@aventurevc/aventure-cli 0.8.386 → 0.8.388

package/dist/aventure-cli/index.js

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-import{enableCompileCache as e}from"node:module";import{fileURLToPath as t}from"node:url";e();var{Command:n,CommanderError:r}=await import(`../chunks/commander-D8IVfzyC.js`),{readRuntimePackage:i}=await import(`../chunks/package-DcUsOdSE.js`),{locateRuntimeManifest:a}=await import(`../chunks/runtime-identity-BXcpCMqz.js`),o=process.argv.slice(2);try{if(a(),o.length===1&&(o[0]===`--version`||o[0]===`-V`))await new n().exitOverride().version(i(t(import.meta.url)).version).parseAsync();else{let{logWarn:e,setStderrLogging:t}=await import(`../chunks/logging-CNg4ihxv.js`),{cliMachineOutputSelected:n}=await import(`../chunks/output-mode-U1V43dYf.js`),{commandAuthMaterializationMode:r,materializeCommandCredential:a}=await import(`../chunks/startup-auth-DVq1dO3o.js`),{GENERATED_OPENAPI_COMMAND_SPECS:s}=await import(`../chunks/openapi-commands-CHYNuWml.js`),{withRenamedCommandAliases:c}=await import(`../chunks/deprecated-command-BBCr1BHb.js`);if(n(o)&&t(!1),o.includes(`--all-fields`)){let{setTextAllFields:e}=await import(`../chunks/text-field-BDYE-wQt.js`);e(!0)}let l=r(o,c(s));if(l===`stored`||l===`optional`)try{await a(l)}catch(t){e({component:i().bin[0],event:`optional_auth_materialization_failed`,message:`saved credential unavailable; continuing with credential-optional command`,error:t})}await import(`../chunks/aventure-cli-CgIcnt5d.js`)}}catch(e){if(!(e instanceof r))throw e;e.code!==`commander.version`&&process.stderr.write(`${e.message}\n`),process.exitCode=e.exitCode}export{};
+import{enableCompileCache as e}from"node:module";import{fileURLToPath as t}from"node:url";e();var{Command:n,CommanderError:r}=await import(`../chunks/commander-D8IVfzyC.js`),{readRuntimePackage:i}=await import(`../chunks/package-DcUsOdSE.js`),{locateRuntimeManifest:a}=await import(`../chunks/runtime-identity-BXcpCMqz.js`),o=process.argv.slice(2);try{if(a(),o.length===1&&(o[0]===`--version`||o[0]===`-V`))await new n().exitOverride().version(i(t(import.meta.url)).version).parseAsync();else{let{logWarn:e,setStderrLogging:t}=await import(`../chunks/logging-CNg4ihxv.js`),{cliMachineOutputSelected:n}=await import(`../chunks/output-mode-U1V43dYf.js`),{commandAuthMaterializationMode:r,materializeCommandCredential:a}=await import(`../chunks/startup-auth-DfEgkGG8.js`),{GENERATED_OPENAPI_COMMAND_SPECS:s}=await import(`../chunks/openapi-commands-CHYNuWml.js`),{withRenamedCommandAliases:c}=await import(`../chunks/deprecated-command-BBCr1BHb.js`);if(n(o)&&t(!1),o.includes(`--all-fields`)){let{setTextAllFields:e}=await import(`../chunks/text-field-BDYE-wQt.js`);e(!0)}let l=r(o,c(s));if(l===`stored`||l===`optional`)try{await a(l)}catch(t){e({component:i().bin[0],event:`optional_auth_materialization_failed`,message:`saved credential unavailable; continuing with credential-optional command`,error:t})}await import(`../chunks/aventure-cli-SEyW_1AB.js`)}}catch(e){if(!(e instanceof r))throw e;e.code!==`commander.version`&&process.stderr.write(`${e.message}\n`),process.exitCode=e.exitCode}export{};

package/dist/aventure-cli/unified-operations.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "generatedFrom": "MCP_GENERATION_CONTRACT",
-  "generatedAt": "2026-11-07T12:29:15.587Z",
+  "generatedAt": "2026-11-07T16:17:23.471Z",
   "totalOperations": 132,
   "note": "1:1 projection of MCP_GENERATION_CONTRACT written by the CLI build ([MCP1b.1-EXC1]).",
   "operations": [

package/dist/chunks/{api-key-credential-verification-CJ5CCGAA.js → api-key-credential-verification-C_DQtQyx.js}

@@ -1 +1 @@
-import{f as e}from"./env-DGAe95Xm.js";import{n as t,s as n}from"./openapi-call-DrJ9I2I1.js";import{a as r}from"./api-target-vxev2RKl.js";import{a as i,i as a,o,s}from"./api-key-credential-v7YT_b1y.js";import{n as c,t as l}from"./credential-redaction-Cl6Eny3X.js";async function u(e){if(e.activation===`revoking`)return{lookup:await a(e.host),verification:null};let t=await d(e.credential.secret);try{if(t.state===`verified`&&e.activation===`active`){let n=await o(e.host,{apiKey:t.apiKey,secret:e.credential.secret},`active`,{state:`found`,stored:e});return n.state===`saved`?{lookup:{state:`found`,stored:n.stored},verification:t}:{lookup:n.current,verification:null}}}catch(n){t={state:`unavailable`,summary:`${t.summary}, but the cached metadata could not be updated — ${l(n,[e.credential.secret])}`}}let n;try{n=await a(e.host)}catch(t){return{lookup:{state:`unavailable`,cause:`storage`,summary:l(t,[e.credential.secret])},verification:null}}return{lookup:n,verification:n.state===`found`&&i(n.stored,e)?t:null}}async function d(i){let a=r(e()),o;try{o=await n(a,{method:`GET`,path:t(`getCurrentApiKey`,{}),headers:{Authorization:`Bearer ${i}`}},s)}catch(e){return{state:`unavailable`,summary:`identity verification failed before an HTTP response — ${l(e,[i])}`}}return o.ok&&o.redirect?{state:`unavailable`,summary:`identity verification returned unexpected redirect ${o.status}`}:o.ok?o.data.status===`ACTIVE`?{state:`verified`,summary:`API key verified by aVenture sign-in`,apiKey:o.data}:{state:`invalid`,summary:`API key is not active`}:{state:o.problem.type!==`about:blank`&&o.problem.status===401?`invalid`:`unavailable`,summary:`identity verification: ${c(o.problem,[i])}`}}export{d as n,u as t};
+import{f as e}from"./env-DGAe95Xm.js";import{n as t,s as n}from"./openapi-call-DRowSHyQ.js";import{a as r}from"./api-target-vxev2RKl.js";import{a as i,i as a,o,s}from"./api-key-credential-v7YT_b1y.js";import{n as c,t as l}from"./credential-redaction-Cl6Eny3X.js";async function u(e){if(e.activation===`revoking`)return{lookup:await a(e.host),verification:null};let t=await d(e.credential.secret);try{if(t.state===`verified`&&e.activation===`active`){let n=await o(e.host,{apiKey:t.apiKey,secret:e.credential.secret},`active`,{state:`found`,stored:e});return n.state===`saved`?{lookup:{state:`found`,stored:n.stored},verification:t}:{lookup:n.current,verification:null}}}catch(n){t={state:`unavailable`,summary:`${t.summary}, but the cached metadata could not be updated — ${l(n,[e.credential.secret])}`}}let n;try{n=await a(e.host)}catch(t){return{lookup:{state:`unavailable`,cause:`storage`,summary:l(t,[e.credential.secret])},verification:null}}return{lookup:n,verification:n.state===`found`&&i(n.stored,e)?t:null}}async function d(i){let a=r(e()),o;try{o=await n(a,{method:`GET`,path:t(`getCurrentApiKey`,{}),headers:{Authorization:`Bearer ${i}`}},s)}catch(e){return{state:`unavailable`,summary:`identity verification failed before an HTTP response — ${l(e,[i])}`}}return o.ok&&o.redirect?{state:`unavailable`,summary:`identity verification returned unexpected redirect ${o.status}`}:o.ok?o.data.status===`ACTIVE`?{state:`verified`,summary:`API key verified by aVenture sign-in`,apiKey:o.data}:{state:`invalid`,summary:`API key is not active`}:{state:o.problem.type!==`about:blank`&&o.problem.status===401?`invalid`:`unavailable`,summary:`identity verification: ${c(o.problem,[i])}`}}export{d as n,u as t};

package/dist/chunks/{api-key-credential-verification-TNvdeeGh.js → api-key-credential-verification-DC-YG5wa.js}

@@ -1 +1 @@
-export{t as refreshStoredApiKeyCredential}from"./api-key-credential-verification-CJ5CCGAA.js";
+export{t as refreshStoredApiKeyCredential}from"./api-key-credential-verification-C_DQtQyx.js";

package/dist/chunks/{api-key-login-C70ptWkf.js → api-key-login-DSWEmjPA.js}

@@ -1,4 +1,4 @@
-import{a as e}from"./package-DEeHDoOT.js";import{A as t,E as n,S as r,_ as i,g as a,i as o,n as s}from"./iso-DzqMxtky.js";import{f as c}from"./env-DGAe95Xm.js";import{c as l,r as u}from"./result-envelope-BMqcRDpc.js";import{z as d}from"./tool-policy-DG8pafmI.js";import{s as f,u as p}from"./openapi-call-DrJ9I2I1.js";import{i as m}from"./response-problem-Dr3Yy1lJ.js";import{a as h,r as g,t as ee}from"./api-target-vxev2RKl.js";import{n as _,o as v,r as te,t as ne}from"./api-key-credential-v7YT_b1y.js";import{n as re,t as y}from"./credential-redaction-Cl6Eny3X.js";import{c as b,l as x,n as S,u as C}from"./credential-store-xkwn77zF.js";import{n as w}from"./api-key-credential-verification-CJ5CCGAA.js";import{n as T}from"./contract-SAu4Y_Kd.js";import{t as E}from"./openapi-composites-IdxI7cAF.js";import{n as ie}from"./logout-Du693hU1.js";import{stderr as D,stdin as ae}from"node:process";import{TextDecoder as oe,inspect as se}from"node:util";import{hostname as ce,platform as le}from"node:os";import{setTimeout as ue}from"node:timers/promises";import{webcrypto as O}from"node:crypto";var k=o([`MACOS`,`LINUX`,`WINDOWS`,`OTHER`]),A=o([`RSA_OAEP_256_A256_GCM_V1`]),de=i({clientLabel:r().regex(/.*\S.*/).min(1).max(120).nullish(),clientPlatform:k.nullish(),encryptionAlgorithm:A.nullish(),encryptionPublicKey:r().min(344).max(12e3).nullish()}),fe=32;async function pe(){let e=await O.subtle.generateKey({name:`RSA-OAEP`,modulusLength:2048,publicExponent:new Uint8Array([1,0,1]),hash:`SHA-256`},!0,[`encrypt`,`decrypt`]),t=await O.subtle.exportKey(`spki`,e.publicKey);return{publicKey:Buffer.from(t).toString(`base64`),privateKey:e.privateKey}}async function me(e,t){let{wrappedKey:n,nonce:r,ciphertext:i,authenticationTag:a}=t,o=j(n,`wrapped key`,128,1024),s=j(r,`nonce`,12,12),c=j(i,`ciphertext`,1,65536),l=j(a,`authentication tag`,16,16),u;try{u=await O.subtle.decrypt({name:`RSA-OAEP`},e,o)}catch{throw Error(`broker credential key could not be decrypted`)}let d=new Uint8Array(u);try{if(d.byteLength!==fe)throw Error(`broker credential used an invalid AES-256 key`);let e=await O.subtle.importKey(`raw`,d,{name:`AES-GCM`},!1,[`decrypt`]),t=new Uint8Array(c.byteLength+l.byteLength);t.set(c),t.set(l,c.byteLength);let n;try{n=await O.subtle.decrypt({name:`AES-GCM`,iv:s,tagLength:128},e,t)}catch{throw Error(`broker credential payload failed authentication`)}let r=new oe(`utf-8`,{fatal:!0}).decode(n);if(r.trim().length===0)throw Error(`broker returned a blank credential`);return r}finally{d.fill(0)}}function j(e,t,n,r){let i=e.replace(/=+$/u,``),a=Uint8Array.from(Buffer.from(e,`base64`)),o=Buffer.from(a).toString(`base64`).replace(/=+$/u,``);if(i.length===0||o!==i||a.byteLength<n||a.byteLength>r)throw Error(`broker returned an invalid ${t}`);return a}var M=o([`PENDING`,`ISSUING`,`KEY_READY`,`REVOKING`,`CONSUMED`,`REVOKED`,`DENIED`,`EXPIRED`,`FAILED`]),N=o([`Denied by user`,`Authorization request expired`,`CLI authorization expired before acknowledgement`,`Credential issuance recovery revoked an unrecoverable key`,`Revoked by user`,`Clerk create response validation failed`,`Credential issuance failed`,`Credential issuance could not be recovered`,`API-key quota reached`,`Credential issuance lost its database claim`,`Credential delivery encryption failed`,`Credential issuance finalization was lost`]),P=i({approvedAt:s({offset:!0}).nullish(),clientLabel:r(),clientPlatform:k,comparisonCode:r(),consumedAt:s({offset:!0}).nullish(),createdAt:s({offset:!0}),expiresAt:s({offset:!0}),id:n(),intervalSeconds:a().int().min(1),keyReadyAt:s({offset:!0}).nullish(),status:M,terminalAt:s({offset:!0}).nullish(),terminalReason:N.nullish(),updatedAt:s({offset:!0})}),F=i({algorithm:A,authenticationTag:r(),ciphertext:r(),nonce:r(),wrappedKey:r()}),I=i({delivery:F.nullish(),expiresAt:s({offset:!0}),status:M,terminalReason:N.nullish()}),L=i({comparisonCode:r(),expiresAt:s({offset:!0}),id:n(),intervalSeconds:a().int().min(1),pollSecret:r(),verificationUrl:r()}),R=T(E,`start`),z=T(E,`poll`),B=T(E,`acknowledge`),V=class extends Error{httpStatus;retryAfterSeconds;retryable;constructor(e,t,n=[]){super(`CLI authorization ${e} failed: ${re(t,n)}`),this.name=`CliAuthorizationRequestError`,this.httpStatus=t.status,this.retryAfterSeconds=ve(t.retryAfterSeconds),this.retryable=t.status>=500||t.status===429}},H=class extends Error{constructor(e,t,n=[]){super(`CLI authorization ${e} transport failed: ${y(t,n)}`,{cause:t}),this.name=`CliAuthorizationTransportError`}};async function he(e){let t=await f(h(c()),{method:R.method,path:d(R.path,{},R.operationId),headers:{},contentType:`application/json`,body:e},L);if(t.ok&&t.redirect)throw new V(`start`,W(t.status));if(!t.ok)throw new V(`start`,t.problem);return ye(t.data)}async function ge(e,t){let n=p(z.operationId),r=await f(h(c()),{method:z.method,path:d(z.path,{cliAuthorizationId:e},z.operationId),headers:{[n]:t}},I);if(r.ok&&r.redirect)throw new V(`poll`,W(r.status),[t]);if(!r.ok)throw new V(`poll`,r.problem,[t]);return{authorization:r.data,retryAfterSeconds:_e(r.headers[`retry-after`])}}async function U(e,t){let n=p(B.operationId),r;try{r=await f(h(c()),{method:B.method,path:d(B.path,{cliAuthorizationId:e},B.operationId),headers:{[n]:t}},P)}catch(e){throw new H(`acknowledge`,e,[t])}if(r.ok&&r.redirect)throw new V(`acknowledge`,W(r.status),[t]);if(!r.ok)throw new V(`acknowledge`,r.problem,[t]);return r.data}function _e(e){if(e===void 0)return null;let t=Number(e);return Number.isInteger(t)&&t>0?t:null}function ve(e){return typeof e==`number`&&Number.isInteger(e)&&e>0?e:null}function W(e){return{status:e,title:`Unexpected redirect`,type:`about:blank`,code:void 0,detail:`CLI authorization endpoint returned an unexpected redirect`}}function ye(e){let{verificationUrl:t,pollSecret:n,...r}=e,i={...e},a=()=>({...r,verificationUrl:`<redacted>`,pollSecret:`<redacted>`});return Object.defineProperties(i,{verificationUrl:{enumerable:!1,get:()=>t},pollSecret:{enumerable:!1,get:()=>n},toJSON:{enumerable:!1,value:a},toString:{enumerable:!1,value:()=>`CliAuthorizationStart(${JSON.stringify(a())})`},[se.custom]:{enumerable:!1,value:a}})}var G=`RSA_OAEP_256_A256_GCM_V1`,be=1,xe=30,K=e().bin[0],q=`The local record remains pending and unavailable to ordinary commands. Re-run \`${K} auth login --key\`; it recovers the credential when the broker acknowledged it, and otherwise clears the stale record.`;async function Se(e){if(!ae.isTTY)return u(`${K} auth login --key requires an interactive TTY on stdin`,[`For non-interactive automation, inject AUTH_TOKEN through the environment.`]);let n,r;try{let e=c().host;n=g(e),r=ee(e)}catch(e){return u(`auth login --key: invalid environment configuration — ${y(e)}`)}for(;;){let e;try{e=await te(n)}catch(e){return u(`auth login --key: credential storage could not be inspected — ${y(e)}`)}if(e.state===`unavailable`)return u(`auth login --key: ${e.summary}`,[`Make the OS keyring or the CLI config directory writable, or use AUTH_TOKEN from the environment.`]);if(e.state===`missing`){let t=S(e.keyringFailure);t!==null&&D.write(t);break}let t=await Ce(e.stored);if(t!==null)return t}let i;try{i=await pe()}catch(e){return u(`auth login --key: ephemeral encryption key could not be created — ${y(e)}`)}let a=de.safeParse({clientLabel:e.clientLabel?.trim()||(ce().trim()||K).slice(0,120),clientPlatform:Ee(),encryptionAlgorithm:G,encryptionPublicKey:i.publicKey});if(!a.success)return u(`auth login --key: ${t(a.error)}`);let o;try{o=await he(a.data)}catch(e){return u(`auth login --key: could not start browser authorization — ${y(e)}`)}let s;try{s=C(o,r)}catch(e){return u(`auth login --key: unsafe browser authorization URL rejected — ${y(e)}`)}let l=await b(o,r,{noBrowser:e.noBrowser});if(!x(l,o,s))return u(`auth login --key: browser authorization requires an interactive terminal for manual handoff`,[`Automatic browser opening did not complete, and the approval URL was withheld because stderr is not an interactive terminal. Retry from an interactive terminal.`],{references:[s]});let d;try{d=await Te(o)}catch(e){return u(`auth login --key: authorization did not complete — ${y(e)}`,[],{references:[s]})}if(d.algorithm!==G)return u(`auth login --key: broker selected an unsupported encryption algorithm`);let f;try{f=await me(i.privateKey,d)}catch(e){return u(`auth login --key: encrypted credential could not be opened — ${y(e)}`)}let p=await w(f);if(p.state!==`verified`)return u(`auth login --key: decrypted credential was neither stored nor acknowledged — ${p.summary}`);let m;try{let e=await v(n,{apiKey:p.apiKey,secret:f},`pending`,{state:`missing`});if(e.state===`changed`)return u(`auth login --key: local credential changed; delivery was not stored or acknowledged. Re-run auth status.`);m=e.stored}catch(e){return u(`auth login --key: credential could not be durably stored — ${y(e)}`)}let h;try{h=await we(o)}catch(e){return Q(m,!0,`auth login --key: credential was stored and verified, but broker acknowledgment was not confirmed — ${y(e,[o.pollSecret])}`,q)}if(h.status!==`CONSUMED`)return Q(m,!0,`auth login --key: broker returned ${h.status} after acknowledgment`,q);let _=await w(f);return _.state!==`verified`||!$(_.apiKey,m.credential.apiKey)?Q(m,!0,`auth login --key: broker acknowledgment succeeded, but refreshed credential metadata could not prove the granted lifetime — ${_.summary}`,q):await J(m,_.apiKey,`acknowledgment`)}async function Ce(e){let t=e.activation===`revoking`?{state:`invalid`,summary:`Local revocation is pending`}:await w(e.credential.secret);if(e.activation===`active`)return t.state===`verified`?l(`API key is already stored and its authenticated identity was verified.`,Z(e,!0),{ids:[e.credential.apiKey.id]}):Q(e,!1,`auth login --key: stored credential ${t.state} — ${t.summary}`,`Run \`${K} auth logout\` to revoke/remove it before authorizing a replacement.`);if(t.state===`verified`&&$(t.apiKey,e.credential.apiKey))return await J(e,t.apiKey,`recovery`);if(t.state===`unavailable`||t.state===`verified`&&!e.credential.apiKey.expiresAt)return Q(e,t.state===`verified`,`auth login --key: the stored pending credential acknowledgment could not be verified — ${t.summary}`,t.state===`verified`?`The stored expiry is missing. Both records were preserved; inspect the existing key in your account before deciding how to recover it.`:`The stored record and the remote key were both preserved. Re-run \`${K} auth login --key\` when the API is reachable; it recovers an acknowledged credential and clears an unacknowledged one.`);try{if(e.activation===`pending`){let t=await v(e.host,e.credential,`revoking`,{state:`found`,stored:e});if(t.state===`changed`)return null;e=t.stored}let t=await ie(e);if(t.outcome===`unconfirmed`)return Q(e,!1,`auth login --key: credential revocation remains pending`,`Remote revocation was not confirmed — ${t.summary}. Retry auth login --key when the API is reachable.`);if((await _(e)).state===`changed`)return null;D.write(t.outcome===`revoked`?`Revoked and cleared a stale pending CLI credential; starting a fresh browser authorization.
+import{a as e}from"./package-DEeHDoOT.js";import{A as t,E as n,S as r,_ as i,g as a,i as o,n as s}from"./iso-DzqMxtky.js";import{f as c}from"./env-DGAe95Xm.js";import{c as l,r as u}from"./result-envelope-BMqcRDpc.js";import{z as d}from"./tool-policy-DG8pafmI.js";import{s as f,u as p}from"./openapi-call-DRowSHyQ.js";import{i as m}from"./response-problem-Dr3Yy1lJ.js";import{a as h,r as g,t as ee}from"./api-target-vxev2RKl.js";import{n as _,o as v,r as te,t as ne}from"./api-key-credential-v7YT_b1y.js";import{n as re,t as y}from"./credential-redaction-Cl6Eny3X.js";import{c as b,l as x,n as S,u as C}from"./credential-store-xkwn77zF.js";import{n as w}from"./api-key-credential-verification-C_DQtQyx.js";import{n as T}from"./contract-SAu4Y_Kd.js";import{t as E}from"./openapi-composites-IdxI7cAF.js";import{n as ie}from"./logout-Dxt8vao3.js";import{stderr as D,stdin as ae}from"node:process";import{TextDecoder as oe,inspect as se}from"node:util";import{hostname as ce,platform as le}from"node:os";import{setTimeout as ue}from"node:timers/promises";import{webcrypto as O}from"node:crypto";var k=o([`MACOS`,`LINUX`,`WINDOWS`,`OTHER`]),A=o([`RSA_OAEP_256_A256_GCM_V1`]),de=i({clientLabel:r().regex(/.*\S.*/).min(1).max(120).nullish(),clientPlatform:k.nullish(),encryptionAlgorithm:A.nullish(),encryptionPublicKey:r().min(344).max(12e3).nullish()}),fe=32;async function pe(){let e=await O.subtle.generateKey({name:`RSA-OAEP`,modulusLength:2048,publicExponent:new Uint8Array([1,0,1]),hash:`SHA-256`},!0,[`encrypt`,`decrypt`]),t=await O.subtle.exportKey(`spki`,e.publicKey);return{publicKey:Buffer.from(t).toString(`base64`),privateKey:e.privateKey}}async function me(e,t){let{wrappedKey:n,nonce:r,ciphertext:i,authenticationTag:a}=t,o=j(n,`wrapped key`,128,1024),s=j(r,`nonce`,12,12),c=j(i,`ciphertext`,1,65536),l=j(a,`authentication tag`,16,16),u;try{u=await O.subtle.decrypt({name:`RSA-OAEP`},e,o)}catch{throw Error(`broker credential key could not be decrypted`)}let d=new Uint8Array(u);try{if(d.byteLength!==fe)throw Error(`broker credential used an invalid AES-256 key`);let e=await O.subtle.importKey(`raw`,d,{name:`AES-GCM`},!1,[`decrypt`]),t=new Uint8Array(c.byteLength+l.byteLength);t.set(c),t.set(l,c.byteLength);let n;try{n=await O.subtle.decrypt({name:`AES-GCM`,iv:s,tagLength:128},e,t)}catch{throw Error(`broker credential payload failed authentication`)}let r=new oe(`utf-8`,{fatal:!0}).decode(n);if(r.trim().length===0)throw Error(`broker returned a blank credential`);return r}finally{d.fill(0)}}function j(e,t,n,r){let i=e.replace(/=+$/u,``),a=Uint8Array.from(Buffer.from(e,`base64`)),o=Buffer.from(a).toString(`base64`).replace(/=+$/u,``);if(i.length===0||o!==i||a.byteLength<n||a.byteLength>r)throw Error(`broker returned an invalid ${t}`);return a}var M=o([`PENDING`,`ISSUING`,`KEY_READY`,`REVOKING`,`CONSUMED`,`REVOKED`,`DENIED`,`EXPIRED`,`FAILED`]),N=o([`Denied by user`,`Authorization request expired`,`CLI authorization expired before acknowledgement`,`Credential issuance recovery revoked an unrecoverable key`,`Revoked by user`,`Clerk create response validation failed`,`Credential issuance failed`,`Credential issuance could not be recovered`,`API-key quota reached`,`Credential issuance lost its database claim`,`Credential delivery encryption failed`,`Credential issuance finalization was lost`]),P=i({approvedAt:s({offset:!0}).nullish(),clientLabel:r(),clientPlatform:k,comparisonCode:r(),consumedAt:s({offset:!0}).nullish(),createdAt:s({offset:!0}),expiresAt:s({offset:!0}),id:n(),intervalSeconds:a().int().min(1),keyReadyAt:s({offset:!0}).nullish(),status:M,terminalAt:s({offset:!0}).nullish(),terminalReason:N.nullish(),updatedAt:s({offset:!0})}),F=i({algorithm:A,authenticationTag:r(),ciphertext:r(),nonce:r(),wrappedKey:r()}),I=i({delivery:F.nullish(),expiresAt:s({offset:!0}),status:M,terminalReason:N.nullish()}),L=i({comparisonCode:r(),expiresAt:s({offset:!0}),id:n(),intervalSeconds:a().int().min(1),pollSecret:r(),verificationUrl:r()}),R=T(E,`start`),z=T(E,`poll`),B=T(E,`acknowledge`),V=class extends Error{httpStatus;retryAfterSeconds;retryable;constructor(e,t,n=[]){super(`CLI authorization ${e} failed: ${re(t,n)}`),this.name=`CliAuthorizationRequestError`,this.httpStatus=t.status,this.retryAfterSeconds=ve(t.retryAfterSeconds),this.retryable=t.status>=500||t.status===429}},H=class extends Error{constructor(e,t,n=[]){super(`CLI authorization ${e} transport failed: ${y(t,n)}`,{cause:t}),this.name=`CliAuthorizationTransportError`}};async function he(e){let t=await f(h(c()),{method:R.method,path:d(R.path,{},R.operationId),headers:{},contentType:`application/json`,body:e},L);if(t.ok&&t.redirect)throw new V(`start`,W(t.status));if(!t.ok)throw new V(`start`,t.problem);return ye(t.data)}async function ge(e,t){let n=p(z.operationId),r=await f(h(c()),{method:z.method,path:d(z.path,{cliAuthorizationId:e},z.operationId),headers:{[n]:t}},I);if(r.ok&&r.redirect)throw new V(`poll`,W(r.status),[t]);if(!r.ok)throw new V(`poll`,r.problem,[t]);return{authorization:r.data,retryAfterSeconds:_e(r.headers[`retry-after`])}}async function U(e,t){let n=p(B.operationId),r;try{r=await f(h(c()),{method:B.method,path:d(B.path,{cliAuthorizationId:e},B.operationId),headers:{[n]:t}},P)}catch(e){throw new H(`acknowledge`,e,[t])}if(r.ok&&r.redirect)throw new V(`acknowledge`,W(r.status),[t]);if(!r.ok)throw new V(`acknowledge`,r.problem,[t]);return r.data}function _e(e){if(e===void 0)return null;let t=Number(e);return Number.isInteger(t)&&t>0?t:null}function ve(e){return typeof e==`number`&&Number.isInteger(e)&&e>0?e:null}function W(e){return{status:e,title:`Unexpected redirect`,type:`about:blank`,code:void 0,detail:`CLI authorization endpoint returned an unexpected redirect`}}function ye(e){let{verificationUrl:t,pollSecret:n,...r}=e,i={...e},a=()=>({...r,verificationUrl:`<redacted>`,pollSecret:`<redacted>`});return Object.defineProperties(i,{verificationUrl:{enumerable:!1,get:()=>t},pollSecret:{enumerable:!1,get:()=>n},toJSON:{enumerable:!1,value:a},toString:{enumerable:!1,value:()=>`CliAuthorizationStart(${JSON.stringify(a())})`},[se.custom]:{enumerable:!1,value:a}})}var G=`RSA_OAEP_256_A256_GCM_V1`,be=1,xe=30,K=e().bin[0],q=`The local record remains pending and unavailable to ordinary commands. Re-run \`${K} auth login --key\`; it recovers the credential when the broker acknowledged it, and otherwise clears the stale record.`;async function Se(e){if(!ae.isTTY)return u(`${K} auth login --key requires an interactive TTY on stdin`,[`For non-interactive automation, inject AUTH_TOKEN through the environment.`]);let n,r;try{let e=c().host;n=g(e),r=ee(e)}catch(e){return u(`auth login --key: invalid environment configuration — ${y(e)}`)}for(;;){let e;try{e=await te(n)}catch(e){return u(`auth login --key: credential storage could not be inspected — ${y(e)}`)}if(e.state===`unavailable`)return u(`auth login --key: ${e.summary}`,[`Make the OS keyring or the CLI config directory writable, or use AUTH_TOKEN from the environment.`]);if(e.state===`missing`){let t=S(e.keyringFailure);t!==null&&D.write(t);break}let t=await Ce(e.stored);if(t!==null)return t}let i;try{i=await pe()}catch(e){return u(`auth login --key: ephemeral encryption key could not be created — ${y(e)}`)}let a=de.safeParse({clientLabel:e.clientLabel?.trim()||(ce().trim()||K).slice(0,120),clientPlatform:Ee(),encryptionAlgorithm:G,encryptionPublicKey:i.publicKey});if(!a.success)return u(`auth login --key: ${t(a.error)}`);let o;try{o=await he(a.data)}catch(e){return u(`auth login --key: could not start browser authorization — ${y(e)}`)}let s;try{s=C(o,r)}catch(e){return u(`auth login --key: unsafe browser authorization URL rejected — ${y(e)}`)}let l=await b(o,r,{noBrowser:e.noBrowser});if(!x(l,o,s))return u(`auth login --key: browser authorization requires an interactive terminal for manual handoff`,[`Automatic browser opening did not complete, and the approval URL was withheld because stderr is not an interactive terminal. Retry from an interactive terminal.`],{references:[s]});let d;try{d=await Te(o)}catch(e){return u(`auth login --key: authorization did not complete — ${y(e)}`,[],{references:[s]})}if(d.algorithm!==G)return u(`auth login --key: broker selected an unsupported encryption algorithm`);let f;try{f=await me(i.privateKey,d)}catch(e){return u(`auth login --key: encrypted credential could not be opened — ${y(e)}`)}let p=await w(f);if(p.state!==`verified`)return u(`auth login --key: decrypted credential was neither stored nor acknowledged — ${p.summary}`);let m;try{let e=await v(n,{apiKey:p.apiKey,secret:f},`pending`,{state:`missing`});if(e.state===`changed`)return u(`auth login --key: local credential changed; delivery was not stored or acknowledged. Re-run auth status.`);m=e.stored}catch(e){return u(`auth login --key: credential could not be durably stored — ${y(e)}`)}let h;try{h=await we(o)}catch(e){return Q(m,!0,`auth login --key: credential was stored and verified, but broker acknowledgment was not confirmed — ${y(e,[o.pollSecret])}`,q)}if(h.status!==`CONSUMED`)return Q(m,!0,`auth login --key: broker returned ${h.status} after acknowledgment`,q);let _=await w(f);return _.state!==`verified`||!$(_.apiKey,m.credential.apiKey)?Q(m,!0,`auth login --key: broker acknowledgment succeeded, but refreshed credential metadata could not prove the granted lifetime — ${_.summary}`,q):await J(m,_.apiKey,`acknowledgment`)}async function Ce(e){let t=e.activation===`revoking`?{state:`invalid`,summary:`Local revocation is pending`}:await w(e.credential.secret);if(e.activation===`active`)return t.state===`verified`?l(`API key is already stored and its authenticated identity was verified.`,Z(e,!0),{ids:[e.credential.apiKey.id]}):Q(e,!1,`auth login --key: stored credential ${t.state} — ${t.summary}`,`Run \`${K} auth logout\` to revoke/remove it before authorizing a replacement.`);if(t.state===`verified`&&$(t.apiKey,e.credential.apiKey))return await J(e,t.apiKey,`recovery`);if(t.state===`unavailable`||t.state===`verified`&&!e.credential.apiKey.expiresAt)return Q(e,t.state===`verified`,`auth login --key: the stored pending credential acknowledgment could not be verified — ${t.summary}`,t.state===`verified`?`The stored expiry is missing. Both records were preserved; inspect the existing key in your account before deciding how to recover it.`:`The stored record and the remote key were both preserved. Re-run \`${K} auth login --key\` when the API is reachable; it recovers an acknowledged credential and clears an unacknowledged one.`);try{if(e.activation===`pending`){let t=await v(e.host,e.credential,`revoking`,{state:`found`,stored:e});if(t.state===`changed`)return null;e=t.stored}let t=await ie(e);if(t.outcome===`unconfirmed`)return Q(e,!1,`auth login --key: credential revocation remains pending`,`Remote revocation was not confirmed — ${t.summary}. Retry auth login --key when the API is reachable.`);if((await _(e)).state===`changed`)return null;D.write(t.outcome===`revoked`?`Revoked and cleared a stale pending CLI credential; starting a fresh browser authorization.
 `:`Cleared a stale pending CLI credential whose remote key can no longer authenticate; starting a fresh browser authorization.
 `)}catch(t){return Q(e,!1,`auth login --key: stale pending credential could not be removed — ${y(t,[e.credential.secret])}`)}return null}async function J(e,t,n){try{let r=await v(e.host,{apiKey:t,secret:e.credential.secret},`active`,{state:`found`,stored:e});return r.state===`changed`?u(`auth login --key: local credential changed ${n===`recovery`?`during recovery`:`after acknowledgment`}; current state preserved. Re-run auth status.`):l(n===`recovery`?`Recovered pending CLI credential: broker acknowledgment had succeeded.`:`API key stored; authenticated identity and broker acknowledgment verified.`,Z(r.stored,!0),{ids:[r.stored.credential.apiKey.id]})}catch(t){return Q(e,!0,`auth login --key: ${n===`recovery`?`credential is valid but could not be promoted locally`:`remote acknowledgment succeeded, but local activation could not be confirmed`} — ${y(t,[e.credential.secret])}`,q)}}async function we(e){let t=new Date(e.expiresAt).getTime(),n=Y(e.intervalSeconds);for(;;)try{return await U(e.id,e.pollSecret)}catch(e){if(e instanceof V){if(!e.retryable)throw e;n=Y(e.retryAfterSeconds??n)}else if(!(e instanceof H))throw e;if(Date.now()>=t)throw e;D.write(`Broker acknowledgment was interrupted; retrying.
 `),await X(n,t)}}async function Te(e){let t=new Date(e.expiresAt).getTime(),n=Y(e.intervalSeconds),r;for(D.write(`Waiting for browser approval...

package/dist/chunks/{auth-status-check-oJLDd2a7.js → auth-status-check-Cwf6uUZP.js}

@@ -1 +1 @@
-import{a as e}from"./package-DEeHDoOT.js";import{t}from"./credential-redaction-Cl6Eny3X.js";import{n,t as r}from"./openapi-commands-B2dIDk9o.js";var i=[{name:`cli-version`,purpose:`running CLI against the latest published release`},{name:`api-schemas`,purpose:`the installed @aventurevc/api-schemas contracts resolve`},{name:`api-host`,purpose:`the selected API host answers GET /info`},{name:`auth`,purpose:`a credential materialized for the next command, never its secret`},{name:`catalog`,purpose:`this CLI knows every operation the API serves`}];function a(e,t,n){return{name:e,status:t,message:n}}async function o(e){let t=l(),n=await u(e),[r,i]=await Promise.all([d(e),t===void 0?null:f(t)]);return{cliVersion:n.check,apiSchemas:r,catalog:m(i,n.upgradeAvailable,e)}}function s(e,t,n){return e.ok?a(`api-host`,`pass`,`GET /info answered at ${t}.`):a(`api-host`,`fail`,e.httpStatus===401?`Replace or unset the credential ${t} rejected, or run \`${n} auth login\`, then rerun \`${n} auth status\` — GET /info returned ${e.summary}.`:`Point the CLI at a reachable API host with \`--environment <name>\` or API_URL, then rerun \`${n} auth status\` — GET /info at ${t} returned ${e.summary}.`)}function c(e,t,n){let r=[e.cliVersion,e.apiSchemas,t,n,e.catalog];return{ok:r.every(e=>e.status!==`fail`),check:r}}function l(){return r.find(e=>e.intent===`status`&&e.resource===`status`)}async function u(t){let{runUpdate:n}=await import(`./builtin-update-DJT_3I5O.js`),r=e(),i=n(r,`check`);if(!i.ok||i.data===null)return{check:a(`cli-version`,`skip`,`Could not compare ${r.version} against the registry (${i.summary}); rerun \`${t} update\` with registry access.`),upgradeAvailable:null};let{targetPackage:o,currentVersion:s,latestVersion:c,upgradeAvailable:l}=i.data;return{check:l?a(`cli-version`,`fail`,`Upgrade ${o} from ${s} to ${c}: run \`${t} update\`.`):a(`cli-version`,`pass`,`${o} ${s} matches the latest published release.`),upgradeAvailable:l}}async function d(e){try{let{EntityDetailSchema:e}=await import(`./detail-BJehaxuo.js`);if(typeof e.safeParse!=`function`)throw Error(`EntityDetailSchema does not expose a Zod parser`);return a(`api-schemas`,`pass`,`Installed @aventurevc/api-schemas contracts resolve beyond the CLI startup path.`)}catch(n){return a(`api-schemas`,`fail`,`Reinstall the CLI: run \`${e} update\` — ${t(n)}.`)}}async function f(e){let{runOpenApiCall:n}=await import(`./openapi-call-BN_q73Gl.js`),r=`${e.method} ${e.path}`;try{let t=await n({method:e.method,path:e.path,auth:e.auth,responseFormat:`json`});if(!t.ok)return{unread:`${r} returned ${t.summary}`};let i=p(t.data);return i===null?{unread:`${r} carried no operationFingerprint`}:{fingerprint:i}}catch(e){return{unread:`${r} failed: ${t(e)}`}}}function p(e){if(typeof e!=`object`||!e||e instanceof Uint8Array)return null;let{response:t}=e;if(typeof t!=`object`||!t||Array.isArray(t))return null;let n=t.operationFingerprint;return typeof n==`string`&&n.length>0?n:null}function m(e,t,i){let o=r.length;if(e===null)return a(`catalog`,`skip`,`The public catalog omits deployment-status metadata and holds ${o} operations.`);if(`unread`in e)return a(`catalog`,`skip`,`Could not read the served operation fingerprint (${e.unread}), so drift is unproven; this catalog holds ${o} operations at ${n}.`);let s=e.fingerprint;if(s===`de32de01d813865c`)return a(`catalog`,`pass`,`${o} generated operations match the set the API serves (${n}).`);let c=`This catalog describes a different operation set than the API serves (${n} vs ${s})`;return t===!0?a(`catalog`,`fail`,`${c}: run \`${i} update\`.`):a(`catalog`,`skip`,t===!1?`${c}, and this CLI is already the latest published release: either the deployed API is older than this CLI, or a newer CLI has not been published yet.`:`${c}, and the registry did not answer, so it is unknown whether a newer release describes it: rerun \`${i} update\` with registry access.`)}export{o as a,a as i,s as n,c as r,i as t};
+import{a as e}from"./package-DEeHDoOT.js";import{t}from"./credential-redaction-Cl6Eny3X.js";import{n,t as r}from"./openapi-commands-B2dIDk9o.js";var i=[{name:`cli-version`,purpose:`running CLI against the latest published release`},{name:`api-schemas`,purpose:`the installed @aventurevc/api-schemas contracts resolve`},{name:`api-host`,purpose:`the selected API host answers GET /info`},{name:`auth`,purpose:`a credential materialized for the next command, never its secret`},{name:`catalog`,purpose:`this CLI knows every operation the API serves`}];function a(e,t,n){return{name:e,status:t,message:n}}async function o(e){let t=l(),n=await u(e),[r,i]=await Promise.all([d(e),t===void 0?null:f(t)]);return{cliVersion:n.check,apiSchemas:r,catalog:m(i,n.upgradeAvailable,e)}}function s(e,t,n){return e.ok?a(`api-host`,`pass`,`GET /info answered at ${t}.`):a(`api-host`,`fail`,e.httpStatus===401?`Replace or unset the credential ${t} rejected, or run \`${n} auth login\`, then rerun \`${n} auth status\` — GET /info returned ${e.summary}.`:`Point the CLI at a reachable API host with \`--environment <name>\` or API_URL, then rerun \`${n} auth status\` — GET /info at ${t} returned ${e.summary}.`)}function c(e,t,n){let r=[e.cliVersion,e.apiSchemas,t,n,e.catalog];return{ok:r.every(e=>e.status!==`fail`),check:r}}function l(){return r.find(e=>e.intent===`status`&&e.resource===`status`)}async function u(t){let{runUpdate:n}=await import(`./builtin-update-DJT_3I5O.js`),r=e(),i=n(r,`check`);if(!i.ok||i.data===null)return{check:a(`cli-version`,`skip`,`Could not compare ${r.version} against the registry (${i.summary}); rerun \`${t} update\` with registry access.`),upgradeAvailable:null};let{targetPackage:o,currentVersion:s,latestVersion:c,upgradeAvailable:l}=i.data;return{check:l?a(`cli-version`,`fail`,`Upgrade ${o} from ${s} to ${c}: run \`${t} update\`.`):a(`cli-version`,`pass`,`${o} ${s} matches the latest published release.`),upgradeAvailable:l}}async function d(e){try{let{EntityDetailSchema:e}=await import(`./detail-BJehaxuo.js`);if(typeof e.safeParse!=`function`)throw Error(`EntityDetailSchema does not expose a Zod parser`);return a(`api-schemas`,`pass`,`Installed @aventurevc/api-schemas contracts resolve beyond the CLI startup path.`)}catch(n){return a(`api-schemas`,`fail`,`Reinstall the CLI: run \`${e} update\` — ${t(n)}.`)}}async function f(e){let{runOpenApiCall:n}=await import(`./openapi-call-Gchy3s8a.js`),r=`${e.method} ${e.path}`;try{let t=await n({method:e.method,path:e.path,auth:e.auth,responseFormat:`json`});if(!t.ok)return{unread:`${r} returned ${t.summary}`};let i=p(t.data);return i===null?{unread:`${r} carried no operationFingerprint`}:{fingerprint:i}}catch(e){return{unread:`${r} failed: ${t(e)}`}}}function p(e){if(typeof e!=`object`||!e||e instanceof Uint8Array)return null;let{response:t}=e;if(typeof t!=`object`||!t||Array.isArray(t))return null;let n=t.operationFingerprint;return typeof n==`string`&&n.length>0?n:null}function m(e,t,i){let o=r.length;if(e===null)return a(`catalog`,`skip`,`The public catalog omits deployment-status metadata and holds ${o} operations.`);if(`unread`in e)return a(`catalog`,`skip`,`Could not read the served operation fingerprint (${e.unread}), so drift is unproven; this catalog holds ${o} operations at ${n}.`);let s=e.fingerprint;if(s===`de32de01d813865c`)return a(`catalog`,`pass`,`${o} generated operations match the set the API serves (${n}).`);let c=`This catalog describes a different operation set than the API serves (${n} vs ${s})`;return t===!0?a(`catalog`,`fail`,`${c}: run \`${i} update\`.`):a(`catalog`,`skip`,t===!1?`${c}, and this CLI is already the latest published release: either the deployed API is older than this CLI, or a newer CLI has not been published yet.`:`${c}, and the registry did not answer, so it is unknown whether a newer release describes it: rerun \`${i} update\` with registry access.`)}export{o as a,a as i,s as n,c as r,i as t};

package/dist/chunks/{auth-status-check-W8rkgIvv.js → auth-status-check-DcY55e4Q.js}

@@ -1 +1 @@
-export{n as apiHostCheck,r as authStatusReport,i as checkResult,a as environmentChecks}from"./auth-status-check-oJLDd2a7.js";
+export{n as apiHostCheck,r as authStatusReport,i as checkResult,a as environmentChecks}from"./auth-status-check-Cwf6uUZP.js";

package/dist/chunks/{auth-status-render-BIHZs1Fl.js → auth-status-render-DlSjZ6kk.js}

@@ -1,2 +1,2 @@
-import{f as e,t}from"./env-DGAe95Xm.js";import{a as n}from"./auth-resolver-CRpJNNB2.js";import{i as r,l as i}from"./openapi-call-DrJ9I2I1.js";import{a,i as o}from"./response-problem-Dr3Yy1lJ.js";import{t as s}from"./api-key-credential-v7YT_b1y.js";import{t as c}from"./credential-redaction-Cl6Eny3X.js";import{t as l}from"./api-key-bearer-credential-DpuLoYkG.js";import{a as u,f as d,l as f,s as p}from"./oauth-credential-D5ioBfGK.js";import{t as m}from"./oauth-bearer-credential-DlyXyoGr.js";async function h(){return null}async function g(e){let t=null,n=e=>{t=e};try{await m(e,n),await l(n)}catch(e){return{materialized:t,failure:c(e)}}return{materialized:t,failure:null}}async function _(e,t,n,i){if(i.failure!==null)return{scope:e,selected:null,identity:null,authorization:null,error:i.failure};let a=null,o=null,s,l=e=>{s=e,o=v(e.credential,i.materialized)};try{let t=await r({method:`POST`,path:`/v1/auth/me/permissions`,body:{operation:[]},auth:e,requesterScope:e,responseFormat:`json`,onAuthPrepared:l});if(!t.ok)throw Error([t.summary,...t.warnings].join(` — `));if(o===null)throw Error(`Live permission probe did not prepare a credential`);if(a=S(t.data),e===`read`)return{scope:e,selected:o,identity:null,authorization:a,error:null};if(s===void 0)throw Error(`Live permission probe did not retain its prepared credential`);let n=await h(e,s);return{scope:e,selected:o,identity:n,authorization:a,error:null}}catch(r){return{scope:e,selected:o,identity:null,authorization:a,error:c(r,y(t,n,s))}}}function v(e,t){if(e===null)return null;let r=t??n().source;if(r===null)throw Error(`Prepared credential has no local provenance`);return{credential:e,source:r}}function y(t,n,r){return[e().userBearerToken,...a(r?.headers??{}),...t.state===`found`?d(t.stored.credential.tokens):[],n.state===`found`?n.stored.credential.secret:void 0]}function b(e,t,n=null){let r=t.state===`found`?t.stored:void 0,i=r?.credential.apiKey.expiresAt??null;return{host:e,present:r!==void 0,provider:r?.provider??null,activation:r===void 0?null:s(r.activation),apiKeyId:r?.credential.apiKey.id??null,subject:r?.credential.apiKey.subject??null,scope:r?.credential.apiKey.scopes??[],name:r===void 0?null:o(r.credential.apiKey.name,[r.credential.secret]),status:r?.credential.apiKey.status??null,expiresAt:i,metadataSource:r===void 0?null:n?.state===`verified`?`clerk`:`store-cache`,live:n===null?null:{state:n.state,summary:n.summary},expiresInDay:w(i),storageFailure:t.state===`unavailable`?t.summary:null,keyringFailure:t.state===`missing`?t.keyringFailure??null:null,error:t.state===`invalid`?t.summary:null}}function x(e,t){let n=t.state===`found`?t.stored:void 0;return{host:e,present:n!==void 0,provider:n?.provider??null,expiresAt:n?.credential.expiresAt??null,expired:n===void 0?null:u(n.credential),renewable:n===void 0?null:n.credential.tokens.refresh_token!==void 0,identity:n===void 0?null:f(n.credential),client:n?.credential.client??null,storageFailure:t.state===`unavailable`?t.summary:null,keyringFailure:t.state===`missing`?t.keyringFailure??null:null,error:t.state===`invalid`?t.summary:null}}function S(e){if(typeof e!=`object`||!e||e instanceof Uint8Array)throw Error(`permission probe returned no JSON response`);let t=i.safeParse(e.response);if(!t.success)throw t.error;return t.data}var C=864e5;function w(e){if(e===null)return null;let t=new Date(e).getTime();return Number.isNaN(t)?null:Math.round((t-Date.now())/C)}var T=7;function E(e){return e===null?`none`:e.length<=11?e:`${e.slice(0,T)}\u2026${e.slice(-4)}`}var D=13,O=14;function k(e){return[``,`${e.cliName} ${e.cliVersion} \u2192 ${e.apiKey.host}`+(e.apiVersion===null?` (api build unavailable)`:` (api ${e.apiVersion})`),``,...N(e.oauth,e.cliName,e.refresh),...F(e.apiKey,e.oauth,e.cliName,e.apiKeyPhase),``,j(`Providers`,R(e.providers)),j(`Environment`,z(e.resolved)),j(`Selected`,B(e.resolved,e.refresh,e.cliName)),...A(e.live)].join(`
+import{f as e,t}from"./env-DGAe95Xm.js";import{a as n}from"./auth-resolver-CRpJNNB2.js";import{i as r,l as i}from"./openapi-call-DRowSHyQ.js";import{a,i as o}from"./response-problem-Dr3Yy1lJ.js";import{t as s}from"./api-key-credential-v7YT_b1y.js";import{t as c}from"./credential-redaction-Cl6Eny3X.js";import{t as l}from"./api-key-bearer-credential-DpuLoYkG.js";import{a as u,f as d,l as f,s as p}from"./oauth-credential-D5ioBfGK.js";import{t as m}from"./oauth-bearer-credential-CxuQ4uM5.js";async function h(){return null}async function g(e){let t=null,n=e=>{t=e};try{await m(e,n),await l(n)}catch(e){return{materialized:t,failure:c(e)}}return{materialized:t,failure:null}}async function _(e,t,n,i){if(i.failure!==null)return{scope:e,selected:null,identity:null,authorization:null,error:i.failure};let a=null,o=null,s,l=e=>{s=e,o=v(e.credential,i.materialized)};try{let t=await r({method:`POST`,path:`/v1/auth/me/permissions`,body:{operation:[]},auth:e,requesterScope:e,responseFormat:`json`,onAuthPrepared:l});if(!t.ok)throw Error([t.summary,...t.warnings].join(` — `));if(o===null)throw Error(`Live permission probe did not prepare a credential`);if(a=S(t.data),e===`read`)return{scope:e,selected:o,identity:null,authorization:a,error:null};if(s===void 0)throw Error(`Live permission probe did not retain its prepared credential`);let n=await h(e,s);return{scope:e,selected:o,identity:n,authorization:a,error:null}}catch(r){return{scope:e,selected:o,identity:null,authorization:a,error:c(r,y(t,n,s))}}}function v(e,t){if(e===null)return null;let r=t??n().source;if(r===null)throw Error(`Prepared credential has no local provenance`);return{credential:e,source:r}}function y(t,n,r){return[e().userBearerToken,...a(r?.headers??{}),...t.state===`found`?d(t.stored.credential.tokens):[],n.state===`found`?n.stored.credential.secret:void 0]}function b(e,t,n=null){let r=t.state===`found`?t.stored:void 0,i=r?.credential.apiKey.expiresAt??null;return{host:e,present:r!==void 0,provider:r?.provider??null,activation:r===void 0?null:s(r.activation),apiKeyId:r?.credential.apiKey.id??null,subject:r?.credential.apiKey.subject??null,scope:r?.credential.apiKey.scopes??[],name:r===void 0?null:o(r.credential.apiKey.name,[r.credential.secret]),status:r?.credential.apiKey.status??null,expiresAt:i,metadataSource:r===void 0?null:n?.state===`verified`?`clerk`:`store-cache`,live:n===null?null:{state:n.state,summary:n.summary},expiresInDay:w(i),storageFailure:t.state===`unavailable`?t.summary:null,keyringFailure:t.state===`missing`?t.keyringFailure??null:null,error:t.state===`invalid`?t.summary:null}}function x(e,t){let n=t.state===`found`?t.stored:void 0;return{host:e,present:n!==void 0,provider:n?.provider??null,expiresAt:n?.credential.expiresAt??null,expired:n===void 0?null:u(n.credential),renewable:n===void 0?null:n.credential.tokens.refresh_token!==void 0,identity:n===void 0?null:f(n.credential),client:n?.credential.client??null,storageFailure:t.state===`unavailable`?t.summary:null,keyringFailure:t.state===`missing`?t.keyringFailure??null:null,error:t.state===`invalid`?t.summary:null}}function S(e){if(typeof e!=`object`||!e||e instanceof Uint8Array)throw Error(`permission probe returned no JSON response`);let t=i.safeParse(e.response);if(!t.success)throw t.error;return t.data}var C=864e5;function w(e){if(e===null)return null;let t=new Date(e).getTime();return Number.isNaN(t)?null:Math.round((t-Date.now())/C)}var T=7;function E(e){return e===null?`none`:e.length<=11?e:`${e.slice(0,T)}\u2026${e.slice(-4)}`}var D=13,O=14;function k(e){return[``,`${e.cliName} ${e.cliVersion} \u2192 ${e.apiKey.host}`+(e.apiVersion===null?` (api build unavailable)`:` (api ${e.apiVersion})`),``,...N(e.oauth,e.cliName,e.refresh),...F(e.apiKey,e.oauth,e.cliName,e.apiKeyPhase),``,j(`Providers`,R(e.providers)),j(`Environment`,z(e.resolved)),j(`Selected`,B(e.resolved,e.refresh,e.cliName)),...A(e.live)].join(`
 `)}function A(e){if(e===null)return[];let t=M(`local credential provenance was captured before verification`);if(e.error!==null)return[``,j(`Live probe`,`${e.scope} permission probe failed`),t,M(e.error)];if(e.authorization===null)return[];let n=e.authorization.permissionGrant,r=e.identity;return[``,j(`Live probe`,`${e.scope} permission probe succeeded`),t,M(`operation access ${e.authorization.operationAccess}; ${n.role.length} role; ${n.permission.length} permission`),...r===null?[M(e.scope===`read`?`identity not requested for a read-scope credential`:`identity unavailable in this build`)]:[j(`Live account`,r.nameFull??r.email??r.clerkUserId??r.id)],M(`no API operation was executed or individually authorized`)]}function j(e,t){return`  ${e.padEnd(D)}${t}`}function M(e){return`  ${``.padEnd(D)}${e}`}function N(e,t,n){switch(e.state){case`found`:{let{credential:r,provider:i}=e.stored,a=f(r);return[j(`OAuth`,`${a.email??a.subject??`unknown identity`} via ${i}`),M(P(r,t,n))]}case`missing`:return[j(`OAuth`,`none stored`),...e.keyringFailure===void 0?[]:[M(`OS keyring unusable — login stores to file: ${e.keyringFailure}`)]];case`unavailable`:return[j(`OAuth`,`storage unavailable: ${e.summary}`)];case`invalid`:return[j(`OAuth`,`stored credential invalid: ${e.summary}`)];default:throw Error(`Unsupported OAuth credential state`)}}function P(e,t,n){return u(e)?e.tokens.refresh_token===void 0?`access token expired — run \`${t} auth login\``:n.failure===null?n.materialized===`api-key`?`access token expired and renewal failed; the API key is in use — \`${t} auth login\` renews OAuth`:`access token expired — not renewed while AUTH_TOKEN is set in the environment`:`access token expired — ${n.failure}`:`access token valid until ${e.expiresAt}`}function F(e,t,n,r){if(!e.present){if(t.state===`found`)return[];let r=e.storageFailure??(t.state===`unavailable`?t.summary:null);return r===null?[j(`Signed in`,`no \u2014 run \`${n} auth login\``),...e.error===null?[]:[M(`stored credential invalid: ${e.error}`)]]:[j(`Signed in`,`credential storage unavailable`),M(r)]}return[j(t.state===`found`?`API key`:`Signed in`,r===`revoking`?`no — API-key revocation pending`:e.subject??`unknown subject`),M(`via ${e.provider??`unknown store`}`),j(`Key`,`${e.name??`unnamed`}  ${E(e.apiKeyId)}`),...I(e,n,r),j(`Scopes`,e.scope.length===0?`none`:e.scope.join(`, `))]}function I(e,t,n){if(n===`revoking`)return[j(`Key state`,`revocation pending; unavailable to ordinary commands`),M(`run \`${t} auth login --key\` to resume cleanup; it cannot reactivate this key`)];let r=e.live,i=e.expiresInDay,a=e.expiresAt;if(r?.state===`invalid`)return[j(`Key state`,`rejected by aVenture sign-in \u2014 ${r.summary}`),M(`run \`${t} auth logout\`, then \`${t} auth login --key\``)];let o=r?.state===`verified`;return[j(`Key state`,o?`${e.status??`unknown`}, verified by aVenture sign-in now`:`${e.status??`unknown`} when stored`),...a===null||i===null?[M(`no expiry recorded`)]:[M(L(a,i,o?`expires`:`cached expiry`))],...o?[]:[M(r===null?"aVenture sign-in owns the live verdict — `auth status` re-checks it":`aVenture sign-in could not be reached \u2014 ${r.summary}`)]]}function L(e,t,n){let r=e.slice(0,10);return new Date(e).getTime()<=Date.now()?`${n} ${r} passed ${Math.abs(t)}d ago`:t<=O?`${n} ${r}, ${t}d away`:`${n} ${r}`}function R(e){if(e.state===`unavailable`)return`unavailable: ${e.summary}`;let t=e.catalog.oauthClient;return[e.catalog.clerkPublishableKey?`browser sign-in`:`no browser sign-in`,t?`oauth ${p(t).host} client ${t.clientId}`:`no OAuth CLI client`].join(`; `)}function z(e){return`${t.authToken}=${e.present?e.source??`resolved`:`unset`}`}function B(e,n,r){return e.present||n.materialized===`env`?`${t.authToken} from the environment`:n.materialized===`oauth`?`saved OAuth access token`:n.materialized===`api-key`?`saved API key`:`none \u2014 sign in with \`${r} auth login\``}export{b as apiKeyCredentialDiagnostics,_ as inspectLiveAuth,x as oauthCredentialDiagnostics,g as refreshCliCredentials,k as renderAuthStatus};

package/dist/chunks/{aventure-cli-CgIcnt5d.js → aventure-cli-SEyW_1AB.js}

@@ -1,11 +1,11 @@
-import{a as e,n as t,o as n,r,t as i}from"./commander-DEj7N1b9.js";import{a}from"./package-DEeHDoOT.js";import{a as o,c as s,r as c}from"./env-DGAe95Xm.js";import{c as l,p as u,r as d}from"./result-envelope-BMqcRDpc.js";import{L as f,R as p,o as m,t as h,u as g,y as _}from"./tool-policy-DG8pafmI.js";import{i as v}from"./logging-DYzy2g8p.js";import{r as y,t as b}from"./cli-help-policy-DCn_wXe1.js";import{a as x,c as S,d as ee,f as te,i as C,l as w,m as ne,n as re,p as ie,r as ae,s as oe,t as se,u as ce}from"./startup-auth-DIefBEfE.js";import{t as T}from"./openapi-commands-B2dIDk9o.js";import{g as le,m as ue}from"./help-catalog-PSifyPm6.js";import{n as de,t as fe}from"./operations-metadata-CzOMH0PS.js";import{a as E,i as pe,t as D}from"./output-mode-DIt-t4Fu.js";import{S as me,_ as O,a as he,b as k,c as ge,d as _e,f as ve,g as ye,h as be,i as xe,l as Se,m as A,n as j,o as Ce,p as we,r as Te,s as Ee,t as De,u as Oe,v as M,x as ke,y as N}from"./generated-option-order-DYmytWyF.js";import{n as Ae,t as je}from"./deprecated-command-bF9Q8_F6.js";import{a as Me,i as Ne,n as Pe,r as Fe}from"./payload-operand-guard-Cne4mq9F.js";import{fileURLToPath as Ie}from"node:url";import{readFile as Le}from"node:fs/promises";async function Re(e){let t;try{t=e===`-`?await ze():await Le(e,`utf8`)}catch(t){return d(`Could not read input: ${t.message}`,[`path=${e}`])}try{if(t.trim().length===0)return l(`No input provided`,null);let e=JSON.parse(t);return l(`Input parsed`,e)}catch(e){return d(`Input is not valid JSON: ${e.message}`)}}async function ze(){if(process.stdin.isTTY)throw Error(`--from-file - requires JSON on stdin, but stdin is a TTY`);process.stdin.setEncoding(`utf8`);let e=``;for await(let t of process.stdin)e+=t;return e}var P=`--content-type`;function Be(e,n,r){let i=e=>!r?.has(e)&&(r?.add(e),!0),a=n.requestBody??[];if(a.length>1&&i(P)){let n=a.map(({contentType:e})=>e);e.addOption(new t(`${P} <media-type>`,`Select the request body encoding, never an uploaded file's media type; omit for ${n[0]}.`).choices(n).argParser(He(a)))}if(z(n)&&i(`--from-file`)){let r=a[0];if(r===void 0)throw Error(`${n.operationId} has no request body`);e.addOption(new t(`--from-file <path>`,he(r,r.requiredPath)).argParser(F(`--from-file`)))}let o=Ce(a).filter(e=>i(I(e.variant[0].parameter)));for(let n of o.toSorted((e,t)=>j(e.variant[0].parameter,t.variant[0].parameter))){let{descriptor:r,parameter:i}=n.variant[0],o=new t(xe(n),a.length>1?Te(n):ge(r,i));a.length===1&&i.envName!==void 0&&o.env(i.envName);let s=a.length===1?Ee(r,i.optionKey):[];s.length>0&&o.conflicts(s),a.length>1?o.argParser(Ve):M(i.name)||i.schemaType===`array`?o.argParser(Ue):o.argParser(F(i.flag)),e.addOption(o),o.envVar!==void 0&&e.on(`optionEnv:${o.name()}`,()=>{let t=e.opts()[i.optionKey];typeof t==`string`&&t.trim()&&e.setOptionValueWithSource(i.optionKey,t.trim(),`env`)})}nt(e,n,o)}function Ve(e,t){return t===void 0?e:typeof t==`string`?[t,e]:[...t,e]}function He(e){return(t,r)=>{if(r!==void 0)throw new n(`${P} was already given; pass it once.`);let i=_(e,t);if(!i.ok)throw new n(i.summary);return t}}function Ue(e,t){return[...t??[],e]}function F(e){let t=e.split(/\s+/u)[0]??e;return(e,r)=>{if(r!==void 0)throw new n(`${t} was already given; pass it once.`);return e}}async function We(e,t){let n=w(e,t),r=_(e.requestBody??[],n);if(!r.ok||r.data===null)return d(r.summary,r.warnings);let i=r.data;if(i===void 0)return l(`No body`,void 0);let a=Ge(e,i,t);if(a!==null)return d(a);let o=A(e.operationId,i,t);if(!o.ok)return d(o.summary,o.warnings);t=o.data;let s=Ke(i,t);if(s!==null)return d(s);let c=await Xe(t);if(!c.ok)return d(c.summary,c.warnings);let u=be(e.requestBody??[],i,c.data);if(u!==null)return d(u);let f=Ye(e.operationId,i,c.data);if(!f.ok)return f;let p=ye(e.operationId,i,c.data);if(p!==null)return d(p);let m=Ze(e.operationId,i,t);if(!m.ok)return m;if(c.data===void 0&&m.data===void 0)return i.required?d(tt(e.operationId,i)):l(`No body`,void 0);let h=$e(e.operationId,i,c.data,m.data);if(!h.ok||h.data===void 0)return h;if(i.schemaType===`array`&&!Array.isArray(h.data))return d(`${e.operationId} requires a JSON array body.`);if(i.parameter.length>0&&!N(h.data)){let t=i.kind===`multipart`?` keyed by multipart part name`:` body`;return d(`${e.operationId} requires a JSON object${t}.`)}let g=Je(i,h.data);if(g.length>0)return d(`${e.operationId} requires body option(s): ${g.join(`, `)}`);let v=h.data,y=N(v)?k(i).filter(e=>!O(v,e)):[];return y.length>0?d(qe(e.operationId,i,y)):h}function Ge(e,t,n){let r=new Set(t.parameter.map(({optionKey:e})=>e));for(let i of e.requestBody??[])if(i!==t)for(let t of i.parameter){if(r.has(t.optionKey)||n[t.optionKey]===void 0)continue;let i=(e.requestBody??[]).filter(e=>e.parameter.some(({optionKey:e})=>e===t.optionKey)).map(({contentType:e})=>e);return`${I(t)} requires ${P} ${i.join(` or `)}.`}return null}function Ke(e,t){for(let n of e.cliConflicts??[]){let e=n.filter(e=>t[e]!==void 0);if(e.length>1)return`Options ${e.join(`, `)} cannot be used together.`}return null}function qe(e,t,n){let r=`${e} requires JSON body path(s): ${n.join(`, `)}`;return t.kind===`multipart`?`${r}. ${n.includes(`body`)?`For multipart --from-file, wrap the endpoint JSON under top-level "body".`:`For multipart --from-file, put the missing nested path(s) inside top-level "body".`}`:r}function Je(e,t){return N(t)?e.parameter.filter(e=>e.required&&!O(t,e.name)).map(I):[]}function Ye(e,t,n){let r=me(t,n);return r===null?l(`Body file paths validated`,null):d(`${e} --from-file contains ${r.message}`)}async function Xe(e){let t=typeof e.fromFile==`string`?e.fromFile:void 0;if(t===void 0)return l(`No body file`,void 0);let n=await Re(t);if(!n.ok)return d(n.summary,n.warnings);let r=u.safeParse(n.data);return r.success?l(`Input parsed`,r.data):d(`Input is not valid JSON value: ${r.error.message}`)}function Ze(e,t,n){let r={},i=!1;for(let e of t.parameter){let a=ke(e,n[e.optionKey]);if(!a.ok||a.data===null)return d(a.summary,a.warnings);let o=a.data;if(o===void 0)continue;let s=Qe(t,n,r,e,o);if(!s.ok)return d(s.summary,s.warnings);i=!0}if(!i)return l(`No direct body options`,void 0);let a=_e(e,t,n,r);return a===null?l(`Direct body options parsed`,r):a}function Qe(e,t,n,r,i){let a=Se(e,t,r);if(a===null){let e=et(r,i);return e.ok?ve(n,r.name,e.data,r.schemaType===`array`):d(e.summary,e.warnings)}let o=Oe(e,t,r,a);if(o!==null)return d(o);let s=r.schemaType===`array`,c=s?r.itemSchemaType:r.schemaType;for(let[e,t]of a.rows){let i=[];for(let e of t){let t=R(r,c,e);if(!t.ok)return d(t.summary,t.warnings);i.push(t.data)}for(let t of s?[i]:i){let i=we(n,r.name,e,t);if(!i.ok)return i}}return l(`Body value assigned`,null)}var I=e=>e.flag.split(` `)[0]??e.name;function $e(e,t,n,r){if(n===void 0)return l(`Direct body parsed`,r);if(r===void 0)return l(`Input parsed`,n);if(N(n)&&N(r))try{return l(`Input parsed`,L(t,n,r))}catch(t){return d(`${e} ${t instanceof Error?t.message:String(t)}`)}return d(`${e} cannot combine --from-file with direct body options unless the file body is an object.`)}function L(e,t,n,r=``){let i={...t};for(let[t,a]of Object.entries(n)){let n=i[t],o=`${r}${t}`;if(N(n)&&N(a))i[t]=L(e,n,a,`${o}.`);else if(n===void 0||n===a)i[t]=a;else throw Error(`sets JSON key '${o}' both in --from-file and with ${e.parameter.find(({name:e})=>e===o)?.flag.split(` `)[0]??`body options`} — set it in one place${Array.isArray(n)?`: move the per-item fields inside the matching '${o}[]' object(s) in the file body`:ue.test(o)?`; keep multi-line text in the --from-file body`:``}.`)}return i}function et(e,t){if(typeof t==`boolean`)return l(`Body value parsed`,t);if(t===void 0||typeof t==`string`)return R(e,e.schemaType,t??``);let n=[],r=M(e.name)&&e.schemaType!==`array`?e.schemaType:e.itemSchemaType;for(let i of t){let t=R(e,r,i);if(!t.ok)return t;n.push(t.data)}return l(`Body value parsed`,n)}function R(e,t,n){if(n===`null`&&e.nullable&&t===e.schemaType)return l(`Body value parsed`,null);let r=e.name;if(t===`boolean`)return n===`true`?l(`Body value parsed`,!0):n===`false`?l(`Body value parsed`,!1):d(`${r} must be true or false.`);if(t===`number`||t===`integer`){let e=n.trim(),i=Number(e);return e===``||!Number.isFinite(i)?d(`${r} must be a finite ${t}.`):t===`integer`&&!Number.isInteger(i)?d(`${r} must be an integer.`):l(`Body value parsed`,i)}return l(`Body value parsed`,n)}function tt(e,t){let n=t.parameter.filter(e=>e.required);if(n.length>0&&t.requiredPath.every(e=>n.some(({name:t})=>t===e||t.startsWith(`${e}.`))))return`${e} requires body option(s): ${n.map(I).join(`, `)}`;let r=k(t);if(r.length>0)return`${e} requires --from-file with JSON body path(s): ${r.join(`, `)}`;let i=t.parameter.map(I).join(`, `);return i.length===0?`${e} requires --from-file`:`${e} requires --from-file or body option(s): ${i}`}function nt(e,t,n){let r=[...t.parameters,...n.map(({variant:e})=>e[0].parameter)];(t.requestBody?.length??0)>1&&r.push({optionKey:`contentType`,flag:P,location:`body`}),z(t)&&r.push({optionKey:`fromFile`,flag:`--from-file`,location:`body`}),De(e.options,r)}function z(e){return(e.requestBody??[]).some(e=>e.kind!==`multipart`||e.parameter.some(e=>e.schemaFormat!==`binary`))}function rt(e,t,n=a().bin[0]){e.helpCommand(!1);let r=e.commands.find(e=>e.name()===`help`)??e.command(`help`);r.summary(`Show full documentation for a command, search the catalog, or ask a question`).description("Show a command's full documentation offline. Select it by command path,\noperationId, or `<METHOD> <path>`; `<command> --help` prints only its usage.\n`help catalog [query...]` searches or lists every operation;\n`help ask <question>` answers a platform question.").argument(`[command...]`,"command path, operationId, or METHOD and path, e.g. `help entities get`"),r.addOption(new it(r)),r.hook(`preSubcommand`,e=>{e.opts().help&&e.help()}),D(r),r.action(async function(r){let i=r.flatMap(e=>e.split(/\s+/u).filter(Boolean)),{emit:a}=await import(`./output-XyvDx9ok.js`),o=this.optsWithGlobals();if(o.help&&i.length===0){this.outputHelp();return}let s=G(e,i),c=t.find(t=>s!==void 0&&G(e,t.cliPath)===s);if(o.help||s!==void 0&&c===void 0){s===void 0&&this.error(`unknown command '${i.join(` `)}' (run \`${n} --help\` for the command tree)`),s.outputHelp();return}let u=c===void 0?await st(i,t):l(`Resolved by command path`,{operationId:c.operationId});if(u.ok&&u.data?.command!==void 0&&this.error(`unknown command '${i.join(` `)}' (run \`${n} --help\` for the command tree)`),!u.ok||u.data===null){a({mode:E(o)},u);return}let{writeShowResult:d}=await import(`./operations-catalog-BfuHbIDu.js`);d({...o,...u.data},t,E(o,`text`),n)}),ot(e,t,n)}var it=class extends t{helpCommand;constructor(e){super(`-h, --help`,`display help for command`),this.helpCommand=e}is(e){if(e!==this.short&&e!==this.long)return!1;let t=this.helpCommand.parent?.args??[],n=t.findIndex(e=>e===this.helpCommand.name()||this.helpCommand.aliases().includes(e)),r=n<0?void 0:t[n+1];return r===void 0||r.startsWith(`-`)?!0:!this.helpCommand.commands.some(e=>e.name()===r||e.aliases().includes(r))}},B=2,V=6,at={formatHelp(e,t){let n=n=>r.prototype.formatHelp.call(this,e,Object.assign(Object.create(t),n));if(t.visibleCommands(e).length===0)return n({});let i=t.padWidth(e,t),a={padWidth:()=>i,visibleOptions:()=>[],showGlobalOptions:!1},o=n({...a,visibleCommands:()=>[]}),s=n({padWidth:()=>i,visibleCommands:()=>[]}).slice(o.length);return n(a)+s},visibleCommands(e){let t=r.prototype.visibleCommands.call(this,e);return e.parent===null?t.filter(e=>S[e.name()]?.listed!==!1):t},subcommandTerm(e){let t=r.prototype.subcommandTerm.call(this,e);return e.commands.length>0&&e.registeredArguments.length===0?`${t} <command>`:t},formatItem(e,t,n,i){let a=i.helpWidth??80,o=a-t-4;return n===``||o>=i.minWidthToWrap?r.prototype.formatItem.call(i,e,t,n,i):`${` `.repeat(B)}${e}\n${H(n,a,i)}`}};function H(e,t,n){return n.boxWrap(e,t-V).replace(/^/gmu,` `.repeat(V))}function ot(e,t,n){for(let r of t){let i=G(e,r.cliPath);i!==void 0&&i.addHelpText(`after`,()=>{let e=i.createHelp(),a=i.configureOutput().getOutHelpWidth?.();e.prepareContext(a===void 0?{}:{helpWidth:a});let o=e.helpWidth??80,s=le(r.operationId,t,n),c=U(de(r.header),o,e),l=U(fe(r.errorResponse),o,e);return`\n${[...s,...c,...l].join(`
-`)}\n`})}}function U(e,t,n){let[r,...i]=e;return r===void 0?[]:[``,r,...i.map(e=>H(e.trimStart(),t,n).replace(/^ +/u,` `.repeat(B)))]}var W='Accepted selectors: `<METHOD> <route template or concrete path>`, an operationId, or a CLI command path such as "entities get".';async function st(e,t){let[n=``,...r]=e.join(` `).trim().split(/\s+/u),[i,...a]=t.filter(e=>e.path===n);if(r.length===0&&i!==void 0)return a.length===0?l(`Resolved by route`,{operationId:i.operationId}):d(`${n} is served by ${[i,...a].map(({method:e})=>e).join(`, `)}; name the method, as in \`help ${i.method} ${n}\`.`,[W]);let o=f.find(e=>e===n.toLowerCase());if(o===void 0||r.length===0){let n=e.join(` `).trim();return l(`Resolved by name`,t.some(e=>e.operationId===n)?{operationId:n}:{command:n})}let s=p(o),c=r.join(``),u=t.find(e=>e.method===s&&e.path===c);if(u!==void 0)return l(`Resolved by route template`,{operationId:u.operationId});let{resolveOpenApiOperationSelector:m}=await import(`./openapi-call-BN_q73Gl.js`),h=m({method:s,path:c});return!h.ok||h.data===null?d(h.summary,[...h.warnings,W]):l(`Resolved by method and path`,{operationId:h.data.operation.operationId})}function G(e,t){let n=e;for(let e of t){let t=n.commands.find(t=>t.name()===e||t.aliases().includes(e));if(t===void 0)return;n=t}return n}function ct(e,t,n){if(e.cliPath[0]!==`lookup`||!lt(n))return null;let r=[...(e.requestBody??[]).flatMap(e=>e.parameter),...e.parameters,{name:`fromFile`,optionKey:`fromFile`}],i=r.filter(({optionKey:e},t)=>r.findIndex(t=>t.optionKey===e)===t).filter(({optionKey:e})=>t[e]!==void 0).map(({name:e,optionKey:n})=>`${e}=${String(t[n])}`),a=`no record for ${i.length===0?`the given input`:i.join(`, `)}`;return n.ok?d(a):d(a,[],{httpStatus:n.httpStatus,problem:n.problem})}function lt(e){return e.ok?Array.isArray(e.data)&&e.data.length===0:e.httpStatus===404}function ut(t,n,r,i){let a=dt(t,r),o=a instanceof e?[]:a,s=o[0],c=i.bin[0],l=[{selected:s===`auth`,register:async()=>{let{registerBuiltinAuthCommands:e}=await import(`./builtin-auth-8D5ET0Cp.js`);e(n,c)}},{selected:s===`agents`,register:async()=>{let{registerBuiltinAgentSetupCommand:e}=await import(`./builtin-agent-setup-B2Xvqera.js`);e(n,c)}},{selected:s===`update`,register:async()=>{let{registerBuiltinUpdateCommand:e}=await import(`./builtin-update-DJT_3I5O.js`);e(n,i)}},{selected:s===`batch`,register:async()=>{let{registerBuiltinBatchCommand:e}=await import(`./builtin-batch-DdGyCjlR.js`);e(n,r,c)}},{selected:s===`research`||s===`research-runs`||s===`data-engineering`,register:async()=>{let{registerBuiltinRunWaitCommand:e}=await import(`./builtin-run-wait-bdVye6Ce.js`);await e(n)}},{selected:s===`completion`,register:async()=>{let{registerCompletionCommand:e}=await import(`./completion-CnY6V98Y.js`);e(n,r,c)}},{selected:s===`help`,register:async()=>{let{registerHelpCatalogCommand:e}=await import(`./operations-Dger9pq7.js`);e(n,r,c)}},{selected:s===`command-catalog`,register:async()=>{let{registerRetiredCommandCatalog:e}=await import(`./operations-Dger9pq7.js`);e(n,r,c)}}],u=s===void 0||s===`help`||s===`completion`||s===`command-catalog`||!l.some(e=>e.selected)&&!r.some(e=>e.cliPath[0]===s),d=1;for(;d<o.length&&r.some(e=>o.slice(0,d+1).every((t,n)=>e.cliPath[n]===t));)d++;let f=o.slice(0,d),p=u?r:r.filter(e=>f.slice(0,e.cliPath.length).every((t,n)=>e.cliPath[n]===t)),m=new Set,h=async(e=!1)=>{for(let t of l)(e||u||t.selected)&&!m.has(t)&&(await t.register(),m.add(t))};return{generated:p,fullTree:u,rootHelp:t.length>0&&t.every(e=>e===`--help`||e===`-h`),registerBuiltin:h,async completeTree(e){e(n,r.filter(e=>!p.includes(e))),await h(!0)}}}function dt(t,n){try{return new i().parseOptions([...C(t,n).commandArgv]).operands}catch(t){if(!(t instanceof e))throw t;return t}}var K=new Set(T.map(e=>e.cliPath.join(` `)));function q(e,t){e.showHelpAfterError(!1).exitOverride(t(e)),e.commands.length===0?e.hook(`preAction`,Pe):e.registeredArguments.length===0&&!K.has(Me(e).join(` `))&&e.addHelpOption(new Ne(e));for(let n of e.commands)q(n,t)}function J(e){return b[y(e,S)??`cli`]}function Y(e,t,n,{rootHelp:r=!1}={}){let i=t.map(e=>{let t=e.cliPath[0]??``;return{spec:e,top:t,rank:J(t).rank}}).toSorted((e,t)=>e.rank-t.rank||e.top.localeCompare(t.top)).map(e=>e.spec),a=new Set(i.filter(e=>se(e.cliPath[0])).map(e=>e.cliPath[0]??``)),o=new Set,s=new Set;for(let{cliPath:e,deprecated:t}of i)for(let n=1;n<e.length;n++){let r=e.slice(0,n).join(` `);o.add(r),t!==!0&&s.add(r)}for(let t of i)ft(e,t,a,s,o.has(t.cliPath.join(` `)),n,!r||t.cliPath.length===1)}function ft(e,n,r,i,a,o,s){let c=n.cliPath,l=e,u=``,f=!r.has(c[0]??``);for(let e of c.slice(0,-1)){u=u===``?e:`${u} ${e}`;let t=f&&u===e||!i.has(u);l=pt(l,e,u,t)}let p=c.at(-1)??n.operationId,_=n.deprecated===!0&&i.has(c.join(` `)),v=l.commands.find(e=>e.name()===p)??l.command(p,n.deprecated===!0&&!_?{hidden:!0}:{}),y=n.requestBody?.flatMap(({parameter:e})=>e)??[];if(v.summary((_?S[c.join(` `)]?.summary:void 0)??(n.summary||n.operationId)).description([`${n.method} ${n.path}.`,n.summary||n.description,`Full documentation: ${o} help ${n.cliPath.join(` `)}`,n.requestBody?.[0]?.kind===`json`||[...n.parameters,...y].some(e=>m(e.schemaType,e.itemSchemaType))?h:``].filter(Boolean).join(`
-`)),!s)return;let b=ie(n);for(let e of n.parameters)mt(v,e,a||e===b);Be(v,n),g(n.intent)&&!v.options.some(e=>e.long===`--execute`)&&v.addOption(new t(`--execute`).hideHelp()),D(v),v.hook(`preAction`,e=>te(e,n)),n.explain===!0&&v.option(`--explain`,`Print the search strategy and parsed constraints before the results`),b!==void 0&&v.argument(`[text...]`,b.description||`Same as ${ce(b.flag)}.`),v.action(async function(){let{emit:e,emitSearchExplanation:t}=await import(`./output-XyvDx9ok.js`),r=Object.assign(this.optsWithGlobals(),{environment:this.opts().environment}),i=E(r),a=r;if(b!==void 0){let t=ne(b,this.args,r);if(!t.ok)return e({mode:i},{...t,notDispatched:!0});if(t.data===null)return e({mode:i},t);a=t.data}let o=ee(n,a);if(o.length>0){let t=`missing required options: ${o.join(`, `)}`;return e({mode:i},d(t,[],{notDispatched:!0}))}let s=await ht(n,a,i),c=ct(n,a,s);if(c!==null)return e({mode:i},c);r.explain===!0&&s.ok&&t(i,s.data),s.ok&&s.data instanceof Uint8Array&&i!==`csv`&&i!==`xlsx`?process.stdout.write(s.data):e({mode:i},s)})}function pt(e,t,n,r){let i=e.commands.find(e=>e.name()===t);if(i!==void 0)return i;let a=S[n],o=e.command(t,r?{hidden:!0}:{}).helpCommand(!1);return a!==void 0&&o.summary(a.summary).description(a.summary),o}function mt(e,n,r=!1){let i=n.description||`${n.name} ${n.location} parameter`,a=n.defaultValue===void 0?void 0:typeof n.defaultValue==`string`||typeof n.defaultValue==`boolean`?n.defaultValue:[...n.defaultValue];if(n.legacyFlag!==void 0){let o=new t(n.flag,i);a!==void 0&&o.default(a);let s=new t(n.legacyFlag,i).conflicts(n.optionKey);e.addOption(o).addOption(s),e.hook(`preAction`,e=>{let t=e.opts(),i=t[n.optionKey],a=t[s.attributeName()];a===void 0?!r&&n.required&&i===void 0&&e.error(`error: required option '${o.flags}' not specified`,{code:`commander.missingMandatoryOptionValue`}):(i===void 0||e.getOptionValueSource(n.optionKey)==="default")&&e.setOptionValueWithSource(n.optionKey,a,`cli`)})}else a===void 0?n.required&&!r?e.requiredOption(n.flag,i):e.option(n.flag,i):e.option(n.flag,i,a)}async function ht(e,t,n){let{buildOpenApiPath:r,runOpenApiCall:i}=await import(`./openapi-call-BN_q73Gl.js`),{pendingResult:a}=await import(`./output-XyvDx9ok.js`),o=await We(e,t);if(!o.ok)return{...o,notDispatched:!0};let s=!1,c=Object.fromEntries(e.parameters.filter(e=>e.location===`path`).map(e=>{let n=t[e.optionKey];if(Array.isArray(n))return[e.name,n.at(0)??``];if(n===void 0)throw Error(`Missing required option ${e.optionKey}`);return[e.name,String(n)]})),l=Object.fromEntries(e.parameters.filter(e=>e.location===`query`).flatMap(e=>{let n=t[e.optionKey];if(n===void 0||Array.isArray(n)&&n.length===0)return[];let r=Array.isArray(n)||typeof n==`boolean`?n:String(n);return[[e.name,r]]})),u=Object.fromEntries(e.parameters.filter(e=>e.location===`header`).flatMap(e=>{let n=t[e.optionKey];return n===void 0||Array.isArray(n)&&n.length===0?[]:[[e.name,Array.isArray(n)?n.join(`,`):String(n)]]})),d=await i({method:e.method,path:r(e.operationId,c),searchParams:l,headers:u,body:o.data,contentType:w(e,t),auth:e.auth,responseFormat:pe(n),responseBytes:e.binaryResponse===!0,pendingResult:a,onDispatch:()=>{s=!0}});return je(e,d.ok||s?d:{...d,notDispatched:!0})}async function gt(e,n){let r=n.bin[0],i=Ae(T),a=re(e,i),l=a===`required`?i:oe(i),u=new Fe;u.enablePositionalOptions(!x(e)&&C(e,i).positionalOptions).name(r).usage(`[--environment <environment>] <command> [subcommand] [options]`).configureHelp(at).summary(`CLI for the aVenture API: companies, people, and news, with the funding, publications, and classifications attached to them`).description(`The aVenture research API from your terminal. Three records — companies,
+import{a as e,n as t,o as n,r,t as i}from"./commander-DEj7N1b9.js";import{a}from"./package-DEeHDoOT.js";import{a as o,c as s,r as c}from"./env-DGAe95Xm.js";import{c as l,p as u,r as d}from"./result-envelope-BMqcRDpc.js";import{L as f,R as p,o as m,t as h,u as g,y as _}from"./tool-policy-DG8pafmI.js";import{i as v}from"./logging-DYzy2g8p.js";import{r as y,t as b}from"./cli-help-policy-DCn_wXe1.js";import{a as x,c as S,d as ee,f as te,i as C,l as w,m as ne,n as re,p as ie,r as ae,s as oe,t as se,u as ce}from"./startup-auth-BuGIFRmd.js";import{t as T}from"./openapi-commands-B2dIDk9o.js";import{g as le,m as ue}from"./help-catalog-PSifyPm6.js";import{n as de,t as fe}from"./operations-metadata-CzOMH0PS.js";import{a as E,i as pe,t as D}from"./output-mode-DIt-t4Fu.js";import{S as me,_ as O,a as he,b as k,c as ge,d as _e,f as ve,g as ye,h as be,i as xe,l as Se,m as A,n as j,o as Ce,p as we,r as Te,s as Ee,t as De,u as Oe,v as M,x as ke,y as N}from"./generated-option-order-DYmytWyF.js";import{n as Ae,t as je}from"./deprecated-command-bF9Q8_F6.js";import{a as Me,i as Ne,n as Pe,r as Fe}from"./payload-operand-guard-Cne4mq9F.js";import{fileURLToPath as Ie}from"node:url";import{readFile as Le}from"node:fs/promises";async function Re(e){let t;try{t=e===`-`?await ze():await Le(e,`utf8`)}catch(t){return d(`Could not read input: ${t.message}`,[`path=${e}`])}try{if(t.trim().length===0)return l(`No input provided`,null);let e=JSON.parse(t);return l(`Input parsed`,e)}catch(e){return d(`Input is not valid JSON: ${e.message}`)}}async function ze(){if(process.stdin.isTTY)throw Error(`--from-file - requires JSON on stdin, but stdin is a TTY`);process.stdin.setEncoding(`utf8`);let e=``;for await(let t of process.stdin)e+=t;return e}var P=`--content-type`;function Be(e,n,r){let i=e=>!r?.has(e)&&(r?.add(e),!0),a=n.requestBody??[];if(a.length>1&&i(P)){let n=a.map(({contentType:e})=>e);e.addOption(new t(`${P} <media-type>`,`Select the request body encoding, never an uploaded file's media type; omit for ${n[0]}.`).choices(n).argParser(He(a)))}if(z(n)&&i(`--from-file`)){let r=a[0];if(r===void 0)throw Error(`${n.operationId} has no request body`);e.addOption(new t(`--from-file <path>`,he(r,r.requiredPath)).argParser(F(`--from-file`)))}let o=Ce(a).filter(e=>i(I(e.variant[0].parameter)));for(let n of o.toSorted((e,t)=>j(e.variant[0].parameter,t.variant[0].parameter))){let{descriptor:r,parameter:i}=n.variant[0],o=new t(xe(n),a.length>1?Te(n):ge(r,i));a.length===1&&i.envName!==void 0&&o.env(i.envName);let s=a.length===1?Ee(r,i.optionKey):[];s.length>0&&o.conflicts(s),a.length>1?o.argParser(Ve):M(i.name)||i.schemaType===`array`?o.argParser(Ue):o.argParser(F(i.flag)),e.addOption(o),o.envVar!==void 0&&e.on(`optionEnv:${o.name()}`,()=>{let t=e.opts()[i.optionKey];typeof t==`string`&&t.trim()&&e.setOptionValueWithSource(i.optionKey,t.trim(),`env`)})}nt(e,n,o)}function Ve(e,t){return t===void 0?e:typeof t==`string`?[t,e]:[...t,e]}function He(e){return(t,r)=>{if(r!==void 0)throw new n(`${P} was already given; pass it once.`);let i=_(e,t);if(!i.ok)throw new n(i.summary);return t}}function Ue(e,t){return[...t??[],e]}function F(e){let t=e.split(/\s+/u)[0]??e;return(e,r)=>{if(r!==void 0)throw new n(`${t} was already given; pass it once.`);return e}}async function We(e,t){let n=w(e,t),r=_(e.requestBody??[],n);if(!r.ok||r.data===null)return d(r.summary,r.warnings);let i=r.data;if(i===void 0)return l(`No body`,void 0);let a=Ge(e,i,t);if(a!==null)return d(a);let o=A(e.operationId,i,t);if(!o.ok)return d(o.summary,o.warnings);t=o.data;let s=Ke(i,t);if(s!==null)return d(s);let c=await Xe(t);if(!c.ok)return d(c.summary,c.warnings);let u=be(e.requestBody??[],i,c.data);if(u!==null)return d(u);let f=Ye(e.operationId,i,c.data);if(!f.ok)return f;let p=ye(e.operationId,i,c.data);if(p!==null)return d(p);let m=Ze(e.operationId,i,t);if(!m.ok)return m;if(c.data===void 0&&m.data===void 0)return i.required?d(tt(e.operationId,i)):l(`No body`,void 0);let h=$e(e.operationId,i,c.data,m.data);if(!h.ok||h.data===void 0)return h;if(i.schemaType===`array`&&!Array.isArray(h.data))return d(`${e.operationId} requires a JSON array body.`);if(i.parameter.length>0&&!N(h.data)){let t=i.kind===`multipart`?` keyed by multipart part name`:` body`;return d(`${e.operationId} requires a JSON object${t}.`)}let g=Je(i,h.data);if(g.length>0)return d(`${e.operationId} requires body option(s): ${g.join(`, `)}`);let v=h.data,y=N(v)?k(i).filter(e=>!O(v,e)):[];return y.length>0?d(qe(e.operationId,i,y)):h}function Ge(e,t,n){let r=new Set(t.parameter.map(({optionKey:e})=>e));for(let i of e.requestBody??[])if(i!==t)for(let t of i.parameter){if(r.has(t.optionKey)||n[t.optionKey]===void 0)continue;let i=(e.requestBody??[]).filter(e=>e.parameter.some(({optionKey:e})=>e===t.optionKey)).map(({contentType:e})=>e);return`${I(t)} requires ${P} ${i.join(` or `)}.`}return null}function Ke(e,t){for(let n of e.cliConflicts??[]){let e=n.filter(e=>t[e]!==void 0);if(e.length>1)return`Options ${e.join(`, `)} cannot be used together.`}return null}function qe(e,t,n){let r=`${e} requires JSON body path(s): ${n.join(`, `)}`;return t.kind===`multipart`?`${r}. ${n.includes(`body`)?`For multipart --from-file, wrap the endpoint JSON under top-level "body".`:`For multipart --from-file, put the missing nested path(s) inside top-level "body".`}`:r}function Je(e,t){return N(t)?e.parameter.filter(e=>e.required&&!O(t,e.name)).map(I):[]}function Ye(e,t,n){let r=me(t,n);return r===null?l(`Body file paths validated`,null):d(`${e} --from-file contains ${r.message}`)}async function Xe(e){let t=typeof e.fromFile==`string`?e.fromFile:void 0;if(t===void 0)return l(`No body file`,void 0);let n=await Re(t);if(!n.ok)return d(n.summary,n.warnings);let r=u.safeParse(n.data);return r.success?l(`Input parsed`,r.data):d(`Input is not valid JSON value: ${r.error.message}`)}function Ze(e,t,n){let r={},i=!1;for(let e of t.parameter){let a=ke(e,n[e.optionKey]);if(!a.ok||a.data===null)return d(a.summary,a.warnings);let o=a.data;if(o===void 0)continue;let s=Qe(t,n,r,e,o);if(!s.ok)return d(s.summary,s.warnings);i=!0}if(!i)return l(`No direct body options`,void 0);let a=_e(e,t,n,r);return a===null?l(`Direct body options parsed`,r):a}function Qe(e,t,n,r,i){let a=Se(e,t,r);if(a===null){let e=et(r,i);return e.ok?ve(n,r.name,e.data,r.schemaType===`array`):d(e.summary,e.warnings)}let o=Oe(e,t,r,a);if(o!==null)return d(o);let s=r.schemaType===`array`,c=s?r.itemSchemaType:r.schemaType;for(let[e,t]of a.rows){let i=[];for(let e of t){let t=R(r,c,e);if(!t.ok)return d(t.summary,t.warnings);i.push(t.data)}for(let t of s?[i]:i){let i=we(n,r.name,e,t);if(!i.ok)return i}}return l(`Body value assigned`,null)}var I=e=>e.flag.split(` `)[0]??e.name;function $e(e,t,n,r){if(n===void 0)return l(`Direct body parsed`,r);if(r===void 0)return l(`Input parsed`,n);if(N(n)&&N(r))try{return l(`Input parsed`,L(t,n,r))}catch(t){return d(`${e} ${t instanceof Error?t.message:String(t)}`)}return d(`${e} cannot combine --from-file with direct body options unless the file body is an object.`)}function L(e,t,n,r=``){let i={...t};for(let[t,a]of Object.entries(n)){let n=i[t],o=`${r}${t}`;if(N(n)&&N(a))i[t]=L(e,n,a,`${o}.`);else if(n===void 0||n===a)i[t]=a;else throw Error(`sets JSON key '${o}' both in --from-file and with ${e.parameter.find(({name:e})=>e===o)?.flag.split(` `)[0]??`body options`} — set it in one place${Array.isArray(n)?`: move the per-item fields inside the matching '${o}[]' object(s) in the file body`:ue.test(o)?`; keep multi-line text in the --from-file body`:``}.`)}return i}function et(e,t){if(typeof t==`boolean`)return l(`Body value parsed`,t);if(t===void 0||typeof t==`string`)return R(e,e.schemaType,t??``);let n=[],r=M(e.name)&&e.schemaType!==`array`?e.schemaType:e.itemSchemaType;for(let i of t){let t=R(e,r,i);if(!t.ok)return t;n.push(t.data)}return l(`Body value parsed`,n)}function R(e,t,n){if(n===`null`&&e.nullable&&t===e.schemaType)return l(`Body value parsed`,null);let r=e.name;if(t===`boolean`)return n===`true`?l(`Body value parsed`,!0):n===`false`?l(`Body value parsed`,!1):d(`${r} must be true or false.`);if(t===`number`||t===`integer`){let e=n.trim(),i=Number(e);return e===``||!Number.isFinite(i)?d(`${r} must be a finite ${t}.`):t===`integer`&&!Number.isInteger(i)?d(`${r} must be an integer.`):l(`Body value parsed`,i)}return l(`Body value parsed`,n)}function tt(e,t){let n=t.parameter.filter(e=>e.required);if(n.length>0&&t.requiredPath.every(e=>n.some(({name:t})=>t===e||t.startsWith(`${e}.`))))return`${e} requires body option(s): ${n.map(I).join(`, `)}`;let r=k(t);if(r.length>0)return`${e} requires --from-file with JSON body path(s): ${r.join(`, `)}`;let i=t.parameter.map(I).join(`, `);return i.length===0?`${e} requires --from-file`:`${e} requires --from-file or body option(s): ${i}`}function nt(e,t,n){let r=[...t.parameters,...n.map(({variant:e})=>e[0].parameter)];(t.requestBody?.length??0)>1&&r.push({optionKey:`contentType`,flag:P,location:`body`}),z(t)&&r.push({optionKey:`fromFile`,flag:`--from-file`,location:`body`}),De(e.options,r)}function z(e){return(e.requestBody??[]).some(e=>e.kind!==`multipart`||e.parameter.some(e=>e.schemaFormat!==`binary`))}function rt(e,t,n=a().bin[0]){e.helpCommand(!1);let r=e.commands.find(e=>e.name()===`help`)??e.command(`help`);r.summary(`Show full documentation for a command, search the catalog, or ask a question`).description("Show a command's full documentation offline. Select it by command path,\noperationId, or `<METHOD> <path>`; `<command> --help` prints only its usage.\n`help catalog [query...]` searches or lists every operation;\n`help ask <question>` answers a platform question.").argument(`[command...]`,"command path, operationId, or METHOD and path, e.g. `help entities get`"),r.addOption(new it(r)),r.hook(`preSubcommand`,e=>{e.opts().help&&e.help()}),D(r),r.action(async function(r){let i=r.flatMap(e=>e.split(/\s+/u).filter(Boolean)),{emit:a}=await import(`./output-XyvDx9ok.js`),o=this.optsWithGlobals();if(o.help&&i.length===0){this.outputHelp();return}let s=G(e,i),c=t.find(t=>s!==void 0&&G(e,t.cliPath)===s);if(o.help||s!==void 0&&c===void 0){s===void 0&&this.error(`unknown command '${i.join(` `)}' (run \`${n} --help\` for the command tree)`),s.outputHelp();return}let u=c===void 0?await st(i,t):l(`Resolved by command path`,{operationId:c.operationId});if(u.ok&&u.data?.command!==void 0&&this.error(`unknown command '${i.join(` `)}' (run \`${n} --help\` for the command tree)`),!u.ok||u.data===null){a({mode:E(o)},u);return}let{writeShowResult:d}=await import(`./operations-catalog-D4YIaQHB.js`);d({...o,...u.data},t,E(o,`text`),n)}),ot(e,t,n)}var it=class extends t{helpCommand;constructor(e){super(`-h, --help`,`display help for command`),this.helpCommand=e}is(e){if(e!==this.short&&e!==this.long)return!1;let t=this.helpCommand.parent?.args??[],n=t.findIndex(e=>e===this.helpCommand.name()||this.helpCommand.aliases().includes(e)),r=n<0?void 0:t[n+1];return r===void 0||r.startsWith(`-`)?!0:!this.helpCommand.commands.some(e=>e.name()===r||e.aliases().includes(r))}},B=2,V=6,at={formatHelp(e,t){let n=n=>r.prototype.formatHelp.call(this,e,Object.assign(Object.create(t),n));if(t.visibleCommands(e).length===0)return n({});let i=t.padWidth(e,t),a={padWidth:()=>i,visibleOptions:()=>[],showGlobalOptions:!1},o=n({...a,visibleCommands:()=>[]}),s=n({padWidth:()=>i,visibleCommands:()=>[]}).slice(o.length);return n(a)+s},visibleCommands(e){let t=r.prototype.visibleCommands.call(this,e);return e.parent===null?t.filter(e=>S[e.name()]?.listed!==!1):t},subcommandTerm(e){let t=r.prototype.subcommandTerm.call(this,e);return e.commands.length>0&&e.registeredArguments.length===0?`${t} <command>`:t},formatItem(e,t,n,i){let a=i.helpWidth??80,o=a-t-4;return n===``||o>=i.minWidthToWrap?r.prototype.formatItem.call(i,e,t,n,i):`${` `.repeat(B)}${e}\n${H(n,a,i)}`}};function H(e,t,n){return n.boxWrap(e,t-V).replace(/^/gmu,` `.repeat(V))}function ot(e,t,n){for(let r of t){let i=G(e,r.cliPath);i!==void 0&&i.addHelpText(`after`,()=>{let e=i.createHelp(),a=i.configureOutput().getOutHelpWidth?.();e.prepareContext(a===void 0?{}:{helpWidth:a});let o=e.helpWidth??80,s=le(r.operationId,t,n),c=U(de(r.header),o,e),l=U(fe(r.errorResponse),o,e);return`\n${[...s,...c,...l].join(`
+`)}\n`})}}function U(e,t,n){let[r,...i]=e;return r===void 0?[]:[``,r,...i.map(e=>H(e.trimStart(),t,n).replace(/^ +/u,` `.repeat(B)))]}var W='Accepted selectors: `<METHOD> <route template or concrete path>`, an operationId, or a CLI command path such as "entities get".';async function st(e,t){let[n=``,...r]=e.join(` `).trim().split(/\s+/u),[i,...a]=t.filter(e=>e.path===n);if(r.length===0&&i!==void 0)return a.length===0?l(`Resolved by route`,{operationId:i.operationId}):d(`${n} is served by ${[i,...a].map(({method:e})=>e).join(`, `)}; name the method, as in \`help ${i.method} ${n}\`.`,[W]);let o=f.find(e=>e===n.toLowerCase());if(o===void 0||r.length===0){let n=e.join(` `).trim();return l(`Resolved by name`,t.some(e=>e.operationId===n)?{operationId:n}:{command:n})}let s=p(o),c=r.join(``),u=t.find(e=>e.method===s&&e.path===c);if(u!==void 0)return l(`Resolved by route template`,{operationId:u.operationId});let{resolveOpenApiOperationSelector:m}=await import(`./openapi-call-Gchy3s8a.js`),h=m({method:s,path:c});return!h.ok||h.data===null?d(h.summary,[...h.warnings,W]):l(`Resolved by method and path`,{operationId:h.data.operation.operationId})}function G(e,t){let n=e;for(let e of t){let t=n.commands.find(t=>t.name()===e||t.aliases().includes(e));if(t===void 0)return;n=t}return n}function ct(e,t,n){if(e.cliPath[0]!==`lookup`||!lt(n))return null;let r=[...(e.requestBody??[]).flatMap(e=>e.parameter),...e.parameters,{name:`fromFile`,optionKey:`fromFile`}],i=r.filter(({optionKey:e},t)=>r.findIndex(t=>t.optionKey===e)===t).filter(({optionKey:e})=>t[e]!==void 0).map(({name:e,optionKey:n})=>`${e}=${String(t[n])}`),a=`no record for ${i.length===0?`the given input`:i.join(`, `)}`;return n.ok?d(a):d(a,[],{httpStatus:n.httpStatus,problem:n.problem})}function lt(e){return e.ok?Array.isArray(e.data)&&e.data.length===0:e.httpStatus===404}function ut(t,n,r,i){let a=dt(t,r),o=a instanceof e?[]:a,s=o[0],c=i.bin[0],l=[{selected:s===`auth`,register:async()=>{let{registerBuiltinAuthCommands:e}=await import(`./builtin-auth-IPP_Zmbj.js`);e(n,c)}},{selected:s===`agents`,register:async()=>{let{registerBuiltinAgentSetupCommand:e}=await import(`./builtin-agent-setup-B2Xvqera.js`);e(n,c)}},{selected:s===`update`,register:async()=>{let{registerBuiltinUpdateCommand:e}=await import(`./builtin-update-DJT_3I5O.js`);e(n,i)}},{selected:s===`batch`,register:async()=>{let{registerBuiltinBatchCommand:e}=await import(`./builtin-batch-DdGyCjlR.js`);e(n,r,c)}},{selected:s===`research`||s===`research-runs`||s===`data-engineering`,register:async()=>{let{registerBuiltinRunWaitCommand:e}=await import(`./builtin-run-wait-5yr1WK3I.js`);await e(n)}},{selected:s===`completion`,register:async()=>{let{registerCompletionCommand:e}=await import(`./completion-CnY6V98Y.js`);e(n,r,c)}},{selected:s===`help`,register:async()=>{let{registerHelpCatalogCommand:e}=await import(`./operations-DbanGAPY.js`);e(n,r,c)}},{selected:s===`command-catalog`,register:async()=>{let{registerRetiredCommandCatalog:e}=await import(`./operations-DbanGAPY.js`);e(n,r,c)}}],u=s===void 0||s===`help`||s===`completion`||s===`command-catalog`||!l.some(e=>e.selected)&&!r.some(e=>e.cliPath[0]===s),d=1;for(;d<o.length&&r.some(e=>o.slice(0,d+1).every((t,n)=>e.cliPath[n]===t));)d++;let f=o.slice(0,d),p=u?r:r.filter(e=>f.slice(0,e.cliPath.length).every((t,n)=>e.cliPath[n]===t)),m=new Set,h=async(e=!1)=>{for(let t of l)(e||u||t.selected)&&!m.has(t)&&(await t.register(),m.add(t))};return{generated:p,fullTree:u,rootHelp:t.length>0&&t.every(e=>e===`--help`||e===`-h`),registerBuiltin:h,async completeTree(e){e(n,r.filter(e=>!p.includes(e))),await h(!0)}}}function dt(t,n){try{return new i().parseOptions([...C(t,n).commandArgv]).operands}catch(t){if(!(t instanceof e))throw t;return t}}var K=new Set(T.map(e=>e.cliPath.join(` `)));function q(e,t){e.showHelpAfterError(!1).exitOverride(t(e)),e.commands.length===0?e.hook(`preAction`,Pe):e.registeredArguments.length===0&&!K.has(Me(e).join(` `))&&e.addHelpOption(new Ne(e));for(let n of e.commands)q(n,t)}function J(e){return b[y(e,S)??`cli`]}function Y(e,t,n,{rootHelp:r=!1}={}){let i=t.map(e=>{let t=e.cliPath[0]??``;return{spec:e,top:t,rank:J(t).rank}}).toSorted((e,t)=>e.rank-t.rank||e.top.localeCompare(t.top)).map(e=>e.spec),a=new Set(i.filter(e=>se(e.cliPath[0])).map(e=>e.cliPath[0]??``)),o=new Set,s=new Set;for(let{cliPath:e,deprecated:t}of i)for(let n=1;n<e.length;n++){let r=e.slice(0,n).join(` `);o.add(r),t!==!0&&s.add(r)}for(let t of i)ft(e,t,a,s,o.has(t.cliPath.join(` `)),n,!r||t.cliPath.length===1)}function ft(e,n,r,i,a,o,s){let c=n.cliPath,l=e,u=``,f=!r.has(c[0]??``);for(let e of c.slice(0,-1)){u=u===``?e:`${u} ${e}`;let t=f&&u===e||!i.has(u);l=pt(l,e,u,t)}let p=c.at(-1)??n.operationId,_=n.deprecated===!0&&i.has(c.join(` `)),v=l.commands.find(e=>e.name()===p)??l.command(p,n.deprecated===!0&&!_?{hidden:!0}:{}),y=n.requestBody?.flatMap(({parameter:e})=>e)??[];if(v.summary((_?S[c.join(` `)]?.summary:void 0)??(n.summary||n.operationId)).description([`${n.method} ${n.path}.`,n.summary||n.description,`Full documentation: ${o} help ${n.cliPath.join(` `)}`,n.requestBody?.[0]?.kind===`json`||[...n.parameters,...y].some(e=>m(e.schemaType,e.itemSchemaType))?h:``].filter(Boolean).join(`
+`)),!s)return;let b=ie(n);for(let e of n.parameters)mt(v,e,a||e===b);Be(v,n),g(n.intent)&&!v.options.some(e=>e.long===`--execute`)&&v.addOption(new t(`--execute`).hideHelp()),D(v),v.hook(`preAction`,e=>te(e,n)),n.explain===!0&&v.option(`--explain`,`Print the search strategy and parsed constraints before the results`),b!==void 0&&v.argument(`[text...]`,b.description||`Same as ${ce(b.flag)}.`),v.action(async function(){let{emit:e,emitSearchExplanation:t}=await import(`./output-XyvDx9ok.js`),r=Object.assign(this.optsWithGlobals(),{environment:this.opts().environment}),i=E(r),a=r;if(b!==void 0){let t=ne(b,this.args,r);if(!t.ok)return e({mode:i},{...t,notDispatched:!0});if(t.data===null)return e({mode:i},t);a=t.data}let o=ee(n,a);if(o.length>0){let t=`missing required options: ${o.join(`, `)}`;return e({mode:i},d(t,[],{notDispatched:!0}))}let s=await ht(n,a,i),c=ct(n,a,s);if(c!==null)return e({mode:i},c);r.explain===!0&&s.ok&&t(i,s.data),s.ok&&s.data instanceof Uint8Array&&i!==`csv`&&i!==`xlsx`?process.stdout.write(s.data):e({mode:i},s)})}function pt(e,t,n,r){let i=e.commands.find(e=>e.name()===t);if(i!==void 0)return i;let a=S[n],o=e.command(t,r?{hidden:!0}:{}).helpCommand(!1);return a!==void 0&&o.summary(a.summary).description(a.summary),o}function mt(e,n,r=!1){let i=n.description||`${n.name} ${n.location} parameter`,a=n.defaultValue===void 0?void 0:typeof n.defaultValue==`string`||typeof n.defaultValue==`boolean`?n.defaultValue:[...n.defaultValue];if(n.legacyFlag!==void 0){let o=new t(n.flag,i);a!==void 0&&o.default(a);let s=new t(n.legacyFlag,i).conflicts(n.optionKey);e.addOption(o).addOption(s),e.hook(`preAction`,e=>{let t=e.opts(),i=t[n.optionKey],a=t[s.attributeName()];a===void 0?!r&&n.required&&i===void 0&&e.error(`error: required option '${o.flags}' not specified`,{code:`commander.missingMandatoryOptionValue`}):(i===void 0||e.getOptionValueSource(n.optionKey)==="default")&&e.setOptionValueWithSource(n.optionKey,a,`cli`)})}else a===void 0?n.required&&!r?e.requiredOption(n.flag,i):e.option(n.flag,i):e.option(n.flag,i,a)}async function ht(e,t,n){let{buildOpenApiPath:r,runOpenApiCall:i}=await import(`./openapi-call-Gchy3s8a.js`),{pendingResult:a}=await import(`./output-XyvDx9ok.js`),o=await We(e,t);if(!o.ok)return{...o,notDispatched:!0};let s=!1,c=Object.fromEntries(e.parameters.filter(e=>e.location===`path`).map(e=>{let n=t[e.optionKey];if(Array.isArray(n))return[e.name,n.at(0)??``];if(n===void 0)throw Error(`Missing required option ${e.optionKey}`);return[e.name,String(n)]})),l=Object.fromEntries(e.parameters.filter(e=>e.location===`query`).flatMap(e=>{let n=t[e.optionKey];if(n===void 0||Array.isArray(n)&&n.length===0)return[];let r=Array.isArray(n)||typeof n==`boolean`?n:String(n);return[[e.name,r]]})),u=Object.fromEntries(e.parameters.filter(e=>e.location===`header`).flatMap(e=>{let n=t[e.optionKey];return n===void 0||Array.isArray(n)&&n.length===0?[]:[[e.name,Array.isArray(n)?n.join(`,`):String(n)]]})),d=await i({method:e.method,path:r(e.operationId,c),searchParams:l,headers:u,body:o.data,contentType:w(e,t),auth:e.auth,responseFormat:pe(n),responseBytes:e.binaryResponse===!0,pendingResult:a,onDispatch:()=>{s=!0}});return je(e,d.ok||s?d:{...d,notDispatched:!0})}async function gt(e,n){let r=n.bin[0],i=Ae(T),a=re(e,i),l=a===`required`?i:oe(i),u=new Fe;u.enablePositionalOptions(!x(e)&&C(e,i).positionalOptions).name(r).usage(`[--environment <environment>] <command> [subcommand] [options]`).configureHelp(at).summary(`CLI for the aVenture API: companies, people, and news, with the funding, publications, and classifications attached to them`).description(`The aVenture research API from your terminal. Three records — companies,
 people, and news — carry everything else: funding, publications, and tags.
 
 Mutations execute directly; --execute is a deprecated no-op.
-The aVenture MCP server runs these same operations through the same API client.`).addOption(new t(`--environment <environment>`,`route all API calls to a mapped API environment (default: API_URL host, else API_ENV, else ${c})`).choices([...s()])).showHelpAfterError(`(run \`${r} --help\` for usage)`),(x(e)||e.every(e=>e.startsWith(`-`)))&&u.version(n.version);let d=ut(e,u,l,n);Y(u,d.generated,r,{rootHelp:d.rootHelp}),await d.registerBuiltin(),rt(u,l,r);for(let e of u.commands)e.helpGroup()||e.helpGroup(J(e.name()).heading);let f;if(q(u,e=>t=>{throw f=(async()=>{!d.fullTree&&![`commander.helpDisplayed`,`commander.version`].includes(t.code)&&await d.completeTree((e,t)=>Y(e,t,r));let{commandExitHandler:n}=await import(`./parse-error-hint-tpmLXK21.js`);try{n(e)(t)}catch(e){if(e!==t)throw e}})(),t}),a===`required`){let e=[u];for(;e.length>0;){let t=e.pop();t!==void 0&&(e.push(...t.commands),t.hook(`preAction`,async(e,t)=>{e===t&&await ae(`required`)}))}}let p=new Set(u.commands.filter(e=>[`entities`,`people`,`news`].includes(e.name())).flatMap(e=>e.commands.map(e=>e.name())));return u.addHelpText(`after`,[``,`Record subcommands under entities, people, and news:`,...[[`search`,`  search   Find many of that record from a plain-English query or a filter`],[`lookup`,`  lookup   Find one news article; companies and people use the root lookup`],[`get`,`  get      Read one record`],[`list`,`  list     Read many records`],[`create`,`  create, update, delete   Write; each needs a credential that permits it`]].flatMap(([e,t])=>p.has(e)?[t]:[]),``,`Authentication (every command that calls aVenture needs a credential):`,`  Create one at ${o}/sign-up, then run: ${r} auth login`,`  AUTH_TOKEN      aVenture API key, for CI and other non-interactive shells`,`  Check what this shell holds with: ${r} auth status\n`,`Output modes (per command):`,`  --text  compact lines, the terminal default;  --json  the full envelope`,`  --csv  Print CSV rows or preserve server CSV bytes.`,`  --xlsx  Write server XLSX bytes with --to-file; use --csv otherwise.`,`  --data  response data as JSON, the default when piped or non-TTY`,`  --data-full  uncapped, for bounded programs, never LLM agents`,`  --all-fields  --text plus the detail fields it hides by default
+The aVenture MCP server runs these same operations through the same API client.`).addOption(new t(`--environment <environment>`,`route all API calls to a mapped API environment (default: API_URL host, else API_ENV, else ${c})`).choices([...s()])).showHelpAfterError(`(run \`${r} --help\` for usage)`),(x(e)||e.every(e=>e.startsWith(`-`)))&&u.version(n.version);let d=ut(e,u,l,n);Y(u,d.generated,r,{rootHelp:d.rootHelp}),await d.registerBuiltin(),rt(u,l,r);for(let e of u.commands)e.helpGroup()||e.helpGroup(J(e.name()).heading);let f;if(q(u,e=>t=>{throw f=(async()=>{!d.fullTree&&![`commander.helpDisplayed`,`commander.version`].includes(t.code)&&await d.completeTree((e,t)=>Y(e,t,r));let{commandExitHandler:n}=await import(`./parse-error-hint-0Xc2T5On.js`);try{n(e)(t)}catch(e){if(e!==t)throw e}})(),t}),a===`required`){let e=[u];for(;e.length>0;){let t=e.pop();t!==void 0&&(e.push(...t.commands),t.hook(`preAction`,async(e,t)=>{e===t&&await ae(`required`)}))}}let p=new Set(u.commands.filter(e=>[`entities`,`people`,`news`].includes(e.name())).flatMap(e=>e.commands.map(e=>e.name())));return u.addHelpText(`after`,[``,`Record subcommands under entities, people, and news:`,...[[`search`,`  search   Find many of that record from a plain-English query or a filter`],[`lookup`,`  lookup   Find one news article; companies and people use the root lookup`],[`get`,`  get      Read one record`],[`list`,`  list     Read many records`],[`create`,`  create, update, delete   Write; each needs a credential that permits it`]].flatMap(([e,t])=>p.has(e)?[t]:[]),``,`Authentication (every command that calls aVenture needs a credential):`,`  Create one at ${o}/sign-up, then run: ${r} auth login`,`  AUTH_TOKEN      aVenture API key, for CI and other non-interactive shells`,`  Check what this shell holds with: ${r} auth status\n`,`Output modes (per command):`,`  --text  compact lines, the terminal default;  --json  the full envelope`,`  --csv  Print CSV rows or preserve server CSV bytes.`,`  --xlsx  Write server XLSX bytes with --to-file; use --csv otherwise.`,`  --data  response data as JSON, the default when piped or non-TTY`,`  --data-full  uncapped, for bounded programs, never LLM agents`,`  --all-fields  --text plus the detail fields it hides by default
 `,`Exit codes:`,`  0   envelope.ok === true
   1   envelope.ok === false
 `,`Examples:`,`  $ ${r} auth login`,`  $ ${r} lookup --name Stripe --url https://stripe.com`,`  $ ${r} search "fintech companies in Austin"\n`,`Run \`${r} <command> --help\` for its subcommands and options,`,`or \`${r} help <command>\` for its full documentation.`].join(`
-`)),{program:u,exitPreparation:()=>f}}var X=a(Ie(import.meta.url)),Z=X.bin[0];async function Q(e,t){process.exitCode=1;let n=e instanceof Error?e:Error(String(e)),r={...d(`${Z} ${t}: ${n.message}`,[n.name||`Error`]),counts:{exitCode:1}};v({component:Z,event:`fatal`,message:n.message,error:n}),process.stderr.write(`${Z} fatal (${t}): ${n.stack??n.message}\n`);try{let{BearerVerificationUnavailableError:e}=await import(`./openapi-call-BN_q73Gl.js`),{emitJson:t}=await import(`./output-XyvDx9ok.js`),i=n instanceof e?{httpStatus:n.problem.status,problem:n.problem}:{};r={...r,...i},t(r)}catch(e){let t=e instanceof Error?e.message:String(e);process.stderr.write(`${Z} fatal reporting failed: ${t}\n`),process.stdout.write(`${JSON.stringify(r)}\n`)}}var _t=e=>{if(e.code!==`EPIPE`)throw e;process.exit(0)};for(let e of[process.stdout,process.stderr])e.on(`error`,_t);process.on(`uncaughtException`,e=>Q(e,`uncaughtException`)),process.on(`unhandledRejection`,e=>Q(e,`unhandledRejection`));var $=await gt(process.argv.slice(2),X);try{await $.program.parseAsync()}catch(t){await $.exitPreparation(),t instanceof e?process.exitCode=t.exitCode:await Q(t,`parseAsync`)}export{};
+`)),{program:u,exitPreparation:()=>f}}var X=a(Ie(import.meta.url)),Z=X.bin[0];async function Q(e,t){process.exitCode=1;let n=e instanceof Error?e:Error(String(e)),r={...d(`${Z} ${t}: ${n.message}`,[n.name||`Error`]),counts:{exitCode:1}};v({component:Z,event:`fatal`,message:n.message,error:n}),process.stderr.write(`${Z} fatal (${t}): ${n.stack??n.message}\n`);try{let{BearerVerificationUnavailableError:e}=await import(`./openapi-call-Gchy3s8a.js`),{emitJson:t}=await import(`./output-XyvDx9ok.js`),i=n instanceof e?{httpStatus:n.problem.status,problem:n.problem}:{};r={...r,...i},t(r)}catch(e){let t=e instanceof Error?e.message:String(e);process.stderr.write(`${Z} fatal reporting failed: ${t}\n`),process.stdout.write(`${JSON.stringify(r)}\n`)}}var _t=e=>{if(e.code!==`EPIPE`)throw e;process.exit(0)};for(let e of[process.stdout,process.stderr])e.on(`error`,_t);process.on(`uncaughtException`,e=>Q(e,`uncaughtException`)),process.on(`unhandledRejection`,e=>Q(e,`unhandledRejection`));var $=await gt(process.argv.slice(2),X);try{await $.program.parseAsync()}catch(t){await $.exitPreparation(),t instanceof e?process.exitCode=t.exitCode:await Q(t,`parseAsync`)}export{};

package/dist/chunks/{builtin-auth-8D5ET0Cp.js → builtin-auth-IPP_Zmbj.js}

@@ -1,6 +1,6 @@
-import{n as e}from"./commander-DEj7N1b9.js";import{a as t}from"./package-DEeHDoOT.js";import{a as n,f as r,t as i}from"./env-DGAe95Xm.js";import{c as a,r as o}from"./result-envelope-BMqcRDpc.js";import{r as s}from"./api-target-vxev2RKl.js";import{t as c}from"./credential-redaction-Cl6Eny3X.js";import{n as l}from"./contract-SAu4Y_Kd.js";import{t as u}from"./openapi-composites-IdxI7cAF.js";import{t as d}from"./auth-status-check-oJLDd2a7.js";import{t as f}from"./output-D8SD_tSW.js";import{a as p,t as m}from"./output-mode-DIt-t4Fu.js";var h=l(u,`oauth`),g=[l(u,`start`),l(u,`poll`),l(u,`acknowledge`)],_=l(u,`revoke`);function v(n,r=t().bin[0]){let a=S(n),s=[`${h.description} Default method: OAuth in your browser.`,`With --key: ${g.map(({description:e})=>e).join(` `)}`].join(`
+import{n as e}from"./commander-DEj7N1b9.js";import{a as t}from"./package-DEeHDoOT.js";import{a as n,f as r,t as i}from"./env-DGAe95Xm.js";import{c as a,r as o}from"./result-envelope-BMqcRDpc.js";import{r as s}from"./api-target-vxev2RKl.js";import{t as c}from"./credential-redaction-Cl6Eny3X.js";import{n as l}from"./contract-SAu4Y_Kd.js";import{t as u}from"./openapi-composites-IdxI7cAF.js";import{t as d}from"./auth-status-check-Cwf6uUZP.js";import{t as f}from"./output-D8SD_tSW.js";import{a as p,t as m}from"./output-mode-DIt-t4Fu.js";var h=l(u,`oauth`),g=[l(u,`start`),l(u,`poll`),l(u,`acknowledge`)],_=l(u,`revoke`);function v(n,r=t().bin[0]){let a=S(n),s=[`${h.description} Default method: OAuth in your browser.`,`With --key: ${g.map(({description:e})=>e).join(` `)}`].join(`
 `);m(x(a,[h,...g],s)).action(y),m(x(a,[_],_.description)).action(b),m(a.command(`status`).summary(`Keep saved credentials current and report them`).description([`Runs the same credential materialization every command runs, then reports:`,`  - auth: whether AUTH_TOKEN was already set in this shell's environment`,`  - oauth: the saved OAuth identity and access-token expiry for the selected API host;`,`    an expired token is renewed with its refresh token and a token the sign-in service rejects is retired`,`  - api-key: the saved aVenture API key, re-verified with aVenture sign-in and its cached metadata updated`,`  - selected: the credential the next command sends`,`  - providers: GET /v1/auth/providers (browser sign-in and the CLI OAuth client)`,`  - api: running CLI package version plus GET /info build metadata`,"  - check: `{ name, status, message }` for each environment check:",...d.map(e=>`      ${e.name}: ${e.purpose}`),``,`Exit code is 0 only when no check failed; a skipped check (no registry reachable) does not`,`fail the run. Each failing message names the command that fixes it.`,`Saved credentials are sent only to the selected API host and aVenture sign-in, never printed.`,`--verify read|write additionally runs a live permission probe for that scope; it does not`,`execute or authorize an arbitrary API operation.`].join(`
 `)).addOption(new e(`--verify <scope>`,`verify one permission-probe scope`).choices([`read`,`write`]))).action(async function(e){C(this),f({mode:p(e)},await w(r,e.verify))}),a.command(`token`).summary(`Print the bearer token the next command sends`).description([`Runs the same credential materialization every command runs, then prints the selected`,`bearer token alone on stdout: ${i.authToken} when set, otherwise the saved OAuth`,`access token (renewed when expired) or the saved aVenture API key.`,`Use it where another client needs this CLI's sign-in, such as an MCP client's header helper.`].join(`
-`)).action(async function(){let{refreshCliCredentials:e}=await import(`./auth-status-render-BIHZs1Fl.js`);C(this);let t=await e(r),n=process.env[i.authToken]?.trim();t.failure===null&&n!==void 0&&n.length>0?process.stdout.write(`${n}\n`):f({mode:`text`},t.failure===null?M(`auth token: no credentials resolved`,null,r,{oauth:!0,apiKey:!0}):o(`auth token: ${t.failure}`))})}async function y(e){C(this);let t=p(e),n=e.key===!0?await(await import(`./api-key-login-C70ptWkf.js`)).loginApiKeyCredential({noBrowser:!e.browser,clientLabel:e.clientLabel}):await(await import(`./oauth-login-D7bKxIzU.js`)).loginOAuthCredential({noBrowser:!e.browser});f({mode:t},n)}async function b(e){let{logoutCliCredentials:t}=await import(`./logout-oTmMJssP.js`);C(this),f({mode:p(e)},await t({forgetLocal:e.forgetLocal===!0}))}function x(e,t,n){let[r]=t,i=e.command(r.command.slice(r.command.indexOf(` `)+1)).summary(r.summary).description(n),a=new Set;for(let e of t)for(let t of[...e.bodyOption,...e.localOption])a.has(t.flag)||(a.add(t.flag),`required`in t&&t.required?i.requiredOption(t.flag,t.description):i.option(t.flag,t.description));return i}function S(e){return(e.commands.find(e=>e.name()===`auth`)??e.command(`auth`)).summary(`Sign in, sign out, and check credentials`).description([`\`${h.command}\`: ${h.summary}; \`--key\` ${g[0].summary.toLowerCase()}.`,`\`${_.command}\`: ${_.summary}.`,"`auth status` reports credential provenance, sign-in providers, CLI/API build metadata, and environment checks.","`auth token` prints the bearer token the next command sends."].join(`
-`))}function C(e){let t=e.optsWithGlobals();t.environment!==void 0&&(process.env.API_ENV=t.environment)}async function w(e,n){let{resolveAuthStatus:l}=await import(`./auth-resolver-DNfIzKg-.js`),{apiHostCheck:u,authStatusReport:d,checkResult:f,environmentChecks:p}=await import(`./auth-status-check-W8rkgIvv.js`),{inspectOAuthCredentialStorage:m}=await import(`./oauth-credential-CYLRKH91.js`),{apiKeyCredentialDiagnostics:h,inspectLiveAuth:g,oauthCredentialDiagnostics:_,refreshCliCredentials:v,renderAuthStatus:y}=await import(`./auth-status-render-BIHZs1Fl.js`),b;try{b=s(r().host)}catch(e){return o(`auth status: invalid API host — ${c(e)}`)}let x=l(),S=v(e),[C,w,O]=await Promise.all([j(`/info`,`GET /info`),D(),p(e)]),A=await S,[N,P]=await Promise.all([m(b),E(b)]),F=n===void 0?null:await g(n,N,P.inspection,A),I=t().version,L=h(b,P.inspection,P.verification),R=F!==null||x.present||N.state===`found`||P.inspection.state===`found`&&P.inspection.stored.activation===`active`,z=A.failure??F?.error??(R?null:`no credentials resolved`),B=d(O,u(C,b,e),z===null?f(`auth`,`pass`,`credential=${A.materialized??x.source??`none`}`):f(`auth`,`fail`,z)),V=`${y({cliName:e,cliVersion:I,apiVersion:C.ok?await k(C.data):null,oauth:N,apiKey:L,apiKeyPhase:P.inspection.state===`found`?P.inspection.stored.activation:null,providers:w,resolved:x,refresh:A,live:F})}\n${T(B.check)}`,H={cli:{version:I},api:C.ok?C.data??null:null,auth:{[i.authToken]:x},selected:A.materialized,oauth:_(b,N),apiKey:L,providers:w,live:F,check:B.check,...C.ok?{}:{apiError:C.summary}};if(A.failure!==null)return{...o(`auth status: ${A.failure} | ${V}`,[A.failure]),data:H};if(!C.ok&&C.httpStatus===401)return{...o(`auth status: the API rejected the selected credential (401) | ${V}`,[`Replace or unset ${i.authToken}, or run \`${e} auth login\`.`]),data:H};if(F!==null&&F.error!==null)return{...o(`auth status: ${F.scope} permission probe failed — ${F.error}`,[F.error]),data:H};if(!R)return M(`auth status: no credentials resolved | ${V}`,H,e,{oauth:N.state===`missing`,apiKey:P.inspection.state===`missing`});let U=B.check.filter(e=>e.status===`fail`);return U.length===0?a(V,H):{...o(`auth status: ${U.map(e=>e.name).join(`, `)} failed | ${V}`,U.map(e=>e.message)),data:H}}function T(e){return[`Checks`,...e.map(e=>`  ${e.name} ${e.status} — ${e.message}`)].join(`
-`)}async function E(e){let{refreshStoredApiKeyCredential:t}=await import(`./api-key-credential-verification-TNvdeeGh.js`),n=await O(e);if(n.state!==`found`)return{inspection:n,verification:null};let{lookup:r,verification:i}=await t(n.stored);return{inspection:r,verification:i}}async function D(){try{let{fetchAuthProviderCatalog:e}=await import(`./oauth-login-D7bKxIzU.js`);return{state:`found`,catalog:await e()}}catch(e){return{state:`unavailable`,summary:c(e)}}}async function O(e){try{let{inspectApiKeyCredentialStorage:t}=await import(`./api-key-credential-CvGuNqg7.js`);return await t(e)}catch(e){return{state:`invalid`,summary:c(e)}}}async function k(e){let{SystemBuildSchema:t}=await import(`./system-build-DFy8edPI.js`);if(!A(e))return null;let n=t.safeParse(Reflect.get(e,`response`));if(!n.success)return null;let r=n.data.build.version?.trim();return r&&r.length>0?r:null}function A(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}async function j(e,t){let{runOpenApiCall:n}=await import(`./openapi-call-BN_q73Gl.js`);return await n({method:`GET`,path:e,auth:`none`,responseFormat:`json`}).catch(e=>o(`${t} failed: ${e instanceof Error?e.message:String(e)}`))}function M(e,t,r,a){return{...o(e,[...a.apiKey?[`For an API key (works over SSH), run \`${r} auth login --key\`.`]:[],...a.oauth?[`For OAuth, run \`${r} auth login\`; without a browser it prints a device code.`]:[],`For non-interactive use, set ${i.authToken} to an aVenture API key (create one at ${n}/settings/api-keys).`]),data:t}}export{v as registerBuiltinAuthCommands};
+`)).action(async function(){let{refreshCliCredentials:e}=await import(`./auth-status-render-DlSjZ6kk.js`);C(this);let t=await e(r),n=process.env[i.authToken]?.trim();t.failure===null&&n!==void 0&&n.length>0?process.stdout.write(`${n}\n`):f({mode:`text`},t.failure===null?M(`auth token: no credentials resolved`,null,r,{oauth:!0,apiKey:!0}):o(`auth token: ${t.failure}`))})}async function y(e){C(this);let t=p(e),n=e.key===!0?await(await import(`./api-key-login-DSWEmjPA.js`)).loginApiKeyCredential({noBrowser:!e.browser,clientLabel:e.clientLabel}):await(await import(`./oauth-login-155QGdTQ.js`)).loginOAuthCredential({noBrowser:!e.browser});f({mode:t},n)}async function b(e){let{logoutCliCredentials:t}=await import(`./logout-GwrTE5av.js`);C(this),f({mode:p(e)},await t({forgetLocal:e.forgetLocal===!0}))}function x(e,t,n){let[r]=t,i=e.command(r.command.slice(r.command.indexOf(` `)+1)).summary(r.summary).description(n),a=new Set;for(let e of t)for(let t of[...e.bodyOption,...e.localOption])a.has(t.flag)||(a.add(t.flag),`required`in t&&t.required?i.requiredOption(t.flag,t.description):i.option(t.flag,t.description));return i}function S(e){return(e.commands.find(e=>e.name()===`auth`)??e.command(`auth`)).summary(`Sign in, sign out, and check credentials`).description([`\`${h.command}\`: ${h.summary}; \`--key\` ${g[0].summary.toLowerCase()}.`,`\`${_.command}\`: ${_.summary}.`,"`auth status` reports credential provenance, sign-in providers, CLI/API build metadata, and environment checks.","`auth token` prints the bearer token the next command sends."].join(`
+`))}function C(e){let t=e.optsWithGlobals();t.environment!==void 0&&(process.env.API_ENV=t.environment)}async function w(e,n){let{resolveAuthStatus:l}=await import(`./auth-resolver-DNfIzKg-.js`),{apiHostCheck:u,authStatusReport:d,checkResult:f,environmentChecks:p}=await import(`./auth-status-check-DcY55e4Q.js`),{inspectOAuthCredentialStorage:m}=await import(`./oauth-credential-CYLRKH91.js`),{apiKeyCredentialDiagnostics:h,inspectLiveAuth:g,oauthCredentialDiagnostics:_,refreshCliCredentials:v,renderAuthStatus:y}=await import(`./auth-status-render-DlSjZ6kk.js`),b;try{b=s(r().host)}catch(e){return o(`auth status: invalid API host — ${c(e)}`)}let x=l(),S=v(e),[C,w,O]=await Promise.all([j(`/info`,`GET /info`),D(),p(e)]),A=await S,[N,P]=await Promise.all([m(b),E(b)]),F=n===void 0?null:await g(n,N,P.inspection,A),I=t().version,L=h(b,P.inspection,P.verification),R=F!==null||x.present||N.state===`found`||P.inspection.state===`found`&&P.inspection.stored.activation===`active`,z=A.failure??F?.error??(R?null:`no credentials resolved`),B=d(O,u(C,b,e),z===null?f(`auth`,`pass`,`credential=${A.materialized??x.source??`none`}`):f(`auth`,`fail`,z)),V=`${y({cliName:e,cliVersion:I,apiVersion:C.ok?await k(C.data):null,oauth:N,apiKey:L,apiKeyPhase:P.inspection.state===`found`?P.inspection.stored.activation:null,providers:w,resolved:x,refresh:A,live:F})}\n${T(B.check)}`,H={cli:{version:I},api:C.ok?C.data??null:null,auth:{[i.authToken]:x},selected:A.materialized,oauth:_(b,N),apiKey:L,providers:w,live:F,check:B.check,...C.ok?{}:{apiError:C.summary}};if(A.failure!==null)return{...o(`auth status: ${A.failure} | ${V}`,[A.failure]),data:H};if(!C.ok&&C.httpStatus===401)return{...o(`auth status: the API rejected the selected credential (401) | ${V}`,[`Replace or unset ${i.authToken}, or run \`${e} auth login\`.`]),data:H};if(F!==null&&F.error!==null)return{...o(`auth status: ${F.scope} permission probe failed — ${F.error}`,[F.error]),data:H};if(!R)return M(`auth status: no credentials resolved | ${V}`,H,e,{oauth:N.state===`missing`,apiKey:P.inspection.state===`missing`});let U=B.check.filter(e=>e.status===`fail`);return U.length===0?a(V,H):{...o(`auth status: ${U.map(e=>e.name).join(`, `)} failed | ${V}`,U.map(e=>e.message)),data:H}}function T(e){return[`Checks`,...e.map(e=>`  ${e.name} ${e.status} — ${e.message}`)].join(`
+`)}async function E(e){let{refreshStoredApiKeyCredential:t}=await import(`./api-key-credential-verification-DC-YG5wa.js`),n=await O(e);if(n.state!==`found`)return{inspection:n,verification:null};let{lookup:r,verification:i}=await t(n.stored);return{inspection:r,verification:i}}async function D(){try{let{fetchAuthProviderCatalog:e}=await import(`./oauth-login-155QGdTQ.js`);return{state:`found`,catalog:await e()}}catch(e){return{state:`unavailable`,summary:c(e)}}}async function O(e){try{let{inspectApiKeyCredentialStorage:t}=await import(`./api-key-credential-CvGuNqg7.js`);return await t(e)}catch(e){return{state:`invalid`,summary:c(e)}}}async function k(e){let{SystemBuildSchema:t}=await import(`./system-build-DFy8edPI.js`);if(!A(e))return null;let n=t.safeParse(Reflect.get(e,`response`));if(!n.success)return null;let r=n.data.build.version?.trim();return r&&r.length>0?r:null}function A(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}async function j(e,t){let{runOpenApiCall:n}=await import(`./openapi-call-Gchy3s8a.js`);return await n({method:`GET`,path:e,auth:`none`,responseFormat:`json`}).catch(e=>o(`${t} failed: ${e instanceof Error?e.message:String(e)}`))}function M(e,t,r,a){return{...o(e,[...a.apiKey?[`For an API key (works over SSH), run \`${r} auth login --key\`.`]:[],...a.oauth?[`For OAuth, run \`${r} auth login\`; without a browser it prints a device code.`]:[],`For non-interactive use, set ${i.authToken} to an aVenture API key (create one at ${n}/settings/api-keys).`]),data:t}}export{v as registerBuiltinAuthCommands};

package/dist/chunks/{builtin-run-wait-bdVye6Ce.js → builtin-run-wait-5yr1WK3I.js}

@@ -1 +1 @@
-import{c as e,r as t}from"./result-envelope-BMqcRDpc.js";import{t as n}from"./output-D8SD_tSW.js";import{a as r,t as i}from"./output-mode-DIt-t4Fu.js";var a=5e3,o=6e4,s=3e4,c=86400,l={noun:`research runs`,summary:`Wait for research runs to finish, then report each outcome`,description:"Polls `research runs get` with backoff until the run is completed, failed, or stopped, then prints its status, error, failure class, and last event time, plus spend when available in this distribution; a timeout reports the last event time so a stalled run shows. Exits nonzero when the run failed or stopped, or when --timeout passes first.",getOperationId:`getResearchRun`,defaultTimeoutSeconds:1800,schema:async()=>(await import(`./run-detail-Dr1rg-iE.js`)).HarnessRunDetailSchema,progress:({run:e,lastEventAt:t})=>e.status===`completed`||e.status===`failed`||e.status===`stopped`?void 0:`${e.status}, last event ${t??`none`}`,outcome:m};async function u(e){let t=t=>e.commands.find(e=>e.name()===t),n=e=>t(e)?.commands.find(e=>e.name()===`runs`),r=n(`research`);r!==void 0&&d(r,l);let i=n(`data-engineering`);if(i!==void 0){let{dataEngineeringRuns:e}=await import(`./private-run-read-DM_02z6l.js`);e!==void 0&&d(i,e)}}function d(e,t){let a=e.command(`wait`).summary(t.summary).description(`${t.description} Several --run-id values wait for every run in one process; data then lists each outcome in order, and the exit is nonzero unless every run succeeded.`).requiredOption(`--run-id <uuid...>`,`Run id; repeat or list several to wait for all`).option(`--timeout <seconds>`,`Total seconds to wait; a run still in flight then exits nonzero as still running`,String(t.defaultTimeoutSeconds));i(a),a.action(async function(){let e=this.optsWithGlobals(),i=await Promise.all(e.runId.map(n=>p(t,{runId:n,timeout:e.timeout}))),a=i.length===1&&i[0]!==void 0?i[0]:f(i);n({mode:r(e)},a)})}function f(t){let n=t.filter(e=>e.ok).length;return{...e(`${n} of ${t.length} runs succeeded: ${t.map(e=>e.summary).join(`; `)}`,t.map(e=>e.data),{warnings:t.flatMap(e=>e.warnings)}),ok:n===t.length}}async function p(e,n){let{setTimeout:r}=await import(`node:timers/promises`),{buildOpenApiPath:i}=await import(`./openapi-call-BN_q73Gl.js`),{parseBoundedInt:s}=await import(`./batch-io-D3B-dxmh.js`),l=s(`--timeout`,n.timeout,1,c);if(!l.ok||l.data===null)return t(l.summary);let u=Date.now()+l.data*1e3,d=i(e.getOperationId,{runId:n.runId}),f=a,p=`not read yet`,m=(r=`after ${l.data}s`)=>t(`Run ${n.runId} is still ${p} ${r}`,[`Wait longer with --timeout, or read it with \`${e.noun} get --run-id ${n.runId}\`.`]);for(;;){if(u-Date.now()<=0)return m();let t=0,n=await h(d,u,await e.schema());if(n.kind===`deadline`)return m();if(n.kind===`refused`)return n.envelope;if(n.kind===`detail`){let t=e.progress(n.detail);if(t===void 0)return await e.outcome(n.detail,u);p=t}else p=`unread (${n.reason})`,t=(n.retryAfterSeconds??0)*1e3;let i=u-Date.now();if(i<=0||t>=i)return m(i<=0?`after ${l.data}s`:`and the API asks for ${t/1e3}s, past the ${l.data}s --timeout`);let s=Math.max(t,a+Math.random()*(f-a)),c=Math.min(u,Date.now()+s),g=c-Date.now();for(;g>0;)await r(g),g=c-Date.now();f=Math.min(f*2,o)}}async function m(t,n){let{readResearchRunSpend:r}=await import(`./private-run-read-DM_02z6l.js`),{run:i}=t,a=await r?.({runId:i.id,deadline:n})??{costUsd:null},o={runId:i.id,status:i.status,error:i.error??null,failureClass:i.failureClass??null,publicUrl:t.publicUrl??null,finishedAt:i.finishedAt??null,lastEventAt:t.lastEventAt??null,...a.costUsd===null?{}:{costUsd:a.costUsd}},s={warnings:a.warning===void 0?[]:[a.warning]},c=a.costUsd===null?``:`; spend $${a.costUsd.toFixed(4)}`;if(i.status===`completed`)return e(`Run ${i.id} completed${c}`,o,s);let l=i.failureClass?` (${i.failureClass})`:``,u=i.error?`: ${i.error}`:``;return{...e(`Run ${i.id} ${i.status}${l}${c}${u}`,o,s),ok:!1}}async function h(e,n,r){let{runOpenApiCall:i}=await import(`./openapi-call-BN_q73Gl.js`),{isTransientRefusal:a,isTransportFailure:o}=await import(`./request-replay-DGlQLFjp.js`),{retrySeconds:c}=await import(`./response-problem-BbI2mj-6.js`),l=n-Date.now();if(l<=0)return{kind:`deadline`};let u=AbortSignal.timeout(Math.min(s,l)),d;try{d=await i({method:`GET`,path:e,auth:`auto`,responseFormat:`json`,signal:u})}catch(e){if(o(e)||u.aborted&&e instanceof Error&&e.cause instanceof Error&&e.cause.name===`AbortError`&&e.cause.cause===u.reason)return{kind:`transient`,reason:String(e)};throw e}if(!d.ok){let{problem:n}=d;if(n!==void 0&&a(n.status,n)){let e=c(n.retryAfterSeconds);return{kind:`transient`,reason:d.summary,...e===void 0?{}:{retryAfterSeconds:e}}}return{kind:`refused`,envelope:t(`GET ${e} failed: ${d.summary}`,d.warnings,{problem:n})}}let f=d.data,p=r.safeParse(typeof f==`object`&&f&&`response`in f?f.response:void 0);return p.success?{kind:`detail`,detail:p.data}:{kind:`refused`,envelope:t(`${e} returned an unexpected body: ${p.error.message}`)}}export{u as registerBuiltinRunWaitCommand};
+import{c as e,r as t}from"./result-envelope-BMqcRDpc.js";import{t as n}from"./output-D8SD_tSW.js";import{a as r,t as i}from"./output-mode-DIt-t4Fu.js";var a=5e3,o=6e4,s=3e4,c=86400,l={noun:`research runs`,summary:`Wait for research runs to finish, then report each outcome`,description:"Polls `research runs get` with backoff until the run is completed, failed, or stopped, then prints its status, error, failure class, and last event time, plus spend when available in this distribution; a timeout reports the last event time so a stalled run shows. Exits nonzero when the run failed or stopped, or when --timeout passes first.",getOperationId:`getResearchRun`,defaultTimeoutSeconds:1800,schema:async()=>(await import(`./run-detail-Dr1rg-iE.js`)).HarnessRunDetailSchema,progress:({run:e,lastEventAt:t})=>e.status===`completed`||e.status===`failed`||e.status===`stopped`?void 0:`${e.status}, last event ${t??`none`}`,outcome:m};async function u(e){let t=t=>e.commands.find(e=>e.name()===t),n=e=>t(e)?.commands.find(e=>e.name()===`runs`),r=n(`research`);r!==void 0&&d(r,l);let i=n(`data-engineering`);if(i!==void 0){let{dataEngineeringRuns:e}=await import(`./private-run-read-DM_02z6l.js`);e!==void 0&&d(i,e)}}function d(e,t){let a=e.command(`wait`).summary(t.summary).description(`${t.description} Several --run-id values wait for every run in one process; data then lists each outcome in order, and the exit is nonzero unless every run succeeded.`).requiredOption(`--run-id <uuid...>`,`Run id; repeat or list several to wait for all`).option(`--timeout <seconds>`,`Total seconds to wait; a run still in flight then exits nonzero as still running`,String(t.defaultTimeoutSeconds));i(a),a.action(async function(){let e=this.optsWithGlobals(),i=await Promise.all(e.runId.map(n=>p(t,{runId:n,timeout:e.timeout}))),a=i.length===1&&i[0]!==void 0?i[0]:f(i);n({mode:r(e)},a)})}function f(t){let n=t.filter(e=>e.ok).length;return{...e(`${n} of ${t.length} runs succeeded: ${t.map(e=>e.summary).join(`; `)}`,t.map(e=>e.data),{warnings:t.flatMap(e=>e.warnings)}),ok:n===t.length}}async function p(e,n){let{setTimeout:r}=await import(`node:timers/promises`),{buildOpenApiPath:i}=await import(`./openapi-call-Gchy3s8a.js`),{parseBoundedInt:s}=await import(`./batch-io-D3B-dxmh.js`),l=s(`--timeout`,n.timeout,1,c);if(!l.ok||l.data===null)return t(l.summary);let u=Date.now()+l.data*1e3,d=i(e.getOperationId,{runId:n.runId}),f=a,p=`not read yet`,m=(r=`after ${l.data}s`)=>t(`Run ${n.runId} is still ${p} ${r}`,[`Wait longer with --timeout, or read it with \`${e.noun} get --run-id ${n.runId}\`.`]);for(;;){if(u-Date.now()<=0)return m();let t=0,n=await h(d,u,await e.schema());if(n.kind===`deadline`)return m();if(n.kind===`refused`)return n.envelope;if(n.kind===`detail`){let t=e.progress(n.detail);if(t===void 0)return await e.outcome(n.detail,u);p=t}else p=`unread (${n.reason})`,t=(n.retryAfterSeconds??0)*1e3;let i=u-Date.now();if(i<=0||t>=i)return m(i<=0?`after ${l.data}s`:`and the API asks for ${t/1e3}s, past the ${l.data}s --timeout`);let s=Math.max(t,a+Math.random()*(f-a)),c=Math.min(u,Date.now()+s),g=c-Date.now();for(;g>0;)await r(g),g=c-Date.now();f=Math.min(f*2,o)}}async function m(t,n){let{readResearchRunSpend:r}=await import(`./private-run-read-DM_02z6l.js`),{run:i}=t,a=await r?.({runId:i.id,deadline:n})??{costUsd:null},o={runId:i.id,status:i.status,error:i.error??null,failureClass:i.failureClass??null,publicUrl:t.publicUrl??null,finishedAt:i.finishedAt??null,lastEventAt:t.lastEventAt??null,...a.costUsd===null?{}:{costUsd:a.costUsd}},s={warnings:a.warning===void 0?[]:[a.warning]},c=a.costUsd===null?``:`; spend $${a.costUsd.toFixed(4)}`;if(i.status===`completed`)return e(`Run ${i.id} completed${c}`,o,s);let l=i.failureClass?` (${i.failureClass})`:``,u=i.error?`: ${i.error}`:``;return{...e(`Run ${i.id} ${i.status}${l}${c}${u}`,o,s),ok:!1}}async function h(e,n,r){let{runOpenApiCall:i}=await import(`./openapi-call-Gchy3s8a.js`),{isTransientRefusal:a,isTransportFailure:o}=await import(`./request-replay-DGlQLFjp.js`),{retrySeconds:c}=await import(`./response-problem-BbI2mj-6.js`),l=n-Date.now();if(l<=0)return{kind:`deadline`};let u=AbortSignal.timeout(Math.min(s,l)),d;try{d=await i({method:`GET`,path:e,auth:`auto`,responseFormat:`json`,signal:u})}catch(e){if(o(e)||u.aborted&&e instanceof Error&&e.cause instanceof Error&&e.cause.name===`AbortError`&&e.cause.cause===u.reason)return{kind:`transient`,reason:String(e)};throw e}if(!d.ok){let{problem:n}=d;if(n!==void 0&&a(n.status,n)){let e=c(n.retryAfterSeconds);return{kind:`transient`,reason:d.summary,...e===void 0?{}:{retryAfterSeconds:e}}}return{kind:`refused`,envelope:t(`GET ${e} failed: ${d.summary}`,d.warnings,{problem:n})}}let f=d.data,p=r.safeParse(typeof f==`object`&&f&&`response`in f?f.response:void 0);return p.success?{kind:`detail`,detail:p.data}:{kind:`refused`,envelope:t(`${e} returned an unexpected body: ${p.error.message}`)}}export{u as registerBuiltinRunWaitCommand};

package/dist/chunks/{logout-Du693hU1.js → logout-Dxt8vao3.js}

@@ -1 +1 @@
-import{a as e,f as t,t as n}from"./env-DGAe95Xm.js";import{c as r,r as i}from"./result-envelope-BMqcRDpc.js";import{z as a}from"./tool-policy-DG8pafmI.js";import{s as o}from"./openapi-call-DrJ9I2I1.js";import{a as s,r as c}from"./api-target-vxev2RKl.js";import{i as l,n as u,s as d,t as f}from"./api-key-credential-v7YT_b1y.js";import{n as p,t as m}from"./credential-redaction-Cl6Eny3X.js";import{n as h}from"./contract-SAu4Y_Kd.js";import{t as g}from"./openapi-composites-IdxI7cAF.js";import{c as _,f as v,m as y,n as b,r as x}from"./oauth-credential-D5ioBfGK.js";import{t as S}from"./oauth-login-CJo685tl.js";var C=h(g,`revoke`);async function w(r){let a;try{a=c(t().host)}catch(e){return i(`auth logout: invalid API host — ${m(e)}`)}let o=await j(a),s=await E(a),l=await k(a,r),u=T(a,s,l);if(o===void 0)return u;let d={...u.data??{host:a,revoked:!1,forgotten:!1},presented:o};switch(o.state){case`revoked`:return{...u,summary:`${u.summary} The API key in ${n.authToken} is revoked; unset it in this shell.`,data:d,ids:[...u.ids,o.apiKeyId]};case`unconfirmed`:return{...i(`auth logout: revocation of the API key in ${n.authToken} was not confirmed — ${o.summary}`,[`Retry when the API is available, or revoke the key at ${e}/settings/api-keys.`]),data:d};case`notApiKey`:case`rejected`:return{...u,data:d,warnings:[...u.warnings,`${n.authToken} was not revoked — ${o.summary}; unset it in this shell.`]};default:throw Error(`Unsupported AUTH_TOKEN logout state`)}}function T(e,t,n){let a=t.state===`failed`?[`OAuth credential could not be removed — ${t.summary}`]:t.state===`forgotten`&&!t.revoked?[`OAuth refresh token was not revoked remotely — ${t.summary??`no revocation endpoint`}`]:[],o={host:e,revoked:!1,forgotten:!1,oauth:t};return n===null?t.state===`missing`?r(`No CLI credential is stored for this API host.`,o):t.state===`failed`?{...i(`auth logout: ${a[0]}`),data:o}:r(t.revoked?`OAuth credential revoked remotely and removed locally.`:`OAuth credential removed locally.`,o,{warnings:a}):{...n,data:{...n.data??o,oauth:t},warnings:[...n.warnings,...a]}}async function E(e){let t=await x(e);if(t.state===`missing`)return{state:`missing`};let n=t.state===`found`?await O(t.stored):{revoked:!1};try{await b(e)}catch(e){return{state:`failed`,summary:m(e)}}return{state:`forgotten`,...n}}async function D(e){let t=Reflect.get(await S(e),`revocation_endpoint`);return typeof t==`string`?y(t,`revocation endpoint`,!0):void 0}async function O(e){let{client:t,tokens:n}=e.credential,r=n.refresh_token??n.access_token;try{let e=await D(t);if(e===void 0)return{revoked:!1};let n=await fetch(e,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:new URLSearchParams({token:r,client_id:_(t)})});return n.ok?{revoked:!0}:{revoked:!1,summary:`revocation endpoint answered ${n.status}`}}catch(e){return{revoked:!1,summary:m(e,v(n))}}}async function k(e,t){let n;try{n=await l(e)}catch(e){return i(`auth logout: stored credential could not be read — ${m(e)}`)}if(n.state===`unavailable`)return{...i(`auth logout: ${n.summary}`),data:{host:e,revoked:!1,forgotten:!1}};if(n.state===`missing`)return null;let a=n.stored,o=await A(a),s=o.outcome===`revoked`,c=a.activation!==`active`&&o.outcome===`rejected`;if(!s&&!c&&!t.forgetLocal)return{...i(`auth logout: remote revocation was not confirmed; local credential preserved — ${o.summary}`,[`Retry when the API is available. If an earlier response was lost after revocation, the retry can be unauthorized because revoked keys cannot authenticate.`,"Use `--forget-local` only to remove local bytes while accepting that the remote key may remain active."]),data:N(a,!1,!1)};try{if((await u(a)).state===`changed`)return{...i(`auth logout: local credential changed during logout; current credential preserved, logout incomplete`,[o.summary]),data:N(a,s,!1)}}catch(e){return{...i(`auth logout: local credential removal failed — ${m(e,[a.credential.secret])}`,[s?"The remote key is revoked. Re-run with `--forget-local` to retry local cleanup.":`Remote revocation was not confirmed; inspect auth status before retrying.`]),data:N(a,s,!1)}}return r(s?`API key revoked remotely and removed locally.`:c?`Stale pending CLI credential removed; its remote key can no longer authenticate and unacknowledged keys expire at the authorization deadline.`:`API key removed locally without confirmed remote revocation.`,N(a,s,!0),{ids:[a.credential.apiKey.id],warnings:s||c?[]:[`Remote revocation was not confirmed; the API key may remain active.`]})}async function A(e){let t=await M(e.credential.secret);return t.apiKey===null?t:t.apiKey.id!==e.credential.apiKey.id||t.apiKey.subject!==e.credential.apiKey.subject?{outcome:`unconfirmed`,summary:`remote response did not match the stored API key identity`}:t}async function j(e){let n=t().userBearerToken?.trim();if(n===void 0||n.length===0)return;let r=await l(e);if(r.state===`found`&&r.stored.credential.secret===n)return;let i=await M(n);return i.outcome===`revoked`&&i.apiKey!==null?{state:`revoked`,apiKeyId:i.apiKey.id}:i.refused?{state:`notApiKey`,summary:i.summary}:{state:i.outcome===`rejected`?`rejected`:`unconfirmed`,summary:i.summary}}async function M(e){let n={apiKey:null,refused:!1},r=s(t());try{let t=await o(r,{method:C.method,path:a(C.path,{},C.operationId),headers:{Authorization:`Bearer ${e}`}},d);if(t.ok&&t.redirect)return{...n,outcome:`unconfirmed`,summary:`remote key revocation returned unexpected redirect ${t.status}`};if(!t.ok){let r=t.problem.type!==`about:blank`,i=r&&t.problem.status===401;return{...n,outcome:i?`rejected`:`unconfirmed`,refused:r&&t.problem.status===403,summary:p(t.problem,[e])}}let i={id:t.data.id,subject:t.data.subject};return t.data.status===`REVOKED`?{apiKey:i,refused:!1,outcome:`revoked`,summary:`remote key revocation confirmed`}:{apiKey:i,refused:!1,outcome:`unconfirmed`,summary:`remote response did not confirm REVOKED status`}}catch(t){return{...n,outcome:`unconfirmed`,summary:m(t,[e])}}}function N(e,t,n){return{host:e.host,apiKeyId:e.credential.apiKey.id,activation:f(e.activation),revoked:t,forgotten:n}}export{A as n,w as t};
+import{a as e,f as t,t as n}from"./env-DGAe95Xm.js";import{c as r,r as i}from"./result-envelope-BMqcRDpc.js";import{z as a}from"./tool-policy-DG8pafmI.js";import{s as o}from"./openapi-call-DRowSHyQ.js";import{a as s,r as c}from"./api-target-vxev2RKl.js";import{i as l,n as u,s as d,t as f}from"./api-key-credential-v7YT_b1y.js";import{n as p,t as m}from"./credential-redaction-Cl6Eny3X.js";import{n as h}from"./contract-SAu4Y_Kd.js";import{t as g}from"./openapi-composites-IdxI7cAF.js";import{c as _,f as v,m as y,n as b,r as x}from"./oauth-credential-D5ioBfGK.js";import{t as S}from"./oauth-login-BDOwNja7.js";var C=h(g,`revoke`);async function w(r){let a;try{a=c(t().host)}catch(e){return i(`auth logout: invalid API host — ${m(e)}`)}let o=await j(a),s=await E(a),l=await k(a,r),u=T(a,s,l);if(o===void 0)return u;let d={...u.data??{host:a,revoked:!1,forgotten:!1},presented:o};switch(o.state){case`revoked`:return{...u,summary:`${u.summary} The API key in ${n.authToken} is revoked; unset it in this shell.`,data:d,ids:[...u.ids,o.apiKeyId]};case`unconfirmed`:return{...i(`auth logout: revocation of the API key in ${n.authToken} was not confirmed — ${o.summary}`,[`Retry when the API is available, or revoke the key at ${e}/settings/api-keys.`]),data:d};case`notApiKey`:case`rejected`:return{...u,data:d,warnings:[...u.warnings,`${n.authToken} was not revoked — ${o.summary}; unset it in this shell.`]};default:throw Error(`Unsupported AUTH_TOKEN logout state`)}}function T(e,t,n){let a=t.state===`failed`?[`OAuth credential could not be removed — ${t.summary}`]:t.state===`forgotten`&&!t.revoked?[`OAuth refresh token was not revoked remotely — ${t.summary??`no revocation endpoint`}`]:[],o={host:e,revoked:!1,forgotten:!1,oauth:t};return n===null?t.state===`missing`?r(`No CLI credential is stored for this API host.`,o):t.state===`failed`?{...i(`auth logout: ${a[0]}`),data:o}:r(t.revoked?`OAuth credential revoked remotely and removed locally.`:`OAuth credential removed locally.`,o,{warnings:a}):{...n,data:{...n.data??o,oauth:t},warnings:[...n.warnings,...a]}}async function E(e){let t=await x(e);if(t.state===`missing`)return{state:`missing`};let n=t.state===`found`?await O(t.stored):{revoked:!1};try{await b(e)}catch(e){return{state:`failed`,summary:m(e)}}return{state:`forgotten`,...n}}async function D(e){let t=Reflect.get(await S(e),`revocation_endpoint`);return typeof t==`string`?y(t,`revocation endpoint`,!0):void 0}async function O(e){let{client:t,tokens:n}=e.credential,r=n.refresh_token??n.access_token;try{let e=await D(t);if(e===void 0)return{revoked:!1};let n=await fetch(e,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:new URLSearchParams({token:r,client_id:_(t)})});return n.ok?{revoked:!0}:{revoked:!1,summary:`revocation endpoint answered ${n.status}`}}catch(e){return{revoked:!1,summary:m(e,v(n))}}}async function k(e,t){let n;try{n=await l(e)}catch(e){return i(`auth logout: stored credential could not be read — ${m(e)}`)}if(n.state===`unavailable`)return{...i(`auth logout: ${n.summary}`),data:{host:e,revoked:!1,forgotten:!1}};if(n.state===`missing`)return null;let a=n.stored,o=await A(a),s=o.outcome===`revoked`,c=a.activation!==`active`&&o.outcome===`rejected`;if(!s&&!c&&!t.forgetLocal)return{...i(`auth logout: remote revocation was not confirmed; local credential preserved — ${o.summary}`,[`Retry when the API is available. If an earlier response was lost after revocation, the retry can be unauthorized because revoked keys cannot authenticate.`,"Use `--forget-local` only to remove local bytes while accepting that the remote key may remain active."]),data:N(a,!1,!1)};try{if((await u(a)).state===`changed`)return{...i(`auth logout: local credential changed during logout; current credential preserved, logout incomplete`,[o.summary]),data:N(a,s,!1)}}catch(e){return{...i(`auth logout: local credential removal failed — ${m(e,[a.credential.secret])}`,[s?"The remote key is revoked. Re-run with `--forget-local` to retry local cleanup.":`Remote revocation was not confirmed; inspect auth status before retrying.`]),data:N(a,s,!1)}}return r(s?`API key revoked remotely and removed locally.`:c?`Stale pending CLI credential removed; its remote key can no longer authenticate and unacknowledged keys expire at the authorization deadline.`:`API key removed locally without confirmed remote revocation.`,N(a,s,!0),{ids:[a.credential.apiKey.id],warnings:s||c?[]:[`Remote revocation was not confirmed; the API key may remain active.`]})}async function A(e){let t=await M(e.credential.secret);return t.apiKey===null?t:t.apiKey.id!==e.credential.apiKey.id||t.apiKey.subject!==e.credential.apiKey.subject?{outcome:`unconfirmed`,summary:`remote response did not match the stored API key identity`}:t}async function j(e){let n=t().userBearerToken?.trim();if(n===void 0||n.length===0)return;let r=await l(e);if(r.state===`found`&&r.stored.credential.secret===n)return;let i=await M(n);return i.outcome===`revoked`&&i.apiKey!==null?{state:`revoked`,apiKeyId:i.apiKey.id}:i.refused?{state:`notApiKey`,summary:i.summary}:{state:i.outcome===`rejected`?`rejected`:`unconfirmed`,summary:i.summary}}async function M(e){let n={apiKey:null,refused:!1},r=s(t());try{let t=await o(r,{method:C.method,path:a(C.path,{},C.operationId),headers:{Authorization:`Bearer ${e}`}},d);if(t.ok&&t.redirect)return{...n,outcome:`unconfirmed`,summary:`remote key revocation returned unexpected redirect ${t.status}`};if(!t.ok){let r=t.problem.type!==`about:blank`,i=r&&t.problem.status===401;return{...n,outcome:i?`rejected`:`unconfirmed`,refused:r&&t.problem.status===403,summary:p(t.problem,[e])}}let i={id:t.data.id,subject:t.data.subject};return t.data.status===`REVOKED`?{apiKey:i,refused:!1,outcome:`revoked`,summary:`remote key revocation confirmed`}:{apiKey:i,refused:!1,outcome:`unconfirmed`,summary:`remote response did not confirm REVOKED status`}}catch(t){return{...n,outcome:`unconfirmed`,summary:m(t,[e])}}}function N(e,t,n){return{host:e.host,apiKeyId:e.credential.apiKey.id,activation:f(e.activation),revoked:t,forgotten:n}}export{A as n,w as t};

package/dist/chunks/logout-GwrTE5av.js

@@ -0,0 +1 @@
+export{t as logoutCliCredentials}from"./logout-Dxt8vao3.js";

package/dist/chunks/oauth-bearer-credential-BiDojkqU.js

@@ -0,0 +1 @@
+export{t as materializeCliOAuthBearerCredential,n as materializeSavedCliOAuthBearerCredential}from"./oauth-bearer-credential-CxuQ4uM5.js";

package/dist/chunks/{oauth-bearer-credential-DlyXyoGr.js → oauth-bearer-credential-CxuQ4uM5.js}

@@ -1 +1 @@
-import{a as e}from"./package-DEeHDoOT.js";import{f as t,t as n}from"./env-DGAe95Xm.js";import{r}from"./auth-resolver-CRpJNNB2.js";import{o as i}from"./logging-DYzy2g8p.js";import{r as a}from"./api-target-vxev2RKl.js";import{i as o}from"./api-key-credential-v7YT_b1y.js";import{t as s}from"./credential-redaction-Cl6Eny3X.js";import{a as c}from"./credential-store-xkwn77zF.js";import{t as l}from"./api-key-bearer-credential-DpuLoYkG.js";import{a as u,f as d,h as f,n as p,o as m,t as h}from"./oauth-credential-D5ioBfGK.js";import"./http-credentials-BUPEQD7v.js";async function g(){let e=await o(a(t().host)).catch(()=>null);return e===null||e.state===`unavailable`||e.state===`found`&&e.stored.activation===`active`}async function _(n,r){if(E())return;let o=async(t,a,o,c=!1)=>{if(await l(r),!E())throw c?a:D(t,n,a,o);i({component:n??e().bin[0],event:`oauth_credential_bypassed`,message:`OAuth sign-in is unavailable (${t}); using the stored API key.`,...a===void 0?{}:{error:Error(s(a,T(o)))}})},c=async(t,r,a,c)=>{if(c){let e=await m(t.host).catch(()=>void 0);if(e?.state===`found`&&e.stored.credential.tokens.access_token!==t.credential.tokens.access_token)return await d(e.stored,!1)}try{await p(t.host)}catch(a){i({component:n??e().bin[0],event:`oauth_credential_retire_failed`,message:`the saved OAuth credential is dead (${r}) but could not be removed`,error:Error(s(a,T(t)))})}await o(r,a,t)},d=async(e,t)=>{let r=(n,r)=>c(e,n,r,t),i=e.credential;if(u(i)){if(i.tokens.refresh_token===void 0)return await r(`the saved OAuth credential has expired`);try{i=await y(e)}catch(t){return await S(t)?await r(`aVenture sign-in rejected the saved refresh token`,t):await o(`the saved OAuth credential could not be renewed`,t,e,!await x(t))}}if(t&&i===e.credential&&(C(i)||!await g()))return f(e,i);let a;try{let{verifyUserBearerToken:e}=await import(`./openapi-call-BN_q73Gl.js`);a=await e(i.tokens.access_token,new URL(i.client.resource))!==null}catch(t){let{errors:n}=await import(`./webapi-WYeLOETY.js`);return t instanceof n.JWTInvalid?await r(`the saved OAuth credential is malformed`,t):await o(`the saved OAuth credential could not be verified`,t,e,!0)}if(!a)return await r(`the saved OAuth credential was rejected`);await w(e.host,i,n),f(e,i)},f=(e,t)=>{E()||(b({...e,credential:t}),r?.(`oauth`))},h;try{h=a(t().host)}catch(e){throw D(`the API host could not select its OAuth credential`,n,e)}let _;try{_=await m(h)}catch(e){return await o(`the saved OAuth credential is invalid or expired`,e)}if(_.state!==`missing`){if(_.state===`unavailable`)return await o(`the saved OAuth credential could not be read`,Error(_.summary));await d(_.stored,!0)}}async function v(){if(E())return;let e=await m(a(t().host));e.state===`found`&&(process.env[n.authToken]=e.stored.credential.tokens.access_token)}async function y(t){return await c(async()=>{let n=await m(t.host),r=n.state===`found`?n.stored:t;if(!u(r.credential))return r.credential;let{renewOAuthTokens:a}=await import(`./oauth-login-D7bKxIzU.js`),o=h(r.credential.client,await a(r));try{await f(t.host,o)}catch(t){i({component:e().bin[0],event:`oauth_credential_store_failed`,message:`renewed OAuth credential could not be stored; this command uses it and the next one falls back to the API key or sign-in`,error:Error(s(t,d(o.tokens)))})}return o})}function b(e){let t=e.credential.tokens.access_token,i;r(t,async()=>{if(i!==void 0||process.env[n.authToken]!==t||!u(e.credential))return i;delete process.env[n.authToken];let r=Error(`no saved credential could serve this command`);try{let{materializeCommandCredential:e}=await import(`./startup-auth-DVq1dO3o.js`);if(await e(`required`),E())return}catch(e){r=e}process.env[n.authToken]=t;let{BearerVerificationUnavailableError:a}=await import(`./openapi-call-BN_q73Gl.js`);if(r instanceof a)return r.problem;let o=r instanceof TypeError,c={status:o?503:401,title:`the saved OAuth sign-in expired during this command and could not be renewed`,type:`about:blank`,detail:s(r,T(e))};return o||(i=c),c})}async function x(e){let{OAuthError:t}=await import(`./dist-DGMIRNW7.js`);return e instanceof t}async function S(e){let{OAuthError:t,OAuthErrorCode:n}=await import(`./dist-DGMIRNW7.js`),r=n.InvalidGrant;return e instanceof t&&e.code===r}function C(e){if(e.verifiedAt===void 0)return!1;let t=Date.now()-new Date(e.verifiedAt).getTime();return t>=0&&t<9e5}async function w(t,n,r){let a=new Date().toISOString();try{await c(async()=>{let e=await m(t);e.state===`found`&&e.stored.credential.tokens.access_token===n.tokens.access_token&&await f(t,{...e.stored.credential,verifiedAt:a})})}catch(t){i({component:r??e().bin[0],event:`oauth_credential_verification_unrecorded`,message:`the saved OAuth credential was verified but the verification could not be stored`,error:Error(s(t,d(n.tokens)))})}}function T(e){return e===void 0?[]:d(e.credential.tokens)}function E(){return(process.env[n.authToken]?.trim().length??0)>0}function D(t,n,r,i){let a=r===void 0?``:` — ${s(r,T(i))}`,o=n??e().bin[0];return Error(`OAuth sign-in is required: ${t}. Run \`${o} auth login\` before retrying.${a}`)}export{v as n,y as r,_ as t};
+import{a as e}from"./package-DEeHDoOT.js";import{f as t,t as n}from"./env-DGAe95Xm.js";import{r}from"./auth-resolver-CRpJNNB2.js";import{o as i}from"./logging-DYzy2g8p.js";import{r as a}from"./api-target-vxev2RKl.js";import{i as o}from"./api-key-credential-v7YT_b1y.js";import{t as s}from"./credential-redaction-Cl6Eny3X.js";import{a as c}from"./credential-store-xkwn77zF.js";import{t as l}from"./api-key-bearer-credential-DpuLoYkG.js";import{a as u,f as d,h as f,n as p,o as m,t as h}from"./oauth-credential-D5ioBfGK.js";import"./http-credentials-BUPEQD7v.js";async function g(){let e=await o(a(t().host)).catch(()=>null);return e===null||e.state===`unavailable`||e.state===`found`&&e.stored.activation===`active`}async function _(n,r){if(E())return;let o=async(t,a,o,c=!1)=>{if(await l(r),!E())throw c?a:D(t,n,a,o);i({component:n??e().bin[0],event:`oauth_credential_bypassed`,message:`OAuth sign-in is unavailable (${t}); using the stored API key.`,...a===void 0?{}:{error:Error(s(a,T(o)))}})},c=async(t,r,a,c)=>{if(c){let e=await m(t.host).catch(()=>void 0);if(e?.state===`found`&&e.stored.credential.tokens.access_token!==t.credential.tokens.access_token)return await d(e.stored,!1)}try{await p(t.host)}catch(a){i({component:n??e().bin[0],event:`oauth_credential_retire_failed`,message:`the saved OAuth credential is dead (${r}) but could not be removed`,error:Error(s(a,T(t)))})}await o(r,a,t)},d=async(e,t)=>{let r=(n,r)=>c(e,n,r,t),i=e.credential;if(u(i)){if(i.tokens.refresh_token===void 0)return await r(`the saved OAuth credential has expired`);try{i=await y(e)}catch(t){return await S(t)?await r(`aVenture sign-in rejected the saved refresh token`,t):await o(`the saved OAuth credential could not be renewed`,t,e,!await x(t))}}if(t&&i===e.credential&&(C(i)||!await g()))return f(e,i);let a;try{let{verifyUserBearerToken:e}=await import(`./openapi-call-Gchy3s8a.js`);a=await e(i.tokens.access_token,new URL(i.client.resource))!==null}catch(t){let{errors:n}=await import(`./webapi-WYeLOETY.js`);return t instanceof n.JWTInvalid?await r(`the saved OAuth credential is malformed`,t):await o(`the saved OAuth credential could not be verified`,t,e,!0)}if(!a)return await r(`the saved OAuth credential was rejected`);await w(e.host,i,n),f(e,i)},f=(e,t)=>{E()||(b({...e,credential:t}),r?.(`oauth`))},h;try{h=a(t().host)}catch(e){throw D(`the API host could not select its OAuth credential`,n,e)}let _;try{_=await m(h)}catch(e){return await o(`the saved OAuth credential is invalid or expired`,e)}if(_.state!==`missing`){if(_.state===`unavailable`)return await o(`the saved OAuth credential could not be read`,Error(_.summary));await d(_.stored,!0)}}async function v(){if(E())return;let e=await m(a(t().host));e.state===`found`&&(process.env[n.authToken]=e.stored.credential.tokens.access_token)}async function y(t){return await c(async()=>{let n=await m(t.host),r=n.state===`found`?n.stored:t;if(!u(r.credential))return r.credential;let{renewOAuthTokens:a}=await import(`./oauth-login-155QGdTQ.js`),o=h(r.credential.client,await a(r));try{await f(t.host,o)}catch(t){i({component:e().bin[0],event:`oauth_credential_store_failed`,message:`renewed OAuth credential could not be stored; this command uses it and the next one falls back to the API key or sign-in`,error:Error(s(t,d(o.tokens)))})}return o})}function b(e){let t=e.credential.tokens.access_token,i;r(t,async()=>{if(i!==void 0||process.env[n.authToken]!==t||!u(e.credential))return i;delete process.env[n.authToken];let r=Error(`no saved credential could serve this command`);try{let{materializeCommandCredential:e}=await import(`./startup-auth-DfEgkGG8.js`);if(await e(`required`),E())return}catch(e){r=e}process.env[n.authToken]=t;let{BearerVerificationUnavailableError:a}=await import(`./openapi-call-Gchy3s8a.js`);if(r instanceof a)return r.problem;let o=r instanceof TypeError,c={status:o?503:401,title:`the saved OAuth sign-in expired during this command and could not be renewed`,type:`about:blank`,detail:s(r,T(e))};return o||(i=c),c})}async function x(e){let{OAuthError:t}=await import(`./dist-DGMIRNW7.js`);return e instanceof t}async function S(e){let{OAuthError:t,OAuthErrorCode:n}=await import(`./dist-DGMIRNW7.js`),r=n.InvalidGrant;return e instanceof t&&e.code===r}function C(e){if(e.verifiedAt===void 0)return!1;let t=Date.now()-new Date(e.verifiedAt).getTime();return t>=0&&t<9e5}async function w(t,n,r){let a=new Date().toISOString();try{await c(async()=>{let e=await m(t);e.state===`found`&&e.stored.credential.tokens.access_token===n.tokens.access_token&&await f(t,{...e.stored.credential,verifiedAt:a})})}catch(t){i({component:r??e().bin[0],event:`oauth_credential_verification_unrecorded`,message:`the saved OAuth credential was verified but the verification could not be stored`,error:Error(s(t,d(n.tokens)))})}}function T(e){return e===void 0?[]:d(e.credential.tokens)}function E(){return(process.env[n.authToken]?.trim().length??0)>0}function D(t,n,r,i){let a=r===void 0?``:` — ${s(r,T(i))}`,o=n??e().bin[0];return Error(`OAuth sign-in is required: ${t}. Run \`${o} auth login\` before retrying.${a}`)}export{v as n,y as r,_ as t};

package/dist/chunks/{oauth-login-D7bKxIzU.js → oauth-login-155QGdTQ.js}

@@ -1 +1 @@
-export{n as fetchAuthProviderCatalog,r as loginOAuthCredential,i as renewOAuthTokens}from"./oauth-login-CJo685tl.js";
+export{n as fetchAuthProviderCatalog,r as loginOAuthCredential,i as renewOAuthTokens}from"./oauth-login-BDOwNja7.js";

package/dist/chunks/{oauth-login-CJo685tl.js → oauth-login-BDOwNja7.js}

@@ -1,4 +1,4 @@
-import{Gt as e,Yt as t}from"./auth-BNDyLTqp-z6VNZXaE.js";import{f as n}from"./env-DGAe95Xm.js";import{c as r,r as i}from"./result-envelope-BMqcRDpc.js";import{a,n as o,s}from"./openapi-call-DrJ9I2I1.js";import{R as c}from"./webapi-B2JTupyg.js";import{a as l,r as u}from"./api-target-vxev2RKl.js";import{n as d,t as f}from"./credential-redaction-Cl6Eny3X.js";import{n as p,s as ee}from"./credential-store-xkwn77zF.js";import"./dist-oUS6BQ43.js";import{a as te,c as m,d as h,f as g,h as ne,m as _,p as v,r as y,s as b,t as x,u as S}from"./oauth-credential-D5ioBfGK.js";import{t as C}from"./provider-catalog-CT1LnhCO.js";import{f as w,o as T,s as E,u as re}from"./dist-Dt0qAmdj.js";import{r as ie}from"./oauth-bearer-credential-DlyXyoGr.js";import{once as ae}from"node:events";import{stderr as D}from"node:process";import{setTimeout as oe}from"node:timers/promises";import{createServer as se}from"node:http";import{randomBytes as ce,timingSafeEqual as O}from"node:crypto";var k=5e3,A=500,j=`Approval poll was interrupted; retrying.
+import{Gt as e,Yt as t}from"./auth-BNDyLTqp-z6VNZXaE.js";import{f as n}from"./env-DGAe95Xm.js";import{c as r,r as i}from"./result-envelope-BMqcRDpc.js";import{a,n as o,s}from"./openapi-call-DRowSHyQ.js";import{R as c}from"./webapi-B2JTupyg.js";import{a as l,r as u}from"./api-target-vxev2RKl.js";import{n as d,t as f}from"./credential-redaction-Cl6Eny3X.js";import{n as p,s as ee}from"./credential-store-xkwn77zF.js";import"./dist-oUS6BQ43.js";import{a as te,c as m,d as h,f as g,h as ne,m as _,p as v,r as y,s as b,t as x,u as S}from"./oauth-credential-D5ioBfGK.js";import{t as C}from"./provider-catalog-CT1LnhCO.js";import{f as w,o as T,s as E,u as re}from"./dist-Dt0qAmdj.js";import{r as ie}from"./oauth-bearer-credential-CxuQ4uM5.js";import{once as ae}from"node:events";import{stderr as D}from"node:process";import{setTimeout as oe}from"node:timers/promises";import{createServer as se}from"node:http";import{randomBytes as ce,timingSafeEqual as O}from"node:crypto";var k=5e3,A=500,j=`Approval poll was interrupted; retrying.
 `,M=`urn:ietf:params:oauth:grant-type:device_code`;function N(e){let t=Reflect.get(e,`device_authorization_endpoint`);if(typeof t!=`string`)throw Error(`OAuth authorization-server metadata lacks device_authorization_endpoint`);return _(t,`device authorization endpoint`,!0)}async function P(e,t){if(t.grant_types_supported?.includes(M)!==!0)throw Error(`OAuth authorization-server metadata must advertise the device authorization grant`);let n=await fetch(N(t),{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:new URLSearchParams({client_id:m(e),scope:h(e).join(` `),resource:S(e).toString()})});if(!n.ok)throw Error(`device authorization endpoint answered ${n.status}`);return I(await F(n,`device authorization`),Date.now())}async function F(e,t){try{return await e.json()}catch(n){throw Error(`${t} endpoint answered ${e.status} without a JSON body`,{cause:n})}}function I(e,t){if(typeof e!=`object`||!e)throw Error(`device authorization response is not an object`);let n=Reflect.get(e,`device_code`),r=Reflect.get(e,`user_code`),i=Reflect.get(e,`verification_uri_complete`),a=Reflect.get(e,`verification_uri`),o=Reflect.get(e,`expires_in`),s=Reflect.get(e,`interval`);if(typeof n!=`string`||typeof r!=`string`||n.length===0||r.length===0)throw Error(`device authorization response lacks device_code or user_code`);let c=typeof i==`string`&&i.length>0?i:a;if(typeof c!=`string`)throw Error(`device authorization response lacks a verification URI`);if(typeof o!=`number`||o<=0)throw Error(`device authorization response lacks a positive expires_in`);return{deviceCode:n,userCode:r,verificationUri:_(c,`verification URI`,!0),expiresAt:t+o*1e3,intervalMilliseconds:(typeof s==`number`&&s>=0?s:5)*1e3}}async function L(n,r,i){let a=_(r.token_endpoint,`token endpoint`,!0),o=i.intervalMilliseconds,s=null;for(;Date.now()<i.expiresAt;){await oe(o);let r;try{r=await fetch(a,{method:`POST`,headers:{"Content-Type":`application/x-www-form-urlencoded`},body:new URLSearchParams({client_id:m(n),grant_type:M,device_code:i.deviceCode})})}catch(e){s=`the token endpoint was unreachable — ${f(e)}`,D.write(j);continue}if(r.status>=A){await r.body?.cancel(),s=`the token endpoint answered ${r.status}`,D.write(j);continue}s=null;let c=await F(r,`token`);if(r.ok){let e=t.safeParse(c);if(!e.success)throw Error(`token endpoint returned an invalid token response`);return e.data}let l=e.safeParse(c),u=l.success?l.data.error:`HTTP ${r.status}`;if(u!==`authorization_pending`){if(u===`slow_down`)o+=k;else throw Error(u===`access_denied`?`the sign-in was denied in the browser`:u===`expired_token`?`the device code expired before approval`:`token endpoint answered ${u}`)}}throw Error(s===null?`the device code expired before approval`:`the device code expired before approval — last failure: ${s}`)}var R=3e5;function z(e){let t;try{t=new URL(e.redirectUri)}catch(e){throw Error(`OAuth callback configuration is not a valid URL`,{cause:e})}if(t.protocol!==`http:`||t.hostname!==`127.0.0.1`||t.port.length>0||t.pathname!==`/callback`||t.username.length>0||t.password.length>0||t.search.length>0||t.hash.length>0)throw Error(`OAuth callback configuration must be http://127.0.0.1/callback without a port, query, or fragment`);return t}async function B(e,t){let n,r=new Promise(e=>{n=e}),i=se((r,i)=>{i.setHeader(`Cache-Control`,`no-store`),i.setHeader(`Content-Type`,`text/plain; charset=utf-8`);let a=new URL(r.url??`/`,e);if(r.method!==`GET`||a.pathname!==e.pathname){i.statusCode=404,i.end(`OAuth callback not found.`);return}let o=a.searchParams.getAll(`state`),s=Buffer.from(o[0]??``),c=Buffer.from(t);if(o.length!==1||s.length!==c.length||!O(s,c)){i.statusCode=400,i.end(`OAuth callback state did not match. Return to the CLI and retry.`);return}if(a.searchParams.has(`error`)){i.statusCode=400,i.end(`OAuth authorization was not completed. Return to the CLI.`),n({state:`failed`,message:`OAuth authorization server returned an error`});return}let l=a.searchParams.getAll(`code`),u=l[0]?.trim();if(l.length!==1||u===void 0||u.length===0){i.statusCode=400,i.end(`OAuth callback did not include an authorization code.`);return}let d=a.searchParams.getAll(`iss`);d.length>1?(i.statusCode=400,i.end(`OAuth callback named more than one issuer.`)):(i.statusCode=200,i.end(`OAuth authorization completed. Return to the CLI.`),n({state:`code`,authorizationCode:u,iss:d[0]}))});i.on(`error`,e=>n({state:`failed`,message:`OAuth callback listener failed: ${f(e)}`}));try{let t=ae(i,`listening`);i.listen({host:`127.0.0.1`,port:0}),await t;let n=i.address();if(n===null||typeof n==`string`||n.port<=0)throw Error(`OAuth callback listener did not receive an ephemeral loopback port`);let a=new URL(e);return a.port=String(n.port),{redirectUri:a,waitForAuthorizationCode:async()=>{let e;return await Promise.race([r,new Promise(t=>{e=setTimeout(()=>t({state:`timed-out`}),R)})]).finally(()=>{e!==void 0&&clearTimeout(e)})},close:async()=>await V(i)}}catch(e){throw i.listening&&await V(i),e}}function V(e){return new Promise((t,n)=>{e.close(e=>e===void 0?t():n(e))})}var H=`the OAuth credential is valid, but the API refused this account (HTTP 403); signing in again will not change that`;async function U(e){let t;try{t=u(n().host)}catch(e){return i(`auth login: invalid API host — ${f(e)}`)}let o=await y(t);if(o.state===`missing`)return G(t,e);if(o.state===`unavailable`)return i(`auth login: ${o.summary}`);if(o.state===`invalid`)return G(t,e,`Saved OAuth credential cannot be read — ${o.summary}`);let{stored:s}=o;if(te(s.credential))return await W(s,e);let l;try{l=await a(s.credential.tokens.access_token,S(s.credential.client))}catch(n){return n instanceof c?G(t,e,`Saved OAuth credential was rejected`):i(`auth login: saved OAuth credential could not be verified — ${f(n,g(s.credential.tokens))}`)}return l===`forbidden`?i(`auth login: ${H}`):l===null?G(t,e,`Saved OAuth credential was rejected`):r(`OAuth CLI access token is already stored and verified.`,$(s))}async function W(e,t){let n=await v(e.host);if(n.state===`unavailable`)return i(`auth login: ${n.summary}`);let{tokens:r}=e.credential;if(r.refresh_token===void 0)return G(e.host,t,`Saved OAuth access token expired`,n);let a;try{a=await ie(e)}catch(i){return G(e.host,t,`Saved OAuth credential could not be renewed — ${f(i,g(r))}`,n)}J(n);let o=await Q(e.host,a,`OAuth CLI access token renewed and verified.`);if(!o.ok)return o;let s=await Z(a);return s.state===`failed`?i(`auth login: ${s.summary}`):s.state===`rejected`?G(e.host,t,`Renewed OAuth access token was rejected`,n):o}async function G(e,t,n,r){let a=r??await v(e);if(a.state===`unavailable`)return i(`auth login: ${a.summary}`);J(a),n!==void 0&&D.write(`${n}; continuing to browser sign-in.\n`);let o;try{let e=(await Y()).oauthClient;if(e==null)throw Error(`the API does not advertise an OAuth CLI client`);o=e}catch(e){return i(`auth login: OAuth configuration is unavailable — ${f(e)}`)}let s;try{s=await X(o)}catch(e){return i(`auth login: OAuth authorization-server discovery failed — ${f(e)}`)}if(t.noBrowser)return await K(e,o,s);let c=ce(32).toString(`base64url`),l;try{l=await B(z(o),c);let t=await w(b(o),{metadata:s,clientInformation:{client_id:m(o)},redirectUrl:l.redirectUri,resource:S(o),scope:h(o).join(` `),state:c});t.authorizationUrl.searchParams.delete(`prompt`);let n=await ee(t.authorizationUrl,{noBrowser:!1});n.state===`opened`?D.write(`Browser sign-in opened: choose the account, then approve. Waiting for the loopback callback...
 `):D.write(`Browser not opened automatically (${n.reason}).\nOpen this private sign-in URL in a browser that can reach this machine's loopback callback:
 ${t.authorizationUrl.toString()}\nWaiting for the loopback callback...\n`);let r=await l.waitForAuthorizationCode();if(r.state===`timed-out`)return await l.close(),l=void 0,D.write(`Browser sign-in was not completed; continuing with a device code.