infra-kit 0.15.0 → 0.17.0

package/dist/{chunk-EZ4DIT5A.js.map → chunk-4WWNBCEI.js.map}

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/lib/agent-mode/agent-mode.ts", "../src/lib/json-output/json-output.ts", "../src/lib/errors/operation-error.ts", "../src/lib/git-utils/git-utils.ts", "../src/lib/release-id/release-id.ts", "../src/lib/git-utils/merge-refs.ts", "../src/lib/git-utils/scratch-worktree.ts", "../src/lib/logger/index.ts", "../src/lib/infra-kit-config/infra-kit-config.ts", "../src/lib/assert-never/assert-never.ts", "../src/lib/config-migrations/migrations/omit-key.ts", "../src/lib/config-migrations/migrations/drop-top-level-key.ts", "../src/lib/config-migrations/migrations/drop-dev-proxy-key.ts", "../src/lib/config-migrations/migrations/drop-env-auto-load-key.ts", "../src/lib/config-migrations/migrations/drop-environments-key.ts", "../src/lib/config-migrations/migrations/strip-legacy-ide-mode.ts", "../src/lib/config-migrations/migrations/strip-retired-zed-ide.ts", "../src/lib/config-migrations/registry.ts", "../src/lib/config-migrations/apply-config-migrations.ts", "../src/lib/path-display/path-display.ts", "../src/lib/config-migrations/migrate-config-file.ts", "../src/lib/config-migrations/auto-migrate-layer.ts", "../src/lib/errors/structured-refusal-error.ts"],
-  "sourcesContent": ["/**\n * @fileoverview\n * Agent-mode flag for the CLI: \"no human is at the other end of stdin\". Anything that would read\n * keystrokes (raw `data` listeners, Ink screens, `@inquirer` prompts) must be gated off, and any\n * guard that exists because an agent needs a human's say-so keys on it.\n *\n * Two sources, and they are not interchangeable \u2014 the source is kept, not just the boolean, so a\n * refusal can word itself for the caller it actually has:\n * - `'flag'`: the global `--agent` option. Beats every environment value, `INFRA_KIT_AGENT=0`\n *   included \u2014 a skill that passes `--agent` must never be silently demoted by a variable in\n *   someone's `.zshenv`.\n * - `'env'`: `INFRA_KIT_AGENT=1`, or `CLAUDECODE` set with a non-TTY stdin. The TTY qualifier is the\n *   point: `CLAUDECODE=1` is inherited by every process Claude Code spawns, including the Orca\n *   terminals `worktrees add` opens, and those are humans at a PTY. `INFRA_KIT_AGENT=0` suppresses\n *   only that heuristic; any other value is ignored as if unset.\n *\n * `process.stdin.isTTY` alone is not the agent signal: a non-TTY stdin is also every zsh `$(\u2026)`\n * capture and CI job, and `--agent` from a terminal has a TTY \u2014 hence the declared flag plus the\n * `CLAUDECODE` \u2227 non-TTY conjunction.\n */\nimport process from 'node:process'\n\nimport { jsonOutput } from 'src/lib/json-output'\n\nexport type AgentModeSource = 'flag' | 'env' | null\n\n/** Mutable holder (object so `prefer-const` holds while the source toggles per run). */\nexport const agentMode = { source: null as AgentModeSource }\n\n/** True when an agent, not a human, is driving this process \u2014 whichever source said so. */\nexport const isAgentMode = (): boolean => {\n  return agentMode.source !== null\n}\n\n/**\n * True when nobody can answer a prompt: an agent is driving, or `--json` has claimed stdout for a\n * machine. Every confirm and picker site keys on this one predicate so the 20-odd sites agree; the\n * few that also care WHICH source read `agentMode.source` next to it.\n */\nexport const isHeadless = (): boolean => {\n  return isAgentMode() || jsonOutput.enabled\n}\n\n/**\n * True on a CI runner (every major one exports `CI`). The config loader withholds its layer-1\n * rewrite there, because a tracked file changed on an ephemeral checkout is lost with the job \u2014\n * the fix has to be committed on the branch instead. Not an agent signal: CI has no human either,\n * but `isAgentMode` keys on who is DRIVING, not where it runs.\n */\nexport const isCI = (): boolean => {\n  return Boolean(process.env.CI)\n}\n\nexport interface ResolveAgentModeInput {\n  env: NodeJS.ProcessEnv\n  stdinIsTTY: boolean\n  /** The global `--agent` option as Commander parsed it. */\n  flag: boolean\n}\n\n/**\n * Pure precedence over the two sources. Called once per run from `program.hook('preAction')`.\n *\n * @example\n * resolveAgentModeSource({ env: { INFRA_KIT_AGENT: '0' }, stdinIsTTY: true, flag: true }) // 'flag'\n * resolveAgentModeSource({ env: { INFRA_KIT_AGENT: '1' }, stdinIsTTY: true, flag: false }) // 'env'\n * resolveAgentModeSource({ env: { CLAUDECODE: '1' }, stdinIsTTY: false, flag: false }) // 'env'\n * resolveAgentModeSource({ env: { CLAUDECODE: '1', INFRA_KIT_AGENT: '0' }, stdinIsTTY: false, flag: false }) // null\n * resolveAgentModeSource({ env: { CLAUDECODE: '1' }, stdinIsTTY: true, flag: false }) // null\n */\nexport const resolveAgentModeSource = ({ env, stdinIsTTY, flag }: ResolveAgentModeInput): AgentModeSource => {\n  if (flag) return 'flag'\n\n  const agentVar = env.INFRA_KIT_AGENT\n\n  if (agentVar === '1') return 'env'\n\n  const claudeCodeHeuristic = env.CLAUDECODE !== undefined && !stdinIsTTY && agentVar !== '0'\n\n  return claudeCodeHeuristic ? 'env' : null\n}\n", "import type { Command } from 'commander'\nimport process from 'node:process'\n\n/**\n * `--json` output mode for the CLI. This is a presentation concern only: every\n * command handler already returns a `structuredContent` payload. Human/log\n * output goes to stderr (see lib/logger), so writing the structured payload to\n * stdout never collides with it.\n */\n\nexport interface CommandResult {\n  structuredContent?: unknown\n}\n\n/** Mutable holder (object so `prefer-const` holds while the flag toggles per run). */\nexport const jsonOutput = { enabled: false }\n\n/**\n * In `--json` mode, write a command result's `structuredContent` to stdout as\n * pretty JSON and return the result unchanged. Outside `--json` mode it is a\n * no-op pass-through. The writer is injectable for testing.\n */\nexport const emit = <T extends CommandResult | void>(\n  result: T,\n  write: (text: string) => void = (text) => {\n    process.stdout.write(text)\n  },\n): T => {\n  if (jsonOutput.enabled && result && result.structuredContent != null) {\n    write(`${JSON.stringify(result.structuredContent, null, 2)}\\n`)\n  }\n\n  return result\n}\n\n/** Register `--json` on a command and every nested subcommand (idempotent). */\nexport const addJsonOption = (cmd: Command): void => {\n  const alreadyHasJson = cmd.options.some((option) => {\n    return option.long === '--json'\n  })\n\n  if (!alreadyHasJson) {\n    cmd.option('--json', 'Output the structured result as JSON on stdout (human logs stay on stderr)')\n  }\n\n  cmd.commands.forEach(addJsonOption)\n}\n", "const STDERR_EXCERPT_MAX_BYTES = 200\n\nexport interface OperationErrorContext {\n  operation: string\n  remediation?: string\n  stderrExcerpt?: string\n}\n\n/**\n * Duck-typed read of zx's `ProcessOutput.stderr` (and similar shapes) without\n * importing zx types just for an `instanceof` check.\n *\n * @example\n * extractStderr(new Error('x'))               // undefined\n * extractStderr({ stderr: 'fatal: ...' })     // 'fatal: ...'\n * extractStderr({ stderr: '' })               // undefined  (empty treated as missing)\n */\nexport const extractStderr = (cause: unknown): string | undefined => {\n  // Walks the `cause` chain rather than reading one level. `OperationError` renders\n  // `stderrExcerpt` into its message and keeps it on the instance, but an OperationError\n  // wrapped in another OperationError \u2014 which is what `executeOne` does to every per-entry\n  // failure \u2014 carries no `.stderr` of its own. Reading one level there returns undefined, so\n  // the inner refusal's evidence would be silently dropped from the message the operator and\n  // the agent actually see.\n  const seen = new Set<unknown>()\n  let current = cause\n\n  while (current !== null && typeof current === 'object' && !seen.has(current)) {\n    seen.add(current)\n\n    const { stderr, stderrExcerpt } = current as { stderr?: unknown; stderrExcerpt?: unknown }\n\n    if (typeof stderr === 'string' && stderr.length > 0) return stderr\n    if (typeof stderrExcerpt === 'string' && stderrExcerpt.length > 0) return stderrExcerpt\n\n    current = (current as { cause?: unknown }).cause\n  }\n\n  return undefined\n}\n\n/**\n * Compose the human-and-agent-readable message body for an `OperationError`:\n * `\"failed to <operation> [\u2014 stderr: <excerpt>] [\u2014 try: <remediation>]\"`.\n * `stderrExcerpt` overrides anything duck-typed off `cause`; both are trimmed\n * and capped at {@link STDERR_EXCERPT_MAX_BYTES} so a runaway subprocess can't\n * blow up the message.\n */\nconst buildMessage = (cause: unknown, ctx: OperationErrorContext): string => {\n  const stderr = ctx.stderrExcerpt ?? extractStderr(cause)\n  const parts = [`failed to ${ctx.operation}`]\n\n  if (stderr) parts.push(`stderr: ${stderr.slice(0, STDERR_EXCERPT_MAX_BYTES).trim()}`)\n  if (ctx.remediation) parts.push(`try: ${ctx.remediation}`)\n\n  return parts.join(' \u2014 ')\n}\n\n/**\n * Error type for any handler-level failure that should surface to the caller\n * (a human or a `--agent` run) with a remediation hint. Wraps an underlying\n * cause and renders a single-line, structured message so logs and the stderr\n * an agent reads stay scannable.\n *\n * Pattern modeled on the exemplary Doppler errors in\n * `src/integrations/doppler/doppler-errors.ts`.\n *\n * @example\n * throw new OperationError(err, {\n *   operation: `git worktree add for ${branch}`,\n *   remediation: 'check the branch name and that the parent dir is writable',\n * })\n * @example\n * // validation failure, with no underlying cause to wrap\n * throw new OperationError(undefined, { operation: 'launch deploy-all workflow', remediation })\n */\nexport class OperationError extends Error {\n  readonly operation: string\n  readonly remediation?: string\n  /**\n   * Kept on the instance, not merely rendered into the message: this error is routinely\n   * re-wrapped in another `OperationError` (see `executeOne`), and {@link extractStderr}\n   * walks the `cause` chain looking for exactly this field. Without it the outer message\n   * reports only its own generic remediation and the real reason disappears.\n   */\n  readonly stderrExcerpt?: string\n\n  constructor(cause: unknown, ctx: OperationErrorContext) {\n    super(buildMessage(cause, ctx), { cause })\n    this.name = 'OperationError'\n    this.operation = ctx.operation\n    this.remediation = ctx.remediation\n    this.stderrExcerpt = ctx.stderrExcerpt ?? extractStderr(cause)\n  }\n}\n", "import path from 'node:path'\nimport process from 'node:process'\nimport { $ } from 'zx'\n\nimport { isAgentMode } from 'src/lib/agent-mode'\nimport { OperationError, extractStderr } from 'src/lib/errors/operation-error'\nimport { isReleaseBranch } from 'src/lib/release-id'\n\n/**\n * A single record from `git worktree list --porcelain`. The porcelain format is\n * the source of truth for worktrees: it carries the absolute `path` (which the\n * human format's `[branch]` scrape discards), and it distinguishes detached /\n * bare / prunable / locked states that the scrape collapses to `null`.\n *\n * `branch` is the short name (`release/v1.2.3`, `feature/x`) with `refs/heads/`\n * stripped, or `null` for a detached, bare, or otherwise branch-less checkout.\n */\nexport interface WorktreeEntry {\n  path: string\n  branch: string | null\n  detached: boolean\n  bare: boolean\n  prunable: boolean\n  locked: boolean\n}\n\n/**\n * List every git worktree of the repo containing `cwd`, parsed from\n * `git worktree list --porcelain`.\n *\n * Porcelain is a stable, documented, line-oriented format: one record per\n * worktree, records separated by a blank line, each opening with a\n * `worktree <abs-path>` line. Attribute lines (`branch`, `detached`, `bare`,\n * `locked`, `prunable`) follow. This replaces the legacy `endsWith(']')` scrape\n * of the human format, which lost the path and returned `null` for detached\n * worktrees.\n *\n * The main checkout is included in the output (as its own record), exactly as\n * git reports it.\n */\nexport const listWorktrees = async (cwd: string): Promise<WorktreeEntry[]> => {\n  const output = await $({ cwd })`git worktree list --porcelain`\n\n  const entries: WorktreeEntry[] = []\n  let current: WorktreeEntry | null = null\n\n  for (const line of output.stdout.split('\\n')) {\n    if (line.startsWith('worktree ')) {\n      // A new record opens; flush the previous one.\n      if (current) entries.push(current)\n\n      current = {\n        path: line.slice('worktree '.length),\n        branch: null,\n        detached: false,\n        bare: false,\n        prunable: false,\n        locked: false,\n      }\n\n      continue\n    }\n\n    if (!current) continue\n\n    if (line.startsWith('branch ')) {\n      current.branch = line.slice('branch '.length).replace(/^refs\\/heads\\//, '')\n    } else if (line === 'detached') {\n      current.detached = true\n    } else if (line === 'bare') {\n      current.bare = true\n    } else if (line === 'locked' || line.startsWith('locked ')) {\n      current.locked = true\n    } else if (line === 'prunable' || line.startsWith('prunable ')) {\n      current.prunable = true\n    }\n  }\n\n  if (current) entries.push(current)\n\n  return entries\n}\n\n/**\n * Get current git worktrees\n *\n * Thin wrapper over {@link listWorktrees}: harvests branch names from the\n * porcelain records and filters by release / feature shape. Detached, bare, and\n * branch-less records drop out naturally (their `branch` is `null`).\n *\n * @returns [release/v1.18.22, release/v1.18.23, release/v1.18.24] or [feature/mobile-app, feature/explore-page, feature/login-page]\n */\nexport const getCurrentWorktrees = async (type: 'release' | 'feature'): Promise<string[]> => {\n  const entries = await listWorktrees(process.cwd())\n\n  const matches = (branch: string): boolean => {\n    return type === 'release' ? isReleaseBranch(branch) : branch.startsWith('feature/')\n  }\n\n  return entries\n    .map((entry) => {\n      return entry.branch\n    })\n    .filter((branch): branch is string => {\n      return branch !== null && matches(branch)\n    })\n}\n\n/**\n * Trim git's `not a git repository (or any of the parent directories): .git` tail \u2014 and ONLY that.\n * Returns undefined for every other failure so `OperationError` falls through to the real stderr:\n * dubious ownership, EACCES, a corrupt repo, and a missing `git` binary must each report themselves.\n */\nconst normalizeGitRootStderr = (error: unknown): string | undefined => {\n  const raw = extractStderr(error)\n\n  return raw && /not a git repository/i.test(raw) ? 'not a git repository' : undefined\n}\n\n/**\n * Remediation text for a failed project-root resolution.\n *\n * Channel-aware: an agent is told which action it has (`-C <dir>`, or re-running from the project\n * directory) rather than to \"cd\", which a fixed-cwd caller cannot do.\n *\n * `hasStderr` gates the stderr-referencing clause: with no stderr (missing `git`\n * binary, ENOENT) the message must not point at evidence it does not carry.\n */\nconst projectRootRemediation = ({ hasStderr }: { hasStderr: boolean }): string => {\n  if (isAgentMode()) {\n    return 'infra-kit resolves its project from the working directory; run it from inside an infra-kit project repo (or one of its git worktrees), or pass `-C <dir>` naming one'\n  }\n\n  const base = 'run infra-kit from inside an infra-kit project repo (or one of its git worktrees)'\n\n  return hasStderr ? `${base}; if you are already in one, the stderr in this message is the real cause` : base\n}\n\n/**\n * Get the current project root directory\n */\nexport const getProjectRoot = async (): Promise<string> => {\n  try {\n    const result = await $({ quiet: true })`git rev-parse --show-toplevel`\n\n    return result.stdout.trim()\n  } catch (error) {\n    const stderrExcerpt = normalizeGitRootStderr(error) ?? extractStderr(error)\n\n    throw new OperationError(error, {\n      operation: `resolve the project root from ${process.cwd()}`,\n      stderrExcerpt,\n      remediation: projectRootRemediation({ hasStderr: stderrExcerpt !== undefined }),\n    })\n  }\n}\n\n/**\n * Absolute path to the MAIN repository root \u2014 invariant across the main checkout\n * and all of its linked worktrees. A linked worktree's `--show-toplevel` is the\n * worktree's own path, but its `--git-common-dir` still points at the shared\n * `<main>/.git`, so the parent of the resolved common dir is always the main repo.\n * This is the stable identity to key per-repo state on (unlike `getProjectRoot`,\n * whose basename is the worktree's leaf directory inside a worktree).\n *\n * Submodules are the one exception: their common dir is\n * `<super>/.git/modules/<name>`, whose parent (`.../.git/modules`) is not a repo\n * root \u2014 there is no meaningful \"main repo\" to converge on \u2014 so we fall back to\n * the caller-supplied toplevel unchanged. Callers must pass a git toplevel as\n * `cwd` (e.g. the result of {@link getProjectRoot}); the fallback assumes it.\n *\n * @example\n * // main checkout: common dir '.git' \u2192 resolve \u2192 '<main>/.git' \u2192 dirname \u2192 '<main>'\n * await getMainRepoRoot('/Users/me/projects/hulyo')            // => '/Users/me/projects/hulyo'\n * // linked worktree: common dir '<main>/.git' \u2192 dirname \u2192 '<main>'\n * await getMainRepoRoot('/Users/me/projects/hulyo-worktrees/feature/x') // => '/Users/me/projects/hulyo'\n */\nexport const getMainRepoRoot = async (cwd?: string): Promise<string> => {\n  const root = cwd ?? (await getProjectRoot())\n  const commonDir = (await $({ cwd: root, quiet: true })`git rev-parse --git-common-dir`).stdout.trim()\n  const resolved = path.resolve(root, commonDir)\n\n  // Submodule: common dir sits under `<super>/.git/modules/<name>` \u2014 no stable\n  // main-repo root to key on, so keep the caller's own toplevel.\n  if (resolved.includes(`${path.sep}.git${path.sep}modules${path.sep}`)) return root\n\n  return path.dirname(resolved)\n}\n\n/**\n * Get the current git branch name (e.g. `dev`, `main`, `release/v1.2.3`).\n */\nexport const getCurrentBranch = async (): Promise<string> => {\n  const result = await $`git rev-parse --abbrev-ref HEAD`\n\n  return result.stdout.trim()\n}\n\n/**\n * The working tree's `git status --porcelain` lines: staged, unstaged, and untracked\n * changes, one entry per path. Empty means clean.\n *\n * The porcelain output is returned rather than reduced to a boolean because every refusal\n * built on it has to name the paths that block the operation \u2014 an operator told only\n * \"working tree has uncommitted changes\" has to run `git status` themselves to act on it.\n */\nexport const getWorkingTreeStatus = async (): Promise<string[]> => {\n  const result = await $`git status --porcelain`\n\n  // Only the trailing whitespace is stripped. The two leading columns are the status itself \u2014\n  // ` M` is \"modified in the worktree\" and `M ` is \"modified and staged\" \u2014 so trimming the left\n  // side would render the first as the second in a message whose whole job is to tell the\n  // operator what is in their way.\n  return result.stdout\n    .split('\\n')\n    .map((line) => {\n      return line.trimEnd()\n    })\n    .filter((line) => {\n      return line.trim().length > 0\n    })\n}\n\n/**\n * Whether the working tree has no staged, unstaged, or untracked changes.\n */\nexport const isWorkingTreeClean = async (): Promise<boolean> => {\n  return (await getWorkingTreeStatus()).length === 0\n}\n\n/**\n * Whether the current checkout is a linked git worktree rather than the main\n * repository checkout.\n *\n * A linked worktree's git dir lives under `<main>/.git/worktrees/<name>`, so it\n * differs from the shared common dir; in the main checkout the two resolve to\n * the same path. Both are anchored to the toplevel so `--git-common-dir` (which\n * git may report relative to cwd) resolves consistently.\n */\nexport const isInsideLinkedWorktree = async (): Promise<boolean> => {\n  const cwd = await getProjectRoot()\n\n  const [gitDirResult, commonDirResult] = await Promise.all([\n    $({ cwd })`git rev-parse --absolute-git-dir`,\n    $({ cwd })`git rev-parse --git-common-dir`,\n  ])\n\n  const gitDir = gitDirResult.stdout.trim()\n  const commonDir = path.resolve(cwd, commonDirResult.stdout.trim())\n\n  return gitDir !== commonDir\n}\n\n/**\n * Basename of the CURRENT worktree's toplevel \u2014 a linked worktree returns the worktree dir name,\n * not the repository. Not a repo identity; see {@link getMainRepoRoot} for the stable root.\n *\n * @deprecated It has no production caller: its last one fed `local-deploy` preflight the release\n * name instead of the project. Kept only because the test suite still imports it.\n */\nexport const getRepoName = async (): Promise<string> => {\n  const projectRoot = await getProjectRoot()\n\n  return path.basename(projectRoot)\n}\n\n/**\n * Check whether a local branch exists.\n *\n * `deleteLocalBranch` fails open: it silently returns without deleting when\n * the branch is the current checkout or already absent, and either way its\n * `void` return gives the caller no way to tell \"deleted\" apart from \"did\n * nothing\". A caller that must not report an unperformed deletion \u2014 such as\n * a teardown command confirming a branch is actually gone \u2014 needs this\n * independent check rather than trusting `deleteLocalBranch`'s outcome.\n */\nexport const branchExists = async (branch: string): Promise<boolean> => {\n  const listed = await $`git branch --list ${branch}`\n\n  return listed.stdout.trim().length > 0\n}\n\n/**\n * Delete a local branch if it exists and is not the current checkout.\n *\n * Idempotent: a no-op when the branch is absent (`git branch --list` prints\n * nothing). Uses force `-D` because a delivered release branch was\n * squash-merged \u2014 its tip is unreachable from the base, so `-d` would refuse\n * with \"not fully merged\". The delete itself still rejects if the branch is\n * checked out in another worktree; callers decide how to handle that.\n */\nexport const deleteLocalBranch = async (branch: string): Promise<void> => {\n  const listed = await $`git branch --list ${branch}`\n\n  if (listed.stdout.trim().length === 0) return\n\n  if ((await getCurrentBranch()) === branch) return\n\n  await $`git branch -D ${branch}`\n}\n\n/**\n * Delete a branch on the `origin` remote if it exists.\n *\n * Idempotent: a no-op when the branch is absent on the remote. Existence is\n * probed with `git ls-remote --heads` (empty stdout = absent) rather than\n * `--exit-code`, so a genuine network/auth failure rejects and propagates to\n * the caller instead of being silently misread as \"branch absent\".\n */\nexport const deleteRemoteBranch = async (branch: string): Promise<void> => {\n  const refs = await $`git ls-remote --heads origin ${branch}`\n\n  if (refs.stdout.trim().length === 0) return\n\n  await $`git push origin --delete ${branch}`\n}\n", "/**\n * A release identity is either a semantic version or a free-form kebab-case\n * name. `raw` is the canonical token for the id: the no-`v` semver string for\n * versions (e.g. `1.2.3`) and the name itself for named releases.\n */\nexport type ReleaseId =\n  | { kind: 'version'; semver: { major: number; minor: number; patch: number }; raw: string }\n  | { kind: 'name'; name: string; raw: string }\n\n/** Matches a bare or `v`-prefixed semver token, e.g. `1.2.3` or `v1.2.3`. */\nconst VERSION_RE = /^v?(\\d+)\\.(\\d+)\\.(\\d+)$/\n\n/** Matches the semver core after the `v` in a `release/v\u2026` branch. */\nconst BRANCH_SEMVER_RE = /^(\\d+)\\.(\\d+)\\.(\\d+)$/\n\n/** Kebab-case: lowercase alphanumeric segments joined by single hyphens. */\nconst KEBAB_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/\n\nconst RELEASE_BRANCH_PREFIX = 'release/'\nconst VERSION_BRANCH_PREFIX = 'release/v'\nconst REFS_HEADS_PREFIX = 'refs/heads/'\n\nconst NEXT_TOKEN = 'next'\nconst MAX_NAME_LENGTH = 50\n\n/**\n * Names that would collide with branch/release semantics or read as a special\n * token. Banned regardless of kebab-case validity.\n */\nconst RESERVED_NAMES: ReadonlySet<string> = new Set(['dev', 'main', 'next', 'hotfix', 'regular', 'release'])\n\n/** Thrown by {@link validateName} when a release name is not acceptable. */\nexport class InvalidReleaseNameError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'InvalidReleaseNameError'\n  }\n}\n\n/** Thrown by {@link parseReleaseRef} when a release ref cannot be parsed. */\nexport class InvalidReleaseRefError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'InvalidReleaseRefError'\n  }\n}\n\nconst stripRefsHeads = (input: string): string => {\n  return input.startsWith(REFS_HEADS_PREFIX) ? input.slice(REFS_HEADS_PREFIX.length) : input\n}\n\nconst makeVersion = (major: number, minor: number, patch: number): ReleaseId => {\n  return {\n    kind: 'version',\n    semver: { major, minor, patch },\n    raw: `${major}.${minor}.${patch}`,\n  }\n}\n\n/**\n * Validate a release name. Throws {@link InvalidReleaseNameError} with a\n * specific message unless the name is kebab-case, at most 50 characters, and\n * not a reserved word. Semver-looking tokens (e.g. `1.2.3`) are already\n * excluded by the kebab-case rule since they contain dots.\n */\nexport const validateName = (name: string): void => {\n  if (name.length === 0) {\n    throw new InvalidReleaseNameError('Release name is empty. Provide a kebab-case name like \"checkout-redesign\".')\n  }\n\n  if (name.length > MAX_NAME_LENGTH) {\n    throw new InvalidReleaseNameError(\n      `Release name \"${name}\" is ${name.length} characters; the maximum is ${MAX_NAME_LENGTH}.`,\n    )\n  }\n\n  if (!KEBAB_RE.test(name)) {\n    throw new InvalidReleaseNameError(\n      `Release name \"${name}\" is not kebab-case. Use lowercase letters, digits, and single hyphens, e.g. \"checkout-redesign\".`,\n    )\n  }\n\n  if (RESERVED_NAMES.has(name)) {\n    throw new InvalidReleaseNameError(\n      `Release name \"${name}\" is reserved. Reserved names: ${[...RESERVED_NAMES].join(', ')}.`,\n    )\n  }\n}\n\n/**\n * Lenient parse of a git branch name into a {@link ReleaseId}. Tolerates a\n * leading `refs/heads/`. Returns `null` for anything that is not a valid\n * `release/v<semver>` or `release/<name>` branch. Never throws.\n *\n * Precedence is version-first: `release/v<semver>` is a version, but if the\n * segment after `release/v` is not a valid semver (e.g. `release/vnext`), the\n * whole token after `release/` is treated as a candidate name instead.\n */\nexport const parseBranchName = (branch: string): ReleaseId | null => {\n  const stripped = stripRefsHeads(branch.trim())\n\n  if (!stripped.startsWith(RELEASE_BRANCH_PREFIX)) return null\n\n  if (stripped.startsWith(VERSION_BRANCH_PREFIX)) {\n    const semverPart = stripped.slice(VERSION_BRANCH_PREFIX.length)\n    const match = BRANCH_SEMVER_RE.exec(semverPart)\n\n    if (match) {\n      return makeVersion(Number(match[1]), Number(match[2]), Number(match[3]))\n    }\n  }\n\n  const namePart = stripped.slice(RELEASE_BRANCH_PREFIX.length)\n\n  try {\n    validateName(namePart)\n  } catch {\n    return null\n  }\n\n  return { kind: 'name', name: namePart, raw: namePart }\n}\n\n/**\n * Strict parse of a release ref into a {@link ReleaseId}. Throws\n * {@link InvalidReleaseRefError} on invalid input. Precedence (order matters):\n *   1. `release/\u2026` (or `refs/heads/release/\u2026`) \u2192 delegate to parseBranchName.\n *   2. semver token (`1.2.3` / `v1.2.3`) \u2192 version.\n *   3. `next` \u2192 throws; callers must resolve `next` to a concrete version\n *      via computeNextVersion before calling this.\n *   4. otherwise \u2192 validateName, returning a named release.\n */\nexport const parseReleaseRef = (input: string): ReleaseId => {\n  const trimmed = input.trim()\n  const branchCandidate = stripRefsHeads(trimmed)\n\n  if (branchCandidate.startsWith(RELEASE_BRANCH_PREFIX)) {\n    const parsed = parseBranchName(trimmed)\n\n    if (!parsed) {\n      throw new InvalidReleaseRefError(\n        `\"${input}\" looks like a release branch but is not a valid release/v<semver> or release/<name> ref.`,\n      )\n    }\n\n    return parsed\n  }\n\n  const versionMatch = VERSION_RE.exec(trimmed)\n\n  if (versionMatch) {\n    return makeVersion(Number(versionMatch[1]), Number(versionMatch[2]), Number(versionMatch[3]))\n  }\n\n  if (trimmed.toLowerCase() === NEXT_TOKEN) {\n    throw new InvalidReleaseRefError(\n      'The \"next\" token must be resolved to a concrete version (via computeNextVersion) before parsing a release ref.',\n    )\n  }\n\n  // A `1.64.0@2026-10-28` spec is what `release create -r` teaches, so it is the likeliest thing to\n  // be pasted here; one hint at the parser serves every ref-taking command. It REPLACES the\n  // kebab-case reason rather than trailing it: that reason is noise for this input, and callers\n  // that wrap the message (`resolveReleaseBranch`) cap it, which would cut the hint off.\n  if (trimmed.includes('@')) {\n    throw new InvalidReleaseRefError(\n      `Cannot parse \"${input}\" as a release ref: the \\`@date\\` suffix belongs to \\`release create\\`; pass the version alone here and use \\`--release-date\\` on \\`release edit\\``,\n    )\n  }\n\n  try {\n    validateName(trimmed)\n  } catch (err) {\n    const reason = err instanceof Error ? err.message : String(err)\n\n    throw new InvalidReleaseRefError(`Cannot parse \"${input}\" as a release ref: ${reason}`)\n  }\n\n  return { kind: 'name', name: trimmed, raw: trimmed }\n}\n\n/** Render the branch name for a release id: `release/v1.2.3` | `release/<name>`. */\nexport const formatBranchName = (id: ReleaseId): string => {\n  if (id.kind === 'version') return `${VERSION_BRANCH_PREFIX}${id.raw}`\n\n  return `${RELEASE_BRANCH_PREFIX}${id.name}`\n}\n\n/**\n * Render a PR title: `Release v1.2.3` / `Hotfix v1.2.3` for versions,\n * `Release <name>` / `Hotfix <name>` for names.\n */\nexport const formatPrTitle = (id: ReleaseId, type: 'regular' | 'hotfix'): string => {\n  const prefix = type === 'hotfix' ? 'Hotfix' : 'Release'\n\n  if (id.kind === 'version') return `${prefix} v${id.raw}`\n\n  return `${prefix} ${id.name}`\n}\n\n/** Render a release-candidate PR title: `Release v1.2.3 (RC)` | `Release <name> (RC)`. */\nexport const formatRcTitle = (id: ReleaseId): string => {\n  if (id.kind === 'version') return `Release v${id.raw} (RC)`\n\n  return `Release ${id.name} (RC)`\n}\n\n/** Render the Jira fix-version name: `v1.2.3` | `<name>`. */\nexport const formatJiraName = (id: ReleaseId): string => {\n  if (id.kind === 'version') return `v${id.raw}`\n\n  return id.name\n}\n\n/** Render a short human display label: `1.2.3` | `<name>`. */\nexport const displayLabel = (id: ReleaseId): string => {\n  return id.raw\n}\n\n/** True iff `branch` is a valid release branch under either scheme. */\nexport const isReleaseBranch = (branch: string | null | undefined): boolean => {\n  if (branch === null || branch === undefined) return false\n\n  return parseBranchName(branch) !== null\n}\n\nconst toTime = (value: string | Date | undefined): number | null => {\n  if (value === undefined) return null\n\n  const time = value instanceof Date ? value.getTime() : new Date(value).getTime()\n\n  return Number.isNaN(time) ? null : time\n}\n\n/**\n * Comparator for {@link ReleaseId} values (locked ordering):\n *   - All versions sort before all names.\n *   - Versions: semver ascending (major, then minor, then patch; numeric).\n *   - Names: by date ascending when both dates are provided, otherwise\n *     lexicographic by name. The result is stable and deterministic.\n */\nexport const compareReleaseIds = (\n  a: ReleaseId,\n  b: ReleaseId,\n  dates?: { a?: string | Date; b?: string | Date },\n): number => {\n  if (a.kind === 'version' && b.kind === 'version') {\n    if (a.semver.major !== b.semver.major) return a.semver.major - b.semver.major\n    if (a.semver.minor !== b.semver.minor) return a.semver.minor - b.semver.minor\n\n    return a.semver.patch - b.semver.patch\n  }\n\n  if (a.kind === 'version') return -1\n  if (b.kind === 'version') return 1\n\n  const timeA = toTime(dates?.a)\n  const timeB = toTime(dates?.b)\n\n  if (timeA !== null && timeB !== null && timeA !== timeB) {\n    return timeA - timeB\n  }\n\n  if (a.name < b.name) return -1\n  if (a.name > b.name) return 1\n\n  return 0\n}\n", "import { $ } from 'zx'\n\nimport { OperationError } from 'src/lib/errors/operation-error'\n\n/**\n * Resolve a ref to a commit sha, or `null` when it does not exist.\n *\n * Callers must run this BEFORE {@link isAncestor} on any ref that might be gone:\n * `git merge-base --is-ancestor` exits 128 on an unknown ref, which is a fatal,\n * not a boolean \u2014 so a release branch deleted on origin between the PR listing\n * and the fetch would abort the whole run instead of failing that one branch.\n */\nexport const revParseVerify = async (cwd: string, ref: string): Promise<string | null> => {\n  const commitish = `${ref}^{commit}`\n\n  try {\n    const result = await $({ cwd, quiet: true })`git rev-parse --verify --quiet ${commitish}`\n\n    return result.stdout.trim() || null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Whether `ancestor` is already contained in `descendant`.\n *\n * This is the idempotency probe for the whole command: when `origin/dev` is\n * already an ancestor of `origin/<branch>`, that branch needs no merge, no\n * checkout, and no refspec. It is also what makes a re-run after a partially\n * rejected push safe rather than duplicative.\n *\n * Exit 0 = contained, exit 1 = not. Anything else (notably 128 on an unknown\n * ref) is a programming error at the call site, so it propagates rather than\n * being flattened into `false` \u2014 a silent `false` would re-merge a branch that\n * was already done.\n */\nexport const isAncestor = async (cwd: string, ancestor: string, descendant: string): Promise<boolean> => {\n  try {\n    await $({ cwd, quiet: true })`git merge-base --is-ancestor ${ancestor} ${descendant}`\n\n    return true\n  } catch (error) {\n    const exitCode = (error as { exitCode?: number }).exitCode\n\n    if (exitCode === 1) return false\n\n    throw new OperationError(error, {\n      operation: `test whether ${ancestor} is contained in ${descendant}`,\n      remediation: 'both refs must exist \u2014 verify them with rev-parse first',\n    })\n  }\n}\n\n/** The sha `origin` currently holds for a branch, or `null` when it has none. */\nexport const lsRemoteHead = async (cwd: string, branch: string): Promise<string | null> => {\n  const result = await $({ cwd, quiet: true })`git ls-remote --heads origin ${branch}`\n  const line = result.stdout.trim().split('\\n')[0]\n\n  return line ? (line.split(/\\s+/)[0] ?? null) : null\n}\n\nexport interface AtomicPushRef {\n  branch: string\n  sha: string\n}\n\nexport interface AtomicPushResult {\n  /** Refspecs exactly as handed to git \u2014 printed before the push so the transcript names what was in flight. */\n  refspecs: string[]\n  pushed: boolean\n  /** Raw stderr on failure, for the report to quote rather than paraphrase. */\n  stderr?: string\n}\n\n/**\n * Push every merge in one all-or-nothing `git push --atomic`.\n *\n * Atomicity is the whole point: a per-branch loop leaves 2^N possible outcomes\n * on a failure, and reconstructing which branches landed means inspecting every\n * remote by hand. With `--atomic`, one non-fast-forwardable ref leaves *every*\n * ref unchanged on origin.\n *\n * Deliberately never forced. No `--force`, no `--force-with-lease`, no `+`\n * refspec: each ref stays individually fast-forward-checked, so a teammate's\n * push landing between the plan and the apply loses safely \u2014 the push is\n * rejected and nothing is overwritten. A rejection here is a correct outcome,\n * not a bug to route around.\n */\nexport const pushAtomic = async (cwd: string, refs: AtomicPushRef[]): Promise<AtomicPushResult> => {\n  const refspecs = refs.map((ref) => {\n    return `${ref.sha}:refs/heads/${ref.branch}`\n  })\n\n  if (refspecs.length === 0) {\n    return { refspecs, pushed: false }\n  }\n\n  try {\n    await $({ cwd, quiet: true })`git push --atomic origin ${refspecs}`\n\n    return { refspecs, pushed: true }\n  } catch (error) {\n    return {\n      refspecs,\n      pushed: false,\n      stderr: (error as { stderr?: string }).stderr,\n    }\n  }\n}\n", "import path from 'node:path'\nimport process from 'node:process'\nimport { $ } from 'zx'\n\nimport { WORKTREES_DIR_SUFFIX, WORKTREE_SUBDIRS } from 'src/lib/constants'\nimport { OperationError } from 'src/lib/errors/operation-error'\n\n/**\n * A disposable detached worktree that `gh-merge-dev` merges inside of.\n *\n * The whole point is that no checkout anyone else owns is touched: the release\n * branches this command merges into are, on this team, almost always checked out\n * in linked worktrees already, so `git switch` \u2014 the old engine \u2014 fails on the\n * ordinary case rather than the exceptional one.\n */\nexport interface ScratchWorktree {\n  /** Absolute path of the scratch checkout. */\n  path: string\n  /** Remove the worktree registration and its directory. Never throws. */\n  remove: () => Promise<void>\n}\n\n/**\n * Where the scratch worktree lives: `<git-common-dir>/infra-kit/merge-dev-<runId>`, with `runId`\n * taken from `INFRA_KIT_SESSION` (this repo's per-terminal id) and falling back to the pid.\n *\n * Two properties are load-bearing: the path is outside every working tree, and it is unique per run.\n */\n// Both are about NOT colliding with things that already exist.\n//\n// 1. Outside every working tree. An untracked directory inside the main checkout would make\n//    `isWorkingTreeClean` false, and therefore `assertManagementContext` throw, for every OTHER\n//    release and worktree command in this CLI \u2014 so a crashed `gh-merge-dev` would break\n//    `worktrees add` and `release create` with a message naming neither of them. Under `.git/`\n//    it is invisible to `git status` by construction.\n// 2. Unique per run. A colliding path is a hard `fatal: \u2026 already exists`, so two concurrent runs\n//    would fight.\n//\n// It also deliberately avoids the team's `<projectRoot>-worktrees/` convention, which\n// `getCurrentWorktrees` scans for release branches.\nexport const scratchWorktreePath = async (cwd?: string): Promise<string> => {\n  const root = cwd ?? process.cwd()\n  const commonDir = (await $({ cwd: root, quiet: true })`git rev-parse --git-common-dir`).stdout.trim()\n  const runId = process.env.INFRA_KIT_SESSION || String(process.pid)\n\n  return path.join(path.resolve(root, commonDir), 'infra-kit', `merge-dev-${runId}`)\n}\n\n/** `release/v1.2.3` \u2192 `release-v1-2-3`: one flat directory name per branch. */\nexport const branchSlug = (branch: string): string => {\n  return branch.replace(/[^\\w-]+/g, '-')\n}\n\n/**\n * Where `release merge-dev --keep-conflicts` leaves a branch mid-merge for someone to resolve:\n * `<projectRoot>-worktrees/merge-dev/<branch-slug>`.\n */\n// This reverses the \"avoid `<projectRoot>-worktrees/`\" choice above, because the resolver must edit\n// files here and `.git/**` is a protected path for agent edits. Both reasons for the original choice\n// still hold: the path is outside every working tree, and the worktree is DETACHED, so\n// `getCurrentWorktrees` (which keeps only entries with a branch) never hands it to `worktrees sync`\n// or `worktrees remove --all`.\nexport const resolutionWorktreePath = (projectRoot: string, branch: string): string => {\n  return path.join(`${projectRoot}${WORKTREES_DIR_SUFFIX}`, WORKTREE_SUBDIRS.mergeDev, branchSlug(branch))\n}\n\n/** Whether a merge is in progress in `cwd`. Never throws. */\nexport const hasMergeInProgress = async (cwd: string): Promise<boolean> => {\n  try {\n    await $({ cwd, quiet: true })`git rev-parse -q --verify MERGE_HEAD`\n\n    return true\n  } catch {\n    return false\n  }\n}\n\n/**\n * Refuse to reuse a scratch worktree that is not pristine.\n *\n * This converts a cleanup miss into a fail-fast instead of a cascade. The\n * failure it guards against is measurable: after a conflicting merge is left\n * unaborted, the next `git checkout --detach` fails with `error: you need to\n * resolve your current index first`, so branch k's conflict would be reported as\n * an error on branches k+1\u2026N \u2014 the same class of silently-wrong per-branch\n * result the new engine exists to eliminate.\n */\nexport const assertPristineWorktree = async (cwd: string): Promise<void> => {\n  if (await hasMergeInProgress(cwd)) {\n    throw new OperationError(undefined, {\n      operation: 'reuse the scratch worktree',\n      stderrExcerpt: 'a merge is still in progress in the scratch worktree',\n      remediation: 'this is an infra-kit bug \u2014 the previous branch iteration did not clean up',\n    })\n  }\n\n  const status = (await $({ cwd, quiet: true })`git status --porcelain`).stdout.trim()\n\n  if (status.length > 0) {\n    throw new OperationError(undefined, {\n      operation: 'reuse the scratch worktree',\n      stderrExcerpt: `scratch worktree is dirty: ${status.split('\\n')[0]}`,\n      remediation: 'this is an infra-kit bug \u2014 the previous branch iteration did not clean up',\n    })\n  }\n}\n\n/**\n * Return the scratch worktree to a pristine state between branch iterations.\n * Never throws: it runs in a `finally`, and a cleanup that can throw would\n * re-create the very defect (a rejection escaping a catch/finally and killing\n * the run) that this rewrite removes.\n *\n * `clean -fd`, not `-fdx`: ignored paths survive, so a `node_modules` installed\n * by `--verify` on one branch is reused by the next instead of being reinstalled\n * from cold. That makes the `qa` verify tier non-hermetic, which is a deliberate\n * trade recorded in the plan \u2014 the cheap `install` tier is unaffected, because it\n * reads the lockfile and manifests rather than executing installed code.\n */\nexport const resetScratchWorktree = async (cwd: string): Promise<void> => {\n  const run = async (fn: () => Promise<unknown>): Promise<void> => {\n    try {\n      await fn()\n    } catch {\n      // Best-effort by contract; `assertPristineWorktree` is the real gate.\n    }\n  }\n\n  if (await hasMergeInProgress(cwd)) {\n    // Guarded: an unconditional `git merge --abort` exits 128 when there is no\n    // merge to abort, and this runs on paths where there often is not.\n    await run(() => {\n      return $({ cwd, quiet: true })`git merge --abort`\n    })\n  }\n\n  await run(() => {\n    return $({ cwd, quiet: true })`git reset --hard`\n  })\n\n  // `reset --hard` leaves untracked files behind, which would fail the pristine\n  // assertion on the next iteration.\n  await run(() => {\n    return $({ cwd, quiet: true })`git clean -fd`\n  })\n}\n\n/**\n * Create the scratch worktree, hand it to `fn`, and always remove it.\n *\n * Anchored on `origin/dev` rather than on the first candidate branch: a branch\n * deleted on origin between the PR listing and the fetch would make the initial\n * `add` fail, and a preflight throw there would kill the run for every *other*\n * branch too. `origin/dev` is verified by the caller immediately beforehand.\n *\n * A stale registration left by a hard kill (`fatal: \u2026 is a missing but already\n * registered worktree`) is recovered once via `git worktree prune`, because\n * otherwise the command would be broken on that machine every subsequent run.\n */\nexport const withScratchWorktree = async <T>(\n  args: { cwd: string; anchor?: string },\n  fn: (worktree: ScratchWorktree) => Promise<T>,\n): Promise<T> => {\n  const { cwd, anchor = 'origin/dev' } = args\n  const worktreePath = await scratchWorktreePath(cwd)\n\n  const add = async (): Promise<void> => {\n    await $({ cwd, quiet: true })`git worktree add --detach ${worktreePath} ${anchor}`\n  }\n\n  try {\n    await add()\n  } catch (firstError) {\n    try {\n      await $({ cwd, quiet: true })`git worktree prune`\n      await add()\n    } catch {\n      throw new OperationError(firstError, {\n        operation: 'create the scratch worktree for the merge',\n        remediation: `remove any stale checkout at ${worktreePath}, then retry`,\n      })\n    }\n  }\n\n  const worktree: ScratchWorktree = {\n    path: worktreePath,\n    remove: async (): Promise<void> => {\n      try {\n        await $({ cwd, quiet: true })`git worktree remove --force ${worktreePath}`\n      } catch {\n        // A leftover registration is recoverable (`prune`-and-retry on the next\n        // run); throwing here would mask whatever the run was actually reporting.\n      }\n    },\n  }\n\n  try {\n    return await fn(worktree)\n  } finally {\n    await worktree.remove()\n  }\n}\n", "import process from 'node:process'\nimport pino from 'pino'\nimport pretty from 'pino-pretty'\n\n/**\n * Key paths pino censors before anything reaches a destination. The load-bearing case is a handler\n * that logs its `params` object: a token-carrying key in that object would land on stderr verbatim,\n * and stderr is captured by CI logs and terminal scrollback alike.\n *\n * The wildcard forms cover the nesting we actually produce: `{ params: { \u2026 } }` and `{ err: { \u2026 } }`\n * are both one level deep, so `*.token` catches `params.token` without enumerating every wrapper.\n *\n * LIMIT \u2014 read this before trusting it: pino's `redact` is KEY-PATH based. It cannot see a token that\n * was INTERPOLATED into a message string (`logger.info(\\`token ${t}\\`)`) \u2014 that string is opaque to\n * it and would be written verbatim. So this is a backstop, not the rule. The RULE is that a token\n * never enters a message string; everything user-facing renders it through `redactToken` first.\n */\nconst REDACT_PATHS = [\n  'token',\n  '*.token',\n  'serviceToken',\n  '*.serviceToken',\n  'DOPPLER_TOKEN',\n  '*.DOPPLER_TOKEN',\n  'INFRA_KIT_ENV_TOKEN',\n  '*.INFRA_KIT_ENV_TOKEN',\n]\n\nexport const initLoggerCLI = () => {\n  const logLevel = process.argv.includes('--debug') ? 'debug' : 'info'\n\n  const ignoreFields = ['time', 'pid', 'hostname']\n\n  if (logLevel === 'debug') {\n    ignoreFields.push('level')\n  }\n\n  const logger = pino(\n    { level: logLevel, redact: REDACT_PATHS },\n    pretty({\n      destination: 2,\n      ignore: ignoreFields.join(','),\n      colorize: true,\n      // Sync, because reports go straight to `process.stderr` in one write beside these lines. pino-pretty's\n      // default async destination buffers, so lines logged BEFORE a report landed after it in a pipe.\n      sync: true,\n    }),\n  )\n\n  return logger\n}\n\n// Singleton logger instance for CLI usage\nexport const logger = initLoggerCLI()\n", "import fs from 'node:fs/promises'\nimport os from 'node:os'\nimport path from 'node:path'\nimport process from 'node:process'\nimport { z } from 'zod'\n\nimport { isAgentMode } from 'src/lib/agent-mode'\nimport { assertNever } from 'src/lib/assert-never'\nimport { tryAutoMigrateLayer } from 'src/lib/config-migrations'\nimport { USER_CONFIG_DIR_NAME } from 'src/lib/constants'\nimport { getMainRepoRoot, getProjectRoot } from 'src/lib/git-utils'\nimport { PROTECTED_CHILD_ENV_NAMES } from 'src/lib/mcp-proxy/protected-env'\n\nconst INFRA_KIT_CONFIG_FILE = 'infra-kit.json'\n\n// Re-exported for the existing consumers (the vendor factory-config loader, no import cycle \u2014 this\n// module imports no `lib/vendor` code); the definition lives in `lib/constants` so zod-free entries\n// can share it.\nexport { USER_CONFIG_DIR_NAME }\nconst USER_GLOBAL_CONFIG_FILE = 'infra-kit.json'\nconst USER_PROJECTS_DIR = 'projects'\n\n// envManagement\nconst dopplerEnvManagementSchema = z.object({\n  provider: z.literal('doppler'),\n  config: z.object({\n    name: z.string().min(1),\n  }),\n})\n\nconst envManagementSchema = z.discriminatedUnion('provider', [dopplerEnvManagementSchema])\n\n// ide\n// There is one attach style: each worktree is added to the configured editor's\n// workspace and opened (no per-window mode). Cursor needs a `.code-workspace`\n// path to reconcile its `folders` array against.\n// `.strict()`: a non-strict object would drop the retired `mode` key in memory and leave it on\n// disk forever. Refusing it sends the layer through the loader's migration retry, which deletes\n// it from the file.\nconst cursorIdeConfigSchema = z\n  .object({\n    workspaceConfigPath: z.string().min(1),\n  })\n  .strict()\n\nconst cursorIdeSchema = z\n  .object({\n    provider: z.literal('cursor'),\n    config: cursorIdeConfigSchema,\n  })\n  .strict()\n\n// Cursor is the only provider: `zed` was retired (Zed has no workspace file, so its only mutation\n// was a destructive `zed --reuse` relaunch that could never report a diff). Because this schema is\n// `.strict()`, a config that still names it is refused \u2014 `infra-kit setup` drops the entry.\nconst ideSchema = z.discriminatedUnion('provider', [cursorIdeSchema])\n\n// `ide` accepts a single provider (back-compat) OR an array (the shape that\n// drove several editors at once). Normalized to an array everywhere via\n// `resolveConfiguredIdes`. Uniqueness-by-provider is enforced at parse time by a\n// `.superRefine` on the full config schema (see below) \u2014 not here, so the message\n// survives `z.union` error aggregation.\nconst idesSchema = z.union([ideSchema, z.array(ideSchema).min(1)])\n\n// taskManager\n//\n// PARSED BUT NEVER READ. Nothing in this CLI consumes `config.taskManager` \u2014 every Jira call builds\n// its config from the JIRA_BASE_URL / JIRA_EMAIL / JIRA_TOKEN / JIRA_PROJECT_ID environment\n// variables (see `loadJiraConfig` in integrations/jira/api.ts). Keeping it validated is deliberate:\n// `infraKitConfigObject` is `.strict()` and `getInfraKitConfig()` runs as an unconditional guard on\n// most commands, so deleting the key would make every command throw in any consumer repo whose\n// infra-kit.json declares it. The trap it sets is real \u2014 a `projectId` here looks authoritative and\n// changing it does nothing \u2014 so the consumer-facing template carries the same warning.\nconst jiraTaskManagerSchema = z.object({\n  provider: z.literal('jira'),\n  config: z.object({\n    baseUrl: z.string().url(),\n    projectId: z.number().int().positive(),\n  }),\n})\n\nconst taskManagerSchema = z.discriminatedUnion('provider', [jiraTaskManagerSchema])\n\n// Orca pane layout for opened worktree workspaces. Named presets keep the config\n// typo-proof (an enum, not a free string) and let the opener switch on a single\n// value; extend the enum + the opener's switch to add a layout.\n//   two-columns \u2014 left | right, both full-height (default)\n//   three-pane  \u2014 left split top/bottom + full-height right (legacy layout)\nconst orcaLayouts = ['two-columns', 'three-pane'] as const\n\nconst orcaConfigSchema = z\n  .object({\n    layout: z.enum(orcaLayouts).optional(),\n  })\n  .strict()\n\n// worktrees prompt defaults. `.strict()` like every other leaf: a non-strict object here let zod\n// SILENTLY drop a misspelt key, turning \"open in Orca\" off with no message.\nconst worktreesConfigSchema = z\n  .object({\n    openInGithubDesktop: z.boolean().optional(),\n    openInOrca: z.boolean().optional(),\n    orca: orcaConfigSchema.optional(),\n  })\n  .strict()\n\n// dev-server per-app overrides. Maps an app folder name (e.g. `client`) to its\n// local dev port and/or URL prefix. Both keys optional. An app absent from the\n// map falls back to env (`{APP}_PORT` / `PORT`) then the built-in defaults, so\n// the map is intentionally NOT validated against the discovered apps here \u2014 an\n// unknown app name is simply ignored at resolve time (lib/dev), never a parse\n// error that would brick every command.\nconst devAppConfigSchema = z\n  .object({\n    port: z.number().int().positive().optional(),\n    prefixUrl: z.string().min(1).optional(),\n  })\n  .strict()\n\nconst devConfigSchema = z.record(z.string().min(1), devAppConfigSchema)\n\n// devServersPresets: named local-dev sessions, declared in the per-project infra-kit.json\n// (team presets committed; personal ones layered via the user-project override).\n// Each preset names launch targets (apps/<app>/{api,ui}), optional per-backend\n// `watchDeps`, per-route proxy-source overrides, and an `orca` layout flag; it is\n// consumed by `infra-kit dev <preset>` and resolved by src/dev/presets. Each target key\n// names exactly one workspace package (`<app>/api` or `<app>/ui`) \u2014 a bare `<app>` is a\n// folder, not a package, and is rejected. The SHAPE is strict (typos in a preset surface\n// as parse errors), but unknown app/route NAMES are intentionally NOT validated here \u2014\n// they resolve at run time against the discovered apps, so a stale preset never bricks\n// every command.\nconst proxySourceSchema = z.enum(['local', 'cloud'])\n\nconst devPresetAppSchema = z\n  .object({\n    // api targets only: watch the backend's dist + shared-package subdeps and restart on change.\n    watchDeps: z.boolean().optional(),\n    // route path (e.g. `/api`) \u2192 source, overriding that route's config.ts default for this session.\n    proxy: z.record(z.string().min(1), proxySourceSchema).optional(),\n  })\n  .strict()\n\nconst devPresetSchema = z\n  .object({\n    // Launch-target key \u2014 one package: `client/ui`, `client/api`, `*/api`. Omit `apps` = all.\n    apps: z.record(z.string().min(1), devPresetAppSchema).optional(),\n    // Run each launched target in its own Orca terminal (one worktree, N terminals).\n    orca: z.boolean().optional(),\n  })\n  .strict()\n\nconst devPresetsSchema = z.record(z.string().min(1), devPresetSchema)\n\n// Base object shape, kept separate so `.partial()` (which only works on a plain\n// ZodObject, not the `.superRefine`-wrapped full schema) can derive the override\n// schema from it.\n//\n// `.strict()` for the same reason every leaf schema below is: this is the one config file humans\n// hand-edit, and a non-strict top level silently swallows the typo that matters most. `devServersPreset`\n// (missing `s`) or `dev-proxy` would parse clean and turn the feature off with no message. The `dev` and\n// `devServersPresets` values stay open `z.record`s \u2014 app and preset NAMES are user-chosen \u2014 so strictness\n// applies to the key set, not the contents.\n// GONE: `environments`. It answered three questions at once and was therefore wrong for two of them.\n// Where can I deploy? \u2192 each workflow's own `workflow_dispatch` `environment.options`, which GitHub\n// validates server-side (`lib/workflow-envs`). What can I authenticate to? \u2192 the token store\n// (`lib/env-tokens`). Being a third, hand-maintained copy of both, it drifted from both: hulyo declared\n// 6 envs while every hulyo workflow declared 8, and the client-side check turned that drift into a\n// REFUSAL to deploy to `stage` and `prod`.\n//\n// Deleted outright rather than accepted-and-ignored: the key is removed from every repo in the same\n// change, so nothing that is checked out on a current branch still carries it. Because this schema is\n// `.strict()`, a config that DOES still carry it (an old release branch, an unmigrated worktree) is\n// refused with `Unrecognized key: \"environments\"` \u2014 delete the key there too.\n// protectedEnvs \u2014 may THIS project reach the delivery-shaped environments listed in\n// `DEFAULT_PROTECTED_ENVS` (lib/workflow-envs/protected-envs)? The list stays in code; only the\n// decision is per-project. \"disallow\" (the default) is today's behaviour: filtered from every deploy\n// picker and refused. \"allow\" reaches them from a human's terminal and under `--agent` alike.\n// \"cli-only\" reaches them from a terminal but not from an agent \u2014 under `--agent` (or a Claude Code\n// shell) it behaves exactly as \"disallow\", because an agent's `--yes` re-run skips every interactive\n// confirmation, so there is no human keystroke on that path.\n//\n// An ENUM rather than a boolean because the VALUE extends without touching the KEY, and a key rename\n// here is expensive: `.strict()` turns the old name into a parse error on every checkout that still\n// carries it, so retiring a key means a registry migration, not just a deletion. \"cli-only\" is that\n// extension already spent.\n//\n// NEVER give this field a `.default()`. `infraKitOverrideConfigSchema` is `.partial()` of this object,\n// and `.partial()` makes a key optional WITHOUT stripping a `ZodDefault` \u2014 so the default is still\n// injected on absence. `loadLayer` parses EVERY layer through that schema and merges the results, and\n// layer 3 always exists (auto-seeded `{}` on each command), so a default here would parse to\n// `{ protectedEnvs: 'disallow' }` and shallow-merge OVER a layer-1 \"allow\", silently reverting the\n// setting on every machine with no error anywhere. Verified on zod 4.4.3. The fallback is applied at\n// the single read site instead \u2014 see `resolveProtectedEnvAccess`. No other field in this schema has a\n// default, so nothing here demonstrates the trap: this comment is the only warning.\nconst protectedEnvsSchema = z.enum(['disallow', 'allow', 'cli-only'])\n\n/** A POSIX environment-variable name. Comma-free by construction, which is what keeps the derived\n *  `ik-mcp` argv unambiguous. */\nconst envVarName = z.string().regex(/^[A-Z_]\\w*$/i, 'must be a POSIX environment-variable name')\n\n/**\n * One stdio MCP server fronted by `ik-mcp`, the credential-agnostic proxy.\n *\n * `env` are the names the proxy reads from the `ik env-load` session file and injects inline; all of\n * them non-empty means \"credentials present\", and their ordered values are the respawn key. `unset`\n * names are forced empty in the child so a stale file-based credential can never outrank the inline\n * one. Everything else the env file holds is withheld from the child.\n */\n// The proxy is for STATELESS servers: a credential change respawns the child and discards its\n// memory. A browser-automation server would lose its open tabs on every `env-load`. Servers that\n// take credentials only as flags, via OAuth, or from their own config file are out of scope.\nconst mcpProxySchema = z\n  .object({\n    command: z.string().min(1),\n    args: z.array(z.string()).default([]),\n    env: z.array(envVarName).min(1),\n    unset: z.array(envVarName).default([]),\n  })\n  .strict()\n  .superRefine((spec, ctx) => {\n    for (const name of spec.env) {\n      if (PROTECTED_CHILD_ENV_NAMES.has(name)) {\n        ctx.addIssue({\n          code: 'custom',\n          path: ['env'],\n          message: `\"${name}\" is process plumbing the proxy never strips or injects \u2014 it cannot be a credential name`,\n        })\n      }\n    }\n  })\n\n/**\n * `mcp.<name>` \u2192 the proxy spec. The name is the `.mcp.json` key and the proxy's cache subdir.\n *\n * A name containing `infra-kit` is refused because `infra-kit` is the `.mcp.json` key the retired\n * server sat under, and `doctor` still reads that key as the leftover registration to delete\n * (`inspectLegacyMcpRegistration`) \u2014 a proxy filed there would be advised away. The whole substring is\n * held so no proxy name reads as a copy of that entry.\n */\nconst mcpProxiesSchema = z.record(\n  z\n    .string()\n    .regex(/^[a-z][a-z0-9-]*$/, 'must be lowercase letters, digits and hyphens, starting with a letter')\n    .refine(\n      (name) => {\n        return !name.includes('infra-kit')\n      },\n      {\n        message:\n          '\"infra-kit\" is reserved: it is the .mcp.json key of the retired infra-kit MCP server \u2014 pick another name',\n      },\n    ),\n  mcpProxySchema,\n)\n\n/** A path inside the repository, resolved against its root on both the source and the target side. */\nconst repoRelativePathSchema = z\n  .string()\n  .min(1)\n  .superRefine((value, ctx) => {\n    if (value.startsWith('/') || value.startsWith('\\\\') || /^[a-z]:/i.test(value)) {\n      ctx.addIssue({ code: 'custom', message: `\"${value}\" must be relative to the repository root` })\n\n      return\n    }\n\n    const segments = value.split(/[/\\\\]/).filter((segment) => {\n      return segment !== '' && segment !== '.'\n    })\n\n    if (segments.includes('..')) {\n      ctx.addIssue({ code: 'custom', message: `\"${value}\" must not contain a \"..\" segment` })\n    }\n\n    // Copying or deleting inside `.git` would rewrite the target's object store and refs, not its files.\n    if (segments[0] === '.git') {\n      ctx.addIssue({ code: 'custom', message: `\"${value}\" must not be .git or a path inside it` })\n    }\n\n    // The sync rebases paths by string prefix and matches them against `git ls-files` output, which is always\n    // canonical, so any other spelling of the same path silently mismatches.\n    if (value.includes('\\\\')) {\n      ctx.addIssue({ code: 'custom', message: `\"${value}\" must use \"/\" as the separator, not \"\\\\\"` })\n    }\n\n    const rawSegments = value.split('/')\n\n    if (rawSegments.includes('')) {\n      ctx.addIssue({ code: 'custom', message: `\"${value}\" must not have a trailing or doubled \"/\"` })\n    }\n\n    if (rawSegments.includes('.')) {\n      ctx.addIssue({\n        code: 'custom',\n        message: `\"${value}\" must not contain a \".\" segment; write it from the repository root, e.g. \"vendor/configs\"`,\n      })\n    }\n  })\n\nconst vendorCopyEntrySchema = z\n  .object({\n    path: repoRelativePathSchema,\n    target: repoRelativePathSchema.optional(),\n  })\n  .strict()\n\n/**\n * Marks this repo as the source that `ik vendor sync` copies from. No `.default()` anywhere inside\n * it, for the same reason as `protectedEnvs`: the always-present layer 3 would inject it.\n */\nexport const vendorSourceSchema = z\n  .object({\n    copy: z.array(vendorCopyEntrySchema).min(1),\n    // Matched against each path segment on both sides of the diff, so a slash could never match.\n    exclude: z.array(z.string().regex(/^[^/\\\\]+$/, 'must be a single path segment, without \"/\"')).optional(),\n  })\n  .strict()\n\n/**\n * The repo root's `audit --root` rules, over `ROOT_DEFAULT_RULES`. Same vocabulary as a package's\n * `infra-kit.config.ts`, so a rule reads the same at either level; each key replaces its baseline.\n */\nconst auditRulesSchema = z\n  .object({\n    requiredScripts: z.array(z.string().min(1)).optional(),\n    requiredFiles: z.array(z.string().min(1)).optional(),\n    turbo: z\n      .object({\n        requiredTasks: z.array(z.string().min(1)).optional(),\n      })\n      .strict()\n      .optional(),\n  })\n  .strict()\n\nexport const infraKitConfigObject = z\n  .object({\n    envManagement: envManagementSchema,\n    ide: idesSchema.optional(),\n    taskManager: taskManagerSchema.optional(),\n    worktrees: worktreesConfigSchema.optional(),\n    dev: devConfigSchema.optional(),\n    devServersPresets: devPresetsSchema.optional(),\n    protectedEnvs: protectedEnvsSchema.optional(),\n    mcp: mcpProxiesSchema.optional(),\n    vendorSource: vendorSourceSchema.nullable().optional(),\n    audit: auditRulesSchema.optional(),\n  })\n  .strict()\n\n/**\n * The portless proxy's listen port. `443` \u2014 the implicit HTTPS port \u2014 because that is the ONLY port that\n * can serve a port-free `https://<release>.<packageName>.<repo>.localhost` URL, which is the whole point.\n *\n * It is privileged, so the daemon must already be running: `infra-kit dev` PROBES it and never elevates\n * (portless binds `:443` by re-execing through `sudo` with an inherited stdio, which a detached child can\n * never answer). One-time, out-of-band: a root `portless service install`, which `dev` and `doctor` print\n * for the user as an absolute-path command (portless is not on `PATH`; see `formatPortlessCommand`). There\n * is deliberately no unprivileged fallback \u2014 a fallback puts the port back in the URL.\n *\n * Not a constant of convenience: it is the single value that decides the scheme, and TLS on 443 is\n * portless's own default (our previous `--no-tls` was the deviation).\n */\nexport const DEFAULT_DEV_PROXY_PORT = 443\n\n// Full schema = base object + a parse-time uniqueness check on the `ide` array.\n// This runs inside the *merged* `safeParse` in getInfraKitConfig, so it's the\n// gate for the final config. (The override layers use the `.partial()` form\n// below, which drops this object-level refinement \u2014 acceptable, the merged\n// parse is authoritative.)\nexport const infraKitConfigSchema = infraKitConfigObject.superRefine((cfg, ctx) => {\n  if (!Array.isArray(cfg.ide)) return\n\n  const seen = new Set<string>()\n\n  for (const entry of cfg.ide) {\n    if (seen.has(entry.provider)) {\n      ctx.addIssue({\n        code: 'custom',\n        message: 'each IDE provider may appear at most once',\n        path: ['ide'],\n      })\n\n      return\n    }\n\n    seen.add(entry.provider)\n  }\n})\n\nexport const infraKitOverrideConfigSchema = infraKitConfigObject.partial()\n\nexport type InfraKitConfig = z.infer<typeof infraKitConfigSchema>\n\n/** This project's access to the delivery-shaped environments. Absent in config means `'disallow'`. */\nexport type ProtectedEnvsSetting = z.infer<typeof protectedEnvsSchema>\n\n/** One `mcp.<name>` entry after parsing \u2014 defaults applied. */\nexport type McpProxySpec = z.infer<typeof mcpProxySchema>\nexport type McpProxies = z.infer<typeof mcpProxiesSchema>\n\nexport type VendorSourceConfig = z.infer<typeof vendorSourceSchema>\n\n/** The root `audit` block: `audit --root` rules layered over the root baseline. */\nexport type AuditRulesConfig = z.infer<typeof auditRulesSchema>\n\n/** Per-app dev-server overrides (`{ port?, prefixUrl? }`). */\nexport type DevAppConfig = z.infer<typeof devAppConfigSchema>\n\n/** The full `dev` section: a map of app folder name to its {@link DevAppConfig}. */\nexport type DevConfig = z.infer<typeof devConfigSchema>\n\n/** A proxy route's resolved source in a preset override (`'local' | 'cloud'`). */\nexport type ProxySource = z.infer<typeof proxySourceSchema>\n\n/** A single dev preset (`{ apps?, orca? }`) from the `devServersPresets` map. */\nexport type DevPreset = z.infer<typeof devPresetSchema>\n\n/** The `devServersPresets` map: preset name \u2192 {@link DevPreset}. */\nexport type DevPresets = z.infer<typeof devPresetsSchema>\n\n/** A single resolved IDE entry (`{ provider, config }`). */\nexport type ConfiguredIde = z.infer<typeof ideSchema>\n\n/**\n * Normalize the `ide` config (single object, array, or unset) into a flat list.\n * Validation-free: assumes already-parsed input (uniqueness is enforced by the\n * schema). The one source of truth for \"which editors are configured.\"\n *\n * @example\n * resolveConfiguredIdes({ ide: { provider: 'cursor', config: {...} } }) // => [cursor]\n * resolveConfiguredIdes({ ide: [cursor] })                              // => [cursor]\n * resolveConfiguredIdes({})                                             // => []\n */\nexport const resolveConfiguredIdes = (config: InfraKitConfig): ConfiguredIde[] => {\n  const ide = config.ide\n\n  if (!ide) return []\n\n  return Array.isArray(ide) ? ide : [ide]\n}\n\n/** An Orca pane layout preset (see {@link orcaLayouts}). */\nexport type OrcaLayout = (typeof orcaLayouts)[number]\n\n/** The layout applied when `worktrees.orca.layout` is left unset. */\nexport const DEFAULT_ORCA_LAYOUT: OrcaLayout = 'two-columns'\n\n/**\n * Resolve the Orca pane layout for opened worktree workspaces, falling back to\n * {@link DEFAULT_ORCA_LAYOUT} when unconfigured. The one source of truth for\n * \"which layout should the Orca opener build.\"\n *\n * @example\n * resolveOrcaLayout({ worktrees: { orca: { layout: 'three-pane' } } }) // => 'three-pane'\n * resolveOrcaLayout({})                                                // => 'two-columns'\n */\nexport const resolveOrcaLayout = (config: InfraKitConfig): OrcaLayout => {\n  return config.worktrees?.orca?.layout ?? DEFAULT_ORCA_LAYOUT\n}\n\nexport interface InfraKitConfigPaths {\n  /** Committed project config (required). */\n  main: string\n  /** User-scope global overrides applied to every project. */\n  userGlobal: string\n  /** User-scope per-project overrides \u2014 `<userProjectsDir>/<projectName>/infra-kit.json`. */\n  userProject: string\n  /** Repo basename (`path.basename(projectRoot)`) used to namespace the user-project file. */\n  projectName: string\n}\n\ninterface CacheEntry {\n  /** `cwd + homedir` \u2014 see {@link pathsCacheKey}. Required alongside `mtimes`: mtimes alone can\n   * collide across two different repo roots (or two homedirs), which would serve one repo's config\n   * to a request for another inside one process (a test suite, a `dev` session re-reading config). */\n  key: string\n  mtimes: Record<keyof Omit<InfraKitConfigPaths, 'projectName'>, number | null>\n  value: InfraKitConfig\n}\n\nlet cached: CacheEntry | null = null\n\ninterface PathsCacheEntry {\n  key: string\n  value: InfraKitConfigPaths\n}\n\n/**\n * Memo slot for {@link getInfraKitConfigPaths}. SINGLE-ENTRY, not a `Map`: the resolver's only\n * inputs are `process.cwd()` and `os.homedir()`, and production never mutates either (there is zero\n * `process.chdir` outside tests), so one key covers the whole process lifetime. A `Map` would buy\n * nothing there and could hand a chdir'ing test file a stale sibling entry; a single slot that\n * recomputes on key mismatch is strictly safer and identically fast.\n */\nlet cachedPaths: PathsCacheEntry | null = null\n\n/**\n * Cache key for {@link cachedPaths}. `homedir` is load-bearing, not decoration: the resolver reads\n * it directly, and a dozen test files swap it for a fresh `mkdtemp` home WITHOUT chdir'ing \u2014 a\n * cwd-only key would hand test B test A's already-deleted temp home.\n *\n * @example\n * pathsCacheKey() // => '/Users/arthur/projects/api /Users/arthur'\n */\nconst pathsCacheKey = (): string => {\n  return `${process.cwd()} ${os.homedir()}`\n}\n\n/**\n * `~/.infra-kit` \u2014 read `os.homedir()` on every call rather than at module load, because the tests\n * swap the homedir per case and a memoized value would leak one test's temp home into the next.\n *\n * @example\n * resolveUserConfigDir() // => '/Users/arthur/.infra-kit'\n */\nconst resolveUserConfigDir = (): string => {\n  return path.join(os.homedir(), USER_CONFIG_DIR_NAME)\n}\n\n/**\n * The user-global config layer, `~/.infra-kit/infra-kit.json`, without going through\n * {@link getInfraKitConfigPaths}. That resolver spawns `git rev-parse` and REJECTS outside a repo,\n * but this file is the one merge layer that exists independent of any project \u2014 the setup\n * migrations address it from wherever `infra-kit setup` was run.\n *\n * @example\n * resolveUserGlobalConfigPath() // => '/Users/arthur/.infra-kit/infra-kit.json'\n */\nexport const resolveUserGlobalConfigPath = (): string => {\n  return path.join(resolveUserConfigDir(), USER_GLOBAL_CONFIG_FILE)\n}\n\n/**\n * Resolve every file path that participates in the config merge chain. Always\n * returns paths even for files that don't yet exist, so callers can use them\n * for \"where would my override go?\" prompts.\n *\n * Memoized on `cwd + homedir` (see {@link cachedPaths}) because the two `git rev-parse` spawns below\n * run BEFORE the mtime cache in `getInfraKitConfig`, so without this every call paid for both. The\n * memo is populated on success only \u2014 `getProjectRoot` rejects outside a git repo and callers depend\n * on that rejection, so a cached rejection would be a stateful negative path. Cleared by\n * {@link resetInfraKitConfigCache}.\n *\n * Safe to memoize: this is a pure path resolver (inputs = cwd + homedir; it returns paths, never\n * file contents), so filesystem mutation cannot invalidate it.\n *\n * @example\n * const paths = await getInfraKitConfigPaths()\n * // {\n * //   main:        '/Users/arthur/projects/api/infra-kit.json',\n * //   userGlobal:  '/Users/arthur/.infra-kit/infra-kit.json',\n * //   userProject: '/Users/arthur/.infra-kit/projects/api/infra-kit.json',\n * //   projectName: 'api',\n * // }\n */\nexport const getInfraKitConfigPaths = async (): Promise<InfraKitConfigPaths> => {\n  const key = pathsCacheKey()\n\n  if (cachedPaths && cachedPaths.key === key) {\n    return cachedPaths.value\n  }\n\n  const projectRoot = await getProjectRoot()\n  // Namespace the per-project override on the MAIN repo root, not `projectRoot`.\n  // Inside a linked worktree `projectRoot` is the worktree's own path, so its\n  // basename is the worktree's leaf dir (e.g. `feature-x`), which would key the\n  // override to a different, per-worktree file. `getMainRepoRoot` resolves the\n  // shared git common dir so every worktree of a repo converges on one key. The\n  // second `git rev-parse` this costs is fine \u2014 the merged config is mtime-cached.\n  const mainRepoRoot = await getMainRepoRoot(projectRoot)\n  const projectName = path.basename(mainRepoRoot)\n\n  const value: InfraKitConfigPaths = {\n    main: path.join(projectRoot, INFRA_KIT_CONFIG_FILE),\n    userGlobal: resolveUserGlobalConfigPath(),\n    userProject: path.join(resolveUserConfigDir(), USER_PROJECTS_DIR, projectName, INFRA_KIT_CONFIG_FILE),\n    projectName,\n  }\n\n  // Populate only after both git calls RESOLVED \u2014 never cache a rejection.\n  cachedPaths = { key, value }\n\n  return value\n}\n\n/**\n * Read and validate `infra-kit.json`, with optional override layers shallow-merged\n * on top in this order (later wins):\n *   1. project `infra-kit.json`                            \u2014 committed source of truth\n *   2. `~/.infra-kit/infra-kit.json`                       \u2014 user-global defaults\n *   3. `~/.infra-kit/projects/<repo-name>/infra-kit.json`  \u2014 user-scope per-project overrides\n *\n * Top-level keys (entire capability sections like `ide`, `envManagement`)\n * replace wholesale. Results are cached per file mtimes, so repeated reads in one\n * process are free and an edit is still picked up on the next call.\n *\n * @example\n * // infra-kit.json:           { \"envManagement\": { \"provider\": \"doppler\", \"config\": { \"name\": \"p\" } } }\n * // ~/.infra-kit/infra-kit.json: { \"ide\": { \"provider\": \"cursor\", \"config\": { \"workspaceConfigPath\": \"./ws.code-workspace\" } } }\n * const cfg = await getInfraKitConfig()\n * // => { envManagement: {...}, ide: { provider: 'cursor', config: { workspaceConfigPath: './ws.code-workspace' } } }\n * @example\n * // A reader whose stderr nobody watches: a retired key must fail as it does today, never be rewritten.\n * await getInfraKitConfig({ autoMigrate: 'off' })\n */\nexport const getInfraKitConfig = async (options: GetInfraKitConfigOptions = {}): Promise<InfraKitConfig> => {\n  const autoMigrate = options.autoMigrate ?? 'write'\n  const key = pathsCacheKey()\n  const paths = await getInfraKitConfigPaths()\n\n  let mainStat: Awaited<ReturnType<typeof fs.stat>>\n\n  try {\n    mainStat = await fs.stat(paths.main)\n  } catch {\n    cached = null\n\n    // Bridge the YAML\u2192JSON cutover: if a legacy infra-kit.yml is sitting where\n    // the JSON config should be, point the user at the one-shot migration.\n    const legacyYmlPath = paths.main.replace(/\\.json$/, '.yml')\n\n    if (await statIfExists(legacyYmlPath)) {\n      throw new Error(\n        `infra-kit.json not found at ${paths.main}. A legacy infra-kit.yml exists \u2014 run \\`infra-kit setup --skip-tools\\` to convert it.`,\n      )\n    }\n\n    throw new Error(\n      isAgentMode()\n        ? `infra-kit.json not found at ${paths.main} \u2014 the working directory is not an infra-kit project. Run infra-kit from inside an infra-kit project repo, or pass \\`-C <dir>\\` naming one.`\n        : `infra-kit.json not found at ${paths.main} \u2014 this git repo is not an infra-kit project. Run \\`infra-kit setup --skip-tools\\` here to create it, cd into an infra-kit project repo, or check out a branch that has infra-kit.json.`,\n    )\n  }\n\n  const [userGlobalStat, userProjectStat] = await Promise.all([\n    statIfExists(paths.userGlobal),\n    statIfExists(paths.userProject),\n  ])\n\n  const mtimes = {\n    main: Number(mainStat.mtimeMs),\n    userGlobal: userGlobalStat ? Number(userGlobalStat.mtimeMs) : null,\n    userProject: userProjectStat ? Number(userProjectStat.mtimeMs) : null,\n  }\n\n  if (cached && cached.key === key && shallowEqual(cached.mtimes, mtimes)) {\n    return cached.value\n  }\n\n  const layers: ConfigLayer[] = [\n    { label: 'infra-kit.json', path: paths.main, required: true, autoMigrate, mtimeMs: mtimes.main },\n    {\n      label: '~/.infra-kit/infra-kit.json',\n      path: paths.userGlobal,\n      required: false,\n      autoMigrate,\n      mtimeMs: mtimes.userGlobal,\n    },\n    {\n      label: `~/.infra-kit/projects/${paths.projectName}/infra-kit.json`,\n      path: paths.userProject,\n      required: false,\n      autoMigrate,\n      mtimeMs: mtimes.userProject,\n    },\n  ]\n\n  let merged: Record<string, unknown> = {}\n\n  for (const layer of layers) {\n    const data = await loadLayer(layer)\n\n    if (data === null) continue\n\n    merged = { ...merged, ...data }\n  }\n\n  const finalResult = infraKitConfigSchema.safeParse(merged)\n\n  if (!finalResult.success) {\n    throw new Error(`Invalid merged infra-kit config: ${z.prettifyError(finalResult.error)}`)\n  }\n\n  // No reset after an auto-migration: `mtimes` were stat'ed before `loadLayer` rewrote the file, so\n  // this entry's fingerprint is already stale and the next read is exactly one guaranteed miss.\n  cached = { key, mtimes, value: finalResult.data }\n\n  return finalResult.data\n}\n\n/**\n * Drop ONLY the merged-config cache ({@link cached}), keeping the path memo ({@link cachedPaths})\n * intact. For writers of a merge layer \u2014 the config bootstrap, which creates the layer-3\n * `~/.infra-kit/projects/<repo>/infra-kit.json`.\n *\n * WHY this exists separately from {@link resetInfraKitConfigCache}: writing the layer-3 file changes\n * the MERGE RESULT (a stale merged config would miss the new layer) but it cannot change the\n * RESOLVED PATHS \u2014 those are a pure function of `cwd + homedir`, and creating a file mutates\n * neither. Blowing away the path memo there would just make the very run that creates the file\n * re-spawn both `git rev-parse` processes for nothing: 4 spawns instead of 2.\n *\n * @example\n * await fs.writeFile(paths.userProject, '{}\\n', 'utf-8')\n * resetMergedConfigCache()\n * await getInfraKitConfig()      // sees the new layer-3 layer\n * await getInfraKitConfigPaths() // still served from the memo \u2014 zero extra git spawns\n */\nexport const resetMergedConfigCache = (): void => {\n  cached = null\n}\n\n/**\n * For tests \u2014 drops BOTH in-memory caches: the mtime-fingerprinted merged config and the\n * `cwd + homedir`-keyed path memo ({@link cachedPaths}). The next read re-spawns `git rev-parse`\n * and re-hits disk. Production writers want the narrower {@link resetMergedConfigCache}.\n *\n * @example\n * resetInfraKitConfigCache()\n * await getInfraKitConfig() // re-resolves paths and re-reads files even if mtimes look unchanged\n */\nexport const resetInfraKitConfigCache = (): void => {\n  cached = null\n  cachedPaths = null\n}\n\n/**\n * `fs.stat` that returns `null` instead of throwing on ENOENT. Used so the\n * resolver can probe optional files in the merge chain without try/catch noise.\n *\n * @example\n * const stat = await statIfExists('/does/not/exist') // => null\n */\nconst statIfExists = async (filePath: string): Promise<Awaited<ReturnType<typeof fs.stat>> | null> => {\n  try {\n    return await fs.stat(filePath)\n  } catch {\n    return null\n  }\n}\n\n/**\n * `fs.readFile` that returns `null` instead of throwing on ENOENT.\n *\n * @example\n * const raw = await readIfExists('/missing.json') // => null\n * const raw = await readIfExists('/exists.json')  // => '{ \"environments\": [\"dev\"] }\\n'\n */\nconst readIfExists = async (filePath: string): Promise<string | null> => {\n  try {\n    return await fs.readFile(filePath, 'utf-8')\n  } catch {\n    return null\n  }\n}\n\n/**\n * Reference-equality comparison of every key in two flat records. Used to\n * cheaply detect whether the cached mtime fingerprint still matches.\n *\n * @example\n * shallowEqual({ a: 1, b: 2 }, { a: 1, b: 2 }) // => true\n * shallowEqual({ a: 1 },       { a: 1, b: 2 }) // => false\n * shallowEqual({ a: 1 },       { a: 2 })       // => false\n */\nconst shallowEqual = <T extends Record<string, unknown>>(a: T, b: T): boolean => {\n  const keys = Object.keys(a)\n\n  if (keys.length !== Object.keys(b).length) return false\n\n  return keys.every((k) => {\n    return a[k] === b[k]\n  })\n}\n\nexport interface GetInfraKitConfigOptions {\n  /**\n   * 'write' (default): a layer the strict schema refuses may be migrated and rewritten on disk.\n   * 'off': never write \u2014 throw today's strict error. For callers whose stderr nobody reads.\n   */\n  autoMigrate?: 'write' | 'off'\n}\n\ninterface ConfigLayer {\n  label: string\n  path: string\n  required: boolean\n  autoMigrate: 'write' | 'off'\n  /**\n   * The mtime stat'ed BEFORE the layer is read. A migration that rewrites the file compares against\n   * it so a concurrent editor's save between read and write is never clobbered; `null` when the\n   * optional layer did not exist at stat time.\n   */\n  mtimeMs: number | null\n}\n\n/**\n * The CI wording for a required layer the strict schema refused: the checkout is ephemeral, so the\n * fix has to land on the branch rather than on this machine.\n *\n * @example\n * withSetupHint(new Error('Invalid infra-kit.json at /r/infra-kit.json: Unrecognized key: \"environments\"')).message\n * // => 'Invalid infra-kit.json at /r/infra-kit.json: Unrecognized key: \"environments\"\\nA retired key on this branch \u2014 run `infra-kit setup --skip-tools` in this checkout and commit infra-kit.json.'\n */\nexport const withSetupHint = (error: Error): Error => {\n  return new Error(\n    `${error.message}\\nA retired key on this branch \u2014 run \\`infra-kit setup --skip-tools\\` in this checkout and commit infra-kit.json.`,\n  )\n}\n\n/**\n * Read a single layer of the merge chain: parse the JSON if the file exists\n * and validate it against the override schema. Returns `null` if an optional\n * layer is missing; throws if the layer is required, malformed, or invalid.\n * An empty/whitespace-only file is treated as `{}` (JSON.parse would throw).\n *\n * A strict-schema refusal is retried once through {@link tryAutoMigrateLayer}\n * (retired keys deleted and the file rewritten) before the error is thrown.\n *\n * @example\n * await loadLayer({ label: '~/.infra-kit/infra-kit.json', path: '/missing.json', required: false, autoMigrate: 'write', mtimeMs: null })\n * // => null\n * @example\n * // /home/me/.infra-kit/infra-kit.json: '{ \"ide\": { \"provider\": \"cursor\", \"config\": { \"workspaceConfigPath\": \"./ws.code-workspace\" } } }'\n * await loadLayer({ label: '~/.infra-kit/infra-kit.json', path: '/home/me/.infra-kit/infra-kit.json', required: false, autoMigrate: 'write', mtimeMs: 1700000000000 })\n * // => { ide: { provider: 'cursor', config: { workspaceConfigPath: './ws.code-workspace' } } }\n */\nconst loadLayer = async (layer: ConfigLayer): Promise<Record<string, unknown> | null> => {\n  const raw = await readIfExists(layer.path)\n\n  if (raw === null) {\n    if (layer.required) {\n      throw new Error(`${layer.label} not found at ${layer.path}`)\n    }\n\n    return null\n  }\n\n  let parsedRaw: unknown\n\n  try {\n    parsedRaw = raw.trim() === '' ? {} : JSON.parse(raw)\n  } catch (err) {\n    throw new Error(`Invalid JSON in ${layer.label} at ${layer.path}: ${(err as Error).message}`)\n  }\n\n  // `envTokens` is ALREADY rejected below \u2014 the override schema keeps `.strict()`, so it lands as a\n  // generic `unrecognized_keys` issue. That generic message is wrong for this one key: the user has\n  // pasted a live Doppler service token into a file that may be committed, backed up by their editor,\n  // or opened by `config edit`. The first instruction has to be REVOKE, not \"fix your config\". Narrow\n  // by construction \u2014 every other unknown key keeps the generic error.\n  if (isRecord(parsedRaw) && 'envTokens' in parsedRaw) {\n    throw new Error(buildEnvTokensRejectionMessage(layer))\n  }\n\n  if (!layer.required && isRecord(parsedRaw)) {\n    assertNoProjectLayerOnlyKeys(layer, parsedRaw)\n  }\n\n  const result = infraKitOverrideConfigSchema.safeParse(parsedRaw)\n\n  if (result.success) {\n    return result.data as Record<string, unknown>\n  }\n\n  const originalError = new Error(`Invalid ${layer.label} at ${layer.path}: ${z.prettifyError(result.error)}`)\n\n  // The retry needs an object to migrate and the pre-read mtime as the stale-write baseline. A\n  // `null` mtime here means the file did not exist when `getInfraKitConfig` stat'ed it and appeared\n  // before the read above \u2014 with no baseline the rewrite could clobber whoever just created it, so\n  // that race keeps the strict error.\n  if (!isRecord(parsedRaw) || layer.mtimeMs === null) {\n    throw originalError\n  }\n\n  const outcome = await tryAutoMigrateLayer({ ...layer, mtimeMs: layer.mtimeMs }, parsedRaw, raw, {\n    schema: infraKitOverrideConfigSchema,\n  })\n\n  switch (outcome.kind) {\n    case 'migrated':\n      return outcome.data\n    case 'ci-gated':\n      throw withSetupHint(originalError)\n    case 'not-applicable':\n      throw originalError\n    default:\n      return assertNever(outcome)\n  }\n}\n\n/**\n * Why `mcp` cannot live in this layer, and where the two things a developer might have wanted go\n * instead: the project file for a shared server, Claude Code's own local scope for a machine-only\n * override (which shadows the project entry by name and needs no infra-kit involvement).\n */\nexport const buildMcpLayerRejectionMessage = (layer: Omit<ConfigLayer, 'autoMigrate' | 'mtimeMs'>): string => {\n  return [\n    `\"mcp\" is not allowed in ${layer.label} (${layer.path}): it feeds the committed .mcp.json, so a per-machine copy would replace the project's servers for everyone.`,\n    'Move the block to the project infra-kit.json and run `infra-kit setup`.',\n    'For a machine-only override of one server (e.g. a local fork), use Claude Code directly:',\n    '  claude mcp add --scope local <name> -- ik-mcp --name <name> --env <VAR> ... -- <command> <args>',\n    '(local scope shadows the project entry by name; `claude mcp list` will show a same-name conflict warning, which is expected).',\n  ].join('\\n')\n}\n\nconst buildVendorSourceLayerRejectionMessage = (layer: Omit<ConfigLayer, 'autoMigrate' | 'mtimeMs'>): string => {\n  return [\n    `\"vendorSource\" is not allowed in ${layer.label} (${layer.path}): only the committed project file may mark a repository as the \\`vendor sync\\` source. In the machine-wide file it would make every repository on this machine a source; in a per-project override it would make this machine disagree with every other clone.`,\n    \"Move the block to the source repository's own infra-kit.json and commit it there.\",\n  ].join('\\n')\n}\n\nconst buildAuditLayerRejectionMessage = (layer: Omit<ConfigLayer, 'autoMigrate' | 'mtimeMs'>): string => {\n  return [\n    `\"audit\" is not allowed in ${layer.label} (${layer.path}): the root audit gates CI, so a per-machine copy would make this machine pass or fail a different check list than CI.`,\n    'Move the block to the project infra-kit.json and commit it there.',\n  ].join('\\n')\n}\n\ntype LayerRejectionMessageBuilder = (layer: Omit<ConfigLayer, 'autoMigrate' | 'mtimeMs'>) => string\n\n/**\n * Keys only the committed project layer may carry. `mcp` feeds the committed `.mcp.json`, and the\n * shallow layer merge would let a per-machine block replace the project's wholesale and then be\n * derived into the shared file. `vendorSource` decides which repo is the sync source. `audit` is\n * what CI enforces at the root.\n */\nconst PROJECT_LAYER_ONLY_KEYS: Readonly<Record<string, LayerRejectionMessageBuilder>> = {\n  mcp: buildMcpLayerRejectionMessage,\n  vendorSource: buildVendorSourceLayerRejectionMessage,\n  audit: buildAuditLayerRejectionMessage,\n}\n\n// Refused loudly rather than silently ignored: each key's message says why a per-machine copy is\n// wrong and where the block belongs instead.\nconst assertNoProjectLayerOnlyKeys = (\n  layer: Omit<ConfigLayer, 'autoMigrate' | 'mtimeMs'>,\n  parsedRaw: Record<string, unknown>,\n): void => {\n  for (const [key, buildMessage] of Object.entries(PROJECT_LAYER_ONLY_KEYS)) {\n    if (key in parsedRaw) {\n      throw new Error(buildMessage(layer))\n    }\n  }\n}\n\n/**\n * Narrow parsed JSON to a plain object so a key probe is safe (JSON's top level may be an array, a\n * string, or `null`).\n *\n * @example\n * isRecord({ envTokens: {} }) // => true\n * isRecord(['envTokens'])     // => false\n * isRecord(null)              // => false\n */\nconst isRecord = (value: unknown): value is Record<string, unknown> => {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n\n/**\n * The REVOKE-first refusal for a service token found in an `infra-kit.json`. Ordered by urgency: the\n * credential is already exposed, so revoking it beats editing the file. Tokens live in a SIBLING\n * `tokens.json` (0600) that this loader never reads \u2014 see `lib/env-tokens`.\n *\n * @example\n * buildEnvTokensRejectionMessage({ label: 'infra-kit.json', path: '/r/infra-kit.json', required: true })\n * // => 'Refusing to load infra-kit.json \u2014 `envTokens` is not a config key. \u2026'\n */\nconst buildEnvTokensRejectionMessage = (layer: Omit<ConfigLayer, 'autoMigrate' | 'mtimeMs'>): string => {\n  return [\n    `Refusing to load ${layer.label} \u2014 \\`envTokens\\` is not a config key.`,\n    'A service token in a config file can be committed, backed up by your editor, or shared.',\n    '  1. REVOKE the token in Doppler now \u2014 treat it as compromised.',\n    `  2. Remove the \\`envTokens\\` key from ${layer.path}.`,\n    '  3. Re-add it privately: `infra-kit env-token-set <env>`',\n    '     (it is written to ~/.infra-kit/projects/<repo>/tokens.json, mode 0600, never to the repo).',\n  ].join('\\n')\n}\n", "/**\n * Exhaustiveness guard for discriminated unions. Place in the `default` branch of\n * a `switch` over a union: once every case is handled the argument narrows to\n * `never`, so adding a new variant later turns this into a compile error.\n *\n * @example\n * switch (source) {\n *   case 'local': return resolveLocal()\n *   case 'cloud': return resolveCloud()\n *   default: return assertNever(source) // compile error if a source is unhandled\n * }\n */\nexport const assertNever = (value: never): never => {\n  throw new Error(`Unexpected value: ${JSON.stringify(value)}`)\n}\n", "export const omitKey = (record: Record<string, unknown>, key: string): Record<string, unknown> => {\n  return Object.fromEntries(\n    Object.entries(record).filter(([entryKey]) => {\n      return entryKey !== key\n    }),\n  )\n}\n", "import type { ConfigMigration } from '../types'\nimport { omitKey } from './omit-key'\n\n/**\n * A migration that removes one top-level key, whatever its value: the strict schema refuses the key\n * regardless, so inspecting the value would only add a way for the migration to disagree with it.\n */\nexport const dropTopLevelKey = ({ key, id, note }: { key: string; id: string; note: string }): ConfigMigration => {\n  return {\n    id,\n    note,\n    apply: (parsed) => {\n      if (!(key in parsed)) return { changed: false, result: parsed }\n\n      return { changed: true, result: omitKey(parsed, key) }\n    },\n  }\n}\n", "import { dropTopLevelKey } from './drop-top-level-key'\n\nexport const dropDevProxyKeyMigration = dropTopLevelKey({\n  key: 'devProxy',\n  id: 'drop-dev-proxy-key',\n  note: 'the retired \"devProxy\" key (dev URLs are port-free https://<release>.<package>.localhost)',\n})\n", "import { dropTopLevelKey } from './drop-top-level-key'\n\nexport const dropEnvAutoLoadKeyMigration = dropTopLevelKey({\n  key: 'envAutoLoad',\n  id: 'drop-env-auto-load-key',\n  note: 'the retired \"envAutoLoad\" key (env auto-load is gone \u2014 run `env-load -c <config>` in the terminal)',\n})\n", "import { dropTopLevelKey } from './drop-top-level-key'\n\nexport const dropEnvironmentsKeyMigration = dropTopLevelKey({\n  key: 'environments',\n  id: 'drop-environments-key',\n  note: 'the retired \"environments\" key (deploy targets now come from each workflow\\'s workflow_dispatch options, auth from the token store)',\n})\n", "import type { ConfigMigration } from '../types'\nimport { omitKey } from './omit-key'\n\n// `ide.config.mode` chose the per-window attach style; the windows removal left one style, so the\n// key is dead and the strict `ideConfigSchema` refuses it. Handles both the single-provider and\n// the array form.\nconst stripLegacyIdeMode: ConfigMigration['apply'] = (parsed) => {\n  const ide = parsed.ide\n\n  if (ide === null || typeof ide !== 'object') {\n    return { changed: false, result: parsed }\n  }\n\n  let changed = false\n\n  const stripEntry = (entry: unknown): unknown => {\n    if (entry === null || typeof entry !== 'object' || !('config' in entry)) {\n      return entry\n    }\n\n    const config = (entry as { config: unknown }).config\n\n    if (config === null || typeof config !== 'object' || !('mode' in config)) {\n      return entry\n    }\n\n    changed = true\n\n    return { ...(entry as Record<string, unknown>), config: omitKey(config as Record<string, unknown>, 'mode') }\n  }\n\n  const nextIde = Array.isArray(ide) ? ide.map(stripEntry) : stripEntry(ide)\n\n  if (!changed) {\n    return { changed: false, result: parsed }\n  }\n\n  return { changed: true, result: { ...parsed, ide: nextIde } }\n}\n\nexport const stripLegacyIdeModeMigration: ConfigMigration = {\n  id: 'strip-legacy-ide-mode',\n  note: 'legacy \"mode\"',\n  apply: stripLegacyIdeMode,\n}\n", "import type { ConfigMigration } from '../types'\nimport { omitKey } from './omit-key'\n\nconst RETIRED_IDE_PROVIDER = 'zed'\n\nconst isRetiredIdeEntry = (entry: unknown): boolean => {\n  return (\n    entry !== null && typeof entry === 'object' && (entry as { provider?: unknown }).provider === RETIRED_IDE_PROVIDER\n  )\n}\n\n// An array that held only Zed loses the `ide` key outright: `ide: []` fails the schema's `.min(1)`,\n// and it means \"no editor\" anyway.\nconst stripRetiredZedIde: ConfigMigration['apply'] = (parsed) => {\n  const ide = parsed.ide\n\n  if (Array.isArray(ide)) {\n    const kept = ide.filter((entry) => {\n      return !isRetiredIdeEntry(entry)\n    })\n\n    if (kept.length === ide.length) return { changed: false, result: parsed }\n\n    return { changed: true, result: kept.length > 0 ? { ...parsed, ide: kept } : omitKey(parsed, 'ide') }\n  }\n\n  if (isRetiredIdeEntry(ide)) return { changed: true, result: omitKey(parsed, 'ide') }\n\n  return { changed: false, result: parsed }\n}\n\nexport const stripRetiredZedIdeMigration: ConfigMigration = {\n  id: 'strip-retired-zed-ide',\n  note: 'the retired \"zed\" provider',\n  apply: stripRetiredZedIde,\n}\n", "import { dropDevProxyKeyMigration } from './migrations/drop-dev-proxy-key'\nimport { dropEnvAutoLoadKeyMigration } from './migrations/drop-env-auto-load-key'\nimport { dropEnvironmentsKeyMigration } from './migrations/drop-environments-key'\nimport { stripLegacyIdeModeMigration } from './migrations/strip-legacy-ide-mode'\nimport { stripRetiredZedIdeMigration } from './migrations/strip-retired-zed-ide'\nimport type { ConfigMigration } from './types'\n\n/**\n * Applied in this order \u2014 the order the \"removed \u2026\" notes are printed in. Each step deletes a\n * disjoint shape, so the order is not load-bearing for the result; it is fixed so the note line is\n * stable across runs.\n */\nexport const CONFIG_MIGRATIONS: readonly ConfigMigration[] = [\n  stripLegacyIdeModeMigration,\n  stripRetiredZedIdeMigration,\n  dropEnvironmentsKeyMigration,\n  dropDevProxyKeyMigration,\n  dropEnvAutoLoadKeyMigration,\n]\n", "import { CONFIG_MIGRATIONS } from './registry'\nimport type { MigrationResult } from './types'\n\n/**\n * Fold the registry over a parsed config. Pure: the input is never mutated, and when no step\n * changes anything the returned `result` IS the input reference, so a caller can `===` it to skip\n * a rewrite. Idempotent by construction \u2014 every step is delete-only, so a second pass finds\n * nothing to delete.\n */\nexport const applyConfigMigrations = (parsed: Record<string, unknown>): MigrationResult => {\n  return CONFIG_MIGRATIONS.reduce<MigrationResult>(\n    (acc, migration) => {\n      const step = migration.apply(acc.result)\n\n      if (!step.changed) return acc\n\n      return { changed: true, result: step.result, notes: [...acc.notes, migration.note] }\n    },\n    { changed: false, result: parsed, notes: [] },\n  )\n}\n", "import fs from 'node:fs/promises'\nimport os from 'node:os'\n\n/**\n * Shared path-display helpers for CLI output. Extracted from `commands/config`\n * and `commands/init/migrate-config` (which each had private copies) so config\n * surfaces print paths consistently. Keep this dependency-light (node builtins\n * only) \u2014 it is imported by several commands.\n */\n\n/**\n * Resolve whether a file is reachable, suppressing ENOENT (and any access error)\n * into a boolean. Used to render `[\u2713]`/`[ ]` existence markers.\n *\n * @example\n * await fileExists('/etc/hosts') // => true\n * await fileExists('/nope.txt')  // => false\n */\nexport const fileExists = async (filePath: string): Promise<boolean> => {\n  try {\n    await fs.access(filePath)\n\n    return true\n  } catch {\n    return false\n  }\n}\n\n/**\n * Replace the user's home prefix with `~` so logged paths stay short and portable\n * across machines. Leaves non-home paths untouched.\n *\n * @example\n * // os.homedir() === '/Users/arthur'\n * tildify('/Users/arthur/.infra-kit/infra-kit.json') // => '~/.infra-kit/infra-kit.json'\n * tildify('/etc/hosts')                              // => '/etc/hosts'\n */\nexport const tildify = (filePath: string): string => {\n  const home = os.homedir()\n\n  return filePath.startsWith(home) ? `~${filePath.slice(home.length)}` : filePath\n}\n", "import { randomBytes } from 'node:crypto'\nimport fs from 'node:fs/promises'\nimport path from 'node:path'\nimport process from 'node:process'\n\nimport { applyConfigMigrations } from './apply-config-migrations'\nimport type { MigrationResult } from './types'\n\n/**\n * The target was modified between the caller's read and this write. Rewriting it would clobber a\n * human's (or another process's) edit with bytes derived from a stale read; the caller retries from\n * the fresh file on its next run instead.\n */\nexport class ConfigFileChangedError extends Error {\n  constructor(filePath: string) {\n    super(`${filePath} changed on disk since it was read`)\n    this.name = 'ConfigFileChangedError'\n  }\n}\n\nexport interface WriteMigratedConfigFileOptions {\n  path: string\n  /** The bytes the caller read \u2014 only the indentation is taken from them. */\n  raw: string\n  migrated: Record<string, unknown>\n  /** `mtimeMs` observed when `raw` was read; the stale-read guard compares against it. */\n  expectedMtimeMs: number\n}\n\nexport interface FileMigrationResult extends MigrationResult {\n  path: string\n}\n\nconst DEFAULT_INDENT = 2\n\n// The first indented line decides, so a hand-edited 4-space file is not reformatted wholesale.\nconst detectIndent = (raw: string): string | number => {\n  return /^([ \\t]+)\\S/m.exec(raw)?.[1] ?? DEFAULT_INDENT\n}\n\n// Group / other permission bits and the setuid/sticky family; the file-type bits above them are not\n// chmod's business.\nconst PERMISSION_BITS = 0o7777\n\n/**\n * Serialise `migrated` over `path` \u2014 atomically, keeping the file's mode and indentation, and\n * refusing when the file moved on since it was read. Never applies the registry: the caller has\n * already done that (the loader on its retry, {@link migrateConfigFile} on the setup path), so\n * the registry runs exactly once per file whichever way in. Does not log \u2014 each caller owns its\n * own line. Throws on any fs error; callers decide.\n *\n * The rename goes over the realpath'd target, so a symlinked `~/.infra-kit/infra-kit.json`\n * (dotfiles repo) keeps its symlink and the link target is what gets replaced \u2014 `writeFile`\n * follows a link implicitly, `rename` would replace the link itself.\n */\nexport const writeMigratedConfigFile = async ({\n  path: filePath,\n  raw,\n  migrated,\n  expectedMtimeMs,\n}: WriteMigratedConfigFileOptions): Promise<void> => {\n  const target = await fs.realpath(filePath)\n  const dir = path.dirname(target)\n  const base = path.basename(target)\n  // pid + random: two racing CLIs never share a tmp name, and a reader never sees a torn file.\n  const tmp = path.join(dir, `.${base}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`)\n  const content = `${JSON.stringify(migrated, null, detectIndent(raw))}\\n`\n\n  try {\n    await fs.writeFile(tmp, content, 'utf8')\n\n    // Re-stat as late as possible: the window between this check and the rename is the smallest\n    // this process can make it.\n    const stat = await fs.stat(target)\n\n    if (stat.mtimeMs !== expectedMtimeMs) {\n      throw new ConfigFileChangedError(filePath)\n    }\n\n    // writeFile's mode is umask-masked; chmod sets the original bits exactly (0600 stays 0600).\n    await fs.chmod(tmp, stat.mode & PERMISSION_BITS)\n    await fs.rename(tmp, target)\n  } catch (err) {\n    await fs.rm(tmp, { force: true })\n    throw err\n  }\n}\n\nconst isRecord = (value: unknown): value is Record<string, unknown> => {\n  return value !== null && typeof value === 'object' && !Array.isArray(value)\n}\n\n/**\n * Setup path: stat + read + {@link applyConfigMigrations} + {@link writeMigratedConfigFile}. An\n * empty (or whitespace-only) file is a no-op rather than a JSON error \u2014 an empty layer is a valid\n * \"nothing to override\". Throws on read/parse/write errors, including {@link ConfigFileChangedError}.\n */\nexport const migrateConfigFile = async (filePath: string): Promise<FileMigrationResult> => {\n  const stat = await fs.stat(filePath)\n  const raw = await fs.readFile(filePath, 'utf8')\n\n  if (raw.trim() === '') {\n    return { changed: false, result: {}, notes: [], path: filePath }\n  }\n\n  const parsed: unknown = JSON.parse(raw)\n\n  if (!isRecord(parsed)) {\n    return { changed: false, result: {}, notes: [], path: filePath }\n  }\n\n  const migrated = applyConfigMigrations(parsed)\n\n  if (migrated.changed) {\n    await writeMigratedConfigFile({ path: filePath, raw, migrated: migrated.result, expectedMtimeMs: stat.mtimeMs })\n  }\n\n  return { ...migrated, path: filePath }\n}\n", "import type { z } from 'zod'\n\nimport { isCI } from 'src/lib/agent-mode'\nimport { logger } from 'src/lib/logger'\nimport { tildify } from 'src/lib/path-display'\n\nimport packageJson from '../../../package.json' with { type: 'json' }\nimport { applyConfigMigrations } from './apply-config-migrations'\nimport { writeMigratedConfigFile } from './migrate-config-file'\n\n/** The slice of the loader's `ConfigLayer` the retry needs; passed in so this module never imports the loader (cycle). */\nexport interface AutoMigrateLayer {\n  path: string\n  /** The tracked project layer \u2014 the only one a CI checkout must not rewrite. */\n  required: boolean\n  /** `'off'` for callers whose stderr nobody reads; they keep today's strict error instead of a rewritten file. */\n  autoMigrate: 'write' | 'off'\n  /** From the stat the loader already took before reading \u2014 the stale-read guard's baseline. */\n  mtimeMs: number\n}\n\nexport type AutoMigrateOutcome =\n  /** `data` is the second `safeParse`'s output (defaults applied), never the raw migrated object. */\n  | { kind: 'migrated'; data: Record<string, unknown> }\n  /** A migration WOULD fix the required layer, but CI withholds the write \u2014 the caller appends its setup hint. */\n  | { kind: 'ci-gated' }\n  /** Policy off, nothing to migrate, still invalid afterwards, file moved, or the write failed: the caller throws its original error. */\n  | { kind: 'not-applicable' }\n\n/**\n * The loader's retry after the strict schema refused a layer: migrate in memory, prove the result\n * parses, write it back, and only then hand the parsed value over \u2014 a migrated value is never\n * returned without the file on disk matching it. Ordered so the CI gate fires only when a migration\n * would actually have fixed the file (a layer with a second, real problem gets the original error\n * naming every unrecognized key, with no misleading hint).\n *\n * `warn`, not `info`, for the one stderr line: `--json` lowers the logger to `warn` and the line\n * must still land \u2014 it is the only signal that a tracked file just gained a hunk to commit.\n */\nexport const tryAutoMigrateLayer = async (\n  layer: AutoMigrateLayer,\n  parsedRaw: Record<string, unknown>,\n  raw: string,\n  { schema }: { schema: z.ZodType },\n): Promise<AutoMigrateOutcome> => {\n  if (layer.autoMigrate === 'off') {\n    return { kind: 'not-applicable' }\n  }\n\n  const migrated = applyConfigMigrations(parsedRaw)\n\n  if (!migrated.changed) {\n    return { kind: 'not-applicable' }\n  }\n\n  const second = schema.safeParse(migrated.result)\n\n  if (!second.success) {\n    return { kind: 'not-applicable' }\n  }\n\n  if (layer.required && isCI()) {\n    return { kind: 'ci-gated' }\n  }\n\n  try {\n    await writeMigratedConfigFile({\n      path: layer.path,\n      raw,\n      migrated: migrated.result,\n      expectedMtimeMs: layer.mtimeMs,\n    })\n  } catch (err) {\n    logger.debug(err, `auto-migration could not rewrite ${layer.path}`)\n\n    return { kind: 'not-applicable' }\n  }\n\n  logger.warn(\n    `Migrated ${tildify(layer.path)}: removed ${migrated.notes.join(' and ')} (retired by infra-kit ${packageJson.version})`,\n  )\n\n  return { kind: 'migrated', data: second.data as Record<string, unknown> }\n}\n", "import { OperationError } from './operation-error'\nimport type { OperationErrorContext } from './operation-error'\n\n/**\n * Why the command stopped, for a machine reader. `exitCode` 2 means nothing happened \u2014 re-run with\n * more; 1 means something happened and part of it failed.\n */\nexport type RefusalStatus = 'confirmation_required' | 'argument_required' | 'partial_failure' | 'refused'\n\nexport interface RefusalStructuredContent {\n  status: RefusalStatus\n  [k: string]: unknown\n}\n\n/**\n * A refusal that carries a payload for an agent: `entry/cli.ts` emits `structuredContent` under\n * `--json` and exits with `exitCode`. The message is the ordinary `OperationError` one\n * (operation / stderr / remediation), so the human-readable line loses nothing.\n *\n * @example\n * throw new StructuredRefusalError(\n *   { status: 'argument_required', argument: 'version', agentMode: 'flag' },\n *   2,\n *   { operation: 'interactive prompt', remediation: 'pass --version' },\n * )\n */\n// Extends `OperationError`, not `Error`, ON PURPOSE. Seven of the eight confirm sites sit under a\n// handler-level `catch` that passes through only `isPromptCancellation`, `isCommandDeclined` and\n// `instanceof OperationError` and REWRAPS everything else into a generic `OperationError`\n// (`release-remove.ts` near the `gh auth status` remediation, `worktrees-add.ts`, `worktrees-sync.ts`,\n// `release-create.ts`). A plain `Error` subclass would lose the payload and the exit code at exactly\n// the sites this exists for.\nexport class StructuredRefusalError extends OperationError {\n  readonly structuredContent: RefusalStructuredContent\n  readonly exitCode: 1 | 2\n\n  constructor(structuredContent: RefusalStructuredContent, exitCode: 1 | 2, context: OperationErrorContext) {\n    super(undefined, context)\n    this.name = 'StructuredRefusalError'\n    this.structuredContent = structuredContent\n    this.exitCode = exitCode\n  }\n}\n"],
-  "mappings": "0IAoBA,OAAOA,OAAa,eCnBpB,OAAOC,OAAa,eAcb,IAAMC,EAAa,CAAE,QAAS,EAAM,EAO9BC,GAAO,CAClBC,EACAC,EAAiCC,GAAS,CACxCL,GAAQ,OAAO,MAAMK,CAAI,CAC3B,KAEIJ,EAAW,SAAWE,GAAUA,EAAO,mBAAqB,MAC9DC,EAAM,GAAG,KAAK,UAAUD,EAAO,kBAAmB,KAAM,CAAC,CAAC;AAAA,CAAI,EAGzDA,GAIIG,GAAiBC,GAAuB,CAC5BA,EAAI,QAAQ,KAAMC,GAChCA,EAAO,OAAS,QACxB,GAGCD,EAAI,OAAO,SAAU,4EAA4E,EAGnGA,EAAI,SAAS,QAAQD,EAAa,CACpC,EDnBO,IAAMG,GAAY,CAAE,OAAQ,IAAwB,EAG9CC,EAAc,IAClBD,GAAU,SAAW,KAQjBE,GAAa,IACjBD,EAAY,GAAKE,EAAW,QASxBC,EAAO,IACX,EAAQC,GAAQ,IAAI,GAoBhBC,GAAyB,CAAC,CAAE,IAAAC,EAAK,WAAAC,EAAY,KAAAC,CAAK,IAA8C,CAC3G,GAAIA,EAAM,MAAO,OAEjB,IAAMC,EAAWH,EAAI,gBAErB,OAAIG,IAAa,KAEWH,EAAI,aAAe,QAAa,CAACC,GAAcE,IAAa,IAF3D,MAIQ,IACvC,EE/DO,IAAMC,EAAiBC,GAAuC,CAOnE,IAAMC,EAAO,IAAI,IACbC,EAAUF,EAEd,KAAOE,IAAY,MAAQ,OAAOA,GAAY,UAAY,CAACD,EAAK,IAAIC,CAAO,GAAG,CAC5ED,EAAK,IAAIC,CAAO,EAEhB,GAAM,CAAE,OAAAC,EAAQ,cAAAC,CAAc,EAAIF,EAElC,GAAI,OAAOC,GAAW,UAAYA,EAAO,OAAS,EAAG,OAAOA,EAC5D,GAAI,OAAOC,GAAkB,UAAYA,EAAc,OAAS,EAAG,OAAOA,EAE1EF,EAAWA,EAAgC,KAC7C,CAGF,EASMG,GAAe,CAACL,EAAgBM,IAAuC,CAC3E,IAAMH,EAASG,EAAI,eAAiBP,EAAcC,CAAK,EACjDO,EAAQ,CAAC,aAAaD,EAAI,SAAS,EAAE,EAE3C,OAAIH,GAAQI,EAAM,KAAK,WAAWJ,EAAO,MAAM,EAAG,GAAwB,EAAE,KAAK,CAAC,EAAE,EAChFG,EAAI,aAAaC,EAAM,KAAK,QAAQD,EAAI,WAAW,EAAE,EAElDC,EAAM,KAAK,UAAK,CACzB,EAoBaC,EAAN,cAA6B,KAAM,CAC/B,UACA,YAOA,cAET,YAAYR,EAAgBM,EAA4B,CACtD,MAAMD,GAAaL,EAAOM,CAAG,EAAG,CAAE,MAAAN,CAAM,CAAC,EACzC,KAAK,KAAO,iBACZ,KAAK,UAAYM,EAAI,UACrB,KAAK,YAAcA,EAAI,YACvB,KAAK,cAAgBA,EAAI,eAAiBP,EAAcC,CAAK,CAC/D,CACF,EC9FA,OAAOS,MAAU,YACjB,OAAOC,OAAa,eACpB,OAAS,KAAAC,MAAS,KCQlB,IAAMC,GAAa,0BAGbC,GAAmB,wBAGnBC,GAAW,6BAEXC,EAAwB,WACxBC,EAAwB,YACxBC,GAAoB,cAEpBC,GAAa,OAOnB,IAAMC,GAAsC,IAAI,IAAI,CAAC,MAAO,OAAQ,OAAQ,SAAU,UAAW,SAAS,CAAC,EAG9FC,EAAN,cAAsC,KAAM,CACjD,YAAYC,EAAiB,CAC3B,MAAMA,CAAO,EACb,KAAK,KAAO,yBACd,CACF,EAGaC,EAAN,cAAqC,KAAM,CAChD,YAAYD,EAAiB,CAC3B,MAAMA,CAAO,EACb,KAAK,KAAO,wBACd,CACF,EAEME,GAAkBC,GACfA,EAAM,WAAWC,EAAiB,EAAID,EAAM,MAAMC,GAAkB,MAAM,EAAID,EAGjFE,GAAc,CAACC,EAAeC,EAAeC,KAC1C,CACL,KAAM,UACN,OAAQ,CAAE,MAAAF,EAAO,MAAAC,EAAO,MAAAC,CAAM,EAC9B,IAAK,GAAGF,CAAK,IAAIC,CAAK,IAAIC,CAAK,EACjC,GASWC,EAAgBC,GAAuB,CAClD,GAAIA,EAAK,SAAW,EAClB,MAAM,IAAIX,EAAwB,4EAA4E,EAGhH,GAAIW,EAAK,OAAS,GAChB,MAAM,IAAIX,EACR,iBAAiBW,CAAI,QAAQA,EAAK,MAAM,iCAC1C,EAGF,GAAI,CAACC,GAAS,KAAKD,CAAI,EACrB,MAAM,IAAIX,EACR,iBAAiBW,CAAI,mGACvB,EAGF,GAAIZ,GAAe,IAAIY,CAAI,EACzB,MAAM,IAAIX,EACR,iBAAiBW,CAAI,kCAAkC,CAAC,GAAGZ,EAAc,EAAE,KAAK,IAAI,CAAC,GACvF,CAEJ,EAWac,EAAmBC,GAAqC,CACnE,IAAMC,EAAWZ,GAAeW,EAAO,KAAK,CAAC,EAE7C,GAAI,CAACC,EAAS,WAAWC,CAAqB,EAAG,OAAO,KAExD,GAAID,EAAS,WAAWE,CAAqB,EAAG,CAC9C,IAAMC,EAAaH,EAAS,MAAME,EAAsB,MAAM,EACxDE,EAAQC,GAAiB,KAAKF,CAAU,EAE9C,GAAIC,EACF,OAAOb,GAAY,OAAOa,EAAM,CAAC,CAAC,EAAG,OAAOA,EAAM,CAAC,CAAC,EAAG,OAAOA,EAAM,CAAC,CAAC,CAAC,CAE3E,CAEA,IAAME,EAAWN,EAAS,MAAMC,EAAsB,MAAM,EAE5D,GAAI,CACFN,EAAaW,CAAQ,CACvB,MAAQ,CACN,OAAO,IACT,CAEA,MAAO,CAAE,KAAM,OAAQ,KAAMA,EAAU,IAAKA,CAAS,CACvD,EAWaC,GAAmBlB,GAA6B,CAC3D,IAAMmB,EAAUnB,EAAM,KAAK,EAG3B,GAFwBD,GAAeoB,CAAO,EAE1B,WAAWP,CAAqB,EAAG,CACrD,IAAMQ,EAASX,EAAgBU,CAAO,EAEtC,GAAI,CAACC,EACH,MAAM,IAAItB,EACR,IAAIE,CAAK,2FACX,EAGF,OAAOoB,CACT,CAEA,IAAMC,EAAeC,GAAW,KAAKH,CAAO,EAE5C,GAAIE,EACF,OAAOnB,GAAY,OAAOmB,EAAa,CAAC,CAAC,EAAG,OAAOA,EAAa,CAAC,CAAC,EAAG,OAAOA,EAAa,CAAC,CAAC,CAAC,EAG9F,GAAIF,EAAQ,YAAY,IAAMI,GAC5B,MAAM,IAAIzB,EACR,gHACF,EAOF,GAAIqB,EAAQ,SAAS,GAAG,EACtB,MAAM,IAAIrB,EACR,iBAAiBE,CAAK,oJACxB,EAGF,GAAI,CACFM,EAAaa,CAAO,CACtB,OAASK,EAAK,CACZ,IAAMC,EAASD,aAAe,MAAQA,EAAI,QAAU,OAAOA,CAAG,EAE9D,MAAM,IAAI1B,EAAuB,iBAAiBE,CAAK,uBAAuByB,CAAM,EAAE,CACxF,CAEA,MAAO,CAAE,KAAM,OAAQ,KAAMN,EAAS,IAAKA,CAAQ,CACrD,EAGaO,GAAoBC,GAC3BA,EAAG,OAAS,UAAkB,GAAGd,CAAqB,GAAGc,EAAG,GAAG,GAE5D,GAAGf,CAAqB,GAAGe,EAAG,IAAI,GAO9BC,GAAgB,CAACD,EAAeE,IAAuC,CAClF,IAAMC,EAASD,IAAS,SAAW,SAAW,UAE9C,OAAIF,EAAG,OAAS,UAAkB,GAAGG,CAAM,KAAKH,EAAG,GAAG,GAE/C,GAAGG,CAAM,IAAIH,EAAG,IAAI,EAC7B,EAGaI,GAAiBJ,GACxBA,EAAG,OAAS,UAAkB,YAAYA,EAAG,GAAG,QAE7C,WAAWA,EAAG,IAAI,QAIdK,GAAkBL,GACzBA,EAAG,OAAS,UAAkB,IAAIA,EAAG,GAAG,GAErCA,EAAG,KAICM,GAAgBN,GACpBA,EAAG,IAICO,EAAmBxB,GAC1BA,GAAW,KAAqC,GAE7CD,EAAgBC,CAAM,IAAM,KAG/ByB,GAAUC,GAAoD,CAClE,GAAIA,IAAU,OAAW,OAAO,KAEhC,IAAMC,EAAOD,aAAiB,KAAOA,EAAM,QAAQ,EAAI,IAAI,KAAKA,CAAK,EAAE,QAAQ,EAE/E,OAAO,OAAO,MAAMC,CAAI,EAAI,KAAOA,CACrC,EASaC,GAAoB,CAC/BC,EACAC,EACAC,IACW,CACX,GAAIF,EAAE,OAAS,WAAaC,EAAE,OAAS,UACrC,OAAID,EAAE,OAAO,QAAUC,EAAE,OAAO,MAAcD,EAAE,OAAO,MAAQC,EAAE,OAAO,MACpED,EAAE,OAAO,QAAUC,EAAE,OAAO,MAAcD,EAAE,OAAO,MAAQC,EAAE,OAAO,MAEjED,EAAE,OAAO,MAAQC,EAAE,OAAO,MAGnC,GAAID,EAAE,OAAS,UAAW,MAAO,GACjC,GAAIC,EAAE,OAAS,UAAW,MAAO,GAEjC,IAAME,EAAQP,GAAOM,GAAO,CAAC,EACvBE,EAAQR,GAAOM,GAAO,CAAC,EAE7B,OAAIC,IAAU,MAAQC,IAAU,MAAQD,IAAUC,EACzCD,EAAQC,EAGbJ,EAAE,KAAOC,EAAE,KAAa,GACxBD,EAAE,KAAOC,EAAE,KAAa,EAErB,CACT,EDnOO,IAAMI,GAAgB,MAAOC,GAA0C,CAC5E,IAAMC,EAAS,MAAMC,EAAE,CAAE,IAAAF,CAAI,CAAC,iCAExBG,EAA2B,CAAC,EAC9BC,EAAgC,KAEpC,QAAWC,KAAQJ,EAAO,OAAO,MAAM;AAAA,CAAI,EAAG,CAC5C,GAAII,EAAK,WAAW,WAAW,EAAG,CAE5BD,GAASD,EAAQ,KAAKC,CAAO,EAEjCA,EAAU,CACR,KAAMC,EAAK,MAAM,CAAkB,EACnC,OAAQ,KACR,SAAU,GACV,KAAM,GACN,SAAU,GACV,OAAQ,EACV,EAEA,QACF,CAEKD,IAEDC,EAAK,WAAW,SAAS,EAC3BD,EAAQ,OAASC,EAAK,MAAM,CAAgB,EAAE,QAAQ,iBAAkB,EAAE,EACjEA,IAAS,WAClBD,EAAQ,SAAW,GACVC,IAAS,OAClBD,EAAQ,KAAO,GACNC,IAAS,UAAYA,EAAK,WAAW,SAAS,EACvDD,EAAQ,OAAS,IACRC,IAAS,YAAcA,EAAK,WAAW,WAAW,KAC3DD,EAAQ,SAAW,IAEvB,CAEA,OAAIA,GAASD,EAAQ,KAAKC,CAAO,EAE1BD,CACT,EAWaG,GAAsB,MAAOC,GAAmD,CAC3F,IAAMJ,EAAU,MAAMJ,GAAcS,GAAQ,IAAI,CAAC,EAE3CC,EAAWC,GACRH,IAAS,UAAYI,EAAgBD,CAAM,EAAIA,EAAO,WAAW,UAAU,EAGpF,OAAOP,EACJ,IAAKS,GACGA,EAAM,MACd,EACA,OAAQF,GACAA,IAAW,MAAQD,EAAQC,CAAM,CACzC,CACL,EAOMG,GAA0BC,GAAuC,CACrE,IAAMC,EAAMC,EAAcF,CAAK,EAE/B,OAAOC,GAAO,wBAAwB,KAAKA,CAAG,EAAI,uBAAyB,MAC7E,EAWME,GAAyB,CAAC,CAAE,UAAAC,CAAU,IAAsC,CAChF,GAAIC,EAAY,EACd,MAAO,uKAGT,IAAMC,EAAO,oFAEb,OAAOF,EAAY,GAAGE,CAAI,4EAA8EA,CAC1G,EAKaC,EAAiB,SAA6B,CACzD,GAAI,CAGF,OAFe,MAAMnB,EAAE,CAAE,MAAO,EAAK,CAAC,kCAExB,OAAO,KAAK,CAC5B,OAASY,EAAO,CACd,IAAMQ,EAAgBT,GAAuBC,CAAK,GAAKE,EAAcF,CAAK,EAE1E,MAAM,IAAIS,EAAeT,EAAO,CAC9B,UAAW,iCAAiCN,GAAQ,IAAI,CAAC,GACzD,cAAAc,EACA,YAAaL,GAAuB,CAAE,UAAWK,IAAkB,MAAU,CAAC,CAChF,CAAC,CACH,CACF,EAsBaE,EAAkB,MAAOxB,GAAkC,CACtE,IAAMyB,EAAOzB,GAAQ,MAAMqB,EAAe,EACpCK,GAAa,MAAMxB,EAAE,CAAE,IAAKuB,EAAM,MAAO,EAAK,CAAC,mCAAmC,OAAO,KAAK,EAC9FE,EAAWC,EAAK,QAAQH,EAAMC,CAAS,EAI7C,OAAIC,EAAS,SAAS,GAAGC,EAAK,GAAG,OAAOA,EAAK,GAAG,UAAUA,EAAK,GAAG,EAAE,EAAUH,EAEvEG,EAAK,QAAQD,CAAQ,CAC9B,EAKaE,GAAmB,UACf,MAAM3B,oCAEP,OAAO,KAAK,EAWf4B,GAAuB,UACnB,MAAM5B,2BAMP,OACX,MAAM;AAAA,CAAI,EACV,IAAKG,GACGA,EAAK,QAAQ,CACrB,EACA,OAAQA,GACAA,EAAK,KAAK,EAAE,OAAS,CAC7B,EAMQ0B,GAAqB,UACxB,MAAMD,GAAqB,GAAG,SAAW,EAYtCE,GAAyB,SAA8B,CAClE,IAAMhC,EAAM,MAAMqB,EAAe,EAE3B,CAACY,EAAcC,CAAe,EAAI,MAAM,QAAQ,IAAI,CACxDhC,EAAE,CAAE,IAAAF,CAAI,CAAC,oCACTE,EAAE,CAAE,IAAAF,CAAI,CAAC,iCACX,CAAC,EAEKmC,EAASF,EAAa,OAAO,KAAK,EAClCP,EAAYE,EAAK,QAAQ5B,EAAKkC,EAAgB,OAAO,KAAK,CAAC,EAEjE,OAAOC,IAAWT,CACpB,EAyBO,IAAMU,GAAe,MAAOC,IAClB,MAAMC,sBAAsBD,CAAM,IAEnC,OAAO,KAAK,EAAE,OAAS,EAY1BE,GAAoB,MAAOF,GAAkC,EACzD,MAAMC,sBAAsBD,CAAM,IAEtC,OAAO,KAAK,EAAE,SAAW,GAE/B,MAAMG,GAAiB,IAAOH,GAEnC,MAAMC,kBAAkBD,CAAM,EAChC,EAUaI,GAAqB,MAAOJ,GAAkC,EAC5D,MAAMC,iCAAiCD,CAAM,IAEjD,OAAO,KAAK,EAAE,SAAW,GAElC,MAAMC,6BAA6BD,CAAM,EAC3C,EE3TA,OAAS,KAAAK,MAAS,KAYX,IAAMC,GAAiB,MAAOC,EAAaC,IAAwC,CACxF,IAAMC,EAAY,GAAGD,CAAG,YAExB,GAAI,CAGF,OAFe,MAAME,EAAE,CAAE,IAAAH,EAAK,MAAO,EAAK,CAAC,mCAAmCE,CAAS,IAEzE,OAAO,KAAK,GAAK,IACjC,MAAQ,CACN,OAAO,IACT,CACF,EAeaE,GAAa,MAAOJ,EAAaK,EAAkBC,IAAyC,CACvG,GAAI,CACF,aAAMH,EAAE,CAAE,IAAAH,EAAK,MAAO,EAAK,CAAC,iCAAiCK,CAAQ,IAAIC,CAAU,GAE5E,EACT,OAASC,EAAO,CAGd,GAFkBA,EAAgC,WAEjC,EAAG,MAAO,GAE3B,MAAM,IAAIC,EAAeD,EAAO,CAC9B,UAAW,gBAAgBF,CAAQ,oBAAoBC,CAAU,GACjE,YAAa,8DACf,CAAC,CACH,CACF,EAGaG,GAAe,MAAOT,EAAaU,IAA2C,CAEzF,IAAMC,GADS,MAAMR,EAAE,CAAE,IAAAH,EAAK,MAAO,EAAK,CAAC,iCAAiCU,CAAM,IAC9D,OAAO,KAAK,EAAE,MAAM;AAAA,CAAI,EAAE,CAAC,EAE/C,OAAOC,EAAQA,EAAK,MAAM,KAAK,EAAE,CAAC,GAAK,KAAQ,IACjD,EA6BaC,GAAa,MAAOZ,EAAaa,IAAqD,CACjG,IAAMC,EAAWD,EAAK,IAAKZ,GAClB,GAAGA,EAAI,GAAG,eAAeA,EAAI,MAAM,EAC3C,EAED,GAAIa,EAAS,SAAW,EACtB,MAAO,CAAE,SAAAA,EAAU,OAAQ,EAAM,EAGnC,GAAI,CACF,aAAMX,EAAE,CAAE,IAAAH,EAAK,MAAO,EAAK,CAAC,6BAA6Bc,CAAQ,GAE1D,CAAE,SAAAA,EAAU,OAAQ,EAAK,CAClC,OAASP,EAAO,CACd,MAAO,CACL,SAAAO,EACA,OAAQ,GACR,OAASP,EAA8B,MACzC,CACF,CACF,EC7GA,OAAOQ,MAAU,YACjB,OAAOC,MAAa,eACpB,OAAS,KAAAC,MAAS,KAsCX,IAAMC,GAAsB,MAAOC,GAAkC,CAC1E,IAAMC,EAAOD,GAAOE,EAAQ,IAAI,EAC1BC,GAAa,MAAMC,EAAE,CAAE,IAAKH,EAAM,MAAO,EAAK,CAAC,mCAAmC,OAAO,KAAK,EAC9FI,EAAQH,EAAQ,IAAI,mBAAqB,OAAOA,EAAQ,GAAG,EAEjE,OAAOI,EAAK,KAAKA,EAAK,QAAQL,EAAME,CAAS,EAAG,YAAa,aAAaE,CAAK,EAAE,CACnF,EAGaE,GAAcC,GAClBA,EAAO,QAAQ,WAAY,GAAG,EAY1BC,GAAyB,CAACC,EAAqBF,IACnDF,EAAK,KAAK,GAAGI,CAAW,GAAGC,EAAoB,GAAIC,GAAiB,SAAUL,GAAWC,CAAM,CAAC,EAI5FK,EAAqB,MAAOb,GAAkC,CACzE,GAAI,CACF,aAAMI,EAAE,CAAE,IAAAJ,EAAK,MAAO,EAAK,CAAC,wCAErB,EACT,MAAQ,CACN,MAAO,EACT,CACF,EAYac,GAAyB,MAAOd,GAA+B,CAC1E,GAAI,MAAMa,EAAmBb,CAAG,EAC9B,MAAM,IAAIe,EAAe,OAAW,CAClC,UAAW,6BACX,cAAe,uDACf,YAAa,gFACf,CAAC,EAGH,IAAMC,GAAU,MAAMZ,EAAE,CAAE,IAAAJ,EAAK,MAAO,EAAK,CAAC,2BAA2B,OAAO,KAAK,EAEnF,GAAIgB,EAAO,OAAS,EAClB,MAAM,IAAID,EAAe,OAAW,CAClC,UAAW,6BACX,cAAe,8BAA8BC,EAAO,MAAM;AAAA,CAAI,EAAE,CAAC,CAAC,GAClE,YAAa,gFACf,CAAC,CAEL,EAcaC,GAAuB,MAAOjB,GAA+B,CACxE,IAAMkB,EAAM,MAAOC,GAA8C,CAC/D,GAAI,CACF,MAAMA,EAAG,CACX,MAAQ,CAER,CACF,EAEI,MAAMN,EAAmBb,CAAG,GAG9B,MAAMkB,EAAI,IACDd,EAAE,CAAE,IAAAJ,EAAK,MAAO,EAAK,CAAC,oBAC9B,EAGH,MAAMkB,EAAI,IACDd,EAAE,CAAE,IAAAJ,EAAK,MAAO,EAAK,CAAC,mBAC9B,EAID,MAAMkB,EAAI,IACDd,EAAE,CAAE,IAAAJ,EAAK,MAAO,EAAK,CAAC,gBAC9B,CACH,EAcaoB,GAAsB,MACjCC,EACAF,IACe,CACf,GAAM,CAAE,IAAAnB,EAAK,OAAAsB,EAAS,YAAa,EAAID,EACjCE,EAAe,MAAMxB,GAAoBC,CAAG,EAE5CwB,EAAM,SAA2B,CACrC,MAAMpB,EAAE,CAAE,IAAAJ,EAAK,MAAO,EAAK,CAAC,8BAA8BuB,CAAY,IAAID,CAAM,EAClF,EAEA,GAAI,CACF,MAAME,EAAI,CACZ,OAASC,EAAY,CACnB,GAAI,CACF,MAAMrB,EAAE,CAAE,IAAAJ,EAAK,MAAO,EAAK,CAAC,sBAC5B,MAAMwB,EAAI,CACZ,MAAQ,CACN,MAAM,IAAIT,EAAeU,EAAY,CACnC,UAAW,4CACX,YAAa,gCAAgCF,CAAY,cAC3D,CAAC,CACH,CACF,CAEA,IAAMG,EAA4B,CAChC,KAAMH,EACN,OAAQ,SAA2B,CACjC,GAAI,CACF,MAAMnB,EAAE,CAAE,IAAAJ,EAAK,MAAO,EAAK,CAAC,gCAAgCuB,CAAY,EAC1E,MAAQ,CAGR,CACF,CACF,EAEA,GAAI,CACF,OAAO,MAAMJ,EAAGO,CAAQ,CAC1B,QAAE,CACA,MAAMA,EAAS,OAAO,CACxB,CACF,ECzMA,OAAOC,OAAa,eACpB,OAAOC,OAAU,OACjB,OAAOC,OAAY,cAenB,IAAMC,GAAe,CACnB,QACA,UACA,eACA,iBACA,gBACA,kBACA,sBACA,uBACF,EAEaC,GAAgB,IAAM,CACjC,IAAMC,EAAWL,GAAQ,KAAK,SAAS,SAAS,EAAI,QAAU,OAExDM,EAAe,CAAC,OAAQ,MAAO,UAAU,EAE/C,OAAID,IAAa,SACfC,EAAa,KAAK,OAAO,EAGZL,GACb,CAAE,MAAOI,EAAU,OAAQF,EAAa,EACxCD,GAAO,CACL,YAAa,EACb,OAAQI,EAAa,KAAK,GAAG,EAC7B,SAAU,GAGV,KAAM,EACR,CAAC,CACH,CAGF,EAGaC,EAASH,GAAc,ECrDpC,OAAOI,MAAQ,mBACf,OAAOC,OAAQ,UACf,OAAOC,MAAU,YACjB,OAAOC,OAAa,eACpB,OAAS,KAAAC,MAAS,MCQX,IAAMC,EAAeC,GAAwB,CAClD,MAAM,IAAI,MAAM,qBAAqB,KAAK,UAAUA,CAAK,CAAC,EAAE,CAC9D,ECdO,IAAMC,EAAU,CAACC,EAAiCC,IAChD,OAAO,YACZ,OAAO,QAAQD,CAAM,EAAE,OAAO,CAAC,CAACE,CAAQ,IAC/BA,IAAaD,CACrB,CACH,ECEK,IAAME,EAAkB,CAAC,CAAE,IAAAC,EAAK,GAAAC,EAAI,KAAAC,CAAK,KACvC,CACL,GAAAD,EACA,KAAAC,EACA,MAAQC,GACAH,KAAOG,EAEN,CAAE,QAAS,GAAM,OAAQC,EAAQD,EAAQH,CAAG,CAAE,EAFxB,CAAE,QAAS,GAAO,OAAQG,CAAO,CAIlE,GCdK,IAAME,GAA2BC,EAAgB,CACtD,IAAK,WACL,GAAI,qBACJ,KAAM,2FACR,CAAC,ECJM,IAAMC,GAA8BC,EAAgB,CACzD,IAAK,cACL,GAAI,yBACJ,KAAM,yGACR,CAAC,ECJM,IAAMC,GAA+BC,EAAgB,CAC1D,IAAK,eACL,GAAI,wBACJ,KAAM,oIACR,CAAC,ECAD,IAAMC,GAAgDC,GAAW,CAC/D,IAAMC,EAAMD,EAAO,IAEnB,GAAIC,IAAQ,MAAQ,OAAOA,GAAQ,SACjC,MAAO,CAAE,QAAS,GAAO,OAAQD,CAAO,EAG1C,IAAIE,EAAU,GAERC,EAAcC,GAA4B,CAC9C,GAAIA,IAAU,MAAQ,OAAOA,GAAU,UAAY,EAAE,WAAYA,GAC/D,OAAOA,EAGT,IAAMC,EAAUD,EAA8B,OAE9C,OAAIC,IAAW,MAAQ,OAAOA,GAAW,UAAY,EAAE,SAAUA,GACxDD,GAGTF,EAAU,GAEH,CAAE,GAAIE,EAAmC,OAAQE,EAAQD,EAAmC,MAAM,CAAE,EAC7G,EAEME,EAAU,MAAM,QAAQN,CAAG,EAAIA,EAAI,IAAIE,CAAU,EAAIA,EAAWF,CAAG,EAEzE,OAAKC,EAIE,CAAE,QAAS,GAAM,OAAQ,CAAE,GAAGF,EAAQ,IAAKO,CAAQ,CAAE,EAHnD,CAAE,QAAS,GAAO,OAAQP,CAAO,CAI5C,EAEaQ,GAA+C,CAC1D,GAAI,wBACJ,KAAM,gBACN,MAAOT,EACT,ECzCA,IAAMU,GAAuB,MAEvBC,GAAqBC,GAEvBA,IAAU,MAAQ,OAAOA,GAAU,UAAaA,EAAiC,WAAaF,GAM5FG,GAAgDC,GAAW,CAC/D,IAAMC,EAAMD,EAAO,IAEnB,GAAI,MAAM,QAAQC,CAAG,EAAG,CACtB,IAAMC,EAAOD,EAAI,OAAQH,GAChB,CAACD,GAAkBC,CAAK,CAChC,EAED,OAAII,EAAK,SAAWD,EAAI,OAAe,CAAE,QAAS,GAAO,OAAQD,CAAO,EAEjE,CAAE,QAAS,GAAM,OAAQE,EAAK,OAAS,EAAI,CAAE,GAAGF,EAAQ,IAAKE,CAAK,EAAIC,EAAQH,EAAQ,KAAK,CAAE,CACtG,CAEA,OAAIH,GAAkBI,CAAG,EAAU,CAAE,QAAS,GAAM,OAAQE,EAAQH,EAAQ,KAAK,CAAE,EAE5E,CAAE,QAAS,GAAO,OAAQA,CAAO,CAC1C,EAEaI,GAA+C,CAC1D,GAAI,wBACJ,KAAM,6BACN,MAAOL,EACT,ECvBO,IAAMM,EAAgD,CAC3DC,GACAC,GACAC,GACAC,GACAC,EACF,ECTO,IAAMC,EAAyBC,GAC7BC,EAAkB,OACvB,CAACC,EAAKC,IAAc,CAClB,IAAMC,EAAOD,EAAU,MAAMD,EAAI,MAAM,EAEvC,OAAKE,EAAK,QAEH,CAAE,QAAS,GAAM,OAAQA,EAAK,OAAQ,MAAO,CAAC,GAAGF,EAAI,MAAOC,EAAU,IAAI,CAAE,EAFzDD,CAG5B,EACA,CAAE,QAAS,GAAO,OAAQF,EAAQ,MAAO,CAAC,CAAE,CAC9C,ECnBF,OAAOK,OAAQ,mBACf,OAAOC,OAAQ,UAiBR,IAAMC,GAAa,MAAOC,GAAuC,CACtE,GAAI,CACF,aAAMH,GAAG,OAAOG,CAAQ,EAEjB,EACT,MAAQ,CACN,MAAO,EACT,CACF,EAWaC,EAAWD,GAA6B,CACnD,IAAME,EAAOJ,GAAG,QAAQ,EAExB,OAAOE,EAAS,WAAWE,CAAI,EAAI,IAAIF,EAAS,MAAME,EAAK,MAAM,CAAC,GAAKF,CACzE,ECzCA,OAAS,eAAAG,OAAmB,cAC5B,OAAOC,MAAQ,mBACf,OAAOC,MAAU,YACjB,OAAOC,OAAa,eAUb,IAAMC,EAAN,cAAqC,KAAM,CAChD,YAAYC,EAAkB,CAC5B,MAAM,GAAGA,CAAQ,oCAAoC,EACrD,KAAK,KAAO,wBACd,CACF,EAeMC,GAAiB,EAGjBC,GAAgBC,GACb,eAAe,KAAKA,CAAG,IAAI,CAAC,GAAKF,GAKpCG,GAAkB,KAaXC,EAA0B,MAAO,CAC5C,KAAML,EACN,IAAAG,EACA,SAAAG,EACA,gBAAAC,CACF,IAAqD,CACnD,IAAMC,EAAS,MAAMC,EAAG,SAAST,CAAQ,EACnCU,EAAMC,EAAK,QAAQH,CAAM,EACzBI,EAAOD,EAAK,SAASH,CAAM,EAE3BK,EAAMF,EAAK,KAAKD,EAAK,IAAIE,CAAI,IAAIE,GAAQ,GAAG,IAAIC,GAAY,CAAC,EAAE,SAAS,KAAK,CAAC,MAAM,EACpFC,EAAU,GAAG,KAAK,UAAUV,EAAU,KAAMJ,GAAaC,CAAG,CAAC,CAAC;AAAA,EAEpE,GAAI,CACF,MAAMM,EAAG,UAAUI,EAAKG,EAAS,MAAM,EAIvC,IAAMC,EAAO,MAAMR,EAAG,KAAKD,CAAM,EAEjC,GAAIS,EAAK,UAAYV,EACnB,MAAM,IAAIR,EAAuBC,CAAQ,EAI3C,MAAMS,EAAG,MAAMI,EAAKI,EAAK,KAAOb,EAAe,EAC/C,MAAMK,EAAG,OAAOI,EAAKL,CAAM,CAC7B,OAASU,EAAK,CACZ,YAAMT,EAAG,GAAGI,EAAK,CAAE,MAAO,EAAK,CAAC,EAC1BK,CACR,CACF,EAEMC,GAAYC,GACTA,IAAU,MAAQ,OAAOA,GAAU,UAAY,CAAC,MAAM,QAAQA,CAAK,EAQ/DC,GAAoB,MAAOrB,GAAmD,CACzF,IAAMiB,EAAO,MAAMR,EAAG,KAAKT,CAAQ,EAC7BG,EAAM,MAAMM,EAAG,SAAST,EAAU,MAAM,EAE9C,GAAIG,EAAI,KAAK,IAAM,GACjB,MAAO,CAAE,QAAS,GAAO,OAAQ,CAAC,EAAG,MAAO,CAAC,EAAG,KAAMH,CAAS,EAGjE,IAAMsB,EAAkB,KAAK,MAAMnB,CAAG,EAEtC,GAAI,CAACgB,GAASG,CAAM,EAClB,MAAO,CAAE,QAAS,GAAO,OAAQ,CAAC,EAAG,MAAO,CAAC,EAAG,KAAMtB,CAAS,EAGjE,IAAMM,EAAWiB,EAAsBD,CAAM,EAE7C,OAAIhB,EAAS,SACX,MAAMD,EAAwB,CAAE,KAAML,EAAU,IAAAG,EAAK,SAAUG,EAAS,OAAQ,gBAAiBW,EAAK,OAAQ,CAAC,EAG1G,CAAE,GAAGX,EAAU,KAAMN,CAAS,CACvC,EC/EO,IAAMwB,EAAsB,MACjCC,EACAC,EACAC,EACA,CAAE,OAAAC,CAAO,IACuB,CAChC,GAAIH,EAAM,cAAgB,MACxB,MAAO,CAAE,KAAM,gBAAiB,EAGlC,IAAMI,EAAWC,EAAsBJ,CAAS,EAEhD,GAAI,CAACG,EAAS,QACZ,MAAO,CAAE,KAAM,gBAAiB,EAGlC,IAAME,EAASH,EAAO,UAAUC,EAAS,MAAM,EAE/C,GAAI,CAACE,EAAO,QACV,MAAO,CAAE,KAAM,gBAAiB,EAGlC,GAAIN,EAAM,UAAYO,EAAK,EACzB,MAAO,CAAE,KAAM,UAAW,EAG5B,GAAI,CACF,MAAMC,EAAwB,CAC5B,KAAMR,EAAM,KACZ,IAAAE,EACA,SAAUE,EAAS,OACnB,gBAAiBJ,EAAM,OACzB,CAAC,CACH,OAASS,EAAK,CACZ,OAAAC,EAAO,MAAMD,EAAK,oCAAoCT,EAAM,IAAI,EAAE,EAE3D,CAAE,KAAM,gBAAiB,CAClC,CAEA,OAAAU,EAAO,KACL,YAAYC,EAAQX,EAAM,IAAI,CAAC,aAAaI,EAAS,MAAM,KAAK,OAAO,CAAC,0BAA0BQ,GAAY,OAAO,GACvH,EAEO,CAAE,KAAM,WAAY,KAAMN,EAAO,IAAgC,CAC1E,EbtEA,IAAMO,GAAwB,iBAM9B,IAAMC,GAA0B,iBAC1BC,GAAoB,WAGpBC,GAA6BC,EAAE,OAAO,CAC1C,SAAUA,EAAE,QAAQ,SAAS,EAC7B,OAAQA,EAAE,OAAO,CACf,KAAMA,EAAE,OAAO,EAAE,IAAI,CAAC,CACxB,CAAC,CACH,CAAC,EAEKC,GAAsBD,EAAE,mBAAmB,WAAY,CAACD,EAA0B,CAAC,EASnFG,GAAwBF,EAC3B,OAAO,CACN,oBAAqBA,EAAE,OAAO,EAAE,IAAI,CAAC,CACvC,CAAC,EACA,OAAO,EAEJG,GAAkBH,EACrB,OAAO,CACN,SAAUA,EAAE,QAAQ,QAAQ,EAC5B,OAAQE,EACV,CAAC,EACA,OAAO,EAKJE,GAAYJ,EAAE,mBAAmB,WAAY,CAACG,EAAe,CAAC,EAO9DE,GAAaL,EAAE,MAAM,CAACI,GAAWJ,EAAE,MAAMI,EAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAW3DE,GAAwBN,EAAE,OAAO,CACrC,SAAUA,EAAE,QAAQ,MAAM,EAC1B,OAAQA,EAAE,OAAO,CACf,QAASA,EAAE,OAAO,EAAE,IAAI,EACxB,UAAWA,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CACvC,CAAC,CACH,CAAC,EAEKO,GAAoBP,EAAE,mBAAmB,WAAY,CAACM,EAAqB,CAAC,EAO5EE,GAAc,CAAC,cAAe,YAAY,EAE1CC,GAAmBT,EACtB,OAAO,CACN,OAAQA,EAAE,KAAKQ,EAAW,EAAE,SAAS,CACvC,CAAC,EACA,OAAO,EAIJE,GAAwBV,EAC3B,OAAO,CACN,oBAAqBA,EAAE,QAAQ,EAAE,SAAS,EAC1C,WAAYA,EAAE,QAAQ,EAAE,SAAS,EACjC,KAAMS,GAAiB,SAAS,CAClC,CAAC,EACA,OAAO,EAQJE,GAAqBX,EACxB,OAAO,CACN,KAAMA,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAC3C,UAAWA,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,CACxC,CAAC,EACA,OAAO,EAEJY,GAAkBZ,EAAE,OAAOA,EAAE,OAAO,EAAE,IAAI,CAAC,EAAGW,EAAkB,EAYhEE,GAAoBb,EAAE,KAAK,CAAC,QAAS,OAAO,CAAC,EAE7Cc,GAAqBd,EACxB,OAAO,CAEN,UAAWA,EAAE,QAAQ,EAAE,SAAS,EAEhC,MAAOA,EAAE,OAAOA,EAAE,OAAO,EAAE,IAAI,CAAC,EAAGa,EAAiB,EAAE,SAAS,CACjE,CAAC,EACA,OAAO,EAEJE,GAAkBf,EACrB,OAAO,CAEN,KAAMA,EAAE,OAAOA,EAAE,OAAO,EAAE,IAAI,CAAC,EAAGc,EAAkB,EAAE,SAAS,EAE/D,KAAMd,EAAE,QAAQ,EAAE,SAAS,CAC7B,CAAC,EACA,OAAO,EAEJgB,GAAmBhB,EAAE,OAAOA,EAAE,OAAO,EAAE,IAAI,CAAC,EAAGe,EAAe,EA2C9DE,GAAsBjB,EAAE,KAAK,CAAC,WAAY,QAAS,UAAU,CAAC,EAI9DkB,GAAalB,EAAE,OAAO,EAAE,MAAM,eAAgB,2CAA2C,EAazFmB,GAAiBnB,EACpB,OAAO,CACN,QAASA,EAAE,OAAO,EAAE,IAAI,CAAC,EACzB,KAAMA,EAAE,MAAMA,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC,EACpC,IAAKA,EAAE,MAAMkB,EAAU,EAAE,IAAI,CAAC,EAC9B,MAAOlB,EAAE,MAAMkB,EAAU,EAAE,QAAQ,CAAC,CAAC,CACvC,CAAC,EACA,OAAO,EACP,YAAY,CAACE,EAAMC,IAAQ,CAC1B,QAAWC,KAAQF,EAAK,IAClBG,GAA0B,IAAID,CAAI,GACpCD,EAAI,SAAS,CACX,KAAM,SACN,KAAM,CAAC,KAAK,EACZ,QAAS,IAAIC,CAAI,+FACnB,CAAC,CAGP,CAAC,EAUGE,GAAmBxB,EAAE,OACzBA,EACG,OAAO,EACP,MAAM,oBAAqB,uEAAuE,EAClG,OACEsB,GACQ,CAACA,EAAK,SAAS,WAAW,EAEnC,CACE,QACE,+GACJ,CACF,EACFH,EACF,EAGMM,GAAyBzB,EAC5B,OAAO,EACP,IAAI,CAAC,EACL,YAAY,CAAC0B,EAAOL,IAAQ,CAC3B,GAAIK,EAAM,WAAW,GAAG,GAAKA,EAAM,WAAW,IAAI,GAAK,WAAW,KAAKA,CAAK,EAAG,CAC7EL,EAAI,SAAS,CAAE,KAAM,SAAU,QAAS,IAAIK,CAAK,2CAA4C,CAAC,EAE9F,MACF,CAEA,IAAMC,EAAWD,EAAM,MAAM,OAAO,EAAE,OAAQE,GACrCA,IAAY,IAAMA,IAAY,GACtC,EAEGD,EAAS,SAAS,IAAI,GACxBN,EAAI,SAAS,CAAE,KAAM,SAAU,QAAS,IAAIK,CAAK,mCAAoC,CAAC,EAIpFC,EAAS,CAAC,IAAM,QAClBN,EAAI,SAAS,CAAE,KAAM,SAAU,QAAS,IAAIK,CAAK,wCAAyC,CAAC,EAKzFA,EAAM,SAAS,IAAI,GACrBL,EAAI,SAAS,CAAE,KAAM,SAAU,QAAS,IAAIK,CAAK,2CAA4C,CAAC,EAGhG,IAAMG,EAAcH,EAAM,MAAM,GAAG,EAE/BG,EAAY,SAAS,EAAE,GACzBR,EAAI,SAAS,CAAE,KAAM,SAAU,QAAS,IAAIK,CAAK,2CAA4C,CAAC,EAG5FG,EAAY,SAAS,GAAG,GAC1BR,EAAI,SAAS,CACX,KAAM,SACN,QAAS,IAAIK,CAAK,4FACpB,CAAC,CAEL,CAAC,EAEGI,GAAwB9B,EAC3B,OAAO,CACN,KAAMyB,GACN,OAAQA,GAAuB,SAAS,CAC1C,CAAC,EACA,OAAO,EAMGM,GAAqB/B,EAC/B,OAAO,CACN,KAAMA,EAAE,MAAM8B,EAAqB,EAAE,IAAI,CAAC,EAE1C,QAAS9B,EAAE,MAAMA,EAAE,OAAO,EAAE,MAAM,YAAa,4CAA4C,CAAC,EAAE,SAAS,CACzG,CAAC,EACA,OAAO,EAMJgC,GAAmBhC,EACtB,OAAO,CACN,gBAAiBA,EAAE,MAAMA,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS,EACrD,cAAeA,EAAE,MAAMA,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS,EACnD,MAAOA,EACJ,OAAO,CACN,cAAeA,EAAE,MAAMA,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS,CACrD,CAAC,EACA,OAAO,EACP,SAAS,CACd,CAAC,EACA,OAAO,EAEGiC,GAAuBjC,EACjC,OAAO,CACN,cAAeC,GACf,IAAKI,GAAW,SAAS,EACzB,YAAaE,GAAkB,SAAS,EACxC,UAAWG,GAAsB,SAAS,EAC1C,IAAKE,GAAgB,SAAS,EAC9B,kBAAmBI,GAAiB,SAAS,EAC7C,cAAeC,GAAoB,SAAS,EAC5C,IAAKO,GAAiB,SAAS,EAC/B,aAAcO,GAAmB,SAAS,EAAE,SAAS,EACrD,MAAOC,GAAiB,SAAS,CACnC,CAAC,EACA,OAAO,EAeGE,GAAyB,IAOzBC,GAAuBF,GAAqB,YAAY,CAACG,EAAKf,IAAQ,CACjF,GAAI,CAAC,MAAM,QAAQe,EAAI,GAAG,EAAG,OAE7B,IAAMC,EAAO,IAAI,IAEjB,QAAWC,KAASF,EAAI,IAAK,CAC3B,GAAIC,EAAK,IAAIC,EAAM,QAAQ,EAAG,CAC5BjB,EAAI,SAAS,CACX,KAAM,SACN,QAAS,4CACT,KAAM,CAAC,KAAK,CACd,CAAC,EAED,MACF,CAEAgB,EAAK,IAAIC,EAAM,QAAQ,CACzB,CACF,CAAC,EAEYC,EAA+BN,GAAqB,QAAQ,EA4C5DO,GAAyBC,GAA4C,CAChF,IAAMC,EAAMD,EAAO,IAEnB,OAAKC,EAEE,MAAM,QAAQA,CAAG,EAAIA,EAAM,CAACA,CAAG,EAFrB,CAAC,CAGpB,EAMaC,GAAkC,cAWlCC,GAAqBH,GACzBA,EAAO,WAAW,MAAM,QAAUE,GAuBvCE,EAA4B,KAc5BC,EAAsC,KAUpCC,GAAgB,IACb,GAAGC,GAAQ,IAAI,CAAC,IAAIC,GAAG,QAAQ,CAAC,GAUnCC,GAAuB,IACpBC,EAAK,KAAKF,GAAG,QAAQ,EAAGG,CAAoB,EAYxCC,GAA8B,IAClCF,EAAK,KAAKD,GAAqB,EAAGrD,EAAuB,EA0BrDyD,GAAyB,SAA0C,CAC9E,IAAMC,EAAMR,GAAc,EAE1B,GAAID,GAAeA,EAAY,MAAQS,EACrC,OAAOT,EAAY,MAGrB,IAAMU,EAAc,MAAMC,EAAe,EAOnCC,EAAe,MAAMC,EAAgBH,CAAW,EAChDI,EAAcT,EAAK,SAASO,CAAY,EAExChC,EAA6B,CACjC,KAAMyB,EAAK,KAAKK,EAAaK,EAAqB,EAClD,WAAYR,GAA4B,EACxC,YAAaF,EAAK,KAAKD,GAAqB,EAAGpD,GAAmB8D,EAAaC,EAAqB,EACpG,YAAAD,CACF,EAGA,OAAAd,EAAc,CAAE,IAAAS,EAAK,MAAA7B,CAAM,EAEpBA,CACT,EAsBaoC,GAAoB,MAAOC,EAAoC,CAAC,IAA+B,CAC1G,IAAMC,EAAcD,EAAQ,aAAe,QACrCR,EAAMR,GAAc,EACpBkB,EAAQ,MAAMX,GAAuB,EAEvCY,EAEJ,GAAI,CACFA,EAAW,MAAMC,EAAG,KAAKF,EAAM,IAAI,CACrC,MAAQ,CACNpB,EAAS,KAIT,IAAMuB,EAAgBH,EAAM,KAAK,QAAQ,UAAW,MAAM,EAE1D,MAAI,MAAMI,EAAaD,CAAa,EAC5B,IAAI,MACR,+BAA+BH,EAAM,IAAI,4FAC3C,EAGI,IAAI,MACRK,EAAY,EACR,+BAA+BL,EAAM,IAAI,mJACzC,+BAA+BA,EAAM,IAAI,8LAC/C,CACF,CAEA,GAAM,CAACM,EAAgBC,CAAe,EAAI,MAAM,QAAQ,IAAI,CAC1DH,EAAaJ,EAAM,UAAU,EAC7BI,EAAaJ,EAAM,WAAW,CAChC,CAAC,EAEKQ,EAAS,CACb,KAAM,OAAOP,EAAS,OAAO,EAC7B,WAAYK,EAAiB,OAAOA,EAAe,OAAO,EAAI,KAC9D,YAAaC,EAAkB,OAAOA,EAAgB,OAAO,EAAI,IACnE,EAEA,GAAI3B,GAAUA,EAAO,MAAQU,GAAOmB,GAAa7B,EAAO,OAAQ4B,CAAM,EACpE,OAAO5B,EAAO,MAGhB,IAAM8B,EAAwB,CAC5B,CAAE,MAAO,iBAAkB,KAAMV,EAAM,KAAM,SAAU,GAAM,YAAAD,EAAa,QAASS,EAAO,IAAK,EAC/F,CACE,MAAO,8BACP,KAAMR,EAAM,WACZ,SAAU,GACV,YAAAD,EACA,QAASS,EAAO,UAClB,EACA,CACE,MAAO,yBAAyBR,EAAM,WAAW,kBACjD,KAAMA,EAAM,YACZ,SAAU,GACV,YAAAD,EACA,QAASS,EAAO,WAClB,CACF,EAEIG,EAAkC,CAAC,EAEvC,QAAWC,KAASF,EAAQ,CAC1B,IAAMG,GAAO,MAAMC,GAAUF,CAAK,EAE9BC,KAAS,OAEbF,EAAS,CAAE,GAAGA,EAAQ,GAAGE,EAAK,EAChC,CAEA,IAAME,EAAc7C,GAAqB,UAAUyC,CAAM,EAEzD,GAAI,CAACI,EAAY,QACf,MAAM,IAAI,MAAM,oCAAoChF,EAAE,cAAcgF,EAAY,KAAK,CAAC,EAAE,EAK1F,OAAAnC,EAAS,CAAE,IAAAU,EAAK,OAAAkB,EAAQ,MAAOO,EAAY,IAAK,EAEzCA,EAAY,IACrB,EAmBaC,GAAyB,IAAY,CAChDpC,EAAS,IACX,EAWaqC,GAA2B,IAAY,CAClDrC,EAAS,KACTC,EAAc,IAChB,EASMuB,EAAe,MAAOc,GAA0E,CACpG,GAAI,CACF,OAAO,MAAMhB,EAAG,KAAKgB,CAAQ,CAC/B,MAAQ,CACN,OAAO,IACT,CACF,EASMC,GAAe,MAAOD,GAA6C,CACvE,GAAI,CACF,OAAO,MAAMhB,EAAG,SAASgB,EAAU,OAAO,CAC5C,MAAQ,CACN,OAAO,IACT,CACF,EAWMT,GAAe,CAAoCW,EAAMC,IAAkB,CAC/E,IAAMC,EAAO,OAAO,KAAKF,CAAC,EAE1B,OAAIE,EAAK,SAAW,OAAO,KAAKD,CAAC,EAAE,OAAe,GAE3CC,EAAK,MAAOC,GACVH,EAAEG,CAAC,IAAMF,EAAEE,CAAC,CACpB,CACH,EA+BaC,GAAiBC,GACrB,IAAI,MACT,GAAGA,EAAM,OAAO;AAAA,qHAClB,EAoBIX,GAAY,MAAOF,GAAgE,CACvF,IAAMc,EAAM,MAAMP,GAAaP,EAAM,IAAI,EAEzC,GAAIc,IAAQ,KAAM,CAChB,GAAId,EAAM,SACR,MAAM,IAAI,MAAM,GAAGA,EAAM,KAAK,iBAAiBA,EAAM,IAAI,EAAE,EAG7D,OAAO,IACT,CAEA,IAAIe,EAEJ,GAAI,CACFA,EAAYD,EAAI,KAAK,IAAM,GAAK,CAAC,EAAI,KAAK,MAAMA,CAAG,CACrD,OAASE,EAAK,CACZ,MAAM,IAAI,MAAM,mBAAmBhB,EAAM,KAAK,OAAOA,EAAM,IAAI,KAAMgB,EAAc,OAAO,EAAE,CAC9F,CAOA,GAAIC,EAASF,CAAS,GAAK,cAAeA,EACxC,MAAM,IAAI,MAAMG,GAA+BlB,CAAK,CAAC,EAGnD,CAACA,EAAM,UAAYiB,EAASF,CAAS,GACvCI,GAA6BnB,EAAOe,CAAS,EAG/C,IAAMK,EAAS1D,EAA6B,UAAUqD,CAAS,EAE/D,GAAIK,EAAO,QACT,OAAOA,EAAO,KAGhB,IAAMC,EAAgB,IAAI,MAAM,WAAWrB,EAAM,KAAK,OAAOA,EAAM,IAAI,KAAK7E,EAAE,cAAciG,EAAO,KAAK,CAAC,EAAE,EAM3G,GAAI,CAACH,EAASF,CAAS,GAAKf,EAAM,UAAY,KAC5C,MAAMqB,EAGR,IAAMC,EAAU,MAAMC,EAAoB,CAAE,GAAGvB,EAAO,QAASA,EAAM,OAAQ,EAAGe,EAAWD,EAAK,CAC9F,OAAQpD,CACV,CAAC,EAED,OAAQ4D,EAAQ,KAAM,CACpB,IAAK,WACH,OAAOA,EAAQ,KACjB,IAAK,WACH,MAAMV,GAAcS,CAAa,EACnC,IAAK,iBACH,MAAMA,EACR,QACE,OAAOG,EAAYF,CAAO,CAC9B,CACF,EAOaG,GAAiCzB,GACrC,CACL,2BAA2BA,EAAM,KAAK,KAAKA,EAAM,IAAI,+GACrD,0EACA,2FACA,oGACA,+HACF,EAAE,KAAK;AAAA,CAAI,EAGP0B,GAA0C1B,GACvC,CACL,oCAAoCA,EAAM,KAAK,KAAKA,EAAM,IAAI,kQAC9D,mFACF,EAAE,KAAK;AAAA,CAAI,EAGP2B,GAAmC3B,GAChC,CACL,6BAA6BA,EAAM,KAAK,KAAKA,EAAM,IAAI,yHACvD,mEACF,EAAE,KAAK;AAAA,CAAI,EAWP4B,GAAkF,CACtF,IAAKH,GACL,aAAcC,GACd,MAAOC,EACT,EAIMR,GAA+B,CACnCnB,EACAe,IACS,CACT,OAAW,CAACrC,EAAKmD,CAAY,IAAK,OAAO,QAAQD,EAAuB,EACtE,GAAIlD,KAAOqC,EACT,MAAM,IAAI,MAAMc,EAAa7B,CAAK,CAAC,CAGzC,EAWMiB,EAAYpE,GACT,OAAOA,GAAU,UAAYA,IAAU,MAAQ,CAAC,MAAM,QAAQA,CAAK,EAYtEqE,GAAkClB,GAC/B,CACL,oBAAoBA,EAAM,KAAK,6CAC/B,0FACA,uEACA,0CAA0CA,EAAM,IAAI,IACpD,4DACA,iGACF,EAAE,KAAK;AAAA,CAAI,Ecj7BN,IAAM8B,GAAN,cAAqCC,CAAe,CAChD,kBACA,SAET,YAAYC,EAA6CC,EAAiBC,EAAgC,CACxG,MAAM,OAAWA,CAAO,EACxB,KAAK,KAAO,yBACZ,KAAK,kBAAoBF,EACzB,KAAK,SAAWC,CAClB,CACF",
-  "names": ["process", "process", "jsonOutput", "emit", "result", "write", "text", "addJsonOption", "cmd", "option", "agentMode", "isAgentMode", "isHeadless", "jsonOutput", "isCI", "process", "resolveAgentModeSource", "env", "stdinIsTTY", "flag", "agentVar", "extractStderr", "cause", "seen", "current", "stderr", "stderrExcerpt", "buildMessage", "ctx", "parts", "OperationError", "path", "process", "$", "VERSION_RE", "BRANCH_SEMVER_RE", "KEBAB_RE", "RELEASE_BRANCH_PREFIX", "VERSION_BRANCH_PREFIX", "REFS_HEADS_PREFIX", "NEXT_TOKEN", "RESERVED_NAMES", "InvalidReleaseNameError", "message", "InvalidReleaseRefError", "stripRefsHeads", "input", "REFS_HEADS_PREFIX", "makeVersion", "major", "minor", "patch", "validateName", "name", "KEBAB_RE", "parseBranchName", "branch", "stripped", "RELEASE_BRANCH_PREFIX", "VERSION_BRANCH_PREFIX", "semverPart", "match", "BRANCH_SEMVER_RE", "namePart", "parseReleaseRef", "trimmed", "parsed", "versionMatch", "VERSION_RE", "NEXT_TOKEN", "err", "reason", "formatBranchName", "id", "formatPrTitle", "type", "prefix", "formatRcTitle", "formatJiraName", "displayLabel", "isReleaseBranch", "toTime", "value", "time", "compareReleaseIds", "a", "b", "dates", "timeA", "timeB", "listWorktrees", "cwd", "output", "$", "entries", "current", "line", "getCurrentWorktrees", "type", "process", "matches", "branch", "isReleaseBranch", "entry", "normalizeGitRootStderr", "error", "raw", "extractStderr", "projectRootRemediation", "hasStderr", "isAgentMode", "base", "getProjectRoot", "stderrExcerpt", "OperationError", "getMainRepoRoot", "root", "commonDir", "resolved", "path", "getCurrentBranch", "getWorkingTreeStatus", "isWorkingTreeClean", "isInsideLinkedWorktree", "gitDirResult", "commonDirResult", "gitDir", "branchExists", "branch", "$", "deleteLocalBranch", "getCurrentBranch", "deleteRemoteBranch", "$", "revParseVerify", "cwd", "ref", "commitish", "$", "isAncestor", "ancestor", "descendant", "error", "OperationError", "lsRemoteHead", "branch", "line", "pushAtomic", "refs", "refspecs", "path", "process", "$", "scratchWorktreePath", "cwd", "root", "process", "commonDir", "$", "runId", "path", "branchSlug", "branch", "resolutionWorktreePath", "projectRoot", "WORKTREES_DIR_SUFFIX", "WORKTREE_SUBDIRS", "hasMergeInProgress", "assertPristineWorktree", "OperationError", "status", "resetScratchWorktree", "run", "fn", "withScratchWorktree", "args", "anchor", "worktreePath", "add", "firstError", "worktree", "process", "pino", "pretty", "REDACT_PATHS", "initLoggerCLI", "logLevel", "ignoreFields", "logger", "fs", "os", "path", "process", "z", "assertNever", "value", "omitKey", "record", "key", "entryKey", "dropTopLevelKey", "key", "id", "note", "parsed", "omitKey", "dropDevProxyKeyMigration", "dropTopLevelKey", "dropEnvAutoLoadKeyMigration", "dropTopLevelKey", "dropEnvironmentsKeyMigration", "dropTopLevelKey", "stripLegacyIdeMode", "parsed", "ide", "changed", "stripEntry", "entry", "config", "omitKey", "nextIde", "stripLegacyIdeModeMigration", "RETIRED_IDE_PROVIDER", "isRetiredIdeEntry", "entry", "stripRetiredZedIde", "parsed", "ide", "kept", "omitKey", "stripRetiredZedIdeMigration", "CONFIG_MIGRATIONS", "stripLegacyIdeModeMigration", "stripRetiredZedIdeMigration", "dropEnvironmentsKeyMigration", "dropDevProxyKeyMigration", "dropEnvAutoLoadKeyMigration", "applyConfigMigrations", "parsed", "CONFIG_MIGRATIONS", "acc", "migration", "step", "fs", "os", "fileExists", "filePath", "tildify", "home", "randomBytes", "fs", "path", "process", "ConfigFileChangedError", "filePath", "DEFAULT_INDENT", "detectIndent", "raw", "PERMISSION_BITS", "writeMigratedConfigFile", "migrated", "expectedMtimeMs", "target", "fs", "dir", "path", "base", "tmp", "process", "randomBytes", "content", "stat", "err", "isRecord", "value", "migrateConfigFile", "parsed", "applyConfigMigrations", "tryAutoMigrateLayer", "layer", "parsedRaw", "raw", "schema", "migrated", "applyConfigMigrations", "second", "isCI", "writeMigratedConfigFile", "err", "logger", "tildify", "package_default", "INFRA_KIT_CONFIG_FILE", "USER_GLOBAL_CONFIG_FILE", "USER_PROJECTS_DIR", "dopplerEnvManagementSchema", "z", "envManagementSchema", "cursorIdeConfigSchema", "cursorIdeSchema", "ideSchema", "idesSchema", "jiraTaskManagerSchema", "taskManagerSchema", "orcaLayouts", "orcaConfigSchema", "worktreesConfigSchema", "devAppConfigSchema", "devConfigSchema", "proxySourceSchema", "devPresetAppSchema", "devPresetSchema", "devPresetsSchema", "protectedEnvsSchema", "envVarName", "mcpProxySchema", "spec", "ctx", "name", "PROTECTED_CHILD_ENV_NAMES", "mcpProxiesSchema", "repoRelativePathSchema", "value", "segments", "segment", "rawSegments", "vendorCopyEntrySchema", "vendorSourceSchema", "auditRulesSchema", "infraKitConfigObject", "DEFAULT_DEV_PROXY_PORT", "infraKitConfigSchema", "cfg", "seen", "entry", "infraKitOverrideConfigSchema", "resolveConfiguredIdes", "config", "ide", "DEFAULT_ORCA_LAYOUT", "resolveOrcaLayout", "cached", "cachedPaths", "pathsCacheKey", "process", "os", "resolveUserConfigDir", "path", "USER_CONFIG_DIR_NAME", "resolveUserGlobalConfigPath", "getInfraKitConfigPaths", "key", "projectRoot", "getProjectRoot", "mainRepoRoot", "getMainRepoRoot", "projectName", "INFRA_KIT_CONFIG_FILE", "getInfraKitConfig", "options", "autoMigrate", "paths", "mainStat", "fs", "legacyYmlPath", "statIfExists", "isAgentMode", "userGlobalStat", "userProjectStat", "mtimes", "shallowEqual", "layers", "merged", "layer", "data", "loadLayer", "finalResult", "resetMergedConfigCache", "resetInfraKitConfigCache", "filePath", "readIfExists", "a", "b", "keys", "k", "withSetupHint", "error", "raw", "parsedRaw", "err", "isRecord", "buildEnvTokensRejectionMessage", "assertNoProjectLayerOnlyKeys", "result", "originalError", "outcome", "tryAutoMigrateLayer", "assertNever", "buildMcpLayerRejectionMessage", "buildVendorSourceLayerRejectionMessage", "buildAuditLayerRejectionMessage", "PROJECT_LAYER_ONLY_KEYS", "buildMessage", "StructuredRefusalError", "OperationError", "structuredContent", "exitCode", "context"]
+  "sourcesContent": ["/**\n * @fileoverview\n * Agent-mode flag for the CLI: \"no human is at the other end of stdin\". Anything that would read\n * keystrokes (raw `data` listeners, Ink screens, `@inquirer` prompts) must be gated off, and any\n * guard that exists because an agent needs a human's say-so keys on it.\n *\n * Two sources, and they are not interchangeable \u2014 the source is kept, not just the boolean, so a\n * refusal can word itself for the caller it actually has:\n * - `'flag'`: the global `--agent` option. Beats every environment value, `INFRA_KIT_AGENT=0`\n *   included \u2014 a skill that passes `--agent` must never be silently demoted by a variable in\n *   someone's `.zshenv`.\n * - `'env'`: `INFRA_KIT_AGENT=1`, or `CLAUDECODE` set with a non-TTY stdin. The TTY qualifier is the\n *   point: `CLAUDECODE=1` is inherited by every process Claude Code spawns, including the Orca\n *   terminals `worktrees add` opens, and those are humans at a PTY. `INFRA_KIT_AGENT=0` suppresses\n *   only that heuristic; any other value is ignored as if unset.\n *\n * `process.stdin.isTTY` alone is not the agent signal: a non-TTY stdin is also every zsh `$(\u2026)`\n * capture and CI job, and `--agent` from a terminal has a TTY \u2014 hence the declared flag plus the\n * `CLAUDECODE` \u2227 non-TTY conjunction.\n */\nimport process from 'node:process'\n\nimport { jsonOutput } from 'src/lib/json-output'\n\nexport type AgentModeSource = 'flag' | 'env' | null\n\n/** Mutable holder (object so `prefer-const` holds while the source toggles per run). */\nexport const agentMode = { source: null as AgentModeSource }\n\n/** True when an agent, not a human, is driving this process \u2014 whichever source said so. */\nexport const isAgentMode = (): boolean => {\n  return agentMode.source !== null\n}\n\n/**\n * True when nobody can answer a prompt: an agent is driving, or `--json` has claimed stdout for a\n * machine. Every confirm and picker site keys on this one predicate so the 20-odd sites agree; the\n * few that also care WHICH source read `agentMode.source` next to it.\n */\nexport const isHeadless = (): boolean => {\n  return isAgentMode() || jsonOutput.enabled\n}\n\n/**\n * True on a CI runner (every major one exports `CI`). The config loader withholds its layer-1\n * rewrite there, because a tracked file changed on an ephemeral checkout is lost with the job \u2014\n * the fix has to be committed on the branch instead. Not an agent signal: CI has no human either,\n * but `isAgentMode` keys on who is DRIVING, not where it runs.\n */\nexport const isCI = (): boolean => {\n  return Boolean(process.env.CI)\n}\n\nexport interface ResolveAgentModeInput {\n  env: NodeJS.ProcessEnv\n  stdinIsTTY: boolean\n  /** The global `--agent` option as Commander parsed it. */\n  flag: boolean\n}\n\n/**\n * Pure precedence over the two sources. Called once per run from `program.hook('preAction')`.\n *\n * @example\n * resolveAgentModeSource({ env: { INFRA_KIT_AGENT: '0' }, stdinIsTTY: true, flag: true }) // 'flag'\n * resolveAgentModeSource({ env: { INFRA_KIT_AGENT: '1' }, stdinIsTTY: true, flag: false }) // 'env'\n * resolveAgentModeSource({ env: { CLAUDECODE: '1' }, stdinIsTTY: false, flag: false }) // 'env'\n * resolveAgentModeSource({ env: { CLAUDECODE: '1', INFRA_KIT_AGENT: '0' }, stdinIsTTY: false, flag: false }) // null\n * resolveAgentModeSource({ env: { CLAUDECODE: '1' }, stdinIsTTY: true, flag: false }) // null\n */\nexport const resolveAgentModeSource = ({ env, stdinIsTTY, flag }: ResolveAgentModeInput): AgentModeSource => {\n  if (flag) return 'flag'\n\n  const agentVar = env.INFRA_KIT_AGENT\n\n  if (agentVar === '1') return 'env'\n\n  const claudeCodeHeuristic = env.CLAUDECODE !== undefined && !stdinIsTTY && agentVar !== '0'\n\n  return claudeCodeHeuristic ? 'env' : null\n}\n", "import type { Command } from 'commander'\nimport process from 'node:process'\n\n/**\n * `--json` output mode for the CLI. This is a presentation concern only: every\n * command handler already returns a `structuredContent` payload. Human/log\n * output goes to stderr (see lib/logger), so writing the structured payload to\n * stdout never collides with it.\n */\n\nexport interface CommandResult {\n  structuredContent?: unknown\n}\n\n/** Mutable holder (object so `prefer-const` holds while the flag toggles per run). */\nexport const jsonOutput = { enabled: false }\n\n/**\n * In `--json` mode, write a command result's `structuredContent` to stdout as\n * pretty JSON and return the result unchanged. Outside `--json` mode it is a\n * no-op pass-through. The writer is injectable for testing.\n */\nexport const emit = <T extends CommandResult | void>(\n  result: T,\n  write: (text: string) => void = (text) => {\n    process.stdout.write(text)\n  },\n): T => {\n  if (jsonOutput.enabled && result && result.structuredContent != null) {\n    write(`${JSON.stringify(result.structuredContent, null, 2)}\\n`)\n  }\n\n  return result\n}\n\n/** Register `--json` on a command and every nested subcommand (idempotent). */\nexport const addJsonOption = (cmd: Command): void => {\n  const alreadyHasJson = cmd.options.some((option) => {\n    return option.long === '--json'\n  })\n\n  if (!alreadyHasJson) {\n    cmd.option('--json', 'Output the structured result as JSON on stdout (human logs stay on stderr)')\n  }\n\n  cmd.commands.forEach(addJsonOption)\n}\n", "const STDERR_EXCERPT_MAX_BYTES = 200\n\nexport interface OperationErrorContext {\n  operation: string\n  remediation?: string\n  stderrExcerpt?: string\n}\n\n/**\n * Duck-typed read of zx's `ProcessOutput.stderr` (and similar shapes) without\n * importing zx types just for an `instanceof` check.\n *\n * @example\n * extractStderr(new Error('x'))               // undefined\n * extractStderr({ stderr: 'fatal: ...' })     // 'fatal: ...'\n * extractStderr({ stderr: '' })               // undefined  (empty treated as missing)\n */\nexport const extractStderr = (cause: unknown): string | undefined => {\n  // Walks the `cause` chain rather than reading one level. `OperationError` renders\n  // `stderrExcerpt` into its message and keeps it on the instance, but an OperationError\n  // wrapped in another OperationError \u2014 which is what `executeOne` does to every per-entry\n  // failure \u2014 carries no `.stderr` of its own. Reading one level there returns undefined, so\n  // the inner refusal's evidence would be silently dropped from the message the operator and\n  // the agent actually see.\n  const seen = new Set<unknown>()\n  let current = cause\n\n  while (current !== null && typeof current === 'object' && !seen.has(current)) {\n    seen.add(current)\n\n    const { stderr, stderrExcerpt } = current as { stderr?: unknown; stderrExcerpt?: unknown }\n\n    if (typeof stderr === 'string' && stderr.length > 0) return stderr\n    if (typeof stderrExcerpt === 'string' && stderrExcerpt.length > 0) return stderrExcerpt\n\n    current = (current as { cause?: unknown }).cause\n  }\n\n  return undefined\n}\n\n/**\n * Compose the human-and-agent-readable message body for an `OperationError`:\n * `\"failed to <operation> [\u2014 stderr: <excerpt>] [\u2014 try: <remediation>]\"`.\n * `stderrExcerpt` overrides anything duck-typed off `cause`; both are trimmed\n * and capped at {@link STDERR_EXCERPT_MAX_BYTES} so a runaway subprocess can't\n * blow up the message.\n */\nconst buildMessage = (cause: unknown, ctx: OperationErrorContext): string => {\n  const stderr = ctx.stderrExcerpt ?? extractStderr(cause)\n  const parts = [`failed to ${ctx.operation}`]\n\n  if (stderr) parts.push(`stderr: ${stderr.slice(0, STDERR_EXCERPT_MAX_BYTES).trim()}`)\n  if (ctx.remediation) parts.push(`try: ${ctx.remediation}`)\n\n  return parts.join(' \u2014 ')\n}\n\n/**\n * Error type for any handler-level failure that should surface to the caller\n * (a human or a `--agent` run) with a remediation hint. Wraps an underlying\n * cause and renders a single-line, structured message so logs and the stderr\n * an agent reads stay scannable.\n *\n * Pattern modeled on the exemplary Doppler errors in\n * `src/integrations/doppler/doppler-errors.ts`.\n *\n * @example\n * throw new OperationError(err, {\n *   operation: `git worktree add for ${branch}`,\n *   remediation: 'check the branch name and that the parent dir is writable',\n * })\n * @example\n * // validation failure, with no underlying cause to wrap\n * throw new OperationError(undefined, { operation: 'launch deploy-all workflow', remediation })\n */\nexport class OperationError extends Error {\n  readonly operation: string\n  readonly remediation?: string\n  /**\n   * Kept on the instance, not merely rendered into the message: this error is routinely\n   * re-wrapped in another `OperationError` (see `executeOne`), and {@link extractStderr}\n   * walks the `cause` chain looking for exactly this field. Without it the outer message\n   * reports only its own generic remediation and the real reason disappears.\n   */\n  readonly stderrExcerpt?: string\n\n  constructor(cause: unknown, ctx: OperationErrorContext) {\n    super(buildMessage(cause, ctx), { cause })\n    this.name = 'OperationError'\n    this.operation = ctx.operation\n    this.remediation = ctx.remediation\n    this.stderrExcerpt = ctx.stderrExcerpt ?? extractStderr(cause)\n  }\n}\n", "import path from 'node:path'\nimport process from 'node:process'\nimport { $ } from 'zx'\n\nimport { isAgentMode } from 'src/lib/agent-mode'\nimport { OperationError, extractStderr } from 'src/lib/errors/operation-error'\nimport { isReleaseBranch } from 'src/lib/release-id'\n\n/**\n * A single record from `git worktree list --porcelain`. The porcelain format is\n * the source of truth for worktrees: it carries the absolute `path` (which the\n * human format's `[branch]` scrape discards), and it distinguishes detached /\n * bare / prunable / locked states that the scrape collapses to `null`.\n *\n * `branch` is the short name (`release/v1.2.3`, `feature/x`) with `refs/heads/`\n * stripped, or `null` for a detached, bare, or otherwise branch-less checkout.\n */\nexport interface WorktreeEntry {\n  path: string\n  branch: string | null\n  detached: boolean\n  bare: boolean\n  prunable: boolean\n  locked: boolean\n}\n\n/**\n * List every git worktree of the repo containing `cwd`, parsed from\n * `git worktree list --porcelain`.\n *\n * Porcelain is a stable, documented, line-oriented format: one record per\n * worktree, records separated by a blank line, each opening with a\n * `worktree <abs-path>` line. Attribute lines (`branch`, `detached`, `bare`,\n * `locked`, `prunable`) follow. This replaces the legacy `endsWith(']')` scrape\n * of the human format, which lost the path and returned `null` for detached\n * worktrees.\n *\n * The main checkout is included in the output (as its own record), exactly as\n * git reports it.\n */\nexport const listWorktrees = async (cwd: string): Promise<WorktreeEntry[]> => {\n  const output = await $({ cwd })`git worktree list --porcelain`\n\n  const entries: WorktreeEntry[] = []\n  let current: WorktreeEntry | null = null\n\n  for (const line of output.stdout.split('\\n')) {\n    if (line.startsWith('worktree ')) {\n      // A new record opens; flush the previous one.\n      if (current) entries.push(current)\n\n      current = {\n        path: line.slice('worktree '.length),\n        branch: null,\n        detached: false,\n        bare: false,\n        prunable: false,\n        locked: false,\n      }\n\n      continue\n    }\n\n    if (!current) continue\n\n    if (line.startsWith('branch ')) {\n      current.branch = line.slice('branch '.length).replace(/^refs\\/heads\\//, '')\n    } else if (line === 'detached') {\n      current.detached = true\n    } else if (line === 'bare') {\n      current.bare = true\n    } else if (line === 'locked' || line.startsWith('locked ')) {\n      current.locked = true\n    } else if (line === 'prunable' || line.startsWith('prunable ')) {\n      current.prunable = true\n    }\n  }\n\n  if (current) entries.push(current)\n\n  return entries\n}\n\n/**\n * Get current git worktrees\n *\n * Thin wrapper over {@link listWorktrees}: harvests branch names from the\n * porcelain records and filters by release / feature shape. Detached, bare, and\n * branch-less records drop out naturally (their `branch` is `null`).\n *\n * @returns [release/v1.18.22, release/v1.18.23, release/v1.18.24] or [feature/mobile-app, feature/explore-page, feature/login-page]\n */\nexport const getCurrentWorktrees = async (type: 'release' | 'feature'): Promise<string[]> => {\n  const entries = await listWorktrees(process.cwd())\n\n  const matches = (branch: string): boolean => {\n    return type === 'release' ? isReleaseBranch(branch) : branch.startsWith('feature/')\n  }\n\n  return entries\n    .map((entry) => {\n      return entry.branch\n    })\n    .filter((branch): branch is string => {\n      return branch !== null && matches(branch)\n    })\n}\n\n/**\n * Trim git's `not a git repository (or any of the parent directories): .git` tail \u2014 and ONLY that.\n * Returns undefined for every other failure so `OperationError` falls through to the real stderr:\n * dubious ownership, EACCES, a corrupt repo, and a missing `git` binary must each report themselves.\n */\nconst normalizeGitRootStderr = (error: unknown): string | undefined => {\n  const raw = extractStderr(error)\n\n  return raw && /not a git repository/i.test(raw) ? 'not a git repository' : undefined\n}\n\n/**\n * Remediation text for a failed project-root resolution.\n *\n * Channel-aware: an agent is told which action it has (`-C <dir>`, or re-running from the project\n * directory) rather than to \"cd\", which a fixed-cwd caller cannot do.\n *\n * `hasStderr` gates the stderr-referencing clause: with no stderr (missing `git`\n * binary, ENOENT) the message must not point at evidence it does not carry.\n */\nconst projectRootRemediation = ({ hasStderr }: { hasStderr: boolean }): string => {\n  if (isAgentMode()) {\n    return 'infra-kit resolves its project from the working directory; run it from inside an infra-kit project repo (or one of its git worktrees), or pass `-C <dir>` naming one'\n  }\n\n  const base = 'run infra-kit from inside an infra-kit project repo (or one of its git worktrees)'\n\n  return hasStderr ? `${base}; if you are already in one, the stderr in this message is the real cause` : base\n}\n\n/**\n * Get the current project root directory\n */\nexport const getProjectRoot = async (): Promise<string> => {\n  try {\n    const result = await $({ quiet: true })`git rev-parse --show-toplevel`\n\n    return result.stdout.trim()\n  } catch (error) {\n    const stderrExcerpt = normalizeGitRootStderr(error) ?? extractStderr(error)\n\n    throw new OperationError(error, {\n      operation: `resolve the project root from ${process.cwd()}`,\n      stderrExcerpt,\n      remediation: projectRootRemediation({ hasStderr: stderrExcerpt !== undefined }),\n    })\n  }\n}\n\n/**\n * Absolute path to the MAIN repository root \u2014 invariant across the main checkout\n * and all of its linked worktrees. A linked worktree's `--show-toplevel` is the\n * worktree's own path, but its `--git-common-dir` still points at the shared\n * `<main>/.git`, so the parent of the resolved common dir is always the main repo.\n * This is the stable identity to key per-repo state on (unlike `getProjectRoot`,\n * whose basename is the worktree's leaf directory inside a worktree).\n *\n * Submodules are the one exception: their common dir is\n * `<super>/.git/modules/<name>`, whose parent (`.../.git/modules`) is not a repo\n * root \u2014 there is no meaningful \"main repo\" to converge on \u2014 so we fall back to\n * the caller-supplied toplevel unchanged. Callers must pass a git toplevel as\n * `cwd` (e.g. the result of {@link getProjectRoot}); the fallback assumes it.\n *\n * @example\n * // main checkout: common dir '.git' \u2192 resolve \u2192 '<main>/.git' \u2192 dirname \u2192 '<main>'\n * await getMainRepoRoot('/Users/me/projects/hulyo')            // => '/Users/me/projects/hulyo'\n * // linked worktree: common dir '<main>/.git' \u2192 dirname \u2192 '<main>'\n * await getMainRepoRoot('/Users/me/projects/hulyo-worktrees/feature/x') // => '/Users/me/projects/hulyo'\n */\nexport const getMainRepoRoot = async (cwd?: string): Promise<string> => {\n  const root = cwd ?? (await getProjectRoot())\n  const commonDir = (await $({ cwd: root, quiet: true })`git rev-parse --git-common-dir`).stdout.trim()\n  const resolved = path.resolve(root, commonDir)\n\n  // Submodule: common dir sits under `<super>/.git/modules/<name>` \u2014 no stable\n  // main-repo root to key on, so keep the caller's own toplevel.\n  if (resolved.includes(`${path.sep}.git${path.sep}modules${path.sep}`)) return root\n\n  return path.dirname(resolved)\n}\n\n/**\n * Get the current git branch name (e.g. `dev`, `main`, `release/v1.2.3`).\n */\nexport const getCurrentBranch = async (): Promise<string> => {\n  const result = await $`git rev-parse --abbrev-ref HEAD`\n\n  return result.stdout.trim()\n}\n\n/**\n * The working tree's `git status --porcelain` lines: staged, unstaged, and untracked\n * changes, one entry per path. Empty means clean.\n *\n * The porcelain output is returned rather than reduced to a boolean because every refusal\n * built on it has to name the paths that block the operation \u2014 an operator told only\n * \"working tree has uncommitted changes\" has to run `git status` themselves to act on it.\n */\nexport const getWorkingTreeStatus = async (): Promise<string[]> => {\n  const result = await $`git status --porcelain`\n\n  // Only the trailing whitespace is stripped. The two leading columns are the status itself \u2014\n  // ` M` is \"modified in the worktree\" and `M ` is \"modified and staged\" \u2014 so trimming the left\n  // side would render the first as the second in a message whose whole job is to tell the\n  // operator what is in their way.\n  return result.stdout\n    .split('\\n')\n    .map((line) => {\n      return line.trimEnd()\n    })\n    .filter((line) => {\n      return line.trim().length > 0\n    })\n}\n\n/**\n * Whether the working tree has no staged, unstaged, or untracked changes.\n */\nexport const isWorkingTreeClean = async (): Promise<boolean> => {\n  return (await getWorkingTreeStatus()).length === 0\n}\n\n/**\n * Whether the current checkout is a linked git worktree rather than the main\n * repository checkout.\n *\n * A linked worktree's git dir lives under `<main>/.git/worktrees/<name>`, so it\n * differs from the shared common dir; in the main checkout the two resolve to\n * the same path. Both are anchored to the toplevel so `--git-common-dir` (which\n * git may report relative to cwd) resolves consistently.\n */\nexport const isInsideLinkedWorktree = async (): Promise<boolean> => {\n  const cwd = await getProjectRoot()\n\n  const [gitDirResult, commonDirResult] = await Promise.all([\n    $({ cwd })`git rev-parse --absolute-git-dir`,\n    $({ cwd })`git rev-parse --git-common-dir`,\n  ])\n\n  const gitDir = gitDirResult.stdout.trim()\n  const commonDir = path.resolve(cwd, commonDirResult.stdout.trim())\n\n  return gitDir !== commonDir\n}\n\n/**\n * Basename of the CURRENT worktree's toplevel \u2014 a linked worktree returns the worktree dir name,\n * not the repository. Not a repo identity; see {@link getMainRepoRoot} for the stable root.\n *\n * @deprecated It has no production caller: its last one fed `local-deploy` preflight the release\n * name instead of the project. Kept only because the test suite still imports it.\n */\nexport const getRepoName = async (): Promise<string> => {\n  const projectRoot = await getProjectRoot()\n\n  return path.basename(projectRoot)\n}\n\n/**\n * Check whether a local branch exists.\n *\n * `deleteLocalBranch` fails open: it silently returns without deleting when\n * the branch is the current checkout or already absent, and either way its\n * `void` return gives the caller no way to tell \"deleted\" apart from \"did\n * nothing\". A caller that must not report an unperformed deletion \u2014 such as\n * a teardown command confirming a branch is actually gone \u2014 needs this\n * independent check rather than trusting `deleteLocalBranch`'s outcome.\n */\nexport const branchExists = async (branch: string): Promise<boolean> => {\n  const listed = await $`git branch --list ${branch}`\n\n  return listed.stdout.trim().length > 0\n}\n\n/**\n * Delete a local branch if it exists and is not the current checkout.\n *\n * Idempotent: a no-op when the branch is absent (`git branch --list` prints\n * nothing). Uses force `-D` because a delivered release branch was\n * squash-merged \u2014 its tip is unreachable from the base, so `-d` would refuse\n * with \"not fully merged\". The delete itself still rejects if the branch is\n * checked out in another worktree; callers decide how to handle that.\n */\nexport const deleteLocalBranch = async (branch: string): Promise<void> => {\n  const listed = await $`git branch --list ${branch}`\n\n  if (listed.stdout.trim().length === 0) return\n\n  if ((await getCurrentBranch()) === branch) return\n\n  await $`git branch -D ${branch}`\n}\n\n/**\n * Delete a branch on the `origin` remote if it exists.\n *\n * Idempotent: a no-op when the branch is absent on the remote. Existence is\n * probed with `git ls-remote --heads` (empty stdout = absent) rather than\n * `--exit-code`, so a genuine network/auth failure rejects and propagates to\n * the caller instead of being silently misread as \"branch absent\".\n */\nexport const deleteRemoteBranch = async (branch: string): Promise<void> => {\n  const refs = await $`git ls-remote --heads origin ${branch}`\n\n  if (refs.stdout.trim().length === 0) return\n\n  await $`git push origin --delete ${branch}`\n}\n", "/**\n * A release identity is either a semantic version or a free-form kebab-case\n * name. `raw` is the canonical token for the id: the no-`v` semver string for\n * versions (e.g. `1.2.3`) and the name itself for named releases.\n */\nexport type ReleaseId =\n  | { kind: 'version'; semver: { major: number; minor: number; patch: number }; raw: string }\n  | { kind: 'name'; name: string; raw: string }\n\n/** Matches a bare or `v`-prefixed semver token, e.g. `1.2.3` or `v1.2.3`. */\nconst VERSION_RE = /^v?(\\d+)\\.(\\d+)\\.(\\d+)$/\n\n/** Matches the semver core after the `v` in a `release/v\u2026` branch. */\nconst BRANCH_SEMVER_RE = /^(\\d+)\\.(\\d+)\\.(\\d+)$/\n\n/** Kebab-case: lowercase alphanumeric segments joined by single hyphens. */\nconst KEBAB_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/\n\nconst RELEASE_BRANCH_PREFIX = 'release/'\nconst VERSION_BRANCH_PREFIX = 'release/v'\nconst REFS_HEADS_PREFIX = 'refs/heads/'\n\nconst NEXT_TOKEN = 'next'\nconst MAX_NAME_LENGTH = 50\n\n/**\n * Names that would collide with branch/release semantics or read as a special\n * token. Banned regardless of kebab-case validity.\n */\nconst RESERVED_NAMES: ReadonlySet<string> = new Set(['dev', 'main', 'next', 'hotfix', 'regular', 'release'])\n\n/** Thrown by {@link validateName} when a release name is not acceptable. */\nexport class InvalidReleaseNameError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'InvalidReleaseNameError'\n  }\n}\n\n/** Thrown by {@link parseReleaseRef} when a release ref cannot be parsed. */\nexport class InvalidReleaseRefError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'InvalidReleaseRefError'\n  }\n}\n\nconst stripRefsHeads = (input: string): string => {\n  return input.startsWith(REFS_HEADS_PREFIX) ? input.slice(REFS_HEADS_PREFIX.length) : input\n}\n\nconst makeVersion = (major: number, minor: number, patch: number): ReleaseId => {\n  return {\n    kind: 'version',\n    semver: { major, minor, patch },\n    raw: `${major}.${minor}.${patch}`,\n  }\n}\n\n/**\n * Validate a release name. Throws {@link InvalidReleaseNameError} with a\n * specific message unless the name is kebab-case, at most 50 characters, and\n * not a reserved word. Semver-looking tokens (e.g. `1.2.3`) are already\n * excluded by the kebab-case rule since they contain dots.\n */\nexport const validateName = (name: string): void => {\n  if (name.length === 0) {\n    throw new InvalidReleaseNameError('Release name is empty. Provide a kebab-case name like \"checkout-redesign\".')\n  }\n\n  if (name.length > MAX_NAME_LENGTH) {\n    throw new InvalidReleaseNameError(\n      `Release name \"${name}\" is ${name.length} characters; the maximum is ${MAX_NAME_LENGTH}.`,\n    )\n  }\n\n  if (!KEBAB_RE.test(name)) {\n    throw new InvalidReleaseNameError(\n      `Release name \"${name}\" is not kebab-case. Use lowercase letters, digits, and single hyphens, e.g. \"checkout-redesign\".`,\n    )\n  }\n\n  if (RESERVED_NAMES.has(name)) {\n    throw new InvalidReleaseNameError(\n      `Release name \"${name}\" is reserved. Reserved names: ${[...RESERVED_NAMES].join(', ')}.`,\n    )\n  }\n}\n\n/**\n * Lenient parse of a git branch name into a {@link ReleaseId}. Tolerates a\n * leading `refs/heads/`. Returns `null` for anything that is not a valid\n * `release/v<semver>` or `release/<name>` branch. Never throws.\n *\n * Precedence is version-first: `release/v<semver>` is a version, but if the\n * segment after `release/v` is not a valid semver (e.g. `release/vnext`), the\n * whole token after `release/` is treated as a candidate name instead.\n */\nexport const parseBranchName = (branch: string): ReleaseId | null => {\n  const stripped = stripRefsHeads(branch.trim())\n\n  if (!stripped.startsWith(RELEASE_BRANCH_PREFIX)) return null\n\n  if (stripped.startsWith(VERSION_BRANCH_PREFIX)) {\n    const semverPart = stripped.slice(VERSION_BRANCH_PREFIX.length)\n    const match = BRANCH_SEMVER_RE.exec(semverPart)\n\n    if (match) {\n      return makeVersion(Number(match[1]), Number(match[2]), Number(match[3]))\n    }\n  }\n\n  const namePart = stripped.slice(RELEASE_BRANCH_PREFIX.length)\n\n  try {\n    validateName(namePart)\n  } catch {\n    return null\n  }\n\n  return { kind: 'name', name: namePart, raw: namePart }\n}\n\n/**\n * Strict parse of a release ref into a {@link ReleaseId}. Throws\n * {@link InvalidReleaseRefError} on invalid input. Precedence (order matters):\n *   1. `release/\u2026` (or `refs/heads/release/\u2026`) \u2192 delegate to parseBranchName.\n *   2. semver token (`1.2.3` / `v1.2.3`) \u2192 version.\n *   3. `next` \u2192 throws; callers must resolve `next` to a concrete version\n *      via computeNextVersion before calling this.\n *   4. otherwise \u2192 validateName, returning a named release.\n */\nexport const parseReleaseRef = (input: string): ReleaseId => {\n  const trimmed = input.trim()\n  const branchCandidate = stripRefsHeads(trimmed)\n\n  if (branchCandidate.startsWith(RELEASE_BRANCH_PREFIX)) {\n    const parsed = parseBranchName(trimmed)\n\n    if (!parsed) {\n      throw new InvalidReleaseRefError(\n        `\"${input}\" looks like a release branch but is not a valid release/v<semver> or release/<name> ref.`,\n      )\n    }\n\n    return parsed\n  }\n\n  const versionMatch = VERSION_RE.exec(trimmed)\n\n  if (versionMatch) {\n    return makeVersion(Number(versionMatch[1]), Number(versionMatch[2]), Number(versionMatch[3]))\n  }\n\n  if (trimmed.toLowerCase() === NEXT_TOKEN) {\n    throw new InvalidReleaseRefError(\n      'The \"next\" token must be resolved to a concrete version (via computeNextVersion) before parsing a release ref.',\n    )\n  }\n\n  // A `1.64.0@2026-10-28` spec is what `release create -r` teaches, so it is the likeliest thing to\n  // be pasted here; one hint at the parser serves every ref-taking command. It REPLACES the\n  // kebab-case reason rather than trailing it: that reason is noise for this input, and callers\n  // that wrap the message (`resolveReleaseBranch`) cap it, which would cut the hint off.\n  if (trimmed.includes('@')) {\n    throw new InvalidReleaseRefError(\n      `Cannot parse \"${input}\" as a release ref: the \\`@date\\` suffix belongs to \\`release create\\`; pass the version alone here and use \\`--release-date\\` on \\`release edit\\``,\n    )\n  }\n\n  try {\n    validateName(trimmed)\n  } catch (err) {\n    const reason = err instanceof Error ? err.message : String(err)\n\n    throw new InvalidReleaseRefError(`Cannot parse \"${input}\" as a release ref: ${reason}`)\n  }\n\n  return { kind: 'name', name: trimmed, raw: trimmed }\n}\n\n/** Render the branch name for a release id: `release/v1.2.3` | `release/<name>`. */\nexport const formatBranchName = (id: ReleaseId): string => {\n  if (id.kind === 'version') return `${VERSION_BRANCH_PREFIX}${id.raw}`\n\n  return `${RELEASE_BRANCH_PREFIX}${id.name}`\n}\n\n/**\n * Render a PR title: `Release v1.2.3` / `Hotfix v1.2.3` for versions,\n * `Release <name>` / `Hotfix <name>` for names.\n */\nexport const formatPrTitle = (id: ReleaseId, type: 'regular' | 'hotfix'): string => {\n  const prefix = type === 'hotfix' ? 'Hotfix' : 'Release'\n\n  if (id.kind === 'version') return `${prefix} v${id.raw}`\n\n  return `${prefix} ${id.name}`\n}\n\n/** Render a release-candidate PR title: `Release v1.2.3 (RC)` | `Release <name> (RC)`. */\nexport const formatRcTitle = (id: ReleaseId): string => {\n  if (id.kind === 'version') return `Release v${id.raw} (RC)`\n\n  return `Release ${id.name} (RC)`\n}\n\n/** Render the Jira fix-version name: `v1.2.3` | `<name>`. */\nexport const formatJiraName = (id: ReleaseId): string => {\n  if (id.kind === 'version') return `v${id.raw}`\n\n  return id.name\n}\n\n/** Render a short human display label: `1.2.3` | `<name>`. */\nexport const displayLabel = (id: ReleaseId): string => {\n  return id.raw\n}\n\n/** True iff `branch` is a valid release branch under either scheme. */\nexport const isReleaseBranch = (branch: string | null | undefined): boolean => {\n  if (branch === null || branch === undefined) return false\n\n  return parseBranchName(branch) !== null\n}\n\nconst toTime = (value: string | Date | undefined): number | null => {\n  if (value === undefined) return null\n\n  const time = value instanceof Date ? value.getTime() : new Date(value).getTime()\n\n  return Number.isNaN(time) ? null : time\n}\n\n/**\n * Comparator for {@link ReleaseId} values (locked ordering):\n *   - All versions sort before all names.\n *   - Versions: semver ascending (major, then minor, then patch; numeric).\n *   - Names: by date ascending when both dates are provided, otherwise\n *     lexicographic by name. The result is stable and deterministic.\n */\nexport const compareReleaseIds = (\n  a: ReleaseId,\n  b: ReleaseId,\n  dates?: { a?: string | Date; b?: string | Date },\n): number => {\n  if (a.kind === 'version' && b.kind === 'version') {\n    if (a.semver.major !== b.semver.major) return a.semver.major - b.semver.major\n    if (a.semver.minor !== b.semver.minor) return a.semver.minor - b.semver.minor\n\n    return a.semver.patch - b.semver.patch\n  }\n\n  if (a.kind === 'version') return -1\n  if (b.kind === 'version') return 1\n\n  const timeA = toTime(dates?.a)\n  const timeB = toTime(dates?.b)\n\n  if (timeA !== null && timeB !== null && timeA !== timeB) {\n    return timeA - timeB\n  }\n\n  if (a.name < b.name) return -1\n  if (a.name > b.name) return 1\n\n  return 0\n}\n", "import { $ } from 'zx'\n\nimport { OperationError } from 'src/lib/errors/operation-error'\n\n/**\n * Resolve a ref to a commit sha, or `null` when it does not exist.\n *\n * Callers must run this BEFORE {@link isAncestor} on any ref that might be gone:\n * `git merge-base --is-ancestor` exits 128 on an unknown ref, which is a fatal,\n * not a boolean \u2014 so a release branch deleted on origin between the PR listing\n * and the fetch would abort the whole run instead of failing that one branch.\n */\nexport const revParseVerify = async (cwd: string, ref: string): Promise<string | null> => {\n  const commitish = `${ref}^{commit}`\n\n  try {\n    const result = await $({ cwd, quiet: true })`git rev-parse --verify --quiet ${commitish}`\n\n    return result.stdout.trim() || null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Whether `ancestor` is already contained in `descendant`.\n *\n * This is the idempotency probe for the whole command: when `origin/dev` is\n * already an ancestor of `origin/<branch>`, that branch needs no merge, no\n * checkout, and no refspec. It is also what makes a re-run after a partially\n * rejected push safe rather than duplicative.\n *\n * Exit 0 = contained, exit 1 = not. Anything else (notably 128 on an unknown\n * ref) is a programming error at the call site, so it propagates rather than\n * being flattened into `false` \u2014 a silent `false` would re-merge a branch that\n * was already done.\n */\nexport const isAncestor = async (cwd: string, ancestor: string, descendant: string): Promise<boolean> => {\n  try {\n    await $({ cwd, quiet: true })`git merge-base --is-ancestor ${ancestor} ${descendant}`\n\n    return true\n  } catch (error) {\n    const exitCode = (error as { exitCode?: number }).exitCode\n\n    if (exitCode === 1) return false\n\n    throw new OperationError(error, {\n      operation: `test whether ${ancestor} is contained in ${descendant}`,\n      remediation: 'both refs must exist \u2014 verify them with rev-parse first',\n    })\n  }\n}\n\n/** The sha `origin` currently holds for a branch, or `null` when it has none. */\nexport const lsRemoteHead = async (cwd: string, branch: string): Promise<string | null> => {\n  const result = await $({ cwd, quiet: true })`git ls-remote --heads origin ${branch}`\n  const line = result.stdout.trim().split('\\n')[0]\n\n  return line ? (line.split(/\\s+/)[0] ?? null) : null\n}\n\nexport interface AtomicPushRef {\n  branch: string\n  sha: string\n}\n\nexport interface AtomicPushResult {\n  /** Refspecs exactly as handed to git \u2014 printed before the push so the transcript names what was in flight. */\n  refspecs: string[]\n  pushed: boolean\n  /** Raw stderr on failure, for the report to quote rather than paraphrase. */\n  stderr?: string\n}\n\n/**\n * Push every merge in one all-or-nothing `git push --atomic`.\n *\n * Atomicity is the whole point: a per-branch loop leaves 2^N possible outcomes\n * on a failure, and reconstructing which branches landed means inspecting every\n * remote by hand. With `--atomic`, one non-fast-forwardable ref leaves *every*\n * ref unchanged on origin.\n *\n * Deliberately never forced. No `--force`, no `--force-with-lease`, no `+`\n * refspec: each ref stays individually fast-forward-checked, so a teammate's\n * push landing between the plan and the apply loses safely \u2014 the push is\n * rejected and nothing is overwritten. A rejection here is a correct outcome,\n * not a bug to route around.\n */\nexport const pushAtomic = async (cwd: string, refs: AtomicPushRef[]): Promise<AtomicPushResult> => {\n  const refspecs = refs.map((ref) => {\n    return `${ref.sha}:refs/heads/${ref.branch}`\n  })\n\n  if (refspecs.length === 0) {\n    return { refspecs, pushed: false }\n  }\n\n  try {\n    await $({ cwd, quiet: true })`git push --atomic origin ${refspecs}`\n\n    return { refspecs, pushed: true }\n  } catch (error) {\n    return {\n      refspecs,\n      pushed: false,\n      stderr: (error as { stderr?: string }).stderr,\n    }\n  }\n}\n", "import path from 'node:path'\nimport process from 'node:process'\nimport { $ } from 'zx'\n\nimport { WORKTREES_DIR_SUFFIX, WORKTREE_SUBDIRS } from 'src/lib/constants'\nimport { OperationError } from 'src/lib/errors/operation-error'\n\n/**\n * A disposable detached worktree that `gh-merge-dev` merges inside of.\n *\n * The whole point is that no checkout anyone else owns is touched: the release\n * branches this command merges into are, on this team, almost always checked out\n * in linked worktrees already, so `git switch` \u2014 the old engine \u2014 fails on the\n * ordinary case rather than the exceptional one.\n */\nexport interface ScratchWorktree {\n  /** Absolute path of the scratch checkout. */\n  path: string\n  /** Remove the worktree registration and its directory. Never throws. */\n  remove: () => Promise<void>\n}\n\n/**\n * Where the scratch worktree lives: `<git-common-dir>/infra-kit/merge-dev-<runId>`, with `runId`\n * taken from `INFRA_KIT_SESSION` (this repo's per-terminal id) and falling back to the pid.\n *\n * Two properties are load-bearing: the path is outside every working tree, and it is unique per run.\n */\n// Both are about NOT colliding with things that already exist.\n//\n// 1. Outside every working tree. An untracked directory inside the main checkout would make\n//    `isWorkingTreeClean` false, and therefore `assertManagementContext` throw, for every OTHER\n//    release and worktree command in this CLI \u2014 so a crashed `gh-merge-dev` would break\n//    `worktrees add` and `release create` with a message naming neither of them. Under `.git/`\n//    it is invisible to `git status` by construction.\n// 2. Unique per run. A colliding path is a hard `fatal: \u2026 already exists`, so two concurrent runs\n//    would fight.\n//\n// It also deliberately avoids the team's `<projectRoot>-worktrees/` convention, which\n// `getCurrentWorktrees` scans for release branches.\nexport const scratchWorktreePath = async (cwd?: string): Promise<string> => {\n  const root = cwd ?? process.cwd()\n  const commonDir = (await $({ cwd: root, quiet: true })`git rev-parse --git-common-dir`).stdout.trim()\n  const runId = process.env.INFRA_KIT_SESSION || String(process.pid)\n\n  return path.join(path.resolve(root, commonDir), 'infra-kit', `merge-dev-${runId}`)\n}\n\n/** `release/v1.2.3` \u2192 `release-v1-2-3`: one flat directory name per branch. */\nexport const branchSlug = (branch: string): string => {\n  return branch.replace(/[^\\w-]+/g, '-')\n}\n\n/**\n * Where `release merge-dev --keep-conflicts` leaves a branch mid-merge for someone to resolve:\n * `<projectRoot>-worktrees/merge-dev/<branch-slug>`.\n */\n// This reverses the \"avoid `<projectRoot>-worktrees/`\" choice above, because the resolver must edit\n// files here and `.git/**` is a protected path for agent edits. Both reasons for the original choice\n// still hold: the path is outside every working tree, and the worktree is DETACHED, so\n// `getCurrentWorktrees` (which keeps only entries with a branch) never hands it to `worktrees sync`\n// or `worktrees remove --all`.\nexport const resolutionWorktreePath = (projectRoot: string, branch: string): string => {\n  return path.join(`${projectRoot}${WORKTREES_DIR_SUFFIX}`, WORKTREE_SUBDIRS.mergeDev, branchSlug(branch))\n}\n\n/** Whether a merge is in progress in `cwd`. Never throws. */\nexport const hasMergeInProgress = async (cwd: string): Promise<boolean> => {\n  try {\n    await $({ cwd, quiet: true })`git rev-parse -q --verify MERGE_HEAD`\n\n    return true\n  } catch {\n    return false\n  }\n}\n\n/**\n * Refuse to reuse a scratch worktree that is not pristine.\n *\n * This converts a cleanup miss into a fail-fast instead of a cascade. The\n * failure it guards against is measurable: after a conflicting merge is left\n * unaborted, the next `git checkout --detach` fails with `error: you need to\n * resolve your current index first`, so branch k's conflict would be reported as\n * an error on branches k+1\u2026N \u2014 the same class of silently-wrong per-branch\n * result the new engine exists to eliminate.\n */\nexport const assertPristineWorktree = async (cwd: string): Promise<void> => {\n  if (await hasMergeInProgress(cwd)) {\n    throw new OperationError(undefined, {\n      operation: 'reuse the scratch worktree',\n      stderrExcerpt: 'a merge is still in progress in the scratch worktree',\n      remediation: 'this is an infra-kit bug \u2014 the previous branch iteration did not clean up',\n    })\n  }\n\n  const status = (await $({ cwd, quiet: true })`git status --porcelain`).stdout.trim()\n\n  if (status.length > 0) {\n    throw new OperationError(undefined, {\n      operation: 'reuse the scratch worktree',\n      stderrExcerpt: `scratch worktree is dirty: ${status.split('\\n')[0]}`,\n      remediation: 'this is an infra-kit bug \u2014 the previous branch iteration did not clean up',\n    })\n  }\n}\n\n/**\n * Return the scratch worktree to a pristine state between branch iterations.\n * Never throws: it runs in a `finally`, and a cleanup that can throw would\n * re-create the very defect (a rejection escaping a catch/finally and killing\n * the run) that this rewrite removes.\n *\n * `clean -fd`, not `-fdx`: ignored paths survive, so a `node_modules` installed\n * by `--verify` on one branch is reused by the next instead of being reinstalled\n * from cold. That makes the `qa` verify tier non-hermetic, which is a deliberate\n * trade recorded in the plan \u2014 the cheap `install` tier is unaffected, because it\n * reads the lockfile and manifests rather than executing installed code.\n */\nexport const resetScratchWorktree = async (cwd: string): Promise<void> => {\n  const run = async (fn: () => Promise<unknown>): Promise<void> => {\n    try {\n      await fn()\n    } catch {\n      // Best-effort by contract; `assertPristineWorktree` is the real gate.\n    }\n  }\n\n  if (await hasMergeInProgress(cwd)) {\n    // Guarded: an unconditional `git merge --abort` exits 128 when there is no\n    // merge to abort, and this runs on paths where there often is not.\n    await run(() => {\n      return $({ cwd, quiet: true })`git merge --abort`\n    })\n  }\n\n  await run(() => {\n    return $({ cwd, quiet: true })`git reset --hard`\n  })\n\n  // `reset --hard` leaves untracked files behind, which would fail the pristine\n  // assertion on the next iteration.\n  await run(() => {\n    return $({ cwd, quiet: true })`git clean -fd`\n  })\n}\n\n/**\n * Create the scratch worktree, hand it to `fn`, and always remove it.\n *\n * Anchored on `origin/dev` rather than on the first candidate branch: a branch\n * deleted on origin between the PR listing and the fetch would make the initial\n * `add` fail, and a preflight throw there would kill the run for every *other*\n * branch too. `origin/dev` is verified by the caller immediately beforehand.\n *\n * A stale registration left by a hard kill (`fatal: \u2026 is a missing but already\n * registered worktree`) is recovered once via `git worktree prune`, because\n * otherwise the command would be broken on that machine every subsequent run.\n */\nexport const withScratchWorktree = async <T>(\n  args: { cwd: string; anchor?: string },\n  fn: (worktree: ScratchWorktree) => Promise<T>,\n): Promise<T> => {\n  const { cwd, anchor = 'origin/dev' } = args\n  const worktreePath = await scratchWorktreePath(cwd)\n\n  const add = async (): Promise<void> => {\n    await $({ cwd, quiet: true })`git worktree add --detach ${worktreePath} ${anchor}`\n  }\n\n  try {\n    await add()\n  } catch (firstError) {\n    try {\n      await $({ cwd, quiet: true })`git worktree prune`\n      await add()\n    } catch {\n      throw new OperationError(firstError, {\n        operation: 'create the scratch worktree for the merge',\n        remediation: `remove any stale checkout at ${worktreePath}, then retry`,\n      })\n    }\n  }\n\n  const worktree: ScratchWorktree = {\n    path: worktreePath,\n    remove: async (): Promise<void> => {\n      try {\n        await $({ cwd, quiet: true })`git worktree remove --force ${worktreePath}`\n      } catch {\n        // A leftover registration is recoverable (`prune`-and-retry on the next\n        // run); throwing here would mask whatever the run was actually reporting.\n      }\n    },\n  }\n\n  try {\n    return await fn(worktree)\n  } finally {\n    await worktree.remove()\n  }\n}\n", "import process from 'node:process'\nimport pino from 'pino'\nimport pretty from 'pino-pretty'\n\n/**\n * Key paths pino censors before anything reaches a destination. The load-bearing case is a handler\n * that logs its `params` object: a token-carrying key in that object would land on stderr verbatim,\n * and stderr is captured by CI logs and terminal scrollback alike.\n *\n * The wildcard forms cover the nesting we actually produce: `{ params: { \u2026 } }` and `{ err: { \u2026 } }`\n * are both one level deep, so `*.token` catches `params.token` without enumerating every wrapper.\n *\n * LIMIT \u2014 read this before trusting it: pino's `redact` is KEY-PATH based. It cannot see a token that\n * was INTERPOLATED into a message string (`logger.info(\\`token ${t}\\`)`) \u2014 that string is opaque to\n * it and would be written verbatim. So this is a backstop, not the rule. The RULE is that a token\n * never enters a message string; everything user-facing renders it through `redactToken` first.\n */\nconst REDACT_PATHS = [\n  'token',\n  '*.token',\n  'serviceToken',\n  '*.serviceToken',\n  'DOPPLER_TOKEN',\n  '*.DOPPLER_TOKEN',\n  'INFRA_KIT_ENV_TOKEN',\n  '*.INFRA_KIT_ENV_TOKEN',\n]\n\nexport const initLoggerCLI = () => {\n  const logLevel = process.argv.includes('--debug') ? 'debug' : 'info'\n\n  const ignoreFields = ['time', 'pid', 'hostname']\n\n  if (logLevel === 'debug') {\n    ignoreFields.push('level')\n  }\n\n  const logger = pino(\n    { level: logLevel, redact: REDACT_PATHS },\n    pretty({\n      destination: 2,\n      ignore: ignoreFields.join(','),\n      colorize: true,\n      // Sync, because reports go straight to `process.stderr` in one write beside these lines. pino-pretty's\n      // default async destination buffers, so lines logged BEFORE a report landed after it in a pipe.\n      sync: true,\n    }),\n  )\n\n  return logger\n}\n\n// Singleton logger instance for CLI usage\nexport const logger = initLoggerCLI()\n", "import fs from 'node:fs/promises'\nimport os from 'node:os'\nimport path from 'node:path'\nimport process from 'node:process'\nimport { z } from 'zod'\n\nimport { isAgentMode } from 'src/lib/agent-mode'\nimport { assertNever } from 'src/lib/assert-never'\nimport { tryAutoMigrateLayer } from 'src/lib/config-migrations'\nimport { USER_CONFIG_DIR_NAME } from 'src/lib/constants'\nimport { getMainRepoRoot, getProjectRoot } from 'src/lib/git-utils'\nimport { PROTECTED_CHILD_ENV_NAMES } from 'src/lib/mcp-proxy/protected-env'\n\nconst INFRA_KIT_CONFIG_FILE = 'infra-kit.json'\n\n// Re-exported for the existing consumers (the vendor factory-config loader, no import cycle \u2014 this\n// module imports no `lib/vendor` code); the definition lives in `lib/constants` so zod-free entries\n// can share it.\nexport { USER_CONFIG_DIR_NAME }\nconst USER_GLOBAL_CONFIG_FILE = 'infra-kit.json'\nconst USER_PROJECTS_DIR = 'projects'\n\n// envManagement\nconst dopplerEnvManagementSchema = z.object({\n  provider: z.literal('doppler'),\n  config: z.object({\n    name: z.string().min(1),\n  }),\n})\n\nconst envManagementSchema = z.discriminatedUnion('provider', [dopplerEnvManagementSchema])\n\n// ide\n// There is one attach style: each worktree is added to the configured editor's\n// workspace and opened (no per-window mode). Cursor needs a `.code-workspace`\n// path to reconcile its `folders` array against.\n// `.strict()`: a non-strict object would drop the retired `mode` key in memory and leave it on\n// disk forever. Refusing it sends the layer through the loader's migration retry, which deletes\n// it from the file.\nconst cursorIdeConfigSchema = z\n  .object({\n    workspaceConfigPath: z.string().min(1),\n  })\n  .strict()\n\nconst cursorIdeSchema = z\n  .object({\n    provider: z.literal('cursor'),\n    config: cursorIdeConfigSchema,\n  })\n  .strict()\n\n// Cursor is the only provider: `zed` was retired (Zed has no workspace file, so its only mutation\n// was a destructive `zed --reuse` relaunch that could never report a diff). Because this schema is\n// `.strict()`, a config that still names it is refused \u2014 `infra-kit setup` drops the entry.\nconst ideSchema = z.discriminatedUnion('provider', [cursorIdeSchema])\n\n// `ide` accepts a single provider (back-compat) OR an array (the shape that\n// drove several editors at once). Normalized to an array everywhere via\n// `resolveConfiguredIdes`. Uniqueness-by-provider is enforced at parse time by a\n// `.superRefine` on the full config schema (see below) \u2014 not here, so the message\n// survives `z.union` error aggregation.\nconst idesSchema = z.union([ideSchema, z.array(ideSchema).min(1)])\n\n// taskManager\n//\n// PARSED BUT NEVER READ. Nothing in this CLI consumes `config.taskManager` \u2014 every Jira call builds\n// its config from the JIRA_BASE_URL / JIRA_EMAIL / JIRA_TOKEN / JIRA_PROJECT_ID environment\n// variables (see `loadJiraConfig` in integrations/jira/api.ts). Keeping it validated is deliberate:\n// `infraKitConfigObject` is `.strict()` and `getInfraKitConfig()` runs as an unconditional guard on\n// most commands, so deleting the key would make every command throw in any consumer repo whose\n// infra-kit.json declares it. The trap it sets is real \u2014 a `projectId` here looks authoritative and\n// changing it does nothing \u2014 so the consumer-facing template carries the same warning.\nconst jiraTaskManagerSchema = z.object({\n  provider: z.literal('jira'),\n  config: z.object({\n    baseUrl: z.string().url(),\n    projectId: z.number().int().positive(),\n  }),\n})\n\nconst taskManagerSchema = z.discriminatedUnion('provider', [jiraTaskManagerSchema])\n\n// Orca pane layout for opened worktree workspaces. Named presets keep the config\n// typo-proof (an enum, not a free string) and let the opener switch on a single\n// value; extend the enum + the opener's switch to add a layout.\n//   two-columns \u2014 left | right, both full-height (default)\n//   three-pane  \u2014 left split top/bottom + full-height right (legacy layout)\nconst orcaLayouts = ['two-columns', 'three-pane'] as const\n\nconst orcaConfigSchema = z\n  .object({\n    layout: z.enum(orcaLayouts).optional(),\n  })\n  .strict()\n\n// worktrees prompt defaults. `.strict()` like every other leaf: a non-strict object here let zod\n// SILENTLY drop a misspelt key, turning \"open in Orca\" off with no message.\nconst worktreesConfigSchema = z\n  .object({\n    openInGithubDesktop: z.boolean().optional(),\n    openInOrca: z.boolean().optional(),\n    orca: orcaConfigSchema.optional(),\n  })\n  .strict()\n\n// dev-server per-app overrides. Maps an app folder name (e.g. `client`) to its\n// local dev port and/or URL prefix. Both keys optional. An app absent from the\n// map falls back to env (`{APP}_PORT` / `PORT`) then the built-in defaults, so\n// the map is intentionally NOT validated against the discovered apps here \u2014 an\n// unknown app name is simply ignored at resolve time (lib/dev), never a parse\n// error that would brick every command.\nconst devAppConfigSchema = z\n  .object({\n    port: z.number().int().positive().optional(),\n    prefixUrl: z.string().min(1).optional(),\n  })\n  .strict()\n\nconst devConfigSchema = z.record(z.string().min(1), devAppConfigSchema)\n\n// devServersPresets: named local-dev sessions, declared in the per-project infra-kit.json\n// (team presets committed; personal ones layered via the user-project override).\n// Each preset names launch targets (apps/<app>/{api,ui}), optional per-backend\n// `watchDeps`, per-route proxy-source overrides, and an `orca` layout flag; it is\n// consumed by `infra-kit dev <preset>` and resolved by src/dev/presets. Each target key\n// names exactly one workspace package (`<app>/api` or `<app>/ui`) \u2014 a bare `<app>` is a\n// folder, not a package, and is rejected. The SHAPE is strict (typos in a preset surface\n// as parse errors), but unknown app/route NAMES are intentionally NOT validated here \u2014\n// they resolve at run time against the discovered apps, so a stale preset never bricks\n// every command.\nconst proxySourceSchema = z.enum(['local', 'cloud'])\n\nconst devPresetAppSchema = z\n  .object({\n    // api targets only: watch the backend's dist + shared-package subdeps and restart on change.\n    watchDeps: z.boolean().optional(),\n    // route path (e.g. `/api`) \u2192 source, overriding that route's config.ts default for this session.\n    proxy: z.record(z.string().min(1), proxySourceSchema).optional(),\n  })\n  .strict()\n\nconst devPresetSchema = z\n  .object({\n    // Launch-target key \u2014 one package: `client/ui`, `client/api`, `*/api`. Omit `apps` = all.\n    apps: z.record(z.string().min(1), devPresetAppSchema).optional(),\n    // Run each launched target in its own Orca terminal (one worktree, N terminals).\n    orca: z.boolean().optional(),\n  })\n  .strict()\n\nconst devPresetsSchema = z.record(z.string().min(1), devPresetSchema)\n\n// Base object shape, kept separate so `.partial()` (which only works on a plain\n// ZodObject, not the `.superRefine`-wrapped full schema) can derive the override\n// schema from it.\n//\n// `.strict()` for the same reason every leaf schema below is: this is the one config file humans\n// hand-edit, and a non-strict top level silently swallows the typo that matters most. `devServersPreset`\n// (missing `s`) or `dev-proxy` would parse clean and turn the feature off with no message. The `dev` and\n// `devServersPresets` values stay open `z.record`s \u2014 app and preset NAMES are user-chosen \u2014 so strictness\n// applies to the key set, not the contents.\n// GONE: `environments`. It answered three questions at once and was therefore wrong for two of them.\n// Where can I deploy? \u2192 each workflow's own `workflow_dispatch` `environment.options`, which GitHub\n// validates server-side (`lib/workflow-envs`). What can I authenticate to? \u2192 the token store\n// (`lib/env-tokens`). Being a third, hand-maintained copy of both, it drifted from both: hulyo declared\n// 6 envs while every hulyo workflow declared 8, and the client-side check turned that drift into a\n// REFUSAL to deploy to `stage` and `prod`.\n//\n// Deleted outright rather than accepted-and-ignored: the key is removed from every repo in the same\n// change, so nothing that is checked out on a current branch still carries it. Because this schema is\n// `.strict()`, a config that DOES still carry it (an old release branch, an unmigrated worktree) is\n// refused with `Unrecognized key: \"environments\"` \u2014 delete the key there too.\n// protectedEnvs \u2014 may THIS project reach the delivery-shaped environments listed in\n// `DEFAULT_PROTECTED_ENVS` (lib/workflow-envs/protected-envs)? The list stays in code; only the\n// decision is per-project. \"disallow\" (the default) is today's behaviour: filtered from every deploy\n// picker and refused. \"allow\" reaches them from a human's terminal and under `--agent` alike.\n// \"cli-only\" reaches them from a terminal but not from an agent \u2014 under `--agent` (or a Claude Code\n// shell) it behaves exactly as \"disallow\", because an agent's `--yes` re-run skips every interactive\n// confirmation, so there is no human keystroke on that path.\n//\n// An ENUM rather than a boolean because the VALUE extends without touching the KEY, and a key rename\n// here is expensive: `.strict()` turns the old name into a parse error on every checkout that still\n// carries it, so retiring a key means a registry migration, not just a deletion. \"cli-only\" is that\n// extension already spent.\n//\n// NEVER give this field a `.default()`. `infraKitOverrideConfigSchema` is `.partial()` of this object,\n// and `.partial()` makes a key optional WITHOUT stripping a `ZodDefault` \u2014 so the default is still\n// injected on absence. `loadLayer` parses EVERY layer through that schema and merges the results, and\n// layer 3 always exists (auto-seeded `{}` on each command), so a default here would parse to\n// `{ protectedEnvs: 'disallow' }` and shallow-merge OVER a layer-1 \"allow\", silently reverting the\n// setting on every machine with no error anywhere. Verified on zod 4.4.3. The fallback is applied at\n// the single read site instead \u2014 see `resolveProtectedEnvAccess`. No other field in this schema has a\n// default, so nothing here demonstrates the trap: this comment is the only warning.\nconst protectedEnvsSchema = z.enum(['disallow', 'allow', 'cli-only'])\n\n/** A POSIX environment-variable name. Comma-free by construction, which is what keeps the derived\n *  `ik-mcp` argv unambiguous. */\nconst envVarName = z.string().regex(/^[A-Z_]\\w*$/i, 'must be a POSIX environment-variable name')\n\n/**\n * One stdio MCP server fronted by `ik-mcp`, the credential-agnostic proxy.\n *\n * `env` are the names the proxy reads from the `ik env-load` session file and injects inline; all of\n * them non-empty means \"credentials present\", and their ordered values are the respawn key. `unset`\n * names are forced empty in the child so a stale file-based credential can never outrank the inline\n * one. Everything else the env file holds is withheld from the child.\n */\n// The proxy is for STATELESS servers: a credential change respawns the child and discards its\n// memory. A browser-automation server would lose its open tabs on every `env-load`. Servers that\n// take credentials only as flags, via OAuth, or from their own config file are out of scope.\nconst mcpProxySchema = z\n  .object({\n    command: z.string().min(1),\n    args: z.array(z.string()).default([]),\n    env: z.array(envVarName).min(1),\n    unset: z.array(envVarName).default([]),\n  })\n  .strict()\n  .superRefine((spec, ctx) => {\n    for (const name of spec.env) {\n      if (PROTECTED_CHILD_ENV_NAMES.has(name)) {\n        ctx.addIssue({\n          code: 'custom',\n          path: ['env'],\n          message: `\"${name}\" is process plumbing the proxy never strips or injects \u2014 it cannot be a credential name`,\n        })\n      }\n    }\n  })\n\n/**\n * `mcp.<name>` \u2192 the proxy spec. The name is the `.mcp.json` key and the proxy's cache subdir.\n *\n * A name containing `infra-kit` is refused because `infra-kit` is the `.mcp.json` key the retired\n * server sat under, and `doctor` still reads that key as the leftover registration to delete\n * (`inspectLegacyMcpRegistration`) \u2014 a proxy filed there would be advised away. The whole substring is\n * held so no proxy name reads as a copy of that entry.\n */\nconst mcpProxiesSchema = z.record(\n  z\n    .string()\n    .regex(/^[a-z][a-z0-9-]*$/, 'must be lowercase letters, digits and hyphens, starting with a letter')\n    .refine(\n      (name) => {\n        return !name.includes('infra-kit')\n      },\n      {\n        message:\n          '\"infra-kit\" is reserved: it is the .mcp.json key of the retired infra-kit MCP server \u2014 pick another name',\n      },\n    ),\n  mcpProxySchema,\n)\n\n/** A path inside the repository, resolved against its root on both the source and the target side. */\nconst repoRelativePathSchema = z\n  .string()\n  .min(1)\n  .superRefine((value, ctx) => {\n    if (value.startsWith('/') || value.startsWith('\\\\') || /^[a-z]:/i.test(value)) {\n      ctx.addIssue({ code: 'custom', message: `\"${value}\" must be relative to the repository root` })\n\n      return\n    }\n\n    const segments = value.split(/[/\\\\]/).filter((segment) => {\n      return segment !== '' && segment !== '.'\n    })\n\n    if (segments.includes('..')) {\n      ctx.addIssue({ code: 'custom', message: `\"${value}\" must not contain a \"..\" segment` })\n    }\n\n    // Copying or deleting inside `.git` would rewrite the target's object store and refs, not its files.\n    if (segments[0] === '.git') {\n      ctx.addIssue({ code: 'custom', message: `\"${value}\" must not be .git or a path inside it` })\n    }\n\n    // The sync rebases paths by string prefix and matches them against `git ls-files` output, which is always\n    // canonical, so any other spelling of the same path silently mismatches.\n    if (value.includes('\\\\')) {\n      ctx.addIssue({ code: 'custom', message: `\"${value}\" must use \"/\" as the separator, not \"\\\\\"` })\n    }\n\n    const rawSegments = value.split('/')\n\n    if (rawSegments.includes('')) {\n      ctx.addIssue({ code: 'custom', message: `\"${value}\" must not have a trailing or doubled \"/\"` })\n    }\n\n    if (rawSegments.includes('.')) {\n      ctx.addIssue({\n        code: 'custom',\n        message: `\"${value}\" must not contain a \".\" segment; write it from the repository root, e.g. \"vendor/configs\"`,\n      })\n    }\n  })\n\nconst vendorCopyEntrySchema = z\n  .object({\n    path: repoRelativePathSchema,\n    target: repoRelativePathSchema.optional(),\n  })\n  .strict()\n\n/**\n * Marks this repo as the source that `ik vendor sync` copies from. No `.default()` anywhere inside\n * it, for the same reason as `protectedEnvs`: the always-present layer 3 would inject it.\n */\nexport const vendorSourceSchema = z\n  .object({\n    copy: z.array(vendorCopyEntrySchema).min(1),\n    // Matched against each path segment on both sides of the diff, so a slash could never match.\n    exclude: z.array(z.string().regex(/^[^/\\\\]+$/, 'must be a single path segment, without \"/\"')).optional(),\n  })\n  .strict()\n\n/**\n * The repo root's `audit --root` rules, over `ROOT_DEFAULT_RULES`. Same vocabulary as a package's\n * `infra-kit.config.ts`, so a rule reads the same at either level; each key replaces its baseline.\n */\nconst auditRulesSchema = z\n  .object({\n    requiredScripts: z.array(z.string().min(1)).optional(),\n    requiredFiles: z.array(z.string().min(1)).optional(),\n    turbo: z\n      .object({\n        requiredTasks: z.array(z.string().min(1)).optional(),\n      })\n      .strict()\n      .optional(),\n  })\n  .strict()\n\n/**\n * The `<repo>` label of the dev alias (`<release>.<package>.<repo>.localhost`), in place of the main\n * checkout's directory name, to keep the host short. Taken verbatim, so it must already be a DNS label.\n */\nconst aliasRepoSchema = z\n  .string()\n  .regex(/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/, 'must be a DNS label: a-z, 0-9 and inner \"-\", at most 63 characters')\n\nexport const infraKitConfigObject = z\n  .object({\n    envManagement: envManagementSchema,\n    ide: idesSchema.optional(),\n    taskManager: taskManagerSchema.optional(),\n    worktrees: worktreesConfigSchema.optional(),\n    dev: devConfigSchema.optional(),\n    devServersPresets: devPresetsSchema.optional(),\n    protectedEnvs: protectedEnvsSchema.optional(),\n    mcp: mcpProxiesSchema.optional(),\n    vendorSource: vendorSourceSchema.nullable().optional(),\n    audit: auditRulesSchema.optional(),\n    aliasRepo: aliasRepoSchema.optional(),\n  })\n  .strict()\n\n/**\n * The portless proxy's listen port. `443` \u2014 the implicit HTTPS port \u2014 because that is the ONLY port that\n * can serve a port-free `https://<release>.<packageName>.<repo>.localhost` URL, which is the whole point.\n *\n * It is privileged, so the daemon must already be running: `infra-kit dev` PROBES it and never elevates\n * (portless binds `:443` by re-execing through `sudo` with an inherited stdio, which a detached child can\n * never answer). One-time, out-of-band: a root `portless service install`, which `dev` and `doctor` print\n * for the user as an absolute-path command (portless is not on `PATH`; see `formatPortlessCommand`). There\n * is deliberately no unprivileged fallback \u2014 a fallback puts the port back in the URL.\n *\n * Not a constant of convenience: it is the single value that decides the scheme, and TLS on 443 is\n * portless's own default (our previous `--no-tls` was the deviation).\n */\nexport const DEFAULT_DEV_PROXY_PORT = 443\n\n// Full schema = base object + a parse-time uniqueness check on the `ide` array.\n// This runs inside the *merged* `safeParse` in getInfraKitConfig, so it's the\n// gate for the final config. (The override layers use the `.partial()` form\n// below, which drops this object-level refinement \u2014 acceptable, the merged\n// parse is authoritative.)\nexport const infraKitConfigSchema = infraKitConfigObject.superRefine((cfg, ctx) => {\n  if (!Array.isArray(cfg.ide)) return\n\n  const seen = new Set<string>()\n\n  for (const entry of cfg.ide) {\n    if (seen.has(entry.provider)) {\n      ctx.addIssue({\n        code: 'custom',\n        message: 'each IDE provider may appear at most once',\n        path: ['ide'],\n      })\n\n      return\n    }\n\n    seen.add(entry.provider)\n  }\n})\n\nexport const infraKitOverrideConfigSchema = infraKitConfigObject.partial()\n\nexport type InfraKitConfig = z.infer<typeof infraKitConfigSchema>\n\n/** This project's access to the delivery-shaped environments. Absent in config means `'disallow'`. */\nexport type ProtectedEnvsSetting = z.infer<typeof protectedEnvsSchema>\n\n/** One `mcp.<name>` entry after parsing \u2014 defaults applied. */\nexport type McpProxySpec = z.infer<typeof mcpProxySchema>\nexport type McpProxies = z.infer<typeof mcpProxiesSchema>\n\nexport type VendorSourceConfig = z.infer<typeof vendorSourceSchema>\n\n/** The root `audit` block: `audit --root` rules layered over the root baseline. */\nexport type AuditRulesConfig = z.infer<typeof auditRulesSchema>\n\n/** Per-app dev-server overrides (`{ port?, prefixUrl? }`). */\nexport type DevAppConfig = z.infer<typeof devAppConfigSchema>\n\n/** The full `dev` section: a map of app folder name to its {@link DevAppConfig}. */\nexport type DevConfig = z.infer<typeof devConfigSchema>\n\n/** A proxy route's resolved source in a preset override (`'local' | 'cloud'`). */\nexport type ProxySource = z.infer<typeof proxySourceSchema>\n\n/** A single dev preset (`{ apps?, orca? }`) from the `devServersPresets` map. */\nexport type DevPreset = z.infer<typeof devPresetSchema>\n\n/** The `devServersPresets` map: preset name \u2192 {@link DevPreset}. */\nexport type DevPresets = z.infer<typeof devPresetsSchema>\n\n/** A single resolved IDE entry (`{ provider, config }`). */\nexport type ConfiguredIde = z.infer<typeof ideSchema>\n\n/**\n * Normalize the `ide` config (single object, array, or unset) into a flat list.\n * Validation-free: assumes already-parsed input (uniqueness is enforced by the\n * schema). The one source of truth for \"which editors are configured.\"\n *\n * @example\n * resolveConfiguredIdes({ ide: { provider: 'cursor', config: {...} } }) // => [cursor]\n * resolveConfiguredIdes({ ide: [cursor] })                              // => [cursor]\n * resolveConfiguredIdes({})                                             // => []\n */\nexport const resolveConfiguredIdes = (config: InfraKitConfig): ConfiguredIde[] => {\n  const ide = config.ide\n\n  if (!ide) return []\n\n  return Array.isArray(ide) ? ide : [ide]\n}\n\n/** An Orca pane layout preset (see {@link orcaLayouts}). */\nexport type OrcaLayout = (typeof orcaLayouts)[number]\n\n/** The layout applied when `worktrees.orca.layout` is left unset. */\nexport const DEFAULT_ORCA_LAYOUT: OrcaLayout = 'two-columns'\n\n/**\n * Resolve the Orca pane layout for opened worktree workspaces, falling back to\n * {@link DEFAULT_ORCA_LAYOUT} when unconfigured. The one source of truth for\n * \"which layout should the Orca opener build.\"\n *\n * @example\n * resolveOrcaLayout({ worktrees: { orca: { layout: 'three-pane' } } }) // => 'three-pane'\n * resolveOrcaLayout({})                                                // => 'two-columns'\n */\nexport const resolveOrcaLayout = (config: InfraKitConfig): OrcaLayout => {\n  return config.worktrees?.orca?.layout ?? DEFAULT_ORCA_LAYOUT\n}\n\nexport interface InfraKitConfigPaths {\n  /** Committed project config (required). */\n  main: string\n  /** User-scope global overrides applied to every project. */\n  userGlobal: string\n  /** User-scope per-project overrides \u2014 `<userProjectsDir>/<projectName>/infra-kit.json`. */\n  userProject: string\n  /** Repo basename (`path.basename(projectRoot)`) used to namespace the user-project file. */\n  projectName: string\n}\n\ninterface CacheEntry {\n  /** `cwd + homedir` \u2014 see {@link pathsCacheKey}. Required alongside `mtimes`: mtimes alone can\n   * collide across two different repo roots (or two homedirs), which would serve one repo's config\n   * to a request for another inside one process (a test suite, a `dev` session re-reading config). */\n  key: string\n  mtimes: Record<keyof Omit<InfraKitConfigPaths, 'projectName'>, number | null>\n  value: InfraKitConfig\n}\n\nlet cached: CacheEntry | null = null\n\ninterface PathsCacheEntry {\n  key: string\n  value: InfraKitConfigPaths\n}\n\n/**\n * Memo slot for {@link getInfraKitConfigPaths}. SINGLE-ENTRY, not a `Map`: the resolver's only\n * inputs are `process.cwd()` and `os.homedir()`, and production never mutates either (there is zero\n * `process.chdir` outside tests), so one key covers the whole process lifetime. A `Map` would buy\n * nothing there and could hand a chdir'ing test file a stale sibling entry; a single slot that\n * recomputes on key mismatch is strictly safer and identically fast.\n */\nlet cachedPaths: PathsCacheEntry | null = null\n\n/**\n * Cache key for {@link cachedPaths}. `homedir` is load-bearing, not decoration: the resolver reads\n * it directly, and a dozen test files swap it for a fresh `mkdtemp` home WITHOUT chdir'ing \u2014 a\n * cwd-only key would hand test B test A's already-deleted temp home.\n *\n * @example\n * pathsCacheKey() // => '/Users/arthur/projects/api /Users/arthur'\n */\nconst pathsCacheKey = (): string => {\n  return `${process.cwd()} ${os.homedir()}`\n}\n\n/**\n * `~/.infra-kit` \u2014 read `os.homedir()` on every call rather than at module load, because the tests\n * swap the homedir per case and a memoized value would leak one test's temp home into the next.\n *\n * @example\n * resolveUserConfigDir() // => '/Users/arthur/.infra-kit'\n */\nconst resolveUserConfigDir = (): string => {\n  return path.join(os.homedir(), USER_CONFIG_DIR_NAME)\n}\n\n/**\n * The user-global config layer, `~/.infra-kit/infra-kit.json`, without going through\n * {@link getInfraKitConfigPaths}. That resolver spawns `git rev-parse` and REJECTS outside a repo,\n * but this file is the one merge layer that exists independent of any project \u2014 the setup\n * migrations address it from wherever `infra-kit setup` was run.\n *\n * @example\n * resolveUserGlobalConfigPath() // => '/Users/arthur/.infra-kit/infra-kit.json'\n */\nexport const resolveUserGlobalConfigPath = (): string => {\n  return path.join(resolveUserConfigDir(), USER_GLOBAL_CONFIG_FILE)\n}\n\n/**\n * Resolve every file path that participates in the config merge chain. Always\n * returns paths even for files that don't yet exist, so callers can use them\n * for \"where would my override go?\" prompts.\n *\n * Memoized on `cwd + homedir` (see {@link cachedPaths}) because the two `git rev-parse` spawns below\n * run BEFORE the mtime cache in `getInfraKitConfig`, so without this every call paid for both. The\n * memo is populated on success only \u2014 `getProjectRoot` rejects outside a git repo and callers depend\n * on that rejection, so a cached rejection would be a stateful negative path. Cleared by\n * {@link resetInfraKitConfigCache}.\n *\n * Safe to memoize: this is a pure path resolver (inputs = cwd + homedir; it returns paths, never\n * file contents), so filesystem mutation cannot invalidate it.\n *\n * @example\n * const paths = await getInfraKitConfigPaths()\n * // {\n * //   main:        '/Users/arthur/projects/api/infra-kit.json',\n * //   userGlobal:  '/Users/arthur/.infra-kit/infra-kit.json',\n * //   userProject: '/Users/arthur/.infra-kit/projects/api/infra-kit.json',\n * //   projectName: 'api',\n * // }\n */\nexport const getInfraKitConfigPaths = async (): Promise<InfraKitConfigPaths> => {\n  const key = pathsCacheKey()\n\n  if (cachedPaths && cachedPaths.key === key) {\n    return cachedPaths.value\n  }\n\n  const projectRoot = await getProjectRoot()\n  // Namespace the per-project override on the MAIN repo root, not `projectRoot`.\n  // Inside a linked worktree `projectRoot` is the worktree's own path, so its\n  // basename is the worktree's leaf dir (e.g. `feature-x`), which would key the\n  // override to a different, per-worktree file. `getMainRepoRoot` resolves the\n  // shared git common dir so every worktree of a repo converges on one key. The\n  // second `git rev-parse` this costs is fine \u2014 the merged config is mtime-cached.\n  const mainRepoRoot = await getMainRepoRoot(projectRoot)\n  const projectName = path.basename(mainRepoRoot)\n\n  const value: InfraKitConfigPaths = {\n    main: path.join(projectRoot, INFRA_KIT_CONFIG_FILE),\n    userGlobal: resolveUserGlobalConfigPath(),\n    userProject: path.join(resolveUserConfigDir(), USER_PROJECTS_DIR, projectName, INFRA_KIT_CONFIG_FILE),\n    projectName,\n  }\n\n  // Populate only after both git calls RESOLVED \u2014 never cache a rejection.\n  cachedPaths = { key, value }\n\n  return value\n}\n\n/**\n * Read and validate `infra-kit.json`, with optional override layers shallow-merged\n * on top in this order (later wins):\n *   1. project `infra-kit.json`                            \u2014 committed source of truth\n *   2. `~/.infra-kit/infra-kit.json`                       \u2014 user-global defaults\n *   3. `~/.infra-kit/projects/<repo-name>/infra-kit.json`  \u2014 user-scope per-project overrides\n *\n * Top-level keys (entire capability sections like `ide`, `envManagement`)\n * replace wholesale. Results are cached per file mtimes, so repeated reads in one\n * process are free and an edit is still picked up on the next call.\n *\n * @example\n * // infra-kit.json:           { \"envManagement\": { \"provider\": \"doppler\", \"config\": { \"name\": \"p\" } } }\n * // ~/.infra-kit/infra-kit.json: { \"ide\": { \"provider\": \"cursor\", \"config\": { \"workspaceConfigPath\": \"./ws.code-workspace\" } } }\n * const cfg = await getInfraKitConfig()\n * // => { envManagement: {...}, ide: { provider: 'cursor', config: { workspaceConfigPath: './ws.code-workspace' } } }\n * @example\n * // A reader whose stderr nobody watches: a retired key must fail as it does today, never be rewritten.\n * await getInfraKitConfig({ autoMigrate: 'off' })\n */\nexport const getInfraKitConfig = async (options: GetInfraKitConfigOptions = {}): Promise<InfraKitConfig> => {\n  const autoMigrate = options.autoMigrate ?? 'write'\n  const key = pathsCacheKey()\n  const paths = await getInfraKitConfigPaths()\n\n  let mainStat: Awaited<ReturnType<typeof fs.stat>>\n\n  try {\n    mainStat = await fs.stat(paths.main)\n  } catch {\n    cached = null\n\n    // Bridge the YAML\u2192JSON cutover: if a legacy infra-kit.yml is sitting where\n    // the JSON config should be, point the user at the one-shot migration.\n    const legacyYmlPath = paths.main.replace(/\\.json$/, '.yml')\n\n    if (await statIfExists(legacyYmlPath)) {\n      throw new Error(\n        `infra-kit.json not found at ${paths.main}. A legacy infra-kit.yml exists \u2014 run \\`infra-kit setup --skip-tools\\` to convert it.`,\n      )\n    }\n\n    throw new Error(\n      isAgentMode()\n        ? `infra-kit.json not found at ${paths.main} \u2014 the working directory is not an infra-kit project. Run infra-kit from inside an infra-kit project repo, or pass \\`-C <dir>\\` naming one.`\n        : `infra-kit.json not found at ${paths.main} \u2014 this git repo is not an infra-kit project. Run \\`infra-kit setup --skip-tools\\` here to create it, cd into an infra-kit project repo, or check out a branch that has infra-kit.json.`,\n    )\n  }\n\n  const [userGlobalStat, userProjectStat] = await Promise.all([\n    statIfExists(paths.userGlobal),\n    statIfExists(paths.userProject),\n  ])\n\n  const mtimes = {\n    main: Number(mainStat.mtimeMs),\n    userGlobal: userGlobalStat ? Number(userGlobalStat.mtimeMs) : null,\n    userProject: userProjectStat ? Number(userProjectStat.mtimeMs) : null,\n  }\n\n  if (cached && cached.key === key && shallowEqual(cached.mtimes, mtimes)) {\n    return cached.value\n  }\n\n  const layers: ConfigLayer[] = [\n    { label: 'infra-kit.json', path: paths.main, required: true, autoMigrate, mtimeMs: mtimes.main },\n    {\n      label: '~/.infra-kit/infra-kit.json',\n      path: paths.userGlobal,\n      required: false,\n      autoMigrate,\n      mtimeMs: mtimes.userGlobal,\n    },\n    {\n      label: `~/.infra-kit/projects/${paths.projectName}/infra-kit.json`,\n      path: paths.userProject,\n      required: false,\n      autoMigrate,\n      mtimeMs: mtimes.userProject,\n    },\n  ]\n\n  let merged: Record<string, unknown> = {}\n\n  for (const layer of layers) {\n    const data = await loadLayer(layer)\n\n    if (data === null) continue\n\n    merged = { ...merged, ...data }\n  }\n\n  const finalResult = infraKitConfigSchema.safeParse(merged)\n\n  if (!finalResult.success) {\n    throw new Error(`Invalid merged infra-kit config: ${z.prettifyError(finalResult.error)}`)\n  }\n\n  // No reset after an auto-migration: `mtimes` were stat'ed before `loadLayer` rewrote the file, so\n  // this entry's fingerprint is already stale and the next read is exactly one guaranteed miss.\n  cached = { key, mtimes, value: finalResult.data }\n\n  return finalResult.data\n}\n\n/**\n * Drop ONLY the merged-config cache ({@link cached}), keeping the path memo ({@link cachedPaths})\n * intact. For writers of a merge layer \u2014 the config bootstrap, which creates the layer-3\n * `~/.infra-kit/projects/<repo>/infra-kit.json`.\n *\n * WHY this exists separately from {@link resetInfraKitConfigCache}: writing the layer-3 file changes\n * the MERGE RESULT (a stale merged config would miss the new layer) but it cannot change the\n * RESOLVED PATHS \u2014 those are a pure function of `cwd + homedir`, and creating a file mutates\n * neither. Blowing away the path memo there would just make the very run that creates the file\n * re-spawn both `git rev-parse` processes for nothing: 4 spawns instead of 2.\n *\n * @example\n * await fs.writeFile(paths.userProject, '{}\\n', 'utf-8')\n * resetMergedConfigCache()\n * await getInfraKitConfig()      // sees the new layer-3 layer\n * await getInfraKitConfigPaths() // still served from the memo \u2014 zero extra git spawns\n */\nexport const resetMergedConfigCache = (): void => {\n  cached = null\n}\n\n/**\n * For tests \u2014 drops BOTH in-memory caches: the mtime-fingerprinted merged config and the\n * `cwd + homedir`-keyed path memo ({@link cachedPaths}). The next read re-spawns `git rev-parse`\n * and re-hits disk. Production writers want the narrower {@link resetMergedConfigCache}.\n *\n * @example\n * resetInfraKitConfigCache()\n * await getInfraKitConfig() // re-resolves paths and re-reads files even if mtimes look unchanged\n */\nexport const resetInfraKitConfigCache = (): void => {\n  cached = null\n  cachedPaths = null\n}\n\n/**\n * `fs.stat` that returns `null` instead of throwing on ENOENT. Used so the\n * resolver can probe optional files in the merge chain without try/catch noise.\n *\n * @example\n * const stat = await statIfExists('/does/not/exist') // => null\n */\nconst statIfExists = async (filePath: string): Promise<Awaited<ReturnType<typeof fs.stat>> | null> => {\n  try {\n    return await fs.stat(filePath)\n  } catch {\n    return null\n  }\n}\n\n/**\n * `fs.readFile` that returns `null` instead of throwing on ENOENT.\n *\n * @example\n * const raw = await readIfExists('/missing.json') // => null\n * const raw = await readIfExists('/exists.json')  // => '{ \"environments\": [\"dev\"] }\\n'\n */\nconst readIfExists = async (filePath: string): Promise<string | null> => {\n  try {\n    return await fs.readFile(filePath, 'utf-8')\n  } catch {\n    return null\n  }\n}\n\n/**\n * Reference-equality comparison of every key in two flat records. Used to\n * cheaply detect whether the cached mtime fingerprint still matches.\n *\n * @example\n * shallowEqual({ a: 1, b: 2 }, { a: 1, b: 2 }) // => true\n * shallowEqual({ a: 1 },       { a: 1, b: 2 }) // => false\n * shallowEqual({ a: 1 },       { a: 2 })       // => false\n */\nconst shallowEqual = <T extends Record<string, unknown>>(a: T, b: T): boolean => {\n  const keys = Object.keys(a)\n\n  if (keys.length !== Object.keys(b).length) return false\n\n  return keys.every((k) => {\n    return a[k] === b[k]\n  })\n}\n\nexport interface GetInfraKitConfigOptions {\n  /**\n   * 'write' (default): a layer the strict schema refuses may be migrated and rewritten on disk.\n   * 'off': never write \u2014 throw today's strict error. For callers whose stderr nobody reads.\n   */\n  autoMigrate?: 'write' | 'off'\n}\n\ninterface ConfigLayer {\n  label: string\n  path: string\n  required: boolean\n  autoMigrate: 'write' | 'off'\n  /**\n   * The mtime stat'ed BEFORE the layer is read. A migration that rewrites the file compares against\n   * it so a concurrent editor's save between read and write is never clobbered; `null` when the\n   * optional layer did not exist at stat time.\n   */\n  mtimeMs: number | null\n}\n\n/**\n * The CI wording for a required layer the strict schema refused: the checkout is ephemeral, so the\n * fix has to land on the branch rather than on this machine.\n *\n * @example\n * withSetupHint(new Error('Invalid infra-kit.json at /r/infra-kit.json: Unrecognized key: \"environments\"')).message\n * // => 'Invalid infra-kit.json at /r/infra-kit.json: Unrecognized key: \"environments\"\\nA retired key on this branch \u2014 run `infra-kit setup --skip-tools` in this checkout and commit infra-kit.json.'\n */\nexport const withSetupHint = (error: Error): Error => {\n  return new Error(\n    `${error.message}\\nA retired key on this branch \u2014 run \\`infra-kit setup --skip-tools\\` in this checkout and commit infra-kit.json.`,\n  )\n}\n\n/**\n * Read a single layer of the merge chain: parse the JSON if the file exists\n * and validate it against the override schema. Returns `null` if an optional\n * layer is missing; throws if the layer is required, malformed, or invalid.\n * An empty/whitespace-only file is treated as `{}` (JSON.parse would throw).\n *\n * A strict-schema refusal is retried once through {@link tryAutoMigrateLayer}\n * (retired keys deleted and the file rewritten) before the error is thrown.\n *\n * @example\n * await loadLayer({ label: '~/.infra-kit/infra-kit.json', path: '/missing.json', required: false, autoMigrate: 'write', mtimeMs: null })\n * // => null\n * @example\n * // /home/me/.infra-kit/infra-kit.json: '{ \"ide\": { \"provider\": \"cursor\", \"config\": { \"workspaceConfigPath\": \"./ws.code-workspace\" } } }'\n * await loadLayer({ label: '~/.infra-kit/infra-kit.json', path: '/home/me/.infra-kit/infra-kit.json', required: false, autoMigrate: 'write', mtimeMs: 1700000000000 })\n * // => { ide: { provider: 'cursor', config: { workspaceConfigPath: './ws.code-workspace' } } }\n */\nconst loadLayer = async (layer: ConfigLayer): Promise<Record<string, unknown> | null> => {\n  const raw = await readIfExists(layer.path)\n\n  if (raw === null) {\n    if (layer.required) {\n      throw new Error(`${layer.label} not found at ${layer.path}`)\n    }\n\n    return null\n  }\n\n  let parsedRaw: unknown\n\n  try {\n    parsedRaw = raw.trim() === '' ? {} : JSON.parse(raw)\n  } catch (err) {\n    throw new Error(`Invalid JSON in ${layer.label} at ${layer.path}: ${(err as Error).message}`)\n  }\n\n  // `envTokens` is ALREADY rejected below \u2014 the override schema keeps `.strict()`, so it lands as a\n  // generic `unrecognized_keys` issue. That generic message is wrong for this one key: the user has\n  // pasted a live Doppler service token into a file that may be committed, backed up by their editor,\n  // or opened by `config edit`. The first instruction has to be REVOKE, not \"fix your config\". Narrow\n  // by construction \u2014 every other unknown key keeps the generic error.\n  if (isRecord(parsedRaw) && 'envTokens' in parsedRaw) {\n    throw new Error(buildEnvTokensRejectionMessage(layer))\n  }\n\n  if (!layer.required && isRecord(parsedRaw)) {\n    assertNoProjectLayerOnlyKeys(layer, parsedRaw)\n  }\n\n  const result = infraKitOverrideConfigSchema.safeParse(parsedRaw)\n\n  if (result.success) {\n    return result.data as Record<string, unknown>\n  }\n\n  const originalError = new Error(`Invalid ${layer.label} at ${layer.path}: ${z.prettifyError(result.error)}`)\n\n  // The retry needs an object to migrate and the pre-read mtime as the stale-write baseline. A\n  // `null` mtime here means the file did not exist when `getInfraKitConfig` stat'ed it and appeared\n  // before the read above \u2014 with no baseline the rewrite could clobber whoever just created it, so\n  // that race keeps the strict error.\n  if (!isRecord(parsedRaw) || layer.mtimeMs === null) {\n    throw originalError\n  }\n\n  const outcome = await tryAutoMigrateLayer({ ...layer, mtimeMs: layer.mtimeMs }, parsedRaw, raw, {\n    schema: infraKitOverrideConfigSchema,\n  })\n\n  switch (outcome.kind) {\n    case 'migrated':\n      return outcome.data\n    case 'ci-gated':\n      throw withSetupHint(originalError)\n    case 'not-applicable':\n      throw originalError\n    default:\n      return assertNever(outcome)\n  }\n}\n\n/**\n * Why `mcp` cannot live in this layer, and where the two things a developer might have wanted go\n * instead: the project file for a shared server, Claude Code's own local scope for a machine-only\n * override (which shadows the project entry by name and needs no infra-kit involvement).\n */\nexport const buildMcpLayerRejectionMessage = (layer: Omit<ConfigLayer, 'autoMigrate' | 'mtimeMs'>): string => {\n  return [\n    `\"mcp\" is not allowed in ${layer.label} (${layer.path}): it feeds the committed .mcp.json, so a per-machine copy would replace the project's servers for everyone.`,\n    'Move the block to the project infra-kit.json and run `infra-kit setup`.',\n    'For a machine-only override of one server (e.g. a local fork), use Claude Code directly:',\n    '  claude mcp add --scope local <name> -- ik-mcp --name <name> --env <VAR> ... -- <command> <args>',\n    '(local scope shadows the project entry by name; `claude mcp list` will show a same-name conflict warning, which is expected).',\n  ].join('\\n')\n}\n\nconst buildVendorSourceLayerRejectionMessage = (layer: Omit<ConfigLayer, 'autoMigrate' | 'mtimeMs'>): string => {\n  return [\n    `\"vendorSource\" is not allowed in ${layer.label} (${layer.path}): only the committed project file may mark a repository as the \\`vendor sync\\` source. In the machine-wide file it would make every repository on this machine a source; in a per-project override it would make this machine disagree with every other clone.`,\n    \"Move the block to the source repository's own infra-kit.json and commit it there.\",\n  ].join('\\n')\n}\n\nconst buildAuditLayerRejectionMessage = (layer: Omit<ConfigLayer, 'autoMigrate' | 'mtimeMs'>): string => {\n  return [\n    `\"audit\" is not allowed in ${layer.label} (${layer.path}): the root audit gates CI, so a per-machine copy would make this machine pass or fail a different check list than CI.`,\n    'Move the block to the project infra-kit.json and commit it there.',\n  ].join('\\n')\n}\n\nconst buildAliasRepoLayerRejectionMessage = (layer: Omit<ConfigLayer, 'autoMigrate' | 'mtimeMs'>): string => {\n  return [\n    `\"aliasRepo\" is not allowed in ${layer.label} (${layer.path}): the vite and Playwright helpers read it from the project infra-kit.json only, so a per-machine copy would register a dev host they never aim at.`,\n    'Move it to the project infra-kit.json and commit it there.',\n  ].join('\\n')\n}\n\ntype LayerRejectionMessageBuilder = (layer: Omit<ConfigLayer, 'autoMigrate' | 'mtimeMs'>) => string\n\n/**\n * Keys only the committed project layer may carry. `mcp` feeds the committed `.mcp.json`, and the\n * shallow layer merge would let a per-machine block replace the project's wholesale and then be\n * derived into the shared file. `vendorSource` decides which repo is the sync source. `audit` is\n * what CI enforces at the root. `aliasRepo` names the dev host, which the helpers read from the project\n * file alone.\n */\nconst PROJECT_LAYER_ONLY_KEYS: Readonly<Record<string, LayerRejectionMessageBuilder>> = {\n  aliasRepo: buildAliasRepoLayerRejectionMessage,\n  mcp: buildMcpLayerRejectionMessage,\n  vendorSource: buildVendorSourceLayerRejectionMessage,\n  audit: buildAuditLayerRejectionMessage,\n}\n\n// Refused loudly rather than silently ignored: each key's message says why a per-machine copy is\n// wrong and where the block belongs instead.\nconst assertNoProjectLayerOnlyKeys = (\n  layer: Omit<ConfigLayer, 'autoMigrate' | 'mtimeMs'>,\n  parsedRaw: Record<string, unknown>,\n): void => {\n  for (const [key, buildMessage] of Object.entries(PROJECT_LAYER_ONLY_KEYS)) {\n    if (key in parsedRaw) {\n      throw new Error(buildMessage(layer))\n    }\n  }\n}\n\n/**\n * Narrow parsed JSON to a plain object so a key probe is safe (JSON's top level may be an array, a\n * string, or `null`).\n *\n * @example\n * isRecord({ envTokens: {} }) // => true\n * isRecord(['envTokens'])     // => false\n * isRecord(null)              // => false\n */\nconst isRecord = (value: unknown): value is Record<string, unknown> => {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n\n/**\n * The REVOKE-first refusal for a service token found in an `infra-kit.json`. Ordered by urgency: the\n * credential is already exposed, so revoking it beats editing the file. Tokens live in a SIBLING\n * `tokens.json` (0600) that this loader never reads \u2014 see `lib/env-tokens`.\n *\n * @example\n * buildEnvTokensRejectionMessage({ label: 'infra-kit.json', path: '/r/infra-kit.json', required: true })\n * // => 'Refusing to load infra-kit.json \u2014 `envTokens` is not a config key. \u2026'\n */\nconst buildEnvTokensRejectionMessage = (layer: Omit<ConfigLayer, 'autoMigrate' | 'mtimeMs'>): string => {\n  return [\n    `Refusing to load ${layer.label} \u2014 \\`envTokens\\` is not a config key.`,\n    'A service token in a config file can be committed, backed up by your editor, or shared.',\n    '  1. REVOKE the token in Doppler now \u2014 treat it as compromised.',\n    `  2. Remove the \\`envTokens\\` key from ${layer.path}.`,\n    '  3. Re-add it privately: `infra-kit env-token-set <env>`',\n    '     (it is written to ~/.infra-kit/projects/<repo>/tokens.json, mode 0600, never to the repo).',\n  ].join('\\n')\n}\n", "/**\n * Exhaustiveness guard for discriminated unions. Place in the `default` branch of\n * a `switch` over a union: once every case is handled the argument narrows to\n * `never`, so adding a new variant later turns this into a compile error.\n *\n * @example\n * switch (source) {\n *   case 'local': return resolveLocal()\n *   case 'cloud': return resolveCloud()\n *   default: return assertNever(source) // compile error if a source is unhandled\n * }\n */\nexport const assertNever = (value: never): never => {\n  throw new Error(`Unexpected value: ${JSON.stringify(value)}`)\n}\n", "export const omitKey = (record: Record<string, unknown>, key: string): Record<string, unknown> => {\n  return Object.fromEntries(\n    Object.entries(record).filter(([entryKey]) => {\n      return entryKey !== key\n    }),\n  )\n}\n", "import type { ConfigMigration } from '../types'\nimport { omitKey } from './omit-key'\n\n/**\n * A migration that removes one top-level key, whatever its value: the strict schema refuses the key\n * regardless, so inspecting the value would only add a way for the migration to disagree with it.\n */\nexport const dropTopLevelKey = ({ key, id, note }: { key: string; id: string; note: string }): ConfigMigration => {\n  return {\n    id,\n    note,\n    apply: (parsed) => {\n      if (!(key in parsed)) return { changed: false, result: parsed }\n\n      return { changed: true, result: omitKey(parsed, key) }\n    },\n  }\n}\n", "import { dropTopLevelKey } from './drop-top-level-key'\n\nexport const dropDevProxyKeyMigration = dropTopLevelKey({\n  key: 'devProxy',\n  id: 'drop-dev-proxy-key',\n  note: 'the retired \"devProxy\" key (dev URLs are port-free https://<release>.<package>.localhost)',\n})\n", "import { dropTopLevelKey } from './drop-top-level-key'\n\nexport const dropEnvAutoLoadKeyMigration = dropTopLevelKey({\n  key: 'envAutoLoad',\n  id: 'drop-env-auto-load-key',\n  note: 'the retired \"envAutoLoad\" key (env auto-load is gone \u2014 run `env-load -c <config>` in the terminal)',\n})\n", "import { dropTopLevelKey } from './drop-top-level-key'\n\nexport const dropEnvironmentsKeyMigration = dropTopLevelKey({\n  key: 'environments',\n  id: 'drop-environments-key',\n  note: 'the retired \"environments\" key (deploy targets now come from each workflow\\'s workflow_dispatch options, auth from the token store)',\n})\n", "import type { ConfigMigration } from '../types'\nimport { omitKey } from './omit-key'\n\n// `ide.config.mode` chose the per-window attach style; the windows removal left one style, so the\n// key is dead and the strict `ideConfigSchema` refuses it. Handles both the single-provider and\n// the array form.\nconst stripLegacyIdeMode: ConfigMigration['apply'] = (parsed) => {\n  const ide = parsed.ide\n\n  if (ide === null || typeof ide !== 'object') {\n    return { changed: false, result: parsed }\n  }\n\n  let changed = false\n\n  const stripEntry = (entry: unknown): unknown => {\n    if (entry === null || typeof entry !== 'object' || !('config' in entry)) {\n      return entry\n    }\n\n    const config = (entry as { config: unknown }).config\n\n    if (config === null || typeof config !== 'object' || !('mode' in config)) {\n      return entry\n    }\n\n    changed = true\n\n    return { ...(entry as Record<string, unknown>), config: omitKey(config as Record<string, unknown>, 'mode') }\n  }\n\n  const nextIde = Array.isArray(ide) ? ide.map(stripEntry) : stripEntry(ide)\n\n  if (!changed) {\n    return { changed: false, result: parsed }\n  }\n\n  return { changed: true, result: { ...parsed, ide: nextIde } }\n}\n\nexport const stripLegacyIdeModeMigration: ConfigMigration = {\n  id: 'strip-legacy-ide-mode',\n  note: 'legacy \"mode\"',\n  apply: stripLegacyIdeMode,\n}\n", "import type { ConfigMigration } from '../types'\nimport { omitKey } from './omit-key'\n\nconst RETIRED_IDE_PROVIDER = 'zed'\n\nconst isRetiredIdeEntry = (entry: unknown): boolean => {\n  return (\n    entry !== null && typeof entry === 'object' && (entry as { provider?: unknown }).provider === RETIRED_IDE_PROVIDER\n  )\n}\n\n// An array that held only Zed loses the `ide` key outright: `ide: []` fails the schema's `.min(1)`,\n// and it means \"no editor\" anyway.\nconst stripRetiredZedIde: ConfigMigration['apply'] = (parsed) => {\n  const ide = parsed.ide\n\n  if (Array.isArray(ide)) {\n    const kept = ide.filter((entry) => {\n      return !isRetiredIdeEntry(entry)\n    })\n\n    if (kept.length === ide.length) return { changed: false, result: parsed }\n\n    return { changed: true, result: kept.length > 0 ? { ...parsed, ide: kept } : omitKey(parsed, 'ide') }\n  }\n\n  if (isRetiredIdeEntry(ide)) return { changed: true, result: omitKey(parsed, 'ide') }\n\n  return { changed: false, result: parsed }\n}\n\nexport const stripRetiredZedIdeMigration: ConfigMigration = {\n  id: 'strip-retired-zed-ide',\n  note: 'the retired \"zed\" provider',\n  apply: stripRetiredZedIde,\n}\n", "import { dropDevProxyKeyMigration } from './migrations/drop-dev-proxy-key'\nimport { dropEnvAutoLoadKeyMigration } from './migrations/drop-env-auto-load-key'\nimport { dropEnvironmentsKeyMigration } from './migrations/drop-environments-key'\nimport { stripLegacyIdeModeMigration } from './migrations/strip-legacy-ide-mode'\nimport { stripRetiredZedIdeMigration } from './migrations/strip-retired-zed-ide'\nimport type { ConfigMigration } from './types'\n\n/**\n * Applied in this order \u2014 the order the \"removed \u2026\" notes are printed in. Each step deletes a\n * disjoint shape, so the order is not load-bearing for the result; it is fixed so the note line is\n * stable across runs.\n */\nexport const CONFIG_MIGRATIONS: readonly ConfigMigration[] = [\n  stripLegacyIdeModeMigration,\n  stripRetiredZedIdeMigration,\n  dropEnvironmentsKeyMigration,\n  dropDevProxyKeyMigration,\n  dropEnvAutoLoadKeyMigration,\n]\n", "import { CONFIG_MIGRATIONS } from './registry'\nimport type { MigrationResult } from './types'\n\n/**\n * Fold the registry over a parsed config. Pure: the input is never mutated, and when no step\n * changes anything the returned `result` IS the input reference, so a caller can `===` it to skip\n * a rewrite. Idempotent by construction \u2014 every step is delete-only, so a second pass finds\n * nothing to delete.\n */\nexport const applyConfigMigrations = (parsed: Record<string, unknown>): MigrationResult => {\n  return CONFIG_MIGRATIONS.reduce<MigrationResult>(\n    (acc, migration) => {\n      const step = migration.apply(acc.result)\n\n      if (!step.changed) return acc\n\n      return { changed: true, result: step.result, notes: [...acc.notes, migration.note] }\n    },\n    { changed: false, result: parsed, notes: [] },\n  )\n}\n", "import fs from 'node:fs/promises'\nimport os from 'node:os'\n\n/**\n * Shared path-display helpers for CLI output. Extracted from `commands/config`\n * and `commands/init/migrate-config` (which each had private copies) so config\n * surfaces print paths consistently. Keep this dependency-light (node builtins\n * only) \u2014 it is imported by several commands.\n */\n\n/**\n * Resolve whether a file is reachable, suppressing ENOENT (and any access error)\n * into a boolean. Used to render `[\u2713]`/`[ ]` existence markers.\n *\n * @example\n * await fileExists('/etc/hosts') // => true\n * await fileExists('/nope.txt')  // => false\n */\nexport const fileExists = async (filePath: string): Promise<boolean> => {\n  try {\n    await fs.access(filePath)\n\n    return true\n  } catch {\n    return false\n  }\n}\n\n/**\n * Replace the user's home prefix with `~` so logged paths stay short and portable\n * across machines. Leaves non-home paths untouched.\n *\n * @example\n * // os.homedir() === '/Users/arthur'\n * tildify('/Users/arthur/.infra-kit/infra-kit.json') // => '~/.infra-kit/infra-kit.json'\n * tildify('/etc/hosts')                              // => '/etc/hosts'\n */\nexport const tildify = (filePath: string): string => {\n  const home = os.homedir()\n\n  return filePath.startsWith(home) ? `~${filePath.slice(home.length)}` : filePath\n}\n", "import { randomBytes } from 'node:crypto'\nimport fs from 'node:fs/promises'\nimport path from 'node:path'\nimport process from 'node:process'\n\nimport { applyConfigMigrations } from './apply-config-migrations'\nimport type { MigrationResult } from './types'\n\n/**\n * The target was modified between the caller's read and this write. Rewriting it would clobber a\n * human's (or another process's) edit with bytes derived from a stale read; the caller retries from\n * the fresh file on its next run instead.\n */\nexport class ConfigFileChangedError extends Error {\n  constructor(filePath: string) {\n    super(`${filePath} changed on disk since it was read`)\n    this.name = 'ConfigFileChangedError'\n  }\n}\n\nexport interface WriteMigratedConfigFileOptions {\n  path: string\n  /** The bytes the caller read \u2014 only the indentation is taken from them. */\n  raw: string\n  migrated: Record<string, unknown>\n  /** `mtimeMs` observed when `raw` was read; the stale-read guard compares against it. */\n  expectedMtimeMs: number\n}\n\nexport interface FileMigrationResult extends MigrationResult {\n  path: string\n}\n\nconst DEFAULT_INDENT = 2\n\n// The first indented line decides, so a hand-edited 4-space file is not reformatted wholesale.\nconst detectIndent = (raw: string): string | number => {\n  return /^([ \\t]+)\\S/m.exec(raw)?.[1] ?? DEFAULT_INDENT\n}\n\n// Group / other permission bits and the setuid/sticky family; the file-type bits above them are not\n// chmod's business.\nconst PERMISSION_BITS = 0o7777\n\n/**\n * Serialise `migrated` over `path` \u2014 atomically, keeping the file's mode and indentation, and\n * refusing when the file moved on since it was read. Never applies the registry: the caller has\n * already done that (the loader on its retry, {@link migrateConfigFile} on the setup path), so\n * the registry runs exactly once per file whichever way in. Does not log \u2014 each caller owns its\n * own line. Throws on any fs error; callers decide.\n *\n * The rename goes over the realpath'd target, so a symlinked `~/.infra-kit/infra-kit.json`\n * (dotfiles repo) keeps its symlink and the link target is what gets replaced \u2014 `writeFile`\n * follows a link implicitly, `rename` would replace the link itself.\n */\nexport const writeMigratedConfigFile = async ({\n  path: filePath,\n  raw,\n  migrated,\n  expectedMtimeMs,\n}: WriteMigratedConfigFileOptions): Promise<void> => {\n  const target = await fs.realpath(filePath)\n  const dir = path.dirname(target)\n  const base = path.basename(target)\n  // pid + random: two racing CLIs never share a tmp name, and a reader never sees a torn file.\n  const tmp = path.join(dir, `.${base}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`)\n  const content = `${JSON.stringify(migrated, null, detectIndent(raw))}\\n`\n\n  try {\n    await fs.writeFile(tmp, content, 'utf8')\n\n    // Re-stat as late as possible: the window between this check and the rename is the smallest\n    // this process can make it.\n    const stat = await fs.stat(target)\n\n    if (stat.mtimeMs !== expectedMtimeMs) {\n      throw new ConfigFileChangedError(filePath)\n    }\n\n    // writeFile's mode is umask-masked; chmod sets the original bits exactly (0600 stays 0600).\n    await fs.chmod(tmp, stat.mode & PERMISSION_BITS)\n    await fs.rename(tmp, target)\n  } catch (err) {\n    await fs.rm(tmp, { force: true })\n    throw err\n  }\n}\n\nconst isRecord = (value: unknown): value is Record<string, unknown> => {\n  return value !== null && typeof value === 'object' && !Array.isArray(value)\n}\n\n/**\n * Setup path: stat + read + {@link applyConfigMigrations} + {@link writeMigratedConfigFile}. An\n * empty (or whitespace-only) file is a no-op rather than a JSON error \u2014 an empty layer is a valid\n * \"nothing to override\". Throws on read/parse/write errors, including {@link ConfigFileChangedError}.\n */\nexport const migrateConfigFile = async (filePath: string): Promise<FileMigrationResult> => {\n  const stat = await fs.stat(filePath)\n  const raw = await fs.readFile(filePath, 'utf8')\n\n  if (raw.trim() === '') {\n    return { changed: false, result: {}, notes: [], path: filePath }\n  }\n\n  const parsed: unknown = JSON.parse(raw)\n\n  if (!isRecord(parsed)) {\n    return { changed: false, result: {}, notes: [], path: filePath }\n  }\n\n  const migrated = applyConfigMigrations(parsed)\n\n  if (migrated.changed) {\n    await writeMigratedConfigFile({ path: filePath, raw, migrated: migrated.result, expectedMtimeMs: stat.mtimeMs })\n  }\n\n  return { ...migrated, path: filePath }\n}\n", "import type { z } from 'zod'\n\nimport { isCI } from 'src/lib/agent-mode'\nimport { logger } from 'src/lib/logger'\nimport { tildify } from 'src/lib/path-display'\n\nimport packageJson from '../../../package.json' with { type: 'json' }\nimport { applyConfigMigrations } from './apply-config-migrations'\nimport { writeMigratedConfigFile } from './migrate-config-file'\n\n/** The slice of the loader's `ConfigLayer` the retry needs; passed in so this module never imports the loader (cycle). */\nexport interface AutoMigrateLayer {\n  path: string\n  /** The tracked project layer \u2014 the only one a CI checkout must not rewrite. */\n  required: boolean\n  /** `'off'` for callers whose stderr nobody reads; they keep today's strict error instead of a rewritten file. */\n  autoMigrate: 'write' | 'off'\n  /** From the stat the loader already took before reading \u2014 the stale-read guard's baseline. */\n  mtimeMs: number\n}\n\nexport type AutoMigrateOutcome =\n  /** `data` is the second `safeParse`'s output (defaults applied), never the raw migrated object. */\n  | { kind: 'migrated'; data: Record<string, unknown> }\n  /** A migration WOULD fix the required layer, but CI withholds the write \u2014 the caller appends its setup hint. */\n  | { kind: 'ci-gated' }\n  /** Policy off, nothing to migrate, still invalid afterwards, file moved, or the write failed: the caller throws its original error. */\n  | { kind: 'not-applicable' }\n\n/**\n * The loader's retry after the strict schema refused a layer: migrate in memory, prove the result\n * parses, write it back, and only then hand the parsed value over \u2014 a migrated value is never\n * returned without the file on disk matching it. Ordered so the CI gate fires only when a migration\n * would actually have fixed the file (a layer with a second, real problem gets the original error\n * naming every unrecognized key, with no misleading hint).\n *\n * `warn`, not `info`, for the one stderr line: `--json` lowers the logger to `warn` and the line\n * must still land \u2014 it is the only signal that a tracked file just gained a hunk to commit.\n */\nexport const tryAutoMigrateLayer = async (\n  layer: AutoMigrateLayer,\n  parsedRaw: Record<string, unknown>,\n  raw: string,\n  { schema }: { schema: z.ZodType },\n): Promise<AutoMigrateOutcome> => {\n  if (layer.autoMigrate === 'off') {\n    return { kind: 'not-applicable' }\n  }\n\n  const migrated = applyConfigMigrations(parsedRaw)\n\n  if (!migrated.changed) {\n    return { kind: 'not-applicable' }\n  }\n\n  const second = schema.safeParse(migrated.result)\n\n  if (!second.success) {\n    return { kind: 'not-applicable' }\n  }\n\n  if (layer.required && isCI()) {\n    return { kind: 'ci-gated' }\n  }\n\n  try {\n    await writeMigratedConfigFile({\n      path: layer.path,\n      raw,\n      migrated: migrated.result,\n      expectedMtimeMs: layer.mtimeMs,\n    })\n  } catch (err) {\n    logger.debug(err, `auto-migration could not rewrite ${layer.path}`)\n\n    return { kind: 'not-applicable' }\n  }\n\n  logger.warn(\n    `Migrated ${tildify(layer.path)}: removed ${migrated.notes.join(' and ')} (retired by infra-kit ${packageJson.version})`,\n  )\n\n  return { kind: 'migrated', data: second.data as Record<string, unknown> }\n}\n", "import { OperationError } from './operation-error'\nimport type { OperationErrorContext } from './operation-error'\n\n/**\n * Why the command stopped, for a machine reader. `exitCode` 2 means nothing happened \u2014 re-run with\n * more; 1 means something happened and part of it failed.\n */\nexport type RefusalStatus = 'confirmation_required' | 'argument_required' | 'partial_failure' | 'refused'\n\nexport interface RefusalStructuredContent {\n  status: RefusalStatus\n  [k: string]: unknown\n}\n\n/**\n * A refusal that carries a payload for an agent: `entry/cli.ts` emits `structuredContent` under\n * `--json` and exits with `exitCode`. The message is the ordinary `OperationError` one\n * (operation / stderr / remediation), so the human-readable line loses nothing.\n *\n * @example\n * throw new StructuredRefusalError(\n *   { status: 'argument_required', argument: 'version', agentMode: 'flag' },\n *   2,\n *   { operation: 'interactive prompt', remediation: 'pass --version' },\n * )\n */\n// Extends `OperationError`, not `Error`, ON PURPOSE. Seven of the eight confirm sites sit under a\n// handler-level `catch` that passes through only `isPromptCancellation`, `isCommandDeclined` and\n// `instanceof OperationError` and REWRAPS everything else into a generic `OperationError`\n// (`release-remove.ts` near the `gh auth status` remediation, `worktrees-add.ts`, `worktrees-sync.ts`,\n// `release-create.ts`). A plain `Error` subclass would lose the payload and the exit code at exactly\n// the sites this exists for.\nexport class StructuredRefusalError extends OperationError {\n  readonly structuredContent: RefusalStructuredContent\n  readonly exitCode: 1 | 2\n\n  constructor(structuredContent: RefusalStructuredContent, exitCode: 1 | 2, context: OperationErrorContext) {\n    super(undefined, context)\n    this.name = 'StructuredRefusalError'\n    this.structuredContent = structuredContent\n    this.exitCode = exitCode\n  }\n}\n"],
+  "mappings": "0IAoBA,OAAOA,OAAa,eCnBpB,OAAOC,OAAa,eAcb,IAAMC,EAAa,CAAE,QAAS,EAAM,EAO9BC,GAAO,CAClBC,EACAC,EAAiCC,GAAS,CACxCL,GAAQ,OAAO,MAAMK,CAAI,CAC3B,KAEIJ,EAAW,SAAWE,GAAUA,EAAO,mBAAqB,MAC9DC,EAAM,GAAG,KAAK,UAAUD,EAAO,kBAAmB,KAAM,CAAC,CAAC;AAAA,CAAI,EAGzDA,GAIIG,GAAiBC,GAAuB,CAC5BA,EAAI,QAAQ,KAAMC,GAChCA,EAAO,OAAS,QACxB,GAGCD,EAAI,OAAO,SAAU,4EAA4E,EAGnGA,EAAI,SAAS,QAAQD,EAAa,CACpC,EDnBO,IAAMG,GAAY,CAAE,OAAQ,IAAwB,EAG9CC,EAAc,IAClBD,GAAU,SAAW,KAQjBE,GAAa,IACjBD,EAAY,GAAKE,EAAW,QASxBC,EAAO,IACX,EAAQC,GAAQ,IAAI,GAoBhBC,GAAyB,CAAC,CAAE,IAAAC,EAAK,WAAAC,EAAY,KAAAC,CAAK,IAA8C,CAC3G,GAAIA,EAAM,MAAO,OAEjB,IAAMC,EAAWH,EAAI,gBAErB,OAAIG,IAAa,KAEWH,EAAI,aAAe,QAAa,CAACC,GAAcE,IAAa,IAF3D,MAIQ,IACvC,EE/DO,IAAMC,EAAiBC,GAAuC,CAOnE,IAAMC,EAAO,IAAI,IACbC,EAAUF,EAEd,KAAOE,IAAY,MAAQ,OAAOA,GAAY,UAAY,CAACD,EAAK,IAAIC,CAAO,GAAG,CAC5ED,EAAK,IAAIC,CAAO,EAEhB,GAAM,CAAE,OAAAC,EAAQ,cAAAC,CAAc,EAAIF,EAElC,GAAI,OAAOC,GAAW,UAAYA,EAAO,OAAS,EAAG,OAAOA,EAC5D,GAAI,OAAOC,GAAkB,UAAYA,EAAc,OAAS,EAAG,OAAOA,EAE1EF,EAAWA,EAAgC,KAC7C,CAGF,EASMG,GAAe,CAACL,EAAgBM,IAAuC,CAC3E,IAAMH,EAASG,EAAI,eAAiBP,EAAcC,CAAK,EACjDO,EAAQ,CAAC,aAAaD,EAAI,SAAS,EAAE,EAE3C,OAAIH,GAAQI,EAAM,KAAK,WAAWJ,EAAO,MAAM,EAAG,GAAwB,EAAE,KAAK,CAAC,EAAE,EAChFG,EAAI,aAAaC,EAAM,KAAK,QAAQD,EAAI,WAAW,EAAE,EAElDC,EAAM,KAAK,UAAK,CACzB,EAoBaC,EAAN,cAA6B,KAAM,CAC/B,UACA,YAOA,cAET,YAAYR,EAAgBM,EAA4B,CACtD,MAAMD,GAAaL,EAAOM,CAAG,EAAG,CAAE,MAAAN,CAAM,CAAC,EACzC,KAAK,KAAO,iBACZ,KAAK,UAAYM,EAAI,UACrB,KAAK,YAAcA,EAAI,YACvB,KAAK,cAAgBA,EAAI,eAAiBP,EAAcC,CAAK,CAC/D,CACF,EC9FA,OAAOS,MAAU,YACjB,OAAOC,OAAa,eACpB,OAAS,KAAAC,MAAS,KCQlB,IAAMC,GAAa,0BAGbC,GAAmB,wBAGnBC,GAAW,6BAEXC,EAAwB,WACxBC,EAAwB,YACxBC,GAAoB,cAEpBC,GAAa,OAOnB,IAAMC,GAAsC,IAAI,IAAI,CAAC,MAAO,OAAQ,OAAQ,SAAU,UAAW,SAAS,CAAC,EAG9FC,EAAN,cAAsC,KAAM,CACjD,YAAYC,EAAiB,CAC3B,MAAMA,CAAO,EACb,KAAK,KAAO,yBACd,CACF,EAGaC,EAAN,cAAqC,KAAM,CAChD,YAAYD,EAAiB,CAC3B,MAAMA,CAAO,EACb,KAAK,KAAO,wBACd,CACF,EAEME,GAAkBC,GACfA,EAAM,WAAWC,EAAiB,EAAID,EAAM,MAAMC,GAAkB,MAAM,EAAID,EAGjFE,GAAc,CAACC,EAAeC,EAAeC,KAC1C,CACL,KAAM,UACN,OAAQ,CAAE,MAAAF,EAAO,MAAAC,EAAO,MAAAC,CAAM,EAC9B,IAAK,GAAGF,CAAK,IAAIC,CAAK,IAAIC,CAAK,EACjC,GASWC,EAAgBC,GAAuB,CAClD,GAAIA,EAAK,SAAW,EAClB,MAAM,IAAIX,EAAwB,4EAA4E,EAGhH,GAAIW,EAAK,OAAS,GAChB,MAAM,IAAIX,EACR,iBAAiBW,CAAI,QAAQA,EAAK,MAAM,iCAC1C,EAGF,GAAI,CAACC,GAAS,KAAKD,CAAI,EACrB,MAAM,IAAIX,EACR,iBAAiBW,CAAI,mGACvB,EAGF,GAAIZ,GAAe,IAAIY,CAAI,EACzB,MAAM,IAAIX,EACR,iBAAiBW,CAAI,kCAAkC,CAAC,GAAGZ,EAAc,EAAE,KAAK,IAAI,CAAC,GACvF,CAEJ,EAWac,EAAmBC,GAAqC,CACnE,IAAMC,EAAWZ,GAAeW,EAAO,KAAK,CAAC,EAE7C,GAAI,CAACC,EAAS,WAAWC,CAAqB,EAAG,OAAO,KAExD,GAAID,EAAS,WAAWE,CAAqB,EAAG,CAC9C,IAAMC,EAAaH,EAAS,MAAME,EAAsB,MAAM,EACxDE,EAAQC,GAAiB,KAAKF,CAAU,EAE9C,GAAIC,EACF,OAAOb,GAAY,OAAOa,EAAM,CAAC,CAAC,EAAG,OAAOA,EAAM,CAAC,CAAC,EAAG,OAAOA,EAAM,CAAC,CAAC,CAAC,CAE3E,CAEA,IAAME,EAAWN,EAAS,MAAMC,EAAsB,MAAM,EAE5D,GAAI,CACFN,EAAaW,CAAQ,CACvB,MAAQ,CACN,OAAO,IACT,CAEA,MAAO,CAAE,KAAM,OAAQ,KAAMA,EAAU,IAAKA,CAAS,CACvD,EAWaC,GAAmBlB,GAA6B,CAC3D,IAAMmB,EAAUnB,EAAM,KAAK,EAG3B,GAFwBD,GAAeoB,CAAO,EAE1B,WAAWP,CAAqB,EAAG,CACrD,IAAMQ,EAASX,EAAgBU,CAAO,EAEtC,GAAI,CAACC,EACH,MAAM,IAAItB,EACR,IAAIE,CAAK,2FACX,EAGF,OAAOoB,CACT,CAEA,IAAMC,EAAeC,GAAW,KAAKH,CAAO,EAE5C,GAAIE,EACF,OAAOnB,GAAY,OAAOmB,EAAa,CAAC,CAAC,EAAG,OAAOA,EAAa,CAAC,CAAC,EAAG,OAAOA,EAAa,CAAC,CAAC,CAAC,EAG9F,GAAIF,EAAQ,YAAY,IAAMI,GAC5B,MAAM,IAAIzB,EACR,gHACF,EAOF,GAAIqB,EAAQ,SAAS,GAAG,EACtB,MAAM,IAAIrB,EACR,iBAAiBE,CAAK,oJACxB,EAGF,GAAI,CACFM,EAAaa,CAAO,CACtB,OAASK,EAAK,CACZ,IAAMC,EAASD,aAAe,MAAQA,EAAI,QAAU,OAAOA,CAAG,EAE9D,MAAM,IAAI1B,EAAuB,iBAAiBE,CAAK,uBAAuByB,CAAM,EAAE,CACxF,CAEA,MAAO,CAAE,KAAM,OAAQ,KAAMN,EAAS,IAAKA,CAAQ,CACrD,EAGaO,GAAoBC,GAC3BA,EAAG,OAAS,UAAkB,GAAGd,CAAqB,GAAGc,EAAG,GAAG,GAE5D,GAAGf,CAAqB,GAAGe,EAAG,IAAI,GAO9BC,GAAgB,CAACD,EAAeE,IAAuC,CAClF,IAAMC,EAASD,IAAS,SAAW,SAAW,UAE9C,OAAIF,EAAG,OAAS,UAAkB,GAAGG,CAAM,KAAKH,EAAG,GAAG,GAE/C,GAAGG,CAAM,IAAIH,EAAG,IAAI,EAC7B,EAGaI,GAAiBJ,GACxBA,EAAG,OAAS,UAAkB,YAAYA,EAAG,GAAG,QAE7C,WAAWA,EAAG,IAAI,QAIdK,GAAkBL,GACzBA,EAAG,OAAS,UAAkB,IAAIA,EAAG,GAAG,GAErCA,EAAG,KAICM,GAAgBN,GACpBA,EAAG,IAICO,EAAmBxB,GAC1BA,GAAW,KAAqC,GAE7CD,EAAgBC,CAAM,IAAM,KAG/ByB,GAAUC,GAAoD,CAClE,GAAIA,IAAU,OAAW,OAAO,KAEhC,IAAMC,EAAOD,aAAiB,KAAOA,EAAM,QAAQ,EAAI,IAAI,KAAKA,CAAK,EAAE,QAAQ,EAE/E,OAAO,OAAO,MAAMC,CAAI,EAAI,KAAOA,CACrC,EASaC,GAAoB,CAC/BC,EACAC,EACAC,IACW,CACX,GAAIF,EAAE,OAAS,WAAaC,EAAE,OAAS,UACrC,OAAID,EAAE,OAAO,QAAUC,EAAE,OAAO,MAAcD,EAAE,OAAO,MAAQC,EAAE,OAAO,MACpED,EAAE,OAAO,QAAUC,EAAE,OAAO,MAAcD,EAAE,OAAO,MAAQC,EAAE,OAAO,MAEjED,EAAE,OAAO,MAAQC,EAAE,OAAO,MAGnC,GAAID,EAAE,OAAS,UAAW,MAAO,GACjC,GAAIC,EAAE,OAAS,UAAW,MAAO,GAEjC,IAAME,EAAQP,GAAOM,GAAO,CAAC,EACvBE,EAAQR,GAAOM,GAAO,CAAC,EAE7B,OAAIC,IAAU,MAAQC,IAAU,MAAQD,IAAUC,EACzCD,EAAQC,EAGbJ,EAAE,KAAOC,EAAE,KAAa,GACxBD,EAAE,KAAOC,EAAE,KAAa,EAErB,CACT,EDnOO,IAAMI,GAAgB,MAAOC,GAA0C,CAC5E,IAAMC,EAAS,MAAMC,EAAE,CAAE,IAAAF,CAAI,CAAC,iCAExBG,EAA2B,CAAC,EAC9BC,EAAgC,KAEpC,QAAWC,KAAQJ,EAAO,OAAO,MAAM;AAAA,CAAI,EAAG,CAC5C,GAAII,EAAK,WAAW,WAAW,EAAG,CAE5BD,GAASD,EAAQ,KAAKC,CAAO,EAEjCA,EAAU,CACR,KAAMC,EAAK,MAAM,CAAkB,EACnC,OAAQ,KACR,SAAU,GACV,KAAM,GACN,SAAU,GACV,OAAQ,EACV,EAEA,QACF,CAEKD,IAEDC,EAAK,WAAW,SAAS,EAC3BD,EAAQ,OAASC,EAAK,MAAM,CAAgB,EAAE,QAAQ,iBAAkB,EAAE,EACjEA,IAAS,WAClBD,EAAQ,SAAW,GACVC,IAAS,OAClBD,EAAQ,KAAO,GACNC,IAAS,UAAYA,EAAK,WAAW,SAAS,EACvDD,EAAQ,OAAS,IACRC,IAAS,YAAcA,EAAK,WAAW,WAAW,KAC3DD,EAAQ,SAAW,IAEvB,CAEA,OAAIA,GAASD,EAAQ,KAAKC,CAAO,EAE1BD,CACT,EAWaG,GAAsB,MAAOC,GAAmD,CAC3F,IAAMJ,EAAU,MAAMJ,GAAcS,GAAQ,IAAI,CAAC,EAE3CC,EAAWC,GACRH,IAAS,UAAYI,EAAgBD,CAAM,EAAIA,EAAO,WAAW,UAAU,EAGpF,OAAOP,EACJ,IAAKS,GACGA,EAAM,MACd,EACA,OAAQF,GACAA,IAAW,MAAQD,EAAQC,CAAM,CACzC,CACL,EAOMG,GAA0BC,GAAuC,CACrE,IAAMC,EAAMC,EAAcF,CAAK,EAE/B,OAAOC,GAAO,wBAAwB,KAAKA,CAAG,EAAI,uBAAyB,MAC7E,EAWME,GAAyB,CAAC,CAAE,UAAAC,CAAU,IAAsC,CAChF,GAAIC,EAAY,EACd,MAAO,uKAGT,IAAMC,EAAO,oFAEb,OAAOF,EAAY,GAAGE,CAAI,4EAA8EA,CAC1G,EAKaC,EAAiB,SAA6B,CACzD,GAAI,CAGF,OAFe,MAAMnB,EAAE,CAAE,MAAO,EAAK,CAAC,kCAExB,OAAO,KAAK,CAC5B,OAASY,EAAO,CACd,IAAMQ,EAAgBT,GAAuBC,CAAK,GAAKE,EAAcF,CAAK,EAE1E,MAAM,IAAIS,EAAeT,EAAO,CAC9B,UAAW,iCAAiCN,GAAQ,IAAI,CAAC,GACzD,cAAAc,EACA,YAAaL,GAAuB,CAAE,UAAWK,IAAkB,MAAU,CAAC,CAChF,CAAC,CACH,CACF,EAsBaE,EAAkB,MAAOxB,GAAkC,CACtE,IAAMyB,EAAOzB,GAAQ,MAAMqB,EAAe,EACpCK,GAAa,MAAMxB,EAAE,CAAE,IAAKuB,EAAM,MAAO,EAAK,CAAC,mCAAmC,OAAO,KAAK,EAC9FE,EAAWC,EAAK,QAAQH,EAAMC,CAAS,EAI7C,OAAIC,EAAS,SAAS,GAAGC,EAAK,GAAG,OAAOA,EAAK,GAAG,UAAUA,EAAK,GAAG,EAAE,EAAUH,EAEvEG,EAAK,QAAQD,CAAQ,CAC9B,EAKaE,GAAmB,UACf,MAAM3B,oCAEP,OAAO,KAAK,EAWf4B,GAAuB,UACnB,MAAM5B,2BAMP,OACX,MAAM;AAAA,CAAI,EACV,IAAKG,GACGA,EAAK,QAAQ,CACrB,EACA,OAAQA,GACAA,EAAK,KAAK,EAAE,OAAS,CAC7B,EAMQ0B,GAAqB,UACxB,MAAMD,GAAqB,GAAG,SAAW,EAYtCE,GAAyB,SAA8B,CAClE,IAAMhC,EAAM,MAAMqB,EAAe,EAE3B,CAACY,EAAcC,CAAe,EAAI,MAAM,QAAQ,IAAI,CACxDhC,EAAE,CAAE,IAAAF,CAAI,CAAC,oCACTE,EAAE,CAAE,IAAAF,CAAI,CAAC,iCACX,CAAC,EAEKmC,EAASF,EAAa,OAAO,KAAK,EAClCP,EAAYE,EAAK,QAAQ5B,EAAKkC,EAAgB,OAAO,KAAK,CAAC,EAEjE,OAAOC,IAAWT,CACpB,EAyBO,IAAMU,GAAe,MAAOC,IAClB,MAAMC,sBAAsBD,CAAM,IAEnC,OAAO,KAAK,EAAE,OAAS,EAY1BE,GAAoB,MAAOF,GAAkC,EACzD,MAAMC,sBAAsBD,CAAM,IAEtC,OAAO,KAAK,EAAE,SAAW,GAE/B,MAAMG,GAAiB,IAAOH,GAEnC,MAAMC,kBAAkBD,CAAM,EAChC,EAUaI,GAAqB,MAAOJ,GAAkC,EAC5D,MAAMC,iCAAiCD,CAAM,IAEjD,OAAO,KAAK,EAAE,SAAW,GAElC,MAAMC,6BAA6BD,CAAM,EAC3C,EE3TA,OAAS,KAAAK,MAAS,KAYX,IAAMC,GAAiB,MAAOC,EAAaC,IAAwC,CACxF,IAAMC,EAAY,GAAGD,CAAG,YAExB,GAAI,CAGF,OAFe,MAAME,EAAE,CAAE,IAAAH,EAAK,MAAO,EAAK,CAAC,mCAAmCE,CAAS,IAEzE,OAAO,KAAK,GAAK,IACjC,MAAQ,CACN,OAAO,IACT,CACF,EAeaE,GAAa,MAAOJ,EAAaK,EAAkBC,IAAyC,CACvG,GAAI,CACF,aAAMH,EAAE,CAAE,IAAAH,EAAK,MAAO,EAAK,CAAC,iCAAiCK,CAAQ,IAAIC,CAAU,GAE5E,EACT,OAASC,EAAO,CAGd,GAFkBA,EAAgC,WAEjC,EAAG,MAAO,GAE3B,MAAM,IAAIC,EAAeD,EAAO,CAC9B,UAAW,gBAAgBF,CAAQ,oBAAoBC,CAAU,GACjE,YAAa,8DACf,CAAC,CACH,CACF,EAGaG,GAAe,MAAOT,EAAaU,IAA2C,CAEzF,IAAMC,GADS,MAAMR,EAAE,CAAE,IAAAH,EAAK,MAAO,EAAK,CAAC,iCAAiCU,CAAM,IAC9D,OAAO,KAAK,EAAE,MAAM;AAAA,CAAI,EAAE,CAAC,EAE/C,OAAOC,EAAQA,EAAK,MAAM,KAAK,EAAE,CAAC,GAAK,KAAQ,IACjD,EA6BaC,GAAa,MAAOZ,EAAaa,IAAqD,CACjG,IAAMC,EAAWD,EAAK,IAAKZ,GAClB,GAAGA,EAAI,GAAG,eAAeA,EAAI,MAAM,EAC3C,EAED,GAAIa,EAAS,SAAW,EACtB,MAAO,CAAE,SAAAA,EAAU,OAAQ,EAAM,EAGnC,GAAI,CACF,aAAMX,EAAE,CAAE,IAAAH,EAAK,MAAO,EAAK,CAAC,6BAA6Bc,CAAQ,GAE1D,CAAE,SAAAA,EAAU,OAAQ,EAAK,CAClC,OAASP,EAAO,CACd,MAAO,CACL,SAAAO,EACA,OAAQ,GACR,OAASP,EAA8B,MACzC,CACF,CACF,EC7GA,OAAOQ,MAAU,YACjB,OAAOC,MAAa,eACpB,OAAS,KAAAC,MAAS,KAsCX,IAAMC,GAAsB,MAAOC,GAAkC,CAC1E,IAAMC,EAAOD,GAAOE,EAAQ,IAAI,EAC1BC,GAAa,MAAMC,EAAE,CAAE,IAAKH,EAAM,MAAO,EAAK,CAAC,mCAAmC,OAAO,KAAK,EAC9FI,EAAQH,EAAQ,IAAI,mBAAqB,OAAOA,EAAQ,GAAG,EAEjE,OAAOI,EAAK,KAAKA,EAAK,QAAQL,EAAME,CAAS,EAAG,YAAa,aAAaE,CAAK,EAAE,CACnF,EAGaE,GAAcC,GAClBA,EAAO,QAAQ,WAAY,GAAG,EAY1BC,GAAyB,CAACC,EAAqBF,IACnDF,EAAK,KAAK,GAAGI,CAAW,GAAGC,EAAoB,GAAIC,GAAiB,SAAUL,GAAWC,CAAM,CAAC,EAI5FK,EAAqB,MAAOb,GAAkC,CACzE,GAAI,CACF,aAAMI,EAAE,CAAE,IAAAJ,EAAK,MAAO,EAAK,CAAC,wCAErB,EACT,MAAQ,CACN,MAAO,EACT,CACF,EAYac,GAAyB,MAAOd,GAA+B,CAC1E,GAAI,MAAMa,EAAmBb,CAAG,EAC9B,MAAM,IAAIe,EAAe,OAAW,CAClC,UAAW,6BACX,cAAe,uDACf,YAAa,gFACf,CAAC,EAGH,IAAMC,GAAU,MAAMZ,EAAE,CAAE,IAAAJ,EAAK,MAAO,EAAK,CAAC,2BAA2B,OAAO,KAAK,EAEnF,GAAIgB,EAAO,OAAS,EAClB,MAAM,IAAID,EAAe,OAAW,CAClC,UAAW,6BACX,cAAe,8BAA8BC,EAAO,MAAM;AAAA,CAAI,EAAE,CAAC,CAAC,GAClE,YAAa,gFACf,CAAC,CAEL,EAcaC,GAAuB,MAAOjB,GAA+B,CACxE,IAAMkB,EAAM,MAAOC,GAA8C,CAC/D,GAAI,CACF,MAAMA,EAAG,CACX,MAAQ,CAER,CACF,EAEI,MAAMN,EAAmBb,CAAG,GAG9B,MAAMkB,EAAI,IACDd,EAAE,CAAE,IAAAJ,EAAK,MAAO,EAAK,CAAC,oBAC9B,EAGH,MAAMkB,EAAI,IACDd,EAAE,CAAE,IAAAJ,EAAK,MAAO,EAAK,CAAC,mBAC9B,EAID,MAAMkB,EAAI,IACDd,EAAE,CAAE,IAAAJ,EAAK,MAAO,EAAK,CAAC,gBAC9B,CACH,EAcaoB,GAAsB,MACjCC,EACAF,IACe,CACf,GAAM,CAAE,IAAAnB,EAAK,OAAAsB,EAAS,YAAa,EAAID,EACjCE,EAAe,MAAMxB,GAAoBC,CAAG,EAE5CwB,EAAM,SAA2B,CACrC,MAAMpB,EAAE,CAAE,IAAAJ,EAAK,MAAO,EAAK,CAAC,8BAA8BuB,CAAY,IAAID,CAAM,EAClF,EAEA,GAAI,CACF,MAAME,EAAI,CACZ,OAASC,EAAY,CACnB,GAAI,CACF,MAAMrB,EAAE,CAAE,IAAAJ,EAAK,MAAO,EAAK,CAAC,sBAC5B,MAAMwB,EAAI,CACZ,MAAQ,CACN,MAAM,IAAIT,EAAeU,EAAY,CACnC,UAAW,4CACX,YAAa,gCAAgCF,CAAY,cAC3D,CAAC,CACH,CACF,CAEA,IAAMG,EAA4B,CAChC,KAAMH,EACN,OAAQ,SAA2B,CACjC,GAAI,CACF,MAAMnB,EAAE,CAAE,IAAAJ,EAAK,MAAO,EAAK,CAAC,gCAAgCuB,CAAY,EAC1E,MAAQ,CAGR,CACF,CACF,EAEA,GAAI,CACF,OAAO,MAAMJ,EAAGO,CAAQ,CAC1B,QAAE,CACA,MAAMA,EAAS,OAAO,CACxB,CACF,ECzMA,OAAOC,OAAa,eACpB,OAAOC,OAAU,OACjB,OAAOC,OAAY,cAenB,IAAMC,GAAe,CACnB,QACA,UACA,eACA,iBACA,gBACA,kBACA,sBACA,uBACF,EAEaC,GAAgB,IAAM,CACjC,IAAMC,EAAWL,GAAQ,KAAK,SAAS,SAAS,EAAI,QAAU,OAExDM,EAAe,CAAC,OAAQ,MAAO,UAAU,EAE/C,OAAID,IAAa,SACfC,EAAa,KAAK,OAAO,EAGZL,GACb,CAAE,MAAOI,EAAU,OAAQF,EAAa,EACxCD,GAAO,CACL,YAAa,EACb,OAAQI,EAAa,KAAK,GAAG,EAC7B,SAAU,GAGV,KAAM,EACR,CAAC,CACH,CAGF,EAGaC,EAASH,GAAc,ECrDpC,OAAOI,MAAQ,mBACf,OAAOC,OAAQ,UACf,OAAOC,MAAU,YACjB,OAAOC,OAAa,eACpB,OAAS,KAAAC,MAAS,MCQX,IAAMC,EAAeC,GAAwB,CAClD,MAAM,IAAI,MAAM,qBAAqB,KAAK,UAAUA,CAAK,CAAC,EAAE,CAC9D,ECdO,IAAMC,EAAU,CAACC,EAAiCC,IAChD,OAAO,YACZ,OAAO,QAAQD,CAAM,EAAE,OAAO,CAAC,CAACE,CAAQ,IAC/BA,IAAaD,CACrB,CACH,ECEK,IAAME,EAAkB,CAAC,CAAE,IAAAC,EAAK,GAAAC,EAAI,KAAAC,CAAK,KACvC,CACL,GAAAD,EACA,KAAAC,EACA,MAAQC,GACAH,KAAOG,EAEN,CAAE,QAAS,GAAM,OAAQC,EAAQD,EAAQH,CAAG,CAAE,EAFxB,CAAE,QAAS,GAAO,OAAQG,CAAO,CAIlE,GCdK,IAAME,GAA2BC,EAAgB,CACtD,IAAK,WACL,GAAI,qBACJ,KAAM,2FACR,CAAC,ECJM,IAAMC,GAA8BC,EAAgB,CACzD,IAAK,cACL,GAAI,yBACJ,KAAM,yGACR,CAAC,ECJM,IAAMC,GAA+BC,EAAgB,CAC1D,IAAK,eACL,GAAI,wBACJ,KAAM,oIACR,CAAC,ECAD,IAAMC,GAAgDC,GAAW,CAC/D,IAAMC,EAAMD,EAAO,IAEnB,GAAIC,IAAQ,MAAQ,OAAOA,GAAQ,SACjC,MAAO,CAAE,QAAS,GAAO,OAAQD,CAAO,EAG1C,IAAIE,EAAU,GAERC,EAAcC,GAA4B,CAC9C,GAAIA,IAAU,MAAQ,OAAOA,GAAU,UAAY,EAAE,WAAYA,GAC/D,OAAOA,EAGT,IAAMC,EAAUD,EAA8B,OAE9C,OAAIC,IAAW,MAAQ,OAAOA,GAAW,UAAY,EAAE,SAAUA,GACxDD,GAGTF,EAAU,GAEH,CAAE,GAAIE,EAAmC,OAAQE,EAAQD,EAAmC,MAAM,CAAE,EAC7G,EAEME,EAAU,MAAM,QAAQN,CAAG,EAAIA,EAAI,IAAIE,CAAU,EAAIA,EAAWF,CAAG,EAEzE,OAAKC,EAIE,CAAE,QAAS,GAAM,OAAQ,CAAE,GAAGF,EAAQ,IAAKO,CAAQ,CAAE,EAHnD,CAAE,QAAS,GAAO,OAAQP,CAAO,CAI5C,EAEaQ,GAA+C,CAC1D,GAAI,wBACJ,KAAM,gBACN,MAAOT,EACT,ECzCA,IAAMU,GAAuB,MAEvBC,GAAqBC,GAEvBA,IAAU,MAAQ,OAAOA,GAAU,UAAaA,EAAiC,WAAaF,GAM5FG,GAAgDC,GAAW,CAC/D,IAAMC,EAAMD,EAAO,IAEnB,GAAI,MAAM,QAAQC,CAAG,EAAG,CACtB,IAAMC,EAAOD,EAAI,OAAQH,GAChB,CAACD,GAAkBC,CAAK,CAChC,EAED,OAAII,EAAK,SAAWD,EAAI,OAAe,CAAE,QAAS,GAAO,OAAQD,CAAO,EAEjE,CAAE,QAAS,GAAM,OAAQE,EAAK,OAAS,EAAI,CAAE,GAAGF,EAAQ,IAAKE,CAAK,EAAIC,EAAQH,EAAQ,KAAK,CAAE,CACtG,CAEA,OAAIH,GAAkBI,CAAG,EAAU,CAAE,QAAS,GAAM,OAAQE,EAAQH,EAAQ,KAAK,CAAE,EAE5E,CAAE,QAAS,GAAO,OAAQA,CAAO,CAC1C,EAEaI,GAA+C,CAC1D,GAAI,wBACJ,KAAM,6BACN,MAAOL,EACT,ECvBO,IAAMM,EAAgD,CAC3DC,GACAC,GACAC,GACAC,GACAC,EACF,ECTO,IAAMC,EAAyBC,GAC7BC,EAAkB,OACvB,CAACC,EAAKC,IAAc,CAClB,IAAMC,EAAOD,EAAU,MAAMD,EAAI,MAAM,EAEvC,OAAKE,EAAK,QAEH,CAAE,QAAS,GAAM,OAAQA,EAAK,OAAQ,MAAO,CAAC,GAAGF,EAAI,MAAOC,EAAU,IAAI,CAAE,EAFzDD,CAG5B,EACA,CAAE,QAAS,GAAO,OAAQF,EAAQ,MAAO,CAAC,CAAE,CAC9C,ECnBF,OAAOK,OAAQ,mBACf,OAAOC,OAAQ,UAiBR,IAAMC,GAAa,MAAOC,GAAuC,CACtE,GAAI,CACF,aAAMH,GAAG,OAAOG,CAAQ,EAEjB,EACT,MAAQ,CACN,MAAO,EACT,CACF,EAWaC,EAAWD,GAA6B,CACnD,IAAME,EAAOJ,GAAG,QAAQ,EAExB,OAAOE,EAAS,WAAWE,CAAI,EAAI,IAAIF,EAAS,MAAME,EAAK,MAAM,CAAC,GAAKF,CACzE,ECzCA,OAAS,eAAAG,OAAmB,cAC5B,OAAOC,MAAQ,mBACf,OAAOC,MAAU,YACjB,OAAOC,OAAa,eAUb,IAAMC,EAAN,cAAqC,KAAM,CAChD,YAAYC,EAAkB,CAC5B,MAAM,GAAGA,CAAQ,oCAAoC,EACrD,KAAK,KAAO,wBACd,CACF,EAeMC,GAAiB,EAGjBC,GAAgBC,GACb,eAAe,KAAKA,CAAG,IAAI,CAAC,GAAKF,GAKpCG,GAAkB,KAaXC,EAA0B,MAAO,CAC5C,KAAML,EACN,IAAAG,EACA,SAAAG,EACA,gBAAAC,CACF,IAAqD,CACnD,IAAMC,EAAS,MAAMC,EAAG,SAAST,CAAQ,EACnCU,EAAMC,EAAK,QAAQH,CAAM,EACzBI,EAAOD,EAAK,SAASH,CAAM,EAE3BK,EAAMF,EAAK,KAAKD,EAAK,IAAIE,CAAI,IAAIE,GAAQ,GAAG,IAAIC,GAAY,CAAC,EAAE,SAAS,KAAK,CAAC,MAAM,EACpFC,EAAU,GAAG,KAAK,UAAUV,EAAU,KAAMJ,GAAaC,CAAG,CAAC,CAAC;AAAA,EAEpE,GAAI,CACF,MAAMM,EAAG,UAAUI,EAAKG,EAAS,MAAM,EAIvC,IAAMC,EAAO,MAAMR,EAAG,KAAKD,CAAM,EAEjC,GAAIS,EAAK,UAAYV,EACnB,MAAM,IAAIR,EAAuBC,CAAQ,EAI3C,MAAMS,EAAG,MAAMI,EAAKI,EAAK,KAAOb,EAAe,EAC/C,MAAMK,EAAG,OAAOI,EAAKL,CAAM,CAC7B,OAASU,EAAK,CACZ,YAAMT,EAAG,GAAGI,EAAK,CAAE,MAAO,EAAK,CAAC,EAC1BK,CACR,CACF,EAEMC,GAAYC,GACTA,IAAU,MAAQ,OAAOA,GAAU,UAAY,CAAC,MAAM,QAAQA,CAAK,EAQ/DC,GAAoB,MAAOrB,GAAmD,CACzF,IAAMiB,EAAO,MAAMR,EAAG,KAAKT,CAAQ,EAC7BG,EAAM,MAAMM,EAAG,SAAST,EAAU,MAAM,EAE9C,GAAIG,EAAI,KAAK,IAAM,GACjB,MAAO,CAAE,QAAS,GAAO,OAAQ,CAAC,EAAG,MAAO,CAAC,EAAG,KAAMH,CAAS,EAGjE,IAAMsB,EAAkB,KAAK,MAAMnB,CAAG,EAEtC,GAAI,CAACgB,GAASG,CAAM,EAClB,MAAO,CAAE,QAAS,GAAO,OAAQ,CAAC,EAAG,MAAO,CAAC,EAAG,KAAMtB,CAAS,EAGjE,IAAMM,EAAWiB,EAAsBD,CAAM,EAE7C,OAAIhB,EAAS,SACX,MAAMD,EAAwB,CAAE,KAAML,EAAU,IAAAG,EAAK,SAAUG,EAAS,OAAQ,gBAAiBW,EAAK,OAAQ,CAAC,EAG1G,CAAE,GAAGX,EAAU,KAAMN,CAAS,CACvC,EC/EO,IAAMwB,EAAsB,MACjCC,EACAC,EACAC,EACA,CAAE,OAAAC,CAAO,IACuB,CAChC,GAAIH,EAAM,cAAgB,MACxB,MAAO,CAAE,KAAM,gBAAiB,EAGlC,IAAMI,EAAWC,EAAsBJ,CAAS,EAEhD,GAAI,CAACG,EAAS,QACZ,MAAO,CAAE,KAAM,gBAAiB,EAGlC,IAAME,EAASH,EAAO,UAAUC,EAAS,MAAM,EAE/C,GAAI,CAACE,EAAO,QACV,MAAO,CAAE,KAAM,gBAAiB,EAGlC,GAAIN,EAAM,UAAYO,EAAK,EACzB,MAAO,CAAE,KAAM,UAAW,EAG5B,GAAI,CACF,MAAMC,EAAwB,CAC5B,KAAMR,EAAM,KACZ,IAAAE,EACA,SAAUE,EAAS,OACnB,gBAAiBJ,EAAM,OACzB,CAAC,CACH,OAASS,EAAK,CACZ,OAAAC,EAAO,MAAMD,EAAK,oCAAoCT,EAAM,IAAI,EAAE,EAE3D,CAAE,KAAM,gBAAiB,CAClC,CAEA,OAAAU,EAAO,KACL,YAAYC,EAAQX,EAAM,IAAI,CAAC,aAAaI,EAAS,MAAM,KAAK,OAAO,CAAC,0BAA0BQ,GAAY,OAAO,GACvH,EAEO,CAAE,KAAM,WAAY,KAAMN,EAAO,IAAgC,CAC1E,EbtEA,IAAMO,GAAwB,iBAM9B,IAAMC,GAA0B,iBAC1BC,GAAoB,WAGpBC,GAA6BC,EAAE,OAAO,CAC1C,SAAUA,EAAE,QAAQ,SAAS,EAC7B,OAAQA,EAAE,OAAO,CACf,KAAMA,EAAE,OAAO,EAAE,IAAI,CAAC,CACxB,CAAC,CACH,CAAC,EAEKC,GAAsBD,EAAE,mBAAmB,WAAY,CAACD,EAA0B,CAAC,EASnFG,GAAwBF,EAC3B,OAAO,CACN,oBAAqBA,EAAE,OAAO,EAAE,IAAI,CAAC,CACvC,CAAC,EACA,OAAO,EAEJG,GAAkBH,EACrB,OAAO,CACN,SAAUA,EAAE,QAAQ,QAAQ,EAC5B,OAAQE,EACV,CAAC,EACA,OAAO,EAKJE,GAAYJ,EAAE,mBAAmB,WAAY,CAACG,EAAe,CAAC,EAO9DE,GAAaL,EAAE,MAAM,CAACI,GAAWJ,EAAE,MAAMI,EAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAW3DE,GAAwBN,EAAE,OAAO,CACrC,SAAUA,EAAE,QAAQ,MAAM,EAC1B,OAAQA,EAAE,OAAO,CACf,QAASA,EAAE,OAAO,EAAE,IAAI,EACxB,UAAWA,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CACvC,CAAC,CACH,CAAC,EAEKO,GAAoBP,EAAE,mBAAmB,WAAY,CAACM,EAAqB,CAAC,EAO5EE,GAAc,CAAC,cAAe,YAAY,EAE1CC,GAAmBT,EACtB,OAAO,CACN,OAAQA,EAAE,KAAKQ,EAAW,EAAE,SAAS,CACvC,CAAC,EACA,OAAO,EAIJE,GAAwBV,EAC3B,OAAO,CACN,oBAAqBA,EAAE,QAAQ,EAAE,SAAS,EAC1C,WAAYA,EAAE,QAAQ,EAAE,SAAS,EACjC,KAAMS,GAAiB,SAAS,CAClC,CAAC,EACA,OAAO,EAQJE,GAAqBX,EACxB,OAAO,CACN,KAAMA,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAC3C,UAAWA,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,CACxC,CAAC,EACA,OAAO,EAEJY,GAAkBZ,EAAE,OAAOA,EAAE,OAAO,EAAE,IAAI,CAAC,EAAGW,EAAkB,EAYhEE,GAAoBb,EAAE,KAAK,CAAC,QAAS,OAAO,CAAC,EAE7Cc,GAAqBd,EACxB,OAAO,CAEN,UAAWA,EAAE,QAAQ,EAAE,SAAS,EAEhC,MAAOA,EAAE,OAAOA,EAAE,OAAO,EAAE,IAAI,CAAC,EAAGa,EAAiB,EAAE,SAAS,CACjE,CAAC,EACA,OAAO,EAEJE,GAAkBf,EACrB,OAAO,CAEN,KAAMA,EAAE,OAAOA,EAAE,OAAO,EAAE,IAAI,CAAC,EAAGc,EAAkB,EAAE,SAAS,EAE/D,KAAMd,EAAE,QAAQ,EAAE,SAAS,CAC7B,CAAC,EACA,OAAO,EAEJgB,GAAmBhB,EAAE,OAAOA,EAAE,OAAO,EAAE,IAAI,CAAC,EAAGe,EAAe,EA2C9DE,GAAsBjB,EAAE,KAAK,CAAC,WAAY,QAAS,UAAU,CAAC,EAI9DkB,GAAalB,EAAE,OAAO,EAAE,MAAM,eAAgB,2CAA2C,EAazFmB,GAAiBnB,EACpB,OAAO,CACN,QAASA,EAAE,OAAO,EAAE,IAAI,CAAC,EACzB,KAAMA,EAAE,MAAMA,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC,EACpC,IAAKA,EAAE,MAAMkB,EAAU,EAAE,IAAI,CAAC,EAC9B,MAAOlB,EAAE,MAAMkB,EAAU,EAAE,QAAQ,CAAC,CAAC,CACvC,CAAC,EACA,OAAO,EACP,YAAY,CAACE,EAAMC,IAAQ,CAC1B,QAAWC,KAAQF,EAAK,IAClBG,GAA0B,IAAID,CAAI,GACpCD,EAAI,SAAS,CACX,KAAM,SACN,KAAM,CAAC,KAAK,EACZ,QAAS,IAAIC,CAAI,+FACnB,CAAC,CAGP,CAAC,EAUGE,GAAmBxB,EAAE,OACzBA,EACG,OAAO,EACP,MAAM,oBAAqB,uEAAuE,EAClG,OACEsB,GACQ,CAACA,EAAK,SAAS,WAAW,EAEnC,CACE,QACE,+GACJ,CACF,EACFH,EACF,EAGMM,GAAyBzB,EAC5B,OAAO,EACP,IAAI,CAAC,EACL,YAAY,CAAC0B,EAAOL,IAAQ,CAC3B,GAAIK,EAAM,WAAW,GAAG,GAAKA,EAAM,WAAW,IAAI,GAAK,WAAW,KAAKA,CAAK,EAAG,CAC7EL,EAAI,SAAS,CAAE,KAAM,SAAU,QAAS,IAAIK,CAAK,2CAA4C,CAAC,EAE9F,MACF,CAEA,IAAMC,EAAWD,EAAM,MAAM,OAAO,EAAE,OAAQE,GACrCA,IAAY,IAAMA,IAAY,GACtC,EAEGD,EAAS,SAAS,IAAI,GACxBN,EAAI,SAAS,CAAE,KAAM,SAAU,QAAS,IAAIK,CAAK,mCAAoC,CAAC,EAIpFC,EAAS,CAAC,IAAM,QAClBN,EAAI,SAAS,CAAE,KAAM,SAAU,QAAS,IAAIK,CAAK,wCAAyC,CAAC,EAKzFA,EAAM,SAAS,IAAI,GACrBL,EAAI,SAAS,CAAE,KAAM,SAAU,QAAS,IAAIK,CAAK,2CAA4C,CAAC,EAGhG,IAAMG,EAAcH,EAAM,MAAM,GAAG,EAE/BG,EAAY,SAAS,EAAE,GACzBR,EAAI,SAAS,CAAE,KAAM,SAAU,QAAS,IAAIK,CAAK,2CAA4C,CAAC,EAG5FG,EAAY,SAAS,GAAG,GAC1BR,EAAI,SAAS,CACX,KAAM,SACN,QAAS,IAAIK,CAAK,4FACpB,CAAC,CAEL,CAAC,EAEGI,GAAwB9B,EAC3B,OAAO,CACN,KAAMyB,GACN,OAAQA,GAAuB,SAAS,CAC1C,CAAC,EACA,OAAO,EAMGM,GAAqB/B,EAC/B,OAAO,CACN,KAAMA,EAAE,MAAM8B,EAAqB,EAAE,IAAI,CAAC,EAE1C,QAAS9B,EAAE,MAAMA,EAAE,OAAO,EAAE,MAAM,YAAa,4CAA4C,CAAC,EAAE,SAAS,CACzG,CAAC,EACA,OAAO,EAMJgC,GAAmBhC,EACtB,OAAO,CACN,gBAAiBA,EAAE,MAAMA,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS,EACrD,cAAeA,EAAE,MAAMA,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS,EACnD,MAAOA,EACJ,OAAO,CACN,cAAeA,EAAE,MAAMA,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS,CACrD,CAAC,EACA,OAAO,EACP,SAAS,CACd,CAAC,EACA,OAAO,EAMJiC,GAAkBjC,EACrB,OAAO,EACP,MAAM,yCAA0C,oEAAoE,EAE1GkC,GAAuBlC,EACjC,OAAO,CACN,cAAeC,GACf,IAAKI,GAAW,SAAS,EACzB,YAAaE,GAAkB,SAAS,EACxC,UAAWG,GAAsB,SAAS,EAC1C,IAAKE,GAAgB,SAAS,EAC9B,kBAAmBI,GAAiB,SAAS,EAC7C,cAAeC,GAAoB,SAAS,EAC5C,IAAKO,GAAiB,SAAS,EAC/B,aAAcO,GAAmB,SAAS,EAAE,SAAS,EACrD,MAAOC,GAAiB,SAAS,EACjC,UAAWC,GAAgB,SAAS,CACtC,CAAC,EACA,OAAO,EAeGE,GAAyB,IAOzBC,GAAuBF,GAAqB,YAAY,CAACG,EAAKhB,IAAQ,CACjF,GAAI,CAAC,MAAM,QAAQgB,EAAI,GAAG,EAAG,OAE7B,IAAMC,EAAO,IAAI,IAEjB,QAAWC,KAASF,EAAI,IAAK,CAC3B,GAAIC,EAAK,IAAIC,EAAM,QAAQ,EAAG,CAC5BlB,EAAI,SAAS,CACX,KAAM,SACN,QAAS,4CACT,KAAM,CAAC,KAAK,CACd,CAAC,EAED,MACF,CAEAiB,EAAK,IAAIC,EAAM,QAAQ,CACzB,CACF,CAAC,EAEYC,EAA+BN,GAAqB,QAAQ,EA4C5DO,GAAyBC,GAA4C,CAChF,IAAMC,EAAMD,EAAO,IAEnB,OAAKC,EAEE,MAAM,QAAQA,CAAG,EAAIA,EAAM,CAACA,CAAG,EAFrB,CAAC,CAGpB,EAMaC,GAAkC,cAWlCC,GAAqBH,GACzBA,EAAO,WAAW,MAAM,QAAUE,GAuBvCE,EAA4B,KAc5BC,EAAsC,KAUpCC,GAAgB,IACb,GAAGC,GAAQ,IAAI,CAAC,IAAIC,GAAG,QAAQ,CAAC,GAUnCC,GAAuB,IACpBC,EAAK,KAAKF,GAAG,QAAQ,EAAGG,CAAoB,EAYxCC,GAA8B,IAClCF,EAAK,KAAKD,GAAqB,EAAGtD,EAAuB,EA0BrD0D,GAAyB,SAA0C,CAC9E,IAAMC,EAAMR,GAAc,EAE1B,GAAID,GAAeA,EAAY,MAAQS,EACrC,OAAOT,EAAY,MAGrB,IAAMU,EAAc,MAAMC,EAAe,EAOnCC,EAAe,MAAMC,EAAgBH,CAAW,EAChDI,EAAcT,EAAK,SAASO,CAAY,EAExCjC,EAA6B,CACjC,KAAM0B,EAAK,KAAKK,EAAaK,EAAqB,EAClD,WAAYR,GAA4B,EACxC,YAAaF,EAAK,KAAKD,GAAqB,EAAGrD,GAAmB+D,EAAaC,EAAqB,EACpG,YAAAD,CACF,EAGA,OAAAd,EAAc,CAAE,IAAAS,EAAK,MAAA9B,CAAM,EAEpBA,CACT,EAsBaqC,GAAoB,MAAOC,EAAoC,CAAC,IAA+B,CAC1G,IAAMC,EAAcD,EAAQ,aAAe,QACrCR,EAAMR,GAAc,EACpBkB,EAAQ,MAAMX,GAAuB,EAEvCY,EAEJ,GAAI,CACFA,EAAW,MAAMC,EAAG,KAAKF,EAAM,IAAI,CACrC,MAAQ,CACNpB,EAAS,KAIT,IAAMuB,EAAgBH,EAAM,KAAK,QAAQ,UAAW,MAAM,EAE1D,MAAI,MAAMI,EAAaD,CAAa,EAC5B,IAAI,MACR,+BAA+BH,EAAM,IAAI,4FAC3C,EAGI,IAAI,MACRK,EAAY,EACR,+BAA+BL,EAAM,IAAI,mJACzC,+BAA+BA,EAAM,IAAI,8LAC/C,CACF,CAEA,GAAM,CAACM,EAAgBC,CAAe,EAAI,MAAM,QAAQ,IAAI,CAC1DH,EAAaJ,EAAM,UAAU,EAC7BI,EAAaJ,EAAM,WAAW,CAChC,CAAC,EAEKQ,EAAS,CACb,KAAM,OAAOP,EAAS,OAAO,EAC7B,WAAYK,EAAiB,OAAOA,EAAe,OAAO,EAAI,KAC9D,YAAaC,EAAkB,OAAOA,EAAgB,OAAO,EAAI,IACnE,EAEA,GAAI3B,GAAUA,EAAO,MAAQU,GAAOmB,GAAa7B,EAAO,OAAQ4B,CAAM,EACpE,OAAO5B,EAAO,MAGhB,IAAM8B,EAAwB,CAC5B,CAAE,MAAO,iBAAkB,KAAMV,EAAM,KAAM,SAAU,GAAM,YAAAD,EAAa,QAASS,EAAO,IAAK,EAC/F,CACE,MAAO,8BACP,KAAMR,EAAM,WACZ,SAAU,GACV,YAAAD,EACA,QAASS,EAAO,UAClB,EACA,CACE,MAAO,yBAAyBR,EAAM,WAAW,kBACjD,KAAMA,EAAM,YACZ,SAAU,GACV,YAAAD,EACA,QAASS,EAAO,WAClB,CACF,EAEIG,EAAkC,CAAC,EAEvC,QAAWC,KAASF,EAAQ,CAC1B,IAAMG,GAAO,MAAMC,GAAUF,CAAK,EAE9BC,KAAS,OAEbF,EAAS,CAAE,GAAGA,EAAQ,GAAGE,EAAK,EAChC,CAEA,IAAME,EAAc7C,GAAqB,UAAUyC,CAAM,EAEzD,GAAI,CAACI,EAAY,QACf,MAAM,IAAI,MAAM,oCAAoCjF,EAAE,cAAciF,EAAY,KAAK,CAAC,EAAE,EAK1F,OAAAnC,EAAS,CAAE,IAAAU,EAAK,OAAAkB,EAAQ,MAAOO,EAAY,IAAK,EAEzCA,EAAY,IACrB,EAmBaC,GAAyB,IAAY,CAChDpC,EAAS,IACX,EAWaqC,GAA2B,IAAY,CAClDrC,EAAS,KACTC,EAAc,IAChB,EASMuB,EAAe,MAAOc,GAA0E,CACpG,GAAI,CACF,OAAO,MAAMhB,EAAG,KAAKgB,CAAQ,CAC/B,MAAQ,CACN,OAAO,IACT,CACF,EASMC,GAAe,MAAOD,GAA6C,CACvE,GAAI,CACF,OAAO,MAAMhB,EAAG,SAASgB,EAAU,OAAO,CAC5C,MAAQ,CACN,OAAO,IACT,CACF,EAWMT,GAAe,CAAoCW,EAAMC,IAAkB,CAC/E,IAAMC,EAAO,OAAO,KAAKF,CAAC,EAE1B,OAAIE,EAAK,SAAW,OAAO,KAAKD,CAAC,EAAE,OAAe,GAE3CC,EAAK,MAAOC,GACVH,EAAEG,CAAC,IAAMF,EAAEE,CAAC,CACpB,CACH,EA+BaC,GAAiBC,GACrB,IAAI,MACT,GAAGA,EAAM,OAAO;AAAA,qHAClB,EAoBIX,GAAY,MAAOF,GAAgE,CACvF,IAAMc,EAAM,MAAMP,GAAaP,EAAM,IAAI,EAEzC,GAAIc,IAAQ,KAAM,CAChB,GAAId,EAAM,SACR,MAAM,IAAI,MAAM,GAAGA,EAAM,KAAK,iBAAiBA,EAAM,IAAI,EAAE,EAG7D,OAAO,IACT,CAEA,IAAIe,EAEJ,GAAI,CACFA,EAAYD,EAAI,KAAK,IAAM,GAAK,CAAC,EAAI,KAAK,MAAMA,CAAG,CACrD,OAASE,EAAK,CACZ,MAAM,IAAI,MAAM,mBAAmBhB,EAAM,KAAK,OAAOA,EAAM,IAAI,KAAMgB,EAAc,OAAO,EAAE,CAC9F,CAOA,GAAIC,EAASF,CAAS,GAAK,cAAeA,EACxC,MAAM,IAAI,MAAMG,GAA+BlB,CAAK,CAAC,EAGnD,CAACA,EAAM,UAAYiB,EAASF,CAAS,GACvCI,GAA6BnB,EAAOe,CAAS,EAG/C,IAAMK,EAAS1D,EAA6B,UAAUqD,CAAS,EAE/D,GAAIK,EAAO,QACT,OAAOA,EAAO,KAGhB,IAAMC,EAAgB,IAAI,MAAM,WAAWrB,EAAM,KAAK,OAAOA,EAAM,IAAI,KAAK9E,EAAE,cAAckG,EAAO,KAAK,CAAC,EAAE,EAM3G,GAAI,CAACH,EAASF,CAAS,GAAKf,EAAM,UAAY,KAC5C,MAAMqB,EAGR,IAAMC,EAAU,MAAMC,EAAoB,CAAE,GAAGvB,EAAO,QAASA,EAAM,OAAQ,EAAGe,EAAWD,EAAK,CAC9F,OAAQpD,CACV,CAAC,EAED,OAAQ4D,EAAQ,KAAM,CACpB,IAAK,WACH,OAAOA,EAAQ,KACjB,IAAK,WACH,MAAMV,GAAcS,CAAa,EACnC,IAAK,iBACH,MAAMA,EACR,QACE,OAAOG,EAAYF,CAAO,CAC9B,CACF,EAOaG,GAAiCzB,GACrC,CACL,2BAA2BA,EAAM,KAAK,KAAKA,EAAM,IAAI,+GACrD,0EACA,2FACA,oGACA,+HACF,EAAE,KAAK;AAAA,CAAI,EAGP0B,GAA0C1B,GACvC,CACL,oCAAoCA,EAAM,KAAK,KAAKA,EAAM,IAAI,kQAC9D,mFACF,EAAE,KAAK;AAAA,CAAI,EAGP2B,GAAmC3B,GAChC,CACL,6BAA6BA,EAAM,KAAK,KAAKA,EAAM,IAAI,yHACvD,mEACF,EAAE,KAAK;AAAA,CAAI,EAGP4B,GAAuC5B,GACpC,CACL,iCAAiCA,EAAM,KAAK,KAAKA,EAAM,IAAI,sJAC3D,4DACF,EAAE,KAAK;AAAA,CAAI,EAYP6B,GAAkF,CACtF,UAAWD,GACX,IAAKH,GACL,aAAcC,GACd,MAAOC,EACT,EAIMR,GAA+B,CACnCnB,EACAe,IACS,CACT,OAAW,CAACrC,EAAKoD,CAAY,IAAK,OAAO,QAAQD,EAAuB,EACtE,GAAInD,KAAOqC,EACT,MAAM,IAAI,MAAMe,EAAa9B,CAAK,CAAC,CAGzC,EAWMiB,EAAYrE,GACT,OAAOA,GAAU,UAAYA,IAAU,MAAQ,CAAC,MAAM,QAAQA,CAAK,EAYtEsE,GAAkClB,GAC/B,CACL,oBAAoBA,EAAM,KAAK,6CAC/B,0FACA,uEACA,0CAA0CA,EAAM,IAAI,IACpD,4DACA,iGACF,EAAE,KAAK;AAAA,CAAI,Ecn8BN,IAAM+B,GAAN,cAAqCC,CAAe,CAChD,kBACA,SAET,YAAYC,EAA6CC,EAAiBC,EAAgC,CACxG,MAAM,OAAWA,CAAO,EACxB,KAAK,KAAO,yBACZ,KAAK,kBAAoBF,EACzB,KAAK,SAAWC,CAClB,CACF",
+  "names": ["process", "process", "jsonOutput", "emit", "result", "write", "text", "addJsonOption", "cmd", "option", "agentMode", "isAgentMode", "isHeadless", "jsonOutput", "isCI", "process", "resolveAgentModeSource", "env", "stdinIsTTY", "flag", "agentVar", "extractStderr", "cause", "seen", "current", "stderr", "stderrExcerpt", "buildMessage", "ctx", "parts", "OperationError", "path", "process", "$", "VERSION_RE", "BRANCH_SEMVER_RE", "KEBAB_RE", "RELEASE_BRANCH_PREFIX", "VERSION_BRANCH_PREFIX", "REFS_HEADS_PREFIX", "NEXT_TOKEN", "RESERVED_NAMES", "InvalidReleaseNameError", "message", "InvalidReleaseRefError", "stripRefsHeads", "input", "REFS_HEADS_PREFIX", "makeVersion", "major", "minor", "patch", "validateName", "name", "KEBAB_RE", "parseBranchName", "branch", "stripped", "RELEASE_BRANCH_PREFIX", "VERSION_BRANCH_PREFIX", "semverPart", "match", "BRANCH_SEMVER_RE", "namePart", "parseReleaseRef", "trimmed", "parsed", "versionMatch", "VERSION_RE", "NEXT_TOKEN", "err", "reason", "formatBranchName", "id", "formatPrTitle", "type", "prefix", "formatRcTitle", "formatJiraName", "displayLabel", "isReleaseBranch", "toTime", "value", "time", "compareReleaseIds", "a", "b", "dates", "timeA", "timeB", "listWorktrees", "cwd", "output", "$", "entries", "current", "line", "getCurrentWorktrees", "type", "process", "matches", "branch", "isReleaseBranch", "entry", "normalizeGitRootStderr", "error", "raw", "extractStderr", "projectRootRemediation", "hasStderr", "isAgentMode", "base", "getProjectRoot", "stderrExcerpt", "OperationError", "getMainRepoRoot", "root", "commonDir", "resolved", "path", "getCurrentBranch", "getWorkingTreeStatus", "isWorkingTreeClean", "isInsideLinkedWorktree", "gitDirResult", "commonDirResult", "gitDir", "branchExists", "branch", "$", "deleteLocalBranch", "getCurrentBranch", "deleteRemoteBranch", "$", "revParseVerify", "cwd", "ref", "commitish", "$", "isAncestor", "ancestor", "descendant", "error", "OperationError", "lsRemoteHead", "branch", "line", "pushAtomic", "refs", "refspecs", "path", "process", "$", "scratchWorktreePath", "cwd", "root", "process", "commonDir", "$", "runId", "path", "branchSlug", "branch", "resolutionWorktreePath", "projectRoot", "WORKTREES_DIR_SUFFIX", "WORKTREE_SUBDIRS", "hasMergeInProgress", "assertPristineWorktree", "OperationError", "status", "resetScratchWorktree", "run", "fn", "withScratchWorktree", "args", "anchor", "worktreePath", "add", "firstError", "worktree", "process", "pino", "pretty", "REDACT_PATHS", "initLoggerCLI", "logLevel", "ignoreFields", "logger", "fs", "os", "path", "process", "z", "assertNever", "value", "omitKey", "record", "key", "entryKey", "dropTopLevelKey", "key", "id", "note", "parsed", "omitKey", "dropDevProxyKeyMigration", "dropTopLevelKey", "dropEnvAutoLoadKeyMigration", "dropTopLevelKey", "dropEnvironmentsKeyMigration", "dropTopLevelKey", "stripLegacyIdeMode", "parsed", "ide", "changed", "stripEntry", "entry", "config", "omitKey", "nextIde", "stripLegacyIdeModeMigration", "RETIRED_IDE_PROVIDER", "isRetiredIdeEntry", "entry", "stripRetiredZedIde", "parsed", "ide", "kept", "omitKey", "stripRetiredZedIdeMigration", "CONFIG_MIGRATIONS", "stripLegacyIdeModeMigration", "stripRetiredZedIdeMigration", "dropEnvironmentsKeyMigration", "dropDevProxyKeyMigration", "dropEnvAutoLoadKeyMigration", "applyConfigMigrations", "parsed", "CONFIG_MIGRATIONS", "acc", "migration", "step", "fs", "os", "fileExists", "filePath", "tildify", "home", "randomBytes", "fs", "path", "process", "ConfigFileChangedError", "filePath", "DEFAULT_INDENT", "detectIndent", "raw", "PERMISSION_BITS", "writeMigratedConfigFile", "migrated", "expectedMtimeMs", "target", "fs", "dir", "path", "base", "tmp", "process", "randomBytes", "content", "stat", "err", "isRecord", "value", "migrateConfigFile", "parsed", "applyConfigMigrations", "tryAutoMigrateLayer", "layer", "parsedRaw", "raw", "schema", "migrated", "applyConfigMigrations", "second", "isCI", "writeMigratedConfigFile", "err", "logger", "tildify", "package_default", "INFRA_KIT_CONFIG_FILE", "USER_GLOBAL_CONFIG_FILE", "USER_PROJECTS_DIR", "dopplerEnvManagementSchema", "z", "envManagementSchema", "cursorIdeConfigSchema", "cursorIdeSchema", "ideSchema", "idesSchema", "jiraTaskManagerSchema", "taskManagerSchema", "orcaLayouts", "orcaConfigSchema", "worktreesConfigSchema", "devAppConfigSchema", "devConfigSchema", "proxySourceSchema", "devPresetAppSchema", "devPresetSchema", "devPresetsSchema", "protectedEnvsSchema", "envVarName", "mcpProxySchema", "spec", "ctx", "name", "PROTECTED_CHILD_ENV_NAMES", "mcpProxiesSchema", "repoRelativePathSchema", "value", "segments", "segment", "rawSegments", "vendorCopyEntrySchema", "vendorSourceSchema", "auditRulesSchema", "aliasRepoSchema", "infraKitConfigObject", "DEFAULT_DEV_PROXY_PORT", "infraKitConfigSchema", "cfg", "seen", "entry", "infraKitOverrideConfigSchema", "resolveConfiguredIdes", "config", "ide", "DEFAULT_ORCA_LAYOUT", "resolveOrcaLayout", "cached", "cachedPaths", "pathsCacheKey", "process", "os", "resolveUserConfigDir", "path", "USER_CONFIG_DIR_NAME", "resolveUserGlobalConfigPath", "getInfraKitConfigPaths", "key", "projectRoot", "getProjectRoot", "mainRepoRoot", "getMainRepoRoot", "projectName", "INFRA_KIT_CONFIG_FILE", "getInfraKitConfig", "options", "autoMigrate", "paths", "mainStat", "fs", "legacyYmlPath", "statIfExists", "isAgentMode", "userGlobalStat", "userProjectStat", "mtimes", "shallowEqual", "layers", "merged", "layer", "data", "loadLayer", "finalResult", "resetMergedConfigCache", "resetInfraKitConfigCache", "filePath", "readIfExists", "a", "b", "keys", "k", "withSetupHint", "error", "raw", "parsedRaw", "err", "isRecord", "buildEnvTokensRejectionMessage", "assertNoProjectLayerOnlyKeys", "result", "originalError", "outcome", "tryAutoMigrateLayer", "assertNever", "buildMcpLayerRejectionMessage", "buildVendorSourceLayerRejectionMessage", "buildAuditLayerRejectionMessage", "buildAliasRepoLayerRejectionMessage", "PROJECT_LAYER_ONLY_KEYS", "buildMessage", "StructuredRefusalError", "OperationError", "structuredContent", "exitCode", "context"]
 }