mfeflow 0.0.0-stage → 0.1.0

package/dist/index.js

@@ -0,0 +1,4154 @@
+import { stripVTControlCharacters } from "node:util";
+import { MfeflowError, PlanBuilder, applyPlan, dotenvKeys, findDiverged, findProjectRoot, getHttps, hasErrno, inOrder, isMfeflowError, loadFeature, loadProject, messageOf, parseFeature, readCappedText, realFs, recordPlan, renderDiff, renderTemplate, resolveFeature, runtimeConfigFiles, schemaKeys, serializeProject, summarize } from "@mfeflow/core";
+import { defineCommand, runCommand } from "citty";
+import node_path from "node:path";
+import { COST_MODEL, DOCS_URL, MFE_NAME, assetsFromManifest, isSafeRelativePath, judgeCost, round1, validateMfeManifest, validateRegistryEntry } from "@mfeflow/contracts";
+import promises from "node:fs/promises";
+import node_fs from "node:fs";
+import { createRequire } from "node:module";
+import semver from "semver";
+import { parse } from "yaml";
+import node_zlib from "node:zlib";
+import { spawn, spawnSync } from "node:child_process";
+import node_net from "node:net";
+import { fileURLToPath } from "node:url";
+import * as __rspack_external__clack_prompts_d2d5c36d from "@clack/prompts";
+const GLOBAL_ARGS = {
+    yes: {
+        type: 'boolean',
+        alias: 'y',
+        description: 'Take the defaults and never prompt'
+    },
+    preset: {
+        type: 'string',
+        description: 'Replay options from a JSON file or an https URL',
+        valueHint: 'file|url'
+    },
+    json: {
+        type: 'boolean',
+        description: 'Print one JSON document on stdout, nothing else'
+    },
+    'dry-run': {
+        type: 'boolean',
+        description: 'Print the summary and diff, write nothing'
+    },
+    cwd: {
+        type: 'string',
+        description: 'Run as if started in this folder',
+        valueHint: 'dir'
+    },
+    install: {
+        type: 'boolean',
+        default: true,
+        description: 'Run the package manager after writing (--no-install to skip)'
+    },
+    verbose: {
+        type: 'boolean',
+        description: 'Show package manager output and stack traces'
+    },
+    local: {
+        type: 'string',
+        description: 'Link @mfeflow/* from a built mfeflow checkout (env MFEFLOW_LOCAL)',
+        valueHint: 'path'
+    },
+    help: {
+        type: 'boolean',
+        alias: 'h',
+        description: 'Show this help'
+    }
+};
+function args_text(args, key) {
+    const value = args[key];
+    return 'string' == typeof value && '' !== value ? value : void 0;
+}
+function readGlobals(args, env, cwd, interactive = false) {
+    const folder = args_text(args, 'cwd');
+    const yes = true === args.yes;
+    const json = true === args.json;
+    return {
+        yes,
+        preset: args_text(args, 'preset'),
+        json,
+        dryRun: true === args['dry-run'],
+        cwd: void 0 === folder ? cwd : node_path.resolve(cwd, folder),
+        install: false !== args.install,
+        verbose: true === args.verbose,
+        local: args_text(args, 'local') ?? ('' === env.MFEFLOW_LOCAL ? void 0 : env.MFEFLOW_LOCAL),
+        canPrompt: interactive && !yes && !json
+    };
+}
+function flagNames(raw) {
+    const names = [];
+    for (const token of raw){
+        if ('--' === token) break;
+        if (!token.startsWith('-') || '-' === token) continue;
+        const body = token.replace(/^--?/, '').split('=')[0] ?? '';
+        names.push(body);
+    }
+    return names;
+}
+function assertKnownFlags(raw, defs) {
+    const known = new Set();
+    for (const [name, def] of Object.entries(defs))if ('positional' !== def.type) {
+        known.add(name);
+        if ('alias' in def) for (const alias of [
+            def.alias ?? []
+        ].flat())known.add(alias);
+        if ('boolean' === def.type) known.add(`no-${name}`);
+    }
+    for (const name of flagNames(raw))if (!known.has(name)) throw new MfeflowError('E107', `unknown flag "${1 === name.length ? '-' : '--'}${name}"`);
+}
+function repeated(raw, name) {
+    const values = [];
+    const flag = `--${name}`;
+    for (const [index, token] of raw.entries()){
+        if ('--' === token) break;
+        if (token === flag) {
+            const next = raw[index + 1];
+            if (void 0 !== next) values.push(next);
+        } else if (token.startsWith(`${flag}=`)) values.push(token.slice(flag.length + 1));
+    }
+    return values;
+}
+function splitList(value) {
+    if (void 0 === value) return;
+    const parts = 'string' == typeof value ? value.split(',') : value;
+    return parts.map((part)=>part.trim()).filter((part)=>'' !== part);
+}
+const FIRST_PARTY = [
+    {
+        name: 'core',
+        always: true,
+        default: true
+    },
+    {
+        name: 'tsconfig',
+        always: true,
+        default: true
+    },
+    {
+        name: 'lint-oxlint',
+        always: false,
+        default: true
+    },
+    {
+        name: 'url-factory',
+        always: false,
+        default: true
+    },
+    {
+        name: 'env-t3',
+        always: false,
+        default: true
+    },
+    {
+        name: 'testing',
+        always: false,
+        default: true
+    },
+    {
+        name: 'analytics-gtm',
+        always: false,
+        default: false
+    },
+    {
+        name: 'telemetry-otel',
+        always: false,
+        default: false
+    },
+    {
+        name: 'ci-github',
+        always: false,
+        default: false
+    },
+    {
+        name: 'git-hooks',
+        always: false,
+        default: false
+    }
+];
+function isFirstParty(name) {
+    return FIRST_PARTY.some((feature)=>feature.name === name);
+}
+const OPTIONAL_FEATURES = FIRST_PARTY.filter((f)=>!f.always).map((f)=>f.name);
+const DEFAULT_FEATURES = FIRST_PARTY.filter((f)=>!f.always && f.default).map((f)=>f.name);
+async function loadFirstParty(name, roots) {
+    if ('core' !== name) return loadFeature(name, {
+        featuresDir: roots.features
+    });
+    const dir = node_path.join(roots.templates, 'monorepo');
+    let text;
+    try {
+        text = await realFs.readFile(node_path.join(dir, 'feature.json'));
+    } catch (error) {
+        throw new MfeflowError('E201', `core (looked in ${dir})`, {
+            cause: error
+        });
+    }
+    return {
+        manifest: parseFeature(text, 'first-party', 'core/feature.json'),
+        trust: 'first-party',
+        readAsset: async (relative)=>{
+            if (!isSafeRelativePath(relative)) throw new MfeflowError('E105', `"${relative}"`);
+            return realFs.readFile(node_path.join(dir, ...relative.split('/')));
+        }
+    };
+}
+function loadAny(name, source) {
+    if (isFirstParty(name)) return loadFirstParty(name, source.roots);
+    return loadFeature(name, {
+        featuresDir: source.roots.features,
+        ...source.registries ? {
+            registries: source.registries
+        } : {},
+        ...source.fetch ? {
+            fetch: source.fetch
+        } : {},
+        ...void 0 === source.version ? {} : {
+            version: source.version
+        }
+    });
+}
+const RESERVED = new Set([
+    'root',
+    'shell',
+    'remotes'
+]);
+function assertAppName(name, apps = {}) {
+    if (!MFE_NAME.test(name)) throw new MfeflowError('E215', `"${name}" is not a Module Federation name`);
+    if (RESERVED.has(name)) throw new MfeflowError('E215', `"${name}" is a reserved name`);
+    if (name in apps) throw new MfeflowError('E215', `"${name}" is already an app`);
+}
+function usedPorts(project) {
+    return new Set(Object.values(project.apps).flatMap((app)=>void 0 === app.port ? [] : [
+            app.port
+        ]));
+}
+function freePort(project, start) {
+    const used = usedPorts(project);
+    let port = start;
+    while(used.has(port))port += 1;
+    return port;
+}
+function pascal(name) {
+    return name.split('_').map((part)=>part.charAt(0).toUpperCase() + part.slice(1)).join('');
+}
+function routeComponent(remote) {
+    return `${pascal(remote)}Route`;
+}
+const REGISTRY_ENVS = [
+    'dev',
+    'staging',
+    'prod'
+];
+const ENV_HOSTS = {
+    staging: 'https://staging.example.com',
+    prod: 'https://app.example.com'
+};
+async function glueTemplate(roots, file) {
+    return promises.readFile(node_path.join(roots.templates, 'monorepo', 'glue', file), 'utf8');
+}
+const asFeatureFile = (file)=>({
+        to: file.path,
+        content: file.content
+    });
+async function registryEntryFiles(roots, remote, envs = REGISTRY_ENVS) {
+    const { name, port } = remote;
+    const template = await glueTemplate(roots, 'registry-entry.json.eta');
+    const urls = {
+        dev: {
+            version: 'dev',
+            manifestUrl: `http://localhost:${String(port)}/mf-manifest.json`
+        },
+        staging: {
+            version: '0.0.0',
+            manifestUrl: `${ENV_HOSTS.staging}/mfe/${name}/mf-manifest.json`
+        },
+        prod: {
+            version: '0.0.0',
+            manifestUrl: `${ENV_HOSTS.prod}/mfe/${name}/mf-manifest.json`
+        }
+    };
+    return envs.flatMap((env)=>{
+        const entry = urls[env];
+        if (void 0 === entry) return [];
+        return [
+            {
+                path: `registry/envs/${env}/${name}.json`,
+                content: renderTemplate(template, {
+                    name,
+                    ...entry
+                }, `registry/${env}`)
+            }
+        ];
+    });
+}
+async function remoteGlue(options) {
+    const { name } = options.remote;
+    const files = [];
+    const transforms = [];
+    if (options.registry) files.push(...(await registryEntryFiles(options.roots, options.remote)).map(asFeatureFile));
+    if (options.shells.length > 0) {
+        const route = await glueTemplate(options.roots, 'route.tsx.eta');
+        const component = routeComponent(name);
+        for (const target of options.shells){
+            files.push({
+                to: `src/remotes/${name}.tsx`,
+                target,
+                content: renderTemplate(route, {
+                    name,
+                    component
+                }, 'route')
+            });
+            transforms.push({
+                op: 'add-route',
+                file: 'src/remotes/route-table.tsx',
+                target,
+                path: `/${name}`,
+                component,
+                from: `./${name}`
+            });
+        }
+    }
+    return {
+        manifest: {
+            name: 'core',
+            version: options.version,
+            files,
+            transforms
+        },
+        trust: 'first-party'
+    };
+}
+function partsForApp(feature, from, app) {
+    const { manifest } = feature;
+    const mine = (items)=>(items ?? []).filter((item)=>item.target === from).map((item)=>Object.assign({}, item, {
+                target: app
+            }));
+    const files = mine(manifest.files);
+    const dependencies = mine(manifest.dependencies);
+    const scripts = mine(manifest.scripts);
+    const transforms = mine(manifest.transforms);
+    if (files.length + dependencies.length + scripts.length + transforms.length === 0) return;
+    return {
+        ...feature,
+        manifest: {
+            name: manifest.name,
+            version: manifest.version,
+            ...manifest.prompts ? {
+                prompts: manifest.prompts
+            } : {},
+            files,
+            dependencies,
+            scripts,
+            transforms
+        }
+    };
+}
+function options_value(raw) {
+    if ('true' === raw) return true;
+    if ('false' === raw) return false;
+    return raw;
+}
+function parseFeatureOptions(flags) {
+    const out = {};
+    for (const flag of flags){
+        const equals = flag.indexOf('=');
+        const dot = flag.indexOf('.');
+        if (equals < 1 || dot < 1 || dot > equals - 1) throw new MfeflowError('E107', `--option "${flag}" must look like feature.key=value`);
+        const feature = flag.slice(0, dot);
+        const key = flag.slice(dot + 1, equals);
+        (out[feature] ??= {})[key] = options_value(flag.slice(equals + 1));
+    }
+    return out;
+}
+function mergeOptions(earlier, later) {
+    const out = {};
+    for (const source of [
+        earlier,
+        later
+    ])for (const [feature, given] of Object.entries(source))out[feature] = {
+        ...out[feature],
+        ...given
+    };
+    return out;
+}
+function assertOptionsAreForFeatures(options, features) {
+    for (const feature of Object.keys(options))if (!features.includes(feature)) throw new MfeflowError('E214', `options given for "${feature}", which is not one of the features in this run (${features.join(', ')})`);
+}
+const EXIT = {
+    ok: 0,
+    unexpected: 1,
+    usage: 2,
+    project: 3,
+    feature: 4,
+    build: 5,
+    registry: 6,
+    upgrade: 7,
+    cancelled: 130
+};
+class Cancelled extends Error {
+    constructor(){
+        super('Cancelled');
+        this.name = 'Cancelled';
+    }
+}
+const USAGE_ERRORS = new Set([
+    'MFEFLOW_E107',
+    'MFEFLOW_E215'
+]);
+const BY_RANGE = {
+    1: EXIT.project,
+    2: EXIT.feature,
+    3: EXIT.build,
+    4: EXIT.registry,
+    5: EXIT.upgrade
+};
+function exitCodeOfCode(code) {
+    if (USAGE_ERRORS.has(code)) return EXIT.usage;
+    return BY_RANGE[code.charAt(9)] ?? EXIT.unexpected;
+}
+function exitCodeFor(error) {
+    if (error instanceof Cancelled) return EXIT.cancelled;
+    if (!isMfeflowError(error)) return EXIT.unexpected;
+    return exitCodeOfCode(error.code);
+}
+function reportOf(error) {
+    return {
+        code: error.code,
+        message: error.message,
+        fix: error.fix,
+        docs: error.docs
+    };
+}
+function unexpectedReport(error) {
+    return {
+        code: 'UNEXPECTED',
+        message: messageOf(error),
+        fix: 'This is a bug in mfeflow. Run again with --verbose for the stack, and report it.',
+        docs: 'https://github.com/mfeflow/mfeflow/issues'
+    };
+}
+function unexpectedText(error, verbose) {
+    const stack = error instanceof Error && void 0 !== error.stack ? error.stack : messageOf(error);
+    return verbose ? stack : `Unexpected error: ${messageOf(error)}\n  Run again with --verbose for the stack.`;
+}
+async function runChecks(view, checks) {
+    const outcomes = await Promise.all(checks.map((check)=>check.run(view)));
+    const reports = checks.map((check, i)=>{
+        const outcome = outcomes[i] ?? {
+            findings: []
+        };
+        const hasError = outcome.findings.some((f)=>'error' === f.severity);
+        const status = void 0 !== outcome.skipped ? 'skipped' : hasError ? 'fail' : outcome.findings.length > 0 ? 'warn' : 'pass';
+        return {
+            id: check.id,
+            title: check.title,
+            status,
+            ...void 0 === outcome.skipped ? {} : {
+                skipped: outcome.skipped
+            },
+            findings: outcome.findings.length
+        };
+    });
+    return {
+        checks: reports,
+        findings: outcomes.flatMap((o)=>o.findings)
+    };
+}
+function summarizeReport(report, fixed) {
+    return {
+        errors: report.findings.filter((f)=>'error' === f.severity).length,
+        warnings: report.findings.filter((f)=>'warning' === f.severity).length,
+        skipped: report.checks.filter((c)=>'skipped' === c.status).length,
+        fixed
+    };
+}
+function exitForFindings(findings) {
+    const codes = findings.filter((f)=>'error' === f.severity).map((f)=>exitCodeOfCode(f.code));
+    return 0 === codes.length ? EXIT.ok : Math.min(...codes);
+}
+const MARK = {
+    pass: 'ok  ',
+    warn: 'warn',
+    fail: 'FAIL',
+    skipped: 'skip'
+};
+function formatReport(report, summary) {
+    const lines = report.checks.map((c)=>`${MARK[c.status]}  ${c.title}${void 0 === c.skipped ? '' : ` (${c.skipped})`}`);
+    for (const f of report.findings)lines.push('', `${'error' === f.severity ? 'error' : 'warning'} ${f.code} ${f.message}`, `  Fix: ${f.fix}${f.fixable ? ' (mfeflow doctor --fix)' : ''}`, `  ${f.docs}`);
+    lines.push('', `${String(summary.errors)} error(s), ${String(summary.warnings)} warning(s), ${String(summary.skipped)} skipped${summary.fixed > 0 ? `, ${String(summary.fixed)} fixed` : ''}`);
+    return lines.join('\n');
+}
+function planReport(plan) {
+    const features = new Map(plan.features.map((f)=>[
+            f.name,
+            f.version
+        ]));
+    return {
+        features: [
+            ...features
+        ].map(([name, version])=>({
+                name,
+                version
+            })),
+        changes: plan.changes.map((c)=>({
+                path: c.path,
+                action: c.action
+            })),
+        dependencies: plan.dependencies.map((d)=>({
+                ...d
+            })),
+        scripts: plan.scripts.map((s)=>({
+                file: s.file,
+                name: s.name,
+                command: s.command
+            })),
+        warnings: [
+            ...plan.warnings
+        ]
+    };
+}
+const isObj = (value)=>'object' == typeof value && null !== value && !Array.isArray(value);
+class Check {
+    issues = [];
+    add(path, message) {
+        this.issues.push({
+            path,
+            message
+        });
+    }
+    string(obj, key, at) {
+        if ('string' != typeof obj[key]) this.add(`${at}${key}`, 'must be text');
+    }
+    boolean(obj, key, at) {
+        if ('boolean' != typeof obj[key]) this.add(`${at}${key}`, 'must be true or false');
+    }
+    list(obj, key, at, each) {
+        const value = obj[key];
+        if (!Array.isArray(value)) return void this.add(`${at}${key}`, 'must be a list');
+        value.forEach((item, i)=>{
+            each(item, `${at}${key}[${String(i)}]`);
+        });
+    }
+    texts(obj, key, at) {
+        this.list(obj, key, at, (item, path)=>{
+            if ('string' != typeof item) this.add(path, 'must be text');
+        });
+    }
+    objects(obj, key, at, check) {
+        this.list(obj, key, at, (item, path)=>{
+            if (isObj(item)) check(item, `${path}.`);
+            else this.add(path, 'must be an object');
+        });
+    }
+}
+function checkPlan(c, plan) {
+    if (!isObj(plan)) return void c.add('plan', 'must be an object');
+    const at = 'plan.';
+    c.objects(plan, 'features', at, (f, p)=>{
+        c.string(f, 'name', p);
+        c.string(f, 'version', p);
+    });
+    c.objects(plan, 'changes', at, (f, p)=>{
+        c.string(f, 'path', p);
+        if (![
+            'create',
+            'patch',
+            'delete'
+        ].includes(String(f.action))) c.add(`${p}action`, 'must be create, patch or delete');
+    });
+    c.objects(plan, 'dependencies', at, (d, p)=>{
+        for (const key of [
+            'file',
+            'name',
+            'range'
+        ])c.string(d, key, p);
+        c.boolean(d, 'dev', p);
+    });
+    c.objects(plan, "scripts", at, (s, p)=>{
+        for (const key of [
+            'file',
+            'name',
+            'command'
+        ])c.string(s, key, p);
+    });
+    c.texts(plan, 'warnings', at);
+}
+function checkWrite(c, value) {
+    c.boolean(value, 'dryRun', '');
+    c.string(value, 'root', '');
+    checkPlan(c, value.plan);
+    c.texts(value, 'written', '');
+    c.boolean(value, 'installed', '');
+    if (void 0 !== value.diff && 'string' != typeof value.diff) c.add('diff', 'must be text');
+    if (true === value.dryRun && 'string' != typeof value.diff) c.add('diff', 'is required for a dry run');
+    if (true === value.dryRun && Array.isArray(value.written) && value.written.length > 0) c.add('written', 'must be empty for a dry run');
+}
+function checkReport(c, value) {
+    c.string(value, 'root', '');
+    const summary = value.summary;
+    if (isObj(summary)) {
+        for (const key of [
+            'errors',
+            'warnings',
+            'skipped',
+            'fixed'
+        ])if ('number' != typeof summary[key]) c.add(`summary.${key}`, 'must be a number');
+    } else c.add('summary', 'must be an object');
+    c.objects(value, 'checks', '', (check, p)=>{
+        for (const key of [
+            'id',
+            'title'
+        ])c.string(check, key, p);
+        if (![
+            'pass',
+            'warn',
+            'fail',
+            'skipped'
+        ].includes(String(check.status))) c.add(`${p}status`, 'must be pass, warn, fail or skipped');
+        if ('number' != typeof check.findings) c.add(`${p}findings`, 'must be a number');
+    });
+    c.objects(value, 'findings', '', (f, p)=>{
+        for (const key of [
+            'code',
+            'check',
+            'message',
+            'fix',
+            'docs'
+        ])c.string(f, key, p);
+        if ('error' !== f.severity && 'warning' !== f.severity) c.add(`${p}severity`, 'must be error or warning');
+        c.boolean(f, 'fixable', p);
+    });
+    if (value.ok !== (isObj(summary) && 0 === summary.errors)) c.add('ok', 'must be true exactly when there are no errors');
+}
+function checkBudget(c, value) {
+    c.string(value, 'root', '');
+    const model = value.model;
+    if (isObj(model)) {
+        for (const key of [
+            'lcpDeltaMs',
+            'shellKb',
+            'remoteKb'
+        ])if ('number' != typeof model[key]) c.add(`model.${key}`, 'must be a number');
+    } else c.add('model', 'must be an object');
+    c.objects(value, 'shells', '', (s, p)=>{
+        c.string(s, 'name', p);
+        for (const key of [
+            'initialKb',
+            "scripts"
+        ])if ('number' != typeof s[key]) c.add(`${p}${key}`, 'must be a number');
+    });
+    c.objects(value, 'remotes', '', (r, p)=>{
+        c.string(r, 'name', p);
+        c.boolean(r, 'pass', p);
+        for (const key of [
+            'entryKb',
+            'budgetKb'
+        ])if ('number' != typeof r[key]) c.add(`${p}${key}`, 'must be a number');
+        c.objects(r, 'routes', p, (route, q)=>{
+            c.string(route, 'route', q);
+            if ('number' != typeof route.kb) c.add(`${q}kb`, 'must be a number');
+        });
+    });
+    c.objects(value, 'findings', '', (f, p)=>{
+        for (const key of [
+            'code',
+            'message',
+            'fix',
+            'docs'
+        ])c.string(f, key, p);
+    });
+}
+function validateResult(value) {
+    const c = new Check();
+    if (!isObj(value)) {
+        c.add('', 'must be an object');
+        return c.issues;
+    }
+    if (false === value.ok && void 0 === value.command) {
+        if (isObj(value.error)) for (const key of [
+            'code',
+            'message',
+            'fix',
+            'docs'
+        ])c.string(value.error, key, 'error.');
+        else c.add('error', 'must be an object');
+        if ('number' != typeof value.exitCode) c.add('exitCode', 'must be a number');
+        return c.issues;
+    }
+    if ('boolean' != typeof value.ok) c.add('ok', 'must be true or false');
+    switch(value.command){
+        case 'init':
+            checkWrite(c, value);
+            c.string(value, 'scope', '');
+            c.texts(value, 'next', '');
+            c.objects(value, 'apps', '', (app, p)=>{
+                c.string(app, 'name', p);
+                c.string(app, 'path', p);
+                if ('shell' !== app.kind && 'remote' !== app.kind) c.add(`${p}kind`, 'must be shell or remote');
+                if (null !== app.port && 'number' != typeof app.port) c.add(`${p}port`, 'must be a number or null');
+            });
+            break;
+        case 'add':
+            checkWrite(c, value);
+            if (![
+                'remote',
+                'shell',
+                'feature',
+                'env-key'
+            ].includes(String(value.kind))) c.add('kind', 'must be remote, shell, feature or env-key');
+            c.texts(value, 'added', '');
+            c.texts(value, 'skipped', '');
+            break;
+        case 'features':
+            if (null !== value.search && 'string' != typeof value.search) c.add('search', 'must be text or null');
+            c.objects(value, 'features', '', (f, p)=>{
+                for (const key of [
+                    'name',
+                    'version',
+                    "description"
+                ])c.string(f, key, p);
+                for (const key of [
+                    'always',
+                    'default',
+                    'installed'
+                ])c.boolean(f, key, p);
+            });
+            break;
+        case 'doctor':
+        case 'validate':
+        case 'check-compat':
+            checkReport(c, value);
+            break;
+        case 'budget':
+            checkBudget(c, value);
+            break;
+        case 'dev':
+            c.string(value, 'root', '');
+            c.string(value, 'registry', '');
+            c.boolean(value, 'dryRun', '');
+            c.boolean(value, 'interrupted', '');
+            c.objects(value, 'apps', '', (app, p)=>{
+                c.string(app, 'name', p);
+                c.string(app, 'command', p);
+                if ('started' !== app.status && 'overridden' !== app.status) c.add(`${p}status`, 'must be started or overridden');
+            });
+            if (!isObj(value.overrides)) c.add('overrides', 'must be an object');
+            break;
+        default:
+            c.add('command', 'must be init, add, features, doctor, validate, check-compat, budget or dev');
+    }
+    return c.issues;
+}
+function exitOf(result) {
+    if ('findings' in result) return exitForFindings(result.findings);
+    if (result.ok && 'interrupted' in result && result.interrupted) return EXIT.cancelled;
+    return result.ok ? EXIT.ok : EXIT.unexpected;
+}
+const PLACEHOLDER_RANGE = 'latest';
+const PREFIX = '@mfeflow/';
+const CLI = 'mfeflow';
+const isOwn = (name)=>name === CLI || name.startsWith(PREFIX);
+function posix(file) {
+    return file.split(node_path.sep).join('/');
+}
+function realpathLoose(file) {
+    try {
+        return node_fs.realpathSync.native(file);
+    } catch  {
+        const parent = node_path.dirname(file);
+        return parent === file ? file : node_path.join(realpathLoose(parent), node_path.basename(file));
+    }
+}
+function readName(dir) {
+    const file = node_path.join(dir, 'package.json');
+    if (!node_fs.existsSync(file)) return;
+    const pkg = JSON.parse(node_fs.readFileSync(file, 'utf8'));
+    if ('object' != typeof pkg || null === pkg || !('name' in pkg) || 'string' != typeof pkg.name) return;
+    const needsBuild = JSON.stringify('exports' in pkg ? pkg.exports : '').includes('./dist/');
+    return {
+        name: pkg.name,
+        built: !needsBuild || node_fs.existsSync(node_path.join(dir, 'dist'))
+    };
+}
+function scanCheckout(checkout) {
+    const packages = node_path.join(checkout, 'packages');
+    if (!node_fs.existsSync(packages)) throw new MfeflowError('E110', `${checkout} has no packages/ folder`);
+    const found = new Map();
+    for (const entry of node_fs.readdirSync(packages, {
+        withFileTypes: true
+    })){
+        if (!entry.isDirectory()) continue;
+        const dir = node_path.join(packages, entry.name);
+        const info = readName(dir);
+        if (info && isOwn(info.name)) found.set(info.name, {
+            dir,
+            built: info.built
+        });
+    }
+    return found;
+}
+function createRangeRewriter(version, local) {
+    const packages = void 0 === local ? void 0 : scanCheckout(node_path.resolve(local));
+    if (packages) {
+        const unbuilt = [
+            ...packages
+        ].filter(([, p])=>!p.built).map(([name])=>name);
+        if (unbuilt.length > 0) throw new MfeflowError('E110', `${unbuilt.join(', ')} ${unbuilt.length > 1 ? 'have' : 'has'} no dist/ yet`);
+    }
+    return (name, range)=>{
+        if (!isOwn(name) || range !== PLACEHOLDER_RANGE) return;
+        if (!packages) return `^${version}`;
+        const found = packages.get(name);
+        if (!found) throw new MfeflowError('E110', `${name} is not in ${local ?? ''}/packages`);
+        return `link:${posix(found.dir)}`;
+    };
+}
+const LOCAL_NONE = 'none';
+function chooseLocal(project, root, cwd, flag) {
+    const { local: recorded, ...rest } = project;
+    const realRoot = realpathLoose(root);
+    if (flag === LOCAL_NONE) return {
+        checkout: void 0,
+        project: rest
+    };
+    if (void 0 === flag) return {
+        checkout: void 0 === recorded ? void 0 : node_path.resolve(realRoot, recorded),
+        project
+    };
+    const checkout = realpathLoose(node_path.resolve(cwd, flag));
+    const relative = node_path.relative(realRoot, checkout);
+    if ('' === relative) throw new MfeflowError('E107', `--local ${flag} is the project itself`);
+    const local = posix(node_path.isAbsolute(relative) ? checkout : relative);
+    return {
+        checkout,
+        project: {
+            ...rest,
+            local
+        }
+    };
+}
+function isPackageJson(value) {
+    return 'object' == typeof value && null !== value && 'name' in value && 'version' in value && 'string' == typeof value.name && 'string' == typeof value.version;
+}
+function readPackageJson() {
+    const require = createRequire(import.meta.url);
+    const pkg = require('../package.json');
+    if (!isPackageJson(pkg)) throw new Error('package.json is missing a name or version');
+    return pkg;
+}
+function projectReader(root) {
+    return async (file)=>{
+        try {
+            return await promises.readFile(node_path.join(root, ...file.split('/')), 'utf8');
+        } catch (error) {
+            if (hasErrno(error, 'ENOENT') || hasErrno(error, 'ENOTDIR')) return;
+            throw error;
+        }
+    };
+}
+function createBuilder(root, checkout) {
+    return new PlanBuilder(projectReader(root), {
+        catalog: true,
+        rewriteRange: createRangeRewriter(readPackageJson().version, checkout)
+    });
+}
+function withProjectChange(plan, project) {
+    const before = plan.projectBefore ?? null;
+    const after = serializeProject(recordPlan(project, plan));
+    if (before === after) return plan;
+    return {
+        ...plan,
+        changes: [
+            ...plan.changes,
+            {
+                path: 'mfeflow.json',
+                action: null === before ? 'create' : 'patch',
+                before,
+                after,
+                track: false,
+                trust: 'first-party'
+            }
+        ]
+    };
+}
+async function missingFolders(root) {
+    const missing = [];
+    let dir = root;
+    while(!await write_exists(dir)){
+        missing.push(dir);
+        const parent = node_path.dirname(dir);
+        if (parent === dir) break;
+        dir = parent;
+    }
+    return missing;
+}
+async function removeCreated(missing) {
+    const [root, ...parents] = missing;
+    if (void 0 === root) return;
+    try {
+        await promises.rm(root, {
+            recursive: true,
+            force: true
+        });
+    } catch (error) {
+        return messageOf(error);
+    }
+    for (const dir of parents)try {
+        await promises.rmdir(dir);
+    } catch  {
+        break;
+    }
+}
+async function removeContents(root) {
+    try {
+        const entries = await promises.readdir(root);
+        await Promise.all(entries.map((entry)=>promises.rm(node_path.join(root, entry), {
+                recursive: true,
+                force: true
+            })));
+    } catch (error) {
+        return messageOf(error);
+    }
+}
+async function isEmptyFolder(dir) {
+    try {
+        return 0 === (await promises.readdir(dir)).length;
+    } catch  {
+        return false;
+    }
+}
+function installFailed(error, root, stuck, emptied) {
+    const reason = messageOf(error.cause ?? error);
+    if (void 0 !== stuck) return new MfeflowError('E213', `${reason}; could not clean up ${root} (${stuck})`, {
+        cause: error.cause,
+        fix: `Delete what is inside ${root} by hand, check your network and package manager, then run the command again.`
+    });
+    return new MfeflowError('E213', `${reason}; ${emptied ? 'emptied the folder' : 'removed the new folder'} ${root}`, {
+        cause: error.cause,
+        fix: 'Nothing was left behind. Check your network and package manager, then run the command again.'
+    });
+}
+async function write_exists(dir) {
+    try {
+        await promises.access(dir);
+        return true;
+    } catch  {
+        return false;
+    }
+}
+async function writePlan(request) {
+    const { rt, globals, root, plan, project } = request;
+    const shown = withProjectChange(plan, project);
+    if (!globals.json) {
+        rt.io.stdout(summarize(shown));
+        if (globals.dryRun || globals.verbose) rt.io.stdout(`\n${renderDiff(shown)}`);
+    }
+    if (globals.dryRun) {
+        if (await write_exists(root)) await applyPlan(plan, {
+            root,
+            project,
+            dryRun: true
+        });
+        return {
+            dryRun: true,
+            shown,
+            written: [],
+            installed: false,
+            diff: renderDiff(shown)
+        };
+    }
+    if (globals.canPrompt && !await rt.prompter.confirm({
+        message: 'Write these changes?'
+    })) throw new Cancelled();
+    const installing = globals.install && plan.dependencies.length > 0;
+    const missing = await missingFolders(root);
+    const wasEmpty = 0 === missing.length && await isEmptyFolder(root);
+    const gitDir = node_path.join(root, '.git');
+    let madeGit = false;
+    await promises.mkdir(root, {
+        recursive: true
+    });
+    let result;
+    try {
+        result = await applyPlan(plan, {
+            root,
+            project,
+            ...installing ? {
+                install: async ()=>{
+                    madeGit = void 0 !== request.afterWrite && !await write_exists(gitDir);
+                    await request.afterWrite?.();
+                    await rt.system.install(root, project.packageManager, globals.verbose);
+                }
+            } : {}
+        });
+    } catch (error) {
+        if (madeGit) await promises.rm(gitDir, {
+            recursive: true,
+            force: true
+        }).catch(()=>void 0);
+        const stuck = wasEmpty ? await removeContents(root) : await removeCreated(missing);
+        const cleaned = missing.length > 0 || wasEmpty;
+        if (cleaned && isMfeflowError(error) && 'MFEFLOW_E213' === error.code) throw installFailed(error, root, stuck, wasEmpty);
+        throw error;
+    }
+    if (!installing) await request.afterWrite?.();
+    return {
+        dryRun: false,
+        shown,
+        written: result.written,
+        installed: installing
+    };
+}
+const KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const GROUPS = [
+    'root',
+    'shell',
+    'remotes'
+];
+function groupOf(value) {
+    if (void 0 === value) return;
+    const group = GROUPS.find((g)=>g === value);
+    if (void 0 === group) throw new MfeflowError('E107', '--group must be root, shell or remotes');
+    return group;
+}
+const exactApp = (name)=>`app:${name}`;
+function serverTargets(project, app, group) {
+    if (void 0 !== app) {
+        if (!(app in project.apps)) throw new MfeflowError('E107', `--app ${app} is not an app (${Object.keys(project.apps).join(', ')})`);
+        return [
+            exactApp(app)
+        ];
+    }
+    const kinds = new Set(Object.values(project.apps).map((a)=>a.kind));
+    if (void 0 === group) {
+        const targets = [
+            ...kinds.has('shell') ? [
+                'shell'
+            ] : [],
+            ...kinds.has('remote') ? [
+                'remotes'
+            ] : []
+        ];
+        if (0 === targets.length) throw new MfeflowError('E107', 'the project has no app to add a key to');
+        return targets;
+    }
+    if ('shell' === group && !kinds.has('shell')) throw new MfeflowError('E107', 'the project has no shell to add a key to');
+    if ('remotes' === group && !kinds.has('remote')) throw new MfeflowError('E107', 'the project has no remotes to add a key to');
+    return [
+        group
+    ];
+}
+function runtimeTargets(project, app, group) {
+    const shells = Object.entries(project.apps).filter(([, a])=>'shell' === a.kind).map(([name, a])=>({
+            name,
+            path: a.path
+        }));
+    if (void 0 !== app) {
+        const shell = shells.find((s)=>s.name === app);
+        if (void 0 === shell) throw new MfeflowError('E107', `--app ${app} is not a shell; runtime config lives in a shell (${shells.map((s)=>s.name).join(', ')})`);
+        return [
+            {
+                target: exactApp(app),
+                path: shell.path
+            }
+        ];
+    }
+    if (void 0 !== group && 'shell' !== group) throw new MfeflowError('E107', `--group ${group} has no runtime config; it lives in a shell`);
+    return shells.map((s)=>({
+            target: exactApp(s.name),
+            path: s.path
+        }));
+}
+async function configFilesOf(root, dir) {
+    const folder = node_path.join(root, ...dir.split('/'), 'public', 'config');
+    return (await runtimeConfigFiles(folder)).map((name)=>`public/config/${name}`);
+}
+function envKeyOp(input) {
+    const { target, key, scope, schema, value, configFiles } = input;
+    const op = {
+        op: 'add-env-key',
+        file: 'server' === scope ? 'env.ts' : 'src/config/schema.ts',
+        target,
+        key,
+        scope,
+        schema
+    };
+    if (void 0 !== value) op.value = value;
+    if ('runtime' === scope) op.configFiles = configFiles;
+    return op;
+}
+async function addEnvKey(rt, globals, args, key) {
+    const scope = args_text(args, 'scope');
+    const schema = args_text(args, 'schema');
+    if (void 0 === key || !KEY.test(key)) throw new MfeflowError('E107', 'add env-key needs a key like API_ORIGIN: mfeflow add env-key <KEY>');
+    if ('server' !== scope && 'runtime' !== scope) throw new MfeflowError('E107', '--scope must be server or runtime');
+    if (void 0 === schema) throw new MfeflowError('E107', '--schema is required, for example --schema "z.url()"');
+    const root = await findProjectRoot(globals.cwd);
+    const chosen = chooseLocal(await loadProject(root), root, globals.cwd, args_text(args, 'local'));
+    const { project } = chosen;
+    const installed = project.features['env-t3'];
+    if (void 0 === installed) throw new MfeflowError('E206', 'add env-key needs env-t3; run `mfeflow add env-t3` first');
+    const value = args_text(args, 'value');
+    const app = args_text(args, 'app');
+    const group = groupOf(args_text(args, 'group'));
+    if (void 0 !== app && void 0 !== group) throw new MfeflowError('E107', '--app and --group cannot be used together');
+    const targets = 'server' === scope ? serverTargets(project, app, group).map((target)=>({
+            target,
+            path: ''
+        })) : runtimeTargets(project, app, group);
+    const transforms = await Promise.all(targets.map(async ({ target, path: dir })=>envKeyOp({
+            target,
+            key,
+            scope,
+            schema,
+            value,
+            configFiles: 'runtime' === scope ? await configFilesOf(root, dir) : []
+        })));
+    const builder = createBuilder(root, chosen.checkout);
+    await resolveFeature({
+        feature: {
+            manifest: {
+                name: 'env-t3',
+                version: installed.version,
+                transforms
+            },
+            trust: 'first-party'
+        },
+        project,
+        builder
+    });
+    const plan = {
+        ...builder.build(),
+        features: []
+    };
+    const outcome = await writePlan({
+        rt,
+        globals: {
+            ...globals,
+            install: false
+        },
+        root,
+        plan,
+        project
+    });
+    const result = {
+        ok: true,
+        command: 'add',
+        kind: 'env-key',
+        dryRun: outcome.dryRun,
+        root,
+        added: 0 === plan.changes.length ? [] : [
+            key
+        ],
+        skipped: 0 === plan.changes.length ? [
+            key
+        ] : [],
+        plan: planReport(outcome.shown),
+        written: outcome.written,
+        installed: false,
+        ...void 0 === outcome.diff ? {} : {
+            diff: outcome.diff
+        }
+    };
+    if (!globals.json) if (outcome.dryRun) rt.io.stdout('\nDry run: nothing was written.');
+    else rt.io.stdout(0 === plan.changes.length ? `${key} is already in the ${scope} schema; nothing to do.` : `Added ${key} to the ${scope} schema${'runtime' === scope ? ' and the runtime-config files' : ' and .env.example'}.`);
+    return result;
+}
+const MAX_BYTES = 100000;
+const KEYS = new Set([
+    '$schema',
+    'scope',
+    'remotes',
+    'features',
+    'packageManager',
+    'topology',
+    'options'
+]);
+function bad(source, why) {
+    throw new MfeflowError('E109', `${source}: ${why}`);
+}
+function isRecord(value) {
+    return 'object' == typeof value && null !== value && !Array.isArray(value);
+}
+function stringList(source, key, value) {
+    if (!Array.isArray(value) || !value.every((item)=>'string' == typeof item)) bad(source, `${key} must be a list of text`);
+    return value;
+}
+function optionsOf(source, value) {
+    if (!isRecord(value)) bad(source, 'options must be an object of feature names');
+    const out = {};
+    for (const [feature, given] of Object.entries(value)){
+        if (!isRecord(given)) bad(source, `options.${feature} must be an object`);
+        out[feature] = given;
+    }
+    return out;
+}
+function parsePreset(source, value) {
+    if (!isRecord(value)) bad(source, 'must be a JSON object');
+    const preset = {};
+    for (const [key, item] of Object.entries(value)){
+        if (!KEYS.has(key)) bad(source, `"${key}" is not a preset option`);
+        if ('scope' === key || 'packageManager' === key || 'topology' === key) {
+            if ('string' != typeof item) bad(source, `${key} must be text`);
+            preset[key] = item;
+        } else if ('remotes' === key || 'features' === key) preset[key] = stringList(source, key, item);
+        else if ('options' === key) preset.options = optionsOf(source, item);
+    }
+    return preset;
+}
+async function readUrl(url, fetchImpl) {
+    const response = await getHttps(url, fetchImpl, 'E109');
+    if (!response.ok) bad(url, `answered ${String(response.status)}`);
+    return readCappedText(response, MAX_BYTES, ()=>new MfeflowError('E109', `${url}: is larger than 100 KB`));
+}
+async function loadPreset(source, sources) {
+    let text;
+    if (/^https?:\/\//i.test(source)) {
+        if (!source.toLowerCase().startsWith('https://')) bad(source, 'must be https');
+        text = await readUrl(source, sources.fetch);
+    } else {
+        const file = node_path.resolve(sources.cwd, source);
+        try {
+            text = await (sources.readFile ?? ((f)=>promises.readFile(f, 'utf8')))(file);
+        } catch (error) {
+            throw new MfeflowError('E109', `${file}: ${messageOf(error)}`, {
+                cause: error
+            });
+        }
+    }
+    let value;
+    try {
+        value = JSON.parse(text);
+    } catch (error) {
+        throw new MfeflowError('E109', `${source}: not valid JSON (${messageOf(error)})`, {
+            cause: error
+        });
+    }
+    return parsePreset(source, value);
+}
+const ADD_ARGS = {
+    port: {
+        type: 'string',
+        description: 'Dev server port for a new app (default: the next free one)',
+        valueHint: 'n'
+    },
+    option: {
+        type: 'string',
+        description: 'A feature option, repeatable: --option feature.key=value',
+        valueHint: 'f.k=v'
+    },
+    scope: {
+        type: 'string',
+        description: 'add env-key: server (env.ts, .env.example) or runtime (runtime-config files)',
+        valueHint: 'server|runtime'
+    },
+    schema: {
+        type: 'string',
+        description: 'add env-key: the validator expression, like "z.url()"',
+        valueHint: 'expr'
+    },
+    value: {
+        type: 'string',
+        description: 'add env-key: the placeholder written to .env.example or the config files',
+        valueHint: 'text'
+    },
+    app: {
+        type: 'string',
+        description: 'add env-key: exactly this app (default: every app; runtime: every shell)',
+        valueHint: 'name'
+    },
+    group: {
+        type: 'string',
+        description: 'add env-key: root, every shell or every remote, instead of --app',
+        valueHint: 'root|shell|remotes'
+    },
+    ...GLOBAL_ARGS
+};
+function portFor(args, project, start) {
+    const given = args.port;
+    if ('string' != typeof given || '' === given) return freePort(project, start);
+    const port = Number(given);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) throw new MfeflowError('E107', `--port "${given}" must be a whole number from 1 to 65535`);
+    const owner = Object.entries(project.apps).find(([, app])=>app.port === port);
+    if (owner) throw new MfeflowError('E107', `--port ${given} is already used by ${owner[0]}`);
+    return port;
+}
+async function nameFrom(rt, globals, given, what) {
+    if (void 0 !== given) return given;
+    if (globals.canPrompt) return rt.prompter.text({
+        message: `Name of the new ${what}`
+    });
+    throw new MfeflowError('E107', `add ${what} needs a name: mfeflow add ${what} <name>`);
+}
+async function addAppParts(rt, globals, builder, project, next, kind, name) {
+    const names = [
+        'core',
+        ...Object.keys(project.features).filter((n)=>'core' !== n)
+    ];
+    const { canPrompt } = globals;
+    const loadedAll = await Promise.all(names.map((feature)=>loadAny(feature, {
+            roots: rt.roots,
+            registries: project.registries,
+            fetch: rt.fetch,
+            version: project.features[feature]?.version
+        })));
+    let core;
+    const fromRegistry = [];
+    const planned = [];
+    names.forEach((feature, index)=>{
+        const loaded = loadedAll[index];
+        if (void 0 === loaded) return;
+        if ('core' === feature) core = loaded;
+        const recorded = project.features[feature]?.version;
+        const parts = partsForApp(loaded, kind, name);
+        if (!parts) return;
+        if ('third-party' === loaded.trust) {
+            if (void 0 !== recorded && loaded.manifest.version !== recorded) throw new MfeflowError('E401', `${feature} is installed at ${recorded} but the registry now serves ${loaded.manifest.version}`, {
+                fix: `Nothing was written. Use a registry URL with {version} so ${recorded} can be fetched, or add the app by hand.`
+            });
+            fromRegistry.push(feature);
+        }
+        planned.push({
+            feature,
+            parts
+        });
+    });
+    assertThirdPartyAllowed(fromRegistry, globals, canPrompt);
+    await inOrder(planned, ({ feature, parts })=>resolveFeature({
+            feature: parts,
+            project: next,
+            builder,
+            options: project.features[feature]?.options ?? {}
+        }));
+    if (void 0 === core) throw new MfeflowError('E201', 'core');
+    return core;
+}
+async function addApp(rt, globals, args, kind, given) {
+    const root = await findProjectRoot(globals.cwd);
+    const chosen = chooseLocal(await loadProject(root), root, globals.cwd, args_text(args, 'local'));
+    const { project } = chosen;
+    const name = await nameFrom(rt, globals, given, kind);
+    assertAppName(name, project.apps);
+    const port = portFor(args, project, 'remote' === kind ? 4311 : 4300);
+    const next = {
+        ...project,
+        apps: {
+            ...project.apps,
+            [name]: {
+                kind,
+                path: `apps/${name}`,
+                port
+            }
+        }
+    };
+    const builder = createBuilder(root, chosen.checkout);
+    const core = await addAppParts(rt, globals, builder, project, next, 'remote' === kind ? 'remotes' : 'shell', name);
+    const version = core.manifest.version;
+    if ('remote' === kind) await resolveFeature({
+        feature: await remoteGlue({
+            roots: rt.roots,
+            version,
+            remote: {
+                name,
+                port
+            },
+            registry: true,
+            shells: [
+                'shell'
+            ]
+        }),
+        project: next,
+        builder
+    });
+    else await inOrder(Object.entries(project.apps), async ([remote, app])=>{
+        if ('remote' !== app.kind || void 0 === app.port) return;
+        await resolveFeature({
+            feature: await remoteGlue({
+                roots: rt.roots,
+                version,
+                remote: {
+                    name: remote,
+                    port: app.port
+                },
+                registry: false,
+                shells: [
+                    name
+                ]
+            }),
+            project: next,
+            builder
+        });
+    });
+    const plan = {
+        ...builder.build(),
+        features: []
+    };
+    const outcome = await writePlan({
+        rt,
+        globals,
+        root,
+        plan,
+        project: next
+    });
+    return finish(rt, globals, root, kind, [
+        name
+    ], [], outcome);
+}
+function finish(rt, globals, root, kind, added, skipped, outcome) {
+    const result = {
+        ok: true,
+        command: 'add',
+        kind,
+        dryRun: outcome.dryRun,
+        root,
+        added,
+        skipped,
+        plan: planReport(outcome.shown),
+        written: outcome.written,
+        installed: outcome.installed,
+        ...void 0 === outcome.diff ? {} : {
+            diff: outcome.diff
+        }
+    };
+    if (!globals.json) if (outcome.dryRun) rt.io.stdout('\nDry run: nothing was written.');
+    else rt.io.stdout(`\nAdded ${added.join(', ')}${'feature' === kind ? '' : ` (${kind})`}.`);
+    return result;
+}
+async function askOptions(rt, feature, given, canPrompt) {
+    const answers = {
+        ...given
+    };
+    if (!canPrompt) return answers;
+    await inOrder(feature.manifest.prompts ?? [], async (prompt)=>{
+        if (prompt.name in answers) return;
+        const message = prompt.message ?? prompt.name;
+        const initial = 'string' == typeof prompt.default ? {
+            initialValue: prompt.default
+        } : {};
+        if ('boolean' === prompt.type) answers[prompt.name] = await rt.prompter.confirm({
+            message,
+            initialValue: true === prompt.default
+        });
+        else if ('select' === prompt.type) answers[prompt.name] = await rt.prompter.select({
+            message,
+            choices: (prompt.choices ?? []).map((c)=>({
+                    value: c,
+                    label: c
+                })),
+            ...initial
+        });
+        else answers[prompt.name] = await rt.prompter.text({
+            message,
+            ...initial
+        });
+    });
+    return answers;
+}
+function assertThirdPartyAllowed(names, globals, canPrompt) {
+    if (names.length > 0 && !globals.yes && !canPrompt && !globals.dryRun) throw new MfeflowError('E107', `${names.join(', ')} comes from a registry; pass --yes to apply it without a terminal to confirm in`);
+}
+const rank = (name)=>OPTIONAL_FEATURES.indexOf(name);
+function inCatalogueOrder(names) {
+    const known = names.filter((n)=>-1 !== rank(n)).toSorted((a, b)=>rank(a) - rank(b));
+    return [
+        ...known,
+        ...names.filter((n)=>-1 === rank(n))
+    ];
+}
+async function addFeatures(rt, globals, local, requested, options) {
+    const root = await findProjectRoot(globals.cwd);
+    const chosen = chooseLocal(await loadProject(root), root, globals.cwd, local);
+    const { project } = chosen;
+    const { canPrompt } = globals;
+    let names = [
+        ...new Set(requested)
+    ];
+    if (0 === names.length && canPrompt) {
+        const choices = OPTIONAL_FEATURES.filter((n)=>!(n in project.features));
+        names = await rt.prompter.multiselect({
+            message: 'Add which features?',
+            choices: choices.map((value)=>({
+                    value,
+                    label: value
+                })),
+            initialValues: []
+        });
+    }
+    if (0 === names.length) throw new MfeflowError('E107', 'add needs a feature: mfeflow add <feature...>, or `mfeflow features` to list them');
+    const skipped = names.filter((n)=>n in project.features);
+    const adding = inCatalogueOrder(names.filter((n)=>!(n in project.features)));
+    if (0 === adding.length) {
+        if (!globals.json) rt.io.stdout(`${skipped.join(', ')} already added; nothing to do.`);
+        return {
+            ok: true,
+            command: 'add',
+            kind: 'feature',
+            dryRun: globals.dryRun,
+            root,
+            added: [],
+            skipped,
+            plan: planReport({
+                version: 1,
+                features: [],
+                changes: [],
+                dependencies: [],
+                scripts: [],
+                env: [],
+                warnings: []
+            }),
+            written: [],
+            installed: false,
+            ...globals.dryRun ? {
+                diff: ''
+            } : {}
+        };
+    }
+    assertOptionsAreForFeatures(options, adding);
+    const loaded = await Promise.all(adding.map((name)=>loadAny(name, {
+            roots: rt.roots,
+            registries: project.registries,
+            fetch: rt.fetch
+        })));
+    const thirdParty = loaded.filter((f)=>'third-party' === f.trust).map((f)=>f.manifest.name);
+    assertThirdPartyAllowed(thirdParty, globals, canPrompt);
+    const builder = createBuilder(root, chosen.checkout);
+    await inOrder(loaded, async (feature)=>{
+        const given = await askOptions(rt, feature, options[feature.manifest.name] ?? {}, canPrompt);
+        await resolveFeature({
+            feature,
+            project,
+            builder,
+            options: given,
+            alsoAdding: adding
+        });
+    });
+    const plan = builder.build();
+    const outcome = await writePlan({
+        rt,
+        globals,
+        root,
+        plan,
+        project,
+        afterWrite: async ()=>{
+            if (adding.includes('git-hooks')) await rt.system.gitInit(root);
+        }
+    });
+    return finish(rt, globals, root, 'feature', adding, skipped, outcome);
+}
+async function runAdd(rt, args, raw) {
+    assertKnownFlags(raw, ADD_ARGS);
+    const globals = readGlobals(args, rt.io.env, rt.io.cwd, rt.io.interactive);
+    const positional = Array.isArray(args._) ? args._.map(String) : [];
+    const [first, ...rest] = positional;
+    if ('remote' === first || 'shell' === first) return addApp(rt, globals, args, first, rest[0]);
+    if ('env-key' === first) return addEnvKey(rt, globals, args, rest[0]);
+    const preset = globals.preset ? await loadPreset(globals.preset, {
+        cwd: globals.cwd,
+        fetch: rt.fetch
+    }) : {};
+    const options = mergeOptions(preset.options ?? {}, parseFeatureOptions(repeated(raw, 'option')));
+    return addFeatures(rt, globals, args_text(args, 'local'), positional, options);
+}
+function finding(check, code, detail, options = {}) {
+    const error = new MfeflowError(code, detail);
+    const out = {
+        code: error.code,
+        severity: options.severity ?? 'error',
+        check,
+        message: error.message,
+        fix: error.fix,
+        docs: error.docs,
+        fixable: options.fixable ?? false
+    };
+    if (void 0 !== options.app) out.app = options.app;
+    if (void 0 !== options.path) out.path = options.path;
+    return out;
+}
+const done = (findings)=>Promise.resolve({
+        findings
+    });
+const SINGLETON_SPECIFIERS = [
+    'react',
+    'react/jsx-runtime',
+    'react/jsx-dev-runtime',
+    'react-dom',
+    'react-dom/client',
+    'react-router',
+    '@tanstack/react-query',
+    'i18next',
+    'react-i18next',
+    '@mfeflow/runtime',
+    '@mfeflow/analytics',
+    '@mfeflow/analytics/react',
+    '@mfeflow/telemetry',
+    '@mfeflow/storage',
+    '@mfeflow/storage/react',
+    '@mfeflow/theme',
+    '@mfeflow/theme/react',
+    '@mfeflow/i18n',
+    '@mfeflow/i18n/react'
+];
+function packageNameOf(specifier) {
+    const parts = specifier.split('/');
+    return specifier.startsWith('@') ? parts.slice(0, 2).join('/') : parts[0] ?? specifier;
+}
+const SINGLETON_PACKAGES = [
+    ...new Set(SINGLETON_SPECIFIERS.map(packageNameOf))
+];
+function specifiersOf(name) {
+    return SINGLETON_SPECIFIERS.filter((s)=>packageNameOf(s) === name);
+}
+const ENVS = [
+    'dev',
+    'staging',
+    'prod'
+];
+const inspect_isObj = (value)=>'object' == typeof value && null !== value && !Array.isArray(value);
+async function readText(file) {
+    try {
+        return await promises.readFile(file, 'utf8');
+    } catch (error) {
+        if (hasErrno(error, 'ENOENT') || hasErrno(error, 'ENOTDIR') || hasErrno(error, 'EISDIR')) return;
+        throw error;
+    }
+}
+async function readJson(file) {
+    const text = await readText(file);
+    if (void 0 === text) return {
+        state: 'missing'
+    };
+    try {
+        return {
+            state: 'ok',
+            value: JSON.parse(text)
+        };
+    } catch (error) {
+        return {
+            state: 'invalid',
+            issues: [
+                {
+                    path: '',
+                    message: `not valid JSON (${messageOf(error)})`
+                }
+            ]
+        };
+    }
+}
+function strings(value) {
+    if (!inspect_isObj(value)) return {};
+    return Object.fromEntries(Object.entries(value).filter((e)=>'string' == typeof e[1]));
+}
+async function readWorkspaceFile(root) {
+    const text = await readText(node_path.join(root, 'pnpm-workspace.yaml'));
+    const empty = {
+        globs: [],
+        catalogs: {
+            default: {},
+            named: {}
+        }
+    };
+    if (void 0 === text) return empty;
+    let doc;
+    try {
+        doc = parse(text);
+    } catch  {
+        return empty;
+    }
+    if (!inspect_isObj(doc)) return empty;
+    const globs = Array.isArray(doc.packages) ? doc.packages.filter((g)=>'string' == typeof g) : [];
+    const named = inspect_isObj(doc.catalogs) ? Object.fromEntries(Object.entries(doc.catalogs).map(([k, v])=>[
+            k,
+            strings(v)
+        ])) : {};
+    return {
+        globs,
+        catalogs: {
+            default: strings(doc.catalog),
+            named
+        }
+    };
+}
+async function subfolders(dir) {
+    try {
+        return (await promises.readdir(dir, {
+            withFileTypes: true
+        })).filter((e)=>e.isDirectory() && 'node_modules' !== e.name).map((e)=>e.name).toSorted((a, b)=>a.localeCompare(b));
+    } catch (error) {
+        if (hasErrno(error, 'ENOENT') || hasErrno(error, 'ENOTDIR')) return [];
+        throw error;
+    }
+}
+function excluder(pattern) {
+    const body = pattern.replace(/\/$/, '').split('/').map((part)=>'**' === part ? '\u0000' : part.replaceAll(/[.+?^${}()|[\]\\]/g, String.raw`\$&`).replaceAll('*', '[^/]*')).join('/').replaceAll('\u0000/', '(?:.*/)?').replaceAll('/\u0000', '(?:/.*)?').replaceAll('\u0000', '.*');
+    return new RegExp(`^${body}$`);
+}
+async function expandGlobs(root, globs) {
+    const out = [];
+    const excluded = globs.filter((g)=>g.startsWith('!')).map((g)=>excluder(g.slice(1)));
+    for (const glob of globs){
+        if (glob.startsWith('!')) continue;
+        const clean = glob.replace(/\/$/, '');
+        if (clean.endsWith('/*') || clean.endsWith('/**')) {
+            const base = clean.replace(/\/\*{1,2}$/, '');
+            for (const name of (await subfolders(node_path.join(root, base))))out.push(`${base}/${name}`);
+        } else out.push(clean);
+    }
+    return [
+        ...new Set(out)
+    ].filter((rel)=>!excluded.some((pattern)=>pattern.test(rel)));
+}
+function resolveSpec(name, spec, catalogs) {
+    if ('catalog:' === spec || 'catalog:default' === spec) return catalogs.default[name] ?? spec;
+    if (spec.startsWith('catalog:')) return catalogs.named[spec.slice(8)]?.[name] ?? spec;
+    return spec;
+}
+async function readPackage(dir, catalogs) {
+    const read = await readJson(node_path.join(dir, 'package.json'));
+    if ('ok' !== read.state || !inspect_isObj(read.value)) return;
+    const deps = {};
+    for (const key of [
+        'peerDependencies',
+        'devDependencies',
+        'dependencies'
+    ])for (const [name, spec] of Object.entries(strings(read.value[key])))deps[name] = resolveSpec(name, spec, catalogs);
+    const view = {
+        deps
+    };
+    if ('string' == typeof read.value.name) view.name = read.value.name;
+    if ('string' == typeof read.value.version) view.version = read.value.version;
+    return view;
+}
+async function readMfe(dir) {
+    const read = await readJson(node_path.join(dir, 'mfe.json'));
+    if ('ok' !== read.state) return read;
+    const issues = validateMfeManifest(read.value);
+    if (issues.length > 0) return {
+        state: 'invalid',
+        issues
+    };
+    return {
+        state: 'ok',
+        value: read.value
+    };
+}
+async function readRegistry(root) {
+    const envsDir = node_path.join(root, 'registry', 'envs');
+    const envDirs = await subfolders(envsDir);
+    const registry = {};
+    for (const env of envDirs){
+        const entries = {};
+        const dir = node_path.join(envsDir, env);
+        const files = (await promises.readdir(dir)).filter((f)=>f.endsWith('.json')).toSorted((a, b)=>a.localeCompare(b));
+        for (const file of files){
+            const read = await readJson(node_path.join(dir, file));
+            const name = file.slice(0, -5);
+            if ('ok' !== read.state) {
+                entries[name] = read;
+                continue;
+            }
+            const issues = validateRegistryEntry(read.value);
+            if (issues.length > 0) {
+                entries[name] = {
+                    state: 'invalid',
+                    issues
+                };
+                continue;
+            }
+            entries[name] = {
+                state: 'ok',
+                value: read.value
+            };
+        }
+        registry[env] = entries;
+    }
+    return {
+        registry,
+        envDirs
+    };
+}
+async function inspectProject(root) {
+    const project = await loadProject(root);
+    const { globs, catalogs } = await readWorkspaceFile(root);
+    const apps = await Promise.all(Object.entries(project.apps).map(async ([name, app])=>{
+        const dir = node_path.join(root, ...app.path.split('/'));
+        const pkg = await readPackage(dir, catalogs);
+        return {
+            name,
+            kind: app.kind,
+            rel: app.path,
+            dir,
+            port: app.port,
+            present: void 0 !== pkg,
+            pkg,
+            mfe: await readMfe(dir)
+        };
+    }));
+    const folders = await expandGlobs(root, globs);
+    const workspace = (await Promise.all(folders.map(async (rel)=>{
+        const dir = node_path.join(root, ...rel.split('/'));
+        const pkg = await readPackage(dir, catalogs);
+        return pkg && {
+            dir,
+            rel,
+            pkg,
+            hasVersion: void 0 !== pkg.version
+        };
+    }))).filter((p)=>void 0 !== p);
+    return {
+        root,
+        project,
+        apps,
+        workspace,
+        ...await readRegistry(root)
+    };
+}
+async function versionIn(app, name, root) {
+    const declared = app.pkg?.deps[name];
+    if (void 0 === declared && !SINGLETON_PACKAGES.includes(name)) return;
+    let dir = app.dir;
+    while(!node_path.relative(root, dir).startsWith('..')){
+        const text = await readText(node_path.join(dir, 'node_modules', ...name.split('/'), 'package.json'));
+        if (void 0 !== text) try {
+            const parsed = JSON.parse(text);
+            if (inspect_isObj(parsed) && 'string' == typeof parsed.version) return parsed.version;
+        } catch  {
+            return;
+        }
+        const parent = node_path.dirname(dir);
+        if (parent === dir || dir === root) break;
+        dir = parent;
+    }
+    return declared;
+}
+function comparable(version) {
+    const exact = semver.valid(version);
+    if (null !== exact) return exact;
+    return null === semver.validRange(version) ? void 0 : semver.minVersion(version)?.version ?? void 0;
+}
+function unresolved(check, code, name, specs) {
+    return finding(check, code, `${name} is ${specs.join(', ')}: the version cannot be compared until install, so it is not checked`, {
+        severity: 'warning'
+    });
+}
+const singletonVersions = {
+    id: 'singletons.versions',
+    title: 'each singleton (react, react-dom, …) is one version across the apps',
+    async run ({ apps, root }) {
+        const present = apps.filter((app)=>app.present);
+        const out = [];
+        for (const name of SINGLETON_PACKAGES){
+            const found = await Promise.all(present.map(async (app)=>({
+                    app: app.name,
+                    version: await versionIn(app, name, root)
+                })));
+            const used = found.flatMap((f)=>{
+                const version = void 0 === f.version ? void 0 : comparable(f.version);
+                return void 0 === version ? [] : [
+                    {
+                        app: f.app,
+                        version
+                    }
+                ];
+            });
+            const open = found.filter((f)=>void 0 !== f.version && void 0 === comparable(f.version));
+            if (open.length > 0) out.push(unresolved('singletons.versions', 'E301', name, open.map((f)=>`${f.app} ${String(f.version)}`)));
+            const versions = new Set(used.map((u)=>u.version));
+            if (versions.size > 1) {
+                const list = used.map((u)=>`${u.app} ${u.version}`).join(', ');
+                out.push(finding('singletons.versions', 'E301', `${name} (${specifiersOf(name).join(', ')}) is ${[
+                    ...versions
+                ].join(' and ')}: ${list}`));
+            }
+        }
+        return {
+            findings: out
+        };
+    }
+};
+function fits(range, shellVersion) {
+    if (void 0 === shellVersion) return true;
+    const have = comparable(shellVersion);
+    const valid = semver.validRange(range);
+    return void 0 === have || null === valid || semver.satisfies(have, valid);
+}
+async function compatFor(shell, remote, root) {
+    const out = [];
+    const at = {
+        app: remote.name,
+        path: `${remote.rel}/mfe.json`
+    };
+    const platform = 'ok' === remote.mfe.state ? remote.mfe.value.platform ?? {} : {};
+    for (const [name, range] of Object.entries(platform)){
+        const have = await versionIn(shell, name, root);
+        if (void 0 !== have && void 0 === comparable(have)) out.push(unresolved('compat', 'E302', name, [
+            `${shell.name} ${have}`
+        ]));
+        else if (!fits(range, have)) out.push(finding('compat', 'E302', `${remote.name} needs ${name} ${range} (mfe.json platform) but ${shell.name} has ${String(have)}`, at));
+    }
+    for (const name of SINGLETON_PACKAGES){
+        const [theirs, mine] = await Promise.all([
+            versionIn(remote, name, root),
+            versionIn(shell, name, root)
+        ]);
+        const want = void 0 === theirs ? void 0 : comparable(theirs);
+        const open = [
+            ...void 0 !== theirs && void 0 === want ? [
+                `${remote.name} ${theirs}`
+            ] : [],
+            ...void 0 !== mine && void 0 === comparable(mine) ? [
+                `${shell.name} ${mine}`
+            ] : []
+        ];
+        if (open.length > 0) out.push(unresolved('compat', 'E302', name, open));
+        if (void 0 !== want && void 0 !== mine) {
+            if (!fits(`^${want}`, mine) && !(name in platform)) out.push(finding('compat', 'E302', `${remote.name} uses ${name} ${want}, ${shell.name} provides ${mine}`, {
+                app: remote.name
+            }));
+        }
+    }
+    return out;
+}
+const compat = {
+    id: 'compat',
+    title: "each remote's shared ranges fit the shells it runs in",
+    async run (view) {
+        const out = [];
+        const remotes = view.apps.filter((a)=>'remote' === a.kind && a.present);
+        for (const remote of remotes){
+            const names = 'ok' === remote.mfe.state ? remote.mfe.value.shells : view.apps.filter((a)=>'shell' === a.kind).map((a)=>a.name);
+            for (const shell of view.apps.filter((a)=>'shell' === a.kind && a.present && names.includes(a.name)))out.push(...await compatFor(shell, remote, view.root));
+        }
+        const seen = new Set();
+        return {
+            findings: out.filter((f)=>!seen.has(f.message) && Boolean(seen.add(f.message)))
+        };
+    }
+};
+function issueText(read) {
+    return 'invalid' === read.state ? read.issues.map((i)=>`${i.path || '(root)'} ${i.message}`).join('; ') : '';
+}
+const appsOnDisk = {
+    id: 'config.apps',
+    title: 'every app in mfeflow.json is on disk',
+    run: ({ apps })=>done(apps.filter((app)=>!app.present).map((app)=>finding('config.apps', 'E112', `${app.name} (${app.rel}/package.json not found)`, {
+                app: app.name,
+                path: `${app.rel}/package.json`
+            })))
+};
+const mfeJson = {
+    id: 'config.mfe-json',
+    title: 'every app has a valid mfe.json that matches mfeflow.json',
+    run: ({ apps })=>done(apps.filter((app)=>app.present).flatMap((app)=>{
+            const at = {
+                app: app.name,
+                path: `${app.rel}/mfe.json`
+            };
+            if ('missing' === app.mfe.state) return [
+                finding('config.mfe-json', 'E113', `${app.name} has no mfe.json`, at)
+            ];
+            if ('invalid' === app.mfe.state) return [
+                finding('config.mfe-json', 'E113', `${app.name}: ${issueText(app.mfe)}`, at)
+            ];
+            const { name } = app.mfe.value;
+            return name === app.name ? [] : [
+                finding('config.mfe-json', 'E116', `mfe.json names "${name}" but the app is "${app.name}"`, at)
+            ];
+        }))
+};
+const config_ports = {
+    id: 'config.ports',
+    title: 'no two apps share a port',
+    run: ({ apps })=>{
+        const byPort = new Map();
+        for (const app of apps)if (void 0 !== app.port) byPort.set(app.port, [
+            ...byPort.get(app.port) ?? [],
+            app.name
+        ]);
+        return done([
+            ...byPort
+        ].filter(([, names])=>names.length > 1).map(([port, names])=>finding('config.ports', 'E115', `${names.join(' and ')} both use ${String(port)}`)));
+    }
+};
+const config_routes = {
+    id: 'config.routes',
+    title: 'no two remotes claim the same route',
+    run: ({ apps })=>{
+        const claimed = new Map();
+        const out = [];
+        for (const app of apps)if ('remote' === app.kind && 'ok' === app.mfe.state) for (const route of app.mfe.value.routes){
+            const owner = claimed.get(route);
+            if (void 0 !== owner && owner !== app.name) out.push(finding('config.routes', 'E116', `${route} is claimed by ${owner} and ${app.name}`, {
+                app: app.name,
+                path: `${app.rel}/mfe.json`
+            }));
+            else claimed.set(route, app.name);
+        }
+        return done(out);
+    }
+};
+const config_registry = {
+    id: 'config.registry',
+    title: 'every remote has a valid registry entry in dev, staging and prod',
+    run: ({ apps, registry: entries })=>{
+        const out = [];
+        const remotes = apps.filter((app)=>'remote' === app.kind);
+        for (const env of ENVS){
+            for (const app of remotes){
+                const entry = entries[env]?.[app.name] ?? {
+                    state: 'missing'
+                };
+                const file = `registry/envs/${env}/${app.name}.json`;
+                if ('missing' === entry.state) out.push(finding('config.registry', 'E114', `${file} is missing`, {
+                    app: app.name,
+                    path: file,
+                    fixable: true
+                }));
+                else if ('invalid' === entry.state) out.push(finding('config.registry', 'E114', `${file}: ${issueText(entry)}`, {
+                    app: app.name,
+                    path: file
+                }));
+            }
+            const known = new Set(remotes.map((r)=>r.name));
+            for (const name of Object.keys(entries[env] ?? {}))if (!known.has(name)) out.push(finding('config.registry', 'E114', `registry/envs/${env}/${name}.json has no remote in mfeflow.json`, {
+                severity: 'warning',
+                path: `registry/envs/${env}/${name}.json`
+            }));
+        }
+        return done(out);
+    }
+};
+const localCheckout = {
+    id: 'config.local',
+    title: 'the linked mfeflow checkout is built',
+    run: ({ project, root })=>{
+        if (void 0 === project.local) return Promise.resolve({
+            findings: [],
+            skipped: 'not linked with --local'
+        });
+        try {
+            const unbuilt = [
+                ...scanCheckout(node_path.resolve(root, project.local))
+            ].filter(([, p])=>!p.built).map(([name])=>name);
+            return done(0 === unbuilt.length ? [] : [
+                finding('config.local', 'E110', `${unbuilt.join(', ')} not built in ${project.local}`)
+            ]);
+        } catch (error) {
+            return done([
+                finding('config.local', 'E110', error instanceof Error ? error.message : String(error))
+            ]);
+        }
+    }
+};
+const drift = {
+    id: 'files.drift',
+    title: 'copied files match the hashes in mfeflow.json',
+    run: async ({ root, project })=>({
+            findings: (await findDiverged(root, project)).map((file)=>finding('files.drift', 'E117', `${file.path} is ${file.state}`, {
+                    severity: 'warning',
+                    path: file.path
+                }))
+        })
+};
+const NOT_INSTALLED = 'the env-t3 feature is not installed';
+const env_installed = ({ project })=>'env-t3' in project.features;
+const PUBLIC_CONSTANTS = new Set([
+    'PUBLIC_APP_NAME',
+    'PUBLIC_BUILD_VERSION'
+]);
+const PUBLIC_VAR = /\bPUBLIC_[A-Z0-9_]+\b/g;
+const SOURCE_FILE = /\.(?:[cm]?[jt]sx?)$/;
+const placeOf = (a)=>{
+    const place = {
+        name: a.name,
+        dir: a.dir,
+        rel: a.rel
+    };
+    const pkg = a.pkg?.name;
+    if (void 0 !== pkg) place.pkg = pkg;
+    return place;
+};
+const places = (view)=>[
+        {
+            name: 'root',
+            dir: view.root,
+            rel: ''
+        },
+        ...view.apps.filter((a)=>a.present).map(placeOf)
+    ];
+const warning = (app, file)=>({
+        app,
+        path: file,
+        severity: 'warning'
+    });
+const env_at = (place, file)=>'' === place.rel ? file : `${place.rel}/${file}`;
+async function eachPlace(view, check) {
+    if (!env_installed(view)) return {
+        findings: [],
+        skipped: NOT_INSTALLED
+    };
+    return done((await Promise.all(places(view).map(check))).flat());
+}
+async function serverKeysOf(place) {
+    const source = await readText(node_path.join(place.dir, 'env.ts'));
+    if (void 0 === source) return;
+    try {
+        const keys = schemaKeys(source, 'env.ts', 'server');
+        if (void 0 === keys) return {
+            keys: [],
+            problem: 'it has no createEnv({ server: { … } })'
+        };
+        return {
+            keys
+        };
+    } catch (error) {
+        return {
+            keys: [],
+            problem: messageOf(error)
+        };
+    }
+}
+const envExample = {
+    id: 'env.example',
+    title: '.env.example lists the required keys of env.ts and no others (decision 0020)',
+    run: (view)=>eachPlace(view, async (place)=>{
+            const server = await serverKeysOf(place);
+            if (void 0 === server) return [];
+            if (void 0 !== server.problem) {
+                const env = env_at(place, 'env.ts');
+                return [
+                    finding('env.example', 'E118', `${env} cannot be checked: ${server.problem}`, {
+                        app: place.name,
+                        path: env,
+                        severity: 'warning'
+                    })
+                ];
+            }
+            const names = new Set(server.keys.map((k)=>k.name));
+            const required = server.keys.filter((k)=>!k.optional).map((k)=>k.name);
+            const file = env_at(place, '.env.example');
+            const example = await readText(node_path.join(place.dir, '.env.example'));
+            const options = {
+                app: place.name,
+                path: file,
+                severity: 'warning'
+            };
+            if (void 0 === example) return 0 === required.length ? [] : [
+                finding('env.example', 'E118', `${file} is missing`, options)
+            ];
+            const listed = dotenvKeys(example);
+            return [
+                ...required.filter((key)=>!listed.includes(key)).map((key)=>finding('env.example', 'E118', `${key} is in ${env_at(place, 'env.ts')} but not in ${file}`, options)),
+                ...listed.filter((key)=>!names.has(key)).map((key)=>finding('env.example', 'E118', `${key} is in ${file} but not in ${env_at(place, 'env.ts')}`, options))
+            ];
+        })
+};
+async function checkConfigFile(place, folder, name, keys) {
+    const file = env_at(place, `public/config/${name}`);
+    const options = {
+        app: place.name,
+        path: file
+    };
+    const extra = warning(place.name, file);
+    let json;
+    try {
+        json = JSON.parse(await readText(node_path.join(folder, name)) ?? '');
+    } catch (error) {
+        return [
+            finding('env.runtime-config', 'E119', `${file} is not valid JSON (${messageOf(error)})`, options)
+        ];
+    }
+    if ('object' != typeof json || null === json || Array.isArray(json)) return [
+        finding('env.runtime-config', 'E119', `${file} is not a JSON object`, options)
+    ];
+    const present = Object.keys(json);
+    return [
+        ...keys.filter((k)=>!k.optional && !present.includes(k.name)).map((k)=>finding('env.runtime-config', 'E119', `${file} is missing ${k.name}`, options)),
+        ...present.filter((key)=>!keys.some((k)=>k.name === key)).map((key)=>finding('env.runtime-config', 'E119', `${file} has ${key}, which the schema does not`, extra))
+    ];
+}
+const runtimeConfig = {
+    id: 'env.runtime-config',
+    title: 'every runtime-config.<env>.json has the keys of the runtime-config schema (decision 0020)',
+    run: (view)=>eachPlace(view, async (place)=>{
+            const source = await readText(node_path.join(place.dir, 'src', 'config', 'schema.ts'));
+            if (void 0 === source) return [];
+            const schemaFile = env_at(place, 'src/config/schema.ts');
+            let keys;
+            try {
+                keys = schemaKeys(source, schemaFile, 'runtime');
+            } catch (error) {
+                return [
+                    finding('env.runtime-config', 'E119', `${schemaFile}: ${messageOf(error)}`, {
+                        app: place.name,
+                        path: schemaFile
+                    })
+                ];
+            }
+            if (void 0 === keys) return [
+                finding('env.runtime-config', 'E119', `${schemaFile} has no runtimeConfigSchema object`, {
+                    app: place.name,
+                    path: schemaFile
+                })
+            ];
+            const folder = node_path.join(place.dir, 'public', 'config');
+            const files = await runtimeConfigFiles(folder);
+            const found = await Promise.all(files.map((name)=>checkConfigFile(place, folder, name, keys)));
+            return found.flat();
+        })
+};
+async function sourceFiles(dir) {
+    const entries = await promises.readdir(dir, {
+        withFileTypes: true
+    }).catch(()=>[]);
+    const nested = await Promise.all(entries.map(async (entry)=>{
+        const full = node_path.join(dir, entry.name);
+        if (entry.isDirectory()) return 'node_modules' === entry.name ? [] : sourceFiles(full);
+        return SOURCE_FILE.test(entry.name) ? [
+            full
+        ] : [];
+    }));
+    return nested.flat();
+}
+const publicPrefix = {
+    id: 'env.public-prefix',
+    title: 'no PUBLIC_ variable is baked into a bundle except constants (decision 0020)',
+    run: (view)=>eachPlace(view, async (place)=>{
+            const files = [
+                node_path.join(place.dir, 'env.ts'),
+                node_path.join(place.dir, '.env.example'),
+                ...await sourceFiles(node_path.join(place.dir, 'src'))
+            ];
+            const found = await Promise.all(files.map(async (file)=>{
+                const source = await readText(file);
+                if (void 0 === source) return [];
+                const names = [
+                    ...new Set(source.match(PUBLIC_VAR) ?? [])
+                ].filter((name)=>!PUBLIC_CONSTANTS.has(name));
+                const shown = node_path.relative(view.root, file).split(node_path.sep).join('/');
+                return names.map((name)=>finding('env.public-prefix', 'E120', `${name} in ${shown}`, {
+                        app: place.name,
+                        path: shown,
+                        severity: 'warning'
+                    }));
+            }));
+            return found.flat();
+        })
+};
+const turboEnv = {
+    id: 'env.turbo',
+    title: 'every required server env key is listed in turbo.json (decision 0020)',
+    run: async (view)=>{
+        if (!env_installed(view)) return {
+            findings: [],
+            skipped: NOT_INSTALLED
+        };
+        const source = await readText(node_path.join(view.root, 'turbo.json'));
+        if (void 0 === source) return {
+            findings: [],
+            skipped: 'there is no turbo.json'
+        };
+        let turbo;
+        try {
+            turbo = JSON.parse(source);
+        } catch  {
+            return {
+                findings: [],
+                skipped: 'turbo.json is not valid JSON'
+            };
+        }
+        return eachPlace(view, async (place)=>{
+            const server = await serverKeysOf(place);
+            const listed = turboBuildEnv(turbo, place);
+            return (server?.keys ?? []).filter((key)=>!key.optional && !envListed(listed, key.name)).map((key)=>finding('env.turbo', 'E121', `${key.name} from ${env_at(place, 'env.ts')}`, {
+                    app: place.name,
+                    path: 'turbo.json',
+                    severity: 'warning'
+                }));
+        });
+    }
+};
+const env_isRecord = (value)=>'object' == typeof value && null !== value && !Array.isArray(value);
+const env_strings = (value)=>Array.isArray(value) ? value.filter((v)=>'string' == typeof v) : [];
+function turboBuildEnv(turbo, place) {
+    if (!env_isRecord(turbo)) return [];
+    const tasks = env_isRecord(turbo.tasks) ? turbo.tasks : {};
+    const own = void 0 === place.pkg ? void 0 : tasks[`${place.pkg}#build`];
+    return [
+        ...env_strings(turbo.globalEnv),
+        ...env_isRecord(tasks.build) ? env_strings(tasks.build.env) : [],
+        ...env_isRecord(own) ? env_strings(own.env) : []
+    ];
+}
+function matchesEnv(pattern, name) {
+    const parts = pattern.split('*').map((part)=>part.replaceAll(/[$()+.?[\\\]^{|}]/g, String.raw`\$&`));
+    return new RegExp(`^${parts.join('.*')}$`).test(name);
+}
+function envListed(patterns, name) {
+    const included = patterns.some((p)=>!p.startsWith('!') && matchesEnv(p, name));
+    return included && !patterns.some((p)=>p.startsWith('!') && matchesEnv(p.slice(1), name));
+}
+const envChecks = [
+    envExample,
+    runtimeConfig,
+    publicPrefix,
+    turboEnv
+];
+const SOURCE = /\.(?:[cm]?[jt]s|[jt]sx)$/;
+const EXTENSIONS = [
+    '',
+    '.ts',
+    '.tsx',
+    '.js',
+    '.mjs',
+    '/index.ts',
+    '/index.js'
+];
+function withoutComments(code) {
+    return code.replaceAll(/\/\*[\s\S]*?\*\//g, '').replaceAll(/(^|[^:])\/\/.*$/gm, '$1');
+}
+const FROM_CLAUSE = /\b(?:import|export)\s+(type\s+(?!from\b))?([\w\s{},*$]*?)\bfrom\s*['"]([^'"]+)['"]/g;
+function onlyTypes(clause) {
+    const named = /^\s*\{([^}]*)\}\s*$/.exec(clause)?.[1];
+    if (void 0 === named) return false;
+    const specifiers = named.split(',').filter((part)=>'' !== part.trim());
+    return specifiers.length > 0 && specifiers.every((part)=>/^\s*type\s+\S/.test(part));
+}
+function importsOf(code) {
+    const clean = withoutComments(code);
+    const found = new Set();
+    for (const m of clean.matchAll(FROM_CLAUSE))if (void 0 === m[1] && !onlyTypes(m[2] ?? '')) found.add(m[3] ?? '');
+    const patterns = [
+        /\bimport\s*['"]([^'"]+)['"]/g,
+        /\bimport\s*\(\s*['"]([^'"]+)['"]\s*\)/g,
+        /\brequire\s*\(\s*['"]([^'"]+)['"]\s*\)/g
+    ];
+    for (const pattern of patterns)for (const m of clean.matchAll(pattern))found.add(m[1] ?? '');
+    return [
+        ...found
+    ];
+}
+async function pluginFiles(app) {
+    const found = new Set();
+    const config = await readText(node_path.join(app.dir, 'rsbuild.config.ts'));
+    const listed = void 0 === config ? null : /runtimePlugins\s*:\s*\[([^\]]*)\]/.exec(withoutComments(config));
+    for (const m of (listed?.[1] ?? '').matchAll(/['"]([^'"]+)['"]/g)){
+        const spec = m[1] ?? '';
+        if (spec.startsWith('.')) found.add(node_path.resolve(app.dir, spec));
+    }
+    const walk = async (dir)=>{
+        let entries;
+        try {
+            entries = await promises.readdir(dir, {
+                withFileTypes: true
+            });
+        } catch  {
+            return;
+        }
+        for (const entry of entries){
+            const full = node_path.join(dir, entry.name);
+            if (entry.isDirectory()) await walk(full);
+            else if (SOURCE.test(entry.name) && /runtime-plugin/.test(node_path.relative(app.dir, full))) found.add(full);
+        }
+    };
+    await walk(node_path.join(app.dir, 'src'));
+    return [
+        ...found
+    ];
+}
+async function resolveFile(base) {
+    for (const ext of EXTENSIONS)if (await readText(base + ext) !== void 0) return base + ext;
+}
+const runtimePlugins = {
+    id: 'plugins.imports',
+    title: 'runtime plugins import no shared modules',
+    async run (view) {
+        const shared = new Set([
+            ...SINGLETON_PACKAGES,
+            ...view.workspace.filter((p)=>!view.apps.some((a)=>a.dir === p.dir)).flatMap((p)=>p.pkg.name ? [
+                    p.pkg.name
+                ] : [])
+        ]);
+        const out = [];
+        for (const app of view.apps.filter((a)=>a.present)){
+            const queue = await pluginFiles(app);
+            const seen = new Set();
+            for(let file = queue.shift(); void 0 !== file; file = queue.shift()){
+                if (seen.has(file)) continue;
+                seen.add(file);
+                const code = await readText(file);
+                if (void 0 !== code) {
+                    for (const spec of importsOf(code))if (spec.startsWith('.')) {
+                        const next = await resolveFile(node_path.resolve(node_path.dirname(file), spec));
+                        if (void 0 !== next) queue.push(next);
+                    } else if (!spec.startsWith('node:') && shared.has(packageNameOf(spec))) {
+                        const rel = node_path.relative(view.root, file).split(node_path.sep).join('/');
+                        out.push(finding('plugins.imports', 'E303', `${rel} imports ${spec}`, {
+                            app: app.name,
+                            path: rel
+                        }));
+                    }
+                }
+            }
+        }
+        return {
+            findings: out
+        };
+    }
+};
+const workspaceVersions = {
+    id: 'singletons.workspace-version',
+    title: 'every workspace package has a version',
+    run: ({ workspace })=>done(workspace.filter((p)=>!p.hasVersion).map((p)=>finding('singletons.workspace-version', 'E111', `${p.pkg.name ?? p.rel} (${p.rel}/package.json)`, {
+                path: `${p.rel}/package.json`,
+                fixable: true
+            })))
+};
+const VALIDATE_CHECKS = [
+    appsOnDisk,
+    mfeJson,
+    config_routes,
+    config_registry
+];
+const COMPAT_CHECKS = [
+    compat
+];
+const DOCTOR_CHECKS = [
+    appsOnDisk,
+    mfeJson,
+    config_ports,
+    config_routes,
+    config_registry,
+    localCheckout,
+    singletonVersions,
+    workspaceVersions,
+    compat,
+    drift,
+    runtimePlugins,
+    ...envChecks
+];
+const DOCTOR_ARGS = {
+    fix: {
+        type: 'boolean',
+        description: 'Repair what is safe: missing workspace versions and registry entries'
+    },
+    ...GLOBAL_ARGS
+};
+const VALIDATE_ARGS = {
+    ...GLOBAL_ARGS
+};
+const COMPAT_ARGS = {
+    ...GLOBAL_ARGS
+};
+const DEFAULT_VERSION = '0.0.0';
+function withVersion(source) {
+    const doc = JSON.parse(source);
+    if ('object' != typeof doc || null === doc || Array.isArray(doc)) return source;
+    const indent = /^(\s+)"/m.exec(source)?.[1] ?? '  ';
+    const entries = Object.entries(doc);
+    const at = Math.max(1, entries.findIndex(([key])=>'name' === key) + 1);
+    const next = Object.fromEntries([
+        ...entries.slice(0, at),
+        [
+            'version',
+            DEFAULT_VERSION
+        ],
+        ...entries.slice(at)
+    ]);
+    return `${JSON.stringify(next, null, indent)}\n`;
+}
+function withPorts(project, ports) {
+    return Object.fromEntries(Object.entries(project.apps).map(([name, app])=>{
+        const port = ports[name];
+        return [
+            name,
+            void 0 === port ? app : {
+                ...app,
+                port
+            }
+        ];
+    }));
+}
+async function plannedFixes(rt, view, findings, builder) {
+    let count = 0;
+    const assigned = {};
+    const missingEnvs = new Map();
+    for (const f of findings.filter((x)=>x.fixable))if ('MFEFLOW_E111' === f.code && void 0 !== f.path) {
+        await builder.patch(f.path, withVersion);
+        count += 1;
+    } else if ('MFEFLOW_E114' === f.code && void 0 !== f.app && void 0 !== f.path) {
+        const env = f.path.split('/')[2] ?? '';
+        missingEnvs.set(f.app, [
+            ...missingEnvs.get(f.app) ?? [],
+            env
+        ]);
+    }
+    for (const [name, envs] of missingEnvs){
+        let port = view.project.apps[name]?.port;
+        if (void 0 === port) {
+            port = freePort({
+                apps: withPorts(view.project, assigned)
+            }, 4311);
+            assigned[name] = port;
+        }
+        for (const file of (await registryEntryFiles(rt.roots, {
+            name,
+            port
+        }, envs))){
+            await builder.create(file.path, file.content, false);
+            count += 1;
+        }
+    }
+    return {
+        count,
+        project: {
+            ...view.project,
+            apps: withPorts(view.project, assigned)
+        }
+    };
+}
+async function fixAll(rt, globals, view, findings) {
+    const { checkout } = chooseLocal(view.project, view.root, globals.cwd, void 0);
+    const builder = createBuilder(view.root, checkout);
+    await builder.captureProject();
+    const { count, project } = await plannedFixes(rt, view, findings, builder);
+    if (0 === count) return 0;
+    const outcome = await writePlan({
+        rt,
+        globals: {
+            ...globals,
+            install: false
+        },
+        root: view.root,
+        plan: builder.build(),
+        project
+    });
+    return outcome.dryRun ? 0 : count;
+}
+async function runGroup(rt, args, raw, defs, command, checks, fix) {
+    assertKnownFlags(raw, defs);
+    const globals = readGlobals(args, rt.io.env, rt.io.cwd);
+    const root = await findProjectRoot(globals.cwd);
+    let view = await inspectProject(root);
+    let report = await runChecks(view, checks);
+    let fixed = 0;
+    if (fix && report.findings.some((f)=>f.fixable)) {
+        fixed = await fixAll(rt, globals, view, report.findings);
+        if (fixed > 0) {
+            view = await inspectProject(root);
+            report = await runChecks(view, checks);
+        }
+    }
+    const summary = summarizeReport(report, fixed);
+    if (!globals.json) rt.io.stdout(formatReport(report, summary));
+    return {
+        ok: 0 === summary.errors,
+        command,
+        root,
+        summary,
+        checks: report.checks,
+        findings: report.findings
+    };
+}
+function runDoctor(rt, args, raw) {
+    return runGroup(rt, args, raw, DOCTOR_ARGS, 'doctor', DOCTOR_CHECKS, true === args.fix);
+}
+function runValidate(rt, args, raw) {
+    return runGroup(rt, args, raw, VALIDATE_ARGS, 'validate', VALIDATE_CHECKS, false);
+}
+function runCheckCompat(rt, args, raw) {
+    return runGroup(rt, args, raw, COMPAT_ARGS, 'check-compat', COMPAT_CHECKS, false);
+}
+const KB = 1024;
+const kb = (bytes)=>round1(bytes / KB);
+async function gzipBytes(file) {
+    try {
+        return node_zlib.gzipSync(await promises.readFile(file), {
+            level: 6
+        }).length;
+    } catch  {
+        return;
+    }
+}
+async function sumGzip(dist, files) {
+    const sizes = await Promise.all(files.map((f)=>gzipBytes(node_path.join(dist, ...f.split('/')))));
+    return sizes.some((s)=>void 0 === s) ? void 0 : sizes.reduce((a, s)=>a + (s ?? 0), 0);
+}
+async function shellInitial(dist) {
+    const html = await readText(node_path.join(dist, 'index.html'));
+    if (void 0 === html) return;
+    const files = [
+        ...html.matchAll(/<script\b[^>]*\bsrc=["']([^"']+)["']/g)
+    ].map((m)=>m[1] ?? '').filter((src)=>!/^[a-z]+:\/\//.test(src)).map((src)=>src.replace(/^\.?\//, '').split(/[?#]/)[0] ?? '');
+    const bytes = await sumGzip(dist, files);
+    return void 0 === bytes ? void 0 : {
+        files,
+        bytes
+    };
+}
+const sizes_isObj = (v)=>'object' == typeof v && null !== v && !Array.isArray(v);
+const ORIGIN = 'https://dist.invalid';
+const SCRIPT = /\.[cm]?js$/;
+function distPath(url) {
+    try {
+        return decodeURIComponent(new URL(url).pathname).replace(/^\//, '');
+    } catch  {
+        return;
+    }
+}
+async function remoteSizes(dist) {
+    const text = await readText(node_path.join(dist, 'mf-manifest.json'));
+    if (void 0 === text) return;
+    let manifest;
+    try {
+        manifest = JSON.parse(text);
+    } catch  {
+        return;
+    }
+    if (!sizes_isObj(manifest) || !sizes_isObj(manifest.metaData) || !sizes_isObj(manifest.metaData.remoteEntry)) return;
+    const local = {
+        ...manifest,
+        metaData: {
+            ...manifest.metaData,
+            publicPath: 'auto',
+            getPublicPath: void 0,
+            globalName: void 0,
+            remoteEntry: {
+                ...manifest.metaData.remoteEntry,
+                type: void 0
+            }
+        }
+    };
+    let assets;
+    try {
+        assets = assetsFromManifest(local, `${ORIGIN}/mf-manifest.json`);
+    } catch  {
+        return;
+    }
+    const entry = void 0 === assets.remoteEntry ? void 0 : distPath(assets.remoteEntry);
+    if (void 0 === entry) return;
+    const entryBytes = await gzipBytes(node_path.join(dist, ...entry.split('/')));
+    if (void 0 === entryBytes) return;
+    const exposes = {};
+    for (const [name, urls] of Object.entries(assets.exposes)){
+        const files = urls.flatMap((url)=>distPath(url) ?? []).filter((f)=>SCRIPT.test(f));
+        const bytes = await sumGzip(dist, files);
+        if (void 0 !== bytes) exposes[name] = bytes;
+    }
+    return {
+        entryBytes,
+        exposes
+    };
+}
+const BUDGET_ARGS = {
+    dist: {
+        type: 'string',
+        description: 'Build output folder inside each app (default dist)',
+        valueHint: 'dir'
+    },
+    ...GLOBAL_ARGS
+};
+function modelOf(view) {
+    const given = view.project.budget ?? {};
+    return {
+        lcpDeltaMs: given.lcpDeltaMs ?? COST_MODEL.lcpDeltaMs,
+        shellKb: given.shellKb ?? COST_MODEL.shellKb,
+        remoteKb: given.remoteKb ?? COST_MODEL.remoteKb
+    };
+}
+const notBuilt = (app, what)=>finding('budget', 'E305', `${app.name}: ${what} not found in ${app.rel}`, {
+        app: app.name
+    });
+async function shellBudget(app, dist, model, baselineKb, out) {
+    const size = await shellInitial(node_path.join(app.dir, dist));
+    if (void 0 === size) return void out.push(notBuilt(app, `${dist}/index.html and its scripts`));
+    const initialKb = kb(size.bytes);
+    const budgetKb = void 0 === baselineKb ? null : baselineKb + model.shellKb;
+    const pass = void 0 === baselineKb ? null : judgeCost({
+        shellBytes: size.bytes,
+        monolithBytes: 1024 * baselineKb,
+        remoteBytes: {},
+        lcpDeltaMs: 0
+    }, model).shell.pass;
+    if (false === pass) out.push(finding('budget', 'E304', `${app.name} loads ${String(initialKb)} KB of JS first; your one-app baseline is ${String(baselineKb)} KB and the shell may add ${String(model.shellKb)} KB`, {
+        app: app.name
+    }));
+    return {
+        name: app.name,
+        initialKb,
+        scripts: size.files.length,
+        baselineKb: baselineKb ?? null,
+        budgetKb,
+        pass
+    };
+}
+async function remoteBudget(app, dist, model, out) {
+    const size = await remoteSizes(node_path.join(app.dir, dist));
+    if (void 0 === size) return void out.push(notBuilt(app, `${dist}/mf-manifest.json and its entry`));
+    const entryKb = kb(size.entryBytes);
+    const pass = judgeCost({
+        shellBytes: 0,
+        monolithBytes: 0,
+        remoteBytes: {
+            [app.name]: size.entryBytes
+        },
+        lcpDeltaMs: 0
+    }, model).remotes.every((r)=>r.pass);
+    if (!pass) out.push(finding('budget', 'E304', `${app.name}'s entry is ${String(entryKb)} KB; a remote may add ${String(model.remoteKb)} KB`, {
+        app: app.name
+    }));
+    const own = 'ok' === app.mfe.state ? app.mfe.value : void 0;
+    const budgetKb = own?.budgets?.initialJsKb ?? null;
+    const exposeNames = Object.keys(size.exposes);
+    const expose = exposeNames.includes('./App') ? './App' : exposeNames[0];
+    const routes = (own?.routes ?? []).map((route)=>{
+        const total = round1((size.entryBytes + (void 0 === expose ? 0 : size.exposes[expose] ?? 0)) / 1024);
+        const routePass = null === budgetKb ? null : total <= budgetKb;
+        if (false === routePass) out.push(finding('budget', 'E304', `${app.name} on ${route} loads ${String(total)} KB; mfe.json budgets.initialJsKb is ${String(budgetKb)}`, {
+            app: app.name,
+            path: `${app.rel}/mfe.json`
+        }));
+        return {
+            route,
+            expose: expose ?? null,
+            kb: total,
+            budgetKb,
+            pass: routePass
+        };
+    });
+    return {
+        name: app.name,
+        entryKb,
+        budgetKb: model.remoteKb,
+        pass,
+        routes
+    };
+}
+async function runBudget(rt, args, raw) {
+    assertKnownFlags(raw, BUDGET_ARGS);
+    const globals = readGlobals(args, rt.io.env, rt.io.cwd);
+    const dist = 'string' == typeof args.dist && '' !== args.dist ? args.dist : 'dist';
+    const view = await inspectProject(await findProjectRoot(globals.cwd));
+    const model = modelOf(view);
+    const findings = [];
+    const baseline = view.project.budget?.baselineKb;
+    const present = view.apps.filter((a)=>a.present);
+    const shells = (await Promise.all(present.filter((a)=>'shell' === a.kind).map((a)=>shellBudget(a, dist, model, baseline, findings)))).filter((s)=>void 0 !== s);
+    const remotes = (await Promise.all(present.filter((a)=>'remote' === a.kind).map((a)=>remoteBudget(a, dist, model, findings)))).filter((r)=>void 0 !== r);
+    const result = {
+        ok: 0 === exitForFindings(findings),
+        command: 'budget',
+        root: view.root,
+        model,
+        shells,
+        remotes,
+        findings
+    };
+    if (!globals.json) rt.io.stdout(formatBudget(result));
+    return result;
+}
+function formatBudget(result) {
+    const lines = [
+        'Initial JS, gzip (1 KB = 1024 bytes):'
+    ];
+    for (const s of result.shells){
+        const limit = null === s.budgetKb ? 'no baseline set (budget.baselineKb), not checked' : `limit ${String(s.budgetKb)}`;
+        lines.push(`  shell ${s.name}: ${String(s.initialKb)} KB in ${String(s.scripts)} scripts, ${limit}`);
+    }
+    for (const r of result.remotes){
+        lines.push(`  remote ${r.name}: entry ${String(r.entryKb)} KB, limit ${String(r.budgetKb)}`);
+        for (const route of r.routes){
+            const limit = null === route.budgetKb ? 'no budget' : `limit ${String(route.budgetKb)}`;
+            lines.push(`    ${route.route} (${route.expose ?? 'no expose'}): ${String(route.kb)} KB, ${limit}`);
+        }
+    }
+    lines.push(`LCP (+${String(result.model.lcpDeltaMs)} ms) is measured by the perf job, not here.`);
+    for (const f of result.findings)lines.push('', `error ${f.code} ${f.message}`, `  Fix: ${f.fix}`, `  ${f.docs}`);
+    return lines.join('\n');
+}
+const LOCAL_HOSTS = new Set([
+    'localhost',
+    '127.0.0.1',
+    '[::1]'
+]);
+function parseOverrides(flags, remotes) {
+    const out = new Map();
+    for (const flag of flags){
+        const equals = flag.indexOf('=');
+        if (equals < 1) throw new MfeflowError('E107', `--remote "${flag}" must look like name=url`);
+        const name = flag.slice(0, equals);
+        const raw = flag.slice(equals + 1);
+        if (!remotes.includes(name)) throw new MfeflowError('E107', `--remote ${name}: no remote called "${name}" (remotes: ${remotes.join(', ')})`);
+        let url;
+        try {
+            url = new URL(raw);
+        } catch  {
+            throw new MfeflowError('E107', `--remote ${name}=${raw}: not a URL`);
+        }
+        if ('http:' !== url.protocol && 'https:' !== url.protocol) throw new MfeflowError('E107', `--remote ${name}=${raw}: only http and https URLs`);
+        if ('/' === url.pathname && '' === url.search && '' === url.hash) url = new URL('/mf-manifest.json', url);
+        out.set(name, url.href);
+    }
+    return out;
+}
+function assertAllowed(overrides, allowed) {
+    const origins = new Set(allowed.map((o)=>originOf(o)));
+    for (const [name, href] of overrides){
+        const url = new URL(href);
+        if (!LOCAL_HOSTS.has(url.hostname) && !origins.has(url.origin)) throw new MfeflowError('E107', `--remote ${name}=${href} is not on localhost; pass --allow-origin ${url.origin} to allow it`);
+    }
+}
+function originOf(value) {
+    try {
+        return new URL(value).origin;
+    } catch  {
+        throw new MfeflowError('E107', `--allow-origin "${value}" is not an origin like https://dev.example.com`);
+    }
+}
+function devIndex(view, overrides = new Map()) {
+    const remotes = view.apps.filter((app)=>'remote' === app.kind).toSorted((a, b)=>a.name < b.name ? -1 : a.name > b.name ? 1 : 0).map((app)=>{
+        const entry = view.registry.dev?.[app.name];
+        const fromRegistry = entry?.state === 'ok' ? entry.value : void 0;
+        const fallback = void 0 === app.port ? '' : `http://localhost:${String(app.port)}/mf-manifest.json`;
+        return {
+            name: app.name,
+            entry: overrides.get(app.name) ?? fromRegistry?.manifestUrl ?? fallback,
+            version: overrides.has(app.name) ? 'override' : fromRegistry?.version ?? 'dev'
+        };
+    }).filter((remote)=>'' !== remote.entry);
+    return {
+        remotes
+    };
+}
+const serializeIndex = (index)=>`${JSON.stringify(index, null, 2)}\n`;
+const DEFAULT_WAIT = {
+    intervalMs: 2000,
+    timeoutMs: 300000
+};
+const GRACE_MS = 5000;
+const DEFAULT_PATHEXT = '.COM;.EXE;.BAT;.CMD';
+function resolveCommand(command, env) {
+    const win = 'win32' === env.platform;
+    const flavour = win ? node_path.win32 : node_path.posix;
+    if (command.includes('/') || win && command.includes('\\')) return flavour.isAbsolute(command) ? command : flavour.resolve(command);
+    const extensions = win ? (env.pathext ?? DEFAULT_PATHEXT).split(';').filter((ext)=>'' !== ext) : [];
+    const hasExtension = extensions.some((ext)=>command.toLowerCase().endsWith(ext.toLowerCase()));
+    const names = win ? hasExtension ? [
+        command
+    ] : extensions.map((ext)=>command + ext) : [
+        command
+    ];
+    for (const dir of (env.path ?? '').split(flavour.delimiter))if ('' !== dir) for (const name of names){
+        const file = flavour.join(dir, name);
+        if (env.isFile(file)) return file;
+    }
+}
+function isRunnableFile(file) {
+    try {
+        if (!node_fs.statSync(file).isFile()) return false;
+        if ('win32' !== process.platform) node_fs.accessSync(file, node_fs.constants.X_OK);
+        return true;
+    } catch  {
+        return false;
+    }
+}
+const resolved = new Map();
+function absoluteCommand(command) {
+    if (!resolved.has(command)) {
+        const key = Object.keys(process.env).find((k)=>'PATH' === k.toUpperCase());
+        resolved.set(command, resolveCommand(command, {
+            path: void 0 === key ? void 0 : process.env[key],
+            pathext: process.env.PATHEXT,
+            platform: process.platform,
+            isFile: isRunnableFile
+        }));
+    }
+    return resolved.get(command) ?? command;
+}
+const taskkillExe = ()=>node_path.win32.join(process.env.SystemRoot ?? String.raw`C:\Windows`, 'System32', 'taskkill.exe');
+const alive = (kill, pid)=>{
+    try {
+        kill(-pid, 0);
+        return true;
+    } catch  {
+        return false;
+    }
+};
+const sleep = (ms)=>new Promise((resolve)=>setTimeout(resolve, ms));
+async function killTree(pid, how) {
+    if ('win32' === how.platform) return void await how.taskkill(pid);
+    for (const signal of [
+        'SIGTERM',
+        'SIGKILL'
+    ]){
+        try {
+            how.kill(-pid, signal);
+        } catch  {
+            return;
+        }
+        const deadline = Date.now() + ('SIGTERM' === signal ? how.graceMs : 2000);
+        while(alive(how.kill, pid) && Date.now() < deadline)await sleep(50);
+        if (!alive(how.kill, pid)) return;
+    }
+}
+const realKiller = {
+    platform: process.platform,
+    kill: (pid, signal)=>process.kill(pid, signal),
+    taskkill: (pid)=>new Promise((resolve)=>{
+            const child = spawn(taskkillExe(), [
+                '/pid',
+                String(pid),
+                '/T',
+                '/F'
+            ], {
+                stdio: 'ignore'
+            });
+            child.on('error', ()=>{
+                resolve();
+            });
+            child.on('close', ()=>{
+                resolve();
+            });
+        }),
+    graceMs: GRACE_MS
+};
+function wrap(child, killer) {
+    const exit = new Promise((resolve)=>{
+        child.once('close', ()=>{
+            resolve();
+        });
+        child.once('error', ()=>{
+            resolve();
+        });
+    });
+    return {
+        pid: child.pid,
+        onOutput (listener) {
+            for (const stream of [
+                child.stdout,
+                child.stderr
+            ])stream?.on('data', (chunk)=>{
+                listener(chunk.toString('utf8'));
+            });
+        },
+        onExit (listener) {
+            child.once('close', (code)=>{
+                listener(code);
+            });
+            child.once('error', ()=>{
+                listener(null);
+            });
+        },
+        async stop () {
+            if (void 0 !== child.pid) await killTree(child.pid, killer);
+            await Promise.race([
+                exit,
+                sleep(2000)
+            ]);
+        }
+    };
+}
+function createReaper(proc, killNow) {
+    const live = new Set();
+    let listening = false;
+    return {
+        track (pid) {
+            if (!listening) {
+                listening = true;
+                proc.on('exit', ()=>{
+                    for (const left of live)killNow(left);
+                });
+            }
+            live.add(pid);
+        },
+        untrack (pid) {
+            live.delete(pid);
+        }
+    };
+}
+const reaper = createReaper(process, (pid)=>{
+    if ('win32' === process.platform) return void spawnSync(taskkillExe(), [
+        '/pid',
+        String(pid),
+        '/T',
+        '/F'
+    ], {
+        stdio: 'ignore'
+    });
+    try {
+        process.kill(-pid, 'SIGKILL');
+    } catch  {}
+});
+const spawnDev = (spec)=>{
+    const command = absoluteCommand(spec.command);
+    const shell = 'win32' === process.platform && (!node_path.isAbsolute(command) || /\.(?:cmd|bat)$/i.test(command));
+    const child = spawn(shell && /\s/.test(command) ? `"${command}"` : command, [
+        ...spec.args
+    ], {
+        cwd: spec.cwd,
+        env: {
+            ...process.env,
+            ...spec.env
+        },
+        stdio: [
+            'ignore',
+            'pipe',
+            'pipe'
+        ],
+        detached: 'win32' !== process.platform,
+        shell
+    });
+    const proc = wrap(child, realKiller);
+    if (void 0 === child.pid) return proc;
+    const { pid } = child;
+    reaper.track(pid);
+    child.once('close', ()=>{
+        if (!alive(realKiller.kill, pid)) reaper.untrack(pid);
+    });
+    return {
+        ...proc,
+        async stop () {
+            await proc.stop();
+            reaper.untrack(pid);
+        }
+    };
+};
+function portFree(port) {
+    return new Promise((resolve)=>{
+        const probe = node_net.createServer();
+        probe.once('error', ()=>{
+            resolve(false);
+        });
+        probe.listen(port, ()=>{
+            probe.close(()=>{
+                resolve(true);
+            });
+        });
+    });
+}
+const DEBOUNCE_MS = 150;
+function watchPaths(paths, listener) {
+    let timer;
+    const fire = ()=>{
+        clearTimeout(timer);
+        timer = setTimeout(listener, DEBOUNCE_MS);
+    };
+    const watchers = [];
+    for (const target of paths){
+        let folder = target;
+        let only;
+        try {
+            if (!node_fs.statSync(target).isDirectory()) {
+                folder = node_path.dirname(target);
+                only = node_path.basename(target);
+            }
+        } catch  {
+            continue;
+        }
+        try {
+            watchers.push(node_fs.watch(folder, (_event, name)=>{
+                if (void 0 === only || null === name || name === only) fire();
+            }));
+        } catch  {}
+    }
+    return ()=>{
+        clearTimeout(timer);
+        for (const watcher of watchers)watcher.close();
+    };
+}
+function onInterrupt(listener, source = process) {
+    const signals = [
+        'SIGINT',
+        'SIGTERM',
+        'SIGHUP'
+    ];
+    for (const signal of signals)source.on(signal, listener);
+    return ()=>{
+        for (const signal of signals)source.off(signal, listener);
+    };
+}
+function realDevHost() {
+    return {
+        spawn: spawnDev,
+        onInterrupt: onInterrupt,
+        watch: watchPaths,
+        portFree: portFree
+    };
+}
+const DEV_ARGS = {
+    only: {
+        type: 'string',
+        description: 'Run only these apps, comma separated (default: the shell and every remote)',
+        valueHint: 'a,b'
+    },
+    remote: {
+        type: 'string',
+        description: 'Use a server you already run for a remote, repeatable: --remote checkout=http://localhost:3001',
+        valueHint: 'name=url'
+    },
+    'allow-origin': {
+        type: 'string',
+        description: 'Let --remote point at this origin; localhost is always allowed. Repeatable',
+        valueHint: 'origin'
+    },
+    ...GLOBAL_ARGS
+};
+const PALETTE = [
+    36,
+    35,
+    33,
+    32,
+    34,
+    91
+];
+const REGISTRY_DIR = '.mfeflow';
+const REGISTRY_FILE = 'dev-registry.json';
+async function writeIfChanged(file, text) {
+    if (await readText(file) === text) return false;
+    await promises.mkdir(node_path.dirname(file), {
+        recursive: true
+    });
+    const temp = `${file}.${String(process.pid)}.tmp`;
+    await promises.writeFile(temp, text, 'utf8');
+    await promises.rename(temp, file);
+    return true;
+}
+class Session {
+    host;
+    out;
+    registryFile;
+    names;
+    running = new Map();
+    buffers = new Map();
+    stopping = false;
+    failed = new Set();
+    finish;
+    done = new Promise((resolve)=>{
+        this.finish = resolve;
+    });
+    width;
+    color;
+    constructor(host, io, out, registryFile, names){
+        this.host = host;
+        this.out = out;
+        this.registryFile = registryFile;
+        this.names = names;
+        this.width = Math.max(...names.map((n)=>n.length), 4);
+        this.color = void 0 === io.env.NO_COLOR && (io.interactive || void 0 !== io.env.FORCE_COLOR);
+    }
+    get hasFailed() {
+        return this.failed.size > 0;
+    }
+    has(name) {
+        return this.running.has(name);
+    }
+    runningNames() {
+        return [
+            ...this.running.keys()
+        ];
+    }
+    prefix(name) {
+        const index = Math.max(0, this.names.indexOf(name));
+        const label = name.padEnd(this.width);
+        const code = PALETTE[index % PALETTE.length] ?? 36;
+        return this.color ? `\u001B[${String(code)}m${label} |\u001B[0m ` : `${label} | `;
+    }
+    line(name, text) {
+        this.out(`${this.prefix(name)}${text}`);
+    }
+    feed(name, chunk) {
+        const text = (this.buffers.get(name) ?? '') + chunk;
+        const lines = text.split(/\r?\n/);
+        this.buffers.set(name, lines.pop() ?? '');
+        for (const line of lines)if ('' !== line.trim()) this.line(name, line);
+    }
+    flush(name) {
+        const rest = this.buffers.get(name) ?? '';
+        this.buffers.delete(name);
+        if ('' !== rest.trim()) this.line(name, rest);
+    }
+    start(app, packageManager) {
+        const child = this.host.spawn({
+            command: packageManager,
+            args: [
+                'run',
+                'dev'
+            ],
+            cwd: app.dir,
+            env: {
+                MFEFLOW_DEV_REGISTRY: this.registryFile,
+                ...this.color ? {
+                    FORCE_COLOR: '1'
+                } : {}
+            }
+        });
+        this.running.set(app.name, child);
+        this.failed.delete(app.name);
+        child.onOutput((chunk)=>{
+            this.feed(app.name, chunk);
+        });
+        child.onExit((code)=>{
+            this.flush(app.name);
+            if (this.running.get(app.name) !== child) return;
+            this.running.delete(app.name);
+            if (!this.stopping) {
+                this.line(app.name, 0 === code ? 'stopped' : `exited with code ${String(code)}`);
+                if (0 !== code) this.failed.add(app.name);
+                if (0 === this.running.size) this.finish?.();
+            }
+        });
+    }
+    async stopOne(name) {
+        const child = this.running.get(name);
+        if (void 0 === child) return;
+        this.running.delete(name);
+        await child.stop();
+        this.flush(name);
+    }
+    async stopAll() {
+        this.stopping = true;
+        await Promise.all([
+            ...this.running.keys()
+        ].map((name)=>this.stopOne(name)));
+        this.finish?.();
+    }
+}
+function describe(app, packageManager) {
+    return {
+        name: app.name,
+        kind: app.kind,
+        port: app.port ?? null,
+        url: void 0 === app.port ? null : `http://localhost:${String(app.port)}`,
+        command: `${packageManager} run dev`,
+        status: 'started'
+    };
+}
+async function isLinked(app, root, name) {
+    let dir = app.dir;
+    while(!node_path.relative(root, dir).startsWith('..')){
+        try {
+            await promises.access(node_path.join(dir, 'node_modules', ...name.split('/')));
+            return true;
+        } catch  {}
+        const parent = node_path.dirname(dir);
+        if (parent === dir || dir === root) break;
+        dir = parent;
+    }
+    return false;
+}
+async function hasDependencies(app, root) {
+    const text = await readText(node_path.join(app.dir, 'package.json'));
+    let doc;
+    try {
+        doc = void 0 === text ? void 0 : JSON.parse(text);
+    } catch  {
+        return false;
+    }
+    if ('object' != typeof doc || null === doc) return false;
+    const names = [
+        'dependencies',
+        'devDependencies'
+    ].flatMap((key)=>{
+        const group = Reflect.get(doc, key);
+        return 'object' == typeof group && null !== group ? Object.keys(group) : [];
+    });
+    const linked = await Promise.all(names.map((name)=>isLinked(app, root, name)));
+    return linked.every(Boolean);
+}
+async function busyPorts(host, apps) {
+    const checked = await Promise.all(apps.map(async (app)=>void 0 === app.port ? void 0 : await host.portFree(app.port) ? void 0 : app));
+    return checked.filter((a)=>void 0 !== a);
+}
+function assertPortsFree(busy) {
+    if (0 === busy.length) return;
+    throw new MfeflowError('E306', busy.map((a)=>`${String(a.port)} is in use (${a.name})`).join('; '), {
+        fix: "Stop whatever listens there (an earlier `mfeflow dev`?), or change the port in mfeflow.json and the app's rsbuild config."
+    });
+}
+async function runDev(rt, args, raw) {
+    assertKnownFlags(raw, DEV_ARGS);
+    const globals = readGlobals(args, rt.io.env, rt.io.cwd);
+    const host = rt.dev ?? realDevHost();
+    const root = await findProjectRoot(globals.cwd);
+    let view = await inspectProject(root);
+    const { packageManager } = view.project;
+    const known = view.apps.map((a)=>a.name);
+    const only = splitList('string' == typeof args.only ? args.only : void 0);
+    const unknown = (only ?? []).filter((n)=>!known.includes(n));
+    if (unknown.length > 0) throw new MfeflowError('E107', `--only ${unknown.join(', ')}: no such app (apps: ${known.join(', ')})`);
+    const overrides = parseOverrides(repeated(raw, 'remote'), view.apps.filter((a)=>'remote' === a.kind).map((a)=>a.name));
+    assertAllowed(overrides, repeated(raw, 'allow-origin'));
+    const wanted = (v)=>v.apps.filter((a)=>a.present && !overrides.has(a.name) && (void 0 === only || only.includes(a.name)));
+    const first = wanted(view);
+    if (0 === first.length) throw new MfeflowError('E107', 'nothing to run: every app is missing, filtered out by --only, or overridden');
+    const registryFile = node_path.join(root, REGISTRY_DIR, REGISTRY_FILE);
+    const out = (text)=>{
+        if (globals.json) rt.io.stderr(text);
+        else rt.io.stdout(text);
+    };
+    const apps = [
+        ...first.map((a)=>describe(a, packageManager)),
+        ...[
+            ...overrides.keys()
+        ].map((name)=>({
+                name,
+                kind: 'remote',
+                port: null,
+                url: overrides.get(name) ?? null,
+                command: '',
+                status: 'overridden'
+            }))
+    ];
+    const base = {
+        ok: true,
+        command: 'dev',
+        root,
+        registry: registryFile,
+        apps,
+        overrides: Object.fromEntries(overrides)
+    };
+    if (globals.dryRun) {
+        if (!globals.json) {
+            for (const app of apps)out('overridden' === app.status ? `${app.name}: uses ${app.url ?? ''}` : `${app.name}: ${app.command} in ${view.apps.find((a)=>a.name === app.name)?.rel ?? ''} (port ${String(app.port)})`);
+            out(`dev registry: ${JSON.stringify(devIndex(view, overrides).remotes.map((r)=>`${r.name} -> ${r.entry}`))}`);
+        }
+        return {
+            ...base,
+            dryRun: true,
+            interrupted: false
+        };
+    }
+    assertPortsFree(await busyPorts(host, first));
+    await writeIfChanged(registryFile, serializeIndex(devIndex(view, overrides)));
+    const session = new Session(host, rt.io, out, registryFile, known);
+    let busy = Promise.resolve();
+    const waiting = new Set();
+    const policy = host.waitPolicy ?? DEFAULT_WAIT;
+    let poll;
+    let waitingSince = 0;
+    let closed = false;
+    const stopPolling = ()=>{
+        clearInterval(poll);
+        poll = void 0;
+    };
+    const keepPolling = ()=>{
+        if (0 === waiting.size || closed) stopPolling();
+        else if (void 0 === poll) {
+            waitingSince = Date.now();
+            poll = setInterval(()=>reload(true), policy.intervalMs);
+        } else if (Date.now() - waitingSince > policy.timeoutMs) {
+            out(`mfeflow: gave up waiting for ${[
+                ...waiting
+            ].join(', ')} to be installed. Run \`${packageManager} install\`, then save mfeflow.json or run \`mfeflow dev\` again.`);
+            waiting.clear();
+            stopPolling();
+        }
+    };
+    const reload = (fromPoll = false)=>{
+        busy = busy.then(async ()=>{
+            if (fromPoll && void 0 === poll) return;
+            let next;
+            try {
+                next = await inspectProject(root);
+            } catch (error) {
+                out(`mfeflow: ${messageOf(error)} (keeping what is running)`);
+                return;
+            }
+            view = next;
+            if (await writeIfChanged(registryFile, serializeIndex(devIndex(next, overrides)))) out(`mfeflow: dev registry updated (${devIndex(next, overrides).remotes.map((r)=>r.name).join(', ') || 'no remotes'})`);
+            const now = wanted(next);
+            for (const name of session.runningNames())if (!now.some((a)=>a.name === name)) {
+                out(`mfeflow: ${name} left the project, stopping it`);
+                await session.stopOne(name);
+            }
+            const candidates = now.filter((a)=>!session.has(a.name));
+            const installed = await Promise.all(candidates.map((app)=>hasDependencies(app, root)));
+            const fresh = candidates.filter((app, i)=>{
+                if (true === installed[i]) {
+                    waiting.delete(app.name);
+                    return true;
+                }
+                if (!waiting.has(app.name)) {
+                    out(`mfeflow: ${app.name} is waiting for its install to finish`);
+                    waiting.add(app.name);
+                }
+                return false;
+            });
+            const stuck = await busyPorts(host, fresh);
+            for (const app of fresh)if (stuck.includes(app)) out(`mfeflow: not starting ${app.name}: port ${String(app.port)} is in use`);
+            else {
+                out(`mfeflow: starting ${app.name}${void 0 === app.port ? '' : ` on ${String(app.port)}`}`);
+                session.start(app, packageManager);
+            }
+            keepPolling();
+        });
+    };
+    const stopWatching = host.watch([
+        node_path.join(root, 'mfeflow.json'),
+        node_path.join(root, 'registry', 'envs', 'dev'),
+        node_path.join(root, 'pnpm-lock.yaml')
+    ], ()=>reload());
+    let interrupted = false;
+    const stopListening = host.onInterrupt(()=>{
+        if (interrupted) return;
+        interrupted = true;
+        out('\nmfeflow: stopping…');
+        session.stopAll();
+    });
+    for (const app of first)session.start(app, packageManager);
+    out(`mfeflow: running ${first.map((a)=>a.name).join(', ')}${overrides.size > 0 ? `; using your ${[
+        ...overrides.keys()
+    ].join(', ')}` : ''}. Ctrl+C stops everything.`);
+    try {
+        await session.done;
+    } finally{
+        stopWatching();
+        stopListening();
+        closed = true;
+        stopPolling();
+        await busy;
+        await session.stopAll();
+    }
+    return {
+        ...base,
+        ok: !session.hasFailed,
+        dryRun: false,
+        interrupted
+    };
+}
+const FEATURES_ARGS = {
+    search: {
+        type: 'positional',
+        required: false,
+        description: "Only features whose name or description contains this"
+    },
+    ...GLOBAL_ARGS
+};
+async function installedFeatures(cwd) {
+    try {
+        const project = await loadProject(await findProjectRoot(cwd));
+        return new Set(Object.keys(project.features));
+    } catch  {
+        return new Set();
+    }
+}
+function matches(feature, search) {
+    const needle = search.toLowerCase();
+    return feature.name.toLowerCase().includes(needle) || feature.description.toLowerCase().includes(needle);
+}
+function features_line(feature) {
+    const tags = [
+        feature.always ? 'always' : feature.default ? 'default' : 'opt-in',
+        ...feature.installed ? [
+            'installed'
+        ] : []
+    ];
+    return `  ${feature.name.padEnd(14)} ${feature.version.padEnd(7)} ${feature.description} [${tags.join(', ')}]`;
+}
+async function runFeatures(rt, args, raw) {
+    assertKnownFlags(raw, FEATURES_ARGS);
+    const globals = readGlobals(args, rt.io.env, rt.io.cwd);
+    const search = 'string' == typeof args.search && '' !== args.search ? args.search : null;
+    const installed = await installedFeatures(globals.cwd);
+    const all = await Promise.all(FIRST_PARTY.map(async (first)=>{
+        const { manifest } = await loadAny(first.name, {
+            roots: rt.roots
+        });
+        return {
+            name: first.name,
+            version: manifest.version,
+            description: manifest.description ?? '',
+            always: first.always,
+            default: first.default,
+            installed: installed.has(first.name)
+        };
+    }));
+    const features = null === search ? all : all.filter((f)=>matches(f, search));
+    if (!globals.json) {
+        if (0 === features.length) rt.io.stdout(`No features match "${search ?? ''}".`);
+        else rt.io.stdout(features.map(features_line).join('\n'));
+        rt.io.stdout('\nFrom a registry: mfeflow add @namespace/name (configure it under "registries" in mfeflow.json).');
+    }
+    return {
+        ok: true,
+        command: 'features',
+        search,
+        features
+    };
+}
+const INIT_ARGS = {
+    dir: {
+        type: 'positional',
+        required: false,
+        description: 'Folder to create (default mfeflow-app)'
+    },
+    scope: {
+        type: 'string',
+        description: 'npm scope for the project packages, like @my-org',
+        valueHint: '@scope'
+    },
+    remotes: {
+        type: 'string',
+        description: 'Remotes to create, comma separated (default catalog,cart)',
+        valueHint: 'a,b'
+    },
+    features: {
+        type: 'string',
+        description: `Optional features, comma separated (${OPTIONAL_FEATURES.join(', ')})`,
+        valueHint: 'a,b'
+    },
+    'package-manager': {
+        type: 'string',
+        description: 'pnpm (the only one in this release)',
+        valueHint: 'pm'
+    },
+    topology: {
+        type: 'string',
+        description: 'monorepo (the only one in this release)',
+        valueHint: 'name'
+    },
+    option: {
+        type: 'string',
+        description: 'A feature option, repeatable: --option feature.key=value',
+        valueHint: 'f.k=v'
+    },
+    ...GLOBAL_ARGS
+};
+const DEFAULT_DIR = 'mfeflow-app';
+const DEFAULT_REMOTES = [
+    'catalog',
+    'cart'
+];
+const SCOPE = /^@[a-z0-9][a-z0-9-._]*$/;
+function scopeFor(dir, cwd = process.cwd()) {
+    const name = node_path.basename(node_path.resolve(cwd, dir)).toLowerCase().replaceAll(/[^a-z0-9-._]+/g, '-').replaceAll(/^[^a-z0-9]+|[^a-z0-9]+$/g, '');
+    return `@${'' === name ? 'app' : name}`;
+}
+function checkRemotes(remotes) {
+    const seen = new Set();
+    for (const name of remotes){
+        assertAppName(name);
+        if (seen.has(name)) throw new MfeflowError('E215', `"${name}" is listed twice`);
+        seen.add(name);
+    }
+}
+function checkFeatures(requested) {
+    const optional = new Set();
+    for (const name of requested)if (!FIRST_PARTY.some((f)=>f.name === name && f.always)) {
+        if (!isFirstParty(name)) throw new MfeflowError('E201', `"${name}" (init takes ${OPTIONAL_FEATURES.join(', ')}; add others later with \`mfeflow add\`)`);
+        optional.add(name);
+    }
+    return OPTIONAL_FEATURES.filter((name)=>optional.has(name));
+}
+function init_only(flag, value, allowed) {
+    if (void 0 !== value && value !== allowed) throw new MfeflowError('E107', `--${flag} ${value}: only ${allowed} is available in this release`);
+}
+async function resolveInitOptions(rt, globals, args, raw, preset) {
+    init_only('package-manager', args_text(args, 'package-manager') ?? preset.packageManager, 'pnpm');
+    init_only('topology', args_text(args, 'topology') ?? preset.topology, 'monorepo');
+    const { canPrompt } = globals;
+    const { prompter } = rt;
+    const given = 'string' == typeof args.dir && '' !== args.dir ? args.dir : void 0;
+    const dir = given ?? (canPrompt ? await prompter.text({
+        message: 'Where should the project go?',
+        initialValue: DEFAULT_DIR
+    }) : DEFAULT_DIR);
+    const scopeFlag = args_text(args, 'scope') ?? preset.scope;
+    const scope = scopeFlag ?? (canPrompt ? await prompter.text({
+        message: 'npm scope for your packages',
+        initialValue: scopeFor(dir, globals.cwd),
+        validate: (v)=>SCOPE.test(v) ? void 0 : 'Use a scope like @my-org'
+    }) : scopeFor(dir, globals.cwd));
+    if (!SCOPE.test(scope)) throw new MfeflowError('E107', `--scope "${scope}" must look like @my-org`);
+    const remotesFlag = splitList(args_text(args, 'remotes')) ?? preset.remotes;
+    const remotes = remotesFlag ?? (canPrompt ? splitList(await prompter.text({
+        message: 'Remotes, comma separated',
+        initialValue: DEFAULT_REMOTES.join(',')
+    })) ?? [] : DEFAULT_REMOTES);
+    checkRemotes(remotes);
+    const featuresFlag = splitList(args_text(args, 'features')) ?? preset.features;
+    const features = checkFeatures(featuresFlag ?? (canPrompt ? await prompter.multiselect({
+        message: 'Features',
+        choices: OPTIONAL_FEATURES.map((name)=>({
+                value: name,
+                label: name
+            })),
+        initialValues: DEFAULT_FEATURES
+    }) : DEFAULT_FEATURES));
+    const featureOptions = mergeOptions(preset.options ?? {}, parseFeatureOptions(repeated(raw, 'option')));
+    return {
+        dir,
+        scope,
+        remotes,
+        features,
+        featureOptions
+    };
+}
+async function assertEmpty(root, readdir = promises.readdir) {
+    let entries;
+    try {
+        entries = await readdir(root);
+    } catch (error) {
+        if (hasErrno(error, 'ENOENT')) return;
+        if (hasErrno(error, 'ENOTDIR')) throw new MfeflowError('E108', `${root} is not a folder, or part of its path is a file`, {
+            cause: error
+        });
+        throw new MfeflowError('E106', `could not look inside ${root} (${messageOf(error)})`, {
+            cause: error
+        });
+    }
+    if (entries.length > 0) {
+        const shown = entries.slice(0, 3).join(', ');
+        throw new MfeflowError('E108', `${root} already has ${shown}${entries.length > 3 ? ', …' : ''}`);
+    }
+}
+function skeleton(options) {
+    const apps = {
+        shell: {
+            kind: 'shell',
+            path: 'apps/shell',
+            port: 4300
+        }
+    };
+    options.remotes.forEach((name, index)=>{
+        apps[name] = {
+            kind: 'remote',
+            path: `apps/${name}`,
+            port: 4311 + index
+        };
+    });
+    return {
+        version: 1,
+        topology: 'monorepo',
+        packageManager: 'pnpm',
+        scope: options.scope,
+        apps,
+        features: {}
+    };
+}
+async function runInit(rt, args, raw) {
+    assertKnownFlags(raw, INIT_ARGS);
+    const globals = readGlobals(args, rt.io.env, rt.io.cwd, rt.io.interactive);
+    const preset = globals.preset ? await loadPreset(globals.preset, {
+        cwd: globals.cwd,
+        fetch: rt.fetch
+    }) : {};
+    const options = await resolveInitOptions(rt, globals, args, raw, preset);
+    const root = node_path.resolve(globals.cwd, options.dir);
+    await assertEmpty(root);
+    const chosen = chooseLocal(skeleton(options), root, globals.cwd, globals.local);
+    const { project } = chosen;
+    const builder = createBuilder(root, chosen.checkout);
+    const names = [
+        'core',
+        'tsconfig',
+        ...options.features
+    ];
+    assertOptionsAreForFeatures(options.featureOptions, names);
+    const loaded = await Promise.all(names.map((name)=>loadAny(name, {
+            roots: rt.roots
+        })));
+    await inOrder(loaded, (feature)=>resolveFeature({
+            feature,
+            project,
+            builder,
+            options: options.featureOptions[feature.manifest.name] ?? {},
+            alsoAdding: names
+        }));
+    const core = loaded[0];
+    await inOrder(options.remotes, async (remote)=>{
+        const port = project.apps[remote]?.port;
+        if (void 0 === core || void 0 === port) return;
+        await resolveFeature({
+            feature: await remoteGlue({
+                roots: rt.roots,
+                version: core.manifest.version,
+                remote: {
+                    name: remote,
+                    port
+                },
+                registry: true,
+                shells: [
+                    'shell'
+                ]
+            }),
+            project,
+            builder,
+            alsoAdding: names
+        });
+    });
+    const plan = builder.build();
+    const outcome = await writePlan({
+        rt,
+        globals,
+        root,
+        plan,
+        project,
+        afterWrite: async ()=>{
+            if (options.features.includes('git-hooks')) await rt.system.gitInit(root);
+        }
+    });
+    const next = [
+        ...node_path.resolve(globals.cwd) === root ? [] : [
+            `cd ${options.dir}`
+        ],
+        ...outcome.installed || outcome.dryRun ? [] : [
+            'pnpm install'
+        ],
+        'pnpm dev'
+    ];
+    const result = {
+        ok: true,
+        command: 'init',
+        dryRun: outcome.dryRun,
+        root,
+        scope: options.scope,
+        apps: Object.entries(project.apps).map(([name, app])=>({
+                name,
+                kind: app.kind,
+                path: app.path,
+                port: app.port ?? null
+            })),
+        plan: planReport(outcome.shown),
+        written: outcome.written,
+        installed: outcome.installed,
+        next,
+        ...void 0 === outcome.diff ? {} : {
+            diff: outcome.diff
+        }
+    };
+    if (!globals.json) printInit(rt, result);
+    return result;
+}
+function printInit(rt, result) {
+    if (result.dryRun) return void rt.io.stdout('\nDry run: nothing was written.');
+    const remotes = result.apps.filter((a)=>'remote' === a.kind).map((a)=>a.name);
+    rt.io.stdout(`\nCreated ${result.root} with a shell and ${String(remotes.length)} remote${1 === remotes.length ? '' : 's'} (${remotes.join(', ')}).`);
+    rt.io.stdout(`Next:\n${result.next.map((line)=>`  ${line}`).join('\n')}`);
+}
+const REPO_URL = 'https://github.com/mfeflow/mfeflow';
+function flagLabel(name, def) {
+    const alias = 'alias' in def ? [
+        def.alias ?? []
+    ].flat().map((a)=>`-${a}, `).join('') : '';
+    if ('boolean' === def.type) return `${alias}--${name}`;
+    return `${alias}--${name} <${'valueHint' in def ? def.valueHint ?? 'value' : 'value'}>`;
+}
+function table(args, skip) {
+    const rows = Object.entries(args).filter(([name, def])=>'positional' !== def.type && !skip.has(name)).map(([name, def])=>[
+            flagLabel(name, def),
+            def.description ?? ''
+        ]);
+    const width = Math.max(0, ...rows.map(([label])=>label.length));
+    return rows.map(([label, text])=>`  ${label.padEnd(width)}  ${text}`);
+}
+function commandHelp(help) {
+    const globals = new Set(Object.keys(GLOBAL_ARGS));
+    const own = table(help.args, globals);
+    const lines = [
+        `mfeflow ${help.name} - ${help.summary}`,
+        '',
+        `Usage: ${help.usage}`
+    ];
+    if (own.length > 0) lines.push('', 'Options:', ...own);
+    lines.push('', 'Global options:', ...table(GLOBAL_ARGS, new Set()));
+    lines.push('', 'Examples:', ...help.examples.map((example)=>`  ${example}`));
+    lines.push('', `Docs: ${DOCS_URL}/`);
+    return lines.join('\n');
+}
+function exitCodesText() {
+    return [
+        `  ${String(EXIT.ok)}    success`,
+        `  ${String(EXIT.unexpected)}    unexpected error`,
+        `  ${String(EXIT.usage)}    bad command line (MFEFLOW_E107)`,
+        `  ${String(EXIT.project)}    project or config problem (MFEFLOW_E1xx)`,
+        `  ${String(EXIT.feature)}    feature problem (MFEFLOW_E2xx)`,
+        `  ${String(EXIT.build)}    build or runtime problem (MFEFLOW_E3xx)`,
+        `  ${String(EXIT.registry)}    registry problem (MFEFLOW_E4xx)`,
+        `  ${String(EXIT.upgrade)}    upgrade problem (MFEFLOW_E5xx)`,
+        `  ${String(EXIT.cancelled)}  cancelled at a prompt, or Ctrl+C in mfeflow dev`
+    ].join('\n');
+}
+function rootHelp(commands) {
+    const width = Math.max(...commands.map((c)=>c.name.length));
+    return [
+        `mfeflow ${readPackageJson().version} - React micro-frontend platform kit`,
+        '',
+        'Usage: mfeflow <command> [options]',
+        '',
+        'Commands:',
+        ...commands.map((c)=>`  ${c.name.padEnd(width)}  ${c.summary}`),
+        '',
+        "Run `mfeflow <command> --help` for a command's options. Every command takes",
+        '--yes, --preset, --json, --dry-run, --cwd, --no-install, --verbose.',
+        '',
+        'Examples:',
+        '  npm create mfeflow@latest my-app -- --yes',
+        '  mfeflow init my-app --remotes catalog,cart,checkout --dry-run',
+        '  mfeflow add remote checkout',
+        '  mfeflow features lint',
+        '',
+        'Exit codes:',
+        exitCodesText(),
+        '',
+        `Docs: ${DOCS_URL}/  Source: ${REPO_URL}`
+    ].join('\n');
+}
+function assetRoots(from = node_path.dirname(fileURLToPath(import.meta.url)), exists = node_fs.existsSync) {
+    const pkg = node_path.resolve(from, '..');
+    const bundled = node_path.join(pkg, 'assets');
+    const fromSource = 'src' === node_path.basename(from);
+    const base = !fromSource && exists(node_path.join(bundled, 'features')) ? bundled : node_path.resolve(pkg, '../..');
+    return {
+        features: node_path.join(base, 'features'),
+        templates: node_path.join(base, 'templates')
+    };
+}
+function processIo() {
+    return {
+        stdout: (text)=>process.stdout.write(`${text}\n`),
+        stderr: (text)=>process.stderr.write(`${text}\n`),
+        cwd: process.cwd(),
+        env: process.env,
+        interactive: process.stdin.isTTY && process.stdout.isTTY
+    };
+}
+function answer(value) {
+    if (__rspack_external__clack_prompts_d2d5c36d.isCancel(value)) throw new Cancelled();
+    return value;
+}
+const clackPrompter = {
+    text: async ({ message, initialValue, validate })=>answer(await __rspack_external__clack_prompts_d2d5c36d.text({
+            message,
+            ...void 0 === initialValue ? {} : {
+                initialValue
+            },
+            ...validate ? {
+                validate: (value)=>validate(value ?? '')
+            } : {}
+        })),
+    multiselect: async ({ message, choices, initialValues })=>answer(await __rspack_external__clack_prompts_d2d5c36d.multiselect({
+            message,
+            options: choices.map((c)=>({
+                    value: c.value,
+                    label: c.label,
+                    ...void 0 === c.hint ? {} : {
+                        hint: c.hint
+                    }
+                })),
+            initialValues: [
+                ...initialValues
+            ],
+            required: false
+        })),
+    select: async ({ message, choices, initialValue })=>answer(await __rspack_external__clack_prompts_d2d5c36d.select({
+            message,
+            options: choices.map((c)=>({
+                    value: c.value,
+                    label: c.label,
+                    ...void 0 === c.hint ? {} : {
+                        hint: c.hint
+                    }
+                })),
+            ...void 0 === initialValue ? {} : {
+                initialValue
+            }
+        })),
+    confirm: async ({ message, initialValue })=>answer(await __rspack_external__clack_prompts_d2d5c36d.confirm({
+            message,
+            initialValue: initialValue ?? true
+        }))
+};
+const REPO_VARIABLES = [
+    'GIT_DIR',
+    'GIT_WORK_TREE',
+    'GIT_INDEX_FILE',
+    'GIT_COMMON_DIR',
+    'GIT_OBJECT_DIRECTORY',
+    'GIT_ALTERNATE_OBJECT_DIRECTORIES',
+    'GIT_PREFIX',
+    'GIT_NAMESPACE'
+];
+function isolatedEnv(env = process.env) {
+    const copy = {
+        ...env
+    };
+    for (const name of REPO_VARIABLES)delete copy[name];
+    return copy;
+}
+const run = (command, args, options)=>new Promise((resolve, reject)=>{
+        const child = spawn(command, args, {
+            cwd: options.cwd,
+            env: isolatedEnv(),
+            stdio: [
+                'ignore',
+                'pipe',
+                'pipe'
+            ],
+            shell: 'win32' === process.platform && !node_path.isAbsolute(command)
+        });
+        let output = '';
+        const collect = (chunk)=>{
+            const text = chunk.toString('utf8');
+            output += text;
+            options.onOutput?.(text);
+        };
+        child.stdout.on('data', collect);
+        child.stderr.on('data', collect);
+        child.on('error', reject);
+        child.on('close', (code)=>{
+            resolve({
+                code: code ?? 1,
+                output
+            });
+        });
+    });
+const TAIL_LINES = 15;
+function installArgs(packageManager) {
+    return 'pnpm' === packageManager ? [
+        'install',
+        '--no-frozen-lockfile'
+    ] : [
+        'install'
+    ];
+}
+function createSystem(io, runner = run) {
+    return {
+        async install (root, packageManager, verbose) {
+            let result;
+            try {
+                result = await runner(packageManager, installArgs(packageManager), {
+                    cwd: root,
+                    ...verbose ? {
+                        onOutput: (chunk)=>io.stderr(chunk.trimEnd())
+                    } : {}
+                });
+            } catch (error) {
+                throw new Error(`could not start ${packageManager} (${messageOf(error)}); install it, for example with \`corepack enable\``, {
+                    cause: error
+                });
+            }
+            if (0 !== result.code) {
+                const tail = result.output.trimEnd().split('\n').slice(-TAIL_LINES).join('\n');
+                throw new Error(`${packageManager} install exited with ${String(result.code)}\n${tail}`);
+            }
+        },
+        async gitInit (root) {
+            try {
+                const inside = await runner('git', [
+                    'rev-parse',
+                    '--is-inside-work-tree'
+                ], {
+                    cwd: root
+                });
+                if (0 === inside.code) return false;
+                return 0 === (await runner('git', [
+                    'init',
+                    '--quiet'
+                ], {
+                    cwd: root
+                })).code;
+            } catch  {
+                return false;
+            }
+        }
+    };
+}
+function realRuntime(io = processIo()) {
+    return {
+        io,
+        prompter: clackPrompter,
+        system: createSystem(io),
+        fetch: (url, init)=>fetch(url, init),
+        roots: assetRoots(),
+        dev: realDevHost()
+    };
+}
+const COMMANDS = [
+    {
+        name: 'init',
+        summary: 'create a new project: a shell and remotes',
+        usage: 'mfeflow init [dir] [options]',
+        args: INIT_ARGS,
+        examples: [
+            'mfeflow init my-app',
+            'mfeflow init my-app --yes',
+            'mfeflow init my-app --scope @acme --remotes catalog,cart,checkout --features lint-oxlint,git-hooks',
+            'mfeflow init my-app --dry-run          # print the diff, write nothing',
+            'mfeflow init my-app --yes --local ~/code/mfeflow   # link a local checkout'
+        ],
+        run: runInit
+    },
+    {
+        name: 'add',
+        summary: 'add a remote, a shell, features or a typed env key to this project',
+        usage: 'mfeflow add remote <name> | mfeflow add shell <name> | mfeflow add <feature...> | mfeflow add env-key <KEY> --scope server|runtime --schema <expr>',
+        args: ADD_ARGS,
+        examples: [
+            'mfeflow add remote checkout',
+            'mfeflow add remote checkout --port 4320',
+            'mfeflow add shell admin',
+            'mfeflow add git-hooks',
+            'mfeflow add @someone/analytics-segment --yes',
+            'mfeflow add url-factory --dry-run',
+            'mfeflow add env-t3 --option env-t3.validator=valibot',
+            'mfeflow add env-key API_ORIGIN --scope server --schema "z.url()"',
+            'mfeflow add env-key GTM_ID --scope runtime --schema "z.string().min(1)" --app shell'
+        ],
+        run: runAdd
+    },
+    {
+        name: 'features',
+        summary: 'list the features you can add',
+        usage: 'mfeflow features [search] [options]',
+        args: FEATURES_ARGS,
+        examples: [
+            'mfeflow features',
+            'mfeflow features lint',
+            'mfeflow features --json'
+        ],
+        run: runFeatures
+    },
+    {
+        name: 'doctor',
+        summary: 'check singletons, compatibility, config and drift; --fix repairs the safe ones',
+        usage: 'mfeflow doctor [options]',
+        args: DOCTOR_ARGS,
+        examples: [
+            'mfeflow doctor',
+            'mfeflow doctor --fix',
+            'mfeflow doctor --json',
+            'mfeflow doctor --fix --dry-run'
+        ],
+        run: runDoctor
+    },
+    {
+        name: 'validate',
+        summary: 'check mfeflow.json, every mfe.json and every registry entry against their schemas',
+        usage: 'mfeflow validate [options]',
+        args: VALIDATE_ARGS,
+        examples: [
+            'mfeflow validate',
+            'mfeflow validate --json'
+        ],
+        run: runValidate
+    },
+    {
+        name: 'check-compat',
+        summary: "check each remote's shared ranges against the shells it runs in",
+        usage: 'mfeflow check-compat [options]',
+        args: COMPAT_ARGS,
+        examples: [
+            'mfeflow check-compat',
+            'mfeflow check-compat --json'
+        ],
+        run: runCheckCompat
+    },
+    {
+        name: 'budget',
+        summary: 'measure the built JS of the shell and each remote against the cost-model budget',
+        usage: 'mfeflow budget [options]',
+        args: BUDGET_ARGS,
+        examples: [
+            'mfeflow budget',
+            'mfeflow budget --json',
+            'mfeflow budget --dist build'
+        ],
+        run: runBudget
+    },
+    {
+        name: 'dev',
+        summary: 'run the shell and every remote together, with a dev registry that follows the project',
+        usage: 'mfeflow dev [options]',
+        args: DEV_ARGS,
+        examples: [
+            'mfeflow dev',
+            'mfeflow dev --only shell,catalog',
+            'mfeflow dev --remote checkout=http://localhost:3001',
+            'mfeflow dev --remote checkout=https://dev.example.com --allow-origin https://dev.example.com',
+            'mfeflow dev --dry-run'
+        ],
+        run: runDev
+    }
+];
+function findCommand(name) {
+    return COMMANDS.find((c)=>c.name === name);
+}
+function toCitty(command, capture, rt) {
+    return defineCommand({
+        meta: {
+            name: command.name,
+            description: command.summary
+        },
+        args: command.args,
+        async run ({ args, rawArgs }) {
+            capture(await command.run(rt, args, rawArgs));
+        }
+    });
+}
+function failure(error) {
+    return {
+        ok: false,
+        error: reportOf(error),
+        exitCode: exitCodeFor(error)
+    };
+}
+function fail(error, rt, json, verbose) {
+    if (error instanceof Cancelled) {
+        rt.io.stderr('Cancelled. Nothing was written.');
+        return EXIT.cancelled;
+    }
+    const mfe = error instanceof Error && 'CLIError' === error.name ? new MfeflowError('E107', stripVTControlCharacters(error.message)) : error;
+    if (isMfeflowError(mfe)) {
+        if (json) rt.io.stdout(JSON.stringify(failure(mfe), null, 2));
+        else rt.io.stderr(mfe.format());
+        if (verbose && void 0 !== mfe.cause) rt.io.stderr(unexpectedText(mfe.cause, true));
+        return exitCodeFor(mfe);
+    }
+    if (json) {
+        const failed = {
+            ok: false,
+            error: unexpectedReport(error),
+            exitCode: EXIT.unexpected
+        };
+        rt.io.stdout(JSON.stringify(failed, null, 2));
+    } else rt.io.stderr(unexpectedText(error, verbose));
+    return EXIT.unexpected;
+}
+async function main(argv, rt = realRuntime()) {
+    const json = argv.includes('--json');
+    const verbose = argv.includes('--verbose');
+    try {
+        const [first] = argv;
+        if ('--version' === first || '-v' === first) {
+            rt.io.stdout(`mfeflow ${readPackageJson().version}`);
+            return EXIT.ok;
+        }
+        if (void 0 === first || 'help' === first || '--help' === first || '-h' === first) {
+            rt.io.stdout(rootHelp(COMMANDS));
+            return EXIT.ok;
+        }
+        const command = findCommand(first);
+        if (!command) {
+            const names = COMMANDS.map((c)=>c.name).join(', ');
+            throw new MfeflowError('E107', first.startsWith('-') ? `${first} comes before the command; write mfeflow <command> [options] (commands: ${names})` : `unknown command "${first}" (commands: ${names})`);
+        }
+        const rest = argv.slice(1);
+        if (rest.includes('--help') || rest.includes('-h')) {
+            rt.io.stdout(commandHelp(command));
+            return EXIT.ok;
+        }
+        let result;
+        await runCommand(toCitty(command, (r)=>{
+            result = r;
+        }, rt), {
+            rawArgs: rest
+        });
+        if (json && result) rt.io.stdout(JSON.stringify(result, null, 2));
+        return result ? exitOf(result) : EXIT.ok;
+    } catch (error) {
+        return fail(error, rt, json, verbose);
+    }
+}
+export { COMMANDS, EXIT, exitCodeFor, main, realRuntime, validateResult };