@bli-cockpit/cli 0.2.48 → 0.2.50

package/dist/commands/jarvis.js

@@ -5,10 +5,68 @@
  * existing paired device session, and every turn is executed by the dashboard
  * through the same JARVIS runtime used by web chat and Slack.
  */
-import { colorEnabled, dim, isInteractiveStdin, readLine, readPipedText, writeLine, } from "./cli-io.js";
+import { colorEnabled, dim, isInteractiveStdin, readLine, readPipedText, writeFragment, writeLine, } from "./cli-io.js";
 import { attachedFileRefusalSentence, readAttachedImage, } from "./jarvis-attachment.js";
+import { rememberTurnTrace, runJarvisTrace } from "./jarvis-trace.js";
 import { loadPairedSession, towerFailureDetail, towerJsonRequest, towerRequest, } from "../tower-client.js";
-import { readTowerTurn, streamFailureDetail, } from "../tower-stream.js";
+import { readTowerTurn, streamFailureDetail, turnTimingFields, } from "../tower-stream.js";
+/**
+ * A citation line's link, as the dashboard mints it (BLI-3570):
+ * `Source: BLI-1234 — Judge outage <https://linear.app/…>`. The words are the
+ * receipt; the link is not part of the sentence, so the terminal prints it
+ * underneath, dim, rather than dragging a 118-character URL through the answer.
+ */
+const CITATION_LINK = /^(\s*(?:Source|Receipt)s?:.*?)\s*<(https?:\/\/[^>\s]+)>\s*$/i;
+/**
+ * The answer, one line at a time, so a receipt's link gets its own dim line.
+ * Every other line is printed exactly as it arrived — this never rewrites the
+ * words, only where the link sits.
+ */
+function writeReply(io, prefix, reply) {
+    const styled = colorEnabled(io);
+    const lines = reply.split("\n");
+    lines.forEach((line, index) => {
+        const head = index === 0 ? prefix : "";
+        const citation = line.match(CITATION_LINK);
+        if (!citation) {
+            writeLine(io.stdout, `${head}${line}`);
+            return;
+        }
+        writeLine(io.stdout, `${head}${citation[1]}`);
+        writeLine(io.stdout, dim(`  ${citation[2]}`, styled));
+    });
+}
+/**
+ * The same link rule, applied to text that CONTINUES a line already on screen
+ * (BLI-3517 + BLI-3570).
+ *
+ * When the answer streamed, the citation block arrives after the last token,
+ * so `settle` has a tail to print rather than a whole reply. The first fragment
+ * is deliberately never tested against `CITATION_LINK`: it is the rest of a
+ * sentence the person is already reading, not a line of its own, and a regex
+ * anchored at `^` would be matching against a boundary that is not there.
+ * Every COMPLETE line after it gets the dim link treatment as usual.
+ *
+ * A citation that was already streamed inline cannot be split — a terminal
+ * cannot unprint — and that is the honest limit of this, not a bug to chase.
+ */
+function writeReplyContinuation(io, tail) {
+    const styled = colorEnabled(io);
+    const [first = "", ...rest] = tail.split("\n");
+    writeFragment(io.stdout, first);
+    for (const line of rest) {
+        writeLine(io.stdout, "");
+        const citation = line.match(CITATION_LINK);
+        if (!citation) {
+            writeFragment(io.stdout, line);
+            continue;
+        }
+        writeFragment(io.stdout, citation[1]);
+        writeLine(io.stdout, "");
+        writeFragment(io.stdout, dim(`  ${citation[2]}`, styled));
+    }
+    writeLine(io.stdout, "");
+}
 /**
  * The dashboard route caps a turn at 120s (`maxDuration = 120`). The client
  * waits slightly longer so the server's own named failure wins the race
@@ -17,7 +75,12 @@ import { readTowerTurn, streamFailureDetail, } from "../tower-stream.js";
  */
 const TURN_DEADLINE_MS = 125_000;
 export async function runJarvis(command, io) {
+    // Milliseconds since this process started (`performance.now()` counts from
+    // `timeOrigin`), captured before this command does anything of its own.
+    const bootMs = Math.round(performance.now());
+    const sessionStartedAt = Date.now();
     const session = await loadPairedSession("jarvis", command.homeDir);
+    const sessionMs = Date.now() - sessionStartedAt;
     const dashboardUrl = command.dashboardUrl ?? session.dashboard_url;
     // BLI-3458: reading back what was already said. No turn, no model, no
     // conversation-ledger write — and, on the server, only ever THIS device
@@ -25,9 +88,32 @@ export async function runJarvis(command, io) {
     if (command.threads || command.history) {
         return readHistory({ command, dashboardUrl, deviceToken: session.device_token }, io);
     }
+    // BLI-3560: reading back what a turn DID. Same class of act, same absence of
+    // a model call — this one asks the ops trace door rather than the ledger.
+    if (command.trace) {
+        return runJarvisTrace({
+            dashboardUrl,
+            deviceToken: session.device_token,
+            requested: command.trace,
+            json: command.json,
+            homeDir: command.homeDir,
+        }, io);
+    }
+    const promptStartedAt = Date.now();
     const oneShotPrompt = await resolveOneShotPrompt(command, io);
     if (oneShotPrompt !== null) {
-        return sendOneTurn({ command, dashboardUrl, deviceToken: session.device_token }, oneShotPrompt, io);
+        return sendOneTurn({
+            command,
+            dashboardUrl,
+            deviceToken: session.device_token,
+            boot: {
+                bootMs,
+                sessionMs,
+                // Only meaningful when the question was piped; an argument costs
+                // nothing to read and reporting a stdin wait for it would be a lie.
+                promptMs: command.prompt ? null : Date.now() - promptStartedAt,
+            },
+        }, oneShotPrompt, io);
     }
     if (command.json) {
         throw new Error("cockpit jarvis --json needs --prompt, positional text, or piped stdin.");
@@ -39,7 +125,14 @@ export async function runJarvis(command, io) {
             continue;
         if (prompt === "/exit" || prompt === "/quit")
             return 0;
-        const exitCode = await sendOneTurn({ command, dashboardUrl, deviceToken: session.device_token }, prompt, io);
+        const exitCode = await sendOneTurn({
+            command,
+            dashboardUrl,
+            deviceToken: session.device_token,
+            // The typing wait belongs to the person, not to the turn, so no prompt
+            // span is reported for an interactive turn.
+            boot: { bootMs, sessionMs, promptMs: null },
+        }, prompt, io);
         if (exitCode !== 0)
             return exitCode;
     }
@@ -159,6 +252,13 @@ async function sendOneTurn(context, prompt, io) {
     // works against both server versions with no flag.
     const wantsStream = context.command.stream !== false;
     const log = (line) => writeLine(io.stderr, line);
+    // BLI-3591: everything this turn did before the question left the machine.
+    // There is no self-update probe, no floor check and no settings fetch on
+    // this path — the ONLY awaits between the command starting and the POST are
+    // the paired-session read, the piped-prompt read and an attached image, and
+    // all three are named. If this number is ever large, the step that made it
+    // large is on the same line.
+    const preRequestMs = Date.now() - startedAt;
     const requested = await towerRequest({
         dashboardUrl: context.dashboardUrl,
         path: "/api/jarvis/cli",
@@ -186,17 +286,22 @@ async function sendOneTurn(context, prompt, io) {
     }
     // Live trace lines go to a person as they land, never to a `--json`
     // consumer: that contract is exactly one object on stdout, so the events are
-    // buffered and folded into the final payload instead.
+    // buffered and folded into the final payload instead. The same rule governs
+    // the answer's own words (BLI-3517): `--json` stays exactly one object.
     let liveTraceLines = 0;
+    const live = createLiveAnswer(context.command, io);
     const turn = await readTowerTurn(requested.response, {
         startedAt,
         log,
         onActivity: (event) => {
             if (context.command.json)
                 return;
+            // A trace row must never land in the middle of a half-written sentence.
+            live.interrupt();
             if (writeActivityLine(io, event))
                 liveTraceLines += 1;
         },
+        onToken: (event) => live.token(event),
         onNote: (reason, detail) => {
             log(`[jarvis cli] stream note ${JSON.stringify({
                 reason,
@@ -205,12 +310,14 @@ async function sendOneTurn(context, prompt, io) {
         },
     });
     if (!turn.ok) {
+        live.abandon();
         writeFailure(context.command, io, turn.reason, streamFailureDetail(turn.reason, turn.detail));
         return 1;
     }
     const body = turn.final;
     const httpStatus = typeof turn.final.httpStatus === "number" ? turn.final.httpStatus : requested.response.status;
     if (httpStatus >= 400 || !body.ok || !body.reply) {
+        live.abandon();
         const reason = body.error ?? body.reply ?? `http_${httpStatus}`;
         writeFailure(context.command, io, "turn_failed", reason);
         return 1;
@@ -219,6 +326,11 @@ async function sendOneTurn(context, prompt, io) {
     // because it already sent every step live; the activity we collected is that
     // same trace, so `--json` still gets one.
     const trace = body.trace ?? activityToTrace(turn.activity);
+    // BLI-3560: bookmark this turn so `cockpit jarvis --trace last` can open its
+    // step tree. Written before the reply is printed for no reason other than
+    // keeping the failure — which is only ever a stderr line — above the answer
+    // rather than after it.
+    await rememberTurnTrace({ traceId: body.traceId ?? null, threadId: body.traceThread ?? null }, io, context.command.homeDir);
     if (context.command.json) {
         writeLine(io.stdout, JSON.stringify({
             ok: true,
@@ -227,11 +339,33 @@ async function sendOneTurn(context, prompt, io) {
             model: body.model ?? null,
             trace,
             subject: body.subject ?? null,
+            // BLI-3582: the server's own split of the wait. `null` from a
+            // dashboard that does not measure it yet.
+            latency: latencyFields(body.latency),
+            // BLI-3591: this side's own half of the same wait, so a consumer can
+            // put the whole journey together without a stopwatch of its own.
+            clientLatency: {
+                bootMs: context.boot.bootMs,
+                sessionMs: context.boot.sessionMs,
+                promptMs: context.boot.promptMs,
+                preRequestMs,
+                respondedMs: requested.respondedMs,
+                firstByteMs: turn.timing.firstByteMs,
+                firstFrameMs: turn.timing.firstFrameMs,
+                firstTokenMs: turn.timing.firstTokenMs,
+                elapsedMs: Date.now() - startedAt,
+            },
+            ...(body.traceId ? { traceId: body.traceId } : {}),
         }));
     }
     else {
         const subject = body.subject?.displayName ? ` (${body.subject.displayName})` : "";
-        writeLine(io.stdout, `jarvis${subject}> ${body.reply}`);
+        // BLI-3517: when the answer streamed, `settle` prints only what the live
+        // words did not already say — and says so out loud when the grounding gate
+        // took some of them back. When nothing streamed it prints the whole reply
+        // through `writeReply`, which is byte-for-byte what this command printed
+        // before, BLI-3570's dim link line included.
+        live.settle(body.reply, subject, body.revised === true);
         // Only when nothing was drawn live — otherwise every tool would print twice.
         if (liveTraceLines === 0)
             writeTraceBlock(io, trace);
@@ -250,9 +384,150 @@ async function sendOneTurn(context, prompt, io) {
         image_byte_size: attachment?.bytes.byteLength ?? null,
         streamed: turn.streamed,
         live_trace_lines: liveTraceLines,
+        // BLI-3517: whether the words arrived live, and whether the settled
+        // answer superseded them. `streamed_chars: 0` against a streaming
+        // dashboard means the answer landed all at once.
+        streamed_chars: turn.draft.length,
+        revised: body.revised === true,
+        // BLI-3582: `elapsed_ms` above is the whole wait as this side felt it;
+        // these three say which part of it was the dashboard's prep, which was
+        // the model's first token, and how long the socket stayed silent before
+        // the first byte. All null against a dashboard that does not send them.
+        ...latencyLogFields(body.latency),
+        // BLI-3591: the terminal's own half, on the same line, so the gap
+        // between the dashboard's first token and the first character a person
+        // sees stops being a mystery with nobody's name on it. `boot_ms` and
+        // `session_ms` are process facts (identical on every turn of an
+        // interactive session); the rest are this turn's, measured from the
+        // moment the turn started.
+        ...clientTimingFields(context.boot, {
+            preRequestMs,
+            respondedMs: requested.respondedMs,
+            timing: turn.timing,
+        }),
     })}`);
     return 0;
 }
+/**
+ * The terminal's own spans as log fields (BLI-3591).
+ *
+ * Deliberately snake_case beside the dashboard's three, and deliberately
+ * distinct names: `model_ttft_ms` is the dashboard's clock, `first_token_ms`
+ * is this one, and confusing them is how a latency line stops being
+ * answerable.
+ */
+function clientTimingFields(boot, turn) {
+    return {
+        boot_ms: boot.bootMs,
+        session_ms: boot.sessionMs,
+        prompt_ms: boot.promptMs,
+        pre_request_ms: turn.preRequestMs,
+        responded_ms: turn.respondedMs,
+        ...turnTimingFields(turn.timing),
+    };
+}
+/**
+ * The answer as it is written, in a terminal (BLI-3517).
+ *
+ * A terminal cannot unprint. That single fact decides everything here:
+ *
+ * - The words stream out under the usual `jarvis> ` prefix, printed the moment
+ *   they arrive rather than after the whole turn (a measured 4-16 s of nothing
+ *   before this ticket).
+ * - A `reset` — the server taking back a draft the model wrote before deciding
+ *   to call a tool — cannot erase what is on screen, so it SAYS so on its own
+ *   line and the replacement follows. Never a retracted sentence left standing
+ *   with nothing marking it.
+ * - The settled reply is the authority. The grounding gate runs on the whole
+ *   text once the stream ends, so the answer can grow (citations, a fallback
+ *   notice) or change. A pure continuation is printed as the remainder; a
+ *   genuine change is reprinted whole under a line saying it was revised.
+ * - `--json` never streams a fragment: that contract is exactly one object on
+ *   stdout, and every method here is a no-op for it.
+ */
+function createLiveAnswer(command, io) {
+    const styled = colorEnabled(io);
+    const quiet = command.json === true;
+    let printed = "";
+    let opened = false;
+    const open = (subject) => {
+        if (opened)
+            return;
+        opened = true;
+        writeFragment(io.stdout, `jarvis${subject}> `);
+    };
+    return {
+        token(event) {
+            if (quiet)
+                return;
+            const text = event.text ?? "";
+            if (event.reset) {
+                if (printed) {
+                    writeLine(io.stdout, "");
+                    writeLine(io.stdout, dim("  — that draft was replaced —", styled));
+                    opened = false;
+                }
+                printed = "";
+            }
+            if (!text)
+                return;
+            open("");
+            printed += text;
+            writeFragment(io.stdout, text);
+        },
+        interrupt() {
+            if (quiet || !opened)
+                return;
+            writeLine(io.stdout, "");
+            opened = false;
+        },
+        settle(reply, subject, revised) {
+            if (quiet)
+                return;
+            if (!printed) {
+                // Nothing streamed: a non-streaming dashboard, `--no-stream`, or a
+                // turn whose words never arrived. Exactly the pre-ticket line, dim
+                // citation link and all (BLI-3570).
+                writeReply(io, `jarvis${subject}> `, reply);
+                return;
+            }
+            if (reply === printed) {
+                if (opened)
+                    writeLine(io.stdout, "");
+                return;
+            }
+            if (reply.startsWith(printed)) {
+                // The gate only ADDED — citations going back under the answer, a
+                // fallback notice. Print the tail and leave the words alone; the
+                // citation block is exactly the thing BLI-3570 puts its link under, and
+                // it is arriving here rather than in the stream.
+                if (!opened)
+                    writeFragment(io.stdout, `jarvis${subject}> `);
+                writeReplyContinuation(io, reply.slice(printed.length));
+                return;
+            }
+            if (opened)
+                writeLine(io.stdout, "");
+            writeLine(io.stdout, dim(revised ? `  — ${ANSWER_REVISED_LINE} —` : "  — corrected —", styled));
+            writeReply(io, `jarvis${subject}> `, reply);
+        },
+        abandon() {
+            // The turn died with words already on screen. End the line so the
+            // failure sentence does not run on from a half-written answer.
+            if (!quiet && opened)
+                writeLine(io.stdout, "");
+        },
+    };
+}
+/**
+ * What the terminal says when the grounding gate changed an answer it had
+ * already printed. The browser's own mark says the same thing in one word
+ * (`ANSWER_REVISED_NOTE`, `apps/dashboard/src/lib/webchat/tool-trace.ts`);
+ * this package cannot import from the dashboard, so the sentence is written
+ * here in the same register rather than shared through a dependency that does
+ * not exist.
+ */
+const ANSWER_REVISED_LINE = "revised: I checked that against its sources and changed what they did not back up";
 /**
  * The multipart body `/api/jarvis/cli` reads when a file is attached
  * (BLI-3414) — same field names the request handler parses, mirroring the
@@ -348,7 +623,7 @@ function writeModelReceipt(io, model) {
     if (!model)
         return;
     const requested = typeof model.requestedModel === "string" ? model.requestedModel : null;
-    const answered = typeof model.model === "string" ? model.model : null;
+    const answered = namedModel(model.model);
     const mismatched = requested !== null && answered !== null && requested !== answered;
     if (!model.fallback && !mismatched)
         return;
@@ -357,6 +632,47 @@ function writeModelReceipt(io, model) {
     // schema. Say what the receipt actually reports.
     writeLine(io.stdout, `Model: ${answered ?? "an unknown model"} answered instead of ${requested ?? "the requested model"}`);
 }
+/** One millisecond span off the wire, or null for anything that is not a number. */
+function latencyMs(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+/** The latency split for `--json`, always the same three keys so a consumer can rely on them. */
+function latencyFields(latency) {
+    return {
+        wireMs: latencyMs(latency?.wireMs),
+        prepMs: latencyMs(latency?.prepMs),
+        modelTtftMs: latencyMs(latency?.modelTtftMs),
+    };
+}
+/** The same three spans as log fields, snake_case like everything else on that line. */
+function latencyLogFields(latency) {
+    const split = latencyFields(latency);
+    return {
+        wire_ms: split.wireMs,
+        prep_ms: split.prepMs,
+        model_ttft_ms: split.modelTtftMs,
+    };
+}
+/**
+ * The receipt's `model` field, unless it is the server's own "I could not tell"
+ * sentinel (BLI-3582).
+ *
+ * `modelReceipt` on the dashboard writes the literal string `"unknown"` when
+ * the run reported no model, and this side used to read that as a model NAME —
+ * so a turn whose model was simply unnamed printed
+ * `Model: unknown answered instead of gpt-5.6-terra`, a fallback notice for a
+ * fallback that never happened. Every streamed turn hit it. The dashboard fix
+ * makes the streamed path name the model again; this one makes the sentinel
+ * unable to invent a fallback on any dashboard version, old or new.
+ */
+function namedModel(value) {
+    if (typeof value !== "string")
+        return null;
+    const trimmed = value.trim();
+    if (!trimmed || trimmed.toLowerCase() === "unknown")
+        return null;
+    return trimmed;
+}
 function writeFailure(command, io, reason, detail) {
     if (command.json) {
         writeLine(io.stdout, JSON.stringify({ ok: false, error: reason, detail }));

package/dist/commands/local-arg-values.js

@@ -0,0 +1,169 @@
+/**
+ * The value readers every subcommand's decision table is written in terms of:
+ * one pass over `argv` into named flags and positionals, then one small
+ * question per value — is it non-empty, is it a URL, is it an email, is it a
+ * positive integer, is it a value this schema accepts.
+ *
+ * Split out of commands/local-args.ts (BLI-3578) so each parser reads as its
+ * own decision table rather than as parsing mixed with coercion. Moved
+ * verbatim: no logic changed, and `normalizeUrl` is still re-exported from
+ * `./local-args.js` for the callers that had it there.
+ *
+ * `rejectServiceRoleLikeArgument` runs on every token, flag or positional, and
+ * is why a service-role credential cannot enter a collector command from the
+ * command line at all.
+ */
+const WORK_ROOT_FLAGS = ["--repo", "--workspace"];
+export function parseNamedArgs(args, options) {
+    const allowed = new Set(options.allowedFlags);
+    const valueFlags = new Set(options.valueFlags);
+    const flags = new Map();
+    const flagValues = new Map();
+    const booleans = new Set();
+    const positionals = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index] ?? "";
+        rejectServiceRoleLikeArgument(arg);
+        if (!arg.startsWith("--")) {
+            positionals.push(arg);
+            continue;
+        }
+        const [flag, inlineValue] = arg.split("=", 2);
+        if (!allowed.has(flag))
+            throw new Error(`Unknown flag: ${flag}`);
+        if (valueFlags.has(flag)) {
+            const value = inlineValue ?? args[index + 1];
+            if (!value || value.startsWith("--")) {
+                throw new Error(`${flag} requires a value.`);
+            }
+            rejectServiceRoleLikeArgument(value);
+            flags.set(flag, value);
+            const existing = flagValues.get(flag) ?? [];
+            existing.push(value);
+            flagValues.set(flag, existing);
+            if (inlineValue === undefined)
+                index += 1;
+        }
+        else {
+            if (inlineValue !== undefined)
+                throw new Error(`${flag} does not accept a value.`);
+            booleans.add(flag);
+        }
+    }
+    return { flags, flagValues, booleans, positionals };
+}
+export function workRootFlagValue(values) {
+    const provided = WORK_ROOT_FLAGS.filter((flag) => values.flags.has(flag));
+    if (provided.length === 0)
+        return undefined;
+    const uniqueValues = new Set(provided.map((flag) => values.flags.get(flag)).filter(Boolean));
+    if (uniqueValues.size > 1) {
+        throw new Error("--repo and --workspace must point to the same path.");
+    }
+    return values.flags.get("--workspace") ?? values.flags.get("--repo");
+}
+export function workRootFlagValues(values) {
+    const roots = [];
+    for (const flag of WORK_ROOT_FLAGS) {
+        roots.push(...(values.flagValues.get(flag) ?? []));
+    }
+    return roots;
+}
+export function optionalNonEmptyList(values) {
+    const filtered = values
+        .map((value) => optionalNonEmpty(value))
+        .filter((value) => Boolean(value));
+    return filtered.length > 0 ? filtered : undefined;
+}
+export function assertNoPositionals(positionals, command) {
+    if (positionals.length > 0) {
+        throw new Error(`${command} does not accept positional arguments.`);
+    }
+}
+export function optionalNonEmpty(value) {
+    const trimmed = value?.trim();
+    return trimmed ? trimmed : undefined;
+}
+export function optionalUrl(value) {
+    return value === undefined ? undefined : normalizeUrl(value);
+}
+export function optionalEmail(value) {
+    const trimmed = value?.trim().toLowerCase();
+    if (!trimmed)
+        return undefined;
+    if (!trimmed.includes("@")) {
+        throw new Error("--email must be a valid email address.");
+    }
+    return trimmed;
+}
+export function optionalPositiveInteger(value, flag) {
+    if (value === undefined)
+        return undefined;
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 1) {
+        throw new Error(`${flag} must be a positive integer.`);
+    }
+    return parsed;
+}
+export function optionalConfidence(value, flag) {
+    if (value === undefined)
+        return undefined;
+    const parsed = Number(value);
+    if (!Number.isFinite(parsed) || parsed < 0 || parsed > 1) {
+        throw new Error(`${flag} must be a number between 0 and 1.`);
+    }
+    return parsed;
+}
+export function optionalSchemaValue(schema, value, flag) {
+    const trimmed = optionalNonEmpty(value);
+    if (!trimmed)
+        return undefined;
+    const parsed = schema.safeParse(trimmed);
+    if (!parsed.success || parsed.data === undefined) {
+        throw new Error(`${flag} has an unsupported value.`);
+    }
+    return parsed.data;
+}
+export function normalizeUrl(value) {
+    const trimmed = value.trim().replace(/\/+$/, "");
+    if (!trimmed)
+        throw new Error("URL value cannot be empty.");
+    return trimmed;
+}
+function rejectServiceRoleLikeArgument(value) {
+    if (!looksLikeServiceRoleSecret(value))
+        return;
+    throw new Error("Service-role credentials are not accepted by local collector commands.");
+}
+function looksLikeServiceRoleSecret(value) {
+    if (serviceCredentialNamePattern().test(value))
+        return true;
+    const parts = value.split(".");
+    if (parts.length !== 3)
+        return false;
+    try {
+        const payload = Buffer.from(base64UrlToBase64(parts[1] ?? ""), "base64").toString("utf8");
+        return serviceCredentialPayloadPattern().test(payload);
+    }
+    catch {
+        // Deliberately silent (BLI-3238), and it must stay silent: this is the
+        // "is this argument a service-role JWT?" test, so a value that will not
+        // decode is simply not one. Anything logged here would be a fragment of a
+        // credential.
+        return false;
+    }
+}
+function serviceCredentialNamePattern() {
+    return new RegExp([
+        ["SUPABASE", "SERVICE", "ROLE", "KEY"].join("[_-]?"),
+        ["service", "role"].join("[_-]?"),
+    ].join("|"), "i");
+}
+function serviceCredentialPayloadPattern() {
+    const privilegedRole = ["service", "role"].join("_");
+    return new RegExp(`"role"\\s*:\\s*"${privilegedRole}"`);
+}
+function base64UrlToBase64(value) {
+    const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+    return `${normalized}${"=".repeat((4 - (normalized.length % 4)) % 4)}`;
+}