@allscale/cli 0.1.0 → 1.0.2

package/bin/run-oclif.js

@@ -15,41 +15,230 @@ function isUnknownCommandError(oclif, error) {
   );
 }
 
-function emitUnknownCommandError() {
-  // Match `serializeErrorEnvelope`'s mode-dependent rendering:
-  // compact for a machine reading stderr as one JSON object per line, indented
-  // for a human. This runs before oclif resolves a command, so `jsonEnabled()`
-  // does not exist yet — read the same two signals it would from argv/env,
-  // resolved exactly as `AllscaleHelp.jsonModeRequested` does (`help.ts`), the
-  // other place that has to answer this without a Command. Keeping the two
-  // answers identical is the point: a caller must not get compact output from
-  // one path and indented from the other for the same command line.
+const UNKNOWN_COMMAND_MESSAGE =
+  "Unknown command. Run `allscale --help` to list available commands.";
+
+// NOTE: this file ships VERBATIM in the npm tarball (`files: ["bin", …]`),
+// unlike `src/`, which reaches users only as minified `dist/`. Its comments are
+// therefore public artifact and must stay free of internal references — issue
+// numbers, review shorthand, `docs/*.md` paths, design-doc sections. The
+// publish gate enforces it (`scripts/public-content-policy.json`, tarball
+// scope); explain the WHY here and leave the provenance to the commit history.
+
+/**
+ * The two OPT-IN machine signals: `--json` (honouring the `--` separator) and
+ * `ALLSCALE_CONTENT_TYPE=json`.
+ *
+ * Extracted because TWO callers below need it and they are deliberately
+ * DIFFERENT predicates — collapsing them would be a bug, duplicating the parsing
+ * would be the drift this PR keeps closing:
+ *
+ *   - `machine` in `emitUnknownCommandError` — chooses the envelope's FORM
+ *     (compact vs indented). Only the declared signals belong
+ *     there: a caller who merely piped stdout did not ask for compact JSON.
+ *   - `isMachineCallerLauncher` — decides WHETHER a human-facing warning is
+ *     emitted at all, so it must also honour the non-opt-in signals (a
+ *     configured sidecar, non-TTY streams) exactly as `isMachineCaller` does.
+ *
+ * The `ALLSCALE_` prefix is hard-coded, and cannot not be: `help.ts` resolves the
+ * same vars through `config.scopedEnvVar("CONTENT_TYPE")`, which derives the
+ * prefix from the bin name, but this file runs BEFORE oclif loads and has no
+ * config to ask. It matches today (`oclif.bin` is `allscale`), and
+ * `tests/tsup-entries.test.ts` pins that bin name with a message pointing here,
+ * so a rename turns a test red instead of silently desyncing this file.
+ */
+function declaredMachineOutput() {
   const raw = process.argv.slice(2);
-  // After `--` everything is a passthrough operand, so a literal `--json`
-  // there is data, not a flag.
+  // After `--` everything is a passthrough operand, so a literal `--json` there
+  // is data, not a flag.
   const passThrough = raw.indexOf("--");
   const json = raw.indexOf("--json");
-  // Case-insensitive, matching oclif's own `CONTENT_TYPE` check and help.ts:
-  // a caller who exported `CONTENT_TYPE=JSON` gets machine output from every
-  // other path, and must not get an indented document from this one. The
-  // `ALLSCALE_` prefix is hard-coded because this file is plain JS and cannot
-  // import the TS helper or reach `config.scopedEnvVar`; it is safe because
-  // `oclif.bin` is pinned to "allscale" in package.json.
-  const machine =
-    (json !== -1 && (passThrough === -1 || json < passThrough)) ||
-    process.env.ALLSCALE_CONTENT_TYPE?.toLowerCase() === "json";
+  if (json !== -1 && (passThrough === -1 || json < passThrough)) return true;
+  // Case-insensitive, matching oclif's own CONTENT_TYPE check and help.ts.
+  return (process.env.ALLSCALE_CONTENT_TYPE ?? "").toLowerCase() === "json";
+}
+
+/**
+ * Is this caller a machine? A plain-CommonJS mirror of `isMachineCaller`
+ * (`src/lib/output/machine-mode.ts`), which this file cannot import: it runs
+ * before oclif loads, from a `.js` launcher with no TS pipeline.
+ *
+ * ALL THREE of that helper's signals, not just the TTY one. An earlier version
+ * checked only `interactive` while its comment claimed parity — and the gap was
+ * trivially reachable: an engineer at a real terminal with
+ * `ALLSCALE_OUTPUT_FILE_PATH` set is a MACHINE by `isMachineCaller`
+ * (`sidecarConfigured()` is OR'd ahead of `interactive`), yet the TTY-only gate
+ * called them human and wrote to their stderr — and that population is the one
+ * most likely to be exercising this path.
+ *
+ * If `isMachineCaller` gains a fourth signal, this must gain it too;
+ * `tests/launcher-unknown-command.test.ts` pins each one.
+ */
+function isMachineCallerLauncher() {
+  if (declaredMachineOutput()) return true;
+  // Truthiness, matching `sidecarConfigured()` — an empty value means no sidecar
+  // to both, so gate and opener cannot drift.
+  if (
+    process.env.ALLSCALE_OUTPUT_FILE_PATH ||
+    process.env.ALLSCALE_OUTPUT_FILE_DIRECTORY
+  ) {
+    return true;
+  }
+  const interactive =
+    process.stdin.isTTY === true && process.stdout.isTTY === true;
+  return !interactive;
+}
+
+/**
+ * A thrown value's CLASS as a bounded, identifier-shaped token — never its
+ * message.
+ *
+ * Three guards, each closing a hole the first version left open while its comment
+ * claimed otherwise:
+ *
+ *  - The read is WRAPPED. `e.name` is a property access, and a hostile or
+ *    instrumented getter throws — inside the `catch (e)` that calls this, where
+ *    nothing further would catch it, so the process would die on Node's default
+ *    handler with a raw stack and exit 1 instead of the `{error}` envelope and
+ *    exit 2. That is the failure mode this file already guards against twice.
+ *  - The value is SHAPE-CHECKED, not merely type-checked. `typeof === "string"`
+ *    bounds nothing: a thrown plain object, or a wrapped fs/Abort error, can carry
+ *    a `.name` holding a path or other caller-influenced text — which would
+ *    reopen on `.name` the very arbitrary-text leak that moving off `.message`
+ *    was meant to close.
+ *  - It is LENGTH-BOUNDED, so a pathological `name` cannot flood stderr.
+ *
+ * Anything failing those becomes the literal "Error", which loses nothing a
+ * reader needs: the actionable part is "the audit write failed", not the class.
+ */
+function errorClass(e) {
+  try {
+    const name = e && typeof e === "object" ? e.name : undefined;
+    if (typeof name === "string" && /^[A-Za-z][A-Za-z0-9_]{0,63}$/.test(name)) {
+      return name;
+    }
+  } catch {
+    // A throwing getter is precisely why this is wrapped.
+  }
+  return "Error";
+}
+
+function warnAuditUnavailable(reason) {
+  // The gate call is INSIDE the try, for the same reason the `typeof` read below
+  // it is: it touches `process.argv`, two env vars, and two `.isTTY` properties,
+  // any of which could be an instrumented getter that throws. Called outside, a
+  // throw here would escape `emitUnknownCommandError` AND `runOclif`'s catch —
+  // and this function is invoked from that catch, so the second call would throw
+  // again with nothing left to catch it. That turns the FAIL-SOFT invariant this
+  // whole path is built on into the exact crash it promises to prevent.
+  //
+  // On a throw we treat the caller as a MACHINE (stay silent). Silence is the
+  // safe default: a spurious warning would corrupt the single-JSON-document
+  // contract for a consumer that may well be one, whereas a missing warning
+  // costs a human one diagnostic line on an already-broken build.
+  try {
+    if (isMachineCallerLauncher()) return;
+  } catch {
+    return;
+  }
+  try {
+    process.stderr.write(
+      `[allscale] audit lifecycle unavailable (${reason}); the refusal was ` +
+        "reported but no audit events were written.\n",
+    );
+  } catch {
+    // Even stderr can fail in pathological cases; swallow.
+  }
+}
+
+/**
+ * A refusal here must write the same sidecar audit lifecycle every other refusal
+ * writes (`session-start` + `error` + `command-end ok:false`), or a supervisor
+ * consuming the stream cannot tell `allscale bogus` from a CLI that never
+ * started — the defect this module exists to close, at the one refusal shape
+ * that never reaches the help class.
+ *
+ * `audit` is INJECTED by the entrypoint rather than required here because this
+ * file is shared by two entries that disagree about where the compiled code
+ * lives: `bin/run.js` runs `dist/`, `bin/dev.js` runs `src/` through ts-node.
+ * Guessing (try dist, fall back to src) would silently audit a dev run through
+ * a stale `dist/` build, so each entry passes the form it is actually executing.
+ *
+ * FAIL-SOFT BY DESIGN: a missing or throwing audit module must never turn a
+ * clean refusal into a crash. The `{error}` envelope and exit code are the
+ * contract; the audit stream is an additional channel, and losing it is strictly
+ * better than losing the refusal itself.
+ */
+function emitUnknownCommandError(audit) {
+  // Match `serializeErrorEnvelope`'s mode-dependent rendering: compact for a
+  // machine reading stderr as one JSON object per line, indented for a human
+  // Only the DECLARED signals decide the FORM — a piped caller
+  // did not ask for compact JSON — which is why this uses
+  // `declaredMachineOutput()` and not the wider `isMachineCallerLauncher()` that
+  // gates the warning.
+  const machine = declaredMachineOutput();
   process.stderr.write(
     `${JSON.stringify(
-      {
-        error: {
-          code: "input.invalid",
-          message: "Unknown command. Run `allscale --help` to list available commands.",
-        },
-      },
+      { error: { code: "input.invalid", message: UNKNOWN_COMMAND_MESSAGE } },
       null,
       machine ? undefined : 2,
     )}\n`,
   );
+  // FAIL-SOFT, BUT NOT SILENT — and the ABSENCE of the module is the case that
+  // actually matters, which is why it is tested for rather than caught.
+  //
+  // The entrypoint requires the audit module inside its own try/catch and passes
+  // `undefined` when that fails, so `audit?.auditRefusal?.(...)` would
+  // short-circuit and throw NOTHING: a catch block alone reports a broken
+  // `dist/` exactly never. That is the degraded state worth announcing — a
+  // shipped build with a stale or partial `dist/` silently reverting to "correct
+  // envelope, empty audit file", giving the supervisor no signal, which is the
+  // same defect returning one layer up. (Verified by deleting the
+  // built module: an earlier version of this code warned on zero of those runs.)
+  //
+  // `sidecar.ts` writes a one-line `[allscale] …` warning for every open/write
+  // failure it fails-soft on; a missing or unusable module is the same class of
+  // event, so it gets the same treatment and the same prefix.
+  // INSIDE the try, not above it. `typeof audit?.auditRefusal` reads a property,
+  // and a property read can throw — a getter on the module object would do it.
+  // Evaluated one line higher (as it was), that throw escaped
+  // emitUnknownCommandError AND runOclif's catch, so the process died on Node's
+  // default handler: a raw stack after the envelope and exit 1 instead of 2.
+  // Strictly worse than the silent stream this guard replaced, from the one line
+  // the fail-soft design forgot to cover. Not reachable through the plain data
+  // property `require()` yields today — which is exactly why it belongs inside
+  // the try rather than relying on that staying true.
+  try {
+    if (typeof audit?.auditRefusal === "function") {
+      // No command id: oclif could not resolve one, which is the whole reason we
+      // are here. rawArgv defaults to process.argv.slice(2) and is redacted
+      // inside the helper, so no secret reaches the file even though this call
+      // site is plain JS with no access to the redactor.
+      audit.auditRefusal({
+        code: "input.invalid",
+        message: UNKNOWN_COMMAND_MESSAGE,
+        exitCode: 2,
+      });
+    } else {
+      warnAuditUnavailable("the audit module did not load");
+    }
+  } catch (e) {
+    // A throw FROM the audit write (an unwritable sidecar path, say) is the same
+    // degradation from the caller's point of view, so it is reported the same
+    // way. It must never replace the refusal with a stack.
+    //
+    // SHAPE, NOT TEXT. Every `[allscale]` warning in sidecar.ts goes
+    // through `sanitizeDiagnosticString`, because free text can carry a
+    // credential-shaped value that key-name masking cannot reach — and the text
+    // available here is a filesystem error built from the caller-supplied
+    // ALLSCALE_OUTPUT_FILE_PATH. This launcher cannot import that scrubber (it
+    // runs before oclif loads — the same reason `auditRefusal` redacts argv
+    // internally), so the proportionate fix is not to reach for the scrubber but
+    // to stop passing arbitrary text through: report the error's CLASS only.
+    // Unreachable today, since initSidecar and writeSidecar both catch their own
+    // failures — which is precisely why it must not depend on that staying true.
+    warnAuditUnavailable(`the audit write threw ${errorClass(e)}`);
+  }
   process.exitCode = 2;
 }
 
@@ -59,7 +248,7 @@ async function runOclif(oclif, options = {}) {
     await oclif.flush();
   } catch (error) {
     if (isUnknownCommandError(oclif, error)) {
-      emitUnknownCommandError();
+      emitUnknownCommandError(options.audit);
       return;
     }
     await oclif.Errors.handle(error);

package/bin/run.js

@@ -3,4 +3,22 @@
 const oclif = require("@oclif/core");
 const { runOclif } = require("./run-oclif");
 
-void runOclif(oclif, { dir: __dirname });
+// The audit-lifecycle module, in the form THIS entry executes (compiled dist/).
+// Injected rather than resolved inside run-oclif.js, which is shared with the
+// ts-node dev entry — see the comment on emitUnknownCommandError. Wrapped
+// because an unknown-command refusal must still work if dist/ is incomplete.
+//
+// This path only exists because `src/lib/output/audit-lifecycle.ts` is a declared
+// tsup entry; tsup emits only declared entries, so without it the module lives
+// inside other bundles and is unreachable by path. With `splitting: false` this
+// bundle carries its own copy of the sidecar module state, which is correct here:
+// an unknown command never constructs a Command, so nothing else has opened the
+// stream, and this copy opens, writes, and closes it alone.
+let audit;
+try {
+  audit = require("../dist/lib/output/audit-lifecycle");
+} catch {
+  audit = undefined;
+}
+
+void runOclif(oclif, { dir: __dirname, audit });

package/dist/commands/build-info.js

@@ -1,16 +1,16 @@
-"use strict";var ze=Object.create;var k=Object.defineProperty;var Je=Object.getOwnPropertyDescriptor;var qe=Object.getOwnPropertyNames;var We=Object.getPrototypeOf,Ve=Object.prototype.hasOwnProperty;var Ze=(e,n)=>{for(var t in n)k(e,t,{get:n[t],enumerable:!0})},pe=(e,n,t,r)=>{if(n&&typeof n=="object"||typeof n=="function")for(let i of qe(n))!Ve.call(e,i)&&i!==t&&k(e,i,{get:()=>n[i],enumerable:!(r=Je(n,i))||r.enumerable});return e};var g=(e,n,t)=>(t=e!=null?ze(We(e)):{},pe(n||!e||!e.__esModule?k(t,"default",{value:e,enumerable:!0}):t,e)),Xe=e=>pe(k({},"__esModule",{value:!0}),e);var Wn={};Ze(Wn,{default:()=>Y});module.exports=Xe(Wn);var A=require("@oclif/core");var fe="public",ge="https://app.allscale.io";var _e=["https://app.allscale.io"];var M="Override the API base URL (public builds accept only https://app.allscale.io)";var K="Only https://app.allscale.io is allowed, and URL userinfo is forbidden.";function Ae(e){try{let n=new URL(e);return n.username.length>0||n.password.length>0?null:n.protocol==="https:"?n:null}catch{return null}}function he(e){return Ae(e)!==null}function H(e){let n=Ae(e);return n!==null&&_e.includes(n.origin)}function h(){return"".trim()||void 0}function E(){return"public"}function S(e){try{let{hostname:n}=new URL(e);return n==="127.0.0.1"||n==="localhost"||n==="[::1]"}catch{return!1}}function z(e){try{return new URL(e).origin}catch{return null}}function m(){{let e="[]".trim();if(e.length===0)return[];try{let n=JSON.parse(e);return Array.isArray(n)?n:[]}catch{return[]}}return j()}function j(){let e=process.env.ALLSCALE_BUILD_PAIRS?.trim()??"";if(e.length>0)try{let r=JSON.parse(e);if(!Array.isArray(r))return[];let i=[];for(let o of r){if(typeof o!="object"||o===null)continue;let{base:s,key:a,keyId:u}=o;if(typeof s!="string"||s.trim().length===0||typeof a!="string"||a.trim().length===0)continue;let f=typeof u=="string"?u.trim():"";i.push({base:s.trim(),key:a,keyId:f.length>0?f:"cli-1"})}return i}catch{return[]}let n=process.env.ALLSCALE_SIGNING_KEY??"",t=process.env.ALLSCALE_BUILD_API_BASE?.trim()??"";if(n.trim().length>0&&t.length>0){let r=process.env.ALLSCALE_SIGNING_KEY_ID?.trim();return[{base:t,key:n,keyId:r&&r.length>0?r:"cli-1"}]}return[]}var Ee="allscale device-login";var Qe={"input.invalid":2,"storage.unavailable":2,"transport.network":3,"transport.timeout":3,"transport.response_too_large":2,"auth.no_token":4,"auth.unknown_profile":2,"auth.token_expired":5,"auth.credential_changed":3,"auth.permission_denied":6,"auth.signature_rejected":11,"claim.not_claimable":12,"claim.expired":12,"claim.payout_ambiguous":9,"claim_link.funding_ambiguous":9,"claim_link.intent_conflict":2,"claim_link.browser_cancelled":12,"user.cancelled":12,"signing.key_unavailable":2,not_found:7,rate_limited:8,"backend.internal":9,"wallet.requires_browser_auth":6,"wallet.bridge_timeout":3,"wallet.bridge_invalid_response":9,"wallet.headless_not_supported":6,"wallet.headless_setup_required":6,"wallet.headless_config_missing":6,"wallet.headless_sign_failed":9,"raw.disabled":10,internal:1},en=new RegExp(["\\u001b\\[[0-9;:<=>?]*[ -/]*[@-~]","\\u009b[0-9;:<=>?]*[ -/]*[@-~]","\\u001b\\][^\\u0007\\u001b\\u009c]*(?:\\u0007|\\u001b\\\\|\\u009c)","\\u009d[^\\u0007\\u001b\\u009c]*(?:\\u0007|\\u001b\\\\|\\u009c)","\\u001b[ -/]+[0-~]","\\u001b[0-Z\\x5c-~]","\\u001b\\[[0-9;:<=>?]*[ -/]*","\\u009b[0-9;:<=>?]*[ -/]*","[\\u0007\\u001b\\u0090\\u0098\\u009b\\u009c\\u009d\\u009e\\u009f]"].join("|"),"g");function W(e){return(typeof e=="string"?e:String(e??"")).replace(en,"")}var nn=64;function J(e,n=new Map,t=0){if(typeof e=="string")return W(e);if(e===null||typeof e!="object")return e;let r=n.get(e);if(r!==void 0)return r;if(t>=nn)return e;if(Array.isArray(e)){let s=[];n.set(e,s);for(let a of e)s.push(J(a,n,t+1));return s}let i=Object.getPrototypeOf(e);if(i!==Object.prototype&&i!==null)return e;let o={};n.set(e,o);for(let[s,a]of Object.entries(e))Object.defineProperty(o,s,{value:J(a,n,t+1),writable:!0,enumerable:!0,configurable:!0});return o}var c=class extends Error{code;details;constructor(n,t,r){super(W(t)),this.code=n,this.details=r&&J(r),this.name="AllscaleError"}get exitCode(){return Qe[this.code]}toJSON(){return{error:{code:this.code,message:this.message,...this.details?{details:this.details}:{}}}}};function me(e){if(e instanceof c)return e;if(e instanceof Error){if(on(e)){let n=an(e),t={};return e.name&&e.name!=="Error"&&(t.name=e.name),Object.keys(n).length>0&&(t.oclif=n),new c("input.invalid",e.message,Object.keys(t).length>0?t:void 0)}return new c("internal",e.message,{name:e.name})}return new c("internal","Unknown error",{value:String(e)})}var tn=new Set(["CLIError","CLIParseError","RequiredArgsError","RequiredFlagError","UnexpectedArgsError","FlagInvalidOptionError","ArgInvalidOptionError","InvalidArgsSpecError"]),rn=[/^Missing \d+ required arg/i,/^Missing required flag/i,/^Unexpected argument/i,/^Nonexistent flag/i,/^Unexpected arguments?/i,/^Failed parsing/i,/^Parsing --[A-Za-z0-9][A-Za-z0-9-]*(?:\s|$)/i,/^Expected (?:--|-).*/i,/^Flag --[A-Za-z0-9][A-Za-z0-9-]* can only be specified once\.?$/i,/^Flag --[A-Za-z0-9][A-Za-z0-9-]* expects a value$/i,/^Flag --[A-Za-z0-9][A-Za-z0-9-]* expects one of these values: /i,/to be one of: /];function on(e){if(sn(e))return!0;let n=e.name??"";return tn.has(n)?n==="CLIError"?q(e,"parse")||Se(e.message):!0:Se(e.message)}function sn(e){if(!q(e,"oclif"))return!1;let n=e.oclif;return typeof n=="object"&&n!==null&&n.exit===2&&q(e,"parse")}function Se(e){return e?W(e).split(`
-`).some(n=>rn.some(t=>t.test(n.trim()))):!1}function q(e,n){return typeof e=="object"&&e!==null&&Object.prototype.hasOwnProperty.call(e,n)}function an(e){let n=e,t={};for(let r of["code","exitCode","suggestions","ref"])n[r]!==void 0&&(t[r]=n[r]);return t}function Le(e){process.stdout.write(`${JSON.stringify({data:e},null,2)}
-`)}var l=g(require("fs")),v=g(require("path")),Oe=g(require("crypto"));var ln="...<truncated>",cn=/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]+/g,un=/\bBearer\s+[A-Za-z0-9._~+/=-]{12,}/gi,ne=String.raw`(?:(?:Bearer|Basic)\s+)?(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*'|[^\s,;)}\]]+)`,V=String.raw`(?:proxy[_-]?)?authorization`,dn=new RegExp(String.raw`(^|[^A-Za-z0-9])((?:"${V}"|'${V}'|${V})\s*[:=]\s*)((?:Bearer|Basic)\s+)?(?!<redacted(?:-jwt)?>)${ne}`,"gi"),pn=/\b(https?:\/\/)[^\s/?#]+@/gi,Z=String.raw`(?:password|passwd|passphrase|otp(?:[_-]?code)?|signature|hmac|sig|session[_-]?id|mnemonic|seed|cookie|bearer|(?:[A-Za-z0-9]+[_-])*(?:token|secret)|(?:api|access|private|signing)[_-]?key|credential|claim[_-]?url)`,fn=new RegExp(String.raw`(^|[^A-Za-z0-9])((?:"${Z}"|'${Z}'|${Z})\s*[:=]\s*)(?!<redacted(?:-jwt)?>)${ne}`,"gi"),X=String.raw`(?:[A-Za-z0-9]+(?:Token|Secret)|[Oo][Tt][Pp]Code|[Ss]essionId|(?:api|API|access|Access|private|Private|signing|Signing)Key|[Cc]laimUrl)`,gn=new RegExp(String.raw`(^|[^A-Za-z0-9])((?:"${X}"|'${X}'|${X})\s*[:=]\s*)(?!<redacted(?:-jwt)?>)${ne}`,"g");function Ie(e){return e.replace(pn,"$1<redacted>@").replace(cn,"<redacted-jwt>").replace(dn,"$1$2$3<redacted>").replace(fn,"$1$2<redacted>").replace(gn,"$1$2<redacted>").replace(un,"Bearer <redacted>")}function be(e){let n="";for(let t of e){let r=t.codePointAt(0),i=r<=8||r>=11&&r<=12||r>=14&&r<=31||r>=127&&r<=159;n+=i?`\\u${r.toString(16).padStart(4,"0")}`:t}return n}function ye(e,n,t=ln){if(n<=0)return"";if(Buffer.byteLength(e,"utf8")<=n)return e;let r=Buffer.byteLength(t,"utf8");if(r>=n){let a="",u=0;for(let f of t){let L=Buffer.byteLength(f,"utf8");if(u+L>n)break;a+=f,u+=L}return a}let i=n-r,o="",s=0;for(let a of e){let u=Buffer.byteLength(a,"utf8");if(s+u>i)break;o+=a,s+=u}return`${o}${t}`}function p(e,n=16384){return ye(be(Ie(e)),n)}var Q=100,_n=8,An=8*1024;function x(){return{remaining:An}}function ee(e,n){let t=Math.min(16384,n.remaining),r=ye(e,t);return n.remaining-=Buffer.byteLength(r,"utf8"),r}function I(e,n,t=0,r={}){if(t>_n)return ee("<truncated>",n);if(typeof e=="string"){let i=Ie(e);return ee(r.escapeControls?be(i):i,n)}if(Array.isArray(e)){let i=e.slice(0,Q),o=i.map(s=>I(s,n,t+1,r));return e.length>i.length&&o.push(ee(`<${e.length-i.length} more items truncated>`,n)),o}if(e!==null&&typeof e=="object"){let i=Object.create(null),o=Object.entries(e);for(let[s,a]of o.slice(0,Q))i[s]=I(a,n,t+1,r);return o.length>Q&&(i.output_truncated=!0),i}return e}var te=require("process");var re=!1;function ie(e){re=e}function we(){return re}var Te="1";function y(e,n){if(re){let t={...e};delete t.version;let r=x(),i={event:t.event,...t},o=I(i,r,0,{escapeControls:!0}),s=JSON.stringify({version:Te,...o});Buffer.byteLength(s,"utf8")+1>65536&&(s=JSON.stringify({version:Te,event:o.event,output_truncated:!0})),te.stderr.write(`${s}
-`)}else te.stderr.write(n)}var Ce="2",T=null,d=null,w=!1;function hn(){let e=process.env.ALLSCALE_OUTPUT_FILE_PATH;if(e)return e;let n=process.env.ALLSCALE_OUTPUT_FILE_DIRECTORY;if(n){let t=new Date().toISOString().replace(/[:.]/g,"-"),r=Oe.randomBytes(4).toString("hex");return v.join(n,`allscale-output-${t}-${r}.ndjson`)}return null}var oe=64*1024*1024,En=null;function Re(){if(w)return;let e=hn();if(!e)return;T=null;let n=null;try{if((En??process.platform)==="win32")throw new Error("owner-only sidecar ACLs cannot be enforced on Windows; sidecar output is disabled");let t=v.dirname(e);if(l.mkdirSync(t,{recursive:!0,mode:448}),!process.env.ALLSCALE_OUTPUT_FILE_PATH&&process.env.ALLSCALE_OUTPUT_FILE_DIRECTORY){let a=l.statSync(t),u=a.mode&511;if(!a.isDirectory()||(u&63)!==0)throw new Error(`output directory must be owner-only (no group/other permissions); current mode is ${u.toString(8).padStart(3,"0")}`)}let r=l.constants.O_NOFOLLOW??0;n=l.openSync(e,l.constants.O_APPEND|l.constants.O_CREAT|l.constants.O_WRONLY|(l.constants.O_NONBLOCK??0)|r,384);let i=l.fstatSync(n),o=l.lstatSync(e);if(!i.isFile()||o.isSymbolicLink()||o.dev!==i.dev||o.ino!==i.ino)throw new Error("target changed while it was being opened or is not a regular file");if(typeof process.geteuid=="function"&&i.uid!==process.geteuid())throw new Error("existing sidecar file is not owned by the current effective user");let s=i.mode&511;if((s&63)!==0)throw new Error(`existing sidecar file must already be owner-only; current mode is ${s.toString(8).padStart(3,"0")}. Rotate or remove it before retrying`);l.fchmodSync(n,384)}catch(t){if(n!==null)try{l.closeSync(n)}catch{}y({event:"sidecar_disabled",reason:"open_failed",detail:p(`sidecar path '${e}' could not be opened safely (${t.message})`)},`${p(`[allscale] sidecar path '${e}' could not be opened safely (${t.message}); refusing to write. Sidecar disabled for this run.`)}
-`);return}T=e,d=n,w=!0}var Sn=[/password/i,/secret/i,/token/i,/api[_-]?key/i,/signing[_-]?key/i,/private[_-]?key/i,/credential/i,/otp/i,/signature/i,/(?:^|[_-])sig(?:[_-]|$)/i,/hmac/i,/session[_-]?id/i,/nonce/i,/bearer/i,/authorization/i,/^code$/i,/^auth$/i,/^state$/i];function mn(e){let n=e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g,"$1_$2");return Sn.some(t=>t.test(n))}function Ln(e){try{let n=new URL(e),t=n.username.length>0||n.password.length>0;t&&(n.username="",n.password="");let r=n.pathname;n.pathname=In(n.pathname);let i=t;n.pathname!==r&&(i=!0);for(let[o]of n.searchParams)mn(o)&&(n.searchParams.set(o,"<redacted>"),i=!0);return i?n.toString():e}catch{return e}}function In(e){return e.replace(/(\/(?:api\/)?(?:v1\/)?public\/claim-links\/)([^/:]+)(:claim)?(?=\/?$)/,"$1<redacted>$3").replace(/(\/(?:api\/)?public\/claim-links\/)([^/]+)(\/claim)(?=\/?$)/,"$1<redacted>$3")}function bn(e){return(e.type==="request"||e.type==="bridge_browser_open")&&typeof e.url=="string"?{...e,url:Ln(e.url)}:e}function yn(e){let n=new Date().toISOString(),t=e,{type:r,...i}=t,o=I(i,x()),s=JSON.stringify({version:Ce,timestamp:n,type:r,...o});return Buffer.byteLength(s,"utf8")+1>65536&&(s=JSON.stringify({version:Ce,timestamp:n,type:r,output_truncated:!0})),s}function R(e){if(!w||!T||d===null)return;let n=bn(e),t=yn(n);try{if(l.fstatSync(d).size+Buffer.byteLength(t,"utf8")+1>oe){w=!1;try{l.closeSync(d)}catch{}d=null,y({event:"sidecar_disabled",reason:"size_limit",...T===null?{}:{path:p(T)},max_bytes:oe},`${p(`[allscale] sidecar exceeded ${oe} bytes; disabling it for the rest of this run. Rotate or remove ${T}, or point ALLSCALE_OUTPUT_FILE_DIRECTORY at a directory so each run gets its own file.`)}
-`);return}l.appendFileSync(d,`${t}
-`)}catch(r){if(w=!1,d!==null){try{l.closeSync(d)}catch{}d=null}try{y({event:"sidecar_disabled",reason:"write_failed",detail:p(r.message)},`${p(`[allscale] sidecar write failed (${r.message}); disabling sidecar for the rest of this run.`)}
-`)}catch{}}}function Ne(){return!!(process.env.ALLSCALE_OUTPUT_FILE_PATH||process.env.ALLSCALE_OUTPUT_FILE_DIRECTORY)}function U(){if(w=!1,d!==null){try{l.closeSync(d)}catch{}d=null}}function Pe(e=!1){let n=process.stdin.isTTY===!0&&process.stdout.isTTY===!0;return e||Ne()||!n}var N=h()??ge,P={TOKEN:"ALLSCALE_TOKEN",PROFILE:"ALLSCALE_PROFILE",API_BASE:"ALLSCALE_API_BASE",PAYOUT_API_BASE:"ALLSCALE_PAYOUT_API_BASE",PRETTY:"ALLSCALE_PRETTY",LOG_LEVEL:"ALLSCALE_LOG_LEVEL",INSECURE_STORAGE:"ALLSCALE_INSECURE_STORAGE",NO_KEYCHAIN:"ALLSCALE_NO_KEYCHAIN",ALLOW_RAW:"ALLSCALE_ALLOW_RAW",OUTPUT_FILE_PATH:"ALLSCALE_OUTPUT_FILE_PATH",OUTPUT_FILE_DIRECTORY:"ALLSCALE_OUTPUT_FILE_DIRECTORY",STORE_API_KEY:"ALLSCALE_STORE_API_KEY",STORE_API_SECRET:"ALLSCALE_STORE_API_SECRET"};function D(e){return he(e)?new URL(e).origin:null}function _(e){try{let n=new URL(e);return`${n.protocol}//${n.host}`}catch{return"<unparseable URL>"}}function Be(){let e=process.env[P.TOKEN]?.trim();return e&&e.length>0?e:void 0}function se(){let e=process.env[P.PROFILE]?.trim();return e&&e.length>0?e:void 0}function $(){let e=process.env[P.API_BASE]?.trim();return e&&e.length>0?e:void 0}function ke(){let e=process.env[P.INSECURE_STORAGE]?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function xe(){let e=process.env[P.ALLOW_RAW]?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function ve(e){let{resolvedApiBase:n,fromExplicitOverride:t,profileApiBase:r,profileApiBaseSource:i}=e;if(h()===void 0&&N!==""&&"".length!==0&&!t&&i!=="explicit"&&r===""&&n==="")return`Notice: this profile is pinned to ${""} (staging) in ~/.allscale/config.toml.
-  The CLI default is now ${N} (production), but a saved profile wins over the default,
+"use strict";var Qe=Object.create;var U=Object.defineProperty;var en=Object.getOwnPropertyDescriptor;var nn=Object.getOwnPropertyNames;var tn=Object.getPrototypeOf,rn=Object.prototype.hasOwnProperty;var on=(e,n)=>{for(var t in n)U(e,t,{get:n[t],enumerable:!0})},_e=(e,n,t,r)=>{if(n&&typeof n=="object"||typeof n=="function")for(let i of nn(n))!rn.call(e,i)&&i!==t&&U(e,i,{get:()=>n[i],enumerable:!(r=en(n,i))||r.enumerable});return e};var g=(e,n,t)=>(t=e!=null?Qe(tn(e)):{},_e(n||!e||!e.__esModule?U(t,"default",{value:e,enumerable:!0}):t,e)),sn=e=>_e(U({},"__esModule",{value:!0}),e);var _t={};on(_t,{default:()=>M});module.exports=sn(_t);var _=require("@oclif/core");var he="public",Ae="https://app.allscale.io";var me=["https://app.allscale.io"];var j="Override the API base URL (public builds accept only https://app.allscale.io)";var H="Only https://app.allscale.io is allowed, and URL userinfo is forbidden.";function Ee(e){try{let n=new URL(e);return n.username.length>0||n.password.length>0?null:n.protocol==="https:"?n:null}catch{return null}}function Se(e){return Ee(e)!==null}function q(e){let n=Ee(e);return n!==null&&me.includes(n.origin)}function S(){return"".trim()||void 0}function h(){return"public"}function b(e){try{let{hostname:n}=new URL(e);return n==="127.0.0.1"||n==="localhost"||n==="[::1]"}catch{return!1}}function W(e){try{return new URL(e).origin}catch{return null}}function L(){{let e="[]".trim();if(e.length===0)return[];try{let n=JSON.parse(e);return Array.isArray(n)?n:[]}catch{return[]}}return z()}function z(){let e=process.env.ALLSCALE_BUILD_PAIRS?.trim()??"";if(e.length>0)try{let r=JSON.parse(e);if(!Array.isArray(r))return[];let i=[];for(let o of r){if(typeof o!="object"||o===null)continue;let{base:s,key:a,keyId:u}=o;if(typeof s!="string"||s.trim().length===0||typeof a!="string"||a.trim().length===0)continue;let d=typeof u=="string"?u.trim():"";i.push({base:s.trim(),key:a,keyId:d.length>0?d:"cli-1"})}return i}catch{return[]}let n=process.env.ALLSCALE_SIGNING_KEY??"",t=process.env.ALLSCALE_BUILD_API_BASE?.trim()??"";if(n.trim().length>0&&t.length>0){let r=process.env.ALLSCALE_SIGNING_KEY_ID?.trim();return[{base:t,key:n,keyId:r&&r.length>0?r:"cli-1"}]}return[]}var an={"input.invalid":2,"storage.unavailable":2,"transport.network":3,"transport.timeout":3,"transport.response_too_large":2,"auth.no_token":4,"auth.unknown_profile":2,"auth.token_invalid":5,"auth.token_expired":5,"auth.device_pairing_timeout":3,"auth.credential_changed":3,"auth.permission_denied":6,"auth.signature_rejected":11,"claim.not_claimable":12,"claim.expired":12,"claim.payout_ambiguous":9,"claim_link.funding_ambiguous":9,"claim_link.intent_conflict":2,"claim_link.browser_cancelled":12,"user.cancelled":12,"signing.key_unavailable":2,not_found:7,rate_limited:8,"backend.internal":9,"wallet.requires_browser_auth":6,"wallet.bridge_timeout":3,"wallet.bridge_op_expired":3,"wallet.bridge_invalid_response":9,"wallet.transaction_reverted":12,"wallet.transaction_status_unknown":9,"raw.disabled":10,internal:1},cn=new RegExp(["\\u001b\\[[0-9;:<=>?]*[ -/]*[@-~]","\\u009b[0-9;:<=>?]*[ -/]*[@-~]","\\u001b\\][^\\u0007\\u001b\\u009c]*(?:\\u0007|\\u001b\\\\|\\u009c)","\\u009d[^\\u0007\\u001b\\u009c]*(?:\\u0007|\\u001b\\\\|\\u009c)","\\u001b[ -/]+[0-~]","\\u001b[0-Z\\x5c-~]","\\u001b\\[[0-9;:<=>?]*[ -/]*","\\u009b[0-9;:<=>?]*[ -/]*","[\\u0007\\u001b\\u0090\\u0098\\u009b\\u009c\\u009d\\u009e\\u009f]"].join("|"),"g");function Z(e){return(typeof e=="string"?e:String(e??"")).replace(cn,"")}var ln=64;function J(e,n=new Map,t=0){if(typeof e=="string")return Z(e);if(e===null||typeof e!="object")return e;let r=n.get(e);if(r!==void 0)return r;if(t>=ln)return e;if(Array.isArray(e)){let s=[];n.set(e,s);for(let a of e)s.push(J(a,n,t+1));return s}let i=Object.getPrototypeOf(e);if(i!==Object.prototype&&i!==null)return e;let o={};n.set(e,o);for(let[s,a]of Object.entries(e))Object.defineProperty(o,s,{value:J(a,n,t+1),writable:!0,enumerable:!0,configurable:!0});return o}var l=class extends Error{code;details;constructor(n,t,r){super(Z(t)),this.code=n,this.details=r&&J(r),this.name="AllscaleError"}get exitCode(){return an[this.code]}toJSON(){return{error:{code:this.code,message:this.message,...this.details?{details:this.details}:{}}}}};function Le(e){if(e instanceof l)return e;if(e instanceof Error){if(pn(e)){let n=gn(e),t={};return e.name&&e.name!=="Error"&&(t.name=e.name),Object.keys(n).length>0&&(t.oclif=n),new l("input.invalid",e.message,Object.keys(t).length>0?t:void 0)}return new l("internal",e.message,{name:e.name})}return new l("internal","Unknown error",{value:String(e)})}var un=new Set(["CLIError","CLIParseError","RequiredArgsError","RequiredFlagError","UnexpectedArgsError","FlagInvalidOptionError","ArgInvalidOptionError","InvalidArgsSpecError"]),dn=[/^Missing \d+ required arg/i,/^Missing required flag/i,/^Unexpected argument/i,/^Nonexistent flag/i,/^Unexpected arguments?/i,/^Failed parsing/i,/^Parsing --[A-Za-z0-9][A-Za-z0-9-]*(?:\s|$)/i,/^Expected (?:--|-).*/i,/^Flag --[A-Za-z0-9][A-Za-z0-9-]* can only be specified once\.?$/i,/^Flag --[A-Za-z0-9][A-Za-z0-9-]* expects a value$/i,/^Flag --[A-Za-z0-9][A-Za-z0-9-]* expects one of these values: /i,/to be one of: /];function pn(e){if(fn(e))return!0;let n=e.name??"";return un.has(n)?n==="CLIError"?V(e,"parse")||be(e.message):!0:be(e.message)}function fn(e){if(!V(e,"oclif"))return!1;let n=e.oclif;return typeof n=="object"&&n!==null&&n.exit===2&&V(e,"parse")}function be(e){return e?Z(e).split(`
+`).some(n=>dn.some(t=>t.test(n.trim()))):!1}function V(e,n){return typeof e=="object"&&e!==null&&Object.prototype.hasOwnProperty.call(e,n)}function gn(e){let n=e,t={};for(let r of["code","exitCode","suggestions","ref"])n[r]!==void 0&&(t[r]=n[r]);return t}function ye(e){process.stdout.write(`${JSON.stringify({data:e},null,2)}
+`)}var c=g(require("fs")),G=g(require("path")),ke=g(require("crypto"));var _n="...<truncated>",hn=/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]+/g,An=/\bBearer\s+[A-Za-z0-9._~+/=-]{12,}/gi,te=String.raw`(?:(?:Bearer|Basic)\s+)?(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*'|[^\s,;)}\]]+)`,X=String.raw`(?:proxy[_-]?)?authorization`,mn=new RegExp(String.raw`(^|[^A-Za-z0-9])((?:"${X}"|'${X}'|${X})\s*[:=]\s*)((?:Bearer|Basic)\s+)?(?!<redacted(?:-jwt)?>)${te}`,"gi"),En=/\b(https?:\/\/)[^\s/?#]+@/gi,Sn=String.raw`(?:[A-Za-z0-9]+[_-])*`,bn=String.raw`(?:[A-Za-z0-9]{1,32}[_-]){0,8}`,we=e=>String.raw`(?:password|passwd|passphrase|otp(?:[_-]?code)?|signature|hmac|sig|session[_-]?id|mnemonic|seed|cookie|bearer|${e}(?:token|secret)|(?:api|access|private|signing)[_-]?key|credential|claim[_-]?url)`,Ie=we(Sn),Ln=we(bn),yn=new RegExp(String.raw`(^|[^A-Za-z0-9])((?:"${Ie}"|'${Ie}'|${Ln})\s*[:=]\s*)(?!<redacted(?:-jwt)?>)${te}`,"gi"),Q=String.raw`(?:[A-Za-z0-9]+(?:Token|Secret)|[Oo][Tt][Pp]Code|[Ss]essionId|(?:api|API|access|Access|private|Private|signing|Signing)Key|[Cc]laimUrl)`,In=new RegExp(String.raw`(^|[^A-Za-z0-9])((?:"${Q}"|'${Q}'|${Q})\s*[:=]\s*)(?!<redacted(?:-jwt)?>)${te}`,"g");function Ce(e){return e.replace(En,"$1<redacted>@").replace(hn,"<redacted-jwt>").replace(mn,"$1$2$3<redacted>").replace(yn,"$1$2<redacted>").replace(In,"$1$2<redacted>").replace(An,"Bearer <redacted>")}var wn=/(token|secret|password|passwd|passphrase|cookie|authorization|bearer|credential|mnemonic|seed|api[_-]?key|apikey|private[_-]?key|privkey|otp|signature|hmac|(?:^|[_-])sig(?:[_-]|$)|session[_-]?id|^input$)/i;function Te(e){let n=e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g,"$1_$2");return wn.test(n)}function Oe(e){let n="";for(let t of e){let r=t.codePointAt(0),i=r<=8||r>=11&&r<=12||r>=14&&r<=31||r>=127&&r<=159;n+=i?`\\u${r.toString(16).padStart(4,"0")}`:t}return n}function ve(e,n,t=_n){if(n<=0)return"";if(Buffer.byteLength(e,"utf8")<=n)return e;let r=Buffer.byteLength(t,"utf8");if(r>=n){let a="",u=0;for(let d of t){let E=Buffer.byteLength(d,"utf8");if(u+E>n)break;a+=d,u+=E}return a}let i=n-r,o="",s=0;for(let a of e){let u=Buffer.byteLength(a,"utf8");if(s+u>i)break;o+=a,s+=u}return`${o}${t}`}function p(e,n=16384){return ve(Oe(Ce(e)),n)}var ee=100,Cn=8,Tn=8*1024;function $(){return{remaining:Tn}}function ne(e,n){let t=Math.min(16384,n.remaining),r=ve(e,t);return n.remaining-=Buffer.byteLength(r,"utf8"),r}function I(e,n,t=0,r={}){if(t>Cn)return ne("<truncated>",n);if(typeof e=="string"){let i=Ce(e);return ne(r.escapeControls?Oe(i):i,n)}if(Array.isArray(e)){let i=e.slice(0,ee),o=i.map(s=>I(s,n,t+1,r));return e.length>i.length&&o.push(ne(`<${e.length-i.length} more items truncated>`,n)),o}if(e!==null&&typeof e=="object"){let i=Object.create(null),o=Object.entries(e);for(let[s,a]of o.slice(0,ee))i[s]=I(a,n,t+1,r);return o.length>ee&&(i.output_truncated=!0),i}return e}var re=require("process");var ie=!1;function oe(e){ie=e}function Ne(){return ie}var Re="1";function C(e,n){if(ie){let t={...e};delete t.version;let r=$(),i={event:t.event,...t},o=I(i,r,0,{escapeControls:!0}),s=JSON.stringify({version:Re,...o});Buffer.byteLength(s,"utf8")+1>65536&&(s=JSON.stringify({version:Re,event:o.event,output_truncated:!0})),re.stderr.write(`${s}
+`)}else re.stderr.write(n)}var Pe="2",T=null,f=null,O=!1,N=!1;function On(){let e=process.env.ALLSCALE_OUTPUT_FILE_PATH;if(e)return e;let n=process.env.ALLSCALE_OUTPUT_FILE_DIRECTORY;if(n){let t=new Date().toISOString().replace(/[:.]/g,"-"),r=ke.randomBytes(4).toString("hex");return G.join(n,`allscale-output-${t}-${r}.ndjson`)}return null}var se=64*1024*1024,vn=null;function ae(e={}){if(e.quiet&&(N=!0),O)return;let n=On();if(!n)return;T=null;let t=null;try{if((vn??process.platform)==="win32")throw new Error("owner-only sidecar ACLs cannot be enforced on Windows; sidecar output is disabled");let r=G.dirname(n);if(c.mkdirSync(r,{recursive:!0,mode:448}),!process.env.ALLSCALE_OUTPUT_FILE_PATH&&process.env.ALLSCALE_OUTPUT_FILE_DIRECTORY){let u=c.statSync(r),d=u.mode&511;if(!u.isDirectory()||(d&63)!==0)throw new Error(`output directory must be owner-only (no group/other permissions); current mode is ${d.toString(8).padStart(3,"0")}`)}let i=c.constants.O_NOFOLLOW??0;t=c.openSync(n,c.constants.O_APPEND|c.constants.O_CREAT|c.constants.O_WRONLY|(c.constants.O_NONBLOCK??0)|i,384);let o=c.fstatSync(t),s=c.lstatSync(n);if(!o.isFile()||s.isSymbolicLink()||s.dev!==o.dev||s.ino!==o.ino)throw new Error("target changed while it was being opened or is not a regular file");if(typeof process.geteuid=="function"&&o.uid!==process.geteuid())throw new Error("existing sidecar file is not owned by the current effective user");let a=o.mode&511;if((a&63)!==0)throw new Error(`existing sidecar file must already be owner-only; current mode is ${a.toString(8).padStart(3,"0")}. Rotate or remove it before retrying`);c.fchmodSync(t,384)}catch(r){if(t!==null)try{c.closeSync(t)}catch{}N||C({event:"sidecar_disabled",reason:"open_failed",detail:p(`sidecar path '${n}' could not be opened safely (${r.message})`)},`${p(`[allscale] sidecar path '${n}' could not be opened safely (${r.message}); refusing to write. Sidecar disabled for this run.`)}
+`);return}T=n,f=t,O=!0}var Rn=[/password/i,/secret/i,/token/i,/api[_-]?key/i,/signing[_-]?key/i,/private[_-]?key/i,/credential/i,/otp/i,/signature/i,/(?:^|[_-])sig(?:[_-]|$)/i,/hmac/i,/session[_-]?id/i,/nonce/i,/bearer/i,/authorization/i,/^code$/i,/^auth$/i,/^state$/i];function Nn(e){let n=e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g,"$1_$2");return Rn.some(t=>t.test(n))}function Pn(e){try{let n=new URL(e),t=n.username.length>0||n.password.length>0;t&&(n.username="",n.password="");let r=n.pathname;n.pathname=kn(n.pathname);let i=t;n.pathname!==r&&(i=!0);for(let[o]of n.searchParams)Nn(o)&&(n.searchParams.set(o,"<redacted>"),i=!0);return i?n.toString():e}catch{return e}}function kn(e){return e.replace(/(\/(?:api\/)?(?:v1\/)?public\/claim-links\/)([^/:]+)(:claim)?(?=\/?$)/,"$1<redacted>$3").replace(/(\/(?:api\/)?public\/claim-links\/)([^/]+)(\/claim)(?=\/?$)/,"$1<redacted>$3")}function Bn(e){return(e.type==="request"||e.type==="bridge_browser_open")&&typeof e.url=="string"?{...e,url:Pn(e.url)}:e}function xn(e){let n=new Date().toISOString(),t=e,{type:r,...i}=t,o=I(i,$()),s=JSON.stringify({version:Pe,timestamp:n,type:r,...o});return Buffer.byteLength(s,"utf8")+1>65536&&(s=JSON.stringify({version:Pe,timestamp:n,type:r,output_truncated:!0})),s}function v(e){if(!O||!T||f===null)return;let n=Bn(e),t=xn(n);try{if(c.fstatSync(f).size+Buffer.byteLength(t,"utf8")+1>se){O=!1;try{c.closeSync(f)}catch{}f=null,N||C({event:"sidecar_disabled",reason:"size_limit",...T===null?{}:{path:p(T)},max_bytes:se},`${p(`[allscale] sidecar exceeded ${se} bytes; disabling it for the rest of this run. Rotate or remove ${T}, or point ALLSCALE_OUTPUT_FILE_DIRECTORY at a directory so each run gets its own file.`)}
+`);return}c.appendFileSync(f,`${t}
+`)}catch(r){if(O=!1,f!==null){try{c.closeSync(f)}catch{}f=null}try{N||C({event:"sidecar_disabled",reason:"write_failed",detail:p(r.message)},`${p(`[allscale] sidecar write failed (${r.message}); disabling sidecar for the rest of this run.`)}
+`)}catch{}}}function Be(){return!!(process.env.ALLSCALE_OUTPUT_FILE_PATH||process.env.ALLSCALE_OUTPUT_FILE_DIRECTORY)}function P(){if(N=!1,O=!1,f!==null){try{c.closeSync(f)}catch{}f=null}}function xe(e=!1){let n=process.stdin.isTTY===!0&&process.stdout.isTTY===!0;return e||Be()||!n}var k=new Set(["--password","-p","--token","-t","--otp","--otp-id","--api-base","--payout-api-base","--browser-base","--input","-i","--claim-token","--claim-url","--api-key","--api-secret"]),Dn=new Set(Array.from(k).filter(e=>e.startsWith("-")&&!e.startsWith("--")&&e.length===2)),Un=Array.from(k).filter(e=>e.startsWith("--")).sort((e,n)=>n.length-e.length),$n=new Set(["--otp-stdin","--password-stdin"]);function ce(e){let n=[];for(let t=0;t<e.length;t+=1){let r=e[t];if(r.startsWith("-")){let o=r.indexOf("=");if(o!==-1){let s=r.slice(0,o);if(k.has(s)){n.push(`${s}=<redacted>`);continue}}}if(k.has(r)){n.push(r),t+1<e.length&&(k.has(e[t+1])||(n.push("<redacted>"),t+=1));continue}if(r.startsWith("-")&&!r.startsWith("--")&&r.length>2&&r[1]!=="="){let o=r.slice(0,2);if(Dn.has(o)){n.push(`${o}<redacted>`);continue}}let i=$n.has(r)?void 0:Un.find(o=>r.length>o.length&&r.startsWith(o));if(i){n.push(`${i}<redacted>`);continue}n.push(r)}return n}function De(e){v({type:"error",code:e.code,message:p(e.message)}),v({type:"command-end",ok:!1,exitCode:e.exitCode}),P()}var B=S()??Ae,x={TOKEN:"ALLSCALE_TOKEN",PROFILE:"ALLSCALE_PROFILE",API_BASE:"ALLSCALE_API_BASE",PAYOUT_API_BASE:"ALLSCALE_PAYOUT_API_BASE",PRETTY:"ALLSCALE_PRETTY",LOG_LEVEL:"ALLSCALE_LOG_LEVEL",INSECURE_STORAGE:"ALLSCALE_INSECURE_STORAGE",NO_KEYCHAIN:"ALLSCALE_NO_KEYCHAIN",ALLOW_RAW:"ALLSCALE_ALLOW_RAW",OUTPUT_FILE_PATH:"ALLSCALE_OUTPUT_FILE_PATH",OUTPUT_FILE_DIRECTORY:"ALLSCALE_OUTPUT_FILE_DIRECTORY",STORE_API_KEY:"ALLSCALE_STORE_API_KEY",STORE_API_SECRET:"ALLSCALE_STORE_API_SECRET"};function le(e){return Se(e)?new URL(e).origin:null}function A(e){try{let n=new URL(e);return`${n.protocol}//${n.host}`}catch{return"<unparseable URL>"}}function Ue(){let e=process.env[x.TOKEN]?.trim();return e&&e.length>0?e:void 0}function ue(){let e=process.env[x.PROFILE]?.trim();return e&&e.length>0?e:void 0}function D(){let e=process.env[x.API_BASE]?.trim();return e&&e.length>0?e:void 0}function $e(){let e=process.env[x.INSECURE_STORAGE]?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function Ge(){let e=process.env[x.ALLOW_RAW]?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function Fe(e){let{resolvedApiBase:n,fromExplicitOverride:t,profileApiBase:r,profileApiBaseSource:i}=e;if(S()===void 0&&B!==""&&"".length!==0&&!t&&i!=="explicit"&&r===""&&n==="")return`Notice: this profile is pinned to ${""} (staging) in ~/.allscale/config.toml.
+  The CLI default is now ${B} (production), but a saved profile wins over the default,
   so this session still uses staging. That pin was written before the default changed, so it may just be
   the old default rather than a deliberate choice.
-  To keep staging, re-run login with --api-base ${""} (recorded as deliberate, silences this).
-  To move to production, run: ${Ee} --api-base ${N}
-`}var O=g(require("fs")),Ue=g(require("os")),ae=g(require("path")),le=g(require("@iarna/toml"));var Cn=".allscale",On="config.toml";function Rn(){return ae.join(Ue.homedir(),Cn)}function Nn(){return ae.join(Rn(),On)}function De(){let e=Nn();if(!O.existsSync(e))return{};let n=O.readFileSync(e,"utf-8");try{return le.parse(n)}catch(t){throw new c("internal",`Failed to parse ${e}: ${t.message}`)}}function $e(e,n){return e.profile?.[n]}function Ge(e,n,t){let r=n??t??e.default??"default";if(r.includes(":"))throw new c("input.invalid",`Invalid profile name '${r}': ':' is reserved as the keychain namespace separator \u2014 pick a name without ':'.`);return r}function ce(e){if(!H(e))throw new c("input.invalid",`Refusing to send credentials to API base ${_(e)}. `+K)}function Fe(e){let n=h();if(n===void 0||S(e))return;let t=D(e),r=m();if(r.length>0){let o=r.map(a=>D(a.base)).filter(a=>a!==null);if(t!==null&&o.includes(t))return;let s=r.map(a=>_(a.base)).join(", ");throw new c("input.invalid",`Refusing to send to ${_(e)} \u2014 this build only signs for: ${s}. Re-login against one of this build's environments, or use a build that includes the one you need.`)}let i=D(n);if(!(t!==null&&t===i))throw new c("input.invalid",`Refusing to send to ${_(e)} \u2014 this build only signs for ${_(n)}. Re-login against this build's environment, or use a build for that one.`)}var Pn=require("@noble/hashes/sha3");var Ye=["USDT","USDC"];var Ut=new Set([`0x${"0".repeat(40)}`,`0x${"0".repeat(36)}dead`]);var Me=require("@oclif/core"),B=class e extends A.Command{static enableJsonFlag=!0;static legacyStagingNoticeShown=!1;static emitsOwnOutput=!1;static requiresEscapeHatch=!1;static requiresInput=!1;static isLocalOnly=!1;static baseFlags={profile:A.Flags.string({description:"Named profile from ~/.allscale/config.toml",helpGroup:"GLOBAL"}),token:A.Flags.string({description:"Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",helpGroup:"GLOBAL",hidden:E()==="public"}),"api-base":A.Flags.string({description:M,helpGroup:"GLOBAL",hidden:E()==="public"}),"insecure-storage":A.Flags.boolean({description:"Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain \u2014 for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",default:!1,helpGroup:"GLOBAL"})};async run(){try{ie(this.jsonEnabled()),Re(),R({type:"session-start",command:this.id??"",argv:kn(this.argv)});let n=this.constructor;if(E()==="public"){if(this.argv.some(o=>o==="--token"||o.startsWith("--token=")))throw new c("input.invalid","--token is not supported in this build. Set the ALLSCALE_TOKEN environment variable instead (it does not leak into shell history or process listings).");if(this.argv.some(o=>o==="--api-base"||o.startsWith("--api-base=")))throw new c("input.invalid","--api-base is not supported in this build; it always talks to its bound AllScale environment.");if(!n.isLocalOnly&&$()!==void 0)throw new c("input.invalid","ALLSCALE_API_BASE is not supported in this build; unset it \u2014 this build always talks to its bound AllScale environment.")}if(n.requiresEscapeHatch&&!xe())throw this.argv.length>0&&await this.parse(),new c("raw.disabled","This command is an opt-in escape hatch and is disabled by default. Set ALLSCALE_ALLOW_RAW=1 to enable raw GraphQL/REST passthroughs and schema introspection. The real access boundary is enforced server-side by the key's scope regardless.");let t=Pe(this.jsonEnabled()),r=this.argv.length===0&&!t&&Yn(n)?this.config.findCommand(this.id??""):void 0;if(r){U();let o=await(0,A.loadHelpClass)(this.config),s=this.config.pjson.oclif?.helpOptions??this.config.pjson.helpOptions;await new o(this.config,s).showCommandHelp(r,this.config.topics);return}let i=await this.runCommand();return R({type:"command-end",ok:!0}),U(),n.emitsOwnOutput?void 0:(this.jsonEnabled()||Le(i),{data:i})}catch(n){let t=me(n);R({type:"error",code:t.code,message:p(t.message)}),R({type:"command-end",ok:!1,exitCode:t.exitCode}),U(),this.emitError(t),process.exitCode=t.exitCode;return}finally{ie(!1)}}resolveSessionApiBaseChain(n){let t=De(),r=n.profile??void 0,i=n["api-base"]??void 0,o=r!==void 0||se()!==void 0,s=Ge(t,r,se()),a=$e(t,s),u=i??$(),f=u??a?.api_base??N,L=ve({resolvedApiBase:f,fromExplicitOverride:u!==void 0,profileApiBase:a?.api_base,profileApiBaseSource:a?.api_base_source});return L&&!e.legacyStagingNoticeShown&&(e.legacyStagingNoticeShown=!0,y({event:"legacy_staging_profile",api_base:f,profile:s},L)),{apiBase:f,explicitApiBase:u,profileApiBase:a?.api_base,profile:s,profileExplicit:o}}resolveSessionApiBaseForPayoutDerivation(n){let{apiBase:t}=this.resolveSessionApiBaseChain(n);return this.constructor.isLocalOnly||ce(t),t}resolveContext(n){if(E()==="public"){if(n.token!==void 0)throw new c("input.invalid","--token is not supported in this build. Set the ALLSCALE_TOKEN environment variable instead (it does not leak into shell history or process listings).");if(n["api-base"]!==void 0)throw new c("input.invalid","--api-base is not supported in this build; it always talks to its bound AllScale environment.");if(!this.constructor.isLocalOnly&&$()!==void 0)throw new c("input.invalid","ALLSCALE_API_BASE is not supported in this build; unset it \u2014 this build always talks to its bound AllScale environment.")}let t=n.token??void 0,r=!!n["insecure-storage"],{apiBase:i,explicitApiBase:o,profile:s,profileApiBase:a,profileExplicit:u}=this.resolveSessionApiBaseChain(n);return this.constructor.isLocalOnly||(ce(i),Fe(i)),{apiBase:i,profile:s,token:t??Be(),insecureStorage:r||ke(),apiBaseSource:o!==void 0?"explicit":a!==void 0?"profile":"default",profileExplicit:u}}emitError(n){process.stderr.write(`${Fn(n)}
-`)}},F=new Set(["--password","-p","--token","-t","--otp","--otp-id","--api-base","--payout-api-base","--browser-base","--input","-i","--claim-token","--claim-url","--api-key","--api-secret"]),Bn=new Set(Array.from(F).filter(e=>e.startsWith("-")&&!e.startsWith("--")&&e.length===2));function kn(e){let n=[];for(let t=0;t<e.length;t+=1){let r=e[t];if(r.startsWith("-")){let i=r.indexOf("=");if(i!==-1){let o=r.slice(0,i);if(F.has(o)){n.push(`${o}=<redacted>`);continue}}}if(F.has(r)){n.push(r),t+1<e.length&&(F.has(e[t+1])||(n.push("<redacted>"),t+=1));continue}if(r.startsWith("-")&&!r.startsWith("--")&&r.length>2&&r[1]!=="="){let i=r.slice(0,2);if(Bn.has(i)){n.push(`${i}<redacted>`);continue}}n.push(r)}return n}var xn=/(token|secret|password|passwd|passphrase|cookie|authorization|bearer|credential|mnemonic|seed|api[_-]?key|apikey|private[_-]?key|privkey|otp|signature|hmac|(?:^|[_-])sig(?:[_-]|$)|session[_-]?id|^input$)/i;function vn(e){let n=e.replace(/([a-z0-9])([A-Z])/g,"$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g,"$1_$2");return xn.test(n)}var Un=/_(removed|cleared|count|total)$/i;function Dn(e,n){return typeof n=="number"&&Un.test(e)}var $n=new Set(Ye);function Gn(e,n){return e==="token_symbol"&&typeof n=="string"&&$n.has(n)}var G=100;function ue(e,n=0){if(n>8)return"<truncated>";if(Array.isArray(e)){let t=e.slice(0,G),r=t.map(i=>ue(i,n+1));return e.length>t.length&&r.push(`<${e.length-t.length} more items truncated>`),r}if(e!==null&&typeof e=="object"){let t=Object.create(null),r=Object.entries(e);for(let[i,o]of r.slice(0,G))t[i]=vn(i)&&!Dn(i,o)&&!Gn(i,o)?"<redacted>":ue(o,n+1);if(r.length>G){let i="<truncated>";for(;i in t;)i=`<${i}>`;t[i]=`${r.length-G} more keys`}return t}return typeof e=="string"?p(e):e}function Fn(e){let n=we()?void 0:2,t=ue(e.toJSON()),r=JSON.stringify(t,null,n);return Buffer.byteLength(r,"utf8")+1<=65536?r:JSON.stringify({error:{code:e.code,message:p(e.message),details:{output_truncated:!0,max_output_bytes:65536}}},null,n)}function Yn(e){if(e.requiresInput===!0)return!0;let n=i=>typeof i=="object"&&i!==null&&i.required===!0,t=e.flags??{},r=e.args??{};return Object.values(t).some(i=>n(i))||Object.values(r).some(i=>n(i))}var Mn=g(require("crypto")),Kn=g(require("fs")),Hn=g(require("path"));var de="cli-1",jn="aScaLe_cli_obf_v1",zn="WWoBD3QEZwECUTEuOD4dTgdWawQSKAQ8UlRaaw==";function Jn(e,n){let t=Buffer.from(e,"base64"),r=Buffer.from(n,"utf8"),i=Buffer.alloc(t.length);for(let o=0;o<t.length;o++)i[o]=t[o]^r[o%r.length];return i.toString("utf8")}var qn=Jn(zn,jn),Xt=`Bearer ${qn}`;function Ke(e,n){let t=z(e);if(t!==null)return n.find(r=>z(r.base)===t)}function He(e){if("f17372513b233456b90621e793c1d0759bce34f8eec3415abc6c2f08270faef2".trim().length>0)return!0;let n=m();if(n.length>0){if(e===void 0||Ke(e,n))return!0;if(S(e)){let r=process.env.ALLSCALE_SIGNING_KEY;return r&&r.trim().length>0?!0:S(n[0].base)}return!1}let t=process.env.ALLSCALE_SIGNING_KEY;return!!(t&&t.trim().length>0)}function je(e){{let r="cli-1".trim();if(r.length>0)return r}let n=m();if(n.length>0){let r=e!==void 0?Ke(e,n):void 0;if(r)return r.keyId;if(e!==void 0&&S(e)){let i=process.env.ALLSCALE_SIGNING_KEY;if(i&&i.trim().length>0){let o=process.env.ALLSCALE_SIGNING_KEY_ID;return o!==void 0?o.trim():de}if(!S(n[0].base))return de}return n[0].keyId}let t=process.env.ALLSCALE_SIGNING_KEY_ID;return t!==void 0?t.trim():de}var Y=class e extends B{static isLocalOnly=!0;static description="Show which API base (if any) this build is bound to, and its signing-key id. Never prints the signing key itself \u2014 only its (non-secret, already-forgeable) id.";static examples=["$ allscale build-info"];static flags={...B.baseFlags};async runCommand(){await this.parse(e);let n=h();return{target:E(),api_base:n===void 0?null:_(n),bound:n!==void 0,signing_key_id:He()?je():null,endpoints:m().map(t=>({base:_(t.base),key_id:t.keyId}))}}};
+  To keep staging, re-run \`allscale device-login\` with --api-base ${""} (recorded as deliberate, silences this).
+  To move to production, run: allscale device-login --api-base ${B}
+`}var y=g(require("fs")),Ye=g(require("os")),de=g(require("path")),pe=g(require("@iarna/toml"));var Yn=".allscale",Mn="config.toml";function Kn(){return de.join(Ye.homedir(),Yn)}function jn(){return de.join(Kn(),Mn)}function Me(){let e=jn();if(!y.existsSync(e))return{};let n=y.readFileSync(e,"utf-8");try{return pe.parse(n)}catch(t){throw new l("internal",`Failed to parse ${e}: ${t.message}`)}}function Ke(e,n){return e.profile?.[n]}function je(e,n,t){let r=n??t??e.default??"default";if(r.includes(":"))throw new l("input.invalid",`Invalid profile name '${r}': ':' is reserved as the keychain namespace separator \u2014 pick a name without ':'.`);return r}function fe(e){if(!q(e))throw new l("input.invalid",`Refusing to send credentials to API base ${A(e)}. `+H)}function He(e){let n=qn(e);if(n)throw new l("input.invalid",n.message)}function Hn(){let e=S();if(e===void 0)return;let n=L();return n.length>0?{endpoints:n.map(t=>t.base),fromPairs:!0}:{endpoints:[e],fromPairs:!1}}function qn(e){let n=Hn();if(n===void 0||b(e))return;let{endpoints:t,fromPairs:r}=n,i=le(e),o=t.map(a=>le(a)).filter(a=>a!==null);if(i!==null&&o.includes(i))return;let s=t.map(a=>A(a)).join(", ");return{message:r?`Refusing to send to ${A(e)} \u2014 this build only signs for: ${s}. Re-login against one of this build's environments, or use a build that includes the one you need.`:`Refusing to send to ${A(e)} \u2014 this build only signs for ${s}. Re-login against this build's environment, or use a build for that one.`}}var zn=require("@noble/hashes/sha3");var qe=["USDT","USDC"];var tr=new Set([`0x${"0".repeat(40)}`,`0x${"0".repeat(36)}dead`]);var Wn="unknown_otp_id",Jn="invalid_code",Vn="expired_code";function Zn(e){return`'${e.replace(/'/g,"'\\''")}'`}function ze(e){return`Run \`allscale otp-send --email ${Zn(e)}\` first \u2014 that command does report a missing account \u2014 then retry with the otp_id it returns and a fresh code.`}var Xn=new Map([[Wn,(e,n)=>`${e}: this environment never issued the --otp-id you passed for '${n}', so the verification code was never the problem. The backend decides this by comparing the otp_id against that address alone, so it says nothing about whether the account exists. ${ze(n)}`],[Jn,e=>`${e}: the --otp-id is one this environment issued and a live code stands behind it \u2014 the verification code you passed is what does not match. Check for a typo \u2014 the backend invalidates the code after a few wrong answers, so if you are unsure, request a fresh code instead of guessing.`],[Vn,(e,n,t)=>t?`${e}: this run's send request was accepted moments ago, but this attempt could not claim a live code for the --otp-id. Delivery is asynchronous and the code is stored only after the email goes out, so it may still be in flight \u2014 or the send may have failed outright, in which case no code is coming. The code you submitted may also have expired, been used, run out of attempts, or been replaced by a newer send. Check the inbox, including spam, and retry with whatever code arrived. If nothing arrives, confirm the address and wait at least three minutes before requesting one fresh code \u2014 sends are rate-limited per address, and retrying in a tight loop spends that budget even when the send is rejected.`:`${e}: this attempt could not claim a live code for the --otp-id. The code you submitted may have expired, been used, run out of attempts, been replaced by a later send, or never have been requested for this address; the backend does not distinguish those. If a newer code was delivered after the one you entered, use that one. ${ze(n)}`]]);var We=[...Xn.keys()];var Je=require("@oclif/core"),m=class e extends _.Command{static enableJsonFlag=!0;static legacyStagingNoticeShown=!1;static emitsOwnOutput=!1;static requiresEscapeHatch=!1;static requiresInput=!1;static isLocalOnly=!1;static baseFlags={profile:_.Flags.string({description:"Named profile from ~/.allscale/config.toml",helpGroup:"GLOBAL"}),token:_.Flags.string({description:"Override the access token for this invocation (precedence: --token > ALLSCALE_TOKEN > --profile)",helpGroup:"GLOBAL",hidden:h()==="public"}),"api-base":_.Flags.string({description:j,helpGroup:"GLOBAL",hidden:h()==="public"}),"insecure-storage":_.Flags.boolean({description:"Force POSIX plaintext token storage at ~/.allscale/credentials.json (mode 0600) instead of the OS keychain \u2014 for headless / CI / agent use. Unavailable on Windows because Node cannot verify owner-only ACL/link safety. Also via ALLSCALE_INSECURE_STORAGE=1.",default:!1,helpGroup:"GLOBAL"})};async run(){try{oe(this.jsonEnabled()),ae(),v({type:"session-start",command:this.id??"",argv:ce(this.argv)});let n=this.constructor;if(h()==="public"){if(this.argv.some(o=>o==="--token"||o.startsWith("--token=")))throw new l("input.invalid","--token is not supported in this build. Set the ALLSCALE_TOKEN environment variable instead (it does not leak into shell history or process listings).");if(this.argv.some(o=>o==="--api-base"||o.startsWith("--api-base=")))throw new l("input.invalid","--api-base is not supported in this build; it always talks to its bound AllScale environment.");if(!n.isLocalOnly&&D()!==void 0)throw new l("input.invalid","ALLSCALE_API_BASE is not supported in this build; unset it \u2014 this build always talks to its bound AllScale environment.")}let t=xe(this.jsonEnabled()),r=this.argv.length===0&&!t&&at(n)?this.config.findCommand(this.id??""):void 0;if(r){P();let o=await(0,_.loadHelpClass)(this.config),s=this.config.pjson.oclif?.helpOptions??this.config.pjson.helpOptions;await new o(this.config,s).showCommandHelp(r,this.config.topics);return}if(n.requiresEscapeHatch&&!Ge())throw this.argv.length>0&&await this.parse(),new l("raw.disabled","This command is an opt-in escape hatch and is disabled by default. Set ALLSCALE_ALLOW_RAW=1 to enable raw GraphQL/REST passthroughs and schema introspection. Access remains governed by the key's granted scopes, which the backend checks on each request.");let i=await this.runCommand();return v({type:"command-end",ok:!0}),P(),n.emitsOwnOutput?void 0:(this.jsonEnabled()||ye(i),{data:i})}catch(n){let t=Le(n);De({code:t.code,message:t.message,exitCode:t.exitCode}),this.emitError(t),process.exitCode=t.exitCode;return}finally{oe(!1)}}resolveSessionApiBaseChain(n){let t=Me(),r=n.profile??void 0,i=n["api-base"]??void 0,o=r!==void 0||ue()!==void 0,s=je(t,r,ue()),a=Ke(t,s),u=h()==="public"&&D()!==void 0,d=i??(u?void 0:D()),E=d??a?.api_base??B,K=Fe({resolvedApiBase:E,fromExplicitOverride:d!==void 0,profileApiBase:a?.api_base,profileApiBaseSource:a?.api_base_source});return K&&!e.legacyStagingNoticeShown&&(e.legacyStagingNoticeShown=!0,C({event:"legacy_staging_profile",api_base:E,profile:s},K)),{apiBase:E,explicitApiBase:d,envApiBaseIgnored:u,profileApiBase:a?.api_base,profile:s,profileExplicit:o}}resolveSessionApiBaseForPayoutDerivation(n){let{apiBase:t}=this.resolveSessionApiBaseChain(n);return this.constructor.isLocalOnly||fe(t),t}resolveContext(n){if(h()==="public"){if(n.token!==void 0)throw new l("input.invalid","--token is not supported in this build. Set the ALLSCALE_TOKEN environment variable instead (it does not leak into shell history or process listings).");if(n["api-base"]!==void 0)throw new l("input.invalid","--api-base is not supported in this build; it always talks to its bound AllScale environment.");if(!this.constructor.isLocalOnly&&D()!==void 0)throw new l("input.invalid","ALLSCALE_API_BASE is not supported in this build; unset it \u2014 this build always talks to its bound AllScale environment.")}let t=n.token??void 0,r=!!n["insecure-storage"],{apiBase:i,explicitApiBase:o,envApiBaseIgnored:s,profile:a,profileApiBase:u,profileExplicit:d}=this.resolveSessionApiBaseChain(n);return this.constructor.isLocalOnly||(fe(i),He(i)),{apiBase:i,profile:a,token:t??Ue(),insecureStorage:r||$e(),apiBaseSource:o!==void 0?"explicit":u!==void 0?"profile":"default",profileExplicit:d,envApiBaseIgnored:s}}emitError(n){process.stderr.write(`${st(n)}
+`)}};var Qn=/_(removed|cleared|count|total)$/i;function et(e,n){return typeof n=="number"&&Qn.test(e)}var nt=new Set(qe);function tt(e,n){return e==="token_symbol"&&typeof n=="string"&&nt.has(n)}var rt=new Set(We);function it(e,n){return e==="otp_reason"&&typeof n=="string"&&rt.has(n)}var F=100;function Y(e,n=0){if(n>8)return"<truncated>";if(Array.isArray(e)){let t=e.slice(0,F),r=t.map(i=>Y(i,n+1));return e.length>t.length&&r.push(`<${e.length-t.length} more items truncated>`),r}if(e!==null&&typeof e=="object"){let t=Object.create(null),r=Object.entries(e);for(let[i,o]of r.slice(0,F))t[i]=Te(i)&&!et(i,o)&&!tt(i,o)&&!it(i,o)?"<redacted>":Y(o,n+1);if(r.length>F){let i="<truncated>";for(;i in t;)i=`<${i}>`;t[i]=`${r.length-F} more keys`}return t}if(typeof e=="string"){let t=ot(e);return t!==void 0?p(JSON.stringify(Y(t,n+1))):p(e)}return e}function ot(e){let n=e.trim();if(!n.startsWith("{")&&!n.startsWith("["))return;let t;try{t=JSON.parse(n)}catch{return}return t!==null&&typeof t=="object"?t:void 0}function st(e){let n=Ne()?void 0:2,t=Y(e.toJSON()),r=JSON.stringify(t,null,n);return Buffer.byteLength(r,"utf8")+1<=65536?r:JSON.stringify({error:{code:e.code,message:p(e.message),details:{output_truncated:!0,max_output_bytes:65536}}},null,n)}function at(e){if(e.requiresInput===!0)return!0;let n=i=>typeof i=="object"&&i!==null&&i.required===!0,t=e.flags??{},r=e.args??{};return Object.values(t).some(i=>n(i))||Object.values(r).some(i=>n(i))}var ct=g(require("crypto")),lt=g(require("fs")),ut=g(require("path"));var ge="cli-1",dt="aScaLe_cli_obf_v1",pt="WWoBD3QEZwECUTEuOD4dTgdWawQSKAQ8UlRaaw==";function ft(e,n){let t=Buffer.from(e,"base64"),r=Buffer.from(n,"utf8"),i=Buffer.alloc(t.length);for(let o=0;o<t.length;o++)i[o]=t[o]^r[o%r.length];return i.toString("utf8")}var gt=ft(pt,dt),yr=`Bearer ${gt}`;function Ve(e,n){let t=W(e);if(t!==null)return n.find(r=>W(r.base)===t)}function Ze(e){if("f17372513b233456b90621e793c1d0759bce34f8eec3415abc6c2f08270faef2".trim().length>0)return!0;let n=L();if(n.length>0){if(e===void 0||Ve(e,n))return!0;if(b(e)){let r=process.env.ALLSCALE_SIGNING_KEY;return r&&r.trim().length>0?!0:b(n[0].base)}return!1}let t=process.env.ALLSCALE_SIGNING_KEY;return!!(t&&t.trim().length>0)}function Xe(e){{let r="cli-1".trim();if(r.length>0)return r}let n=L();if(n.length>0){let r=e!==void 0?Ve(e,n):void 0;if(r)return r.keyId;if(e!==void 0&&b(e)){let i=process.env.ALLSCALE_SIGNING_KEY;if(i&&i.trim().length>0){let o=process.env.ALLSCALE_SIGNING_KEY_ID;return o!==void 0?o.trim():ge}if(!b(n[0].base))return ge}return n[0].keyId}let t=process.env.ALLSCALE_SIGNING_KEY_ID;return t!==void 0?t.trim():ge}var M=class e extends m{static isLocalOnly=!0;static description="Show which API base (if any) this build is bound to, and its signing-key id. Never prints the signing key itself \u2014 only its non-secret id.";static examples=["$ allscale build-info"];static flags={...m.baseFlags,profile:{...m.baseFlags.profile,hidden:!0},token:{...m.baseFlags.token,hidden:!0},"api-base":{...m.baseFlags["api-base"],hidden:!0}};async runCommand(){let{flags:n}=await this.parse(e),t=["profile","token","api-base"].filter(i=>n[i]!==void 0).map(i=>`--${i}`);if(t.length>0)throw new l("input.invalid",`${t.join(", ")} cannot be used with build-info. This command reports offline artifact metadata only and does not load or validate profiles, tokens, or API bases.`);let r=S();return{target:h(),api_base:r===void 0?null:A(r),bound:r!==void 0,signing_key_id:Ze()?Xe():null,endpoints:L().map(i=>({base:A(i.base),key_id:i.keyId}))}}};
 //# sourceMappingURL=build-info.js.map