infra-kit 0.3.6 → 0.3.7

package/dist/chunk-EX66ZFV5.js

@@ -1,2 +0,0 @@
-import{b as I}from"./chunk-A7FAXZGI.js";import{m as f,q as x}from"./chunk-CHETBZ6M.js";import u from"node:path";var m="infra-kit",g=`${m}@latest`,w=(e,t,n)=>{let r=u.relative(n(u.resolve(e)),u.resolve(t));return r!==""&&!r.startsWith("..")&&!u.isAbsolute(r)},l=(e,t)=>u.resolve(e).split(u.sep).includes(t),z=(e,t)=>{let n=u.resolve(e).split(u.sep),r=n.indexOf("Cellar");return r!==-1&&n[r+1]===t},C=(e,t,n,r)=>{let o=e[t];return o!=null&&o!==""&&w(o,n,r)},H=[{manager:"volta",test:({selfRealPath:e,env:t,realpath:n})=>C(t,"VOLTA_HOME",e,n)||l(e,".volta")||l(e,"volta"),updateCommand:["volta","install",m],canSelfSpawn:!0},{manager:"homebrew",test:({selfRealPath:e})=>z(e,m),updateCommand:["brew","upgrade",m],canSelfSpawn:!1},{manager:"pnpm",test:({selfRealPath:e,env:t,realpath:n})=>C(t,"PNPM_HOME",e,n)||l(e,"pnpm")&&l(e,"global"),updateCommand:["pnpm","add","-g",g],canSelfSpawn:!0},{manager:"bun",test:({selfRealPath:e,env:t,realpath:n})=>C(t,"BUN_INSTALL",e,n)||l(e,".bun"),updateCommand:["bun","add","-g",g],canSelfSpawn:!0},{manager:"yarn",test:({selfRealPath:e})=>l(e,".yarn")||l(e,"yarn")&&l(e,"global"),updateCommand:["yarn","global","add",g],canSelfSpawn:!0},{manager:"npm",test:({selfRealPath:e,env:t,realpath:n})=>C(t,"npm_config_prefix",e,n),updateCommand:["npm","install","-g",g],canSelfSpawn:!0}],N=["npm","install","-g",g],M=e=>{let{selfRealPath:t,env:n,realpath:r,lazyNpmRoot:o}=e,s=H.find(({test:i})=>i({selfRealPath:t,env:n,realpath:r}));if(s)return{manager:s.manager,updateCommand:s.updateCommand,canSelfSpawn:s.canSelfSpawn};let a=o?.();return a!=null&&a!==""&&w(a,t,r)?{manager:"npm",updateCommand:N,canSelfSpawn:!0}:{manager:"unknown",updateCommand:N,canSelfSpawn:!1}},K=(e,t,n)=>l(e,"node_modules")&&w(t,e,n);import{realpathSync as G}from"node:fs";import $ from"node:path";var b=e=>{try{return G(e)}catch{return $.resolve(e)}};import{execFileSync as W}from"node:child_process";import B from"node:process";var Y=3e3,k=()=>{try{let t=W("npm",["root","-g"],{encoding:"utf-8",timeout:Y,stdio:["ignore","pipe","ignore"],shell:B.platform==="win32"}).trim();return t===""?void 0:t}catch{return}};import{spawnSync as ge}from"node:child_process";import{homedir as he}from"node:os";import E from"node:process";import d from"node:fs";import P from"node:path";import Q from"node:process";var X="update-check.lock",Z=1800*1e3,ee=()=>P.join(f(),X),te=(e,t)=>{try{t-d.statSync(e).mtimeMs>Z&&d.rmSync(e,{force:!0})}catch{}},R=(e={})=>{let t=e.nowMs??Date.now(),n=e.lockPath??ee();try{d.mkdirSync(P.dirname(n),{recursive:!0})}catch{return null}let r=()=>{try{return d.openSync(n,"wx",384)}catch{return null}},o=r();if(o===null&&(te(n,t),o=r()),o===null)return null;try{d.writeFileSync(o,String(Q.pid))}catch{}return()=>{try{d.closeSync(o)}catch{}try{d.rmSync(n,{force:!0})}catch{}}};var ne="https://registry.npmjs.org",re=5e3,oe=e=>Object.entries(e).find(([n,r])=>/^npm_config_registry$/i.test(n)&&r!=null&&r!=="")?.[1],ae=e=>{let t=oe(e),n=t!=null&&t!==""?t:ne;for(;n.endsWith("/");)n=n.slice(0,-1);return n},A=async(e,t=fetch)=>{let n=new AbortController,r=setTimeout(()=>{n.abort()},re);try{let o=await t(`${ae(e)}/${m}/latest`,{signal:n.signal,headers:{accept:"application/json"}});if(!o.ok)return null;let a=(await o.json())?.version;return typeof a=="string"&&a!==""?a:null}catch{return null}finally{clearTimeout(r)}};var se=/^(\d+)\.(\d+)\.(\d+)$/,_=e=>{let[t=""]=e.trim().split("+"),[n="",...r]=t.split("-"),o=se.exec(n);if(!o)return null;let[s,a,i]=[o[1],o[2],o[3]].map(Number);return{release:[s,a,i],prerelease:r.length>0?r.join("-").split("."):[]}},L=/^\d+$/,le=(e,t)=>{let n=L.test(e),r=L.test(t);return n&&r?Number(e)-Number(t):n!==r?n?-1:1:e<t?-1:1},ie=(e,t)=>{for(let n=0;n<Math.max(e.length,t.length);n+=1){let r=e[n],o=t[n];if(r===void 0)return-1;if(o===void 0)return 1;if(r!==o)return le(r,o)}return 0},U=(e,t)=>{let n=_(e),r=_(t);if(!n||!r)return!1;for(let a=0;a<3;a+=1){let i=n.release[a],h=r.release[a];if(i!==h)return i>h}let o=n.prerelease.length===0,s=r.prerelease.length===0;return o!==s?o:ie(n.prerelease,r.prerelease)>0};import T from"node:fs";import O from"node:path";var F="update-check.json",ce=1440*60*1e3,ue=3600*1e3,pe=new Set(["fetch-failed","install-failed","parent-still-running","parent-unknown","installing"]),me=()=>O.join(f(),F),de=e=>Array.isArray(e)&&e.every(t=>typeof t=="string"),fe=e=>{if(typeof e!="object"||e===null)return!1;let{lastCheckMs:t,latestVersion:n,updateCommand:r,outcome:o}=e;return typeof t=="number"&&Number.isFinite(t)&&(n===null||typeof n=="string")&&(r===null||de(r))&&(o==null||typeof o=="string")},$e=(e=t=>T.readFileSync(t,"utf8"))=>{try{let t=JSON.parse(e(me()));return fe(t)?t:null}catch{return null}},D=e=>{let t=f();T.mkdirSync(t,{recursive:!0}),x(O.join(t,F),JSON.stringify(e),384)},We=(e,t)=>{if(!e)return!0;let n=t-e.lastCheckMs;if(n<0)return!0;let r=e.outcome!=null&&pe.has(e.outcome)?ue:ce;return n>=r};var ye=200,Ce=300*1e3,Se=e=>{try{return E.kill(e,0),!0}catch{return!1}},we=e=>new Promise(t=>{setTimeout(t,e)}),Me=async(e,t)=>{let n=t.clock()+Ce;for(;t.clock()<n;){if(!t.isProcessAlive(e))return!0;await t.sleep(ye)}return!t.isProcessAlive(e)},at=async(e,t)=>{let r=(t.acquireLock??R)();if(!r)return"already-running";try{return await be(e,t)}finally{r()}},be=async(e,t)=>{let n=t.env??E.env,r=t.nowMs??Date.now(),o=t.fetchLatest??A,s=t.writeCache??D,a=t.isProcessAlive??Se,i=t.sleep??we,h=t.clock??Date.now,V=t.lazyNpmRoot??k,j=t.spawnSync??ge,c=await o(n),p=(v,q)=>(s({lastCheckMs:r,...q,outcome:v}),v);if(c===null)return p("fetch-failed",{latestVersion:null,updateCommand:null});if(!U(c,e))return p("up-to-date",{latestVersion:c,updateCommand:null});let{canSelfSpawn:J,updateCommand:y}=M({selfRealPath:t.selfRealPath,env:n,realpath:b,lazyNpmRoot:V});if(!J)return p("cannot-self-spawn",{latestVersion:c,updateCommand:y});if(t.parentPid==null)return p("parent-unknown",{latestVersion:c,updateCommand:null});if(s({lastCheckMs:r,latestVersion:c,updateCommand:null,outcome:"installing"}),!await Me(t.parentPid,{isProcessAlive:a,sleep:i,clock:h}))return p("parent-still-running",{latestVersion:c,updateCommand:null});let S=j(y[0],y.slice(1),{stdio:"ignore",shell:E.platform==="win32",cwd:he(),env:I(n),windowsHide:!0});return S.error||S.signal||S.status!==0?p("install-failed",{latestVersion:c,updateCommand:y}):p("installed",{latestVersion:null,updateCommand:null})};export{M as a,K as b,k as c,b as d,U as e,$e as f,We as g,at as h};
-//# sourceMappingURL=chunk-EX66ZFV5.js.map

package/dist/chunk-EX66ZFV5.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/lib/install-manager/install-manager.ts", "../src/lib/install-manager/safe-realpath.ts", "../src/lib/install-manager/npm-root.ts", "../src/lib/update-check/run-update-check.ts", "../src/lib/update-check/lock.ts", "../src/lib/update-check/registry.ts", "../src/lib/update-check/semver.ts", "../src/lib/update-check/update-cache.ts"],
-  "sourcesContent": ["/**\n * Pure detection of *how* this CLI was installed, so a self-update advisory can name the one command\n * that will actually work. No fs, no spawn, no `process.env` read \u2014 every input is injected, which is\n * what lets the whole matrix be table-tested.\n *\n * Detection is env-first and LAZY: the only signal that costs a subprocess (`npm root -g`) is passed in\n * as `lazyNpmRoot` and consulted solely when every cheaper matcher has missed.\n */\nimport path from 'node:path'\n\n/** The published package this CLI updates itself to. Single source for every suggested argv. */\nexport const PACKAGE_NAME = 'infra-kit'\n\nconst LATEST = `${PACKAGE_NAME}@latest`\n\nexport type InstallManager = 'npm' | 'pnpm' | 'yarn' | 'bun' | 'volta' | 'homebrew' | 'unknown'\n\nexport interface InstallManagerInfo {\n  manager: InstallManager\n  /** The command to run. Only safe to spawn ourselves when `canSelfSpawn`; otherwise print it. */\n  updateCommand: string[]\n  /** False when we must not run the command for the user \u2014 either it needs sudo/a tap, or we guessed. */\n  canSelfSpawn: boolean\n}\n\n/**\n * Canonicalises a candidate *root* directory. Required, not optional: `selfRealPath` has already had its\n * symlinks followed, so comparing it against a raw `PNPM_HOME`/`npm root -g`/`cwd` compares a resolved\n * path to an unresolved one and silently never matches. macOS is the everyday proof \u2014 `/var` is a symlink\n * to `/private/var`, so a global install under `/var/...` reports `unknown` unless both sides are resolved.\n * Callers inject the real thing; tests inject a stub.\n */\nexport type RealpathFn = (dir: string) => string\n\nexport interface DetectInstallManagerInput {\n  /** Fully-resolved (symlinks followed) path to this CLI's entry file. */\n  selfRealPath: string\n  env: NodeJS.ProcessEnv\n  /** Canonicalises each candidate root before comparison. See {@link RealpathFn}. */\n  realpath: RealpathFn\n  /** `npm root -g`, deferred: invoked at most once, and only when no cheaper matcher hit. */\n  lazyNpmRoot?: () => string | undefined\n}\n\n/**\n * Is `child` inside the `parent` subtree? Boundary-aware: a naive `startsWith` would call\n * `/Users/x/pnpm-ish` a child of `/Users/x/pnpm`. `parent` is canonicalised first because it arrives raw\n * from the environment while `child` is already a realpath.\n */\nconst isWithin = (parent: string, child: string, realpath: RealpathFn): boolean => {\n  const rel = path.relative(realpath(path.resolve(parent)), path.resolve(child))\n\n  return rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel)\n}\n\n/** Does `p` contain `name` as a whole path SEGMENT? `/a/node_modules_backup/b` must not match `node_modules`. */\nconst hasSegment = (p: string, name: string): boolean => {\n  return path.resolve(p).split(path.sep).includes(name)\n}\n\n/**\n * Is `p` inside a Homebrew keg belonging to the `name` FORMULA \u2014 i.e. `.../Cellar/<name>/<version>/...`?\n *\n * The formula name is what makes this sound. A bare `Cellar` segment says only \"somewhere under a keg\",\n * and the keg it lands in is routinely someone else's: when npm's global prefix is a node keg\n * (`npm config set prefix \"$(brew --prefix node)\"`, or any keg-only `node@X`), an `npm i -g` package\n * installs to `Cellar/node/<v>/lib/node_modules/<pkg>/...` \u2014 brew has never heard of it, yet the segment\n * is right there. Requiring `<name>` to sit directly after `Cellar` is what separates \"brew installed\n * THIS\" from \"brew installed the runtime that installed this\".\n *\n * Works for both keg layouts, since each is rooted at the formula: a plain formula\n * (`Cellar/infra-kit/1.2.3/bin/infra-kit`) and brew's node-CLI layout\n * (`Cellar/infra-kit/1.2.3/libexec/lib/node_modules/infra-kit/dist/cli.js`). Do NOT try to tell them\n * apart by excluding `node_modules` \u2014 the second one contains it.\n */\nconst isBrewKegOf = (p: string, name: string): boolean => {\n  const segments = path.resolve(p).split(path.sep)\n  const cellar = segments.indexOf('Cellar')\n\n  return cellar !== -1 && segments[cellar + 1] === name\n}\n\n/** `env[key]` names a directory that contains `selfRealPath`. Absent/empty env var \u2192 no match. */\nconst underEnvDir = (env: NodeJS.ProcessEnv, key: string, selfRealPath: string, realpath: RealpathFn): boolean => {\n  const dir = env[key]\n\n  return dir != null && dir !== '' && isWithin(dir, selfRealPath, realpath)\n}\n\ninterface Matcher extends Omit<InstallManagerInfo, 'manager'> {\n  manager: InstallManager\n  test: (input: Required<Pick<DetectInstallManagerInput, 'selfRealPath' | 'env' | 'realpath'>>) => boolean\n}\n\n/**\n * Ordered, first-hit-wins. Order matters: volta and homebrew wrap an npm-shaped layout, so they must be\n * consulted before the generic npm prefix matcher would claim them.\n */\nconst MATCHERS: Matcher[] = [\n  {\n    manager: 'volta',\n    // volta owns the shim; `volta install` is the correct tool, not a workaround \u2014 so we may run it.\n    test: ({ selfRealPath, env, realpath }) => {\n      return (\n        underEnvDir(env, 'VOLTA_HOME', selfRealPath, realpath) ||\n        hasSegment(selfRealPath, '.volta') ||\n        hasSegment(selfRealPath, 'volta')\n      )\n    },\n    updateCommand: ['volta', 'install', PACKAGE_NAME],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'homebrew',\n    // `brew upgrade` can touch the prefix, relink, and prompt \u2014 never ours to run unattended.\n    //\n    // Our own keg is the ONLY sound signal \u2014 see {@link isBrewKegOf}. Two broader tests look plausible\n    // and are both wrong, because each answers \"did brew put something here?\" when the question is \"does\n    // brew own THIS package?\":\n    //   - `HOMEBREW_PREFIX` containment: when node comes from brew, npm's global prefix IS\n    //     $HOMEBREW_PREFIX, so EVERY `npm i -g` package lands under it, unknown to brew.\n    //   - a bare `Cellar` segment: an npm prefix pointed at a node keg puts packages inside that keg.\n    // Either misfire tells macOS users to run `brew upgrade infra-kit` \u2014 a formula that does not exist \u2014\n    // and, far worse, makes the background auto-updater bail with `cannot-self-spawn` forever, so the\n    // very fix for it can never reach them. Detection runs on the realpath, and a linked brew bin always\n    // resolves into its own keg, so the narrow test has no false negatives to trade for this.\n    test: ({ selfRealPath }) => {\n      return isBrewKegOf(selfRealPath, PACKAGE_NAME)\n    },\n    updateCommand: ['brew', 'upgrade', PACKAGE_NAME],\n    canSelfSpawn: false,\n  },\n  {\n    manager: 'pnpm',\n    test: ({ selfRealPath, env, realpath }) => {\n      return (\n        underEnvDir(env, 'PNPM_HOME', selfRealPath, realpath) ||\n        (hasSegment(selfRealPath, 'pnpm') && hasSegment(selfRealPath, 'global'))\n      )\n    },\n    updateCommand: ['pnpm', 'add', '-g', LATEST],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'bun',\n    test: ({ selfRealPath, env, realpath }) => {\n      return underEnvDir(env, 'BUN_INSTALL', selfRealPath, realpath) || hasSegment(selfRealPath, '.bun')\n    },\n    updateCommand: ['bun', 'add', '-g', LATEST],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'yarn',\n    test: ({ selfRealPath }) => {\n      return (\n        hasSegment(selfRealPath, '.yarn') || (hasSegment(selfRealPath, 'yarn') && hasSegment(selfRealPath, 'global'))\n      )\n    },\n    updateCommand: ['yarn', 'global', 'add', LATEST],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'npm',\n    test: ({ selfRealPath, env, realpath }) => {\n      return underEnvDir(env, 'npm_config_prefix', selfRealPath, realpath)\n    },\n    updateCommand: ['npm', 'install', '-g', LATEST],\n    canSelfSpawn: true,\n  },\n]\n\nconst NPM_UPDATE_COMMAND = ['npm', 'install', '-g', LATEST]\n\n/**\n * Identify the package manager that owns `selfRealPath`.\n *\n * `lazyNpmRoot` is the fallback probe and is invoked at most once, only after every env/path matcher has\n * missed \u2014 a global `npm root -g` subprocess is never paid for a pnpm or volta install. When nothing\n * matches we report `unknown` with an npm command that is a *suggestion only* (`canSelfSpawn: false`):\n * running a guessed global install is worse than printing one.\n *\n * @example\n * detectInstallManager({ selfRealPath: '/Users/x/Library/pnpm/global/5/node_modules/infra-kit/dist/cli.js', env: {} })\n * // => { manager: 'pnpm', updateCommand: ['pnpm', 'add', '-g', 'infra-kit@latest'], canSelfSpawn: true }\n */\nexport const detectInstallManager = (input: DetectInstallManagerInput): InstallManagerInfo => {\n  const { selfRealPath, env, realpath, lazyNpmRoot } = input\n  const hit = MATCHERS.find(({ test }) => {\n    return test({ selfRealPath, env, realpath })\n  })\n\n  if (hit) return { manager: hit.manager, updateCommand: hit.updateCommand, canSelfSpawn: hit.canSelfSpawn }\n\n  const npmRoot = lazyNpmRoot?.()\n\n  if (npmRoot != null && npmRoot !== '' && isWithin(npmRoot, selfRealPath, realpath)) {\n    return { manager: 'npm', updateCommand: NPM_UPDATE_COMMAND, canSelfSpawn: true }\n  }\n\n  return { manager: 'unknown', updateCommand: NPM_UPDATE_COMMAND, canSelfSpawn: false }\n}\n\n/**\n * Is this CLI running from a *project-local* `node_modules` (as opposed to a global root)?\n *\n * The cwd clause is what does the distinguishing \u2014 BOTH a project install and a global root contain a\n * `/node_modules/` segment (`pnpm root -g` is `~/Library/pnpm/global/5/node_modules`). Without it we\n * would nag every global pnpm user to stop using a local install they do not have.\n *\n * Accepted false-negative: invoked from a subdirectory (cwd `project/apps/x`, deps at\n * `project/node_modules`) this returns false and the advisory stays silent. Under-warning is the safe\n * direction for a best-effort, never-throwing advisory \u2014 do not \"fix\" it by dropping the cwd clause.\n *\n * `cwd` is canonicalised before comparison for the same reason `detectInstallManager` canonicalises its\n * roots: `selfRealPath` is a realpath, and comparing it to an unresolved cwd never matches.\n *\n * @example\n * isLocalNodeModulesInstall('/repo/node_modules/infra-kit/dist/cli.js', '/repo', (p) => p) // => true\n */\nexport const isLocalNodeModulesInstall = (selfRealPath: string, cwd: string, realpath: RealpathFn): boolean => {\n  return hasSegment(selfRealPath, 'node_modules') && isWithin(cwd, selfRealPath, realpath)\n}\n", "import { realpathSync } from 'node:fs'\nimport path from 'node:path'\n\n/**\n * The impure companion to the pure detection module: canonicalise a directory that may not exist.\n *\n * `realpathSync` throws on a missing path, and candidate roots routinely miss \u2014 `PNPM_HOME` can point at a\n * directory the user never created, `npm root -g` can name a prefix that was removed. A throw there would\n * turn \"we could not identify your install\" into a crash, so an unresolvable path falls back to\n * `path.resolve`, which still normalises `.`/`..` and yields a usable, non-matching absolute path.\n */\nexport const safeRealpath = (dir: string): string => {\n  try {\n    return realpathSync(dir)\n  } catch {\n    return path.resolve(dir)\n  }\n}\n", "/* eslint-disable sonarjs/no-os-command-from-path */\n/**\n * `npm root -g`, the LAZY fallback for {@link detectInstallManager}.\n *\n * Why it is indispensable: the `npm` matcher keys off `npm_config_prefix`, which npm sets only while npm\n * itself is running. A user who ran `npm i -g infra-kit` months ago and now types `ik` has no such var,\n * so every cheap matcher misses and detection reports `unknown` / `canSelfSpawn: false`. Without this\n * probe the single most common install method can never update itself.\n *\n * Shared by `self-update` (interactive) and the background update worker so the two can never disagree\n * about who owns the install.\n */\nimport { execFileSync } from 'node:child_process'\nimport process from 'node:process'\n\nconst NPM_ROOT_TIMEOUT_MS = 3_000\n\n/**\n * The global npm root, or undefined when npm is absent, slow, or errors. Costs a subprocess, so\n * `detectInstallManager` invokes it at most once and only after every env/path matcher has missed \u2014 a\n * pnpm or volta install never pays for it.\n *\n * Resolving the user's `npm` from PATH is inherent here: we must ask the very package manager that owns\n * this install where its global root is. Pinning an absolute path would defeat the detection.\n *\n * @example\n * defaultLazyNpmRoot() // => '/usr/local/lib/node_modules' | undefined\n */\nexport const defaultLazyNpmRoot = (): string | undefined => {\n  try {\n    const out = execFileSync('npm', ['root', '-g'], {\n      encoding: 'utf-8',\n      timeout: NPM_ROOT_TIMEOUT_MS,\n      stdio: ['ignore', 'pipe', 'ignore'],\n      shell: process.platform === 'win32',\n    })\n    const trimmed = out.trim()\n\n    return trimmed === '' ? undefined : trimmed\n  } catch {\n    return undefined\n  }\n}\n", "/**\n * The CHILD half of the auto-update, spawned detached by `maybeAutoUpdate`. It outlives the CLI\n * invocation that started it, so it may take its time and it may replace the binary.\n *\n * WHY IT WAITS FOR THE PARENT TO EXIT \u2014 the load-bearing invariant of this whole feature:\n * `scripts/build.js` sets esbuild `splitting: true`, so `dist/cli.js` lazily imports sibling\n * `chunk-*.js` files at runtime (that is how the Ink TUI stays off the fast path). A package manager\n * installing over `dist/` mid-command deletes chunks the parent has not imported yet, and the parent\n * dies on a dynamic import of a file that no longer exists. Waiting for the parent to exit is what\n * makes a silent background install safe rather than a random crash under `infra-kit dev`.\n */\nimport { spawnSync } from 'node:child_process'\nimport { homedir } from 'node:os'\nimport process from 'node:process'\n\nimport { defaultLazyNpmRoot, detectInstallManager, safeRealpath } from 'src/lib/install-manager'\nimport { packageManagerInstallEnv } from 'src/lib/pm-env'\n\nimport { acquireUpdateLock } from './lock'\nimport { fetchLatestVersion } from './registry'\nimport { isNewerVersion } from './semver'\nimport { writeUpdateCache } from './update-cache'\nimport type { UpdateCache } from './update-cache'\n\n/** How often to re-check whether the parent is gone. */\nexport const PARENT_POLL_INTERVAL_MS = 200\n\n/**\n * Give up waiting after this long. A long-lived parent (`infra-kit dev` runs for hours) must not leave\n * an immortal child pinned to a stale version: we simply skip this cycle. `lastCheckMs` is already\n * persisted by then, so the next short-lived command re-checks after the normal 24h window.\n */\nexport const PARENT_WAIT_TIMEOUT_MS = 5 * 60 * 1000\n\nexport interface RunUpdateCheckDeps {\n  env?: NodeJS.ProcessEnv\n  nowMs?: number\n  fetchLatest?: (env: NodeJS.ProcessEnv) => Promise<string | null>\n  writeCache?: typeof writeUpdateCache\n  isProcessAlive?: (pid: number) => boolean\n  sleep?: (ms: number) => Promise<void>\n  /** Monotonic-ish source for the parent-wait deadline. Injected so the timeout is testable without real time. */\n  clock?: () => number\n  /** `npm root -g` probe. Defaults to the real subprocess; this child is detached, so it can afford one. */\n  lazyNpmRoot?: () => string | undefined\n  /** Single-flight guard. Returns a release fn, or null when another worker already holds the lock. */\n  acquireLock?: () => (() => void) | null\n  spawnSync?: typeof spawnSync\n  /** Realpath of the installed `dist/cli.js`, used to identify the owning package manager. */\n  selfRealPath: string\n  parentPid?: number\n}\n\n/** Signal 0 performs the permission/existence check without delivering anything. */\nconst defaultIsProcessAlive = (pid: number): boolean => {\n  try {\n    process.kill(pid, 0)\n\n    return true\n  } catch {\n    return false\n  }\n}\n\nconst defaultSleep = (ms: number): Promise<void> => {\n  return new Promise((resolve) => {\n    setTimeout(resolve, ms)\n  })\n}\n\n/**\n * Block until `parentPid` exits or {@link PARENT_WAIT_TIMEOUT_MS} elapses. Returns whether the parent\n * is actually gone \u2014 the caller must not install on a timeout.\n */\nconst waitForParentExit = async (\n  parentPid: number,\n  deps: Required<Pick<RunUpdateCheckDeps, 'isProcessAlive' | 'sleep' | 'clock'>>,\n): Promise<boolean> => {\n  const deadline = deps.clock() + PARENT_WAIT_TIMEOUT_MS\n\n  while (deps.clock() < deadline) {\n    if (!deps.isProcessAlive(parentPid)) return true\n\n    await deps.sleep(PARENT_POLL_INTERVAL_MS)\n  }\n\n  return !deps.isProcessAlive(parentPid)\n}\n\nexport type UpdateCheckOutcome =\n  | 'installed'\n  | 'install-failed'\n  | 'up-to-date'\n  | 'fetch-failed'\n  | 'cannot-self-spawn'\n  | 'parent-still-running'\n  | 'parent-unknown'\n  | 'already-running'\n\n/**\n * Fetch, decide, and (when safe) install \u2014 returning WHY it did what it did so tests can distinguish\n * \"no update\" from \"could not install\". Never throws.\n *\n * `lastCheckMs` is written from the ATTEMPT, before any early return. If it were written only on\n * success, an offline user would re-spawn a doomed child on every single command.\n *\n * @example\n * await runUpdateCheck('0.1.130', { selfRealPath: '/usr/local/lib/node_modules/infra-kit/dist/cli.js' })\n * // => 'installed'\n */\nexport const runUpdateCheck = async (currentVersion: string, deps: RunUpdateCheckDeps): Promise<UpdateCheckOutcome> => {\n  const acquireLock = deps.acquireLock ?? acquireUpdateLock\n\n  // Single-flight. N shells launched at once all read the same stale cache and each spawns a worker;\n  // the cache throttle cannot stop them because it is only written after the fetch returns. Without\n  // this, a pending update means N concurrent `npm install -g` over one global directory.\n  const release = acquireLock()\n\n  if (!release) return 'already-running'\n\n  try {\n    return await runUpdateCheckLocked(currentVersion, deps)\n  } finally {\n    release()\n  }\n}\n\nconst runUpdateCheckLocked = async (currentVersion: string, deps: RunUpdateCheckDeps): Promise<UpdateCheckOutcome> => {\n  const env = deps.env ?? process.env\n  const nowMs = deps.nowMs ?? Date.now()\n  const fetchLatest = deps.fetchLatest ?? fetchLatestVersion\n  const writeCache = deps.writeCache ?? writeUpdateCache\n  const isProcessAlive = deps.isProcessAlive ?? defaultIsProcessAlive\n  const sleep = deps.sleep ?? defaultSleep\n  const clock = deps.clock ?? Date.now\n  const lazyNpmRoot = deps.lazyNpmRoot ?? defaultLazyNpmRoot\n  const spawn = deps.spawnSync ?? spawnSync\n\n  const latestVersion = await fetchLatest(env)\n\n  // Every path below writes the cache EXACTLY once, and always with `lastCheckMs: nowMs` \u2014 the throttle\n  // burns on the ATTEMPT, never on success. If it burned only on success, an offline user would respawn\n  // a doomed child on every command.\n  const finish = (\n    outcome: UpdateCheckOutcome,\n    cache: Omit<UpdateCache, 'lastCheckMs' | 'outcome'>,\n  ): UpdateCheckOutcome => {\n    // `outcome` is recorded on EVERY write: it is what lets a reader (human or `isStale`) tell a settled\n    // `installed`/`up-to-date` from a transient `fetch-failed`, all of which otherwise write an identical\n    // `{latestVersion:null}`. See `UpdateCache.outcome`.\n    writeCache({ lastCheckMs: nowMs, ...cache, outcome })\n\n    return outcome\n  }\n\n  if (latestVersion === null) return finish('fetch-failed', { latestVersion: null, updateCommand: null })\n  if (!isNewerVersion(latestVersion, currentVersion))\n    return finish('up-to-date', { latestVersion, updateCommand: null })\n\n  // `lazyNpmRoot` is what makes the COMMON case work: a plain `npm i -g infra-kit` leaves no\n  // `npm_config_prefix` in the user's shell, so every cheap matcher misses and detection would report\n  // `unknown` / `canSelfSpawn: false`. Without this probe the auto-update would silently degrade to a\n  // notice for the majority of installs. The subprocess is affordable here and nowhere else.\n  const { canSelfSpawn, updateCommand } = detectInstallManager({\n    selfRealPath: deps.selfRealPath,\n    env,\n    realpath: safeRealpath,\n    lazyNpmRoot,\n  })\n\n  // Homebrew relinks its prefix and may prompt; an unknown location means the command is a guess.\n  // Both stay the user's call, so record the command for `maybeAutoUpdate` to print next invocation.\n  if (!canSelfSpawn) return finish('cannot-self-spawn', { latestVersion, updateCommand })\n\n  // Fail SAFE. Without a parent to outlive we cannot know whether a live CLI is still lazily importing\n  // `chunk-*.js` out of the `dist/` we are about to replace, so we skip the cycle rather than install\n  // blind. The real spawn always passes `--parent-pid`; only a hand-run worker lands here.\n  if (deps.parentPid == null) return finish('parent-unknown', { latestVersion, updateCommand: null })\n\n  // Burn the throttle NOW, before the two unbounded-ish operations below (a 5-minute parent wait, then an\n  // install of no fixed duration). Everything after this point can take many minutes, and until the cache\n  // is written it still reads as STALE \u2014 so every new shell in that window spawns its own worker, and the\n  // single-flight lock becomes the only thing standing between them and concurrent `npm install -g` runs\n  // over one global directory. The lock is reaped by mtime (LOCK_STALE_MS), so a slow enough install has\n  // its live lock stolen and we get exactly the pile-up the lock exists to prevent.\n  //\n  // Writing the stamp here makes the throttle \u2014 not the lock \u2014 the primary guard, which is what the cache\n  // was always for. `finish()` overwrites this with the real outcome; this is the only path that writes\n  // the cache twice, and deliberately so.\n  //\n  // `outcome: 'installing'` is a RETRYABLE checkpoint (see `RETRYABLE_OUTCOMES`): if the worker is killed\n  // mid-install (machine sleeps, SIGKILL) and never reaches `finish()`, this stamp is what the next run\n  // reads \u2014 and the short retry window lets it try again in an hour rather than a full day.\n  writeCache({ lastCheckMs: nowMs, latestVersion, updateCommand: null, outcome: 'installing' })\n\n  const parentGone = await waitForParentExit(deps.parentPid, { isProcessAlive, sleep, clock })\n\n  // A long-lived parent (`infra-kit dev`) outlasted the wait. Stay silent and retry next window.\n  if (!parentGone) return finish('parent-still-running', { latestVersion, updateCommand: null })\n\n  // `shell` on win32 so the `.cmd` shims npm/pnpm/yarn ship as global bins resolve.\n  //\n  // `packageManagerInstallEnv` strips the inherited npx/dlx markers \u2014 which otherwise make\n  // pnpm/portless-style tools believe they were invoked via `npx`/`dlx` and refuse to run \u2014 while KEEPING\n  // `npm_config_prefix` and `npm_config_registry`. Using the blunt `withoutPackageManagerEnv` here was a\n  // bug: it also erased the prefix that `detectInstallManager` had just matched on, so we would detect a\n  // global install at prefix P and then install into the default prefix instead \u2014 silently, forever. See\n  // the module doc on `packageManagerInstallEnv`.\n  //\n  // `cwd` is pinned to the home directory, and this is a SECURITY control, not tidiness: npm resolves\n  // `registry=` from an `.npmrc` on disk relative to the cwd. Inheriting the caller's cwd would let any\n  // repo containing a hostile `.npmrc` silently redirect this unattended `install -g` to an attacker's\n  // registry, executing its lifecycle scripts. Stripping `npm_config_registry` from the env does NOT\n  // close that hole, because the redirect lives in a file, not the environment.\n  const result = spawn(updateCommand[0] as string, updateCommand.slice(1), {\n    stdio: 'ignore',\n    shell: process.platform === 'win32',\n    cwd: homedir(),\n    env: packageManagerInstallEnv(env),\n    windowsHide: true,\n  })\n\n  // Record the manual command so a persistently failing silent install (EACCES on a root-owned global\n  // dir, say) still surfaces ONE actionable line, instead of failing invisibly forever.\n  if (result.error || result.signal || result.status !== 0) {\n    return finish('install-failed', { latestVersion, updateCommand })\n  }\n\n  // The installed version is now `latestVersion`; clear it so the next run does not re-notify.\n  return finish('installed', { latestVersion: null, updateCommand: null })\n}\n", "/**\n * Single-flight lock for the background update worker.\n *\n * Without it, N shells starting at once all read the same stale cache and each spawns a worker \u2014 and\n * once a newer version exists, each of those runs `npm install -g` concurrently, over the same global\n * directory. (Measured: five concurrent `ik` invocations spawn five workers.) The throttle in the cache\n * cannot prevent this: it is only written AFTER the fetch returns, long after the other workers launched.\n *\n * `openSync(path, 'wx')` is the primitive \u2014 an atomic create-if-absent, so exactly one worker wins even\n * if all of them call it in the same millisecond.\n */\nimport fs from 'node:fs'\nimport path from 'node:path'\nimport process from 'node:process'\n\nimport { getCacheRoot } from 'src/lib/constants'\n\nexport const LOCK_FILE_NAME = 'update-check.lock'\n\n/**\n * A lock older than this is assumed to belong to a worker that was killed before it could clean up.\n *\n * Must exceed the worker's ENTIRE critical section, and the install is part of it: the lock is held across\n * `fetch` (\u22642.5s) + the parent wait (\u22645min) + `npm install -g`, which has no bound at all \u2014 a cold cache on\n * a slow link can run for many minutes. The previous 10 minutes was budgeted from the wait and the fetch\n * alone, silently omitting the very operation the lock exists to serialise. A slow enough install therefore\n * had its own LIVE lock reaped as stale by the next worker, which then ran a second concurrent\n * `npm install -g` over the same global directory \u2014 precisely the pile-up described above.\n *\n * The throttle, not this timeout, is now the primary guard: `runUpdateCheck` stamps `lastCheckMs` BEFORE\n * the wait and the install, so concurrent shells stop spawning workers at all. This value only has to\n * outlive a plausible install, and is deliberately generous \u2014 the cost of being too large is that a worker\n * killed mid-install delays the next attempt, which the 24h throttle would delay anyway.\n */\nexport const LOCK_STALE_MS = 30 * 60 * 1000\n\nexport const lockFilePath = (): string => {\n  return path.join(getCacheRoot(), LOCK_FILE_NAME)\n}\n\nexport interface LockDeps {\n  nowMs?: number\n  lockPath?: string\n}\n\n/** Delete a lock whose mtime predates the staleness window. Best-effort: losing the race is harmless. */\nconst reapIfStale = (lockPath: string, nowMs: number): void => {\n  try {\n    if (nowMs - fs.statSync(lockPath).mtimeMs > LOCK_STALE_MS) fs.rmSync(lockPath, { force: true })\n  } catch {\n    // Vanished under us \u2014 another worker reaped it. Nothing to do.\n  }\n}\n\n/**\n * Take the lock, or return null when another worker already holds it.\n *\n * Returns a release function rather than a boolean so the caller cannot forget which path releases:\n * there is exactly one handle, and it is the only thing that can unlink the file.\n *\n * @example\n * const release = acquireUpdateLock()\n * if (!release) return 'already-running'\n * try { ... } finally { release() }\n */\nexport const acquireUpdateLock = (deps: LockDeps = {}): (() => void) | null => {\n  const nowMs = deps.nowMs ?? Date.now()\n  const lockPath = deps.lockPath ?? lockFilePath()\n\n  try {\n    fs.mkdirSync(path.dirname(lockPath), { recursive: true })\n  } catch {\n    return null\n  }\n\n  const open = (): number | null => {\n    try {\n      // 'wx' fails with EEXIST if the file is already there: an atomic test-and-set.\n      return fs.openSync(lockPath, 'wx', 0o600)\n    } catch {\n      return null\n    }\n  }\n\n  let fd = open()\n\n  if (fd === null) {\n    reapIfStale(lockPath, nowMs)\n    // One retry only. If a live worker holds the lock, we are the loser and must simply stand down.\n    fd = open()\n  }\n\n  if (fd === null) return null\n\n  try {\n    fs.writeFileSync(fd, String(process.pid))\n  } catch {\n    // The pid is a debugging aid, not part of the protocol; the lock is held either way.\n  }\n\n  return () => {\n    try {\n      fs.closeSync(fd)\n    } catch {\n      // Already closed.\n    }\n\n    try {\n      fs.rmSync(lockPath, { force: true })\n    } catch {\n      // Already gone; a later worker will reap it via LOCK_STALE_MS regardless.\n    }\n  }\n}\n", "/**\n * Ask the npm registry for the `latest` dist-tag. Node >= 24 (see `engines`), so global `fetch` is\n * available and this needs no dependency.\n */\nimport { PACKAGE_NAME } from 'src/lib/install-manager'\n\nexport const DEFAULT_REGISTRY = 'https://registry.npmjs.org'\n\n/**\n * Bounded so a hanging registry can never keep a detached child alive indefinitely. 5s, not a tighter\n * bound: the abbreviated `/pkg/latest` endpoint is usually ~20-900ms, but a cold TLS/DNS handshake in a\n * freshly-spawned worker can spike past a 2.5s cap \u2014 and a single trip used to cost a `fetch-failed` that\n * pushed the next check a full day out. A detached child that lingers a few extra seconds harms nothing.\n */\nexport const FETCH_TIMEOUT_MS = 5_000\n\n/**\n * The registry this install actually talks to. A user behind a corporate mirror has `npm_config_registry`\n * set; hitting registry.npmjs.org directly would either fail closed (firewall) or, worse, report a public\n * version they cannot install.\n *\n * @example\n * registryUrl({ npm_config_registry: 'https://nexus.corp/repo/npm/' }) // => 'https://nexus.corp/repo/npm'\n */\n/**\n * `npm_config_registry` in WHICHEVER case the environment spells it.\n *\n * A bare `env.npm_config_registry` reads only the lowercase form, but npm itself matches `/^npm_config_/i`,\n * and POSIX `process.env` is case-SENSITIVE \u2014 so a `NPM_CONFIG_REGISTRY` (the form Dockerfiles and CI\n * images export) was invisible here while npm honoured it. The check then queried the public registry that\n * the install would never touch: the two halves of this feature were exactly inverted.\n */\nconst configuredRegistry = (env: NodeJS.ProcessEnv): string | undefined => {\n  const hit = Object.entries(env).find(([key, value]) => {\n    return /^npm_config_registry$/i.test(key) && value != null && value !== ''\n  })\n\n  return hit?.[1]\n}\n\nexport const registryUrl = (env: NodeJS.ProcessEnv): string => {\n  const configured = configuredRegistry(env)\n\n  let base = configured != null && configured !== '' ? configured : DEFAULT_REGISTRY\n\n  // A `/\\/+$/` regex would do this in one line, but its backtracking is super-linear on a hostile input.\n  while (base.endsWith('/')) {\n    base = base.slice(0, -1)\n  }\n\n  return base\n}\n\n/**\n * The published `latest` version, or null on ANY failure (offline, timeout, non-200, malformed body).\n * Never throws: a failed check must be indistinguishable from \"no update available\" to every caller.\n *\n * @example\n * await fetchLatestVersion(process.env) // => '0.1.131' | null\n */\nexport const fetchLatestVersion = async (\n  env: NodeJS.ProcessEnv,\n  fetchFn: typeof fetch = fetch,\n): Promise<string | null> => {\n  const controller = new AbortController()\n  const timer = setTimeout(() => {\n    controller.abort()\n  }, FETCH_TIMEOUT_MS)\n\n  try {\n    const response = await fetchFn(`${registryUrl(env)}/${PACKAGE_NAME}/latest`, {\n      signal: controller.signal,\n      headers: { accept: 'application/json' },\n    })\n\n    if (!response.ok) return null\n\n    const body: unknown = await response.json()\n    const version = (body as { version?: unknown } | null)?.version\n\n    return typeof version === 'string' && version !== '' ? version : null\n  } catch {\n    return null\n  } finally {\n    clearTimeout(timer)\n  }\n}\n", "/**\n * Registry-safe version comparison for the auto-update check.\n *\n * Deliberately NOT `src/lib/version-utils`: `parseVersion` there does `versionStr.slice(1)` because it\n * only ever sees `v`-prefixed release tags, so it turns a bare registry version (`0.1.130`) into\n * `[NaN, 1, 130]`. Feeding npm's `dist-tags.latest` through it silently compares NaNs and never fires.\n * These inputs are bare semver from `registry.npmjs.org` and from our own `package.json`.\n */\n\n/** `1.2.3-beta.4+build` \u2192 the `[1, 2, 3]` release triple and the `beta.4` prerelease, or null if unparsable. */\ninterface ParsedVersion {\n  release: [number, number, number]\n  /** Dot-separated prerelease identifiers, empty when this is a final release. */\n  prerelease: string[]\n}\n\nconst RELEASE_PATTERN = /^(\\d+)\\.(\\d+)\\.(\\d+)$/\n\n/**\n * Parse bare semver. Returns null (never throws, never NaNs) for anything that is not\n * `major.minor.patch` with optional `-prerelease` and `+build` \u2014 a garbled registry body must read as\n * \"no update\", not as \"update to NaN\".\n *\n * @example\n * parseSemver('0.1.130') // => { release: [0, 1, 130], prerelease: [] }\n * parseSemver('1.0.0-rc.1+abc') // => { release: [1, 0, 0], prerelease: ['rc', '1'] }\n * parseSemver('v1.0.0') // => null\n */\nexport const parseSemver = (version: string): ParsedVersion | null => {\n  // Build metadata is ignored entirely by semver precedence rules.\n  const [withoutBuild = ''] = version.trim().split('+')\n  const [core = '', ...prereleaseParts] = withoutBuild.split('-')\n  const match = RELEASE_PATTERN.exec(core)\n\n  if (!match) return null\n\n  const [major, minor, patch] = [match[1], match[2], match[3]].map(Number) as [number, number, number]\n\n  return {\n    release: [major, minor, patch],\n    // Re-join on '-' so `1.0.0-rc-1` keeps its hyphen inside a single identifier.\n    prerelease: prereleaseParts.length > 0 ? prereleaseParts.join('-').split('.') : [],\n  }\n}\n\nconst NUMERIC_IDENTIFIER = /^\\d+$/\n\n/** Compare two unequal prerelease identifiers per semver \u00A711. Numeric ones rank below alphanumeric ones. */\nconst compareIdentifier = (left: string, right: string): number => {\n  const leftNumeric = NUMERIC_IDENTIFIER.test(left)\n  const rightNumeric = NUMERIC_IDENTIFIER.test(right)\n\n  if (leftNumeric && rightNumeric) return Number(left) - Number(right)\n  if (leftNumeric !== rightNumeric) return leftNumeric ? -1 : 1\n\n  return left < right ? -1 : 1\n}\n\n/** Compare prerelease identifier lists. A shorter list has lower precedence: `1.0.0-rc` < `1.0.0-rc.1`. */\nconst comparePrerelease = (a: string[], b: string[]): number => {\n  for (let index = 0; index < Math.max(a.length, b.length); index += 1) {\n    const left = a[index]\n    const right = b[index]\n\n    if (left === undefined) return -1\n    if (right === undefined) return 1\n    if (left !== right) return compareIdentifier(left, right)\n  }\n\n  return 0\n}\n\n/**\n * Is `latest` strictly newer than `current`? False when either is unparsable, so a bad registry\n * response can never trigger an install.\n *\n * The load-bearing case is NUMERIC, not lexical, comparison: `0.1.9` must be older than `0.1.130`.\n * A string compare would order them the other way and pin every user to the older build forever.\n *\n * A final release outranks its own prereleases (`1.0.0` > `1.0.0-rc.1`), so a user on `rc` is offered\n * the release, and a user on the release is never \"downgraded\" to an rc.\n *\n * @example\n * isNewerVersion('0.1.130', '0.1.9') // => true  (numeric, not lexical)\n * isNewerVersion('1.0.0', '1.0.0-rc.1') // => true\n * isNewerVersion('0.1.130', '0.1.130') // => false\n * isNewerVersion('garbage', '0.1.0') // => false\n */\nexport const isNewerVersion = (latest: string, current: string): boolean => {\n  const parsedLatest = parseSemver(latest)\n  const parsedCurrent = parseSemver(current)\n\n  if (!parsedLatest || !parsedCurrent) return false\n\n  for (let index = 0; index < 3; index += 1) {\n    const left = parsedLatest.release[index] as number\n    const right = parsedCurrent.release[index] as number\n\n    if (left !== right) return left > right\n  }\n\n  const latestIsFinal = parsedLatest.prerelease.length === 0\n  const currentIsFinal = parsedCurrent.prerelease.length === 0\n\n  if (latestIsFinal !== currentIsFinal) return latestIsFinal\n\n  return comparePrerelease(parsedLatest.prerelease, parsedCurrent.prerelease) > 0\n}\n", "/**\n * The throttle + notice state for the auto-update check, at `$cacheRoot/update-check.json`.\n *\n * `getCacheRoot()` \u2014 NOT `getSessionCacheDir()`, which throws unless `INFRA_KIT_SESSION` is set. A user\n * who installed this CLI globally and never ran `infra-kit init` has no session, and the update check\n * must still work for exactly that person.\n */\nimport fs from 'node:fs'\nimport path from 'node:path'\n\nimport { atomicWriteFileSync, getCacheRoot } from 'src/lib/constants'\n\nexport const CACHE_FILE_NAME = 'update-check.json'\n\n/** Refresh at most once a day after a SETTLED check. A background check is cheap, but not once per shell command. */\nexport const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000\n\n/**\n * The shorter re-check window after a TRANSIENT outcome (see {@link RETRYABLE_OUTCOMES}). A single\n * failed fetch used to burn the full 24h {@link CHECK_INTERVAL_MS}, so one network blip locked\n * auto-update out for a whole day \u2014 exactly the failure a publisher hits pushing a release mid-window.\n * An hour still stops the per-command spawn storm the throttle exists to prevent.\n */\nexport const RETRY_INTERVAL_MS = 60 * 60 * 1000\n\n/**\n * Outcomes that did NOT reach a settled \"checked, nothing left to do\" state \u2014 a transient failure, or\n * an install we could not complete this cycle. They get the short {@link RETRY_INTERVAL_MS}; every\n * settled outcome (`up-to-date`, `installed`, `cannot-self-spawn`) keeps the 24h window.\n *\n * Most members mirror `UpdateCheckOutcome` in `run-update-check.ts` \u2014 keep the two in step \u2014 with two\n * deliberate mismatches: `installing` is a cache-ONLY mid-install checkpoint (not a union member), and\n * the union's `already-running` never reaches the cache (it returns before any write). This set has no\n * compile-time tie to the union (that would import-cycle), so a rename there fails silently HERE \u2014 the\n * membership guard test in `__tests__/update-cache.test.ts` is what catches that drift.\n *\n * ACCEPTED tradeoff: `install-failed` covers both a transient blip and a permanently broken setup (EACCES\n * on a root-owned global dir), so a broken install now retries hourly rather than daily. It is bounded \u2014\n * single-flight lock, silent `stdio: 'ignore'`, and the manual command still surfaced via the notice \u2014 and\n * favouring fast recovery of the transient case is the point of this change.\n */\nconst RETRYABLE_OUTCOMES = new Set([\n  'fetch-failed',\n  'install-failed',\n  'parent-still-running',\n  'parent-unknown',\n  'installing',\n])\n\nexport interface UpdateCache {\n  /**\n   * When the last check was ATTEMPTED \u2014 never \"when it last succeeded\". An offline user whose fetch\n   * throws must still burn their window, or every single command spawns another doomed child.\n   */\n  lastCheckMs: number\n  /** Latest version seen on the registry, or null when the last attempt failed. */\n  latestVersion: string | null\n  /**\n   * The command the USER must run, set only when the worker was not allowed to install for them\n   * (Homebrew, or an install location it could not identify). Null means \"handled, say nothing\".\n   *\n   * The worker decides this, not the reader: identifying the owning package manager can cost an\n   * `npm root -g` subprocess, and the CLI startup path must never pay for one. The background child\n   * already pays it, so it writes the verdict down.\n   */\n  updateCommand: string[] | null\n  /**\n   * The last check's terminal outcome (`installed`, `fetch-failed`, `up-to-date`, \u2026), or absent on a\n   * cache written before this field existed. Two jobs: (1) it is the signal {@link isStale} uses to\n   * pick the short retry window after a transient failure; (2) it is the ONLY thing that makes the file\n   * legible \u2014 a successful `installed` and a failed `fetch-failed` both write a byte-identical\n   * `{latestVersion:null, updateCommand:null}`, so without this the cache cannot say which happened.\n   */\n  outcome?: string | null\n}\n\nexport const cacheFilePath = (): string => {\n  return path.join(getCacheRoot(), CACHE_FILE_NAME)\n}\n\nconst isStringArray = (value: unknown): value is string[] => {\n  return (\n    Array.isArray(value) &&\n    value.every((entry) => {\n      return typeof entry === 'string'\n    })\n  )\n}\n\nconst isUpdateCache = (value: unknown): value is UpdateCache => {\n  if (typeof value !== 'object' || value === null) return false\n\n  const { lastCheckMs, latestVersion, updateCommand, outcome } = value as Partial<UpdateCache>\n\n  return (\n    typeof lastCheckMs === 'number' &&\n    Number.isFinite(lastCheckMs) &&\n    (latestVersion === null || typeof latestVersion === 'string') &&\n    (updateCommand === null || isStringArray(updateCommand)) &&\n    (outcome === undefined || outcome === null || typeof outcome === 'string')\n  )\n}\n\n/**\n * Read the cache, or null when it is missing/unreadable/corrupt. A null read means \"stale\" to every\n * caller, so a first run and a hand-mangled file behave identically: check again.\n *\n * @example\n * readUpdateCache() // => { lastCheckMs: 1770000000000, latestVersion: '0.1.131' } | null\n */\nexport const readUpdateCache = (\n  readFile: (p: string) => string = (p) => {\n    return fs.readFileSync(p, 'utf8')\n  },\n): UpdateCache | null => {\n  try {\n    const parsed: unknown = JSON.parse(readFile(cacheFilePath()))\n\n    return isUpdateCache(parsed) ? parsed : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Persist the check result. Creates `$cacheRoot` first: `atomicWriteFileSync` writes a temp file\n * beside the target and renames, so it throws ENOENT on a machine that has never had a `~/.cache/infra-kit`.\n * Without this mkdir the write fails, `lastCheckMs` never lands, and the throttle degrades into a\n * detached-child spawn on every invocation.\n *\n * @example\n * writeUpdateCache({ lastCheckMs: Date.now(), latestVersion: '0.1.131' })\n */\nexport const writeUpdateCache = (cache: UpdateCache): void => {\n  const root = getCacheRoot()\n\n  fs.mkdirSync(root, { recursive: true })\n  atomicWriteFileSync(path.join(root, CACHE_FILE_NAME), JSON.stringify(cache), 0o600)\n}\n\n/**\n * Has the throttle window elapsed? A missing cache is stale by definition (first run).\n *\n * A `lastCheckMs` in the future (clock skew, or a restored backup) also reads as stale rather than\n * locking the user out of updates until their clock catches up.\n *\n * The window is outcome-aware: a transient last outcome (see {@link RETRYABLE_OUTCOMES}) is re-checked\n * after {@link RETRY_INTERVAL_MS}, every settled outcome after {@link CHECK_INTERVAL_MS}. A cache with\n * no `outcome` (pre-`outcome` format, or a hand-written file) falls through to the 24h bucket \u2014 the\n * safe default that cannot turn into an every-hour spawn storm.\n *\n * @example\n * isStale(null, 1_000) // => true\n * isStale({ lastCheckMs: 0, latestVersion: null, updateCommand: null }, CHECK_INTERVAL_MS + 1) // => true\n */\nexport const isStale = (cache: UpdateCache | null, nowMs: number): boolean => {\n  if (!cache) return true\n\n  const elapsed = nowMs - cache.lastCheckMs\n\n  if (elapsed < 0) return true\n\n  const interval =\n    cache.outcome != null && RETRYABLE_OUTCOMES.has(cache.outcome) ? RETRY_INTERVAL_MS : CHECK_INTERVAL_MS\n\n  return elapsed >= interval\n}\n"],
-  "mappings": "uFAQA,OAAOA,MAAU,YAGV,IAAMC,EAAe,YAEtBC,EAAS,GAAGD,CAAY,UAoCxBE,EAAW,CAACC,EAAgBC,EAAeC,IAAkC,CACjF,IAAMC,EAAMP,EAAK,SAASM,EAASN,EAAK,QAAQI,CAAM,CAAC,EAAGJ,EAAK,QAAQK,CAAK,CAAC,EAE7E,OAAOE,IAAQ,IAAM,CAACA,EAAI,WAAW,IAAI,GAAK,CAACP,EAAK,WAAWO,CAAG,CACpE,EAGMC,EAAa,CAACC,EAAWC,IACtBV,EAAK,QAAQS,CAAC,EAAE,MAAMT,EAAK,GAAG,EAAE,SAASU,CAAI,EAkBhDC,EAAc,CAACF,EAAWC,IAA0B,CACxD,IAAME,EAAWZ,EAAK,QAAQS,CAAC,EAAE,MAAMT,EAAK,GAAG,EACzCa,EAASD,EAAS,QAAQ,QAAQ,EAExC,OAAOC,IAAW,IAAMD,EAASC,EAAS,CAAC,IAAMH,CACnD,EAGMI,EAAc,CAACC,EAAwBC,EAAaC,EAAsBX,IAAkC,CAChH,IAAMY,EAAMH,EAAIC,CAAG,EAEnB,OAAOE,GAAO,MAAQA,IAAQ,IAAMf,EAASe,EAAKD,EAAcX,CAAQ,CAC1E,EAWMa,EAAsB,CAC1B,CACE,QAAS,QAET,KAAM,CAAC,CAAE,aAAAF,EAAc,IAAAF,EAAK,SAAAT,CAAS,IAEjCQ,EAAYC,EAAK,aAAcE,EAAcX,CAAQ,GACrDE,EAAWS,EAAc,QAAQ,GACjCT,EAAWS,EAAc,OAAO,EAGpC,cAAe,CAAC,QAAS,UAAWhB,CAAY,EAChD,aAAc,EAChB,EACA,CACE,QAAS,WAaT,KAAM,CAAC,CAAE,aAAAgB,CAAa,IACbN,EAAYM,EAAchB,CAAY,EAE/C,cAAe,CAAC,OAAQ,UAAWA,CAAY,EAC/C,aAAc,EAChB,EACA,CACE,QAAS,OACT,KAAM,CAAC,CAAE,aAAAgB,EAAc,IAAAF,EAAK,SAAAT,CAAS,IAEjCQ,EAAYC,EAAK,YAAaE,EAAcX,CAAQ,GACnDE,EAAWS,EAAc,MAAM,GAAKT,EAAWS,EAAc,QAAQ,EAG1E,cAAe,CAAC,OAAQ,MAAO,KAAMf,CAAM,EAC3C,aAAc,EAChB,EACA,CACE,QAAS,MACT,KAAM,CAAC,CAAE,aAAAe,EAAc,IAAAF,EAAK,SAAAT,CAAS,IAC5BQ,EAAYC,EAAK,cAAeE,EAAcX,CAAQ,GAAKE,EAAWS,EAAc,MAAM,EAEnG,cAAe,CAAC,MAAO,MAAO,KAAMf,CAAM,EAC1C,aAAc,EAChB,EACA,CACE,QAAS,OACT,KAAM,CAAC,CAAE,aAAAe,CAAa,IAElBT,EAAWS,EAAc,OAAO,GAAMT,EAAWS,EAAc,MAAM,GAAKT,EAAWS,EAAc,QAAQ,EAG/G,cAAe,CAAC,OAAQ,SAAU,MAAOf,CAAM,EAC/C,aAAc,EAChB,EACA,CACE,QAAS,MACT,KAAM,CAAC,CAAE,aAAAe,EAAc,IAAAF,EAAK,SAAAT,CAAS,IAC5BQ,EAAYC,EAAK,oBAAqBE,EAAcX,CAAQ,EAErE,cAAe,CAAC,MAAO,UAAW,KAAMJ,CAAM,EAC9C,aAAc,EAChB,CACF,EAEMkB,EAAqB,CAAC,MAAO,UAAW,KAAMlB,CAAM,EAc7CmB,EAAwBC,GAAyD,CAC5F,GAAM,CAAE,aAAAL,EAAc,IAAAF,EAAK,SAAAT,EAAU,YAAAiB,CAAY,EAAID,EAC/CE,EAAML,EAAS,KAAK,CAAC,CAAE,KAAAM,CAAK,IACzBA,EAAK,CAAE,aAAAR,EAAc,IAAAF,EAAK,SAAAT,CAAS,CAAC,CAC5C,EAED,GAAIkB,EAAK,MAAO,CAAE,QAASA,EAAI,QAAS,cAAeA,EAAI,cAAe,aAAcA,EAAI,YAAa,EAEzG,IAAME,EAAUH,IAAc,EAE9B,OAAIG,GAAW,MAAQA,IAAY,IAAMvB,EAASuB,EAAST,EAAcX,CAAQ,EACxE,CAAE,QAAS,MAAO,cAAec,EAAoB,aAAc,EAAK,EAG1E,CAAE,QAAS,UAAW,cAAeA,EAAoB,aAAc,EAAM,CACtF,EAmBaO,EAA4B,CAACV,EAAsBW,EAAatB,IACpEE,EAAWS,EAAc,cAAc,GAAKd,EAASyB,EAAKX,EAAcX,CAAQ,EC5NzF,OAAS,gBAAAuB,MAAoB,UAC7B,OAAOC,MAAU,YAUV,IAAMC,EAAgBC,GAAwB,CACnD,GAAI,CACF,OAAOH,EAAaG,CAAG,CACzB,MAAQ,CACN,OAAOF,EAAK,QAAQE,CAAG,CACzB,CACF,ECLA,OAAS,gBAAAC,MAAoB,qBAC7B,OAAOC,MAAa,eAEpB,IAAMC,EAAsB,IAafC,EAAqB,IAA0B,CAC1D,GAAI,CAOF,IAAMC,EANMJ,EAAa,MAAO,CAAC,OAAQ,IAAI,EAAG,CAC9C,SAAU,QACV,QAASE,EACT,MAAO,CAAC,SAAU,OAAQ,QAAQ,EAClC,MAAOD,EAAQ,WAAa,OAC9B,CAAC,EACmB,KAAK,EAEzB,OAAOG,IAAY,GAAK,OAAYA,CACtC,MAAQ,CACN,MACF,CACF,EC/BA,OAAS,aAAAC,OAAiB,qBAC1B,OAAS,WAAAC,OAAe,UACxB,OAAOC,MAAa,eCFpB,OAAOC,MAAQ,UACf,OAAOC,MAAU,YACjB,OAAOC,MAAa,eAIb,IAAMC,EAAiB,oBAiBjBC,EAAgB,KAAU,IAE1BC,GAAe,IACnBC,EAAK,KAAKC,EAAa,EAAGJ,CAAc,EAS3CK,GAAc,CAACC,EAAkBC,IAAwB,CAC7D,GAAI,CACEA,EAAQC,EAAG,SAASF,CAAQ,EAAE,QAAUL,GAAeO,EAAG,OAAOF,EAAU,CAAE,MAAO,EAAK,CAAC,CAChG,MAAQ,CAER,CACF,EAaaG,EAAoB,CAACC,EAAiB,CAAC,IAA2B,CAC7E,IAAMH,EAAQG,EAAK,OAAS,KAAK,IAAI,EAC/BJ,EAAWI,EAAK,UAAYR,GAAa,EAE/C,GAAI,CACFM,EAAG,UAAUL,EAAK,QAAQG,CAAQ,EAAG,CAAE,UAAW,EAAK,CAAC,CAC1D,MAAQ,CACN,OAAO,IACT,CAEA,IAAMK,EAAO,IAAqB,CAChC,GAAI,CAEF,OAAOH,EAAG,SAASF,EAAU,KAAM,GAAK,CAC1C,MAAQ,CACN,OAAO,IACT,CACF,EAEIM,EAAKD,EAAK,EAQd,GANIC,IAAO,OACTP,GAAYC,EAAUC,CAAK,EAE3BK,EAAKD,EAAK,GAGRC,IAAO,KAAM,OAAO,KAExB,GAAI,CACFJ,EAAG,cAAcI,EAAI,OAAOC,EAAQ,GAAG,CAAC,CAC1C,MAAQ,CAER,CAEA,MAAO,IAAM,CACX,GAAI,CACFL,EAAG,UAAUI,CAAE,CACjB,MAAQ,CAER,CAEA,GAAI,CACFJ,EAAG,OAAOF,EAAU,CAAE,MAAO,EAAK,CAAC,CACrC,MAAQ,CAER,CACF,CACF,EC3GO,IAAMQ,GAAmB,6BAQnBC,GAAmB,IAkB1BC,GAAsBC,GACd,OAAO,QAAQA,CAAG,EAAE,KAAK,CAAC,CAACC,EAAKC,CAAK,IACxC,yBAAyB,KAAKD,CAAG,GAAKC,GAAS,MAAQA,IAAU,EACzE,IAEY,CAAC,EAGHC,GAAeH,GAAmC,CAC7D,IAAMI,EAAaL,GAAmBC,CAAG,EAErCK,EAAOD,GAAc,MAAQA,IAAe,GAAKA,EAAaP,GAGlE,KAAOQ,EAAK,SAAS,GAAG,GACtBA,EAAOA,EAAK,MAAM,EAAG,EAAE,EAGzB,OAAOA,CACT,EASaC,EAAqB,MAChCN,EACAO,EAAwB,QACG,CAC3B,IAAMC,EAAa,IAAI,gBACjBC,EAAQ,WAAW,IAAM,CAC7BD,EAAW,MAAM,CACnB,EAAGV,EAAgB,EAEnB,GAAI,CACF,IAAMY,EAAW,MAAMH,EAAQ,GAAGJ,GAAYH,CAAG,CAAC,IAAIW,CAAY,UAAW,CAC3E,OAAQH,EAAW,OACnB,QAAS,CAAE,OAAQ,kBAAmB,CACxC,CAAC,EAED,GAAI,CAACE,EAAS,GAAI,OAAO,KAGzB,IAAME,GADgB,MAAMF,EAAS,KAAK,IACc,QAExD,OAAO,OAAOE,GAAY,UAAYA,IAAY,GAAKA,EAAU,IACnE,MAAQ,CACN,OAAO,IACT,QAAE,CACA,aAAaH,CAAK,CACpB,CACF,ECtEA,IAAMI,GAAkB,wBAYXC,EAAeC,GAA0C,CAEpE,GAAM,CAACC,EAAe,EAAE,EAAID,EAAQ,KAAK,EAAE,MAAM,GAAG,EAC9C,CAACE,EAAO,GAAI,GAAGC,CAAe,EAAIF,EAAa,MAAM,GAAG,EACxDG,EAAQN,GAAgB,KAAKI,CAAI,EAEvC,GAAI,CAACE,EAAO,OAAO,KAEnB,GAAM,CAACC,EAAOC,EAAOC,CAAK,EAAI,CAACH,EAAM,CAAC,EAAGA,EAAM,CAAC,EAAGA,EAAM,CAAC,CAAC,EAAE,IAAI,MAAM,EAEvE,MAAO,CACL,QAAS,CAACC,EAAOC,EAAOC,CAAK,EAE7B,WAAYJ,EAAgB,OAAS,EAAIA,EAAgB,KAAK,GAAG,EAAE,MAAM,GAAG,EAAI,CAAC,CACnF,CACF,EAEMK,EAAqB,QAGrBC,GAAoB,CAACC,EAAcC,IAA0B,CACjE,IAAMC,EAAcJ,EAAmB,KAAKE,CAAI,EAC1CG,EAAeL,EAAmB,KAAKG,CAAK,EAElD,OAAIC,GAAeC,EAAqB,OAAOH,CAAI,EAAI,OAAOC,CAAK,EAC/DC,IAAgBC,EAAqBD,EAAc,GAAK,EAErDF,EAAOC,EAAQ,GAAK,CAC7B,EAGMG,GAAoB,CAACC,EAAaC,IAAwB,CAC9D,QAASC,EAAQ,EAAGA,EAAQ,KAAK,IAAIF,EAAE,OAAQC,EAAE,MAAM,EAAGC,GAAS,EAAG,CACpE,IAAMP,EAAOK,EAAEE,CAAK,EACdN,EAAQK,EAAEC,CAAK,EAErB,GAAIP,IAAS,OAAW,MAAO,GAC/B,GAAIC,IAAU,OAAW,MAAO,GAChC,GAAID,IAASC,EAAO,OAAOF,GAAkBC,EAAMC,CAAK,CAC1D,CAEA,MAAO,EACT,EAkBaO,EAAiB,CAACC,EAAgBC,IAA6B,CAC1E,IAAMC,EAAetB,EAAYoB,CAAM,EACjCG,EAAgBvB,EAAYqB,CAAO,EAEzC,GAAI,CAACC,GAAgB,CAACC,EAAe,MAAO,GAE5C,QAASL,EAAQ,EAAGA,EAAQ,EAAGA,GAAS,EAAG,CACzC,IAAMP,EAAOW,EAAa,QAAQJ,CAAK,EACjCN,EAAQW,EAAc,QAAQL,CAAK,EAEzC,GAAIP,IAASC,EAAO,OAAOD,EAAOC,CACpC,CAEA,IAAMY,EAAgBF,EAAa,WAAW,SAAW,EACnDG,EAAiBF,EAAc,WAAW,SAAW,EAE3D,OAAIC,IAAkBC,EAAuBD,EAEtCT,GAAkBO,EAAa,WAAYC,EAAc,UAAU,EAAI,CAChF,ECpGA,OAAOG,MAAQ,UACf,OAAOC,MAAU,YAIV,IAAMC,EAAkB,oBAGlBC,GAAoB,KAAU,GAAK,IAQnCC,GAAoB,KAAU,IAkBrCC,GAAqB,IAAI,IAAI,CACjC,eACA,iBACA,uBACA,iBACA,YACF,CAAC,EA6BYC,GAAgB,IACpBC,EAAK,KAAKC,EAAa,EAAGN,CAAe,EAG5CO,GAAiBC,GAEnB,MAAM,QAAQA,CAAK,GACnBA,EAAM,MAAOC,GACJ,OAAOA,GAAU,QACzB,EAICC,GAAiBF,GAAyC,CAC9D,GAAI,OAAOA,GAAU,UAAYA,IAAU,KAAM,MAAO,GAExD,GAAM,CAAE,YAAAG,EAAa,cAAAC,EAAe,cAAAC,EAAe,QAAAC,CAAQ,EAAIN,EAE/D,OACE,OAAOG,GAAgB,UACvB,OAAO,SAASA,CAAW,IAC1BC,IAAkB,MAAQ,OAAOA,GAAkB,YACnDC,IAAkB,MAAQN,GAAcM,CAAa,KAC5BC,GAAY,MAAQ,OAAOA,GAAY,SAErE,EASaC,GAAkB,CAC7BC,EAAmCC,GAC1BC,EAAG,aAAaD,EAAG,MAAM,IAEX,CACvB,GAAI,CACF,IAAME,EAAkB,KAAK,MAAMH,EAASZ,GAAc,CAAC,CAAC,EAE5D,OAAOM,GAAcS,CAAM,EAAIA,EAAS,IAC1C,MAAQ,CACN,OAAO,IACT,CACF,EAWaC,EAAoBC,GAA6B,CAC5D,IAAMC,EAAOhB,EAAa,EAE1BY,EAAG,UAAUI,EAAM,CAAE,UAAW,EAAK,CAAC,EACtCC,EAAoBlB,EAAK,KAAKiB,EAAMtB,CAAe,EAAG,KAAK,UAAUqB,CAAK,EAAG,GAAK,CACpF,EAiBaG,GAAU,CAACH,EAA2BI,IAA2B,CAC5E,GAAI,CAACJ,EAAO,MAAO,GAEnB,IAAMK,EAAUD,EAAQJ,EAAM,YAE9B,GAAIK,EAAU,EAAG,MAAO,GAExB,IAAMC,EACJN,EAAM,SAAW,MAAQlB,GAAmB,IAAIkB,EAAM,OAAO,EAAInB,GAAoBD,GAEvF,OAAOyB,GAAWC,CACpB,EJ7IO,IAAMC,GAA0B,IAO1BC,GAAyB,IAAS,IAsBzCC,GAAyBC,GAAyB,CACtD,GAAI,CACF,OAAAC,EAAQ,KAAKD,EAAK,CAAC,EAEZ,EACT,MAAQ,CACN,MAAO,EACT,CACF,EAEME,GAAgBC,GACb,IAAI,QAASC,GAAY,CAC9B,WAAWA,EAASD,CAAE,CACxB,CAAC,EAOGE,GAAoB,MACxBC,EACAC,IACqB,CACrB,IAAMC,EAAWD,EAAK,MAAM,EAAIT,GAEhC,KAAOS,EAAK,MAAM,EAAIC,GAAU,CAC9B,GAAI,CAACD,EAAK,eAAeD,CAAS,EAAG,MAAO,GAE5C,MAAMC,EAAK,MAAMV,EAAuB,CAC1C,CAEA,MAAO,CAACU,EAAK,eAAeD,CAAS,CACvC,EAuBaG,GAAiB,MAAOC,EAAwBH,IAA0D,CAMrH,IAAMI,GALcJ,EAAK,aAAeK,GAKZ,EAE5B,GAAI,CAACD,EAAS,MAAO,kBAErB,GAAI,CACF,OAAO,MAAME,GAAqBH,EAAgBH,CAAI,CACxD,QAAE,CACAI,EAAQ,CACV,CACF,EAEME,GAAuB,MAAOH,EAAwBH,IAA0D,CACpH,IAAMO,EAAMP,EAAK,KAAON,EAAQ,IAC1Bc,EAAQR,EAAK,OAAS,KAAK,IAAI,EAC/BS,EAAcT,EAAK,aAAeU,EAClCC,EAAaX,EAAK,YAAcY,EAChCC,EAAiBb,EAAK,gBAAkBR,GACxCsB,EAAQd,EAAK,OAASL,GACtBoB,EAAQf,EAAK,OAAS,KAAK,IAC3BgB,EAAchB,EAAK,aAAeiB,EAClCC,EAAQlB,EAAK,WAAamB,GAE1BC,EAAgB,MAAMX,EAAYF,CAAG,EAKrCc,EAAS,CACbC,EACAC,KAKAZ,EAAW,CAAE,YAAaH,EAAO,GAAGe,EAAO,QAAAD,CAAQ,CAAC,EAE7CA,GAGT,GAAIF,IAAkB,KAAM,OAAOC,EAAO,eAAgB,CAAE,cAAe,KAAM,cAAe,IAAK,CAAC,EACtG,GAAI,CAACG,EAAeJ,EAAejB,CAAc,EAC/C,OAAOkB,EAAO,aAAc,CAAE,cAAAD,EAAe,cAAe,IAAK,CAAC,EAMpE,GAAM,CAAE,aAAAK,EAAc,cAAAC,CAAc,EAAIC,EAAqB,CAC3D,aAAc3B,EAAK,aACnB,IAAAO,EACA,SAAUqB,EACV,YAAAZ,CACF,CAAC,EAID,GAAI,CAACS,EAAc,OAAOJ,EAAO,oBAAqB,CAAE,cAAAD,EAAe,cAAAM,CAAc,CAAC,EAKtF,GAAI1B,EAAK,WAAa,KAAM,OAAOqB,EAAO,iBAAkB,CAAE,cAAAD,EAAe,cAAe,IAAK,CAAC,EAqBlG,GALAT,EAAW,CAAE,YAAaH,EAAO,cAAAY,EAAe,cAAe,KAAM,QAAS,YAAa,CAAC,EAKxF,CAHe,MAAMtB,GAAkBE,EAAK,UAAW,CAAE,eAAAa,EAAgB,MAAAC,EAAO,MAAAC,CAAM,CAAC,EAG1E,OAAOM,EAAO,uBAAwB,CAAE,cAAAD,EAAe,cAAe,IAAK,CAAC,EAgB7F,IAAMS,EAASX,EAAMQ,EAAc,CAAC,EAAaA,EAAc,MAAM,CAAC,EAAG,CACvE,MAAO,SACP,MAAOhC,EAAQ,WAAa,QAC5B,IAAKoC,GAAQ,EACb,IAAKC,EAAyBxB,CAAG,EACjC,YAAa,EACf,CAAC,EAID,OAAIsB,EAAO,OAASA,EAAO,QAAUA,EAAO,SAAW,EAC9CR,EAAO,iBAAkB,CAAE,cAAAD,EAAe,cAAAM,CAAc,CAAC,EAI3DL,EAAO,YAAa,CAAE,cAAe,KAAM,cAAe,IAAK,CAAC,CACzE",
-  "names": ["path", "PACKAGE_NAME", "LATEST", "isWithin", "parent", "child", "realpath", "rel", "hasSegment", "p", "name", "isBrewKegOf", "segments", "cellar", "underEnvDir", "env", "key", "selfRealPath", "dir", "MATCHERS", "NPM_UPDATE_COMMAND", "detectInstallManager", "input", "lazyNpmRoot", "hit", "test", "npmRoot", "isLocalNodeModulesInstall", "cwd", "realpathSync", "path", "safeRealpath", "dir", "execFileSync", "process", "NPM_ROOT_TIMEOUT_MS", "defaultLazyNpmRoot", "trimmed", "spawnSync", "homedir", "process", "fs", "path", "process", "LOCK_FILE_NAME", "LOCK_STALE_MS", "lockFilePath", "path", "getCacheRoot", "reapIfStale", "lockPath", "nowMs", "fs", "acquireUpdateLock", "deps", "open", "fd", "process", "DEFAULT_REGISTRY", "FETCH_TIMEOUT_MS", "configuredRegistry", "env", "key", "value", "registryUrl", "configured", "base", "fetchLatestVersion", "fetchFn", "controller", "timer", "response", "PACKAGE_NAME", "version", "RELEASE_PATTERN", "parseSemver", "version", "withoutBuild", "core", "prereleaseParts", "match", "major", "minor", "patch", "NUMERIC_IDENTIFIER", "compareIdentifier", "left", "right", "leftNumeric", "rightNumeric", "comparePrerelease", "a", "b", "index", "isNewerVersion", "latest", "current", "parsedLatest", "parsedCurrent", "latestIsFinal", "currentIsFinal", "fs", "path", "CACHE_FILE_NAME", "CHECK_INTERVAL_MS", "RETRY_INTERVAL_MS", "RETRYABLE_OUTCOMES", "cacheFilePath", "path", "getCacheRoot", "isStringArray", "value", "entry", "isUpdateCache", "lastCheckMs", "latestVersion", "updateCommand", "outcome", "readUpdateCache", "readFile", "p", "fs", "parsed", "writeUpdateCache", "cache", "root", "atomicWriteFileSync", "isStale", "nowMs", "elapsed", "interval", "PARENT_POLL_INTERVAL_MS", "PARENT_WAIT_TIMEOUT_MS", "defaultIsProcessAlive", "pid", "process", "defaultSleep", "ms", "resolve", "waitForParentExit", "parentPid", "deps", "deadline", "runUpdateCheck", "currentVersion", "release", "acquireUpdateLock", "runUpdateCheckLocked", "env", "nowMs", "fetchLatest", "fetchLatestVersion", "writeCache", "writeUpdateCache", "isProcessAlive", "sleep", "clock", "lazyNpmRoot", "defaultLazyNpmRoot", "spawn", "spawnSync", "latestVersion", "finish", "outcome", "cache", "isNewerVersion", "canSelfSpawn", "updateCommand", "detectInstallManager", "safeRealpath", "result", "homedir", "packageManagerInstallEnv"]
-}

package/dist/chunk-GZNE5CBQ.js

@@ -1,7 +0,0 @@
-import{O as E,u as m}from"./chunk-IVWPZEMC.js";import{q as w}from"./chunk-CHETBZ6M.js";import f from"node:fs/promises";import c from"node:path";import{z as s}from"zod";var i=class extends Error{env;constructor(e,o=null){super(e),this.name="EnvAuthError",this.env=o}},J=t=>t instanceof i;import b from"node:fs/promises";import $ from"node:os";var C=async t=>{try{return await b.access(t),!0}catch{return!1}},l=t=>{let e=$.homedir();return t.startsWith(e)?`~${t.slice(e.length)}`:t};var I="tokens.json",p=1,k=384,y=448,M=s.object({version:s.literal(p).default(p),envs:s.record(s.string().min(1),s.string().min(1))}).strict(),d=async()=>{let t=await E();return c.join(c.dirname(t.userProject),I)},u=async()=>{let t=await d(),e;try{e=await f.readFile(t,"utf-8")}catch{return null}let o;try{o=JSON.parse(e)}catch(n){throw new i(`Invalid JSON in the token store at ${l(t)}: ${n.message}
-Fix or delete the file, then re-add the token with \`infra-kit env-token-set <env>\`.`)}let r=M.safeParse(o);if(!r.success)throw new i(`Invalid token store at ${l(t)}: ${s.prettifyError(r.error)}
-Fix or delete the file, then re-add the token with \`infra-kit env-token-set <env>\`.`);return r.data},g=async t=>{let e=await d(),o=c.dirname(e),r=c.dirname(o),n=c.dirname(r);for(let a of[n,r,o])await f.mkdir(a,{recursive:!0,mode:y}),await f.chmod(a,y);w(e,`${JSON.stringify(t,null,2)}
-`,k),await f.chmod(e,k)},N=async(t,e)=>{let o=await u();await g({version:p,envs:{...o?.envs,[t]:e}})},_=async t=>{let e=await u();if(!e||!(t in e.envs))return;let o={...e.envs};delete o[t],await g({version:p,envs:o})};var j=()=>{let t="",e=[],o=!1;return{start(r){t=r,e=[],o=!1},setInteractive(){o=!0},addOption(r,n){e.push({flag:r,value:n})},formatOptions(){return e.map(r=>typeof r.value=="boolean"?r.value?r.flag:"":Array.isArray(r.value)?`${r.flag} "${r.value.join(", ")}"`:`${r.flag} "${r.value}"`).filter(Boolean).join(" ")},snapshot(){return e.length===0?null:{formattedOptions:this.formatOptions()}},print(){!o||e.length===0||!t||m.info(`\u{1F4DF} Equivalent command: 
-pnpm exec infra-kit ${t} ${this.formatOptions()}
-`)},reset(){t="",e=[],o=!1}}},h=j();import T from"node:process";var S={enabled:!1},v=()=>S.enabled;var D=27,O=async(t,e)=>{let o=new AbortController,r={...e,signal:o.signal};if(v()||!T.stdin.isTTY)return t(r);let n=T.stdin,a=x=>{x.length===1&&x[0]===D&&o.abort()},P=t(r);n.on("data",a);try{return await P}finally{n.removeListener("data",a)}};import A from"@inquirer/confirm";import F from"node:process";var R=async(t,e)=>{let o=t?!0:await O(r=>A({message:e},r));t||h.setInteractive(),o||(m.info("Operation cancelled. Exiting..."),F.exit(0))};export{i as a,J as b,C as c,l as d,d as e,u as f,N as g,_ as h,h as i,S as j,v as k,O as l,R as m};
-//# sourceMappingURL=chunk-GZNE5CBQ.js.map

package/dist/chunk-IVWPZEMC.js

@@ -1,4 +0,0 @@
-import L from"node:process";import C from"pino";import re from"pino-pretty";var _="/tmp/mcp-infra-kit.log",K=["token","*.token","serviceToken","*.serviceToken","DOPPLER_TOKEN","*.DOPPLER_TOKEN","INFRA_KIT_ENV_TOKEN","*.INFRA_KIT_ENV_TOKEN"],bt=()=>{let e=L.argv.includes("--debug")?"debug":"info",t=C({level:e,redact:K},C.destination({dest:_}));return t.info(`Logger initialized with level: ${e}. Logging to: ${_}`),t},ne=()=>{let e=L.argv.includes("--debug")?"debug":"info",t=["time","pid","hostname"];return e==="debug"&&t.push("level"),C({level:e,redact:K},re({destination:2,ignore:t.join(","),colorize:!0}))},Ct=ne();import*as p from"node:fs";import*as a from"node:path";function oe(e){let t=e;for(let r=0;r<10;r++){let n=a.join(t,"pnpm-workspace.yaml");if(p.existsSync(n))return t;t=a.dirname(t)}throw new Error("Could not find monorepo root (pnpm-workspace.yaml)")}function M(e,t){let r=a.join(e,"package.json");if(!p.existsSync(r))return t;try{let n=JSON.parse(p.readFileSync(r,"utf-8"));return typeof n.name=="string"?n.name:t}catch{return t}}function It(e){let t=a.join(e,"apps"),r=[];if(!p.existsSync(t))throw new Error(`Apps directory not found: ${t}`);let n=p.readdirSync(t,{withFileTypes:!0}).filter(o=>o.isDirectory()).map(o=>o.name);for(let o of n){let i=a.join(t,o,"api"),c=a.join(i,"serverless.yml");p.existsSync(c)&&r.push({name:o,packageName:M(i,o),path:i})}return r}var se=["vite.config.ts","vite.config.mts","vite.config.cts","vite.config.js","vite.config.mjs","vite.config.cjs"],ie=["@slip-stream-kit/vite","@slip-stream-kit/config/vite","infra-kit/vite"];function ae(e){for(let t of se){let r=a.join(e,t);if(p.existsSync(r))try{let n=p.readFileSync(r,"utf-8");return ie.some(o=>n.includes(o))}catch{return!1}}return!1}function ce(e){let t=a.join(e,"package.json");if(!p.existsSync(t))return!1;try{let r=JSON.parse(p.readFileSync(t,"utf-8"));return typeof r.scripts?.dev=="string"&&r.scripts.dev.length>0}catch{return!1}}function Et(e){let t=a.join(e,"apps"),r=[];if(!p.existsSync(t))return r;let n=p.readdirSync(t,{withFileTypes:!0}).filter(o=>o.isDirectory()).map(o=>o.name);for(let o of n){let i=a.join(t,o,"ui");p.existsSync(i)&&ce(i)&&r.push({name:o,packageName:M(i,o),path:i,managedPort:ae(i)})}return r}function jt(e){let t=e?.filter(Boolean)??[];return t.length>0?t:null}function Dt(e){let t=oe(e),r=a.relative(a.join(t,"apps"),e),n=r.split(a.sep)[0];if(r===""||r.startsWith("..")||a.isAbsolute(r)||!n)throw new Error(`--self: not inside an apps/<app> directory (cwd: ${e}). Run from an app folder or use --app=<name>.`);return n}var pe=new Set(["api","ui"]),O=e=>{let t=a.join(e,"dist");return p.existsSync(t)&&p.statSync(t).isDirectory()?t:void 0},S=e=>p.existsSync(e)?p.readdirSync(e,{withFileTypes:!0}).filter(t=>t.isDirectory()).map(t=>t.name):[];function At(e){let t=[];for(let n of S(a.join(e,"packages"))){let o=O(a.join(e,"packages",n));o!==void 0&&t.push(o)}let r=a.join(e,"apps");for(let n of S(r))for(let o of S(a.join(r,n))){if(pe.has(o))continue;let i=a.join(r,n,o);if(!p.existsSync(a.join(i,"package.json")))continue;let c=O(i);c!==void 0&&t.push(c)}return t}function $t(e){return e.map(t=>a.join(t.path,"dist")).filter(t=>p.existsSync(t))}function Nt(e,t,r){let n=a.normalize(e),o=r.find(c=>n.startsWith(a.normalize(c)));return o?{kind:"package",packageDir:o}:{kind:"app",app:t.find(c=>n.startsWith(a.normalize(c)))}}var le={"*/api":{},"*/ui":{}},B=e=>{let t=e.split("/"),[r,n]=t;return t.length!==2||!r?`devServersPresets: invalid target "${e}" (expected "<app>/api" or "<app>/ui")`:n!=="api"&&n!=="ui"?`devServersPresets: invalid target part "${n}" in "${e}" (expected "api" or "ui")`:null},ue=e=>{let t=B(e);if(t)throw new Error(t);let[r,n]=e.split("/");return{appGlob:r,part:n}},_t=e=>{let t=[];for(let[r,n]of Object.entries(e))for(let o of Object.keys(n.apps??{})){let i=B(o);i&&t.push({preset:r,key:o,message:`preset "${r}": ${i}`})}return t},fe=(e,t)=>t==="api"?e.api:e.ui,ge=e=>[...new Set([...e.api,...e.ui])].sort(),F=(e,t)=>`${e}/${t}`,de=e=>e?0:1,me=(e,t)=>t.watchDeps===void 0?e??{watchDeps:!0,rank:t.rank,explicitValue:!1}:!e||!e.explicitValue?{watchDeps:t.watchDeps,rank:t.rank,explicitValue:!0}:t.rank>e.rank?{watchDeps:t.watchDeps,rank:t.rank,explicitValue:!0}:e,he=(e,t,r)=>{let{app:n,part:o,watchDeps:i,isGlob:c}=r;if(!fe(t,o).includes(n)){c||e.unmatched.push(F(n,o));return}let l=F(n,o),u=me(e.targets.get(l),{watchDeps:i,rank:de(c)});e.targets.set(l,{app:n,part:o,...u})},ve=(e,t)=>{let r=Object.entries(e.apps??le),n={targets:new Map,proxy:{},unmatched:[]};for(let[c,l]of r){let{appGlob:u,part:h}=ue(c),P=u==="*",R=P?ge(t):[u];for(let b of R)he(n,t,{app:b,part:h,watchDeps:l.watchDeps,isGlob:P}),l.proxy&&(n.proxy[b]={...n.proxy[b]??{},...l.proxy})}let o=[...n.targets.values()].map(({app:c,part:l,watchDeps:u})=>({app:c,part:l,watchDeps:u})),i=[...new Set(o.filter(c=>c.part==="api").map(c=>c.app))];return{targets:o,cmux:e.cmux??!1,proxy:n.proxy,localApps:i,unmatched:n.unmatched}},Lt=e=>{if(e.preset!=null)return e.preset;if(e.running.length===0)return"nothing";let t=new Set(e.running);return e.discovered.every(n=>t.has(n))?"*":[...t].sort().join(" + ")},ye=(e,t)=>Object.keys(e).find(r=>e[r]===t),xe=({preset:e,app:t,route:r,launchedPkgs:n,ctx:o})=>{let i=o.routePkg(t,r);if(i===void 0)return{preset:e,app:t,route:r,kind:"unknown-route",message:`preset "${e}": proxy override "${r}" on "${t}" names a route not declared in ${t}'s infra-kit.config.ts dev.proxy.routes`};if(n.has(i))return null;let c=ye(o.apiPkgByApp,i),l=c?`add "${c}/api" to the preset`:`launch the api whose package is "${i}"`;return{preset:e,app:t,route:r,pkg:i,kind:"backend-not-launched",message:`preset "${e}": proxy override "${r}" \u2192 "local" requires backend "${i}" to run locally, but the preset does not launch it \u2014 ${l}, or set "${r}" to "cloud"`}},Kt=(e,t)=>{let r=[];for(let[n,o]of Object.entries(e)){let i=ve(o,t.discovered),c=new Set(i.localApps.map(l=>t.apiPkgByApp[l]).filter(l=>l!==void 0));for(let[l,u]of Object.entries(i.proxy))for(let[h,P]of Object.entries(u)){if(P!=="local")continue;let R=xe({preset:n,app:l,route:h,launchedPkgs:c,ctx:t});R&&r.push(R)}}return r};import N from"node:fs/promises";import Y from"node:os";import x from"node:path";import Me from"node:process";import{z as s}from"zod";import d from"node:path";import{$ as f}from"zx";var ke=/^v?(\d+)\.(\d+)\.(\d+)$/,Pe=/^(\d+)\.(\d+)\.(\d+)$/,Re=/^[a-z0-9]+(?:-[a-z0-9]+)*$/,w="release/",I="release/v",G="refs/heads/",we="next";var z=new Set(["dev","main","next","hotfix","regular","release"]),g=class extends Error{constructor(t){super(t),this.name="InvalidReleaseNameError"}},v=class extends Error{constructor(t){super(t),this.name="InvalidReleaseRefError"}},W=e=>e.startsWith(G)?e.slice(G.length):e,U=(e,t,r)=>({kind:"version",semver:{major:e,minor:t,patch:r},raw:`${e}.${t}.${r}`}),E=e=>{if(e.length===0)throw new g('Release name is empty. Provide a kebab-case name like "checkout-redesign".');if(e.length>50)throw new g(`Release name "${e}" is ${e.length} characters; the maximum is 50.`);if(!Re.test(e))throw new g(`Release name "${e}" is not kebab-case. Use lowercase letters, digits, and single hyphens, e.g. "checkout-redesign".`);if(z.has(e))throw new g(`Release name "${e}" is reserved. Reserved names: ${[...z].join(", ")}.`)},j=e=>{let t=W(e.trim());if(!t.startsWith(w))return null;if(t.startsWith(I)){let n=t.slice(I.length),o=Pe.exec(n);if(o)return U(Number(o[1]),Number(o[2]),Number(o[3]))}let r=t.slice(w.length);try{E(r)}catch{return null}return{kind:"name",name:r,raw:r}},be=e=>{let t=e.trim();if(W(t).startsWith(w)){let o=j(t);if(!o)throw new v(`"${e}" looks like a release branch but is not a valid release/v<semver> or release/<name> ref.`);return o}let n=ke.exec(t);if(n)return U(Number(n[1]),Number(n[2]),Number(n[3]));if(t.toLowerCase()===we)throw new v('The "next" token must be resolved to a concrete version (via computeNextVersion) before parsing a release ref.');try{E(t)}catch(o){let i=o instanceof Error?o.message:String(o);throw new v(`Cannot parse "${e}" as a release ref: ${i}`)}return{kind:"name",name:t,raw:t}},Ce=e=>e.kind==="version"?`${I}${e.raw}`:`${w}${e.name}`,Se=(e,t)=>{let r=t==="hotfix"?"Hotfix":"Release";return e.kind==="version"?`${r} v${e.raw}`:`${r} ${e.name}`},Ie=e=>e.kind==="version"?`Release v${e.raw} (RC)`:`Release ${e.name} (RC)`,Ee=e=>e.kind==="version"?`v${e.raw}`:e.name,je=e=>e.raw,D=e=>e==null?!1:j(e)!==null,V=e=>{if(e===void 0)return null;let t=e instanceof Date?e.getTime():new Date(e).getTime();return Number.isNaN(t)?null:t},De=(e,t,r)=>{if(e.kind==="version"&&t.kind==="version")return e.semver.major!==t.semver.major?e.semver.major-t.semver.major:e.semver.minor!==t.semver.minor?e.semver.minor-t.semver.minor:e.semver.patch-t.semver.patch;if(e.kind==="version")return-1;if(t.kind==="version")return 1;let n=V(r?.a),o=V(r?.b);return n!==null&&o!==null&&n!==o?n-o:e.name<t.name?-1:e.name>t.name?1:0};var Ae=async e=>{let r=(await f`git worktree list`).stdout.split(`
-`).filter(Boolean),n={release:$e,feature:Ne};return r.map(n[e]).filter(o=>o!==null)},H=e=>{let t=e.trimEnd();if(!t.endsWith("]"))return null;let r=t.lastIndexOf("[");if(r===-1)return null;let n=t.slice(r+1,-1);return n.length>0?n:null},$e=e=>{let t=H(e);return D(t)?t:null},Ne=e=>{let t=H(e);return t?.startsWith("feature/")?t:null},y=async()=>(await f`git rev-parse --show-toplevel`).stdout.trim(),A=async e=>{let t=e??await y(),r=(await f({cwd:t})`git rev-parse --git-common-dir`).stdout.trim(),n=d.resolve(t,r);return n.includes(`${d.sep}.git${d.sep}modules${d.sep}`)?t:d.dirname(n)},X=async()=>(await f`git rev-parse --abbrev-ref HEAD`).stdout.trim(),Te=async()=>(await f`git status --porcelain`).stdout.trim().length===0,_e=async()=>{let e=await y(),[t,r]=await Promise.all([f({cwd:e})`git rev-parse --absolute-git-dir`,f({cwd:e})`git rev-parse --git-common-dir`]),n=t.stdout.trim(),o=d.resolve(e,r.stdout.trim());return n!==o},Le=async()=>{let e=await y();return d.basename(e)},Ke=async e=>{(await f`git branch --list ${e}`).stdout.trim().length!==0&&await X()!==e&&await f`git branch -D ${e}`},Oe=async e=>{(await f`git ls-remote --heads origin ${e}`).stdout.trim().length!==0&&await f`git push origin --delete ${e}`};var q="infra-kit.json",Q=".infra-kit",Fe="infra-kit.json",Be="projects",Ge=s.object({provider:s.literal("doppler"),config:s.object({name:s.string().min(1)})}),ze=s.discriminatedUnion("provider",[Ge]),Ve=s.object({workspaceConfigPath:s.string().min(1)}),We=s.object({provider:s.literal("cursor"),config:Ve}),Ue=s.object({}),He=s.object({provider:s.literal("zed"),config:Ue}),J=s.discriminatedUnion("provider",[We,He]),Xe=s.union([J,s.array(J).min(1)]),qe=s.object({provider:s.literal("jira"),config:s.object({baseUrl:s.string().url(),projectId:s.number().int().positive()})}),Je=s.discriminatedUnion("provider",[qe]),Ye=["two-columns","three-pane"],Qe=s.object({layout:s.enum(Ye).optional()}),Ze=s.object({openInGithubDesktop:s.boolean().optional(),openInCmux:s.boolean().optional(),cmux:Qe.optional()}),et=s.object({port:s.number().int().positive().optional(),prefixUrl:s.string().min(1).optional()}).strict(),tt=s.record(s.string().min(1),et),rt=s.enum(["local","cloud"]),nt=s.object({watchDeps:s.boolean().optional(),proxy:s.record(s.string().min(1),rt).optional()}).strict(),ot=s.object({apps:s.record(s.string().min(1),nt).optional(),cmux:s.boolean().optional()}).strict(),st=s.record(s.string().min(1),ot),it=s.object({port:s.number().int().positive().optional()}).strict(),at=s.object({trigger:s.enum(["shell-startup","cli-invocation"]),config:s.string().min(1)}).strict(),T=s.object({envManagement:ze,ide:Xe.optional(),taskManager:Je.optional(),worktrees:Ze.optional(),envAutoLoad:at.optional(),dev:tt.optional(),devServersPresets:st.optional(),devProxy:it.optional()}).strict(),ct=443,Z=T.superRefine((e,t)=>{if(!Array.isArray(e.ide))return;let r=new Set;for(let n of e.ide){if(r.has(n.provider)){t.addIssue({code:"custom",message:"each IDE provider may appear at most once",path:["ide"]});return}r.add(n.provider)}}),ee=T.partial(),pt=e=>{let t=e.ide;return t?Array.isArray(t)?t:[t]:[]},lt="two-columns",ut=e=>e.worktrees?.cmux?.layout??lt,m=null,k=null,ft=()=>`${Me.cwd()} ${Y.homedir()}`,te=async()=>{let e=ft();if(k&&k.key===e)return k.value;let t=await y(),r=await A(t),n=x.basename(r),o=x.join(Y.homedir(),Q),i={main:x.join(t,q),userGlobal:x.join(o,Fe),userProject:x.join(o,Be,n,q),projectName:n};return k={key:e,value:i},i},gt=async()=>{let e=await te(),t;try{t=await N.stat(e.main)}catch{m=null;let u=e.main.replace(/\.json$/,".yml");throw await $(u)?new Error(`infra-kit.json not found at ${e.main}. A legacy infra-kit.yml exists \u2014 run \`infra-kit init\` to convert it.`):new Error(`infra-kit.json not found at ${e.main}`)}let[r,n]=await Promise.all([$(e.userGlobal),$(e.userProject)]),o={main:Number(t.mtimeMs),userGlobal:r?Number(r.mtimeMs):null,userProject:n?Number(n.mtimeMs):null};if(m&&vt(m.mtimes,o))return m.value;let i=[{label:"infra-kit.json",path:e.main,required:!0},{label:"~/.infra-kit/infra-kit.json",path:e.userGlobal,required:!1},{label:`~/.infra-kit/projects/${e.projectName}/infra-kit.json`,path:e.userProject,required:!1}],c={};for(let u of i){let h=await yt(u);h!==null&&(c={...c,...h})}let l=Z.safeParse(c);if(!l.success)throw new Error(`Invalid merged infra-kit config: ${s.prettifyError(l.error)}`);return m={mtimes:o,value:l.data},l.data},dt=()=>{m=null},mt=()=>{m=null,k=null},$=async e=>{try{return await N.stat(e)}catch{return null}},ht=async e=>{try{return await N.readFile(e,"utf-8")}catch{return null}},vt=(e,t)=>{let r=Object.keys(e);return r.length!==Object.keys(t).length?!1:r.every(n=>e[n]===t[n])},yt=async e=>{let t=await ht(e.path);if(t===null){if(e.required)throw new Error(`${e.label} not found at ${e.path}`);return null}let r;try{r=t.trim()===""?{}:JSON.parse(t)}catch(o){throw new Error(`Invalid JSON in ${e.label} at ${e.path}: ${o.message}`)}if(xt(r)&&"envTokens"in r)throw new Error(kt(e));let n=ee.safeParse(r);if(!n.success)throw new Error(`Invalid ${e.label} at ${e.path}: ${s.prettifyError(n.error)}`);return n.data},xt=e=>typeof e=="object"&&e!==null&&!Array.isArray(e),kt=e=>[`Refusing to load ${e.label} \u2014 \`envTokens\` is not a config key.`,"A service token in a config file can be committed, backed up by your editor, or shared.","  1. REVOKE the token in Doppler now \u2014 treat it as compromised.",`  2. Remove the \`envTokens\` key from ${e.path}.`,"  3. Re-add it privately: `infra-kit env-token-set <env>`","     (it is written to ~/.infra-kit/projects/<repo>/tokens.json, mode 0600, never to the repo)."].join(`
-`);export{g as a,E as b,j as c,be as d,Ce as e,Se as f,Ie as g,Ee as h,je as i,D as j,De as k,Ae as l,y as m,Te as n,_e as o,Le as p,Ke as q,Oe as r,_ as s,bt as t,Ct as u,oe as v,It as w,Et as x,jt as y,Dt as z,At as A,$t as B,Nt as C,B as D,_t as E,ve as F,Lt as G,Kt as H,Q as I,ct as J,Z as K,ee as L,pt as M,ut as N,te as O,gt as P,dt as Q,mt as R};
-//# sourceMappingURL=chunk-IVWPZEMC.js.map

package/dist/chunk-S45AAYXO.js

@@ -1,4 +0,0 @@
-import{a as T}from"./chunk-A7FAXZGI.js";import{N as v,P as S,c as E,i as C,u}from"./chunk-IVWPZEMC.js";import W from"node:process";import{$ as w}from"zx";var $=async()=>{try{return await w`cmux --version`.quiet(),!0}catch{return!1}},N=async e=>{let{cwd:t,title:r,layout:n}=e,o=JSON.stringify(n),i=(await w({env:{...W.env,CMUX_QUIET:"1"}})`cmux new-workspace --name ${r} --cwd ${t} --focus false --layout ${o}`).stdout;return D(i)},_=async e=>{try{await w`cmux close-workspace --workspace ${e}`.quiet()}catch(t){u.debug({error:t,ref:e},"cmux: skipped closing dev workspace")}},D=e=>{let t=e.match(/workspace:\d+/);if(!t)throw new Error("cmux: could not locate workspace ref in new-workspace output");return t[0]};var I=/\bv(\d+\.\d+\.\d+)\b/g,l=e=>e.trim().replace(/\s+/g," ").replace(I,"$1");import{$ as A}from"zx";var M=async e=>{try{let t=(await A`cmux list-workspaces`.quiet()).stdout,r=B(t,e);if(!r)return;await A`cmux close-workspace --workspace ${r}`.quiet()}catch(t){u.debug({error:t,title:e},"cmux: skipped closing workspace")}},B=(e,t)=>{let r=l(t);for(let n of e.split(`
-`)){let o=n.match(/^[* ]\s*(workspace:\d+)\s+(.+?)(?:\s+\[selected\])?\s*$/);if(!o)continue;let s=o[1],i=o[2]?.trim()??"";if(l(i)===r)return s}};import{$ as U}from"zx";var F=async()=>{try{let e=(await U`cmux list-workspaces`.quiet()).stdout,t=new Set;for(let r of e.split(`
-`)){let n=r.match(/^[* ]\s*workspace:\d+\s+(.+?)(?:\s+\[selected\])?\s*$/);if(!n)continue;let o=n[1]?.trim();o&&t.add(l(o))}return t}catch(e){return u.debug({error:e},"cmux: skipped listing workspace titles"),new Set}};import{$ as p}from"zx";var q=async e=>{let{cwd:t,title:r}=e,n=v(await S()),o=(await p`cmux workspace create --cwd ${t}`).stdout,s=J(o),i=(await p`cmux list-pane-surfaces --workspace ${s}`).stdout,c=z(i);await p`cmux new-split right --workspace ${s} --surface ${c}`,n==="three-pane"&&await p`cmux new-split down --workspace ${s} --surface ${c}`,r&&await p`cmux workspace rename --workspace ${s} --title ${r}`},z=e=>{let t=e.match(/surface:\d+/);if(!t)throw new Error("cmux: could not locate initial surface in list-pane-surfaces output");return t[0]},J=e=>{let t=e.match(/workspace:\d+/);if(!t)throw new Error("cmux: could not locate workspace ref in workspace create output");return t[0]};var j=e=>{let{repoName:t,branch:r}=e,n=E(r),o=n?C(n):r;return`${t} ${o}`};var H=new Set(["ExitPromptError","AbortPromptError","PromptCancelledError"]),R=e=>e instanceof Error&&H.has(e.name),je=e=>{if(R(e))return!0;let t=e?.cause;return R(t)};import{execFile as K}from"node:child_process";import{createHash as Q}from"node:crypto";import{existsSync as V,readFileSync as f}from"node:fs";import G from"node:http";import X from"node:https";import Y from"node:net";import{homedir as Z}from"node:os";import{dirname as k,join as m}from"node:path";import g from"node:process";import ee from"node:tls";import{fileURLToPath as te}from"node:url";import{promisify as re}from"node:util";var oe=re(K),ne=e=>{let t=JSON.parse(f(e,"utf-8")),r=typeof t.bin=="string"?t.bin:t.bin?.portless;return r==null||r===""?null:r},se=()=>{try{let e=k(te(import.meta.url));for(;;){let t=m(e,"node_modules","portless","package.json");if(V(t)){let n=ne(t);return n==null?null:m(k(t),n)}let r=k(e);if(r===e)return null;e=r}}catch{return null}},h,L=()=>(h===void 0&&(h=se()),h),ie=/^[\w@%+=:,./-]+$/,ae="'\\''",ce=e=>ie.test(e)?e:`'${e.replaceAll("'",ae)}'`,it=(e,t)=>{let r=[t.execPath??g.execPath,t.bin,...e];return(t.sudo===!0?"sudo ":"")+r.map(ce).join(" ")},ue=1500,y=1500,le="x-portless",P="127.0.0.1",me="localhost",pe=e=>new Promise(t=>{let r=Y.connect({host:P,port:e}),n=o=>{r.destroy(),t(o)};r.setTimeout(y),r.once("connect",()=>{n(!0)}),r.once("timeout",()=>{n(!1)}),r.once("error",()=>{n(!1)})}),fe=(e,t)=>new Promise(r=>{let o=(t?X.request:G.request)({host:P,port:e,method:"HEAD",path:"/",timeout:y,...t?{rejectUnauthorized:!1,servername:me}:{}},s=>{s.resume(),r(s.headers[le]==="1")});o.on("error",()=>{r(!1)}),o.on("timeout",()=>{o.destroy(),r(!1)}),o.end()}),de=async(e,{timeoutMs:t})=>{let r=L();if(r==null)throw new Error("portless is not installed (not resolvable from node_modules)");await oe(g.execPath,[r,...e],{signal:AbortSignal.timeout(t),encoding:"utf-8",env:T(g.env)})},b=()=>g.env.PORTLESS_STATE_DIR??m(Z(),".portless"),ge="ca.pem",xe="ca.trusted",O=()=>m(b(),ge),at=()=>{try{let e=f(m(b(),xe),"utf-8").trim();return e===""?!1:Q("sha256").update(f(O())).digest("hex")===e.toLowerCase()}catch{return!1}},ct=(e,t)=>new Promise(r=>{let n;try{n=f(O())}catch{r({ok:!1,code:"ENOENT"});return}let o=ee.connect({host:P,port:e,servername:t,ca:[n],rejectUnauthorized:!0},()=>{let s=o.authorizationError,i=o.authorized;o.destroy(),r(i?{ok:!0}:{ok:!1,code:s?.code??s?.message??"UNKNOWN"})});o.setTimeout(y),o.once("timeout",()=>{o.destroy(),r({ok:!1,code:"ETIMEDOUT"})}),o.once("error",s=>{o.destroy(),r({ok:!1,code:s.code??"UNKNOWN"})})}),ut=()=>{try{let e=JSON.parse(f(m(b(),"routes.json"),"utf-8"));return Array.isArray(e)?e.flatMap(t=>{let{hostname:r,port:n}=t??{};return typeof r!="string"||r===""||typeof n!="number"?[]:[{name:r,port:n}]}):[]}catch{return[]}},lt=(e={})=>{let t=e.bin===void 0?L():e.bin,r=e.run??de,n=e.isListening??pe,o=e.isProxyServing??fe,s=e.timeoutMs??ue,i=null,c=async a=>{try{return await r(a,{timeoutMs:s}),!0}catch{return!1}},d=async()=>(i??=await c(["--version"]),i);return{binPath:()=>t,isAvailable:d,isProxyServing:async(a,x)=>!await d()||!await n(a)?!1:o(a,x),registerAlias:async(a,x)=>await d()?c(["alias",a,String(x)]):!1,removeAlias:async a=>{await d()&&await c(["alias","--remove",a])}}};export{se as a,it as b,pe as c,fe as d,O as e,at as f,ct as g,ut as h,lt as i,l as j,M as k,F as l,$ as m,N as n,_ as o,q as p,j as q,je as r};
-//# sourceMappingURL=chunk-S45AAYXO.js.map

package/dist/chunk-S45AAYXO.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/integrations/cmux/open-dev-workspace.ts", "../src/integrations/cmux/canonicalize-cmux-title.ts", "../src/integrations/cmux/close-workspace-by-title.ts", "../src/integrations/cmux/list-workspace-titles.ts", "../src/integrations/cmux/open-workspace-with-layout.ts", "../src/integrations/cmux/workspace-title.ts", "../src/lib/errors/is-prompt-cancellation.ts", "../src/dev/proxy/portless-driver.ts"],
-  "sourcesContent": ["import process from 'node:process'\nimport { $ } from 'zx'\n\nimport type { CmuxLayoutNode } from 'src/dev/cmux-layout'\nimport { logger } from 'src/lib/logger'\n\n/** Args for {@link openCmuxDevWorkspace}: the workspace root, title, and pane layout tree. */\ninterface OpenCmuxDevWorkspaceArgs {\n  cwd: string\n  title: string\n  layout: CmuxLayoutNode\n}\n\n/**\n * True iff the `cmux` CLI is invokable (i.e. `cmux --version` resolves). Used to\n * gate `--cmux` mode and fall back to single-process dev when cmux is absent.\n */\nexport const isCmuxAvailable = async (): Promise<boolean> => {\n  try {\n    await $`cmux --version`.quiet()\n\n    return true\n  } catch {\n    return false\n  }\n}\n\n/**\n * Open ONE cmux workspace rooted at `cwd`, laid out per `layout` (one pane per\n * command). Runs in a `CMUX_QUIET=1` scoped env to suppress cmux's one-time compat\n * notice, then parses and returns the `workspace:<id>` ref from stdout.\n */\nexport const openCmuxDevWorkspace = async (args: OpenCmuxDevWorkspaceArgs): Promise<string> => {\n  const { cwd, title, layout } = args\n  const layoutJson = JSON.stringify(layout)\n\n  const $cmux = $({ env: { ...process.env, CMUX_QUIET: '1' } })\n  const output = (await $cmux`cmux new-workspace --name ${title} --cwd ${cwd} --focus false --layout ${layoutJson}`)\n    .stdout\n\n  return parseWorkspaceRef(output)\n}\n\n/**\n * Best-effort close of the cmux workspace `ref`, tearing down the workspace and\n * every pane process. Silently no-ops (debug-logged) if cmux isn't running or the\n * close fails, mirroring {@link file://./close-workspace-by-title.ts}.\n */\nexport const closeCmuxDevWorkspace = async (ref: string): Promise<void> => {\n  try {\n    await $`cmux close-workspace --workspace ${ref}`.quiet()\n  } catch (error) {\n    logger.debug({ error, ref }, 'cmux: skipped closing dev workspace')\n  }\n}\n\n/**\n * Extract the `workspace:<id>` ref from `cmux new-workspace` output (e.g.\n * `OK workspace:5`). Throws a clear error when no ref is present.\n *\n * @example\n * parseWorkspaceRef('OK workspace:5\\n') // => 'workspace:5'\n */\nconst parseWorkspaceRef = (output: string): string => {\n  const match = output.match(/workspace:\\d+/)\n\n  if (!match) {\n    throw new Error('cmux: could not locate workspace ref in new-workspace output')\n  }\n\n  return match[0]\n}\n", "/** Matches a `v`-prefixed semver token (e.g. `v1.48.0`) anchored on shape. */\nconst V_SEMVER_TOKEN_RE = /\\bv(\\d+\\.\\d+\\.\\d+)\\b/g\n\n/**\n * Canonicalizes a cmux workspace title into a stable dedup/close key.\n *\n * cmux workspace titles are human display strings built by\n * `buildCmuxWorkspaceTitle`, so the value stored when a workspace is created can\n * drift from the value rebuilt later \u2014 across whitespace and across CLI versions\n * (an older build titled version releases `v1.48.0`; the current build titles\n * them `1.48.0`). Keying dedup or close on the raw title silently creates\n * duplicate / unclosable workspaces whenever that drift occurs.\n *\n * Canonicalization collapses the known drift axes so both sides round-trip to an\n * equal key:\n *   - trims and collapses internal whitespace to single spaces;\n *   - normalizes a `v`-prefixed semver token to its bare form\n *     (`v1.48.0` \u2192 `1.48.0`), anchored on semver shape so named releases that\n *     merely start with `v` (e.g. `vega-redesign`) are left untouched.\n *\n * Non-release fallback titles (which may contain `/`, e.g. `feature/foo`) are\n * preserved as-is apart from whitespace normalization.\n *\n * @example\n * canonicalizeCmuxTitle('hulyo-monorepo  v1.48.0')      // => 'hulyo-monorepo 1.48.0'\n * canonicalizeCmuxTitle('hulyo-monorepo 1.48.0')        // => 'hulyo-monorepo 1.48.0'\n * canonicalizeCmuxTitle('hulyo-monorepo vega-redesign') // => 'hulyo-monorepo vega-redesign'\n */\nexport const canonicalizeCmuxTitle = (raw: string): string => {\n  return raw.trim().replace(/\\s+/g, ' ').replace(V_SEMVER_TOKEN_RE, '$1')\n}\n", "import { $ } from 'zx'\n\nimport { logger } from 'src/lib/logger'\n\nimport { canonicalizeCmuxTitle } from './canonicalize-cmux-title'\n\n/**\n * Best-effort close of the cmux workspace whose title matches `title` (compared\n * via {@link canonicalizeCmuxTitle}, so a drifted stored title still resolves).\n * Silently no-ops if cmux isn't running, the workspace isn't found, or close fails.\n */\nexport const closeCmuxWorkspaceByTitle = async (title: string): Promise<void> => {\n  try {\n    const listOutput = (await $`cmux list-workspaces`.quiet()).stdout\n\n    const ref = findWorkspaceRefByTitle(listOutput, title)\n\n    if (!ref) {\n      return\n    }\n\n    await $`cmux close-workspace --workspace ${ref}`.quiet()\n  } catch (error) {\n    logger.debug({ error, title }, 'cmux: skipped closing workspace')\n  }\n}\n\n/**\n * Parses `cmux list-workspaces` output and returns the workspace ref whose\n * title matches `title`, or undefined if no match. Both sides are compared via\n * {@link canonicalizeCmuxTitle} so a workspace stored under a drifted title\n * (whitespace, or an older CLI's `v`-prefixed semver) is still found \u2014 keeping\n * close symmetric with the cmux open dedup in `worktrees-reload`.\n *\n * Each line looks like:\n *   \"  workspace:8  hulyo-monorepo 1.48.0\"\n *   \"* workspace:6  obsidian-workspace  [selected]\"\n */\nconst findWorkspaceRefByTitle = (output: string, title: string): string | undefined => {\n  const target = canonicalizeCmuxTitle(title)\n\n  for (const rawLine of output.split('\\n')) {\n    // eslint-disable-next-line sonarjs/super-linear-regex, regexp/no-super-linear-backtracking\n    const match = rawLine.match(/^[* ]\\s*(workspace:\\d+)\\s+(.+?)(?:\\s+\\[selected\\])?\\s*$/)\n\n    if (!match) {\n      continue\n    }\n\n    const ref = match[1]\n    const lineTitle = match[2]?.trim() ?? ''\n\n    if (canonicalizeCmuxTitle(lineTitle) === target) {\n      return ref\n    }\n  }\n\n  return undefined\n}\n", "import { $ } from 'zx'\n\nimport { logger } from 'src/lib/logger'\n\nimport { canonicalizeCmuxTitle } from './canonicalize-cmux-title'\n\n/**\n * Returns the set of **canonical** titles for all currently-open cmux\n * workspaces (see {@link canonicalizeCmuxTitle}). Keying on the canonical form\n * lets callers match a workspace even when its stored title drifted from the\n * title they rebuild (whitespace, or an older CLI's `v`-prefixed semver).\n * Returns an empty set if cmux isn't running, the call fails, or the output\n * can't be parsed \u2014 callers should treat \"empty\" as \"unknown, proceed as if\n * nothing is open\".\n *\n * Each line of `cmux list-workspaces` looks like:\n *   \"  workspace:8  hulyo-monorepo 1.48.0\"\n *   \"* workspace:6  obsidian-workspace  [selected]\"\n */\nexport const listCmuxWorkspaceTitles = async (): Promise<Set<string>> => {\n  try {\n    const output = (await $`cmux list-workspaces`.quiet()).stdout\n\n    const titles = new Set<string>()\n\n    for (const rawLine of output.split('\\n')) {\n      // eslint-disable-next-line sonarjs/super-linear-regex, regexp/no-super-linear-backtracking\n      const match = rawLine.match(/^[* ]\\s*workspace:\\d+\\s+(.+?)(?:\\s+\\[selected\\])?\\s*$/)\n\n      if (!match) {\n        continue\n      }\n\n      const title = match[1]?.trim()\n\n      if (title) {\n        titles.add(canonicalizeCmuxTitle(title))\n      }\n    }\n\n    return titles\n  } catch (error) {\n    logger.debug({ error }, 'cmux: skipped listing workspace titles')\n\n    return new Set()\n  }\n}\n", "import { $ } from 'zx'\n\nimport { getInfraKitConfig, resolveCmuxLayout } from 'src/lib/infra-kit-config'\n\ninterface OpenCmuxWorkspaceArgs {\n  cwd: string\n  title?: string\n}\n\n/**\n * Opens a new cmux workspace rooted at `cwd`, with panes arranged per the\n * configured `worktrees.cmux.layout` (resolved via {@link resolveCmuxLayout},\n * default `two-columns`):\n *   two-columns \u2014 left | right, both full-height (two panes)\n *   three-pane  \u2014 left-top / left-bottom | full-height right (three panes)\n * All panes inherit `cwd` from the workspace.\n */\nexport const openCmuxWorkspaceWithLayout = async (args: OpenCmuxWorkspaceArgs): Promise<void> => {\n  const { cwd, title } = args\n\n  const layout = resolveCmuxLayout(await getInfraKitConfig())\n\n  const newWorkspaceOutput = (await $`cmux workspace create --cwd ${cwd}`).stdout\n\n  const workspaceRef = parseWorkspaceRef(newWorkspaceOutput)\n\n  const surfacesOutput = (await $`cmux list-pane-surfaces --workspace ${workspaceRef}`).stdout\n\n  const leftTopRef = parseFirstSurfaceRef(surfacesOutput)\n\n  // Both layouts share the vertical split into left | right columns; only the\n  // legacy three-pane layout additionally splits the left column top/bottom.\n  await $`cmux new-split right --workspace ${workspaceRef} --surface ${leftTopRef}`\n\n  if (layout === 'three-pane') {\n    await $`cmux new-split down --workspace ${workspaceRef} --surface ${leftTopRef}`\n  }\n\n  if (title) {\n    await $`cmux workspace rename --workspace ${workspaceRef} --title ${title}`\n  }\n}\n\n/**\n * Extracts the first `surface:<id>` reference from the output of\n * `cmux list-pane-surfaces`. Used to locate the initial (primary) pane\n * surface so subsequent splits can be anchored relative to it.\n *\n * @example\n * const output = 'surface:12 (active)\\nsurface:13\\n'\n * parseFirstSurfaceRef(output) // => 'surface:12'\n */\nconst parseFirstSurfaceRef = (output: string): string => {\n  const match = output.match(/surface:\\d+/)\n\n  if (!match) {\n    throw new Error('cmux: could not locate initial surface in list-pane-surfaces output')\n  }\n\n  return match[0]\n}\n\n/**\n * Extracts the `workspace:<id>` reference from the output of\n * `cmux workspace create`. The returned ref is used to target the newly\n * created workspace in follow-up `cmux` commands (splits, rename, etc.).\n *\n * @example\n * const output = 'created workspace:7\\n'\n * parseWorkspaceRef(output) // => 'workspace:7'\n */\nconst parseWorkspaceRef = (output: string): string => {\n  const match = output.match(/workspace:\\d+/)\n\n  if (!match) {\n    throw new Error('cmux: could not locate workspace ref in workspace create output')\n  }\n\n  return match[0]\n}\n", "import { displayLabel, parseBranchName } from 'src/lib/release-id'\n\ninterface BuildCmuxWorkspaceTitleArgs {\n  repoName: string\n  branch: string\n}\n\n/**\n * Builds the cmux workspace title used by `worktrees-add` and looked up by\n * `worktrees-remove`. Release branches are rendered via their release-id\n * display label so the title reads e.g. `\"hulyo-monorepo 1.48.0\"` for\n * `\"release/v1.48.0\"` and `\"hulyo-monorepo checkout-redesign\"` for\n * `\"release/checkout-redesign\"`. Non-release branches (cmux titles them too)\n * fall back to the raw branch string.\n */\nexport const buildCmuxWorkspaceTitle = (args: BuildCmuxWorkspaceTitleArgs): string => {\n  const { repoName, branch } = args\n\n  const id = parseBranchName(branch)\n  const label = id ? displayLabel(id) : branch\n\n  return `${repoName} ${label}`\n}\n", "/**\n * Names of the error classes thrown when an interactive prompt ends without a\n * value. From `@inquirer/core`: `ExitPromptError` (Ctrl-C \u2014 and ONLY Ctrl-C:\n * inquirer binds no escape key, so it raises this from readline's SIGINT) and\n * `AbortPromptError` (the prompt was aborted via an `AbortSignal`, which is how\n * Esc arrives \u2014 see lib/prompts/escapable-context). From our own Ink pickers:\n * `PromptCancelledError` (see ./prompt-cancelled-error), which is registered here\n * rather than impersonating an inquirer class name. All are intentional\n * cancellations, not failures.\n */\nconst CANCELLATION_ERROR_NAMES = new Set(['ExitPromptError', 'AbortPromptError', 'PromptCancelledError'])\n\nconst hasCancellationName = (value: unknown): boolean => {\n  return value instanceof Error && CANCELLATION_ERROR_NAMES.has(value.name)\n}\n\n/**\n * True when `error` represents a user (or signal) cancellation of an interactive\n * prompt \u2014 Ctrl-C anywhere, or Esc, which reaches an `@inquirer` prompt as an\n * abort and an Ink picker as a `PromptCancelledError`. Matched by `name` rather\n * than `instanceof` so it stays correct\n * even when pnpm dedupes more than one copy of `@inquirer/core` into the tree\n * (an `instanceof` check fails across realms/duplicate classes).\n *\n * Also unwraps one level of `cause`, so a cancellation re-wrapped in an\n * {@link ./operation-error.OperationError} is still recognised at the top-level\n * error boundary.\n *\n * @example\n * try {\n *   await checkbox({ message: 'Select release branches', choices })\n * } catch (err) {\n *   if (isPromptCancellation(err)) process.exit(0) // clean back-out, not an error\n *   throw err\n * }\n */\nexport const isPromptCancellation = (error: unknown): boolean => {\n  if (hasCancellationName(error)) return true\n\n  const cause = (error as { cause?: unknown } | null | undefined)?.cause\n\n  return hasCancellationName(cause)\n}\n", "/**\n * Thin, injectable driver for the `portless` daemon (Layer B \u2014 see `.omc/plans/dev-https-portless.md`).\n *\n * `infra-kit dev` uses it to register `<release>.<package>.localhost \u2192 127.0.0.1:<port>` routes so the\n * hero URLs resolve over **HTTPS on :443, with no port in the URL**. Every call here is **time-bounded and\n * never throws**: a missing binary, a non-zero exit, or a wedged process resolves to `false`/no-op. That is\n * a reporting contract, not a tolerance one \u2014 portless IS a hard dependency of the dev loop, and\n * `DevServerRunner.ensureProxy` turns a `false` from this driver into a fatal, actionable start error.\n *\n * The binary is NOT resolved from `PATH`: `portless` is a normal npm dependency living in\n * `node_modules/.bin`, which is on `PATH` only when the process was launched via pnpm/npm. Since\n * `infra-kit dev` is often launched otherwise (a global bin, a cmux runner, a foreign cwd), we resolve\n * portless's own `dist/cli.js` by walking `node_modules` from this file (see {@link resolvePortlessBin})\n * and run it with the current `node` (`process.execPath`) \u2014 so it works regardless of how `dev` was\n * invoked. Args are fixed literals plus discovered release/package names + a numeric port, never\n * shell-interpolated.\n *\n * **The daemon is PROBED, never started.** `:443` is privileged, and portless binds it by re-execing\n * itself through `sudo` with an inherited stdio \u2014 which a detached `stdio:'ignore'` child can never\n * satisfy: the password prompt has nowhere to go. Setup is one-time and out-of-band: a root\n * `portless service install`, printed for the user by {@link formatPortlessCommand} (never as a bare\n * `portless`, which no shell can resolve \u2014 see there).\n *\n * All process I/O is injected (`run` for awaited commands, `isProxyServing` for the wire probe) so tests\n * never shell out and can assert the exact portless argv.\n */\nimport type { Buffer } from 'node:buffer'\nimport { execFile } from 'node:child_process'\nimport { createHash } from 'node:crypto'\nimport { existsSync, readFileSync } from 'node:fs'\nimport http from 'node:http'\nimport https from 'node:https'\nimport net from 'node:net'\nimport { homedir } from 'node:os'\nimport { dirname, join } from 'node:path'\nimport process from 'node:process'\nimport tls from 'node:tls'\nimport { fileURLToPath } from 'node:url'\nimport { promisify } from 'node:util'\n\nimport { withoutPackageManagerEnv } from 'src/lib/pm-env'\n\nconst execFileAsync = promisify(execFile)\n\n/** Read `bin.portless` (the `dist/cli.js` relative path) from a portless `package.json` on disk. */\nconst readBinRel = (pkgJsonPath: string): string | null => {\n  const pkg = JSON.parse(readFileSync(pkgJsonPath, 'utf-8')) as { bin?: string | Record<string, string> }\n  const rel = typeof pkg.bin === 'string' ? pkg.bin : pkg.bin?.portless\n\n  return rel == null || rel === '' ? null : rel\n}\n\n/**\n * Resolve the absolute path to portless's CLI entry (`portless/dist/cli.js`) from node_modules,\n * independent of `PATH`. Returns `null` when portless is not installed, degrading the whole driver to\n * a no-op.\n *\n * portless is ESM-only (its `.` export exposes only `import`/`types`, no `require`), so\n * `createRequire().resolve` can't see it. We instead walk `node_modules` upward from this file \u2014 the\n * standard resolution path \u2014 and read the package's `package.json` straight off disk, which bypasses the\n * exports map that would otherwise hide both `package.json` and the main entry.\n */\nexport const resolvePortlessBin = (): string | null => {\n  try {\n    let dir = dirname(fileURLToPath(import.meta.url))\n\n    for (;;) {\n      const pkgJsonPath = join(dir, 'node_modules', 'portless', 'package.json')\n\n      if (existsSync(pkgJsonPath)) {\n        const rel = readBinRel(pkgJsonPath)\n\n        return rel == null ? null : join(dirname(pkgJsonPath), rel)\n      }\n      const parent = dirname(dir)\n\n      if (parent === dir) return null\n      dir = parent\n    }\n  } catch {\n    return null\n  }\n}\n\n/** Resolve portless's CLI once per process \u2014 the on-disk location never changes within a run. */\nlet cachedBin: string | null | undefined\nconst portlessBin = (): string | null => {\n  if (cachedBin === undefined) cachedBin = resolvePortlessBin()\n\n  return cachedBin\n}\n\n/**\n * Characters that survive a POSIX shell unquoted. Anything outside this set (a space, a paren \u2014 both of\n * which appear in real install paths like `/Applications/My Editor.app`) gets single-quoted.\n */\nconst SHELL_SAFE = /^[\\w@%+=:,./-]+$/\n\n/** A literal `'` inside single quotes: close, emit an escaped quote, reopen \u2014 the only way a shell allows it. */\nconst SINGLE_QUOTE_ESCAPE = \"'\\\\''\"\n\n/** Single-quote `value` for a POSIX shell unless it is already inert. */\nconst shellQuote = (value: string): string => {\n  return SHELL_SAFE.test(value) ? value : `'${value.replaceAll(\"'\", SINGLE_QUOTE_ESCAPE)}'`\n}\n\n/** Seams for {@link formatPortlessCommand}, injected so tests never depend on the real node_modules layout. */\nexport interface FormatPortlessCommandOptions {\n  /**\n   * Absolute path to portless's `dist/cli.js`. **Required and non-nullable on purpose.** The caller must\n   * have resolved portless before it can describe how to run it, so \"I could not find the binary\" cannot be\n   * silently rendered as a plausible-looking command \u2014 the type makes that unwritable rather than merely\n   * discouraged. A `null` bin is a different report (\"run `pnpm install`\"), which every caller makes first.\n   */\n  bin: string\n  /** Prefix with `sudo` \u2014 only `service install`, which binds the privileged `:443`, needs it. */\n  sudo?: boolean\n  execPath?: string\n}\n\n/**\n * Render a portless command the user can actually paste into a shell.\n *\n * This exists because the obvious string is a lie. `portless` is a plain npm dependency living in\n * `node_modules/.bin`, which is on `PATH` only inside a pnpm/npm script \u2014 so printing `sudo portless service\n * install` hands the user a command that dies with `sudo: portless: command not found`. `sudo` makes it\n * strictly worse: it replaces `PATH` with `secure_path`, so even a shell that *could* resolve `portless`\n * loses it the moment the command is elevated.\n *\n * We therefore print what the driver itself runs (see {@link defaultRun}): the current interpreter, by\n * absolute path, invoking portless's `dist/cli.js`, by absolute path. Nothing is resolved from `PATH`, so the\n * command works under `sudo`, from any cwd, and however `infra-kit` was launched.\n *\n * This is not merely cosmetic. portless's `service install` writes **the interpreter and script path it was\n * invoked with** straight into the launchd plist's `ProgramArguments` (`nodePath: process.execPath` plus\n * `process.argv[1]`), so the command printed here is the command that gets installed as a **root system\n * daemon**. Printing a name for the shell to resolve would not just fail \u2014 it would decide what runs as root.\n *\n * @example\n * formatPortlessCommand(['service', 'install'], { sudo: true, bin })\n * // 'sudo /usr/local/bin/node /repo/node_modules/portless/dist/cli.js service install'\n */\nexport const formatPortlessCommand = (args: string[], options: FormatPortlessCommandOptions): string => {\n  const words = [options.execPath ?? process.execPath, options.bin, ...args]\n  const prefix = options.sudo === true ? 'sudo ' : ''\n\n  return prefix + words.map(shellQuote).join(' ')\n}\n\n/** Awaited portless invocation. Rejects on non-zero exit / timeout; the driver swallows that into a no-op. */\nexport type PortlessRun = (args: string[], opts: { timeoutMs: number }) => Promise<void>\n\n/** Cheap \"is anything at all accepting TCP here?\" pre-filter in front of the wire probe. */\nexport type IsListening = (port: number) => Promise<boolean>\n\n/**\n * Ground-truth identity: is the process serving `port` actually **portless**, and (when `tls`) is it\n * serving **TLS**? See {@link defaultIsProxyServing} for why this cannot be answered from state files.\n */\nexport type IsProxyServing = (port: number, tls: boolean) => Promise<boolean>\n\nconst DEFAULT_TIMEOUT_MS = 1500\nconst PROBE_TIMEOUT_MS = 1500\n\n/** Response header portless sets on every response it serves. Node lower-cases response header names. */\nconst PORTLESS_HEADER = 'x-portless'\n\n/** IPv4 loopback: portless binds and dials `127.0.0.1`. */\nconst LOOPBACK = '127.0.0.1'\n\n/**\n * SNI for the probe. Node sends **no SNI to an IP literal** (RFC 6066), which would drop portless onto its\n * default certificate \u2014 whose SANs are `localhost`, `*.localhost`, `*.local` and contain **no IP entry**.\n * `localhost` is always in that set, so it is the one name guaranteed to work even on a machine with zero\n * aliases registered.\n */\nconst PROBE_SERVERNAME = 'localhost'\n\nexport const defaultIsListening: IsListening = (port) => {\n  return new Promise((resolve) => {\n    const socket = net.connect({ host: LOOPBACK, port })\n    const finish = (result: boolean): void => {\n      socket.destroy()\n      resolve(result)\n    }\n\n    socket.setTimeout(PROBE_TIMEOUT_MS)\n    socket.once('connect', () => {\n      finish(true)\n    })\n    socket.once('timeout', () => {\n      finish(false)\n    })\n    socket.once('error', () => {\n      finish(false)\n    })\n  })\n}\n\n/**\n * Is the listener on `port` portless itself, serving `tls`? Proven **on the wire**, by asking it: portless\n * sets `X-Portless: 1` on every response, before route lookup \u2014 so an unrouted host still answers the probe\n * (a 404 with the header is a pass). This mirrors portless's own `isProxyRunning`.\n *\n * This replaces the old state-file check (`proxy.port` + `proxy.pid`), which was **unsound**: portless's\n * `resolveStateDir(_port)` ignores its port argument, so `proxy.port` / `proxy.pid` / `proxy.tls` are\n * process-global singletons shared by every daemon on every port. Starting ANY daemon rewrites them, and\n * stopping ANY daemon DELETES them \u2014 so a second, unrelated daemon (or a stale sibling repo still on the\n * old CLI, falling back to an unprivileged port) makes a perfectly healthy `:443` daemon look dead. Both\n * were reproduced against portless 0.15.1; see `.omc/research/portless-https-spike.md`.\n *\n * `rejectUnauthorized: false` is deliberate and load-bearing: this probe answers *\"is portless serving\n * here?\"*, **never** *\"is its CA trusted?\"*. Validating the chain here would collapse two different\n * failures \u2014 a daemon that is down, and a CA that was never trusted \u2014 into one indistinguishable error,\n * with two different fixes (a root `service install` vs the sudo-free `trust`). Trust is a separate,\n * explicitly-validating probe (doctor's CA check).\n */\nexport const defaultIsProxyServing: IsProxyServing = (port, tls) => {\n  return new Promise((resolve) => {\n    const request = tls ? https.request : http.request\n    const req = request(\n      {\n        host: LOOPBACK,\n        port,\n        method: 'HEAD',\n        path: '/',\n        timeout: PROBE_TIMEOUT_MS,\n        ...(tls ? { rejectUnauthorized: false, servername: PROBE_SERVERNAME } : {}),\n      },\n      (res) => {\n        res.resume()\n        resolve(res.headers[PORTLESS_HEADER] === '1')\n      },\n    )\n\n    req.on('error', () => {\n      resolve(false)\n    })\n    req.on('timeout', () => {\n      req.destroy()\n      resolve(false)\n    })\n    req.end()\n  })\n}\n\nconst defaultRun: PortlessRun = async (args, { timeoutMs }) => {\n  const bin = portlessBin()\n\n  if (bin == null) throw new Error('portless is not installed (not resolvable from node_modules)')\n  await execFileAsync(process.execPath, [bin, ...args], {\n    signal: AbortSignal.timeout(timeoutMs),\n    encoding: 'utf-8',\n    env: withoutPackageManagerEnv(process.env),\n  })\n}\n\n/**\n * portless's state directory. Exported so `doctor` reports on the same directory the driver reads.\n *\n * The default is deliberately **unchanged** (`~/.portless`): portless's `service install` bakes\n * `PORTLESS_STATE_DIR`, resolved from `SUDO_USER`, into the launchd plist \u2014 so the root daemon reads the\n * *invoking user's* home. Pointing this anywhere else by default would manufacture the very split it looks\n * like it prevents.\n */\nexport const portlessStateDir = (): string => {\n  return process.env.PORTLESS_STATE_DIR ?? join(homedir(), '.portless')\n}\n\n/** portless's local CA certificate \u2014 the root every host cert it mints is signed by. */\nconst CA_CERT_FILE = 'ca.pem'\n\n/**\n * Marker portless's `trust` writes: the **hex sha256 of `ca.pem`'s bytes** that was added to the login\n * keychain (`writeTrustMarker` \u2192 `caFingerprint`, `cli.js:78-101`). It records WHICH CA was trusted, so a\n * regenerated CA leaves a marker that no longer matches.\n */\nconst CA_TRUST_MARKER_FILE = 'ca.trusted'\n\n/** A route portless is serving: `<name> \u2192 127.0.0.1:<port>`. */\nexport interface PortlessRoute {\n  /**\n   * The registered hostname (e.g. `2-4.client-api.localhost`). Usable verbatim as a\n   * `portless alias --remove <name>` argument \u2014 portless strips a trailing TLD off the name it is handed\n   * (`parseHostnames`, `chunk-SD2PIWJU.js:68-79`) \u2014 and as a TLS `servername`.\n   */\n  name: string\n  port: number\n}\n\n/** Absolute path to portless's local CA certificate, in whichever state dir {@link portlessStateDir} names. */\nexport const readCaPath = (): string => {\n  return join(portlessStateDir(), CA_CERT_FILE)\n}\n\n/**\n * Was `portless trust` run for the CA that is on disk right now? Compares `sha256(ca.pem)` against the\n * fingerprint recorded in `ca.trusted`. `false` when either file is missing; never throws.\n *\n * **This proves the marker was written for THIS fingerprint \u2014 not that the keychain still trusts it.** A\n * user who deletes the certificate from Keychain Access by hand leaves the marker behind and gets a false\n * pass here. That residual is accepted (reading the keychain would mean shelling out to `security` on a\n * check that must stay cheap); it is why this is a *separate* check from the chain handshake\n * ({@link handshakeChainsToCa}), which proves what the daemon actually serves.\n */\nexport const caFingerprintMatches = (): boolean => {\n  try {\n    const recorded = readFileSync(join(portlessStateDir(), CA_TRUST_MARKER_FILE), 'utf-8').trim()\n\n    if (recorded === '') return false\n\n    const actual = createHash('sha256').update(readFileSync(readCaPath())).digest('hex')\n\n    return actual === recorded.toLowerCase()\n  } catch {\n    return false\n  }\n}\n\n/** Outcome of {@link handshakeChainsToCa}: `code` is the Node TLS error code, which the caller discriminates on. */\nexport type HandshakeResult = { ok: true } | { ok: false; code: string }\n\n/**\n * Does the certificate served on `port` chain to the CA in `ca.pem`? A **validating** TLS handshake \u2014 the\n * complement of {@link defaultIsProxyServing}, which deliberately does not validate.\n *\n * `servername` is **mandatory and load-bearing**, never optional: Node sends no SNI to an IP literal\n * (RFC 6066), which drops portless onto its default certificate, whose SANs (`localhost`, `*.localhost`,\n * `*.local`) contain **no IP entry** \u2014 so a validating probe of `127.0.0.1` with no `servername` fails with\n * `ERR_TLS_CERT_ALTNAME_INVALID` against a perfectly healthy daemon. Any such code coming back from here is\n * therefore a bug in the CALLER's probe, never a finding about the user's trust store. Passing an\n * unregistered name is safe: portless's SNI callback mints a cert on demand for any servername.\n *\n * Time-bounded; never throws.\n */\nexport const handshakeChainsToCa = (port: number, servername: string): Promise<HandshakeResult> => {\n  return new Promise((resolve) => {\n    let ca: Buffer<ArrayBufferLike>\n\n    try {\n      ca = readFileSync(readCaPath())\n    } catch {\n      resolve({ ok: false, code: 'ENOENT' })\n\n      return\n    }\n\n    const socket = tls.connect({ host: LOOPBACK, port, servername, ca: [ca], rejectUnauthorized: true }, () => {\n      // With `rejectUnauthorized: true` a chain failure normally surfaces as an 'error' event and this\n      // callback never runs; the check is here so a future Node that connects-then-reports can't slip a\n      // rejected chain through as a pass.\n      const authError = socket.authorizationError as NodeJS.ErrnoException | undefined\n      const authorized = socket.authorized\n\n      socket.destroy()\n      resolve(authorized ? { ok: true } : { ok: false, code: authError?.code ?? authError?.message ?? 'UNKNOWN' })\n    })\n\n    socket.setTimeout(PROBE_TIMEOUT_MS)\n    socket.once('timeout', () => {\n      socket.destroy()\n      resolve({ ok: false, code: 'ETIMEDOUT' })\n    })\n    socket.once('error', (err: NodeJS.ErrnoException) => {\n      socket.destroy()\n      resolve({ ok: false, code: err.code ?? 'UNKNOWN' })\n    })\n  })\n}\n\n/**\n * Routes portless currently has registered, read from `routes.json` in {@link portlessStateDir}. `[]` on any\n * failure (absent file, malformed JSON, unexpected shape) \u2014 an unreadable route list is reported as \"no\n * routes\", never as an error, because every caller uses this for diagnostics only.\n */\nexport const listRoutes = (): PortlessRoute[] => {\n  try {\n    const raw: unknown = JSON.parse(readFileSync(join(portlessStateDir(), 'routes.json'), 'utf-8'))\n\n    if (!Array.isArray(raw)) return []\n\n    return raw.flatMap((entry): PortlessRoute[] => {\n      const { hostname, port } = (entry ?? {}) as { hostname?: unknown; port?: unknown }\n\n      if (typeof hostname !== 'string' || hostname === '' || typeof port !== 'number') return []\n\n      return [{ name: hostname, port }]\n    })\n  } catch {\n    return []\n  }\n}\n\nexport interface PortlessDriver {\n  /**\n   * Absolute path to the `dist/cli.js` this driver executes, or `null` when portless is not installed.\n   *\n   * Exposed so a caller rendering a remediation ({@link formatPortlessCommand}) names the binary THIS driver\n   * would run, rather than re-resolving one behind its back \u2014 which, under an injected driver, would print a\n   * fix derived from the real machine instead of the one under test.\n   */\n  binPath: () => string | null\n  /** Resolve (and memoize) whether the `portless` binary is usable. Absent \u2192 every other call no-ops. */\n  isAvailable: () => Promise<boolean>\n  /**\n   * Is a portless daemon serving `port` over `tls`? **Probe only \u2014 this never starts anything.** Binding\n   * the privileged `:443` needs root, and portless's sudo re-exec cannot prompt from a detached child, so\n   * the daemon is installed once, out-of-band (a root `service install`). A `false` here is turned into a\n   * fatal, actionable start error by the caller.\n   */\n  isProxyServing: (port: number, tls: boolean) => Promise<boolean>\n  /**\n   * Register `<name> \u2192 127.0.0.1:<port>` (`name` = `<release>.<package>`). Returns `true` on success so\n   * the caller shows the hero URL only for an alias that actually resolves (best-effort otherwise).\n   */\n  registerAlias: (name: string, port: number) => Promise<boolean>\n  /** Deregister `<name>`. Best-effort. */\n  removeAlias: (name: string) => Promise<void>\n}\n\nexport interface PortlessDriverDeps {\n  /** Override the resolved `dist/cli.js` path (default: the real node_modules walk). Injected in tests. */\n  bin?: string | null\n  run?: PortlessRun\n  /** TCP liveness pre-filter (default: real `net` connect). Injected in tests. */\n  isListening?: IsListening\n  /** Wire-probe identity check (default: real `HEAD /` + `X-Portless`). Injected in tests. */\n  isProxyServing?: IsProxyServing\n  timeoutMs?: number\n}\n\n/**\n * Build a {@link PortlessDriver}. Inject `run` in tests to assert argv without shelling out.\n * `isAvailable` memoizes so the binary is probed at most once per runner.\n */\nexport const createPortlessDriver = (deps: PortlessDriverDeps = {}): PortlessDriver => {\n  const bin = deps.bin === undefined ? portlessBin() : deps.bin\n  const run = deps.run ?? defaultRun\n  const isListening = deps.isListening ?? defaultIsListening\n  const isProxyServing = deps.isProxyServing ?? defaultIsProxyServing\n  const timeoutMs = deps.timeoutMs ?? DEFAULT_TIMEOUT_MS\n  let availability: boolean | null = null\n\n  /** Run a portless subcommand, swallowing any failure into `false` (best-effort contract). */\n  const tryRun = async (args: string[]): Promise<boolean> => {\n    try {\n      await run(args, { timeoutMs })\n\n      return true\n    } catch {\n      return false\n    }\n  }\n\n  const isAvailable = async (): Promise<boolean> => {\n    availability ??= await tryRun(['--version'])\n\n    return availability\n  }\n\n  const serving = async (port: number, tls: boolean): Promise<boolean> => {\n    if (!(await isAvailable())) return false\n    // Nothing is even accepting TCP \u2192 skip the (more expensive) wire probe entirely.\n    if (!(await isListening(port))) return false\n\n    return isProxyServing(port, tls)\n  }\n\n  const registerAlias = async (name: string, port: number): Promise<boolean> => {\n    if (!(await isAvailable())) return false\n\n    return tryRun(['alias', name, String(port)])\n  }\n\n  const removeAlias = async (name: string): Promise<void> => {\n    if (!(await isAvailable())) return\n    await tryRun(['alias', '--remove', name])\n  }\n\n  return {\n    binPath: () => {\n      return bin\n    },\n    isAvailable,\n    isProxyServing: serving,\n    registerAlias,\n    removeAlias,\n  }\n}\n"],
-  "mappings": "uGAAA,OAAOA,MAAa,eACpB,OAAS,KAAAC,MAAS,KAgBX,IAAMC,EAAkB,SAA8B,CAC3D,GAAI,CACF,aAAMC,kBAAkB,MAAM,EAEvB,EACT,MAAQ,CACN,MAAO,EACT,CACF,EAOaC,EAAuB,MAAOC,GAAoD,CAC7F,GAAM,CAAE,IAAAC,EAAK,MAAAC,EAAO,OAAAC,CAAO,EAAIH,EACzBI,EAAa,KAAK,UAAUD,CAAM,EAGlCE,GAAU,MADFP,EAAE,CAAE,IAAK,CAAE,GAAGQ,EAAQ,IAAK,WAAY,GAAI,CAAE,CAAC,8BACJJ,CAAK,UAAUD,CAAG,2BAA2BG,CAAU,IAC5G,OAEH,OAAOG,EAAkBF,CAAM,CACjC,EAOaG,EAAwB,MAAOC,GAA+B,CACzE,GAAI,CACF,MAAMX,qCAAqCW,CAAG,GAAG,MAAM,CACzD,OAASC,EAAO,CACdC,EAAO,MAAM,CAAE,MAAAD,EAAO,IAAAD,CAAI,EAAG,qCAAqC,CACpE,CACF,EASMF,EAAqBF,GAA2B,CACpD,IAAMO,EAAQP,EAAO,MAAM,eAAe,EAE1C,GAAI,CAACO,EACH,MAAM,IAAI,MAAM,8DAA8D,EAGhF,OAAOA,EAAM,CAAC,CAChB,ECtEA,IAAMC,EAAoB,wBA2BbC,EAAyBC,GAC7BA,EAAI,KAAK,EAAE,QAAQ,OAAQ,GAAG,EAAE,QAAQF,EAAmB,IAAI,EC7BxE,OAAS,KAAAG,MAAS,KAWX,IAAMC,EAA4B,MAAOC,GAAiC,CAC/E,GAAI,CACF,IAAMC,GAAc,MAAMC,wBAAwB,MAAM,GAAG,OAErDC,EAAMC,EAAwBH,EAAYD,CAAK,EAErD,GAAI,CAACG,EACH,OAGF,MAAMD,qCAAqCC,CAAG,GAAG,MAAM,CACzD,OAASE,EAAO,CACdC,EAAO,MAAM,CAAE,MAAAD,EAAO,MAAAL,CAAM,EAAG,iCAAiC,CAClE,CACF,EAaMI,EAA0B,CAACG,EAAgBP,IAAsC,CACrF,IAAMQ,EAASC,EAAsBT,CAAK,EAE1C,QAAWU,KAAWH,EAAO,MAAM;AAAA,CAAI,EAAG,CAExC,IAAMI,EAAQD,EAAQ,MAAM,yDAAyD,EAErF,GAAI,CAACC,EACH,SAGF,IAAMR,EAAMQ,EAAM,CAAC,EACbC,EAAYD,EAAM,CAAC,GAAG,KAAK,GAAK,GAEtC,GAAIF,EAAsBG,CAAS,IAAMJ,EACvC,OAAOL,CAEX,CAGF,EC1DA,OAAS,KAAAU,MAAS,KAmBX,IAAMC,EAA0B,SAAkC,CACvE,GAAI,CACF,IAAMC,GAAU,MAAMC,wBAAwB,MAAM,GAAG,OAEjDC,EAAS,IAAI,IAEnB,QAAWC,KAAWH,EAAO,MAAM;AAAA,CAAI,EAAG,CAExC,IAAMI,EAAQD,EAAQ,MAAM,uDAAuD,EAEnF,GAAI,CAACC,EACH,SAGF,IAAMC,EAAQD,EAAM,CAAC,GAAG,KAAK,EAEzBC,GACFH,EAAO,IAAII,EAAsBD,CAAK,CAAC,CAE3C,CAEA,OAAOH,CACT,OAASK,EAAO,CACd,OAAAC,EAAO,MAAM,CAAE,MAAAD,CAAM,EAAG,wCAAwC,EAEzD,IAAI,GACb,CACF,EC9CA,OAAS,KAAAE,MAAS,KAiBX,IAAMC,EAA8B,MAAOC,GAA+C,CAC/F,GAAM,CAAE,IAAAC,EAAK,MAAAC,CAAM,EAAIF,EAEjBG,EAASC,EAAkB,MAAMC,EAAkB,CAAC,EAEpDC,GAAsB,MAAMC,gCAAgCN,CAAG,IAAI,OAEnEO,EAAeC,EAAkBH,CAAkB,EAEnDI,GAAkB,MAAMH,wCAAwCC,CAAY,IAAI,OAEhFG,EAAaC,EAAqBF,CAAc,EAItD,MAAMH,qCAAqCC,CAAY,cAAcG,CAAU,GAE3ER,IAAW,cACb,MAAMI,oCAAoCC,CAAY,cAAcG,CAAU,GAG5ET,GACF,MAAMK,sCAAsCC,CAAY,YAAYN,CAAK,EAE7E,EAWMU,EAAwBC,GAA2B,CACvD,IAAMC,EAAQD,EAAO,MAAM,aAAa,EAExC,GAAI,CAACC,EACH,MAAM,IAAI,MAAM,qEAAqE,EAGvF,OAAOA,EAAM,CAAC,CAChB,EAWML,EAAqBI,GAA2B,CACpD,IAAMC,EAAQD,EAAO,MAAM,eAAe,EAE1C,GAAI,CAACC,EACH,MAAM,IAAI,MAAM,iEAAiE,EAGnF,OAAOA,EAAM,CAAC,CAChB,EChEO,IAAMC,EAA2BC,GAA8C,CACpF,GAAM,CAAE,SAAAC,EAAU,OAAAC,CAAO,EAAIF,EAEvBG,EAAKC,EAAgBF,CAAM,EAC3BG,EAAQF,EAAKG,EAAaH,CAAE,EAAID,EAEtC,MAAO,GAAGD,CAAQ,IAAII,CAAK,EAC7B,ECZA,IAAME,EAA2B,IAAI,IAAI,CAAC,kBAAmB,mBAAoB,sBAAsB,CAAC,EAElGC,EAAuBC,GACpBA,aAAiB,OAASF,EAAyB,IAAIE,EAAM,IAAI,EAuB7DC,GAAwBC,GAA4B,CAC/D,GAAIH,EAAoBG,CAAK,EAAG,MAAO,GAEvC,IAAMC,EAASD,GAAkD,MAEjE,OAAOH,EAAoBI,CAAK,CAClC,ECfA,OAAS,YAAAC,MAAgB,qBACzB,OAAS,cAAAC,MAAkB,cAC3B,OAAS,cAAAC,EAAY,gBAAAC,MAAoB,UACzC,OAAOC,MAAU,YACjB,OAAOC,MAAW,aAClB,OAAOC,MAAS,WAChB,OAAS,WAAAC,MAAe,UACxB,OAAS,WAAAC,EAAS,QAAAC,MAAY,YAC9B,OAAOC,MAAa,eACpB,OAAOC,OAAS,WAChB,OAAS,iBAAAC,OAAqB,WAC9B,OAAS,aAAAC,OAAiB,YAI1B,IAAMC,GAAgBC,GAAUC,CAAQ,EAGlCC,GAAcC,GAAuC,CACzD,IAAMC,EAAM,KAAK,MAAMC,EAAaF,EAAa,OAAO,CAAC,EACnDG,EAAM,OAAOF,EAAI,KAAQ,SAAWA,EAAI,IAAMA,EAAI,KAAK,SAE7D,OAAOE,GAAO,MAAQA,IAAQ,GAAK,KAAOA,CAC5C,EAYaC,GAAqB,IAAqB,CACrD,GAAI,CACF,IAAIC,EAAMC,EAAQC,GAAc,YAAY,GAAG,CAAC,EAEhD,OAAS,CACP,IAAMP,EAAcQ,EAAKH,EAAK,eAAgB,WAAY,cAAc,EAExE,GAAII,EAAWT,CAAW,EAAG,CAC3B,IAAMG,EAAMJ,GAAWC,CAAW,EAElC,OAAOG,GAAO,KAAO,KAAOK,EAAKF,EAAQN,CAAW,EAAGG,CAAG,CAC5D,CACA,IAAMO,EAASJ,EAAQD,CAAG,EAE1B,GAAIK,IAAWL,EAAK,OAAO,KAC3BA,EAAMK,CACR,CACF,MAAQ,CACN,OAAO,IACT,CACF,EAGIC,EACEC,EAAc,KACdD,IAAc,SAAWA,EAAYP,GAAmB,GAErDO,GAOHE,GAAa,mBAGbC,GAAsB,QAGtBC,GAAcC,GACXH,GAAW,KAAKG,CAAK,EAAIA,EAAQ,IAAIA,EAAM,WAAW,IAAKF,EAAmB,CAAC,IAuC3EG,GAAwB,CAACC,EAAgBC,IAAkD,CACtG,IAAMC,EAAQ,CAACD,EAAQ,UAAYE,EAAQ,SAAUF,EAAQ,IAAK,GAAGD,CAAI,EAGzE,OAFeC,EAAQ,OAAS,GAAO,QAAU,IAEjCC,EAAM,IAAIL,EAAU,EAAE,KAAK,GAAG,CAChD,EAcMO,GAAqB,KACrBC,EAAmB,KAGnBC,GAAkB,aAGlBC,EAAW,YAQXC,GAAmB,YAEZC,GAAmCC,GACvC,IAAI,QAASC,GAAY,CAC9B,IAAMC,EAASC,EAAI,QAAQ,CAAE,KAAMN,EAAU,KAAAG,CAAK,CAAC,EAC7CI,EAAUC,GAA0B,CACxCH,EAAO,QAAQ,EACfD,EAAQI,CAAM,CAChB,EAEAH,EAAO,WAAWP,CAAgB,EAClCO,EAAO,KAAK,UAAW,IAAM,CAC3BE,EAAO,EAAI,CACb,CAAC,EACDF,EAAO,KAAK,UAAW,IAAM,CAC3BE,EAAO,EAAK,CACd,CAAC,EACDF,EAAO,KAAK,QAAS,IAAM,CACzBE,EAAO,EAAK,CACd,CAAC,CACH,CAAC,EAqBUE,GAAwC,CAACN,EAAMO,IACnD,IAAI,QAASN,GAAY,CAE9B,IAAMO,GADUD,EAAME,EAAM,QAAUC,EAAK,SAEzC,CACE,KAAMb,EACN,KAAAG,EACA,OAAQ,OACR,KAAM,IACN,QAASL,EACT,GAAIY,EAAM,CAAE,mBAAoB,GAAO,WAAYT,EAAiB,EAAI,CAAC,CAC3E,EACCa,GAAQ,CACPA,EAAI,OAAO,EACXV,EAAQU,EAAI,QAAQf,EAAe,IAAM,GAAG,CAC9C,CACF,EAEAY,EAAI,GAAG,QAAS,IAAM,CACpBP,EAAQ,EAAK,CACf,CAAC,EACDO,EAAI,GAAG,UAAW,IAAM,CACtBA,EAAI,QAAQ,EACZP,EAAQ,EAAK,CACf,CAAC,EACDO,EAAI,IAAI,CACV,CAAC,EAGGI,GAA0B,MAAOtB,EAAM,CAAE,UAAAuB,CAAU,IAAM,CAC7D,IAAMC,EAAM9B,EAAY,EAExB,GAAI8B,GAAO,KAAM,MAAM,IAAI,MAAM,8DAA8D,EAC/F,MAAM9C,GAAcyB,EAAQ,SAAU,CAACqB,EAAK,GAAGxB,CAAI,EAAG,CACpD,OAAQ,YAAY,QAAQuB,CAAS,EACrC,SAAU,QACV,IAAKE,EAAyBtB,EAAQ,GAAG,CAC3C,CAAC,CACH,EAUauB,EAAmB,IACvBvB,EAAQ,IAAI,oBAAsBb,EAAKqC,EAAQ,EAAG,WAAW,EAIhEC,GAAe,SAOfC,GAAuB,aAchBC,EAAa,IACjBxC,EAAKoC,EAAiB,EAAGE,EAAY,EAajCG,GAAuB,IAAe,CACjD,GAAI,CACF,IAAMC,EAAWhD,EAAaM,EAAKoC,EAAiB,EAAGG,EAAoB,EAAG,OAAO,EAAE,KAAK,EAE5F,OAAIG,IAAa,GAAW,GAEbC,EAAW,QAAQ,EAAE,OAAOjD,EAAa8C,EAAW,CAAC,CAAC,EAAE,OAAO,KAAK,IAEjEE,EAAS,YAAY,CACzC,MAAQ,CACN,MAAO,EACT,CACF,EAkBaE,GAAsB,CAACxB,EAAcyB,IACzC,IAAI,QAASxB,GAAY,CAC9B,IAAIyB,EAEJ,GAAI,CACFA,EAAKpD,EAAa8C,EAAW,CAAC,CAChC,MAAQ,CACNnB,EAAQ,CAAE,GAAI,GAAO,KAAM,QAAS,CAAC,EAErC,MACF,CAEA,IAAMC,EAASK,GAAI,QAAQ,CAAE,KAAMV,EAAU,KAAAG,EAAM,WAAAyB,EAAY,GAAI,CAACC,CAAE,EAAG,mBAAoB,EAAK,EAAG,IAAM,CAIzG,IAAMC,EAAYzB,EAAO,mBACnB0B,EAAa1B,EAAO,WAE1BA,EAAO,QAAQ,EACfD,EAAQ2B,EAAa,CAAE,GAAI,EAAK,EAAI,CAAE,GAAI,GAAO,KAAMD,GAAW,MAAQA,GAAW,SAAW,SAAU,CAAC,CAC7G,CAAC,EAEDzB,EAAO,WAAWP,CAAgB,EAClCO,EAAO,KAAK,UAAW,IAAM,CAC3BA,EAAO,QAAQ,EACfD,EAAQ,CAAE,GAAI,GAAO,KAAM,WAAY,CAAC,CAC1C,CAAC,EACDC,EAAO,KAAK,QAAU2B,GAA+B,CACnD3B,EAAO,QAAQ,EACfD,EAAQ,CAAE,GAAI,GAAO,KAAM4B,EAAI,MAAQ,SAAU,CAAC,CACpD,CAAC,CACH,CAAC,EAQUC,GAAa,IAAuB,CAC/C,GAAI,CACF,IAAMC,EAAe,KAAK,MAAMzD,EAAaM,EAAKoC,EAAiB,EAAG,aAAa,EAAG,OAAO,CAAC,EAE9F,OAAK,MAAM,QAAQe,CAAG,EAEfA,EAAI,QAASC,GAA2B,CAC7C,GAAM,CAAE,SAAAC,EAAU,KAAAjC,CAAK,EAAKgC,GAAS,CAAC,EAEtC,OAAI,OAAOC,GAAa,UAAYA,IAAa,IAAM,OAAOjC,GAAS,SAAiB,CAAC,EAElF,CAAC,CAAE,KAAMiC,EAAU,KAAAjC,CAAK,CAAC,CAClC,CAAC,EAR+B,CAAC,CASnC,MAAQ,CACN,MAAO,CAAC,CACV,CACF,EA4CakC,GAAuB,CAACC,EAA2B,CAAC,IAAsB,CACrF,IAAMrB,EAAMqB,EAAK,MAAQ,OAAYnD,EAAY,EAAImD,EAAK,IACpDC,EAAMD,EAAK,KAAOvB,GAClByB,EAAcF,EAAK,aAAepC,GAClCuC,EAAiBH,EAAK,gBAAkB7B,GACxCO,EAAYsB,EAAK,WAAazC,GAChC6C,EAA+B,KAG7BC,EAAS,MAAOlD,GAAqC,CACzD,GAAI,CACF,aAAM8C,EAAI9C,EAAM,CAAE,UAAAuB,CAAU,CAAC,EAEtB,EACT,MAAQ,CACN,MAAO,EACT,CACF,EAEM4B,EAAc,UAClBF,IAAiB,MAAMC,EAAO,CAAC,WAAW,CAAC,EAEpCD,GAsBT,MAAO,CACL,QAAS,IACAzB,EAET,YAAA2B,EACA,eAxBc,MAAOzC,EAAcO,IAC/B,CAAE,MAAMkC,EAAY,GAEpB,CAAE,MAAMJ,EAAYrC,CAAI,EAAW,GAEhCsC,EAAetC,EAAMO,CAAG,EAoB/B,cAjBoB,MAAOmC,EAAc1C,IACnC,MAAMyC,EAAY,EAEjBD,EAAO,CAAC,QAASE,EAAM,OAAO1C,CAAI,CAAC,CAAC,EAFR,GAiBnC,YAZkB,MAAO0C,GAAgC,CACnD,MAAMD,EAAY,GACxB,MAAMD,EAAO,CAAC,QAAS,WAAYE,CAAI,CAAC,CAC1C,CAUA,CACF",
-  "names": ["process", "$", "isCmuxAvailable", "$", "openCmuxDevWorkspace", "args", "cwd", "title", "layout", "layoutJson", "output", "process", "parseWorkspaceRef", "closeCmuxDevWorkspace", "ref", "error", "logger", "match", "V_SEMVER_TOKEN_RE", "canonicalizeCmuxTitle", "raw", "$", "closeCmuxWorkspaceByTitle", "title", "listOutput", "$", "ref", "findWorkspaceRefByTitle", "error", "logger", "output", "target", "canonicalizeCmuxTitle", "rawLine", "match", "lineTitle", "$", "listCmuxWorkspaceTitles", "output", "$", "titles", "rawLine", "match", "title", "canonicalizeCmuxTitle", "error", "logger", "$", "openCmuxWorkspaceWithLayout", "args", "cwd", "title", "layout", "resolveCmuxLayout", "getInfraKitConfig", "newWorkspaceOutput", "$", "workspaceRef", "parseWorkspaceRef", "surfacesOutput", "leftTopRef", "parseFirstSurfaceRef", "output", "match", "buildCmuxWorkspaceTitle", "args", "repoName", "branch", "id", "parseBranchName", "label", "displayLabel", "CANCELLATION_ERROR_NAMES", "hasCancellationName", "value", "isPromptCancellation", "error", "cause", "execFile", "createHash", "existsSync", "readFileSync", "http", "https", "net", "homedir", "dirname", "join", "process", "tls", "fileURLToPath", "promisify", "execFileAsync", "promisify", "execFile", "readBinRel", "pkgJsonPath", "pkg", "readFileSync", "rel", "resolvePortlessBin", "dir", "dirname", "fileURLToPath", "join", "existsSync", "parent", "cachedBin", "portlessBin", "SHELL_SAFE", "SINGLE_QUOTE_ESCAPE", "shellQuote", "value", "formatPortlessCommand", "args", "options", "words", "process", "DEFAULT_TIMEOUT_MS", "PROBE_TIMEOUT_MS", "PORTLESS_HEADER", "LOOPBACK", "PROBE_SERVERNAME", "defaultIsListening", "port", "resolve", "socket", "net", "finish", "result", "defaultIsProxyServing", "tls", "req", "https", "http", "res", "defaultRun", "timeoutMs", "bin", "withoutPackageManagerEnv", "portlessStateDir", "homedir", "CA_CERT_FILE", "CA_TRUST_MARKER_FILE", "readCaPath", "caFingerprintMatches", "recorded", "createHash", "handshakeChainsToCa", "servername", "ca", "authError", "authorized", "err", "listRoutes", "raw", "entry", "hostname", "createPortlessDriver", "deps", "run", "isListening", "isProxyServing", "availability", "tryRun", "isAvailable", "name"]
-}

package/dist/dev-wizard-run-5ST3BJ4L.js

@@ -1,2 +0,0 @@
-import{f as W,i as f,l as g}from"./chunk-GZNE5CBQ.js";import{H as v,P as C,u as d,v as y,w as k,x}from"./chunk-IVWPZEMC.js";import{e as w}from"./chunk-CHETBZ6M.js";import _ from"@inquirer/checkbox";import j from"@inquirer/confirm";import I,{Separator as K}from"@inquirer/select";import{loadDev as U}from"@slip-stream-kit/config/internal";import q from"node:path";import m from"node:process";var z=e=>e.split("/")[0],D=e=>new Map(e.apps.map(r=>[r.name,r])),N=e=>e.localCapable&&e.cloudCapable,$=(e,r,a)=>N(r)?a[`${e} ${r.path}`]??(r.cloudCapable?"cloud":"local"):r.localCapable?"local":"cloud",O=(e,r,a)=>{let o=new Set,t=new Map;for(let n of e){let s=r.get(z(n));for(let c of s?.backends??[]){t.set(c.packageName,c.ownerApp);for(let p of c.routes)$(n,p,a)==="local"&&o.add(c.packageName)}}return{localPkgs:o,ownerByPkg:t}},B=(e,r)=>{let a={},o=!1;for(let t of e?.backends??[]){let n=r.has(t.packageName);for(let s of t.routes){let c=s.localCapable&&n?"local":"cloud";a[s.path]=c,c==="cloud"&&(o=!0)}}return{overrides:a,anyCloud:o}},M=(e,r)=>{let a=D(r),o=e.targets.filter(l=>l.endsWith("/ui")),t=e.targets.filter(l=>l.endsWith("/api")),{localPkgs:n,ownerByPkg:s}=O(o,a,e.sources),c={},p=!1;for(let l of o){let{overrides:u,anyCloud:i}=B(a.get(z(l)),n);i&&(p=!0),c[l]=Object.keys(u).length>0?{proxy:u}:{}}for(let l of t)c[l]??={};for(let l of n){let u=s.get(l);u!=null&&(c[`${u}/api`]??={})}return{presetDef:{apps:c,cmux:e.cmux},anyCloudRoute:p,targetKeys:Object.keys(c).sort()}},R=(e,r)=>{let a=[`--target=${e.targetKeys.join(",")}`];return r.watch&&a.push("--watch"),r.cmux&&a.push("--cmux"),{flags:a.join(" ")}};var h={output:m.stderr,clearPromptOnDone:!0},E={select:e=>g(r=>I({message:e.message,choices:e.choices,default:e.default},r),h),checkbox:e=>g(r=>_({message:e.message,choices:e.choices},r),h),confirm:e=>g(r=>j({message:e.message,default:e.default},r),h)},T=(e,r)=>{let a=new Map;for(let[o,t]of Object.entries(e)){let n={path:o,localCapable:t.from.includes("local"),cloudCapable:t.from.includes("cloud"),default:t.default},s=a.get(t.packageName);s?(s.routes.push(n),s.localCapable=s.localCapable||n.localCapable,s.cloudCapable=s.cloudCapable||n.cloudCapable):a.set(t.packageName,{packageName:t.packageName,routes:[n],localCapable:n.localCapable,cloudCapable:n.cloudCapable,ownerApp:r.get(t.packageName)})}return[...a.values()]},V=async e=>{let r=k(e),a=x(e),o=await C(),t=new Map(r.map(i=>[i.packageName,i.name])),n=new Map(r.map(i=>[i.name,i.packageName])),s=new Set(a.map(i=>i.name)),c=new Set(r.map(i=>i.name)),p=[...new Set([...c,...s])].sort(),l=await Promise.all(p.map(async i=>{let P=s.has(i),b=P?(await U(q.join(e,"apps",i,"ui")))?.proxy?.routes:void 0;return{name:i,hasApi:c.has(i),hasUi:P,apiPackage:n.get(i),backends:b?T(b,t):[]}})),u=await W();return{apps:l,presets:Object.keys(o.devServersPresets??{}),environments:Object.keys(u?.envs??{}).sort()}},F=e=>{let r=[];for(let a of e.apps){if(a.hasUi){let o=a.backends.flatMap(n=>n.routes.map(s=>s.path)),t=o.length>0?`frontend \u2014 proxies ${[...o].sort().join(", ")}`:"frontend";r.push({name:`${a.name}/ui`,value:`${a.name}/ui`,description:t})}a.hasApi&&!a.hasUi&&r.push({name:`${a.name}/api`,value:`${a.name}/api`,description:"backend"})}return r},L=e=>{let r={api:e.apps.filter(t=>t.hasApi).map(t=>t.name),ui:e.apps.filter(t=>t.hasUi).map(t=>t.name)},a={},o=new Map;for(let t of e.apps){t.apiPackage!=null&&(a[t.name]=t.apiPackage);for(let n of t.backends)for(let s of n.routes)o.set(`${t.name} ${s.path}`,n.packageName)}return{discovered:r,apiPkgByApp:a,routePkg:(t,n)=>o.get(`${t} ${n}`)}},X=(e,r)=>v({__wizard__:e},L(r)).map(a=>a.message),Z="INFRA_KIT_DEV_WIZARD_CMUX",H=()=>m.env[Z]==="1",G=async(e,r,a)=>{let o=new Map(r.apps.map(n=>[n.name,n])),t={};for(let n of a){let s=o.get(n.split("/")[0]);for(let c of s?.backends??[])for(let p of c.routes){if(!p.localCapable||!p.cloudCapable)continue;let l=await e.select({message:`\u{1F500} ${n} ${p.path} \u2192 local or cloud?`,choices:[{name:"local (this machine)",value:"local"},{name:"cloud",value:"cloud"}],default:p.default??"local"});t[`${n} ${p.path}`]=l}}return t},J=(e,r,a)=>e.apps.find(o=>o.name===r)?.backends.flatMap(o=>o.routes).find(o=>o.path===a),Q=(e,r)=>{let a=[];for(let[o,t]of Object.entries(e.presetDef.apps??{})){if(!o.endsWith("/ui")||!t.proxy)continue;let n=o.split("/")[0];for(let[s,c]of Object.entries(t.proxy)){let p=J(r,n,s),l=p&&p.localCapable&&p.cloudCapable?"":" (only option)";a.push(`  ${o} ${s} \u2192 ${c}${l}`)}}if(a.length!==0){d.info("Resolved routes:");for(let o of[...a].sort())d.info(o)}},S=async(e,r)=>{if(r.apps.length===0)return d.warn("No apps discovered to run."),null;let a=await e.checkbox({message:"\u{1F4E6} Which packages?",choices:F(r)});if(a.length===0)return d.warn("No packages selected."),null;let o=a.filter(i=>i.endsWith("/ui")),t=await G(e,r,o),n=await e.confirm({message:"\u{1F440} Rebuild & restart on save (watch)?",default:!1}),s=H()?await e.confirm({message:"\u{1F9E9} Run each app in its own cmux pane?",default:!1}):!1,c={targets:a,sources:t,watch:n,cmux:s},p=M(c,r);p.anyCloudRoute&&(c.env=await e.select({message:"\u2601\uFE0F  Point cloud routes at which environment?",choices:r.environments.map(i=>({name:i,value:i}))}),m.env[w]=c.env);let l=X(p.presetDef,r);if(l.length>0){d.warn("\u26A0\uFE0F  Proxy audit found issues with this selection:");for(let i of l)d.warn(`   \u2022 ${i}`);return null}Q(p,r),Y(p,c);let u=p.targetKeys.filter(i=>i.endsWith("/api")).map(i=>i.split("/")[0]);return s&&u.length>0?{include:u,presetDef:p.presetDef,watch:n,cmux:!0}:(s&&d.info("\u2139\uFE0F  cmux needs at least one local backend (panes are backend-only) \u2014 running in-process instead."),{presetDef:p.presetDef,watch:n,cmux:!1})},Y=(e,r)=>{f.setInteractive();let a=R(e,r);f.addOption(a.flags,!0),f.print(),d.info("\u2139\uFE0F  Prefer a short name? Save this selection as a devPreset and run `infra-kit dev <name>`.")},ee=async(e,r)=>{let a=await e.confirm({message:"\u{1F440} Rebuild & restart on save (watch)?",default:!1});return f.setInteractive(),f.addOption(r,!0),a&&f.addOption("--watch",!0),f.print(),{preset:r,watch:a,cmux:!1}},A=" manual",re=async(e,r)=>{if(r.presets.length===0)return S(e,r);let a=await e.select({message:"\u{1F680} Start from a preset, or configure manually?",choices:[...r.presets.map(o=>({name:o,value:o})),new K(" "),{name:"Manual (custom)\u2026",value:A}]});return a===A?S(e,r):ee(e,a)},be=async(e=E,r=y(m.cwd()))=>re(e,await V(r));export{A as MANUAL_CHOICE,Z as WIZARD_CMUX_VAR,X as auditManualPlan,E as defaultPrompts,V as gatherWizardModel,be as runDevWizard,re as runWizardFlow};
-//# sourceMappingURL=dev-wizard-run-5ST3BJ4L.js.map

package/dist/dev-wizard-run-5ST3BJ4L.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/dev/dev-wizard-run.ts", "../src/dev/dev-wizard.ts"],
-  "sourcesContent": ["/**\n * Impure driver for the interactive `infra-kit dev` wizard: filesystem/config discovery, the inquirer\n * prompt flow (step-0 preset-or-manual, then the manual matrix), the pre-flight proxy audit, and the\n * `commandEcho` teaching line. The pure answer\u2192plan mapping lives in {@link file://./dev-wizard.ts}.\n *\n * Prompts are behind the injectable {@link WizardPrompts} seam so the flow is testable without a TTY.\n * This module is reached ONLY from the bare-invocation TTY branch of the entry point; every flagged /\n * non-TTY / `--json` / MCP invocation bypasses it entirely.\n */\nimport inquirerCheckbox from '@inquirer/checkbox'\nimport inquirerConfirm from '@inquirer/confirm'\nimport inquirerSelect, { Separator } from '@inquirer/select'\nimport { loadDev } from '@slip-stream-kit/config/internal'\nimport path from 'node:path'\nimport process from 'node:process'\n\nimport { discoverApiApps, discoverUiApps, findMonorepoRoot } from 'src/dev/discovery'\nimport { commandEcho } from 'src/lib/command-echo'\nimport { INFRA_KIT_ENV_VAR } from 'src/lib/constants'\nimport { readTokenStore } from 'src/lib/env-tokens'\nimport { getInfraKitConfig } from 'src/lib/infra-kit-config'\nimport type { DevPreset, ProxySource } from 'src/lib/infra-kit-config'\nimport { logger } from 'src/lib/logger'\nimport { withEscape } from 'src/lib/prompts/escapable-context'\n\nimport { deriveManualPlan, equivalentCommand } from './dev-wizard.js'\nimport type { DerivedPlan, ManualSelection, ProxyBackend, RouteCap, WizardApp, WizardModel } from './dev-wizard.js'\nimport { validatePresetProxy } from './presets.js'\nimport type { DiscoveredParts, PresetProxyContext } from './presets.js'\n\n/** A wizard prompt choice \u2014 all values are strings, so the seam needs no generics. */\nexport interface WizardChoice {\n  name: string\n  value: string\n  description?: string\n  checked?: boolean\n  disabled?: boolean | string\n}\n\n/**\n * Injectable prompt seam (a string-valued subset of `@inquirer/*`). The default implementation\n * ({@link defaultPrompts}) delegates to the real prompts, rendering to stderr so the dev-server's\n * stdout stays clean. Tests pass a scripted object.\n */\nexport interface WizardPrompts {\n  select: (cfg: { message: string; choices: (WizardChoice | Separator)[]; default?: string }) => Promise<string>\n  checkbox: (cfg: { message: string; choices: WizardChoice[] }) => Promise<string[]>\n  confirm: (cfg: { message: string; default?: boolean }) => Promise<boolean>\n}\n\n/**\n * Shared `@inquirer/*` context. Rendered to stderr (mirrors the bare-`infra-kit` command palette).\n *\n * `clearPromptOnDone` erases each answered prompt instead of leaving a `\u2714 <question> <answer>` line\n * behind, so the wizard collapses to nothing once it finishes and the dev-server's ready header lands\n * at the top of a clean screen. The choices are not lost: {@link echoManual} / {@link runPresetBranch}\n * print the equivalent flag command, which is the durable record of what was picked.\n */\nconst promptContext = { output: process.stderr, clearPromptOnDone: true }\n\n/**\n * Real `@inquirer/*` prompts, rendered to stderr and erased once answered.\n *\n * Every one goes through {@link withEscape}, which binds Esc to cancellation. The wrap is here rather\n * than around the {@link WizardPrompts} seam so the scripted prompts the tests inject stay untouched:\n * the seam is the test boundary, `defaultPrompts` is the only implementation that talks to a terminal.\n *\n * Esc rejects with an `AbortPromptError`, which `entry/cli.ts` catches as a cancellation \u2192 exit 0. The\n * wizard therefore needs no cancel branch of its own: a cancelled prompt never returns here at all, so\n * no server is started.\n */\nexport const defaultPrompts: WizardPrompts = {\n  select: (cfg) => {\n    return withEscape((context) => {\n      return inquirerSelect({ message: cfg.message, choices: cfg.choices, default: cfg.default }, context)\n    }, promptContext)\n  },\n  checkbox: (cfg) => {\n    return withEscape((context) => {\n      return inquirerCheckbox({ message: cfg.message, choices: cfg.choices }, context)\n    }, promptContext)\n  },\n  confirm: (cfg) => {\n    return withEscape((context) => {\n      return inquirerConfirm({ message: cfg.message, default: cfg.default }, context)\n    }, promptContext)\n  },\n}\n\n/** What the wizard hands back to the entry point (merged into `DevServerOptions`), or null on cancel. */\nexport interface WizardResult {\n  /** Named preset (preset branch) \u2014 passed through as `options.preset`. */\n  preset?: string\n  /** In-memory preset (manual branch, non-cmux) \u2014 passed through as `options.presetDef`. */\n  presetDef?: DevPreset\n  /**\n   * App-name include list for the cmux path only: which discovered API apps get a pane. Paired with\n   * `presetDef`, which tells each pane the exact parts to run. An app selected UI-only gets no pane\n   * (cmux panes are opened per API app). Unset for the non-cmux manual path.\n   */\n  include?: string[]\n  watch: boolean\n  cmux: boolean\n}\n\n/** Group one frontend's `dev.proxy.routes` into {@link ProxyBackend}s keyed by backend package. */\nconst groupBackends = (\n  routes: Record<string, { packageName: string; from: readonly string[]; default?: 'local' | 'cloud' }>,\n  ownerByPkg: Map<string, string>,\n): ProxyBackend[] => {\n  const byPkg = new Map<string, ProxyBackend>()\n\n  for (const [route, def] of Object.entries(routes)) {\n    const cap: RouteCap = {\n      path: route,\n      localCapable: def.from.includes('local'),\n      cloudCapable: def.from.includes('cloud'),\n      default: def.default,\n    }\n    const existing = byPkg.get(def.packageName)\n\n    if (existing) {\n      existing.routes.push(cap)\n      existing.localCapable = existing.localCapable || cap.localCapable\n      existing.cloudCapable = existing.cloudCapable || cap.cloudCapable\n    } else {\n      byPkg.set(def.packageName, {\n        packageName: def.packageName,\n        routes: [cap],\n        localCapable: cap.localCapable,\n        cloudCapable: cap.cloudCapable,\n        ownerApp: ownerByPkg.get(def.packageName),\n      })\n    }\n  }\n\n  return [...byPkg.values()]\n}\n\n/** Discover apps + configs and assemble the {@link WizardModel} (backends resolved per frontend). */\nexport const gatherWizardModel = async (root: string): Promise<WizardModel> => {\n  const apiApps = discoverApiApps(root)\n  const uiApps = discoverUiApps(root)\n  const config = await getInfraKitConfig()\n\n  const ownerByPkg = new Map(\n    apiApps.map((a) => {\n      return [a.packageName, a.name] as const\n    }),\n  )\n  const apiPkgByName = new Map(\n    apiApps.map((a) => {\n      return [a.name, a.packageName] as const\n    }),\n  )\n  const uiNames = new Set(\n    uiApps.map((a) => {\n      return a.name\n    }),\n  )\n  const apiNames = new Set(\n    apiApps.map((a) => {\n      return a.name\n    }),\n  )\n  const allNames = [...new Set([...apiNames, ...uiNames])].sort()\n\n  const apps: WizardApp[] = await Promise.all(\n    allNames.map(async (name): Promise<WizardApp> => {\n      const hasUi = uiNames.has(name)\n      const routes = hasUi ? (await loadDev(path.join(root, 'apps', name, 'ui')))?.proxy?.routes : undefined\n\n      return {\n        name,\n        hasApi: apiNames.has(name),\n        hasUi,\n        apiPackage: apiPkgByName.get(name),\n        backends: routes ? groupBackends(routes, ownerByPkg) : [],\n      }\n    }),\n  )\n\n  // The cloud-env choices are the envs we hold a token for \u2014 the same authority as `env-load`, because\n  // it is the same question. This picker writes INFRA_KIT_ENV, which `@slip-stream-kit/config/vite`\n  // reads to build the cloud backend's URL, and whose only other writer is `env-load` (which cannot run\n  // without a Doppler token). Sourcing it from the workflow options instead would put `prod` in the list\n  // for everyone \u2014 including a developer holding no prod credential \u2014 and point a local UI at\n  // production. No token, no entry.\n  const store = await readTokenStore()\n\n  return {\n    apps,\n    presets: Object.keys(config.devServersPresets ?? {}),\n    environments: Object.keys(store?.envs ?? {}).sort(),\n  }\n}\n\n/**\n * Build the checkbox choices: one `<app>/ui` per frontend, plus `<app>/api` ONLY for api-only apps\n * (an api with no ui). A full-stack `<app>/api` is deliberately NOT offered \u2014 a full-stack backend is\n * launched by choosing `local` for one of its frontend's routes (asked per-route afterwards), so the\n * checkbox stays a pick of frontends + standalone backends.\n *\n * Nothing starts checked: the manual branch is opt-in, so a run only ever launches what was explicitly\n * ticked. Pre-checking every part would make the fast path (accept the defaults) boot the whole monorepo\n * \u2014 the exact opposite of why someone reached for \"Manual\" over a preset.\n */\nconst buildPartChoices = (model: WizardModel): WizardChoice[] => {\n  const choices: WizardChoice[] = []\n\n  for (const app of model.apps) {\n    if (app.hasUi) {\n      const paths = app.backends.flatMap((b) => {\n        return b.routes.map((r) => {\n          return r.path\n        })\n      })\n      const description = paths.length > 0 ? `frontend \u2014 proxies ${[...paths].sort().join(', ')}` : 'frontend'\n\n      choices.push({ name: `${app.name}/ui`, value: `${app.name}/ui`, description })\n    }\n    if (app.hasApi && !app.hasUi) {\n      choices.push({ name: `${app.name}/api`, value: `${app.name}/api`, description: 'backend' })\n    }\n  }\n\n  return choices\n}\n\n/** Build the audit context from the gathered model (no re-reading of configs). */\nconst buildAuditContext = (model: WizardModel): PresetProxyContext => {\n  const discovered: DiscoveredParts = {\n    api: model.apps\n      .filter((a) => {\n        return a.hasApi\n      })\n      .map((a) => {\n        return a.name\n      }),\n    ui: model.apps\n      .filter((a) => {\n        return a.hasUi\n      })\n      .map((a) => {\n        return a.name\n      }),\n  }\n  const apiPkgByApp: Record<string, string> = {}\n  const routeToPkg = new Map<string, string>()\n\n  for (const app of model.apps) {\n    // Map EVERY discovered api app to its own api package \u2014 including api-only apps a frontend proxies\n    // to cross-app \u2014 so `launchedPkgs` in validatePresetProxy is faithful (mirrors preset-proxy-check.ts).\n    // Deriving this from proxy backends alone would miss api-only owners and false-positive the audit.\n    if (app.apiPackage != null) apiPkgByApp[app.name] = app.apiPackage\n    for (const b of app.backends) {\n      for (const route of b.routes) {\n        routeToPkg.set(`${app.name} ${route.path}`, b.packageName)\n      }\n    }\n  }\n\n  return {\n    discovered,\n    apiPkgByApp,\n    routePkg: (app, route) => {\n      return routeToPkg.get(`${app} ${route}`)\n    },\n  }\n}\n\n/**\n * Run the assembled plan through the SAME proxy-locality rule the root audit uses. Returns issue\n * messages (empty when clean). Catches a `local` override whose backend won't launch \u2014 the wizard's\n * derivation launches owners, so a hit means the backend has no discoverable owning app.\n */\nexport const auditManualPlan = (presetDef: DevPreset, model: WizardModel): string[] => {\n  return validatePresetProxy({ __wizard__: presetDef }, buildAuditContext(model)).map((i) => {\n    return i.message\n  })\n}\n\n/**\n * Opt back into the cmux question: set to exactly `'1'`. The prompt is temporarily off \u2014 the manual\n * branch always runs in-process \u2014 but the derivation below is kept whole for when it returns. `--cmux`\n * on the command line is a separate path and stays live either way.\n */\nexport const WIZARD_CMUX_VAR = 'INFRA_KIT_DEV_WIZARD_CMUX'\n\nconst asksCmux = (): boolean => {\n  return process.env[WIZARD_CMUX_VAR] === '1'\n}\n\n/**\n * Ask, per selected frontend, an EXPLICIT local/cloud choice for every TWO-OPTION route (its `from`\n * lists both). Single-option routes are auto-picked in the pure mapping, so they are never prompted.\n * The answers are keyed `${app}/ui ${routePath}` to match {@link ManualSelection.sources}; the select's\n * default seeds from the route's declared `default` when it has one.\n */\nconst promptRouteSources = async (\n  prompts: WizardPrompts,\n  model: WizardModel,\n  uiKeys: string[],\n): Promise<Record<string, ProxySource>> => {\n  const apps = new Map(\n    model.apps.map((a) => {\n      return [a.name, a] as const\n    }),\n  )\n  const sources: Record<string, ProxySource> = {}\n\n  for (const key of uiKeys) {\n    const app = apps.get(key.split('/')[0]!)\n\n    for (const backend of app?.backends ?? []) {\n      for (const route of backend.routes) {\n        if (!route.localCapable || !route.cloudCapable) continue\n\n        const answer = await prompts.select({\n          message: `\uD83D\uDD00 ${key} ${route.path} \u2192 local or cloud?`,\n          choices: [\n            { name: 'local (this machine)', value: 'local' },\n            { name: 'cloud', value: 'cloud' },\n          ],\n          default: route.default ?? 'local',\n        })\n\n        sources[`${key} ${route.path}`] = answer as ProxySource\n      }\n    }\n  }\n\n  return sources\n}\n\n/** Look up a frontend route's capability in the model (for the recap's \"only option\" annotation). */\nconst findRouteCap = (model: WizardModel, app: string, routePath: string): RouteCap | undefined => {\n  return model.apps\n    .find((a) => {\n      return a.name === app\n    })\n    ?.backends.flatMap((b) => {\n      return b.routes\n    })\n    .find((r) => {\n      return r.path === routePath\n    })\n}\n\n/**\n * Print a one-line-per-route recap of what each frontend route resolved to, so the chosen sources are\n * visible before launch. A single-option route is annotated `(only option)` \u2014 it was auto-picked, not\n * asked. This is in addition to {@link echoManual}'s pasteable `--target` command.\n */\nconst recapSources = (plan: DerivedPlan, model: WizardModel): void => {\n  const lines: string[] = []\n\n  for (const [key, cfg] of Object.entries(plan.presetDef.apps ?? {})) {\n    if (!key.endsWith('/ui') || !cfg.proxy) continue\n\n    const app = key.split('/')[0]!\n\n    for (const [routePath, source] of Object.entries(cfg.proxy)) {\n      const cap = findRouteCap(model, app, routePath)\n      const suffix = cap && cap.localCapable && cap.cloudCapable ? '' : ' (only option)'\n\n      lines.push(`  ${key} ${routePath} \u2192 ${source}${suffix}`)\n    }\n  }\n\n  if (lines.length === 0) return\n  logger.info('Resolved routes:')\n  for (const line of [...lines].sort()) {\n    logger.info(line)\n  }\n}\n\n/** The manual-branch flow: frontends + per-route source + env + watch + cmux \u2192 audited plan \u2192 recap \u2192 echo. */\nconst runManualBranch = async (prompts: WizardPrompts, model: WizardModel): Promise<WizardResult | null> => {\n  if (model.apps.length === 0) {\n    logger.warn('No apps discovered to run.')\n\n    return null\n  }\n\n  const selectedTargets = await prompts.checkbox({ message: '\uD83D\uDCE6 Which packages?', choices: buildPartChoices(model) })\n\n  if (selectedTargets.length === 0) {\n    logger.warn('No packages selected.')\n\n    return null\n  }\n\n  const uiKeys = selectedTargets.filter((t) => {\n    return t.endsWith('/ui')\n  })\n  const sources = await promptRouteSources(prompts, model, uiKeys)\n\n  const watch = await prompts.confirm({ message: '\uD83D\uDC40 Rebuild & restart on save (watch)?', default: false })\n  const cmux = asksCmux()\n    ? await prompts.confirm({ message: '\uD83E\uDDE9 Run each app in its own cmux pane?', default: false })\n    : false\n\n  const selection: ManualSelection = { targets: selectedTargets, sources, watch, cmux }\n  const plan = deriveManualPlan(selection, model)\n\n  if (plan.anyCloudRoute) {\n    selection.env = await prompts.select({\n      message: '\u2601\uFE0F  Point cloud routes at which environment?',\n      choices: model.environments.map((e) => {\n        return { name: e, value: e }\n      }),\n    })\n    process.env[INFRA_KIT_ENV_VAR] = selection.env\n  }\n\n  const issues = auditManualPlan(plan.presetDef, model)\n\n  if (issues.length > 0) {\n    logger.warn('\u26A0\uFE0F  Proxy audit found issues with this selection:')\n    for (const issue of issues) {\n      logger.warn(`   \u2022 ${issue}`)\n    }\n\n    return null\n  }\n\n  recapSources(plan, model)\n  echoManual(plan, selection)\n\n  // cmux opens one pane per selected API app. `include` picks WHICH apps get a pane; `presetDef` tells\n  // each pane exactly which of its parts to run. Without the latter a pane runs `--app=<name>`, which\n  // expands to every part the app has \u2014 silently starting a UI the user just unticked.\n  const apiApps = plan.targetKeys\n    .filter((k) => {\n      return k.endsWith('/api')\n    })\n    .map((k) => {\n      return k.split('/')[0]!\n    })\n\n  // An empty include would collapse to `null` in `normalizeAppInclude` and make cmux run EVERY api app,\n  // so a cmux run with no selected backends (e.g. an all-frontend selection) falls back to in-process.\n  if (cmux && apiApps.length > 0) {\n    return { include: apiApps, presetDef: plan.presetDef, watch, cmux: true }\n  }\n\n  if (cmux) {\n    logger.info('\u2139\uFE0F  cmux needs at least one local backend (panes are backend-only) \u2014 running in-process instead.')\n  }\n\n  return { presetDef: plan.presetDef, watch, cmux: false }\n}\n\n/** Print the equivalent (`--target=\u2026`) flag command, plus a save-as-preset ergonomics hint. */\nconst echoManual = (plan: DerivedPlan, selection: ManualSelection): void => {\n  commandEcho.setInteractive()\n\n  const eq = equivalentCommand(plan, selection)\n\n  commandEcho.addOption(eq.flags, true)\n  commandEcho.print()\n\n  // The `--target=\u2026` line reproduces the selection exactly; the preset is pure convenience \u2014 a short,\n  // memorable name instead of retyping the target keys.\n  logger.info('\u2139\uFE0F  Prefer a short name? Save this selection as a devPreset and run `infra-kit dev <name>`.')\n}\n\n/** The preset-branch flow: run a named preset, asking only whether to watch (presets can't encode it). */\nconst runPresetBranch = async (prompts: WizardPrompts, preset: string): Promise<WizardResult> => {\n  const watch = await prompts.confirm({ message: '\uD83D\uDC40 Rebuild & restart on save (watch)?', default: false })\n\n  commandEcho.setInteractive()\n  commandEcho.addOption(preset, true)\n  if (watch) commandEcho.addOption('--watch', true)\n  commandEcho.print()\n\n  return { preset, watch, cmux: false }\n}\n\n/** Sentinel value for the \"Manual (custom)\" step-0 choice (a preset name can never be empty). */\nexport const MANUAL_CHOICE = ' manual'\n\n/**\n * Drive the wizard's branch flow over an ALREADY-gathered model (no disk/config access). Split from\n * {@link runDevWizard} so the flow is unit-testable with scripted prompts + a fixture model.\n */\nexport const runWizardFlow = async (prompts: WizardPrompts, model: WizardModel): Promise<WizardResult | null> => {\n  if (model.presets.length === 0) {\n    return runManualBranch(prompts, model)\n  }\n\n  const choice = await prompts.select({\n    message: '\uD83D\uDE80 Start from a preset, or configure manually?',\n    choices: [\n      ...model.presets.map((p) => {\n        return { name: p, value: p }\n      }),\n      new Separator(' '),\n      { name: 'Manual (custom)\u2026', value: MANUAL_CHOICE },\n    ],\n  })\n\n  return choice === MANUAL_CHOICE ? runManualBranch(prompts, model) : runPresetBranch(prompts, choice)\n}\n\n/**\n * Gather the model from disk/config, then drive the wizard flow, returning the resolved run options (or\n * null on cancel / empty selection). The entry point calls this on a bare TTY `infra-kit dev`.\n */\nexport const runDevWizard = async (\n  prompts: WizardPrompts = defaultPrompts,\n  root: string = findMonorepoRoot(process.cwd()),\n): Promise<WizardResult | null> => {\n  return runWizardFlow(prompts, await gatherWizardModel(root))\n}\n", "/**\n * Pure core of the interactive `infra-kit dev` wizard (the no-args, TTY path).\n *\n * The wizard is FRONTEND-CENTRIC: you pick which frontends to run, and for each frontend you choose,\n * every proxy route that has TWO real options (its `from` lists both `local` and `cloud`) is decided\n * EXPLICITLY \u2014 local (its backend is launched \u2192 the route resolves local) or cloud (the route proxies\n * to the `<env>` cloud target). Single-option routes are auto-picked. Because a backend runs local OR\n * cloud as a whole, routes that share one backend package RECONCILE: if any of them resolved local, the\n * backend runs local and all its local-capable routes follow. This module turns those answers into an\n * in-memory {@link DevPreset} the runner consumes verbatim (part-level targets the app-name-only `--app`\n * include cannot express) \u2014 and is side-effect-free so the mapping is fully unit-testable. The impure\n * I/O (discovery, inquirer prompts, audit, launch) lives in {@link file://./dev-wizard-run.ts}.\n */\nimport type { DevPreset, ProxySource } from 'src/lib/infra-kit-config'\n\n/**\n * One proxy route's per-route capability, carried through grouping so the wizard can decide whether it\n * even needs to ask about the route (only a `local`+`cloud` route is a real choice).\n */\nexport interface RouteCap {\n  /** Route path (e.g. `/api`). */\n  path: string\n  /** `from` includes `local` \u2014 the route can resolve to a locally-launched backend. */\n  localCapable: boolean\n  /** `from` includes `cloud` \u2014 the route can resolve to the cloud target. */\n  cloudCapable: boolean\n  /** The route's declared `default` source when it has one (present iff `from` lists >1 source) \u2014 seeds the prompt's default. */\n  default?: ProxySource\n}\n\n/**\n * One backend a frontend's proxy routes can be pointed at, grouped by the backend package. A frontend\n * that maps `/api` and `/media` to the same package yields ONE {@link ProxyBackend} with both routes \u2014\n * launching the package flips every one of its `local`-capable routes together (the reconcile in\n * {@link deriveManualPlan}).\n */\nexport interface ProxyBackend {\n  /** Backend package name (a route's `packageName`). */\n  packageName: string\n  /** The routes that resolve to this package, each with its own local/cloud capability. */\n  routes: RouteCap[]\n  /** True when at least one of `routes` lists `local` in its `from` capabilities \u2014 i.e. it is launchable-local. */\n  localCapable: boolean\n  /** True when at least one of `routes` lists `cloud` \u2014 i.e. it can stay on the cloud target. */\n  cloudCapable: boolean\n  /** App folder whose `api` package is {@link packageName}, or undefined when no discovered app owns it (a `local` choice then has nothing to launch \u2014 the audit flags it). */\n  ownerApp?: string\n}\n\n/** A discovered app as the wizard sees it: which parts exist + which backends its frontend proxies to. */\nexport interface WizardApp {\n  /** App folder name (e.g. `client`). */\n  name: string\n  /** Has `apps/<app>/api` (a launchable backend). */\n  hasApi: boolean\n  /** Has `apps/<app>/ui` (a launchable frontend). */\n  hasUi: boolean\n  /**\n   * This app's OWN `api` package name (from `apps/<app>/api`), or undefined when it has no api. Carried\n   * so the audit can build a faithful `app \u2192 apiPackage` map for EVERY discovered api app \u2014 including\n   * api-only apps a frontend proxies to cross-app \u2014 mirroring the root audit (`preset-proxy-check.ts`).\n   */\n  apiPackage?: string\n  /** Backends this app's frontend proxies to (empty for api-only apps or a frontend with no `dev.proxy`). */\n  backends: ProxyBackend[]\n}\n\n/** Everything the wizard needs, gathered impurely by {@link file://./dev-wizard-run.ts}. */\nexport interface WizardModel {\n  /** All discovered apps (api and/or ui), sorted by name. */\n  apps: WizardApp[]\n  /** `devServersPresets` names (drives the preset-or-manual step-0). */\n  presets: string[]\n  /** Configured `environments` (the cloud-env `select` options). */\n  environments: string[]\n}\n\n/** The manual-branch answers collected from the prompts, fed to {@link deriveManualPlan}. */\nexport interface ManualSelection {\n  /**\n   * The target keys the user ticked directly: every selected `<app>/ui` frontend, plus any api-only\n   * `<app>/api` backend (apps with an api but no ui). A full-stack backend is NOT ticked here \u2014 it is\n   * launched by choosing `local` for one of its frontend's routes (recorded in {@link sources}).\n   */\n  targets: string[]\n  /**\n   * Explicit per-route choice for every TWO-OPTION route, keyed `${app}/ui ${routePath}` (e.g.\n   * `client/ui /api`). Single-option routes are absent (auto-picked). Missing two-option answers fall\n   * back to the route's cloud/local capability in {@link deriveManualPlan}.\n   */\n  sources: Record<string, ProxySource>\n  /** Chosen cloud env for cloud routes (undefined when nothing resolves cloud). */\n  env?: string\n  /** Rebuild + restart on save. */\n  watch: boolean\n  /** One cmux pane per app. */\n  cmux: boolean\n}\n\n/** The resolved run plan derived from a {@link ManualSelection}. */\nexport interface DerivedPlan {\n  /** In-memory preset handed to the runner (`options.presetDef`). */\n  presetDef: DevPreset\n  /** At least one route resolves to cloud \u2192 an env must be chosen (pre-flight gate). */\n  anyCloudRoute: boolean\n  /** Resolved `<app>/<part>` target keys, sorted \u2014 for the echo + audit display. */\n  targetKeys: string[]\n}\n\n/** App folder name from an `<app>/<part>` target key. */\nconst appOf = (key: string): string => {\n  return key.split('/')[0]!\n}\n\n/** Index a model's apps by folder name for O(1) lookup. */\nconst byName = (model: WizardModel): Map<string, WizardApp> => {\n  return new Map(\n    model.apps.map((a) => {\n      return [a.name, a]\n    }),\n  )\n}\n\n/** Is this route a real choice (both local and cloud reachable)? */\nconst isTwoOption = (route: RouteCap): boolean => {\n  return route.localCapable && route.cloudCapable\n}\n\n/**\n * The source a single route resolves to BEFORE per-backend reconciliation:\n *  - two-option: the user's recorded answer, else 'cloud' when cloud-capable else 'local';\n *  - single local-only: always 'local';\n *  - single cloud-only: always 'cloud'.\n */\nconst rawSource = (uiKey: string, route: RouteCap, sources: Record<string, ProxySource>): ProxySource => {\n  if (isTwoOption(route)) {\n    return sources[`${uiKey} ${route.path}`] ?? (route.cloudCapable ? 'cloud' : 'local')\n  }\n\n  return route.localCapable ? 'local' : 'cloud'\n}\n\n/**\n * Pass 1: which backend packages resolve local (any of their routes did), plus each package's owner app.\n * A package's local verdict is shared across every frontend that proxies to it \u2014 that is the reconcile.\n */\nconst collectLocalPackages = (\n  uiKeys: string[],\n  apps: Map<string, WizardApp>,\n  sources: Record<string, ProxySource>,\n): { localPkgs: Set<string>; ownerByPkg: Map<string, string | undefined> } => {\n  const localPkgs = new Set<string>()\n  const ownerByPkg = new Map<string, string | undefined>()\n\n  for (const key of uiKeys) {\n    const app = apps.get(appOf(key))\n\n    for (const backend of app?.backends ?? []) {\n      ownerByPkg.set(backend.packageName, backend.ownerApp)\n      for (const route of backend.routes) {\n        if (rawSource(key, route, sources) === 'local') localPkgs.add(backend.packageName)\n      }\n    }\n  }\n\n  return { localPkgs, ownerByPkg }\n}\n\n/**\n * Pass 2 for ONE frontend: its per-route overrides after the per-package verdict, and whether any route\n * went cloud. A local-capable route on a local package is `local` (reconciled up); everything else `cloud`.\n */\nconst frontendOverrides = (\n  app: WizardApp | undefined,\n  localPkgs: ReadonlySet<string>,\n): { overrides: Record<string, ProxySource>; anyCloud: boolean } => {\n  const overrides: Record<string, ProxySource> = {}\n  let anyCloud = false\n\n  for (const backend of app?.backends ?? []) {\n    const backendLocal = localPkgs.has(backend.packageName)\n\n    for (const route of backend.routes) {\n      const source: ProxySource = route.localCapable && backendLocal ? 'local' : 'cloud'\n\n      overrides[route.path] = source\n      if (source === 'cloud') anyCloud = true\n    }\n  }\n\n  return { overrides, anyCloud }\n}\n\n/**\n * Turn the manual {@link ManualSelection} into an in-memory {@link DevPreset}. The frontend checkbox picks\n * which UIs (and standalone api-only backends) to run; the per-route answers in {@link ManualSelection.sources}\n * decide each two-option route. Resolution is two passes so same-backend routes stay coherent:\n *\n *  1. Resolve every route of every selected frontend to its raw source; a package is LOCAL iff any of its\n *     routes resolved local.\n *  2. Re-resolve each route against that per-package verdict: a local-capable route on a local package is\n *     `local` (reconciled up even if it was individually answered cloud); a cloud-only route stays `cloud`.\n *\n * Launched backends are the ticked api-only parts \u222A every package that resolved local (added as\n * `${ownerApp}/api` when the owner is discoverable \u2014 a local override on an owner-less package is still\n * emitted, and the audit flags it).\n *\n * @example\n * // client frontend, its /api answered local \u2192 launches client/api + client/ui, /api resolves local:\n * deriveManualPlan(\n *   { targets: ['client/ui'], sources: { 'client/ui /api': 'local' }, watch: false, cmux: false },\n *   { apps: [{ name: 'client', hasApi: true, hasUi: true,\n *              backends: [{ packageName: 'client-api', cloudCapable: true, localCapable: true,\n *                           routes: [{ path: '/api', localCapable: true, cloudCapable: true }],\n *                           ownerApp: 'client' }] }],\n *     presets: [], environments: ['dev'] },\n * ).targetKeys // => ['client/api', 'client/ui']\n */\nexport const deriveManualPlan = (selection: ManualSelection, model: WizardModel): DerivedPlan => {\n  const apps = byName(model)\n  const uiKeys = selection.targets.filter((t) => {\n    return t.endsWith('/ui')\n  })\n  const apiOnlyKeys = selection.targets.filter((t) => {\n    return t.endsWith('/api')\n  })\n\n  // Pass 1: a package is local iff any of its routes (across every selected frontend) resolved local.\n  const { localPkgs, ownerByPkg } = collectLocalPackages(uiKeys, apps, selection.sources)\n\n  // Pass 2: re-resolve each route against the per-package verdict + build per-frontend overrides.\n  const presetApps: Record<string, { proxy?: Record<string, ProxySource> }> = {}\n  let anyCloud = false\n\n  for (const key of uiKeys) {\n    const { overrides, anyCloud: cloud } = frontendOverrides(apps.get(appOf(key)), localPkgs)\n\n    if (cloud) anyCloud = true\n    presetApps[key] = Object.keys(overrides).length > 0 ? { proxy: overrides } : {}\n  }\n\n  // Launch: the ticked api-only backends, plus every package that resolved local (via its owner app).\n  for (const key of apiOnlyKeys) {\n    presetApps[key] ??= {}\n  }\n  for (const pkg of localPkgs) {\n    const owner = ownerByPkg.get(pkg)\n\n    if (owner != null) presetApps[`${owner}/api`] ??= {}\n  }\n\n  return {\n    presetDef: { apps: presetApps, cmux: selection.cmux },\n    anyCloudRoute: anyCloud,\n    targetKeys: Object.keys(presetApps).sort(),\n  }\n}\n\n/** The equivalent non-interactive command for a derived plan. */\nexport interface EquivalentCommand {\n  /** The `--target=<app>/<part>,\u2026`-form flag string (no leading `infra-kit dev`). */\n  flags: string\n}\n\n/**\n * Build the equivalent `infra-kit dev --target=\u2026 [--watch] [--cmux]` flag string for a derived plan.\n * Always exact: `--target` names packages at `<app>/<part>` granularity \u2014 the same grammar the plan's\n * `targetKeys` already use \u2014 so every wizard selection, whole-app or part-level, round-trips into a\n * pasteable command. (`--app` is deliberately NOT used here: its app-name granularity over-launches a\n * part-level pick \u2014 `--app=client` starts `client/api` even when only `client/ui` was ticked.)\n */\nexport const equivalentCommand = (plan: DerivedPlan, selection: ManualSelection): EquivalentCommand => {\n  const parts = [`--target=${plan.targetKeys.join(',')}`]\n\n  if (selection.watch) parts.push('--watch')\n  if (selection.cmux) parts.push('--cmux')\n\n  return { flags: parts.join(' ') }\n}\n"],
-  "mappings": "oKASA,OAAOA,MAAsB,qBAC7B,OAAOC,MAAqB,oBAC5B,OAAOC,GAAkB,aAAAC,MAAiB,mBAC1C,OAAS,WAAAC,MAAe,mCACxB,OAAOC,MAAU,YACjB,OAAOC,MAAa,eCgGpB,IAAMC,EAASC,GACNA,EAAI,MAAM,GAAG,EAAE,CAAC,EAInBC,EAAUC,GACP,IAAI,IACTA,EAAM,KAAK,IAAKC,GACP,CAACA,EAAE,KAAMA,CAAC,CAClB,CACH,EAIIC,EAAeC,GACZA,EAAM,cAAgBA,EAAM,aAS/BC,EAAY,CAACC,EAAeF,EAAiBG,IAC7CJ,EAAYC,CAAK,EACZG,EAAQ,GAAGD,CAAK,IAAIF,EAAM,IAAI,EAAE,IAAMA,EAAM,aAAe,QAAU,SAGvEA,EAAM,aAAe,QAAU,QAOlCI,EAAuB,CAC3BC,EACAC,EACAH,IAC4E,CAC5E,IAAMI,EAAY,IAAI,IAChBC,EAAa,IAAI,IAEvB,QAAWb,KAAOU,EAAQ,CACxB,IAAMI,EAAMH,EAAK,IAAIZ,EAAMC,CAAG,CAAC,EAE/B,QAAWe,KAAWD,GAAK,UAAY,CAAC,EAAG,CACzCD,EAAW,IAAIE,EAAQ,YAAaA,EAAQ,QAAQ,EACpD,QAAWV,KAASU,EAAQ,OACtBT,EAAUN,EAAKK,EAAOG,CAAO,IAAM,SAASI,EAAU,IAAIG,EAAQ,WAAW,CAErF,CACF,CAEA,MAAO,CAAE,UAAAH,EAAW,WAAAC,CAAW,CACjC,EAMMG,EAAoB,CACxBF,EACAF,IACkE,CAClE,IAAMK,EAAyC,CAAC,EAC5CC,EAAW,GAEf,QAAWH,KAAWD,GAAK,UAAY,CAAC,EAAG,CACzC,IAAMK,EAAeP,EAAU,IAAIG,EAAQ,WAAW,EAEtD,QAAWV,KAASU,EAAQ,OAAQ,CAClC,IAAMK,EAAsBf,EAAM,cAAgBc,EAAe,QAAU,QAE3EF,EAAUZ,EAAM,IAAI,EAAIe,EACpBA,IAAW,UAASF,EAAW,GACrC,CACF,CAEA,MAAO,CAAE,UAAAD,EAAW,SAAAC,CAAS,CAC/B,EA2BaG,EAAmB,CAACC,EAA4BpB,IAAoC,CAC/F,IAAMS,EAAOV,EAAOC,CAAK,EACnBQ,EAASY,EAAU,QAAQ,OAAQC,GAChCA,EAAE,SAAS,KAAK,CACxB,EACKC,EAAcF,EAAU,QAAQ,OAAQC,GACrCA,EAAE,SAAS,MAAM,CACzB,EAGK,CAAE,UAAAX,EAAW,WAAAC,CAAW,EAAIJ,EAAqBC,EAAQC,EAAMW,EAAU,OAAO,EAGhFG,EAAsE,CAAC,EACzEP,EAAW,GAEf,QAAWlB,KAAOU,EAAQ,CACxB,GAAM,CAAE,UAAAO,EAAW,SAAUS,CAAM,EAAIV,EAAkBL,EAAK,IAAIZ,EAAMC,CAAG,CAAC,EAAGY,CAAS,EAEpFc,IAAOR,EAAW,IACtBO,EAAWzB,CAAG,EAAI,OAAO,KAAKiB,CAAS,EAAE,OAAS,EAAI,CAAE,MAAOA,CAAU,EAAI,CAAC,CAChF,CAGA,QAAWjB,KAAOwB,EAChBC,EAAWzB,CAAG,IAAM,CAAC,EAEvB,QAAW2B,KAAOf,EAAW,CAC3B,IAAMgB,EAAQf,EAAW,IAAIc,CAAG,EAE5BC,GAAS,OAAMH,EAAW,GAAGG,CAAK,MAAM,IAAM,CAAC,EACrD,CAEA,MAAO,CACL,UAAW,CAAE,KAAMH,EAAY,KAAMH,EAAU,IAAK,EACpD,cAAeJ,EACf,WAAY,OAAO,KAAKO,CAAU,EAAE,KAAK,CAC3C,CACF,EAeaI,EAAoB,CAACC,EAAmBR,IAAkD,CACrG,IAAMS,EAAQ,CAAC,YAAYD,EAAK,WAAW,KAAK,GAAG,CAAC,EAAE,EAEtD,OAAIR,EAAU,OAAOS,EAAM,KAAK,SAAS,EACrCT,EAAU,MAAMS,EAAM,KAAK,QAAQ,EAEhC,CAAE,MAAOA,EAAM,KAAK,GAAG,CAAE,CAClC,ED5NA,IAAMC,EAAgB,CAAE,OAAQC,EAAQ,OAAQ,kBAAmB,EAAK,EAa3DC,EAAgC,CAC3C,OAASC,GACAC,EAAYC,GACVC,EAAe,CAAE,QAASH,EAAI,QAAS,QAASA,EAAI,QAAS,QAASA,EAAI,OAAQ,EAAGE,CAAO,EAClGL,CAAa,EAElB,SAAWG,GACFC,EAAYC,GACVE,EAAiB,CAAE,QAASJ,EAAI,QAAS,QAASA,EAAI,OAAQ,EAAGE,CAAO,EAC9EL,CAAa,EAElB,QAAUG,GACDC,EAAYC,GACVG,EAAgB,CAAE,QAASL,EAAI,QAAS,QAASA,EAAI,OAAQ,EAAGE,CAAO,EAC7EL,CAAa,CAEpB,EAmBMS,EAAgB,CACpBC,EACAC,IACmB,CACnB,IAAMC,EAAQ,IAAI,IAElB,OAAW,CAACC,EAAOC,CAAG,IAAK,OAAO,QAAQJ,CAAM,EAAG,CACjD,IAAMK,EAAgB,CACpB,KAAMF,EACN,aAAcC,EAAI,KAAK,SAAS,OAAO,EACvC,aAAcA,EAAI,KAAK,SAAS,OAAO,EACvC,QAASA,EAAI,OACf,EACME,EAAWJ,EAAM,IAAIE,EAAI,WAAW,EAEtCE,GACFA,EAAS,OAAO,KAAKD,CAAG,EACxBC,EAAS,aAAeA,EAAS,cAAgBD,EAAI,aACrDC,EAAS,aAAeA,EAAS,cAAgBD,EAAI,cAErDH,EAAM,IAAIE,EAAI,YAAa,CACzB,YAAaA,EAAI,YACjB,OAAQ,CAACC,CAAG,EACZ,aAAcA,EAAI,aAClB,aAAcA,EAAI,aAClB,SAAUJ,EAAW,IAAIG,EAAI,WAAW,CAC1C,CAAC,CAEL,CAEA,MAAO,CAAC,GAAGF,EAAM,OAAO,CAAC,CAC3B,EAGaK,EAAoB,MAAOC,GAAuC,CAC7E,IAAMC,EAAUC,EAAgBF,CAAI,EAC9BG,EAASC,EAAeJ,CAAI,EAC5BK,EAAS,MAAMC,EAAkB,EAEjCb,EAAa,IAAI,IACrBQ,EAAQ,IAAKM,GACJ,CAACA,EAAE,YAAaA,EAAE,IAAI,CAC9B,CACH,EACMC,EAAe,IAAI,IACvBP,EAAQ,IAAKM,GACJ,CAACA,EAAE,KAAMA,EAAE,WAAW,CAC9B,CACH,EACME,EAAU,IAAI,IAClBN,EAAO,IAAKI,GACHA,EAAE,IACV,CACH,EACMG,EAAW,IAAI,IACnBT,EAAQ,IAAKM,GACJA,EAAE,IACV,CACH,EACMI,EAAW,CAAC,GAAG,IAAI,IAAI,CAAC,GAAGD,EAAU,GAAGD,CAAO,CAAC,CAAC,EAAE,KAAK,EAExDG,EAAoB,MAAM,QAAQ,IACtCD,EAAS,IAAI,MAAOE,GAA6B,CAC/C,IAAMC,EAAQL,EAAQ,IAAII,CAAI,EACxBrB,EAASsB,GAAS,MAAMC,EAAQC,EAAK,KAAKhB,EAAM,OAAQa,EAAM,IAAI,CAAC,IAAI,OAAO,OAAS,OAE7F,MAAO,CACL,KAAAA,EACA,OAAQH,EAAS,IAAIG,CAAI,EACzB,MAAAC,EACA,WAAYN,EAAa,IAAIK,CAAI,EACjC,SAAUrB,EAASD,EAAcC,EAAQC,CAAU,EAAI,CAAC,CAC1D,CACF,CAAC,CACH,EAQMwB,EAAQ,MAAMC,EAAe,EAEnC,MAAO,CACL,KAAAN,EACA,QAAS,OAAO,KAAKP,EAAO,mBAAqB,CAAC,CAAC,EACnD,aAAc,OAAO,KAAKY,GAAO,MAAQ,CAAC,CAAC,EAAE,KAAK,CACpD,CACF,EAYME,EAAoBC,GAAuC,CAC/D,IAAMC,EAA0B,CAAC,EAEjC,QAAWC,KAAOF,EAAM,KAAM,CAC5B,GAAIE,EAAI,MAAO,CACb,IAAMC,EAAQD,EAAI,SAAS,QAASE,GAC3BA,EAAE,OAAO,IAAKC,GACZA,EAAE,IACV,CACF,EACKC,EAAcH,EAAM,OAAS,EAAI,2BAAsB,CAAC,GAAGA,CAAK,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,GAAK,WAE9FF,EAAQ,KAAK,CAAE,KAAM,GAAGC,EAAI,IAAI,MAAO,MAAO,GAAGA,EAAI,IAAI,MAAO,YAAAI,CAAY,CAAC,CAC/E,CACIJ,EAAI,QAAU,CAACA,EAAI,OACrBD,EAAQ,KAAK,CAAE,KAAM,GAAGC,EAAI,IAAI,OAAQ,MAAO,GAAGA,EAAI,IAAI,OAAQ,YAAa,SAAU,CAAC,CAE9F,CAEA,OAAOD,CACT,EAGMM,EAAqBP,GAA2C,CACpE,IAAMQ,EAA8B,CAClC,IAAKR,EAAM,KACR,OAAQb,GACAA,EAAE,MACV,EACA,IAAKA,GACGA,EAAE,IACV,EACH,GAAIa,EAAM,KACP,OAAQb,GACAA,EAAE,KACV,EACA,IAAKA,GACGA,EAAE,IACV,CACL,EACMsB,EAAsC,CAAC,EACvCC,EAAa,IAAI,IAEvB,QAAWR,KAAOF,EAAM,KAAM,CAIxBE,EAAI,YAAc,OAAMO,EAAYP,EAAI,IAAI,EAAIA,EAAI,YACxD,QAAWE,KAAKF,EAAI,SAClB,QAAW3B,KAAS6B,EAAE,OACpBM,EAAW,IAAI,GAAGR,EAAI,IAAI,IAAI3B,EAAM,IAAI,GAAI6B,EAAE,WAAW,CAG/D,CAEA,MAAO,CACL,WAAAI,EACA,YAAAC,EACA,SAAU,CAACP,EAAK3B,IACPmC,EAAW,IAAI,GAAGR,CAAG,IAAI3B,CAAK,EAAE,CAE3C,CACF,EAOaoC,EAAkB,CAACC,EAAsBZ,IAC7Ca,EAAoB,CAAE,WAAYD,CAAU,EAAGL,EAAkBP,CAAK,CAAC,EAAE,IAAKc,GAC5EA,EAAE,OACV,EAQUC,EAAkB,4BAEzBC,EAAW,IACRrD,EAAQ,IAAIoD,CAAe,IAAM,IASpCE,EAAqB,MACzBC,EACAlB,EACAmB,IACyC,CACzC,IAAM3B,EAAO,IAAI,IACfQ,EAAM,KAAK,IAAKb,GACP,CAACA,EAAE,KAAMA,CAAC,CAClB,CACH,EACMiC,EAAuC,CAAC,EAE9C,QAAWC,KAAOF,EAAQ,CACxB,IAAMjB,EAAMV,EAAK,IAAI6B,EAAI,MAAM,GAAG,EAAE,CAAC,CAAE,EAEvC,QAAWC,KAAWpB,GAAK,UAAY,CAAC,EACtC,QAAW3B,KAAS+C,EAAQ,OAAQ,CAClC,GAAI,CAAC/C,EAAM,cAAgB,CAACA,EAAM,aAAc,SAEhD,IAAMgD,EAAS,MAAML,EAAQ,OAAO,CAClC,QAAS,aAAMG,CAAG,IAAI9C,EAAM,IAAI,0BAChC,QAAS,CACP,CAAE,KAAM,uBAAwB,MAAO,OAAQ,EAC/C,CAAE,KAAM,QAAS,MAAO,OAAQ,CAClC,EACA,QAASA,EAAM,SAAW,OAC5B,CAAC,EAED6C,EAAQ,GAAGC,CAAG,IAAI9C,EAAM,IAAI,EAAE,EAAIgD,CACpC,CAEJ,CAEA,OAAOH,CACT,EAGMI,EAAe,CAACxB,EAAoBE,EAAauB,IAC9CzB,EAAM,KACV,KAAMb,GACEA,EAAE,OAASe,CACnB,GACC,SAAS,QAASE,GACXA,EAAE,MACV,EACA,KAAMC,GACEA,EAAE,OAASoB,CACnB,EAQCC,EAAe,CAACC,EAAmB3B,IAA6B,CACpE,IAAM4B,EAAkB,CAAC,EAEzB,OAAW,CAACP,EAAKxD,CAAG,IAAK,OAAO,QAAQ8D,EAAK,UAAU,MAAQ,CAAC,CAAC,EAAG,CAClE,GAAI,CAACN,EAAI,SAAS,KAAK,GAAK,CAACxD,EAAI,MAAO,SAExC,IAAMqC,EAAMmB,EAAI,MAAM,GAAG,EAAE,CAAC,EAE5B,OAAW,CAACI,EAAWI,CAAM,IAAK,OAAO,QAAQhE,EAAI,KAAK,EAAG,CAC3D,IAAMY,EAAM+C,EAAaxB,EAAOE,EAAKuB,CAAS,EACxCK,EAASrD,GAAOA,EAAI,cAAgBA,EAAI,aAAe,GAAK,iBAElEmD,EAAM,KAAK,KAAKP,CAAG,IAAII,CAAS,WAAMI,CAAM,GAAGC,CAAM,EAAE,CACzD,CACF,CAEA,GAAIF,EAAM,SAAW,EACrB,CAAAG,EAAO,KAAK,kBAAkB,EAC9B,QAAWC,IAAQ,CAAC,GAAGJ,CAAK,EAAE,KAAK,EACjCG,EAAO,KAAKC,CAAI,EAEpB,EAGMC,EAAkB,MAAOf,EAAwBlB,IAAqD,CAC1G,GAAIA,EAAM,KAAK,SAAW,EACxB,OAAA+B,EAAO,KAAK,4BAA4B,EAEjC,KAGT,IAAMG,EAAkB,MAAMhB,EAAQ,SAAS,CAAE,QAAS,4BAAsB,QAASnB,EAAiBC,CAAK,CAAE,CAAC,EAElH,GAAIkC,EAAgB,SAAW,EAC7B,OAAAH,EAAO,KAAK,uBAAuB,EAE5B,KAGT,IAAMZ,EAASe,EAAgB,OAAQC,GAC9BA,EAAE,SAAS,KAAK,CACxB,EACKf,EAAU,MAAMH,EAAmBC,EAASlB,EAAOmB,CAAM,EAEzDiB,EAAQ,MAAMlB,EAAQ,QAAQ,CAAE,QAAS,+CAAyC,QAAS,EAAM,CAAC,EAClGmB,EAAOrB,EAAS,EAClB,MAAME,EAAQ,QAAQ,CAAE,QAAS,+CAAyC,QAAS,EAAM,CAAC,EAC1F,GAEEoB,EAA6B,CAAE,QAASJ,EAAiB,QAAAd,EAAS,MAAAgB,EAAO,KAAAC,CAAK,EAC9EV,EAAOY,EAAiBD,EAAWtC,CAAK,EAE1C2B,EAAK,gBACPW,EAAU,IAAM,MAAMpB,EAAQ,OAAO,CACnC,QAAS,yDACT,QAASlB,EAAM,aAAa,IAAKwC,IACxB,CAAE,KAAMA,EAAG,MAAOA,CAAE,EAC5B,CACH,CAAC,EACD7E,EAAQ,IAAI8E,CAAiB,EAAIH,EAAU,KAG7C,IAAMI,EAAS/B,EAAgBgB,EAAK,UAAW3B,CAAK,EAEpD,GAAI0C,EAAO,OAAS,EAAG,CACrBX,EAAO,KAAK,6DAAmD,EAC/D,QAAWY,KAASD,EAClBX,EAAO,KAAK,aAAQY,CAAK,EAAE,EAG7B,OAAO,IACT,CAEAjB,EAAaC,EAAM3B,CAAK,EACxB4C,EAAWjB,EAAMW,CAAS,EAK1B,IAAMzD,EAAU8C,EAAK,WAClB,OAAQkB,GACAA,EAAE,SAAS,MAAM,CACzB,EACA,IAAKA,GACGA,EAAE,MAAM,GAAG,EAAE,CAAC,CACtB,EAIH,OAAIR,GAAQxD,EAAQ,OAAS,EACpB,CAAE,QAASA,EAAS,UAAW8C,EAAK,UAAW,MAAAS,EAAO,KAAM,EAAK,GAGtEC,GACFN,EAAO,KAAK,iHAAkG,EAGzG,CAAE,UAAWJ,EAAK,UAAW,MAAAS,EAAO,KAAM,EAAM,EACzD,EAGMQ,EAAa,CAACjB,EAAmBW,IAAqC,CAC1EQ,EAAY,eAAe,EAE3B,IAAMC,EAAKC,EAAkBrB,EAAMW,CAAS,EAE5CQ,EAAY,UAAUC,EAAG,MAAO,EAAI,EACpCD,EAAY,MAAM,EAIlBf,EAAO,KAAK,uGAA6F,CAC3G,EAGMkB,GAAkB,MAAO/B,EAAwBgC,IAA0C,CAC/F,IAAMd,EAAQ,MAAMlB,EAAQ,QAAQ,CAAE,QAAS,+CAAyC,QAAS,EAAM,CAAC,EAExG,OAAA4B,EAAY,eAAe,EAC3BA,EAAY,UAAUI,EAAQ,EAAI,EAC9Bd,GAAOU,EAAY,UAAU,UAAW,EAAI,EAChDA,EAAY,MAAM,EAEX,CAAE,OAAAI,EAAQ,MAAAd,EAAO,KAAM,EAAM,CACtC,EAGae,EAAgB,UAMhBC,GAAgB,MAAOlC,EAAwBlB,IAAqD,CAC/G,GAAIA,EAAM,QAAQ,SAAW,EAC3B,OAAOiC,EAAgBf,EAASlB,CAAK,EAGvC,IAAMqD,EAAS,MAAMnC,EAAQ,OAAO,CAClC,QAAS,wDACT,QAAS,CACP,GAAGlB,EAAM,QAAQ,IAAKsD,IACb,CAAE,KAAMA,EAAG,MAAOA,CAAE,EAC5B,EACD,IAAIC,EAAU,GAAG,EACjB,CAAE,KAAM,wBAAoB,MAAOJ,CAAc,CACnD,CACF,CAAC,EAED,OAAOE,IAAWF,EAAgBlB,EAAgBf,EAASlB,CAAK,EAAIiD,GAAgB/B,EAASmC,CAAM,CACrG,EAMaG,GAAe,MAC1BtC,EAAyBtD,EACzBgB,EAAe6E,EAAiB9F,EAAQ,IAAI,CAAC,IAEtCyF,GAAclC,EAAS,MAAMvC,EAAkBC,CAAI,CAAC",
-  "names": ["inquirerCheckbox", "inquirerConfirm", "inquirerSelect", "Separator", "loadDev", "path", "process", "appOf", "key", "byName", "model", "a", "isTwoOption", "route", "rawSource", "uiKey", "sources", "collectLocalPackages", "uiKeys", "apps", "localPkgs", "ownerByPkg", "app", "backend", "frontendOverrides", "overrides", "anyCloud", "backendLocal", "source", "deriveManualPlan", "selection", "t", "apiOnlyKeys", "presetApps", "cloud", "pkg", "owner", "equivalentCommand", "plan", "parts", "promptContext", "process", "defaultPrompts", "cfg", "withEscape", "context", "inquirerSelect", "inquirerCheckbox", "inquirerConfirm", "groupBackends", "routes", "ownerByPkg", "byPkg", "route", "def", "cap", "existing", "gatherWizardModel", "root", "apiApps", "discoverApiApps", "uiApps", "discoverUiApps", "config", "getInfraKitConfig", "a", "apiPkgByName", "uiNames", "apiNames", "allNames", "apps", "name", "hasUi", "loadDev", "path", "store", "readTokenStore", "buildPartChoices", "model", "choices", "app", "paths", "b", "r", "description", "buildAuditContext", "discovered", "apiPkgByApp", "routeToPkg", "auditManualPlan", "presetDef", "validatePresetProxy", "i", "WIZARD_CMUX_VAR", "asksCmux", "promptRouteSources", "prompts", "uiKeys", "sources", "key", "backend", "answer", "findRouteCap", "routePath", "recapSources", "plan", "lines", "source", "suffix", "logger", "line", "runManualBranch", "selectedTargets", "t", "watch", "cmux", "selection", "deriveManualPlan", "e", "INFRA_KIT_ENV_VAR", "issues", "issue", "echoManual", "k", "commandEcho", "eq", "equivalentCommand", "runPresetBranch", "preset", "MANUAL_CHOICE", "runWizardFlow", "choice", "p", "Separator", "runDevWizard", "findMonorepoRoot"]
-}