infra-kit 0.34.0 → 0.35.0

package/dist/{chunk-QCTAEXMN.js → chunk-YVIJUGOB.js}

@@ -1,12 +1,12 @@
-import{a as N,e as ie,h as O,i as ae,j as u}from"./chunk-MWGE43QS.js";import{P as a,S as se,d as f,e as b,ea as m,f as x,h as S,ha as g,i as ne,w as A}from"./chunk-467ZSXYU.js";import{a as G,c as B,d as P,f as Y,g as Q,h as X,i as ee,j as te,o as re,p as L,q as oe}from"./chunk-I23MDR4X.js";import Ye from"@inquirer/select";import{readRepoIdentity as Qe}from"@slip-stream-kit/config/internal";import{Buffer as Xe}from"node:buffer";import et from"node:fs";import U from"node:path";import C from"node:process";import{z as d}from"zod";import{$ as K}from"zx";var be="Could not find requested project",xe="Could not find requested config",ce="Invalid Auth token",le="does not have access to requested config",D=e=>e.includes(ce)||e.includes(le)?"auth":e.includes(be)?"project":e.includes(xe)?"config":"unknown",R=e=>e.includes(le)?"mis-scoped":e.includes(ce)?"revoked":null;var pe=e=>[`Doppler rejected the service token for env "${e}" \u2014 it is invalid, revoked, or scoped to a different config.`,`Fix: run \`infra-kit env-token-set ${e}\` with a token scoped to that config.`,"CI / agents: set INFRA_KIT_ENV_TOKEN to a token scoped to that config."].join(`
+import{a as N,e as ie,h as O,i as ae,j as u}from"./chunk-BYCCXWPB.js";import{P as a,S as se,X as m,d as f,e as b,f as x,fa as g,h as S,i as ne,w as A}from"./chunk-GDOQUC23.js";import{a as G,c as B,d as P,f as Y,g as Q,h as X,i as ee,j as te,o as re,p as L,q as oe}from"./chunk-GCOYOWGH.js";import Ye from"@inquirer/select";import{readRepoIdentity as Qe}from"@slip-stream-kit/config/internal";import{Buffer as Xe}from"node:buffer";import et from"node:fs";import U from"node:path";import C from"node:process";import{z as d}from"zod";import{$ as K}from"zx";var be="Could not find requested project",xe="Could not find requested config",ce="Invalid Auth token",le="does not have access to requested config",D=e=>e.includes(ce)||e.includes(le)?"auth":e.includes(be)?"project":e.includes(xe)?"config":"unknown",R=e=>e.includes(le)?"mis-scoped":e.includes(ce)?"revoked":null;var pe=e=>[`Doppler rejected the service token for env "${e}" \u2014 it is invalid, revoked, or scoped to a different config.`,`Fix: run \`infra-kit env-token-set ${e}\` with a token scoped to that config.`,"CI / agents: set INFRA_KIT_ENV_TOKEN to a token scoped to that config."].join(`
 `),v=class extends O{authKind;constructor(t,r=null,o){super(o??pe(t),t),this.name="DopplerAuthError",this.authKind=r}};var M=({kind:e,project:t,config:r,available:o})=>{let n=e==="project"?[`Doppler project "${t}" not found (set in infra-kit.json \u2192 envManagement.config.name).`]:[`Doppler config "${r}" not found in project "${t}".`];if(o&&o.length>0){let s=e==="project"?"Available projects":`Available configs in "${t}"`;n.push(`${s}: ${o.join(", ")}.`)}return n.push(e==="project"?"Fix: update envManagement.config.name to an existing project, or create it in Doppler.":"Fix: pass an existing config, or create it in Doppler."),n.join(`
-`)};import{$ as j}from"zx";var Se=5e3,Ne="DOPPLER_CONFIG",h=async()=>{let{envManagement:e}=await m();return e.config.name},Oe=async({childEnv:e,project:t,config:r})=>{let o=j.quiet;j.quiet=!0;try{let s=(await j({env:e})`doppler secrets get ${Ne} --plain --project ${t} --config ${r}`.timeout(Se)).stdout.trim();return s!==r?{outcome:"mis-scoped",scopedTo:s}:{outcome:"valid",scopedTo:s}}catch(n){return{outcome:je(n)}}finally{j.quiet=o}},je=e=>{let t=S(e)??(e instanceof Error?e.message:String(e));return D(t)!=="auth"?"unreachable":R(t)??"unreachable"};import Fe from"node:process";var l="INFRA_KIT_ENV_TOKEN",V=async e=>{let t=Fe.env[l];if(t)return{token:t,source:"env"};let o=(await u())?.envs[e];if(o)return{token:o,source:"store"};throw new O(Ie(e,await ae()),e)},Ie=(e,t)=>[`No Doppler service token for env "${e}".`,`Mint one at https://dashboard.doppler.com \u2014 this project \u2192 config "${e}" \u2192 Access tab \u2192 "Generate Service Token".`,`Fix: run \`infra-kit env-token-set ${e}\` and paste it.`,`It is stored in ${se(t)} (mode 0600, never in the repo).`,`CI / agents: set ${l} instead \u2014 it takes precedence and needs no home config.`].join(`
-`);import ke from"node:process";import{z as Ee}from"zod";import We from"node:process";import{z as p}from"zod";var _=async()=>{try{return(await m()).defaultEnv??null}catch{return null}};var ue=["prod"],E={allowed:!1,reason:"disallow"},w=e=>ue.includes(e),$e=["dev","stage"],Ke=e=>$e.includes(e)||w(e),Ce=(e,t=E)=>t.allowed?e:e.filter(r=>!w(r)),Le=(e,t,r=E)=>{if(!r.allowed&&w(e))throw r.reason==="agent-blocked"?new g({status:"refused",env:e,agentMode:f.source},2,{operation:t,remediation:'a human runs it from their own terminal \u2014 this project sets `protectedEnvs: "cli-only"`',stderrExcerpt:`"${e}" is withheld from agents in this project (protectedEnvs: "cli-only")`}):new ne(void 0,{operation:t,remediation:`use \`infra-kit release deliver\` \u2014 it merges the release to main, opens the RC PR, deploys from main, and releases the Jira version. To allow ad-hoc deploys to "${e}" in this project, set \`protectedEnvs\` to "allow" or "cli-only" in infra-kit.json`,stderrExcerpt:`"${e}" is delivered, not deployed ad-hoc`})};var Me=async()=>{let e;try{e=(await m()).protectedEnvs??"disallow"}catch{return E}return e==="disallow"?E:e==="cli-only"&&b()?{allowed:!1,reason:"agent-blocked"}:{allowed:!0,reason:"allowed"}};var Ve=e=>{let{env:t,branch:r}=e;w(t)&&a.warn([`\u26A0\uFE0F "${t}" is a delivery target \u2014 this project allows dispatching to it directly, but this is NOT the delivery flow.`,`Dispatching from "${r}" ships ${t} from a ref that is not merged to main, and skips:`,"  \u2022 the squash-merge of the release branch into main","  \u2022 the RC pull request","  \u2022 the Jira fix-version release","Run `infra-kit release deliver` instead if you want those."].join(`
+`)};import{$ as j}from"zx";var Se=5e3,Ne="DOPPLER_CONFIG",h=async()=>{let{envManagement:e}=await g();return e.config.name},Oe=async({childEnv:e,project:t,config:r})=>{let o=j.quiet;j.quiet=!0;try{let s=(await j({env:e})`doppler secrets get ${Ne} --plain --project ${t} --config ${r}`.timeout(Se)).stdout.trim();return s!==r?{outcome:"mis-scoped",scopedTo:s}:{outcome:"valid",scopedTo:s}}catch(n){return{outcome:je(n)}}finally{j.quiet=o}},je=e=>{let t=S(e)??(e instanceof Error?e.message:String(e));return D(t)!=="auth"?"unreachable":R(t)??"unreachable"};import Fe from"node:process";var l="INFRA_KIT_ENV_TOKEN",V=async e=>{let t=Fe.env[l];if(t)return{token:t,source:"env"};let o=(await u())?.envs[e];if(o)return{token:o,source:"store"};throw new O(Ie(e,await ae()),e)},Ie=(e,t)=>[`No Doppler service token for env "${e}".`,`Mint one at https://dashboard.doppler.com \u2014 this project \u2192 config "${e}" \u2192 Access tab \u2192 "Generate Service Token".`,`Fix: run \`infra-kit env-token-set ${e}\` and paste it.`,`It is stored in ${se(t)} (mode 0600, never in the repo).`,`CI / agents: set ${l} instead \u2014 it takes precedence and needs no home config.`].join(`
+`);import ke from"node:process";import{z as Ee}from"zod";import We from"node:process";import{z as p}from"zod";var _=async()=>{try{return(await g()).defaultEnv??null}catch{return null}};var ue=["prod"],E={allowed:!1,reason:"disallow"},w=e=>ue.includes(e),$e=["dev","stage"],Ke=e=>$e.includes(e)||w(e),Ce=(e,t=E)=>t.allowed?e:e.filter(r=>!w(r)),Le=(e,t,r=E)=>{if(!r.allowed&&w(e))throw r.reason==="agent-blocked"?new m({status:"refused",env:e,agentMode:f.source},2,{operation:t,remediation:'a human runs it from their own terminal \u2014 this project sets `protectedEnvs: "cli-only"`',stderrExcerpt:`"${e}" is withheld from agents in this project (protectedEnvs: "cli-only")`}):new ne(void 0,{operation:t,remediation:`use \`infra-kit release deliver\` \u2014 it merges the release to main, opens the RC PR, deploys from main, and releases the Jira version. To allow ad-hoc deploys to "${e}" in this project, set \`protectedEnvs\` to "allow" or "cli-only" in infra-kit.json`,stderrExcerpt:`"${e}" is delivered, not deployed ad-hoc`})};var Me=async()=>{let e;try{e=(await g()).protectedEnvs??"disallow"}catch{return E}return e==="disallow"?E:e==="cli-only"&&b()?{allowed:!1,reason:"agent-blocked"}:{allowed:!0,reason:"allowed"}};var Ve=e=>{let{env:t,branch:r}=e;w(t)&&a.warn([`\u26A0\uFE0F "${t}" is a delivery target \u2014 this project allows dispatching to it directly, but this is NOT the delivery flow.`,`Dispatching from "${r}" ships ${t} from a ref that is not merged to main, and skips:`,"  \u2022 the squash-merge of the release branch into main","  \u2022 the RC pull request","  \u2022 the Jira fix-version release","Run `infra-kit release deliver` instead if you want those."].join(`
 `))};import de from"node:fs/promises";import z from"node:path";import ze from"yaml";var fe=".github/workflows",qe=async e=>{let t=await A();return me(z.resolve(t,fe,e))},q=async()=>{let e=await A(),t=z.resolve(e,fe),r;try{r=await de.readdir(t)}catch{return[]}let o=r.filter(s=>s.endsWith(".yml")||s.endsWith(".yaml")).sort(),n=await Promise.all(o.map(s=>me(z.resolve(t,s))));return[...new Set(n.flat())]},me=async e=>{let t;try{t=ze.parse(await de.readFile(e,"utf-8"))}catch{return[]}let r=k(t,"on")??k(t,"true"),o=k(k(k(k(r,"workflow_dispatch"),"inputs"),"environment"),"options");return Array.isArray(o)?o.filter(n=>typeof n=="string"&&n.length>0):[]},k=(e,t)=>{if(!(typeof e!="object"||e===null||Array.isArray(e)))return e[t]};var y=async()=>{let e=await q(),t=await u(),r=e.map(s=>({env:s,source:"gh-workflow"})),o=new Set(e),n=Object.keys(t?.envs??{}).filter(s=>!o.has(s)).sort().map(s=>({env:s,source:"token-only"}));return[...r,...n]},W=async()=>(await y()).map(t=>t.env);var F=e=>[{type:"text",text:e}],I=e=>e;var $=(e,t,r)=>e.map(({env:o,source:n})=>({env:o,source:n,hasToken:!!(r||t[o])})),ge=["Environment","Source","Token"],Je=e=>{let t=e.map(s=>[s.env,s.source,s.hasToken?"set":"not set"]),r=ge.map((s,i)=>Math.max(s.length,...t.map(c=>(c[i]??"").length))),o=s=>s.map((i,c)=>i.padEnd(r[c]??0)).join(" | ").trimEnd(),n=r.map(s=>"\u2500".repeat(s)).join("\u2500\u253C\u2500");return["Environments:","",o(ge),n,...t.map(o)]},he=async()=>{let e=await h(),t=await y(),r=await u(),o=We.env[l],n=await _(),s=$(t,r?.envs??{},o);if(a.info(`Doppler project: ${e}`),a.info(`Default env: ${n??"none \u2014 set one with `infra-kit config-set defaultEnv <env>`"}
-`),s.length===0)return a.info("No environments found."),a.info("  Declare them in a workflow's `workflow_dispatch` `environment.options`,"),a.info("  or add a token for one manually."),ve({project:e,defaultEnv:n,envs:s});for(let i of Je(s))a.info(i);return ve({project:e,defaultEnv:n,envs:s})},ve=({project:e,defaultEnv:t,envs:r})=>{let o={project:e,defaultEnv:t,configs:r.map(n=>n.env),tokens:r};return{content:F(JSON.stringify(o,null,2)),structuredContent:o}},Ze=I({name:"env-list",description:"List the environments this project has. The list is the union of two local sources: every environment declared in a GitHub workflow's `workflow_dispatch` `environment.options` (source `gh-workflow`), and every environment the local token store holds a token for (source `token-only`). Not a live fetch from Doppler \u2014 a Doppler service token is config-scoped and cannot enumerate sibling configs. Also returns the Doppler project name, and reports per environment whether a service token resolves locally (from the token store or INFRA_KIT_ENV_TOKEN) \u2014 presence only, never the token value, and never a live Doppler probe. Read-only.",inputSchema:{},outputSchema:{project:p.string().describe("Detected Doppler project name"),defaultEnv:p.string().nullable().describe('The configured "defaultEnv" \u2014 what env-load takes when no config is named; null when unset'),configs:p.array(p.string()).describe("Every environment name known to this project"),tokens:p.array(p.object({env:p.string().describe("Environment / Doppler config name"),source:p.enum(["gh-workflow","token-only"]).describe("Where we learned this environment exists \u2014 a workflow declaration, or a token we hold"),hasToken:p.boolean().describe("Whether a service token resolves locally for this environment")})).describe("Per-environment token presence \u2014 never the token value")},handler:he});var we=e=>typeof e=="object"&&e!==null&&!Array.isArray(e),Ue=async e=>{try{return await e}catch{return[]}},He=async e=>{let t=await u().catch(()=>null);return $(e,t?.envs??{},ke.env[l]).filter(r=>!r.hasToken).map(r=>r.env)},J=()=>({get message(){return`Choose the environment to load into terminal session ${ke.env[P]??`UNKNOWN \u2014 ${P} is not set, the load will fail`}. Picking one LOADS it; there is no further prompt.`},isFormable:e=>we(e)&&(e.config===void 0||e.config===""),buildRequestedSchema:async()=>{let e=await Ue(y());if(e.length===0)return a.info({msg:"Tool execution form options empty: env-load"}),null;let t=e.map(o=>o.env),r=await He(e);return Ee.object({config:Ee.enum(t).describe(`The environment to load. ${r.length===0?"A service token is stored for every one of them.":`NO stored token for: ${r.join(", ")} \u2014 choosing one of those fails until you run \`infra-kit env-token-set <env>\`.`} The list is what env-list knows: workflow-declared environments first, then token-only ones.`)})},toArgs:(e,t)=>{let{config:r}=e;return typeof r!="string"||r.length===0?null:{...we(t)?t:{},config:r}}});import{z as Ge}from"zod";var Be=async e=>{try{return await e.provider.buildRequestedSchema(e.params)}catch(t){return a.debug({err:t,operation:e.operation},"argument form builder threw; refusing without choices"),null}},ye=async e=>{if(!x()||!e.provider.isFormable(e.params))return;let t=await Be(e),r=typeof e.params=="object"&&e.params!==null?e.params:{},o=(t===null?[]:Object.keys(t.shape)).filter(i=>r[i]===void 0||r[i]===""),n=typeof e.argument=="string"?e.argument:e.argument(o),s=t===null?void 0:Ge.toJSONSchema(t);throw new g({status:"argument_required",argument:n,...s===void 0?{}:{choices:s},agentMode:f.source},2,{operation:e.operation,remediation:s===void 0?`pass --${n} on the re-run \u2014 nothing could be listed to choose from`:`ask the human to pick from "choices", then pass --${n} on the re-run`,stderrExcerpt:`--${n} was not given and there is no human to ask`})};var tt="DOPPLER_CONFIG",Te=new Set(["DOPPLER_TOKEN",l]),Pe=!1,rt=e=>{e.length===0||Pe||(Pe=!0,a.warn(`infra-kit: not exporting ${e.join(", ")} from Doppler into your shell \u2014 a service token must not be sourced into every process.`))},ot=({pairs:e,config:t,project:r,projectRoot:o,loadedAt:n})=>{let s=e.filter(([i])=>!Te.has(i));return rt(e.filter(([i])=>Te.has(i)).map(([i])=>i)),["set -a",...s.map(([i,c])=>`${i}=${T(c)}`),`${Y}=${T(t)}`,`${Q}=${T(t)}`,`${X}=${T(r)}`,`${ee}=${T(o)}`,`${te}=${T(n)}`,"set +a"]},nt=async()=>{try{return await A()}catch{return""}},st=(e,t=C.cwd())=>{if(e==="")return[U.resolve(t)];let r=Qe(e).root??e;return[...new Set([r,`${r}${oe}`,e])]},it=async({config:e})=>{let t=await h(),r=await nt(),o=await Re(t,e),n=new Date().toISOString(),i=`${ot({pairs:o,config:e,project:t,projectRoot:r,loadedAt:n}).join(`
+`),s.length===0)return a.info("No environments found."),a.info("  Declare them in a workflow's `workflow_dispatch` `environment.options`,"),a.info("  or add a token for one manually."),ve({project:e,defaultEnv:n,envs:s});for(let i of Je(s))a.info(i);return ve({project:e,defaultEnv:n,envs:s})},ve=({project:e,defaultEnv:t,envs:r})=>{let o={project:e,defaultEnv:t,configs:r.map(n=>n.env),tokens:r};return{content:F(JSON.stringify(o,null,2)),structuredContent:o}},Ze=I({name:"env-list",description:"List the environments this project has. The list is the union of two local sources: every environment declared in a GitHub workflow's `workflow_dispatch` `environment.options` (source `gh-workflow`), and every environment the local token store holds a token for (source `token-only`). Not a live fetch from Doppler \u2014 a Doppler service token is config-scoped and cannot enumerate sibling configs. Also returns the Doppler project name, and reports per environment whether a service token resolves locally (from the token store or INFRA_KIT_ENV_TOKEN) \u2014 presence only, never the token value, and never a live Doppler probe. Read-only.",inputSchema:{},outputSchema:{project:p.string().describe("Detected Doppler project name"),defaultEnv:p.string().nullable().describe('The configured "defaultEnv" \u2014 what env-load takes when no config is named; null when unset'),configs:p.array(p.string()).describe("Every environment name known to this project"),tokens:p.array(p.object({env:p.string().describe("Environment / Doppler config name"),source:p.enum(["gh-workflow","token-only"]).describe("Where we learned this environment exists \u2014 a workflow declaration, or a token we hold"),hasToken:p.boolean().describe("Whether a service token resolves locally for this environment")})).describe("Per-environment token presence \u2014 never the token value")},handler:he});var we=e=>typeof e=="object"&&e!==null&&!Array.isArray(e),Ue=async e=>{try{return await e}catch{return[]}},He=async e=>{let t=await u().catch(()=>null);return $(e,t?.envs??{},ke.env[l]).filter(r=>!r.hasToken).map(r=>r.env)},J=()=>({get message(){return`Choose the environment to load into terminal session ${ke.env[P]??`UNKNOWN \u2014 ${P} is not set, the load will fail`}. Picking one LOADS it; there is no further prompt.`},isFormable:e=>we(e)&&(e.config===void 0||e.config===""),buildRequestedSchema:async()=>{let e=await Ue(y());if(e.length===0)return a.info({msg:"Tool execution form options empty: env-load"}),null;let t=e.map(o=>o.env),r=await He(e);return Ee.object({config:Ee.enum(t).describe(`The environment to load. ${r.length===0?"A service token is stored for every one of them.":`NO stored token for: ${r.join(", ")} \u2014 choosing one of those fails until you run \`infra-kit env-token-set <env>\`.`} The list is what env-list knows: workflow-declared environments first, then token-only ones.`)})},toArgs:(e,t)=>{let{config:r}=e;return typeof r!="string"||r.length===0?null:{...we(t)?t:{},config:r}}});import{z as Ge}from"zod";var Be=async e=>{try{return await e.provider.buildRequestedSchema(e.params)}catch(t){return a.debug({err:t,operation:e.operation},"argument form builder threw; refusing without choices"),null}},ye=async e=>{if(!x()||!e.provider.isFormable(e.params))return;let t=await Be(e),r=typeof e.params=="object"&&e.params!==null?e.params:{},o=(t===null?[]:Object.keys(t.shape)).filter(i=>r[i]===void 0||r[i]===""),n=typeof e.argument=="string"?e.argument:e.argument(o),s=t===null?void 0:Ge.toJSONSchema(t);throw new m({status:"argument_required",argument:n,...s===void 0?{}:{choices:s},agentMode:f.source},2,{operation:e.operation,remediation:s===void 0?`pass --${n} on the re-run \u2014 nothing could be listed to choose from`:`ask the human to pick from "choices", then pass --${n} on the re-run`,stderrExcerpt:`--${n} was not given and there is no human to ask`})};var tt="DOPPLER_CONFIG",Te=new Set(["DOPPLER_TOKEN",l]),Pe=!1,rt=e=>{e.length===0||Pe||(Pe=!0,a.warn(`infra-kit: not exporting ${e.join(", ")} from Doppler into your shell \u2014 a service token must not be sourced into every process.`))},ot=({pairs:e,config:t,project:r,projectRoot:o,loadedAt:n})=>{let s=e.filter(([i])=>!Te.has(i));return rt(e.filter(([i])=>Te.has(i)).map(([i])=>i)),["set -a",...s.map(([i,c])=>`${i}=${T(c)}`),`${Y}=${T(t)}`,`${Q}=${T(t)}`,`${X}=${T(r)}`,`${ee}=${T(o)}`,`${te}=${T(n)}`,"set +a"]},nt=async()=>{try{return await A()}catch{return""}},st=(e,t=C.cwd())=>{if(e==="")return[U.resolve(t)];let r=Qe(e).root??e;return[...new Set([r,`${r}${oe}`,e])]},it=async({config:e})=>{let t=await h(),r=await nt(),o=await Re(t,e),n=new Date().toISOString(),i=`${ot({pairs:o,config:e,project:t,projectRoot:r,loadedAt:n}).join(`
 `)}
 `,c=re(),H=U.resolve(c,G);et.mkdirSync(c,{recursive:!0,mode:448});let _e=st(r);return L(U.resolve(c,B),`${_e.join(`
 `)}
-`,384),L(H,i,384),{filePath:H,variableCount:o.length,project:t,config:e}},De=J(),at=async e=>{let{config:t}=e,r=t?null:await _();if(!t&&r&&x())return Z(r,"default");if(await ye({provider:De,params:e,operation:"env-load",argument:"config"}),t)return Z(t,"argument");if(b())throw new g({status:"argument_required",argument:"config",agentMode:f.source},2,{operation:"env-load",remediation:'call env-list, ask the human which environment, and re-call env-load with "config"'});let o=await W();N.setInteractive();let n=await ie(s=>Ye({message:"Select environment config",choices:ct(o,r),...r?{default:r}:{}},s),{output:C.stderr,whenHeadless:"refuse"});return Z(n,"picker")},ct=(e,t)=>(t&&!e.includes(t)?[t,...e]:e).map(o=>({name:o===t?`${o} (default)`:o,value:o})),Z=async(e,t)=>{N.addOption("--config",e);let r=await it({config:e});N.print();let o={filePath:r.filePath,variableCount:r.variableCount,project:r.project,config:r.config,configSource:t,sessionId:C.env[P]??null};return{content:F(JSON.stringify(o,null,2)),structuredContent:o}},Ae=1024*1024,lt=3e4,pt=["DOPPLER_TOKEN","DOPPLER_PROJECT","DOPPLER_CONFIG"],ut=(e,t=C.env)=>{let r={...t};for(let o of pt)delete r[o];return r.DOPPLER_TOKEN=e,r},io=async e=>new Map(await Re(await h(),e)),Re=async(e,t)=>{let{token:r}=await V(t),o=ut(r),n=K.quiet;K.quiet=!0;try{let s;try{s=await K({env:o})`doppler secrets download --no-file --format json --project ${e} --config ${t}`.timeout(lt)}catch(c){throw ft(c,e,t)}mt(s.stdout);let i=vt(s.stdout);return dt(i,t),i}finally{K.quiet=n}},dt=(e,t)=>{let r=e.find(([o])=>o===tt)?.[1];if(!(r===void 0||r===t))throw new v(t,null,`Doppler returned secrets for config "${r}" but "${t}" was requested \u2014 the service token for env "${t}" is scoped to the wrong config. Refusing to load another environment's secrets.
+`,384),L(H,i,384),{filePath:H,variableCount:o.length,project:t,config:e}},De=J(),at=async e=>{let{config:t}=e,r=t?null:await _();if(!t&&r&&x())return Z(r,"default");if(await ye({provider:De,params:e,operation:"env-load",argument:"config"}),t)return Z(t,"argument");if(b())throw new m({status:"argument_required",argument:"config",agentMode:f.source},2,{operation:"env-load",remediation:'call env-list, ask the human which environment, and re-call env-load with "config"'});let o=await W();N.setInteractive();let n=await ie(s=>Ye({message:"Select environment config",choices:ct(o,r),...r?{default:r}:{}},s),{output:C.stderr,whenHeadless:"refuse"});return Z(n,"picker")},ct=(e,t)=>(t&&!e.includes(t)?[t,...e]:e).map(o=>({name:o===t?`${o} (default)`:o,value:o})),Z=async(e,t)=>{N.addOption("--config",e);let r=await it({config:e});N.print();let o={filePath:r.filePath,variableCount:r.variableCount,project:r.project,config:r.config,configSource:t,sessionId:C.env[P]??null};return{content:F(JSON.stringify(o,null,2)),structuredContent:o}},Ae=1024*1024,lt=3e4,pt=["DOPPLER_TOKEN","DOPPLER_PROJECT","DOPPLER_CONFIG"],ut=(e,t=C.env)=>{let r={...t};for(let o of pt)delete r[o];return r.DOPPLER_TOKEN=e,r},io=async e=>new Map(await Re(await h(),e)),Re=async(e,t)=>{let{token:r}=await V(t),o=ut(r),n=K.quiet;K.quiet=!0;try{let s;try{s=await K({env:o})`doppler secrets download --no-file --format json --project ${e} --config ${t}`.timeout(lt)}catch(c){throw ft(c,e,t)}mt(s.stdout);let i=vt(s.stdout);return dt(i,t),i}finally{K.quiet=n}},dt=(e,t)=>{let r=e.find(([o])=>o===tt)?.[1];if(!(r===void 0||r===t))throw new v(t,null,`Doppler returned secrets for config "${r}" but "${t}" was requested \u2014 the service token for env "${t}" is scoped to the wrong config. Refusing to load another environment's secrets.
 Fix: run \`infra-kit env-token-set ${t}\` with a token scoped to "${t}".`)},ft=(e,t,r)=>{let o=S(e)??(e instanceof Error?e.message:String(e)),n=D(o);return n==="auth"?new v(r,R(o)):n==="unknown"?e instanceof Error?e:new Error(String(e)):new Error(M({kind:n,project:t,config:r,available:null}))},mt=e=>{let t=Xe.byteLength(e,"utf-8");if(t>Ae)throw new Error(`doppler returned unexpectedly large output (${t} bytes > ${Ae}) \u2014 refusing to write to disk`)},T=e=>`'${e.replaceAll("'","'\\''")}'`,gt=/^[A-Z_]\w*$/i,vt=e=>{let t;try{t=JSON.parse(e)}catch{throw new Error(`doppler returned non-JSON output for env-load (got: ${JSON.stringify(e.slice(0,80))})`)}if(t===null||typeof t!="object"||Array.isArray(t))throw new Error("doppler returned unexpected JSON shape for env-load (expected an object of KEY: value pairs)");let r=[];for(let[o,n]of Object.entries(t)){if(!gt.test(o))throw new Error(`doppler returned an invalid env var name for env-load (got: ${JSON.stringify(o.slice(0,80))})`);if(typeof n!="string")throw new TypeError(`doppler returned a non-string value for "${o}" (got ${typeof n})`);r.push([o,n])}if(r.length===0)throw new Error("doppler returned empty output for env-load");return r},ao=I({name:"env-load",description:'Download the env vars for a Doppler config and write them to a temporary shell script. Does NOT mutate the calling process \u2014 returns the path to a script that must be sourced ("source <filePath>") for the vars to take effect. The infra-kit shell wrapper auto-sources; direct MCP callers must handle sourcing themselves or surface filePath to the user. This server picks the file up on its next tool call, so a tool that needs the variables can be called right after. Omit "config" and this server offers the human a form listing every environment env-list knows, token-less ones marked; a client that cannot render one gets a refusal naming the missing field \u2014 call env-list and ask the human, never guess. When the project config sets "defaultEnv", omitting "config" headless loads that environment instead of refusing, and "configSource" reports "default".',inputSchema:{config:d.string().optional().describe('Doppler config / environment name to load (e.g. "dev", "arthur"). Omit it to load the configured "defaultEnv", or, with none set, to have the human choose from a form.')},formProvider:De,outputSchema:{filePath:d.string().describe("Path to the file that must be sourced to apply variables"),variableCount:d.number().describe("Number of variables loaded"),project:d.string().describe("Doppler project name"),config:d.string().describe("Doppler config name"),configSource:d.enum(["argument","default","picker"]).describe('How the config was chosen: passed as "config", the configured "defaultEnv", or the terminal picker'),sessionId:d.string().nullable().describe("The INFRA_KIT_SESSION the file was written for; null when the process had no session")},handler:at});export{F as a,I as b,D as c,R as d,h as e,Oe as f,l as g,V as h,ue as i,w as j,Ke as k,Ce as l,Le as m,Me as n,Ve as o,qe as p,y as q,W as r,he as s,Ze as t,ye as u,ot as v,st as w,it as x,at as y,ct as z,Ae as A,ut as B,io as C,dt as D,ft as E,mt as F,T as G,vt as H,ao as I};
-//# sourceMappingURL=chunk-QCTAEXMN.js.map
+//# sourceMappingURL=chunk-YVIJUGOB.js.map