infra-kit 0.43.0 → 0.44.0

package/dist/{chunk-KA5BFUCS.js → chunk-3DAG53TI.js}

@@ -1,6 +1,6 @@
-import{a as c,c as v,d as m}from"./chunk-L4AFEAYF.js";import{ha as E,k as g,p}from"./chunk-JBQ5572P.js";import{Buffer as b}from"node:buffer";import K from"node:process";import{$ as d}from"zx";var y="Could not find requested project",N="Could not find requested config",h="Invalid Auth token",D="does not have access to requested config",a=e=>e.includes(h)||e.includes(D)?"auth":e.includes(y)?"project":e.includes(N)?"config":"unknown",u=e=>e.includes(D)?"mis-scoped":e.includes(h)?"revoked":null;var A=e=>[`Doppler rejected the service token for env "${e}" \u2014 it is invalid, revoked, or scoped to a different config.`,`Fix: run \`infra-kit env-token-set ${e}\` with a token scoped to that config.`,"CI / agents: set INFRA_KIT_ENV_TOKEN to a token scoped to that config."].join(`
+import{a as c,c as v,d as m}from"./chunk-NJ22P2UB.js";import{k as g,la as E,t as p}from"./chunk-DVMV3WJZ.js";import{Buffer as b}from"node:buffer";import K from"node:process";import{$ as d}from"zx";var y="Could not find requested project",N="Could not find requested config",h="Invalid Auth token",D="does not have access to requested config",a=e=>e.includes(h)||e.includes(D)?"auth":e.includes(y)?"project":e.includes(N)?"config":"unknown",u=e=>e.includes(D)?"mis-scoped":e.includes(h)?"revoked":null;var A=e=>[`Doppler rejected the service token for env "${e}" \u2014 it is invalid, revoked, or scoped to a different config.`,`Fix: run \`infra-kit env-token-set ${e}\` with a token scoped to that config.`,"CI / agents: set INFRA_KIT_ENV_TOKEN to a token scoped to that config."].join(`
 `),i=class extends c{authKind;constructor(r,t=null,o){super(o??A(r),r),this.name="DopplerAuthError",this.authKind=t}};var k=({kind:e,project:r,config:t,available:o})=>{let n=e==="project"?[`Doppler project "${r}" not found (set in infra-kit.json \u2192 envManagement.config.name).`]:[`Doppler config "${t}" not found in project "${r}".`];if(o&&o.length>0){let s=e==="project"?"Available projects":`Available configs in "${r}"`;n.push(`${s}: ${o.join(", ")}.`)}return n.push(e==="project"?"Fix: update envManagement.config.name to an existing project, or create it in Doppler.":"Fix: pass an existing config, or create it in Doppler."),n.join(`
 `)};import{$ as l}from"zx";var x=5e3,F="DOPPLER_CONFIG",w=async()=>{let{envManagement:e}=await E();return e.config.name},X=async({childEnv:e,project:r,config:t})=>{let o=l.quiet;l.quiet=!0;try{let s=(await l({env:e})`doppler secrets get ${F} --plain --project ${r} --config ${t}`.timeout(x)).stdout.trim();return s!==t?{outcome:"mis-scoped",scopedTo:s}:{outcome:"valid",scopedTo:s}}catch(n){return{outcome:R(n)}}finally{l.quiet=o}},R=e=>{let r=p(e)??(e instanceof Error?e.message:String(e));return a(r)!=="auth"?"unreachable":u(r)??"unreachable"};import $ from"node:process";var P="INFRA_KIT_ENV_TOKEN",O=async e=>{let r=$.env[P];if(r)return{token:r,source:"env"};let o=(await m())?.envs[e];if(o)return{token:o,source:"store"};throw new c(S(e,await v()),e)},S=(e,r)=>[`No Doppler service token for env "${e}".`,`Mint one at https://dashboard.doppler.com \u2014 this project \u2192 config "${e}" \u2192 Access tab \u2192 "Generate Service Token".`,`Fix: run \`infra-kit env-token-set ${e}\` and paste it.`,`It is stored in ${g(r)} (mode 0600, never in the repo).`,`CI / agents: set ${P} instead \u2014 it takes precedence and needs no home config.`].join(`
 `);var j="DOPPLER_CONFIG",T=1024*1024,M=3e4,I=["DOPPLER_TOKEN","DOPPLER_PROJECT","DOPPLER_CONFIG"],C=(e,r=K.env)=>{let t={...r};for(let o of I)delete t[o];return t.DOPPLER_TOKEN=e,t},de=async e=>new Map(await L(await w(),e)),L=async(e,r)=>{let{token:t}=await O(r),o=C(t),n=d.quiet;d.quiet=!0;try{let s;try{s=await d({env:o})`doppler secrets download --no-file --format json --project ${e} --config ${r}`.timeout(M)}catch(_){throw q(_,e,r)}V(s.stdout);let f=U(s.stdout);return J(f,r),f}finally{d.quiet=n}},J=(e,r)=>{let t=e.find(([o])=>o===j)?.[1];if(!(t===void 0||t===r))throw new i(r,null,`Doppler returned secrets for config "${t}" but "${r}" was requested \u2014 the service token for env "${r}" is scoped to the wrong config. Refusing to load another environment's secrets.
 Fix: run \`infra-kit env-token-set ${r}\` with a token scoped to "${r}".`)},q=(e,r,t)=>{let o=p(e)??(e instanceof Error?e.message:String(e)),n=a(o);return n==="auth"?new i(t,u(o)):n==="unknown"?e instanceof Error?e:new Error(String(e)):new Error(k({kind:n,project:r,config:t,available:null}))},V=e=>{let r=b.byteLength(e,"utf-8");if(r>T)throw new Error(`doppler returned unexpectedly large output (${r} bytes > ${T}) \u2014 refusing to write to disk`)},G=/^[A-Z_]\w*$/i,U=e=>{let r;try{r=JSON.parse(e)}catch{throw new Error(`doppler returned non-JSON output for env-load (got: ${JSON.stringify(e.slice(0,80))})`)}if(r===null||typeof r!="object"||Array.isArray(r))throw new Error("doppler returned unexpected JSON shape for env-load (expected an object of KEY: value pairs)");let t=[];for(let[o,n]of Object.entries(r)){if(!G.test(o))throw new Error(`doppler returned an invalid env var name for env-load (got: ${JSON.stringify(o.slice(0,80))})`);if(typeof n!="string")throw new TypeError(`doppler returned a non-string value for "${o}" (got ${typeof n})`);t.push([o,n])}if(t.length===0)throw new Error("doppler returned empty output for env-load");return t};export{a,u as b,w as c,X as d,P as e,O as f,T as g,C as h,de as i,L as j,J as k,q as l,V as m,U as n};
-//# sourceMappingURL=chunk-KA5BFUCS.js.map
+//# sourceMappingURL=chunk-3DAG53TI.js.map

package/dist/{chunk-KA5BFUCS.js.map → chunk-3DAG53TI.js.map}

@@ -2,6 +2,6 @@
   "version": 3,
   "sources": ["../src/integrations/doppler/secrets-download.ts", "../src/integrations/doppler/doppler-errors.ts", "../src/integrations/doppler/doppler-project.ts", "../src/integrations/doppler/token-resolver.ts"],
   "sourcesContent": ["import { Buffer } from 'node:buffer'\nimport process from 'node:process'\nimport { $ } from 'zx'\n\nimport { extractStderr } from 'src/lib/errors/operation-error'\n\nimport {\n  DopplerAuthError,\n  buildDopplerNotFoundMessage,\n  classifyDopplerAuthFailure,\n  classifyDopplerFailure,\n} from './doppler-errors'\nimport { getDopplerProject } from './doppler-project'\nimport { resolveEnvToken } from './token-resolver'\n\n/** The payload key that carries the token's scope \u2014 the one {@link assertTokenScope} compares. */\nconst DOPPLER_CONFIG_KEY = 'DOPPLER_CONFIG'\n\n/**\n * Cap the Doppler stdout we're willing to accept. A well-formed env bundle is\n * O(10 KB); megabytes would indicate a service regression or the wrong stream\n * being captured, and we don't want to write that to disk or source it.\n */\nexport const DOPPLER_MAX_OUTPUT_BYTES = 1024 * 1024\n\n/**\n * Hard upper bound for the Doppler subprocess. Well under zx's default so a\n * hung call surfaces quickly instead of blocking an interactive shell.\n */\nconst DOPPLER_DOWNLOAD_TIMEOUT_MS = 30_000\n\n/**\n * Doppler env vars we refuse to inherit into the download child. SPIKE-0 Q5: an inherited\n * `DOPPLER_TOKEN` OVERRIDES everything else the CLI would use \u2014 and `env-load` itself exports a whole\n * Doppler project into the shell, so a project that happens to hold a secret named `DOPPLER_TOKEN`\n * would silently hijack the NEXT download. `DOPPLER_PROJECT` / `DOPPLER_CONFIG` are scrubbed for the\n * same reason: they are the payload's own scope evidence, and an inherited copy could shadow the\n * `--project` / `--config` we pass in argv.\n */\nconst INHERITED_DOPPLER_VARS = ['DOPPLER_TOKEN', 'DOPPLER_PROJECT', 'DOPPLER_CONFIG'] as const\n\n/**\n * The child environment for `doppler secrets download`: the caller's env with the inherited Doppler\n * vars scrubbed and OUR resolved token set explicitly.\n *\n * The token travels by ENV, never by argv: `ps` shows argv to every user on the box, and\n * `commandEcho` prints option values back to the terminal. Pure (takes the base env) so the scrub is\n * unit-testable without touching `process.env`.\n *\n * @example\n * buildDopplerChildEnv('dp.st.x', { PATH: '/bin', DOPPLER_CONFIG: 'prod' })\n * // => { PATH: '/bin', DOPPLER_TOKEN: 'dp.st.x' }   (DOPPLER_CONFIG dropped)\n */\nexport const buildDopplerChildEnv = (token: string, baseEnv: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv => {\n  const childEnv: NodeJS.ProcessEnv = { ...baseEnv }\n\n  for (const name of INHERITED_DOPPLER_VARS) {\n    delete childEnv[name]\n  }\n\n  childEnv.DOPPLER_TOKEN = token\n\n  return childEnv\n}\n\n/**\n * One Doppler config's secrets, downloaded with the token stored for it \u2014 `env-load`'s own fetch, for a\n * caller that needs a few values of an env without loading the whole env into a shell.\n */\nexport const downloadEnvSecrets = async (config: string): Promise<Map<string, string>> => {\n  return new Map(await downloadDopplerSecrets(await getDopplerProject(), config))\n}\n\nexport const downloadDopplerSecrets = async (project: string, config: string): Promise<Array<[string, string]>> => {\n  const { token } = await resolveEnvToken(config)\n\n  const childEnv = buildDopplerChildEnv(token)\n\n  const prevQuiet = $.quiet\n\n  $.quiet = true\n  try {\n    let result\n\n    try {\n      result = await $({\n        env: childEnv,\n      })`doppler secrets download --no-file --format json --project ${project} --config ${config}`.timeout(\n        DOPPLER_DOWNLOAD_TIMEOUT_MS,\n      )\n    } catch (error: unknown) {\n      throw translateDopplerDownloadError(error, project, config)\n    }\n\n    assertDopplerOutputSize(result.stdout)\n\n    const pairs = parseDopplerSecretsJson(result.stdout)\n\n    assertTokenScope(pairs, config)\n\n    return pairs\n  } finally {\n    $.quiet = prevQuiet\n  }\n}\n\n/**\n * Defense in depth against a MIS-SCOPED token: the payload always carries `DOPPLER_CONFIG` as an\n * ordinary secret, and it echoes the `--config` we asked for (SPIKE-0 Q2 \u2014 it is the CONFIG, not\n * `DOPPLER_ENVIRONMENT`, which can differ: config `dev_personal` lives in environment `dev`).\n *\n * ABSENT \u21D2 PROCEED, deliberately. The Doppler CLI already refuses a real mismatch on the wire\n * (SPIKE-0 Q1: exit 1, \"does not have access to requested config\"), so it \u2014 not this \u2014 is the\n * load-bearing guard. An absent `DOPPLER_CONFIG` therefore means Doppler changed what it injects,\n * and failing closed here would blank every developer's shell at once.\n *\n * @example\n * assertTokenScope([['DOPPLER_CONFIG', 'dev']], 'dev')   // ok\n * assertTokenScope([['FOO', 'bar']], 'dev')              // ok (absent \u21D2 proceed)\n * assertTokenScope([['DOPPLER_CONFIG', 'prod']], 'dev')  // throws: token is scoped to \"prod\"\n */\nexport const assertTokenScope = (pairs: Array<[string, string]>, config: string): void => {\n  const actual = pairs.find(([key]) => {\n    return key === DOPPLER_CONFIG_KEY\n  })?.[1]\n\n  if (actual === undefined || actual === config) return\n\n  // A DopplerAuthError, not a plain Error: this IS an auth failure, and callers classify by TYPE\n  // (`isEnvAuthFailure`), so a plain Error would read as transient. The message stays richer than the\n  // generic one: we know the token's real config.\n  throw new DopplerAuthError(\n    config,\n    null,\n    `Doppler returned secrets for config \"${actual}\" but \"${config}\" was requested \u2014 the service token for ` +\n      `env \"${config}\" is scoped to the wrong config. Refusing to load another environment's secrets.\\n` +\n      `Fix: run \\`infra-kit env-token-set ${config}\\` with a token scoped to \"${config}\".`,\n  )\n}\n\n/**\n * Turn a raw `doppler secrets download` failure into an actionable error. An AUTH-class failure (the\n * token is invalid, revoked, or mis-scoped) becomes a {@link DopplerAuthError} carrying the\n * env-token-set message; a recognized project/config not-found points at the exact infra-kit.json\n * field. Anything else \u2014 network, timeout \u2014 is rethrown untouched so it degrades to the existing\n * behavior, never worse.\n *\n * This is THE boundary where Doppler's raw stderr is read: the markers exist only here, and the\n * classification leaves as a TYPE (`DopplerAuthError`), never as prose for a downstream module to\n * re-parse. Exported so a seam test can drive the REAL error a caller sees.\n *\n * @example\n * translateDopplerDownloadError({ stderr: 'Doppler Error: Invalid Auth token' }, 'p', 'dev')\n * // => DopplerAuthError { authKind: 'revoked', message: '\u2026 `infra-kit env-token-set <env>` \u2026' }\n * translateDopplerDownloadError(new Error('connect ETIMEDOUT'), 'p', 'dev')\n * // => the same Error, untouched\n */\n// Why a type and not prose: a caller that text-matched the raw Doppler markers on the error this\n// function had already rewritten found them long gone, and a revoked token went silent.\n//\n// The not-found message no longer lists the AVAILABLE names: `listDopplerProjects` /\n// `listDopplerConfigs` require an ACCOUNT login, which token-only auth deleted, so that probe\n// could only ever return `null` now. `buildDopplerNotFoundMessage` already treats `null` as\n// \"couldn't tell\" and omits the suggestion line rather than misreporting \"none exist\".\nexport const translateDopplerDownloadError = (error: unknown, project: string, config: string): Error => {\n  const stderr = extractStderr(error) ?? (error instanceof Error ? error.message : String(error))\n  const kind = classifyDopplerFailure(stderr)\n\n  if (kind === 'auth') return new DopplerAuthError(config, classifyDopplerAuthFailure(stderr))\n\n  if (kind === 'unknown') return error instanceof Error ? error : new Error(String(error))\n\n  return new Error(buildDopplerNotFoundMessage({ kind, project, config, available: null }))\n}\n\nexport const assertDopplerOutputSize = (stdout: string): void => {\n  const bytes = Buffer.byteLength(stdout, 'utf-8')\n\n  if (bytes > DOPPLER_MAX_OUTPUT_BYTES) {\n    throw new Error(\n      `doppler returned unexpectedly large output (${bytes} bytes > ${DOPPLER_MAX_OUTPUT_BYTES}) \u2014 refusing to write to disk`,\n    )\n  }\n}\n\n/** A valid POSIX env-var name: a letter or underscore, then word characters. */\nconst ENV_VAR_NAME_PATTERN = /^[A-Z_]\\w*$/i\n\n/**\n * Parse the `doppler secrets download --format json` output (a flat\n * `{\"KEY\":\"value\"}` map) into ordered `[key, value]` pairs, validating the shape\n * and every name/value. Values are returned RAW \u2014 callers must single-quote them\n * before emitting shell (an unquoted `a$(cmd)b` would execute on `source`).\n *\n * @example\n * parseDopplerSecretsJson('{\"FOO\":\"bar\",\"BAZ\":\"a$(x)\"}')\n * // => [['FOO', 'bar'], ['BAZ', 'a$(x)']]\n */\nexport const parseDopplerSecretsJson = (stdout: string): Array<[string, string]> => {\n  let parsed: unknown\n\n  try {\n    parsed = JSON.parse(stdout)\n  } catch {\n    throw new Error(`doppler returned non-JSON output for env-load (got: ${JSON.stringify(stdout.slice(0, 80))})`)\n  }\n\n  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {\n    throw new Error('doppler returned unexpected JSON shape for env-load (expected an object of KEY: value pairs)')\n  }\n\n  const pairs: Array<[string, string]> = []\n\n  for (const [key, value] of Object.entries(parsed)) {\n    if (!ENV_VAR_NAME_PATTERN.test(key)) {\n      throw new Error(\n        `doppler returned an invalid env var name for env-load (got: ${JSON.stringify(key.slice(0, 80))})`,\n      )\n    }\n\n    if (typeof value !== 'string') {\n      throw new TypeError(`doppler returned a non-string value for \"${key}\" (got ${typeof value})`)\n    }\n\n    pairs.push([key, value])\n  }\n\n  if (pairs.length === 0) {\n    throw new Error('doppler returned empty output for env-load')\n  }\n\n  return pairs\n}\n", "/**\n * @fileoverview\n *\n * Translate Doppler `secrets download` not-found failures into actionable,\n * point-at-the-fix guidance. Pure (no I/O) so the classification + message policy\n * is unit-testable without spawning the Doppler CLI \u2014 mirroring the pure-helper\n * pattern in `./secrets-download.ts`.\n *\n * Observed Doppler output on a not-found download (verified 2026-06-27, doppler\n * v3.76.0), exit 1, written to STDERR (stdout empty):\n *   Unable to download secrets\n *   Doppler Error: Could not find requested project 'name'\n *   Doppler Error: Could not find requested config 'name'\n * Only the \"Doppler Error:\" prefix is ANSI-colored; the \"Could not find requested\n * ...\" text is plain, so substring matching is color-safe. zx's\n * `ProcessOutput.message` also concatenates stdout+stderr, so the same markers are\n * matchable off `.message` when `.stderr` is unavailable.\n */\nimport { EnvAuthError } from 'src/lib/errors/env-auth-error'\n\n/** Which kind of Doppler not-found a download failure represents (`unknown` = not a not-found error). */\nexport type DopplerNotFoundKind = 'project' | 'config' | 'unknown'\n\n/**\n * Every class of `secrets download` failure we act on. `'auth'` is the token-only addition: the\n * service token is absent, revoked, garbage, or scoped to a DIFFERENT config. It is deliberately\n * distinct from the not-found kinds (the name is wrong) and from `'unknown'` (network, timeout,\n * Doppler down) \u2014 only `'auth'` is a durable, user-fixable state.\n */\nexport type DopplerFailureKind = 'auth' | DopplerNotFoundKind\n\nconst PROJECT_NOT_FOUND_MARKER = 'Could not find requested project'\nconst CONFIG_NOT_FOUND_MARKER = 'Could not find requested config'\n\n/**\n * The REAL auth-class stderr markers, captured from a live Doppler CLI v3.76.0 (SPIKE-0 Q1/Q4):\n *   - `Invalid Auth token`                                       \u2014 revoked / garbage token\n *   - `This token does not have access to requested config 'x'`  \u2014 mis-scoped token\n * Both are plain (uncolored) text, so substring matching is ANSI-safe. The second one is the CLI\n * ENFORCING the token's scope for us \u2014 it is the primary mis-scope guard, not our payload assert.\n */\nconst INVALID_TOKEN_MARKER = 'Invalid Auth token'\nconst TOKEN_SCOPE_MARKER = 'does not have access to requested config'\n\n/**\n * Classify a Doppler `secrets download` failure from its stderr/message text. The full lattice:\n * auth-class first (a mis-scoped token's message names a config but is NOT a not-found), then the\n * two not-found kinds, then `'unknown'` for everything else so the caller can rethrow the original\n * untouched (degrades to status quo, never worse).\n *\n * @example\n * classifyDopplerFailure('Doppler Error: Invalid Auth token')                            // => 'auth'\n * classifyDopplerFailure(\"This token does not have access to requested config 'dev'\")    // => 'auth'\n * classifyDopplerFailure(\"Doppler Error: Could not find requested project 'x'\")          // => 'project'\n * classifyDopplerFailure('connect ETIMEDOUT')                                            // => 'unknown'\n */\nexport const classifyDopplerFailure = (stderr: string): DopplerFailureKind => {\n  if (stderr.includes(INVALID_TOKEN_MARKER) || stderr.includes(TOKEN_SCOPE_MARKER)) return 'auth'\n\n  if (stderr.includes(PROJECT_NOT_FOUND_MARKER)) return 'project'\n\n  if (stderr.includes(CONFIG_NOT_FOUND_MARKER)) return 'config'\n\n  return 'unknown'\n}\n\n/**\n * The two auth-class failures, told apart. Both are `'auth'` to\n * {@link classifyDopplerFailure} \u2014 they share one fix (a new token) \u2014 but they are DIFFERENT\n * diagnoses, and `doctor` must not conflate them: \"your token was revoked\" sends a user to the\n * Doppler dashboard, \"your token is scoped to the wrong config\" sends them to re-issue it against\n * the right one.\n */\nexport type DopplerAuthKind = 'revoked' | 'mis-scoped'\n\n/**\n * Split an auth-class failure into its two diagnoses, or `null` when the text is not auth-class at\n * all (network, timeout, not-found) \u2014 the caller must not read `null` as \"the token is fine\", only\n * as \"this failure says nothing about the token\".\n *\n * @example\n * classifyDopplerAuthFailure(\"This token does not have access to requested config 'dev'\") // => 'mis-scoped'\n * classifyDopplerAuthFailure('Doppler Error: Invalid Auth token')                         // => 'revoked'\n * classifyDopplerAuthFailure('connect ETIMEDOUT')                                         // => null\n */\nexport const classifyDopplerAuthFailure = (stderr: string): DopplerAuthKind | null => {\n  if (stderr.includes(TOKEN_SCOPE_MARKER)) return 'mis-scoped'\n\n  if (stderr.includes(INVALID_TOKEN_MARKER)) return 'revoked'\n\n  return null\n}\n\n/**\n * Is this failure text an auth-class Doppler failure (bad / absent / mis-scoped service token)\n * rather than a transient one (network, timeout, Doppler down)? The single source of truth\n * callers classify on.\n *\n * @example\n * isDopplerAuthFailure('Doppler Error: Invalid Auth token') // => true\n * isDopplerAuthFailure('network unreachable')               // => false\n */\nexport const isDopplerAuthFailure = (stderr: string): boolean => {\n  return classifyDopplerFailure(stderr) === 'auth'\n}\n\n/**\n * Classify a Doppler download failure into the NOT-FOUND lattice only. Auth-class failures collapse\n * to `'unknown'` here on purpose: this predicate's whole contract is \"is this a wrong-NAME error\",\n * and its callers enrich with project/config listings that an auth failure must never trigger. Use\n * {@link classifyDopplerFailure} when you need the full lattice.\n *\n * @example\n * classifyDopplerDownloadError(\"Doppler Error: Could not find requested project 'x'\") // => 'project'\n * classifyDopplerDownloadError(\"Doppler Error: Could not find requested config 'dev'\") // => 'config'\n * classifyDopplerDownloadError('Doppler Error: Invalid Auth token')                    // => 'unknown'\n */\nexport const classifyDopplerDownloadError = (stderr: string): DopplerNotFoundKind => {\n  const kind = classifyDopplerFailure(stderr)\n\n  return kind === 'auth' ? 'unknown' : kind\n}\n\n/**\n * The actionable body for an auth-class download failure: Doppler REFUSED the token we sent, so the\n * fix is always a new token for this env \u2014 never `doppler login` (account auth no longer exists).\n *\n * Deliberately does not interpolate the raw stderr: this message is user-facing, and the one rule a\n * credential path cannot bend is that nothing token-adjacent gets rendered by accident.\n *\n * @example\n * buildDopplerAuthFailureMessage('dev')\n * // => 'Doppler rejected the service token for env \"dev\" \u2026 run `infra-kit env-token-set <env>` \u2026'\n */\nexport const buildDopplerAuthFailureMessage = (env: string): string => {\n  return [\n    `Doppler rejected the service token for env \"${env}\" \u2014 it is invalid, revoked, or scoped to a different config.`,\n    `Fix: run \\`infra-kit env-token-set ${env}\\` with a token scoped to that config.`,\n    'CI / agents: set INFRA_KIT_ENV_TOKEN to a token scoped to that config.',\n  ].join('\\n')\n}\n\n/**\n * An auth-class `secrets download` failure, as a TYPE rather than a string. This is the error\n * `env-load`'s `translateDopplerDownloadError` throws for the auth class, and it is what every\n * DOWNSTREAM consumer classifies on.\n *\n * It is the DOPPLER-REFUSED-US subset of {@link EnvAuthError}, the durable/user-fixable env-auth\n * class. Downstream policy therefore classifies on `isEnvAuthFailure`; `isDopplerAuthError`\n * remains for the callers who genuinely mean \"the token was SENT and Doppler\n * rejected it\". The message is unchanged \u2014 {@link buildDopplerAuthFailureMessage} still renders\n * it \u2014 so a human who only ever sees `error.message` sees precisely what they saw before.\n *\n * @example\n * throw new DopplerAuthError('dev', 'revoked')\n * // message: 'Doppler rejected the service token for env \"dev\" \u2026 `infra-kit env-token-set <env>` \u2026'\n */\n// WHY a class and not \"match the message\": the moment the raw Doppler stderr is translated into a\n// human-facing message the markers it was classified by are GONE. A consumer that re-derives the\n// class by re-parsing that message is coupled to prose owned by another module \u2014 and the coupling\n// is SILENT: reword the message and the auth channel simply stops firing, with every unit test on\n// both sides still green (exactly the defect this type exists to make impossible). The\n// classification now travels WITH the error.\n//\n// Why the subset framing: a missing token never reaches Doppler, and a corrupt token store never\n// reaches the resolver, yet all three are equally durable and equally the user's to fix.\n//\n// The @example names the command as `infra-kit env-token-set <env>` rather than with a literal arg\n// for `program.test.ts`'s benefit: to that scan an `<env>` placeholder ENDS the command, but a\n// literal `dev` is indistinguishable from a subcommand and would be reported as a dead one.\nexport class DopplerAuthError extends EnvAuthError {\n  /**\n   * The env (= Doppler config) whose service token Doppler refused. Names the fix, carries no token.\n   *\n   * `declare` NARROWS the base's `string | null` (a Doppler refusal always names one env) without\n   * re-declaring the field: under `useDefineForClassFields` a real re-declaration would `defineProperty`\n   * it back to `undefined` AFTER `super()` had set it.\n   */\n  declare readonly env: string\n  /**\n   * Which of the two auth diagnoses the raw stderr indicated, or `null` when it was not stated\n   * (e.g. the payload-scope assert, which never sees Doppler's stderr). Diagnostic only \u2014 every\n   * auth kind shares one fix.\n   */\n  readonly authKind: DopplerAuthKind | null\n\n  /**\n   * `message` overrides the rendered text for a caller that knows MORE than the generic diagnosis \u2014\n   * the payload-scope assert can name the config the token actually belongs to, which Doppler's own\n   * refusal cannot. It never changes the CLASS: every auth failure must remain type-detectable, or it\n   * degrades to the transient 30s marker and the user is never told (the defect this type exists to\n   * make impossible).\n   */\n  constructor(env: string, authKind: DopplerAuthKind | null = null, message?: string) {\n    super(message ?? buildDopplerAuthFailureMessage(env), env)\n    this.name = 'DopplerAuthError'\n    this.authKind = authKind\n  }\n}\n\n/**\n * The NARROW type guard: \"we sent Doppler a token and Doppler refused it\". Not text-matching \u2014 that\n * is how a caller asks \"was this the token?\" without re-parsing a rendered message.\n *\n * Use {@link isEnvAuthFailure} instead when the question is the POLICY one \u2014 \"is this durable and the\n * user's to fix?\" \u2014 because a missing token and a corrupt token store are both of those and neither is\n * a Doppler refusal; narrowing policy to this guard silently drops both cases.\n *\n * @example\n * isDopplerAuthError(new DopplerAuthError('dev'))                   // => true\n * isDopplerAuthError(new Error('Doppler Error: Invalid Auth token')) // => false (untranslated: not ours to claim)\n */\nexport const isDopplerAuthError = (error: unknown): error is DopplerAuthError => {\n  return error instanceof DopplerAuthError\n}\n\ninterface DopplerNotFoundMessageArgs {\n  /** Whether the missing entity is the project or the config within it. */\n  kind: 'project' | 'config'\n  project: string\n  config: string\n  /**\n   * Names to suggest. `null` = lookup failed/unavailable, `[]` = none exist; both\n   * omit the suggestion line so a failed enrichment probe is never misreported as\n   * a definitive \"none available\".\n   */\n  available?: string[] | null\n}\n\n/**\n * Build the actionable, multi-line error body for a Doppler not-found failure:\n * states what's missing, points at the exact infra-kit.json field, lists available\n * names when known, and gives a concrete fix.\n *\n * @example\n * buildDopplerNotFoundMessage({ kind: 'project', project: 'infra-kit', config: 'dev', available: ['nomadream'] })\n * // => 'Doppler project \"infra-kit\" not found (set in infra-kit.json \u2192 envManagement.config.name).\\nAvailable projects: nomadream.\\nFix: ...'\n */\nexport const buildDopplerNotFoundMessage = ({\n  kind,\n  project,\n  config,\n  available,\n}: DopplerNotFoundMessageArgs): string => {\n  const lines: string[] =\n    kind === 'project'\n      ? [`Doppler project \"${project}\" not found (set in infra-kit.json \u2192 envManagement.config.name).`]\n      : [`Doppler config \"${config}\" not found in project \"${project}\".`]\n\n  if (available && available.length > 0) {\n    const label = kind === 'project' ? 'Available projects' : `Available configs in \"${project}\"`\n\n    lines.push(`${label}: ${available.join(', ')}.`)\n  }\n\n  // The config half no longer points at a config file: there IS no declared env list any more. The name\n  // came from a workflow, a token, or the `--config` flag, and the only place to fix a genuinely missing\n  // one is Doppler itself.\n  lines.push(\n    kind === 'project'\n      ? 'Fix: update envManagement.config.name to an existing project, or create it in Doppler.'\n      : 'Fix: pass an existing config, or create it in Doppler.',\n  )\n\n  return lines.join('\\n')\n}\n", "import { $ } from 'zx'\n\nimport { classifyDopplerAuthFailure, classifyDopplerFailure } from 'src/integrations/doppler/doppler-errors'\nimport { extractStderr } from 'src/lib/errors/operation-error'\nimport { getInfraKitConfig } from 'src/lib/infra-kit-config'\n\n/**\n * Hard upper bound for the Doppler probe. It runs only on the diagnostic path (`doctor`), but a hung\n * VPN/connection must not stall it.\n */\nconst DOPPLER_PROBE_TIMEOUT_MS = 5_000\n\n/**\n * The one secret every Doppler payload carries, whose value is the config the token is scoped to\n * (SPIKE-0 Q2 \u2014 the CONFIG, not `DOPPLER_ENVIRONMENT`, which can differ: config `dev_personal` lives\n * in environment `dev`). Reading it back is what turns a liveness probe into a SCOPE probe.\n */\nconst SCOPE_KEY = 'DOPPLER_CONFIG'\n\n/**\n * Resolve Doppler project name from infra-kit.json at the project root\n */\nexport const getDopplerProject = async (): Promise<string> => {\n  const { envManagement } = await getInfraKitConfig()\n\n  return envManagement.config.name\n}\n\n/**\n * What a service token turned out to be, once Doppler was asked.\n *\n * `'unreachable'` is the load-bearing one and it means \"COULDN'T TELL\", never \"bad\": network,\n * timeout, VPN, Doppler down, a CLI that isn't installed. A caller that renders it as a definitive\n * verdict would tell a developer on a plane that their token was revoked. (Same `null`-vs-`[]`\n * contract the deleted `listDopplerProjects` carried, in enum form.)\n */\nexport type EnvTokenProbeOutcome = 'valid' | 'revoked' | 'mis-scoped' | 'unreachable'\n\nexport interface EnvTokenProbe {\n  outcome: EnvTokenProbeOutcome\n  /** The config the token actually resolved to, when Doppler told us. Never a token value. */\n  scopedTo?: string\n}\n\ninterface EnvTokenProbeArgs {\n  /**\n   * The child environment carrying the token \u2014 built by `buildDopplerChildEnv`, which scrubs the\n   * inherited `DOPPLER_*` vars and sets ours. Passed in rather than built here so the token travels\n   * by ENV and never by argv (`ps` shows argv to every user on the box).\n   */\n  childEnv: NodeJS.ProcessEnv\n  project: string\n  config: string\n}\n\n/**\n * The cheapest combined VALIDITY + SCOPE probe of a Doppler service token (SPIKE-0): read one secret\n * back \u2014 the payload's own `DOPPLER_CONFIG` \u2014 and compare it to the config we asked for.\n *\n * `doppler me` is NOT enough: it works under a service token but returns no project/config, so it can\n * only prove the token is alive, never that it points where we think. One `secrets get` answers both\n * questions in one round trip, and the CLI enforces the scope for us on the wire.\n *\n * Never throws. Every failure becomes an outcome, and an unrecognized one becomes `'unreachable'`\n * (\"couldn't tell\") rather than a guess \u2014 the caller is `doctor`, whose whole value is that its\n * verdicts are true.\n *\n * @example\n * await probeEnvToken({ childEnv, project: 'api', config: 'dev' })\n * // => { outcome: 'valid', scopedTo: 'dev' }\n * // revoked token   => { outcome: 'revoked' }\n * // token for prod  => { outcome: 'mis-scoped' }\n * // offline         => { outcome: 'unreachable' }\n */\nexport const probeEnvToken = async ({ childEnv, project, config }: EnvTokenProbeArgs): Promise<EnvTokenProbe> => {\n  const prevQuiet = $.quiet\n\n  $.quiet = true\n  try {\n    const result = await $({\n      env: childEnv,\n    })`doppler secrets get ${SCOPE_KEY} --plain --project ${project} --config ${config}`.timeout(\n      DOPPLER_PROBE_TIMEOUT_MS,\n    )\n\n    const scopedTo = result.stdout.trim()\n\n    // Exit 0 with a DIFFERENT config would mean the CLI's own scope enforcement let a mis-scoped token\n    // through \u2014 belt and braces, but this is the check that would catch it.\n    if (scopedTo !== config) return { outcome: 'mis-scoped', scopedTo }\n\n    return { outcome: 'valid', scopedTo }\n  } catch (error: unknown) {\n    return { outcome: classifyProbeFailure(error) }\n  } finally {\n    $.quiet = prevQuiet\n  }\n}\n\n/**\n * Turn a failed probe into an outcome. Only the two auth-class markers are definitive; a\n * project/config not-found is a config bug rather than a token verdict, so it collapses to\n * `'unreachable'` too \u2014 the token check must not claim a token is bad because the PROJECT name is.\n */\nconst classifyProbeFailure = (error: unknown): EnvTokenProbeOutcome => {\n  const stderr = extractStderr(error) ?? (error instanceof Error ? error.message : String(error))\n\n  if (classifyDopplerFailure(stderr) !== 'auth') return 'unreachable'\n\n  return classifyDopplerAuthFailure(stderr) ?? 'unreachable'\n}\n", "import process from 'node:process'\n\nimport { getTokenStorePath, readTokenStore } from 'src/lib/env-tokens'\nimport { EnvAuthError } from 'src/lib/errors/env-auth-error'\nimport { tildify } from 'src/lib/path-display'\n\n/**\n * The ONE environment variable that carries a Doppler service token into infra-kit (the CI / agent\n * path: no home directory, no token store, no interactive `env-token-set`).\n *\n * Deliberately NOT named `DOPPLER_TOKEN`. That name is contaminated on both ends: a Doppler project\n * may itself hold a secret called `DOPPLER_TOKEN`, and `env-load` exports the WHOLE project into the\n * shell \u2014 so a `DOPPLER_TOKEN` in the environment cannot be trusted to be the token WE were handed\n * (SPIKE-0 Q5: an inherited `DOPPLER_TOKEN` silently overrides everything else the CLI would use).\n * A private name keeps the input channel ours.\n */\nexport const INFRA_KIT_ENV_TOKEN_VAR = 'INFRA_KIT_ENV_TOKEN'\n\n/** Where a resolved token came from. Surfaced by `env-token-list`; never carries the token itself. */\nexport type EnvTokenSource = 'env' | 'store'\n\nexport interface ResolvedEnvToken {\n  /** The Doppler service token. NEVER log, echo, or write this into a sourced file. */\n  token: string\n  source: EnvTokenSource\n}\n\n/**\n * Resolve the Doppler service token for one environment (= one Doppler config).\n *\n * Precedence, highest first:\n *  1. `INFRA_KIT_ENV_TOKEN` \u2014 the CI / agent channel. Checked BEFORE the store so a machine with no\n *     home config (or a deliberately corrupted one) still loads, and so nothing on that path can\n *     throw on a store it never needed.\n *  2. `envs[env]` from `~/.infra-kit/projects/<repo>/tokens.json` \u2014 the developer channel.\n *  3. Nothing \u21D2 THROW an {@link EnvAuthError}. Token-only auth has no fallback: there is no\n *     `doppler login` account to degrade to, so a missing token is a hard, actionable stop rather than\n *     a mysterious empty env. The CLASS matters as much as the message \u2014 see the throw below.\n *\n * An EMPTY `INFRA_KIT_ENV_TOKEN` is a MISS, not an empty token: `export INFRA_KIT_ENV_TOKEN=` (or an\n * unset var expanded by a CI template) must fall through to the store, not authenticate as \"\".\n *\n * @example\n * await resolveEnvToken('dev') // => { token: 'dp.st.dev.xxxx', source: 'store' }\n * // with INFRA_KIT_ENV_TOKEN set => { token: <that value>, source: 'env' }\n * // with neither                 => throws 'No Doppler service token for env \"dev\". \u2026'\n */\nexport const resolveEnvToken = async (env: string): Promise<ResolvedEnvToken> => {\n  const fromEnv = process.env[INFRA_KIT_ENV_TOKEN_VAR]\n\n  if (fromEnv) return { token: fromEnv, source: 'env' }\n\n  const store = await readTokenStore()\n  const fromStore = store?.envs[env]\n\n  if (fromStore) return { token: fromStore, source: 'store' }\n\n  // An EnvAuthError, not a plain Error: \"no token\" is the DURABLE, user-fixable auth failure \u2014 see\n  // EnvAuthError's own doc for why the class, not the message, is what downstream callers classify on.\n  throw new EnvAuthError(buildMissingTokenMessage(env, await getTokenStorePath()), env)\n}\n\n/**\n * The no-token refusal. It is the first thing an un-migrated user sees at update time, so it must be\n * fixable without reading any docs: it names the env, where to mint a token, the exact command, where\n * the token lands (and that it is NOT the repo), and the CI escape hatch.\n *\n * The fix command is a BACKTICK code span \u2014 the repo convention for naming a command to a human, and\n * the anchor `program.test.ts` scans to prove every command we print is a command we accept.\n *\n * (The @example names the command as `infra-kit env-token-set <env>` rather than with a literal arg\n * for that scan's benefit: a `<env>` placeholder ENDS the command, but a literal `dev` is\n * indistinguishable from a subcommand and would be reported as a dead one.)\n *\n * @example\n * buildMissingTokenMessage('dev', '/Users/x/.infra-kit/projects/api/tokens.json')\n * // => 'No Doppler service token for env \"dev\". Mint one at https://dashboard.doppler.com \u2026 run `infra-kit env-token-set <env>` \u2026'\n */\nconst buildMissingTokenMessage = (env: string, storePath: string): string => {\n  return [\n    `No Doppler service token for env \"${env}\".`,\n    `Mint one at https://dashboard.doppler.com \u2014 this project \u2192 config \"${env}\" \u2192 Access tab \u2192 \"Generate Service Token\".`,\n    `Fix: run \\`infra-kit env-token-set ${env}\\` and paste it.`,\n    `It is stored in ${tildify(storePath)} (mode 0600, never in the repo).`,\n    `CI / agents: set ${INFRA_KIT_ENV_TOKEN_VAR} instead \u2014 it takes precedence and needs no home config.`,\n  ].join('\\n')\n}\n"],
-  "mappings": "wGAAA,OAAS,UAAAA,MAAc,cACvB,OAAOC,MAAa,eACpB,OAAS,KAAAC,MAAS,KC6BlB,IAAMC,EAA2B,mCAC3BC,EAA0B,kCAS1BC,EAAuB,qBACvBC,EAAqB,2CAcdC,EAA0BC,GACjCA,EAAO,SAASH,CAAoB,GAAKG,EAAO,SAASF,CAAkB,EAAU,OAErFE,EAAO,SAASL,CAAwB,EAAU,UAElDK,EAAO,SAASJ,CAAuB,EAAU,SAE9C,UAsBIK,EAA8BD,GACrCA,EAAO,SAASF,CAAkB,EAAU,aAE5CE,EAAO,SAASH,CAAoB,EAAU,UAE3C,KA4CF,IAAMK,EAAkCC,GACtC,CACL,+CAA+CA,CAAG,oEAClD,sCAAsCA,CAAG,yCACzC,wEACF,EAAE,KAAK;AAAA,CAAI,EA+BAC,EAAN,cAA+BC,CAAa,CAcxC,SAST,YAAYF,EAAaG,EAAmC,KAAMC,EAAkB,CAClF,MAAMA,GAAWL,EAA+BC,CAAG,EAAGA,CAAG,EACzD,KAAK,KAAO,mBACZ,KAAK,SAAWG,CAClB,CACF,EAwCO,IAAME,EAA8B,CAAC,CAC1C,KAAAC,EACA,QAAAC,EACA,OAAAC,EACA,UAAAC,CACF,IAA0C,CACxC,IAAMC,EACJJ,IAAS,UACL,CAAC,oBAAoBC,CAAO,uEAAkE,EAC9F,CAAC,mBAAmBC,CAAM,2BAA2BD,CAAO,IAAI,EAEtE,GAAIE,GAAaA,EAAU,OAAS,EAAG,CACrC,IAAME,EAAQL,IAAS,UAAY,qBAAuB,yBAAyBC,CAAO,IAE1FG,EAAM,KAAK,GAAGC,CAAK,KAAKF,EAAU,KAAK,IAAI,CAAC,GAAG,CACjD,CAKA,OAAAC,EAAM,KACJJ,IAAS,UACL,yFACA,wDACN,EAEOI,EAAM,KAAK;AAAA,CAAI,CACxB,ECzQA,OAAS,KAAAE,MAAS,KAUlB,IAAMC,EAA2B,IAO3BC,EAAY,iBAKLC,EAAoB,SAA6B,CAC5D,GAAM,CAAE,cAAAC,CAAc,EAAI,MAAMC,EAAkB,EAElD,OAAOD,EAAc,OAAO,IAC9B,EAgDaE,EAAgB,MAAO,CAAE,SAAAC,EAAU,QAAAC,EAAS,OAAAC,CAAO,IAAiD,CAC/G,IAAMC,EAAYC,EAAE,MAEpBA,EAAE,MAAQ,GACV,GAAI,CAOF,IAAMC,GANS,MAAMD,EAAE,CACrB,IAAKJ,CACP,CAAC,wBAAwBL,CAAS,sBAAsBM,CAAO,aAAaC,CAAM,GAAG,QACnFR,CACF,GAEwB,OAAO,KAAK,EAIpC,OAAIW,IAAaH,EAAe,CAAE,QAAS,aAAc,SAAAG,CAAS,EAE3D,CAAE,QAAS,QAAS,SAAAA,CAAS,CACtC,OAASC,EAAgB,CACvB,MAAO,CAAE,QAASC,EAAqBD,CAAK,CAAE,CAChD,QAAE,CACAF,EAAE,MAAQD,CACZ,CACF,EAOMI,EAAwBD,GAAyC,CACrE,IAAME,EAASC,EAAcH,CAAK,IAAMA,aAAiB,MAAQA,EAAM,QAAU,OAAOA,CAAK,GAE7F,OAAII,EAAuBF,CAAM,IAAM,OAAe,cAE/CG,EAA2BH,CAAM,GAAK,aAC/C,EC9GA,OAAOI,MAAa,eAgBb,IAAMC,EAA0B,sBA+B1BC,EAAkB,MAAOC,GAA2C,CAC/E,IAAMC,EAAUC,EAAQ,IAAIJ,CAAuB,EAEnD,GAAIG,EAAS,MAAO,CAAE,MAAOA,EAAS,OAAQ,KAAM,EAGpD,IAAME,GADQ,MAAMC,EAAe,IACV,KAAKJ,CAAG,EAEjC,GAAIG,EAAW,MAAO,CAAE,MAAOA,EAAW,OAAQ,OAAQ,EAI1D,MAAM,IAAIE,EAAaC,EAAyBN,EAAK,MAAMO,EAAkB,CAAC,EAAGP,CAAG,CACtF,EAkBMM,EAA2B,CAACN,EAAaQ,IACtC,CACL,qCAAqCR,CAAG,KACxC,gFAAsEA,CAAG,uDACzE,sCAAsCA,CAAG,mBACzC,mBAAmBS,EAAQD,CAAS,CAAC,mCACrC,oBAAoBV,CAAuB,+DAC7C,EAAE,KAAK;AAAA,CAAI,EHrEb,IAAMY,EAAqB,iBAOdC,EAA2B,KAAO,KAMzCC,EAA8B,IAU9BC,EAAyB,CAAC,gBAAiB,kBAAmB,gBAAgB,EAcvEC,EAAuB,CAACC,EAAeC,EAA6BC,EAAQ,MAA2B,CAClH,IAAMC,EAA8B,CAAE,GAAGF,CAAQ,EAEjD,QAAWG,KAAQN,EACjB,OAAOK,EAASC,CAAI,EAGtB,OAAAD,EAAS,cAAgBH,EAElBG,CACT,EAMaE,GAAqB,MAAOC,GAChC,IAAI,IAAI,MAAMC,EAAuB,MAAMC,EAAkB,EAAGF,CAAM,CAAC,EAGnEC,EAAyB,MAAOE,EAAiBH,IAAqD,CACjH,GAAM,CAAE,MAAAN,CAAM,EAAI,MAAMU,EAAgBJ,CAAM,EAExCH,EAAWJ,EAAqBC,CAAK,EAErCW,EAAYC,EAAE,MAEpBA,EAAE,MAAQ,GACV,GAAI,CACF,IAAIC,EAEJ,GAAI,CACFA,EAAS,MAAMD,EAAE,CACf,IAAKT,CACP,CAAC,+DAA+DM,CAAO,aAAaH,CAAM,GAAG,QAC3FT,CACF,CACF,OAASiB,EAAgB,CACvB,MAAMC,EAA8BD,EAAOL,EAASH,CAAM,CAC5D,CAEAU,EAAwBH,EAAO,MAAM,EAErC,IAAMI,EAAQC,EAAwBL,EAAO,MAAM,EAEnD,OAAAM,EAAiBF,EAAOX,CAAM,EAEvBW,CACT,QAAE,CACAL,EAAE,MAAQD,CACZ,CACF,EAiBaQ,EAAmB,CAACF,EAAgCX,IAAyB,CACxF,IAAMc,EAASH,EAAM,KAAK,CAAC,CAACI,CAAG,IACtBA,IAAQ1B,CAChB,IAAI,CAAC,EAEN,GAAI,EAAAyB,IAAW,QAAaA,IAAWd,GAKvC,MAAM,IAAIgB,EACRhB,EACA,KACA,wCAAwCc,CAAM,UAAUd,CAAM,qDACpDA,CAAM;AAAA,qCACwBA,CAAM,8BAA8BA,CAAM,IACpF,CACF,EA0BaS,EAAgC,CAACD,EAAgBL,EAAiBH,IAA0B,CACvG,IAAMiB,EAASC,EAAcV,CAAK,IAAMA,aAAiB,MAAQA,EAAM,QAAU,OAAOA,CAAK,GACvFW,EAAOC,EAAuBH,CAAM,EAE1C,OAAIE,IAAS,OAAe,IAAIH,EAAiBhB,EAAQqB,EAA2BJ,CAAM,CAAC,EAEvFE,IAAS,UAAkBX,aAAiB,MAAQA,EAAQ,IAAI,MAAM,OAAOA,CAAK,CAAC,EAEhF,IAAI,MAAMc,EAA4B,CAAE,KAAAH,EAAM,QAAAhB,EAAS,OAAAH,EAAQ,UAAW,IAAK,CAAC,CAAC,CAC1F,EAEaU,EAA2Ba,GAAyB,CAC/D,IAAMC,EAAQC,EAAO,WAAWF,EAAQ,OAAO,EAE/C,GAAIC,EAAQlC,EACV,MAAM,IAAI,MACR,+CAA+CkC,CAAK,YAAYlC,CAAwB,oCAC1F,CAEJ,EAGMoC,EAAuB,eAYhBd,EAA2BW,GAA4C,CAClF,IAAII,EAEJ,GAAI,CACFA,EAAS,KAAK,MAAMJ,CAAM,CAC5B,MAAQ,CACN,MAAM,IAAI,MAAM,uDAAuD,KAAK,UAAUA,EAAO,MAAM,EAAG,EAAE,CAAC,CAAC,GAAG,CAC/G,CAEA,GAAII,IAAW,MAAQ,OAAOA,GAAW,UAAY,MAAM,QAAQA,CAAM,EACvE,MAAM,IAAI,MAAM,8FAA8F,EAGhH,IAAMhB,EAAiC,CAAC,EAExC,OAAW,CAACI,EAAKa,CAAK,IAAK,OAAO,QAAQD,CAAM,EAAG,CACjD,GAAI,CAACD,EAAqB,KAAKX,CAAG,EAChC,MAAM,IAAI,MACR,+DAA+D,KAAK,UAAUA,EAAI,MAAM,EAAG,EAAE,CAAC,CAAC,GACjG,EAGF,GAAI,OAAOa,GAAU,SACnB,MAAM,IAAI,UAAU,4CAA4Cb,CAAG,UAAU,OAAOa,CAAK,GAAG,EAG9FjB,EAAM,KAAK,CAACI,EAAKa,CAAK,CAAC,CACzB,CAEA,GAAIjB,EAAM,SAAW,EACnB,MAAM,IAAI,MAAM,4CAA4C,EAG9D,OAAOA,CACT",
+  "mappings": "6GAAA,OAAS,UAAAA,MAAc,cACvB,OAAOC,MAAa,eACpB,OAAS,KAAAC,MAAS,KC6BlB,IAAMC,EAA2B,mCAC3BC,EAA0B,kCAS1BC,EAAuB,qBACvBC,EAAqB,2CAcdC,EAA0BC,GACjCA,EAAO,SAASH,CAAoB,GAAKG,EAAO,SAASF,CAAkB,EAAU,OAErFE,EAAO,SAASL,CAAwB,EAAU,UAElDK,EAAO,SAASJ,CAAuB,EAAU,SAE9C,UAsBIK,EAA8BD,GACrCA,EAAO,SAASF,CAAkB,EAAU,aAE5CE,EAAO,SAASH,CAAoB,EAAU,UAE3C,KA4CF,IAAMK,EAAkCC,GACtC,CACL,+CAA+CA,CAAG,oEAClD,sCAAsCA,CAAG,yCACzC,wEACF,EAAE,KAAK;AAAA,CAAI,EA+BAC,EAAN,cAA+BC,CAAa,CAcxC,SAST,YAAYF,EAAaG,EAAmC,KAAMC,EAAkB,CAClF,MAAMA,GAAWL,EAA+BC,CAAG,EAAGA,CAAG,EACzD,KAAK,KAAO,mBACZ,KAAK,SAAWG,CAClB,CACF,EAwCO,IAAME,EAA8B,CAAC,CAC1C,KAAAC,EACA,QAAAC,EACA,OAAAC,EACA,UAAAC,CACF,IAA0C,CACxC,IAAMC,EACJJ,IAAS,UACL,CAAC,oBAAoBC,CAAO,uEAAkE,EAC9F,CAAC,mBAAmBC,CAAM,2BAA2BD,CAAO,IAAI,EAEtE,GAAIE,GAAaA,EAAU,OAAS,EAAG,CACrC,IAAME,EAAQL,IAAS,UAAY,qBAAuB,yBAAyBC,CAAO,IAE1FG,EAAM,KAAK,GAAGC,CAAK,KAAKF,EAAU,KAAK,IAAI,CAAC,GAAG,CACjD,CAKA,OAAAC,EAAM,KACJJ,IAAS,UACL,yFACA,wDACN,EAEOI,EAAM,KAAK;AAAA,CAAI,CACxB,ECzQA,OAAS,KAAAE,MAAS,KAUlB,IAAMC,EAA2B,IAO3BC,EAAY,iBAKLC,EAAoB,SAA6B,CAC5D,GAAM,CAAE,cAAAC,CAAc,EAAI,MAAMC,EAAkB,EAElD,OAAOD,EAAc,OAAO,IAC9B,EAgDaE,EAAgB,MAAO,CAAE,SAAAC,EAAU,QAAAC,EAAS,OAAAC,CAAO,IAAiD,CAC/G,IAAMC,EAAYC,EAAE,MAEpBA,EAAE,MAAQ,GACV,GAAI,CAOF,IAAMC,GANS,MAAMD,EAAE,CACrB,IAAKJ,CACP,CAAC,wBAAwBL,CAAS,sBAAsBM,CAAO,aAAaC,CAAM,GAAG,QACnFR,CACF,GAEwB,OAAO,KAAK,EAIpC,OAAIW,IAAaH,EAAe,CAAE,QAAS,aAAc,SAAAG,CAAS,EAE3D,CAAE,QAAS,QAAS,SAAAA,CAAS,CACtC,OAASC,EAAgB,CACvB,MAAO,CAAE,QAASC,EAAqBD,CAAK,CAAE,CAChD,QAAE,CACAF,EAAE,MAAQD,CACZ,CACF,EAOMI,EAAwBD,GAAyC,CACrE,IAAME,EAASC,EAAcH,CAAK,IAAMA,aAAiB,MAAQA,EAAM,QAAU,OAAOA,CAAK,GAE7F,OAAII,EAAuBF,CAAM,IAAM,OAAe,cAE/CG,EAA2BH,CAAM,GAAK,aAC/C,EC9GA,OAAOI,MAAa,eAgBb,IAAMC,EAA0B,sBA+B1BC,EAAkB,MAAOC,GAA2C,CAC/E,IAAMC,EAAUC,EAAQ,IAAIJ,CAAuB,EAEnD,GAAIG,EAAS,MAAO,CAAE,MAAOA,EAAS,OAAQ,KAAM,EAGpD,IAAME,GADQ,MAAMC,EAAe,IACV,KAAKJ,CAAG,EAEjC,GAAIG,EAAW,MAAO,CAAE,MAAOA,EAAW,OAAQ,OAAQ,EAI1D,MAAM,IAAIE,EAAaC,EAAyBN,EAAK,MAAMO,EAAkB,CAAC,EAAGP,CAAG,CACtF,EAkBMM,EAA2B,CAACN,EAAaQ,IACtC,CACL,qCAAqCR,CAAG,KACxC,gFAAsEA,CAAG,uDACzE,sCAAsCA,CAAG,mBACzC,mBAAmBS,EAAQD,CAAS,CAAC,mCACrC,oBAAoBV,CAAuB,+DAC7C,EAAE,KAAK;AAAA,CAAI,EHrEb,IAAMY,EAAqB,iBAOdC,EAA2B,KAAO,KAMzCC,EAA8B,IAU9BC,EAAyB,CAAC,gBAAiB,kBAAmB,gBAAgB,EAcvEC,EAAuB,CAACC,EAAeC,EAA6BC,EAAQ,MAA2B,CAClH,IAAMC,EAA8B,CAAE,GAAGF,CAAQ,EAEjD,QAAWG,KAAQN,EACjB,OAAOK,EAASC,CAAI,EAGtB,OAAAD,EAAS,cAAgBH,EAElBG,CACT,EAMaE,GAAqB,MAAOC,GAChC,IAAI,IAAI,MAAMC,EAAuB,MAAMC,EAAkB,EAAGF,CAAM,CAAC,EAGnEC,EAAyB,MAAOE,EAAiBH,IAAqD,CACjH,GAAM,CAAE,MAAAN,CAAM,EAAI,MAAMU,EAAgBJ,CAAM,EAExCH,EAAWJ,EAAqBC,CAAK,EAErCW,EAAYC,EAAE,MAEpBA,EAAE,MAAQ,GACV,GAAI,CACF,IAAIC,EAEJ,GAAI,CACFA,EAAS,MAAMD,EAAE,CACf,IAAKT,CACP,CAAC,+DAA+DM,CAAO,aAAaH,CAAM,GAAG,QAC3FT,CACF,CACF,OAASiB,EAAgB,CACvB,MAAMC,EAA8BD,EAAOL,EAASH,CAAM,CAC5D,CAEAU,EAAwBH,EAAO,MAAM,EAErC,IAAMI,EAAQC,EAAwBL,EAAO,MAAM,EAEnD,OAAAM,EAAiBF,EAAOX,CAAM,EAEvBW,CACT,QAAE,CACAL,EAAE,MAAQD,CACZ,CACF,EAiBaQ,EAAmB,CAACF,EAAgCX,IAAyB,CACxF,IAAMc,EAASH,EAAM,KAAK,CAAC,CAACI,CAAG,IACtBA,IAAQ1B,CAChB,IAAI,CAAC,EAEN,GAAI,EAAAyB,IAAW,QAAaA,IAAWd,GAKvC,MAAM,IAAIgB,EACRhB,EACA,KACA,wCAAwCc,CAAM,UAAUd,CAAM,qDACpDA,CAAM;AAAA,qCACwBA,CAAM,8BAA8BA,CAAM,IACpF,CACF,EA0BaS,EAAgC,CAACD,EAAgBL,EAAiBH,IAA0B,CACvG,IAAMiB,EAASC,EAAcV,CAAK,IAAMA,aAAiB,MAAQA,EAAM,QAAU,OAAOA,CAAK,GACvFW,EAAOC,EAAuBH,CAAM,EAE1C,OAAIE,IAAS,OAAe,IAAIH,EAAiBhB,EAAQqB,EAA2BJ,CAAM,CAAC,EAEvFE,IAAS,UAAkBX,aAAiB,MAAQA,EAAQ,IAAI,MAAM,OAAOA,CAAK,CAAC,EAEhF,IAAI,MAAMc,EAA4B,CAAE,KAAAH,EAAM,QAAAhB,EAAS,OAAAH,EAAQ,UAAW,IAAK,CAAC,CAAC,CAC1F,EAEaU,EAA2Ba,GAAyB,CAC/D,IAAMC,EAAQC,EAAO,WAAWF,EAAQ,OAAO,EAE/C,GAAIC,EAAQlC,EACV,MAAM,IAAI,MACR,+CAA+CkC,CAAK,YAAYlC,CAAwB,oCAC1F,CAEJ,EAGMoC,EAAuB,eAYhBd,EAA2BW,GAA4C,CAClF,IAAII,EAEJ,GAAI,CACFA,EAAS,KAAK,MAAMJ,CAAM,CAC5B,MAAQ,CACN,MAAM,IAAI,MAAM,uDAAuD,KAAK,UAAUA,EAAO,MAAM,EAAG,EAAE,CAAC,CAAC,GAAG,CAC/G,CAEA,GAAII,IAAW,MAAQ,OAAOA,GAAW,UAAY,MAAM,QAAQA,CAAM,EACvE,MAAM,IAAI,MAAM,8FAA8F,EAGhH,IAAMhB,EAAiC,CAAC,EAExC,OAAW,CAACI,EAAKa,CAAK,IAAK,OAAO,QAAQD,CAAM,EAAG,CACjD,GAAI,CAACD,EAAqB,KAAKX,CAAG,EAChC,MAAM,IAAI,MACR,+DAA+D,KAAK,UAAUA,EAAI,MAAM,EAAG,EAAE,CAAC,CAAC,GACjG,EAGF,GAAI,OAAOa,GAAU,SACnB,MAAM,IAAI,UAAU,4CAA4Cb,CAAG,UAAU,OAAOa,CAAK,GAAG,EAG9FjB,EAAM,KAAK,CAACI,EAAKa,CAAK,CAAC,CACzB,CAEA,GAAIjB,EAAM,SAAW,EACnB,MAAM,IAAI,MAAM,4CAA4C,EAG9D,OAAOA,CACT",
   "names": ["Buffer", "process", "$", "PROJECT_NOT_FOUND_MARKER", "CONFIG_NOT_FOUND_MARKER", "INVALID_TOKEN_MARKER", "TOKEN_SCOPE_MARKER", "classifyDopplerFailure", "stderr", "classifyDopplerAuthFailure", "buildDopplerAuthFailureMessage", "env", "DopplerAuthError", "EnvAuthError", "authKind", "message", "buildDopplerNotFoundMessage", "kind", "project", "config", "available", "lines", "label", "$", "DOPPLER_PROBE_TIMEOUT_MS", "SCOPE_KEY", "getDopplerProject", "envManagement", "getInfraKitConfig", "probeEnvToken", "childEnv", "project", "config", "prevQuiet", "$", "scopedTo", "error", "classifyProbeFailure", "stderr", "extractStderr", "classifyDopplerFailure", "classifyDopplerAuthFailure", "process", "INFRA_KIT_ENV_TOKEN_VAR", "resolveEnvToken", "env", "fromEnv", "process", "fromStore", "readTokenStore", "EnvAuthError", "buildMissingTokenMessage", "getTokenStorePath", "storePath", "tildify", "DOPPLER_CONFIG_KEY", "DOPPLER_MAX_OUTPUT_BYTES", "DOPPLER_DOWNLOAD_TIMEOUT_MS", "INHERITED_DOPPLER_VARS", "buildDopplerChildEnv", "token", "baseEnv", "process", "childEnv", "name", "downloadEnvSecrets", "config", "downloadDopplerSecrets", "getDopplerProject", "project", "resolveEnvToken", "prevQuiet", "$", "result", "error", "translateDopplerDownloadError", "assertDopplerOutputSize", "pairs", "parseDopplerSecretsJson", "assertTokenScope", "actual", "key", "DopplerAuthError", "stderr", "extractStderr", "kind", "classifyDopplerFailure", "classifyDopplerAuthFailure", "buildDopplerNotFoundMessage", "stdout", "bytes", "Buffer", "ENV_VAR_NAME_PATTERN", "parsed", "value"]
 }

package/dist/{chunk-FHOMP6VJ.js → chunk-D7C4NYQA.js}

@@ -1,2 +1,2 @@
-var i={name:"infra-kit",type:"module",version:"0.43.0",repository:{type:"git",url:"git+https://github.com/ArthurSaenz/infra-kit.git",directory:"apps/infra-kit/cli"},files:["dist"],description:"infra-kit",bin:{"infra-kit":"dist/cli.js",ik:"dist/cli.js","ik-mcp":"dist/mcp-proxy.js"},engines:{node:">=24.x"},scripts:{build:"pnpm run clean-artifacts && node ./scripts/build.js",prepack:"pnpm run build","infra-kit-check":"pnpm exec infra-kit audit","clean-artifacts":"rm -rf dist","clean-cache":"rm -rf node_modules/.cache .eslintcache tsconfig.tsbuildinfo .turbo .swc","prettier-fix":"pnpm exec prettier **/* --write --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore","prettier-check":"pnpm exec prettier **/* --check --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore","eslint-check":"pnpm exec eslint --cache --report-unused-disable-directives ./src","eslint-fix":"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src --fix","ts-check":"tsc --noEmit",test:"pnpm exec vitest run --reporter=minimal","test-watch":"pnpm exec vitest --watch --silent passed-only","test-ui":"pnpm exec vitest --ui --silent passed-only","test-report":"pnpm exec vitest run --coverage --silent passed-only","generate-config-schema":"pnpm exec vitest run src/lib/infra-kit-config/__tests__/json-schema.test.ts --update=all","qa:pty":"INFRA_KIT_REQUIRE_PTY=1 pnpm exec vitest run --reporter=minimal src/tui/__tests__/stdin-pause-pty.test.ts src/entry/__tests__/quit-keys-pty.test.ts src/entry/__tests__/post-run-pause-pty.test.ts",qa:"pnpm run prettier-check && pnpm run eslint-check && pnpm run ts-check && pnpm run test && echo \u2705 Success",fix:"pnpm run prettier-fix && pnpm run eslint-fix && pnpm run qa"},dependencies:{"@inquirer/checkbox":"^5.2.8","@inquirer/confirm":"^6.3.5","@inquirer/input":"^5.1.9","@inquirer/password":"^5.2.5","@inquirer/select":"^5.2.8","@slip-stream-kit/config":"workspace:^",chalk:"^6.0.1",chokidar:"^6.0.0",commander:"^15.0.0",fastify:"^5.12.7",ink:"^8.0.0",pino:"^10.4.0","pino-pretty":"^13.2.0",portless:"^0.15.12",react:"19.3.1",yaml:"^2.9.1",zod:"^4.6.7",zx:"^8.8.5"},devDependencies:{"@slip-stream-kit/eslint-plugin":"workspace:*","@types/aws-lambda":"catalog:","@types/react":"catalog:","@wl/eslint-config":"workspace:*","@wl/vitest-config":"workspace:*",esbuild:"^0.28.2","ink-testing-library":"^4.0.0",typescript:"^6.0.3"}};export{i as a};
-//# sourceMappingURL=chunk-FHOMP6VJ.js.map
+var i={name:"infra-kit",type:"module",version:"0.44.0",repository:{type:"git",url:"git+https://github.com/ArthurSaenz/infra-kit.git",directory:"apps/infra-kit/cli"},files:["dist"],description:"infra-kit",bin:{"infra-kit":"dist/cli.js",ik:"dist/cli.js","ik-mcp":"dist/mcp-proxy.js"},engines:{node:">=24.x"},scripts:{build:"pnpm run clean-artifacts && node ./scripts/build.js",prepack:"pnpm run build","infra-kit-check":"pnpm exec infra-kit audit","clean-artifacts":"rm -rf dist","clean-cache":"rm -rf node_modules/.cache .eslintcache tsconfig.tsbuildinfo .turbo .swc","prettier-fix":"pnpm exec prettier **/* --write --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore","prettier-check":"pnpm exec prettier **/* --check --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore","eslint-check":"pnpm exec eslint --cache --report-unused-disable-directives ./src","eslint-fix":"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src --fix","ts-check":"tsc --noEmit",test:"pnpm exec vitest run --reporter=minimal","test-watch":"pnpm exec vitest --watch --silent passed-only","test-ui":"pnpm exec vitest --ui --silent passed-only","test-report":"pnpm exec vitest run --coverage --silent passed-only","generate-config-schema":"pnpm exec vitest run src/lib/infra-kit-config/__tests__/json-schema.test.ts --update=all","qa:pty":"INFRA_KIT_REQUIRE_PTY=1 pnpm exec vitest run --reporter=minimal src/tui/__tests__/stdin-pause-pty.test.ts src/entry/__tests__/quit-keys-pty.test.ts src/entry/__tests__/post-run-pause-pty.test.ts",qa:"pnpm run prettier-check && pnpm run eslint-check && pnpm run ts-check && pnpm run test && echo \u2705 Success",fix:"pnpm run prettier-fix && pnpm run eslint-fix && pnpm run qa"},dependencies:{"@inquirer/checkbox":"^5.2.8","@inquirer/confirm":"^6.3.5","@inquirer/input":"^5.1.9","@inquirer/password":"^5.2.5","@inquirer/select":"^5.2.8","@slip-stream-kit/config":"workspace:^",chalk:"^6.0.1",chokidar:"^6.0.0",commander:"^15.0.0",fastify:"^5.12.7",ink:"^8.0.0",pino:"^10.4.0","pino-pretty":"^13.2.0",portless:"^0.15.12",react:"19.3.1",yaml:"^2.9.1",zod:"^4.6.7",zx:"^8.8.5"},devDependencies:{"@slip-stream-kit/eslint-plugin":"workspace:*","@types/aws-lambda":"catalog:","@types/react":"catalog:","@wl/eslint-config":"workspace:*","@wl/vitest-config":"workspace:*",esbuild:"^0.28.2","ink-testing-library":"^4.0.0",typescript:"^6.0.3"}};export{i as a};
+//# sourceMappingURL=chunk-D7C4NYQA.js.map

package/dist/{chunk-FHOMP6VJ.js.map → chunk-D7C4NYQA.js.map}

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../package.json"],
-  "sourcesContent": ["{\n  \"name\": \"infra-kit\",\n  \"type\": \"module\",\n  \"version\": \"0.43.0\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"git+https://github.com/ArthurSaenz/infra-kit.git\",\n    \"directory\": \"apps/infra-kit/cli\"\n  },\n  \"files\": [\n    \"dist\"\n  ],\n  \"description\": \"infra-kit\",\n  \"bin\": {\n    \"infra-kit\": \"dist/cli.js\",\n    \"ik\": \"dist/cli.js\",\n    \"ik-mcp\": \"dist/mcp-proxy.js\"\n  },\n  \"engines\": {\n    \"node\": \">=24.x\"\n  },\n  \"scripts\": {\n    \"build\": \"pnpm run clean-artifacts && node ./scripts/build.js\",\n    \"prepack\": \"pnpm run build\",\n    \"infra-kit-check\": \"pnpm exec infra-kit audit\",\n    \"clean-artifacts\": \"rm -rf dist\",\n    \"clean-cache\": \"rm -rf node_modules/.cache .eslintcache tsconfig.tsbuildinfo .turbo .swc\",\n    \"prettier-fix\": \"pnpm exec prettier **/* --write --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore\",\n    \"prettier-check\": \"pnpm exec prettier **/* --check --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore\",\n    \"eslint-check\": \"pnpm exec eslint --cache --report-unused-disable-directives ./src\",\n    \"eslint-fix\": \"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src --fix\",\n    \"ts-check\": \"tsc --noEmit\",\n    \"test\": \"pnpm exec vitest run --reporter=minimal\",\n    \"test-watch\": \"pnpm exec vitest --watch --silent passed-only\",\n    \"test-ui\": \"pnpm exec vitest --ui --silent passed-only\",\n    \"test-report\": \"pnpm exec vitest run --coverage --silent passed-only\",\n    \"generate-config-schema\": \"pnpm exec vitest run src/lib/infra-kit-config/__tests__/json-schema.test.ts --update=all\",\n    \"qa:pty\": \"INFRA_KIT_REQUIRE_PTY=1 pnpm exec vitest run --reporter=minimal src/tui/__tests__/stdin-pause-pty.test.ts src/entry/__tests__/quit-keys-pty.test.ts src/entry/__tests__/post-run-pause-pty.test.ts\",\n    \"qa\": \"pnpm run prettier-check && pnpm run eslint-check && pnpm run ts-check && pnpm run test && echo \u2705 Success\",\n    \"fix\": \"pnpm run prettier-fix && pnpm run eslint-fix && pnpm run qa\"\n  },\n  \"dependencies\": {\n    \"@inquirer/checkbox\": \"^5.2.8\",\n    \"@inquirer/confirm\": \"^6.3.5\",\n    \"@inquirer/input\": \"^5.1.9\",\n    \"@inquirer/password\": \"^5.2.5\",\n    \"@inquirer/select\": \"^5.2.8\",\n    \"@slip-stream-kit/config\": \"workspace:^\",\n    \"chalk\": \"^6.0.1\",\n    \"chokidar\": \"^6.0.0\",\n    \"commander\": \"^15.0.0\",\n    \"fastify\": \"^5.12.7\",\n    \"ink\": \"^8.0.0\",\n    \"pino\": \"^10.4.0\",\n    \"pino-pretty\": \"^13.2.0\",\n    \"portless\": \"^0.15.12\",\n    \"react\": \"19.3.1\",\n    \"yaml\": \"^2.9.1\",\n    \"zod\": \"^4.6.7\",\n    \"zx\": \"^8.8.5\"\n  },\n  \"devDependencies\": {\n    \"@slip-stream-kit/eslint-plugin\": \"workspace:*\",\n    \"@types/aws-lambda\": \"catalog:\",\n    \"@types/react\": \"catalog:\",\n    \"@wl/eslint-config\": \"workspace:*\",\n    \"@wl/vitest-config\": \"workspace:*\",\n    \"esbuild\": \"^0.28.2\",\n    \"ink-testing-library\": \"^4.0.0\",\n    \"typescript\": \"^6.0.3\"\n  }\n}\n"],
+  "sourcesContent": ["{\n  \"name\": \"infra-kit\",\n  \"type\": \"module\",\n  \"version\": \"0.44.0\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"git+https://github.com/ArthurSaenz/infra-kit.git\",\n    \"directory\": \"apps/infra-kit/cli\"\n  },\n  \"files\": [\n    \"dist\"\n  ],\n  \"description\": \"infra-kit\",\n  \"bin\": {\n    \"infra-kit\": \"dist/cli.js\",\n    \"ik\": \"dist/cli.js\",\n    \"ik-mcp\": \"dist/mcp-proxy.js\"\n  },\n  \"engines\": {\n    \"node\": \">=24.x\"\n  },\n  \"scripts\": {\n    \"build\": \"pnpm run clean-artifacts && node ./scripts/build.js\",\n    \"prepack\": \"pnpm run build\",\n    \"infra-kit-check\": \"pnpm exec infra-kit audit\",\n    \"clean-artifacts\": \"rm -rf dist\",\n    \"clean-cache\": \"rm -rf node_modules/.cache .eslintcache tsconfig.tsbuildinfo .turbo .swc\",\n    \"prettier-fix\": \"pnpm exec prettier **/* --write --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore\",\n    \"prettier-check\": \"pnpm exec prettier **/* --check --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore\",\n    \"eslint-check\": \"pnpm exec eslint --cache --report-unused-disable-directives ./src\",\n    \"eslint-fix\": \"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src --fix\",\n    \"ts-check\": \"tsc --noEmit\",\n    \"test\": \"pnpm exec vitest run --reporter=minimal\",\n    \"test-watch\": \"pnpm exec vitest --watch --silent passed-only\",\n    \"test-ui\": \"pnpm exec vitest --ui --silent passed-only\",\n    \"test-report\": \"pnpm exec vitest run --coverage --silent passed-only\",\n    \"generate-config-schema\": \"pnpm exec vitest run src/lib/infra-kit-config/__tests__/json-schema.test.ts --update=all\",\n    \"qa:pty\": \"INFRA_KIT_REQUIRE_PTY=1 pnpm exec vitest run --reporter=minimal src/tui/__tests__/stdin-pause-pty.test.ts src/entry/__tests__/quit-keys-pty.test.ts src/entry/__tests__/post-run-pause-pty.test.ts\",\n    \"qa\": \"pnpm run prettier-check && pnpm run eslint-check && pnpm run ts-check && pnpm run test && echo \u2705 Success\",\n    \"fix\": \"pnpm run prettier-fix && pnpm run eslint-fix && pnpm run qa\"\n  },\n  \"dependencies\": {\n    \"@inquirer/checkbox\": \"^5.2.8\",\n    \"@inquirer/confirm\": \"^6.3.5\",\n    \"@inquirer/input\": \"^5.1.9\",\n    \"@inquirer/password\": \"^5.2.5\",\n    \"@inquirer/select\": \"^5.2.8\",\n    \"@slip-stream-kit/config\": \"workspace:^\",\n    \"chalk\": \"^6.0.1\",\n    \"chokidar\": \"^6.0.0\",\n    \"commander\": \"^15.0.0\",\n    \"fastify\": \"^5.12.7\",\n    \"ink\": \"^8.0.0\",\n    \"pino\": \"^10.4.0\",\n    \"pino-pretty\": \"^13.2.0\",\n    \"portless\": \"^0.15.12\",\n    \"react\": \"19.3.1\",\n    \"yaml\": \"^2.9.1\",\n    \"zod\": \"^4.6.7\",\n    \"zx\": \"^8.8.5\"\n  },\n  \"devDependencies\": {\n    \"@slip-stream-kit/eslint-plugin\": \"workspace:*\",\n    \"@types/aws-lambda\": \"catalog:\",\n    \"@types/react\": \"catalog:\",\n    \"@wl/eslint-config\": \"workspace:*\",\n    \"@wl/vitest-config\": \"workspace:*\",\n    \"esbuild\": \"^0.28.2\",\n    \"ink-testing-library\": \"^4.0.0\",\n    \"typescript\": \"^6.0.3\"\n  }\n}\n"],
   "mappings": "AAAA,IAAAA,EAAA,CACE,KAAQ,YACR,KAAQ,SACR,QAAW,SACX,WAAc,CACZ,KAAQ,MACR,IAAO,mDACP,UAAa,oBACf,EACA,MAAS,CACP,MACF,EACA,YAAe,YACf,IAAO,CACL,YAAa,cACb,GAAM,cACN,SAAU,mBACZ,EACA,QAAW,CACT,KAAQ,QACV,EACA,QAAW,CACT,MAAS,sDACT,QAAW,iBACX,kBAAmB,4BACnB,kBAAmB,cACnB,cAAe,2EACf,eAAgB,4HAChB,iBAAkB,4HAClB,eAAgB,oEAChB,aAAc,kFACd,WAAY,eACZ,KAAQ,0CACR,aAAc,gDACd,UAAW,6CACX,cAAe,uDACf,yBAA0B,2FAC1B,SAAU,qMACV,GAAM,gHACN,IAAO,6DACT,EACA,aAAgB,CACd,qBAAsB,SACtB,oBAAqB,SACrB,kBAAmB,SACnB,qBAAsB,SACtB,mBAAoB,SACpB,0BAA2B,cAC3B,MAAS,SACT,SAAY,SACZ,UAAa,UACb,QAAW,UACX,IAAO,SACP,KAAQ,UACR,cAAe,UACf,SAAY,WACZ,MAAS,SACT,KAAQ,SACR,IAAO,SACP,GAAM,QACR,EACA,gBAAmB,CACjB,iCAAkC,cAClC,oBAAqB,WACrB,eAAgB,WAChB,oBAAqB,cACrB,oBAAqB,cACrB,QAAW,UACX,sBAAuB,SACvB,WAAc,QAChB,CACF",
   "names": ["package_default"]
 }

package/dist/{chunk-TYGUMAIP.js → chunk-DQSVQO2S.js}

@@ -1,4 +1,4 @@
-import{a as x,b as E}from"./chunk-QWVLAZ6N.js";import{d as l,f as u,i as v,r as c}from"./chunk-JBQ5572P.js";var A=()=>{let e="",n=[],t=!1;return{start(r){e=r,n=[],t=!1},setInteractive(){t=!0},addOption(r,o){n.push({flag:r,value:o})},formatOptions(){return n.map(r=>typeof r.value=="boolean"?r.value?r.flag:"":Array.isArray(r.value)?`${r.flag} "${r.value.join(", ")}"`:`${r.flag} "${r.value}"`).filter(Boolean).join(" ")},snapshot(){return n.length===0?null:{formattedOptions:this.formatOptions()}},print(){!t||n.length===0||!e||v.info(`\u{1F4DF} Equivalent command: 
+import{a as x,b as E}from"./chunk-QWVLAZ6N.js";import{d as l,f as u,i as v,v as c}from"./chunk-DVMV3WJZ.js";var A=()=>{let e="",n=[],t=!1;return{start(r){e=r,n=[],t=!1},setInteractive(){t=!0},addOption(r,o){n.push({flag:r,value:o})},formatOptions(){return n.map(r=>typeof r.value=="boolean"?r.value?r.flag:"":Array.isArray(r.value)?`${r.flag} "${r.value.join(", ")}"`:`${r.flag} "${r.value}"`).filter(Boolean).join(" ")},snapshot(){return n.length===0?null:{formattedOptions:this.formatOptions()}},print(){!t||n.length===0||!e||v.info(`\u{1F4DF} Equivalent command: 
 pnpm exec infra-kit ${e} ${this.formatOptions()}
 `)},reset(){e="",n=[],t=!1}}},f=A();import{isAbsolute as w,resolve as y}from"node:path";import T from"node:process";var m=null,p=null,P=e=>{m=[...e],p=T.cwd()},S=new Set(["--yes","-y"]),$=(e,n)=>{let t=[...e];for(let[r,o]of t.entries())o==="-C"&&t[r+1]!==void 0&&!w(t[r+1])?t[r+1]=y(n,t[r+1]):o.startsWith("-C")&&o.length>2&&!o.startsWith("--")&&!w(o.slice(2))&&(t[r]=`-C${y(n,o.slice(2))}`);return t},g=()=>{if(m===null||p===null)return["--yes"];let e=m.slice(2),n=e.indexOf("--"),t=n===-1?e.length:n,r=$(e.slice(0,t),p),o=e.slice(t);return r.some(s=>S.has(s))?[...r,...o]:[...r,"--yes",...o]};import b from"node:process";var H=27,D=e=>e===null?"an interactive prompt was reached under --json, which never prompts":`an interactive prompt was reached in agent mode (${e==="flag"?"--agent":"INFRA_KIT_AGENT / CLAUDECODE"}), where there is no human to answer it`,j=e=>`${e===void 0?"pass the value explicitly instead of relying on the prompt":`pass --${e}`} on the re-run`,I=e=>{if(typeof e=="object"&&"value"in e)return e.value;let n=typeof e=="object"?e.refuse:void 0,{source:t}=l;throw new c(n===void 0?{status:"refused",agentMode:t}:{status:"argument_required",argument:n,agentMode:t},2,{operation:"interactive prompt",remediation:j(n),stderrExcerpt:D(t)})},C=async(e,n)=>{let t=new AbortController,{whenHeadless:r="refuse",...o}=n??{},d={...o,signal:t.signal};if(u())return I(r);if(!b.stdin.isTTY)return e(d);let s=b.stdin,h=a=>{a.length===1&&a[0]===H&&t.abort()};x();try{let a=e(d);return s.isPaused()&&s.resume(),s.on("data",h),await a}finally{s.removeListener("data",h),E()}};import M from"@inquirer/confirm";var i=class extends Error{constructor(n="Operation cancelled by the operator"){super(n),this.name="CommandDeclinedError"}},z=e=>e instanceof i;var O=(e,n,t=g())=>{let{source:r}=l;throw new c({status:"confirmation_required",message:e,plan:n,rerun:t,agentMode:r},2,{operation:"confirm before running",remediation:r===null?"pass `--yes` to confirm, or drop `--json` to be prompted":`show the plan to the human, then re-run \`infra-kit ${t.join(" ")}\` to confirm`,stderrExcerpt:"confirmation required and nobody to ask"})},k=async(e,n,t={})=>{!e&&u()&&O(n,t.plan,t.rerun);let r=e?!0:await C(o=>M({message:n},o),{whenHeadless:"refuse"});if(e||f.setInteractive(),!r)throw new i};export{f as a,z as b,P as c,g as d,C as e,O as f,k as g};
-//# sourceMappingURL=chunk-TYGUMAIP.js.map
+//# sourceMappingURL=chunk-DQSVQO2S.js.map

package/dist/chunk-DVMV3WJZ.js

@@ -0,0 +1,21 @@
+import{a as ke}from"./chunk-MFAFQVTW.js";import{a as ye}from"./chunk-D7C4NYQA.js";import{e as G,q,s as J}from"./chunk-RVMKL6T4.js";import mt from"node:process";import pt from"pino";import dt from"pino-pretty";var gt=["token","*.token","serviceToken","*.serviceToken","DOPPLER_TOKEN","*.DOPPLER_TOKEN","INFRA_KIT_ENV_TOKEN","*.INFRA_KIT_ENV_TOKEN"],ft=()=>{let e=mt.argv.includes("--debug")?"debug":"info",t=["time","pid","hostname"];return e==="debug"&&t.push("level"),pt({level:e,redact:gt},dt({destination:2,ignore:t.join(","),colorize:!0,sync:!0}))},B=ft();var E=e=>{let t=new Set,r=e;for(;r!==null&&typeof r=="object"&&!t.has(r);){t.add(r);let{stderr:n,stderrExcerpt:o}=r;if(typeof n=="string"&&n.length>0)return n;if(typeof o=="string"&&o.length>0)return o;r=r.cause}},ht=(e,t)=>{let r=t.stderrExcerpt??E(e),n=[`failed to ${t.operation}`];return r&&n.push(`stderr: ${r.slice(0,200).trim()}`),t.remediation&&n.push(`try: ${t.remediation}`),n.join(" \u2014 ")},d=class extends Error{operation;remediation;stderrExcerpt;constructor(t,r){super(ht(t,r),{cause:t}),this.name="OperationError",this.operation=r.operation,this.remediation=r.remediation,this.stderrExcerpt=r.stderrExcerpt??E(t)}};import yt from"node:process";import{z as ve}from"zod";var H=1,kt={schemaVersion:ve.literal(H),command:ve.string().describe("The grouped command path that ran, e.g. `release create`")},M={enabled:!1,command:""},vt=e=>typeof e=="object"&&e!==null&&!Array.isArray(e),we=e=>vt(e)?{schemaVersion:H,command:M.command,...e}:e,wt=(e,t=r=>{yt.stdout.write(r)})=>(M.enabled&&e&&e.structuredContent!=null&&t(`${JSON.stringify(we(e.structuredContent),null,2)}
+`),e),be=e=>{e.options.some(r=>r.long==="--json")||e.option("--json","Output the structured result as JSON on stdout (human logs stay on stderr)");for(let r of e.commands)be(r)};import bt from"node:process";var O={source:null},b=()=>O.source!==null,xt=()=>b()||M.enabled,z=()=>!!bt.env.CI,Rt=({env:e,stdinIsTTY:t,flag:r})=>{if(r)return"flag";let n=e.INFRA_KIT_AGENT;return n==="1"||e.CLAUDECODE!==void 0&&!t&&n!=="0"?"env":null};import Et from"node:fs/promises";import Mt from"node:os";var St=async e=>{try{return await Et.access(e),!0}catch{return!1}},U=e=>{let t=Mt.homedir();return e.startsWith(t)?`~${e.slice(t.length)}`:e};var P=class extends d{structuredContent;exitCode;constructor(t,r,n){super(void 0,n),this.name="StructuredRefusalError",this.structuredContent=t,this.exitCode=r}};import x from"node:path";import Ce from"node:process";import{$ as g}from"zx";var Ct=/^v?(\d+)\.(\d+)\.(\d+)$/,$t=/^(\d+)\.(\d+)\.(\d+)$/,jt=/^[a-z0-9]+(?:-[a-z0-9]+)*$/,T="release/",X="release/v",xe="refs/heads/",It="next";var Re=new Set(["dev","main","next","hotfix","regular","release"]),k=class extends Error{constructor(t){super(t),this.name="InvalidReleaseNameError"}},v=class extends Error{constructor(t){super(t),this.name="InvalidReleaseRefError"}},Me=e=>e.startsWith(xe)?e.slice(xe.length):e,Se=(e,t,r)=>({kind:"version",semver:{major:e,minor:t,patch:r},raw:`${e}.${t}.${r}`}),Y=e=>{if(e.length===0)throw new k('Release name is empty. Provide a kebab-case name like "checkout-redesign".');if(e.length>50)throw new k(`Release name "${e}" is ${e.length} characters; the maximum is 50.`);if(!jt.test(e))throw new k(`Release name "${e}" is not kebab-case. Use lowercase letters, digits, and single hyphens, e.g. "checkout-redesign".`);if(Re.has(e))throw new k(`Release name "${e}" is reserved. Reserved names: ${[...Re].join(", ")}.`)},Z=e=>{let t=Me(e.trim());if(!t.startsWith(T))return null;if(t.startsWith(X)){let n=t.slice(X.length),o=$t.exec(n);if(o)return Se(Number(o[1]),Number(o[2]),Number(o[3]))}let r=t.slice(T.length);try{Y(r)}catch{return null}return{kind:"name",name:r,raw:r}},Ot=e=>{let t=e.trim();if(Me(t).startsWith(T)){let o=Z(t);if(!o)throw new v(`"${e}" looks like a release branch but is not a valid release/v<semver> or release/<name> ref.`);return o}let n=Ct.exec(t);if(n)return Se(Number(n[1]),Number(n[2]),Number(n[3]));if(t.toLowerCase()===It)throw new v('The "next" token must be resolved to a concrete version (via computeNextVersion) before parsing a release ref.');if(t.includes("@"))throw new v(`Cannot parse "${e}" as a release ref: the \`@date\` suffix belongs to \`release create\`; pass the version alone here and use \`--release-date\` on \`release edit\``);try{Y(t)}catch(o){let s=o instanceof Error?o.message:String(o);throw new v(`Cannot parse "${e}" as a release ref: ${s}`)}return{kind:"name",name:t,raw:t}},Pt=e=>e.kind==="version"?`${X}${e.raw}`:`${T}${e.name}`,Tt=(e,t)=>{let r=t==="hotfix"?"Hotfix":"Release";return e.kind==="version"?`${r} v${e.raw}`:`${r} ${e.name}`},At=e=>e.kind==="version"?`Release v${e.raw} (RC)`:`Release ${e.name} (RC)`,Nt=e=>e.kind==="version"?`v${e.raw}`:e.name,Lt=e=>e.raw,Q=e=>e==null?!1:Z(e)!==null,Ee=e=>{if(e===void 0)return null;let t=e instanceof Date?e.getTime():new Date(e).getTime();return Number.isNaN(t)?null:t},_t=(e,t,r)=>{if(e.kind==="version"&&t.kind==="version")return e.semver.major!==t.semver.major?e.semver.major-t.semver.major:e.semver.minor!==t.semver.minor?e.semver.minor-t.semver.minor:e.semver.patch-t.semver.patch;if(e.kind==="version")return-1;if(t.kind==="version")return 1;let n=Ee(r?.a),o=Ee(r?.b);return n!==null&&o!==null&&n!==o?n-o:e.name<t.name?-1:e.name>t.name?1:0};var $e=async e=>{let t=await g({cwd:e})`git worktree list --porcelain`,r=[],n=null;for(let o of t.stdout.split(`
+`)){if(o.startsWith("worktree ")){n&&r.push(n),n={path:o.slice(9),branch:null,detached:!1,bare:!1,prunable:!1,locked:!1};continue}n&&(o.startsWith("branch ")?n.branch=o.slice(7).replace(/^refs\/heads\//,""):o==="detached"?n.detached=!0:o==="bare"?n.bare=!0:o==="locked"||o.startsWith("locked ")?n.locked=!0:(o==="prunable"||o.startsWith("prunable "))&&(n.prunable=!0))}return n&&r.push(n),r},Kt=async e=>{let t=await $e(Ce.cwd()),r=n=>e==="release"?Q(n):n.startsWith("feature/");return t.map(n=>n.branch).filter(n=>n!==null&&r(n))},Ft=e=>{let t=E(e);return t&&/not a git repository/i.test(t)?"not a git repository":void 0},Dt=({hasStderr:e})=>{if(b())return"infra-kit resolves its project from the working directory; run it from inside an infra-kit project repo (or one of its git worktrees), or pass `-C <dir>` naming one";let t="run infra-kit from inside an infra-kit project repo (or one of its git worktrees)";return e?`${t}; if you are already in one, the stderr in this message is the real cause`:t},S=async()=>{try{return(await g({quiet:!0})`git rev-parse --show-toplevel`).stdout.trim()}catch(e){let t=Ft(e)??E(e);throw new d(e,{operation:`resolve the project root from ${Ce.cwd()}`,stderrExcerpt:t,remediation:Dt({hasStderr:t!==void 0})})}},ee=async e=>{let t=e??await S(),r=(await g({cwd:t,quiet:!0})`git rev-parse --git-common-dir`).stdout.trim(),n=x.resolve(t,r);return n.includes(`${x.sep}.git${x.sep}modules${x.sep}`)?t:x.dirname(n)},je=async()=>(await g`git rev-parse --abbrev-ref HEAD`).stdout.trim(),Ie=async()=>(await g`git status --porcelain`).stdout.split(`
+`).map(t=>t.trimEnd()).filter(t=>t.trim().length>0),Wt=async()=>(await Ie()).length===0,Vt=async()=>{let e=await S(),[t,r]=await Promise.all([g({cwd:e})`git rev-parse --absolute-git-dir`,g({cwd:e})`git rev-parse --git-common-dir`]),n=t.stdout.trim(),o=x.resolve(e,r.stdout.trim());return n!==o};var Gt=async e=>(await g`git branch --list ${e}`).stdout.trim().length>0,qt=async e=>{(await g`git branch --list ${e}`).stdout.trim().length!==0&&await je()!==e&&await g`git branch -D ${e}`},Jt=async e=>{(await g`git ls-remote --heads origin ${e}`).stdout.trim().length!==0&&await g`git push origin --delete ${e}`};import{$ as A}from"zx";var Bt=async(e,t)=>{let r=`${t}^{commit}`;try{return(await A({cwd:e,quiet:!0})`git rev-parse --verify --quiet ${r}`).stdout.trim()||null}catch{return null}},Ht=async(e,t,r)=>{try{return await A({cwd:e,quiet:!0})`git merge-base --is-ancestor ${t} ${r}`,!0}catch(n){if(n.exitCode===1)return!1;throw new d(n,{operation:`test whether ${t} is contained in ${r}`,remediation:"both refs must exist \u2014 verify them with rev-parse first"})}},zt=async(e,t)=>{let n=(await A({cwd:e,quiet:!0})`git ls-remote --heads origin ${t}`).stdout.trim().split(`
+`)[0];return n?n.split(/\s+/)[0]??null:null},Ut=async(e,t)=>{let r=t.map(n=>`${n.sha}:refs/heads/${n.branch}`);if(r.length===0)return{refspecs:r,pushed:!1};try{return await A({cwd:e,quiet:!0})`git push --atomic origin ${r}`,{refspecs:r,pushed:!0}}catch(n){return{refspecs:r,pushed:!1,stderr:n.stderr}}};import N from"node:path";import te from"node:process";import{$ as f}from"zx";var Oe=async e=>{let t=e??te.cwd(),r=(await f({cwd:t,quiet:!0})`git rev-parse --git-common-dir`).stdout.trim(),n=N.dirname(N.resolve(t,r)),o=te.env.INFRA_KIT_SESSION||String(te.pid);return N.join(`${n}${q}`,J.mergeDev,`.scratch-${o}`)},Pe=e=>e.replace(/[^\w-]+/g,"-"),Xt=(e,t)=>N.join(`${e}${q}`,J.mergeDev,Pe(t)),re=async e=>{try{return await f({cwd:e,quiet:!0})`git rev-parse -q --verify MERGE_HEAD`,!0}catch{return!1}},Yt=async e=>{if(await re(e))throw new d(void 0,{operation:"reuse the scratch worktree",stderrExcerpt:"a merge is still in progress in the scratch worktree",remediation:"this is an infra-kit bug \u2014 the previous branch iteration did not clean up"});let t=(await f({cwd:e,quiet:!0})`git status --porcelain`).stdout.trim();if(t.length>0)throw new d(void 0,{operation:"reuse the scratch worktree",stderrExcerpt:`scratch worktree is dirty: ${t.split(`
+`)[0]}`,remediation:"this is an infra-kit bug \u2014 the previous branch iteration did not clean up"})},Zt=async e=>{let t=async r=>{try{await r()}catch{}};await re(e)&&await t(()=>f({cwd:e,quiet:!0})`git merge --abort`),await t(()=>f({cwd:e,quiet:!0})`git reset --hard`),await t(()=>f({cwd:e,quiet:!0})`git clean -fdx -e node_modules`)},Qt=async(e,t)=>{let{cwd:r,anchor:n}=e,o=await Oe(r),s=async()=>{await f({cwd:r,quiet:!0})`git worktree add --detach ${o} ${n}`};try{await s()}catch(c){try{await f({cwd:r,quiet:!0})`git worktree prune`,await s()}catch{throw new d(c,{operation:"create the scratch worktree for the merge",remediation:`remove any stale checkout at ${o}, then retry`})}}let a={path:o,remove:async()=>{try{await f({cwd:r,quiet:!0})`git worktree remove --force ${o}`}catch{}}};try{return await t(a)}finally{await a.remove()}};import ge from"node:fs/promises";import Qe from"node:os";import j from"node:path";import pr from"node:process";import{z as i}from"zod";var ne=e=>{throw new Error(`Unexpected value: ${JSON.stringify(e)}`)};var Te=(e,t)=>Object.fromEntries(Object.entries(e).filter(([r])=>r!==t));var p=({key:e,id:t,note:r})=>({kind:"drop",id:t,note:r,apply:n=>e in n?{changed:!0,result:Te(n,e)}:{changed:!1,result:n}});var Ae=p({key:"dev",id:"drop-dev-key",note:'the unused "dev" key (a dev server port comes from <APP>_PORT / PORT, else the built-in default)'});var Ne=p({key:"devServersPresets",id:"drop-dev-presets-key",note:'the unused "devServersPresets" key (run `infra-kit dev <app>` instead of a preset name)'});var Le=p({key:"devProxy",id:"drop-dev-proxy-key",note:'the retired "devProxy" key (dev URLs are port-free https://<release>.<package>.localhost)'});var _e=p({key:"envAutoLoad",id:"drop-env-auto-load-key",note:'the retired "envAutoLoad" key (env auto-load is gone \u2014 run `env-load -c <config>` in the terminal)'});var Ke=p({key:"environments",id:"drop-environments-key",note:`the retired "environments" key (deploy targets now come from each workflow's workflow_dispatch options, auth from the token store)`});var Fe=p({key:"ide",id:"drop-ide-key",note:'the unused "ide" key (worktrees add/remove no longer edit a Cursor .code-workspace)'});var De=p({key:"taskManager",id:"drop-task-manager-key",note:'the unused "taskManager" key (Jira is configured by the JIRA_BASE_URL / JIRA_PROJECT_ID env vars in Doppler)'});var L=[Fe,Ke,Le,_e,De,Ne,Ae],er=Math.max(1,...L.flatMap(e=>e.kind==="drop"?[]:[e.toVersion]));var C=e=>L.reduce((t,r)=>{let n=r.apply(t.result);return n.changed?{changed:!0,result:n.result,notes:[...t.notes,r.note]}:t},{changed:!1,result:e,notes:[]});var We={withheld:!1},oe=()=>We.withheld||z();import{randomBytes as sr}from"node:crypto";import h from"node:fs/promises";import le from"node:path";import ar from"node:process";import{isDeepStrictEqual as Ve}from"node:util";var tr=/\s/u,R=(e,t)=>{let r=t;for(;r<e.length&&tr.test(e[r]);)r+=1;return r},ie=(e,t)=>{let r=t+1;for(;r<e.length&&e[r]!=='"';)r+=e[r]==="\\"?2:1;return r+1},rr=(e,t)=>{if(e[t]==='"')return ie(e,t);if(e[t]!=="{"&&e[t]!=="["){let o=t;for(;o<e.length&&!/[\s,}\]]/u.test(e[o]);)o+=1;return o}let r=0,n=t;for(;n<e.length;){let o=e[n];if(o==='"'){n=ie(e,n);continue}if((o==="{"||o==="[")&&(r+=1),(o==="}"||o==="]")&&(r-=1),n+=1,r===0)return n}return n},Ge=(e,t)=>{if(e[t]!=="{")return null;let r=[],n=R(e,t+1);for(;n<e.length&&e[n]!=="}";){if(e[n]!=='"')return null;let o=ie(e,n),s=JSON.parse(e.slice(n,o)),a=R(e,R(e,o)+1),c=rr(e,a);r.push({key:s,keyStart:n,valueStart:a,valueEnd:c}),n=R(e,c),e[n]===","&&(n=R(e,n+1))}return e[n]==="}"?{open:t,close:n,members:r}:null},_=e=>Ge(e,R(e,0)),ce=e=>e.includes(`\r
+`)?`\r
+`:`
+`,se=(e,t,r,n)=>{let o=JSON.stringify(t,null,r).split(`
+`).join(`${n}${r}`);return`${r}${JSON.stringify(e)}: ${o}`},qe=(e,t)=>/[\r\n]/u.test(e.slice(t.open,t.close)),Je=(e,t,r)=>{let n=_(e);if(n===null||t.length===0)return n===null?null:e;let o=ce(e);if(n.members.length===0){let a=t.map(([c,u])=>se(c,u,r,o)).join(`,${o}`);return`${e.slice(0,n.open)}{${o}${a}${o}}${e.slice(n.close+1)}`}let s=qe(e,n)?t.map(([a,c])=>`${o}${se(a,c,r,o)},`).join(""):t.map(([a,c])=>`${JSON.stringify(a)}: ${JSON.stringify(c)}, `).join("");return`${e.slice(0,n.open+1)}${s}${e.slice(n.open+1)}`},Be=(e,t,r)=>{let n=_(e);if(n===null||t.length===0)return n===null?null:e;let o=n.members.at(-1);if(o===void 0)return Je(e,t,r);let s=ce(e),a=qe(e,n)?t.map(([c,u])=>`,${s}${se(c,u,r,s)}`).join(""):t.map(([c,u])=>`, ${JSON.stringify(c)}: ${JSON.stringify(u)}`).join("");return`${e.slice(0,o.valueEnd)}${a}${e.slice(o.valueEnd)}`},nr=(e,t,r)=>{let n=_(e)?.members.find(o=>o.key===t);return n===void 0?null:`${e.slice(0,n.valueStart)}${JSON.stringify(r)}${e.slice(n.valueEnd)}`},ae=e=>typeof e=="object"&&e!==null&&!Array.isArray(e),or=(e,t)=>{let r=e.lastIndexOf(`
+`,t-1)+1;return/^[ \t]*/u.exec(e.slice(r))[0]},ir=(e,t)=>{let{members:r}=e,n=[],o=0;for(;o<r.length;){if(!t.has(o)){o+=1;continue}let s=o;for(;t.has(s+1);)s+=1;let a=r[s+1];a!==void 0?n.push({start:r[o].keyStart,end:a.keyStart,text:""}):o>0?n.push({start:r[o-1].valueEnd,end:r[s].valueEnd,text:""}):n.push({start:e.open+1,end:e.close,text:""}),o=s+1}return n},He=(e,t,r,n,o)=>{let s=new Set,a=[];for(let[c,u]of t.members.entries()){if(!(u.key in n)){s.add(c);continue}let m=r[u.key],l=n[u.key];if(Ve(m,l))continue;let w=ae(m)&&ae(l)?Ge(e,u.valueStart):null;if(w!==null){let he=He(e,w,m,l,o);if(he===null)return null;a.push(...he);continue}let I=JSON.stringify(l,null,o).split(`
+`).join(`${ce(e)}${or(e,u.keyStart)}`);a.push({start:u.valueStart,end:u.valueEnd,text:I})}return a.concat(ir(t,s))},ue=(e,t,r)=>{let n=_(e),o=n===null?null:JSON.parse(e);if(n===null||!ae(o))return null;let s=He(e,n,o,t,r);if(s===null)return null;let a=[...s].sort((m,l)=>l.start-m.start).reduce((m,l)=>`${m.slice(0,l.start)}${l.text}${m.slice(l.end)}`,e),c=Object.entries(t).filter(([m])=>!(m in o)),u=Be(a,c,r);if(u===null)return null;try{return Ve(JSON.parse(u),t)?u:null}catch{return null}};var K=class extends Error{constructor(t){super(`${t} changed on disk since it was read`),this.name="ConfigFileChangedError"}},F=class extends Error{constructor(t){super(`${t} could not be migrated without reformatting it \u2014 remove the retired key by hand`),this.name="ConfigTextEditError"}},cr=2,ze=e=>/^([ \t]+)\S/m.exec(e)?.[1]??" ".repeat(cr),ur=4095,D=async({path:e,raw:t,migrated:r,expectedMtimeMs:n})=>{let o=ue(t,r,ze(t));if(o===null)throw new F(e);await Ue({path:e,content:o,expectedMtimeMs:n})},Ue=async({path:e,content:t,expectedMtimeMs:r})=>{let n=await h.realpath(e),o=le.dirname(n),s=le.basename(n),a=le.join(o,`.${s}.${ar.pid}.${sr(4).toString("hex")}.tmp`);try{await h.writeFile(a,t,"utf8");let c=await h.stat(n);if(c.mtimeMs!==r)throw new K(e);await h.chmod(a,c.mode&ur),await h.rename(a,n)}catch(c){throw await h.rm(a,{force:!0}),c}},lr=e=>e!==null&&typeof e=="object"&&!Array.isArray(e),mr=async e=>{let t=await h.stat(e),r=await h.readFile(e,"utf8");if(r.trim()==="")return{changed:!1,result:{},notes:[],path:e};let n=JSON.parse(r);if(!lr(n))return{changed:!1,result:{},notes:[],path:e};let o=C(n);return o.changed&&await D({path:e,raw:r,migrated:o.result,expectedMtimeMs:t.mtimeMs}),{...o,path:e}};var me=async(e,t,r,{schema:n})=>{if(e.autoMigrate==="off")return{kind:"not-applicable"};let o=C(t);if(!o.changed)return{kind:"not-applicable"};let s=n.safeParse(o.result);if(!s.success)return{kind:"not-applicable"};if(e.required&&oe())return{kind:"ci-gated"};try{await D({path:e.path,raw:r,migrated:o.result,expectedMtimeMs:e.mtimeMs})}catch(a){return B.debug(a,`auto-migration could not rewrite ${e.path}`),{kind:"not-applicable"}}return B.warn(`Migrated ${U(e.path)}: removed ${o.notes.join(" and ")} (retired by infra-kit ${ye.version})`),{kind:"migrated",data:s.data}};var Xe="infra-kit.json";var dr="infra-kit.json",gr="projects",fr=i.object({provider:i.literal("doppler"),config:i.object({name:i.string().min(1)})}),hr=i.discriminatedUnion("provider",[fr]),yr=["two-columns","three-pane"],kr=i.object({layout:i.enum(yr).optional()}).strict(),vr=i.object({openInGithubDesktop:i.boolean().optional(),openInOrca:i.boolean().optional(),orca:kr.optional()}).strict(),wr=i.enum(["disallow","allow","cli-only"]),Ye=i.string().regex(/^[A-Z_]\w*$/i,"must be a POSIX environment-variable name"),br=i.object({command:i.string().min(1),args:i.array(i.string()).default([]),env:i.array(Ye).min(1),unset:i.array(Ye).default([])}).strict().superRefine((e,t)=>{for(let r of e.env)ke.has(r)&&t.addIssue({code:"custom",path:["env"],message:`"${r}" is process plumbing the proxy never strips or injects \u2014 it cannot be a credential name`})}),xr=i.record(i.string().regex(/^[a-z][a-z0-9-]*$/,"must be lowercase letters, digits and hyphens, starting with a letter").refine(e=>!e.includes("infra-kit"),{message:'"infra-kit" is reserved: it is the .mcp.json key of the retired infra-kit MCP server \u2014 pick another name'}),br),Ze=i.string().min(1).superRefine((e,t)=>{if(e.startsWith("/")||e.startsWith("\\")||/^[a-z]:/i.test(e)){t.addIssue({code:"custom",message:`"${e}" must be relative to the repository root`});return}let r=e.split(/[/\\]/).filter(o=>o!==""&&o!==".");r.includes("..")&&t.addIssue({code:"custom",message:`"${e}" must not contain a ".." segment`}),r[0]===".git"&&t.addIssue({code:"custom",message:`"${e}" must not be .git or a path inside it`}),e.includes("\\")&&t.addIssue({code:"custom",message:`"${e}" must use "/" as the separator, not "\\"`});let n=e.split("/");n.includes("")&&t.addIssue({code:"custom",message:`"${e}" must not have a trailing or doubled "/"`}),n.includes(".")&&t.addIssue({code:"custom",message:`"${e}" must not contain a "." segment; write it from the repository root, e.g. "vendor/configs"`})}),et=i.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/,'must be kebab-case: a-z, 0-9 and inner "-"'),Rr=i.object({path:Ze,target:Ze.optional(),module:et.optional()}).strict(),tt=i.object({copy:i.array(Rr).min(1),exclude:i.array(i.string().regex(/^[^/\\]+$/,'must be a single path segment, without "/"')).optional()}).strict(),rt=i.object({modules:i.array(et)}).strict(),Er=i.object({requiredScripts:i.array(i.string().min(1)).optional(),requiredFiles:i.array(i.string().min(1)).optional(),turbo:i.object({requiredTasks:i.array(i.string().min(1)).optional()}).strict().optional(),exclude:i.array(i.string().min(1)).optional()}).strict(),Mr=i.string().regex(/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/,'must be a DNS label: a-z, 0-9 and inner "-", at most 63 characters'),Sr=i.string().min(1),Cr=i.enum(["dev","main"]),V=1,nt="dist/infra-kit.schema.json",$r=e=>`https://unpkg.com/infra-kit@${e}/${nt}`,fe=i.object({$schema:i.string().optional(),configVersion:i.number().int().positive().optional(),envManagement:hr,defaultEnv:Sr.optional(),worktrees:vr.optional(),protectedEnvs:wr.optional(),gitFlow:Cr.optional(),mcp:xr.optional(),vendorSource:tt.nullable().optional(),vendorTarget:rt.optional(),audit:Er.optional(),aliasRepo:Mr.optional()}).strict(),jr=443,ot=fe,de=fe.partial(),it="two-columns",Ir=e=>e.worktrees?.orca?.layout??it,y=null,$=null,st=()=>`${pr.cwd()} ${Qe.homedir()}`,at=()=>j.join(Qe.homedir(),G),ct=()=>j.join(at(),dr),ut=async()=>{let e=st();if($&&$.key===e)return $.value;let t=await S(),r=await ee(t),n=j.basename(r),o={main:j.join(t,Xe),userGlobal:ct(),userProject:j.join(at(),gr,n,Xe),projectName:n};return $={key:e,value:o},o},Or=async(e={})=>{let t=e.autoMigrate??"write",r=st(),n=await ut(),o;try{o=await ge.stat(n.main)}catch{y=null;let w=n.main.replace(/\.json$/,".yml");throw await pe(w)?new Error(`infra-kit.json not found at ${n.main}. A legacy infra-kit.yml exists \u2014 run \`infra-kit setup --skip-tools\` to convert it.`):new Error(b()?`infra-kit.json not found at ${n.main} \u2014 the working directory is not an infra-kit project. Run infra-kit from inside an infra-kit project repo, or pass \`-C <dir>\` naming one.`:`infra-kit.json not found at ${n.main} \u2014 this git repo is not an infra-kit project. Run \`infra-kit setup --skip-tools\` here to create it, cd into an infra-kit project repo, or check out a branch that has infra-kit.json.`)}let[s,a]=await Promise.all([pe(n.userGlobal),pe(n.userProject)]),c={main:Number(o.mtimeMs),userGlobal:s?Number(s.mtimeMs):null,userProject:a?Number(a.mtimeMs):null};if(y&&y.key===r&&Nr(y.mtimes,c))return y.value;let u=[{label:"infra-kit.json",path:n.main,required:!0,autoMigrate:t,mtimeMs:c.main},{label:"~/.infra-kit/infra-kit.json",path:n.userGlobal,required:!1,autoMigrate:t,mtimeMs:c.userGlobal},{label:`~/.infra-kit/projects/${n.projectName}/infra-kit.json`,path:n.userProject,required:!1,autoMigrate:t,mtimeMs:c.userProject}],m={};for(let w of u){let I=await Lr(w);I!==null&&(m={...m,...I})}let l=ot.safeParse(m);if(!l.success)throw new Error(`Invalid merged infra-kit config: ${i.prettifyError(l.error)}`);return y={key:r,mtimes:c,value:l.data},l.data},Pr=()=>{y=null},Tr=()=>{y=null,$=null},pe=async e=>{try{return await ge.stat(e)}catch{return null}},Ar=async e=>{try{return await ge.readFile(e,"utf-8")}catch{return null}},Nr=(e,t)=>{let r=Object.keys(e);return r.length!==Object.keys(t).length?!1:r.every(n=>e[n]===t[n])},lt=e=>new Error(`${e.message}
+A retired key on this branch \u2014 run \`infra-kit setup --skip-tools\` in this checkout and commit infra-kit.json.`),Lr=async e=>{let t=await Ar(e.path);if(t===null){if(e.required)throw new Error(`${e.label} not found at ${e.path}`);return null}let r;try{r=t.trim()===""?{}:JSON.parse(t)}catch(a){throw new Error(`Invalid JSON in ${e.label} at ${e.path}: ${a.message}`)}if(W(r)&&"envTokens"in r)throw new Error(Hr(e));!e.required&&W(r)&&Br(e,r),e.required&&W(r)&&Jr(r,e.path);let n=de.safeParse(r);if(n.success)return n.data;let o=new Error(`Invalid ${e.label} at ${e.path}: ${i.prettifyError(n.error)}`);if(!W(r)||e.mtimeMs===null)throw o;let s=await me({...e,mtimeMs:e.mtimeMs},r,t,{schema:de});switch(s.kind){case"migrated":return s.data;case"ci-gated":throw lt(o);case"not-applicable":throw o;default:return ne(s)}},_r=e=>[`"mcp" is not allowed in ${e.label} (${e.path}): it feeds the committed .mcp.json, so a per-machine copy would replace the project's servers for everyone.`,"Move the block to the project infra-kit.json and run `infra-kit setup`.","For a machine-only override of one server (e.g. a local fork), use Claude Code directly:","  claude mcp add --scope local <name> -- ik-mcp --name <name> --env <VAR> ... -- <command> <args>","(local scope shadows the project entry by name; `claude mcp list` will show a same-name conflict warning, which is expected)."].join(`
+`),Kr=e=>[`"vendorSource" is not allowed in ${e.label} (${e.path}): only the committed project file may mark a repository as the \`vendor sync\` source. In the machine-wide file it would make every repository on this machine a source; in a per-project override it would make this machine disagree with every other clone.`,"Move the block to the source repository's own infra-kit.json and commit it there."].join(`
+`),Fr=e=>[`"vendorTarget" is not allowed in ${e.label} (${e.path}): \`vendor sync\` reads it from the target repository's committed infra-kit.json only, so a per-machine copy would never be seen and would only make this clone disagree with the others.`,"Move the block to the target repository's own infra-kit.json and commit it there."].join(`
+`),Dr=e=>[`"audit" is not allowed in ${e.label} (${e.path}): the root audit gates CI, so a per-machine copy would make this machine pass or fail a different check list than CI.`,"Move the block to the project infra-kit.json and commit it there."].join(`
+`),Wr=e=>`"configVersion" is not allowed in ${e.label} (${e.path}): it versions the committed project file's shape, so a per-machine copy would describe nothing. Remove it from this file.`,Vr=e=>[`"aliasRepo" is not allowed in ${e.label} (${e.path}): the vite and Playwright helpers read it from the project infra-kit.json only, so a per-machine copy would register a dev host they never aim at.`,"Move it to the project infra-kit.json and commit it there."].join(`
+`),Gr=e=>[`"gitFlow" is not allowed in ${e.label} (${e.path}): it decides which branch every teammate's releases are cut from and delivered through, so a per-machine copy would ship this clone's releases down a different branch than everyone else's.`,"Move it to the project infra-kit.json and commit it there."].join(`
+`),qr={aliasRepo:Vr,configVersion:Wr,gitFlow:Gr,mcp:_r,vendorSource:Kr,vendorTarget:Fr,audit:Dr},Jr=(e,t)=>{let{configVersion:r}=e;if(!(typeof r!="number"||r<=V))throw new P({status:"refused",reason:"config-version-unsupported",configVersion:r,supportedConfigVersion:V,agentMode:O.source},2,{operation:"load infra-kit.json",remediation:"update the infra-kit CLI: `pnpm add -g infra-kit@<version>` with the version `pnpm view infra-kit version` prints, then re-run",stderrExcerpt:`${t} declares configVersion ${r}; this CLI reads up to ${V}`})},Br=(e,t)=>{for(let[r,n]of Object.entries(qr))if(r in t)throw new Error(n(e))},W=e=>typeof e=="object"&&e!==null&&!Array.isArray(e),Hr=e=>[`Refusing to load ${e.label} \u2014 \`envTokens\` is not a config key.`,"A service token in a config file can be committed, backed up by your editor, or shared.","  1. REVOKE the token in Doppler now \u2014 treat it as compromised.",`  2. Remove the \`envTokens\` key from ${e.path}.`,"  3. Re-add it privately: `infra-kit env-token-set <env>`","     (it is written to ~/.infra-kit/projects/<repo>/tokens.json, mode 0600, never to the repo)."].join(`
+`);export{M as a,wt as b,be as c,O as d,b as e,xt as f,Rt as g,ne as h,B as i,St as j,U as k,We as l,Je as m,Be as n,nr as o,K as p,ze as q,Ue as r,mr as s,E as t,d as u,P as v,k as w,Y as x,Z as y,Ot as z,Pt as A,Tt as B,At as C,Nt as D,Lt as E,Q as F,_t as G,$e as H,Kt as I,S as J,ee as K,je as L,Ie as M,Wt as N,Vt as O,Gt as P,qt as Q,Jt as R,Bt as S,Ht as T,zt as U,Ut as V,Pe as W,Xt as X,re as Y,Yt as Z,Zt as _,Qt as $,tt as aa,rt as ba,V as ca,$r as da,fe as ea,jr as fa,ot as ga,de as ha,Ir as ia,ct as ja,ut as ka,Or as la,Pr as ma,Tr as na};
+//# sourceMappingURL=chunk-DVMV3WJZ.js.map