infra-kit 0.3.8 → 0.3.11

package/dist/chunk-M46KGMQ6.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/lib/logger/index.ts", "../src/dev/discovery.ts", "../src/dev/presets.ts", "../src/lib/infra-kit-config/infra-kit-config.ts", "../src/lib/git-utils/git-utils.ts", "../src/lib/errors/operation-error.ts", "../src/lib/mcp-mode/mcp-mode.ts", "../src/lib/release-id/release-id.ts"],
+  "sourcesContent": ["import process from 'node:process'\nimport pino from 'pino'\nimport pretty from 'pino-pretty'\n\n// eslint-disable-next-line sonarjs/publicly-writable-directories\nexport const LOG_FILE_PATH = '/tmp/mcp-infra-kit.log'\n\n/**\n * Key paths pino censors before anything reaches a destination. The load-bearing case is the MCP\n * tool-handler, which logs every tool's `params` object \u2014 twice (at entry, and again in its catch) \u2014\n * into a WORLD-READABLE `/tmp/mcp-infra-kit.log`. A token-carrying key in that object would be\n * written to a file every user on the box can read.\n *\n * The wildcard forms cover the nesting we actually produce: `{ params: { \u2026 } }` and `{ err: { \u2026 } }`\n * are both one level deep, so `*.token` catches `params.token` without enumerating every wrapper.\n *\n * LIMIT \u2014 read this before trusting it: pino's `redact` is KEY-PATH based. It cannot see a token that\n * was INTERPOLATED into a message string (`logger.info(\\`token ${t}\\`)`) \u2014 that string is opaque to\n * it and would be written verbatim. So this is a backstop, not the rule. The RULE is that a token\n * never enters a message string; everything user-facing renders it through `redactToken` first.\n */\nconst REDACT_PATHS = [\n  'token',\n  '*.token',\n  'serviceToken',\n  '*.serviceToken',\n  'DOPPLER_TOKEN',\n  '*.DOPPLER_TOKEN',\n  'INFRA_KIT_ENV_TOKEN',\n  '*.INFRA_KIT_ENV_TOKEN',\n]\n\nexport const initLoggerMcp = () => {\n  const logLevel = process.argv.includes('--debug') ? 'debug' : 'info'\n\n  const logger = pino({ level: logLevel, redact: REDACT_PATHS }, pino.destination({ dest: LOG_FILE_PATH }))\n\n  logger.info(`Logger initialized with level: ${logLevel}. Logging to: ${LOG_FILE_PATH}`)\n\n  return logger\n}\n\nexport const initLoggerCLI = () => {\n  const logLevel = process.argv.includes('--debug') ? 'debug' : 'info'\n\n  const ignoreFields = ['time', 'pid', 'hostname']\n\n  if (logLevel === 'debug') {\n    ignoreFields.push('level')\n  }\n\n  const logger = pino(\n    { level: logLevel, redact: REDACT_PATHS },\n    pretty({\n      destination: 2,\n      ignore: ignoreFields.join(','),\n      colorize: true,\n    }),\n  )\n\n  return logger\n}\n\n// Singleton logger instance for CLI usage\nexport const logger = initLoggerCLI()\n", "/**\n * Filesystem discovery helpers for the dev-server.\n *\n * These functions read the filesystem (walking for the monorepo root, scanning\n * `apps/` and `packages/`) but never `chdir` and never resolve ports / prefixes \u2014\n * that stays with the pure {@link file://./ports.ts} layer. The starting directory\n * is passed in so discovery is testable against a fixture root.\n */\nimport * as fs from 'node:fs'\nimport * as path from 'node:path'\n\n/** Bare metadata for a discovered API app (no resolved port / prefix). */\nexport interface DiscoveredApiApp {\n  /** App folder name (e.g. backoffice, client). */\n  name: string\n  /** Package name from package.json (e.g. sls-trvl-client), or the folder name as fallback. */\n  packageName: string\n  path: string\n}\n\n/** Walk up from `startDir` (max 10 levels) to the dir containing `pnpm-workspace.yaml`. */\nexport function findMonorepoRoot(startDir: string): string {\n  let currentDir = startDir\n\n  for (let i = 0; i < 10; i++) {\n    const workspaceFile = path.join(currentDir, 'pnpm-workspace.yaml')\n\n    if (fs.existsSync(workspaceFile)) {\n      return currentDir\n    }\n    currentDir = path.dirname(currentDir)\n  }\n\n  throw new Error('Could not find monorepo root (pnpm-workspace.yaml)')\n}\n\n/** Read the `name` field from `<apiPath>/package.json`, falling back to `appName`. */\nexport function getPackageName(apiPath: string, appName: string): string {\n  const pkgPath = path.join(apiPath, 'package.json')\n\n  if (!fs.existsSync(pkgPath)) return appName\n\n  try {\n    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8')) as { name?: string }\n\n    return typeof pkg.name === 'string' ? pkg.name : appName\n  } catch {\n    return appName\n  }\n}\n\n/** Discover every `apps/<app>` that has an `api/serverless.yml` (bare metadata only). */\nexport function discoverApiApps(root: string): DiscoveredApiApp[] {\n  const appsDir = path.join(root, 'apps')\n  const apps: DiscoveredApiApp[] = []\n\n  if (!fs.existsSync(appsDir)) {\n    throw new Error(`Apps directory not found: ${appsDir}`)\n  }\n\n  const appDirs = fs\n    .readdirSync(appsDir, { withFileTypes: true })\n    .filter((dirent) => {\n      return dirent.isDirectory()\n    })\n    .map((dirent) => {\n      return dirent.name\n    })\n\n  for (const appName of appDirs) {\n    const apiPath = path.join(appsDir, appName, 'api')\n    const serverlessPath = path.join(apiPath, 'serverless.yml')\n\n    if (fs.existsSync(serverlessPath)) {\n      apps.push({\n        name: appName,\n        packageName: getPackageName(apiPath, appName),\n        path: apiPath,\n      })\n    }\n  }\n\n  return apps\n}\n\n/** Bare metadata for a discovered UI app (a frontend with its own framework `dev` script). */\nexport interface DiscoveredUiApp {\n  /** App folder name (e.g. backoffice, client). */\n  name: string\n  /** package.json `name` \u2014 used as the exact `turbo run dev --filter` target. */\n  packageName: string\n  /** Absolute path to `apps/<app>/ui`. */\n  path: string\n  /**\n   * True when this UI's vite config wires `infra-kit/vite`'s `infraKitDev()` helper \u2014 the ONLY thing\n   * that makes it honor the runner-assigned `INFRA_KIT_UI_PORTS` port (which it binds with `strictPort`).\n   *\n   * The runner treats frameworks opaquely, so it cannot assume a pre-assigned port is the port the child\n   * will bind. Without this signal it would print a confident, wrong URL for any UI that picks its own\n   * port (vike, astro, a hand-rolled vite config). Unwired \u2192 the runner claims no port and the UI keeps\n   * its honest \"vite prints its URL below\" reference line.\n   */\n  managedPort: boolean\n}\n\n/** Vite config filenames checked for the helper import, in vite's own resolution order. */\nconst VITE_CONFIG_FILES = [\n  'vite.config.ts',\n  'vite.config.mts',\n  'vite.config.cts',\n  'vite.config.js',\n  'vite.config.mjs',\n  'vite.config.cjs',\n]\n\n/**\n * Every module specifier that binds a UI to infra-kit's dev wiring \u2014 whether through the raw\n * `infraKitDev` helper or through the `@slip-stream-kit/vite` plugin that wraps it.\n *\n * A LIST, not a single literal, because the wiring moved packages twice: it used to ship from the\n * `infra-kit` CLI itself, then from `@slip-stream-kit/config` (the split that let the CLI become a\n * global install \u2014 a local `node_modules/.bin/infra-kit` would otherwise shadow the global bin, see\n * that package's readme), and the plugin form now ships from `@slip-stream-kit/vite`. Consumers migrate\n * one repo at a time, so all three specifiers are live.\n *\n * This is what makes `managedPort` true, so a MISSING entry is not cosmetic: the runner would stop\n * claiming the port for every UI on that specifier, and with it the hero URL.\n *\n * Note this is a SUBSTRING match, which is why the config package could not be called `@infra-kit/vite`:\n * that name *contains* `infra-kit/vite`, so the legacy entry would have matched it by accident and\n * hidden the very coupling the split makes explicit. Neither `@slip-stream-kit/config/vite` nor\n * `@slip-stream-kit/vite` contains any other entry, so no entry here shadows another.\n *\n * Drop the legacy entry once every consumer repo is migrated.\n */\nexport const INFRA_KIT_VITE_SPECIFIERS = [\n  '@slip-stream-kit/vite',\n  '@slip-stream-kit/config/vite',\n  'infra-kit/vite',\n] as const\n\n/**\n * True when `<dir>`'s vite config references the `infraKitDev` helper module. A text match, not a\n * module load: the config is TypeScript the runner must not execute, and importing it would run the\n * consumer's own side effects. False negatives (a config that re-exports the helper from a shared\n * preset) cost only the reference line, never a wrong URL \u2014 the safe direction to be wrong in.\n */\nexport function usesInfraKitVite(dir: string): boolean {\n  for (const file of VITE_CONFIG_FILES) {\n    const configPath = path.join(dir, file)\n\n    if (!fs.existsSync(configPath)) continue\n\n    try {\n      const source = fs.readFileSync(configPath, 'utf-8')\n\n      return INFRA_KIT_VITE_SPECIFIERS.some((specifier) => {\n        return source.includes(specifier)\n      })\n    } catch {\n      return false\n    }\n  }\n\n  return false\n}\n\n/**\n * True when `<dir>`'s vite config wires the `infraKit()` PLUGIN specifically \u2014 not just the raw\n * `infraKitDev()` helper it wraps (see {@link usesInfraKitVite}, which matches either). Only the\n * plugin watches `.infra-kit/dev-context` and restarts vite when the resolved proxy changes; a\n * config that calls the helper directly bakes its proxy at config load and will not react to a\n * backend recovering mid-session (see `dev-server.ts`'s boot warning for this).\n *\n * No structural signal exists to check instead: the plugin writes nothing to disk at config load,\n * so this is the same conservative text match as {@link usesInfraKitVite} \u2014 a config source read,\n * not a module load. The substring is the plugin's call syntax, `infraKit(`; it cannot false-match\n * `infraKitDev(`, whose next character after `infraKit` is `D`, not `(`. A false negative (e.g. the\n * plugin re-exported from a shared preset under a different call shape) only costs a spurious\n * warning \u2014 never a missed one \u2014 which is the safe direction here.\n */\nexport function usesInfraKitVitePlugin(dir: string): boolean {\n  for (const file of VITE_CONFIG_FILES) {\n    const configPath = path.join(dir, file)\n\n    if (!fs.existsSync(configPath)) continue\n\n    try {\n      return fs.readFileSync(configPath, 'utf-8').includes('infraKit(')\n    } catch {\n      return false\n    }\n  }\n\n  return false\n}\n\n/** True when `<dir>/package.json` declares a non-empty `scripts.dev`. */\nfunction hasDevScript(dir: string): boolean {\n  const pkgPath = path.join(dir, 'package.json')\n\n  if (!fs.existsSync(pkgPath)) return false\n\n  try {\n    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8')) as { scripts?: Record<string, string> }\n\n    return typeof pkg.scripts?.dev === 'string' && pkg.scripts.dev.length > 0\n  } catch {\n    return false\n  }\n}\n\n/**\n * Discover every `apps/<app>/ui` whose package.json declares a `dev` script \u2014 the frontends\n * `infra-kit dev --ui` runs (via one delegated `turbo run dev`). Lenient: no `apps/` dir \u2192 `[]`\n * (UIs are optional), unlike {@link discoverApiApps} which requires it.\n */\nexport function discoverUiApps(root: string): DiscoveredUiApp[] {\n  const appsDir = path.join(root, 'apps')\n  const apps: DiscoveredUiApp[] = []\n\n  if (!fs.existsSync(appsDir)) return apps\n\n  const appDirs = fs\n    .readdirSync(appsDir, { withFileTypes: true })\n    .filter((dirent) => {\n      return dirent.isDirectory()\n    })\n    .map((dirent) => {\n      return dirent.name\n    })\n\n  for (const appName of appDirs) {\n    const uiPath = path.join(appsDir, appName, 'ui')\n\n    if (fs.existsSync(uiPath) && hasDevScript(uiPath)) {\n      apps.push({\n        name: appName,\n        packageName: getPackageName(uiPath, appName),\n        path: uiPath,\n        managedPort: usesInfraKitVite(uiPath),\n      })\n    }\n  }\n\n  return apps\n}\n\n/** Normalize the `--app` include list: drop empties, and collapse an empty list to `null`. */\nexport function normalizeAppInclude(include?: string[] | null): string[] | null {\n  const filtered = include?.filter(Boolean) ?? []\n\n  return filtered.length > 0 ? filtered : null\n}\n\n/**\n * Infer the current app's folder name from `startDir`, so a per-app script can\n * run `infra-kit dev --self` without hardcoding its own app name. Walks up to the\n * monorepo root (via {@link findMonorepoRoot}), then takes the first path segment\n * of `startDir` relative to `<root>/apps` \u2014 e.g. `apps/config-handler/api` and\n * `apps/config-handler` both resolve to `config-handler`. Throws when `startDir`\n * isn't inside `<root>/apps/<app>/...` (repo root, or an unrelated path).\n *\n * @example\n * resolveSelfAppName('/repo/apps/config-handler/api') // => 'config-handler'\n */\nexport function resolveSelfAppName(startDir: string): string {\n  const root = findMonorepoRoot(startDir)\n  const relative = path.relative(path.join(root, 'apps'), startDir)\n  const firstSegment = relative.split(path.sep)[0]\n  const isOutsideApps = relative === '' || relative.startsWith('..') || path.isAbsolute(relative)\n\n  if (isOutsideApps || !firstSegment) {\n    throw new Error(\n      `--self: not inside an apps/<app> directory (cwd: ${startDir}). Run from an app folder or use --app=<name>.`,\n    )\n  }\n\n  return firstSegment\n}\n\n/** App-part directory names that are apps in their own right, never shared packages. See {@link getPackageDistDirs}. */\nconst APP_PART_DIRS = new Set(['api', 'ui'])\n\n/** `<dir>/dist` when it exists and is a directory, else `undefined`. */\nconst existingDistDir = (dir: string): string | undefined => {\n  const distDir = path.join(dir, 'dist')\n\n  return fs.existsSync(distDir) && fs.statSync(distDir).isDirectory() ? distDir : undefined\n}\n\n/** Immediate subdirectory names of `dir`, or `[]` when `dir` does not exist. */\nconst subdirNames = (dir: string): string[] => {\n  if (!fs.existsSync(dir)) return []\n\n  return fs\n    .readdirSync(dir, { withFileTypes: true })\n    .filter((d) => {\n      return d.isDirectory()\n    })\n    .map((d) => {\n      return d.name\n    })\n}\n\n/**\n * Existing dist directories of every SHARED workspace package \u2014 the compiled outputs `turbo watch`\n * rewrites. Watched (alongside app dist) because editing a shared lib rewrites only the lib's `dist`,\n * never the dependent app's, so a package-dist change is the only signal that a lib was rebuilt.\n *\n * Two homes, because the pnpm workspace globs cover `packages/<pkg>` as well as `apps/<app>/<part>`:\n *  - `packages/<pkg>/dist` \u2014 the obvious one.\n *  - `apps/<app>/<part>/dist` where `<part>` is neither `api` nor `ui` and the dir is a real workspace\n *    member (it has a `package.json`). A shared library may legally live beside the app that owns it \u2014\n *    hulyo's `@pkg/ai-mcp` is `apps/ai/mcp`, and two backends depend on it. Scanning only `packages`\n *    left such a package watched by nobody: turbo rebuilt its dist, the runner never saw the change, and\n *    every dependent backend kept serving stale code.\n *\n * `api`/`ui` parts are excluded deliberately: an api's dist is already covered by {@link getAppDistDirs},\n * and treating a frontend's dist as a shared package would bounce every backend on a UI rebuild.\n */\nexport function getPackageDistDirs(root: string): string[] {\n  const dirs: string[] = []\n\n  for (const name of subdirNames(path.join(root, 'packages'))) {\n    const distDir = existingDistDir(path.join(root, 'packages', name))\n\n    if (distDir !== undefined) dirs.push(distDir)\n  }\n\n  const appsDir = path.join(root, 'apps')\n\n  for (const app of subdirNames(appsDir)) {\n    for (const part of subdirNames(path.join(appsDir, app))) {\n      if (APP_PART_DIRS.has(part)) continue\n\n      const partDir = path.join(appsDir, app, part)\n\n      // A workspace member, not a stray build artifact directory.\n      if (!fs.existsSync(path.join(partDir, 'package.json'))) continue\n\n      const distDir = existingDistDir(partDir)\n\n      if (distDir !== undefined) dirs.push(distDir)\n    }\n  }\n\n  return dirs\n}\n\n/** Existing `<app.path>/dist` directories for the given apps (order preserved). */\nexport function getAppDistDirs(apps: Array<{ path: string }>): string[] {\n  return apps\n    .map((app) => {\n      return path.join(app.path, 'dist')\n    })\n    .filter((dir) => {\n      return fs.existsSync(dir)\n    })\n}\n\n/** How a watched dist change should be routed. */\nexport interface ChangeClassification {\n  kind: 'app' | 'package'\n  /** For app changes: the matched app dist dir (undefined when nothing matched). */\n  app?: string\n  /** For package changes: the matched `packages/<pkg>/dist` dir (the change identity used to scope restarts). */\n  packageDir?: string\n}\n\n/**\n * Route a changed compiled-output path: a `packages/<pkg>/dist` change is a shared-package\n * rebuild \u2014 the matched package dist dir is returned so the caller can restart only the apps\n * whose dependency closure includes it. An `<app>/dist` change restarts only that app (the\n * matched app dist dir is returned; `undefined` when the path matches neither). Package matches\n * take precedence.\n */\nexport function classifyDistChange(\n  changedPath: string,\n  appDistDirs: string[],\n  packageDistDirs: string[],\n): ChangeClassification {\n  const normalized = path.normalize(changedPath)\n\n  const matchedPackageDir = packageDistDirs.find((dir) => {\n    return normalized.startsWith(path.normalize(dir))\n  })\n\n  if (matchedPackageDir) {\n    return { kind: 'package', packageDir: matchedPackageDir }\n  }\n\n  const matchedDir = appDistDirs.find((dir) => {\n    return normalized.startsWith(path.normalize(dir))\n  })\n\n  return { kind: 'app', app: matchedDir }\n}\n", "/**\n * Pure resolution of a named dev preset into a concrete run plan.\n *\n * A preset (declared under `devServersPresets` in the per-project infra-kit.json) names\n * launch targets (`client/api`, `client/ui`, with `*` allowed in the app position), optional\n * per-target `watchDeps` (api + ui), per-route proxy-source overrides, and a `cmux` layout\n * flag. This module turns that declarative shape into a flat {@link ResolvedPreset}\n * the runner consumes. Side-effect free: the discovered app parts are passed in\n * (never read from disk here), so resolution is fully unit-testable.\n *\n * Every target key names exactly one workspace package \u2014 the app folder plus the part\n * (`apps/<app>/api` or `apps/<app>/ui`). A bare `<app>` is not a package and is rejected.\n */\nimport type { DevPreset, DevPresets, ProxySource } from 'src/lib/infra-kit-config'\n\n/** The two launchable halves of an `apps/<app>` folder. */\nexport type AppPart = 'api' | 'ui'\n\n/** One concrete thing to launch: a single part of a single app. */\nexport interface ResolvedTarget {\n  /** App folder name (e.g. `client`). */\n  app: string\n  /** Which half of the app to launch. */\n  part: AppPart\n  /**\n   * Participate in dependency-closure watching (uniform for api + ui): react to a change in\n   * this target's own workspace-dependency closure. Default `true` (opt-in participation).\n   * Resolution is specificity-ordered: an explicit value on a more-specific key (a concrete\n   * app, or an explicit `/part`) wins over a `*` glob; at equal specificity an explicit\n   * `false` wins over `true` (order-independent opt-out). See {@link resolveWatch}.\n   */\n  watchDeps: boolean\n}\n\n/** Which apps have an `api` / `ui` part on disk \u2014 the resolver's view of discovery. */\nexport interface DiscoveredParts {\n  /** App names that have `apps/<app>/api`. */\n  api: string[]\n  /** App names that have `apps/<app>/ui`. */\n  ui: string[]\n}\n\n/** A fully-resolved preset: the flat run plan derived from its declarative shape. */\nexport interface ResolvedPreset {\n  /** Every (app, part) to launch, de-duplicated. */\n  targets: ResolvedTarget[]\n  /** Run each target in its own cmux pane. */\n  cmux: boolean\n  /**\n   * app \u2192 (route path \u2192 source) overrides, as DECLARED by the preset.\n   *\n   * Not an input to proxy resolution, and never has been: the vite helper derives a route's source from\n   * the dev-context fragments the runner writes, so a route is local iff its backend is actually up. This\n   * map is the declared INTENT, and it has two readers:\n   *  - `validatePresetProxy` \u2014 the STATIC check, run by `infra-kit audit` and the bare-invocation wizard.\n   *    Note it does NOT run on the `infra-kit dev <preset>` path, so it cannot be relied on to have\n   *    caught anything by the time a run starts;\n   *  - `local-pairing.ts` \u2014 the RUNTIME check, which folds a `local` pin into the set of packages the run\n   *    intended to serve locally, and refuses when one of them is not actually up.\n   */\n  proxy: Record<string, Record<string, ProxySource>>\n  /** Apps whose `api` part is launched \u2014 their backends are local (derived). */\n  localApps: string[]\n  /** Concretely-named `<app>/<part>` targets that matched no discovered app/part (for a warning). */\n  unmatched: string[]\n}\n\n/** The target keys resolution falls back to when a preset omits `apps`: every discovered package. */\nconst ALL_TARGETS_KEYS: NonNullable<DevPreset['apps']> = { '*/api': {}, '*/ui': {} }\n\n/** A preset target key that does not name an `<app>/<part>` package. */\nexport interface PresetKeyIssue {\n  /** Preset name the bad key is under. */\n  preset: string\n  /** The offending key, verbatim. */\n  key: string\n  /** Human-readable, actionable explanation (already prefixed with the preset name). */\n  message: string\n}\n\ninterface ParsedKey {\n  /** App name or `*` (all discovered apps). */\n  appGlob: string\n  /** The single part the key selects. */\n  part: AppPart\n}\n\n/**\n * Explain why `key` is not a valid target, or null when it parses. Keys name one workspace\n * package, so the `/api`|`/ui` part is mandatory \u2014 a bare `client` names a folder, not a package.\n */\nexport const explainTargetKey = (key: string): string | null => {\n  const segments = key.split('/')\n  const [appGlob, part] = segments\n\n  if (segments.length !== 2 || !appGlob) {\n    return `devServersPresets: invalid target \"${key}\" (expected \"<app>/api\" or \"<app>/ui\")`\n  }\n\n  if (part !== 'api' && part !== 'ui') {\n    return `devServersPresets: invalid target part \"${part}\" in \"${key}\" (expected \"api\" or \"ui\")`\n  }\n\n  return null\n}\n\n/**\n * Parse a preset target key into an app glob + its part. Throws when the key is not an\n * `<app>/<part>` package identity (see {@link explainTargetKey}).\n *\n * A `*` app glob is legal (`*` plus a part), and expands to every discovered app.\n *\n * @example\n * parseTargetKey('client/api')  // => { appGlob: 'client', part: 'api' }\n */\nexport const parseTargetKey = (key: string): ParsedKey => {\n  const error = explainTargetKey(key)\n\n  if (error) {\n    throw new Error(error)\n  }\n\n  const [appGlob, part] = key.split('/') as [string, AppPart]\n\n  return { appGlob, part }\n}\n\n/** Every `preset \u2192 invalid target key` in the map, with the reason (empty when all keys parse). */\nexport const validatePresetKeys = (presets: DevPresets): PresetKeyIssue[] => {\n  const issues: PresetKeyIssue[] = []\n\n  for (const [preset, def] of Object.entries(presets)) {\n    for (const key of Object.keys(def.apps ?? {})) {\n      const error = explainTargetKey(key)\n\n      if (error) {\n        issues.push({ preset, key, message: `preset \"${preset}\": ${error}` })\n      }\n    }\n  }\n\n  return issues\n}\n\n/** App names that have `part` on disk, per the discovery result. */\nconst appsWithPart = (discovered: DiscoveredParts, part: AppPart): string[] => {\n  return part === 'api' ? discovered.api : discovered.ui\n}\n\n/** Every discovered app name (union of api + ui halves), sorted for deterministic output. */\nconst allApps = (discovered: DiscoveredParts): string[] => {\n  return [...new Set([...discovered.api, ...discovered.ui])].sort()\n}\n\n/** Stable `app/part` identity key for de-duplicating targets across preset keys. */\nconst targetId = (app: string, part: AppPart): string => {\n  return `${app}/${part}`\n}\n\n/** A resolved target plus the provenance the merge needs to order later keys by specificity. */\ninterface ResolvedTargetInternal extends ResolvedTarget {\n  /** Specificity rank of the key that set `watchDeps` (see {@link keyRank}) \u2014 a higher rank wins. */\n  rank: number\n  /** Whether `watchDeps` came from an explicit preset value (vs the participate-default). */\n  explicitValue: boolean\n}\n\ninterface ResolveState {\n  targets: Map<string, ResolvedTargetInternal>\n  proxy: Record<string, Record<string, ProxySource>>\n  unmatched: string[]\n}\n\n/**\n * Specificity rank of a preset key, higher = more specific. Every key names a part, so the\n * only axis left is the app: a concrete `client/api` (1) beats a `*` glob key (0).\n */\nconst keyRank = (isGlob: boolean): number => {\n  return isGlob ? 0 : 1\n}\n\n/**\n * Merge a preset key's `watchDeps` into any prior resolution for the same target. A key that\n * omits `watchDeps` never clobbers a prior explicit value (and, absent any explicit value,\n * seeds the participate-default `true`). A more-specific key ({@link keyRank}) wins in either\n * direction, so a `*` glob cannot override a concrete `client/api` and vice-versa. Two explicit\n * keys can never tie: each target is named by at most one key per rank (one glob, one concrete),\n * so the merge is order-independent.\n */\nconst resolveWatch = (\n  prior: ResolvedTargetInternal | undefined,\n  next: { watchDeps: boolean | undefined; rank: number },\n): { watchDeps: boolean; rank: number; explicitValue: boolean } => {\n  // This key configured nothing \u2192 keep the prior resolution, or seed the participate-default.\n  if (next.watchDeps === undefined) {\n    return prior ?? { watchDeps: true, rank: next.rank, explicitValue: false }\n  }\n\n  // No prior explicit value (fresh, or only a default) \u2192 this explicit value takes it.\n  if (!prior || !prior.explicitValue) {\n    return { watchDeps: next.watchDeps, rank: next.rank, explicitValue: true }\n  }\n\n  // Two explicit values: the more-specific key wins, in either direction.\n  return next.rank > prior.rank ? { watchDeps: next.watchDeps, rank: next.rank, explicitValue: true } : prior\n}\n\n/**\n * Fold one (app, part) into the accumulator: record a target when the part exists,\n * merge `watchDeps` with any prior target of the same identity by specificity\n * ({@link resolveWatch}), and flag a named-but-missing package as unmatched\n * (glob-expanded misses are silent).\n */\nconst addTarget = (\n  state: ResolveState,\n  discovered: DiscoveredParts,\n  spec: { app: string; part: AppPart; watchDeps: boolean | undefined; isGlob: boolean },\n): void => {\n  const { app, part, watchDeps, isGlob } = spec\n\n  if (!appsWithPart(discovered, part).includes(app)) {\n    // A glob expands over discovery, so its misses are expected; a concretely-named\n    // `<app>/<part>` that can't be found is a mistake worth surfacing.\n    if (!isGlob) {\n      state.unmatched.push(targetId(app, part))\n    }\n\n    return\n  }\n\n  const id = targetId(app, part)\n  const merged = resolveWatch(state.targets.get(id), { watchDeps, rank: keyRank(isGlob) })\n\n  state.targets.set(id, { app, part, ...merged })\n}\n\n/**\n * Resolve a preset against the discovered app parts. Expands `*` app globs,\n * de-duplicates targets, derives the local-backend set from the launched `api`\n * targets, and collects per-app proxy overrides. Unknown app/route names are\n * tolerated (a missing named target lands in `unmatched`, not an exception) so a\n * stale preset degrades gracefully \u2014 but a key that is not an `<app>/<part>`\n * package identity throws, since it can't be resolved at all.\n *\n * @example\n * resolvePreset(\n *   { apps: { 'client/ui': {}, 'client/api': { watchDeps: false } } },\n *   { api: ['client'], ui: ['client'] },\n * )\n * // => {\n * //   targets: [{ app: 'client', part: 'ui', watchDeps: true },   // default participate\n * //             { app: 'client', part: 'api', watchDeps: false }], // explicit opt-out\n * //   cmux: false, proxy: {}, localApps: ['client'], unmatched: [],\n * // }\n */\nexport const resolvePreset = (preset: DevPreset, discovered: DiscoveredParts): ResolvedPreset => {\n  const entries = Object.entries(preset.apps ?? ALL_TARGETS_KEYS)\n  const state: ResolveState = { targets: new Map(), proxy: {}, unmatched: [] }\n\n  for (const [key, cfg] of entries) {\n    const { appGlob, part } = parseTargetKey(key)\n    const isGlob = appGlob === '*'\n    const apps = isGlob ? allApps(discovered) : [appGlob]\n\n    for (const app of apps) {\n      addTarget(state, discovered, { app, part, watchDeps: cfg.watchDeps, isGlob })\n\n      if (cfg.proxy) {\n        state.proxy[app] = { ...(state.proxy[app] ?? {}), ...cfg.proxy }\n      }\n    }\n  }\n\n  const targets: ResolvedTarget[] = [...state.targets.values()].map(({ app, part, watchDeps }) => {\n    return { app, part, watchDeps }\n  })\n  const localApps = [\n    ...new Set(\n      targets\n        .filter((t) => {\n          return t.part === 'api'\n        })\n        .map((t) => {\n          return t.app\n        }),\n    ),\n  ]\n\n  return { targets, cmux: preset.cmux ?? false, proxy: state.proxy, localApps, unmatched: state.unmatched }\n}\n\n/** What the run launched, as passed to {@link deriveTargetLabel}. */\nexport interface TargetLabelInput {\n  /** Named preset (`infra-kit dev <preset>`) \u2014 its name is the label when present. */\n  preset?: string\n  /** The `<app>/<part>` package keys actually being launched, after preset resolution and `--app`. */\n  running: string[]\n  /** Every `<app>/<part>` package key discovered in the monorepo. */\n  discovered: string[]\n}\n\n/**\n * The header's target label. A named preset labels itself; otherwise the label is the set of\n * `<app>/<part>` packages actually launching, collapsing to `*` when that set is everything\n * discovered. Never a bare app name: `client` is not a target anywhere in this system (see\n * {@link parseTargetKey}) and would hide which half of the app is running \u2014 the whole point of\n * the wizard's part-level selection.\n *\n * @example\n * deriveTargetLabel({ running: ['client/ui', 'client/api'], discovered: ['client/api', 'client/ui', 'seo/ui'] })\n * // => 'client/api + client/ui'\n * deriveTargetLabel({ running: ['client/api'], discovered: ['client/api'] }) // => '*'\n * deriveTargetLabel({ preset: 'full', running: ['client/api'], discovered: ['client/api', 'seo/ui'] }) // => 'full'\n */\nexport const deriveTargetLabel = (input: TargetLabelInput): string => {\n  if (input.preset != null) {\n    return input.preset\n  }\n  if (input.running.length === 0) {\n    return 'nothing'\n  }\n\n  const running = new Set(input.running)\n  const isEverything = input.discovered.every((key) => {\n    return running.has(key)\n  })\n\n  return isEverything ? '*' : [...running].sort().join(' + ')\n}\n\n/** A devServersPresets proxy-locality violation surfaced by the audit. */\nexport interface PresetProxyIssue {\n  /** Preset name the violation is in. */\n  preset: string\n  /** Frontend app folder the override is under (e.g. `client`). */\n  app: string\n  /** Route path forced to a source (e.g. `/api`). */\n  route: string\n  /** Backend pkg the route maps to; undefined when the route is not declared in the frontend config. */\n  pkg?: string\n  /** `unknown-route` = route absent from the frontend config; `backend-not-launched` = local target not launched. */\n  kind: 'unknown-route' | 'backend-not-launched'\n  /** Human-readable, actionable explanation. */\n  message: string\n}\n\n/**\n * Cross-file lookups the proxy validator needs, kept injectable so the rule stays\n * filesystem-free (and unit-testable). The impure side (audit) builds these from\n * discovery + each frontend's loaded `infra-kit.config.ts`.\n */\nexport interface PresetProxyContext {\n  /** Discovered app parts, for resolving each preset's launch set. */\n  discovered: DiscoveredParts\n  /** App folder name \u2192 its `apps/<app>/api` package name. */\n  apiPkgByApp: Record<string, string>\n  /** (frontend app folder, route path) \u2192 backend pkg from that frontend's config; undefined when the route is absent. */\n  routePkg: (app: string, route: string) => string | undefined\n}\n\ninterface CheckLocalRouteArgs {\n  preset: string\n  app: string\n  route: string\n  launchedPkgs: ReadonlySet<string>\n  ctx: PresetProxyContext\n}\n\n/** App folder whose `api` package is `pkg` (for the remediation hint), or undefined. */\nconst ownerApp = (apiPkgByApp: Record<string, string>, pkg: string): string | undefined => {\n  return Object.keys(apiPkgByApp).find((app) => {\n    return apiPkgByApp[app] === pkg\n  })\n}\n\n/**\n * Validate one `route \u2192 'local'` override: the route must be declared in the\n * frontend config, and the backend pkg it maps to must be in the preset's launched\n * set. Returns the issue, or null when the override is satisfiable.\n */\nconst checkLocalRoute = ({ preset, app, route, launchedPkgs, ctx }: CheckLocalRouteArgs): PresetProxyIssue | null => {\n  const pkg = ctx.routePkg(app, route)\n\n  if (pkg === undefined) {\n    return {\n      preset,\n      app,\n      route,\n      kind: 'unknown-route',\n      message: `preset \"${preset}\": proxy override \"${route}\" on \"${app}\" names a route not declared in ${app}'s infra-kit.config.ts dev.proxy.routes`,\n    }\n  }\n\n  if (launchedPkgs.has(pkg)) {\n    return null\n  }\n\n  const owner = ownerApp(ctx.apiPkgByApp, pkg)\n  const hint = owner ? `add \"${owner}/api\" to the preset` : `launch the api whose package is \"${pkg}\"`\n\n  return {\n    preset,\n    app,\n    route,\n    pkg,\n    kind: 'backend-not-launched',\n    message: `preset \"${preset}\": proxy override \"${route}\" \u2192 \"local\" requires backend \"${pkg}\" to run locally, but the preset does not launch it \u2014 ${hint}, or set \"${route}\" to \"cloud\"`,\n  }\n}\n\n/**\n * Audit every preset's per-route proxy overrides: a route pinned to `local` is only\n * valid when the backend package it resolves to (per the frontend's\n * `infra-kit.config.ts`) is actually launched by that same preset. Catches the\n * `{ \"client/ui\": { \"proxy\": { \"/api\": \"local\" } } }` case where no local backend\n * is running to serve `/api`. `cloud` overrides are always satisfiable and skipped.\n *\n * @example\n * validatePresetProxy(\n *   { 'client-remote': { apps: { 'client/ui': { proxy: { '/api': 'local' } } } } },\n *   { discovered: { api: ['client'], ui: ['client'] }, apiPkgByApp: { client: 'backend-api' },\n *     routePkg: () => 'backend-api' },\n * )\n * // => [{ preset: 'client-remote', app: 'client', route: '/api', pkg: 'backend-api',\n * //       kind: 'backend-not-launched', message: '\u2026' }]\n */\nexport const validatePresetProxy = (presets: DevPresets, ctx: PresetProxyContext): PresetProxyIssue[] => {\n  const issues: PresetProxyIssue[] = []\n\n  for (const [preset, def] of Object.entries(presets)) {\n    const resolved = resolvePreset(def, ctx.discovered)\n    const launchedPkgs = new Set(\n      resolved.localApps\n        .map((app) => {\n          return ctx.apiPkgByApp[app]\n        })\n        .filter((pkg): pkg is string => {\n          return pkg !== undefined\n        }),\n    )\n\n    for (const [app, routes] of Object.entries(resolved.proxy)) {\n      for (const [route, source] of Object.entries(routes)) {\n        if (source !== 'local') {\n          continue\n        }\n\n        const issue = checkLocalRoute({ preset, app, route, launchedPkgs, ctx })\n\n        if (issue) {\n          issues.push(issue)\n        }\n      }\n    }\n  }\n\n  return issues\n}\n", "import fs from 'node:fs/promises'\nimport os from 'node:os'\nimport path from 'node:path'\nimport process from 'node:process'\nimport { z } from 'zod'\n\nimport { getMainRepoRoot, getProjectRoot } from 'src/lib/git-utils'\nimport { isMcpMode } from 'src/lib/mcp-mode'\n\nconst INFRA_KIT_CONFIG_FILE = 'infra-kit.json'\n\n/**\n * Directory under the user's home that holds all machine-local infra-kit config:\n * the runtime `infra-kit.json` merge layer, per-project overrides, and the factory\n * registry (`vendor.json`). Single source of truth for `.infra-kit`, reused\n * by the vendor factory-config loader (no import cycle \u2014 this module imports no\n * `lib/vendor` code).\n */\nexport const USER_CONFIG_DIR_NAME = '.infra-kit'\nconst USER_GLOBAL_CONFIG_FILE = 'infra-kit.json'\nconst USER_PROJECTS_DIR = 'projects'\n\n// envManagement\nconst dopplerEnvManagementSchema = z.object({\n  provider: z.literal('doppler'),\n  config: z.object({\n    name: z.string().min(1),\n  }),\n})\n\nconst envManagementSchema = z.discriminatedUnion('provider', [dopplerEnvManagementSchema])\n\n// ide\n// There is one attach style: each worktree is added to the configured editor's\n// workspace and opened (no per-window mode). Cursor needs a `.code-workspace`\n// path to reconcile its `folders` array against.\nconst cursorIdeConfigSchema = z.object({\n  workspaceConfigPath: z.string().min(1),\n})\n\nconst cursorIdeSchema = z.object({\n  provider: z.literal('cursor'),\n  config: cursorIdeConfigSchema,\n})\n\n// Zed has no portable workspace file (no `.code-workspace`) and no folder-remove\n// CLI: a multi-worktree workspace is realized by a single `zed <root> <wt...>`\n// invocation. So `config` carries no settings \u2014 there's no path to point at.\nconst zedIdeConfigSchema = z.object({})\n\nconst zedIdeSchema = z.object({\n  provider: z.literal('zed'),\n  config: zedIdeConfigSchema,\n})\n\nconst ideSchema = z.discriminatedUnion('provider', [cursorIdeSchema, zedIdeSchema])\n\n// `ide` accepts a single provider (back-compat) OR an array to drive multiple\n// editors at once (e.g. Cursor + Zed). Normalized to an array everywhere via\n// `resolveConfiguredIdes`. Uniqueness-by-provider is enforced at parse time by a\n// `.superRefine` on the full config schema (see below) \u2014 not here, so the message\n// survives `z.union` error aggregation.\nconst idesSchema = z.union([ideSchema, z.array(ideSchema).min(1)])\n\n// taskManager\nconst jiraTaskManagerSchema = z.object({\n  provider: z.literal('jira'),\n  config: z.object({\n    baseUrl: z.string().url(),\n    projectId: z.number().int().positive(),\n  }),\n})\n\nconst taskManagerSchema = z.discriminatedUnion('provider', [jiraTaskManagerSchema])\n\n// cmux pane layout for opened worktree workspaces. Named presets keep the config\n// typo-proof (an enum, not a free string) and let the opener switch on a single\n// value; extend the enum + the opener's switch to add a layout.\n//   two-columns \u2014 left | right, both full-height (default)\n//   three-pane  \u2014 left split top/bottom + full-height right (legacy layout)\nconst cmuxLayouts = ['two-columns', 'three-pane'] as const\n\nconst cmuxConfigSchema = z.object({\n  layout: z.enum(cmuxLayouts).optional(),\n})\n\n// worktrees prompt defaults\nconst worktreesConfigSchema = z.object({\n  openInGithubDesktop: z.boolean().optional(),\n  openInCmux: z.boolean().optional(),\n  cmux: cmuxConfigSchema.optional(),\n})\n\n// dev-server per-app overrides. Maps an app folder name (e.g. `client`) to its\n// local dev port and/or URL prefix. Both keys optional. An app absent from the\n// map falls back to env (`{APP}_PORT` / `PORT`) then the built-in defaults, so\n// the map is intentionally NOT validated against the discovered apps here \u2014 an\n// unknown app name is simply ignored at resolve time (lib/dev), never a parse\n// error that would brick every command.\nconst devAppConfigSchema = z\n  .object({\n    port: z.number().int().positive().optional(),\n    prefixUrl: z.string().min(1).optional(),\n  })\n  .strict()\n\nconst devConfigSchema = z.record(z.string().min(1), devAppConfigSchema)\n\n// devServersPresets: named local-dev sessions, declared in the per-project infra-kit.json\n// (team presets committed; personal ones layered via the user-project override).\n// Each preset names launch targets (apps/<app>/{api,ui}), optional per-backend\n// `watchDeps`, per-route proxy-source overrides, and a `cmux` layout flag; it is\n// consumed by `infra-kit dev <preset>` and resolved by src/dev/presets. Each target key\n// names exactly one workspace package (`<app>/api` or `<app>/ui`) \u2014 a bare `<app>` is a\n// folder, not a package, and is rejected. The SHAPE is strict (typos in a preset surface\n// as parse errors), but unknown app/route NAMES are intentionally NOT validated here \u2014\n// they resolve at run time against the discovered apps, so a stale preset never bricks\n// every command.\nconst proxySourceSchema = z.enum(['local', 'cloud'])\n\nconst devPresetAppSchema = z\n  .object({\n    // api targets only: watch the backend's dist + shared-package subdeps and restart on change.\n    watchDeps: z.boolean().optional(),\n    // route path (e.g. `/api`) \u2192 source, overriding that route's config.ts default for this session.\n    proxy: z.record(z.string().min(1), proxySourceSchema).optional(),\n  })\n  .strict()\n\nconst devPresetSchema = z\n  .object({\n    // Launch-target key \u2014 one package: `client/ui`, `client/api`, `*/api`. Omit `apps` = all.\n    apps: z.record(z.string().min(1), devPresetAppSchema).optional(),\n    // Run each launched target in its own cmux pane (one workspace, N panes).\n    cmux: z.boolean().optional(),\n  })\n  .strict()\n\nconst devPresetsSchema = z.record(z.string().min(1), devPresetSchema)\n\n// DEPRECATED (accepted and ignored). Layer-B local-dev proxy (portless).\n//\n// The proxy port is no longer negotiable: every dev URL is `https://<release>.<packageName>.localhost`\n// with NO port, and the only port that can serve a port-free HTTPS URL is 443. A configurable port would\n// put the port straight back into the URL \u2014 the exact thing this design removes.\n//\n// The key is still PARSED so it does not brick anything: `infraKitConfigObject` is `.strict()` and\n// `getInfraKitConfig` THROWS on an unknown key, so simply deleting it would hard-fail EVERY infra-kit\n// command (not just `dev`) on any machine whose config still carries it \u2014 arriving unannounced, because\n// the CLI self-updates. It is read by nothing and silently ignored. Remove one release from now.\nconst devProxyConfigSchema = z\n  .object({\n    port: z.number().int().positive().optional(),\n  })\n  .strict()\n\n// env auto-load: opt-in convenience that primes Doppler env when you work inside\n// this project / a worktree. Absent => disabled. `trigger` selects the moment\n// (pick one):\n//   shell-startup  \u2014 when a new shell opens inside the project\n//   cli-invocation \u2014 before each `infra-kit` command (primes SUBSEQUENT commands)\n// `config` names which environment to load. It is intentionally NOT validated\n// against `environments` here: an invalid name must DISABLE the feature at\n// resolve time (lib/env-autoload), never throw inside the merged-config parse and\n// brick every command.\nconst envAutoLoadSchema = z\n  .object({\n    trigger: z.enum(['shell-startup', 'cli-invocation']),\n    config: z.string().min(1),\n  })\n  .strict()\n\n// Base object shape, kept separate so `.partial()` (which only works on a plain\n// ZodObject, not the `.superRefine`-wrapped full schema) can derive the override\n// schema from it.\n//\n// `.strict()` for the same reason every leaf schema below is: this is the one config file humans\n// hand-edit, and a non-strict top level silently swallows the typo that matters most. `devServersPreset`\n// (missing `s`) or `dev-proxy` would parse clean and turn the feature off with no message. The `dev` and\n// `devServersPresets` values stay open `z.record`s \u2014 app and preset NAMES are user-chosen \u2014 so strictness\n// applies to the key set, not the contents.\n// GONE: `environments`. It answered three questions at once and was therefore wrong for two of them.\n// Where can I deploy? \u2192 each workflow's own `workflow_dispatch` `environment.options`, which GitHub\n// validates server-side (`lib/workflow-envs`). What can I authenticate to? \u2192 the token store\n// (`lib/env-tokens`). Being a third, hand-maintained copy of both, it drifted from both: hulyo declared\n// 6 envs while every hulyo workflow declared 8, and the client-side check turned that drift into a\n// REFUSAL to deploy to `stage` and `prod`.\n//\n// Deleted outright rather than accepted-and-ignored: the key is removed from every repo in the same\n// change, so nothing that is checked out on a current branch still carries it. Because this schema is\n// `.strict()`, a config that DOES still carry it (an old release branch, an unmigrated worktree) is\n// refused with `Unrecognized key: \"environments\"` \u2014 delete the key there too.\nexport const infraKitConfigObject = z\n  .object({\n    envManagement: envManagementSchema,\n    ide: idesSchema.optional(),\n    taskManager: taskManagerSchema.optional(),\n    worktrees: worktreesConfigSchema.optional(),\n    envAutoLoad: envAutoLoadSchema.optional(),\n    dev: devConfigSchema.optional(),\n    devServersPresets: devPresetsSchema.optional(),\n    devProxy: devProxyConfigSchema.optional(),\n  })\n  .strict()\n\n/**\n * The portless proxy's listen port. `443` \u2014 the implicit HTTPS port \u2014 because that is the ONLY port that\n * can serve a port-free `https://<release>.<packageName>.localhost` URL, which is the whole point.\n *\n * It is privileged, so the daemon must already be running: `infra-kit dev` PROBES it and never elevates\n * (portless binds `:443` by re-execing through `sudo` with an inherited stdio, which a detached child can\n * never answer). One-time, out-of-band: a root `portless service install`, which `dev` and `doctor` print\n * for the user as an absolute-path command (portless is not on `PATH`; see `formatPortlessCommand`). There\n * is deliberately no unprivileged fallback \u2014 a fallback puts the port back in the URL.\n *\n * Not a constant of convenience: it is the single value that decides the scheme, and TLS on 443 is\n * portless's own default (our previous `--no-tls` was the deviation).\n */\nexport const DEFAULT_DEV_PROXY_PORT = 443\n\n// Full schema = base object + a parse-time uniqueness check on the `ide` array.\n// This runs inside the *merged* `safeParse` in getInfraKitConfig, so it's the\n// gate for the final config. (The override layers use the `.partial()` form\n// below, which drops this object-level refinement \u2014 acceptable, the merged\n// parse is authoritative.)\nexport const infraKitConfigSchema = infraKitConfigObject.superRefine((cfg, ctx) => {\n  if (!Array.isArray(cfg.ide)) return\n\n  const seen = new Set<string>()\n\n  for (const entry of cfg.ide) {\n    if (seen.has(entry.provider)) {\n      ctx.addIssue({\n        code: 'custom',\n        message: 'each IDE provider may appear at most once',\n        path: ['ide'],\n      })\n\n      return\n    }\n\n    seen.add(entry.provider)\n  }\n})\n\nexport const infraKitOverrideConfigSchema = infraKitConfigObject.partial()\n\nexport type InfraKitConfig = z.infer<typeof infraKitConfigSchema>\n\n/** Resolved env auto-load config (`{ trigger, config }`), or `undefined` when off. */\nexport type EnvAutoLoadConfig = z.infer<typeof envAutoLoadSchema>\n\n/** Per-app dev-server overrides (`{ port?, prefixUrl? }`). */\nexport type DevAppConfig = z.infer<typeof devAppConfigSchema>\n\n/** The full `dev` section: a map of app folder name to its {@link DevAppConfig}. */\nexport type DevConfig = z.infer<typeof devConfigSchema>\n\n/** A proxy route's resolved source in a preset override (`'local' | 'cloud'`). */\nexport type ProxySource = z.infer<typeof proxySourceSchema>\n\n/** A single dev preset (`{ apps?, cmux? }`) from the `devServersPresets` map. */\nexport type DevPreset = z.infer<typeof devPresetSchema>\n\n/** The `devServersPresets` map: preset name \u2192 {@link DevPreset}. */\nexport type DevPresets = z.infer<typeof devPresetsSchema>\n\n/** A single resolved IDE entry (`{ provider, config }`). */\nexport type ConfiguredIde = z.infer<typeof ideSchema>\n\n/**\n * Normalize the `ide` config (single object, array, or unset) into a flat list.\n * Validation-free: assumes already-parsed input (uniqueness is enforced by the\n * schema). The one source of truth for \"which editors are configured.\"\n *\n * @example\n * resolveConfiguredIdes({ ide: { provider: 'cursor', config: {...} } }) // => [cursor]\n * resolveConfiguredIdes({ ide: [cursor, zed] })                         // => [cursor, zed]\n * resolveConfiguredIdes({})                                             // => []\n */\nexport const resolveConfiguredIdes = (config: InfraKitConfig): ConfiguredIde[] => {\n  const ide = config.ide\n\n  if (!ide) return []\n\n  return Array.isArray(ide) ? ide : [ide]\n}\n\n/** A cmux pane layout preset (see {@link cmuxLayouts}). */\nexport type CmuxLayout = (typeof cmuxLayouts)[number]\n\n/** The layout applied when `worktrees.cmux.layout` is left unset. */\nexport const DEFAULT_CMUX_LAYOUT: CmuxLayout = 'two-columns'\n\n/**\n * Resolve the cmux pane layout for opened worktree workspaces, falling back to\n * {@link DEFAULT_CMUX_LAYOUT} when unconfigured. The one source of truth for\n * \"which layout should the cmux opener build.\"\n *\n * @example\n * resolveCmuxLayout({ worktrees: { cmux: { layout: 'three-pane' } } }) // => 'three-pane'\n * resolveCmuxLayout({})                                                // => 'two-columns'\n */\nexport const resolveCmuxLayout = (config: InfraKitConfig): CmuxLayout => {\n  return config.worktrees?.cmux?.layout ?? DEFAULT_CMUX_LAYOUT\n}\n\nexport interface InfraKitConfigPaths {\n  /** Committed project config (required). */\n  main: string\n  /** User-scope global overrides applied to every project. */\n  userGlobal: string\n  /** User-scope per-project overrides \u2014 `<userProjectsDir>/<projectName>/infra-kit.json`. */\n  userProject: string\n  /** Repo basename (`path.basename(projectRoot)`) used to namespace the user-project file. */\n  projectName: string\n}\n\ninterface CacheEntry {\n  /** `cwd + homedir` \u2014 see {@link pathsCacheKey}. Required alongside `mtimes`: mtimes alone can\n   * collide across two different repo roots (or two homedirs), which would serve one repo's config\n   * to a request for another inside a long-lived process (the MCP server). */\n  key: string\n  mtimes: Record<keyof Omit<InfraKitConfigPaths, 'projectName'>, number | null>\n  value: InfraKitConfig\n}\n\nlet cached: CacheEntry | null = null\n\ninterface PathsCacheEntry {\n  key: string\n  value: InfraKitConfigPaths\n}\n\n/**\n * Memo slot for {@link getInfraKitConfigPaths}. SINGLE-ENTRY, not a `Map`: the resolver's only\n * inputs are `process.cwd()` and `os.homedir()`, and production never mutates either (there is zero\n * `process.chdir` outside tests), so one key covers the whole process lifetime. A `Map` would buy\n * nothing there and could hand a chdir'ing test file a stale sibling entry; a single slot that\n * recomputes on key mismatch is strictly safer and identically fast.\n */\nlet cachedPaths: PathsCacheEntry | null = null\n\n/**\n * Cache key for {@link cachedPaths}. `homedir` is load-bearing, not decoration: the resolver reads\n * it directly, and a dozen test files swap it for a fresh `mkdtemp` home WITHOUT chdir'ing \u2014 a\n * cwd-only key would hand test B test A's already-deleted temp home.\n *\n * @example\n * pathsCacheKey() // => '/Users/arthur/projects/api /Users/arthur'\n */\nconst pathsCacheKey = (): string => {\n  return `${process.cwd()} ${os.homedir()}`\n}\n\n/**\n * Resolve every file path that participates in the config merge chain. Always\n * returns paths even for files that don't yet exist, so callers can use them\n * for \"where would my override go?\" prompts.\n *\n * Memoized on `cwd + homedir` (see {@link cachedPaths}) because the two `git rev-parse` spawns below\n * run BEFORE the mtime cache in `getInfraKitConfig`, so without this every call paid for both. The\n * memo is populated on success only \u2014 `getProjectRoot` rejects outside a git repo and callers depend\n * on that rejection, so a cached rejection would be a stateful negative path. Cleared by\n * {@link resetInfraKitConfigCache}.\n *\n * Safe to memoize: this is a pure path resolver (inputs = cwd + homedir; it returns paths, never\n * file contents), so filesystem mutation cannot invalidate it.\n *\n * @example\n * const paths = await getInfraKitConfigPaths()\n * // {\n * //   main:        '/Users/arthur/projects/api/infra-kit.json',\n * //   userGlobal:  '/Users/arthur/.infra-kit/infra-kit.json',\n * //   userProject: '/Users/arthur/.infra-kit/projects/api/infra-kit.json',\n * //   projectName: 'api',\n * // }\n */\nexport const getInfraKitConfigPaths = async (): Promise<InfraKitConfigPaths> => {\n  const key = pathsCacheKey()\n\n  if (cachedPaths && cachedPaths.key === key) {\n    return cachedPaths.value\n  }\n\n  const projectRoot = await getProjectRoot()\n  // Namespace the per-project override on the MAIN repo root, not `projectRoot`.\n  // Inside a linked worktree `projectRoot` is the worktree's own path, so its\n  // basename is the worktree's leaf dir (e.g. `feature-x`), which would key the\n  // override to a different, per-worktree file. `getMainRepoRoot` resolves the\n  // shared git common dir so every worktree of a repo converges on one key. The\n  // second `git rev-parse` this costs is fine \u2014 the merged config is mtime-cached.\n  const mainRepoRoot = await getMainRepoRoot(projectRoot)\n  const projectName = path.basename(mainRepoRoot)\n  const userConfigDir = path.join(os.homedir(), USER_CONFIG_DIR_NAME)\n\n  const value: InfraKitConfigPaths = {\n    main: path.join(projectRoot, INFRA_KIT_CONFIG_FILE),\n    userGlobal: path.join(userConfigDir, USER_GLOBAL_CONFIG_FILE),\n    userProject: path.join(userConfigDir, USER_PROJECTS_DIR, projectName, INFRA_KIT_CONFIG_FILE),\n    projectName,\n  }\n\n  // Populate only after both git calls RESOLVED \u2014 never cache a rejection.\n  cachedPaths = { key, value }\n\n  return value\n}\n\n/**\n * Read and validate `infra-kit.json`, with optional override layers shallow-merged\n * on top in this order (later wins):\n *   1. project `infra-kit.json`                            \u2014 committed source of truth\n *   2. `~/.infra-kit/infra-kit.json`                       \u2014 user-global defaults\n *   3. `~/.infra-kit/projects/<repo-name>/infra-kit.json`  \u2014 user-scope per-project overrides\n *\n * Top-level keys (entire capability sections like `ide`, `envManagement`)\n * replace wholesale. Results are cached per file mtimes so the long-running\n * MCP server picks up edits without a restart.\n *\n * @example\n * // infra-kit.json:           { \"environments\": [\"dev\"], \"envManagement\": { \"provider\": \"doppler\", \"config\": { \"name\": \"p\" } } }\n * // ~/.infra-kit/infra-kit.json: { \"ide\": { \"provider\": \"cursor\", \"config\": { \"workspaceConfigPath\": \"./ws.code-workspace\" } } }\n * const cfg = await getInfraKitConfig()\n * // => { environments: ['dev'], envManagement: {...}, ide: { provider: 'cursor', config: { workspaceConfigPath: './ws.code-workspace' } } }\n */\nexport const getInfraKitConfig = async (): Promise<InfraKitConfig> => {\n  const key = pathsCacheKey()\n  const paths = await getInfraKitConfigPaths()\n\n  let mainStat: Awaited<ReturnType<typeof fs.stat>>\n\n  try {\n    mainStat = await fs.stat(paths.main)\n  } catch {\n    cached = null\n\n    // Bridge the YAML\u2192JSON cutover: if a legacy infra-kit.yml is sitting where\n    // the JSON config should be, point the user at the one-shot migration.\n    const legacyYmlPath = paths.main.replace(/\\.json$/, '.yml')\n\n    if (await statIfExists(legacyYmlPath)) {\n      throw new Error(\n        `infra-kit.json not found at ${paths.main}. A legacy infra-kit.yml exists \u2014 run \\`infra-kit init\\` to convert it.`,\n      )\n    }\n\n    throw new Error(\n      isMcpMode()\n        ? `infra-kit.json not found at ${paths.main} \u2014 the directory the infra-kit MCP server was launched in is not an infra-kit project. The operator must relaunch the server with its working directory set to an infra-kit project repo.`\n        : `infra-kit.json not found at ${paths.main} \u2014 this git repo is not an infra-kit project. Run \\`infra-kit init\\` here to create it, cd into an infra-kit project repo, or check out a branch that has infra-kit.json.`,\n    )\n  }\n\n  const [userGlobalStat, userProjectStat] = await Promise.all([\n    statIfExists(paths.userGlobal),\n    statIfExists(paths.userProject),\n  ])\n\n  const mtimes = {\n    main: Number(mainStat.mtimeMs),\n    userGlobal: userGlobalStat ? Number(userGlobalStat.mtimeMs) : null,\n    userProject: userProjectStat ? Number(userProjectStat.mtimeMs) : null,\n  }\n\n  if (cached && cached.key === key && shallowEqual(cached.mtimes, mtimes)) {\n    return cached.value\n  }\n\n  const layers: ConfigLayer[] = [\n    { label: 'infra-kit.json', path: paths.main, required: true },\n    { label: '~/.infra-kit/infra-kit.json', path: paths.userGlobal, required: false },\n    {\n      label: `~/.infra-kit/projects/${paths.projectName}/infra-kit.json`,\n      path: paths.userProject,\n      required: false,\n    },\n  ]\n\n  let merged: Record<string, unknown> = {}\n\n  for (const layer of layers) {\n    const data = await loadLayer(layer)\n\n    if (data === null) continue\n\n    merged = { ...merged, ...data }\n  }\n\n  const finalResult = infraKitConfigSchema.safeParse(merged)\n\n  if (!finalResult.success) {\n    throw new Error(`Invalid merged infra-kit config: ${z.prettifyError(finalResult.error)}`)\n  }\n\n  cached = { key, mtimes, value: finalResult.data }\n\n  return finalResult.data\n}\n\n/**\n * Drop ONLY the merged-config cache ({@link cached}), keeping the path memo ({@link cachedPaths})\n * intact. For writers of a merge layer \u2014 the config bootstrap, which creates the layer-3\n * `~/.infra-kit/projects/<repo>/infra-kit.json`.\n *\n * WHY this exists separately from {@link resetInfraKitConfigCache}: writing the layer-3 file changes\n * the MERGE RESULT (a stale merged config would miss the new layer) but it cannot change the\n * RESOLVED PATHS \u2014 those are a pure function of `cwd + homedir`, and creating a file mutates\n * neither. Blowing away the path memo there would just make the very run that creates the file\n * re-spawn both `git rev-parse` processes for nothing: 4 spawns instead of 2.\n *\n * @example\n * await fs.writeFile(paths.userProject, '{}\\n', 'utf-8')\n * resetMergedConfigCache()\n * await getInfraKitConfig()      // sees the new layer-3 layer\n * await getInfraKitConfigPaths() // still served from the memo \u2014 zero extra git spawns\n */\nexport const resetMergedConfigCache = (): void => {\n  cached = null\n}\n\n/**\n * For tests \u2014 drops BOTH in-memory caches: the mtime-fingerprinted merged config and the\n * `cwd + homedir`-keyed path memo ({@link cachedPaths}). The next read re-spawns `git rev-parse`\n * and re-hits disk. Production writers want the narrower {@link resetMergedConfigCache}.\n *\n * @example\n * resetInfraKitConfigCache()\n * await getInfraKitConfig() // re-resolves paths and re-reads files even if mtimes look unchanged\n */\nexport const resetInfraKitConfigCache = (): void => {\n  cached = null\n  cachedPaths = null\n}\n\n/**\n * `fs.stat` that returns `null` instead of throwing on ENOENT. Used so the\n * resolver can probe optional files in the merge chain without try/catch noise.\n *\n * @example\n * const stat = await statIfExists('/does/not/exist') // => null\n */\nconst statIfExists = async (filePath: string): Promise<Awaited<ReturnType<typeof fs.stat>> | null> => {\n  try {\n    return await fs.stat(filePath)\n  } catch {\n    return null\n  }\n}\n\n/**\n * `fs.readFile` that returns `null` instead of throwing on ENOENT.\n *\n * @example\n * const raw = await readIfExists('/missing.json') // => null\n * const raw = await readIfExists('/exists.json')  // => '{ \"environments\": [\"dev\"] }\\n'\n */\nconst readIfExists = async (filePath: string): Promise<string | null> => {\n  try {\n    return await fs.readFile(filePath, 'utf-8')\n  } catch {\n    return null\n  }\n}\n\n/**\n * Reference-equality comparison of every key in two flat records. Used to\n * cheaply detect whether the cached mtime fingerprint still matches.\n *\n * @example\n * shallowEqual({ a: 1, b: 2 }, { a: 1, b: 2 }) // => true\n * shallowEqual({ a: 1 },       { a: 1, b: 2 }) // => false\n * shallowEqual({ a: 1 },       { a: 2 })       // => false\n */\nconst shallowEqual = <T extends Record<string, unknown>>(a: T, b: T): boolean => {\n  const keys = Object.keys(a)\n\n  if (keys.length !== Object.keys(b).length) return false\n\n  return keys.every((k) => {\n    return a[k] === b[k]\n  })\n}\n\ninterface ConfigLayer {\n  label: string\n  path: string\n  required: boolean\n}\n\n/**\n * Read a single layer of the merge chain: parse the JSON if the file exists\n * and validate it against the override schema. Returns `null` if an optional\n * layer is missing; throws if the layer is required, malformed, or invalid.\n * An empty/whitespace-only file is treated as `{}` (JSON.parse would throw).\n *\n * @example\n * await loadLayer({ label: '~/.infra-kit/infra-kit.json', path: '/missing.json', required: false })\n * // => null\n *\n * @example\n * // /home/me/.infra-kit/infra-kit.json: '{ \"ide\": { \"provider\": \"cursor\", \"config\": { \"workspaceConfigPath\": \"./ws.code-workspace\" } } }'\n * await loadLayer({ label: '~/.infra-kit/infra-kit.json', path: '/home/me/.infra-kit/infra-kit.json', required: false })\n * // => { ide: { provider: 'cursor', config: { workspaceConfigPath: './ws.code-workspace' } } }\n */\nconst loadLayer = async (layer: ConfigLayer): Promise<Record<string, unknown> | null> => {\n  const raw = await readIfExists(layer.path)\n\n  if (raw === null) {\n    if (layer.required) {\n      throw new Error(`${layer.label} not found at ${layer.path}`)\n    }\n\n    return null\n  }\n\n  let parsedRaw: unknown\n\n  try {\n    parsedRaw = raw.trim() === '' ? {} : JSON.parse(raw)\n  } catch (err) {\n    throw new Error(`Invalid JSON in ${layer.label} at ${layer.path}: ${(err as Error).message}`)\n  }\n\n  // `envTokens` is ALREADY rejected below \u2014 the override schema keeps `.strict()`, so it lands as a\n  // generic `unrecognized_keys` issue. That generic message is wrong for this one key: the user has\n  // pasted a live Doppler service token into a file that may be committed, backed up by their editor,\n  // or opened by `config edit`. The first instruction has to be REVOKE, not \"fix your config\". Narrow\n  // by construction \u2014 every other unknown key keeps the generic error.\n  if (isRecord(parsedRaw) && 'envTokens' in parsedRaw) {\n    throw new Error(buildEnvTokensRejectionMessage(layer))\n  }\n\n  const result = infraKitOverrideConfigSchema.safeParse(parsedRaw)\n\n  if (!result.success) {\n    throw new Error(`Invalid ${layer.label} at ${layer.path}: ${z.prettifyError(result.error)}`)\n  }\n\n  return result.data as Record<string, unknown>\n}\n\n/**\n * Narrow parsed JSON to a plain object so a key probe is safe (JSON's top level may be an array, a\n * string, or `null`).\n *\n * @example\n * isRecord({ envTokens: {} }) // => true\n * isRecord(['envTokens'])     // => false\n * isRecord(null)              // => false\n */\nconst isRecord = (value: unknown): value is Record<string, unknown> => {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n\n/**\n * The REVOKE-first refusal for a service token found in an `infra-kit.json`. Ordered by urgency: the\n * credential is already exposed, so revoking it beats editing the file. Tokens live in a SIBLING\n * `tokens.json` (0600) that this loader never reads \u2014 see `lib/env-tokens`.\n *\n * @example\n * buildEnvTokensRejectionMessage({ label: 'infra-kit.json', path: '/r/infra-kit.json', required: true })\n * // => 'Refusing to load infra-kit.json \u2014 `envTokens` is not a config key. \u2026'\n */\nconst buildEnvTokensRejectionMessage = (layer: ConfigLayer): string => {\n  return [\n    `Refusing to load ${layer.label} \u2014 \\`envTokens\\` is not a config key.`,\n    'A service token in a config file can be committed, backed up by your editor, or shared.',\n    '  1. REVOKE the token in Doppler now \u2014 treat it as compromised.',\n    `  2. Remove the \\`envTokens\\` key from ${layer.path}.`,\n    '  3. Re-add it privately: `infra-kit env-token-set <env>`',\n    '     (it is written to ~/.infra-kit/projects/<repo>/tokens.json, mode 0600, never to the repo).',\n  ].join('\\n')\n}\n", "import path from 'node:path'\nimport process from 'node:process'\nimport { $ } from 'zx'\n\nimport { OperationError, extractStderr } from 'src/lib/errors/operation-error'\nimport { isMcpMode } from 'src/lib/mcp-mode'\nimport { isReleaseBranch } from 'src/lib/release-id'\n\n/**\n * A single record from `git worktree list --porcelain`. The porcelain format is\n * the source of truth for worktrees: it carries the absolute `path` (which the\n * human format's `[branch]` scrape discards), and it distinguishes detached /\n * bare / prunable / locked states that the scrape collapses to `null`.\n *\n * `branch` is the short name (`release/v1.2.3`, `feature/x`) with `refs/heads/`\n * stripped, or `null` for a detached, bare, or otherwise branch-less checkout.\n */\nexport interface WorktreeEntry {\n  path: string\n  branch: string | null\n  detached: boolean\n  bare: boolean\n  prunable: boolean\n  locked: boolean\n}\n\n/**\n * List every git worktree of the repo containing `cwd`, parsed from\n * `git worktree list --porcelain`.\n *\n * Porcelain is a stable, documented, line-oriented format: one record per\n * worktree, records separated by a blank line, each opening with a\n * `worktree <abs-path>` line. Attribute lines (`branch`, `detached`, `bare`,\n * `locked`, `prunable`) follow. This replaces the legacy `endsWith(']')` scrape\n * of the human format, which lost the path and returned `null` for detached\n * worktrees.\n *\n * The main checkout is included in the output (as its own record), exactly as\n * git reports it.\n */\nexport const listWorktrees = async (cwd: string): Promise<WorktreeEntry[]> => {\n  const output = await $({ cwd })`git worktree list --porcelain`\n\n  const entries: WorktreeEntry[] = []\n  let current: WorktreeEntry | null = null\n\n  for (const line of output.stdout.split('\\n')) {\n    if (line.startsWith('worktree ')) {\n      // A new record opens; flush the previous one.\n      if (current) entries.push(current)\n\n      current = {\n        path: line.slice('worktree '.length),\n        branch: null,\n        detached: false,\n        bare: false,\n        prunable: false,\n        locked: false,\n      }\n\n      continue\n    }\n\n    if (!current) continue\n\n    if (line.startsWith('branch ')) {\n      current.branch = line.slice('branch '.length).replace(/^refs\\/heads\\//, '')\n    } else if (line === 'detached') {\n      current.detached = true\n    } else if (line === 'bare') {\n      current.bare = true\n    } else if (line === 'locked' || line.startsWith('locked ')) {\n      current.locked = true\n    } else if (line === 'prunable' || line.startsWith('prunable ')) {\n      current.prunable = true\n    }\n  }\n\n  if (current) entries.push(current)\n\n  return entries\n}\n\n/**\n * Get current git worktrees\n *\n * Thin wrapper over {@link listWorktrees}: harvests branch names from the\n * porcelain records and filters by release / feature shape. Detached, bare, and\n * branch-less records drop out naturally (their `branch` is `null`).\n *\n * @returns [release/v1.18.22, release/v1.18.23, release/v1.18.24] or [feature/mobile-app, feature/explore-page, feature/login-page]\n */\nexport const getCurrentWorktrees = async (type: 'release' | 'feature'): Promise<string[]> => {\n  const entries = await listWorktrees(process.cwd())\n\n  const matches = (branch: string): boolean => {\n    return type === 'release' ? isReleaseBranch(branch) : branch.startsWith('feature/')\n  }\n\n  return entries\n    .map((entry) => {\n      return entry.branch\n    })\n    .filter((branch): branch is string => {\n      return branch !== null && matches(branch)\n    })\n}\n\n/**\n * Trim git's `not a git repository (or any of the parent directories): .git` tail \u2014 and ONLY that.\n * Returns undefined for every other failure so `OperationError` falls through to the real stderr:\n * dubious ownership, EACCES, a corrupt repo, and a missing `git` binary must each report themselves.\n */\nconst normalizeGitRootStderr = (error: unknown): string | undefined => {\n  const raw = extractStderr(error)\n\n  return raw && /not a git repository/i.test(raw) ? 'not a git repository' : undefined\n}\n\n/**\n * Remediation text for a failed project-root resolution.\n *\n * Channel-aware: an MCP server's cwd is fixed at spawn and the CLI has no\n * `--project`/`--cwd`/`-C`, so an agent told to \"cd\" has NO available action \u2014\n * the only actor who can act is the human operator.\n *\n * `hasStderr` gates the stderr-referencing clause: with no stderr (missing `git`\n * binary, ENOENT) the message must not point at evidence it does not carry.\n */\nconst projectRootRemediation = ({ hasStderr }: { hasStderr: boolean }): string => {\n  if (isMcpMode()) {\n    return 'the infra-kit MCP server resolves its project from the working directory it was launched in; the operator must relaunch the server with its working directory set to an infra-kit project repo'\n  }\n\n  const base = 'run infra-kit from inside an infra-kit project repo (or one of its git worktrees)'\n\n  return hasStderr ? `${base}; if you are already in one, the stderr in this message is the real cause` : base\n}\n\n/**\n * Get the current project root directory\n */\nexport const getProjectRoot = async (): Promise<string> => {\n  try {\n    const result = await $({ quiet: true })`git rev-parse --show-toplevel`\n\n    return result.stdout.trim()\n  } catch (error) {\n    const stderrExcerpt = normalizeGitRootStderr(error) ?? extractStderr(error)\n\n    throw new OperationError(error, {\n      operation: `resolve the project root from ${process.cwd()}`,\n      stderrExcerpt,\n      remediation: projectRootRemediation({ hasStderr: stderrExcerpt !== undefined }),\n    })\n  }\n}\n\n/**\n * Absolute path to the MAIN repository root \u2014 invariant across the main checkout\n * and all of its linked worktrees. A linked worktree's `--show-toplevel` is the\n * worktree's own path, but its `--git-common-dir` still points at the shared\n * `<main>/.git`, so the parent of the resolved common dir is always the main repo.\n * This is the stable identity to key per-repo state on (unlike `getProjectRoot`,\n * whose basename is the worktree's leaf directory inside a worktree).\n *\n * Submodules are the one exception: their common dir is\n * `<super>/.git/modules/<name>`, whose parent (`.../.git/modules`) is not a repo\n * root \u2014 there is no meaningful \"main repo\" to converge on \u2014 so we fall back to\n * the caller-supplied toplevel unchanged. Callers must pass a git toplevel as\n * `cwd` (e.g. the result of {@link getProjectRoot}); the fallback assumes it.\n *\n * @example\n * // main checkout: common dir '.git' \u2192 resolve \u2192 '<main>/.git' \u2192 dirname \u2192 '<main>'\n * await getMainRepoRoot('/Users/me/projects/hulyo')            // => '/Users/me/projects/hulyo'\n * // linked worktree: common dir '<main>/.git' \u2192 dirname \u2192 '<main>'\n * await getMainRepoRoot('/Users/me/projects/hulyo-worktrees/feature/x') // => '/Users/me/projects/hulyo'\n */\nexport const getMainRepoRoot = async (cwd?: string): Promise<string> => {\n  const root = cwd ?? (await getProjectRoot())\n  const commonDir = (await $({ cwd: root, quiet: true })`git rev-parse --git-common-dir`).stdout.trim()\n  const resolved = path.resolve(root, commonDir)\n\n  // Submodule: common dir sits under `<super>/.git/modules/<name>` \u2014 no stable\n  // main-repo root to key on, so keep the caller's own toplevel.\n  if (resolved.includes(`${path.sep}.git${path.sep}modules${path.sep}`)) return root\n\n  return path.dirname(resolved)\n}\n\n/**\n * Get the current git branch name (e.g. `dev`, `main`, `release/v1.2.3`).\n */\nexport const getCurrentBranch = async (): Promise<string> => {\n  const result = await $`git rev-parse --abbrev-ref HEAD`\n\n  return result.stdout.trim()\n}\n\n/**\n * Whether the working tree has no staged, unstaged, or untracked changes.\n */\nexport const isWorkingTreeClean = async (): Promise<boolean> => {\n  const result = await $`git status --porcelain`\n\n  return result.stdout.trim().length === 0\n}\n\n/**\n * Whether the current checkout is a linked git worktree rather than the main\n * repository checkout.\n *\n * A linked worktree's git dir lives under `<main>/.git/worktrees/<name>`, so it\n * differs from the shared common dir; in the main checkout the two resolve to\n * the same path. Both are anchored to the toplevel so `--git-common-dir` (which\n * git may report relative to cwd) resolves consistently.\n */\nexport const isInsideLinkedWorktree = async (): Promise<boolean> => {\n  const cwd = await getProjectRoot()\n\n  const [gitDirResult, commonDirResult] = await Promise.all([\n    $({ cwd })`git rev-parse --absolute-git-dir`,\n    $({ cwd })`git rev-parse --git-common-dir`,\n  ])\n\n  const gitDir = gitDirResult.stdout.trim()\n  const commonDir = path.resolve(cwd, commonDirResult.stdout.trim())\n\n  return gitDir !== commonDir\n}\n\n/**\n * Get the current repository name (basename of the project root)\n */\nexport const getRepoName = async (): Promise<string> => {\n  const projectRoot = await getProjectRoot()\n\n  return path.basename(projectRoot)\n}\n\n/**\n * Delete a local branch if it exists and is not the current checkout.\n *\n * Idempotent: a no-op when the branch is absent (`git branch --list` prints\n * nothing). Uses force `-D` because a delivered release branch was\n * squash-merged \u2014 its tip is unreachable from the base, so `-d` would refuse\n * with \"not fully merged\". The delete itself still rejects if the branch is\n * checked out in another worktree; callers decide how to handle that.\n */\nexport const deleteLocalBranch = async (branch: string): Promise<void> => {\n  const listed = await $`git branch --list ${branch}`\n\n  if (listed.stdout.trim().length === 0) return\n\n  if ((await getCurrentBranch()) === branch) return\n\n  await $`git branch -D ${branch}`\n}\n\n/**\n * Delete a branch on the `origin` remote if it exists.\n *\n * Idempotent: a no-op when the branch is absent on the remote. Existence is\n * probed with `git ls-remote --heads` (empty stdout = absent) rather than\n * `--exit-code`, so a genuine network/auth failure rejects and propagates to\n * the caller instead of being silently misread as \"branch absent\".\n */\nexport const deleteRemoteBranch = async (branch: string): Promise<void> => {\n  const refs = await $`git ls-remote --heads origin ${branch}`\n\n  if (refs.stdout.trim().length === 0) return\n\n  await $`git push origin --delete ${branch}`\n}\n", "const STDERR_EXCERPT_MAX_BYTES = 200\n\nexport interface OperationErrorContext {\n  operation: string\n  remediation?: string\n  stderrExcerpt?: string\n}\n\n/**\n * Duck-typed read of zx's `ProcessOutput.stderr` (and similar shapes) without\n * importing zx types just for an `instanceof` check.\n *\n * @example\n * extractStderr(new Error('x'))               // undefined\n * extractStderr({ stderr: 'fatal: ...' })     // 'fatal: ...'\n * extractStderr({ stderr: '' })               // undefined  (empty treated as missing)\n */\nexport const extractStderr = (cause: unknown): string | undefined => {\n  if (cause === null || typeof cause !== 'object') return undefined\n  const stderr = (cause as { stderr?: unknown }).stderr\n\n  return typeof stderr === 'string' && stderr.length > 0 ? stderr : undefined\n}\n\n/**\n * Compose the human-and-agent-readable message body for an `OperationError`:\n * `\"failed to <operation> [\u2014 stderr: <excerpt>] [\u2014 try: <remediation>]\"`.\n * `stderrExcerpt` overrides anything duck-typed off `cause`; both are trimmed\n * and capped at {@link STDERR_EXCERPT_MAX_BYTES} so a runaway subprocess can't\n * blow up the message.\n */\nconst buildMessage = (cause: unknown, ctx: OperationErrorContext): string => {\n  const stderr = ctx.stderrExcerpt ?? extractStderr(cause)\n  const parts = [`failed to ${ctx.operation}`]\n\n  if (stderr) parts.push(`stderr: ${stderr.slice(0, STDERR_EXCERPT_MAX_BYTES).trim()}`)\n  if (ctx.remediation) parts.push(`try: ${ctx.remediation}`)\n\n  return parts.join(' \u2014 ')\n}\n\n/**\n * Error type for any handler-level failure that should surface to the caller\n * (CLI user or MCP-connected agent) with a remediation hint. Wraps an\n * underlying cause and renders a single-line, structured message so logs and\n * agent tool-result text stay scannable.\n *\n * Pattern modeled on the exemplary Doppler errors in\n * `src/integrations/doppler/doppler-errors.ts`.\n *\n * @example\n * // wrap a zx subprocess failure\n * try {\n *   await $`git worktree add ${path} ${branch}`\n * } catch (err) {\n *   throw new OperationError(err, {\n *     operation: `git worktree add for ${branch}`,\n *     remediation: 'check the branch name and that the parent dir is writable',\n *   })\n * }\n *\n * @example\n * // validation failure with no underlying cause\n * throw new OperationError(undefined, {\n *   operation: 'launch deploy-all workflow',\n *   remediation: `pass one of: ${environments.join(', ')}`,\n *   stderrExcerpt: `invalid environment: ${selectedEnv}`,\n * })\n */\nexport class OperationError extends Error {\n  readonly operation: string\n  readonly remediation?: string\n\n  constructor(cause: unknown, ctx: OperationErrorContext) {\n    super(buildMessage(cause, ctx), { cause })\n    this.name = 'OperationError'\n    this.operation = ctx.operation\n    this.remediation = ctx.remediation\n  }\n}\n", "/**\n * MCP-mode flag for the CLI. `process.stdin` is the JSON-RPC transport when the\n * binary runs as an MCP server, so anything that would read keystrokes from it\n * (raw `data` listeners, Ink screens, `@inquirer` prompts) must be gated off.\n *\n * This exists because `process.stdin.isTTY` CANNOT answer that question:\n * `commands/mcp/mcp.ts` spawns the server with `stdio: 'inherit'`, so a\n * terminal-launched `infra-kit mcp` hands the child a real TTY stdin and an\n * isTTY-keyed guard does not fire. Piped stdio (how Claude Code spawns it) only\n * makes isTTY look sufficient by coincidence.\n *\n * Set in `createMcpServer()` \u2014 the importable, transport-free entry that every\n * MCP launch goes through \u2014 not in `entry/mcp.ts`, which starts a server at\n * module scope and so can never assert the flag was actually set.\n */\n\n/** Mutable holder (object so `prefer-const` holds while the flag toggles per run). */\nexport const mcpMode = { enabled: false }\n\n/** True when this process is serving MCP, i.e. `process.stdin` carries JSON-RPC. */\nexport const isMcpMode = (): boolean => {\n  return mcpMode.enabled\n}\n", "/**\n * A release identity is either a semantic version or a free-form kebab-case\n * name. `raw` is the canonical token for the id: the no-`v` semver string for\n * versions (e.g. `1.2.3`) and the name itself for named releases.\n */\nexport type ReleaseId =\n  | { kind: 'version'; semver: { major: number; minor: number; patch: number }; raw: string }\n  | { kind: 'name'; name: string; raw: string }\n\n/** Matches a bare or `v`-prefixed semver token, e.g. `1.2.3` or `v1.2.3`. */\nconst VERSION_RE = /^v?(\\d+)\\.(\\d+)\\.(\\d+)$/\n\n/** Matches the semver core after the `v` in a `release/v\u2026` branch. */\nconst BRANCH_SEMVER_RE = /^(\\d+)\\.(\\d+)\\.(\\d+)$/\n\n/** Kebab-case: lowercase alphanumeric segments joined by single hyphens. */\nconst KEBAB_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/\n\nconst RELEASE_BRANCH_PREFIX = 'release/'\nconst VERSION_BRANCH_PREFIX = 'release/v'\nconst REFS_HEADS_PREFIX = 'refs/heads/'\n\nconst NEXT_TOKEN = 'next'\nconst MAX_NAME_LENGTH = 50\n\n/**\n * Names that would collide with branch/release semantics or read as a special\n * token. Banned regardless of kebab-case validity.\n */\nconst RESERVED_NAMES: ReadonlySet<string> = new Set(['dev', 'main', 'next', 'hotfix', 'regular', 'release'])\n\n/** Thrown by {@link validateName} when a release name is not acceptable. */\nexport class InvalidReleaseNameError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'InvalidReleaseNameError'\n  }\n}\n\n/** Thrown by {@link parseReleaseRef} when a release ref cannot be parsed. */\nexport class InvalidReleaseRefError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'InvalidReleaseRefError'\n  }\n}\n\nconst stripRefsHeads = (input: string): string => {\n  return input.startsWith(REFS_HEADS_PREFIX) ? input.slice(REFS_HEADS_PREFIX.length) : input\n}\n\nconst makeVersion = (major: number, minor: number, patch: number): ReleaseId => {\n  return {\n    kind: 'version',\n    semver: { major, minor, patch },\n    raw: `${major}.${minor}.${patch}`,\n  }\n}\n\n/**\n * Validate a release name. Throws {@link InvalidReleaseNameError} with a\n * specific message unless the name is kebab-case, at most 50 characters, and\n * not a reserved word. Semver-looking tokens (e.g. `1.2.3`) are already\n * excluded by the kebab-case rule since they contain dots.\n */\nexport const validateName = (name: string): void => {\n  if (name.length === 0) {\n    throw new InvalidReleaseNameError('Release name is empty. Provide a kebab-case name like \"checkout-redesign\".')\n  }\n\n  if (name.length > MAX_NAME_LENGTH) {\n    throw new InvalidReleaseNameError(\n      `Release name \"${name}\" is ${name.length} characters; the maximum is ${MAX_NAME_LENGTH}.`,\n    )\n  }\n\n  if (!KEBAB_RE.test(name)) {\n    throw new InvalidReleaseNameError(\n      `Release name \"${name}\" is not kebab-case. Use lowercase letters, digits, and single hyphens, e.g. \"checkout-redesign\".`,\n    )\n  }\n\n  if (RESERVED_NAMES.has(name)) {\n    throw new InvalidReleaseNameError(\n      `Release name \"${name}\" is reserved. Reserved names: ${[...RESERVED_NAMES].join(', ')}.`,\n    )\n  }\n}\n\n/**\n * Lenient parse of a git branch name into a {@link ReleaseId}. Tolerates a\n * leading `refs/heads/`. Returns `null` for anything that is not a valid\n * `release/v<semver>` or `release/<name>` branch. Never throws.\n *\n * Precedence is version-first: `release/v<semver>` is a version, but if the\n * segment after `release/v` is not a valid semver (e.g. `release/vnext`), the\n * whole token after `release/` is treated as a candidate name instead.\n */\nexport const parseBranchName = (branch: string): ReleaseId | null => {\n  const stripped = stripRefsHeads(branch.trim())\n\n  if (!stripped.startsWith(RELEASE_BRANCH_PREFIX)) return null\n\n  if (stripped.startsWith(VERSION_BRANCH_PREFIX)) {\n    const semverPart = stripped.slice(VERSION_BRANCH_PREFIX.length)\n    const match = BRANCH_SEMVER_RE.exec(semverPart)\n\n    if (match) {\n      return makeVersion(Number(match[1]), Number(match[2]), Number(match[3]))\n    }\n  }\n\n  const namePart = stripped.slice(RELEASE_BRANCH_PREFIX.length)\n\n  try {\n    validateName(namePart)\n  } catch {\n    return null\n  }\n\n  return { kind: 'name', name: namePart, raw: namePart }\n}\n\n/**\n * Strict parse of a release ref into a {@link ReleaseId}. Throws\n * {@link InvalidReleaseRefError} on invalid input. Precedence (order matters):\n *   1. `release/\u2026` (or `refs/heads/release/\u2026`) \u2192 delegate to parseBranchName.\n *   2. semver token (`1.2.3` / `v1.2.3`) \u2192 version.\n *   3. `next` \u2192 throws; callers must resolve `next` to a concrete version\n *      via computeNextVersion before calling this.\n *   4. otherwise \u2192 validateName, returning a named release.\n */\nexport const parseReleaseRef = (input: string): ReleaseId => {\n  const trimmed = input.trim()\n  const branchCandidate = stripRefsHeads(trimmed)\n\n  if (branchCandidate.startsWith(RELEASE_BRANCH_PREFIX)) {\n    const parsed = parseBranchName(trimmed)\n\n    if (!parsed) {\n      throw new InvalidReleaseRefError(\n        `\"${input}\" looks like a release branch but is not a valid release/v<semver> or release/<name> ref.`,\n      )\n    }\n\n    return parsed\n  }\n\n  const versionMatch = VERSION_RE.exec(trimmed)\n\n  if (versionMatch) {\n    return makeVersion(Number(versionMatch[1]), Number(versionMatch[2]), Number(versionMatch[3]))\n  }\n\n  if (trimmed.toLowerCase() === NEXT_TOKEN) {\n    throw new InvalidReleaseRefError(\n      'The \"next\" token must be resolved to a concrete version (via computeNextVersion) before parsing a release ref.',\n    )\n  }\n\n  try {\n    validateName(trimmed)\n  } catch (err) {\n    const reason = err instanceof Error ? err.message : String(err)\n\n    throw new InvalidReleaseRefError(`Cannot parse \"${input}\" as a release ref: ${reason}`)\n  }\n\n  return { kind: 'name', name: trimmed, raw: trimmed }\n}\n\n/** Render the branch name for a release id: `release/v1.2.3` | `release/<name>`. */\nexport const formatBranchName = (id: ReleaseId): string => {\n  if (id.kind === 'version') return `${VERSION_BRANCH_PREFIX}${id.raw}`\n\n  return `${RELEASE_BRANCH_PREFIX}${id.name}`\n}\n\n/**\n * Render a PR title: `Release v1.2.3` / `Hotfix v1.2.3` for versions,\n * `Release <name>` / `Hotfix <name>` for names.\n */\nexport const formatPrTitle = (id: ReleaseId, type: 'regular' | 'hotfix'): string => {\n  const prefix = type === 'hotfix' ? 'Hotfix' : 'Release'\n\n  if (id.kind === 'version') return `${prefix} v${id.raw}`\n\n  return `${prefix} ${id.name}`\n}\n\n/** Render a release-candidate PR title: `Release v1.2.3 (RC)` | `Release <name> (RC)`. */\nexport const formatRcTitle = (id: ReleaseId): string => {\n  if (id.kind === 'version') return `Release v${id.raw} (RC)`\n\n  return `Release ${id.name} (RC)`\n}\n\n/** Render the Jira fix-version name: `v1.2.3` | `<name>`. */\nexport const formatJiraName = (id: ReleaseId): string => {\n  if (id.kind === 'version') return `v${id.raw}`\n\n  return id.name\n}\n\n/** Render a short human display label: `1.2.3` | `<name>`. */\nexport const displayLabel = (id: ReleaseId): string => {\n  return id.raw\n}\n\n/** True iff `branch` is a valid release branch under either scheme. */\nexport const isReleaseBranch = (branch: string | null | undefined): boolean => {\n  if (branch === null || branch === undefined) return false\n\n  return parseBranchName(branch) !== null\n}\n\nconst toTime = (value: string | Date | undefined): number | null => {\n  if (value === undefined) return null\n\n  const time = value instanceof Date ? value.getTime() : new Date(value).getTime()\n\n  return Number.isNaN(time) ? null : time\n}\n\n/**\n * Comparator for {@link ReleaseId} values (locked ordering):\n *   - All versions sort before all names.\n *   - Versions: semver ascending (major, then minor, then patch; numeric).\n *   - Names: by date ascending when both dates are provided, otherwise\n *     lexicographic by name. The result is stable and deterministic.\n */\nexport const compareReleaseIds = (\n  a: ReleaseId,\n  b: ReleaseId,\n  dates?: { a?: string | Date; b?: string | Date },\n): number => {\n  if (a.kind === 'version' && b.kind === 'version') {\n    if (a.semver.major !== b.semver.major) return a.semver.major - b.semver.major\n    if (a.semver.minor !== b.semver.minor) return a.semver.minor - b.semver.minor\n\n    return a.semver.patch - b.semver.patch\n  }\n\n  if (a.kind === 'version') return -1\n  if (b.kind === 'version') return 1\n\n  const timeA = toTime(dates?.a)\n  const timeB = toTime(dates?.b)\n\n  if (timeA !== null && timeB !== null && timeA !== timeB) {\n    return timeA - timeB\n  }\n\n  if (a.name < b.name) return -1\n  if (a.name > b.name) return 1\n\n  return 0\n}\n"],
+  "mappings": "AAAA,OAAOA,MAAa,eACpB,OAAOC,MAAU,OACjB,OAAOC,OAAY,cAGZ,IAAMC,EAAgB,yBAgBvBC,EAAe,CACnB,QACA,UACA,eACA,iBACA,gBACA,kBACA,sBACA,uBACF,EAEaC,GAAgB,IAAM,CACjC,IAAMC,EAAWN,EAAQ,KAAK,SAAS,SAAS,EAAI,QAAU,OAExDO,EAASN,EAAK,CAAE,MAAOK,EAAU,OAAQF,CAAa,EAAGH,EAAK,YAAY,CAAE,KAAME,CAAc,CAAC,CAAC,EAExG,OAAAI,EAAO,KAAK,kCAAkCD,CAAQ,iBAAiBH,CAAa,EAAE,EAE/EI,CACT,EAEaC,GAAgB,IAAM,CACjC,IAAMF,EAAWN,EAAQ,KAAK,SAAS,SAAS,EAAI,QAAU,OAExDS,EAAe,CAAC,OAAQ,MAAO,UAAU,EAE/C,OAAIH,IAAa,SACfG,EAAa,KAAK,OAAO,EAGZR,EACb,CAAE,MAAOK,EAAU,OAAQF,CAAa,EACxCF,GAAO,CACL,YAAa,EACb,OAAQO,EAAa,KAAK,GAAG,EAC7B,SAAU,EACZ,CAAC,CACH,CAGF,EAGaF,GAASC,GAAc,ECxDpC,UAAYE,MAAQ,UACpB,UAAYC,MAAU,YAYf,SAASC,GAAiBC,EAA0B,CACzD,IAAIC,EAAaD,EAEjB,QAASE,EAAI,EAAGA,EAAI,GAAIA,IAAK,CAC3B,IAAMC,EAAqB,OAAKF,EAAY,qBAAqB,EAEjE,GAAO,aAAWE,CAAa,EAC7B,OAAOF,EAETA,EAAkB,UAAQA,CAAU,CACtC,CAEA,MAAM,IAAI,MAAM,oDAAoD,CACtE,CAGO,SAASG,EAAeC,EAAiBC,EAAyB,CACvE,IAAMC,EAAe,OAAKF,EAAS,cAAc,EAEjD,GAAI,CAAI,aAAWE,CAAO,EAAG,OAAOD,EAEpC,GAAI,CACF,IAAME,EAAM,KAAK,MAAS,eAAaD,EAAS,OAAO,CAAC,EAExD,OAAO,OAAOC,EAAI,MAAS,SAAWA,EAAI,KAAOF,CACnD,MAAQ,CACN,OAAOA,CACT,CACF,CAGO,SAASG,GAAgBC,EAAkC,CAChE,IAAMC,EAAe,OAAKD,EAAM,MAAM,EAChCE,EAA2B,CAAC,EAElC,GAAI,CAAI,aAAWD,CAAO,EACxB,MAAM,IAAI,MAAM,6BAA6BA,CAAO,EAAE,EAGxD,IAAME,EACH,cAAYF,EAAS,CAAE,cAAe,EAAK,CAAC,EAC5C,OAAQG,GACAA,EAAO,YAAY,CAC3B,EACA,IAAKA,GACGA,EAAO,IACf,EAEH,QAAWR,KAAWO,EAAS,CAC7B,IAAMR,EAAe,OAAKM,EAASL,EAAS,KAAK,EAC3CS,EAAsB,OAAKV,EAAS,gBAAgB,EAEnD,aAAWU,CAAc,GAC9BH,EAAK,KAAK,CACR,KAAMN,EACN,YAAaF,EAAeC,EAASC,CAAO,EAC5C,KAAMD,CACR,CAAC,CAEL,CAEA,OAAOO,CACT,CAuBA,IAAMI,EAAoB,CACxB,iBACA,kBACA,kBACA,iBACA,kBACA,iBACF,EAsBaC,GAA4B,CACvC,wBACA,+BACA,gBACF,EAQO,SAASC,GAAiBC,EAAsB,CACrD,QAAWC,KAAQJ,EAAmB,CACpC,IAAMK,EAAkB,OAAKF,EAAKC,CAAI,EAEtC,GAAQ,aAAWC,CAAU,EAE7B,GAAI,CACF,IAAMC,EAAY,eAAaD,EAAY,OAAO,EAElD,OAAOJ,GAA0B,KAAMM,GAC9BD,EAAO,SAASC,CAAS,CACjC,CACH,MAAQ,CACN,MAAO,EACT,CACF,CAEA,MAAO,EACT,CAgBO,SAASC,GAAuBL,EAAsB,CAC3D,QAAWC,KAAQJ,EAAmB,CACpC,IAAMK,EAAkB,OAAKF,EAAKC,CAAI,EAEtC,GAAQ,aAAWC,CAAU,EAE7B,GAAI,CACF,OAAU,eAAaA,EAAY,OAAO,EAAE,SAAS,WAAW,CAClE,MAAQ,CACN,MAAO,EACT,CACF,CAEA,MAAO,EACT,CAGA,SAASI,GAAaN,EAAsB,CAC1C,IAAMZ,EAAe,OAAKY,EAAK,cAAc,EAE7C,GAAI,CAAI,aAAWZ,CAAO,EAAG,MAAO,GAEpC,GAAI,CACF,IAAMC,EAAM,KAAK,MAAS,eAAaD,EAAS,OAAO,CAAC,EAExD,OAAO,OAAOC,EAAI,SAAS,KAAQ,UAAYA,EAAI,QAAQ,IAAI,OAAS,CAC1E,MAAQ,CACN,MAAO,EACT,CACF,CAOO,SAASkB,GAAehB,EAAiC,CAC9D,IAAMC,EAAe,OAAKD,EAAM,MAAM,EAChCE,EAA0B,CAAC,EAEjC,GAAI,CAAI,aAAWD,CAAO,EAAG,OAAOC,EAEpC,IAAMC,EACH,cAAYF,EAAS,CAAE,cAAe,EAAK,CAAC,EAC5C,OAAQG,GACAA,EAAO,YAAY,CAC3B,EACA,IAAKA,GACGA,EAAO,IACf,EAEH,QAAWR,KAAWO,EAAS,CAC7B,IAAMc,EAAc,OAAKhB,EAASL,EAAS,IAAI,EAExC,aAAWqB,CAAM,GAAKF,GAAaE,CAAM,GAC9Cf,EAAK,KAAK,CACR,KAAMN,EACN,YAAaF,EAAeuB,EAAQrB,CAAO,EAC3C,KAAMqB,EACN,YAAaT,GAAiBS,CAAM,CACtC,CAAC,CAEL,CAEA,OAAOf,CACT,CAGO,SAASgB,GAAoBC,EAA4C,CAC9E,IAAMC,EAAWD,GAAS,OAAO,OAAO,GAAK,CAAC,EAE9C,OAAOC,EAAS,OAAS,EAAIA,EAAW,IAC1C,CAaO,SAASC,GAAmB/B,EAA0B,CAC3D,IAAMU,EAAOX,GAAiBC,CAAQ,EAChCgC,EAAgB,WAAc,OAAKtB,EAAM,MAAM,EAAGV,CAAQ,EAC1DiC,EAAeD,EAAS,MAAW,KAAG,EAAE,CAAC,EAG/C,GAFsBA,IAAa,IAAMA,EAAS,WAAW,IAAI,GAAU,aAAWA,CAAQ,GAEzE,CAACC,EACpB,MAAM,IAAI,MACR,oDAAoDjC,CAAQ,gDAC9D,EAGF,OAAOiC,CACT,CAGA,IAAMC,GAAgB,IAAI,IAAI,CAAC,MAAO,IAAI,CAAC,EAGrCC,EAAmBhB,GAAoC,CAC3D,IAAMiB,EAAe,OAAKjB,EAAK,MAAM,EAErC,OAAU,aAAWiB,CAAO,GAAQ,WAASA,CAAO,EAAE,YAAY,EAAIA,EAAU,MAClF,EAGMC,EAAelB,GACX,aAAWA,CAAG,EAGnB,cAAYA,EAAK,CAAE,cAAe,EAAK,CAAC,EACxC,OAAQmB,GACAA,EAAE,YAAY,CACtB,EACA,IAAKA,GACGA,EAAE,IACV,EAT6B,CAAC,EA4B5B,SAASC,GAAmB7B,EAAwB,CACzD,IAAM8B,EAAiB,CAAC,EAExB,QAAWC,KAAQJ,EAAiB,OAAK3B,EAAM,UAAU,CAAC,EAAG,CAC3D,IAAM0B,EAAUD,EAAqB,OAAKzB,EAAM,WAAY+B,CAAI,CAAC,EAE7DL,IAAY,QAAWI,EAAK,KAAKJ,CAAO,CAC9C,CAEA,IAAMzB,EAAe,OAAKD,EAAM,MAAM,EAEtC,QAAWgC,KAAOL,EAAY1B,CAAO,EACnC,QAAWgC,KAAQN,EAAiB,OAAK1B,EAAS+B,CAAG,CAAC,EAAG,CACvD,GAAIR,GAAc,IAAIS,CAAI,EAAG,SAE7B,IAAMC,EAAe,OAAKjC,EAAS+B,EAAKC,CAAI,EAG5C,GAAI,CAAI,aAAgB,OAAKC,EAAS,cAAc,CAAC,EAAG,SAExD,IAAMR,EAAUD,EAAgBS,CAAO,EAEnCR,IAAY,QAAWI,EAAK,KAAKJ,CAAO,CAC9C,CAGF,OAAOI,CACT,CAGO,SAASK,GAAejC,EAAyC,CACtE,OAAOA,EACJ,IAAK8B,GACQ,OAAKA,EAAI,KAAM,MAAM,CAClC,EACA,OAAQvB,GACG,aAAWA,CAAG,CACzB,CACL,CAkBO,SAAS2B,GACdC,EACAC,EACAC,EACsB,CACtB,IAAMC,EAAkB,YAAUH,CAAW,EAEvCI,EAAoBF,EAAgB,KAAM9B,GACvC+B,EAAW,WAAgB,YAAU/B,CAAG,CAAC,CACjD,EAED,OAAIgC,EACK,CAAE,KAAM,UAAW,WAAYA,CAAkB,EAOnD,CAAE,KAAM,MAAO,IAJHH,EAAY,KAAM7B,GAC5B+B,EAAW,WAAgB,YAAU/B,CAAG,CAAC,CACjD,CAEqC,CACxC,CCzUA,IAAMiC,GAAmD,CAAE,QAAS,CAAC,EAAG,OAAQ,CAAC,CAAE,EAuBtEC,EAAoBC,GAA+B,CAC9D,IAAMC,EAAWD,EAAI,MAAM,GAAG,EACxB,CAACE,EAASC,CAAI,EAAIF,EAExB,OAAIA,EAAS,SAAW,GAAK,CAACC,EACrB,sCAAsCF,CAAG,yCAG9CG,IAAS,OAASA,IAAS,KACtB,2CAA2CA,CAAI,SAASH,CAAG,6BAG7D,IACT,EAWaI,GAAkBJ,GAA2B,CACxD,IAAMK,EAAQN,EAAiBC,CAAG,EAElC,GAAIK,EACF,MAAM,IAAI,MAAMA,CAAK,EAGvB,GAAM,CAACH,EAASC,CAAI,EAAIH,EAAI,MAAM,GAAG,EAErC,MAAO,CAAE,QAAAE,EAAS,KAAAC,CAAK,CACzB,EAGaG,GAAsBC,GAA0C,CAC3E,IAAMC,EAA2B,CAAC,EAElC,OAAW,CAACC,EAAQC,CAAG,IAAK,OAAO,QAAQH,CAAO,EAChD,QAAWP,KAAO,OAAO,KAAKU,EAAI,MAAQ,CAAC,CAAC,EAAG,CAC7C,IAAML,EAAQN,EAAiBC,CAAG,EAE9BK,GACFG,EAAO,KAAK,CAAE,OAAAC,EAAQ,IAAAT,EAAK,QAAS,WAAWS,CAAM,MAAMJ,CAAK,EAAG,CAAC,CAExE,CAGF,OAAOG,CACT,EAGMG,GAAe,CAACC,EAA6BT,IAC1CA,IAAS,MAAQS,EAAW,IAAMA,EAAW,GAIhDC,GAAWD,GACR,CAAC,GAAG,IAAI,IAAI,CAAC,GAAGA,EAAW,IAAK,GAAGA,EAAW,EAAE,CAAC,CAAC,EAAE,KAAK,EAI5DE,EAAW,CAACC,EAAaZ,IACtB,GAAGY,CAAG,IAAIZ,CAAI,GAqBjBa,GAAWC,GACRA,EAAS,EAAI,EAWhBC,GAAe,CACnBC,EACAC,IAGIA,EAAK,YAAc,OACdD,GAAS,CAAE,UAAW,GAAM,KAAMC,EAAK,KAAM,cAAe,EAAM,EAIvE,CAACD,GAAS,CAACA,EAAM,cACZ,CAAE,UAAWC,EAAK,UAAW,KAAMA,EAAK,KAAM,cAAe,EAAK,EAIpEA,EAAK,KAAOD,EAAM,KAAO,CAAE,UAAWC,EAAK,UAAW,KAAMA,EAAK,KAAM,cAAe,EAAK,EAAID,EASlGE,GAAY,CAChBC,EACAV,EACAW,IACS,CACT,GAAM,CAAE,IAAAR,EAAK,KAAAZ,EAAM,UAAAqB,EAAW,OAAAP,CAAO,EAAIM,EAEzC,GAAI,CAACZ,GAAaC,EAAYT,CAAI,EAAE,SAASY,CAAG,EAAG,CAG5CE,GACHK,EAAM,UAAU,KAAKR,EAASC,EAAKZ,CAAI,CAAC,EAG1C,MACF,CAEA,IAAMsB,EAAKX,EAASC,EAAKZ,CAAI,EACvBuB,EAASR,GAAaI,EAAM,QAAQ,IAAIG,CAAE,EAAG,CAAE,UAAAD,EAAW,KAAMR,GAAQC,CAAM,CAAE,CAAC,EAEvFK,EAAM,QAAQ,IAAIG,EAAI,CAAE,IAAAV,EAAK,KAAAZ,EAAM,GAAGuB,CAAO,CAAC,CAChD,EAqBaC,GAAgB,CAAClB,EAAmBG,IAAgD,CAC/F,IAAMgB,EAAU,OAAO,QAAQnB,EAAO,MAAQX,EAAgB,EACxDwB,EAAsB,CAAE,QAAS,IAAI,IAAO,MAAO,CAAC,EAAG,UAAW,CAAC,CAAE,EAE3E,OAAW,CAACtB,EAAK6B,CAAG,IAAKD,EAAS,CAChC,GAAM,CAAE,QAAA1B,EAAS,KAAAC,CAAK,EAAIC,GAAeJ,CAAG,EACtCiB,EAASf,IAAY,IACrB4B,EAAOb,EAASJ,GAAQD,CAAU,EAAI,CAACV,CAAO,EAEpD,QAAWa,KAAOe,EAChBT,GAAUC,EAAOV,EAAY,CAAE,IAAAG,EAAK,KAAAZ,EAAM,UAAW0B,EAAI,UAAW,OAAAZ,CAAO,CAAC,EAExEY,EAAI,QACNP,EAAM,MAAMP,CAAG,EAAI,CAAE,GAAIO,EAAM,MAAMP,CAAG,GAAK,CAAC,EAAI,GAAGc,EAAI,KAAM,EAGrE,CAEA,IAAME,EAA4B,CAAC,GAAGT,EAAM,QAAQ,OAAO,CAAC,EAAE,IAAI,CAAC,CAAE,IAAAP,EAAK,KAAAZ,EAAM,UAAAqB,CAAU,KACjF,CAAE,IAAAT,EAAK,KAAAZ,EAAM,UAAAqB,CAAU,EAC/B,EACKQ,EAAY,CAChB,GAAG,IAAI,IACLD,EACG,OAAQE,GACAA,EAAE,OAAS,KACnB,EACA,IAAKA,GACGA,EAAE,GACV,CACL,CACF,EAEA,MAAO,CAAE,QAAAF,EAAS,KAAMtB,EAAO,MAAQ,GAAO,MAAOa,EAAM,MAAO,UAAAU,EAAW,UAAWV,EAAM,SAAU,CAC1G,EAyBaY,GAAqBC,GAAoC,CACpE,GAAIA,EAAM,QAAU,KAClB,OAAOA,EAAM,OAEf,GAAIA,EAAM,QAAQ,SAAW,EAC3B,MAAO,UAGT,IAAMC,EAAU,IAAI,IAAID,EAAM,OAAO,EAKrC,OAJqBA,EAAM,WAAW,MAAOnC,GACpCoC,EAAQ,IAAIpC,CAAG,CACvB,EAEqB,IAAM,CAAC,GAAGoC,CAAO,EAAE,KAAK,EAAE,KAAK,KAAK,CAC5D,EAyCMC,GAAW,CAACC,EAAqCC,IAC9C,OAAO,KAAKD,CAAW,EAAE,KAAMvB,GAC7BuB,EAAYvB,CAAG,IAAMwB,CAC7B,EAQGC,GAAkB,CAAC,CAAE,OAAA/B,EAAQ,IAAAM,EAAK,MAAA0B,EAAO,aAAAC,EAAc,IAAAC,CAAI,IAAoD,CACnH,IAAMJ,EAAMI,EAAI,SAAS5B,EAAK0B,CAAK,EAEnC,GAAIF,IAAQ,OACV,MAAO,CACL,OAAA9B,EACA,IAAAM,EACA,MAAA0B,EACA,KAAM,gBACN,QAAS,WAAWhC,CAAM,sBAAsBgC,CAAK,SAAS1B,CAAG,mCAAmCA,CAAG,yCACzG,EAGF,GAAI2B,EAAa,IAAIH,CAAG,EACtB,OAAO,KAGT,IAAMK,EAAQP,GAASM,EAAI,YAAaJ,CAAG,EACrCM,EAAOD,EAAQ,QAAQA,CAAK,sBAAwB,oCAAoCL,CAAG,IAEjG,MAAO,CACL,OAAA9B,EACA,IAAAM,EACA,MAAA0B,EACA,IAAAF,EACA,KAAM,uBACN,QAAS,WAAW9B,CAAM,sBAAsBgC,CAAK,sCAAiCF,CAAG,8DAAyDM,CAAI,aAAaJ,CAAK,cAC1K,CACF,EAkBaK,GAAsB,CAACvC,EAAqBoC,IAAgD,CACvG,IAAMnC,EAA6B,CAAC,EAEpC,OAAW,CAACC,EAAQC,CAAG,IAAK,OAAO,QAAQH,CAAO,EAAG,CACnD,IAAMwC,EAAWpB,GAAcjB,EAAKiC,EAAI,UAAU,EAC5CD,EAAe,IAAI,IACvBK,EAAS,UACN,IAAKhC,GACG4B,EAAI,YAAY5B,CAAG,CAC3B,EACA,OAAQwB,GACAA,IAAQ,MAChB,CACL,EAEA,OAAW,CAACxB,EAAKiC,CAAM,IAAK,OAAO,QAAQD,EAAS,KAAK,EACvD,OAAW,CAACN,EAAOQ,CAAM,IAAK,OAAO,QAAQD,CAAM,EAAG,CACpD,GAAIC,IAAW,QACb,SAGF,IAAMC,EAAQV,GAAgB,CAAE,OAAA/B,EAAQ,IAAAM,EAAK,MAAA0B,EAAO,aAAAC,EAAc,IAAAC,CAAI,CAAC,EAEnEO,GACF1C,EAAO,KAAK0C,CAAK,CAErB,CAEJ,CAEA,OAAO1C,CACT,ECzcA,OAAO2C,MAAQ,mBACf,OAAOC,OAAQ,UACf,OAAOC,MAAU,YACjB,OAAOC,OAAa,eACpB,OAAS,KAAAC,MAAS,MCJlB,OAAOC,MAAU,YACjB,OAAOC,MAAa,eACpB,OAAS,KAAAC,MAAS,KCeX,IAAMC,EAAiBC,GAAuC,CACnE,GAAIA,IAAU,MAAQ,OAAOA,GAAU,SAAU,OACjD,IAAMC,EAAUD,EAA+B,OAE/C,OAAO,OAAOC,GAAW,UAAYA,EAAO,OAAS,EAAIA,EAAS,MACpE,EASMC,GAAe,CAACF,EAAgBG,IAAuC,CAC3E,IAAMF,EAASE,EAAI,eAAiBJ,EAAcC,CAAK,EACjDI,EAAQ,CAAC,aAAaD,EAAI,SAAS,EAAE,EAE3C,OAAIF,GAAQG,EAAM,KAAK,WAAWH,EAAO,MAAM,EAAG,GAAwB,EAAE,KAAK,CAAC,EAAE,EAChFE,EAAI,aAAaC,EAAM,KAAK,QAAQD,EAAI,WAAW,EAAE,EAElDC,EAAM,KAAK,UAAK,CACzB,EA8BaC,EAAN,cAA6B,KAAM,CAC/B,UACA,YAET,YAAYL,EAAgBG,EAA4B,CACtD,MAAMD,GAAaF,EAAOG,CAAG,EAAG,CAAE,MAAAH,CAAM,CAAC,EACzC,KAAK,KAAO,iBACZ,KAAK,UAAYG,EAAI,UACrB,KAAK,YAAcA,EAAI,WACzB,CACF,EC9DO,IAAMG,EAAU,CAAE,QAAS,EAAM,EAG3BC,EAAY,IAChBD,EAAQ,QCXjB,IAAME,GAAa,0BAGbC,GAAmB,wBAGnBC,GAAW,6BAEXC,EAAwB,WACxBC,EAAwB,YACxBC,EAAoB,cAEpBC,GAAa,OAOnB,IAAMC,EAAsC,IAAI,IAAI,CAAC,MAAO,OAAQ,OAAQ,SAAU,UAAW,SAAS,CAAC,EAG9FC,EAAN,cAAsC,KAAM,CACjD,YAAYC,EAAiB,CAC3B,MAAMA,CAAO,EACb,KAAK,KAAO,yBACd,CACF,EAGaC,EAAN,cAAqC,KAAM,CAChD,YAAYD,EAAiB,CAC3B,MAAMA,CAAO,EACb,KAAK,KAAO,wBACd,CACF,EAEME,EAAkBC,GACfA,EAAM,WAAWC,CAAiB,EAAID,EAAM,MAAMC,EAAkB,MAAM,EAAID,EAGjFE,EAAc,CAACC,EAAeC,EAAeC,KAC1C,CACL,KAAM,UACN,OAAQ,CAAE,MAAAF,EAAO,MAAAC,EAAO,MAAAC,CAAM,EAC9B,IAAK,GAAGF,CAAK,IAAIC,CAAK,IAAIC,CAAK,EACjC,GASWC,EAAgBC,GAAuB,CAClD,GAAIA,EAAK,SAAW,EAClB,MAAM,IAAIX,EAAwB,4EAA4E,EAGhH,GAAIW,EAAK,OAAS,GAChB,MAAM,IAAIX,EACR,iBAAiBW,CAAI,QAAQA,EAAK,MAAM,iCAC1C,EAGF,GAAI,CAACC,GAAS,KAAKD,CAAI,EACrB,MAAM,IAAIX,EACR,iBAAiBW,CAAI,mGACvB,EAGF,GAAIZ,EAAe,IAAIY,CAAI,EACzB,MAAM,IAAIX,EACR,iBAAiBW,CAAI,kCAAkC,CAAC,GAAGZ,CAAc,EAAE,KAAK,IAAI,CAAC,GACvF,CAEJ,EAWac,EAAmBC,GAAqC,CACnE,IAAMC,EAAWZ,EAAeW,EAAO,KAAK,CAAC,EAE7C,GAAI,CAACC,EAAS,WAAWC,CAAqB,EAAG,OAAO,KAExD,GAAID,EAAS,WAAWE,CAAqB,EAAG,CAC9C,IAAMC,EAAaH,EAAS,MAAME,EAAsB,MAAM,EACxDE,EAAQC,GAAiB,KAAKF,CAAU,EAE9C,GAAIC,EACF,OAAOb,EAAY,OAAOa,EAAM,CAAC,CAAC,EAAG,OAAOA,EAAM,CAAC,CAAC,EAAG,OAAOA,EAAM,CAAC,CAAC,CAAC,CAE3E,CAEA,IAAME,EAAWN,EAAS,MAAMC,EAAsB,MAAM,EAE5D,GAAI,CACFN,EAAaW,CAAQ,CACvB,MAAQ,CACN,OAAO,IACT,CAEA,MAAO,CAAE,KAAM,OAAQ,KAAMA,EAAU,IAAKA,CAAS,CACvD,EAWaC,GAAmBlB,GAA6B,CAC3D,IAAMmB,EAAUnB,EAAM,KAAK,EAG3B,GAFwBD,EAAeoB,CAAO,EAE1B,WAAWP,CAAqB,EAAG,CACrD,IAAMQ,EAASX,EAAgBU,CAAO,EAEtC,GAAI,CAACC,EACH,MAAM,IAAItB,EACR,IAAIE,CAAK,2FACX,EAGF,OAAOoB,CACT,CAEA,IAAMC,EAAeC,GAAW,KAAKH,CAAO,EAE5C,GAAIE,EACF,OAAOnB,EAAY,OAAOmB,EAAa,CAAC,CAAC,EAAG,OAAOA,EAAa,CAAC,CAAC,EAAG,OAAOA,EAAa,CAAC,CAAC,CAAC,EAG9F,GAAIF,EAAQ,YAAY,IAAMI,GAC5B,MAAM,IAAIzB,EACR,gHACF,EAGF,GAAI,CACFQ,EAAaa,CAAO,CACtB,OAASK,EAAK,CACZ,IAAMC,EAASD,aAAe,MAAQA,EAAI,QAAU,OAAOA,CAAG,EAE9D,MAAM,IAAI1B,EAAuB,iBAAiBE,CAAK,uBAAuByB,CAAM,EAAE,CACxF,CAEA,MAAO,CAAE,KAAM,OAAQ,KAAMN,EAAS,IAAKA,CAAQ,CACrD,EAGaO,GAAoBC,GAC3BA,EAAG,OAAS,UAAkB,GAAGd,CAAqB,GAAGc,EAAG,GAAG,GAE5D,GAAGf,CAAqB,GAAGe,EAAG,IAAI,GAO9BC,GAAgB,CAACD,EAAeE,IAAuC,CAClF,IAAMC,EAASD,IAAS,SAAW,SAAW,UAE9C,OAAIF,EAAG,OAAS,UAAkB,GAAGG,CAAM,KAAKH,EAAG,GAAG,GAE/C,GAAGG,CAAM,IAAIH,EAAG,IAAI,EAC7B,EAGaI,GAAiBJ,GACxBA,EAAG,OAAS,UAAkB,YAAYA,EAAG,GAAG,QAE7C,WAAWA,EAAG,IAAI,QAIdK,GAAkBL,GACzBA,EAAG,OAAS,UAAkB,IAAIA,EAAG,GAAG,GAErCA,EAAG,KAICM,GAAgBN,GACpBA,EAAG,IAICO,EAAmBxB,GAC1BA,GAAW,KAAqC,GAE7CD,EAAgBC,CAAM,IAAM,KAG/ByB,EAAUC,GAAoD,CAClE,GAAIA,IAAU,OAAW,OAAO,KAEhC,IAAMC,EAAOD,aAAiB,KAAOA,EAAM,QAAQ,EAAI,IAAI,KAAKA,CAAK,EAAE,QAAQ,EAE/E,OAAO,OAAO,MAAMC,CAAI,EAAI,KAAOA,CACrC,EASaC,GAAoB,CAC/BC,EACAC,EACAC,IACW,CACX,GAAIF,EAAE,OAAS,WAAaC,EAAE,OAAS,UACrC,OAAID,EAAE,OAAO,QAAUC,EAAE,OAAO,MAAcD,EAAE,OAAO,MAAQC,EAAE,OAAO,MACpED,EAAE,OAAO,QAAUC,EAAE,OAAO,MAAcD,EAAE,OAAO,MAAQC,EAAE,OAAO,MAEjED,EAAE,OAAO,MAAQC,EAAE,OAAO,MAGnC,GAAID,EAAE,OAAS,UAAW,MAAO,GACjC,GAAIC,EAAE,OAAS,UAAW,MAAO,GAEjC,IAAME,EAAQP,EAAOM,GAAO,CAAC,EACvBE,EAAQR,EAAOM,GAAO,CAAC,EAE7B,OAAIC,IAAU,MAAQC,IAAU,MAAQD,IAAUC,EACzCD,EAAQC,EAGbJ,EAAE,KAAOC,EAAE,KAAa,GACxBD,EAAE,KAAOC,EAAE,KAAa,EAErB,CACT,EHzNO,IAAMI,EAAgB,MAAOC,GAA0C,CAC5E,IAAMC,EAAS,MAAMC,EAAE,CAAE,IAAAF,CAAI,CAAC,iCAExBG,EAA2B,CAAC,EAC9BC,EAAgC,KAEpC,QAAWC,KAAQJ,EAAO,OAAO,MAAM;AAAA,CAAI,EAAG,CAC5C,GAAII,EAAK,WAAW,WAAW,EAAG,CAE5BD,GAASD,EAAQ,KAAKC,CAAO,EAEjCA,EAAU,CACR,KAAMC,EAAK,MAAM,CAAkB,EACnC,OAAQ,KACR,SAAU,GACV,KAAM,GACN,SAAU,GACV,OAAQ,EACV,EAEA,QACF,CAEKD,IAEDC,EAAK,WAAW,SAAS,EAC3BD,EAAQ,OAASC,EAAK,MAAM,CAAgB,EAAE,QAAQ,iBAAkB,EAAE,EACjEA,IAAS,WAClBD,EAAQ,SAAW,GACVC,IAAS,OAClBD,EAAQ,KAAO,GACNC,IAAS,UAAYA,EAAK,WAAW,SAAS,EACvDD,EAAQ,OAAS,IACRC,IAAS,YAAcA,EAAK,WAAW,WAAW,KAC3DD,EAAQ,SAAW,IAEvB,CAEA,OAAIA,GAASD,EAAQ,KAAKC,CAAO,EAE1BD,CACT,EAWaG,GAAsB,MAAOC,GAAmD,CAC3F,IAAMJ,EAAU,MAAMJ,EAAcS,EAAQ,IAAI,CAAC,EAE3CC,EAAWC,GACRH,IAAS,UAAYI,EAAgBD,CAAM,EAAIA,EAAO,WAAW,UAAU,EAGpF,OAAOP,EACJ,IAAKS,GACGA,EAAM,MACd,EACA,OAAQF,GACAA,IAAW,MAAQD,EAAQC,CAAM,CACzC,CACL,EAOMG,GAA0BC,GAAuC,CACrE,IAAMC,EAAMC,EAAcF,CAAK,EAE/B,OAAOC,GAAO,wBAAwB,KAAKA,CAAG,EAAI,uBAAyB,MAC7E,EAYME,GAAyB,CAAC,CAAE,UAAAC,CAAU,IAAsC,CAChF,GAAIC,EAAU,EACZ,MAAO,iMAGT,IAAMC,EAAO,oFAEb,OAAOF,EAAY,GAAGE,CAAI,4EAA8EA,CAC1G,EAKaC,EAAiB,SAA6B,CACzD,GAAI,CAGF,OAFe,MAAMnB,EAAE,CAAE,MAAO,EAAK,CAAC,kCAExB,OAAO,KAAK,CAC5B,OAASY,EAAO,CACd,IAAMQ,EAAgBT,GAAuBC,CAAK,GAAKE,EAAcF,CAAK,EAE1E,MAAM,IAAIS,EAAeT,EAAO,CAC9B,UAAW,iCAAiCN,EAAQ,IAAI,CAAC,GACzD,cAAAc,EACA,YAAaL,GAAuB,CAAE,UAAWK,IAAkB,MAAU,CAAC,CAChF,CAAC,CACH,CACF,EAsBaE,EAAkB,MAAOxB,GAAkC,CACtE,IAAMyB,EAAOzB,GAAQ,MAAMqB,EAAe,EACpCK,GAAa,MAAMxB,EAAE,CAAE,IAAKuB,EAAM,MAAO,EAAK,CAAC,mCAAmC,OAAO,KAAK,EAC9FE,EAAWC,EAAK,QAAQH,EAAMC,CAAS,EAI7C,OAAIC,EAAS,SAAS,GAAGC,EAAK,GAAG,OAAOA,EAAK,GAAG,UAAUA,EAAK,GAAG,EAAE,EAAUH,EAEvEG,EAAK,QAAQD,CAAQ,CAC9B,EAKaE,GAAmB,UACf,MAAM3B,oCAEP,OAAO,KAAK,EAMf4B,GAAqB,UACjB,MAAM5B,2BAEP,OAAO,KAAK,EAAE,SAAW,EAY5B6B,GAAyB,SAA8B,CAClE,IAAM/B,EAAM,MAAMqB,EAAe,EAE3B,CAACW,EAAcC,CAAe,EAAI,MAAM,QAAQ,IAAI,CACxD/B,EAAE,CAAE,IAAAF,CAAI,CAAC,oCACTE,EAAE,CAAE,IAAAF,CAAI,CAAC,iCACX,CAAC,EAEKkC,EAASF,EAAa,OAAO,KAAK,EAClCN,EAAYE,EAAK,QAAQ5B,EAAKiC,EAAgB,OAAO,KAAK,CAAC,EAEjE,OAAOC,IAAWR,CACpB,EAoBO,IAAMS,GAAoB,MAAOC,GAAkC,EACzD,MAAMC,sBAAsBD,CAAM,IAEtC,OAAO,KAAK,EAAE,SAAW,GAE/B,MAAME,GAAiB,IAAOF,GAEnC,MAAMC,kBAAkBD,CAAM,EAChC,EAUaG,GAAqB,MAAOH,GAAkC,EAC5D,MAAMC,iCAAiCD,CAAM,IAEjD,OAAO,KAAK,EAAE,SAAW,GAElC,MAAMC,6BAA6BD,CAAM,EAC3C,EDxQA,IAAMI,GAAwB,iBASjBC,GAAuB,aAC9BC,GAA0B,iBAC1BC,GAAoB,WAGpBC,GAA6BC,EAAE,OAAO,CAC1C,SAAUA,EAAE,QAAQ,SAAS,EAC7B,OAAQA,EAAE,OAAO,CACf,KAAMA,EAAE,OAAO,EAAE,IAAI,CAAC,CACxB,CAAC,CACH,CAAC,EAEKC,GAAsBD,EAAE,mBAAmB,WAAY,CAACD,EAA0B,CAAC,EAMnFG,GAAwBF,EAAE,OAAO,CACrC,oBAAqBA,EAAE,OAAO,EAAE,IAAI,CAAC,CACvC,CAAC,EAEKG,GAAkBH,EAAE,OAAO,CAC/B,SAAUA,EAAE,QAAQ,QAAQ,EAC5B,OAAQE,EACV,CAAC,EAKKE,GAAqBJ,EAAE,OAAO,CAAC,CAAC,EAEhCK,GAAeL,EAAE,OAAO,CAC5B,SAAUA,EAAE,QAAQ,KAAK,EACzB,OAAQI,EACV,CAAC,EAEKE,GAAYN,EAAE,mBAAmB,WAAY,CAACG,GAAiBE,EAAY,CAAC,EAO5EE,GAAaP,EAAE,MAAM,CAACM,GAAWN,EAAE,MAAMM,EAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAG3DE,GAAwBR,EAAE,OAAO,CACrC,SAAUA,EAAE,QAAQ,MAAM,EAC1B,OAAQA,EAAE,OAAO,CACf,QAASA,EAAE,OAAO,EAAE,IAAI,EACxB,UAAWA,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CACvC,CAAC,CACH,CAAC,EAEKS,GAAoBT,EAAE,mBAAmB,WAAY,CAACQ,EAAqB,CAAC,EAO5EE,GAAc,CAAC,cAAe,YAAY,EAE1CC,GAAmBX,EAAE,OAAO,CAChC,OAAQA,EAAE,KAAKU,EAAW,EAAE,SAAS,CACvC,CAAC,EAGKE,GAAwBZ,EAAE,OAAO,CACrC,oBAAqBA,EAAE,QAAQ,EAAE,SAAS,EAC1C,WAAYA,EAAE,QAAQ,EAAE,SAAS,EACjC,KAAMW,GAAiB,SAAS,CAClC,CAAC,EAQKE,GAAqBb,EACxB,OAAO,CACN,KAAMA,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAC3C,UAAWA,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,CACxC,CAAC,EACA,OAAO,EAEJc,GAAkBd,EAAE,OAAOA,EAAE,OAAO,EAAE,IAAI,CAAC,EAAGa,EAAkB,EAYhEE,GAAoBf,EAAE,KAAK,CAAC,QAAS,OAAO,CAAC,EAE7CgB,GAAqBhB,EACxB,OAAO,CAEN,UAAWA,EAAE,QAAQ,EAAE,SAAS,EAEhC,MAAOA,EAAE,OAAOA,EAAE,OAAO,EAAE,IAAI,CAAC,EAAGe,EAAiB,EAAE,SAAS,CACjE,CAAC,EACA,OAAO,EAEJE,GAAkBjB,EACrB,OAAO,CAEN,KAAMA,EAAE,OAAOA,EAAE,OAAO,EAAE,IAAI,CAAC,EAAGgB,EAAkB,EAAE,SAAS,EAE/D,KAAMhB,EAAE,QAAQ,EAAE,SAAS,CAC7B,CAAC,EACA,OAAO,EAEJkB,GAAmBlB,EAAE,OAAOA,EAAE,OAAO,EAAE,IAAI,CAAC,EAAGiB,EAAe,EAY9DE,GAAuBnB,EAC1B,OAAO,CACN,KAAMA,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,CAC7C,CAAC,EACA,OAAO,EAWJoB,GAAoBpB,EACvB,OAAO,CACN,QAASA,EAAE,KAAK,CAAC,gBAAiB,gBAAgB,CAAC,EACnD,OAAQA,EAAE,OAAO,EAAE,IAAI,CAAC,CAC1B,CAAC,EACA,OAAO,EAsBGqB,EAAuBrB,EACjC,OAAO,CACN,cAAeC,GACf,IAAKM,GAAW,SAAS,EACzB,YAAaE,GAAkB,SAAS,EACxC,UAAWG,GAAsB,SAAS,EAC1C,YAAaQ,GAAkB,SAAS,EACxC,IAAKN,GAAgB,SAAS,EAC9B,kBAAmBI,GAAiB,SAAS,EAC7C,SAAUC,GAAqB,SAAS,CAC1C,CAAC,EACA,OAAO,EAeGG,GAAyB,IAOzBC,GAAuBF,EAAqB,YAAY,CAACG,EAAKC,IAAQ,CACjF,GAAI,CAAC,MAAM,QAAQD,EAAI,GAAG,EAAG,OAE7B,IAAME,EAAO,IAAI,IAEjB,QAAWC,KAASH,EAAI,IAAK,CAC3B,GAAIE,EAAK,IAAIC,EAAM,QAAQ,EAAG,CAC5BF,EAAI,SAAS,CACX,KAAM,SACN,QAAS,4CACT,KAAM,CAAC,KAAK,CACd,CAAC,EAED,MACF,CAEAC,EAAK,IAAIC,EAAM,QAAQ,CACzB,CACF,CAAC,EAEYC,GAA+BP,EAAqB,QAAQ,EAmC5DQ,GAAyBC,GAA4C,CAChF,IAAMC,EAAMD,EAAO,IAEnB,OAAKC,EAEE,MAAM,QAAQA,CAAG,EAAIA,EAAM,CAACA,CAAG,EAFrB,CAAC,CAGpB,EAMaC,GAAkC,cAWlCC,GAAqBH,GACzBA,EAAO,WAAW,MAAM,QAAUE,GAuBvCE,EAA4B,KAc5BC,EAAsC,KAUpCC,GAAgB,IACb,GAAGC,GAAQ,IAAI,CAAC,IAAIC,GAAG,QAAQ,CAAC,GA0B5BC,GAAyB,SAA0C,CAC9E,IAAMC,EAAMJ,GAAc,EAE1B,GAAID,GAAeA,EAAY,MAAQK,EACrC,OAAOL,EAAY,MAGrB,IAAMM,EAAc,MAAMC,EAAe,EAOnCC,EAAe,MAAMC,EAAgBH,CAAW,EAChDI,EAAcC,EAAK,SAASH,CAAY,EACxCI,EAAgBD,EAAK,KAAKR,GAAG,QAAQ,EAAG1C,EAAoB,EAE5DoD,EAA6B,CACjC,KAAMF,EAAK,KAAKL,EAAa9C,EAAqB,EAClD,WAAYmD,EAAK,KAAKC,EAAelD,EAAuB,EAC5D,YAAaiD,EAAK,KAAKC,EAAejD,GAAmB+C,EAAalD,EAAqB,EAC3F,YAAAkD,CACF,EAGA,OAAAV,EAAc,CAAE,IAAAK,EAAK,MAAAQ,CAAM,EAEpBA,CACT,EAmBaC,GAAoB,SAAqC,CACpE,IAAMT,EAAMJ,GAAc,EACpBc,EAAQ,MAAMX,GAAuB,EAEvCY,EAEJ,GAAI,CACFA,EAAW,MAAMC,EAAG,KAAKF,EAAM,IAAI,CACrC,MAAQ,CACNhB,EAAS,KAIT,IAAMmB,EAAgBH,EAAM,KAAK,QAAQ,UAAW,MAAM,EAE1D,MAAI,MAAMI,EAAaD,CAAa,EAC5B,IAAI,MACR,+BAA+BH,EAAM,IAAI,8EAC3C,EAGI,IAAI,MACRK,EAAU,EACN,+BAA+BL,EAAM,IAAI,iMACzC,+BAA+BA,EAAM,IAAI,gLAC/C,CACF,CAEA,GAAM,CAACM,EAAgBC,CAAe,EAAI,MAAM,QAAQ,IAAI,CAC1DH,EAAaJ,EAAM,UAAU,EAC7BI,EAAaJ,EAAM,WAAW,CAChC,CAAC,EAEKQ,EAAS,CACb,KAAM,OAAOP,EAAS,OAAO,EAC7B,WAAYK,EAAiB,OAAOA,EAAe,OAAO,EAAI,KAC9D,YAAaC,EAAkB,OAAOA,EAAgB,OAAO,EAAI,IACnE,EAEA,GAAIvB,GAAUA,EAAO,MAAQM,GAAOmB,GAAazB,EAAO,OAAQwB,CAAM,EACpE,OAAOxB,EAAO,MAGhB,IAAM0B,EAAwB,CAC5B,CAAE,MAAO,iBAAkB,KAAMV,EAAM,KAAM,SAAU,EAAK,EAC5D,CAAE,MAAO,8BAA+B,KAAMA,EAAM,WAAY,SAAU,EAAM,EAChF,CACE,MAAO,yBAAyBA,EAAM,WAAW,kBACjD,KAAMA,EAAM,YACZ,SAAU,EACZ,CACF,EAEIW,EAAkC,CAAC,EAEvC,QAAWC,KAASF,EAAQ,CAC1B,IAAMG,EAAO,MAAMC,GAAUF,CAAK,EAE9BC,IAAS,OAEbF,EAAS,CAAE,GAAGA,EAAQ,GAAGE,CAAK,EAChC,CAEA,IAAME,EAAc1C,GAAqB,UAAUsC,CAAM,EAEzD,GAAI,CAACI,EAAY,QACf,MAAM,IAAI,MAAM,oCAAoCjE,EAAE,cAAciE,EAAY,KAAK,CAAC,EAAE,EAG1F,OAAA/B,EAAS,CAAE,IAAAM,EAAK,OAAAkB,EAAQ,MAAOO,EAAY,IAAK,EAEzCA,EAAY,IACrB,EAmBaC,GAAyB,IAAY,CAChDhC,EAAS,IACX,EAWaiC,GAA2B,IAAY,CAClDjC,EAAS,KACTC,EAAc,IAChB,EASMmB,EAAe,MAAOc,GAA0E,CACpG,GAAI,CACF,OAAO,MAAMhB,EAAG,KAAKgB,CAAQ,CAC/B,MAAQ,CACN,OAAO,IACT,CACF,EASMC,GAAe,MAAOD,GAA6C,CACvE,GAAI,CACF,OAAO,MAAMhB,EAAG,SAASgB,EAAU,OAAO,CAC5C,MAAQ,CACN,OAAO,IACT,CACF,EAWMT,GAAe,CAAoCW,EAAMC,IAAkB,CAC/E,IAAMC,EAAO,OAAO,KAAKF,CAAC,EAE1B,OAAIE,EAAK,SAAW,OAAO,KAAKD,CAAC,EAAE,OAAe,GAE3CC,EAAK,MAAOC,GACVH,EAAEG,CAAC,IAAMF,EAAEE,CAAC,CACpB,CACH,EAuBMT,GAAY,MAAOF,GAAgE,CACvF,IAAMY,EAAM,MAAML,GAAaP,EAAM,IAAI,EAEzC,GAAIY,IAAQ,KAAM,CAChB,GAAIZ,EAAM,SACR,MAAM,IAAI,MAAM,GAAGA,EAAM,KAAK,iBAAiBA,EAAM,IAAI,EAAE,EAG7D,OAAO,IACT,CAEA,IAAIa,EAEJ,GAAI,CACFA,EAAYD,EAAI,KAAK,IAAM,GAAK,CAAC,EAAI,KAAK,MAAMA,CAAG,CACrD,OAASE,EAAK,CACZ,MAAM,IAAI,MAAM,mBAAmBd,EAAM,KAAK,OAAOA,EAAM,IAAI,KAAMc,EAAc,OAAO,EAAE,CAC9F,CAOA,GAAIC,GAASF,CAAS,GAAK,cAAeA,EACxC,MAAM,IAAI,MAAMG,GAA+BhB,CAAK,CAAC,EAGvD,IAAMiB,EAASnD,GAA6B,UAAU+C,CAAS,EAE/D,GAAI,CAACI,EAAO,QACV,MAAM,IAAI,MAAM,WAAWjB,EAAM,KAAK,OAAOA,EAAM,IAAI,KAAK9D,EAAE,cAAc+E,EAAO,KAAK,CAAC,EAAE,EAG7F,OAAOA,EAAO,IAChB,EAWMF,GAAY7B,GACT,OAAOA,GAAU,UAAYA,IAAU,MAAQ,CAAC,MAAM,QAAQA,CAAK,EAYtE8B,GAAkChB,GAC/B,CACL,oBAAoBA,EAAM,KAAK,6CAC/B,0FACA,uEACA,0CAA0CA,EAAM,IAAI,IACpD,4DACA,iGACF,EAAE,KAAK;AAAA,CAAI",
+  "names": ["process", "pino", "pretty", "LOG_FILE_PATH", "REDACT_PATHS", "initLoggerMcp", "logLevel", "logger", "initLoggerCLI", "ignoreFields", "fs", "path", "findMonorepoRoot", "startDir", "currentDir", "i", "workspaceFile", "getPackageName", "apiPath", "appName", "pkgPath", "pkg", "discoverApiApps", "root", "appsDir", "apps", "appDirs", "dirent", "serverlessPath", "VITE_CONFIG_FILES", "INFRA_KIT_VITE_SPECIFIERS", "usesInfraKitVite", "dir", "file", "configPath", "source", "specifier", "usesInfraKitVitePlugin", "hasDevScript", "discoverUiApps", "uiPath", "normalizeAppInclude", "include", "filtered", "resolveSelfAppName", "relative", "firstSegment", "APP_PART_DIRS", "existingDistDir", "distDir", "subdirNames", "d", "getPackageDistDirs", "dirs", "name", "app", "part", "partDir", "getAppDistDirs", "classifyDistChange", "changedPath", "appDistDirs", "packageDistDirs", "normalized", "matchedPackageDir", "ALL_TARGETS_KEYS", "explainTargetKey", "key", "segments", "appGlob", "part", "parseTargetKey", "error", "validatePresetKeys", "presets", "issues", "preset", "def", "appsWithPart", "discovered", "allApps", "targetId", "app", "keyRank", "isGlob", "resolveWatch", "prior", "next", "addTarget", "state", "spec", "watchDeps", "id", "merged", "resolvePreset", "entries", "cfg", "apps", "targets", "localApps", "t", "deriveTargetLabel", "input", "running", "ownerApp", "apiPkgByApp", "pkg", "checkLocalRoute", "route", "launchedPkgs", "ctx", "owner", "hint", "validatePresetProxy", "resolved", "routes", "source", "issue", "fs", "os", "path", "process", "z", "path", "process", "$", "extractStderr", "cause", "stderr", "buildMessage", "ctx", "parts", "OperationError", "mcpMode", "isMcpMode", "VERSION_RE", "BRANCH_SEMVER_RE", "KEBAB_RE", "RELEASE_BRANCH_PREFIX", "VERSION_BRANCH_PREFIX", "REFS_HEADS_PREFIX", "NEXT_TOKEN", "RESERVED_NAMES", "InvalidReleaseNameError", "message", "InvalidReleaseRefError", "stripRefsHeads", "input", "REFS_HEADS_PREFIX", "makeVersion", "major", "minor", "patch", "validateName", "name", "KEBAB_RE", "parseBranchName", "branch", "stripped", "RELEASE_BRANCH_PREFIX", "VERSION_BRANCH_PREFIX", "semverPart", "match", "BRANCH_SEMVER_RE", "namePart", "parseReleaseRef", "trimmed", "parsed", "versionMatch", "VERSION_RE", "NEXT_TOKEN", "err", "reason", "formatBranchName", "id", "formatPrTitle", "type", "prefix", "formatRcTitle", "formatJiraName", "displayLabel", "isReleaseBranch", "toTime", "value", "time", "compareReleaseIds", "a", "b", "dates", "timeA", "timeB", "listWorktrees", "cwd", "output", "$", "entries", "current", "line", "getCurrentWorktrees", "type", "process", "matches", "branch", "isReleaseBranch", "entry", "normalizeGitRootStderr", "error", "raw", "extractStderr", "projectRootRemediation", "hasStderr", "isMcpMode", "base", "getProjectRoot", "stderrExcerpt", "OperationError", "getMainRepoRoot", "root", "commonDir", "resolved", "path", "getCurrentBranch", "isWorkingTreeClean", "isInsideLinkedWorktree", "gitDirResult", "commonDirResult", "gitDir", "deleteLocalBranch", "branch", "$", "getCurrentBranch", "deleteRemoteBranch", "INFRA_KIT_CONFIG_FILE", "USER_CONFIG_DIR_NAME", "USER_GLOBAL_CONFIG_FILE", "USER_PROJECTS_DIR", "dopplerEnvManagementSchema", "z", "envManagementSchema", "cursorIdeConfigSchema", "cursorIdeSchema", "zedIdeConfigSchema", "zedIdeSchema", "ideSchema", "idesSchema", "jiraTaskManagerSchema", "taskManagerSchema", "cmuxLayouts", "cmuxConfigSchema", "worktreesConfigSchema", "devAppConfigSchema", "devConfigSchema", "proxySourceSchema", "devPresetAppSchema", "devPresetSchema", "devPresetsSchema", "devProxyConfigSchema", "envAutoLoadSchema", "infraKitConfigObject", "DEFAULT_DEV_PROXY_PORT", "infraKitConfigSchema", "cfg", "ctx", "seen", "entry", "infraKitOverrideConfigSchema", "resolveConfiguredIdes", "config", "ide", "DEFAULT_CMUX_LAYOUT", "resolveCmuxLayout", "cached", "cachedPaths", "pathsCacheKey", "process", "os", "getInfraKitConfigPaths", "key", "projectRoot", "getProjectRoot", "mainRepoRoot", "getMainRepoRoot", "projectName", "path", "userConfigDir", "value", "getInfraKitConfig", "paths", "mainStat", "fs", "legacyYmlPath", "statIfExists", "isMcpMode", "userGlobalStat", "userProjectStat", "mtimes", "shallowEqual", "layers", "merged", "layer", "data", "loadLayer", "finalResult", "resetMergedConfigCache", "resetInfraKitConfigCache", "filePath", "readIfExists", "a", "b", "keys", "k", "raw", "parsedRaw", "err", "isRecord", "buildEnvTokensRejectionMessage", "result"]
+}

package/dist/chunk-PZ2AWWGK.js

@@ -0,0 +1,7 @@
+import{U as E,d as x,z as f}from"./chunk-M46KGMQ6.js";import{q as w}from"./chunk-CHETBZ6M.js";import{a as k,b as S}from"./chunk-X46DP23W.js";import p from"node:fs/promises";import c from"node:path";import{z as s}from"zod";var i=class extends Error{env;constructor(e,o=null){super(e),this.name="EnvAuthError",this.env=o}},K=t=>t instanceof i;import b from"node:fs/promises";import $ from"node:os";var C=async t=>{try{return await b.access(t),!0}catch{return!1}},l=t=>{let e=$.homedir();return t.startsWith(e)?`~${t.slice(e.length)}`:t};var I="tokens.json",d=1,y=384,T=448,N=s.object({version:s.literal(d).default(d),envs:s.record(s.string().min(1),s.string().min(1))}).strict(),u=async()=>{let t=await E();return c.join(c.dirname(t.userProject),I)},g=async()=>{let t=await u(),e;try{e=await p.readFile(t,"utf-8")}catch{return null}let o;try{o=JSON.parse(e)}catch(n){throw new i(`Invalid JSON in the token store at ${l(t)}: ${n.message}
+Fix or delete the file, then re-add the token with \`infra-kit env-token-set <env>\`.`)}let r=N.safeParse(o);if(!r.success)throw new i(`Invalid token store at ${l(t)}: ${s.prettifyError(r.error)}
+Fix or delete the file, then re-add the token with \`infra-kit env-token-set <env>\`.`);return r.data},h=async t=>{let e=await u(),o=c.dirname(e),r=c.dirname(o),n=c.dirname(r);for(let a of[n,r,o])await p.mkdir(a,{recursive:!0,mode:T}),await p.chmod(a,T);w(e,`${JSON.stringify(t,null,2)}
+`,y),await p.chmod(e,y)},_=async(t,e)=>{let o=await g();await h({version:d,envs:{...o?.envs,[t]:e}})},j=async t=>{let e=await g();if(!e||!(t in e.envs))return;let o={...e.envs};delete o[t],await h({version:d,envs:o})};var D=()=>{let t="",e=[],o=!1;return{start(r){t=r,e=[],o=!1},setInteractive(){o=!0},addOption(r,n){e.push({flag:r,value:n})},formatOptions(){return e.map(r=>typeof r.value=="boolean"?r.value?r.flag:"":Array.isArray(r.value)?`${r.flag} "${r.value.join(", ")}"`:`${r.flag} "${r.value}"`).filter(Boolean).join(" ")},snapshot(){return e.length===0?null:{formattedOptions:this.formatOptions()}},print(){!o||e.length===0||!t||f.info(`\u{1F4DF} Equivalent command: 
+pnpm exec infra-kit ${t} ${this.formatOptions()}
+`)},reset(){t="",e=[],o=!1}}},v=D();import O from"node:process";var A=27,P=async(t,e)=>{let o=new AbortController,r={...e,signal:o.signal};if(x()||!O.stdin.isTTY)return t(r);let n=O.stdin,a=m=>{m.length===1&&m[0]===A&&o.abort()};k();try{let m=t(r);return n.isPaused()&&n.resume(),n.on("data",a),await m}finally{n.removeListener("data",a),S()}};import F from"@inquirer/confirm";import R from"node:process";var J=async(t,e)=>{let o=t?!0:await P(r=>F({message:e},r));t||v.setInteractive(),o||(f.info("Operation cancelled. Exiting..."),R.exit(0))};export{i as a,K as b,C as c,l as d,u as e,g as f,_ as g,j as h,v as i,P as j,J as k};
+//# sourceMappingURL=chunk-PZ2AWWGK.js.map

package/dist/{chunk-7DL27USH.js.map → chunk-PZ2AWWGK.js.map}

@@ -1,7 +1,7 @@
 {
   "version": 3,
-  "sources": ["../src/lib/env-tokens/env-tokens.ts", "../src/lib/errors/env-auth-error.ts", "../src/lib/path-display/path-display.ts", "../src/lib/command-echo/command-echo.ts", "../src/lib/prompts/escapable-context.ts", "../src/lib/mcp-mode/mcp-mode.ts", "../src/lib/command-echo/confirm-or-exit.ts"],
-  "sourcesContent": ["// DEFAULT import, deliberately \u2014 the same reason config-bootstrap.ts documents: the module is used as\n// `fs.readFile(...)` / `fs.mkdir(...)` so every call is a property lookup on the live module object,\n// which is what `vi.spyOn(fs, \u2026)` patches. A named import (`import { readFile }`) is bound at import\n// time and the spy silently does NOT intercept it \u2014 the assertion goes green while the real call\n// still hits disk. Do not \"modernize\" this import.\nimport fs from 'node:fs/promises'\nimport path from 'node:path'\nimport { z } from 'zod'\n\nimport { atomicWriteFileSync } from 'src/lib/constants'\nimport { EnvAuthError } from 'src/lib/errors/env-auth-error'\nimport { getInfraKitConfigPaths } from 'src/lib/infra-kit-config'\nimport { tildify } from 'src/lib/path-display'\n\n/**\n * Basename of the token store. A SIBLING of the layer-3 `infra-kit.json`, never a key inside it:\n * `getInfraKitConfig` only ever globs the three hardcoded `infra-kit.json` paths and its schema is\n * `.strict()`, so an unknown key throws at the LAYER parse and bricks every command on every pinned\n * version. A sibling file is structurally invisible to that loader \u2014 `config-bootstrap.ts` already\n * relies on exactly this for its `.example.jsonc`. That invisibility is the blast-radius guarantee:\n * a corrupt `tokens.json` can only break the readers below, never `worktrees-list`.\n */\nconst TOKEN_STORE_FILE = 'tokens.json'\n\n/** Schema version of the on-disk store. Bump only alongside a migration. */\nconst TOKEN_STORE_VERSION = 1\n\n/** Mode of `tokens.json` itself \u2014 owner read/write only. It holds live credentials. */\nconst TOKEN_FILE_MODE = 0o600\n\n/** Mode of every directory on the way to the store \u2014 owner-only traversal. */\nconst TOKEN_DIR_MODE = 0o700\n\n/**\n * The store's OWN schema: `{ version?: 1, envs: { <env>: <token> } }`. Deliberately NOT derived from\n * `infraKitConfigObject`: this file is not a merge layer, so `.strict()` here is free (a typo is a\n * loud error in three readers, not a bricked CLI).\n *\n * HAND-AUTHORABILITY IS THE CONSTRAINT THIS SHAPE IS CHOSEN FOR, and two earlier fields were dropped\n * for it \u2014 do not re-add either without re-deciding that:\n *\n *  - `version` is OPTIONAL (defaulted to 1) because a store typed by a human carries no version key,\n *    and a store the CLI refuses to read is a store the human cannot write.\n *  - `repoRoot` is GONE, and with it the refusal that compared it against the current checkout. That\n *    guard was real: the store directory is keyed on `path.basename(mainRepoRoot)`, so `~/work/api`\n *    and `~/oss/api` share ONE token directory and repo B could load (and then overwrite) repo A's\n *    credentials. It was removed anyway, knowingly: it also made the CLI refuse every hand-written\n *    store, which carries no such field. Hand-authorability wins; the basename-collision risk is\n *    ACCEPTED. A weakened version of the guard (warn-and-continue, or \"only check when present\") is\n *    NOT the compromise here \u2014 it would re-introduce the same refusal for anyone who did write the\n *    field. If you want the guard back, key the store directory on something collision-free instead.\n */\nconst tokenStoreSchema = z\n  .object({\n    version: z.literal(TOKEN_STORE_VERSION).default(TOKEN_STORE_VERSION),\n    envs: z.record(z.string().min(1), z.string().min(1)),\n  })\n  .strict()\n\n/** The parsed `tokens.json` shape: `{ version, envs }` \u2014 `version` defaulted to 1 when absent on disk. */\nexport type TokenStore = z.infer<typeof tokenStoreSchema>\n\n/**\n * Absolute path to the per-project token store: `~/.infra-kit/projects/<repo>/tokens.json`.\n *\n * Derived from {@link getInfraKitConfigPaths} rather than re-deriving the home/projects/repo chain \u2014\n * that resolver already keys the directory off the MAIN repo root (so every worktree of a repo shares\n * one store) and memoizes the two `git rev-parse` spawns.\n *\n * @example\n * await getTokenStorePath() // => '/Users/arthur/.infra-kit/projects/infra-kit/tokens.json'\n */\nexport const getTokenStorePath = async (): Promise<string> => {\n  const paths = await getInfraKitConfigPaths()\n\n  return path.join(path.dirname(paths.userProject), TOKEN_STORE_FILE)\n}\n\n/**\n * Read the token store, or `null` when it does not exist.\n *\n * ABSENCE IS NOT AN ERROR \u2014 a fresh machine has no store, and every caller must be able to say \"no\n * tokens yet\" without a try/catch. The two things that DO throw are malformed JSON and a schema\n * mismatch: both are states only a human can fix, so both are loud.\n *\n * @example\n * const store = await readTokenStore()\n * store?.envs.dev // => 'dp.st.dev.xxxx' | undefined\n * // no file on disk  => null\n * // garbage on disk  => throws 'Invalid token store at ~/.infra-kit/projects/api/tokens.json: \u2026'\n */\nexport const readTokenStore = async (): Promise<TokenStore | null> => {\n  const storePath = await getTokenStorePath()\n\n  let raw: string\n\n  try {\n    raw = await fs.readFile(storePath, 'utf-8')\n  } catch {\n    return null\n  }\n\n  // Every refusal below is an EnvAuthError, not a plain Error. A broken store is the MOST durable\n  // env-auth failure there is \u2014 it cannot heal on a 30s retry, only a human can fix it \u2014 and env\n  // auto-load's sticky marker is keyed on that CLASS. Thrown as a plain Error these were classified\n  // TRANSIENT, so a corrupt store went silent on the backgrounded shell-startup spawn and the user's\n  // env simply stopped loading with nothing ever said. `env` is null: no ONE environment is at fault.\n  let parsedRaw: unknown\n\n  try {\n    parsedRaw = JSON.parse(raw)\n  } catch (err) {\n    throw new EnvAuthError(\n      `Invalid JSON in the token store at ${tildify(storePath)}: ${(err as Error).message}\\n` +\n        `Fix or delete the file, then re-add the token with \\`infra-kit env-token-set <env>\\`.`,\n    )\n  }\n\n  const result = tokenStoreSchema.safeParse(parsedRaw)\n\n  if (!result.success) {\n    throw new EnvAuthError(\n      `Invalid token store at ${tildify(storePath)}: ${z.prettifyError(result.error)}\\n` +\n        `Fix or delete the file, then re-add the token with \\`infra-kit env-token-set <env>\\`.`,\n    )\n  }\n\n  return result.data\n}\n\n/**\n * Persist the store atomically at 0600, tightening every directory on the way to it to 0700.\n *\n * The chmods are not belt-and-braces: the config bootstrap already seeds\n * `~/.infra-kit/projects/<repo>/` at the default umask (0755), so an EXISTING directory is\n * world-readable and `mkdir`'s mode argument is a no-op for it. The same holds for the file \u2014 a\n * hand-written `tokens.json` is 0644 \u2014 so the modes of the whole credential path are (re)asserted on\n * EVERY write, not only on the writes that created it. Self-healing by construction: a plain\n * `env-token-set` is enough to fix a store a human typed.\n *\n * @example\n * await writeTokenStore({ version: 1, envs: { dev: 'dp.st.dev.x' } })\n * // ~/.infra-kit/projects/api/tokens.json  -rw-------\n * // ~/.infra-kit/projects/api/             drwx------\n */\nexport const writeTokenStore = async (store: TokenStore): Promise<void> => {\n  const storePath = await getTokenStorePath()\n\n  const projectDir = path.dirname(storePath)\n  const projectsDir = path.dirname(projectDir)\n  const userConfigDir = path.dirname(projectsDir)\n\n  for (const dir of [userConfigDir, projectsDir, projectDir]) {\n    await fs.mkdir(dir, { recursive: true, mode: TOKEN_DIR_MODE })\n    await fs.chmod(dir, TOKEN_DIR_MODE)\n  }\n\n  atomicWriteFileSync(storePath, `${JSON.stringify(store, null, 2)}\\n`, TOKEN_FILE_MODE)\n\n  // The rename above already lands a fresh 0600 inode, but the mode of a credential file is not a\n  // thing to leave to the umask that happened to be in effect \u2014 assert it outright.\n  await fs.chmod(storePath, TOKEN_FILE_MODE)\n}\n\n/**\n * Add or replace one environment's token, read-modify-write, stamping the current `version`. Inherits\n * {@link readTokenStore}'s refusals: a corrupt store is never silently overwritten.\n *\n * @example\n * await setToken('dev', 'dp.st.dev.xxxxxxxx')\n * // tokens.json => { version: 1, envs: { dev: 'dp.st.dev.xxxxxxxx' } }\n */\nexport const setToken = async (env: string, token: string): Promise<void> => {\n  const existing = await readTokenStore()\n\n  await writeTokenStore({\n    version: TOKEN_STORE_VERSION,\n    envs: { ...existing?.envs, [env]: token },\n  })\n}\n\n/**\n * Drop one environment's token. A no-op when the store (or the key) is absent \u2014 removing something\n * that is not there is the state the caller asked for.\n *\n * Removing a token here does NOT revoke it in Doppler; callers say so.\n *\n * @example\n * await removeToken('dev')\n * // tokens.json => { version: 1, envs: {} }\n */\nexport const removeToken = async (env: string): Promise<void> => {\n  const existing = await readTokenStore()\n\n  if (!existing || !(env in existing.envs)) return\n\n  const envs = { ...existing.envs }\n\n  delete envs[env]\n\n  await writeTokenStore({\n    version: TOKEN_STORE_VERSION,\n    envs,\n  })\n}\n", "/**\n * The DURABLE, USER-FIXABLE env-auth failure \u2014 as a TYPE rather than a string.\n *\n * WHY THIS EXISTS (and why it is deliberately NOT a Doppler type): env auto-load must tell a user\n * apart from a TRANSIENT failure (network, timeout, Doppler down \u2014 heals itself, 30s backoff, stay\n * quiet) and a DURABLE one (no token, a corrupt token store, a foreign token store \u2014 never heals, and\n * only a human can fix it). Only the durable class earns the STICKY marker that survives the\n * backgrounded shell-startup spawn and is replayed onto the next interactive command; a durable\n * failure misclassified as transient is TOTAL SILENCE, forever, on the one path the whole feature\n * exists to survive.\n *\n * That classification therefore has to travel WITH the error, not be re-derived by grepping a message\n * some other module owns \u2014 and it has to be throwable from EVERY module that can produce the class.\n * `lib/env-tokens` (the store) is a layer BELOW `integrations/doppler`, so a Doppler-owned base type\n * could not be thrown there without a layering inversion and an import cycle. Hence a neutral base\n * here in `lib/errors`, with `DopplerAuthError extends EnvAuthError` for the subset of failures that\n * are specifically \"Doppler refused the token we sent\".\n *\n * The defect class this closes is \"a durable failure that is not type-detectable\". Adding a new\n * durable failure and forgetting to type it is exactly how this shipped silent twice \u2014 so throw this\n * (or a subclass), never a plain `Error`, for anything a user must fix before env-load can work.\n *\n * @example\n * // no token minted for this env (integrations/doppler/token-resolver.ts)\n * throw new EnvAuthError(buildMissingTokenMessage('dev', storePath), 'dev')\n *\n * @example\n * // the token store itself is unusable \u2014 no single env is at fault, so `env` stays null\n * throw new EnvAuthError(`Invalid JSON in the token store at ${storePath} \u2026`)\n */\nexport class EnvAuthError extends Error {\n  /**\n   * The env (= Doppler config) whose token is at fault, or `null` when the failure is not attributable\n   * to ONE env (a corrupt or foreign token store breaks every env at once). `null` is honest: do NOT\n   * invent an env to fill it \u2014 the consumer names the env it was TRYING to load, which it already\n   * knows.\n   */\n  readonly env: string | null\n\n  constructor(message: string, env: string | null = null) {\n    super(message)\n    this.name = 'EnvAuthError'\n    this.env = env\n  }\n}\n\n/**\n * The TYPE GUARD every consumer of the auth channel classifies on \u2014 the single question \"is this a\n * durable, user-fixable env-auth failure?\", answered by the error's CLASS and never by its text.\n *\n * This is the default `isAuthFailure` of `lib/env-autoload`'s `runEnvAutoLoad`. It is deliberately\n * WIDER than `isDopplerAuthError`: that one means \"Doppler refused us\", which is only one of the\n * durable failures \u2014 a missing token never reaches Doppler at all, and a corrupt store never reaches\n * the resolver.\n *\n * @example\n * isEnvAuthFailure(new EnvAuthError('No Doppler service token for env \"dev\".', 'dev')) // => true\n * isEnvAuthFailure(new DopplerAuthError('dev', 'revoked'))                             // => true (subclass)\n * isEnvAuthFailure(new Error('connect ETIMEDOUT'))                                     // => false (transient)\n */\nexport const isEnvAuthFailure = (error: unknown): error is EnvAuthError => {\n  return error instanceof EnvAuthError\n}\n", "import fs from 'node:fs/promises'\nimport os from 'node:os'\n\n/**\n * Shared path-display helpers for CLI output. Extracted from `commands/config`\n * and `commands/init/migrate-config` (which each had private copies) so config\n * surfaces print paths consistently. Keep this dependency-light (node builtins\n * only) \u2014 it is imported by several commands.\n */\n\n/**\n * Resolve whether a file is reachable, suppressing ENOENT (and any access error)\n * into a boolean. Used to render `[\u2713]`/`[ ]` existence markers.\n *\n * @example\n * await fileExists('/etc/hosts') // => true\n * await fileExists('/nope.txt')  // => false\n */\nexport const fileExists = async (filePath: string): Promise<boolean> => {\n  try {\n    await fs.access(filePath)\n\n    return true\n  } catch {\n    return false\n  }\n}\n\n/**\n * Replace the user's home prefix with `~` so logged paths stay short and portable\n * across machines. Leaves non-home paths untouched.\n *\n * @example\n * // os.homedir() === '/Users/arthur'\n * tildify('/Users/arthur/.infra-kit/infra-kit.json') // => '~/.infra-kit/infra-kit.json'\n * tildify('/etc/hosts')                              // => '/etc/hosts'\n */\nexport const tildify = (filePath: string): string => {\n  const home = os.homedir()\n\n  return filePath.startsWith(home) ? `~${filePath.slice(home.length)}` : filePath\n}\n", "import { logger } from 'src/lib/logger'\n\ninterface CommandOption {\n  flag: string\n  value: string | string[] | boolean\n}\n\nconst createCommandEcho = () => {\n  let cliPath = ''\n  let options: CommandOption[] = []\n  let isInteractive = false\n\n  return {\n    /**\n     * Bind the echo to the command about to run, and clear the previous one's recording.\n     *\n     * `cliPath` must be the argv Commander actually parsed (`release create`), which is why the ONLY\n     * caller is program.ts's `preAction` hook, feeding it `commandPath(actionCommand)`. Commands used to\n     * name themselves here, and that is precisely how the printed line rotted: they passed the flat\n     * `release-create`, which stopped being a command the day the flat aliases were dropped, so the\n     * \"equivalent command\" we told the user to retype no longer parsed. Commander is the only thing that\n     * knows the real path, so it is the only thing allowed to say it.\n     */\n    start(path: string): void {\n      cliPath = path\n      options = []\n      isInteractive = false\n    },\n\n    /**\n     * Mark that the command had interactive input (prompts)\n     * Call this once when ANY prompt happens\n     */\n    setInteractive(): void {\n      isInteractive = true\n    },\n\n    /**\n     * Track an option selection\n     * @param flag The CLI flag (e.g., \"--versions\")\n     * @param value The selected value\n     */\n    addOption(flag: string, value: string | string[] | boolean): void {\n      options.push({ flag, value })\n    },\n\n    /**\n     * Format the tracked options into a replayable flag string (empty when none).\n     */\n    formatOptions(): string {\n      return options\n        .map((opt) => {\n          if (typeof opt.value === 'boolean') {\n            return opt.value ? opt.flag : ''\n          }\n\n          if (Array.isArray(opt.value)) {\n            return `${opt.flag} \"${opt.value.join(', ')}\"`\n          }\n\n          return `${opt.flag} \"${opt.value}\"`\n        })\n        .filter(Boolean)\n        .join(' ')\n    },\n\n    /**\n     * The recorded interactive flags for the session shell's report side channel, so the transcript's\n     * equivalent line carries the resolved options (`--versions \"1.2.5\"`), not just the bare command.\n     * `null` when nothing was recorded \u2014 the caller then falls back to the bare spawned argv.\n     */\n    snapshot(): { formattedOptions: string } | null {\n      if (options.length === 0) {\n        return null\n      }\n\n      return { formattedOptions: this.formatOptions() }\n    },\n\n    /**\n     * Print the equivalent CLI command if there was interactive input.\n     *\n     * Silent without a bound `cliPath`: the only caller that binds one is Commander's `preAction`, so an\n     * unbound echo means the command ran off the CLI (an MCP tool), where a `pnpm exec` line would be\n     * nonsense. Printing a path-less `pnpm exec infra-kit --yes` would be worse than printing nothing.\n     */\n    print(): void {\n      if (!isInteractive || options.length === 0 || !cliPath) {\n        return\n      }\n\n      logger.info(`\uD83D\uDCDF Equivalent command: \\npnpm exec infra-kit ${cliPath} ${this.formatOptions()}\\n`)\n    },\n\n    /**\n     * Reset state (useful for testing)\n     */\n    reset(): void {\n      cliPath = ''\n      options = []\n      isInteractive = false\n    },\n  }\n}\n\n// Singleton instance (same pattern as logger)\nexport const commandEcho = createCommandEcho()\n", "import type { Buffer } from 'node:buffer'\nimport process from 'node:process'\n\nimport { isMcpMode } from 'src/lib/mcp-mode'\n\nimport { acquireStdin, releaseStdin } from './stdin-ref'\n\n/**\n * Structural mirror of `@inquirer/type`'s `Context` \u2014 the second argument every\n * `@inquirer/*` prompt takes. Declared here rather than imported because\n * `@inquirer/core` and `@inquirer/type` are transitive dependencies of this\n * package, not direct ones (only the four prompt packages are).\n */\nexport interface PromptContext {\n  input?: NodeJS.ReadableStream\n  output?: NodeJS.WritableStream\n  clearPromptOnDone?: boolean\n  signal?: AbortSignal\n}\n\nconst ESC_BYTE = 0x1b\n\n/**\n * Run an `@inquirer/*` prompt with Esc bound to cancellation.\n *\n * The cancel path is entirely pre-existing plumbing: an `AbortController`'s signal\n * goes into the prompt context, `@inquirer/core` rejects with an `AbortPromptError`\n * when it fires, that name is already in `CANCELLATION_ERROR_NAMES`\n * (lib/errors/is-prompt-cancellation), and `entry/cli.ts` catches it at the top\n * level \u2192 \"Operation cancelled.\" \u2192 exit 0. All this adds is the thing that calls\n * `abort()`.\n *\n * DETECTION \u2014 a raw `data` listener that aborts iff the chunk is exactly one `0x1b`\n * byte. Deliberately NOT readline `keypress`: that delivers a lone Esc only after its\n * escape-sequence timeout (~523ms measured), and the `escapeCodeTimeout` dial that\n * would shorten it is process-global and first-armer-wins \u2014 a second\n * `emitKeypressEvents` call on `process.stdin` is SILENTLY IGNORED, so the dial\n * degrades to a no-op with no error and no failing test. The raw listener costs ~24ms\n * and touches no global state. Arrow keys (`\\x1b[B`, 3 bytes) and Alt combos\n * (`\\x1bb`, 2 bytes) are ignored because they are LONGER \u2014 no parsed key field is\n * involved. Node `data` listeners broadcast, so this one does not steal bytes from\n * readline: arrows and Enter keep working while it is attached.\n *\n * FALSE POSITIVES are a non-issue: there is no routine source of a lone-`0x1b` chunk.\n * Focus events (`\\x1b[I`/`\\x1b[O`), bracketed paste (`\\x1b[200~`) and mouse reports\n * (`\\x1b[M\u2026`) are all multi-byte, and inquirer enables none of them.\n *\n * FALSE NEGATIVE \u2014 measured and accepted: a COALESCED Esc (`\"\\x1bx\"` arriving in ONE\n * chunk, i.e. Esc immediately followed by another key) is silently dropped and the\n * prompt stays open. The fix would be Ink's 20ms deferred abort \u2014 hold the lone Esc,\n * cancel it if a follow-up chunk lands. That is a logged NON-GOAL; do not pre-build it.\n *\n * The listener attaches only on a real interactive terminal. `isTTY` alone is NOT a\n * sufficient guard \u2014 see lib/mcp-mode for why `stdio: 'inherit'` defeats it.\n */\nexport const withEscape = async <T>(run: (context: PromptContext) => Promise<T>, base?: PromptContext): Promise<T> => {\n  const controller = new AbortController()\n  const context: PromptContext = { ...base, signal: controller.signal }\n\n  if (isMcpMode() || !process.stdin.isTTY) return run(context)\n\n  const input = process.stdin\n\n  const onData = (chunk: Buffer) => {\n    if (chunk.length === 1 && chunk[0] === ESC_BYTE) controller.abort()\n  }\n\n  // STDIN OWNERSHIP \u2014 this is the seam that keeps stdin alive for inquirer, which refs\n  // nothing itself. It must sit BELOW the early return above: a non-TTY run never reads\n  // stdin, so acquiring there would ref a handle nobody reads and hang the process. See\n  // lib/prompts/stdin-ref for why an unref'd stdin kills a prompt with exit 13.\n  acquireStdin()\n\n  try {\n    // Attach after the prompt has built its readline interface. Cheap ordering defence\n    // only \u2014 there is no race today: readline attaches its own consumer synchronously\n    // and `data` events are async.\n    //\n    // INSIDE the `try`, both of them: `run` is caller-supplied and `@inquirer/core` runs\n    // synchronously up to readline construction, so a SYNCHRONOUS throw here would skip a\n    // `finally` placed any lower \u2014 leaking the ref and hanging the CLI, which is the exact\n    // failure this module exists to prevent.\n    const pending = run(context)\n\n    input.on('data', onData)\n\n    return await pending\n  } finally {\n    // Non-negotiable: the dev wizard runs ~5 prompts back to back, so a leaked\n    // listener would abort the next one.\n    input.removeListener('data', onData)\n    // Same `finally` as the listener teardown, and for the same reason: every exit path\n    // (answer, Esc abort, throw) must give the ref back, or node never exits.\n    releaseStdin()\n  }\n}\n", "/**\n * MCP-mode flag for the CLI. `process.stdin` is the JSON-RPC transport when the\n * binary runs as an MCP server, so anything that would read keystrokes from it\n * (raw `data` listeners, Ink screens, `@inquirer` prompts) must be gated off.\n *\n * This exists because `process.stdin.isTTY` CANNOT answer that question:\n * `commands/mcp/mcp.ts` spawns the server with `stdio: 'inherit'`, so a\n * terminal-launched `infra-kit mcp` hands the child a real TTY stdin and an\n * isTTY-keyed guard does not fire. Piped stdio (how Claude Code spawns it) only\n * makes isTTY look sufficient by coincidence.\n *\n * Set in `createMcpServer()` \u2014 the importable, transport-free entry that every\n * MCP launch goes through \u2014 not in `entry/mcp.ts`, which starts a server at\n * module scope and so can never assert the flag was actually set.\n */\n\n/** Mutable holder (object so `prefer-const` holds while the flag toggles per run). */\nexport const mcpMode = { enabled: false }\n\n/** True when this process is serving MCP, i.e. `process.stdin` carries JSON-RPC. */\nexport const isMcpMode = (): boolean => {\n  return mcpMode.enabled\n}\n", "import confirm from '@inquirer/confirm'\nimport process from 'node:process'\n\nimport { logger } from 'src/lib/logger'\nimport { withEscape } from 'src/lib/prompts/escapable-context'\n\nimport { commandEcho } from './command-echo'\n\n/**\n * Shared interactive-confirmation gate for mutating commands.\n *\n * When `confirmedCommand` is truthy (CLI `--yes` or an MCP call, which always\n * injects `confirmedCommand: true`) the prompt is skipped and execution\n * proceeds. Otherwise it prompts the user, marks the echo as interactive, and\n * exits cleanly if the user declines.\n *\n * Esc aborts the prompt (via `withEscape`) rather than answering it \u2014 the caller\n * sees an `AbortPromptError`, which every command's boundary already treats as a\n * clean back-out through `isPromptCancellation`. That is deliberately NOT the same\n * as declining: a decline is an answer of \"no\" and takes the `process.exit(0)` path\n * below, whereas Esc means \"I never answered\".\n *\n * Unlike every other prompt in the CLI this one renders to STDOUT, not stderr \u2014\n * left as-is, since changing it would move confirmation text out of the stream\n * callers have always read it from.\n *\n * The `process.exit(0)` only runs on the interactive-decline path, which is\n * unreachable under MCP \u2014 so this stays safe for the long-lived MCP server.\n *\n * Callers remain responsible for their own `commandEcho.addOption('--yes', \u2026)`\n * bookkeeping, which varies between commands.\n */\nexport const confirmOrExit = async (confirmedCommand: boolean | undefined, message: string): Promise<void> => {\n  const answer = confirmedCommand\n    ? true\n    : await withEscape((context) => {\n        return confirm({ message }, context)\n      })\n\n  if (!confirmedCommand) {\n    commandEcho.setInteractive()\n  }\n\n  if (!answer) {\n    logger.info('Operation cancelled. Exiting...')\n    process.exit(0)\n  }\n}\n"],
-  "mappings": "sIAKA,OAAOA,MAAQ,mBACf,OAAOC,MAAU,YACjB,OAAS,KAAAC,MAAS,MCuBX,IAAMC,EAAN,cAA2B,KAAM,CAO7B,IAET,YAAYC,EAAiBC,EAAqB,KAAM,CACtD,MAAMD,CAAO,EACb,KAAK,KAAO,eACZ,KAAK,IAAMC,CACb,CACF,EAgBaC,EAAoBC,GACxBA,aAAiBJ,EC7D1B,OAAOK,MAAQ,mBACf,OAAOC,MAAQ,UAiBR,IAAMC,EAAa,MAAOC,GAAuC,CACtE,GAAI,CACF,aAAMH,EAAG,OAAOG,CAAQ,EAEjB,EACT,MAAQ,CACN,MAAO,EACT,CACF,EAWaC,EAAWD,GAA6B,CACnD,IAAME,EAAOJ,EAAG,QAAQ,EAExB,OAAOE,EAAS,WAAWE,CAAI,EAAI,IAAIF,EAAS,MAAME,EAAK,MAAM,CAAC,GAAKF,CACzE,EFnBA,IAAMG,EAAmB,cAGnBC,EAAsB,EAGtBC,EAAkB,IAGlBC,EAAiB,IAqBjBC,EAAmBC,EACtB,OAAO,CACN,QAASA,EAAE,QAAQJ,CAAmB,EAAE,QAAQA,CAAmB,EACnE,KAAMI,EAAE,OAAOA,EAAE,OAAO,EAAE,IAAI,CAAC,EAAGA,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CACrD,CAAC,EACA,OAAO,EAeGC,EAAoB,SAA6B,CAC5D,IAAMC,EAAQ,MAAMC,EAAuB,EAE3C,OAAOC,EAAK,KAAKA,EAAK,QAAQF,EAAM,WAAW,EAAGP,CAAgB,CACpE,EAeaU,EAAiB,SAAwC,CACpE,IAAMC,EAAY,MAAML,EAAkB,EAEtCM,EAEJ,GAAI,CACFA,EAAM,MAAMC,EAAG,SAASF,EAAW,OAAO,CAC5C,MAAQ,CACN,OAAO,IACT,CAOA,IAAIG,EAEJ,GAAI,CACFA,EAAY,KAAK,MAAMF,CAAG,CAC5B,OAASG,EAAK,CACZ,MAAM,IAAIC,EACR,sCAAsCC,EAAQN,CAAS,CAAC,KAAMI,EAAc,OAAO;AAAA,sFAErF,CACF,CAEA,IAAMG,EAASd,EAAiB,UAAUU,CAAS,EAEnD,GAAI,CAACI,EAAO,QACV,MAAM,IAAIF,EACR,0BAA0BC,EAAQN,CAAS,CAAC,KAAKN,EAAE,cAAca,EAAO,KAAK,CAAC;AAAA,sFAEhF,EAGF,OAAOA,EAAO,IAChB,EAiBaC,EAAkB,MAAOC,GAAqC,CACzE,IAAMT,EAAY,MAAML,EAAkB,EAEpCe,EAAaZ,EAAK,QAAQE,CAAS,EACnCW,EAAcb,EAAK,QAAQY,CAAU,EACrCE,EAAgBd,EAAK,QAAQa,CAAW,EAE9C,QAAWE,IAAO,CAACD,EAAeD,EAAaD,CAAU,EACvD,MAAMR,EAAG,MAAMW,EAAK,CAAE,UAAW,GAAM,KAAMrB,CAAe,CAAC,EAC7D,MAAMU,EAAG,MAAMW,EAAKrB,CAAc,EAGpCsB,EAAoBd,EAAW,GAAG,KAAK,UAAUS,EAAO,KAAM,CAAC,CAAC;AAAA,EAAMlB,CAAe,EAIrF,MAAMW,EAAG,MAAMF,EAAWT,CAAe,CAC3C,EAUawB,EAAW,MAAOC,EAAaC,IAAiC,CAC3E,IAAMC,EAAW,MAAMnB,EAAe,EAEtC,MAAMS,EAAgB,CACpB,QAASlB,EACT,KAAM,CAAE,GAAG4B,GAAU,KAAM,CAACF,CAAG,EAAGC,CAAM,CAC1C,CAAC,CACH,EAYaE,EAAc,MAAOH,GAA+B,CAC/D,IAAME,EAAW,MAAMnB,EAAe,EAEtC,GAAI,CAACmB,GAAY,EAAEF,KAAOE,EAAS,MAAO,OAE1C,IAAME,EAAO,CAAE,GAAGF,EAAS,IAAK,EAEhC,OAAOE,EAAKJ,CAAG,EAEf,MAAMR,EAAgB,CACpB,QAASlB,EACT,KAAA8B,CACF,CAAC,CACH,EGrMA,IAAMC,EAAoB,IAAM,CAC9B,IAAIC,EAAU,GACVC,EAA2B,CAAC,EAC5BC,EAAgB,GAEpB,MAAO,CAWL,MAAMC,EAAoB,CACxBH,EAAUG,EACVF,EAAU,CAAC,EACXC,EAAgB,EAClB,EAMA,gBAAuB,CACrBA,EAAgB,EAClB,EAOA,UAAUE,EAAcC,EAA0C,CAChEJ,EAAQ,KAAK,CAAE,KAAAG,EAAM,MAAAC,CAAM,CAAC,CAC9B,EAKA,eAAwB,CACtB,OAAOJ,EACJ,IAAKK,GACA,OAAOA,EAAI,OAAU,UAChBA,EAAI,MAAQA,EAAI,KAAO,GAG5B,MAAM,QAAQA,EAAI,KAAK,EAClB,GAAGA,EAAI,IAAI,KAAKA,EAAI,MAAM,KAAK,IAAI,CAAC,IAGtC,GAAGA,EAAI,IAAI,KAAKA,EAAI,KAAK,GACjC,EACA,OAAO,OAAO,EACd,KAAK,GAAG,CACb,EAOA,UAAgD,CAC9C,OAAIL,EAAQ,SAAW,EACd,KAGF,CAAE,iBAAkB,KAAK,cAAc,CAAE,CAClD,EASA,OAAc,CACR,CAACC,GAAiBD,EAAQ,SAAW,GAAK,CAACD,GAI/CO,EAAO,KAAK;AAAA,sBAAgDP,CAAO,IAAI,KAAK,cAAc,CAAC;AAAA,CAAI,CACjG,EAKA,OAAc,CACZA,EAAU,GACVC,EAAU,CAAC,EACXC,EAAgB,EAClB,CACF,CACF,EAGaM,EAAcT,EAAkB,ECzG7C,OAAOU,MAAa,eCgBb,IAAMC,EAAU,CAAE,QAAS,EAAM,EAG3BC,EAAY,IAChBD,EAAQ,QDDjB,IAAME,EAAW,GAmCJC,EAAa,MAAUC,EAA6CC,IAAqC,CACpH,IAAMC,EAAa,IAAI,gBACjBC,EAAyB,CAAE,GAAGF,EAAM,OAAQC,EAAW,MAAO,EAEpE,GAAIE,EAAU,GAAK,CAACC,EAAQ,MAAM,MAAO,OAAOL,EAAIG,CAAO,EAE3D,IAAMG,EAAQD,EAAQ,MAEhBE,EAAUC,GAAkB,CAC5BA,EAAM,SAAW,GAAKA,EAAM,CAAC,IAAMV,GAAUI,EAAW,MAAM,CACpE,EAMAO,EAAa,EAEb,GAAI,CASF,IAAMC,EAAUV,EAAIG,CAAO,EAE3B,OAAAG,EAAM,GAAG,OAAQC,CAAM,EAEhB,MAAMG,CACf,QAAE,CAGAJ,EAAM,eAAe,OAAQC,CAAM,EAGnCI,EAAa,CACf,CACF,EE/FA,OAAOC,MAAa,oBACpB,OAAOC,MAAa,eA+Bb,IAAMC,EAAgB,MAAOC,EAAuCC,IAAmC,CAC5G,IAAMC,EAASF,EACX,GACA,MAAMG,EAAYC,GACTC,EAAQ,CAAE,QAAAJ,CAAQ,EAAGG,CAAO,CACpC,EAEAJ,GACHM,EAAY,eAAe,EAGxBJ,IACHK,EAAO,KAAK,iCAAiC,EAC7CC,EAAQ,KAAK,CAAC,EAElB",
-  "names": ["fs", "path", "z", "EnvAuthError", "message", "env", "isEnvAuthFailure", "error", "fs", "os", "fileExists", "filePath", "tildify", "home", "TOKEN_STORE_FILE", "TOKEN_STORE_VERSION", "TOKEN_FILE_MODE", "TOKEN_DIR_MODE", "tokenStoreSchema", "z", "getTokenStorePath", "paths", "getInfraKitConfigPaths", "path", "readTokenStore", "storePath", "raw", "fs", "parsedRaw", "err", "EnvAuthError", "tildify", "result", "writeTokenStore", "store", "projectDir", "projectsDir", "userConfigDir", "dir", "atomicWriteFileSync", "setToken", "env", "token", "existing", "removeToken", "envs", "createCommandEcho", "cliPath", "options", "isInteractive", "path", "flag", "value", "opt", "logger", "commandEcho", "process", "mcpMode", "isMcpMode", "ESC_BYTE", "withEscape", "run", "base", "controller", "context", "isMcpMode", "process", "input", "onData", "chunk", "acquireStdin", "pending", "releaseStdin", "confirm", "process", "confirmOrExit", "confirmedCommand", "message", "answer", "withEscape", "context", "confirm", "commandEcho", "logger", "process"]
+  "sources": ["../src/lib/env-tokens/env-tokens.ts", "../src/lib/errors/env-auth-error.ts", "../src/lib/path-display/path-display.ts", "../src/lib/command-echo/command-echo.ts", "../src/lib/prompts/escapable-context.ts", "../src/lib/command-echo/confirm-or-exit.ts"],
+  "sourcesContent": ["// DEFAULT import, deliberately \u2014 the same reason config-bootstrap.ts documents: the module is used as\n// `fs.readFile(...)` / `fs.mkdir(...)` so every call is a property lookup on the live module object,\n// which is what `vi.spyOn(fs, \u2026)` patches. A named import (`import { readFile }`) is bound at import\n// time and the spy silently does NOT intercept it \u2014 the assertion goes green while the real call\n// still hits disk. Do not \"modernize\" this import.\nimport fs from 'node:fs/promises'\nimport path from 'node:path'\nimport { z } from 'zod'\n\nimport { atomicWriteFileSync } from 'src/lib/constants'\nimport { EnvAuthError } from 'src/lib/errors/env-auth-error'\nimport { getInfraKitConfigPaths } from 'src/lib/infra-kit-config'\nimport { tildify } from 'src/lib/path-display'\n\n/**\n * Basename of the token store. A SIBLING of the layer-3 `infra-kit.json`, never a key inside it:\n * `getInfraKitConfig` only ever globs the three hardcoded `infra-kit.json` paths and its schema is\n * `.strict()`, so an unknown key throws at the LAYER parse and bricks every command on every pinned\n * version. A sibling file is structurally invisible to that loader \u2014 `config-bootstrap.ts` already\n * relies on exactly this for its `.example.jsonc`. That invisibility is the blast-radius guarantee:\n * a corrupt `tokens.json` can only break the readers below, never `worktrees-list`.\n */\nconst TOKEN_STORE_FILE = 'tokens.json'\n\n/** Schema version of the on-disk store. Bump only alongside a migration. */\nconst TOKEN_STORE_VERSION = 1\n\n/** Mode of `tokens.json` itself \u2014 owner read/write only. It holds live credentials. */\nconst TOKEN_FILE_MODE = 0o600\n\n/** Mode of every directory on the way to the store \u2014 owner-only traversal. */\nconst TOKEN_DIR_MODE = 0o700\n\n/**\n * The store's OWN schema: `{ version?: 1, envs: { <env>: <token> } }`. Deliberately NOT derived from\n * `infraKitConfigObject`: this file is not a merge layer, so `.strict()` here is free (a typo is a\n * loud error in three readers, not a bricked CLI).\n *\n * HAND-AUTHORABILITY IS THE CONSTRAINT THIS SHAPE IS CHOSEN FOR, and two earlier fields were dropped\n * for it \u2014 do not re-add either without re-deciding that:\n *\n *  - `version` is OPTIONAL (defaulted to 1) because a store typed by a human carries no version key,\n *    and a store the CLI refuses to read is a store the human cannot write.\n *  - `repoRoot` is GONE, and with it the refusal that compared it against the current checkout. That\n *    guard was real: the store directory is keyed on `path.basename(mainRepoRoot)`, so `~/work/api`\n *    and `~/oss/api` share ONE token directory and repo B could load (and then overwrite) repo A's\n *    credentials. It was removed anyway, knowingly: it also made the CLI refuse every hand-written\n *    store, which carries no such field. Hand-authorability wins; the basename-collision risk is\n *    ACCEPTED. A weakened version of the guard (warn-and-continue, or \"only check when present\") is\n *    NOT the compromise here \u2014 it would re-introduce the same refusal for anyone who did write the\n *    field. If you want the guard back, key the store directory on something collision-free instead.\n */\nconst tokenStoreSchema = z\n  .object({\n    version: z.literal(TOKEN_STORE_VERSION).default(TOKEN_STORE_VERSION),\n    envs: z.record(z.string().min(1), z.string().min(1)),\n  })\n  .strict()\n\n/** The parsed `tokens.json` shape: `{ version, envs }` \u2014 `version` defaulted to 1 when absent on disk. */\nexport type TokenStore = z.infer<typeof tokenStoreSchema>\n\n/**\n * Absolute path to the per-project token store: `~/.infra-kit/projects/<repo>/tokens.json`.\n *\n * Derived from {@link getInfraKitConfigPaths} rather than re-deriving the home/projects/repo chain \u2014\n * that resolver already keys the directory off the MAIN repo root (so every worktree of a repo shares\n * one store) and memoizes the two `git rev-parse` spawns.\n *\n * @example\n * await getTokenStorePath() // => '/Users/arthur/.infra-kit/projects/infra-kit/tokens.json'\n */\nexport const getTokenStorePath = async (): Promise<string> => {\n  const paths = await getInfraKitConfigPaths()\n\n  return path.join(path.dirname(paths.userProject), TOKEN_STORE_FILE)\n}\n\n/**\n * Read the token store, or `null` when it does not exist.\n *\n * ABSENCE IS NOT AN ERROR \u2014 a fresh machine has no store, and every caller must be able to say \"no\n * tokens yet\" without a try/catch. The two things that DO throw are malformed JSON and a schema\n * mismatch: both are states only a human can fix, so both are loud.\n *\n * @example\n * const store = await readTokenStore()\n * store?.envs.dev // => 'dp.st.dev.xxxx' | undefined\n * // no file on disk  => null\n * // garbage on disk  => throws 'Invalid token store at ~/.infra-kit/projects/api/tokens.json: \u2026'\n */\nexport const readTokenStore = async (): Promise<TokenStore | null> => {\n  const storePath = await getTokenStorePath()\n\n  let raw: string\n\n  try {\n    raw = await fs.readFile(storePath, 'utf-8')\n  } catch {\n    return null\n  }\n\n  // Every refusal below is an EnvAuthError, not a plain Error. A broken store is the MOST durable\n  // env-auth failure there is \u2014 it cannot heal on a 30s retry, only a human can fix it \u2014 and env\n  // auto-load's sticky marker is keyed on that CLASS. Thrown as a plain Error these were classified\n  // TRANSIENT, so a corrupt store went silent on the backgrounded shell-startup spawn and the user's\n  // env simply stopped loading with nothing ever said. `env` is null: no ONE environment is at fault.\n  let parsedRaw: unknown\n\n  try {\n    parsedRaw = JSON.parse(raw)\n  } catch (err) {\n    throw new EnvAuthError(\n      `Invalid JSON in the token store at ${tildify(storePath)}: ${(err as Error).message}\\n` +\n        `Fix or delete the file, then re-add the token with \\`infra-kit env-token-set <env>\\`.`,\n    )\n  }\n\n  const result = tokenStoreSchema.safeParse(parsedRaw)\n\n  if (!result.success) {\n    throw new EnvAuthError(\n      `Invalid token store at ${tildify(storePath)}: ${z.prettifyError(result.error)}\\n` +\n        `Fix or delete the file, then re-add the token with \\`infra-kit env-token-set <env>\\`.`,\n    )\n  }\n\n  return result.data\n}\n\n/**\n * Persist the store atomically at 0600, tightening every directory on the way to it to 0700.\n *\n * The chmods are not belt-and-braces: the config bootstrap already seeds\n * `~/.infra-kit/projects/<repo>/` at the default umask (0755), so an EXISTING directory is\n * world-readable and `mkdir`'s mode argument is a no-op for it. The same holds for the file \u2014 a\n * hand-written `tokens.json` is 0644 \u2014 so the modes of the whole credential path are (re)asserted on\n * EVERY write, not only on the writes that created it. Self-healing by construction: a plain\n * `env-token-set` is enough to fix a store a human typed.\n *\n * @example\n * await writeTokenStore({ version: 1, envs: { dev: 'dp.st.dev.x' } })\n * // ~/.infra-kit/projects/api/tokens.json  -rw-------\n * // ~/.infra-kit/projects/api/             drwx------\n */\nexport const writeTokenStore = async (store: TokenStore): Promise<void> => {\n  const storePath = await getTokenStorePath()\n\n  const projectDir = path.dirname(storePath)\n  const projectsDir = path.dirname(projectDir)\n  const userConfigDir = path.dirname(projectsDir)\n\n  for (const dir of [userConfigDir, projectsDir, projectDir]) {\n    await fs.mkdir(dir, { recursive: true, mode: TOKEN_DIR_MODE })\n    await fs.chmod(dir, TOKEN_DIR_MODE)\n  }\n\n  atomicWriteFileSync(storePath, `${JSON.stringify(store, null, 2)}\\n`, TOKEN_FILE_MODE)\n\n  // The rename above already lands a fresh 0600 inode, but the mode of a credential file is not a\n  // thing to leave to the umask that happened to be in effect \u2014 assert it outright.\n  await fs.chmod(storePath, TOKEN_FILE_MODE)\n}\n\n/**\n * Add or replace one environment's token, read-modify-write, stamping the current `version`. Inherits\n * {@link readTokenStore}'s refusals: a corrupt store is never silently overwritten.\n *\n * @example\n * await setToken('dev', 'dp.st.dev.xxxxxxxx')\n * // tokens.json => { version: 1, envs: { dev: 'dp.st.dev.xxxxxxxx' } }\n */\nexport const setToken = async (env: string, token: string): Promise<void> => {\n  const existing = await readTokenStore()\n\n  await writeTokenStore({\n    version: TOKEN_STORE_VERSION,\n    envs: { ...existing?.envs, [env]: token },\n  })\n}\n\n/**\n * Drop one environment's token. A no-op when the store (or the key) is absent \u2014 removing something\n * that is not there is the state the caller asked for.\n *\n * Removing a token here does NOT revoke it in Doppler; callers say so.\n *\n * @example\n * await removeToken('dev')\n * // tokens.json => { version: 1, envs: {} }\n */\nexport const removeToken = async (env: string): Promise<void> => {\n  const existing = await readTokenStore()\n\n  if (!existing || !(env in existing.envs)) return\n\n  const envs = { ...existing.envs }\n\n  delete envs[env]\n\n  await writeTokenStore({\n    version: TOKEN_STORE_VERSION,\n    envs,\n  })\n}\n", "/**\n * The DURABLE, USER-FIXABLE env-auth failure \u2014 as a TYPE rather than a string.\n *\n * WHY THIS EXISTS (and why it is deliberately NOT a Doppler type): env auto-load must tell a user\n * apart from a TRANSIENT failure (network, timeout, Doppler down \u2014 heals itself, 30s backoff, stay\n * quiet) and a DURABLE one (no token, a corrupt token store, a foreign token store \u2014 never heals, and\n * only a human can fix it). Only the durable class earns the STICKY marker that survives the\n * backgrounded shell-startup spawn and is replayed onto the next interactive command; a durable\n * failure misclassified as transient is TOTAL SILENCE, forever, on the one path the whole feature\n * exists to survive.\n *\n * That classification therefore has to travel WITH the error, not be re-derived by grepping a message\n * some other module owns \u2014 and it has to be throwable from EVERY module that can produce the class.\n * `lib/env-tokens` (the store) is a layer BELOW `integrations/doppler`, so a Doppler-owned base type\n * could not be thrown there without a layering inversion and an import cycle. Hence a neutral base\n * here in `lib/errors`, with `DopplerAuthError extends EnvAuthError` for the subset of failures that\n * are specifically \"Doppler refused the token we sent\".\n *\n * The defect class this closes is \"a durable failure that is not type-detectable\". Adding a new\n * durable failure and forgetting to type it is exactly how this shipped silent twice \u2014 so throw this\n * (or a subclass), never a plain `Error`, for anything a user must fix before env-load can work.\n *\n * @example\n * // no token minted for this env (integrations/doppler/token-resolver.ts)\n * throw new EnvAuthError(buildMissingTokenMessage('dev', storePath), 'dev')\n *\n * @example\n * // the token store itself is unusable \u2014 no single env is at fault, so `env` stays null\n * throw new EnvAuthError(`Invalid JSON in the token store at ${storePath} \u2026`)\n */\nexport class EnvAuthError extends Error {\n  /**\n   * The env (= Doppler config) whose token is at fault, or `null` when the failure is not attributable\n   * to ONE env (a corrupt or foreign token store breaks every env at once). `null` is honest: do NOT\n   * invent an env to fill it \u2014 the consumer names the env it was TRYING to load, which it already\n   * knows.\n   */\n  readonly env: string | null\n\n  constructor(message: string, env: string | null = null) {\n    super(message)\n    this.name = 'EnvAuthError'\n    this.env = env\n  }\n}\n\n/**\n * The TYPE GUARD every consumer of the auth channel classifies on \u2014 the single question \"is this a\n * durable, user-fixable env-auth failure?\", answered by the error's CLASS and never by its text.\n *\n * This is the default `isAuthFailure` of `lib/env-autoload`'s `runEnvAutoLoad`. It is deliberately\n * WIDER than `isDopplerAuthError`: that one means \"Doppler refused us\", which is only one of the\n * durable failures \u2014 a missing token never reaches Doppler at all, and a corrupt store never reaches\n * the resolver.\n *\n * @example\n * isEnvAuthFailure(new EnvAuthError('No Doppler service token for env \"dev\".', 'dev')) // => true\n * isEnvAuthFailure(new DopplerAuthError('dev', 'revoked'))                             // => true (subclass)\n * isEnvAuthFailure(new Error('connect ETIMEDOUT'))                                     // => false (transient)\n */\nexport const isEnvAuthFailure = (error: unknown): error is EnvAuthError => {\n  return error instanceof EnvAuthError\n}\n", "import fs from 'node:fs/promises'\nimport os from 'node:os'\n\n/**\n * Shared path-display helpers for CLI output. Extracted from `commands/config`\n * and `commands/init/migrate-config` (which each had private copies) so config\n * surfaces print paths consistently. Keep this dependency-light (node builtins\n * only) \u2014 it is imported by several commands.\n */\n\n/**\n * Resolve whether a file is reachable, suppressing ENOENT (and any access error)\n * into a boolean. Used to render `[\u2713]`/`[ ]` existence markers.\n *\n * @example\n * await fileExists('/etc/hosts') // => true\n * await fileExists('/nope.txt')  // => false\n */\nexport const fileExists = async (filePath: string): Promise<boolean> => {\n  try {\n    await fs.access(filePath)\n\n    return true\n  } catch {\n    return false\n  }\n}\n\n/**\n * Replace the user's home prefix with `~` so logged paths stay short and portable\n * across machines. Leaves non-home paths untouched.\n *\n * @example\n * // os.homedir() === '/Users/arthur'\n * tildify('/Users/arthur/.infra-kit/infra-kit.json') // => '~/.infra-kit/infra-kit.json'\n * tildify('/etc/hosts')                              // => '/etc/hosts'\n */\nexport const tildify = (filePath: string): string => {\n  const home = os.homedir()\n\n  return filePath.startsWith(home) ? `~${filePath.slice(home.length)}` : filePath\n}\n", "import { logger } from 'src/lib/logger'\n\ninterface CommandOption {\n  flag: string\n  value: string | string[] | boolean\n}\n\nconst createCommandEcho = () => {\n  let cliPath = ''\n  let options: CommandOption[] = []\n  let isInteractive = false\n\n  return {\n    /**\n     * Bind the echo to the command about to run, and clear the previous one's recording.\n     *\n     * `cliPath` must be the argv Commander actually parsed (`release create`), which is why the ONLY\n     * caller is program.ts's `preAction` hook, feeding it `commandPath(actionCommand)`. Commands used to\n     * name themselves here, and that is precisely how the printed line rotted: they passed the flat\n     * `release-create`, which stopped being a command the day the flat aliases were dropped, so the\n     * \"equivalent command\" we told the user to retype no longer parsed. Commander is the only thing that\n     * knows the real path, so it is the only thing allowed to say it.\n     */\n    start(path: string): void {\n      cliPath = path\n      options = []\n      isInteractive = false\n    },\n\n    /**\n     * Mark that the command had interactive input (prompts)\n     * Call this once when ANY prompt happens\n     */\n    setInteractive(): void {\n      isInteractive = true\n    },\n\n    /**\n     * Track an option selection\n     * @param flag The CLI flag (e.g., \"--versions\")\n     * @param value The selected value\n     */\n    addOption(flag: string, value: string | string[] | boolean): void {\n      options.push({ flag, value })\n    },\n\n    /**\n     * Format the tracked options into a replayable flag string (empty when none).\n     */\n    formatOptions(): string {\n      return options\n        .map((opt) => {\n          if (typeof opt.value === 'boolean') {\n            return opt.value ? opt.flag : ''\n          }\n\n          if (Array.isArray(opt.value)) {\n            return `${opt.flag} \"${opt.value.join(', ')}\"`\n          }\n\n          return `${opt.flag} \"${opt.value}\"`\n        })\n        .filter(Boolean)\n        .join(' ')\n    },\n\n    /**\n     * The recorded interactive flags for the session shell's report side channel, so the transcript's\n     * equivalent line carries the resolved options (`--versions \"1.2.5\"`), not just the bare command.\n     * `null` when nothing was recorded \u2014 the caller then falls back to the bare spawned argv.\n     */\n    snapshot(): { formattedOptions: string } | null {\n      if (options.length === 0) {\n        return null\n      }\n\n      return { formattedOptions: this.formatOptions() }\n    },\n\n    /**\n     * Print the equivalent CLI command if there was interactive input.\n     *\n     * Silent without a bound `cliPath`: the only caller that binds one is Commander's `preAction`, so an\n     * unbound echo means the command ran off the CLI (an MCP tool), where a `pnpm exec` line would be\n     * nonsense. Printing a path-less `pnpm exec infra-kit --yes` would be worse than printing nothing.\n     */\n    print(): void {\n      if (!isInteractive || options.length === 0 || !cliPath) {\n        return\n      }\n\n      logger.info(`\uD83D\uDCDF Equivalent command: \\npnpm exec infra-kit ${cliPath} ${this.formatOptions()}\\n`)\n    },\n\n    /**\n     * Reset state (useful for testing)\n     */\n    reset(): void {\n      cliPath = ''\n      options = []\n      isInteractive = false\n    },\n  }\n}\n\n// Singleton instance (same pattern as logger)\nexport const commandEcho = createCommandEcho()\n", "import type { Buffer } from 'node:buffer'\nimport process from 'node:process'\n\nimport { isMcpMode } from 'src/lib/mcp-mode'\n\nimport { acquireStdin, releaseStdin } from './stdin-ref'\n\n/**\n * Structural mirror of `@inquirer/type`'s `Context` \u2014 the second argument every\n * `@inquirer/*` prompt takes. Declared here rather than imported because\n * `@inquirer/core` and `@inquirer/type` are transitive dependencies of this\n * package, not direct ones (only the four prompt packages are).\n */\nexport interface PromptContext {\n  input?: NodeJS.ReadableStream\n  output?: NodeJS.WritableStream\n  clearPromptOnDone?: boolean\n  signal?: AbortSignal\n}\n\nconst ESC_BYTE = 0x1b\n\n/**\n * Run an `@inquirer/*` prompt with Esc bound to cancellation.\n *\n * The cancel path is entirely pre-existing plumbing: an `AbortController`'s signal\n * goes into the prompt context, `@inquirer/core` rejects with an `AbortPromptError`\n * when it fires, that name is already in `CANCELLATION_ERROR_NAMES`\n * (lib/errors/is-prompt-cancellation), and `entry/cli.ts` catches it at the top\n * level \u2192 \"Operation cancelled.\" \u2192 exit 0. All this adds is the thing that calls\n * `abort()`.\n *\n * DETECTION \u2014 a raw `data` listener that aborts iff the chunk is exactly one `0x1b`\n * byte. Deliberately NOT readline `keypress`: that delivers a lone Esc only after its\n * escape-sequence timeout (~523ms measured), and the `escapeCodeTimeout` dial that\n * would shorten it is process-global and first-armer-wins \u2014 a second\n * `emitKeypressEvents` call on `process.stdin` is SILENTLY IGNORED, so the dial\n * degrades to a no-op with no error and no failing test. The raw listener costs ~24ms\n * and touches no global state. Arrow keys (`\\x1b[B`, 3 bytes) and Alt combos\n * (`\\x1bb`, 2 bytes) are ignored because they are LONGER \u2014 no parsed key field is\n * involved. Node `data` listeners broadcast, so this one does not steal bytes from\n * readline: arrows and Enter keep working while it is attached.\n *\n * FALSE POSITIVES are a non-issue: there is no routine source of a lone-`0x1b` chunk.\n * Focus events (`\\x1b[I`/`\\x1b[O`), bracketed paste (`\\x1b[200~`) and mouse reports\n * (`\\x1b[M\u2026`) are all multi-byte, and inquirer enables none of them.\n *\n * FALSE NEGATIVE \u2014 measured and accepted: a COALESCED Esc (`\"\\x1bx\"` arriving in ONE\n * chunk, i.e. Esc immediately followed by another key) is silently dropped and the\n * prompt stays open. The fix would be Ink's 20ms deferred abort \u2014 hold the lone Esc,\n * cancel it if a follow-up chunk lands. That is a logged NON-GOAL; do not pre-build it.\n *\n * The listener attaches only on a real interactive terminal. `isTTY` alone is NOT a\n * sufficient guard \u2014 see lib/mcp-mode for why `stdio: 'inherit'` defeats it.\n */\nexport const withEscape = async <T>(run: (context: PromptContext) => Promise<T>, base?: PromptContext): Promise<T> => {\n  const controller = new AbortController()\n  const context: PromptContext = { ...base, signal: controller.signal }\n\n  if (isMcpMode() || !process.stdin.isTTY) return run(context)\n\n  const input = process.stdin\n\n  const onData = (chunk: Buffer) => {\n    if (chunk.length === 1 && chunk[0] === ESC_BYTE) controller.abort()\n  }\n\n  // STDIN OWNERSHIP \u2014 this is the seam that keeps stdin alive for inquirer, which refs\n  // nothing itself. It must sit BELOW the early return above: a non-TTY run never reads\n  // stdin, so acquiring there would ref a handle nobody reads and hang the process. See\n  // lib/prompts/stdin-ref for why an unref'd stdin kills a prompt with exit 13.\n  acquireStdin()\n\n  try {\n    // Attach after the prompt has built its readline interface. Cheap ordering defence\n    // only \u2014 there is no race today: readline attaches its own consumer synchronously\n    // and `data` events are async.\n    //\n    // INSIDE the `try`, both of them: `run` is caller-supplied and `@inquirer/core` runs\n    // synchronously up to readline construction, so a SYNCHRONOUS throw here would skip a\n    // `finally` placed any lower \u2014 leaking the ref and hanging the CLI, which is the exact\n    // failure this module exists to prevent.\n    const pending = run(context)\n\n    // Explicit, because `on('data')` alone is NOT enough to start the flow: `Readable` resumes on a\n    // new `data` listener only when `flowing !== false`, and the palette's teardown now pauses stdin\n    // (tui/boot.tsx) so a prompt opened after an Ink screen inherits `flowing === false`. Esc would be\n    // silently dead. It happens to work anyway today \u2014 `run()` above builds inquirer's readline, whose\n    // constructor resumes the stream \u2014 but that is an undocumented side effect of a TRANSITIVE\n    // dependency, and the ordering it relies on is the very thing the comment below reserves the right\n    // to change. One idempotent call is cheaper than that coupling.\n    if (input.isPaused()) input.resume()\n\n    input.on('data', onData)\n\n    return await pending\n  } finally {\n    // Non-negotiable: the dev wizard runs ~5 prompts back to back, so a leaked\n    // listener would abort the next one.\n    input.removeListener('data', onData)\n    // Same `finally` as the listener teardown, and for the same reason: every exit path\n    // (answer, Esc abort, throw) must give the ref back, or node never exits.\n    releaseStdin()\n  }\n}\n", "import confirm from '@inquirer/confirm'\nimport process from 'node:process'\n\nimport { logger } from 'src/lib/logger'\nimport { withEscape } from 'src/lib/prompts/escapable-context'\n\nimport { commandEcho } from './command-echo'\n\n/**\n * Shared interactive-confirmation gate for mutating commands.\n *\n * When `confirmedCommand` is truthy (CLI `--yes` or an MCP call, which always\n * injects `confirmedCommand: true`) the prompt is skipped and execution\n * proceeds. Otherwise it prompts the user, marks the echo as interactive, and\n * exits cleanly if the user declines.\n *\n * Esc aborts the prompt (via `withEscape`) rather than answering it \u2014 the caller\n * sees an `AbortPromptError`, which every command's boundary already treats as a\n * clean back-out through `isPromptCancellation`. That is deliberately NOT the same\n * as declining: a decline is an answer of \"no\" and takes the `process.exit(0)` path\n * below, whereas Esc means \"I never answered\".\n *\n * Unlike every other prompt in the CLI this one renders to STDOUT, not stderr \u2014\n * left as-is, since changing it would move confirmation text out of the stream\n * callers have always read it from.\n *\n * The `process.exit(0)` only runs on the interactive-decline path, which is\n * unreachable under MCP \u2014 so this stays safe for the long-lived MCP server.\n *\n * Callers remain responsible for their own `commandEcho.addOption('--yes', \u2026)`\n * bookkeeping, which varies between commands.\n */\nexport const confirmOrExit = async (confirmedCommand: boolean | undefined, message: string): Promise<void> => {\n  const answer = confirmedCommand\n    ? true\n    : await withEscape((context) => {\n        return confirm({ message }, context)\n      })\n\n  if (!confirmedCommand) {\n    commandEcho.setInteractive()\n  }\n\n  if (!answer) {\n    logger.info('Operation cancelled. Exiting...')\n    process.exit(0)\n  }\n}\n"],
+  "mappings": "6IAKA,OAAOA,MAAQ,mBACf,OAAOC,MAAU,YACjB,OAAS,KAAAC,MAAS,MCuBX,IAAMC,EAAN,cAA2B,KAAM,CAO7B,IAET,YAAYC,EAAiBC,EAAqB,KAAM,CACtD,MAAMD,CAAO,EACb,KAAK,KAAO,eACZ,KAAK,IAAMC,CACb,CACF,EAgBaC,EAAoBC,GACxBA,aAAiBJ,EC7D1B,OAAOK,MAAQ,mBACf,OAAOC,MAAQ,UAiBR,IAAMC,EAAa,MAAOC,GAAuC,CACtE,GAAI,CACF,aAAMH,EAAG,OAAOG,CAAQ,EAEjB,EACT,MAAQ,CACN,MAAO,EACT,CACF,EAWaC,EAAWD,GAA6B,CACnD,IAAME,EAAOJ,EAAG,QAAQ,EAExB,OAAOE,EAAS,WAAWE,CAAI,EAAI,IAAIF,EAAS,MAAME,EAAK,MAAM,CAAC,GAAKF,CACzE,EFnBA,IAAMG,EAAmB,cAGnBC,EAAsB,EAGtBC,EAAkB,IAGlBC,EAAiB,IAqBjBC,EAAmBC,EACtB,OAAO,CACN,QAASA,EAAE,QAAQJ,CAAmB,EAAE,QAAQA,CAAmB,EACnE,KAAMI,EAAE,OAAOA,EAAE,OAAO,EAAE,IAAI,CAAC,EAAGA,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CACrD,CAAC,EACA,OAAO,EAeGC,EAAoB,SAA6B,CAC5D,IAAMC,EAAQ,MAAMC,EAAuB,EAE3C,OAAOC,EAAK,KAAKA,EAAK,QAAQF,EAAM,WAAW,EAAGP,CAAgB,CACpE,EAeaU,EAAiB,SAAwC,CACpE,IAAMC,EAAY,MAAML,EAAkB,EAEtCM,EAEJ,GAAI,CACFA,EAAM,MAAMC,EAAG,SAASF,EAAW,OAAO,CAC5C,MAAQ,CACN,OAAO,IACT,CAOA,IAAIG,EAEJ,GAAI,CACFA,EAAY,KAAK,MAAMF,CAAG,CAC5B,OAASG,EAAK,CACZ,MAAM,IAAIC,EACR,sCAAsCC,EAAQN,CAAS,CAAC,KAAMI,EAAc,OAAO;AAAA,sFAErF,CACF,CAEA,IAAMG,EAASd,EAAiB,UAAUU,CAAS,EAEnD,GAAI,CAACI,EAAO,QACV,MAAM,IAAIF,EACR,0BAA0BC,EAAQN,CAAS,CAAC,KAAKN,EAAE,cAAca,EAAO,KAAK,CAAC;AAAA,sFAEhF,EAGF,OAAOA,EAAO,IAChB,EAiBaC,EAAkB,MAAOC,GAAqC,CACzE,IAAMT,EAAY,MAAML,EAAkB,EAEpCe,EAAaZ,EAAK,QAAQE,CAAS,EACnCW,EAAcb,EAAK,QAAQY,CAAU,EACrCE,EAAgBd,EAAK,QAAQa,CAAW,EAE9C,QAAWE,IAAO,CAACD,EAAeD,EAAaD,CAAU,EACvD,MAAMR,EAAG,MAAMW,EAAK,CAAE,UAAW,GAAM,KAAMrB,CAAe,CAAC,EAC7D,MAAMU,EAAG,MAAMW,EAAKrB,CAAc,EAGpCsB,EAAoBd,EAAW,GAAG,KAAK,UAAUS,EAAO,KAAM,CAAC,CAAC;AAAA,EAAMlB,CAAe,EAIrF,MAAMW,EAAG,MAAMF,EAAWT,CAAe,CAC3C,EAUawB,EAAW,MAAOC,EAAaC,IAAiC,CAC3E,IAAMC,EAAW,MAAMnB,EAAe,EAEtC,MAAMS,EAAgB,CACpB,QAASlB,EACT,KAAM,CAAE,GAAG4B,GAAU,KAAM,CAACF,CAAG,EAAGC,CAAM,CAC1C,CAAC,CACH,EAYaE,EAAc,MAAOH,GAA+B,CAC/D,IAAME,EAAW,MAAMnB,EAAe,EAEtC,GAAI,CAACmB,GAAY,EAAEF,KAAOE,EAAS,MAAO,OAE1C,IAAME,EAAO,CAAE,GAAGF,EAAS,IAAK,EAEhC,OAAOE,EAAKJ,CAAG,EAEf,MAAMR,EAAgB,CACpB,QAASlB,EACT,KAAA8B,CACF,CAAC,CACH,EGrMA,IAAMC,EAAoB,IAAM,CAC9B,IAAIC,EAAU,GACVC,EAA2B,CAAC,EAC5BC,EAAgB,GAEpB,MAAO,CAWL,MAAMC,EAAoB,CACxBH,EAAUG,EACVF,EAAU,CAAC,EACXC,EAAgB,EAClB,EAMA,gBAAuB,CACrBA,EAAgB,EAClB,EAOA,UAAUE,EAAcC,EAA0C,CAChEJ,EAAQ,KAAK,CAAE,KAAAG,EAAM,MAAAC,CAAM,CAAC,CAC9B,EAKA,eAAwB,CACtB,OAAOJ,EACJ,IAAKK,GACA,OAAOA,EAAI,OAAU,UAChBA,EAAI,MAAQA,EAAI,KAAO,GAG5B,MAAM,QAAQA,EAAI,KAAK,EAClB,GAAGA,EAAI,IAAI,KAAKA,EAAI,MAAM,KAAK,IAAI,CAAC,IAGtC,GAAGA,EAAI,IAAI,KAAKA,EAAI,KAAK,GACjC,EACA,OAAO,OAAO,EACd,KAAK,GAAG,CACb,EAOA,UAAgD,CAC9C,OAAIL,EAAQ,SAAW,EACd,KAGF,CAAE,iBAAkB,KAAK,cAAc,CAAE,CAClD,EASA,OAAc,CACR,CAACC,GAAiBD,EAAQ,SAAW,GAAK,CAACD,GAI/CO,EAAO,KAAK;AAAA,sBAAgDP,CAAO,IAAI,KAAK,cAAc,CAAC;AAAA,CAAI,CACjG,EAKA,OAAc,CACZA,EAAU,GACVC,EAAU,CAAC,EACXC,EAAgB,EAClB,CACF,CACF,EAGaM,EAAcT,EAAkB,ECzG7C,OAAOU,MAAa,eAmBpB,IAAMC,EAAW,GAmCJC,EAAa,MAAUC,EAA6CC,IAAqC,CACpH,IAAMC,EAAa,IAAI,gBACjBC,EAAyB,CAAE,GAAGF,EAAM,OAAQC,EAAW,MAAO,EAEpE,GAAIE,EAAU,GAAK,CAACC,EAAQ,MAAM,MAAO,OAAOL,EAAIG,CAAO,EAE3D,IAAMG,EAAQD,EAAQ,MAEhBE,EAAUC,GAAkB,CAC5BA,EAAM,SAAW,GAAKA,EAAM,CAAC,IAAMV,GAAUI,EAAW,MAAM,CACpE,EAMAO,EAAa,EAEb,GAAI,CASF,IAAMC,EAAUV,EAAIG,CAAO,EAS3B,OAAIG,EAAM,SAAS,GAAGA,EAAM,OAAO,EAEnCA,EAAM,GAAG,OAAQC,CAAM,EAEhB,MAAMG,CACf,QAAE,CAGAJ,EAAM,eAAe,OAAQC,CAAM,EAGnCI,EAAa,CACf,CACF,ECxGA,OAAOC,MAAa,oBACpB,OAAOC,MAAa,eA+Bb,IAAMC,EAAgB,MAAOC,EAAuCC,IAAmC,CAC5G,IAAMC,EAASF,EACX,GACA,MAAMG,EAAYC,GACTC,EAAQ,CAAE,QAAAJ,CAAQ,EAAGG,CAAO,CACpC,EAEAJ,GACHM,EAAY,eAAe,EAGxBJ,IACHK,EAAO,KAAK,iCAAiC,EAC7CC,EAAQ,KAAK,CAAC,EAElB",
+  "names": ["fs", "path", "z", "EnvAuthError", "message", "env", "isEnvAuthFailure", "error", "fs", "os", "fileExists", "filePath", "tildify", "home", "TOKEN_STORE_FILE", "TOKEN_STORE_VERSION", "TOKEN_FILE_MODE", "TOKEN_DIR_MODE", "tokenStoreSchema", "z", "getTokenStorePath", "paths", "getInfraKitConfigPaths", "path", "readTokenStore", "storePath", "raw", "fs", "parsedRaw", "err", "EnvAuthError", "tildify", "result", "writeTokenStore", "store", "projectDir", "projectsDir", "userConfigDir", "dir", "atomicWriteFileSync", "setToken", "env", "token", "existing", "removeToken", "envs", "createCommandEcho", "cliPath", "options", "isInteractive", "path", "flag", "value", "opt", "logger", "commandEcho", "process", "ESC_BYTE", "withEscape", "run", "base", "controller", "context", "isMcpMode", "process", "input", "onData", "chunk", "acquireStdin", "pending", "releaseStdin", "confirm", "process", "confirmOrExit", "confirmedCommand", "message", "answer", "withEscape", "context", "confirm", "commandEcho", "logger", "process"]
 }