infra-kit 0.5.5 → 0.5.6

package/dist/{chunk-QJQQ7ENL.js → chunk-XN7VHD7P.js}

@@ -1,4 +1,4 @@
-import{a as Yo,c as fe,d as b,e as Nt,f as ae,i as h,j as rn,k as A,l as V}from"./chunk-QUXDC3A3.js";import{a as Pc,b as Sc,c as Tc,d as qo,e as Ot,f as Cc,g as Ac,h as Ic,i as $c,j as is,k as Dc,n as Mc,p as hr,q as qe,r as nn,s as sn,t as an,x as qr,y as cn,z as Ce}from"./chunk-744Y674Y.js";import{A as Ho,B as Dt,C as ts,D as zo,E as fc,F as gc,G as os,H as ns,I as hc,L as l,M as vc,N as ze,O as yc,P as ss,Q as ke,S as H,T as P,U as kc,V as Vr,X as wc,Z as bc,a as Go,b as g,d as J,e as ic,ea as Rc,f as Ko,g as j,h as me,ha as Ec,i as ye,j as ac,k as rs,l as U,m as L,n as ur,o as cc,p as Ue,q as ne,r as R,s as He,t as Br,u as lc,v as pc,w as dc,x as uc,y as mc,z as Uo}from"./chunk-LCNORKDV.js";import{a as se,c as Nc,d as tn,e as as,f as jc,k as on}from"./chunk-GF2CA4CD.js";import{b as xc}from"./chunk-XJOY7J3G.js";import{a as ie,b as Zo,c as _t,d as Oc,e as Xo,f as Gr,g as Kr,h as Qo,i as Ur,j as mr,k as Hr,l as en,o as zr,p as _c,q as fr,r as gr,s as Z}from"./chunk-PQG63EIV.js";import yl from"node:process";import{z as le}from"zod";import Vc from"node:fs";import Yr from"node:path";import{packageConfigSchema as Su}from"@slip-stream-kit/config/internal";import Lc from"node:fs/promises";import ds from"node:path";import{pathToFileURL as Tu}from"node:url";import{z as Cu}from"zod";import Fc from"node:path";var jt=["frontend","backend","lib","e2e","mobile"],wu={ui:"frontend",api:"backend",tests:"e2e"},bu="mobile-app",Ru=[{type:"e2e",packages:["@playwright/test"]},{type:"mobile",packages:["@capacitor/core","@capacitor/cli"]},{type:"backend",packages:["serverless"]}],Eu=(e,r)=>{let t=Fc.relative(r,e).split(Fc.sep).filter(s=>s!==""&&s!=="."),[o,,n]=t;if(t.length===3&&o==="apps"&&n!==void 0){let s=wu[n];if(s)return s}return t.at(-1)===bu?"mobile":null},Pu=e=>{let r=new Set([...Object.keys(e.dependencies??{}),...Object.keys(e.devDependencies??{}),...Object.keys(e.peerDependencies??{})]);for(let o of Ru)if(o.packages.some(n=>r.has(n)))return o.type;return r.has("vite")&&r.has("react")&&!!e.scripts?.dev?"frontend":null},cs=({packageDir:e,repoRoot:r,pkgJson:t,declaredType:o})=>o??Eu(e,r)??Pu(t)??"lib";var Ye={requiredScripts:["build","ts-check","eslint-check","prettier-check","test"],requiredFiles:["tsconfig.json","eslint.config.js","readme.md"],turboTasks:[]},ls={requiredScripts:["build","dev","test","qa","infra-kit-check","fix"],requiredFiles:["turbo.json","pnpm-workspace.yaml"],turboTasks:["build","test","ts-check","eslint-check","prettier-check","infra-kit-check"]},ps=(e,r=Ye)=>({requiredScripts:e.requiredScripts??[...r.requiredScripts],requiredFiles:e.requiredFiles??[...r.requiredFiles],turboTasks:e.turbo?.requiredTasks??[...r.turboTasks]});import xu from"node:fs/promises";var we=async e=>{try{return await xu.access(e),!0}catch{return!1}};var Ae="infra-kit.config.ts",Mt=async e=>{try{let r=await Lc.readFile(ds.join(e,"package.json"),"utf-8");return JSON.parse(r)}catch{return{}}},Wc=async e=>{let r=await Lc.stat(e),n=(await import(`${Tu(e).href}?mtime=${Number(r.mtimeMs)}`)).default;if(n===void 0)throw new Error(`${Ae} at ${e} has no default export`);return typeof n=="function"?await n():n},Ft=async e=>{let r=ds.join(e,Ae);if(await we(r))try{let o=(await Wc(r))?.type;return jt.find(n=>n===o)}catch{return}},Lt=async(e,r=Ye)=>{let t=ds.join(e,Ae);if(!await we(t))throw new Error(`${Ae} not found at ${t}`);let o=await Wc(t),n=Su.safeParse(o);if(!n.success)throw new Error(`Invalid ${Ae} at ${t}: ${Cu.prettifyError(n.error)}`);return ps(n.data,r)};import Jc from"node:fs/promises";import ln from"node:path";import Au from"yaml";var Iu="pnpm-workspace.yaml",$u=async e=>(await Jc.readdir(e,{withFileTypes:!0}).catch(()=>[])).filter(t=>t.isDirectory()).map(t=>ln.join(e,t.name)),Du=async(e,r)=>{let t=[];for(let o of e){if(r==="*"){t.push(...await $u(o));continue}let n=ln.join(o,r);await we(n)&&t.push(n)}return t},Ou=async(e,r)=>{let t=[e];for(let o of r.split("/"))t=await Du(t,o);return t},Q=async e=>{let r=await Jc.readFile(ln.join(e,Iu),"utf-8"),o=((Au.parse(r)??{}).packages??[]).filter(s=>!s.startsWith("!")&&!s.startsWith("vendor")),n=new Set;for(let s of o){let i=await Ou(e,s);for(let a of i)await we(ln.join(a,"package.json"))&&n.add(a)}return[...n].sort()};import Wt from"node:path";var Jt=async e=>{let r=Wt.resolve(e);for(;r!==Wt.dirname(r);){if(await we(Wt.join(r,"package.json")))return r;r=Wt.dirname(r)}if(await we(Wt.join(r,"package.json")))return r;throw new Error(`No package.json found in or above ${e} \u2014 cd into a package directory, or pass --root to audit a monorepo root`)};var be=(e,r,t)=>{let o=e.indexOf(r),n=e.indexOf(t);return o!==-1&&n!==-1&&n>=o},Ze=(e,r,t)=>{let o=e.indexOf(r),n=e.indexOf(t);if(o===-1||n===-1||n<o)return null;let s=e.slice(0,o).replace(/\n+$/,""),i=e.slice(n+t.length).replace(/^\n+/,"");return s+(i?`
+import{a as Yo,c as fe,d as b,e as Nt,f as ae,i as h,j as rn,k as A,l as V}from"./chunk-QUXDC3A3.js";import{a as Pc,b as Sc,c as Tc,d as qo,e as Ot,f as Cc,g as Ac,h as Ic,i as $c,j as is,k as Dc,n as Mc,p as hr,q as qe,r as nn,s as sn,t as an,x as qr,y as cn,z as Ce}from"./chunk-744Y674Y.js";import{A as Ho,B as Dt,C as ts,D as zo,E as fc,F as gc,G as os,H as ns,I as hc,L as l,M as vc,N as ze,O as yc,P as ss,Q as ke,S as H,T as P,U as kc,V as Vr,X as wc,Z as bc,a as Go,b as g,d as J,e as ic,ea as Rc,f as Ko,g as j,h as me,ha as Ec,i as ye,j as ac,k as rs,l as U,m as L,n as ur,o as cc,p as Ue,q as ne,r as R,s as He,t as Br,u as lc,v as pc,w as dc,x as uc,y as mc,z as Uo}from"./chunk-LCNORKDV.js";import{a as se,c as Nc,d as tn,e as as,f as jc,k as on}from"./chunk-Y5TLBGZT.js";import{b as xc}from"./chunk-XJOY7J3G.js";import{a as ie,b as Zo,c as _t,d as Oc,e as Xo,f as Gr,g as Kr,h as Qo,i as Ur,j as mr,k as Hr,l as en,o as zr,p as _c,q as fr,r as gr,s as Z}from"./chunk-PQG63EIV.js";import yl from"node:process";import{z as le}from"zod";import Vc from"node:fs";import Yr from"node:path";import{packageConfigSchema as Su}from"@slip-stream-kit/config/internal";import Lc from"node:fs/promises";import ds from"node:path";import{pathToFileURL as Tu}from"node:url";import{z as Cu}from"zod";import Fc from"node:path";var jt=["frontend","backend","lib","e2e","mobile"],wu={ui:"frontend",api:"backend",tests:"e2e"},bu="mobile-app",Ru=[{type:"e2e",packages:["@playwright/test"]},{type:"mobile",packages:["@capacitor/core","@capacitor/cli"]},{type:"backend",packages:["serverless"]}],Eu=(e,r)=>{let t=Fc.relative(r,e).split(Fc.sep).filter(s=>s!==""&&s!=="."),[o,,n]=t;if(t.length===3&&o==="apps"&&n!==void 0){let s=wu[n];if(s)return s}return t.at(-1)===bu?"mobile":null},Pu=e=>{let r=new Set([...Object.keys(e.dependencies??{}),...Object.keys(e.devDependencies??{}),...Object.keys(e.peerDependencies??{})]);for(let o of Ru)if(o.packages.some(n=>r.has(n)))return o.type;return r.has("vite")&&r.has("react")&&!!e.scripts?.dev?"frontend":null},cs=({packageDir:e,repoRoot:r,pkgJson:t,declaredType:o})=>o??Eu(e,r)??Pu(t)??"lib";var Ye={requiredScripts:["build","ts-check","eslint-check","prettier-check","test"],requiredFiles:["tsconfig.json","eslint.config.js","readme.md"],turboTasks:[]},ls={requiredScripts:["build","dev","test","qa","infra-kit-check","fix"],requiredFiles:["turbo.json","pnpm-workspace.yaml"],turboTasks:["build","test","ts-check","eslint-check","prettier-check","infra-kit-check"]},ps=(e,r=Ye)=>({requiredScripts:e.requiredScripts??[...r.requiredScripts],requiredFiles:e.requiredFiles??[...r.requiredFiles],turboTasks:e.turbo?.requiredTasks??[...r.turboTasks]});import xu from"node:fs/promises";var we=async e=>{try{return await xu.access(e),!0}catch{return!1}};var Ae="infra-kit.config.ts",Mt=async e=>{try{let r=await Lc.readFile(ds.join(e,"package.json"),"utf-8");return JSON.parse(r)}catch{return{}}},Wc=async e=>{let r=await Lc.stat(e),n=(await import(`${Tu(e).href}?mtime=${Number(r.mtimeMs)}`)).default;if(n===void 0)throw new Error(`${Ae} at ${e} has no default export`);return typeof n=="function"?await n():n},Ft=async e=>{let r=ds.join(e,Ae);if(await we(r))try{let o=(await Wc(r))?.type;return jt.find(n=>n===o)}catch{return}},Lt=async(e,r=Ye)=>{let t=ds.join(e,Ae);if(!await we(t))throw new Error(`${Ae} not found at ${t}`);let o=await Wc(t),n=Su.safeParse(o);if(!n.success)throw new Error(`Invalid ${Ae} at ${t}: ${Cu.prettifyError(n.error)}`);return ps(n.data,r)};import Jc from"node:fs/promises";import ln from"node:path";import Au from"yaml";var Iu="pnpm-workspace.yaml",$u=async e=>(await Jc.readdir(e,{withFileTypes:!0}).catch(()=>[])).filter(t=>t.isDirectory()).map(t=>ln.join(e,t.name)),Du=async(e,r)=>{let t=[];for(let o of e){if(r==="*"){t.push(...await $u(o));continue}let n=ln.join(o,r);await we(n)&&t.push(n)}return t},Ou=async(e,r)=>{let t=[e];for(let o of r.split("/"))t=await Du(t,o);return t},Q=async e=>{let r=await Jc.readFile(ln.join(e,Iu),"utf-8"),o=((Au.parse(r)??{}).packages??[]).filter(s=>!s.startsWith("!")&&!s.startsWith("vendor")),n=new Set;for(let s of o){let i=await Ou(e,s);for(let a of i)await we(ln.join(a,"package.json"))&&n.add(a)}return[...n].sort()};import Wt from"node:path";var Jt=async e=>{let r=Wt.resolve(e);for(;r!==Wt.dirname(r);){if(await we(Wt.join(r,"package.json")))return r;r=Wt.dirname(r)}if(await we(Wt.join(r,"package.json")))return r;throw new Error(`No package.json found in or above ${e} \u2014 cd into a package directory, or pass --root to audit a monorepo root`)};var be=(e,r,t)=>{let o=e.indexOf(r),n=e.indexOf(t);return o!==-1&&n!==-1&&n>=o},Ze=(e,r,t)=>{let o=e.indexOf(r),n=e.indexOf(t);if(o===-1||n===-1||n<o)return null;let s=e.slice(0,o).replace(/\n+$/,""),i=e.slice(n+t.length).replace(/^\n+/,"");return s+(i?`
 ${i}`:"")},us=(e,r)=>{let t=e.indexOf(r);if(t===-1)return null;let n=e.slice(t+r.length).match(/^([^\s>]+)/);return n?n[1]:null},Bc=(e,r,t)=>`${e}
 ${r}
 ${t}`,Bt=({content:e,body:r,startMarker:t,endMarker:o,placement:n="replace-in-place"})=>{let s=Bc(t,r,o),i=be(e,t,o);if(n==="replace-in-place"&&i){let p=e.indexOf(t),u=e.indexOf(o)+o.length;return e.slice(0,p)+s+e.slice(u)}let c=(i?Ze(e,t,o)??e:e).replace(/\n+$/,"");return c.length>0?`${c}
@@ -442,4 +442,4 @@ ${e} (${r.length}):`);for(let t of r.slice(0,Za))l.info(`  ${t}`);r.length>Za&&l
 
 ${i.join(`
 `)}`);let a={worktrees:n,count:n.length};return{content:y(JSON.stringify(a,null,2)),structuredContent:a}},tc=k({name:"worktrees-list",description:"List existing release-branch worktrees with version, release type (regular / hotfix), and Jira fix-version description. Read-only.",inputSchema:{},outputSchema:{worktrees:$t.array($t.object({version:$t.string().describe("Release version"),type:$t.enum(["regular","hotfix"]).describe("Release type"),description:$t.string().nullable().describe("Jira version description")})).describe("List of all worktrees with details"),count:$t.number().describe("Number of worktrees")},handler:hu});import{z as Wr}from"zod";var ub=e=>{if(J()){if(e.all)throw new g(void 0,{operation:"remove worktrees",remediation:'name targets explicitly via "versions"; bulk all=true removal is disabled over MCP',stderrExcerpt:"all=true is not permitted for worktrees-remove over MCP"});if(!e.versions)throw new g(void 0,{operation:"remove worktrees",remediation:'pass "versions" (comma-separated release versions/names); the interactive picker needs a TTY',stderrExcerpt:'worktrees-remove over MCP requires "versions"'})}},mb=(e,r)=>{let t=e.filter(o=>!r.includes(o));if(t.length>0)throw new g(void 0,{operation:"remove worktrees",remediation:`no active worktree for: ${t.join(", ")}. Run 'infra-kit worktrees list' to see current worktrees`,stderrExcerpt:`unmatched worktree target(s): ${t.join(", ")}`})},vu=async e=>{let{confirmedCommand:r,all:t,versions:o}=e;await re({operation:"remove worktrees"}),await P(),ub({all:t,versions:o});try{let n=await ne("release");if(n.length===0){l.info("\u2139\uFE0F No active worktrees to remove"),h.print();let u={removedWorktrees:[],failedWorktrees:[],count:0};return{content:y(JSON.stringify(u,null,2)),structuredContent:u}}let s=await R(),i=`${s}${Z}`,a=[];if(t)a=n;else if(o)a=o.split(",").map(u=>ye(me(u.trim())));else{h.setInteractive();let[u,d]=await Promise.all([B(),D()]),m=new Map(d.map(v=>[v.branch,_(v.title)]));a=await St(Y({branches:n,descriptions:u,types:m}),{required:!0})}mb(a,n);let c=a.length===n.length;c?h.addOption("--all",!0):h.addOption("--versions",Dr(a)),await V(r,"Are you sure you want to proceed with these worktree changes?"),r||h.addOption("--yes",!0);let p=await Nr({branches:a,worktreeDir:i,projectRoot:s,pruneFolder:c});return await Lr({projectRoot:s,worktreeDir:i,currentWorktrees:n,removedWorktrees:p.removed,allowEditorRelaunch:!r}),Ro(p),h.print(),Eo({result:p,operation:"remove worktrees"})}catch(n){throw Ce(n)||n instanceof g?n:(l.error({error:n},"\u274C Error managing worktrees"),new g(n,{operation:"remove worktrees",remediation:"check 'git worktree list' for the path; uncommitted changes block removal"}))}},oc=k({name:"worktrees-remove",description:'Remove local git worktrees for the named release branches. Over MCP you MUST pass "versions" (comma-separated); bulk all=true removal is disabled here (it is a one-shot, unconfirmed wipe of every worktree) \u2014 the branch picker and confirmation are unavailable without a TTY. Every named version must be an active worktree, or the call errors without removing anything. What survives: the release branches/commits themselves are never deleted, and the worktrees directory plus its release/feature subfolders are left in place (recreate a worktree with worktrees-add). What is lost: git refuses to remove a worktree with modified tracked files or untracked files, BUT it DOES delete the worktree directory including gitignored contents \u2014 a hydrated .env of Doppler secrets (re-fetch with env-load) and build output such as node_modules/dist (needs reinstall/rebuild). When every worktree is removed it also runs "git worktree prune". A branch git refuses to remove is listed in failedWorktrees and the result carries isError; a leftover that git already unregistered and that holds only tool state (.omc/state, .omc/sessions, .DS_Store) is swept automatically.',requiresHumanConfirm:!0,inputSchema:{versions:Wr.string().describe('Comma-separated release versions or names to remove (e.g. "1.2.5, 1.2.6" or "checkout-redesign, 1.2.5"). Required: each must name an active worktree, or the call errors before removing anything.'),confirm:Wr.boolean().optional().describe("Set true to execute; omit for a dry-run gate that echoes the resolved action.")},outputSchema:{removedWorktrees:Wr.array(Wr.string()).describe("List of removed git worktree branches"),failedWorktrees:Wr.array(Wr.string()).describe("Branches whose worktree could NOT be removed (git refused, or an unsweepable leftover remained)"),count:Wr.number().describe("Number of git worktrees removed")},handler:vu});import{z as Vo}from"zod";var yu=async e=>{let{confirmedCommand:r}=e;await re({operation:"sync worktrees"}),await P();try{let t=await ne("release"),o=await R(),n=`${o}${Z}`,s=await Wn();await V(r,"Are you sure you want to proceed with these worktree changes?"),r||h.addOption("--yes",!0);let{branchesToRemove:i}=fb({releasePRsList:s,currentWorktrees:t}),a=await Nr({branches:i,worktreeDir:n,projectRoot:o});return await Lr({projectRoot:o,worktreeDir:n,currentWorktrees:t,removedWorktrees:a.removed,allowEditorRelaunch:!1}),Ro(a),h.print(),Eo({result:a,operation:"sync worktrees"})}catch(t){throw Ce(t)||t instanceof g?t:(l.error({error:t},"\u274C Error managing worktrees"),new g(t,{operation:"sync worktrees with remote",remediation:"ensure 'gh auth status' is ok and you can reach origin"}))}},fb=e=>{let{releasePRsList:r,currentWorktrees:t}=e;return{branchesToRemove:t.filter(s=>ur(s)).filter(s=>!r.includes(s))}},nc=k({name:"worktrees-sync",description:"Remove worktrees whose release PR is no longer open (stale cleanup). Only removes \u2014 never creates; use worktrees-add to create worktrees for new releases. The CLI confirmation is auto-skipped for MCP calls, so the caller is responsible for gating. A branch git refuses to remove is listed in failedWorktrees and the result carries isError; a leftover that git already unregistered and that holds only tool state (.omc/state, .omc/sessions, .DS_Store) is swept automatically.",inputSchema:{},outputSchema:{removedWorktrees:Vo.array(Vo.string()).describe("List of removed worktree branches"),failedWorktrees:Vo.array(Vo.string()).describe("Branches whose worktree could NOT be removed (git refused, or an unsweepable leftover remained)"),count:Vo.number().describe("Number of worktrees removed during sync")},handler:yu});var gb=[{key:"develop",label:"Develop"},{key:"release",label:"Release Management"},{key:"worktrees",label:"Worktrees"},{key:"environment",label:"Environment"},{key:"configuration",label:"Configuration"},{key:"vendor",label:"Vendor"},{key:"setup",label:"Setup & Diagnostics"}],es=[{cliName:"dev",menuGroup:"develop",mcpTool:null,mcpExposed:!1,mutating:!0,groupPath:["dev"],longRunning:!0},{cliName:"dev-status",menuGroup:"develop",mcpTool:zs,mcpExposed:!0,mutating:!1,groupPath:["dev-status"]},{cliName:"merge-dev",menuGroup:"release",mcpTool:qi,mcpExposed:!0,mutating:!0,groupPath:["release","merge-dev"]},{cliName:"release-list",menuGroup:"release",mcpTool:la,mcpExposed:!0,mutating:!1,groupPath:["release","list"]},{cliName:"release-create",menuGroup:"release",mcpTool:Ra,mcpExposed:!0,mutating:!0,groupPath:["release","create"]},{cliName:"release-desc-edit",menuGroup:"release",mcpTool:Ea,mcpExposed:!0,mutating:!0,groupPath:["release","desc-edit"]},{cliName:"release-deploy-all",menuGroup:"release",mcpTool:ia,mcpExposed:!0,mutating:!0,groupPath:["release","deploy-all"]},{cliName:"release-deploy-selected",menuGroup:"release",mcpTool:ca,mcpExposed:!0,mutating:!0,groupPath:["release","deploy-selected"]},{cliName:"release-deliver",menuGroup:"release",mcpTool:Zi,mcpExposed:!1,mutating:!0,groupPath:["release","deliver"]},{cliName:"release-remove",menuGroup:"release",mcpTool:Oa,mcpExposed:!0,mutating:!0,groupPath:["release","remove"]},{cliName:"local-deploy-all",menuGroup:null,mcpTool:va,mcpExposed:!0,mutating:!0,groupPath:["local","deploy-all"]},{cliName:"local-deploy-selected",menuGroup:null,mcpTool:ya,mcpExposed:!0,mutating:!0,groupPath:["local","deploy-selected"]},{cliName:"worktrees-add",menuGroup:"worktrees",mcpTool:rc,mcpExposed:!0,mutating:!0,groupPath:["worktrees","add"]},{cliName:"worktrees-list",menuGroup:"worktrees",mcpTool:tc,mcpExposed:!0,mutating:!1,groupPath:["worktrees","list"]},{cliName:"reopen",menuGroup:"worktrees",mcpTool:ja,mcpExposed:!0,mutating:!1,groupPath:["reopen"]},{cliName:"worktrees-remove",menuGroup:"worktrees",mcpTool:oc,mcpExposed:!0,mutating:!0,groupPath:["worktrees","remove"]},{cliName:"worktrees-sync",menuGroup:"worktrees",mcpTool:nc,mcpExposed:!0,mutating:!0,groupPath:["worktrees","sync"]},{cliName:"env-status",menuGroup:"environment",mcpTool:Ji,mcpExposed:!0,mutating:!1,groupPath:["env-status"]},{cliName:"env-list",menuGroup:"environment",mcpTool:Wi,mcpExposed:!0,mutating:!1,groupPath:["env-list"]},{cliName:"env-load",menuGroup:"environment",mcpTool:ii,mcpExposed:!0,mutating:!0,groupPath:["env-load"],sessionEnvNotice:!0},{cliName:"env-clear",menuGroup:"environment",mcpTool:Li,mcpExposed:!0,mutating:!0,groupPath:["env-clear"],sessionEnvNotice:!0},{cliName:"env-token-list",menuGroup:"environment",mcpTool:Vi,mcpExposed:!0,mutating:!1,groupPath:["env-token-list"]},{cliName:"config-get",menuGroup:"configuration",mcpTool:Ks,mcpExposed:!0,mutating:!1,groupPath:["config-get"]},{cliName:"config-path",menuGroup:"configuration",mcpTool:null,mcpExposed:!1,mutating:!1,groupPath:["config","path"]},{cliName:"config-edit",menuGroup:"configuration",mcpTool:null,mcpExposed:!1,mutating:!0,groupPath:["config","edit"],entersAltScreen:!0},{cliName:"vendor-check",menuGroup:"vendor",mcpTool:Qa,mcpExposed:!0,mutating:!1,groupPath:["vendor","check"]},{cliName:"vendor-config",menuGroup:"vendor",mcpTool:null,mcpExposed:!1,mutating:!0,groupPath:["vendor","config"]},{cliName:"setup",menuGroup:"setup",mcpTool:Ja,mcpExposed:!0,mutating:!0,groupPath:["setup"]},{cliName:"doctor",menuGroup:"setup",mcpTool:Mi,mcpExposed:!0,mutating:!1,groupPath:["doctor"]},{cliName:"audit",menuGroup:"setup",mcpTool:Gs,mcpExposed:!0,mutating:!1,groupPath:["audit"]},{cliName:"version",menuGroup:"setup",mcpTool:ec,mcpExposed:!0,mutating:!1,groupPath:["version"]},{cliName:"vendor",menuGroup:null,mcpTool:null,mcpExposed:!1,mutating:!1,groupPath:["vendor"]},{cliName:"config",menuGroup:null,mcpTool:null,mcpExposed:!1,mutating:!1,groupPath:["config"]},{cliName:"env-autoload",menuGroup:null,mcpTool:null,mcpExposed:!1,mutating:!0,groupPath:["env-autoload"]},{cliName:"env-token-set",menuGroup:null,mcpTool:null,mcpExposed:!1,mutating:!0,groupPath:["env-token-set"]},{cliName:"env-token-remove",menuGroup:null,mcpTool:null,mcpExposed:!1,mutating:!0,groupPath:["env-token-remove"]},{cliName:"mcp",menuGroup:null,mcpTool:null,mcpExposed:!1,mutating:!1,groupPath:["mcp"]}];var hb={"dev-status":{title:"Dev server status",openWorld:!1},"gh-release-list":{title:"Open releases",openWorld:!0},"worktrees-list":{title:"Release worktrees",openWorld:!0},"env-status":{title:"Loaded environment",openWorld:!1},"env-list":{title:"Available environments",openWorld:!1},"env-token-list":{title:"Doppler service tokens",openWorld:!0},"config-get":{title:"Merged infra-kit config",openWorld:!1},"vendor-check":{title:"Vendor checksum check",openWorld:!1},audit:{title:"Package audit",openWorld:!1},version:{title:"CLI version",openWorld:!1},doctor:{title:"Diagnose this machine",openWorld:!0},setup:{title:"Set up this machine",openWorld:!0},"gh-merge-dev":{title:"Merge dev into release branches",openWorld:!0},"release-create":{title:"Create releases",openWorld:!0},"release-remove":{title:"Remove a release",openWorld:!0},"gh-release-deploy-all":{title:"Deploy all services (CI)",openWorld:!0},"gh-release-deploy-selected":{title:"Deploy selected services (CI)",openWorld:!0},"local-deploy-all":{title:"Deploy all services from this machine",openWorld:!0},"local-deploy-selected":{title:"Deploy selected services from this machine",openWorld:!0},"worktrees-remove":{title:"Remove release worktrees",openWorld:!1},"env-clear":{title:"Clear environment variables",openWorld:!1},"release-desc-edit":{title:"Edit release description",openWorld:!0},"worktrees-add":{title:"Add release worktrees",openWorld:!0},"worktrees-sync":{title:"Prune stale worktrees",openWorld:!0},"env-load":{title:"Load environment variables",openWorld:!0},reopen:{title:"Reopen project windows",openWorld:!1}},vb=["reopen"],yb=()=>es.flatMap(e=>{if(!e.mcpExposed||!e.mcpTool)return[];let r=hb[e.mcpTool.name];if(!r)throw new Error(`No MCP_TOOL_PRESENTATION entry for exposed tool "${e.mcpTool.name}" \u2014 add a title and an evidence-cited openWorld value in command-catalog.ts.`);let t=!e.mutating&&!vb.includes(e.mcpTool.name);return[{...e.mcpTool,title:r.title,annotations:{readOnlyHint:t,...t?{}:{destructiveHint:!0},openWorldHint:r.openWorld}}]}),kb=e=>es.filter(r=>r.menuGroup===e),wb=e=>es.some(r=>r.longRunning===!0&&r.groupPath.join(" ")===e);import sc from"node:process";var bb="MODULE_TYPELESS_PACKAGE_JSON",Rb=(e,r)=>typeof e=="object"&&e!==null?e.code:r,ku=!1,Eb=()=>{if(ku)return;ku=!0;let e=sc.emitWarning.bind(sc);sc.emitWarning=((r,...t)=>{Rb(t[0],t[1])!==bb&&e(r,...t)})};export{y as a,kl as b,wl as c,Hs as d,Rl as e,Lf as f,Qt as g,eo as h,Rr as i,Ax as j,qf as k,Vl as l,Gl as m,mt as n,Kl as o,Ul as p,Cn as q,An as r,Rg as s,hi as t,AT as u,IT as v,yi as w,ki as x,yh as y,_p as z,jp as A,Lp as B,Wp as C,Bi as D,Gp as E,xt as F,$v as G,Zp as H,T$ as I,cd as J,gd as K,At as L,Dy as M,Oy as N,Pd as O,xd as P,Sd as Q,_d as R,Nd as S,Bd as T,Vd as U,Yn as V,qd as W,tw as X,iu as Y,du as Z,uu as _,gu as $,hu as aa,vu as ba,yu as ca,gb as da,es as ea,yb as fa,kb as ga,wb as ha,Eb as ia};
-//# sourceMappingURL=chunk-QJQQ7ENL.js.map
+//# sourceMappingURL=chunk-XN7VHD7P.js.map

package/dist/chunk-Y5TLBGZT.js

@@ -0,0 +1,2 @@
+var j={name:"infra-kit",type:"module",version:"0.5.6",files:["dist"],description:"infra-kit",bin:{"infra-kit":"dist/cli.js",ik:"dist/cli.js","ik-mcp":"dist/mcp-proxy.js"},engines:{node:">=24.x"},scripts:{inspector:"npx @modelcontextprotocol/inspector node ./dist/mcp.js --debug",build:"pnpm run clean-artifacts && node ./scripts/build.js",prepack:"pnpm run build","infra-kit-check":"pnpm exec infra-kit audit","clean-artifacts":"rm -rf dist","clean-cache":"rm -rf node_modules/.cache .eslintcache tsconfig.tsbuildinfo .turbo .swc","prettier-fix":"pnpm exec prettier **/* --write --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore","prettier-check":"pnpm exec prettier **/* --check --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore","eslint-check":"pnpm exec eslint --cache --report-unused-disable-directives ./src","eslint-fix":"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src --fix","ts-check":"tsc --noEmit",test:"pnpm exec vitest run --reporter=minimal","test-watch":"pnpm exec vitest --watch --silent passed-only","test-ui":"pnpm exec vitest --ui --silent passed-only","test-report":"pnpm exec vitest run --coverage --silent passed-only","qa:pty":"INFRA_KIT_REQUIRE_PTY=1 pnpm exec vitest run --reporter=minimal src/tui/__tests__/stdin-pause-pty.test.ts src/entry/__tests__/quit-keys-pty.test.ts src/entry/__tests__/post-run-pause-pty.test.ts",qa:"pnpm run prettier-check && pnpm run eslint-check && pnpm run ts-check && pnpm run test && echo \u2705 Success",fix:"pnpm run prettier-fix && pnpm run eslint-fix && pnpm run qa"},dependencies:{"@aws-lambda-powertools/logger":"^2.35.0","@inquirer/checkbox":"^5.2.5","@inquirer/confirm":"^6.3.2","@inquirer/input":"^5.1.6","@inquirer/password":"^5.2.2","@inquirer/select":"^5.2.5","@modelcontextprotocol/server":"^2.0.0","@slip-stream-kit/config":"^0.5.6",chalk:"^6.0.0",chokidar:"^5.0.0",commander:"^15.0.0",fastify:"^5.12.4",ink:"^7.1.1",pino:"^10.3.1","pino-pretty":"^13.1.3",portless:"^0.15.6",react:"19.3.0",yaml:"^2.9.1",zod:"^4.6.2",zx:"^8.8.5"},devDependencies:{"@modelcontextprotocol/client":"^2.0.0","@modelcontextprotocol/sdk":"^1.30.0","@slip-stream-kit/eslint-plugin":"workspace:*","@types/aws-lambda":"catalog:","@types/react":"catalog:","@wl/eslint-config":"workspace:*","@wl/vitest-config":"workspace:*",esbuild:"^0.28.2","ink-testing-library":"^4.0.0",typescript:"^6.0.3"}};import a from"node:path";var p="infra-kit",i=`${p}@latest`,v=(e,t)=>t===void 0?e:e.map(n=>n===i?`${p}@${t}`:n),d=(e,t,n)=>{let r=a.relative(n(a.resolve(e)),a.resolve(t));return r!==""&&!r.startsWith("..")&&!a.isAbsolute(r)},s=(e,t)=>a.resolve(e).split(a.sep).includes(t),M=(e,t)=>{let n=a.resolve(e).split(a.sep),r=n.indexOf("Cellar");return r!==-1&&n[r+1]===t},S=(e,t)=>{let n=a.resolve(e).split(a.sep),r=n.lastIndexOf("node_modules");return r<2||n[r-1]!=="lib"||n[r+1]!==t?null:n.slice(0,r-1).join(a.sep)||a.sep},b=e=>S(e,p),w=e=>["npm","install","-g","--prefix",e,i],_=e=>e.map(t=>t.includes(" ")?`'${t}'`:t).join(" "),u=(e,t,n,r)=>{let o=e[t];return o!=null&&o!==""&&d(o,n,r)},k=[{manager:"volta",test:({selfRealPath:e,env:t,realpath:n})=>u(t,"VOLTA_HOME",e,n)||s(e,".volta")||s(e,"volta"),updateCommand:["volta","install",p],canSelfSpawn:!0},{manager:"homebrew",test:({selfRealPath:e})=>M(e,p),updateCommand:["brew","upgrade",p],canSelfSpawn:!1}],C=[{manager:"pnpm",test:({selfRealPath:e,env:t,realpath:n})=>u(t,"PNPM_HOME",e,n)||s(e,"pnpm")&&s(e,"global"),updateCommand:["pnpm","add","-g",i],canSelfSpawn:!0},{manager:"bun",test:({selfRealPath:e,env:t,realpath:n})=>u(t,"BUN_INSTALL",e,n)||s(e,".bun"),updateCommand:["bun","add","-g",i],canSelfSpawn:!0},{manager:"yarn",test:({selfRealPath:e})=>s(e,".yarn")||s(e,"yarn")&&s(e,"global"),updateCommand:["yarn","global","add",i],canSelfSpawn:!0},{manager:"npm",test:({selfRealPath:e,env:t,realpath:n})=>u(t,"npm_config_prefix",e,n),updateCommand:["npm","install","-g",i],canSelfSpawn:!0}],I=["npm","install","-g",i],E=e=>{let{selfRealPath:t,env:n,realpath:r,lazyNpmRoot:o,version:m}=e,l=R({selfRealPath:t,env:n,realpath:r,lazyNpmRoot:o});return{...l,updateCommand:v(l.updateCommand,m)}},R=e=>{let{selfRealPath:t,env:n,realpath:r,lazyNpmRoot:o}=e,m=c=>({manager:c.manager,updateCommand:c.updateCommand,canSelfSpawn:c.canSelfSpawn}),l=({test:c})=>c({selfRealPath:t,env:n,realpath:r}),f=k.find(l);if(f)return m(f);let x=b(t);if(x!==null)return{manager:"npm",updateCommand:w(x),canSelfSpawn:!0};let h=C.find(l);if(h)return m(h);let g=o?.();return g!=null&&g!==""&&d(g,t,r)?{manager:"npm",updateCommand:I,canSelfSpawn:!0}:{manager:"unknown",updateCommand:I,canSelfSpawn:!1}},N=(e,t,n)=>s(e,"node_modules")&&d(t,e,n);import{realpathSync as P}from"node:fs";import A from"node:path";var O=e=>{try{return P(e)}catch{return A.resolve(e)}};import{execFileSync as T}from"node:child_process";import q from"node:process";var D=3e3,F=()=>{try{let t=T("npm",["root","-g"],{encoding:"utf-8",timeout:D,stdio:["ignore","pipe","ignore"],shell:q.platform==="win32"}).trim();return t===""?void 0:t}catch{return}};export{j as a,p as b,d as c,s as d,M as e,S as f,_ as g,E as h,N as i,F as j,O as k};
+//# sourceMappingURL=chunk-Y5TLBGZT.js.map

package/dist/chunk-Y5TLBGZT.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../package.json", "../src/lib/install-manager/install-manager.ts", "../src/lib/install-manager/safe-realpath.ts", "../src/lib/install-manager/npm-root.ts"],
+  "sourcesContent": ["{\n  \"name\": \"infra-kit\",\n  \"type\": \"module\",\n  \"version\": \"0.5.6\",\n  \"files\": [\n    \"dist\"\n  ],\n  \"description\": \"infra-kit\",\n  \"bin\": {\n    \"infra-kit\": \"dist/cli.js\",\n    \"ik\": \"dist/cli.js\",\n    \"ik-mcp\": \"dist/mcp-proxy.js\"\n  },\n  \"engines\": {\n    \"node\": \">=24.x\"\n  },\n  \"scripts\": {\n    \"inspector\": \"npx @modelcontextprotocol/inspector node ./dist/mcp.js --debug\",\n    \"build\": \"pnpm run clean-artifacts && node ./scripts/build.js\",\n    \"prepack\": \"pnpm run build\",\n    \"infra-kit-check\": \"pnpm exec infra-kit audit\",\n    \"clean-artifacts\": \"rm -rf dist\",\n    \"clean-cache\": \"rm -rf node_modules/.cache .eslintcache tsconfig.tsbuildinfo .turbo .swc\",\n    \"prettier-fix\": \"pnpm exec prettier **/* --write --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore\",\n    \"prettier-check\": \"pnpm exec prettier **/* --check --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore\",\n    \"eslint-check\": \"pnpm exec eslint --cache --report-unused-disable-directives ./src\",\n    \"eslint-fix\": \"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src --fix\",\n    \"ts-check\": \"tsc --noEmit\",\n    \"test\": \"pnpm exec vitest run --reporter=minimal\",\n    \"test-watch\": \"pnpm exec vitest --watch --silent passed-only\",\n    \"test-ui\": \"pnpm exec vitest --ui --silent passed-only\",\n    \"test-report\": \"pnpm exec vitest run --coverage --silent passed-only\",\n    \"qa:pty\": \"INFRA_KIT_REQUIRE_PTY=1 pnpm exec vitest run --reporter=minimal src/tui/__tests__/stdin-pause-pty.test.ts src/entry/__tests__/quit-keys-pty.test.ts src/entry/__tests__/post-run-pause-pty.test.ts\",\n    \"qa\": \"pnpm run prettier-check && pnpm run eslint-check && pnpm run ts-check && pnpm run test && echo \u2705 Success\",\n    \"fix\": \"pnpm run prettier-fix && pnpm run eslint-fix && pnpm run qa\"\n  },\n  \"dependencies\": {\n    \"@aws-lambda-powertools/logger\": \"^2.35.0\",\n    \"@inquirer/checkbox\": \"^5.2.5\",\n    \"@inquirer/confirm\": \"^6.3.2\",\n    \"@inquirer/input\": \"^5.1.6\",\n    \"@inquirer/password\": \"^5.2.2\",\n    \"@inquirer/select\": \"^5.2.5\",\n    \"@modelcontextprotocol/server\": \"^2.0.0\",\n    \"@slip-stream-kit/config\": \"^0.5.6\",\n    \"chalk\": \"^6.0.0\",\n    \"chokidar\": \"^5.0.0\",\n    \"commander\": \"^15.0.0\",\n    \"fastify\": \"^5.12.4\",\n    \"ink\": \"^7.1.1\",\n    \"pino\": \"^10.3.1\",\n    \"pino-pretty\": \"^13.1.3\",\n    \"portless\": \"^0.15.6\",\n    \"react\": \"19.3.0\",\n    \"yaml\": \"^2.9.1\",\n    \"zod\": \"^4.6.2\",\n    \"zx\": \"^8.8.5\"\n  },\n  \"devDependencies\": {\n    \"@modelcontextprotocol/client\": \"^2.0.0\",\n    \"@modelcontextprotocol/sdk\": \"^1.30.0\",\n    \"@slip-stream-kit/eslint-plugin\": \"workspace:*\",\n    \"@types/aws-lambda\": \"catalog:\",\n    \"@types/react\": \"catalog:\",\n    \"@wl/eslint-config\": \"workspace:*\",\n    \"@wl/vitest-config\": \"workspace:*\",\n    \"esbuild\": \"^0.28.2\",\n    \"ink-testing-library\": \"^4.0.0\",\n    \"typescript\": \"^6.0.3\"\n  }\n}\n", "/**\n * Pure detection of *how* this CLI was installed, so the background updater knows whether it may act at\n * all, and the advisory it prints can name the one command that will actually work. No fs, no spawn, no `process.env` read \u2014 every input is injected, which is\n * what lets the whole matrix be table-tested.\n *\n * Detection is env-first and LAZY: the only signal that costs a subprocess (`npm root -g`) is passed in\n * as `lazyNpmRoot` and consulted solely when every cheaper matcher has missed.\n */\nimport path from 'node:path'\n\n/** The published package this CLI updates itself to. Single source for every suggested argv. */\nexport const PACKAGE_NAME = 'infra-kit'\n\nconst LATEST = `${PACKAGE_NAME}@latest`\n\nexport type InstallManager = 'npm' | 'pnpm' | 'yarn' | 'bun' | 'volta' | 'homebrew' | 'unknown'\n\nexport interface InstallManagerInfo {\n  manager: InstallManager\n  /** The command to run. Only safe to spawn ourselves when `canSelfSpawn`; otherwise print it. */\n  updateCommand: string[]\n  /** False when we must not run the command for the user \u2014 either it needs sudo/a tap, or we guessed. */\n  canSelfSpawn: boolean\n}\n\n/**\n * Canonicalises a candidate *root* directory. Required, not optional: `selfRealPath` has already had its\n * symlinks followed, so comparing it against a raw `PNPM_HOME`/`npm root -g`/`cwd` compares a resolved\n * path to an unresolved one and silently never matches. macOS is the everyday proof \u2014 `/var` is a symlink\n * to `/private/var`, so a global install under `/var/...` reports `unknown` unless both sides are resolved.\n * Callers inject the real thing; tests inject a stub.\n */\nexport type RealpathFn = (dir: string) => string\n\nexport interface DetectInstallManagerInput {\n  /** Fully-resolved (symlinks followed) path to this CLI's entry file. */\n  selfRealPath: string\n  env: NodeJS.ProcessEnv\n  /** Canonicalises each candidate root before comparison. See {@link RealpathFn}. */\n  realpath: RealpathFn\n  /** `npm root -g`, deferred: invoked at most once, and only when no cheaper matcher hit. */\n  lazyNpmRoot?: () => string | undefined\n  /**\n   * The exact version to install, when the caller has already resolved it. Omitted, the command targets\n   * the `latest` dist-tag \u2014 fine to PRINT, unsafe to RUN: see {@link pinSpec}.\n   */\n  version?: string\n}\n\n/**\n * Swap the `@latest` token for `@<version>`.\n *\n * `pnpm add -g infra-kit@latest` resolves the tag from pnpm's on-disk metadata cache and does not\n * revalidate it when a cached version already satisfies the tag (pnpm 12.3.4, measured: two runs 90+\n * minutes after a publish both reinstalled the stale `latest` while `pnpm view` already reported the new\n * one). The updater had fetched the real latest itself moments earlier, ran the tag command, got exit 0\n * \u2014 nothing was reinstalled \u2014 and recorded `installed`, so the stale binary looked up to date until the\n * next cycle repeated the same no-op. A concrete version the cache has never seen forces the fetch.\n */\nconst pinSpec = (command: string[], version: string | undefined): string[] => {\n  if (version === undefined) return command\n\n  return command.map((token) => {\n    return token === LATEST ? `${PACKAGE_NAME}@${version}` : token\n  })\n}\n\n/**\n * Is `child` inside the `parent` subtree? Boundary-aware: a naive `startsWith` would call\n * `/Users/x/pnpm-ish` a child of `/Users/x/pnpm`. `parent` is canonicalised first because it arrives raw\n * from the environment while `child` is already a realpath.\n */\nexport const isWithin = (parent: string, child: string, realpath: RealpathFn): boolean => {\n  const rel = path.relative(realpath(path.resolve(parent)), path.resolve(child))\n\n  return rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel)\n}\n\n/** Does `p` contain `name` as a whole path SEGMENT? `/a/node_modules_backup/b` must not match `node_modules`. */\nexport const hasSegment = (p: string, name: string): boolean => {\n  return path.resolve(p).split(path.sep).includes(name)\n}\n\n/**\n * Is `p` inside a Homebrew keg belonging to the `name` FORMULA \u2014 i.e. `.../Cellar/<name>/<version>/...`?\n *\n * The formula name is what makes this sound. A bare `Cellar` segment says only \"somewhere under a keg\",\n * and the keg it lands in is routinely someone else's: when npm's global prefix is a node keg\n * (`npm config set prefix \"$(brew --prefix node)\"`, or any keg-only `node@X`), an `npm i -g` package\n * installs to `Cellar/node/<v>/lib/node_modules/<pkg>/...` \u2014 brew has never heard of it, yet the segment\n * is right there. Requiring `<name>` to sit directly after `Cellar` is what separates \"brew installed\n * THIS\" from \"brew installed the runtime that installed this\".\n *\n * Works for both keg layouts, since each is rooted at the formula: a plain formula\n * (`Cellar/infra-kit/1.2.3/bin/infra-kit`) and brew's node-CLI layout\n * (`Cellar/infra-kit/1.2.3/libexec/lib/node_modules/infra-kit/dist/cli.js`). Do NOT try to tell them\n * apart by excluding `node_modules` \u2014 the second one contains it.\n */\nexport const isBrewKegOf = (p: string, name: string): boolean => {\n  const segments = path.resolve(p).split(path.sep)\n  const cellar = segments.indexOf('Cellar')\n\n  return cellar !== -1 && segments[cellar + 1] === name\n}\n\n/**\n * The npm global prefix that owns `binRealPath`, derived from the path ITSELF, or null when the\n * layout is not an npm global one.\n *\n * Matches `<prefix>/lib/node_modules/<packageName>` \u2014 npm's global layout and no other manager's\n * \u2014 requiring BOTH the `lib` parent and our package as the immediate child. Windows global npm has\n * no `lib` segment (`%APPDATA%\\npm\\node_modules`), so this returns null there and detection falls\n * through to `npm root -g`, which is correct on Windows, where there is normally one npm.\n */\n// This is the one signal that cannot point at the wrong tree. Everything else in this module\n// answers \"is this file somewhere inside tool X's directory?\", and containment is not ownership:\n//   - `npm root -g` answers for whichever `npm` is first on PATH, which is routinely a DIFFERENT\n//     node than the one that installed us (a pnpm/nvm/fnm-managed node, or a node that has since\n//     been removed). It then reports a root that does not contain us, every matcher misses, and\n//     detection degrades to `unknown` \u2014 a notice printed forever, on the single most common install\n//     method. That is the bug this exists to close.\n//   - `PNPM_HOME` containment is satisfied by `<PNPM_HOME>/nodejs/<v>/lib/node_modules/<pkg>` (a\n//     plain `npm i -g` under a pnpm-managed node), yet `pnpm add -g` installs to\n//     `<PNPM_HOME>/global/<v>/...` \u2014 a different directory. That one is worse than a missed update:\n//     the install \"succeeds\" while the binary on PATH stays old, silently, with no notice to show\n//     for it.\n//\n// Requiring both segments is what makes the match proof rather than a hint. The `lib` requirement\n// is also what keeps a project-local `<repo>/node_modules/<pkg>` out (it has no `lib`), and nesting\n// cannot spoof it: `.../node_modules/foo/node_modules/<pkg>` fails the `lib` test.\nexport const npmPrefixOfPackage = (binRealPath: string, packageName: string): string | null => {\n  const segments = path.resolve(binRealPath).split(path.sep)\n  const nodeModules = segments.lastIndexOf('node_modules')\n\n  if (nodeModules < 2) return null\n  if (segments[nodeModules - 1] !== 'lib') return null\n  if (segments[nodeModules + 1] !== packageName) return null\n\n  // Drop `lib/node_modules/...`; the empty result of a root-level prefix (`/lib/node_modules/...`) is `/`.\n  return segments.slice(0, nodeModules - 1).join(path.sep) || path.sep\n}\n\n// The self-scoped reading, kept as the name every call site below already uses. `dependency-registry`\n// asks the same question about OTHER packages (`portless`), which is why the body moved up one level\n// rather than gaining a defaulted parameter \u2014 a default is how the wrong package silently gets probed.\nconst npmPrefixFromSelfPath = (selfRealPath: string): string | null => {\n  return npmPrefixOfPackage(selfRealPath, PACKAGE_NAME)\n}\n\n/**\n * `--prefix` is passed EXPLICITLY rather than trusting the ambient one: the whole point of deriving it is\n * that the `npm` we are about to run may default to a different prefix than the one we are installed in.\n * A command-line flag outranks both `npm_config_prefix` and any `.npmrc`, so this targets the tree we\n * actually run from. With `-g`, npm writes `<prefix>/lib/node_modules` and links bins into `<prefix>/bin`.\n */\nconst npmPrefixInstallCommand = (prefix: string): string[] => {\n  return ['npm', 'install', '-g', '--prefix', prefix, LATEST]\n}\n\n/**\n * Render argv as a line the user can paste into a shell.\n *\n * A plain `join(' ')` was fine while every token came from a static table; `--prefix <path>` puts a\n * filesystem path in argv, and `/Users/Ada Lovelace/.nvm/...` pasted unquoted is two arguments and a\n * failed install. Single quotes are sound here without escaping because the callers' validation rejects a\n * token containing a quote \u2014 see `SAFE_COMMAND_TOKEN` in src/lib/update-check/auto-update.ts.\n *\n * @example\n * formatUpdateCommand(['npm', 'install', '-g', '--prefix', '/opt/x y', 'infra-kit@latest'])\n * // => \"npm install -g --prefix '/opt/x y' infra-kit@latest\"\n */\nexport const formatUpdateCommand = (command: string[]): string => {\n  return command\n    .map((token) => {\n      return token.includes(' ') ? `'${token}'` : token\n    })\n    .join(' ')\n}\n\n/** `env[key]` names a directory that contains `selfRealPath`. Absent/empty env var \u2192 no match. */\nconst underEnvDir = (env: NodeJS.ProcessEnv, key: string, selfRealPath: string, realpath: RealpathFn): boolean => {\n  const dir = env[key]\n\n  return dir != null && dir !== '' && isWithin(dir, selfRealPath, realpath)\n}\n\ninterface Matcher extends Omit<InstallManagerInfo, 'manager'> {\n  manager: InstallManager\n  test: (input: Required<Pick<DetectInstallManagerInput, 'selfRealPath' | 'env' | 'realpath'>>) => boolean\n}\n\n/**\n * Consulted FIRST, before {@link npmPrefixFromSelfPath}. Both of these legitimately wrap an npm-shaped\n * `lib/node_modules` tree \u2014 volta at `~/.volta/tools/image/node/<v>/lib/node_modules`, brew at\n * `Cellar/<pkg>/<v>/libexec/lib/node_modules` \u2014 so deriving an npm prefix from the path would hijack\n * installs that a wrapper owns and must keep owning.\n */\nconst WRAPPER_MATCHERS: Matcher[] = [\n  {\n    manager: 'volta',\n    // volta owns the shim; `volta install` is the correct tool, not a workaround \u2014 so we may run it.\n    test: ({ selfRealPath, env, realpath }) => {\n      return (\n        underEnvDir(env, 'VOLTA_HOME', selfRealPath, realpath) ||\n        hasSegment(selfRealPath, '.volta') ||\n        hasSegment(selfRealPath, 'volta')\n      )\n    },\n    updateCommand: ['volta', 'install', PACKAGE_NAME],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'homebrew',\n    // `brew upgrade` can touch the prefix, relink, and prompt \u2014 never ours to run unattended.\n    //\n    // Our own keg is the ONLY sound signal \u2014 see `isBrewKegOf`. Two broader tests look plausible\n    // and are both wrong, because each answers \"did brew put something here?\" when the question is \"does\n    // brew own THIS package?\":\n    //   - `HOMEBREW_PREFIX` containment: when node comes from brew, npm's global prefix IS\n    //     $HOMEBREW_PREFIX, so EVERY `npm i -g` package lands under it, unknown to brew.\n    //   - a bare `Cellar` segment: an npm prefix pointed at a node keg puts packages inside that keg.\n    // Either misfire tells macOS users to run `brew upgrade infra-kit` \u2014 a formula that does not exist \u2014\n    // and, far worse, makes the background auto-updater bail with `cannot-self-spawn` forever, so the\n    // very fix for it can never reach them. Detection runs on the realpath, and a linked brew bin always\n    // resolves into its own keg, so the narrow test has no false negatives to trade for this.\n    test: ({ selfRealPath }) => {\n      return isBrewKegOf(selfRealPath, PACKAGE_NAME)\n    },\n    updateCommand: ['brew', 'upgrade', PACKAGE_NAME],\n    canSelfSpawn: false,\n  },\n]\n\n/**\n * Consulted LAST, after {@link npmPrefixFromSelfPath} has had its say. Each of these proves only that we\n * live somewhere inside a tool's directory tree, which is weaker than knowing the layout npm itself\n * created \u2014 see the `PNPM_HOME`/`nodejs` case in that helper's doc for a containment hit whose install\n * command targets the wrong directory.\n */\nconst TREE_MATCHERS: Matcher[] = [\n  {\n    manager: 'pnpm',\n    test: ({ selfRealPath, env, realpath }) => {\n      return (\n        underEnvDir(env, 'PNPM_HOME', selfRealPath, realpath) ||\n        (hasSegment(selfRealPath, 'pnpm') && hasSegment(selfRealPath, 'global'))\n      )\n    },\n    updateCommand: ['pnpm', 'add', '-g', LATEST],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'bun',\n    test: ({ selfRealPath, env, realpath }) => {\n      return underEnvDir(env, 'BUN_INSTALL', selfRealPath, realpath) || hasSegment(selfRealPath, '.bun')\n    },\n    updateCommand: ['bun', 'add', '-g', LATEST],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'yarn',\n    test: ({ selfRealPath }) => {\n      return (\n        hasSegment(selfRealPath, '.yarn') || (hasSegment(selfRealPath, 'yarn') && hasSegment(selfRealPath, 'global'))\n      )\n    },\n    updateCommand: ['yarn', 'global', 'add', LATEST],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'npm',\n    test: ({ selfRealPath, env, realpath }) => {\n      return underEnvDir(env, 'npm_config_prefix', selfRealPath, realpath)\n    },\n    updateCommand: ['npm', 'install', '-g', LATEST],\n    canSelfSpawn: true,\n  },\n]\n\nconst NPM_UPDATE_COMMAND = ['npm', 'install', '-g', LATEST]\n\n/**\n * Identify the package manager that owns `selfRealPath`.\n *\n * Order, and why it is this one: wrappers that own an npm-shaped tree (volta, brew) first, then the npm\n * prefix DERIVED from our own path, then the env/path containment matchers, then the `npm root -g` probe.\n * The derived prefix sits above containment because it is the only signal that cannot name a directory we\n * do not live in \u2014 see {@link npmPrefixFromSelfPath}.\n *\n * `lazyNpmRoot` is the last resort and is invoked at most once, only after every matcher has missed \u2014 a\n * pnpm or volta install never pays for the subprocess, and neither does any npm global install in the\n * standard layout, which the derived prefix now settles for free. When nothing matches we report `unknown`\n * with an npm command that is a *suggestion only* (`canSelfSpawn: false`): running a guessed global\n * install is worse than printing one.\n *\n * @example\n * detectInstallManager({ selfRealPath: '/Users/x/Library/pnpm/global/5/node_modules/infra-kit/dist/cli.js', env: {} })\n * // => { manager: 'pnpm', updateCommand: ['pnpm', 'add', '-g', 'infra-kit@latest'], canSelfSpawn: true }\n * detectInstallManager({ selfRealPath: '/Users/x/Library/pnpm/global/5/node_modules/infra-kit/dist/cli.js', env: {}, version: '0.5.5' })\n * // => { manager: 'pnpm', updateCommand: ['pnpm', 'add', '-g', 'infra-kit@0.5.5'], canSelfSpawn: true }\n */\nexport const detectInstallManager = (input: DetectInstallManagerInput): InstallManagerInfo => {\n  const { selfRealPath, env, realpath, lazyNpmRoot, version } = input\n  const detected = detectUnpinned({ selfRealPath, env, realpath, lazyNpmRoot })\n\n  return { ...detected, updateCommand: pinSpec(detected.updateCommand, version) }\n}\n\nconst detectUnpinned = (input: DetectInstallManagerInput): InstallManagerInfo => {\n  const { selfRealPath, env, realpath, lazyNpmRoot } = input\n  const toInfo = (hit: Matcher): InstallManagerInfo => {\n    return { manager: hit.manager, updateCommand: hit.updateCommand, canSelfSpawn: hit.canSelfSpawn }\n  }\n  const matches = ({ test }: Matcher): boolean => {\n    return test({ selfRealPath, env, realpath })\n  }\n\n  const wrapper = WRAPPER_MATCHERS.find(matches)\n\n  if (wrapper) return toInfo(wrapper)\n\n  const derivedPrefix = npmPrefixFromSelfPath(selfRealPath)\n\n  if (derivedPrefix !== null) {\n    return { manager: 'npm', updateCommand: npmPrefixInstallCommand(derivedPrefix), canSelfSpawn: true }\n  }\n\n  const tree = TREE_MATCHERS.find(matches)\n\n  if (tree) return toInfo(tree)\n\n  const npmRoot = lazyNpmRoot?.()\n\n  if (npmRoot != null && npmRoot !== '' && isWithin(npmRoot, selfRealPath, realpath)) {\n    return { manager: 'npm', updateCommand: NPM_UPDATE_COMMAND, canSelfSpawn: true }\n  }\n\n  return { manager: 'unknown', updateCommand: NPM_UPDATE_COMMAND, canSelfSpawn: false }\n}\n\n/**\n * Is this CLI running from a *project-local* `node_modules` (as opposed to a global root)?\n *\n * The cwd clause is what does the distinguishing \u2014 BOTH a project install and a global root contain a\n * `/node_modules/` segment (`pnpm root -g` is `~/Library/pnpm/global/5/node_modules`). Without it we\n * would nag every global pnpm user to stop using a local install they do not have.\n *\n * Accepted false-negative: invoked from a subdirectory (cwd `project/apps/x`, deps at\n * `project/node_modules`) this returns false and the advisory stays silent. Under-warning is the safe\n * direction for a best-effort, never-throwing advisory \u2014 do not \"fix\" it by dropping the cwd clause.\n *\n * `cwd` is canonicalised before comparison for the same reason `detectInstallManager` canonicalises its\n * roots: `selfRealPath` is a realpath, and comparing it to an unresolved cwd never matches.\n *\n * @example\n * isLocalNodeModulesInstall('/repo/node_modules/infra-kit/dist/cli.js', '/repo', (p) => p) // => true\n */\nexport const isLocalNodeModulesInstall = (selfRealPath: string, cwd: string, realpath: RealpathFn): boolean => {\n  return hasSegment(selfRealPath, 'node_modules') && isWithin(cwd, selfRealPath, realpath)\n}\n", "import { realpathSync } from 'node:fs'\nimport path from 'node:path'\n\n/**\n * The impure companion to the pure detection module: canonicalise a directory that may not exist.\n *\n * `realpathSync` throws on a missing path, and candidate roots routinely miss \u2014 `PNPM_HOME` can point at a\n * directory the user never created, `npm root -g` can name a prefix that was removed. A throw there would\n * turn \"we could not identify your install\" into a crash, so an unresolvable path falls back to\n * `path.resolve`, which still normalises `.`/`..` and yields a usable, non-matching absolute path.\n */\nexport const safeRealpath = (dir: string): string => {\n  try {\n    return realpathSync(dir)\n  } catch {\n    return path.resolve(dir)\n  }\n}\n", "/* eslint-disable sonarjs/no-os-command-from-path */\n/**\n * `npm root -g`, the LAZY fallback for {@link detectInstallManager}.\n *\n * Why it is indispensable: the `npm` matcher keys off `npm_config_prefix`, which npm sets only while npm\n * itself is running. A user who ran `npm i -g infra-kit` months ago and now types `ik` has no such var,\n * so every cheap matcher misses and detection reports `unknown` / `canSelfSpawn: false`. Without this\n * probe the single most common install method can never update itself.\n *\n * Read by the background update worker, and by the `doctor` advisory that names the command a human\n * would run by hand \u2014 one probe so the two can never disagree about who owns the install.\n */\nimport { execFileSync } from 'node:child_process'\nimport process from 'node:process'\n\nconst NPM_ROOT_TIMEOUT_MS = 3_000\n\n/**\n * The global npm root, or undefined when npm is absent, slow, or errors. Costs a subprocess, so\n * `detectInstallManager` invokes it at most once and only after every env/path matcher has missed \u2014 a\n * pnpm or volta install never pays for it.\n *\n * Resolving the user's `npm` from PATH is inherent here: we must ask the very package manager that owns\n * this install where its global root is. Pinning an absolute path would defeat the detection.\n *\n * @example\n * defaultLazyNpmRoot() // => '/usr/local/lib/node_modules' | undefined\n */\nexport const defaultLazyNpmRoot = (): string | undefined => {\n  try {\n    const out = execFileSync('npm', ['root', '-g'], {\n      encoding: 'utf-8',\n      timeout: NPM_ROOT_TIMEOUT_MS,\n      stdio: ['ignore', 'pipe', 'ignore'],\n      shell: process.platform === 'win32',\n    })\n    const trimmed = out.trim()\n\n    return trimmed === '' ? undefined : trimmed\n  } catch {\n    return undefined\n  }\n}\n"],
+  "mappings": "AAAA,IAAAA,EAAA,CACE,KAAQ,YACR,KAAQ,SACR,QAAW,QACX,MAAS,CACP,MACF,EACA,YAAe,YACf,IAAO,CACL,YAAa,cACb,GAAM,cACN,SAAU,mBACZ,EACA,QAAW,CACT,KAAQ,QACV,EACA,QAAW,CACT,UAAa,iEACb,MAAS,sDACT,QAAW,iBACX,kBAAmB,4BACnB,kBAAmB,cACnB,cAAe,2EACf,eAAgB,4HAChB,iBAAkB,4HAClB,eAAgB,oEAChB,aAAc,kFACd,WAAY,eACZ,KAAQ,0CACR,aAAc,gDACd,UAAW,6CACX,cAAe,uDACf,SAAU,qMACV,GAAM,gHACN,IAAO,6DACT,EACA,aAAgB,CACd,gCAAiC,UACjC,qBAAsB,SACtB,oBAAqB,SACrB,kBAAmB,SACnB,qBAAsB,SACtB,mBAAoB,SACpB,+BAAgC,SAChC,0BAA2B,SAC3B,MAAS,SACT,SAAY,SACZ,UAAa,UACb,QAAW,UACX,IAAO,SACP,KAAQ,UACR,cAAe,UACf,SAAY,UACZ,MAAS,SACT,KAAQ,SACR,IAAO,SACP,GAAM,QACR,EACA,gBAAmB,CACjB,+BAAgC,SAChC,4BAA6B,UAC7B,iCAAkC,cAClC,oBAAqB,WACrB,eAAgB,WAChB,oBAAqB,cACrB,oBAAqB,cACrB,QAAW,UACX,sBAAuB,SACvB,WAAc,QAChB,CACF,EC9DA,OAAOC,MAAU,YAGV,IAAMC,EAAe,YAEtBC,EAAS,GAAGD,CAAY,UA8CxBE,EAAU,CAACC,EAAmBC,IAC9BA,IAAY,OAAkBD,EAE3BA,EAAQ,IAAKE,GACXA,IAAUJ,EAAS,GAAGD,CAAY,IAAII,CAAO,GAAKC,CAC1D,EAQUC,EAAW,CAACC,EAAgBC,EAAeC,IAAkC,CACxF,IAAMC,EAAMX,EAAK,SAASU,EAASV,EAAK,QAAQQ,CAAM,CAAC,EAAGR,EAAK,QAAQS,CAAK,CAAC,EAE7E,OAAOE,IAAQ,IAAM,CAACA,EAAI,WAAW,IAAI,GAAK,CAACX,EAAK,WAAWW,CAAG,CACpE,EAGaC,EAAa,CAACC,EAAWC,IAC7Bd,EAAK,QAAQa,CAAC,EAAE,MAAMb,EAAK,GAAG,EAAE,SAASc,CAAI,EAkBzCC,EAAc,CAACF,EAAWC,IAA0B,CAC/D,IAAME,EAAWhB,EAAK,QAAQa,CAAC,EAAE,MAAMb,EAAK,GAAG,EACzCiB,EAASD,EAAS,QAAQ,QAAQ,EAExC,OAAOC,IAAW,IAAMD,EAASC,EAAS,CAAC,IAAMH,CACnD,EA2BaI,EAAqB,CAACC,EAAqBC,IAAuC,CAC7F,IAAMJ,EAAWhB,EAAK,QAAQmB,CAAW,EAAE,MAAMnB,EAAK,GAAG,EACnDqB,EAAcL,EAAS,YAAY,cAAc,EAIvD,OAFIK,EAAc,GACdL,EAASK,EAAc,CAAC,IAAM,OAC9BL,EAASK,EAAc,CAAC,IAAMD,EAAoB,KAG/CJ,EAAS,MAAM,EAAGK,EAAc,CAAC,EAAE,KAAKrB,EAAK,GAAG,GAAKA,EAAK,GACnE,EAKMsB,EAAyBC,GACtBL,EAAmBK,EAActB,CAAY,EAShDuB,EAA2BC,GACxB,CAAC,MAAO,UAAW,KAAM,WAAYA,EAAQvB,CAAM,EAe/CwB,EAAuBtB,GAC3BA,EACJ,IAAKE,GACGA,EAAM,SAAS,GAAG,EAAI,IAAIA,CAAK,IAAMA,CAC7C,EACA,KAAK,GAAG,EAIPqB,EAAc,CAACC,EAAwBC,EAAaN,EAAsBb,IAAkC,CAChH,IAAMoB,EAAMF,EAAIC,CAAG,EAEnB,OAAOC,GAAO,MAAQA,IAAQ,IAAMvB,EAASuB,EAAKP,EAAcb,CAAQ,CAC1E,EAaMqB,EAA8B,CAClC,CACE,QAAS,QAET,KAAM,CAAC,CAAE,aAAAR,EAAc,IAAAK,EAAK,SAAAlB,CAAS,IAEjCiB,EAAYC,EAAK,aAAcL,EAAcb,CAAQ,GACrDE,EAAWW,EAAc,QAAQ,GACjCX,EAAWW,EAAc,OAAO,EAGpC,cAAe,CAAC,QAAS,UAAWtB,CAAY,EAChD,aAAc,EAChB,EACA,CACE,QAAS,WAaT,KAAM,CAAC,CAAE,aAAAsB,CAAa,IACbR,EAAYQ,EAActB,CAAY,EAE/C,cAAe,CAAC,OAAQ,UAAWA,CAAY,EAC/C,aAAc,EAChB,CACF,EAQM+B,EAA2B,CAC/B,CACE,QAAS,OACT,KAAM,CAAC,CAAE,aAAAT,EAAc,IAAAK,EAAK,SAAAlB,CAAS,IAEjCiB,EAAYC,EAAK,YAAaL,EAAcb,CAAQ,GACnDE,EAAWW,EAAc,MAAM,GAAKX,EAAWW,EAAc,QAAQ,EAG1E,cAAe,CAAC,OAAQ,MAAO,KAAMrB,CAAM,EAC3C,aAAc,EAChB,EACA,CACE,QAAS,MACT,KAAM,CAAC,CAAE,aAAAqB,EAAc,IAAAK,EAAK,SAAAlB,CAAS,IAC5BiB,EAAYC,EAAK,cAAeL,EAAcb,CAAQ,GAAKE,EAAWW,EAAc,MAAM,EAEnG,cAAe,CAAC,MAAO,MAAO,KAAMrB,CAAM,EAC1C,aAAc,EAChB,EACA,CACE,QAAS,OACT,KAAM,CAAC,CAAE,aAAAqB,CAAa,IAElBX,EAAWW,EAAc,OAAO,GAAMX,EAAWW,EAAc,MAAM,GAAKX,EAAWW,EAAc,QAAQ,EAG/G,cAAe,CAAC,OAAQ,SAAU,MAAOrB,CAAM,EAC/C,aAAc,EAChB,EACA,CACE,QAAS,MACT,KAAM,CAAC,CAAE,aAAAqB,EAAc,IAAAK,EAAK,SAAAlB,CAAS,IAC5BiB,EAAYC,EAAK,oBAAqBL,EAAcb,CAAQ,EAErE,cAAe,CAAC,MAAO,UAAW,KAAMR,CAAM,EAC9C,aAAc,EAChB,CACF,EAEM+B,EAAqB,CAAC,MAAO,UAAW,KAAM/B,CAAM,EAsB7CgC,EAAwBC,GAAyD,CAC5F,GAAM,CAAE,aAAAZ,EAAc,IAAAK,EAAK,SAAAlB,EAAU,YAAA0B,EAAa,QAAA/B,CAAQ,EAAI8B,EACxDE,EAAWC,EAAe,CAAE,aAAAf,EAAc,IAAAK,EAAK,SAAAlB,EAAU,YAAA0B,CAAY,CAAC,EAE5E,MAAO,CAAE,GAAGC,EAAU,cAAelC,EAAQkC,EAAS,cAAehC,CAAO,CAAE,CAChF,EAEMiC,EAAkBH,GAAyD,CAC/E,GAAM,CAAE,aAAAZ,EAAc,IAAAK,EAAK,SAAAlB,EAAU,YAAA0B,CAAY,EAAID,EAC/CI,EAAUC,IACP,CAAE,QAASA,EAAI,QAAS,cAAeA,EAAI,cAAe,aAAcA,EAAI,YAAa,GAE5FC,EAAU,CAAC,CAAE,KAAAC,CAAK,IACfA,EAAK,CAAE,aAAAnB,EAAc,IAAAK,EAAK,SAAAlB,CAAS,CAAC,EAGvCiC,EAAUZ,EAAiB,KAAKU,CAAO,EAE7C,GAAIE,EAAS,OAAOJ,EAAOI,CAAO,EAElC,IAAMC,EAAgBtB,EAAsBC,CAAY,EAExD,GAAIqB,IAAkB,KACpB,MAAO,CAAE,QAAS,MAAO,cAAepB,EAAwBoB,CAAa,EAAG,aAAc,EAAK,EAGrG,IAAMC,EAAOb,EAAc,KAAKS,CAAO,EAEvC,GAAII,EAAM,OAAON,EAAOM,CAAI,EAE5B,IAAMC,EAAUV,IAAc,EAE9B,OAAIU,GAAW,MAAQA,IAAY,IAAMvC,EAASuC,EAASvB,EAAcb,CAAQ,EACxE,CAAE,QAAS,MAAO,cAAeuB,EAAoB,aAAc,EAAK,EAG1E,CAAE,QAAS,UAAW,cAAeA,EAAoB,aAAc,EAAM,CACtF,EAmBac,EAA4B,CAACxB,EAAsByB,EAAatC,IACpEE,EAAWW,EAAc,cAAc,GAAKhB,EAASyC,EAAKzB,EAAcb,CAAQ,ECtWzF,OAAS,gBAAAuC,MAAoB,UAC7B,OAAOC,MAAU,YAUV,IAAMC,EAAgBC,GAAwB,CACnD,GAAI,CACF,OAAOH,EAAaG,CAAG,CACzB,MAAQ,CACN,OAAOF,EAAK,QAAQE,CAAG,CACzB,CACF,ECLA,OAAS,gBAAAC,MAAoB,qBAC7B,OAAOC,MAAa,eAEpB,IAAMC,EAAsB,IAafC,EAAqB,IAA0B,CAC1D,GAAI,CAOF,IAAMC,EANMJ,EAAa,MAAO,CAAC,OAAQ,IAAI,EAAG,CAC9C,SAAU,QACV,QAASE,EACT,MAAO,CAAC,SAAU,OAAQ,QAAQ,EAClC,MAAOD,EAAQ,WAAa,OAC9B,CAAC,EACmB,KAAK,EAEzB,OAAOG,IAAY,GAAK,OAAYA,CACtC,MAAQ,CACN,MACF,CACF",
+  "names": ["package_default", "path", "PACKAGE_NAME", "LATEST", "pinSpec", "command", "version", "token", "isWithin", "parent", "child", "realpath", "rel", "hasSegment", "p", "name", "isBrewKegOf", "segments", "cellar", "npmPrefixOfPackage", "binRealPath", "packageName", "nodeModules", "npmPrefixFromSelfPath", "selfRealPath", "npmPrefixInstallCommand", "prefix", "formatUpdateCommand", "underEnvDir", "env", "key", "dir", "WRAPPER_MATCHERS", "TREE_MATCHERS", "NPM_UPDATE_COMMAND", "detectInstallManager", "input", "lazyNpmRoot", "detected", "detectUnpinned", "toInfo", "hit", "matches", "test", "wrapper", "derivedPrefix", "tree", "npmRoot", "isLocalNodeModulesInstall", "cwd", "realpathSync", "path", "safeRealpath", "dir", "execFileSync", "process", "NPM_ROOT_TIMEOUT_MS", "defaultLazyNpmRoot", "trimmed"]
+}

package/dist/chunk-YYEUJYC7.js

@@ -0,0 +1,2 @@
+import{b as f,h as k,j as P,k as S}from"./chunk-Y5TLBGZT.js";import{b as w}from"./chunk-XJOY7J3G.js";import{n as m,r as C}from"./chunk-PQG63EIV.js";import{spawnSync as L}from"node:child_process";import{homedir as I}from"node:os";import h from"node:process";import l from"node:fs";import b from"node:path";import D from"node:process";var J="update-check.lock",q=1800*1e3,G=()=>b.join(m(),J),H=(t,e)=>{try{e-l.statSync(t).mtimeMs>q&&l.rmSync(t,{force:!0})}catch{}},E=(t={})=>{let e=t.nowMs??Date.now(),n=t.lockPath??G();try{l.mkdirSync(b.dirname(n),{recursive:!0})}catch{return null}let r=()=>{try{return l.openSync(n,"wx",384)}catch{return null}},o=r();if(o===null&&(H(n,e),o=r()),o===null)return null;try{l.writeFileSync(o,String(D.pid))}catch{}return()=>{try{l.closeSync(o)}catch{}try{l.rmSync(n,{force:!0})}catch{}}};var K="https://registry.npmjs.org",$=5e3,z=t=>Object.entries(t).find(([n,r])=>/^npm_config_registry$/i.test(n)&&r!=null&&r!=="")?.[1],W=t=>{let e=z(t),n=e!=null&&e!==""?e:K;for(;n.endsWith("/");)n=n.slice(0,-1);return n},v=async(t,e=fetch)=>{let n=new AbortController,r=setTimeout(()=>{n.abort()},$);try{let o=await e(`${W(t)}/${f}/latest`,{signal:n.signal,headers:{accept:"application/json"}});if(!o.ok)return null;let s=(await o.json())?.version;return typeof s=="string"&&s!==""?s:null}catch{return null}finally{clearTimeout(r)}};var B=/^(\d+)\.(\d+)\.(\d+)$/,N=t=>{let[e=""]=t.trim().split("+"),[n="",...r]=e.split("-"),o=B.exec(n);if(!o)return null;let[c,s,u]=[o[1],o[2],o[3]].map(Number);return{release:[c,s,u],prerelease:r.length>0?r.join("-").split("."):[]}},U=/^\d+$/,Y=(t,e)=>{let n=U.test(t),r=U.test(e);return n&&r?Number(t)-Number(e):n!==r?n?-1:1:t<e?-1:1},Q=(t,e)=>{for(let n=0;n<Math.max(t.length,e.length);n+=1){let r=t[n],o=e[n];if(r===void 0)return-1;if(o===void 0)return 1;if(r!==o)return Y(r,o)}return 0},M=(t,e)=>{let n=N(t),r=N(e);if(!n||!r)return!1;for(let s=0;s<3;s+=1){let u=n.release[s],d=r.release[s];if(u!==d)return u>d}let o=n.prerelease.length===0,c=r.prerelease.length===0;return o!==c?o:Q(n.prerelease,r.prerelease)>0};import x from"node:fs";import A from"node:path";var R="update-check.json",X=1200*1e3,Z=()=>A.join(m(),R),ee=t=>Array.isArray(t)&&t.every(e=>typeof e=="string"),te=t=>{if(typeof t!="object"||t===null)return!1;let{lastCheckMs:e,latestVersion:n,updateCommand:r,outcome:o}=t;return typeof e=="number"&&Number.isFinite(e)&&(n===null||typeof n=="string")&&(r===null||ee(r))&&(o==null||typeof o=="string")},be=(t=e=>x.readFileSync(e,"utf8"))=>{try{let e=JSON.parse(t(Z()));return te(e)?e:null}catch{return null}},_=t=>{let e=m();x.mkdirSync(e,{recursive:!0}),C(A.join(e,R),JSON.stringify(t),384)},Ee=(t,e)=>{if(!t)return!0;let n=e-t.lastCheckMs;return n<0?!0:n>=X};var ne=200,re=300*1e3,oe=15e3,se=t=>{let e=L(f,["version","--json"],{stdio:["ignore","pipe","ignore"],shell:h.platform==="win32",cwd:I(),env:t,timeout:oe,windowsHide:!0,encoding:"utf8"});if(e.error||e.signal||e.status!==0)return null;try{let r=JSON.parse(e.stdout)?.version;return typeof r=="string"&&r!==""?r:null}catch{return null}},ie=t=>{try{return h.kill(t,0),!0}catch{return!1}},ae=t=>new Promise(e=>{setTimeout(e,t)}),ce=async(t,e)=>{let n=e.clock()+re;for(;e.clock()<n;){if(!e.isProcessAlive(t))return!0;await e.sleep(ne)}return!e.isProcessAlive(t)},Te=async(t,e)=>{let r=(e.acquireLock??E)();if(!r)return"already-running";try{return await le(t,e)}finally{r()}},le=async(t,e)=>{let n=e.env??h.env,r=e.nowMs??Date.now(),o=e.fetchLatest??v,c=e.writeCache??_,s=e.isProcessAlive??ie,u=e.sleep??ae,d=e.clock??Date.now,T=e.lazyNpmRoot??P,O=e.spawnSync??L,V=e.installedVersion??se,i=await o(n),a=(y,j)=>(c({lastCheckMs:r,...j,outcome:y}),y);if(i===null)return a("fetch-failed",{latestVersion:null,updateCommand:null});if(!M(i,t))return a("up-to-date",{latestVersion:i,updateCommand:null});let{canSelfSpawn:F,updateCommand:p}=k({selfRealPath:e.selfRealPath,env:n,realpath:S,lazyNpmRoot:T,version:i});if(!F)return a("cannot-self-spawn",{latestVersion:i,updateCommand:p});if(e.parentPid==null)return a("parent-unknown",{latestVersion:i,updateCommand:null});if(c({lastCheckMs:r,latestVersion:i,updateCommand:null,outcome:"installing"}),!await ce(e.parentPid,{isProcessAlive:s,sleep:u,clock:d}))return a("parent-still-running",{latestVersion:i,updateCommand:null});let g=O(p[0],p.slice(1),{stdio:"ignore",shell:h.platform==="win32",cwd:I(),env:w(n),windowsHide:!0});return g.error||g.signal||g.status!==0?a("install-failed",{latestVersion:i,updateCommand:p}):V(n)!==i?a("install-stale",{latestVersion:i,updateCommand:p}):a("installed",{latestVersion:null,updateCommand:null})};export{M as a,be as b,Ee as c,Te as d};
+//# sourceMappingURL=chunk-YYEUJYC7.js.map

package/dist/chunk-YYEUJYC7.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/lib/update-check/run-update-check.ts", "../src/lib/update-check/lock.ts", "../src/lib/update-check/registry.ts", "../src/lib/update-check/semver.ts", "../src/lib/update-check/update-cache.ts"],
+  "sourcesContent": ["/**\n * The CHILD half of the auto-update, spawned detached by `maybeAutoUpdate`. It outlives the CLI\n * invocation that started it, so it may take its time and it may replace the binary.\n *\n * WHY IT WAITS FOR THE PARENT TO EXIT \u2014 the load-bearing invariant of this whole feature:\n * `scripts/build.js` sets esbuild `splitting: true`, so `dist/cli.js` lazily imports sibling\n * `chunk-*.js` files at runtime (that is how the Ink TUI stays off the fast path). A package manager\n * installing over `dist/` mid-command deletes chunks the parent has not imported yet, and the parent\n * dies on a dynamic import of a file that no longer exists. Waiting for the parent to exit is what\n * makes a silent background install safe rather than a random crash under `infra-kit dev`.\n */\nimport { spawnSync } from 'node:child_process'\nimport { homedir } from 'node:os'\nimport process from 'node:process'\n\nimport { PACKAGE_NAME, defaultLazyNpmRoot, detectInstallManager, safeRealpath } from 'src/lib/install-manager'\nimport { packageManagerInstallEnv } from 'src/lib/pm-env'\n\nimport { acquireUpdateLock } from './lock'\nimport { fetchLatestVersion } from './registry'\nimport { isNewerVersion } from './semver'\nimport { writeUpdateCache } from './update-cache'\nimport type { UpdateCache } from './update-cache'\n\n/** How often to re-check whether the parent is gone. */\nexport const PARENT_POLL_INTERVAL_MS = 200\n\n/**\n * Give up waiting after this long. A long-lived parent (`infra-kit dev` runs for hours) must not leave\n * an immortal child pinned to a stale version: we simply skip this cycle. `lastCheckMs` is already\n * persisted by then, so the next short-lived command re-checks after the normal throttle window.\n */\nexport const PARENT_WAIT_TIMEOUT_MS = 5 * 60 * 1000\n\nexport interface RunUpdateCheckDeps {\n  env?: NodeJS.ProcessEnv\n  nowMs?: number\n  fetchLatest?: (env: NodeJS.ProcessEnv) => Promise<string | null>\n  writeCache?: typeof writeUpdateCache\n  isProcessAlive?: (pid: number) => boolean\n  sleep?: (ms: number) => Promise<void>\n  /** Monotonic-ish source for the parent-wait deadline. Injected so the timeout is testable without real time. */\n  clock?: () => number\n  /** `npm root -g` probe. Defaults to the real subprocess; this child is detached, so it can afford one. */\n  lazyNpmRoot?: () => string | undefined\n  /** Single-flight guard. Returns a release fn, or null when another worker already holds the lock. */\n  acquireLock?: () => (() => void) | null\n  spawnSync?: typeof spawnSync\n  /**\n   * The version the user now gets from the `infra-kit` on their PATH. Consulted once, after the install\n   * command returns 0, because that exit code is not proof of anything \u2014 see {@link readInstalledVersion}.\n   */\n  installedVersion?: (env: NodeJS.ProcessEnv) => string | null\n  /** Realpath of the installed `dist/cli.js`, used to identify the owning package manager. */\n  selfRealPath: string\n  parentPid?: number\n}\n\n/** Bounds the post-install probe; a hung shim must not pin this worker for the parent's 5-minute budget. */\nconst VERSION_PROBE_TIMEOUT_MS = 15_000\n\n/**\n * Ask the freshly installed CLI what it is, the way the user will: the `infra-kit` bin on PATH.\n *\n * Not `<selfRealPath>/../package.json`. pnpm keeps each version in its own directory\n * (`.pnpm/infra-kit@0.5.1/\u2026`, `global/v11/<hash>/\u2026`) and repoints the shim, so the path THIS worker was\n * launched from keeps reporting the old version forever, while the path the user gets has moved.\n *\n * `--json` doubles as the guard that stops the probe spawning a second updater from inside the first:\n * `autoUpdateSkipReason` returns `json` before anything else runs, and piped stdio fails the tty arm too.\n * Anything short of a parseable version is `null` \u2014 a shim that no longer resolves, a bin that crashes on\n * boot, output that is not JSON \u2014 and the caller treats every one of those as \"not verified\".\n */\nconst readInstalledVersion = (env: NodeJS.ProcessEnv): string | null => {\n  const result = spawnSync(PACKAGE_NAME, ['version', '--json'], {\n    stdio: ['ignore', 'pipe', 'ignore'],\n    shell: process.platform === 'win32',\n    cwd: homedir(),\n    env,\n    timeout: VERSION_PROBE_TIMEOUT_MS,\n    windowsHide: true,\n    encoding: 'utf8',\n  })\n\n  if (result.error || result.signal || result.status !== 0) return null\n\n  try {\n    const parsed: unknown = JSON.parse(result.stdout)\n    const version = (parsed as { version?: unknown } | null)?.version\n\n    return typeof version === 'string' && version !== '' ? version : null\n  } catch {\n    return null\n  }\n}\n\n/** Signal 0 performs the permission/existence check without delivering anything. */\nconst defaultIsProcessAlive = (pid: number): boolean => {\n  try {\n    process.kill(pid, 0)\n\n    return true\n  } catch {\n    return false\n  }\n}\n\nconst defaultSleep = (ms: number): Promise<void> => {\n  return new Promise((resolve) => {\n    setTimeout(resolve, ms)\n  })\n}\n\n/**\n * Block until `parentPid` exits or {@link PARENT_WAIT_TIMEOUT_MS} elapses. Returns whether the parent\n * is actually gone \u2014 the caller must not install on a timeout.\n */\nconst waitForParentExit = async (\n  parentPid: number,\n  deps: Required<Pick<RunUpdateCheckDeps, 'isProcessAlive' | 'sleep' | 'clock'>>,\n): Promise<boolean> => {\n  const deadline = deps.clock() + PARENT_WAIT_TIMEOUT_MS\n\n  while (deps.clock() < deadline) {\n    if (!deps.isProcessAlive(parentPid)) return true\n\n    await deps.sleep(PARENT_POLL_INTERVAL_MS)\n  }\n\n  return !deps.isProcessAlive(parentPid)\n}\n\nexport type UpdateCheckOutcome =\n  | 'installed'\n  | 'install-failed'\n  /** The install command returned 0, yet the `infra-kit` on PATH still does not report `latestVersion`. */\n  | 'install-stale'\n  | 'up-to-date'\n  | 'fetch-failed'\n  | 'cannot-self-spawn'\n  | 'parent-still-running'\n  | 'parent-unknown'\n  | 'already-running'\n\n/**\n * Fetch, decide, and (when safe) install \u2014 returning WHY it did what it did so tests can distinguish\n * \"no update\" from \"could not install\". Never throws.\n *\n * `lastCheckMs` is written from the ATTEMPT, before any early return. If it were written only on\n * success, an offline user would re-spawn a doomed child on every single command.\n *\n * @example\n * await runUpdateCheck('0.1.130', { selfRealPath: '/usr/local/lib/node_modules/infra-kit/dist/cli.js' })\n * // => 'installed'\n */\nexport const runUpdateCheck = async (currentVersion: string, deps: RunUpdateCheckDeps): Promise<UpdateCheckOutcome> => {\n  const acquireLock = deps.acquireLock ?? acquireUpdateLock\n\n  // Single-flight. N shells launched at once all read the same stale cache and each spawns a worker;\n  // the cache throttle cannot stop them because it is only written after the fetch returns. Without\n  // this, a pending update means N concurrent `npm install -g` over one global directory.\n  const release = acquireLock()\n\n  if (!release) return 'already-running'\n\n  try {\n    return await runUpdateCheckLocked(currentVersion, deps)\n  } finally {\n    release()\n  }\n}\n\nconst runUpdateCheckLocked = async (currentVersion: string, deps: RunUpdateCheckDeps): Promise<UpdateCheckOutcome> => {\n  const env = deps.env ?? process.env\n  const nowMs = deps.nowMs ?? Date.now()\n  const fetchLatest = deps.fetchLatest ?? fetchLatestVersion\n  const writeCache = deps.writeCache ?? writeUpdateCache\n  const isProcessAlive = deps.isProcessAlive ?? defaultIsProcessAlive\n  const sleep = deps.sleep ?? defaultSleep\n  const clock = deps.clock ?? Date.now\n  const lazyNpmRoot = deps.lazyNpmRoot ?? defaultLazyNpmRoot\n  const spawn = deps.spawnSync ?? spawnSync\n  const installedVersion = deps.installedVersion ?? readInstalledVersion\n\n  const latestVersion = await fetchLatest(env)\n\n  // Every path below writes the cache EXACTLY once, and always with `lastCheckMs: nowMs` \u2014 the throttle\n  // burns on the ATTEMPT, never on success. If it burned only on success, an offline user would respawn\n  // a doomed child on every command.\n  const finish = (\n    outcome: UpdateCheckOutcome,\n    cache: Omit<UpdateCache, 'lastCheckMs' | 'outcome'>,\n  ): UpdateCheckOutcome => {\n    // `outcome` is recorded on EVERY write: it is what lets a reader (human or `isStale`) tell a settled\n    // `installed`/`up-to-date` from a transient `fetch-failed`, all of which otherwise write an identical\n    // `{latestVersion:null}`. See `UpdateCache.outcome`.\n    writeCache({ lastCheckMs: nowMs, ...cache, outcome })\n\n    return outcome\n  }\n\n  if (latestVersion === null) return finish('fetch-failed', { latestVersion: null, updateCommand: null })\n  if (!isNewerVersion(latestVersion, currentVersion))\n    return finish('up-to-date', { latestVersion, updateCommand: null })\n\n  // `lazyNpmRoot` is what makes the COMMON case work: a plain `npm i -g infra-kit` leaves no\n  // `npm_config_prefix` in the user's shell, so every cheap matcher misses and detection would report\n  // `unknown` / `canSelfSpawn: false`. Without this probe the auto-update would silently degrade to a\n  // notice for the majority of installs. The subprocess is affordable here and nowhere else.\n  // `version` pins the spec to what we just fetched: a `@latest` command is resolved by the package\n  // manager from ITS cache, which pnpm does not revalidate \u2014 see `pinSpec` in install-manager.\n  const { canSelfSpawn, updateCommand } = detectInstallManager({\n    selfRealPath: deps.selfRealPath,\n    env,\n    realpath: safeRealpath,\n    lazyNpmRoot,\n    version: latestVersion,\n  })\n\n  // Homebrew relinks its prefix and may prompt; an unknown location means the command is a guess.\n  // Both stay the user's call, so record the command for `maybeAutoUpdate` to print next invocation.\n  if (!canSelfSpawn) return finish('cannot-self-spawn', { latestVersion, updateCommand })\n\n  // Fail SAFE. Without a parent to outlive we cannot know whether a live CLI is still lazily importing\n  // `chunk-*.js` out of the `dist/` we are about to replace, so we skip the cycle rather than install\n  // blind. The real spawn always passes `--parent-pid`; only a hand-run worker lands here.\n  if (deps.parentPid == null) return finish('parent-unknown', { latestVersion, updateCommand: null })\n\n  // Burn the throttle NOW, before the two unbounded-ish operations below (a 5-minute parent wait, then an\n  // install of no fixed duration). Everything after this point can take many minutes, and until the cache\n  // is written it still reads as STALE \u2014 so every new shell in that window spawns its own worker, and the\n  // single-flight lock becomes the only thing standing between them and concurrent `npm install -g` runs\n  // over one global directory. The lock is reaped by mtime (LOCK_STALE_MS), so a slow enough install has\n  // its live lock stolen and we get exactly the pile-up the lock exists to prevent.\n  //\n  // Writing the stamp here makes the throttle \u2014 not the lock \u2014 the primary guard, which is what the cache\n  // was always for. `finish()` overwrites this with the real outcome; this is the only path that writes\n  // the cache twice, and deliberately so.\n  //\n  // `outcome: 'installing'` marks a mid-install checkpoint: if the worker is killed here (machine sleeps,\n  // SIGKILL) and never reaches `finish()`, this stamp is what the next run reads, and the cache says so\n  // rather than looking like a settled result. It does not shorten the next window \u2014 see CHECK_INTERVAL_MS.\n  writeCache({ lastCheckMs: nowMs, latestVersion, updateCommand: null, outcome: 'installing' })\n\n  const parentGone = await waitForParentExit(deps.parentPid, { isProcessAlive, sleep, clock })\n\n  // A long-lived parent (`infra-kit dev`) outlasted the wait. Stay silent and retry next window.\n  if (!parentGone) return finish('parent-still-running', { latestVersion, updateCommand: null })\n\n  // `shell` on win32 so the `.cmd` shims npm/pnpm/yarn ship as global bins resolve.\n  //\n  // `packageManagerInstallEnv` strips the inherited npx/dlx markers \u2014 which otherwise make\n  // pnpm/portless-style tools believe they were invoked via `npx`/`dlx` and refuse to run \u2014 while KEEPING\n  // `npm_config_prefix` and `npm_config_registry`. Using the blunt `withoutPackageManagerEnv` here was a\n  // bug: it also erased the prefix that `detectInstallManager` had just matched on, so we would detect a\n  // global install at prefix P and then install into the default prefix instead \u2014 silently, forever. See\n  // the module doc on `packageManagerInstallEnv`.\n  //\n  // `cwd` is pinned to the home directory, and this is a SECURITY control, not tidiness: npm resolves\n  // `registry=` from an `.npmrc` on disk relative to the cwd. Inheriting the caller's cwd would let any\n  // repo containing a hostile `.npmrc` silently redirect this unattended `install -g` to an attacker's\n  // registry, executing its lifecycle scripts. Stripping `npm_config_registry` from the env does NOT\n  // close that hole, because the redirect lives in a file, not the environment.\n  const result = spawn(updateCommand[0] as string, updateCommand.slice(1), {\n    stdio: 'ignore',\n    shell: process.platform === 'win32',\n    cwd: homedir(),\n    env: packageManagerInstallEnv(env),\n    windowsHide: true,\n  })\n\n  // Record the manual command so a persistently failing silent install (EACCES on a root-owned global\n  // dir, say) still surfaces ONE actionable line, instead of failing invisibly forever.\n  if (result.error || result.signal || result.status !== 0) {\n    return finish('install-failed', { latestVersion, updateCommand })\n  }\n\n  // Exit 0 is the package manager saying it is content, not that anything changed. `pnpm add -g\n  // infra-kit@latest` resolved the tag from its own stale metadata cache, reinstalled the version already\n  // present, and returned 0 \u2014 and this function recorded `installed`, cleared `latestVersion`, and\n  // repeated the same no-op every cycle. The spec is pinned now, but the check that would have SHOWN\n  // that bug is this one: ask the binary the user actually runs. A mismatch keeps `latestVersion` and the\n  // command in the cache, so the parent prints the manual line instead of staying silent.\n  const nowInstalled = installedVersion(env)\n\n  if (nowInstalled !== latestVersion) return finish('install-stale', { latestVersion, updateCommand })\n\n  // Verified: clear `latestVersion` so the next run does not re-notify.\n  return finish('installed', { latestVersion: null, updateCommand: null })\n}\n", "/**\n * Single-flight lock for the background update worker.\n *\n * Without it, N shells starting at once all read the same stale cache and each spawns a worker \u2014 and\n * once a newer version exists, each of those runs `npm install -g` concurrently, over the same global\n * directory. (Measured: five concurrent `ik` invocations spawn five workers.) The throttle in the cache\n * cannot prevent this: it is only written AFTER the fetch returns, long after the other workers launched.\n *\n * `openSync(path, 'wx')` is the primitive \u2014 an atomic create-if-absent, so exactly one worker wins even\n * if all of them call it in the same millisecond.\n */\nimport fs from 'node:fs'\nimport path from 'node:path'\nimport process from 'node:process'\n\nimport { getCacheRoot } from 'src/lib/constants'\n\nexport const LOCK_FILE_NAME = 'update-check.lock'\n\n/**\n * A lock older than this is assumed to belong to a worker that was killed before it could clean up.\n *\n * Must exceed the worker's ENTIRE critical section, and the install is part of it: the lock is held across\n * `fetch` (\u22642.5s) + the parent wait (\u22645min) + `npm install -g`, which has no bound at all \u2014 a cold cache on\n * a slow link can run for many minutes. The previous 10 minutes was budgeted from the wait and the fetch\n * alone, silently omitting the very operation the lock exists to serialise. A slow enough install therefore\n * had its own LIVE lock reaped as stale by the next worker, which then ran a second concurrent\n * `npm install -g` over the same global directory \u2014 precisely the pile-up described above.\n *\n * The throttle, not this timeout, is now the primary guard: `runUpdateCheck` stamps `lastCheckMs` BEFORE\n * the wait and the install, so concurrent shells stop spawning workers at all. This value only has to\n * outlive a plausible install, and is deliberately generous \u2014 the cost of being too large is that a worker\n * killed mid-install delays the next attempt, which the throttle would delay anyway.\n */\nexport const LOCK_STALE_MS = 30 * 60 * 1000\n\nexport const lockFilePath = (): string => {\n  return path.join(getCacheRoot(), LOCK_FILE_NAME)\n}\n\nexport interface LockDeps {\n  nowMs?: number\n  lockPath?: string\n}\n\n/** Delete a lock whose mtime predates the staleness window. Best-effort: losing the race is harmless. */\nconst reapIfStale = (lockPath: string, nowMs: number): void => {\n  try {\n    if (nowMs - fs.statSync(lockPath).mtimeMs > LOCK_STALE_MS) fs.rmSync(lockPath, { force: true })\n  } catch {\n    // Vanished under us \u2014 another worker reaped it. Nothing to do.\n  }\n}\n\n/**\n * Take the lock, or return null when another worker already holds it.\n *\n * Returns a release function rather than a boolean so the caller cannot forget which path releases:\n * there is exactly one handle, and it is the only thing that can unlink the file.\n *\n * @example\n * const release = acquireUpdateLock()\n * if (!release) return 'already-running'\n * try { ... } finally { release() }\n */\nexport const acquireUpdateLock = (deps: LockDeps = {}): (() => void) | null => {\n  const nowMs = deps.nowMs ?? Date.now()\n  const lockPath = deps.lockPath ?? lockFilePath()\n\n  try {\n    fs.mkdirSync(path.dirname(lockPath), { recursive: true })\n  } catch {\n    return null\n  }\n\n  const open = (): number | null => {\n    try {\n      // 'wx' fails with EEXIST if the file is already there: an atomic test-and-set.\n      return fs.openSync(lockPath, 'wx', 0o600)\n    } catch {\n      return null\n    }\n  }\n\n  let fd = open()\n\n  if (fd === null) {\n    reapIfStale(lockPath, nowMs)\n    // One retry only. If a live worker holds the lock, we are the loser and must simply stand down.\n    fd = open()\n  }\n\n  if (fd === null) return null\n\n  try {\n    fs.writeFileSync(fd, String(process.pid))\n  } catch {\n    // The pid is a debugging aid, not part of the protocol; the lock is held either way.\n  }\n\n  return () => {\n    try {\n      fs.closeSync(fd)\n    } catch {\n      // Already closed.\n    }\n\n    try {\n      fs.rmSync(lockPath, { force: true })\n    } catch {\n      // Already gone; a later worker will reap it via LOCK_STALE_MS regardless.\n    }\n  }\n}\n", "/**\n * Ask the npm registry for the `latest` dist-tag. Node >= 24 (see `engines`), so global `fetch` is\n * available and this needs no dependency.\n */\nimport { PACKAGE_NAME } from 'src/lib/install-manager'\n\nexport const DEFAULT_REGISTRY = 'https://registry.npmjs.org'\n\n/**\n * Bounded so a hanging registry can never keep a detached child alive indefinitely. 5s, not a tighter\n * bound: the abbreviated `/pkg/latest` endpoint is usually ~20-900ms, but a cold TLS/DNS handshake in a\n * freshly-spawned worker can spike past a 2.5s cap \u2014 and a single trip used to cost a `fetch-failed` that\n * pushed the next check a full window out. A detached child that lingers a few extra seconds harms nothing.\n */\nexport const FETCH_TIMEOUT_MS = 5_000\n\n/**\n * The registry this install actually talks to. A user behind a corporate mirror has `npm_config_registry`\n * set; hitting registry.npmjs.org directly would either fail closed (firewall) or, worse, report a public\n * version they cannot install.\n *\n * @example\n * registryUrl({ npm_config_registry: 'https://nexus.corp/repo/npm/' }) // => 'https://nexus.corp/repo/npm'\n */\n/**\n * `npm_config_registry` in WHICHEVER case the environment spells it.\n *\n * A bare `env.npm_config_registry` reads only the lowercase form, but npm itself matches `/^npm_config_/i`,\n * and POSIX `process.env` is case-SENSITIVE \u2014 so a `NPM_CONFIG_REGISTRY` (the form Dockerfiles and CI\n * images export) was invisible here while npm honoured it. The check then queried the public registry that\n * the install would never touch: the two halves of this feature were exactly inverted.\n */\nconst configuredRegistry = (env: NodeJS.ProcessEnv): string | undefined => {\n  const hit = Object.entries(env).find(([key, value]) => {\n    return /^npm_config_registry$/i.test(key) && value != null && value !== ''\n  })\n\n  return hit?.[1]\n}\n\nexport const registryUrl = (env: NodeJS.ProcessEnv): string => {\n  const configured = configuredRegistry(env)\n\n  let base = configured != null && configured !== '' ? configured : DEFAULT_REGISTRY\n\n  // A `/\\/+$/` regex would do this in one line, but its backtracking is super-linear on a hostile input.\n  while (base.endsWith('/')) {\n    base = base.slice(0, -1)\n  }\n\n  return base\n}\n\n/**\n * The published `latest` version, or null on ANY failure (offline, timeout, non-200, malformed body).\n * Never throws: a failed check must be indistinguishable from \"no update available\" to every caller.\n *\n * @example\n * await fetchLatestVersion(process.env) // => '0.1.131' | null\n */\nexport const fetchLatestVersion = async (\n  env: NodeJS.ProcessEnv,\n  fetchFn: typeof fetch = fetch,\n): Promise<string | null> => {\n  const controller = new AbortController()\n  const timer = setTimeout(() => {\n    controller.abort()\n  }, FETCH_TIMEOUT_MS)\n\n  try {\n    const response = await fetchFn(`${registryUrl(env)}/${PACKAGE_NAME}/latest`, {\n      signal: controller.signal,\n      headers: { accept: 'application/json' },\n    })\n\n    if (!response.ok) return null\n\n    const body: unknown = await response.json()\n    const version = (body as { version?: unknown } | null)?.version\n\n    return typeof version === 'string' && version !== '' ? version : null\n  } catch {\n    return null\n  } finally {\n    clearTimeout(timer)\n  }\n}\n", "/**\n * Registry-safe version comparison for the auto-update check.\n *\n * Deliberately NOT `src/lib/version-utils`: `parseVersion` there does `versionStr.slice(1)` because it\n * only ever sees `v`-prefixed release tags, so it turns a bare registry version (`0.1.130`) into\n * `[NaN, 1, 130]`. Feeding npm's `dist-tags.latest` through it silently compares NaNs and never fires.\n * These inputs are bare semver from `registry.npmjs.org` and from our own `package.json`.\n */\n\n/** `1.2.3-beta.4+build` \u2192 the `[1, 2, 3]` release triple and the `beta.4` prerelease, or null if unparsable. */\ninterface ParsedVersion {\n  release: [number, number, number]\n  /** Dot-separated prerelease identifiers, empty when this is a final release. */\n  prerelease: string[]\n}\n\nconst RELEASE_PATTERN = /^(\\d+)\\.(\\d+)\\.(\\d+)$/\n\n/**\n * Parse bare semver. Returns null (never throws, never NaNs) for anything that is not\n * `major.minor.patch` with optional `-prerelease` and `+build` \u2014 a garbled registry body must read as\n * \"no update\", not as \"update to NaN\".\n *\n * @example\n * parseSemver('0.1.130') // => { release: [0, 1, 130], prerelease: [] }\n * parseSemver('1.0.0-rc.1+abc') // => { release: [1, 0, 0], prerelease: ['rc', '1'] }\n * parseSemver('v1.0.0') // => null\n */\nexport const parseSemver = (version: string): ParsedVersion | null => {\n  // Build metadata is ignored entirely by semver precedence rules.\n  const [withoutBuild = ''] = version.trim().split('+')\n  const [core = '', ...prereleaseParts] = withoutBuild.split('-')\n  const match = RELEASE_PATTERN.exec(core)\n\n  if (!match) return null\n\n  const [major, minor, patch] = [match[1], match[2], match[3]].map(Number) as [number, number, number]\n\n  return {\n    release: [major, minor, patch],\n    // Re-join on '-' so `1.0.0-rc-1` keeps its hyphen inside a single identifier.\n    prerelease: prereleaseParts.length > 0 ? prereleaseParts.join('-').split('.') : [],\n  }\n}\n\nconst NUMERIC_IDENTIFIER = /^\\d+$/\n\n/** Compare two unequal prerelease identifiers per semver \u00A711. Numeric ones rank below alphanumeric ones. */\nconst compareIdentifier = (left: string, right: string): number => {\n  const leftNumeric = NUMERIC_IDENTIFIER.test(left)\n  const rightNumeric = NUMERIC_IDENTIFIER.test(right)\n\n  if (leftNumeric && rightNumeric) return Number(left) - Number(right)\n  if (leftNumeric !== rightNumeric) return leftNumeric ? -1 : 1\n\n  return left < right ? -1 : 1\n}\n\n/** Compare prerelease identifier lists. A shorter list has lower precedence: `1.0.0-rc` < `1.0.0-rc.1`. */\nconst comparePrerelease = (a: string[], b: string[]): number => {\n  for (let index = 0; index < Math.max(a.length, b.length); index += 1) {\n    const left = a[index]\n    const right = b[index]\n\n    if (left === undefined) return -1\n    if (right === undefined) return 1\n    if (left !== right) return compareIdentifier(left, right)\n  }\n\n  return 0\n}\n\n/**\n * Is `latest` strictly newer than `current`? False when either is unparsable, so a bad registry\n * response can never trigger an install.\n *\n * The load-bearing case is NUMERIC, not lexical, comparison: `0.1.9` must be older than `0.1.130`.\n * A string compare would order them the other way and pin every user to the older build forever.\n *\n * A final release outranks its own prereleases (`1.0.0` > `1.0.0-rc.1`), so a user on `rc` is offered\n * the release, and a user on the release is never \"downgraded\" to an rc.\n *\n * @example\n * isNewerVersion('0.1.130', '0.1.9') // => true  (numeric, not lexical)\n * isNewerVersion('1.0.0', '1.0.0-rc.1') // => true\n * isNewerVersion('0.1.130', '0.1.130') // => false\n * isNewerVersion('garbage', '0.1.0') // => false\n */\nexport const isNewerVersion = (latest: string, current: string): boolean => {\n  const parsedLatest = parseSemver(latest)\n  const parsedCurrent = parseSemver(current)\n\n  if (!parsedLatest || !parsedCurrent) return false\n\n  for (let index = 0; index < 3; index += 1) {\n    const left = parsedLatest.release[index] as number\n    const right = parsedCurrent.release[index] as number\n\n    if (left !== right) return left > right\n  }\n\n  const latestIsFinal = parsedLatest.prerelease.length === 0\n  const currentIsFinal = parsedCurrent.prerelease.length === 0\n\n  if (latestIsFinal !== currentIsFinal) return latestIsFinal\n\n  return comparePrerelease(parsedLatest.prerelease, parsedCurrent.prerelease) > 0\n}\n", "/**\n * The throttle + notice state for the auto-update check, at `$cacheRoot/update-check.json`.\n *\n * `getCacheRoot()` \u2014 NOT `getSessionCacheDir()`, which throws unless `INFRA_KIT_SESSION` is set. A user\n * who installed this CLI globally and never ran `infra-kit setup` has no session, and the update check\n * must still work for exactly that person.\n */\nimport fs from 'node:fs'\nimport path from 'node:path'\n\nimport { atomicWriteFileSync, getCacheRoot } from 'src/lib/constants'\n\nexport const CACHE_FILE_NAME = 'update-check.json'\n\n/**\n * The ONE re-check window, whatever the last outcome was. A background check is cheap \u2014 one\n * detached child and a single registry fetch bounded by `FETCH_TIMEOUT_MS` \u2014 but not once per\n * shell command, which is the storm this throttle exists to stop.\n *\n * MUST stay above a full worker cycle: `runUpdateCheck` stamps `lastCheckMs` BEFORE waiting up to\n * `PARENT_WAIT_TIMEOUT_MS` (5min) for the parent to exit and THEN installing.\n */\n// There is deliberately no shorter \"retry after a transient failure\" window. One used to exist\n// because this interval was 24h, and burning a whole day on a single network blip locked out\n// exactly the publisher pushing a release mid-window. At 20 minutes that gap is gone: a blip costs\n// one window, so a second window buys nothing and cannot pay for what it costs.\n//\n// What it would cost: go below a full worker cycle and the cache reads stale while the first worker\n// is still legitimately working, so the next shell spawns a worker that dies on the live\n// single-flight lock and returns WITHOUT writing \u2014 leaving the cache stale for every command until\n// `LOCK_STALE_MS` (30min) reaps the lock. That is the per-command spawn storm this throttle exists\n// to prevent, and it is why a 5-minute retry window is not an option.\nexport const CHECK_INTERVAL_MS = 20 * 60 * 1000\n\nexport interface UpdateCache {\n  /**\n   * When the last check was ATTEMPTED \u2014 never \"when it last succeeded\". An offline user whose fetch\n   * throws must still burn their window, or every single command spawns another doomed child.\n   */\n  lastCheckMs: number\n  /** Latest version seen on the registry, or null when the last attempt failed. */\n  latestVersion: string | null\n  /**\n   * The command the USER must run, set only when the worker was not allowed to install for them\n   * (Homebrew, or an install location it could not identify). Null means \"handled, say nothing\".\n   *\n   * The worker decides this, not the reader: identifying the owning package manager can cost an\n   * `npm root -g` subprocess, and the CLI startup path must never pay for one. The background child\n   * already pays it, so it writes the verdict down.\n   */\n  updateCommand: string[] | null\n  /**\n   * The last check's terminal outcome (`installed`, `fetch-failed`, `up-to-date`, \u2026), or absent on a\n   * cache written before this field existed.\n   *\n   * Diagnostic ONLY \u2014 nothing branches on it, {@link isStale} included. It earns its keep by being the\n   * one thing that makes this file legible: a successful `installed` and a failed `fetch-failed` both\n   * write a byte-identical `{latestVersion:null, updateCommand:null}`, so without this the cache cannot\n   * say which happened, and a silent auto-update leaves no other trace of what it did.\n   */\n  outcome?: string | null\n}\n\nexport const cacheFilePath = (): string => {\n  return path.join(getCacheRoot(), CACHE_FILE_NAME)\n}\n\nconst isStringArray = (value: unknown): value is string[] => {\n  return (\n    Array.isArray(value) &&\n    value.every((entry) => {\n      return typeof entry === 'string'\n    })\n  )\n}\n\nconst isUpdateCache = (value: unknown): value is UpdateCache => {\n  if (typeof value !== 'object' || value === null) return false\n\n  const { lastCheckMs, latestVersion, updateCommand, outcome } = value as Partial<UpdateCache>\n\n  return (\n    typeof lastCheckMs === 'number' &&\n    Number.isFinite(lastCheckMs) &&\n    (latestVersion === null || typeof latestVersion === 'string') &&\n    (updateCommand === null || isStringArray(updateCommand)) &&\n    (outcome === undefined || outcome === null || typeof outcome === 'string')\n  )\n}\n\n/**\n * Read the cache, or null when it is missing/unreadable/corrupt. A null read means \"stale\" to every\n * caller, so a first run and a hand-mangled file behave identically: check again.\n *\n * @example\n * readUpdateCache() // => { lastCheckMs: 1770000000000, latestVersion: '0.1.131' } | null\n */\nexport const readUpdateCache = (\n  readFile: (p: string) => string = (p) => {\n    return fs.readFileSync(p, 'utf8')\n  },\n): UpdateCache | null => {\n  try {\n    const parsed: unknown = JSON.parse(readFile(cacheFilePath()))\n\n    return isUpdateCache(parsed) ? parsed : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Persist the check result. Creates `$cacheRoot` first: `atomicWriteFileSync` writes a temp file\n * beside the target and renames, so it throws ENOENT on a machine that has never had a `~/.cache/infra-kit`.\n * Without this mkdir the write fails, `lastCheckMs` never lands, and the throttle degrades into a\n * detached-child spawn on every invocation.\n *\n * @example\n * writeUpdateCache({ lastCheckMs: Date.now(), latestVersion: '0.1.131' })\n */\nexport const writeUpdateCache = (cache: UpdateCache): void => {\n  const root = getCacheRoot()\n\n  fs.mkdirSync(root, { recursive: true })\n  atomicWriteFileSync(path.join(root, CACHE_FILE_NAME), JSON.stringify(cache), 0o600)\n}\n\n/**\n * Has the throttle window elapsed? A missing cache is stale by definition (first run).\n *\n * A `lastCheckMs` in the future (clock skew, or a restored backup) also reads as stale rather than\n * locking the user out of updates until their clock catches up.\n *\n * The window does NOT depend on `outcome`: every last outcome, transient or settled, is re-checked\n * after {@link CHECK_INTERVAL_MS}. See that constant for why a shorter transient-failure window is not\n * worth its cost here.\n *\n * @example\n * isStale(null, 1_000) // => true\n * isStale({ lastCheckMs: 0, latestVersion: null, updateCommand: null }, CHECK_INTERVAL_MS + 1) // => true\n */\nexport const isStale = (cache: UpdateCache | null, nowMs: number): boolean => {\n  if (!cache) return true\n\n  const elapsed = nowMs - cache.lastCheckMs\n\n  if (elapsed < 0) return true\n\n  return elapsed >= CHECK_INTERVAL_MS\n}\n"],
+  "mappings": "oJAWA,OAAS,aAAAA,MAAiB,qBAC1B,OAAS,WAAAC,MAAe,UACxB,OAAOC,MAAa,eCFpB,OAAOC,MAAQ,UACf,OAAOC,MAAU,YACjB,OAAOC,MAAa,eAIb,IAAMC,EAAiB,oBAiBjBC,EAAgB,KAAU,IAE1BC,EAAe,IACnBC,EAAK,KAAKC,EAAa,EAAGJ,CAAc,EAS3CK,EAAc,CAACC,EAAkBC,IAAwB,CAC7D,GAAI,CACEA,EAAQC,EAAG,SAASF,CAAQ,EAAE,QAAUL,GAAeO,EAAG,OAAOF,EAAU,CAAE,MAAO,EAAK,CAAC,CAChG,MAAQ,CAER,CACF,EAaaG,EAAoB,CAACC,EAAiB,CAAC,IAA2B,CAC7E,IAAMH,EAAQG,EAAK,OAAS,KAAK,IAAI,EAC/BJ,EAAWI,EAAK,UAAYR,EAAa,EAE/C,GAAI,CACFM,EAAG,UAAUL,EAAK,QAAQG,CAAQ,EAAG,CAAE,UAAW,EAAK,CAAC,CAC1D,MAAQ,CACN,OAAO,IACT,CAEA,IAAMK,EAAO,IAAqB,CAChC,GAAI,CAEF,OAAOH,EAAG,SAASF,EAAU,KAAM,GAAK,CAC1C,MAAQ,CACN,OAAO,IACT,CACF,EAEIM,EAAKD,EAAK,EAQd,GANIC,IAAO,OACTP,EAAYC,EAAUC,CAAK,EAE3BK,EAAKD,EAAK,GAGRC,IAAO,KAAM,OAAO,KAExB,GAAI,CACFJ,EAAG,cAAcI,EAAI,OAAOC,EAAQ,GAAG,CAAC,CAC1C,MAAQ,CAER,CAEA,MAAO,IAAM,CACX,GAAI,CACFL,EAAG,UAAUI,CAAE,CACjB,MAAQ,CAER,CAEA,GAAI,CACFJ,EAAG,OAAOF,EAAU,CAAE,MAAO,EAAK,CAAC,CACrC,MAAQ,CAER,CACF,CACF,EC3GO,IAAMQ,EAAmB,6BAQnBC,EAAmB,IAkB1BC,EAAsBC,GACd,OAAO,QAAQA,CAAG,EAAE,KAAK,CAAC,CAACC,EAAKC,CAAK,IACxC,yBAAyB,KAAKD,CAAG,GAAKC,GAAS,MAAQA,IAAU,EACzE,IAEY,CAAC,EAGHC,EAAeH,GAAmC,CAC7D,IAAMI,EAAaL,EAAmBC,CAAG,EAErCK,EAAOD,GAAc,MAAQA,IAAe,GAAKA,EAAaP,EAGlE,KAAOQ,EAAK,SAAS,GAAG,GACtBA,EAAOA,EAAK,MAAM,EAAG,EAAE,EAGzB,OAAOA,CACT,EASaC,EAAqB,MAChCN,EACAO,EAAwB,QACG,CAC3B,IAAMC,EAAa,IAAI,gBACjBC,EAAQ,WAAW,IAAM,CAC7BD,EAAW,MAAM,CACnB,EAAGV,CAAgB,EAEnB,GAAI,CACF,IAAMY,EAAW,MAAMH,EAAQ,GAAGJ,EAAYH,CAAG,CAAC,IAAIW,CAAY,UAAW,CAC3E,OAAQH,EAAW,OACnB,QAAS,CAAE,OAAQ,kBAAmB,CACxC,CAAC,EAED,GAAI,CAACE,EAAS,GAAI,OAAO,KAGzB,IAAME,GADgB,MAAMF,EAAS,KAAK,IACc,QAExD,OAAO,OAAOE,GAAY,UAAYA,IAAY,GAAKA,EAAU,IACnE,MAAQ,CACN,OAAO,IACT,QAAE,CACA,aAAaH,CAAK,CACpB,CACF,ECtEA,IAAMI,EAAkB,wBAYXC,EAAeC,GAA0C,CAEpE,GAAM,CAACC,EAAe,EAAE,EAAID,EAAQ,KAAK,EAAE,MAAM,GAAG,EAC9C,CAACE,EAAO,GAAI,GAAGC,CAAe,EAAIF,EAAa,MAAM,GAAG,EACxDG,EAAQN,EAAgB,KAAKI,CAAI,EAEvC,GAAI,CAACE,EAAO,OAAO,KAEnB,GAAM,CAACC,EAAOC,EAAOC,CAAK,EAAI,CAACH,EAAM,CAAC,EAAGA,EAAM,CAAC,EAAGA,EAAM,CAAC,CAAC,EAAE,IAAI,MAAM,EAEvE,MAAO,CACL,QAAS,CAACC,EAAOC,EAAOC,CAAK,EAE7B,WAAYJ,EAAgB,OAAS,EAAIA,EAAgB,KAAK,GAAG,EAAE,MAAM,GAAG,EAAI,CAAC,CACnF,CACF,EAEMK,EAAqB,QAGrBC,EAAoB,CAACC,EAAcC,IAA0B,CACjE,IAAMC,EAAcJ,EAAmB,KAAKE,CAAI,EAC1CG,EAAeL,EAAmB,KAAKG,CAAK,EAElD,OAAIC,GAAeC,EAAqB,OAAOH,CAAI,EAAI,OAAOC,CAAK,EAC/DC,IAAgBC,EAAqBD,EAAc,GAAK,EAErDF,EAAOC,EAAQ,GAAK,CAC7B,EAGMG,EAAoB,CAACC,EAAaC,IAAwB,CAC9D,QAASC,EAAQ,EAAGA,EAAQ,KAAK,IAAIF,EAAE,OAAQC,EAAE,MAAM,EAAGC,GAAS,EAAG,CACpE,IAAMP,EAAOK,EAAEE,CAAK,EACdN,EAAQK,EAAEC,CAAK,EAErB,GAAIP,IAAS,OAAW,MAAO,GAC/B,GAAIC,IAAU,OAAW,MAAO,GAChC,GAAID,IAASC,EAAO,OAAOF,EAAkBC,EAAMC,CAAK,CAC1D,CAEA,MAAO,EACT,EAkBaO,EAAiB,CAACC,EAAgBC,IAA6B,CAC1E,IAAMC,EAAetB,EAAYoB,CAAM,EACjCG,EAAgBvB,EAAYqB,CAAO,EAEzC,GAAI,CAACC,GAAgB,CAACC,EAAe,MAAO,GAE5C,QAASL,EAAQ,EAAGA,EAAQ,EAAGA,GAAS,EAAG,CACzC,IAAMP,EAAOW,EAAa,QAAQJ,CAAK,EACjCN,EAAQW,EAAc,QAAQL,CAAK,EAEzC,GAAIP,IAASC,EAAO,OAAOD,EAAOC,CACpC,CAEA,IAAMY,EAAgBF,EAAa,WAAW,SAAW,EACnDG,EAAiBF,EAAc,WAAW,SAAW,EAE3D,OAAIC,IAAkBC,EAAuBD,EAEtCT,EAAkBO,EAAa,WAAYC,EAAc,UAAU,EAAI,CAChF,ECpGA,OAAOG,MAAQ,UACf,OAAOC,MAAU,YAIV,IAAMC,EAAkB,oBAoBlBC,EAAoB,KAAU,IA+B9BC,EAAgB,IACpBC,EAAK,KAAKC,EAAa,EAAGJ,CAAe,EAG5CK,GAAiBC,GAEnB,MAAM,QAAQA,CAAK,GACnBA,EAAM,MAAOC,GACJ,OAAOA,GAAU,QACzB,EAICC,GAAiBF,GAAyC,CAC9D,GAAI,OAAOA,GAAU,UAAYA,IAAU,KAAM,MAAO,GAExD,GAAM,CAAE,YAAAG,EAAa,cAAAC,EAAe,cAAAC,EAAe,QAAAC,CAAQ,EAAIN,EAE/D,OACE,OAAOG,GAAgB,UACvB,OAAO,SAASA,CAAW,IAC1BC,IAAkB,MAAQ,OAAOA,GAAkB,YACnDC,IAAkB,MAAQN,GAAcM,CAAa,KAC5BC,GAAY,MAAQ,OAAOA,GAAY,SAErE,EASaC,GAAkB,CAC7BC,EAAmCC,GAC1BC,EAAG,aAAaD,EAAG,MAAM,IAEX,CACvB,GAAI,CACF,IAAME,EAAkB,KAAK,MAAMH,EAASZ,EAAc,CAAC,CAAC,EAE5D,OAAOM,GAAcS,CAAM,EAAIA,EAAS,IAC1C,MAAQ,CACN,OAAO,IACT,CACF,EAWaC,EAAoBC,GAA6B,CAC5D,IAAMC,EAAOhB,EAAa,EAE1BY,EAAG,UAAUI,EAAM,CAAE,UAAW,EAAK,CAAC,EACtCC,EAAoBlB,EAAK,KAAKiB,EAAMpB,CAAe,EAAG,KAAK,UAAUmB,CAAK,EAAG,GAAK,CACpF,EAgBaG,GAAU,CAACH,EAA2BI,IAA2B,CAC5E,GAAI,CAACJ,EAAO,MAAO,GAEnB,IAAMK,EAAUD,EAAQJ,EAAM,YAE9B,OAAIK,EAAU,EAAU,GAEjBA,GAAWvB,CACpB,EJ5HO,IAAMwB,GAA0B,IAO1BC,GAAyB,IAAS,IA2BzCC,GAA2B,KAc3BC,GAAwBC,GAA0C,CACtE,IAAMC,EAASC,EAAUC,EAAc,CAAC,UAAW,QAAQ,EAAG,CAC5D,MAAO,CAAC,SAAU,OAAQ,QAAQ,EAClC,MAAOC,EAAQ,WAAa,QAC5B,IAAKC,EAAQ,EACb,IAAAL,EACA,QAASF,GACT,YAAa,GACb,SAAU,MACZ,CAAC,EAED,GAAIG,EAAO,OAASA,EAAO,QAAUA,EAAO,SAAW,EAAG,OAAO,KAEjE,GAAI,CAEF,IAAMK,EADkB,KAAK,MAAML,EAAO,MAAM,GACU,QAE1D,OAAO,OAAOK,GAAY,UAAYA,IAAY,GAAKA,EAAU,IACnE,MAAQ,CACN,OAAO,IACT,CACF,EAGMC,GAAyBC,GAAyB,CACtD,GAAI,CACF,OAAAJ,EAAQ,KAAKI,EAAK,CAAC,EAEZ,EACT,MAAQ,CACN,MAAO,EACT,CACF,EAEMC,GAAgBC,GACb,IAAI,QAASC,GAAY,CAC9B,WAAWA,EAASD,CAAE,CACxB,CAAC,EAOGE,GAAoB,MACxBC,EACAC,IACqB,CACrB,IAAMC,EAAWD,EAAK,MAAM,EAAIjB,GAEhC,KAAOiB,EAAK,MAAM,EAAIC,GAAU,CAC9B,GAAI,CAACD,EAAK,eAAeD,CAAS,EAAG,MAAO,GAE5C,MAAMC,EAAK,MAAMlB,EAAuB,CAC1C,CAEA,MAAO,CAACkB,EAAK,eAAeD,CAAS,CACvC,EAyBaG,GAAiB,MAAOC,EAAwBH,IAA0D,CAMrH,IAAMI,GALcJ,EAAK,aAAeK,GAKZ,EAE5B,GAAI,CAACD,EAAS,MAAO,kBAErB,GAAI,CACF,OAAO,MAAME,GAAqBH,EAAgBH,CAAI,CACxD,QAAE,CACAI,EAAQ,CACV,CACF,EAEME,GAAuB,MAAOH,EAAwBH,IAA0D,CACpH,IAAMd,EAAMc,EAAK,KAAOV,EAAQ,IAC1BiB,EAAQP,EAAK,OAAS,KAAK,IAAI,EAC/BQ,EAAcR,EAAK,aAAeS,EAClCC,EAAaV,EAAK,YAAcW,EAChCC,EAAiBZ,EAAK,gBAAkBP,GACxCoB,EAAQb,EAAK,OAASL,GACtBmB,EAAQd,EAAK,OAAS,KAAK,IAC3Be,EAAcf,EAAK,aAAegB,EAClCC,EAAQjB,EAAK,WAAaZ,EAC1B8B,EAAmBlB,EAAK,kBAAoBf,GAE5CkC,EAAgB,MAAMX,EAAYtB,CAAG,EAKrCkC,EAAS,CACbC,EACAC,KAKAZ,EAAW,CAAE,YAAaH,EAAO,GAAGe,EAAO,QAAAD,CAAQ,CAAC,EAE7CA,GAGT,GAAIF,IAAkB,KAAM,OAAOC,EAAO,eAAgB,CAAE,cAAe,KAAM,cAAe,IAAK,CAAC,EACtG,GAAI,CAACG,EAAeJ,EAAehB,CAAc,EAC/C,OAAOiB,EAAO,aAAc,CAAE,cAAAD,EAAe,cAAe,IAAK,CAAC,EAQpE,GAAM,CAAE,aAAAK,EAAc,cAAAC,CAAc,EAAIC,EAAqB,CAC3D,aAAc1B,EAAK,aACnB,IAAAd,EACA,SAAUyC,EACV,YAAAZ,EACA,QAASI,CACX,CAAC,EAID,GAAI,CAACK,EAAc,OAAOJ,EAAO,oBAAqB,CAAE,cAAAD,EAAe,cAAAM,CAAc,CAAC,EAKtF,GAAIzB,EAAK,WAAa,KAAM,OAAOoB,EAAO,iBAAkB,CAAE,cAAAD,EAAe,cAAe,IAAK,CAAC,EAqBlG,GALAT,EAAW,CAAE,YAAaH,EAAO,cAAAY,EAAe,cAAe,KAAM,QAAS,YAAa,CAAC,EAKxF,CAHe,MAAMrB,GAAkBE,EAAK,UAAW,CAAE,eAAAY,EAAgB,MAAAC,EAAO,MAAAC,CAAM,CAAC,EAG1E,OAAOM,EAAO,uBAAwB,CAAE,cAAAD,EAAe,cAAe,IAAK,CAAC,EAgB7F,IAAMhC,EAAS8B,EAAMQ,EAAc,CAAC,EAAaA,EAAc,MAAM,CAAC,EAAG,CACvE,MAAO,SACP,MAAOnC,EAAQ,WAAa,QAC5B,IAAKC,EAAQ,EACb,IAAKqC,EAAyB1C,CAAG,EACjC,YAAa,EACf,CAAC,EAID,OAAIC,EAAO,OAASA,EAAO,QAAUA,EAAO,SAAW,EAC9CiC,EAAO,iBAAkB,CAAE,cAAAD,EAAe,cAAAM,CAAc,CAAC,EAS7CP,EAAiBhC,CAAG,IAEpBiC,EAAsBC,EAAO,gBAAiB,CAAE,cAAAD,EAAe,cAAAM,CAAc,CAAC,EAG5FL,EAAO,YAAa,CAAE,cAAe,KAAM,cAAe,IAAK,CAAC,CACzE",
+  "names": ["spawnSync", "homedir", "process", "fs", "path", "process", "LOCK_FILE_NAME", "LOCK_STALE_MS", "lockFilePath", "path", "getCacheRoot", "reapIfStale", "lockPath", "nowMs", "fs", "acquireUpdateLock", "deps", "open", "fd", "process", "DEFAULT_REGISTRY", "FETCH_TIMEOUT_MS", "configuredRegistry", "env", "key", "value", "registryUrl", "configured", "base", "fetchLatestVersion", "fetchFn", "controller", "timer", "response", "PACKAGE_NAME", "version", "RELEASE_PATTERN", "parseSemver", "version", "withoutBuild", "core", "prereleaseParts", "match", "major", "minor", "patch", "NUMERIC_IDENTIFIER", "compareIdentifier", "left", "right", "leftNumeric", "rightNumeric", "comparePrerelease", "a", "b", "index", "isNewerVersion", "latest", "current", "parsedLatest", "parsedCurrent", "latestIsFinal", "currentIsFinal", "fs", "path", "CACHE_FILE_NAME", "CHECK_INTERVAL_MS", "cacheFilePath", "path", "getCacheRoot", "isStringArray", "value", "entry", "isUpdateCache", "lastCheckMs", "latestVersion", "updateCommand", "outcome", "readUpdateCache", "readFile", "p", "fs", "parsed", "writeUpdateCache", "cache", "root", "atomicWriteFileSync", "isStale", "nowMs", "elapsed", "PARENT_POLL_INTERVAL_MS", "PARENT_WAIT_TIMEOUT_MS", "VERSION_PROBE_TIMEOUT_MS", "readInstalledVersion", "env", "result", "spawnSync", "PACKAGE_NAME", "process", "homedir", "version", "defaultIsProcessAlive", "pid", "defaultSleep", "ms", "resolve", "waitForParentExit", "parentPid", "deps", "deadline", "runUpdateCheck", "currentVersion", "release", "acquireUpdateLock", "runUpdateCheckLocked", "nowMs", "fetchLatest", "fetchLatestVersion", "writeCache", "writeUpdateCache", "isProcessAlive", "sleep", "clock", "lazyNpmRoot", "defaultLazyNpmRoot", "spawn", "installedVersion", "latestVersion", "finish", "outcome", "cache", "isNewerVersion", "canSelfSpawn", "updateCommand", "detectInstallManager", "safeRealpath", "packageManagerInstallEnv"]
+}

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import{$ as Kt,A as kt,B as Rt,C as Pt,D as te,E as xt,F as D,G as m,H as Ct,I as bt,J as At,K as Tt,L as Dt,M as It,N as Lt,O as _t,P as Nt,Q as Ot,R as Mt,S as Ft,T as $t,U as jt,V as oe,W as Ut,X as qt,Y as Gt,Z as Wt,_ as Vt,a as N,aa as Ht,b as Ue,ba as Jt,c as qe,ca as Bt,da as Yt,e as We,ea as zt,f as Ve,g as He,ga as Xt,h as Je,ha as Qt,i as O,ia as Zt,j as rt,k as j,l as st,m as at,n as ct,o as lt,p as dt,q as ut,r as mt,s as pt,t as ee,u as ft,v as gt,w as ht,x as vt,y as wt,z as St}from"./chunk-QJQQ7ENL.js";import{b as Ke,c as E,d as h,e as F,f as et,g as tt,h as ot,i as P,k as $}from"./chunk-QUXDC3A3.js";import{z as re}from"./chunk-744Y674Y.js";import{L as l,S as Q,T as $e,V as je,a as Oe,r as Me}from"./chunk-LCNORKDV.js";import"./chunk-MFAFQVTW.js";import{a as ne,b as ie,c as se}from"./chunk-IERRU26T.js";import{a as Fe,g as yt,i as U,k as q}from"./chunk-GF2CA4CD.js";import{a as Ge}from"./chunk-XJOY7J3G.js";import{a as M,b as Be,d as Ye,f as ze,g as Xe,j as Z,k as Qe,o as w,r as Ze}from"./chunk-PQG63EIV.js";import{a as Et}from"./chunk-TVG47UHG.js";import{a as nt,b as it}from"./chunk-QWVLAZ6N.js";import In,{Separator as Go}from"@inquirer/select";import{realpathSync as Ln}from"node:fs";import g from"node:process";import{fileURLToPath as Vo}from"node:url";var Ho=(e,t)=>{let o=e,r;for(let n of t){if(r=o.find(s=>s.name()===n),!r)return;o=r.commands}return r},eo=e=>Yt.flatMap(({key:t,label:o})=>Xt(t).flatMap(r=>{let n=Ho(e,r.groupPath);return n?[{name:r.groupPath.join(" "),description:n.description(),group:o}]:[]}));import{Command as Rr}from"commander";import b from"node:process";import to from"node:process";import{$ as Jo}from"zx";var ae=async()=>{let e=await Q(),t=await Promise.all([{label:"project (committed)",path:e.main},{label:"user global",path:e.userGlobal},{label:"user project",path:e.userProject}].map(async a=>({...a,exists:await E(a.path)}))),o=t.at(-1)?.exists===!0,r=await ht(e.userProject,o),n=o?vt(r):"";l.info(`Project name: ${e.projectName}
+import{$ as Kt,A as kt,B as Rt,C as Pt,D as te,E as xt,F as D,G as m,H as Ct,I as bt,J as At,K as Tt,L as Dt,M as It,N as Lt,O as _t,P as Nt,Q as Ot,R as Mt,S as Ft,T as $t,U as jt,V as oe,W as Ut,X as qt,Y as Gt,Z as Wt,_ as Vt,a as N,aa as Ht,b as Ue,ba as Jt,c as qe,ca as Bt,da as Yt,e as We,ea as zt,f as Ve,g as He,ga as Xt,h as Je,ha as Qt,i as O,ia as Zt,j as rt,k as j,l as st,m as at,n as ct,o as lt,p as dt,q as ut,r as mt,s as pt,t as ee,u as ft,v as gt,w as ht,x as vt,y as wt,z as St}from"./chunk-XN7VHD7P.js";import{b as Ke,c as E,d as h,e as F,f as et,g as tt,h as ot,i as P,k as $}from"./chunk-QUXDC3A3.js";import{z as re}from"./chunk-744Y674Y.js";import{L as l,S as Q,T as $e,V as je,a as Oe,r as Me}from"./chunk-LCNORKDV.js";import"./chunk-MFAFQVTW.js";import{a as ne,b as ie,c as se}from"./chunk-YYEUJYC7.js";import{a as Fe,g as yt,i as U,k as q}from"./chunk-Y5TLBGZT.js";import{a as Ge}from"./chunk-XJOY7J3G.js";import{a as M,b as Be,d as Ye,f as ze,g as Xe,j as Z,k as Qe,o as w,r as Ze}from"./chunk-PQG63EIV.js";import{a as Et}from"./chunk-TVG47UHG.js";import{a as nt,b as it}from"./chunk-QWVLAZ6N.js";import In,{Separator as Go}from"@inquirer/select";import{realpathSync as Ln}from"node:fs";import g from"node:process";import{fileURLToPath as Vo}from"node:url";var Ho=(e,t)=>{let o=e,r;for(let n of t){if(r=o.find(s=>s.name()===n),!r)return;o=r.commands}return r},eo=e=>Yt.flatMap(({key:t,label:o})=>Xt(t).flatMap(r=>{let n=Ho(e,r.groupPath);return n?[{name:r.groupPath.join(" "),description:n.description(),group:o}]:[]}));import{Command as Rr}from"commander";import b from"node:process";import to from"node:process";import{$ as Jo}from"zx";var ae=async()=>{let e=await Q(),t=await Promise.all([{label:"project (committed)",path:e.main},{label:"user global",path:e.userGlobal},{label:"user project",path:e.userProject}].map(async a=>({...a,exists:await E(a.path)}))),o=t.at(-1)?.exists===!0,r=await ht(e.userProject,o),n=o?vt(r):"";l.info(`Project name: ${e.projectName}
 `),l.info(`Config merge chain (later overrides earlier):
 `);for(let a of t){let i=a.exists?"  [\u2713]":"  [ ]",c=a.path===e.userProject&&n!==""?` ${n}`:"";l.info(`${i} ${a.label.padEnd(22)} ${h(a.path)}${c}`)}let s={projectName:e.projectName,layers:t.map(a=>({label:a.label,path:a.path,exists:a.exists})),hasOverrides:r.hasOverrides,overrideKeys:r.overrideKeys};return{content:[{type:"text",text:JSON.stringify(s,null,2)}],structuredContent:s}},ce=async()=>{let e=await Q(),t=to.env.EDITOR||to.env.VISUAL||"vi",o=await ut(e);o.createdConfig&&l.info(mt(o)),l.info(`Opening ${h(e.userProject)} in ${t} (per-machine override \u2014 every key except "mcp")`),await Jo({stdio:"inherit"})`${t} ${e.userProject}`,je();let r={path:e.userProject,editor:t};return{content:[{type:"text",text:JSON.stringify(r,null,2)}],structuredContent:r}};var le=e=>{if(typeof e!="object"||e===null)return null;let{config:t,reason:o,at:r}=e;return typeof t!="string"||t.length===0||typeof o!="string"||typeof r!="number"||!Number.isFinite(r)?null:{config:t,reason:o,at:r}},I=e=>`infra-kit: Doppler token for env "${e}" is missing, invalid, or unreadable \u2014 env auto-load is not running. Fix: run \`infra-kit env-token-set ${e}\` (mint one at https://dashboard.doppler.com under this config's Access tab).`;import f from"node:fs";import S from"node:path";import L from"node:process";var Bo="autoload-warn-fail.flag",de="autoload-warn-auth-fail.flag",ue="autoload-fail.flag",me="autoload-auth-fail.json",Yo=3e4,ro=async(e=!0)=>{let t;try{t=await $e()}catch{return null}let o=t.envAutoLoad;if(!o)return null;let r={trigger:o.trigger,config:o.config,project:t.envManagement.config.name};try{if(await rt(o.config))return r}catch{return r}return io({config:o.config,reason:`No Doppler service token for env "${o.config}"`,at:Date.now()}),e&&G(I(o.config),de),null},no=e=>{let{trigger:t,expectedTrigger:o,targetConfig:r,targetProject:n,env:s,force:a}=e;return t!==o||!s.session||s.cleared||s.currentConfig&&!s.autoLoadedMarker||!a&&s.autoLoadedMarker&&s.currentConfig===r&&s.currentProject===n?"skip":"load"},_=async({expectedTrigger:e,projectDir:t,force:o,isAuthFailure:r=Ke})=>{let n=e==="cli-invocation";n&&W();let s=null;try{if(s=await ro(n),!s||no({trigger:s.trigger,expectedTrigger:e,targetConfig:s.config,targetProject:s.project,env:Qo(),force:o})==="skip"||oo()||tr())return null;let i=Zo(),c=await st({config:s.config,autoLoaded:!0,projectDir:t,beforeWrite:()=>!oo()&&!er(i)});return c?(rr(),Xo(),c.filePath):null}catch(a){let i=a.message,c=r(a);return or(),c&&s&&io({config:s.config,reason:i,at:Date.now()}),n&&c&&s?(G(I(s.config),de),l.debug(`env auto-load auth failure: ${i}`)):n?G(`infra-kit: env auto-load failed \u2014 ${i} (will retry later)`,Bo):l.debug(`env auto-load skipped: ${i}`),null}},W=()=>{let e=zo();e&&(G(I(e.config),de),l.debug(`env auto-load auth failure (recorded ${new Date(e.at).toISOString()}): ${e.reason}`))},zo=()=>{try{let e=f.readFileSync(S.join(w(),me),"utf-8");return le(JSON.parse(e))}catch{return null}},io=e=>{try{let t=w();f.mkdirSync(t,{recursive:!0,mode:448}),Ze(S.join(t,me),JSON.stringify(e),384)}catch{}},Xo=()=>{try{f.rmSync(S.join(w(),me),{force:!0})}catch{}},Qo=()=>({session:L.env[Ye],cleared:L.env[Qe],currentConfig:L.env[ze],currentProject:L.env[Xe],autoLoadedMarker:L.env[Z]}),Zo=()=>{try{return f.statSync(S.join(w(),M)).mtimeMs}catch{return null}},er=e=>{try{let t=S.join(w(),M);if(!f.existsSync(t))return!1;let o=f.statSync(t).mtimeMs;return e!==null&&o<=e?!1:new RegExp(`^unset ${Z}$`,"m").test(f.readFileSync(t,"utf-8"))}catch{return!1}},oo=()=>{try{let e=w(),t=S.join(e,Be);if(!f.existsSync(t))return!1;let o=S.join(e,M);return f.existsSync(o)?f.statSync(t).mtimeMs>=f.statSync(o).mtimeMs:!0}catch{return!1}},tr=()=>{try{let e=S.join(w(),ue);return f.existsSync(e)?Date.now()-f.statSync(e).mtimeMs<Yo:!1}catch{return!1}},or=()=>{try{let e=w();f.mkdirSync(e,{recursive:!0,mode:448}),f.writeFileSync(S.join(e,ue),"",{mode:384})}catch{}},rr=()=>{try{f.rmSync(S.join(w(),ue),{force:!0})}catch{}},G=(e,t)=>{try{let o=w(),r=S.join(o,t);if(f.existsSync(r))return;f.mkdirSync(o,{recursive:!0,mode:448}),f.writeFileSync(r,"",{mode:384})}catch{}l.warn(e)};var pe=async({projectDir:e}={})=>{await _({expectedTrigger:"shell-startup",projectDir:e,force:!0})};var so="https://dashboard.doppler.com/workplace/projects",nr=(e,t)=>["Removing it locally does NOT revoke it \u2014 the token still works anywhere else it is stored.",`Revoke it in Doppler (project "${e}", config "${t}"): ${so}/${e}`],fe=async({env:e})=>{let o=!!(await et())?.envs[e];await ot(e);let r=await j(),n=await O(),s=await F();o?l.info(`Removed the "${e}" service token from ${h(s)}.`):l.info(`No "${e}" service token was stored in ${h(s)} \u2014 nothing to remove.`),r.length>0&&l.info(`Purged ${r.length} warm cache(s) across this repo's worktrees.`);for(let i of nr(n,e))l.warn(i);let a={env:e,removed:o,storePath:s,warmCachesPurged:r.length,revokeUrl:`${so}/${n}`};return{content:N(JSON.stringify(a,null,2)),structuredContent:a}};import ir from"@inquirer/password";import K from"node:process";import{$ as V}from"zx";var sr=async({stdin:e,fromEnv:t})=>{if(e)return{token:await ar(),source:"stdin"};if(t){let r=K.env[t];if(!r)throw new Error(`${t} is not set (or is empty) \u2014 nothing to store.`);return{token:r,source:"env"}}return P.setInteractive(),{token:(await $(r=>ir({message:"Paste the Doppler service token (input is hidden)",mask:!0},r),{output:K.stderr})).trim(),source:"prompt"}},ar=async()=>{let e=[];K.stdin.setEncoding("utf8");for await(let t of K.stdin)e.push(t);return e.join("").trim()},ge="DOPPLER_CONFIG",cr=3e4,lr=async(e,t,o)=>{let r=V.quiet;V.quiet=!0;let n;try{n=(await V({env:ct(e)})`doppler secrets download --no-file --format json --project ${t} --config ${o}`.timeout(cr)).stdout}catch(s){throw dr(s,o)}finally{V.quiet=r}return dt(n)},dr=(e,t)=>{let o=Oe(e)??(e instanceof Error?e.message:String(e));if(He(o)!=="auth")return e instanceof Error?e:new Error(String(e));let r=Je(o)==="mis-scoped"?"it is scoped to a DIFFERENT config (pasting another environment's token here is the mistake this check exists to catch).":"it is invalid or has been revoked.";return new Error([`Doppler refused this token for config "${t}" \u2014 ${r}`,"Nothing was written. Issue a service token scoped to that config and try again."].join(`
 `))},ur=e=>[`Could not verify this token's scope: the Doppler payload for "${e}" carries no ${ge}.`,"Refusing to store a credential whose scope is unknown (a token for the wrong environment would load","the wrong secrets into every shell).","Re-run with --force if you are certain the token is scoped to this config."].join(`

package/dist/mcp.js

@@ -1,4 +1,4 @@
-import{a as E,d as w,fa as N,ia as M,s as O}from"./chunk-QJQQ7ENL.js";import{i as P}from"./chunk-QUXDC3A3.js";import"./chunk-744Y674Y.js";import{J as g,K as A,L as i,T as I,c as _}from"./chunk-LCNORKDV.js";import"./chunk-MFAFQVTW.js";import{a as D}from"./chunk-GF2CA4CD.js";import"./chunk-XJOY7J3G.js";import"./chunk-PQG63EIV.js";import"./chunk-QWVLAZ6N.js";import{serveStdio as Ge}from"@modelcontextprotocol/server/stdio";import f from"node:process";import{setTimeout as He}from"node:timers/promises";import u from"node:process";var F=e=>{u.on("uncaughtException",t=>{e.fatal({err:t,msg:"Uncaught Exception"}),e.error(`Uncaught Exception! Check ${g}. Shutting down...`),e.flush(),u.exit(1)}),u.on("unhandledRejection",(t,o)=>{e.fatal({reason:t,promise:o,msg:"Unhandled Rejection"}),e.error(`Unhandled Rejection! Check ${g}. Shutting down...`),e.flush(),u.exit(1)})};import{McpServer as $e}from"@modelcontextprotocol/server";var q='# release-create \u2014 cutting a release through infra-kit\n\nThe tool is `mcp__infra-kit__release-create`. Everything below is about calling that tool.\n\nDo not shell out. A `Bash` call running `git switch`, `git push` or `gh pr create` reproduces none\nof the preconditions below and bypasses the confirm gate in section 2 \u2014 which is the only place a\nhuman approves the release.\n\n## 1. Preconditions\n\nCheck these before the first call; each one is a refusal the human has to clear, not something to\nwork around.\n\n- **The main repository checkout, not a linked worktree.** The tool refuses outright from inside a\n  linked worktree.\n- **A clean working tree.** Uncommitted changes are refused; the human commits or stashes.\n- **No other worktree holding the base branch.** Regular releases branch off `dev`, hotfixes off\n  `main`. If a linked worktree has that branch checked out, the tool refuses and names the path.\n- **Jira configured.** Every release gets a matching fix version, so `JIRA_BASE_URL`,\n  `JIRA_EMAIL`, `JIRA_PROJECT_ID` and `JIRA_TOKEN` (or `JIRA_API_TOKEN`) must be in the\n  environment \u2014 load them with `ik env-load` and source the file it returns. The check runs before\n  anything is cut.\n\n**You do not have to already be on the base branch.** The tool runs `git fetch origin`,\n`git switch <base>` and `git pull --ff-only` itself. That is a real side effect on the human\'s\ncheckout: say so before call 2.\n\n## 2. The two-call confirm protocol\n\n`release-create` is gated. **The first call never executes anything.**\n\n**Call 1** \u2014 send the real arguments, with no `confirm` and no `confirmToken`. The result is a gate\npayload, `{"status": "confirmation_required", ...}`, and it carries `"isError": true`.\n\n**That `isError` does not mean the call failed.** It is set because the payload is a gate rather\nthan the tool\'s declared output. Nothing was created, nothing was pushed, nothing was switched. An\nagent that reads it as a failure \u2014 and gives up, or retries, or falls back to `Bash` \u2014 has skipped\nthe human approval this protocol exists for. Do none of those.\n\nThe gate payload carries two things you need:\n\n- `resolvedArgs` \u2014 exactly the arguments the server bound. **Show these to the human.** This is the\n  approval moment; there is no other one.\n- `confirmToken` \u2014 an HMAC bound to the tool name and to those exact arguments. It expires 600\n  seconds after it is minted.\n\n**Call 2** \u2014 repeat the **same arguments**, unchanged, plus `"confirm": true` and the\n`confirmToken` from call 1.\n\nChange any argument between the two calls and round 2 comes back as\n`{"status": "confirmation_refused", "reason": "mismatch"}`. That is terminal \u2014 it is not a second\ngate. The other reasons are `absent`, `malformed`, `mac`, `expired` and `bind`, and every one of\nthem recovers the same way: call again **without** `confirm` to mint a fresh gate, then re-call\nwith those arguments and the new token. Never retry call 2 with the old token.\n\nIf the human wants different arguments, go back to call 1 with the new arguments. Do not edit the\narguments and reuse the token \u2014 that is exactly what `mismatch` refuses.\n\n## 3. What goes in `releases`\n\n`releases` is an array with at least one entry. Every entry carries **exactly one** of:\n\n- `version` \u2014 a semver string such as `"1.64.0"`, or the literal token `"next"`.\n- `name` \u2014 a free-form kebab-case identifier such as `"checkout-redesign"`.\n\nThey are mutually exclusive and one is required. An entry with both, or with neither, is rejected\nby the schema before the tool runs.\n\nEach entry also carries `type` (`"regular"` or `"hotfix"`, default `"regular"`) and an optional\n`description`, which becomes the Jira fix version\'s description and feeds the PR body.\n\n### The `"next"` token\n\n`"next"` is version-only \u2014 a named release never auto-bumps. It resolves against the union of the\nremote `release/v*` branches on `origin` and the project\'s Jira fix versions:\n\n- `"regular"` bumps the minor and resets the patch: `1.63.2` becomes `1.64.0`.\n- `"hotfix"` bumps the patch on the highest minor: `1.63.2` becomes `1.63.3`.\n\nSeveral `"next"` entries in one call advance sequentially rather than all resolving to the same\nversion.\n\n**Be honest about what `"next"` could see.** The two sources are queried in parallel and a source\nthat fails is logged and dropped, not raised \u2014 if the Jira call fails, `"next"` is computed from\nthe remote branches alone and can land on a version Jira already knows about. If neither source\nyields a prior version the tool refuses and asks for an explicit one. When the exact number\nmatters, pass the semver instead of the token.\n\n### Reading `$ARGUMENTS`\n\nThe `/infra-kit:release-create` command hands you `$ARGUMENTS` verbatim, and its argument hint is\n`[--hotfix] [--desc <text>] [<version|name>]`. **Those two flags are conventions of this command, not\nCLI flags** \u2014 `infra-kit release create` accepts neither, and the tool takes neither. They exist so a\nhuman can type the whole request on one line, and it is your job to translate them:\n\n- `--hotfix` \u2192 `type: "hotfix"` on every entry you build. Its absence means `"regular"`.\n- `--desc <text>` \u2192 `description` on the entry. The text runs to the end of the argument string.\n- The bare token \u2192 `version` when it is a semver or the literal `next`, `name` when it is kebab-case.\n\nSo `--hotfix --desc "Card expiry fix" 1.63.3` is one entry:\n`{version: "1.63.3", type: "hotfix", description: "Card expiry fix"}`.\n\nIf `$ARGUMENTS` is empty, ask the human what to cut rather than guessing a version \u2014 and read the\n`"next"` caveats above before offering it.\n\n**Precedence, when a form is also involved.** If the server answers with an argument form and the\nhuman edits it, **the form wins field by field wherever the human supplied a value, and the values\nyou parsed from `$ARGUMENTS` win everywhere else.** A human who typed `--hotfix` and then picked\n`regular` in the form gets `regular` \u2014 they saw the field and changed it. A human who typed\n`--hotfix` and left `type` untouched gets `hotfix`. Never rebuild the entry from the form alone: that\nconverts every untouched field into a silent overwrite by a value the human never saw.\n\n### Batches\n\nOne call may create several releases, but **all entries must share the same `type`**. Regular and\nhotfix branch off different bases, so a mixed batch is rejected \u2014 cut them in separate\ninvocations.\n\nA batch does not stop at the first failure. Each entry is attempted and the result reports\n`successCount`, `failureCount`, `createdBranches` and `failedReleases`. Read all four before\ntelling the human the release was created: partial success is a normal outcome here.\n\n## 4. What one release does\n\nPer entry, in order: fetch and switch to the base branch, cut `release/v<semver>` (or\n`release/<name>`), open a GitHub release PR, and create or reuse the Jira fix version (`v<semver>`\nor `<name>`).\n\nTwo consequences worth stating before call 2:\n\n- An existing fix version is **reused**, and a `description` that differs is written through to it,\n  so the PR and the fix version cannot disagree.\n- A fix version that is already released or archived is **refused**, not reused. The human either\n  picks a different version or un-releases it in Jira.\n\n## 5. What not to do\n\n- Do not work around a refusal with `git` or `gh`. Every refusal in section 1 is a state only the\n  human can clear.\n- Do not invent a list of candidate versions for the human. Pass `"next"` and let the server\n  resolve it from the real branches and fix versions, or ask for the exact semver.\n- Do not read `isError: true` on a `confirmation_required` payload as a failure. See section 2.\n';var j=`# session \u2014 switching a terminal's context through infra-kit
+import{a as E,d as w,fa as N,ia as M,s as O}from"./chunk-XN7VHD7P.js";import{i as P}from"./chunk-QUXDC3A3.js";import"./chunk-744Y674Y.js";import{J as g,K as A,L as i,T as I,c as _}from"./chunk-LCNORKDV.js";import"./chunk-MFAFQVTW.js";import{a as D}from"./chunk-Y5TLBGZT.js";import"./chunk-XJOY7J3G.js";import"./chunk-PQG63EIV.js";import"./chunk-QWVLAZ6N.js";import{serveStdio as Ge}from"@modelcontextprotocol/server/stdio";import f from"node:process";import{setTimeout as He}from"node:timers/promises";import u from"node:process";var F=e=>{u.on("uncaughtException",t=>{e.fatal({err:t,msg:"Uncaught Exception"}),e.error(`Uncaught Exception! Check ${g}. Shutting down...`),e.flush(),u.exit(1)}),u.on("unhandledRejection",(t,o)=>{e.fatal({reason:t,promise:o,msg:"Unhandled Rejection"}),e.error(`Unhandled Rejection! Check ${g}. Shutting down...`),e.flush(),u.exit(1)})};import{McpServer as $e}from"@modelcontextprotocol/server";var q='# release-create \u2014 cutting a release through infra-kit\n\nThe tool is `mcp__infra-kit__release-create`. Everything below is about calling that tool.\n\nDo not shell out. A `Bash` call running `git switch`, `git push` or `gh pr create` reproduces none\nof the preconditions below and bypasses the confirm gate in section 2 \u2014 which is the only place a\nhuman approves the release.\n\n## 1. Preconditions\n\nCheck these before the first call; each one is a refusal the human has to clear, not something to\nwork around.\n\n- **The main repository checkout, not a linked worktree.** The tool refuses outright from inside a\n  linked worktree.\n- **A clean working tree.** Uncommitted changes are refused; the human commits or stashes.\n- **No other worktree holding the base branch.** Regular releases branch off `dev`, hotfixes off\n  `main`. If a linked worktree has that branch checked out, the tool refuses and names the path.\n- **Jira configured.** Every release gets a matching fix version, so `JIRA_BASE_URL`,\n  `JIRA_EMAIL`, `JIRA_PROJECT_ID` and `JIRA_TOKEN` (or `JIRA_API_TOKEN`) must be in the\n  environment \u2014 load them with `ik env-load` and source the file it returns. The check runs before\n  anything is cut.\n\n**You do not have to already be on the base branch.** The tool runs `git fetch origin`,\n`git switch <base>` and `git pull --ff-only` itself. That is a real side effect on the human\'s\ncheckout: say so before call 2.\n\n## 2. The two-call confirm protocol\n\n`release-create` is gated. **The first call never executes anything.**\n\n**Call 1** \u2014 send the real arguments, with no `confirm` and no `confirmToken`. The result is a gate\npayload, `{"status": "confirmation_required", ...}`, and it carries `"isError": true`.\n\n**That `isError` does not mean the call failed.** It is set because the payload is a gate rather\nthan the tool\'s declared output. Nothing was created, nothing was pushed, nothing was switched. An\nagent that reads it as a failure \u2014 and gives up, or retries, or falls back to `Bash` \u2014 has skipped\nthe human approval this protocol exists for. Do none of those.\n\nThe gate payload carries two things you need:\n\n- `resolvedArgs` \u2014 exactly the arguments the server bound. **Show these to the human.** This is the\n  approval moment; there is no other one.\n- `confirmToken` \u2014 an HMAC bound to the tool name and to those exact arguments. It expires 600\n  seconds after it is minted.\n\n**Call 2** \u2014 repeat the **same arguments**, unchanged, plus `"confirm": true` and the\n`confirmToken` from call 1.\n\nChange any argument between the two calls and round 2 comes back as\n`{"status": "confirmation_refused", "reason": "mismatch"}`. That is terminal \u2014 it is not a second\ngate. The other reasons are `absent`, `malformed`, `mac`, `expired` and `bind`, and every one of\nthem recovers the same way: call again **without** `confirm` to mint a fresh gate, then re-call\nwith those arguments and the new token. Never retry call 2 with the old token.\n\nIf the human wants different arguments, go back to call 1 with the new arguments. Do not edit the\narguments and reuse the token \u2014 that is exactly what `mismatch` refuses.\n\n## 3. What goes in `releases`\n\n`releases` is an array with at least one entry. Every entry carries **exactly one** of:\n\n- `version` \u2014 a semver string such as `"1.64.0"`, or the literal token `"next"`.\n- `name` \u2014 a free-form kebab-case identifier such as `"checkout-redesign"`.\n\nThey are mutually exclusive and one is required. An entry with both, or with neither, is rejected\nby the schema before the tool runs.\n\nEach entry also carries `type` (`"regular"` or `"hotfix"`, default `"regular"`) and an optional\n`description`, which becomes the Jira fix version\'s description and feeds the PR body.\n\n### The `"next"` token\n\n`"next"` is version-only \u2014 a named release never auto-bumps. It resolves against the union of the\nremote `release/v*` branches on `origin` and the project\'s Jira fix versions:\n\n- `"regular"` bumps the minor and resets the patch: `1.63.2` becomes `1.64.0`.\n- `"hotfix"` bumps the patch on the highest minor: `1.63.2` becomes `1.63.3`.\n\nSeveral `"next"` entries in one call advance sequentially rather than all resolving to the same\nversion.\n\n**Be honest about what `"next"` could see.** The two sources are queried in parallel and a source\nthat fails is logged and dropped, not raised \u2014 if the Jira call fails, `"next"` is computed from\nthe remote branches alone and can land on a version Jira already knows about. If neither source\nyields a prior version the tool refuses and asks for an explicit one. When the exact number\nmatters, pass the semver instead of the token.\n\n### Reading `$ARGUMENTS`\n\nThe `/infra-kit:release-create` command hands you `$ARGUMENTS` verbatim, and its argument hint is\n`[--hotfix] [--desc <text>] [<version|name>]`. **Those two flags are conventions of this command, not\nCLI flags** \u2014 `infra-kit release create` accepts neither, and the tool takes neither. They exist so a\nhuman can type the whole request on one line, and it is your job to translate them:\n\n- `--hotfix` \u2192 `type: "hotfix"` on every entry you build. Its absence means `"regular"`.\n- `--desc <text>` \u2192 `description` on the entry. The text runs to the end of the argument string.\n- The bare token \u2192 `version` when it is a semver or the literal `next`, `name` when it is kebab-case.\n\nSo `--hotfix --desc "Card expiry fix" 1.63.3` is one entry:\n`{version: "1.63.3", type: "hotfix", description: "Card expiry fix"}`.\n\nIf `$ARGUMENTS` is empty, ask the human what to cut rather than guessing a version \u2014 and read the\n`"next"` caveats above before offering it.\n\n**Precedence, when a form is also involved.** If the server answers with an argument form and the\nhuman edits it, **the form wins field by field wherever the human supplied a value, and the values\nyou parsed from `$ARGUMENTS` win everywhere else.** A human who typed `--hotfix` and then picked\n`regular` in the form gets `regular` \u2014 they saw the field and changed it. A human who typed\n`--hotfix` and left `type` untouched gets `hotfix`. Never rebuild the entry from the form alone: that\nconverts every untouched field into a silent overwrite by a value the human never saw.\n\n### Batches\n\nOne call may create several releases, but **all entries must share the same `type`**. Regular and\nhotfix branch off different bases, so a mixed batch is rejected \u2014 cut them in separate\ninvocations.\n\nA batch does not stop at the first failure. Each entry is attempted and the result reports\n`successCount`, `failureCount`, `createdBranches` and `failedReleases`. Read all four before\ntelling the human the release was created: partial success is a normal outcome here.\n\n## 4. What one release does\n\nPer entry, in order: fetch and switch to the base branch, cut `release/v<semver>` (or\n`release/<name>`), open a GitHub release PR, and create or reuse the Jira fix version (`v<semver>`\nor `<name>`).\n\nTwo consequences worth stating before call 2:\n\n- An existing fix version is **reused**, and a `description` that differs is written through to it,\n  so the PR and the fix version cannot disagree.\n- A fix version that is already released or archived is **refused**, not reused. The human either\n  picks a different version or un-releases it in Jira.\n\n## 5. What not to do\n\n- Do not work around a refusal with `git` or `gh`. Every refusal in section 1 is a state only the\n  human can clear.\n- Do not invent a list of candidate versions for the human. Pass `"next"` and let the server\n  resolve it from the real branches and fix versions, or ask for the exact semver.\n- Do not read `isError: true` on a `confirmation_required` payload as a failure. See section 2.\n';var j=`# session \u2014 switching a terminal's context through infra-kit
 
 Three tools do the work, and this body is only the procedure that composes them:
 \`mcp__infra-kit__env-list\`, \`mcp__infra-kit__env-load\` and \`mcp__infra-kit__env-clear\`. None of them

package/dist/update-check.js

@@ -1,2 +1,2 @@
-import{d as i}from"./chunk-IERRU26T.js";import{a as t}from"./chunk-GF2CA4CD.js";import"./chunk-XJOY7J3G.js";import"./chunk-PQG63EIV.js";import a from"node:fs";import o from"node:process";import{fileURLToPath as s}from"node:url";var m=r=>{let n=r.indexOf("--parent-pid");if(n===-1)return;let e=Number(r[n+1]);return Number.isInteger(e)&&e>0?e:void 0},p=()=>a.realpathSync(s(new URL("./cli.js",import.meta.url))),d=async()=>{await i(t.version,{selfRealPath:p(),parentPid:m(o.argv)})};d().catch(()=>{o.exitCode=0});
+import{d as i}from"./chunk-YYEUJYC7.js";import{a as t}from"./chunk-Y5TLBGZT.js";import"./chunk-XJOY7J3G.js";import"./chunk-PQG63EIV.js";import a from"node:fs";import o from"node:process";import{fileURLToPath as s}from"node:url";var m=r=>{let n=r.indexOf("--parent-pid");if(n===-1)return;let e=Number(r[n+1]);return Number.isInteger(e)&&e>0?e:void 0},p=()=>a.realpathSync(s(new URL("./cli.js",import.meta.url))),d=async()=>{await i(t.version,{selfRealPath:p(),parentPid:m(o.argv)})};d().catch(()=>{o.exitCode=0});
 //# sourceMappingURL=update-check.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "infra-kit",
   "type": "module",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "files": [
     "dist"
   ],
@@ -22,7 +22,7 @@
     "@inquirer/password": "^5.2.2",
     "@inquirer/select": "^5.2.5",
     "@modelcontextprotocol/server": "^2.0.0",
-    "@slip-stream-kit/config": "^0.5.0",
+    "@slip-stream-kit/config": "^0.5.6",
     "chalk": "^6.0.0",
     "chokidar": "^5.0.0",
     "commander": "^15.0.0",
@@ -39,14 +39,14 @@
   "devDependencies": {
     "@modelcontextprotocol/client": "^2.0.0",
     "@modelcontextprotocol/sdk": "^1.30.0",
+    "@slip-stream-kit/eslint-plugin": "0.5.6",
     "@types/aws-lambda": "^8.10.163",
     "@types/react": "19.3.0",
+    "@wl/eslint-config": "0.1.0",
+    "@wl/vitest-config": "0.1.0",
     "esbuild": "^0.28.2",
     "ink-testing-library": "^4.0.0",
-    "typescript": "^6.0.3",
-    "@slip-stream-kit/eslint-plugin": "0.5.5",
-    "@wl/eslint-config": "0.1.0",
-    "@wl/vitest-config": "0.1.0"
+    "typescript": "^6.0.3"
   },
   "scripts": {
     "inspector": "npx @modelcontextprotocol/inspector node ./dist/mcp.js --debug",

package/dist/chunk-GF2CA4CD.js

@@ -1,2 +0,0 @@
-var D={name:"infra-kit",type:"module",version:"0.5.5",files:["dist"],description:"infra-kit",bin:{"infra-kit":"dist/cli.js",ik:"dist/cli.js","ik-mcp":"dist/mcp-proxy.js"},engines:{node:">=24.x"},scripts:{inspector:"npx @modelcontextprotocol/inspector node ./dist/mcp.js --debug",build:"pnpm run clean-artifacts && node ./scripts/build.js",prepack:"pnpm run build",prepublishOnly:"pnpm run build","infra-kit-check":"pnpm exec infra-kit audit","clean-artifacts":"rm -rf dist","clean-cache":"rm -rf node_modules/.cache .eslintcache tsconfig.tsbuildinfo .turbo .swc","prettier-fix":"pnpm exec prettier **/* --write --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore","prettier-check":"pnpm exec prettier **/* --check --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore","eslint-check":"pnpm exec eslint --cache --report-unused-disable-directives ./src","eslint-fix":"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src --fix","ts-check":"tsc --noEmit",test:"pnpm exec vitest run --reporter=minimal","test-watch":"pnpm exec vitest --watch --silent passed-only","test-ui":"pnpm exec vitest --ui --silent passed-only","test-report":"pnpm exec vitest run --coverage --silent passed-only","qa:pty":"INFRA_KIT_REQUIRE_PTY=1 pnpm exec vitest run --reporter=minimal src/tui/__tests__/stdin-pause-pty.test.ts src/entry/__tests__/quit-keys-pty.test.ts src/entry/__tests__/post-run-pause-pty.test.ts",qa:"pnpm run prettier-check && pnpm run eslint-check && pnpm run ts-check && pnpm run test && echo \u2705 Success",fix:"pnpm run prettier-fix && pnpm run eslint-fix && pnpm run qa"},dependencies:{"@aws-lambda-powertools/logger":"^2.35.0","@inquirer/checkbox":"^5.2.5","@inquirer/confirm":"^6.3.2","@inquirer/input":"^5.1.6","@inquirer/password":"^5.2.2","@inquirer/select":"^5.2.5","@modelcontextprotocol/server":"^2.0.0","@slip-stream-kit/config":"^0.5.0",chalk:"^6.0.0",chokidar:"^5.0.0",commander:"^15.0.0",fastify:"^5.12.4",ink:"^7.1.1",pino:"^10.3.1","pino-pretty":"^13.1.3",portless:"^0.15.6",react:"19.3.0",yaml:"^2.9.1",zod:"^4.6.2",zx:"^8.8.5"},devDependencies:{"@modelcontextprotocol/client":"^2.0.0","@modelcontextprotocol/sdk":"^1.30.0","@slip-stream-kit/eslint-plugin":"workspace:*","@types/aws-lambda":"catalog:","@types/react":"catalog:","@wl/eslint-config":"workspace:*","@wl/vitest-config":"workspace:*",esbuild:"^0.28.2","ink-testing-library":"^4.0.0",typescript:"^6.0.3"}};import a from"node:path";var i="infra-kit",o=`${i}@latest`,m=(e,t,n)=>{let r=a.relative(n(a.resolve(e)),a.resolve(t));return r!==""&&!r.startsWith("..")&&!a.isAbsolute(r)},s=(e,t)=>a.resolve(e).split(a.sep).includes(t),b=(e,t)=>{let n=a.resolve(e).split(a.sep),r=n.indexOf("Cellar");return r!==-1&&n[r+1]===t},y=(e,t)=>{let n=a.resolve(e).split(a.sep),r=n.lastIndexOf("node_modules");return r<2||n[r-1]!=="lib"||n[r+1]!==t?null:n.slice(0,r-1).join(a.sep)||a.sep},w=e=>y(e,i),I=e=>["npm","install","-g","--prefix",e,o],v=e=>e.map(t=>t.includes(" ")?`'${t}'`:t).join(" "),c=(e,t,n,r)=>{let p=e[t];return p!=null&&p!==""&&m(p,n,r)},_=[{manager:"volta",test:({selfRealPath:e,env:t,realpath:n})=>c(t,"VOLTA_HOME",e,n)||s(e,".volta")||s(e,"volta"),updateCommand:["volta","install",i],canSelfSpawn:!0},{manager:"homebrew",test:({selfRealPath:e})=>b(e,i),updateCommand:["brew","upgrade",i],canSelfSpawn:!1}],k=[{manager:"pnpm",test:({selfRealPath:e,env:t,realpath:n})=>c(t,"PNPM_HOME",e,n)||s(e,"pnpm")&&s(e,"global"),updateCommand:["pnpm","add","-g",o],canSelfSpawn:!0},{manager:"bun",test:({selfRealPath:e,env:t,realpath:n})=>c(t,"BUN_INSTALL",e,n)||s(e,".bun"),updateCommand:["bun","add","-g",o],canSelfSpawn:!0},{manager:"yarn",test:({selfRealPath:e})=>s(e,".yarn")||s(e,"yarn")&&s(e,"global"),updateCommand:["yarn","global","add",o],canSelfSpawn:!0},{manager:"npm",test:({selfRealPath:e,env:t,realpath:n})=>c(t,"npm_config_prefix",e,n),updateCommand:["npm","install","-g",o],canSelfSpawn:!0}],S=["npm","install","-g",o],C=e=>{let{selfRealPath:t,env:n,realpath:r,lazyNpmRoot:p}=e,d=l=>({manager:l.manager,updateCommand:l.updateCommand,canSelfSpawn:l.canSelfSpawn}),g=({test:l})=>l({selfRealPath:t,env:n,realpath:r}),f=_.find(g);if(f)return d(f);let x=w(t);if(x!==null)return{manager:"npm",updateCommand:I(x),canSelfSpawn:!0};let h=k.find(g);if(h)return d(h);let u=p?.();return u!=null&&u!==""&&m(u,t,r)?{manager:"npm",updateCommand:S,canSelfSpawn:!0}:{manager:"unknown",updateCommand:S,canSelfSpawn:!1}},E=(e,t,n)=>s(e,"node_modules")&&m(t,e,n);import{realpathSync as R}from"node:fs";import N from"node:path";var A=e=>{try{return R(e)}catch{return N.resolve(e)}};import{execFileSync as P}from"node:child_process";import O from"node:process";var T=3e3,q=()=>{try{let t=P("npm",["root","-g"],{encoding:"utf-8",timeout:T,stdio:["ignore","pipe","ignore"],shell:O.platform==="win32"}).trim();return t===""?void 0:t}catch{return}};export{D as a,i as b,m as c,s as d,b as e,y as f,v as g,C as h,E as i,q as j,A as k};
-//# sourceMappingURL=chunk-GF2CA4CD.js.map

package/dist/chunk-GF2CA4CD.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../package.json", "../src/lib/install-manager/install-manager.ts", "../src/lib/install-manager/safe-realpath.ts", "../src/lib/install-manager/npm-root.ts"],
-  "sourcesContent": ["{\n  \"name\": \"infra-kit\",\n  \"type\": \"module\",\n  \"version\": \"0.5.5\",\n  \"files\": [\n    \"dist\"\n  ],\n  \"description\": \"infra-kit\",\n  \"bin\": {\n    \"infra-kit\": \"dist/cli.js\",\n    \"ik\": \"dist/cli.js\",\n    \"ik-mcp\": \"dist/mcp-proxy.js\"\n  },\n  \"engines\": {\n    \"node\": \">=24.x\"\n  },\n  \"scripts\": {\n    \"inspector\": \"npx @modelcontextprotocol/inspector node ./dist/mcp.js --debug\",\n    \"build\": \"pnpm run clean-artifacts && node ./scripts/build.js\",\n    \"prepack\": \"pnpm run build\",\n    \"prepublishOnly\": \"pnpm run build\",\n    \"infra-kit-check\": \"pnpm exec infra-kit audit\",\n    \"clean-artifacts\": \"rm -rf dist\",\n    \"clean-cache\": \"rm -rf node_modules/.cache .eslintcache tsconfig.tsbuildinfo .turbo .swc\",\n    \"prettier-fix\": \"pnpm exec prettier **/* --write --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore\",\n    \"prettier-check\": \"pnpm exec prettier **/* --check --no-error-on-unmatched-pattern --log-level silent --ignore-path ../../../.prettierignore\",\n    \"eslint-check\": \"pnpm exec eslint --cache --report-unused-disable-directives ./src\",\n    \"eslint-fix\": \"pnpm exec eslint --cache --quiet --report-unused-disable-directives ./src --fix\",\n    \"ts-check\": \"tsc --noEmit\",\n    \"test\": \"pnpm exec vitest run --reporter=minimal\",\n    \"test-watch\": \"pnpm exec vitest --watch --silent passed-only\",\n    \"test-ui\": \"pnpm exec vitest --ui --silent passed-only\",\n    \"test-report\": \"pnpm exec vitest run --coverage --silent passed-only\",\n    \"qa:pty\": \"INFRA_KIT_REQUIRE_PTY=1 pnpm exec vitest run --reporter=minimal src/tui/__tests__/stdin-pause-pty.test.ts src/entry/__tests__/quit-keys-pty.test.ts src/entry/__tests__/post-run-pause-pty.test.ts\",\n    \"qa\": \"pnpm run prettier-check && pnpm run eslint-check && pnpm run ts-check && pnpm run test && echo \u2705 Success\",\n    \"fix\": \"pnpm run prettier-fix && pnpm run eslint-fix && pnpm run qa\"\n  },\n  \"dependencies\": {\n    \"@aws-lambda-powertools/logger\": \"^2.35.0\",\n    \"@inquirer/checkbox\": \"^5.2.5\",\n    \"@inquirer/confirm\": \"^6.3.2\",\n    \"@inquirer/input\": \"^5.1.6\",\n    \"@inquirer/password\": \"^5.2.2\",\n    \"@inquirer/select\": \"^5.2.5\",\n    \"@modelcontextprotocol/server\": \"^2.0.0\",\n    \"@slip-stream-kit/config\": \"^0.5.0\",\n    \"chalk\": \"^6.0.0\",\n    \"chokidar\": \"^5.0.0\",\n    \"commander\": \"^15.0.0\",\n    \"fastify\": \"^5.12.4\",\n    \"ink\": \"^7.1.1\",\n    \"pino\": \"^10.3.1\",\n    \"pino-pretty\": \"^13.1.3\",\n    \"portless\": \"^0.15.6\",\n    \"react\": \"19.3.0\",\n    \"yaml\": \"^2.9.1\",\n    \"zod\": \"^4.6.2\",\n    \"zx\": \"^8.8.5\"\n  },\n  \"devDependencies\": {\n    \"@modelcontextprotocol/client\": \"^2.0.0\",\n    \"@modelcontextprotocol/sdk\": \"^1.30.0\",\n    \"@slip-stream-kit/eslint-plugin\": \"workspace:*\",\n    \"@types/aws-lambda\": \"catalog:\",\n    \"@types/react\": \"catalog:\",\n    \"@wl/eslint-config\": \"workspace:*\",\n    \"@wl/vitest-config\": \"workspace:*\",\n    \"esbuild\": \"^0.28.2\",\n    \"ink-testing-library\": \"^4.0.0\",\n    \"typescript\": \"^6.0.3\"\n  }\n}\n", "/**\n * Pure detection of *how* this CLI was installed, so the background updater knows whether it may act at\n * all, and the advisory it prints can name the one command that will actually work. No fs, no spawn, no `process.env` read \u2014 every input is injected, which is\n * what lets the whole matrix be table-tested.\n *\n * Detection is env-first and LAZY: the only signal that costs a subprocess (`npm root -g`) is passed in\n * as `lazyNpmRoot` and consulted solely when every cheaper matcher has missed.\n */\nimport path from 'node:path'\n\n/** The published package this CLI updates itself to. Single source for every suggested argv. */\nexport const PACKAGE_NAME = 'infra-kit'\n\nconst LATEST = `${PACKAGE_NAME}@latest`\n\nexport type InstallManager = 'npm' | 'pnpm' | 'yarn' | 'bun' | 'volta' | 'homebrew' | 'unknown'\n\nexport interface InstallManagerInfo {\n  manager: InstallManager\n  /** The command to run. Only safe to spawn ourselves when `canSelfSpawn`; otherwise print it. */\n  updateCommand: string[]\n  /** False when we must not run the command for the user \u2014 either it needs sudo/a tap, or we guessed. */\n  canSelfSpawn: boolean\n}\n\n/**\n * Canonicalises a candidate *root* directory. Required, not optional: `selfRealPath` has already had its\n * symlinks followed, so comparing it against a raw `PNPM_HOME`/`npm root -g`/`cwd` compares a resolved\n * path to an unresolved one and silently never matches. macOS is the everyday proof \u2014 `/var` is a symlink\n * to `/private/var`, so a global install under `/var/...` reports `unknown` unless both sides are resolved.\n * Callers inject the real thing; tests inject a stub.\n */\nexport type RealpathFn = (dir: string) => string\n\nexport interface DetectInstallManagerInput {\n  /** Fully-resolved (symlinks followed) path to this CLI's entry file. */\n  selfRealPath: string\n  env: NodeJS.ProcessEnv\n  /** Canonicalises each candidate root before comparison. See {@link RealpathFn}. */\n  realpath: RealpathFn\n  /** `npm root -g`, deferred: invoked at most once, and only when no cheaper matcher hit. */\n  lazyNpmRoot?: () => string | undefined\n}\n\n/**\n * Is `child` inside the `parent` subtree? Boundary-aware: a naive `startsWith` would call\n * `/Users/x/pnpm-ish` a child of `/Users/x/pnpm`. `parent` is canonicalised first because it arrives raw\n * from the environment while `child` is already a realpath.\n */\nexport const isWithin = (parent: string, child: string, realpath: RealpathFn): boolean => {\n  const rel = path.relative(realpath(path.resolve(parent)), path.resolve(child))\n\n  return rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel)\n}\n\n/** Does `p` contain `name` as a whole path SEGMENT? `/a/node_modules_backup/b` must not match `node_modules`. */\nexport const hasSegment = (p: string, name: string): boolean => {\n  return path.resolve(p).split(path.sep).includes(name)\n}\n\n/**\n * Is `p` inside a Homebrew keg belonging to the `name` FORMULA \u2014 i.e. `.../Cellar/<name>/<version>/...`?\n *\n * The formula name is what makes this sound. A bare `Cellar` segment says only \"somewhere under a keg\",\n * and the keg it lands in is routinely someone else's: when npm's global prefix is a node keg\n * (`npm config set prefix \"$(brew --prefix node)\"`, or any keg-only `node@X`), an `npm i -g` package\n * installs to `Cellar/node/<v>/lib/node_modules/<pkg>/...` \u2014 brew has never heard of it, yet the segment\n * is right there. Requiring `<name>` to sit directly after `Cellar` is what separates \"brew installed\n * THIS\" from \"brew installed the runtime that installed this\".\n *\n * Works for both keg layouts, since each is rooted at the formula: a plain formula\n * (`Cellar/infra-kit/1.2.3/bin/infra-kit`) and brew's node-CLI layout\n * (`Cellar/infra-kit/1.2.3/libexec/lib/node_modules/infra-kit/dist/cli.js`). Do NOT try to tell them\n * apart by excluding `node_modules` \u2014 the second one contains it.\n */\nexport const isBrewKegOf = (p: string, name: string): boolean => {\n  const segments = path.resolve(p).split(path.sep)\n  const cellar = segments.indexOf('Cellar')\n\n  return cellar !== -1 && segments[cellar + 1] === name\n}\n\n/**\n * The npm global prefix that owns `binRealPath`, derived from the path ITSELF, or null when the\n * layout is not an npm global one.\n *\n * Matches `<prefix>/lib/node_modules/<packageName>` \u2014 npm's global layout and no other manager's\n * \u2014 requiring BOTH the `lib` parent and our package as the immediate child. Windows global npm has\n * no `lib` segment (`%APPDATA%\\npm\\node_modules`), so this returns null there and detection falls\n * through to `npm root -g`, which is correct on Windows, where there is normally one npm.\n */\n// This is the one signal that cannot point at the wrong tree. Everything else in this module\n// answers \"is this file somewhere inside tool X's directory?\", and containment is not ownership:\n//   - `npm root -g` answers for whichever `npm` is first on PATH, which is routinely a DIFFERENT\n//     node than the one that installed us (a pnpm/nvm/fnm-managed node, or a node that has since\n//     been removed). It then reports a root that does not contain us, every matcher misses, and\n//     detection degrades to `unknown` \u2014 a notice printed forever, on the single most common install\n//     method. That is the bug this exists to close.\n//   - `PNPM_HOME` containment is satisfied by `<PNPM_HOME>/nodejs/<v>/lib/node_modules/<pkg>` (a\n//     plain `npm i -g` under a pnpm-managed node), yet `pnpm add -g` installs to\n//     `<PNPM_HOME>/global/<v>/...` \u2014 a different directory. That one is worse than a missed update:\n//     the install \"succeeds\" while the binary on PATH stays old, silently, with no notice to show\n//     for it.\n//\n// Requiring both segments is what makes the match proof rather than a hint. The `lib` requirement\n// is also what keeps a project-local `<repo>/node_modules/<pkg>` out (it has no `lib`), and nesting\n// cannot spoof it: `.../node_modules/foo/node_modules/<pkg>` fails the `lib` test.\nexport const npmPrefixOfPackage = (binRealPath: string, packageName: string): string | null => {\n  const segments = path.resolve(binRealPath).split(path.sep)\n  const nodeModules = segments.lastIndexOf('node_modules')\n\n  if (nodeModules < 2) return null\n  if (segments[nodeModules - 1] !== 'lib') return null\n  if (segments[nodeModules + 1] !== packageName) return null\n\n  // Drop `lib/node_modules/...`; the empty result of a root-level prefix (`/lib/node_modules/...`) is `/`.\n  return segments.slice(0, nodeModules - 1).join(path.sep) || path.sep\n}\n\n// The self-scoped reading, kept as the name every call site below already uses. `dependency-registry`\n// asks the same question about OTHER packages (`portless`), which is why the body moved up one level\n// rather than gaining a defaulted parameter \u2014 a default is how the wrong package silently gets probed.\nconst npmPrefixFromSelfPath = (selfRealPath: string): string | null => {\n  return npmPrefixOfPackage(selfRealPath, PACKAGE_NAME)\n}\n\n/**\n * `--prefix` is passed EXPLICITLY rather than trusting the ambient one: the whole point of deriving it is\n * that the `npm` we are about to run may default to a different prefix than the one we are installed in.\n * A command-line flag outranks both `npm_config_prefix` and any `.npmrc`, so this targets the tree we\n * actually run from. With `-g`, npm writes `<prefix>/lib/node_modules` and links bins into `<prefix>/bin`.\n */\nconst npmPrefixInstallCommand = (prefix: string): string[] => {\n  return ['npm', 'install', '-g', '--prefix', prefix, LATEST]\n}\n\n/**\n * Render argv as a line the user can paste into a shell.\n *\n * A plain `join(' ')` was fine while every token came from a static table; `--prefix <path>` puts a\n * filesystem path in argv, and `/Users/Ada Lovelace/.nvm/...` pasted unquoted is two arguments and a\n * failed install. Single quotes are sound here without escaping because the callers' validation rejects a\n * token containing a quote \u2014 see `SAFE_COMMAND_TOKEN` in src/lib/update-check/auto-update.ts.\n *\n * @example\n * formatUpdateCommand(['npm', 'install', '-g', '--prefix', '/opt/x y', 'infra-kit@latest'])\n * // => \"npm install -g --prefix '/opt/x y' infra-kit@latest\"\n */\nexport const formatUpdateCommand = (command: string[]): string => {\n  return command\n    .map((token) => {\n      return token.includes(' ') ? `'${token}'` : token\n    })\n    .join(' ')\n}\n\n/** `env[key]` names a directory that contains `selfRealPath`. Absent/empty env var \u2192 no match. */\nconst underEnvDir = (env: NodeJS.ProcessEnv, key: string, selfRealPath: string, realpath: RealpathFn): boolean => {\n  const dir = env[key]\n\n  return dir != null && dir !== '' && isWithin(dir, selfRealPath, realpath)\n}\n\ninterface Matcher extends Omit<InstallManagerInfo, 'manager'> {\n  manager: InstallManager\n  test: (input: Required<Pick<DetectInstallManagerInput, 'selfRealPath' | 'env' | 'realpath'>>) => boolean\n}\n\n/**\n * Consulted FIRST, before {@link npmPrefixFromSelfPath}. Both of these legitimately wrap an npm-shaped\n * `lib/node_modules` tree \u2014 volta at `~/.volta/tools/image/node/<v>/lib/node_modules`, brew at\n * `Cellar/<pkg>/<v>/libexec/lib/node_modules` \u2014 so deriving an npm prefix from the path would hijack\n * installs that a wrapper owns and must keep owning.\n */\nconst WRAPPER_MATCHERS: Matcher[] = [\n  {\n    manager: 'volta',\n    // volta owns the shim; `volta install` is the correct tool, not a workaround \u2014 so we may run it.\n    test: ({ selfRealPath, env, realpath }) => {\n      return (\n        underEnvDir(env, 'VOLTA_HOME', selfRealPath, realpath) ||\n        hasSegment(selfRealPath, '.volta') ||\n        hasSegment(selfRealPath, 'volta')\n      )\n    },\n    updateCommand: ['volta', 'install', PACKAGE_NAME],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'homebrew',\n    // `brew upgrade` can touch the prefix, relink, and prompt \u2014 never ours to run unattended.\n    //\n    // Our own keg is the ONLY sound signal \u2014 see `isBrewKegOf`. Two broader tests look plausible\n    // and are both wrong, because each answers \"did brew put something here?\" when the question is \"does\n    // brew own THIS package?\":\n    //   - `HOMEBREW_PREFIX` containment: when node comes from brew, npm's global prefix IS\n    //     $HOMEBREW_PREFIX, so EVERY `npm i -g` package lands under it, unknown to brew.\n    //   - a bare `Cellar` segment: an npm prefix pointed at a node keg puts packages inside that keg.\n    // Either misfire tells macOS users to run `brew upgrade infra-kit` \u2014 a formula that does not exist \u2014\n    // and, far worse, makes the background auto-updater bail with `cannot-self-spawn` forever, so the\n    // very fix for it can never reach them. Detection runs on the realpath, and a linked brew bin always\n    // resolves into its own keg, so the narrow test has no false negatives to trade for this.\n    test: ({ selfRealPath }) => {\n      return isBrewKegOf(selfRealPath, PACKAGE_NAME)\n    },\n    updateCommand: ['brew', 'upgrade', PACKAGE_NAME],\n    canSelfSpawn: false,\n  },\n]\n\n/**\n * Consulted LAST, after {@link npmPrefixFromSelfPath} has had its say. Each of these proves only that we\n * live somewhere inside a tool's directory tree, which is weaker than knowing the layout npm itself\n * created \u2014 see the `PNPM_HOME`/`nodejs` case in that helper's doc for a containment hit whose install\n * command targets the wrong directory.\n */\nconst TREE_MATCHERS: Matcher[] = [\n  {\n    manager: 'pnpm',\n    test: ({ selfRealPath, env, realpath }) => {\n      return (\n        underEnvDir(env, 'PNPM_HOME', selfRealPath, realpath) ||\n        (hasSegment(selfRealPath, 'pnpm') && hasSegment(selfRealPath, 'global'))\n      )\n    },\n    updateCommand: ['pnpm', 'add', '-g', LATEST],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'bun',\n    test: ({ selfRealPath, env, realpath }) => {\n      return underEnvDir(env, 'BUN_INSTALL', selfRealPath, realpath) || hasSegment(selfRealPath, '.bun')\n    },\n    updateCommand: ['bun', 'add', '-g', LATEST],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'yarn',\n    test: ({ selfRealPath }) => {\n      return (\n        hasSegment(selfRealPath, '.yarn') || (hasSegment(selfRealPath, 'yarn') && hasSegment(selfRealPath, 'global'))\n      )\n    },\n    updateCommand: ['yarn', 'global', 'add', LATEST],\n    canSelfSpawn: true,\n  },\n  {\n    manager: 'npm',\n    test: ({ selfRealPath, env, realpath }) => {\n      return underEnvDir(env, 'npm_config_prefix', selfRealPath, realpath)\n    },\n    updateCommand: ['npm', 'install', '-g', LATEST],\n    canSelfSpawn: true,\n  },\n]\n\nconst NPM_UPDATE_COMMAND = ['npm', 'install', '-g', LATEST]\n\n/**\n * Identify the package manager that owns `selfRealPath`.\n *\n * Order, and why it is this one: wrappers that own an npm-shaped tree (volta, brew) first, then the npm\n * prefix DERIVED from our own path, then the env/path containment matchers, then the `npm root -g` probe.\n * The derived prefix sits above containment because it is the only signal that cannot name a directory we\n * do not live in \u2014 see {@link npmPrefixFromSelfPath}.\n *\n * `lazyNpmRoot` is the last resort and is invoked at most once, only after every matcher has missed \u2014 a\n * pnpm or volta install never pays for the subprocess, and neither does any npm global install in the\n * standard layout, which the derived prefix now settles for free. When nothing matches we report `unknown`\n * with an npm command that is a *suggestion only* (`canSelfSpawn: false`): running a guessed global\n * install is worse than printing one.\n *\n * @example\n * detectInstallManager({ selfRealPath: '/Users/x/Library/pnpm/global/5/node_modules/infra-kit/dist/cli.js', env: {} })\n * // => { manager: 'pnpm', updateCommand: ['pnpm', 'add', '-g', 'infra-kit@latest'], canSelfSpawn: true }\n */\nexport const detectInstallManager = (input: DetectInstallManagerInput): InstallManagerInfo => {\n  const { selfRealPath, env, realpath, lazyNpmRoot } = input\n  const toInfo = (hit: Matcher): InstallManagerInfo => {\n    return { manager: hit.manager, updateCommand: hit.updateCommand, canSelfSpawn: hit.canSelfSpawn }\n  }\n  const matches = ({ test }: Matcher): boolean => {\n    return test({ selfRealPath, env, realpath })\n  }\n\n  const wrapper = WRAPPER_MATCHERS.find(matches)\n\n  if (wrapper) return toInfo(wrapper)\n\n  const derivedPrefix = npmPrefixFromSelfPath(selfRealPath)\n\n  if (derivedPrefix !== null) {\n    return { manager: 'npm', updateCommand: npmPrefixInstallCommand(derivedPrefix), canSelfSpawn: true }\n  }\n\n  const tree = TREE_MATCHERS.find(matches)\n\n  if (tree) return toInfo(tree)\n\n  const npmRoot = lazyNpmRoot?.()\n\n  if (npmRoot != null && npmRoot !== '' && isWithin(npmRoot, selfRealPath, realpath)) {\n    return { manager: 'npm', updateCommand: NPM_UPDATE_COMMAND, canSelfSpawn: true }\n  }\n\n  return { manager: 'unknown', updateCommand: NPM_UPDATE_COMMAND, canSelfSpawn: false }\n}\n\n/**\n * Is this CLI running from a *project-local* `node_modules` (as opposed to a global root)?\n *\n * The cwd clause is what does the distinguishing \u2014 BOTH a project install and a global root contain a\n * `/node_modules/` segment (`pnpm root -g` is `~/Library/pnpm/global/5/node_modules`). Without it we\n * would nag every global pnpm user to stop using a local install they do not have.\n *\n * Accepted false-negative: invoked from a subdirectory (cwd `project/apps/x`, deps at\n * `project/node_modules`) this returns false and the advisory stays silent. Under-warning is the safe\n * direction for a best-effort, never-throwing advisory \u2014 do not \"fix\" it by dropping the cwd clause.\n *\n * `cwd` is canonicalised before comparison for the same reason `detectInstallManager` canonicalises its\n * roots: `selfRealPath` is a realpath, and comparing it to an unresolved cwd never matches.\n *\n * @example\n * isLocalNodeModulesInstall('/repo/node_modules/infra-kit/dist/cli.js', '/repo', (p) => p) // => true\n */\nexport const isLocalNodeModulesInstall = (selfRealPath: string, cwd: string, realpath: RealpathFn): boolean => {\n  return hasSegment(selfRealPath, 'node_modules') && isWithin(cwd, selfRealPath, realpath)\n}\n", "import { realpathSync } from 'node:fs'\nimport path from 'node:path'\n\n/**\n * The impure companion to the pure detection module: canonicalise a directory that may not exist.\n *\n * `realpathSync` throws on a missing path, and candidate roots routinely miss \u2014 `PNPM_HOME` can point at a\n * directory the user never created, `npm root -g` can name a prefix that was removed. A throw there would\n * turn \"we could not identify your install\" into a crash, so an unresolvable path falls back to\n * `path.resolve`, which still normalises `.`/`..` and yields a usable, non-matching absolute path.\n */\nexport const safeRealpath = (dir: string): string => {\n  try {\n    return realpathSync(dir)\n  } catch {\n    return path.resolve(dir)\n  }\n}\n", "/* eslint-disable sonarjs/no-os-command-from-path */\n/**\n * `npm root -g`, the LAZY fallback for {@link detectInstallManager}.\n *\n * Why it is indispensable: the `npm` matcher keys off `npm_config_prefix`, which npm sets only while npm\n * itself is running. A user who ran `npm i -g infra-kit` months ago and now types `ik` has no such var,\n * so every cheap matcher misses and detection reports `unknown` / `canSelfSpawn: false`. Without this\n * probe the single most common install method can never update itself.\n *\n * Read by the background update worker, and by the `doctor` advisory that names the command a human\n * would run by hand \u2014 one probe so the two can never disagree about who owns the install.\n */\nimport { execFileSync } from 'node:child_process'\nimport process from 'node:process'\n\nconst NPM_ROOT_TIMEOUT_MS = 3_000\n\n/**\n * The global npm root, or undefined when npm is absent, slow, or errors. Costs a subprocess, so\n * `detectInstallManager` invokes it at most once and only after every env/path matcher has missed \u2014 a\n * pnpm or volta install never pays for it.\n *\n * Resolving the user's `npm` from PATH is inherent here: we must ask the very package manager that owns\n * this install where its global root is. Pinning an absolute path would defeat the detection.\n *\n * @example\n * defaultLazyNpmRoot() // => '/usr/local/lib/node_modules' | undefined\n */\nexport const defaultLazyNpmRoot = (): string | undefined => {\n  try {\n    const out = execFileSync('npm', ['root', '-g'], {\n      encoding: 'utf-8',\n      timeout: NPM_ROOT_TIMEOUT_MS,\n      stdio: ['ignore', 'pipe', 'ignore'],\n      shell: process.platform === 'win32',\n    })\n    const trimmed = out.trim()\n\n    return trimmed === '' ? undefined : trimmed\n  } catch {\n    return undefined\n  }\n}\n"],
-  "mappings": "AAAA,IAAAA,EAAA,CACE,KAAQ,YACR,KAAQ,SACR,QAAW,QACX,MAAS,CACP,MACF,EACA,YAAe,YACf,IAAO,CACL,YAAa,cACb,GAAM,cACN,SAAU,mBACZ,EACA,QAAW,CACT,KAAQ,QACV,EACA,QAAW,CACT,UAAa,iEACb,MAAS,sDACT,QAAW,iBACX,eAAkB,iBAClB,kBAAmB,4BACnB,kBAAmB,cACnB,cAAe,2EACf,eAAgB,4HAChB,iBAAkB,4HAClB,eAAgB,oEAChB,aAAc,kFACd,WAAY,eACZ,KAAQ,0CACR,aAAc,gDACd,UAAW,6CACX,cAAe,uDACf,SAAU,qMACV,GAAM,gHACN,IAAO,6DACT,EACA,aAAgB,CACd,gCAAiC,UACjC,qBAAsB,SACtB,oBAAqB,SACrB,kBAAmB,SACnB,qBAAsB,SACtB,mBAAoB,SACpB,+BAAgC,SAChC,0BAA2B,SAC3B,MAAS,SACT,SAAY,SACZ,UAAa,UACb,QAAW,UACX,IAAO,SACP,KAAQ,UACR,cAAe,UACf,SAAY,UACZ,MAAS,SACT,KAAQ,SACR,IAAO,SACP,GAAM,QACR,EACA,gBAAmB,CACjB,+BAAgC,SAChC,4BAA6B,UAC7B,iCAAkC,cAClC,oBAAqB,WACrB,eAAgB,WAChB,oBAAqB,cACrB,oBAAqB,cACrB,QAAW,UACX,sBAAuB,SACvB,WAAc,QAChB,CACF,EC/DA,OAAOC,MAAU,YAGV,IAAMC,EAAe,YAEtBC,EAAS,GAAGD,CAAY,UAoCjBE,EAAW,CAACC,EAAgBC,EAAeC,IAAkC,CACxF,IAAMC,EAAMP,EAAK,SAASM,EAASN,EAAK,QAAQI,CAAM,CAAC,EAAGJ,EAAK,QAAQK,CAAK,CAAC,EAE7E,OAAOE,IAAQ,IAAM,CAACA,EAAI,WAAW,IAAI,GAAK,CAACP,EAAK,WAAWO,CAAG,CACpE,EAGaC,EAAa,CAACC,EAAWC,IAC7BV,EAAK,QAAQS,CAAC,EAAE,MAAMT,EAAK,GAAG,EAAE,SAASU,CAAI,EAkBzCC,EAAc,CAACF,EAAWC,IAA0B,CAC/D,IAAME,EAAWZ,EAAK,QAAQS,CAAC,EAAE,MAAMT,EAAK,GAAG,EACzCa,EAASD,EAAS,QAAQ,QAAQ,EAExC,OAAOC,IAAW,IAAMD,EAASC,EAAS,CAAC,IAAMH,CACnD,EA2BaI,EAAqB,CAACC,EAAqBC,IAAuC,CAC7F,IAAMJ,EAAWZ,EAAK,QAAQe,CAAW,EAAE,MAAMf,EAAK,GAAG,EACnDiB,EAAcL,EAAS,YAAY,cAAc,EAIvD,OAFIK,EAAc,GACdL,EAASK,EAAc,CAAC,IAAM,OAC9BL,EAASK,EAAc,CAAC,IAAMD,EAAoB,KAG/CJ,EAAS,MAAM,EAAGK,EAAc,CAAC,EAAE,KAAKjB,EAAK,GAAG,GAAKA,EAAK,GACnE,EAKMkB,EAAyBC,GACtBL,EAAmBK,EAAclB,CAAY,EAShDmB,EAA2BC,GACxB,CAAC,MAAO,UAAW,KAAM,WAAYA,EAAQnB,CAAM,EAe/CoB,EAAuBC,GAC3BA,EACJ,IAAKC,GACGA,EAAM,SAAS,GAAG,EAAI,IAAIA,CAAK,IAAMA,CAC7C,EACA,KAAK,GAAG,EAIPC,EAAc,CAACC,EAAwBC,EAAaR,EAAsBb,IAAkC,CAChH,IAAMsB,EAAMF,EAAIC,CAAG,EAEnB,OAAOC,GAAO,MAAQA,IAAQ,IAAMzB,EAASyB,EAAKT,EAAcb,CAAQ,CAC1E,EAaMuB,EAA8B,CAClC,CACE,QAAS,QAET,KAAM,CAAC,CAAE,aAAAV,EAAc,IAAAO,EAAK,SAAApB,CAAS,IAEjCmB,EAAYC,EAAK,aAAcP,EAAcb,CAAQ,GACrDE,EAAWW,EAAc,QAAQ,GACjCX,EAAWW,EAAc,OAAO,EAGpC,cAAe,CAAC,QAAS,UAAWlB,CAAY,EAChD,aAAc,EAChB,EACA,CACE,QAAS,WAaT,KAAM,CAAC,CAAE,aAAAkB,CAAa,IACbR,EAAYQ,EAAclB,CAAY,EAE/C,cAAe,CAAC,OAAQ,UAAWA,CAAY,EAC/C,aAAc,EAChB,CACF,EAQM6B,EAA2B,CAC/B,CACE,QAAS,OACT,KAAM,CAAC,CAAE,aAAAX,EAAc,IAAAO,EAAK,SAAApB,CAAS,IAEjCmB,EAAYC,EAAK,YAAaP,EAAcb,CAAQ,GACnDE,EAAWW,EAAc,MAAM,GAAKX,EAAWW,EAAc,QAAQ,EAG1E,cAAe,CAAC,OAAQ,MAAO,KAAMjB,CAAM,EAC3C,aAAc,EAChB,EACA,CACE,QAAS,MACT,KAAM,CAAC,CAAE,aAAAiB,EAAc,IAAAO,EAAK,SAAApB,CAAS,IAC5BmB,EAAYC,EAAK,cAAeP,EAAcb,CAAQ,GAAKE,EAAWW,EAAc,MAAM,EAEnG,cAAe,CAAC,MAAO,MAAO,KAAMjB,CAAM,EAC1C,aAAc,EAChB,EACA,CACE,QAAS,OACT,KAAM,CAAC,CAAE,aAAAiB,CAAa,IAElBX,EAAWW,EAAc,OAAO,GAAMX,EAAWW,EAAc,MAAM,GAAKX,EAAWW,EAAc,QAAQ,EAG/G,cAAe,CAAC,OAAQ,SAAU,MAAOjB,CAAM,EAC/C,aAAc,EAChB,EACA,CACE,QAAS,MACT,KAAM,CAAC,CAAE,aAAAiB,EAAc,IAAAO,EAAK,SAAApB,CAAS,IAC5BmB,EAAYC,EAAK,oBAAqBP,EAAcb,CAAQ,EAErE,cAAe,CAAC,MAAO,UAAW,KAAMJ,CAAM,EAC9C,aAAc,EAChB,CACF,EAEM6B,EAAqB,CAAC,MAAO,UAAW,KAAM7B,CAAM,EAoB7C8B,EAAwBC,GAAyD,CAC5F,GAAM,CAAE,aAAAd,EAAc,IAAAO,EAAK,SAAApB,EAAU,YAAA4B,CAAY,EAAID,EAC/CE,EAAUC,IACP,CAAE,QAASA,EAAI,QAAS,cAAeA,EAAI,cAAe,aAAcA,EAAI,YAAa,GAE5FC,EAAU,CAAC,CAAE,KAAAC,CAAK,IACfA,EAAK,CAAE,aAAAnB,EAAc,IAAAO,EAAK,SAAApB,CAAS,CAAC,EAGvCiC,EAAUV,EAAiB,KAAKQ,CAAO,EAE7C,GAAIE,EAAS,OAAOJ,EAAOI,CAAO,EAElC,IAAMC,EAAgBtB,EAAsBC,CAAY,EAExD,GAAIqB,IAAkB,KACpB,MAAO,CAAE,QAAS,MAAO,cAAepB,EAAwBoB,CAAa,EAAG,aAAc,EAAK,EAGrG,IAAMC,EAAOX,EAAc,KAAKO,CAAO,EAEvC,GAAII,EAAM,OAAON,EAAOM,CAAI,EAE5B,IAAMC,EAAUR,IAAc,EAE9B,OAAIQ,GAAW,MAAQA,IAAY,IAAMvC,EAASuC,EAASvB,EAAcb,CAAQ,EACxE,CAAE,QAAS,MAAO,cAAeyB,EAAoB,aAAc,EAAK,EAG1E,CAAE,QAAS,UAAW,cAAeA,EAAoB,aAAc,EAAM,CACtF,EAmBaY,EAA4B,CAACxB,EAAsByB,EAAatC,IACpEE,EAAWW,EAAc,cAAc,GAAKhB,EAASyC,EAAKzB,EAAcb,CAAQ,ECtUzF,OAAS,gBAAAuC,MAAoB,UAC7B,OAAOC,MAAU,YAUV,IAAMC,EAAgBC,GAAwB,CACnD,GAAI,CACF,OAAOH,EAAaG,CAAG,CACzB,MAAQ,CACN,OAAOF,EAAK,QAAQE,CAAG,CACzB,CACF,ECLA,OAAS,gBAAAC,MAAoB,qBAC7B,OAAOC,MAAa,eAEpB,IAAMC,EAAsB,IAafC,EAAqB,IAA0B,CAC1D,GAAI,CAOF,IAAMC,EANMJ,EAAa,MAAO,CAAC,OAAQ,IAAI,EAAG,CAC9C,SAAU,QACV,QAASE,EACT,MAAO,CAAC,SAAU,OAAQ,QAAQ,EAClC,MAAOD,EAAQ,WAAa,OAC9B,CAAC,EACmB,KAAK,EAEzB,OAAOG,IAAY,GAAK,OAAYA,CACtC,MAAQ,CACN,MACF,CACF",
-  "names": ["package_default", "path", "PACKAGE_NAME", "LATEST", "isWithin", "parent", "child", "realpath", "rel", "hasSegment", "p", "name", "isBrewKegOf", "segments", "cellar", "npmPrefixOfPackage", "binRealPath", "packageName", "nodeModules", "npmPrefixFromSelfPath", "selfRealPath", "npmPrefixInstallCommand", "prefix", "formatUpdateCommand", "command", "token", "underEnvDir", "env", "key", "dir", "WRAPPER_MATCHERS", "TREE_MATCHERS", "NPM_UPDATE_COMMAND", "detectInstallManager", "input", "lazyNpmRoot", "toInfo", "hit", "matches", "test", "wrapper", "derivedPrefix", "tree", "npmRoot", "isLocalNodeModulesInstall", "cwd", "realpathSync", "path", "safeRealpath", "dir", "execFileSync", "process", "NPM_ROOT_TIMEOUT_MS", "defaultLazyNpmRoot", "trimmed"]
-}

package/dist/chunk-IERRU26T.js

@@ -1,2 +0,0 @@
-import{b as k,h as w,j as P,k as b}from"./chunk-GF2CA4CD.js";import{b as y}from"./chunk-XJOY7J3G.js";import{n as p,r as C}from"./chunk-PQG63EIV.js";import{spawnSync as Z}from"node:child_process";import{homedir as ee}from"node:os";import h from"node:process";import l from"node:fs";import S from"node:path";import O from"node:process";var V="update-check.lock",j=1800*1e3,D=()=>S.join(p(),V),q=(t,e)=>{try{e-l.statSync(t).mtimeMs>j&&l.rmSync(t,{force:!0})}catch{}},E=(t={})=>{let e=t.nowMs??Date.now(),n=t.lockPath??D();try{l.mkdirSync(S.dirname(n),{recursive:!0})}catch{return null}let r=()=>{try{return l.openSync(n,"wx",384)}catch{return null}},o=r();if(o===null&&(q(n,e),o=r()),o===null)return null;try{l.writeFileSync(o,String(O.pid))}catch{}return()=>{try{l.closeSync(o)}catch{}try{l.rmSync(n,{force:!0})}catch{}}};var J="https://registry.npmjs.org",$=5e3,z=t=>Object.entries(t).find(([n,r])=>/^npm_config_registry$/i.test(n)&&r!=null&&r!=="")?.[1],G=t=>{let e=z(t),n=e!=null&&e!==""?e:J;for(;n.endsWith("/");)n=n.slice(0,-1);return n},U=async(t,e=fetch)=>{let n=new AbortController,r=setTimeout(()=>{n.abort()},$);try{let o=await e(`${G(t)}/${k}/latest`,{signal:n.signal,headers:{accept:"application/json"}});if(!o.ok)return null;let s=(await o.json())?.version;return typeof s=="string"&&s!==""?s:null}catch{return null}finally{clearTimeout(r)}};var H=/^(\d+)\.(\d+)\.(\d+)$/,v=t=>{let[e=""]=t.trim().split("+"),[n="",...r]=e.split("-"),o=H.exec(n);if(!o)return null;let[i,s,u]=[o[1],o[2],o[3]].map(Number);return{release:[i,s,u],prerelease:r.length>0?r.join("-").split("."):[]}},x=/^\d+$/,K=(t,e)=>{let n=x.test(t),r=x.test(e);return n&&r?Number(t)-Number(e):n!==r?n?-1:1:t<e?-1:1},W=(t,e)=>{for(let n=0;n<Math.max(t.length,e.length);n+=1){let r=t[n],o=e[n];if(r===void 0)return-1;if(o===void 0)return 1;if(r!==o)return K(r,o)}return 0},N=(t,e)=>{let n=v(t),r=v(e);if(!n||!r)return!1;for(let s=0;s<3;s+=1){let u=n.release[s],m=r.release[s];if(u!==m)return u>m}let o=n.prerelease.length===0,i=r.prerelease.length===0;return o!==i?o:W(n.prerelease,r.prerelease)>0};import L from"node:fs";import M from"node:path";var A="update-check.json",B=1200*1e3,Y=()=>M.join(p(),A),Q=t=>Array.isArray(t)&&t.every(e=>typeof e=="string"),X=t=>{if(typeof t!="object"||t===null)return!1;let{lastCheckMs:e,latestVersion:n,updateCommand:r,outcome:o}=t;return typeof e=="number"&&Number.isFinite(e)&&(n===null||typeof n=="string")&&(r===null||Q(r))&&(o==null||typeof o=="string")},ke=(t=e=>L.readFileSync(e,"utf8"))=>{try{let e=JSON.parse(t(Y()));return X(e)?e:null}catch{return null}},R=t=>{let e=p();L.mkdirSync(e,{recursive:!0}),C(M.join(e,A),JSON.stringify(t),384)},we=(t,e)=>{if(!t)return!0;let n=e-t.lastCheckMs;return n<0?!0:n>=B};var te=200,ne=300*1e3,re=t=>{try{return h.kill(t,0),!0}catch{return!1}},oe=t=>new Promise(e=>{setTimeout(e,t)}),se=async(t,e)=>{let n=e.clock()+ne;for(;e.clock()<n;){if(!e.isProcessAlive(t))return!0;await e.sleep(te)}return!e.isProcessAlive(t)},Ae=async(t,e)=>{let r=(e.acquireLock??E)();if(!r)return"already-running";try{return await ae(t,e)}finally{r()}},ae=async(t,e)=>{let n=e.env??h.env,r=e.nowMs??Date.now(),o=e.fetchLatest??U,i=e.writeCache??R,s=e.isProcessAlive??re,u=e.sleep??oe,m=e.clock??Date.now,_=e.lazyNpmRoot??P,I=e.spawnSync??Z,a=await o(n),c=(g,F)=>(i({lastCheckMs:r,...F,outcome:g}),g);if(a===null)return c("fetch-failed",{latestVersion:null,updateCommand:null});if(!N(a,t))return c("up-to-date",{latestVersion:a,updateCommand:null});let{canSelfSpawn:T,updateCommand:f}=w({selfRealPath:e.selfRealPath,env:n,realpath:b,lazyNpmRoot:_});if(!T)return c("cannot-self-spawn",{latestVersion:a,updateCommand:f});if(e.parentPid==null)return c("parent-unknown",{latestVersion:a,updateCommand:null});if(i({lastCheckMs:r,latestVersion:a,updateCommand:null,outcome:"installing"}),!await se(e.parentPid,{isProcessAlive:s,sleep:u,clock:m}))return c("parent-still-running",{latestVersion:a,updateCommand:null});let d=I(f[0],f.slice(1),{stdio:"ignore",shell:h.platform==="win32",cwd:ee(),env:y(n),windowsHide:!0});return d.error||d.signal||d.status!==0?c("install-failed",{latestVersion:a,updateCommand:f}):c("installed",{latestVersion:null,updateCommand:null})};export{N as a,ke as b,we as c,Ae as d};
-//# sourceMappingURL=chunk-IERRU26T.js.map

package/dist/chunk-IERRU26T.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/lib/update-check/run-update-check.ts", "../src/lib/update-check/lock.ts", "../src/lib/update-check/registry.ts", "../src/lib/update-check/semver.ts", "../src/lib/update-check/update-cache.ts"],
-  "sourcesContent": ["/**\n * The CHILD half of the auto-update, spawned detached by `maybeAutoUpdate`. It outlives the CLI\n * invocation that started it, so it may take its time and it may replace the binary.\n *\n * WHY IT WAITS FOR THE PARENT TO EXIT \u2014 the load-bearing invariant of this whole feature:\n * `scripts/build.js` sets esbuild `splitting: true`, so `dist/cli.js` lazily imports sibling\n * `chunk-*.js` files at runtime (that is how the Ink TUI stays off the fast path). A package manager\n * installing over `dist/` mid-command deletes chunks the parent has not imported yet, and the parent\n * dies on a dynamic import of a file that no longer exists. Waiting for the parent to exit is what\n * makes a silent background install safe rather than a random crash under `infra-kit dev`.\n */\nimport { spawnSync } from 'node:child_process'\nimport { homedir } from 'node:os'\nimport process from 'node:process'\n\nimport { defaultLazyNpmRoot, detectInstallManager, safeRealpath } from 'src/lib/install-manager'\nimport { packageManagerInstallEnv } from 'src/lib/pm-env'\n\nimport { acquireUpdateLock } from './lock'\nimport { fetchLatestVersion } from './registry'\nimport { isNewerVersion } from './semver'\nimport { writeUpdateCache } from './update-cache'\nimport type { UpdateCache } from './update-cache'\n\n/** How often to re-check whether the parent is gone. */\nexport const PARENT_POLL_INTERVAL_MS = 200\n\n/**\n * Give up waiting after this long. A long-lived parent (`infra-kit dev` runs for hours) must not leave\n * an immortal child pinned to a stale version: we simply skip this cycle. `lastCheckMs` is already\n * persisted by then, so the next short-lived command re-checks after the normal throttle window.\n */\nexport const PARENT_WAIT_TIMEOUT_MS = 5 * 60 * 1000\n\nexport interface RunUpdateCheckDeps {\n  env?: NodeJS.ProcessEnv\n  nowMs?: number\n  fetchLatest?: (env: NodeJS.ProcessEnv) => Promise<string | null>\n  writeCache?: typeof writeUpdateCache\n  isProcessAlive?: (pid: number) => boolean\n  sleep?: (ms: number) => Promise<void>\n  /** Monotonic-ish source for the parent-wait deadline. Injected so the timeout is testable without real time. */\n  clock?: () => number\n  /** `npm root -g` probe. Defaults to the real subprocess; this child is detached, so it can afford one. */\n  lazyNpmRoot?: () => string | undefined\n  /** Single-flight guard. Returns a release fn, or null when another worker already holds the lock. */\n  acquireLock?: () => (() => void) | null\n  spawnSync?: typeof spawnSync\n  /** Realpath of the installed `dist/cli.js`, used to identify the owning package manager. */\n  selfRealPath: string\n  parentPid?: number\n}\n\n/** Signal 0 performs the permission/existence check without delivering anything. */\nconst defaultIsProcessAlive = (pid: number): boolean => {\n  try {\n    process.kill(pid, 0)\n\n    return true\n  } catch {\n    return false\n  }\n}\n\nconst defaultSleep = (ms: number): Promise<void> => {\n  return new Promise((resolve) => {\n    setTimeout(resolve, ms)\n  })\n}\n\n/**\n * Block until `parentPid` exits or {@link PARENT_WAIT_TIMEOUT_MS} elapses. Returns whether the parent\n * is actually gone \u2014 the caller must not install on a timeout.\n */\nconst waitForParentExit = async (\n  parentPid: number,\n  deps: Required<Pick<RunUpdateCheckDeps, 'isProcessAlive' | 'sleep' | 'clock'>>,\n): Promise<boolean> => {\n  const deadline = deps.clock() + PARENT_WAIT_TIMEOUT_MS\n\n  while (deps.clock() < deadline) {\n    if (!deps.isProcessAlive(parentPid)) return true\n\n    await deps.sleep(PARENT_POLL_INTERVAL_MS)\n  }\n\n  return !deps.isProcessAlive(parentPid)\n}\n\nexport type UpdateCheckOutcome =\n  | 'installed'\n  | 'install-failed'\n  | 'up-to-date'\n  | 'fetch-failed'\n  | 'cannot-self-spawn'\n  | 'parent-still-running'\n  | 'parent-unknown'\n  | 'already-running'\n\n/**\n * Fetch, decide, and (when safe) install \u2014 returning WHY it did what it did so tests can distinguish\n * \"no update\" from \"could not install\". Never throws.\n *\n * `lastCheckMs` is written from the ATTEMPT, before any early return. If it were written only on\n * success, an offline user would re-spawn a doomed child on every single command.\n *\n * @example\n * await runUpdateCheck('0.1.130', { selfRealPath: '/usr/local/lib/node_modules/infra-kit/dist/cli.js' })\n * // => 'installed'\n */\nexport const runUpdateCheck = async (currentVersion: string, deps: RunUpdateCheckDeps): Promise<UpdateCheckOutcome> => {\n  const acquireLock = deps.acquireLock ?? acquireUpdateLock\n\n  // Single-flight. N shells launched at once all read the same stale cache and each spawns a worker;\n  // the cache throttle cannot stop them because it is only written after the fetch returns. Without\n  // this, a pending update means N concurrent `npm install -g` over one global directory.\n  const release = acquireLock()\n\n  if (!release) return 'already-running'\n\n  try {\n    return await runUpdateCheckLocked(currentVersion, deps)\n  } finally {\n    release()\n  }\n}\n\nconst runUpdateCheckLocked = async (currentVersion: string, deps: RunUpdateCheckDeps): Promise<UpdateCheckOutcome> => {\n  const env = deps.env ?? process.env\n  const nowMs = deps.nowMs ?? Date.now()\n  const fetchLatest = deps.fetchLatest ?? fetchLatestVersion\n  const writeCache = deps.writeCache ?? writeUpdateCache\n  const isProcessAlive = deps.isProcessAlive ?? defaultIsProcessAlive\n  const sleep = deps.sleep ?? defaultSleep\n  const clock = deps.clock ?? Date.now\n  const lazyNpmRoot = deps.lazyNpmRoot ?? defaultLazyNpmRoot\n  const spawn = deps.spawnSync ?? spawnSync\n\n  const latestVersion = await fetchLatest(env)\n\n  // Every path below writes the cache EXACTLY once, and always with `lastCheckMs: nowMs` \u2014 the throttle\n  // burns on the ATTEMPT, never on success. If it burned only on success, an offline user would respawn\n  // a doomed child on every command.\n  const finish = (\n    outcome: UpdateCheckOutcome,\n    cache: Omit<UpdateCache, 'lastCheckMs' | 'outcome'>,\n  ): UpdateCheckOutcome => {\n    // `outcome` is recorded on EVERY write: it is what lets a reader (human or `isStale`) tell a settled\n    // `installed`/`up-to-date` from a transient `fetch-failed`, all of which otherwise write an identical\n    // `{latestVersion:null}`. See `UpdateCache.outcome`.\n    writeCache({ lastCheckMs: nowMs, ...cache, outcome })\n\n    return outcome\n  }\n\n  if (latestVersion === null) return finish('fetch-failed', { latestVersion: null, updateCommand: null })\n  if (!isNewerVersion(latestVersion, currentVersion))\n    return finish('up-to-date', { latestVersion, updateCommand: null })\n\n  // `lazyNpmRoot` is what makes the COMMON case work: a plain `npm i -g infra-kit` leaves no\n  // `npm_config_prefix` in the user's shell, so every cheap matcher misses and detection would report\n  // `unknown` / `canSelfSpawn: false`. Without this probe the auto-update would silently degrade to a\n  // notice for the majority of installs. The subprocess is affordable here and nowhere else.\n  const { canSelfSpawn, updateCommand } = detectInstallManager({\n    selfRealPath: deps.selfRealPath,\n    env,\n    realpath: safeRealpath,\n    lazyNpmRoot,\n  })\n\n  // Homebrew relinks its prefix and may prompt; an unknown location means the command is a guess.\n  // Both stay the user's call, so record the command for `maybeAutoUpdate` to print next invocation.\n  if (!canSelfSpawn) return finish('cannot-self-spawn', { latestVersion, updateCommand })\n\n  // Fail SAFE. Without a parent to outlive we cannot know whether a live CLI is still lazily importing\n  // `chunk-*.js` out of the `dist/` we are about to replace, so we skip the cycle rather than install\n  // blind. The real spawn always passes `--parent-pid`; only a hand-run worker lands here.\n  if (deps.parentPid == null) return finish('parent-unknown', { latestVersion, updateCommand: null })\n\n  // Burn the throttle NOW, before the two unbounded-ish operations below (a 5-minute parent wait, then an\n  // install of no fixed duration). Everything after this point can take many minutes, and until the cache\n  // is written it still reads as STALE \u2014 so every new shell in that window spawns its own worker, and the\n  // single-flight lock becomes the only thing standing between them and concurrent `npm install -g` runs\n  // over one global directory. The lock is reaped by mtime (LOCK_STALE_MS), so a slow enough install has\n  // its live lock stolen and we get exactly the pile-up the lock exists to prevent.\n  //\n  // Writing the stamp here makes the throttle \u2014 not the lock \u2014 the primary guard, which is what the cache\n  // was always for. `finish()` overwrites this with the real outcome; this is the only path that writes\n  // the cache twice, and deliberately so.\n  //\n  // `outcome: 'installing'` marks a mid-install checkpoint: if the worker is killed here (machine sleeps,\n  // SIGKILL) and never reaches `finish()`, this stamp is what the next run reads, and the cache says so\n  // rather than looking like a settled result. It does not shorten the next window \u2014 see CHECK_INTERVAL_MS.\n  writeCache({ lastCheckMs: nowMs, latestVersion, updateCommand: null, outcome: 'installing' })\n\n  const parentGone = await waitForParentExit(deps.parentPid, { isProcessAlive, sleep, clock })\n\n  // A long-lived parent (`infra-kit dev`) outlasted the wait. Stay silent and retry next window.\n  if (!parentGone) return finish('parent-still-running', { latestVersion, updateCommand: null })\n\n  // `shell` on win32 so the `.cmd` shims npm/pnpm/yarn ship as global bins resolve.\n  //\n  // `packageManagerInstallEnv` strips the inherited npx/dlx markers \u2014 which otherwise make\n  // pnpm/portless-style tools believe they were invoked via `npx`/`dlx` and refuse to run \u2014 while KEEPING\n  // `npm_config_prefix` and `npm_config_registry`. Using the blunt `withoutPackageManagerEnv` here was a\n  // bug: it also erased the prefix that `detectInstallManager` had just matched on, so we would detect a\n  // global install at prefix P and then install into the default prefix instead \u2014 silently, forever. See\n  // the module doc on `packageManagerInstallEnv`.\n  //\n  // `cwd` is pinned to the home directory, and this is a SECURITY control, not tidiness: npm resolves\n  // `registry=` from an `.npmrc` on disk relative to the cwd. Inheriting the caller's cwd would let any\n  // repo containing a hostile `.npmrc` silently redirect this unattended `install -g` to an attacker's\n  // registry, executing its lifecycle scripts. Stripping `npm_config_registry` from the env does NOT\n  // close that hole, because the redirect lives in a file, not the environment.\n  const result = spawn(updateCommand[0] as string, updateCommand.slice(1), {\n    stdio: 'ignore',\n    shell: process.platform === 'win32',\n    cwd: homedir(),\n    env: packageManagerInstallEnv(env),\n    windowsHide: true,\n  })\n\n  // Record the manual command so a persistently failing silent install (EACCES on a root-owned global\n  // dir, say) still surfaces ONE actionable line, instead of failing invisibly forever.\n  if (result.error || result.signal || result.status !== 0) {\n    return finish('install-failed', { latestVersion, updateCommand })\n  }\n\n  // The installed version is now `latestVersion`; clear it so the next run does not re-notify.\n  return finish('installed', { latestVersion: null, updateCommand: null })\n}\n", "/**\n * Single-flight lock for the background update worker.\n *\n * Without it, N shells starting at once all read the same stale cache and each spawns a worker \u2014 and\n * once a newer version exists, each of those runs `npm install -g` concurrently, over the same global\n * directory. (Measured: five concurrent `ik` invocations spawn five workers.) The throttle in the cache\n * cannot prevent this: it is only written AFTER the fetch returns, long after the other workers launched.\n *\n * `openSync(path, 'wx')` is the primitive \u2014 an atomic create-if-absent, so exactly one worker wins even\n * if all of them call it in the same millisecond.\n */\nimport fs from 'node:fs'\nimport path from 'node:path'\nimport process from 'node:process'\n\nimport { getCacheRoot } from 'src/lib/constants'\n\nexport const LOCK_FILE_NAME = 'update-check.lock'\n\n/**\n * A lock older than this is assumed to belong to a worker that was killed before it could clean up.\n *\n * Must exceed the worker's ENTIRE critical section, and the install is part of it: the lock is held across\n * `fetch` (\u22642.5s) + the parent wait (\u22645min) + `npm install -g`, which has no bound at all \u2014 a cold cache on\n * a slow link can run for many minutes. The previous 10 minutes was budgeted from the wait and the fetch\n * alone, silently omitting the very operation the lock exists to serialise. A slow enough install therefore\n * had its own LIVE lock reaped as stale by the next worker, which then ran a second concurrent\n * `npm install -g` over the same global directory \u2014 precisely the pile-up described above.\n *\n * The throttle, not this timeout, is now the primary guard: `runUpdateCheck` stamps `lastCheckMs` BEFORE\n * the wait and the install, so concurrent shells stop spawning workers at all. This value only has to\n * outlive a plausible install, and is deliberately generous \u2014 the cost of being too large is that a worker\n * killed mid-install delays the next attempt, which the throttle would delay anyway.\n */\nexport const LOCK_STALE_MS = 30 * 60 * 1000\n\nexport const lockFilePath = (): string => {\n  return path.join(getCacheRoot(), LOCK_FILE_NAME)\n}\n\nexport interface LockDeps {\n  nowMs?: number\n  lockPath?: string\n}\n\n/** Delete a lock whose mtime predates the staleness window. Best-effort: losing the race is harmless. */\nconst reapIfStale = (lockPath: string, nowMs: number): void => {\n  try {\n    if (nowMs - fs.statSync(lockPath).mtimeMs > LOCK_STALE_MS) fs.rmSync(lockPath, { force: true })\n  } catch {\n    // Vanished under us \u2014 another worker reaped it. Nothing to do.\n  }\n}\n\n/**\n * Take the lock, or return null when another worker already holds it.\n *\n * Returns a release function rather than a boolean so the caller cannot forget which path releases:\n * there is exactly one handle, and it is the only thing that can unlink the file.\n *\n * @example\n * const release = acquireUpdateLock()\n * if (!release) return 'already-running'\n * try { ... } finally { release() }\n */\nexport const acquireUpdateLock = (deps: LockDeps = {}): (() => void) | null => {\n  const nowMs = deps.nowMs ?? Date.now()\n  const lockPath = deps.lockPath ?? lockFilePath()\n\n  try {\n    fs.mkdirSync(path.dirname(lockPath), { recursive: true })\n  } catch {\n    return null\n  }\n\n  const open = (): number | null => {\n    try {\n      // 'wx' fails with EEXIST if the file is already there: an atomic test-and-set.\n      return fs.openSync(lockPath, 'wx', 0o600)\n    } catch {\n      return null\n    }\n  }\n\n  let fd = open()\n\n  if (fd === null) {\n    reapIfStale(lockPath, nowMs)\n    // One retry only. If a live worker holds the lock, we are the loser and must simply stand down.\n    fd = open()\n  }\n\n  if (fd === null) return null\n\n  try {\n    fs.writeFileSync(fd, String(process.pid))\n  } catch {\n    // The pid is a debugging aid, not part of the protocol; the lock is held either way.\n  }\n\n  return () => {\n    try {\n      fs.closeSync(fd)\n    } catch {\n      // Already closed.\n    }\n\n    try {\n      fs.rmSync(lockPath, { force: true })\n    } catch {\n      // Already gone; a later worker will reap it via LOCK_STALE_MS regardless.\n    }\n  }\n}\n", "/**\n * Ask the npm registry for the `latest` dist-tag. Node >= 24 (see `engines`), so global `fetch` is\n * available and this needs no dependency.\n */\nimport { PACKAGE_NAME } from 'src/lib/install-manager'\n\nexport const DEFAULT_REGISTRY = 'https://registry.npmjs.org'\n\n/**\n * Bounded so a hanging registry can never keep a detached child alive indefinitely. 5s, not a tighter\n * bound: the abbreviated `/pkg/latest` endpoint is usually ~20-900ms, but a cold TLS/DNS handshake in a\n * freshly-spawned worker can spike past a 2.5s cap \u2014 and a single trip used to cost a `fetch-failed` that\n * pushed the next check a full window out. A detached child that lingers a few extra seconds harms nothing.\n */\nexport const FETCH_TIMEOUT_MS = 5_000\n\n/**\n * The registry this install actually talks to. A user behind a corporate mirror has `npm_config_registry`\n * set; hitting registry.npmjs.org directly would either fail closed (firewall) or, worse, report a public\n * version they cannot install.\n *\n * @example\n * registryUrl({ npm_config_registry: 'https://nexus.corp/repo/npm/' }) // => 'https://nexus.corp/repo/npm'\n */\n/**\n * `npm_config_registry` in WHICHEVER case the environment spells it.\n *\n * A bare `env.npm_config_registry` reads only the lowercase form, but npm itself matches `/^npm_config_/i`,\n * and POSIX `process.env` is case-SENSITIVE \u2014 so a `NPM_CONFIG_REGISTRY` (the form Dockerfiles and CI\n * images export) was invisible here while npm honoured it. The check then queried the public registry that\n * the install would never touch: the two halves of this feature were exactly inverted.\n */\nconst configuredRegistry = (env: NodeJS.ProcessEnv): string | undefined => {\n  const hit = Object.entries(env).find(([key, value]) => {\n    return /^npm_config_registry$/i.test(key) && value != null && value !== ''\n  })\n\n  return hit?.[1]\n}\n\nexport const registryUrl = (env: NodeJS.ProcessEnv): string => {\n  const configured = configuredRegistry(env)\n\n  let base = configured != null && configured !== '' ? configured : DEFAULT_REGISTRY\n\n  // A `/\\/+$/` regex would do this in one line, but its backtracking is super-linear on a hostile input.\n  while (base.endsWith('/')) {\n    base = base.slice(0, -1)\n  }\n\n  return base\n}\n\n/**\n * The published `latest` version, or null on ANY failure (offline, timeout, non-200, malformed body).\n * Never throws: a failed check must be indistinguishable from \"no update available\" to every caller.\n *\n * @example\n * await fetchLatestVersion(process.env) // => '0.1.131' | null\n */\nexport const fetchLatestVersion = async (\n  env: NodeJS.ProcessEnv,\n  fetchFn: typeof fetch = fetch,\n): Promise<string | null> => {\n  const controller = new AbortController()\n  const timer = setTimeout(() => {\n    controller.abort()\n  }, FETCH_TIMEOUT_MS)\n\n  try {\n    const response = await fetchFn(`${registryUrl(env)}/${PACKAGE_NAME}/latest`, {\n      signal: controller.signal,\n      headers: { accept: 'application/json' },\n    })\n\n    if (!response.ok) return null\n\n    const body: unknown = await response.json()\n    const version = (body as { version?: unknown } | null)?.version\n\n    return typeof version === 'string' && version !== '' ? version : null\n  } catch {\n    return null\n  } finally {\n    clearTimeout(timer)\n  }\n}\n", "/**\n * Registry-safe version comparison for the auto-update check.\n *\n * Deliberately NOT `src/lib/version-utils`: `parseVersion` there does `versionStr.slice(1)` because it\n * only ever sees `v`-prefixed release tags, so it turns a bare registry version (`0.1.130`) into\n * `[NaN, 1, 130]`. Feeding npm's `dist-tags.latest` through it silently compares NaNs and never fires.\n * These inputs are bare semver from `registry.npmjs.org` and from our own `package.json`.\n */\n\n/** `1.2.3-beta.4+build` \u2192 the `[1, 2, 3]` release triple and the `beta.4` prerelease, or null if unparsable. */\ninterface ParsedVersion {\n  release: [number, number, number]\n  /** Dot-separated prerelease identifiers, empty when this is a final release. */\n  prerelease: string[]\n}\n\nconst RELEASE_PATTERN = /^(\\d+)\\.(\\d+)\\.(\\d+)$/\n\n/**\n * Parse bare semver. Returns null (never throws, never NaNs) for anything that is not\n * `major.minor.patch` with optional `-prerelease` and `+build` \u2014 a garbled registry body must read as\n * \"no update\", not as \"update to NaN\".\n *\n * @example\n * parseSemver('0.1.130') // => { release: [0, 1, 130], prerelease: [] }\n * parseSemver('1.0.0-rc.1+abc') // => { release: [1, 0, 0], prerelease: ['rc', '1'] }\n * parseSemver('v1.0.0') // => null\n */\nexport const parseSemver = (version: string): ParsedVersion | null => {\n  // Build metadata is ignored entirely by semver precedence rules.\n  const [withoutBuild = ''] = version.trim().split('+')\n  const [core = '', ...prereleaseParts] = withoutBuild.split('-')\n  const match = RELEASE_PATTERN.exec(core)\n\n  if (!match) return null\n\n  const [major, minor, patch] = [match[1], match[2], match[3]].map(Number) as [number, number, number]\n\n  return {\n    release: [major, minor, patch],\n    // Re-join on '-' so `1.0.0-rc-1` keeps its hyphen inside a single identifier.\n    prerelease: prereleaseParts.length > 0 ? prereleaseParts.join('-').split('.') : [],\n  }\n}\n\nconst NUMERIC_IDENTIFIER = /^\\d+$/\n\n/** Compare two unequal prerelease identifiers per semver \u00A711. Numeric ones rank below alphanumeric ones. */\nconst compareIdentifier = (left: string, right: string): number => {\n  const leftNumeric = NUMERIC_IDENTIFIER.test(left)\n  const rightNumeric = NUMERIC_IDENTIFIER.test(right)\n\n  if (leftNumeric && rightNumeric) return Number(left) - Number(right)\n  if (leftNumeric !== rightNumeric) return leftNumeric ? -1 : 1\n\n  return left < right ? -1 : 1\n}\n\n/** Compare prerelease identifier lists. A shorter list has lower precedence: `1.0.0-rc` < `1.0.0-rc.1`. */\nconst comparePrerelease = (a: string[], b: string[]): number => {\n  for (let index = 0; index < Math.max(a.length, b.length); index += 1) {\n    const left = a[index]\n    const right = b[index]\n\n    if (left === undefined) return -1\n    if (right === undefined) return 1\n    if (left !== right) return compareIdentifier(left, right)\n  }\n\n  return 0\n}\n\n/**\n * Is `latest` strictly newer than `current`? False when either is unparsable, so a bad registry\n * response can never trigger an install.\n *\n * The load-bearing case is NUMERIC, not lexical, comparison: `0.1.9` must be older than `0.1.130`.\n * A string compare would order them the other way and pin every user to the older build forever.\n *\n * A final release outranks its own prereleases (`1.0.0` > `1.0.0-rc.1`), so a user on `rc` is offered\n * the release, and a user on the release is never \"downgraded\" to an rc.\n *\n * @example\n * isNewerVersion('0.1.130', '0.1.9') // => true  (numeric, not lexical)\n * isNewerVersion('1.0.0', '1.0.0-rc.1') // => true\n * isNewerVersion('0.1.130', '0.1.130') // => false\n * isNewerVersion('garbage', '0.1.0') // => false\n */\nexport const isNewerVersion = (latest: string, current: string): boolean => {\n  const parsedLatest = parseSemver(latest)\n  const parsedCurrent = parseSemver(current)\n\n  if (!parsedLatest || !parsedCurrent) return false\n\n  for (let index = 0; index < 3; index += 1) {\n    const left = parsedLatest.release[index] as number\n    const right = parsedCurrent.release[index] as number\n\n    if (left !== right) return left > right\n  }\n\n  const latestIsFinal = parsedLatest.prerelease.length === 0\n  const currentIsFinal = parsedCurrent.prerelease.length === 0\n\n  if (latestIsFinal !== currentIsFinal) return latestIsFinal\n\n  return comparePrerelease(parsedLatest.prerelease, parsedCurrent.prerelease) > 0\n}\n", "/**\n * The throttle + notice state for the auto-update check, at `$cacheRoot/update-check.json`.\n *\n * `getCacheRoot()` \u2014 NOT `getSessionCacheDir()`, which throws unless `INFRA_KIT_SESSION` is set. A user\n * who installed this CLI globally and never ran `infra-kit setup` has no session, and the update check\n * must still work for exactly that person.\n */\nimport fs from 'node:fs'\nimport path from 'node:path'\n\nimport { atomicWriteFileSync, getCacheRoot } from 'src/lib/constants'\n\nexport const CACHE_FILE_NAME = 'update-check.json'\n\n/**\n * The ONE re-check window, whatever the last outcome was. A background check is cheap \u2014 one\n * detached child and a single registry fetch bounded by `FETCH_TIMEOUT_MS` \u2014 but not once per\n * shell command, which is the storm this throttle exists to stop.\n *\n * MUST stay above a full worker cycle: `runUpdateCheck` stamps `lastCheckMs` BEFORE waiting up to\n * `PARENT_WAIT_TIMEOUT_MS` (5min) for the parent to exit and THEN installing.\n */\n// There is deliberately no shorter \"retry after a transient failure\" window. One used to exist\n// because this interval was 24h, and burning a whole day on a single network blip locked out\n// exactly the publisher pushing a release mid-window. At 20 minutes that gap is gone: a blip costs\n// one window, so a second window buys nothing and cannot pay for what it costs.\n//\n// What it would cost: go below a full worker cycle and the cache reads stale while the first worker\n// is still legitimately working, so the next shell spawns a worker that dies on the live\n// single-flight lock and returns WITHOUT writing \u2014 leaving the cache stale for every command until\n// `LOCK_STALE_MS` (30min) reaps the lock. That is the per-command spawn storm this throttle exists\n// to prevent, and it is why a 5-minute retry window is not an option.\nexport const CHECK_INTERVAL_MS = 20 * 60 * 1000\n\nexport interface UpdateCache {\n  /**\n   * When the last check was ATTEMPTED \u2014 never \"when it last succeeded\". An offline user whose fetch\n   * throws must still burn their window, or every single command spawns another doomed child.\n   */\n  lastCheckMs: number\n  /** Latest version seen on the registry, or null when the last attempt failed. */\n  latestVersion: string | null\n  /**\n   * The command the USER must run, set only when the worker was not allowed to install for them\n   * (Homebrew, or an install location it could not identify). Null means \"handled, say nothing\".\n   *\n   * The worker decides this, not the reader: identifying the owning package manager can cost an\n   * `npm root -g` subprocess, and the CLI startup path must never pay for one. The background child\n   * already pays it, so it writes the verdict down.\n   */\n  updateCommand: string[] | null\n  /**\n   * The last check's terminal outcome (`installed`, `fetch-failed`, `up-to-date`, \u2026), or absent on a\n   * cache written before this field existed.\n   *\n   * Diagnostic ONLY \u2014 nothing branches on it, {@link isStale} included. It earns its keep by being the\n   * one thing that makes this file legible: a successful `installed` and a failed `fetch-failed` both\n   * write a byte-identical `{latestVersion:null, updateCommand:null}`, so without this the cache cannot\n   * say which happened, and a silent auto-update leaves no other trace of what it did.\n   */\n  outcome?: string | null\n}\n\nexport const cacheFilePath = (): string => {\n  return path.join(getCacheRoot(), CACHE_FILE_NAME)\n}\n\nconst isStringArray = (value: unknown): value is string[] => {\n  return (\n    Array.isArray(value) &&\n    value.every((entry) => {\n      return typeof entry === 'string'\n    })\n  )\n}\n\nconst isUpdateCache = (value: unknown): value is UpdateCache => {\n  if (typeof value !== 'object' || value === null) return false\n\n  const { lastCheckMs, latestVersion, updateCommand, outcome } = value as Partial<UpdateCache>\n\n  return (\n    typeof lastCheckMs === 'number' &&\n    Number.isFinite(lastCheckMs) &&\n    (latestVersion === null || typeof latestVersion === 'string') &&\n    (updateCommand === null || isStringArray(updateCommand)) &&\n    (outcome === undefined || outcome === null || typeof outcome === 'string')\n  )\n}\n\n/**\n * Read the cache, or null when it is missing/unreadable/corrupt. A null read means \"stale\" to every\n * caller, so a first run and a hand-mangled file behave identically: check again.\n *\n * @example\n * readUpdateCache() // => { lastCheckMs: 1770000000000, latestVersion: '0.1.131' } | null\n */\nexport const readUpdateCache = (\n  readFile: (p: string) => string = (p) => {\n    return fs.readFileSync(p, 'utf8')\n  },\n): UpdateCache | null => {\n  try {\n    const parsed: unknown = JSON.parse(readFile(cacheFilePath()))\n\n    return isUpdateCache(parsed) ? parsed : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Persist the check result. Creates `$cacheRoot` first: `atomicWriteFileSync` writes a temp file\n * beside the target and renames, so it throws ENOENT on a machine that has never had a `~/.cache/infra-kit`.\n * Without this mkdir the write fails, `lastCheckMs` never lands, and the throttle degrades into a\n * detached-child spawn on every invocation.\n *\n * @example\n * writeUpdateCache({ lastCheckMs: Date.now(), latestVersion: '0.1.131' })\n */\nexport const writeUpdateCache = (cache: UpdateCache): void => {\n  const root = getCacheRoot()\n\n  fs.mkdirSync(root, { recursive: true })\n  atomicWriteFileSync(path.join(root, CACHE_FILE_NAME), JSON.stringify(cache), 0o600)\n}\n\n/**\n * Has the throttle window elapsed? A missing cache is stale by definition (first run).\n *\n * A `lastCheckMs` in the future (clock skew, or a restored backup) also reads as stale rather than\n * locking the user out of updates until their clock catches up.\n *\n * The window does NOT depend on `outcome`: every last outcome, transient or settled, is re-checked\n * after {@link CHECK_INTERVAL_MS}. See that constant for why a shorter transient-failure window is not\n * worth its cost here.\n *\n * @example\n * isStale(null, 1_000) // => true\n * isStale({ lastCheckMs: 0, latestVersion: null, updateCommand: null }, CHECK_INTERVAL_MS + 1) // => true\n */\nexport const isStale = (cache: UpdateCache | null, nowMs: number): boolean => {\n  if (!cache) return true\n\n  const elapsed = nowMs - cache.lastCheckMs\n\n  if (elapsed < 0) return true\n\n  return elapsed >= CHECK_INTERVAL_MS\n}\n"],
-  "mappings": "oJAWA,OAAS,aAAAA,MAAiB,qBAC1B,OAAS,WAAAC,OAAe,UACxB,OAAOC,MAAa,eCFpB,OAAOC,MAAQ,UACf,OAAOC,MAAU,YACjB,OAAOC,MAAa,eAIb,IAAMC,EAAiB,oBAiBjBC,EAAgB,KAAU,IAE1BC,EAAe,IACnBC,EAAK,KAAKC,EAAa,EAAGJ,CAAc,EAS3CK,EAAc,CAACC,EAAkBC,IAAwB,CAC7D,GAAI,CACEA,EAAQC,EAAG,SAASF,CAAQ,EAAE,QAAUL,GAAeO,EAAG,OAAOF,EAAU,CAAE,MAAO,EAAK,CAAC,CAChG,MAAQ,CAER,CACF,EAaaG,EAAoB,CAACC,EAAiB,CAAC,IAA2B,CAC7E,IAAMH,EAAQG,EAAK,OAAS,KAAK,IAAI,EAC/BJ,EAAWI,EAAK,UAAYR,EAAa,EAE/C,GAAI,CACFM,EAAG,UAAUL,EAAK,QAAQG,CAAQ,EAAG,CAAE,UAAW,EAAK,CAAC,CAC1D,MAAQ,CACN,OAAO,IACT,CAEA,IAAMK,EAAO,IAAqB,CAChC,GAAI,CAEF,OAAOH,EAAG,SAASF,EAAU,KAAM,GAAK,CAC1C,MAAQ,CACN,OAAO,IACT,CACF,EAEIM,EAAKD,EAAK,EAQd,GANIC,IAAO,OACTP,EAAYC,EAAUC,CAAK,EAE3BK,EAAKD,EAAK,GAGRC,IAAO,KAAM,OAAO,KAExB,GAAI,CACFJ,EAAG,cAAcI,EAAI,OAAOC,EAAQ,GAAG,CAAC,CAC1C,MAAQ,CAER,CAEA,MAAO,IAAM,CACX,GAAI,CACFL,EAAG,UAAUI,CAAE,CACjB,MAAQ,CAER,CAEA,GAAI,CACFJ,EAAG,OAAOF,EAAU,CAAE,MAAO,EAAK,CAAC,CACrC,MAAQ,CAER,CACF,CACF,EC3GO,IAAMQ,EAAmB,6BAQnBC,EAAmB,IAkB1BC,EAAsBC,GACd,OAAO,QAAQA,CAAG,EAAE,KAAK,CAAC,CAACC,EAAKC,CAAK,IACxC,yBAAyB,KAAKD,CAAG,GAAKC,GAAS,MAAQA,IAAU,EACzE,IAEY,CAAC,EAGHC,EAAeH,GAAmC,CAC7D,IAAMI,EAAaL,EAAmBC,CAAG,EAErCK,EAAOD,GAAc,MAAQA,IAAe,GAAKA,EAAaP,EAGlE,KAAOQ,EAAK,SAAS,GAAG,GACtBA,EAAOA,EAAK,MAAM,EAAG,EAAE,EAGzB,OAAOA,CACT,EASaC,EAAqB,MAChCN,EACAO,EAAwB,QACG,CAC3B,IAAMC,EAAa,IAAI,gBACjBC,EAAQ,WAAW,IAAM,CAC7BD,EAAW,MAAM,CACnB,EAAGV,CAAgB,EAEnB,GAAI,CACF,IAAMY,EAAW,MAAMH,EAAQ,GAAGJ,EAAYH,CAAG,CAAC,IAAIW,CAAY,UAAW,CAC3E,OAAQH,EAAW,OACnB,QAAS,CAAE,OAAQ,kBAAmB,CACxC,CAAC,EAED,GAAI,CAACE,EAAS,GAAI,OAAO,KAGzB,IAAME,GADgB,MAAMF,EAAS,KAAK,IACc,QAExD,OAAO,OAAOE,GAAY,UAAYA,IAAY,GAAKA,EAAU,IACnE,MAAQ,CACN,OAAO,IACT,QAAE,CACA,aAAaH,CAAK,CACpB,CACF,ECtEA,IAAMI,EAAkB,wBAYXC,EAAeC,GAA0C,CAEpE,GAAM,CAACC,EAAe,EAAE,EAAID,EAAQ,KAAK,EAAE,MAAM,GAAG,EAC9C,CAACE,EAAO,GAAI,GAAGC,CAAe,EAAIF,EAAa,MAAM,GAAG,EACxDG,EAAQN,EAAgB,KAAKI,CAAI,EAEvC,GAAI,CAACE,EAAO,OAAO,KAEnB,GAAM,CAACC,EAAOC,EAAOC,CAAK,EAAI,CAACH,EAAM,CAAC,EAAGA,EAAM,CAAC,EAAGA,EAAM,CAAC,CAAC,EAAE,IAAI,MAAM,EAEvE,MAAO,CACL,QAAS,CAACC,EAAOC,EAAOC,CAAK,EAE7B,WAAYJ,EAAgB,OAAS,EAAIA,EAAgB,KAAK,GAAG,EAAE,MAAM,GAAG,EAAI,CAAC,CACnF,CACF,EAEMK,EAAqB,QAGrBC,EAAoB,CAACC,EAAcC,IAA0B,CACjE,IAAMC,EAAcJ,EAAmB,KAAKE,CAAI,EAC1CG,EAAeL,EAAmB,KAAKG,CAAK,EAElD,OAAIC,GAAeC,EAAqB,OAAOH,CAAI,EAAI,OAAOC,CAAK,EAC/DC,IAAgBC,EAAqBD,EAAc,GAAK,EAErDF,EAAOC,EAAQ,GAAK,CAC7B,EAGMG,EAAoB,CAACC,EAAaC,IAAwB,CAC9D,QAASC,EAAQ,EAAGA,EAAQ,KAAK,IAAIF,EAAE,OAAQC,EAAE,MAAM,EAAGC,GAAS,EAAG,CACpE,IAAMP,EAAOK,EAAEE,CAAK,EACdN,EAAQK,EAAEC,CAAK,EAErB,GAAIP,IAAS,OAAW,MAAO,GAC/B,GAAIC,IAAU,OAAW,MAAO,GAChC,GAAID,IAASC,EAAO,OAAOF,EAAkBC,EAAMC,CAAK,CAC1D,CAEA,MAAO,EACT,EAkBaO,EAAiB,CAACC,EAAgBC,IAA6B,CAC1E,IAAMC,EAAetB,EAAYoB,CAAM,EACjCG,EAAgBvB,EAAYqB,CAAO,EAEzC,GAAI,CAACC,GAAgB,CAACC,EAAe,MAAO,GAE5C,QAASL,EAAQ,EAAGA,EAAQ,EAAGA,GAAS,EAAG,CACzC,IAAMP,EAAOW,EAAa,QAAQJ,CAAK,EACjCN,EAAQW,EAAc,QAAQL,CAAK,EAEzC,GAAIP,IAASC,EAAO,OAAOD,EAAOC,CACpC,CAEA,IAAMY,EAAgBF,EAAa,WAAW,SAAW,EACnDG,EAAiBF,EAAc,WAAW,SAAW,EAE3D,OAAIC,IAAkBC,EAAuBD,EAEtCT,EAAkBO,EAAa,WAAYC,EAAc,UAAU,EAAI,CAChF,ECpGA,OAAOG,MAAQ,UACf,OAAOC,MAAU,YAIV,IAAMC,EAAkB,oBAoBlBC,EAAoB,KAAU,IA+B9BC,EAAgB,IACpBC,EAAK,KAAKC,EAAa,EAAGJ,CAAe,EAG5CK,EAAiBC,GAEnB,MAAM,QAAQA,CAAK,GACnBA,EAAM,MAAOC,GACJ,OAAOA,GAAU,QACzB,EAICC,EAAiBF,GAAyC,CAC9D,GAAI,OAAOA,GAAU,UAAYA,IAAU,KAAM,MAAO,GAExD,GAAM,CAAE,YAAAG,EAAa,cAAAC,EAAe,cAAAC,EAAe,QAAAC,CAAQ,EAAIN,EAE/D,OACE,OAAOG,GAAgB,UACvB,OAAO,SAASA,CAAW,IAC1BC,IAAkB,MAAQ,OAAOA,GAAkB,YACnDC,IAAkB,MAAQN,EAAcM,CAAa,KAC5BC,GAAY,MAAQ,OAAOA,GAAY,SAErE,EASaC,GAAkB,CAC7BC,EAAmCC,GAC1BC,EAAG,aAAaD,EAAG,MAAM,IAEX,CACvB,GAAI,CACF,IAAME,EAAkB,KAAK,MAAMH,EAASZ,EAAc,CAAC,CAAC,EAE5D,OAAOM,EAAcS,CAAM,EAAIA,EAAS,IAC1C,MAAQ,CACN,OAAO,IACT,CACF,EAWaC,EAAoBC,GAA6B,CAC5D,IAAMC,EAAOhB,EAAa,EAE1BY,EAAG,UAAUI,EAAM,CAAE,UAAW,EAAK,CAAC,EACtCC,EAAoBlB,EAAK,KAAKiB,EAAMpB,CAAe,EAAG,KAAK,UAAUmB,CAAK,EAAG,GAAK,CACpF,EAgBaG,GAAU,CAACH,EAA2BI,IAA2B,CAC5E,GAAI,CAACJ,EAAO,MAAO,GAEnB,IAAMK,EAAUD,EAAQJ,EAAM,YAE9B,OAAIK,EAAU,EAAU,GAEjBA,GAAWvB,CACpB,EJ5HO,IAAMwB,GAA0B,IAO1BC,GAAyB,IAAS,IAsBzCC,GAAyBC,GAAyB,CACtD,GAAI,CACF,OAAAC,EAAQ,KAAKD,EAAK,CAAC,EAEZ,EACT,MAAQ,CACN,MAAO,EACT,CACF,EAEME,GAAgBC,GACb,IAAI,QAASC,GAAY,CAC9B,WAAWA,EAASD,CAAE,CACxB,CAAC,EAOGE,GAAoB,MACxBC,EACAC,IACqB,CACrB,IAAMC,EAAWD,EAAK,MAAM,EAAIT,GAEhC,KAAOS,EAAK,MAAM,EAAIC,GAAU,CAC9B,GAAI,CAACD,EAAK,eAAeD,CAAS,EAAG,MAAO,GAE5C,MAAMC,EAAK,MAAMV,EAAuB,CAC1C,CAEA,MAAO,CAACU,EAAK,eAAeD,CAAS,CACvC,EAuBaG,GAAiB,MAAOC,EAAwBH,IAA0D,CAMrH,IAAMI,GALcJ,EAAK,aAAeK,GAKZ,EAE5B,GAAI,CAACD,EAAS,MAAO,kBAErB,GAAI,CACF,OAAO,MAAME,GAAqBH,EAAgBH,CAAI,CACxD,QAAE,CACAI,EAAQ,CACV,CACF,EAEME,GAAuB,MAAOH,EAAwBH,IAA0D,CACpH,IAAMO,EAAMP,EAAK,KAAON,EAAQ,IAC1Bc,EAAQR,EAAK,OAAS,KAAK,IAAI,EAC/BS,EAAcT,EAAK,aAAeU,EAClCC,EAAaX,EAAK,YAAcY,EAChCC,EAAiBb,EAAK,gBAAkBR,GACxCsB,EAAQd,EAAK,OAASL,GACtBoB,EAAQf,EAAK,OAAS,KAAK,IAC3BgB,EAAchB,EAAK,aAAeiB,EAClCC,EAAQlB,EAAK,WAAamB,EAE1BC,EAAgB,MAAMX,EAAYF,CAAG,EAKrCc,EAAS,CACbC,EACAC,KAKAZ,EAAW,CAAE,YAAaH,EAAO,GAAGe,EAAO,QAAAD,CAAQ,CAAC,EAE7CA,GAGT,GAAIF,IAAkB,KAAM,OAAOC,EAAO,eAAgB,CAAE,cAAe,KAAM,cAAe,IAAK,CAAC,EACtG,GAAI,CAACG,EAAeJ,EAAejB,CAAc,EAC/C,OAAOkB,EAAO,aAAc,CAAE,cAAAD,EAAe,cAAe,IAAK,CAAC,EAMpE,GAAM,CAAE,aAAAK,EAAc,cAAAC,CAAc,EAAIC,EAAqB,CAC3D,aAAc3B,EAAK,aACnB,IAAAO,EACA,SAAUqB,EACV,YAAAZ,CACF,CAAC,EAID,GAAI,CAACS,EAAc,OAAOJ,EAAO,oBAAqB,CAAE,cAAAD,EAAe,cAAAM,CAAc,CAAC,EAKtF,GAAI1B,EAAK,WAAa,KAAM,OAAOqB,EAAO,iBAAkB,CAAE,cAAAD,EAAe,cAAe,IAAK,CAAC,EAqBlG,GALAT,EAAW,CAAE,YAAaH,EAAO,cAAAY,EAAe,cAAe,KAAM,QAAS,YAAa,CAAC,EAKxF,CAHe,MAAMtB,GAAkBE,EAAK,UAAW,CAAE,eAAAa,EAAgB,MAAAC,EAAO,MAAAC,CAAM,CAAC,EAG1E,OAAOM,EAAO,uBAAwB,CAAE,cAAAD,EAAe,cAAe,IAAK,CAAC,EAgB7F,IAAMS,EAASX,EAAMQ,EAAc,CAAC,EAAaA,EAAc,MAAM,CAAC,EAAG,CACvE,MAAO,SACP,MAAOhC,EAAQ,WAAa,QAC5B,IAAKoC,GAAQ,EACb,IAAKC,EAAyBxB,CAAG,EACjC,YAAa,EACf,CAAC,EAID,OAAIsB,EAAO,OAASA,EAAO,QAAUA,EAAO,SAAW,EAC9CR,EAAO,iBAAkB,CAAE,cAAAD,EAAe,cAAAM,CAAc,CAAC,EAI3DL,EAAO,YAAa,CAAE,cAAe,KAAM,cAAe,IAAK,CAAC,CACzE",
-  "names": ["spawnSync", "homedir", "process", "fs", "path", "process", "LOCK_FILE_NAME", "LOCK_STALE_MS", "lockFilePath", "path", "getCacheRoot", "reapIfStale", "lockPath", "nowMs", "fs", "acquireUpdateLock", "deps", "open", "fd", "process", "DEFAULT_REGISTRY", "FETCH_TIMEOUT_MS", "configuredRegistry", "env", "key", "value", "registryUrl", "configured", "base", "fetchLatestVersion", "fetchFn", "controller", "timer", "response", "PACKAGE_NAME", "version", "RELEASE_PATTERN", "parseSemver", "version", "withoutBuild", "core", "prereleaseParts", "match", "major", "minor", "patch", "NUMERIC_IDENTIFIER", "compareIdentifier", "left", "right", "leftNumeric", "rightNumeric", "comparePrerelease", "a", "b", "index", "isNewerVersion", "latest", "current", "parsedLatest", "parsedCurrent", "latestIsFinal", "currentIsFinal", "fs", "path", "CACHE_FILE_NAME", "CHECK_INTERVAL_MS", "cacheFilePath", "path", "getCacheRoot", "isStringArray", "value", "entry", "isUpdateCache", "lastCheckMs", "latestVersion", "updateCommand", "outcome", "readUpdateCache", "readFile", "p", "fs", "parsed", "writeUpdateCache", "cache", "root", "atomicWriteFileSync", "isStale", "nowMs", "elapsed", "PARENT_POLL_INTERVAL_MS", "PARENT_WAIT_TIMEOUT_MS", "defaultIsProcessAlive", "pid", "process", "defaultSleep", "ms", "resolve", "waitForParentExit", "parentPid", "deps", "deadline", "runUpdateCheck", "currentVersion", "release", "acquireUpdateLock", "runUpdateCheckLocked", "env", "nowMs", "fetchLatest", "fetchLatestVersion", "writeCache", "writeUpdateCache", "isProcessAlive", "sleep", "clock", "lazyNpmRoot", "defaultLazyNpmRoot", "spawn", "spawnSync", "latestVersion", "finish", "outcome", "cache", "isNewerVersion", "canSelfSpawn", "updateCommand", "detectInstallManager", "safeRealpath", "result", "homedir", "packageManagerInstallEnv"]
-}