infra-kit 0.9.0 → 0.11.0

package/dist/boot-BL4EQMZV.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/tui/boot.tsx", "../src/tui/screens/branch-multi-picker.tsx", "../src/tui/hooks/use-list-filter.ts", "../src/tui/screens/palette-window.ts", "../src/tui/screens/branch-picker.tsx", "../src/tui/screens/command-palette.tsx"],
-  "sourcesContent": ["import { render } from 'ink'\nimport process from 'node:process'\nimport type { ReactElement } from 'react'\n\nimport { stdinReaderCount } from 'src/lib/prompts/stdin-ref'\nimport type { BranchPickerItem } from 'src/lib/prompts/types'\nimport { suspendForeground } from 'src/lib/session/suspend-foreground'\n\nimport { safeStderr } from './safe-stderr'\nimport { BranchMultiPicker } from './screens/branch-multi-picker'\nimport { BranchPicker } from './screens/branch-picker'\nimport { CommandPalette } from './screens/command-palette'\nimport type { PaletteItem } from './types'\n\n/**\n * Entry point for the Ink TUI. This module (and everything under `src/tui/`) is\n * the ONLY place allowed to import `ink`/`react`; it is reached exclusively via a\n * dynamic `await import('src/tui/boot')` from the TTY branch of entry/cli.ts, so\n * React never loads on the MCP / `--json` / non-TTY paths. Build splitting keeps\n * it in a separate lazy chunk (see scripts/build.js).\n */\n\n/**\n * Render an Ink element to stderr and resolve once it tears down. Frames are\n * written to stderr so stdout stays clean for the command that runs afterwards\n * (mirrors the previous Inquirer menu).\n *\n * STDIN \u2014 Ink is self-balancing (it refs when it arms raw mode, unrefs on teardown), so the common\n * paths need nothing from here. The re-assert below is CONDITIONAL on the reader counter and is a\n * net for the one case Ink cannot see: an Ink screen rendered INSIDE a `withEscape` callback, whose\n * teardown would unref the handle the outer prompt is still reading from and kill it with exit 13.\n * See lib/prompts/stdin-ref.\n */\n// Where the balance comes from: ink/build/components/App.js:225 (`ref` on raw mode) and :137\n// (`unref` on teardown). A later Ink render refs itself again on mount, and an `@inquirer/*`\n// prompt \u2014 which refs nothing on its own \u2014 gets its ref from `withEscape`. The re-assert is a net\n// for a boundary nothing structurally enforces, not the mechanism that keeps prompts alive.\n//\n// It replaces an UNCONDITIONAL `process.stdin.ref()`, whose stated premise \u2014 \"an idle ref'd stdin\n// does not block exit\" \u2014 is simply false: a ref'd tty ReadStream holds the event loop open whether\n// or not anything is listening to it. That re-ref bought the next prompt its handle and cost the\n// session shell its exit, so every quit key in the palette tore the frame down correctly and then\n// hung forever.\nconst renderToStderr = async (element: ReactElement): Promise<void> => {\n  const stdout = safeStderr()\n  const { waitUntilExit } = render(element, {\n    stdout,\n    // Ink's default is `exitOnCtrlC: true`, which intercepts the 0x03 byte in its own App and calls\n    // `handleExit()` BEFORE it ever reaches `useInput`. That makes every screen's own ctrl+c branch\n    // dead code, and \u2014 worse \u2014 it tears down on the CURRENT frame, so `log.done()` freezes the drawn\n    // command list into the scrollback instead of erasing it (Esc, which goes through the screens'\n    // own quit path, erases correctly; Ctrl-C left a corpse). Every screen rendered here already\n    // handles ctrl+c itself, so hand them the key.\n    exitOnCtrlC: false,\n    // Ink's default is `!isInCi && stdout.isTTY`. We drop the isInCi term: a developer with CI\n    // exported in their shell would otherwise get a NON-interactive Ink on a real terminal, and Ink\n    // skips ALL terminal management in that mode \u2014 `beginSuspend` returns before it can drop raw mode\n    // or erase the frame, and `endSuspend` never redraws. Ctrl-Z would hand the shell a raw-mode tty\n    // with a stranded frame and a hidden cursor, and `fg` would come back to nothing. Whether we own\n    // the terminal is a question about the tty, and only about the tty.\n    interactive: Boolean(stdout.isTTY),\n  })\n\n  try {\n    await waitUntilExit()\n  } catch {\n    // Swallow a teardown rejection: the caller reports cancellation via its own\n    // captured sentinel (which stays at its initial value), not via a throw.\n  } finally {\n    if (stdinReaderCount() > 0) {\n      process.stdin.ref()\n    } else {\n      // STOP READING, not just \"stop holding the loop open\". `unref()` answers \"may node exit?\", not\n      // \"is anyone still consuming this fd?\" \u2014 and Ink's teardown only drops its `readable` listener\n      // and unrefs (App.js:136-137). The session shell then spawns the next command with\n      // `stdio: 'inherit'`, so parent and child hold the SAME tty and each keystroke goes to exactly\n      // one of them. Left unpaused, the parent wins often enough to eat the user's Esc; the child then\n      // never cancels, `waitForExit` never resolves, and `childOwnsSigint` (lib/session/run-session)\n      // swallows every Ctrl-C that follows. That is the \"Esc worked, then nothing does\" wedge.\n      //\n      // WHY `pause()` REACHES libuv AT ALL \u2014 it looks inert, and on a generic stream it is. The chain:\n      //   1. `Readable.prototype.pause()` (node internal/streams/readable.js) emits `'pause'` ONLY IF\n      //      `readableFlowing !== false`.\n      //   2. `process.stdin` \u2014 and ONLY `process.stdin`, ONLY on the main thread \u2014 carries a `'pause'`\n      //      listener installed by node's bootstrap (internal/bootstrap/switches/is_main_thread.js:263).\n      //   3. That listener defers to `onpause` (:267), which calls `stdin._handle.readStop()` (:273).\n      // `net.Socket.prototype.pause` never calls `readStop` itself (it does so only under `kBuffer`,\n      // which is unset here), so a harness built on a CONSTRUCTED `tty.ReadStream`, or run in a worker\n      // thread, measures a stream with ZERO `'pause'` listeners and correctly reports no effect. That\n      // is a false negative about a different object, not evidence against this line.\n      //\n      // THE PRECONDITION, AND WHY THIS CALL SITE MEETS IT \u2014 Ink reads via a `readable` listener\n      // (App.js:206, removed at :126), where `readableFlowing === false`, which would fail step 1 and\n      // make this a silent no-op. It does not, because `removeListener('readable')` schedules\n      // `updateReadableListening` on the NEXTTICK queue (clearing flowing to `null`), while this\n      // `finally` runs in the PROMISE MICROTASK behind `await waitUntilExit()` above \u2014 and node drains\n      // nextTick before microtasks. Ink resolves no earlier than it detaches (App.js:126 <- unmount\n      // ink.js:300 <- resolveExitPromise ink.js:580). Measured on a pty: synchronous call => 0 `'pause'`\n      // events, 0 readStops; behind the await => 1 and 1, flowing `null`, 3/3.\n      //\n      // SO: KEEP THIS BEHIND THE `await`. Making it synchronous silently disarms it with every test\n      // still green \u2014 which is what src/tui/__tests__/stdin-pause-semantics.test.ts exists to catch.\n      // Deferring it by a tick is NOT a hardening: `readStop` already lands after the `spawn` in\n      // run-session.ts (pause -> spawn -> readStop) and deferring only widens that window. Verified\n      // against ink 7.1.0; if Ink ever resolves before detaching, this reverts to a no-op.\n      process.stdin.pause()\n    }\n  }\n}\n\n/**\n * Render the command palette and resolve to the chosen command name, or `null`\n * if the user cancels. A Ctrl-Z suspends the job and resolves nothing \u2014 the same\n * palette redraws, filter and all, when the user brings it back with `fg`.\n */\nexport const runCommandPalette = async (items: PaletteItem[]): Promise<string | null> => {\n  let selected: string | null = null\n\n  await renderToStderr(\n    <CommandPalette\n      items={items}\n      onSelect={(name) => {\n        selected = name\n      }}\n      onCancel={() => {\n        selected = null\n      }}\n      // This module is the platform authority: `undefined` tells the palette that suspending is\n      // impossible here, so it neither binds Ctrl-Z nor advertises it in the footer. (`suspendForeground`\n      // guards win32 again on its own \u2014 the palette itself must stay free of `process`.)\n      onSuspend={\n        process.platform === 'win32'\n          ? undefined\n          : () => {\n              suspendForeground()\n            }\n      }\n    />,\n  )\n\n  return selected\n}\n\n/**\n * Render the searchable single-select branch picker and resolve to the chosen\n * value, or `null` if the user cancels.\n */\nexport const runBranchPicker = async (items: BranchPickerItem[]): Promise<string | null> => {\n  let selected: string | null = null\n\n  await renderToStderr(\n    <BranchPicker\n      items={items}\n      onSelect={(value) => {\n        selected = value\n      }}\n      onCancel={() => {\n        selected = null\n      }}\n    />,\n  )\n\n  return selected\n}\n\n/**\n * Render the searchable multi-select branch picker and resolve to the chosen\n * values, or `null` if the user cancels. The captured variable starts as `null`\n * and is only assigned an array in `onSubmit`, so a cancel is distinguishable\n * from an empty submit.\n */\nexport const runBranchMultiPicker = async (\n  items: BranchPickerItem[],\n  opts?: { required?: boolean; allowSelectAll?: boolean },\n): Promise<string[] | null> => {\n  let selected: string[] | null = null\n\n  await renderToStderr(\n    <BranchMultiPicker\n      items={items}\n      required={opts?.required}\n      allowSelectAll={opts?.allowSelectAll}\n      onSubmit={(values) => {\n        selected = values\n      }}\n      onCancel={() => {\n        selected = null\n      }}\n    />,\n  )\n\n  return selected\n}\n", "import { Box, Text, useApp, useInput, useWindowSize } from 'ink'\nimport { useEffect, useState } from 'react'\n\nimport type { BranchPickerItem } from '../../lib/prompts/types'\nimport { useListFilter } from '../hooks/use-list-filter'\nimport { listLayout, paletteWindow } from './palette-window'\n\ninterface BranchMultiPickerProps {\n  items: BranchPickerItem[]\n  /** Called with the selected item values; the app then exits. */\n  onSubmit: (values: string[]) => void\n  /** Called when the user cancels (Esc / Ctrl-C); the app then exits. */\n  onCancel: () => void\n  /** When true (default), Enter with an empty selection is ignored. */\n  required?: boolean\n  /** When true (default), Ctrl-A toggles select-all across all items. */\n  allowSelectAll?: boolean\n}\n\n/**\n * Searchable multi-select branch picker rendered with Ink. Same filter/move/cancel\n * behaviour as `BranchPicker`, plus a selection `Set` keyed by item *value* so the\n * selection survives filter changes. Space toggles the active row; Ctrl-A toggles\n * select-all across all items; Enter submits the selected values.\n *\n * The list is WINDOWED to the terminal height for the same safety reason as the\n * palette and the single picker: an overflowing Ink frame corrupts the cursor and\n * welds later output onto the transcript. See `palette-window.ts`.\n */\nexport const BranchMultiPicker = (props: BranchMultiPickerProps) => {\n  const { items, onSubmit, onCancel, required = true, allowSelectAll = true } = props\n\n  const T = BRANCH_MULTI_PICKER_TEXT\n  const labelWidth = items.reduce((max, item) => {\n    return Math.max(max, item.label.length)\n  }, 0)\n\n  const { exit } = useApp()\n  const { rows } = useWindowSize()\n  const { filtered, activeIndex, query, handleNavigation, clearQuery } = useListFilter(items, filterText)\n  // Selection keyed by value so it persists across filter changes.\n  const [selected, setSelected] = useState<Set<string>>(() => {\n    return new Set()\n  })\n  const [showRequiredHint, setShowRequiredHint] = useState(false)\n  // First branch in the visible window; kept in state so the list scrolls by the minimum needed.\n  const [windowStart, setWindowStart] = useState(0)\n  // When set, the component renders `null` for one frame so Ink erases the list\n  // before unmount commits its final frame.\n  const [submitted, setSubmitted] = useState(false)\n\n  // Exit only after the empty frame has committed, so the list is wiped first.\n  useEffect(() => {\n    if (submitted) {\n      exit()\n    }\n  }, [submitted, exit])\n\n  // The extra chrome row is this screen's `select at least one` hint: counted unconditionally, because\n  // it appears on a keystroke and a budget that shrinks mid-frame is a budget that overflows.\n  const layout = listLayout(rows, 1)\n  // No `groupOf`: a branch list has no headers, so every branch costs exactly one row.\n  const view = paletteWindow(filtered, windowStart, activeIndex, rows, { chromeRows: layout.chromeRows })\n\n  // Commit the scroll position once the frame that used it has rendered.\n  useEffect(() => {\n    if (view.start !== windowStart) {\n      setWindowStart(view.start)\n    }\n  }, [view.start, windowStart])\n\n  const toggleValue = (value: string) => {\n    setSelected((prev) => {\n      const next = new Set(prev)\n\n      if (next.has(value)) {\n        next.delete(value)\n      } else {\n        next.add(value)\n      }\n\n      return next\n    })\n  }\n\n  const toggleSelectAll = () => {\n    setSelected((prev) => {\n      // Clear only when every item (all, not just filtered) is already selected.\n      const allSelected = items.every((item) => {\n        return prev.has(item.value)\n      })\n\n      if (allSelected) {\n        return new Set()\n      }\n\n      return new Set(\n        items.map((item) => {\n          return item.value\n        }),\n      )\n    })\n  }\n\n  const cancel = () => {\n    onCancel()\n    setSubmitted(true)\n  }\n\n  const submit = () => {\n    if (required && selected.size === 0) {\n      setShowRequiredHint(true)\n\n      return\n    }\n\n    onSubmit([...selected])\n    setSubmitted(true)\n  }\n\n  useInput((input, key) => {\n    if (submitted) {\n      return\n    }\n\n    if (key.ctrl && input === 'c') {\n      cancel()\n\n      return\n    }\n\n    // Esc pops the innermost stateful thing: the typed filter first, the picker only once\n    // there is no filter left to clear. It never touches `selected` \u2014 a filter keystroke is\n    // not a selection, so clearing one must not discard the other. Stage 2 discards it, as before.\n    if (key.escape) {\n      if (!clearQuery()) {\n        cancel()\n      }\n\n      return\n    }\n\n    if (key.ctrl && input === 'a') {\n      if (allowSelectAll) {\n        toggleSelectAll()\n      }\n\n      return\n    }\n\n    if (input === ' ') {\n      const active = filtered[activeIndex]\n\n      if (active) {\n        toggleValue(active.value)\n      }\n\n      return\n    }\n\n    if (key.return) {\n      submit()\n\n      return\n    }\n\n    handleNavigation(input, key)\n  })\n\n  // Final frame: render nothing so Ink erases the list on its way out.\n  if (submitted) {\n    return null\n  }\n\n  // Too short for even one branch row plus a prompt. One truncated line always fits.\n  if (layout.mode === 'tiny') {\n    return (\n      <Text dimColor wrap=\"truncate\">\n        {T.tiny}\n      </Text>\n    )\n  }\n\n  return (\n    <Box flexDirection=\"column\">\n      {layout.mode === 'full' ? (\n        <Text dimColor wrap=\"truncate\">\n          {T.hint}\n        </Text>\n      ) : null}\n      <Box>\n        <Text color=\"cyan\">{T.prompt}</Text>\n        {/* truncate-START: overflow must eat the head of the filter, never the character being typed. */}\n        <Text wrap=\"truncate-start\">{query}</Text>\n      </Box>\n      <Box flexDirection=\"column\" marginTop={layout.mode === 'full' ? 1 : 0}>\n        {filtered.length === 0 ? (\n          <Text dimColor wrap=\"truncate\">\n            {T.empty}\n          </Text>\n        ) : null}\n        {view.hiddenBefore > 0 ? <Text dimColor wrap=\"truncate\">{`${T.more} ${view.hiddenBefore} above`}</Text> : null}\n        {view.visible.map((item, position) => {\n          const isActive = view.start + position === activeIndex\n          const isChecked = selected.has(item.value)\n\n          // `wrap=\"truncate\"` keeps one branch = one row at any width. Ink reads the wrap style off the\n          // OUTER <Text> only, so it must live here, not on the nested description.\n          return (\n            <Text color={isActive ? 'green' : undefined} key={item.value} wrap=\"truncate\">\n              {isActive ? '\u203A ' : '  '}\n              {isChecked ? '[x] ' : '[ ] '}\n              {item.label.padEnd(labelWidth)} <Text dimColor>{item.description ?? ''}</Text>\n            </Text>\n          )\n        })}\n        {view.hiddenAfter > 0 ? <Text dimColor wrap=\"truncate\">{`${T.more} ${view.hiddenAfter} below`}</Text> : null}\n      </Box>\n      {showRequiredHint ? (\n        <Text dimColor wrap=\"truncate\">\n          {T.requiredHint}\n        </Text>\n      ) : null}\n    </Box>\n  )\n}\n\nfunction filterText(item: BranchPickerItem): string {\n  return `${item.label} ${item.description ?? ''}`\n}\n\n/**\n * Static screen copy. Module-scoped and exported so the hint-width guard can measure it:\n * these strings render under `wrap=\"truncate\"`, so a hint of \u226580 columns silently loses\n * its tail at the common terminal width \u2014 and the tail is where the Esc hint lives.\n */\nexport const BRANCH_MULTI_PICKER_TEXT = {\n  hint: 'filter \u00B7 \u2191\u2193 move \u00B7 Space toggle \u00B7 Ctrl-A all \u00B7 Enter submit \u00B7 Esc clear/cancel',\n  prompt: '\u276F ',\n  empty: 'No matching branches',\n  tiny: 'terminal too short \u2014 resize to pick branches',\n  requiredHint: 'select at least one',\n  more: '\u2026',\n}\n", "import type { Key } from 'ink'\nimport { useMemo, useState } from 'react'\n\ninterface ListFilter<T> {\n  /** Items matching the current query (all items when the query is empty). */\n  filtered: T[]\n  /** Active row index, always clamped into `filtered`'s bounds. */\n  activeIndex: number\n  /** Current filter query. */\n  query: string\n  /**\n   * Handle the shared navigation/filter keys (\u2191\u2193 wrap-around, backspace/delete,\n   * printable chars). Returns true when the key was consumed so the caller can\n   * `return` early; false leaves the key for the component's own handlers.\n   */\n  handleNavigation: (input: string, key: Key) => boolean\n  /**\n   * Stage 1 of the Esc ladder: clears a non-empty query (back to the first row) and\n   * returns true. Returns false when the query is already empty \u2014 the boolean IS the\n   * ladder, and a false tells the caller there is nothing left to cancel but the screen.\n   *\n   * Deliberately NOT folded into `handleNavigation`: the two pickers want different\n   * stage-2 actions, so the escape branch belongs to each screen, not to the shared handler.\n   */\n  clearQuery: () => boolean\n}\n\n/**\n * Shared list-filter state for the branch pickers: substring filtering,\n * wrap-around \u2191\u2193 movement, and query editing. Extracted so each `useInput`\n * handler stays under the sonarjs cognitive-complexity \u226415 gate.\n */\nexport const useListFilter = <T>(items: T[], toText: (item: T) => string): ListFilter<T> => {\n  const [query, setQuery] = useState('')\n  const [index, setIndex] = useState(0)\n\n  const filtered = useMemo(() => {\n    const q = query.trim().toLowerCase()\n\n    if (!q) {\n      return items\n    }\n\n    return items.filter((item) => {\n      return toText(item).toLowerCase().includes(q)\n    })\n  }, [items, query, toText])\n\n  const activeIndex = Math.min(index, Math.max(0, filtered.length - 1))\n\n  const handleNavigation = (input: string, key: Key): boolean => {\n    const n = filtered.length\n\n    if (key.upArrow) {\n      // `+ n` sidesteps JS negative modulo (e.g. -1 % 5 === -1, not 4).\n      if (n > 0) {\n        setIndex((activeIndex - 1 + n) % n)\n      }\n\n      return true\n    }\n\n    if (key.downArrow) {\n      if (n > 0) {\n        setIndex((activeIndex + 1) % n)\n      }\n\n      return true\n    }\n\n    if (key.backspace || key.delete) {\n      setQuery(query.slice(0, -1))\n      setIndex(0)\n\n      return true\n    }\n\n    // Printable character: append to the filter and reset to the first row.\n    if (input && !key.ctrl && !key.meta) {\n      setQuery(query + input)\n      setIndex(0)\n\n      return true\n    }\n\n    return false\n  }\n\n  const clearQuery = (): boolean => {\n    if (!query) {\n      return false\n    }\n\n    setQuery('')\n    setIndex(0)\n\n    return true\n  }\n\n  return { filtered, activeIndex, query, handleNavigation, clearQuery }\n}\n", "/**\n * @fileoverview\n *\n * Pure viewport arithmetic shared by every Ink list screen (the command palette and both branch\n * pickers): which slice of the (already filtered) list fits the terminal, and how much chrome the\n * screen may spend around it.\n *\n * This is a SAFETY guard, not a readability one. Ink's cleanup walks the cursor upward one line at a\n * time (`ESC[2K ESC[1A` per row) and `ESC[1A` SATURATES AT ROW 0. So the moment a frame is taller than\n * the viewport, the terminal scrolls while Ink draws, the upward walk erases the wrong rows, and the\n * cursor is left parked ABOVE live content \u2014 after which every later write (the session's status\n * footer, the next palette frame) is deposited on top of the transcript. That is the \"welded rows\" bug:\n * `\u276F ` printed over the head of `ERROR: \u2026`, leaving `ROR: \u2026` behind.\n *\n * The invariant this module exists to enforce, for every (columns, rows):\n *\n *     rendered frame height  <  terminal rows\n *\n * Hold that, and Ink never takes its overflow path: `clearTerminal` never fires, `eraseLines` never\n * saturates, the cursor stays below the transcript, and a fresh (cold) Ink instance \u2014 which erases\n * NOTHING before its first frame \u2014 simply appends below the transcript like any other CLI. No new\n * escape bytes required.\n *\n * Two things make the row count knowable at all:\n *   - Every list row is rendered `wrap=\"truncate\"`, so one item is always exactly one row. Without that\n *     a long description wraps to two rows and this arithmetic silently under-counts (Ink wraps text\n *     itself and measures the WRAPPED height, so it, not us, would be right).\n *   - Chrome is counted unconditionally, even when a given row is not drawn (see `CHROME_ROWS`). Over-\n *     counting shrinks the list; under-counting overflows. Only one of those is a bug.\n *\n * `src/tui/safe-stderr.ts` (the `ESC[3J` byte filter) remains the last-resort backstop for the case\n * this cannot cover \u2014 a SIGWINCH that invalidates a frame's height retroactively.\n */\nimport type { PaletteItem } from '../types'\n\n/**\n * Reads an item's group label. Omitted by the branch pickers, whose lists have no headers at all.\n * (Passed as an accessor rather than constrained with a `{ group?: string }` marker interface: a type\n * whose properties are ALL optional is \"weak\", and TypeScript refuses to match a `BranchPickerItem`\n * against it \u2014 inference silently falls back to the constraint and every field access breaks.)\n */\nexport type GroupOf<T> = (item: T) => string | undefined\n\n/** The slice to render, plus how many rows fell off each end (for the `\u2026 n more` affordances). */\nexport interface ListWindow<T> {\n  visible: T[]\n  /** Index the window starts at \u2014 the component stores it so the list does not jump between frames. */\n  start: number\n  hiddenBefore: number\n  hiddenAfter: number\n}\n\n/** Back-compat alias: the command palette's window is a window of `PaletteItem`s. */\nexport type PaletteWindow = ListWindow<PaletteItem>\n\n/**\n * Rows a screen spends on everything that is not a list row, counted UNCONDITIONALLY (a `\u2026 n above`\n * that is not drawn today may be drawn on the next keystroke, and re-deriving the budget mid-frame is\n * how you get an off-by-one that only bites on a full list):\n *   hint, `\u276F` prompt, the list's `marginTop`, `\u2026 n above`, `\u2026 n below`, and one row of headroom.\n *\n * The headroom row is what makes the frame strictly SHORTER than the viewport: Ink treats a frame\n * exactly as tall as the terminal as fullscreen and clears the screen.\n */\nexport const CHROME_ROWS = 6\n\n/** Compact chrome: the hint and the list's `marginTop` are dropped. Prompt + affordances + headroom. */\nexport const COMPACT_CHROME_ROWS = 4\n\n/** Below this many rows a screen drops its hint, its `marginTop`, and its group headers. */\nexport const COMPACT_BELOW_ROWS = 10\n\n/** Below this many rows no usable list fits at all; the screen renders a single-line notice instead. */\nexport const TINY_BELOW_ROWS = 5\n\n/** How a screen must lay itself out to keep its frame shorter than `rows`. */\nexport type ListLayoutMode = 'full' | 'compact' | 'tiny'\n\nexport interface ListLayout {\n  mode: ListLayoutMode\n  /** Rows reserved for chrome. Pass to `paletteWindow` as `chromeRows`. */\n  chromeRows: number\n  /** Whether group headers may be drawn (they cost a row each, so a compact frame drops them). */\n  groups: boolean\n}\n\n/** A list with no group headers: every item costs exactly one row. */\nconst NO_GROUPS = (): undefined => {\n  return undefined\n}\n\n/**\n * The layout a screen must use at this terminal height. `extraChromeRows` is for chrome a screen has\n * that the others do not \u2014 the multi-picker's `select at least one` hint is the only one today.\n *\n * A `tiny` frame is one truncated line, which is strictly shorter than any terminal of 2+ rows. (At\n * `rows === 1` nothing can be shorter than the viewport; Ink will clear. That is a degenerate terminal,\n * and `safe-stderr` keeps even that harmless.)\n *\n * @example\n * listLayout(24)    // => { mode: 'full',    chromeRows: 6, groups: true }\n * listLayout(8)     // => { mode: 'compact', chromeRows: 4, groups: false }\n * listLayout(8, 1)  // => { mode: 'compact', chromeRows: 5, groups: false }  (multi-picker)\n * listLayout(4)     // => { mode: 'tiny',    chromeRows: 0, groups: false }\n */\nexport const listLayout = (rows: number, extraChromeRows = 0): ListLayout => {\n  if (rows < TINY_BELOW_ROWS) {\n    return { mode: 'tiny', chromeRows: 0, groups: false }\n  }\n\n  if (rows < COMPACT_BELOW_ROWS) {\n    return { mode: 'compact', chromeRows: COMPACT_CHROME_ROWS + extraChromeRows, groups: false }\n  }\n\n  return { mode: 'full', chromeRows: CHROME_ROWS + extraChromeRows, groups: true }\n}\n\n/**\n * How many rows rendering `items[start..end)` costs: one per item (guaranteed by `wrap=\"truncate\"`),\n * plus, when `groups` is on, one for each group header and one for the blank line between groups (the\n * first rendered group gets a header but no blank \u2014 it mirrors the `showGroup && position > 0` rule in\n * the components). A list whose items carry no `group` never spends a header row.\n */\nconst heightOf = <T>(items: T[], start: number, end: number, groupOf: GroupOf<T>): number => {\n  let height = 0\n  let previousGroup: string | undefined\n\n  for (let index = start; index < end; index += 1) {\n    const item = items[index]\n\n    if (!item) break\n\n    const group = groupOf(item)\n    const startsGroup = group !== undefined && group !== previousGroup\n\n    height += 1 + (startsGroup ? 1 : 0) + (startsGroup && index > start ? 1 : 0)\n    previousGroup = group\n  }\n\n  return height\n}\n\n/** The last index (exclusive) that still fits `budget` rows when rendering from `start`. */\nconst endThatFits = <T>(items: T[], start: number, budget: number, groupOf: GroupOf<T>): number => {\n  let end = start\n\n  while (end < items.length && heightOf(items, start, end + 1, groupOf) <= budget) {\n    end += 1\n  }\n\n  return end\n}\n\n/**\n * The window of items to render: the largest slice starting at or after `start` that fits the terminal\n * while still containing `activeIndex`. Scrolls by the minimum needed \u2014 the caller keeps `start` in\n * state, so the list only moves when the cursor would otherwise leave the window.\n *\n * An empty `visible` is a legitimate result on a terminal too short to hold even one row. It is NOT\n * clamped up to one item: forcing a row that does not fit is exactly how the frame overflows and the\n * cursor corruption starts. A screen that gets nothing back renders its `tiny` notice instead \u2014 see\n * `listLayout`.\n *\n * @example\n * const window = paletteWindow(items, 0, 12, 24)\n * window.visible.length // => however many commands fit 18 rows\n * window.hiddenAfter    // => the rest, surfaced as '\u2026 n below'\n */\nexport const paletteWindow = <T>(\n  items: T[],\n  start: number,\n  activeIndex: number,\n  rows: number,\n  opts?: { chromeRows?: number; groupOf?: GroupOf<T> },\n): ListWindow<T> => {\n  const groupOf = opts?.groupOf ?? NO_GROUPS\n  const budget = Math.max(0, rows - (opts?.chromeRows ?? CHROME_ROWS))\n\n  // Scroll up only if the cursor moved above the window; otherwise scroll down just far enough.\n  let first = Math.min(start, activeIndex)\n\n  while (activeIndex >= endThatFits(items, first, budget, groupOf) && first < activeIndex) {\n    first += 1\n  }\n\n  const end = endThatFits(items, first, budget, groupOf)\n\n  return {\n    visible: items.slice(first, end),\n    start: first,\n    hiddenBefore: first,\n    hiddenAfter: Math.max(0, items.length - end),\n  }\n}\n", "import { Box, Text, useApp, useInput, useWindowSize } from 'ink'\nimport { useEffect, useState } from 'react'\n\nimport type { BranchPickerItem } from '../../lib/prompts/types'\nimport { useListFilter } from '../hooks/use-list-filter'\nimport { listLayout, paletteWindow } from './palette-window'\n\ninterface BranchPickerProps {\n  items: BranchPickerItem[]\n  /** Called with the chosen item's value; the app then exits. */\n  onSelect: (value: string) => void\n  /** Called when the user cancels (Esc / Ctrl-C); the app then exits. */\n  onCancel: () => void\n}\n\n/**\n * Searchable single-select branch picker rendered with Ink. Mirrors\n * `CommandPalette` minus the group headers: type-to-filter over label +\n * description, \u2191\u2193 wrap-around, Enter selects the active item's *value*.\n *\n * Like the palette, the list is WINDOWED to the terminal height. That is a safety\n * requirement, not a nicety: a repo with ~20 open releases produced a frame taller\n * than an 80x24 window, and an overflowing Ink frame corrupts the cursor and welds\n * the next frame onto the command's own output. See `palette-window.ts`.\n */\nexport const BranchPicker = (props: BranchPickerProps) => {\n  const { items, onSelect, onCancel } = props\n\n  const T = BRANCH_PICKER_TEXT\n  const labelWidth = items.reduce((max, item) => {\n    return Math.max(max, item.label.length)\n  }, 0)\n\n  const { exit } = useApp()\n  const { rows } = useWindowSize()\n  const { filtered, activeIndex, query, handleNavigation, clearQuery } = useListFilter(items, filterText)\n  // First branch in the visible window; kept in state so the list scrolls by the minimum needed.\n  const [windowStart, setWindowStart] = useState(0)\n  // When set, the component renders `null` for one frame so Ink erases the list\n  // before unmount commits its final frame.\n  const [submitted, setSubmitted] = useState(false)\n\n  // Exit only after the empty frame has committed, so the list is wiped first.\n  useEffect(() => {\n    if (submitted) {\n      exit()\n    }\n  }, [submitted, exit])\n\n  const layout = listLayout(rows)\n  // No `groupOf`: a branch list has no headers, so every branch costs exactly one row.\n  const view = paletteWindow(filtered, windowStart, activeIndex, rows, { chromeRows: layout.chromeRows })\n\n  // Commit the scroll position once the frame that used it has rendered.\n  useEffect(() => {\n    if (view.start !== windowStart) {\n      setWindowStart(view.start)\n    }\n  }, [view.start, windowStart])\n\n  const cancel = () => {\n    onCancel()\n    setSubmitted(true)\n  }\n\n  useInput((input, key) => {\n    if (submitted) {\n      return\n    }\n\n    if (key.ctrl && input === 'c') {\n      cancel()\n\n      return\n    }\n\n    // Esc pops the innermost stateful thing: a typed filter first, the picker only once\n    // there is no filter left to clear. `clearQuery` returning false IS that ladder.\n    if (key.escape) {\n      if (!clearQuery()) {\n        cancel()\n      }\n\n      return\n    }\n\n    if (key.return) {\n      const selected = filtered[activeIndex]\n\n      if (selected) {\n        onSelect(selected.value)\n        setSubmitted(true)\n      }\n\n      return\n    }\n\n    handleNavigation(input, key)\n  })\n\n  // Final frame: render nothing so Ink erases the list on its way out.\n  if (submitted) {\n    return null\n  }\n\n  // Too short for even one branch row plus a prompt. One truncated line always fits.\n  if (layout.mode === 'tiny') {\n    return (\n      <Text dimColor wrap=\"truncate\">\n        {T.tiny}\n      </Text>\n    )\n  }\n\n  return (\n    <Box flexDirection=\"column\">\n      {layout.mode === 'full' ? (\n        <Text dimColor wrap=\"truncate\">\n          {T.hint}\n        </Text>\n      ) : null}\n      <Box>\n        <Text color=\"cyan\">{T.prompt}</Text>\n        {/* truncate-START: overflow must eat the head of the filter, never the character being typed. */}\n        <Text wrap=\"truncate-start\">{query}</Text>\n      </Box>\n      <Box flexDirection=\"column\" marginTop={layout.mode === 'full' ? 1 : 0}>\n        {filtered.length === 0 ? (\n          <Text dimColor wrap=\"truncate\">\n            {T.empty}\n          </Text>\n        ) : null}\n        {view.hiddenBefore > 0 ? <Text dimColor wrap=\"truncate\">{`${T.more} ${view.hiddenBefore} above`}</Text> : null}\n        {view.visible.map((item, position) => {\n          const isActive = view.start + position === activeIndex\n\n          // `wrap=\"truncate\"` keeps one branch = one row at any width (a long branch name would\n          // otherwise wrap and make the frame taller than this component believes). Ink reads the wrap\n          // style off the OUTER <Text> only, so it must live here, not on the nested description.\n          return (\n            <Text color={labelColor(item.type, isActive)} key={item.value} wrap=\"truncate\">\n              {isActive ? '\u203A ' : '  '}\n              {item.label.padEnd(labelWidth)} <Text dimColor>{item.description ?? ''}</Text>\n            </Text>\n          )\n        })}\n        {view.hiddenAfter > 0 ? <Text dimColor wrap=\"truncate\">{`${T.more} ${view.hiddenAfter} below`}</Text> : null}\n      </Box>\n    </Box>\n  )\n}\n\n/**\n * Colour for a row's label, derived from the release type. Kept a plain lookup so\n * an unknown/absent type simply falls through to the default (green when active).\n */\nfunction labelColor(type: string | undefined, isActive: boolean): string | undefined {\n  if (type === 'hotfix') {\n    return 'red'\n  }\n\n  return isActive ? 'green' : undefined\n}\n\nfunction filterText(item: BranchPickerItem): string {\n  return `${item.label} ${item.description ?? ''}`\n}\n\n/**\n * Static screen copy. Module-scoped and exported so the hint-width guard can measure it:\n * these strings render under `wrap=\"truncate\"`, so a hint of \u226580 columns silently loses\n * its tail at the common terminal width \u2014 and the tail is where the Esc hint lives.\n */\nexport const BRANCH_PICKER_TEXT = {\n  hint: 'type to filter \u00B7 \u2191\u2193 move \u00B7 Enter select \u00B7 Esc clear/cancel',\n  prompt: '\u276F ',\n  empty: 'No matching branches',\n  tiny: 'terminal too short \u2014 resize to pick a branch',\n  more: '\u2026',\n}\n", "import { Box, Text, useApp, useInput, useWindowSize } from 'ink'\nimport { useEffect, useMemo, useState } from 'react'\n\nimport type { PaletteItem } from '../types'\nimport { listLayout, paletteWindow } from './palette-window'\n\ninterface CommandPaletteProps {\n  items: PaletteItem[]\n  /** Called with the chosen command name; the app then exits. */\n  onSelect: (name: string) => void\n  /** Called when the user cancels (Ctrl-C / Ctrl-D); the app then exits. Esc never reaches this. */\n  onCancel: () => void\n  /**\n   * Stop the foreground job (Ctrl-Z). ABSENT means suspend is impossible on this platform \u2014 the\n   * palette stays pure presentation and never inspects `process`; boot.tsx is the platform authority.\n   */\n  onSuspend?: () => void\n}\n\n/**\n * Fuzzy-ish command picker rendered with Ink. Pure presentation: it receives a\n * flat list of commands (already grouped/ordered by the catalog) and returns the\n * selected name. It never executes anything \u2014 the caller runs the command via\n * the existing Commander path.\n *\n * NOTE: this component sits at exactly the sonarjs cognitive-complexity ceiling (15). Any `if` or\n * `?:` added to its BODY breaks `pnpm run qa` \u2014 which is why the hint is picked by the module-scope\n * `hintFor` below and the control keys by `handleCtrlKey`, rather than inline.\n */\nexport const CommandPalette = (props: CommandPaletteProps) => {\n  const { items, onSelect, onCancel, onSuspend } = props\n\n  const T = {\n    hint: hintFor(Boolean(onSuspend)),\n    prompt: '\u276F ',\n    empty: 'No matching commands',\n    tiny: 'terminal too short \u2014 resize to pick a command',\n    more: '\u2026',\n  }\n  const nameWidth = 24\n\n  const { exit, suspendTerminal } = useApp()\n  const { rows } = useWindowSize()\n  const [query, setQuery] = useState('')\n  const [index, setIndex] = useState(0)\n  // First command in the visible window. Kept in state so the list scrolls by the minimum needed\n  // instead of jumping every time the cursor moves.\n  const [windowStart, setWindowStart] = useState(0)\n  // When set, the component renders `null` for one frame so Ink erases the list\n  // before unmount commits its final frame (Ink's `log.done()` would otherwise\n  // freeze the last drawn frame \u2014 the command list \u2014 into the scrollback).\n  const [submitted, setSubmitted] = useState(false)\n\n  // Exit only after the empty frame has committed, so the list is wiped first.\n  useEffect(() => {\n    if (submitted) {\n      exit()\n    }\n  }, [submitted, exit])\n\n  const filtered = useMemo(() => {\n    const q = query.trim().toLowerCase()\n\n    if (!q) {\n      return items\n    }\n\n    return items.filter((item) => {\n      return `${item.name} ${item.description}`.toLowerCase().includes(q)\n    })\n  }, [items, query])\n\n  const activeIndex = Math.min(index, Math.max(0, filtered.length - 1))\n\n  // The slice that fits this terminal, and how much chrome we may spend around it. A frame taller than\n  // the viewport corrupts the cursor (see palette-window.ts) \u2014 every row here is budgeted, and every\n  // row below is `wrap=\"truncate\"` so one command is always exactly one row.\n  const layout = listLayout(rows)\n  const view = paletteWindow(filtered, windowStart, activeIndex, rows, {\n    chromeRows: layout.chromeRows,\n    // A compact frame drops group headers, so they must not be budgeted for either.\n    groupOf: layout.groups\n      ? (item) => {\n          return item.group\n        }\n      : undefined,\n  })\n\n  // Commit the scroll position once the frame that used it has rendered.\n  useEffect(() => {\n    if (view.start !== windowStart) {\n      setWindowStart(view.start)\n    }\n  }, [view.start, windowStart])\n\n  // Back out with nothing picked (Ctrl-C / Ctrl-D). Esc is NOT a caller: it pops the filter only.\n  const quit = () => {\n    onCancel()\n    setSubmitted(true)\n  }\n\n  // Hand the terminal back to the user's shell until they `fg`.\n  //\n  // Ink does all the terminal work for us, in the right order and synchronously: `beginSuspend`\n  // settles pending frames, erases the list, restores the cursor and drops raw mode BEFORE our\n  // callback runs, and on resume `endSuspend` re-arms raw mode and force-redraws THIS SAME LIVE\n  // COMPONENT \u2014 so the typed filter survives the suspend. That is why we must NOT set `submitted`\n  // here: unmounting would throw the query away and give us a blank palette on return.\n  //\n  // The `.catch` is the PRIMARY guard, not a backstop \u2014 never simplify it to `void`. Two 0x1a bytes\n  // in one read chunk (a double-tap) are both already queued in Ink's input loop, and `pauseInput`\n  // only detaches the stdin listener, so the second one still fires \u2014 into a `beginSuspend` that is\n  // already suspended, which throws. Harmless (it throws before flipping its own state, and the first\n  // suspension still unwinds), but the rejection must be caught: `void` would make it an unhandled\n  // rejection that kills the process mid terminal-restore.\n  const suspend = () => {\n    if (!onSuspend) {\n      return\n    }\n\n    suspendTerminal(onSuspend).catch(() => {\n      // See above: a double Ctrl-Z is a no-op, not a crash.\n    })\n  }\n\n  /**\n   * Ctrl-C / Ctrl-Z, hoisted OUT of the `useInput` body. Mandatory, not tidiness: that handler sits at\n   * cognitive complexity 14, and an inline `if (key.ctrl && input === 'z' && onSuspend)` costs +2 \u2014\n   * 16, over the sonarjs ceiling of 15, and `pnpm run qa` goes red.\n   *\n   * The palette's Ctrl-Z is a BYTE (0x1a), not a signal: Ink holds stdin in raw mode, which clears\n   * termios ISIG, so the tty never generates SIGTSTP here at all. We therefore stop the process GROUP\n   * ourselves (kill(0), see ../suspend.ts). The session shell's SIGTSTP handler does the opposite \u2014\n   * it self-stops with raise('SIGSTOP') (lib/session/run-session.ts) \u2014 and that is CORRECT there,\n   * because while a child command holds the foreground the tty is cooked and has already TSTP'd the\n   * whole group, leaving only us to follow. DO NOT UNIFY THE TWO.\n   */\n  const handleCtrlKey = (input: string): boolean => {\n    if (input === 'c') {\n      quit()\n\n      return true\n    }\n\n    // Ctrl-D is the REPL/shell convention for \"end of input\", and it quits exactly like Ctrl-C above.\n    // UNCONDITIONAL, unlike anything Esc does: it ends the session with a filter typed as readily as\n    // without one. It is no longer the key the footer names \u2014 Ctrl-C is, because that is the one a\n    // hand reaches for to abandon a picker \u2014 but a shell user's fingers know this one, so it stays.\n    if (input === 'd') {\n      quit()\n\n      return true\n    }\n\n    if (input === 'z') {\n      suspend()\n\n      return true\n    }\n\n    return false\n  }\n\n  // Move the active row by `delta`, wrapping. The `+ n` sidesteps JS negative modulo\n  // (e.g. -1 % 5 === -1, not 4). No-op on an empty list.\n  const step = (delta: number) => {\n    const n = filtered.length\n\n    if (n > 0) {\n      setIndex((activeIndex + delta + n) % n)\n    }\n  }\n\n  useInput((input, key) => {\n    if (submitted) {\n      return\n    }\n\n    // Ctrl-C quits, Ctrl-Z suspends (see handleCtrlKey). Esc pops one level and this palette has\n    // exactly one \u2014 the filter \u2014 so an empty filter makes it a no-op, NOT a quit. Popping the root\n    // would leave nowhere to land: the session shell has no screen behind the palette, so an Esc that\n    // quit would be a quit wearing a back-out's clothes. Quitting is Ctrl-C / Ctrl-D, and only those.\n    // No emptiness check: clearing an already-empty query is a React no-op.\n    if (key.ctrl && handleCtrlKey(input)) {\n      return\n    }\n\n    if (key.escape) {\n      setQuery('')\n      setIndex(0)\n\n      return\n    }\n\n    if (key.return) {\n      const selected = filtered[activeIndex]\n\n      if (selected) {\n        onSelect(selected.name)\n        setSubmitted(true)\n      }\n\n      return\n    }\n\n    if (key.upArrow) {\n      step(-1)\n\n      return\n    }\n\n    if (key.downArrow) {\n      step(1)\n\n      return\n    }\n\n    if (key.backspace || key.delete) {\n      setQuery(query.slice(0, -1))\n      setIndex(0)\n\n      return\n    }\n\n    // Printable character: append to the filter.\n    if (input && !key.ctrl && !key.meta) {\n      setQuery(query + input)\n      setIndex(0)\n    }\n  })\n\n  // Final frame: render nothing so Ink erases the list on its way out.\n  if (submitted) {\n    return null\n  }\n\n  // Too short for even one command row plus a prompt. One truncated line always fits.\n  if (layout.mode === 'tiny') {\n    return (\n      <Text dimColor wrap=\"truncate\">\n        {T.tiny}\n      </Text>\n    )\n  }\n\n  let lastGroup = ''\n\n  return (\n    <Box flexDirection=\"column\">\n      {layout.mode === 'full' ? (\n        <Text dimColor wrap=\"truncate\">\n          {T.hint}\n        </Text>\n      ) : null}\n      <Box>\n        <Text color=\"cyan\">{T.prompt}</Text>\n        {/* truncate-START on the input: overflow must eat the head of the filter, never the character\n            being typed. */}\n        <Text wrap=\"truncate-start\">{query}</Text>\n      </Box>\n      <Box flexDirection=\"column\" marginTop={layout.mode === 'full' ? 1 : 0}>\n        {filtered.length === 0 ? (\n          <Text dimColor wrap=\"truncate\">\n            {T.empty}\n          </Text>\n        ) : null}\n        {view.hiddenBefore > 0 ? <Text dimColor wrap=\"truncate\">{`${T.more} ${view.hiddenBefore} above`}</Text> : null}\n        {view.visible.map((item, position) => {\n          const isActive = view.start + position === activeIndex\n          const showGroup = layout.groups && item.group !== lastGroup\n\n          lastGroup = item.group\n\n          return (\n            <Box flexDirection=\"column\" key={item.name}>\n              {/* Blank line between groups (not before the first row of the window). */}\n              {showGroup && position > 0 ? <Text> </Text> : null}\n              {showGroup ? <Text color=\"yellow\" wrap=\"truncate\">{`\u2014 ${item.group} \u2014`}</Text> : null}\n              {/* `wrap=\"truncate\"` is load-bearing, not cosmetic: it is what makes \"one command = one\n                  row\" true at any width, which is what keeps the frame shorter than the viewport. Ink\n                  reads the wrap style off the OUTER <Text> only \u2014 it squashes the nested <Text> into\n                  this one's string \u2014 so it must live here. */}\n              <Text color={isActive ? 'green' : undefined} wrap=\"truncate\">\n                {isActive ? '\u203A ' : '  '}\n                {item.name.padEnd(nameWidth)} <Text dimColor>{item.description}</Text>\n              </Text>\n            </Box>\n          )\n        })}\n        {view.hiddenAfter > 0 ? <Text dimColor wrap=\"truncate\">{`${T.more} ${view.hiddenAfter} below`}</Text> : null}\n      </Box>\n    </Box>\n  )\n}\n\n/**\n * Footer copy. Kept out of the component's `T` because picking between the two is a conditional.\n *\n * Exported so the hint-width guard can measure these strings: they render under `wrap=\"truncate\"`,\n * so a hint of \u226580 columns silently loses its TAIL \u2014 and the tail is where the newest keybinding\n * always lands. `Esc clear` is the whole truth, not an abbreviation of one: Esc pops the filter and\n * never quits, so the `quit` beside it is the only advertised way out.\n *\n * That advertised key is Ctrl-C, though Ctrl-D quits identically (see `handleCtrlKey`). Naming only\n * one is a width decision, and Ctrl-C wins it: it is what a hand reaches for to abandon a picker, and\n * it went UNADVERTISED here for as long as the palette existed.\n *\n * The slack this leaves is NOT spendable: restoring `type to filter` to the suspend variant would\n * measure 79 against the guard's `toBeLessThan(80)`, i.e. one column from silently truncating again.\n */\nexport const HINTS = {\n  suspend: 'filter \u00B7 \u2191\u2193 move \u00B7 Enter run \u00B7 Esc clear \u00B7 Ctrl-C quit \u00B7 Ctrl-Z suspend',\n  plain: 'type to filter \u00B7 \u2191\u2193 move \u00B7 Enter run \u00B7 Esc clear \u00B7 Ctrl-C quit',\n}\n\n/**\n * The footer hint, which advertises Ctrl-Z only where suspending is possible.\n *\n * Module scope for two reasons, both load-bearing. It cannot live in the component: a `?:` in\n * `CommandPalette`'s body pushes it from 15 to 16, over the sonarjs cognitive-complexity ceiling. And\n * it cannot sit above the component either: `@wl/component-file-order` pins this file to\n * imports \u2192 props interface \u2192 component with nothing in between. Below is the only legal home.\n *\n * Both strings are SHORTER than the hint they replace, on purpose \u2014 the footer renders with\n * `wrap=\"truncate\"`, so anything longer silently loses its tail on a narrow terminal, and the tail is\n * exactly where a newly-added key would land.\n *\n * @example\n * hintFor(true).includes('Ctrl-Z') // => true\n */\nconst hintFor = (canSuspend: boolean): string => {\n  return canSuspend ? HINTS.suspend : HINTS.plain\n}\n"],
-  "mappings": "yHAAA,OAAS,UAAAA,OAAc,MACvB,OAAOC,MAAa,eCDpB,OAAS,OAAAC,EAAK,QAAAC,EAAM,UAAAC,GAAQ,YAAAC,GAAU,iBAAAC,OAAqB,MAC3D,OAAS,aAAAC,GAAW,YAAAC,MAAgB,QCApC,OAAS,WAAAC,GAAS,YAAAC,OAAgB,QA+B3B,IAAMC,EAAgB,CAAIC,EAAYC,IAA+C,CAC1F,GAAM,CAACC,EAAOC,CAAQ,EAAIL,GAAS,EAAE,EAC/B,CAACM,EAAOC,CAAQ,EAAIP,GAAS,CAAC,EAE9BQ,EAAWT,GAAQ,IAAM,CAC7B,IAAMU,EAAIL,EAAM,KAAK,EAAE,YAAY,EAEnC,OAAKK,EAIEP,EAAM,OAAQQ,GACZP,EAAOO,CAAI,EAAE,YAAY,EAAE,SAASD,CAAC,CAC7C,EALQP,CAMX,EAAG,CAACA,EAAOE,EAAOD,CAAM,CAAC,EAEnBQ,EAAc,KAAK,IAAIL,EAAO,KAAK,IAAI,EAAGE,EAAS,OAAS,CAAC,CAAC,EAmDpE,MAAO,CAAE,SAAAA,EAAU,YAAAG,EAAa,MAAAP,EAAO,iBAjDd,CAACQ,EAAeC,IAAsB,CAC7D,IAAMC,EAAIN,EAAS,OAEnB,OAAIK,EAAI,SAEFC,EAAI,GACNP,GAAUI,EAAc,EAAIG,GAAKA,CAAC,EAG7B,IAGLD,EAAI,WACFC,EAAI,GACNP,GAAUI,EAAc,GAAKG,CAAC,EAGzB,IAGLD,EAAI,WAAaA,EAAI,QACvBR,EAASD,EAAM,MAAM,EAAG,EAAE,CAAC,EAC3BG,EAAS,CAAC,EAEH,IAILK,GAAS,CAACC,EAAI,MAAQ,CAACA,EAAI,MAC7BR,EAASD,EAAQQ,CAAK,EACtBL,EAAS,CAAC,EAEH,IAGF,EACT,EAayD,WAXtC,IACZH,GAILC,EAAS,EAAE,EACXE,EAAS,CAAC,EAEH,IANE,EASyD,CACtE,ECbA,IAAMQ,GAAY,IAAiB,CAEnC,EAgBaC,EAAa,CAACC,EAAcC,EAAkB,IACrDD,EAAO,EACF,CAAE,KAAM,OAAQ,WAAY,EAAG,OAAQ,EAAM,EAGlDA,EAAO,GACF,CAAE,KAAM,UAAW,WAAY,EAAsBC,EAAiB,OAAQ,EAAM,EAGtF,CAAE,KAAM,OAAQ,WAAY,EAAcA,EAAiB,OAAQ,EAAK,EAS3EC,GAAW,CAAIC,EAAYC,EAAeC,EAAaC,IAAgC,CAC3F,IAAIC,EAAS,EACTC,EAEJ,QAASC,EAAQL,EAAOK,EAAQJ,EAAKI,GAAS,EAAG,CAC/C,IAAMC,EAAOP,EAAMM,CAAK,EAExB,GAAI,CAACC,EAAM,MAEX,IAAMC,EAAQL,EAAQI,CAAI,EACpBE,EAAcD,IAAU,QAAaA,IAAUH,EAErDD,GAAU,GAAKK,EAAc,EAAI,IAAMA,GAAeH,EAAQL,EAAQ,EAAI,GAC1EI,EAAgBG,CAClB,CAEA,OAAOJ,CACT,EAGMM,GAAc,CAAIV,EAAYC,EAAeU,EAAgBR,IAAgC,CACjG,IAAID,EAAMD,EAEV,KAAOC,EAAMF,EAAM,QAAUD,GAASC,EAAOC,EAAOC,EAAM,EAAGC,CAAO,GAAKQ,GACvET,GAAO,EAGT,OAAOA,CACT,EAiBaU,EAAgB,CAC3BZ,EACAC,EACAY,EACAhB,EACAiB,IACkB,CAClB,IAAMX,EAAUW,GAAM,SAAWnB,GAC3BgB,EAAS,KAAK,IAAI,EAAGd,GAAQiB,GAAM,YAAc,EAAY,EAG/DC,EAAQ,KAAK,IAAId,EAAOY,CAAW,EAEvC,KAAOA,GAAeH,GAAYV,EAAOe,EAAOJ,EAAQR,CAAO,GAAKY,EAAQF,GAC1EE,GAAS,EAGX,IAAMb,EAAMQ,GAAYV,EAAOe,EAAOJ,EAAQR,CAAO,EAErD,MAAO,CACL,QAASH,EAAM,MAAMe,EAAOb,CAAG,EAC/B,MAAOa,EACP,aAAcA,EACd,YAAa,KAAK,IAAI,EAAGf,EAAM,OAASE,CAAG,CAC7C,CACF,EFhBM,cAAAc,EAaA,QAAAC,MAbA,oBApJC,IAAMC,GAAqBC,GAAkC,CAClE,GAAM,CAAE,MAAAC,EAAO,SAAAC,EAAU,SAAAC,EAAU,SAAAC,EAAW,GAAM,eAAAC,EAAiB,EAAK,EAAIL,EAExEM,EAAIC,GACJC,EAAaP,EAAM,OAAO,CAACQ,EAAKC,IAC7B,KAAK,IAAID,EAAKC,EAAK,MAAM,MAAM,EACrC,CAAC,EAEE,CAAE,KAAAC,CAAK,EAAIC,GAAO,EAClB,CAAE,KAAAC,CAAK,EAAIC,GAAc,EACzB,CAAE,SAAAC,EAAU,YAAAC,EAAa,MAAAC,EAAO,iBAAAC,EAAkB,WAAAC,CAAW,EAAIC,EAAcnB,EAAOoB,EAAU,EAEhG,CAACC,EAAUC,CAAW,EAAIC,EAAsB,IAC7C,IAAI,GACZ,EACK,CAACC,EAAkBC,CAAmB,EAAIF,EAAS,EAAK,EAExD,CAACG,EAAaC,CAAc,EAAIJ,EAAS,CAAC,EAG1C,CAACK,EAAWC,CAAY,EAAIN,EAAS,EAAK,EAGhDO,GAAU,IAAM,CACVF,GACFlB,EAAK,CAET,EAAG,CAACkB,EAAWlB,CAAI,CAAC,EAIpB,IAAMqB,EAASC,EAAWpB,EAAM,CAAC,EAE3BqB,EAAOC,EAAcpB,EAAUY,EAAaX,EAAaH,EAAM,CAAE,WAAYmB,EAAO,UAAW,CAAC,EAGtGD,GAAU,IAAM,CACVG,EAAK,QAAUP,GACjBC,EAAeM,EAAK,KAAK,CAE7B,EAAG,CAACA,EAAK,MAAOP,CAAW,CAAC,EAE5B,IAAMS,EAAeC,GAAkB,CACrCd,EAAae,GAAS,CACpB,IAAMC,EAAO,IAAI,IAAID,CAAI,EAEzB,OAAIC,EAAK,IAAIF,CAAK,EAChBE,EAAK,OAAOF,CAAK,EAEjBE,EAAK,IAAIF,CAAK,EAGTE,CACT,CAAC,CACH,EAEMC,EAAkB,IAAM,CAC5BjB,EAAae,GAESrC,EAAM,MAAOS,GACxB4B,EAAK,IAAI5B,EAAK,KAAK,CAC3B,EAGQ,IAAI,IAGN,IAAI,IACTT,EAAM,IAAKS,GACFA,EAAK,KACb,CACH,CACD,CACH,EAEM+B,EAAS,IAAM,CACnBtC,EAAS,EACT2B,EAAa,EAAI,CACnB,EAEMY,EAAS,IAAM,CACnB,GAAItC,GAAYkB,EAAS,OAAS,EAAG,CACnCI,EAAoB,EAAI,EAExB,MACF,CAEAxB,EAAS,CAAC,GAAGoB,CAAQ,CAAC,EACtBQ,EAAa,EAAI,CACnB,EAoDA,OAlDAa,GAAS,CAACC,EAAOC,IAAQ,CACvB,GAAI,CAAAhB,EAIJ,IAAIgB,EAAI,MAAQD,IAAU,IAAK,CAC7BH,EAAO,EAEP,MACF,CAKA,GAAII,EAAI,OAAQ,CACT1B,EAAW,GACdsB,EAAO,EAGT,MACF,CAEA,GAAII,EAAI,MAAQD,IAAU,IAAK,CACzBvC,GACFmC,EAAgB,EAGlB,MACF,CAEA,GAAII,IAAU,IAAK,CACjB,IAAME,EAAS/B,EAASC,CAAW,EAE/B8B,GACFV,EAAYU,EAAO,KAAK,EAG1B,MACF,CAEA,GAAID,EAAI,OAAQ,CACdH,EAAO,EAEP,MACF,CAEAxB,EAAiB0B,EAAOC,CAAG,EAC7B,CAAC,EAGGhB,EACK,KAILG,EAAO,OAAS,OAEhBnC,EAACkD,EAAA,CAAK,SAAQ,GAAC,KAAK,WACjB,SAAAzC,EAAE,KACL,EAKFR,EAACkD,EAAA,CAAI,cAAc,SAChB,UAAAhB,EAAO,OAAS,OACfnC,EAACkD,EAAA,CAAK,SAAQ,GAAC,KAAK,WACjB,SAAAzC,EAAE,KACL,EACE,KACJR,EAACkD,EAAA,CACC,UAAAnD,EAACkD,EAAA,CAAK,MAAM,OAAQ,SAAAzC,EAAE,OAAO,EAE7BT,EAACkD,EAAA,CAAK,KAAK,iBAAkB,SAAA9B,EAAM,GACrC,EACAnB,EAACkD,EAAA,CAAI,cAAc,SAAS,UAAWhB,EAAO,OAAS,OAAS,EAAI,EACjE,UAAAjB,EAAS,SAAW,EACnBlB,EAACkD,EAAA,CAAK,SAAQ,GAAC,KAAK,WACjB,SAAAzC,EAAE,MACL,EACE,KACH4B,EAAK,aAAe,EAAIrC,EAACkD,EAAA,CAAK,SAAQ,GAAC,KAAK,WAAY,YAAGzC,EAAE,IAAI,IAAI4B,EAAK,YAAY,SAAS,EAAU,KACzGA,EAAK,QAAQ,IAAI,CAACxB,EAAMuC,IAAa,CACpC,IAAMC,EAAWhB,EAAK,MAAQe,IAAajC,EACrCmC,GAAY7B,EAAS,IAAIZ,EAAK,KAAK,EAIzC,OACEZ,EAACiD,EAAA,CAAK,MAAOG,EAAW,QAAU,OAA4B,KAAK,WAChE,UAAAA,EAAW,UAAO,KAClBC,GAAY,OAAS,OACrBzC,EAAK,MAAM,OAAOF,CAAU,EAAE,IAACX,EAACkD,EAAA,CAAK,SAAQ,GAAE,SAAArC,EAAK,aAAe,GAAG,IAHvBA,EAAK,KAIvD,CAEJ,CAAC,EACAwB,EAAK,YAAc,EAAIrC,EAACkD,EAAA,CAAK,SAAQ,GAAC,KAAK,WAAY,YAAGzC,EAAE,IAAI,IAAI4B,EAAK,WAAW,SAAS,EAAU,MAC1G,EACCT,EACC5B,EAACkD,EAAA,CAAK,SAAQ,GAAC,KAAK,WACjB,SAAAzC,EAAE,aACL,EACE,MACN,CAEJ,EAEA,SAASe,GAAWX,EAAgC,CAClD,MAAO,GAAGA,EAAK,KAAK,IAAIA,EAAK,aAAe,EAAE,EAChD,CAOO,IAAMH,GAA2B,CACtC,KAAM,0GACN,OAAQ,UACR,MAAO,uBACP,KAAM,oDACN,aAAc,sBACd,KAAM,QACR,EGnPA,OAAS,OAAA6C,EAAK,QAAAC,EAAM,UAAAC,GAAQ,YAAAC,GAAU,iBAAAC,OAAqB,MAC3D,OAAS,aAAAC,GAAW,YAAAC,OAAgB,QA2G9B,cAAAC,EAaA,QAAAC,MAbA,oBAnFC,IAAMC,GAAgBC,GAA6B,CACxD,GAAM,CAAE,MAAAC,EAAO,SAAAC,EAAU,SAAAC,CAAS,EAAIH,EAEhCI,EAAIC,GACJC,EAAaL,EAAM,OAAO,CAACM,EAAKC,IAC7B,KAAK,IAAID,EAAKC,EAAK,MAAM,MAAM,EACrC,CAAC,EAEE,CAAE,KAAAC,CAAK,EAAIC,GAAO,EAClB,CAAE,KAAAC,CAAK,EAAIC,GAAc,EACzB,CAAE,SAAAC,EAAU,YAAAC,EAAa,MAAAC,EAAO,iBAAAC,EAAkB,WAAAC,CAAW,EAAIC,EAAcjB,EAAOkB,EAAU,EAEhG,CAACC,EAAaC,CAAc,EAAIC,GAAS,CAAC,EAG1C,CAACC,EAAWC,CAAY,EAAIF,GAAS,EAAK,EAGhDG,GAAU,IAAM,CACVF,GACFd,EAAK,CAET,EAAG,CAACc,EAAWd,CAAI,CAAC,EAEpB,IAAMiB,EAASC,EAAWhB,CAAI,EAExBiB,EAAOC,EAAchB,EAAUO,EAAaN,EAAaH,EAAM,CAAE,WAAYe,EAAO,UAAW,CAAC,EAGtGD,GAAU,IAAM,CACVG,EAAK,QAAUR,GACjBC,EAAeO,EAAK,KAAK,CAE7B,EAAG,CAACA,EAAK,MAAOR,CAAW,CAAC,EAE5B,IAAMU,EAAS,IAAM,CACnB3B,EAAS,EACTqB,EAAa,EAAI,CACnB,EAsCA,OApCAO,GAAS,CAACC,EAAOC,IAAQ,CACvB,GAAI,CAAAV,EAIJ,IAAIU,EAAI,MAAQD,IAAU,IAAK,CAC7BF,EAAO,EAEP,MACF,CAIA,GAAIG,EAAI,OAAQ,CACThB,EAAW,GACda,EAAO,EAGT,MACF,CAEA,GAAIG,EAAI,OAAQ,CACd,IAAMC,EAAWrB,EAASC,CAAW,EAEjCoB,IACFhC,EAASgC,EAAS,KAAK,EACvBV,EAAa,EAAI,GAGnB,MACF,CAEAR,EAAiBgB,EAAOC,CAAG,EAC7B,CAAC,EAGGV,EACK,KAILG,EAAO,OAAS,OAEhB7B,EAACsC,EAAA,CAAK,SAAQ,GAAC,KAAK,WACjB,SAAA/B,EAAE,KACL,EAKFN,EAACsC,EAAA,CAAI,cAAc,SAChB,UAAAV,EAAO,OAAS,OACf7B,EAACsC,EAAA,CAAK,SAAQ,GAAC,KAAK,WACjB,SAAA/B,EAAE,KACL,EACE,KACJN,EAACsC,EAAA,CACC,UAAAvC,EAACsC,EAAA,CAAK,MAAM,OAAQ,SAAA/B,EAAE,OAAO,EAE7BP,EAACsC,EAAA,CAAK,KAAK,iBAAkB,SAAApB,EAAM,GACrC,EACAjB,EAACsC,EAAA,CAAI,cAAc,SAAS,UAAWV,EAAO,OAAS,OAAS,EAAI,EACjE,UAAAb,EAAS,SAAW,EACnBhB,EAACsC,EAAA,CAAK,SAAQ,GAAC,KAAK,WACjB,SAAA/B,EAAE,MACL,EACE,KACHwB,EAAK,aAAe,EAAI/B,EAACsC,EAAA,CAAK,SAAQ,GAAC,KAAK,WAAY,YAAG/B,EAAE,IAAI,IAAIwB,EAAK,YAAY,SAAS,EAAU,KACzGA,EAAK,QAAQ,IAAI,CAACpB,EAAM6B,IAAa,CACpC,IAAMC,EAAWV,EAAK,MAAQS,IAAavB,EAK3C,OACEhB,EAACqC,EAAA,CAAK,MAAOI,GAAW/B,EAAK,KAAM8B,CAAQ,EAAoB,KAAK,WACjE,UAAAA,EAAW,UAAO,KAClB9B,EAAK,MAAM,OAAOF,CAAU,EAAE,IAACT,EAACsC,EAAA,CAAK,SAAQ,GAAE,SAAA3B,EAAK,aAAe,GAAG,IAFtBA,EAAK,KAGxD,CAEJ,CAAC,EACAoB,EAAK,YAAc,EAAI/B,EAACsC,EAAA,CAAK,SAAQ,GAAC,KAAK,WAAY,YAAG/B,EAAE,IAAI,IAAIwB,EAAK,WAAW,SAAS,EAAU,MAC1G,GACF,CAEJ,EAMA,SAASW,GAAWC,EAA0BF,EAAuC,CACnF,OAAIE,IAAS,SACJ,MAGFF,EAAW,QAAU,MAC9B,CAEA,SAASnB,GAAWX,EAAgC,CAClD,MAAO,GAAGA,EAAK,KAAK,IAAIA,EAAK,aAAe,EAAE,EAChD,CAOO,IAAMH,GAAqB,CAChC,KAAM,gFACN,OAAQ,UACR,MAAO,uBACP,KAAM,oDACN,KAAM,QACR,ECnLA,OAAS,OAAAoC,EAAK,QAAAC,EAAM,UAAAC,GAAQ,YAAAC,GAAU,iBAAAC,OAAqB,MAC3D,OAAS,aAAAC,GAAW,WAAAC,GAAS,YAAAC,MAAgB,QA8OvC,cAAAC,EAeA,QAAAC,MAfA,oBAlNC,IAAMC,GAAkBC,GAA+B,CAC5D,GAAM,CAAE,MAAAC,EAAO,SAAAC,EAAU,SAAAC,EAAU,UAAAC,CAAU,EAAIJ,EAE3CK,EAAI,CACR,KAAMC,GAAQ,EAAQF,CAAU,EAChC,OAAQ,UACR,MAAO,uBACP,KAAM,qDACN,KAAM,QACR,EACMG,EAAY,GAEZ,CAAE,KAAAC,EAAM,gBAAAC,CAAgB,EAAIC,GAAO,EACnC,CAAE,KAAAC,CAAK,EAAIC,GAAc,EACzB,CAACC,EAAOC,CAAQ,EAAIC,EAAS,EAAE,EAC/B,CAACC,EAAOC,CAAQ,EAAIF,EAAS,CAAC,EAG9B,CAACG,EAAaC,CAAc,EAAIJ,EAAS,CAAC,EAI1C,CAACK,EAAWC,CAAY,EAAIN,EAAS,EAAK,EAGhDO,GAAU,IAAM,CACVF,GACFZ,EAAK,CAET,EAAG,CAACY,EAAWZ,CAAI,CAAC,EAEpB,IAAMe,EAAWC,GAAQ,IAAM,CAC7B,IAAMC,EAAIZ,EAAM,KAAK,EAAE,YAAY,EAEnC,OAAKY,EAIExB,EAAM,OAAQyB,GACZ,GAAGA,EAAK,IAAI,IAAIA,EAAK,WAAW,GAAG,YAAY,EAAE,SAASD,CAAC,CACnE,EALQxB,CAMX,EAAG,CAACA,EAAOY,CAAK,CAAC,EAEXc,EAAc,KAAK,IAAIX,EAAO,KAAK,IAAI,EAAGO,EAAS,OAAS,CAAC,CAAC,EAK9DK,EAASC,EAAWlB,CAAI,EACxBmB,EAAOC,EAAcR,EAAUL,EAAaS,EAAahB,EAAM,CACnE,WAAYiB,EAAO,WAEnB,QAASA,EAAO,OACXF,GACQA,EAAK,MAEd,MACN,CAAC,EAGDJ,GAAU,IAAM,CACVQ,EAAK,QAAUZ,GACjBC,EAAeW,EAAK,KAAK,CAE7B,EAAG,CAACA,EAAK,MAAOZ,CAAW,CAAC,EAG5B,IAAMc,EAAO,IAAM,CACjB7B,EAAS,EACTkB,EAAa,EAAI,CACnB,EAgBMY,EAAU,IAAM,CACf7B,GAILK,EAAgBL,CAAS,EAAE,MAAM,IAAM,CAEvC,CAAC,CACH,EAcM8B,EAAiBC,GACjBA,IAAU,KAUVA,IAAU,KACZH,EAAK,EAEE,IAGLG,IAAU,KACZF,EAAQ,EAED,IAGF,GAKHG,EAAQC,GAAkB,CAC9B,IAAMC,EAAIf,EAAS,OAEfe,EAAI,GACNrB,GAAUU,EAAcU,EAAQC,GAAKA,CAAC,CAE1C,EA6DA,GA3DAC,GAAS,CAACJ,EAAOK,IAAQ,CACvB,GAAI,CAAApB,GASA,EAAAoB,EAAI,MAAQN,EAAcC,CAAK,GAInC,IAAIK,EAAI,OAAQ,CACd1B,EAAS,EAAE,EACXG,EAAS,CAAC,EAEV,MACF,CAEA,GAAIuB,EAAI,OAAQ,CACd,IAAMC,EAAWlB,EAASI,CAAW,EAEjCc,IACFvC,EAASuC,EAAS,IAAI,EACtBpB,EAAa,EAAI,GAGnB,MACF,CAEA,GAAImB,EAAI,QAAS,CACfJ,EAAK,EAAE,EAEP,MACF,CAEA,GAAII,EAAI,UAAW,CACjBJ,EAAK,CAAC,EAEN,MACF,CAEA,GAAII,EAAI,WAAaA,EAAI,OAAQ,CAC/B1B,EAASD,EAAM,MAAM,EAAG,EAAE,CAAC,EAC3BI,EAAS,CAAC,EAEV,MACF,CAGIkB,GAAS,CAACK,EAAI,MAAQ,CAACA,EAAI,OAC7B1B,EAASD,EAAQsB,CAAK,EACtBlB,EAAS,CAAC,GAEd,CAAC,EAGGG,EACF,OAAO,KAIT,GAAIQ,EAAO,OAAS,OAClB,OACE/B,EAAC6C,EAAA,CAAK,SAAQ,GAAC,KAAK,WACjB,SAAArC,EAAE,KACL,EAIJ,IAAIsC,EAAY,GAEhB,OACE7C,EAAC8C,EAAA,CAAI,cAAc,SAChB,UAAAhB,EAAO,OAAS,OACf/B,EAAC6C,EAAA,CAAK,SAAQ,GAAC,KAAK,WACjB,SAAArC,EAAE,KACL,EACE,KACJP,EAAC8C,EAAA,CACC,UAAA/C,EAAC6C,EAAA,CAAK,MAAM,OAAQ,SAAArC,EAAE,OAAO,EAG7BR,EAAC6C,EAAA,CAAK,KAAK,iBAAkB,SAAA7B,EAAM,GACrC,EACAf,EAAC8C,EAAA,CAAI,cAAc,SAAS,UAAWhB,EAAO,OAAS,OAAS,EAAI,EACjE,UAAAL,EAAS,SAAW,EACnB1B,EAAC6C,EAAA,CAAK,SAAQ,GAAC,KAAK,WACjB,SAAArC,EAAE,MACL,EACE,KACHyB,EAAK,aAAe,EAAIjC,EAAC6C,EAAA,CAAK,SAAQ,GAAC,KAAK,WAAY,YAAGrC,EAAE,IAAI,IAAIyB,EAAK,YAAY,SAAS,EAAU,KACzGA,EAAK,QAAQ,IAAI,CAACJ,EAAMmB,IAAa,CACpC,IAAMC,EAAWhB,EAAK,MAAQe,IAAalB,EACrCoB,EAAYnB,EAAO,QAAUF,EAAK,QAAUiB,EAElD,OAAAA,EAAYjB,EAAK,MAGf5B,EAAC8C,EAAA,CAAI,cAAc,SAEhB,UAAAG,GAAaF,EAAW,EAAIhD,EAAC6C,EAAA,CAAK,aAAC,EAAU,KAC7CK,EAAYlD,EAAC6C,EAAA,CAAK,MAAM,SAAS,KAAK,WAAY,mBAAKhB,EAAK,KAAK,UAAK,EAAU,KAKjF5B,EAAC4C,EAAA,CAAK,MAAOI,EAAW,QAAU,OAAW,KAAK,WAC/C,UAAAA,EAAW,UAAO,KAClBpB,EAAK,KAAK,OAAOnB,CAAS,EAAE,IAACV,EAAC6C,EAAA,CAAK,SAAQ,GAAE,SAAAhB,EAAK,YAAY,GACjE,IAX+BA,EAAK,IAYtC,CAEJ,CAAC,EACAI,EAAK,YAAc,EAAIjC,EAAC6C,EAAA,CAAK,SAAQ,GAAC,KAAK,WAAY,YAAGrC,EAAE,IAAI,IAAIyB,EAAK,WAAW,SAAS,EAAU,MAC1G,GACF,CAEJ,EAiBakB,GAAQ,CACnB,QAAS,mGACT,MAAO,sFACT,EAiBM1C,GAAW2C,GACRA,EAAaD,GAAM,QAAUA,GAAM,MLpNxC,cAAAE,MAAA,oBA5EJ,IAAMC,EAAiB,MAAOC,GAAyC,CACrE,IAAMC,EAASC,GAAW,EACpB,CAAE,cAAAC,CAAc,EAAIC,GAAOJ,EAAS,CACxC,OAAAC,EAOA,YAAa,GAOb,YAAa,EAAQA,EAAO,KAC9B,CAAC,EAED,GAAI,CACF,MAAME,EAAc,CACtB,MAAQ,CAGR,QAAE,CACIE,EAAiB,EAAI,EACvBC,EAAQ,MAAM,IAAI,EAmClBA,EAAQ,MAAM,MAAM,CAExB,CACF,EAOaC,GAAoB,MAAOC,GAAiD,CACvF,IAAIC,EAA0B,KAE9B,aAAMV,EACJD,EAACY,GAAA,CACC,MAAOF,EACP,SAAWG,GAAS,CAClBF,EAAWE,CACb,EACA,SAAU,IAAM,CACdF,EAAW,IACb,EAIA,UACEH,EAAQ,WAAa,QACjB,OACA,IAAM,CACJM,EAAkB,CACpB,EAER,CACF,EAEOH,CACT,EAMaI,GAAkB,MAAOL,GAAsD,CAC1F,IAAIC,EAA0B,KAE9B,aAAMV,EACJD,EAACgB,GAAA,CACC,MAAON,EACP,SAAWO,GAAU,CACnBN,EAAWM,CACb,EACA,SAAU,IAAM,CACdN,EAAW,IACb,EACF,CACF,EAEOA,CACT,EAQaO,GAAuB,MAClCR,EACAS,IAC6B,CAC7B,IAAIR,EAA4B,KAEhC,aAAMV,EACJD,EAACoB,GAAA,CACC,MAAOV,EACP,SAAUS,GAAM,SAChB,eAAgBA,GAAM,eACtB,SAAWE,GAAW,CACpBV,EAAWU,CACb,EACA,SAAU,IAAM,CACdV,EAAW,IACb,EACF,CACF,EAEOA,CACT",
-  "names": ["render", "process", "Box", "Text", "useApp", "useInput", "useWindowSize", "useEffect", "useState", "useMemo", "useState", "useListFilter", "items", "toText", "query", "setQuery", "index", "setIndex", "filtered", "q", "item", "activeIndex", "input", "key", "n", "NO_GROUPS", "listLayout", "rows", "extraChromeRows", "heightOf", "items", "start", "end", "groupOf", "height", "previousGroup", "index", "item", "group", "startsGroup", "endThatFits", "budget", "paletteWindow", "activeIndex", "opts", "first", "jsx", "jsxs", "BranchMultiPicker", "props", "items", "onSubmit", "onCancel", "required", "allowSelectAll", "T", "BRANCH_MULTI_PICKER_TEXT", "labelWidth", "max", "item", "exit", "useApp", "rows", "useWindowSize", "filtered", "activeIndex", "query", "handleNavigation", "clearQuery", "useListFilter", "filterText", "selected", "setSelected", "useState", "showRequiredHint", "setShowRequiredHint", "windowStart", "setWindowStart", "submitted", "setSubmitted", "useEffect", "layout", "listLayout", "view", "paletteWindow", "toggleValue", "value", "prev", "next", "toggleSelectAll", "cancel", "submit", "useInput", "input", "key", "active", "Text", "Box", "position", "isActive", "isChecked", "Box", "Text", "useApp", "useInput", "useWindowSize", "useEffect", "useState", "jsx", "jsxs", "BranchPicker", "props", "items", "onSelect", "onCancel", "T", "BRANCH_PICKER_TEXT", "labelWidth", "max", "item", "exit", "useApp", "rows", "useWindowSize", "filtered", "activeIndex", "query", "handleNavigation", "clearQuery", "useListFilter", "filterText", "windowStart", "setWindowStart", "useState", "submitted", "setSubmitted", "useEffect", "layout", "listLayout", "view", "paletteWindow", "cancel", "useInput", "input", "key", "selected", "Text", "Box", "position", "isActive", "labelColor", "type", "Box", "Text", "useApp", "useInput", "useWindowSize", "useEffect", "useMemo", "useState", "jsx", "jsxs", "CommandPalette", "props", "items", "onSelect", "onCancel", "onSuspend", "T", "hintFor", "nameWidth", "exit", "suspendTerminal", "useApp", "rows", "useWindowSize", "query", "setQuery", "useState", "index", "setIndex", "windowStart", "setWindowStart", "submitted", "setSubmitted", "useEffect", "filtered", "useMemo", "q", "item", "activeIndex", "layout", "listLayout", "view", "paletteWindow", "quit", "suspend", "handleCtrlKey", "input", "step", "delta", "n", "useInput", "key", "selected", "Text", "lastGroup", "Box", "position", "isActive", "showGroup", "HINTS", "canSuspend", "jsx", "renderToStderr", "element", "stdout", "safeStderr", "waitUntilExit", "render", "stdinReaderCount", "process", "runCommandPalette", "items", "selected", "CommandPalette", "name", "suspendForeground", "runBranchPicker", "BranchPicker", "value", "runBranchMultiPicker", "opts", "BranchMultiPicker", "values"]
-}

package/dist/chunk-75BE6MSY.js

@@ -1,7 +0,0 @@
-import{P as h,R as x,_ as A,d as f,f as p,i as b}from"./chunk-H5AAXCRJ.js";import{t as P}from"./chunk-75URROMU.js";import{a as $,b as _}from"./chunk-QWVLAZ6N.js";import g from"node:fs/promises";import u from"node:path";import{z as s}from"zod";var i=class extends Error{env;constructor(r,t=null){super(r),this.name="EnvAuthError",this.env=t}},te=e=>e instanceof i;var H="tokens.json",v=1,D=384,R=448,q=s.object({version:s.literal(v).default(v),envs:s.record(s.string().min(1),s.string().min(1))}).strict(),w=async()=>{let e=await A();return u.join(u.dirname(e.userProject),H)},E=async()=>{let e=await w(),r;try{r=await g.readFile(e,"utf-8")}catch{return null}let t;try{t=JSON.parse(r)}catch(o){throw new i(`Invalid JSON in the token store at ${x(e)}: ${o.message}
-Fix or delete the file, then re-add the token with \`infra-kit env-token-set <env>\`.`)}let n=q.safeParse(t);if(!n.success)throw new i(`Invalid token store at ${x(e)}: ${s.prettifyError(n.error)}
-Fix or delete the file, then re-add the token with \`infra-kit env-token-set <env>\`.`);return n.data},y=async e=>{let r=await w(),t=u.dirname(r),n=u.dirname(t),o=u.dirname(n);for(let c of[o,n,t])await g.mkdir(c,{recursive:!0,mode:R}),await g.chmod(c,R);P(r,`${JSON.stringify(e,null,2)}
-`,D),await g.chmod(r,D)},J=async(e,r)=>{let t=await E();await y({version:v,envs:{...t?.envs,[e]:r}})},K=async e=>{let r=await E();if(!r||!(e in r.envs))return;let t={...r.envs};delete t[e],await y({version:v,envs:t})};var B=()=>{let e="",r=[],t=!1;return{start(n){e=n,r=[],t=!1},setInteractive(){t=!0},addOption(n,o){r.push({flag:n,value:o})},formatOptions(){return r.map(n=>typeof n.value=="boolean"?n.value?n.flag:"":Array.isArray(n.value)?`${n.flag} "${n.value.join(", ")}"`:`${n.flag} "${n.value}"`).filter(Boolean).join(" ")},snapshot(){return r.length===0?null:{formattedOptions:this.formatOptions()}},print(){!t||r.length===0||!e||h.info(`\u{1F4DF} Equivalent command: 
-pnpm exec infra-kit ${e} ${this.formatOptions()}
-`)},reset(){e="",r=[],t=!1}}},S=B();import{isAbsolute as j,resolve as I}from"node:path";import L from"node:process";var O=null,k=null,W=e=>{O=[...e],k=L.cwd()},z=new Set(["--yes","-y"]),U=(e,r)=>{let t=[...e];for(let[n,o]of t.entries())o==="-C"&&t[n+1]!==void 0&&!j(t[n+1])?t[n+1]=I(r,t[n+1]):o.startsWith("-C")&&o.length>2&&!o.startsWith("--")&&!j(o.slice(2))&&(t[n]=`-C${I(r,o.slice(2))}`);return t},C=()=>{if(O===null||k===null)return["--yes"];let e=U(O.slice(2),k);return e.some(t=>z.has(t))?e:[...e,"--yes"]};import M from"node:process";var a=class extends b{structuredContent;exitCode;constructor(r,t,n){super(void 0,n),this.name="StructuredRefusalError",this.structuredContent=r,this.exitCode=t}};var Y=27,G=e=>e==="mcp"?"an interactive prompt was reached under MCP, where stdin carries JSON-RPC":e===null?"an interactive prompt was reached under --json, which never prompts":`an interactive prompt was reached in agent mode (${e==="flag"?"--agent":"INFRA_KIT_AGENT / CLAUDECODE"}), where there is no human to answer it`,V=(e,r)=>{let t=r===void 0?"pass the value explicitly instead of relying on the prompt":`pass --${r}`;return e==="mcp"?r===void 0?`${t} \u2014 MCP runs have no human to answer it`:`pass "${r}" \u2014 MCP runs have no human to answer it`:`${t} on the re-run`},Q=e=>{if(typeof e=="object"&&"value"in e)return e.value;let r=typeof e=="object"?e.refuse:void 0,{source:t}=f;throw new a(r===void 0?{status:"refused",agentMode:t}:{status:"argument_required",argument:r,agentMode:t},2,{operation:"interactive prompt",remediation:V(t,r),stderrExcerpt:G(t)})},N=async(e,r)=>{let t=new AbortController,{whenHeadless:n="refuse",...o}=r??{},c={...o,signal:t.signal};if(p())return Q(n);if(!M.stdin.isTTY)return e(c);let d=M.stdin,T=m=>{m.length===1&&m[0]===Y&&t.abort()};$();try{let m=e(c);return d.isPaused()&&d.resume(),d.on("data",T),await m}finally{d.removeListener("data",T),_()}};import X from"@inquirer/confirm";import Z from"node:process";var l=class extends Error{constructor(r="Operation cancelled by the operator"){super(r),this.name="CommandDeclinedError"}},Pe=e=>e instanceof l;var F=(e,r)=>{let{source:t}=f,n=C();throw new a({status:"confirmation_required",message:e,plan:r,rerun:n,agentMode:t},2,{operation:"confirm before running",remediation:t===null?"pass `--yes` to confirm, or drop `--json` to be prompted":`show the plan to the human, then re-run \`infra-kit ${n.join(" ")}\` to confirm`,stderrExcerpt:"confirmation required and nobody to ask"})},ee=async(e,r,t={})=>{!e&&p()&&F(r,t.plan);let n=e?!0:await N(o=>X({message:r},o),{whenHeadless:"refuse"});if(e||S.setInteractive(),!n){if(t.throwOnDecline)throw new l;h.info("Operation cancelled. Exiting..."),Z.exit(0)}};export{i as a,te as b,w as c,E as d,J as e,K as f,S as g,Pe as h,a as i,W as j,N as k,F as l,ee as m};
-//# sourceMappingURL=chunk-75BE6MSY.js.map

package/dist/chunk-75BE6MSY.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/lib/env-tokens/env-tokens.ts", "../src/lib/errors/env-auth-error.ts", "../src/lib/command-echo/command-echo.ts", "../src/lib/parsed-argv/parsed-argv.ts", "../src/lib/prompts/escapable-context.ts", "../src/lib/errors/structured-refusal-error.ts", "../src/lib/command-echo/confirm-or-exit.ts", "../src/lib/errors/command-declined-error.ts"],
-  "sourcesContent": ["// DEFAULT import, deliberately \u2014 the same reason config-bootstrap.ts documents: the module is used as\n// `fs.readFile(...)` / `fs.mkdir(...)` so every call is a property lookup on the live module object,\n// which is what `vi.spyOn(fs, \u2026)` patches. A named import (`import { readFile }`) is bound at import\n// time and the spy silently does NOT intercept it \u2014 the assertion goes green while the real call\n// still hits disk. Do not \"modernize\" this import.\nimport fs from 'node:fs/promises'\nimport path from 'node:path'\nimport { z } from 'zod'\n\nimport { atomicWriteFileSync } from 'src/lib/constants'\nimport { EnvAuthError } from 'src/lib/errors/env-auth-error'\nimport { getInfraKitConfigPaths } from 'src/lib/infra-kit-config'\nimport { tildify } from 'src/lib/path-display'\n\n/**\n * Basename of the token store. A SIBLING of the layer-3 `infra-kit.json`, never a key inside it:\n * `getInfraKitConfig` only ever globs the three hardcoded `infra-kit.json` paths and its schema is\n * `.strict()`, so an unknown key throws at the LAYER parse and bricks every command on every pinned\n * version. A sibling file is structurally invisible to that loader \u2014 `config-bootstrap.ts` already\n * relies on exactly this for its `.example.jsonc`. That invisibility is the blast-radius guarantee:\n * a corrupt `tokens.json` can only break the readers below, never `worktrees-list`.\n */\nconst TOKEN_STORE_FILE = 'tokens.json'\n\n/** Schema version of the on-disk store. Bump only alongside a migration. */\nconst TOKEN_STORE_VERSION = 1\n\n/** Mode of `tokens.json` itself \u2014 owner read/write only. It holds live credentials. */\nconst TOKEN_FILE_MODE = 0o600\n\n/** Mode of every directory on the way to the store \u2014 owner-only traversal. */\nconst TOKEN_DIR_MODE = 0o700\n\n/**\n * The store's OWN schema: `{ version?: 1, envs: { <env>: <token> } }`. Deliberately NOT derived from\n * `infraKitConfigObject`: this file is not a merge layer, so `.strict()` here is free (a typo is a\n * loud error in three readers, not a bricked CLI).\n */\n// HAND-AUTHORABILITY IS THE CONSTRAINT THIS SHAPE IS CHOSEN FOR, and two earlier fields were\n// dropped for it \u2014 do not re-add either without re-deciding that:\n//\n//  - `version` is OPTIONAL (defaulted to 1) because a store typed by a human carries no version\n//    key, and a store the CLI refuses to read is a store the human cannot write.\n//  - `repoRoot` is GONE, and with it the refusal that compared it against the current checkout.\n//    That guard was real: the store directory is keyed on `path.basename(mainRepoRoot)`, so\n//    `~/work/api` and `~/oss/api` share ONE token directory and repo B could load (and then\n//    overwrite) repo A's credentials. It was removed anyway, knowingly: it also made the CLI refuse\n//    every hand-written store, which carries no such field. Hand-authorability wins; the\n//    basename-collision risk is ACCEPTED. A weakened version of the guard (warn-and-continue, or\n//    \"only check when present\") is NOT the compromise here \u2014 it would re-introduce the same refusal\n//    for anyone who did write the field. If you want the guard back, key the store directory on\n//    something collision-free instead.\nconst tokenStoreSchema = z\n  .object({\n    version: z.literal(TOKEN_STORE_VERSION).default(TOKEN_STORE_VERSION),\n    envs: z.record(z.string().min(1), z.string().min(1)),\n  })\n  .strict()\n\n/** The parsed `tokens.json` shape: `{ version, envs }` \u2014 `version` defaulted to 1 when absent on disk. */\nexport type TokenStore = z.infer<typeof tokenStoreSchema>\n\n/**\n * Absolute path to the per-project token store: `~/.infra-kit/projects/<repo>/tokens.json`.\n *\n * Derived from {@link getInfraKitConfigPaths} rather than re-deriving the home/projects/repo chain \u2014\n * that resolver already keys the directory off the MAIN repo root (so every worktree of a repo shares\n * one store) and memoizes the two `git rev-parse` spawns.\n *\n * @example\n * await getTokenStorePath() // => '/Users/arthur/.infra-kit/projects/infra-kit/tokens.json'\n */\nexport const getTokenStorePath = async (): Promise<string> => {\n  const paths = await getInfraKitConfigPaths()\n\n  return path.join(path.dirname(paths.userProject), TOKEN_STORE_FILE)\n}\n\n/**\n * Read the token store, or `null` when it does not exist.\n *\n * ABSENCE IS NOT AN ERROR \u2014 a fresh machine has no store, and every caller must be able to say \"no\n * tokens yet\" without a try/catch. The two things that DO throw are malformed JSON and a schema\n * mismatch: both are states only a human can fix, so both are loud.\n *\n * @example\n * const store = await readTokenStore()\n * store?.envs.dev // => 'dp.st.dev.xxxx' | undefined\n * // no file on disk  => null\n * // garbage on disk  => throws 'Invalid token store at ~/.infra-kit/projects/api/tokens.json: \u2026'\n */\nexport const readTokenStore = async (): Promise<TokenStore | null> => {\n  const storePath = await getTokenStorePath()\n\n  let raw: string\n\n  try {\n    raw = await fs.readFile(storePath, 'utf-8')\n  } catch {\n    return null\n  }\n\n  // Every refusal below is an EnvAuthError, not a plain Error. A broken store is the MOST durable\n  // env-auth failure there is \u2014 it cannot heal on a 30s retry, only a human can fix it \u2014 and env\n  // auto-load's sticky marker is keyed on that CLASS. Thrown as a plain Error these were classified\n  // TRANSIENT, so a corrupt store went silent on the backgrounded shell-startup spawn and the user's\n  // env simply stopped loading with nothing ever said. `env` is null: no ONE environment is at fault.\n  let parsedRaw: unknown\n\n  try {\n    parsedRaw = JSON.parse(raw)\n  } catch (err) {\n    throw new EnvAuthError(\n      `Invalid JSON in the token store at ${tildify(storePath)}: ${(err as Error).message}\\n` +\n        `Fix or delete the file, then re-add the token with \\`infra-kit env-token-set <env>\\`.`,\n    )\n  }\n\n  const result = tokenStoreSchema.safeParse(parsedRaw)\n\n  if (!result.success) {\n    throw new EnvAuthError(\n      `Invalid token store at ${tildify(storePath)}: ${z.prettifyError(result.error)}\\n` +\n        `Fix or delete the file, then re-add the token with \\`infra-kit env-token-set <env>\\`.`,\n    )\n  }\n\n  return result.data\n}\n\n/**\n * Persist the store atomically at 0600, tightening every directory on the way to it to 0700.\n *\n * The chmods are not belt-and-braces: the config bootstrap already seeds\n * `~/.infra-kit/projects/<repo>/` at the default umask (0755), so an EXISTING directory is\n * world-readable and `mkdir`'s mode argument is a no-op for it. The same holds for the file \u2014 a\n * hand-written `tokens.json` is 0644 \u2014 so the modes of the whole credential path are (re)asserted on\n * EVERY write, not only on the writes that created it. Self-healing by construction: a plain\n * `env-token-set` is enough to fix a store a human typed.\n *\n * @example\n * await writeTokenStore({ version: 1, envs: { dev: 'dp.st.dev.x' } })\n * // ~/.infra-kit/projects/api/tokens.json  -rw-------\n * // ~/.infra-kit/projects/api/             drwx------\n */\nexport const writeTokenStore = async (store: TokenStore): Promise<void> => {\n  const storePath = await getTokenStorePath()\n\n  const projectDir = path.dirname(storePath)\n  const projectsDir = path.dirname(projectDir)\n  const userConfigDir = path.dirname(projectsDir)\n\n  for (const dir of [userConfigDir, projectsDir, projectDir]) {\n    await fs.mkdir(dir, { recursive: true, mode: TOKEN_DIR_MODE })\n    await fs.chmod(dir, TOKEN_DIR_MODE)\n  }\n\n  atomicWriteFileSync(storePath, `${JSON.stringify(store, null, 2)}\\n`, TOKEN_FILE_MODE)\n\n  // The rename above already lands a fresh 0600 inode, but the mode of a credential file is not a\n  // thing to leave to the umask that happened to be in effect \u2014 assert it outright.\n  await fs.chmod(storePath, TOKEN_FILE_MODE)\n}\n\n/**\n * Add or replace one environment's token, read-modify-write, stamping the current `version`. Inherits\n * {@link readTokenStore}'s refusals: a corrupt store is never silently overwritten.\n *\n * @example\n * await setToken('dev', 'dp.st.dev.xxxxxxxx')\n * // tokens.json => { version: 1, envs: { dev: 'dp.st.dev.xxxxxxxx' } }\n */\nexport const setToken = async (env: string, token: string): Promise<void> => {\n  const existing = await readTokenStore()\n\n  await writeTokenStore({\n    version: TOKEN_STORE_VERSION,\n    envs: { ...existing?.envs, [env]: token },\n  })\n}\n\n/**\n * Drop one environment's token. A no-op when the store (or the key) is absent \u2014 removing something\n * that is not there is the state the caller asked for.\n *\n * Removing a token here does NOT revoke it in Doppler; callers say so.\n *\n * @example\n * await removeToken('dev')\n * // tokens.json => { version: 1, envs: {} }\n */\nexport const removeToken = async (env: string): Promise<void> => {\n  const existing = await readTokenStore()\n\n  if (!existing || !(env in existing.envs)) return\n\n  const envs = { ...existing.envs }\n\n  delete envs[env]\n\n  await writeTokenStore({\n    version: TOKEN_STORE_VERSION,\n    envs,\n  })\n}\n", "/**\n * The DURABLE, USER-FIXABLE env-auth failure \u2014 as a TYPE rather than a string.\n *\n * Throw this (or a subclass) \u2014 never a plain `Error` \u2014 for anything a user must fix before\n * env-load can work: no token minted, a corrupt token store, a foreign token store. Only this\n * class earns the STICKY marker that survives the backgrounded shell-startup spawn and is replayed\n * onto the next interactive command. `DopplerAuthError extends EnvAuthError` for the subset that\n * is specifically \"Doppler refused the token we sent\".\n *\n * @example\n * // no token minted for this env (integrations/doppler/token-resolver.ts)\n * throw new EnvAuthError(buildMissingTokenMessage('dev', storePath), 'dev')\n * @example\n * // the token store itself is unusable \u2014 no single env is at fault, so `env` stays null\n * throw new EnvAuthError(`Invalid JSON in the token store at ${storePath} \u2026`)\n */\n// WHY THIS EXISTS (and why it is deliberately NOT a Doppler type): env auto-load must tell a\n// TRANSIENT failure (network, timeout, Doppler down \u2014 heals itself, 30s backoff, stay quiet) apart\n// from a DURABLE one (never heals, and only a human can fix it). A durable failure misclassified as\n// transient is TOTAL SILENCE, forever, on the one path the whole feature exists to survive.\n//\n// That classification therefore has to travel WITH the error, not be re-derived by grepping a\n// message some other module owns \u2014 and it has to be throwable from EVERY module that can produce\n// the class. `lib/env-tokens` (the store) is a layer BELOW `integrations/doppler`, so a\n// Doppler-owned base type could not be thrown there without a layering inversion and an import\n// cycle. Hence a neutral base here in `lib/errors`.\n//\n// The defect class this closes is \"a durable failure that is not type-detectable\". Adding a new\n// durable failure and forgetting to type it is exactly how this shipped silent twice.\nexport class EnvAuthError extends Error {\n  /**\n   * The env (= Doppler config) whose token is at fault, or `null` when the failure is not attributable\n   * to ONE env (a corrupt or foreign token store breaks every env at once). `null` is honest: do NOT\n   * invent an env to fill it \u2014 the consumer names the env it was TRYING to load, which it already\n   * knows.\n   */\n  readonly env: string | null\n\n  constructor(message: string, env: string | null = null) {\n    super(message)\n    this.name = 'EnvAuthError'\n    this.env = env\n  }\n}\n\n/**\n * The TYPE GUARD every consumer of the auth channel classifies on \u2014 the single question \"is this a\n * durable, user-fixable env-auth failure?\", answered by the error's CLASS and never by its text.\n *\n * This is the default `isAuthFailure` of `lib/env-autoload`'s `runEnvAutoLoad`. It is deliberately\n * WIDER than `isDopplerAuthError`: that one means \"Doppler refused us\", which is only one of the\n * durable failures \u2014 a missing token never reaches Doppler at all, and a corrupt store never reaches\n * the resolver.\n *\n * @example\n * isEnvAuthFailure(new EnvAuthError('No Doppler service token for env \"dev\".', 'dev')) // => true\n * isEnvAuthFailure(new DopplerAuthError('dev', 'revoked'))                             // => true (subclass)\n * isEnvAuthFailure(new Error('connect ETIMEDOUT'))                                     // => false (transient)\n */\nexport const isEnvAuthFailure = (error: unknown): error is EnvAuthError => {\n  return error instanceof EnvAuthError\n}\n", "import { logger } from 'src/lib/logger'\n\ninterface CommandOption {\n  flag: string\n  value: string | string[] | boolean\n}\n\nconst createCommandEcho = () => {\n  let cliPath = ''\n  let options: CommandOption[] = []\n  let isInteractive = false\n\n  return {\n    /**\n     * Bind the echo to the command about to run, and clear the previous one's recording.\n     *\n     * `cliPath` must be the argv Commander actually parsed (`release create`), which is why the ONLY\n     * caller is program.ts's `preAction` hook, feeding it `commandPath(actionCommand)`. Commands used to\n     * name themselves here, and that is precisely how the printed line rotted: they passed the flat\n     * `release-create`, which stopped being a command the day the flat aliases were dropped, so the\n     * \"equivalent command\" we told the user to retype no longer parsed. Commander is the only thing that\n     * knows the real path, so it is the only thing allowed to say it.\n     */\n    start(path: string): void {\n      cliPath = path\n      options = []\n      isInteractive = false\n    },\n\n    /**\n     * Mark that the command had interactive input (prompts)\n     * Call this once when ANY prompt happens\n     */\n    setInteractive(): void {\n      isInteractive = true\n    },\n\n    /**\n     * Track an option selection\n     *\n     * @param flag The CLI flag (e.g., \"--versions\")\n     * @param value The selected value\n     */\n    addOption(flag: string, value: string | string[] | boolean): void {\n      options.push({ flag, value })\n    },\n\n    /**\n     * Format the tracked options into a replayable flag string (empty when none).\n     */\n    formatOptions(): string {\n      return options\n        .map((opt) => {\n          if (typeof opt.value === 'boolean') {\n            return opt.value ? opt.flag : ''\n          }\n\n          if (Array.isArray(opt.value)) {\n            return `${opt.flag} \"${opt.value.join(', ')}\"`\n          }\n\n          return `${opt.flag} \"${opt.value}\"`\n        })\n        .filter(Boolean)\n        .join(' ')\n    },\n\n    /**\n     * The recorded interactive flags for the session shell's report side channel, so the transcript's\n     * equivalent line carries the resolved options (`--versions \"1.2.5\"`), not just the bare command.\n     * `null` when nothing was recorded \u2014 the caller then falls back to the bare spawned argv.\n     */\n    snapshot(): { formattedOptions: string } | null {\n      if (options.length === 0) {\n        return null\n      }\n\n      return { formattedOptions: this.formatOptions() }\n    },\n\n    /**\n     * Print the equivalent CLI command if there was interactive input.\n     *\n     * Silent without a bound `cliPath`: the only caller that binds one is Commander's `preAction`, so an\n     * unbound echo means the command ran off the CLI (an MCP tool), where a `pnpm exec` line would be\n     * nonsense. Printing a path-less `pnpm exec infra-kit --yes` would be worse than printing nothing.\n     */\n    print(): void {\n      if (!isInteractive || options.length === 0 || !cliPath) {\n        return\n      }\n\n      logger.info(`\uD83D\uDCDF Equivalent command: \\npnpm exec infra-kit ${cliPath} ${this.formatOptions()}\\n`)\n    },\n\n    /**\n     * Reset state (useful for testing)\n     */\n    reset(): void {\n      cliPath = ''\n      options = []\n      isInteractive = false\n    },\n  }\n}\n\n// Singleton instance (same pattern as logger)\nexport const commandEcho = createCommandEcho()\n", "import { isAbsolute, resolve } from 'node:path'\nimport process from 'node:process'\n\n/**\n * The argv Commander actually parsed for this run \u2014 captured by `entry/cli.ts` at the one place it\n * hands an argv to `parseAsync`, the interactive-menu re-entry included. Commands that need to name\n * their own invocation (a `confirmation_required` refusal's `rerun`) read it here instead of\n * `process.argv`, which the menu path never rewrites.\n */\n\nlet parsedArgv: readonly string[] | null = null\nlet launchCwd: string | null = null\n\n/**\n * Record the full node-style argv (`[node, script, ...args]`) handed to `parseAsync`, and the cwd it\n * was typed in \u2014 read NOW because the `-C` chdir in `preAction` runs later, and a relative `-C` only\n * means anything against this directory.\n */\nexport const setParsedArgv = (argv: readonly string[]): void => {\n  parsedArgv = [...argv]\n  launchCwd = process.cwd()\n}\n\nconst YES_FLAGS = new Set(['--yes', '-y'])\n\n/**\n * Make every `-C <dir>` in `args` absolute against `cwd`, in place. Commander accepts both\n * `-C dir` and `-Cdir`; both are handled so the re-run is cwd-independent whichever way it was typed.\n */\nconst absolutizeChangeDir = (args: string[], cwd: string): string[] => {\n  const out = [...args]\n\n  for (const [index, token] of out.entries()) {\n    if (token === '-C' && out[index + 1] !== undefined && !isAbsolute(out[index + 1] as string)) {\n      out[index + 1] = resolve(cwd, out[index + 1] as string)\n    } else if (token.startsWith('-C') && token.length > 2 && !token.startsWith('--') && !isAbsolute(token.slice(2))) {\n      out[index] = `-C${resolve(cwd, token.slice(2))}`\n    }\n  }\n\n  return out\n}\n\n/**\n * The argv an agent re-runs to confirm what this run refused: the captured user args with `--yes`\n * appended and any relative `-C` made absolute, so the next Bash call may run from any cwd.\n *\n * Appending is safe: no leaf uses `passThroughOptions` or `--`, and the only variadic option\n * (`--project <names...>`) stops at `--yes`. An argv that already carries `--yes`/`-y` is returned\n * as-is \u2014 a second copy would be noise, and a confirm that fired despite it is not this function's\n * problem to hide.\n *\n * @example\n * // captured: ['node', 'infra-kit', '-C', 'app', 'release', 'remove', '1.2.3', '--json'], cwd /w\n * rerunArgv() // ['-C', '/w/app', 'release', 'remove', '1.2.3', '--json', '--yes']\n */\nexport const rerunArgv = (): string[] => {\n  if (parsedArgv === null || launchCwd === null) return ['--yes']\n\n  const args = absolutizeChangeDir(parsedArgv.slice(2), launchCwd)\n\n  const alreadyConfirmed = args.some((token) => {\n    return YES_FLAGS.has(token)\n  })\n\n  return alreadyConfirmed ? args : [...args, '--yes']\n}\n", "import type { Buffer } from 'node:buffer'\nimport process from 'node:process'\n\nimport { agentMode, isHeadless } from 'src/lib/agent-mode'\nimport type { AgentModeSource } from 'src/lib/agent-mode'\nimport { StructuredRefusalError } from 'src/lib/errors/structured-refusal-error'\n\nimport { acquireStdin, releaseStdin } from './stdin-ref'\n\n/**\n * Structural mirror of `@inquirer/type`'s `Context` \u2014 the second argument every\n * `@inquirer/*` prompt takes. Declared here rather than imported because\n * `@inquirer/core` and `@inquirer/type` are transitive dependencies of this\n * package, not direct ones (only the four prompt packages are).\n */\nexport interface PromptContext {\n  input?: NodeJS.ReadableStream\n  output?: NodeJS.WritableStream\n  clearPromptOnDone?: boolean\n  signal?: AbortSignal\n}\n\n/**\n * What this call site does when there is no human: refuse, refuse NAMING the argument that would have\n * answered the prompt, or answer with a fixed value.\n *\n * - `'refuse'` \u2014 throw `{ status: 'refused' }`: the site has no single argument to name.\n * - `{ refuse: 'version' }` \u2014 throw `{ status: 'argument_required', argument: 'version' }`: the\n *   agent is told exactly what to pass on the re-run. The name is the CLI flag / tool field without\n *   its dashes; G8 (`headless-policy-guards`) checks it exists on every owning tool's schema.\n * - `{ value: T }` \u2014 answer with `value`, no throw.\n *\n * There is no `'unreachable'` any more: that was a claim about an MCP schema making a field\n * required, and no schema stands between a Bash-driven agent and this prompt.\n */\nexport type HeadlessPolicy<T> = 'refuse' | { refuse: string } | { value: T }\n\n/** {@link withEscape}'s options: the prompt context, plus this site's headless policy. */\nexport type EscapeOptions<T> = PromptContext & { whenHeadless?: HeadlessPolicy<T> }\n\nconst ESC_BYTE = 0x1b\n\n// Widening the existing options object rather than adding a third parameter: six call sites already\n// pass a `PromptContext` (`entry/cli.ts`, `env-load`, `env-token-set`, and the wizard's shared\n// context used by three prompts), all of them `{ output: process.stderr }` for documented reasons \u2014\n// `env-token-set.ts:64-68` notes that some env commands run inside `$(\u2026)`, where a prompt on stdout\n// would leave the user typing a credential into a captured stream. A third parameter would have\n// forced every one of them to grow a positional `undefined`.\n//\n// Optional, and the default is `'refuse'`. That default is safe for the same reason the guard exists\n// at all: under `isAgentMode()` nobody is at the keyboard (and under `'mcp'` `process.stdin` IS the\n// JSON-RPC transport), so no prompt at any site can return a usable answer, and refusing removes no\n// capability that exists. It is what CLI-only sites (the palette, the dev wizard, `env-token-set`)\n// keep, because they face a real human.\n//\n// It is NOT what an MCP-reachable site may keep. There, omitting `whenHeadless` is indistinguishable\n// from never having considered the question, so G7 (`every-inquirer-site-is-escapable`) requires the\n// answer to be written out \u2014 `'refuse'` included.\n//\n// What the default is NOT is *correct* everywhere \u2014 that distinction is the whole point of the\n// parameter. `worktrees-add` documents a `false` fallback for MCP in its own schema, so a refusal\n// there is right-outcome-by-accident at best and a regression at worst. The type cannot tell those\n// apart; G6 (description-to-policy) and G8 (argument-to-schema) are what check the answers,\n// because a wrong answer here compiles and can never fail a test on its own.\n//\n// WORDING IS SOURCE-AWARE. \"stdin carries JSON-RPC\" is true of exactly one caller; a skill driving\n// the CLI over Bash that reads it would go looking for a server that does not exist. Only the\n// `'mcp'` source keeps that text.\nconst headlessExcerpt = (source: AgentModeSource): string => {\n  if (source === 'mcp') return 'an interactive prompt was reached under MCP, where stdin carries JSON-RPC'\n  if (source === null) return 'an interactive prompt was reached under --json, which never prompts'\n\n  return `an interactive prompt was reached in agent mode (${source === 'flag' ? '--agent' : 'INFRA_KIT_AGENT / CLAUDECODE'}), where there is no human to answer it`\n}\n\nconst headlessRemediation = (source: AgentModeSource, argument: string | undefined): string => {\n  const passIt =\n    argument === undefined ? 'pass the value explicitly instead of relying on the prompt' : `pass --${argument}`\n\n  if (source === 'mcp') {\n    return argument === undefined\n      ? `${passIt} \u2014 MCP runs have no human to answer it`\n      : `pass \"${argument}\" \u2014 MCP runs have no human to answer it`\n  }\n\n  return `${passIt} on the re-run`\n}\n\nconst resolveHeadless = <T>(policy: HeadlessPolicy<T>): T => {\n  if (typeof policy === 'object' && 'value' in policy) return policy.value\n\n  const argument = typeof policy === 'object' ? policy.refuse : undefined\n  const { source } = agentMode\n\n  throw new StructuredRefusalError(\n    argument === undefined\n      ? { status: 'refused', agentMode: source }\n      : { status: 'argument_required', argument, agentMode: source },\n    2,\n    {\n      operation: 'interactive prompt',\n      remediation: headlessRemediation(source, argument),\n      stderrExcerpt: headlessExcerpt(source),\n    },\n  )\n}\n\n/**\n * Run an `@inquirer/*` prompt with Esc bound to cancellation. On Esc the prompt rejects with an\n * `AbortPromptError`, which `entry/cli.ts` already catches at the top level -> \"Operation\n * cancelled.\" -> exit 0.\n *\n * The listener attaches only on a real interactive terminal. `isTTY` alone is NOT a sufficient\n * guard \u2014 see lib/agent-mode for why `stdio: 'inherit'` defeats it.\n */\n// The cancel path is entirely pre-existing plumbing: an `AbortController`'s signal goes into the\n// prompt context, `@inquirer/core` rejects with an `AbortPromptError` when it fires, and that name\n// is already in `CANCELLATION_ERROR_NAMES` (lib/errors/is-prompt-cancellation). All this adds is\n// the thing that calls `abort()`.\n//\n// DETECTION \u2014 a raw `data` listener that aborts iff the chunk is exactly one `0x1b` byte.\n// Deliberately NOT readline `keypress`: that delivers a lone Esc only after its escape-sequence\n// timeout (~523ms measured), and the `escapeCodeTimeout` dial that would shorten it is\n// process-global and first-armer-wins \u2014 a second `emitKeypressEvents` call on `process.stdin` is\n// SILENTLY IGNORED, so the dial degrades to a no-op with no error and no failing test. The raw\n// listener costs ~24ms and touches no global state. Arrow keys (`\\x1b[B`, 3 bytes) and Alt combos\n// (`\\x1bb`, 2 bytes) are ignored because they are LONGER \u2014 no parsed key field is involved. Node\n// `data` listeners broadcast, so this one does not steal bytes from readline: arrows and Enter keep\n// working while it is attached.\n//\n// FALSE POSITIVES are a non-issue: there is no routine source of a lone-`0x1b` chunk. Focus events\n// (`\\x1b[I`/`\\x1b[O`), bracketed paste (`\\x1b[200~`) and mouse reports (`\\x1b[M\u2026`) are all\n// multi-byte, and inquirer enables none of them.\n//\n// FALSE NEGATIVE \u2014 measured and accepted: a COALESCED Esc (`\"\\x1bx\"` arriving in ONE chunk, i.e.\n// Esc immediately followed by another key) is silently dropped and the prompt stays open. The fix\n// would be Ink's 20ms deferred abort \u2014 hold the lone Esc, cancel it if a follow-up chunk lands.\n// That is a logged NON-GOAL; do not pre-build it.\nexport const withEscape = async <T>(\n  run: (context: PromptContext) => Promise<T>,\n  base?: EscapeOptions<T>,\n): Promise<T> => {\n  const controller = new AbortController()\n  // `whenHeadless` is ours, not inquirer's \u2014 split it off so it never reaches a prompt's context.\n  const { whenHeadless = 'refuse', ...promptBase } = base ?? {}\n  const context: PromptContext = { ...promptBase, signal: controller.signal }\n\n  // Keyed on `isHeadless()`. `!isTTY` deliberately does NOT ride along: a piped-but-human\n  // run (`infra-kit worktrees add > log.txt`) has no TTY and still deserves its prompt, and the two\n  // conditions were only ever collapsed here because both merely skipped the Esc listener. Now that\n  // this branch decides an ANSWER rather than just a listener, conflating them would refuse prompts\n  // no agent is waiting on. `release-picker.ts` keeps its own `!isTTY` clause for its own reason.\n  //\n  // `--json` joins because a prompt is stdout traffic on a stream a machine is parsing, and because\n  // `release-picker`/`source-picker` already treat `--json` as never-prompt \u2014 this makes the 20 sites\n  // agree with those two.\n  if (isHeadless()) return resolveHeadless(whenHeadless)\n\n  if (!process.stdin.isTTY) return run(context)\n\n  const input = process.stdin\n\n  const onData = (chunk: Buffer) => {\n    if (chunk.length === 1 && chunk[0] === ESC_BYTE) controller.abort()\n  }\n\n  // STDIN OWNERSHIP \u2014 this is the seam that keeps stdin alive for inquirer, which refs\n  // nothing itself. It must sit BELOW the early return above: a non-TTY run never reads\n  // stdin, so acquiring there would ref a handle nobody reads and hang the process. See\n  // lib/prompts/stdin-ref for why an unref'd stdin kills a prompt with exit 13.\n  acquireStdin()\n\n  try {\n    // Attach after the prompt has built its readline interface. Cheap ordering defence\n    // only \u2014 there is no race today: readline attaches its own consumer synchronously\n    // and `data` events are async.\n    //\n    // INSIDE the `try`, both of them: `run` is caller-supplied and `@inquirer/core` runs\n    // synchronously up to readline construction, so a SYNCHRONOUS throw here would skip a\n    // `finally` placed any lower \u2014 leaking the ref and hanging the CLI, which is the exact\n    // failure this module exists to prevent.\n    const pending = run(context)\n\n    // Explicit, because `on('data')` alone is NOT enough to start the flow: `Readable` resumes on a\n    // new `data` listener only when `flowing !== false`, and the palette's teardown now pauses stdin\n    // (tui/boot.tsx) so a prompt opened after an Ink screen inherits `flowing === false`. Esc would be\n    // silently dead. It happens to work anyway today \u2014 `run()` above builds inquirer's readline, whose\n    // constructor resumes the stream \u2014 but that is an undocumented side effect of a TRANSITIVE\n    // dependency, and the ordering it relies on is the very thing the comment below reserves the right\n    // to change. One idempotent call is cheaper than that coupling.\n    if (input.isPaused()) input.resume()\n\n    input.on('data', onData)\n\n    return await pending\n  } finally {\n    // Non-negotiable: the dev wizard runs ~5 prompts back to back, so a leaked\n    // listener would abort the next one.\n    input.removeListener('data', onData)\n    // Same `finally` as the listener teardown, and for the same reason: every exit path\n    // (answer, Esc abort, throw) must give the ref back, or node never exits.\n    releaseStdin()\n  }\n}\n", "import { OperationError } from './operation-error'\nimport type { OperationErrorContext } from './operation-error'\n\n/**\n * Why the command stopped, for a machine reader. `exitCode` 2 means nothing happened \u2014 re-run with\n * more; 1 means something happened and part of it failed.\n */\nexport type RefusalStatus = 'confirmation_required' | 'argument_required' | 'partial_failure' | 'refused'\n\nexport interface RefusalStructuredContent {\n  status: RefusalStatus\n  [k: string]: unknown\n}\n\n/**\n * A refusal that carries a payload for whichever agent surface is listening: `entry/cli.ts` emits\n * `structuredContent` under `--json` and exits with `exitCode`; the MCP tool handler renders it as an\n * `isError` result with the same `structuredContent`. The message is the ordinary `OperationError`\n * one (operation / stderr / remediation), so the human-readable line loses nothing.\n *\n * @example\n * throw new StructuredRefusalError(\n *   { status: 'argument_required', argument: 'version', agentMode: 'flag' },\n *   2,\n *   { operation: 'interactive prompt', remediation: 'pass --version' },\n * )\n */\n// Extends `OperationError`, not `Error`, ON PURPOSE. Seven of the eight confirm sites sit under a\n// handler-level `catch` that passes through only `isPromptCancellation`, `isCommandDeclined` and\n// `instanceof OperationError` and REWRAPS everything else into a generic `OperationError`\n// (`release-remove.ts` near the `gh auth status` remediation, `worktrees-add.ts`, `worktrees-sync.ts`,\n// `release-create.ts`). A plain `Error` subclass would lose the payload and the exit code at exactly\n// the sites this exists for.\nexport class StructuredRefusalError extends OperationError {\n  readonly structuredContent: RefusalStructuredContent\n  readonly exitCode: 1 | 2\n\n  constructor(structuredContent: RefusalStructuredContent, exitCode: 1 | 2, context: OperationErrorContext) {\n    super(undefined, context)\n    this.name = 'StructuredRefusalError'\n    this.structuredContent = structuredContent\n    this.exitCode = exitCode\n  }\n}\n", "/**\n * @fileoverview\n * Shared interactive-confirmation gate for mutating commands.\n *\n * When `confirmedCommand` is truthy (CLI `--yes` or an MCP call, which always\n * injects `confirmedCommand: true`) the prompt is skipped and execution\n * proceeds. Otherwise, with no human to ask \u2014 agent mode, or `--json`, whose\n * stdout a machine is parsing \u2014 it throws a `confirmation_required` refusal\n * carrying the argv that confirms (preview-then-execute, no new flag). Otherwise\n * it prompts the user, marks the echo as interactive, and exits cleanly if the\n * user declines.\n *\n * Esc aborts the prompt (via `withEscape`) rather than answering it \u2014 the caller\n * sees an `AbortPromptError`, which every command's boundary already treats as a\n * clean back-out through `isPromptCancellation`. That is deliberately NOT the same\n * as declining: a decline is an answer of \"no\" and takes the `process.exit(0)` path\n * below, whereas Esc means \"I never answered\".\n *\n * Unlike every other prompt in the CLI this one renders to STDOUT, not stderr \u2014\n * left as-is, since changing it would move confirmation text out of the stream\n * callers have always read it from.\n *\n * The `process.exit(0)` only runs on the interactive-decline path, which is\n * unreachable under MCP \u2014 so this stays safe for the long-lived MCP server.\n *\n * Callers remain responsible for their own `commandEcho.addOption('--yes', \u2026)`\n * bookkeeping, which varies between commands.\n */\nimport confirm from '@inquirer/confirm'\nimport process from 'node:process'\n\nimport { agentMode, isHeadless } from 'src/lib/agent-mode'\nimport { CommandDeclinedError } from 'src/lib/errors/command-declined-error'\nimport { StructuredRefusalError } from 'src/lib/errors/structured-refusal-error'\nimport { logger } from 'src/lib/logger'\nimport { rerunArgv } from 'src/lib/parsed-argv'\nimport { withEscape } from 'src/lib/prompts/escapable-context'\n\nimport { commandEcho } from './command-echo'\n\nexport interface ConfirmOrExitOptions {\n  /**\n   * The structured form of what `message` renders, handed back verbatim in the\n   * `confirmation_required` payload so an agent can show the human WHAT it is\n   * about to confirm without parsing prose. JSON-safe and secret-free \u2014 it is\n   * emitted to stdout. Sites with no structured plan pass nothing.\n   */\n  plan?: unknown\n  /**\n   * Throw {@link CommandDeclinedError} on a decline instead of `process.exit(0)`.\n   *\n   * **Defaults to false, and must stay that way.** Seven commands call this\n   * helper; flipping the default would change the exit semantics of all of them\n   * at once, inside a change whose tests cover none of them.\n   *\n   * Opt in when the command has already acquired something that needs releasing\n   * by the time it prompts \u2014 `process.exit` skips every `finally`, so for those\n   * commands the decline path is precisely where a resource leaks. The caller\n   * owns catching it and exiting 0: a decline is a successful outcome.\n   */\n  throwOnDecline?: boolean\n}\n\n/**\n * Throw the `confirmation_required` refusal an agent (or a `--json` run) gets in place of a confirm\n * prompt: the message, the site's plan, the argv that confirms, and the source. Exit 2 \u2014 nothing ran.\n *\n * Exported for the one confirm site that is not `confirmOrExit` (`lib/release-deploy/confirm-deploy`),\n * so both speak the same shape.\n */\n// Thrown from HERE, not from `withEscape`'s headless branch, because it needs what only a confirm\n// site has: the message, the plan, and the knowledge that `--yes` is the answer. Callers key it on\n// `isHeadless()`, never on `confirmedCommand`, so their short-circuit for the MCP chokepoint and\n// every `--yes` human stays as it was.\nexport const refuseUnconfirmed = (message: string, plan?: unknown): never => {\n  const { source } = agentMode\n  const rerun = rerunArgv()\n\n  throw new StructuredRefusalError({ status: 'confirmation_required', message, plan, rerun, agentMode: source }, 2, {\n    operation: 'confirm before running',\n    remediation:\n      source === null\n        ? 'pass `--yes` to confirm, or drop `--json` to be prompted'\n        : `show the plan to the human, then re-run \\`infra-kit ${rerun.join(' ')}\\` to confirm`,\n    stderrExcerpt: 'confirmation required and nobody to ask',\n  })\n}\n\nexport const confirmOrExit = async (\n  confirmedCommand: boolean | undefined,\n  message: string,\n  options: ConfirmOrExitOptions = {},\n): Promise<void> => {\n  if (!confirmedCommand && isHeadless()) refuseUnconfirmed(message, options.plan)\n\n  const answer = confirmedCommand\n    ? true\n    : await withEscape(\n        (context) => {\n          return confirm({ message }, context)\n        },\n        // Unreachable headless: the guard above already refused every agent / `--json` run that got\n        // here without `confirmedCommand`. Written out anyway \u2014 G7 requires every reachable site to\n        // answer, and `'refuse'` is the answer that costs nothing if the guard above ever moves.\n        { whenHeadless: 'refuse' },\n      )\n\n  if (!confirmedCommand) {\n    commandEcho.setInteractive()\n  }\n\n  if (!answer) {\n    if (options.throwOnDecline) {\n      throw new CommandDeclinedError()\n    }\n\n    logger.info('Operation cancelled. Exiting...')\n    process.exit(0)\n  }\n}\n", "/**\n * The operator answered \"no\" at a confirmation prompt.\n *\n * Deliberately NOT an {@link OperationError}: nothing failed. It is also not a prompt\n * cancellation \u2014 Esc means \"I never answered\" and has its own handling, while this means\n * \"I answered, and the answer was no.\" Callers that opt in via `throwOnDecline` are\n * responsible for catching it and exiting 0.\n */\n// It exists so a command that acquired a resource before prompting \u2014 a scratch worktree, a temp\n// directory, a lock \u2014 can unwind through its own `finally` blocks and release it, instead of\n// `confirmOrExit` calling `process.exit(0)` and skipping every one of them.\n//\n// That distinction is load-bearing rather than stylistic. In a plan -> confirm -> apply design,\n// declining is a first-class expected outcome, not an edge case, so the most ordinary non-happy\n// path is exactly the one that would leak.\nexport class CommandDeclinedError extends Error {\n  constructor(message = 'Operation cancelled by the operator') {\n    super(message)\n    this.name = 'CommandDeclinedError'\n  }\n}\n\n/** Narrow an unknown catch binding to a decline. */\nexport const isCommandDeclined = (error: unknown): error is CommandDeclinedError => {\n  return error instanceof CommandDeclinedError\n}\n"],
-  "mappings": "kKAKA,OAAOA,MAAQ,mBACf,OAAOC,MAAU,YACjB,OAAS,KAAAC,MAAS,MCsBX,IAAMC,EAAN,cAA2B,KAAM,CAO7B,IAET,YAAYC,EAAiBC,EAAqB,KAAM,CACtD,MAAMD,CAAO,EACb,KAAK,KAAO,eACZ,KAAK,IAAMC,CACb,CACF,EAgBaC,GAAoBC,GACxBA,aAAiBJ,EDtC1B,IAAMK,EAAmB,cAGnBC,EAAsB,EAGtBC,EAAkB,IAGlBC,EAAiB,IAqBjBC,EAAmBC,EACtB,OAAO,CACN,QAASA,EAAE,QAAQJ,CAAmB,EAAE,QAAQA,CAAmB,EACnE,KAAMI,EAAE,OAAOA,EAAE,OAAO,EAAE,IAAI,CAAC,EAAGA,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CACrD,CAAC,EACA,OAAO,EAeGC,EAAoB,SAA6B,CAC5D,IAAMC,EAAQ,MAAMC,EAAuB,EAE3C,OAAOC,EAAK,KAAKA,EAAK,QAAQF,EAAM,WAAW,EAAGP,CAAgB,CACpE,EAeaU,EAAiB,SAAwC,CACpE,IAAMC,EAAY,MAAML,EAAkB,EAEtCM,EAEJ,GAAI,CACFA,EAAM,MAAMC,EAAG,SAASF,EAAW,OAAO,CAC5C,MAAQ,CACN,OAAO,IACT,CAOA,IAAIG,EAEJ,GAAI,CACFA,EAAY,KAAK,MAAMF,CAAG,CAC5B,OAASG,EAAK,CACZ,MAAM,IAAIC,EACR,sCAAsCC,EAAQN,CAAS,CAAC,KAAMI,EAAc,OAAO;AAAA,sFAErF,CACF,CAEA,IAAMG,EAASd,EAAiB,UAAUU,CAAS,EAEnD,GAAI,CAACI,EAAO,QACV,MAAM,IAAIF,EACR,0BAA0BC,EAAQN,CAAS,CAAC,KAAKN,EAAE,cAAca,EAAO,KAAK,CAAC;AAAA,sFAEhF,EAGF,OAAOA,EAAO,IAChB,EAiBaC,EAAkB,MAAOC,GAAqC,CACzE,IAAMT,EAAY,MAAML,EAAkB,EAEpCe,EAAaZ,EAAK,QAAQE,CAAS,EACnCW,EAAcb,EAAK,QAAQY,CAAU,EACrCE,EAAgBd,EAAK,QAAQa,CAAW,EAE9C,QAAWE,IAAO,CAACD,EAAeD,EAAaD,CAAU,EACvD,MAAMR,EAAG,MAAMW,EAAK,CAAE,UAAW,GAAM,KAAMrB,CAAe,CAAC,EAC7D,MAAMU,EAAG,MAAMW,EAAKrB,CAAc,EAGpCsB,EAAoBd,EAAW,GAAG,KAAK,UAAUS,EAAO,KAAM,CAAC,CAAC;AAAA,EAAMlB,CAAe,EAIrF,MAAMW,EAAG,MAAMF,EAAWT,CAAe,CAC3C,EAUawB,EAAW,MAAOC,EAAaC,IAAiC,CAC3E,IAAMC,EAAW,MAAMnB,EAAe,EAEtC,MAAMS,EAAgB,CACpB,QAASlB,EACT,KAAM,CAAE,GAAG4B,GAAU,KAAM,CAACF,CAAG,EAAGC,CAAM,CAC1C,CAAC,CACH,EAYaE,EAAc,MAAOH,GAA+B,CAC/D,IAAME,EAAW,MAAMnB,EAAe,EAEtC,GAAI,CAACmB,GAAY,EAAEF,KAAOE,EAAS,MAAO,OAE1C,IAAME,EAAO,CAAE,GAAGF,EAAS,IAAK,EAEhC,OAAOE,EAAKJ,CAAG,EAEf,MAAMR,EAAgB,CACpB,QAASlB,EACT,KAAA8B,CACF,CAAC,CACH,EErMA,IAAMC,EAAoB,IAAM,CAC9B,IAAIC,EAAU,GACVC,EAA2B,CAAC,EAC5BC,EAAgB,GAEpB,MAAO,CAWL,MAAMC,EAAoB,CACxBH,EAAUG,EACVF,EAAU,CAAC,EACXC,EAAgB,EAClB,EAMA,gBAAuB,CACrBA,EAAgB,EAClB,EAQA,UAAUE,EAAcC,EAA0C,CAChEJ,EAAQ,KAAK,CAAE,KAAAG,EAAM,MAAAC,CAAM,CAAC,CAC9B,EAKA,eAAwB,CACtB,OAAOJ,EACJ,IAAKK,GACA,OAAOA,EAAI,OAAU,UAChBA,EAAI,MAAQA,EAAI,KAAO,GAG5B,MAAM,QAAQA,EAAI,KAAK,EAClB,GAAGA,EAAI,IAAI,KAAKA,EAAI,MAAM,KAAK,IAAI,CAAC,IAGtC,GAAGA,EAAI,IAAI,KAAKA,EAAI,KAAK,GACjC,EACA,OAAO,OAAO,EACd,KAAK,GAAG,CACb,EAOA,UAAgD,CAC9C,OAAIL,EAAQ,SAAW,EACd,KAGF,CAAE,iBAAkB,KAAK,cAAc,CAAE,CAClD,EASA,OAAc,CACR,CAACC,GAAiBD,EAAQ,SAAW,GAAK,CAACD,GAI/CO,EAAO,KAAK;AAAA,sBAAgDP,CAAO,IAAI,KAAK,cAAc,CAAC;AAAA,CAAI,CACjG,EAKA,OAAc,CACZA,EAAU,GACVC,EAAU,CAAC,EACXC,EAAgB,EAClB,CACF,CACF,EAGaM,EAAcT,EAAkB,EC3G7C,OAAS,cAAAU,EAAY,WAAAC,MAAe,YACpC,OAAOC,MAAa,eASpB,IAAIC,EAAuC,KACvCC,EAA2B,KAOlBC,EAAiBC,GAAkC,CAC9DH,EAAa,CAAC,GAAGG,CAAI,EACrBF,EAAYF,EAAQ,IAAI,CAC1B,EAEMK,EAAY,IAAI,IAAI,CAAC,QAAS,IAAI,CAAC,EAMnCC,EAAsB,CAACC,EAAgBC,IAA0B,CACrE,IAAMC,EAAM,CAAC,GAAGF,CAAI,EAEpB,OAAW,CAACG,EAAOC,CAAK,IAAKF,EAAI,QAAQ,EACnCE,IAAU,MAAQF,EAAIC,EAAQ,CAAC,IAAM,QAAa,CAACZ,EAAWW,EAAIC,EAAQ,CAAC,CAAW,EACxFD,EAAIC,EAAQ,CAAC,EAAIX,EAAQS,EAAKC,EAAIC,EAAQ,CAAC,CAAW,EAC7CC,EAAM,WAAW,IAAI,GAAKA,EAAM,OAAS,GAAK,CAACA,EAAM,WAAW,IAAI,GAAK,CAACb,EAAWa,EAAM,MAAM,CAAC,CAAC,IAC5GF,EAAIC,CAAK,EAAI,KAAKX,EAAQS,EAAKG,EAAM,MAAM,CAAC,CAAC,CAAC,IAIlD,OAAOF,CACT,EAeaG,EAAY,IAAgB,CACvC,GAAIX,IAAe,MAAQC,IAAc,KAAM,MAAO,CAAC,OAAO,EAE9D,IAAMK,EAAOD,EAAoBL,EAAW,MAAM,CAAC,EAAGC,CAAS,EAM/D,OAJyBK,EAAK,KAAMI,GAC3BN,EAAU,IAAIM,CAAK,CAC3B,EAEyBJ,EAAO,CAAC,GAAGA,EAAM,OAAO,CACpD,ECjEA,OAAOM,MAAa,eCgCb,IAAMC,EAAN,cAAqCC,CAAe,CAChD,kBACA,SAET,YAAYC,EAA6CC,EAAiBC,EAAgC,CACxG,MAAM,OAAWA,CAAO,EACxB,KAAK,KAAO,yBACZ,KAAK,kBAAoBF,EACzB,KAAK,SAAWC,CAClB,CACF,EDHA,IAAME,EAAW,GA4BXC,EAAmBC,GACnBA,IAAW,MAAc,4EACzBA,IAAW,KAAa,sEAErB,oDAAoDA,IAAW,OAAS,UAAY,8BAA8B,0CAGrHC,EAAsB,CAACD,EAAyBE,IAAyC,CAC7F,IAAMC,EACJD,IAAa,OAAY,6DAA+D,UAAUA,CAAQ,GAE5G,OAAIF,IAAW,MACNE,IAAa,OAChB,GAAGC,CAAM,8CACT,SAASD,CAAQ,+CAGhB,GAAGC,CAAM,gBAClB,EAEMC,EAAsBC,GAAiC,CAC3D,GAAI,OAAOA,GAAW,UAAY,UAAWA,EAAQ,OAAOA,EAAO,MAEnE,IAAMH,EAAW,OAAOG,GAAW,SAAWA,EAAO,OAAS,OACxD,CAAE,OAAAL,CAAO,EAAIM,EAEnB,MAAM,IAAIC,EACRL,IAAa,OACT,CAAE,OAAQ,UAAW,UAAWF,CAAO,EACvC,CAAE,OAAQ,oBAAqB,SAAAE,EAAU,UAAWF,CAAO,EAC/D,EACA,CACE,UAAW,qBACX,YAAaC,EAAoBD,EAAQE,CAAQ,EACjD,cAAeH,EAAgBC,CAAM,CACvC,CACF,CACF,EAiCaQ,EAAa,MACxBC,EACAC,IACe,CACf,IAAMC,EAAa,IAAI,gBAEjB,CAAE,aAAAC,EAAe,SAAU,GAAGC,CAAW,EAAIH,GAAQ,CAAC,EACtDI,EAAyB,CAAE,GAAGD,EAAY,OAAQF,EAAW,MAAO,EAW1E,GAAII,EAAW,EAAG,OAAOX,EAAgBQ,CAAY,EAErD,GAAI,CAACI,EAAQ,MAAM,MAAO,OAAOP,EAAIK,CAAO,EAE5C,IAAMG,EAAQD,EAAQ,MAEhBE,EAAUC,GAAkB,CAC5BA,EAAM,SAAW,GAAKA,EAAM,CAAC,IAAMrB,GAAUa,EAAW,MAAM,CACpE,EAMAS,EAAa,EAEb,GAAI,CASF,IAAMC,EAAUZ,EAAIK,CAAO,EAS3B,OAAIG,EAAM,SAAS,GAAGA,EAAM,OAAO,EAEnCA,EAAM,GAAG,OAAQC,CAAM,EAEhB,MAAMG,CACf,QAAE,CAGAJ,EAAM,eAAe,OAAQC,CAAM,EAGnCI,EAAa,CACf,CACF,EE/KA,OAAOC,MAAa,oBACpB,OAAOC,MAAa,eCdb,IAAMC,EAAN,cAAmC,KAAM,CAC9C,YAAYC,EAAU,sCAAuC,CAC3D,MAAMA,CAAO,EACb,KAAK,KAAO,sBACd,CACF,EAGaC,GAAqBC,GACzBA,aAAiBH,EDkDnB,IAAMI,EAAoB,CAACC,EAAiBC,IAA0B,CAC3E,GAAM,CAAE,OAAAC,CAAO,EAAIC,EACbC,EAAQC,EAAU,EAExB,MAAM,IAAIC,EAAuB,CAAE,OAAQ,wBAAyB,QAAAN,EAAS,KAAAC,EAAM,MAAAG,EAAO,UAAWF,CAAO,EAAG,EAAG,CAChH,UAAW,yBACX,YACEA,IAAW,KACP,2DACA,uDAAuDE,EAAM,KAAK,GAAG,CAAC,gBAC5E,cAAe,yCACjB,CAAC,CACH,EAEaG,GAAgB,MAC3BC,EACAR,EACAS,EAAgC,CAAC,IACf,CACd,CAACD,GAAoBE,EAAW,GAAGX,EAAkBC,EAASS,EAAQ,IAAI,EAE9E,IAAME,EAASH,EACX,GACA,MAAMI,EACHC,GACQC,EAAQ,CAAE,QAAAd,CAAQ,EAAGa,CAAO,EAKrC,CAAE,aAAc,QAAS,CAC3B,EAMJ,GAJKL,GACHO,EAAY,eAAe,EAGzB,CAACJ,EAAQ,CACX,GAAIF,EAAQ,eACV,MAAM,IAAIO,EAGZC,EAAO,KAAK,iCAAiC,EAC7CC,EAAQ,KAAK,CAAC,CAChB,CACF",
-  "names": ["fs", "path", "z", "EnvAuthError", "message", "env", "isEnvAuthFailure", "error", "TOKEN_STORE_FILE", "TOKEN_STORE_VERSION", "TOKEN_FILE_MODE", "TOKEN_DIR_MODE", "tokenStoreSchema", "z", "getTokenStorePath", "paths", "getInfraKitConfigPaths", "path", "readTokenStore", "storePath", "raw", "fs", "parsedRaw", "err", "EnvAuthError", "tildify", "result", "writeTokenStore", "store", "projectDir", "projectsDir", "userConfigDir", "dir", "atomicWriteFileSync", "setToken", "env", "token", "existing", "removeToken", "envs", "createCommandEcho", "cliPath", "options", "isInteractive", "path", "flag", "value", "opt", "logger", "commandEcho", "isAbsolute", "resolve", "process", "parsedArgv", "launchCwd", "setParsedArgv", "argv", "YES_FLAGS", "absolutizeChangeDir", "args", "cwd", "out", "index", "token", "rerunArgv", "process", "StructuredRefusalError", "OperationError", "structuredContent", "exitCode", "context", "ESC_BYTE", "headlessExcerpt", "source", "headlessRemediation", "argument", "passIt", "resolveHeadless", "policy", "agentMode", "StructuredRefusalError", "withEscape", "run", "base", "controller", "whenHeadless", "promptBase", "context", "isHeadless", "process", "input", "onData", "chunk", "acquireStdin", "pending", "releaseStdin", "confirm", "process", "CommandDeclinedError", "message", "isCommandDeclined", "error", "refuseUnconfirmed", "message", "plan", "source", "agentMode", "rerun", "rerunArgv", "StructuredRefusalError", "confirmOrExit", "confirmedCommand", "options", "isHeadless", "answer", "withEscape", "context", "confirm", "commandEcho", "CommandDeclinedError", "logger", "process"]
-}

package/dist/chunk-75URROMU.js

@@ -1,4 +0,0 @@
-import O from"node:crypto";import R from"node:fs";import C from"node:os";import E from"node:path";import p from"node:process";var x="env-load.sh",S="env-clear.sh",D="projects",K=7200,I="INFRA_KIT_SESSION",L=".infra-kit",f="INFRA_KIT_ENV",d="INFRA_KIT_ENV_CONFIG",v="INFRA_KIT_ENV_PROJECT",W="INFRA_KIT_ENV_PROJECT_ROOT",y="INFRA_KIT_ENV_LOADED_AT",P="INFRA_KIT_ENV_AUTOLOADED",U="INFRA_KIT_ENV_CLEARED",h=/^([A-Z_]\w*)=/i,j=/^unset ([A-Z_]\w*)$/i,c=(t,e)=>{let r=e;for(let n=0;n<t.length;n++){if(!r&&t[n]==="\\"){n++;continue}t[n]==="'"&&(r=!r)}return r},w=t=>{let e=t.startsWith("'")?t.slice(1):t;return(e.endsWith("'")?e.slice(0,-1):e).split("'\\''").join("'")},F=t=>{try{return R.readFileSync(t,"utf-8")}catch{return""}},T=(t,e,r)=>{let n=t.split(`
-`).map(s=>s.endsWith("\r")?s.slice(0,-1):s),o=0,_=!1;for(;o<n.length;){let s=n[o];if(_){_=c(s,_),o+=1;continue}let a=h.exec(s);if(!a){let i=j.exec(s);i&&r?.(i[1]),_=c(s,!1),o+=1;continue}let V=a[1],A=s.slice(a[0].length);if(!A.startsWith("'")){e({name:V,value:A}),_=c(s,!1),o+=1;continue}let m=[A],N=c(A,!1);for(;N&&o+1<n.length;){o+=1;let i=n[o];m.push(i),N=c(i,!0)}e({name:V,value:w(m.join(`
-`))}),_=N,o+=1}},G=t=>{let e=[];return T(F(t),({name:r})=>{e.push(r)}),e},b=t=>{let e={};return T(F(t),({name:r,value:n})=>{e[r]=n}),e},k=t=>{let e=[];return T(F(t),()=>{},r=>{e.push(r)}),e},g=()=>{let t=p.env.XDG_CACHE_HOME,e=t&&t.length>0?t:E.join(C.homedir(),".cache");return E.join(e,"infra-kit")},H=()=>{let t=p.env[I];if(!t)throw new Error(`${I} is not set. Run \`infra-kit setup --skip-tools\` then \`source ~/.zshrc\`.`);return E.join(g(),t)},l=t=>O.createHash("sha256").update(t,"utf8").digest("hex"),u=()=>E.join(g(),D),J=t=>E.join(u(),l(t)),M=(t,e,r)=>{let n=`${t}.tmp.${p.pid}`;R.writeFileSync(n,e,{mode:r});try{R.renameSync(n,t)}catch(o){throw R.rmSync(n,{force:!0}),o}},Q="-worktrees";export{x as a,S as b,K as c,I as d,L as e,f,d as g,v as h,W as i,y as j,P as k,U as l,G as m,b as n,k as o,g as p,H as q,u as r,J as s,M as t,Q as u};
-//# sourceMappingURL=chunk-75URROMU.js.map

package/dist/chunk-75URROMU.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/lib/constants/constants.ts"],
-  "sourcesContent": ["import crypto from 'node:crypto'\nimport fs from 'node:fs'\nimport os from 'node:os'\nimport path from 'node:path'\nimport process from 'node:process'\n\nexport const ENV_LOAD_FILE = 'env-load.sh'\nexport const ENV_CLEAR_FILE = 'env-clear.sh'\n\n/** Subdir of the cache root holding the project-scoped WARM caches (one dir per\n *  project, keyed by {@link warmCacheKey}). Kept in sync with the zsh block in\n *  init.ts, which reads `$cache_root/projects/$key/env-load.sh`. */\nexport const WARM_CACHE_SUBDIR = 'projects'\n\n/**\n * Default warm-cache TTL in seconds (2h). Governs BOTH the node-side eviction\n * sweep and the zsh-side source gate (`_INFRA_KIT_WARM_TTL` in the shell block);\n * the two MUST stay equal, so this constant is the single source of truth and the\n * shell default is emitted from it. Short by design: a warm file older than this\n * is never sourced (bounds a revoked/rotated secret served at prompt-0) and is\n * deleted on the next write. The background refresh lands in ~1-2s regardless.\n */\nexport const DEFAULT_WARM_TTL_SECONDS = 2 * 60 * 60\n\nexport const INFRA_KIT_SESSION_VAR = 'INFRA_KIT_SESSION'\n/**\n * Directory under the user's home that holds all machine-local infra-kit config:\n * the runtime `infra-kit.json` merge layer, per-project overrides, the factory\n * registry (`vendor.json`), and the `portless` package link. Single source of\n * truth for `.infra-kit`.\n *\n * Defined HERE, not in `lib/infra-kit-config`, because that module pulls in zod\n * and the `ik-mcp` proxy bundle must stay Node-builtins-only (guarded in\n * `entry/__tests__/dist-shebang.test.ts`); `lib/infra-kit-config` re-exports it\n * for its existing consumers.\n */\nexport const USER_CONFIG_DIR_NAME = '.infra-kit'\n/**\n * The active environment/config NAME (e.g. `dev`, `arthur`), exported plainly so\n * non-shell consumers can read it from `process.env`. Notably `infra-kit/vite`'s\n * `infraKitDev()` reads this to interpolate the `<env>` placeholder in cloud proxy\n * targets. Mirrors {@link INFRA_KIT_ENV_CONFIG_VAR} (same value) but is the stable,\n * purpose-named handle for tooling rather than the shell session-metadata var.\n */\nexport const INFRA_KIT_ENV_VAR = 'INFRA_KIT_ENV'\nexport const INFRA_KIT_ENV_CONFIG_VAR = 'INFRA_KIT_ENV_CONFIG'\nexport const INFRA_KIT_ENV_PROJECT_VAR = 'INFRA_KIT_ENV_PROJECT'\n/**\n * Absolute project root (git top-level) the loaded env belongs to. Lets the shell\n * startup gate tell a same-project subshell (skip) from a NEW project (load), so a\n * different project's secrets are never silently kept after `cd`/new shell.\n */\nexport const INFRA_KIT_ENV_PROJECT_ROOT_VAR = 'INFRA_KIT_ENV_PROJECT_ROOT'\nexport const INFRA_KIT_ENV_LOADED_AT_VAR = 'INFRA_KIT_ENV_LOADED_AT'\n/**\n * Marker exported into env-load.sh ONLY when the load was triggered automatically\n * (see lib/env-autoload). Its presence is the sole signal distinguishing an\n * auto-loaded env from a deliberate manual `env-load`, so auto-load never\n * clobbers a manual choice. A manual load unsets it.\n */\nexport const INFRA_KIT_ENV_AUTOLOADED_VAR = 'INFRA_KIT_ENV_AUTOLOADED'\n/**\n * Suppression sentinel exported by env-clear. While set in a shell, cli-invocation\n * auto-load stays silent (a deliberate clear must not be immediately re-loaded).\n * Lifted by a manual `env-load` or a new shell.\n */\nexport const INFRA_KIT_ENV_CLEARED_VAR = 'INFRA_KIT_ENV_CLEARED'\n\n/**\n * Matches a line of the form `KEY=...` where KEY is an env-var identifier\n * (letter or underscore, then word chars). Capture group 1 is the name. Shared\n * between env-load (validation, var counting) and parseVarNamesFromEnvFile.\n */\nexport const ENV_VAR_LINE_PATTERN = /^([A-Z_]\\w*)=/i\n\n/**\n * The `unset NAME` line env-clear.sh is made of and a manual env-load.sh ends with. Anchored at\n * both ends so a value that merely starts with the word is not a match.\n */\nconst UNSET_LINE_PATTERN = /^unset ([A-Z_]\\w*)$/i\n\n/**\n * Track whether a physical line leaves us inside an open single-quoted value,\n * mirroring how `shellSingleQuote` emits values (`'\u2026'`, with literal quotes as\n * `'\\''`). Outside a quote a backslash escapes the next char; inside a quote a\n * `'` closes it. Lets the parser skip the continuation lines of a multiline value.\n */\nconst advanceSingleQuoteState = (line: string, startInQuote: boolean): boolean => {\n  let inQuote = startInQuote\n\n  for (let i = 0; i < line.length; i++) {\n    if (!inQuote && line[i] === '\\\\') {\n      i++\n      continue\n    }\n\n    if (line[i] === \"'\") {\n      inQuote = !inQuote\n    }\n  }\n\n  return inQuote\n}\n\n/** One `KEY=value` assignment recovered from an env file, value already unescaped. */\nexport interface EnvAssignment {\n  name: string\n  value: string\n}\n\n/**\n * Undo {@link shellSingleQuote}: drop the wrapping quotes, then turn each `'\\''`\n * back into a literal `'`. Order matters \u2014 unescaping first would let an embedded\n * `'\\''` be mistaken for the closing quote.\n */\nconst decodeSingleQuoted = (raw: string): string => {\n  const withoutOpen = raw.startsWith(\"'\") ? raw.slice(1) : raw\n  const body = withoutOpen.endsWith(\"'\") ? withoutOpen.slice(0, -1) : withoutOpen\n\n  return body.split(\"'\\\\''\").join(\"'\")\n}\n\n/** File contents, or '' when the path is absent, a directory, or unreadable. */\nconst readEnvFileContent = (filePath: string): string => {\n  try {\n    return fs.readFileSync(filePath, 'utf-8')\n  } catch {\n    return ''\n  }\n}\n\n/**\n * Walk every assignment in an env-load.sh body, skipping the continuation lines of\n * multiline values. {@link parseVarNamesFromEnvFile}, {@link parseVarsFromEnvFile}\n * and {@link parseUnsetNamesFromEnvFile} all go through here, so they can never\n * disagree about where a value ends \u2014 an `unset X` inside a quoted value is a\n * continuation line to every one of them.\n */\nconst forEachAssignment = (\n  content: string,\n  visit: (assignment: EnvAssignment) => void,\n  visitUnset?: (name: string) => void,\n): void => {\n  // A trailing CR is stripped per line: a CRLF file would otherwise hand back values\n  // ending in '\\r' \u2014 a token that looks right in a diff and fails every request.\n  const lines = content.split('\\n').map((line) => {\n    return line.endsWith('\\r') ? line.slice(0, -1) : line\n  })\n  let index = 0\n  let inQuote = false\n\n  while (index < lines.length) {\n    const line = lines[index]!\n\n    // Only a line that starts OUTSIDE a quoted value can be a real assignment;\n    // continuation lines of a multiline secret value are skipped.\n    if (inQuote) {\n      inQuote = advanceSingleQuoteState(line, inQuote)\n      index += 1\n      continue\n    }\n\n    const match = ENV_VAR_LINE_PATTERN.exec(line)\n\n    if (!match) {\n      const unset = UNSET_LINE_PATTERN.exec(line)\n\n      if (unset) visitUnset?.(unset[1]!)\n\n      inQuote = advanceSingleQuoteState(line, false)\n      index += 1\n      continue\n    }\n\n    const name = match[1]!\n    const rest = line.slice(match[0].length)\n\n    // An unquoted value cannot span lines (`CONNECTION_STRING=host=db;user=admin`).\n    if (!rest.startsWith(\"'\")) {\n      visit({ name, value: rest })\n      inQuote = advanceSingleQuoteState(line, false)\n      index += 1\n      continue\n    }\n\n    const parts = [rest]\n    let open = advanceSingleQuoteState(rest, false)\n\n    while (open && index + 1 < lines.length) {\n      index += 1\n      const continuation = lines[index]!\n\n      parts.push(continuation)\n      open = advanceSingleQuoteState(continuation, true)\n    }\n\n    visit({ name, value: decodeSingleQuoted(parts.join('\\n')) })\n    inQuote = open\n    index += 1\n  }\n}\n\nexport const parseVarNamesFromEnvFile = (filePath: string): string[] => {\n  const names: string[] = []\n\n  forEachAssignment(readEnvFileContent(filePath), ({ name }) => {\n    names.push(name)\n  })\n\n  return names\n}\n\n/**\n * Same walk as {@link parseVarNamesFromEnvFile}, but keeping the values. Later\n * assignments win, matching what `source`ing the file would do.\n */\nexport const parseVarsFromEnvFile = (filePath: string): Record<string, string> => {\n  const vars: Record<string, string> = {}\n\n  forEachAssignment(readEnvFileContent(filePath), ({ name, value }) => {\n    vars[name] = value\n  })\n\n  return vars\n}\n\n/**\n * The names the file `unset`s \u2014 everything env-clear.sh does, and the marker lines a\n * manual env-load.sh ends with. Absent file \u2192 `[]`, like its siblings.\n */\nexport const parseUnsetNamesFromEnvFile = (filePath: string): string[] => {\n  const names: string[] = []\n\n  forEachAssignment(\n    readEnvFileContent(filePath),\n    () => {},\n    (name) => {\n      names.push(name)\n    },\n  )\n\n  return names\n}\n\n/**\n * Root cache dir for infra-kit across all sessions. Resolved from\n * $XDG_CACHE_HOME when set, falling back to ~/.cache/infra-kit. Keep in sync\n * with the shell block emitted by `infra-kit setup` (src/commands/init/init.ts).\n */\nexport const getCacheRoot = (): string => {\n  const xdg = process.env.XDG_CACHE_HOME\n  const base = xdg && xdg.length > 0 ? xdg : path.join(os.homedir(), '.cache')\n\n  return path.join(base, 'infra-kit')\n}\n\nexport const getSessionCacheDir = (): string => {\n  const session = process.env[INFRA_KIT_SESSION_VAR]\n\n  if (!session) {\n    throw new Error(\n      `${INFRA_KIT_SESSION_VAR} is not set. Run \\`infra-kit setup --skip-tools\\` then \\`source ~/.zshrc\\`.`,\n    )\n  }\n\n  return path.join(getCacheRoot(), session)\n}\n\n/**\n * The warm-cache key for a project: the hex SHA-256 of its CANONICAL (realpath'd)\n * directory. This MUST be byte-identical to the zsh block's\n * `printf %s \"$canon\" | shasum -a 256 | cut -c1-64` \u2014 same input string (no\n * trailing newline), same digest, full 64-hex output \u2014 or a warm file written by\n * node is never found by the shell. The shell passes the already-canonicalized\n * dir via `--project-dir`, so node hashes that VERBATIM (it does not re-resolve).\n */\nexport const warmCacheKey = (canonicalProjectDir: string): string => {\n  return crypto.createHash('sha256').update(canonicalProjectDir, 'utf8').digest('hex')\n}\n\n/** Root holding all project-scoped warm caches: `$cacheRoot/projects`. */\nexport const getWarmCacheRoot = (): string => {\n  return path.join(getCacheRoot(), WARM_CACHE_SUBDIR)\n}\n\n/** This project's warm-cache dir: `$cacheRoot/projects/<warmCacheKey>`. */\nexport const getProjectWarmCacheDir = (canonicalProjectDir: string): string => {\n  return path.join(getWarmCacheRoot(), warmCacheKey(canonicalProjectDir))\n}\n\n/**\n * Write content atomically: write to a pid-suffixed temp file in the same\n * directory, then rename. fs.renameSync is atomic on a single filesystem, so\n * concurrent writers can't produce a half-written secret file.\n */\nexport const atomicWriteFileSync = (filePath: string, content: string, mode: number): void => {\n  const tmpPath = `${filePath}.tmp.${process.pid}`\n\n  fs.writeFileSync(tmpPath, content, { mode })\n\n  try {\n    fs.renameSync(tmpPath, filePath)\n  } catch (error) {\n    fs.rmSync(tmpPath, { force: true })\n    throw error\n  }\n}\n\nexport const WORKTREES_DIR_SUFFIX = '-worktrees'\n// eslint-disable-next-line sonarjs/publicly-writable-directories\nexport const LOG_FILE_PATH = '/tmp/mcp-infra-kit.log'\n"],
-  "mappings": "AAAA,OAAOA,MAAY,cACnB,OAAOC,MAAQ,UACf,OAAOC,MAAQ,UACf,OAAOC,MAAU,YACjB,OAAOC,MAAa,eAEb,IAAMC,EAAgB,cAChBC,EAAiB,eAKjBC,EAAoB,WAUpBC,EAA2B,KAE3BC,EAAwB,oBAYxBC,EAAuB,aAQvBC,EAAoB,gBACpBC,EAA2B,uBAC3BC,EAA4B,wBAM5BC,EAAiC,6BACjCC,EAA8B,0BAO9BC,EAA+B,2BAM/BC,EAA4B,wBAO5BC,EAAuB,iBAM9BC,EAAqB,uBAQrBC,EAA0B,CAACC,EAAcC,IAAmC,CAChF,IAAIC,EAAUD,EAEd,QAASE,EAAI,EAAGA,EAAIH,EAAK,OAAQG,IAAK,CACpC,GAAI,CAACD,GAAWF,EAAKG,CAAC,IAAM,KAAM,CAChCA,IACA,QACF,CAEIH,EAAKG,CAAC,IAAM,MACdD,EAAU,CAACA,EAEf,CAEA,OAAOA,CACT,EAaME,EAAsBC,GAAwB,CAClD,IAAMC,EAAcD,EAAI,WAAW,GAAG,EAAIA,EAAI,MAAM,CAAC,EAAIA,EAGzD,OAFaC,EAAY,SAAS,GAAG,EAAIA,EAAY,MAAM,EAAG,EAAE,EAAIA,GAExD,MAAM,OAAO,EAAE,KAAK,GAAG,CACrC,EAGMC,EAAsBC,GAA6B,CACvD,GAAI,CACF,OAAO5B,EAAG,aAAa4B,EAAU,OAAO,CAC1C,MAAQ,CACN,MAAO,EACT,CACF,EASMC,EAAoB,CACxBC,EACAC,EACAC,IACS,CAGT,IAAMC,EAAQH,EAAQ,MAAM;AAAA,CAAI,EAAE,IAAKV,GAC9BA,EAAK,SAAS,IAAI,EAAIA,EAAK,MAAM,EAAG,EAAE,EAAIA,CAClD,EACGc,EAAQ,EACRZ,EAAU,GAEd,KAAOY,EAAQD,EAAM,QAAQ,CAC3B,IAAMb,EAAOa,EAAMC,CAAK,EAIxB,GAAIZ,EAAS,CACXA,EAAUH,EAAwBC,EAAME,CAAO,EAC/CY,GAAS,EACT,QACF,CAEA,IAAMC,EAAQlB,EAAqB,KAAKG,CAAI,EAE5C,GAAI,CAACe,EAAO,CACV,IAAMC,EAAQlB,EAAmB,KAAKE,CAAI,EAEtCgB,GAAOJ,IAAaI,EAAM,CAAC,CAAE,EAEjCd,EAAUH,EAAwBC,EAAM,EAAK,EAC7Cc,GAAS,EACT,QACF,CAEA,IAAMG,EAAOF,EAAM,CAAC,EACdG,EAAOlB,EAAK,MAAMe,EAAM,CAAC,EAAE,MAAM,EAGvC,GAAI,CAACG,EAAK,WAAW,GAAG,EAAG,CACzBP,EAAM,CAAE,KAAAM,EAAM,MAAOC,CAAK,CAAC,EAC3BhB,EAAUH,EAAwBC,EAAM,EAAK,EAC7Cc,GAAS,EACT,QACF,CAEA,IAAMK,EAAQ,CAACD,CAAI,EACfE,EAAOrB,EAAwBmB,EAAM,EAAK,EAE9C,KAAOE,GAAQN,EAAQ,EAAID,EAAM,QAAQ,CACvCC,GAAS,EACT,IAAMO,EAAeR,EAAMC,CAAK,EAEhCK,EAAM,KAAKE,CAAY,EACvBD,EAAOrB,EAAwBsB,EAAc,EAAI,CACnD,CAEAV,EAAM,CAAE,KAAAM,EAAM,MAAOb,EAAmBe,EAAM,KAAK;AAAA,CAAI,CAAC,CAAE,CAAC,EAC3DjB,EAAUkB,EACVN,GAAS,CACX,CACF,EAEaQ,EAA4Bd,GAA+B,CACtE,IAAMe,EAAkB,CAAC,EAEzB,OAAAd,EAAkBF,EAAmBC,CAAQ,EAAG,CAAC,CAAE,KAAAS,CAAK,IAAM,CAC5DM,EAAM,KAAKN,CAAI,CACjB,CAAC,EAEMM,CACT,EAMaC,EAAwBhB,GAA6C,CAChF,IAAMiB,EAA+B,CAAC,EAEtC,OAAAhB,EAAkBF,EAAmBC,CAAQ,EAAG,CAAC,CAAE,KAAAS,EAAM,MAAAS,CAAM,IAAM,CACnED,EAAKR,CAAI,EAAIS,CACf,CAAC,EAEMD,CACT,EAMaE,EAA8BnB,GAA+B,CACxE,IAAMe,EAAkB,CAAC,EAEzB,OAAAd,EACEF,EAAmBC,CAAQ,EAC3B,IAAM,CAAC,EACNS,GAAS,CACRM,EAAM,KAAKN,CAAI,CACjB,CACF,EAEOM,CACT,EAOaK,EAAe,IAAc,CACxC,IAAMC,EAAM9C,EAAQ,IAAI,eAClB+C,EAAOD,GAAOA,EAAI,OAAS,EAAIA,EAAM/C,EAAK,KAAKD,EAAG,QAAQ,EAAG,QAAQ,EAE3E,OAAOC,EAAK,KAAKgD,EAAM,WAAW,CACpC,EAEaC,EAAqB,IAAc,CAC9C,IAAMC,EAAUjD,EAAQ,IAAIK,CAAqB,EAEjD,GAAI,CAAC4C,EACH,MAAM,IAAI,MACR,GAAG5C,CAAqB,6EAC1B,EAGF,OAAON,EAAK,KAAK8C,EAAa,EAAGI,CAAO,CAC1C,EAUaC,EAAgBC,GACpBvD,EAAO,WAAW,QAAQ,EAAE,OAAOuD,EAAqB,MAAM,EAAE,OAAO,KAAK,EAIxEC,EAAmB,IACvBrD,EAAK,KAAK8C,EAAa,EAAG1C,CAAiB,EAIvCkD,EAA0BF,GAC9BpD,EAAK,KAAKqD,EAAiB,EAAGF,EAAaC,CAAmB,CAAC,EAQ3DG,EAAsB,CAAC7B,EAAkBE,EAAiB4B,IAAuB,CAC5F,IAAMC,EAAU,GAAG/B,CAAQ,QAAQzB,EAAQ,GAAG,GAE9CH,EAAG,cAAc2D,EAAS7B,EAAS,CAAE,KAAA4B,CAAK,CAAC,EAE3C,GAAI,CACF1D,EAAG,WAAW2D,EAAS/B,CAAQ,CACjC,OAASgC,EAAO,CACd,MAAA5D,EAAG,OAAO2D,EAAS,CAAE,MAAO,EAAK,CAAC,EAC5BC,CACR,CACF,EAEaC,EAAuB",
-  "names": ["crypto", "fs", "os", "path", "process", "ENV_LOAD_FILE", "ENV_CLEAR_FILE", "WARM_CACHE_SUBDIR", "DEFAULT_WARM_TTL_SECONDS", "INFRA_KIT_SESSION_VAR", "USER_CONFIG_DIR_NAME", "INFRA_KIT_ENV_VAR", "INFRA_KIT_ENV_CONFIG_VAR", "INFRA_KIT_ENV_PROJECT_VAR", "INFRA_KIT_ENV_PROJECT_ROOT_VAR", "INFRA_KIT_ENV_LOADED_AT_VAR", "INFRA_KIT_ENV_AUTOLOADED_VAR", "INFRA_KIT_ENV_CLEARED_VAR", "ENV_VAR_LINE_PATTERN", "UNSET_LINE_PATTERN", "advanceSingleQuoteState", "line", "startInQuote", "inQuote", "i", "decodeSingleQuoted", "raw", "withoutOpen", "readEnvFileContent", "filePath", "forEachAssignment", "content", "visit", "visitUnset", "lines", "index", "match", "unset", "name", "rest", "parts", "open", "continuation", "parseVarNamesFromEnvFile", "names", "parseVarsFromEnvFile", "vars", "value", "parseUnsetNamesFromEnvFile", "getCacheRoot", "xdg", "base", "getSessionCacheDir", "session", "warmCacheKey", "canonicalProjectDir", "getWarmCacheRoot", "getProjectWarmCacheDir", "atomicWriteFileSync", "mode", "tmpPath", "error", "WORKTREES_DIR_SUFFIX"]
-}