infra-kit 0.42.0 → 0.43.0

package/dist/{dev-wizard-run-PF3FTXA7.js → dev-wizard-run-UUHDVB5L.js}

@@ -1,2 +1,2 @@
-import{a as m,e as h}from"./chunk-K5YNW3DE.js";import"./chunk-QWVLAZ6N.js";import{a as v,b as k,d as w,m as x}from"./chunk-55F372Z7.js";import{d as b}from"./chunk-S23ECFH4.js";import{P as u}from"./chunk-HMXEV7ZN.js";import"./chunk-MFAFQVTW.js";import"./chunk-YSR7UND3.js";import{f as P}from"./chunk-RVMKL6T4.js";import N from"@inquirer/checkbox";import E from"@inquirer/confirm";import O from"@inquirer/select";import{loadDev as B,loadPackageConfig as j}from"@slip-stream-kit/config/internal";import z from"node:path";import g from"node:process";var C=e=>e.split("/")[0],R=e=>new Map(e.apps.map(r=>[r.name,r])),S=e=>e.localCapable&&e.cloudCapable,A=(e,r,a)=>S(r)?a[`${e} ${r.path}`]??(r.cloudCapable?"cloud":"local"):r.localCapable?"local":"cloud",D=(e,r,a)=>{let o=new Set,t=new Map;for(let n of e){let s=r.get(C(n));for(let i of s?.backends??[]){t.set(i.packageName,i.ownerApp);for(let p of i.routes)A(n,p,a)==="local"&&o.add(i.packageName)}}return{localPkgs:o,ownerByPkg:t}},$=(e,r)=>{let a={},o=!1;for(let t of e?.backends??[]){let n=r.has(t.packageName);for(let s of t.routes){let i=s.localCapable&&n?"local":"cloud";a[s.path]=i,i==="cloud"&&(o=!0)}}return{overrides:a,anyCloud:o}},W=(e,r)=>{let a=R(r),o=e.targets.filter(l=>l.endsWith("/ui")),t=e.targets.filter(l=>l.endsWith("/api")),{localPkgs:n,ownerByPkg:s}=D(o,a,e.sources),i={},p=!1;for(let l of o){let{overrides:c,anyCloud:f}=$(a.get(C(l)),n);f&&(p=!0),i[l]=Object.keys(c).length>0?{proxy:c}:{}}for(let l of t)i[l]??={};for(let l of n){let c=s.get(l);c!=null&&(i[`${c}/api`]??={})}return{presetDef:{apps:i},anyCloudRoute:p,targetKeys:Object.keys(i).sort()}},M=(e,r)=>{let a=[`--target=${e.targetKeys.join(",")}`];return r.watch||a.push("--no-watch"),r.orca&&a.push("--orca"),{flags:a.join(" ")}};var y={output:g.stderr,clearPromptOnDone:!0},U={select:e=>h(r=>O({message:e.message,choices:e.choices,default:e.default},r),{...y,whenHeadless:"refuse"}),checkbox:e=>h(r=>N({message:e.message,choices:e.choices},r),{...y,whenHeadless:"refuse"}),confirm:e=>h(r=>E({message:e.message,default:e.default},r),{...y,whenHeadless:"refuse"})},V=(e,r)=>{let a=new Map;for(let[o,t]of Object.entries(e)){let n={path:o,localCapable:t.from.includes("local"),cloudCapable:t.from.includes("cloud"),default:t.default},s=a.get(t.packageName);s?(s.routes.push(n),s.localCapable=s.localCapable||n.localCapable,s.cloudCapable=s.cloudCapable||n.cloudCapable):a.set(t.packageName,{packageName:t.packageName,routes:[n],localCapable:n.localCapable,cloudCapable:n.cloudCapable,ownerApp:r.get(t.packageName)})}return[...a.values()]},K=async(e,r,a)=>{try{let o=(await B(e))?.proxy?.routes;return o?V(o,a):[]}catch(o){return u.warn(`\u26A0\uFE0F  Skipping ${r}: its dev config failed to load \u2014 ${o instanceof Error?o.message:String(o)}`),[]}},_=async e=>{let r=k(e),a=w(e),o=new Map(r.map(c=>[c.packageName,c.name])),t=new Map(r.map(c=>[c.name,c.packageName])),n=new Set(a.map(c=>c.name)),s=new Set(r.map(c=>c.name)),i=[...new Set([...s,...n])].sort(),p=await Promise.all(i.map(async c=>{let f=n.has(c);return{name:c,hasApi:s.has(c),hasUi:f,apiPackage:t.get(c),backends:f?await K(z.join(e,"apps",c,"ui"),c,o):[],deployedUrlEnv:f?(await j(z.join(e,"apps",c,"ui")).catch(()=>{}))?.deployedUrlEnv:void 0}})),l=await b();return{apps:p,environments:Object.keys(l?.envs??{}).sort()}},q=e=>{let r=[];for(let a of e.apps){if(a.hasUi){let o=a.backends.flatMap(n=>n.routes.map(s=>s.path)),t=o.length>0?`frontend \u2014 proxies ${[...o].sort().join(", ")}`:"frontend";r.push({name:`${a.name}/ui`,value:`${a.name}/ui`,description:t})}a.hasApi&&!a.hasUi&&r.push({name:`${a.name}/api`,value:`${a.name}/api`,description:"backend"})}return r},I=e=>{let r={api:e.apps.filter(t=>t.hasApi).map(t=>t.name),ui:e.apps.filter(t=>t.hasUi).map(t=>t.name)},a={},o=new Map;for(let t of e.apps){t.apiPackage!=null&&(a[t.name]=t.apiPackage);for(let n of t.backends)for(let s of n.routes)o.set(`${t.name} ${s.path}`,n.packageName)}return{discovered:r,apiPkgByApp:a,routePkg:(t,n)=>o.get(`${t} ${n}`)}},L=(e,r)=>x(e,I(r)).map(a=>a.message),T="INFRA_KIT_DEV_WIZARD_ORCA",F=()=>g.env[T]==="1",H=async(e,r,a)=>{let o=new Map(r.apps.map(n=>[n.name,n])),t={};for(let n of a){let s=o.get(n.split("/")[0]);for(let i of s?.backends??[])for(let p of i.routes){if(!p.localCapable||!p.cloudCapable)continue;let l=await e.select({message:`\u{1F500} ${n} ${p.path} \u2192 local or cloud?`,choices:[{name:"local (this machine)",value:"local"},{name:"cloud",value:"cloud"}],default:p.default??"local"});t[`${n} ${p.path}`]=l}}return t},Z=(e,r,a)=>e.apps.find(o=>o.name===r)?.backends.flatMap(o=>o.routes).find(o=>o.path===a),G=(e,r)=>{let a=[];for(let[o,t]of Object.entries(e.presetDef.apps??{})){if(!o.endsWith("/ui")||!t.proxy)continue;let n=o.split("/")[0];for(let[s,i]of Object.entries(t.proxy)){let p=Z(r,n,s),l=p&&p.localCapable&&p.cloudCapable?"":" (only option)";a.push(`  ${o} ${s} \u2192 ${i}${l}`)}}if(a.length!==0){u.info("Resolved routes:");for(let o of[...a].sort())u.info(o)}},J=async(e,r)=>{let{downloadEnvSecrets:a}=await import("./secrets-download-DXRM5M6F.js"),o=await a(e);return new Map(r.flatMap(t=>{let n=o.get(t);return n===void 0?[]:[[t,n]]}))},Q=async(e,r,a,o)=>{let t=r.flatMap(s=>{let i=a.apps.find(p=>`${p.name}/ui`===s);return i?.deployedUrlEnv?[i.deployedUrlEnv]:[]}),n=t.length>0?await o(e,t):new Map;g.env[P]=e;for(let s of t){let i=n.get(s);i?g.env[s]=i:(delete g.env[s],u.warn(`\u2601\uFE0F  "${e}" holds no ${s}; routes that go to the deployed app will fail until it does.`))}},X=async(e,r,a)=>{if(r.apps.length===0)return u.warn("No apps discovered to run."),null;let o=await e.checkbox({message:"\u{1F4E6} Which packages?",choices:q(r)});if(o.length===0)return u.warn("No packages selected."),null;let t=o.filter(d=>d.endsWith("/ui")),n=await H(e,r,t),s=await e.confirm({message:"\u{1F440} Rebuild & restart on save (watch)?",default:!0}),i=F()?await e.confirm({message:"\u{1F9E9} Run each app in its own Orca pane?",default:!1}):!1,p={targets:o,sources:n,watch:s,orca:i},l=W(p,r);if(l.anyCloudRoute){if(r.environments.length===0)return u.warn("\u2601\uFE0F  This selection routes to a cloud environment, but no environment token is loaded."),u.warn("   Run `infra-kit env-load` to add one, then re-run the wizard."),null;p.env=await e.select({message:"\u2601\uFE0F  Point cloud routes at which environment?",choices:r.environments.map(d=>({name:d,value:d}))}),await Q(p.env,t,r,a)}let c=L(l.presetDef,r);if(c.length>0){u.warn("\u26A0\uFE0F  Proxy audit found issues with this selection:");for(let d of c)u.warn(`   \u2022 ${d}`);return null}G(l,r),Y(l,p);let f=l.targetKeys.filter(d=>d.endsWith("/api")).map(d=>d.split("/")[0]);return i&&f.length>0?{include:f,presetDef:l.presetDef,watch:s,orca:!0}:(i&&u.info("\u2139\uFE0F  Orca needs at least one local backend (panes are backend-only) \u2014 running in-process instead."),{presetDef:l.presetDef,watch:s,orca:!1})},Y=(e,r)=>{m.setInteractive();let a=M(e,r);m.addOption(a.flags,!0),m.print()},ee=async(e,r,a=J)=>X(e,r,a),he=async(e=U,r=v(g.cwd()))=>ee(e,await _(r));export{T as WIZARD_ORCA_VAR,L as auditManualPlan,U as defaultPrompts,_ as gatherWizardModel,K as loadBackends,he as runDevWizard,ee as runWizardFlow};
-//# sourceMappingURL=dev-wizard-run-PF3FTXA7.js.map
+import{a as m,e as h}from"./chunk-TYGUMAIP.js";import"./chunk-QWVLAZ6N.js";import{a as v,b as k,d as w,m as x}from"./chunk-55F372Z7.js";import{d as b}from"./chunk-L4AFEAYF.js";import{i as u}from"./chunk-JBQ5572P.js";import"./chunk-MFAFQVTW.js";import"./chunk-FHOMP6VJ.js";import{f as P}from"./chunk-RVMKL6T4.js";import N from"@inquirer/checkbox";import E from"@inquirer/confirm";import O from"@inquirer/select";import{loadDev as B,loadPackageConfig as j}from"@slip-stream-kit/config/internal";import z from"node:path";import g from"node:process";var C=e=>e.split("/")[0],R=e=>new Map(e.apps.map(r=>[r.name,r])),S=e=>e.localCapable&&e.cloudCapable,A=(e,r,a)=>S(r)?a[`${e} ${r.path}`]??(r.cloudCapable?"cloud":"local"):r.localCapable?"local":"cloud",D=(e,r,a)=>{let o=new Set,t=new Map;for(let n of e){let s=r.get(C(n));for(let i of s?.backends??[]){t.set(i.packageName,i.ownerApp);for(let p of i.routes)A(n,p,a)==="local"&&o.add(i.packageName)}}return{localPkgs:o,ownerByPkg:t}},$=(e,r)=>{let a={},o=!1;for(let t of e?.backends??[]){let n=r.has(t.packageName);for(let s of t.routes){let i=s.localCapable&&n?"local":"cloud";a[s.path]=i,i==="cloud"&&(o=!0)}}return{overrides:a,anyCloud:o}},W=(e,r)=>{let a=R(r),o=e.targets.filter(l=>l.endsWith("/ui")),t=e.targets.filter(l=>l.endsWith("/api")),{localPkgs:n,ownerByPkg:s}=D(o,a,e.sources),i={},p=!1;for(let l of o){let{overrides:c,anyCloud:f}=$(a.get(C(l)),n);f&&(p=!0),i[l]=Object.keys(c).length>0?{proxy:c}:{}}for(let l of t)i[l]??={};for(let l of n){let c=s.get(l);c!=null&&(i[`${c}/api`]??={})}return{presetDef:{apps:i},anyCloudRoute:p,targetKeys:Object.keys(i).sort()}},M=(e,r)=>{let a=[`--target=${e.targetKeys.join(",")}`];return r.watch||a.push("--no-watch"),r.orca&&a.push("--orca"),{flags:a.join(" ")}};var y={output:g.stderr,clearPromptOnDone:!0},U={select:e=>h(r=>O({message:e.message,choices:e.choices,default:e.default},r),{...y,whenHeadless:"refuse"}),checkbox:e=>h(r=>N({message:e.message,choices:e.choices},r),{...y,whenHeadless:"refuse"}),confirm:e=>h(r=>E({message:e.message,default:e.default},r),{...y,whenHeadless:"refuse"})},V=(e,r)=>{let a=new Map;for(let[o,t]of Object.entries(e)){let n={path:o,localCapable:t.from.includes("local"),cloudCapable:t.from.includes("cloud"),default:t.default},s=a.get(t.packageName);s?(s.routes.push(n),s.localCapable=s.localCapable||n.localCapable,s.cloudCapable=s.cloudCapable||n.cloudCapable):a.set(t.packageName,{packageName:t.packageName,routes:[n],localCapable:n.localCapable,cloudCapable:n.cloudCapable,ownerApp:r.get(t.packageName)})}return[...a.values()]},K=async(e,r,a)=>{try{let o=(await B(e))?.proxy?.routes;return o?V(o,a):[]}catch(o){return u.warn(`\u26A0\uFE0F  Skipping ${r}: its dev config failed to load \u2014 ${o instanceof Error?o.message:String(o)}`),[]}},_=async e=>{let r=k(e),a=w(e),o=new Map(r.map(c=>[c.packageName,c.name])),t=new Map(r.map(c=>[c.name,c.packageName])),n=new Set(a.map(c=>c.name)),s=new Set(r.map(c=>c.name)),i=[...new Set([...s,...n])].sort(),p=await Promise.all(i.map(async c=>{let f=n.has(c);return{name:c,hasApi:s.has(c),hasUi:f,apiPackage:t.get(c),backends:f?await K(z.join(e,"apps",c,"ui"),c,o):[],deployedUrlEnv:f?(await j(z.join(e,"apps",c,"ui")).catch(()=>{}))?.deployedUrlEnv:void 0}})),l=await b();return{apps:p,environments:Object.keys(l?.envs??{}).sort()}},q=e=>{let r=[];for(let a of e.apps){if(a.hasUi){let o=a.backends.flatMap(n=>n.routes.map(s=>s.path)),t=o.length>0?`frontend \u2014 proxies ${[...o].sort().join(", ")}`:"frontend";r.push({name:`${a.name}/ui`,value:`${a.name}/ui`,description:t})}a.hasApi&&!a.hasUi&&r.push({name:`${a.name}/api`,value:`${a.name}/api`,description:"backend"})}return r},I=e=>{let r={api:e.apps.filter(t=>t.hasApi).map(t=>t.name),ui:e.apps.filter(t=>t.hasUi).map(t=>t.name)},a={},o=new Map;for(let t of e.apps){t.apiPackage!=null&&(a[t.name]=t.apiPackage);for(let n of t.backends)for(let s of n.routes)o.set(`${t.name} ${s.path}`,n.packageName)}return{discovered:r,apiPkgByApp:a,routePkg:(t,n)=>o.get(`${t} ${n}`)}},L=(e,r)=>x(e,I(r)).map(a=>a.message),T="INFRA_KIT_DEV_WIZARD_ORCA",F=()=>g.env[T]==="1",H=async(e,r,a)=>{let o=new Map(r.apps.map(n=>[n.name,n])),t={};for(let n of a){let s=o.get(n.split("/")[0]);for(let i of s?.backends??[])for(let p of i.routes){if(!p.localCapable||!p.cloudCapable)continue;let l=await e.select({message:`\u{1F500} ${n} ${p.path} \u2192 local or cloud?`,choices:[{name:"local (this machine)",value:"local"},{name:"cloud",value:"cloud"}],default:p.default??"local"});t[`${n} ${p.path}`]=l}}return t},Z=(e,r,a)=>e.apps.find(o=>o.name===r)?.backends.flatMap(o=>o.routes).find(o=>o.path===a),G=(e,r)=>{let a=[];for(let[o,t]of Object.entries(e.presetDef.apps??{})){if(!o.endsWith("/ui")||!t.proxy)continue;let n=o.split("/")[0];for(let[s,i]of Object.entries(t.proxy)){let p=Z(r,n,s),l=p&&p.localCapable&&p.cloudCapable?"":" (only option)";a.push(`  ${o} ${s} \u2192 ${i}${l}`)}}if(a.length!==0){u.info("Resolved routes:");for(let o of[...a].sort())u.info(o)}},J=async(e,r)=>{let{downloadEnvSecrets:a}=await import("./secrets-download-KDLWMDYM.js"),o=await a(e);return new Map(r.flatMap(t=>{let n=o.get(t);return n===void 0?[]:[[t,n]]}))},Q=async(e,r,a,o)=>{let t=r.flatMap(s=>{let i=a.apps.find(p=>`${p.name}/ui`===s);return i?.deployedUrlEnv?[i.deployedUrlEnv]:[]}),n=t.length>0?await o(e,t):new Map;g.env[P]=e;for(let s of t){let i=n.get(s);i?g.env[s]=i:(delete g.env[s],u.warn(`\u2601\uFE0F  "${e}" holds no ${s}; routes that go to the deployed app will fail until it does.`))}},X=async(e,r,a)=>{if(r.apps.length===0)return u.warn("No apps discovered to run."),null;let o=await e.checkbox({message:"\u{1F4E6} Which packages?",choices:q(r)});if(o.length===0)return u.warn("No packages selected."),null;let t=o.filter(d=>d.endsWith("/ui")),n=await H(e,r,t),s=await e.confirm({message:"\u{1F440} Rebuild & restart on save (watch)?",default:!0}),i=F()?await e.confirm({message:"\u{1F9E9} Run each app in its own Orca pane?",default:!1}):!1,p={targets:o,sources:n,watch:s,orca:i},l=W(p,r);if(l.anyCloudRoute){if(r.environments.length===0)return u.warn("\u2601\uFE0F  This selection routes to a cloud environment, but no environment token is loaded."),u.warn("   Run `infra-kit env-load` to add one, then re-run the wizard."),null;p.env=await e.select({message:"\u2601\uFE0F  Point cloud routes at which environment?",choices:r.environments.map(d=>({name:d,value:d}))}),await Q(p.env,t,r,a)}let c=L(l.presetDef,r);if(c.length>0){u.warn("\u26A0\uFE0F  Proxy audit found issues with this selection:");for(let d of c)u.warn(`   \u2022 ${d}`);return null}G(l,r),Y(l,p);let f=l.targetKeys.filter(d=>d.endsWith("/api")).map(d=>d.split("/")[0]);return i&&f.length>0?{include:f,presetDef:l.presetDef,watch:s,orca:!0}:(i&&u.info("\u2139\uFE0F  Orca needs at least one local backend (panes are backend-only) \u2014 running in-process instead."),{presetDef:l.presetDef,watch:s,orca:!1})},Y=(e,r)=>{m.setInteractive();let a=M(e,r);m.addOption(a.flags,!0),m.print()},ee=async(e,r,a=J)=>X(e,r,a),he=async(e=U,r=v(g.cwd()))=>ee(e,await _(r));export{T as WIZARD_ORCA_VAR,L as auditManualPlan,U as defaultPrompts,_ as gatherWizardModel,K as loadBackends,he as runDevWizard,ee as runWizardFlow};
+//# sourceMappingURL=dev-wizard-run-UUHDVB5L.js.map

package/dist/infra-kit.schema.json

@@ -0,0 +1,218 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "$schema": {
+      "type": "string"
+    },
+    "configVersion": {
+      "type": "integer",
+      "exclusiveMinimum": 0,
+      "maximum": 9007199254740991
+    },
+    "envManagement": {
+      "oneOf": [
+        {
+          "type": "object",
+          "properties": {
+            "provider": {
+              "type": "string",
+              "const": "doppler"
+            },
+            "config": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "minLength": 1
+                }
+              },
+              "required": ["name"]
+            }
+          },
+          "required": ["provider", "config"]
+        }
+      ]
+    },
+    "defaultEnv": {
+      "type": "string",
+      "minLength": 1
+    },
+    "worktrees": {
+      "type": "object",
+      "properties": {
+        "openInGithubDesktop": {
+          "type": "boolean"
+        },
+        "openInOrca": {
+          "type": "boolean"
+        },
+        "orca": {
+          "type": "object",
+          "properties": {
+            "layout": {
+              "type": "string",
+              "enum": ["two-columns", "three-pane"]
+            }
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    },
+    "protectedEnvs": {
+      "type": "string",
+      "enum": ["disallow", "allow", "cli-only"]
+    },
+    "gitFlow": {
+      "type": "string",
+      "enum": ["dev", "main"]
+    },
+    "mcp": {
+      "type": "object",
+      "propertyNames": {
+        "type": "string",
+        "pattern": "^[a-z][a-z0-9-]*$"
+      },
+      "additionalProperties": {
+        "type": "object",
+        "properties": {
+          "command": {
+            "type": "string",
+            "minLength": 1
+          },
+          "args": {
+            "default": [],
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "env": {
+            "minItems": 1,
+            "type": "array",
+            "items": {
+              "type": "string",
+              "pattern": "^[A-Z_]\\w*$"
+            }
+          },
+          "unset": {
+            "default": [],
+            "type": "array",
+            "items": {
+              "type": "string",
+              "pattern": "^[A-Z_]\\w*$"
+            }
+          }
+        },
+        "required": ["command", "env"],
+        "additionalProperties": false
+      }
+    },
+    "vendorSource": {
+      "anyOf": [
+        {
+          "type": "object",
+          "properties": {
+            "copy": {
+              "minItems": 1,
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "path": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "target": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "module": {
+                    "type": "string",
+                    "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$"
+                  }
+                },
+                "required": ["path"],
+                "additionalProperties": false
+              }
+            },
+            "exclude": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "pattern": "^[^/\\\\]+$"
+              }
+            }
+          },
+          "required": ["copy"],
+          "additionalProperties": false
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "vendorTarget": {
+      "type": "object",
+      "properties": {
+        "modules": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$"
+          }
+        }
+      },
+      "required": ["modules"],
+      "additionalProperties": false
+    },
+    "audit": {
+      "type": "object",
+      "properties": {
+        "requiredScripts": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "requiredFiles": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "turbo": {
+          "type": "object",
+          "properties": {
+            "requiredTasks": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          },
+          "additionalProperties": false
+        },
+        "exclude": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        }
+      },
+      "additionalProperties": false
+    },
+    "aliasRepo": {
+      "type": "string",
+      "pattern": "^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$"
+    }
+  },
+  "required": ["envManagement"],
+  "additionalProperties": false,
+  "title": "infra-kit.json"
+}

package/dist/{secrets-download-DXRM5M6F.js → secrets-download-KDLWMDYM.js}

@@ -1,2 +1,2 @@
-import{g as a,h as b,i as c,j as d,k as e,l as f,m as g,n as h}from"./chunk-K5KNXRTF.js";import"./chunk-S23ECFH4.js";import"./chunk-HMXEV7ZN.js";import"./chunk-MFAFQVTW.js";import"./chunk-YSR7UND3.js";import"./chunk-RVMKL6T4.js";export{a as DOPPLER_MAX_OUTPUT_BYTES,g as assertDopplerOutputSize,e as assertTokenScope,b as buildDopplerChildEnv,d as downloadDopplerSecrets,c as downloadEnvSecrets,h as parseDopplerSecretsJson,f as translateDopplerDownloadError};
-//# sourceMappingURL=secrets-download-DXRM5M6F.js.map
+import{g as a,h as b,i as c,j as d,k as e,l as f,m as g,n as h}from"./chunk-KA5BFUCS.js";import"./chunk-L4AFEAYF.js";import"./chunk-JBQ5572P.js";import"./chunk-MFAFQVTW.js";import"./chunk-FHOMP6VJ.js";import"./chunk-RVMKL6T4.js";export{a as DOPPLER_MAX_OUTPUT_BYTES,g as assertDopplerOutputSize,e as assertTokenScope,b as buildDopplerChildEnv,d as downloadDopplerSecrets,c as downloadEnvSecrets,h as parseDopplerSecretsJson,f as translateDopplerDownloadError};
+//# sourceMappingURL=secrets-download-KDLWMDYM.js.map

package/dist/update-check.js

@@ -1,2 +1,2 @@
-import{t as i}from"./chunk-HIGOL4H4.js";import"./chunk-REDCBY4O.js";import{a as t}from"./chunk-YSR7UND3.js";import"./chunk-RVMKL6T4.js";import a from"node:fs";import o from"node:process";import{fileURLToPath as s}from"node:url";var m=r=>{let n=r.indexOf("--parent-pid");if(n===-1)return;let e=Number(r[n+1]);return Number.isInteger(e)&&e>0?e:void 0},p=()=>a.realpathSync(s(new URL("./cli.js",import.meta.url))),d=async()=>{await i(t.version,{selfRealPath:p(),parentPid:m(o.argv)})};d().catch(()=>{o.exitCode=0});
+import{t as i}from"./chunk-HIGOL4H4.js";import"./chunk-REDCBY4O.js";import{a as t}from"./chunk-FHOMP6VJ.js";import"./chunk-RVMKL6T4.js";import a from"node:fs";import o from"node:process";import{fileURLToPath as s}from"node:url";var m=r=>{let n=r.indexOf("--parent-pid");if(n===-1)return;let e=Number(r[n+1]);return Number.isInteger(e)&&e>0?e:void 0},p=()=>a.realpathSync(s(new URL("./cli.js",import.meta.url))),d=async()=>{await i(t.version,{selfRealPath:p(),parentPid:m(o.argv)})};d().catch(()=>{o.exitCode=0});
 //# sourceMappingURL=update-check.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "infra-kit",
   "type": "module",
-  "version": "0.42.0",
+  "version": "0.43.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ArthurSaenz/infra-kit.git",
@@ -25,7 +25,7 @@
     "@inquirer/input": "^5.1.9",
     "@inquirer/password": "^5.2.5",
     "@inquirer/select": "^5.2.8",
-    "@slip-stream-kit/config": "^0.42.0",
+    "@slip-stream-kit/config": "^0.43.0",
     "chalk": "^6.0.1",
     "chokidar": "^6.0.0",
     "commander": "^15.0.0",
@@ -40,7 +40,7 @@
     "zx": "^8.8.5"
   },
   "devDependencies": {
-    "@slip-stream-kit/eslint-plugin": "0.42.0",
+    "@slip-stream-kit/eslint-plugin": "0.43.0",
     "@types/aws-lambda": "^8.10.164",
     "@types/react": "19.3.0",
     "@wl/eslint-config": "0.1.0",
@@ -63,6 +63,7 @@
     "test-watch": "pnpm exec vitest --watch --silent passed-only",
     "test-ui": "pnpm exec vitest --ui --silent passed-only",
     "test-report": "pnpm exec vitest run --coverage --silent passed-only",
+    "generate-config-schema": "pnpm exec vitest run src/lib/infra-kit-config/__tests__/json-schema.test.ts --update=all",
     "qa:pty": "INFRA_KIT_REQUIRE_PTY=1 pnpm exec vitest run --reporter=minimal src/tui/__tests__/stdin-pause-pty.test.ts src/entry/__tests__/quit-keys-pty.test.ts src/entry/__tests__/post-run-pause-pty.test.ts",
     "qa": "pnpm run prettier-check && pnpm run eslint-check && pnpm run ts-check && pnpm run test && echo ✅ Success",
     "fix": "pnpm run prettier-fix && pnpm run eslint-fix && pnpm run qa"

package/readme.md

@@ -45,7 +45,7 @@ Code loads is self-contained and needs no config reader at session start.
 The split is by level: one `infra-kit.json` per repo, one `infra-kit.config.ts` per workspace package. The repo root has no `infra-kit.config.ts`.
 
 **infra-kit.json** (repo)  
-Repo-wide settings: environment providers (e.g., Doppler), worktrees, MCP proxies, and the `audit` block `infra-kit audit --root` checks the root against. Layered with personal overrides from `~/.infra-kit/infra-kit.json` and `~/.infra-kit/projects/<repo>/infra-kit.json`; `aliasRepo`, `mcp`, `vendorSource`, `vendorTarget` and `audit` are accepted only in the committed file. A `vendorSource.copy` entry with a `module` name reaches only the targets whose `vendorTarget.modules` lists it (no `vendorTarget` block: every module); dropping a module deletes its files under `vendor/` and leaves a path outside it to the target, and `vendor sync` fails the target while one of its `package.json` files still depends on a package the drop would delete. A mirrored file keeps the target's own lines between `# infra-kit:local-start` and `# infra-kit:local-end` marker lines (any comment leader): `vendor sync` writes the source with that block in place of the source's own block (or appended), and `vendor check` leaves the block out of its checksums. `aliasRepo` (a DNS label, e.g. `"trvl"`) replaces the main checkout's directory name in the dev host `<release>.<package>.<repo>.localhost`. A leftover root `infra-kit.config.ts` fails `audit --root`; `infra-kit audit --fix --root` moves its rules into `audit` and deletes it.
+Repo-wide settings: environment providers (e.g., Doppler), worktrees, MCP proxies, and the `audit` block `infra-kit audit --root` checks the root against. Layered with personal overrides from `~/.infra-kit/infra-kit.json` and `~/.infra-kit/projects/<repo>/infra-kit.json`; `aliasRepo`, `mcp`, `vendorSource`, `vendorTarget` and `audit` are accepted only in the committed file. A `vendorSource.copy` entry with a `module` name reaches only the targets whose `vendorTarget.modules` lists it (no `vendorTarget` block: every module); dropping a module deletes its files under `vendor/` and leaves a path outside it to the target, and `vendor sync` fails the target while one of its `package.json` files still depends on a package the drop would delete. A mirrored file keeps the target's own lines between `# infra-kit:local-start` and `# infra-kit:local-end` marker lines (any comment leader): `vendor sync` writes the source with that block in place of the source's own block (or appended), and `vendor check` leaves the block out of its checksums. `aliasRepo` (a DNS label, e.g. `"trvl"`) replaces the main checkout's directory name in the dev host `<release>.<package>.<repo>.localhost`. `audit.exclude` lists workspace globs in the `pnpm-workspace.yaml` dialect (e.g. `apps/special/ui/pages/*`) that `audit --all` and `audit --fix --all` skip — for packages another tool generates and owns; `--json` names them in `excluded`. A leftover root `infra-kit.config.ts` fails `audit --root`; `infra-kit audit --fix --root` moves its rules into `audit` and deletes it. `audit --fix --root` also stamps `$schema` (the JSON Schema shipped with that CLI version, on unpkg) and `configVersion` at the top of the committed file; nothing else writes them, and a CLI refuses a `configVersion` newer than it reads.
 
 **infra-kit.config.ts** (package)  
 Strict schema file that declares the package's audit rules (`requiredScripts`, `requiredFiles`), an optional `type` override (`frontend` | `backend` | `lib` | `e2e` | `mobile`) used by the `agent-guidance` check, and the `dev.proxy` / `e2e` blocks read by the Vite plugin, `infra-kit dev` and the Playwright helper.

package/dist/chunk-HMXEV7ZN.js

@@ -1,16 +0,0 @@
-import{a as me}from"./chunk-MFAFQVTW.js";import{a as ce}from"./chunk-YSR7UND3.js";import{e as L,q as K,s as W}from"./chunk-RVMKL6T4.js";var v=e=>{let t=new Set,r=e;for(;r!==null&&typeof r=="object"&&!t.has(r);){t.add(r);let{stderr:o,stderrExcerpt:n}=r;if(typeof o=="string"&&o.length>0)return o;if(typeof n=="string"&&n.length>0)return n;r=r.cause}},He=(e,t)=>{let r=t.stderrExcerpt??v(e),o=[`failed to ${t.operation}`];return r&&o.push(`stderr: ${r.slice(0,200).trim()}`),t.remediation&&o.push(`try: ${t.remediation}`),o.join(" \u2014 ")},m=class extends Error{operation;remediation;stderrExcerpt;constructor(t,r){super(He(t,r),{cause:t}),this.name="OperationError",this.operation=r.operation,this.remediation=r.remediation,this.stderrExcerpt=r.stderrExcerpt??v(t)}};import Je from"node:process";import Ue from"pino";import Xe from"pino-pretty";var Ye=["token","*.token","serviceToken","*.serviceToken","DOPPLER_TOKEN","*.DOPPLER_TOKEN","INFRA_KIT_ENV_TOKEN","*.INFRA_KIT_ENV_TOKEN"],Ze=()=>{let e=Je.argv.includes("--debug")?"debug":"info",t=["time","pid","hostname"];return e==="debug"&&t.push("level"),Ue({level:e,redact:Ye},Xe({destination:2,ignore:t.join(","),colorize:!0,sync:!0}))},D=Ze();import Qe from"node:process";import{z as ue}from"zod";var F=1,et={schemaVersion:ue.literal(F),command:ue.string().describe("The grouped command path that ran, e.g. `release create`")},R={enabled:!1,command:""},tt=e=>typeof e=="object"&&e!==null&&!Array.isArray(e),de=e=>tt(e)?{schemaVersion:F,command:R.command,...e}:e,rt=(e,t=r=>{Qe.stdout.write(r)})=>(R.enabled&&e&&e.structuredContent!=null&&t(`${JSON.stringify(de(e.structuredContent),null,2)}
-`),e),pe=e=>{e.options.some(r=>r.long==="--json")||e.option("--json","Output the structured result as JSON on stdout (human logs stay on stderr)");for(let r of e.commands)pe(r)};import ot from"node:process";var S={source:null},w=()=>S.source!==null,nt=()=>w()||R.enabled,V=()=>!!ot.env.CI,it=({env:e,stdinIsTTY:t,flag:r})=>{if(r)return"flag";let o=e.INFRA_KIT_AGENT;return o==="1"||e.CLAUDECODE!==void 0&&!t&&o!=="0"?"env":null};import k from"node:path";import we from"node:process";import{$ as u}from"zx";var st=/^v?(\d+)\.(\d+)\.(\d+)$/,at=/^(\d+)\.(\d+)\.(\d+)$/,ct=/^[a-z0-9]+(?:-[a-z0-9]+)*$/,P="release/",q="release/v",le="refs/heads/",mt="next";var ge=new Set(["dev","main","next","hotfix","regular","release"]),h=class extends Error{constructor(t){super(t),this.name="InvalidReleaseNameError"}},y=class extends Error{constructor(t){super(t),this.name="InvalidReleaseRefError"}},he=e=>e.startsWith(le)?e.slice(le.length):e,ye=(e,t,r)=>({kind:"version",semver:{major:e,minor:t,patch:r},raw:`${e}.${t}.${r}`}),G=e=>{if(e.length===0)throw new h('Release name is empty. Provide a kebab-case name like "checkout-redesign".');if(e.length>50)throw new h(`Release name "${e}" is ${e.length} characters; the maximum is 50.`);if(!ct.test(e))throw new h(`Release name "${e}" is not kebab-case. Use lowercase letters, digits, and single hyphens, e.g. "checkout-redesign".`);if(ge.has(e))throw new h(`Release name "${e}" is reserved. Reserved names: ${[...ge].join(", ")}.`)},B=e=>{let t=he(e.trim());if(!t.startsWith(P))return null;if(t.startsWith(q)){let o=t.slice(q.length),n=at.exec(o);if(n)return ye(Number(n[1]),Number(n[2]),Number(n[3]))}let r=t.slice(P.length);try{G(r)}catch{return null}return{kind:"name",name:r,raw:r}},ut=e=>{let t=e.trim();if(he(t).startsWith(P)){let n=B(t);if(!n)throw new y(`"${e}" looks like a release branch but is not a valid release/v<semver> or release/<name> ref.`);return n}let o=st.exec(t);if(o)return ye(Number(o[1]),Number(o[2]),Number(o[3]));if(t.toLowerCase()===mt)throw new y('The "next" token must be resolved to a concrete version (via computeNextVersion) before parsing a release ref.');if(t.includes("@"))throw new y(`Cannot parse "${e}" as a release ref: the \`@date\` suffix belongs to \`release create\`; pass the version alone here and use \`--release-date\` on \`release edit\``);try{G(t)}catch(n){let s=n instanceof Error?n.message:String(n);throw new y(`Cannot parse "${e}" as a release ref: ${s}`)}return{kind:"name",name:t,raw:t}},dt=e=>e.kind==="version"?`${q}${e.raw}`:`${P}${e.name}`,pt=(e,t)=>{let r=t==="hotfix"?"Hotfix":"Release";return e.kind==="version"?`${r} v${e.raw}`:`${r} ${e.name}`},lt=e=>e.kind==="version"?`Release v${e.raw} (RC)`:`Release ${e.name} (RC)`,gt=e=>e.kind==="version"?`v${e.raw}`:e.name,ft=e=>e.raw,z=e=>e==null?!1:B(e)!==null,fe=e=>{if(e===void 0)return null;let t=e instanceof Date?e.getTime():new Date(e).getTime();return Number.isNaN(t)?null:t},ht=(e,t,r)=>{if(e.kind==="version"&&t.kind==="version")return e.semver.major!==t.semver.major?e.semver.major-t.semver.major:e.semver.minor!==t.semver.minor?e.semver.minor-t.semver.minor:e.semver.patch-t.semver.patch;if(e.kind==="version")return-1;if(t.kind==="version")return 1;let o=fe(r?.a),n=fe(r?.b);return o!==null&&n!==null&&o!==n?o-n:e.name<t.name?-1:e.name>t.name?1:0};var ke=async e=>{let t=await u({cwd:e})`git worktree list --porcelain`,r=[],o=null;for(let n of t.stdout.split(`
-`)){if(n.startsWith("worktree ")){o&&r.push(o),o={path:n.slice(9),branch:null,detached:!1,bare:!1,prunable:!1,locked:!1};continue}o&&(n.startsWith("branch ")?o.branch=n.slice(7).replace(/^refs\/heads\//,""):n==="detached"?o.detached=!0:n==="bare"?o.bare=!0:n==="locked"||n.startsWith("locked ")?o.locked=!0:(n==="prunable"||n.startsWith("prunable "))&&(o.prunable=!0))}return o&&r.push(o),r},yt=async e=>{let t=await ke(we.cwd()),r=o=>e==="release"?z(o):o.startsWith("feature/");return t.map(o=>o.branch).filter(o=>o!==null&&r(o))},wt=e=>{let t=v(e);return t&&/not a git repository/i.test(t)?"not a git repository":void 0},kt=({hasStderr:e})=>{if(w())return"infra-kit resolves its project from the working directory; run it from inside an infra-kit project repo (or one of its git worktrees), or pass `-C <dir>` naming one";let t="run infra-kit from inside an infra-kit project repo (or one of its git worktrees)";return e?`${t}; if you are already in one, the stderr in this message is the real cause`:t},x=async()=>{try{return(await u({quiet:!0})`git rev-parse --show-toplevel`).stdout.trim()}catch(e){let t=wt(e)??v(e);throw new m(e,{operation:`resolve the project root from ${we.cwd()}`,stderrExcerpt:t,remediation:kt({hasStderr:t!==void 0})})}},H=async e=>{let t=e??await x(),r=(await u({cwd:t,quiet:!0})`git rev-parse --git-common-dir`).stdout.trim(),o=k.resolve(t,r);return o.includes(`${k.sep}.git${k.sep}modules${k.sep}`)?t:k.dirname(o)},ve=async()=>(await u`git rev-parse --abbrev-ref HEAD`).stdout.trim(),Re=async()=>(await u`git status --porcelain`).stdout.split(`
-`).map(t=>t.trimEnd()).filter(t=>t.trim().length>0),vt=async()=>(await Re()).length===0,Rt=async()=>{let e=await x(),[t,r]=await Promise.all([u({cwd:e})`git rev-parse --absolute-git-dir`,u({cwd:e})`git rev-parse --git-common-dir`]),o=t.stdout.trim(),n=k.resolve(e,r.stdout.trim());return o!==n};var xt=async e=>(await u`git branch --list ${e}`).stdout.trim().length>0,bt=async e=>{(await u`git branch --list ${e}`).stdout.trim().length!==0&&await ve()!==e&&await u`git branch -D ${e}`},Et=async e=>{(await u`git ls-remote --heads origin ${e}`).stdout.trim().length!==0&&await u`git push origin --delete ${e}`};import{$ as j}from"zx";var Mt=async(e,t)=>{let r=`${t}^{commit}`;try{return(await j({cwd:e,quiet:!0})`git rev-parse --verify --quiet ${r}`).stdout.trim()||null}catch{return null}},Ct=async(e,t,r)=>{try{return await j({cwd:e,quiet:!0})`git merge-base --is-ancestor ${t} ${r}`,!0}catch(o){if(o.exitCode===1)return!1;throw new m(o,{operation:`test whether ${t} is contained in ${r}`,remediation:"both refs must exist \u2014 verify them with rev-parse first"})}},St=async(e,t)=>{let o=(await j({cwd:e,quiet:!0})`git ls-remote --heads origin ${t}`).stdout.trim().split(`
-`)[0];return o?o.split(/\s+/)[0]??null:null},Pt=async(e,t)=>{let r=t.map(o=>`${o.sha}:refs/heads/${o.branch}`);if(r.length===0)return{refspecs:r,pushed:!1};try{return await j({cwd:e,quiet:!0})`git push --atomic origin ${r}`,{refspecs:r,pushed:!0}}catch(o){return{refspecs:r,pushed:!1,stderr:o.stderr}}};import $ from"node:path";import J from"node:process";import{$ as p}from"zx";var xe=async e=>{let t=e??J.cwd(),r=(await p({cwd:t,quiet:!0})`git rev-parse --git-common-dir`).stdout.trim(),o=$.dirname($.resolve(t,r)),n=J.env.INFRA_KIT_SESSION||String(J.pid);return $.join(`${o}${K}`,W.mergeDev,`.scratch-${n}`)},be=e=>e.replace(/[^\w-]+/g,"-"),jt=(e,t)=>$.join(`${e}${K}`,W.mergeDev,be(t)),U=async e=>{try{return await p({cwd:e,quiet:!0})`git rev-parse -q --verify MERGE_HEAD`,!0}catch{return!1}},$t=async e=>{if(await U(e))throw new m(void 0,{operation:"reuse the scratch worktree",stderrExcerpt:"a merge is still in progress in the scratch worktree",remediation:"this is an infra-kit bug \u2014 the previous branch iteration did not clean up"});let t=(await p({cwd:e,quiet:!0})`git status --porcelain`).stdout.trim();if(t.length>0)throw new m(void 0,{operation:"reuse the scratch worktree",stderrExcerpt:`scratch worktree is dirty: ${t.split(`
-`)[0]}`,remediation:"this is an infra-kit bug \u2014 the previous branch iteration did not clean up"})},It=async e=>{let t=async r=>{try{await r()}catch{}};await U(e)&&await t(()=>p({cwd:e,quiet:!0})`git merge --abort`),await t(()=>p({cwd:e,quiet:!0})`git reset --hard`),await t(()=>p({cwd:e,quiet:!0})`git clean -fdx -e node_modules`)},Ot=async(e,t)=>{let{cwd:r,anchor:o}=e,n=await xe(r),s=async()=>{await p({cwd:r,quiet:!0})`git worktree add --detach ${n} ${o}`};try{await s()}catch(c){try{await p({cwd:r,quiet:!0})`git worktree prune`,await s()}catch{throw new m(c,{operation:"create the scratch worktree for the merge",remediation:`remove any stale checkout at ${n}, then retry`})}}let d={path:n,remove:async()=>{try{await p({cwd:r,quiet:!0})`git worktree remove --force ${n}`}catch{}}};try{return await t(d)}finally{await d.remove()}};import At from"node:fs/promises";import Tt from"node:os";var Nt=async e=>{try{return await At.access(e),!0}catch{return!1}},X=e=>{let t=Tt.homedir();return e.startsWith(t)?`~${e.slice(t.length)}`:e};var I=class extends m{structuredContent;exitCode;constructor(t,r,o){super(void 0,o),this.name="StructuredRefusalError",this.structuredContent=t,this.exitCode=r}};import ie from"node:fs/promises";import _e from"node:os";import M from"node:path";import qt from"node:process";import{z as i}from"zod";var Y=e=>{throw new Error(`Unexpected value: ${JSON.stringify(e)}`)};var Ee=(e,t)=>Object.fromEntries(Object.entries(e).filter(([r])=>r!==t));var a=({key:e,id:t,note:r})=>({id:t,note:r,apply:o=>e in o?{changed:!0,result:Ee(o,e)}:{changed:!1,result:o}});var Me=a({key:"dev",id:"drop-dev-key",note:'the unused "dev" key (a dev server port comes from <APP>_PORT / PORT, else the built-in default)'});var Ce=a({key:"devServersPresets",id:"drop-dev-presets-key",note:'the unused "devServersPresets" key (run `infra-kit dev <app>` instead of a preset name)'});var Se=a({key:"devProxy",id:"drop-dev-proxy-key",note:'the retired "devProxy" key (dev URLs are port-free https://<release>.<package>.localhost)'});var Pe=a({key:"envAutoLoad",id:"drop-env-auto-load-key",note:'the retired "envAutoLoad" key (env auto-load is gone \u2014 run `env-load -c <config>` in the terminal)'});var je=a({key:"environments",id:"drop-environments-key",note:`the retired "environments" key (deploy targets now come from each workflow's workflow_dispatch options, auth from the token store)`});var $e=a({key:"ide",id:"drop-ide-key",note:'the unused "ide" key (worktrees add/remove no longer edit a Cursor .code-workspace)'});var Ie=a({key:"taskManager",id:"drop-task-manager-key",note:'the unused "taskManager" key (Jira is configured by the JIRA_BASE_URL / JIRA_PROJECT_ID env vars in Doppler)'});var Z=[$e,je,Se,Pe,Ie,Ce,Me];var b=e=>Z.reduce((t,r)=>{let o=r.apply(t.result);return o.changed?{changed:!0,result:o.result,notes:[...t.notes,r.note]}:t},{changed:!1,result:e,notes:[]});var Oe={withheld:!1},Q=()=>Oe.withheld||V();import{randomBytes as _t}from"node:crypto";import g from"node:fs/promises";import ee from"node:path";import Lt from"node:process";var O=class extends Error{constructor(t){super(`${t} changed on disk since it was read`),this.name="ConfigFileChangedError"}},Kt=2,Wt=e=>/^([ \t]+)\S/m.exec(e)?.[1]??Kt,Dt=4095,A=async({path:e,raw:t,migrated:r,expectedMtimeMs:o})=>{let n=await g.realpath(e),s=ee.dirname(n),d=ee.basename(n),c=ee.join(s,`.${d}.${Lt.pid}.${_t(4).toString("hex")}.tmp`),N=`${JSON.stringify(r,null,Wt(t))}
-`;try{await g.writeFile(c,N,"utf8");let l=await g.stat(n);if(l.mtimeMs!==o)throw new O(e);await g.chmod(c,l.mode&Dt),await g.rename(c,n)}catch(l){throw await g.rm(c,{force:!0}),l}},Ft=e=>e!==null&&typeof e=="object"&&!Array.isArray(e),Vt=async e=>{let t=await g.stat(e),r=await g.readFile(e,"utf8");if(r.trim()==="")return{changed:!1,result:{},notes:[],path:e};let o=JSON.parse(r);if(!Ft(o))return{changed:!1,result:{},notes:[],path:e};let n=b(o);return n.changed&&await A({path:e,raw:r,migrated:n.result,expectedMtimeMs:t.mtimeMs}),{...n,path:e}};var te=async(e,t,r,{schema:o})=>{if(e.autoMigrate==="off")return{kind:"not-applicable"};let n=b(t);if(!n.changed)return{kind:"not-applicable"};let s=o.safeParse(n.result);if(!s.success)return{kind:"not-applicable"};if(e.required&&Q())return{kind:"ci-gated"};try{await A({path:e.path,raw:r,migrated:n.result,expectedMtimeMs:e.mtimeMs})}catch(d){return D.debug(d,`auto-migration could not rewrite ${e.path}`),{kind:"not-applicable"}}return D.warn(`Migrated ${X(e.path)}: removed ${n.notes.join(" and ")} (retired by infra-kit ${ce.version})`),{kind:"migrated",data:s.data}};var Ae="infra-kit.json";var Gt="infra-kit.json",Bt="projects",zt=i.object({provider:i.literal("doppler"),config:i.object({name:i.string().min(1)})}),Ht=i.discriminatedUnion("provider",[zt]),Jt=["two-columns","three-pane"],Ut=i.object({layout:i.enum(Jt).optional()}).strict(),Xt=i.object({openInGithubDesktop:i.boolean().optional(),openInOrca:i.boolean().optional(),orca:Ut.optional()}).strict(),Yt=i.enum(["disallow","allow","cli-only"]),Te=i.string().regex(/^[A-Z_]\w*$/i,"must be a POSIX environment-variable name"),Zt=i.object({command:i.string().min(1),args:i.array(i.string()).default([]),env:i.array(Te).min(1),unset:i.array(Te).default([])}).strict().superRefine((e,t)=>{for(let r of e.env)me.has(r)&&t.addIssue({code:"custom",path:["env"],message:`"${r}" is process plumbing the proxy never strips or injects \u2014 it cannot be a credential name`})}),Qt=i.record(i.string().regex(/^[a-z][a-z0-9-]*$/,"must be lowercase letters, digits and hyphens, starting with a letter").refine(e=>!e.includes("infra-kit"),{message:'"infra-kit" is reserved: it is the .mcp.json key of the retired infra-kit MCP server \u2014 pick another name'}),Zt),Ne=i.string().min(1).superRefine((e,t)=>{if(e.startsWith("/")||e.startsWith("\\")||/^[a-z]:/i.test(e)){t.addIssue({code:"custom",message:`"${e}" must be relative to the repository root`});return}let r=e.split(/[/\\]/).filter(n=>n!==""&&n!==".");r.includes("..")&&t.addIssue({code:"custom",message:`"${e}" must not contain a ".." segment`}),r[0]===".git"&&t.addIssue({code:"custom",message:`"${e}" must not be .git or a path inside it`}),e.includes("\\")&&t.addIssue({code:"custom",message:`"${e}" must use "/" as the separator, not "\\"`});let o=e.split("/");o.includes("")&&t.addIssue({code:"custom",message:`"${e}" must not have a trailing or doubled "/"`}),o.includes(".")&&t.addIssue({code:"custom",message:`"${e}" must not contain a "." segment; write it from the repository root, e.g. "vendor/configs"`})}),Le=i.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/,'must be kebab-case: a-z, 0-9 and inner "-"'),er=i.object({path:Ne,target:Ne.optional(),module:Le.optional()}).strict(),Ke=i.object({copy:i.array(er).min(1),exclude:i.array(i.string().regex(/^[^/\\]+$/,'must be a single path segment, without "/"')).optional()}).strict(),We=i.object({modules:i.array(Le)}).strict(),tr=i.object({requiredScripts:i.array(i.string().min(1)).optional(),requiredFiles:i.array(i.string().min(1)).optional(),turbo:i.object({requiredTasks:i.array(i.string().min(1)).optional()}).strict().optional()}).strict(),rr=i.string().regex(/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/,'must be a DNS label: a-z, 0-9 and inner "-", at most 63 characters'),or=i.string().min(1),nr=i.enum(["dev","main"]),re=1,se=i.object({$schema:i.string().optional(),configVersion:i.number().int().positive().optional(),envManagement:Ht,defaultEnv:or.optional(),worktrees:Xt.optional(),protectedEnvs:Yt.optional(),gitFlow:nr.optional(),mcp:Qt.optional(),vendorSource:Ke.nullable().optional(),vendorTarget:We.optional(),audit:tr.optional(),aliasRepo:rr.optional()}).strict(),ir=443,De=se,ne=se.partial(),Fe="two-columns",sr=e=>e.worktrees?.orca?.layout??Fe,f=null,E=null,Ve=()=>`${qt.cwd()} ${_e.homedir()}`,qe=()=>M.join(_e.homedir(),L),Ge=()=>M.join(qe(),Gt),Be=async()=>{let e=Ve();if(E&&E.key===e)return E.value;let t=await x(),r=await H(t),o=M.basename(r),n={main:M.join(t,Ae),userGlobal:Ge(),userProject:M.join(qe(),Bt,o,Ae),projectName:o};return E={key:e,value:n},n},ar=async(e={})=>{let t=e.autoMigrate??"write",r=Ve(),o=await Be(),n;try{n=await ie.stat(o.main)}catch{f=null;let _=o.main.replace(/\.json$/,".yml");throw await oe(_)?new Error(`infra-kit.json not found at ${o.main}. A legacy infra-kit.yml exists \u2014 run \`infra-kit setup --skip-tools\` to convert it.`):new Error(w()?`infra-kit.json not found at ${o.main} \u2014 the working directory is not an infra-kit project. Run infra-kit from inside an infra-kit project repo, or pass \`-C <dir>\` naming one.`:`infra-kit.json not found at ${o.main} \u2014 this git repo is not an infra-kit project. Run \`infra-kit setup --skip-tools\` here to create it, cd into an infra-kit project repo, or check out a branch that has infra-kit.json.`)}let[s,d]=await Promise.all([oe(o.userGlobal),oe(o.userProject)]),c={main:Number(n.mtimeMs),userGlobal:s?Number(s.mtimeMs):null,userProject:d?Number(d.mtimeMs):null};if(f&&f.key===r&&dr(f.mtimes,c))return f.value;let N=[{label:"infra-kit.json",path:o.main,required:!0,autoMigrate:t,mtimeMs:c.main},{label:"~/.infra-kit/infra-kit.json",path:o.userGlobal,required:!1,autoMigrate:t,mtimeMs:c.userGlobal},{label:`~/.infra-kit/projects/${o.projectName}/infra-kit.json`,path:o.userProject,required:!1,autoMigrate:t,mtimeMs:c.userProject}],l={};for(let _ of N){let ae=await pr(_);ae!==null&&(l={...l,...ae})}let C=De.safeParse(l);if(!C.success)throw new Error(`Invalid merged infra-kit config: ${i.prettifyError(C.error)}`);return f={key:r,mtimes:c,value:C.data},C.data},cr=()=>{f=null},mr=()=>{f=null,E=null},oe=async e=>{try{return await ie.stat(e)}catch{return null}},ur=async e=>{try{return await ie.readFile(e,"utf-8")}catch{return null}},dr=(e,t)=>{let r=Object.keys(e);return r.length!==Object.keys(t).length?!1:r.every(o=>e[o]===t[o])},ze=e=>new Error(`${e.message}
-A retired key on this branch \u2014 run \`infra-kit setup --skip-tools\` in this checkout and commit infra-kit.json.`),pr=async e=>{let t=await ur(e.path);if(t===null){if(e.required)throw new Error(`${e.label} not found at ${e.path}`);return null}let r;try{r=t.trim()===""?{}:JSON.parse(t)}catch(d){throw new Error(`Invalid JSON in ${e.label} at ${e.path}: ${d.message}`)}if(T(r)&&"envTokens"in r)throw new Error(br(e));!e.required&&T(r)&&xr(e,r),e.required&&T(r)&&Rr(r,e.path);let o=ne.safeParse(r);if(o.success)return o.data;let n=new Error(`Invalid ${e.label} at ${e.path}: ${i.prettifyError(o.error)}`);if(!T(r)||e.mtimeMs===null)throw n;let s=await te({...e,mtimeMs:e.mtimeMs},r,t,{schema:ne});switch(s.kind){case"migrated":return s.data;case"ci-gated":throw ze(n);case"not-applicable":throw n;default:return Y(s)}},lr=e=>[`"mcp" is not allowed in ${e.label} (${e.path}): it feeds the committed .mcp.json, so a per-machine copy would replace the project's servers for everyone.`,"Move the block to the project infra-kit.json and run `infra-kit setup`.","For a machine-only override of one server (e.g. a local fork), use Claude Code directly:","  claude mcp add --scope local <name> -- ik-mcp --name <name> --env <VAR> ... -- <command> <args>","(local scope shadows the project entry by name; `claude mcp list` will show a same-name conflict warning, which is expected)."].join(`
-`),gr=e=>[`"vendorSource" is not allowed in ${e.label} (${e.path}): only the committed project file may mark a repository as the \`vendor sync\` source. In the machine-wide file it would make every repository on this machine a source; in a per-project override it would make this machine disagree with every other clone.`,"Move the block to the source repository's own infra-kit.json and commit it there."].join(`
-`),fr=e=>[`"vendorTarget" is not allowed in ${e.label} (${e.path}): \`vendor sync\` reads it from the target repository's committed infra-kit.json only, so a per-machine copy would never be seen and would only make this clone disagree with the others.`,"Move the block to the target repository's own infra-kit.json and commit it there."].join(`
-`),hr=e=>[`"audit" is not allowed in ${e.label} (${e.path}): the root audit gates CI, so a per-machine copy would make this machine pass or fail a different check list than CI.`,"Move the block to the project infra-kit.json and commit it there."].join(`
-`),yr=e=>`"configVersion" is not allowed in ${e.label} (${e.path}): it versions the committed project file's shape, so a per-machine copy would describe nothing. Remove it from this file.`,wr=e=>[`"aliasRepo" is not allowed in ${e.label} (${e.path}): the vite and Playwright helpers read it from the project infra-kit.json only, so a per-machine copy would register a dev host they never aim at.`,"Move it to the project infra-kit.json and commit it there."].join(`
-`),kr=e=>[`"gitFlow" is not allowed in ${e.label} (${e.path}): it decides which branch every teammate's releases are cut from and delivered through, so a per-machine copy would ship this clone's releases down a different branch than everyone else's.`,"Move it to the project infra-kit.json and commit it there."].join(`
-`),vr={aliasRepo:wr,configVersion:yr,gitFlow:kr,mcp:lr,vendorSource:gr,vendorTarget:fr,audit:hr},Rr=(e,t)=>{let{configVersion:r}=e;if(!(typeof r!="number"||r<=re))throw new I({status:"refused",reason:"config-version-unsupported",configVersion:r,supportedConfigVersion:re,agentMode:S.source},2,{operation:"load infra-kit.json",remediation:"update the infra-kit CLI: `pnpm add -g infra-kit@<version>` with the version `pnpm view infra-kit version` prints, then re-run",stderrExcerpt:`${t} declares configVersion ${r}; this CLI reads up to ${re}`})},xr=(e,t)=>{for(let[r,o]of Object.entries(vr))if(r in t)throw new Error(o(e))},T=e=>typeof e=="object"&&e!==null&&!Array.isArray(e),br=e=>[`Refusing to load ${e.label} \u2014 \`envTokens\` is not a config key.`,"A service token in a config file can be committed, backed up by your editor, or shared.","  1. REVOKE the token in Doppler now \u2014 treat it as compromised.",`  2. Remove the \`envTokens\` key from ${e.path}.`,"  3. Re-add it privately: `infra-kit env-token-set <env>`","     (it is written to ~/.infra-kit/projects/<repo>/tokens.json, mode 0600, never to the repo)."].join(`
-`);export{R as a,rt as b,pe as c,S as d,w as e,nt as f,it as g,v as h,m as i,h as j,G as k,B as l,ut as m,dt as n,pt as o,lt as p,gt as q,ft as r,z as s,ht as t,ke as u,yt as v,x as w,H as x,ve as y,Re as z,vt as A,Rt as B,xt as C,bt as D,Et as E,Mt as F,Ct as G,St as H,Pt as I,be as J,jt as K,U as L,$t as M,It as N,Ot as O,D as P,Y as Q,Nt as R,X as S,Oe as T,O as U,A as V,Vt as W,I as X,Ke as Y,We as Z,se as _,ir as $,De as aa,ne as ba,sr as ca,Ge as da,Be as ea,ar as fa,cr as ga,mr as ha};
-//# sourceMappingURL=chunk-HMXEV7ZN.js.map