infra-kit 0.42.0 → 0.43.0

package/dist/{chunk-K5KNXRTF.js.map → chunk-KA5BFUCS.js.map}

@@ -2,6 +2,6 @@
   "version": 3,
   "sources": ["../src/integrations/doppler/secrets-download.ts", "../src/integrations/doppler/doppler-errors.ts", "../src/integrations/doppler/doppler-project.ts", "../src/integrations/doppler/token-resolver.ts"],
   "sourcesContent": ["import { Buffer } from 'node:buffer'\nimport process from 'node:process'\nimport { $ } from 'zx'\n\nimport { extractStderr } from 'src/lib/errors/operation-error'\n\nimport {\n  DopplerAuthError,\n  buildDopplerNotFoundMessage,\n  classifyDopplerAuthFailure,\n  classifyDopplerFailure,\n} from './doppler-errors'\nimport { getDopplerProject } from './doppler-project'\nimport { resolveEnvToken } from './token-resolver'\n\n/** The payload key that carries the token's scope \u2014 the one {@link assertTokenScope} compares. */\nconst DOPPLER_CONFIG_KEY = 'DOPPLER_CONFIG'\n\n/**\n * Cap the Doppler stdout we're willing to accept. A well-formed env bundle is\n * O(10 KB); megabytes would indicate a service regression or the wrong stream\n * being captured, and we don't want to write that to disk or source it.\n */\nexport const DOPPLER_MAX_OUTPUT_BYTES = 1024 * 1024\n\n/**\n * Hard upper bound for the Doppler subprocess. Well under zx's default so a\n * hung call surfaces quickly instead of blocking an interactive shell.\n */\nconst DOPPLER_DOWNLOAD_TIMEOUT_MS = 30_000\n\n/**\n * Doppler env vars we refuse to inherit into the download child. SPIKE-0 Q5: an inherited\n * `DOPPLER_TOKEN` OVERRIDES everything else the CLI would use \u2014 and `env-load` itself exports a whole\n * Doppler project into the shell, so a project that happens to hold a secret named `DOPPLER_TOKEN`\n * would silently hijack the NEXT download. `DOPPLER_PROJECT` / `DOPPLER_CONFIG` are scrubbed for the\n * same reason: they are the payload's own scope evidence, and an inherited copy could shadow the\n * `--project` / `--config` we pass in argv.\n */\nconst INHERITED_DOPPLER_VARS = ['DOPPLER_TOKEN', 'DOPPLER_PROJECT', 'DOPPLER_CONFIG'] as const\n\n/**\n * The child environment for `doppler secrets download`: the caller's env with the inherited Doppler\n * vars scrubbed and OUR resolved token set explicitly.\n *\n * The token travels by ENV, never by argv: `ps` shows argv to every user on the box, and\n * `commandEcho` prints option values back to the terminal. Pure (takes the base env) so the scrub is\n * unit-testable without touching `process.env`.\n *\n * @example\n * buildDopplerChildEnv('dp.st.x', { PATH: '/bin', DOPPLER_CONFIG: 'prod' })\n * // => { PATH: '/bin', DOPPLER_TOKEN: 'dp.st.x' }   (DOPPLER_CONFIG dropped)\n */\nexport const buildDopplerChildEnv = (token: string, baseEnv: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv => {\n  const childEnv: NodeJS.ProcessEnv = { ...baseEnv }\n\n  for (const name of INHERITED_DOPPLER_VARS) {\n    delete childEnv[name]\n  }\n\n  childEnv.DOPPLER_TOKEN = token\n\n  return childEnv\n}\n\n/**\n * One Doppler config's secrets, downloaded with the token stored for it \u2014 `env-load`'s own fetch, for a\n * caller that needs a few values of an env without loading the whole env into a shell.\n */\nexport const downloadEnvSecrets = async (config: string): Promise<Map<string, string>> => {\n  return new Map(await downloadDopplerSecrets(await getDopplerProject(), config))\n}\n\nexport const downloadDopplerSecrets = async (project: string, config: string): Promise<Array<[string, string]>> => {\n  const { token } = await resolveEnvToken(config)\n\n  const childEnv = buildDopplerChildEnv(token)\n\n  const prevQuiet = $.quiet\n\n  $.quiet = true\n  try {\n    let result\n\n    try {\n      result = await $({\n        env: childEnv,\n      })`doppler secrets download --no-file --format json --project ${project} --config ${config}`.timeout(\n        DOPPLER_DOWNLOAD_TIMEOUT_MS,\n      )\n    } catch (error: unknown) {\n      throw translateDopplerDownloadError(error, project, config)\n    }\n\n    assertDopplerOutputSize(result.stdout)\n\n    const pairs = parseDopplerSecretsJson(result.stdout)\n\n    assertTokenScope(pairs, config)\n\n    return pairs\n  } finally {\n    $.quiet = prevQuiet\n  }\n}\n\n/**\n * Defense in depth against a MIS-SCOPED token: the payload always carries `DOPPLER_CONFIG` as an\n * ordinary secret, and it echoes the `--config` we asked for (SPIKE-0 Q2 \u2014 it is the CONFIG, not\n * `DOPPLER_ENVIRONMENT`, which can differ: config `dev_personal` lives in environment `dev`).\n *\n * ABSENT \u21D2 PROCEED, deliberately. The Doppler CLI already refuses a real mismatch on the wire\n * (SPIKE-0 Q1: exit 1, \"does not have access to requested config\"), so it \u2014 not this \u2014 is the\n * load-bearing guard. An absent `DOPPLER_CONFIG` therefore means Doppler changed what it injects,\n * and failing closed here would blank every developer's shell at once.\n *\n * @example\n * assertTokenScope([['DOPPLER_CONFIG', 'dev']], 'dev')   // ok\n * assertTokenScope([['FOO', 'bar']], 'dev')              // ok (absent \u21D2 proceed)\n * assertTokenScope([['DOPPLER_CONFIG', 'prod']], 'dev')  // throws: token is scoped to \"prod\"\n */\nexport const assertTokenScope = (pairs: Array<[string, string]>, config: string): void => {\n  const actual = pairs.find(([key]) => {\n    return key === DOPPLER_CONFIG_KEY\n  })?.[1]\n\n  if (actual === undefined || actual === config) return\n\n  // A DopplerAuthError, not a plain Error: this IS an auth failure, and callers classify by TYPE\n  // (`isEnvAuthFailure`), so a plain Error would read as transient. The message stays richer than the\n  // generic one: we know the token's real config.\n  throw new DopplerAuthError(\n    config,\n    null,\n    `Doppler returned secrets for config \"${actual}\" but \"${config}\" was requested \u2014 the service token for ` +\n      `env \"${config}\" is scoped to the wrong config. Refusing to load another environment's secrets.\\n` +\n      `Fix: run \\`infra-kit env-token-set ${config}\\` with a token scoped to \"${config}\".`,\n  )\n}\n\n/**\n * Turn a raw `doppler secrets download` failure into an actionable error. An AUTH-class failure (the\n * token is invalid, revoked, or mis-scoped) becomes a {@link DopplerAuthError} carrying the\n * env-token-set message; a recognized project/config not-found points at the exact infra-kit.json\n * field. Anything else \u2014 network, timeout \u2014 is rethrown untouched so it degrades to the existing\n * behavior, never worse.\n *\n * This is THE boundary where Doppler's raw stderr is read: the markers exist only here, and the\n * classification leaves as a TYPE (`DopplerAuthError`), never as prose for a downstream module to\n * re-parse. Exported so a seam test can drive the REAL error a caller sees.\n *\n * @example\n * translateDopplerDownloadError({ stderr: 'Doppler Error: Invalid Auth token' }, 'p', 'dev')\n * // => DopplerAuthError { authKind: 'revoked', message: '\u2026 `infra-kit env-token-set <env>` \u2026' }\n * translateDopplerDownloadError(new Error('connect ETIMEDOUT'), 'p', 'dev')\n * // => the same Error, untouched\n */\n// Why a type and not prose: a caller that text-matched the raw Doppler markers on the error this\n// function had already rewritten found them long gone, and a revoked token went silent.\n//\n// The not-found message no longer lists the AVAILABLE names: `listDopplerProjects` /\n// `listDopplerConfigs` require an ACCOUNT login, which token-only auth deleted, so that probe\n// could only ever return `null` now. `buildDopplerNotFoundMessage` already treats `null` as\n// \"couldn't tell\" and omits the suggestion line rather than misreporting \"none exist\".\nexport const translateDopplerDownloadError = (error: unknown, project: string, config: string): Error => {\n  const stderr = extractStderr(error) ?? (error instanceof Error ? error.message : String(error))\n  const kind = classifyDopplerFailure(stderr)\n\n  if (kind === 'auth') return new DopplerAuthError(config, classifyDopplerAuthFailure(stderr))\n\n  if (kind === 'unknown') return error instanceof Error ? error : new Error(String(error))\n\n  return new Error(buildDopplerNotFoundMessage({ kind, project, config, available: null }))\n}\n\nexport const assertDopplerOutputSize = (stdout: string): void => {\n  const bytes = Buffer.byteLength(stdout, 'utf-8')\n\n  if (bytes > DOPPLER_MAX_OUTPUT_BYTES) {\n    throw new Error(\n      `doppler returned unexpectedly large output (${bytes} bytes > ${DOPPLER_MAX_OUTPUT_BYTES}) \u2014 refusing to write to disk`,\n    )\n  }\n}\n\n/** A valid POSIX env-var name: a letter or underscore, then word characters. */\nconst ENV_VAR_NAME_PATTERN = /^[A-Z_]\\w*$/i\n\n/**\n * Parse the `doppler secrets download --format json` output (a flat\n * `{\"KEY\":\"value\"}` map) into ordered `[key, value]` pairs, validating the shape\n * and every name/value. Values are returned RAW \u2014 callers must single-quote them\n * before emitting shell (an unquoted `a$(cmd)b` would execute on `source`).\n *\n * @example\n * parseDopplerSecretsJson('{\"FOO\":\"bar\",\"BAZ\":\"a$(x)\"}')\n * // => [['FOO', 'bar'], ['BAZ', 'a$(x)']]\n */\nexport const parseDopplerSecretsJson = (stdout: string): Array<[string, string]> => {\n  let parsed: unknown\n\n  try {\n    parsed = JSON.parse(stdout)\n  } catch {\n    throw new Error(`doppler returned non-JSON output for env-load (got: ${JSON.stringify(stdout.slice(0, 80))})`)\n  }\n\n  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {\n    throw new Error('doppler returned unexpected JSON shape for env-load (expected an object of KEY: value pairs)')\n  }\n\n  const pairs: Array<[string, string]> = []\n\n  for (const [key, value] of Object.entries(parsed)) {\n    if (!ENV_VAR_NAME_PATTERN.test(key)) {\n      throw new Error(\n        `doppler returned an invalid env var name for env-load (got: ${JSON.stringify(key.slice(0, 80))})`,\n      )\n    }\n\n    if (typeof value !== 'string') {\n      throw new TypeError(`doppler returned a non-string value for \"${key}\" (got ${typeof value})`)\n    }\n\n    pairs.push([key, value])\n  }\n\n  if (pairs.length === 0) {\n    throw new Error('doppler returned empty output for env-load')\n  }\n\n  return pairs\n}\n", "/**\n * @fileoverview\n *\n * Translate Doppler `secrets download` not-found failures into actionable,\n * point-at-the-fix guidance. Pure (no I/O) so the classification + message policy\n * is unit-testable without spawning the Doppler CLI \u2014 mirroring the pure-helper\n * pattern in `./secrets-download.ts`.\n *\n * Observed Doppler output on a not-found download (verified 2026-06-27, doppler\n * v3.76.0), exit 1, written to STDERR (stdout empty):\n *   Unable to download secrets\n *   Doppler Error: Could not find requested project 'name'\n *   Doppler Error: Could not find requested config 'name'\n * Only the \"Doppler Error:\" prefix is ANSI-colored; the \"Could not find requested\n * ...\" text is plain, so substring matching is color-safe. zx's\n * `ProcessOutput.message` also concatenates stdout+stderr, so the same markers are\n * matchable off `.message` when `.stderr` is unavailable.\n */\nimport { EnvAuthError } from 'src/lib/errors/env-auth-error'\n\n/** Which kind of Doppler not-found a download failure represents (`unknown` = not a not-found error). */\nexport type DopplerNotFoundKind = 'project' | 'config' | 'unknown'\n\n/**\n * Every class of `secrets download` failure we act on. `'auth'` is the token-only addition: the\n * service token is absent, revoked, garbage, or scoped to a DIFFERENT config. It is deliberately\n * distinct from the not-found kinds (the name is wrong) and from `'unknown'` (network, timeout,\n * Doppler down) \u2014 only `'auth'` is a durable, user-fixable state.\n */\nexport type DopplerFailureKind = 'auth' | DopplerNotFoundKind\n\nconst PROJECT_NOT_FOUND_MARKER = 'Could not find requested project'\nconst CONFIG_NOT_FOUND_MARKER = 'Could not find requested config'\n\n/**\n * The REAL auth-class stderr markers, captured from a live Doppler CLI v3.76.0 (SPIKE-0 Q1/Q4):\n *   - `Invalid Auth token`                                       \u2014 revoked / garbage token\n *   - `This token does not have access to requested config 'x'`  \u2014 mis-scoped token\n * Both are plain (uncolored) text, so substring matching is ANSI-safe. The second one is the CLI\n * ENFORCING the token's scope for us \u2014 it is the primary mis-scope guard, not our payload assert.\n */\nconst INVALID_TOKEN_MARKER = 'Invalid Auth token'\nconst TOKEN_SCOPE_MARKER = 'does not have access to requested config'\n\n/**\n * Classify a Doppler `secrets download` failure from its stderr/message text. The full lattice:\n * auth-class first (a mis-scoped token's message names a config but is NOT a not-found), then the\n * two not-found kinds, then `'unknown'` for everything else so the caller can rethrow the original\n * untouched (degrades to status quo, never worse).\n *\n * @example\n * classifyDopplerFailure('Doppler Error: Invalid Auth token')                            // => 'auth'\n * classifyDopplerFailure(\"This token does not have access to requested config 'dev'\")    // => 'auth'\n * classifyDopplerFailure(\"Doppler Error: Could not find requested project 'x'\")          // => 'project'\n * classifyDopplerFailure('connect ETIMEDOUT')                                            // => 'unknown'\n */\nexport const classifyDopplerFailure = (stderr: string): DopplerFailureKind => {\n  if (stderr.includes(INVALID_TOKEN_MARKER) || stderr.includes(TOKEN_SCOPE_MARKER)) return 'auth'\n\n  if (stderr.includes(PROJECT_NOT_FOUND_MARKER)) return 'project'\n\n  if (stderr.includes(CONFIG_NOT_FOUND_MARKER)) return 'config'\n\n  return 'unknown'\n}\n\n/**\n * The two auth-class failures, told apart. Both are `'auth'` to\n * {@link classifyDopplerFailure} \u2014 they share one fix (a new token) \u2014 but they are DIFFERENT\n * diagnoses, and `doctor` must not conflate them: \"your token was revoked\" sends a user to the\n * Doppler dashboard, \"your token is scoped to the wrong config\" sends them to re-issue it against\n * the right one.\n */\nexport type DopplerAuthKind = 'revoked' | 'mis-scoped'\n\n/**\n * Split an auth-class failure into its two diagnoses, or `null` when the text is not auth-class at\n * all (network, timeout, not-found) \u2014 the caller must not read `null` as \"the token is fine\", only\n * as \"this failure says nothing about the token\".\n *\n * @example\n * classifyDopplerAuthFailure(\"This token does not have access to requested config 'dev'\") // => 'mis-scoped'\n * classifyDopplerAuthFailure('Doppler Error: Invalid Auth token')                         // => 'revoked'\n * classifyDopplerAuthFailure('connect ETIMEDOUT')                                         // => null\n */\nexport const classifyDopplerAuthFailure = (stderr: string): DopplerAuthKind | null => {\n  if (stderr.includes(TOKEN_SCOPE_MARKER)) return 'mis-scoped'\n\n  if (stderr.includes(INVALID_TOKEN_MARKER)) return 'revoked'\n\n  return null\n}\n\n/**\n * Is this failure text an auth-class Doppler failure (bad / absent / mis-scoped service token)\n * rather than a transient one (network, timeout, Doppler down)? The single source of truth\n * callers classify on.\n *\n * @example\n * isDopplerAuthFailure('Doppler Error: Invalid Auth token') // => true\n * isDopplerAuthFailure('network unreachable')               // => false\n */\nexport const isDopplerAuthFailure = (stderr: string): boolean => {\n  return classifyDopplerFailure(stderr) === 'auth'\n}\n\n/**\n * Classify a Doppler download failure into the NOT-FOUND lattice only. Auth-class failures collapse\n * to `'unknown'` here on purpose: this predicate's whole contract is \"is this a wrong-NAME error\",\n * and its callers enrich with project/config listings that an auth failure must never trigger. Use\n * {@link classifyDopplerFailure} when you need the full lattice.\n *\n * @example\n * classifyDopplerDownloadError(\"Doppler Error: Could not find requested project 'x'\") // => 'project'\n * classifyDopplerDownloadError(\"Doppler Error: Could not find requested config 'dev'\") // => 'config'\n * classifyDopplerDownloadError('Doppler Error: Invalid Auth token')                    // => 'unknown'\n */\nexport const classifyDopplerDownloadError = (stderr: string): DopplerNotFoundKind => {\n  const kind = classifyDopplerFailure(stderr)\n\n  return kind === 'auth' ? 'unknown' : kind\n}\n\n/**\n * The actionable body for an auth-class download failure: Doppler REFUSED the token we sent, so the\n * fix is always a new token for this env \u2014 never `doppler login` (account auth no longer exists).\n *\n * Deliberately does not interpolate the raw stderr: this message is user-facing, and the one rule a\n * credential path cannot bend is that nothing token-adjacent gets rendered by accident.\n *\n * @example\n * buildDopplerAuthFailureMessage('dev')\n * // => 'Doppler rejected the service token for env \"dev\" \u2026 run `infra-kit env-token-set <env>` \u2026'\n */\nexport const buildDopplerAuthFailureMessage = (env: string): string => {\n  return [\n    `Doppler rejected the service token for env \"${env}\" \u2014 it is invalid, revoked, or scoped to a different config.`,\n    `Fix: run \\`infra-kit env-token-set ${env}\\` with a token scoped to that config.`,\n    'CI / agents: set INFRA_KIT_ENV_TOKEN to a token scoped to that config.',\n  ].join('\\n')\n}\n\n/**\n * An auth-class `secrets download` failure, as a TYPE rather than a string. This is the error\n * `env-load`'s `translateDopplerDownloadError` throws for the auth class, and it is what every\n * DOWNSTREAM consumer classifies on.\n *\n * It is the DOPPLER-REFUSED-US subset of {@link EnvAuthError}, the durable/user-fixable env-auth\n * class. Downstream policy therefore classifies on `isEnvAuthFailure`; `isDopplerAuthError`\n * remains for the callers who genuinely mean \"the token was SENT and Doppler\n * rejected it\". The message is unchanged \u2014 {@link buildDopplerAuthFailureMessage} still renders\n * it \u2014 so a human who only ever sees `error.message` sees precisely what they saw before.\n *\n * @example\n * throw new DopplerAuthError('dev', 'revoked')\n * // message: 'Doppler rejected the service token for env \"dev\" \u2026 `infra-kit env-token-set <env>` \u2026'\n */\n// WHY a class and not \"match the message\": the moment the raw Doppler stderr is translated into a\n// human-facing message the markers it was classified by are GONE. A consumer that re-derives the\n// class by re-parsing that message is coupled to prose owned by another module \u2014 and the coupling\n// is SILENT: reword the message and the auth channel simply stops firing, with every unit test on\n// both sides still green (exactly the defect this type exists to make impossible). The\n// classification now travels WITH the error.\n//\n// Why the subset framing: a missing token never reaches Doppler, and a corrupt token store never\n// reaches the resolver, yet all three are equally durable and equally the user's to fix.\n//\n// The @example names the command as `infra-kit env-token-set <env>` rather than with a literal arg\n// for `program.test.ts`'s benefit: to that scan an `<env>` placeholder ENDS the command, but a\n// literal `dev` is indistinguishable from a subcommand and would be reported as a dead one.\nexport class DopplerAuthError extends EnvAuthError {\n  /**\n   * The env (= Doppler config) whose service token Doppler refused. Names the fix, carries no token.\n   *\n   * `declare` NARROWS the base's `string | null` (a Doppler refusal always names one env) without\n   * re-declaring the field: under `useDefineForClassFields` a real re-declaration would `defineProperty`\n   * it back to `undefined` AFTER `super()` had set it.\n   */\n  declare readonly env: string\n  /**\n   * Which of the two auth diagnoses the raw stderr indicated, or `null` when it was not stated\n   * (e.g. the payload-scope assert, which never sees Doppler's stderr). Diagnostic only \u2014 every\n   * auth kind shares one fix.\n   */\n  readonly authKind: DopplerAuthKind | null\n\n  /**\n   * `message` overrides the rendered text for a caller that knows MORE than the generic diagnosis \u2014\n   * the payload-scope assert can name the config the token actually belongs to, which Doppler's own\n   * refusal cannot. It never changes the CLASS: every auth failure must remain type-detectable, or it\n   * degrades to the transient 30s marker and the user is never told (the defect this type exists to\n   * make impossible).\n   */\n  constructor(env: string, authKind: DopplerAuthKind | null = null, message?: string) {\n    super(message ?? buildDopplerAuthFailureMessage(env), env)\n    this.name = 'DopplerAuthError'\n    this.authKind = authKind\n  }\n}\n\n/**\n * The NARROW type guard: \"we sent Doppler a token and Doppler refused it\". Not text-matching \u2014 that\n * is how a caller asks \"was this the token?\" without re-parsing a rendered message.\n *\n * Use {@link isEnvAuthFailure} instead when the question is the POLICY one \u2014 \"is this durable and the\n * user's to fix?\" \u2014 because a missing token and a corrupt token store are both of those and neither is\n * a Doppler refusal; narrowing policy to this guard silently drops both cases.\n *\n * @example\n * isDopplerAuthError(new DopplerAuthError('dev'))                   // => true\n * isDopplerAuthError(new Error('Doppler Error: Invalid Auth token')) // => false (untranslated: not ours to claim)\n */\nexport const isDopplerAuthError = (error: unknown): error is DopplerAuthError => {\n  return error instanceof DopplerAuthError\n}\n\ninterface DopplerNotFoundMessageArgs {\n  /** Whether the missing entity is the project or the config within it. */\n  kind: 'project' | 'config'\n  project: string\n  config: string\n  /**\n   * Names to suggest. `null` = lookup failed/unavailable, `[]` = none exist; both\n   * omit the suggestion line so a failed enrichment probe is never misreported as\n   * a definitive \"none available\".\n   */\n  available?: string[] | null\n}\n\n/**\n * Build the actionable, multi-line error body for a Doppler not-found failure:\n * states what's missing, points at the exact infra-kit.json field, lists available\n * names when known, and gives a concrete fix.\n *\n * @example\n * buildDopplerNotFoundMessage({ kind: 'project', project: 'infra-kit', config: 'dev', available: ['nomadream'] })\n * // => 'Doppler project \"infra-kit\" not found (set in infra-kit.json \u2192 envManagement.config.name).\\nAvailable projects: nomadream.\\nFix: ...'\n */\nexport const buildDopplerNotFoundMessage = ({\n  kind,\n  project,\n  config,\n  available,\n}: DopplerNotFoundMessageArgs): string => {\n  const lines: string[] =\n    kind === 'project'\n      ? [`Doppler project \"${project}\" not found (set in infra-kit.json \u2192 envManagement.config.name).`]\n      : [`Doppler config \"${config}\" not found in project \"${project}\".`]\n\n  if (available && available.length > 0) {\n    const label = kind === 'project' ? 'Available projects' : `Available configs in \"${project}\"`\n\n    lines.push(`${label}: ${available.join(', ')}.`)\n  }\n\n  // The config half no longer points at a config file: there IS no declared env list any more. The name\n  // came from a workflow, a token, or the `--config` flag, and the only place to fix a genuinely missing\n  // one is Doppler itself.\n  lines.push(\n    kind === 'project'\n      ? 'Fix: update envManagement.config.name to an existing project, or create it in Doppler.'\n      : 'Fix: pass an existing config, or create it in Doppler.',\n  )\n\n  return lines.join('\\n')\n}\n", "import { $ } from 'zx'\n\nimport { classifyDopplerAuthFailure, classifyDopplerFailure } from 'src/integrations/doppler/doppler-errors'\nimport { extractStderr } from 'src/lib/errors/operation-error'\nimport { getInfraKitConfig } from 'src/lib/infra-kit-config'\n\n/**\n * Hard upper bound for the Doppler probe. It runs only on the diagnostic path (`doctor`), but a hung\n * VPN/connection must not stall it.\n */\nconst DOPPLER_PROBE_TIMEOUT_MS = 5_000\n\n/**\n * The one secret every Doppler payload carries, whose value is the config the token is scoped to\n * (SPIKE-0 Q2 \u2014 the CONFIG, not `DOPPLER_ENVIRONMENT`, which can differ: config `dev_personal` lives\n * in environment `dev`). Reading it back is what turns a liveness probe into a SCOPE probe.\n */\nconst SCOPE_KEY = 'DOPPLER_CONFIG'\n\n/**\n * Resolve Doppler project name from infra-kit.json at the project root\n */\nexport const getDopplerProject = async (): Promise<string> => {\n  const { envManagement } = await getInfraKitConfig()\n\n  return envManagement.config.name\n}\n\n/**\n * What a service token turned out to be, once Doppler was asked.\n *\n * `'unreachable'` is the load-bearing one and it means \"COULDN'T TELL\", never \"bad\": network,\n * timeout, VPN, Doppler down, a CLI that isn't installed. A caller that renders it as a definitive\n * verdict would tell a developer on a plane that their token was revoked. (Same `null`-vs-`[]`\n * contract the deleted `listDopplerProjects` carried, in enum form.)\n */\nexport type EnvTokenProbeOutcome = 'valid' | 'revoked' | 'mis-scoped' | 'unreachable'\n\nexport interface EnvTokenProbe {\n  outcome: EnvTokenProbeOutcome\n  /** The config the token actually resolved to, when Doppler told us. Never a token value. */\n  scopedTo?: string\n}\n\ninterface EnvTokenProbeArgs {\n  /**\n   * The child environment carrying the token \u2014 built by `buildDopplerChildEnv`, which scrubs the\n   * inherited `DOPPLER_*` vars and sets ours. Passed in rather than built here so the token travels\n   * by ENV and never by argv (`ps` shows argv to every user on the box).\n   */\n  childEnv: NodeJS.ProcessEnv\n  project: string\n  config: string\n}\n\n/**\n * The cheapest combined VALIDITY + SCOPE probe of a Doppler service token (SPIKE-0): read one secret\n * back \u2014 the payload's own `DOPPLER_CONFIG` \u2014 and compare it to the config we asked for.\n *\n * `doppler me` is NOT enough: it works under a service token but returns no project/config, so it can\n * only prove the token is alive, never that it points where we think. One `secrets get` answers both\n * questions in one round trip, and the CLI enforces the scope for us on the wire.\n *\n * Never throws. Every failure becomes an outcome, and an unrecognized one becomes `'unreachable'`\n * (\"couldn't tell\") rather than a guess \u2014 the caller is `doctor`, whose whole value is that its\n * verdicts are true.\n *\n * @example\n * await probeEnvToken({ childEnv, project: 'api', config: 'dev' })\n * // => { outcome: 'valid', scopedTo: 'dev' }\n * // revoked token   => { outcome: 'revoked' }\n * // token for prod  => { outcome: 'mis-scoped' }\n * // offline         => { outcome: 'unreachable' }\n */\nexport const probeEnvToken = async ({ childEnv, project, config }: EnvTokenProbeArgs): Promise<EnvTokenProbe> => {\n  const prevQuiet = $.quiet\n\n  $.quiet = true\n  try {\n    const result = await $({\n      env: childEnv,\n    })`doppler secrets get ${SCOPE_KEY} --plain --project ${project} --config ${config}`.timeout(\n      DOPPLER_PROBE_TIMEOUT_MS,\n    )\n\n    const scopedTo = result.stdout.trim()\n\n    // Exit 0 with a DIFFERENT config would mean the CLI's own scope enforcement let a mis-scoped token\n    // through \u2014 belt and braces, but this is the check that would catch it.\n    if (scopedTo !== config) return { outcome: 'mis-scoped', scopedTo }\n\n    return { outcome: 'valid', scopedTo }\n  } catch (error: unknown) {\n    return { outcome: classifyProbeFailure(error) }\n  } finally {\n    $.quiet = prevQuiet\n  }\n}\n\n/**\n * Turn a failed probe into an outcome. Only the two auth-class markers are definitive; a\n * project/config not-found is a config bug rather than a token verdict, so it collapses to\n * `'unreachable'` too \u2014 the token check must not claim a token is bad because the PROJECT name is.\n */\nconst classifyProbeFailure = (error: unknown): EnvTokenProbeOutcome => {\n  const stderr = extractStderr(error) ?? (error instanceof Error ? error.message : String(error))\n\n  if (classifyDopplerFailure(stderr) !== 'auth') return 'unreachable'\n\n  return classifyDopplerAuthFailure(stderr) ?? 'unreachable'\n}\n", "import process from 'node:process'\n\nimport { getTokenStorePath, readTokenStore } from 'src/lib/env-tokens'\nimport { EnvAuthError } from 'src/lib/errors/env-auth-error'\nimport { tildify } from 'src/lib/path-display'\n\n/**\n * The ONE environment variable that carries a Doppler service token into infra-kit (the CI / agent\n * path: no home directory, no token store, no interactive `env-token-set`).\n *\n * Deliberately NOT named `DOPPLER_TOKEN`. That name is contaminated on both ends: a Doppler project\n * may itself hold a secret called `DOPPLER_TOKEN`, and `env-load` exports the WHOLE project into the\n * shell \u2014 so a `DOPPLER_TOKEN` in the environment cannot be trusted to be the token WE were handed\n * (SPIKE-0 Q5: an inherited `DOPPLER_TOKEN` silently overrides everything else the CLI would use).\n * A private name keeps the input channel ours.\n */\nexport const INFRA_KIT_ENV_TOKEN_VAR = 'INFRA_KIT_ENV_TOKEN'\n\n/** Where a resolved token came from. Surfaced by `env-token-list`; never carries the token itself. */\nexport type EnvTokenSource = 'env' | 'store'\n\nexport interface ResolvedEnvToken {\n  /** The Doppler service token. NEVER log, echo, or write this into a sourced file. */\n  token: string\n  source: EnvTokenSource\n}\n\n/**\n * Resolve the Doppler service token for one environment (= one Doppler config).\n *\n * Precedence, highest first:\n *  1. `INFRA_KIT_ENV_TOKEN` \u2014 the CI / agent channel. Checked BEFORE the store so a machine with no\n *     home config (or a deliberately corrupted one) still loads, and so nothing on that path can\n *     throw on a store it never needed.\n *  2. `envs[env]` from `~/.infra-kit/projects/<repo>/tokens.json` \u2014 the developer channel.\n *  3. Nothing \u21D2 THROW an {@link EnvAuthError}. Token-only auth has no fallback: there is no\n *     `doppler login` account to degrade to, so a missing token is a hard, actionable stop rather than\n *     a mysterious empty env. The CLASS matters as much as the message \u2014 see the throw below.\n *\n * An EMPTY `INFRA_KIT_ENV_TOKEN` is a MISS, not an empty token: `export INFRA_KIT_ENV_TOKEN=` (or an\n * unset var expanded by a CI template) must fall through to the store, not authenticate as \"\".\n *\n * @example\n * await resolveEnvToken('dev') // => { token: 'dp.st.dev.xxxx', source: 'store' }\n * // with INFRA_KIT_ENV_TOKEN set => { token: <that value>, source: 'env' }\n * // with neither                 => throws 'No Doppler service token for env \"dev\". \u2026'\n */\nexport const resolveEnvToken = async (env: string): Promise<ResolvedEnvToken> => {\n  const fromEnv = process.env[INFRA_KIT_ENV_TOKEN_VAR]\n\n  if (fromEnv) return { token: fromEnv, source: 'env' }\n\n  const store = await readTokenStore()\n  const fromStore = store?.envs[env]\n\n  if (fromStore) return { token: fromStore, source: 'store' }\n\n  // An EnvAuthError, not a plain Error: \"no token\" is the DURABLE, user-fixable auth failure \u2014 see\n  // EnvAuthError's own doc for why the class, not the message, is what downstream callers classify on.\n  throw new EnvAuthError(buildMissingTokenMessage(env, await getTokenStorePath()), env)\n}\n\n/**\n * The no-token refusal. It is the first thing an un-migrated user sees at update time, so it must be\n * fixable without reading any docs: it names the env, where to mint a token, the exact command, where\n * the token lands (and that it is NOT the repo), and the CI escape hatch.\n *\n * The fix command is a BACKTICK code span \u2014 the repo convention for naming a command to a human, and\n * the anchor `program.test.ts` scans to prove every command we print is a command we accept.\n *\n * (The @example names the command as `infra-kit env-token-set <env>` rather than with a literal arg\n * for that scan's benefit: a `<env>` placeholder ENDS the command, but a literal `dev` is\n * indistinguishable from a subcommand and would be reported as a dead one.)\n *\n * @example\n * buildMissingTokenMessage('dev', '/Users/x/.infra-kit/projects/api/tokens.json')\n * // => 'No Doppler service token for env \"dev\". Mint one at https://dashboard.doppler.com \u2026 run `infra-kit env-token-set <env>` \u2026'\n */\nconst buildMissingTokenMessage = (env: string, storePath: string): string => {\n  return [\n    `No Doppler service token for env \"${env}\".`,\n    `Mint one at https://dashboard.doppler.com \u2014 this project \u2192 config \"${env}\" \u2192 Access tab \u2192 \"Generate Service Token\".`,\n    `Fix: run \\`infra-kit env-token-set ${env}\\` and paste it.`,\n    `It is stored in ${tildify(storePath)} (mode 0600, never in the repo).`,\n    `CI / agents: set ${INFRA_KIT_ENV_TOKEN_VAR} instead \u2014 it takes precedence and needs no home config.`,\n  ].join('\\n')\n}\n"],
-  "mappings": "6GAAA,OAAS,UAAAA,MAAc,cACvB,OAAOC,MAAa,eACpB,OAAS,KAAAC,MAAS,KC6BlB,IAAMC,EAA2B,mCAC3BC,EAA0B,kCAS1BC,EAAuB,qBACvBC,EAAqB,2CAcdC,EAA0BC,GACjCA,EAAO,SAASH,CAAoB,GAAKG,EAAO,SAASF,CAAkB,EAAU,OAErFE,EAAO,SAASL,CAAwB,EAAU,UAElDK,EAAO,SAASJ,CAAuB,EAAU,SAE9C,UAsBIK,EAA8BD,GACrCA,EAAO,SAASF,CAAkB,EAAU,aAE5CE,EAAO,SAASH,CAAoB,EAAU,UAE3C,KA4CF,IAAMK,EAAkCC,GACtC,CACL,+CAA+CA,CAAG,oEAClD,sCAAsCA,CAAG,yCACzC,wEACF,EAAE,KAAK;AAAA,CAAI,EA+BAC,EAAN,cAA+BC,CAAa,CAcxC,SAST,YAAYF,EAAaG,EAAmC,KAAMC,EAAkB,CAClF,MAAMA,GAAWL,EAA+BC,CAAG,EAAGA,CAAG,EACzD,KAAK,KAAO,mBACZ,KAAK,SAAWG,CAClB,CACF,EAwCO,IAAME,EAA8B,CAAC,CAC1C,KAAAC,EACA,QAAAC,EACA,OAAAC,EACA,UAAAC,CACF,IAA0C,CACxC,IAAMC,EACJJ,IAAS,UACL,CAAC,oBAAoBC,CAAO,uEAAkE,EAC9F,CAAC,mBAAmBC,CAAM,2BAA2BD,CAAO,IAAI,EAEtE,GAAIE,GAAaA,EAAU,OAAS,EAAG,CACrC,IAAME,EAAQL,IAAS,UAAY,qBAAuB,yBAAyBC,CAAO,IAE1FG,EAAM,KAAK,GAAGC,CAAK,KAAKF,EAAU,KAAK,IAAI,CAAC,GAAG,CACjD,CAKA,OAAAC,EAAM,KACJJ,IAAS,UACL,yFACA,wDACN,EAEOI,EAAM,KAAK;AAAA,CAAI,CACxB,ECzQA,OAAS,KAAAE,MAAS,KAUlB,IAAMC,EAA2B,IAO3BC,EAAY,iBAKLC,EAAoB,SAA6B,CAC5D,GAAM,CAAE,cAAAC,CAAc,EAAI,MAAMC,EAAkB,EAElD,OAAOD,EAAc,OAAO,IAC9B,EAgDaE,EAAgB,MAAO,CAAE,SAAAC,EAAU,QAAAC,EAAS,OAAAC,CAAO,IAAiD,CAC/G,IAAMC,EAAYC,EAAE,MAEpBA,EAAE,MAAQ,GACV,GAAI,CAOF,IAAMC,GANS,MAAMD,EAAE,CACrB,IAAKJ,CACP,CAAC,wBAAwBL,CAAS,sBAAsBM,CAAO,aAAaC,CAAM,GAAG,QACnFR,CACF,GAEwB,OAAO,KAAK,EAIpC,OAAIW,IAAaH,EAAe,CAAE,QAAS,aAAc,SAAAG,CAAS,EAE3D,CAAE,QAAS,QAAS,SAAAA,CAAS,CACtC,OAASC,EAAgB,CACvB,MAAO,CAAE,QAASC,EAAqBD,CAAK,CAAE,CAChD,QAAE,CACAF,EAAE,MAAQD,CACZ,CACF,EAOMI,EAAwBD,GAAyC,CACrE,IAAME,EAASC,EAAcH,CAAK,IAAMA,aAAiB,MAAQA,EAAM,QAAU,OAAOA,CAAK,GAE7F,OAAII,EAAuBF,CAAM,IAAM,OAAe,cAE/CG,EAA2BH,CAAM,GAAK,aAC/C,EC9GA,OAAOI,MAAa,eAgBb,IAAMC,EAA0B,sBA+B1BC,EAAkB,MAAOC,GAA2C,CAC/E,IAAMC,EAAUC,EAAQ,IAAIJ,CAAuB,EAEnD,GAAIG,EAAS,MAAO,CAAE,MAAOA,EAAS,OAAQ,KAAM,EAGpD,IAAME,GADQ,MAAMC,EAAe,IACV,KAAKJ,CAAG,EAEjC,GAAIG,EAAW,MAAO,CAAE,MAAOA,EAAW,OAAQ,OAAQ,EAI1D,MAAM,IAAIE,EAAaC,EAAyBN,EAAK,MAAMO,EAAkB,CAAC,EAAGP,CAAG,CACtF,EAkBMM,EAA2B,CAACN,EAAaQ,IACtC,CACL,qCAAqCR,CAAG,KACxC,gFAAsEA,CAAG,uDACzE,sCAAsCA,CAAG,mBACzC,mBAAmBS,EAAQD,CAAS,CAAC,mCACrC,oBAAoBV,CAAuB,+DAC7C,EAAE,KAAK;AAAA,CAAI,EHrEb,IAAMY,EAAqB,iBAOdC,EAA2B,KAAO,KAMzCC,EAA8B,IAU9BC,EAAyB,CAAC,gBAAiB,kBAAmB,gBAAgB,EAcvEC,EAAuB,CAACC,EAAeC,EAA6BC,EAAQ,MAA2B,CAClH,IAAMC,EAA8B,CAAE,GAAGF,CAAQ,EAEjD,QAAWG,KAAQN,EACjB,OAAOK,EAASC,CAAI,EAGtB,OAAAD,EAAS,cAAgBH,EAElBG,CACT,EAMaE,GAAqB,MAAOC,GAChC,IAAI,IAAI,MAAMC,EAAuB,MAAMC,EAAkB,EAAGF,CAAM,CAAC,EAGnEC,EAAyB,MAAOE,EAAiBH,IAAqD,CACjH,GAAM,CAAE,MAAAN,CAAM,EAAI,MAAMU,EAAgBJ,CAAM,EAExCH,EAAWJ,EAAqBC,CAAK,EAErCW,EAAYC,EAAE,MAEpBA,EAAE,MAAQ,GACV,GAAI,CACF,IAAIC,EAEJ,GAAI,CACFA,EAAS,MAAMD,EAAE,CACf,IAAKT,CACP,CAAC,+DAA+DM,CAAO,aAAaH,CAAM,GAAG,QAC3FT,CACF,CACF,OAASiB,EAAgB,CACvB,MAAMC,EAA8BD,EAAOL,EAASH,CAAM,CAC5D,CAEAU,EAAwBH,EAAO,MAAM,EAErC,IAAMI,EAAQC,EAAwBL,EAAO,MAAM,EAEnD,OAAAM,EAAiBF,EAAOX,CAAM,EAEvBW,CACT,QAAE,CACAL,EAAE,MAAQD,CACZ,CACF,EAiBaQ,EAAmB,CAACF,EAAgCX,IAAyB,CACxF,IAAMc,EAASH,EAAM,KAAK,CAAC,CAACI,CAAG,IACtBA,IAAQ1B,CAChB,IAAI,CAAC,EAEN,GAAI,EAAAyB,IAAW,QAAaA,IAAWd,GAKvC,MAAM,IAAIgB,EACRhB,EACA,KACA,wCAAwCc,CAAM,UAAUd,CAAM,qDACpDA,CAAM;AAAA,qCACwBA,CAAM,8BAA8BA,CAAM,IACpF,CACF,EA0BaS,EAAgC,CAACD,EAAgBL,EAAiBH,IAA0B,CACvG,IAAMiB,EAASC,EAAcV,CAAK,IAAMA,aAAiB,MAAQA,EAAM,QAAU,OAAOA,CAAK,GACvFW,EAAOC,EAAuBH,CAAM,EAE1C,OAAIE,IAAS,OAAe,IAAIH,EAAiBhB,EAAQqB,EAA2BJ,CAAM,CAAC,EAEvFE,IAAS,UAAkBX,aAAiB,MAAQA,EAAQ,IAAI,MAAM,OAAOA,CAAK,CAAC,EAEhF,IAAI,MAAMc,EAA4B,CAAE,KAAAH,EAAM,QAAAhB,EAAS,OAAAH,EAAQ,UAAW,IAAK,CAAC,CAAC,CAC1F,EAEaU,EAA2Ba,GAAyB,CAC/D,IAAMC,EAAQC,EAAO,WAAWF,EAAQ,OAAO,EAE/C,GAAIC,EAAQlC,EACV,MAAM,IAAI,MACR,+CAA+CkC,CAAK,YAAYlC,CAAwB,oCAC1F,CAEJ,EAGMoC,EAAuB,eAYhBd,EAA2BW,GAA4C,CAClF,IAAII,EAEJ,GAAI,CACFA,EAAS,KAAK,MAAMJ,CAAM,CAC5B,MAAQ,CACN,MAAM,IAAI,MAAM,uDAAuD,KAAK,UAAUA,EAAO,MAAM,EAAG,EAAE,CAAC,CAAC,GAAG,CAC/G,CAEA,GAAII,IAAW,MAAQ,OAAOA,GAAW,UAAY,MAAM,QAAQA,CAAM,EACvE,MAAM,IAAI,MAAM,8FAA8F,EAGhH,IAAMhB,EAAiC,CAAC,EAExC,OAAW,CAACI,EAAKa,CAAK,IAAK,OAAO,QAAQD,CAAM,EAAG,CACjD,GAAI,CAACD,EAAqB,KAAKX,CAAG,EAChC,MAAM,IAAI,MACR,+DAA+D,KAAK,UAAUA,EAAI,MAAM,EAAG,EAAE,CAAC,CAAC,GACjG,EAGF,GAAI,OAAOa,GAAU,SACnB,MAAM,IAAI,UAAU,4CAA4Cb,CAAG,UAAU,OAAOa,CAAK,GAAG,EAG9FjB,EAAM,KAAK,CAACI,EAAKa,CAAK,CAAC,CACzB,CAEA,GAAIjB,EAAM,SAAW,EACnB,MAAM,IAAI,MAAM,4CAA4C,EAG9D,OAAOA,CACT",
+  "mappings": "wGAAA,OAAS,UAAAA,MAAc,cACvB,OAAOC,MAAa,eACpB,OAAS,KAAAC,MAAS,KC6BlB,IAAMC,EAA2B,mCAC3BC,EAA0B,kCAS1BC,EAAuB,qBACvBC,EAAqB,2CAcdC,EAA0BC,GACjCA,EAAO,SAASH,CAAoB,GAAKG,EAAO,SAASF,CAAkB,EAAU,OAErFE,EAAO,SAASL,CAAwB,EAAU,UAElDK,EAAO,SAASJ,CAAuB,EAAU,SAE9C,UAsBIK,EAA8BD,GACrCA,EAAO,SAASF,CAAkB,EAAU,aAE5CE,EAAO,SAASH,CAAoB,EAAU,UAE3C,KA4CF,IAAMK,EAAkCC,GACtC,CACL,+CAA+CA,CAAG,oEAClD,sCAAsCA,CAAG,yCACzC,wEACF,EAAE,KAAK;AAAA,CAAI,EA+BAC,EAAN,cAA+BC,CAAa,CAcxC,SAST,YAAYF,EAAaG,EAAmC,KAAMC,EAAkB,CAClF,MAAMA,GAAWL,EAA+BC,CAAG,EAAGA,CAAG,EACzD,KAAK,KAAO,mBACZ,KAAK,SAAWG,CAClB,CACF,EAwCO,IAAME,EAA8B,CAAC,CAC1C,KAAAC,EACA,QAAAC,EACA,OAAAC,EACA,UAAAC,CACF,IAA0C,CACxC,IAAMC,EACJJ,IAAS,UACL,CAAC,oBAAoBC,CAAO,uEAAkE,EAC9F,CAAC,mBAAmBC,CAAM,2BAA2BD,CAAO,IAAI,EAEtE,GAAIE,GAAaA,EAAU,OAAS,EAAG,CACrC,IAAME,EAAQL,IAAS,UAAY,qBAAuB,yBAAyBC,CAAO,IAE1FG,EAAM,KAAK,GAAGC,CAAK,KAAKF,EAAU,KAAK,IAAI,CAAC,GAAG,CACjD,CAKA,OAAAC,EAAM,KACJJ,IAAS,UACL,yFACA,wDACN,EAEOI,EAAM,KAAK;AAAA,CAAI,CACxB,ECzQA,OAAS,KAAAE,MAAS,KAUlB,IAAMC,EAA2B,IAO3BC,EAAY,iBAKLC,EAAoB,SAA6B,CAC5D,GAAM,CAAE,cAAAC,CAAc,EAAI,MAAMC,EAAkB,EAElD,OAAOD,EAAc,OAAO,IAC9B,EAgDaE,EAAgB,MAAO,CAAE,SAAAC,EAAU,QAAAC,EAAS,OAAAC,CAAO,IAAiD,CAC/G,IAAMC,EAAYC,EAAE,MAEpBA,EAAE,MAAQ,GACV,GAAI,CAOF,IAAMC,GANS,MAAMD,EAAE,CACrB,IAAKJ,CACP,CAAC,wBAAwBL,CAAS,sBAAsBM,CAAO,aAAaC,CAAM,GAAG,QACnFR,CACF,GAEwB,OAAO,KAAK,EAIpC,OAAIW,IAAaH,EAAe,CAAE,QAAS,aAAc,SAAAG,CAAS,EAE3D,CAAE,QAAS,QAAS,SAAAA,CAAS,CACtC,OAASC,EAAgB,CACvB,MAAO,CAAE,QAASC,EAAqBD,CAAK,CAAE,CAChD,QAAE,CACAF,EAAE,MAAQD,CACZ,CACF,EAOMI,EAAwBD,GAAyC,CACrE,IAAME,EAASC,EAAcH,CAAK,IAAMA,aAAiB,MAAQA,EAAM,QAAU,OAAOA,CAAK,GAE7F,OAAII,EAAuBF,CAAM,IAAM,OAAe,cAE/CG,EAA2BH,CAAM,GAAK,aAC/C,EC9GA,OAAOI,MAAa,eAgBb,IAAMC,EAA0B,sBA+B1BC,EAAkB,MAAOC,GAA2C,CAC/E,IAAMC,EAAUC,EAAQ,IAAIJ,CAAuB,EAEnD,GAAIG,EAAS,MAAO,CAAE,MAAOA,EAAS,OAAQ,KAAM,EAGpD,IAAME,GADQ,MAAMC,EAAe,IACV,KAAKJ,CAAG,EAEjC,GAAIG,EAAW,MAAO,CAAE,MAAOA,EAAW,OAAQ,OAAQ,EAI1D,MAAM,IAAIE,EAAaC,EAAyBN,EAAK,MAAMO,EAAkB,CAAC,EAAGP,CAAG,CACtF,EAkBMM,EAA2B,CAACN,EAAaQ,IACtC,CACL,qCAAqCR,CAAG,KACxC,gFAAsEA,CAAG,uDACzE,sCAAsCA,CAAG,mBACzC,mBAAmBS,EAAQD,CAAS,CAAC,mCACrC,oBAAoBV,CAAuB,+DAC7C,EAAE,KAAK;AAAA,CAAI,EHrEb,IAAMY,EAAqB,iBAOdC,EAA2B,KAAO,KAMzCC,EAA8B,IAU9BC,EAAyB,CAAC,gBAAiB,kBAAmB,gBAAgB,EAcvEC,EAAuB,CAACC,EAAeC,EAA6BC,EAAQ,MAA2B,CAClH,IAAMC,EAA8B,CAAE,GAAGF,CAAQ,EAEjD,QAAWG,KAAQN,EACjB,OAAOK,EAASC,CAAI,EAGtB,OAAAD,EAAS,cAAgBH,EAElBG,CACT,EAMaE,GAAqB,MAAOC,GAChC,IAAI,IAAI,MAAMC,EAAuB,MAAMC,EAAkB,EAAGF,CAAM,CAAC,EAGnEC,EAAyB,MAAOE,EAAiBH,IAAqD,CACjH,GAAM,CAAE,MAAAN,CAAM,EAAI,MAAMU,EAAgBJ,CAAM,EAExCH,EAAWJ,EAAqBC,CAAK,EAErCW,EAAYC,EAAE,MAEpBA,EAAE,MAAQ,GACV,GAAI,CACF,IAAIC,EAEJ,GAAI,CACFA,EAAS,MAAMD,EAAE,CACf,IAAKT,CACP,CAAC,+DAA+DM,CAAO,aAAaH,CAAM,GAAG,QAC3FT,CACF,CACF,OAASiB,EAAgB,CACvB,MAAMC,EAA8BD,EAAOL,EAASH,CAAM,CAC5D,CAEAU,EAAwBH,EAAO,MAAM,EAErC,IAAMI,EAAQC,EAAwBL,EAAO,MAAM,EAEnD,OAAAM,EAAiBF,EAAOX,CAAM,EAEvBW,CACT,QAAE,CACAL,EAAE,MAAQD,CACZ,CACF,EAiBaQ,EAAmB,CAACF,EAAgCX,IAAyB,CACxF,IAAMc,EAASH,EAAM,KAAK,CAAC,CAACI,CAAG,IACtBA,IAAQ1B,CAChB,IAAI,CAAC,EAEN,GAAI,EAAAyB,IAAW,QAAaA,IAAWd,GAKvC,MAAM,IAAIgB,EACRhB,EACA,KACA,wCAAwCc,CAAM,UAAUd,CAAM,qDACpDA,CAAM;AAAA,qCACwBA,CAAM,8BAA8BA,CAAM,IACpF,CACF,EA0BaS,EAAgC,CAACD,EAAgBL,EAAiBH,IAA0B,CACvG,IAAMiB,EAASC,EAAcV,CAAK,IAAMA,aAAiB,MAAQA,EAAM,QAAU,OAAOA,CAAK,GACvFW,EAAOC,EAAuBH,CAAM,EAE1C,OAAIE,IAAS,OAAe,IAAIH,EAAiBhB,EAAQqB,EAA2BJ,CAAM,CAAC,EAEvFE,IAAS,UAAkBX,aAAiB,MAAQA,EAAQ,IAAI,MAAM,OAAOA,CAAK,CAAC,EAEhF,IAAI,MAAMc,EAA4B,CAAE,KAAAH,EAAM,QAAAhB,EAAS,OAAAH,EAAQ,UAAW,IAAK,CAAC,CAAC,CAC1F,EAEaU,EAA2Ba,GAAyB,CAC/D,IAAMC,EAAQC,EAAO,WAAWF,EAAQ,OAAO,EAE/C,GAAIC,EAAQlC,EACV,MAAM,IAAI,MACR,+CAA+CkC,CAAK,YAAYlC,CAAwB,oCAC1F,CAEJ,EAGMoC,EAAuB,eAYhBd,EAA2BW,GAA4C,CAClF,IAAII,EAEJ,GAAI,CACFA,EAAS,KAAK,MAAMJ,CAAM,CAC5B,MAAQ,CACN,MAAM,IAAI,MAAM,uDAAuD,KAAK,UAAUA,EAAO,MAAM,EAAG,EAAE,CAAC,CAAC,GAAG,CAC/G,CAEA,GAAII,IAAW,MAAQ,OAAOA,GAAW,UAAY,MAAM,QAAQA,CAAM,EACvE,MAAM,IAAI,MAAM,8FAA8F,EAGhH,IAAMhB,EAAiC,CAAC,EAExC,OAAW,CAACI,EAAKa,CAAK,IAAK,OAAO,QAAQD,CAAM,EAAG,CACjD,GAAI,CAACD,EAAqB,KAAKX,CAAG,EAChC,MAAM,IAAI,MACR,+DAA+D,KAAK,UAAUA,EAAI,MAAM,EAAG,EAAE,CAAC,CAAC,GACjG,EAGF,GAAI,OAAOa,GAAU,SACnB,MAAM,IAAI,UAAU,4CAA4Cb,CAAG,UAAU,OAAOa,CAAK,GAAG,EAG9FjB,EAAM,KAAK,CAACI,EAAKa,CAAK,CAAC,CACzB,CAEA,GAAIjB,EAAM,SAAW,EACnB,MAAM,IAAI,MAAM,4CAA4C,EAG9D,OAAOA,CACT",
   "names": ["Buffer", "process", "$", "PROJECT_NOT_FOUND_MARKER", "CONFIG_NOT_FOUND_MARKER", "INVALID_TOKEN_MARKER", "TOKEN_SCOPE_MARKER", "classifyDopplerFailure", "stderr", "classifyDopplerAuthFailure", "buildDopplerAuthFailureMessage", "env", "DopplerAuthError", "EnvAuthError", "authKind", "message", "buildDopplerNotFoundMessage", "kind", "project", "config", "available", "lines", "label", "$", "DOPPLER_PROBE_TIMEOUT_MS", "SCOPE_KEY", "getDopplerProject", "envManagement", "getInfraKitConfig", "probeEnvToken", "childEnv", "project", "config", "prevQuiet", "$", "scopedTo", "error", "classifyProbeFailure", "stderr", "extractStderr", "classifyDopplerFailure", "classifyDopplerAuthFailure", "process", "INFRA_KIT_ENV_TOKEN_VAR", "resolveEnvToken", "env", "fromEnv", "process", "fromStore", "readTokenStore", "EnvAuthError", "buildMissingTokenMessage", "getTokenStorePath", "storePath", "tildify", "DOPPLER_CONFIG_KEY", "DOPPLER_MAX_OUTPUT_BYTES", "DOPPLER_DOWNLOAD_TIMEOUT_MS", "INHERITED_DOPPLER_VARS", "buildDopplerChildEnv", "token", "baseEnv", "process", "childEnv", "name", "downloadEnvSecrets", "config", "downloadDopplerSecrets", "getDopplerProject", "project", "resolveEnvToken", "prevQuiet", "$", "result", "error", "translateDopplerDownloadError", "assertDopplerOutputSize", "pairs", "parseDopplerSecretsJson", "assertTokenScope", "actual", "key", "DopplerAuthError", "stderr", "extractStderr", "kind", "classifyDopplerFailure", "classifyDopplerAuthFailure", "buildDopplerNotFoundMessage", "stdout", "bytes", "Buffer", "ENV_VAR_NAME_PATTERN", "parsed", "value"]
 }

package/dist/{chunk-S23ECFH4.js → chunk-L4AFEAYF.js}

@@ -1,5 +1,5 @@
-import{S as m,ea as E}from"./chunk-HMXEV7ZN.js";import{p as w}from"./chunk-RVMKL6T4.js";import i from"node:fs/promises";import o from"node:path";import{z as a}from"zod";var c=class extends Error{env;constructor(e,r=null){super(e),this.name="EnvAuthError",this.env=r}};var x="tokens.json",d=1,k=384,u=448,y=a.object({version:a.literal(d).default(d),envs:a.record(a.string().min(1),a.string().min(1))}).strict(),l=async()=>{let t=await E();return o.join(o.dirname(t.userProject),x)},h=async()=>{let t=await l(),e;try{e=await i.readFile(t,"utf-8")}catch{return null}let r;try{r=JSON.parse(e)}catch(s){throw new c(`Invalid JSON in the token store at ${m(t)}: ${s.message}
+import{ga as E,k as m}from"./chunk-JBQ5572P.js";import{p as w}from"./chunk-RVMKL6T4.js";import i from"node:fs/promises";import o from"node:path";import{z as a}from"zod";var c=class extends Error{env;constructor(e,r=null){super(e),this.name="EnvAuthError",this.env=r}};var x="tokens.json",d=1,k=384,u=448,y=a.object({version:a.literal(d).default(d),envs:a.record(a.string().min(1),a.string().min(1))}).strict(),l=async()=>{let t=await E();return o.join(o.dirname(t.userProject),x)},h=async()=>{let t=await l(),e;try{e=await i.readFile(t,"utf-8")}catch{return null}let r;try{r=JSON.parse(e)}catch(s){throw new c(`Invalid JSON in the token store at ${m(t)}: ${s.message}
 Fix or delete the file, then re-add the token with \`infra-kit env-token-set <env>\`.`)}let n=y.safeParse(r);if(!n.success)throw new c(`Invalid token store at ${m(t)}: ${a.prettifyError(n.error)}
 Fix or delete the file, then re-add the token with \`infra-kit env-token-set <env>\`.`);return n.data},v=async t=>{let e=await l(),r=o.dirname(e),n=o.dirname(r),s=o.dirname(n);for(let f of[s,n,r])await i.mkdir(f,{recursive:!0,mode:u}),await i.chmod(f,u);w(e,`${JSON.stringify(t,null,2)}
 `,k),await i.chmod(e,k)},P=async()=>{let t=await l().catch(()=>null);if(t===null)return null;let e=o.dirname(t),r=o.dirname(e),s=[[o.dirname(r),u],[r,u],[e,u],[t,k]];if(!await i.stat(t).then(()=>!0,()=>!1))return null;let g=[];for(let[p,S]of s){let T=(await i.stat(p)).mode&511;T!==S&&(await i.chmod(p,S),g.push(`${m(p)} was 0${T.toString(8)}`))}return g};var j=async t=>{let e=await h();await v({version:d,envs:{...e?.envs,...t}})},O=async t=>{let e=await h();if(!e||!(t in e.envs))return;let r={...e.envs};delete r[t],await v({version:d,envs:r})};var D=(t,e,r)=>t.map(({env:n,source:s})=>({env:n,source:s,hasToken:!!(r||e[n])}));export{c as a,D as b,l as c,h as d,P as e,j as f,O as g};
-//# sourceMappingURL=chunk-S23ECFH4.js.map
+//# sourceMappingURL=chunk-L4AFEAYF.js.map

package/dist/{chunk-ZY6BBGHH.js → chunk-O3W65BXT.js}

@@ -1,4 +1,4 @@
-import{P as f,l as $,r as F}from"./chunk-HMXEV7ZN.js";import{execFile as te,execFileSync as oe}from"node:child_process";import b from"node:process";var ne=5e3,ae=100,W=2e3,U="/bin/ps",se=1e3,J=["-eo","pid=,ppid=,pgid=,lstart="],V=8<<20,B=e=>e.split(`
+import{A as F,i as f,u as $}from"./chunk-JBQ5572P.js";import{execFile as te,execFileSync as oe}from"node:child_process";import b from"node:process";var ne=5e3,ae=100,W=2e3,U="/bin/ps",se=1e3,J=["-eo","pid=,ppid=,pgid=,lstart="],V=8<<20,B=e=>e.split(`
 `).flatMap(r=>{let[t,o,n,...i]=r.trim().split(/\s+/);if(t==null||o==null||n==null)return[];let l=Number(t),s=Number(o),c=Number(n);return!Number.isInteger(l)||!Number.isInteger(s)||!Number.isInteger(c)?[]:[{pid:l,ppid:s,pgid:c,lstart:i.join(" ")}]}),H=e=>{let r=new Map;for(let t of e)t.pid===t.pgid&&r.set(t.pgid,t.lstart);return r},ie=(e,r,t)=>{let o=H(r);return j(e,r,t).flatMap(n=>{let i=o.get(n);return i==null||i===""?[]:[{pgid:n,leaderStart:i}]})},K=(e,r)=>{let t=H(r);return e.flatMap(({pgid:o,leaderStart:n})=>t.get(o)===n?[o]:[])},D=(e,r)=>K(e,r).flatMap(t=>{try{b.kill(-t,"SIGKILL")}catch{return[]}return[t]}),j=(e,r,t)=>{let o=new Map;for(let s of r){let c=o.get(s.ppid);c?c.push(s):o.set(s.ppid,[s])}let n=new Set([e]),i=new Set([e]),l=[e];for(let s=0;s<l.length;s+=1)for(let c of o.get(l[s]??-1)??[])i.has(c.pid)||(i.add(c.pid),n.add(c.pgid),l.push(c.pid));return[...n].filter(s=>s>1&&s!==t)},A=()=>{try{return B(oe(U,[...J],{encoding:"utf8",maxBuffer:V}))}catch{return[]}},ce=async()=>new Promise(e=>{te(U,[...J],{encoding:"utf8",maxBuffer:V},(r,t)=>{e(r?[]:B(t))})}),le=(e,r,t)=>t.some(o=>o.pid===e&&o.ppid===r),L=(e,r)=>{let t=r.find(o=>o.pid===b.pid)?.pgid;return j(e,r,t)},q=e=>{try{return b.kill(-e,0),!0}catch{return!1}},C=(e,r)=>{for(let t of e)try{b.kill(-t,r)}catch{}},S=new Set,ue=(e,r,t)=>{let o=L(e,r),n=t.flatMap(i=>K(i,r));return[...new Set([...o,...n])]},z=()=>{let e=A(),r=[...S].map(t=>t());C(ue(b.pid,e,r),"SIGKILL")},pe=async e=>new Promise(r=>{setTimeout(r,e)}),v=async(e,r)=>{let t=Date.now()+r,o=e;for(;o.length>0&&Date.now()<t&&(o=o.filter(q),o.length!==0);)await pe(ae);return o};function or(e,r=ne,t,o=A){e.unref();let n=!1,i=!1,l=[],s=null,c=()=>l;S.add(c);let m=()=>{s&&clearInterval(s),s=null},w=async()=>{await v(l.map(a=>a.pgid),W),S.delete(c)},h=a=>{let u=e.pid;if(u==null||i||n||a.length===0)return;let R=a.find(_=>_.pid===b.pid)?.pgid,x=ie(u,a,R);x.length>0&&(l=x)},y=async()=>{e.pid==null||i||n||h(await ce())};h(A()),s=setInterval(()=>{y()},se),s.unref();let T=a=>{n||t?.(a)};return e.on("exit",(a,u)=>{i=!0,m(),n||(D(l,o()),w()),T(`exited unexpectedly (code=${a??"null"}, signal=${u??"null"})`)}),e.on("error",a=>{T(`failed to spawn: ${a.message}`)}),{kill:async()=>{n=!0,m();let a=e.pid;if(a==null){S.delete(c);return}if(e.exitCode!==null||e.signalCode!==null){D(l,o()),await w();return}let u=o();if(u.length>0&&!le(a,b.pid,u))return;let R=L(a,u);C(R,"SIGTERM");let x=await v(R,r);if(x.length===0){S.delete(c);return}let _=L(a,o()),G=[...new Set([...x,..._])].filter(q);C(G,"SIGKILL"),await v(G,W),S.delete(c)}}}import{constants as de}from"node:os";import k from"node:process";var me=["SIGINT","SIGTERM","SIGHUP"],fe=de.signals,ge=2,N=e=>128+(fe[e]??ge),Oe=2e4,be=e=>{k.exit(e)},we=(e,r)=>{k.on(e,r)},he=(e,r)=>{k.off(e,r)},ye=(e,r)=>{let t=setTimeout(e,r);return t.unref(),()=>{clearTimeout(t)}},I=e=>{try{k.stderr.write(e)}catch{}},Se=(e,r)=>{let t=r instanceof Error?`${r.message}
 ${r.stack??"(no stack)"}`:String(r);I(`
 \u2717 Teardown failed while handling ${e}: ${t}
@@ -7,4 +7,4 @@ ${r.stack??"(no stack)"}`:String(r);I(`
 `),w?.(),n(),y(),r(N(a));return}m=a,w=l(()=>{let u=`
 \u26A0  Teardown deadline exceeded at stage=${s()} after ${i}ms \u2014 force-quitting.
 `;I(u),c(u),n(),y(),r(N(a))},i),(async()=>{try{await e(a)}catch(u){Se(a,u)}finally{w?.(),y(),r(N(a))}})()};for(let a of me){let u=()=>T(a);h.set(a,u),t(a,u)}return y};var Pe=new Set(["ExitPromptError","AbortPromptError","PromptCancelledError"]),X=e=>e instanceof Error&&Pe.has(e.name),ur=e=>{if(X(e))return!0;let r=e?.cause;return X(r)};import{$ as xe}from"zx";var d=class extends Error{code;data;constructor(r){super(r.message),this.name="OrcaError",this.code=r.code,this.data=r.data}},P=class extends Error{exitCode;stderrTail;constructor(r,t){super(`orca: stdout is not a JSON envelope (exit ${r??"signal"})`),this.name="OrcaMalformedError",this.exitCode=r,this.stderrTail=t}},g=class extends Error{constructor(){super("orca: command not found \u2014 the CLI is registered from Orca \u2192 Settings \u2192 Experimental \u2192 CLI"),this.name="OrcaAbsentError"}},Te=400,Re=127,ke=e=>typeof e=="object"&&e!==null&&e.code==="ENOENT",Ee=async e=>{try{return await xe({nothrow:!0,quiet:!0})`orca ${e} --json`}catch(r){throw ke(r)?new g:r}},_e=e=>{try{let r=JSON.parse(e);return typeof r=="object"&&r!==null&&typeof r.ok=="boolean"?r:null}catch{return null}},p=async e=>{let r=await Ee(e),t=_e(r.stdout);if(f.debug({argv:e,ok:t?.ok,code:t?.error?.code,exitCode:r.exitCode},"orca"),!t)throw r.exitCode===Re?new g:new P(r.exitCode,r.stderr.slice(-Te));if(!t.ok)throw new d(t.error??{code:"unknown",message:"orca: ok:false without an error payload"});return t.result};var ve=async()=>{try{let e=await p(["status"]);return f.debug({appVersion:e.runtime?.appVersion},"orca: status"),e.app?.running===!0&&e.runtime?.reachable===!0?"ready":"unreachable"}catch(e){return e instanceof g?"absent":(f.debug({error:e},"orca: status probe failed"),"unreachable")}};import{realpath as Ae}from"node:fs/promises";var O=async e=>{try{return await Ae(e)}catch{return e}};var Le=async e=>{let[{repos:r=[]},t]=await Promise.all([p(["repo","list"]),O(e)]);for(let o of r)if(await O(o.path)===t)return{registered:!0,visibility:o.externalWorktreeVisibility};return{registered:!1}},Ce=async e=>{let{repo:r}=await p(["repo","add","--path",e]);return{visibility:r?.externalWorktreeVisibility}};var Ne="500",Ie=async(e,r)=>{let[{worktrees:t=[]},o]=await Promise.all([p(["worktree","list","--repo",`path:${e}`,"--limit",Ne]),O(r)]);for(let n of t)if(await O(n.path)===o)return!0;return!1};import Me from"node:process";var Y="::",Ge=e=>{let r=e.ORCA_WORKTREE_ID;if(!r)return null;let t=r.indexOf(Y);if(t<0)return null;let o=r.slice(t+Y.length);return o.length>0?o:null},$e=async(e,r=Me.env)=>{let t=Ge(r);if(t===null)return null;let o=await O(t);for(let n of e)if(await O(n)===o)return n;return null};var Q="200",M=async e=>{try{let r=await p(["terminal","list","--worktree",`path:${e}`,"--limit",Q]),t=r.truncated===!0;return t&&f.debug({cwd:e,limit:Q},"orca: terminal list truncated"),{terminals:r.terminals??[],truncated:t}}catch(r){if(r instanceof d&&r.code==="selector_not_found")return{terminals:[],truncated:!1};throw r}};var Fe=async e=>{try{return await p(["terminal","close","--worktree",`path:${e}`,"--all"]),"retired"}catch(r){if(r instanceof d&&r.code==="selector_not_found")return"not_found";if(r instanceof d&&r.code==="terminal_close_incomplete")return f.debug({cwd:e,error:r},"orca: surfaces not retired"),"retired";throw r}},We=async e=>{let{terminals:r}=await M(e);for(let o of r)await p(["terminal","close","--terminal",o.handle]);let t=await Fe(e);return r.length===0&&t==="not_found"?{closed:!1,skipped:"not_found"}:{closed:!0,count:r.length}},De=(e,r)=>r instanceof g?{closed:!1,skipped:"absent"}:r instanceof d?{closed:!1,error:r}:r instanceof P?{closed:!1,error:new d({code:"orca_malformed_output",message:r.message,data:{exitCode:r.exitCode,stderrTail:r.stderrTail}})}:(f.debug({cwd:e,error:r},"orca: close failed outside the Orca contract"),{closed:!1,error:new d({code:"orca_close_failed",message:r instanceof Error?r.message:String(r)})}),Ue=async(e,r)=>{if(r!=="ready")return{closed:!1,skipped:r};try{return await We(e)}catch(t){return De(e,t)}};import{setTimeout as Je}from"node:timers/promises";var Ve=3,Be=300,ee=(e={})=>({attempts:e.attempts??Ve,delayMs:e.delayMs??Be,exhausted:!1}),He=async e=>{try{return{created:await p(e)}}catch(r){if(r instanceof d&&r.code==="selector_not_found")return{notSelectable:r};throw r}},Ke=async(e,r,t)=>{let o=t.exhausted?1:t.attempts,n=Array.from({length:o},(l,s)=>s+1),i;for(let l of n){let s=await He(e);if("created"in s)return s.created.terminal.handle;i=s.notSelectable,l<o&&await Je(t.delayMs)}throw t.exhausted=!0,new d({code:"orca_worktree_not_selectable",message:`orca: worktree ${r} is not selectable after ${o} attempt(s): ${i?.message??""}`,data:{cwd:r,attempts:o,cause:i?.data}})},Z=async(e,r)=>(await p(["terminal","split","--terminal",e,"--direction",r])).split.handle,je=async e=>{let{cwd:r,title:t,focus:o,layout:n,panes:i,poll:l=ee()}=e,s=["terminal","create","--worktree",`path:${r}`,"--title",t,...o?["--focus"]:[]],c=await Ke(s,r,l),m=[c];return n==="full"&&(m.push(await Z(c,"horizontal")),i==="three-pane"&&m.push(await Z(c,"vertical"))),{handles:m,layout:n}};var qe=e=>{let{branch:r}=e,t=$(r);return t?F(t):r};var Yr=e=>typeof e=="object",E=async e=>(await e.body?.cancel(),{kind:"foreign",status:e.status,contentType:e.headers.get("content-type")}),Qr=(e,r)=>{let t=r.contentType?.split(";")[0]?.trim(),o=t==null||t===""?`${r.status}`:`${r.status} ${t}`;return`port ${e} answered ${o}, not vite's ping \u2014 liveness cannot be verified`};var re={accept:"text/x-vite-ping"},ze=e=>e.kind==="api"?`http://127.0.0.1:${e.port}/__health`:`http://127.0.0.1:${e.port}/`,Xe=(e,r)=>{try{return new URL(e,r)}catch{return null}},Ye=async(e,r)=>{let t=await fetch(e,{signal:r});return t.ok?(await t.body?.cancel(),"ok"):E(t)},Qe=async(e,r)=>{let t=await fetch(e,{headers:re,redirect:"manual",signal:r});if(t.status===204)return"ok";if(t.status<300||t.status>=400)return E(t);let o=t.headers.get("location"),n=o==null?null:Xe(o,e);if(n==null||n.origin!==new URL(e).origin)return E(t);await t.body?.cancel();let i=await fetch(n,{headers:re,redirect:"manual",signal:r});return i.status!==204?E(i):(await i.body?.cancel(),"ok")},Zr=async e=>{let r=ze(e),t=AbortSignal.timeout(1500);try{return e.kind==="api"?await Ye(r,t):await Qe(r,t)}catch{return"refused"}};import{readRelease as Ze}from"@slip-stream-kit/config/internal";var er=e=>Ze(e);export{d as a,p as b,ve as c,$e as d,M as e,Ue as f,Le as g,Ce as h,Ie as i,ee as j,je as k,qe as l,Yr as m,Qr as n,Zr as o,er as p,z as q,or as r,N as s,cr as t,ur as u};
-//# sourceMappingURL=chunk-ZY6BBGHH.js.map
+//# sourceMappingURL=chunk-O3W65BXT.js.map

package/dist/{chunk-K5YNW3DE.js → chunk-TYGUMAIP.js}

@@ -1,4 +1,4 @@
-import{a as x,b as E}from"./chunk-QWVLAZ6N.js";import{P as v,X as c,d as l,f as u}from"./chunk-HMXEV7ZN.js";var A=()=>{let e="",n=[],t=!1;return{start(r){e=r,n=[],t=!1},setInteractive(){t=!0},addOption(r,o){n.push({flag:r,value:o})},formatOptions(){return n.map(r=>typeof r.value=="boolean"?r.value?r.flag:"":Array.isArray(r.value)?`${r.flag} "${r.value.join(", ")}"`:`${r.flag} "${r.value}"`).filter(Boolean).join(" ")},snapshot(){return n.length===0?null:{formattedOptions:this.formatOptions()}},print(){!t||n.length===0||!e||v.info(`\u{1F4DF} Equivalent command: 
+import{a as x,b as E}from"./chunk-QWVLAZ6N.js";import{d as l,f as u,i as v,r as c}from"./chunk-JBQ5572P.js";var A=()=>{let e="",n=[],t=!1;return{start(r){e=r,n=[],t=!1},setInteractive(){t=!0},addOption(r,o){n.push({flag:r,value:o})},formatOptions(){return n.map(r=>typeof r.value=="boolean"?r.value?r.flag:"":Array.isArray(r.value)?`${r.flag} "${r.value.join(", ")}"`:`${r.flag} "${r.value}"`).filter(Boolean).join(" ")},snapshot(){return n.length===0?null:{formattedOptions:this.formatOptions()}},print(){!t||n.length===0||!e||v.info(`\u{1F4DF} Equivalent command: 
 pnpm exec infra-kit ${e} ${this.formatOptions()}
 `)},reset(){e="",n=[],t=!1}}},f=A();import{isAbsolute as w,resolve as y}from"node:path";import T from"node:process";var m=null,p=null,P=e=>{m=[...e],p=T.cwd()},S=new Set(["--yes","-y"]),$=(e,n)=>{let t=[...e];for(let[r,o]of t.entries())o==="-C"&&t[r+1]!==void 0&&!w(t[r+1])?t[r+1]=y(n,t[r+1]):o.startsWith("-C")&&o.length>2&&!o.startsWith("--")&&!w(o.slice(2))&&(t[r]=`-C${y(n,o.slice(2))}`);return t},g=()=>{if(m===null||p===null)return["--yes"];let e=m.slice(2),n=e.indexOf("--"),t=n===-1?e.length:n,r=$(e.slice(0,t),p),o=e.slice(t);return r.some(s=>S.has(s))?[...r,...o]:[...r,"--yes",...o]};import b from"node:process";var H=27,D=e=>e===null?"an interactive prompt was reached under --json, which never prompts":`an interactive prompt was reached in agent mode (${e==="flag"?"--agent":"INFRA_KIT_AGENT / CLAUDECODE"}), where there is no human to answer it`,j=e=>`${e===void 0?"pass the value explicitly instead of relying on the prompt":`pass --${e}`} on the re-run`,I=e=>{if(typeof e=="object"&&"value"in e)return e.value;let n=typeof e=="object"?e.refuse:void 0,{source:t}=l;throw new c(n===void 0?{status:"refused",agentMode:t}:{status:"argument_required",argument:n,agentMode:t},2,{operation:"interactive prompt",remediation:j(n),stderrExcerpt:D(t)})},C=async(e,n)=>{let t=new AbortController,{whenHeadless:r="refuse",...o}=n??{},d={...o,signal:t.signal};if(u())return I(r);if(!b.stdin.isTTY)return e(d);let s=b.stdin,h=a=>{a.length===1&&a[0]===H&&t.abort()};x();try{let a=e(d);return s.isPaused()&&s.resume(),s.on("data",h),await a}finally{s.removeListener("data",h),E()}};import M from"@inquirer/confirm";var i=class extends Error{constructor(n="Operation cancelled by the operator"){super(n),this.name="CommandDeclinedError"}},z=e=>e instanceof i;var O=(e,n,t=g())=>{let{source:r}=l;throw new c({status:"confirmation_required",message:e,plan:n,rerun:t,agentMode:r},2,{operation:"confirm before running",remediation:r===null?"pass `--yes` to confirm, or drop `--json` to be prompted":`show the plan to the human, then re-run \`infra-kit ${t.join(" ")}\` to confirm`,stderrExcerpt:"confirmation required and nobody to ask"})},k=async(e,n,t={})=>{!e&&u()&&O(n,t.plan,t.rerun);let r=e?!0:await C(o=>M({message:n},o),{whenHeadless:"refuse"});if(e||f.setInteractive(),!r)throw new i};export{f as a,z as b,P as c,g as d,C as e,O as f,k as g};
-//# sourceMappingURL=chunk-K5YNW3DE.js.map
+//# sourceMappingURL=chunk-TYGUMAIP.js.map