */\nconst withProxyPort = (target: string, proxyPort: number | undefined): string => {\n  if (proxyPort == null || proxyPort === DEFAULT_HTTP_PORT) return target\n\n  let url: URL\n\n  try {\n    url = new URL(target)\n  } catch {\n    throw new Error(\n      `infra-kit/vite: dev.proxy templates.local resolved to \"${target}\", which is not a valid URL, so the proxy port ${proxyPort} cannot be applied.`,\n    )\n  }\n\n  if (url.port !== '') return target\n  url.port = String(proxyPort)\n\n  // `URL.toString()` synthesizes a `/` pathname for an authority-only URL, so the common port-free\n  // template would come back as `\u2026localhost:1355/`. Strip that ONLY when the template had no trailing\n  // slash of its own \u2014 a template ending in `/` (e.g. `\u2026localhost/base/`) means it, and silently\n  // trimming it would change the path the frontend proxies to.\n  const grafted = url.toString()\n\n  return !target.endsWith('/') && grafted.endsWith('/') ? grafted.slice(0, -1) : grafted\n}\n\n/**\n * The lowest port a daemon can bind without root. An origin-less fragment recording a port AT OR ABOVE\n * this was written by an old CLI whose `spawnDaemon` always passed `--no-tls`, so infra-kit itself could\n * only ever have put PLAIN HTTP there. Below it (80/443) the daemon was installed out-of-band, where\n * portless defaults to TLS ON \u2014 which is precisely why the legacy scheme is left alone down there.\n */\nconst LEGACY_SELF_SPAWNED_PORT_FLOOR = 1024\n\n/**\n * Legacy target resolution \u2014 reached ONLY for an origin-less fragment, i.e. one written by an OLD CLI\n * (a CLI-only rollback). It must reproduce the old helper rather than reject anything, because that is\n * what lets the CLI be reverted without touching a single consumer repo.\n *\n * `proxyPort >= 1024`: force the scheme to `http`. **Mitigation, not a proof** \u2014 infra-kit's own\n * `spawnDaemon` always passed `--no-tls`, so an unprivileged daemon *infra-kit created* was always plain\n * HTTP; a HAND-STARTED TLS daemon on such a port (portless's own default is TLS) would be wrongly\n * downgraded here. That corner is accepted: forcing `http` reproduces what the old CLI + old helper\n * already emitted, so it regresses nothing that worked.\n *\n * `proxyPort < 1024` (80/443) or absent: the daemon was installed out-of-band and may well be TLS, and we\n * cannot know. Reproduce the old helper verbatim and NEVER rewrite the scheme \u2014 forcing `http` on a `:443`\n * fragment would emit `http://<alias>:443`, plain HTTP into a TLS listener, the exact silent failure this\n * design exists to remove.\n */\nconst resolveLegacyTarget = (target: string, proxyPort: number | undefined): string => {\n  if (proxyPort != null && proxyPort >= LEGACY_SELF_SPAWNED_PORT_FLOOR) {\n    return withProxyPort(target.replace(/^https:\\/\\//iu, 'http://'), proxyPort)\n  }\n\n  return withProxyPort(target, proxyPort)\n}\n\n/**\n * The proxy target for a route resolved to `local`. The runner PUBLISHES the contract and the helper OBEYS\n * it: when the fragment carries an `origin`, that string is the target verbatim \u2014 the runner is the only\n * party that knows the scheme and port the alias it registered is actually served on, and this helper ships\n * on its own release cadence, so any re-derivation here is a guess that can silently disagree.\n *\n * `templates.local` is consulted ONLY in legacy mode (see {@link resolveLegacyTarget}).\n *\n * The target proxies to a stable HOSTNAME, and the runner re-points that alias at the freshly-bound port\n * on every `--watch` restart, so it self-heals without Vite reloading its config.\n */\nconst resolveLocalTarget = (args: {\n  route: InfraKitDevProxyRoute\n  templates: InfraKitDevProxy['templates']\n  env: string | undefined\n  getRelease: () => string\n  info: LocalPackageInfo | undefined\n}): string => {\n  const { route, templates, env, getRelease, info } = args\n\n  if (info?.origin) return info.origin\n\n  const target = interpolate(templates.local, {\n    // Prefer THIS package's runner-recorded release slug (R4) over the single global git derivation,\n    // so cross-branch FE/BE pairings don't drift the emitted `<release>` from the segment the runner\n    // aliased. Fall back to the global git slug only when the fragment carried no release.\n    release: info?.release ?? getRelease(),\n    // The local template resolves to a `<release>.<packageName>.localhost` alias the dev-server\n    // registered with portless \u2014 which slugifies the package name to a legal DNS label. Slugify\n    // identically here or a scoped name (`@hulyo/client-ui`) emits a target that no alias backs.\n    packageName: slugifyHostLabel(route.packageName),\n    env: env ?? '',\n  })\n\n  return resolveLegacyTarget(target, info?.proxyPort)\n}\n\n/**\n * Pick the effective source for a route: `local` when the route lists `local` as\n * a capability AND its packageName is in the local dev set; otherwise the fallback\n * \u2014 the declared `default` for a multi-source route, or the sole `from` entry for\n * a single-source one. Always resolves (the schema guarantees a usable fallback).\n */\nconst pickSource = (route: InfraKitDevProxyRoute, localSet: ReadonlySet<string>): InfraKitDevProxySource => {\n  // `from` is guaranteed non-empty by the schema, so `from[0]` is always present.\n  const fallback = route.default ?? route.from[0]!\n\n  return route.from.includes('local') && localSet.has(route.packageName) ? 'local' : fallback\n}\n\ninterface ResolveRouteArgs {\n  routePath: string\n  route: InfraKitDevProxyRoute\n  templates: InfraKitDevProxy['templates']\n  localSet: ReadonlySet<string>\n  env: string | undefined\n  getRelease: () => string\n  /** Per-package runtime data (recorded release/port) from the dev-context merge. */\n  localInfo?: ReadonlyMap<string, LocalPackageInfo>\n}\n\n/** Hostnames that can only be this machine \u2014 the only ones a private-CA cert is allowed to go unchecked on. */\nconst LOOPBACK_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1'])\n\n/**\n * Is `target` unambiguously on this machine? Only then may {@link resolveRoute} disable cert validation:\n * `templates.local` is an unconstrained string in a consumer-authored config, so an unconditional\n * `secure: false` in a PUBLISHED helper would silently switch off validation for whatever URL a consumer\n * wrote there. Scoping it to `.localhost`/loopback is what makes \"no MITM surface\" true by construction.\n * An unparseable target is NOT local (the caller then leaves `secure` unset \u2014 fail closed).\n */\nconst isLoopbackTarget = (target: string): boolean => {\n  let hostname: string\n\n  try {\n    hostname = new URL(target).hostname.toLowerCase()\n  } catch {\n    return false\n  }\n\n  // `URL.hostname` brackets an IPv6 literal (`[::1]`); compare the bare address.\n  const bare = hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname\n\n  return bare.endsWith('.localhost') || LOOPBACK_HOSTNAMES.has(bare)\n}\n\n/** Resolve one route into a Vite proxy entry (or throw an actionable error). */\nconst resolveRoute = ({\n  routePath,\n  route,\n  templates,\n  localSet,\n  env,\n  getRelease,\n  localInfo,\n}: ResolveRouteArgs): InfraKitViteProxyEntry => {\n  const source = pickSource(route, localSet)\n\n  if (source === 'local') {\n    const target = resolveLocalTarget({ route, templates, env, getRelease, info: localInfo?.get(route.packageName) })\n\n    // The local target is now HTTPS, served with a cert minted by portless's own private CA. Node's\n    // http-proxy validates the upstream chain against the system store, which does not contain that CA,\n    // so every proxied request fails with SELF_SIGNED_CERT_IN_CHAIN (confirmed empirically \u2014 see\n    // `.omc/research/portless-https-spike.md`). Only a loopback target earns the exemption.\n    return isLoopbackTarget(target) ? { target, changeOrigin: true, secure: false } : { target, changeOrigin: true }\n  }\n\n  if (!env) {\n    throw new Error(\n      `infra-kit/vite: proxy route \"${routePath}\" resolves to a cloud backend but ${INFRA_KIT_ENV} is not set. Source an environment from Doppler first (e.g. \\`infra-kit env-load -c dev\\`).`,\n    )\n  }\n\n  const target = interpolate(templates.cloud, { release: '', packageName: route.packageName, env })\n\n  return { target, changeOrigin: true, secure: false, cookieDomainRewrite: 'localhost' }\n}\n\ninterface ResolveProxyArgs {\n  proxy: InfraKitDevProxy\n  localSet: ReadonlySet<string>\n  env: string | undefined\n  getRelease: () => string\n  /** Pre-computed `Authorization` header value applied uniformly to every route. */\n  authHeader?: string\n  /** Per-package runtime data (recorded release/port) from the dev-context merge. */\n  localInfo?: ReadonlyMap<string, LocalPackageInfo>\n}\n\n/**\n * Pure resolver: turn a `dev.proxy` config + resolved inputs (local set, env,\n * lazy release) into a Vite `server.proxy` map. Side-effect-free so the\n * resolution shape is fully unit-testable. When `authHeader` is set, every route\n * entry gets a matching `headers.Authorization`; otherwise no `headers` key.\n */\nexport const resolveProxyConfig = ({\n  proxy,\n  localSet,\n  env,\n  getRelease,\n  authHeader,\n  localInfo,\n}: ResolveProxyArgs): InfraKitViteProxy => {\n  const result: InfraKitViteProxy = {}\n  const headers = authHeader ? { Authorization: authHeader } : undefined\n\n  for (const [routePath, route] of Object.entries(proxy.routes)) {\n    const entry = resolveRoute({ routePath, route, templates: proxy.templates, localSet, env, getRelease, localInfo })\n\n    result[routePath] = headers ? { ...entry, headers } : entry\n  }\n\n  return result\n}\n\n/** Memoize a zero-arg thunk so `<release>` git resolution runs at most once. */\nconst once = <T>(fn: () => T): (() => T) => {\n  let cached: { value: T } | undefined\n\n  return () => {\n    cached ??= { value: fn() }\n\n    return cached.value\n  }\n}\n\n/**\n * Load a package's `infra-kit.config.ts` and return its `dev` block, or\n * `undefined` when the config or the `dev` key is absent. The `.ts` config is\n * evaluated via Node's native type stripping (Node >= 24) \u2014 the same mechanism\n * the CLI's config loader uses. Cache-busted by mtime so repeated dev-server\n * reloads pick up edits.\n */\nexport const loadDev = async (cwd: string): Promise<InfraKitDev | undefined> => {\n  const configPath = path.join(cwd, PACKAGE_CONFIG_FILE)\n\n  if (!fs.existsSync(configPath)) return undefined\n\n  const stat = fs.statSync(configPath)\n  const moduleUrl = `${pathToFileURL(configPath).href}?mtime=${Number(stat.mtimeMs)}`\n\n  const imported = (await import(moduleUrl)) as { default?: unknown }\n  const rawExport = imported.default\n\n  if (rawExport === undefined) return undefined\n\n  const resolved = typeof rawExport === 'function' ? await (rawExport as () => unknown)() : rawExport\n\n  const parsed = packageConfigSchema.safeParse(resolved)\n\n  if (!parsed.success) {\n    throw new Error(`infra-kit/vite: invalid ${PACKAGE_CONFIG_FILE} at ${configPath}: ${z.prettifyError(parsed.error)}`)\n  }\n\n  return parsed.data.dev\n}\n\n/** Coerce a parsed dev-context.json into the set of locally-running package names. */\nconst extractPackages = (parsed: unknown): string[] => {\n  if (Array.isArray(parsed)) {\n    return parsed.filter((v): v is string => {\n      return typeof v === 'string'\n    })\n  }\n\n  if (parsed !== null && typeof parsed === 'object') {\n    const candidate = (parsed as Record<string, unknown>).packages ?? (parsed as Record<string, unknown>).localPackages\n\n    if (Array.isArray(candidate)) {\n      return candidate.filter((v): v is string => {\n        return typeof v === 'string'\n      })\n    }\n  }\n\n  return []\n}\n\n/** Search upward from `start` for `relative`, returning the first hit or undefined. */\nconst findUp = (start: string, relative: string): string | undefined => {\n  let dir = path.resolve(start)\n\n  for (;;) {\n    const candidate = path.join(dir, relative)\n\n    if (fs.existsSync(candidate)) return candidate\n\n    const parent = path.dirname(dir)\n\n    if (parent === dir) return undefined\n\n    dir = parent\n  }\n}\n\n/** Per-package runtime data merged from the dev-context fragment directory. */\nexport interface LocalPackageInfo {\n  /** The real bound port the runner recorded. Provenance only \u2014 the proxy target is the alias host. */\n  port: number\n  /**\n   * The authoritative local target (`https://<release>.<packageName>.localhost`), published by the\n   * runner. Present \u2192 {@link resolveLocalTarget} uses it verbatim and consults no template. Absent \u2192\n   * the fragment came from an old CLI and the legacy template path runs.\n   */\n  origin?: string\n  /** LEGACY (no `origin`): the runner-recorded release slug, preferred over the helper's git derivation. */\n  release?: string\n  /** LEGACY (no `origin`): `<release>.<packageName>.localhost`, present only when an alias was registered. */\n  alias?: string\n  /** LEGACY (no `origin`): the port {@link alias} resolves on. `80` (the default) is implicit in the template. */\n  proxyPort?: number\n}\n\n/**\n * The locally-running package set plus a `package \u2192 { port, release }` map merged\n * from the dev-context fragments. `packages` feeds `pickSource`; `info` lets a\n * `local` route emit the per-package recorded release (see {@link resolveRoute}).\n */\nexport interface LocalContext {\n  packages: ReadonlySet<string>\n  info: ReadonlyMap<string, LocalPackageInfo>\n}\n\n/** An empty {@link LocalContext} (frontend-only / dev-context absent). */\nconst emptyLocalContext = (): LocalContext => {\n  return { packages: new Set(), info: new Map() }\n}\n\n/**\n * Is the runner that wrote a fragment still alive? Signal `0` performs the permission and existence\n * checks without delivering anything. `ESRCH` is the one answer that means \"gone\"; `EPERM` means the\n * pid exists under another uid, which is still a live process. A fragment with no `pid` predates the\n * field and is trusted (back-compat) rather than dropped.\n */\nconst isFragmentWriterAlive = (pid: number | undefined): boolean => {\n  if (pid == null) return true\n\n  try {\n    process.kill(pid, 0)\n\n    return true\n  } catch (error) {\n    return (error as NodeJS.ErrnoException).code === 'EPERM'\n  }\n}\n\n/**\n * Merge every `<app>.json` fragment in the dev-context directory into a\n * {@link LocalContext}. Two DISTINCT failure branches (do NOT collapse them into\n * one directory-wide catch):\n *  - `readdir`-ENOENT (directory vanished mid-race) \u2192 empty context, matching the\n *    dir-absent back-compat behaviour.\n *  - a single corrupt/truncated/invalid `<app>.json` \u2192 that ONE fragment is\n *    SKIPPED (per-fragment `safeParse` isolation); the rest still merge, so one bad\n *    fragment never collapses the whole localSet to empty (which would silently\n *    drop a started package to cloud).\n */\nconst readFragmentDir = (dir: string): LocalContext => {\n  let entries: string[]\n\n  try {\n    entries = fs.readdirSync(dir)\n  } catch {\n    return emptyLocalContext()\n  }\n\n  const packages = new Set<string>()\n  const info = new Map<string, LocalPackageInfo>()\n\n  for (const name of entries) {\n    if (!name.endsWith('.json')) continue\n\n    try {\n      const parsed = devContextFragmentSchema.safeParse(JSON.parse(fs.readFileSync(path.join(dir, name), 'utf-8')))\n\n      if (!parsed.success) continue\n\n      // A runner killed with SIGKILL (or crashed) leaves its fragment AND its portless alias behind.\n      // Trusting it would route this package's `/api` at an alias nothing serves \u2014 a silent 502 with\n      // no diagnostic. The writer already stamps its pid; honour it.\n      if (!isFragmentWriterAlive(parsed.data.pid)) continue\n\n      packages.add(parsed.data.package)\n      info.set(parsed.data.package, {\n        port: parsed.data.port,\n        origin: parsed.data.origin,\n        release: parsed.data.release,\n        alias: parsed.data.alias,\n        proxyPort: parsed.data.proxyPort,\n      })\n    } catch {\n      // Corrupt/truncated fragment (JSON.parse / read failure): skip ONLY this one.\n      continue\n    }\n  }\n\n  return { packages, info }\n}\n\n/**\n * Read the locally-running package context, searched upward from `cwd`. Prefers\n * the `.infra-kit/dev-context/` fragment DIRECTORY (merged via\n * {@link readFragmentDir}); when it is absent, falls back to the legacy single\n * `.infra-kit/dev-context.json` file (read as before \u2014 no per-package release);\n * when neither exists \u2192 empty context (frontend-only, every route resolves cloud).\n */\nexport const readLocalContext = (cwd: string): LocalContext => {\n  const dir = findUp(cwd, DEV_CONTEXT_DIR)\n\n  if (dir) return readFragmentDir(dir)\n\n  const legacy = findUp(cwd, DEV_CONTEXT_FILE)\n\n  if (!legacy) return emptyLocalContext()\n\n  try {\n    return { packages: new Set(extractPackages(JSON.parse(fs.readFileSync(legacy, 'utf-8')))), info: new Map() }\n  } catch {\n    return emptyLocalContext()\n  }\n}\n\n/**\n * Read the set of locally-running packages (searched upward from `cwd`). Thin\n * wrapper over {@link readLocalContext} preserving the historical `Set`-returning\n * contract. Absent dev-context \u2192 empty set (frontend-only cloud resolution).\n */\nexport const readLocalSet = (cwd: string): ReadonlySet<string> => {\n  return readLocalContext(cwd).packages\n}\n\n/** Current git branch of `cwd` (raw, un-slugified). */\nconst readGitBranch = (cwd: string): string => {\n  // eslint-disable-next-line sonarjs/no-os-command-from-path\n  return execFileSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { cwd, encoding: 'utf-8' }).trim()\n}\n\n/**\n * An OS-assigned free TCP port on 127.0.0.1 \u2014 the per-worktree dev-server port (mirrors the\n * backend's `listen(0)`). This probes then releases the port, so there is a small TOCTOU window\n * before Vite binds it; Vite's default `strictPort: false` absorbs a lost race by stepping to the\n * next free port. Only a consumer that sets `strictPort: true` would hard-fail on the rare collision.\n */\nconst getFreePort = (): Promise<number> => {\n  return new Promise((resolve, reject) => {\n    const srv = net.createServer()\n\n    srv.unref()\n    srv.on('error', reject)\n    srv.listen(0, '127.0.0.1', () => {\n      const address = srv.address()\n      const port = typeof address === 'object' && address !== null ? address.port : 0\n\n      srv.close(() => {\n        return resolve(port)\n      })\n    })\n  })\n}\n\n/** Env var carrying the runner-assigned `{ \"<ui-package>\": <port> }` map (Layer B). */\nconst UI_PORTS_ENV = 'INFRA_KIT_UI_PORTS'\n\n/** This package's `package.json` `name`, or `null` (unreadable / nameless). */\nconst readPackageName = (cwd: string): string | null => {\n  try {\n    const parsed = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf-8')) as { name?: unknown }\n\n    return typeof parsed.name === 'string' ? parsed.name : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * What the runner assigned THIS UI. `alias` is present only in the widened record form, i.e. only when the\n * runner both assigned the port AND registered the hostname \u2014 which is exactly the condition for pointing\n * HMR at that hostname. The legacy bare-number form yields no alias.\n */\ninterface ManagedUi {\n  port: number\n  alias?: string\n}\n\n/**\n * What `infra-kit dev` assigned THIS UI via `INFRA_KIT_UI_PORTS` (Layer B), or `null` when the map is\n * absent / this package isn't in it / it's malformed. Present \u2192 the helper binds the port with\n * `strictPort` so vite lands on exactly the port the runner already aliased. Absent (a standalone\n * `vite dev`) \u2192 the caller falls back to a free port, byte-identical to today.\n *\n * Accepts BOTH the widened `{ port, alias }` record and the legacy bare `<port>` number an older runner\n * writes \u2014 a new helper paired with an old CLI must still bind the assigned port.\n */\nconst resolveManagedUi = (cwd: string): ManagedUi | null => {\n  const raw = process.env[UI_PORTS_ENV]\n\n  if (raw == null || raw === '') return null\n\n  const name = readPackageName(cwd)\n\n  if (name == null) return null\n\n  try {\n    const entry = (JSON.parse(raw) as Record<string, unknown>)[name]\n\n    if (typeof entry === 'number') return { port: entry }\n\n    if (entry === null || typeof entry !== 'object') return null\n\n    const { port, alias } = entry as { port?: unknown; alias?: unknown }\n\n    if (typeof port !== 'number') return null\n\n    return { port, alias: typeof alias === 'string' ? alias : undefined }\n  } catch {\n    return null\n  }\n}\n\n/** The port an `https://` alias is served on \u2014 never spelled out in a URL, and what the HMR client dials. */\nconst HTTPS_PORT = 443\n\n/**\n * Vite's `server.hmr` override, pointing the HMR client at the alias instead of at the raw dev-server port.\n * The page is loaded over `https://<alias>`, so its websocket must be `wss://` on the same origin or the\n * browser blocks it as mixed content; `clientPort` is the proxy's implicit `:443`, not vite's bound port.\n */\nexport interface InfraKitViteHmr {\n  protocol: 'wss'\n  host: string\n  clientPort: number\n}\n\n/**\n * Resolve a package's `dev` block into a ready-made Vite `server` config: a per-worktree dev-server\n * `port` plus the `proxy` map. Loads the package's `infra-kit.config.ts`, merges the local dev set\n * from the `.infra-kit/dev-context/` fragment directory, and interpolates the local/cloud templates.\n * `<env>` comes from `INFRA_KIT_ENV`; `<release>` from each package's runner-recorded fragment when\n * present, else the slugified git branch (computed lazily, only when a local route needs it).\n *\n * `port` defaults to a fresh OS-assigned free port so simultaneous git worktrees never collide on\n * Vite's `5173` (override via `options.port`). `host` defaults to {@link LOOPBACK_V4} so the portless\n * alias can actually reach it (override via `options.host` for containers/LAN). `hmr` is emitted only\n * when `infra-kit dev` registered an alias for this UI, so a bare `vite dev` keeps vite's own HMR\n * defaults. Pass `command` so `build` is a no-op (empty proxy, no port) \u2014 a build ignores `server` and\n * proxy resolution would otherwise fail-fast on a cloud route with no sourced env.\n *\n * @example\n * // vite.config.ts \u2014 the whole `server` field is the helper's output\n * import { infraKitDev } from 'infra-kit/vite'\n * export default defineConfig(async ({ command }) => ({ server: await infraKitDev({ command }) }))\n */\nexport const infraKitDev = async (\n  options: InfraKitDevOptions = {},\n): Promise<{\n  port?: number\n  host?: string | boolean\n  strictPort?: boolean\n  hmr?: InfraKitViteHmr\n  proxy: InfraKitViteProxy\n}> => {\n  const cwd = options.cwd ?? process.cwd()\n\n  // A build ignores `server`; skip the port + proxy work (proxy resolution would fail-fast on a\n  // cloud route with no sourced env).\n  if (options.command === 'build') return { proxy: {} }\n\n  // Port precedence: explicit `options.port` > the runner-assigned Layer-B port (bound `strictPort` so\n  // vite lands on exactly the aliased port) > a fresh free port (today's default; the portless-off path).\n  const managed = options.port == null ? resolveManagedUi(cwd) : null\n  const port = options.port ?? managed?.port ?? (await getFreePort())\n  const strictPort = managed != null\n  const host = options.host ?? LOOPBACK_V4\n\n  // Override HMR ONLY when the runner handed us the alias it registered. A bare `vite dev` (no runner)\n  // has no alias, and a computable hostname is not a registered one \u2014 pointing the HMR client at a\n  // hostname nothing resolves would break hot reload on a path that works today.\n  const hmr: InfraKitViteHmr | undefined =\n    managed?.alias == null ? undefined : { protocol: 'wss', host: managed.alias, clientPort: HTTPS_PORT }\n  const server = { port, host, ...(strictPort ? { strictPort } : {}), ...(hmr ? { hmr } : {}) }\n  const dev = await loadDev(cwd)\n\n  if (!dev?.proxy) return { ...server, proxy: {} }\n\n  const { packages: localSet, info: localInfo } = readLocalContext(cwd)\n  const env = process.env[INFRA_KIT_ENV]\n  const authHeader = buildBasicAuthHeader(process.env, options.basicAuth)\n  const getRelease = once(() => {\n    // Mirrors the dev-server's `readAppRelease`: outside a git repo both sides must land on the SAME\n    // label, or this target names a host the runner never aliased.\n    try {\n      return slugifyRelease(readGitBranch(cwd)) || DEFAULT_RELEASE_SLUG\n    } catch {\n      return DEFAULT_RELEASE_SLUG\n    }\n  })\n\n  return {\n    ...server,\n    proxy: resolveProxyConfig({ proxy: dev.proxy, localSet, env, getRelease, authHeader, localInfo }),\n  }\n}\n\n/**\n * Convenience wrapper returning just the proxy map (for spreading into\n * `server.proxy` directly). Equivalent to `(await infraKitDev(options)).proxy`.\n */\nexport const infraKitProxy = async (options: InfraKitDevOptions = {}): Promise<InfraKitViteProxy> => {\n  return (await infraKitDev(options)).proxy\n}\n", "import { z } from 'zod'\n\n/**\n * Schema for the resolved (post-factory) package config object. `strictObject`\n * rejects unknown keys so typos in `infra-kit.config.ts` surface as validation\n * errors instead of being silently ignored.\n *\n * Kept in its own module \u2014 separate from the public `defineConfig`/types entry \u2014\n * so the published `infra-kit` type surface stays free of a `zod` import.\n */\nexport const packageConfigSchema = z.strictObject({\n  requiredScripts: z.array(z.string().min(1)).optional(),\n  requiredFiles: z.array(z.string().min(1)).optional(),\n  turbo: z\n    .strictObject({\n      requiredTasks: z.array(z.string().min(1)).optional(),\n    })\n    .optional(),\n  dev: z\n    .strictObject({\n      proxy: z\n        .strictObject({\n          templates: z.strictObject({\n            local: z.string().min(1),\n            cloud: z.string().min(1),\n          }),\n          routes: z.record(\n            z.string().min(1),\n            z\n              .strictObject({\n                packageName: z.string().min(1),\n                from: z.array(z.enum(['local', 'cloud'])).min(1),\n                default: z.enum(['local', 'cloud']).optional(),\n              })\n              .refine(\n                (route) => {\n                  return route.from.length <= 1 || route.default !== undefined\n                },\n                {\n                  message: 'default is required when `from` has more than one source',\n                },\n              )\n              .refine(\n                (route) => {\n                  return route.default === undefined || route.from.includes(route.default)\n                },\n                {\n                  message: 'default must be listed in `from`',\n                },\n              ),\n          ),\n        })\n        .optional(),\n    })\n    .optional(),\n})\n"],
+  "mappings": "sDAAA,OAAS,UAAAA,MAAc,cACvB,OAAS,gBAAAC,MAAoB,qBAC7B,OAAOC,MAAQ,UACf,OAAOC,MAAS,WAChB,OAAOC,MAAU,YACjB,OAAOC,MAAa,eACpB,OAAS,iBAAAC,MAAqB,WAC9B,OAAS,KAAAC,MAAS,MCPlB,OAAS,KAAAC,MAAS,MAUX,IAAMC,EAAsBD,EAAE,aAAa,CAChD,gBAAiBA,EAAE,MAAMA,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS,EACrD,cAAeA,EAAE,MAAMA,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS,EACnD,MAAOA,EACJ,aAAa,CACZ,cAAeA,EAAE,MAAMA,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS,CACrD,CAAC,EACA,SAAS,EACZ,IAAKA,EACF,aAAa,CACZ,MAAOA,EACJ,aAAa,CACZ,UAAWA,EAAE,aAAa,CACxB,MAAOA,EAAE,OAAO,EAAE,IAAI,CAAC,EACvB,MAAOA,EAAE,OAAO,EAAE,IAAI,CAAC,CACzB,CAAC,EACD,OAAQA,EAAE,OACRA,EAAE,OAAO,EAAE,IAAI,CAAC,EAChBA,EACG,aAAa,CACZ,YAAaA,EAAE,OAAO,EAAE,IAAI,CAAC,EAC7B,KAAMA,EAAE,MAAMA,EAAE,KAAK,CAAC,QAAS,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,EAC/C,QAASA,EAAE,KAAK,CAAC,QAAS,OAAO,CAAC,EAAE,SAAS,CAC/C,CAAC,EACA,OACEE,GACQA,EAAM,KAAK,QAAU,GAAKA,EAAM,UAAY,OAErD,CACE,QAAS,0DACX,CACF,EACC,OACEA,GACQA,EAAM,UAAY,QAAaA,EAAM,KAAK,SAASA,EAAM,OAAO,EAEzE,CACE,QAAS,kCACX,CACF,CACJ,CACF,CAAC,EACA,SAAS,CACd,CAAC,EACA,SAAS,CACd,CAAC,ED/BD,IAAMC,EAAgB,gBAGhBC,EAAsB,sBAQtBC,EAAkBC,EAAK,KAAK,aAAc,aAAa,EAOvDC,EAAmBD,EAAK,KAAK,aAAc,kBAAkB,EAoB7DE,EAA2BC,EAAE,OAAO,CACxC,QAASA,EAAE,OAAO,EAClB,KAAMA,EAAE,OAAO,EACf,IAAKA,EAAE,OAAO,EAAE,SAAS,EACzB,UAAWA,EAAE,OAAO,EAAE,SAAS,EAC/B,QAASA,EAAE,OAAO,EAAE,SAAS,EAC7B,MAAOA,EAAE,OAAO,EAAE,SAAS,EAC3B,UAAWA,EAAE,OAAO,EAAE,SAAS,EAC/B,OAAQA,EAAE,OAAO,EAAE,SAAS,CAC9B,CAAC,EAiEKC,EAAuB,CAACC,EAAwBC,IAAqD,CACzG,IAAMC,EAAWD,GAAU,UAAYD,EAAI,yBACrCG,EAAWF,GAAU,UAAYD,EAAI,yBAE3C,MAAI,CAACE,GAAY,CAACC,EAAU,OAIrB,SAFSC,EAAO,KAAK,GAAGF,CAAQ,IAAIC,CAAQ,EAAE,EAAE,SAAS,QAAQ,CAEjD,EACzB,EAWA,IAAME,EAAc,CAACC,EAAkBC,IAC9BD,EACJ,WAAW,YAAaC,EAAO,OAAO,EACtC,WAAW,gBAAiBA,EAAO,WAAW,EAC9C,WAAW,QAASA,EAAO,GAAG,EAI7BC,EAAoB,GAUpBC,EAAc,YASdC,EAAgB,CAACC,EAAgBC,IAA0C,CAC/E,GAAIA,GAAa,MAAQA,IAAcJ,EAAmB,OAAOG,EAEjE,IAAIE,EAEJ,GAAI,CACFA,EAAM,IAAI,IAAIF,CAAM,CACtB,MAAQ,CACN,MAAM,IAAI,MACR,0DAA0DA,CAAM,kDAAkDC,CAAS,qBAC7H,CACF,CAEA,GAAIC,EAAI,OAAS,GAAI,OAAOF,EAC5BE,EAAI,KAAO,OAAOD,CAAS,EAM3B,IAAME,EAAUD,EAAI,SAAS,EAE7B,MAAO,CAACF,EAAO,SAAS,GAAG,GAAKG,EAAQ,SAAS,GAAG,EAAIA,EAAQ,MAAM,EAAG,EAAE,EAAIA,CACjF,EAQMC,EAAiC,KAkBjCC,EAAsB,CAACL,EAAgBC,IACvCA,GAAa,MAAQA,GAAaG,EAC7BL,EAAcC,EAAO,QAAQ,gBAAiB,SAAS,EAAGC,CAAS,EAGrEF,EAAcC,EAAQC,CAAS,EAclCK,EAAsBC,GAMd,CACZ,GAAM,CAAE,MAAAC,EAAO,UAAAC,EAAW,IAAAC,EAAK,WAAAC,EAAY,KAAAC,CAAK,EAAIL,EAEpD,GAAIK,GAAM,OAAQ,OAAOA,EAAK,OAE9B,IAAMZ,EAASN,EAAYe,EAAU,MAAO,CAI1C,QAASG,GAAM,SAAWD,EAAW,EAIrC,YAAaE,EAAiBL,EAAM,WAAW,EAC/C,IAAKE,GAAO,EACd,CAAC,EAED,OAAOL,EAAoBL,EAAQY,GAAM,SAAS,CACpD,EAQME,EAAa,CAACN,EAA8BO,IAA0D,CAE1G,IAAMC,EAAWR,EAAM,SAAWA,EAAM,KAAK,CAAC,EAE9C,OAAOA,EAAM,KAAK,SAAS,OAAO,GAAKO,EAAS,IAAIP,EAAM,WAAW,EAAI,QAAUQ,CACrF,EAcMC,EAAqB,IAAI,IAAI,CAAC,YAAa,YAAa,KAAK,CAAC,EAS9DC,EAAoBlB,GAA4B,CACpD,IAAImB,EAEJ,GAAI,CACFA,EAAW,IAAI,IAAInB,CAAM,EAAE,SAAS,YAAY,CAClD,MAAQ,CACN,MAAO,EACT,CAGA,IAAMoB,EAAOD,EAAS,WAAW,GAAG,GAAKA,EAAS,SAAS,GAAG,EAAIA,EAAS,MAAM,EAAG,EAAE,EAAIA,EAE1F,OAAOC,EAAK,SAAS,YAAY,GAAKH,EAAmB,IAAIG,CAAI,CACnE,EAGMC,EAAe,CAAC,CACpB,UAAAC,EACA,MAAAd,EACA,UAAAC,EACA,SAAAM,EACA,IAAAL,EACA,WAAAC,EACA,UAAAY,CACF,IAAgD,CAG9C,GAFeT,EAAWN,EAAOO,CAAQ,IAE1B,QAAS,CACtB,IAAMf,EAASM,EAAmB,CAAE,MAAAE,EAAO,UAAAC,EAAW,IAAAC,EAAK,WAAAC,EAAY,KAAMY,GAAW,IAAIf,EAAM,WAAW,CAAE,CAAC,EAMhH,OAAOU,EAAiBlB,CAAM,EAAI,CAAE,OAAAA,EAAQ,aAAc,GAAM,OAAQ,EAAM,EAAI,CAAE,OAAAA,EAAQ,aAAc,EAAK,CACjH,CAEA,GAAI,CAACU,EACH,MAAM,IAAI,MACR,gCAAgCY,CAAS,qCAAqCE,CAAa,6FAC7F,EAKF,MAAO,CAAE,OAFM9B,EAAYe,EAAU,MAAO,CAAE,QAAS,GAAI,YAAaD,EAAM,YAAa,IAAAE,CAAI,CAAC,EAE/E,aAAc,GAAM,OAAQ,GAAO,oBAAqB,WAAY,CACvF,EAmBae,EAAqB,CAAC,CACjC,MAAAC,EACA,SAAAX,EACA,IAAAL,EACA,WAAAC,EACA,WAAAgB,EACA,UAAAJ,CACF,IAA2C,CACzC,IAAMK,EAA4B,CAAC,EAC7BC,EAAUF,EAAa,CAAE,cAAeA,CAAW,EAAI,OAE7D,OAAW,CAACL,EAAWd,CAAK,IAAK,OAAO,QAAQkB,EAAM,MAAM,EAAG,CAC7D,IAAMI,EAAQT,EAAa,CAAE,UAAAC,EAAW,MAAAd,EAAO,UAAWkB,EAAM,UAAW,SAAAX,EAAU,IAAAL,EAAK,WAAAC,EAAY,UAAAY,CAAU,CAAC,EAEjHK,EAAON,CAAS,EAAIO,EAAU,CAAE,GAAGC,EAAO,QAAAD,CAAQ,EAAIC,CACxD,CAEA,OAAOF,CACT,EAGMG,EAAWC,GAA2B,CAC1C,IAAIC,EAEJ,MAAO,KACLA,IAAW,CAAE,MAAOD,EAAG,CAAE,EAElBC,EAAO,MAElB,EASaC,EAAU,MAAOC,GAAkD,CAC9E,IAAMC,EAAaC,EAAK,KAAKF,EAAKG,CAAmB,EAErD,GAAI,CAACC,EAAG,WAAWH,CAAU,EAAG,OAEhC,IAAMI,EAAOD,EAAG,SAASH,CAAU,EAI7BK,GADY,MAAM,OAFN,GAAGC,EAAcN,CAAU,EAAE,IAAI,UAAU,OAAOI,EAAK,OAAO,CAAC,KAGtD,QAE3B,GAAIC,IAAc,OAAW,OAE7B,IAAME,EAAW,OAAOF,GAAc,WAAa,MAAOA,EAA4B,EAAIA,EAEpFG,EAASC,EAAoB,UAAUF,CAAQ,EAErD,GAAI,CAACC,EAAO,QACV,MAAM,IAAI,MAAM,2BAA2BN,CAAmB,OAAOF,CAAU,KAAKU,EAAE,cAAcF,EAAO,KAAK,CAAC,EAAE,EAGrH,OAAOA,EAAO,KAAK,GACrB,EAGMG,EAAmBH,GAA8B,CACrD,GAAI,MAAM,QAAQA,CAAM,EACtB,OAAOA,EAAO,OAAQI,GACb,OAAOA,GAAM,QACrB,EAGH,GAAIJ,IAAW,MAAQ,OAAOA,GAAW,SAAU,CACjD,IAAMK,EAAaL,EAAmC,UAAaA,EAAmC,cAEtG,GAAI,MAAM,QAAQK,CAAS,EACzB,OAAOA,EAAU,OAAQD,GAChB,OAAOA,GAAM,QACrB,CAEL,CAEA,MAAO,CAAC,CACV,EAGME,EAAS,CAACC,EAAeC,IAAyC,CACtE,IAAIC,EAAMhB,EAAK,QAAQc,CAAK,EAE5B,OAAS,CACP,IAAMF,EAAYZ,EAAK,KAAKgB,EAAKD,CAAQ,EAEzC,GAAIb,EAAG,WAAWU,CAAS,EAAG,OAAOA,EAErC,IAAMK,EAASjB,EAAK,QAAQgB,CAAG,EAE/B,GAAIC,IAAWD,EAAK,OAEpBA,EAAMC,CACR,CACF,EA+BMC,EAAoB,KACjB,CAAE,SAAU,IAAI,IAAO,KAAM,IAAI,GAAM,GAS1CC,EAAyBC,GAAqC,CAClE,GAAIA,GAAO,KAAM,MAAO,GAExB,GAAI,CACF,OAAAC,EAAQ,KAAKD,EAAK,CAAC,EAEZ,EACT,OAASE,EAAO,CACd,OAAQA,EAAgC,OAAS,OACnD,CACF,EAaMC,EAAmBP,GAA8B,CACrD,IAAIQ,EAEJ,GAAI,CACFA,EAAUtB,EAAG,YAAYc,CAAG,CAC9B,MAAQ,CACN,OAAOE,EAAkB,CAC3B,CAEA,IAAMO,EAAW,IAAI,IACflD,EAAO,IAAI,IAEjB,QAAWmD,KAAQF,EACjB,GAAKE,EAAK,SAAS,OAAO,EAE1B,GAAI,CACF,IAAMnB,EAASoB,EAAyB,UAAU,KAAK,MAAMzB,EAAG,aAAaF,EAAK,KAAKgB,EAAKU,CAAI,EAAG,OAAO,CAAC,CAAC,EAO5G,GALI,CAACnB,EAAO,SAKR,CAACY,EAAsBZ,EAAO,KAAK,GAAG,EAAG,SAE7CkB,EAAS,IAAIlB,EAAO,KAAK,OAAO,EAChChC,EAAK,IAAIgC,EAAO,KAAK,QAAS,CAC5B,KAAMA,EAAO,KAAK,KAClB,OAAQA,EAAO,KAAK,OACpB,QAASA,EAAO,KAAK,QACrB,MAAOA,EAAO,KAAK,MACnB,UAAWA,EAAO,KAAK,SACzB,CAAC,CACH,MAAQ,CAEN,QACF,CAGF,MAAO,CAAE,SAAAkB,EAAU,KAAAlD,CAAK,CAC1B,EASaqD,EAAoB9B,GAA8B,CAC7D,IAAMkB,EAAMH,EAAOf,EAAK+B,CAAe,EAEvC,GAAIb,EAAK,OAAOO,EAAgBP,CAAG,EAEnC,IAAMc,EAASjB,EAAOf,EAAKiC,CAAgB,EAE3C,GAAI,CAACD,EAAQ,OAAOZ,EAAkB,EAEtC,GAAI,CACF,MAAO,CAAE,SAAU,IAAI,IAAIR,EAAgB,KAAK,MAAMR,EAAG,aAAa4B,EAAQ,OAAO,CAAC,CAAC,CAAC,EAAG,KAAM,IAAI,GAAM,CAC7G,MAAQ,CACN,OAAOZ,EAAkB,CAC3B,CACF,EAYA,IAAMc,EAAiBC,GAEdC,EAAa,MAAO,CAAC,YAAa,eAAgB,MAAM,EAAG,CAAE,IAAAD,EAAK,SAAU,OAAQ,CAAC,EAAE,KAAK,EAS/FE,GAAc,IACX,IAAI,QAAQ,CAACC,EAASC,IAAW,CACtC,IAAMC,EAAMC,EAAI,aAAa,EAE7BD,EAAI,MAAM,EACVA,EAAI,GAAG,QAASD,CAAM,EACtBC,EAAI,OAAO,EAAG,YAAa,IAAM,CAC/B,IAAME,EAAUF,EAAI,QAAQ,EACtBG,EAAO,OAAOD,GAAY,UAAYA,IAAY,KAAOA,EAAQ,KAAO,EAE9EF,EAAI,MAAM,IACDF,EAAQK,CAAI,CACpB,CACH,CAAC,CACH,CAAC,EAIGC,GAAe,qBAGfC,GAAmBV,GAA+B,CACtD,GAAI,CACF,IAAMW,EAAS,KAAK,MAAMC,EAAG,aAAaC,EAAK,KAAKb,EAAK,cAAc,EAAG,OAAO,CAAC,EAElF,OAAO,OAAOW,EAAO,MAAS,SAAWA,EAAO,KAAO,IACzD,MAAQ,CACN,OAAO,IACT,CACF,EAqBMG,GAAoBd,GAAkC,CAC1D,IAAMe,EAAMC,EAAQ,IAAIP,EAAY,EAEpC,GAAIM,GAAO,MAAQA,IAAQ,GAAI,OAAO,KAEtC,IAAME,EAAOP,GAAgBV,CAAG,EAEhC,GAAIiB,GAAQ,KAAM,OAAO,KAEzB,GAAI,CACF,IAAMC,EAAS,KAAK,MAAMH,CAAG,EAA8BE,CAAI,EAE/D,GAAI,OAAOC,GAAU,SAAU,MAAO,CAAE,KAAMA,CAAM,EAEpD,GAAIA,IAAU,MAAQ,OAAOA,GAAU,SAAU,OAAO,KAExD,GAAM,CAAE,KAAAV,EAAM,MAAAW,CAAM,EAAID,EAExB,OAAI,OAAOV,GAAS,SAAiB,KAE9B,CAAE,KAAAA,EAAM,MAAO,OAAOW,GAAU,SAAWA,EAAQ,MAAU,CACtE,MAAQ,CACN,OAAO,IACT,CACF,EAGMC,GAAa,IAgCNC,GAAc,MACzBC,EAA8B,CAAC,IAO3B,CACJ,IAAMtB,EAAMsB,EAAQ,KAAON,EAAQ,IAAI,EAIvC,GAAIM,EAAQ,UAAY,QAAS,MAAO,CAAE,MAAO,CAAC,CAAE,EAIpD,IAAMC,EAAUD,EAAQ,MAAQ,KAAOR,GAAiBd,CAAG,EAAI,KACzDQ,EAAOc,EAAQ,MAAQC,GAAS,MAAS,MAAMrB,GAAY,EAC3DsB,EAAaD,GAAW,KACxBE,EAAOH,EAAQ,MAAQI,EAKvBC,EACJJ,GAAS,OAAS,KAAO,OAAY,CAAE,SAAU,MAAO,KAAMA,EAAQ,MAAO,WAAYH,EAAW,EAChGQ,EAAS,CAAE,KAAApB,EAAM,KAAAiB,EAAM,GAAID,EAAa,CAAE,WAAAA,CAAW,EAAI,CAAC,EAAI,GAAIG,EAAM,CAAE,IAAAA,CAAI,EAAI,CAAC,CAAG,EACtFE,EAAM,MAAMC,EAAQ9B,CAAG,EAE7B,GAAI,CAAC6B,GAAK,MAAO,MAAO,CAAE,GAAGD,EAAQ,MAAO,CAAC,CAAE,EAE/C,GAAM,CAAE,SAAUG,EAAU,KAAMC,CAAU,EAAIC,EAAiBjC,CAAG,EAC9DkC,EAAMlB,EAAQ,IAAImB,CAAa,EAC/BC,EAAaC,EAAqBrB,EAAQ,IAAKM,EAAQ,SAAS,EAChEgB,EAAaC,EAAK,IAAM,CAG5B,GAAI,CACF,OAAOC,EAAezC,EAAcC,CAAG,CAAC,GAAKyC,CAC/C,MAAQ,CACN,OAAOA,CACT,CACF,CAAC,EAED,MAAO,CACL,GAAGb,EACH,MAAOc,EAAmB,CAAE,MAAOb,EAAI,MAAO,SAAAE,EAAU,IAAAG,EAAK,WAAAI,EAAY,WAAAF,EAAY,UAAAJ,CAAU,CAAC,CAClG,CACF,EAMaW,GAAgB,MAAOrB,EAA8B,CAAC,KACzD,MAAMD,GAAYC,CAAO,GAAG",
+  "names": ["Buffer", "execFileSync", "fs", "net", "path", "process", "pathToFileURL", "z", "z", "packageConfigSchema", "route", "INFRA_KIT_ENV", "PACKAGE_CONFIG_FILE", "DEV_CONTEXT_DIR", "path", "DEV_CONTEXT_FILE", "devContextFragmentSchema", "z", "buildBasicAuthHeader", "env", "override", "username", "password", "Buffer", "interpolate", "template", "values", "DEFAULT_HTTP_PORT", "LOOPBACK_V4", "withProxyPort", "target", "proxyPort", "url", "grafted", "LEGACY_SELF_SPAWNED_PORT_FLOOR", "resolveLegacyTarget", "resolveLocalTarget", "args", "route", "templates", "env", "getRelease", "info", "slugifyHostLabel", "pickSource", "localSet", "fallback", "LOOPBACK_HOSTNAMES", "isLoopbackTarget", "hostname", "bare", "resolveRoute", "routePath", "localInfo", "INFRA_KIT_ENV", "resolveProxyConfig", "proxy", "authHeader", "result", "headers", "entry", "once", "fn", "cached", "loadDev", "cwd", "configPath", "path", "PACKAGE_CONFIG_FILE", "fs", "stat", "rawExport", "pathToFileURL", "resolved", "parsed", "packageConfigSchema", "z", "extractPackages", "v", "candidate", "findUp", "start", "relative", "dir", "parent", "emptyLocalContext", "isFragmentWriterAlive", "pid", "process", "error", "readFragmentDir", "entries", "packages", "name", "devContextFragmentSchema", "readLocalContext", "DEV_CONTEXT_DIR", "legacy", "DEV_CONTEXT_FILE", "readGitBranch", "cwd", "execFileSync", "getFreePort", "resolve", "reject", "srv", "net", "address", "port", "UI_PORTS_ENV", "readPackageName", "parsed", "fs", "path", "resolveManagedUi", "raw", "process", "name", "entry", "alias", "HTTPS_PORT", "infraKitDev", "options", "managed", "strictPort", "host", "LOOPBACK_V4", "hmr", "server", "dev", "loadDev", "localSet", "localInfo", "readLocalContext", "env", "INFRA_KIT_ENV", "authHeader", "buildBasicAuthHeader", "getRelease", "once", "slugifyRelease", "DEFAULT_RELEASE_SLUG", "resolveProxyConfig", "infraKitProxy"]
+}

package/dist/cli.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-import{A as Be,B as Je,C as We,D as He,E as ze,F as Xe,G as Qe,H as Ze,I as W,J as et,K as tt,L as ot,M as rt,N as nt,O as it,Q as E,a as we,b as k,c as w,d as Re,e as ke,f as Ee,g as K,h as Ce,i as xe,j as Y,k as Te,l as Ae,m as _e,n as De,o as Me,p as $e,q as je,r as Fe,s as M,t as m,u as Ue,v as Ve,w as Ge,x as qe,y as Ke,z as Ye}from"./chunk-GQHUWUJL.js";import{a as Oe}from"./chunk-RXEMP3VI.js";import{q as H}from"./chunk-RSF5XAQJ.js";import{P as q,Q as he,S as ye,m as ve,v as s}from"./chunk-V37MZDFR.js";import{e as J}from"./chunk-Z6KTUVIC.js";import{a as at,b as O,c as st,d as x,e as z,f as X,g as Q}from"./chunk-IGTHMZPR.js";import{a as Se}from"./chunk-LSEYIAWK.js";import{a as _}from"./chunk-6FU2TRU5.js";import{a as D,b as Pe,d as be,f as Le,g as Ie,j as B,k as Ne,n as S}from"./chunk-CHETBZ6M.js";import"./chunk-6EPRH34O.js";import"./chunk-LTKR3F4N.js";import Xo,{Separator as P}from"@inquirer/select";import{realpathSync as Qo}from"node:fs";import f from"node:process";import{fileURLToPath as oo}from"node:url";import{Command as Io}from"commander";import I from"node:process";import ct from"node:process";import{$ as io}from"zx";var Z=async()=>{let e=await q(),t=await Promise.all([{label:"project (committed)",path:e.main},{label:"user global",path:e.userGlobal},{label:"user project",path:e.userProject}].map(async r=>({...r,exists:await k(r.path)}))),o=t.at(-1)?.exists===!0,n=await Te(e.userProject,o),a=o?Ae(n):"";s.info(`Project name: ${e.projectName}
-`),s.info(`Config merge chain (later overrides earlier):
-`);for(let r of t){let c=r.exists?"  [\u2713]":"  [ ]",l=r.path===e.userProject&&a!==""?` ${a}`:"";s.info(`${c} ${r.label.padEnd(22)} ${w(r.path)}${l}`)}let i={projectName:e.projectName,layers:t.map(r=>({label:r.label,path:r.path,exists:r.exists})),hasOverrides:n.hasOverrides,overrideKeys:n.overrideKeys};return{content:[{type:"text",text:JSON.stringify(i,null,2)}],structuredContent:i}},ee=async()=>{let e=await q(),t=ct.env.EDITOR||ct.env.VISUAL||"vi",o=await Re(e);o.createdConfig&&s.info(ke(o)),s.info(`Opening ${w(e.userProject)} in ${t}`),await io({stdio:"inherit"})`${t} ${e.userProject}`,ye();let n={path:e.userProject,editor:t};return{content:[{type:"text",text:JSON.stringify(n,null,2)}],structuredContent:n}};import u from"node:fs";import R from"node:path";import b from"node:process";var ao="autoload-warn-misconfig.flag",so="autoload-warn-fail.flag",te="autoload-fail.flag",co=3e4,mt=async(e=!0)=>{let t;try{t=await he()}catch{return null}let o=t.envAutoLoad;return o?t.environments.includes(o.config)?{trigger:o.trigger,config:o.config,project:t.envManagement.config.name}:(e&&pt(`infra-kit: envAutoLoad.config "${o.config}" is not one of environments [${t.environments.join(", ")}] \u2014 env auto-load disabled.`,ao),null):null},dt=e=>{let{trigger:t,expectedTrigger:o,targetConfig:n,targetProject:a,env:i,force:r}=e;return t!==o||!i.session||i.cleared||i.currentConfig&&!i.autoLoadedMarker||!r&&i.autoLoadedMarker&&i.currentConfig===n&&i.currentProject===a?"skip":"load"},L=async({expectedTrigger:e,projectDir:t,force:o})=>{let n=e==="cli-invocation";try{let a=await mt(n);if(!a||dt({trigger:a.trigger,expectedTrigger:e,targetConfig:a.config,targetProject:a.project,env:lo(),force:o})==="skip"||lt()||uo())return null;let r=mo(),c=await $e({config:a.config,autoLoaded:!0,projectDir:t,beforeWrite:()=>!lt()&&!po(r)});return c?(go(),c.filePath):null}catch(a){let i=a.message;return fo(),n?pt(`infra-kit: env auto-load failed \u2014 ${i} (will retry later)`,so):s.debug(`env auto-load skipped: ${i}`),null}},lo=()=>({session:b.env[be],cleared:b.env[Ne],currentConfig:b.env[Le],currentProject:b.env[Ie],autoLoadedMarker:b.env[B]}),mo=()=>{try{return u.statSync(R.join(S(),D)).mtimeMs}catch{return null}},po=e=>{try{let t=R.join(S(),D);if(!u.existsSync(t))return!1;let o=u.statSync(t).mtimeMs;return e!==null&&o<=e?!1:new RegExp(`^unset ${B}$`,"m").test(u.readFileSync(t,"utf-8"))}catch{return!1}},lt=()=>{try{let e=S(),t=R.join(e,Pe);if(!u.existsSync(t))return!1;let o=R.join(e,D);return u.existsSync(o)?u.statSync(t).mtimeMs>=u.statSync(o).mtimeMs:!0}catch{return!1}},uo=()=>{try{let e=R.join(S(),te);return u.existsSync(e)?Date.now()-u.statSync(e).mtimeMs<co:!1}catch{return!1}},fo=()=>{try{let e=S();u.mkdirSync(e,{recursive:!0,mode:448}),u.writeFileSync(R.join(e,te),"",{mode:384})}catch{}},go=()=>{try{u.rmSync(R.join(S(),te),{force:!0})}catch{}},pt=(e,t)=>{try{let o=S(),n=R.join(o,t);if(u.existsSync(n))return;u.mkdirSync(o,{recursive:!0,mode:448}),u.writeFileSync(n,"",{mode:384})}catch{}s.warn(e)};var oe=async({projectDir:e}={})=>{await L({expectedTrigger:"shell-startup",projectDir:e,force:!0})};import{spawn as vo}from"node:child_process";import $ from"node:process";import{fileURLToPath as ho}from"node:url";var yo=["SIGINT","SIGTERM"],ut=()=>ho(new URL("./mcp.js",import.meta.url)),re=(e={})=>{let t=e.spawn??vo,o=e.exit??(r=>$.exit(r)),n=e.env??$.env,a=e.onError??(r=>s.error(r)),i=t($.execPath,[ut()],{stdio:"inherit",env:_(n)});i.on("error",r=>{a(`failed to launch the MCP server: ${r.message}`),o(1)}),yo.forEach(r=>{$.on(r,()=>{i.kill(r)})}),i.on("exit",(r,c)=>{o(c?1:r??1)})};import{spawnSync as wo}from"node:child_process";import{realpathSync as So}from"node:fs";import ne from"node:process";import{fileURLToPath as Ro}from"node:url";var ko=()=>So(Ro(import.meta.url)),Eo=(e,t,o,n)=>e.error?(o(`${t} not found on PATH: ${e.error.message}`),n(1)):e.signal?(o(`update terminated by signal ${e.signal}`),n(1)):n(e.status??1),ie=({dryRun:e},t={})=>{let o=t.spawnSync??wo,n=t.print??(C=>s.info(C)),a=t.exit??(C=>ne.exit(C)),i=t.env??ne.env,r=t.selfRealPath??ko(),c=t.lazyNpmRoot??st,{manager:l,updateCommand:d,canSelfSpawn:p}=at({selfRealPath:r,env:i,realpath:x,lazyNpmRoot:c}),y=d.join(" ");if(e){n(`Detected install manager: ${l}`),n(`Would run: ${y}`);return}if(!p){n(`Detected install manager: ${l}`),n(`Run this yourself: ${y}`),n(l==="homebrew"?"Not run for you: Homebrew manages this install; running a package manager would create a split-brain install.":"Not run for you: the install location is unrecognized, so the command above is a guess \u2014 a guessed global install is worse than a printed one.");return}let N=o(d[0],d.slice(1),{stdio:"inherit",shell:ne.platform==="win32",env:_(i)});Eo(N,l,n,a)};import ae from"node:fs/promises";import se from"node:path";import ft from"node:process";import{pathToFileURL as Co}from"node:url";var gt="~/projects",ce=async(e={})=>{if(e.init){await To(e.cwd);return}await xo()},xo=async()=>{let e=K(),t=await k(e);if(s.info(`Factory config: ${w(e)}   ${t?"[\u2713]":"[ ]"}`),!t){s.info("\nNot found \u2014 run `infra-kit vendor-config --init` to scaffold it."),ft.exitCode=1;return}let{workspaceDir:o,targets:n}=await xe(),a=Ce(o),i=await k(a);s.info(`workspaceDir:   ${o}   (resolved: ${a})   ${i?"[\u2713 exists]":"[ ] not found"}`),s.info("Targets:");let r=i;for(let c of n){let l=se.join(a,c),d=await k(l);d||(r=!1);let p=d?"[\u2713]":"[ ]",y=d?"":"   (not found \u2014 clone or remove)";s.info(`  ${p} ${c}   ${w(l)}${y}`)}r||(ft.exitCode=1)},To=async e=>{let t=K();if(await k(t)){s.info(`Factory config already exists at ${w(t)} \u2014 leaving it untouched.`);return}let o=e??await ve(),n=await Ao(o);await ae.mkdir(se.dirname(t),{recursive:!0}),await ae.writeFile(t,Po(n),"utf-8"),s.info(`\u2713 Created ${w(t)}`),n.length>0&&s.info(`  Seeded ${n.length} target(s) from the source ${J}.`),s.info(`  Edit \`workspaceDir\` (placeholder: ${gt}) to point at where your repos live.`),n.length===0&&s.info("  Add at least one repo name to `targets` before running vendor sync/manifest/diff.")},Ao=async e=>{try{let t=se.join(e,J),o=await ae.stat(t),i=(await import(`${Co(t).href}?mtime=${Number(o.mtimeMs)}`)).default,r=typeof i=="function"?await i():i;if(r&&typeof r=="object"&&"targets"in r){let c=r.targets;if(Array.isArray(c)&&c.every(l=>typeof l=="string"))return c}}catch{}return[]},Po=e=>`${JSON.stringify({workspaceDir:gt,targets:e},null,2)}
-`;var j=(e,t=!0)=>({line:e,reproducible:t});import F from"node:fs";import bo from"node:os";import Lo from"node:path";import wt from"node:process";var U="INFRA_KIT_SESSION_REPORT",le=null,vt=!1,ht=[],St=(e=wt.env)=>{vt||(le=e[U]??null,vt=!0,delete e[U])};var Rt=(e,t)=>{if(!le)return;let o=e.summary??(ht.length>0?[...ht]:void 0),n={...e,...o?{summary:o}:{}},a=t?.write??((i,r)=>{F.writeFileSync(i,r)});try{a(le,JSON.stringify(n))}catch{}},yt=0,kt=e=>{let t=e?.tmpdir?.()??bo.tmpdir(),o=e?.pid??wt.pid;return yt+=1,Lo.join(t,`infra-kit-session-${o}-${yt}.json`)},Et=(e,t)=>{if(!(t?.exists??(r=>F.existsSync(r)))(e))return null;let n=t?.read??(r=>F.readFileSync(r,"utf-8")),a=t?.unlink??(r=>F.unlinkSync(r)),i;try{i=n(e)}catch{return null}finally{try{a(e)}catch{}}try{return JSON.parse(i)}catch{return null}};var No=(e,t)=>[...t,e],me=e=>typeof e=="string"?e.split(",").filter(Boolean):void 0,Ct=(e,t)=>{if(!(typeof e>"u")){if(e===!0)return"workspace";if(e===!1)return"none";if(typeof e=="string"&&W.includes(e))return e;throw new Error(`Invalid ${t} value "${String(e)}". Expected one of: ${W.join(", ")}.`)}},V={value:!1},g=(e,t)=>e.hook("preAction",()=>{V.value||s.warn(`"${e.name()}" is a deprecated alias; use "${t}" instead.`)}),xt=e=>e.description("Merge dev branch into every release branch").option("-a, --all","Select all active release branches").option("-y, --yes","Skip confirmation prompt").action(async t=>{m(await Ve({all:t.all,confirmedCommand:t.yes}))}),Tt=e=>e.description("List all release branches").action(async()=>{m(await Ye())}),At=e=>e.description("Create one or more release branches (each entry can mix regular/hotfix and its own description)").option("-r, --release <spec>",'Release spec "<version|next|name>[:type[:description]]" (repeatable). The token is a semver ("1.2.5"), the literal "next", or a kebab-case name ("checkout-redesign"). Type is regular|hotfix (default regular). Examples: "1.2.5", "1.2.5:hotfix", "next:regular:Holiday backend", "checkout-redesign:regular:Q3 redesign".',No,[]).option("-y, --yes","Skip confirmation prompt").action(async t=>{let n=t.release.map(Be),a=n.length>0?n:void 0;m(await Je({releases:a,confirmedCommand:t.yes}))}),Pt=e=>e.description("Edit a release's description in Jira and in the matching GitHub PR body").option("-v, --version <version>","Release version (e.g. 1.2.5) or release name (e.g. checkout-redesign)").option("-d, --description <description>",'New description (use "" to clear)').option("-y, --yes","Skip confirmation prompt").action(async t=>{m(await We({version:t.version,description:t.description,confirmedCommand:t.yes}))}),bt=e=>e.description("Deploy any release branch to any environment").option("-v, --version <version>",'Version (e.g. 1.2.5) or release name (e.g. checkout-redesign) to deploy; "dev" deploys from the dev branch').option("-e, --env <env>","Specify the environment to deploy to, e.g. dev").option("--skip-terraform","Skip terraform deployment step").option("-y, --yes","Skip confirmation prompt").action(async t=>{m(await qe({version:t.version,env:t.env,skipTerraform:t.skipTerraform,confirmedCommand:t.yes}))}),Lt=e=>e.description("Deploy selected services from release branch to any environment").option("-v, --version <version>",'Version (e.g. 1.2.5) or release name (e.g. checkout-redesign) to deploy; "dev" deploys from the dev branch').option("-e, --env <env>","Specify the environment to deploy to, e.g. dev").option("-s, --services <services...>","Specify services to deploy, e.g. client-be client-fe").option("--skip-terraform","Skip terraform deployment step").option("-y, --yes","Skip confirmation prompt").action(async t=>{m(await Ke({version:t.version,env:t.env,services:t.services,skipTerraform:t.skipTerraform,confirmedCommand:t.yes}))}),It=e=>e.description("Release a new version to production").option("-v, --version <version>","Version (e.g. 1.2.5) or release name (e.g. checkout-redesign) to deliver").option("-y, --yes","Skip confirmation prompt").action(async t=>{m(await Ge({version:t.version,confirmedCommand:t.yes}))}),Nt=e=>e.description("Remove release worktrees whose PRs are no longer open").option("-y, --yes","Skip confirmation prompt").action(async t=>{m(await nt({confirmedCommand:t.yes}))}),_t=e=>e.description("Add git worktrees for release branches").option("-y, --yes","Skip confirmation prompt").option("-a, --all","Select all active release branches").option("-v, --versions <versions>","Specify versions by comma, e.g. 1.2.5, 1.2.6").option("-i, --ide [mode]","Editor mode for created worktrees: workspace (default) | none").option("--no-ide","Skip the editor (alias for --ide none)").option("-c, --cursor [mode]","Deprecated alias for --ide").option("--no-cursor","Deprecated alias for --no-ide").option("-g, --github-desktop","Open created worktrees in GitHub Desktop").option("--no-github-desktop","Skip GitHub Desktop prompt").option("-m, --cmux","Open created worktrees in cmux (3-pane layout)").option("--no-cmux","Skip cmux prompt").action(async t=>{let o=Ct(t.ide,"--ide")??Ct(t.cursor,"--cursor");m(await et({confirmedCommand:t.yes,all:t.all,versions:t.versions,ide:o,githubDesktop:t.githubDesktop,cmux:t.cmux}))}),Dt=e=>e.description("List all git worktrees with detailed information").action(async()=>{m(await tt())}),Mt=e=>e.description("Remove git worktrees for release branches").option("-y, --yes","Skip confirmation prompt").option("-a, --all","Select all active release branches").option("-v, --versions <versions>","Specify versions by comma, e.g. 1.2.5, 1.2.6").action(async t=>{m(await rt({confirmedCommand:t.yes,all:t.all,versions:t.versions}))}),Ot=e=>e.description("Close all cmux/editor worktree windows, then reopen the current release worktrees (also cold-start restore)").action(async()=>{m(await ot())}),$t=e=>e.description("Show the machine-local factory config (~/.infra-kit/vendor.json) or scaffold it with --init").option("--init","Scaffold ~/.infra-kit/vendor.json (skips if it already exists)").action(async t=>{m(await ce({init:t.init}))}),jt=e=>e.description("Verify vendor/ matches vendor/.sync-manifest.json (self-contained; for any consumer repo)").action(async()=>{let t=await He();m(t),t.structuredContent.ok||(I.exitCode=1)}),Ft=e=>e.description("Source-aware drift check (rsync dry-run) of each target vendored subtree vs the source").option("-r, --repos <repos>","Restrict to comma-separated target repo names").action(async t=>{let o=await ze({repos:me(t.repos)});m(o),o.structuredContent.ok||(I.exitCode=1)}),Ut=e=>e.description("Show the resolved config merge chain and file paths").action(async()=>{m(await Z())}),Vt=e=>e.description("Open the user-scope per-project override file in $EDITOR").action(async()=>{m(await ee())}),_o=new Set(["init","doctor","version","dev","self-update","mcp"]),Do=e=>e.startsWith("env-")||_o.has(e),Mo=new Set(["env-autoload","mcp","version","self-update"]),Gt=e=>{let t=[];for(let o=e;o&&o.parent;o=o.parent)t.unshift(o.name());return t.join(" ")},de=()=>{let e=new Io,t=e.command("release").description("Release management commands");xt(t.command("merge-dev")),Tt(t.command("list")),At(t.command("create")),Pt(t.command("desc-edit")),bt(t.command("deploy-all")),Lt(t.command("deploy-selected")),It(t.command("deliver"));let o=e.command("worktrees").description("Git worktree management commands");_t(o.command("add")),Dt(o.command("list")),Mt(o.command("remove")),Nt(o.command("sync")),Ot(o.command("reload")),g(xt(e.command("merge-dev")),"release merge-dev"),g(Tt(e.command("release-list")),"release list"),g(At(e.command("release-create")),"release create"),g(Pt(e.command("release-desc-edit")),"release desc-edit"),g(bt(e.command("release-deploy-all")),"release deploy-all"),g(Lt(e.command("release-deploy-selected")),"release deploy-selected"),g(It(e.command("release-deliver")),"release deliver"),g(_t(e.command("worktrees-add")),"worktrees add"),g(Dt(e.command("worktrees-list")),"worktrees list"),g(Mt(e.command("worktrees-remove")),"worktrees remove"),g(Nt(e.command("worktrees-sync")),"worktrees sync"),g(Ot(e.command("worktrees-reload")),"worktrees reload");let n=e.command("config").description("Manage infra-kit configuration files");Ut(n.command("path")),Vt(n.command("edit")),Ut(e.command("config-path",{hidden:!0})),Vt(e.command("config-edit",{hidden:!0})),e.command("audit").description("Audit against infra-kit.config.ts rules (--all for every package, --root for the monorepo root)").option("-a, --all","Audit every non-vendor workspace package").option("-r, --root","Audit the monorepo root (turbo pipeline + root commands)").action(async i=>{let r=await we({all:i.all,root:i.root});m(r),r.structuredContent.allPassed||(I.exitCode=1)});let a=e.command("vendor").description("Verify and sync the mirrored vendor/ tree");return jt(a.command("check")),a.command("sync").description("Copy vendored files from the source repo into each target and regenerate manifests").option("-y, --yes","Skip confirmation prompt").option("-r, --repos <repos>","Restrict to comma-separated target repo names").action(async i=>{m(await Qe({confirmedCommand:i.yes,repos:me(i.repos)}))}),a.command("manifest").description("Regenerate each target vendor/.sync-manifest.json + README from current content (no copy)").option("-r, --repos <repos>","Restrict to comma-separated target repo names").action(async i=>{m(await Xe({confirmedCommand:!0,repos:me(i.repos)}))}),Ft(a.command("diff")),$t(a.command("config")),g($t(e.command("vendor-config")),"vendor config"),jt(e.command("vendor-check",{hidden:!0})),Ft(e.command("vendor-diff",{hidden:!0})),e.command("doctor").description("Check installation and authentication status of gh and doppler CLIs").action(async()=>{m(await _e())}),e.command("self-update").description("Update this CLI using the package manager that installed it").option("--dry-run","Print the detected manager and the command that would run; install nothing").action(i=>{ie({dryRun:!!i.dryRun})}),e.command("mcp").description("Run the infra-kit MCP server (stdio transport)").action(()=>{re()}),e.command("dev").description("Run local dev servers for a named devServersPresets preset (or all apps); api + ui").argument("[preset]","Named preset from devServersPresets (omit to run every app)").option("-w, --watch","Rebuild and restart on file save").option("--app <names>","Further narrow to these app folder names (comma-separated)").option("--target <keys>","Run exactly these <app>/api|<app>/ui packages (comma-separated); part-level, unlike --app").option("--cmux","Run each app in its own cmux pane (one workspace, N panes; falls back to single terminal if cmux is unavailable)").option("--self","Run only the app of the current directory (infer from cwd; use inside apps/<app>/\u2026)").option("-V, --verbose","Print full boot narration (default: quiet; full detail always in the session log)").option("--routes","Print each app\u2019s registered METHOD /path routes at startup (default: off)").action(async(i,r)=>{let{runDevServerCli:c}=await import("./dev-server.js"),l=!!(I.stdout.isTTY&&I.stdin.isTTY);await c({...r,preset:i},l,M.enabled)}),e.command("version").description("Print the installed infra-kit CLI version").action(async()=>{m(await Ze())}),e.command("env-status").description("Show which env is loaded in this session (local introspection; no Doppler call)").action(async()=>{m(await Fe())}),e.command("env-list").description("List available Doppler configs for the detected project").action(async()=>{m(await Me())}),e.command("init").description("Inject shell integration into .zshrc and sync repo agent-instruction files").action(async()=>{m(await Y())}),e.command("env-load").description("Load Doppler env vars for a config. Source the returned file path to apply.").option("-c, --config <config>","Environment config name to load (e.g. dev, arthur)").action(async i=>{m(await je({config:i.config}))}),e.command("env-clear").description("Clear loaded env vars. Source the returned file path to apply.").option("--purge","Also delete this project's warm cache outright (durable disable)").action(async i=>{m(await De({purge:!!i.purge}))}),e.command("env-autoload",{hidden:!0}).description("Internal: prime env for the shell-startup auto-load trigger").option("--project-dir <dir>","Canonical project dir for the warm-cache key (shell-startup only)").action(async i=>{await oe({projectDir:i.projectDir})}),e.commands.forEach(Ue),e.hook("preAction",async(i,r)=>{M.enabled=!!r.optsWithGlobals().json,M.enabled&&(s.level="warn"),Mo.has(Gt(r))||await Ee(),Do(r.name())||await L({expectedTrigger:"cli-invocation"})}),e.hook("postAction",(i,r)=>{let l=Oe.snapshot()?.formattedOptions??"",d=l?` ${l}`:"",p=`infra-kit ${Gt(r)}${d}`;Rt({equivalent:j(p,!0)})}),e};var pe=(e,t="  ")=>{let o=e.reduce((n,[a])=>Math.max(n,a.length),0);return e.map(([n,a])=>`${n.padEnd(o)}${t}${a}`)};import{spawn as jo}from"node:child_process";import h from"node:process";var v={ok:"ok",findingsPlain:"completed with findings",failed:"failed",cancelled:"cancelled",findingsSuffix:"findings",sep:" \xB7 ",reproPrefix:"$ ",nonReproPrefix:"\u2248 ",envNotice:"Applies to your shell after you exit this session."},qt={ok:{unicode:"\u2713",ascii:"[ok]"},findings:{unicode:"\u26A0",ascii:"[!]"},failed:{unicode:"\u2717",ascii:"[x]"},cancelled:{unicode:"\u2298",ascii:"[-]"}},Kt=e=>`${v.reproPrefix}${e}`,Oo=e=>e<1e3?`${Math.round(e)}ms`:`${(e/1e3).toFixed(1)}s`,$o=(e,t)=>e==="findings"?t!=null?`${t} ${v.findingsSuffix}`:v.findingsPlain:{ok:v.ok,failed:v.failed,cancelled:v.cancelled}[e],Yt=e=>{let t=e.equivalent.reproducible?v.reproPrefix:v.nonReproPrefix,o=e.ascii===!0?qt[e.outcome].ascii:qt[e.outcome].unicode,a=[$o(e.outcome,e.findingsCount),Oo(e.durationMs)],i=e.summary?.[0];i!=null&&i.length>0&&a.push(i);let r=[`${o} ${a.join(v.sep)}`];return e.showEquivalent!==!1&&r.unshift(`${t}${e.equivalent.line}`),e.envNotice===!0&&r.push(v.envNotice),r.join(`
-`)};var Bt=(e,t,o)=>o?t!=null||e===0?"ok":"findings":t==="SIGINT"||e===0?"cancelled":"failed";import Jt from"node:process";var T={column:"\r",sgr:"\x1B[0m",cursor:"\x1B[?25h",wrap:"\x1B[?7h",scrollRegion:"\x1B[r",primaryBuffer:"\x1B[?1049l"},Wt=(e,t)=>{let o=t?.write??(i=>{Jt.stderr.write(i)}),n=t?.stdin??Jt.stdin,a=[T.column,T.sgr,T.cursor,T.wrap,T.scrollRegion];e.entersAltScreen===!0&&a.push(T.primaryBuffer),o(a.join("")),n.isTTY===!0&&n.isRaw===!0&&n.setRawMode?.(!1)};var Ht=e=>`infra-kit ${e.groupPath.join(" ")}`,Fo=e=>new Promise(t=>{e.on("exit",(o,n)=>{t({code:o,signal:n})}),e.on("error",()=>{t({code:1,signal:null})})}),Uo=async(e,t,o)=>{let n=kt(),a={...t.env,[U]:n,INFRA_KIT_NO_AUTO_UPDATE:"1"},i=t.now(),r={code:1,signal:null};o(!0);try{let y=t.spawn(h.execPath,[t.cliPath,...e.groupPath],{stdio:"inherit",env:a});r=await Fo(y)}catch{r={code:1,signal:null}}finally{o(!1),t.resetTerminal({entersAltScreen:e.entersAltScreen})}let c=Et(n),l=Bt(r.code,r.signal,c!=null),d=Ht(e),p=c?.equivalent??j(d,!0);return Yt({equivalent:p,outcome:l,durationMs:t.now()-i,summary:c?.summary,envNotice:e.sessionEnvNotice,ascii:t.ascii,showEquivalent:!(p.reproducible&&p.line===d)})},Vo=e=>{let t=()=>{e()||h.exit(0)},o=()=>{};return h.on("SIGINT",t),h.on("SIGTSTP",o),()=>{h.off("SIGINT",t),h.off("SIGTSTP",o)}},zt=(e,t)=>!!(t.stdoutIsTTY&&t.stdinIsTTY&&t.stderrIsTTY&&e.TERM!=="dumb"&&!e.INFRA_KIT_NO_SESSION&&!e.INFRA_KIT_SESSION_REPORT),Xt=async(e,t)=>{let o={spawn:t.spawn??jo,now:t.now??(()=>Date.now()),env:t.env??h.env,cliPath:t.cliPath,ascii:t.ascii??!(h.stdout.isTTY&&h.env.TERM!=="dumb"),resetTerminal:t.resetTerminal??(r=>{Wt(r)})},n=t.write??(r=>h.stderr.write(r)),a=!1,i=t.installSignals===!1?()=>{}:Vo(()=>a);try{for(;;){let r=await t.renderPalette(e);if(r==null)return;let c=t.resolveCommand(r);if(!c)continue;let l=Kt(Ht(c));n(`
-${l}
-`);let d=await Uo(c,o,p=>{a=p});n(`
-${d}
-`)}}finally{i()}};import{spawn as Ko}from"node:child_process";import Zt from"node:fs";import A from"node:process";import{fileURLToPath as eo}from"node:url";var Qt=["INFRA_KIT_NO_AUTO_UPDATE","NO_UPDATE_NOTIFIER","CI"],Go=new Set(["mcp","self-update"]),qo=e=>e[2]!=null&&Go.has(e[2]),ue=e=>{let{argv:t,env:o,isTty:n,selfRealPath:a,cwd:i,realpath:r}=e;return Qt.some(l=>{let d=o[l];return d!=null&&d!==""})?"opt-out":t.includes("--json")?"json":qo(t)?"own-command":n?O(a,i,r)?"local-install":null:"not-a-tty"};var Yo=e=>{Ko(A.execPath,[e,"--parent-pid",String(A.pid)],{detached:!0,stdio:"ignore",windowsHide:!0}).unref()},Bo=()=>eo(new URL("./update-check.js",import.meta.url)),Jo=()=>Zt.realpathSync(eo(new URL("./cli.js",import.meta.url))),Wo=/^[\w@./+-]+$/i,Ho=e=>Wo.test(e),zo=(e,t,o)=>{!e?.latestVersion||!e.updateCommand||z(e.latestVersion,t)&&e.updateCommand.every(Ho)&&o(`infra-kit ${e.latestVersion} is available (you have ${t}). Run: ${e.updateCommand.join(" ")}`)},fe=(e,t={})=>{try{let o=t.argv??A.argv,n=t.env??A.env,a=t.isTty??!!A.stdout.isTTY,i=t.cwd??A.cwd(),r=t.nowMs??Date.now(),c=t.selfRealPath??Jo(),l=t.readCache??X,d=t.spawnChild??Yo,p=t.fileExists??(G=>Zt.existsSync(G)),y=t.notify??(G=>{s.info(G)});if(ue({argv:o,env:n,isTty:a,selfRealPath:c,cwd:i,realpath:x})!==null)return;let N=l();if(zo(N,e,y),!Q(N,r))return;let C=t.childPath??Bo();if(!p(C))return;d(C)}catch{}};St();var ge=de(),to=async e=>{try{e?await ge.parseAsync(e):await ge.parseAsync()}catch(t){H(t)&&(s.info("Operation cancelled."),f.exit(0));let o=t instanceof Error?t.message:String(t);s.error(o),f.exit(1)}},Zo=()=>{try{if(f.env.INFRA_KIT_NO_LOCATION_WARN||f.argv.includes("--json")||f.argv[2]==="mcp")return;O(Qo(oo(import.meta.url)),f.cwd(),x)&&s.info("Running from a project-local node_modules. Install globally for faster startup: npm i -g infra-kit")}catch{}};Zo();fe(Se.version);var ro=()=>new Map(ge.commands.map(e=>[e.name(),e])),no=()=>{let e=ro();return[{label:"Release Management",names:E("release")},{label:"Worktrees",names:E("worktrees")},{label:"Environment",names:E("environment")}].flatMap(({label:o,names:n})=>n.filter(a=>e.has(a)).map(a=>({name:a,description:e.get(a).description(),group:o})))},er=async()=>{let e=E("release"),t=E("worktrees"),o=E("environment"),n=ro(),a=no(),i=null;try{if(f.stdout.isTTY&&f.stdin.isTTY){let{runCommandPalette:r}=await import("./boot-SG7525LE.js");i=await r(a)}else{let r=pe(a.map(d=>[d.name,d.description])),c=new Map;a.forEach((d,p)=>{c.set(d.name,r[p]??d.name)});let l=d=>d.filter(p=>n.has(p)).map(p=>({name:c.get(p)??p,value:p}));i=await Xo({message:"Select a command to run",choices:[new P(" "),new P("\u2014 Release Management \u2014"),...l(e),new P(" "),new P("\u2014 Worktrees \u2014"),...l(t),new P(" "),new P("\u2014 Environment \u2014"),...l(o)]},{output:f.stderr})}}catch(r){if(!H(r))throw r}return i},tr=async()=>{let{runCommandPalette:e}=await import("./boot-SG7525LE.js"),t=oo(import.meta.url),o=new Map(it.map(n=>[n.cliName,n]));await Xt(no(),{renderPalette:e,resolveCommand:n=>{let a=o.get(n);return a?{groupPath:a.groupPath,entersAltScreen:a.entersAltScreen,sessionEnvNotice:a.sessionEnvNotice}:void 0},cliPath:t})};if(f.argv.length<=2){let e={stdoutIsTTY:!!f.stdout.isTTY,stdinIsTTY:!!f.stdin.isTTY,stderrIsTTY:!!f.stderr.isTTY};if(zt(f.env,e))await tr();else{let t=await er();t&&(V.value=!0,await to(["node","infra-kit",t]))}}else await to();
+import{A as qe,B as Ke,C as Je,D as Ye,E as Be,F as We,G as He,H as ze,I as Y,J as Xe,K as Qe,L as Ze,M as et,N as tt,O as ot,P as rt,R as nt,S as it,a as he,b as E,c as y,d as Se,e as we,f as Re,g as G,h as Ee,i as xe,j as V,k as Ce,l as Pe,m as Le,n as Ne,o as _e,p as De,q as Oe,r as Me,s as N,t as m,u as je,v as $e,w as Ue,x as Fe,y as Ge,z as Ve}from"./chunk-2YHPK2VY.js";import{a as K}from"./chunk-TFHVQOVF.js";import{r as B}from"./chunk-27PDA2PN.js";import{P as F,Q as ge,S as ve,m as fe,v as l}from"./chunk-3F7XYJWY.js";import{e as J}from"./chunk-Z6KTUVIC.js";import{a as at,b as _,c as st,d as P,e as W,f as H,g as z}from"./chunk-3OMHS5RE.js";import{a as ye}from"./chunk-DOG3OPNW.js";import{a as I}from"./chunk-6FU2TRU5.js";import{a as L,b as Te,d as ke,f as Ae,g as be,j as q,k as Ie,n as S}from"./chunk-CHETBZ6M.js";import"./chunk-TUVUKM4K.js";import"./chunk-LTKR3F4N.js";import Zo,{Separator as $t}from"@inquirer/select";import{realpathSync as er}from"node:fs";import u from"node:process";import{fileURLToPath as Ft}from"node:url";var Vt=(e,t)=>{let o=e,r;for(let a of t){if(r=o.find(n=>n.name()===a),!r)return;o=r.commands}return r},ct=e=>ot.flatMap(({key:t,label:o})=>nt(t).flatMap(r=>{let a=Vt(e,r.groupPath);return a?[{name:r.groupPath.join(" "),description:a.description(),group:o}]:[]}));import{Command as go}from"commander";import b from"node:process";import lt from"node:process";import{$ as qt}from"zx";var X=async()=>{let e=await F(),t=await Promise.all([{label:"project (committed)",path:e.main},{label:"user global",path:e.userGlobal},{label:"user project",path:e.userProject}].map(async i=>({...i,exists:await E(i.path)}))),o=t.at(-1)?.exists===!0,r=await Ce(e.userProject,o),a=o?Pe(r):"";l.info(`Project name: ${e.projectName}
+`),l.info(`Config merge chain (later overrides earlier):
+`);for(let i of t){let c=i.exists?"  [\u2713]":"  [ ]",s=i.path===e.userProject&&a!==""?` ${a}`:"";l.info(`${c} ${i.label.padEnd(22)} ${y(i.path)}${s}`)}let n={projectName:e.projectName,layers:t.map(i=>({label:i.label,path:i.path,exists:i.exists})),hasOverrides:r.hasOverrides,overrideKeys:r.overrideKeys};return{content:[{type:"text",text:JSON.stringify(n,null,2)}],structuredContent:n}},Q=async()=>{let e=await F(),t=lt.env.EDITOR||lt.env.VISUAL||"vi",o=await Se(e);o.createdConfig&&l.info(we(o)),l.info(`Opening ${y(e.userProject)} in ${t}`),await qt({stdio:"inherit"})`${t} ${e.userProject}`,ve();let r={path:e.userProject,editor:t};return{content:[{type:"text",text:JSON.stringify(r,null,2)}],structuredContent:r}};import p from"node:fs";import w from"node:path";import k from"node:process";var Kt="autoload-warn-misconfig.flag",Jt="autoload-warn-fail.flag",Z="autoload-fail.flag",Yt=3e4,dt=async(e=!0)=>{let t;try{t=await ge()}catch{return null}let o=t.envAutoLoad;return o?t.environments.includes(o.config)?{trigger:o.trigger,config:o.config,project:t.envManagement.config.name}:(e&&ut(`infra-kit: envAutoLoad.config "${o.config}" is not one of environments [${t.environments.join(", ")}] \u2014 env auto-load disabled.`,Kt),null):null},pt=e=>{let{trigger:t,expectedTrigger:o,targetConfig:r,targetProject:a,env:n,force:i}=e;return t!==o||!n.session||n.cleared||n.currentConfig&&!n.autoLoadedMarker||!i&&n.autoLoadedMarker&&n.currentConfig===r&&n.currentProject===a?"skip":"load"},A=async({expectedTrigger:e,projectDir:t,force:o})=>{let r=e==="cli-invocation";try{let a=await dt(r);if(!a||pt({trigger:a.trigger,expectedTrigger:e,targetConfig:a.config,targetProject:a.project,env:Bt(),force:o})==="skip"||mt()||zt())return null;let i=Wt(),c=await De({config:a.config,autoLoaded:!0,projectDir:t,beforeWrite:()=>!mt()&&!Ht(i)});return c?(Qt(),c.filePath):null}catch(a){let n=a.message;return Xt(),r?ut(`infra-kit: env auto-load failed \u2014 ${n} (will retry later)`,Jt):l.debug(`env auto-load skipped: ${n}`),null}},Bt=()=>({session:k.env[ke],cleared:k.env[Ie],currentConfig:k.env[Ae],currentProject:k.env[be],autoLoadedMarker:k.env[q]}),Wt=()=>{try{return p.statSync(w.join(S(),L)).mtimeMs}catch{return null}},Ht=e=>{try{let t=w.join(S(),L);if(!p.existsSync(t))return!1;let o=p.statSync(t).mtimeMs;return e!==null&&o<=e?!1:new RegExp(`^unset ${q}$`,"m").test(p.readFileSync(t,"utf-8"))}catch{return!1}},mt=()=>{try{let e=S(),t=w.join(e,Te);if(!p.existsSync(t))return!1;let o=w.join(e,L);return p.existsSync(o)?p.statSync(t).mtimeMs>=p.statSync(o).mtimeMs:!0}catch{return!1}},zt=()=>{try{let e=w.join(S(),Z);return p.existsSync(e)?Date.now()-p.statSync(e).mtimeMs<Yt:!1}catch{return!1}},Xt=()=>{try{let e=S();p.mkdirSync(e,{recursive:!0,mode:448}),p.writeFileSync(w.join(e,Z),"",{mode:384})}catch{}},Qt=()=>{try{p.rmSync(w.join(S(),Z),{force:!0})}catch{}},ut=(e,t)=>{try{let o=S(),r=w.join(o,t);if(p.existsSync(r))return;p.mkdirSync(o,{recursive:!0,mode:448}),p.writeFileSync(r,"",{mode:384})}catch{}l.warn(e)};var ee=async({projectDir:e}={})=>{await A({expectedTrigger:"shell-startup",projectDir:e,force:!0})};import{spawn as Zt}from"node:child_process";import D from"node:process";import{fileURLToPath as eo}from"node:url";var to=["SIGINT","SIGTERM"],ft=()=>eo(new URL("./mcp.js",import.meta.url)),te=(e={})=>{let t=e.spawn??Zt,o=e.exit??(i=>D.exit(i)),r=e.env??D.env,a=e.onError??(i=>l.error(i)),n=t(D.execPath,[ft()],{stdio:"inherit",env:I(r)});n.on("error",i=>{a(`failed to launch the MCP server: ${i.message}`),o(1)}),to.forEach(i=>{D.on(i,()=>{n.kill(i)})}),n.on("exit",(i,c)=>{o(c?1:i??1)})};import{spawnSync as oo}from"node:child_process";import{realpathSync as ro}from"node:fs";import oe from"node:process";import{fileURLToPath as no}from"node:url";var io=()=>ro(no(import.meta.url)),ao=(e,t,o,r)=>e.error?(o(`${t} not found on PATH: ${e.error.message}`),r(1)):e.signal?(o(`update terminated by signal ${e.signal}`),r(1)):r(e.status??1),re=({dryRun:e},t={})=>{let o=t.spawnSync??oo,r=t.print??(C=>l.info(C)),a=t.exit??(C=>oe.exit(C)),n=t.env??oe.env,i=t.selfRealPath??io(),c=t.lazyNpmRoot??st,{manager:s,updateCommand:d,canSelfSpawn:f}=at({selfRealPath:i,env:n,realpath:P,lazyNpmRoot:c}),g=d.join(" ");if(e){r(`Detected install manager: ${s}`),r(`Would run: ${g}`);return}if(!f){r(`Detected install manager: ${s}`),r(`Run this yourself: ${g}`),r(s==="homebrew"?"Not run for you: Homebrew manages this install; running a package manager would create a split-brain install.":"Not run for you: the install location is unrecognized, so the command above is a guess \u2014 a guessed global install is worse than a printed one.");return}let x=o(d[0],d.slice(1),{stdio:"inherit",shell:oe.platform==="win32",env:I(n)});ao(x,s,r,a)};import ne from"node:fs/promises";import ie from"node:path";import gt from"node:process";import{pathToFileURL as so}from"node:url";var vt="~/projects",ae=async(e={})=>{if(e.init){await lo(e.cwd);return}await co()},co=async()=>{let e=G(),t=await E(e);if(l.info(`Factory config: ${y(e)}   ${t?"[\u2713]":"[ ]"}`),!t){l.info("\nNot found \u2014 run `infra-kit vendor config --init` to scaffold it."),gt.exitCode=1;return}let{workspaceDir:o,targets:r}=await xe(),a=Ee(o),n=await E(a);l.info(`workspaceDir:   ${o}   (resolved: ${a})   ${n?"[\u2713 exists]":"[ ] not found"}`),l.info("Targets:");let i=n;for(let c of r){let s=ie.join(a,c),d=await E(s);d||(i=!1);let f=d?"[\u2713]":"[ ]",g=d?"":"   (not found \u2014 clone or remove)";l.info(`  ${f} ${c}   ${y(s)}${g}`)}i||(gt.exitCode=1)},lo=async e=>{let t=G();if(await E(t)){l.info(`Factory config already exists at ${y(t)} \u2014 leaving it untouched.`);return}let o=e??await fe(),r=await mo(o);await ne.mkdir(ie.dirname(t),{recursive:!0}),await ne.writeFile(t,po(r),"utf-8"),l.info(`\u2713 Created ${y(t)}`),r.length>0&&l.info(`  Seeded ${r.length} target(s) from the source ${J}.`),l.info(`  Edit \`workspaceDir\` (placeholder: ${vt}) to point at where your repos live.`),r.length===0&&l.info("  Add at least one repo name to `targets` before running vendor sync/manifest/diff.")},mo=async e=>{try{let t=ie.join(e,J),o=await ne.stat(t),n=(await import(`${so(t).href}?mtime=${Number(o.mtimeMs)}`)).default,i=typeof n=="function"?await n():n;if(i&&typeof i=="object"&&"targets"in i){let c=i.targets;if(Array.isArray(c)&&c.every(s=>typeof s=="string"))return c}}catch{}return[]},po=e=>`${JSON.stringify({workspaceDir:vt,targets:e},null,2)}
+`;var O=(e,t=!0)=>({line:e,reproducible:t});import M from"node:fs";import uo from"node:os";import fo from"node:path";import wt from"node:process";var j="INFRA_KIT_SESSION_REPORT",se=null,ht=!1,yt=[],Rt=(e=wt.env)=>{ht||(se=e[j]??null,ht=!0,delete e[j])};var Et=(e,t)=>{if(!se)return;let o=e.summary??(yt.length>0?[...yt]:void 0),r={...e,...o?{summary:o}:{}},a=t?.write??((n,i)=>{M.writeFileSync(n,i)});try{a(se,JSON.stringify(r))}catch{}},St=0,xt=e=>{let t=e?.tmpdir?.()??uo.tmpdir(),o=e?.pid??wt.pid;return St+=1,fo.join(t,`infra-kit-session-${o}-${St}.json`)},Ct=(e,t)=>{if(!(t?.exists??(i=>M.existsSync(i)))(e))return null;let r=t?.read??(i=>M.readFileSync(i,"utf-8")),a=t?.unlink??(i=>M.unlinkSync(i)),n;try{n=r(e)}catch{return null}finally{try{a(e)}catch{}}try{return JSON.parse(n)}catch{return null}};var vo=(e,t)=>[...t,e],ce=e=>typeof e=="string"?e.split(",").filter(Boolean):void 0,Pt=(e,t)=>{if(!(typeof e>"u")){if(e===!0)return"workspace";if(e===!1)return"none";if(typeof e=="string"&&Y.includes(e))return e;throw new Error(`Invalid ${t} value "${String(e)}". Expected one of: ${Y.join(", ")}.`)}},ho=e=>e.description("Merge dev branch into every release branch").option("-a, --all","Select all active release branches").option("-y, --yes","Skip confirmation prompt").action(async t=>{m(await $e({all:t.all,confirmedCommand:t.yes}))}),yo=e=>e.description("List all release branches").action(async()=>{m(await Ve())}),So=e=>e.description("Create one or more release branches (each entry can mix regular/hotfix and its own description)").option("-r, --release <spec>",'Release spec "<version|next|name>[:type[:description]]" (repeatable). The token is a semver ("1.2.5"), the literal "next", or a kebab-case name ("checkout-redesign"). Type is regular|hotfix (default regular). Examples: "1.2.5", "1.2.5:hotfix", "next:regular:Holiday backend", "checkout-redesign:regular:Q3 redesign".',vo,[]).option("-y, --yes","Skip confirmation prompt").action(async t=>{let r=t.release.map(qe),a=r.length>0?r:void 0;m(await Ke({releases:a,confirmedCommand:t.yes}))}),wo=e=>e.description("Edit a release's description in Jira and in the matching GitHub PR body").option("-v, --version <version>","Release version (e.g. 1.2.5) or release name (e.g. checkout-redesign)").option("-d, --description <description>",'New description (use "" to clear)').option("-y, --yes","Skip confirmation prompt").action(async t=>{m(await Je({version:t.version,description:t.description,confirmedCommand:t.yes}))}),Ro=e=>e.description("Deploy any release branch to any environment").option("-v, --version <version>",'Version (e.g. 1.2.5) or release name (e.g. checkout-redesign) to deploy; "dev" deploys from the dev branch').option("-e, --env <env>","Specify the environment to deploy to, e.g. dev").option("--skip-terraform","Skip terraform deployment step").option("-y, --yes","Skip confirmation prompt").action(async t=>{m(await Fe({version:t.version,env:t.env,skipTerraform:t.skipTerraform,confirmedCommand:t.yes}))}),Eo=e=>e.description("Deploy selected services from release branch to any environment").option("-v, --version <version>",'Version (e.g. 1.2.5) or release name (e.g. checkout-redesign) to deploy; "dev" deploys from the dev branch').option("-e, --env <env>","Specify the environment to deploy to, e.g. dev").option("-s, --services <services...>","Specify services to deploy, e.g. client-be client-fe").option("--skip-terraform","Skip terraform deployment step").option("-y, --yes","Skip confirmation prompt").action(async t=>{m(await Ge({version:t.version,env:t.env,services:t.services,skipTerraform:t.skipTerraform,confirmedCommand:t.yes}))}),xo=e=>e.description("Release a new version to production").option("-v, --version <version>","Version (e.g. 1.2.5) or release name (e.g. checkout-redesign) to deliver").option("-y, --yes","Skip confirmation prompt").action(async t=>{m(await Ue({version:t.version,confirmedCommand:t.yes}))}),Co=e=>e.description("Remove release worktrees whose PRs are no longer open").option("-y, --yes","Skip confirmation prompt").action(async t=>{m(await tt({confirmedCommand:t.yes}))}),Po=e=>e.description("Add git worktrees for release branches").option("-y, --yes","Skip confirmation prompt").option("-a, --all","Select all active release branches").option("-v, --versions <versions>","Specify versions by comma, e.g. 1.2.5, 1.2.6").option("-i, --ide [mode]","Editor mode for created worktrees: workspace (default) | none").option("--no-ide","Skip the editor (alias for --ide none)").option("-c, --cursor [mode]","Deprecated alias for --ide").option("--no-cursor","Deprecated alias for --no-ide").option("-g, --github-desktop","Open created worktrees in GitHub Desktop").option("--no-github-desktop","Skip GitHub Desktop prompt").option("-m, --cmux","Open created worktrees in cmux (3-pane layout)").option("--no-cmux","Skip cmux prompt").action(async t=>{let o=Pt(t.ide,"--ide")??Pt(t.cursor,"--cursor");m(await Xe({confirmedCommand:t.yes,all:t.all,versions:t.versions,ide:o,githubDesktop:t.githubDesktop,cmux:t.cmux}))}),To=e=>e.description("List all git worktrees with detailed information").action(async()=>{m(await Qe())}),ko=e=>e.description("Remove git worktrees for release branches").option("-y, --yes","Skip confirmation prompt").option("-a, --all","Select all active release branches").option("-v, --versions <versions>","Specify versions by comma, e.g. 1.2.5, 1.2.6").action(async t=>{m(await et({confirmedCommand:t.yes,all:t.all,versions:t.versions}))}),Ao=e=>e.description("Close all cmux/editor worktree windows, then reopen the current release worktrees (also cold-start restore)").action(async()=>{m(await Ze())}),bo=e=>e.description("Show the machine-local factory config (~/.infra-kit/vendor.json) or scaffold it with --init").option("--init","Scaffold ~/.infra-kit/vendor.json (skips if it already exists)").action(async t=>{m(await ae({init:t.init}))}),Io=e=>e.description("Verify vendor/ matches vendor/.sync-manifest.json (self-contained; for any consumer repo)").action(async()=>{let t=await Ye();m(t),t.structuredContent.ok||(b.exitCode=1)}),Lo=e=>e.description("Source-aware drift check (rsync dry-run) of each target vendored subtree vs the source").option("-r, --repos <repos>","Restrict to comma-separated target repo names").action(async t=>{let o=await Be({repos:ce(t.repos)});m(o),o.structuredContent.ok||(b.exitCode=1)}),No=e=>e.description("Show the resolved config merge chain and file paths").action(async()=>{m(await X())}),_o=e=>e.description("Open the user-scope per-project override file in $EDITOR").action(async()=>{m(await Q())}),Do=new Set(["init","doctor","version","dev","self-update","mcp"]),Oo=e=>e.startsWith("env-")||Do.has(e),Mo=new Set(["env-autoload","mcp","version","self-update"]),$=e=>{let t=[];for(let o=e;o&&o.parent;o=o.parent)t.unshift(o.name());return t.join(" ")},le=()=>{let e=new go,t=e.command("release").description("Release management commands");ho(t.command("merge-dev")),yo(t.command("list")),So(t.command("create")),wo(t.command("desc-edit")),Ro(t.command("deploy-all")),Eo(t.command("deploy-selected")),xo(t.command("deliver"));let o=e.command("worktrees").description("Git worktree management commands");Po(o.command("add")),To(o.command("list")),ko(o.command("remove")),Co(o.command("sync")),Ao(o.command("reload"));let r=e.command("config").description("Manage infra-kit configuration files");No(r.command("path")),_o(r.command("edit")),e.command("audit").description("Audit against infra-kit.config.ts rules (--all for every package, --root for the monorepo root)").option("-a, --all","Audit every non-vendor workspace package").option("-r, --root","Audit the monorepo root (turbo pipeline + root commands)").action(async n=>{let i=await he({all:n.all,root:n.root});m(i),i.structuredContent.allPassed||(b.exitCode=1)});let a=e.command("vendor").description("Verify and sync the mirrored vendor/ tree");return Io(a.command("check")),a.command("sync").description("Copy vendored files from the source repo into each target and regenerate manifests").option("-y, --yes","Skip confirmation prompt").option("-r, --repos <repos>","Restrict to comma-separated target repo names").action(async n=>{m(await He({confirmedCommand:n.yes,repos:ce(n.repos)}))}),a.command("manifest").description("Regenerate each target vendor/.sync-manifest.json + README from current content (no copy)").option("-r, --repos <repos>","Restrict to comma-separated target repo names").action(async n=>{m(await We({confirmedCommand:!0,repos:ce(n.repos)}))}),Lo(a.command("diff")),bo(a.command("config")),e.command("doctor").description("Check installation and authentication status of gh and doppler CLIs").action(async()=>{m(await Le())}),e.command("self-update").description("Update this CLI using the package manager that installed it").option("--dry-run","Print the detected manager and the command that would run; install nothing").action(n=>{re({dryRun:!!n.dryRun})}),e.command("mcp").description("Run the infra-kit MCP server (stdio transport)").action(()=>{te()}),e.command("dev").description("Run local dev servers for a named devServersPresets preset (or all apps); api + ui").argument("[preset]","Named preset from devServersPresets (omit to run every app)").option("-w, --watch","Rebuild and restart on file save").option("--app <names>","Further narrow to these app folder names (comma-separated)").option("--target <keys>","Run exactly these <app>/api|<app>/ui packages (comma-separated); part-level, unlike --app").option("--cmux","Run each app in its own cmux pane (one workspace, N panes; falls back to single terminal if cmux is unavailable)").option("--self","Run only the app of the current directory (infer from cwd; use inside apps/<app>/\u2026)").option("-V, --verbose","Print full boot narration (default: quiet; full detail always in the session log)").option("--routes","Print each app\u2019s registered METHOD /path routes at startup (default: off)").action(async(n,i)=>{let{runDevServerCli:c}=await import("./dev-server.js"),s=!!(b.stdout.isTTY&&b.stdin.isTTY);await c({...i,preset:n},s,N.enabled)}),e.command("version").description("Print the installed infra-kit CLI version").action(async()=>{m(await ze())}),e.command("env-status").description("Show which env is loaded in this session (local introspection; no Doppler call)").action(async()=>{m(await Me())}),e.command("env-list").description("List available Doppler configs for the detected project").action(async()=>{m(await _e())}),e.command("init").description("Inject shell integration into .zshrc and sync repo agent-instruction files").action(async()=>{m(await V())}),e.command("env-load").description("Load Doppler env vars for a config. Source the returned file path to apply.").option("-c, --config <config>","Environment config name to load (e.g. dev, arthur)").action(async n=>{m(await Oe({config:n.config}))}),e.command("env-clear").description("Clear loaded env vars. Source the returned file path to apply.").option("--purge","Also delete this project's warm cache outright (durable disable)").action(async n=>{m(await Ne({purge:!!n.purge}))}),e.command("env-autoload",{hidden:!0}).description("Internal: prime env for the shell-startup auto-load trigger").option("--project-dir <dir>","Canonical project dir for the warm-cache key (shell-startup only)").action(async n=>{await ee({projectDir:n.projectDir})}),e.commands.forEach(je),e.hook("preAction",async(n,i)=>{K.start($(i)),N.enabled=!!i.optsWithGlobals().json,N.enabled&&(l.level="warn"),Mo.has($(i))||await Re(),Oo(i.name())||await A({expectedTrigger:"cli-invocation"})}),e.hook("postAction",(n,i)=>{let c=$(i);if(it(c))return;let d=K.snapshot()?.formattedOptions??"",f=d?` ${d}`:"",g=`infra-kit ${c}${f}`;Et({equivalent:O(g,!0)})}),e};var me=(e,t="  ")=>{let o=e.reduce((r,[a])=>Math.max(r,a.length),0);return e.map(([r,a])=>`${r.padEnd(o)}${t}${a}`)};import{spawn as Fo}from"node:child_process";import h from"node:process";var v={ok:"ok",findingsPlain:"completed with findings",failed:"failed",cancelled:"cancelled",findingsSuffix:"findings",sep:" \xB7 ",reproPrefix:"$ ",nonReproPrefix:"\u2248 ",envNotice:"Applies to your shell after you exit this session."},Tt={ok:{unicode:"\u2713",ascii:"[ok]"},findings:{unicode:"\u26A0",ascii:"[!]"},failed:{unicode:"\u2717",ascii:"[x]"},cancelled:{unicode:"\u2298",ascii:"[-]"}},kt=e=>`${v.reproPrefix}${e}`,jo=e=>e<1e3?`${Math.round(e)}ms`:`${(e/1e3).toFixed(1)}s`,$o=(e,t)=>e==="findings"?t!=null?`${t} ${v.findingsSuffix}`:v.findingsPlain:{ok:v.ok,failed:v.failed,cancelled:v.cancelled}[e],At=e=>{let t=e.equivalent.reproducible?v.reproPrefix:v.nonReproPrefix,o=e.ascii===!0?Tt[e.outcome].ascii:Tt[e.outcome].unicode,a=[$o(e.outcome,e.findingsCount),jo(e.durationMs)],n=e.summary?.[0];n!=null&&n.length>0&&a.push(n);let i=[`${o} ${a.join(v.sep)}`];return e.showEquivalent!==!1&&i.unshift(`${t}${e.equivalent.line}`),e.envNotice===!0&&i.push(v.envNotice),i.join(`
+`)};var Uo=new Set([130,143]),bt=(e,t,o,r=!1)=>o?t!=null||e===0?"ok":"findings":r&&e!=null&&Uo.has(e)||t==="SIGINT"||e===0?"cancelled":"failed";import It from"node:process";var R={column:"\r",sgr:"\x1B[0m",cursor:"\x1B[?25h",wrap:"\x1B[?7h",saveCursor:"\x1B7",restoreCursor:"\x1B8",scrollRegion:"\x1B[r",primaryBuffer:"\x1B[?1049l"},Lt=(e,t)=>{let o=t?.write??(n=>{It.stderr.write(n)}),r=t?.stdin??It.stdin,a=[R.saveCursor,R.scrollRegion,R.restoreCursor,R.column,R.sgr,R.cursor,R.wrap];e.entersAltScreen===!0&&a.push(R.primaryBuffer),o(a.join("")),r.isTTY===!0&&r.isRaw===!0&&r.setRawMode?.(!1)};var Nt=e=>`infra-kit ${e.groupPath.join(" ")}`,Go=e=>new Promise(t=>{e.on("exit",(o,r)=>{t({code:o,signal:r})}),e.on("error",()=>{t({code:1,signal:null})})}),Vo=async(e,t,o)=>{let r=xt(),a={...t.env,[j]:r,INFRA_KIT_NO_AUTO_UPDATE:"1"},n=t.now(),i={code:1,signal:null};o(!0);try{let g=t.spawn(h.execPath,[t.cliPath,...e.groupPath],{stdio:"inherit",env:a});i=await Go(g)}catch{i={code:1,signal:null}}finally{o(!1),t.resetTerminal({entersAltScreen:e.entersAltScreen})}let c=Ct(r),s=bt(i.code,i.signal,c!=null,e.longRunning),d=Nt(e),f=c?.equivalent??O(d,!0);return At({equivalent:f,outcome:s,durationMs:t.now()-n,summary:c?.summary,envNotice:e.sessionEnvNotice,ascii:t.ascii,showEquivalent:!(f.reproducible&&f.line===d)})},qo=(e,t)=>{let o=!1,r=!1,a=()=>{if(e()){o=!0;return}t.exit(0)},n=()=>{if(!e()){t.exit(0);return}o||(r=!0)},i=()=>{t.exit(129)},c=()=>{e()&&t.raise("SIGSTOP")};return t.register("SIGINT",a),t.register("SIGTERM",n),t.register("SIGHUP",i),t.register("SIGTSTP",c),{dispose:()=>{t.unregister("SIGINT",a),t.unregister("SIGTERM",n),t.unregister("SIGHUP",i),t.unregister("SIGTSTP",c)},childStarted:()=>{o=!1},quitRequested:()=>r}},_t=(e,t)=>!!(t.stdoutIsTTY&&t.stdinIsTTY&&t.stderrIsTTY&&e.TERM!=="dumb"&&!e.INFRA_KIT_NO_SESSION&&!e.INFRA_KIT_SESSION_REPORT),Dt=async(e,t)=>{let o={spawn:t.spawn??Fo,now:t.now??(()=>Date.now()),env:t.env??h.env,cliPath:t.cliPath,ascii:t.ascii??!(h.stdout.isTTY&&h.env.TERM!=="dumb"),resetTerminal:t.resetTerminal??(s=>{Lt(s)})},r=t.write??(s=>h.stderr.write(s)),a=t.signals??{register:(s,d)=>{h.on(s,d)},unregister:(s,d)=>{h.off(s,d)},exit:s=>{h.exit(s)},raise:s=>{h.kill(h.pid,s)}},n=!1,i={dispose:()=>{},childStarted:()=>{},quitRequested:()=>!1},c=t.installSignals===!1?i:qo(()=>n,a);try{for(;;){let s=await t.renderPalette(e);if(s==null)return;let d=t.resolveCommand(s);if(!d)continue;let f=kt(Nt(d));r(`
+${f}
+`),c.childStarted();let g=await Vo(d,o,x=>{n=x});if(r(`
+${g}
+`),c.quitRequested())return}}finally{c.dispose()}};import{spawn as Yo}from"node:child_process";import Mt from"node:fs";import T from"node:process";import{fileURLToPath as jt}from"node:url";var Ot=["INFRA_KIT_NO_AUTO_UPDATE","NO_UPDATE_NOTIFIER","CI"],Ko=new Set(["mcp","self-update"]),Jo=e=>e[2]!=null&&Ko.has(e[2]),de=e=>{let{argv:t,env:o,isTty:r,selfRealPath:a,cwd:n,realpath:i}=e;return Ot.some(s=>{let d=o[s];return d!=null&&d!==""})?"opt-out":t.includes("--json")?"json":Jo(t)?"own-command":r?_(a,n,i)?"local-install":null:"not-a-tty"};var Bo=e=>{Yo(T.execPath,[e,"--parent-pid",String(T.pid)],{detached:!0,stdio:"ignore",windowsHide:!0}).unref()},Wo=()=>jt(new URL("./update-check.js",import.meta.url)),Ho=()=>Mt.realpathSync(jt(new URL("./cli.js",import.meta.url))),zo=/^[\w@./+-]+$/i,Xo=e=>zo.test(e),Qo=(e,t,o)=>{!e?.latestVersion||!e.updateCommand||W(e.latestVersion,t)&&e.updateCommand.every(Xo)&&o(`infra-kit ${e.latestVersion} is available (you have ${t}). Run: ${e.updateCommand.join(" ")}`)},pe=(e,t={})=>{try{let o=t.argv??T.argv,r=t.env??T.env,a=t.isTty??!!T.stdout.isTTY,n=t.cwd??T.cwd(),i=t.nowMs??Date.now(),c=t.selfRealPath??Ho(),s=t.readCache??H,d=t.spawnChild??Bo,f=t.fileExists??(U=>Mt.existsSync(U)),g=t.notify??(U=>{l.info(U)});if(de({argv:o,env:r,isTty:a,selfRealPath:c,cwd:n,realpath:P})!==null)return;let x=s();if(Qo(x,e,g),!z(x,i))return;let C=t.childPath??Wo();if(!f(C))return;d(C)}catch{}};Rt();var ue=le(),Ut=async e=>{try{e?await ue.parseAsync(e):await ue.parseAsync()}catch(t){B(t)&&(l.info("Operation cancelled."),u.exit(0));let o=t instanceof Error?t.message:String(t);l.error(o),u.exit(1)}},tr=()=>{try{if(u.env.INFRA_KIT_NO_LOCATION_WARN||u.argv.includes("--json")||u.argv[2]==="mcp")return;_(er(Ft(import.meta.url)),u.cwd(),P)&&l.info("Running from a project-local node_modules. Install globally for faster startup: npm i -g infra-kit")}catch{}};tr();pe(ye.version);var Gt=()=>ct(ue.commands),or=async()=>{let e=Gt(),t=null;try{if(u.stdout.isTTY&&u.stdin.isTTY){let{runCommandPalette:o}=await import("./boot-YCABHUPP.js");t=await o(e)}else{let o=me(e.map(a=>[a.name,a.description])),r=e.flatMap((a,n)=>[...e[n-1]?.group===a.group?[]:[new $t(" "),new $t(`\u2014 ${a.group} \u2014`)],{name:o[n]??a.name,value:a.name}]);t=await Zo({message:"Select a command to run",choices:r},{output:u.stderr})}}catch(o){if(!B(o))throw o}return t},rr=async()=>{let{runCommandPalette:e}=await import("./boot-YCABHUPP.js"),t=Ft(import.meta.url),o=new Map(rt.map(r=>[r.groupPath.join(" "),r]));await Dt(Gt(),{renderPalette:e,resolveCommand:r=>{let a=o.get(r);return a?{groupPath:a.groupPath,entersAltScreen:a.entersAltScreen,sessionEnvNotice:a.sessionEnvNotice,longRunning:a.longRunning}:void 0},cliPath:t})};if(u.argv.length<=2){let e={stdoutIsTTY:!!u.stdout.isTTY,stdinIsTTY:!!u.stdin.isTTY,stderrIsTTY:!!u.stderr.isTTY};if(_t(u.env,e))await rr();else{let t=await or();t&&await Ut(["node","infra-kit",...t.split(" ")])}}else await Ut();
 //# sourceMappingURL=cli.js.map