infra-kit 0.15.0 → 0.16.0

package/dist/{chunk-EZ4DIT5A.js → chunk-4GXRGHU3.js}

@@ -1,13 +1,14 @@
-import{a as ie}from"./chunk-MFAFQVTW.js";import{a as ne}from"./chunk-3UE375II.js";import{e as N,q as re,s as oe}from"./chunk-I23MDR4X.js";import Fe from"node:process";import De from"node:process";var S={enabled:!1},We=(e,t=r=>{De.stdout.write(r)})=>(S.enabled&&e&&e.structuredContent!=null&&t(`${JSON.stringify(e.structuredContent,null,2)}
-`),e),se=e=>{e.options.some(r=>r.long==="--json")||e.option("--json","Output the structured result as JSON on stdout (human logs stay on stderr)"),e.commands.forEach(se)};var ae={source:null},w=()=>ae.source!==null,qe=()=>w()||S.enabled,_=()=>!!Fe.env.CI,Ge=({env:e,stdinIsTTY:t,flag:r})=>{if(r)return"flag";let o=e.INFRA_KIT_AGENT;return o==="1"||e.CLAUDECODE!==void 0&&!t&&o!=="0"?"env":null};var x=e=>{let t=new Set,r=e;for(;r!==null&&typeof r=="object"&&!t.has(r);){t.add(r);let{stderr:o,stderrExcerpt:n}=r;if(typeof o=="string"&&o.length>0)return o;if(typeof n=="string"&&n.length>0)return n;r=r.cause}},Be=(e,t)=>{let r=t.stderrExcerpt??x(e),o=[`failed to ${t.operation}`];return r&&o.push(`stderr: ${r.slice(0,200).trim()}`),t.remediation&&o.push(`try: ${t.remediation}`),o.join(" \u2014 ")},u=class extends Error{operation;remediation;stderrExcerpt;constructor(t,r){super(Be(t,r),{cause:t}),this.name="OperationError",this.operation=r.operation,this.remediation=r.remediation,this.stderrExcerpt=r.stderrExcerpt??x(t)}};import k from"node:path";import le from"node:process";import{$ as m}from"zx";var ze=/^v?(\d+)\.(\d+)\.(\d+)$/,Ue=/^(\d+)\.(\d+)\.(\d+)$/,He=/^[a-z0-9]+(?:-[a-z0-9]+)*$/,I="release/",T="release/v",ce="refs/heads/",Ve="next";var ue=new Set(["dev","main","next","hotfix","regular","release"]),g=class extends Error{constructor(t){super(t),this.name="InvalidReleaseNameError"}},h=class extends Error{constructor(t){super(t),this.name="InvalidReleaseRefError"}},pe=e=>e.startsWith(ce)?e.slice(ce.length):e,de=(e,t,r)=>({kind:"version",semver:{major:e,minor:t,patch:r},raw:`${e}.${t}.${r}`}),L=e=>{if(e.length===0)throw new g('Release name is empty. Provide a kebab-case name like "checkout-redesign".');if(e.length>50)throw new g(`Release name "${e}" is ${e.length} characters; the maximum is 50.`);if(!He.test(e))throw new g(`Release name "${e}" is not kebab-case. Use lowercase letters, digits, and single hyphens, e.g. "checkout-redesign".`);if(ue.has(e))throw new g(`Release name "${e}" is reserved. Reserved names: ${[...ue].join(", ")}.`)},K=e=>{let t=pe(e.trim());if(!t.startsWith(I))return null;if(t.startsWith(T)){let o=t.slice(T.length),n=Ue.exec(o);if(n)return de(Number(n[1]),Number(n[2]),Number(n[3]))}let r=t.slice(I.length);try{L(r)}catch{return null}return{kind:"name",name:r,raw:r}},Je=e=>{let t=e.trim();if(pe(t).startsWith(I)){let n=K(t);if(!n)throw new h(`"${e}" looks like a release branch but is not a valid release/v<semver> or release/<name> ref.`);return n}let o=ze.exec(t);if(o)return de(Number(o[1]),Number(o[2]),Number(o[3]));if(t.toLowerCase()===Ve)throw new h('The "next" token must be resolved to a concrete version (via computeNextVersion) before parsing a release ref.');if(t.includes("@"))throw new h(`Cannot parse "${e}" as a release ref: the \`@date\` suffix belongs to \`release create\`; pass the version alone here and use \`--release-date\` on \`release edit\``);try{L(t)}catch(n){let s=n instanceof Error?n.message:String(n);throw new h(`Cannot parse "${e}" as a release ref: ${s}`)}return{kind:"name",name:t,raw:t}},Xe=e=>e.kind==="version"?`${T}${e.raw}`:`${I}${e.name}`,Ye=(e,t)=>{let r=t==="hotfix"?"Hotfix":"Release";return e.kind==="version"?`${r} v${e.raw}`:`${r} ${e.name}`},Ze=e=>e.kind==="version"?`Release v${e.raw} (RC)`:`Release ${e.name} (RC)`,Qe=e=>e.kind==="version"?`v${e.raw}`:e.name,et=e=>e.raw,D=e=>e==null?!1:K(e)!==null,me=e=>{if(e===void 0)return null;let t=e instanceof Date?e.getTime():new Date(e).getTime();return Number.isNaN(t)?null:t},tt=(e,t,r)=>{if(e.kind==="version"&&t.kind==="version")return e.semver.major!==t.semver.major?e.semver.major-t.semver.major:e.semver.minor!==t.semver.minor?e.semver.minor-t.semver.minor:e.semver.patch-t.semver.patch;if(e.kind==="version")return-1;if(t.kind==="version")return 1;let o=me(r?.a),n=me(r?.b);return o!==null&&n!==null&&o!==n?o-n:e.name<t.name?-1:e.name>t.name?1:0};var fe=async e=>{let t=await m({cwd:e})`git worktree list --porcelain`,r=[],o=null;for(let n of t.stdout.split(`
+import{a as ie}from"./chunk-MFAFQVTW.js";import{a as ne}from"./chunk-OPYDLPHB.js";import{e as N,q as re,s as oe}from"./chunk-I23MDR4X.js";import Fe from"node:process";import De from"node:process";var S={enabled:!1},We=(e,t=r=>{De.stdout.write(r)})=>(S.enabled&&e&&e.structuredContent!=null&&t(`${JSON.stringify(e.structuredContent,null,2)}
+`),e),se=e=>{e.options.some(r=>r.long==="--json")||e.option("--json","Output the structured result as JSON on stdout (human logs stay on stderr)"),e.commands.forEach(se)};var ae={source:null},w=()=>ae.source!==null,qe=()=>w()||S.enabled,_=()=>!!Fe.env.CI,ze=({env:e,stdinIsTTY:t,flag:r})=>{if(r)return"flag";let o=e.INFRA_KIT_AGENT;return o==="1"||e.CLAUDECODE!==void 0&&!t&&o!=="0"?"env":null};var x=e=>{let t=new Set,r=e;for(;r!==null&&typeof r=="object"&&!t.has(r);){t.add(r);let{stderr:o,stderrExcerpt:n}=r;if(typeof o=="string"&&o.length>0)return o;if(typeof n=="string"&&n.length>0)return n;r=r.cause}},Ge=(e,t)=>{let r=t.stderrExcerpt??x(e),o=[`failed to ${t.operation}`];return r&&o.push(`stderr: ${r.slice(0,200).trim()}`),t.remediation&&o.push(`try: ${t.remediation}`),o.join(" \u2014 ")},u=class extends Error{operation;remediation;stderrExcerpt;constructor(t,r){super(Ge(t,r),{cause:t}),this.name="OperationError",this.operation=r.operation,this.remediation=r.remediation,this.stderrExcerpt=r.stderrExcerpt??x(t)}};import k from"node:path";import le from"node:process";import{$ as m}from"zx";var Be=/^v?(\d+)\.(\d+)\.(\d+)$/,Ue=/^(\d+)\.(\d+)\.(\d+)$/,He=/^[a-z0-9]+(?:-[a-z0-9]+)*$/,I="release/",T="release/v",ce="refs/heads/",Ve="next";var ue=new Set(["dev","main","next","hotfix","regular","release"]),g=class extends Error{constructor(t){super(t),this.name="InvalidReleaseNameError"}},h=class extends Error{constructor(t){super(t),this.name="InvalidReleaseRefError"}},pe=e=>e.startsWith(ce)?e.slice(ce.length):e,de=(e,t,r)=>({kind:"version",semver:{major:e,minor:t,patch:r},raw:`${e}.${t}.${r}`}),L=e=>{if(e.length===0)throw new g('Release name is empty. Provide a kebab-case name like "checkout-redesign".');if(e.length>50)throw new g(`Release name "${e}" is ${e.length} characters; the maximum is 50.`);if(!He.test(e))throw new g(`Release name "${e}" is not kebab-case. Use lowercase letters, digits, and single hyphens, e.g. "checkout-redesign".`);if(ue.has(e))throw new g(`Release name "${e}" is reserved. Reserved names: ${[...ue].join(", ")}.`)},K=e=>{let t=pe(e.trim());if(!t.startsWith(I))return null;if(t.startsWith(T)){let o=t.slice(T.length),n=Ue.exec(o);if(n)return de(Number(n[1]),Number(n[2]),Number(n[3]))}let r=t.slice(I.length);try{L(r)}catch{return null}return{kind:"name",name:r,raw:r}},Je=e=>{let t=e.trim();if(pe(t).startsWith(I)){let n=K(t);if(!n)throw new h(`"${e}" looks like a release branch but is not a valid release/v<semver> or release/<name> ref.`);return n}let o=Be.exec(t);if(o)return de(Number(o[1]),Number(o[2]),Number(o[3]));if(t.toLowerCase()===Ve)throw new h('The "next" token must be resolved to a concrete version (via computeNextVersion) before parsing a release ref.');if(t.includes("@"))throw new h(`Cannot parse "${e}" as a release ref: the \`@date\` suffix belongs to \`release create\`; pass the version alone here and use \`--release-date\` on \`release edit\``);try{L(t)}catch(n){let s=n instanceof Error?n.message:String(n);throw new h(`Cannot parse "${e}" as a release ref: ${s}`)}return{kind:"name",name:t,raw:t}},Xe=e=>e.kind==="version"?`${T}${e.raw}`:`${I}${e.name}`,Ye=(e,t)=>{let r=t==="hotfix"?"Hotfix":"Release";return e.kind==="version"?`${r} v${e.raw}`:`${r} ${e.name}`},Ze=e=>e.kind==="version"?`Release v${e.raw} (RC)`:`Release ${e.name} (RC)`,Qe=e=>e.kind==="version"?`v${e.raw}`:e.name,et=e=>e.raw,D=e=>e==null?!1:K(e)!==null,me=e=>{if(e===void 0)return null;let t=e instanceof Date?e.getTime():new Date(e).getTime();return Number.isNaN(t)?null:t},tt=(e,t,r)=>{if(e.kind==="version"&&t.kind==="version")return e.semver.major!==t.semver.major?e.semver.major-t.semver.major:e.semver.minor!==t.semver.minor?e.semver.minor-t.semver.minor:e.semver.patch-t.semver.patch;if(e.kind==="version")return-1;if(t.kind==="version")return 1;let o=me(r?.a),n=me(r?.b);return o!==null&&n!==null&&o!==n?o-n:e.name<t.name?-1:e.name>t.name?1:0};var fe=async e=>{let t=await m({cwd:e})`git worktree list --porcelain`,r=[],o=null;for(let n of t.stdout.split(`
 `)){if(n.startsWith("worktree ")){o&&r.push(o),o={path:n.slice(9),branch:null,detached:!1,bare:!1,prunable:!1,locked:!1};continue}o&&(n.startsWith("branch ")?o.branch=n.slice(7).replace(/^refs\/heads\//,""):n==="detached"?o.detached=!0:n==="bare"?o.bare=!0:n==="locked"||n.startsWith("locked ")?o.locked=!0:(n==="prunable"||n.startsWith("prunable "))&&(o.prunable=!0))}return o&&r.push(o),r},rt=async e=>{let t=await fe(le.cwd()),r=o=>e==="release"?D(o):o.startsWith("feature/");return t.map(o=>o.branch).filter(o=>o!==null&&r(o))},ot=e=>{let t=x(e);return t&&/not a git repository/i.test(t)?"not a git repository":void 0},nt=({hasStderr:e})=>{if(w())return"infra-kit resolves its project from the working directory; run it from inside an infra-kit project repo (or one of its git worktrees), or pass `-C <dir>` naming one";let t="run infra-kit from inside an infra-kit project repo (or one of its git worktrees)";return e?`${t}; if you are already in one, the stderr in this message is the real cause`:t},R=async()=>{try{return(await m({quiet:!0})`git rev-parse --show-toplevel`).stdout.trim()}catch(e){let t=ot(e)??x(e);throw new u(e,{operation:`resolve the project root from ${le.cwd()}`,stderrExcerpt:t,remediation:nt({hasStderr:t!==void 0})})}},W=async e=>{let t=e??await R(),r=(await m({cwd:t,quiet:!0})`git rev-parse --git-common-dir`).stdout.trim(),o=k.resolve(t,r);return o.includes(`${k.sep}.git${k.sep}modules${k.sep}`)?t:k.dirname(o)},ge=async()=>(await m`git rev-parse --abbrev-ref HEAD`).stdout.trim(),he=async()=>(await m`git status --porcelain`).stdout.split(`
 `).map(t=>t.trimEnd()).filter(t=>t.trim().length>0),it=async()=>(await he()).length===0,st=async()=>{let e=await R(),[t,r]=await Promise.all([m({cwd:e})`git rev-parse --absolute-git-dir`,m({cwd:e})`git rev-parse --git-common-dir`]),o=t.stdout.trim(),n=k.resolve(e,r.stdout.trim());return o!==n};var at=async e=>(await m`git branch --list ${e}`).stdout.trim().length>0,ct=async e=>{(await m`git branch --list ${e}`).stdout.trim().length!==0&&await ge()!==e&&await m`git branch -D ${e}`},ut=async e=>{(await m`git ls-remote --heads origin ${e}`).stdout.trim().length!==0&&await m`git push origin --delete ${e}`};import{$ as P}from"zx";var mt=async(e,t)=>{let r=`${t}^{commit}`;try{return(await P({cwd:e,quiet:!0})`git rev-parse --verify --quiet ${r}`).stdout.trim()||null}catch{return null}},pt=async(e,t,r)=>{try{return await P({cwd:e,quiet:!0})`git merge-base --is-ancestor ${t} ${r}`,!0}catch(o){if(o.exitCode===1)return!1;throw new u(o,{operation:`test whether ${t} is contained in ${r}`,remediation:"both refs must exist \u2014 verify them with rev-parse first"})}},dt=async(e,t)=>{let o=(await P({cwd:e,quiet:!0})`git ls-remote --heads origin ${t}`).stdout.trim().split(`
-`)[0];return o?o.split(/\s+/)[0]??null:null},lt=async(e,t)=>{let r=t.map(o=>`${o.sha}:refs/heads/${o.branch}`);if(r.length===0)return{refspecs:r,pushed:!1};try{return await P({cwd:e,quiet:!0})`git push --atomic origin ${r}`,{refspecs:r,pushed:!0}}catch(o){return{refspecs:r,pushed:!1,stderr:o.stderr}}};import q from"node:path";import F from"node:process";import{$ as p}from"zx";var ye=async e=>{let t=e??F.cwd(),r=(await p({cwd:t,quiet:!0})`git rev-parse --git-common-dir`).stdout.trim(),o=F.env.INFRA_KIT_SESSION||String(F.pid);return q.join(q.resolve(t,r),"infra-kit",`merge-dev-${o}`)},we=e=>e.replace(/[^\w-]+/g,"-"),ft=(e,t)=>q.join(`${e}${re}`,oe.mergeDev,we(t)),G=async e=>{try{return await p({cwd:e,quiet:!0})`git rev-parse -q --verify MERGE_HEAD`,!0}catch{return!1}},gt=async e=>{if(await G(e))throw new u(void 0,{operation:"reuse the scratch worktree",stderrExcerpt:"a merge is still in progress in the scratch worktree",remediation:"this is an infra-kit bug \u2014 the previous branch iteration did not clean up"});let t=(await p({cwd:e,quiet:!0})`git status --porcelain`).stdout.trim();if(t.length>0)throw new u(void 0,{operation:"reuse the scratch worktree",stderrExcerpt:`scratch worktree is dirty: ${t.split(`
-`)[0]}`,remediation:"this is an infra-kit bug \u2014 the previous branch iteration did not clean up"})},ht=async e=>{let t=async r=>{try{await r()}catch{}};await G(e)&&await t(()=>p({cwd:e,quiet:!0})`git merge --abort`),await t(()=>p({cwd:e,quiet:!0})`git reset --hard`),await t(()=>p({cwd:e,quiet:!0})`git clean -fd`)},yt=async(e,t)=>{let{cwd:r,anchor:o="origin/dev"}=e,n=await ye(r),s=async()=>{await p({cwd:r,quiet:!0})`git worktree add --detach ${n} ${o}`};try{await s()}catch(c){try{await p({cwd:r,quiet:!0})`git worktree prune`,await s()}catch{throw new u(c,{operation:"create the scratch worktree for the merge",remediation:`remove any stale checkout at ${n}, then retry`})}}let a={path:n,remove:async()=>{try{await p({cwd:r,quiet:!0})`git worktree remove --force ${n}`}catch{}}};try{return await t(a)}finally{await a.remove()}};import wt from"node:process";import kt from"pino";import vt from"pino-pretty";var xt=["token","*.token","serviceToken","*.serviceToken","DOPPLER_TOKEN","*.DOPPLER_TOKEN","INFRA_KIT_ENV_TOKEN","*.INFRA_KIT_ENV_TOKEN"],Rt=()=>{let e=wt.argv.includes("--debug")?"debug":"info",t=["time","pid","hostname"];return e==="debug"&&t.push("level"),kt({level:e,redact:xt},vt({destination:2,ignore:t.join(","),colorize:!0,sync:!0}))},B=Rt();import Q from"node:fs/promises";import Pe from"node:os";import E from"node:path";import Tt from"node:process";import{z as i}from"zod";var z=e=>{throw new Error(`Unexpected value: ${JSON.stringify(e)}`)};var y=(e,t)=>Object.fromEntries(Object.entries(e).filter(([r])=>r!==t));var v=({key:e,id:t,note:r})=>({id:t,note:r,apply:o=>e in o?{changed:!0,result:y(o,e)}:{changed:!1,result:o}});var ke=v({key:"devProxy",id:"drop-dev-proxy-key",note:'the retired "devProxy" key (dev URLs are port-free https://<release>.<package>.localhost)'});var ve=v({key:"envAutoLoad",id:"drop-env-auto-load-key",note:'the retired "envAutoLoad" key (env auto-load is gone \u2014 run `env-load -c <config>` in the terminal)'});var xe=v({key:"environments",id:"drop-environments-key",note:`the retired "environments" key (deploy targets now come from each workflow's workflow_dispatch options, auth from the token store)`});var bt=e=>{let t=e.ide;if(t===null||typeof t!="object")return{changed:!1,result:e};let r=!1,o=s=>{if(s===null||typeof s!="object"||!("config"in s))return s;let a=s.config;return a===null||typeof a!="object"||!("mode"in a)?s:(r=!0,{...s,config:y(a,"mode")})},n=Array.isArray(t)?t.map(o):o(t);return r?{changed:!0,result:{...e,ide:n}}:{changed:!1,result:e}},Re={id:"strip-legacy-ide-mode",note:'legacy "mode"',apply:bt};var Ct="zed",be=e=>e!==null&&typeof e=="object"&&e.provider===Ct,Et=e=>{let t=e.ide;if(Array.isArray(t)){let r=t.filter(o=>!be(o));return r.length===t.length?{changed:!1,result:e}:{changed:!0,result:r.length>0?{...e,ide:r}:y(e,"ide")}}return be(t)?{changed:!0,result:y(e,"ide")}:{changed:!1,result:e}},Ce={id:"strip-retired-zed-ide",note:'the retired "zed" provider',apply:Et};var U=[Re,Ce,xe,ke,ve];var b=e=>U.reduce((t,r)=>{let o=r.apply(t.result);return o.changed?{changed:!0,result:o.result,notes:[...t.notes,r.note]}:t},{changed:!1,result:e,notes:[]});import Mt from"node:fs/promises";import St from"node:os";var It=async e=>{try{return await Mt.access(e),!0}catch{return!1}},H=e=>{let t=St.homedir();return e.startsWith(t)?`~${e.slice(t.length)}`:e};import{randomBytes as Pt}from"node:crypto";import l from"node:fs/promises";import V from"node:path";import jt from"node:process";var j=class extends Error{constructor(t){super(`${t} changed on disk since it was read`),this.name="ConfigFileChangedError"}},$t=2,At=e=>/^([ \t]+)\S/m.exec(e)?.[1]??$t,Ot=4095,$=async({path:e,raw:t,migrated:r,expectedMtimeMs:o})=>{let n=await l.realpath(e),s=V.dirname(n),a=V.basename(n),c=V.join(s,`.${a}.${jt.pid}.${Pt(4).toString("hex")}.tmp`),A=`${JSON.stringify(r,null,At(t))}
-`;try{await l.writeFile(c,A,"utf8");let d=await l.stat(n);if(d.mtimeMs!==o)throw new j(e);await l.chmod(c,d.mode&Ot),await l.rename(c,n)}catch(d){throw await l.rm(c,{force:!0}),d}},Nt=e=>e!==null&&typeof e=="object"&&!Array.isArray(e),_t=async e=>{let t=await l.stat(e),r=await l.readFile(e,"utf8");if(r.trim()==="")return{changed:!1,result:{},notes:[],path:e};let o=JSON.parse(r);if(!Nt(o))return{changed:!1,result:{},notes:[],path:e};let n=b(o);return n.changed&&await $({path:e,raw:r,migrated:n.result,expectedMtimeMs:t.mtimeMs}),{...n,path:e}};var J=async(e,t,r,{schema:o})=>{if(e.autoMigrate==="off")return{kind:"not-applicable"};let n=b(t);if(!n.changed)return{kind:"not-applicable"};let s=o.safeParse(n.result);if(!s.success)return{kind:"not-applicable"};if(e.required&&_())return{kind:"ci-gated"};try{await $({path:e.path,raw:r,migrated:n.result,expectedMtimeMs:e.mtimeMs})}catch(a){return B.debug(a,`auto-migration could not rewrite ${e.path}`),{kind:"not-applicable"}}return B.warn(`Migrated ${H(e.path)}: removed ${n.notes.join(" and ")} (retired by infra-kit ${ne.version})`),{kind:"migrated",data:s.data}};var Ee="infra-kit.json";var Lt="infra-kit.json",Kt="projects",Dt=i.object({provider:i.literal("doppler"),config:i.object({name:i.string().min(1)})}),Wt=i.discriminatedUnion("provider",[Dt]),Ft=i.object({workspaceConfigPath:i.string().min(1)}).strict(),qt=i.object({provider:i.literal("cursor"),config:Ft}).strict(),Me=i.discriminatedUnion("provider",[qt]),Gt=i.union([Me,i.array(Me).min(1)]),Bt=i.object({provider:i.literal("jira"),config:i.object({baseUrl:i.string().url(),projectId:i.number().int().positive()})}),zt=i.discriminatedUnion("provider",[Bt]),Ut=["two-columns","three-pane"],Ht=i.object({layout:i.enum(Ut).optional()}).strict(),Vt=i.object({openInGithubDesktop:i.boolean().optional(),openInOrca:i.boolean().optional(),orca:Ht.optional()}).strict(),Jt=i.object({port:i.number().int().positive().optional(),prefixUrl:i.string().min(1).optional()}).strict(),Xt=i.record(i.string().min(1),Jt),Yt=i.enum(["local","cloud"]),Zt=i.object({watchDeps:i.boolean().optional(),proxy:i.record(i.string().min(1),Yt).optional()}).strict(),Qt=i.object({apps:i.record(i.string().min(1),Zt).optional(),orca:i.boolean().optional()}).strict(),er=i.record(i.string().min(1),Qt),tr=i.enum(["disallow","allow","cli-only"]),Se=i.string().regex(/^[A-Z_]\w*$/i,"must be a POSIX environment-variable name"),rr=i.object({command:i.string().min(1),args:i.array(i.string()).default([]),env:i.array(Se).min(1),unset:i.array(Se).default([])}).strict().superRefine((e,t)=>{for(let r of e.env)ie.has(r)&&t.addIssue({code:"custom",path:["env"],message:`"${r}" is process plumbing the proxy never strips or injects \u2014 it cannot be a credential name`})}),or=i.record(i.string().regex(/^[a-z][a-z0-9-]*$/,"must be lowercase letters, digits and hyphens, starting with a letter").refine(e=>!e.includes("infra-kit"),{message:'"infra-kit" is reserved: it is the .mcp.json key of the retired infra-kit MCP server \u2014 pick another name'}),rr),Ie=i.string().min(1).superRefine((e,t)=>{if(e.startsWith("/")||e.startsWith("\\")||/^[a-z]:/i.test(e)){t.addIssue({code:"custom",message:`"${e}" must be relative to the repository root`});return}let r=e.split(/[/\\]/).filter(n=>n!==""&&n!==".");r.includes("..")&&t.addIssue({code:"custom",message:`"${e}" must not contain a ".." segment`}),r[0]===".git"&&t.addIssue({code:"custom",message:`"${e}" must not be .git or a path inside it`}),e.includes("\\")&&t.addIssue({code:"custom",message:`"${e}" must use "/" as the separator, not "\\"`});let o=e.split("/");o.includes("")&&t.addIssue({code:"custom",message:`"${e}" must not have a trailing or doubled "/"`}),o.includes(".")&&t.addIssue({code:"custom",message:`"${e}" must not contain a "." segment; write it from the repository root, e.g. "vendor/configs"`})}),nr=i.object({path:Ie,target:Ie.optional()}).strict(),je=i.object({copy:i.array(nr).min(1),exclude:i.array(i.string().regex(/^[^/\\]+$/,'must be a single path segment, without "/"')).optional()}).strict(),ir=i.object({requiredScripts:i.array(i.string().min(1)).optional(),requiredFiles:i.array(i.string().min(1)).optional(),turbo:i.object({requiredTasks:i.array(i.string().min(1)).optional()}).strict().optional()}).strict(),ee=i.object({envManagement:Wt,ide:Gt.optional(),taskManager:zt.optional(),worktrees:Vt.optional(),dev:Xt.optional(),devServersPresets:er.optional(),protectedEnvs:tr.optional(),mcp:or.optional(),vendorSource:je.nullable().optional(),audit:ir.optional()}).strict(),sr=443,$e=ee.superRefine((e,t)=>{if(!Array.isArray(e.ide))return;let r=new Set;for(let o of e.ide){if(r.has(o.provider)){t.addIssue({code:"custom",message:"each IDE provider may appear at most once",path:["ide"]});return}r.add(o.provider)}}),Z=ee.partial(),ar=e=>{let t=e.ide;return t?Array.isArray(t)?t:[t]:[]},Ae="two-columns",cr=e=>e.worktrees?.orca?.layout??Ae,f=null,C=null,Oe=()=>`${Tt.cwd()} ${Pe.homedir()}`,Ne=()=>E.join(Pe.homedir(),N),_e=()=>E.join(Ne(),Lt),Te=async()=>{let e=Oe();if(C&&C.key===e)return C.value;let t=await R(),r=await W(t),o=E.basename(r),n={main:E.join(t,Ee),userGlobal:_e(),userProject:E.join(Ne(),Kt,o,Ee),projectName:o};return C={key:e,value:n},n},ur=async(e={})=>{let t=e.autoMigrate??"write",r=Oe(),o=await Te(),n;try{n=await Q.stat(o.main)}catch{f=null;let O=o.main.replace(/\.json$/,".yml");throw await X(O)?new Error(`infra-kit.json not found at ${o.main}. A legacy infra-kit.yml exists \u2014 run \`infra-kit setup --skip-tools\` to convert it.`):new Error(w()?`infra-kit.json not found at ${o.main} \u2014 the working directory is not an infra-kit project. Run infra-kit from inside an infra-kit project repo, or pass \`-C <dir>\` naming one.`:`infra-kit.json not found at ${o.main} \u2014 this git repo is not an infra-kit project. Run \`infra-kit setup --skip-tools\` here to create it, cd into an infra-kit project repo, or check out a branch that has infra-kit.json.`)}let[s,a]=await Promise.all([X(o.userGlobal),X(o.userProject)]),c={main:Number(n.mtimeMs),userGlobal:s?Number(s.mtimeMs):null,userProject:a?Number(a.mtimeMs):null};if(f&&f.key===r&&lr(f.mtimes,c))return f.value;let A=[{label:"infra-kit.json",path:o.main,required:!0,autoMigrate:t,mtimeMs:c.main},{label:"~/.infra-kit/infra-kit.json",path:o.userGlobal,required:!1,autoMigrate:t,mtimeMs:c.userGlobal},{label:`~/.infra-kit/projects/${o.projectName}/infra-kit.json`,path:o.userProject,required:!1,autoMigrate:t,mtimeMs:c.userProject}],d={};for(let O of A){let te=await fr(O);te!==null&&(d={...d,...te})}let M=$e.safeParse(d);if(!M.success)throw new Error(`Invalid merged infra-kit config: ${i.prettifyError(M.error)}`);return f={key:r,mtimes:c,value:M.data},M.data},mr=()=>{f=null},pr=()=>{f=null,C=null},X=async e=>{try{return await Q.stat(e)}catch{return null}},dr=async e=>{try{return await Q.readFile(e,"utf-8")}catch{return null}},lr=(e,t)=>{let r=Object.keys(e);return r.length!==Object.keys(t).length?!1:r.every(o=>e[o]===t[o])},Le=e=>new Error(`${e.message}
-A retired key on this branch \u2014 run \`infra-kit setup --skip-tools\` in this checkout and commit infra-kit.json.`),fr=async e=>{let t=await dr(e.path);if(t===null){if(e.required)throw new Error(`${e.label} not found at ${e.path}`);return null}let r;try{r=t.trim()===""?{}:JSON.parse(t)}catch(a){throw new Error(`Invalid JSON in ${e.label} at ${e.path}: ${a.message}`)}if(Y(r)&&"envTokens"in r)throw new Error(vr(e));!e.required&&Y(r)&&kr(e,r);let o=Z.safeParse(r);if(o.success)return o.data;let n=new Error(`Invalid ${e.label} at ${e.path}: ${i.prettifyError(o.error)}`);if(!Y(r)||e.mtimeMs===null)throw n;let s=await J({...e,mtimeMs:e.mtimeMs},r,t,{schema:Z});switch(s.kind){case"migrated":return s.data;case"ci-gated":throw Le(n);case"not-applicable":throw n;default:return z(s)}},gr=e=>[`"mcp" is not allowed in ${e.label} (${e.path}): it feeds the committed .mcp.json, so a per-machine copy would replace the project's servers for everyone.`,"Move the block to the project infra-kit.json and run `infra-kit setup`.","For a machine-only override of one server (e.g. a local fork), use Claude Code directly:","  claude mcp add --scope local <name> -- ik-mcp --name <name> --env <VAR> ... -- <command> <args>","(local scope shadows the project entry by name; `claude mcp list` will show a same-name conflict warning, which is expected)."].join(`
-`),hr=e=>[`"vendorSource" is not allowed in ${e.label} (${e.path}): only the committed project file may mark a repository as the \`vendor sync\` source. In the machine-wide file it would make every repository on this machine a source; in a per-project override it would make this machine disagree with every other clone.`,"Move the block to the source repository's own infra-kit.json and commit it there."].join(`
-`),yr=e=>[`"audit" is not allowed in ${e.label} (${e.path}): the root audit gates CI, so a per-machine copy would make this machine pass or fail a different check list than CI.`,"Move the block to the project infra-kit.json and commit it there."].join(`
-`),wr={mcp:gr,vendorSource:hr,audit:yr},kr=(e,t)=>{for(let[r,o]of Object.entries(wr))if(r in t)throw new Error(o(e))},Y=e=>typeof e=="object"&&e!==null&&!Array.isArray(e),vr=e=>[`Refusing to load ${e.label} \u2014 \`envTokens\` is not a config key.`,"A service token in a config file can be committed, backed up by your editor, or shared.","  1. REVOKE the token in Doppler now \u2014 treat it as compromised.",`  2. Remove the \`envTokens\` key from ${e.path}.`,"  3. Re-add it privately: `infra-kit env-token-set <env>`","     (it is written to ~/.infra-kit/projects/<repo>/tokens.json, mode 0600, never to the repo)."].join(`
-`);var Ke=class extends u{structuredContent;exitCode;constructor(t,r,o){super(void 0,o),this.name="StructuredRefusalError",this.structuredContent=t,this.exitCode=r}};export{S as a,We as b,se as c,ae as d,w as e,qe as f,Ge as g,x as h,u as i,g as j,L as k,K as l,Je as m,Xe as n,Ye as o,Ze as p,Qe as q,et as r,D as s,tt as t,fe as u,rt as v,R as w,W as x,ge as y,he as z,it as A,st as B,at as C,ct as D,ut as E,mt as F,pt as G,dt as H,lt as I,we as J,ft as K,G as L,gt as M,ht as N,yt as O,B as P,z as Q,It as R,H as S,j as T,$ as U,_t as V,je as W,ee as X,sr as Y,$e as Z,Z as _,ar as $,cr as aa,_e as ba,Te as ca,ur as da,mr as ea,pr as fa,Ke as ga};
-//# sourceMappingURL=chunk-EZ4DIT5A.js.map
+`)[0];return o?o.split(/\s+/)[0]??null:null},lt=async(e,t)=>{let r=t.map(o=>`${o.sha}:refs/heads/${o.branch}`);if(r.length===0)return{refspecs:r,pushed:!1};try{return await P({cwd:e,quiet:!0})`git push --atomic origin ${r}`,{refspecs:r,pushed:!0}}catch(o){return{refspecs:r,pushed:!1,stderr:o.stderr}}};import q from"node:path";import F from"node:process";import{$ as p}from"zx";var ye=async e=>{let t=e??F.cwd(),r=(await p({cwd:t,quiet:!0})`git rev-parse --git-common-dir`).stdout.trim(),o=F.env.INFRA_KIT_SESSION||String(F.pid);return q.join(q.resolve(t,r),"infra-kit",`merge-dev-${o}`)},we=e=>e.replace(/[^\w-]+/g,"-"),ft=(e,t)=>q.join(`${e}${re}`,oe.mergeDev,we(t)),z=async e=>{try{return await p({cwd:e,quiet:!0})`git rev-parse -q --verify MERGE_HEAD`,!0}catch{return!1}},gt=async e=>{if(await z(e))throw new u(void 0,{operation:"reuse the scratch worktree",stderrExcerpt:"a merge is still in progress in the scratch worktree",remediation:"this is an infra-kit bug \u2014 the previous branch iteration did not clean up"});let t=(await p({cwd:e,quiet:!0})`git status --porcelain`).stdout.trim();if(t.length>0)throw new u(void 0,{operation:"reuse the scratch worktree",stderrExcerpt:`scratch worktree is dirty: ${t.split(`
+`)[0]}`,remediation:"this is an infra-kit bug \u2014 the previous branch iteration did not clean up"})},ht=async e=>{let t=async r=>{try{await r()}catch{}};await z(e)&&await t(()=>p({cwd:e,quiet:!0})`git merge --abort`),await t(()=>p({cwd:e,quiet:!0})`git reset --hard`),await t(()=>p({cwd:e,quiet:!0})`git clean -fd`)},yt=async(e,t)=>{let{cwd:r,anchor:o="origin/dev"}=e,n=await ye(r),s=async()=>{await p({cwd:r,quiet:!0})`git worktree add --detach ${n} ${o}`};try{await s()}catch(c){try{await p({cwd:r,quiet:!0})`git worktree prune`,await s()}catch{throw new u(c,{operation:"create the scratch worktree for the merge",remediation:`remove any stale checkout at ${n}, then retry`})}}let a={path:n,remove:async()=>{try{await p({cwd:r,quiet:!0})`git worktree remove --force ${n}`}catch{}}};try{return await t(a)}finally{await a.remove()}};import wt from"node:process";import kt from"pino";import vt from"pino-pretty";var xt=["token","*.token","serviceToken","*.serviceToken","DOPPLER_TOKEN","*.DOPPLER_TOKEN","INFRA_KIT_ENV_TOKEN","*.INFRA_KIT_ENV_TOKEN"],Rt=()=>{let e=wt.argv.includes("--debug")?"debug":"info",t=["time","pid","hostname"];return e==="debug"&&t.push("level"),kt({level:e,redact:xt},vt({destination:2,ignore:t.join(","),colorize:!0,sync:!0}))},G=Rt();import Q from"node:fs/promises";import Pe from"node:os";import E from"node:path";import Tt from"node:process";import{z as i}from"zod";var B=e=>{throw new Error(`Unexpected value: ${JSON.stringify(e)}`)};var y=(e,t)=>Object.fromEntries(Object.entries(e).filter(([r])=>r!==t));var v=({key:e,id:t,note:r})=>({id:t,note:r,apply:o=>e in o?{changed:!0,result:y(o,e)}:{changed:!1,result:o}});var ke=v({key:"devProxy",id:"drop-dev-proxy-key",note:'the retired "devProxy" key (dev URLs are port-free https://<release>.<package>.localhost)'});var ve=v({key:"envAutoLoad",id:"drop-env-auto-load-key",note:'the retired "envAutoLoad" key (env auto-load is gone \u2014 run `env-load -c <config>` in the terminal)'});var xe=v({key:"environments",id:"drop-environments-key",note:`the retired "environments" key (deploy targets now come from each workflow's workflow_dispatch options, auth from the token store)`});var bt=e=>{let t=e.ide;if(t===null||typeof t!="object")return{changed:!1,result:e};let r=!1,o=s=>{if(s===null||typeof s!="object"||!("config"in s))return s;let a=s.config;return a===null||typeof a!="object"||!("mode"in a)?s:(r=!0,{...s,config:y(a,"mode")})},n=Array.isArray(t)?t.map(o):o(t);return r?{changed:!0,result:{...e,ide:n}}:{changed:!1,result:e}},Re={id:"strip-legacy-ide-mode",note:'legacy "mode"',apply:bt};var Ct="zed",be=e=>e!==null&&typeof e=="object"&&e.provider===Ct,Et=e=>{let t=e.ide;if(Array.isArray(t)){let r=t.filter(o=>!be(o));return r.length===t.length?{changed:!1,result:e}:{changed:!0,result:r.length>0?{...e,ide:r}:y(e,"ide")}}return be(t)?{changed:!0,result:y(e,"ide")}:{changed:!1,result:e}},Ce={id:"strip-retired-zed-ide",note:'the retired "zed" provider',apply:Et};var U=[Re,Ce,xe,ke,ve];var b=e=>U.reduce((t,r)=>{let o=r.apply(t.result);return o.changed?{changed:!0,result:o.result,notes:[...t.notes,r.note]}:t},{changed:!1,result:e,notes:[]});import Mt from"node:fs/promises";import St from"node:os";var It=async e=>{try{return await Mt.access(e),!0}catch{return!1}},H=e=>{let t=St.homedir();return e.startsWith(t)?`~${e.slice(t.length)}`:e};import{randomBytes as Pt}from"node:crypto";import l from"node:fs/promises";import V from"node:path";import jt from"node:process";var j=class extends Error{constructor(t){super(`${t} changed on disk since it was read`),this.name="ConfigFileChangedError"}},$t=2,At=e=>/^([ \t]+)\S/m.exec(e)?.[1]??$t,Ot=4095,$=async({path:e,raw:t,migrated:r,expectedMtimeMs:o})=>{let n=await l.realpath(e),s=V.dirname(n),a=V.basename(n),c=V.join(s,`.${a}.${jt.pid}.${Pt(4).toString("hex")}.tmp`),A=`${JSON.stringify(r,null,At(t))}
+`;try{await l.writeFile(c,A,"utf8");let d=await l.stat(n);if(d.mtimeMs!==o)throw new j(e);await l.chmod(c,d.mode&Ot),await l.rename(c,n)}catch(d){throw await l.rm(c,{force:!0}),d}},Nt=e=>e!==null&&typeof e=="object"&&!Array.isArray(e),_t=async e=>{let t=await l.stat(e),r=await l.readFile(e,"utf8");if(r.trim()==="")return{changed:!1,result:{},notes:[],path:e};let o=JSON.parse(r);if(!Nt(o))return{changed:!1,result:{},notes:[],path:e};let n=b(o);return n.changed&&await $({path:e,raw:r,migrated:n.result,expectedMtimeMs:t.mtimeMs}),{...n,path:e}};var J=async(e,t,r,{schema:o})=>{if(e.autoMigrate==="off")return{kind:"not-applicable"};let n=b(t);if(!n.changed)return{kind:"not-applicable"};let s=o.safeParse(n.result);if(!s.success)return{kind:"not-applicable"};if(e.required&&_())return{kind:"ci-gated"};try{await $({path:e.path,raw:r,migrated:n.result,expectedMtimeMs:e.mtimeMs})}catch(a){return G.debug(a,`auto-migration could not rewrite ${e.path}`),{kind:"not-applicable"}}return G.warn(`Migrated ${H(e.path)}: removed ${n.notes.join(" and ")} (retired by infra-kit ${ne.version})`),{kind:"migrated",data:s.data}};var Ee="infra-kit.json";var Lt="infra-kit.json",Kt="projects",Dt=i.object({provider:i.literal("doppler"),config:i.object({name:i.string().min(1)})}),Wt=i.discriminatedUnion("provider",[Dt]),Ft=i.object({workspaceConfigPath:i.string().min(1)}).strict(),qt=i.object({provider:i.literal("cursor"),config:Ft}).strict(),Me=i.discriminatedUnion("provider",[qt]),zt=i.union([Me,i.array(Me).min(1)]),Gt=i.object({provider:i.literal("jira"),config:i.object({baseUrl:i.string().url(),projectId:i.number().int().positive()})}),Bt=i.discriminatedUnion("provider",[Gt]),Ut=["two-columns","three-pane"],Ht=i.object({layout:i.enum(Ut).optional()}).strict(),Vt=i.object({openInGithubDesktop:i.boolean().optional(),openInOrca:i.boolean().optional(),orca:Ht.optional()}).strict(),Jt=i.object({port:i.number().int().positive().optional(),prefixUrl:i.string().min(1).optional()}).strict(),Xt=i.record(i.string().min(1),Jt),Yt=i.enum(["local","cloud"]),Zt=i.object({watchDeps:i.boolean().optional(),proxy:i.record(i.string().min(1),Yt).optional()}).strict(),Qt=i.object({apps:i.record(i.string().min(1),Zt).optional(),orca:i.boolean().optional()}).strict(),er=i.record(i.string().min(1),Qt),tr=i.enum(["disallow","allow","cli-only"]),Se=i.string().regex(/^[A-Z_]\w*$/i,"must be a POSIX environment-variable name"),rr=i.object({command:i.string().min(1),args:i.array(i.string()).default([]),env:i.array(Se).min(1),unset:i.array(Se).default([])}).strict().superRefine((e,t)=>{for(let r of e.env)ie.has(r)&&t.addIssue({code:"custom",path:["env"],message:`"${r}" is process plumbing the proxy never strips or injects \u2014 it cannot be a credential name`})}),or=i.record(i.string().regex(/^[a-z][a-z0-9-]*$/,"must be lowercase letters, digits and hyphens, starting with a letter").refine(e=>!e.includes("infra-kit"),{message:'"infra-kit" is reserved: it is the .mcp.json key of the retired infra-kit MCP server \u2014 pick another name'}),rr),Ie=i.string().min(1).superRefine((e,t)=>{if(e.startsWith("/")||e.startsWith("\\")||/^[a-z]:/i.test(e)){t.addIssue({code:"custom",message:`"${e}" must be relative to the repository root`});return}let r=e.split(/[/\\]/).filter(n=>n!==""&&n!==".");r.includes("..")&&t.addIssue({code:"custom",message:`"${e}" must not contain a ".." segment`}),r[0]===".git"&&t.addIssue({code:"custom",message:`"${e}" must not be .git or a path inside it`}),e.includes("\\")&&t.addIssue({code:"custom",message:`"${e}" must use "/" as the separator, not "\\"`});let o=e.split("/");o.includes("")&&t.addIssue({code:"custom",message:`"${e}" must not have a trailing or doubled "/"`}),o.includes(".")&&t.addIssue({code:"custom",message:`"${e}" must not contain a "." segment; write it from the repository root, e.g. "vendor/configs"`})}),nr=i.object({path:Ie,target:Ie.optional()}).strict(),je=i.object({copy:i.array(nr).min(1),exclude:i.array(i.string().regex(/^[^/\\]+$/,'must be a single path segment, without "/"')).optional()}).strict(),ir=i.object({requiredScripts:i.array(i.string().min(1)).optional(),requiredFiles:i.array(i.string().min(1)).optional(),turbo:i.object({requiredTasks:i.array(i.string().min(1)).optional()}).strict().optional()}).strict(),sr=i.string().regex(/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/,'must be a DNS label: a-z, 0-9 and inner "-", at most 63 characters'),ee=i.object({envManagement:Wt,ide:zt.optional(),taskManager:Bt.optional(),worktrees:Vt.optional(),dev:Xt.optional(),devServersPresets:er.optional(),protectedEnvs:tr.optional(),mcp:or.optional(),vendorSource:je.nullable().optional(),audit:ir.optional(),aliasRepo:sr.optional()}).strict(),ar=443,$e=ee.superRefine((e,t)=>{if(!Array.isArray(e.ide))return;let r=new Set;for(let o of e.ide){if(r.has(o.provider)){t.addIssue({code:"custom",message:"each IDE provider may appear at most once",path:["ide"]});return}r.add(o.provider)}}),Z=ee.partial(),cr=e=>{let t=e.ide;return t?Array.isArray(t)?t:[t]:[]},Ae="two-columns",ur=e=>e.worktrees?.orca?.layout??Ae,f=null,C=null,Oe=()=>`${Tt.cwd()} ${Pe.homedir()}`,Ne=()=>E.join(Pe.homedir(),N),_e=()=>E.join(Ne(),Lt),Te=async()=>{let e=Oe();if(C&&C.key===e)return C.value;let t=await R(),r=await W(t),o=E.basename(r),n={main:E.join(t,Ee),userGlobal:_e(),userProject:E.join(Ne(),Kt,o,Ee),projectName:o};return C={key:e,value:n},n},mr=async(e={})=>{let t=e.autoMigrate??"write",r=Oe(),o=await Te(),n;try{n=await Q.stat(o.main)}catch{f=null;let O=o.main.replace(/\.json$/,".yml");throw await X(O)?new Error(`infra-kit.json not found at ${o.main}. A legacy infra-kit.yml exists \u2014 run \`infra-kit setup --skip-tools\` to convert it.`):new Error(w()?`infra-kit.json not found at ${o.main} \u2014 the working directory is not an infra-kit project. Run infra-kit from inside an infra-kit project repo, or pass \`-C <dir>\` naming one.`:`infra-kit.json not found at ${o.main} \u2014 this git repo is not an infra-kit project. Run \`infra-kit setup --skip-tools\` here to create it, cd into an infra-kit project repo, or check out a branch that has infra-kit.json.`)}let[s,a]=await Promise.all([X(o.userGlobal),X(o.userProject)]),c={main:Number(n.mtimeMs),userGlobal:s?Number(s.mtimeMs):null,userProject:a?Number(a.mtimeMs):null};if(f&&f.key===r&&fr(f.mtimes,c))return f.value;let A=[{label:"infra-kit.json",path:o.main,required:!0,autoMigrate:t,mtimeMs:c.main},{label:"~/.infra-kit/infra-kit.json",path:o.userGlobal,required:!1,autoMigrate:t,mtimeMs:c.userGlobal},{label:`~/.infra-kit/projects/${o.projectName}/infra-kit.json`,path:o.userProject,required:!1,autoMigrate:t,mtimeMs:c.userProject}],d={};for(let O of A){let te=await gr(O);te!==null&&(d={...d,...te})}let M=$e.safeParse(d);if(!M.success)throw new Error(`Invalid merged infra-kit config: ${i.prettifyError(M.error)}`);return f={key:r,mtimes:c,value:M.data},M.data},pr=()=>{f=null},dr=()=>{f=null,C=null},X=async e=>{try{return await Q.stat(e)}catch{return null}},lr=async e=>{try{return await Q.readFile(e,"utf-8")}catch{return null}},fr=(e,t)=>{let r=Object.keys(e);return r.length!==Object.keys(t).length?!1:r.every(o=>e[o]===t[o])},Le=e=>new Error(`${e.message}
+A retired key on this branch \u2014 run \`infra-kit setup --skip-tools\` in this checkout and commit infra-kit.json.`),gr=async e=>{let t=await lr(e.path);if(t===null){if(e.required)throw new Error(`${e.label} not found at ${e.path}`);return null}let r;try{r=t.trim()===""?{}:JSON.parse(t)}catch(a){throw new Error(`Invalid JSON in ${e.label} at ${e.path}: ${a.message}`)}if(Y(r)&&"envTokens"in r)throw new Error(Rr(e));!e.required&&Y(r)&&xr(e,r);let o=Z.safeParse(r);if(o.success)return o.data;let n=new Error(`Invalid ${e.label} at ${e.path}: ${i.prettifyError(o.error)}`);if(!Y(r)||e.mtimeMs===null)throw n;let s=await J({...e,mtimeMs:e.mtimeMs},r,t,{schema:Z});switch(s.kind){case"migrated":return s.data;case"ci-gated":throw Le(n);case"not-applicable":throw n;default:return B(s)}},hr=e=>[`"mcp" is not allowed in ${e.label} (${e.path}): it feeds the committed .mcp.json, so a per-machine copy would replace the project's servers for everyone.`,"Move the block to the project infra-kit.json and run `infra-kit setup`.","For a machine-only override of one server (e.g. a local fork), use Claude Code directly:","  claude mcp add --scope local <name> -- ik-mcp --name <name> --env <VAR> ... -- <command> <args>","(local scope shadows the project entry by name; `claude mcp list` will show a same-name conflict warning, which is expected)."].join(`
+`),yr=e=>[`"vendorSource" is not allowed in ${e.label} (${e.path}): only the committed project file may mark a repository as the \`vendor sync\` source. In the machine-wide file it would make every repository on this machine a source; in a per-project override it would make this machine disagree with every other clone.`,"Move the block to the source repository's own infra-kit.json and commit it there."].join(`
+`),wr=e=>[`"audit" is not allowed in ${e.label} (${e.path}): the root audit gates CI, so a per-machine copy would make this machine pass or fail a different check list than CI.`,"Move the block to the project infra-kit.json and commit it there."].join(`
+`),kr=e=>[`"aliasRepo" is not allowed in ${e.label} (${e.path}): the vite and Playwright helpers read it from the project infra-kit.json only, so a per-machine copy would register a dev host they never aim at.`,"Move it to the project infra-kit.json and commit it there."].join(`
+`),vr={aliasRepo:kr,mcp:hr,vendorSource:yr,audit:wr},xr=(e,t)=>{for(let[r,o]of Object.entries(vr))if(r in t)throw new Error(o(e))},Y=e=>typeof e=="object"&&e!==null&&!Array.isArray(e),Rr=e=>[`Refusing to load ${e.label} \u2014 \`envTokens\` is not a config key.`,"A service token in a config file can be committed, backed up by your editor, or shared.","  1. REVOKE the token in Doppler now \u2014 treat it as compromised.",`  2. Remove the \`envTokens\` key from ${e.path}.`,"  3. Re-add it privately: `infra-kit env-token-set <env>`","     (it is written to ~/.infra-kit/projects/<repo>/tokens.json, mode 0600, never to the repo)."].join(`
+`);var Ke=class extends u{structuredContent;exitCode;constructor(t,r,o){super(void 0,o),this.name="StructuredRefusalError",this.structuredContent=t,this.exitCode=r}};export{S as a,We as b,se as c,ae as d,w as e,qe as f,ze as g,x as h,u as i,g as j,L as k,K as l,Je as m,Xe as n,Ye as o,Ze as p,Qe as q,et as r,D as s,tt as t,fe as u,rt as v,R as w,W as x,ge as y,he as z,it as A,st as B,at as C,ct as D,ut as E,mt as F,pt as G,dt as H,lt as I,we as J,ft as K,z as L,gt as M,ht as N,yt as O,G as P,B as Q,It as R,H as S,j as T,$ as U,_t as V,je as W,ee as X,ar as Y,$e as Z,Z as _,cr as $,ur as aa,_e as ba,Te as ca,mr as da,pr as ea,dr as fa,Ke as ga};
+//# sourceMappingURL=chunk-4GXRGHU3.js.map