@apilift/cli 1.5.15 → 1.6.1-dev.1793190001.48d047bc92bb2c8a02f67d83be4995c1e0cee871

package/dist/apilift-capture-server.js

@@ -19917,7 +19917,7 @@ function windowsProcessStart(pid) {
 
 // src/capture-server/store.ts
 import { randomUUID, createHash } from "node:crypto";
-import { mkdirSync, chmodSync, readFileSync as readFileSync2 } from "node:fs";
+import { constants, mkdirSync, chmodSync, readFileSync as readFileSync2, openSync, closeSync, readSync, writeSync, ftruncateSync, fsyncSync, statSync, rmSync } from "node:fs";
 import { join as join2 } from "node:path";
 import { execFileSync } from "node:child_process";
 import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
@@ -20003,6 +20003,7 @@ function inspectOwner(pid, expectedStartedAt, probe) {
 }
 var CaptureStore = class {
   constructor(root, clock = Date.now, alive = ownerProcessAlive) {
+    this.root = root;
     this.clock = clock;
     this.alive = alive;
     mkdirSync(root, { recursive: true, mode: 448 });
@@ -20024,6 +20025,7 @@ var CaptureStore = class {
         CREATE TABLE IF NOT EXISTS bridge_status (id INTEGER PRIMARY KEY CHECK(id=1), version TEXT NOT NULL, updated_at REAL NOT NULL);
         CREATE TABLE IF NOT EXISTS blobs (scope_id TEXT NOT NULL REFERENCES scopes(id) ON DELETE CASCADE, digest TEXT NOT NULL, recording TEXT, job_id TEXT, bytes INTEGER NOT NULL, data BLOB NOT NULL, complete INTEGER NOT NULL, PRIMARY KEY(scope_id,digest));
       `);
+      if (!this.db.prepare("PRAGMA table_info(blobs)").all().some((column) => column.name === "stored_bytes")) this.db.exec("ALTER TABLE blobs ADD COLUMN stored_bytes INTEGER");
       if (!hadCandidates) this.db.exec(`INSERT INTO capture_candidates (scope_id,seq,capture_id,entry_json) SELECT e.scope_id,g.first_seq,g.capture_id,e.entry_json FROM capture_entries e JOIN (SELECT scope_id,COALESCE(json_extract(entry_json,'$.captureId'),CAST(seq AS TEXT)) AS capture_id,MIN(seq) AS first_seq,MAX(seq) AS last_seq FROM capture_entries GROUP BY scope_id,capture_id) g ON e.scope_id=g.scope_id AND e.seq=g.last_seq`);
       const columns = this.db.prepare("PRAGMA table_info(scopes)").all();
       if (!columns.some((column) => column.name === "owner_session")) this.db.exec("ALTER TABLE scopes ADD COLUMN owner_session TEXT");
@@ -20074,7 +20076,7 @@ var CaptureStore = class {
     if (capture?.kind === "capture" && this.db.prepare("SELECT 1 FROM capture_candidates WHERE scope_id=? LIMIT 1").get(id2)) {
       this.db.prepare("UPDATE scopes SET window_json=NULL WHERE id=?").run(id2);
       this.retainScope(id2);
-    } else this.db.prepare("DELETE FROM scopes WHERE id=?").run(id2);
+    } else this.closeScope(id2);
     this.emit();
   }
   row(id2, freshOwner = false) {
@@ -20136,8 +20138,15 @@ var CaptureStore = class {
   }
   closeScope(id2) {
     this.db.prepare("DELETE FROM scopes WHERE id=?").run(id2);
+    rmSync(join2(this.root, "bodies", createHash("sha256").update(id2).digest("hex")), { recursive: true, force: true });
     this.emit();
   }
+  bodyPath(scopeId, digest) {
+    if (!/^[0-9a-f]{64}$/.test(digest)) throw new CaptureError("blob-invalid", "Body digest is invalid");
+    const directory = join2(this.root, "bodies", createHash("sha256").update(scopeId).digest("hex"));
+    mkdirSync(directory, { recursive: true, mode: 448 });
+    return join2(directory, digest);
+  }
   scopes() {
     this.prune();
     const rows = this.db.prepare("SELECT id,kind,page_origin,tab_selector,start_url,binding_mode,lease_id,expires_at,activated_at,ack_through,window_json,owner_session FROM scopes WHERE retained_at IS NULL ORDER BY activated_at").all();
@@ -20150,8 +20159,8 @@ var CaptureStore = class {
   blob(scopeId, digest) {
     const scope2 = this.row(scopeId);
     if (!/^[0-9a-f]{64}$/.test(digest)) throw new CaptureError("blob-invalid", "Selected body digest is invalid");
-    const held = this.db.prepare("SELECT data,complete FROM blobs WHERE scope_id=? AND digest=?").get(scopeId, digest);
-    if (held?.complete) return Buffer.from(held.data);
+    const held = this.db.prepare("SELECT data,complete,stored_bytes FROM blobs WHERE scope_id=? AND digest=?").get(scopeId, digest);
+    if (held?.complete) return held.stored_bytes === null ? Buffer.from(held.data) : readFileSync2(this.bodyPath(scopeId, digest));
     if (scope2.retained_at !== null && this.clock() > Number(scope2.retained_at) + 2e4) throw new CaptureError("blob-unavailable", "Recorded body delivery did not complete within its collection deadline");
     return null;
   }
@@ -20297,15 +20306,47 @@ var CaptureStore = class {
         if (Boolean(request2.payload.recording) === Boolean(request2.payload.jobId)) throw new CaptureError("blob-owner", "Body chunk must identify exactly one recording or job");
         const chunk = Buffer.from(request2.payload.dataBase64, "base64");
         if (createHash("sha256").update(chunk).digest("hex") !== request2.payload.chunkSha256) throw new CaptureError("blob-integrity", "Body chunk checksum does not match");
-        const held = this.db.prepare("SELECT data,bytes,complete FROM blobs WHERE scope_id=? AND digest=?").get(scopeId, request2.payload.sha256);
-        const previous = held ? Buffer.from(held.data) : Buffer.alloc(0);
+        const held = this.db.prepare("SELECT bytes,complete,stored_bytes,length(data) AS legacy_bytes FROM blobs WHERE scope_id=? AND digest=?").get(scopeId, request2.payload.sha256);
+        const offset = held ? held.stored_bytes ?? held.legacy_bytes : 0;
+        if (held && held.bytes !== request2.payload.bytes) throw new CaptureError("blob-integrity", "Body length changed during transfer");
         if (held?.complete) return { offset: held.bytes, complete: true };
-        if (request2.payload.offset !== previous.length) throw new CaptureError("blob-offset", "Body chunk offset does not match persisted bytes");
-        if (request2.payload.bytes > 48 * 1024 * 1024 || previous.length + chunk.length > request2.payload.bytes) throw new CaptureError("blob-limit", "Body exceeds the capture limit");
-        const data = Buffer.concat([previous, chunk]), complete = data.length === request2.payload.bytes;
-        if (complete && createHash("sha256").update(data).digest("hex") !== request2.payload.sha256) throw new CaptureError("blob-integrity", "Body checksum does not match");
-        this.db.prepare("INSERT INTO blobs (scope_id,digest,recording,job_id,bytes,data,complete) VALUES (?,?,?,?,?,?,?) ON CONFLICT(scope_id,digest) DO UPDATE SET data=excluded.data,complete=excluded.complete").run(scopeId, request2.payload.sha256, request2.payload.recording ?? null, request2.payload.jobId ?? null, request2.payload.bytes, data, complete ? 1 : 0);
-        return { offset: data.length, complete };
+        if (request2.payload.offset < offset) return { offset, complete: false };
+        if (request2.payload.offset !== offset) throw new CaptureError("blob-offset", "Body chunk offset does not match persisted bytes");
+        if (request2.payload.bytes > 48 * 1024 * 1024 || offset + chunk.length > request2.payload.bytes) throw new CaptureError("blob-limit", "Body exceeds the capture limit");
+        const path = this.bodyPath(scopeId, request2.payload.sha256);
+        const fd = openSync(path, constants.O_RDWR | constants.O_CREAT, 384);
+        const next = offset + chunk.length, complete = next === request2.payload.bytes;
+        const writeAt = (data, position) => {
+          for (let written = 0; written < data.length; ) {
+            const count = writeSync(fd, data, written, data.length - written, position + written);
+            if (!count) throw new CaptureError("blob-write", "Body storage made no progress");
+            written += count;
+          }
+        };
+        try {
+          if (held && held.stored_bytes === null) {
+            const legacy = this.db.prepare("SELECT data FROM blobs WHERE scope_id=? AND digest=?").get(scopeId, request2.payload.sha256);
+            ftruncateSync(fd, 0);
+            writeAt(legacy.data, 0);
+          } else if (statSync(path).size < offset) throw new CaptureError("blob-integrity", "Persisted body bytes are missing");
+          ftruncateSync(fd, offset);
+          writeAt(chunk, offset);
+          fsyncSync(fd);
+          if (complete) {
+            const hash3 = createHash("sha256"), buffer = Buffer.allocUnsafe(64 * 1024);
+            for (let position = 0; position < next; ) {
+              const bytes = readSync(fd, buffer, 0, Math.min(buffer.length, next - position), position);
+              if (!bytes) throw new CaptureError("blob-integrity", "Persisted body is incomplete");
+              hash3.update(buffer.subarray(0, bytes));
+              position += bytes;
+            }
+            if (hash3.digest("hex") !== request2.payload.sha256) throw new CaptureError("blob-integrity", "Body checksum does not match");
+          }
+        } finally {
+          closeSync(fd);
+        }
+        this.db.prepare("INSERT INTO blobs (scope_id,digest,recording,job_id,bytes,data,complete,stored_bytes) VALUES (?,?,?,?,?,X'',?,?) ON CONFLICT(scope_id,digest) DO UPDATE SET data=X'',complete=excluded.complete,stored_bytes=excluded.stored_bytes").run(scopeId, request2.payload.sha256, request2.payload.recording ?? null, request2.payload.jobId ?? null, request2.payload.bytes, complete ? 1 : 0, next);
+        return { offset: next, complete };
       }
       case "jobs.poll": {
         const job = this.db.prepare("SELECT id,envelope_json FROM jobs WHERE scope_id=? AND status='queued' ORDER BY created_at LIMIT 1").get(scopeId);

package/dist/apilift-collector.js

@@ -28273,8 +28273,8 @@ var init_contracts = __esm({
     setupStatus = external_exports.strictObject({ linkCode: external_exports.strictObject({ id: uuid5, agent: knownAgent.nullable(), status: external_exports.enum(["pending", "claimed", "expired"]), expiresAt: iso, installationId: uuid5.nullable() }).nullable(), installation: external_exports.strictObject({ id: uuid5, label: str, readiness, steps: data, agents: external_exports.array(knownAgent) }).nullable() });
     actionSummary = external_exports.strictObject({ name: str, title: str, summary: external_exports.string(), effect: external_exports.enum(["read", "create", "update", "delete"]).optional(), availability: external_exports.enum(["executable", "unavailable"]), policy: external_exports.enum(["approve", "deny", "disable"]), health: data, documentation: data.optional() });
     actionDocumentation = external_exports.strictObject({ name: str, title: str, description: external_exports.string(), effect: external_exports.enum(["read", "create", "update", "delete"]).optional(), availability: external_exports.enum(["executable", "unavailable"]), inputs: jsonSchema, output: jsonSchema.optional(), proof: external_exports.enum(["readback", "absence"]).optional(), unavailable: external_exports.strictObject({ reason: str, evidence: str }).optional(), transport: external_exports.strictObject({ name: str, mode: external_exports.enum(["direct", "browser"]), instructions: str, credentials: external_exports.array(external_exports.strictObject({ name: str, header: str })) }).optional(), version: external_exports.number().int().positive(), executableHash: hash2.optional(), policy: external_exports.enum(["approve", "deny", "disable"]), health: data });
-    bundle = external_exports.strictObject({ receipt: external_exports.strictObject({ id: uuid5, dispatchBefore: iso }).optional(), decision: external_exports.literal("allow"), app: external_exports.strictObject({ id: uuid5, slug: str, visibility: external_exports.enum(["public", "private"]) }), action: external_exports.strictObject({ name: str, effect: external_exports.enum(["read", "create", "update", "delete"]) }), closure: external_exports.strictObject({ hash: hash2, status: external_exports.enum(["pending", "validated"]), workspaceStatus: external_exports.literal("successful").nullable(), versions: external_exports.array(external_exports.strictObject({ kind: resourceKindSchema, name: str, version: external_exports.number().int().positive(), executableHash: hash2, definition })) }), selection: external_exports.strictObject({ channel: external_exports.enum(["latest", "validated"]), fallback: external_exports.boolean(), replaced: external_exports.strictObject({ closureHash: hash2, reason: str, until: iso.optional() }).optional() }), policy: external_exports.literal("approve") });
-    resourceRead = external_exports.strictObject({ ...kindName.shape, definition, version: external_exports.number().int().positive(), executableHash: hash2.optional(), verification: data.optional(), dependents: external_exports.array(kindName).optional() });
+    bundle = external_exports.strictObject({ receipt: external_exports.strictObject({ id: uuid5, dispatchBefore: iso }).optional(), decision: external_exports.literal("allow"), app: external_exports.strictObject({ id: uuid5, slug: str, visibility: external_exports.enum(["public", "private"]) }), action: external_exports.strictObject({ name: str, effect: external_exports.enum(["read", "create", "update", "delete"]) }), closure: external_exports.strictObject({ hash: hash2, status: external_exports.enum(["pending", "validated"]), workspaceStatus: external_exports.literal("successful").nullable(), versions: external_exports.array(external_exports.strictObject({ kind: resourceKindSchema, name: str, version: external_exports.number().int().positive(), executableHash: hash2, versionId: uuid5.optional(), definition: definition.optional() })) }), selection: external_exports.strictObject({ channel: external_exports.enum(["latest", "validated"]), fallback: external_exports.boolean(), replaced: external_exports.strictObject({ closureHash: hash2, reason: str, until: iso.optional() }).optional() }), policy: external_exports.literal("approve") });
+    resourceRead = external_exports.strictObject({ ...kindName.shape, definition, version: external_exports.number().int().positive(), executableHash: hash2.optional(), verification: data.optional(), dependents: external_exports.array(kindName).optional(), nextDependentsCursor: external_exports.string().nullable().optional() });
     resourceRequirements = external_exports.strictObject({ legacyCredentialContract: str.optional(), credentialContract: str.optional(), destinations: external_exports.array(str).optional(), name: str, title: str, mode: external_exports.enum(["direct", "browser"]), instructions: str, credentials: external_exports.array(external_exports.strictObject({ name: str, header: str, prefix: external_exports.string().optional() })) });
     safetyReview = external_exports.union([external_exports.strictObject({ access: external_exports.literal("locked") }), external_exports.strictObject({ access: external_exports.literal("included"), state: external_exports.enum(["missing", "checking", "ready", "unavailable"]), route: str, findings: data.optional(), checkedAt: iso.optional(), stale: external_exports.boolean().optional(), message: external_exports.string().optional() })]);
     billing = external_exports.strictObject({ workspaceId: uuid5, paddleCustomerId: str.optional(), entitlement, trial: external_exports.strictObject({ status: external_exports.enum(["active", "ended", "converted"]), startedAt: iso, endsAt: iso, completedAt: iso.optional() }).optional(), subscription: external_exports.strictObject({ id: str, status: str, plan: str, interval: str, currency: str, currentPeriod: external_exports.strictObject({ startsAt: iso, endsAt: iso }), nextBilledAt: iso.optional(), graceEndsAt: iso.optional(), scheduledChange: data.optional() }).optional(), usage: data.optional(), checkout: external_exports.strictObject({ status: external_exports.enum(["pending", "unknown"]), transactionId: str.optional() }).optional(), checkoutAvailable: external_exports.boolean(), paddle: external_exports.strictObject({ environment: external_exports.enum(["sandbox", "production"]), clientToken: str }) });
@@ -28298,12 +28298,12 @@ var init_contracts = __esm({
       releaseSession: apiContract("DELETE", "/api/v1/sessions/{id}", "installation", external_exports.strictObject({ id: str }), external_exports.strictObject({ appId: uuid5.optional(), purpose: external_exports.literal("execution").optional() }).refine((v2) => Boolean(v2.appId) === Boolean(v2.purpose), "appId and purpose must be supplied together"), noBody, data),
       listApps: apiContract("GET", "/api/v1/apps", "installation-or-cookie", noParams, external_exports.strictObject({ q: external_exports.string().max(200).optional(), domain: str.optional(), category: categorySchema.optional(), visibility: external_exports.enum(["public", "private", "all"]).optional(), ids: str.optional(), ...pageQuery }), noBody, page(appItem)),
       createApp: apiContract("POST", "/api/v1/apps", "installation", noParams, noQuery, external_exports.strictObject({ requestId: uuid5, slug: str, visibility: external_exports.enum(["public", "private"]).optional(), definition: appDefinitionSchema }), data, ["slug-taken"]),
-      getApp: apiContract("GET", "/api/v1/apps/{app}", "installation-or-cookie", path, noQuery, noBody, appItem.extend({ about: external_exports.string().optional(), safety: data.optional(), entities: external_exports.array(data), transports: external_exports.array(data) })),
+      getApp: apiContract("GET", "/api/v1/apps/{app}", "installation-or-cookie", path, external_exports.strictObject({ entity: str.optional(), entityCursor: str.optional(), transportCursor: str.optional(), limit: pageQuery.limit }), noBody, appItem.extend({ about: external_exports.string().optional(), safety: data.optional(), entities: external_exports.array(data), transports: external_exports.array(data), nextEntityCursor: str.nullable().optional(), nextTransportCursor: str.nullable().optional() })),
       listActions: apiContract("GET", "/api/v1/apps/{app}/actions", "installation-or-cookie", path, external_exports.strictObject({ entity: str.optional(), q: external_exports.string().max(200).optional(), names: str.optional(), include: external_exports.literal("documentation").optional(), ...pageQuery }), noBody, page(actionSummary)),
       getAction: apiContract("GET", "/api/v1/apps/{app}/actions/{action}", "installation-or-cookie", actionPath, external_exports.strictObject({ include: external_exports.literal("schemas").optional() }), noBody, actionDocumentation),
-      getBundle: apiContract("GET", "/api/v1/apps/{app}/actions/{action}/bundle", "installation", actionPath, noQuery, noBody, bundle, ["session-limit", "action-withheld", "action-disabled", "action-denied", "action-unavailable"]),
-      listResources: apiContract("GET", "/api/v1/apps/{app}/resources", "installation", path, external_exports.strictObject({ kind: resourceKindSchema.optional(), names: str.optional() }), noBody, page(external_exports.strictObject({ ...kindName.shape, version: external_exports.number().int().positive(), executableHash: hash2.optional(), updatedAt: iso }))),
-      getResource: apiContract("GET", "/api/v1/apps/{app}/resources/{kind}/{name}", "installation-or-cookie", resourcePath, external_exports.strictObject({ view: external_exports.literal("requirements").optional() }), noBody, external_exports.union([resourceRead, resourceRequirements])),
+      getBundle: apiContract("GET", "/api/v1/apps/{app}/actions/{action}/bundle", "installation", actionPath, external_exports.strictObject({ knownVersions: external_exports.string().max(120).optional() }), noBody, bundle, ["session-limit", "action-withheld", "action-disabled", "action-denied", "action-unavailable"]),
+      listResources: apiContract("GET", "/api/v1/apps/{app}/resources", "installation", path, external_exports.strictObject({ kind: resourceKindSchema.optional(), names: str.optional(), ...pageQuery }), noBody, page(external_exports.strictObject({ ...kindName.shape, version: external_exports.number().int().positive(), executableHash: hash2.optional(), updatedAt: iso }))),
+      getResource: apiContract("GET", "/api/v1/apps/{app}/resources/{kind}/{name}", "installation-or-cookie", resourcePath, external_exports.strictObject({ view: external_exports.literal("requirements").optional(), dependentsCursor: external_exports.string().optional() }), noBody, external_exports.union([resourceRead, resourceRequirements])),
       publishResource: apiContract("PUT", "/api/v1/apps/{app}/resources/{kind}/{name}", "installation", resourcePath, noQuery, external_exports.union([external_exports.strictObject({ requestId: uuid5, expectedVersion: external_exports.number().int().positive().nullable(), definition, verification: data.optional() }), external_exports.strictObject({ requestId: uuid5, expectedVersion: external_exports.number().int().positive(), remove: external_exports.literal(true) })]), external_exports.strictObject({ resource: external_exports.strictObject({ ...kindName.shape, version: external_exports.number().int().positive() }), executableHash: hash2.optional(), closureHash: hash2.optional(), distribution: external_exports.strictObject({ state: external_exports.enum(["available", "testing", "queued", "paused"]), reason: str.optional(), until: iso.optional() }).optional() }), ["definition-invalid", "documentation-incomplete", "reference-unresolved", "reference-cycle", "verification-incomplete", "verification-stale", "version-conflict"]),
       listChanges: apiContract("GET", "/api/v1/apps/{app}/changes", "installation-or-cookie", path, external_exports.strictObject({ resource: str.optional(), ...pageQuery }), noBody, page(external_exports.strictObject({ change: external_exports.number().int().positive(), kind: resourceKindSchema, name: str, version: external_exports.number().int().positive(), event: external_exports.enum(["published", "removed"]), distribution: external_exports.strictObject({ state: external_exports.enum(["available", "testing", "queued", "paused"]), reason: str.optional(), until: iso.optional() }).optional(), publishedAt: iso }))),
       safetyReview: apiContract("GET", "/api/v1/apps/{app}/safety-review", "cookie", path, noQuery, noBody, safetyReview),
@@ -28382,6 +28382,34 @@ var init_version = __esm({
   }
 });
 
+// src/execution-reports.ts
+async function flushExecutionReports(api2, state, budgetMs = 1e4) {
+  const pending = state.pendingExecutionReports();
+  if (!pending.length) return;
+  const controller = new AbortController();
+  let timer;
+  try {
+    const acknowledgment = await Promise.race([
+      api2.call("postExecutions", { body: { reports: pending.map((item) => item.report) }, signal: controller.signal }),
+      new Promise((_, reject) => {
+        timer = setTimeout(() => {
+          controller.abort();
+          reject(new Error("Report delivery deferred"));
+        }, budgetMs);
+      })
+    ]);
+    state.acknowledgeExecutionReports(acknowledgment.results.map((item) => item.id));
+  } catch {
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var init_execution_reports = __esm({
+  "src/execution-reports.ts"() {
+    "use strict";
+  }
+});
+
 // src/api.ts
 function retryDelay(response, attempt) {
   const value = response.headers.get("retry-after");
@@ -28400,7 +28428,7 @@ function createCliApi(baseUrl, fetcher = fetch, token, sessionId) {
   const transport = async (input2, init) => {
     const method = init?.method ?? "GET";
     const headers = new Headers(init?.headers);
-    headers.set("Apilift-Capabilities", "distributed-rollouts-v1,discovery-proof-v2,dynamic-bindings-v1,collection-proof-v3,web-responses-v1");
+    headers.set("Apilift-Capabilities", "distributed-rollouts-v1,discovery-proof-v2,dynamic-bindings-v1,collection-proof-v3,web-responses-v1,bounded-catalog-v1");
     headers.set("Apilift-Client", `cli/${cliVersion}`);
     if (token) headers.set("Authorization", `Bearer ${token}`);
     if (sessionId) headers.set("Apilift-Session", sessionId);
@@ -28429,7 +28457,7 @@ function createCliApi(baseUrl, fetcher = fetch, token, sessionId) {
       }
     }
   };
-  return createApiClient(baseUrl, transport);
+  return Object.assign(createApiClient(baseUrl, transport), { cacheNamespace: baseUrl });
 }
 var retryStatuses, ApiDeliveryUncertainError, ApiReadUnavailableError;
 var init_api3 = __esm({
@@ -28453,34 +28481,6 @@ var init_api3 = __esm({
   }
 });
 
-// src/execution-reports.ts
-async function flushExecutionReports(api2, state, budgetMs = 1e4) {
-  const pending = state.pendingExecutionReports();
-  if (!pending.length) return;
-  const controller = new AbortController();
-  let timer;
-  try {
-    const acknowledgment = await Promise.race([
-      api2.call("postExecutions", { body: { reports: pending.map((item) => item.report) }, signal: controller.signal }),
-      new Promise((_, reject) => {
-        timer = setTimeout(() => {
-          controller.abort();
-          reject(new Error("Report delivery deferred"));
-        }, budgetMs);
-      })
-    ]);
-    state.acknowledgeExecutionReports(acknowledgment.results.map((item) => item.id));
-  } catch {
-  } finally {
-    clearTimeout(timer);
-  }
-}
-var init_execution_reports = __esm({
-  "src/execution-reports.ts"() {
-    "use strict";
-  }
-});
-
 // src/usage/baselines.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { chmodSync as chmodSync4, mkdirSync as mkdirSync4, writeFileSync as writeFileSync3 } from "node:fs";
@@ -28589,7 +28589,7 @@ var init_receipts = __esm({
 });
 
 // src/usage/transcript.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { closeSync, openSync, readSync, readdirSync, statSync as statSync2 } from "node:fs";
 import { homedir as homedir2, platform as platform2 } from "node:os";
 import { basename, join as join5 } from "node:path";
@@ -28676,7 +28676,7 @@ function commandIdentity(command) {
   let argv = words.slice(index + 1);
   if (argv[0] === "--session") argv = argv.slice(2);
   if (!argv.length) return null;
-  return { key: argv.slice(0, 3).join(" "), argumentHash: createHash2("sha256").update(JSON.stringify(argv)).digest("hex") };
+  return { key: argv.slice(0, 3).join(" "), argumentHash: createHash4("sha256").update(JSON.stringify(argv)).digest("hex") };
 }
 function commandKey(command) {
   return commandIdentity(command)?.key ?? null;
@@ -28776,7 +28776,7 @@ var init_transcript = __esm({
       provider = null;
       thread = null;
       lastAt = null;
-      hash = createHash2("sha256");
+      hash = createHash4("sha256");
       head = Buffer.alloc(0);
       tail = Buffer.alloc(0);
       bytes(bytes) {
@@ -29009,8 +29009,8 @@ var init_transcript = __esm({
         }
         this.facts.records.sort((a, b2) => (a.startedAt ?? Infinity) - (b2.startedAt ?? Infinity));
         this.facts.sourceHash = this.hash.digest("hex");
-        this.facts.headHash = createHash2("sha256").update(this.head).digest("hex");
-        this.facts.tailHash = createHash2("sha256").update(this.tail).digest("hex");
+        this.facts.headHash = createHash4("sha256").update(this.head).digest("hex");
+        this.facts.tailHash = createHash4("sha256").update(this.tail).digest("hex");
         return this.facts;
       }
     };
@@ -163682,7 +163682,7 @@ var init_pricing = __esm({
 });
 
 // src/usage/measurement.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import { readFileSync as readFileSync3 } from "node:fs";
 function largestRemainder(total, weights) {
   const positive = weights.map((v2) => Math.max(0, Math.floor(v2))), sum = positive.reduce((a, b2) => a + b2, 0);
@@ -163748,7 +163748,7 @@ function matchesCommand(row, tool) {
     return false;
   }
   const expected = argv[0] === "--session" ? argv.slice(2) : argv;
-  return tool.category === "apilift" && tool.argumentHash === createHash3("sha256").update(JSON.stringify(expected)).digest("hex");
+  return tool.category === "apilift" && tool.argumentHash === createHash5("sha256").update(JSON.stringify(expected)).digest("hex");
 }
 function invocationMatches(row, facts) {
   if (row.agent !== facts.runtime || row.session_id && !row.session_id.includes(":label:") && facts.sessionId && row.session_id !== `${facts.runtime}:${facts.sessionId}`) return [];
@@ -163968,7 +163968,7 @@ __export(collector_exports, {
   reconcilePending: () => reconcilePending
 });
 import { rmSync as rmSync2, statSync as statSync3 } from "node:fs";
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 function hasPendingUsage(ledger) {
   if (ledger.db.prepare("SELECT count(*) AS n FROM invocation WHERE output_path IS NOT NULL OR (execution_id IS NOT NULL AND status='pending')").get().n) return true;
   if (!ledger.db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='baseline_candidate'").get()) return false;
@@ -164062,9 +164062,9 @@ async function deliverPending(ledger, state, site, fetcher = fetch, now = Date.n
   if (!installation) return;
   const cutoff = new Date(now - 7 * 864e5).toISOString();
   ledger.db.prepare("UPDATE baseline_candidate SET status='rejected' WHERE status='pending' AND stopped_at IS NOT NULL AND stopped_at<?").run(cutoff);
-  const rows = ledger.pendingMeasurement(now);
   const baselines = new BaselineStore(ledger);
-  const baselineRows = baselines.rows().filter((row) => row.measurement_json && row.status === "pending" && row.next_attempt_at <= now).slice(0, Math.max(0, 100 - rows.length));
+  const baselineRows = baselines.rows().filter((row) => row.measurement_json && row.status === "pending" && row.next_attempt_at <= now).slice(0, 100);
+  const rows = ledger.pendingMeasurement(now, 100 - baselineRows.length);
   if (!rows.length && !baselineRows.length) return;
   const executions = rows.flatMap((row) => {
     try {
@@ -164158,6 +164158,10 @@ var init_collector = __esm({
         }
         let entry = rootScans.get(path2);
         if (!entry || entry.inode !== stat.ino || stat.size < entry.reader.offset || entry.facts && (entry.size !== stat.size || entry.mtime !== stat.mtimeMs)) {
+          if (this.remaining <= 0) {
+            this.deferred = true;
+            return null;
+          }
           entry = { reader: new TranscriptRead(path2, tokenCount), size: stat.size, mtime: stat.mtimeMs, inode: stat.ino, facts: null };
           rootScans.set(path2, entry);
           if (rootScans.size > 64) rootScans.delete(rootScans.keys().next().value);
@@ -164183,7 +164187,7 @@ var init_collector = __esm({
           entry.mtime = stat.mtimeMs;
         }
         const facts = entry.facts;
-        const pathHash = createHash4("sha256").update(path2).digest("hex");
+        const pathHash = createHash6("sha256").update(path2).digest("hex");
         const previous = this.ledger.db.prepare("SELECT source_hash,head_hash,bytes,gap FROM source_observation WHERE path_hash=?").get(pathHash);
         if (previous) {
           const replaced = facts.bytes < previous.bytes || facts.bytes === previous.bytes && facts.sourceHash !== previous.source_hash || previous.head_hash !== null && previous.bytes >= 4096 && facts.headHash !== previous.head_hash;
@@ -164249,7 +164253,7 @@ init_ledger();
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/analytics.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { createHash as createHash3, randomUUID as randomUUID3 } from "node:crypto";
 
 // ../../packages/core/dist/analytics/index.js
 var eventProperties = {
@@ -164347,7 +164351,87 @@ function scrubEventProperties(event, input2) {
 
 // src/analytics.ts
 init_api2();
-init_api3();
+
+// src/identity-cache.ts
+init_api2();
+init_version();
+import { createHash as createHash2 } from "node:crypto";
+var freshMs = 3e5;
+var retainedMs = 864e5;
+var IdentityCache = class {
+  constructor(state, site, fetcher = fetch) {
+    this.state = state;
+    this.site = site;
+    this.fetcher = fetcher;
+    state.db.exec("CREATE TABLE IF NOT EXISTS registry_identity_cache (key TEXT PRIMARY KEY, value TEXT, fetched_at INTEGER NOT NULL DEFAULT 0, lease_until INTEGER NOT NULL DEFAULT 0, retry_at INTEGER NOT NULL DEFAULT 0, failures INTEGER NOT NULL DEFAULT 0, readiness_at INTEGER NOT NULL DEFAULT 0)");
+  }
+  key() {
+    const installation = this.state.installation();
+    return installation ? createHash2("sha256").update(JSON.stringify([this.site, installation])).digest("hex") : null;
+  }
+  fetchedAt() {
+    const key = this.key();
+    if (!key) return 0;
+    return Number(this.state.db.prepare("SELECT fetched_at FROM registry_identity_cache WHERE key=?").get(key)?.fetched_at ?? 0);
+  }
+  peek(now = Date.now()) {
+    const key = this.key();
+    if (!key) return null;
+    const row = this.state.db.prepare("SELECT value,fetched_at FROM registry_identity_cache WHERE key=?").get(key);
+    if (!row?.value || now - row.fetched_at >= retainedMs) return null;
+    try {
+      return JSON.parse(row.value);
+    } catch {
+      return null;
+    }
+  }
+  async read(now = Date.now(), active = () => true) {
+    const key = this.key(), installation = this.state.installation();
+    if (!key || !installation) return null;
+    this.state.db.prepare("INSERT OR IGNORE INTO registry_identity_cache(key) VALUES (?)").run(key);
+    const owned = this.state.db.prepare("UPDATE registry_identity_cache SET lease_until=? WHERE key=? AND lease_until<=? AND retry_at<=? AND fetched_at<=? RETURNING key").get(now + 1e4, key, now, now, now - freshMs);
+    if (!owned) return this.peek(now);
+    let timer;
+    try {
+      const signal = AbortSignal.timeout(2e3);
+      const api2 = createApiClient(this.site, (input2, init) => {
+        const headers = new Headers(init?.headers);
+        headers.set("Authorization", `Bearer ${installation.token}`);
+        headers.set("Apilift-Client", `cli/${cliVersion}`);
+        return this.fetcher(input2, { ...init, headers, signal });
+      });
+      const me3 = await Promise.race([api2.call("me"), new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error("identity-timeout")), 2500);
+      })]);
+      if (!active() || this.key() !== key) return null;
+      if (me3.installation.id !== installation.id || me3.account.id !== installation.accountId || me3.workspace.id !== installation.workspaceId) throw new Error("identity-mismatch");
+      this.state.db.prepare("UPDATE registry_identity_cache SET value=?,fetched_at=?,lease_until=0,retry_at=0,failures=0 WHERE key=?").run(JSON.stringify(me3), now, key);
+      this.state.db.prepare("DELETE FROM registry_identity_cache WHERE key<>?").run(key);
+      return me3;
+    } catch (error62) {
+      if (!active() || this.key() !== key) return null;
+      const code = error62.response?.error?.code;
+      const revoked = error62.status === 401 || code === "installation-revoked" || code === "unauthenticated" || error62 instanceof Error && error62.message === "identity-mismatch";
+      this.state.db.prepare("UPDATE registry_identity_cache SET value=CASE WHEN ? THEN NULL ELSE value END,fetched_at=CASE WHEN ? THEN 0 ELSE fetched_at END,lease_until=0,failures=min(failures+1,10),retry_at=?+min(300000,1000*(1 << min(failures+1,8))) WHERE key=?").run(Number(revoked), Number(revoked), now, key);
+      if (revoked) throw error62;
+      return this.peek(now);
+    } finally {
+      clearTimeout(timer);
+      if (active()) this.state.db.prepare("UPDATE registry_identity_cache SET lease_until=0 WHERE key=? AND lease_until=?").run(key, now + 1e4);
+    }
+  }
+  reserveReadiness(now = Date.now()) {
+    const key = this.key();
+    if (!key) return false;
+    return Boolean(this.state.db.prepare("UPDATE registry_identity_cache SET readiness_at=? WHERE key=? AND readiness_at<=? RETURNING key").get(now, key, now - freshMs));
+  }
+  retryReadiness() {
+    const key = this.key();
+    if (key) this.state.db.prepare("UPDATE registry_identity_cache SET readiness_at=? WHERE key=?").run(Date.now(), key);
+  }
+};
+
+// src/analytics.ts
 var EVENT = /* @__PURE__ */ new Set(["cli_command_finished", "setup_stage_changed", "onboarding_failed", "discovery_started", "discovery_finished", "client_exception"]);
 var EU_HOST = "https://eu.i.posthog.com";
 var CliAnalytics = class {
@@ -164376,14 +164460,14 @@ var CliAnalytics = class {
     try {
       const identity = JSON.parse(row.json);
       const installation = this.state.installation();
-      return installation && identity.expiresAt > Date.now() && identity.accountId === installation.accountId && identity.workspaceId === installation.workspaceId && identity.installationId === installation.id ? identity : null;
+      return installation && identity.installationKey === createHash3("sha256").update(JSON.stringify(installation)).digest("hex") && identity.expiresAt > Date.now() && identity.accountId === installation.accountId && identity.workspaceId === installation.workspaceId && identity.installationId === installation.id ? identity : null;
     } catch {
       return null;
     }
   }
   updateIdentity(me3, now = Date.now()) {
     const previous = this.identity();
-    const next = { accountId: me3.account.id, workspaceId: me3.workspace.id, installationId: me3.installation.id, ...me3.analytics, enabled: me3.analytics.enabled && me3.analytics.environment !== "disabled" && me3.analytics.host === EU_HOST && /^phc_[A-Za-z0-9]+$/u.test(me3.analytics.projectKey), expiresAt: now + 24 * 60 * 6e4 };
+    const next = { installationKey: createHash3("sha256").update(JSON.stringify(this.state.installation())).digest("hex"), accountId: me3.account.id, workspaceId: me3.workspace.id, installationId: me3.installation.id, ...me3.analytics, enabled: me3.analytics.enabled && me3.analytics.environment !== "disabled" && me3.analytics.host === EU_HOST && /^phc_[A-Za-z0-9]+$/u.test(me3.analytics.projectKey), expiresAt: now + 24 * 60 * 6e4 };
     if (!next.enabled || previous && previous.accountId !== next.accountId) this.state.db.exec("DELETE FROM cli_analytics_queue");
     this.state.db.prepare("INSERT INTO cli_analytics_identity (id,json,refreshed_at) VALUES (1,?,?) ON CONFLICT(id) DO UPDATE SET json=excluded.json,refreshed_at=excluded.refreshed_at").run(JSON.stringify(next), now);
     this.state.db.prepare("DELETE FROM cli_analytics_queue WHERE account_id<>? OR occurred_at<?").run(next.accountId, new Date(now - 7 * 864e5).toISOString());
@@ -164391,10 +164475,11 @@ var CliAnalytics = class {
   async refresh(site, now = Date.now()) {
     const installation = this.state.installation();
     if (!installation) return "unavailable";
-    const last = this.state.db.prepare("SELECT refreshed_at FROM cli_analytics_identity WHERE id=1").get();
-    if (last && now - last.refreshed_at < 5 * 6e4 && this.identity()) return "ok";
     try {
-      this.updateIdentity(await createCliApi(site, this.fetcher, installation.token).call("me"), now);
+      const cache = new IdentityCache(this.state, site, this.fetcher);
+      const me3 = await cache.read(now);
+      if (!me3) return "unavailable";
+      this.updateIdentity(me3, cache.fetchedAt());
       return "ok";
     } catch (error62) {
       if (error62 instanceof ApiClientError && error62.status === 401 && error62.response?.error?.code === "unauthenticated") return "unauthorized";