infra-kit 0.34.0 → 0.36.0

package/dist/{chunk-AWFGP6GY.js.map → chunk-REDCBY4O.js.map}

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/lib/install-manager/install-manager.ts", "../src/lib/install-manager/safe-realpath.ts", "../src/lib/install-manager/npm-root.ts", "../src/lib/pm-env/pm-env.ts"],
-  "sourcesContent": ["/**\n * Pure detection of *how* this CLI was installed, so the background updater knows whether it may act at\n * all, and the advisory it prints can name the one command that will actually work. No fs, no spawn, no `process.env` read \u2014 every input is injected, which is\n * what lets the whole matrix be table-tested.\n *\n * Detection is env-first and LAZY: the only signal that costs a subprocess (`npm root -g`) is passed in\n * as `lazyNpmRoot` and consulted solely when every cheaper matcher has missed.\n */\nimport path from 'node:path'\n\n/** The published package this CLI updates itself to. Single source for every suggested argv. */\nexport const PACKAGE_NAME = 'infra-kit'\n\nconst LATEST = `${PACKAGE_NAME}@latest`\n\nexport type InstallManager = 'npm' | 'pnpm' | 'yarn' | 'bun' | 'volta' | 'homebrew' | 'unknown'\n\nexport interface InstallManagerInfo {\n  manager: InstallManager\n  /** The command to run. Only safe to spawn ourselves when `canSelfSpawn`; otherwise print it. */\n  updateCommand: string[]\n  /** False when we must not run the command for the user \u2014 either it needs sudo/a tap, or we guessed. */\n  canSelfSpawn: boolean\n}\n\n/**\n * Canonicalises a candidate *root* directory. Required, not optional: `selfRealPath` has already had its\n * symlinks followed, so comparing it against a raw `PNPM_HOME`/`npm root -g`/`cwd` compares a resolved\n * path to an unresolved one and silently never matches. macOS is the everyday proof \u2014 `/var` is a symlink\n * to `/private/var`, so a global install under `/var/...` reports `unknown` unless both sides are resolved.\n * Callers inject the real thing; tests inject a stub.\n */\nexport type RealpathFn = (dir: string) => string\n\nexport interface DetectInstallManagerInput {\n  /** Fully-resolved (symlinks followed) path to this CLI's entry file. */\n  selfRealPath: string\n  env: NodeJS.ProcessEnv\n  /** Canonicalises each candidate root before comparison. See {@link RealpathFn}. */\n  realpath: RealpathFn\n  /** `npm root -g`, deferred: invoked at most once, and only when no cheaper matcher hit. */\n  lazyNpmRoot?: () => string | undefined\n  /**\n   * The exact version to install, when the caller has already resolved it. Omitted, the command targets\n   * the `latest` dist-tag \u2014 fine to PRINT, unsafe to RUN: see {@link pinSpec}.\n   */\n  version?: string\n}\n\n/**\n * Swap the `@latest` token for `@<version>`.\n *\n * `pnpm add -g infra-kit@latest` resolves the tag from pnpm's on-disk metadata cache and does not\n * revalidate it when a cached version already satisfies the tag (pnpm 12.3.4, measured: two runs 90+\n * minutes after a publish both reinstalled the stale `latest` while `pnpm view` already reported the new\n * one). The updater had fetched the real latest itself moments earlier, ran the tag command, got exit 0\n * \u2014 nothing was reinstalled \u2014 and recorded `installed`, so the stale binary looked up to date until the\n * next cycle repeated the same no-op. A concrete version the cache has never seen forces the fetch.\n */\nconst pinSpec = (command: string[], version: string | undefined): string[] => {\n  if (version === undefined) return command\n\n  return command.map((token) => {\n    return token === LATEST ? `${PACKAGE_NAME}@${version}` : token\n  })\n}\n\n/**\n * Is `child` inside the `parent` subtree? Boundary-aware: a naive `startsWith` would call\n * `/Users/x/pnpm-ish` a child of `/Users/x/pnpm`. `parent` is canonicalised first because it arrives raw\n * from the environment while `child` is already a realpath.\n */\nexport const isWithin = (parent: string, child: string, realpath: RealpathFn): boolean => {\n  const rel = path.relative(realpath(path.resolve(parent)), path.resolve(child))\n\n  return rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel)\n}\n\n/** Does `p` contain `name` as a whole path SEGMENT? `/a/node_modules_backup/b` must not match `node_modules`. */\nexport const hasSegment = (p: string, name: string): boolean => {\n  return path.resolve(p).split(path.sep).includes(name)\n}\n\n/**\n * Is `p` inside a Homebrew keg belonging to the `name` FORMULA \u2014 i.e. `.../Cellar/<name>/<version>/...`?\n *\n * The formula name is what makes this sound. A bare `Cellar` segment says only \"somewhere under a keg\",\n * and the keg it lands in is routinely someone else's: when npm's global prefix is a node keg\n * (`npm config set prefix \"$(brew --prefix node)\"`, or any keg-only `node@X`), an `npm i -g` package\n * installs to `Cellar/node/<v>/lib/node_modules/<pkg>/...` \u2014 brew has never heard of it, yet the segment\n * is right there. Requiring `<name>` to sit directly after `Cellar` is what separates \"brew installed\n * THIS\" from \"brew installed the runtime that installed this\".\n *\n * Works for both keg layouts, since each is rooted at the formula: a plain formula\n * (`Cellar/infra-kit/1.2.3/bin/infra-kit`) and brew's node-CLI layout\n * (`Cellar/infra-kit/1.2.3/libexec/lib/node_modules/infra-kit/dist/cli.js`). Do NOT try to tell them\n * apart by excluding `node_modules` \u2014 the second one contains it.\n */\nexport const isBrewKegOf = (p: string, name: string): boolean => {\n  const segments = path.resolve(p).split(path.sep)\n  const cellar = segments.indexOf('Cellar')\n\n  return cellar !== -1 && segments[cellar + 1] === name\n}\n\n/**\n * The npm global prefix that owns `binRealPath`, derived from the path ITSELF, or null when the\n * layout is not an npm global one.\n *\n * Matches `<prefix>/lib/node_modules/<packageName>` \u2014 npm's global layout and no other manager's\n * \u2014 requiring BOTH the `lib` parent and our package as the immediate child. Windows global npm has\n * no `lib` segment (`%APPDATA%\\npm\\node_modules`), so this returns null there and detection falls\n * through to `npm root -g`, which is correct on Windows, where there is normally one npm.\n */\n// This is the one signal that cannot point at the wrong tree. Everything else in this module\n// answers \"is this file somewhere inside tool X's directory?\", and containment is not ownership:\n//   - `npm root -g` answers for whichever `npm` is first on PATH, which is routinely a DIFFERENT\n//     node than the one that installed us (a pnpm/nvm/fnm-managed node, or a node that has since\n//     been removed). It then reports a root that does not contain us, every matcher misses, and\n//     detection degrades to `unknown` \u2014 a notice printed forever, on the single most common install\n//     method. That is the bug this exists to close.\n//   - `PNPM_HOME` containment is satisfied by `<PNPM_HOME>/nodejs/<v>/lib/node_modules/<pkg>` (a\n//     plain `npm i -g` under a pnpm-managed node), yet `pnpm add -g` installs to\n//     `<PNPM_HOME>/global/<v>/...` \u2014 a different directory. That one is worse than a missed update:\n//     the install \"succeeds\" while the binary on PATH stays old, silently, with no notice to show\n//     for it.\n//\n// Requiring both segments is what makes the match proof rather than a hint. The `lib` requirement\n// is also what keeps a project-local `<repo>/node_modules/<pkg>` out (it has no `lib`), and nesting\n// cannot spoof it: `.../node_modules/foo/node_modules/<pkg>` fails the `lib` test.\nexport const npmPrefixOfPackage = (binRealPath: string, packageName: string): string | null => {\n  const segments = path.resolve(binRealPath).split(path.sep)\n  const nodeModules = segments.lastIndexOf('node_modules')\n\n  if (nodeModules < 2) return null\n  if (segments[nodeModules - 1] !== 'lib') return null\n  if (segments[nodeModules + 1] !== packageName) return null\n\n  // Drop `lib/node_modules/...`; the empty result of a root-level prefix (`/lib/node_modules/...`) is `/`.\n  return segments.slice(0, nodeModules - 1).join(path.sep) || path.sep\n}\n\n// The self-scoped reading, kept as the name every call site below already uses. `dependency-registry`\n// asks the same question about OTHER packages (`portless`), which is why the body moved up one level\n// rather than gaining a defaulted parameter \u2014 a default is how the wrong package silently gets probed.\nconst npmPrefixFromSelfPath = (selfRealPath: string): string | null => {\n  return npmPrefixOfPackage(selfRealPath, PACKAGE_NAME)\n}\n\n/**\n * `--prefix` is passed EXPLICITLY rather than trusting the ambient one: the whole point of deriving it is\n * that the `npm` we are about to run may default to a different prefix than the one we are installed in.\n * A command-line flag outranks both `npm_config_prefix` and any `.npmrc`, so this targets the tree we\n * actually run from. With `-g`, npm writes `<prefix>/lib/node_modules` and links bins into `<prefix>/bin`.\n */\nconst npmPrefixInstallCommand = (prefix: string): string[] => {\n  return ['npm', 'install', '-g', '--prefix', prefix, LATEST]\n}\n\n/**\n * Render argv as a line the user can paste into a shell.\n *\n * A plain `join(' ')` was fine while every token came from a static table; `--prefix <path>` puts a\n * filesystem path in argv, and `/Users/Ada Lovelace/.nvm/...` pasted unquoted is two arguments and a\n * failed install. Single quotes are sound here without escaping because the callers' validation rejects a\n * token containing a quote \u2014 see `SAFE_COMMAND_TOKEN` in src/lib/update-check/auto-update.ts.\n *\n * @example\n * formatUpdateCommand(['npm', 'install', '-g', '--prefix', '/opt/x y', 'infra-kit@latest'])\n * // => \"npm install -g --prefix '/opt/x y' infra-kit@latest\"\n */\nexport const formatUpdateCommand = (command: string[]): string => {\n  return command\n    .map((token) => {\n      return token.includes(' ') ? `'${token}'` : token\n    })\n    .join(' ')\n}\n\n/** `env[key]` names a directory that contains `selfRealPath`. Absent/empty env var \u2192 no match. */\nconst underEnvDir = (env: NodeJS.ProcessEnv, key: string, selfRealPath: string, realpath: RealpathFn): boolean => {\n  const dir = env[key]\n\n  return dir != null && dir !== '' && isWithin(dir, selfRealPath, realpath)\n}\n\ninterface Matcher extends Omit<InstallManagerInfo, 'manager'> {\n  manager: InstallManager\n  test: (input: Required<Pick<DetectInstallManagerInput, 'selfRealPath' | 'env' | 'realpath'>>) => boolean\n}\n\n/**\n * Consulted FIRST, before {@link npmPrefixFromSelfPath}. Both of these legitimately wrap an npm-shaped\n * `lib/node_modules` tree \u2014 volta at `~/.volta/tools/image/node/<v>/lib/node_modules`, brew at\n * `Cellar/<pkg>/<v>/libexec/lib/node_modules` \u2014 so deriving an npm prefix from the path would hijack\n * installs that a wrapper owns and must keep owning.\n */\nconst WRAPPER_MATCHERS: Matcher[] = [\n  {\n    manager: 'volta',\n    // volta owns the shim; `volta install` is the correct tool, not a workaround \u2014 so we may run it.\n    test: ({ selfRealPath, env, realpath }) => {\n      return (\n        underEnvDir(env, 'VOLTA_HOME', selfRealPath, realpath) ||\n        hasSegment(selfRealPath, '.volta') ||\n        hasSegment(selfRealPath, 'volta')\n      )\n    },\n    updateCommand: ['volta', 'install', PACKAGE_NAME],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'homebrew',\n    // `brew upgrade` can touch the prefix, relink, and prompt \u2014 never ours to run unattended.\n    //\n    // Our own keg is the ONLY sound signal \u2014 see `isBrewKegOf`. Two broader tests look plausible\n    // and are both wrong, because each answers \"did brew put something here?\" when the question is \"does\n    // brew own THIS package?\":\n    //   - `HOMEBREW_PREFIX` containment: when node comes from brew, npm's global prefix IS\n    //     $HOMEBREW_PREFIX, so EVERY `npm i -g` package lands under it, unknown to brew.\n    //   - a bare `Cellar` segment: an npm prefix pointed at a node keg puts packages inside that keg.\n    // Either misfire tells macOS users to run `brew upgrade infra-kit` \u2014 a formula that does not exist \u2014\n    // and, far worse, makes the background auto-updater bail with `cannot-self-spawn` forever, so the\n    // very fix for it can never reach them. Detection runs on the realpath, and a linked brew bin always\n    // resolves into its own keg, so the narrow test has no false negatives to trade for this.\n    test: ({ selfRealPath }) => {\n      return isBrewKegOf(selfRealPath, PACKAGE_NAME)\n    },\n    updateCommand: ['brew', 'upgrade', PACKAGE_NAME],\n    canSelfSpawn: false,\n  },\n]\n\n/**\n * Consulted LAST, after {@link npmPrefixFromSelfPath} has had its say. Each of these proves only that we\n * live somewhere inside a tool's directory tree, which is weaker than knowing the layout npm itself\n * created \u2014 see the `PNPM_HOME`/`nodejs` case in that helper's doc for a containment hit whose install\n * command targets the wrong directory.\n */\nconst TREE_MATCHERS: Matcher[] = [\n  {\n    manager: 'pnpm',\n    test: ({ selfRealPath, env, realpath }) => {\n      return (\n        underEnvDir(env, 'PNPM_HOME', selfRealPath, realpath) ||\n        (hasSegment(selfRealPath, 'pnpm') && hasSegment(selfRealPath, 'global'))\n      )\n    },\n    updateCommand: ['pnpm', 'add', '-g', LATEST],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'bun',\n    test: ({ selfRealPath, env, realpath }) => {\n      return underEnvDir(env, 'BUN_INSTALL', selfRealPath, realpath) || hasSegment(selfRealPath, '.bun')\n    },\n    updateCommand: ['bun', 'add', '-g', LATEST],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'yarn',\n    test: ({ selfRealPath }) => {\n      return (\n        hasSegment(selfRealPath, '.yarn') || (hasSegment(selfRealPath, 'yarn') && hasSegment(selfRealPath, 'global'))\n      )\n    },\n    updateCommand: ['yarn', 'global', 'add', LATEST],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'npm',\n    test: ({ selfRealPath, env, realpath }) => {\n      return underEnvDir(env, 'npm_config_prefix', selfRealPath, realpath)\n    },\n    updateCommand: ['npm', 'install', '-g', LATEST],\n    canSelfSpawn: true,\n  },\n]\n\nconst NPM_UPDATE_COMMAND = ['npm', 'install', '-g', LATEST]\n\n/**\n * The command to print when nobody has identified this CLI's package manager \u2014 the same guess\n * `detectInstallManager` records for an unrecognised location, pinned to `version`. For a caller that\n * must name a command but has no worker verdict to read (no update cache on an opt-out machine).\n *\n * @example\n * fallbackUpdateCommand('0.8.0') // => ['npm', 'install', '-g', 'infra-kit@0.8.0']\n */\nexport const fallbackUpdateCommand = (version: string): string[] => {\n  return pinSpec(NPM_UPDATE_COMMAND, version)\n}\n\n/**\n * Identify the package manager that owns `selfRealPath`.\n *\n * Order, and why it is this one: wrappers that own an npm-shaped tree (volta, brew) first, then the npm\n * prefix DERIVED from our own path, then the env/path containment matchers, then the `npm root -g` probe.\n * The derived prefix sits above containment because it is the only signal that cannot name a directory we\n * do not live in \u2014 see {@link npmPrefixFromSelfPath}.\n *\n * `lazyNpmRoot` is the last resort and is invoked at most once, only after every matcher has missed \u2014 a\n * pnpm or volta install never pays for the subprocess, and neither does any npm global install in the\n * standard layout, which the derived prefix now settles for free. When nothing matches we report `unknown`\n * with an npm command that is a *suggestion only* (`canSelfSpawn: false`): running a guessed global\n * install is worse than printing one.\n *\n * @example\n * detectInstallManager({ selfRealPath: '/Users/x/Library/pnpm/global/5/node_modules/infra-kit/dist/cli.js', env: {} })\n * // => { manager: 'pnpm', updateCommand: ['pnpm', 'add', '-g', 'infra-kit@latest'], canSelfSpawn: true }\n * detectInstallManager({ selfRealPath: '/Users/x/Library/pnpm/global/5/node_modules/infra-kit/dist/cli.js', env: {}, version: '0.5.5' })\n * // => { manager: 'pnpm', updateCommand: ['pnpm', 'add', '-g', 'infra-kit@0.5.5'], canSelfSpawn: true }\n */\nexport const detectInstallManager = (input: DetectInstallManagerInput): InstallManagerInfo => {\n  const { selfRealPath, env, realpath, lazyNpmRoot, version } = input\n  const detected = detectUnpinned({ selfRealPath, env, realpath, lazyNpmRoot })\n\n  return { ...detected, updateCommand: pinSpec(detected.updateCommand, version) }\n}\n\nconst detectUnpinned = (input: DetectInstallManagerInput): InstallManagerInfo => {\n  const { selfRealPath, env, realpath, lazyNpmRoot } = input\n  const toInfo = (hit: Matcher): InstallManagerInfo => {\n    return { manager: hit.manager, updateCommand: hit.updateCommand, canSelfSpawn: hit.canSelfSpawn }\n  }\n  const matches = ({ test }: Matcher): boolean => {\n    return test({ selfRealPath, env, realpath })\n  }\n\n  const wrapper = WRAPPER_MATCHERS.find(matches)\n\n  if (wrapper) return toInfo(wrapper)\n\n  const derivedPrefix = npmPrefixFromSelfPath(selfRealPath)\n\n  if (derivedPrefix !== null) {\n    return { manager: 'npm', updateCommand: npmPrefixInstallCommand(derivedPrefix), canSelfSpawn: true }\n  }\n\n  const tree = TREE_MATCHERS.find(matches)\n\n  if (tree) return toInfo(tree)\n\n  const npmRoot = lazyNpmRoot?.()\n\n  if (npmRoot != null && npmRoot !== '' && isWithin(npmRoot, selfRealPath, realpath)) {\n    return { manager: 'npm', updateCommand: NPM_UPDATE_COMMAND, canSelfSpawn: true }\n  }\n\n  return { manager: 'unknown', updateCommand: NPM_UPDATE_COMMAND, canSelfSpawn: false }\n}\n\n/**\n * Is this CLI running from a *project-local* `node_modules` (as opposed to a global root)?\n *\n * The cwd clause is what does the distinguishing \u2014 BOTH a project install and a global root contain a\n * `/node_modules/` segment (`pnpm root -g` is `~/Library/pnpm/global/5/node_modules`). Without it we\n * would nag every global pnpm user to stop using a local install they do not have.\n *\n * Accepted false-negative: invoked from a subdirectory (cwd `project/apps/x`, deps at\n * `project/node_modules`) this returns false and the advisory stays silent. Under-warning is the safe\n * direction for a best-effort, never-throwing advisory \u2014 do not \"fix\" it by dropping the cwd clause.\n *\n * `cwd` is canonicalised before comparison for the same reason `detectInstallManager` canonicalises its\n * roots: `selfRealPath` is a realpath, and comparing it to an unresolved cwd never matches.\n *\n * @example\n * isLocalNodeModulesInstall('/repo/node_modules/infra-kit/dist/cli.js', '/repo', (p) => p) // => true\n */\nexport const isLocalNodeModulesInstall = (selfRealPath: string, cwd: string, realpath: RealpathFn): boolean => {\n  return hasSegment(selfRealPath, 'node_modules') && isWithin(cwd, selfRealPath, realpath)\n}\n\n/** Does this path exist at all \u2014 directory, file, or symlink? Injected so the walk never touches the real disk in tests. */\nexport type ExistsFn = (p: string) => boolean\n\nexport interface IsGlobalInstallInput {\n  /** Fully-resolved (symlinks followed) path to this CLI's entry file. */\n  selfRealPath: string\n  env: NodeJS.ProcessEnv\n  /** Canonicalises `home` and every root {@link detectInstallManager} compares against. */\n  realpath: RealpathFn\n  /** The user's home directory (`os.homedir()`), raw \u2014 canonicalised here before the walk compares it. */\n  home: string\n  exists: ExistsFn\n}\n\n/** Upper bound on the `.git` walk: deeper than any real install layout, so it only ever guards against a pathological path. */\nconst GIT_WALK_MAX_HOPS = 32\n\n/**\n * Where the `.git` walk starts: the parent of the OUTERMOST `node_modules` segment (`indexOf`, not\n * `lastIndexOf` \u2014 pnpm's `.pnpm/<pkg>@<v>/node_modules/<pkg>` nests two, and the checkout that owns the\n * tree sits above the first). A self path with no `node_modules` at all (a plain brew keg's `bin/`) starts\n * at its own directory, so the walk still inspects every ancestor.\n */\nconst gitWalkStart = (selfRealPath: string): string => {\n  const segments = path.resolve(selfRealPath).split(path.sep)\n  const outermost = segments.indexOf('node_modules')\n\n  if (outermost === -1) return path.dirname(selfRealPath)\n\n  return segments.slice(0, outermost).join(path.sep) || path.sep\n}\n\n/** `start` and its ancestors up to but EXCLUDING `homeReal`, bounded \u2014 the directories the `.git` walk may inspect. */\nconst ancestorsBelowHome = (start: string, homeReal: string): string[] => {\n  const dirs: string[] = []\n  let dir = start\n\n  while (dir !== homeReal && dirs.length < GIT_WALK_MAX_HOPS) {\n    dirs.push(dir)\n\n    const parent = path.dirname(dir)\n\n    if (parent === dir) break\n\n    dir = parent\n  }\n\n  return dirs\n}\n\nconst hasGitAncestor = (start: string, homeReal: string, exists: ExistsFn): boolean => {\n  return ancestorsBelowHome(start, homeReal).some((dir) => {\n    return exists(path.join(dir, '.git'))\n  })\n}\n\n/**\n * Is this CLI the machine's *global* install \u2014 the one a root-owned daemon or a system-wide link may be\n * aimed at \u2014 as opposed to a checkout or a project-local dependency? Probe-free: fs + env only, never a\n * subprocess, because it runs on every boot.\n *\n * True iff {@link detectInstallManager} names a manager AND no `.git` entry (directory or file \u2014 a\n * worktree's is a file) exists above the outermost `node_modules`, walking up to but EXCLUDING\n * `realpath(home)`. Never throws: any seam failure reports false, the safe direction for every caller.\n *\n * @example\n * isGlobalInstall({\n *   selfRealPath: '/Users/x/Library/pnpm/global/v11/8a83-1/node_modules/.pnpm/infra-kit@0.5.6/node_modules/infra-kit/dist/cli.js',\n *   env: { PNPM_HOME: '/Users/x/Library/pnpm' },\n *   realpath: (p) => p,\n *   home: '/Users/x',\n *   exists: (p) => p === '/Users/x/.git',\n * }) // => true \u2014 the only `.git` is $HOME's own, which the walk never inspects\n */\n// Why these two predicates and not the obvious candidates:\n//   - Not `canSelfSpawn`: that flag encodes \"may I run an unattended `npm i -g`\", and homebrew is\n//     `canSelfSpawn: false` while being unmistakably global \u2014 gating on it would leave a brew install\n//     unconverged forever. A global install whose manager cannot be identified in a stripped env (no\n//     `PNPM_HOME`, no derivable prefix) reports false: fail-safe, since a skipped write is never wrong and\n//     the next shell-run command converges it.\n//   - Not `isLocalNodeModulesInstall`: its cwd clause calls every global layout under `$HOME` \"local\" the\n//     moment cwd is `$HOME` \u2014 which is exactly the cwd the background updater spawns with, and a plain\n//     `cd ~ && infra-kit version` reproduces it. This predicate reads the tree, not the cwd.\n//   - Why the `.git` walk at all: the cheap matchers are segment heuristics that also fire on\n//     project-local shapes \u2014 a repo with a `volta` path segment, Yarn Berry's `.yarn/unplugged/\u2026`, a\n//     checkout cloned under `$PNPM_HOME`, a workspace package literally named `lib` \u2014 and every one of\n//     those is a checkout; every checkout has a `.git`, no global root does.\n//   - Why `$HOME` is excluded: dotfiles users `git init ~`, and a `~/.git` would refuse the pnpm-global\n//     install permanently. Every checkout under `$HOME` (`~/repo/.git`) is still strictly below it.\n//   - Why `.git` ONLY, not `pnpm-workspace.yaml`: pnpm 12 writes one INSIDE the global install dir, so\n//     that marker would refuse the very install this is for.\nexport const isGlobalInstall = (input: IsGlobalInstallInput): boolean => {\n  try {\n    const { selfRealPath, env, realpath, home, exists } = input\n\n    if (detectInstallManager({ selfRealPath, env, realpath }).manager === 'unknown') return false\n\n    return !hasGitAncestor(gitWalkStart(selfRealPath), realpath(path.resolve(home)), exists)\n  } catch {\n    return false\n  }\n}\n\n/**\n * The advisory gate for `warnIfLocalInstall`, pulled out so it is testable without spawning the CLI.\n * Warn only when the install is provably NOT global AND looks project-local: the second clause alone\n * fires on a global pnpm root whenever cwd is `$HOME` (see {@link isGlobalInstall}).\n */\nexport const shouldWarnLocalInstall = (input: IsGlobalInstallInput & { cwd: string }): boolean => {\n  const { selfRealPath, cwd, realpath } = input\n\n  return !isGlobalInstall(input) && isLocalNodeModulesInstall(selfRealPath, cwd, realpath)\n}\n", "import { realpathSync } from 'node:fs'\nimport path from 'node:path'\n\n/**\n * The impure companion to the pure detection module: canonicalise a directory that may not exist.\n *\n * `realpathSync` throws on a missing path, and candidate roots routinely miss \u2014 `PNPM_HOME` can point at a\n * directory the user never created, `npm root -g` can name a prefix that was removed. A throw there would\n * turn \"we could not identify your install\" into a crash, so an unresolvable path falls back to\n * `path.resolve`, which still normalises `.`/`..` and yields a usable, non-matching absolute path.\n */\nexport const safeRealpath = (dir: string): string => {\n  try {\n    return realpathSync(dir)\n  } catch {\n    return path.resolve(dir)\n  }\n}\n", "/* eslint-disable sonarjs/no-os-command-from-path */\n/**\n * `npm root -g`, the LAZY fallback for {@link detectInstallManager}.\n *\n * Why it is indispensable: the `npm` matcher keys off `npm_config_prefix`, which npm sets only while npm\n * itself is running. A user who ran `npm i -g infra-kit` months ago and now types `ik` has no such var,\n * so every cheap matcher misses and detection reports `unknown` / `canSelfSpawn: false`. Without this\n * probe the single most common install method can never update itself.\n *\n * Read by the background update worker, and by the `doctor` advisory that names the command a human\n * would run by hand \u2014 one probe so the two can never disagree about who owns the install.\n */\nimport { execFileSync } from 'node:child_process'\nimport process from 'node:process'\n\nconst NPM_ROOT_TIMEOUT_MS = 3_000\n\n/**\n * The global npm root, or undefined when npm is absent, slow, or errors. Costs a subprocess, so\n * `detectInstallManager` invokes it at most once and only after every env/path matcher has missed \u2014 a\n * pnpm or volta install never pays for it.\n *\n * Resolving the user's `npm` from PATH is inherent here: we must ask the very package manager that owns\n * this install where its global root is. Pinning an absolute path would defeat the detection.\n *\n * @example\n * defaultLazyNpmRoot() // => '/usr/local/lib/node_modules' | undefined\n */\nexport const defaultLazyNpmRoot = (): string | undefined => {\n  try {\n    const out = execFileSync('npm', ['root', '-g'], {\n      encoding: 'utf-8',\n      timeout: NPM_ROOT_TIMEOUT_MS,\n      stdio: ['ignore', 'pipe', 'ignore'],\n      shell: process.platform === 'win32',\n    })\n    const trimmed = out.trim()\n\n    return trimmed === '' ? undefined : trimmed\n  } catch {\n    return undefined\n  }\n}\n", "/**\n * `env` minus every package-manager marker a spawned child could mistake for a throwaway install:\n * the whole `npm_*` block plus `PNPM_SCRIPT_SRC_DIR`. The result makes the child look exactly like\n * a direct `node <pkg>/dist/cli.js` run \u2014 which it is.\n */\n// Any child we launch through `node <bin>` (the portless driver, the update worker, the dependency installer)\n// inherits our env, and a tool that sniffs those markers will conclude it was run via `npx`/`pnpm\n// dlx` and refuse to work. portless is the motivating case; its guard (cli.js `main()`) is:\n//\n//     isNpx     = npm_command === 'exec' && !npm_lifecycle_event\n//     isPnpmDlx = !!PNPM_SCRIPT_SRC_DIR  && !npm_lifecycle_event\n//     if ((isNpx || isPnpmDlx) && !isLocallyInstalled()) -> abort\n//\n// `isLocallyInstalled()` walks up from the CHILD's cwd, so in a consumer repo (where portless is a\n// transitive dep of infra-kit, absent from the root `node_modules`) it is false and the guard is\n// live. `pnpm exec infra-kit dev` exports `npm_command=exec` with no lifecycle event, so `isNpx`\n// holds, every portless call exits 1, `isAvailable()` is false, and `ensureProxy` aborts the whole\n// dev boot with \"portless is not installed\", on a machine where it plainly is.\n//\n// `PNPM_SCRIPT_SRC_DIR` must be dropped ALONGSIDE the `npm_*` block, not left behind: it is set by\n// `pnpm run <script>`, where `npm_lifecycle_event` is what suppresses `isPnpmDlx`. Stripping only\n// `npm_*` removes that suppressor and creates an abort for the script-style invocation that\n// previously worked. Both markers go, or neither is safe.\nexport const withoutPackageManagerEnv = (env: NodeJS.ProcessEnv): NodeJS.ProcessEnv => {\n  return Object.fromEntries(\n    Object.entries(env).filter(([key]) => {\n      return !key.startsWith('npm_') && key !== 'PNPM_SCRIPT_SRC_DIR'\n    }),\n  )\n}\n\n/**\n * npm's own configuration \u2014 as opposed to the npx/dlx *markers* above. Case-insensitive because npm reads\n * `npm_config_*` case-insensitively (its parser matches `/^npm_config_/i`) and real environments export\n * both forms: shells write the lowercase name, Dockerfiles and CI images overwhelmingly write the\n * uppercase one.\n */\nconst NPM_CONFIG_TO_PRESERVE = /^npm_config_(?:prefix|registry)$/i\n\n/**\n * The env for spawning a package-manager INSTALL: npx/dlx markers stripped, but npm's own config\n * kept \u2014 specifically `npm_config_prefix` and `npm_config_registry`.\n *\n * @example\n * packageManagerInstallEnv({ npm_command: 'exec', npm_config_prefix: '/p', PATH: '/bin' })\n * // => { npm_config_prefix: '/p', PATH: '/bin' }\n */\n// `withoutPackageManagerEnv` is deliberately a blunt `npm_*` prefix filter, and it is the\n// right tool for the portless driver \u2014 but it is the WRONG tool for spawning an install, because it\n// also drops the two variables that tell the package manager where, and from where, to install:\n//\n//   - `npm_config_prefix` is the npm matcher's ONLY signal (see `install-manager.ts`). Strip it and\n//     we detect a global install rooted at prefix P, then run the install with P erased \u2014 so it\n//     lands in the DEFAULT prefix instead. That is either a permanent EACCES, or a second global\n//     copy that is not the one on PATH. Nothing notices: the install exits 0, we report\n//     `installed`, the version on PATH never moves, and the whole cycle repeats every window\n//     forever. `export npm_config_prefix=~/.npm-global` is npm's own documented EACCES workaround,\n//     so this is a mainstream layout, not an exotic one.\n//   - `npm_config_registry` is what the update CHECK already used to pick a registry. Dropping it\n//     here means we decide against a corporate mirror and then install from somewhere else.\n//\n// Preserving these cannot re-arm the dlx guard: that guard reads `npm_command`,\n// `npm_lifecycle_event` and `PNPM_SCRIPT_SRC_DIR` \u2014 none of which are npm config, and all of which\n// remain stripped.\nexport const packageManagerInstallEnv = (env: NodeJS.ProcessEnv): NodeJS.ProcessEnv => {\n  const sanitised = withoutPackageManagerEnv(env)\n\n  for (const [key, value] of Object.entries(env)) {\n    if (NPM_CONFIG_TO_PRESERVE.test(key)) sanitised[key] = value\n  }\n\n  return sanitised\n}\n"],
-  "mappings": "AAQA,OAAOA,MAAU,YAGV,IAAMC,EAAe,YAEtBC,EAAS,GAAGD,CAAY,UA8CxBE,EAAU,CAACC,EAAmBC,IAC9BA,IAAY,OAAkBD,EAE3BA,EAAQ,IAAKE,GACXA,IAAUJ,EAAS,GAAGD,CAAY,IAAII,CAAO,GAAKC,CAC1D,EAQUC,EAAW,CAACC,EAAgBC,EAAeC,IAAkC,CACxF,IAAMC,EAAMX,EAAK,SAASU,EAASV,EAAK,QAAQQ,CAAM,CAAC,EAAGR,EAAK,QAAQS,CAAK,CAAC,EAE7E,OAAOE,IAAQ,IAAM,CAACA,EAAI,WAAW,IAAI,GAAK,CAACX,EAAK,WAAWW,CAAG,CACpE,EAGaC,EAAa,CAACC,EAAWC,IAC7Bd,EAAK,QAAQa,CAAC,EAAE,MAAMb,EAAK,GAAG,EAAE,SAASc,CAAI,EAkBzCC,EAAc,CAACF,EAAWC,IAA0B,CAC/D,IAAME,EAAWhB,EAAK,QAAQa,CAAC,EAAE,MAAMb,EAAK,GAAG,EACzCiB,EAASD,EAAS,QAAQ,QAAQ,EAExC,OAAOC,IAAW,IAAMD,EAASC,EAAS,CAAC,IAAMH,CACnD,EA2BaI,EAAqB,CAACC,EAAqBC,IAAuC,CAC7F,IAAMJ,EAAWhB,EAAK,QAAQmB,CAAW,EAAE,MAAMnB,EAAK,GAAG,EACnDqB,EAAcL,EAAS,YAAY,cAAc,EAIvD,OAFIK,EAAc,GACdL,EAASK,EAAc,CAAC,IAAM,OAC9BL,EAASK,EAAc,CAAC,IAAMD,EAAoB,KAG/CJ,EAAS,MAAM,EAAGK,EAAc,CAAC,EAAE,KAAKrB,EAAK,GAAG,GAAKA,EAAK,GACnE,EAKMsB,EAAyBC,GACtBL,EAAmBK,EAActB,CAAY,EAShDuB,EAA2BC,GACxB,CAAC,MAAO,UAAW,KAAM,WAAYA,EAAQvB,CAAM,EAe/CwB,EAAuBtB,GAC3BA,EACJ,IAAKE,GACGA,EAAM,SAAS,GAAG,EAAI,IAAIA,CAAK,IAAMA,CAC7C,EACA,KAAK,GAAG,EAIPqB,EAAc,CAACC,EAAwBC,EAAaN,EAAsBb,IAAkC,CAChH,IAAMoB,EAAMF,EAAIC,CAAG,EAEnB,OAAOC,GAAO,MAAQA,IAAQ,IAAMvB,EAASuB,EAAKP,EAAcb,CAAQ,CAC1E,EAaMqB,EAA8B,CAClC,CACE,QAAS,QAET,KAAM,CAAC,CAAE,aAAAR,EAAc,IAAAK,EAAK,SAAAlB,CAAS,IAEjCiB,EAAYC,EAAK,aAAcL,EAAcb,CAAQ,GACrDE,EAAWW,EAAc,QAAQ,GACjCX,EAAWW,EAAc,OAAO,EAGpC,cAAe,CAAC,QAAS,UAAWtB,CAAY,EAChD,aAAc,EAChB,EACA,CACE,QAAS,WAaT,KAAM,CAAC,CAAE,aAAAsB,CAAa,IACbR,EAAYQ,EAActB,CAAY,EAE/C,cAAe,CAAC,OAAQ,UAAWA,CAAY,EAC/C,aAAc,EAChB,CACF,EAQM+B,EAA2B,CAC/B,CACE,QAAS,OACT,KAAM,CAAC,CAAE,aAAAT,EAAc,IAAAK,EAAK,SAAAlB,CAAS,IAEjCiB,EAAYC,EAAK,YAAaL,EAAcb,CAAQ,GACnDE,EAAWW,EAAc,MAAM,GAAKX,EAAWW,EAAc,QAAQ,EAG1E,cAAe,CAAC,OAAQ,MAAO,KAAMrB,CAAM,EAC3C,aAAc,EAChB,EACA,CACE,QAAS,MACT,KAAM,CAAC,CAAE,aAAAqB,EAAc,IAAAK,EAAK,SAAAlB,CAAS,IAC5BiB,EAAYC,EAAK,cAAeL,EAAcb,CAAQ,GAAKE,EAAWW,EAAc,MAAM,EAEnG,cAAe,CAAC,MAAO,MAAO,KAAMrB,CAAM,EAC1C,aAAc,EAChB,EACA,CACE,QAAS,OACT,KAAM,CAAC,CAAE,aAAAqB,CAAa,IAElBX,EAAWW,EAAc,OAAO,GAAMX,EAAWW,EAAc,MAAM,GAAKX,EAAWW,EAAc,QAAQ,EAG/G,cAAe,CAAC,OAAQ,SAAU,MAAOrB,CAAM,EAC/C,aAAc,EAChB,EACA,CACE,QAAS,MACT,KAAM,CAAC,CAAE,aAAAqB,EAAc,IAAAK,EAAK,SAAAlB,CAAS,IAC5BiB,EAAYC,EAAK,oBAAqBL,EAAcb,CAAQ,EAErE,cAAe,CAAC,MAAO,UAAW,KAAMR,CAAM,EAC9C,aAAc,EAChB,CACF,EAEM+B,EAAqB,CAAC,MAAO,UAAW,KAAM/B,CAAM,EAU7CgC,EAAyB7B,GAC7BF,EAAQ8B,EAAoB5B,CAAO,EAuB/B8B,EAAwBC,GAAyD,CAC5F,GAAM,CAAE,aAAAb,EAAc,IAAAK,EAAK,SAAAlB,EAAU,YAAA2B,EAAa,QAAAhC,CAAQ,EAAI+B,EACxDE,EAAWC,EAAe,CAAE,aAAAhB,EAAc,IAAAK,EAAK,SAAAlB,EAAU,YAAA2B,CAAY,CAAC,EAE5E,MAAO,CAAE,GAAGC,EAAU,cAAenC,EAAQmC,EAAS,cAAejC,CAAO,CAAE,CAChF,EAEMkC,EAAkBH,GAAyD,CAC/E,GAAM,CAAE,aAAAb,EAAc,IAAAK,EAAK,SAAAlB,EAAU,YAAA2B,CAAY,EAAID,EAC/CI,EAAUC,IACP,CAAE,QAASA,EAAI,QAAS,cAAeA,EAAI,cAAe,aAAcA,EAAI,YAAa,GAE5FC,EAAU,CAAC,CAAE,KAAAC,CAAK,IACfA,EAAK,CAAE,aAAApB,EAAc,IAAAK,EAAK,SAAAlB,CAAS,CAAC,EAGvCkC,EAAUb,EAAiB,KAAKW,CAAO,EAE7C,GAAIE,EAAS,OAAOJ,EAAOI,CAAO,EAElC,IAAMC,EAAgBvB,EAAsBC,CAAY,EAExD,GAAIsB,IAAkB,KACpB,MAAO,CAAE,QAAS,MAAO,cAAerB,EAAwBqB,CAAa,EAAG,aAAc,EAAK,EAGrG,IAAMC,EAAOd,EAAc,KAAKU,CAAO,EAEvC,GAAII,EAAM,OAAON,EAAOM,CAAI,EAE5B,IAAMC,EAAUV,IAAc,EAE9B,OAAIU,GAAW,MAAQA,IAAY,IAAMxC,EAASwC,EAASxB,EAAcb,CAAQ,EACxE,CAAE,QAAS,MAAO,cAAeuB,EAAoB,aAAc,EAAK,EAG1E,CAAE,QAAS,UAAW,cAAeA,EAAoB,aAAc,EAAM,CACtF,EAmBae,EAA4B,CAACzB,EAAsB0B,EAAavC,IACpEE,EAAWW,EAAc,cAAc,GAAKhB,EAAS0C,EAAK1B,EAAcb,CAAQ,EAkBnFwC,EAAoB,GAQpBC,EAAgB5B,GAAiC,CACrD,IAAMP,EAAWhB,EAAK,QAAQuB,CAAY,EAAE,MAAMvB,EAAK,GAAG,EACpDoD,EAAYpC,EAAS,QAAQ,cAAc,EAEjD,OAAIoC,IAAc,GAAWpD,EAAK,QAAQuB,CAAY,EAE/CP,EAAS,MAAM,EAAGoC,CAAS,EAAE,KAAKpD,EAAK,GAAG,GAAKA,EAAK,GAC7D,EAGMqD,EAAqB,CAACC,EAAeC,IAA+B,CACxE,IAAMC,EAAiB,CAAC,EACpB1B,EAAMwB,EAEV,KAAOxB,IAAQyB,GAAYC,EAAK,OAASN,GAAmB,CAC1DM,EAAK,KAAK1B,CAAG,EAEb,IAAMtB,EAASR,EAAK,QAAQ8B,CAAG,EAE/B,GAAItB,IAAWsB,EAAK,MAEpBA,EAAMtB,CACR,CAEA,OAAOgD,CACT,EAEMC,EAAiB,CAACH,EAAeC,EAAkBG,IAChDL,EAAmBC,EAAOC,CAAQ,EAAE,KAAMzB,GACxC4B,EAAO1D,EAAK,KAAK8B,EAAK,MAAM,CAAC,CACrC,EAsCU6B,EAAmBvB,GAAyC,CACvE,GAAI,CACF,GAAM,CAAE,aAAAb,EAAc,IAAAK,EAAK,SAAAlB,EAAU,KAAAkD,EAAM,OAAAF,CAAO,EAAItB,EAEtD,OAAID,EAAqB,CAAE,aAAAZ,EAAc,IAAAK,EAAK,SAAAlB,CAAS,CAAC,EAAE,UAAY,UAAkB,GAEjF,CAAC+C,EAAeN,EAAa5B,CAAY,EAAGb,EAASV,EAAK,QAAQ4D,CAAI,CAAC,EAAGF,CAAM,CACzF,MAAQ,CACN,MAAO,EACT,CACF,EAOaG,EAA0BzB,GAA2D,CAChG,GAAM,CAAE,aAAAb,EAAc,IAAA0B,EAAK,SAAAvC,CAAS,EAAI0B,EAExC,MAAO,CAACuB,EAAgBvB,CAAK,GAAKY,EAA0BzB,EAAc0B,EAAKvC,CAAQ,CACzF,ECreA,OAAS,gBAAAoD,MAAoB,UAC7B,OAAOC,MAAU,YAUV,IAAMC,EAAgBC,GAAwB,CACnD,GAAI,CACF,OAAOH,EAAaG,CAAG,CACzB,MAAQ,CACN,OAAOF,EAAK,QAAQE,CAAG,CACzB,CACF,ECLA,OAAS,gBAAAC,MAAoB,qBAC7B,OAAOC,MAAa,eAEpB,IAAMC,EAAsB,IAafC,EAAqB,IAA0B,CAC1D,GAAI,CAOF,IAAMC,EANMJ,EAAa,MAAO,CAAC,OAAQ,IAAI,EAAG,CAC9C,SAAU,QACV,QAASE,EACT,MAAO,CAAC,SAAU,OAAQ,QAAQ,EAClC,MAAOD,EAAQ,WAAa,OAC9B,CAAC,EACmB,KAAK,EAEzB,OAAOG,IAAY,GAAK,OAAYA,CACtC,MAAQ,CACN,MACF,CACF,ECnBO,IAAMC,EAA4BC,GAChC,OAAO,YACZ,OAAO,QAAQA,CAAG,EAAE,OAAO,CAAC,CAACC,CAAG,IACvB,CAACA,EAAI,WAAW,MAAM,GAAKA,IAAQ,qBAC3C,CACH,EASIC,EAAyB,oCA2BlBC,EAA4BH,GAA8C,CACrF,IAAMI,EAAYL,EAAyBC,CAAG,EAE9C,OAAW,CAACC,EAAKI,CAAK,IAAK,OAAO,QAAQL,CAAG,EACvCE,EAAuB,KAAKD,CAAG,IAAGG,EAAUH,CAAG,EAAII,GAGzD,OAAOD,CACT",
+  "sourcesContent": ["/**\n * Pure detection of *how* this CLI was installed, so the background updater knows whether it may act at\n * all, and the advisory it prints can name the one command that will actually work. No fs, no spawn, no `process.env` read \u2014 every input is injected, which is\n * what lets the whole matrix be table-tested.\n *\n * Detection is env-first and LAZY: the only signal that costs a subprocess (`npm root -g`) is passed in\n * as `lazyNpmRoot` and consulted solely when every cheaper matcher has missed.\n */\nimport path from 'node:path'\n\n/** The published package this CLI updates itself to. Single source for every suggested argv. */\nexport const PACKAGE_NAME = 'infra-kit'\n\nconst LATEST = `${PACKAGE_NAME}@latest`\n\nexport type InstallManager = 'npm' | 'pnpm' | 'yarn' | 'bun' | 'volta' | 'homebrew' | 'unknown'\n\nexport interface InstallManagerInfo {\n  manager: InstallManager\n  /** The command to run. Only safe to spawn ourselves when `canSelfSpawn`; otherwise print it. */\n  updateCommand: string[]\n  /** False when we must not run the command for the user \u2014 either it needs sudo/a tap, or we guessed. */\n  canSelfSpawn: boolean\n}\n\n/**\n * Canonicalises a candidate *root* directory. Required, not optional: `selfRealPath` has already had its\n * symlinks followed, so comparing it against a raw `PNPM_HOME`/`npm root -g`/`cwd` compares a resolved\n * path to an unresolved one and silently never matches. macOS is the everyday proof \u2014 `/var` is a symlink\n * to `/private/var`, so a global install under `/var/...` reports `unknown` unless both sides are resolved.\n * Callers inject the real thing; tests inject a stub.\n */\nexport type RealpathFn = (dir: string) => string\n\nexport interface DetectInstallManagerInput {\n  /** Fully-resolved (symlinks followed) path to this CLI's entry file. */\n  selfRealPath: string\n  env: NodeJS.ProcessEnv\n  /** Canonicalises each candidate root before comparison. See {@link RealpathFn}. */\n  realpath: RealpathFn\n  /** `npm root -g`, deferred: invoked at most once, and only when no cheaper matcher hit. */\n  lazyNpmRoot?: () => string | undefined\n  /**\n   * The exact version to install, when the caller has already resolved it. Omitted, the command targets\n   * the `latest` dist-tag \u2014 fine to PRINT, unsafe to RUN: see {@link pinSpec}.\n   */\n  version?: string\n}\n\n/**\n * Swap the `@latest` token for `@<version>`.\n *\n * `pnpm add -g infra-kit@latest` resolves the tag from pnpm's on-disk metadata cache and does not\n * revalidate it when a cached version already satisfies the tag (pnpm 12.3.4, measured: two runs 90+\n * minutes after a publish both reinstalled the stale `latest` while `pnpm view` already reported the new\n * one). The updater had fetched the real latest itself moments earlier, ran the tag command, got exit 0\n * \u2014 nothing was reinstalled \u2014 and recorded `installed`, so the stale binary looked up to date until the\n * next cycle repeated the same no-op. A concrete version the cache has never seen forces the fetch.\n */\nconst pinSpec = (command: string[], version: string | undefined): string[] => {\n  if (version === undefined) return command\n\n  return command.map((token) => {\n    return token === LATEST ? `${PACKAGE_NAME}@${version}` : token\n  })\n}\n\n/**\n * Is `child` inside the `parent` subtree? Boundary-aware: a naive `startsWith` would call\n * `/Users/x/pnpm-ish` a child of `/Users/x/pnpm`. `parent` is canonicalised first because it arrives raw\n * from the environment while `child` is already a realpath.\n */\nexport const isWithin = (parent: string, child: string, realpath: RealpathFn): boolean => {\n  const rel = path.relative(realpath(path.resolve(parent)), path.resolve(child))\n\n  return rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel)\n}\n\n/** Does `p` contain `name` as a whole path SEGMENT? `/a/node_modules_backup/b` must not match `node_modules`. */\nexport const hasSegment = (p: string, name: string): boolean => {\n  return path.resolve(p).split(path.sep).includes(name)\n}\n\n/**\n * Is `p` inside a Homebrew keg belonging to the `name` FORMULA \u2014 i.e. `.../Cellar/<name>/<version>/...`?\n *\n * The formula name is what makes this sound. A bare `Cellar` segment says only \"somewhere under a keg\",\n * and the keg it lands in is routinely someone else's: when npm's global prefix is a node keg\n * (`npm config set prefix \"$(brew --prefix node)\"`, or any keg-only `node@X`), an `npm i -g` package\n * installs to `Cellar/node/<v>/lib/node_modules/<pkg>/...` \u2014 brew has never heard of it, yet the segment\n * is right there. Requiring `<name>` to sit directly after `Cellar` is what separates \"brew installed\n * THIS\" from \"brew installed the runtime that installed this\".\n *\n * Works for both keg layouts, since each is rooted at the formula: a plain formula\n * (`Cellar/infra-kit/1.2.3/bin/infra-kit`) and brew's node-CLI layout\n * (`Cellar/infra-kit/1.2.3/libexec/lib/node_modules/infra-kit/dist/cli.js`). Do NOT try to tell them\n * apart by excluding `node_modules` \u2014 the second one contains it.\n */\nexport const isBrewKegOf = (p: string, name: string): boolean => {\n  const segments = path.resolve(p).split(path.sep)\n  const cellar = segments.indexOf('Cellar')\n\n  return cellar !== -1 && segments[cellar + 1] === name\n}\n\n/**\n * The npm global prefix that owns `binRealPath`, derived from the path ITSELF, or null when the\n * layout is not an npm global one.\n *\n * Matches `<prefix>/lib/node_modules/<packageName>` \u2014 npm's global layout and no other manager's\n * \u2014 requiring BOTH the `lib` parent and our package as the immediate child. Windows global npm has\n * no `lib` segment (`%APPDATA%\\npm\\node_modules`), so this returns null there and detection falls\n * through to `npm root -g`, which is correct on Windows, where there is normally one npm.\n */\n// This is the one signal that cannot point at the wrong tree. Everything else in this module\n// answers \"is this file somewhere inside tool X's directory?\", and containment is not ownership:\n//   - `npm root -g` answers for whichever `npm` is first on PATH, which is routinely a DIFFERENT\n//     node than the one that installed us (a pnpm/nvm/fnm-managed node, or a node that has since\n//     been removed). It then reports a root that does not contain us, every matcher misses, and\n//     detection degrades to `unknown` \u2014 a notice printed forever, on the single most common install\n//     method. That is the bug this exists to close.\n//   - `PNPM_HOME` containment is satisfied by `<PNPM_HOME>/nodejs/<v>/lib/node_modules/<pkg>` (a\n//     plain `npm i -g` under a pnpm-managed node), yet `pnpm add -g` installs to\n//     `<PNPM_HOME>/global/<v>/...` \u2014 a different directory. That one is worse than a missed update:\n//     the install \"succeeds\" while the binary on PATH stays old, silently, with no notice to show\n//     for it.\n//\n// Requiring both segments is what makes the match proof rather than a hint. The `lib` requirement\n// is also what keeps a project-local `<repo>/node_modules/<pkg>` out (it has no `lib`), and nesting\n// cannot spoof it: `.../node_modules/foo/node_modules/<pkg>` fails the `lib` test.\nexport const npmPrefixOfPackage = (binRealPath: string, packageName: string): string | null => {\n  const segments = path.resolve(binRealPath).split(path.sep)\n  const nodeModules = segments.lastIndexOf('node_modules')\n\n  if (nodeModules < 2) return null\n  if (segments[nodeModules - 1] !== 'lib') return null\n  if (segments[nodeModules + 1] !== packageName) return null\n\n  // Drop `lib/node_modules/...`; the empty result of a root-level prefix (`/lib/node_modules/...`) is `/`.\n  return segments.slice(0, nodeModules - 1).join(path.sep) || path.sep\n}\n\n// The self-scoped reading, kept as the name every call site below already uses. `dependency-registry`\n// asks the same question about OTHER packages (`portless`), which is why the body moved up one level\n// rather than gaining a defaulted parameter \u2014 a default is how the wrong package silently gets probed.\nconst npmPrefixFromSelfPath = (selfRealPath: string): string | null => {\n  return npmPrefixOfPackage(selfRealPath, PACKAGE_NAME)\n}\n\n/**\n * `--prefix` is passed EXPLICITLY rather than trusting the ambient one: the whole point of deriving it is\n * that the `npm` we are about to run may default to a different prefix than the one we are installed in.\n * A command-line flag outranks both `npm_config_prefix` and any `.npmrc`, so this targets the tree we\n * actually run from. With `-g`, npm writes `<prefix>/lib/node_modules` and links bins into `<prefix>/bin`.\n */\nconst npmPrefixInstallCommand = (prefix: string): string[] => {\n  return ['npm', 'install', '-g', '--prefix', prefix, LATEST]\n}\n\n/**\n * Render argv as a line the user can paste into a shell.\n *\n * A plain `join(' ')` was fine while every token came from a static table; `--prefix <path>` puts a\n * filesystem path in argv, and `/Users/Ada Lovelace/.nvm/...` pasted unquoted is two arguments and a\n * failed install. Single quotes are sound here without escaping because the callers' validation rejects a\n * token containing a quote \u2014 see `SAFE_COMMAND_TOKEN` in src/lib/update-check/auto-update.ts.\n *\n * @example\n * formatUpdateCommand(['npm', 'install', '-g', '--prefix', '/opt/x y', 'infra-kit@latest'])\n * // => \"npm install -g --prefix '/opt/x y' infra-kit@latest\"\n */\nexport const formatUpdateCommand = (command: string[]): string => {\n  return command\n    .map((token) => {\n      return token.includes(' ') ? `'${token}'` : token\n    })\n    .join(' ')\n}\n\n/** `env[key]` names a directory that contains `selfRealPath`. Absent/empty env var \u2192 no match. */\nconst underEnvDir = (env: NodeJS.ProcessEnv, key: string, selfRealPath: string, realpath: RealpathFn): boolean => {\n  const dir = env[key]\n\n  return dir != null && dir !== '' && isWithin(dir, selfRealPath, realpath)\n}\n\ninterface Matcher extends Omit<InstallManagerInfo, 'manager'> {\n  manager: InstallManager\n  test: (input: Required<Pick<DetectInstallManagerInput, 'selfRealPath' | 'env' | 'realpath'>>) => boolean\n}\n\n/**\n * Consulted FIRST, before {@link npmPrefixFromSelfPath}. Both of these legitimately wrap an npm-shaped\n * `lib/node_modules` tree \u2014 volta at `~/.volta/tools/image/node/<v>/lib/node_modules`, brew at\n * `Cellar/<pkg>/<v>/libexec/lib/node_modules` \u2014 so deriving an npm prefix from the path would hijack\n * installs that a wrapper owns and must keep owning.\n */\nconst WRAPPER_MATCHERS: Matcher[] = [\n  {\n    manager: 'volta',\n    // volta owns the shim; `volta install` is the correct tool, not a workaround \u2014 so we may run it.\n    test: ({ selfRealPath, env, realpath }) => {\n      return (\n        underEnvDir(env, 'VOLTA_HOME', selfRealPath, realpath) ||\n        hasSegment(selfRealPath, '.volta') ||\n        hasSegment(selfRealPath, 'volta')\n      )\n    },\n    updateCommand: ['volta', 'install', PACKAGE_NAME],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'homebrew',\n    // `brew upgrade` can touch the prefix, relink, and prompt \u2014 never ours to run unattended.\n    //\n    // Our own keg is the ONLY sound signal \u2014 see `isBrewKegOf`. Two broader tests look plausible\n    // and are both wrong, because each answers \"did brew put something here?\" when the question is \"does\n    // brew own THIS package?\":\n    //   - `HOMEBREW_PREFIX` containment: when node comes from brew, npm's global prefix IS\n    //     $HOMEBREW_PREFIX, so EVERY `npm i -g` package lands under it, unknown to brew.\n    //   - a bare `Cellar` segment: an npm prefix pointed at a node keg puts packages inside that keg.\n    // Either misfire tells macOS users to run `brew upgrade infra-kit` \u2014 a formula that does not exist \u2014\n    // and, far worse, makes the background auto-updater bail with `cannot-self-spawn` forever, so the\n    // very fix for it can never reach them. Detection runs on the realpath, and a linked brew bin always\n    // resolves into its own keg, so the narrow test has no false negatives to trade for this.\n    test: ({ selfRealPath }) => {\n      return isBrewKegOf(selfRealPath, PACKAGE_NAME)\n    },\n    updateCommand: ['brew', 'upgrade', PACKAGE_NAME],\n    canSelfSpawn: false,\n  },\n]\n\n/**\n * Consulted LAST, after {@link npmPrefixFromSelfPath} has had its say. Each of these proves only that we\n * live somewhere inside a tool's directory tree, which is weaker than knowing the layout npm itself\n * created \u2014 see the `PNPM_HOME`/`nodejs` case in that helper's doc for a containment hit whose install\n * command targets the wrong directory.\n */\nconst TREE_MATCHERS: Matcher[] = [\n  {\n    manager: 'pnpm',\n    test: ({ selfRealPath, env, realpath }) => {\n      return (\n        underEnvDir(env, 'PNPM_HOME', selfRealPath, realpath) ||\n        (hasSegment(selfRealPath, 'pnpm') && hasSegment(selfRealPath, 'global'))\n      )\n    },\n    updateCommand: ['pnpm', 'add', '-g', LATEST],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'bun',\n    test: ({ selfRealPath, env, realpath }) => {\n      return underEnvDir(env, 'BUN_INSTALL', selfRealPath, realpath) || hasSegment(selfRealPath, '.bun')\n    },\n    updateCommand: ['bun', 'add', '-g', LATEST],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'yarn',\n    test: ({ selfRealPath }) => {\n      return (\n        hasSegment(selfRealPath, '.yarn') || (hasSegment(selfRealPath, 'yarn') && hasSegment(selfRealPath, 'global'))\n      )\n    },\n    updateCommand: ['yarn', 'global', 'add', LATEST],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'npm',\n    test: ({ selfRealPath, env, realpath }) => {\n      return underEnvDir(env, 'npm_config_prefix', selfRealPath, realpath)\n    },\n    updateCommand: ['npm', 'install', '-g', LATEST],\n    canSelfSpawn: true,\n  },\n]\n\nconst NPM_UPDATE_COMMAND = ['npm', 'install', '-g', LATEST]\n\n/**\n * The command to print when nobody has identified this CLI's package manager \u2014 the same guess\n * `detectInstallManager` records for an unrecognised location, pinned to `version`. For a caller that\n * must name a command but has no worker verdict to read (no update cache on an opt-out machine).\n *\n * @example\n * fallbackUpdateCommand('0.8.0') // => ['npm', 'install', '-g', 'infra-kit@0.8.0']\n */\nexport const fallbackUpdateCommand = (version: string): string[] => {\n  return pinSpec(NPM_UPDATE_COMMAND, version)\n}\n\n/**\n * Identify the package manager that owns `selfRealPath`.\n *\n * Order, and why it is this one: wrappers that own an npm-shaped tree (volta, brew) first, then the npm\n * prefix DERIVED from our own path, then the env/path containment matchers, then the `npm root -g` probe.\n * The derived prefix sits above containment because it is the only signal that cannot name a directory we\n * do not live in \u2014 see {@link npmPrefixFromSelfPath}.\n *\n * `lazyNpmRoot` is the last resort and is invoked at most once, only after every matcher has missed \u2014 a\n * pnpm or volta install never pays for the subprocess, and neither does any npm global install in the\n * standard layout, which the derived prefix now settles for free. When nothing matches we report `unknown`\n * with an npm command that is a *suggestion only* (`canSelfSpawn: false`): running a guessed global\n * install is worse than printing one.\n *\n * @example\n * detectInstallManager({ selfRealPath: '/Users/x/Library/pnpm/global/5/node_modules/infra-kit/dist/cli.js', env: {} })\n * // => { manager: 'pnpm', updateCommand: ['pnpm', 'add', '-g', 'infra-kit@latest'], canSelfSpawn: true }\n * detectInstallManager({ selfRealPath: '/Users/x/Library/pnpm/global/5/node_modules/infra-kit/dist/cli.js', env: {}, version: '0.5.5' })\n * // => { manager: 'pnpm', updateCommand: ['pnpm', 'add', '-g', 'infra-kit@0.5.5'], canSelfSpawn: true }\n */\nexport const detectInstallManager = (input: DetectInstallManagerInput): InstallManagerInfo => {\n  const { selfRealPath, env, realpath, lazyNpmRoot, version } = input\n  const detected = detectUnpinned({ selfRealPath, env, realpath, lazyNpmRoot })\n\n  return { ...detected, updateCommand: pinSpec(detected.updateCommand, version) }\n}\n\nconst detectUnpinned = (input: DetectInstallManagerInput): InstallManagerInfo => {\n  const { selfRealPath, env, realpath, lazyNpmRoot } = input\n\n  const toInfo = (hit: Matcher): InstallManagerInfo => {\n    return { manager: hit.manager, updateCommand: hit.updateCommand, canSelfSpawn: hit.canSelfSpawn }\n  }\n\n  const matches = ({ test }: Matcher): boolean => {\n    return test({ selfRealPath, env, realpath })\n  }\n\n  const wrapper = WRAPPER_MATCHERS.find(matches)\n\n  if (wrapper) return toInfo(wrapper)\n\n  const derivedPrefix = npmPrefixFromSelfPath(selfRealPath)\n\n  if (derivedPrefix !== null) {\n    return { manager: 'npm', updateCommand: npmPrefixInstallCommand(derivedPrefix), canSelfSpawn: true }\n  }\n\n  const tree = TREE_MATCHERS.find(matches)\n\n  if (tree) return toInfo(tree)\n\n  const npmRoot = lazyNpmRoot?.()\n\n  if (npmRoot != null && npmRoot !== '' && isWithin(npmRoot, selfRealPath, realpath)) {\n    return { manager: 'npm', updateCommand: NPM_UPDATE_COMMAND, canSelfSpawn: true }\n  }\n\n  return { manager: 'unknown', updateCommand: NPM_UPDATE_COMMAND, canSelfSpawn: false }\n}\n\n/**\n * Is this CLI running from a *project-local* `node_modules` (as opposed to a global root)?\n *\n * The cwd clause is what does the distinguishing \u2014 BOTH a project install and a global root contain a\n * `/node_modules/` segment (`pnpm root -g` is `~/Library/pnpm/global/5/node_modules`). Without it we\n * would nag every global pnpm user to stop using a local install they do not have.\n *\n * Accepted false-negative: invoked from a subdirectory (cwd `project/apps/x`, deps at\n * `project/node_modules`) this returns false and the advisory stays silent. Under-warning is the safe\n * direction for a best-effort, never-throwing advisory \u2014 do not \"fix\" it by dropping the cwd clause.\n *\n * `cwd` is canonicalised before comparison for the same reason `detectInstallManager` canonicalises its\n * roots: `selfRealPath` is a realpath, and comparing it to an unresolved cwd never matches.\n *\n * @example\n * isLocalNodeModulesInstall('/repo/node_modules/infra-kit/dist/cli.js', '/repo', (p) => p) // => true\n */\nexport const isLocalNodeModulesInstall = (selfRealPath: string, cwd: string, realpath: RealpathFn): boolean => {\n  return hasSegment(selfRealPath, 'node_modules') && isWithin(cwd, selfRealPath, realpath)\n}\n\n/** Does this path exist at all \u2014 directory, file, or symlink? Injected so the walk never touches the real disk in tests. */\nexport type ExistsFn = (p: string) => boolean\n\nexport interface IsGlobalInstallInput {\n  /** Fully-resolved (symlinks followed) path to this CLI's entry file. */\n  selfRealPath: string\n  env: NodeJS.ProcessEnv\n  /** Canonicalises `home` and every root {@link detectInstallManager} compares against. */\n  realpath: RealpathFn\n  /** The user's home directory (`os.homedir()`), raw \u2014 canonicalised here before the walk compares it. */\n  home: string\n  exists: ExistsFn\n}\n\n/** Upper bound on the `.git` walk: deeper than any real install layout, so it only ever guards against a pathological path. */\nconst GIT_WALK_MAX_HOPS = 32\n\n/**\n * Where the `.git` walk starts: the parent of the OUTERMOST `node_modules` segment (`indexOf`, not\n * `lastIndexOf` \u2014 pnpm's `.pnpm/<pkg>@<v>/node_modules/<pkg>` nests two, and the checkout that owns the\n * tree sits above the first). A self path with no `node_modules` at all (a plain brew keg's `bin/`) starts\n * at its own directory, so the walk still inspects every ancestor.\n */\nconst gitWalkStart = (selfRealPath: string): string => {\n  const segments = path.resolve(selfRealPath).split(path.sep)\n  const outermost = segments.indexOf('node_modules')\n\n  if (outermost === -1) return path.dirname(selfRealPath)\n\n  return segments.slice(0, outermost).join(path.sep) || path.sep\n}\n\n/** `start` and its ancestors up to but EXCLUDING `homeReal`, bounded \u2014 the directories the `.git` walk may inspect. */\nconst ancestorsBelowHome = (start: string, homeReal: string): string[] => {\n  const dirs: string[] = []\n  let dir = start\n\n  while (dir !== homeReal && dirs.length < GIT_WALK_MAX_HOPS) {\n    dirs.push(dir)\n\n    const parent = path.dirname(dir)\n\n    if (parent === dir) break\n\n    dir = parent\n  }\n\n  return dirs\n}\n\nconst hasGitAncestor = (start: string, homeReal: string, exists: ExistsFn): boolean => {\n  return ancestorsBelowHome(start, homeReal).some((dir) => {\n    return exists(path.join(dir, '.git'))\n  })\n}\n\n/**\n * Is this CLI the machine's *global* install \u2014 the one a root-owned daemon or a system-wide link may be\n * aimed at \u2014 as opposed to a checkout or a project-local dependency? Probe-free: fs + env only, never a\n * subprocess, because it runs on every boot.\n *\n * True iff {@link detectInstallManager} names a manager AND no `.git` entry (directory or file \u2014 a\n * worktree's is a file) exists above the outermost `node_modules`, walking up to but EXCLUDING\n * `realpath(home)`. Never throws: any seam failure reports false, the safe direction for every caller.\n *\n * @example\n * isGlobalInstall({\n *   selfRealPath: '/Users/x/Library/pnpm/global/v11/8a83-1/node_modules/.pnpm/infra-kit@0.5.6/node_modules/infra-kit/dist/cli.js',\n *   env: { PNPM_HOME: '/Users/x/Library/pnpm' },\n *   realpath: (p) => p,\n *   home: '/Users/x',\n *   exists: (p) => p === '/Users/x/.git',\n * }) // => true \u2014 the only `.git` is $HOME's own, which the walk never inspects\n */\n// Why these two predicates and not the obvious candidates:\n//   - Not `canSelfSpawn`: that flag encodes \"may I run an unattended `npm i -g`\", and homebrew is\n//     `canSelfSpawn: false` while being unmistakably global \u2014 gating on it would leave a brew install\n//     unconverged forever. A global install whose manager cannot be identified in a stripped env (no\n//     `PNPM_HOME`, no derivable prefix) reports false: fail-safe, since a skipped write is never wrong and\n//     the next shell-run command converges it.\n//   - Not `isLocalNodeModulesInstall`: its cwd clause calls every global layout under `$HOME` \"local\" the\n//     moment cwd is `$HOME` \u2014 which is exactly the cwd the background updater spawns with, and a plain\n//     `cd ~ && infra-kit version` reproduces it. This predicate reads the tree, not the cwd.\n//   - Why the `.git` walk at all: the cheap matchers are segment heuristics that also fire on\n//     project-local shapes \u2014 a repo with a `volta` path segment, Yarn Berry's `.yarn/unplugged/\u2026`, a\n//     checkout cloned under `$PNPM_HOME`, a workspace package literally named `lib` \u2014 and every one of\n//     those is a checkout; every checkout has a `.git`, no global root does.\n//   - Why `$HOME` is excluded: dotfiles users `git init ~`, and a `~/.git` would refuse the pnpm-global\n//     install permanently. Every checkout under `$HOME` (`~/repo/.git`) is still strictly below it.\n//   - Why `.git` ONLY, not `pnpm-workspace.yaml`: pnpm 12 writes one INSIDE the global install dir, so\n//     that marker would refuse the very install this is for.\nexport const isGlobalInstall = (input: IsGlobalInstallInput): boolean => {\n  try {\n    const { selfRealPath, env, realpath, home, exists } = input\n\n    if (detectInstallManager({ selfRealPath, env, realpath }).manager === 'unknown') return false\n\n    return !hasGitAncestor(gitWalkStart(selfRealPath), realpath(path.resolve(home)), exists)\n  } catch {\n    return false\n  }\n}\n\n/**\n * The advisory gate for `warnIfLocalInstall`, pulled out so it is testable without spawning the CLI.\n * Warn only when the install is provably NOT global AND looks project-local: the second clause alone\n * fires on a global pnpm root whenever cwd is `$HOME` (see {@link isGlobalInstall}).\n */\nexport const shouldWarnLocalInstall = (input: IsGlobalInstallInput & { cwd: string }): boolean => {\n  const { selfRealPath, cwd, realpath } = input\n\n  return !isGlobalInstall(input) && isLocalNodeModulesInstall(selfRealPath, cwd, realpath)\n}\n", "import { realpathSync } from 'node:fs'\nimport path from 'node:path'\n\n/**\n * The impure companion to the pure detection module: canonicalise a directory that may not exist.\n *\n * `realpathSync` throws on a missing path, and candidate roots routinely miss \u2014 `PNPM_HOME` can point at a\n * directory the user never created, `npm root -g` can name a prefix that was removed. A throw there would\n * turn \"we could not identify your install\" into a crash, so an unresolvable path falls back to\n * `path.resolve`, which still normalises `.`/`..` and yields a usable, non-matching absolute path.\n */\nexport const safeRealpath = (dir: string): string => {\n  try {\n    return realpathSync(dir)\n  } catch {\n    return path.resolve(dir)\n  }\n}\n", "/* eslint-disable sonarjs/no-os-command-from-path */\n/**\n * `npm root -g`, the LAZY fallback for {@link detectInstallManager}.\n *\n * Why it is indispensable: the `npm` matcher keys off `npm_config_prefix`, which npm sets only while npm\n * itself is running. A user who ran `npm i -g infra-kit` months ago and now types `ik` has no such var,\n * so every cheap matcher misses and detection reports `unknown` / `canSelfSpawn: false`. Without this\n * probe the single most common install method can never update itself.\n *\n * Read by the background update worker, and by the `doctor` advisory that names the command a human\n * would run by hand \u2014 one probe so the two can never disagree about who owns the install.\n */\nimport { execFileSync } from 'node:child_process'\nimport process from 'node:process'\n\nconst NPM_ROOT_TIMEOUT_MS = 3_000\n\n/**\n * The global npm root, or undefined when npm is absent, slow, or errors. Costs a subprocess, so\n * `detectInstallManager` invokes it at most once and only after every env/path matcher has missed \u2014 a\n * pnpm or volta install never pays for it.\n *\n * Resolving the user's `npm` from PATH is inherent here: we must ask the very package manager that owns\n * this install where its global root is. Pinning an absolute path would defeat the detection.\n *\n * @example\n * defaultLazyNpmRoot() // => '/usr/local/lib/node_modules' | undefined\n */\nexport const defaultLazyNpmRoot = (): string | undefined => {\n  try {\n    const out = execFileSync('npm', ['root', '-g'], {\n      encoding: 'utf-8',\n      timeout: NPM_ROOT_TIMEOUT_MS,\n      stdio: ['ignore', 'pipe', 'ignore'],\n      shell: process.platform === 'win32',\n    })\n\n    const trimmed = out.trim()\n\n    return trimmed === '' ? undefined : trimmed\n  } catch {\n    return undefined\n  }\n}\n", "/**\n * `env` minus every package-manager marker a spawned child could mistake for a throwaway install:\n * the whole `npm_*` block plus `PNPM_SCRIPT_SRC_DIR`. The result makes the child look exactly like\n * a direct `node <pkg>/dist/cli.js` run \u2014 which it is.\n */\n// Any child we launch through `node <bin>` (the portless driver, the update worker, the dependency installer)\n// inherits our env, and a tool that sniffs those markers will conclude it was run via `npx`/`pnpm\n// dlx` and refuse to work. portless is the motivating case; its guard (cli.js `main()`) is:\n//\n//     isNpx     = npm_command === 'exec' && !npm_lifecycle_event\n//     isPnpmDlx = !!PNPM_SCRIPT_SRC_DIR  && !npm_lifecycle_event\n//     if ((isNpx || isPnpmDlx) && !isLocallyInstalled()) -> abort\n//\n// `isLocallyInstalled()` walks up from the CHILD's cwd, so in a consumer repo (where portless is a\n// transitive dep of infra-kit, absent from the root `node_modules`) it is false and the guard is\n// live. `pnpm exec infra-kit dev` exports `npm_command=exec` with no lifecycle event, so `isNpx`\n// holds, every portless call exits 1, `isAvailable()` is false, and `ensureProxy` aborts the whole\n// dev boot with \"portless is not installed\", on a machine where it plainly is.\n//\n// `PNPM_SCRIPT_SRC_DIR` must be dropped ALONGSIDE the `npm_*` block, not left behind: it is set by\n// `pnpm run <script>`, where `npm_lifecycle_event` is what suppresses `isPnpmDlx`. Stripping only\n// `npm_*` removes that suppressor and creates an abort for the script-style invocation that\n// previously worked. Both markers go, or neither is safe.\nexport const withoutPackageManagerEnv = (env: NodeJS.ProcessEnv): NodeJS.ProcessEnv => {\n  return Object.fromEntries(\n    Object.entries(env).filter(([key]) => {\n      return !key.startsWith('npm_') && key !== 'PNPM_SCRIPT_SRC_DIR'\n    }),\n  )\n}\n\n/**\n * npm's own configuration \u2014 as opposed to the npx/dlx *markers* above. Case-insensitive because npm reads\n * `npm_config_*` case-insensitively (its parser matches `/^npm_config_/i`) and real environments export\n * both forms: shells write the lowercase name, Dockerfiles and CI images overwhelmingly write the\n * uppercase one.\n */\nconst NPM_CONFIG_TO_PRESERVE = /^npm_config_(?:prefix|registry)$/i\n\n/**\n * The env for spawning a package-manager INSTALL: npx/dlx markers stripped, but npm's own config\n * kept \u2014 specifically `npm_config_prefix` and `npm_config_registry`.\n *\n * @example\n * packageManagerInstallEnv({ npm_command: 'exec', npm_config_prefix: '/p', PATH: '/bin' })\n * // => { npm_config_prefix: '/p', PATH: '/bin' }\n */\n// `withoutPackageManagerEnv` is deliberately a blunt `npm_*` prefix filter, and it is the\n// right tool for the portless driver \u2014 but it is the WRONG tool for spawning an install, because it\n// also drops the two variables that tell the package manager where, and from where, to install:\n//\n//   - `npm_config_prefix` is the npm matcher's ONLY signal (see `install-manager.ts`). Strip it and\n//     we detect a global install rooted at prefix P, then run the install with P erased \u2014 so it\n//     lands in the DEFAULT prefix instead. That is either a permanent EACCES, or a second global\n//     copy that is not the one on PATH. Nothing notices: the install exits 0, we report\n//     `installed`, the version on PATH never moves, and the whole cycle repeats every window\n//     forever. `export npm_config_prefix=~/.npm-global` is npm's own documented EACCES workaround,\n//     so this is a mainstream layout, not an exotic one.\n//   - `npm_config_registry` is what the update CHECK already used to pick a registry. Dropping it\n//     here means we decide against a corporate mirror and then install from somewhere else.\n//\n// Preserving these cannot re-arm the dlx guard: that guard reads `npm_command`,\n// `npm_lifecycle_event` and `PNPM_SCRIPT_SRC_DIR` \u2014 none of which are npm config, and all of which\n// remain stripped.\nexport const packageManagerInstallEnv = (env: NodeJS.ProcessEnv): NodeJS.ProcessEnv => {\n  const sanitised = withoutPackageManagerEnv(env)\n\n  for (const [key, value] of Object.entries(env)) {\n    if (NPM_CONFIG_TO_PRESERVE.test(key)) sanitised[key] = value\n  }\n\n  return sanitised\n}\n"],
+  "mappings": "AAQA,OAAOA,MAAU,YAGV,IAAMC,EAAe,YAEtBC,EAAS,GAAGD,CAAY,UA8CxBE,EAAU,CAACC,EAAmBC,IAC9BA,IAAY,OAAkBD,EAE3BA,EAAQ,IAAKE,GACXA,IAAUJ,EAAS,GAAGD,CAAY,IAAII,CAAO,GAAKC,CAC1D,EAQUC,EAAW,CAACC,EAAgBC,EAAeC,IAAkC,CACxF,IAAMC,EAAMX,EAAK,SAASU,EAASV,EAAK,QAAQQ,CAAM,CAAC,EAAGR,EAAK,QAAQS,CAAK,CAAC,EAE7E,OAAOE,IAAQ,IAAM,CAACA,EAAI,WAAW,IAAI,GAAK,CAACX,EAAK,WAAWW,CAAG,CACpE,EAGaC,EAAa,CAACC,EAAWC,IAC7Bd,EAAK,QAAQa,CAAC,EAAE,MAAMb,EAAK,GAAG,EAAE,SAASc,CAAI,EAkBzCC,EAAc,CAACF,EAAWC,IAA0B,CAC/D,IAAME,EAAWhB,EAAK,QAAQa,CAAC,EAAE,MAAMb,EAAK,GAAG,EACzCiB,EAASD,EAAS,QAAQ,QAAQ,EAExC,OAAOC,IAAW,IAAMD,EAASC,EAAS,CAAC,IAAMH,CACnD,EA2BaI,EAAqB,CAACC,EAAqBC,IAAuC,CAC7F,IAAMJ,EAAWhB,EAAK,QAAQmB,CAAW,EAAE,MAAMnB,EAAK,GAAG,EACnDqB,EAAcL,EAAS,YAAY,cAAc,EAIvD,OAFIK,EAAc,GACdL,EAASK,EAAc,CAAC,IAAM,OAC9BL,EAASK,EAAc,CAAC,IAAMD,EAAoB,KAG/CJ,EAAS,MAAM,EAAGK,EAAc,CAAC,EAAE,KAAKrB,EAAK,GAAG,GAAKA,EAAK,GACnE,EAKMsB,EAAyBC,GACtBL,EAAmBK,EAActB,CAAY,EAShDuB,EAA2BC,GACxB,CAAC,MAAO,UAAW,KAAM,WAAYA,EAAQvB,CAAM,EAe/CwB,EAAuBtB,GAC3BA,EACJ,IAAKE,GACGA,EAAM,SAAS,GAAG,EAAI,IAAIA,CAAK,IAAMA,CAC7C,EACA,KAAK,GAAG,EAIPqB,EAAc,CAACC,EAAwBC,EAAaN,EAAsBb,IAAkC,CAChH,IAAMoB,EAAMF,EAAIC,CAAG,EAEnB,OAAOC,GAAO,MAAQA,IAAQ,IAAMvB,EAASuB,EAAKP,EAAcb,CAAQ,CAC1E,EAaMqB,EAA8B,CAClC,CACE,QAAS,QAET,KAAM,CAAC,CAAE,aAAAR,EAAc,IAAAK,EAAK,SAAAlB,CAAS,IAEjCiB,EAAYC,EAAK,aAAcL,EAAcb,CAAQ,GACrDE,EAAWW,EAAc,QAAQ,GACjCX,EAAWW,EAAc,OAAO,EAGpC,cAAe,CAAC,QAAS,UAAWtB,CAAY,EAChD,aAAc,EAChB,EACA,CACE,QAAS,WAaT,KAAM,CAAC,CAAE,aAAAsB,CAAa,IACbR,EAAYQ,EAActB,CAAY,EAE/C,cAAe,CAAC,OAAQ,UAAWA,CAAY,EAC/C,aAAc,EAChB,CACF,EAQM+B,EAA2B,CAC/B,CACE,QAAS,OACT,KAAM,CAAC,CAAE,aAAAT,EAAc,IAAAK,EAAK,SAAAlB,CAAS,IAEjCiB,EAAYC,EAAK,YAAaL,EAAcb,CAAQ,GACnDE,EAAWW,EAAc,MAAM,GAAKX,EAAWW,EAAc,QAAQ,EAG1E,cAAe,CAAC,OAAQ,MAAO,KAAMrB,CAAM,EAC3C,aAAc,EAChB,EACA,CACE,QAAS,MACT,KAAM,CAAC,CAAE,aAAAqB,EAAc,IAAAK,EAAK,SAAAlB,CAAS,IAC5BiB,EAAYC,EAAK,cAAeL,EAAcb,CAAQ,GAAKE,EAAWW,EAAc,MAAM,EAEnG,cAAe,CAAC,MAAO,MAAO,KAAMrB,CAAM,EAC1C,aAAc,EAChB,EACA,CACE,QAAS,OACT,KAAM,CAAC,CAAE,aAAAqB,CAAa,IAElBX,EAAWW,EAAc,OAAO,GAAMX,EAAWW,EAAc,MAAM,GAAKX,EAAWW,EAAc,QAAQ,EAG/G,cAAe,CAAC,OAAQ,SAAU,MAAOrB,CAAM,EAC/C,aAAc,EAChB,EACA,CACE,QAAS,MACT,KAAM,CAAC,CAAE,aAAAqB,EAAc,IAAAK,EAAK,SAAAlB,CAAS,IAC5BiB,EAAYC,EAAK,oBAAqBL,EAAcb,CAAQ,EAErE,cAAe,CAAC,MAAO,UAAW,KAAMR,CAAM,EAC9C,aAAc,EAChB,CACF,EAEM+B,EAAqB,CAAC,MAAO,UAAW,KAAM/B,CAAM,EAU7CgC,EAAyB7B,GAC7BF,EAAQ8B,EAAoB5B,CAAO,EAuB/B8B,EAAwBC,GAAyD,CAC5F,GAAM,CAAE,aAAAb,EAAc,IAAAK,EAAK,SAAAlB,EAAU,YAAA2B,EAAa,QAAAhC,CAAQ,EAAI+B,EACxDE,EAAWC,EAAe,CAAE,aAAAhB,EAAc,IAAAK,EAAK,SAAAlB,EAAU,YAAA2B,CAAY,CAAC,EAE5E,MAAO,CAAE,GAAGC,EAAU,cAAenC,EAAQmC,EAAS,cAAejC,CAAO,CAAE,CAChF,EAEMkC,EAAkBH,GAAyD,CAC/E,GAAM,CAAE,aAAAb,EAAc,IAAAK,EAAK,SAAAlB,EAAU,YAAA2B,CAAY,EAAID,EAE/CI,EAAUC,IACP,CAAE,QAASA,EAAI,QAAS,cAAeA,EAAI,cAAe,aAAcA,EAAI,YAAa,GAG5FC,EAAU,CAAC,CAAE,KAAAC,CAAK,IACfA,EAAK,CAAE,aAAApB,EAAc,IAAAK,EAAK,SAAAlB,CAAS,CAAC,EAGvCkC,EAAUb,EAAiB,KAAKW,CAAO,EAE7C,GAAIE,EAAS,OAAOJ,EAAOI,CAAO,EAElC,IAAMC,EAAgBvB,EAAsBC,CAAY,EAExD,GAAIsB,IAAkB,KACpB,MAAO,CAAE,QAAS,MAAO,cAAerB,EAAwBqB,CAAa,EAAG,aAAc,EAAK,EAGrG,IAAMC,EAAOd,EAAc,KAAKU,CAAO,EAEvC,GAAII,EAAM,OAAON,EAAOM,CAAI,EAE5B,IAAMC,EAAUV,IAAc,EAE9B,OAAIU,GAAW,MAAQA,IAAY,IAAMxC,EAASwC,EAASxB,EAAcb,CAAQ,EACxE,CAAE,QAAS,MAAO,cAAeuB,EAAoB,aAAc,EAAK,EAG1E,CAAE,QAAS,UAAW,cAAeA,EAAoB,aAAc,EAAM,CACtF,EAmBae,EAA4B,CAACzB,EAAsB0B,EAAavC,IACpEE,EAAWW,EAAc,cAAc,GAAKhB,EAAS0C,EAAK1B,EAAcb,CAAQ,EAkBnFwC,EAAoB,GAQpBC,EAAgB5B,GAAiC,CACrD,IAAMP,EAAWhB,EAAK,QAAQuB,CAAY,EAAE,MAAMvB,EAAK,GAAG,EACpDoD,EAAYpC,EAAS,QAAQ,cAAc,EAEjD,OAAIoC,IAAc,GAAWpD,EAAK,QAAQuB,CAAY,EAE/CP,EAAS,MAAM,EAAGoC,CAAS,EAAE,KAAKpD,EAAK,GAAG,GAAKA,EAAK,GAC7D,EAGMqD,EAAqB,CAACC,EAAeC,IAA+B,CACxE,IAAMC,EAAiB,CAAC,EACpB1B,EAAMwB,EAEV,KAAOxB,IAAQyB,GAAYC,EAAK,OAASN,GAAmB,CAC1DM,EAAK,KAAK1B,CAAG,EAEb,IAAMtB,EAASR,EAAK,QAAQ8B,CAAG,EAE/B,GAAItB,IAAWsB,EAAK,MAEpBA,EAAMtB,CACR,CAEA,OAAOgD,CACT,EAEMC,EAAiB,CAACH,EAAeC,EAAkBG,IAChDL,EAAmBC,EAAOC,CAAQ,EAAE,KAAMzB,GACxC4B,EAAO1D,EAAK,KAAK8B,EAAK,MAAM,CAAC,CACrC,EAsCU6B,EAAmBvB,GAAyC,CACvE,GAAI,CACF,GAAM,CAAE,aAAAb,EAAc,IAAAK,EAAK,SAAAlB,EAAU,KAAAkD,EAAM,OAAAF,CAAO,EAAItB,EAEtD,OAAID,EAAqB,CAAE,aAAAZ,EAAc,IAAAK,EAAK,SAAAlB,CAAS,CAAC,EAAE,UAAY,UAAkB,GAEjF,CAAC+C,EAAeN,EAAa5B,CAAY,EAAGb,EAASV,EAAK,QAAQ4D,CAAI,CAAC,EAAGF,CAAM,CACzF,MAAQ,CACN,MAAO,EACT,CACF,EAOaG,EAA0BzB,GAA2D,CAChG,GAAM,CAAE,aAAAb,EAAc,IAAA0B,EAAK,SAAAvC,CAAS,EAAI0B,EAExC,MAAO,CAACuB,EAAgBvB,CAAK,GAAKY,EAA0BzB,EAAc0B,EAAKvC,CAAQ,CACzF,ECveA,OAAS,gBAAAoD,MAAoB,UAC7B,OAAOC,MAAU,YAUV,IAAMC,EAAgBC,GAAwB,CACnD,GAAI,CACF,OAAOH,EAAaG,CAAG,CACzB,MAAQ,CACN,OAAOF,EAAK,QAAQE,CAAG,CACzB,CACF,ECLA,OAAS,gBAAAC,MAAoB,qBAC7B,OAAOC,MAAa,eAEpB,IAAMC,EAAsB,IAafC,EAAqB,IAA0B,CAC1D,GAAI,CAQF,IAAMC,EAPMJ,EAAa,MAAO,CAAC,OAAQ,IAAI,EAAG,CAC9C,SAAU,QACV,QAASE,EACT,MAAO,CAAC,SAAU,OAAQ,QAAQ,EAClC,MAAOD,EAAQ,WAAa,OAC9B,CAAC,EAEmB,KAAK,EAEzB,OAAOG,IAAY,GAAK,OAAYA,CACtC,MAAQ,CACN,MACF,CACF,ECpBO,IAAMC,EAA4BC,GAChC,OAAO,YACZ,OAAO,QAAQA,CAAG,EAAE,OAAO,CAAC,CAACC,CAAG,IACvB,CAACA,EAAI,WAAW,MAAM,GAAKA,IAAQ,qBAC3C,CACH,EASIC,EAAyB,oCA2BlBC,EAA4BH,GAA8C,CACrF,IAAMI,EAAYL,EAAyBC,CAAG,EAE9C,OAAW,CAACC,EAAKI,CAAK,IAAK,OAAO,QAAQL,CAAG,EACvCE,EAAuB,KAAKD,CAAG,IAAGG,EAAUH,CAAG,EAAII,GAGzD,OAAOD,CACT",
   "names": ["path", "PACKAGE_NAME", "LATEST", "pinSpec", "command", "version", "token", "isWithin", "parent", "child", "realpath", "rel", "hasSegment", "p", "name", "isBrewKegOf", "segments", "cellar", "npmPrefixOfPackage", "binRealPath", "packageName", "nodeModules", "npmPrefixFromSelfPath", "selfRealPath", "npmPrefixInstallCommand", "prefix", "formatUpdateCommand", "underEnvDir", "env", "key", "dir", "WRAPPER_MATCHERS", "TREE_MATCHERS", "NPM_UPDATE_COMMAND", "fallbackUpdateCommand", "detectInstallManager", "input", "lazyNpmRoot", "detected", "detectUnpinned", "toInfo", "hit", "matches", "test", "wrapper", "derivedPrefix", "tree", "npmRoot", "isLocalNodeModulesInstall", "cwd", "GIT_WALK_MAX_HOPS", "gitWalkStart", "outermost", "ancestorsBelowHome", "start", "homeReal", "dirs", "hasGitAncestor", "exists", "isGlobalInstall", "home", "shouldWarnLocalInstall", "realpathSync", "path", "safeRealpath", "dir", "execFileSync", "process", "NPM_ROOT_TIMEOUT_MS", "defaultLazyNpmRoot", "trimmed", "withoutPackageManagerEnv", "env", "key", "NPM_CONFIG_TO_PRESERVE", "packageManagerInstallEnv", "sanitised", "value"]
 }

package/dist/{chunk-QCTAEXMN.js → chunk-SBG3HRSC.js}

@@ -1,12 +1,12 @@
-import{a as N,e as ie,h as O,i as ae,j as u}from"./chunk-MWGE43QS.js";import{P as a,S as se,d as f,e as b,ea as m,f as x,h as S,ha as g,i as ne,w as A}from"./chunk-467ZSXYU.js";import{a as G,c as B,d as P,f as Y,g as Q,h as X,i as ee,j as te,o as re,p as L,q as oe}from"./chunk-I23MDR4X.js";import Ye from"@inquirer/select";import{readRepoIdentity as Qe}from"@slip-stream-kit/config/internal";import{Buffer as Xe}from"node:buffer";import et from"node:fs";import U from"node:path";import C from"node:process";import{z as d}from"zod";import{$ as K}from"zx";var be="Could not find requested project",xe="Could not find requested config",ce="Invalid Auth token",le="does not have access to requested config",D=e=>e.includes(ce)||e.includes(le)?"auth":e.includes(be)?"project":e.includes(xe)?"config":"unknown",R=e=>e.includes(le)?"mis-scoped":e.includes(ce)?"revoked":null;var pe=e=>[`Doppler rejected the service token for env "${e}" \u2014 it is invalid, revoked, or scoped to a different config.`,`Fix: run \`infra-kit env-token-set ${e}\` with a token scoped to that config.`,"CI / agents: set INFRA_KIT_ENV_TOKEN to a token scoped to that config."].join(`
+import{a as N,e as ie,h as O,i as ae,j as u}from"./chunk-TGEAIKD6.js";import{P as a,S as se,X as m,d as f,e as b,f as x,fa as g,h as S,i as ne,w as A}from"./chunk-BPOPODWW.js";import{a as G,c as B,d as P,f as Y,g as Q,h as X,i as ee,j as te,o as re,p as L,q as oe}from"./chunk-GCOYOWGH.js";import Ye from"@inquirer/select";import{readRepoIdentity as Qe}from"@slip-stream-kit/config/internal";import{Buffer as Xe}from"node:buffer";import et from"node:fs";import U from"node:path";import C from"node:process";import{z as d}from"zod";import{$ as K}from"zx";var be="Could not find requested project",xe="Could not find requested config",ce="Invalid Auth token",le="does not have access to requested config",D=e=>e.includes(ce)||e.includes(le)?"auth":e.includes(be)?"project":e.includes(xe)?"config":"unknown",R=e=>e.includes(le)?"mis-scoped":e.includes(ce)?"revoked":null;var pe=e=>[`Doppler rejected the service token for env "${e}" \u2014 it is invalid, revoked, or scoped to a different config.`,`Fix: run \`infra-kit env-token-set ${e}\` with a token scoped to that config.`,"CI / agents: set INFRA_KIT_ENV_TOKEN to a token scoped to that config."].join(`
 `),v=class extends O{authKind;constructor(t,r=null,o){super(o??pe(t),t),this.name="DopplerAuthError",this.authKind=r}};var M=({kind:e,project:t,config:r,available:o})=>{let n=e==="project"?[`Doppler project "${t}" not found (set in infra-kit.json \u2192 envManagement.config.name).`]:[`Doppler config "${r}" not found in project "${t}".`];if(o&&o.length>0){let s=e==="project"?"Available projects":`Available configs in "${t}"`;n.push(`${s}: ${o.join(", ")}.`)}return n.push(e==="project"?"Fix: update envManagement.config.name to an existing project, or create it in Doppler.":"Fix: pass an existing config, or create it in Doppler."),n.join(`
-`)};import{$ as j}from"zx";var Se=5e3,Ne="DOPPLER_CONFIG",h=async()=>{let{envManagement:e}=await m();return e.config.name},Oe=async({childEnv:e,project:t,config:r})=>{let o=j.quiet;j.quiet=!0;try{let s=(await j({env:e})`doppler secrets get ${Ne} --plain --project ${t} --config ${r}`.timeout(Se)).stdout.trim();return s!==r?{outcome:"mis-scoped",scopedTo:s}:{outcome:"valid",scopedTo:s}}catch(n){return{outcome:je(n)}}finally{j.quiet=o}},je=e=>{let t=S(e)??(e instanceof Error?e.message:String(e));return D(t)!=="auth"?"unreachable":R(t)??"unreachable"};import Fe from"node:process";var l="INFRA_KIT_ENV_TOKEN",V=async e=>{let t=Fe.env[l];if(t)return{token:t,source:"env"};let o=(await u())?.envs[e];if(o)return{token:o,source:"store"};throw new O(Ie(e,await ae()),e)},Ie=(e,t)=>[`No Doppler service token for env "${e}".`,`Mint one at https://dashboard.doppler.com \u2014 this project \u2192 config "${e}" \u2192 Access tab \u2192 "Generate Service Token".`,`Fix: run \`infra-kit env-token-set ${e}\` and paste it.`,`It is stored in ${se(t)} (mode 0600, never in the repo).`,`CI / agents: set ${l} instead \u2014 it takes precedence and needs no home config.`].join(`
-`);import ke from"node:process";import{z as Ee}from"zod";import We from"node:process";import{z as p}from"zod";var _=async()=>{try{return(await m()).defaultEnv??null}catch{return null}};var ue=["prod"],E={allowed:!1,reason:"disallow"},w=e=>ue.includes(e),$e=["dev","stage"],Ke=e=>$e.includes(e)||w(e),Ce=(e,t=E)=>t.allowed?e:e.filter(r=>!w(r)),Le=(e,t,r=E)=>{if(!r.allowed&&w(e))throw r.reason==="agent-blocked"?new g({status:"refused",env:e,agentMode:f.source},2,{operation:t,remediation:'a human runs it from their own terminal \u2014 this project sets `protectedEnvs: "cli-only"`',stderrExcerpt:`"${e}" is withheld from agents in this project (protectedEnvs: "cli-only")`}):new ne(void 0,{operation:t,remediation:`use \`infra-kit release deliver\` \u2014 it merges the release to main, opens the RC PR, deploys from main, and releases the Jira version. To allow ad-hoc deploys to "${e}" in this project, set \`protectedEnvs\` to "allow" or "cli-only" in infra-kit.json`,stderrExcerpt:`"${e}" is delivered, not deployed ad-hoc`})};var Me=async()=>{let e;try{e=(await m()).protectedEnvs??"disallow"}catch{return E}return e==="disallow"?E:e==="cli-only"&&b()?{allowed:!1,reason:"agent-blocked"}:{allowed:!0,reason:"allowed"}};var Ve=e=>{let{env:t,branch:r}=e;w(t)&&a.warn([`\u26A0\uFE0F "${t}" is a delivery target \u2014 this project allows dispatching to it directly, but this is NOT the delivery flow.`,`Dispatching from "${r}" ships ${t} from a ref that is not merged to main, and skips:`,"  \u2022 the squash-merge of the release branch into main","  \u2022 the RC pull request","  \u2022 the Jira fix-version release","Run `infra-kit release deliver` instead if you want those."].join(`
+`)};import{$ as j}from"zx";var Se=5e3,Ne="DOPPLER_CONFIG",h=async()=>{let{envManagement:e}=await g();return e.config.name},Oe=async({childEnv:e,project:t,config:r})=>{let o=j.quiet;j.quiet=!0;try{let s=(await j({env:e})`doppler secrets get ${Ne} --plain --project ${t} --config ${r}`.timeout(Se)).stdout.trim();return s!==r?{outcome:"mis-scoped",scopedTo:s}:{outcome:"valid",scopedTo:s}}catch(n){return{outcome:je(n)}}finally{j.quiet=o}},je=e=>{let t=S(e)??(e instanceof Error?e.message:String(e));return D(t)!=="auth"?"unreachable":R(t)??"unreachable"};import Fe from"node:process";var l="INFRA_KIT_ENV_TOKEN",V=async e=>{let t=Fe.env[l];if(t)return{token:t,source:"env"};let o=(await u())?.envs[e];if(o)return{token:o,source:"store"};throw new O(Ie(e,await ae()),e)},Ie=(e,t)=>[`No Doppler service token for env "${e}".`,`Mint one at https://dashboard.doppler.com \u2014 this project \u2192 config "${e}" \u2192 Access tab \u2192 "Generate Service Token".`,`Fix: run \`infra-kit env-token-set ${e}\` and paste it.`,`It is stored in ${se(t)} (mode 0600, never in the repo).`,`CI / agents: set ${l} instead \u2014 it takes precedence and needs no home config.`].join(`
+`);import ke from"node:process";import{z as Ee}from"zod";import We from"node:process";import{z as p}from"zod";var _=async()=>{try{return(await g()).defaultEnv??null}catch{return null}};var ue=["prod"],E={allowed:!1,reason:"disallow"},w=e=>ue.includes(e),$e=["dev","stage"],Ke=e=>$e.includes(e)||w(e),Ce=(e,t=E)=>t.allowed?e:e.filter(r=>!w(r)),Le=(e,t,r=E)=>{if(!r.allowed&&w(e))throw r.reason==="agent-blocked"?new m({status:"refused",env:e,agentMode:f.source},2,{operation:t,remediation:'a human runs it from their own terminal \u2014 this project sets `protectedEnvs: "cli-only"`',stderrExcerpt:`"${e}" is withheld from agents in this project (protectedEnvs: "cli-only")`}):new ne(void 0,{operation:t,remediation:`use \`infra-kit release deliver\` \u2014 it merges the release to main, opens the RC PR, deploys from main, and releases the Jira version. To allow ad-hoc deploys to "${e}" in this project, set \`protectedEnvs\` to "allow" or "cli-only" in infra-kit.json`,stderrExcerpt:`"${e}" is delivered, not deployed ad-hoc`})};var Me=async()=>{let e;try{e=(await g()).protectedEnvs??"disallow"}catch{return E}return e==="disallow"?E:e==="cli-only"&&b()?{allowed:!1,reason:"agent-blocked"}:{allowed:!0,reason:"allowed"}};var Ve=e=>{let{env:t,branch:r}=e;w(t)&&a.warn([`\u26A0\uFE0F "${t}" is a delivery target \u2014 this project allows dispatching to it directly, but this is NOT the delivery flow.`,`Dispatching from "${r}" ships ${t} from a ref that is not merged to main, and skips:`,"  \u2022 the squash-merge of the release branch into main","  \u2022 the RC pull request","  \u2022 the Jira fix-version release","Run `infra-kit release deliver` instead if you want those."].join(`
 `))};import de from"node:fs/promises";import z from"node:path";import ze from"yaml";var fe=".github/workflows",qe=async e=>{let t=await A();return me(z.resolve(t,fe,e))},q=async()=>{let e=await A(),t=z.resolve(e,fe),r;try{r=await de.readdir(t)}catch{return[]}let o=r.filter(s=>s.endsWith(".yml")||s.endsWith(".yaml")).sort(),n=await Promise.all(o.map(s=>me(z.resolve(t,s))));return[...new Set(n.flat())]},me=async e=>{let t;try{t=ze.parse(await de.readFile(e,"utf-8"))}catch{return[]}let r=k(t,"on")??k(t,"true"),o=k(k(k(k(r,"workflow_dispatch"),"inputs"),"environment"),"options");return Array.isArray(o)?o.filter(n=>typeof n=="string"&&n.length>0):[]},k=(e,t)=>{if(!(typeof e!="object"||e===null||Array.isArray(e)))return e[t]};var y=async()=>{let e=await q(),t=await u(),r=e.map(s=>({env:s,source:"gh-workflow"})),o=new Set(e),n=Object.keys(t?.envs??{}).filter(s=>!o.has(s)).sort().map(s=>({env:s,source:"token-only"}));return[...r,...n]},W=async()=>(await y()).map(t=>t.env);var F=e=>[{type:"text",text:e}],I=e=>e;var $=(e,t,r)=>e.map(({env:o,source:n})=>({env:o,source:n,hasToken:!!(r||t[o])})),ge=["Environment","Source","Token"],Je=e=>{let t=e.map(s=>[s.env,s.source,s.hasToken?"set":"not set"]),r=ge.map((s,i)=>Math.max(s.length,...t.map(c=>(c[i]??"").length))),o=s=>s.map((i,c)=>i.padEnd(r[c]??0)).join(" | ").trimEnd(),n=r.map(s=>"\u2500".repeat(s)).join("\u2500\u253C\u2500");return["Environments:","",o(ge),n,...t.map(o)]},he=async()=>{let e=await h(),t=await y(),r=await u(),o=We.env[l],n=await _(),s=$(t,r?.envs??{},o);if(a.info(`Doppler project: ${e}`),a.info(`Default env: ${n??"none \u2014 set one with `infra-kit config-set defaultEnv <env>`"}
-`),s.length===0)return a.info("No environments found."),a.info("  Declare them in a workflow's `workflow_dispatch` `environment.options`,"),a.info("  or add a token for one manually."),ve({project:e,defaultEnv:n,envs:s});for(let i of Je(s))a.info(i);return ve({project:e,defaultEnv:n,envs:s})},ve=({project:e,defaultEnv:t,envs:r})=>{let o={project:e,defaultEnv:t,configs:r.map(n=>n.env),tokens:r};return{content:F(JSON.stringify(o,null,2)),structuredContent:o}},Ze=I({name:"env-list",description:"List the environments this project has. The list is the union of two local sources: every environment declared in a GitHub workflow's `workflow_dispatch` `environment.options` (source `gh-workflow`), and every environment the local token store holds a token for (source `token-only`). Not a live fetch from Doppler \u2014 a Doppler service token is config-scoped and cannot enumerate sibling configs. Also returns the Doppler project name, and reports per environment whether a service token resolves locally (from the token store or INFRA_KIT_ENV_TOKEN) \u2014 presence only, never the token value, and never a live Doppler probe. Read-only.",inputSchema:{},outputSchema:{project:p.string().describe("Detected Doppler project name"),defaultEnv:p.string().nullable().describe('The configured "defaultEnv" \u2014 what env-load takes when no config is named; null when unset'),configs:p.array(p.string()).describe("Every environment name known to this project"),tokens:p.array(p.object({env:p.string().describe("Environment / Doppler config name"),source:p.enum(["gh-workflow","token-only"]).describe("Where we learned this environment exists \u2014 a workflow declaration, or a token we hold"),hasToken:p.boolean().describe("Whether a service token resolves locally for this environment")})).describe("Per-environment token presence \u2014 never the token value")},handler:he});var we=e=>typeof e=="object"&&e!==null&&!Array.isArray(e),Ue=async e=>{try{return await e}catch{return[]}},He=async e=>{let t=await u().catch(()=>null);return $(e,t?.envs??{},ke.env[l]).filter(r=>!r.hasToken).map(r=>r.env)},J=()=>({get message(){return`Choose the environment to load into terminal session ${ke.env[P]??`UNKNOWN \u2014 ${P} is not set, the load will fail`}. Picking one LOADS it; there is no further prompt.`},isFormable:e=>we(e)&&(e.config===void 0||e.config===""),buildRequestedSchema:async()=>{let e=await Ue(y());if(e.length===0)return a.info({msg:"Tool execution form options empty: env-load"}),null;let t=e.map(o=>o.env),r=await He(e);return Ee.object({config:Ee.enum(t).describe(`The environment to load. ${r.length===0?"A service token is stored for every one of them.":`NO stored token for: ${r.join(", ")} \u2014 choosing one of those fails until you run \`infra-kit env-token-set <env>\`.`} The list is what env-list knows: workflow-declared environments first, then token-only ones.`)})},toArgs:(e,t)=>{let{config:r}=e;return typeof r!="string"||r.length===0?null:{...we(t)?t:{},config:r}}});import{z as Ge}from"zod";var Be=async e=>{try{return await e.provider.buildRequestedSchema(e.params)}catch(t){return a.debug({err:t,operation:e.operation},"argument form builder threw; refusing without choices"),null}},ye=async e=>{if(!x()||!e.provider.isFormable(e.params))return;let t=await Be(e),r=typeof e.params=="object"&&e.params!==null?e.params:{},o=(t===null?[]:Object.keys(t.shape)).filter(i=>r[i]===void 0||r[i]===""),n=typeof e.argument=="string"?e.argument:e.argument(o),s=t===null?void 0:Ge.toJSONSchema(t);throw new g({status:"argument_required",argument:n,...s===void 0?{}:{choices:s},agentMode:f.source},2,{operation:e.operation,remediation:s===void 0?`pass --${n} on the re-run \u2014 nothing could be listed to choose from`:`ask the human to pick from "choices", then pass --${n} on the re-run`,stderrExcerpt:`--${n} was not given and there is no human to ask`})};var tt="DOPPLER_CONFIG",Te=new Set(["DOPPLER_TOKEN",l]),Pe=!1,rt=e=>{e.length===0||Pe||(Pe=!0,a.warn(`infra-kit: not exporting ${e.join(", ")} from Doppler into your shell \u2014 a service token must not be sourced into every process.`))},ot=({pairs:e,config:t,project:r,projectRoot:o,loadedAt:n})=>{let s=e.filter(([i])=>!Te.has(i));return rt(e.filter(([i])=>Te.has(i)).map(([i])=>i)),["set -a",...s.map(([i,c])=>`${i}=${T(c)}`),`${Y}=${T(t)}`,`${Q}=${T(t)}`,`${X}=${T(r)}`,`${ee}=${T(o)}`,`${te}=${T(n)}`,"set +a"]},nt=async()=>{try{return await A()}catch{return""}},st=(e,t=C.cwd())=>{if(e==="")return[U.resolve(t)];let r=Qe(e).root??e;return[...new Set([r,`${r}${oe}`,e])]},it=async({config:e})=>{let t=await h(),r=await nt(),o=await Re(t,e),n=new Date().toISOString(),i=`${ot({pairs:o,config:e,project:t,projectRoot:r,loadedAt:n}).join(`
+`),s.length===0)return a.info("No environments found."),a.info("  Declare them in a workflow's `workflow_dispatch` `environment.options`,"),a.info("  or add a token for one manually."),ve({project:e,defaultEnv:n,envs:s});for(let i of Je(s))a.info(i);return ve({project:e,defaultEnv:n,envs:s})},ve=({project:e,defaultEnv:t,envs:r})=>{let o={project:e,defaultEnv:t,configs:r.map(n=>n.env),tokens:r};return{content:F(JSON.stringify(o,null,2)),structuredContent:o}},Ze=I({name:"env-list",description:"List the environments this project has. The list is the union of two local sources: every environment declared in a GitHub workflow's `workflow_dispatch` `environment.options` (source `gh-workflow`), and every environment the local token store holds a token for (source `token-only`). Not a live fetch from Doppler \u2014 a Doppler service token is config-scoped and cannot enumerate sibling configs. Also returns the Doppler project name, and reports per environment whether a service token resolves locally (from the token store or INFRA_KIT_ENV_TOKEN) \u2014 presence only, never the token value, and never a live Doppler probe. Read-only.",inputSchema:{},outputSchema:{project:p.string().describe("Detected Doppler project name"),defaultEnv:p.string().nullable().describe('The configured "defaultEnv" \u2014 what env-load takes when no config is named; null when unset'),configs:p.array(p.string()).describe("Every environment name known to this project"),tokens:p.array(p.object({env:p.string().describe("Environment / Doppler config name"),source:p.enum(["gh-workflow","token-only"]).describe("Where we learned this environment exists \u2014 a workflow declaration, or a token we hold"),hasToken:p.boolean().describe("Whether a service token resolves locally for this environment")})).describe("Per-environment token presence \u2014 never the token value")},handler:he});var we=e=>typeof e=="object"&&e!==null&&!Array.isArray(e),Ue=async e=>{try{return await e}catch{return[]}},He=async e=>{let t=await u().catch(()=>null);return $(e,t?.envs??{},ke.env[l]).filter(r=>!r.hasToken).map(r=>r.env)},J=()=>({get message(){return`Choose the environment to load into terminal session ${ke.env[P]??`UNKNOWN \u2014 ${P} is not set, the load will fail`}. Picking one LOADS it; there is no further prompt.`},isFormable:e=>we(e)&&(e.config===void 0||e.config===""),buildRequestedSchema:async()=>{let e=await Ue(y());if(e.length===0)return a.info({msg:"Tool execution form options empty: env-load"}),null;let t=e.map(o=>o.env),r=await He(e);return Ee.object({config:Ee.enum(t).describe(`The environment to load. ${r.length===0?"A service token is stored for every one of them.":`NO stored token for: ${r.join(", ")} \u2014 choosing one of those fails until you run \`infra-kit env-token-set <env>\`.`} The list is what env-list knows: workflow-declared environments first, then token-only ones.`)})},toArgs:(e,t)=>{let{config:r}=e;return typeof r!="string"||r.length===0?null:{...we(t)?t:{},config:r}}});import{z as Ge}from"zod";var Be=async e=>{try{return await e.provider.buildRequestedSchema(e.params)}catch(t){return a.debug({err:t,operation:e.operation},"argument form builder threw; refusing without choices"),null}},ye=async e=>{if(!x()||!e.provider.isFormable(e.params))return;let t=await Be(e),r=typeof e.params=="object"&&e.params!==null?e.params:{},o=(t===null?[]:Object.keys(t.shape)).filter(i=>r[i]===void 0||r[i]===""),n=typeof e.argument=="string"?e.argument:e.argument(o),s=t===null?void 0:Ge.toJSONSchema(t);throw new m({status:"argument_required",argument:n,...s===void 0?{}:{choices:s},agentMode:f.source},2,{operation:e.operation,remediation:s===void 0?`pass --${n} on the re-run \u2014 nothing could be listed to choose from`:`ask the human to pick from "choices", then pass --${n} on the re-run`,stderrExcerpt:`--${n} was not given and there is no human to ask`})};var tt="DOPPLER_CONFIG",Te=new Set(["DOPPLER_TOKEN",l]),Pe=!1,rt=e=>{e.length===0||Pe||(Pe=!0,a.warn(`infra-kit: not exporting ${e.join(", ")} from Doppler into your shell \u2014 a service token must not be sourced into every process.`))},ot=({pairs:e,config:t,project:r,projectRoot:o,loadedAt:n})=>{let s=e.filter(([i])=>!Te.has(i));return rt(e.filter(([i])=>Te.has(i)).map(([i])=>i)),["set -a",...s.map(([i,c])=>`${i}=${T(c)}`),`${Y}=${T(t)}`,`${Q}=${T(t)}`,`${X}=${T(r)}`,`${ee}=${T(o)}`,`${te}=${T(n)}`,"set +a"]},nt=async()=>{try{return await A()}catch{return""}},st=(e,t=C.cwd())=>{if(e==="")return[U.resolve(t)];let r=Qe(e).root??e;return[...new Set([r,`${r}${oe}`,e])]},it=async({config:e})=>{let t=await h(),r=await nt(),o=await Re(t,e),n=new Date().toISOString(),i=`${ot({pairs:o,config:e,project:t,projectRoot:r,loadedAt:n}).join(`
 `)}
 `,c=re(),H=U.resolve(c,G);et.mkdirSync(c,{recursive:!0,mode:448});let _e=st(r);return L(U.resolve(c,B),`${_e.join(`
 `)}
-`,384),L(H,i,384),{filePath:H,variableCount:o.length,project:t,config:e}},De=J(),at=async e=>{let{config:t}=e,r=t?null:await _();if(!t&&r&&x())return Z(r,"default");if(await ye({provider:De,params:e,operation:"env-load",argument:"config"}),t)return Z(t,"argument");if(b())throw new g({status:"argument_required",argument:"config",agentMode:f.source},2,{operation:"env-load",remediation:'call env-list, ask the human which environment, and re-call env-load with "config"'});let o=await W();N.setInteractive();let n=await ie(s=>Ye({message:"Select environment config",choices:ct(o,r),...r?{default:r}:{}},s),{output:C.stderr,whenHeadless:"refuse"});return Z(n,"picker")},ct=(e,t)=>(t&&!e.includes(t)?[t,...e]:e).map(o=>({name:o===t?`${o} (default)`:o,value:o})),Z=async(e,t)=>{N.addOption("--config",e);let r=await it({config:e});N.print();let o={filePath:r.filePath,variableCount:r.variableCount,project:r.project,config:r.config,configSource:t,sessionId:C.env[P]??null};return{content:F(JSON.stringify(o,null,2)),structuredContent:o}},Ae=1024*1024,lt=3e4,pt=["DOPPLER_TOKEN","DOPPLER_PROJECT","DOPPLER_CONFIG"],ut=(e,t=C.env)=>{let r={...t};for(let o of pt)delete r[o];return r.DOPPLER_TOKEN=e,r},io=async e=>new Map(await Re(await h(),e)),Re=async(e,t)=>{let{token:r}=await V(t),o=ut(r),n=K.quiet;K.quiet=!0;try{let s;try{s=await K({env:o})`doppler secrets download --no-file --format json --project ${e} --config ${t}`.timeout(lt)}catch(c){throw ft(c,e,t)}mt(s.stdout);let i=vt(s.stdout);return dt(i,t),i}finally{K.quiet=n}},dt=(e,t)=>{let r=e.find(([o])=>o===tt)?.[1];if(!(r===void 0||r===t))throw new v(t,null,`Doppler returned secrets for config "${r}" but "${t}" was requested \u2014 the service token for env "${t}" is scoped to the wrong config. Refusing to load another environment's secrets.
+`,384),L(H,i,384),{filePath:H,variableCount:o.length,project:t,config:e}},De=J(),at=async e=>{let{config:t}=e,r=t?null:await _();if(!t&&r&&x())return Z(r,"default");if(await ye({provider:De,params:e,operation:"env-load",argument:"config"}),t)return Z(t,"argument");if(b())throw new m({status:"argument_required",argument:"config",agentMode:f.source},2,{operation:"env-load",remediation:'call env-list, ask the human which environment, and re-call env-load with "config"'});let o=await W();N.setInteractive();let n=await ie(s=>Ye({message:"Select environment config",choices:ct(o,r),...r?{default:r}:{}},s),{output:C.stderr,whenHeadless:"refuse"});return Z(n,"picker")},ct=(e,t)=>(t&&!e.includes(t)?[t,...e]:e).map(o=>({name:o===t?`${o} (default)`:o,value:o})),Z=async(e,t)=>{N.addOption("--config",e);let r=await it({config:e});N.print();let o={filePath:r.filePath,variableCount:r.variableCount,project:r.project,config:r.config,configSource:t,sessionId:C.env[P]??null};return{content:F(JSON.stringify(o,null,2)),structuredContent:o}},Ae=1024*1024,lt=3e4,pt=["DOPPLER_TOKEN","DOPPLER_PROJECT","DOPPLER_CONFIG"],ut=(e,t=C.env)=>{let r={...t};for(let o of pt)delete r[o];return r.DOPPLER_TOKEN=e,r},io=async e=>new Map(await Re(await h(),e)),Re=async(e,t)=>{let{token:r}=await V(t),o=ut(r),n=K.quiet;K.quiet=!0;try{let s;try{s=await K({env:o})`doppler secrets download --no-file --format json --project ${e} --config ${t}`.timeout(lt)}catch(c){throw ft(c,e,t)}mt(s.stdout);let i=vt(s.stdout);return dt(i,t),i}finally{K.quiet=n}},dt=(e,t)=>{let r=e.find(([o])=>o===tt)?.[1];if(!(r===void 0||r===t))throw new v(t,null,`Doppler returned secrets for config "${r}" but "${t}" was requested \u2014 the service token for env "${t}" is scoped to the wrong config. Refusing to load another environment's secrets.
 Fix: run \`infra-kit env-token-set ${t}\` with a token scoped to "${t}".`)},ft=(e,t,r)=>{let o=S(e)??(e instanceof Error?e.message:String(e)),n=D(o);return n==="auth"?new v(r,R(o)):n==="unknown"?e instanceof Error?e:new Error(String(e)):new Error(M({kind:n,project:t,config:r,available:null}))},mt=e=>{let t=Xe.byteLength(e,"utf-8");if(t>Ae)throw new Error(`doppler returned unexpectedly large output (${t} bytes > ${Ae}) \u2014 refusing to write to disk`)},T=e=>`'${e.replaceAll("'","'\\''")}'`,gt=/^[A-Z_]\w*$/i,vt=e=>{let t;try{t=JSON.parse(e)}catch{throw new Error(`doppler returned non-JSON output for env-load (got: ${JSON.stringify(e.slice(0,80))})`)}if(t===null||typeof t!="object"||Array.isArray(t))throw new Error("doppler returned unexpected JSON shape for env-load (expected an object of KEY: value pairs)");let r=[];for(let[o,n]of Object.entries(t)){if(!gt.test(o))throw new Error(`doppler returned an invalid env var name for env-load (got: ${JSON.stringify(o.slice(0,80))})`);if(typeof n!="string")throw new TypeError(`doppler returned a non-string value for "${o}" (got ${typeof n})`);r.push([o,n])}if(r.length===0)throw new Error("doppler returned empty output for env-load");return r},ao=I({name:"env-load",description:'Download the env vars for a Doppler config and write them to a temporary shell script. Does NOT mutate the calling process \u2014 returns the path to a script that must be sourced ("source <filePath>") for the vars to take effect. The infra-kit shell wrapper auto-sources; direct MCP callers must handle sourcing themselves or surface filePath to the user. This server picks the file up on its next tool call, so a tool that needs the variables can be called right after. Omit "config" and this server offers the human a form listing every environment env-list knows, token-less ones marked; a client that cannot render one gets a refusal naming the missing field \u2014 call env-list and ask the human, never guess. When the project config sets "defaultEnv", omitting "config" headless loads that environment instead of refusing, and "configSource" reports "default".',inputSchema:{config:d.string().optional().describe('Doppler config / environment name to load (e.g. "dev", "arthur"). Omit it to load the configured "defaultEnv", or, with none set, to have the human choose from a form.')},formProvider:De,outputSchema:{filePath:d.string().describe("Path to the file that must be sourced to apply variables"),variableCount:d.number().describe("Number of variables loaded"),project:d.string().describe("Doppler project name"),config:d.string().describe("Doppler config name"),configSource:d.enum(["argument","default","picker"]).describe('How the config was chosen: passed as "config", the configured "defaultEnv", or the terminal picker'),sessionId:d.string().nullable().describe("The INFRA_KIT_SESSION the file was written for; null when the process had no session")},handler:at});export{F as a,I as b,D as c,R as d,h as e,Oe as f,l as g,V as h,ue as i,w as j,Ke as k,Ce as l,Le as m,Me as n,Ve as o,qe as p,y as q,W as r,he as s,Ze as t,ye as u,ot as v,st as w,it as x,at as y,ct as z,Ae as A,ut as B,io as C,dt as D,ft as E,mt as F,T as G,vt as H,ao as I};
-//# sourceMappingURL=chunk-QCTAEXMN.js.map
+//# sourceMappingURL=chunk-SBG3HRSC.js.map