infra-kit 0.5.0 → 0.5.5

package/dist/chunk-5OHTHRS7.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../package.json", "../src/lib/install-manager/install-manager.ts", "../src/lib/install-manager/safe-realpath.ts", "../src/lib/install-manager/npm-root.ts"],
-  "sourcesContent": ["{\n  \"name\": \"infra-kit\",\n  \"type\": \"module\",\n  \"version\": \"0.5.0\",\n  \"files\": [\n    \"dist\"\n  ],\n  \"description\": \"infra-kit\",\n  \"bin\": {\n    \"infra-kit\": \"dist/cli.js\",\n    \"ik\": \"dist/cli.js\"\n  },\n  \"engines\": {\n    \"node\": \">=24.x\"\n  },\n  \"scripts\": {\n    \"inspector\": \"npx @modelcontextprotocol/inspector node ./dist/mcp.js --debug\",\n    \"build\": \"pnpm run clean-artifacts && node ./scripts/build.js\",\n    \"prepack\": \"pnpm run build\",\n    \"prepublishOnly\": \"pnpm run build\",\n    \"infra-kit-check\": \"pnpm exec infra-kit audit\",\n    \"clean-artifacts\": \"rm -rf dist\",\n    \"clean-cache\": \"rm -rf node_modules/.cache .eslintcache tsconfig.tsbuildinfo .turbo .swc\",\n    \"prettier-fix\": \"pnpm exec prettier **/* --write --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore\",\n    \"prettier-check\": \"pnpm exec prettier **/* --check --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore\",\n    \"eslint-check\": \"pnpm exec eslint --cache --report-unused-disable-directives ./src\",\n    \"eslint-fix\": \"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src --fix\",\n    \"ts-check\": \"tsc --noEmit\",\n    \"test\": \"pnpm exec vitest run --reporter=minimal\",\n    \"test-watch\": \"pnpm exec vitest --watch --silent passed-only\",\n    \"test-ui\": \"pnpm exec vitest --ui --silent passed-only\",\n    \"test-report\": \"pnpm exec vitest run --coverage --silent passed-only\",\n    \"qa:pty\": \"INFRA_KIT_REQUIRE_PTY=1 pnpm exec vitest run --reporter=minimal src/tui/__tests__/stdin-pause-pty.test.ts src/entry/__tests__/quit-keys-pty.test.ts src/entry/__tests__/post-run-pause-pty.test.ts\",\n    \"qa\": \"pnpm run prettier-check && pnpm run eslint-check && pnpm run ts-check && pnpm run test && echo \u2705 Success\",\n    \"fix\": \"pnpm run prettier-fix && pnpm run eslint-fix && pnpm run qa\"\n  },\n  \"dependencies\": {\n    \"@aws-lambda-powertools/logger\": \"^2.35.0\",\n    \"@inquirer/checkbox\": \"^5.2.5\",\n    \"@inquirer/confirm\": \"^6.3.2\",\n    \"@inquirer/input\": \"^5.1.6\",\n    \"@inquirer/password\": \"^5.2.2\",\n    \"@inquirer/select\": \"^5.2.5\",\n    \"@modelcontextprotocol/server\": \"^2.0.0\",\n    \"@slip-stream-kit/config\": \"^0.4.0\",\n    \"chalk\": \"^6.0.0\",\n    \"chokidar\": \"^5.0.0\",\n    \"commander\": \"^15.0.0\",\n    \"fastify\": \"^5.12.3\",\n    \"ink\": \"^7.1.1\",\n    \"pino\": \"^10.3.1\",\n    \"pino-pretty\": \"^13.1.3\",\n    \"portless\": \"^0.15.6\",\n    \"react\": \"19.2.8\",\n    \"yaml\": \"^2.9.0\",\n    \"zod\": \"^4.5.4\",\n    \"zx\": \"^8.8.5\"\n  },\n  \"devDependencies\": {\n    \"@modelcontextprotocol/client\": \"^2.0.0\",\n    \"@modelcontextprotocol/sdk\": \"^1.30.0\",\n    \"@slip-stream-kit/eslint-plugin\": \"workspace:*\",\n    \"@types/aws-lambda\": \"catalog:\",\n    \"@types/react\": \"catalog:\",\n    \"@wl/eslint-config\": \"workspace:*\",\n    \"@wl/vitest-config\": \"workspace:*\",\n    \"esbuild\": \"^0.28.2\",\n    \"ink-testing-library\": \"^4.0.0\",\n    \"typescript\": \"^6.0.3\"\n  }\n}\n", "/**\n * Pure detection of *how* this CLI was installed, so a self-update advisory can name the one command\n * that will actually work. No fs, no spawn, no `process.env` read \u2014 every input is injected, which is\n * what lets the whole matrix be table-tested.\n *\n * Detection is env-first and LAZY: the only signal that costs a subprocess (`npm root -g`) is passed in\n * as `lazyNpmRoot` and consulted solely when every cheaper matcher has missed.\n */\nimport path from 'node:path'\n\n/** The published package this CLI updates itself to. Single source for every suggested argv. */\nexport const PACKAGE_NAME = 'infra-kit'\n\nconst LATEST = `${PACKAGE_NAME}@latest`\n\nexport type InstallManager = 'npm' | 'pnpm' | 'yarn' | 'bun' | 'volta' | 'homebrew' | 'unknown'\n\nexport interface InstallManagerInfo {\n  manager: InstallManager\n  /** The command to run. Only safe to spawn ourselves when `canSelfSpawn`; otherwise print it. */\n  updateCommand: string[]\n  /** False when we must not run the command for the user \u2014 either it needs sudo/a tap, or we guessed. */\n  canSelfSpawn: boolean\n}\n\n/**\n * Canonicalises a candidate *root* directory. Required, not optional: `selfRealPath` has already had its\n * symlinks followed, so comparing it against a raw `PNPM_HOME`/`npm root -g`/`cwd` compares a resolved\n * path to an unresolved one and silently never matches. macOS is the everyday proof \u2014 `/var` is a symlink\n * to `/private/var`, so a global install under `/var/...` reports `unknown` unless both sides are resolved.\n * Callers inject the real thing; tests inject a stub.\n */\nexport type RealpathFn = (dir: string) => string\n\nexport interface DetectInstallManagerInput {\n  /** Fully-resolved (symlinks followed) path to this CLI's entry file. */\n  selfRealPath: string\n  env: NodeJS.ProcessEnv\n  /** Canonicalises each candidate root before comparison. See {@link RealpathFn}. */\n  realpath: RealpathFn\n  /** `npm root -g`, deferred: invoked at most once, and only when no cheaper matcher hit. */\n  lazyNpmRoot?: () => string | undefined\n}\n\n/**\n * Is `child` inside the `parent` subtree? Boundary-aware: a naive `startsWith` would call\n * `/Users/x/pnpm-ish` a child of `/Users/x/pnpm`. `parent` is canonicalised first because it arrives raw\n * from the environment while `child` is already a realpath.\n */\nexport const isWithin = (parent: string, child: string, realpath: RealpathFn): boolean => {\n  const rel = path.relative(realpath(path.resolve(parent)), path.resolve(child))\n\n  return rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel)\n}\n\n/** Does `p` contain `name` as a whole path SEGMENT? `/a/node_modules_backup/b` must not match `node_modules`. */\nexport const hasSegment = (p: string, name: string): boolean => {\n  return path.resolve(p).split(path.sep).includes(name)\n}\n\n/**\n * Is `p` inside a Homebrew keg belonging to the `name` FORMULA \u2014 i.e. `.../Cellar/<name>/<version>/...`?\n *\n * The formula name is what makes this sound. A bare `Cellar` segment says only \"somewhere under a keg\",\n * and the keg it lands in is routinely someone else's: when npm's global prefix is a node keg\n * (`npm config set prefix \"$(brew --prefix node)\"`, or any keg-only `node@X`), an `npm i -g` package\n * installs to `Cellar/node/<v>/lib/node_modules/<pkg>/...` \u2014 brew has never heard of it, yet the segment\n * is right there. Requiring `<name>` to sit directly after `Cellar` is what separates \"brew installed\n * THIS\" from \"brew installed the runtime that installed this\".\n *\n * Works for both keg layouts, since each is rooted at the formula: a plain formula\n * (`Cellar/infra-kit/1.2.3/bin/infra-kit`) and brew's node-CLI layout\n * (`Cellar/infra-kit/1.2.3/libexec/lib/node_modules/infra-kit/dist/cli.js`). Do NOT try to tell them\n * apart by excluding `node_modules` \u2014 the second one contains it.\n */\nexport const isBrewKegOf = (p: string, name: string): boolean => {\n  const segments = path.resolve(p).split(path.sep)\n  const cellar = segments.indexOf('Cellar')\n\n  return cellar !== -1 && segments[cellar + 1] === name\n}\n\n/**\n * The npm global prefix that owns `binRealPath`, derived from the path ITSELF, or null when the\n * layout is not an npm global one.\n *\n * Matches `<prefix>/lib/node_modules/<packageName>` \u2014 npm's global layout and no other manager's\n * \u2014 requiring BOTH the `lib` parent and our package as the immediate child. Windows global npm has\n * no `lib` segment (`%APPDATA%\\npm\\node_modules`), so this returns null there and detection falls\n * through to `npm root -g`, which is correct on Windows, where there is normally one npm.\n */\n// This is the one signal that cannot point at the wrong tree. Everything else in this module\n// answers \"is this file somewhere inside tool X's directory?\", and containment is not ownership:\n//   - `npm root -g` answers for whichever `npm` is first on PATH, which is routinely a DIFFERENT\n//     node than the one that installed us (a pnpm/nvm/fnm-managed node, or a node that has since\n//     been removed). It then reports a root that does not contain us, every matcher misses, and\n//     detection degrades to `unknown` \u2014 a notice printed forever, on the single most common install\n//     method. That is the bug this exists to close.\n//   - `PNPM_HOME` containment is satisfied by `<PNPM_HOME>/nodejs/<v>/lib/node_modules/<pkg>` (a\n//     plain `npm i -g` under a pnpm-managed node), yet `pnpm add -g` installs to\n//     `<PNPM_HOME>/global/<v>/...` \u2014 a different directory. That one is worse than a missed update:\n//     the install \"succeeds\" while the binary on PATH stays old, silently, with no notice to show\n//     for it.\n//\n// Requiring both segments is what makes the match proof rather than a hint. The `lib` requirement\n// is also what keeps a project-local `<repo>/node_modules/<pkg>` out (it has no `lib`), and nesting\n// cannot spoof it: `.../node_modules/foo/node_modules/<pkg>` fails the `lib` test.\nexport const npmPrefixOfPackage = (binRealPath: string, packageName: string): string | null => {\n  const segments = path.resolve(binRealPath).split(path.sep)\n  const nodeModules = segments.lastIndexOf('node_modules')\n\n  if (nodeModules < 2) return null\n  if (segments[nodeModules - 1] !== 'lib') return null\n  if (segments[nodeModules + 1] !== packageName) return null\n\n  // Drop `lib/node_modules/...`; the empty result of a root-level prefix (`/lib/node_modules/...`) is `/`.\n  return segments.slice(0, nodeModules - 1).join(path.sep) || path.sep\n}\n\n// The self-scoped reading, kept as the name every call site below already uses. `dependency-registry`\n// asks the same question about OTHER packages (`portless`), which is why the body moved up one level\n// rather than gaining a defaulted parameter \u2014 a default is how the wrong package silently gets probed.\nconst npmPrefixFromSelfPath = (selfRealPath: string): string | null => {\n  return npmPrefixOfPackage(selfRealPath, PACKAGE_NAME)\n}\n\n/**\n * `--prefix` is passed EXPLICITLY rather than trusting the ambient one: the whole point of deriving it is\n * that the `npm` we are about to run may default to a different prefix than the one we are installed in.\n * A command-line flag outranks both `npm_config_prefix` and any `.npmrc`, so this targets the tree we\n * actually run from. With `-g`, npm writes `<prefix>/lib/node_modules` and links bins into `<prefix>/bin`.\n */\nconst npmPrefixInstallCommand = (prefix: string): string[] => {\n  return ['npm', 'install', '-g', '--prefix', prefix, LATEST]\n}\n\n/**\n * Render argv as a line the user can paste into a shell.\n *\n * A plain `join(' ')` was fine while every token came from a static table; `--prefix <path>` puts a\n * filesystem path in argv, and `/Users/Ada Lovelace/.nvm/...` pasted unquoted is two arguments and a\n * failed install. Single quotes are sound here without escaping because the callers' validation rejects a\n * token containing a quote \u2014 see `SAFE_COMMAND_TOKEN` in src/lib/update-check/auto-update.ts.\n *\n * @example\n * formatUpdateCommand(['npm', 'install', '-g', '--prefix', '/opt/x y', 'infra-kit@latest'])\n * // => \"npm install -g --prefix '/opt/x y' infra-kit@latest\"\n */\nexport const formatUpdateCommand = (command: string[]): string => {\n  return command\n    .map((token) => {\n      return token.includes(' ') ? `'${token}'` : token\n    })\n    .join(' ')\n}\n\n/** `env[key]` names a directory that contains `selfRealPath`. Absent/empty env var \u2192 no match. */\nconst underEnvDir = (env: NodeJS.ProcessEnv, key: string, selfRealPath: string, realpath: RealpathFn): boolean => {\n  const dir = env[key]\n\n  return dir != null && dir !== '' && isWithin(dir, selfRealPath, realpath)\n}\n\ninterface Matcher extends Omit<InstallManagerInfo, 'manager'> {\n  manager: InstallManager\n  test: (input: Required<Pick<DetectInstallManagerInput, 'selfRealPath' | 'env' | 'realpath'>>) => boolean\n}\n\n/**\n * Consulted FIRST, before {@link npmPrefixFromSelfPath}. Both of these legitimately wrap an npm-shaped\n * `lib/node_modules` tree \u2014 volta at `~/.volta/tools/image/node/<v>/lib/node_modules`, brew at\n * `Cellar/<pkg>/<v>/libexec/lib/node_modules` \u2014 so deriving an npm prefix from the path would hijack\n * installs that a wrapper owns and must keep owning.\n */\nconst WRAPPER_MATCHERS: Matcher[] = [\n  {\n    manager: 'volta',\n    // volta owns the shim; `volta install` is the correct tool, not a workaround \u2014 so we may run it.\n    test: ({ selfRealPath, env, realpath }) => {\n      return (\n        underEnvDir(env, 'VOLTA_HOME', selfRealPath, realpath) ||\n        hasSegment(selfRealPath, '.volta') ||\n        hasSegment(selfRealPath, 'volta')\n      )\n    },\n    updateCommand: ['volta', 'install', PACKAGE_NAME],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'homebrew',\n    // `brew upgrade` can touch the prefix, relink, and prompt \u2014 never ours to run unattended.\n    //\n    // Our own keg is the ONLY sound signal \u2014 see `isBrewKegOf`. Two broader tests look plausible\n    // and are both wrong, because each answers \"did brew put something here?\" when the question is \"does\n    // brew own THIS package?\":\n    //   - `HOMEBREW_PREFIX` containment: when node comes from brew, npm's global prefix IS\n    //     $HOMEBREW_PREFIX, so EVERY `npm i -g` package lands under it, unknown to brew.\n    //   - a bare `Cellar` segment: an npm prefix pointed at a node keg puts packages inside that keg.\n    // Either misfire tells macOS users to run `brew upgrade infra-kit` \u2014 a formula that does not exist \u2014\n    // and, far worse, makes the background auto-updater bail with `cannot-self-spawn` forever, so the\n    // very fix for it can never reach them. Detection runs on the realpath, and a linked brew bin always\n    // resolves into its own keg, so the narrow test has no false negatives to trade for this.\n    test: ({ selfRealPath }) => {\n      return isBrewKegOf(selfRealPath, PACKAGE_NAME)\n    },\n    updateCommand: ['brew', 'upgrade', PACKAGE_NAME],\n    canSelfSpawn: false,\n  },\n]\n\n/**\n * Consulted LAST, after {@link npmPrefixFromSelfPath} has had its say. Each of these proves only that we\n * live somewhere inside a tool's directory tree, which is weaker than knowing the layout npm itself\n * created \u2014 see the `PNPM_HOME`/`nodejs` case in that helper's doc for a containment hit whose install\n * command targets the wrong directory.\n */\nconst TREE_MATCHERS: Matcher[] = [\n  {\n    manager: 'pnpm',\n    test: ({ selfRealPath, env, realpath }) => {\n      return (\n        underEnvDir(env, 'PNPM_HOME', selfRealPath, realpath) ||\n        (hasSegment(selfRealPath, 'pnpm') && hasSegment(selfRealPath, 'global'))\n      )\n    },\n    updateCommand: ['pnpm', 'add', '-g', LATEST],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'bun',\n    test: ({ selfRealPath, env, realpath }) => {\n      return underEnvDir(env, 'BUN_INSTALL', selfRealPath, realpath) || hasSegment(selfRealPath, '.bun')\n    },\n    updateCommand: ['bun', 'add', '-g', LATEST],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'yarn',\n    test: ({ selfRealPath }) => {\n      return (\n        hasSegment(selfRealPath, '.yarn') || (hasSegment(selfRealPath, 'yarn') && hasSegment(selfRealPath, 'global'))\n      )\n    },\n    updateCommand: ['yarn', 'global', 'add', LATEST],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'npm',\n    test: ({ selfRealPath, env, realpath }) => {\n      return underEnvDir(env, 'npm_config_prefix', selfRealPath, realpath)\n    },\n    updateCommand: ['npm', 'install', '-g', LATEST],\n    canSelfSpawn: true,\n  },\n]\n\nconst NPM_UPDATE_COMMAND = ['npm', 'install', '-g', LATEST]\n\n/**\n * Identify the package manager that owns `selfRealPath`.\n *\n * Order, and why it is this one: wrappers that own an npm-shaped tree (volta, brew) first, then the npm\n * prefix DERIVED from our own path, then the env/path containment matchers, then the `npm root -g` probe.\n * The derived prefix sits above containment because it is the only signal that cannot name a directory we\n * do not live in \u2014 see {@link npmPrefixFromSelfPath}.\n *\n * `lazyNpmRoot` is the last resort and is invoked at most once, only after every matcher has missed \u2014 a\n * pnpm or volta install never pays for the subprocess, and neither does any npm global install in the\n * standard layout, which the derived prefix now settles for free. When nothing matches we report `unknown`\n * with an npm command that is a *suggestion only* (`canSelfSpawn: false`): running a guessed global\n * install is worse than printing one.\n *\n * @example\n * detectInstallManager({ selfRealPath: '/Users/x/Library/pnpm/global/5/node_modules/infra-kit/dist/cli.js', env: {} })\n * // => { manager: 'pnpm', updateCommand: ['pnpm', 'add', '-g', 'infra-kit@latest'], canSelfSpawn: true }\n */\nexport const detectInstallManager = (input: DetectInstallManagerInput): InstallManagerInfo => {\n  const { selfRealPath, env, realpath, lazyNpmRoot } = input\n  const toInfo = (hit: Matcher): InstallManagerInfo => {\n    return { manager: hit.manager, updateCommand: hit.updateCommand, canSelfSpawn: hit.canSelfSpawn }\n  }\n  const matches = ({ test }: Matcher): boolean => {\n    return test({ selfRealPath, env, realpath })\n  }\n\n  const wrapper = WRAPPER_MATCHERS.find(matches)\n\n  if (wrapper) return toInfo(wrapper)\n\n  const derivedPrefix = npmPrefixFromSelfPath(selfRealPath)\n\n  if (derivedPrefix !== null) {\n    return { manager: 'npm', updateCommand: npmPrefixInstallCommand(derivedPrefix), canSelfSpawn: true }\n  }\n\n  const tree = TREE_MATCHERS.find(matches)\n\n  if (tree) return toInfo(tree)\n\n  const npmRoot = lazyNpmRoot?.()\n\n  if (npmRoot != null && npmRoot !== '' && isWithin(npmRoot, selfRealPath, realpath)) {\n    return { manager: 'npm', updateCommand: NPM_UPDATE_COMMAND, canSelfSpawn: true }\n  }\n\n  return { manager: 'unknown', updateCommand: NPM_UPDATE_COMMAND, canSelfSpawn: false }\n}\n\n/**\n * Is this CLI running from a *project-local* `node_modules` (as opposed to a global root)?\n *\n * The cwd clause is what does the distinguishing \u2014 BOTH a project install and a global root contain a\n * `/node_modules/` segment (`pnpm root -g` is `~/Library/pnpm/global/5/node_modules`). Without it we\n * would nag every global pnpm user to stop using a local install they do not have.\n *\n * Accepted false-negative: invoked from a subdirectory (cwd `project/apps/x`, deps at\n * `project/node_modules`) this returns false and the advisory stays silent. Under-warning is the safe\n * direction for a best-effort, never-throwing advisory \u2014 do not \"fix\" it by dropping the cwd clause.\n *\n * `cwd` is canonicalised before comparison for the same reason `detectInstallManager` canonicalises its\n * roots: `selfRealPath` is a realpath, and comparing it to an unresolved cwd never matches.\n *\n * @example\n * isLocalNodeModulesInstall('/repo/node_modules/infra-kit/dist/cli.js', '/repo', (p) => p) // => true\n */\nexport const isLocalNodeModulesInstall = (selfRealPath: string, cwd: string, realpath: RealpathFn): boolean => {\n  return hasSegment(selfRealPath, 'node_modules') && isWithin(cwd, selfRealPath, realpath)\n}\n", "import { realpathSync } from 'node:fs'\nimport path from 'node:path'\n\n/**\n * The impure companion to the pure detection module: canonicalise a directory that may not exist.\n *\n * `realpathSync` throws on a missing path, and candidate roots routinely miss \u2014 `PNPM_HOME` can point at a\n * directory the user never created, `npm root -g` can name a prefix that was removed. A throw there would\n * turn \"we could not identify your install\" into a crash, so an unresolvable path falls back to\n * `path.resolve`, which still normalises `.`/`..` and yields a usable, non-matching absolute path.\n */\nexport const safeRealpath = (dir: string): string => {\n  try {\n    return realpathSync(dir)\n  } catch {\n    return path.resolve(dir)\n  }\n}\n", "/* eslint-disable sonarjs/no-os-command-from-path */\n/**\n * `npm root -g`, the LAZY fallback for {@link detectInstallManager}.\n *\n * Why it is indispensable: the `npm` matcher keys off `npm_config_prefix`, which npm sets only while npm\n * itself is running. A user who ran `npm i -g infra-kit` months ago and now types `ik` has no such var,\n * so every cheap matcher misses and detection reports `unknown` / `canSelfSpawn: false`. Without this\n * probe the single most common install method can never update itself.\n *\n * Shared by `self-update` (interactive) and the background update worker so the two can never disagree\n * about who owns the install.\n */\nimport { execFileSync } from 'node:child_process'\nimport process from 'node:process'\n\nconst NPM_ROOT_TIMEOUT_MS = 3_000\n\n/**\n * The global npm root, or undefined when npm is absent, slow, or errors. Costs a subprocess, so\n * `detectInstallManager` invokes it at most once and only after every env/path matcher has missed \u2014 a\n * pnpm or volta install never pays for it.\n *\n * Resolving the user's `npm` from PATH is inherent here: we must ask the very package manager that owns\n * this install where its global root is. Pinning an absolute path would defeat the detection.\n *\n * @example\n * defaultLazyNpmRoot() // => '/usr/local/lib/node_modules' | undefined\n */\nexport const defaultLazyNpmRoot = (): string | undefined => {\n  try {\n    const out = execFileSync('npm', ['root', '-g'], {\n      encoding: 'utf-8',\n      timeout: NPM_ROOT_TIMEOUT_MS,\n      stdio: ['ignore', 'pipe', 'ignore'],\n      shell: process.platform === 'win32',\n    })\n    const trimmed = out.trim()\n\n    return trimmed === '' ? undefined : trimmed\n  } catch {\n    return undefined\n  }\n}\n"],
-  "mappings": "AAAA,IAAAA,EAAA,CACE,KAAQ,YACR,KAAQ,SACR,QAAW,QACX,MAAS,CACP,MACF,EACA,YAAe,YACf,IAAO,CACL,YAAa,cACb,GAAM,aACR,EACA,QAAW,CACT,KAAQ,QACV,EACA,QAAW,CACT,UAAa,iEACb,MAAS,sDACT,QAAW,iBACX,eAAkB,iBAClB,kBAAmB,4BACnB,kBAAmB,cACnB,cAAe,2EACf,eAAgB,4HAChB,iBAAkB,4HAClB,eAAgB,oEAChB,aAAc,kFACd,WAAY,eACZ,KAAQ,0CACR,aAAc,gDACd,UAAW,6CACX,cAAe,uDACf,SAAU,qMACV,GAAM,gHACN,IAAO,6DACT,EACA,aAAgB,CACd,gCAAiC,UACjC,qBAAsB,SACtB,oBAAqB,SACrB,kBAAmB,SACnB,qBAAsB,SACtB,mBAAoB,SACpB,+BAAgC,SAChC,0BAA2B,SAC3B,MAAS,SACT,SAAY,SACZ,UAAa,UACb,QAAW,UACX,IAAO,SACP,KAAQ,UACR,cAAe,UACf,SAAY,UACZ,MAAS,SACT,KAAQ,SACR,IAAO,SACP,GAAM,QACR,EACA,gBAAmB,CACjB,+BAAgC,SAChC,4BAA6B,UAC7B,iCAAkC,cAClC,oBAAqB,WACrB,eAAgB,WAChB,oBAAqB,cACrB,oBAAqB,cACrB,QAAW,UACX,sBAAuB,SACvB,WAAc,QAChB,CACF,EC9DA,OAAOC,MAAU,YAGV,IAAMC,EAAe,YAEtBC,EAAS,GAAGD,CAAY,UAoCjBE,EAAW,CAACC,EAAgBC,EAAeC,IAAkC,CACxF,IAAMC,EAAMP,EAAK,SAASM,EAASN,EAAK,QAAQI,CAAM,CAAC,EAAGJ,EAAK,QAAQK,CAAK,CAAC,EAE7E,OAAOE,IAAQ,IAAM,CAACA,EAAI,WAAW,IAAI,GAAK,CAACP,EAAK,WAAWO,CAAG,CACpE,EAGaC,EAAa,CAACC,EAAWC,IAC7BV,EAAK,QAAQS,CAAC,EAAE,MAAMT,EAAK,GAAG,EAAE,SAASU,CAAI,EAkBzCC,EAAc,CAACF,EAAWC,IAA0B,CAC/D,IAAME,EAAWZ,EAAK,QAAQS,CAAC,EAAE,MAAMT,EAAK,GAAG,EACzCa,EAASD,EAAS,QAAQ,QAAQ,EAExC,OAAOC,IAAW,IAAMD,EAASC,EAAS,CAAC,IAAMH,CACnD,EA2BaI,EAAqB,CAACC,EAAqBC,IAAuC,CAC7F,IAAMJ,EAAWZ,EAAK,QAAQe,CAAW,EAAE,MAAMf,EAAK,GAAG,EACnDiB,EAAcL,EAAS,YAAY,cAAc,EAIvD,OAFIK,EAAc,GACdL,EAASK,EAAc,CAAC,IAAM,OAC9BL,EAASK,EAAc,CAAC,IAAMD,EAAoB,KAG/CJ,EAAS,MAAM,EAAGK,EAAc,CAAC,EAAE,KAAKjB,EAAK,GAAG,GAAKA,EAAK,GACnE,EAKMkB,EAAyBC,GACtBL,EAAmBK,EAAclB,CAAY,EAShDmB,EAA2BC,GACxB,CAAC,MAAO,UAAW,KAAM,WAAYA,EAAQnB,CAAM,EAe/CoB,EAAuBC,GAC3BA,EACJ,IAAKC,GACGA,EAAM,SAAS,GAAG,EAAI,IAAIA,CAAK,IAAMA,CAC7C,EACA,KAAK,GAAG,EAIPC,EAAc,CAACC,EAAwBC,EAAaR,EAAsBb,IAAkC,CAChH,IAAMsB,EAAMF,EAAIC,CAAG,EAEnB,OAAOC,GAAO,MAAQA,IAAQ,IAAMzB,EAASyB,EAAKT,EAAcb,CAAQ,CAC1E,EAaMuB,EAA8B,CAClC,CACE,QAAS,QAET,KAAM,CAAC,CAAE,aAAAV,EAAc,IAAAO,EAAK,SAAApB,CAAS,IAEjCmB,EAAYC,EAAK,aAAcP,EAAcb,CAAQ,GACrDE,EAAWW,EAAc,QAAQ,GACjCX,EAAWW,EAAc,OAAO,EAGpC,cAAe,CAAC,QAAS,UAAWlB,CAAY,EAChD,aAAc,EAChB,EACA,CACE,QAAS,WAaT,KAAM,CAAC,CAAE,aAAAkB,CAAa,IACbR,EAAYQ,EAAclB,CAAY,EAE/C,cAAe,CAAC,OAAQ,UAAWA,CAAY,EAC/C,aAAc,EAChB,CACF,EAQM6B,EAA2B,CAC/B,CACE,QAAS,OACT,KAAM,CAAC,CAAE,aAAAX,EAAc,IAAAO,EAAK,SAAApB,CAAS,IAEjCmB,EAAYC,EAAK,YAAaP,EAAcb,CAAQ,GACnDE,EAAWW,EAAc,MAAM,GAAKX,EAAWW,EAAc,QAAQ,EAG1E,cAAe,CAAC,OAAQ,MAAO,KAAMjB,CAAM,EAC3C,aAAc,EAChB,EACA,CACE,QAAS,MACT,KAAM,CAAC,CAAE,aAAAiB,EAAc,IAAAO,EAAK,SAAApB,CAAS,IAC5BmB,EAAYC,EAAK,cAAeP,EAAcb,CAAQ,GAAKE,EAAWW,EAAc,MAAM,EAEnG,cAAe,CAAC,MAAO,MAAO,KAAMjB,CAAM,EAC1C,aAAc,EAChB,EACA,CACE,QAAS,OACT,KAAM,CAAC,CAAE,aAAAiB,CAAa,IAElBX,EAAWW,EAAc,OAAO,GAAMX,EAAWW,EAAc,MAAM,GAAKX,EAAWW,EAAc,QAAQ,EAG/G,cAAe,CAAC,OAAQ,SAAU,MAAOjB,CAAM,EAC/C,aAAc,EAChB,EACA,CACE,QAAS,MACT,KAAM,CAAC,CAAE,aAAAiB,EAAc,IAAAO,EAAK,SAAApB,CAAS,IAC5BmB,EAAYC,EAAK,oBAAqBP,EAAcb,CAAQ,EAErE,cAAe,CAAC,MAAO,UAAW,KAAMJ,CAAM,EAC9C,aAAc,EAChB,CACF,EAEM6B,EAAqB,CAAC,MAAO,UAAW,KAAM7B,CAAM,EAoB7C8B,EAAwBC,GAAyD,CAC5F,GAAM,CAAE,aAAAd,EAAc,IAAAO,EAAK,SAAApB,EAAU,YAAA4B,CAAY,EAAID,EAC/CE,EAAUC,IACP,CAAE,QAASA,EAAI,QAAS,cAAeA,EAAI,cAAe,aAAcA,EAAI,YAAa,GAE5FC,EAAU,CAAC,CAAE,KAAAC,CAAK,IACfA,EAAK,CAAE,aAAAnB,EAAc,IAAAO,EAAK,SAAApB,CAAS,CAAC,EAGvCiC,EAAUV,EAAiB,KAAKQ,CAAO,EAE7C,GAAIE,EAAS,OAAOJ,EAAOI,CAAO,EAElC,IAAMC,EAAgBtB,EAAsBC,CAAY,EAExD,GAAIqB,IAAkB,KACpB,MAAO,CAAE,QAAS,MAAO,cAAepB,EAAwBoB,CAAa,EAAG,aAAc,EAAK,EAGrG,IAAMC,EAAOX,EAAc,KAAKO,CAAO,EAEvC,GAAII,EAAM,OAAON,EAAOM,CAAI,EAE5B,IAAMC,EAAUR,IAAc,EAE9B,OAAIQ,GAAW,MAAQA,IAAY,IAAMvC,EAASuC,EAASvB,EAAcb,CAAQ,EACxE,CAAE,QAAS,MAAO,cAAeyB,EAAoB,aAAc,EAAK,EAG1E,CAAE,QAAS,UAAW,cAAeA,EAAoB,aAAc,EAAM,CACtF,EAmBaY,EAA4B,CAACxB,EAAsByB,EAAatC,IACpEE,EAAWW,EAAc,cAAc,GAAKhB,EAASyC,EAAKzB,EAAcb,CAAQ,ECtUzF,OAAS,gBAAAuC,MAAoB,UAC7B,OAAOC,MAAU,YAUV,IAAMC,EAAgBC,GAAwB,CACnD,GAAI,CACF,OAAOH,EAAaG,CAAG,CACzB,MAAQ,CACN,OAAOF,EAAK,QAAQE,CAAG,CACzB,CACF,ECLA,OAAS,gBAAAC,MAAoB,qBAC7B,OAAOC,MAAa,eAEpB,IAAMC,EAAsB,IAafC,EAAqB,IAA0B,CAC1D,GAAI,CAOF,IAAMC,EANMJ,EAAa,MAAO,CAAC,OAAQ,IAAI,EAAG,CAC9C,SAAU,QACV,QAASE,EACT,MAAO,CAAC,SAAU,OAAQ,QAAQ,EAClC,MAAOD,EAAQ,WAAa,OAC9B,CAAC,EACmB,KAAK,EAEzB,OAAOG,IAAY,GAAK,OAAYA,CACtC,MAAQ,CACN,MACF,CACF",
-  "names": ["package_default", "path", "PACKAGE_NAME", "LATEST", "isWithin", "parent", "child", "realpath", "rel", "hasSegment", "p", "name", "isBrewKegOf", "segments", "cellar", "npmPrefixOfPackage", "binRealPath", "packageName", "nodeModules", "npmPrefixFromSelfPath", "selfRealPath", "npmPrefixInstallCommand", "prefix", "formatUpdateCommand", "command", "token", "underEnvDir", "env", "key", "dir", "WRAPPER_MATCHERS", "TREE_MATCHERS", "NPM_UPDATE_COMMAND", "detectInstallManager", "input", "lazyNpmRoot", "toInfo", "hit", "matches", "test", "wrapper", "derivedPrefix", "tree", "npmRoot", "isLocalNodeModulesInstall", "cwd", "realpathSync", "path", "safeRealpath", "dir", "execFileSync", "process", "NPM_ROOT_TIMEOUT_MS", "defaultLazyNpmRoot", "trimmed"]
-}

package/dist/chunk-7POMR4QK.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/lib/pm-env/pm-env.ts"],
-  "sourcesContent": ["/**\n * `env` minus every package-manager marker a spawned child could mistake for a throwaway install:\n * the whole `npm_*` block plus `PNPM_SCRIPT_SRC_DIR`. The result makes the child look exactly like\n * a direct `node <pkg>/dist/cli.js` run \u2014 which it is.\n */\n// Any child we launch through `node <bin>` (the portless driver, self-update, the mcp launcher)\n// inherits our env, and a tool that sniffs those markers will conclude it was run via `npx`/`pnpm\n// dlx` and refuse to work. portless is the motivating case; its guard (cli.js `main()`) is:\n//\n//     isNpx     = npm_command === 'exec' && !npm_lifecycle_event\n//     isPnpmDlx = !!PNPM_SCRIPT_SRC_DIR  && !npm_lifecycle_event\n//     if ((isNpx || isPnpmDlx) && !isLocallyInstalled()) -> abort\n//\n// `isLocallyInstalled()` walks up from the CHILD's cwd, so in a consumer repo (where portless is a\n// transitive dep of infra-kit, absent from the root `node_modules`) it is false and the guard is\n// live. `pnpm exec infra-kit dev` exports `npm_command=exec` with no lifecycle event, so `isNpx`\n// holds, every portless call exits 1, `isAvailable()` is false, and `ensureProxy` aborts the whole\n// dev boot with \"portless is not installed\", on a machine where it plainly is.\n//\n// `PNPM_SCRIPT_SRC_DIR` must be dropped ALONGSIDE the `npm_*` block, not left behind: it is set by\n// `pnpm run <script>`, where `npm_lifecycle_event` is what suppresses `isPnpmDlx`. Stripping only\n// `npm_*` removes that suppressor and creates an abort for the script-style invocation that\n// previously worked. Both markers go, or neither is safe.\nexport const withoutPackageManagerEnv = (env: NodeJS.ProcessEnv): NodeJS.ProcessEnv => {\n  return Object.fromEntries(\n    Object.entries(env).filter(([key]) => {\n      return !key.startsWith('npm_') && key !== 'PNPM_SCRIPT_SRC_DIR'\n    }),\n  )\n}\n\n/**\n * npm's own configuration \u2014 as opposed to the npx/dlx *markers* above. Case-insensitive because npm reads\n * `npm_config_*` case-insensitively (its parser matches `/^npm_config_/i`) and real environments export\n * both forms: shells write the lowercase name, Dockerfiles and CI images overwhelmingly write the\n * uppercase one.\n */\nconst NPM_CONFIG_TO_PRESERVE = /^npm_config_(?:prefix|registry)$/i\n\n/**\n * The env for spawning a package-manager INSTALL: npx/dlx markers stripped, but npm's own config\n * kept \u2014 specifically `npm_config_prefix` and `npm_config_registry`.\n *\n * @example\n * packageManagerInstallEnv({ npm_command: 'exec', npm_config_prefix: '/p', PATH: '/bin' })\n * // => { npm_config_prefix: '/p', PATH: '/bin' }\n */\n// `withoutPackageManagerEnv` is deliberately a blunt `npm_*` prefix filter, and it is the\n// right tool for the portless driver \u2014 but it is the WRONG tool for spawning an install, because it\n// also drops the two variables that tell the package manager where, and from where, to install:\n//\n//   - `npm_config_prefix` is the npm matcher's ONLY signal (see `install-manager.ts`). Strip it and\n//     we detect a global install rooted at prefix P, then run the install with P erased \u2014 so it\n//     lands in the DEFAULT prefix instead. That is either a permanent EACCES, or a second global\n//     copy that is not the one on PATH. Nothing notices: the install exits 0, we report\n//     `installed`, the version on PATH never moves, and the whole cycle repeats every window\n//     forever. `export npm_config_prefix=~/.npm-global` is npm's own documented EACCES workaround,\n//     so this is a mainstream layout, not an exotic one.\n//   - `npm_config_registry` is what the update CHECK already used to pick a registry. Dropping it\n//     here means we decide against a corporate mirror and then install from somewhere else.\n//\n// Preserving these cannot re-arm the dlx guard: that guard reads `npm_command`,\n// `npm_lifecycle_event` and `PNPM_SCRIPT_SRC_DIR` \u2014 none of which are npm config, and all of which\n// remain stripped.\nexport const packageManagerInstallEnv = (env: NodeJS.ProcessEnv): NodeJS.ProcessEnv => {\n  const sanitised = withoutPackageManagerEnv(env)\n\n  for (const [key, value] of Object.entries(env)) {\n    if (NPM_CONFIG_TO_PRESERVE.test(key)) sanitised[key] = value\n  }\n\n  return sanitised\n}\n"],
-  "mappings": "AAuBO,IAAMA,EAA4BC,GAChC,OAAO,YACZ,OAAO,QAAQA,CAAG,EAAE,OAAO,CAAC,CAACC,CAAG,IACvB,CAACA,EAAI,WAAW,MAAM,GAAKA,IAAQ,qBAC3C,CACH,EASIC,EAAyB,oCA2BlBC,EAA4BH,GAA8C,CACrF,IAAMI,EAAYL,EAAyBC,CAAG,EAE9C,OAAW,CAACC,EAAKI,CAAK,IAAK,OAAO,QAAQL,CAAG,EACvCE,EAAuB,KAAKD,CAAG,IAAGG,EAAUH,CAAG,EAAII,GAGzD,OAAOD,CACT",
-  "names": ["withoutPackageManagerEnv", "env", "key", "NPM_CONFIG_TO_PRESERVE", "packageManagerInstallEnv", "sanitised", "value"]
-}

package/dist/chunk-D4UYDBN5.js

@@ -1,3 +0,0 @@
-import T from"node:crypto";import r from"node:fs";import F from"node:os";import n from"node:path";import A from"node:process";var V="env-load.sh",a="env-clear.sh",p="projects",O=7200,E="INFRA_KIT_SESSION",m="INFRA_KIT_ENV",C="INFRA_KIT_ENV_CONFIG",D="INFRA_KIT_ENV_PROJECT",S="INFRA_KIT_ENV_PROJECT_ROOT",K="INFRA_KIT_ENV_LOADED_AT",g="INFRA_KIT_ENV_AUTOLOADED",x="INFRA_KIT_ENV_CLEARED",I=/^([A-Z_]\w*)=/i,L=(t,e)=>{let o=e;for(let _=0;_<t.length;_++){if(!o&&t[_]==="\\"){_++;continue}t[_]==="'"&&(o=!o)}return o},h=t=>{if(!r.existsSync(t))return[];let e=r.readFileSync(t,"utf-8"),o=[],_=!1;for(let s of e.split(`
-`)){if(!_){let c=I.exec(s);c&&o.push(c[1])}_=L(s,_)}return o},R=()=>{let t=A.env.XDG_CACHE_HOME,e=t&&t.length>0?t:n.join(F.homedir(),".cache");return n.join(e,"infra-kit")},f=()=>{let t=A.env[E];if(!t)throw new Error(`${E} is not set. Run \`infra-kit setup --skip-tools\` then \`source ~/.zshrc\`.`);return n.join(R(),t)},N=t=>T.createHash("sha256").update(t,"utf8").digest("hex"),i=()=>n.join(R(),p),u=t=>n.join(i(),N(t)),l=(t,e,o)=>{let _=`${t}.tmp.${A.pid}`;r.writeFileSync(_,e,{mode:o});try{r.renameSync(_,t)}catch(s){throw r.rmSync(_,{force:!0}),s}},y="-worktrees";export{V as a,a as b,O as c,E as d,m as e,C as f,D as g,S as h,K as i,g as j,x as k,h as l,R as m,f as n,i as o,u as p,l as q,y as r};
-//# sourceMappingURL=chunk-D4UYDBN5.js.map

package/dist/chunk-D4UYDBN5.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/lib/constants/constants.ts"],
-  "sourcesContent": ["import crypto from 'node:crypto'\nimport fs from 'node:fs'\nimport os from 'node:os'\nimport path from 'node:path'\nimport process from 'node:process'\n\nexport const ENV_LOAD_FILE = 'env-load.sh'\nexport const ENV_CLEAR_FILE = 'env-clear.sh'\n\n/** Subdir of the cache root holding the project-scoped WARM caches (one dir per\n *  project, keyed by {@link warmCacheKey}). Kept in sync with the zsh block in\n *  init.ts, which reads `$cache_root/projects/$key/env-load.sh`. */\nexport const WARM_CACHE_SUBDIR = 'projects'\n\n/**\n * Default warm-cache TTL in seconds (2h). Governs BOTH the node-side eviction\n * sweep and the zsh-side source gate (`_INFRA_KIT_WARM_TTL` in the shell block);\n * the two MUST stay equal, so this constant is the single source of truth and the\n * shell default is emitted from it. Short by design: a warm file older than this\n * is never sourced (bounds a revoked/rotated secret served at prompt-0) and is\n * deleted on the next write. The background refresh lands in ~1-2s regardless.\n */\nexport const DEFAULT_WARM_TTL_SECONDS = 2 * 60 * 60\n\nexport const INFRA_KIT_SESSION_VAR = 'INFRA_KIT_SESSION'\n/**\n * The active environment/config NAME (e.g. `dev`, `arthur`), exported plainly so\n * non-shell consumers can read it from `process.env`. Notably `infra-kit/vite`'s\n * `infraKitDev()` reads this to interpolate the `<env>` placeholder in cloud proxy\n * targets. Mirrors {@link INFRA_KIT_ENV_CONFIG_VAR} (same value) but is the stable,\n * purpose-named handle for tooling rather than the shell session-metadata var.\n */\nexport const INFRA_KIT_ENV_VAR = 'INFRA_KIT_ENV'\nexport const INFRA_KIT_ENV_CONFIG_VAR = 'INFRA_KIT_ENV_CONFIG'\nexport const INFRA_KIT_ENV_PROJECT_VAR = 'INFRA_KIT_ENV_PROJECT'\n/**\n * Absolute project root (git top-level) the loaded env belongs to. Lets the shell\n * startup gate tell a same-project subshell (skip) from a NEW project (load), so a\n * different project's secrets are never silently kept after `cd`/new shell.\n */\nexport const INFRA_KIT_ENV_PROJECT_ROOT_VAR = 'INFRA_KIT_ENV_PROJECT_ROOT'\nexport const INFRA_KIT_ENV_LOADED_AT_VAR = 'INFRA_KIT_ENV_LOADED_AT'\n/**\n * Marker exported into env-load.sh ONLY when the load was triggered automatically\n * (see lib/env-autoload). Its presence is the sole signal distinguishing an\n * auto-loaded env from a deliberate manual `env-load`, so auto-load never\n * clobbers a manual choice. A manual load unsets it.\n */\nexport const INFRA_KIT_ENV_AUTOLOADED_VAR = 'INFRA_KIT_ENV_AUTOLOADED'\n/**\n * Suppression sentinel exported by env-clear. While set in a shell, cli-invocation\n * auto-load stays silent (a deliberate clear must not be immediately re-loaded).\n * Lifted by a manual `env-load` or a new shell.\n */\nexport const INFRA_KIT_ENV_CLEARED_VAR = 'INFRA_KIT_ENV_CLEARED'\n\n/**\n * Matches a line of the form `KEY=...` where KEY is an env-var identifier\n * (letter or underscore, then word chars). Capture group 1 is the name. Shared\n * between env-load (validation, var counting) and parseVarNamesFromEnvFile.\n */\nexport const ENV_VAR_LINE_PATTERN = /^([A-Z_]\\w*)=/i\n\n/**\n * Track whether a physical line leaves us inside an open single-quoted value,\n * mirroring how `shellSingleQuote` emits values (`'\u2026'`, with literal quotes as\n * `'\\''`). Outside a quote a backslash escapes the next char; inside a quote a\n * `'` closes it. Lets the parser skip the continuation lines of a multiline value.\n */\nconst advanceSingleQuoteState = (line: string, startInQuote: boolean): boolean => {\n  let inQuote = startInQuote\n\n  for (let i = 0; i < line.length; i++) {\n    if (!inQuote && line[i] === '\\\\') {\n      i++\n      continue\n    }\n\n    if (line[i] === \"'\") {\n      inQuote = !inQuote\n    }\n  }\n\n  return inQuote\n}\n\nexport const parseVarNamesFromEnvFile = (filePath: string): string[] => {\n  if (!fs.existsSync(filePath)) return []\n\n  const content = fs.readFileSync(filePath, 'utf-8')\n  const names: string[] = []\n  let inQuote = false\n\n  for (const line of content.split('\\n')) {\n    // Only a line that starts OUTSIDE a quoted value can be a real assignment;\n    // continuation lines of a multiline secret value are skipped.\n    if (!inQuote) {\n      const match = ENV_VAR_LINE_PATTERN.exec(line)\n\n      if (match) {\n        names.push(match[1]!)\n      }\n    }\n\n    inQuote = advanceSingleQuoteState(line, inQuote)\n  }\n\n  return names\n}\n\n/**\n * Root cache dir for infra-kit across all sessions. Resolved from\n * $XDG_CACHE_HOME when set, falling back to ~/.cache/infra-kit. Keep in sync\n * with the shell block emitted by `infra-kit setup` (src/commands/init/init.ts).\n */\nexport const getCacheRoot = (): string => {\n  const xdg = process.env.XDG_CACHE_HOME\n  const base = xdg && xdg.length > 0 ? xdg : path.join(os.homedir(), '.cache')\n\n  return path.join(base, 'infra-kit')\n}\n\nexport const getSessionCacheDir = (): string => {\n  const session = process.env[INFRA_KIT_SESSION_VAR]\n\n  if (!session) {\n    throw new Error(\n      `${INFRA_KIT_SESSION_VAR} is not set. Run \\`infra-kit setup --skip-tools\\` then \\`source ~/.zshrc\\`.`,\n    )\n  }\n\n  return path.join(getCacheRoot(), session)\n}\n\n/**\n * The warm-cache key for a project: the hex SHA-256 of its CANONICAL (realpath'd)\n * directory. This MUST be byte-identical to the zsh block's\n * `printf %s \"$canon\" | shasum -a 256 | cut -c1-64` \u2014 same input string (no\n * trailing newline), same digest, full 64-hex output \u2014 or a warm file written by\n * node is never found by the shell. The shell passes the already-canonicalized\n * dir via `--project-dir`, so node hashes that VERBATIM (it does not re-resolve).\n */\nexport const warmCacheKey = (canonicalProjectDir: string): string => {\n  return crypto.createHash('sha256').update(canonicalProjectDir, 'utf8').digest('hex')\n}\n\n/** Root holding all project-scoped warm caches: `$cacheRoot/projects`. */\nexport const getWarmCacheRoot = (): string => {\n  return path.join(getCacheRoot(), WARM_CACHE_SUBDIR)\n}\n\n/** This project's warm-cache dir: `$cacheRoot/projects/<warmCacheKey>`. */\nexport const getProjectWarmCacheDir = (canonicalProjectDir: string): string => {\n  return path.join(getWarmCacheRoot(), warmCacheKey(canonicalProjectDir))\n}\n\n/**\n * Write content atomically: write to a pid-suffixed temp file in the same\n * directory, then rename. fs.renameSync is atomic on a single filesystem, so\n * concurrent writers can't produce a half-written secret file.\n */\nexport const atomicWriteFileSync = (filePath: string, content: string, mode: number): void => {\n  const tmpPath = `${filePath}.tmp.${process.pid}`\n\n  fs.writeFileSync(tmpPath, content, { mode })\n\n  try {\n    fs.renameSync(tmpPath, filePath)\n  } catch (error) {\n    fs.rmSync(tmpPath, { force: true })\n    throw error\n  }\n}\n\nexport const WORKTREES_DIR_SUFFIX = '-worktrees'\n// eslint-disable-next-line sonarjs/publicly-writable-directories\nexport const LOG_FILE_PATH = '/tmp/mcp-infra-kit.log'\n"],
-  "mappings": "AAAA,OAAOA,MAAY,cACnB,OAAOC,MAAQ,UACf,OAAOC,MAAQ,UACf,OAAOC,MAAU,YACjB,OAAOC,MAAa,eAEb,IAAMC,EAAgB,cAChBC,EAAiB,eAKjBC,EAAoB,WAUpBC,EAA2B,KAE3BC,EAAwB,oBAQxBC,EAAoB,gBACpBC,EAA2B,uBAC3BC,EAA4B,wBAM5BC,EAAiC,6BACjCC,EAA8B,0BAO9BC,EAA+B,2BAM/BC,EAA4B,wBAO5BC,EAAuB,iBAQ9BC,EAA0B,CAACC,EAAcC,IAAmC,CAChF,IAAIC,EAAUD,EAEd,QAASE,EAAI,EAAGA,EAAIH,EAAK,OAAQG,IAAK,CACpC,GAAI,CAACD,GAAWF,EAAKG,CAAC,IAAM,KAAM,CAChCA,IACA,QACF,CAEIH,EAAKG,CAAC,IAAM,MACdD,EAAU,CAACA,EAEf,CAEA,OAAOA,CACT,EAEaE,EAA4BC,GAA+B,CACtE,GAAI,CAACvB,EAAG,WAAWuB,CAAQ,EAAG,MAAO,CAAC,EAEtC,IAAMC,EAAUxB,EAAG,aAAauB,EAAU,OAAO,EAC3CE,EAAkB,CAAC,EACrBL,EAAU,GAEd,QAAWF,KAAQM,EAAQ,MAAM;AAAA,CAAI,EAAG,CAGtC,GAAI,CAACJ,EAAS,CACZ,IAAMM,EAAQV,EAAqB,KAAKE,CAAI,EAExCQ,GACFD,EAAM,KAAKC,EAAM,CAAC,CAAE,CAExB,CAEAN,EAAUH,EAAwBC,EAAME,CAAO,CACjD,CAEA,OAAOK,CACT,EAOaE,EAAe,IAAc,CACxC,IAAMC,EAAMzB,EAAQ,IAAI,eAClB0B,EAAOD,GAAOA,EAAI,OAAS,EAAIA,EAAM1B,EAAK,KAAKD,EAAG,QAAQ,EAAG,QAAQ,EAE3E,OAAOC,EAAK,KAAK2B,EAAM,WAAW,CACpC,EAEaC,EAAqB,IAAc,CAC9C,IAAMC,EAAU5B,EAAQ,IAAIK,CAAqB,EAEjD,GAAI,CAACuB,EACH,MAAM,IAAI,MACR,GAAGvB,CAAqB,6EAC1B,EAGF,OAAON,EAAK,KAAKyB,EAAa,EAAGI,CAAO,CAC1C,EAUaC,EAAgBC,GACpBlC,EAAO,WAAW,QAAQ,EAAE,OAAOkC,EAAqB,MAAM,EAAE,OAAO,KAAK,EAIxEC,EAAmB,IACvBhC,EAAK,KAAKyB,EAAa,EAAGrB,CAAiB,EAIvC6B,EAA0BF,GAC9B/B,EAAK,KAAKgC,EAAiB,EAAGF,EAAaC,CAAmB,CAAC,EAQ3DG,EAAsB,CAACb,EAAkBC,EAAiBa,IAAuB,CAC5F,IAAMC,EAAU,GAAGf,CAAQ,QAAQpB,EAAQ,GAAG,GAE9CH,EAAG,cAAcsC,EAASd,EAAS,CAAE,KAAAa,CAAK,CAAC,EAE3C,GAAI,CACFrC,EAAG,WAAWsC,EAASf,CAAQ,CACjC,OAASgB,EAAO,CACd,MAAAvC,EAAG,OAAOsC,EAAS,CAAE,MAAO,EAAK,CAAC,EAC5BC,CACR,CACF,EAEaC,EAAuB",
-  "names": ["crypto", "fs", "os", "path", "process", "ENV_LOAD_FILE", "ENV_CLEAR_FILE", "WARM_CACHE_SUBDIR", "DEFAULT_WARM_TTL_SECONDS", "INFRA_KIT_SESSION_VAR", "INFRA_KIT_ENV_VAR", "INFRA_KIT_ENV_CONFIG_VAR", "INFRA_KIT_ENV_PROJECT_VAR", "INFRA_KIT_ENV_PROJECT_ROOT_VAR", "INFRA_KIT_ENV_LOADED_AT_VAR", "INFRA_KIT_ENV_AUTOLOADED_VAR", "INFRA_KIT_ENV_CLEARED_VAR", "ENV_VAR_LINE_PATTERN", "advanceSingleQuoteState", "line", "startInQuote", "inQuote", "i", "parseVarNamesFromEnvFile", "filePath", "content", "names", "match", "getCacheRoot", "xdg", "base", "getSessionCacheDir", "session", "warmCacheKey", "canonicalProjectDir", "getWarmCacheRoot", "getProjectWarmCacheDir", "atomicWriteFileSync", "mode", "tmpPath", "error", "WORKTREES_DIR_SUFFIX"]
-}

package/dist/chunk-DHYZ6MBU.js

@@ -1,10 +0,0 @@
-import{a as z}from"./chunk-7POMR4QK.js";import{L as m,X as q,da as H,fa as K,g as U,m as j}from"./chunk-Q4HKBLQG.js";import{execFile as me,execFileSync as de}from"node:child_process";import x from"node:process";var fe=5e3,ge=100,V=2e3,X="/bin/ps",xe=1e3,Y=["-eo","pid=,ppid=,pgid=,lstart="],Z=8<<20,ee=e=>e.split(`
-`).flatMap(r=>{let[t,o,n,...i]=r.trim().split(/\s+/);if(t==null||o==null||n==null)return[];let a=Number(t),c=Number(o),u=Number(n);return!Number.isInteger(a)||!Number.isInteger(c)||!Number.isInteger(u)?[]:[{pid:a,ppid:c,pgid:u,lstart:i.join(" ")}]}),re=e=>{let r=new Map;for(let t of e)t.pid===t.pgid&&r.set(t.pgid,t.lstart);return r},we=(e,r,t)=>{let o=re(r);return oe(e,r,t).flatMap(n=>{let i=o.get(n);return i==null||i===""?[]:[{pgid:n,leaderStart:i}]})},te=(e,r)=>{let t=re(r);return e.flatMap(({pgid:o,leaderStart:n})=>t.get(o)===n?[o]:[])},Q=(e,r)=>te(e,r).flatMap(t=>{try{x.kill(-t,"SIGKILL")}catch{return[]}return[t]}),oe=(e,r,t)=>{let o=new Map;for(let c of r){let u=o.get(c.ppid);u?u.push(c):o.set(c.ppid,[c])}let n=new Set([e]),i=new Set([e]),a=[e];for(let c=0;c<a.length;c+=1)for(let u of o.get(a[c]??-1)??[])i.has(u.pid)||(i.add(u.pid),n.add(u.pgid),a.push(u.pid));return[...n].filter(c=>c>1&&c!==t)},L=()=>{try{return ee(de(X,[...Y],{encoding:"utf8",maxBuffer:Z}))}catch{return[]}},ye=async()=>new Promise(e=>{me(X,[...Y],{encoding:"utf8",maxBuffer:Z},(r,t)=>{e(r?[]:ee(t))})}),Pe=(e,r,t)=>t.some(o=>o.pid===e&&o.ppid===r),A=(e,r)=>{let t=r.find(o=>o.pid===x.pid)?.pgid;return oe(e,r,t)},ne=e=>{try{return x.kill(-e,0),!0}catch{return!1}},I=(e,r)=>{for(let t of e)try{x.kill(-t,r)}catch{}},w=new Set,Se=(e,r,t)=>{let o=A(e,r),n=t.flatMap(i=>te(i,r));return[...new Set([...o,...n])]},se=()=>{let e=L(),r=[...w].map(t=>t());I(Se(x.pid,e,r),"SIGKILL")},be=async e=>new Promise(r=>{setTimeout(r,e)}),N=async(e,r)=>{let t=Date.now()+r,o=e;for(;o.length>0&&Date.now()<t&&(o=o.filter(ne),o.length!==0);)await be(ge);return o};function vr(e,r=fe,t,o=L){e.unref();let n=!1,i=!1,a=[],c=null,u=()=>a;w.add(u);let p=()=>{c&&clearInterval(c),c=null},d=async()=>{await N(a.map(s=>s.pgid),V),w.delete(u)},f=s=>{let l=e.pid;if(l==null||i||n||s.length===0)return;let v=s.find(R=>R.pid===x.pid)?.pgid,h=we(l,s,v);h.length>0&&(a=h)},g=async()=>{e.pid==null||i||n||f(await ye())};f(L()),c=setInterval(()=>{g()},xe),c.unref();let b=s=>{n||t?.(s)};return e.on("exit",(s,l)=>{i=!0,p(),n||(Q(a,o()),d()),b(`exited unexpectedly (code=${s??"null"}, signal=${l??"null"})`)}),e.on("error",s=>{b(`failed to spawn: ${s.message}`)}),{kill:async()=>{n=!0,p();let s=e.pid;if(s==null){w.delete(u);return}if(e.exitCode!==null||e.signalCode!==null){Q(a,o()),await d();return}let l=o();if(l.length>0&&!Pe(s,x.pid,l))return;let v=A(s,l);I(v,"SIGTERM");let h=await N(v,r);if(h.length===0){w.delete(u);return}let R=A(s,o()),J=[...new Set([...h,...R])].filter(ne);I(J,"SIGKILL"),await N(J,V),w.delete(u)}}}import{constants as he}from"node:os";import E from"node:process";var ke=["SIGINT","SIGTERM","SIGHUP"],ve=he.signals,Ee=2,T=e=>128+(ve[e]??Ee),Ce=2e4,Re=e=>{E.exit(e)},Ne=(e,r)=>{E.on(e,r)},Le=(e,r)=>{E.off(e,r)},Ae=(e,r)=>{let t=setTimeout(e,r);return t.unref(),()=>{clearTimeout(t)}},_=e=>{try{E.stderr.write(e)}catch{}},Ie=(e,r)=>{let t=r instanceof Error?`${r.message}
-${r.stack??"(no stack)"}`:String(r);_(`
-\u2717 Teardown failed while handling ${e}: ${t}
-`)},Lr=({onSignal:e,exit:r=Re,register:t=Ne,unregister:o=Le,forceReap:n=se,teardownDeadlineMs:i=Ce,setTimer:a=Ae,describeStall:c=()=>"unknown",fileReport:u=()=>{}})=>{let p=null,d=null,f=new Map,g=()=>{for(let[s,l]of f)o(s,l);f.clear()},b=s=>{if(p!==null){if(s!==p)return;_(`
-\u26A0  Received ${s} again \u2014 force-quitting.
-`),d?.(),n(),g(),r(T(s));return}p=s,d=a(()=>{let l=`
-\u26A0  Teardown deadline exceeded at stage=${c()} after ${i}ms \u2014 force-quitting.
-`;_(l),u(l),n(),g(),r(T(s))},i),(async()=>{try{await e(s)}catch(l){Ie(s,l)}finally{d?.(),g(),r(T(s))}})()};for(let s of ke){let l=()=>b(s);f.set(s,l),t(s,l)}return g};import Te from"node:process";import{$ as O}from"zx";var _e=async()=>{try{return await O`cmux --version`.quiet(),!0}catch{return!1}},Oe=async e=>{let{cwd:r,title:t,layout:o}=e,n=JSON.stringify(o),a=(await O({env:{...Te.env,CMUX_QUIET:"1"}})`cmux new-workspace --name ${t} --cwd ${r} --focus false --layout ${n}`).stdout;return Me(a)},De=async e=>{try{await O`cmux close-workspace --workspace ${e}`.quiet()}catch(r){m.debug({error:r,ref:e},"cmux: skipped closing dev workspace")}},Me=e=>{let r=e.match(/workspace:\d+/);if(!r)throw new Error("cmux: could not locate workspace ref in new-workspace output");return r[0]};import{$ as Ge}from"zx";import{realpath as $e}from"node:fs/promises";import{$ as ie}from"zx";var C=async e=>{try{return await $e(e)}catch{return e}},D=async()=>{try{let[e,r]=await Promise.all([ie`cmux workspace list --json`.quiet(),ie`cmux workspace-group list --json`.quiet()]),t=JSON.parse(e.stdout).workspaces??[],o=JSON.parse(r.stdout).groups??[],n=new Set(o.map(a=>a.anchor_workspace_ref).filter(a=>typeof a=="string")),i=new Map;for(let a of t)!a.current_directory||n.has(a.ref)||i.set(await C(a.current_directory),a.ref);return i}catch(e){return m.debug({error:e},"cmux: skipped listing workspaces by cwd"),new Map}};var We=async e=>{try{let t=(await D()).get(await C(e));if(!t)return;await Ge`cmux workspace close ${t}`.quiet()}catch(r){m.debug({error:r,cwd:e},"cmux: skipped closing workspace by cwd")}};import{$ as M}from"zx";var ae=async e=>{try{let r=(await M`cmux workspace-group list --json`.quiet()).stdout;return(JSON.parse(r).groups??[]).find(n=>n.name===e)?.ref??null}catch(r){return m.debug({error:r,name:e},"cmux: skipped group lookup"),null}},Be=async(e,r)=>{try{let o=(await M`cmux workspace-group create --name ${e} --from ${r.join(",")}`).stdout.match(/workspace_group:\d+/)?.[0]??await ae(e);return o&&await M`cmux workspace-group pin ${o}`.quiet(),o??null}catch(t){return m.warn({error:t,name:e},"\u26A0\uFE0F cmux: failed to create workspace group"),null}};import{$ as y}from"zx";var Fe=async e=>{let{cwd:r,title:t,group:o}=e,n=H(await K()),i=o?(await y`cmux workspace create --cwd ${r} --group ${o} --group-placement end`).stdout:(await y`cmux workspace create --cwd ${r}`).stdout,a=Ue(i),c=(await y`cmux list-pane-surfaces --workspace ${a}`).stdout,u=Je(c);return await y`cmux new-split right --workspace ${a} --surface ${u}`,n==="three-pane"&&await y`cmux new-split down --workspace ${a} --surface ${u}`,t&&await y`cmux workspace rename --workspace ${a} --title ${t}`,a},Je=e=>{let r=e.match(/surface:\d+/);if(!r)throw new Error("cmux: could not locate initial surface in list-pane-surfaces output");return r[0]},Ue=e=>{let r=e.match(/workspace:\d+/);if(!r)throw new Error("cmux: could not locate workspace ref in workspace create output");return r[0]};var je=e=>{let{branch:r}=e,t=U(r);return t?j(t):r};var qe=new Set(["ExitPromptError","AbortPromptError","PromptCancelledError"]),ce=e=>e instanceof Error&&qe.has(e.name),nt=e=>{if(ce(e))return!0;let r=e?.cause;return ce(r)};import{loadDev as He}from"@slip-stream-kit/config/internal";import Ke from"node:path";var ze=(e,r)=>{let t=new Set;for(let o of Object.values(e))for(let n of Object.keys(q(o,r).proxy))t.add(n);return[...t]},Ve=async(e,r)=>{let t={},o=[];return await Promise.all(r.map(async n=>{try{let a=(await He(Ke.join(e,"apps",n,"ui")))?.proxy?.routes;if(!a)return;t[n]=Object.fromEntries(Object.entries(a).map(([c,u])=>[c,u.packageName]))}catch(i){o.push({app:n,message:i instanceof Error?i.message:String(i)})}})),{routePkg:(n,i)=>t[n]?.[i],loadErrors:o}},ut=async(e,r,t,o)=>{let{routePkg:n,loadErrors:i}=await Ve(e,ze(r,t));return{ctx:{discovered:t,apiPkgByApp:Object.fromEntries(o.map(a=>[a.name,a.packageName])),routePkg:n},loadErrors:i}};import{execFile as Qe}from"node:child_process";import{createHash as Xe}from"node:crypto";import{existsSync as ue,readFileSync as k}from"node:fs";import Ye from"node:http";import Ze from"node:https";import er from"node:net";import{homedir as rr}from"node:os";import{dirname as $,join as P}from"node:path";import S from"node:process";import tr from"node:tls";import{fileURLToPath as or}from"node:url";import{promisify as nr}from"node:util";var sr=nr(Qe),ir=e=>{let r=JSON.parse(k(e,"utf-8")),t=typeof r.bin=="string"?r.bin:r.bin?.portless;return t==null||t===""?null:t},ar=()=>{try{let e=$(or(import.meta.url));for(;;){let r=P(e,"node_modules","portless","package.json");if(ue(r)){let o=ir(r);return o==null?null:P($(r),o)}let t=$(e);if(t===e)return null;e=t}}catch{return null}},G,le=()=>(G===void 0&&(G=ar()),G),cr=/^[\w@%+=:,./-]+$/,ur="'\\''",lr=e=>cr.test(e)?e:`'${e.replaceAll("'",ur)}'`,vt=(e,r)=>{let t=[r.execPath??S.execPath,r.bin,...e];return(r.sudo===!0?"sudo ":"")+t.map(lr).join(" ")},pr=1500,W=1500,mr="x-portless",B="127.0.0.1",dr="localhost",fr="/Library/LaunchDaemons/sh.portless.proxy.plist",gr="/etc/systemd/system/portless.service",xr=(e=ue)=>{try{return S.platform==="darwin"?e(fr)?"yes":"no":S.platform==="linux"?e(gr)?"yes":"no":"unknown"}catch{return"unknown"}},wr=e=>new Promise(r=>{let t=er.connect({host:B,port:e}),o=n=>{t.destroy(),r(n)};t.setTimeout(W),t.once("connect",()=>{o(!0)}),t.once("timeout",()=>{o(!1)}),t.once("error",()=>{o(!1)})}),yr=(e,r)=>new Promise(t=>{let n=(r?Ze.request:Ye.request)({host:B,port:e,method:"HEAD",path:"/",timeout:W,...r?{rejectUnauthorized:!1,servername:dr}:{}},i=>{i.resume(),t(i.headers[mr]==="1")});n.on("error",()=>{t(!1)}),n.on("timeout",()=>{n.destroy(),t(!1)}),n.end()}),Pr=async(e,{timeoutMs:r})=>{let t=le();if(t==null)throw new Error("portless is not installed (not resolvable from node_modules)");await sr(S.execPath,[t,...e],{signal:AbortSignal.timeout(r),encoding:"utf-8",env:z(S.env)})},F=()=>S.env.PORTLESS_STATE_DIR??P(rr(),".portless"),Sr="ca.pem",br="ca.trusted",pe=()=>P(F(),Sr),Et=()=>{try{let e=k(P(F(),br),"utf-8").trim();return e===""?!1:Xe("sha256").update(k(pe())).digest("hex")===e.toLowerCase()}catch{return!1}},Ct=(e,r)=>new Promise(t=>{let o;try{o=k(pe())}catch{t({ok:!1,code:"ENOENT"});return}let n=tr.connect({host:B,port:e,servername:r,ca:[o],rejectUnauthorized:!0},()=>{let i=n.authorizationError,a=n.authorized;n.destroy(),t(a?{ok:!0}:{ok:!1,code:i?.code??i?.message??"UNKNOWN"})});n.setTimeout(W),n.once("timeout",()=>{n.destroy(),t({ok:!1,code:"ETIMEDOUT"})}),n.once("error",i=>{n.destroy(),t({ok:!1,code:i.code??"UNKNOWN"})})}),Rt=()=>{try{let e=JSON.parse(k(P(F(),"routes.json"),"utf-8"));return Array.isArray(e)?e.flatMap(r=>{let{hostname:t,port:o}=r??{};return typeof t!="string"||t===""||typeof o!="number"?[]:[{name:t,port:o}]}):[]}catch{return[]}},Nt=(e={})=>{let r=e.bin===void 0?le():e.bin,t=e.run??Pr,o=e.isListening??wr,n=e.isProxyServing??yr,i=e.isServiceInstalled??xr,a=e.timeoutMs??pr,c=null,u=async s=>{try{return await t(s,{timeoutMs:a}),!0}catch{return!1}},p=async()=>(c??=await u(["--version"]),c);return{binPath:()=>r,isAvailable:p,isProxyServing:async(s,l)=>!await p()||!await o(s)?!1:n(s,l),probeProxy:async(s,l)=>await o(s)?await n(s,l)?"serving":"not-portless":"daemon-down",isServiceInstalled:i,registerAlias:async(s,l)=>await p()?u(["alias",s,String(l)]):!1,removeAlias:async s=>{await p()&&await u(["alias","--remove",s])}}};export{ut as a,ar as b,vt as c,wr as d,yr as e,pe as f,Et as g,Ct as h,Rt as i,Nt as j,se as k,vr as l,T as m,Lr as n,C as o,D as p,We as q,ae as r,Be as s,_e as t,Oe as u,De as v,Fe as w,je as x,nt as y};
-//# sourceMappingURL=chunk-DHYZ6MBU.js.map