infra-kit 0.3.6 → 0.3.7

package/dist/chunk-KAWDTA5H.js

@@ -0,0 +1,2 @@
+import{b as E}from"./chunk-LKKKDB6V.js";import{m as f,q as P}from"./chunk-CHETBZ6M.js";import u from"node:path";var m="infra-kit",g=`${m}@latest`,S=(t,e,n)=>{let r=u.relative(n(u.resolve(t)),u.resolve(e));return r!==""&&!r.startsWith("..")&&!u.isAbsolute(r)},l=(t,e)=>u.resolve(t).split(u.sep).includes(e),z=(t,e)=>{let n=u.resolve(t).split(u.sep),r=n.indexOf("Cellar");return r!==-1&&n[r+1]===e},C=(t,e,n,r)=>{let o=t[e];return o!=null&&o!==""&&S(o,n,r)},H=[{manager:"volta",test:({selfRealPath:t,env:e,realpath:n})=>C(e,"VOLTA_HOME",t,n)||l(t,".volta")||l(t,"volta"),updateCommand:["volta","install",m],canSelfSpawn:!0},{manager:"homebrew",test:({selfRealPath:t})=>z(t,m),updateCommand:["brew","upgrade",m],canSelfSpawn:!1},{manager:"pnpm",test:({selfRealPath:t,env:e,realpath:n})=>C(e,"PNPM_HOME",t,n)||l(t,"pnpm")&&l(t,"global"),updateCommand:["pnpm","add","-g",g],canSelfSpawn:!0},{manager:"bun",test:({selfRealPath:t,env:e,realpath:n})=>C(e,"BUN_INSTALL",t,n)||l(t,".bun"),updateCommand:["bun","add","-g",g],canSelfSpawn:!0},{manager:"yarn",test:({selfRealPath:t})=>l(t,".yarn")||l(t,"yarn")&&l(t,"global"),updateCommand:["yarn","global","add",g],canSelfSpawn:!0},{manager:"npm",test:({selfRealPath:t,env:e,realpath:n})=>C(e,"npm_config_prefix",t,n),updateCommand:["npm","install","-g",g],canSelfSpawn:!0}],I=["npm","install","-g",g],b=t=>{let{selfRealPath:e,env:n,realpath:r,lazyNpmRoot:o}=t,s=H.find(({test:i})=>i({selfRealPath:e,env:n,realpath:r}));if(s)return{manager:s.manager,updateCommand:s.updateCommand,canSelfSpawn:s.canSelfSpawn};let a=o?.();return a!=null&&a!==""&&S(a,e,r)?{manager:"npm",updateCommand:I,canSelfSpawn:!0}:{manager:"unknown",updateCommand:I,canSelfSpawn:!1}},K=(t,e,n)=>l(t,"node_modules")&&S(e,t,n);import{realpathSync as G}from"node:fs";import $ from"node:path";var M=t=>{try{return G(t)}catch{return $.resolve(t)}};import{execFileSync as W}from"node:child_process";import B from"node:process";var Y=3e3,k=()=>{try{let e=W("npm",["root","-g"],{encoding:"utf-8",timeout:Y,stdio:["ignore","pipe","ignore"],shell:B.platform==="win32"}).trim();return e===""?void 0:e}catch{return}};import{spawnSync as de}from"node:child_process";import{homedir as fe}from"node:os";import v from"node:process";import d from"node:fs";import N from"node:path";import Q from"node:process";var X="update-check.lock",Z=1800*1e3,ee=()=>N.join(f(),X),te=(t,e)=>{try{e-d.statSync(t).mtimeMs>Z&&d.rmSync(t,{force:!0})}catch{}},A=(t={})=>{let e=t.nowMs??Date.now(),n=t.lockPath??ee();try{d.mkdirSync(N.dirname(n),{recursive:!0})}catch{return null}let r=()=>{try{return d.openSync(n,"wx",384)}catch{return null}},o=r();if(o===null&&(te(n,e),o=r()),o===null)return null;try{d.writeFileSync(o,String(Q.pid))}catch{}return()=>{try{d.closeSync(o)}catch{}try{d.rmSync(n,{force:!0})}catch{}}};var ne="https://registry.npmjs.org",re=5e3,oe=t=>Object.entries(t).find(([n,r])=>/^npm_config_registry$/i.test(n)&&r!=null&&r!=="")?.[1],ae=t=>{let e=oe(t),n=e!=null&&e!==""?e:ne;for(;n.endsWith("/");)n=n.slice(0,-1);return n},R=async(t,e=fetch)=>{let n=new AbortController,r=setTimeout(()=>{n.abort()},re);try{let o=await e(`${ae(t)}/${m}/latest`,{signal:n.signal,headers:{accept:"application/json"}});if(!o.ok)return null;let a=(await o.json())?.version;return typeof a=="string"&&a!==""?a:null}catch{return null}finally{clearTimeout(r)}};var se=/^(\d+)\.(\d+)\.(\d+)$/,_=t=>{let[e=""]=t.trim().split("+"),[n="",...r]=e.split("-"),o=se.exec(n);if(!o)return null;let[s,a,i]=[o[1],o[2],o[3]].map(Number);return{release:[s,a,i],prerelease:r.length>0?r.join("-").split("."):[]}},L=/^\d+$/,le=(t,e)=>{let n=L.test(t),r=L.test(e);return n&&r?Number(t)-Number(e):n!==r?n?-1:1:t<e?-1:1},ie=(t,e)=>{for(let n=0;n<Math.max(t.length,e.length);n+=1){let r=t[n],o=e[n];if(r===void 0)return-1;if(o===void 0)return 1;if(r!==o)return le(r,o)}return 0},U=(t,e)=>{let n=_(t),r=_(e);if(!n||!r)return!1;for(let a=0;a<3;a+=1){let i=n.release[a],h=r.release[a];if(i!==h)return i>h}let o=n.prerelease.length===0,s=r.prerelease.length===0;return o!==s?o:ie(n.prerelease,r.prerelease)>0};import T from"node:fs";import O from"node:path";var F="update-check.json",ce=1200*1e3,ue=()=>O.join(f(),F),pe=t=>Array.isArray(t)&&t.every(e=>typeof e=="string"),me=t=>{if(typeof t!="object"||t===null)return!1;let{lastCheckMs:e,latestVersion:n,updateCommand:r,outcome:o}=t;return typeof e=="number"&&Number.isFinite(e)&&(n===null||typeof n=="string")&&(r===null||pe(r))&&(o==null||typeof o=="string")},Ke=(t=e=>T.readFileSync(e,"utf8"))=>{try{let e=JSON.parse(t(ue()));return me(e)?e:null}catch{return null}},D=t=>{let e=f();T.mkdirSync(e,{recursive:!0}),P(O.join(e,F),JSON.stringify(t),384)},Ge=(t,e)=>{if(!t)return!0;let n=e-t.lastCheckMs;return n<0?!0:n>=ce};var ge=200,he=300*1e3,ye=t=>{try{return v.kill(t,0),!0}catch{return!1}},Ce=t=>new Promise(e=>{setTimeout(e,t)}),we=async(t,e)=>{let n=e.clock()+he;for(;e.clock()<n;){if(!e.isProcessAlive(t))return!0;await e.sleep(ge)}return!e.isProcessAlive(t)},rt=async(t,e)=>{let r=(e.acquireLock??A)();if(!r)return"already-running";try{return await Se(t,e)}finally{r()}},Se=async(t,e)=>{let n=e.env??v.env,r=e.nowMs??Date.now(),o=e.fetchLatest??R,s=e.writeCache??D,a=e.isProcessAlive??ye,i=e.sleep??Ce,h=e.clock??Date.now,V=e.lazyNpmRoot??k,j=e.spawnSync??de,c=await o(n),p=(x,q)=>(s({lastCheckMs:r,...q,outcome:x}),x);if(c===null)return p("fetch-failed",{latestVersion:null,updateCommand:null});if(!U(c,t))return p("up-to-date",{latestVersion:c,updateCommand:null});let{canSelfSpawn:J,updateCommand:y}=b({selfRealPath:e.selfRealPath,env:n,realpath:M,lazyNpmRoot:V});if(!J)return p("cannot-self-spawn",{latestVersion:c,updateCommand:y});if(e.parentPid==null)return p("parent-unknown",{latestVersion:c,updateCommand:null});if(s({lastCheckMs:r,latestVersion:c,updateCommand:null,outcome:"installing"}),!await we(e.parentPid,{isProcessAlive:a,sleep:i,clock:h}))return p("parent-still-running",{latestVersion:c,updateCommand:null});let w=j(y[0],y.slice(1),{stdio:"ignore",shell:v.platform==="win32",cwd:fe(),env:E(n),windowsHide:!0});return w.error||w.signal||w.status!==0?p("install-failed",{latestVersion:c,updateCommand:y}):p("installed",{latestVersion:null,updateCommand:null})};export{b as a,K as b,k as c,M as d,U as e,Ke as f,Ge as g,rt as h};
+//# sourceMappingURL=chunk-KAWDTA5H.js.map

package/dist/chunk-KAWDTA5H.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/lib/install-manager/install-manager.ts", "../src/lib/install-manager/safe-realpath.ts", "../src/lib/install-manager/npm-root.ts", "../src/lib/update-check/run-update-check.ts", "../src/lib/update-check/lock.ts", "../src/lib/update-check/registry.ts", "../src/lib/update-check/semver.ts", "../src/lib/update-check/update-cache.ts"],
+  "sourcesContent": ["/**\n * Pure detection of *how* this CLI was installed, so a self-update advisory can name the one command\n * that will actually work. No fs, no spawn, no `process.env` read \u2014 every input is injected, which is\n * what lets the whole matrix be table-tested.\n *\n * Detection is env-first and LAZY: the only signal that costs a subprocess (`npm root -g`) is passed in\n * as `lazyNpmRoot` and consulted solely when every cheaper matcher has missed.\n */\nimport path from 'node:path'\n\n/** The published package this CLI updates itself to. Single source for every suggested argv. */\nexport const PACKAGE_NAME = 'infra-kit'\n\nconst LATEST = `${PACKAGE_NAME}@latest`\n\nexport type InstallManager = 'npm' | 'pnpm' | 'yarn' | 'bun' | 'volta' | 'homebrew' | 'unknown'\n\nexport interface InstallManagerInfo {\n  manager: InstallManager\n  /** The command to run. Only safe to spawn ourselves when `canSelfSpawn`; otherwise print it. */\n  updateCommand: string[]\n  /** False when we must not run the command for the user \u2014 either it needs sudo/a tap, or we guessed. */\n  canSelfSpawn: boolean\n}\n\n/**\n * Canonicalises a candidate *root* directory. Required, not optional: `selfRealPath` has already had its\n * symlinks followed, so comparing it against a raw `PNPM_HOME`/`npm root -g`/`cwd` compares a resolved\n * path to an unresolved one and silently never matches. macOS is the everyday proof \u2014 `/var` is a symlink\n * to `/private/var`, so a global install under `/var/...` reports `unknown` unless both sides are resolved.\n * Callers inject the real thing; tests inject a stub.\n */\nexport type RealpathFn = (dir: string) => string\n\nexport interface DetectInstallManagerInput {\n  /** Fully-resolved (symlinks followed) path to this CLI's entry file. */\n  selfRealPath: string\n  env: NodeJS.ProcessEnv\n  /** Canonicalises each candidate root before comparison. See {@link RealpathFn}. */\n  realpath: RealpathFn\n  /** `npm root -g`, deferred: invoked at most once, and only when no cheaper matcher hit. */\n  lazyNpmRoot?: () => string | undefined\n}\n\n/**\n * Is `child` inside the `parent` subtree? Boundary-aware: a naive `startsWith` would call\n * `/Users/x/pnpm-ish` a child of `/Users/x/pnpm`. `parent` is canonicalised first because it arrives raw\n * from the environment while `child` is already a realpath.\n */\nconst isWithin = (parent: string, child: string, realpath: RealpathFn): boolean => {\n  const rel = path.relative(realpath(path.resolve(parent)), path.resolve(child))\n\n  return rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel)\n}\n\n/** Does `p` contain `name` as a whole path SEGMENT? `/a/node_modules_backup/b` must not match `node_modules`. */\nconst hasSegment = (p: string, name: string): boolean => {\n  return path.resolve(p).split(path.sep).includes(name)\n}\n\n/**\n * Is `p` inside a Homebrew keg belonging to the `name` FORMULA \u2014 i.e. `.../Cellar/<name>/<version>/...`?\n *\n * The formula name is what makes this sound. A bare `Cellar` segment says only \"somewhere under a keg\",\n * and the keg it lands in is routinely someone else's: when npm's global prefix is a node keg\n * (`npm config set prefix \"$(brew --prefix node)\"`, or any keg-only `node@X`), an `npm i -g` package\n * installs to `Cellar/node/<v>/lib/node_modules/<pkg>/...` \u2014 brew has never heard of it, yet the segment\n * is right there. Requiring `<name>` to sit directly after `Cellar` is what separates \"brew installed\n * THIS\" from \"brew installed the runtime that installed this\".\n *\n * Works for both keg layouts, since each is rooted at the formula: a plain formula\n * (`Cellar/infra-kit/1.2.3/bin/infra-kit`) and brew's node-CLI layout\n * (`Cellar/infra-kit/1.2.3/libexec/lib/node_modules/infra-kit/dist/cli.js`). Do NOT try to tell them\n * apart by excluding `node_modules` \u2014 the second one contains it.\n */\nconst isBrewKegOf = (p: string, name: string): boolean => {\n  const segments = path.resolve(p).split(path.sep)\n  const cellar = segments.indexOf('Cellar')\n\n  return cellar !== -1 && segments[cellar + 1] === name\n}\n\n/** `env[key]` names a directory that contains `selfRealPath`. Absent/empty env var \u2192 no match. */\nconst underEnvDir = (env: NodeJS.ProcessEnv, key: string, selfRealPath: string, realpath: RealpathFn): boolean => {\n  const dir = env[key]\n\n  return dir != null && dir !== '' && isWithin(dir, selfRealPath, realpath)\n}\n\ninterface Matcher extends Omit<InstallManagerInfo, 'manager'> {\n  manager: InstallManager\n  test: (input: Required<Pick<DetectInstallManagerInput, 'selfRealPath' | 'env' | 'realpath'>>) => boolean\n}\n\n/**\n * Ordered, first-hit-wins. Order matters: volta and homebrew wrap an npm-shaped layout, so they must be\n * consulted before the generic npm prefix matcher would claim them.\n */\nconst MATCHERS: Matcher[] = [\n  {\n    manager: 'volta',\n    // volta owns the shim; `volta install` is the correct tool, not a workaround \u2014 so we may run it.\n    test: ({ selfRealPath, env, realpath }) => {\n      return (\n        underEnvDir(env, 'VOLTA_HOME', selfRealPath, realpath) ||\n        hasSegment(selfRealPath, '.volta') ||\n        hasSegment(selfRealPath, 'volta')\n      )\n    },\n    updateCommand: ['volta', 'install', PACKAGE_NAME],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'homebrew',\n    // `brew upgrade` can touch the prefix, relink, and prompt \u2014 never ours to run unattended.\n    //\n    // Our own keg is the ONLY sound signal \u2014 see {@link isBrewKegOf}. Two broader tests look plausible\n    // and are both wrong, because each answers \"did brew put something here?\" when the question is \"does\n    // brew own THIS package?\":\n    //   - `HOMEBREW_PREFIX` containment: when node comes from brew, npm's global prefix IS\n    //     $HOMEBREW_PREFIX, so EVERY `npm i -g` package lands under it, unknown to brew.\n    //   - a bare `Cellar` segment: an npm prefix pointed at a node keg puts packages inside that keg.\n    // Either misfire tells macOS users to run `brew upgrade infra-kit` \u2014 a formula that does not exist \u2014\n    // and, far worse, makes the background auto-updater bail with `cannot-self-spawn` forever, so the\n    // very fix for it can never reach them. Detection runs on the realpath, and a linked brew bin always\n    // resolves into its own keg, so the narrow test has no false negatives to trade for this.\n    test: ({ selfRealPath }) => {\n      return isBrewKegOf(selfRealPath, PACKAGE_NAME)\n    },\n    updateCommand: ['brew', 'upgrade', PACKAGE_NAME],\n    canSelfSpawn: false,\n  },\n  {\n    manager: 'pnpm',\n    test: ({ selfRealPath, env, realpath }) => {\n      return (\n        underEnvDir(env, 'PNPM_HOME', selfRealPath, realpath) ||\n        (hasSegment(selfRealPath, 'pnpm') && hasSegment(selfRealPath, 'global'))\n      )\n    },\n    updateCommand: ['pnpm', 'add', '-g', LATEST],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'bun',\n    test: ({ selfRealPath, env, realpath }) => {\n      return underEnvDir(env, 'BUN_INSTALL', selfRealPath, realpath) || hasSegment(selfRealPath, '.bun')\n    },\n    updateCommand: ['bun', 'add', '-g', LATEST],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'yarn',\n    test: ({ selfRealPath }) => {\n      return (\n        hasSegment(selfRealPath, '.yarn') || (hasSegment(selfRealPath, 'yarn') && hasSegment(selfRealPath, 'global'))\n      )\n    },\n    updateCommand: ['yarn', 'global', 'add', LATEST],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'npm',\n    test: ({ selfRealPath, env, realpath }) => {\n      return underEnvDir(env, 'npm_config_prefix', selfRealPath, realpath)\n    },\n    updateCommand: ['npm', 'install', '-g', LATEST],\n    canSelfSpawn: true,\n  },\n]\n\nconst NPM_UPDATE_COMMAND = ['npm', 'install', '-g', LATEST]\n\n/**\n * Identify the package manager that owns `selfRealPath`.\n *\n * `lazyNpmRoot` is the fallback probe and is invoked at most once, only after every env/path matcher has\n * missed \u2014 a global `npm root -g` subprocess is never paid for a pnpm or volta install. When nothing\n * matches we report `unknown` with an npm command that is a *suggestion only* (`canSelfSpawn: false`):\n * running a guessed global install is worse than printing one.\n *\n * @example\n * detectInstallManager({ selfRealPath: '/Users/x/Library/pnpm/global/5/node_modules/infra-kit/dist/cli.js', env: {} })\n * // => { manager: 'pnpm', updateCommand: ['pnpm', 'add', '-g', 'infra-kit@latest'], canSelfSpawn: true }\n */\nexport const detectInstallManager = (input: DetectInstallManagerInput): InstallManagerInfo => {\n  const { selfRealPath, env, realpath, lazyNpmRoot } = input\n  const hit = MATCHERS.find(({ test }) => {\n    return test({ selfRealPath, env, realpath })\n  })\n\n  if (hit) return { manager: hit.manager, updateCommand: hit.updateCommand, canSelfSpawn: hit.canSelfSpawn }\n\n  const npmRoot = lazyNpmRoot?.()\n\n  if (npmRoot != null && npmRoot !== '' && isWithin(npmRoot, selfRealPath, realpath)) {\n    return { manager: 'npm', updateCommand: NPM_UPDATE_COMMAND, canSelfSpawn: true }\n  }\n\n  return { manager: 'unknown', updateCommand: NPM_UPDATE_COMMAND, canSelfSpawn: false }\n}\n\n/**\n * Is this CLI running from a *project-local* `node_modules` (as opposed to a global root)?\n *\n * The cwd clause is what does the distinguishing \u2014 BOTH a project install and a global root contain a\n * `/node_modules/` segment (`pnpm root -g` is `~/Library/pnpm/global/5/node_modules`). Without it we\n * would nag every global pnpm user to stop using a local install they do not have.\n *\n * Accepted false-negative: invoked from a subdirectory (cwd `project/apps/x`, deps at\n * `project/node_modules`) this returns false and the advisory stays silent. Under-warning is the safe\n * direction for a best-effort, never-throwing advisory \u2014 do not \"fix\" it by dropping the cwd clause.\n *\n * `cwd` is canonicalised before comparison for the same reason `detectInstallManager` canonicalises its\n * roots: `selfRealPath` is a realpath, and comparing it to an unresolved cwd never matches.\n *\n * @example\n * isLocalNodeModulesInstall('/repo/node_modules/infra-kit/dist/cli.js', '/repo', (p) => p) // => true\n */\nexport const isLocalNodeModulesInstall = (selfRealPath: string, cwd: string, realpath: RealpathFn): boolean => {\n  return hasSegment(selfRealPath, 'node_modules') && isWithin(cwd, selfRealPath, realpath)\n}\n", "import { realpathSync } from 'node:fs'\nimport path from 'node:path'\n\n/**\n * The impure companion to the pure detection module: canonicalise a directory that may not exist.\n *\n * `realpathSync` throws on a missing path, and candidate roots routinely miss \u2014 `PNPM_HOME` can point at a\n * directory the user never created, `npm root -g` can name a prefix that was removed. A throw there would\n * turn \"we could not identify your install\" into a crash, so an unresolvable path falls back to\n * `path.resolve`, which still normalises `.`/`..` and yields a usable, non-matching absolute path.\n */\nexport const safeRealpath = (dir: string): string => {\n  try {\n    return realpathSync(dir)\n  } catch {\n    return path.resolve(dir)\n  }\n}\n", "/* eslint-disable sonarjs/no-os-command-from-path */\n/**\n * `npm root -g`, the LAZY fallback for {@link detectInstallManager}.\n *\n * Why it is indispensable: the `npm` matcher keys off `npm_config_prefix`, which npm sets only while npm\n * itself is running. A user who ran `npm i -g infra-kit` months ago and now types `ik` has no such var,\n * so every cheap matcher misses and detection reports `unknown` / `canSelfSpawn: false`. Without this\n * probe the single most common install method can never update itself.\n *\n * Shared by `self-update` (interactive) and the background update worker so the two can never disagree\n * about who owns the install.\n */\nimport { execFileSync } from 'node:child_process'\nimport process from 'node:process'\n\nconst NPM_ROOT_TIMEOUT_MS = 3_000\n\n/**\n * The global npm root, or undefined when npm is absent, slow, or errors. Costs a subprocess, so\n * `detectInstallManager` invokes it at most once and only after every env/path matcher has missed \u2014 a\n * pnpm or volta install never pays for it.\n *\n * Resolving the user's `npm` from PATH is inherent here: we must ask the very package manager that owns\n * this install where its global root is. Pinning an absolute path would defeat the detection.\n *\n * @example\n * defaultLazyNpmRoot() // => '/usr/local/lib/node_modules' | undefined\n */\nexport const defaultLazyNpmRoot = (): string | undefined => {\n  try {\n    const out = execFileSync('npm', ['root', '-g'], {\n      encoding: 'utf-8',\n      timeout: NPM_ROOT_TIMEOUT_MS,\n      stdio: ['ignore', 'pipe', 'ignore'],\n      shell: process.platform === 'win32',\n    })\n    const trimmed = out.trim()\n\n    return trimmed === '' ? undefined : trimmed\n  } catch {\n    return undefined\n  }\n}\n", "/**\n * The CHILD half of the auto-update, spawned detached by `maybeAutoUpdate`. It outlives the CLI\n * invocation that started it, so it may take its time and it may replace the binary.\n *\n * WHY IT WAITS FOR THE PARENT TO EXIT \u2014 the load-bearing invariant of this whole feature:\n * `scripts/build.js` sets esbuild `splitting: true`, so `dist/cli.js` lazily imports sibling\n * `chunk-*.js` files at runtime (that is how the Ink TUI stays off the fast path). A package manager\n * installing over `dist/` mid-command deletes chunks the parent has not imported yet, and the parent\n * dies on a dynamic import of a file that no longer exists. Waiting for the parent to exit is what\n * makes a silent background install safe rather than a random crash under `infra-kit dev`.\n */\nimport { spawnSync } from 'node:child_process'\nimport { homedir } from 'node:os'\nimport process from 'node:process'\n\nimport { defaultLazyNpmRoot, detectInstallManager, safeRealpath } from 'src/lib/install-manager'\nimport { packageManagerInstallEnv } from 'src/lib/pm-env'\n\nimport { acquireUpdateLock } from './lock'\nimport { fetchLatestVersion } from './registry'\nimport { isNewerVersion } from './semver'\nimport { writeUpdateCache } from './update-cache'\nimport type { UpdateCache } from './update-cache'\n\n/** How often to re-check whether the parent is gone. */\nexport const PARENT_POLL_INTERVAL_MS = 200\n\n/**\n * Give up waiting after this long. A long-lived parent (`infra-kit dev` runs for hours) must not leave\n * an immortal child pinned to a stale version: we simply skip this cycle. `lastCheckMs` is already\n * persisted by then, so the next short-lived command re-checks after the normal throttle window.\n */\nexport const PARENT_WAIT_TIMEOUT_MS = 5 * 60 * 1000\n\nexport interface RunUpdateCheckDeps {\n  env?: NodeJS.ProcessEnv\n  nowMs?: number\n  fetchLatest?: (env: NodeJS.ProcessEnv) => Promise<string | null>\n  writeCache?: typeof writeUpdateCache\n  isProcessAlive?: (pid: number) => boolean\n  sleep?: (ms: number) => Promise<void>\n  /** Monotonic-ish source for the parent-wait deadline. Injected so the timeout is testable without real time. */\n  clock?: () => number\n  /** `npm root -g` probe. Defaults to the real subprocess; this child is detached, so it can afford one. */\n  lazyNpmRoot?: () => string | undefined\n  /** Single-flight guard. Returns a release fn, or null when another worker already holds the lock. */\n  acquireLock?: () => (() => void) | null\n  spawnSync?: typeof spawnSync\n  /** Realpath of the installed `dist/cli.js`, used to identify the owning package manager. */\n  selfRealPath: string\n  parentPid?: number\n}\n\n/** Signal 0 performs the permission/existence check without delivering anything. */\nconst defaultIsProcessAlive = (pid: number): boolean => {\n  try {\n    process.kill(pid, 0)\n\n    return true\n  } catch {\n    return false\n  }\n}\n\nconst defaultSleep = (ms: number): Promise<void> => {\n  return new Promise((resolve) => {\n    setTimeout(resolve, ms)\n  })\n}\n\n/**\n * Block until `parentPid` exits or {@link PARENT_WAIT_TIMEOUT_MS} elapses. Returns whether the parent\n * is actually gone \u2014 the caller must not install on a timeout.\n */\nconst waitForParentExit = async (\n  parentPid: number,\n  deps: Required<Pick<RunUpdateCheckDeps, 'isProcessAlive' | 'sleep' | 'clock'>>,\n): Promise<boolean> => {\n  const deadline = deps.clock() + PARENT_WAIT_TIMEOUT_MS\n\n  while (deps.clock() < deadline) {\n    if (!deps.isProcessAlive(parentPid)) return true\n\n    await deps.sleep(PARENT_POLL_INTERVAL_MS)\n  }\n\n  return !deps.isProcessAlive(parentPid)\n}\n\nexport type UpdateCheckOutcome =\n  | 'installed'\n  | 'install-failed'\n  | 'up-to-date'\n  | 'fetch-failed'\n  | 'cannot-self-spawn'\n  | 'parent-still-running'\n  | 'parent-unknown'\n  | 'already-running'\n\n/**\n * Fetch, decide, and (when safe) install \u2014 returning WHY it did what it did so tests can distinguish\n * \"no update\" from \"could not install\". Never throws.\n *\n * `lastCheckMs` is written from the ATTEMPT, before any early return. If it were written only on\n * success, an offline user would re-spawn a doomed child on every single command.\n *\n * @example\n * await runUpdateCheck('0.1.130', { selfRealPath: '/usr/local/lib/node_modules/infra-kit/dist/cli.js' })\n * // => 'installed'\n */\nexport const runUpdateCheck = async (currentVersion: string, deps: RunUpdateCheckDeps): Promise<UpdateCheckOutcome> => {\n  const acquireLock = deps.acquireLock ?? acquireUpdateLock\n\n  // Single-flight. N shells launched at once all read the same stale cache and each spawns a worker;\n  // the cache throttle cannot stop them because it is only written after the fetch returns. Without\n  // this, a pending update means N concurrent `npm install -g` over one global directory.\n  const release = acquireLock()\n\n  if (!release) return 'already-running'\n\n  try {\n    return await runUpdateCheckLocked(currentVersion, deps)\n  } finally {\n    release()\n  }\n}\n\nconst runUpdateCheckLocked = async (currentVersion: string, deps: RunUpdateCheckDeps): Promise<UpdateCheckOutcome> => {\n  const env = deps.env ?? process.env\n  const nowMs = deps.nowMs ?? Date.now()\n  const fetchLatest = deps.fetchLatest ?? fetchLatestVersion\n  const writeCache = deps.writeCache ?? writeUpdateCache\n  const isProcessAlive = deps.isProcessAlive ?? defaultIsProcessAlive\n  const sleep = deps.sleep ?? defaultSleep\n  const clock = deps.clock ?? Date.now\n  const lazyNpmRoot = deps.lazyNpmRoot ?? defaultLazyNpmRoot\n  const spawn = deps.spawnSync ?? spawnSync\n\n  const latestVersion = await fetchLatest(env)\n\n  // Every path below writes the cache EXACTLY once, and always with `lastCheckMs: nowMs` \u2014 the throttle\n  // burns on the ATTEMPT, never on success. If it burned only on success, an offline user would respawn\n  // a doomed child on every command.\n  const finish = (\n    outcome: UpdateCheckOutcome,\n    cache: Omit<UpdateCache, 'lastCheckMs' | 'outcome'>,\n  ): UpdateCheckOutcome => {\n    // `outcome` is recorded on EVERY write: it is what lets a reader (human or `isStale`) tell a settled\n    // `installed`/`up-to-date` from a transient `fetch-failed`, all of which otherwise write an identical\n    // `{latestVersion:null}`. See `UpdateCache.outcome`.\n    writeCache({ lastCheckMs: nowMs, ...cache, outcome })\n\n    return outcome\n  }\n\n  if (latestVersion === null) return finish('fetch-failed', { latestVersion: null, updateCommand: null })\n  if (!isNewerVersion(latestVersion, currentVersion))\n    return finish('up-to-date', { latestVersion, updateCommand: null })\n\n  // `lazyNpmRoot` is what makes the COMMON case work: a plain `npm i -g infra-kit` leaves no\n  // `npm_config_prefix` in the user's shell, so every cheap matcher misses and detection would report\n  // `unknown` / `canSelfSpawn: false`. Without this probe the auto-update would silently degrade to a\n  // notice for the majority of installs. The subprocess is affordable here and nowhere else.\n  const { canSelfSpawn, updateCommand } = detectInstallManager({\n    selfRealPath: deps.selfRealPath,\n    env,\n    realpath: safeRealpath,\n    lazyNpmRoot,\n  })\n\n  // Homebrew relinks its prefix and may prompt; an unknown location means the command is a guess.\n  // Both stay the user's call, so record the command for `maybeAutoUpdate` to print next invocation.\n  if (!canSelfSpawn) return finish('cannot-self-spawn', { latestVersion, updateCommand })\n\n  // Fail SAFE. Without a parent to outlive we cannot know whether a live CLI is still lazily importing\n  // `chunk-*.js` out of the `dist/` we are about to replace, so we skip the cycle rather than install\n  // blind. The real spawn always passes `--parent-pid`; only a hand-run worker lands here.\n  if (deps.parentPid == null) return finish('parent-unknown', { latestVersion, updateCommand: null })\n\n  // Burn the throttle NOW, before the two unbounded-ish operations below (a 5-minute parent wait, then an\n  // install of no fixed duration). Everything after this point can take many minutes, and until the cache\n  // is written it still reads as STALE \u2014 so every new shell in that window spawns its own worker, and the\n  // single-flight lock becomes the only thing standing between them and concurrent `npm install -g` runs\n  // over one global directory. The lock is reaped by mtime (LOCK_STALE_MS), so a slow enough install has\n  // its live lock stolen and we get exactly the pile-up the lock exists to prevent.\n  //\n  // Writing the stamp here makes the throttle \u2014 not the lock \u2014 the primary guard, which is what the cache\n  // was always for. `finish()` overwrites this with the real outcome; this is the only path that writes\n  // the cache twice, and deliberately so.\n  //\n  // `outcome: 'installing'` marks a mid-install checkpoint: if the worker is killed here (machine sleeps,\n  // SIGKILL) and never reaches `finish()`, this stamp is what the next run reads, and the cache says so\n  // rather than looking like a settled result. It does not shorten the next window \u2014 see CHECK_INTERVAL_MS.\n  writeCache({ lastCheckMs: nowMs, latestVersion, updateCommand: null, outcome: 'installing' })\n\n  const parentGone = await waitForParentExit(deps.parentPid, { isProcessAlive, sleep, clock })\n\n  // A long-lived parent (`infra-kit dev`) outlasted the wait. Stay silent and retry next window.\n  if (!parentGone) return finish('parent-still-running', { latestVersion, updateCommand: null })\n\n  // `shell` on win32 so the `.cmd` shims npm/pnpm/yarn ship as global bins resolve.\n  //\n  // `packageManagerInstallEnv` strips the inherited npx/dlx markers \u2014 which otherwise make\n  // pnpm/portless-style tools believe they were invoked via `npx`/`dlx` and refuse to run \u2014 while KEEPING\n  // `npm_config_prefix` and `npm_config_registry`. Using the blunt `withoutPackageManagerEnv` here was a\n  // bug: it also erased the prefix that `detectInstallManager` had just matched on, so we would detect a\n  // global install at prefix P and then install into the default prefix instead \u2014 silently, forever. See\n  // the module doc on `packageManagerInstallEnv`.\n  //\n  // `cwd` is pinned to the home directory, and this is a SECURITY control, not tidiness: npm resolves\n  // `registry=` from an `.npmrc` on disk relative to the cwd. Inheriting the caller's cwd would let any\n  // repo containing a hostile `.npmrc` silently redirect this unattended `install -g` to an attacker's\n  // registry, executing its lifecycle scripts. Stripping `npm_config_registry` from the env does NOT\n  // close that hole, because the redirect lives in a file, not the environment.\n  const result = spawn(updateCommand[0] as string, updateCommand.slice(1), {\n    stdio: 'ignore',\n    shell: process.platform === 'win32',\n    cwd: homedir(),\n    env: packageManagerInstallEnv(env),\n    windowsHide: true,\n  })\n\n  // Record the manual command so a persistently failing silent install (EACCES on a root-owned global\n  // dir, say) still surfaces ONE actionable line, instead of failing invisibly forever.\n  if (result.error || result.signal || result.status !== 0) {\n    return finish('install-failed', { latestVersion, updateCommand })\n  }\n\n  // The installed version is now `latestVersion`; clear it so the next run does not re-notify.\n  return finish('installed', { latestVersion: null, updateCommand: null })\n}\n", "/**\n * Single-flight lock for the background update worker.\n *\n * Without it, N shells starting at once all read the same stale cache and each spawns a worker \u2014 and\n * once a newer version exists, each of those runs `npm install -g` concurrently, over the same global\n * directory. (Measured: five concurrent `ik` invocations spawn five workers.) The throttle in the cache\n * cannot prevent this: it is only written AFTER the fetch returns, long after the other workers launched.\n *\n * `openSync(path, 'wx')` is the primitive \u2014 an atomic create-if-absent, so exactly one worker wins even\n * if all of them call it in the same millisecond.\n */\nimport fs from 'node:fs'\nimport path from 'node:path'\nimport process from 'node:process'\n\nimport { getCacheRoot } from 'src/lib/constants'\n\nexport const LOCK_FILE_NAME = 'update-check.lock'\n\n/**\n * A lock older than this is assumed to belong to a worker that was killed before it could clean up.\n *\n * Must exceed the worker's ENTIRE critical section, and the install is part of it: the lock is held across\n * `fetch` (\u22642.5s) + the parent wait (\u22645min) + `npm install -g`, which has no bound at all \u2014 a cold cache on\n * a slow link can run for many minutes. The previous 10 minutes was budgeted from the wait and the fetch\n * alone, silently omitting the very operation the lock exists to serialise. A slow enough install therefore\n * had its own LIVE lock reaped as stale by the next worker, which then ran a second concurrent\n * `npm install -g` over the same global directory \u2014 precisely the pile-up described above.\n *\n * The throttle, not this timeout, is now the primary guard: `runUpdateCheck` stamps `lastCheckMs` BEFORE\n * the wait and the install, so concurrent shells stop spawning workers at all. This value only has to\n * outlive a plausible install, and is deliberately generous \u2014 the cost of being too large is that a worker\n * killed mid-install delays the next attempt, which the throttle would delay anyway.\n */\nexport const LOCK_STALE_MS = 30 * 60 * 1000\n\nexport const lockFilePath = (): string => {\n  return path.join(getCacheRoot(), LOCK_FILE_NAME)\n}\n\nexport interface LockDeps {\n  nowMs?: number\n  lockPath?: string\n}\n\n/** Delete a lock whose mtime predates the staleness window. Best-effort: losing the race is harmless. */\nconst reapIfStale = (lockPath: string, nowMs: number): void => {\n  try {\n    if (nowMs - fs.statSync(lockPath).mtimeMs > LOCK_STALE_MS) fs.rmSync(lockPath, { force: true })\n  } catch {\n    // Vanished under us \u2014 another worker reaped it. Nothing to do.\n  }\n}\n\n/**\n * Take the lock, or return null when another worker already holds it.\n *\n * Returns a release function rather than a boolean so the caller cannot forget which path releases:\n * there is exactly one handle, and it is the only thing that can unlink the file.\n *\n * @example\n * const release = acquireUpdateLock()\n * if (!release) return 'already-running'\n * try { ... } finally { release() }\n */\nexport const acquireUpdateLock = (deps: LockDeps = {}): (() => void) | null => {\n  const nowMs = deps.nowMs ?? Date.now()\n  const lockPath = deps.lockPath ?? lockFilePath()\n\n  try {\n    fs.mkdirSync(path.dirname(lockPath), { recursive: true })\n  } catch {\n    return null\n  }\n\n  const open = (): number | null => {\n    try {\n      // 'wx' fails with EEXIST if the file is already there: an atomic test-and-set.\n      return fs.openSync(lockPath, 'wx', 0o600)\n    } catch {\n      return null\n    }\n  }\n\n  let fd = open()\n\n  if (fd === null) {\n    reapIfStale(lockPath, nowMs)\n    // One retry only. If a live worker holds the lock, we are the loser and must simply stand down.\n    fd = open()\n  }\n\n  if (fd === null) return null\n\n  try {\n    fs.writeFileSync(fd, String(process.pid))\n  } catch {\n    // The pid is a debugging aid, not part of the protocol; the lock is held either way.\n  }\n\n  return () => {\n    try {\n      fs.closeSync(fd)\n    } catch {\n      // Already closed.\n    }\n\n    try {\n      fs.rmSync(lockPath, { force: true })\n    } catch {\n      // Already gone; a later worker will reap it via LOCK_STALE_MS regardless.\n    }\n  }\n}\n", "/**\n * Ask the npm registry for the `latest` dist-tag. Node >= 24 (see `engines`), so global `fetch` is\n * available and this needs no dependency.\n */\nimport { PACKAGE_NAME } from 'src/lib/install-manager'\n\nexport const DEFAULT_REGISTRY = 'https://registry.npmjs.org'\n\n/**\n * Bounded so a hanging registry can never keep a detached child alive indefinitely. 5s, not a tighter\n * bound: the abbreviated `/pkg/latest` endpoint is usually ~20-900ms, but a cold TLS/DNS handshake in a\n * freshly-spawned worker can spike past a 2.5s cap \u2014 and a single trip used to cost a `fetch-failed` that\n * pushed the next check a full window out. A detached child that lingers a few extra seconds harms nothing.\n */\nexport const FETCH_TIMEOUT_MS = 5_000\n\n/**\n * The registry this install actually talks to. A user behind a corporate mirror has `npm_config_registry`\n * set; hitting registry.npmjs.org directly would either fail closed (firewall) or, worse, report a public\n * version they cannot install.\n *\n * @example\n * registryUrl({ npm_config_registry: 'https://nexus.corp/repo/npm/' }) // => 'https://nexus.corp/repo/npm'\n */\n/**\n * `npm_config_registry` in WHICHEVER case the environment spells it.\n *\n * A bare `env.npm_config_registry` reads only the lowercase form, but npm itself matches `/^npm_config_/i`,\n * and POSIX `process.env` is case-SENSITIVE \u2014 so a `NPM_CONFIG_REGISTRY` (the form Dockerfiles and CI\n * images export) was invisible here while npm honoured it. The check then queried the public registry that\n * the install would never touch: the two halves of this feature were exactly inverted.\n */\nconst configuredRegistry = (env: NodeJS.ProcessEnv): string | undefined => {\n  const hit = Object.entries(env).find(([key, value]) => {\n    return /^npm_config_registry$/i.test(key) && value != null && value !== ''\n  })\n\n  return hit?.[1]\n}\n\nexport const registryUrl = (env: NodeJS.ProcessEnv): string => {\n  const configured = configuredRegistry(env)\n\n  let base = configured != null && configured !== '' ? configured : DEFAULT_REGISTRY\n\n  // A `/\\/+$/` regex would do this in one line, but its backtracking is super-linear on a hostile input.\n  while (base.endsWith('/')) {\n    base = base.slice(0, -1)\n  }\n\n  return base\n}\n\n/**\n * The published `latest` version, or null on ANY failure (offline, timeout, non-200, malformed body).\n * Never throws: a failed check must be indistinguishable from \"no update available\" to every caller.\n *\n * @example\n * await fetchLatestVersion(process.env) // => '0.1.131' | null\n */\nexport const fetchLatestVersion = async (\n  env: NodeJS.ProcessEnv,\n  fetchFn: typeof fetch = fetch,\n): Promise<string | null> => {\n  const controller = new AbortController()\n  const timer = setTimeout(() => {\n    controller.abort()\n  }, FETCH_TIMEOUT_MS)\n\n  try {\n    const response = await fetchFn(`${registryUrl(env)}/${PACKAGE_NAME}/latest`, {\n      signal: controller.signal,\n      headers: { accept: 'application/json' },\n    })\n\n    if (!response.ok) return null\n\n    const body: unknown = await response.json()\n    const version = (body as { version?: unknown } | null)?.version\n\n    return typeof version === 'string' && version !== '' ? version : null\n  } catch {\n    return null\n  } finally {\n    clearTimeout(timer)\n  }\n}\n", "/**\n * Registry-safe version comparison for the auto-update check.\n *\n * Deliberately NOT `src/lib/version-utils`: `parseVersion` there does `versionStr.slice(1)` because it\n * only ever sees `v`-prefixed release tags, so it turns a bare registry version (`0.1.130`) into\n * `[NaN, 1, 130]`. Feeding npm's `dist-tags.latest` through it silently compares NaNs and never fires.\n * These inputs are bare semver from `registry.npmjs.org` and from our own `package.json`.\n */\n\n/** `1.2.3-beta.4+build` \u2192 the `[1, 2, 3]` release triple and the `beta.4` prerelease, or null if unparsable. */\ninterface ParsedVersion {\n  release: [number, number, number]\n  /** Dot-separated prerelease identifiers, empty when this is a final release. */\n  prerelease: string[]\n}\n\nconst RELEASE_PATTERN = /^(\\d+)\\.(\\d+)\\.(\\d+)$/\n\n/**\n * Parse bare semver. Returns null (never throws, never NaNs) for anything that is not\n * `major.minor.patch` with optional `-prerelease` and `+build` \u2014 a garbled registry body must read as\n * \"no update\", not as \"update to NaN\".\n *\n * @example\n * parseSemver('0.1.130') // => { release: [0, 1, 130], prerelease: [] }\n * parseSemver('1.0.0-rc.1+abc') // => { release: [1, 0, 0], prerelease: ['rc', '1'] }\n * parseSemver('v1.0.0') // => null\n */\nexport const parseSemver = (version: string): ParsedVersion | null => {\n  // Build metadata is ignored entirely by semver precedence rules.\n  const [withoutBuild = ''] = version.trim().split('+')\n  const [core = '', ...prereleaseParts] = withoutBuild.split('-')\n  const match = RELEASE_PATTERN.exec(core)\n\n  if (!match) return null\n\n  const [major, minor, patch] = [match[1], match[2], match[3]].map(Number) as [number, number, number]\n\n  return {\n    release: [major, minor, patch],\n    // Re-join on '-' so `1.0.0-rc-1` keeps its hyphen inside a single identifier.\n    prerelease: prereleaseParts.length > 0 ? prereleaseParts.join('-').split('.') : [],\n  }\n}\n\nconst NUMERIC_IDENTIFIER = /^\\d+$/\n\n/** Compare two unequal prerelease identifiers per semver \u00A711. Numeric ones rank below alphanumeric ones. */\nconst compareIdentifier = (left: string, right: string): number => {\n  const leftNumeric = NUMERIC_IDENTIFIER.test(left)\n  const rightNumeric = NUMERIC_IDENTIFIER.test(right)\n\n  if (leftNumeric && rightNumeric) return Number(left) - Number(right)\n  if (leftNumeric !== rightNumeric) return leftNumeric ? -1 : 1\n\n  return left < right ? -1 : 1\n}\n\n/** Compare prerelease identifier lists. A shorter list has lower precedence: `1.0.0-rc` < `1.0.0-rc.1`. */\nconst comparePrerelease = (a: string[], b: string[]): number => {\n  for (let index = 0; index < Math.max(a.length, b.length); index += 1) {\n    const left = a[index]\n    const right = b[index]\n\n    if (left === undefined) return -1\n    if (right === undefined) return 1\n    if (left !== right) return compareIdentifier(left, right)\n  }\n\n  return 0\n}\n\n/**\n * Is `latest` strictly newer than `current`? False when either is unparsable, so a bad registry\n * response can never trigger an install.\n *\n * The load-bearing case is NUMERIC, not lexical, comparison: `0.1.9` must be older than `0.1.130`.\n * A string compare would order them the other way and pin every user to the older build forever.\n *\n * A final release outranks its own prereleases (`1.0.0` > `1.0.0-rc.1`), so a user on `rc` is offered\n * the release, and a user on the release is never \"downgraded\" to an rc.\n *\n * @example\n * isNewerVersion('0.1.130', '0.1.9') // => true  (numeric, not lexical)\n * isNewerVersion('1.0.0', '1.0.0-rc.1') // => true\n * isNewerVersion('0.1.130', '0.1.130') // => false\n * isNewerVersion('garbage', '0.1.0') // => false\n */\nexport const isNewerVersion = (latest: string, current: string): boolean => {\n  const parsedLatest = parseSemver(latest)\n  const parsedCurrent = parseSemver(current)\n\n  if (!parsedLatest || !parsedCurrent) return false\n\n  for (let index = 0; index < 3; index += 1) {\n    const left = parsedLatest.release[index] as number\n    const right = parsedCurrent.release[index] as number\n\n    if (left !== right) return left > right\n  }\n\n  const latestIsFinal = parsedLatest.prerelease.length === 0\n  const currentIsFinal = parsedCurrent.prerelease.length === 0\n\n  if (latestIsFinal !== currentIsFinal) return latestIsFinal\n\n  return comparePrerelease(parsedLatest.prerelease, parsedCurrent.prerelease) > 0\n}\n", "/**\n * The throttle + notice state for the auto-update check, at `$cacheRoot/update-check.json`.\n *\n * `getCacheRoot()` \u2014 NOT `getSessionCacheDir()`, which throws unless `INFRA_KIT_SESSION` is set. A user\n * who installed this CLI globally and never ran `infra-kit init` has no session, and the update check\n * must still work for exactly that person.\n */\nimport fs from 'node:fs'\nimport path from 'node:path'\n\nimport { atomicWriteFileSync, getCacheRoot } from 'src/lib/constants'\n\nexport const CACHE_FILE_NAME = 'update-check.json'\n\n/**\n * The ONE re-check window, whatever the last outcome was. A background check is cheap \u2014 one detached\n * child and a single registry fetch bounded by `FETCH_TIMEOUT_MS` \u2014 but not once per shell command,\n * which is the storm this throttle exists to stop.\n *\n * There is deliberately no shorter \"retry after a transient failure\" window. One used to exist because\n * this interval was 24h, and burning a whole day on a single network blip locked out exactly the\n * publisher pushing a release mid-window. At 20 minutes that gap is gone: a blip costs one window, so\n * a second window buys nothing and cannot pay for what it costs (below).\n *\n * MUST stay above a full worker cycle: `runUpdateCheck` stamps `lastCheckMs` BEFORE waiting up to\n * `PARENT_WAIT_TIMEOUT_MS` (5min) for the parent to exit and THEN installing. Go below that and the\n * cache reads stale while the first worker is still legitimately working, so the next shell spawns a\n * worker that dies on the live single-flight lock and returns WITHOUT writing \u2014 leaving the cache stale\n * for every command until `LOCK_STALE_MS` (30min) reaps the lock. That is the per-command spawn storm\n * this throttle exists to prevent, and it is why a 5-minute retry window is not an option.\n */\nexport const CHECK_INTERVAL_MS = 20 * 60 * 1000\n\nexport interface UpdateCache {\n  /**\n   * When the last check was ATTEMPTED \u2014 never \"when it last succeeded\". An offline user whose fetch\n   * throws must still burn their window, or every single command spawns another doomed child.\n   */\n  lastCheckMs: number\n  /** Latest version seen on the registry, or null when the last attempt failed. */\n  latestVersion: string | null\n  /**\n   * The command the USER must run, set only when the worker was not allowed to install for them\n   * (Homebrew, or an install location it could not identify). Null means \"handled, say nothing\".\n   *\n   * The worker decides this, not the reader: identifying the owning package manager can cost an\n   * `npm root -g` subprocess, and the CLI startup path must never pay for one. The background child\n   * already pays it, so it writes the verdict down.\n   */\n  updateCommand: string[] | null\n  /**\n   * The last check's terminal outcome (`installed`, `fetch-failed`, `up-to-date`, \u2026), or absent on a\n   * cache written before this field existed.\n   *\n   * Diagnostic ONLY \u2014 nothing branches on it, {@link isStale} included. It earns its keep by being the\n   * one thing that makes this file legible: a successful `installed` and a failed `fetch-failed` both\n   * write a byte-identical `{latestVersion:null, updateCommand:null}`, so without this the cache cannot\n   * say which happened, and a silent auto-update leaves no other trace of what it did.\n   */\n  outcome?: string | null\n}\n\nexport const cacheFilePath = (): string => {\n  return path.join(getCacheRoot(), CACHE_FILE_NAME)\n}\n\nconst isStringArray = (value: unknown): value is string[] => {\n  return (\n    Array.isArray(value) &&\n    value.every((entry) => {\n      return typeof entry === 'string'\n    })\n  )\n}\n\nconst isUpdateCache = (value: unknown): value is UpdateCache => {\n  if (typeof value !== 'object' || value === null) return false\n\n  const { lastCheckMs, latestVersion, updateCommand, outcome } = value as Partial<UpdateCache>\n\n  return (\n    typeof lastCheckMs === 'number' &&\n    Number.isFinite(lastCheckMs) &&\n    (latestVersion === null || typeof latestVersion === 'string') &&\n    (updateCommand === null || isStringArray(updateCommand)) &&\n    (outcome === undefined || outcome === null || typeof outcome === 'string')\n  )\n}\n\n/**\n * Read the cache, or null when it is missing/unreadable/corrupt. A null read means \"stale\" to every\n * caller, so a first run and a hand-mangled file behave identically: check again.\n *\n * @example\n * readUpdateCache() // => { lastCheckMs: 1770000000000, latestVersion: '0.1.131' } | null\n */\nexport const readUpdateCache = (\n  readFile: (p: string) => string = (p) => {\n    return fs.readFileSync(p, 'utf8')\n  },\n): UpdateCache | null => {\n  try {\n    const parsed: unknown = JSON.parse(readFile(cacheFilePath()))\n\n    return isUpdateCache(parsed) ? parsed : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Persist the check result. Creates `$cacheRoot` first: `atomicWriteFileSync` writes a temp file\n * beside the target and renames, so it throws ENOENT on a machine that has never had a `~/.cache/infra-kit`.\n * Without this mkdir the write fails, `lastCheckMs` never lands, and the throttle degrades into a\n * detached-child spawn on every invocation.\n *\n * @example\n * writeUpdateCache({ lastCheckMs: Date.now(), latestVersion: '0.1.131' })\n */\nexport const writeUpdateCache = (cache: UpdateCache): void => {\n  const root = getCacheRoot()\n\n  fs.mkdirSync(root, { recursive: true })\n  atomicWriteFileSync(path.join(root, CACHE_FILE_NAME), JSON.stringify(cache), 0o600)\n}\n\n/**\n * Has the throttle window elapsed? A missing cache is stale by definition (first run).\n *\n * A `lastCheckMs` in the future (clock skew, or a restored backup) also reads as stale rather than\n * locking the user out of updates until their clock catches up.\n *\n * The window does NOT depend on `outcome`: every last outcome, transient or settled, is re-checked\n * after {@link CHECK_INTERVAL_MS}. See that constant for why a shorter transient-failure window is not\n * worth its cost here.\n *\n * @example\n * isStale(null, 1_000) // => true\n * isStale({ lastCheckMs: 0, latestVersion: null, updateCommand: null }, CHECK_INTERVAL_MS + 1) // => true\n */\nexport const isStale = (cache: UpdateCache | null, nowMs: number): boolean => {\n  if (!cache) return true\n\n  const elapsed = nowMs - cache.lastCheckMs\n\n  if (elapsed < 0) return true\n\n  return elapsed >= CHECK_INTERVAL_MS\n}\n"],
+  "mappings": "uFAQA,OAAOA,MAAU,YAGV,IAAMC,EAAe,YAEtBC,EAAS,GAAGD,CAAY,UAoCxBE,EAAW,CAACC,EAAgBC,EAAeC,IAAkC,CACjF,IAAMC,EAAMP,EAAK,SAASM,EAASN,EAAK,QAAQI,CAAM,CAAC,EAAGJ,EAAK,QAAQK,CAAK,CAAC,EAE7E,OAAOE,IAAQ,IAAM,CAACA,EAAI,WAAW,IAAI,GAAK,CAACP,EAAK,WAAWO,CAAG,CACpE,EAGMC,EAAa,CAACC,EAAWC,IACtBV,EAAK,QAAQS,CAAC,EAAE,MAAMT,EAAK,GAAG,EAAE,SAASU,CAAI,EAkBhDC,EAAc,CAACF,EAAWC,IAA0B,CACxD,IAAME,EAAWZ,EAAK,QAAQS,CAAC,EAAE,MAAMT,EAAK,GAAG,EACzCa,EAASD,EAAS,QAAQ,QAAQ,EAExC,OAAOC,IAAW,IAAMD,EAASC,EAAS,CAAC,IAAMH,CACnD,EAGMI,EAAc,CAACC,EAAwBC,EAAaC,EAAsBX,IAAkC,CAChH,IAAMY,EAAMH,EAAIC,CAAG,EAEnB,OAAOE,GAAO,MAAQA,IAAQ,IAAMf,EAASe,EAAKD,EAAcX,CAAQ,CAC1E,EAWMa,EAAsB,CAC1B,CACE,QAAS,QAET,KAAM,CAAC,CAAE,aAAAF,EAAc,IAAAF,EAAK,SAAAT,CAAS,IAEjCQ,EAAYC,EAAK,aAAcE,EAAcX,CAAQ,GACrDE,EAAWS,EAAc,QAAQ,GACjCT,EAAWS,EAAc,OAAO,EAGpC,cAAe,CAAC,QAAS,UAAWhB,CAAY,EAChD,aAAc,EAChB,EACA,CACE,QAAS,WAaT,KAAM,CAAC,CAAE,aAAAgB,CAAa,IACbN,EAAYM,EAAchB,CAAY,EAE/C,cAAe,CAAC,OAAQ,UAAWA,CAAY,EAC/C,aAAc,EAChB,EACA,CACE,QAAS,OACT,KAAM,CAAC,CAAE,aAAAgB,EAAc,IAAAF,EAAK,SAAAT,CAAS,IAEjCQ,EAAYC,EAAK,YAAaE,EAAcX,CAAQ,GACnDE,EAAWS,EAAc,MAAM,GAAKT,EAAWS,EAAc,QAAQ,EAG1E,cAAe,CAAC,OAAQ,MAAO,KAAMf,CAAM,EAC3C,aAAc,EAChB,EACA,CACE,QAAS,MACT,KAAM,CAAC,CAAE,aAAAe,EAAc,IAAAF,EAAK,SAAAT,CAAS,IAC5BQ,EAAYC,EAAK,cAAeE,EAAcX,CAAQ,GAAKE,EAAWS,EAAc,MAAM,EAEnG,cAAe,CAAC,MAAO,MAAO,KAAMf,CAAM,EAC1C,aAAc,EAChB,EACA,CACE,QAAS,OACT,KAAM,CAAC,CAAE,aAAAe,CAAa,IAElBT,EAAWS,EAAc,OAAO,GAAMT,EAAWS,EAAc,MAAM,GAAKT,EAAWS,EAAc,QAAQ,EAG/G,cAAe,CAAC,OAAQ,SAAU,MAAOf,CAAM,EAC/C,aAAc,EAChB,EACA,CACE,QAAS,MACT,KAAM,CAAC,CAAE,aAAAe,EAAc,IAAAF,EAAK,SAAAT,CAAS,IAC5BQ,EAAYC,EAAK,oBAAqBE,EAAcX,CAAQ,EAErE,cAAe,CAAC,MAAO,UAAW,KAAMJ,CAAM,EAC9C,aAAc,EAChB,CACF,EAEMkB,EAAqB,CAAC,MAAO,UAAW,KAAMlB,CAAM,EAc7CmB,EAAwBC,GAAyD,CAC5F,GAAM,CAAE,aAAAL,EAAc,IAAAF,EAAK,SAAAT,EAAU,YAAAiB,CAAY,EAAID,EAC/CE,EAAML,EAAS,KAAK,CAAC,CAAE,KAAAM,CAAK,IACzBA,EAAK,CAAE,aAAAR,EAAc,IAAAF,EAAK,SAAAT,CAAS,CAAC,CAC5C,EAED,GAAIkB,EAAK,MAAO,CAAE,QAASA,EAAI,QAAS,cAAeA,EAAI,cAAe,aAAcA,EAAI,YAAa,EAEzG,IAAME,EAAUH,IAAc,EAE9B,OAAIG,GAAW,MAAQA,IAAY,IAAMvB,EAASuB,EAAST,EAAcX,CAAQ,EACxE,CAAE,QAAS,MAAO,cAAec,EAAoB,aAAc,EAAK,EAG1E,CAAE,QAAS,UAAW,cAAeA,EAAoB,aAAc,EAAM,CACtF,EAmBaO,EAA4B,CAACV,EAAsBW,EAAatB,IACpEE,EAAWS,EAAc,cAAc,GAAKd,EAASyB,EAAKX,EAAcX,CAAQ,EC5NzF,OAAS,gBAAAuB,MAAoB,UAC7B,OAAOC,MAAU,YAUV,IAAMC,EAAgBC,GAAwB,CACnD,GAAI,CACF,OAAOH,EAAaG,CAAG,CACzB,MAAQ,CACN,OAAOF,EAAK,QAAQE,CAAG,CACzB,CACF,ECLA,OAAS,gBAAAC,MAAoB,qBAC7B,OAAOC,MAAa,eAEpB,IAAMC,EAAsB,IAafC,EAAqB,IAA0B,CAC1D,GAAI,CAOF,IAAMC,EANMJ,EAAa,MAAO,CAAC,OAAQ,IAAI,EAAG,CAC9C,SAAU,QACV,QAASE,EACT,MAAO,CAAC,SAAU,OAAQ,QAAQ,EAClC,MAAOD,EAAQ,WAAa,OAC9B,CAAC,EACmB,KAAK,EAEzB,OAAOG,IAAY,GAAK,OAAYA,CACtC,MAAQ,CACN,MACF,CACF,EC/BA,OAAS,aAAAC,OAAiB,qBAC1B,OAAS,WAAAC,OAAe,UACxB,OAAOC,MAAa,eCFpB,OAAOC,MAAQ,UACf,OAAOC,MAAU,YACjB,OAAOC,MAAa,eAIb,IAAMC,EAAiB,oBAiBjBC,EAAgB,KAAU,IAE1BC,GAAe,IACnBC,EAAK,KAAKC,EAAa,EAAGJ,CAAc,EAS3CK,GAAc,CAACC,EAAkBC,IAAwB,CAC7D,GAAI,CACEA,EAAQC,EAAG,SAASF,CAAQ,EAAE,QAAUL,GAAeO,EAAG,OAAOF,EAAU,CAAE,MAAO,EAAK,CAAC,CAChG,MAAQ,CAER,CACF,EAaaG,EAAoB,CAACC,EAAiB,CAAC,IAA2B,CAC7E,IAAMH,EAAQG,EAAK,OAAS,KAAK,IAAI,EAC/BJ,EAAWI,EAAK,UAAYR,GAAa,EAE/C,GAAI,CACFM,EAAG,UAAUL,EAAK,QAAQG,CAAQ,EAAG,CAAE,UAAW,EAAK,CAAC,CAC1D,MAAQ,CACN,OAAO,IACT,CAEA,IAAMK,EAAO,IAAqB,CAChC,GAAI,CAEF,OAAOH,EAAG,SAASF,EAAU,KAAM,GAAK,CAC1C,MAAQ,CACN,OAAO,IACT,CACF,EAEIM,EAAKD,EAAK,EAQd,GANIC,IAAO,OACTP,GAAYC,EAAUC,CAAK,EAE3BK,EAAKD,EAAK,GAGRC,IAAO,KAAM,OAAO,KAExB,GAAI,CACFJ,EAAG,cAAcI,EAAI,OAAOC,EAAQ,GAAG,CAAC,CAC1C,MAAQ,CAER,CAEA,MAAO,IAAM,CACX,GAAI,CACFL,EAAG,UAAUI,CAAE,CACjB,MAAQ,CAER,CAEA,GAAI,CACFJ,EAAG,OAAOF,EAAU,CAAE,MAAO,EAAK,CAAC,CACrC,MAAQ,CAER,CACF,CACF,EC3GO,IAAMQ,GAAmB,6BAQnBC,GAAmB,IAkB1BC,GAAsBC,GACd,OAAO,QAAQA,CAAG,EAAE,KAAK,CAAC,CAACC,EAAKC,CAAK,IACxC,yBAAyB,KAAKD,CAAG,GAAKC,GAAS,MAAQA,IAAU,EACzE,IAEY,CAAC,EAGHC,GAAeH,GAAmC,CAC7D,IAAMI,EAAaL,GAAmBC,CAAG,EAErCK,EAAOD,GAAc,MAAQA,IAAe,GAAKA,EAAaP,GAGlE,KAAOQ,EAAK,SAAS,GAAG,GACtBA,EAAOA,EAAK,MAAM,EAAG,EAAE,EAGzB,OAAOA,CACT,EASaC,EAAqB,MAChCN,EACAO,EAAwB,QACG,CAC3B,IAAMC,EAAa,IAAI,gBACjBC,EAAQ,WAAW,IAAM,CAC7BD,EAAW,MAAM,CACnB,EAAGV,EAAgB,EAEnB,GAAI,CACF,IAAMY,EAAW,MAAMH,EAAQ,GAAGJ,GAAYH,CAAG,CAAC,IAAIW,CAAY,UAAW,CAC3E,OAAQH,EAAW,OACnB,QAAS,CAAE,OAAQ,kBAAmB,CACxC,CAAC,EAED,GAAI,CAACE,EAAS,GAAI,OAAO,KAGzB,IAAME,GADgB,MAAMF,EAAS,KAAK,IACc,QAExD,OAAO,OAAOE,GAAY,UAAYA,IAAY,GAAKA,EAAU,IACnE,MAAQ,CACN,OAAO,IACT,QAAE,CACA,aAAaH,CAAK,CACpB,CACF,ECtEA,IAAMI,GAAkB,wBAYXC,EAAeC,GAA0C,CAEpE,GAAM,CAACC,EAAe,EAAE,EAAID,EAAQ,KAAK,EAAE,MAAM,GAAG,EAC9C,CAACE,EAAO,GAAI,GAAGC,CAAe,EAAIF,EAAa,MAAM,GAAG,EACxDG,EAAQN,GAAgB,KAAKI,CAAI,EAEvC,GAAI,CAACE,EAAO,OAAO,KAEnB,GAAM,CAACC,EAAOC,EAAOC,CAAK,EAAI,CAACH,EAAM,CAAC,EAAGA,EAAM,CAAC,EAAGA,EAAM,CAAC,CAAC,EAAE,IAAI,MAAM,EAEvE,MAAO,CACL,QAAS,CAACC,EAAOC,EAAOC,CAAK,EAE7B,WAAYJ,EAAgB,OAAS,EAAIA,EAAgB,KAAK,GAAG,EAAE,MAAM,GAAG,EAAI,CAAC,CACnF,CACF,EAEMK,EAAqB,QAGrBC,GAAoB,CAACC,EAAcC,IAA0B,CACjE,IAAMC,EAAcJ,EAAmB,KAAKE,CAAI,EAC1CG,EAAeL,EAAmB,KAAKG,CAAK,EAElD,OAAIC,GAAeC,EAAqB,OAAOH,CAAI,EAAI,OAAOC,CAAK,EAC/DC,IAAgBC,EAAqBD,EAAc,GAAK,EAErDF,EAAOC,EAAQ,GAAK,CAC7B,EAGMG,GAAoB,CAACC,EAAaC,IAAwB,CAC9D,QAASC,EAAQ,EAAGA,EAAQ,KAAK,IAAIF,EAAE,OAAQC,EAAE,MAAM,EAAGC,GAAS,EAAG,CACpE,IAAMP,EAAOK,EAAEE,CAAK,EACdN,EAAQK,EAAEC,CAAK,EAErB,GAAIP,IAAS,OAAW,MAAO,GAC/B,GAAIC,IAAU,OAAW,MAAO,GAChC,GAAID,IAASC,EAAO,OAAOF,GAAkBC,EAAMC,CAAK,CAC1D,CAEA,MAAO,EACT,EAkBaO,EAAiB,CAACC,EAAgBC,IAA6B,CAC1E,IAAMC,EAAetB,EAAYoB,CAAM,EACjCG,EAAgBvB,EAAYqB,CAAO,EAEzC,GAAI,CAACC,GAAgB,CAACC,EAAe,MAAO,GAE5C,QAASL,EAAQ,EAAGA,EAAQ,EAAGA,GAAS,EAAG,CACzC,IAAMP,EAAOW,EAAa,QAAQJ,CAAK,EACjCN,EAAQW,EAAc,QAAQL,CAAK,EAEzC,GAAIP,IAASC,EAAO,OAAOD,EAAOC,CACpC,CAEA,IAAMY,EAAgBF,EAAa,WAAW,SAAW,EACnDG,EAAiBF,EAAc,WAAW,SAAW,EAE3D,OAAIC,IAAkBC,EAAuBD,EAEtCT,GAAkBO,EAAa,WAAYC,EAAc,UAAU,EAAI,CAChF,ECpGA,OAAOG,MAAQ,UACf,OAAOC,MAAU,YAIV,IAAMC,EAAkB,oBAmBlBC,GAAoB,KAAU,IA+B9BC,GAAgB,IACpBC,EAAK,KAAKC,EAAa,EAAGJ,CAAe,EAG5CK,GAAiBC,GAEnB,MAAM,QAAQA,CAAK,GACnBA,EAAM,MAAOC,GACJ,OAAOA,GAAU,QACzB,EAICC,GAAiBF,GAAyC,CAC9D,GAAI,OAAOA,GAAU,UAAYA,IAAU,KAAM,MAAO,GAExD,GAAM,CAAE,YAAAG,EAAa,cAAAC,EAAe,cAAAC,EAAe,QAAAC,CAAQ,EAAIN,EAE/D,OACE,OAAOG,GAAgB,UACvB,OAAO,SAASA,CAAW,IAC1BC,IAAkB,MAAQ,OAAOA,GAAkB,YACnDC,IAAkB,MAAQN,GAAcM,CAAa,KAC5BC,GAAY,MAAQ,OAAOA,GAAY,SAErE,EASaC,GAAkB,CAC7BC,EAAmCC,GAC1BC,EAAG,aAAaD,EAAG,MAAM,IAEX,CACvB,GAAI,CACF,IAAME,EAAkB,KAAK,MAAMH,EAASZ,GAAc,CAAC,CAAC,EAE5D,OAAOM,GAAcS,CAAM,EAAIA,EAAS,IAC1C,MAAQ,CACN,OAAO,IACT,CACF,EAWaC,EAAoBC,GAA6B,CAC5D,IAAMC,EAAOhB,EAAa,EAE1BY,EAAG,UAAUI,EAAM,CAAE,UAAW,EAAK,CAAC,EACtCC,EAAoBlB,EAAK,KAAKiB,EAAMpB,CAAe,EAAG,KAAK,UAAUmB,CAAK,EAAG,GAAK,CACpF,EAgBaG,GAAU,CAACH,EAA2BI,IAA2B,CAC5E,GAAI,CAACJ,EAAO,MAAO,GAEnB,IAAMK,EAAUD,EAAQJ,EAAM,YAE9B,OAAIK,EAAU,EAAU,GAEjBA,GAAWvB,EACpB,EJ3HO,IAAMwB,GAA0B,IAO1BC,GAAyB,IAAS,IAsBzCC,GAAyBC,GAAyB,CACtD,GAAI,CACF,OAAAC,EAAQ,KAAKD,EAAK,CAAC,EAEZ,EACT,MAAQ,CACN,MAAO,EACT,CACF,EAEME,GAAgBC,GACb,IAAI,QAASC,GAAY,CAC9B,WAAWA,EAASD,CAAE,CACxB,CAAC,EAOGE,GAAoB,MACxBC,EACAC,IACqB,CACrB,IAAMC,EAAWD,EAAK,MAAM,EAAIT,GAEhC,KAAOS,EAAK,MAAM,EAAIC,GAAU,CAC9B,GAAI,CAACD,EAAK,eAAeD,CAAS,EAAG,MAAO,GAE5C,MAAMC,EAAK,MAAMV,EAAuB,CAC1C,CAEA,MAAO,CAACU,EAAK,eAAeD,CAAS,CACvC,EAuBaG,GAAiB,MAAOC,EAAwBH,IAA0D,CAMrH,IAAMI,GALcJ,EAAK,aAAeK,GAKZ,EAE5B,GAAI,CAACD,EAAS,MAAO,kBAErB,GAAI,CACF,OAAO,MAAME,GAAqBH,EAAgBH,CAAI,CACxD,QAAE,CACAI,EAAQ,CACV,CACF,EAEME,GAAuB,MAAOH,EAAwBH,IAA0D,CACpH,IAAMO,EAAMP,EAAK,KAAON,EAAQ,IAC1Bc,EAAQR,EAAK,OAAS,KAAK,IAAI,EAC/BS,EAAcT,EAAK,aAAeU,EAClCC,EAAaX,EAAK,YAAcY,EAChCC,EAAiBb,EAAK,gBAAkBR,GACxCsB,EAAQd,EAAK,OAASL,GACtBoB,EAAQf,EAAK,OAAS,KAAK,IAC3BgB,EAAchB,EAAK,aAAeiB,EAClCC,EAAQlB,EAAK,WAAamB,GAE1BC,EAAgB,MAAMX,EAAYF,CAAG,EAKrCc,EAAS,CACbC,EACAC,KAKAZ,EAAW,CAAE,YAAaH,EAAO,GAAGe,EAAO,QAAAD,CAAQ,CAAC,EAE7CA,GAGT,GAAIF,IAAkB,KAAM,OAAOC,EAAO,eAAgB,CAAE,cAAe,KAAM,cAAe,IAAK,CAAC,EACtG,GAAI,CAACG,EAAeJ,EAAejB,CAAc,EAC/C,OAAOkB,EAAO,aAAc,CAAE,cAAAD,EAAe,cAAe,IAAK,CAAC,EAMpE,GAAM,CAAE,aAAAK,EAAc,cAAAC,CAAc,EAAIC,EAAqB,CAC3D,aAAc3B,EAAK,aACnB,IAAAO,EACA,SAAUqB,EACV,YAAAZ,CACF,CAAC,EAID,GAAI,CAACS,EAAc,OAAOJ,EAAO,oBAAqB,CAAE,cAAAD,EAAe,cAAAM,CAAc,CAAC,EAKtF,GAAI1B,EAAK,WAAa,KAAM,OAAOqB,EAAO,iBAAkB,CAAE,cAAAD,EAAe,cAAe,IAAK,CAAC,EAqBlG,GALAT,EAAW,CAAE,YAAaH,EAAO,cAAAY,EAAe,cAAe,KAAM,QAAS,YAAa,CAAC,EAKxF,CAHe,MAAMtB,GAAkBE,EAAK,UAAW,CAAE,eAAAa,EAAgB,MAAAC,EAAO,MAAAC,CAAM,CAAC,EAG1E,OAAOM,EAAO,uBAAwB,CAAE,cAAAD,EAAe,cAAe,IAAK,CAAC,EAgB7F,IAAMS,EAASX,EAAMQ,EAAc,CAAC,EAAaA,EAAc,MAAM,CAAC,EAAG,CACvE,MAAO,SACP,MAAOhC,EAAQ,WAAa,QAC5B,IAAKoC,GAAQ,EACb,IAAKC,EAAyBxB,CAAG,EACjC,YAAa,EACf,CAAC,EAID,OAAIsB,EAAO,OAASA,EAAO,QAAUA,EAAO,SAAW,EAC9CR,EAAO,iBAAkB,CAAE,cAAAD,EAAe,cAAAM,CAAc,CAAC,EAI3DL,EAAO,YAAa,CAAE,cAAe,KAAM,cAAe,IAAK,CAAC,CACzE",
+  "names": ["path", "PACKAGE_NAME", "LATEST", "isWithin", "parent", "child", "realpath", "rel", "hasSegment", "p", "name", "isBrewKegOf", "segments", "cellar", "underEnvDir", "env", "key", "selfRealPath", "dir", "MATCHERS", "NPM_UPDATE_COMMAND", "detectInstallManager", "input", "lazyNpmRoot", "hit", "test", "npmRoot", "isLocalNodeModulesInstall", "cwd", "realpathSync", "path", "safeRealpath", "dir", "execFileSync", "process", "NPM_ROOT_TIMEOUT_MS", "defaultLazyNpmRoot", "trimmed", "spawnSync", "homedir", "process", "fs", "path", "process", "LOCK_FILE_NAME", "LOCK_STALE_MS", "lockFilePath", "path", "getCacheRoot", "reapIfStale", "lockPath", "nowMs", "fs", "acquireUpdateLock", "deps", "open", "fd", "process", "DEFAULT_REGISTRY", "FETCH_TIMEOUT_MS", "configuredRegistry", "env", "key", "value", "registryUrl", "configured", "base", "fetchLatestVersion", "fetchFn", "controller", "timer", "response", "PACKAGE_NAME", "version", "RELEASE_PATTERN", "parseSemver", "version", "withoutBuild", "core", "prereleaseParts", "match", "major", "minor", "patch", "NUMERIC_IDENTIFIER", "compareIdentifier", "left", "right", "leftNumeric", "rightNumeric", "comparePrerelease", "a", "b", "index", "isNewerVersion", "latest", "current", "parsedLatest", "parsedCurrent", "latestIsFinal", "currentIsFinal", "fs", "path", "CACHE_FILE_NAME", "CHECK_INTERVAL_MS", "cacheFilePath", "path", "getCacheRoot", "isStringArray", "value", "entry", "isUpdateCache", "lastCheckMs", "latestVersion", "updateCommand", "outcome", "readUpdateCache", "readFile", "p", "fs", "parsed", "writeUpdateCache", "cache", "root", "atomicWriteFileSync", "isStale", "nowMs", "elapsed", "PARENT_POLL_INTERVAL_MS", "PARENT_WAIT_TIMEOUT_MS", "defaultIsProcessAlive", "pid", "process", "defaultSleep", "ms", "resolve", "waitForParentExit", "parentPid", "deps", "deadline", "runUpdateCheck", "currentVersion", "release", "acquireUpdateLock", "runUpdateCheckLocked", "env", "nowMs", "fetchLatest", "fetchLatestVersion", "writeCache", "writeUpdateCache", "isProcessAlive", "sleep", "clock", "lazyNpmRoot", "defaultLazyNpmRoot", "spawn", "spawnSync", "latestVersion", "finish", "outcome", "cache", "isNewerVersion", "canSelfSpawn", "updateCommand", "detectInstallManager", "safeRealpath", "result", "homedir", "packageManagerInstallEnv"]
+}

package/dist/{chunk-A7FAXZGI.js → chunk-LKKKDB6V.js}

@@ -1,2 +1,2 @@
 var r=t=>Object.fromEntries(Object.entries(t).filter(([e])=>!e.startsWith("npm_")&&e!=="PNPM_SCRIPT_SRC_DIR")),o=/^npm_config_(?:prefix|registry)$/i,a=t=>{let e=r(t);for(let[n,s]of Object.entries(t))o.test(n)&&(e[n]=s);return e};export{r as a,a as b};
-//# sourceMappingURL=chunk-A7FAXZGI.js.map
+//# sourceMappingURL=chunk-LKKKDB6V.js.map

package/dist/{chunk-A7FAXZGI.js.map → chunk-LKKKDB6V.js.map}

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/lib/pm-env/pm-env.ts"],
-  "sourcesContent": ["/**\n * `env` minus every package-manager marker a spawned child could mistake for a throwaway install.\n *\n * Any child we launch through `node <bin>` (the portless driver, self-update, the mcp launcher) inherits\n * our env, and a tool that sniffs those markers will conclude it was run via `npx`/`pnpm dlx` and refuse\n * to work. portless is the motivating case; its guard (cli.js `main()`) is:\n *\n *     isNpx     = npm_command === 'exec' && !npm_lifecycle_event\n *     isPnpmDlx = !!PNPM_SCRIPT_SRC_DIR  && !npm_lifecycle_event\n *     if ((isNpx || isPnpmDlx) && !isLocallyInstalled()) \u2192 abort\n *\n * `isLocallyInstalled()` walks up from the CHILD's cwd, so in a consumer repo (where portless is a\n * transitive dep of infra-kit, absent from the root `node_modules`) it is false and the guard is live.\n * `pnpm exec infra-kit dev` exports `npm_command=exec` with no lifecycle event \u2192 `isNpx` \u2192 every\n * portless call exits 1 \u2192 `isAvailable()` is false \u2192 `ensureProxy` aborts the whole dev boot with\n * \"portless is not installed\", on a machine where it plainly is.\n *\n * `PNPM_SCRIPT_SRC_DIR` must be dropped ALONGSIDE the `npm_*` block, not left behind: it is set by\n * `pnpm run <script>`, where `npm_lifecycle_event` is what suppresses `isPnpmDlx`. Stripping only\n * `npm_*` removes that suppressor and *creates* an abort for the script-style invocation that\n * previously worked. Both markers go, or neither is safe.\n *\n * The result makes the child look exactly like a direct `node <pkg>/dist/cli.js` run \u2014 which it is.\n */\nexport const withoutPackageManagerEnv = (env: NodeJS.ProcessEnv): NodeJS.ProcessEnv => {\n  return Object.fromEntries(\n    Object.entries(env).filter(([key]) => {\n      return !key.startsWith('npm_') && key !== 'PNPM_SCRIPT_SRC_DIR'\n    }),\n  )\n}\n\n/**\n * npm's own configuration \u2014 as opposed to the npx/dlx *markers* above. Case-insensitive because npm reads\n * `npm_config_*` case-insensitively (its parser matches `/^npm_config_/i`) and real environments export\n * both forms: shells write the lowercase name, Dockerfiles and CI images overwhelmingly write the\n * uppercase one.\n */\nconst NPM_CONFIG_TO_PRESERVE = /^npm_config_(?:prefix|registry)$/i\n\n/**\n * The env for spawning a package-manager INSTALL: npx/dlx markers stripped, but npm's own config kept.\n *\n * {@link withoutPackageManagerEnv} is deliberately a blunt `npm_*` prefix filter, and it is the right tool\n * for the portless driver \u2014 but it is the WRONG tool for spawning an install, because it also drops the two\n * variables that tell the package manager *where* and *from where* to install:\n *\n *   - `npm_config_prefix` is the npm matcher's ONLY signal (see `install-manager.ts`). Strip it and we\n *     detect a global install rooted at prefix P, then run the install with P erased \u2014 so it lands in the\n *     DEFAULT prefix instead. That is either a permanent EACCES, or a second global copy that is not the\n *     one on PATH. Nothing notices: the install exits 0, we report `installed`, the version on PATH never\n *     moves, and the whole cycle repeats every 24h forever. `export npm_config_prefix=~/.npm-global` is\n *     npm's own documented EACCES workaround, so this is a mainstream layout, not an exotic one.\n *   - `npm_config_registry` is what the update CHECK already used to pick a registry. Dropping it here\n *     means we decide against a corporate mirror and then install from somewhere else.\n *\n * Preserving these cannot re-arm the dlx guard: that guard reads `npm_command`, `npm_lifecycle_event`, and\n * `PNPM_SCRIPT_SRC_DIR` \u2014 none of which are npm *config*, and all of which remain stripped.\n *\n * @example\n * packageManagerInstallEnv({ npm_command: 'exec', npm_config_prefix: '/p', PATH: '/bin' })\n * // => { npm_config_prefix: '/p', PATH: '/bin' }\n */\nexport const packageManagerInstallEnv = (env: NodeJS.ProcessEnv): NodeJS.ProcessEnv => {\n  const sanitised = withoutPackageManagerEnv(env)\n\n  for (const [key, value] of Object.entries(env)) {\n    if (NPM_CONFIG_TO_PRESERVE.test(key)) sanitised[key] = value\n  }\n\n  return sanitised\n}\n"],
+  "sourcesContent": ["/**\n * `env` minus every package-manager marker a spawned child could mistake for a throwaway install.\n *\n * Any child we launch through `node <bin>` (the portless driver, self-update, the mcp launcher) inherits\n * our env, and a tool that sniffs those markers will conclude it was run via `npx`/`pnpm dlx` and refuse\n * to work. portless is the motivating case; its guard (cli.js `main()`) is:\n *\n *     isNpx     = npm_command === 'exec' && !npm_lifecycle_event\n *     isPnpmDlx = !!PNPM_SCRIPT_SRC_DIR  && !npm_lifecycle_event\n *     if ((isNpx || isPnpmDlx) && !isLocallyInstalled()) \u2192 abort\n *\n * `isLocallyInstalled()` walks up from the CHILD's cwd, so in a consumer repo (where portless is a\n * transitive dep of infra-kit, absent from the root `node_modules`) it is false and the guard is live.\n * `pnpm exec infra-kit dev` exports `npm_command=exec` with no lifecycle event \u2192 `isNpx` \u2192 every\n * portless call exits 1 \u2192 `isAvailable()` is false \u2192 `ensureProxy` aborts the whole dev boot with\n * \"portless is not installed\", on a machine where it plainly is.\n *\n * `PNPM_SCRIPT_SRC_DIR` must be dropped ALONGSIDE the `npm_*` block, not left behind: it is set by\n * `pnpm run <script>`, where `npm_lifecycle_event` is what suppresses `isPnpmDlx`. Stripping only\n * `npm_*` removes that suppressor and *creates* an abort for the script-style invocation that\n * previously worked. Both markers go, or neither is safe.\n *\n * The result makes the child look exactly like a direct `node <pkg>/dist/cli.js` run \u2014 which it is.\n */\nexport const withoutPackageManagerEnv = (env: NodeJS.ProcessEnv): NodeJS.ProcessEnv => {\n  return Object.fromEntries(\n    Object.entries(env).filter(([key]) => {\n      return !key.startsWith('npm_') && key !== 'PNPM_SCRIPT_SRC_DIR'\n    }),\n  )\n}\n\n/**\n * npm's own configuration \u2014 as opposed to the npx/dlx *markers* above. Case-insensitive because npm reads\n * `npm_config_*` case-insensitively (its parser matches `/^npm_config_/i`) and real environments export\n * both forms: shells write the lowercase name, Dockerfiles and CI images overwhelmingly write the\n * uppercase one.\n */\nconst NPM_CONFIG_TO_PRESERVE = /^npm_config_(?:prefix|registry)$/i\n\n/**\n * The env for spawning a package-manager INSTALL: npx/dlx markers stripped, but npm's own config kept.\n *\n * {@link withoutPackageManagerEnv} is deliberately a blunt `npm_*` prefix filter, and it is the right tool\n * for the portless driver \u2014 but it is the WRONG tool for spawning an install, because it also drops the two\n * variables that tell the package manager *where* and *from where* to install:\n *\n *   - `npm_config_prefix` is the npm matcher's ONLY signal (see `install-manager.ts`). Strip it and we\n *     detect a global install rooted at prefix P, then run the install with P erased \u2014 so it lands in the\n *     DEFAULT prefix instead. That is either a permanent EACCES, or a second global copy that is not the\n *     one on PATH. Nothing notices: the install exits 0, we report `installed`, the version on PATH never\n *     moves, and the whole cycle repeats every window forever. `export npm_config_prefix=~/.npm-global` is\n *     npm's own documented EACCES workaround, so this is a mainstream layout, not an exotic one.\n *   - `npm_config_registry` is what the update CHECK already used to pick a registry. Dropping it here\n *     means we decide against a corporate mirror and then install from somewhere else.\n *\n * Preserving these cannot re-arm the dlx guard: that guard reads `npm_command`, `npm_lifecycle_event`, and\n * `PNPM_SCRIPT_SRC_DIR` \u2014 none of which are npm *config*, and all of which remain stripped.\n *\n * @example\n * packageManagerInstallEnv({ npm_command: 'exec', npm_config_prefix: '/p', PATH: '/bin' })\n * // => { npm_config_prefix: '/p', PATH: '/bin' }\n */\nexport const packageManagerInstallEnv = (env: NodeJS.ProcessEnv): NodeJS.ProcessEnv => {\n  const sanitised = withoutPackageManagerEnv(env)\n\n  for (const [key, value] of Object.entries(env)) {\n    if (NPM_CONFIG_TO_PRESERVE.test(key)) sanitised[key] = value\n  }\n\n  return sanitised\n}\n"],
   "mappings": "AAwBO,IAAMA,EAA4BC,GAChC,OAAO,YACZ,OAAO,QAAQA,CAAG,EAAE,OAAO,CAAC,CAACC,CAAG,IACvB,CAACA,EAAI,WAAW,MAAM,GAAKA,IAAQ,qBAC3C,CACH,EASIC,EAAyB,oCAyBlBC,EAA4BH,GAA8C,CACrF,IAAMI,EAAYL,EAAyBC,CAAG,EAE9C,OAAW,CAACC,EAAKI,CAAK,IAAK,OAAO,QAAQL,CAAG,EACvCE,EAAuB,KAAKD,CAAG,IAAGG,EAAUH,CAAG,EAAII,GAGzD,OAAOD,CACT",
   "names": ["withoutPackageManagerEnv", "env", "key", "NPM_CONFIG_TO_PRESERVE", "packageManagerInstallEnv", "sanitised", "value"]
 }

package/dist/{chunk-T74NOBEP.js → chunk-N6ML3SBF.js}

@@ -1,2 +1,2 @@
-var i={name:"infra-kit",type:"module",version:"0.3.6",files:["dist"],description:"infra-kit",bin:{"infra-kit":"dist/cli.js",ik:"dist/cli.js"},engines:{node:">=24.x"},scripts:{inspector:"npx @modelcontextprotocol/inspector node ./dist/mcp.js --debug",build:"pnpm run clean-artifacts && node ./scripts/build.js",prepack:"pnpm run build",prepublishOnly:"pnpm run build","infra-kit-check":"pnpm exec infra-kit audit","clean-artifacts":"rm -rf dist","clean-cache":"rm -rf node_modules/.cache .eslintcache tsconfig.tsbuildinfo .turbo .swc","prettier-fix":"pnpm exec prettier **/* --write --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore","prettier-check":"pnpm exec prettier **/* --check --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore","eslint-check":"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src","eslint-fix":"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src --fix","ts-check":"tsc --noEmit",test:"pnpm exec vitest run --reporter=minimal","test-watch":"pnpm exec vitest --watch --silent passed-only","test-ui":"pnpm exec vitest --ui --silent passed-only","test-report":"pnpm exec vitest run --coverage --silent passed-only",qa:"pnpm run prettier-check && pnpm run eslint-check && pnpm run ts-check && pnpm run test && echo \u2705 Success",fix:"pnpm run prettier-fix && pnpm run eslint-fix && pnpm run qa"},dependencies:{"@aws-lambda-powertools/logger":"^2.33.1","@inquirer/checkbox":"^5.2.1","@inquirer/confirm":"^6.1.1","@inquirer/password":"^5.0.2","@inquirer/select":"^5.2.1","@modelcontextprotocol/sdk":"^1.29.0","@slip-stream-kit/config":"^0.3.3",chalk:"^5.6.2",chokidar:"^5.0.0",commander:"^15.0.0",fastify:"5.10.0",ink:"^7.1.0",pino:"^10.3.1","pino-pretty":"^13.1.3",portless:"^0.15.2",react:"19.2.7",yaml:"^2.9.0",zod:"^4.4.3",zx:"^8.8.5"},devDependencies:{"@types/aws-lambda":"^8.10.162","@types/react":"19.2.17","@wl/eslint-config":"workspace:*","@wl/vitest-config":"workspace:*",esbuild:"^0.28.1","ink-testing-library":"^4.0.0",typescript:"^6.0.3"}};export{i as a};
-//# sourceMappingURL=chunk-T74NOBEP.js.map
+var i={name:"infra-kit",type:"module",version:"0.3.7",files:["dist"],description:"infra-kit",bin:{"infra-kit":"dist/cli.js",ik:"dist/cli.js"},engines:{node:">=24.x"},scripts:{inspector:"npx @modelcontextprotocol/inspector node ./dist/mcp.js --debug",build:"pnpm run clean-artifacts && node ./scripts/build.js",prepack:"pnpm run build",prepublishOnly:"pnpm run build","infra-kit-check":"pnpm exec infra-kit audit","clean-artifacts":"rm -rf dist","clean-cache":"rm -rf node_modules/.cache .eslintcache tsconfig.tsbuildinfo .turbo .swc","prettier-fix":"pnpm exec prettier **/* --write --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore","prettier-check":"pnpm exec prettier **/* --check --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore","eslint-check":"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src","eslint-fix":"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src --fix","ts-check":"tsc --noEmit",test:"pnpm exec vitest run --reporter=minimal","test-watch":"pnpm exec vitest --watch --silent passed-only","test-ui":"pnpm exec vitest --ui --silent passed-only","test-report":"pnpm exec vitest run --coverage --silent passed-only",qa:"pnpm run prettier-check && pnpm run eslint-check && pnpm run ts-check && pnpm run test && echo \u2705 Success",fix:"pnpm run prettier-fix && pnpm run eslint-fix && pnpm run qa"},dependencies:{"@aws-lambda-powertools/logger":"^2.33.1","@inquirer/checkbox":"^5.2.1","@inquirer/confirm":"^6.1.1","@inquirer/password":"^5.0.2","@inquirer/select":"^5.2.1","@modelcontextprotocol/sdk":"^1.29.0","@slip-stream-kit/config":"^0.3.3",chalk:"^5.6.2",chokidar:"^5.0.0",commander:"^15.0.0",fastify:"5.10.0",ink:"^7.1.0",pino:"^10.3.1","pino-pretty":"^13.1.3",portless:"^0.15.2",react:"19.2.7",yaml:"^2.9.0",zod:"^4.4.3",zx:"^8.8.5"},devDependencies:{"@types/aws-lambda":"^8.10.162","@types/react":"19.2.17","@wl/eslint-config":"workspace:*","@wl/vitest-config":"workspace:*",esbuild:"^0.28.1","ink-testing-library":"^4.0.0",typescript:"^6.0.3"}};export{i as a};
+//# sourceMappingURL=chunk-N6ML3SBF.js.map

package/dist/{chunk-T74NOBEP.js.map → chunk-N6ML3SBF.js.map}

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../package.json"],
-  "sourcesContent": ["{\n  \"name\": \"infra-kit\",\n  \"type\": \"module\",\n  \"version\": \"0.3.6\",\n  \"files\": [\n    \"dist\"\n  ],\n  \"description\": \"infra-kit\",\n  \"bin\": {\n    \"infra-kit\": \"dist/cli.js\",\n    \"ik\": \"dist/cli.js\"\n  },\n  \"engines\": {\n    \"node\": \">=24.x\"\n  },\n  \"scripts\": {\n    \"inspector\": \"npx @modelcontextprotocol/inspector node ./dist/mcp.js --debug\",\n    \"build\": \"pnpm run clean-artifacts && node ./scripts/build.js\",\n    \"prepack\": \"pnpm run build\",\n    \"prepublishOnly\": \"pnpm run build\",\n    \"infra-kit-check\": \"pnpm exec infra-kit audit\",\n    \"clean-artifacts\": \"rm -rf dist\",\n    \"clean-cache\": \"rm -rf node_modules/.cache .eslintcache tsconfig.tsbuildinfo .turbo .swc\",\n    \"prettier-fix\": \"pnpm exec prettier **/* --write --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore\",\n    \"prettier-check\": \"pnpm exec prettier **/* --check --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore\",\n    \"eslint-check\": \"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src\",\n    \"eslint-fix\": \"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src --fix\",\n    \"ts-check\": \"tsc --noEmit\",\n    \"test\": \"pnpm exec vitest run --reporter=minimal\",\n    \"test-watch\": \"pnpm exec vitest --watch --silent passed-only\",\n    \"test-ui\": \"pnpm exec vitest --ui --silent passed-only\",\n    \"test-report\": \"pnpm exec vitest run --coverage --silent passed-only\",\n    \"qa\": \"pnpm run prettier-check && pnpm run eslint-check && pnpm run ts-check && pnpm run test && echo \u2705 Success\",\n    \"fix\": \"pnpm run prettier-fix && pnpm run eslint-fix && pnpm run qa\"\n  },\n  \"dependencies\": {\n    \"@aws-lambda-powertools/logger\": \"^2.33.1\",\n    \"@inquirer/checkbox\": \"^5.2.1\",\n    \"@inquirer/confirm\": \"^6.1.1\",\n    \"@inquirer/password\": \"^5.0.2\",\n    \"@inquirer/select\": \"^5.2.1\",\n    \"@modelcontextprotocol/sdk\": \"^1.29.0\",\n    \"@slip-stream-kit/config\": \"^0.3.3\",\n    \"chalk\": \"^5.6.2\",\n    \"chokidar\": \"^5.0.0\",\n    \"commander\": \"^15.0.0\",\n    \"fastify\": \"5.10.0\",\n    \"ink\": \"^7.1.0\",\n    \"pino\": \"^10.3.1\",\n    \"pino-pretty\": \"^13.1.3\",\n    \"portless\": \"^0.15.2\",\n    \"react\": \"19.2.7\",\n    \"yaml\": \"^2.9.0\",\n    \"zod\": \"^4.4.3\",\n    \"zx\": \"^8.8.5\"\n  },\n  \"devDependencies\": {\n    \"@types/aws-lambda\": \"^8.10.162\",\n    \"@types/react\": \"19.2.17\",\n    \"@wl/eslint-config\": \"workspace:*\",\n    \"@wl/vitest-config\": \"workspace:*\",\n    \"esbuild\": \"^0.28.1\",\n    \"ink-testing-library\": \"^4.0.0\",\n    \"typescript\": \"^6.0.3\"\n  }\n}\n"],
+  "sourcesContent": ["{\n  \"name\": \"infra-kit\",\n  \"type\": \"module\",\n  \"version\": \"0.3.7\",\n  \"files\": [\n    \"dist\"\n  ],\n  \"description\": \"infra-kit\",\n  \"bin\": {\n    \"infra-kit\": \"dist/cli.js\",\n    \"ik\": \"dist/cli.js\"\n  },\n  \"engines\": {\n    \"node\": \">=24.x\"\n  },\n  \"scripts\": {\n    \"inspector\": \"npx @modelcontextprotocol/inspector node ./dist/mcp.js --debug\",\n    \"build\": \"pnpm run clean-artifacts && node ./scripts/build.js\",\n    \"prepack\": \"pnpm run build\",\n    \"prepublishOnly\": \"pnpm run build\",\n    \"infra-kit-check\": \"pnpm exec infra-kit audit\",\n    \"clean-artifacts\": \"rm -rf dist\",\n    \"clean-cache\": \"rm -rf node_modules/.cache .eslintcache tsconfig.tsbuildinfo .turbo .swc\",\n    \"prettier-fix\": \"pnpm exec prettier **/* --write --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore\",\n    \"prettier-check\": \"pnpm exec prettier **/* --check --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore\",\n    \"eslint-check\": \"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src\",\n    \"eslint-fix\": \"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src --fix\",\n    \"ts-check\": \"tsc --noEmit\",\n    \"test\": \"pnpm exec vitest run --reporter=minimal\",\n    \"test-watch\": \"pnpm exec vitest --watch --silent passed-only\",\n    \"test-ui\": \"pnpm exec vitest --ui --silent passed-only\",\n    \"test-report\": \"pnpm exec vitest run --coverage --silent passed-only\",\n    \"qa\": \"pnpm run prettier-check && pnpm run eslint-check && pnpm run ts-check && pnpm run test && echo \u2705 Success\",\n    \"fix\": \"pnpm run prettier-fix && pnpm run eslint-fix && pnpm run qa\"\n  },\n  \"dependencies\": {\n    \"@aws-lambda-powertools/logger\": \"^2.33.1\",\n    \"@inquirer/checkbox\": \"^5.2.1\",\n    \"@inquirer/confirm\": \"^6.1.1\",\n    \"@inquirer/password\": \"^5.0.2\",\n    \"@inquirer/select\": \"^5.2.1\",\n    \"@modelcontextprotocol/sdk\": \"^1.29.0\",\n    \"@slip-stream-kit/config\": \"^0.3.3\",\n    \"chalk\": \"^5.6.2\",\n    \"chokidar\": \"^5.0.0\",\n    \"commander\": \"^15.0.0\",\n    \"fastify\": \"5.10.0\",\n    \"ink\": \"^7.1.0\",\n    \"pino\": \"^10.3.1\",\n    \"pino-pretty\": \"^13.1.3\",\n    \"portless\": \"^0.15.2\",\n    \"react\": \"19.2.7\",\n    \"yaml\": \"^2.9.0\",\n    \"zod\": \"^4.4.3\",\n    \"zx\": \"^8.8.5\"\n  },\n  \"devDependencies\": {\n    \"@types/aws-lambda\": \"^8.10.162\",\n    \"@types/react\": \"19.2.17\",\n    \"@wl/eslint-config\": \"workspace:*\",\n    \"@wl/vitest-config\": \"workspace:*\",\n    \"esbuild\": \"^0.28.1\",\n    \"ink-testing-library\": \"^4.0.0\",\n    \"typescript\": \"^6.0.3\"\n  }\n}\n"],
   "mappings": "AAAA,IAAAA,EAAA,CACE,KAAQ,YACR,KAAQ,SACR,QAAW,QACX,MAAS,CACP,MACF,EACA,YAAe,YACf,IAAO,CACL,YAAa,cACb,GAAM,aACR,EACA,QAAW,CACT,KAAQ,QACV,EACA,QAAW,CACT,UAAa,iEACb,MAAS,sDACT,QAAW,iBACX,eAAkB,iBAClB,kBAAmB,4BACnB,kBAAmB,cACnB,cAAe,2EACf,eAAgB,4HAChB,iBAAkB,4HAClB,eAAgB,4EAChB,aAAc,kFACd,WAAY,eACZ,KAAQ,0CACR,aAAc,gDACd,UAAW,6CACX,cAAe,uDACf,GAAM,gHACN,IAAO,6DACT,EACA,aAAgB,CACd,gCAAiC,UACjC,qBAAsB,SACtB,oBAAqB,SACrB,qBAAsB,SACtB,mBAAoB,SACpB,4BAA6B,UAC7B,0BAA2B,SAC3B,MAAS,SACT,SAAY,SACZ,UAAa,UACb,QAAW,SACX,IAAO,SACP,KAAQ,UACR,cAAe,UACf,SAAY,UACZ,MAAS,SACT,KAAQ,SACR,IAAO,SACP,GAAM,QACR,EACA,gBAAmB,CACjB,oBAAqB,YACrB,eAAgB,UAChB,oBAAqB,cACrB,oBAAqB,cACrB,QAAW,UACX,sBAAuB,SACvB,WAAc,QAChB,CACF",
   "names": ["package_default"]
 }

package/dist/chunk-PZU6BLQR.js

@@ -0,0 +1,4 @@
+import L from"node:process";import C from"pino";import re from"pino-pretty";var _="/tmp/mcp-infra-kit.log",K=["token","*.token","serviceToken","*.serviceToken","DOPPLER_TOKEN","*.DOPPLER_TOKEN","INFRA_KIT_ENV_TOKEN","*.INFRA_KIT_ENV_TOKEN"],Pt=()=>{let e=L.argv.includes("--debug")?"debug":"info",t=C({level:e,redact:K},C.destination({dest:_}));return t.info(`Logger initialized with level: ${e}. Logging to: ${_}`),t},ne=()=>{let e=L.argv.includes("--debug")?"debug":"info",t=["time","pid","hostname"];return e==="debug"&&t.push("level"),C({level:e,redact:K},re({destination:2,ignore:t.join(","),colorize:!0}))},Rt=ne();import*as p from"node:fs";import*as a from"node:path";function oe(e){let t=e;for(let n=0;n<10;n++){let r=a.join(t,"pnpm-workspace.yaml");if(p.existsSync(r))return t;t=a.dirname(t)}throw new Error("Could not find monorepo root (pnpm-workspace.yaml)")}function M(e,t){let n=a.join(e,"package.json");if(!p.existsSync(n))return t;try{let r=JSON.parse(p.readFileSync(n,"utf-8"));return typeof r.name=="string"?r.name:t}catch{return t}}function Ct(e){let t=a.join(e,"apps"),n=[];if(!p.existsSync(t))throw new Error(`Apps directory not found: ${t}`);let r=p.readdirSync(t,{withFileTypes:!0}).filter(o=>o.isDirectory()).map(o=>o.name);for(let o of r){let i=a.join(t,o,"api"),c=a.join(i,"serverless.yml");p.existsSync(c)&&n.push({name:o,packageName:M(i,o),path:i})}return n}var se=["vite.config.ts","vite.config.mts","vite.config.cts","vite.config.js","vite.config.mjs","vite.config.cjs"],ie=["@slip-stream-kit/vite","@slip-stream-kit/config/vite","infra-kit/vite"];function ae(e){for(let t of se){let n=a.join(e,t);if(p.existsSync(n))try{let r=p.readFileSync(n,"utf-8");return ie.some(o=>r.includes(o))}catch{return!1}}return!1}function ce(e){let t=a.join(e,"package.json");if(!p.existsSync(t))return!1;try{let n=JSON.parse(p.readFileSync(t,"utf-8"));return typeof n.scripts?.dev=="string"&&n.scripts.dev.length>0}catch{return!1}}function St(e){let t=a.join(e,"apps"),n=[];if(!p.existsSync(t))return n;let r=p.readdirSync(t,{withFileTypes:!0}).filter(o=>o.isDirectory()).map(o=>o.name);for(let o of r){let i=a.join(t,o,"ui");p.existsSync(i)&&ce(i)&&n.push({name:o,packageName:M(i,o),path:i,managedPort:ae(i)})}return n}function It(e){let t=e?.filter(Boolean)??[];return t.length>0?t:null}function Et(e){let t=oe(e),n=a.relative(a.join(t,"apps"),e),r=n.split(a.sep)[0];if(n===""||n.startsWith("..")||a.isAbsolute(n)||!r)throw new Error(`--self: not inside an apps/<app> directory (cwd: ${e}). Run from an app folder or use --app=<name>.`);return r}var pe=new Set(["api","ui"]),O=e=>{let t=a.join(e,"dist");return p.existsSync(t)&&p.statSync(t).isDirectory()?t:void 0},S=e=>p.existsSync(e)?p.readdirSync(e,{withFileTypes:!0}).filter(t=>t.isDirectory()).map(t=>t.name):[];function jt(e){let t=[];for(let r of S(a.join(e,"packages"))){let o=O(a.join(e,"packages",r));o!==void 0&&t.push(o)}let n=a.join(e,"apps");for(let r of S(n))for(let o of S(a.join(n,r))){if(pe.has(o))continue;let i=a.join(n,r,o);if(!p.existsSync(a.join(i,"package.json")))continue;let c=O(i);c!==void 0&&t.push(c)}return t}function Dt(e){return e.map(t=>a.join(t.path,"dist")).filter(t=>p.existsSync(t))}function At(e,t,n){let r=a.normalize(e),o=n.find(c=>r.startsWith(a.normalize(c)));return o?{kind:"package",packageDir:o}:{kind:"app",app:t.find(c=>r.startsWith(a.normalize(c)))}}var le={"*/api":{},"*/ui":{}},W=e=>{let t=e.split("/"),[n,r]=t;return t.length!==2||!n?`devServersPresets: invalid target "${e}" (expected "<app>/api" or "<app>/ui")`:r!=="api"&&r!=="ui"?`devServersPresets: invalid target part "${r}" in "${e}" (expected "api" or "ui")`:null},ue=e=>{let t=W(e);if(t)throw new Error(t);let[n,r]=e.split("/");return{appGlob:n,part:r}},Nt=e=>{let t=[];for(let[n,r]of Object.entries(e))for(let o of Object.keys(r.apps??{})){let i=W(o);i&&t.push({preset:n,key:o,message:`preset "${n}": ${i}`})}return t},fe=(e,t)=>t==="api"?e.api:e.ui,ge=e=>[...new Set([...e.api,...e.ui])].sort(),F=(e,t)=>`${e}/${t}`,de=e=>e?0:1,me=(e,t)=>t.watchDeps===void 0?e??{watchDeps:!0,rank:t.rank,explicitValue:!1}:!e||!e.explicitValue?{watchDeps:t.watchDeps,rank:t.rank,explicitValue:!0}:t.rank>e.rank?{watchDeps:t.watchDeps,rank:t.rank,explicitValue:!0}:e,he=(e,t,n)=>{let{app:r,part:o,watchDeps:i,isGlob:c}=n;if(!fe(t,o).includes(r)){c||e.unmatched.push(F(r,o));return}let l=F(r,o),u=me(e.targets.get(l),{watchDeps:i,rank:de(c)});e.targets.set(l,{app:r,part:o,...u})},ve=(e,t)=>{let n=Object.entries(e.apps??le),r={targets:new Map,proxy:{},unmatched:[]};for(let[c,l]of n){let{appGlob:u,part:m}=ue(c),b=u==="*",P=b?ge(t):[u];for(let w of P)he(r,t,{app:w,part:m,watchDeps:l.watchDeps,isGlob:b}),l.proxy&&(r.proxy[w]={...r.proxy[w]??{},...l.proxy})}let o=[...r.targets.values()].map(({app:c,part:l,watchDeps:u})=>({app:c,part:l,watchDeps:u})),i=[...new Set(o.filter(c=>c.part==="api").map(c=>c.app))];return{targets:o,cmux:e.cmux??!1,proxy:r.proxy,localApps:i,unmatched:r.unmatched}},Tt=e=>{if(e.preset!=null)return e.preset;if(e.running.length===0)return"nothing";let t=new Set(e.running);return e.discovered.every(r=>t.has(r))?"*":[...t].sort().join(" + ")},ye=(e,t)=>Object.keys(e).find(n=>e[n]===t),xe=({preset:e,app:t,route:n,launchedPkgs:r,ctx:o})=>{let i=o.routePkg(t,n);if(i===void 0)return{preset:e,app:t,route:n,kind:"unknown-route",message:`preset "${e}": proxy override "${n}" on "${t}" names a route not declared in ${t}'s infra-kit.config.ts dev.proxy.routes`};if(r.has(i))return null;let c=ye(o.apiPkgByApp,i),l=c?`add "${c}/api" to the preset`:`launch the api whose package is "${i}"`;return{preset:e,app:t,route:n,pkg:i,kind:"backend-not-launched",message:`preset "${e}": proxy override "${n}" \u2192 "local" requires backend "${i}" to run locally, but the preset does not launch it \u2014 ${l}, or set "${n}" to "cloud"`}},_t=(e,t)=>{let n=[];for(let[r,o]of Object.entries(e)){let i=ve(o,t.discovered),c=new Set(i.localApps.map(l=>t.apiPkgByApp[l]).filter(l=>l!==void 0));for(let[l,u]of Object.entries(i.proxy))for(let[m,b]of Object.entries(u)){if(b!=="local")continue;let P=xe({preset:r,app:l,route:m,launchedPkgs:c,ctx:t});P&&n.push(P)}}return n};import N from"node:fs/promises";import Y from"node:os";import x from"node:path";import Ke from"node:process";import{z as s}from"zod";import v from"node:path";import Ae from"node:process";import{$ as f}from"zx";var ke=/^v?(\d+)\.(\d+)\.(\d+)$/,be=/^(\d+)\.(\d+)\.(\d+)$/,Pe=/^[a-z0-9]+(?:-[a-z0-9]+)*$/,R="release/",I="release/v",G="refs/heads/",Re="next";var B=new Set(["dev","main","next","hotfix","regular","release"]),g=class extends Error{constructor(t){super(t),this.name="InvalidReleaseNameError"}},h=class extends Error{constructor(t){super(t),this.name="InvalidReleaseRefError"}},V=e=>e.startsWith(G)?e.slice(G.length):e,U=(e,t,n)=>({kind:"version",semver:{major:e,minor:t,patch:n},raw:`${e}.${t}.${n}`}),E=e=>{if(e.length===0)throw new g('Release name is empty. Provide a kebab-case name like "checkout-redesign".');if(e.length>50)throw new g(`Release name "${e}" is ${e.length} characters; the maximum is 50.`);if(!Pe.test(e))throw new g(`Release name "${e}" is not kebab-case. Use lowercase letters, digits, and single hyphens, e.g. "checkout-redesign".`);if(B.has(e))throw new g(`Release name "${e}" is reserved. Reserved names: ${[...B].join(", ")}.`)},j=e=>{let t=V(e.trim());if(!t.startsWith(R))return null;if(t.startsWith(I)){let r=t.slice(I.length),o=be.exec(r);if(o)return U(Number(o[1]),Number(o[2]),Number(o[3]))}let n=t.slice(R.length);try{E(n)}catch{return null}return{kind:"name",name:n,raw:n}},we=e=>{let t=e.trim();if(V(t).startsWith(R)){let o=j(t);if(!o)throw new h(`"${e}" looks like a release branch but is not a valid release/v<semver> or release/<name> ref.`);return o}let r=ke.exec(t);if(r)return U(Number(r[1]),Number(r[2]),Number(r[3]));if(t.toLowerCase()===Re)throw new h('The "next" token must be resolved to a concrete version (via computeNextVersion) before parsing a release ref.');try{E(t)}catch(o){let i=o instanceof Error?o.message:String(o);throw new h(`Cannot parse "${e}" as a release ref: ${i}`)}return{kind:"name",name:t,raw:t}},Ce=e=>e.kind==="version"?`${I}${e.raw}`:`${R}${e.name}`,Se=(e,t)=>{let n=t==="hotfix"?"Hotfix":"Release";return e.kind==="version"?`${n} v${e.raw}`:`${n} ${e.name}`},Ie=e=>e.kind==="version"?`Release v${e.raw} (RC)`:`Release ${e.name} (RC)`,Ee=e=>e.kind==="version"?`v${e.raw}`:e.name,je=e=>e.raw,D=e=>e==null?!1:j(e)!==null,z=e=>{if(e===void 0)return null;let t=e instanceof Date?e.getTime():new Date(e).getTime();return Number.isNaN(t)?null:t},De=(e,t,n)=>{if(e.kind==="version"&&t.kind==="version")return e.semver.major!==t.semver.major?e.semver.major-t.semver.major:e.semver.minor!==t.semver.minor?e.semver.minor-t.semver.minor:e.semver.patch-t.semver.patch;if(e.kind==="version")return-1;if(t.kind==="version")return 1;let r=z(n?.a),o=z(n?.b);return r!==null&&o!==null&&r!==o?r-o:e.name<t.name?-1:e.name>t.name?1:0};var H=async e=>{let t=await f({cwd:e})`git worktree list --porcelain`,n=[],r=null;for(let o of t.stdout.split(`
+`)){if(o.startsWith("worktree ")){r&&n.push(r),r={path:o.slice(9),branch:null,detached:!1,bare:!1,prunable:!1,locked:!1};continue}r&&(o.startsWith("branch ")?r.branch=o.slice(7).replace(/^refs\/heads\//,""):o==="detached"?r.detached=!0:o==="bare"?r.bare=!0:o==="locked"||o.startsWith("locked ")?r.locked=!0:(o==="prunable"||o.startsWith("prunable "))&&(r.prunable=!0))}return r&&n.push(r),n},$e=async e=>{let t=await H(Ae.cwd()),n=r=>e==="release"?D(r):r.startsWith("feature/");return t.map(r=>r.branch).filter(r=>r!==null&&n(r))},y=async()=>(await f`git rev-parse --show-toplevel`).stdout.trim(),A=async e=>{let t=e??await y(),n=(await f({cwd:t})`git rev-parse --git-common-dir`).stdout.trim(),r=v.resolve(t,n);return r.includes(`${v.sep}.git${v.sep}modules${v.sep}`)?t:v.dirname(r)},X=async()=>(await f`git rev-parse --abbrev-ref HEAD`).stdout.trim(),Ne=async()=>(await f`git status --porcelain`).stdout.trim().length===0,Te=async()=>{let e=await y(),[t,n]=await Promise.all([f({cwd:e})`git rev-parse --absolute-git-dir`,f({cwd:e})`git rev-parse --git-common-dir`]),r=t.stdout.trim(),o=v.resolve(e,n.stdout.trim());return r!==o};var _e=async e=>{(await f`git branch --list ${e}`).stdout.trim().length!==0&&await X()!==e&&await f`git branch -D ${e}`},Le=async e=>{(await f`git ls-remote --heads origin ${e}`).stdout.trim().length!==0&&await f`git push origin --delete ${e}`};var q="infra-kit.json",Q=".infra-kit",Oe="infra-kit.json",Me="projects",Fe=s.object({provider:s.literal("doppler"),config:s.object({name:s.string().min(1)})}),We=s.discriminatedUnion("provider",[Fe]),Ge=s.object({workspaceConfigPath:s.string().min(1)}),Be=s.object({provider:s.literal("cursor"),config:Ge}),ze=s.object({}),Ve=s.object({provider:s.literal("zed"),config:ze}),J=s.discriminatedUnion("provider",[Be,Ve]),Ue=s.union([J,s.array(J).min(1)]),He=s.object({provider:s.literal("jira"),config:s.object({baseUrl:s.string().url(),projectId:s.number().int().positive()})}),Xe=s.discriminatedUnion("provider",[He]),qe=["two-columns","three-pane"],Je=s.object({layout:s.enum(qe).optional()}),Ye=s.object({openInGithubDesktop:s.boolean().optional(),openInCmux:s.boolean().optional(),cmux:Je.optional()}),Qe=s.object({port:s.number().int().positive().optional(),prefixUrl:s.string().min(1).optional()}).strict(),Ze=s.record(s.string().min(1),Qe),et=s.enum(["local","cloud"]),tt=s.object({watchDeps:s.boolean().optional(),proxy:s.record(s.string().min(1),et).optional()}).strict(),rt=s.object({apps:s.record(s.string().min(1),tt).optional(),cmux:s.boolean().optional()}).strict(),nt=s.record(s.string().min(1),rt),ot=s.object({port:s.number().int().positive().optional()}).strict(),st=s.object({trigger:s.enum(["shell-startup","cli-invocation"]),config:s.string().min(1)}).strict(),T=s.object({envManagement:We,ide:Ue.optional(),taskManager:Xe.optional(),worktrees:Ye.optional(),envAutoLoad:st.optional(),dev:Ze.optional(),devServersPresets:nt.optional(),devProxy:ot.optional()}).strict(),it=443,Z=T.superRefine((e,t)=>{if(!Array.isArray(e.ide))return;let n=new Set;for(let r of e.ide){if(n.has(r.provider)){t.addIssue({code:"custom",message:"each IDE provider may appear at most once",path:["ide"]});return}n.add(r.provider)}}),ee=T.partial(),at=e=>{let t=e.ide;return t?Array.isArray(t)?t:[t]:[]},ct="two-columns",pt=e=>e.worktrees?.cmux?.layout??ct,d=null,k=null,lt=()=>`${Ke.cwd()} ${Y.homedir()}`,te=async()=>{let e=lt();if(k&&k.key===e)return k.value;let t=await y(),n=await A(t),r=x.basename(n),o=x.join(Y.homedir(),Q),i={main:x.join(t,q),userGlobal:x.join(o,Oe),userProject:x.join(o,Me,r,q),projectName:r};return k={key:e,value:i},i},ut=async()=>{let e=await te(),t;try{t=await N.stat(e.main)}catch{d=null;let u=e.main.replace(/\.json$/,".yml");throw await $(u)?new Error(`infra-kit.json not found at ${e.main}. A legacy infra-kit.yml exists \u2014 run \`infra-kit init\` to convert it.`):new Error(`infra-kit.json not found at ${e.main}`)}let[n,r]=await Promise.all([$(e.userGlobal),$(e.userProject)]),o={main:Number(t.mtimeMs),userGlobal:n?Number(n.mtimeMs):null,userProject:r?Number(r.mtimeMs):null};if(d&&mt(d.mtimes,o))return d.value;let i=[{label:"infra-kit.json",path:e.main,required:!0},{label:"~/.infra-kit/infra-kit.json",path:e.userGlobal,required:!1},{label:`~/.infra-kit/projects/${e.projectName}/infra-kit.json`,path:e.userProject,required:!1}],c={};for(let u of i){let m=await ht(u);m!==null&&(c={...c,...m})}let l=Z.safeParse(c);if(!l.success)throw new Error(`Invalid merged infra-kit config: ${s.prettifyError(l.error)}`);return d={mtimes:o,value:l.data},l.data},ft=()=>{d=null},gt=()=>{d=null,k=null},$=async e=>{try{return await N.stat(e)}catch{return null}},dt=async e=>{try{return await N.readFile(e,"utf-8")}catch{return null}},mt=(e,t)=>{let n=Object.keys(e);return n.length!==Object.keys(t).length?!1:n.every(r=>e[r]===t[r])},ht=async e=>{let t=await dt(e.path);if(t===null){if(e.required)throw new Error(`${e.label} not found at ${e.path}`);return null}let n;try{n=t.trim()===""?{}:JSON.parse(t)}catch(o){throw new Error(`Invalid JSON in ${e.label} at ${e.path}: ${o.message}`)}if(vt(n)&&"envTokens"in n)throw new Error(yt(e));let r=ee.safeParse(n);if(!r.success)throw new Error(`Invalid ${e.label} at ${e.path}: ${s.prettifyError(r.error)}`);return r.data},vt=e=>typeof e=="object"&&e!==null&&!Array.isArray(e),yt=e=>[`Refusing to load ${e.label} \u2014 \`envTokens\` is not a config key.`,"A service token in a config file can be committed, backed up by your editor, or shared.","  1. REVOKE the token in Doppler now \u2014 treat it as compromised.",`  2. Remove the \`envTokens\` key from ${e.path}.`,"  3. Re-add it privately: `infra-kit env-token-set <env>`","     (it is written to ~/.infra-kit/projects/<repo>/tokens.json, mode 0600, never to the repo)."].join(`
+`);export{g as a,E as b,j as c,we as d,Ce as e,Se as f,Ie as g,Ee as h,je as i,D as j,De as k,H as l,$e as m,y as n,A as o,Ne as p,Te as q,_e as r,Le as s,_ as t,Pt as u,Rt as v,oe as w,Ct as x,St as y,It as z,Et as A,jt as B,Dt as C,At as D,W as E,Nt as F,ve as G,Tt as H,_t as I,Q as J,it as K,Z as L,ee as M,at as N,pt as O,te as P,ut as Q,ft as R,gt as S};
+//# sourceMappingURL=chunk-PZU6BLQR.js.map