@allocator-one/harness-cli 1.16.0 → 1.17.0

package/dist/chunk-BHBEIT5I.js

@@ -0,0 +1,1348 @@
+#!/usr/bin/env node
+import {
+  CLI_PACKAGE,
+  CLI_VERSION,
+  invokedName
+} from "./chunk-5THYIKLW.js";
+
+// src/core/errors.ts
+var HttpError = class extends Error {
+  constructor(status, message, body = {}, retryAfter = null) {
+    super(message);
+    this.status = status;
+    this.body = body;
+    this.retryAfter = retryAfter;
+    this.name = "HttpError";
+  }
+  status;
+  body;
+  retryAfter;
+};
+var UpgradeRequiredError = class extends HttpError {
+  constructor(message, body = {}) {
+    super(426, message, body);
+    this.name = "UpgradeRequiredError";
+  }
+};
+var TransportError = class extends Error {
+  constructor(message, code = null) {
+    super(message);
+    this.code = code;
+    this.name = "TransportError";
+  }
+  code;
+};
+var MalformedResponseError = class extends TransportError {
+  constructor(message) {
+    super(message);
+    this.name = "MalformedResponseError";
+  }
+};
+var UsageError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "UsageError";
+  }
+};
+var LocalError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "LocalError";
+  }
+};
+var CommandError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CommandError";
+  }
+};
+
+// src/core/expert.ts
+var EXPERT_TOKEN_PREFIX = "pxc_";
+var EXPERT_ASSIGNMENTS_PATH = "/api/v1/expert/assignments";
+function isExpertToken(token) {
+  return token.startsWith(EXPERT_TOKEN_PREFIX);
+}
+var EXPERT_REACH = "an outside expert's pxc_ credential only lists its own assignments and reads and ticks the gates it owns on them: assignments, conditions <issue> and gate satisfy|unsatisfy (assignment_list, condition_list and gate_set over MCP)";
+var EXPERT_LAPSED = "the pxc_ credential is not valid here: it has expired (it lasts at most 30 days) or was revoked, its seat was revoked or has ended, the account is suspended, its TOTP enrolment changed, or it was minted for another host. If your seat is still open, mint a new one in your expert view";
+var NOT_AN_EXPERT = "this credential is a member's login or an API token, not an outside expert's pxc_ credential";
+function explainExpertRefusal(error, token) {
+  if (!(error instanceof HttpError) || error instanceof UpgradeRequiredError) return error;
+  const code = error.body["error"];
+  let hint;
+  if (error.status === 403 && code === "expert_bound_credential") hint = EXPERT_REACH;
+  else if (error.status === 403 && code === "expert_credential_required") hint = NOT_AN_EXPERT;
+  else if (error.status === 401 && isExpertToken(token)) hint = EXPERT_LAPSED;
+  if (hint === void 0) return error;
+  return new HttpError(error.status, `${error.message} \u2014 ${hint}`, error.body, error.retryAfter);
+}
+
+// src/core/client.ts
+var RECEIVE_TIMEOUT_MS = 3e4;
+var UPLOAD_RECEIVE_TIMEOUT_MS = 6e4;
+var UPLOAD_FLOOR_BYTES_PER_MS = 100;
+function uploadTimeoutMs(bodyBytes) {
+  return UPLOAD_RECEIVE_TIMEOUT_MS + Math.ceil(bodyBytes / UPLOAD_FLOOR_BYTES_PER_MS);
+}
+var DEFAULT_MESSAGES = {
+  401: "Missing or invalid token (check HARNESS_API_TOKEN)",
+  403: "Token not permitted (scope or admin gate)",
+  404: "Not found",
+  409: "Conflict",
+  422: "Validation error",
+  426: `CLI too old for this API \u2014 upgrade: npm i -g ${CLI_PACKAGE}@latest`,
+  429: "Rate limited \u2014 retry later"
+};
+var API_VERSION_HEADER = "x-harness-api-version";
+var STATS_PATH = "/api/v1/stats";
+var SESSION_PATH = "/api/v1/session";
+function isLoginCredential(token) {
+  return !token.startsWith("aone_") && !isExpertToken(token);
+}
+var Client = class {
+  constructor(config) {
+    this.config = config;
+    this.fetchImpl = config.fetchImpl ?? globalThis.fetch;
+  }
+  config;
+  fetchImpl;
+  get cliVersion() {
+    return CLI_VERSION;
+  }
+  get baseUrl() {
+    return this.config.baseUrl;
+  }
+  async get(path2, params) {
+    return this.json(await this.raw("GET", path2, { params }));
+  }
+  /**
+   * `actor: false` keeps a configured actor out of the body, for endpoints
+   * whose body is closed: they refuse a field they do not name, and record
+   * the credential's own person instead.
+   */
+  async post(path2, body = {}, options = {}) {
+    return this.json(
+      await this.raw("POST", path2, {
+        json: options.actor === false ? body : this.withActor(body),
+        idempotencyKey: options.idempotencyKey
+      })
+    );
+  }
+  async patch(path2, body) {
+    return this.json(await this.raw("PATCH", path2, { json: this.withActor(body) }));
+  }
+  async put(path2, body) {
+    return this.json(await this.raw("PUT", path2, { json: this.withActor(body) }));
+  }
+  async delete(path2) {
+    return this.json(await this.raw("DELETE", path2, {}));
+  }
+  /**
+   * Posts multipart/form-data — the one endpoint that does not take JSON.
+   * Shares auth, the version header, and error mapping with the JSON verbs,
+   * but never the actor: there is no JSON body to carry an `actor` field,
+   * and the server's file contract is the form itself.
+   */
+  async postMultipart(path2, form, bodyBytes = 0) {
+    return this.json(await this.raw("POST", path2, { form, timeoutMs: uploadTimeoutMs(bodyBytes) }));
+  }
+  /** Binary download (attachments); non-2xx still maps through the JSON error envelope. */
+  async getBytes(path2) {
+    const response = await this.raw("GET", path2, {});
+    if (!response.ok) throw await this.toHttpError(response);
+    try {
+      return new Uint8Array(await response.arrayBuffer());
+    } catch (error) {
+      throw new TransportError(transportMessage(error), transportCode(error));
+    }
+  }
+  /**
+   * A GET that also hands back the server's API version header, so a probe
+   * that verifies a credential reports the version without a second
+   * request. Errors map as for `get`.
+   */
+  async getVersioned(path2) {
+    const response = await this.raw("GET", path2, {});
+    const apiVersion = response.headers.get(API_VERSION_HEADER);
+    return { envelope: await this.json(response), apiVersion };
+  }
+  /**
+   * The server's API version, for `version`'s server side. The header rides
+   * on every response of a route the server has — the versioning plug runs
+   * before auth — so even a 401 answers. Each credential probes a route it
+   * reaches, so the probe is never a refusal in the server's log: a pxc_
+   * credential its assignments, a login credential of either kind (the
+   * Operator-only one reaches no tracker read) GET /api/v1/session, and an
+   * aone_ token the stats. A server older than GET /api/v1/session answers
+   * that route's 404 without the header, so the stats answer then.
+   */
+  async serverVersion() {
+    const token = this.config.token;
+    const path2 = isExpertToken(token) ? EXPERT_ASSIGNMENTS_PATH : isLoginCredential(token) ? SESSION_PATH : STATS_PATH;
+    const version = (await this.raw("GET", path2, {})).headers.get(API_VERSION_HEADER);
+    if (version !== null || path2 !== SESSION_PATH) return version ?? "unknown";
+    return (await this.raw("GET", STATS_PATH, {})).headers.get(API_VERSION_HEADER) ?? "unknown";
+  }
+  // Only an explicitly configured actor is sent, and never over one the
+  // caller already put in the body.
+  withActor(body) {
+    if (this.config.actor === null || "actor" in body) return body;
+    return { ...body, actor: this.config.actor };
+  }
+  async raw(method, path2, options) {
+    const url = new URL(this.config.baseUrl + path2);
+    for (const [key, value] of Object.entries(options.params ?? {})) {
+      if (value !== void 0) url.searchParams.set(key, String(value));
+    }
+    const headers = {
+      authorization: `Bearer ${this.config.token}`,
+      "x-harness-cli-version": CLI_VERSION
+    };
+    if (options.idempotencyKey !== void 0) {
+      headers["idempotency-key"] = options.idempotencyKey;
+    }
+    let body;
+    if (options.json !== void 0) {
+      headers["content-type"] = "application/json";
+      body = JSON.stringify(options.json);
+    } else if (options.form !== void 0) {
+      body = options.form;
+    }
+    try {
+      return await this.fetchImpl(url, {
+        method,
+        headers,
+        body,
+        signal: AbortSignal.timeout(options.timeoutMs ?? RECEIVE_TIMEOUT_MS),
+        redirect: "manual"
+      });
+    } catch (error) {
+      throw new TransportError(transportMessage(error), transportCode(error));
+    }
+  }
+  async json(response) {
+    if (!response.ok) throw await this.toHttpError(response);
+    let text;
+    try {
+      text = await response.text();
+    } catch (error) {
+      throw new TransportError(transportMessage(error), transportCode(error));
+    }
+    if (text === "") return { data: void 0 };
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      throw new MalformedResponseError(`the API answered with a non-JSON body (HTTP ${response.status})`);
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      throw new MalformedResponseError(`the API answered with an invalid JSON envelope (HTTP ${response.status})`);
+    }
+    return parsed;
+  }
+  async toHttpError(response) {
+    let parsed = {};
+    try {
+      const candidate = JSON.parse(await response.text());
+      if (typeof candidate === "object" && candidate !== null) {
+        parsed = candidate;
+      }
+    } catch {
+    }
+    const fromBody = typeof parsed["message"] === "string" ? parsed["message"] : null;
+    const message = fromBody ?? DEFAULT_MESSAGES[response.status] ?? `HTTP ${response.status}`;
+    if (response.status === 426) return new UpgradeRequiredError(message, parsed);
+    return new HttpError(response.status, message, parsed, response.headers.get("retry-after"));
+  }
+};
+function transportCode(error) {
+  const cause = error instanceof Error ? error.cause : void 0;
+  if (typeof cause !== "object" || cause === null) return null;
+  const code = cause.code;
+  if (typeof code === "string") return code;
+  const errors = cause.errors;
+  if (!Array.isArray(errors)) return null;
+  const codes = new Set(errors.map((inner) => inner?.code));
+  const [only] = codes;
+  return codes.size === 1 && typeof only === "string" ? only : null;
+}
+function transportMessage(error) {
+  if (error instanceof Error) {
+    if (error.name === "TimeoutError" || error.name === "AbortError") return "request timed out";
+    const cause = error.cause;
+    if (cause instanceof Error && cause.message !== "") return cause.message;
+    return error.message;
+  }
+  return String(error);
+}
+
+// src/core/output.ts
+var TITLE_WIDTH = 70;
+var segmenter = new Intl.Segmenter(void 0, { granularity: "grapheme" });
+function graphemes(text) {
+  return [...segmenter.segment(text)].map((piece) => piece.segment);
+}
+function graphemeLength(text) {
+  return graphemes(text).length;
+}
+function padGraphemes(text, width) {
+  const shortfall = width - graphemeLength(text);
+  return shortfall > 0 ? text + " ".repeat(shortfall) : text;
+}
+function clean(value) {
+  if (value === null || value === void 0) return "";
+  return String(value).replace(/[\x00-\x1F\x7F\u0080-\u009F]/gu, "");
+}
+function json(term) {
+  return JSON.stringify(term) + "\n";
+}
+var OPERATOR_TEAM_KEY = /^OPERATOR\d*$/;
+var OPERATOR_TEAM_NAME = "Operator";
+var AGENT_MARK = "[agent]";
+var AGENT_LEGEND = `
+${AGENT_MARK} Operator runs this step for its plan; only the plan driver claims it.
+`;
+function isAgentStep(issue) {
+  return OPERATOR_TEAM_KEY.test(str(path(issue, "team", "key"))) && str(path(issue, "team", "name")) === OPERATOR_TEAM_NAME;
+}
+function issuesTable(issues, options = {}) {
+  if (issues.length === 0) return "No issues.\n";
+  let marked = false;
+  const rows = issues.map((issue) => {
+    const agentStep = options.markAgentSteps === true && isAgentStep(issue);
+    if (agentStep) marked = true;
+    return [
+      str(issue["identifier"]),
+      str(path(issue, "state", "name")) || "-",
+      str(issue["priority_label"]) || "-",
+      str(path(issue, "assignee", "name")) || "-",
+      agentStep ? truncate(`${AGENT_MARK} ${clean(issue["title"])}`) : truncate(issue["title"])
+    ];
+  });
+  const rendered = table(["ID", "STATE", "PRIORITY", "ASSIGNEE", "TITLE"], rows);
+  return marked ? rendered + AGENT_LEGEND : rendered;
+}
+function issueDetail(issue, images = []) {
+  const header = `${str(issue["identifier"])} \xB7 ${clean(issue["title"])}
+`;
+  const fields = [
+    ["State", path(issue, "state", "name")],
+    ["Priority", issue["priority_label"]],
+    ["Assignee", path(issue, "assignee", "name")],
+    ["Team", path(issue, "team", "key")],
+    ["Plan", issuePlanLine(issue["plan"])],
+    ["Labels", labelsLine(issue["labels"])],
+    ["Blocked", blockedLine(issue)],
+    ["Waiting", waitingLine(issue)],
+    ["Due", issue["due_date"]],
+    ["Updated", issue["updated_at"]]
+  ];
+  const fieldLines = fields.filter(([, value]) => value !== null && value !== void 0 && value !== "").map(([label, value]) => `  ${(label + ":").padEnd(12)}${clean(value)}
+`).join("");
+  const sections = [
+    ["Description", issue["description"]],
+    ["Design", issue["design"]],
+    ["Acceptance criteria", issue["acceptance_criteria"]],
+    ["Notes", issue["notes"]]
+  ];
+  const sectionText = sections.filter(([, text]) => text !== null && text !== void 0 && text !== "").map(([title, text]) => `
+${title}:
+${indent(String(text))}
+`).join("");
+  return header + fieldLines + sectionText + conditionsSection(issue["conditions"]) + relationsSection(issue["relations"]) + childrenSection(issue["children"]) + commentsSection(issue["comments"]) + imagesSection(images);
+}
+function activityEntries(entries) {
+  if (entries.length === 0) return "No activity.\n";
+  return entries.map(activityEntry).join("\n");
+}
+function activityEntry(entry) {
+  switch (entry["kind"]) {
+    case "comment":
+      return activityComment(entry);
+    case "state_event":
+      return activityStateEvent(entry);
+    case "assignee_event":
+      return activityAssigneeEvent(entry);
+    case "condition_event":
+      return activityConditionEvent(entry);
+    case "field_event":
+      return activityFieldEvent(entry);
+    default:
+      throw new CommandError(`Unknown activity entry kind: ${clean(entry["kind"])}`);
+  }
+}
+function activityComment(entry) {
+  const comment = requiredRecord(entry["comment"], "activity comment");
+  const authorValue = comment["author"];
+  const author = authorValue === null ? "unknown" : optionalLabel(requiredRecord(authorValue, "comment author")["name"], "unknown", "comment author name");
+  const deleted = comment["deleted"];
+  if (typeof deleted !== "boolean") throw new CommandError("Invalid comment deleted flag.");
+  const body = activityCommentBody(comment["body"], deleted);
+  const text = cleanMultiline(body).split("\n").map((line) => "  " + line).join("\n");
+  return `[${occurredAt(entry)}] ${clean(author)} (${clean(requiredString(comment["id"], "comment id"))}):
+${text}
+`;
+}
+function activityCommentBody(value, deleted) {
+  if (deleted) return "[deleted comment]";
+  if (value === null || value === "") return "[comment has no text]";
+  return requiredString(value, "comment body");
+}
+function activityStateEvent(entry) {
+  const actor = activityWho(entry);
+  const provenance = activityProvenance(requiredRecord(entry["provenance"], "activity provenance"));
+  let description;
+  switch (entry["action"]) {
+    case "created":
+      description = `${actor} created the issue in ${stateName(entry["to_state"], "created to_state")}`;
+      break;
+    case "transition":
+      description = `${actor} moved the issue from ${nullableStateName(entry["from_state"], "transition from_state")} to ${stateName(entry["to_state"], "transition to_state")}`;
+      break;
+    case "milestone":
+      description = `${actor} recorded the ${stateName(entry["to_state"], "milestone to_state")} milestone`;
+      break;
+    default:
+      throw new CommandError(`Unknown activity action: ${clean(entry["action"])}`);
+  }
+  return `[${occurredAt(entry)}] ${description} \xB7 ${provenance}
+`;
+}
+function activityAssigneeEvent(entry) {
+  const actor = activityWho(entry);
+  const provenance = activityProvenance(requiredRecord(entry["provenance"], "activity provenance"));
+  let description;
+  switch (entry["action"]) {
+    case "assigned":
+      description = `${actor} assigned the issue to ${assigneeName(entry["to_assignee"])}`;
+      break;
+    case "reassigned":
+      description = `${actor} reassigned the issue from ${assigneeName(entry["from_assignee"])} to ${assigneeName(entry["to_assignee"])}`;
+      break;
+    case "unassigned":
+      description = `${actor} unassigned the issue from ${assigneeName(entry["from_assignee"])}`;
+      break;
+    default:
+      throw new CommandError(`Unknown activity action: ${clean(entry["action"])}`);
+  }
+  return `[${occurredAt(entry)}] ${description} - ${provenance}
+`;
+}
+function activityConditionEvent(entry) {
+  const actor = activityWho(entry);
+  const provenance = activityProvenance(requiredRecord(entry["provenance"], "activity provenance"));
+  const condition = conditionSubject(requiredRecord(entry["condition"], "activity condition"));
+  let description;
+  switch (entry["action"]) {
+    case "added":
+      description = `${actor} added ${condition}`;
+      break;
+    case "changed":
+      description = `${actor} changed ${condition}`;
+      break;
+    case "removed":
+      description = `${actor} removed ${condition}`;
+      break;
+    case "satisfied":
+      description = `${actor} satisfied ${condition}`;
+      break;
+    case "unsatisfied":
+      description = `${actor} marked ${condition} unsatisfied`;
+      break;
+    default:
+      throw new CommandError(`Unknown activity action: ${clean(entry["action"])}`);
+  }
+  return `[${occurredAt(entry)}] ${description} \xB7 ${provenance}
+`;
+}
+function conditionSubject(condition) {
+  const label = clean(condition["label"]);
+  switch (condition["kind"]) {
+    case "gate":
+      return label === "" ? "the gate" : `the gate "${label}"`;
+    case "not_before": {
+      const at = clean(condition["not_before"]);
+      return at === "" ? "the not-before date" : `the not-before date ${at}`;
+    }
+    case "event":
+      return label === "" ? "the wait condition" : `the system event "${label}"`;
+    default:
+      return "the wait condition";
+  }
+}
+function activityFieldEvent(entry) {
+  const actor = activityWho(entry);
+  const provenance = activityProvenance(requiredRecord(entry["provenance"], "activity provenance"));
+  const change = fieldChange(requiredString(entry["field"], "activity field"), entry["from"], entry["to"]);
+  return `[${occurredAt(entry)}] ${actor} ${change} \xB7 ${provenance}
+`;
+}
+function fieldChange(field, from, to) {
+  switch (field) {
+    case "priority":
+      return `changed priority from ${priorityName(from)} to ${priorityName(to)}`;
+    case "title":
+      return `renamed the issue from \u201C${activityTitle(from)}\u201D to \u201C${activityTitle(to)}\u201D`;
+    case "description":
+      return "edited the description";
+    case "labels":
+      return labelsChange(to);
+    case "parent":
+      return parentChange(from, to);
+    case "archived":
+      if (typeof to !== "boolean") throw new CommandError("Invalid activity archived value.");
+      return to ? "archived the issue" : "unarchived the issue";
+    default:
+      return `changed the ${clean(field)} field`;
+  }
+}
+var ACTIVITY_PRIORITIES = {
+  0: "No priority",
+  1: "Urgent",
+  2: "High",
+  3: "Medium",
+  4: "Low"
+};
+function priorityName(value) {
+  if (typeof value !== "number" || !Number.isInteger(value)) throw new CommandError("Invalid activity priority.");
+  return ACTIVITY_PRIORITIES[value] ?? String(value);
+}
+function activityTitle(value) {
+  if (typeof value !== "string") throw new CommandError("Invalid activity title.");
+  return clean(value);
+}
+function labelsChange(to) {
+  const change = requiredRecord(to, "activity labels");
+  const added = labelNames(change["added"]);
+  const removed = labelNames(change["removed"]);
+  const parts = [
+    ...added.length > 0 ? [`added ${labelList(added)}`] : [],
+    ...removed.length > 0 ? [`removed ${labelList(removed)}`] : []
+  ];
+  return parts.length === 0 ? "changed the labels" : parts.join(" and ");
+}
+function labelNames(value) {
+  if (!Array.isArray(value)) throw new CommandError("Invalid activity labels.");
+  return value.map((label) => clean(requiredString(requiredRecord(label, "activity labels")["name"], "activity labels")));
+}
+function labelList(names) {
+  return `${names.length === 1 ? "label" : "labels"} ${names.join(", ")}`;
+}
+function parentChange(from, to) {
+  if (from === null && to === null) return "changed the parent";
+  if (from === null) return `set the parent to ${parentName(to)}`;
+  if (to === null) return `removed the parent ${parentName(from)}`;
+  return `changed the parent from ${parentName(from)} to ${parentName(to)}`;
+}
+function parentName(value) {
+  const parent = requiredRecord(value, "activity parent");
+  return optionalLabel(parent["identifier"], "an unknown issue", "activity parent identifier");
+}
+function activityWho(entry) {
+  const actor = activityActor(requiredRecord(entry["actor"], "activity actor"));
+  const label = entry["actor_label"];
+  if (label === void 0 || label === null || label === "") return actor;
+  if (typeof label !== "string") throw new CommandError("Invalid activity actor label.");
+  const cleaned = clean(label);
+  return cleaned === "" ? actor : `${actor} via \u201C${cleaned}\u201D`;
+}
+function occurredAt(entry) {
+  return clean(requiredString(entry["occurred_at"], "activity occurrence time"));
+}
+function assigneeName(value) {
+  const assignee = requiredRecord(value, "activity assignee");
+  if (assignee["kind"] === "unknown") return "Unknown assignee";
+  return activityActor(assignee);
+}
+function activityActor(actor) {
+  switch (actor["kind"]) {
+    case "user":
+      return optionalLabel(actor["name"], "Unknown actor", "activity actor name");
+    case "system":
+      return "System";
+    case "deleted_user":
+      return "Deleted user";
+    case "unknown":
+      return "Unknown actor";
+    default:
+      throw new CommandError(`Unknown activity actor kind: ${clean(actor["kind"])}`);
+  }
+}
+function activityProvenance(provenance) {
+  switch (provenance["kind"]) {
+    case "live":
+    case "import":
+    case "backfill":
+      return String(provenance["kind"]);
+    default:
+      throw new CommandError(`Unknown activity provenance: ${clean(provenance["kind"])}`);
+  }
+}
+function stateName(value, field) {
+  return optionalLabel(requiredRecord(value, field)["name"], "Unknown state", `${field} name`);
+}
+function nullableStateName(value, field) {
+  return value === null ? "Unknown state" : stateName(value, field);
+}
+function optionalLabel(value, fallback, field) {
+  if (value === null || value === "") return fallback;
+  return clean(requiredString(value, field));
+}
+function requiredRecord(value, field) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new CommandError(`Invalid ${field}.`);
+  }
+  return value;
+}
+function requiredString(value, field) {
+  if (typeof value !== "string" || value === "") throw new CommandError(`Invalid ${field}.`);
+  return value;
+}
+function stats(data) {
+  const teams = data["teams"] ?? [];
+  const totals = data["totals"] ?? {};
+  const rows = teams.map((team) => [
+    str(path(team, "team", "key")),
+    str(team["open"]),
+    str(team["started"]),
+    str(team["blocked"]),
+    str(team["ready"]),
+    str(team["closed"])
+  ]);
+  const totalsRow = ["TOTAL", ...["open", "started", "blocked", "ready", "closed"].map((key) => str(totals[key]))];
+  return table(["TEAM", "OPEN", "STARTED", "BLOCKED", "READY", "CLOSED"], [...rows, totalsRow]);
+}
+function table(headers, rows) {
+  const all = [headers, ...rows.map((row) => row.map((cell) => clean(cell)))];
+  const widths = headers.map((_, column) => Math.max(...all.map((row) => graphemeLength(row[column] ?? ""))));
+  return all.map(
+    (row) => row.map((cell, column) => padGraphemes(cell, widths[column] ?? 0)).join("  ").replace(/\s+$/, "") + "\n"
+  ).join("");
+}
+function records(value) {
+  if (!Array.isArray(value)) return [];
+  return value.filter(
+    (entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry)
+  );
+}
+function waitingLine(issue) {
+  if (issue["waiting_on_condition"] !== true) return null;
+  const conditions = records(issue["conditions"]);
+  const open = conditions.filter((condition) => condition["satisfied"] !== true).length;
+  return `yes, on ${open} of ${conditions.length} wait condition${conditions.length === 1 ? "" : "s"}`;
+}
+function conditionsSection(conditions) {
+  const list = records(conditions);
+  if (list.length === 0) return "";
+  return "\nWait conditions:\n" + list.map((condition) => `  ${conditionLine(condition)}
+`).join("");
+}
+function conditionLine(condition, options = {}) {
+  const satisfied = condition["satisfied"] === true;
+  let what;
+  switch (condition["kind"]) {
+    case "gate": {
+      const owner = condition["owner"];
+      let ownedBy = "";
+      if (typeof owner === "object" && owner !== null) {
+        const record = owner;
+        ownedBy = options.expertView === true && record["kind"] === "expert" ? "you" : ownerText(record);
+      }
+      what = `gate ${gateName(condition)}${ownedBy === "" ? "" : ` owned by ${ownedBy}`}`;
+      break;
+    }
+    case "not_before":
+      what = `not before ${clean(condition["not_before"])}`;
+      break;
+    case "event":
+      what = "system event";
+      break;
+    default:
+      what = clean(condition["kind"]) || "condition";
+  }
+  let when = "";
+  if (satisfied && typeof condition["satisfied_at"] === "string") {
+    let by = clean(path(condition, "satisfied_by", "name"));
+    if (by === "" && condition["satisfied_by_kind"] === "expert") by = "an outside expert";
+    let role = typeof condition["satisfied_as_role"] === "string" ? roleName(condition["satisfied_as_role"]) : "";
+    switch (path(condition, "satisfied_by", "kind")) {
+      case "you":
+        by = "you";
+        break;
+      case "role": {
+        const as = path(condition, "satisfied_by", "role");
+        if (typeof as === "string" && as !== "") role = roleName(as);
+        break;
+      }
+      case "expert":
+        by = "an outside expert";
+        break;
+      case "member":
+        by = "a member";
+        break;
+    }
+    when = ` (satisfied ${clean(condition["satisfied_at"])}${by === "" ? "" : ` by ${by}`}${role === "" ? "" : ` as ${role}`})`;
+  }
+  return `${satisfied ? "[x]" : "[ ]"} ${what}${when} \xB7 ${clean(condition["id"])}`;
+}
+function gateName(gate) {
+  const key = clean(gate["key"]);
+  return `"${clean(gate["label"])}"${key === "" ? "" : ` [${key}]`}`;
+}
+function ownerText(owner) {
+  const label = clean(owner["label"]) || (owner["kind"] === "role" && typeof owner["role"] === "string" ? roleName(owner["role"]) : "");
+  const ref = clean(owner["ref"]);
+  if (owner["kind"] === "expert") {
+    const email = label || ref.replace(/^expert:/, "");
+    return email === "" ? "" : `${email} (expert)`;
+  }
+  if (label === "") return ref;
+  return ref === "" || ref === label ? label : `${label} (${ref})`;
+}
+function expertSummary(seat) {
+  const role = typeof seat.role === "string" && seat.role !== "" ? roleName(seat.role) : "Outside expert";
+  const status = clean(seat.plan?.status);
+  const plan = seat.plan === null ? ", no plan" : ` on plan ${clean(seat.plan.id)}${status === "" ? "" : ` (${status})`}`;
+  const steps = seat.assigned_steps;
+  const count = steps === 0 ? "no assigned steps" : `${steps} assigned step${steps === 1 ? "" : "s"}`;
+  return `${role}${plan} \xB7 ${count}`;
+}
+function expertAssignments(steps) {
+  return steps.map((step) => "\n" + assignedStep(step)).join("");
+}
+function assignedStep(step) {
+  const blockers = typeof step["open_blockers"] === "number" ? step["open_blockers"] : 0;
+  const fields = [
+    ["State", path(step, "state", "name")],
+    ["Due", step["due_date"]],
+    ["Blocked", blockers > 0 ? `yes, by ${blockers} open issue${blockers === 1 ? "" : "s"}` : null]
+  ];
+  const fieldLines = fields.filter(([, value]) => value !== null && value !== void 0 && value !== "").map(([label, value]) => `  ${(label + ":").padEnd(12)}${clean(value)}
+`).join("");
+  const gates = records(step["gates"]);
+  const gateLines = gates.length === 0 ? "  Gates:      none of yours\n" : "  Gates:\n" + gates.map((gate) => `    ${conditionLine(gate, { expertView: true })}
+`).join("");
+  const description = step["description"];
+  const descriptionLines = typeof description === "string" && description !== "" ? "  Description:\n" + indent(indent(description)) + "\n" : "";
+  return `${clean(step["identifier"])} \xB7 ${clean(step["title"])}
+${fieldLines}${gateLines}${descriptionLines}`;
+}
+var ROLE_NAMES = { gp: "GP" };
+function roleName(role) {
+  const slug = clean(role);
+  if (Object.hasOwn(ROLE_NAMES, slug)) return ROLE_NAMES[slug];
+  const words = slug.replace(/_/g, " ");
+  return words.charAt(0).toUpperCase() + words.slice(1);
+}
+var LIVE_PLAN_STATUSES = ["released", "running", "needs_attention"];
+function plansTable(plans) {
+  const rows = plans.map((plan) => [
+    str(plan["root"]) || "-",
+    str(plan["status"]) || "-",
+    plan["held"] === true ? "yes" : plan["held"] === false ? "no" : "-",
+    typeof plan["revision"] === "number" ? String(plan["revision"]) : "-",
+    truncate(plan["title"])
+  ]);
+  return table(["ROOT", "STATUS", "HELD", "REVISION", "TITLE"], rows);
+}
+function issuePlanLine(plan) {
+  if (typeof plan !== "object" || plan === null || Array.isArray(plan)) return null;
+  const record = plan;
+  const root = clean(record["root"]);
+  if (root === "") return null;
+  const status = record["held"] === true ? "held" : clean(record["status"]);
+  const revision = record["revision"];
+  const parts = [root];
+  if (status !== "") parts.push(status);
+  if (typeof revision === "number") {
+    parts.push(`revision ${revision}`);
+    if (typeof record["in_revision"] === "boolean") parts.push(record["in_revision"] ? "in revision" : "not in revision");
+  } else {
+    parts.push("never released");
+  }
+  if (record["executor"] === "operator") parts.push("Operator step");
+  return parts.join(" \xB7 ");
+}
+function planDetail(plan) {
+  const steps = records(plan["steps"]);
+  const fields = [
+    ["Root", planRootLine(plan["root"])],
+    ["Revision", planRevisionLine(plan)],
+    ["Budgets", planBudgetsLine(plan)],
+    ["Estimate", planEstimateLine(plan["estimate"])]
+  ];
+  const fieldLines = fields.filter((field) => field[1] !== null).map(([label, value]) => `  ${(label + ":").padEnd(12)}${value}
+`).join("");
+  return `Plan ${clean(plan["id"])} \xB7 ${clean(plan["status"])}
+` + fieldLines + planStepsSection(steps, str(plan["status"])) + planEdgesSection(plan["edges"]) + planConditionsSection(steps) + planWaitingSection(steps) + planHeldSection(plan["held_steps"]);
+}
+function planRootLine(root) {
+  if (typeof root !== "object" || root === null) return null;
+  const record = root;
+  return `${clean(record["identifier"])} \xB7 ${clean(record["title"])}`;
+}
+function planRevisionLine(plan) {
+  const revision = plan["revision"];
+  if (typeof revision !== "object" || revision === null) return "none yet (never released)";
+  const number = clean(revision["number"]);
+  const by = clean(path(plan, "released_by", "name"));
+  const at = clean(plan["released_at"]);
+  if (by === "" && at === "") return number;
+  return `${number} \xB7 released${by === "" ? "" : ` by ${by}`}${at === "" ? "" : ` at ${at}`}`;
+}
+function planBudgetsLine(plan) {
+  const retries = plan["retry_budget"];
+  const retryText = typeof retries === "number" ? `${retries} ${retries === 1 ? "retry" : "retries"} per failed Operator step` : null;
+  const spend = plan["spend_budget_cents"];
+  const spendText = typeof spend === "number" ? `spend budget ${spend} cents` : "no spend budget";
+  return [retryText, spendText].filter((part) => part !== null).join(" \xB7 ");
+}
+function planEstimateLine(estimate) {
+  if (typeof estimate !== "object" || estimate === null) return null;
+  const record = estimate;
+  const ceiling = record["ceiling_cents"];
+  if (typeof ceiling !== "number") return null;
+  const minimum = record["minimum_budget_cents"];
+  return `up to ${ceiling} cents${typeof minimum === "number" ? ` (minimum budget ${minimum} cents)` : ""}`;
+}
+function planStepsSection(steps, planStatus) {
+  if (steps.length === 0) return "";
+  const depths = stepDepths(steps);
+  const rows = steps.map((step) => [
+    "  ".repeat(depths.get(str(step["identifier"])) ?? 0) + str(step["identifier"]),
+    str(step["key"]) || "-",
+    str(step["executor"]) || "-",
+    str(path(step, "state", "name")) || "-",
+    stepStatus(step, planStatus),
+    truncate(step["title"])
+  ]);
+  const rendered = table(["STEP", "KEY", "EXECUTOR", "STATE", "STATUS", "TITLE"], rows);
+  return "\nSteps:\n" + indentLines(rendered);
+}
+function stepDepths(steps) {
+  const parents = new Map(steps.map((step) => [str(step["identifier"]), str(step["parent"])]));
+  const depths = /* @__PURE__ */ new Map();
+  for (const identifier of parents.keys()) {
+    let depth = 0;
+    let parent = parents.get(identifier) ?? "";
+    const seen = /* @__PURE__ */ new Set([identifier]);
+    while (parent !== "" && parents.has(parent) && !seen.has(parent)) {
+      seen.add(parent);
+      depth += 1;
+      parent = parents.get(parent) ?? "";
+    }
+    depths.set(identifier, depth);
+  }
+  return depths;
+}
+function stepStatus(step, planStatus) {
+  const stateType = path(step, "state", "type");
+  if (step["archived"] === true) return "archived";
+  if (stateType === "completed") return "done";
+  if (stateType === "canceled") return "cancelled";
+  if (step["container"] === true) return "container";
+  if (step["ready"] === true) return "ready";
+  if (step["held"] === true) return "held";
+  if (step["in_revision"] === false && LIVE_PLAN_STATUSES.includes(planStatus)) return "not in revision";
+  if (records(step["conditions"]).some((condition) => condition["satisfied"] !== true)) return "waiting";
+  return "-";
+}
+function planEdgesSection(edges) {
+  const list = records(edges);
+  if (list.length === 0) return "";
+  return "\nEdges (blocker \u2192 blocked):\n" + list.map((edge) => `  ${clean(edge["from"])} \u2192 ${clean(edge["to"])}
+`).join("");
+}
+function planConditionsSection(steps) {
+  const lines = steps.flatMap(
+    (step) => records(step["conditions"]).map((condition) => [clean(step["identifier"]), conditionLine(condition)])
+  );
+  if (lines.length === 0) return "";
+  const width = Math.max(...lines.map(([identifier]) => graphemeLength(identifier)));
+  return "\nWait conditions:\n" + lines.map(([identifier, line]) => `  ${padGraphemes(identifier, width)}  ${line}
+`).join("");
+}
+function planWaitingSection(steps) {
+  const lines = steps.flatMap(
+    (step) => records(step["waiting_for"]).map((wait) => [clean(step["identifier"]), waitLine(wait)])
+  );
+  if (lines.length === 0) return "";
+  const width = Math.max(...lines.map(([identifier]) => graphemeLength(identifier)));
+  return "\nWaiting for:\n" + lines.map(([identifier, line]) => `  ${padGraphemes(identifier, width)}  ${line}
+`).join("");
+}
+function waitLine(wait) {
+  const name = gateName(wait);
+  const owner = wait["owner"];
+  if (typeof owner !== "object" || owner === null) return `${name} \xB7 no owner, anyone with standing can tick`;
+  const holders = wait["holders"];
+  let who;
+  if (!Array.isArray(holders)) who = "who can tick is not known";
+  else if (holders.length === 0) who = "nobody can tick";
+  else who = `can tick: ${records(holders).map(holderText).join(", ")}`;
+  return `${name} \xB7 ${ownerText(owner)} \xB7 ${who}`;
+}
+function holderText(holder) {
+  const name = clean(holder["name"]);
+  if (holder["kind"] !== "expert") return name;
+  const organization = clean(holder["organization"]);
+  return `${name} (expert${organization === "" ? "" : `, ${organization}`})`;
+}
+function planHeldSection(heldSteps) {
+  if (!Array.isArray(heldSteps) || heldSteps.length === 0) return "";
+  return `
+Changed since the release: ${heldSteps.map((step) => clean(step)).join(", ")} (only Operator steps are held until the next release takes them in)
+`;
+}
+function indentLines(text) {
+  return text.split("\n").map((line) => line === "" ? line : "  " + line).join("\n");
+}
+function errorDetails(body) {
+  return changesetDetails(body["details"]) + violationDetails(body["violations"]);
+}
+function changesetDetails(details) {
+  if (typeof details !== "object" || details === null || Array.isArray(details)) return "";
+  return Object.entries(details).map(([field, messages]) => {
+    const text = Array.isArray(messages) ? messages.map(String).join("; ") : String(messages);
+    return `
+  ${clean(field)}: ${clean(text)}`;
+  }).join("");
+}
+function violationDetails(violations) {
+  return records(violations).map((violation) => {
+    const code = clean(violation["code"]);
+    const message = capMessage(violation) ?? (clean(violation["message"]) || code || "invalid");
+    return `
+  ${violationSubject(violation)}: ${message}${code === "" ? "" : ` [${code}]`}`;
+  }).join("");
+}
+var MAX_PLAN_STEPS_CEILING = 2e3;
+function capMessage(violation) {
+  if (violation["code"] !== "too_many_steps") return null;
+  const cap = violation["cap"];
+  if (typeof cap !== "object" || cap === null || Array.isArray(cap)) return null;
+  const { kind, max, count, ceiling: served } = cap;
+  if (!Number.isInteger(max) || !Number.isInteger(count)) return null;
+  if (kind === "operator_steps") {
+    return `the plan has ${count} Operator steps, above the fixed limit of ${max}: Operator's delegated grant caps a plan's agent steps, and no setting raises it \u2014 hand some to people (executor none) or split the plan`;
+  }
+  if (kind === "plan_steps") {
+    const ceiling = Number.isInteger(served) ? served : MAX_PLAN_STEPS_CEILING;
+    const over = `the plan has ${count} steps, above this organization's max plan steps (${max})`;
+    if (count > ceiling && max < ceiling) {
+      return `${over}, and above the ceiling of ${ceiling} that no setting raises past \u2014 split the plan`;
+    }
+    if (max >= ceiling) return `${over}, which is already at its ceiling of ${ceiling} \u2014 split the plan`;
+    return `${over}: a Harness admin can raise "Max plan steps" in Harness settings \u2192 Plans (max_plan_steps, up to ${ceiling})`;
+  }
+  return null;
+}
+function violationSubject(violation) {
+  const key = typeof violation["key"] === "string" ? clean(violation["key"]) : null;
+  const index = typeof violation["index"] === "number" ? `steps[${violation["index"]}]` : null;
+  const issue = typeof violation["issue"] === "string" ? clean(violation["issue"]) : null;
+  if (key !== null) {
+    const where = index ?? issue;
+    return where === null ? `step "${key}"` : `step "${key}" (${where})`;
+  }
+  return issue ?? index ?? "plan";
+}
+function relationsSection(relations) {
+  if (!Array.isArray(relations) || relations.length === 0) return "";
+  const lines = relations.map((relation) => `  ${str(relation["direction"]).padEnd(14)}${str(relation["other_issue"])}
+`).join("");
+  return "\nRelations:\n" + lines;
+}
+function childrenSection(children) {
+  if (!Array.isArray(children) || children.length === 0) return "";
+  const lines = children.map((child) => {
+    const state = str(path(child, "state", "name")) || "-";
+    return `  ${str(child["identifier"])}  [${state}]  ${truncate(child["title"])}
+`;
+  }).join("");
+  return "\nSub-issues:\n" + lines;
+}
+function commentsSection(comments) {
+  if (!Array.isArray(comments) || comments.length === 0) return "";
+  const lines = comments.map((comment) => {
+    const author = clean(path(comment, "author", "name") ?? "unknown");
+    return `  [${str(comment["inserted_at"])}] ${author}: ${truncate(comment["body"])}
+`;
+  }).join("");
+  return "\nComments:\n" + lines;
+}
+function imagesSection(images) {
+  if (images.length === 0) return "";
+  const lines = images.map((image) => `  [${image["source"]}] ${clean(image["path"])}
+`).join("");
+  return "\nImages (attachments downloaded locally \u2014 read them, they are part of the issue):\n" + lines;
+}
+function labelsLine(labels) {
+  if (!Array.isArray(labels) || labels.length === 0) return null;
+  return labels.map((label) => clean(label["name"])).join(", ");
+}
+function blockedLine(issue) {
+  if (issue["blocked"] === true && Array.isArray(issue["blocked_by"])) {
+    const notes = blockerNotes(issue["blockers"]);
+    const blockers = issue["blocked_by"].map((blocker) => {
+      const identifier = String(blocker);
+      const note = notes.get(identifier);
+      return note === void 0 ? identifier : `${identifier} (${note})`;
+    });
+    return `yes, by ${blockers.join(", ")}`;
+  }
+  return null;
+}
+function blockerNotes(blockers) {
+  const notes = /* @__PURE__ */ new Map();
+  if (!Array.isArray(blockers)) return notes;
+  for (const blocker of blockers) {
+    if (typeof blocker !== "object" || blocker === null) continue;
+    const record = blocker;
+    if (typeof record["identifier"] !== "string") continue;
+    const reasons = [];
+    if (record["state_type"] === "canceled") reasons.push("cancelled");
+    if (record["archived"] === true) reasons.push("archived");
+    if (reasons.length > 0) notes.set(record["identifier"], reasons.join(", "));
+  }
+  return notes;
+}
+function indent(text) {
+  return cleanMultiline(text).split("\n").map((line) => "  " + line).join("\n");
+}
+function cleanMultiline(text) {
+  return text.split("\n").map((line) => clean(line)).join("\n");
+}
+function truncate(text) {
+  if (text === null || text === void 0) return "";
+  const cleaned = clean(text);
+  const pieces = graphemes(cleaned);
+  if (pieces.length > TITLE_WIDTH) {
+    return pieces.slice(0, TITLE_WIDTH - 1).join("") + "\u2026";
+  }
+  return cleaned;
+}
+function str(value) {
+  return value === null || value === void 0 ? "" : String(value);
+}
+function path(record, ...keys) {
+  let current = record;
+  for (const key of keys) {
+    if (typeof current !== "object" || current === null) return null;
+    current = current[key];
+  }
+  return current ?? null;
+}
+
+// src/core/credentials.ts
+import { createHash } from "crypto";
+import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, isAbsolute, join } from "path";
+function defaultCredentialsPath(env = process.env) {
+  const xdg = env["XDG_CONFIG_HOME"];
+  const base = xdg !== void 0 && xdg !== "" && isAbsolute(xdg) ? xdg : join(homedir(), ".config");
+  return join(base, "harness", "credentials.json");
+}
+function orgCredentialsPath(path2, baseUrl, org) {
+  const url = new URL(baseUrl);
+  const host = url.origin + url.pathname.replace(/\/+$/, "");
+  const key = createHash("sha256").update(JSON.stringify([path2, host, org.toLowerCase()])).digest("hex");
+  return join(dirname(path2), `credentials-org-${key}.json`);
+}
+function validOrgId(org) {
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(org);
+}
+function readCredentials(path2) {
+  try {
+    const parsed = JSON.parse(readFileSync(path2, "utf8"));
+    if (typeof parsed === "object" && parsed !== null) {
+      const { url, token } = parsed;
+      if (typeof url === "string" && typeof token === "string") return { url, token };
+    }
+  } catch {
+  }
+  return null;
+}
+var uniqueCounter = 0;
+function writeCredentials(path2, url, token) {
+  mkdirSync(dirname(path2), { recursive: true });
+  const tempPath = `${path2}.${process.pid}.${++uniqueCounter}.tmp`;
+  try {
+    writeFileSync(tempPath, "", { mode: 384 });
+    chmodSync(tempPath, 384);
+    writeFileSync(tempPath, JSON.stringify({ url, token }));
+    renameSync(tempPath, path2);
+  } finally {
+    rmSync(tempPath, { force: true });
+  }
+}
+function deleteCredentials(path2) {
+  rmSync(path2, { force: true });
+}
+
+// src/core/repo-config.ts
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, isAbsolute as isAbsolute2, join as join2, parse } from "path";
+var CONFIG_RELATIVE_PATH = join2(".harness-cli", "config.json");
+function findRepoConfig(startDir = process.cwd()) {
+  let dir = startDir;
+  const { root } = parse(startDir);
+  for (; ; ) {
+    const candidate = join2(dir, CONFIG_RELATIVE_PATH);
+    if (existsSync(candidate)) {
+      return readRepoConfig(candidate);
+    }
+    if (dir === root) return { config: null, warnings: [] };
+    dir = dirname2(dir);
+  }
+}
+function readRepoConfig(path2) {
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync2(path2, "utf8"));
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return { config: null, warnings: [`harness: ignoring malformed ${path2} (${detail})`] };
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return { config: null, warnings: [`harness: ignoring ${path2} \u2014 expected a JSON object`] };
+  }
+  const record = parsed;
+  const config = { path: path2 };
+  const warnings = [];
+  for (const field of ["team", "url", "org"]) {
+    const value = record[field];
+    if (value === void 0) continue;
+    if (typeof value === "string" && value.trim() !== "") {
+      config[field] = value.trim();
+    } else {
+      warnings.push(`harness: ignoring "${field}" in ${path2} \u2014 expected a non-empty string`);
+    }
+  }
+  return { config, warnings };
+}
+function trustedHostsPath(env = process.env) {
+  const xdg = env["XDG_CONFIG_HOME"];
+  const base = xdg !== void 0 && xdg !== "" && isAbsolute2(xdg) ? xdg : join2(homedir2(), ".config");
+  return join2(base, "harness", "trusted-hosts.json");
+}
+function readTrustedHosts(env) {
+  try {
+    const parsed = JSON.parse(readFileSync2(trustedHostsPath(env), "utf8"));
+    if (typeof parsed === "object" && parsed !== null && Array.isArray(parsed["hosts"])) {
+      return parsed["hosts"].filter(
+        (host) => typeof host === "string"
+      );
+    }
+  } catch {
+  }
+  return [];
+}
+function isHostTrusted(baseUrl, env) {
+  return readTrustedHosts(env).includes(baseUrl);
+}
+function trustHost(baseUrl, env) {
+  const hosts = readTrustedHosts(env);
+  if (hosts.includes(baseUrl)) return;
+  const path2 = trustedHostsPath(env);
+  mkdirSync2(dirname2(path2), { recursive: true });
+  writeFileSync2(path2, JSON.stringify({ hosts: [...hosts, baseUrl] }, null, 2) + "\n");
+}
+
+// src/core/config.ts
+import { homedir as homedir3, tmpdir } from "os";
+import { isAbsolute as isAbsolute3, join as join3 } from "path";
+var DEFAULT_BASE_URL = "https://harness.infra.one";
+function resolveConfig(env = process.env, credentialsPath, repo) {
+  let warnings = [];
+  if (repo === void 0) {
+    const lookup = findRepoConfig();
+    repo = lookup.config;
+    warnings = lookup.warnings;
+  }
+  const path2 = credentialsPath ?? defaultCredentialsPath(env);
+  const stored = readCredentials(path2);
+  const envUrl = blankToNull(env["HARNESS_API_URL"]);
+  const envToken = blankToNull(env["HARNESS_API_TOKEN"]);
+  const repoUrl = repo?.url?.replace(/\/+$/, "") ?? null;
+  const org = envToken === null ? repo?.org?.toLowerCase() : void 0;
+  if (org !== void 0 && !validOrgId(org)) {
+    return { kind: "error", message: `repo org in ${repo?.path} must be an organization UUID`, warnings };
+  }
+  let rawUrl;
+  let hostSource;
+  if (envUrl !== null) {
+    rawUrl = envUrl;
+    hostSource = "env";
+  } else if (envToken !== null) {
+    if (repoUrl !== null && normalize(repoUrl) !== normalize(DEFAULT_BASE_URL)) {
+      return {
+        kind: "error",
+        message: `this repo's config (${repo?.path}) targets ${repoUrl}, but HARNESS_API_TOKEN only travels to the host the environment names \u2014 set HARNESS_API_URL explicitly to pair them`,
+        warnings
+      };
+    }
+    rawUrl = DEFAULT_BASE_URL;
+    hostSource = "default";
+  } else if (repoUrl !== null) {
+    rawUrl = repoUrl;
+    hostSource = "repo-config";
+  } else if (org !== void 0) {
+    rawUrl = DEFAULT_BASE_URL;
+    hostSource = "default";
+  } else if (stored !== null) {
+    rawUrl = stored.url;
+    hostSource = "stored-login";
+  } else {
+    rawUrl = DEFAULT_BASE_URL;
+    hostSource = "default";
+  }
+  const validated = validateBaseUrl(rawUrl);
+  if (!validated.ok) return { kind: "error", message: validated.message, warnings };
+  const baseUrl = rawUrl.replace(/\/+$/, "");
+  const selectedPath = org === void 0 ? path2 : orgCredentialsPath(path2, baseUrl, org);
+  const selected = org === void 0 ? stored : readCredentials(selectedPath);
+  let token;
+  if (envToken !== null) {
+    token = envToken;
+  } else if (selected !== null && normalize(selected.url) !== null && normalize(selected.url) === normalize(baseUrl)) {
+    token = selected.token;
+  } else {
+    const result = { kind: "needs-login", baseUrl, hostSource, credentialsPath: selectedPath, warnings };
+    if (org !== void 0) result.org = org;
+    if (hostSource === "repo-config" && repo?.path !== void 0) result.repoConfigPath = repo.path;
+    return result;
+  }
+  return {
+    kind: "ok",
+    config: {
+      baseUrl,
+      token,
+      actor: blankToNull(env["HARNESS_ACTOR"]),
+      // The committed team is the fallback: the environment (and, above it,
+      // the --team flag at the command layer) stays authoritative.
+      team: blankToNull(env["HARNESS_TEAM"]) ?? repo?.team ?? null,
+      cacheDir: resolveCacheDir(env),
+      hostSource,
+      credentialsPath: selectedPath
+    },
+    warnings
+  };
+}
+function resolveCacheDir(env = process.env) {
+  return absolute(env["HARNESS_CACHE_DIR"]) ?? join3(resolveCacheHome(env), "harness", "attachments");
+}
+function absolute(value) {
+  return value !== void 0 && value !== "" && isAbsolute3(value) ? value : null;
+}
+function resolveCacheHome(env = process.env) {
+  return absolute(env["XDG_CACHE_HOME"]) ?? join3(homedir3() || tmpdir(), ".cache");
+}
+function normalize(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return null;
+  }
+  const port = parsed.port !== "" ? parsed.port : parsed.protocol === "https:" ? "443" : parsed.protocol === "http:" ? "80" : "";
+  return JSON.stringify([parsed.protocol, parsed.hostname, port, parsed.pathname.replace(/\/+$/, "")]);
+}
+function validateBaseUrl(baseUrl) {
+  let parsed;
+  try {
+    parsed = new URL(baseUrl);
+  } catch {
+    return { ok: false, message: `HARNESS_API_URL must be an http(s) URL with a host, got: ${baseUrl}` };
+  }
+  if (parsed.username !== "" || parsed.password !== "") {
+    return { ok: false, message: "HARNESS_API_URL must not embed credentials (user:pass@) \u2014 use HARNESS_API_TOKEN" };
+  }
+  if (parsed.search !== "" || parsed.hash !== "") {
+    return { ok: false, message: `HARNESS_API_URL must not carry a query or fragment, got: ${baseUrl}` };
+  }
+  if (parsed.protocol === "https:" && parsed.hostname !== "") return { ok: true };
+  if (parsed.protocol === "http:") {
+    const host = parsed.hostname;
+    if (["localhost", "127.0.0.1", "[::1]"].includes(host) || host.endsWith(".localhost")) return { ok: true };
+    return {
+      ok: false,
+      message: `refusing plain-http HARNESS_API_URL (${baseUrl}) \u2014 the API token would travel in cleartext. Use https, or http against localhost, *.localhost, 127.0.0.1 or [::1] only.`
+    };
+  }
+  return { ok: false, message: `HARNESS_API_URL must be an http(s) URL with a host, got: ${baseUrl}` };
+}
+function loginHelp(baseUrl, name = invokedName()) {
+  return `Not signed in to ${baseUrl}.
+
+Interactively, in a terminal (not from inside an agent \u2014 the browser
+tab needs someone to see it):
+
+    ${name} login
+
+For agents and CI, mint an API token (admin \u2192 API tokens) with the
+harness:read scope \u2014 plus harness:write only where the workflow
+creates or closes \u2014 set an expiry, and export it:
+
+    export HARNESS_API_TOKEN=aone_...
+
+An outside expert uses the pxc_ credential minted in their expert view:
+export it the same way, or paste it into \`${name} login --no-browser\`.
+`;
+}
+function blankToNull(value) {
+  if (value === void 0 || value.trim() === "") return null;
+  return value;
+}
+
+export {
+  HttpError,
+  UpgradeRequiredError,
+  TransportError,
+  MalformedResponseError,
+  UsageError,
+  LocalError,
+  CommandError,
+  EXPERT_ASSIGNMENTS_PATH,
+  isExpertToken,
+  EXPERT_LAPSED,
+  explainExpertRefusal,
+  SESSION_PATH,
+  isLoginCredential,
+  Client,
+  graphemeLength,
+  clean,
+  json,
+  isAgentStep,
+  issuesTable,
+  issueDetail,
+  activityEntries,
+  stats,
+  table,
+  conditionLine,
+  gateName,
+  ownerText,
+  expertSummary,
+  expertAssignments,
+  plansTable,
+  planDetail,
+  errorDetails,
+  cleanMultiline,
+  truncate,
+  defaultCredentialsPath,
+  orgCredentialsPath,
+  validOrgId,
+  readCredentials,
+  writeCredentials,
+  deleteCredentials,
+  findRepoConfig,
+  isHostTrusted,
+  trustHost,
+  DEFAULT_BASE_URL,
+  resolveConfig,
+  resolveCacheHome,
+  validateBaseUrl,
+  loginHelp
+};