infra-kit 0.34.0 → 0.36.0

package/dist/chunk-XES5EOEE.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/dev/proxy/portless-link.ts", "../src/dev/proxy/portless-driver.ts", "../src/lib/shell-quote/shell-quote.ts", "../src/dev/proxy/portless-node.ts"],
-  "sourcesContent": ["/**\n * @fileoverview\n *\n * `~/.infra-kit/portless` \u2014 a stable symlink to the portless PACKAGE directory bundled with the running\n * infra-kit, kept pointing at the current install by every process boot.\n *\n * Why it exists: `portless service install` bakes `process.execPath` and `process.argv[1]` verbatim into\n * the root launchd plist (`ProgramArguments`), and it offers no `--entry` flag to say otherwise. Under\n * pnpm 12 the script half of that pair is version-unstable \u2014 every `pnpm add -g infra-kit@x` mints a\n * fresh `global/v11/{pid}-{timestamp}/` project and removes the previous one, and the path also embeds\n * `infra-kit@<version>`. With silent auto-update on, the daemon's argv dangles after every release,\n * launchd cannot start it at the next boot, and the \"fix\" is another sudo. Node does NOT realpath\n * `argv[1]` (it keeps whatever string it was given) but DOES realpath `execPath`, so only the script half\n * can be made stable: point the plist at `<link>/dist/cli.js` and keep the link current.\n *\n * Why tmp + rename, never unlink first: `rename(2)` replaces a symlink atomically, so there is no\n * instant at which the path is absent. An unlink-then-symlink sequence has one \u2014 and a reboot inside it\n * leaves launchd with no script at all; `KeepAlive` retries the same dangling path forever, and `:443`\n * stays dark until a human runs `service install` again.\n *\n * Why the boot call must run on `version --json`: that is the exact invocation the background updater\n * spawns to verify a fresh install (`run-update-check.ts`, `readInstalledVersion`: `cwd = homedir()`,\n * `--json`, piped stdio). It is the FIRST process the new binary ever runs \u2014 and the one that re-points\n * the link after an auto-update, before any shell command does. So `bootPortlessLink` must not sit\n * behind `warnIfLocalInstall`'s `--json` guard, and it must not have an env opt-out: the link is state,\n * not advisory output.\n *\n * Every write is guarded by `isGlobalInstall`: a checkout or a project-local dependency never aims the\n * root daemon at itself (that would dangle the moment the worktree is removed). Nothing here spawns a\n * subprocess, touches stdout, or throws \u2014 the `ik-mcp` proxy calls it at boot with stdout carrying the\n * JSON-RPC transport, and the CLI calls it before Commander parses argv.\n */\nimport fs from 'node:fs'\nimport { homedir } from 'node:os'\nimport { dirname, join } from 'node:path'\nimport process from 'node:process'\nimport { fileURLToPath } from 'node:url'\n\nimport { USER_CONFIG_DIR_NAME } from 'src/lib/constants'\nimport { isGlobalInstall, safeRealpath } from 'src/lib/install-manager'\n\nimport { formatPortlessCommand, resolvePortlessBin } from './portless-driver'\nimport type { ExistsCheck } from './portless-driver'\nimport { ensurePortlessNode, stableNodeCandidate } from './portless-node'\nimport type { EnsurePortlessNodeDeps, PortlessNodeResult } from './portless-node'\n\n/** `<home>/.infra-kit/portless` \u2014 the link path; the same `home` seam the rest of the config layer uses. */\nexport const portlessLinkPath = (home: string): string => {\n  return join(home, USER_CONFIG_DIR_NAME, 'portless')\n}\n\n/**\n * `<link>/dist/cli.js` when the link resolves to a portless with that file, else `null` \u2014 the path the\n * printed `service install` command (and the plist it writes) should carry. `exists` follows the\n * symlink, so a dangling link answers `null` and callers fall back to the real path.\n */\nexport const portlessLinkCliPath = (\n  home: string,\n  exists: (target: string) => boolean = fs.existsSync,\n): string | null => {\n  const cliPath = join(portlessLinkPath(home), 'dist', 'cli.js')\n\n  return exists(cliPath) ? cliPath : null\n}\n\n/** Where the link is looked up and which node to print; every seam is injectable so tests never read a real `~/.infra-kit`. */\nexport interface ServiceInstallSeams {\n  home: string\n  exists?: ExistsCheck\n  execPath?: string\n  /**\n   * `~/.infra-kit/node` as a health verdict: a string is \"resolved and healthy \u2014 render through it\"\n   * (doctor/setup after their node row), `null` is \"resolved and unhealthy or absent \u2014 render through\n   * `execPath`, the node that provably runs\", `undefined` is \"not resolved\" and the inode-only candidate\n   * is checked here instead (`dev`, which never spawns on its hot path).\n   */\n  stableNode?: string | null\n}\n\n/**\n * The one-time, out-of-band, ROOT command that installs the `:443` daemon. infra-kit never runs it \u2014 it\n * only ever prints it (principle 3: infra-kit probes and prints, it never elevates). `doctor`, `setup`\n * and `dev` all print it from here so no two surfaces can disagree about the path that ends up as root.\n *\n * Rendered THROUGH `~/.infra-kit/portless/dist/cli.js` whenever that link resolves: portless bakes the\n * script path it was invoked with into the plist, so the command printed here decides whether the root\n * daemon survives the next `pnpm add -g infra-kit` (the link is re-pointed on every boot; the version-\n * specific path is deleted). `bin` \u2014 the resolved `dist/cli.js`, never a bare `portless` (see\n * {@link formatPortlessCommand}) \u2014 is the fallback only, for a machine where nothing has created the\n * link yet.\n */\nexport const serviceInstallCommand = (bin: string, seams: ServiceInstallSeams): string => {\n  // Resolved before the candidate check: `dev` passes `{ home }` only, and the candidate must never stat `undefined`.\n  const execPath = seams.execPath ?? process.execPath\n  // Written out rather than `??`-chained: a `null` verdict (\"resolved, unhealthy\") must reach `execPath`\n  // directly and never fall through to a candidate check that would contradict doctor's spawn.\n  const stableNode =\n    seams.stableNode === undefined ? stableNodeCandidate({ home: seams.home, execPath }) : seams.stableNode\n\n  return formatPortlessCommand(['service', 'install'], {\n    sudo: true,\n    bin: portlessLinkCliPath(seams.home, seams.exists) ?? bin,\n    execPath: stableNode ?? execPath,\n  })\n}\n\nexport type PortlessLinkOutcome =\n  'created' | 'repointed' | 'unchanged' | 'skipped-local' | 'skipped-unresolved' | 'failed'\n\nexport interface PortlessLinkResult {\n  kind: 'link'\n  outcome: PortlessLinkOutcome\n  /** The portless package dir the link should point at; `null` only for `'skipped-unresolved'`. */\n  target: string | null\n  link: string\n}\n\n/**\n * The six fs calls the link needs, as an OBJECT seam. Named `node:fs` imports cannot be intercepted by\n * `vi.spyOn` (the binding is a live import, not a property), so the default export is the injectable\n * shape and tests hand in an in-memory fake instead of touching a real `~/.infra-kit`.\n */\nexport interface PortlessLinkFs {\n  mkdirSync: (dir: string, options: { recursive: true }) => unknown\n  lstatSync: (target: string, options: { throwIfNoEntry: false }) => { isSymbolicLink: () => boolean } | undefined\n  readlinkSync: (target: string) => string\n  symlinkSync: (target: string, linkPath: string) => void\n  renameSync: (from: string, to: string) => void\n  unlinkSync: (target: string) => void\n}\n\nexport interface EnsurePortlessLinkDeps {\n  /** `resolvePortlessBin` \u2014 the bundled portless's `dist/cli.js`, or `null` when it is not installed. */\n  resolveBin: () => string | null\n  /** `isGlobalInstall` bound to this process \u2014 the ONLY gate between a checkout and the root daemon. */\n  isGlobal: () => boolean\n  home: string\n  fs?: PortlessLinkFs\n}\n\n/** What currently sits at the link path, beyond \"a symlink to X\". */\nconst ABSENT = Symbol('absent')\nconst NOT_A_SYMLINK = Symbol('not-a-symlink')\n\nconst readCurrentLink = (link: string, linkFs: PortlessLinkFs): string | typeof ABSENT | typeof NOT_A_SYMLINK => {\n  const stat = linkFs.lstatSync(link, { throwIfNoEntry: false })\n\n  if (stat === undefined) return ABSENT\n  if (!stat.isSymbolicLink()) return NOT_A_SYMLINK\n\n  return linkFs.readlinkSync(link)\n}\n\n/**\n * Publish `target` at `link` through a pid-suffixed sibling and one `rename`, so the path never goes\n * absent (see the file header). The sibling is cleared BEFORE the symlink as well as after a failed\n * rename: a crash between the two calls leaves `.tmp-<pid>` behind forever, and pid reuse would then\n * turn a later boot's `symlinkSync` into EEXIST \u2014 a `'failed'` for a link that is fine. The name is\n * ours alone, never user data, so removing whatever sits there is safe; `ENOENT` is the normal case.\n */\nconst writeLink = (target: string, link: string, linkFs: PortlessLinkFs): void => {\n  const tmp = `${link}.tmp-${process.pid}`\n\n  try {\n    linkFs.unlinkSync(tmp)\n  } catch {\n    // Nothing to clear \u2014 the ordinary path.\n  }\n\n  linkFs.symlinkSync(target, tmp)\n\n  try {\n    linkFs.renameSync(tmp, link)\n  } catch (error) {\n    try {\n      linkFs.unlinkSync(tmp)\n    } catch {\n      // Best effort: the failed rename is the error worth surfacing, not the leftover sibling.\n    }\n\n    throw error\n  }\n}\n\n/**\n * Converge `~/.infra-kit/portless` on the portless bundled with THIS install. Never throws; every\n * outcome is a value so callers can log it without a try/catch of their own.\n *\n * A non-symlink at the link path is `'failed'` and left exactly as found: this code owns a symlink, not\n * whatever a user or another tool put there, and removing a directory to make room would be the one\n * destructive action a boot hook must never take.\n *\n * @example\n * ensurePortlessLink({ resolveBin: () => '/g/node_modules/portless/dist/cli.js', isGlobal: () => true, home: '/Users/x' })\n * // => { kind: 'link', outcome: 'created', target: '/g/node_modules/portless', link: '/Users/x/.infra-kit/portless' }\n */\nexport const ensurePortlessLink = (deps: EnsurePortlessLinkDeps): PortlessLinkResult => {\n  const { resolveBin, isGlobal, home, fs: linkFs = fs } = deps\n  const link = portlessLinkPath(home)\n  const bin = resolveBin()\n\n  if (bin === null) return { kind: 'link', outcome: 'skipped-unresolved', target: null, link }\n\n  const target = dirname(dirname(bin))\n\n  if (!isGlobal()) return { kind: 'link', outcome: 'skipped-local', target, link }\n\n  try {\n    linkFs.mkdirSync(dirname(link), { recursive: true })\n\n    const current = readCurrentLink(link, linkFs)\n\n    if (current === target) return { kind: 'link', outcome: 'unchanged', target, link }\n    if (current === NOT_A_SYMLINK) return { kind: 'link', outcome: 'failed', target, link }\n\n    writeLink(target, link, linkFs)\n\n    return { kind: 'link', outcome: current === ABSENT ? 'created' : 'repointed', target, link }\n  } catch {\n    return { kind: 'link', outcome: 'failed', target, link }\n  }\n}\n\n/**\n * `(fields, message)` \u2014 the shape of `logger.debug`, so the CLI can pass it straight through. The two\n * boot results are a union on `kind`: a caller that reads `link`/`target` (the `ik-mcp` stderr line)\n * narrows first.\n */\nexport type PortlessLinkLog = (result: PortlessLinkResult | PortlessNodeResult, message: string) => void\n\n/** The link's seams and the node's, sharing ONE `isGlobal` \u2014 the two are converged together at every boot. */\nexport interface PortlessStableDeps {\n  link: EnsurePortlessLinkDeps\n  node: EnsurePortlessNodeDeps\n}\n\n/**\n * The real seams. Shared with `setup`, which needs the RESULTS back to report its steps, so the writers\n * can never disagree about which install is \"global\" or where the files go. `isGlobal` is memoised\n * per deps object: it costs a `realpathSync` plus the `.git` walk, and both steps ask it.\n */\nexport const realPortlessStableDeps = (): PortlessStableDeps => {\n  const home = homedir()\n  let global: boolean | undefined\n\n  const isGlobal = (): boolean => {\n    global ??= isGlobalInstall({\n      selfRealPath: fs.realpathSync(fileURLToPath(import.meta.url)),\n      env: process.env,\n      realpath: safeRealpath,\n      home,\n      exists: fs.existsSync,\n    })\n\n    return global\n  }\n\n  return {\n    link: { resolveBin: resolvePortlessBin, isGlobal, home },\n    node: {\n      isGlobal,\n      home,\n      execPath: process.execPath,\n      version: process.version,\n      arch: process.arch,\n      platform: process.platform,\n    },\n  }\n}\n\nconst logStep = (log: PortlessLinkLog, message: string, run: () => PortlessLinkResult | PortlessNodeResult): void => {\n  try {\n    log(run(), message)\n  } catch {\n    // A file that could not be converged is `doctor`'s to report; it must never be a boot failure.\n  }\n}\n\n/**\n * The process-boot entry for both bins: the link, then the node \u2014 independent state, so the node step\n * runs whatever the link reported. fs-only, no subprocess, never throws, never exits, never writes to\n * stdout; each outcome goes to `log` and nowhere else. `deps` is injectable so the \"`'failed'` is\n * logged\" contract is testable without a real disk.\n */\nexport const bootPortlessLink = (log: PortlessLinkLog, deps?: PortlessStableDeps): void => {\n  const stable = deps ?? realPortlessStableDeps()\n\n  logStep(log, 'portless link', () => {\n    return ensurePortlessLink(stable.link)\n  })\n  logStep(log, 'portless node', () => {\n    return ensurePortlessNode(stable.node)\n  })\n}\n", "/**\n * @fileoverview\n *\n * Thin, injectable driver for the `portless` daemon (Layer B \u2014 see `.omc/plans/dev-https-portless.md`).\n *\n * `infra-kit dev` uses it to register `<release>.<package>.<repo>.localhost \u2192 127.0.0.1:<port>` routes so the\n * hero URLs resolve over **HTTPS on :443, with no port in the URL**. Every call here is **time-bounded and\n * never throws**: a missing binary, a non-zero exit, or a wedged process resolves to `false`/no-op. That is\n * a reporting contract, not a tolerance one \u2014 portless IS a hard dependency of the dev loop, and\n * `DevServerRunner.ensureProxy` turns a `false` from this driver into a fatal, actionable start error.\n *\n * The binary is NOT resolved from `PATH`: `portless` is a normal npm dependency living in\n * `node_modules/.bin`, which is on `PATH` only when the process was launched via pnpm/npm. Since\n * `infra-kit dev` is often launched otherwise (a global bin, an Orca pane, a foreign cwd), we resolve\n * portless's own `dist/cli.js` by walking `node_modules` from this file (see {@link resolvePortlessBin})\n * and run it with the current `node` (`process.execPath`) \u2014 so it works regardless of how `dev` was\n * invoked. Args are fixed literals plus discovered release/package names + a numeric port, never\n * shell-interpolated.\n *\n * **The daemon is PROBED, never started.** `:443` is privileged, and portless binds it by re-execing\n * itself through `sudo` with an inherited stdio \u2014 which a detached `stdio:'ignore'` child can never\n * satisfy: the password prompt has nowhere to go. Setup is one-time and out-of-band: a root\n * `portless service install`, printed for the user by {@link formatPortlessCommand} (never as a bare\n * `portless`, which no shell can resolve \u2014 see there).\n *\n * All process I/O is injected (`run` for awaited commands, `isProxyServing` for the wire probe) so tests\n * never shell out and can assert the exact portless argv.\n */\nimport type { Buffer } from 'node:buffer'\nimport { execFile } from 'node:child_process'\nimport { createHash } from 'node:crypto'\nimport { existsSync, readFileSync } from 'node:fs'\nimport http from 'node:http'\nimport https from 'node:https'\nimport net from 'node:net'\nimport { homedir } from 'node:os'\nimport { dirname, join } from 'node:path'\nimport process from 'node:process'\nimport tls from 'node:tls'\nimport { fileURLToPath } from 'node:url'\nimport { promisify } from 'node:util'\n\nimport { withoutPackageManagerEnv } from 'src/lib/pm-env'\nimport { shellLine } from 'src/lib/shell-quote'\n\nconst execFileAsync = promisify(execFile)\n\n/** Read `bin.portless` (the `dist/cli.js` relative path) from a portless `package.json` on disk. */\nconst readBinRel = (pkgJsonPath: string): string | null => {\n  const pkg = JSON.parse(readFileSync(pkgJsonPath, 'utf-8')) as { bin?: string | Record<string, string> }\n  const rel = typeof pkg.bin === 'string' ? pkg.bin : pkg.bin?.portless\n\n  return rel == null || rel === '' ? null : rel\n}\n\n/**\n * Resolve the absolute path to portless's CLI entry (`portless/dist/cli.js`) from node_modules,\n * independent of `PATH`. Returns `null` when portless is not installed, degrading the whole driver to\n * a no-op.\n *\n * portless is ESM-only (its `.` export exposes only `import`/`types`, no `require`), so\n * `createRequire().resolve` can't see it. We instead walk `node_modules` upward from this file \u2014 the\n * standard resolution path \u2014 and read the package's `package.json` straight off disk, which bypasses the\n * exports map that would otherwise hide both `package.json` and the main entry.\n */\nexport const resolvePortlessBin = (): string | null => {\n  try {\n    let dir = dirname(fileURLToPath(import.meta.url))\n\n    for (;;) {\n      const pkgJsonPath = join(dir, 'node_modules', 'portless', 'package.json')\n\n      if (existsSync(pkgJsonPath)) {\n        const rel = readBinRel(pkgJsonPath)\n\n        return rel == null ? null : join(dirname(pkgJsonPath), rel)\n      }\n      const parent = dirname(dir)\n\n      if (parent === dir) return null\n      dir = parent\n    }\n  } catch {\n    return null\n  }\n}\n\n/** Resolve portless's CLI once per process \u2014 the on-disk location never changes within a run. */\nlet cachedBin: string | null | undefined\nconst portlessBin = (): string | null => {\n  if (cachedBin === undefined) cachedBin = resolvePortlessBin()\n\n  return cachedBin\n}\n\n/** Seams for {@link formatPortlessCommand}, injected so tests never depend on the real node_modules layout. */\nexport interface FormatPortlessCommandOptions {\n  /**\n   * Absolute path to portless's `dist/cli.js`. **Required and non-nullable on purpose.** The caller must\n   * have resolved portless before it can describe how to run it, so \"I could not find the binary\" cannot be\n   * silently rendered as a plausible-looking command \u2014 the type makes that unwritable rather than merely\n   * discouraged. A `null` bin is a different report (\"run `pnpm install`\"), which every caller makes first.\n   */\n  bin: string\n  /** Prefix with `sudo` \u2014 only `service install`, which binds the privileged `:443`, needs it. */\n  sudo?: boolean\n  execPath?: string\n}\n\n/**\n * Render a portless command the user can actually paste into a shell.\n *\n * Prints what the driver itself runs (see {@link defaultRun}): the current interpreter, by absolute path,\n * invoking portless's `dist/cli.js`, by absolute path. Nothing is resolved from `PATH`, so the command\n * works under `sudo`, from any cwd, and however `infra-kit` was launched.\n *\n * @example\n * formatPortlessCommand(['service', 'install'], { sudo: true, bin })\n * // 'sudo /usr/local/bin/node /repo/node_modules/portless/dist/cli.js service install'\n */\n// This exists because the obvious string is a lie. `portless` is a plain npm dependency living in\n// `node_modules/.bin`, which is on `PATH` only inside a pnpm/npm script \u2014 so printing `sudo portless\n// service install` hands the user a command that dies with `sudo: portless: command not found`. `sudo`\n// makes it strictly worse: it replaces `PATH` with `secure_path`, so even a shell that *could* resolve\n// `portless` loses it the moment the command is elevated.\n//\n// This is not merely cosmetic. portless's `service install` writes the interpreter and script path it was\n// invoked with straight into the launchd plist's `ProgramArguments` (`nodePath: process.execPath` plus\n// `process.argv[1]`), so the command printed here is the command that gets installed as a ROOT SYSTEM\n// DAEMON. Printing a name for the shell to resolve would not just fail \u2014 it would decide what runs as\n// root.\nexport const formatPortlessCommand = (args: string[], options: FormatPortlessCommandOptions): string => {\n  const words = [options.execPath ?? process.execPath, options.bin, ...args]\n  const prefix = options.sudo === true ? 'sudo ' : ''\n\n  return prefix + shellLine(words)\n}\n\n/** Awaited portless invocation. Rejects on non-zero exit / timeout; the driver swallows that into a no-op. */\nexport type PortlessRun = (args: string[], opts: { timeoutMs: number }) => Promise<void>\n\n/** Cheap \"is anything at all accepting TCP here?\" pre-filter in front of the wire probe. */\nexport type IsListening = (port: number) => Promise<boolean>\n\n/**\n * Ground-truth identity: is the process serving `port` actually **portless**, and (when `tls`) is it\n * serving **TLS**? See {@link defaultIsProxyServing} for why this cannot be answered from state files.\n */\nexport type IsProxyServing = (port: number, tls: boolean) => Promise<boolean>\n\nconst DEFAULT_TIMEOUT_MS = 1500\nconst PROBE_TIMEOUT_MS = 1500\n\n/** Response header portless sets on every response it serves. Node lower-cases response header names. */\nconst PORTLESS_HEADER = 'x-portless'\n\n/** IPv4 loopback: portless binds and dials `127.0.0.1`. */\nconst LOOPBACK = '127.0.0.1'\n\n/**\n * SNI for the probe. Node sends **no SNI to an IP literal** (RFC 6066), which would drop portless onto its\n * default certificate \u2014 whose SANs are `localhost`, `*.localhost`, `*.local` and contain **no IP entry**.\n * `localhost` is always in that set, so it is the one name guaranteed to work even on a machine with zero\n * aliases registered.\n */\nconst PROBE_SERVERNAME = 'localhost'\n\n/**\n * Whether portless's OS-level service (the thing `service install` registers) is present on disk.\n * `'unknown'` on a platform this check does not cover (currently anything but macOS/Linux) \u2014 a caller must\n * never read `'unknown'` as `'no'`, since doing so would tell an already-provisioned Windows machine to\n * reinstall.\n */\nexport type ServiceInstalled = 'yes' | 'no' | 'unknown'\n\n/**\n * portless's launchd service label (`sh.portless.proxy`, hard-coded in portless's own CLI) and the two\n * fixed paths its `service install`/`uninstall` write to on macOS and Linux. These are read-only constants\n * of portless's OWN implementation, not ours \u2014 see `dist/cli.js`'s `SERVICE_LABEL`/`buildServiceSpec`. There\n * is no per-user or per-project variant: `service install` always targets exactly one of these two paths.\n * Exported so a test can assert against the exact path this check reads, without hard-coding a second copy.\n */\nexport const DARWIN_SERVICE_LABEL = 'sh.portless.proxy'\nexport const DARWIN_SERVICE_PLIST_PATH = `/Library/LaunchDaemons/${DARWIN_SERVICE_LABEL}.plist`\nexport const LINUX_SERVICE_UNIT_PATH = '/etc/systemd/system/portless.service'\n/** The systemd unit name `service install` registers on Linux \u2014 the `systemctl` argument, not a path. */\nexport const LINUX_SERVICE_UNIT_NAME = 'portless'\n\n/** The `existsSync` seam {@link defaultIsServiceInstalled} takes, injected so tests never touch real root paths. */\nexport type ExistsCheck = (path: string) => boolean\n\n/**\n * Cheap, synchronous, never-throwing check for whether portless's OS service is registered \u2014 a plain\n * `existsSync` on the fixed path `service install` writes to, never a `launchctl`/`systemctl` shell-out. This\n * is what lets {@link createPortlessDriver}'s daemon-down classification tell \"never installed\" apart from\n * \"installed, but not currently answering\" without adding a second process spawn to every failed probe.\n *\n * Deliberately does not attempt Windows detection (a Task Scheduler task, which needs `schtasks` to query) \u2014\n * `'unknown'` there is honest; a guessed `'no'` would send an already-provisioned machine back through\n * `service install` for no reason.\n *\n * `exists` defaults to the real `existsSync` but is a normal parameter (not a named-import spy target) so a\n * test can assert both branches without touching `/Library/LaunchDaemons` \u2014 a root-owned path a dev machine\n * may genuinely have populated, which would make an un-injected assertion true or false depending on the\n * author's own machine state rather than the code under test.\n */\nexport const defaultIsServiceInstalled = (exists: ExistsCheck = existsSync): ServiceInstalled => {\n  try {\n    if (process.platform === 'darwin') return exists(DARWIN_SERVICE_PLIST_PATH) ? 'yes' : 'no'\n    if (process.platform === 'linux') return exists(LINUX_SERVICE_UNIT_PATH) ? 'yes' : 'no'\n\n    return 'unknown'\n  } catch {\n    return 'unknown'\n  }\n}\n\n/**\n * Fine-grained outcome of probing the proxy port, distinguishing the two ways \"not serving\" happens so\n * {@link createPortlessDriver}'s caller can print a distinct, actionable fix for each:\n *  - `'serving'` \u2014 portless answered on the wire (the old boolean `true`).\n *  - `'daemon-down'` \u2014 nothing is even accepting TCP on the port (refused). Combined with\n *    {@link ServiceInstalled} this splits into \"never installed\" vs \"installed but crashed/stopped\".\n *  - `'not-portless'` \u2014 something IS listening, but it did not answer with `X-Portless: 1` \u2014 a squatter has\n *    the port, and installing/trusting portless will not free it.\n */\nexport type ProxyProbeOutcome = 'serving' | 'daemon-down' | 'not-portless'\n\nexport const defaultIsListening: IsListening = (port) => {\n  return new Promise((resolve) => {\n    const socket = net.connect({ host: LOOPBACK, port })\n    const finish = (result: boolean): void => {\n      socket.destroy()\n      resolve(result)\n    }\n\n    socket.setTimeout(PROBE_TIMEOUT_MS)\n    socket.once('connect', () => {\n      finish(true)\n    })\n    socket.once('timeout', () => {\n      finish(false)\n    })\n    socket.once('error', () => {\n      finish(false)\n    })\n  })\n}\n\n/**\n * Is the listener on `port` portless itself, serving `tls`? Proven **on the wire**, by asking it: portless\n * sets `X-Portless: 1` on every response, before route lookup \u2014 so an unrouted host still answers the probe\n * (a 404 with the header is a pass). This mirrors portless's own `isProxyRunning`.\n *\n * `rejectUnauthorized: false` is deliberate and load-bearing: this probe answers *\"is portless serving\n * here?\"*, **never** *\"is its CA trusted?\"*. Trust is a separate, explicitly-validating probe (doctor's\n * CA check).\n */\n// This replaces the old state-file check (`proxy.port` + `proxy.pid`), which was UNSOUND: portless's\n// `resolveStateDir(_port)` ignores its port argument, so `proxy.port` / `proxy.pid` / `proxy.tls` are\n// process-global singletons shared by every daemon on every port. Starting ANY daemon rewrites them, and\n// stopping ANY daemon DELETES them \u2014 so a second, unrelated daemon (or a stale sibling repo still on the\n// old CLI, falling back to an unprivileged port) makes a perfectly healthy `:443` daemon look dead. Both\n// were reproduced against portless 0.15.1; see `.omc/research/portless-https-spike.md`.\n//\n// Validating the chain here would collapse two different failures \u2014 a daemon that is down, and a CA that\n// was never trusted \u2014 into one indistinguishable error, with two different fixes (a root `service install`\n// vs the sudo-free `trust`).\nexport const defaultIsProxyServing: IsProxyServing = (port, tls) => {\n  return new Promise((resolve) => {\n    const request = tls ? https.request : http.request\n    const req = request(\n      {\n        host: LOOPBACK,\n        port,\n        method: 'HEAD',\n        path: '/',\n        timeout: PROBE_TIMEOUT_MS,\n        ...(tls ? { rejectUnauthorized: false, servername: PROBE_SERVERNAME } : {}),\n      },\n      (res) => {\n        res.resume()\n        resolve(res.headers[PORTLESS_HEADER] === '1')\n      },\n    )\n\n    req.on('error', () => {\n      resolve(false)\n    })\n    req.on('timeout', () => {\n      req.destroy()\n      resolve(false)\n    })\n    req.end()\n  })\n}\n\nconst defaultRun: PortlessRun = async (args, { timeoutMs }) => {\n  const bin = portlessBin()\n\n  if (bin == null) throw new Error('portless is not installed (not resolvable from node_modules)')\n  await execFileAsync(process.execPath, [bin, ...args], {\n    signal: AbortSignal.timeout(timeoutMs),\n    encoding: 'utf-8',\n    env: withoutPackageManagerEnv(process.env),\n  })\n}\n\n/**\n * portless's state directory. Exported so `doctor` reports on the same directory the driver reads.\n *\n * The default is deliberately **unchanged** (`~/.portless`): portless's `service install` bakes\n * `PORTLESS_STATE_DIR`, resolved from `SUDO_USER`, into the launchd plist \u2014 so the root daemon reads the\n * invoking user's* home. Pointing this anywhere else by default would manufacture the very split it looks\n * like it prevents.\n */\nexport const portlessStateDir = (): string => {\n  return process.env.PORTLESS_STATE_DIR ?? join(homedir(), '.portless')\n}\n\n/** portless's local CA certificate \u2014 the root every host cert it mints is signed by. */\nconst CA_CERT_FILE = 'ca.pem'\n\n/**\n * Marker portless's `trust` writes: the **hex sha256 of `ca.pem`'s bytes** that was added to the login\n * keychain (`writeTrustMarker` \u2192 `caFingerprint`, `cli.js:78-101`). It records WHICH CA was trusted, so a\n * regenerated CA leaves a marker that no longer matches.\n */\nconst CA_TRUST_MARKER_FILE = 'ca.trusted'\n\n/** A route portless is serving: `<name> \u2192 127.0.0.1:<port>`. */\nexport interface PortlessRoute {\n  /**\n   * The registered hostname (e.g. `2-4.client-api.hulyo-monorepo.localhost`). Usable verbatim as a\n   * `portless alias --remove <name>` argument \u2014 portless strips a trailing TLD off the name it is handed\n   * (`parseHostnames`, `chunk-SD2PIWJU.js:68-79`) \u2014 and as a TLS `servername`.\n   */\n  name: string\n  port: number\n}\n\n/** Absolute path to portless's local CA certificate, in whichever state dir {@link portlessStateDir} names. */\nexport const readCaPath = (): string => {\n  return join(portlessStateDir(), CA_CERT_FILE)\n}\n\n/**\n * Was `portless trust` run for the CA that is on disk right now? Compares `sha256(ca.pem)` against the\n * fingerprint recorded in `ca.trusted`. `false` when either file is missing; never throws.\n *\n * **This proves the marker was written for THIS fingerprint \u2014 not that the keychain still trusts it.** A\n * user who deletes the certificate from Keychain Access by hand leaves the marker behind and gets a false\n * pass here. That residual is accepted (reading the keychain would mean shelling out to `security` on a\n * check that must stay cheap); it is why this is a *separate* check from the chain handshake\n * ({@link handshakeChainsToCa}), which proves what the daemon actually serves.\n */\nexport const caFingerprintMatches = (): boolean => {\n  try {\n    const recorded = readFileSync(join(portlessStateDir(), CA_TRUST_MARKER_FILE), 'utf-8').trim()\n\n    if (recorded === '') return false\n\n    const actual = createHash('sha256').update(readFileSync(readCaPath())).digest('hex')\n\n    return actual === recorded.toLowerCase()\n  } catch {\n    return false\n  }\n}\n\n/** Outcome of {@link handshakeChainsToCa}: `code` is the Node TLS error code, which the caller discriminates on. */\nexport type HandshakeResult = { ok: true } | { ok: false; code: string }\n\n/**\n * Does the certificate served on `port` chain to the CA in `ca.pem`? A **validating** TLS handshake \u2014 the\n * complement of {@link defaultIsProxyServing}, which deliberately does not validate.\n *\n * `servername` is **mandatory and load-bearing**, never optional: Node sends no SNI to an IP literal\n * (RFC 6066), which drops portless onto its default certificate, whose SANs (`localhost`, `*.localhost`,\n * `*.local`) contain **no IP entry** \u2014 so a validating probe of `127.0.0.1` with no `servername` fails with\n * `ERR_TLS_CERT_ALTNAME_INVALID` against a perfectly healthy daemon. Any such code coming back from here is\n * therefore a bug in the CALLER's probe, never a finding about the user's trust store. Passing an\n * unregistered name is safe: portless's SNI callback mints a cert on demand for any servername.\n *\n * Time-bounded; never throws.\n */\nexport const handshakeChainsToCa = (port: number, servername: string): Promise<HandshakeResult> => {\n  return new Promise((resolve) => {\n    let ca: Buffer<ArrayBufferLike>\n\n    try {\n      ca = readFileSync(readCaPath())\n    } catch {\n      resolve({ ok: false, code: 'ENOENT' })\n\n      return\n    }\n\n    const socket = tls.connect({ host: LOOPBACK, port, servername, ca: [ca], rejectUnauthorized: true }, () => {\n      // With `rejectUnauthorized: true` a chain failure normally surfaces as an 'error' event and this\n      // callback never runs; the check is here so a future Node that connects-then-reports can't slip a\n      // rejected chain through as a pass.\n      const authError = socket.authorizationError as NodeJS.ErrnoException | undefined\n      const authorized = socket.authorized\n\n      socket.destroy()\n      resolve(authorized ? { ok: true } : { ok: false, code: authError?.code ?? authError?.message ?? 'UNKNOWN' })\n    })\n\n    socket.setTimeout(PROBE_TIMEOUT_MS)\n    socket.once('timeout', () => {\n      socket.destroy()\n      resolve({ ok: false, code: 'ETIMEDOUT' })\n    })\n    socket.once('error', (err: NodeJS.ErrnoException) => {\n      socket.destroy()\n      resolve({ ok: false, code: err.code ?? 'UNKNOWN' })\n    })\n  })\n}\n\n/**\n * Routes portless currently has registered, read from `routes.json` in {@link portlessStateDir}. `[]` on any\n * failure (absent file, malformed JSON, unexpected shape) \u2014 an unreadable route list is reported as \"no\n * routes\", never as an error, because every caller uses this for diagnostics only.\n */\nexport const listRoutes = (): PortlessRoute[] => {\n  try {\n    const raw: unknown = JSON.parse(readFileSync(join(portlessStateDir(), 'routes.json'), 'utf-8'))\n\n    if (!Array.isArray(raw)) return []\n\n    return raw.flatMap((entry): PortlessRoute[] => {\n      const { hostname, port } = (entry ?? {}) as { hostname?: unknown; port?: unknown }\n\n      if (typeof hostname !== 'string' || hostname === '' || typeof port !== 'number') return []\n\n      return [{ name: hostname, port }]\n    })\n  } catch {\n    return []\n  }\n}\n\nexport interface PortlessDriver {\n  /**\n   * Absolute path to the `dist/cli.js` this driver executes, or `null` when portless is not installed.\n   *\n   * Exposed so a caller rendering a remediation ({@link formatPortlessCommand}) names the binary THIS driver\n   * would run, rather than re-resolving one behind its back \u2014 which, under an injected driver, would print a\n   * fix derived from the real machine instead of the one under test.\n   */\n  binPath: () => string | null\n  /** Resolve (and memoize) whether the `portless` binary is usable. Absent \u2192 every other call no-ops. */\n  isAvailable: () => Promise<boolean>\n  /**\n   * Is a portless daemon serving `port` over `tls`? **Probe only \u2014 this never starts anything.** Binding\n   * the privileged `:443` needs root, and portless's sudo re-exec cannot prompt from a detached child, so\n   * the daemon is installed once, out-of-band (a root `service install`). A `false` here is turned into a\n   * fatal, actionable start error by the caller.\n   */\n  isProxyServing: (port: number, tls: boolean) => Promise<boolean>\n  /**\n   * Same probe as {@link PortlessDriver.isProxyServing}, but reporting WHICH way it failed instead of\n   * collapsing every non-serving case into `false`. `ensureProxy` uses this to print a distinct, actionable\n   * message for \"nothing there\", \"something else is there\", and (combined with {@link isServiceInstalled})\n   * \"installed but not running\" vs \"never installed\". Never starts anything \u2014 probe only, same as above.\n   */\n  probeProxy: (port: number, tls: boolean) => Promise<ProxyProbeOutcome>\n  /**\n   * Is portless's OS-level service (what `service install` registers) present on disk? Cheap, synchronous,\n   * never throws. `'unknown'` on a platform this cannot check \u2014 a caller must not read that as `'no'`.\n   */\n  isServiceInstalled: () => ServiceInstalled\n  /**\n   * Register `<name> \u2192 127.0.0.1:<port>` (`name` = `<release>.<package>.<repo>`). Returns `true` on success so\n   * the caller shows the hero URL only for an alias that actually resolves (best-effort otherwise).\n   */\n  registerAlias: (name: string, port: number) => Promise<boolean>\n  /** Deregister `<name>`. Best-effort. */\n  removeAlias: (name: string) => Promise<void>\n}\n\nexport interface PortlessDriverDeps {\n  /** Override the resolved `dist/cli.js` path (default: the real node_modules walk). Injected in tests. */\n  bin?: string | null\n  run?: PortlessRun\n  /** TCP liveness pre-filter (default: real `net` connect). Injected in tests. */\n  isListening?: IsListening\n  /** Wire-probe identity check (default: real `HEAD /` + `X-Portless`). Injected in tests. */\n  isProxyServing?: IsProxyServing\n  /** OS-service-on-disk check (default: real `existsSync` on the plist/unit path). Injected in tests. */\n  isServiceInstalled?: () => ServiceInstalled\n  timeoutMs?: number\n}\n\n/**\n * Build a {@link PortlessDriver}. Inject `run` in tests to assert argv without shelling out.\n * `isAvailable` memoizes so the binary is probed at most once per runner.\n */\nexport const createPortlessDriver = (deps: PortlessDriverDeps = {}): PortlessDriver => {\n  const bin = deps.bin === undefined ? portlessBin() : deps.bin\n  const run = deps.run ?? defaultRun\n  const isListening = deps.isListening ?? defaultIsListening\n  const isProxyServing = deps.isProxyServing ?? defaultIsProxyServing\n  const isServiceInstalled = deps.isServiceInstalled ?? defaultIsServiceInstalled\n  const timeoutMs = deps.timeoutMs ?? DEFAULT_TIMEOUT_MS\n  let availability: boolean | null = null\n\n  /** Run a portless subcommand, swallowing any failure into `false` (best-effort contract). */\n  const tryRun = async (args: string[]): Promise<boolean> => {\n    try {\n      await run(args, { timeoutMs })\n\n      return true\n    } catch {\n      return false\n    }\n  }\n\n  const isAvailable = async (): Promise<boolean> => {\n    availability ??= await tryRun(['--version'])\n\n    return availability\n  }\n\n  const serving = async (port: number, tls: boolean): Promise<boolean> => {\n    if (!(await isAvailable())) return false\n    // Nothing is even accepting TCP \u2192 skip the (more expensive) wire probe entirely.\n    if (!(await isListening(port))) return false\n\n    return isProxyServing(port, tls)\n  }\n\n  /**\n   * The classifying counterpart of {@link serving}. Deliberately does NOT gate on `isAvailable()` first (unlike\n   * `serving`): a broken/missing CLI binary says nothing about whether a daemon a PRIOR install started is\n   * still up on the wire, so the two are independent facts and the caller (which already checked availability\n   * before ever calling this) must not have that distinction collapsed here.\n   */\n  const probeProxy = async (port: number, tls: boolean): Promise<ProxyProbeOutcome> => {\n    if (!(await isListening(port))) return 'daemon-down'\n\n    return (await isProxyServing(port, tls)) ? 'serving' : 'not-portless'\n  }\n\n  const registerAlias = async (name: string, port: number): Promise<boolean> => {\n    if (!(await isAvailable())) return false\n\n    return tryRun(['alias', name, String(port)])\n  }\n\n  const removeAlias = async (name: string): Promise<void> => {\n    if (!(await isAvailable())) return\n    await tryRun(['alias', '--remove', name])\n  }\n\n  return {\n    binPath: () => {\n      return bin\n    },\n    isAvailable,\n    isProxyServing: serving,\n    probeProxy,\n    isServiceInstalled,\n    registerAlias,\n    removeAlias,\n  }\n}\n", "/**\n * Render an argv array as a line a POSIX shell runs back verbatim.\n *\n * Every surface that PRINTS a command for a human to paste has the same obligation, and `join(' ')` does\n * not meet it. The load-bearing case is `lib/dependency-install`'s refusals: a recipe we decline to run\n * is printed precisely so the human can run it, and joining\n * `['/bin/bash', '-c', 'curl -fsSL \u2026 | bash']` on spaces yields\n * `/bin/bash -c curl -fsSL \u2026 | bash` \u2014 which loses the argument boundary and runs `curl` with `-fsSL`\n * as `$0`, no URL, and the rest piped into a second shell. It fails, and it fails in a way that reads\n * like the tool's fault rather than the transcription's.\n *\n * The implementation began inside `dev/proxy/portless-driver`, which needed it first and is still a\n * caller; a second copy beside the recipes would drift from it.\n */\n\n/**\n * Characters that survive a POSIX shell unquoted. Anything outside this set \u2014 a space, a pipe, a paren,\n * all of which appear in real recipes and real install paths \u2014 gets single-quoted.\n */\nconst SHELL_SAFE = /^[\\w@%+=:,./-]+$/\n\n/** A literal `'` inside single quotes: close, emit an escaped quote, reopen \u2014 the only way a shell allows it. */\nconst SINGLE_QUOTE_ESCAPE = \"'\\\\''\"\n\n/** Single-quote `value` for a POSIX shell unless it is already inert. */\nexport const shellQuote = (value: string): string => {\n  return SHELL_SAFE.test(value) ? value : `'${value.replaceAll(\"'\", SINGLE_QUOTE_ESCAPE)}'`\n}\n\n/** One pasteable shell line from an argv array, each word quoted only when it needs to be. */\nexport const shellLine = (argv: readonly string[]): string => {\n  return argv.map(shellQuote).join(' ')\n}\n", "/**\n * @fileoverview\n *\n * `~/.infra-kit/node` \u2014 a stable, regular-file name for the Node binary the global infra-kit runs, kept\n * current by every process boot beside `~/.infra-kit/portless` (see that module's header for the link).\n *\n * Why a HARDLINK: `portless service install` bakes `process.execPath` into the root plist, and Node\n * realpaths `execPath` (measured: a hardlink of node prints its own path from `-p process.execPath`;\n * a symlink prints the target), so no symlink in front of the binary survives into the plist. Under\n * pnpm 12 the binary lives in `global/v11/{pid}-{ts}/\u2026/node@runtime/\u2026`, a directory every `pnpm add -g`\n * re-mints \u2014 with no Node bump. A hardlink is a regular file, costs 0.3 ms and 0 bytes, and its inode\n * outlives the manager's directory, so the name cannot dangle across a re-mint + reboot the way a\n * symlink would. `copyFile(COPYFILE_FICLONE)` is a full 134 MB copy on APFS here, so it is the FALLBACK\n * only: root-owned `/usr/bin/node` under `protected_hardlinks`, a cross-volume home (macOS answers\n * `EPERM`, not `EXDEV`), exFAT/SMB/NFS (`ENOTSUP`), dataless iCloud (`EDEADLK`) \u2014 the failure set of\n * `link(2)` is not enumerable, so ANY throw takes the copy. The daemon never consults `execPath` again\n * after boot (`proxy start --foreground` spawns nothing), so that one plist word is the whole contract.\n *\n * T-1 \u2014 the hardlink SHARES an inode with the package manager's node, and macOS enforces no `ETXTBSY`:\n * a write through this name lands in the developer's real node and, on Apple Silicon, kills every\n * process mapping it by signature invalidation. Rename-only discipline is the ONLY guard: every byte\n * goes to a `node.tmp-<pid>` sibling and is published by `rename(2)`; the node path is never opened\n * for writing, never chmod'ed (that too mutates the shared inode) and never unlinked. `chmod` runs on\n * the copy branch's tmp alone \u2014 the source is executable already, this process executed it.\n *\n * Staleness is one inode compare against `process.execPath`, never a version or byte compare: after a\n * re-mint the source is a new inode with identical bytes and relinking is free. The sidecar keeps two\n * clocks \u2014 `refreshedAt` (the file) and `versionChangedAt` (the Node behind it, carried over on a\n * same-version relink) \u2014 because doctor's \"daemon predates Node \u2026\" advisory must not nag after every\n * global install. Neither is an fs timestamp: a hardlink's mtime is the source's install time.\n *\n * Same gate and contract as the link: `isGlobalInstall` is the only thing between a checkout and the\n * root daemon; nothing here spawns, writes stdout, or throws.\n */\nimport fs from 'node:fs'\nimport { basename, dirname, join } from 'node:path'\nimport process from 'node:process'\n\nimport { USER_CONFIG_DIR_NAME } from 'src/lib/constants'\n\n/** `<home>/.infra-kit/node` \u2014 the file the plist's first argv word names. */\nexport const portlessNodePath = (home: string): string => {\n  return join(home, USER_CONFIG_DIR_NAME, 'node')\n}\n\n/** `<node>.source.json` \u2014 what the file is (method, Node triple, source) and the two clocks. */\nexport const portlessNodeSidecar = (home: string): string => {\n  return `${portlessNodePath(home)}.source.json`\n}\n\n// Hand-checked, not zod: this module is reached from the `ik-mcp` bundle, which must stay free of every\n// node_modules input (`dist-shebang.test.ts`). A sidecar is eight scalars \u2014 a validator is cheaper than\n// the dependency.\nexport interface PortlessNodeSidecar {\n  method: 'hardlink' | 'copy'\n  version: string\n  arch: string\n  platform: string\n  source: string\n  sourceSize?: number\n  refreshedAt: string\n  versionChangedAt: string\n}\n\nconst isSidecar = (value: unknown): value is PortlessNodeSidecar => {\n  if (typeof value !== 'object' || value === null) return false\n  const record = value as Record<string, unknown>\n  const strings = ['version', 'arch', 'platform', 'source', 'refreshedAt', 'versionChangedAt']\n\n  return (\n    (record.method === 'hardlink' || record.method === 'copy') &&\n    strings.every((key) => {\n      return typeof record[key] === 'string'\n    }) &&\n    (record.sourceSize === undefined || typeof record.sourceSize === 'number')\n  )\n}\n\n/** The subset of `fs.Stats` the inode compare and the copy-path size witness need. */\nexport interface PortlessNodeStat {\n  ino: number\n  dev: number\n  size: number\n  isFile: () => boolean\n}\n\n/**\n * Every fs call the file needs, as an OBJECT seam: `vi.spyOn` cannot intercept named `node:fs` imports,\n * so tests hand in an in-memory fake and the call log \u2014 not the final state \u2014 carries the rename-only\n * contract (T-1). `copyFileSync` takes the mode so the FICLONE flag is visible in that log.\n */\nexport interface PortlessNodeFs {\n  mkdirSync: (dir: string, options: { recursive: true }) => unknown\n  lstatSync: (target: string, options: { throwIfNoEntry: false }) => PortlessNodeStat | undefined\n  statSync: (target: string, options: { throwIfNoEntry: false }) => PortlessNodeStat | undefined\n  readFileSync: (target: string, encoding: 'utf8') => string\n  writeFileSync: (target: string, data: string) => void\n  readdirSync: (dir: string) => string[]\n  linkSync: (existing: string, newPath: string) => void\n  copyFileSync: (src: string, dest: string, mode: number) => void\n  chmodSync: (target: string, mode: number) => void\n  renameSync: (from: string, to: string) => void\n  unlinkSync: (target: string) => void\n}\n\nexport type PortlessNodeOutcome =\n  'created' | 'refreshed' | 'unchanged' | 'skipped-local' | 'skipped-platform' | 'failed'\n\nexport interface PortlessNodeResult {\n  kind: 'node'\n  outcome: PortlessNodeOutcome\n  node: string\n  /** The `execPath` the file was (or would have been) made from. */\n  source: string\n  version: string\n  /** How the file relates to `source`; `null` when nothing was published and nothing converged was found. */\n  method: 'hardlink' | 'copy' | null\n}\n\nexport interface EnsurePortlessNodeDeps {\n  /** The SAME memoised closure the link uses \u2014 the ONLY gate between a checkout and the root daemon. */\n  isGlobal: () => boolean\n  home: string\n  execPath: string\n  version: string\n  arch: string\n  platform: NodeJS.Platform\n  fs?: PortlessNodeFs\n  now?: () => Date\n}\n\n// EXCL is load-bearing, not hygiene: a stale `node.tmp-<pid>` from a boot that died before its `rename`\n// can be a HARDLINK of the live node, and a reused pid would hand the copy branch that name \u2014 an\n// `O_TRUNC` open of it is the T-1 write-through. With EXCL the copy refuses (`EEXIST` \u2192 `'failed'`) and\n// the next boot's sweep clears the name.\nconst COPY_FLAGS = fs.constants.COPYFILE_FICLONE | fs.constants.COPYFILE_EXCL\nconst COPY_MODE = 0o755\n\n/** `null` when the sidecar is absent, unreadable or does not parse \u2014 every one of those forces a refresh. */\nexport const readPortlessNodeSidecar = (home: string, nodeFs: PortlessNodeFs = fs): PortlessNodeSidecar | null => {\n  try {\n    const parsed: unknown = JSON.parse(nodeFs.readFileSync(portlessNodeSidecar(home), 'utf8'))\n\n    return isSidecar(parsed) ? parsed : null\n  } catch {\n    return null\n  }\n}\n\nconst sameInode = (a: PortlessNodeStat, b: PortlessNodeStat): boolean => {\n  return a.ino === b.ino && a.dev === b.dev\n}\n\n/**\n * `<home>/.infra-kit/node` when it is a regular file on the SAME inode as `execPath`, else `null`.\n * Inode equality is proof of runnability \u2014 the asking process IS that inode \u2014 so this needs no sidecar\n * and no spawn, which is what lets `dev` render the short `service install` line on its hot path. A\n * copy-path file is never a candidate: nothing short of running it proves it runs (doctor's job).\n */\nexport const stableNodeCandidate = (input: { home: string; execPath: string; fs?: PortlessNodeFs }): string | null => {\n  const { home, execPath, fs: nodeFs = fs } = input\n  const node = portlessNodePath(home)\n\n  try {\n    const current = nodeFs.lstatSync(node, { throwIfNoEntry: false })\n    const exec = nodeFs.statSync(execPath, { throwIfNoEntry: false })\n\n    if (current === undefined || exec === undefined || !current.isFile()) return null\n\n    return sameInode(current, exec) ? node : null\n  } catch {\n    return null\n  }\n}\n\ntype NodeTriple = Pick<EnsurePortlessNodeDeps, 'version' | 'arch' | 'platform'>\n\nconst describesProcess = (sidecar: PortlessNodeSidecar, deps: NodeTriple): boolean => {\n  return sidecar.version === deps.version && sidecar.arch === deps.arch && sidecar.platform === deps.platform\n}\n\n/**\n * The fast path. Inode equality is the strongest signal for the FILE; the version clause is for the\n * SIDECAR: a crash between the two renames after a Node bump leaves the new inode described as the old\n * version with a pre-bump `versionChangedAt`, and without this clause that would be `'unchanged'` forever\n * (doctor printing the wrong version, the restart advisory keyed on a clock that is too old). On the copy\n * path the inode can never match, so the size is the second witness beside the version triple.\n */\nconst isConverged = (\n  current: PortlessNodeStat,\n  exec: PortlessNodeStat,\n  sidecar: PortlessNodeSidecar,\n  deps: NodeTriple,\n): boolean => {\n  if (!describesProcess(sidecar, deps)) return false\n  if (sameInode(current, exec)) return true\n\n  return sidecar.method === 'copy' && sidecar.sourceSize === exec.size\n}\n\nconst discard = (tmp: string, nodeFs: PortlessNodeFs): void => {\n  try {\n    nodeFs.unlinkSync(tmp)\n  } catch {\n    // Best effort: the failure that got us here is the one worth surfacing, not a leftover sibling.\n  }\n}\n\n/**\n * A SIGKILL mid-copy leaves a 134 MB `node.tmp-<pid>` under a pid that may never recur; the sidecar\n * orphan is ~250 B, but one pass covers both. Only these two prefixes are ours to remove. A concurrent\n * boot's live tmp may go too \u2014 its `rename` then fails into `'failed'` and the next boot converges;\n * the published name always holds a complete file.\n */\nconst sweepOrphans = (dir: string, prefixes: string[], nodeFs: PortlessNodeFs): void => {\n  let names: string[]\n\n  try {\n    names = nodeFs.readdirSync(dir)\n  } catch {\n    return\n  }\n\n  for (const name of names) {\n    const orphan = prefixes.some((prefix) => {\n      return name.startsWith(prefix)\n    })\n\n    if (orphan) discard(join(dir, name), nodeFs)\n  }\n}\n\n/** Hardlink first; on ANY throw, the copy (see the header for why the error set is not filtered). */\nconst stageNode = (execPath: string, tmp: string, nodeFs: PortlessNodeFs): 'hardlink' | 'copy' => {\n  try {\n    nodeFs.linkSync(execPath, tmp)\n\n    return 'hardlink'\n  } catch {\n    nodeFs.copyFileSync(execPath, tmp, COPY_FLAGS)\n    // The copy branch ONLY: on a hardlink this would chmod the manager's inode. 0755 is what the source\n    // carries and what root needs to exec a file under a 0700 home \u2014 no secret lives in a node binary.\n    // eslint-disable-next-line sonarjs/file-permissions -- an executable's mode, not a data file's\n    nodeFs.chmodSync(tmp, COPY_MODE)\n\n    return 'copy'\n  }\n}\n\n/**\n * Stage under the pid-suffixed sibling, publish by ONE `rename` (T-1). The old inode stays mapped by a\n * running daemon; `rename` touches no byte of it. On any throw the sibling is removed and the old file\n * is exactly as it was.\n */\nconst publishNode = (execPath: string, node: string, nodeFs: PortlessNodeFs): 'hardlink' | 'copy' => {\n  const tmp = `${node}.tmp-${process.pid}`\n\n  try {\n    const method = stageNode(execPath, tmp, nodeFs)\n\n    nodeFs.renameSync(tmp, node)\n\n    return method\n  } catch (error) {\n    discard(tmp, nodeFs)\n    throw error\n  }\n}\n\nconst publishSidecar = (sidecarPath: string, sidecar: PortlessNodeSidecar, nodeFs: PortlessNodeFs): void => {\n  const tmp = `${sidecarPath}.tmp-${process.pid}`\n\n  try {\n    nodeFs.writeFileSync(tmp, `${JSON.stringify(sidecar, null, 2)}\\n`)\n    nodeFs.renameSync(tmp, sidecarPath)\n  } catch (error) {\n    discard(tmp, nodeFs)\n    throw error\n  }\n}\n\n/**\n * `versionChangedAt` is carried over only when the Node behind the file is the same one the previous\n * sidecar described: the triple, plus the size whenever the previous sidecar recorded one (a copy of a\n * same-version different build IS a different Node). A same-version relink after a re-mint must not\n * look like a Node bump to doctor's restart advisory. No parsable previous sidecar \u2192 `now`, which errs\n * towards one advisory too many, never too few.\n */\nconst nextSidecar = (\n  previous: PortlessNodeSidecar | null,\n  method: 'hardlink' | 'copy',\n  exec: PortlessNodeStat,\n  deps: EnsurePortlessNodeDeps,\n  now: string,\n): PortlessNodeSidecar => {\n  const sameNode =\n    previous !== null &&\n    describesProcess(previous, deps) &&\n    (previous.sourceSize === undefined || previous.sourceSize === exec.size)\n\n  return {\n    method,\n    version: deps.version,\n    arch: deps.arch,\n    platform: deps.platform,\n    source: deps.execPath,\n    ...(method === 'copy' ? { sourceSize: exec.size } : {}),\n    refreshedAt: now,\n    versionChangedAt: sameNode ? previous.versionChangedAt : now,\n  }\n}\n\n/**\n * Converge `~/.infra-kit/node` on the Node running THIS install. Never throws; every outcome is a value.\n *\n * A symlink or directory at the path is `'failed'` and left exactly as found \u2014 this code owns a regular\n * file, and removing whatever someone else put there is the one destructive act a boot hook must never\n * take. A converged machine pays one `lstat`, one `stat` and a ~250-byte read: no write, no subprocess.\n *\n * @example\n * ensurePortlessNode({ isGlobal: () => true, home: '/Users/x', execPath: process.execPath, version: process.version, arch: process.arch, platform: process.platform })\n * // => { kind: 'node', outcome: 'created', node: '/Users/x/.infra-kit/node', source: process.execPath, version: process.version, method: 'hardlink' }\n */\nexport const ensurePortlessNode = (deps: EnsurePortlessNodeDeps): PortlessNodeResult => {\n  const {\n    home,\n    execPath,\n    version,\n    fs: nodeFs = fs,\n    now = () => {\n      return new Date()\n    },\n  } = deps\n  const node = portlessNodePath(home)\n  const sidecarPath = portlessNodeSidecar(home)\n  const result = (outcome: PortlessNodeOutcome, method: PortlessNodeResult['method']): PortlessNodeResult => {\n    return { kind: 'node', outcome, node, source: execPath, version, method }\n  }\n\n  if (deps.platform !== 'darwin' && deps.platform !== 'linux') return result('skipped-platform', null)\n  if (!deps.isGlobal()) return result('skipped-local', null)\n\n  try {\n    nodeFs.mkdirSync(dirname(node), { recursive: true })\n\n    const current = nodeFs.lstatSync(node, { throwIfNoEntry: false })\n\n    if (current !== undefined && !current.isFile()) return result('failed', null)\n\n    const exec = nodeFs.statSync(execPath, { throwIfNoEntry: false })\n\n    if (exec === undefined) return result('failed', null)\n\n    const previous = readPortlessNodeSidecar(home, nodeFs)\n\n    if (current !== undefined && previous !== null && isConverged(current, exec, previous, deps)) {\n      return result('unchanged', previous.method)\n    }\n\n    sweepOrphans(dirname(node), [`${basename(node)}.tmp-`, `${basename(sidecarPath)}.tmp-`], nodeFs)\n\n    const method = publishNode(execPath, node, nodeFs)\n\n    publishSidecar(sidecarPath, nextSidecar(previous, method, exec, deps, now().toISOString()), nodeFs)\n\n    return result(current === undefined ? 'created' : 'refreshed', method)\n  } catch {\n    return result('failed', null)\n  }\n}\n"],
-  "mappings": "8FAgCA,OAAOA,MAAQ,UACf,OAAS,WAAAC,OAAe,UACxB,OAAS,WAAAC,EAAS,QAAAC,MAAY,YAC9B,OAAOC,MAAa,eACpB,OAAS,iBAAAC,OAAqB,WCP9B,OAAS,YAAAC,OAAgB,qBACzB,OAAS,cAAAC,OAAkB,cAC3B,OAAS,cAAAC,EAAY,gBAAAC,MAAoB,UACzC,OAAOC,OAAU,YACjB,OAAOC,OAAW,aAClB,OAAOC,OAAS,WAChB,OAAS,WAAAC,OAAe,UACxB,OAAS,WAAAC,EAAS,QAAAC,MAAY,YAC9B,OAAOC,MAAa,eACpB,OAAOC,OAAS,WAChB,OAAS,iBAAAC,OAAqB,WAC9B,OAAS,aAAAC,OAAiB,YCrB1B,IAAMC,GAAa,mBAGbC,GAAsB,QAGfC,EAAcC,GAClBH,GAAW,KAAKG,CAAK,EAAIA,EAAQ,IAAIA,EAAM,WAAW,IAAKF,EAAmB,CAAC,IAI3EG,EAAaC,GACjBA,EAAK,IAAIH,CAAU,EAAE,KAAK,GAAG,EDctC,IAAMI,GAAgBC,GAAUC,EAAQ,EAGlCC,GAAcC,GAAuC,CACzD,IAAMC,EAAM,KAAK,MAAMC,EAAaF,EAAa,OAAO,CAAC,EACnDG,EAAM,OAAOF,EAAI,KAAQ,SAAWA,EAAI,IAAMA,EAAI,KAAK,SAE7D,OAAOE,GAAO,MAAQA,IAAQ,GAAK,KAAOA,CAC5C,EAYaC,EAAqB,IAAqB,CACrD,GAAI,CACF,IAAIC,EAAMC,EAAQC,GAAc,YAAY,GAAG,CAAC,EAEhD,OAAS,CACP,IAAMP,EAAcQ,EAAKH,EAAK,eAAgB,WAAY,cAAc,EAExE,GAAII,EAAWT,CAAW,EAAG,CAC3B,IAAMG,EAAMJ,GAAWC,CAAW,EAElC,OAAOG,GAAO,KAAO,KAAOK,EAAKF,EAAQN,CAAW,EAAGG,CAAG,CAC5D,CACA,IAAMO,EAASJ,EAAQD,CAAG,EAE1B,GAAIK,IAAWL,EAAK,OAAO,KAC3BA,EAAMK,CACR,CACF,MAAQ,CACN,OAAO,IACT,CACF,EAGIC,EACEC,EAAc,KACdD,IAAc,SAAWA,EAAYP,EAAmB,GAErDO,GAuCIE,EAAwB,CAACC,EAAgBC,IAAkD,CACtG,IAAMC,EAAQ,CAACD,EAAQ,UAAYE,EAAQ,SAAUF,EAAQ,IAAK,GAAGD,CAAI,EAGzE,OAFeC,EAAQ,OAAS,GAAO,QAAU,IAEjCG,EAAUF,CAAK,CACjC,EAcMG,GAAqB,KACrBC,EAAmB,KAGnBC,GAAkB,aAGlBC,EAAW,YAQXC,GAAmB,YAiBZC,GAAuB,oBACvBC,GAA4B,0BAA0BD,EAAoB,SAC1EE,GAA0B,uCAE1BC,GAA0B,WAoB1BC,GAA4B,CAACC,EAAsBpB,IAAiC,CAC/F,GAAI,CACF,OAAIQ,EAAQ,WAAa,SAAiBY,EAAOJ,EAAyB,EAAI,MAAQ,KAClFR,EAAQ,WAAa,QAAgBY,EAAOH,EAAuB,EAAI,MAAQ,KAE5E,SACT,MAAQ,CACN,MAAO,SACT,CACF,EAaaI,GAAmCC,GACvC,IAAI,QAASC,GAAY,CAC9B,IAAMC,EAASC,GAAI,QAAQ,CAAE,KAAMZ,EAAU,KAAAS,CAAK,CAAC,EAC7CI,EAAUC,GAA0B,CACxCH,EAAO,QAAQ,EACfD,EAAQI,CAAM,CAChB,EAEAH,EAAO,WAAWb,CAAgB,EAClCa,EAAO,KAAK,UAAW,IAAM,CAC3BE,EAAO,EAAI,CACb,CAAC,EACDF,EAAO,KAAK,UAAW,IAAM,CAC3BE,EAAO,EAAK,CACd,CAAC,EACDF,EAAO,KAAK,QAAS,IAAM,CACzBE,EAAO,EAAK,CACd,CAAC,CACH,CAAC,EAsBUE,GAAwC,CAACN,EAAMO,IACnD,IAAI,QAASN,GAAY,CAE9B,IAAMO,GADUD,EAAME,GAAM,QAAUC,GAAK,SAEzC,CACE,KAAMnB,EACN,KAAAS,EACA,OAAQ,OACR,KAAM,IACN,QAASX,EACT,GAAIkB,EAAM,CAAE,mBAAoB,GAAO,WAAYf,EAAiB,EAAI,CAAC,CAC3E,EACCmB,GAAQ,CACPA,EAAI,OAAO,EACXV,EAAQU,EAAI,QAAQrB,EAAe,IAAM,GAAG,CAC9C,CACF,EAEAkB,EAAI,GAAG,QAAS,IAAM,CACpBP,EAAQ,EAAK,CACf,CAAC,EACDO,EAAI,GAAG,UAAW,IAAM,CACtBA,EAAI,QAAQ,EACZP,EAAQ,EAAK,CACf,CAAC,EACDO,EAAI,IAAI,CACV,CAAC,EAGGI,GAA0B,MAAO7B,EAAM,CAAE,UAAA8B,CAAU,IAAM,CAC7D,IAAMC,EAAMjC,EAAY,EAExB,GAAIiC,GAAO,KAAM,MAAM,IAAI,MAAM,8DAA8D,EAC/F,MAAMjD,GAAcqB,EAAQ,SAAU,CAAC4B,EAAK,GAAG/B,CAAI,EAAG,CACpD,OAAQ,YAAY,QAAQ8B,CAAS,EACrC,SAAU,QACV,IAAKE,EAAyB7B,EAAQ,GAAG,CAC3C,CAAC,CACH,EAUa8B,EAAmB,IACvB9B,EAAQ,IAAI,oBAAsBT,EAAKwC,GAAQ,EAAG,WAAW,EAIhEC,GAAe,SAOfC,GAAuB,aAchBC,EAAa,IACjB3C,EAAKuC,EAAiB,EAAGE,EAAY,EAajCG,GAAuB,IAAe,CACjD,GAAI,CACF,IAAMC,EAAWnD,EAAaM,EAAKuC,EAAiB,EAAGG,EAAoB,EAAG,OAAO,EAAE,KAAK,EAE5F,OAAIG,IAAa,GAAW,GAEbC,GAAW,QAAQ,EAAE,OAAOpD,EAAaiD,EAAW,CAAC,CAAC,EAAE,OAAO,KAAK,IAEjEE,EAAS,YAAY,CACzC,MAAQ,CACN,MAAO,EACT,CACF,EAkBaE,GAAsB,CAACxB,EAAcyB,IACzC,IAAI,QAASxB,GAAY,CAC9B,IAAIyB,EAEJ,GAAI,CACFA,EAAKvD,EAAaiD,EAAW,CAAC,CAChC,MAAQ,CACNnB,EAAQ,CAAE,GAAI,GAAO,KAAM,QAAS,CAAC,EAErC,MACF,CAEA,IAAMC,EAASK,GAAI,QAAQ,CAAE,KAAMhB,EAAU,KAAAS,EAAM,WAAAyB,EAAY,GAAI,CAACC,CAAE,EAAG,mBAAoB,EAAK,EAAG,IAAM,CAIzG,IAAMC,EAAYzB,EAAO,mBACnB0B,EAAa1B,EAAO,WAE1BA,EAAO,QAAQ,EACfD,EAAQ2B,EAAa,CAAE,GAAI,EAAK,EAAI,CAAE,GAAI,GAAO,KAAMD,GAAW,MAAQA,GAAW,SAAW,SAAU,CAAC,CAC7G,CAAC,EAEDzB,EAAO,WAAWb,CAAgB,EAClCa,EAAO,KAAK,UAAW,IAAM,CAC3BA,EAAO,QAAQ,EACfD,EAAQ,CAAE,GAAI,GAAO,KAAM,WAAY,CAAC,CAC1C,CAAC,EACDC,EAAO,KAAK,QAAU2B,GAA+B,CACnD3B,EAAO,QAAQ,EACfD,EAAQ,CAAE,GAAI,GAAO,KAAM4B,EAAI,MAAQ,SAAU,CAAC,CACpD,CAAC,CACH,CAAC,EAQUC,GAAa,IAAuB,CAC/C,GAAI,CACF,IAAMC,EAAe,KAAK,MAAM5D,EAAaM,EAAKuC,EAAiB,EAAG,aAAa,EAAG,OAAO,CAAC,EAE9F,OAAK,MAAM,QAAQe,CAAG,EAEfA,EAAI,QAASC,GAA2B,CAC7C,GAAM,CAAE,SAAAC,EAAU,KAAAjC,CAAK,EAAKgC,GAAS,CAAC,EAEtC,OAAI,OAAOC,GAAa,UAAYA,IAAa,IAAM,OAAOjC,GAAS,SAAiB,CAAC,EAElF,CAAC,CAAE,KAAMiC,EAAU,KAAAjC,CAAK,CAAC,CAClC,CAAC,EAR+B,CAAC,CASnC,MAAQ,CACN,MAAO,CAAC,CACV,CACF,EA0DakC,GAAuB,CAACC,EAA2B,CAAC,IAAsB,CACrF,IAAMrB,EAAMqB,EAAK,MAAQ,OAAYtD,EAAY,EAAIsD,EAAK,IACpDC,EAAMD,EAAK,KAAOvB,GAClByB,EAAcF,EAAK,aAAepC,GAClCuC,EAAiBH,EAAK,gBAAkB7B,GACxCiC,EAAqBJ,EAAK,oBAAsBtC,GAChDgB,EAAYsB,EAAK,WAAa/C,GAChCoD,EAA+B,KAG7BC,EAAS,MAAO1D,GAAqC,CACzD,GAAI,CACF,aAAMqD,EAAIrD,EAAM,CAAE,UAAA8B,CAAU,CAAC,EAEtB,EACT,MAAQ,CACN,MAAO,EACT,CACF,EAEM6B,EAAc,UAClBF,IAAiB,MAAMC,EAAO,CAAC,WAAW,CAAC,EAEpCD,GAkCT,MAAO,CACL,QAAS,IACA1B,EAET,YAAA4B,EACA,eApCc,MAAO1C,EAAcO,IAC/B,CAAE,MAAMmC,EAAY,GAEpB,CAAE,MAAML,EAAYrC,CAAI,EAAW,GAEhCsC,EAAetC,EAAMO,CAAG,EAgC/B,WAvBiB,MAAOP,EAAcO,IAChC,MAAM8B,EAAYrC,CAAI,EAEpB,MAAMsC,EAAetC,EAAMO,CAAG,EAAK,UAAY,eAFhB,cAuBvC,mBAAAgC,EACA,cAnBoB,MAAOI,EAAc3C,IACnC,MAAM0C,EAAY,EAEjBD,EAAO,CAAC,QAASE,EAAM,OAAO3C,CAAI,CAAC,CAAC,EAFR,GAmBnC,YAdkB,MAAO2C,GAAgC,CACnD,MAAMD,EAAY,GACxB,MAAMD,EAAO,CAAC,QAAS,WAAYE,CAAI,CAAC,CAC1C,CAYA,CACF,EEthBA,OAAOC,MAAQ,UACf,OAAS,YAAAC,EAAU,WAAAC,EAAS,QAAAC,MAAY,YACxC,OAAOC,MAAa,eAKb,IAAMC,EAAoBC,GACxBC,EAAKD,EAAME,EAAsB,MAAM,EAInCC,EAAuBH,GAC3B,GAAGD,EAAiBC,CAAI,CAAC,eAiB5BI,GAAaC,GAAiD,CAClE,GAAI,OAAOA,GAAU,UAAYA,IAAU,KAAM,MAAO,GACxD,IAAMC,EAASD,EACTE,EAAU,CAAC,UAAW,OAAQ,WAAY,SAAU,cAAe,kBAAkB,EAE3F,OACGD,EAAO,SAAW,YAAcA,EAAO,SAAW,SACnDC,EAAQ,MAAOC,GACN,OAAOF,EAAOE,CAAG,GAAM,QAC/B,IACAF,EAAO,aAAe,QAAa,OAAOA,EAAO,YAAe,SAErE,EA2DMG,GAAaC,EAAG,UAAU,iBAAmBA,EAAG,UAAU,cAC1DC,GAAY,IAGLC,GAA0B,CAACZ,EAAca,EAAyBH,IAAmC,CAChH,GAAI,CACF,IAAMI,EAAkB,KAAK,MAAMD,EAAO,aAAaV,EAAoBH,CAAI,EAAG,MAAM,CAAC,EAEzF,OAAOI,GAAUU,CAAM,EAAIA,EAAS,IACtC,MAAQ,CACN,OAAO,IACT,CACF,EAEMC,EAAY,CAACC,EAAqBC,IAC/BD,EAAE,MAAQC,EAAE,KAAOD,EAAE,MAAQC,EAAE,IAS3BC,EAAuBC,GAAkF,CACpH,GAAM,CAAE,KAAAnB,EAAM,SAAAoB,EAAU,GAAIP,EAASH,CAAG,EAAIS,EACtCE,EAAOtB,EAAiBC,CAAI,EAElC,GAAI,CACF,IAAMsB,EAAUT,EAAO,UAAUQ,EAAM,CAAE,eAAgB,EAAM,CAAC,EAC1DE,EAAOV,EAAO,SAASO,EAAU,CAAE,eAAgB,EAAM,CAAC,EAEhE,OAAIE,IAAY,QAAaC,IAAS,QAAa,CAACD,EAAQ,OAAO,EAAU,KAEtEP,EAAUO,EAASC,CAAI,EAAIF,EAAO,IAC3C,MAAQ,CACN,OAAO,IACT,CACF,EAIMG,EAAmB,CAACC,EAA8BC,IAC/CD,EAAQ,UAAYC,EAAK,SAAWD,EAAQ,OAASC,EAAK,MAAQD,EAAQ,WAAaC,EAAK,SAU/FC,GAAc,CAClBL,EACAC,EACAE,EACAC,IAEKF,EAAiBC,EAASC,CAAI,EAC/BX,EAAUO,EAASC,CAAI,EAAU,GAE9BE,EAAQ,SAAW,QAAUA,EAAQ,aAAeF,EAAK,KAHnB,GAMzCK,EAAU,CAACC,EAAahB,IAAiC,CAC7D,GAAI,CACFA,EAAO,WAAWgB,CAAG,CACvB,MAAQ,CAER,CACF,EAQMC,GAAe,CAACC,EAAaC,EAAoBnB,IAAiC,CACtF,IAAIoB,EAEJ,GAAI,CACFA,EAAQpB,EAAO,YAAYkB,CAAG,CAChC,MAAQ,CACN,MACF,CAEA,QAAWG,KAAQD,EACFD,EAAS,KAAMG,GACrBD,EAAK,WAAWC,CAAM,CAC9B,GAEWP,EAAQ3B,EAAK8B,EAAKG,CAAI,EAAGrB,CAAM,CAE/C,EAGMuB,GAAY,CAAChB,EAAkBS,EAAahB,IAAgD,CAChG,GAAI,CACF,OAAAA,EAAO,SAASO,EAAUS,CAAG,EAEtB,UACT,MAAQ,CACN,OAAAhB,EAAO,aAAaO,EAAUS,EAAKpB,EAAU,EAI7CI,EAAO,UAAUgB,EAAKlB,EAAS,EAExB,MACT,CACF,EAOM0B,GAAc,CAACjB,EAAkBC,EAAcR,IAAgD,CACnG,IAAMgB,EAAM,GAAGR,CAAI,QAAQiB,EAAQ,GAAG,GAEtC,GAAI,CACF,IAAMC,EAASH,GAAUhB,EAAUS,EAAKhB,CAAM,EAE9C,OAAAA,EAAO,WAAWgB,EAAKR,CAAI,EAEpBkB,CACT,OAASC,EAAO,CACd,MAAAZ,EAAQC,EAAKhB,CAAM,EACb2B,CACR,CACF,EAEMC,GAAiB,CAACC,EAAqBjB,EAA8BZ,IAAiC,CAC1G,IAAMgB,EAAM,GAAGa,CAAW,QAAQJ,EAAQ,GAAG,GAE7C,GAAI,CACFzB,EAAO,cAAcgB,EAAK,GAAG,KAAK,UAAUJ,EAAS,KAAM,CAAC,CAAC;AAAA,CAAI,EACjEZ,EAAO,WAAWgB,EAAKa,CAAW,CACpC,OAASF,EAAO,CACd,MAAAZ,EAAQC,EAAKhB,CAAM,EACb2B,CACR,CACF,EASMG,GAAc,CAClBC,EACAL,EACAhB,EACAG,EACAmB,IACwB,CACxB,IAAMC,EACJF,IAAa,MACbpB,EAAiBoB,EAAUlB,CAAI,IAC9BkB,EAAS,aAAe,QAAaA,EAAS,aAAerB,EAAK,MAErE,MAAO,CACL,OAAAgB,EACA,QAASb,EAAK,QACd,KAAMA,EAAK,KACX,SAAUA,EAAK,SACf,OAAQA,EAAK,SACb,GAAIa,IAAW,OAAS,CAAE,WAAYhB,EAAK,IAAK,EAAI,CAAC,EACrD,YAAasB,EACb,iBAAkBC,EAAWF,EAAS,iBAAmBC,CAC3D,CACF,EAaaE,EAAsBrB,GAAqD,CACtF,GAAM,CACJ,KAAA1B,EACA,SAAAoB,EACA,QAAA4B,EACA,GAAInC,EAASH,EACb,IAAAmC,EAAM,IACG,IAAI,IAEf,EAAInB,EACEL,EAAOtB,EAAiBC,CAAI,EAC5B0C,EAAcvC,EAAoBH,CAAI,EACtCiD,EAAS,CAACC,EAA8BX,KACrC,CAAE,KAAM,OAAQ,QAAAW,EAAS,KAAA7B,EAAM,OAAQD,EAAU,QAAA4B,EAAS,OAAAT,CAAO,GAG1E,GAAIb,EAAK,WAAa,UAAYA,EAAK,WAAa,QAAS,OAAOuB,EAAO,mBAAoB,IAAI,EACnG,GAAI,CAACvB,EAAK,SAAS,EAAG,OAAOuB,EAAO,gBAAiB,IAAI,EAEzD,GAAI,CACFpC,EAAO,UAAUsC,EAAQ9B,CAAI,EAAG,CAAE,UAAW,EAAK,CAAC,EAEnD,IAAMC,EAAUT,EAAO,UAAUQ,EAAM,CAAE,eAAgB,EAAM,CAAC,EAEhE,GAAIC,IAAY,QAAa,CAACA,EAAQ,OAAO,EAAG,OAAO2B,EAAO,SAAU,IAAI,EAE5E,IAAM1B,EAAOV,EAAO,SAASO,EAAU,CAAE,eAAgB,EAAM,CAAC,EAEhE,GAAIG,IAAS,OAAW,OAAO0B,EAAO,SAAU,IAAI,EAEpD,IAAML,EAAWhC,GAAwBZ,EAAMa,CAAM,EAErD,GAAIS,IAAY,QAAasB,IAAa,MAAQjB,GAAYL,EAASC,EAAMqB,EAAUlB,CAAI,EACzF,OAAOuB,EAAO,YAAaL,EAAS,MAAM,EAG5Cd,GAAaqB,EAAQ9B,CAAI,EAAG,CAAC,GAAG+B,EAAS/B,CAAI,CAAC,QAAS,GAAG+B,EAASV,CAAW,CAAC,OAAO,EAAG7B,CAAM,EAE/F,IAAM0B,EAASF,GAAYjB,EAAUC,EAAMR,CAAM,EAEjD,OAAA4B,GAAeC,EAAaC,GAAYC,EAAUL,EAAQhB,EAAMG,EAAMmB,EAAI,EAAE,YAAY,CAAC,EAAGhC,CAAM,EAE3FoC,EAAO3B,IAAY,OAAY,UAAY,YAAaiB,CAAM,CACvE,MAAQ,CACN,OAAOU,EAAO,SAAU,IAAI,CAC9B,CACF,EHlUO,IAAMI,EAAoBC,GACxBC,EAAKD,EAAME,EAAsB,UAAU,EAQvCC,GAAsB,CACjCH,EACAI,EAAsCC,EAAG,aACvB,CAClB,IAAMC,EAAUL,EAAKF,EAAiBC,CAAI,EAAG,OAAQ,QAAQ,EAE7D,OAAOI,EAAOE,CAAO,EAAIA,EAAU,IACrC,EA4BaC,GAAwB,CAACC,EAAaC,IAAuC,CAExF,IAAMC,EAAWD,EAAM,UAAYE,EAAQ,SAGrCC,EACJH,EAAM,aAAe,OAAYI,EAAoB,CAAE,KAAMJ,EAAM,KAAM,SAAAC,CAAS,CAAC,EAAID,EAAM,WAE/F,OAAOK,EAAsB,CAAC,UAAW,SAAS,EAAG,CACnD,KAAM,GACN,IAAKX,GAAoBM,EAAM,KAAMA,EAAM,MAAM,GAAKD,EACtD,SAAUI,GAAcF,CAC1B,CAAC,CACH,EAqCMK,EAAS,OAAO,QAAQ,EACxBC,EAAgB,OAAO,eAAe,EAEtCC,GAAkB,CAACC,EAAcC,IAA0E,CAC/G,IAAMC,EAAOD,EAAO,UAAUD,EAAM,CAAE,eAAgB,EAAM,CAAC,EAE7D,OAAIE,IAAS,OAAkBL,EAC1BK,EAAK,eAAe,EAElBD,EAAO,aAAaD,CAAI,EAFIF,CAGrC,EASMK,GAAY,CAACC,EAAgBJ,EAAcC,IAAiC,CAChF,IAAMI,EAAM,GAAGL,CAAI,QAAQP,EAAQ,GAAG,GAEtC,GAAI,CACFQ,EAAO,WAAWI,CAAG,CACvB,MAAQ,CAER,CAEAJ,EAAO,YAAYG,EAAQC,CAAG,EAE9B,GAAI,CACFJ,EAAO,WAAWI,EAAKL,CAAI,CAC7B,OAASM,EAAO,CACd,GAAI,CACFL,EAAO,WAAWI,CAAG,CACvB,MAAQ,CAER,CAEA,MAAMC,CACR,CACF,EAcaC,GAAsBC,GAAqD,CACtF,GAAM,CAAE,WAAAC,EAAY,SAAAC,EAAU,KAAA5B,EAAM,GAAImB,EAASd,CAAG,EAAIqB,EAClDR,EAAOnB,EAAiBC,CAAI,EAC5BQ,EAAMmB,EAAW,EAEvB,GAAInB,IAAQ,KAAM,MAAO,CAAE,KAAM,OAAQ,QAAS,qBAAsB,OAAQ,KAAM,KAAAU,CAAK,EAE3F,IAAMI,EAASO,EAAQA,EAAQrB,CAAG,CAAC,EAEnC,GAAI,CAACoB,EAAS,EAAG,MAAO,CAAE,KAAM,OAAQ,QAAS,gBAAiB,OAAAN,EAAQ,KAAAJ,CAAK,EAE/E,GAAI,CACFC,EAAO,UAAUU,EAAQX,CAAI,EAAG,CAAE,UAAW,EAAK,CAAC,EAEnD,IAAMY,EAAUb,GAAgBC,EAAMC,CAAM,EAE5C,OAAIW,IAAYR,EAAe,CAAE,KAAM,OAAQ,QAAS,YAAa,OAAAA,EAAQ,KAAAJ,CAAK,EAC9EY,IAAYd,EAAsB,CAAE,KAAM,OAAQ,QAAS,SAAU,OAAAM,EAAQ,KAAAJ,CAAK,GAEtFG,GAAUC,EAAQJ,EAAMC,CAAM,EAEvB,CAAE,KAAM,OAAQ,QAASW,IAAYf,EAAS,UAAY,YAAa,OAAAO,EAAQ,KAAAJ,CAAK,EAC7F,MAAQ,CACN,MAAO,CAAE,KAAM,OAAQ,QAAS,SAAU,OAAAI,EAAQ,KAAAJ,CAAK,CACzD,CACF,EAoBaa,GAAyB,IAA0B,CAC9D,IAAM/B,EAAOgC,GAAQ,EACjBC,EAEEL,EAAW,KACfK,IAAWC,EAAgB,CACzB,aAAc7B,EAAG,aAAa8B,GAAc,YAAY,GAAG,CAAC,EAC5D,IAAKxB,EAAQ,IACb,SAAUyB,EACV,KAAApC,EACA,OAAQK,EAAG,UACb,CAAC,EAEM4B,GAGT,MAAO,CACL,KAAM,CAAE,WAAYI,EAAoB,SAAAT,EAAU,KAAA5B,CAAK,EACvD,KAAM,CACJ,SAAA4B,EACA,KAAA5B,EACA,SAAUW,EAAQ,SAClB,QAASA,EAAQ,QACjB,KAAMA,EAAQ,KACd,SAAUA,EAAQ,QACpB,CACF,CACF,EAEM2B,EAAU,CAACC,EAAsBC,EAAiBC,IAA6D,CACnH,GAAI,CACFF,EAAIE,EAAI,EAAGD,CAAO,CACpB,MAAQ,CAER,CACF,EAQaE,GAAmB,CAACH,EAAsBb,IAAoC,CACzF,IAAMiB,EAASjB,GAAQK,GAAuB,EAE9CO,EAAQC,EAAK,gBAAiB,IACrBd,GAAmBkB,EAAO,IAAI,CACtC,EACDL,EAAQC,EAAK,gBAAiB,IACrBK,EAAmBD,EAAO,IAAI,CACtC,CACH",
-  "names": ["fs", "homedir", "dirname", "join", "process", "fileURLToPath", "execFile", "createHash", "existsSync", "readFileSync", "http", "https", "net", "homedir", "dirname", "join", "process", "tls", "fileURLToPath", "promisify", "SHELL_SAFE", "SINGLE_QUOTE_ESCAPE", "shellQuote", "value", "shellLine", "argv", "execFileAsync", "promisify", "execFile", "readBinRel", "pkgJsonPath", "pkg", "readFileSync", "rel", "resolvePortlessBin", "dir", "dirname", "fileURLToPath", "join", "existsSync", "parent", "cachedBin", "portlessBin", "formatPortlessCommand", "args", "options", "words", "process", "shellLine", "DEFAULT_TIMEOUT_MS", "PROBE_TIMEOUT_MS", "PORTLESS_HEADER", "LOOPBACK", "PROBE_SERVERNAME", "DARWIN_SERVICE_LABEL", "DARWIN_SERVICE_PLIST_PATH", "LINUX_SERVICE_UNIT_PATH", "LINUX_SERVICE_UNIT_NAME", "defaultIsServiceInstalled", "exists", "defaultIsListening", "port", "resolve", "socket", "net", "finish", "result", "defaultIsProxyServing", "tls", "req", "https", "http", "res", "defaultRun", "timeoutMs", "bin", "withoutPackageManagerEnv", "portlessStateDir", "homedir", "CA_CERT_FILE", "CA_TRUST_MARKER_FILE", "readCaPath", "caFingerprintMatches", "recorded", "createHash", "handshakeChainsToCa", "servername", "ca", "authError", "authorized", "err", "listRoutes", "raw", "entry", "hostname", "createPortlessDriver", "deps", "run", "isListening", "isProxyServing", "isServiceInstalled", "availability", "tryRun", "isAvailable", "name", "fs", "basename", "dirname", "join", "process", "portlessNodePath", "home", "join", "USER_CONFIG_DIR_NAME", "portlessNodeSidecar", "isSidecar", "value", "record", "strings", "key", "COPY_FLAGS", "fs", "COPY_MODE", "readPortlessNodeSidecar", "nodeFs", "parsed", "sameInode", "a", "b", "stableNodeCandidate", "input", "execPath", "node", "current", "exec", "describesProcess", "sidecar", "deps", "isConverged", "discard", "tmp", "sweepOrphans", "dir", "prefixes", "names", "name", "prefix", "stageNode", "publishNode", "process", "method", "error", "publishSidecar", "sidecarPath", "nextSidecar", "previous", "now", "sameNode", "ensurePortlessNode", "version", "result", "outcome", "dirname", "basename", "portlessLinkPath", "home", "join", "USER_CONFIG_DIR_NAME", "portlessLinkCliPath", "exists", "fs", "cliPath", "serviceInstallCommand", "bin", "seams", "execPath", "process", "stableNode", "stableNodeCandidate", "formatPortlessCommand", "ABSENT", "NOT_A_SYMLINK", "readCurrentLink", "link", "linkFs", "stat", "writeLink", "target", "tmp", "error", "ensurePortlessLink", "deps", "resolveBin", "isGlobal", "dirname", "current", "realPortlessStableDeps", "homedir", "global", "isGlobalInstall", "fileURLToPath", "safeRealpath", "resolvePortlessBin", "logStep", "log", "message", "run", "bootPortlessLink", "stable", "ensurePortlessNode"]
-}

package/dist/dev-wizard-run-452R76HN.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/dev/dev-wizard-run.ts", "../src/dev/dev-wizard.ts"],
-  "sourcesContent": ["/**\n * Impure driver for the interactive `infra-kit dev` wizard: filesystem/config discovery, the inquirer\n * prompt flow (the package + per-route matrix), the pre-flight proxy audit, and the\n * `commandEcho` teaching line. The pure answer\u2192plan mapping lives in {@link file://./dev-wizard.ts}.\n *\n * Prompts are behind the injectable {@link WizardPrompts} seam so the flow is testable without a TTY.\n * This module is reached ONLY from the bare-invocation TTY branch of the entry point; every flagged /\n * non-TTY / `--json` / `--agent` invocation bypasses it entirely.\n */\nimport inquirerCheckbox from '@inquirer/checkbox'\nimport inquirerConfirm from '@inquirer/confirm'\nimport inquirerSelect from '@inquirer/select'\nimport { loadDev, loadPackageConfig } from '@slip-stream-kit/config/internal'\nimport path from 'node:path'\nimport process from 'node:process'\n\nimport { discoverApiApps, discoverUiApps, findMonorepoRoot } from 'src/dev/discovery'\nimport { commandEcho } from 'src/lib/command-echo'\nimport { INFRA_KIT_ENV_VAR } from 'src/lib/constants'\nimport { readTokenStore } from 'src/lib/env-tokens'\nimport { logger } from 'src/lib/logger'\nimport { withEscape } from 'src/lib/prompts/escapable-context'\n\nimport { deriveManualPlan, equivalentCommand } from './dev-wizard.js'\nimport type { DerivedPlan, ManualSelection, ProxyBackend, RouteCap, WizardApp, WizardModel } from './dev-wizard.js'\nimport { validatePresetProxy } from './presets.js'\nimport type { DevPreset, DiscoveredParts, PresetProxyContext, ProxySource } from './presets.js'\n\n/** A wizard prompt choice \u2014 all values are strings, so the seam needs no generics. */\nexport interface WizardChoice {\n  name: string\n  value: string\n  description?: string\n  checked?: boolean\n  disabled?: boolean | string\n}\n\n/**\n * Injectable prompt seam (a string-valued subset of `@inquirer/*`). The default implementation\n * ({@link defaultPrompts}) delegates to the real prompts, rendering to stderr so the dev-server's\n * stdout stays clean. Tests pass a scripted object.\n */\nexport interface WizardPrompts {\n  select: (cfg: { message: string; choices: WizardChoice[]; default?: string }) => Promise<string>\n  checkbox: (cfg: { message: string; choices: WizardChoice[] }) => Promise<string[]>\n  confirm: (cfg: { message: string; default?: boolean }) => Promise<boolean>\n}\n\n/**\n * Shared `@inquirer/*` context. Rendered to stderr (mirrors the bare-`infra-kit` command palette).\n *\n * `clearPromptOnDone` erases each answered prompt instead of leaving a `\u2714 <question> <answer>` line\n * behind, so the wizard collapses to nothing once it finishes and the dev-server's ready header lands\n * at the top of a clean screen. The choices are not lost: {@link echoManual} prints the equivalent flag\n * command, which is the durable record of what was picked.\n */\nconst promptContext = { output: process.stderr, clearPromptOnDone: true }\n\n/**\n * Real `@inquirer/*` prompts, rendered to stderr and erased once answered.\n *\n * Every one goes through {@link withEscape}, which binds Esc to cancellation. The wrap is here rather\n * than around the {@link WizardPrompts} seam so the scripted prompts the tests inject stay untouched:\n * the seam is the test boundary, `defaultPrompts` is the only implementation that talks to a terminal.\n *\n * Esc rejects with an `AbortPromptError`, which `entry/cli.ts` catches as a cancellation \u2192 exit 0. The\n * wizard therefore needs no cancel branch of its own: a cancelled prompt never returns here at all, so\n * no server is started.\n */\nexport const defaultPrompts: WizardPrompts = {\n  select: (cfg) => {\n    // The wizard is TTY-only by construction (`shouldRunWizard`); the declaration is for the sweep,\n    // which roots `entry/dev-server.ts` and reads the policy off the literal.\n    return withEscape(\n      (context) => {\n        return inquirerSelect({ message: cfg.message, choices: cfg.choices, default: cfg.default }, context)\n      },\n      { ...promptContext, whenHeadless: 'refuse' },\n    )\n  },\n  checkbox: (cfg) => {\n    return withEscape(\n      (context) => {\n        return inquirerCheckbox({ message: cfg.message, choices: cfg.choices }, context)\n      },\n      { ...promptContext, whenHeadless: 'refuse' },\n    )\n  },\n  confirm: (cfg) => {\n    return withEscape(\n      (context) => {\n        return inquirerConfirm({ message: cfg.message, default: cfg.default }, context)\n      },\n      { ...promptContext, whenHeadless: 'refuse' },\n    )\n  },\n}\n\n/** What the wizard hands back to the entry point (merged into `DevServerOptions`), or null on cancel. */\nexport interface WizardResult {\n  /** In-memory run plan \u2014 passed through as `options.presetDef`. */\n  presetDef?: DevPreset\n  /**\n   * App-name include list for the Orca path only: which discovered API apps get a pane. Paired with\n   * `presetDef`, which tells each pane the exact parts to run. An app selected UI-only gets no pane\n   * (Orca panes are opened per API app). Unset for the non-Orca manual path.\n   */\n  include?: string[]\n  watch: boolean\n  orca: boolean\n}\n\n/** Group one frontend's `dev.proxy.routes` into {@link ProxyBackend}s keyed by backend package. */\nconst groupBackends = (\n  routes: Record<string, { packageName: string; from: readonly string[]; default?: 'local' | 'cloud' }>,\n  ownerByPkg: Map<string, string>,\n): ProxyBackend[] => {\n  const byPkg = new Map<string, ProxyBackend>()\n\n  for (const [route, def] of Object.entries(routes)) {\n    const cap: RouteCap = {\n      path: route,\n      localCapable: def.from.includes('local'),\n      cloudCapable: def.from.includes('cloud'),\n      default: def.default,\n    }\n    const existing = byPkg.get(def.packageName)\n\n    if (existing) {\n      existing.routes.push(cap)\n      existing.localCapable = existing.localCapable || cap.localCapable\n      existing.cloudCapable = existing.cloudCapable || cap.cloudCapable\n    } else {\n      byPkg.set(def.packageName, {\n        packageName: def.packageName,\n        routes: [cap],\n        localCapable: cap.localCapable,\n        cloudCapable: cap.cloudCapable,\n        ownerApp: ownerByPkg.get(def.packageName),\n      })\n    }\n  }\n\n  return [...byPkg.values()]\n}\n\n/**\n * Load one frontend's proxy routes and group them into backends. A config that throws \u2014 schema-invalid\n * or an import-time error \u2014 degrades THAT app to zero backends with a named warning instead of rejecting.\n * Without this, a single broken `apps/<x>/ui/infra-kit.config.ts` fails the whole `Promise.all` in\n * {@link gatherWizardModel} and takes the entire wizard down, so `infra-kit dev` becomes unusable for every\n * other app in the monorepo.\n */\nexport const loadBackends = async (\n  uiDir: string,\n  name: string,\n  ownerByPkg: Map<string, string>,\n): Promise<ProxyBackend[]> => {\n  try {\n    const routes = (await loadDev(uiDir))?.proxy?.routes\n\n    return routes ? groupBackends(routes, ownerByPkg) : []\n  } catch (error) {\n    logger.warn(\n      `\u26A0\uFE0F  Skipping ${name}: its dev config failed to load \u2014 ${error instanceof Error ? error.message : String(error)}`,\n    )\n\n    return []\n  }\n}\n\n/** Discover apps + configs and assemble the {@link WizardModel} (backends resolved per frontend). */\nexport const gatherWizardModel = async (root: string): Promise<WizardModel> => {\n  const apiApps = discoverApiApps(root)\n  const uiApps = discoverUiApps(root)\n\n  const ownerByPkg = new Map(\n    apiApps.map((a) => {\n      return [a.packageName, a.name] as const\n    }),\n  )\n  const apiPkgByName = new Map(\n    apiApps.map((a) => {\n      return [a.name, a.packageName] as const\n    }),\n  )\n  const uiNames = new Set(\n    uiApps.map((a) => {\n      return a.name\n    }),\n  )\n  const apiNames = new Set(\n    apiApps.map((a) => {\n      return a.name\n    }),\n  )\n  const allNames = [...new Set([...apiNames, ...uiNames])].sort()\n\n  const apps: WizardApp[] = await Promise.all(\n    allNames.map(async (name): Promise<WizardApp> => {\n      const hasUi = uiNames.has(name)\n\n      return {\n        name,\n        hasApi: apiNames.has(name),\n        hasUi,\n        apiPackage: apiPkgByName.get(name),\n        backends: hasUi ? await loadBackends(path.join(root, 'apps', name, 'ui'), name, ownerByPkg) : [],\n        deployedUrlEnv: hasUi\n          ? (\n              await loadPackageConfig(path.join(root, 'apps', name, 'ui')).catch(() => {\n                return undefined\n              })\n            )?.deployedUrlEnv\n          : undefined,\n      }\n    }),\n  )\n\n  // The cloud-env choices are the envs we hold a token for \u2014 the same authority as `env-load`, because\n  // it is the same question. Picking one loads that env's deployed URLs for the picked frontends, which\n  // `@slip-stream-kit/config/vite` sends their cloud routes to \u2014 and the download needs the env's token. Sourcing it from the workflow options instead would put `prod` in the list\n  // for everyone \u2014 including a developer holding no prod credential \u2014 and point a local UI at\n  // production. No token, no entry.\n  const store = await readTokenStore()\n\n  return {\n    apps,\n    environments: Object.keys(store?.envs ?? {}).sort(),\n  }\n}\n\n/**\n * Build the checkbox choices: one `<app>/ui` per frontend, plus `<app>/api` ONLY for api-only apps\n * (an api with no ui). A full-stack `<app>/api` is deliberately NOT offered \u2014 a full-stack backend is\n * launched by choosing `local` for one of its frontend's routes (asked per-route afterwards), so the\n * checkbox stays a pick of frontends + standalone backends.\n *\n * Nothing starts checked: the selection is opt-in, so a run only ever launches what was explicitly\n * ticked. Pre-checking every part would make the fast path (accept the defaults) boot the whole monorepo\n * \u2014 the exact opposite of why someone reached for the wizard over a bare `infra-kit dev <app>`.\n */\nconst buildPartChoices = (model: WizardModel): WizardChoice[] => {\n  const choices: WizardChoice[] = []\n\n  for (const app of model.apps) {\n    if (app.hasUi) {\n      const paths = app.backends.flatMap((b) => {\n        return b.routes.map((r) => {\n          return r.path\n        })\n      })\n      const description = paths.length > 0 ? `frontend \u2014 proxies ${[...paths].sort().join(', ')}` : 'frontend'\n\n      choices.push({ name: `${app.name}/ui`, value: `${app.name}/ui`, description })\n    }\n    if (app.hasApi && !app.hasUi) {\n      choices.push({ name: `${app.name}/api`, value: `${app.name}/api`, description: 'backend' })\n    }\n  }\n\n  return choices\n}\n\n/** Build the audit context from the gathered model (no re-reading of configs). */\nconst buildAuditContext = (model: WizardModel): PresetProxyContext => {\n  const discovered: DiscoveredParts = {\n    api: model.apps\n      .filter((a) => {\n        return a.hasApi\n      })\n      .map((a) => {\n        return a.name\n      }),\n    ui: model.apps\n      .filter((a) => {\n        return a.hasUi\n      })\n      .map((a) => {\n        return a.name\n      }),\n  }\n  const apiPkgByApp: Record<string, string> = {}\n  const routeToPkg = new Map<string, string>()\n\n  for (const app of model.apps) {\n    // Map EVERY discovered api app to its own api package \u2014 including api-only apps a frontend proxies\n    // to cross-app \u2014 so `launchedPkgs` in validatePresetProxy is faithful.\n    // Deriving this from proxy backends alone would miss api-only owners and false-positive the audit.\n    if (app.apiPackage != null) apiPkgByApp[app.name] = app.apiPackage\n    for (const b of app.backends) {\n      for (const route of b.routes) {\n        routeToPkg.set(`${app.name} ${route.path}`, b.packageName)\n      }\n    }\n  }\n\n  return {\n    discovered,\n    apiPkgByApp,\n    routePkg: (app, route) => {\n      return routeToPkg.get(`${app} ${route}`)\n    },\n  }\n}\n\n/**\n * Run the assembled plan through the proxy-locality rule. Returns issue messages (empty when clean). Catches a `local` override whose backend won't launch \u2014 the wizard's\n * derivation launches owners, so a hit means the backend has no discoverable owning app.\n */\nexport const auditManualPlan = (presetDef: DevPreset, model: WizardModel): string[] => {\n  return validatePresetProxy(presetDef, buildAuditContext(model)).map((i) => {\n    return i.message\n  })\n}\n\n/**\n * Opt back into the Orca question: set to exactly `'1'`. The prompt is temporarily off \u2014 the manual\n * branch always runs in-process \u2014 but the derivation below is kept whole for when it returns. `--orca`\n * on the command line is a separate path and stays live either way.\n */\nexport const WIZARD_ORCA_VAR = 'INFRA_KIT_DEV_WIZARD_ORCA'\n\nconst asksOrca = (): boolean => {\n  return process.env[WIZARD_ORCA_VAR] === '1'\n}\n\n/**\n * Ask, per selected frontend, an EXPLICIT local/cloud choice for every TWO-OPTION route (its `from`\n * lists both). Single-option routes are auto-picked in the pure mapping, so they are never prompted.\n * The answers are keyed `${app}/ui ${routePath}` to match {@link ManualSelection.sources}; the select's\n * default seeds from the route's declared `default` when it has one.\n */\nconst promptRouteSources = async (\n  prompts: WizardPrompts,\n  model: WizardModel,\n  uiKeys: string[],\n): Promise<Record<string, ProxySource>> => {\n  const apps = new Map(\n    model.apps.map((a) => {\n      return [a.name, a] as const\n    }),\n  )\n  const sources: Record<string, ProxySource> = {}\n\n  for (const key of uiKeys) {\n    const app = apps.get(key.split('/')[0]!)\n\n    for (const backend of app?.backends ?? []) {\n      for (const route of backend.routes) {\n        if (!route.localCapable || !route.cloudCapable) continue\n\n        const answer = await prompts.select({\n          message: `\uD83D\uDD00 ${key} ${route.path} \u2192 local or cloud?`,\n          choices: [\n            { name: 'local (this machine)', value: 'local' },\n            { name: 'cloud', value: 'cloud' },\n          ],\n          default: route.default ?? 'local',\n        })\n\n        sources[`${key} ${route.path}`] = answer as ProxySource\n      }\n    }\n  }\n\n  return sources\n}\n\n/** Look up a frontend route's capability in the model (for the recap's \"only option\" annotation). */\nconst findRouteCap = (model: WizardModel, app: string, routePath: string): RouteCap | undefined => {\n  return model.apps\n    .find((a) => {\n      return a.name === app\n    })\n    ?.backends.flatMap((b) => {\n      return b.routes\n    })\n    .find((r) => {\n      return r.path === routePath\n    })\n}\n\n/**\n * Print a one-line-per-route recap of what each frontend route resolved to, so the chosen sources are\n * visible before launch. A single-option route is annotated `(only option)` \u2014 it was auto-picked, not\n * asked. This is in addition to {@link echoManual}'s pasteable `--target` command.\n */\nconst recapSources = (plan: DerivedPlan, model: WizardModel): void => {\n  const lines: string[] = []\n\n  for (const [key, cfg] of Object.entries(plan.presetDef.apps ?? {})) {\n    if (!key.endsWith('/ui') || !cfg.proxy) continue\n\n    const app = key.split('/')[0]!\n\n    for (const [routePath, source] of Object.entries(cfg.proxy)) {\n      const cap = findRouteCap(model, app, routePath)\n      const suffix = cap && cap.localCapable && cap.cloudCapable ? '' : ' (only option)'\n\n      lines.push(`  ${key} ${routePath} \u2192 ${source}${suffix}`)\n    }\n  }\n\n  if (lines.length === 0) return\n  logger.info('Resolved routes:')\n  for (const line of [...lines].sort()) {\n    logger.info(line)\n  }\n}\n\n/** The manual-branch flow: frontends + per-route source + env + watch + orca \u2192 audited plan \u2192 recap \u2192 echo. */\n/** Reads named variables of one environment (its Doppler config). A seam, so the flow runs without Doppler in tests. */\nexport type LoadEnvVars = (env: string, names: string[]) => Promise<Map<string, string>>\n\nconst loadEnvVarsFromDoppler: LoadEnvVars = async (env, names) => {\n  const { downloadEnvSecrets } = await import('src/commands/env-load/env-load')\n  const secrets = await downloadEnvSecrets(env)\n\n  return new Map(\n    names.flatMap((name) => {\n      const value = secrets.get(name)\n\n      return value === undefined ? [] : [[name, value] as const]\n    }),\n  )\n}\n\n/**\n * Point this session's cloud routes at the picked env: its name, and the deployed URL of every picked\n * frontend. The URLs are the picked env's own \u2014 the shell may hold another env's, and `INFRA_KIT_ENV` alone\n * no longer names a host. Backends keep the shell's env; only what the proxy reads changes.\n */\nconst applyCloudEnv = async (\n  env: string,\n  uiKeys: string[],\n  model: WizardModel,\n  loadEnvVars: LoadEnvVars,\n): Promise<void> => {\n  const names = uiKeys.flatMap((key) => {\n    const app = model.apps.find((candidate) => {\n      return `${candidate.name}/ui` === key\n    })\n\n    return app?.deployedUrlEnv ? [app.deployedUrlEnv] : []\n  })\n  const values = names.length > 0 ? await loadEnvVars(env, names) : new Map<string, string>()\n\n  process.env[INFRA_KIT_ENV_VAR] = env\n\n  for (const name of names) {\n    const value = values.get(name)\n\n    if (value) {\n      process.env[name] = value\n    } else {\n      // The shell's value names another env's host; keeping it would send this env's cloud routes there.\n      delete process.env[name]\n      logger.warn(`\u2601\uFE0F  \"${env}\" holds no ${name}; routes that go to the deployed app will fail until it does.`)\n    }\n  }\n}\n\nconst runManualBranch = async (\n  prompts: WizardPrompts,\n  model: WizardModel,\n  loadEnvVars: LoadEnvVars,\n): Promise<WizardResult | null> => {\n  if (model.apps.length === 0) {\n    logger.warn('No apps discovered to run.')\n\n    return null\n  }\n\n  const selectedTargets = await prompts.checkbox({ message: '\uD83D\uDCE6 Which packages?', choices: buildPartChoices(model) })\n\n  if (selectedTargets.length === 0) {\n    logger.warn('No packages selected.')\n\n    return null\n  }\n\n  const uiKeys = selectedTargets.filter((t) => {\n    return t.endsWith('/ui')\n  })\n  const sources = await promptRouteSources(prompts, model, uiKeys)\n\n  const watch = await prompts.confirm({ message: '\uD83D\uDC40 Rebuild & restart on save (watch)?', default: true })\n  const orca = asksOrca()\n    ? await prompts.confirm({ message: '\uD83E\uDDE9 Run each app in its own Orca pane?', default: false })\n    : false\n\n  const selection: ManualSelection = { targets: selectedTargets, sources, watch, orca }\n  const plan = deriveManualPlan(selection, model)\n\n  if (plan.anyCloudRoute) {\n    // A cloud route needs an environment to point at, and the only environments we can offer are those we\n    // hold a token for. With none loaded, the `select` below would be handed zero choices and `@inquirer/select`\n    // throws `No selectable choices` \u2014 a raw stack on a realistic first-run path (fresh clone, no `env-load`).\n    // Back out cleanly with guidance instead, and BEFORE mutating `process.env`, so a refused run leaks nothing.\n    if (model.environments.length === 0) {\n      logger.warn('\u2601\uFE0F  This selection routes to a cloud environment, but no environment token is loaded.')\n      logger.warn('   Run `infra-kit env-load` to add one, then re-run the wizard.')\n\n      return null\n    }\n\n    selection.env = await prompts.select({\n      message: '\u2601\uFE0F  Point cloud routes at which environment?',\n      choices: model.environments.map((e) => {\n        return { name: e, value: e }\n      }),\n    })\n    await applyCloudEnv(selection.env, uiKeys, model, loadEnvVars)\n  }\n\n  const issues = auditManualPlan(plan.presetDef, model)\n\n  if (issues.length > 0) {\n    logger.warn('\u26A0\uFE0F  Proxy audit found issues with this selection:')\n    for (const issue of issues) {\n      logger.warn(`   \u2022 ${issue}`)\n    }\n\n    return null\n  }\n\n  recapSources(plan, model)\n  echoManual(plan, selection)\n\n  // Orca opens one pane per selected API app. `include` picks WHICH apps get a pane; `presetDef` tells\n  // each pane exactly which of its parts to run. Without the latter a pane runs `--app=<name>`, which\n  // expands to every part the app has \u2014 silently starting a UI the user just unticked.\n  const apiApps = plan.targetKeys\n    .filter((k) => {\n      return k.endsWith('/api')\n    })\n    .map((k) => {\n      return k.split('/')[0]!\n    })\n\n  // An empty include would collapse to `null` in `normalizeAppInclude` and make Orca run EVERY api app,\n  // so an Orca run with no selected backends (e.g. an all-frontend selection) falls back to in-process.\n  if (orca && apiApps.length > 0) {\n    return { include: apiApps, presetDef: plan.presetDef, watch, orca: true }\n  }\n\n  if (orca) {\n    logger.info('\u2139\uFE0F  Orca needs at least one local backend (panes are backend-only) \u2014 running in-process instead.')\n  }\n\n  return { presetDef: plan.presetDef, watch, orca: false }\n}\n\n/** Print the equivalent (`--target=\u2026`) flag command. */\nconst echoManual = (plan: DerivedPlan, selection: ManualSelection): void => {\n  commandEcho.setInteractive()\n\n  const eq = equivalentCommand(plan, selection)\n\n  commandEcho.addOption(eq.flags, true)\n  commandEcho.print()\n}\n\n/**\n * Drive the wizard flow over an ALREADY-gathered model (no disk/config access). Split from\n * {@link runDevWizard} so the flow is unit-testable with scripted prompts + a fixture model.\n */\nexport const runWizardFlow = async (\n  prompts: WizardPrompts,\n  model: WizardModel,\n  loadEnvVars: LoadEnvVars = loadEnvVarsFromDoppler,\n): Promise<WizardResult | null> => {\n  return runManualBranch(prompts, model, loadEnvVars)\n}\n\n/**\n * Gather the model from disk/config, then drive the wizard flow, returning the resolved run options (or\n * null on cancel / empty selection). The entry point calls this on a bare TTY `infra-kit dev`.\n */\nexport const runDevWizard = async (\n  prompts: WizardPrompts = defaultPrompts,\n  root: string = findMonorepoRoot(process.cwd()),\n): Promise<WizardResult | null> => {\n  return runWizardFlow(prompts, await gatherWizardModel(root))\n}\n", "/**\n * Pure core of the interactive `infra-kit dev` wizard (the no-args, TTY path).\n *\n * The wizard is FRONTEND-CENTRIC: you pick which frontends to run, and for each frontend you choose,\n * every proxy route that has TWO real options (its `from` lists both `local` and `cloud`) is decided\n * EXPLICITLY \u2014 local (its backend is launched \u2192 the route resolves local) or cloud (the route proxies\n * to the `<env>` cloud target). Single-option routes are auto-picked. Because a backend runs local OR\n * cloud as a whole, routes that share one backend package RECONCILE: if any of them resolved local, the\n * backend runs local and all its local-capable routes follow. This module turns those answers into an\n * in-memory {@link DevPreset} the runner consumes verbatim (part-level targets the app-name-only `--app`\n * include cannot express) \u2014 and is side-effect-free so the mapping is fully unit-testable. The impure\n * I/O (discovery, inquirer prompts, audit, launch) lives in {@link file://./dev-wizard-run.ts}.\n */\nimport type { DevPreset, ProxySource } from './presets.js'\n\n/**\n * One proxy route's per-route capability, carried through grouping so the wizard can decide whether it\n * even needs to ask about the route (only a `local`+`cloud` route is a real choice).\n */\nexport interface RouteCap {\n  /** Route path (e.g. `/api`). */\n  path: string\n  /** `from` includes `local` \u2014 the route can resolve to a locally-launched backend. */\n  localCapable: boolean\n  /** `from` includes `cloud` \u2014 the route can resolve to the cloud target. */\n  cloudCapable: boolean\n  /** The route's declared `default` source when it has one (present iff `from` lists >1 source) \u2014 seeds the prompt's default. */\n  default?: ProxySource\n}\n\n/**\n * One backend a frontend's proxy routes can be pointed at, grouped by the backend package. A frontend\n * that maps `/api` and `/media` to the same package yields ONE {@link ProxyBackend} with both routes \u2014\n * launching the package flips every one of its `local`-capable routes together (the reconcile in\n * {@link deriveManualPlan}).\n */\nexport interface ProxyBackend {\n  /** Backend package name (a route's `packageName`). */\n  packageName: string\n  /** The routes that resolve to this package, each with its own local/cloud capability. */\n  routes: RouteCap[]\n  /** True when at least one of `routes` lists `local` in its `from` capabilities \u2014 i.e. it is launchable-local. */\n  localCapable: boolean\n  /** True when at least one of `routes` lists `cloud` \u2014 i.e. it can stay on the cloud target. */\n  cloudCapable: boolean\n  /** App folder whose `api` package is {@link packageName}, or undefined when no discovered app owns it (a `local` choice then has nothing to launch \u2014 the audit flags it). */\n  ownerApp?: string\n}\n\n/** A discovered app as the wizard sees it: which parts exist + which backends its frontend proxies to. */\nexport interface WizardApp {\n  /** App folder name (e.g. `client`). */\n  name: string\n  /** Has `apps/<app>/api` (a launchable backend). */\n  hasApi: boolean\n  /** Has `apps/<app>/ui` (a launchable frontend). */\n  hasUi: boolean\n  /**\n   * This app's OWN `api` package name (from `apps/<app>/api`), or undefined when it has no api. Carried\n   * so the audit can build a faithful `app \u2192 apiPackage` map for EVERY discovered api app \u2014 including\n   * api-only apps a frontend proxies to cross-app.\n   */\n  apiPackage?: string\n  /** Backends this app's frontend proxies to (empty for api-only apps or a frontend with no `dev.proxy`). */\n  backends: ProxyBackend[]\n  /** The frontend's `deployedUrlEnv` \u2014 the variable its cloud routes are sent to. Absent when it declares none. */\n  deployedUrlEnv?: string\n}\n\n/** Everything the wizard needs, gathered impurely by {@link file://./dev-wizard-run.ts}. */\nexport interface WizardModel {\n  /** All discovered apps (api and/or ui), sorted by name. */\n  apps: WizardApp[]\n  /** Configured `environments` (the cloud-env `select` options). */\n  environments: string[]\n}\n\n/** The manual-branch answers collected from the prompts, fed to {@link deriveManualPlan}. */\nexport interface ManualSelection {\n  /**\n   * The target keys the user ticked directly: every selected `<app>/ui` frontend, plus any api-only\n   * `<app>/api` backend (apps with an api but no ui). A full-stack backend is NOT ticked here \u2014 it is\n   * launched by choosing `local` for one of its frontend's routes (recorded in {@link sources}).\n   */\n  targets: string[]\n  /**\n   * Explicit per-route choice for every TWO-OPTION route, keyed `${app}/ui ${routePath}` (e.g.\n   * `client/ui /api`). Single-option routes are absent (auto-picked). Missing two-option answers fall\n   * back to the route's cloud/local capability in {@link deriveManualPlan}.\n   */\n  sources: Record<string, ProxySource>\n  /** Chosen cloud env for cloud routes (undefined when nothing resolves cloud). */\n  env?: string\n  /** Rebuild + restart on save. */\n  watch: boolean\n  /** One Orca pane per app. */\n  orca: boolean\n}\n\n/** The resolved run plan derived from a {@link ManualSelection}. */\nexport interface DerivedPlan {\n  /** In-memory run plan handed to the runner (`options.presetDef`). */\n  presetDef: DevPreset\n  /** At least one route resolves to cloud \u2192 an env must be chosen (pre-flight gate). */\n  anyCloudRoute: boolean\n  /** Resolved `<app>/<part>` target keys, sorted \u2014 for the echo + audit display. */\n  targetKeys: string[]\n}\n\n/** App folder name from an `<app>/<part>` target key. */\nconst appOf = (key: string): string => {\n  return key.split('/')[0]!\n}\n\n/** Index a model's apps by folder name for O(1) lookup. */\nconst byName = (model: WizardModel): Map<string, WizardApp> => {\n  return new Map(\n    model.apps.map((a) => {\n      return [a.name, a]\n    }),\n  )\n}\n\n/** Is this route a real choice (both local and cloud reachable)? */\nconst isTwoOption = (route: RouteCap): boolean => {\n  return route.localCapable && route.cloudCapable\n}\n\n/**\n * The source a single route resolves to BEFORE per-backend reconciliation:\n *  - two-option: the user's recorded answer, else 'cloud' when cloud-capable else 'local';\n *  - single local-only: always 'local';\n *  - single cloud-only: always 'cloud'.\n */\nconst rawSource = (uiKey: string, route: RouteCap, sources: Record<string, ProxySource>): ProxySource => {\n  if (isTwoOption(route)) {\n    return sources[`${uiKey} ${route.path}`] ?? (route.cloudCapable ? 'cloud' : 'local')\n  }\n\n  return route.localCapable ? 'local' : 'cloud'\n}\n\n/**\n * Pass 1: which backend packages resolve local (any of their routes did), plus each package's owner app.\n * A package's local verdict is shared across every frontend that proxies to it \u2014 that is the reconcile.\n */\nconst collectLocalPackages = (\n  uiKeys: string[],\n  apps: Map<string, WizardApp>,\n  sources: Record<string, ProxySource>,\n): { localPkgs: Set<string>; ownerByPkg: Map<string, string | undefined> } => {\n  const localPkgs = new Set<string>()\n  const ownerByPkg = new Map<string, string | undefined>()\n\n  for (const key of uiKeys) {\n    const app = apps.get(appOf(key))\n\n    for (const backend of app?.backends ?? []) {\n      ownerByPkg.set(backend.packageName, backend.ownerApp)\n      for (const route of backend.routes) {\n        if (rawSource(key, route, sources) === 'local') localPkgs.add(backend.packageName)\n      }\n    }\n  }\n\n  return { localPkgs, ownerByPkg }\n}\n\n/**\n * Pass 2 for ONE frontend: its per-route overrides after the per-package verdict, and whether any route\n * went cloud. A local-capable route on a local package is `local` (reconciled up); everything else `cloud`.\n */\nconst frontendOverrides = (\n  app: WizardApp | undefined,\n  localPkgs: ReadonlySet<string>,\n): { overrides: Record<string, ProxySource>; anyCloud: boolean } => {\n  const overrides: Record<string, ProxySource> = {}\n  let anyCloud = false\n\n  for (const backend of app?.backends ?? []) {\n    const backendLocal = localPkgs.has(backend.packageName)\n\n    for (const route of backend.routes) {\n      const source: ProxySource = route.localCapable && backendLocal ? 'local' : 'cloud'\n\n      overrides[route.path] = source\n      if (source === 'cloud') anyCloud = true\n    }\n  }\n\n  return { overrides, anyCloud }\n}\n\n/**\n * Turn the manual {@link ManualSelection} into an in-memory {@link DevPreset}. The frontend checkbox picks\n * which UIs (and standalone api-only backends) to run; the per-route answers in {@link ManualSelection.sources}\n * decide each two-option route. Resolution is two passes so same-backend routes stay coherent:\n *\n *  1. Resolve every route of every selected frontend to its raw source; a package is LOCAL iff any of its\n *     routes resolved local.\n *  2. Re-resolve each route against that per-package verdict: a local-capable route on a local package is\n *     `local` (reconciled up even if it was individually answered cloud); a cloud-only route stays `cloud`.\n *\n * Launched backends are the ticked api-only parts \u222A every package that resolved local (added as\n * `${ownerApp}/api` when the owner is discoverable \u2014 a local override on an owner-less package is still\n * emitted, and the audit flags it).\n *\n * @example\n * // client frontend, its /api answered local \u2192 launches client/api + client/ui, /api resolves local:\n * deriveManualPlan(\n *   { targets: ['client/ui'], sources: { 'client/ui /api': 'local' }, watch: false, orca: false },\n *   { apps: [{ name: 'client', hasApi: true, hasUi: true, backends: [{ packageName: 'client-api',\n *              cloudCapable: true, localCapable: true, ownerApp: 'client',\n *              routes: [{ path: '/api', localCapable: true, cloudCapable: true }] }] }],\n *     environments: ['dev'] },\n * ).targetKeys // => ['client/api', 'client/ui']\n */\nexport const deriveManualPlan = (selection: ManualSelection, model: WizardModel): DerivedPlan => {\n  const apps = byName(model)\n  const uiKeys = selection.targets.filter((t) => {\n    return t.endsWith('/ui')\n  })\n  const apiOnlyKeys = selection.targets.filter((t) => {\n    return t.endsWith('/api')\n  })\n\n  // Pass 1: a package is local iff any of its routes (across every selected frontend) resolved local.\n  const { localPkgs, ownerByPkg } = collectLocalPackages(uiKeys, apps, selection.sources)\n\n  // Pass 2: re-resolve each route against the per-package verdict + build per-frontend overrides.\n  const presetApps: Record<string, { proxy?: Record<string, ProxySource> }> = {}\n  let anyCloud = false\n\n  for (const key of uiKeys) {\n    const { overrides, anyCloud: cloud } = frontendOverrides(apps.get(appOf(key)), localPkgs)\n\n    if (cloud) anyCloud = true\n    presetApps[key] = Object.keys(overrides).length > 0 ? { proxy: overrides } : {}\n  }\n\n  // Launch: the ticked api-only backends, plus every package that resolved local (via its owner app).\n  for (const key of apiOnlyKeys) {\n    presetApps[key] ??= {}\n  }\n  for (const pkg of localPkgs) {\n    const owner = ownerByPkg.get(pkg)\n\n    if (owner != null) presetApps[`${owner}/api`] ??= {}\n  }\n\n  return {\n    presetDef: { apps: presetApps },\n    anyCloudRoute: anyCloud,\n    targetKeys: Object.keys(presetApps).sort(),\n  }\n}\n\n/** The equivalent non-interactive command for a derived plan. */\nexport interface EquivalentCommand {\n  /** The `--target=<app>/<part>,\u2026`-form flag string (no leading `infra-kit dev`). */\n  flags: string\n}\n\n/**\n * Build the equivalent `infra-kit dev --target=\u2026 [--no-watch] [--orca]` flag string for a derived plan.\n * Always exact: `--target` names packages at `<app>/<part>` granularity \u2014 the same grammar the plan's\n * `targetKeys` already use \u2014 so every wizard selection, whole-app or part-level, round-trips into a\n * pasteable command. (`--app` is deliberately NOT used here: its app-name granularity over-launches a\n * part-level pick \u2014 `--app=client` starts `client/api` even when only `client/ui` was ticked.)\n */\nexport const equivalentCommand = (plan: DerivedPlan, selection: ManualSelection): EquivalentCommand => {\n  const parts = [`--target=${plan.targetKeys.join(',')}`]\n\n  if (!selection.watch) parts.push('--no-watch')\n  if (selection.orca) parts.push('--orca')\n\n  return { flags: parts.join(' ') }\n}\n"],
-  "mappings": "uRASA,OAAOA,MAAsB,qBAC7B,OAAOC,MAAqB,oBAC5B,OAAOC,MAAoB,mBAC3B,OAAS,WAAAC,EAAS,qBAAAC,MAAyB,mCAC3C,OAAOC,MAAU,YACjB,OAAOC,MAAa,eCgGpB,IAAMC,EAASC,GACNA,EAAI,MAAM,GAAG,EAAE,CAAC,EAInBC,EAAUC,GACP,IAAI,IACTA,EAAM,KAAK,IAAKC,GACP,CAACA,EAAE,KAAMA,CAAC,CAClB,CACH,EAIIC,EAAeC,GACZA,EAAM,cAAgBA,EAAM,aAS/BC,EAAY,CAACC,EAAeF,EAAiBG,IAC7CJ,EAAYC,CAAK,EACZG,EAAQ,GAAGD,CAAK,IAAIF,EAAM,IAAI,EAAE,IAAMA,EAAM,aAAe,QAAU,SAGvEA,EAAM,aAAe,QAAU,QAOlCI,EAAuB,CAC3BC,EACAC,EACAH,IAC4E,CAC5E,IAAMI,EAAY,IAAI,IAChBC,EAAa,IAAI,IAEvB,QAAWb,KAAOU,EAAQ,CACxB,IAAMI,EAAMH,EAAK,IAAIZ,EAAMC,CAAG,CAAC,EAE/B,QAAWe,KAAWD,GAAK,UAAY,CAAC,EAAG,CACzCD,EAAW,IAAIE,EAAQ,YAAaA,EAAQ,QAAQ,EACpD,QAAWV,KAASU,EAAQ,OACtBT,EAAUN,EAAKK,EAAOG,CAAO,IAAM,SAASI,EAAU,IAAIG,EAAQ,WAAW,CAErF,CACF,CAEA,MAAO,CAAE,UAAAH,EAAW,WAAAC,CAAW,CACjC,EAMMG,EAAoB,CACxBF,EACAF,IACkE,CAClE,IAAMK,EAAyC,CAAC,EAC5CC,EAAW,GAEf,QAAWH,KAAWD,GAAK,UAAY,CAAC,EAAG,CACzC,IAAMK,EAAeP,EAAU,IAAIG,EAAQ,WAAW,EAEtD,QAAWV,KAASU,EAAQ,OAAQ,CAClC,IAAMK,EAAsBf,EAAM,cAAgBc,EAAe,QAAU,QAE3EF,EAAUZ,EAAM,IAAI,EAAIe,EACpBA,IAAW,UAASF,EAAW,GACrC,CACF,CAEA,MAAO,CAAE,UAAAD,EAAW,SAAAC,CAAS,CAC/B,EA0BaG,EAAmB,CAACC,EAA4BpB,IAAoC,CAC/F,IAAMS,EAAOV,EAAOC,CAAK,EACnBQ,EAASY,EAAU,QAAQ,OAAQC,GAChCA,EAAE,SAAS,KAAK,CACxB,EACKC,EAAcF,EAAU,QAAQ,OAAQC,GACrCA,EAAE,SAAS,MAAM,CACzB,EAGK,CAAE,UAAAX,EAAW,WAAAC,CAAW,EAAIJ,EAAqBC,EAAQC,EAAMW,EAAU,OAAO,EAGhFG,EAAsE,CAAC,EACzEP,EAAW,GAEf,QAAWlB,KAAOU,EAAQ,CACxB,GAAM,CAAE,UAAAO,EAAW,SAAUS,CAAM,EAAIV,EAAkBL,EAAK,IAAIZ,EAAMC,CAAG,CAAC,EAAGY,CAAS,EAEpFc,IAAOR,EAAW,IACtBO,EAAWzB,CAAG,EAAI,OAAO,KAAKiB,CAAS,EAAE,OAAS,EAAI,CAAE,MAAOA,CAAU,EAAI,CAAC,CAChF,CAGA,QAAWjB,KAAOwB,EAChBC,EAAWzB,CAAG,IAAM,CAAC,EAEvB,QAAW2B,KAAOf,EAAW,CAC3B,IAAMgB,EAAQf,EAAW,IAAIc,CAAG,EAE5BC,GAAS,OAAMH,EAAW,GAAGG,CAAK,MAAM,IAAM,CAAC,EACrD,CAEA,MAAO,CACL,UAAW,CAAE,KAAMH,CAAW,EAC9B,cAAeP,EACf,WAAY,OAAO,KAAKO,CAAU,EAAE,KAAK,CAC3C,CACF,EAeaI,EAAoB,CAACC,EAAmBR,IAAkD,CACrG,IAAMS,EAAQ,CAAC,YAAYD,EAAK,WAAW,KAAK,GAAG,CAAC,EAAE,EAEtD,OAAKR,EAAU,OAAOS,EAAM,KAAK,YAAY,EACzCT,EAAU,MAAMS,EAAM,KAAK,QAAQ,EAEhC,CAAE,MAAOA,EAAM,KAAK,GAAG,CAAE,CAClC,ED7NA,IAAMC,EAAgB,CAAE,OAAQC,EAAQ,OAAQ,kBAAmB,EAAK,EAa3DC,EAAgC,CAC3C,OAASC,GAGAC,EACJC,GACQC,EAAe,CAAE,QAASH,EAAI,QAAS,QAASA,EAAI,QAAS,QAASA,EAAI,OAAQ,EAAGE,CAAO,EAErG,CAAE,GAAGL,EAAe,aAAc,QAAS,CAC7C,EAEF,SAAWG,GACFC,EACJC,GACQE,EAAiB,CAAE,QAASJ,EAAI,QAAS,QAASA,EAAI,OAAQ,EAAGE,CAAO,EAEjF,CAAE,GAAGL,EAAe,aAAc,QAAS,CAC7C,EAEF,QAAUG,GACDC,EACJC,GACQG,EAAgB,CAAE,QAASL,EAAI,QAAS,QAASA,EAAI,OAAQ,EAAGE,CAAO,EAEhF,CAAE,GAAGL,EAAe,aAAc,QAAS,CAC7C,CAEJ,EAiBMS,EAAgB,CACpBC,EACAC,IACmB,CACnB,IAAMC,EAAQ,IAAI,IAElB,OAAW,CAACC,EAAOC,CAAG,IAAK,OAAO,QAAQJ,CAAM,EAAG,CACjD,IAAMK,EAAgB,CACpB,KAAMF,EACN,aAAcC,EAAI,KAAK,SAAS,OAAO,EACvC,aAAcA,EAAI,KAAK,SAAS,OAAO,EACvC,QAASA,EAAI,OACf,EACME,EAAWJ,EAAM,IAAIE,EAAI,WAAW,EAEtCE,GACFA,EAAS,OAAO,KAAKD,CAAG,EACxBC,EAAS,aAAeA,EAAS,cAAgBD,EAAI,aACrDC,EAAS,aAAeA,EAAS,cAAgBD,EAAI,cAErDH,EAAM,IAAIE,EAAI,YAAa,CACzB,YAAaA,EAAI,YACjB,OAAQ,CAACC,CAAG,EACZ,aAAcA,EAAI,aAClB,aAAcA,EAAI,aAClB,SAAUJ,EAAW,IAAIG,EAAI,WAAW,CAC1C,CAAC,CAEL,CAEA,MAAO,CAAC,GAAGF,EAAM,OAAO,CAAC,CAC3B,EASaK,EAAe,MAC1BC,EACAC,EACAR,IAC4B,CAC5B,GAAI,CACF,IAAMD,GAAU,MAAMU,EAAQF,CAAK,IAAI,OAAO,OAE9C,OAAOR,EAASD,EAAcC,EAAQC,CAAU,EAAI,CAAC,CACvD,OAASU,EAAO,CACd,OAAAC,EAAO,KACL,0BAAgBH,CAAI,0CAAqCE,aAAiB,MAAQA,EAAM,QAAU,OAAOA,CAAK,CAAC,EACjH,EAEO,CAAC,CACV,CACF,EAGaE,EAAoB,MAAOC,GAAuC,CAC7E,IAAMC,EAAUC,EAAgBF,CAAI,EAC9BG,EAASC,EAAeJ,CAAI,EAE5Bb,EAAa,IAAI,IACrBc,EAAQ,IAAKI,GACJ,CAACA,EAAE,YAAaA,EAAE,IAAI,CAC9B,CACH,EACMC,EAAe,IAAI,IACvBL,EAAQ,IAAKI,GACJ,CAACA,EAAE,KAAMA,EAAE,WAAW,CAC9B,CACH,EACME,EAAU,IAAI,IAClBJ,EAAO,IAAKE,GACHA,EAAE,IACV,CACH,EACMG,EAAW,IAAI,IACnBP,EAAQ,IAAKI,GACJA,EAAE,IACV,CACH,EACMI,EAAW,CAAC,GAAG,IAAI,IAAI,CAAC,GAAGD,EAAU,GAAGD,CAAO,CAAC,CAAC,EAAE,KAAK,EAExDG,EAAoB,MAAM,QAAQ,IACtCD,EAAS,IAAI,MAAOd,GAA6B,CAC/C,IAAMgB,EAAQJ,EAAQ,IAAIZ,CAAI,EAE9B,MAAO,CACL,KAAAA,EACA,OAAQa,EAAS,IAAIb,CAAI,EACzB,MAAAgB,EACA,WAAYL,EAAa,IAAIX,CAAI,EACjC,SAAUgB,EAAQ,MAAMlB,EAAamB,EAAK,KAAKZ,EAAM,OAAQL,EAAM,IAAI,EAAGA,EAAMR,CAAU,EAAI,CAAC,EAC/F,eAAgBwB,GAEV,MAAME,EAAkBD,EAAK,KAAKZ,EAAM,OAAQL,EAAM,IAAI,CAAC,EAAE,MAAM,IAAM,CAEzE,CAAC,IACA,eACH,MACN,CACF,CAAC,CACH,EAOMmB,EAAQ,MAAMC,EAAe,EAEnC,MAAO,CACL,KAAAL,EACA,aAAc,OAAO,KAAKI,GAAO,MAAQ,CAAC,CAAC,EAAE,KAAK,CACpD,CACF,EAYME,EAAoBC,GAAuC,CAC/D,IAAMC,EAA0B,CAAC,EAEjC,QAAWC,KAAOF,EAAM,KAAM,CAC5B,GAAIE,EAAI,MAAO,CACb,IAAMC,EAAQD,EAAI,SAAS,QAASE,GAC3BA,EAAE,OAAO,IAAKC,GACZA,EAAE,IACV,CACF,EACKC,EAAcH,EAAM,OAAS,EAAI,2BAAsB,CAAC,GAAGA,CAAK,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,GAAK,WAE9FF,EAAQ,KAAK,CAAE,KAAM,GAAGC,EAAI,IAAI,MAAO,MAAO,GAAGA,EAAI,IAAI,MAAO,YAAAI,CAAY,CAAC,CAC/E,CACIJ,EAAI,QAAU,CAACA,EAAI,OACrBD,EAAQ,KAAK,CAAE,KAAM,GAAGC,EAAI,IAAI,OAAQ,MAAO,GAAGA,EAAI,IAAI,OAAQ,YAAa,SAAU,CAAC,CAE9F,CAEA,OAAOD,CACT,EAGMM,EAAqBP,GAA2C,CACpE,IAAMQ,EAA8B,CAClC,IAAKR,EAAM,KACR,OAAQZ,GACAA,EAAE,MACV,EACA,IAAKA,GACGA,EAAE,IACV,EACH,GAAIY,EAAM,KACP,OAAQZ,GACAA,EAAE,KACV,EACA,IAAKA,GACGA,EAAE,IACV,CACL,EACMqB,EAAsC,CAAC,EACvCC,EAAa,IAAI,IAEvB,QAAWR,KAAOF,EAAM,KAAM,CAIxBE,EAAI,YAAc,OAAMO,EAAYP,EAAI,IAAI,EAAIA,EAAI,YACxD,QAAWE,KAAKF,EAAI,SAClB,QAAW9B,KAASgC,EAAE,OACpBM,EAAW,IAAI,GAAGR,EAAI,IAAI,IAAI9B,EAAM,IAAI,GAAIgC,EAAE,WAAW,CAG/D,CAEA,MAAO,CACL,WAAAI,EACA,YAAAC,EACA,SAAU,CAACP,EAAK9B,IACPsC,EAAW,IAAI,GAAGR,CAAG,IAAI9B,CAAK,EAAE,CAE3C,CACF,EAMauC,EAAkB,CAACC,EAAsBZ,IAC7Ca,EAAoBD,EAAWL,EAAkBP,CAAK,CAAC,EAAE,IAAKc,GAC5DA,EAAE,OACV,EAQUC,EAAkB,4BAEzBC,EAAW,IACRxD,EAAQ,IAAIuD,CAAe,IAAM,IASpCE,EAAqB,MACzBC,EACAlB,EACAmB,IACyC,CACzC,IAAM1B,EAAO,IAAI,IACfO,EAAM,KAAK,IAAKZ,GACP,CAACA,EAAE,KAAMA,CAAC,CAClB,CACH,EACMgC,EAAuC,CAAC,EAE9C,QAAWC,KAAOF,EAAQ,CACxB,IAAMjB,EAAMT,EAAK,IAAI4B,EAAI,MAAM,GAAG,EAAE,CAAC,CAAE,EAEvC,QAAWC,KAAWpB,GAAK,UAAY,CAAC,EACtC,QAAW9B,KAASkD,EAAQ,OAAQ,CAClC,GAAI,CAAClD,EAAM,cAAgB,CAACA,EAAM,aAAc,SAEhD,IAAMmD,EAAS,MAAML,EAAQ,OAAO,CAClC,QAAS,aAAMG,CAAG,IAAIjD,EAAM,IAAI,0BAChC,QAAS,CACP,CAAE,KAAM,uBAAwB,MAAO,OAAQ,EAC/C,CAAE,KAAM,QAAS,MAAO,OAAQ,CAClC,EACA,QAASA,EAAM,SAAW,OAC5B,CAAC,EAEDgD,EAAQ,GAAGC,CAAG,IAAIjD,EAAM,IAAI,EAAE,EAAImD,CACpC,CAEJ,CAEA,OAAOH,CACT,EAGMI,EAAe,CAACxB,EAAoBE,EAAauB,IAC9CzB,EAAM,KACV,KAAMZ,GACEA,EAAE,OAASc,CACnB,GACC,SAAS,QAASE,GACXA,EAAE,MACV,EACA,KAAMC,GACEA,EAAE,OAASoB,CACnB,EAQCC,EAAe,CAACC,EAAmB3B,IAA6B,CACpE,IAAM4B,EAAkB,CAAC,EAEzB,OAAW,CAACP,EAAK3D,CAAG,IAAK,OAAO,QAAQiE,EAAK,UAAU,MAAQ,CAAC,CAAC,EAAG,CAClE,GAAI,CAACN,EAAI,SAAS,KAAK,GAAK,CAAC3D,EAAI,MAAO,SAExC,IAAMwC,EAAMmB,EAAI,MAAM,GAAG,EAAE,CAAC,EAE5B,OAAW,CAACI,EAAWI,CAAM,IAAK,OAAO,QAAQnE,EAAI,KAAK,EAAG,CAC3D,IAAMY,EAAMkD,EAAaxB,EAAOE,EAAKuB,CAAS,EACxCK,EAASxD,GAAOA,EAAI,cAAgBA,EAAI,aAAe,GAAK,iBAElEsD,EAAM,KAAK,KAAKP,CAAG,IAAII,CAAS,WAAMI,CAAM,GAAGC,CAAM,EAAE,CACzD,CACF,CAEA,GAAIF,EAAM,SAAW,EACrB,CAAA/C,EAAO,KAAK,kBAAkB,EAC9B,QAAWkD,IAAQ,CAAC,GAAGH,CAAK,EAAE,KAAK,EACjC/C,EAAO,KAAKkD,CAAI,EAEpB,EAMMC,EAAsC,MAAOC,EAAKC,IAAU,CAChE,GAAM,CAAE,mBAAAC,CAAmB,EAAI,KAAM,QAAO,wBAAgC,EACtEC,EAAU,MAAMD,EAAmBF,CAAG,EAE5C,OAAO,IAAI,IACTC,EAAM,QAASxD,GAAS,CACtB,IAAM2D,EAAQD,EAAQ,IAAI1D,CAAI,EAE9B,OAAO2D,IAAU,OAAY,CAAC,EAAI,CAAC,CAAC3D,EAAM2D,CAAK,CAAU,CAC3D,CAAC,CACH,CACF,EAOMC,EAAgB,MACpBL,EACAd,EACAnB,EACAuC,IACkB,CAClB,IAAML,EAAQf,EAAO,QAASE,GAAQ,CACpC,IAAMnB,EAAMF,EAAM,KAAK,KAAMwC,GACpB,GAAGA,EAAU,IAAI,QAAUnB,CACnC,EAED,OAAOnB,GAAK,eAAiB,CAACA,EAAI,cAAc,EAAI,CAAC,CACvD,CAAC,EACKuC,EAASP,EAAM,OAAS,EAAI,MAAMK,EAAYN,EAAKC,CAAK,EAAI,IAAI,IAEtE1E,EAAQ,IAAIkF,CAAiB,EAAIT,EAEjC,QAAWvD,KAAQwD,EAAO,CACxB,IAAMG,EAAQI,EAAO,IAAI/D,CAAI,EAEzB2D,EACF7E,EAAQ,IAAIkB,CAAI,EAAI2D,GAGpB,OAAO7E,EAAQ,IAAIkB,CAAI,EACvBG,EAAO,KAAK,kBAAQoD,CAAG,cAAcvD,CAAI,+DAA+D,EAE5G,CACF,EAEMiE,EAAkB,MACtBzB,EACAlB,EACAuC,IACiC,CACjC,GAAIvC,EAAM,KAAK,SAAW,EACxB,OAAAnB,EAAO,KAAK,4BAA4B,EAEjC,KAGT,IAAM+D,EAAkB,MAAM1B,EAAQ,SAAS,CAAE,QAAS,4BAAsB,QAASnB,EAAiBC,CAAK,CAAE,CAAC,EAElH,GAAI4C,EAAgB,SAAW,EAC7B,OAAA/D,EAAO,KAAK,uBAAuB,EAE5B,KAGT,IAAMsC,EAASyB,EAAgB,OAAQC,GAC9BA,EAAE,SAAS,KAAK,CACxB,EACKzB,EAAU,MAAMH,EAAmBC,EAASlB,EAAOmB,CAAM,EAEzD2B,EAAQ,MAAM5B,EAAQ,QAAQ,CAAE,QAAS,+CAAyC,QAAS,EAAK,CAAC,EACjG6B,EAAO/B,EAAS,EAClB,MAAME,EAAQ,QAAQ,CAAE,QAAS,+CAAyC,QAAS,EAAM,CAAC,EAC1F,GAEE8B,EAA6B,CAAE,QAASJ,EAAiB,QAAAxB,EAAS,MAAA0B,EAAO,KAAAC,CAAK,EAC9EpB,EAAOsB,EAAiBD,EAAWhD,CAAK,EAE9C,GAAI2B,EAAK,cAAe,CAKtB,GAAI3B,EAAM,aAAa,SAAW,EAChC,OAAAnB,EAAO,KAAK,iGAAuF,EACnGA,EAAO,KAAK,iEAAiE,EAEtE,KAGTmE,EAAU,IAAM,MAAM9B,EAAQ,OAAO,CACnC,QAAS,yDACT,QAASlB,EAAM,aAAa,IAAKkD,IACxB,CAAE,KAAMA,EAAG,MAAOA,CAAE,EAC5B,CACH,CAAC,EACD,MAAMZ,EAAcU,EAAU,IAAK7B,EAAQnB,EAAOuC,CAAW,CAC/D,CAEA,IAAMY,EAASxC,EAAgBgB,EAAK,UAAW3B,CAAK,EAEpD,GAAImD,EAAO,OAAS,EAAG,CACrBtE,EAAO,KAAK,6DAAmD,EAC/D,QAAWuE,KAASD,EAClBtE,EAAO,KAAK,aAAQuE,CAAK,EAAE,EAG7B,OAAO,IACT,CAEA1B,EAAaC,EAAM3B,CAAK,EACxBqD,EAAW1B,EAAMqB,CAAS,EAK1B,IAAMhE,EAAU2C,EAAK,WAClB,OAAQ2B,GACAA,EAAE,SAAS,MAAM,CACzB,EACA,IAAKA,GACGA,EAAE,MAAM,GAAG,EAAE,CAAC,CACtB,EAIH,OAAIP,GAAQ/D,EAAQ,OAAS,EACpB,CAAE,QAASA,EAAS,UAAW2C,EAAK,UAAW,MAAAmB,EAAO,KAAM,EAAK,GAGtEC,GACFlE,EAAO,KAAK,iHAAkG,EAGzG,CAAE,UAAW8C,EAAK,UAAW,MAAAmB,EAAO,KAAM,EAAM,EACzD,EAGMO,EAAa,CAAC1B,EAAmBqB,IAAqC,CAC1EO,EAAY,eAAe,EAE3B,IAAMC,EAAKC,EAAkB9B,EAAMqB,CAAS,EAE5CO,EAAY,UAAUC,EAAG,MAAO,EAAI,EACpCD,EAAY,MAAM,CACpB,EAMaG,GAAgB,MAC3BxC,EACAlB,EACAuC,EAA2BP,IAEpBW,EAAgBzB,EAASlB,EAAOuC,CAAW,EAOvCoB,GAAe,MAC1BzC,EAAyBzD,EACzBsB,EAAe6E,EAAiBpG,EAAQ,IAAI,CAAC,IAEtCkG,GAAcxC,EAAS,MAAMpC,EAAkBC,CAAI,CAAC",
-  "names": ["inquirerCheckbox", "inquirerConfirm", "inquirerSelect", "loadDev", "loadPackageConfig", "path", "process", "appOf", "key", "byName", "model", "a", "isTwoOption", "route", "rawSource", "uiKey", "sources", "collectLocalPackages", "uiKeys", "apps", "localPkgs", "ownerByPkg", "app", "backend", "frontendOverrides", "overrides", "anyCloud", "backendLocal", "source", "deriveManualPlan", "selection", "t", "apiOnlyKeys", "presetApps", "cloud", "pkg", "owner", "equivalentCommand", "plan", "parts", "promptContext", "process", "defaultPrompts", "cfg", "withEscape", "context", "inquirerSelect", "inquirerCheckbox", "inquirerConfirm", "groupBackends", "routes", "ownerByPkg", "byPkg", "route", "def", "cap", "existing", "loadBackends", "uiDir", "name", "loadDev", "error", "logger", "gatherWizardModel", "root", "apiApps", "discoverApiApps", "uiApps", "discoverUiApps", "a", "apiPkgByName", "uiNames", "apiNames", "allNames", "apps", "hasUi", "path", "loadPackageConfig", "store", "readTokenStore", "buildPartChoices", "model", "choices", "app", "paths", "b", "r", "description", "buildAuditContext", "discovered", "apiPkgByApp", "routeToPkg", "auditManualPlan", "presetDef", "validatePresetProxy", "i", "WIZARD_ORCA_VAR", "asksOrca", "promptRouteSources", "prompts", "uiKeys", "sources", "key", "backend", "answer", "findRouteCap", "routePath", "recapSources", "plan", "lines", "source", "suffix", "line", "loadEnvVarsFromDoppler", "env", "names", "downloadEnvSecrets", "secrets", "value", "applyCloudEnv", "loadEnvVars", "candidate", "values", "INFRA_KIT_ENV_VAR", "runManualBranch", "selectedTargets", "t", "watch", "orca", "selection", "deriveManualPlan", "e", "issues", "issue", "echoManual", "k", "commandEcho", "eq", "equivalentCommand", "runWizardFlow", "runDevWizard", "findMonorepoRoot"]
-}