@allocator-one/harness-cli 1.13.0 → 1.15.0

package/dist/chunk-I2S2JVCQ.js

@@ -0,0 +1,4761 @@
+#!/usr/bin/env node
+
+// src/core/errors.ts
+var HttpError = class extends Error {
+  constructor(status, message, body = {}, retryAfter = null) {
+    super(message);
+    this.status = status;
+    this.body = body;
+    this.retryAfter = retryAfter;
+    this.name = "HttpError";
+  }
+  status;
+  body;
+  retryAfter;
+};
+var UpgradeRequiredError = class extends HttpError {
+  constructor(message, body = {}) {
+    super(426, message, body);
+    this.name = "UpgradeRequiredError";
+  }
+};
+var TransportError = class extends Error {
+  constructor(message, code = null) {
+    super(message);
+    this.code = code;
+    this.name = "TransportError";
+  }
+  code;
+};
+var MalformedResponseError = class extends TransportError {
+  constructor(message) {
+    super(message);
+    this.name = "MalformedResponseError";
+  }
+};
+var UsageError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "UsageError";
+  }
+};
+var LocalError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "LocalError";
+  }
+};
+var CommandError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CommandError";
+  }
+};
+
+// src/version.ts
+import { readFileSync } from "fs";
+var pkg = JSON.parse(
+  readFileSync(new URL("../package.json", import.meta.url), "utf8")
+);
+var CLI_VERSION = pkg.version;
+var CLI_PACKAGE = pkg.name;
+
+// src/core/expert.ts
+var EXPERT_TOKEN_PREFIX = "pxc_";
+var EXPERT_ASSIGNMENTS_PATH = "/api/v1/expert/assignments";
+function isExpertToken(token) {
+  return token.startsWith(EXPERT_TOKEN_PREFIX);
+}
+var EXPERT_REACH = "an outside expert's pxc_ credential only lists its own assignments and reads and ticks the gates it owns on them: assignments, conditions <issue> and gate satisfy|unsatisfy (assignment_list, condition_list and gate_set over MCP)";
+var EXPERT_LAPSED = "the pxc_ credential is not valid here: it has expired (it lasts at most 30 days) or was revoked, its seat was revoked or has ended, the account is suspended, its TOTP enrolment changed, or it was minted for another host. If your seat is still open, mint a new one in your expert view";
+var NOT_AN_EXPERT = "this credential is a member's login or an API token, not an outside expert's pxc_ credential";
+function explainExpertRefusal(error, token) {
+  if (!(error instanceof HttpError) || error instanceof UpgradeRequiredError) return error;
+  const code = error.body["error"];
+  let hint;
+  if (error.status === 403 && code === "expert_bound_credential") hint = EXPERT_REACH;
+  else if (error.status === 403 && code === "expert_credential_required") hint = NOT_AN_EXPERT;
+  else if (error.status === 401 && isExpertToken(token)) hint = EXPERT_LAPSED;
+  if (hint === void 0) return error;
+  return new HttpError(error.status, `${error.message} \u2014 ${hint}`, error.body, error.retryAfter);
+}
+
+// src/core/client.ts
+var RECEIVE_TIMEOUT_MS = 3e4;
+var UPLOAD_RECEIVE_TIMEOUT_MS = 6e4;
+var UPLOAD_FLOOR_BYTES_PER_MS = 100;
+function uploadTimeoutMs(bodyBytes) {
+  return UPLOAD_RECEIVE_TIMEOUT_MS + Math.ceil(bodyBytes / UPLOAD_FLOOR_BYTES_PER_MS);
+}
+var DEFAULT_MESSAGES = {
+  401: "Missing or invalid token (check HARNESS_API_TOKEN)",
+  403: "Token not permitted (scope or admin gate)",
+  404: "Not found",
+  409: "Conflict",
+  422: "Validation error",
+  426: "CLI too old for this API \u2014 upgrade: npm i -g @allocator-one/harness-cli@latest",
+  429: "Rate limited \u2014 retry later"
+};
+var Client = class {
+  constructor(config) {
+    this.config = config;
+    this.fetchImpl = config.fetchImpl ?? globalThis.fetch;
+  }
+  config;
+  fetchImpl;
+  get cliVersion() {
+    return CLI_VERSION;
+  }
+  get baseUrl() {
+    return this.config.baseUrl;
+  }
+  async get(path2, params) {
+    return this.json(await this.raw("GET", path2, { params }));
+  }
+  /**
+   * `actor: false` keeps a configured actor out of the body, for endpoints
+   * whose body is closed: they refuse a field they do not name, and record
+   * the credential's own person instead.
+   */
+  async post(path2, body = {}, options = {}) {
+    return this.json(
+      await this.raw("POST", path2, {
+        json: options.actor === false ? body : this.withActor(body),
+        idempotencyKey: options.idempotencyKey
+      })
+    );
+  }
+  async patch(path2, body) {
+    return this.json(await this.raw("PATCH", path2, { json: this.withActor(body) }));
+  }
+  async put(path2, body) {
+    return this.json(await this.raw("PUT", path2, { json: this.withActor(body) }));
+  }
+  async delete(path2) {
+    return this.json(await this.raw("DELETE", path2, {}));
+  }
+  /**
+   * Posts multipart/form-data — the one endpoint that does not take JSON.
+   * Shares auth, the version header, and error mapping with the JSON verbs,
+   * but never the actor: there is no JSON body to carry an `actor` field,
+   * and the server's file contract is the form itself.
+   */
+  async postMultipart(path2, form, bodyBytes = 0) {
+    return this.json(await this.raw("POST", path2, { form, timeoutMs: uploadTimeoutMs(bodyBytes) }));
+  }
+  /** Binary download (attachments); non-2xx still maps through the JSON error envelope. */
+  async getBytes(path2) {
+    const response = await this.raw("GET", path2, {});
+    if (!response.ok) throw await this.toHttpError(response);
+    try {
+      return new Uint8Array(await response.arrayBuffer());
+    } catch (error) {
+      throw new TransportError(transportMessage(error), transportCode(error));
+    }
+  }
+  /**
+   * The server's API version, for `version`'s server side. The header rides
+   * on every response — the versioning plug runs before auth — so even a
+   * 401 answers. A pxc_ credential probes the one route it reaches, so the
+   * probe is never a refusal in the server's log.
+   */
+  async serverVersion() {
+    const path2 = isExpertToken(this.config.token) ? EXPERT_ASSIGNMENTS_PATH : "/api/v1/stats";
+    const response = await this.raw("GET", path2, {});
+    return response.headers.get("x-harness-api-version") ?? "unknown";
+  }
+  // Only an explicitly configured actor is sent, and never over one the
+  // caller already put in the body.
+  withActor(body) {
+    if (this.config.actor === null || "actor" in body) return body;
+    return { ...body, actor: this.config.actor };
+  }
+  async raw(method, path2, options) {
+    const url = new URL(this.config.baseUrl + path2);
+    for (const [key, value] of Object.entries(options.params ?? {})) {
+      if (value !== void 0) url.searchParams.set(key, String(value));
+    }
+    const headers = {
+      authorization: `Bearer ${this.config.token}`,
+      "x-harness-cli-version": CLI_VERSION
+    };
+    if (options.idempotencyKey !== void 0) {
+      headers["idempotency-key"] = options.idempotencyKey;
+    }
+    let body;
+    if (options.json !== void 0) {
+      headers["content-type"] = "application/json";
+      body = JSON.stringify(options.json);
+    } else if (options.form !== void 0) {
+      body = options.form;
+    }
+    try {
+      return await this.fetchImpl(url, {
+        method,
+        headers,
+        body,
+        signal: AbortSignal.timeout(options.timeoutMs ?? RECEIVE_TIMEOUT_MS),
+        redirect: "manual"
+      });
+    } catch (error) {
+      throw new TransportError(transportMessage(error), transportCode(error));
+    }
+  }
+  async json(response) {
+    if (!response.ok) throw await this.toHttpError(response);
+    let text;
+    try {
+      text = await response.text();
+    } catch (error) {
+      throw new TransportError(transportMessage(error), transportCode(error));
+    }
+    if (text === "") return { data: void 0 };
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      throw new MalformedResponseError(`the API answered with a non-JSON body (HTTP ${response.status})`);
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      throw new MalformedResponseError(`the API answered with an invalid JSON envelope (HTTP ${response.status})`);
+    }
+    return parsed;
+  }
+  async toHttpError(response) {
+    let parsed = {};
+    try {
+      const candidate = JSON.parse(await response.text());
+      if (typeof candidate === "object" && candidate !== null) {
+        parsed = candidate;
+      }
+    } catch {
+    }
+    const fromBody = typeof parsed["message"] === "string" ? parsed["message"] : null;
+    const message = fromBody ?? DEFAULT_MESSAGES[response.status] ?? `HTTP ${response.status}`;
+    if (response.status === 426) return new UpgradeRequiredError(message, parsed);
+    return new HttpError(response.status, message, parsed, response.headers.get("retry-after"));
+  }
+};
+function transportCode(error) {
+  const cause = error instanceof Error ? error.cause : void 0;
+  if (typeof cause !== "object" || cause === null) return null;
+  const code = cause.code;
+  if (typeof code === "string") return code;
+  const errors = cause.errors;
+  if (!Array.isArray(errors)) return null;
+  const codes = new Set(errors.map((inner) => inner?.code));
+  const [only] = codes;
+  return codes.size === 1 && typeof only === "string" ? only : null;
+}
+function transportMessage(error) {
+  if (error instanceof Error) {
+    if (error.name === "TimeoutError" || error.name === "AbortError") return "request timed out";
+    const cause = error.cause;
+    if (cause instanceof Error && cause.message !== "") return cause.message;
+    return error.message;
+  }
+  return String(error);
+}
+
+// src/core/output.ts
+var TITLE_WIDTH = 70;
+var segmenter = new Intl.Segmenter(void 0, { granularity: "grapheme" });
+function graphemes(text) {
+  return [...segmenter.segment(text)].map((piece) => piece.segment);
+}
+function graphemeLength(text) {
+  return graphemes(text).length;
+}
+function padGraphemes(text, width) {
+  const shortfall = width - graphemeLength(text);
+  return shortfall > 0 ? text + " ".repeat(shortfall) : text;
+}
+function clean(value) {
+  if (value === null || value === void 0) return "";
+  return String(value).replace(/[\x00-\x1F\x7F\u0080-\u009F]/gu, "");
+}
+function json(term) {
+  return JSON.stringify(term) + "\n";
+}
+var OPERATOR_TEAM_KEY = /^OPERATOR\d*$/;
+var OPERATOR_TEAM_NAME = "Operator";
+var AGENT_MARK = "[agent]";
+var AGENT_LEGEND = `
+${AGENT_MARK} Operator runs this step for its plan; only the plan driver claims it.
+`;
+function isAgentStep(issue) {
+  return OPERATOR_TEAM_KEY.test(str(path(issue, "team", "key"))) && str(path(issue, "team", "name")) === OPERATOR_TEAM_NAME;
+}
+function issuesTable(issues, options = {}) {
+  if (issues.length === 0) return "No issues.\n";
+  let marked = false;
+  const rows = issues.map((issue) => {
+    const agentStep = options.markAgentSteps === true && isAgentStep(issue);
+    if (agentStep) marked = true;
+    return [
+      str(issue["identifier"]),
+      str(path(issue, "state", "name")) || "-",
+      str(issue["priority_label"]) || "-",
+      str(path(issue, "assignee", "name")) || "-",
+      agentStep ? truncate(`${AGENT_MARK} ${clean(issue["title"])}`) : truncate(issue["title"])
+    ];
+  });
+  const rendered = table(["ID", "STATE", "PRIORITY", "ASSIGNEE", "TITLE"], rows);
+  return marked ? rendered + AGENT_LEGEND : rendered;
+}
+function issueDetail(issue, images = []) {
+  const header = `${str(issue["identifier"])} \xB7 ${clean(issue["title"])}
+`;
+  const fields = [
+    ["State", path(issue, "state", "name")],
+    ["Priority", issue["priority_label"]],
+    ["Assignee", path(issue, "assignee", "name")],
+    ["Team", path(issue, "team", "key")],
+    ["Labels", labelsLine(issue["labels"])],
+    ["Blocked", blockedLine(issue)],
+    ["Waiting", waitingLine(issue)],
+    ["Due", issue["due_date"]],
+    ["Updated", issue["updated_at"]]
+  ];
+  const fieldLines = fields.filter(([, value]) => value !== null && value !== void 0 && value !== "").map(([label, value]) => `  ${(label + ":").padEnd(12)}${clean(value)}
+`).join("");
+  const sections = [
+    ["Description", issue["description"]],
+    ["Design", issue["design"]],
+    ["Acceptance criteria", issue["acceptance_criteria"]],
+    ["Notes", issue["notes"]]
+  ];
+  const sectionText = sections.filter(([, text]) => text !== null && text !== void 0 && text !== "").map(([title, text]) => `
+${title}:
+${indent(String(text))}
+`).join("");
+  return header + fieldLines + sectionText + conditionsSection(issue["conditions"]) + relationsSection(issue["relations"]) + childrenSection(issue["children"]) + commentsSection(issue["comments"]) + imagesSection(images);
+}
+function activityEntries(entries) {
+  if (entries.length === 0) return "No activity.\n";
+  return entries.map(activityEntry).join("\n");
+}
+function activityEntry(entry) {
+  switch (entry["kind"]) {
+    case "comment":
+      return activityComment(entry);
+    case "state_event":
+      return activityStateEvent(entry);
+    case "assignee_event":
+      return activityAssigneeEvent(entry);
+    case "condition_event":
+      return activityConditionEvent(entry);
+    case "field_event":
+      return activityFieldEvent(entry);
+    default:
+      throw new CommandError(`Unknown activity entry kind: ${clean(entry["kind"])}`);
+  }
+}
+function activityComment(entry) {
+  const comment2 = requiredRecord(entry["comment"], "activity comment");
+  const authorValue = comment2["author"];
+  const author = authorValue === null ? "unknown" : optionalLabel(requiredRecord(authorValue, "comment author")["name"], "unknown", "comment author name");
+  const deleted = comment2["deleted"];
+  if (typeof deleted !== "boolean") throw new CommandError("Invalid comment deleted flag.");
+  const body = activityCommentBody(comment2["body"], deleted);
+  const text = cleanMultiline(body).split("\n").map((line) => "  " + line).join("\n");
+  return `[${occurredAt(entry)}] ${clean(author)} (${clean(requiredString(comment2["id"], "comment id"))}):
+${text}
+`;
+}
+function activityCommentBody(value, deleted) {
+  if (deleted) return "[deleted comment]";
+  if (value === null || value === "") return "[comment has no text]";
+  return requiredString(value, "comment body");
+}
+function activityStateEvent(entry) {
+  const actor = activityWho(entry);
+  const provenance = activityProvenance(requiredRecord(entry["provenance"], "activity provenance"));
+  let description;
+  switch (entry["action"]) {
+    case "created":
+      description = `${actor} created the issue in ${stateName(entry["to_state"], "created to_state")}`;
+      break;
+    case "transition":
+      description = `${actor} moved the issue from ${nullableStateName(entry["from_state"], "transition from_state")} to ${stateName(entry["to_state"], "transition to_state")}`;
+      break;
+    case "milestone":
+      description = `${actor} recorded the ${stateName(entry["to_state"], "milestone to_state")} milestone`;
+      break;
+    default:
+      throw new CommandError(`Unknown activity action: ${clean(entry["action"])}`);
+  }
+  return `[${occurredAt(entry)}] ${description} \xB7 ${provenance}
+`;
+}
+function activityAssigneeEvent(entry) {
+  const actor = activityWho(entry);
+  const provenance = activityProvenance(requiredRecord(entry["provenance"], "activity provenance"));
+  let description;
+  switch (entry["action"]) {
+    case "assigned":
+      description = `${actor} assigned the issue to ${assigneeName(entry["to_assignee"])}`;
+      break;
+    case "reassigned":
+      description = `${actor} reassigned the issue from ${assigneeName(entry["from_assignee"])} to ${assigneeName(entry["to_assignee"])}`;
+      break;
+    case "unassigned":
+      description = `${actor} unassigned the issue from ${assigneeName(entry["from_assignee"])}`;
+      break;
+    default:
+      throw new CommandError(`Unknown activity action: ${clean(entry["action"])}`);
+  }
+  return `[${occurredAt(entry)}] ${description} - ${provenance}
+`;
+}
+function activityConditionEvent(entry) {
+  const actor = activityWho(entry);
+  const provenance = activityProvenance(requiredRecord(entry["provenance"], "activity provenance"));
+  const condition = conditionSubject(requiredRecord(entry["condition"], "activity condition"));
+  let description;
+  switch (entry["action"]) {
+    case "added":
+      description = `${actor} added ${condition}`;
+      break;
+    case "changed":
+      description = `${actor} changed ${condition}`;
+      break;
+    case "removed":
+      description = `${actor} removed ${condition}`;
+      break;
+    case "satisfied":
+      description = `${actor} satisfied ${condition}`;
+      break;
+    case "unsatisfied":
+      description = `${actor} marked ${condition} unsatisfied`;
+      break;
+    default:
+      throw new CommandError(`Unknown activity action: ${clean(entry["action"])}`);
+  }
+  return `[${occurredAt(entry)}] ${description} \xB7 ${provenance}
+`;
+}
+function conditionSubject(condition) {
+  const label = clean(condition["label"]);
+  switch (condition["kind"]) {
+    case "gate":
+      return label === "" ? "the gate" : `the gate "${label}"`;
+    case "not_before": {
+      const at = clean(condition["not_before"]);
+      return at === "" ? "the not-before date" : `the not-before date ${at}`;
+    }
+    case "event":
+      return label === "" ? "the wait condition" : `the system event "${label}"`;
+    default:
+      return "the wait condition";
+  }
+}
+function activityFieldEvent(entry) {
+  const actor = activityWho(entry);
+  const provenance = activityProvenance(requiredRecord(entry["provenance"], "activity provenance"));
+  const change = fieldChange(requiredString(entry["field"], "activity field"), entry["from"], entry["to"]);
+  return `[${occurredAt(entry)}] ${actor} ${change} \xB7 ${provenance}
+`;
+}
+function fieldChange(field3, from, to) {
+  switch (field3) {
+    case "priority":
+      return `changed priority from ${priorityName(from)} to ${priorityName(to)}`;
+    case "title":
+      return `renamed the issue from \u201C${activityTitle(from)}\u201D to \u201C${activityTitle(to)}\u201D`;
+    case "description":
+      return "edited the description";
+    case "labels":
+      return labelsChange(to);
+    case "parent":
+      return parentChange(from, to);
+    case "archived":
+      if (typeof to !== "boolean") throw new CommandError("Invalid activity archived value.");
+      return to ? "archived the issue" : "unarchived the issue";
+    default:
+      return `changed the ${clean(field3)} field`;
+  }
+}
+var ACTIVITY_PRIORITIES = {
+  0: "No priority",
+  1: "Urgent",
+  2: "High",
+  3: "Medium",
+  4: "Low"
+};
+function priorityName(value) {
+  if (typeof value !== "number" || !Number.isInteger(value)) throw new CommandError("Invalid activity priority.");
+  return ACTIVITY_PRIORITIES[value] ?? String(value);
+}
+function activityTitle(value) {
+  if (typeof value !== "string") throw new CommandError("Invalid activity title.");
+  return clean(value);
+}
+function labelsChange(to) {
+  const change = requiredRecord(to, "activity labels");
+  const added = labelNames(change["added"]);
+  const removed = labelNames(change["removed"]);
+  const parts = [
+    ...added.length > 0 ? [`added ${labelList(added)}`] : [],
+    ...removed.length > 0 ? [`removed ${labelList(removed)}`] : []
+  ];
+  return parts.length === 0 ? "changed the labels" : parts.join(" and ");
+}
+function labelNames(value) {
+  if (!Array.isArray(value)) throw new CommandError("Invalid activity labels.");
+  return value.map((label) => clean(requiredString(requiredRecord(label, "activity labels")["name"], "activity labels")));
+}
+function labelList(names) {
+  return `${names.length === 1 ? "label" : "labels"} ${names.join(", ")}`;
+}
+function parentChange(from, to) {
+  if (from === null && to === null) return "changed the parent";
+  if (from === null) return `set the parent to ${parentName(to)}`;
+  if (to === null) return `removed the parent ${parentName(from)}`;
+  return `changed the parent from ${parentName(from)} to ${parentName(to)}`;
+}
+function parentName(value) {
+  const parent = requiredRecord(value, "activity parent");
+  return optionalLabel(parent["identifier"], "an unknown issue", "activity parent identifier");
+}
+function activityWho(entry) {
+  const actor = activityActor(requiredRecord(entry["actor"], "activity actor"));
+  const label = entry["actor_label"];
+  if (label === void 0 || label === null || label === "") return actor;
+  if (typeof label !== "string") throw new CommandError("Invalid activity actor label.");
+  const cleaned = clean(label);
+  return cleaned === "" ? actor : `${actor} via \u201C${cleaned}\u201D`;
+}
+function occurredAt(entry) {
+  return clean(requiredString(entry["occurred_at"], "activity occurrence time"));
+}
+function assigneeName(value) {
+  const assignee = requiredRecord(value, "activity assignee");
+  if (assignee["kind"] === "unknown") return "Unknown assignee";
+  return activityActor(assignee);
+}
+function activityActor(actor) {
+  switch (actor["kind"]) {
+    case "user":
+      return optionalLabel(actor["name"], "Unknown actor", "activity actor name");
+    case "system":
+      return "System";
+    case "deleted_user":
+      return "Deleted user";
+    case "unknown":
+      return "Unknown actor";
+    default:
+      throw new CommandError(`Unknown activity actor kind: ${clean(actor["kind"])}`);
+  }
+}
+function activityProvenance(provenance) {
+  switch (provenance["kind"]) {
+    case "live":
+    case "import":
+    case "backfill":
+      return String(provenance["kind"]);
+    default:
+      throw new CommandError(`Unknown activity provenance: ${clean(provenance["kind"])}`);
+  }
+}
+function stateName(value, field3) {
+  return optionalLabel(requiredRecord(value, field3)["name"], "Unknown state", `${field3} name`);
+}
+function nullableStateName(value, field3) {
+  return value === null ? "Unknown state" : stateName(value, field3);
+}
+function optionalLabel(value, fallback, field3) {
+  if (value === null || value === "") return fallback;
+  return clean(requiredString(value, field3));
+}
+function requiredRecord(value, field3) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new CommandError(`Invalid ${field3}.`);
+  }
+  return value;
+}
+function requiredString(value, field3) {
+  if (typeof value !== "string" || value === "") throw new CommandError(`Invalid ${field3}.`);
+  return value;
+}
+function stats(data) {
+  const teams = data["teams"] ?? [];
+  const totals = data["totals"] ?? {};
+  const rows = teams.map((team) => [
+    str(path(team, "team", "key")),
+    str(team["open"]),
+    str(team["started"]),
+    str(team["blocked"]),
+    str(team["ready"]),
+    str(team["closed"])
+  ]);
+  const totalsRow = ["TOTAL", ...["open", "started", "blocked", "ready", "closed"].map((key) => str(totals[key]))];
+  return table(["TEAM", "OPEN", "STARTED", "BLOCKED", "READY", "CLOSED"], [...rows, totalsRow]);
+}
+function table(headers, rows) {
+  const all = [headers, ...rows.map((row) => row.map((cell) => clean(cell)))];
+  const widths = headers.map((_, column) => Math.max(...all.map((row) => graphemeLength(row[column] ?? ""))));
+  return all.map(
+    (row) => row.map((cell, column) => padGraphemes(cell, widths[column] ?? 0)).join("  ").replace(/\s+$/, "") + "\n"
+  ).join("");
+}
+function records(value) {
+  if (!Array.isArray(value)) return [];
+  return value.filter(
+    (entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry)
+  );
+}
+function waitingLine(issue) {
+  if (issue["waiting_on_condition"] !== true) return null;
+  const conditions = records(issue["conditions"]);
+  const open = conditions.filter((condition) => condition["satisfied"] !== true).length;
+  return `yes, on ${open} of ${conditions.length} wait condition${conditions.length === 1 ? "" : "s"}`;
+}
+function conditionsSection(conditions) {
+  const list3 = records(conditions);
+  if (list3.length === 0) return "";
+  return "\nWait conditions:\n" + list3.map((condition) => `  ${conditionLine(condition)}
+`).join("");
+}
+function conditionLine(condition, options = {}) {
+  const satisfied = condition["satisfied"] === true;
+  let what;
+  switch (condition["kind"]) {
+    case "gate": {
+      const owner = condition["owner"];
+      let ownedBy = "";
+      if (typeof owner === "object" && owner !== null) {
+        const record = owner;
+        ownedBy = options.expertView === true && record["kind"] === "expert" ? "you" : ownerText(record);
+      }
+      what = `gate ${gateName(condition)}${ownedBy === "" ? "" : ` owned by ${ownedBy}`}`;
+      break;
+    }
+    case "not_before":
+      what = `not before ${clean(condition["not_before"])}`;
+      break;
+    case "event":
+      what = "system event";
+      break;
+    default:
+      what = clean(condition["kind"]) || "condition";
+  }
+  let when = "";
+  if (satisfied && typeof condition["satisfied_at"] === "string") {
+    let by = clean(path(condition, "satisfied_by", "name"));
+    if (by === "" && condition["satisfied_by_kind"] === "expert") by = "an outside expert";
+    let role = typeof condition["satisfied_as_role"] === "string" ? roleName(condition["satisfied_as_role"]) : "";
+    switch (path(condition, "satisfied_by", "kind")) {
+      case "you":
+        by = "you";
+        break;
+      case "role": {
+        const as = path(condition, "satisfied_by", "role");
+        if (typeof as === "string" && as !== "") role = roleName(as);
+        break;
+      }
+      case "expert":
+        by = "an outside expert";
+        break;
+      case "member":
+        by = "a member";
+        break;
+    }
+    when = ` (satisfied ${clean(condition["satisfied_at"])}${by === "" ? "" : ` by ${by}`}${role === "" ? "" : ` as ${role}`})`;
+  }
+  return `${satisfied ? "[x]" : "[ ]"} ${what}${when} \xB7 ${clean(condition["id"])}`;
+}
+function gateName(gate) {
+  const key = clean(gate["key"]);
+  return `"${clean(gate["label"])}"${key === "" ? "" : ` [${key}]`}`;
+}
+function ownerText(owner) {
+  const label = clean(owner["label"]) || (owner["kind"] === "role" && typeof owner["role"] === "string" ? roleName(owner["role"]) : "");
+  const ref = clean(owner["ref"]);
+  if (owner["kind"] === "expert") {
+    const email = label || ref.replace(/^expert:/, "");
+    return email === "" ? "" : `${email} (expert)`;
+  }
+  if (label === "") return ref;
+  return ref === "" || ref === label ? label : `${label} (${ref})`;
+}
+function expertSummary(seat) {
+  const role = typeof seat.role === "string" && seat.role !== "" ? roleName(seat.role) : "Outside expert";
+  const status = clean(seat.plan?.status);
+  const plan = seat.plan === null ? ", no plan" : ` on plan ${clean(seat.plan.id)}${status === "" ? "" : ` (${status})`}`;
+  const steps = seat.assigned_steps;
+  const count = steps === 0 ? "no assigned steps" : `${steps} assigned step${steps === 1 ? "" : "s"}`;
+  return `${role}${plan} \xB7 ${count}`;
+}
+function expertAssignments(steps) {
+  return steps.map((step) => "\n" + assignedStep(step)).join("");
+}
+function assignedStep(step) {
+  const blockers = typeof step["open_blockers"] === "number" ? step["open_blockers"] : 0;
+  const fields = [
+    ["State", path(step, "state", "name")],
+    ["Due", step["due_date"]],
+    ["Blocked", blockers > 0 ? `yes, by ${blockers} open issue${blockers === 1 ? "" : "s"}` : null]
+  ];
+  const fieldLines = fields.filter(([, value]) => value !== null && value !== void 0 && value !== "").map(([label, value]) => `  ${(label + ":").padEnd(12)}${clean(value)}
+`).join("");
+  const gates = records(step["gates"]);
+  const gateLines = gates.length === 0 ? "  Gates:      none of yours\n" : "  Gates:\n" + gates.map((gate) => `    ${conditionLine(gate, { expertView: true })}
+`).join("");
+  const description = step["description"];
+  const descriptionLines = typeof description === "string" && description !== "" ? "  Description:\n" + indent(indent(description)) + "\n" : "";
+  return `${clean(step["identifier"])} \xB7 ${clean(step["title"])}
+${fieldLines}${gateLines}${descriptionLines}`;
+}
+var ROLE_NAMES = { gp: "GP" };
+function roleName(role) {
+  const slug = clean(role);
+  if (Object.hasOwn(ROLE_NAMES, slug)) return ROLE_NAMES[slug];
+  const words = slug.replace(/_/g, " ");
+  return words.charAt(0).toUpperCase() + words.slice(1);
+}
+var LIVE_PLAN_STATUSES = ["released", "running", "needs_attention"];
+function planDetail(plan) {
+  const steps = records(plan["steps"]);
+  const fields = [
+    ["Root", planRootLine(plan["root"])],
+    ["Revision", planRevisionLine(plan)],
+    ["Budgets", planBudgetsLine(plan)],
+    ["Estimate", planEstimateLine(plan["estimate"])]
+  ];
+  const fieldLines = fields.filter((field3) => field3[1] !== null).map(([label, value]) => `  ${(label + ":").padEnd(12)}${value}
+`).join("");
+  return `Plan ${clean(plan["id"])} \xB7 ${clean(plan["status"])}
+` + fieldLines + planStepsSection(steps, str(plan["status"])) + planEdgesSection(plan["edges"]) + planConditionsSection(steps) + planWaitingSection(steps) + planHeldSection(plan["held_steps"]);
+}
+function planRootLine(root) {
+  if (typeof root !== "object" || root === null) return null;
+  const record = root;
+  return `${clean(record["identifier"])} \xB7 ${clean(record["title"])}`;
+}
+function planRevisionLine(plan) {
+  const revision = plan["revision"];
+  if (typeof revision !== "object" || revision === null) return "none yet (never released)";
+  const number = clean(revision["number"]);
+  const by = clean(path(plan, "released_by", "name"));
+  const at = clean(plan["released_at"]);
+  if (by === "" && at === "") return number;
+  return `${number} \xB7 released${by === "" ? "" : ` by ${by}`}${at === "" ? "" : ` at ${at}`}`;
+}
+function planBudgetsLine(plan) {
+  const retries = plan["retry_budget"];
+  const retryText = typeof retries === "number" ? `${retries} ${retries === 1 ? "retry" : "retries"} per failed Operator step` : null;
+  const spend = plan["spend_budget_cents"];
+  const spendText = typeof spend === "number" ? `spend budget ${spend} cents` : "no spend budget";
+  return [retryText, spendText].filter((part) => part !== null).join(" \xB7 ");
+}
+function planEstimateLine(estimate) {
+  if (typeof estimate !== "object" || estimate === null) return null;
+  const record = estimate;
+  const ceiling = record["ceiling_cents"];
+  if (typeof ceiling !== "number") return null;
+  const minimum = record["minimum_budget_cents"];
+  return `up to ${ceiling} cents${typeof minimum === "number" ? ` (minimum budget ${minimum} cents)` : ""}`;
+}
+function planStepsSection(steps, planStatus) {
+  if (steps.length === 0) return "";
+  const depths = stepDepths(steps);
+  const rows = steps.map((step) => [
+    "  ".repeat(depths.get(str(step["identifier"])) ?? 0) + str(step["identifier"]),
+    str(step["key"]) || "-",
+    str(step["executor"]) || "-",
+    str(path(step, "state", "name")) || "-",
+    stepStatus(step, planStatus),
+    truncate(step["title"])
+  ]);
+  const rendered = table(["STEP", "KEY", "EXECUTOR", "STATE", "STATUS", "TITLE"], rows);
+  return "\nSteps:\n" + indentLines(rendered);
+}
+function stepDepths(steps) {
+  const parents = new Map(steps.map((step) => [str(step["identifier"]), str(step["parent"])]));
+  const depths = /* @__PURE__ */ new Map();
+  for (const identifier of parents.keys()) {
+    let depth = 0;
+    let parent = parents.get(identifier) ?? "";
+    const seen = /* @__PURE__ */ new Set([identifier]);
+    while (parent !== "" && parents.has(parent) && !seen.has(parent)) {
+      seen.add(parent);
+      depth += 1;
+      parent = parents.get(parent) ?? "";
+    }
+    depths.set(identifier, depth);
+  }
+  return depths;
+}
+function stepStatus(step, planStatus) {
+  const stateType = path(step, "state", "type");
+  if (step["archived"] === true) return "archived";
+  if (stateType === "completed") return "done";
+  if (stateType === "canceled") return "cancelled";
+  if (step["container"] === true) return "container";
+  if (step["ready"] === true) return "ready";
+  if (step["held"] === true) return "held";
+  if (step["in_revision"] === false && LIVE_PLAN_STATUSES.includes(planStatus)) return "not in revision";
+  if (records(step["conditions"]).some((condition) => condition["satisfied"] !== true)) return "waiting";
+  return "-";
+}
+function planEdgesSection(edges) {
+  const list3 = records(edges);
+  if (list3.length === 0) return "";
+  return "\nEdges (blocker \u2192 blocked):\n" + list3.map((edge) => `  ${clean(edge["from"])} \u2192 ${clean(edge["to"])}
+`).join("");
+}
+function planConditionsSection(steps) {
+  const lines = steps.flatMap(
+    (step) => records(step["conditions"]).map((condition) => [clean(step["identifier"]), conditionLine(condition)])
+  );
+  if (lines.length === 0) return "";
+  const width = Math.max(...lines.map(([identifier]) => graphemeLength(identifier)));
+  return "\nWait conditions:\n" + lines.map(([identifier, line]) => `  ${padGraphemes(identifier, width)}  ${line}
+`).join("");
+}
+function planWaitingSection(steps) {
+  const lines = steps.flatMap(
+    (step) => records(step["waiting_for"]).map((wait) => [clean(step["identifier"]), waitLine(wait)])
+  );
+  if (lines.length === 0) return "";
+  const width = Math.max(...lines.map(([identifier]) => graphemeLength(identifier)));
+  return "\nWaiting for:\n" + lines.map(([identifier, line]) => `  ${padGraphemes(identifier, width)}  ${line}
+`).join("");
+}
+function waitLine(wait) {
+  const name = gateName(wait);
+  const owner = wait["owner"];
+  if (typeof owner !== "object" || owner === null) return `${name} \xB7 no owner, anyone with standing can tick`;
+  const holders = wait["holders"];
+  let who;
+  if (!Array.isArray(holders)) who = "who can tick is not known";
+  else if (holders.length === 0) who = "nobody can tick";
+  else who = `can tick: ${records(holders).map(holderText).join(", ")}`;
+  return `${name} \xB7 ${ownerText(owner)} \xB7 ${who}`;
+}
+function holderText(holder) {
+  const name = clean(holder["name"]);
+  if (holder["kind"] !== "expert") return name;
+  const organization = clean(holder["organization"]);
+  return `${name} (expert${organization === "" ? "" : `, ${organization}`})`;
+}
+function planHeldSection(heldSteps) {
+  if (!Array.isArray(heldSteps) || heldSteps.length === 0) return "";
+  return `
+Held by an edit until the plan is released again: ${heldSteps.map((step) => clean(step)).join(", ")}
+`;
+}
+function indentLines(text) {
+  return text.split("\n").map((line) => line === "" ? line : "  " + line).join("\n");
+}
+function errorDetails(body) {
+  return changesetDetails(body["details"]) + violationDetails(body["violations"]);
+}
+function changesetDetails(details) {
+  if (typeof details !== "object" || details === null || Array.isArray(details)) return "";
+  return Object.entries(details).map(([field3, messages]) => {
+    const text = Array.isArray(messages) ? messages.map(String).join("; ") : String(messages);
+    return `
+  ${clean(field3)}: ${clean(text)}`;
+  }).join("");
+}
+function violationDetails(violations) {
+  return records(violations).map((violation) => {
+    const code = clean(violation["code"]);
+    const message = clean(violation["message"]) || code || "invalid";
+    return `
+  ${violationSubject(violation)}: ${message}${code === "" ? "" : ` [${code}]`}`;
+  }).join("");
+}
+function violationSubject(violation) {
+  const key = typeof violation["key"] === "string" ? clean(violation["key"]) : null;
+  const index = typeof violation["index"] === "number" ? `steps[${violation["index"]}]` : null;
+  const issue = typeof violation["issue"] === "string" ? clean(violation["issue"]) : null;
+  if (key !== null) {
+    const where = index ?? issue;
+    return where === null ? `step "${key}"` : `step "${key}" (${where})`;
+  }
+  return issue ?? index ?? "plan";
+}
+function relationsSection(relations) {
+  if (!Array.isArray(relations) || relations.length === 0) return "";
+  const lines = relations.map((relation) => `  ${str(relation["direction"]).padEnd(14)}${str(relation["other_issue"])}
+`).join("");
+  return "\nRelations:\n" + lines;
+}
+function childrenSection(children) {
+  if (!Array.isArray(children) || children.length === 0) return "";
+  const lines = children.map((child) => {
+    const state = str(path(child, "state", "name")) || "-";
+    return `  ${str(child["identifier"])}  [${state}]  ${truncate(child["title"])}
+`;
+  }).join("");
+  return "\nSub-issues:\n" + lines;
+}
+function commentsSection(comments2) {
+  if (!Array.isArray(comments2) || comments2.length === 0) return "";
+  const lines = comments2.map((comment2) => {
+    const author = clean(path(comment2, "author", "name") ?? "unknown");
+    return `  [${str(comment2["inserted_at"])}] ${author}: ${truncate(comment2["body"])}
+`;
+  }).join("");
+  return "\nComments:\n" + lines;
+}
+function imagesSection(images) {
+  if (images.length === 0) return "";
+  const lines = images.map((image) => `  [${image["source"]}] ${clean(image["path"])}
+`).join("");
+  return "\nImages (attachments downloaded locally \u2014 read them, they are part of the issue):\n" + lines;
+}
+function labelsLine(labels) {
+  if (!Array.isArray(labels) || labels.length === 0) return null;
+  return labels.map((label) => clean(label["name"])).join(", ");
+}
+function blockedLine(issue) {
+  if (issue["blocked"] === true && Array.isArray(issue["blocked_by"])) {
+    const notes = blockerNotes(issue["blockers"]);
+    const blockers = issue["blocked_by"].map((blocker) => {
+      const identifier = String(blocker);
+      const note = notes.get(identifier);
+      return note === void 0 ? identifier : `${identifier} (${note})`;
+    });
+    return `yes, by ${blockers.join(", ")}`;
+  }
+  return null;
+}
+function blockerNotes(blockers) {
+  const notes = /* @__PURE__ */ new Map();
+  if (!Array.isArray(blockers)) return notes;
+  for (const blocker of blockers) {
+    if (typeof blocker !== "object" || blocker === null) continue;
+    const record = blocker;
+    if (typeof record["identifier"] !== "string") continue;
+    const reasons = [];
+    if (record["state_type"] === "canceled") reasons.push("cancelled");
+    if (record["archived"] === true) reasons.push("archived");
+    if (reasons.length > 0) notes.set(record["identifier"], reasons.join(", "));
+  }
+  return notes;
+}
+function indent(text) {
+  return cleanMultiline(text).split("\n").map((line) => "  " + line).join("\n");
+}
+function cleanMultiline(text) {
+  return text.split("\n").map((line) => clean(line)).join("\n");
+}
+function truncate(text) {
+  if (text === null || text === void 0) return "";
+  const cleaned = clean(text);
+  const pieces = graphemes(cleaned);
+  if (pieces.length > TITLE_WIDTH) {
+    return pieces.slice(0, TITLE_WIDTH - 1).join("") + "\u2026";
+  }
+  return cleaned;
+}
+function str(value) {
+  return value === null || value === void 0 ? "" : String(value);
+}
+function path(record, ...keys) {
+  let current = record;
+  for (const key of keys) {
+    if (typeof current !== "object" || current === null) return null;
+    current = current[key];
+  }
+  return current ?? null;
+}
+
+// src/commands/issues.ts
+import { openAsBlob, openSync, closeSync, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+import { basename, extname } from "path";
+
+// src/core/attachments.ts
+import { chmodSync, mkdirSync, renameSync, rmSync, statSync, writeFileSync } from "fs";
+import { dirname, join } from "path";
+var REF = /\/(?:uploads\/harness|api\/v1)\/attachments\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\/([A-Za-z0-9._-]*\.(?:png|jpe?g|webp|gif))(?![A-Za-z0-9._-])/gi;
+var SOURCES = [
+  ["description", "description"],
+  ["design", "design"],
+  ["acceptance_criteria", "acceptance criteria"],
+  ["notes", "notes"]
+];
+var MAX_IMAGES_PER_SHOW = 20;
+var MAX_ATTACHMENT_BYTES = 25e6;
+function refs(issue) {
+  const texts = SOURCES.map(([field3, source]) => [issue[field3], source]);
+  const comments2 = Array.isArray(issue["comments"]) ? issue["comments"] : [];
+  for (const comment2 of comments2) texts.push([comment2["body"], "comment"]);
+  const found = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [text, source] of texts) {
+    if (typeof text !== "string" || text === "") continue;
+    for (const match of text.matchAll(REF)) {
+      const ref = {
+        attachmentId: match[1].toLowerCase(),
+        file: match[2],
+        source
+      };
+      const key = `${ref.attachmentId}/${ref.file}`;
+      if (!seen.has(key)) {
+        seen.add(key);
+        found.push(ref);
+      }
+    }
+  }
+  return found;
+}
+async function fetchImages(client, issue, cacheDir) {
+  const allRefs = refs(issue);
+  const wanted = allRefs.slice(0, MAX_IMAGES_PER_SHOW);
+  const dropped = allRefs.slice(MAX_IMAGES_PER_SHOW);
+  const images = [];
+  const failures = [];
+  for (const ref of wanted) {
+    const result = await download(client, ref, cacheDir);
+    if (result.ok) {
+      images.push({
+        attachment_id: ref.attachmentId,
+        file: ref.file,
+        path: result.path,
+        source: ref.source
+      });
+    } else {
+      failures.push(`${ref.file}: ${result.message}`);
+    }
+  }
+  if (dropped.length > 0) {
+    failures.push(
+      `${dropped.length} further reference(s) skipped \u2014 the cap is ${MAX_IMAGES_PER_SHOW} images per show`
+    );
+  }
+  return { images, failures };
+}
+async function download(client, ref, cacheDir) {
+  const path2 = join(cacheDir, hostSegment(client.baseUrl), ref.attachmentId, ref.file);
+  try {
+    if (statSync(path2).size > 0) return { ok: true, path: path2 };
+  } catch {
+  }
+  const bytes = await fetchBytes(client, ref);
+  if (!bytes.ok) return bytes;
+  return write(path2, bytes.bytes);
+}
+function hostSegment(baseUrl) {
+  let host = "unknown-host";
+  let port = null;
+  try {
+    const parsed = new URL(baseUrl);
+    host = parsed.hostname.toLowerCase().replace(/[^a-z0-9.-]/g, "_");
+    port = parsed.port === "" ? null : Number(parsed.port);
+  } catch {
+  }
+  return port === null || port === 80 || port === 443 ? host : `${host}_${port}`;
+}
+async function fetchBytes(client, ref) {
+  let bytes;
+  try {
+    bytes = await client.getBytes(`/api/v1/attachments/${ref.attachmentId}/${ref.file}`);
+  } catch (error) {
+    if (error instanceof HttpError) return { ok: false, message: `${error.message} (HTTP ${error.status})` };
+    if (error instanceof TransportError) return { ok: false, message: error.message };
+    throw error;
+  }
+  if (bytes.byteLength > MAX_ATTACHMENT_BYTES) {
+    return { ok: false, message: `response is larger than the ${MAX_ATTACHMENT_BYTES}-byte attachment cap` };
+  }
+  if (!isImage(bytes)) return { ok: false, message: "response is not an image" };
+  return { ok: true, bytes };
+}
+function isImage(bytes) {
+  const startsWith = (prefix) => prefix.every((byte, index) => bytes[index] === byte);
+  if (startsWith([137, 80, 78, 71, 13, 10, 26, 10])) return true;
+  if (startsWith([255, 216, 255])) return true;
+  if (startsWith([71, 73, 70, 56, 55, 97])) return true;
+  if (startsWith([71, 73, 70, 56, 57, 97])) return true;
+  if (startsWith([82, 73, 70, 70]) && bytes.length >= 12) {
+    return bytes[8] === 87 && bytes[9] === 69 && bytes[10] === 66 && bytes[11] === 80;
+  }
+  return false;
+}
+var partialCounter = 0;
+function write(path2, bytes) {
+  const partial = `${path2}.partial.${process.pid}.${++partialCounter}`;
+  try {
+    mkdirSync(dirname(path2), { recursive: true });
+    chmodSync(dirname(path2), 448);
+    writeFileSync(partial, bytes);
+    chmodSync(partial, 384);
+    renameSync(partial, path2);
+    return { ok: true, path: path2 };
+  } catch (error) {
+    rmSync(partial, { force: true });
+    const detail = error instanceof Error ? error.message : String(error);
+    return { ok: false, message: `cannot write ${path2}: ${detail}` };
+  }
+}
+
+// src/core/pagination.ts
+function notices(meta, requestedPageSize, records5) {
+  return capNotice(meta, requestedPageSize) + truncationNotice(meta, records5);
+}
+function capNotice(meta, requestedPageSize) {
+  const served = meta?.page_size;
+  if (typeof served === "number" && typeof requestedPageSize === "number" && requestedPageSize > served) {
+    return `harness: --limit ${requestedPageSize} was capped at ${served} by the server.
+`;
+  }
+  return "";
+}
+function truncationNotice(meta, records5) {
+  const total = meta?.total;
+  const page = meta?.page;
+  const pages = meta?.total_pages;
+  if (typeof total !== "number" || typeof page !== "number" || typeof pages !== "number") return "";
+  const shown = records5.length;
+  if (shown < total) {
+    return `harness: showing ${shown} of ${total} (page ${page} of ${pages}) \u2014 pass --all for the rest, or --page to step through.
+`;
+  }
+  return "";
+}
+async function fetchEveryPage(fetchPage) {
+  const first = await fetchPage(1);
+  const totalPages = pageCount(first.meta);
+  if (totalPages === null) return first.data;
+  let records5 = first.data;
+  for (let page = 2; page <= totalPages; page++) {
+    const body = await fetchPage(page);
+    records5 = dedupe([...records5, ...body.data]);
+  }
+  return records5;
+}
+function pageCount(meta) {
+  const total = meta?.total_pages;
+  return typeof total === "number" && total > 0 ? total : null;
+}
+function dedupe(records5) {
+  const seen = /* @__PURE__ */ new Set();
+  return records5.filter((record) => {
+    const id = record["id"];
+    const key = id === void 0 || id === null ? `struct:${stableKey(record)}` : `id:${stableKey(id)}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+function stableKey(value) {
+  return JSON.stringify(
+    value,
+    (_field, nested) => nested !== null && typeof nested === "object" && !Array.isArray(nested) ? Object.fromEntries(Object.entries(nested).sort(([a], [b]) => a < b ? -1 : 1)) : nested
+  );
+}
+
+// src/commands/issues.ts
+var PRIORITY_NAMES = { urgent: 1, high: 2, medium: 3, low: 4, none: 0 };
+var PRIORITY_RANK = { 1: 0, 2: 1, 3: 2, 4: 3, 0: 4 };
+var STATUS_STATE_TYPES = {
+  open: "backlog,unstarted",
+  in_progress: "started",
+  closed: "completed,canceled"
+};
+var MAX_IDEMPOTENCY_KEY_BYTES = 200;
+var IDEMPOTENCY_KEY_FORMAT = /^[\x21-\x7e](?:[\x20-\x7e]*[\x21-\x7e])?(?![\s\S])/;
+var IDENTIFIER_FORMAT = /^[A-Za-z][A-Za-z0-9]*-\d+$/;
+var UUID_FORMAT = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isUuid(value) {
+  return UUID_FORMAT.test(value);
+}
+function requireIdentifiers(identifiers) {
+  const bad = identifiers.filter((identifier) => !IDENTIFIER_FORMAT.test(identifier));
+  if (bad.length > 0) {
+    throw new UsageError(`not an issue identifier: ${bad.join(", ")} (expected e.g. ALL-4223)`);
+  }
+}
+async function ready(ctx, opts) {
+  if (opts.claim === true) return claimNext(ctx, opts);
+  const params = { ...listParams(ctx, opts), ready: true };
+  const { records: records5, notice } = await fetchIssues(ctx, params, opts);
+  const rank = (issue) => PRIORITY_RANK[issue["priority"]] ?? 4;
+  const sorted = markAgentSteps([...records5].sort((a, b) => rank(a) - rank(b)));
+  return { json: sorted, human: issuesTable(sorted, { markAgentSteps: true }), notice };
+}
+function markAgentSteps(issues) {
+  return issues.map((issue) => ({ ...issue, agent_step: isAgentStep(issue) }));
+}
+function requireReadyClaimArgs(opts) {
+  const paging = [
+    opts.all === true ? "--all" : null,
+    opts.limit !== void 0 ? "--limit" : null,
+    opts.page !== void 0 ? "--page" : null
+  ].filter((flag) => flag !== null);
+  if (paging.length === 0) return;
+  const last = paging.pop();
+  const flags = paging.length === 0 ? last : `${paging.join(", ")} or ${last}`;
+  throw new UsageError(
+    `--claim cannot be combined with ${flags}: the server picks from the team's whole ready queue, so there are no pages to choose from`
+  );
+}
+async function claimNext(ctx, opts) {
+  requireReadyClaimArgs(opts);
+  const team = requiredTeam(ctx, opts.team);
+  const check = `check \`harness list --team ${team} --assignee me --status in_progress\``;
+  const unreadable = (why) => new CommandError(`The claim-next response ${why}, so an issue may have been claimed \u2014 ${check}.`);
+  let body;
+  try {
+    body = await ctx.client.post(`/api/v1/teams/${team}/issues/claim-next`);
+  } catch (error) {
+    if (error instanceof MalformedResponseError) throw unreadable(`could not be read (${error.message})`);
+    if (error instanceof TransportError) {
+      throw new TransportError(
+        `${error.message} \u2014 if the request reached the server, an issue may have been claimed; ${check} before claiming again`
+      );
+    }
+    throw error;
+  }
+  if (body.data === null) {
+    return { json: null, human: `Nothing to claim: team ${team} has no unassigned ready issues.
+` };
+  }
+  const claimed = body.data;
+  if (!isIssueRecord(claimed)) throw unreadable("carried neither an issue nor null");
+  return {
+    json: claimed,
+    human: `Claimed ${str2(claimed["identifier"])}: ${clean(claimed["title"])}
+`
+  };
+}
+function isIssueRecord(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const identifier = value["identifier"];
+  return typeof identifier === "string" && identifier !== "";
+}
+async function blocked(ctx, opts) {
+  const params = { ...listParams(ctx, opts), blocked: true };
+  const { records: records5, notice } = await fetchIssues(ctx, params, opts);
+  return { json: records5, human: issuesTable(records5), notice };
+}
+async function list(ctx, opts) {
+  const params = listParams(ctx, opts);
+  const { records: records5, notice } = await fetchIssues(ctx, params, opts);
+  return { json: records5, human: issuesTable(records5), notice };
+}
+async function search(ctx, queryWords, opts) {
+  if (queryWords.length === 0) throw new UsageError("usage: harness search <query>");
+  const deprecation = opts.page !== void 0 || opts.all === true ? "--page/--all are ignored: search returns one ranked list, capped at 20" : void 0;
+  let params = { q: queryWords.join(" ") };
+  if (opts.limit !== void 0) params = { ...params, limit: opts.limit };
+  const body = await ctx.client.get("/api/v1/issues/search", params);
+  const meta = body.meta ?? {};
+  const degraded = meta["mode"] === "lexical" ? "semantic search unavailable \u2014 showing lexical matches only" : void 0;
+  const notice = [deprecation, degraded].filter(Boolean).join("; ") || void 0;
+  return { json: body.data, human: issuesTable(body.data), notice };
+}
+async function show(ctx, identifier, opts) {
+  requireIdentifiers([identifier]);
+  const body = await ctx.client.get(`/api/v1/issues/${identifier}`, {
+    include: "relations,children,comments"
+  });
+  const issue = body.data;
+  let images = [];
+  let failures = [];
+  if (opts.images !== false) {
+    ({ images, failures } = await fetchImages(ctx.client, issue, ctx.config.cacheDir));
+  }
+  const json2 = images.length === 0 ? issue : { ...issue, local_images: images };
+  const human = issueDetail(issue, images);
+  const notice = failures.map((failure) => `harness: image not downloaded: ${clean(failure)}
+`).join("");
+  return notice === "" ? { json: json2, human } : { json: json2, human, notice };
+}
+var ACTIVITY_MAX_LIMIT = 100;
+var ACTIVITY_INCLUDE = "condition_events,field_events";
+var ACTIVITY_INCLUDE_WITHOUT_FIELDS = "condition_events";
+var ACTIVITY_WITHOUT_FIELDS_NOTICE = "harness: this server doesn't record field changes yet; showing activity without them.\n";
+async function activity(ctx, identifier, opts) {
+  requireIdentifiers([identifier]);
+  const first = await firstActivityPage(ctx, identifier, opts.limit);
+  const include = first.include;
+  let { page, notice } = first;
+  let entries = page.entries;
+  if (opts.all === true) {
+    const pages = [page.entries];
+    const seenCursors = /* @__PURE__ */ new Set();
+    while (page.hasMore) {
+      const cursor = page.nextCursor;
+      if (seenCursors.has(cursor)) {
+        throw new CommandError("Activity response repeated a cursor.");
+      }
+      seenCursors.add(cursor);
+      page = await activityPage(ctx, identifier, include, opts.limit, cursor);
+      pages.push(page.entries);
+    }
+    entries = pages.reverse().flat();
+  }
+  if (opts.all !== true && page.hasMore) {
+    notice += `harness: showing the newest ${entries.length} activity entries \u2014 pass --all for older activity.
+`;
+  }
+  return { json: entries, human: activityEntries(entries), notice: notice === "" ? void 0 : notice };
+}
+async function firstActivityPage(ctx, identifier, limit) {
+  try {
+    const page2 = await activityPage(ctx, identifier, ACTIVITY_INCLUDE, limit);
+    return { page: page2, include: ACTIVITY_INCLUDE, notice: "" };
+  } catch (error) {
+    if (!refusesInclude(error)) throw error;
+  }
+  const page = await activityPage(ctx, identifier, ACTIVITY_INCLUDE_WITHOUT_FIELDS, limit);
+  return { page, include: ACTIVITY_INCLUDE_WITHOUT_FIELDS, notice: ACTIVITY_WITHOUT_FIELDS_NOTICE };
+}
+function refusesInclude(error) {
+  if (!(error instanceof HttpError) || error.status !== 400) return false;
+  const message = error.body["message"];
+  return typeof message === "string" && /\binclude\b/.test(message) && /\b(condition_events|field_events)\b|\baccepts only\b/.test(message);
+}
+async function activityPage(ctx, identifier, include, limit, before) {
+  const body = await ctx.client.get(`/api/v1/issues/${identifier}/activity`, {
+    limit,
+    before,
+    include
+  });
+  if (!Array.isArray(body.data)) throw new CommandError("Activity response data is not an array.");
+  if (body.data.some((entry) => typeof entry !== "object" || entry === null || Array.isArray(entry))) {
+    throw new CommandError("Activity response contains a non-object entry.");
+  }
+  const meta = body.meta;
+  if (typeof meta !== "object" || meta === null) {
+    throw new CommandError("Activity response has no pagination metadata.");
+  }
+  const hasMore = meta.has_more;
+  const nextCursor = meta.next_cursor;
+  if (typeof hasMore !== "boolean") {
+    throw new CommandError("Activity response has an invalid has_more value.");
+  }
+  if (nextCursor !== null && typeof nextCursor !== "string") {
+    throw new CommandError("Activity response has an invalid next_cursor value.");
+  }
+  if (hasMore) {
+    if (nextCursor === null || nextCursor === "") {
+      throw new CommandError("Activity response says older entries exist but provides no cursor.");
+    }
+    if (body.data.length === 0) {
+      throw new CommandError("Activity response says older entries exist but contains no entries.");
+    }
+    return { entries: body.data, hasMore: true, nextCursor };
+  }
+  if (nextCursor !== null) {
+    throw new CommandError("Activity response provides a cursor when no older entries exist.");
+  }
+  return { entries: body.data, hasMore: false, nextCursor: null };
+}
+async function stats2(ctx) {
+  const body = await ctx.client.get("/api/v1/stats");
+  return { json: body.data, human: stats(body.data) };
+}
+async function prime(ctx) {
+  const statsBody = await ctx.client.get("/api/v1/stats");
+  const ready2 = markAgentSteps(await mostImportantReady(ctx));
+  const json2 = { stats: statsBody.data, ready: ready2 };
+  const human = "# Harness workflow context\n\n" + stats(statsBody.data) + "\nReady to work:\n" + issuesTable(ready2, { markAgentSteps: true }) + `
+Workflow: harness ready \u2192 harness update <id> --claim \u2192 work \u2192
+harness close <id> --reason "Implemented in <commit-hash>" (response
+lists newly unblocked issues \u2014 surface them).
+Create tracked work BEFORE coding: harness create --title "\u2026" --type task.
+Dependencies: harness dep add <issue> <blocker> (blocker blocks issue).
+Before reporting done: close the issues you finished.
+`;
+  return { json: json2, human };
+}
+async function mostImportantReady(ctx) {
+  try {
+    return (await ctx.client.get("/api/v1/issues/next", { limit: 10 })).data;
+  } catch (error) {
+    if (!(error instanceof HttpError) || error.status !== 404) throw error;
+    return (await ctx.client.get("/api/v1/issues", { ready: true, page_size: 10 })).data;
+  }
+}
+async function version(config) {
+  let server;
+  if (config === null || config.baseUrl === "") {
+    server = "unconfigured";
+  } else {
+    server = await new Client(config).serverVersion().catch(() => "unreachable");
+  }
+  return { json: { cli: CLI_VERSION, server }, human: `harness ${CLI_VERSION} (server API ${server})
+` };
+}
+async function create(ctx, opts) {
+  if (opts.title === void 0) {
+    throw new UsageError("usage: harness create --title <title> [--team <key>] \u2026");
+  }
+  validateType(opts.type);
+  const team = requiredTeam(ctx, opts.team);
+  validateIdempotencyKey(opts.idempotencyKey);
+  const priority = optionalPriority(opts.priority);
+  const dueDate = optionalDueDate(opts.dueDate);
+  const labels = requestedLabelNames(wantedLabels(opts));
+  const labelIds = await prepareCreateLabelIds(ctx, team, labels);
+  let body = { title: opts.title };
+  body = putOpt(body, "description", opts.description);
+  body = putOpt(body, "design", opts.design);
+  body = putOpt(body, "notes", opts.notes);
+  body = putOpt(body, "acceptance_criteria", opts.acceptance);
+  body = putOpt(body, "parent", opts.parent);
+  body = putPresent(body, "priority", priority);
+  body = putDueDate(body, dueDate);
+  body = putAssignee(body, opts.assignee);
+  if (labelIds.length > 0) body["label_ids"] = labelIds;
+  const created = await ctx.client.post(`/api/v1/teams/${team}/issues`, body, {
+    idempotencyKey: opts.idempotencyKey
+  });
+  const issue = created.data;
+  return {
+    json: issue,
+    human: `Created ${str2(issue["identifier"])}: ${clean(issue["title"])}
+`
+  };
+}
+function validateIdempotencyKey(key) {
+  if (key === void 0) return;
+  if (key.trim() === "") throw new UsageError("idempotency key must not be blank");
+  if (Buffer.byteLength(key, "utf8") > MAX_IDEMPOTENCY_KEY_BYTES) {
+    throw new UsageError(`idempotency key must not exceed ${MAX_IDEMPOTENCY_KEY_BYTES} UTF-8 bytes`);
+  }
+  if (!IDEMPOTENCY_KEY_FORMAT.test(key)) {
+    throw new UsageError("idempotency key must use printable ASCII and cannot start or end with a space");
+  }
+}
+async function update(ctx, identifier, opts) {
+  requireIdentifiers([identifier]);
+  if (opts.notes !== void 0 && opts.appendNotes !== void 0) {
+    throw new UsageError("--notes replaces and --append-notes appends \u2014 pass one, not both");
+  }
+  if (opts.claim === true && opts.assignee !== void 0) {
+    throw new UsageError(
+      "--claim takes the issue and starts it; --assignee only sets the field \u2014 pass one, not both (--claim to take it yourself, --assignee to hand it to someone)"
+    );
+  }
+  const priority = optionalPriority(opts.priority);
+  const dueDate = optionalDueDate(opts.dueDate);
+  const addLabels = requestedLabelInputs(opts.addLabel ?? []);
+  const removeLabels = requestedLabelInputs(opts.removeLabel ?? []);
+  const labelPlan = addLabels.length > 0 || removeLabels.length > 0 ? await prepareLabelUpdate(ctx, identifier, addLabels, removeLabels) : null;
+  let issue = labelPlan?.issue ?? null;
+  let wrote = false;
+  if (opts.claim === true) {
+    try {
+      const body = await ctx.client.post(`/api/v1/issues/${identifier}/claim`);
+      issue = body.data;
+    } catch (error) {
+      throw explainClaimRefusal(error, identifier);
+    }
+    wrote = true;
+  }
+  let patch = {};
+  patch = putOpt(patch, "title", opts.title);
+  patch = putOpt(patch, "description", opts.description);
+  patch = putOpt(patch, "design", opts.design);
+  patch = putOpt(patch, "notes", opts.notes);
+  patch = putOpt(patch, "acceptance_criteria", opts.acceptance);
+  patch = putOpt(patch, "parent", opts.parent);
+  patch = putPresent(patch, "priority", priority);
+  patch = putDueDate(patch, dueDate);
+  patch = putAssignee(patch, opts.assignee);
+  if (opts.appendNotes !== void 0) {
+    const current = await ctx.client.get(`/api/v1/issues/${identifier}`);
+    const existing = current.data["notes"];
+    const combined = existing === null || existing === void 0 || existing === "" ? opts.appendNotes : `${str2(existing)}
+
+${opts.appendNotes}`;
+    patch["notes"] = combined;
+  }
+  if (Object.keys(patch).length > 0) {
+    const body = await ctx.client.patch(`/api/v1/issues/${identifier}`, patch);
+    issue = body.data;
+    wrote = true;
+  }
+  if (opts.state !== void 0) {
+    issue = await setState(ctx, identifier, opts.state);
+    wrote = true;
+  }
+  if (labelPlan?.changed === true) {
+    const body = await ctx.client.put(`/api/v1/issues/${identifier}/labels`, {
+      label_ids: labelPlan.ids
+    });
+    issue = body.data;
+    wrote = true;
+  }
+  if (issue === null) {
+    throw new UsageError("usage: harness update <id> --claim | --title \u2026 | --state <name> | \u2026");
+  }
+  const human = wrote ? `Updated ${str2(issue["identifier"])}
+` : `Labels already up to date for ${str2(issue["identifier"])}
+`;
+  return { json: issue, human };
+}
+var CLAIM_REFUSAL_HINTS = {
+  // The edit holds a released step, so the plan needs releasing again before
+  // the step is claimable.
+  agent_step: () => "Operator runs it for its plan; to do it yourself, set its executor to none (harness plan edit <plan-id>) and release the plan again",
+  waiting_on_condition: (identifier) => `harness show ${identifier} lists what it waits on; tick a gate with harness gate satisfy ${identifier} <gate>`
+};
+function explainClaimRefusal(error, identifier) {
+  if (!(error instanceof HttpError) || error.status !== 409) return error;
+  const reason = error.body["reason"];
+  const hint = typeof reason === "string" && Object.hasOwn(CLAIM_REFUSAL_HINTS, reason) ? CLAIM_REFUSAL_HINTS[reason](identifier) : void 0;
+  if (hint === void 0) return error;
+  return new HttpError(error.status, `${error.message} \u2014 ${hint}`, error.body, error.retryAfter);
+}
+function requireCloseArgs(identifiers, opts) {
+  if (identifiers.length === 0) {
+    throw new UsageError(
+      "usage: harness close <id> [<id>\u2026] [--reason <text>] [--cancel | --duplicate-of <id>]"
+    );
+  }
+  requireIdentifiers(identifiers);
+  if (opts.duplicateOf === void 0) return;
+  requireIdentifiers([opts.duplicateOf]);
+  if (opts.cancel === true) {
+    throw new UsageError("--duplicate-of and --cancel are mutually exclusive");
+  }
+  if (identifiers.length !== 1) {
+    throw new UsageError("--duplicate-of accepts exactly one source issue");
+  }
+}
+async function close(ctx, identifiers, opts) {
+  requireCloseArgs(identifiers, opts);
+  let body = {};
+  body = putPresent(body, "reason", opts.reason);
+  body = putPresent(body, "cancel", opts.cancel);
+  body = putPresent(body, "duplicate_of", opts.duplicateOf);
+  const results = [];
+  for (const identifier of identifiers) {
+    try {
+      const response = await ctx.client.post(`/api/v1/issues/${identifier}/close`, body);
+      results.push({ identifier, ok: true, response });
+    } catch (error) {
+      if (error instanceof HttpError || error instanceof TransportError) {
+        results.push({ identifier, ok: false, error: explainExpertRefusal(error, ctx.config.token) });
+      } else {
+        throw error;
+      }
+    }
+  }
+  const human = results.map((result) => closeLine(result, opts.duplicateOf)).join("");
+  const json2 = results.map(
+    (result) => result.ok ? {
+      identifier: result.identifier,
+      closed: true,
+      ...opts.duplicateOf === void 0 ? {} : { duplicate_of: opts.duplicateOf },
+      unblocked: result.response["unblocked"] ?? null,
+      // Passed through as sent: older servers omit it, and so does this.
+      ..."still_blocking" in result.response ? { still_blocking: result.response["still_blocking"] } : {}
+    } : { identifier: result.identifier, closed: false, error: errorText(result.error) }
+  );
+  const partial = results.some((result) => !result.ok);
+  return partial ? { json: json2, human, partial: true } : { json: json2, human };
+}
+function closeLine(result, duplicateOf) {
+  if (!result.ok) return `FAILED ${result.identifier}: ${errorText(result.error)}
+`;
+  const closure = duplicateOf === void 0 ? `Closed ${result.identifier}` : `Closed ${result.identifier} as duplicate of ${duplicateOf}`;
+  const unblocked = result.response["unblocked"];
+  const line = Array.isArray(unblocked) && unblocked.length > 0 ? `${closure} \u2014 unblocked: ${unblocked.map((identifier) => clean(identifier)).join(", ")}
+` : `${closure}
+`;
+  return line + stillBlockingLine(result.response["still_blocking"]);
+}
+function stillBlockingLine(stillBlocking) {
+  if (!Array.isArray(stillBlocking) || stillBlocking.length === 0) return "";
+  const identifiers = stillBlocking.map((identifier) => clean(identifier)).join(", ");
+  return `  Still blocking: ${identifiers} (a cancelled issue still blocks its dependents)
+`;
+}
+async function archive(ctx, identifiers, opts) {
+  if (identifiers.length === 0) {
+    throw new UsageError("usage: harness archive <id> [<id>\u2026] [--restore]");
+  }
+  requireIdentifiers(identifiers);
+  const archived = opts.restore !== true;
+  const verb = archived ? "Archived" : "Restored";
+  const results = [];
+  for (const identifier of identifiers) {
+    try {
+      const body = await ctx.client.put(`/api/v1/issues/${identifier}/archive_state`, { archived });
+      results.push({ identifier, ok: true, issue: body.data });
+    } catch (error) {
+      if (error instanceof HttpError || error instanceof TransportError) {
+        results.push({ identifier, ok: false, error: explainExpertRefusal(error, ctx.config.token) });
+      } else {
+        throw error;
+      }
+    }
+  }
+  const human = results.map(
+    (result) => result.ok ? `${verb} ${result.identifier}
+` : `FAILED ${result.identifier}: ${errorText(result.error)}
+`
+  ).join("");
+  const json2 = results.map(
+    (result) => result.ok ? { identifier: result.identifier, archived } : { identifier: result.identifier, error: errorText(result.error) }
+  );
+  const partial = results.some((result) => !result.ok);
+  return partial ? { json: json2, human, partial: true } : { json: json2, human };
+}
+async function comments(ctx, identifier) {
+  requireIdentifiers([identifier]);
+  const body = await ctx.client.get(`/api/v1/issues/${identifier}/comments`);
+  if (body.data.length === 0) return { json: body.data, human: "No comments.\n" };
+  const human = body.data.map((comment2) => {
+    const author = clean((comment2["author"] ?? {})["name"] ?? "unknown");
+    const id = clean(comment2["id"] ?? "unknown id");
+    const text = cleanMultiline(str2(comment2["body"])).split("\n").map((line) => "  " + line).join("\n");
+    return `[${str2(comment2["inserted_at"])}] ${author} (${id}):
+${text}
+`;
+  }).join("\n");
+  return { json: body.data, human };
+}
+async function dep(ctx, verb, issue, blocker) {
+  requireIdentifiers([issue, blocker]);
+  if (verb === "add") {
+    const response = await ctx.client.post(`/api/v1/issues/${issue}/relations`, {
+      type: "blocked_by",
+      related_issue: blocker
+    });
+    return { json: response.data, human: `${blocker} now blocks ${issue}
+` };
+  }
+  if (verb === "rm") {
+    const body = await ctx.client.get(`/api/v1/issues/${issue}/relations`);
+    const relation = (body.data ?? []).find(
+      (candidate) => candidate["direction"] === "blocked_by" && candidate["other_issue"] === blocker
+    );
+    if (relation === void 0) throw new CommandError(`${blocker} does not block this issue.`);
+    await ctx.client.delete(`/api/v1/issues/${issue}/relations/${str2(relation["id"])}`);
+    return { json: { deleted: relation["id"] }, human: `${blocker} no longer blocks ${issue}
+` };
+  }
+  throw new UsageError("usage: harness dep add|rm <issue> <blocker>  (the blocker blocks the issue)");
+}
+var RELATION_CREATE_TYPES = [
+  "blocks",
+  "blocked_by",
+  "related",
+  "duplicate",
+  "duplicate_of",
+  "duplicated_by"
+];
+var RELATION_UPDATE_TYPES = ["blocks", "blocked_by", "related", "duplicate_of"];
+function requireRelationType(type, allowed, operation) {
+  if (!allowed.includes(type)) {
+    throw new UsageError(`relation ${operation} type must be one of: ${allowed.join(", ")}`);
+  }
+}
+async function findRelation(ctx, issue, idOrIssue) {
+  const response = await ctx.client.get(`/api/v1/issues/${issue}/relations`);
+  const idMatch = response.data.find((candidate) => candidate["id"] === idOrIssue);
+  if (idMatch !== void 0) return idMatch;
+  const issueMatches = response.data.filter((candidate) => candidate["other_issue"] === idOrIssue);
+  if (issueMatches.length > 1) {
+    throw new CommandError(`multiple relations on ${issue} match ${idOrIssue}; use a relation id`);
+  }
+  if (issueMatches.length === 0) {
+    throw new CommandError(`no relation on ${issue} matches ${idOrIssue} (by id or related issue)`);
+  }
+  return issueMatches[0];
+}
+async function resolveRelationId(ctx, issue, idOrIssue) {
+  if (isUuid(idOrIssue)) return idOrIssue.toLowerCase();
+  const relation = await findRelation(ctx, issue, idOrIssue);
+  return String(relation["id"]);
+}
+async function relationList(ctx, issue) {
+  requireIdentifiers([issue]);
+  const response = await ctx.client.get(`/api/v1/issues/${issue}/relations`);
+  const human = response.data.length === 0 ? "No relations.\n" : table(
+    ["ID", "DIRECTION", "ISSUE"],
+    response.data.map((relation) => [
+      String(relation["id"] ?? ""),
+      String(relation["direction"] ?? ""),
+      String(relation["other_issue"] ?? "")
+    ])
+  );
+  return { json: response.data, human };
+}
+async function relationAdd(ctx, issue, relatedIssue, type) {
+  requireIdentifiers([issue, relatedIssue]);
+  requireRelationType(type, RELATION_CREATE_TYPES, "add");
+  const response = await ctx.client.post(`/api/v1/issues/${issue}/relations`, {
+    type,
+    related_issue: relatedIssue
+  });
+  return { json: response.data, human: `Related ${issue} to ${relatedIssue} as ${type}
+` };
+}
+async function relationUpdate(ctx, issue, idOrIssue, type) {
+  requireIdentifiers([issue]);
+  requireRelationType(type, RELATION_UPDATE_TYPES, "update");
+  const id = await resolveRelationId(ctx, issue, idOrIssue);
+  const response = await ctx.client.patch(`/api/v1/issues/${issue}/relations/${id}`, { type });
+  return { json: response.data, human: `Updated relation ${id} on ${issue} to ${type}
+` };
+}
+async function relationRm(ctx, issue, idOrIssue) {
+  requireIdentifiers([issue]);
+  const id = await resolveRelationId(ctx, issue, idOrIssue);
+  await ctx.client.delete(`/api/v1/issues/${issue}/relations/${id}`);
+  return { json: { deleted: id }, human: `Removed relation ${id} from ${issue}
+` };
+}
+async function comment(ctx, identifier, textWords, mentions) {
+  requireIdentifiers([identifier]);
+  if (textWords.length === 0) {
+    throw new UsageError("usage: harness comment <id> <text> [--mention NAME]\u2026");
+  }
+  const body = { body: textWords.join(" ") };
+  if (mentions.length > 0) body["mentions"] = mentions;
+  const response = await ctx.client.post(`/api/v1/issues/${identifier}/comments`, body);
+  return { json: response.data, human: `Commented on ${identifier}
+` };
+}
+async function editComment(ctx, identifier, commentId, textWords) {
+  requireIdentifiers([identifier]);
+  requireCommentId(commentId);
+  const body = textWords.join(" ");
+  if (body.trim() === "") {
+    throw new UsageError("the comment text is empty \u2014 nothing to edit");
+  }
+  const response = await ctx.client.patch(
+    `/api/v1/issues/${identifier}/comments/${commentId}`,
+    { body }
+  );
+  return {
+    json: response.data,
+    human: `Edited comment ${commentId} on ${identifier}
+`
+  };
+}
+async function deleteComment(ctx, identifier, commentId) {
+  requireIdentifiers([identifier]);
+  requireCommentId(commentId);
+  const response = await ctx.client.delete(
+    `/api/v1/issues/${identifier}/comments/${commentId}`
+  );
+  return {
+    json: response.data,
+    human: `Deleted comment ${commentId} from ${identifier}
+`
+  };
+}
+function requireCommentId(commentId) {
+  if (!UUID_FORMAT.test(commentId)) {
+    throw new UsageError(`not a comment id: ${commentId} (expected a UUID)`);
+  }
+}
+var MAX_IMAGE_BYTES = 25e6;
+var MAX_VIDEO_BYTES = 1e8;
+async function attachImage(ctx, path2) {
+  return uploadAttachment(ctx, path2, MAX_IMAGE_BYTES);
+}
+async function attachFile(ctx, path2) {
+  const maxBytes = extname(path2).toLowerCase() === ".mp4" ? MAX_VIDEO_BYTES : MAX_IMAGE_BYTES;
+  return uploadAttachment(ctx, path2, maxBytes);
+}
+async function uploadAttachment(ctx, path2, maxBytes) {
+  attachableFile(path2, maxBytes);
+  const file = maxBytes === MAX_VIDEO_BYTES ? new File([await openAsBlob(path2)], basename(path2)) : new File([readFileSync2(path2)], basename(path2));
+  requireAttachmentSize(path2, file.size, maxBytes);
+  const form = new FormData();
+  form.set("file", file);
+  const body = await ctx.client.postMultipart("/api/v1/uploads", form, file.size);
+  const attachment = body.data;
+  const markdown = attachment["markdown"];
+  if (typeof markdown !== "string") throw new CommandError("the upload response carried no markdown reference");
+  return { json: attachment, human: clean(markdown) + "\n" };
+}
+function attachableFile(path2, maxBytes) {
+  let fileStats;
+  try {
+    fileStats = statSync2(path2);
+  } catch (error) {
+    throw new LocalError(`cannot read ${path2}: ${posixDetail(error)}`);
+  }
+  if (!fileStats.isFile()) {
+    const kind = fileStats.isDirectory() ? "directory" : "special file";
+    throw new LocalError(`${path2} is a ${kind}, not a file.`);
+  }
+  requireAttachmentSize(path2, fileStats.size, maxBytes);
+  try {
+    closeSync(openSync(path2, "r"));
+  } catch (error) {
+    throw new LocalError(`cannot read ${path2}: ${posixDetail(error)}`);
+  }
+}
+function requireAttachmentSize(path2, size, maxBytes) {
+  if (size > maxBytes) {
+    throw new LocalError(`${path2} is too large: ${size} bytes, and attachments are capped at ${maxBytes}.`);
+  }
+}
+function posixDetail(error) {
+  const code = error.code;
+  if (code === "ENOENT") return "no such file or directory";
+  if (code === "EACCES") return "permission denied";
+  return error instanceof Error ? error.message : String(error);
+}
+async function setState(ctx, identifier, stateName2) {
+  const showBody = await ctx.client.get(`/api/v1/issues/${identifier}`);
+  const teamKey = str2((showBody.data["team"] ?? {})["key"]);
+  const statesBody = await ctx.client.get(
+    `/api/v1/teams/${teamKey}/workflow_states`
+  );
+  const wanted = stateName2.toLowerCase();
+  const state = statesBody.data.find(
+    (candidate) => str2(candidate["name"]).toLowerCase() === wanted || str2(candidate["type"]) === wanted
+  );
+  if (state === void 0) {
+    const names = statesBody.data.map((candidate) => str2(candidate["name"])).join(", ");
+    throw new CommandError(`No workflow state matches "${stateName2}". States: ${names}`);
+  }
+  const body = await ctx.client.put(`/api/v1/issues/${identifier}/state`, { state_id: state["id"] });
+  return body.data;
+}
+var ISSUE_TYPES = ["task", "bug", "feature", "epic"];
+function wantedLabels(opts) {
+  const typeLabels = opts.type === void 0 ? [] : [`type/${opts.type}`];
+  return [...typeLabels, ...opts.label ?? []];
+}
+function validateType(type) {
+  if (type !== void 0 && !ISSUE_TYPES.includes(type)) {
+    throw new UsageError(`not an issue type: ${type} (expected ${ISSUE_TYPES.join(", ")})`);
+  }
+}
+function requestedLabelNames(names) {
+  const unique = /* @__PURE__ */ new Map();
+  for (const name of requestedLabelInputs(names)) {
+    const normalized = normalizeLabelName(name);
+    if (!unique.has(normalized)) unique.set(normalized, name);
+  }
+  return [...unique.values()];
+}
+function requestedLabelInputs(values) {
+  return values.map((value) => {
+    const trimmed = value.trim();
+    if (trimmed === "") throw new UsageError("label names and ids cannot be empty");
+    return trimmed;
+  });
+}
+function normalizeLabelName(value) {
+  return str2(value).trim().toLowerCase();
+}
+async function prepareCreateLabelIds(ctx, teamKey, names) {
+  if (names.length === 0) return [];
+  const teams = await ctx.client.get("/api/v1/teams");
+  const target = teams.data.find(
+    (team) => str2(team["key"]).toLowerCase() === teamKey.toLowerCase()
+  );
+  if (target === void 0) throw new CommandError(`No team matches key "${teamKey}".`);
+  const teamId = str2(target["id"]);
+  if (teamId === "") throw new CommandError(`team ${teamKey} carried no id`);
+  return prepareApplicableLabelIds(ctx, teamId, names);
+}
+async function prepareApplicableLabelIds(ctx, teamId, names) {
+  let labels = (await ctx.client.get("/api/v1/labels")).data;
+  const ids = [];
+  for (const name of names) {
+    const resolved = await resolveOrCreateApplicableLabel(ctx, labels, name, teamId);
+    labels = resolved.catalog;
+    ids.push(labelId(resolved.label));
+  }
+  return [...new Set(ids)];
+}
+function applicableLabel(labels, input, teamId) {
+  const normalized = normalizeLabelName(input);
+  const named = labels.filter((label) => normalizeLabelName(label["name"]) === normalized);
+  const teamMatches = named.filter((label) => label["team_id"] === teamId);
+  if (teamMatches.length > 1) {
+    throw new CommandError(`more than one team label matches "${input}"; use a label id`);
+  }
+  if (teamMatches.length === 1) return teamMatches[0];
+  const workspaceMatches = named.filter(
+    (label) => label["team_id"] === null || label["team_id"] === void 0
+  );
+  if (workspaceMatches.length > 1) {
+    throw new CommandError(`more than one workspace label matches "${input}"; use a label id`);
+  }
+  return workspaceMatches[0];
+}
+async function resolveOrCreateApplicableLabel(ctx, catalog, name, teamId) {
+  const existing = applicableLabel(catalog, name, teamId);
+  if (existing !== void 0) return { label: existing, catalog };
+  try {
+    const created = await ctx.client.post("/api/v1/labels", {
+      name,
+      color: "gray"
+    });
+    return { label: created.data, catalog: [...catalog, created.data] };
+  } catch (error) {
+    if (!(error instanceof HttpError) || error.status !== 422) throw error;
+    const refreshed = (await ctx.client.get("/api/v1/labels")).data;
+    const winner = applicableLabel(refreshed, name, teamId);
+    if (winner === void 0) throw error;
+    return { label: winner, catalog: refreshed };
+  }
+}
+function labelId(label) {
+  const id = str2(label["id"]);
+  if (id === "") throw new CommandError("the label response carried no id");
+  return id;
+}
+async function prepareLabelUpdate(ctx, identifier, addInputs, removeInputs) {
+  const issue = (await ctx.client.get(`/api/v1/issues/${identifier}`)).data;
+  const attached = Array.isArray(issue["labels"]) ? issue["labels"] : [];
+  const originalIds = attached.map(labelId);
+  const removed = /* @__PURE__ */ new Set();
+  for (const input of removeInputs) {
+    const idInput = UUID_FORMAT.test(input);
+    const exact = attached.find((label) => {
+      const id = labelId(label);
+      return idInput ? id.toLowerCase() === input.toLowerCase() : id === input;
+    });
+    if (exact !== void 0) {
+      removed.add(labelId(exact));
+      continue;
+    }
+    const normalized = normalizeLabelName(input);
+    const matches = attached.filter((label) => normalizeLabelName(label["name"]) === normalized);
+    if (matches.length > 1) {
+      throw new CommandError(`more than one attached label matches "${input}"; remove by label id`);
+    }
+    if (matches.length === 1) removed.add(labelId(matches[0]));
+  }
+  const ids = originalIds.filter((id) => !removed.has(id));
+  if (addInputs.length > 0) {
+    const team = issue["team"] ?? {};
+    const teamId = str2(team["id"]);
+    if (teamId === "") throw new CommandError(`issue ${identifier} carried no team id`);
+    let catalog = (await ctx.client.get("/api/v1/labels")).data;
+    for (const input of addInputs) {
+      const idInput = UUID_FORMAT.test(input);
+      let chosen = idInput ? catalog.find((label) => labelId(label).toLowerCase() === input.toLowerCase()) : void 0;
+      if (chosen !== void 0) {
+        const owner = chosen["team_id"];
+        if (owner !== null && owner !== void 0 && owner !== teamId) {
+          throw new CommandError(
+            `label ${input} belongs to another team and cannot be added to ${identifier}`
+          );
+        }
+      } else {
+        if (idInput) throw new CommandError(`No label matches id "${input}".`);
+        const resolved = await resolveOrCreateApplicableLabel(ctx, catalog, input, teamId);
+        chosen = resolved.label;
+        catalog = resolved.catalog;
+      }
+      const id = labelId(chosen);
+      if (!ids.includes(id)) ids.push(id);
+    }
+  }
+  return {
+    issue,
+    ids,
+    changed: ids.length !== originalIds.length || ids.some((id, index) => id !== originalIds[index])
+  };
+}
+async function fetchIssues(ctx, params, opts) {
+  if (opts.all === true && opts.page !== void 0) {
+    throw new UsageError("--all reads every page from the first \u2014 pass --all or --page, not both");
+  }
+  if (opts.all === true) {
+    const records6 = await fetchEveryPage(
+      (page) => ctx.client.get("/api/v1/issues", { ...params, page })
+    );
+    return { records: records6, notice: "" };
+  }
+  const body = await ctx.client.get("/api/v1/issues", params);
+  const records5 = body.data;
+  const requested = typeof params["page_size"] === "number" ? params["page_size"] : void 0;
+  return { records: records5, notice: notices(body.meta, requested, records5) };
+}
+function listParams(ctx, opts) {
+  if (opts.type !== void 0 && opts.label !== void 0) {
+    throw new UsageError("--type is a label filter itself \u2014 pass either --type or --label, not both");
+  }
+  validateType(opts.type);
+  let params = withTeam({ page_size: opts.limit ?? 50, page: opts.page ?? 1 }, ctx, opts);
+  params = putParam(params, "search", opts.search);
+  params = putParam(params, "parent", opts.parent);
+  params = putParam(params, "label", opts.label);
+  params = putParam(params, "scope", opts.scope);
+  params = putParam(params, "assignee", opts.assignee);
+  params = putParam(params, "created_by", opts.createdBy);
+  params = putParam(params, "involved", opts.involved);
+  if (opts.type !== void 0) params = putParam(params, "label", `type/${opts.type}`);
+  if (opts.status !== void 0) {
+    const stateTypes = Object.hasOwn(STATUS_STATE_TYPES, opts.status) ? STATUS_STATE_TYPES[opts.status] : void 0;
+    if (stateTypes === void 0) {
+      throw new UsageError(`status must be one of: ${Object.keys(STATUS_STATE_TYPES).join(", ")}`);
+    }
+    params = putParam(params, "state_type", stateTypes);
+  }
+  const priority = optionalPriority(opts.priority);
+  if (priority !== null) params = putParam(params, "priority", priority);
+  return params;
+}
+function optionalPriority(value) {
+  if (value === void 0) return null;
+  const named = Object.hasOwn(PRIORITY_NAMES, value) ? PRIORITY_NAMES[value] : void 0;
+  if (named !== void 0) return named;
+  if (/^\d+$/.test(value)) {
+    throw new UsageError(
+      `Bare numeric priorities are refused: bd and harness disagree on what
+the numbers mean, so a habit-typed number would silently file the
+wrong priority.
+
+  bd:      0=critical 1=high 2=medium 3=normal 4=backlog
+  harness: 0=none     1=urgent 2=high 3=medium 4=low
+
+Use a name instead: --priority urgent|high|medium|low|none
+`
+    );
+  }
+  throw new UsageError("priority must be one of: urgent, high, medium, low, none");
+}
+function optionalDueDate(value) {
+  if (value === void 0) return null;
+  const trimmed = value.trim();
+  if (trimmed === "") return "clear";
+  const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(trimmed);
+  if (match === null) throw new UsageError(`not a date: ${trimmed} (expected YYYY-MM-DD)`);
+  const [, year, month, day] = match.map(Number);
+  const candidate = /* @__PURE__ */ new Date(0);
+  candidate.setUTCFullYear(year, month - 1, day);
+  const real = candidate.getUTCFullYear() === year && candidate.getUTCMonth() === month - 1 && candidate.getUTCDate() === day;
+  if (!real) throw new UsageError(`not a date: ${trimmed} (no such day on the calendar)`);
+  return trimmed;
+}
+var TEAM_KEY_FORMAT = /^[A-Za-z][A-Za-z0-9]*$/;
+function requiredTeam(ctx, team) {
+  const resolved = team ?? ctx.config.team ?? void 0;
+  if (resolved === void 0) throw new UsageError("No team given. Pass --team <key> or set HARNESS_TEAM.");
+  if (!TEAM_KEY_FORMAT.test(resolved)) throw new UsageError(`not a team key: ${resolved} (expected e.g. ALL)`);
+  return resolved;
+}
+function withTeam(params, ctx, opts) {
+  const team = opts.team ?? ctx.config.team ?? void 0;
+  return team === void 0 ? params : { ...params, team };
+}
+function putParam(params, key, value) {
+  return value === void 0 ? params : { ...params, [key]: value };
+}
+function putOpt(body, field3, value) {
+  return value === void 0 ? body : { ...body, [field3]: value };
+}
+function putPresent(body, key, value) {
+  if (value === null || value === void 0 || value === false) return body;
+  return { ...body, [key]: value };
+}
+function putDueDate(body, dueDate) {
+  if (dueDate === null) return body;
+  if (dueDate === "clear") return { ...body, due_date: null };
+  return { ...body, due_date: dueDate };
+}
+function putAssignee(body, assignee) {
+  if (assignee === void 0) return body;
+  return { ...body, assignee: assignee.trim() === "" ? null : assignee };
+}
+function errorText(error) {
+  if (error instanceof HttpError) return `${clean(error.message)} (HTTP ${error.status})`;
+  return `cannot reach the API: ${clean(error.message)}`;
+}
+function str2(value) {
+  return value === null || value === void 0 ? "" : String(value);
+}
+
+// src/commands/extended.ts
+var SAFE_ID = /^(?!\.{1,2}$)[A-Za-z0-9._-]+$/;
+function requireSafeId(kind, id) {
+  if (!SAFE_ID.test(id)) throw new UsageError(`not a ${kind} id: ${id}`);
+}
+function str3(value) {
+  return value === null || value === void 0 ? "" : String(value);
+}
+function field(row, ...keys) {
+  let current = row;
+  for (const key of keys) {
+    if (typeof current !== "object" || current === null) return null;
+    current = current[key];
+  }
+  return current ?? null;
+}
+function putOpt2(body, key, value) {
+  return value === void 0 ? body : { ...body, [key]: value };
+}
+function putDate(body, key, raw) {
+  const parsed = optionalDueDate(raw);
+  if (parsed === null) return body;
+  return { ...body, [key]: parsed === "clear" ? null : parsed };
+}
+async function paginatedRead(ctx, path2, params, opts) {
+  if (opts.all === true && opts.page !== void 0) {
+    throw new UsageError("--all reads every page from the first \u2014 pass --all or --page, not both");
+  }
+  if (opts.all === true) {
+    const records5 = await fetchEveryPage((page) => ctx.client.get(path2, { ...params, page }));
+    return { records: records5, notice: "" };
+  }
+  const body = await ctx.client.get(path2, params);
+  const requested = typeof params["page_size"] === "number" ? params["page_size"] : void 0;
+  return { records: body.data, notice: notices(body.meta, requested, body.data) };
+}
+async function projectList(ctx, opts) {
+  let params = { page_size: opts.limit ?? 50, page: opts.page ?? 1 };
+  if (opts.search !== void 0) params = { ...params, search: opts.search };
+  if (opts.state !== void 0) params = { ...params, state: opts.state };
+  const { records: records5, notice } = await paginatedRead(ctx, "/api/v1/projects", params, opts);
+  const human = records5.length === 0 ? "No projects.\n" : table(
+    ["ID", "STATE", "LEAD", "TARGET", "NAME"],
+    records5.map((project) => [
+      str3(project["id"]),
+      str3(project["state"]) || "-",
+      str3(field(project, "lead", "name")) || "-",
+      str3(project["target_date"]) || "-",
+      str3(project["name"])
+    ])
+  );
+  return { json: records5, human, notice };
+}
+async function projectShow(ctx, id) {
+  requireSafeId("project", id);
+  const body = await ctx.client.get(`/api/v1/projects/${id}`);
+  const project = body.data;
+  const fields = [
+    ["State", project["state"]],
+    ["Lead", field(project, "lead", "name")],
+    ["Start", project["start_date"]],
+    ["Target", project["target_date"]],
+    ["Updated", project["updated_at"]]
+  ];
+  const fieldLines = fields.filter(([, value]) => value !== null && value !== void 0 && value !== "").map(([label, value]) => `  ${(label + ":").padEnd(12)}${clean(value)}
+`).join("");
+  const sections = [
+    ["Summary", project["summary"]],
+    ["Description", project["description"]]
+  ];
+  const sectionText = sections.filter(([, text]) => text !== null && text !== void 0 && text !== "").map(([title, text]) => `
+${title}:
+${indent2(String(text))}
+`).join("");
+  const milestones = Array.isArray(project["milestones"]) ? project["milestones"] : [];
+  const milestoneText = milestones.length === 0 ? "" : "\nMilestones:\n" + milestones.map((milestone) => `  ${(str3(milestone["target_date"]) || "-").padEnd(12)}${clean(milestone["name"])}
+`).join("");
+  const human = `${str3(project["id"])} \xB7 ${clean(project["name"])}
+` + fieldLines + sectionText + milestoneText;
+  return { json: project, human };
+}
+function projectBody(opts) {
+  let body = {};
+  body = putOpt2(body, "name", opts.name);
+  body = putOpt2(body, "description", opts.description);
+  body = putOpt2(body, "summary", opts.summary);
+  body = putOpt2(body, "state", opts.state);
+  body = putOpt2(body, "lead_id", opts.lead);
+  body = putDate(body, "start_date", opts.startDate);
+  body = putDate(body, "target_date", opts.targetDate);
+  return body;
+}
+async function projectCreate(ctx, opts) {
+  if (opts.name === void 0) throw new UsageError("usage: harness project create --name <name> \u2026");
+  const body = await ctx.client.post("/api/v1/projects", projectBody(opts));
+  const project = body.data;
+  return { json: project, human: `Created project ${clean(project["name"])} (${str3(project["id"])})
+` };
+}
+async function projectUpdate(ctx, id, opts) {
+  requireSafeId("project", id);
+  const patch = projectBody(opts);
+  if (Object.keys(patch).length === 0) {
+    throw new UsageError("usage: harness project update <id> --name \u2026 | --state \u2026 | \u2026");
+  }
+  const body = await ctx.client.patch(`/api/v1/projects/${id}`, patch);
+  return { json: body.data, human: `Updated project ${str3(body.data["id"])}
+` };
+}
+async function milestoneList(ctx, project) {
+  if (project === void 0) throw new UsageError("usage: harness milestone list --project <id>");
+  requireSafeId("project", project);
+  const body = await ctx.client.get(`/api/v1/projects/${project}/milestones`);
+  const human = body.data.length === 0 ? "No milestones.\n" : table(
+    ["ID", "TARGET", "NAME"],
+    body.data.map((milestone) => [
+      str3(milestone["id"]),
+      str3(milestone["target_date"]) || "-",
+      str3(milestone["name"])
+    ])
+  );
+  return { json: body.data, human };
+}
+async function milestoneCreate(ctx, opts) {
+  if (opts.project === void 0 || opts.name === void 0) {
+    throw new UsageError("usage: harness milestone create --project <id> --name <name> [--description TEXT] [--target-date YYYY-MM-DD]");
+  }
+  requireSafeId("project", opts.project);
+  let body = { name: opts.name };
+  body = putOpt2(body, "description", opts.description);
+  body = putDate(body, "target_date", opts.targetDate);
+  const response = await ctx.client.post(`/api/v1/projects/${opts.project}/milestones`, body);
+  const milestone = response.data;
+  return {
+    json: milestone,
+    human: `Created milestone ${clean(milestone["name"])} (${str3(milestone["id"])})
+`
+  };
+}
+async function docList(ctx, opts) {
+  let params = { page_size: opts.limit ?? 50, page: opts.page ?? 1 };
+  if (opts.search !== void 0) params = { ...params, search: opts.search };
+  const { records: records5, notice } = await paginatedRead(ctx, "/api/v1/documents", params, opts);
+  const human = records5.length === 0 ? "No documents.\n" : table(
+    ["ID", "UPDATED", "TITLE"],
+    records5.map((doc) => [str3(doc["id"]), str3(doc["updated_at"]) || "-", str3(doc["title"])])
+  );
+  return { json: records5, human, notice };
+}
+async function docShow(ctx, id) {
+  requireSafeId("document", id);
+  const body = await ctx.client.get(`/api/v1/documents/${id}`);
+  const doc = body.data;
+  const content = doc["content"];
+  const human = `${str3(doc["id"])} \xB7 ${clean(doc["title"])}
+  Updated:    ${clean(doc["updated_at"])}
+` + (content === null || content === void 0 || content === "" ? "" : "\n" + cleanMultiline(String(content)) + "\n");
+  return { json: doc, human };
+}
+async function docCreate(ctx, opts) {
+  if (opts.title === void 0) throw new UsageError("usage: harness doc create --title <title> [--content TEXT] [--project ID]");
+  let body = { title: opts.title };
+  body = putOpt2(body, "content", opts.content);
+  body = putOpt2(body, "project_id", opts.project);
+  const response = await ctx.client.post("/api/v1/documents", body);
+  const doc = response.data;
+  return { json: doc, human: `Created document ${clean(doc["title"])} (${str3(doc["id"])})
+` };
+}
+async function docUpdate(ctx, id, opts) {
+  requireSafeId("document", id);
+  let patch = {};
+  patch = putOpt2(patch, "title", opts.title);
+  patch = putOpt2(patch, "content", opts.content);
+  patch = putOpt2(patch, "project_id", opts.project);
+  if (Object.keys(patch).length === 0) {
+    throw new UsageError("usage: harness doc update <id> --title \u2026 | --content \u2026 | --project \u2026");
+  }
+  const response = await ctx.client.patch(`/api/v1/documents/${id}`, patch);
+  return { json: response.data, human: `Updated document ${str3(response.data["id"])}
+` };
+}
+async function linkList(ctx, issue) {
+  requireIdentifiers([issue]);
+  const body = await ctx.client.get(`/api/v1/issues/${issue}/links`);
+  const human = body.data.length === 0 ? "No links.\n" : table(
+    ["ID", "URL", "TITLE"],
+    body.data.map((link) => [str3(link["id"]), str3(link["url"]), str3(link["title"]) || "-"])
+  );
+  return { json: body.data, human };
+}
+async function linkAdd(ctx, issue, url, title) {
+  requireIdentifiers([issue]);
+  let body = { url };
+  body = putOpt2(body, "title", title);
+  const response = await ctx.client.post(`/api/v1/issues/${issue}/links`, body);
+  return { json: response.data, human: `Linked ${clean(url)} to ${issue}
+` };
+}
+async function findLink(ctx, issue, idOrUrl, allowDuplicateUrl = false) {
+  const body = await ctx.client.get(`/api/v1/issues/${issue}/links`);
+  const idMatch = body.data.find((candidate) => candidate["id"] === idOrUrl);
+  if (idMatch !== void 0) return idMatch;
+  const urlMatches = body.data.filter((candidate) => candidate["url"] === idOrUrl);
+  if (urlMatches.length > 1 && !allowDuplicateUrl) {
+    throw new CommandError(`multiple links on ${issue} match ${idOrUrl}; use a link id`);
+  }
+  if (urlMatches.length === 0) {
+    throw new CommandError(`no link on ${issue} matches ${idOrUrl} (by id or exact URL)`);
+  }
+  return urlMatches[0];
+}
+async function linkUpdate(ctx, issue, idOrUrl, opts) {
+  requireIdentifiers([issue]);
+  let patch = {};
+  patch = putOpt2(patch, "url", opts.url);
+  patch = putOpt2(patch, "title", opts.title);
+  if (Object.keys(patch).length === 0) {
+    throw new UsageError("usage: harness link update <issue> <link-id-or-url> --url <url> | --title <title>");
+  }
+  const id = isUuid(idOrUrl) ? idOrUrl.toLowerCase() : str3((await findLink(ctx, issue, idOrUrl))["id"]);
+  if (!isUuid(idOrUrl)) patch["expected_url"] = idOrUrl;
+  const response = await ctx.client.patch(`/api/v1/issues/${issue}/links/${id}`, patch);
+  return { json: response.data, human: `Updated link ${clean(response.data["url"])} on ${issue}
+` };
+}
+async function linkRm(ctx, issue, idOrUrl) {
+  requireIdentifiers([issue]);
+  const link = await findLink(ctx, issue, idOrUrl, true);
+  await ctx.client.delete(`/api/v1/issues/${issue}/links/${str3(link["id"])}`);
+  return { json: { deleted: link["id"] }, human: `Removed ${clean(link["url"])} from ${issue}
+` };
+}
+async function labelList2(ctx) {
+  const body = await ctx.client.get("/api/v1/labels");
+  const human = body.data.length === 0 ? "No labels.\n" : table(
+    ["NAME", "COLOR", "ISSUES", "ID"],
+    body.data.map((label) => [
+      str3(label["name"]),
+      str3(label["color"]) || "-",
+      str3(label["issue_count"] ?? 0),
+      str3(label["id"])
+    ])
+  );
+  return { json: body.data, human };
+}
+async function labelCreate(ctx, name, color) {
+  if (name === void 0) throw new UsageError("usage: harness label create <name> [--color <color>]");
+  let body = { name };
+  body = putOpt2(body, "color", color);
+  const response = await ctx.client.post("/api/v1/labels", body);
+  return { json: response.data, human: `Created label ${clean(response.data["name"])}
+` };
+}
+var TEAM_CREATE_KEY = /^[A-Za-z][A-Za-z0-9]*$/;
+async function teamCreate(ctx, opts) {
+  if (opts.key === void 0 || opts.name === void 0) {
+    throw new UsageError("usage: harness team create --key <key> --name <name>");
+  }
+  if (!TEAM_CREATE_KEY.test(opts.key)) {
+    throw new UsageError(`not a team key: ${opts.key} (expected e.g. ALL \u2014 letters and digits, letter first)`);
+  }
+  const created = await ctx.client.post("/api/v1/teams", { key: opts.key, name: opts.name });
+  const team = created.data;
+  const states = await ctx.client.get(`/api/v1/teams/${str3(team["key"])}/workflow_states`);
+  const human = `Created team ${str3(team["key"])} \u2014 ${clean(team["name"])}
+` + table(
+    ["NAME", "TYPE"],
+    states.data.map((state) => [str3(state["name"]), str3(state["type"])])
+  );
+  return { json: { ...team, workflow_states: states.data }, human };
+}
+async function teamList(ctx) {
+  const body = await ctx.client.get("/api/v1/teams");
+  const human = body.data.length === 0 ? "No teams.\n" : table(
+    ["KEY", "NAME", "ISSUES", "DEFAULT"],
+    body.data.map((team) => [
+      str3(team["key"]),
+      str3(team["name"]),
+      str3(team["issue_count"] ?? 0),
+      team["is_default"] === true ? "yes" : ""
+    ])
+  );
+  return { json: body.data, human };
+}
+async function workflowStates(ctx, team) {
+  const key = requiredTeam({ client: ctx.client, config: ctx.config }, team);
+  const body = await ctx.client.get(`/api/v1/teams/${key}/workflow_states`);
+  const human = body.data.length === 0 ? "No workflow states.\n" : table(
+    ["NAME", "TYPE", "COLOR", "ID"],
+    body.data.map((state) => [
+      str3(state["name"]),
+      str3(state["type"]),
+      str3(state["color"]) || "-",
+      str3(state["id"])
+    ])
+  );
+  return { json: body.data, human };
+}
+async function userList(ctx) {
+  const body = await ctx.client.get("/api/v1/users");
+  const human = body.data.length === 0 ? "No users.\n" : table(
+    ["NAME", "EMAIL", "ID"],
+    body.data.map((user) => [str3(user["name"]), str3(user["email"]), str3(user["id"])])
+  );
+  return { json: body.data, human };
+}
+async function teamRename(ctx, key, name) {
+  if (key === void 0 || name === void 0) {
+    throw new UsageError("usage: harness team rename <key> --name <name>");
+  }
+  const body = await ctx.client.patch(`/api/v1/teams/${encodeURIComponent(key)}`, { name });
+  return { json: body.data, human: `Renamed ${str3(body.data["key"])} to ${clean(body.data["name"])}
+` };
+}
+async function teamSetDefault(ctx, key) {
+  if (key === void 0) throw new UsageError("usage: harness team set-default <key>");
+  const body = await ctx.client.put(`/api/v1/teams/${encodeURIComponent(key)}/default`, {});
+  return {
+    json: body.data,
+    human: `${str3(body.data["key"])} is now the default filing target
+`
+  };
+}
+async function stateAdd(ctx, opts) {
+  const key = requiredTeam({ client: ctx.client, config: ctx.config }, opts.team);
+  if (opts.name === void 0 || opts.type === void 0) {
+    throw new UsageError("usage: harness state add --name <name> --type <type> [--color <color>] [--team <key>]");
+  }
+  let payload = { name: opts.name, type: opts.type };
+  payload = putOpt2(payload, "color", opts.color);
+  const body = await ctx.client.post(`/api/v1/teams/${key}/workflow_states`, payload);
+  return { json: body.data, human: `Added ${clean(body.data["name"])} to ${key}
+` };
+}
+async function stateUpdate(ctx, id, opts) {
+  const key = requiredTeam({ client: ctx.client, config: ctx.config }, opts.team);
+  if (id === void 0) throw new UsageError("usage: harness state update <id> [--name <name>] [--type <type>] [--color <color>]");
+  if (opts.name === void 0 && opts.type === void 0 && opts.color === void 0) {
+    throw new UsageError("nothing to change \u2014 pass at least one of --name, --type, --color");
+  }
+  let payload = {};
+  payload = putOpt2(payload, "name", opts.name);
+  payload = putOpt2(payload, "type", opts.type);
+  payload = putOpt2(payload, "color", opts.color);
+  const body = await ctx.client.patch(`/api/v1/teams/${key}/workflow_states/${encodeURIComponent(id)}`, payload);
+  return { json: body.data, human: `Updated ${clean(body.data["name"])}
+` };
+}
+async function stateOrder(ctx, ids, opts) {
+  const key = requiredTeam({ client: ctx.client, config: ctx.config }, opts.team);
+  if (ids === void 0) {
+    throw new UsageError("usage: harness state order <id,id,id> [--team <key>] \u2014 every state id, in the order you want");
+  }
+  const state_ids = ids.split(",").map((id) => id.trim()).filter((id) => id !== "");
+  if (state_ids.length === 0) throw new UsageError("no state ids given");
+  const body = await ctx.client.put(`/api/v1/teams/${key}/workflow_states/order`, { state_ids });
+  const human = table(
+    ["NAME", "TYPE"],
+    body.data.map((state) => [str3(state["name"]), str3(state["type"])])
+  );
+  return { json: body.data, human };
+}
+async function stateDelete(ctx, id, opts) {
+  const key = requiredTeam({ client: ctx.client, config: ctx.config }, opts.team);
+  if (id === void 0) throw new UsageError("usage: harness state delete <id> --yes [--team <key>]");
+  requireYes("state delete", id, opts.yes);
+  await ctx.client.delete(`/api/v1/teams/${key}/workflow_states/${encodeURIComponent(id)}`);
+  return { json: { deleted: id }, human: `Deleted workflow state ${id}
+` };
+}
+async function labelUpdate(ctx, id, opts) {
+  if (id === void 0) throw new UsageError("usage: harness label update <id> [--name <name>] [--color <color>]");
+  if (opts.name === void 0 && opts.color === void 0) {
+    throw new UsageError("nothing to change \u2014 pass --name, --color, or both");
+  }
+  let payload = {};
+  payload = putOpt2(payload, "name", opts.name);
+  payload = putOpt2(payload, "color", opts.color);
+  const body = await ctx.client.patch(`/api/v1/labels/${encodeURIComponent(id)}`, payload);
+  return { json: body.data, human: `Updated label ${clean(body.data["name"])}
+` };
+}
+async function labelDelete(ctx, id, opts) {
+  if (id === void 0) throw new UsageError("usage: harness label delete <id> --yes");
+  requireYes("label delete", id, opts.yes);
+  await ctx.client.delete(`/api/v1/labels/${encodeURIComponent(id)}`);
+  return { json: { deleted: id }, human: `Deleted label ${id}
+` };
+}
+async function memberList(ctx) {
+  const body = await ctx.client.get("/api/v1/members");
+  const human = body.data.length === 0 ? "No members.\n" : table(
+    ["NAME", "EMAIL", "RANK", "STANDING", "ID"],
+    body.data.map((member) => [
+      str3(field(member, "user", "name")),
+      str3(field(member, "user", "email")),
+      str3(member["role"]) || "-",
+      str3(member["standing"]),
+      str3(field(member, "user", "id"))
+    ])
+  );
+  return { json: body.data, human };
+}
+async function memberAdd(ctx, opts) {
+  if (opts.email === void 0 || opts.role === void 0) {
+    throw new UsageError("usage: harness member add --email <email> --role <admin|staff|collaborator>");
+  }
+  const body = await ctx.client.post("/api/v1/members", { email: opts.email, role: opts.role });
+  return {
+    json: body.data,
+    human: `Added ${str3(field(body.data, "user", "email"))} as ${str3(body.data["role"])}
+`
+  };
+}
+async function memberSetRole(ctx, userId, opts) {
+  if (userId === void 0 || opts.role === void 0) {
+    throw new UsageError("usage: harness member set-role <user-id> --role <admin|staff|collaborator|none>");
+  }
+  const body = await ctx.client.put(`/api/v1/members/${encodeURIComponent(userId)}/role`, { role: opts.role });
+  const rank = str3(body.data["role"]);
+  const human = rank === "" ? `Revoked the rank for ${str3(field(body.data, "user", "email"))}
+` : `${str3(field(body.data, "user", "email"))} is now ${rank}
+`;
+  return { json: body.data, human };
+}
+function requireYes(command, id, yes) {
+  if (yes !== true) throw new UsageError(`${command} ${id} is destructive \u2014 pass --yes to confirm`);
+}
+async function upload(ctx, path2) {
+  return attachFile(ctx, path2);
+}
+function indent2(text) {
+  return cleanMultiline(text).split("\n").map((line) => "  " + line).join("\n");
+}
+
+// src/commands/operator-catalog.ts
+var SCHEMA_VIEWS = ["input", "result"];
+var MAX_QUERY_BYTES = 200;
+var MAX_CATALOG_PAGES = 200;
+var MAX_SCHEMA_PAGES = 1e3;
+var SCHEMA_ENCODING = "json_fragments_v1";
+var CAPABILITY_ID_FORMAT = /^[A-Za-z0-9_.:-]{1,200}$/;
+var APPROVAL_NOTE = "Write and send capabilities, and any proposal, need a person's approval in the app before they take effect.\n";
+var REFUSALS = {
+  operator_disabled: "nothing here works until it is switched back on",
+  operator_not_permitted: "this account has no admin or member role in the organization the credential is bound to",
+  actor_required: "this credential acts as no person: sign in with `harness login`, or use an API token minted for a user",
+  run_bound_credential: "a run-bound credential can't read Operator's catalog",
+  forbidden: "Operator needs the operator:read scope (aone_ API tokens must be minted with it) and an admin or member role"
+};
+async function toolsList(ctx, opts) {
+  requireToolsOpts(opts);
+  const { items, meta } = await capabilityPages(ctx, {}, opts);
+  return {
+    json: items,
+    human: items.length === 0 ? "Operator can use no capabilities here.\n" : capabilitiesTable(items, false),
+    notice: pagingNotice(items, meta, opts, "capabilities")
+  };
+}
+async function toolsSearch(ctx, query, opts) {
+  requireSearchQuery(query);
+  requireToolsOpts(opts);
+  const { items, meta } = await capabilityPages(ctx, { q: query }, opts);
+  return {
+    json: items,
+    human: items.length === 0 ? `No capability Operator can use matches "${clean(query)}".
+` : capabilitiesTable(items, true),
+    notice: pagingNotice(items, meta, opts, "matches")
+  };
+}
+async function toolsDomains(ctx) {
+  const body = await operatorRequest(() => ctx.client.get("/api/v1/operator/capabilities/domains"));
+  const domains = records2(body.data, "domains");
+  return {
+    json: domains,
+    human: domains.length === 0 ? "Operator can use no capabilities here.\n" : table(
+      ["DOMAIN", "CAPABILITIES"],
+      domains.map((domain) => [str4(domain["domain"]), str4(domain["count"])])
+    )
+  };
+}
+async function toolShow(ctx, id, opts) {
+  requireCapabilityId(id);
+  const view = requireSchemaView(opts.schema);
+  const fragments = [];
+  let capability = {};
+  let fragmentCount = null;
+  for (let page = 1; ; page++) {
+    const body = await operatorRequest(
+      () => ctx.client.get(`/api/v1/operator/capabilities/${id}`, { schema: view, page }),
+      `Operator can't use a capability ${id} here: it doesn't exist, or it is disabled or switched off`
+    );
+    const data = body.data;
+    if (!isRecord(data)) throw new CommandError("The capability response carried no capability.");
+    if (data["id"] !== id || data["schema"] !== view || data["page"] !== page) {
+      throw new CommandError(
+        `The capability response is not page ${page} of ${id}'s ${view} schema (it says page ${clean(data["page"])} of ${clean(data["id"])}'s ${clean(data["schema"])} schema).`
+      );
+    }
+    if (data["schema_encoding"] !== SCHEMA_ENCODING) {
+      throw new CommandError(
+        `The capability's schema comes in an encoding this CLI does not read (${clean(data["schema_encoding"])}) \u2014 upgrade the CLI.`
+      );
+    }
+    const count = data["fragment_count"];
+    if (typeof count !== "number" || !Number.isInteger(count) || count < 1) {
+      throw new CommandError(`The capability's schema page ${page} carries no valid fragment count.`);
+    }
+    if (fragmentCount !== null && count !== fragmentCount) {
+      throw new CommandError(
+        `The capability's schema pages disagree on the fragment count (${fragmentCount}, then ${count} on page ${page}).`
+      );
+    }
+    fragmentCount = count;
+    const pageFragments = data["fragments"];
+    if (!Array.isArray(pageFragments) || !pageFragments.every((fragment) => typeof fragment === "string")) {
+      throw new CommandError(`The capability's schema page ${page} carried no fragments.`);
+    }
+    fragments.push(...pageFragments);
+    capability = data;
+    const next = data["next_page"];
+    if (next === null || next === void 0) break;
+    if (next !== page + 1 || next > MAX_SCHEMA_PAGES) {
+      throw new CommandError(`The capability's schema page ${page} names an invalid next page (${clean(next)}).`);
+    }
+  }
+  if (fragments.length !== fragmentCount) {
+    throw new CommandError(
+      `The capability's schema came back incomplete: ${fragments.length} of ${fragmentCount} fragments.`
+    );
+  }
+  let schema;
+  try {
+    schema = JSON.parse(fragments.join(""));
+  } catch {
+    throw new CommandError("The capability's schema fragments do not join into valid JSON.");
+  }
+  const shown = { ...withoutSchemaPaging(capability), [`${view}_schema`]: schema };
+  return { json: shown, human: capabilityDetail(shown, view, schema) };
+}
+async function skillsList(ctx) {
+  const body = await operatorRequest(() => ctx.client.get("/api/v1/operator/skills"));
+  const skills = records2(body.data, "skills").map((skill) => ({
+    id: skill["id"],
+    title: skill["title"],
+    invocation_name: skill["invocation_name"],
+    content_sha256: skill["content_sha256"]
+  }));
+  return {
+    json: skills,
+    human: skills.length === 0 ? "No skills are assigned to Operator in this organization.\n" : table(
+      ["INVOCATION", "TITLE", "SHA-256", "ID"],
+      skills.map((skill) => [
+        str4(skill.invocation_name),
+        truncate(skill.title),
+        str4(skill.content_sha256),
+        str4(skill.id)
+      ])
+    )
+  };
+}
+function requireCapabilityId(id) {
+  if (!CAPABILITY_ID_FORMAT.test(id) || /^\.+$/.test(id)) {
+    throw new UsageError(`not a capability id: ${clean(id)} (e.g. crm.party.search)`);
+  }
+  if (id === "domains") {
+    throw new UsageError("domains is not a capability id \u2014 `harness tools domains` lists the domains");
+  }
+}
+function requireSearchQuery(query) {
+  if (query.trim() === "") throw new UsageError("the search query is empty \u2014 say what to search for");
+  if (Buffer.byteLength(query, "utf8") > MAX_QUERY_BYTES) {
+    throw new UsageError(`the search query is over ${MAX_QUERY_BYTES} bytes \u2014 shorten it`);
+  }
+}
+function requireToolsOpts(opts) {
+  if (opts.domain !== void 0 && opts.domain.trim() === "") {
+    throw new UsageError("the domain is empty \u2014 name one, or leave it out for every domain");
+  }
+  if (opts.cursor !== void 0 && opts.cursor.trim() === "") {
+    throw new UsageError("the cursor is empty \u2014 pass a page's cursor, or leave it out for the first page");
+  }
+}
+function requireSchemaView(view) {
+  if (view === void 0) return "input";
+  if (SCHEMA_VIEWS.includes(view)) return view;
+  throw new UsageError(`--schema must be input or result, not ${clean(view)}`);
+}
+async function capabilityPages(ctx, base, opts) {
+  const params = { ...base, domain: opts.domain };
+  let page = await capabilityPage(ctx, { ...params, cursor: opts.cursor }, CALLER_CURSOR);
+  const items = [...page.items];
+  if (opts.all === true) {
+    const seen = new Set(opts.cursor === void 0 ? [] : [opts.cursor]);
+    let pages = 1;
+    while (page.nextCursor !== null) {
+      if (seen.has(page.nextCursor)) throw new CommandError("The capabilities response repeated a cursor.");
+      if (pages >= MAX_CATALOG_PAGES) {
+        throw new CommandError(`The capabilities listing ran past ${MAX_CATALOG_PAGES} pages; stopped there.`);
+      }
+      seen.add(page.nextCursor);
+      page = await capabilityPage(ctx, { ...params, cursor: page.nextCursor }, WALK_CURSOR);
+      pages++;
+      items.push(...page.items);
+    }
+  }
+  return { items: dedupeById(items), meta: page.meta };
+}
+var CALLER_CURSOR = "start again without the cursor";
+var WALK_CURSOR = "the listing changed or its cursor expired while following pages; run it again";
+async function capabilityPage(ctx, params, staleCursor) {
+  const body = await operatorRequest(
+    () => ctx.client.get("/api/v1/operator/capabilities", params),
+    void 0,
+    staleCursor
+  );
+  const items = records2(body.data, "capabilities");
+  const meta = body.meta;
+  if (!isRecord(meta)) throw new CommandError("The capabilities response has no pagination metadata.");
+  const nextCursor = meta.next_cursor;
+  if (nextCursor !== null && (typeof nextCursor !== "string" || nextCursor === "")) {
+    throw new CommandError("The capabilities response has an invalid next_cursor.");
+  }
+  if (nextCursor !== null && items.length === 0) {
+    throw new CommandError("The capabilities response says there are more pages but holds no capabilities.");
+  }
+  return { items, meta, nextCursor };
+}
+async function operatorRequest(send, notFound2 = "this Harness server has no Operator API yet", staleCursor = CALLER_CURSOR) {
+  try {
+    return await send();
+  } catch (error) {
+    throw explain(error, notFound2, staleCursor);
+  }
+}
+function explain(error, notFound2, staleCursor) {
+  if (!(error instanceof HttpError)) return error;
+  const code = typeof error.body["error"] === "string" ? error.body["error"] : "";
+  let hint;
+  if (error.status === 403) hint = Object.hasOwn(REFUSALS, code) ? REFUSALS[code] : void 0;
+  else if (error.status === 404) hint = notFound2;
+  else if (error.status === 400 && code === "invalid_cursor") hint = staleCursor;
+  else if (error.status === 400 && /\bdomain\b/.test(error.message)) {
+    hint = "no such domain; listing without one shows each capability's domain";
+  }
+  if (hint === void 0) return error;
+  return new HttpError(error.status, `${error.message} \u2014 ${hint}`, error.body, error.retryAfter);
+}
+function capabilitiesTable(items, search2) {
+  const headers = ["ID", "KIND", "DOMAIN", "SUMMARY"];
+  const rows = items.map((item) => [
+    str4(item["id"]),
+    kindName(item),
+    str4(item["domain"]),
+    truncate(item["summary"])
+  ]);
+  const table2 = search2 ? table(
+    ["SCORE", ...headers],
+    rows.map((row, index) => [str4(items[index]["score"]), ...row])
+  ) : table(headers, rows);
+  return table2 + (items.some(needsApproval) ? "\n" + APPROVAL_NOTE : "");
+}
+function pagingNotice(items, meta, opts, noun) {
+  if (opts.all === true || typeof meta.next_cursor !== "string") return void 0;
+  const of = typeof meta.count === "number" ? ` of ${meta.count}` : "";
+  return `harness: showing ${items.length}${of} ${noun} \u2014 pass --all for every page, or --cursor ${clean(meta.next_cursor)} for the next one.
+`;
+}
+function capabilityDetail(capability, view, schema) {
+  const kind = kindName(capability);
+  const line = (label, value) => `  ${(label + ":").padEnd(10)}${clean(value)}
+`;
+  const description = cleanMultiline(str4(capability["description"]));
+  return `${clean(capability["id"])}
+` + line("Domain", str4(capability["domain"])) + line("Kind", kind === "send" ? "send \u2014 delivered beyond the platform" : kind) + line("Mode", `${str4(capability["mode"])} (effect: ${str4(capability["effect"])})`) + line("Summary", str4(capability["summary"])) + line("Approval", approval(capability)) + (description === "" ? "" : `
+Description:
+${indent3(description)}
+`) + `
+${view === "input" ? "Input" : "Result"} schema:
+${indent3(cleanMultiline(JSON.stringify(schema, null, 2)))}
+`;
+}
+function needsApproval(capability) {
+  return capability["kind"] === "write" || capability["kind"] === "send" || capability["mode"] === "proposal";
+}
+function approval(capability) {
+  if (needsApproval(capability)) return "a person approves it in the app before it takes effect";
+  if (capability["kind"] === "read") return "not needed for a read";
+  const kind = kindName(capability);
+  return kind === "unknown" ? "unknown: the server named no kind" : `unknown for a capability of kind ${kind}`;
+}
+function kindName(capability) {
+  const kind = capability["kind"];
+  return typeof kind === "string" && kind.trim() !== "" ? kind : "unknown";
+}
+var SCHEMA_PAGING_FIELDS = /* @__PURE__ */ new Set(["schema", "schema_encoding", "fragments", "fragment_count", "page", "next_page"]);
+function withoutSchemaPaging(capability) {
+  return Object.fromEntries(Object.entries(capability).filter(([key]) => !SCHEMA_PAGING_FIELDS.has(key)));
+}
+function records2(value, what) {
+  if (!Array.isArray(value) || !value.every(isRecord)) {
+    throw new CommandError(`The ${what} response carried no list.`);
+  }
+  return value;
+}
+function dedupeById(items) {
+  const seen = /* @__PURE__ */ new Set();
+  return items.filter((item) => {
+    if (seen.has(item["id"])) return false;
+    seen.add(item["id"]);
+    return true;
+  });
+}
+function indent3(text) {
+  return text.split("\n").map((line) => "  " + line).join("\n");
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function str4(value) {
+  return value === null || value === void 0 ? "" : String(value);
+}
+
+// src/commands/operator-jobs.ts
+var JOB_STATES = [
+  "draft",
+  "planning",
+  "ready",
+  "running",
+  "waiting_for_approval",
+  "waiting_for_human",
+  "paused",
+  "failed",
+  "needs_reconciliation",
+  "completed",
+  "cancelled"
+];
+var JOB_STATUS_ALIASES = ["open", "waiting", "done"];
+var JOBS_MAX_LIMIT = 50;
+var JOBS_MAX_PAGES = 100;
+var EVENTS_PAGE_LIMIT = 200;
+var WATCH_INTERVAL_MS = 2e3;
+var WATCH_WAITING_INTERVAL_MS = 1e4;
+var WATCH_RETRIES = 3;
+var RETRY_BASE_MS = 1e3;
+var RETRY_AFTER_CAP_MS = 3e5;
+var EXIT_WAITING_FOR_PERSON = 4;
+var EXIT_JOB_ENDED = 5;
+var EXIT_INTERRUPTED = 130;
+var INTERRUPTED = "interrupted";
+var READER_GONE = "reader-gone";
+var ENDED_STATES = /* @__PURE__ */ new Set(["completed", "failed", "cancelled"]);
+var CHANGE_SET_FIELDS = [
+  "manifest_id",
+  "version",
+  "digest",
+  "status",
+  "plan_version",
+  "max_effect_count",
+  "actions"
+];
+var CHANGE_SET_ACTION_FIELDS = [
+  "id",
+  "action_type",
+  "action_version",
+  "display_order",
+  "effect_count",
+  "required_capability_ids",
+  "digest"
+];
+var WITHHELD_FIELDS = /* @__PURE__ */ new Set([
+  "objective",
+  "objective_text",
+  "instruction",
+  "instructions",
+  "description",
+  "result",
+  "results",
+  "outputs",
+  "investigation",
+  "read_material",
+  "public_research",
+  "source_review",
+  "review_actions",
+  "manifest_actions",
+  "recipe",
+  "lua",
+  "lua_source"
+]);
+var CODE = /^[a-z0-9_.:-]{1,64}$/;
+var TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
+function requireJobsArgs(opts) {
+  if (opts.status !== void 0) normalizeStatus(opts.status);
+  if (opts.limit !== void 0 && (!Number.isInteger(opts.limit) || opts.limit < 1 || opts.limit > JOBS_MAX_LIMIT)) {
+    throw new UsageError(`--limit takes an integer from 1 to ${JOBS_MAX_LIMIT}`);
+  }
+}
+function normalizeStatus(status) {
+  const tokens = status.split(",").map((token) => token.trim().toLowerCase()).filter((token) => token !== "");
+  const known = [...JOB_STATES, ...JOB_STATUS_ALIASES];
+  const unknown = tokens.filter((token) => !known.includes(token));
+  if (tokens.length === 0 || unknown.length > 0) {
+    throw new UsageError(
+      `${tokens.length === 0 ? "--status is empty" : `unknown job status: ${unknown.join(", ")}`} \u2014 pass job states (${JOB_STATES.join(", ")}) or ${JOB_STATUS_ALIASES.join(", ")}, comma-separated`
+    );
+  }
+  return tokens.join(",");
+}
+async function jobsList(ctx, opts) {
+  requireJobsArgs(opts);
+  const params = {
+    status: opts.status === void 0 ? void 0 : normalizeStatus(opts.status),
+    mine: opts.mine === true ? true : void 0,
+    // Reading everything: full pages, so the walk takes as few requests as it can.
+    limit: opts.limit ?? (opts.all === true ? JOBS_MAX_LIMIT : void 0)
+  };
+  let page = await jobsPage(ctx, params, void 0);
+  let jobs = page.jobs;
+  if (opts.all !== true) {
+    if (!page.hasMore) return { json: jobs, human: jobsTable(jobs) };
+    if (jobs.length === 0) {
+      return {
+        json: jobs,
+        human: "No Operator jobs you can see on this page.\n",
+        notice: "harness: older jobs may exist past this page \u2014 pass --all to read on.\n"
+      };
+    }
+    return {
+      json: jobs,
+      human: jobsTable(jobs),
+      notice: `harness: showing the newest ${plural(jobs.length, "Operator job")} \u2014 pass --all for older ones.
+`
+    };
+  }
+  const seen = /* @__PURE__ */ new Set();
+  let pages = 1;
+  while (page.hasMore && pages < JOBS_MAX_PAGES) {
+    const cursor = page.nextCursor;
+    if (seen.has(cursor)) throw new CommandError("The jobs response repeated a cursor.");
+    seen.add(cursor);
+    page = await jobsPage(ctx, params, cursor);
+    pages += 1;
+    jobs = [...jobs, ...page.jobs];
+  }
+  jobs = uniqueById(jobs);
+  if (!page.hasMore) return { json: jobs, human: jobsTable(jobs) };
+  return {
+    json: jobs,
+    human: jobsTable(jobs),
+    notice: `harness: stopped after ${JOBS_MAX_PAGES} pages (${plural(jobs.length, "job")}) without reaching the end \u2014 narrow the list with --status or --mine.
+`,
+    exitCode: 1
+  };
+}
+async function jobsPage(ctx, params, before) {
+  const body = await explained(
+    () => ctx.client.get("/api/v1/operator/jobs", { ...params, before }),
+    { notFound: "this Harness server has no Operator API yet" }
+  );
+  const jobs = objects(body.data, "jobs").map(withheld);
+  const meta = body.meta;
+  if (typeof meta !== "object" || meta === null || typeof meta["has_more"] !== "boolean") {
+    throw new CommandError("The jobs response has no paging metadata.");
+  }
+  if (meta["has_more"] !== true) return { jobs, hasMore: false, nextCursor: null };
+  const cursor = meta["next_cursor"];
+  if (typeof cursor !== "string" || cursor === "") {
+    throw new CommandError("The jobs response says more exist but gives no cursor.");
+  }
+  return { jobs, hasMore: true, nextCursor: cursor };
+}
+function requireJobId(id) {
+  if (!isUuid(id)) throw new UsageError(`not an Operator job id: ${id} (expected the job's UUID)`);
+}
+async function jobShow(ctx, id, opts = {}) {
+  requireJobId(id);
+  const body = await explained(() => ctx.client.get(`/api/v1/operator/jobs/${id}`), {
+    notFound: missingJob(id)
+  });
+  if (!isRecord2(body.data)) throw new CommandError("The job response carried no job.");
+  const job = withheld(body.data);
+  if (opts.changes !== true && opts.people !== true) return { json: job, human: jobDetail(job) };
+  const document = Object.fromEntries(
+    ["id", "state", "waiting_on", "url", "approval_url"].map((key) => [key, job[key] ?? null])
+  );
+  const sections = [];
+  let notice;
+  if (opts.changes === true) {
+    const changeSet = await jobChangeSet(ctx, id);
+    document["change_set"] = changeSet;
+    sections.push(changesText(id, job, changeSet));
+    notice = changeSetRace(job, changeSet);
+  }
+  if (opts.people === true) {
+    const people = jobPeople(job);
+    document["people"] = people;
+    sections.push(peopleText(id, people));
+  }
+  return { json: document, human: sections.join("\n"), ...notice === void 0 ? {} : { notice } };
+}
+function changeSetRace(job, changeSet) {
+  const pending = field2(job, "pending_approval", "manifest_id");
+  if (typeof pending !== "string") return void 0;
+  const read = changeSet === null ? null : changeSet["manifest_id"];
+  if (read === pending) return void 0;
+  return `harness: the job waits for approval of change set ${clean(pending)}, but the change set read next is ${read === null ? "none" : clean(read)}: the job changed between the two reads, so run it again.
+`;
+}
+async function jobChangeSet(ctx, id) {
+  const body = await explained(() => ctx.client.get(`/api/v1/operator/jobs/${id}/changes`), {
+    notFound: missingJob(id)
+  });
+  if (body.data === null) return null;
+  if (!isRecord2(body.data)) throw new CommandError("The change set response carried no change set.");
+  return {
+    ...pick(body.data, CHANGE_SET_FIELDS),
+    actions: records3(body.data["actions"]).map((action) => pick(action, CHANGE_SET_ACTION_FIELDS))
+  };
+}
+function jobPeople(job) {
+  const participants = records3(field2(job, "people", "participants"));
+  const owner = isRecord2(job["owner"]) ? job["owner"] : null;
+  const names = /* @__PURE__ */ new Map();
+  for (const named of owner === null ? participants : [...participants, owner]) {
+    if (typeof named["user_id"] === "string" && typeof named["name"] === "string" && named["name"] !== "") {
+      if (!names.has(named["user_id"])) names.set(named["user_id"], named["name"]);
+    }
+  }
+  const person = (userId) => typeof userId === "string" && userId !== "" ? { user_id: userId, name: names.get(userId) ?? null } : null;
+  const some = (people) => people.filter((entry) => entry !== null);
+  const approvers = field2(job, "people", "approver_user_ids");
+  return {
+    requester: person(job["requester_user_id"]),
+    execution_principal: person(job["execution_principal_user_id"]),
+    owner: owner === null ? null : person(owner["user_id"]),
+    approvers: some((Array.isArray(approvers) ? approvers : []).map(person)),
+    collaborators: some(participants.filter((entry) => entry["role"] === "collaborator").map((entry) => person(entry["user_id"])))
+  };
+}
+async function jobWatch(ctx, id, opts) {
+  requireJobId(id);
+  if (opts.after !== void 0 && (!Number.isInteger(opts.after) || opts.after < 0)) {
+    throw new UsageError("--after takes a non-negative event sequence");
+  }
+  const emit = opts.onLine ?? (() => {
+  });
+  const sleep = opts.sleep ?? abortableSleep;
+  const signal = opts.signal;
+  let after = opts.after ?? 0;
+  const events = [];
+  let job = null;
+  let shown = null;
+  let shownApprovalUrl = null;
+  const document = (outcome, extra = {}) => ({
+    id,
+    outcome,
+    ...extra,
+    job: job === null ? null : jobStateJson(job),
+    ...opts.collectEvents === true ? { events } : {},
+    next_after: after
+  });
+  const stopped = (reason) => reason === READER_GONE ? (
+    // Nobody is reading any more: end quietly.
+    { json: document("stopped"), human: "", exitCode: 0 }
+  ) : { json: document("interrupted"), human: "", notice: resumeLine(id, after), exitCode: EXIT_INTERRUPTED };
+  for (; ; ) {
+    if (aborted(signal)) return stopped(signal?.reason);
+    let page;
+    try {
+      page = await withRetries(() => eventsPage(ctx, id, after), sleep, signal);
+    } catch (error) {
+      if (aborted(signal)) return stopped(signal?.reason);
+      if (!transient(error)) throw error;
+      const message = failureMessage(error);
+      return {
+        json: document("error", {
+          error: { message, status: error instanceof HttpError ? error.status : null }
+        }),
+        human: "",
+        notice: `harness: ${message}
+` + resumeLine(id, after),
+        exitCode: error instanceof TransportError ? 3 : 1
+      };
+    }
+    for (const event of page.events) {
+      if (opts.collectEvents === true) events.push(eventJson(event));
+      emit(eventLine(event));
+    }
+    after = page.nextAfter;
+    job = page.job;
+    if (page.hasMore) continue;
+    const state = str5(job["state"]);
+    const waitingOn = typeof job["waiting_on"] === "string" ? job["waiting_on"] : null;
+    if (shown === null || shown.state !== state || shown.waitingOn !== waitingOn) {
+      emit(stateLine(shown?.state ?? null, state, waitingOn));
+      shown = { state, waitingOn };
+    }
+    const approvalUrl = typeof job["approval_url"] === "string" ? job["approval_url"] : null;
+    if (opts.throughWaits === true && approvalUrl !== null && approvalUrl !== shownApprovalUrl) {
+      emit(`approve in the app: ${clean(approvalUrl)}
+`);
+    }
+    shownApprovalUrl = approvalUrl;
+    let outcome = null;
+    if (ENDED_STATES.has(state)) outcome = state;
+    else if (waitingOn !== null && opts.throughWaits !== true) outcome = "waiting";
+    if (outcome !== null) {
+      return {
+        json: document(outcome),
+        human: outcomeText(id, outcome, job),
+        exitCode: outcome === "completed" ? 0 : outcome === "waiting" ? EXIT_WAITING_FOR_PERSON : EXIT_JOB_ENDED
+      };
+    }
+    if (aborted(signal)) return stopped(signal?.reason);
+    await sleep(waitingOn !== null || state === "paused" ? WATCH_WAITING_INTERVAL_MS : WATCH_INTERVAL_MS, signal);
+  }
+}
+function resumeLine(id, after) {
+  return `harness: stopped watching job ${id}; resume with: harness watch ${id} --after ${after}
+`;
+}
+function watchStopSignal(stdout = process.stdout, signals = process) {
+  const controller = new AbortController();
+  const readerGone = () => controller.abort(READER_GONE);
+  stdout.once("error", readerGone);
+  stdout.once("close", readerGone);
+  signals.once("SIGINT", () => controller.abort(INTERRUPTED));
+  return controller.signal;
+}
+function aborted(signal) {
+  return signal?.aborted === true;
+}
+function abortableSleep(ms, signal) {
+  return new Promise((resolve) => {
+    if (aborted(signal)) {
+      resolve();
+      return;
+    }
+    const done = () => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", done);
+      resolve();
+    };
+    const timer = setTimeout(done, ms);
+    signal?.addEventListener("abort", done, { once: true });
+  });
+}
+function transient(error) {
+  if (error instanceof TransportError) return true;
+  return error instanceof HttpError && !(error instanceof UpgradeRequiredError) && (error.status >= 500 || error.status === 429);
+}
+async function withRetries(send, sleep, signal) {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return await send();
+    } catch (error) {
+      if (attempt >= WATCH_RETRIES || !transient(error) || aborted(signal)) throw error;
+      await sleep(retryDelay(error, attempt), signal);
+      if (aborted(signal)) throw error;
+    }
+  }
+}
+function retryDelay(error, attempt) {
+  const backoff = RETRY_BASE_MS * 2 ** attempt;
+  const asked = error instanceof HttpError ? retryAfterMs(error.retryAfter) : null;
+  return asked === null ? backoff : Math.max(backoff, Math.min(asked, RETRY_AFTER_CAP_MS));
+}
+function retryAfterMs(header) {
+  if (header === null) return null;
+  const value = header.trim();
+  if (/^\d+$/.test(value)) return Number.parseInt(value, 10) * 1e3;
+  const at = Date.parse(value);
+  return Number.isNaN(at) ? null : Math.max(0, at - Date.now());
+}
+function failureMessage(error) {
+  if (error instanceof TransportError) return `cannot reach the API: ${clean(error.message)}`;
+  return `${clean(error.message)} (HTTP ${error.status})${errorDetails(error.body)}`;
+}
+async function eventsPage(ctx, id, after) {
+  const body = await explained(
+    () => ctx.client.get(`/api/v1/operator/jobs/${id}/events`, {
+      after,
+      limit: EVENTS_PAGE_LIMIT
+    }),
+    { notFound: missingJob(id) }
+  );
+  const events = objects(body.data, "events");
+  const meta = body.meta;
+  if (typeof meta !== "object" || meta === null) throw new CommandError("The events response has no metadata.");
+  const nextAfter = meta["next_after"];
+  const hasMore = meta["has_more"];
+  const job = meta["job"];
+  if (typeof nextAfter !== "number" || !Number.isInteger(nextAfter) || nextAfter < after) {
+    throw new CommandError("The events response has an invalid next_after.");
+  }
+  if (typeof hasMore !== "boolean") throw new CommandError("The events response has an invalid has_more.");
+  if (!isRecord2(job) || typeof job["state"] !== "string") {
+    throw new CommandError("The events response does not carry the job's state.");
+  }
+  if (hasMore && nextAfter === after) {
+    throw new CommandError("The events response says more exist but did not move its cursor.");
+  }
+  return { events, nextAfter, hasMore, job };
+}
+var REFUSAL_HINTS = {
+  operator_disabled: "nothing can be read until Operator is switched back on for this organization",
+  operator_not_permitted: "only the organization's admins and members use Operator; guests and people outside it cannot",
+  actor_required: "the credential acts as no person: sign in with `harness login`, or use an API token a person created",
+  forbidden: "the credential lacks the operator:read scope (`harness login` carries it; an aone_ token must be created with it, bound to this organization), or you are a guest or outside the organization",
+  run_bound_credential: "a run-bound credential cannot read Operator jobs; sign in with `harness login`"
+};
+function missingJob(id) {
+  return `no Operator job ${id} you can see: it does not exist, is in another organization, or is not shared with you (or this Harness server has no Operator API yet)`;
+}
+async function explained(send, why) {
+  try {
+    return await send();
+  } catch (error) {
+    if (!(error instanceof HttpError)) throw error;
+    const code = error.body["error"];
+    let hint;
+    if (error.status === 403 && typeof code === "string") hint = REFUSAL_HINTS[code];
+    if (error.status === 404) hint = why.notFound;
+    if (error.status === 400 && code === "invalid_cursor") hint = "run the list again from the start";
+    if (hint === void 0) throw error;
+    throw new HttpError(error.status, `${error.message} \u2014 ${hint}`, error.body, error.retryAfter);
+  }
+}
+function jobsTable(jobs) {
+  if (jobs.length === 0) return "No Operator jobs.\n";
+  const rows = jobs.map((job) => [
+    str5(job["id"]),
+    str5(job["state"]) || "-",
+    str5(job["waiting_on"]) || "-",
+    str5(job["objective_kind"]) || "-",
+    personName(job["owner"]),
+    str5(field2(job, "plan_step", "issue")) || "-",
+    str5(job["updated_at"]) || "-"
+  ]);
+  const table2 = table(["ID", "STATE", "WAITING ON", "KIND", "OWNER", "PLAN STEP", "UPDATED"], rows);
+  const approvals = jobs.filter((job) => typeof job["approval_url"] === "string");
+  if (approvals.length === 0) return table2;
+  return table2 + "\nWaiting for approval. Approve in the app; the CLI cannot:\n" + approvals.map((job) => `  ${clean(job["id"])}  ${clean(job["approval_url"])}
+`).join("");
+}
+function jobDetail(job) {
+  const waitingOn = str5(job["waiting_on"]);
+  const header = `Operator job ${clean(job["id"])} \xB7 ${clean(job["state"])}` + (waitingOn === "" ? "" : ` \xB7 waiting on ${clean(waitingOn)}`) + "\n";
+  const people = records3(field2(job, "people", "participants"));
+  const fields = [
+    ["Kind", str5(job["objective_kind"]) || "-"],
+    ["Role", str5(job["viewer_role"]) || null],
+    ["Owner", isRecord2(job["owner"]) ? personName(job["owner"]) : null],
+    ["Plan step", planStepLine(job["plan_step"])],
+    ["Plan", planLine(job["plan"])],
+    ["Progress", progressLine(job["progress"])],
+    ["Window", windowLine(job["window"])],
+    ["Spend", spendLine(job["spend"])],
+    ["Verification", str5(field2(job, "verification", "status")) || null],
+    ["Effects", effectsLine(job["effects"])],
+    ["Skill", skillLine(job["skill"])],
+    ["Grant", grantLine(job["grant"], people)],
+    ["Created", str5(job["inserted_at"]) || null],
+    ["Updated", str5(job["updated_at"]) || null],
+    ["Workbench", str5(job["url"]) || null]
+  ];
+  return header + labelled(fields) + approvalSection(job["pending_approval"], people) + listSection("Blockers", records3(job["blockers"]), (item) => `${str5(item["kind"])}: ${str5(item["state"])}`) + listSection("Artifacts", records3(job["artifacts"]), (item) => `${str5(item["id"])}  ${str5(item["url"])}`) + peopleSection(people) + listSection(
+    "Procedures",
+    records3(job["procedures"]),
+    (procedure) => `${str5(procedure["name"])}  v${str5(procedure["current_version"])}  ${str5(procedure["id"])}`
+  ) + controlsLine(job["viewer_can"]) + "\nThe objective's text is not shown: the API never returns it, because it can quote what Operator read. Open the workbench link to read it.\n";
+}
+function labelled(fields, width = 15) {
+  return fields.filter((entry) => entry[1] !== null).map(([label, value]) => `  ${(label + ":").padEnd(width)}${clean(value)}
+`).join("");
+}
+function planStepLine(step) {
+  if (!isRecord2(step)) return null;
+  return `${str5(step["issue"])} (plan ${str5(step["plan_id"])})`;
+}
+function planLine(plan) {
+  if (!isRecord2(plan)) return "none yet";
+  const count = plan["capability_count"];
+  return `version ${str5(plan["version"])} \xB7 instructions v${str5(plan["instruction_version"])} \xB7 ${str5(count)} capabilit${count === 1 ? "y" : "ies"}`;
+}
+function progressLine(progress) {
+  if (!isRecord2(progress)) return null;
+  const parts = [str5(progress["stage"]), str5(progress["situation"])].filter((part) => part !== "");
+  if (progress["needs_viewer"] === true) parts.push("needs you");
+  return parts.length === 0 ? null : parts.join(" \xB7 ");
+}
+function windowLine(window) {
+  if (!isRecord2(window)) return null;
+  const left = duration(window["remaining_ms"]);
+  const budget = duration(window["budget_ms"]);
+  const sequence = window["sequence"];
+  return `${left ?? "?"} left${budget === null ? "" : ` of ${budget}`} \xB7 ${str5(window["state"])}` + (typeof sequence === "number" ? ` (window ${sequence})` : "");
+}
+function spendLine(spend) {
+  if (!isRecord2(spend)) return null;
+  const spent = `${str5(spend["spent_cents"]) || "0"} cents spent`;
+  if (typeof spend["plan_budget_cents"] !== "number") return spent;
+  const remaining = spend["plan_remaining_cents"];
+  return `${spent} \xB7 plan budget ${spend["plan_budget_cents"]} cents` + (typeof remaining === "number" ? `, ${remaining} cents left` : "");
+}
+function effectsLine(effects) {
+  if (!isRecord2(effects)) return null;
+  return ["staged", "succeeded", "failed", "unknown"].map((key) => `${str5(effects[key]) || "0"} ${key}`).join(" \xB7 ");
+}
+function skillLine(skill) {
+  if (!isRecord2(skill)) return null;
+  return `${str5(skill["title"])} (${str5(skill["invocation_name"])}) \xB7 sha256 ${str5(skill["content_sha256"])} \xB7 pinned ${str5(skill["pinned_at"])}`;
+}
+function grantLine(grant, people) {
+  if (!isRecord2(grant)) return null;
+  const approvedAt = str5(grant["approved_at"]);
+  const expiresAt = str5(grant["expires_at"]);
+  return `${str5(grant["status"])} v${str5(grant["version"])} \xB7 approved by ${nameOf(grant["approver_user_id"], people)}` + (approvedAt === "" ? "" : ` at ${approvedAt}`) + ` \xB7 ${expiresAt === "" ? "no expiry" : `expires ${expiresAt}`}`;
+}
+function approvalSection(pending, people) {
+  if (!isRecord2(pending)) return "";
+  const approvers = Array.isArray(pending["approver_user_ids"]) ? pending["approver_user_ids"].map((id) => nameOf(id, people)).join(", ") : "";
+  const canApprove = pending["viewer_can_approve"] === true ? "you can approve" : "you cannot approve it";
+  return "\nWaiting for approval. Approve it in the app; the CLI cannot:\n" + labelled([
+    [
+      "Change set",
+      `${str5(pending["manifest_id"])} v${str5(pending["version"])} \xB7 ${str5(pending["action_count"])} actions \xB7 up to ${str5(pending["max_effect_count"])} effects \xB7 plan version ${str5(pending["plan_version"])}`
+    ],
+    ["Digest", str5(pending["digest"]) || null],
+    ["Approvers", approvers === "" ? canApprove : `${approvers} \xB7 ${canApprove}`],
+    ["Approve at", str5(pending["url"]) || null]
+  ]);
+}
+function peopleSection(people) {
+  if (people.length === 0) return "";
+  const rows = people.map((person) => [
+    str5(person["name"]) || "(no name)",
+    str5(person["role"]),
+    str5(person["user_id"])
+  ]);
+  const lines = table(["", "", ""], rows).split("\n").slice(1, -1);
+  return "\nPeople:\n" + lines.map((line) => `  ${line}
+`).join("");
+}
+function changesText(id, job, changeSet) {
+  if (changeSet === null) return `No pending change set: Operator has proposed nothing for job ${id} yet.
+`;
+  const approvalUrl = str5(job["approval_url"]);
+  const rows = records3(changeSet["actions"]).map((action) => [
+    str5(action["display_order"]) || "-",
+    str5(action["action_type"]),
+    str5(action["action_version"]),
+    str5(action["effect_count"]),
+    (Array.isArray(action["required_capability_ids"]) ? action["required_capability_ids"].map(str5).join(", ") : "") || "-",
+    str5(action["digest"]),
+    str5(action["id"])
+  ]);
+  const actions = rows.length === 0 ? "\nActions: none\n" : "\nActions:\n" + table(["#", "ACTION", "VERSION", "EFFECTS", "CAPABILITIES", "DIGEST", "ID"], rows).split("\n").slice(0, -1).map((line) => `  ${line}
+`).join("");
+  return `Change set of Operator job ${id} \xB7 ${clean(changeSet["status"])}
+` + labelled([
+    [
+      "Change set",
+      `${str5(changeSet["manifest_id"])} v${str5(changeSet["version"])} \xB7 plan version ${str5(changeSet["plan_version"])} \xB7 up to ${str5(changeSet["max_effect_count"])} effects`
+    ],
+    ["Digest", str5(changeSet["digest"]) || null],
+    approvalUrl === "" ? ["Workbench", str5(job["url"]) || null] : ["Approve at", approvalUrl]
+  ]) + actions + "\nValues and targets are not shown: review them in the app at the " + (approvalUrl === "" ? "workbench link.\n" : "approval link. The CLI cannot approve.\n");
+}
+function peopleText(id, people) {
+  const one = (entry) => isRecord2(entry) ? str5(entry["name"]) || str5(entry["user_id"]) : "-";
+  const many = (entries) => (Array.isArray(entries) ? entries.map(one).join(", ") : "") || "none";
+  return `People on Operator job ${id}:
+` + labelled(
+    [
+      ["Requester", one(people["requester"])],
+      ["Execution principal", one(people["execution_principal"])],
+      ["Owner", one(people["owner"])],
+      ["Approvers", many(people["approvers"])],
+      ["Collaborators", many(people["collaborators"])]
+    ],
+    22
+  );
+}
+function listSection(title, items, line) {
+  if (items.length === 0) return "";
+  return `
+${title}:
+` + items.map((item) => `  ${clean(line(item))}
+`).join("");
+}
+function controlsLine(viewerCan) {
+  const controls = isRecord2(viewerCan) ? ["steer", "cancel", "continue", "pause", "save_procedure"].filter((key) => viewerCan[key] === true) : [];
+  return `
+You can, in the workbench: ${controls.length === 0 ? "nothing right now" : controls.join(", ")}
+`;
+}
+function eventLine(event) {
+  const actor = isRecord2(event["actor"]) ? event["actor"] : {};
+  const actorKind = safeValue(actor["kind"]) || "?";
+  const actorId = safeValue(actor["delegated_grant_id"] ?? actor["user_id"]);
+  const data = isRecord2(event["data"]) ? Object.entries(event["data"]).map(([key, value]) => `${clean(key)}=${safeValue(value) || "\u2026"}`) : [];
+  return `#${clean(event["sequence"])}  ${clean(event["occurred_at"])}  ${clean(event["kind"])}  ${actorId === "" ? actorKind : `${actorKind} ${actorId}`}` + (data.length === 0 ? "" : `  ${data.join(" ")}`) + "\n";
+}
+function eventJson(event) {
+  const actor = isRecord2(event["actor"]) ? event["actor"] : {};
+  const data = isRecord2(event["data"]) ? event["data"] : {};
+  return {
+    sequence: typeof event["sequence"] === "number" ? event["sequence"] : null,
+    kind: safeValue(event["kind"]) || null,
+    occurred_at: typeof event["occurred_at"] === "string" && TIMESTAMP.test(event["occurred_at"]) ? event["occurred_at"] : null,
+    actor: Object.fromEntries(
+      ["kind", "user_id", "delegated_grant_id"].filter((key) => key in actor && (actor[key] === null || safeValue(actor[key]) !== "")).map((key) => [key, actor[key]])
+    ),
+    data: Object.fromEntries(Object.entries(data).filter(([key, value]) => CODE.test(key) && safeValue(value) !== ""))
+  };
+}
+function jobStateJson(job) {
+  return Object.fromEntries(
+    ["state", "waiting_on", "updated_at", "url", "approval_url"].filter((key) => key in job).map((key) => [key, job[key]])
+  );
+}
+function stateLine(previous, state, waitingOn) {
+  const now = clean(state) + (waitingOn === null ? "" : `, waiting on ${clean(waitingOn)}`);
+  return previous === null || previous === state ? `state: ${now}
+` : `state: ${clean(previous)} \u2192 ${now}
+`;
+}
+function outcomeText(id, outcome, job) {
+  const url = clean(job["url"]);
+  switch (outcome) {
+    case "completed":
+      return `Job ${id} completed.
+  Workbench: ${url}
+`;
+    case "failed":
+      return `Job ${id} failed.
+  Workbench: ${url}
+`;
+    case "cancelled":
+      return `Job ${id} was cancelled.
+  Workbench: ${url}
+`;
+    case "waiting": {
+      const waitingOn = job["waiting_on"];
+      if (waitingOn === "approval") {
+        const link = clean(job["approval_url"]) || url;
+        return `Job ${id} is waiting for approval. Approve it in the app; the CLI cannot:
+  ${link}
+`;
+      }
+      const what = waitingOn === "person" ? "a person" : clean(waitingOn);
+      return `Job ${id} is waiting on ${what}; a person has to act in the workbench:
+  ${url}
+`;
+    }
+  }
+}
+function withheld(job) {
+  return Object.fromEntries(
+    Object.entries(job).filter(([key]) => !WITHHELD_FIELDS.has(key) && !key.startsWith("knowledge"))
+  );
+}
+function pick(record, keys) {
+  return Object.fromEntries(keys.filter((key) => key in record).map((key) => [key, record[key]]));
+}
+function objects(value, what) {
+  if (!Array.isArray(value) || !value.every(isRecord2)) {
+    throw new CommandError(`The ${what} response data is not a list of objects.`);
+  }
+  return value;
+}
+function plural(count, noun) {
+  return `${count} ${noun}${count === 1 ? "" : "s"}`;
+}
+function uniqueById(jobs) {
+  const seen = /* @__PURE__ */ new Set();
+  return jobs.filter((job) => {
+    const id = str5(job["id"]);
+    if (seen.has(id)) return false;
+    seen.add(id);
+    return true;
+  });
+}
+function personName(person) {
+  if (!isRecord2(person)) return "-";
+  return str5(person["name"]) || str5(person["user_id"]) || "-";
+}
+function nameOf(userId, people) {
+  const id = str5(userId);
+  const person = people.find((candidate) => candidate["user_id"] === id);
+  return (person === void 0 ? "" : str5(person["name"])) || id || "?";
+}
+function duration(ms) {
+  if (typeof ms !== "number" || !Number.isFinite(ms)) return null;
+  const seconds = Math.max(0, Math.floor(ms / 1e3));
+  const hours = Math.floor(seconds / 3600);
+  const minutes = Math.floor(seconds % 3600 / 60);
+  const rest = seconds % 60;
+  if (hours > 0) return `${hours}h ${String(minutes).padStart(2, "0")}m`;
+  if (minutes > 0) return `${minutes}m ${String(rest).padStart(2, "0")}s`;
+  return `${rest}s`;
+}
+function safeValue(value) {
+  if (typeof value === "number" && Number.isFinite(value)) return String(value);
+  if (typeof value === "boolean") return String(value);
+  if (typeof value === "string" && CODE.test(value)) return value;
+  return "";
+}
+function field2(record, ...keys) {
+  let current = record;
+  for (const key of keys) {
+    if (!isRecord2(current)) return null;
+    current = current[key];
+  }
+  return current ?? null;
+}
+function records3(value) {
+  return Array.isArray(value) ? value.filter(isRecord2) : [];
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function str5(value) {
+  return value === null || value === void 0 ? "" : String(value);
+}
+
+// src/commands/operator-write.ts
+var ACCESS_HINTS = {
+  ...REFUSAL_HINTS,
+  operator_disabled: "nothing can be changed until Operator is switched back on for this organization",
+  actor_required: "the credential acts as no person: use a browser login, or an API token a person created",
+  forbidden: "the credential lacks the operator:write scope (a browser login carries it; an aone_ token must be created with it, bound to this organization), or you are a guest or outside the organization",
+  run_bound_credential: "a run-bound credential cannot change Operator jobs; use a browser login"
+};
+var BAD_REQUEST_HINT = "nothing changed: the server refused a field this CLI sent, so this CLI and the server disagree about the request \u2014 update the CLI";
+var NEVER_SENT = /* @__PURE__ */ new Set([
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "EAI_FAIL",
+  "ECONNREFUSED",
+  "ENETUNREACH",
+  "EHOSTUNREACH",
+  "EHOSTDOWN",
+  "EADDRNOTAVAIL",
+  "UND_ERR_CONNECT_TIMEOUT",
+  "DEPTH_ZERO_SELF_SIGNED_CERT",
+  "SELF_SIGNED_CERT_IN_CHAIN",
+  "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+  "UNABLE_TO_GET_ISSUER_CERT",
+  "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+  "CERT_HAS_EXPIRED",
+  "CERT_NOT_YET_VALID",
+  "CERT_REVOKED",
+  "CERT_UNTRUSTED",
+  "CERT_REJECTED",
+  "HOSTNAME_MISMATCH",
+  "ERR_TLS_CERT_ALTNAME_INVALID",
+  "ERR_SSL_WRONG_VERSION_NUMBER"
+]);
+function neverSent(error) {
+  return !(error instanceof MalformedResponseError) && error.code !== null && NEVER_SENT.has(error.code);
+}
+function outcomeUnknown(why, write2) {
+  return new CommandError(
+    `Outcome unknown: ${why}, so ${write2.mayHave}. It is not retried; check ${write2.check} before trying again.`
+  );
+}
+async function sendOnce(ctx, path2, body, write2) {
+  try {
+    return await ctx.client.post(path2, body, { actor: false });
+  } catch (error) {
+    if (error instanceof TransportError) {
+      if (neverSent(error)) {
+        throw new TransportError(
+          `${error.message} \u2014 the request never reached the server, so nothing changed`,
+          error.code
+        );
+      }
+      throw outcomeUnknown(
+        error instanceof MalformedResponseError ? `the answer could not be read (${error.message})` : `the request failed (${error.message}) after it may have reached the server`,
+        write2
+      );
+    }
+    if (error instanceof HttpError && !(error instanceof UpgradeRequiredError) && error.status >= 500) {
+      throw new HttpError(
+        error.status,
+        `${error.message} \u2014 outcome unknown: ${write2.mayHave}. It is not retried; check ${write2.check} before trying again`,
+        error.body,
+        error.retryAfter
+      );
+    }
+    throw error;
+  }
+}
+function explainRefusal(error, notFound2, hints) {
+  if (!(error instanceof HttpError) || error instanceof UpgradeRequiredError) return error;
+  const code = typeof error.body["error"] === "string" ? error.body["error"] : "";
+  const own = Object.hasOwn(hints, code) ? hints[code] : void 0;
+  let hint;
+  if (error.status >= 500) hint = own;
+  else if (error.status === 404) hint = notFound2;
+  else if (own !== void 0) hint = own;
+  else if (error.status === 403 && Object.hasOwn(ACCESS_HINTS, code)) hint = ACCESS_HINTS[code];
+  else if (error.status === 400 && code === "bad_request") hint = BAD_REQUEST_HINT;
+  if (hint === void 0) return error;
+  const message = error.status >= 500 && typeof error.body["message"] === "string" ? error.body["message"] : error.message;
+  return new HttpError(error.status, `${message} \u2014 ${hint}`, error.body, error.retryAfter);
+}
+
+// src/commands/operator-continue.ts
+async function jobContinue(ctx, id) {
+  requireJobId(id);
+  const write2 = { mayHave: "the job may have been continued", check: `\`job ${id}\`` };
+  let data;
+  try {
+    data = (await sendOnce(ctx, `/api/v1/operator/jobs/${id}/continue`, {}, write2)).data;
+  } catch (error) {
+    throw explainRefusal(error, notFound(id), refusals(id));
+  }
+  if (typeof data !== "object" || data === null || Array.isArray(data)) {
+    throw outcomeUnknown("the answer carried no job", write2);
+  }
+  const job = withheld(data);
+  return { json: job, human: `Continued Operator job ${id}.
+
+` + jobDetail(job) };
+}
+function notFound(id) {
+  return `${missingJob(id)}. If you could see the job until now, it may have gone out of sight just as it was continued: check \`job ${id}\` before continuing it again`;
+}
+function refusals(id) {
+  return {
+    principal_required: "only the person the job runs as (its execution principal) can continue it",
+    invalid_state: `the job has nothing to continue in its current state; \`job ${id}\` shows where it stands`,
+    reconciliation_required: "reconcile its partial effects in the app first, from the job's workbench link",
+    principal_inactive: "the person the job runs as lost the rights to run it, so it can't continue until those are restored",
+    deliveries_unsettled: `a delivery is still sending, or its outcome is unknown: if \`job ${id}\` shows it waiting on delivery, settle it in the app; otherwise continue it once the delivery has sent`
+  };
+}
+
+// src/core/textinput.ts
+import { readFileSync as readFileSync3, statSync as statSync3 } from "fs";
+import { isatty } from "tty";
+var STDIN_PATH = "-";
+var MAX_TEXT_BYTES = 1e6;
+var TEXT_LIMIT = { bytes: MAX_TEXT_BYTES, why: "that is not prose; check the path" };
+var DOCUMENT_LIMIT = { bytes: 8e6, why: "larger than the API accepts in one request" };
+function flagOf(name) {
+  return name.replace(/[A-Z]/g, (upper) => `-${upper.toLowerCase()}`);
+}
+function resolveTextSources(sources) {
+  const resolved = {};
+  const toRead = [];
+  let stdinClaimedBy;
+  for (const { name, inline, file } of sources) {
+    if (inline !== void 0 && file !== void 0) {
+      throw new UsageError(
+        `--${flagOf(name)} and --${flagOf(name)}-file both given \u2014 pass one; there is no precedence between them`
+      );
+    }
+    if (file === void 0) {
+      if (inline !== void 0) resolved[name] = inline;
+      continue;
+    }
+    if (file === STDIN_PATH) {
+      if (isatty(0)) {
+        throw new UsageError(
+          `--${flagOf(name)}-file - reads stdin, but stdin is a terminal \u2014 pipe something in or pass a path`
+        );
+      }
+      if (stdinClaimedBy !== void 0) {
+        throw new UsageError(
+          `--${flagOf(name)}-file and --${flagOf(stdinClaimedBy)}-file both read stdin \u2014 there is only one stream, so only one may be "-"`
+        );
+      }
+      stdinClaimedBy = name;
+    }
+    if (file !== STDIN_PATH) checkReadable(file, `--${flagOf(name)}-file`);
+    toRead.push({ name, file });
+  }
+  for (const { name, file } of [...toRead].sort(byStdinLast)) {
+    resolved[name] = stripOneTrailingNewline(readTextFile(file, `--${flagOf(name)}-file`));
+  }
+  return resolved;
+}
+function readFileOption(flag, path2) {
+  if (path2 === STDIN_PATH) {
+    if (isatty(0)) {
+      throw new UsageError(`${flag} - reads stdin, but stdin is a terminal \u2014 pipe something in or pass a path`);
+    }
+  } else {
+    checkReadable(path2, flag, DOCUMENT_LIMIT);
+  }
+  return readTextFile(path2, flag, DOCUMENT_LIMIT);
+}
+function readTextFile(path2, option, limit = TEXT_LIMIT) {
+  if (path2 === STDIN_PATH) {
+    let piped;
+    try {
+      piped = readFileSync3(0);
+    } catch (error) {
+      throw new UsageError(`${option} -: cannot read stdin (${describe(error)})`);
+    }
+    if (piped.length > limit.bytes) {
+      throw new UsageError(oversize(`${option} -`, limit));
+    }
+    return decodeUtf8(piped, `${option} -`);
+  }
+  const flag = `${option} ${path2}`;
+  let bytes;
+  try {
+    bytes = readFileSync3(path2);
+  } catch (error) {
+    throw new UsageError(`${flag}: ${describe(error)}`);
+  }
+  if (bytes.length > limit.bytes) throw new UsageError(oversize(flag, limit));
+  return decodeUtf8(bytes, flag);
+}
+function decodeUtf8(bytes, flag) {
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    throw new UsageError(`${flag}: not valid UTF-8 \u2014 convert it first`);
+  }
+}
+function oversize(what, limit) {
+  return `${what}: over ${limit.bytes / 1e6} MB \u2014 ${limit.why}`;
+}
+function checkReadable(path2, option, limit = TEXT_LIMIT) {
+  const flag = `${option} ${path2}`;
+  let stats3;
+  try {
+    stats3 = statSync3(path2);
+  } catch (error) {
+    throw new UsageError(`${flag}: ${describe(error)}`);
+  }
+  if (!stats3.isFile()) {
+    throw new UsageError(
+      `${flag}: ${stats3.isDirectory() ? "is a directory" : "not a regular file"}`
+    );
+  }
+  if (stats3.size > limit.bytes) throw new UsageError(oversize(flag, limit));
+}
+function byStdinLast(a, b) {
+  return Number(a.file === STDIN_PATH) - Number(b.file === STDIN_PATH);
+}
+function stripOneTrailingNewline(text) {
+  if (text.endsWith("\r\n")) return text.slice(0, -2);
+  if (text.endsWith("\n")) return text.slice(0, -1);
+  return text;
+}
+function describe(error) {
+  const code = error?.code;
+  if (code === "ENOENT") return "no such file";
+  if (code === "EISDIR") return "is a directory";
+  if (code === "EACCES") return "permission denied";
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/commands/operator-controls.ts
+var STEER_MAX_CHARACTERS = 1e4;
+var DONE = { steer: "steered", cancel: "cancelled", pause: "paused" };
+function requireInstruction(instruction) {
+  const trimmed = instruction.trim();
+  if (trimmed === "") throw new UsageError("the instruction is empty \u2014 say what the job should change");
+  const length = graphemeLength(trimmed);
+  if (length > STEER_MAX_CHARACTERS) {
+    throw new UsageError(
+      `the instruction is ${length} characters once trimmed; a job takes at most ${STEER_MAX_CHARACTERS}`
+    );
+  }
+  return trimmed;
+}
+function instructionFrom(words, file) {
+  if (file === void 0) return requireInstruction(words.join(" "));
+  if (words.length > 0) {
+    throw new UsageError(
+      "instruction words and --instruction-file both given \u2014 pass one; there is no precedence between them"
+    );
+  }
+  return requireInstruction(resolveTextSources([{ name: "instruction", inline: void 0, file }])["instruction"] ?? "");
+}
+async function jobSteer(ctx, id, instruction) {
+  requireJobId(id);
+  const job = await control(ctx, id, "steer", { instruction: requireInstruction(instruction) });
+  return {
+    json: job,
+    human: `Steered Operator job ${id}: the instruction is posted in its room, attributed to you. Work it changes needs a fresh approval (earlier approvals no longer apply), and a run in progress stops to take it.
+
+` + jobDetail(job)
+  };
+}
+async function jobCancel(ctx, id) {
+  requireJobId(id);
+  const job = await control(ctx, id, "cancel", {});
+  const effects = effectsLine(job["effects"]);
+  return {
+    json: job,
+    human: `Cancelled Operator job ${id}. ` + (effects === null ? "Committed effects stay committed; the answer carried no counts.\n" : `Committed effects stay committed: ${clean(effects)} (staged effects that never ran count as unknown).
+`) + "\n" + jobDetail(job)
+  };
+}
+async function jobPause(ctx, id) {
+  requireJobId(id);
+  const job = await control(ctx, id, "pause", {});
+  return {
+    json: job,
+    human: `Paused Operator job ${id}. Its active-time budget is kept; continue it to run again.
+
+` + jobDetail(job)
+  };
+}
+async function control(ctx, id, verb, body) {
+  const write2 = { mayHave: `the job may have been ${DONE[verb]}`, check: `\`job ${id}\`` };
+  let data;
+  try {
+    data = (await sendOnce(ctx, `/api/v1/operator/jobs/${id}/${verb}`, body, write2)).data;
+  } catch (error) {
+    throw explained2(error, id, verb);
+  }
+  if (!isRecord3(data)) throw outcomeUnknown("the answer carried no job", write2);
+  return withheld(data);
+}
+function explained2(error, id, verb) {
+  if (!(error instanceof HttpError) || error.status >= 500) return error;
+  const hint = refusalHint(error, id, verb);
+  if (hint === void 0) return error;
+  return new HttpError(error.status, `${error.message} \u2014 ${hint}`, error.body, error.retryAfter);
+}
+function refusalHint(error, id, verb) {
+  const code = typeof error.body["error"] === "string" ? error.body["error"] : "";
+  const job = `\`job ${id}\``;
+  switch (error.status) {
+    case 400:
+      return code === "bad_request" ? BAD_REQUEST_HINT : void 0;
+    case 403:
+      if (code !== "principal_required") return ACCESS_HINTS[code];
+      return verb === "pause" ? "only the job's execution principal may pause it; as its owner or a collaborator you can steer it instead, which stops its current run" : `only the job's execution principal may ${verb} it; ask them to`;
+    case 404:
+      return missingJob(id);
+    case 409:
+      return conflictHint(code, verb, job);
+    case 422:
+      if (code === "invalid_instruction") {
+        return `pass the instruction as text of 1 to ${STEER_MAX_CHARACTERS} characters once trimmed`;
+      }
+      return code === "validation_error" && verb === "steer" ? "the job's room refused the instruction, so nothing was posted" : void 0;
+    default:
+      return void 0;
+  }
+}
+function conflictHint(code, verb, job) {
+  switch (code) {
+    case "invalid_state":
+      return {
+        steer: `the app doesn't offer Steer for the job now: it has finished, failed, waits for approval or needs reconciliation \u2014 ${job} shows where it stands`,
+        cancel: `the job has already ended \u2014 ${job} shows how`,
+        pause: `only a running job can be paused \u2014 ${job} shows where it stands`
+      }[verb];
+    case "reconciliation_required":
+      return `its partial effects need reconciling first: reconcile them in the app (${job} has the workbench link)`;
+    case "deliveries_unsettled":
+      return `a delivery is still sending, or its outcome is unknown: if ${job} shows it waiting on delivery, settle that in the app (the workbench link is there); otherwise ${verb} it again once the delivery has sent`;
+    case "principal_inactive":
+      return "nothing changed: the job's execution principal needs their admin or member role back first";
+    case "cancellation_scope_changed":
+      return `the job was not cancelled; read it with ${job} and decide again`;
+    default:
+      return void 0;
+  }
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/commands/operator-procedures.ts
+var PROCEDURE_FIELDS = [
+  "id",
+  "name",
+  "job_id",
+  "job_url",
+  "current_version",
+  "parameter_schema",
+  "versions",
+  "inserted_at",
+  "updated_at"
+];
+var PROCEDURE_VERSION_FIELDS = [
+  "version",
+  "recipe_digest",
+  "capability_ids",
+  "action_roster",
+  "inserted_at"
+];
+var RUN_NOTE = "A run is a new job: fresh inputs, your current rights and a change set that needs its own approval. Nothing of the saved job carries over. Approving happens in the app; the CLI cannot approve.\n";
+function requireProcedureId(id) {
+  if (!isUuid(id)) throw new UsageError(`not an Operator procedure id: ${id} (expected the procedure's UUID)`);
+}
+function missingProcedure(id) {
+  return `no Operator procedure ${id} you can see: it does not exist or was deleted, is in another organization, was saved from a job you can't see, or was saved for the whole organization rather than a job (or this Harness server has no procedures API yet)`;
+}
+function requireProcedureName(name) {
+  if (name === void 0 || name.trim() === "") {
+    throw new UsageError('a procedure needs a name: procedure save <job-id> --name "\u2026"');
+  }
+  return name;
+}
+async function procedureSave(ctx, jobId, name) {
+  requireJobId(jobId);
+  const named = requireProcedureName(name);
+  const write2 = {
+    mayHave: "a procedure may have been saved",
+    check: `the job's procedures with \`job ${jobId}\``
+  };
+  let data;
+  try {
+    data = (await sendOnce(ctx, `/api/v1/operator/jobs/${jobId}/procedures`, { name: named }, write2)).data;
+  } catch (error) {
+    throw explainRefusal(error, missingJob(jobId), {
+      owner_required: "only the job's owner can save it as a procedure; ask them to save it",
+      not_saveable: "only a job that completed with its work verified, and has work to repeat, can be saved",
+      validation_error: "the name must be plain text, without control characters"
+    });
+  }
+  if (!isRecord4(data) || typeof data["id"] !== "string" || data["id"] === "") {
+    throw outcomeUnknown("the answer named no procedure", write2);
+  }
+  const saved = `Saved job ${jobId} as procedure ${clean(data["id"])}`;
+  if (!Array.isArray(data["versions"])) {
+    return {
+      json: pick2(data, ["id", "url"]),
+      human: `${saved}, but it can't be read back as you.
+` + labelled([["Workbench", str6(data["url"]) || null]])
+    };
+  }
+  const procedure = procedureJson(data);
+  return { json: procedure, human: `${saved}.
+
+` + procedureDetail(procedure) };
+}
+async function procedureShow(ctx, id) {
+  requireProcedureId(id);
+  const body = await explained(() => ctx.client.get(`/api/v1/operator/procedures/${id}`), {
+    notFound: missingProcedure(id)
+  });
+  if (!isRecord4(body.data)) throw new CommandError("The procedure response carried no procedure.");
+  const procedure = procedureJson(body.data);
+  return { json: procedure, human: procedureDetail(procedure) };
+}
+function prepareProcedureRun(id, opts) {
+  requireProcedureId(id);
+  const body = {};
+  const version2 = runVersion(opts.version);
+  if (version2 !== void 0) body["version"] = version2;
+  const given = [
+    opts.param !== void 0 && opts.param.length > 0 ? "--param" : null,
+    opts.paramsFile !== void 0 ? "--params-file" : null,
+    opts.parameters !== void 0 ? "parameters" : null
+  ].filter((source) => source !== null);
+  if (given.length > 1) {
+    throw new UsageError(`${given.join(" and ")} both given \u2014 pass the parameters one way; there is no precedence`);
+  }
+  if (opts.parameters !== void 0 && !isRecord4(opts.parameters)) {
+    throw new UsageError("parameters must be one object of names and values");
+  }
+  const fromFlags = opts.param !== void 0 && opts.param.length > 0 ? parseParams(opts.param) : void 0;
+  if (opts.group !== void 0) body["group_id"] = bareId(opts.group, "--group");
+  if (opts.source !== void 0) body["source_resource_id"] = bareId(opts.source, "--source");
+  const parameters = fromFlags ?? opts.parameters ?? (opts.paramsFile === void 0 ? void 0 : readParamsFile(opts.paramsFile));
+  if (parameters !== void 0) body["parameters"] = parameters;
+  return { id, body };
+}
+async function startProcedureRun(ctx, request) {
+  const { id } = request;
+  const write2 = { mayHave: "a job may have been started", check: "`jobs` for the new job" };
+  let data;
+  try {
+    data = (await sendOnce(ctx, `/api/v1/operator/procedures/${id}/runs`, request.body, write2)).data;
+  } catch (error) {
+    throw explainRefusal(error, missingProcedure(id), {
+      version_conflict: `the procedure has a newer current version (\`procedure show ${id}\` names it): run that one, or run without a version to take the current one`,
+      concurrent_change: `read the procedure again (\`procedure show ${id}\`) before running it again`,
+      invalid_rerun: `check the parameters against the procedure's parameter schema (\`procedure show ${id}\`), and that your current rights cover the run`,
+      // The server refuses with it before the run starts.
+      service_unavailable: "nothing was started; try again later"
+    });
+  }
+  if (!isRecord4(data) || typeof data["id"] !== "string" || data["id"] === "") {
+    throw outcomeUnknown("the answer named no job", write2);
+  }
+  const started = `Started Operator job ${clean(data["id"])} from procedure ${id}`;
+  if (typeof data["state"] !== "string") {
+    return {
+      json: pick2(data, ["id", "url"]),
+      human: `${started}, but it can't be read back as you.
+` + labelled([["Workbench", str6(data["url"]) || null]]) + "\n" + RUN_NOTE
+    };
+  }
+  const job = withheld(data);
+  const waitingOn = str6(job["waiting_on"]);
+  return {
+    json: job,
+    human: `${started}.
+` + labelled([
+      ["State", str6(job["state"]) + (waitingOn === "" ? "" : ` \xB7 waiting on ${waitingOn}`)],
+      ["Workbench", str6(job["url"]) || null],
+      ["Approve at", str6(job["approval_url"]) || null]
+    ]) + "\n" + RUN_NOTE
+  };
+}
+async function procedureRun(ctx, id, opts) {
+  return startProcedureRun(ctx, prepareProcedureRun(id, opts));
+}
+function runVersion(version2) {
+  if (version2 === void 0) return void 0;
+  const text = String(version2).trim();
+  const parsed = typeof version2 === "number" ? version2 : /^\d+$/.test(text) ? Number(text) : Number.NaN;
+  if (!Number.isSafeInteger(parsed) || parsed < 1) {
+    throw new UsageError(`--version takes a positive integer, the version expected to be current (got ${text})`);
+  }
+  return parsed;
+}
+function parseParams(entries) {
+  const parsed = [];
+  const names = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    const equals = entry.indexOf("=");
+    if (equals === -1) throw new UsageError(`--param ${entry}: expected name=value, or name:=<json> for a JSON value`);
+    const typed = equals > 0 && entry[equals - 1] === ":";
+    const name = entry.slice(0, typed ? equals - 1 : equals);
+    const raw = entry.slice(equals + 1);
+    if (name.trim() === "") throw new UsageError(`--param ${entry}: the parameter has no name`);
+    if (name !== name.trim()) {
+      throw new UsageError(`--param ${entry}: the name starts or ends with whitespace \u2014 write it without`);
+    }
+    if (names.has(name)) throw new UsageError(`--param ${name} given twice \u2014 pass each parameter once`);
+    names.add(name);
+    parsed.push([name, typed ? jsonValue(raw, `--param ${entry}`) : raw]);
+  }
+  return Object.fromEntries(parsed);
+}
+function jsonValue(text, what) {
+  try {
+    return JSON.parse(text);
+  } catch (error) {
+    throw new UsageError(`${what}: not valid JSON after := (${firstLine(error)}); quote a string as name=value`);
+  }
+}
+function readParamsFile(path2) {
+  const text = readFileOption("--params-file", path2);
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error) {
+    throw new UsageError(`--params-file ${path2}: not valid JSON (${firstLine(error)})`);
+  }
+  if (!isRecord4(parsed)) {
+    throw new UsageError(`--params-file ${path2}: the parameters are one JSON object of names and values`);
+  }
+  return parsed;
+}
+function bareId(value, flag) {
+  if (value.trim() === "") throw new UsageError(`${flag} is empty`);
+  if (value !== value.trim()) throw new UsageError(`${flag} starts or ends with whitespace \u2014 pass the id alone`);
+  return value;
+}
+function procedureJson(data) {
+  const procedure = pick2(data, PROCEDURE_FIELDS);
+  if ("versions" in procedure) {
+    procedure["versions"] = records4(procedure["versions"]).map((version2) => pick2(version2, PROCEDURE_VERSION_FIELDS));
+  }
+  return procedure;
+}
+function procedureDetail(procedure) {
+  const current = procedure["current_version"];
+  const versions = records4(procedure["versions"]).map(
+    (version2) => `  ${clean(`v${str6(version2["version"])}${version2["version"] === current ? " (current)" : ""}  ${str6(version2["inserted_at"])}  recipe ${str6(version2["recipe_digest"])}`)}
+      ${"Capabilities:".padEnd(15)}${clean(list2(version2["capability_ids"]))}
+      ${"Actions:".padEnd(15)}${clean(list2(version2["action_roster"]))}
+`
+  );
+  return `Procedure ${clean(procedure["name"])} \xB7 v${clean(current)} \xB7 ${clean(procedure["id"])}
+` + labelled([
+    ["Saved from", `job ${str6(procedure["job_id"])}`],
+    ["Workbench", str6(procedure["job_url"]) || null],
+    ["Created", str6(procedure["inserted_at"]) || null],
+    ["Updated", str6(procedure["updated_at"]) || null]
+  ]) + (versions.length === 0 ? "\nVersions: none\n" : "\nVersions:\n" + versions.join("")) + parametersSection(procedure["parameter_schema"]) + "\n" + RUN_NOTE;
+}
+function parametersSection(schema) {
+  if (!isRecord4(schema) || Object.keys(schema).length === 0) return "\nParameters a run takes: none\n";
+  const lines = JSON.stringify(schema, null, 2).split("\n").map((line) => `  ${clean(line)}
+`).join("");
+  const scoped = isRecord4(schema["scoped_inputs"]) ? schema["scoped_inputs"]["required"] : void 0;
+  const scopes = Array.isArray(scoped) ? scoped.map(str6) : [];
+  let needs = "";
+  if (scopes.includes("contact_reconciliation")) {
+    needs = "Its runs also need --group <contact-group-id> and --source <uploaded-file-id> (contact_reconciliation).\n";
+  } else if (scopes.length > 0) {
+    needs = `Its runs also need inputs resolved afresh: ${clean(scopes.join(", "))}.
+`;
+  }
+  return "\nParameters a run takes (JSON schema):\n" + lines + needs;
+}
+function list2(value) {
+  return (Array.isArray(value) ? value.map(str6).join(", ") : "") || "none";
+}
+function pick2(record, keys) {
+  return Object.fromEntries(keys.filter((key) => key in record).map((key) => [key, record[key]]));
+}
+function records4(value) {
+  return Array.isArray(value) ? value.filter(isRecord4) : [];
+}
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function str6(value) {
+  return value === null || value === void 0 ? "" : String(value);
+}
+function firstLine(error) {
+  return (error instanceof Error ? error.message : String(error)).split("\n")[0] ?? "";
+}
+
+// src/commands/plans.ts
+import { extname as extname2 } from "path";
+import { parseDocument } from "yaml";
+var PLAN_EXECUTORS = ["none", "operator"];
+var CONDITION_KINDS = ["not_before", "gate", "event"];
+var GATE_OWNER_ROLES = ["gp", "compliance_officer", "valuer", "accountant", "auditor", "counsel"];
+function parsePlanDocument(text, source) {
+  const parsed = extname2(source).toLowerCase() === ".json" ? parseJson(text, source) : parseYamlDocument(text, source);
+  if (!isRecord5(parsed)) {
+    throw new UsageError(`${source}: a plan file holds one object (a mapping), not a list or a scalar`);
+  }
+  return parsed;
+}
+function parseJson(text, source) {
+  try {
+    return JSON.parse(text);
+  } catch (error) {
+    throw new UsageError(`${source}: not valid JSON (${firstLine2(error)})`);
+  }
+}
+function parseYamlDocument(text, source) {
+  const document = parseDocument(text, { resolveKnownTags: false });
+  const problem = document.errors[0] ?? document.warnings[0];
+  if (problem !== void 0) throw new UsageError(`${source}: not valid YAML (${firstLine2(problem)})`);
+  let value;
+  try {
+    value = document.toJS();
+  } catch (error) {
+    throw new UsageError(`${source}: not valid YAML (${firstLine2(error)})`);
+  }
+  if (!jsonSafe(value)) {
+    throw new UsageError(`${source}: holds a value JSON cannot carry (.inf or .nan) \u2014 write a number or a string`);
+  }
+  return value;
+}
+function jsonSafe(value) {
+  if (typeof value === "number") return Number.isFinite(value);
+  if (Array.isArray(value)) return value.every(jsonSafe);
+  if (typeof value === "object" && value !== null) return Object.values(value).every(jsonSafe);
+  return true;
+}
+function firstLine2(error) {
+  return (error instanceof Error ? error.message : String(error)).split("\n")[0] ?? "";
+}
+function readPlanFile(path2, flag = "--file") {
+  return parsePlanDocument(readFileOption(flag, path2), path2);
+}
+async function planCreate(ctx, plan, opts) {
+  requireDocument(plan, "a plan is one object: the root's fields and its steps");
+  const team = requiredTeam(ctx, opts.team);
+  validateIdempotencyKey(opts.idempotencyKey);
+  let body;
+  try {
+    body = await ctx.client.post(`/api/v1/teams/${team}/plans`, plan, { idempotencyKey: opts.idempotencyKey });
+  } catch (error) {
+    throw explainMissing(error, `no team ${team} here, or this Harness server has no plan API yet`);
+  }
+  const created = body.data;
+  const id = str7(created["id"]);
+  return {
+    json: created,
+    human: `Created plan ${clean(id)} (${clean(created["status"]) || "held"})
+
+` + planDetail(created) + `
+Nothing runs until it is released: harness plan release ${clean(id)}
+`
+  };
+}
+async function planShow(ctx, id) {
+  requirePlanId(id);
+  const plan = await planRequest(id, () => ctx.client.get(`/api/v1/plans/${id}`));
+  return { json: plan, human: planDetail(plan) };
+}
+async function planEdit(ctx, id, edits) {
+  requirePlanId(id);
+  requireDocument(edits, "a plan edit is one object: steps to change and budgets");
+  const plan = await planRequest(id, () => ctx.client.patch(`/api/v1/plans/${id}`, edits));
+  const held = Array.isArray(plan["held_steps"]) && plan["held_steps"].length > 0;
+  return {
+    json: plan,
+    human: `Updated plan ${clean(id)}
+
+` + planDetail(plan) + (held ? `
+Release it again to run the held steps: harness plan release ${clean(id)}
+` : "")
+  };
+}
+async function planRelease(ctx, id, opts) {
+  requirePlanId(id);
+  const body = {};
+  if (opts.collaborators !== void 0 && opts.collaborators.length > 0) body["collaborators"] = opts.collaborators;
+  if (opts.retryBudget !== void 0) body["retry_budget"] = opts.retryBudget;
+  if (opts.spendBudgetCents !== void 0) body["spend_budget_cents"] = opts.spendBudgetCents;
+  const plan = await planRequest(id, () => ctx.client.post(`/api/v1/plans/${id}/release`, body));
+  const revision = plan["revision"] ?? {};
+  const ready2 = Array.isArray(plan["steps"]) ? plan["steps"].filter((step) => isRecord5(step) && step["ready"] === true).length : 0;
+  return {
+    json: plan,
+    human: `Released plan ${clean(id)} as revision ${clean(revision["number"]) || "?"}: ${ready2} ${ready2 === 1 ? "step" : "steps"} ready now
+`
+  };
+}
+async function planHold(ctx, id) {
+  requirePlanId(id);
+  const plan = await planRequest(id, () => ctx.client.post(`/api/v1/plans/${id}/hold`));
+  return {
+    json: plan,
+    human: `Held plan ${clean(id)}: none of its steps is ready until it is released again
+`
+  };
+}
+async function gateSet(ctx, issue, gate, satisfied) {
+  requireIdentifiers([issue]);
+  const wanted = gate.trim();
+  if (wanted === "") throw new UsageError("name the gate by its key, its label or its condition id");
+  const expert = isExpertToken(ctx.config.token);
+  const list3 = await readConditions(ctx, issue, expert);
+  const target = findGate(list3, issue, wanted, expert);
+  const id = str7(target["id"]);
+  let body;
+  try {
+    body = await ctx.client.put(`/api/v1/issues/${issue}/conditions/${id}/satisfaction`, { satisfied });
+  } catch (error) {
+    throw await explainNotGateOwner(ctx, error, target, issue, satisfied);
+  }
+  const others = list3.filter((condition) => condition["id"] !== id && condition["satisfied"] !== true).length;
+  let tail = "";
+  if (satisfied && expert) {
+    tail = others > 0 ? ` \u2014 ${others} other gate${others === 1 ? "" : "s"} of yours on it ${others === 1 ? "is" : "are"} open` : "";
+  } else if (satisfied) {
+    tail = others > 0 ? ` \u2014 it still waits on ${others} other condition${others === 1 ? "" : "s"}` : " \u2014 no other wait condition holds it";
+  }
+  return {
+    json: body.data,
+    human: `${satisfied ? "Satisfied" : "Un-satisfied"} gate "${clean(target["label"])}" on ${issue}${tail}
+`
+  };
+}
+async function conditionList(ctx, issue) {
+  requireIdentifiers([issue]);
+  const expert = isExpertToken(ctx.config.token);
+  const list3 = await readConditions(ctx, issue, expert);
+  let human;
+  if (list3.length === 0) {
+    human = expert ? `You own no gate on ${issue}.
+` : `No wait conditions on ${issue}.
+`;
+  } else {
+    human = (expert ? `Your gates on ${issue}:
+` : `Wait conditions on ${issue}:
+`) + list3.map((condition) => `  ${conditionLine(condition, { expertView: expert })}
+`).join("");
+  }
+  return { json: list3, human };
+}
+async function readConditions(ctx, issue, expert) {
+  let conditions;
+  try {
+    conditions = (await ctx.client.get(`/api/v1/issues/${issue}/conditions`)).data;
+  } catch (error) {
+    throw explainMissing(
+      error,
+      expert ? `no step ${issue} assigned to you: a pxc_ credential reads only its own steps` : `no issue ${issue} here, or this Harness server has no wait conditions yet`
+    );
+  }
+  if (!Array.isArray(conditions)) throw new CommandError("The conditions response carried no list.");
+  return conditions.filter(isRecord5);
+}
+function requirePlanId(id) {
+  if (!isUuid(id)) throw new UsageError(`not a plan id: ${id} (expected the plan's UUID)`);
+}
+function requireDocument(value, what) {
+  if (!isRecord5(value)) throw new UsageError(what);
+}
+async function planRequest(id, send) {
+  try {
+    return (await send()).data;
+  } catch (error) {
+    throw explainMissing(error, `no plan ${id} in this organization, or this Harness server has no plan API yet`);
+  }
+}
+function explainMissing(error, why) {
+  if (!(error instanceof HttpError) || error.status !== 404) return error;
+  return new HttpError(404, `${error.message} \u2014 ${why}`, error.body, error.retryAfter);
+}
+async function explainNotGateOwner(ctx, error, gate, issue, satisfied) {
+  if (!(error instanceof HttpError) || error.status !== 403 || error.body["reason"] !== "not_gate_owner") return error;
+  let current;
+  let currentOwner = error.body["owner"];
+  if (currentOwner !== null && !isRecord5(currentOwner)) {
+    try {
+      const fresh = (await ctx.client.get(`/api/v1/issues/${issue}/conditions`)).data;
+      if (Array.isArray(fresh)) current = fresh.filter(isRecord5).find((condition) => condition["id"] === gate["id"]);
+    } catch {
+    }
+    currentOwner = current?.["owner"];
+  }
+  const owner = isRecord5(currentOwner) ? ownerText(currentOwner) : "";
+  const subject = `its owner${owner === "" ? "" : `, ${owner},`}`;
+  const named = `gate "${clean((current ?? gate)["label"])}" on ${issue}`;
+  const message = satisfied ? `Cannot satisfy ${named}: only ${subject} can tick it` : `Cannot un-satisfy ${named}: only ${subject} or Harness staff can untick it`;
+  return new HttpError(error.status, message, error.body, error.retryAfter);
+}
+var gateLabel = (condition) => str7(condition["label"]).trim();
+var gateKey = (condition) => str7(condition["key"]);
+function exactMatches(conditions, wanted) {
+  const id = isUuid(wanted) ? wanted.toLowerCase() : null;
+  return conditions.filter((condition) => {
+    if (id !== null && str7(condition["id"]).toLowerCase() === id) return true;
+    if (condition["kind"] !== "gate") return false;
+    const key = gateKey(condition);
+    return key !== "" && key === (id ?? wanted) || gateLabel(condition) === wanted;
+  });
+}
+function ambiguous(conditions, issue, wanted, matches) {
+  const listed = matches.map((condition) => {
+    const what = condition["kind"] === "gate" ? `gate ${gateName({ label: gateLabel(condition), key: gateKey(condition) })}` : `${clean(condition["kind"])} condition`;
+    return `${clean(condition["id"])} (${what})`;
+  }).join(", ");
+  const unnameable = matches.map((condition) => str7(condition["id"])).filter((id) => exactMatches(conditions, id).length !== 1).map((id) => clean(id));
+  const caveat = unnameable.length === 0 ? "" : ` (${unnameable.join(", ")} ${unnameable.length === 1 ? "is" : "are"} also another gate's key or label, so ${unnameable.length === 1 ? "it" : "they"} cannot be named by id)`;
+  return new CommandError(
+    `several gates on ${issue} match "${wanted}": ${listed} \u2014 pass the condition id of the one you mean${caveat}`
+  );
+}
+function findGate(conditions, issue, wanted, expert = false) {
+  const exact = exactMatches(conditions, wanted);
+  if (exact.length > 1) throw ambiguous(conditions, issue, wanted, exact);
+  if (exact.length === 1) {
+    const only = exact[0];
+    if (only["kind"] !== "gate") {
+      throw new CommandError(
+        `condition ${wanted} on ${issue} is a ${clean(only["kind"])} condition \u2014 only a gate is satisfied by hand`
+      );
+    }
+    return only;
+  }
+  const gates = conditions.filter((condition) => condition["kind"] === "gate");
+  const folded = wanted.toLowerCase();
+  const loose = gates.filter(
+    (condition) => gateLabel(condition).toLowerCase() === folded || gateKey(condition) !== "" && gateKey(condition) === folded
+  );
+  if (loose.length > 1) throw ambiguous(conditions, issue, wanted, loose);
+  if (loose.length === 1) return loose[0];
+  if (isUuid(wanted)) throw new CommandError(`No condition ${wanted} on ${issue}${expert ? " that you own" : ""}.`);
+  const none = expert ? `No gate of yours on ${issue}` : `No gate on ${issue}`;
+  if (gates.length === 0) {
+    throw new CommandError(`${none} matches "${wanted}" \u2014 ${expert ? "you own no gate on it" : "it has no gates"}`);
+  }
+  const names = gates.map((condition) => gateName({ label: gateLabel(condition), key: gateKey(condition) })).join(", ");
+  throw new CommandError(`${none} matches "${wanted}". ${expert ? "Your" : "Its"} gates: ${names}`);
+}
+function isRecord5(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function str7(value) {
+  return value === null || value === void 0 ? "" : String(value);
+}
+
+// src/commands/expert.ts
+async function assignments(ctx) {
+  const data = (await ctx.client.get(EXPERT_ASSIGNMENTS_PATH)).data;
+  if (!isRecord6(data) || !Array.isArray(data["assignments"])) {
+    throw new CommandError("The assignments response carried no list.");
+  }
+  const steps = data["assignments"].filter(isRecord6);
+  const expert = isRecord6(data["expert"]) ? data["expert"] : {};
+  const plan = isRecord6(data["plan"]) ? { id: data["plan"]["id"], status: data["plan"]["status"] } : null;
+  const header = expertSummary({ role: expert["role"], plan, assigned_steps: steps.length });
+  return { json: data, human: `${header}
+${expertAssignments(steps)}` };
+}
+function isRecord6(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/core/credentials.ts
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync4, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { homedir } from "os";
+import { dirname as dirname2, isAbsolute, join as join2 } from "path";
+function defaultCredentialsPath(env = process.env) {
+  const xdg = env["XDG_CONFIG_HOME"];
+  const base = xdg !== void 0 && xdg !== "" && isAbsolute(xdg) ? xdg : join2(homedir(), ".config");
+  return join2(base, "harness", "credentials.json");
+}
+function readCredentials(path2) {
+  try {
+    const parsed = JSON.parse(readFileSync4(path2, "utf8"));
+    if (typeof parsed === "object" && parsed !== null) {
+      const { url, token } = parsed;
+      if (typeof url === "string" && typeof token === "string") return { url, token };
+    }
+  } catch {
+  }
+  return null;
+}
+var uniqueCounter = 0;
+function writeCredentials(path2, url, token) {
+  mkdirSync2(dirname2(path2), { recursive: true });
+  const tempPath = `${path2}.${process.pid}.${++uniqueCounter}.tmp`;
+  try {
+    writeFileSync2(tempPath, "", { mode: 384 });
+    chmodSync2(tempPath, 384);
+    writeFileSync2(tempPath, JSON.stringify({ url, token }));
+    renameSync2(tempPath, path2);
+  } finally {
+    rmSync2(tempPath, { force: true });
+  }
+}
+function deleteCredentials(path2) {
+  rmSync2(path2, { force: true });
+}
+
+// src/core/repo-config.ts
+import { existsSync, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname3, isAbsolute as isAbsolute2, join as join3, parse } from "path";
+var CONFIG_RELATIVE_PATH = join3(".harness-cli", "config.json");
+function findRepoConfig(startDir = process.cwd()) {
+  let dir = startDir;
+  const { root } = parse(startDir);
+  for (; ; ) {
+    const candidate = join3(dir, CONFIG_RELATIVE_PATH);
+    if (existsSync(candidate)) {
+      return readRepoConfig(candidate);
+    }
+    if (dir === root) return { config: null, warnings: [] };
+    dir = dirname3(dir);
+  }
+}
+function readRepoConfig(path2) {
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync5(path2, "utf8"));
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return { config: null, warnings: [`harness: ignoring malformed ${path2} (${detail})`] };
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return { config: null, warnings: [`harness: ignoring ${path2} \u2014 expected a JSON object`] };
+  }
+  const record = parsed;
+  const config = { path: path2 };
+  const warnings = [];
+  for (const field3 of ["team", "url", "org"]) {
+    const value = record[field3];
+    if (value === void 0) continue;
+    if (typeof value === "string" && value.trim() !== "") {
+      config[field3] = value.trim();
+    } else {
+      warnings.push(`harness: ignoring "${field3}" in ${path2} \u2014 expected a non-empty string`);
+    }
+  }
+  return { config, warnings };
+}
+function trustedHostsPath(env = process.env) {
+  const xdg = env["XDG_CONFIG_HOME"];
+  const base = xdg !== void 0 && xdg !== "" && isAbsolute2(xdg) ? xdg : join3(homedir2(), ".config");
+  return join3(base, "harness", "trusted-hosts.json");
+}
+function readTrustedHosts(env) {
+  try {
+    const parsed = JSON.parse(readFileSync5(trustedHostsPath(env), "utf8"));
+    if (typeof parsed === "object" && parsed !== null && Array.isArray(parsed["hosts"])) {
+      return parsed["hosts"].filter(
+        (host) => typeof host === "string"
+      );
+    }
+  } catch {
+  }
+  return [];
+}
+function isHostTrusted(baseUrl, env) {
+  return readTrustedHosts(env).includes(baseUrl);
+}
+function trustHost(baseUrl, env) {
+  const hosts = readTrustedHosts(env);
+  if (hosts.includes(baseUrl)) return;
+  const path2 = trustedHostsPath(env);
+  mkdirSync3(dirname3(path2), { recursive: true });
+  writeFileSync3(path2, JSON.stringify({ hosts: [...hosts, baseUrl] }, null, 2) + "\n");
+}
+
+// src/core/config.ts
+import { homedir as homedir3, tmpdir } from "os";
+import { isAbsolute as isAbsolute3, join as join4 } from "path";
+var DEFAULT_BASE_URL = "https://harness.infra.one";
+function resolveConfig(env = process.env, credentialsPath, repo) {
+  let warnings = [];
+  if (repo === void 0) {
+    const lookup = findRepoConfig();
+    repo = lookup.config;
+    warnings = lookup.warnings;
+  }
+  const path2 = credentialsPath ?? defaultCredentialsPath(env);
+  const stored = readCredentials(path2);
+  const envUrl = blankToNull(env["HARNESS_API_URL"]);
+  const envToken = blankToNull(env["HARNESS_API_TOKEN"]);
+  const repoUrl = repo?.url?.replace(/\/+$/, "") ?? null;
+  let rawUrl;
+  let hostSource;
+  if (envUrl !== null) {
+    rawUrl = envUrl;
+    hostSource = "env";
+  } else if (envToken !== null) {
+    if (repoUrl !== null && normalize(repoUrl) !== normalize(DEFAULT_BASE_URL)) {
+      return {
+        kind: "error",
+        message: `this repo's config (${repo?.path}) targets ${repoUrl}, but HARNESS_API_TOKEN only travels to the host the environment names \u2014 set HARNESS_API_URL explicitly to pair them`,
+        warnings
+      };
+    }
+    rawUrl = DEFAULT_BASE_URL;
+    hostSource = "default";
+  } else if (repoUrl !== null) {
+    rawUrl = repoUrl;
+    hostSource = "repo-config";
+  } else if (stored !== null) {
+    rawUrl = stored.url;
+    hostSource = "stored-login";
+  } else {
+    rawUrl = DEFAULT_BASE_URL;
+    hostSource = "default";
+  }
+  const validated = validateBaseUrl(rawUrl);
+  if (!validated.ok) return { kind: "error", message: validated.message, warnings };
+  const baseUrl = rawUrl.replace(/\/+$/, "");
+  let token;
+  if (envToken !== null) {
+    token = envToken;
+  } else if (stored !== null && normalize(stored.url) !== null && normalize(stored.url) === normalize(baseUrl)) {
+    token = stored.token;
+  } else {
+    const result = { kind: "needs-login", baseUrl, hostSource, warnings };
+    if (hostSource === "repo-config" && repo?.path !== void 0) result.repoConfigPath = repo.path;
+    return result;
+  }
+  return {
+    kind: "ok",
+    config: {
+      baseUrl,
+      token,
+      actor: blankToNull(env["HARNESS_ACTOR"]),
+      // The committed team is the fallback: the environment (and, above it,
+      // the --team flag at the command layer) stays authoritative.
+      team: blankToNull(env["HARNESS_TEAM"]) ?? repo?.team ?? null,
+      cacheDir: resolveCacheDir(env),
+      hostSource
+    },
+    warnings
+  };
+}
+function resolveCacheDir(env = process.env) {
+  return absolute(env["HARNESS_CACHE_DIR"]) ?? join4(resolveCacheHome(env), "harness", "attachments");
+}
+function absolute(value) {
+  return value !== void 0 && value !== "" && isAbsolute3(value) ? value : null;
+}
+function resolveCacheHome(env = process.env) {
+  return absolute(env["XDG_CACHE_HOME"]) ?? join4(homedir3() || tmpdir(), ".cache");
+}
+function normalize(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return null;
+  }
+  const port = parsed.port !== "" ? parsed.port : parsed.protocol === "https:" ? "443" : parsed.protocol === "http:" ? "80" : "";
+  return JSON.stringify([parsed.protocol, parsed.hostname, port, parsed.pathname.replace(/\/+$/, "")]);
+}
+function validateBaseUrl(baseUrl) {
+  let parsed;
+  try {
+    parsed = new URL(baseUrl);
+  } catch {
+    return { ok: false, message: `HARNESS_API_URL must be an http(s) URL with a host, got: ${baseUrl}` };
+  }
+  if (parsed.username !== "" || parsed.password !== "") {
+    return { ok: false, message: "HARNESS_API_URL must not embed credentials (user:pass@) \u2014 use HARNESS_API_TOKEN" };
+  }
+  if (parsed.search !== "" || parsed.hash !== "") {
+    return { ok: false, message: `HARNESS_API_URL must not carry a query or fragment, got: ${baseUrl}` };
+  }
+  if (parsed.protocol === "https:" && parsed.hostname !== "") return { ok: true };
+  if (parsed.protocol === "http:") {
+    if (["localhost", "127.0.0.1", "[::1]"].includes(parsed.hostname)) return { ok: true };
+    return {
+      ok: false,
+      message: `refusing plain-http HARNESS_API_URL (${baseUrl}) \u2014 the API token would travel in cleartext. Use https, or http against localhost only.`
+    };
+  }
+  return { ok: false, message: `HARNESS_API_URL must be an http(s) URL with a host, got: ${baseUrl}` };
+}
+function loginHelp(baseUrl) {
+  return `Not signed in to ${baseUrl}.
+
+Interactively, in a terminal (not from inside an agent \u2014 the browser
+tab needs someone to see it):
+
+    harness login
+
+For agents and CI, mint an API token (admin \u2192 API tokens) with the
+harness:read scope \u2014 plus harness:write only where the workflow
+creates or closes \u2014 set an expiry, and export it:
+
+    export HARNESS_API_TOKEN=aone_...
+
+An outside expert uses the pxc_ credential minted in their expert view:
+export it the same way, or paste it into \`harness login --no-browser\`.
+`;
+}
+function blankToNull(value) {
+  if (value === void 0 || value.trim() === "") return null;
+  return value;
+}
+
+export {
+  HttpError,
+  UpgradeRequiredError,
+  TransportError,
+  UsageError,
+  LocalError,
+  CommandError,
+  CLI_VERSION,
+  CLI_PACKAGE,
+  EXPERT_ASSIGNMENTS_PATH,
+  isExpertToken,
+  EXPERT_LAPSED,
+  explainExpertRefusal,
+  Client,
+  clean,
+  json,
+  expertSummary,
+  errorDetails,
+  MAX_IDEMPOTENCY_KEY_BYTES,
+  IDEMPOTENCY_KEY_FORMAT,
+  requireIdentifiers,
+  ready,
+  requireReadyClaimArgs,
+  blocked,
+  list,
+  search,
+  show,
+  ACTIVITY_MAX_LIMIT,
+  activity,
+  stats2 as stats,
+  prime,
+  version,
+  create,
+  validateIdempotencyKey,
+  update,
+  requireCloseArgs,
+  close,
+  archive,
+  comments,
+  dep,
+  RELATION_CREATE_TYPES,
+  RELATION_UPDATE_TYPES,
+  relationList,
+  relationAdd,
+  relationUpdate,
+  relationRm,
+  comment,
+  editComment,
+  deleteComment,
+  requireCommentId,
+  attachImage,
+  requiredTeam,
+  projectList,
+  projectShow,
+  projectCreate,
+  projectUpdate,
+  milestoneList,
+  milestoneCreate,
+  docList,
+  docShow,
+  docCreate,
+  docUpdate,
+  linkList,
+  linkAdd,
+  linkUpdate,
+  linkRm,
+  labelList2 as labelList,
+  labelCreate,
+  teamCreate,
+  teamList,
+  workflowStates,
+  userList,
+  teamRename,
+  teamSetDefault,
+  stateAdd,
+  stateUpdate,
+  stateOrder,
+  stateDelete,
+  labelUpdate,
+  labelDelete,
+  memberList,
+  memberAdd,
+  memberSetRole,
+  upload,
+  toolsList,
+  toolsSearch,
+  toolsDomains,
+  toolShow,
+  skillsList,
+  requireCapabilityId,
+  requireSearchQuery,
+  requireToolsOpts,
+  requireSchemaView,
+  JOB_STATES,
+  JOB_STATUS_ALIASES,
+  JOBS_MAX_LIMIT,
+  JOBS_MAX_PAGES,
+  EXIT_WAITING_FOR_PERSON,
+  EXIT_JOB_ENDED,
+  EXIT_INTERRUPTED,
+  requireJobsArgs,
+  jobsList,
+  requireJobId,
+  jobShow,
+  jobWatch,
+  watchStopSignal,
+  jobContinue,
+  resolveTextSources,
+  STEER_MAX_CHARACTERS,
+  instructionFrom,
+  jobSteer,
+  jobCancel,
+  jobPause,
+  requireProcedureId,
+  requireProcedureName,
+  procedureSave,
+  procedureShow,
+  prepareProcedureRun,
+  startProcedureRun,
+  procedureRun,
+  PLAN_EXECUTORS,
+  CONDITION_KINDS,
+  GATE_OWNER_ROLES,
+  readPlanFile,
+  planCreate,
+  planShow,
+  planEdit,
+  planRelease,
+  planHold,
+  gateSet,
+  conditionList,
+  requirePlanId,
+  assignments,
+  defaultCredentialsPath,
+  readCredentials,
+  writeCredentials,
+  deleteCredentials,
+  findRepoConfig,
+  isHostTrusted,
+  trustHost,
+  DEFAULT_BASE_URL,
+  resolveConfig,
+  resolveCacheHome,
+  validateBaseUrl,
+  loginHelp
+};