ts-pantry 0.11.132 → 0.11.135

package/README.md

@@ -148,8 +148,8 @@ application metadata in `craft.config.ts` and declare release policy in
   "native": {
     "environment": "production",
     "runtime": {
-      "revision": "d675077c317c486d8b5743f3432c40ddf1cd693a",
-      "version": "0.0.295"
+      "revision": "1fb96b37dc6c30a431570c0902df5aa8a70c911c",
+      "version": "0.0.355"
     },
     "checks": {
       "before": [["bun", "run", "lint"], ["bun", "run", "test:unit"]],
@@ -178,9 +178,11 @@ fails before signing or publication.
 
 The workflow installs dependencies from the
 lockfile, runs all declared checks, provisions the immutable Craft source with
-its locked Zig compiler and first-party pins, builds through Buddy, and checks
-the actual bundle's identity, size, Mach-O executable and native launch. Native
-checks remain app-owned and run against the real artifact. Release tags must
+its locked Zig compiler, resolves and hash-verifies current dependencies through
+Zig's native package manifest, builds through Buddy, and checks
+the actual bundle's identity, size, Mach-O executable and native launch. Pinned
+older Craft revisions keep their declared sibling-source pins; malformed pins
+fail rather than switching dependency contracts. Native checks remain app-owned and run against the real artifact. Release tags must
 match `package.json`. Releases reject the local `CRAFT_BIN` development override.
 
 Direct macOS releases require `APPLE_APPLICATION_CERTIFICATE` (base64 P12),

package/dist/bin/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import{t,x,n,d,h,P,Y,re,f,z,j,E,L,ie,ce,s,M,U,m,V,D,S,_,T,c,G,ue,de,he,et,tt,at}from"../chunk-apsdptxf.js";import"../chunk-2rtvgvbn.js";import C from"node:fs";import O from"node:path";import v from"node:process";import{existsSync as Ge}from"node:fs";import be from"node:fs/promises";import Te from"node:os";import we from"node:path";import oe from"node:process";import{EventEmitter as qe}from"node:events";import se from"node:process";import Ae from"node:process";import Se from"node:process";import ye from"node:process";import pe from"node:process";import De from"node:tty";import Mt,{stdin as ps,stdout as fs}from"node:process";class Ne{configPath;config=null;events=[];retryCount=0;maxRetries=3;retryDelayMs=1000;constructor(){let e=Te.homedir(),i=we.join(e,".config","clapp");this.configPath=we.join(i,"telemetry.json")}async isEnabled(){if(oe.env.DO_NOT_TRACK==="1"||oe.env.DO_NOT_TRACK==="true")return!1;if(oe.env.NO_TELEMETRY==="1"||oe.env.NO_TELEMETRY==="true")return!1;return(await this.loadConfig()).enabled}async enable(){let e=await this.loadConfig();if(e.enabled=!0,!e.userId)e.userId=this.generateUserId();await this.saveConfig(e)}async disable(){let e=await this.loadConfig();e.enabled=!1,await this.saveConfig(e)}async track(e,i){if(!await this.isEnabled())return;let o={event:e,...i,timestamp:Date.now(),platform:Te.platform(),nodeVersion:oe.version};if(this.events.push(o),this.events.length>=10)await this.send()}async trackCommand(e,i){await this.track("command",{command:e,duration:i})}async trackError(e,i){await this.track("error",{error:e,command:i})}async send(){if(!await this.isEnabled()||this.events.length===0)return!0;try{this.events=[],this.retryCount=0;let i=await this.loadConfig();return i.lastSent=Date.now(),await this.saveConfig(i),!0}catch{if(this.retryCount<this.maxRetries){this.retryCount++;let i=this.retryDelayMs*2**(this.retryCount-1);return await this.sleep(i),this.send()}return this.events=[],this.retryCount=0,!1}}async flush(){if(this.events.length===0)return!0;return this.send()}sleep(e){return new Promise((i)=>setTimeout(i,e))}async status(){let e=await this.loadConfig();return{enabled:e.enabled,doNotTrack:oe.env.DO_NOT_TRACK==="1"||oe.env.DO_NOT_TRACK==="true",eventsQueued:this.events.length,lastSent:e.lastSent}}async loadConfig(){if(this.config)return this.config;try{if(Ge(this.configPath)){let e=await be.readFile(this.configPath,"utf-8");return this.config=JSON.parse(e),this.config}}catch{}return this.config={enabled:!1},this.config}async saveConfig(e){this.config=e;try{let i=we.dirname(this.configPath);await be.mkdir(i,{recursive:!0}),await be.writeFile(this.configPath,JSON.stringify(e,null,2),"utf-8")}catch{}}generateUserId(){let e=Math.random().toString(36).substring(2,15),i=Date.now().toString(36);return`${e}-${i}`}}var es=new Ne;function xe(e){return e.replace(/[<[].+/,"").trim()}function He(e){let i=/<([^>]+)>/g,r=/\[([^\]]+)\]/g,o=[],a=(b)=>{let u=!1,p=b[1];if(p.startsWith("..."))p=p.slice(3),u=!0;return{required:b[0].startsWith("<"),value:p,variadic:u}},l;while(l=i.exec(e))o.push(a(l));let g;while(g=r.exec(e))o.push(a(g));return o}function Ke(e){let i={alias:{},boolean:[]};for(let[r,o]of e.entries()){if(o.names.length>1)i.alias[o.names[0]]=o.names.slice(1);if(o.isBoolean)if(o.negated){if(!e.some((l,g)=>g!==r&&l.names.some((b)=>o.names.includes(b))&&typeof l.required==="boolean"))i.boolean.push(o.names[0])}else i.boolean.push(o.names[0])}return i}function _e(e){return e.reduce((i,r)=>i.length>=r.length?i:r,"")}function ve(e,i){return e.length>=i?e:`${e}${" ".repeat(i-e.length)}`}function ge(e){return e.replace(/([a-z])-([a-z])/g,(i,r,o)=>r+o.toUpperCase())}function Je(e,i,r){let o=0,a=i.length,l=e,g;for(;o<a;++o)g=l[i[o]],l=l[i[o]]=o===a-1?r:g!=null?g:!!~i[o+1].indexOf(".")||!(+i[o+1]>-1)?{}:[]}function Ye(e,i){for(let r of Object.keys(i)){let o=i[r];if(o.shouldTransform){if(e[r]=Array.prototype.concat.call([],e[r]),typeof o.transformFunction==="function")e[r]=e[r].map(o.transformFunction)}}}function Ze(e){let i=/([^\\/]+)$/.exec(e);return i?i[1]:""}function fe(e){return e.split(".").map((i,r)=>r===0?ge(i):i).join(".")}class me extends Error{exitCode=2;isUsageError=!0;usage;constructor(e,i){super(e);if(this.name=this.constructor.name,i!==void 0)this.usage=i;if(typeof Error.captureStackTrace==="function")Error.captureStackTrace(this,this.constructor);else this.stack=Error(e).stack}format(e=!1){if(e&&this.stack)return`${this.message}
+import{t,x,n,d,h,P,Y,re,f,z,j,E,L,ie,ce,s,M,U,m,V,D,S,_,T,c,G,ue,de,he,et,tt,at}from"../chunk-xf6jmg4r.js";import"../chunk-9xrmp053.js";import C from"node:fs";import O from"node:path";import v from"node:process";import{existsSync as Ge}from"node:fs";import be from"node:fs/promises";import Te from"node:os";import we from"node:path";import oe from"node:process";import{EventEmitter as qe}from"node:events";import se from"node:process";import Ae from"node:process";import Se from"node:process";import ye from"node:process";import pe from"node:process";import De from"node:tty";import Mt,{stdin as ps,stdout as fs}from"node:process";class Ne{configPath;config=null;events=[];retryCount=0;maxRetries=3;retryDelayMs=1000;constructor(){let e=Te.homedir(),i=we.join(e,".config","clapp");this.configPath=we.join(i,"telemetry.json")}async isEnabled(){if(oe.env.DO_NOT_TRACK==="1"||oe.env.DO_NOT_TRACK==="true")return!1;if(oe.env.NO_TELEMETRY==="1"||oe.env.NO_TELEMETRY==="true")return!1;return(await this.loadConfig()).enabled}async enable(){let e=await this.loadConfig();if(e.enabled=!0,!e.userId)e.userId=this.generateUserId();await this.saveConfig(e)}async disable(){let e=await this.loadConfig();e.enabled=!1,await this.saveConfig(e)}async track(e,i){if(!await this.isEnabled())return;let o={event:e,...i,timestamp:Date.now(),platform:Te.platform(),nodeVersion:oe.version};if(this.events.push(o),this.events.length>=10)await this.send()}async trackCommand(e,i){await this.track("command",{command:e,duration:i})}async trackError(e,i){await this.track("error",{error:e,command:i})}async send(){if(!await this.isEnabled()||this.events.length===0)return!0;try{this.events=[],this.retryCount=0;let i=await this.loadConfig();return i.lastSent=Date.now(),await this.saveConfig(i),!0}catch{if(this.retryCount<this.maxRetries){this.retryCount++;let i=this.retryDelayMs*2**(this.retryCount-1);return await this.sleep(i),this.send()}return this.events=[],this.retryCount=0,!1}}async flush(){if(this.events.length===0)return!0;return this.send()}sleep(e){return new Promise((i)=>setTimeout(i,e))}async status(){let e=await this.loadConfig();return{enabled:e.enabled,doNotTrack:oe.env.DO_NOT_TRACK==="1"||oe.env.DO_NOT_TRACK==="true",eventsQueued:this.events.length,lastSent:e.lastSent}}async loadConfig(){if(this.config)return this.config;try{if(Ge(this.configPath)){let e=await be.readFile(this.configPath,"utf-8");return this.config=JSON.parse(e),this.config}}catch{}return this.config={enabled:!1},this.config}async saveConfig(e){this.config=e;try{let i=we.dirname(this.configPath);await be.mkdir(i,{recursive:!0}),await be.writeFile(this.configPath,JSON.stringify(e,null,2),"utf-8")}catch{}}generateUserId(){let e=Math.random().toString(36).substring(2,15),i=Date.now().toString(36);return`${e}-${i}`}}var es=new Ne;function xe(e){return e.replace(/[<[].+/,"").trim()}function He(e){let i=/<([^>]+)>/g,r=/\[([^\]]+)\]/g,o=[],a=(b)=>{let u=!1,p=b[1];if(p.startsWith("..."))p=p.slice(3),u=!0;return{required:b[0].startsWith("<"),value:p,variadic:u}},l;while(l=i.exec(e))o.push(a(l));let g;while(g=r.exec(e))o.push(a(g));return o}function Ke(e){let i={alias:{},boolean:[]};for(let[r,o]of e.entries()){if(o.names.length>1)i.alias[o.names[0]]=o.names.slice(1);if(o.isBoolean)if(o.negated){if(!e.some((l,g)=>g!==r&&l.names.some((b)=>o.names.includes(b))&&typeof l.required==="boolean"))i.boolean.push(o.names[0])}else i.boolean.push(o.names[0])}return i}function _e(e){return e.reduce((i,r)=>i.length>=r.length?i:r,"")}function ve(e,i){return e.length>=i?e:`${e}${" ".repeat(i-e.length)}`}function ge(e){return e.replace(/([a-z])-([a-z])/g,(i,r,o)=>r+o.toUpperCase())}function Je(e,i,r){let o=0,a=i.length,l=e,g;for(;o<a;++o)g=l[i[o]],l=l[i[o]]=o===a-1?r:g!=null?g:!!~i[o+1].indexOf(".")||!(+i[o+1]>-1)?{}:[]}function Ye(e,i){for(let r of Object.keys(i)){let o=i[r];if(o.shouldTransform){if(e[r]=Array.prototype.concat.call([],e[r]),typeof o.transformFunction==="function")e[r]=e[r].map(o.transformFunction)}}}function Ze(e){let i=/([^\\/]+)$/.exec(e);return i?i[1]:""}function fe(e){return e.split(".").map((i,r)=>r===0?ge(i):i).join(".")}class me extends Error{exitCode=2;isUsageError=!0;usage;constructor(e,i){super(e);if(this.name=this.constructor.name,i!==void 0)this.usage=i;if(typeof Error.captureStackTrace==="function")Error.captureStackTrace(this,this.constructor);else this.stack=Error(e).stack}format(e=!1){if(e&&this.stack)return`${this.message}
 
 Stack trace:
 ${this.stack}`;return this.message}}function Xe(e){if(e instanceof me)return!0;return!!e&&typeof e==="object"&&e.name==="ClappError"&&typeof e.message==="string"}function Qe(){let{env:e}=Ae,{TERM:i,TERM_PROGRAM:r}=e;if(Ae.platform!=="win32")return i!=="linux";return Boolean(e.WT_SESSION)||Boolean(e.TERMINUS_SUBLIME)||e.ConEmuTask==="{cmd::Cmder}"||r==="Terminus-Sublime"||r==="vscode"||i==="xterm-256color"||i==="alacritty"||i==="rxvt-unicode"||i==="rxvt-unicode-256color"||e.TERMINAL_EMULATOR==="JetBrains-JediTerm"}var $e="\x1B",Z=`${$e}[`;var je={to(e,i){if(!i)return`${Z}${e+1}G`;return`${Z}${i+1};${e+1}H`},move(e,i){let r="";if(e<0)r+=`${Z}${-e}D`;else if(e>0)r+=`${Z}${e}C`;if(i<0)r+=`${Z}${-i}A`;else if(i>0)r+=`${Z}${i}B`;return r},up:(e=1)=>`${Z}${e}A`,down:(e=1)=>`${Z}${e}B`,forward:(e=1)=>`${Z}${e}C`,backward:(e=1)=>`${Z}${e}D`,nextLine:(e=1)=>`${Z}E`.repeat(e),prevLine:(e=1)=>`${Z}F`.repeat(e),left:`${Z}G`,hide:`${Z}?25l`,show:`${Z}?25h`,save:`${$e}7`,restore:`${$e}8`};var is={screen:`${Z}2J`,up:(e=1)=>`${Z}1J`.repeat(e),down:(e=1)=>`${Z}J`.repeat(e),line:`${Z}2K`,lineEnd:`${Z}K`,lineStart:`${Z}1K`,lines(e){let i="";for(let r=0;r<e;r++)i+=this.line+(r<e-1?je.up():"");if(e)i+=je.left;return i}},rs={screen:`${$e}c`};function st(e,i){let r=[];for(let o=0;o<=i.length;o++)r[o]=[o];for(let o=0;o<=e.length;o++)r[0][o]=o;for(let o=1;o<=i.length;o++)for(let a=1;a<=e.length;a++)if(i.charAt(o-1)===e.charAt(a-1))r[o][a]=r[o-1][a-1];else r[o][a]=Math.min(r[o-1][a-1]+1,r[o][a-1]+1,r[o-1][a]+1);return r[i.length][e.length]}function Be(e,i,r=2,o=3){return i.map((a)=>({cmd:a,distance:st(e,a)})).filter(({distance:a})=>a<=r).sort((a,l)=>a.distance-l.distance).slice(0,o).map(({cmd:a})=>a)}function nt(e,i={}){let r={_:[]},o=i.alias||{},a=new Set(i.boolean||[]),l={};for(let u of Object.keys(o))for(let p of o[u])l[p]=u;for(let u of a)if(o[u])for(let p of o[u])a.add(p);function g(u,p){if(u===void 0)return p;if(typeof p==="boolean")return p;return Array.isArray(u)?[...u,p]:[u,p]}function b(u,p){let k=l[u]||u,I=g(r[k],p);if(r[k]=I,o[k])for(let y of o[k])r[y]=I;if(l[u]&&o[l[u]])for(let y of o[l[u]])r[y]=I;r[u]=I}for(let u=0;u<e.length;u++){let p=e[u];if(p==="--"){r._.push(...e.slice(u+1));break}if(p.startsWith("--")){let k=p.indexOf("=");if(k!==-1){let I=ge(p.slice(2,k)),y=p.slice(k+1);b(I,y)}else{let I=p.slice(2);if(I.startsWith("no-")){let w=ge(I.slice(3));b(w,!1);continue}let y=ge(I),A=l[y]||y;if(a.has(A)||a.has(y))b(y,!0);else{let w=e[u+1];if(w!==void 0&&!w.startsWith("-"))b(y,w),u++;else b(y,!0)}}}else if(p.startsWith("-")&&p.length>1){let k=p.slice(1);for(let I=0;I<k.length;I++){let y=k[I],A=l[y]||y;if(I===k.length-1&&!a.has(A)&&!a.has(y)){let w=e[u+1];if(w!==void 0&&!w.startsWith("-"))b(y,w),u++;else b(y,!0)}else b(y,!0)}}else r._.push(p)}return r}class Me{rawName;description;name;names;isBoolean;required;config;negated;constructor(e,i,r){if(this.rawName=e,this.description=i,this.config=Object.assign({},r),e=e.replace(/\.\*/g,""),this.negated=!1,this.names=xe(e).split(",").map((o)=>{let a=o.trim().replace(/^-{1,2}/,"");if(a.startsWith("no-"))this.negated=!0,a=a.replace(/^no-/,"");return fe(a)}).sort((o,a)=>o.length>a.length?1:-1),this.name=this.names[this.names.length-1],this.negated&&this.config.default==null)this.config.default=!0;if(e.includes("<"))this.required=!0;else if(e.includes("["))this.required=!1;else this.isBoolean=!0}}var as=Se.argv,it=`${Se.platform}-${Se.arch} bun-v${typeof Bun<"u"?Bun.version:"unknown"}`,Pe=ye.argv,rt=`${ye.platform}-${ye.arch} node-${ye.version}`;class ke{rawName;description;config;cli;options;aliasNames;name;namespace;args;commandAction;usageText;versionNumber;examples;helpCallback;globalCommand;beforeHooks;afterHooks;middleware;constructor(e,i,r,o){this.rawName=e,this.description=i,this.config=r,this.cli=o,this.options=[],this.aliasNames=[],this.name=xe(e);let a=xe(e),l=a.indexOf(":");if(l>0)this.namespace=a.substring(0,l),this.name=a.substring(l+1);if(this.args=He(e),this.examples=[],this.beforeHooks=[],this.afterHooks=[],this.middleware=[],!r)this.config={}}usage(e){return this.usageText=e,this}allowUnknownOptions(){return this.config.allowUnknownOptions=!0,this}ignoreOptionDefaultValue(){return this.config.ignoreOptionDefaultValue=!0,this}version(e,i="-v, --version"){return this.versionNumber=e,this.option(i,"Display version number"),this}example(e){return this.examples.push(e),this}option(e,i,r){let o=new Me(e,i,r);return this.options.push(o),this}alias(e){return this.aliasNames.push(e),this}action(e){return this.commandAction=e,this}before(e){return this.beforeHooks.push(e),this}after(e){return this.afterHooks.push(e),this}use(e){return this.middleware.push(e),this}isMatched(e){if(this.aliasNames.includes(e))return!0;if(this.namespace)return`${this.namespace}:${this.name}`===e;return this.name===e}get isDefaultCommand(){return this.name===""||this.aliasNames.includes("!")}get isGlobalCommand(){return this instanceof Ce}get displayName(){return this.namespace?`${this.namespace}:${this.name}`:this.name}hasOption(e){let i=fe(e.split(".")[0]);return!!this.options.find((r)=>r.names.some((o)=>fe(o)===i))}outputHelp(){let{name:e,commands:i}=this.cli,{versionNumber:r,options:o,helpCallback:a}=this.cli.globalCommand,l=[{body:`${e}${r?`/${r}`:""}`}];if(l.push({title:"Usage",body:`  $ ${e} ${this.usageText||this.rawName}`}),(this.isGlobalCommand||this.isDefaultCommand)&&i.length>0){let p=_e(i.map((w)=>w.rawName)),k=new Map,I=[];for(let w of i)if(w.namespace){if(!k.has(w.namespace))k.set(w.namespace,[]);k.get(w.namespace).push(w)}else I.push(w);let y="";if(I.sort((w,W)=>w.rawName<W.rawName?-1:w.rawName>W.rawName?1:0),I.length>0)y+=I.map((w)=>`  ${ve(w.rawName,p.length)}  ${w.description}`).join(`
@@ -28,7 +28,7 @@ Received ${r}, cleaning up...`),e)try{await e()}catch(o){console.error("Error du
 `)),this.enableDidYouMean){let i=[];for(let o of this.commands){if(o.displayName)i.push(o.displayName);if(o.aliasNames)i.push(...o.aliasNames)}let r=Be(e,i);if(r.length>0)console.log(le.yellow("Did you mean one of these?")),r.forEach((o)=>console.log(`  ${le.dim("•")} ${this.name} ${o}`)),console.log("")}console.log(le.dim("Run"),`${this.name} --help`,le.dim("to see all available commands")),se.exit(1)}async parse(e=Pe,i={}){let{run:r=!0,exitOnError:o=!1}=i;if(o)try{return await this.parse(e,{run:r})}catch(u){throw this.handleUsageError(u),u}if(this.rawArgs=e,!this.name)this.name=e[1]?Ze(e[1]):"cli";let a=!0,l=e.slice(2),g=l[0];if(g&&!g.startsWith("-")){for(let u of this.commands)if(u.isMatched(g)){let p=this.mri(l,u);a=!1;let k={...p,args:p.args.slice(1)};this.setParsedInfo(k,u,g),this.emit(`command:${g}`,u);break}if(a){let u=l[1];if(u&&!u.startsWith("-")){let p=`${g}:${u}`;for(let k of this.commands)if(k.isMatched(p)){let I=this.mri(l,k);a=!1;let y={...I,args:I.args.slice(2)};this.setParsedInfo(y,k,p),this.emit(`command:${p}`,k);break}}}}if(a){for(let u of this.commands)if(u.name===""){a=!1;let p=this.mri(l,u);this.setParsedInfo(p,u),this.emit("command:!",u);break}}if(a){let u=this.mri(e.slice(2));this.setParsedInfo(u)}if(this.options.verbose)this.isVerbose=!0;if(this.options.quiet)this.isQuiet=!0;if(this.options.debug)this.isDebug=!0;if(this.options.noInteraction||this.options.interaction===!1)this.isNoInteraction=!0;if(this.options.env)this.environment=String(this.options.env);if(this.options.dryRun)this.isDryRun=!0;if(this.options.force)this.isForce=!0;if(this.options.noEmoji||this.options.emoji===!1)this.useEmoji=!1;if(this.options.theme)this.theme=String(this.options.theme);if(this.options.noCache||this.options.cache===!1)this.isNoCache=!0;if(this.options.help&&this.showHelpOnExit)this.outputHelp(),r=!1,this.unsetMatchedCommand();if(this.options.version&&this.showVersionOnExit&&this.matchedCommandName==null)this.outputVersion(),r=!1,this.unsetMatchedCommand();let b={args:this.args,options:this.options};if(r)await this.runMatchedCommand();if(!this.matchedCommand&&this.args[0]){if(this.emit("command:*"),!(this.listenerCount("command:*")>0))this.showCommandNotFound(this.args[0])}return b}mri(e,i){let r=[...this.globalCommand.options,...i?i.options:[]],o=Ke(r),a=[],l=e.indexOf("--");if(l>-1)a=e.slice(l+1),e=e.slice(0,l);let g=nt(e,o),b={_:g._};for(let y of Object.keys(g))if(y!=="_")b[fe(y)]=g[y];let u=b._,p={"--":a},k=i&&i.config.ignoreOptionDefaultValue?i.config.ignoreOptionDefaultValue:this.globalCommand.config.ignoreOptionDefaultValue,I=Object.create(null);for(let y of r){if(!k&&y.config.default!==void 0)for(let A of y.names)p[A]=y.config.default;if(Array.isArray(y.config.type)){if(I[y.name]===void 0)I[y.name]={shouldTransform:!0,transformFunction:y.config.type[0]}}}for(let y of Object.keys(b))if(y!=="_"){let A=y.split(".");Je(p,A,b[y]),Ye(p,I)}return{args:u,options:p}}async run(e=Pe){return this.parse(e,{run:!0,exitOnError:!0})}handleUsageError(e){if(!Xe(e)||e.isUsageError===!1)return;let i=e.message||"command-line error",r=this.name?`${this.name}: `:"",o=/--help/.test(i)?"":e.usage?`
 Usage: ${e.usage}`:`
 Run \`${this.name??"cli"} --help\` for usage.`;se.stderr.write(`${r}${i}${o}
-`),se.exit(e.exitCode??2)}async runMatchedCommand(){let{args:e,options:i,matchedCommand:r}=this;if(!r||!r.commandAction)return;r.checkUnknownOptions(),r.checkOptionValue(),r.checkRequiredArgs();let o=[];r.args.forEach((b,u)=>{if(b.variadic)o.push(e.slice(u));else o.push(e[u])}),o.push(i);let a={command:r,args:o,options:i};for(let b of r.beforeHooks)await b(a);let l,g=async()=>{let b=r.commandAction.apply(this,o);if(b instanceof Promise)l=await b;else l=b;return l};if(r.middleware.length>0){let b=0,u=async()=>{if(b<r.middleware.length){let p=r.middleware[b++];await p({...a,next:u})}else await g()};await u()}else await g();for(let b of r.afterHooks)await b(a);return l}removeSignalHandlers(){if(!this.signalHandlersSet)return this;return se.removeAllListeners("SIGINT"),se.removeAllListeners("SIGTERM"),this.signalHandlersSet=!1,this}destroy(){this.removeSignalHandlers(),this.commands=[],this.rawArgs=[],this.args=[],this.options={},this.matchedCommand=void 0,this.matchedCommandName=void 0,this.removeAllListeners()}}class Re{cache;enabled;cleanupInterval=null;hits=0;misses=0;constructor(){this.cache=new Map,this.enabled=!0,this.startCleanupInterval()}startCleanupInterval(){if(this.cleanupInterval)return;this.cleanupInterval=setInterval(()=>{this.cleanup()},30000),this.cleanupInterval.unref()}stopCleanup(){if(this.cleanupInterval)clearInterval(this.cleanupInterval),this.cleanupInterval=null}isEnabled(){return this.enabled}get(e){if(!this.enabled){this.misses++;return}let i=this.cache.get(e);if(!i){this.misses++;return}if(Date.now()-i.timestamp>i.ttl){this.cache.delete(e),this.misses++;return}return this.hits++,i.value}set(e,i,r=5000){if(!this.enabled)return;this.cache.set(e,{value:i,timestamp:Date.now(),ttl:r})}has(e){if(!this.enabled)return!1;let i=this.cache.get(e);if(!i)return!1;if(Date.now()-i.timestamp>i.ttl)return this.cache.delete(e),!1;return!0}delete(e){this.cache.delete(e)}clear(){this.cache.clear()}disable(){this.enabled=!1,this.clear()}enable(){this.enabled=!0}stats(){return{size:this.cache.size,enabled:this.enabled,hits:this.hits,misses:this.misses}}resetStats(){this.hits=0,this.misses=0}keys(){return Array.from(this.cache.keys())}cleanup(){let e=Date.now();for(let[i,r]of this.cache.entries())if(e-r.timestamp>r.ttl)this.cache.delete(i)}destroy(){this.stopCleanup(),this.clear(),this.resetStats()}}var ls=new Re;function ut(){if("FORCE_COLOR"in pe.env)return pe.env.FORCE_COLOR!=="0";if("NO_COLOR"in pe.env||pe.env.TERM==="dumb")return!1;if(pe.platform==="win32")return!0;return De.isatty(1)&&De.isatty(2)}var Le=ut();function J(e,i){if(!Le)return(r)=>r;return(r)=>e+r+i}var dt=J("\x1B[0m","\x1B[0m"),ht=J("\x1B[31m","\x1B[39m"),pt=J("\x1B[32m","\x1B[39m"),ft=J("\x1B[33m","\x1B[39m"),mt=J("\x1B[34m","\x1B[39m"),gt=J("\x1B[35m","\x1B[39m"),yt=J("\x1B[36m","\x1B[39m"),$t=J("\x1B[37m","\x1B[39m"),bt=J("\x1B[90m","\x1B[39m"),wt=J("\x1B[1m","\x1B[22m"),vt=J("\x1B[3m","\x1B[23m"),xt=J("\x1B[4m","\x1B[24m"),St=J("\x1B[2m","\x1B[22m"),kt=J("\x1B[7m","\x1B[27m"),Ct=J("\x1B[8m","\x1B[28m"),It=J("\x1B[9m","\x1B[29m"),Ot=J("\x1B[41m","\x1B[49m"),Et=J("\x1B[42m","\x1B[49m"),Tt=J("\x1B[43m","\x1B[49m"),At=J("\x1B[44m","\x1B[49m"),_t=J("\x1B[45m","\x1B[49m"),jt=J("\x1B[46m","\x1B[49m"),Pt=J("\x1B[47m","\x1B[49m"),Dt=Le,Nt={reset:dt,red:ht,green:pt,yellow:ft,blue:mt,magenta:gt,cyan:yt,white:$t,gray:bt,bold:wt,italic:vt,underline:xt,dim:St,inverse:kt,hidden:Ct,strikethrough:It,bgRed:Ot,bgGreen:Et,bgYellow:Tt,bgBlue:At,bgMagenta:_t,bgCyan:jt,bgWhite:Pt,isColorSupported:Dt},Bt=Nt,Rt=["up","down","left","right","space","enter","cancel"],ms={actions:new Set(Rt),aliases:new Map([["k","up"],["j","down"],["h","left"],["l","right"],["\x03","cancel"],["escape","cancel"]]),messages:{cancel:"Canceled",error:"Something went wrong"}};var gs=Mt.platform.startsWith("win"),ys=Symbol("clapp:cancel");var Lt=Qe();var K=(e,i)=>Lt?e:i,$s=K("◆","*"),bs=K("■","x"),ws=K("▲","x"),vs=K("◇","o"),xs=K("┌","T"),Vt=K("│","|"),Ss=K("└","—"),ks=K("●",">"),Cs=K("○"," "),Is=K("◻","[•]"),Os=K("◼","[+]"),Es=K("◻","[ ]"),Ts=K("▪","•"),As=K("─","-"),_s=K("╮","+"),js=K("├","+"),Ps=K("╯","+"),Ds=K("●","•"),Ns=K("◆","*"),Bs=K("▲","!"),Ms=K("■","x");var Rs={light:K("─","-"),heavy:K("━","="),block:K("█","#")};function Ft(){return`${Bt.gray(Vt)}  `}var Ls=Ft();var Ve="0.11.132";x();async function Wt(e="src/pantry"){if(!C.existsSync(e))throw Error(`Pantry directory not found: ${e}. Please run 'bun ./bin/cli.ts update-pantry' first.`);let i=[];function r(o,a=""){let l=C.readdirSync(o,{withFileTypes:!0}),g=O.join(o,"package.yml");if(a&&C.existsSync(g))i.push(a);for(let b of l)if(b.isDirectory()&&!b.name.startsWith(".")){let u=a?`${a}/${b.name}`:b.name,p=O.join(o,b.name);r(p,u)}}return r(e),console.log(`\uD83D\uDCE6 Found ${i.length} packages in local pantry`),i.sort()}async function Ut(e=!1){async function i(g){let b=new URL("https://s3.amazonaws.com/dist.tea.xyz/");if(b.searchParams.set("list-type","2"),b.searchParams.set("prefix",""),b.searchParams.set("max-keys","1000"),g)b.searchParams.set("continuation-token",g);let u=await fetch(b.toString());if(!u.ok)throw Error(`Failed to fetch S3 listing: ${u.status}`);let p=await u.text(),k=[],I=p.match(/<Key>([^<]+)<\/Key>/g);if(I)for(let W of I){let q=W.replace(/<Key>([^<]+)<\/Key>/,"$1");k.push({Key:q})}let y=p.includes("<IsTruncated>true</IsTruncated>"),A=p.match(/<NextContinuationToken>([^<]+)<\/NextContinuationToken>/),w=A?A[1]:void 0;return{IsTruncated:y,NextContinuationToken:w,Contents:k}}console.log("Scraping packages from S3 registry...");let r=new Set,o;do{let g=await i(o);for(let b of g.Contents){let u=b.Key,p=u.split("/");if(p.length===0)continue;if(p[0].startsWith(".")||p[0].includes(" ")||u.match(/\.(md|txt|yml|yaml|json)$/i))continue;let k=["darwin","linux","windows"],I=-1;for(let y=1;y<p.length;y++)if(k.includes(p[y])){I=y;break}if(I>0){let y=p.slice(0,I).join("/");if(y.includes("."))r.add(y)}else if(p.length>=2&&p[0].includes(".")&&!p[1].startsWith("v")&&!p[1].match(/^\d/)){let y=`${p[0]}/${p[1]}`;r.add(y)}else if(p.length>=1&&p[0].includes("."))r.add(p[0])}o=g.NextContinuationToken,console.log(`Found ${r.size} packages so far...`)}while(o);let a=Array.from(r).sort(),l=[];for(let g of a){if(!g.includes(".")||g.match(/^[a-z0-9.-]+\.[a-z]{2,}(\/[\w.-]+){0,20}$/i)===null)continue;if(g.endsWith("/README.rst")||g.endsWith("/README")||g.includes("/docs/"))continue;if(g.endsWith("/.pkgroot"))continue;if(["amazon.com/aws","charm.sh","code.videolan.org","crates.io"].includes(g))continue;l.push(g)}return console.log(`\uD83D\uDCE6 Found ${l.length} valid packages in registry`),l}async function Gt(e,i){let o=`/**
+`),se.exit(e.exitCode??2)}async runMatchedCommand(){let{args:e,options:i,matchedCommand:r}=this;if(!r||!r.commandAction)return;r.checkUnknownOptions(),r.checkOptionValue(),r.checkRequiredArgs();let o=[];r.args.forEach((b,u)=>{if(b.variadic)o.push(e.slice(u));else o.push(e[u])}),o.push(i);let a={command:r,args:o,options:i};for(let b of r.beforeHooks)await b(a);let l,g=async()=>{let b=r.commandAction.apply(this,o);if(b instanceof Promise)l=await b;else l=b;return l};if(r.middleware.length>0){let b=0,u=async()=>{if(b<r.middleware.length){let p=r.middleware[b++];await p({...a,next:u})}else await g()};await u()}else await g();for(let b of r.afterHooks)await b(a);return l}removeSignalHandlers(){if(!this.signalHandlersSet)return this;return se.removeAllListeners("SIGINT"),se.removeAllListeners("SIGTERM"),this.signalHandlersSet=!1,this}destroy(){this.removeSignalHandlers(),this.commands=[],this.rawArgs=[],this.args=[],this.options={},this.matchedCommand=void 0,this.matchedCommandName=void 0,this.removeAllListeners()}}class Re{cache;enabled;cleanupInterval=null;hits=0;misses=0;constructor(){this.cache=new Map,this.enabled=!0,this.startCleanupInterval()}startCleanupInterval(){if(this.cleanupInterval)return;this.cleanupInterval=setInterval(()=>{this.cleanup()},30000),this.cleanupInterval.unref()}stopCleanup(){if(this.cleanupInterval)clearInterval(this.cleanupInterval),this.cleanupInterval=null}isEnabled(){return this.enabled}get(e){if(!this.enabled){this.misses++;return}let i=this.cache.get(e);if(!i){this.misses++;return}if(Date.now()-i.timestamp>i.ttl){this.cache.delete(e),this.misses++;return}return this.hits++,i.value}set(e,i,r=5000){if(!this.enabled)return;this.cache.set(e,{value:i,timestamp:Date.now(),ttl:r})}has(e){if(!this.enabled)return!1;let i=this.cache.get(e);if(!i)return!1;if(Date.now()-i.timestamp>i.ttl)return this.cache.delete(e),!1;return!0}delete(e){this.cache.delete(e)}clear(){this.cache.clear()}disable(){this.enabled=!1,this.clear()}enable(){this.enabled=!0}stats(){return{size:this.cache.size,enabled:this.enabled,hits:this.hits,misses:this.misses}}resetStats(){this.hits=0,this.misses=0}keys(){return Array.from(this.cache.keys())}cleanup(){let e=Date.now();for(let[i,r]of this.cache.entries())if(e-r.timestamp>r.ttl)this.cache.delete(i)}destroy(){this.stopCleanup(),this.clear(),this.resetStats()}}var ls=new Re;function ut(){if("FORCE_COLOR"in pe.env)return pe.env.FORCE_COLOR!=="0";if("NO_COLOR"in pe.env||pe.env.TERM==="dumb")return!1;if(pe.platform==="win32")return!0;return De.isatty(1)&&De.isatty(2)}var Le=ut();function J(e,i){if(!Le)return(r)=>r;return(r)=>e+r+i}var dt=J("\x1B[0m","\x1B[0m"),ht=J("\x1B[31m","\x1B[39m"),pt=J("\x1B[32m","\x1B[39m"),ft=J("\x1B[33m","\x1B[39m"),mt=J("\x1B[34m","\x1B[39m"),gt=J("\x1B[35m","\x1B[39m"),yt=J("\x1B[36m","\x1B[39m"),$t=J("\x1B[37m","\x1B[39m"),bt=J("\x1B[90m","\x1B[39m"),wt=J("\x1B[1m","\x1B[22m"),vt=J("\x1B[3m","\x1B[23m"),xt=J("\x1B[4m","\x1B[24m"),St=J("\x1B[2m","\x1B[22m"),kt=J("\x1B[7m","\x1B[27m"),Ct=J("\x1B[8m","\x1B[28m"),It=J("\x1B[9m","\x1B[29m"),Ot=J("\x1B[41m","\x1B[49m"),Et=J("\x1B[42m","\x1B[49m"),Tt=J("\x1B[43m","\x1B[49m"),At=J("\x1B[44m","\x1B[49m"),_t=J("\x1B[45m","\x1B[49m"),jt=J("\x1B[46m","\x1B[49m"),Pt=J("\x1B[47m","\x1B[49m"),Dt=Le,Nt={reset:dt,red:ht,green:pt,yellow:ft,blue:mt,magenta:gt,cyan:yt,white:$t,gray:bt,bold:wt,italic:vt,underline:xt,dim:St,inverse:kt,hidden:Ct,strikethrough:It,bgRed:Ot,bgGreen:Et,bgYellow:Tt,bgBlue:At,bgMagenta:_t,bgCyan:jt,bgWhite:Pt,isColorSupported:Dt},Bt=Nt,Rt=["up","down","left","right","space","enter","cancel"],ms={actions:new Set(Rt),aliases:new Map([["k","up"],["j","down"],["h","left"],["l","right"],["\x03","cancel"],["escape","cancel"]]),messages:{cancel:"Canceled",error:"Something went wrong"}};var gs=Mt.platform.startsWith("win"),ys=Symbol("clapp:cancel");var Lt=Qe();var K=(e,i)=>Lt?e:i,$s=K("◆","*"),bs=K("■","x"),ws=K("▲","x"),vs=K("◇","o"),xs=K("┌","T"),Vt=K("│","|"),Ss=K("└","—"),ks=K("●",">"),Cs=K("○"," "),Is=K("◻","[•]"),Os=K("◼","[+]"),Es=K("◻","[ ]"),Ts=K("▪","•"),As=K("─","-"),_s=K("╮","+"),js=K("├","+"),Ps=K("╯","+"),Ds=K("●","•"),Ns=K("◆","*"),Bs=K("▲","!"),Ms=K("■","x");var Rs={light:K("─","-"),heavy:K("━","="),block:K("█","#")};function Ft(){return`${Bt.gray(Vt)}  `}var Ls=Ft();var Ve="0.11.135";x();async function Wt(e="src/pantry"){if(!C.existsSync(e))throw Error(`Pantry directory not found: ${e}. Please run 'bun ./bin/cli.ts update-pantry' first.`);let i=[];function r(o,a=""){let l=C.readdirSync(o,{withFileTypes:!0}),g=O.join(o,"package.yml");if(a&&C.existsSync(g))i.push(a);for(let b of l)if(b.isDirectory()&&!b.name.startsWith(".")){let u=a?`${a}/${b.name}`:b.name,p=O.join(o,b.name);r(p,u)}}return r(e),console.log(`\uD83D\uDCE6 Found ${i.length} packages in local pantry`),i.sort()}async function Ut(e=!1){async function i(g){let b=new URL("https://s3.amazonaws.com/dist.tea.xyz/");if(b.searchParams.set("list-type","2"),b.searchParams.set("prefix",""),b.searchParams.set("max-keys","1000"),g)b.searchParams.set("continuation-token",g);let u=await fetch(b.toString());if(!u.ok)throw Error(`Failed to fetch S3 listing: ${u.status}`);let p=await u.text(),k=[],I=p.match(/<Key>([^<]+)<\/Key>/g);if(I)for(let W of I){let q=W.replace(/<Key>([^<]+)<\/Key>/,"$1");k.push({Key:q})}let y=p.includes("<IsTruncated>true</IsTruncated>"),A=p.match(/<NextContinuationToken>([^<]+)<\/NextContinuationToken>/),w=A?A[1]:void 0;return{IsTruncated:y,NextContinuationToken:w,Contents:k}}console.log("Scraping packages from S3 registry...");let r=new Set,o;do{let g=await i(o);for(let b of g.Contents){let u=b.Key,p=u.split("/");if(p.length===0)continue;if(p[0].startsWith(".")||p[0].includes(" ")||u.match(/\.(md|txt|yml|yaml|json)$/i))continue;let k=["darwin","linux","windows"],I=-1;for(let y=1;y<p.length;y++)if(k.includes(p[y])){I=y;break}if(I>0){let y=p.slice(0,I).join("/");if(y.includes("."))r.add(y)}else if(p.length>=2&&p[0].includes(".")&&!p[1].startsWith("v")&&!p[1].match(/^\d/)){let y=`${p[0]}/${p[1]}`;r.add(y)}else if(p.length>=1&&p[0].includes("."))r.add(p[0])}o=g.NextContinuationToken,console.log(`Found ${r.size} packages so far...`)}while(o);let a=Array.from(r).sort(),l=[];for(let g of a){if(!g.includes(".")||g.match(/^[a-z0-9.-]+\.[a-z]{2,}(\/[\w.-]+){0,20}$/i)===null)continue;if(g.endsWith("/README.rst")||g.endsWith("/README")||g.includes("/docs/"))continue;if(g.endsWith("/.pkgroot"))continue;if(["amazon.com/aws","charm.sh","code.videolan.org","crates.io"].includes(g))continue;l.push(g)}return console.log(`\uD83D\uDCE6 Found ${l.length} valid packages in registry`),l}async function Gt(e,i){let o=`/**
  * Constants used throughout the ts-pantry package
  * This file is auto-generated from ${i}. Do not edit manually.
  * Generated on ${new Date().toISOString()}
@@ -91,17 +91,17 @@ ${a.join(`
 Conflicts found:`),y.conflicts.forEach((w)=>{console.log(`  ${w.package}: ${w.versions.join(", ")}`)});if(console.log(`
 \uD83D\uDCCB All unique packages to install:`),y.uniquePackages.forEach((w,W)=>{let q=y.allDependencies.find((H)=>H.name===w),N=q&&q.version&&q.version!=="latest"?` (${q.version})`:"";console.log(`  ${W+1}. ${w}${N}`)}),p)console.log(`
 \uD83D\uDE80 Install command:`),console.log(`pantry install ${y.uniquePackages.join(" ")}`);if(Object.values(y.osSpecificDeps).reduce((w,W)=>w+W.length,0)>0)console.log(`
-\uD83D\uDDA5️  OS-specific dependencies:`),Object.entries(y.osSpecificDeps).forEach(([w,W])=>{if(W.length>0)console.log(`  ${w}: ${W.map((q)=>q.name).join(", ")}`)})}v.exit(0)}catch(r){if(i.json){let o={success:!1,error:String(r),timestamp:new Date().toISOString()};console.log(JSON.stringify(o))}else console.error("Error resolving dependencies:",r);v.exit(1)}});F.command("get-php-versions","Get PHP versions suitable for CI/CD workflows").option("--format <type>","Output format: json (default), yaml, or csv",{default:"json"}).option("--branches <branches>","Comma-separated list of PHP branches to include (e.g., 8.4,8.3,8.2)").option("--fallback <versions>","Comma-separated list of fallback versions if detection fails").action(async(e)=>{try{let{getPhpVersionsForWorkflow:i}=await import("../chunk-cphwkmpn.js"),r={};if(e.branches)r.supportedBranches=e.branches.split(",").map((a)=>a.trim());if(e.fallback)r.fallbackVersions=e.fallback.split(",").map((a)=>a.trim());let o=i(r);switch(e.format.toLowerCase()){case"yaml":console.log(`php_versions:
+\uD83D\uDDA5️  OS-specific dependencies:`),Object.entries(y.osSpecificDeps).forEach(([w,W])=>{if(W.length>0)console.log(`  ${w}: ${W.map((q)=>q.name).join(", ")}`)})}v.exit(0)}catch(r){if(i.json){let o={success:!1,error:String(r),timestamp:new Date().toISOString()};console.log(JSON.stringify(o))}else console.error("Error resolving dependencies:",r);v.exit(1)}});F.command("get-php-versions","Get PHP versions suitable for CI/CD workflows").option("--format <type>","Output format: json (default), yaml, or csv",{default:"json"}).option("--branches <branches>","Comma-separated list of PHP branches to include (e.g., 8.4,8.3,8.2)").option("--fallback <versions>","Comma-separated list of fallback versions if detection fails").action(async(e)=>{try{let{getPhpVersionsForWorkflow:i}=await import("../chunk-dc6k11xh.js"),r={};if(e.branches)r.supportedBranches=e.branches.split(",").map((a)=>a.trim());if(e.fallback)r.fallbackVersions=e.fallback.split(",").map((a)=>a.trim());let o=i(r);switch(e.format.toLowerCase()){case"yaml":console.log(`php_versions:
 ${o.map((a)=>`  - "${a}"`).join(`
-`)}`);break;case"csv":console.log(o.join(","));break;case"json":default:console.log(JSON.stringify(o));break}v.exit(0)}catch(i){console.error("Error getting PHP versions:",i),v.exit(1)}});F.command("generate-zig","Generate Zig package definitions from TypeScript packages").option("--packages-dir <dir>","Directory containing TypeScript package files",{default:"src/packages"}).option("--output <file>","Output Zig file path",{default:"packages.zig"}).option("--aliases","Also generate aliases file").option("--aliases-output <file>","Output file for Zig aliases",{default:"aliases.zig"}).action(async(e)=>{try{let{generateZigDefinitions:i,generateZigAliases:r}=await import("../chunk-spd7k5a5.js"),{packagesDir:o="src/packages",output:a="packages.zig",aliases:l=!1,aliasesOutput:g="aliases.zig"}=e;if(console.log("\uD83D\uDE80 Generating Zig package definitions..."),await i(o,a),l)console.log(`
+`)}`);break;case"csv":console.log(o.join(","));break;case"json":default:console.log(JSON.stringify(o));break}v.exit(0)}catch(i){console.error("Error getting PHP versions:",i),v.exit(1)}});F.command("generate-zig","Generate Zig package definitions from TypeScript packages").option("--packages-dir <dir>","Directory containing TypeScript package files",{default:"src/packages"}).option("--output <file>","Output Zig file path",{default:"packages.zig"}).option("--aliases","Also generate aliases file").option("--aliases-output <file>","Output file for Zig aliases",{default:"aliases.zig"}).action(async(e)=>{try{let{generateZigDefinitions:i,generateZigAliases:r}=await import("../chunk-d8hyhrra.js"),{packagesDir:o="src/packages",output:a="packages.zig",aliases:l=!1,aliasesOutput:g="aliases.zig"}=e;if(console.log("\uD83D\uDE80 Generating Zig package definitions..."),await i(o,a),l)console.log(`
 \uD83D\uDE80 Generating Zig package aliases...`),await r(o,g);console.log(`
-✅ Zig code generation complete!`),v.exit(0)}catch(i){console.error("Error generating Zig definitions:",i),v.exit(1)}});F.command("release [type]","Release a Zig package (changelog, bump, commit, tag, push, publish)").option("-y, --yes","Non-interactive mode (skip confirmation prompts)").option("--dry-run","Preview the release without changing anything").option("--no-changelog","Skip changelog generation").option("--no-push","Skip pushing the commit and tag").option("--no-publish","Skip publishing to the pantry registry").action(async(e,i)=>{let r=(e??"patch").toLowerCase();if(!["patch","minor","major"].includes(r))console.error(`error: invalid release type "${r}" (expected: patch | minor | major)`),v.exit(1);let{runRelease:o}=await import("../chunk-cwa30yjr.js"),a=await o({type:r,yes:i.yes,dryRun:i.dryRun,noChangelog:i.changelog===!1,noPush:i.push===!1,noPublish:i.publish===!1});v.exit(a.exitCode)});F.command("apps","List installed desktop applications with version info").option("-j, --json","Output as JSON").action(async(e)=>{try{let{scanInstalledApps:i}=await import("../chunk-7p6g0wq4.js"),r=i();if(e.json)console.log(JSON.stringify({success:!0,apps:r,total:r.length}));else{console.log(`
+✅ Zig code generation complete!`),v.exit(0)}catch(i){console.error("Error generating Zig definitions:",i),v.exit(1)}});F.command("release [type]","Release a Zig package (changelog, bump, commit, tag, push, publish)").option("-y, --yes","Non-interactive mode (skip confirmation prompts)").option("--dry-run","Preview the release without changing anything").option("--no-changelog","Skip changelog generation").option("--no-push","Skip pushing the commit and tag").option("--no-publish","Skip publishing to the pantry registry").action(async(e,i)=>{let r=(e??"patch").toLowerCase();if(!["patch","minor","major"].includes(r))console.error(`error: invalid release type "${r}" (expected: patch | minor | major)`),v.exit(1);let{runRelease:o}=await import("../chunk-cwa30yjr.js"),a=await o({type:r,yes:i.yes,dryRun:i.dryRun,noChangelog:i.changelog===!1,noPush:i.push===!1,noPublish:i.publish===!1});v.exit(a.exitCode)});F.command("apps","List installed desktop applications with version info").option("-j, --json","Output as JSON").action(async(e)=>{try{let{scanInstalledApps:i}=await import("../chunk-ezky7wtc.js"),r=i();if(e.json)console.log(JSON.stringify({success:!0,apps:r,total:r.length}));else{console.log(`
 Installed Desktop Apps (${r.length}):
-`),console.log("Application".padEnd(40)+"Version"),console.log("-".repeat(60));for(let o of r)console.log(`${o.name.padEnd(40)}${o.version}`)}v.exit(0)}catch(i){console.error("Error listing apps:",i),v.exit(1)}});F.command("apps-outdated","Check for outdated desktop applications").option("-j, --json","Output as JSON").action(async(e)=>{try{let{checkAppUpdates:i}=await import("../chunk-7p6g0wq4.js");if(!e.json)console.log("Checking desktop apps for updates...");let r=await i(),o=r.filter((a)=>a.updateAvailable);if(e.json)console.log(JSON.stringify({success:!0,apps:r,outdated:o.length,total:r.length,timestamp:new Date().toISOString()}));else{if(o.length>0){console.log(`
+`),console.log("Application".padEnd(40)+"Version"),console.log("-".repeat(60));for(let o of r)console.log(`${o.name.padEnd(40)}${o.version}`)}v.exit(0)}catch(i){console.error("Error listing apps:",i),v.exit(1)}});F.command("apps-outdated","Check for outdated desktop applications").option("-j, --json","Output as JSON").action(async(e)=>{try{let{checkAppUpdates:i}=await import("../chunk-ezky7wtc.js");if(!e.json)console.log("Checking desktop apps for updates...");let r=await i(),o=r.filter((a)=>a.updateAvailable);if(e.json)console.log(JSON.stringify({success:!0,apps:r,outdated:o.length,total:r.length,timestamp:new Date().toISOString()}));else{if(o.length>0){console.log(`
 Outdated Apps (${o.length}):
 `),console.log("Application".padEnd(30)+"Current".padEnd(16)+"Latest".padEnd(16)+"Source"),console.log("-".repeat(75));for(let l of o)console.log(`${l.name.padEnd(30)}${l.currentVersion.padEnd(16)}${(l.latestVersion||"?").padEnd(16)}${l.source}`)}else console.log(`
 All desktop apps are up to date!`);let a=r.filter((l)=>!l.updateAvailable&&l.source!=="system"&&l.source!=="unknown");if(a.length>0)console.log(`
-${a.length} app(s) up to date, ${r.filter((l)=>l.source==="unknown").length} unchecked`)}v.exit(0)}catch(i){console.error("Error checking app updates:",i),v.exit(1)}});F.command("apps-update <name>","Update a desktop application from the pantry registry").action(async(e)=>{try{let{updateApp:i}=await import("../chunk-7p6g0wq4.js");console.log(`Updating ${e} from the pantry registry...`);let r=await i(e);if(r.success)console.log(`Successfully updated ${e} to ${r.version}`);else console.error(`Failed to update ${e}: ${r.error}`),v.exit(1);v.exit(0)}catch(i){console.error("Error updating app:",i),v.exit(1)}});F.command("install <pkg>","Install a system package (e.g. ziglang.org@0.17.0-dev)").option("--global","Link binaries into the user-level global bin so they appear on PATH").option("--install-dir <dir>","Where to download into (default: ./pantry)").option("--platform <target>","Install for a target platform (e.g. linux-x86_64)").option("--no-bin-links","Skip creating local .bin/ symlinks").option("--quiet","Suppress progress output").action(async(e,i)=>{let r=e.lastIndexOf("@"),o=r>0,a=o?e.slice(0,r):e,l=o?e.slice(r+1):"latest";try{let g=await z(a,l,{installDir:i.installDir,platform:qt(i.platform),createBinLinks:i.binLinks!==!1,quiet:i.quiet,globalBin:i.global?!0:void 0});if(!i.quiet){if(console.log(`
+${a.length} app(s) up to date, ${r.filter((l)=>l.source==="unknown").length} unchecked`)}v.exit(0)}catch(i){console.error("Error checking app updates:",i),v.exit(1)}});F.command("apps-update <name>","Update a desktop application from the pantry registry").action(async(e)=>{try{let{updateApp:i}=await import("../chunk-ezky7wtc.js");console.log(`Updating ${e} from the pantry registry...`);let r=await i(e);if(r.success)console.log(`Successfully updated ${e} to ${r.version}`);else console.error(`Failed to update ${e}: ${r.error}`),v.exit(1);v.exit(0)}catch(i){console.error("Error updating app:",i),v.exit(1)}});F.command("install <pkg>","Install a system package (e.g. ziglang.org@0.17.0-dev)").option("--global","Link binaries into the user-level global bin so they appear on PATH").option("--install-dir <dir>","Where to download into (default: ./pantry)").option("--platform <target>","Install for a target platform (e.g. linux-x86_64)").option("--no-bin-links","Skip creating local .bin/ symlinks").option("--quiet","Suppress progress output").action(async(e,i)=>{let r=e.lastIndexOf("@"),o=r>0,a=o?e.slice(0,r):e,l=o?e.slice(r+1):"latest";try{let g=await z(a,l,{installDir:i.installDir,platform:qt(i.platform),createBinLinks:i.binLinks!==!1,quiet:i.quiet,globalBin:i.global?!0:void 0});if(!i.quiet){if(console.log(`
 ✓ ${g.name}@${g.version}`),console.log(`  installed to: ${g.installPath}`),g.globalLinks&&g.globalLinks.length>0){if(console.log(`  linked into: ${O.dirname(g.globalLinks[0])}`),!v.env.PATH?.split(O.delimiter).includes(O.dirname(g.globalLinks[0])))console.log(`
   ⚠ ${O.dirname(g.globalLinks[0])} is not on your PATH yet.`),console.log("    Run `ts-pantry shell-init --install` once to fix that.")}}v.exit(0)}catch(g){console.error(`Error installing ${e}:`,g instanceof Error?g.message:g),v.exit(1)}});function Kt(e){let i=re(e);if(i.length===0)return[];try{return P(i[0]).map((r)=>r.version&&r.version!=="latest"?`${r.name}@${String(r.version).replace(/^[\^~>=<]+/,"")}`:r.name)}catch{return[]}}F.command("env","Print the environment pantry-installed packages need, for a program to consume").option("--json","Print JSON instead of shell assignments").option("--dir <path>","A project directory, whose dependency file is included (default: cwd)").option("--install","Install anything the dependency file names that is missing").action(async(e)=>{let i=O.resolve(e.dir??v.cwd()),r=Kt(i);if(e.install&&r.length>0)for(let l of r){let g=l.lastIndexOf("@"),b=g>0;await z(b?l.slice(0,g):l,b?l.slice(g+1):"latest",{globalBin:!0,quiet:!0}).catch((u)=>{console.error(`# could not install ${l}: ${u instanceof Error?u.message:u}`)})}let o=f(),a=[O.join(i,".bin"),o].filter((l)=>C.existsSync(l));if(e.json)console.log(JSON.stringify({path:a,PATH:[...a,v.env.PATH??""].filter(Boolean).join(O.delimiter),dependencies:r,globalBin:o},null,2)),v.exit(0);console.log(`export PATH="${[...a,"$PATH"].join(O.delimiter)}"`),v.exit(0)});F.command("shell-init","Print the shell snippet that puts pantry-installed packages on PATH").option("--install","Append the snippet to your shell rc file (idempotent)").option("--uninstall","Remove a previously installed snippet").option("--shell <shell>","Force a shell (zsh|bash|fish) instead of autodetect").action(async(e)=>{let i=e.shell??j();try{if(e.uninstall){let o=ce({shell:i});console.log(o.changed?`✓ Removed pantry shell-init from ${o.rcFile}`:`Nothing to remove (no pantry shell-init block in ${o.rcFile})`),v.exit(0)}if(e.install){let o=ie({shell:i});if(o.changed)console.log(`✓ Added pantry shell-init to ${o.rcFile}`),console.log(`  Restart your shell or run: source ${o.rcFile}`);else console.log(`✓ Already integrated in ${o.rcFile}`);v.exit(0)}let r=E(i);if(v.stdout.isTTY){if(console.log(`# Detected shell: ${i}`),console.log(`# Global bin dir: ${f()}`),r)console.log(`# Append this to: ${r}`);console.log("# Or run: ts-pantry shell-init --install"),console.log()}v.stdout.write(L({shell:i})),v.exit(0)}catch(r){console.error("Error:",r instanceof Error?r.message:r),v.exit(1)}});F.command("build [context]","Build a Dockerfile into an OCI image (no Docker daemon required)").option("-f, --file <path>","Path to the Dockerfile (default: <context>/Dockerfile)").option("-t, --tag <tag>","Image tag, e.g. myapp:latest (repeatable)").option("--target <stage>","Target stage for a multi-stage build").option("--build-arg <kv>","Set a build arg KEY=VALUE (repeatable)").option("--platform <os/arch>","Target platform (default: linux/<host-arch>)").option("--output <dir>","Where to write the image archive + OCI layout (default: <context>/.pantry/images)").option("--run-mode <mode>","How to run RUN steps: auto|chroot|host|skip (default: auto)").option("--push","Push the built image to the pantry registry after building").option("--quiet","Suppress step output").action(async(e,i)=>{try{let r=[].concat(i.tag??[]),o={};for(let l of[].concat(i.buildArg??[])){let g=l.indexOf("=");if(g!==-1)o[l.slice(0,g)]=l.slice(g+1)}let a=await de({context:e??".",dockerfile:i.file,tags:r,target:i.target,buildArgs:o,platform:i.platform,outputDir:i.output,runMode:i.runMode,quiet:i.quiet});if(!i.quiet){if(console.log(`
 ✓ Built ${a.imageId}`),r.length)console.log(`  tags: ${r.join(", ")}`);console.log(`  archive: ${a.archivePath}`),console.log(`  oci layout: ${a.ociLayoutPath}`)}if(i.push){let l=G(r[0]||"app:latest");if(!i.quiet)console.log(`

package/dist/chunk-2ybm9yer.js

@@ -0,0 +1 @@
+import{t,je,St,Ue}from"./chunk-xf6jmg4r.js";Ue();export{t as aliases,St as packages,je as pantry};

package/dist/chunk-6jywemnk.js

@@ -0,0 +1 @@
+import{n,d,h,ga,ma}from"./chunk-xf6jmg4r.js";export{ma as ALL_KNOWN_PACKAGES,n as DEFAULT_CACHE_DIR,d as DEFAULT_CACHE_EXPIRATION_MINUTES,h as DEFAULT_TIMEOUT_MS,ga as PACKAGE_ALIASES};

package/dist/{chunk-2rtvgvbn.js → chunk-9xrmp053.js}

@@ -1 +1 @@
-import{execSync as c}from"node:child_process";var i=new Set,m=!1;function T(){if(m)return;m=!0;let t=()=>{for(let e of i)try{c(`pantry stop ${e}`,{stdio:"ignore",timeout:1e4})}catch{}i.clear()};process.on("exit",t),process.on("SIGINT",()=>{t(),process.exit(130)}),process.on("SIGTERM",()=>{t(),process.exit(143)})}function o(t,e=!1){let r={encoding:"utf-8",timeout:30000,stdio:e?"pipe":["pipe","pipe","pipe"]};return c(`pantry ${t}`,r)}function v(t){let e=t.match(/Name:\s+(\S+)/)?.[1]??"",r=/Status:\s+running/i.test(t),s=t.match(/Port:\s+(\d+)/),n=t.match(/PID:\s+(\d+)/),f=t.match(/Data Dir:\s+(.+)/);return{name:e,running:r,port:s?Number.parseInt(s[1],10):null,pid:n?Number.parseInt(n[1],10):null,dataDir:f?f[1].trim():null}}class p{config;_startedByUs=!1;constructor(t){this.config={name:t.name,port:t.port??0,readyTimeoutMs:t.readyTimeoutMs??15000,pollIntervalMs:t.pollIntervalMs??200,quiet:t.quiet??!0}}static isAvailable(){try{return c("pantry --version",{stdio:"ignore",timeout:5000}),!0}catch{return!1}}status(){try{let t=o(`inspect ${this.config.name}`,!0);return v(t)}catch{return{name:this.config.name,running:!1,port:null,pid:null,dataDir:null}}}isRunning(){return this.status().running}getPort(){return this.status().port}async start(){if(T(),this.isRunning())return this.status();return o(`start ${this.config.name}`,this.config.quiet),this._startedByUs=!0,i.add(this.config.name),await this.waitReady(),this.status()}async stop(){if(!this._startedByUs)return;try{o(`stop ${this.config.name}`,this.config.quiet)}catch{}i.delete(this.config.name),this._startedByUs=!1}async forceStop(){try{o(`stop ${this.config.name}`,this.config.quiet)}catch{}i.delete(this.config.name),this._startedByUs=!1}async ensureRunning(){if(this.isRunning())return this.status();return this.start()}async waitReady(){let t=Date.now()+this.config.readyTimeoutMs;while(Date.now()<t){if(this.isRunning())return;await new Promise((e)=>setTimeout(e,this.config.pollIntervalMs))}throw Error(`Service '${this.config.name}' did not become ready within ${this.config.readyTimeoutMs}ms`)}}var y=new p({name:"mysql"});async function K(t){let e=await y.ensureRunning();return{port:t?.port??e.port??3306,host:t?.host??"localhost",database:t?.database??"test",username:t?.username??"root"}}async function W(){await y.stop()}function ot(t){let e=null;return{get connection(){if(!e)throw Error("MySQL not started. Ensure beforeAll has run.");return e},beforeAll:async()=>{e=await K(t)},afterAll:async()=>{await W(),e=null}}}async function st(t,e){let r=await K(e);try{return await t(r)}finally{if(e?.stopAfter!==!1)await W()}}var g=new p({name:"postgres"});async function H(t){let e=await g.ensureRunning();return{port:t?.port??e.port??5432,host:t?.host??"localhost",database:t?.database??"postgres",username:t?.username??process.env.USER??"postgres"}}async function J(){await g.stop()}function nt(t){let e=null;return{get connection(){if(!e)throw Error("Postgres not started. Ensure beforeAll has run.");return e},beforeAll:async()=>{e=await H(t)},afterAll:async()=>{await J(),e=null}}}async function rt(t,e){let r=await H(e);try{return await t(r)}finally{if(e?.stopAfter!==!1)await J()}}var d=new p({name:"redis"});async function X(t){let e=await d.ensureRunning(),r=t?.port??e.port??6379,s=t?.host??"localhost";return{port:r,host:s,url:`redis://${s}:${r}`}}async function Z(){await d.stop()}function it(t){let e=null;return{get connection(){if(!e)throw Error("Redis not started. Ensure beforeAll has run.");return e},beforeAll:async()=>{e=await X(t)},afterAll:async()=>{await Z(),e=null}}}async function ct(t,e){let r=await X(e);try{return await t(r)}finally{if(e?.stopAfter!==!1)await Z()}}import{existsSync as u,mkdirSync as P,mkdtempSync as S,rmSync as w,writeFileSync as R}from"node:fs";import{tmpdir as x}from"node:os";import{join as l}from"node:path";var a=new Set,h=!1;function M(){if(h)return;h=!0;let t=()=>{for(let e of a)try{if(u(e))w(e,{recursive:!0,force:!0})}catch{}a.clear()};process.on("exit",t),process.on("SIGINT",()=>{t(),process.exit(130)}),process.on("SIGTERM",()=>{t(),process.exit(143)})}function Q(t="pantry-test-"){M();let e=S(l(x(),t));return a.add(e),e}function ee(t){a.delete(t);try{if(u(t))w(t,{recursive:!0,force:!0})}catch{}}async function lt(t,e){let r=Q(t);try{return await e(r)}finally{ee(r)}}function pt(t,e){let r=Q(t);try{return e(r)}finally{ee(r)}}function gt(t,e,r){let s=l(t,e),n=s.substring(0,s.lastIndexOf("/"));if(n&&!u(n))P(n,{recursive:!0});return R(s,r),s}function mt(t,e){let r=l(t,e);return P(r,{recursive:!0}),r}var Ta={createTempDir:Q,createTestDir:mt,createTestFile:gt,PantryService:p,removeTempDir:ee,startMysql:K,startPostgres:H,startRedis:X,stopMysql:W,stopPostgres:J,stopRedis:Z,useMysql:ot,usePostgres:nt,useRedis:it,withMysql:st,withPostgres:rt,withRedis:ct,withTempDir:lt,withTempDirSync:pt};export{p,K,W,ot,st,H,J,nt,rt,X,Z,it,ct,Q,ee,lt,pt,gt,mt,Ta};
+import{execSync as c}from"node:child_process";var i=new Set,m=!1;function T(){if(m)return;m=!0;let t=()=>{for(let e of i)try{c(`pantry stop ${e}`,{stdio:"ignore",timeout:1e4})}catch{}i.clear()};process.on("exit",t),process.on("SIGINT",()=>{t(),process.exit(130)}),process.on("SIGTERM",()=>{t(),process.exit(143)})}function o(t,e=!1){let r={encoding:"utf-8",timeout:30000,stdio:e?"pipe":["pipe","pipe","pipe"]};return c(`pantry ${t}`,r)}function v(t){let e=t.match(/Name:\s+(\S+)/)?.[1]??"",r=/Status:\s+running/i.test(t),s=t.match(/Port:\s+(\d+)/),n=t.match(/PID:\s+(\d+)/),f=t.match(/Data Dir:\s+(.+)/);return{name:e,running:r,port:s?Number.parseInt(s[1],10):null,pid:n?Number.parseInt(n[1],10):null,dataDir:f?f[1].trim():null}}class p{config;_startedByUs=!1;constructor(t){this.config={name:t.name,port:t.port??0,readyTimeoutMs:t.readyTimeoutMs??15000,pollIntervalMs:t.pollIntervalMs??200,quiet:t.quiet??!0}}static isAvailable(){try{return c("pantry --version",{stdio:"ignore",timeout:5000}),!0}catch{return!1}}status(){try{let t=o(`inspect ${this.config.name}`,!0);return v(t)}catch{return{name:this.config.name,running:!1,port:null,pid:null,dataDir:null}}}isRunning(){return this.status().running}getPort(){return this.status().port}async start(){if(T(),this.isRunning())return this.status();return o(`start ${this.config.name}`,this.config.quiet),this._startedByUs=!0,i.add(this.config.name),await this.waitReady(),this.status()}async stop(){if(!this._startedByUs)return;try{o(`stop ${this.config.name}`,this.config.quiet)}catch{}i.delete(this.config.name),this._startedByUs=!1}async forceStop(){try{o(`stop ${this.config.name}`,this.config.quiet)}catch{}i.delete(this.config.name),this._startedByUs=!1}async ensureRunning(){if(this.isRunning())return this.status();return this.start()}async waitReady(){let t=Date.now()+this.config.readyTimeoutMs;while(Date.now()<t){if(this.isRunning())return;await new Promise((e)=>setTimeout(e,this.config.pollIntervalMs))}throw Error(`Service '${this.config.name}' did not become ready within ${this.config.readyTimeoutMs}ms`)}}var y=new p({name:"mysql"});async function K(t){let e=await y.ensureRunning();return{port:t?.port??e.port??3306,host:t?.host??"localhost",database:t?.database??"test",username:t?.username??"root"}}async function W(){await y.stop()}function ot(t){let e=null;return{get connection(){if(!e)throw Error("MySQL not started. Ensure beforeAll has run.");return e},beforeAll:async()=>{e=await K(t)},afterAll:async()=>{await W(),e=null}}}async function st(t,e){let r=await K(e);try{return await t(r)}finally{if(e?.stopAfter!==!1)await W()}}var g=new p({name:"postgres"});async function H(t){let e=await g.ensureRunning();return{port:t?.port??e.port??5432,host:t?.host??"localhost",database:t?.database??"postgres",username:t?.username??process.env.USER??"postgres"}}async function J(){await g.stop()}function nt(t){let e=null;return{get connection(){if(!e)throw Error("Postgres not started. Ensure beforeAll has run.");return e},beforeAll:async()=>{e=await H(t)},afterAll:async()=>{await J(),e=null}}}async function rt(t,e){let r=await H(e);try{return await t(r)}finally{if(e?.stopAfter!==!1)await J()}}var d=new p({name:"redis"});async function X(t){let e=await d.ensureRunning(),r=t?.port??e.port??6379,s=t?.host??"localhost";return{port:r,host:s,url:`redis://${s}:${r}`}}async function Z(){await d.stop()}function it(t){let e=null;return{get connection(){if(!e)throw Error("Redis not started. Ensure beforeAll has run.");return e},beforeAll:async()=>{e=await X(t)},afterAll:async()=>{await Z(),e=null}}}async function ct(t,e){let r=await X(e);try{return await t(r)}finally{if(e?.stopAfter!==!1)await Z()}}import{existsSync as u,mkdirSync as P,mkdtempSync as S,rmSync as w,writeFileSync as R}from"node:fs";import{tmpdir as x}from"node:os";import{join as l}from"node:path";var a=new Set,h=!1;function M(){if(h)return;h=!0;let t=()=>{for(let e of a)try{if(u(e))w(e,{recursive:!0,force:!0})}catch{}a.clear()};process.on("exit",t),process.on("SIGINT",()=>{t(),process.exit(130)}),process.on("SIGTERM",()=>{t(),process.exit(143)})}function Q(t="pantry-test-"){M();let e=S(l(x(),t));return a.add(e),e}function ee(t){a.delete(t);try{if(u(t))w(t,{recursive:!0,force:!0})}catch{}}async function lt(t,e){let r=Q(t);try{return await e(r)}finally{ee(r)}}function pt(t,e){let r=Q(t);try{return e(r)}finally{ee(r)}}function gt(t,e,r){let s=l(t,e),n=s.substring(0,s.lastIndexOf("/"));if(n&&!u(n))P(n,{recursive:!0});return R(s,r),s}function mt(t,e){let r=l(t,e);return P(r,{recursive:!0}),r}var Oa={createTempDir:Q,createTestDir:mt,createTestFile:gt,PantryService:p,removeTempDir:ee,startMysql:K,startPostgres:H,startRedis:X,stopMysql:W,stopPostgres:J,stopRedis:Z,useMysql:ot,usePostgres:nt,useRedis:it,withMysql:st,withPostgres:rt,withRedis:ct,withTempDir:lt,withTempDirSync:pt};export{p,K,W,ot,st,H,J,nt,rt,X,Z,it,ct,Q,ee,lt,pt,gt,mt,Oa};

package/dist/chunk-d8hyhrra.js

@@ -0,0 +1 @@
+import{A,ho,fo}from"./chunk-xf6jmg4r.js";export{A as compareVersions,fo as generateZigAliases,ho as generateZigDefinitions};

package/dist/chunk-dc6k11xh.js

@@ -0,0 +1 @@
+import{I,O,ca,$t,De,u,q,Se,la,oe,$e,se,N,Ie,pa}from"./chunk-xf6jmg4r.js";export{Ie as compareVersionsDesc,$e as getActivePackages,O as getAvailableVersions,I as getLatestVersion,u as getPackageInfo,la as getPackagesByPattern,ca as getPhpVersionsForWorkflow,oe as getPopularPackages,$t as isVersionAvailable,N as parseVersion,q as resolvePackageDomain,De as resolveVersion,pa as resolveVersionFromMetadata,Se as searchPackages,se as validatePackageSpec};

package/dist/chunk-ezky7wtc.js

@@ -0,0 +1 @@
+import{Zt,Qt,ea,ta,Qe,Ia,Aa}from"./chunk-xf6jmg4r.js";export{Qt as MAS_APPS,Zt as SYSTEM_APPS,Ia as checkAppUpdates,Qe as fetchDesktopCatalogue,ea as isNewerVersion,ta as scanInstalledApps,Aa as updateApp};

package/dist/{chunk-gf5h5t76.js → chunk-ndgq5wvr.js}

@@ -1,17 +1,17 @@
-import{existsSync as Ye,readFileSync as We}from"node:fs";import{join as je,resolve as Y,sep as Ue}from"node:path";var Ra={revision:"d675077c317c486d8b5743f3432c40ddf1cd693a",version:"0.0.295"};function be(t){let r=t.split(".");return r.length>1&&r.every((n)=>/^[A-Za-z]\w*$/.test(n))}function g(t,r){let n=Y(t,r);if(n===Y(t)||!n.startsWith(`${Y(t)}${Ue}`))throw Error(`Native output must be inside the project: ${r}`);return n}function te(t,r=!1){let n=je(t,"pantry.json");if(!Ye(n)){if(r)throw Error("Native publishing requires pantry.json with a native configuration");return}let i=JSON.parse(We(n,"utf8")).native;if(!i){if(r)throw Error("pantry.json must declare native app settings");return}if(i.environment!==void 0&&(typeof i.environment!=="string"||!/^[a-z][a-z0-9-]*$/.test(i.environment)))throw Error("Invalid native release environment name");if(i.runtime&&(!/^[a-f0-9]{40}$/.test(i.runtime.revision)||!/^\d+\.\d+\.\d+$/.test(i.runtime.version)))throw Error("Craft requires an immutable 40-character Git revision and an exact version");for(let o of[i.build,...i.checks?.before??[],...i.checks?.after??[]])if(o!==void 0&&(!Array.isArray(o)||!o.length||o.some((s)=>typeof s!=="string"||!s)))throw Error("Native commands must be nonempty argument arrays");if(i.macos?.maxBundleSize!==void 0&&(!Number.isSafeInteger(i.macos.maxBundleSize)||i.macos.maxBundleSize<=0))throw Error("maxBundleSize must be a positive byte count");if(i.android){if(g(t,i.android.bundle),!be(i.android.packageName)||!i.android.track||!["draft","completed","inProgress"].includes(i.android.status))throw Error("Android publishing requires a package name, track and explicit release status");let o=i.android.userFraction;if(i.android.status==="inProgress"?!(typeof o==="number"&&o>0&&o<1):o!==void 0)throw Error("Only an inProgress rollout requires userFraction between zero and one")}return i}import ze from"node:process";import{spawn as Ge}from"node:child_process";var a=(t,r,n={})=>new Promise((i,o)=>{let s=Ge(t,r,{cwd:n.cwd,env:n.env??ze.env,stdio:n.inherit?"inherit":[n.input===void 0?"ignore":"pipe","pipe","pipe"]});if(n.input!==void 0)s.stdin?.end(n.input);let c="",d="";s.stdout?.on("data",(u)=>{c+=u.toString()}),s.stderr?.on("data",(u)=>{d+=u.toString()}),s.once("error",o),s.once("close",(u)=>i({exitCode:u??1,stdout:c,stderr:d}))});function e(t,r){if(r.exitCode!==0)throw Error(`${t} failed (${r.exitCode}): ${r.stdout}
-${r.stderr}`.trim());return r}import V from"node:process";import{createHash as qe}from"node:crypto";import{existsSync as O,mkdirSync as Me,readFileSync as W,writeFileSync as Je}from"node:fs";import{join as P,resolve as He}from"node:path";function dt(t,r,n=V.arch){if(!/^[a-f0-9]{40}$/.test(t))throw Error("Craft revision must be immutable");if(!/^\d+\.\d+(?:\.\d+)?$/.test(r))throw Error("A valid minimum macOS version is required");let i=n==="arm64"?"aarch64":n==="x64"?"x86_64":void 0;if(!i)throw Error(`Unsupported native architecture: ${n}`);return`revision=${t};ReleaseSmall;js-runtime=false;target=${i}-macos.${r}`}function aa(t,r,n=V.arch){if(!t.runtime)throw Error("No Craft runtime configured");return qe("sha256").update(`${dt(t.runtime.revision,r,n)};version=${t.runtime.version};schema=1`).digest("hex")}function oa(t){let r=t.workspaces?.[""]?.system?.["ziglang.org"];if(typeof r!=="string"||!/^\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?$/.test(r))throw Error("Craft must lock an exact Zig compiler version");return r}async function ht(t,r,n,i={}){let o=i.env??V.env;if(o.CRAFT_BIN){let v=He(t,o.CRAFT_BIN);if(!O(v))throw Error(`CRAFT_BIN does not exist: ${v}`);return v}if(!r.runtime)return;if(V.platform!=="darwin")throw Error("The configured macOS Craft runtime must be built on macOS");let s=i.command??a,{revision:c,version:d}=r.runtime,u=dt(c,n),l=P(t,".pantry/native/runtimes",aa(r,n)),p=P(l,"Tools/craft"),f=P(p,"packages/zig/zig-out/bin/craft"),y=P(p,".pantry-runtime-profile"),m=async(v,w,h=o,k=!1)=>e(v[0],await s(v[0],v.slice(1),{cwd:w,env:h,inherit:k})),E=async(v,w,h)=>{if(!/^[a-f0-9]{40}$/.test(w))throw Error(`Missing immutable dependency pin: ${v}`);if(Me(h,{recursive:!0}),!O(P(h,".git")))await m(["git","init","--quiet"],h),await m(["git","remote","add","origin",`https://github.com/${v}.git`],h),await m(["git","fetch","--quiet","--depth","1","origin",w],h),await m(["git","checkout","--quiet","--detach","FETCH_HEAD"],h);let k=(await m(["git","rev-parse","HEAD"],h)).stdout.trim();if(k!==w)throw Error(`Unexpected source revision in ${h}: ${k}`);if((await m(["git","status","--porcelain","--untracked-files=no"],h)).stdout.trim())throw Error(`Modified runtime source in ${h}`)};await E("craft-native/craft",c,p);let I=W(P(p,".github/actions/first-party-zig-deps/pins.env"),"utf8");for(let[v,w]of[["zig-js","zig_js"],["zig-regex","zig_regex"],["zig-gc","zig_gc"]]){let h=I.match(new RegExp(`^${w}=([a-f0-9]{40})$`,"m"))?.[1];if(!h)throw Error(`Missing upstream dependency pin: ${w}`);await E(`zig-utils/${v}`,h,P(l,"Libraries",v))}if(!O(f)||!O(y)||W(y,"utf8")!==u){let v=JSON.parse(W(P(p,"pantry.lock"),"utf8")),w=oa(v);await m(["pantry","install",`ziglang.org@${w}`,"--no-save","--ignore-scripts"],p,o,!0);let h=P(p,"pantry/ziglang.org",`v${w}`,"bin/zig");if(!O(h))throw Error(`Locked Zig compiler is missing: ${h}`);let k=(await m(["xcrun","--sdk","macosx","--show-sdk-path"],p)).stdout.trim();if(!k)throw Error("The macOS SDK is required");let H=u.split("target=")[1];await m(["bun","scripts/zig.ts","--core","--versioned","build","-Doptimize=ReleaseSmall","-Djs-runtime=false",`-Dtarget=${H}`,`-Dmacos-sdk=${k}`],p,{...o,CRAFT_ZIG:h},!0),Je(y,u)}let T=await m([f,"--version"],p);if(!`${T.stdout}${T.stderr}`.includes(`craft version ${d}`))throw Error(`Craft does not match configured version ${d}`);return f}import Xe from"node:process";import{existsSync as Z,mkdirSync as Ze,mkdtempSync as Qe,readFileSync as et,rmSync as X,writeFileSync as Q}from"node:fs";import{tmpdir as tt}from"node:os";import{join as x,resolve as rt}from"node:path";function j(t){return t.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&apos;")}function sa(t){let r=(n)=>typeof n==="boolean"?`<${n}/>`:typeof n==="string"?`<string>${j(n)}</string>`:Array.isArray(n)&&n.every((i)=>typeof i==="string")?`<array>${n.map((i)=>`<string>${j(i)}</string>`).join("")}</array>`:(()=>{throw Error("Unsupported entitlement value")})();return`<?xml version="1.0" encoding="UTF-8"?>
+import{existsSync as We,readFileSync as je}from"node:fs";import{join as Ue,resolve as W,sep as ze}from"node:path";var qa={revision:"d675077c317c486d8b5743f3432c40ddf1cd693a",version:"0.0.295"};function be(t){let r=t.split(".");return r.length>1&&r.every((n)=>/^[A-Za-z]\w*$/.test(n))}function g(t,r){let n=W(t,r);if(n===W(t)||!n.startsWith(`${W(t)}${ze}`))throw Error(`Native output must be inside the project: ${r}`);return n}function te(t,r=!1){let n=Ue(t,"pantry.json");if(!We(n)){if(r)throw Error("Native publishing requires pantry.json with a native configuration");return}let i=JSON.parse(je(n,"utf8")).native;if(!i){if(r)throw Error("pantry.json must declare native app settings");return}if(i.environment!==void 0&&(typeof i.environment!=="string"||!/^[a-z][a-z0-9-]*$/.test(i.environment)))throw Error("Invalid native release environment name");if(i.runtime&&(!/^[a-f0-9]{40}$/.test(i.runtime.revision)||!/^\d+\.\d+\.\d+$/.test(i.runtime.version)))throw Error("Craft requires an immutable 40-character Git revision and an exact version");for(let o of[i.build,...i.checks?.before??[],...i.checks?.after??[]])if(o!==void 0&&(!Array.isArray(o)||!o.length||o.some((s)=>typeof s!=="string"||!s)))throw Error("Native commands must be nonempty argument arrays");if(i.macos?.maxBundleSize!==void 0&&(!Number.isSafeInteger(i.macos.maxBundleSize)||i.macos.maxBundleSize<=0))throw Error("maxBundleSize must be a positive byte count");if(i.android){if(g(t,i.android.bundle),!be(i.android.packageName)||!i.android.track||!["draft","completed","inProgress"].includes(i.android.status))throw Error("Android publishing requires a package name, track and explicit release status");let o=i.android.userFraction;if(i.android.status==="inProgress"?!(typeof o==="number"&&o>0&&o<1):o!==void 0)throw Error("Only an inProgress rollout requires userFraction between zero and one")}return i}import Ge from"node:process";import{spawn as qe}from"node:child_process";var a=(t,r,n={})=>new Promise((i,o)=>{let s=qe(t,r,{cwd:n.cwd,env:n.env??Ge.env,stdio:n.inherit?"inherit":[n.input===void 0?"ignore":"pipe","pipe","pipe"]});if(n.input!==void 0)s.stdin?.end(n.input);let c="",d="";s.stdout?.on("data",(u)=>{c+=u.toString()}),s.stderr?.on("data",(u)=>{d+=u.toString()}),s.once("error",o),s.once("close",(u)=>i({exitCode:u??1,stdout:c,stderr:d}))});function e(t,r){if(r.exitCode!==0)throw Error(`${t} failed (${r.exitCode}): ${r.stdout}
+${r.stderr}`.trim());return r}import V from"node:process";import{createHash as Me}from"node:crypto";import{existsSync as k,mkdirSync as Je,readFileSync as j,rmSync as He,writeFileSync as Xe}from"node:fs";import{join as w,resolve as Ze}from"node:path";function dt(t,r,n=V.arch){if(!/^[a-f0-9]{40}$/.test(t))throw Error("Craft revision must be immutable");if(!/^\d+\.\d+(?:\.\d+)?$/.test(r))throw Error("A valid minimum macOS version is required");let i=n==="arm64"?"aarch64":n==="x64"?"x86_64":void 0;if(!i)throw Error(`Unsupported native architecture: ${n}`);return`revision=${t};ReleaseSmall;js-runtime=false;target=${i}-macos.${r}`}function aa(t,r,n=V.arch){if(!t.runtime)throw Error("No Craft runtime configured");return Me("sha256").update(`${dt(t.runtime.revision,r,n)};version=${t.runtime.version};schema=1`).digest("hex")}function oa(t){let r=t.workspaces?.[""]?.system?.["ziglang.org"];if(typeof r!=="string"||!/^\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?$/.test(r))throw Error("Craft must lock an exact Zig compiler version");return r}function sa(t){if(!k(w(t,"packages/zig/build.zig.zon")))throw Error("Craft dependency manifest is missing");let r=w(t,".github/actions/first-party-zig-deps/pins.env");if(!k(r))return{kind:"manifest"};let n=j(r,"utf8");return{kind:"legacy-pins",sources:[["zig-js","zig_js"],["zig-regex","zig_regex"],["zig-gc","zig_gc"]].map(([o,s])=>{let c=n.match(new RegExp(`^${s}=([a-f0-9]{40})$`,"m"))?.[1];if(!c)throw Error(`Missing upstream dependency pin: ${s}`);return{repository:`zig-utils/${o}`,revision:c,directory:o}})}}async function ht(t,r,n,i={}){let o=i.env??V.env;if(o.CRAFT_BIN){let v=Ze(t,o.CRAFT_BIN);if(!k(v))throw Error(`CRAFT_BIN does not exist: ${v}`);return v}if(!r.runtime)return;if(V.platform!=="darwin")throw Error("The configured macOS Craft runtime must be built on macOS");let s=i.command??a,{revision:c,version:d}=r.runtime,u=dt(c,n),l=w(t,".pantry/native/runtimes",aa(r,n)),p=w(l,"Tools/craft"),f=w(p,"packages/zig/zig-out/bin/craft"),y=w(p,".pantry-runtime-profile"),m=async(v,_,E=o,b=!1)=>e(v[0],await s(v[0],v.slice(1),{cwd:_,env:E,inherit:b})),h=async(v,_,E)=>{if(!/^[a-f0-9]{40}$/.test(_))throw Error(`Missing immutable dependency pin: ${v}`);if(Je(E,{recursive:!0}),!k(w(E,".git")))await m(["git","init","--quiet"],E),await m(["git","remote","add","origin",`https://github.com/${v}.git`],E),await m(["git","fetch","--quiet","--depth","1","origin",_],E),await m(["git","checkout","--quiet","--detach","FETCH_HEAD"],E);let b=(await m(["git","rev-parse","HEAD"],E)).stdout.trim();if(b!==_)throw Error(`Unexpected source revision in ${E}: ${b}`);if((await m(["git","status","--porcelain","--untracked-files=no"],E)).stdout.trim())throw Error(`Modified runtime source in ${E}`)};await h("craft-native/craft",c,p);let N=sa(p);if(N.kind==="legacy-pins")for(let v of N.sources)await h(v.repository,v.revision,w(l,"Libraries",v.directory));if(!k(f)||!k(y)||j(y,"utf8")!==u){He(y,{force:!0});let v=JSON.parse(j(w(p,"pantry.lock"),"utf8")),_=oa(v);await m(["pantry","install",`ziglang.org@${_}`,"--no-save","--ignore-scripts"],p,o,!0);let E=w(p,"pantry/ziglang.org",`v${_}`,"bin/zig");if(!k(E))throw Error(`Locked Zig compiler is missing: ${E}`);let b={...o,CRAFT_ZIG:E};if(N.kind==="manifest")await m(["bun","scripts/zig.ts","--core","build","--fetch"],p,b,!0);let Y=(await m(["xcrun","--sdk","macosx","--show-sdk-path"],p)).stdout.trim();if(!Y)throw Error("The macOS SDK is required");let Ye=u.split("target=")[1];await m(["bun","scripts/zig.ts","--core","--versioned","build","-Doptimize=ReleaseSmall","-Djs-runtime=false",`-Dtarget=${Ye}`,`-Dmacos-sdk=${Y}`],p,b,!0),Xe(y,u)}let O=await m([f,"--version"],p);if(!`${O.stdout}${O.stderr}`.includes(`craft version ${d}`))throw Error(`Craft does not match configured version ${d}`);return f}import Qe from"node:process";import{existsSync as Z,mkdirSync as et,mkdtempSync as tt,readFileSync as rt,rmSync as X,writeFileSync as Q}from"node:fs";import{tmpdir as it}from"node:os";import{join as x,resolve as nt}from"node:path";function U(t){return t.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&apos;")}function na(t){let r=(n)=>typeof n==="boolean"?`<${n}/>`:typeof n==="string"?`<string>${U(n)}</string>`:Array.isArray(n)&&n.every((i)=>typeof i==="string")?`<array>${n.map((i)=>`<string>${U(i)}</string>`).join("")}</array>`:(()=>{throw Error("Unsupported entitlement value")})();return`<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0"><dict>${Object.entries(t).map(([n,i])=>`<key>${j(n)}</key>${r(i)}`).join("")}</dict></plist>
-`}async function Oa(t,r={}){let n=te(t),i=r.env??Xe.env;if(!n)return{overrides:{},cleanup(){}};let o=await ht(t,n,r.minimumSystemVersion??"13.0",{env:i}),s=i.PANTRY_DISTRIBUTION==="app-store",c=s?n.macos?.entitlements?.appStore:n.macos?.entitlements?.direct,d=i.APPLE_SIGNING_IDENTITY,u=i.APPLE_PROVISIONING_PROFILE_PATH||i.APPLE_PROVISIONING_PROFILE,l=Qe(x(tt(),"pantry-native-build-"));try{let p=x(l,"entitlements.plist");if(c)Q(p,sa(c),{mode:384});if(u&&!Z(u))throw Error("APPLE_PROVISIONING_PROFILE must name a local profile file");if(s&&(!d||!u||c?.["com.apple.security.app-sandbox"]!==!0))throw Error("App Store builds require a signing identity, provisioning profile and sandbox entitlement");return{overrides:{...o?{craftPath:o}:{},...s?{output:g(t,".pantry/native/app-store")}:{},...d?{macosSigning:{identity:d,...u?{provisioningProfile:rt(u)}:{},...c?{entitlements:p}:{},hardenedRuntime:!s}}:{}},cleanup(){X(l,{recursive:!0,force:!0})}}}catch(p){throw X(l,{recursive:!0,force:!0}),p}}function qa(t,r){g(t,r.path);let n=x(t,".pantry/native");Ze(n,{recursive:!0}),Q(x(n,"artifact.json"),`${JSON.stringify(r,null,2)}
-`)}function ke(t){let r=JSON.parse(et(x(t,".pantry/native/artifact.json"),"utf8"));if(g(t,r.path),!r.name||!r.bundleId||!r.version||!r.buildNumber||!Z(r.path))throw Error("The native build did not produce a complete artifact manifest");return r}import it from"node:process";import{createHash as nt}from"node:crypto";import{existsSync as b,mkdtempSync as re,readFileSync as ie,rmSync as ne,writeFileSync as oe}from"node:fs";import{tmpdir as se}from"node:os";import{basename as ot,dirname as st,join as R}from"node:path";import{setTimeout as at}from"node:timers/promises";function ft(t=it.env){if(t.APPLE_NOTARY_KEYCHAIN_PROFILE)return{keychainProfile:t.APPLE_NOTARY_KEYCHAIN_PROFILE};let r=t.APP_STORE_CONNECT_API_KEY_ID,n=t.APP_STORE_CONNECT_ISSUER_ID||t.APP_STORE_CONNECT_API_ISSUER_ID,i=t.APP_STORE_CONNECT_PRIVATE_KEY||(t.APP_STORE_CONNECT_API_KEY_PATH?ie(t.APP_STORE_CONNECT_API_KEY_PATH,"utf8"):void 0);if(r||n||i){if(!r||!n||!i)throw Error("Notarization requires complete App Store Connect API credentials");if(!/^[A-Z0-9]+$/.test(r))throw Error("Invalid App Store Connect API key ID");return{apiKeyId:r,issuerId:n,privateKey:i}}if(t.APPLE_ID&&t.APPLE_APP_SPECIFIC_PASSWORD&&t.APPLE_TEAM_ID)return{appleId:t.APPLE_ID,password:t.APPLE_APP_SPECIFIC_PASSWORD,teamId:t.APPLE_TEAM_ID};throw Error("Notarization requires an existing keychain profile, App Store Connect API key, or Apple ID credentials")}async function yt(t,r,n=a){if(!b(t)||!t.toLowerCase().endsWith(".dmg")||!r)throw Error("Disk image signing requires an existing DMG and a Developer ID Application identity");e("Sign disk image",await n("codesign",["--force","--sign",r,"--timestamp",t])),e("Disk image signature",await n("codesign",["--verify","--strict",t]));let i=e("Disk image identity",await n("codesign",["-dv","--verbose=4",t])),o=`${i.stdout}
-${i.stderr}`;if(!o.includes("Authority=Developer ID Application:")||!/^Timestamp=/m.test(o))throw Error("Disk image requires a timestamped Developer ID Application signature")}async function xe(t,r=a){let n=t.toLowerCase().endsWith(".dmg")?["--type","open","--context","context:primary-signature"]:t.toLowerCase().endsWith(".app")?["--type","exec"]:t.toLowerCase().endsWith(".pkg")?["--type","install"]:void 0;if(!b(t)||!n)throw Error("Gatekeeper assessment requires an existing app, DMG or PKG");let i=e("Gatekeeper assessment",await r("spctl",["--assess",...n,"--verbose=2",t]));if(!`${i.stdout}
+<plist version="1.0"><dict>${Object.entries(t).map(([n,i])=>`<key>${U(n)}</key>${r(i)}`).join("")}</dict></plist>
+`}async function Na(t,r={}){let n=te(t),i=r.env??Qe.env;if(!n)return{overrides:{},cleanup(){}};let o=await ht(t,n,r.minimumSystemVersion??"13.0",{env:i}),s=i.PANTRY_DISTRIBUTION==="app-store",c=s?n.macos?.entitlements?.appStore:n.macos?.entitlements?.direct,d=i.APPLE_SIGNING_IDENTITY,u=i.APPLE_PROVISIONING_PROFILE_PATH||i.APPLE_PROVISIONING_PROFILE,l=tt(x(it(),"pantry-native-build-"));try{let p=x(l,"entitlements.plist");if(c)Q(p,na(c),{mode:384});if(u&&!Z(u))throw Error("APPLE_PROVISIONING_PROFILE must name a local profile file");if(s&&(!d||!u||c?.["com.apple.security.app-sandbox"]!==!0))throw Error("App Store builds require a signing identity, provisioning profile and sandbox entitlement");return{overrides:{...o?{craftPath:o}:{},...s?{output:g(t,".pantry/native/app-store")}:{},...d?{macosSigning:{identity:d,...u?{provisioningProfile:nt(u)}:{},...c?{entitlements:p}:{},hardenedRuntime:!s}}:{}},cleanup(){X(l,{recursive:!0,force:!0})}}}catch(p){throw X(l,{recursive:!0,force:!0}),p}}function Ya(t,r){g(t,r.path);let n=x(t,".pantry/native");et(n,{recursive:!0}),Q(x(n,"artifact.json"),`${JSON.stringify(r,null,2)}
+`)}function ke(t){let r=JSON.parse(rt(x(t,".pantry/native/artifact.json"),"utf8"));if(g(t,r.path),!r.name||!r.bundleId||!r.version||!r.buildNumber||!Z(r.path))throw Error("The native build did not produce a complete artifact manifest");return r}import ot from"node:process";import{createHash as st}from"node:crypto";import{existsSync as C,mkdtempSync as re,readFileSync as ie,rmSync as ne,writeFileSync as oe}from"node:fs";import{tmpdir as se}from"node:os";import{basename as at,dirname as ct,join as R}from"node:path";import{setTimeout as pt}from"node:timers/promises";function ft(t=ot.env){if(t.APPLE_NOTARY_KEYCHAIN_PROFILE)return{keychainProfile:t.APPLE_NOTARY_KEYCHAIN_PROFILE};let r=t.APP_STORE_CONNECT_API_KEY_ID,n=t.APP_STORE_CONNECT_ISSUER_ID||t.APP_STORE_CONNECT_API_ISSUER_ID,i=t.APP_STORE_CONNECT_PRIVATE_KEY||(t.APP_STORE_CONNECT_API_KEY_PATH?ie(t.APP_STORE_CONNECT_API_KEY_PATH,"utf8"):void 0);if(r||n||i){if(!r||!n||!i)throw Error("Notarization requires complete App Store Connect API credentials");if(!/^[A-Z0-9]+$/.test(r))throw Error("Invalid App Store Connect API key ID");return{apiKeyId:r,issuerId:n,privateKey:i}}if(t.APPLE_ID&&t.APPLE_APP_SPECIFIC_PASSWORD&&t.APPLE_TEAM_ID)return{appleId:t.APPLE_ID,password:t.APPLE_APP_SPECIFIC_PASSWORD,teamId:t.APPLE_TEAM_ID};throw Error("Notarization requires an existing keychain profile, App Store Connect API key, or Apple ID credentials")}async function yt(t,r,n=a){if(!C(t)||!t.toLowerCase().endsWith(".dmg")||!r)throw Error("Disk image signing requires an existing DMG and a Developer ID Application identity");e("Sign disk image",await n("codesign",["--force","--sign",r,"--timestamp",t])),e("Disk image signature",await n("codesign",["--verify","--strict",t]));let i=e("Disk image identity",await n("codesign",["-dv","--verbose=4",t])),o=`${i.stdout}
+${i.stderr}`;if(!o.includes("Authority=Developer ID Application:")||!/^Timestamp=/m.test(o))throw Error("Disk image requires a timestamped Developer ID Application signature")}async function xe(t,r=a){let n=t.toLowerCase().endsWith(".dmg")?["--type","open","--context","context:primary-signature"]:t.toLowerCase().endsWith(".app")?["--type","exec"]:t.toLowerCase().endsWith(".pkg")?["--type","install"]:void 0;if(!C(t)||!n)throw Error("Gatekeeper assessment requires an existing app, DMG or PKG");let i=e("Gatekeeper assessment",await r("spctl",["--assess",...n,"--verbose=2",t]));if(!`${i.stdout}
 ${i.stderr}`.includes("source=Notarized Developer ID"))throw Error("Gatekeeper did not recognize the notarized Developer ID distribution")}async function ee(t,r,n){let i=t==="staple"?"Staple notarization":"Validate notarization";for(let o=0;;o++){let s=await n("xcrun",["stapler",t,r]),c=/NSURLErrorDomain\s+Code=-(?:1001|1003|1004|1005|1009)\b/.test(`${s.stdout}
-${s.stderr}`);if(s.exitCode===0||!c||o===4){e(i,s);return}await at(1000*2**o)}}async function bt(t,r,n=a){if(!b(t)||!/\.(dmg|pkg|zip)$/i.test(t))throw Error("Notarization requires an existing DMG, PKG or ZIP");let i=re(R(se(),"pantry-notary-"));try{let o;if("keychainProfile"in r)o=["--keychain-profile",r.keychainProfile];else if("apiKeyId"in r){let d=R(i,"AuthKey.p8");oe(d,r.privateKey,{mode:384}),o=["--key",d,"--key-id",r.apiKeyId,"--issuer",r.issuerId]}else o=["--apple-id",r.appleId,"--password",r.password,"--team-id",r.teamId];let s=e("Apple notarization",await n("xcrun",["notarytool","submit",t,...o,"--wait","--timeout","30m","--output-format","json"])),c=JSON.parse(s.stdout);if(!c.id||c.status!=="Accepted")throw Error(`Apple did not accept notarization: ${c.status??"unknown status"} (${c.id??"no submission ID"})`);if(!t.toLowerCase().endsWith(".zip"))await ee("staple",t,n),await ee("validate",t,n);return{schemaVersion:1,file:ot(t),submissionId:c.id,status:c.status,sha256:nt("sha256").update(ie(t)).digest("hex"),completedAt:new Date().toISOString()}}finally{ne(i,{recursive:!0,force:!0})}}async function kt(t,r,n,i=a){if(!t.endsWith(".app")||!b(t)||!r.endsWith(".pkg")||!n)throw Error("App Store packaging requires an app, .pkg output and installer identity");if(b(r))throw Error(`Refusing to overwrite an existing package: ${r}`);if(!b(R(t,"Contents/embedded.provisionprofile")))throw Error("App Store app is missing its provisioning profile");e("App signature",await i("codesign",["--verify","--deep","--strict",t]));let o=e("Read signed entitlements",await i("codesign",["-d","--entitlements",":-",t])),s=re(R(se(),"pantry-app-store-package-"));try{let c=R(s,"entitlements.plist");if(oe(c,o.stdout||o.stderr),JSON.parse(e("App sandbox entitlement",await i("plutil",["-convert","json","-o","-",c])).stdout)["com.apple.security.app-sandbox"]!==!0)throw Error("App Store app sandbox must be enabled");if(e("Create signed App Store package",await i("productbuild",["--component",t,"/Applications","--sign",n,r],{cwd:st(r)})),e("Installer signature",await i("pkgutil",["--check-signature",r])),!b(r))throw Error("productbuild did not produce the requested package");return r}finally{ne(s,{recursive:!0,force:!0})}}import ct from"node:process";import{existsSync as ce,mkdtempSync as pt,renameSync as ut,rmSync as pe,writeFileSync as lt}from"node:fs";import{tmpdir as mt}from"node:os";import{join as ue}from"node:path";async function xt(t,r=ct.env,n=a){if(!t.endsWith(".aab")||!ce(t))throw Error("Android signing requires an existing .aab");let i=[r.ANDROID_KEYSTORE_BASE64,r.ANDROID_KEYSTORE_PASSWORD,r.ANDROID_KEY_ALIAS,r.ANDROID_KEY_PASSWORD];if(i.some(Boolean)&&!i.every(Boolean))throw Error("Android signing requires a keystore, alias, store password and key password");let o=pt(ue(mt(),"pantry-android-signing-")),s=`${t}.pantry-signed.aab`,c=async(d)=>{let u=e("Android bundle signature",await n("jarsigner",["-J-Duser.language=en","-J-Duser.country=US","-verify",d]));if(!/jar verified\./i.test(u.stdout)||/jar is unsigned/i.test(`${u.stdout}${u.stderr}`))throw Error("Android bundle is not signed")};try{if(i.every(Boolean)){if(ce(s))throw Error("A previous Android signing artifact still exists");let d=ue(o,"release.keystore");lt(d,Buffer.from(r.ANDROID_KEYSTORE_BASE64,"base64"),{mode:384}),e("Android bundle signing",await n("jarsigner",["-J-Duser.language=en","-J-Duser.country=US","-keystore",d,"-storepass:env","PANTRY_ANDROID_STORE_PASSWORD","-keypass:env","PANTRY_ANDROID_KEY_PASSWORD","-signedjar",s,t,r.ANDROID_KEY_ALIAS],{env:{...r,PANTRY_ANDROID_STORE_PASSWORD:r.ANDROID_KEYSTORE_PASSWORD,PANTRY_ANDROID_KEY_PASSWORD:r.ANDROID_KEY_PASSWORD}})),await c(s),ut(s,t)}else await c(t)}finally{pe(s,{force:!0}),pe(o,{recursive:!0,force:!0})}}import{existsSync as er,readFileSync as tr}from"node:fs";import{join as rr}from"node:path";import{chmodSync as oi,existsSync as Ne,readFileSync as Ae,renameSync as si,rmSync as ai,writeFileSync as ci}from"node:fs";import{basename as ui,dirname as di,resolve as _e}from"node:path";import{createCipheriv as Wr,createDecipheriv as fe,createHash as U,createPrivateKey as gt,createPublicKey as z,diffieHellman as Et,generateKeyPairSync as jr,hkdfSync as Nt,randomBytes as Ur}from"node:crypto";var L="x25519-public:",de="x25519-private:",le="encrypted:v2:",me="encrypted:",At=Buffer.from("stacks-env:v2","utf8"),ye="Environment decryption failed: authentication or format error";function _t(t){if(t.length===32)return t;return U("sha256").update(t).digest()}function St(t,r,n,i){try{let o=fe("aes-256-gcm",_t(r),Buffer.from(n,"hex"));return o.setAuthTag(Buffer.from(i,"hex")),Buffer.concat([o.update(Buffer.from(t,"hex")),o.final()]).toString("utf8")}catch{throw Error("Decryption failed: authentication or format error")}}function G(t){return t.toString("base64url")}function _(t,r,n){if(typeof t!=="string"||t.length>0&&!/^[A-Za-z0-9_-]+$/.test(t))throw Error(`${r} is not canonical base64url`);let i=Buffer.from(t,"base64url");if(G(i)!==t)throw Error(`${r} is not canonical base64url`);if(n!==void 0&&i.length!==n)throw Error(`${r} has an invalid length`);return i}function It(t){if(!t.startsWith(L))throw Error("Legacy or invalid public key. Run buddy env:rotate before creating new ciphertext.");let r=z({key:_(t.slice(L.length),"public key"),format:"der",type:"spki"});if(r.asymmetricKeyType!=="x25519")throw Error("Public key is not X25519");return r}function D(t){if(typeof t!=="string")return!1;try{let r=It(t);return t===`${L}${G(r.export({format:"der",type:"spki"}))}`}catch{return!1}}function ge(t){if(!t.startsWith(de))throw Error("Private key is not a version 2 X25519 key");let r=gt({key:_(t.slice(de.length),"private key"),format:"der",type:"pkcs8"});if(r.asymmetricKeyType!=="x25519")throw Error("Private key is not X25519");return r}function F(t,r){if(!D(t)||typeof r!=="string")return!1;try{let n=z(ge(r));return t===`${L}${G(n.export({format:"der",type:"spki"}))}`}catch{return!1}}function $t(t){return Buffer.from(`stacks-env:v2;${t.epk};${t.salt};${t.nonce}`,"utf8")}function Tt(t){let r=_(t.slice(le.length),"envelope").toString("utf8"),n=JSON.parse(r);if(!n||typeof n!=="object"||Array.isArray(n))throw Error("envelope is not an object");let i=Object.keys(n).sort(),o=["ciphertext","epk","nonce","salt","tag","v"];if(i.length!==o.length||i.some((s,c)=>s!==o[c]))throw Error("envelope fields are invalid");if(n.v!==2)throw Error("envelope version is unsupported");for(let s of["epk","salt","nonce","ciphertext","tag"])if(typeof n[s]!=="string")throw Error(`${s} is invalid`);return n}function Ot(t,r){try{let n=Tt(t),i=ge(r),o=z({key:_(n.epk,"ephemeral public key"),format:"der",type:"spki"});if(o.asymmetricKeyType!=="x25519")throw Error("ephemeral key is not X25519");let s=_(n.salt,"salt",16),c=_(n.nonce,"nonce",12),d=_(n.ciphertext,"ciphertext"),u=_(n.tag,"tag",16),l=Et({privateKey:i,publicKey:o}),p=Buffer.from(Nt("sha256",l,s,At,32));try{let f=fe("aes-256-gcm",p,c);return f.setAAD($t(n)),f.setAuthTag(u),Buffer.concat([f.update(d),f.final()]).toString("utf8")}finally{l.fill(0),p.fill(0)}}catch{throw Error(ye)}}function Rt(t,r){try{if(!/^[0-9a-f]{64}$/.test(r))throw Error("invalid legacy private key");let n=Buffer.from(t.slice(me.length),"base64");if(n.length<32)throw Error("invalid legacy payload");let i=U("sha256").update(Buffer.from(r,"hex")).digest(),o=U("sha256").update(i).digest();return St(n.subarray(32).toString("hex"),o,n.subarray(0,16).toString("hex"),n.subarray(16,32).toString("hex"))}catch{throw Error(ye)}}function q(t,r){if(!t.startsWith(me))return t;return t.startsWith(le)?Ot(t,r):Rt(t,r)}import{spawnSync as Dt}from"node:child_process";import{readFileSync as Kt}from"node:fs";import{arch as Vt,hostname as Lt,platform as Ee,release as Ft,userInfo as Bt}from"node:os";import{basename as Yt,dirname as Wt,resolve as jt}from"node:path";function B(t){return typeof t==="string"&&(t.startsWith("encrypted:")||t.startsWith("enc:"))}function he(t,r=Object.keys(t)){let n=r.map((i)=>t[i]).filter((i)=>B(i));return Object.fromEntries(Object.entries(t).filter(([,i])=>i===void 0||!n.some((o)=>i.includes(o))))}function K(t,r={}){let n={},i=[],o=[],s=t.split(`
+${s.stderr}`);if(s.exitCode===0||!c||o===4){e(i,s);return}await pt(1000*2**o)}}async function bt(t,r,n=a){if(!C(t)||!/\.(dmg|pkg|zip)$/i.test(t))throw Error("Notarization requires an existing DMG, PKG or ZIP");let i=re(R(se(),"pantry-notary-"));try{let o;if("keychainProfile"in r)o=["--keychain-profile",r.keychainProfile];else if("apiKeyId"in r){let d=R(i,"AuthKey.p8");oe(d,r.privateKey,{mode:384}),o=["--key",d,"--key-id",r.apiKeyId,"--issuer",r.issuerId]}else o=["--apple-id",r.appleId,"--password",r.password,"--team-id",r.teamId];let s=e("Apple notarization",await n("xcrun",["notarytool","submit",t,...o,"--wait","--timeout","30m","--output-format","json"])),c=JSON.parse(s.stdout);if(!c.id||c.status!=="Accepted")throw Error(`Apple did not accept notarization: ${c.status??"unknown status"} (${c.id??"no submission ID"})`);if(!t.toLowerCase().endsWith(".zip"))await ee("staple",t,n),await ee("validate",t,n);return{schemaVersion:1,file:at(t),submissionId:c.id,status:c.status,sha256:st("sha256").update(ie(t)).digest("hex"),completedAt:new Date().toISOString()}}finally{ne(i,{recursive:!0,force:!0})}}async function kt(t,r,n,i=a){if(!t.endsWith(".app")||!C(t)||!r.endsWith(".pkg")||!n)throw Error("App Store packaging requires an app, .pkg output and installer identity");if(C(r))throw Error(`Refusing to overwrite an existing package: ${r}`);if(!C(R(t,"Contents/embedded.provisionprofile")))throw Error("App Store app is missing its provisioning profile");e("App signature",await i("codesign",["--verify","--deep","--strict",t]));let o=e("Read signed entitlements",await i("codesign",["-d","--entitlements",":-",t])),s=re(R(se(),"pantry-app-store-package-"));try{let c=R(s,"entitlements.plist");if(oe(c,o.stdout||o.stderr),JSON.parse(e("App sandbox entitlement",await i("plutil",["-convert","json","-o","-",c])).stdout)["com.apple.security.app-sandbox"]!==!0)throw Error("App Store app sandbox must be enabled");if(e("Create signed App Store package",await i("productbuild",["--component",t,"/Applications","--sign",n,r],{cwd:ct(r)})),e("Installer signature",await i("pkgutil",["--check-signature",r])),!C(r))throw Error("productbuild did not produce the requested package");return r}finally{ne(s,{recursive:!0,force:!0})}}import ut from"node:process";import{existsSync as ce,mkdtempSync as lt,renameSync as mt,rmSync as pe,writeFileSync as gt}from"node:fs";import{tmpdir as Et}from"node:os";import{join as ue}from"node:path";async function xt(t,r=ut.env,n=a){if(!t.endsWith(".aab")||!ce(t))throw Error("Android signing requires an existing .aab");let i=[r.ANDROID_KEYSTORE_BASE64,r.ANDROID_KEYSTORE_PASSWORD,r.ANDROID_KEY_ALIAS,r.ANDROID_KEY_PASSWORD];if(i.some(Boolean)&&!i.every(Boolean))throw Error("Android signing requires a keystore, alias, store password and key password");let o=lt(ue(Et(),"pantry-android-signing-")),s=`${t}.pantry-signed.aab`,c=async(d)=>{let u=e("Android bundle signature",await n("jarsigner",["-J-Duser.language=en","-J-Duser.country=US","-verify",d]));if(!/jar verified\./i.test(u.stdout)||/jar is unsigned/i.test(`${u.stdout}${u.stderr}`))throw Error("Android bundle is not signed")};try{if(i.every(Boolean)){if(ce(s))throw Error("A previous Android signing artifact still exists");let d=ue(o,"release.keystore");gt(d,Buffer.from(r.ANDROID_KEYSTORE_BASE64,"base64"),{mode:384}),e("Android bundle signing",await n("jarsigner",["-J-Duser.language=en","-J-Duser.country=US","-keystore",d,"-storepass:env","PANTRY_ANDROID_STORE_PASSWORD","-keypass:env","PANTRY_ANDROID_KEY_PASSWORD","-signedjar",s,t,r.ANDROID_KEY_ALIAS],{env:{...r,PANTRY_ANDROID_STORE_PASSWORD:r.ANDROID_KEYSTORE_PASSWORD,PANTRY_ANDROID_KEY_PASSWORD:r.ANDROID_KEY_PASSWORD}})),await c(s),mt(s,t)}else await c(t)}finally{pe(s,{force:!0}),pe(o,{recursive:!0,force:!0})}}import{existsSync as rr,readFileSync as ir}from"node:fs";import{join as nr}from"node:path";import{chmodSync as ai,existsSync as Ne,readFileSync as Ae,renameSync as ci,rmSync as pi,writeFileSync as ui}from"node:fs";import{basename as fi,dirname as li,resolve as _e}from"node:path";import{createCipheriv as Ur,createDecipheriv as fe,createHash as z,createPrivateKey as Nt,createPublicKey as G,diffieHellman as At,generateKeyPairSync as zr,hkdfSync as _t,randomBytes as Gr}from"node:crypto";var L="x25519-public:",de="x25519-private:",le="encrypted:v2:",me="encrypted:",St=Buffer.from("stacks-env:v2","utf8"),ye="Environment decryption failed: authentication or format error";function It(t){if(t.length===32)return t;return z("sha256").update(t).digest()}function $t(t,r,n,i){try{let o=fe("aes-256-gcm",It(r),Buffer.from(n,"hex"));return o.setAuthTag(Buffer.from(i,"hex")),Buffer.concat([o.update(Buffer.from(t,"hex")),o.final()]).toString("utf8")}catch{throw Error("Decryption failed: authentication or format error")}}function q(t){return t.toString("base64url")}function S(t,r,n){if(typeof t!=="string"||t.length>0&&!/^[A-Za-z0-9_-]+$/.test(t))throw Error(`${r} is not canonical base64url`);let i=Buffer.from(t,"base64url");if(q(i)!==t)throw Error(`${r} is not canonical base64url`);if(n!==void 0&&i.length!==n)throw Error(`${r} has an invalid length`);return i}function Tt(t){if(!t.startsWith(L))throw Error("Legacy or invalid public key. Run buddy env:rotate before creating new ciphertext.");let r=G({key:S(t.slice(L.length),"public key"),format:"der",type:"spki"});if(r.asymmetricKeyType!=="x25519")throw Error("Public key is not X25519");return r}function D(t){if(typeof t!=="string")return!1;try{let r=Tt(t);return t===`${L}${q(r.export({format:"der",type:"spki"}))}`}catch{return!1}}function ge(t){if(!t.startsWith(de))throw Error("Private key is not a version 2 X25519 key");let r=Nt({key:S(t.slice(de.length),"private key"),format:"der",type:"pkcs8"});if(r.asymmetricKeyType!=="x25519")throw Error("Private key is not X25519");return r}function F(t,r){if(!D(t)||typeof r!=="string")return!1;try{let n=G(ge(r));return t===`${L}${q(n.export({format:"der",type:"spki"}))}`}catch{return!1}}function Ot(t){return Buffer.from(`stacks-env:v2;${t.epk};${t.salt};${t.nonce}`,"utf8")}function Rt(t){let r=S(t.slice(le.length),"envelope").toString("utf8"),n=JSON.parse(r);if(!n||typeof n!=="object"||Array.isArray(n))throw Error("envelope is not an object");let i=Object.keys(n).sort(),o=["ciphertext","epk","nonce","salt","tag","v"];if(i.length!==o.length||i.some((s,c)=>s!==o[c]))throw Error("envelope fields are invalid");if(n.v!==2)throw Error("envelope version is unsupported");for(let s of["epk","salt","nonce","ciphertext","tag"])if(typeof n[s]!=="string")throw Error(`${s} is invalid`);return n}function Dt(t,r){try{let n=Rt(t),i=ge(r),o=G({key:S(n.epk,"ephemeral public key"),format:"der",type:"spki"});if(o.asymmetricKeyType!=="x25519")throw Error("ephemeral key is not X25519");let s=S(n.salt,"salt",16),c=S(n.nonce,"nonce",12),d=S(n.ciphertext,"ciphertext"),u=S(n.tag,"tag",16),l=At({privateKey:i,publicKey:o}),p=Buffer.from(_t("sha256",l,s,St,32));try{let f=fe("aes-256-gcm",p,c);return f.setAAD(Ot(n)),f.setAuthTag(u),Buffer.concat([f.update(d),f.final()]).toString("utf8")}finally{l.fill(0),p.fill(0)}}catch{throw Error(ye)}}function Kt(t,r){try{if(!/^[0-9a-f]{64}$/.test(r))throw Error("invalid legacy private key");let n=Buffer.from(t.slice(me.length),"base64");if(n.length<32)throw Error("invalid legacy payload");let i=z("sha256").update(Buffer.from(r,"hex")).digest(),o=z("sha256").update(i).digest();return $t(n.subarray(32).toString("hex"),o,n.subarray(0,16).toString("hex"),n.subarray(16,32).toString("hex"))}catch{throw Error(ye)}}function M(t,r){if(!t.startsWith(me))return t;return t.startsWith(le)?Dt(t,r):Kt(t,r)}import{spawnSync as Vt}from"node:child_process";import{readFileSync as Lt}from"node:fs";import{arch as Ft,hostname as Bt,platform as Ee,release as Yt,userInfo as Wt}from"node:os";import{basename as jt,dirname as Ut,resolve as zt}from"node:path";function B(t){return typeof t==="string"&&(t.startsWith("encrypted:")||t.startsWith("enc:"))}function he(t,r=Object.keys(t)){let n=r.map((i)=>t[i]).filter((i)=>B(i));return Object.fromEntries(Object.entries(t).filter(([,i])=>i===void 0||!n.some((o)=>i.includes(o))))}function K(t,r={}){let n={},i=[],o=[],s=t.split(`
 `),c=he(r.processEnv||process.env);for(let d of s){let u=d.trim();if(!u||u.startsWith("#"))continue;if(u.startsWith("DOTENV_PUBLIC_KEY=")){let y=u.match(/^DOTENV_PUBLIC_KEY=["']?([^"'\n]+)["']?/);if(y&&y[1]!==void 0)n.DOTENV_PUBLIC_KEY=y[1];continue}let l=u.match(/^([^=]+)=(.*)$/);if(!l||l[1]===void 0||l[2]===void 0)continue;let p=l[1].trim(),f=l[2].trim();if(f.startsWith('"')&&f.endsWith('"')||f.startsWith("'")&&f.endsWith("'")){if(f=f.slice(1,-1),f.includes("\\n"))f=f.replace(/\\n/g,`
-`)}if(f.startsWith("encrypted:")||f.startsWith("enc:")){if(!r.privateKey){o.push(p);continue}try{let y=f.startsWith("enc:")?`encrypted:${f.slice(4)}`:f;f=q(y,r.privateKey)}catch(y){i.push(`Failed to decrypt ${p}: ${y instanceof Error?y.message:"Unknown error"}`),o.push(p);continue}}f=Ut(f,{...c,...n}),f=Mt(f),n[p]=f}return{parsed:n,errors:i,skippedEncrypted:o}}function Ut(t,r){return t.replace(/\$\{([^}]+)\}/g,(n,i)=>{let o=i.match(/^([^:\-+]+)(:-|-)(.+)$/);if(o){let[,c,d,u]=o,l=r[c];if(d===":-")return l||u;else return l!==void 0?l:u}let s=i.match(/^([^:\-+]+)(:?\+)(.+)$/);if(s){let[,c,d,u]=s,l=r[c];if(d===":+")return l?u:"";else return l!==void 0?u:""}return r[i]||""})}var zt=new Set(["date","hostname","whoami","uname","pwd","echo","printf","cat","basename","dirname"]);function Gt(t){let r=[],n="",i=null,o=!1;for(let s of t.trim()){if(o){n+=s,o=!1;continue}if(s==="\\"&&i!=="'"){o=!0;continue}if(i){if(s===i)i=null;else n+=s;continue}if(s==='"'||s==="'"){i=s;continue}if(/\s/.test(s)){if(n)r.push(n),n="";continue}n+=s}if(o||i)throw Error("Command substitution contains an unterminated escape or quote");if(n)r.push(n);return r}function qt(t){let[r,...n]=t,i=n.some((o)=>o.startsWith("-"));if(r==="echo"&&!i)return n.join(" ");if(r==="printf"&&n.length===1&&!n[0]?.includes("%"))return n[0];if(r==="hostname"&&n.length===0)return Lt();if(r==="whoami"&&n.length===0)return Bt().username;if(r==="pwd"&&n.length===0)return process.cwd();if(r==="basename"&&n.length===1)return Yt(n[0]??"");if(r==="dirname"&&n.length===1)return Wt(n[0]??"");if(r==="cat"&&n.length>0&&!i)return n.map((o)=>Kt(jt(process.cwd(),o),"utf8")).join("");if(r==="uname"){let o=n[0]??"-s";if(n.length<=1&&o==="-m")return Vt();if(n.length<=1&&o==="-r")return Ft();if(n.length<=1&&o==="-s")return{aix:"AIX",android:"Android",cygwin:"CYGWIN",darwin:"Darwin",freebsd:"FreeBSD",haiku:"Haiku",linux:"Linux",netbsd:"NetBSD",openbsd:"OpenBSD",sunos:"SunOS",win32:"Windows_NT"}[Ee()]??Ee()}return}function Mt(t){return t.replace(/\$\(([^)]+)\)/g,(r,n)=>{try{let i=Gt(n),o=i[0];if(!o||!zt.has(o))return console.warn(`[env] Blocked command substitution for disallowed command: ${o}`),"";let s=qt(i);if(s!==void 0)return s.trim();let c=Dt(o,i.slice(1),{encoding:"utf8",env:process.env});if(c.status===0)return c.stdout.trim();let d=c.stderr.trim();console.warn(`[env] Command substitution failed (exit code ${c.status??"unknown"}): ${o}${d?`: ${d}`:""}`)}catch(i){console.warn(`[env] Command substitution error: ${i instanceof Error?i.message:String(i)}`)}return""})}function Se(t){let r=((t||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase();return{publicKeyName:r?`DOTENV_PUBLIC_KEY_${r}`:"DOTENV_PUBLIC_KEY",privateKeyName:r?`DOTENV_PRIVATE_KEY_${r}`:"DOTENV_PRIVATE_KEY"}}function Jt(t){let{publicKeyName:r}=Se(t);return r==="DOTENV_PUBLIC_KEY"?[r]:[r,"DOTENV_PUBLIC_KEY"]}function Ie(t){let{privateKeyName:r}=Se(t);return r==="DOTENV_PRIVATE_KEY"?[r]:[r,"DOTENV_PRIVATE_KEY"]}function M(t={}){let r=_e(t.cwd||process.cwd(),t.keysFile||".env.keys"),n=Ne(r)?K(Ae(r,"utf8")).parsed:{};for(let i of Ie(t.file)){let o=n[i]||process.env[i];if(o)return o}return}function Ht(t,r,n,i){let o=i.file||".env",s=i.keysFile||".env.keys",[c]=Ie(i.file),d=`${t.length===1?"Value":"Values"} that cannot be decrypted: ${t.join(", ")}.`;if(!n)return[`Cannot read ${o}: no private key for it.`,`  Expected ${c} in ${s} or the environment, and found neither.`,`  ${d}`].join(`
-`);let u=Jt(i.file).find((f)=>r[f]),l=u?r[u]:void 0,p=l&&!F(l,n)?`  The private key found for it does not match ${u} in the file, so it belongs to a different key pair.`:"  The private key found for it did not decrypt them. It may belong to a different key pair, or the values may be damaged.";return[`Cannot read ${o}: its private key does not decrypt it.`,p,`  ${d}`].join(`
-`)}function $e(t,r={}){let n=r.cwd||process.cwd(),i=_e(n,r.file||".env");if(!Ne(i))return{success:!1,error:`File not found: ${i}`};try{let o=M(r),s=Ae(i,"utf-8"),{parsed:c,skippedEncrypted:d}=K(s,{privateKey:o}),u=t&&!r.all?d.filter((f)=>f===t):d;if(u.length>0)return{success:!1,error:Ht(u,c,o,r)};if(t&&!r.all){let f=c[t];if(f===void 0)return{success:!1,error:`Key not found: ${t}`};return{success:!0,output:f}}let l=c,p;switch(r.format){case"shell":p=Object.entries(l).map(([f,y])=>`${f}=${y}`).join(" ");break;case"eval":p=Object.entries(l).map(([f,y])=>`${f}="${y}"`).join(`
-`);break;case"json":default:p=r.prettyPrint?JSON.stringify(l,null,2):JSON.stringify(l);break}return{success:!0,output:p}}catch(o){return{success:!1,error:`Failed to get: ${o instanceof Error?o.message:"Unknown error"}`}}}var Xt=/(?:^|_)(?:PASSWORD|PASSWD|SECRET|TOKEN|APIKEY|API_KEY|CREDENTIAL|CREDENTIALS|PRIVATE|SALT|DSN|CERT|CIPHER|SIGNATURE|WEBHOOK)(?:_|$)|(?:^|_)(?:ACCESS|SECRET)_KEY(?:_|$)|_KEY$/,Zt=/^DOTENV_(?:PUBLIC|PRIVATE)_KEY/,Qt=/^\$\{[^}]+\}$/;function Te(t,r={}){let{placeholders:n={},strict:i=!1}=r,o=[];for(let[s,c]of Object.entries(t)){if(i&&s.startsWith("DOTENV_PUBLIC_KEY")){if(!D(c))o.push({key:s,reason:"invalid-public-key"});continue}if(i&&s.startsWith("DOTENV_PRIVATE_KEY")){if(c.trim())o.push({key:s,reason:"private-key-material"});continue}if(!c||c.trim()==="")continue;if(B(c))continue;if(Zt.test(s))continue;if(Qt.test(c.trim()))continue;let d=Xt.test(s),u=Object.prototype.hasOwnProperty.call(n,s)&&n[s]===c;if(d&&!u){o.push({key:s,reason:"plaintext-secret"});continue}if(i)o.push({key:s,reason:"plaintext-value"})}return o}function ve(t,r){if(!/^[a-z][a-z0-9-]*$/.test(r))throw Error("Invalid native release environment name");let n=rr(t,`.env.${r}`);if(!er(n))throw Error(`Native release environment is missing: .env.${r}`);let{parsed:i,skippedEncrypted:o}=K(tr(n,"utf8"),{processEnv:{}});if([...Object.keys(i),...o].some((d)=>d.startsWith("DOTENV_PRIVATE_KEY")))throw Error("Private decryption keys must never be committed in environment files");let s=Te(i,{strict:!0});if(s.length)throw Error(`Native release environment must be Buddy-encrypted: ${s.map((d)=>d.key).join(", ")}`);let c=i[`DOTENV_PUBLIC_KEY_${r.toUpperCase()}`]||i.DOTENV_PUBLIC_KEY;if(!D(c))throw Error("Native release environment requires valid Buddy public-key metadata")}function vt(t,r,n=()=>{}){ve(t,r);let i=`.env.${r}`,o=$e(void 0,{cwd:t,file:i,all:!0,format:"json"});if(!o.success||!o.output)throw Error(o.error||`Could not read ${i}`);let s=JSON.parse(o.output),c=s[`DOTENV_PUBLIC_KEY_${r.toUpperCase()}`]||s.DOTENV_PUBLIC_KEY;if(!F(c,M({cwd:t,file:i})))throw Error("Native release environment key does not match its public metadata");for(let[d,u]of Object.entries(s)){if(d.startsWith("DOTENV_PRIVATE_KEY")&&u)throw Error("Private decryption keys must never be committed in environment files");if(!d.startsWith("DOTENV_PUBLIC_KEY")&&u)n(u)}return Object.fromEntries(Object.entries(s).filter(([d])=>!d.startsWith("DOTENV_")))}import ir from"node:process";import{existsSync as J,lstatSync as nr,readdirSync as or,readFileSync as Be,rmSync as Le,writeFileSync as sr}from"node:fs";import{basename as ar,dirname as Fe,join as A}from"node:path";import*as De from"node:crypto";import*as S from"node:fs";import*as Ke from"node:os";import*as C from"node:path";function Pt(t){return[...t.matchAll(/^\s*\d+\)\s+[0-9A-F]+\s+"([^"]+)"/gim)].map((r)=>r[1])}function Oe(t,r){let n=new Set([...t.matchAll(/^\s*\d+\)\s+([0-9A-F]{40})\s+"([^"]+)"/gim)].filter((i)=>i[2]===r).map((i)=>i[1].toUpperCase()));if(n.size!==1)throw Error(`Imported signing identity requires a unique certificate fingerprint: ${r}`);return[...n][0]}function Pe(t,r){let n=r==="application"?["3rd Party Mac Developer Application","Apple Distribution","Developer ID Application"]:["3rd Party Mac Developer Installer","Developer ID Installer"];for(let i of n){let o=t.find((s)=>s.startsWith(i));if(o)return o}return}async function Ve(t,r){return a(t,r)}function N(t,r){if(r.exitCode===0)return;let n=`${r.stdout}
-${r.stderr}`.trim();throw Error(`${t} failed${n?`: ${n}`:` with exit code ${r.exitCode}`}`)}function Re(t,r,n){let i=C.join(t,r);return S.writeFileSync(i,Buffer.from(n.trim(),"base64"),{mode:384}),i}async function ae(t,r={}){if((r.platform||process.platform)!=="darwin")throw Error("Apple code signing requires a macOS runner");if(!t.applicationCertificate)throw Error("Apple code signing requires an application certificate");if(!t.certificatePassword)throw Error("Apple code signing requires the password protecting the .p12 certificates");let i=r.runCommand||Ve,o=S.mkdtempSync(C.join(r.tempDirectory||Ke.tmpdir(),"pantry-signing-")),s=De.randomBytes(24).toString("base64"),c=C.join(o,"pantry-signing.keychain-db");try{N("Keychain creation",await i("security",["create-keychain","-p",s,c])),N("Keychain configuration",await i("security",["set-keychain-settings","-lut","21600",c])),N("Keychain unlock",await i("security",["unlock-keychain","-p",s,c]));let d=[{name:"application.p12",content:t.applicationCertificate},...t.installerCertificate?[{name:"installer.p12",content:t.installerCertificate}]:[]];for(let I of d){let T=Re(o,I.name,I.content);N(`Import of ${I.name}`,await i("security",["import",T,"-k",c,"-P",t.certificatePassword,"-T","/usr/bin/codesign","-T","/usr/bin/productbuild","-f","pkcs12","-A"])),S.rmSync(T,{force:!0})}N("Keychain partition list",await i("security",["set-key-partition-list","-S","apple-tool:,apple:,codesign:","-s","-k",s,c]));let u=await i("security",["list-keychains","-d","user"]);N("Keychain search list",u);let l=[...u.stdout.matchAll(/"([^"]+)"/g)].map((I)=>I[1]);N("Keychain search list update",await i("security",["list-keychains","-d","user","-s",c,...l]));let p=await i("security",["find-identity","-v",c]);N("Identity lookup",p);let f=Pt(p.stdout),y=Pe(f,"application");if(!y)throw Error(`No application signing identity found in the imported certificates (found: ${f.join(", ")||"none"})`);let m=Pe(f,"installer");if(t.installerCertificate&&!m)throw Error(`No installer signing identity found in the imported certificates (found: ${f.join(", ")})`);let E=t.provisioningProfile?Re(t.outputDirectory||o,"embedded.provisionprofile",t.provisioningProfile):void 0;return{keychainPath:c,applicationIdentity:y,applicationFingerprint:Oe(p.stdout,y),...m?{installerIdentity:m,installerFingerprint:Oe(p.stdout,m)}:{},...E?{provisioningProfilePath:E}:{}}}catch(d){try{await i("security",["delete-keychain",c])}catch(u){throw AggregateError([d,u],"Apple signing failed and its temporary keychain could not be removed")}finally{S.rmSync(o,{recursive:!0,force:!0})}throw d}}async function we(t,r={}){let n=r.runCommand||Ve;try{N("Keychain removal",await n("security",["delete-keychain",t]))}finally{S.rmSync(C.dirname(t),{recursive:!0,force:!0})}}function wt(t){let r=nr(t);if(r.isSymbolicLink())throw Error(`Native app must not contain symbolic links: ${t}`);return r.isDirectory()?or(t).reduce((n,i)=>n+wt(A(t,i)),0):r.size}async function Ct(t,r,n=a){let i=t.appPath??t.path;if(!i.endsWith(".app")||!J(i))throw Error("Native build must produce a macOS application bundle");let o=A(i,"Contents/Info.plist"),s=A(i,"Contents/MacOS",t.name);for(let p of[o,s,A(i,"Contents/Resources/index.html"),A(i,"Contents/Resources/craft.json")])if(!J(p))throw Error(`Native app is incomplete: ${p}`);let c=Be(s).subarray(0,4).toString("hex");if(!["cffaedfe","cefaedfe","cafebabe","bebafeca","cafebabf","bfbafeca"].includes(c))throw Error("Native app executable must be Mach-O");let d=wt(i);if(r!==void 0&&d>=r)throw Error(`Native bundle is ${d} bytes; it must be below ${r}`);let u=JSON.parse(e("Read bundle metadata",await n("plutil",["-convert","json","-o","-",o])).stdout);if(u.CFBundleIdentifier!==t.bundleId||u.CFBundleShortVersionString!==t.version||String(u.CFBundleVersion)!==t.buildNumber)throw Error("Built app identity/version does not match the release manifest");let l=e("Native launch check",await n(s,["--benchmark"]));if(!`${l.stdout}${l.stderr}`.includes("ready"))throw Error("Native app did not report ready")}async function Ce(t,r,n={}){let i=te(t,!0),o=n.command??a,s={...n.env??ir.env};if(i.environment){if(ve(t,i.environment),r==="release"){let p=vt(t,i.environment,n.onSecret);Object.assign(s,p,{APP_ENV:i.environment,NODE_ENV:i.environment,DOTENV_ENV:i.environment}),n.onEnvironment?.(p)}}let c=JSON.parse(Be(A(t,"package.json"),"utf8"));if(!c.version||!/^\d+\.\d+\.\d+(?:-[\w.-]+)?$/.test(c.version))throw Error("A native release requires a semantic package version");if(s.PANTRY_BUILD_NUMBER=s.PANTRY_BUILD_NUMBER||s.GITHUB_RUN_NUMBER||c.version,r==="release"&&s.GITHUB_REF_TYPE==="tag"&&s.GITHUB_REF_NAME!==`v${c.version}`)throw Error("Release tag must match package.json version");if(r==="release"&&s.CRAFT_BIN)throw Error("Release builds must use the configured immutable runtime; CRAFT_BIN is a development override");let d=r==="release"&&i.macos?.notarize?ft(s):void 0;if(r==="release"&&i.android&&!s.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON)throw Error("Google Play publishing requires GOOGLE_PLAY_SERVICE_ACCOUNT_JSON");if(r==="release"&&i.macos?.appStore&&(!s.APPLE_APP_STORE_APPLICATION_CERTIFICATE||!s.APPLE_APP_STORE_INSTALLER_CERTIFICATE||!s.APPLE_APP_STORE_PROVISIONING_PROFILE_BASE64||!s.APP_STORE_CONNECT_API_KEY_ID||!s.APP_STORE_CONNECT_ISSUER_ID||!s.APP_STORE_CONNECT_PRIVATE_KEY))throw Error("App Store publishing requires distribution certificates, provisioning profile and App Store Connect credentials");if(r==="release"&&i.macos&&!(s.APPLE_SIGNING_IDENTITY||s.APPLE_APPLICATION_CERTIFICATE))throw Error("Native macOS releases require an application signing identity or certificate");let u=async(p)=>e(p[0],await o(p[0],p.slice(1),{cwd:t,env:s,inherit:!0})),l=[];try{if(r==="release"&&i.macos&&s.APPLE_APPLICATION_CERTIFICATE){let m=await ae({applicationCertificate:s.APPLE_APPLICATION_CERTIFICATE,certificatePassword:s.APPLE_CERTIFICATE_PASSWORD||"",provisioningProfile:s.APPLE_PROVISIONING_PROFILE_BASE64});if(l.push(m.keychainPath),s.APPLE_SIGNING_IDENTITY=m.applicationFingerprint,m.provisioningProfilePath)s.APPLE_PROVISIONING_PROFILE_PATH=m.provisioningProfilePath}await u(["bun","install","--frozen-lockfile"]);for(let m of i.checks?.before??[])await u(m);if(Le(A(t,".pantry/native/artifact.json"),{force:!0}),await u(i.build??["bun","run","package"]),r==="release"&&i.android)await xt(g(t,i.android.bundle),s,o);let p=i.macos?ke(t):void 0;if(p){if(p.version!==c.version)throw Error("Native artifact belongs to a different package version");await Ct(p,i.macos?.maxBundleSize,o)}for(let m of i.checks?.after??[])await u(m);let f=p?[p.path]:i.android?[g(t,i.android.bundle)]:[];if(!f.length||f.some((m)=>!J(m)))throw Error("Native pipeline produced no release files");if(p&&r==="release"){e("Release signature",await o("codesign",["--verify","--deep","--strict",p.appPath??p.path]));let m=e("Release identity",await o("codesign",["-dv","--verbose=4",p.appPath??p.path]));if(!`${m.stdout}${m.stderr}`.includes("Authority=Developer ID Application:"))throw Error("Direct macOS releases require a Developer ID signature");if(p.path.toLowerCase().endsWith(".dmg"))await yt(p.path,s.APPLE_SIGNING_IDENTITY,o)}if(d){let m=await bt(f[0],d,o);if(p?.appPath)await xe(p.appPath,o);if(!f[0].toLowerCase().endsWith(".zip"))await xe(f[0],o);let E=A(Fe(f[0]),"notarization-receipt.json");sr(E,`${JSON.stringify(m,null,2)}
-`),f.push(E)}let y;if(r==="release"&&i.macos?.appStore){let m=await ae({applicationCertificate:s.APPLE_APP_STORE_APPLICATION_CERTIFICATE,installerCertificate:s.APPLE_APP_STORE_INSTALLER_CERTIFICATE,certificatePassword:s.APPLE_CERTIFICATE_PASSWORD||"",provisioningProfile:s.APPLE_APP_STORE_PROVISIONING_PROFILE_BASE64});l.push(m.keychainPath),s.PANTRY_DISTRIBUTION="app-store",s.APPLE_SIGNING_IDENTITY=m.applicationFingerprint,s.APPLE_PROVISIONING_PROFILE_PATH=m.provisioningProfilePath,Le(g(t,".pantry/native/app-store"),{recursive:!0,force:!0}),await u(["bun","run","build"]);let E=ke(t);await Ct(E,i.macos.maxBundleSize,o),y=A(Fe(f[0]),`${ar(E.appPath??E.path,".app")}-${c.version}.pkg`),await kt(E.appPath??E.path,y,m.installerFingerprint,o),f.push(y)}return{config:i,version:c.version,files:f,...p?{artifact:p}:{},...y?{appStorePackage:y}:{}}}finally{for(let p of l.reverse())await we(p)}}
-export{Ra,be,g,te,a,e,dt,aa,oa,ht,sa,Oa,qa,ke,ft,yt,xe,bt,kt,xt,ve,vt,Pt,Pe,ae,we,wt,Ct,Ce};
+`)}if(f.startsWith("encrypted:")||f.startsWith("enc:")){if(!r.privateKey){o.push(p);continue}try{let y=f.startsWith("enc:")?`encrypted:${f.slice(4)}`:f;f=M(y,r.privateKey)}catch(y){i.push(`Failed to decrypt ${p}: ${y instanceof Error?y.message:"Unknown error"}`),o.push(p);continue}}f=Gt(f,{...c,...n}),f=Ht(f),n[p]=f}return{parsed:n,errors:i,skippedEncrypted:o}}function Gt(t,r){return t.replace(/\$\{([^}]+)\}/g,(n,i)=>{let o=i.match(/^([^:\-+]+)(:-|-)(.+)$/);if(o){let[,c,d,u]=o,l=r[c];if(d===":-")return l||u;else return l!==void 0?l:u}let s=i.match(/^([^:\-+]+)(:?\+)(.+)$/);if(s){let[,c,d,u]=s,l=r[c];if(d===":+")return l?u:"";else return l!==void 0?u:""}return r[i]||""})}var qt=new Set(["date","hostname","whoami","uname","pwd","echo","printf","cat","basename","dirname"]);function Mt(t){let r=[],n="",i=null,o=!1;for(let s of t.trim()){if(o){n+=s,o=!1;continue}if(s==="\\"&&i!=="'"){o=!0;continue}if(i){if(s===i)i=null;else n+=s;continue}if(s==='"'||s==="'"){i=s;continue}if(/\s/.test(s)){if(n)r.push(n),n="";continue}n+=s}if(o||i)throw Error("Command substitution contains an unterminated escape or quote");if(n)r.push(n);return r}function Jt(t){let[r,...n]=t,i=n.some((o)=>o.startsWith("-"));if(r==="echo"&&!i)return n.join(" ");if(r==="printf"&&n.length===1&&!n[0]?.includes("%"))return n[0];if(r==="hostname"&&n.length===0)return Bt();if(r==="whoami"&&n.length===0)return Wt().username;if(r==="pwd"&&n.length===0)return process.cwd();if(r==="basename"&&n.length===1)return jt(n[0]??"");if(r==="dirname"&&n.length===1)return Ut(n[0]??"");if(r==="cat"&&n.length>0&&!i)return n.map((o)=>Lt(zt(process.cwd(),o),"utf8")).join("");if(r==="uname"){let o=n[0]??"-s";if(n.length<=1&&o==="-m")return Ft();if(n.length<=1&&o==="-r")return Yt();if(n.length<=1&&o==="-s")return{aix:"AIX",android:"Android",cygwin:"CYGWIN",darwin:"Darwin",freebsd:"FreeBSD",haiku:"Haiku",linux:"Linux",netbsd:"NetBSD",openbsd:"OpenBSD",sunos:"SunOS",win32:"Windows_NT"}[Ee()]??Ee()}return}function Ht(t){return t.replace(/\$\(([^)]+)\)/g,(r,n)=>{try{let i=Mt(n),o=i[0];if(!o||!qt.has(o))return console.warn(`[env] Blocked command substitution for disallowed command: ${o}`),"";let s=Jt(i);if(s!==void 0)return s.trim();let c=Vt(o,i.slice(1),{encoding:"utf8",env:process.env});if(c.status===0)return c.stdout.trim();let d=c.stderr.trim();console.warn(`[env] Command substitution failed (exit code ${c.status??"unknown"}): ${o}${d?`: ${d}`:""}`)}catch(i){console.warn(`[env] Command substitution error: ${i instanceof Error?i.message:String(i)}`)}return""})}function Se(t){let r=((t||".env").split("/").pop()||"").replace(/^\.env\./,"").replace(/^\.env$/,"").toUpperCase();return{publicKeyName:r?`DOTENV_PUBLIC_KEY_${r}`:"DOTENV_PUBLIC_KEY",privateKeyName:r?`DOTENV_PRIVATE_KEY_${r}`:"DOTENV_PRIVATE_KEY"}}function Xt(t){let{publicKeyName:r}=Se(t);return r==="DOTENV_PUBLIC_KEY"?[r]:[r,"DOTENV_PUBLIC_KEY"]}function Ie(t){let{privateKeyName:r}=Se(t);return r==="DOTENV_PRIVATE_KEY"?[r]:[r,"DOTENV_PRIVATE_KEY"]}function J(t={}){let r=_e(t.cwd||process.cwd(),t.keysFile||".env.keys"),n=Ne(r)?K(Ae(r,"utf8")).parsed:{};for(let i of Ie(t.file)){let o=n[i]||process.env[i];if(o)return o}return}function Zt(t,r,n,i){let o=i.file||".env",s=i.keysFile||".env.keys",[c]=Ie(i.file),d=`${t.length===1?"Value":"Values"} that cannot be decrypted: ${t.join(", ")}.`;if(!n)return[`Cannot read ${o}: no private key for it.`,`  Expected ${c} in ${s} or the environment, and found neither.`,`  ${d}`].join(`
+`);let u=Xt(i.file).find((f)=>r[f]),l=u?r[u]:void 0,p=l&&!F(l,n)?`  The private key found for it does not match ${u} in the file, so it belongs to a different key pair.`:"  The private key found for it did not decrypt them. It may belong to a different key pair, or the values may be damaged.";return[`Cannot read ${o}: its private key does not decrypt it.`,p,`  ${d}`].join(`
+`)}function $e(t,r={}){let n=r.cwd||process.cwd(),i=_e(n,r.file||".env");if(!Ne(i))return{success:!1,error:`File not found: ${i}`};try{let o=J(r),s=Ae(i,"utf-8"),{parsed:c,skippedEncrypted:d}=K(s,{privateKey:o}),u=t&&!r.all?d.filter((f)=>f===t):d;if(u.length>0)return{success:!1,error:Zt(u,c,o,r)};if(t&&!r.all){let f=c[t];if(f===void 0)return{success:!1,error:`Key not found: ${t}`};return{success:!0,output:f}}let l=c,p;switch(r.format){case"shell":p=Object.entries(l).map(([f,y])=>`${f}=${y}`).join(" ");break;case"eval":p=Object.entries(l).map(([f,y])=>`${f}="${y}"`).join(`
+`);break;case"json":default:p=r.prettyPrint?JSON.stringify(l,null,2):JSON.stringify(l);break}return{success:!0,output:p}}catch(o){return{success:!1,error:`Failed to get: ${o instanceof Error?o.message:"Unknown error"}`}}}var Qt=/(?:^|_)(?:PASSWORD|PASSWD|SECRET|TOKEN|APIKEY|API_KEY|CREDENTIAL|CREDENTIALS|PRIVATE|SALT|DSN|CERT|CIPHER|SIGNATURE|WEBHOOK)(?:_|$)|(?:^|_)(?:ACCESS|SECRET)_KEY(?:_|$)|_KEY$/,er=/^DOTENV_(?:PUBLIC|PRIVATE)_KEY/,tr=/^\$\{[^}]+\}$/;function Te(t,r={}){let{placeholders:n={},strict:i=!1}=r,o=[];for(let[s,c]of Object.entries(t)){if(i&&s.startsWith("DOTENV_PUBLIC_KEY")){if(!D(c))o.push({key:s,reason:"invalid-public-key"});continue}if(i&&s.startsWith("DOTENV_PRIVATE_KEY")){if(c.trim())o.push({key:s,reason:"private-key-material"});continue}if(!c||c.trim()==="")continue;if(B(c))continue;if(er.test(s))continue;if(tr.test(c.trim()))continue;let d=Qt.test(s),u=Object.prototype.hasOwnProperty.call(n,s)&&n[s]===c;if(d&&!u){o.push({key:s,reason:"plaintext-secret"});continue}if(i)o.push({key:s,reason:"plaintext-value"})}return o}function ve(t,r){if(!/^[a-z][a-z0-9-]*$/.test(r))throw Error("Invalid native release environment name");let n=nr(t,`.env.${r}`);if(!rr(n))throw Error(`Native release environment is missing: .env.${r}`);let{parsed:i,skippedEncrypted:o}=K(ir(n,"utf8"),{processEnv:{}});if([...Object.keys(i),...o].some((d)=>d.startsWith("DOTENV_PRIVATE_KEY")))throw Error("Private decryption keys must never be committed in environment files");let s=Te(i,{strict:!0});if(s.length)throw Error(`Native release environment must be Buddy-encrypted: ${s.map((d)=>d.key).join(", ")}`);let c=i[`DOTENV_PUBLIC_KEY_${r.toUpperCase()}`]||i.DOTENV_PUBLIC_KEY;if(!D(c))throw Error("Native release environment requires valid Buddy public-key metadata")}function vt(t,r,n=()=>{}){ve(t,r);let i=`.env.${r}`,o=$e(void 0,{cwd:t,file:i,all:!0,format:"json"});if(!o.success||!o.output)throw Error(o.error||`Could not read ${i}`);let s=JSON.parse(o.output),c=s[`DOTENV_PUBLIC_KEY_${r.toUpperCase()}`]||s.DOTENV_PUBLIC_KEY;if(!F(c,J({cwd:t,file:i})))throw Error("Native release environment key does not match its public metadata");for(let[d,u]of Object.entries(s)){if(d.startsWith("DOTENV_PRIVATE_KEY")&&u)throw Error("Private decryption keys must never be committed in environment files");if(!d.startsWith("DOTENV_PUBLIC_KEY")&&u)n(u)}return Object.fromEntries(Object.entries(s).filter(([d])=>!d.startsWith("DOTENV_")))}import or from"node:process";import{existsSync as H,lstatSync as sr,readdirSync as ar,readFileSync as Be,rmSync as Le,writeFileSync as cr}from"node:fs";import{basename as pr,dirname as Fe,join as P}from"node:path";import*as De from"node:crypto";import*as I from"node:fs";import*as Ke from"node:os";import*as T from"node:path";function Pt(t){return[...t.matchAll(/^\s*\d+\)\s+[0-9A-F]+\s+"([^"]+)"/gim)].map((r)=>r[1])}function Oe(t,r){let n=new Set([...t.matchAll(/^\s*\d+\)\s+([0-9A-F]{40})\s+"([^"]+)"/gim)].filter((i)=>i[2]===r).map((i)=>i[1].toUpperCase()));if(n.size!==1)throw Error(`Imported signing identity requires a unique certificate fingerprint: ${r}`);return[...n][0]}function Pe(t,r){let n=r==="application"?["3rd Party Mac Developer Application","Apple Distribution","Developer ID Application"]:["3rd Party Mac Developer Installer","Developer ID Installer"];for(let i of n){let o=t.find((s)=>s.startsWith(i));if(o)return o}return}async function Ve(t,r){return a(t,r)}function A(t,r){if(r.exitCode===0)return;let n=`${r.stdout}
+${r.stderr}`.trim();throw Error(`${t} failed${n?`: ${n}`:` with exit code ${r.exitCode}`}`)}function Re(t,r,n){let i=T.join(t,r);return I.writeFileSync(i,Buffer.from(n.trim(),"base64"),{mode:384}),i}async function ae(t,r={}){if((r.platform||process.platform)!=="darwin")throw Error("Apple code signing requires a macOS runner");if(!t.applicationCertificate)throw Error("Apple code signing requires an application certificate");if(!t.certificatePassword)throw Error("Apple code signing requires the password protecting the .p12 certificates");let i=r.runCommand||Ve,o=I.mkdtempSync(T.join(r.tempDirectory||Ke.tmpdir(),"pantry-signing-")),s=De.randomBytes(24).toString("base64"),c=T.join(o,"pantry-signing.keychain-db");try{A("Keychain creation",await i("security",["create-keychain","-p",s,c])),A("Keychain configuration",await i("security",["set-keychain-settings","-lut","21600",c])),A("Keychain unlock",await i("security",["unlock-keychain","-p",s,c]));let d=[{name:"application.p12",content:t.applicationCertificate},...t.installerCertificate?[{name:"installer.p12",content:t.installerCertificate}]:[]];for(let N of d){let O=Re(o,N.name,N.content);A(`Import of ${N.name}`,await i("security",["import",O,"-k",c,"-P",t.certificatePassword,"-T","/usr/bin/codesign","-T","/usr/bin/productbuild","-f","pkcs12","-A"])),I.rmSync(O,{force:!0})}A("Keychain partition list",await i("security",["set-key-partition-list","-S","apple-tool:,apple:,codesign:","-s","-k",s,c]));let u=await i("security",["list-keychains","-d","user"]);A("Keychain search list",u);let l=[...u.stdout.matchAll(/"([^"]+)"/g)].map((N)=>N[1]);A("Keychain search list update",await i("security",["list-keychains","-d","user","-s",c,...l]));let p=await i("security",["find-identity","-v",c]);A("Identity lookup",p);let f=Pt(p.stdout),y=Pe(f,"application");if(!y)throw Error(`No application signing identity found in the imported certificates (found: ${f.join(", ")||"none"})`);let m=Pe(f,"installer");if(t.installerCertificate&&!m)throw Error(`No installer signing identity found in the imported certificates (found: ${f.join(", ")})`);let h=t.provisioningProfile?Re(t.outputDirectory||o,"embedded.provisionprofile",t.provisioningProfile):void 0;return{keychainPath:c,applicationIdentity:y,applicationFingerprint:Oe(p.stdout,y),...m?{installerIdentity:m,installerFingerprint:Oe(p.stdout,m)}:{},...h?{provisioningProfilePath:h}:{}}}catch(d){try{await i("security",["delete-keychain",c])}catch(u){throw AggregateError([d,u],"Apple signing failed and its temporary keychain could not be removed")}finally{I.rmSync(o,{recursive:!0,force:!0})}throw d}}async function we(t,r={}){let n=r.runCommand||Ve;try{A("Keychain removal",await n("security",["delete-keychain",t]))}finally{I.rmSync(T.dirname(t),{recursive:!0,force:!0})}}function wt(t){let r=sr(t);if(r.isSymbolicLink())throw Error(`Native app must not contain symbolic links: ${t}`);return r.isDirectory()?ar(t).reduce((n,i)=>n+wt(P(t,i)),0):r.size}async function Ct(t,r,n=a){let i=t.appPath??t.path;if(!i.endsWith(".app")||!H(i))throw Error("Native build must produce a macOS application bundle");let o=P(i,"Contents/Info.plist"),s=P(i,"Contents/MacOS",t.name);for(let l of[o,s,P(i,"Contents/Resources/index.html"),P(i,"Contents/Resources/craft.json")])if(!H(l))throw Error(`Native app is incomplete: ${l}`);let c=Be(s).subarray(0,4).toString("hex");if(!["cffaedfe","cefaedfe","cafebabe","bebafeca","cafebabf","bfbafeca"].includes(c))throw Error("Native app executable must be Mach-O");let d=wt(i);if(r!==void 0&&d>=r)throw Error(`Native bundle is ${d} bytes; it must be below ${r}`);let u=JSON.parse(e("Read bundle metadata",await n("plutil",["-convert","json","-o","-",o])).stdout);if(u.CFBundleIdentifier!==t.bundleId||u.CFBundleShortVersionString!==t.version||String(u.CFBundleVersion)!==t.buildNumber)throw Error("Built app identity/version does not match the release manifest")}async function ra(t,r,n=a){await Ct(t,r,n);let i=P(t.appPath??t.path,"Contents/MacOS",t.name),o=e("Native launch check",await n(i,["--benchmark"]));if(!`${o.stdout}${o.stderr}`.includes("ready"))throw Error("Native app did not report ready")}async function Ce(t,r,n={}){let i=te(t,!0),o=n.command??a,s={...n.env??or.env};if(i.environment){if(ve(t,i.environment),r==="release"){let p=vt(t,i.environment,n.onSecret);Object.assign(s,p,{APP_ENV:i.environment,NODE_ENV:i.environment,DOTENV_ENV:i.environment}),n.onEnvironment?.(p)}}let c=JSON.parse(Be(P(t,"package.json"),"utf8"));if(!c.version||!/^\d+\.\d+\.\d+(?:-[\w.-]+)?$/.test(c.version))throw Error("A native release requires a semantic package version");if(s.PANTRY_BUILD_NUMBER=s.PANTRY_BUILD_NUMBER||s.GITHUB_RUN_NUMBER||c.version,r==="release"&&s.GITHUB_REF_TYPE==="tag"&&s.GITHUB_REF_NAME!==`v${c.version}`)throw Error("Release tag must match package.json version");if(r==="release"&&s.CRAFT_BIN)throw Error("Release builds must use the configured immutable runtime; CRAFT_BIN is a development override");let d=r==="release"&&i.macos?.notarize?ft(s):void 0;if(r==="release"&&i.android&&!s.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON)throw Error("Google Play publishing requires GOOGLE_PLAY_SERVICE_ACCOUNT_JSON");if(r==="release"&&i.macos?.appStore&&(!s.APPLE_APP_STORE_APPLICATION_CERTIFICATE||!s.APPLE_APP_STORE_INSTALLER_CERTIFICATE||!s.APPLE_APP_STORE_PROVISIONING_PROFILE_BASE64||!s.APP_STORE_CONNECT_API_KEY_ID||!s.APP_STORE_CONNECT_ISSUER_ID||!s.APP_STORE_CONNECT_PRIVATE_KEY))throw Error("App Store publishing requires distribution certificates, provisioning profile and App Store Connect credentials");if(r==="release"&&i.macos&&!(s.APPLE_SIGNING_IDENTITY||s.APPLE_APPLICATION_CERTIFICATE))throw Error("Native macOS releases require an application signing identity or certificate");let u=async(p)=>e(p[0],await o(p[0],p.slice(1),{cwd:t,env:s,inherit:!0})),l=[];try{if(r==="release"&&i.macos&&s.APPLE_APPLICATION_CERTIFICATE){let m=await ae({applicationCertificate:s.APPLE_APPLICATION_CERTIFICATE,certificatePassword:s.APPLE_CERTIFICATE_PASSWORD||"",provisioningProfile:s.APPLE_PROVISIONING_PROFILE_BASE64});if(l.push(m.keychainPath),s.APPLE_SIGNING_IDENTITY=m.applicationFingerprint,m.provisioningProfilePath)s.APPLE_PROVISIONING_PROFILE_PATH=m.provisioningProfilePath}await u(["bun","install","--frozen-lockfile"]);for(let m of i.checks?.before??[])await u(m);if(Le(P(t,".pantry/native/artifact.json"),{force:!0}),await u(i.build??["bun","run","package"]),r==="release"&&i.android)await xt(g(t,i.android.bundle),s,o);let p=i.macos?ke(t):void 0;if(p){if(p.version!==c.version)throw Error("Native artifact belongs to a different package version");await ra(p,i.macos?.maxBundleSize,o)}for(let m of i.checks?.after??[])await u(m);let f=p?[p.path]:i.android?[g(t,i.android.bundle)]:[];if(!f.length||f.some((m)=>!H(m)))throw Error("Native pipeline produced no release files");if(p&&r==="release"){e("Release signature",await o("codesign",["--verify","--deep","--strict",p.appPath??p.path]));let m=e("Release identity",await o("codesign",["-dv","--verbose=4",p.appPath??p.path]));if(!`${m.stdout}${m.stderr}`.includes("Authority=Developer ID Application:"))throw Error("Direct macOS releases require a Developer ID signature");if(p.path.toLowerCase().endsWith(".dmg"))await yt(p.path,s.APPLE_SIGNING_IDENTITY,o)}if(d){let m=await bt(f[0],d,o);if(p?.appPath)await xe(p.appPath,o);if(!f[0].toLowerCase().endsWith(".zip"))await xe(f[0],o);let h=P(Fe(f[0]),"notarization-receipt.json");cr(h,`${JSON.stringify(m,null,2)}
+`),f.push(h)}let y;if(r==="release"&&i.macos?.appStore){let m=await ae({applicationCertificate:s.APPLE_APP_STORE_APPLICATION_CERTIFICATE,installerCertificate:s.APPLE_APP_STORE_INSTALLER_CERTIFICATE,certificatePassword:s.APPLE_CERTIFICATE_PASSWORD||"",provisioningProfile:s.APPLE_APP_STORE_PROVISIONING_PROFILE_BASE64});l.push(m.keychainPath),s.PANTRY_DISTRIBUTION="app-store",s.APPLE_SIGNING_IDENTITY=m.applicationFingerprint,s.APPLE_PROVISIONING_PROFILE_PATH=m.provisioningProfilePath,Le(g(t,".pantry/native/app-store"),{recursive:!0,force:!0}),await u(["bun","run","build"]);let h=ke(t);if(await Ct(h,i.macos.maxBundleSize,o),!p||h.bundleId!==p.bundleId||h.version!==p.version||h.buildNumber!==p.buildNumber)throw Error("App Store bundle must match the qualified direct release identity and version");y=P(Fe(f[0]),`${pr(h.appPath??h.path,".app")}-${c.version}.pkg`),await kt(h.appPath??h.path,y,m.installerFingerprint,o),f.push(y)}return{config:i,version:c.version,files:f,...p?{artifact:p}:{},...y?{appStorePackage:y}:{}}}finally{for(let p of l.reverse())await we(p)}}
+export{qa,be,g,te,a,e,dt,aa,oa,sa,ht,na,Na,Ya,ke,ft,yt,xe,bt,kt,xt,ve,vt,Pt,Pe,ae,we,wt,Ct,ra,Ce};

package/dist/{chunk-2h344rhw.js → chunk-t42ydsf5.js}

@@ -1 +1 @@
-import{le,pe,Te,ge,qt,Nt,me,r,Yt,Lt,F,Re,Ft,Mt,Bt}from"./chunk-apsdptxf.js";export{Lt as convertDomainToFileName,r as convertDomainToVarName,qt as fetchPackageListFromGitHub,me as formatObjectWithoutQuotedKeys,Bt as getCanonicalDomain,Te as getGitHubPackageCache,Ft as getPackageAliases,F as guessOriginalDomain,Mt as isKnownAlias,Nt as logPkgxProjects,Re as resolvePackageDomain,ge as saveGitHubPackageCache,le as saveRateLimitInfo,pe as shouldProceedWithGitHubRequest,Yt as toPropertyKey};
+import{le,pe,Te,ge,qt,Nt,me,r,Yt,Lt,F,Re,Ft,Mt,Bt}from"./chunk-xf6jmg4r.js";export{Lt as convertDomainToFileName,r as convertDomainToVarName,qt as fetchPackageListFromGitHub,me as formatObjectWithoutQuotedKeys,Bt as getCanonicalDomain,Te as getGitHubPackageCache,Ft as getPackageAliases,F as guessOriginalDomain,Mt as isKnownAlias,Nt as logPkgxProjects,Re as resolvePackageDomain,ge as saveGitHubPackageCache,le as saveRateLimitInfo,pe as shouldProceedWithGitHubRequest,Yt as toPropertyKey};

package/dist/{chunk-55gcc42h.js → chunk-v5mxzv2b.js}

@@ -1 +1 @@
-import{s,M,Oe,U,m,Vt,B,Gt,Kt,V,qe,Ne,Ye,D}from"./chunk-apsdptxf.js";export{M as cleanStaleOutputFiles,m as cleanupBrowserResources,V as fetchAndSaveAllPackages,qe as fetchAndSavePackage,B as fetchPantryPackage,D as fetchPantryPackageWithMetadata,Vt as fetchPkgxProjects,Oe as getValidCachedPackage,Ye as readPantryPackageInfo,s as savePackageAsTypeScript,U as saveToCacheAndOutput,Ne as scanPantryPackages,Gt as setupCleanupHandlers,Kt as startPeriodicCleanup};
+import{s,M,Oe,U,m,Vt,B,Gt,Kt,V,qe,Ne,Ye,D}from"./chunk-xf6jmg4r.js";export{M as cleanStaleOutputFiles,m as cleanupBrowserResources,V as fetchAndSaveAllPackages,qe as fetchAndSavePackage,B as fetchPantryPackage,D as fetchPantryPackageWithMetadata,Vt as fetchPkgxProjects,Oe as getValidCachedPackage,Ye as readPantryPackageInfo,s as savePackageAsTypeScript,U as saveToCacheAndOutput,Ne as scanPantryPackages,Gt as setupCleanupHandlers,Kt as startPeriodicCleanup};