@catalyst-cloud/catalyst-skills 0.5.0 → 0.8.0

package/dist/transport.js

@@ -1,205 +0,0 @@
-import { normalizeBaseUrl } from "./config.js";
-import { CliError, MeError } from "./errors.js";
-import { bearerFor } from "./oauth.js";
-export const REQUEST_TIMEOUT_MS = 15_000;
-export class ApiClient {
-    baseUrl;
-    credential;
-    fetchImpl;
-    constructor(baseUrl, 
-    /** Resolves the current bearer FRESH per request — a personal key verbatim, or the OAuth access
-     *  token refreshed within 60s of expiry (CTC-2112). Never captured once. */
-    credential, fetchImpl) {
-        this.baseUrl = baseUrl;
-        this.credential = credential;
-        this.fetchImpl = fetchImpl;
-    }
-    /** `path` is absolute under the origin (e.g. `/api/v1/issues`). */
-    url(path, query) {
-        const u = new URL(`${normalizeBaseUrl(this.baseUrl)}${path}`);
-        for (const [k, v] of Object.entries(query ?? {}))
-            if (v !== undefined)
-                u.searchParams.set(k, String(v));
-        return u.toString();
-    }
-    async getJson(path, opts = {}) {
-        const headers = {
-            authorization: `Bearer ${await this.credential()}`,
-            accept: "application/json",
-        };
-        if (opts.etag)
-            headers["if-none-match"] = opts.etag;
-        const url = this.url(path, opts.query);
-        const res = await this.send(url, { method: "GET", headers });
-        if (opts.accept?.includes(res.status)) {
-            return { status: res.status, body: undefined, headers: res.headers };
-        }
-        await this.refuseIfNotOk(res, `GET ${path}`);
-        return { status: res.status, body: await this.parseBody(res, `GET ${path}`), headers: res.headers };
-    }
-    /**
-     * A GET whose success body is NDJSON — one JSON object per line, the shape `streamNdjson` sends.
-     *
-     * ⛔ `/changes` and `/snapshot` ANSWER NDJSON ON 200 AND JSON ON A REFUSAL, so a caller that only
-     * has `getJson` reads every real success as "returned a non-JSON body" while its refusals parse
-     * perfectly. That asymmetry is why `query changes` looked like it worked: nothing reached a 200.
-     * `accept` behaves as it does on `getJson` — those statuses come back with `rows: []` for the
-     * caller to branch on, and their (JSON) body is deliberately not parsed here.
-     */
-    async getNdjson(path, opts = {}) {
-        const url = this.url(path, opts.query);
-        const res = await this.send(url, {
-            method: "GET",
-            headers: { authorization: `Bearer ${await this.credential()}`, accept: "application/x-ndjson, application/json" },
-        });
-        if (opts.accept?.includes(res.status))
-            return { status: res.status, body: [], headers: res.headers };
-        await this.refuseIfNotOk(res, `GET ${path}`);
-        const text = await res.text();
-        const rows = [];
-        for (const line of text.split("\n")) {
-            const trimmed = line.trim();
-            if (trimmed === "")
-                continue;
-            try {
-                rows.push(JSON.parse(trimmed));
-            }
-            catch {
-                throw new MeError(`GET ${path} returned a line that is not JSON: ${trimmed.slice(0, 120)}`, "shape");
-            }
-        }
-        return { status: res.status, body: rows, headers: res.headers };
-    }
-    /** `opts.accept` lists non-2xx statuses returned to the caller with their JSON body instead of thrown
-     *  — the release route answers a refusal as 409 with the refusals the caller has to print. */
-    async postJson(path, body, opts = {}) {
-        const url = this.url(path);
-        const res = await this.send(url, {
-            method: "POST",
-            headers: {
-                authorization: `Bearer ${await this.credential()}`,
-                accept: "application/json",
-                "content-type": "application/json",
-            },
-            body: JSON.stringify(body),
-        });
-        if (!opts.accept?.includes(res.status))
-            await this.refuseIfNotOk(res, `POST ${path}`);
-        return { status: res.status, body: await this.parseBody(res, `POST ${path}`), headers: res.headers };
-    }
-    async send(url, init) {
-        try {
-            return await this.fetchImpl(url, { ...init, signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
-        }
-        catch (err) {
-            throw new MeError(`could not reach ${url}: ${err instanceof Error ? err.message : String(err)}`, "network");
-        }
-    }
-    async parseBody(res, what) {
-        try {
-            return (await res.json());
-        }
-        catch {
-            throw new MeError(`${what} returned a non-JSON body`, "shape");
-        }
-    }
-    async refuseIfNotOk(res, what) {
-        if (res.ok)
-            return;
-        let reason = "";
-        let raw = "";
-        try {
-            raw = await res.text();
-            const body = JSON.parse(raw);
-            reason = body.reason ?? body.error ?? body.message ?? "";
-        }
-        catch {
-            reason = raw.slice(0, 200);
-        }
-        if (res.status === 401) {
-            throw new CliError(`${what} failed (401): credential not accepted — mint a personal key at Settings → API keys and log in again`, "unauthorized", 2, 401);
-        }
-        if (res.status === 403) {
-            throw new CliError(`${what} failed (403): this key may not reach that route${reason ? ` (${reason})` : ""} — a route that acts as a host (claiming work, publishing artifacts) needs the tenant's account key; every read and write a person makes takes your personal key`, "forbidden", 2, 403);
-        }
-        if (res.status === 429) {
-            const retryAfter = res.headers.get("retry-after");
-            const budget = /budget/i.test(raw) || /budget/i.test(reason);
-            throw new CliError(`${what} refused (429)${budget ? ": the per-host daily write budget is spent" : ": rate limited"}${reason ? ` — ${reason}` : ""}${retryAfter ? ` — retry after ${retryAfter}s` : ""}`, budget ? "budget" : "rate-limited", 2, 429);
-        }
-        throw new CliError(`${what} failed (${res.status})${reason ? `: ${reason}` : ""}`, "http", 2, res.status);
-    }
-}
-/** Build the authenticated client for a config: the bearer resolves through {@link bearerFor}, so a
- *  key config sends the key and an OAuth config sends a freshly-refreshed access token per request. */
-export function apiClient(cfg, ctx) {
-    return new ApiClient(cfg.baseUrl, () => bearerFor(ctx, cfg), ctx.fetch);
-}
-/** GET /api/v1/me — how a key learns its own tenant. Unchanged contract from 0.1. */
-export async function fetchMe(baseUrl, key, fetchImpl, timeoutMs = REQUEST_TIMEOUT_MS) {
-    const url = `${normalizeBaseUrl(baseUrl)}/api/v1/me`;
-    let res;
-    try {
-        res = await fetchImpl(url, {
-            headers: { authorization: `Bearer ${key}`, accept: "application/json" },
-            signal: AbortSignal.timeout(timeoutMs),
-        });
-    }
-    catch (err) {
-        throw new MeError(`could not reach ${url}: ${err instanceof Error ? err.message : String(err)}`, "network");
-    }
-    if (!res.ok) {
-        let reason;
-        try {
-            const body = (await res.json());
-            reason = body.reason ?? body.error ?? "";
-        }
-        catch {
-            reason = "";
-        }
-        const detail = res.status === 401
-            ? "credential not accepted — mint a personal key at Settings → API keys and log in again"
-            : reason || `HTTP ${res.status}`;
-        throw new MeError(`GET /me failed (${res.status}): ${detail}`, "http", res.status);
-    }
-    let body;
-    try {
-        body = (await res.json());
-    }
-    catch {
-        throw new MeError("GET /me returned a non-JSON body", "shape");
-    }
-    if (typeof body.account !== "string" ||
-        typeof body.slug !== "string" ||
-        typeof body.name !== "string" ||
-        (body.permissions !== null && !Array.isArray(body.permissions)) ||
-        (body.principal !== "service" && body.principal !== "session")) {
-        throw new MeError("GET /me returned an unexpected shape", "shape");
-    }
-    const user = parseMeUser(body.user);
-    return {
-        account: body.account,
-        slug: body.slug,
-        name: body.name,
-        permissions: body.permissions,
-        principal: body.principal,
-        ...(user ? { user } : {}),
-    };
-}
-/** The `user` block a personal key gets from /me. Absent (undefined) is "a host key, no person";
- *  present-but-malformed is a shape error like any other field, never silently dropped. */
-function parseMeUser(raw) {
-    if (raw === undefined)
-        return undefined;
-    if (typeof raw !== "object" || raw === null)
-        throw new MeError("GET /me returned an unexpected user shape", "shape");
-    const u = raw;
-    if (typeof u.id !== "string" ||
-        typeof u.label !== "string" ||
-        (u.email !== null && typeof u.email !== "string") ||
-        (u.role !== "owner" && u.role !== "admin" && u.role !== "member") ||
-        (u.linearUserId !== null && typeof u.linearUserId !== "string")) {
-        throw new MeError("GET /me returned an unexpected user shape", "shape");
-    }
-    return { id: u.id, label: u.label, email: u.email, role: u.role, linearUserId: u.linearUserId };
-}

package/dist/ts-deps-loader.js

@@ -1,68 +0,0 @@
-// ts-deps-loader.ts — lets plain Node load the Catalyst Cloud SDK.
-//
-// `@catalyst-cloud/sdk` depends on `@catalyst-cloud/schema` and `@catalyst-cloud/replicate`, both of
-// which are published as TypeScript source (`exports: "./src/index.ts"`). Node refuses to strip types
-// for files under node_modules (ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING), so a bare
-// `import("@catalyst-cloud/sdk/node")` fails on every Node version. Bun and vitest transpile anywhere,
-// which is why the SDK's other consumers never see this.
-//
-// This module installs two synchronous module hooks (Node 22.15+): a `load` hook that strips types
-// from any `.ts` file under node_modules with Node's own `stripTypeScriptTypes`, and a `resolve` hook
-// that maps a failed `./x.js` relative import onto `./x.ts` (the TS-ESM suffix convention those
-// packages use). Nothing outside node_modules is touched, and the hooks are installed once.
-import * as nodeModule from "node:module";
-import { existsSync, readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-let installed = false;
-function inDeps(url) {
-    return typeof url === "string" && url.startsWith("file:") && url.includes("/node_modules/");
-}
-/** Build the hook pair over a strip function. Pure, so a test can drive it with fake `next`s. */
-export function makeHooks(strip, fileExists = existsSync, readFile = (p) => readFileSync(p, "utf8")) {
-    return {
-        resolve(specifier, context, next) {
-            try {
-                return next(specifier, context);
-            }
-            catch (err) {
-                const code = err?.code;
-                if (code === "ERR_MODULE_NOT_FOUND" && specifier.startsWith(".") && inDeps(context.parentURL)) {
-                    const base = specifier.endsWith(".js") ? specifier.slice(0, -3) : specifier;
-                    const alt = new URL(`${base}.ts`, context.parentURL);
-                    if (fileExists(fileURLToPath(alt)))
-                        return { url: alt.href, format: "module", shortCircuit: true };
-                }
-                throw err;
-            }
-        },
-        load(url, context, next) {
-            if (inDeps(url) && url.endsWith(".ts")) {
-                return { format: "module", shortCircuit: true, source: strip(readFile(fileURLToPath(url)), { mode: "transform", sourceUrl: url }) };
-            }
-            return next(url, context);
-        },
-    };
-}
-/** Install the hooks once. Returns whether they are installed and, if not, why. */
-export function installTsDepsLoader(mod = nodeModule) {
-    if (installed)
-        return { installed: true };
-    if (typeof mod.registerHooks !== "function") {
-        return { installed: false, reason: `node:module has no registerHooks on Node ${process.version}; Node 22.15 or newer is required` };
-    }
-    if (typeof mod.stripTypeScriptTypes !== "function") {
-        return { installed: false, reason: `node:module has no stripTypeScriptTypes on Node ${process.version}; Node 22.13 or newer is required` };
-    }
-    // Node prints "stripTypeScriptTypes is an experimental feature" once on first use; that line would
-    // land on stderr of every SDK-loading verb, so the one warning this loader provokes is dropped.
-    const emit = process.emitWarning.bind(process);
-    process.emitWarning = ((warning, ...rest) => {
-        const text = typeof warning === "string" ? warning : warning instanceof Error ? warning.message : "";
-        if (text.includes("stripTypeScriptTypes"))
-            return;
-        emit(warning, ...rest);
-    });
-    mod.registerHooks(makeHooks(mod.stripTypeScriptTypes));
-    installed = true;
-    return { installed: true };
-}

package/dist/watch/consumer.js

@@ -1,141 +0,0 @@
-import { readCursorFile, writeCursorFile } from "./cursor-file.js";
-export const LOG_PREFIX = "[live-events]";
-function defaultWsFactory(url) {
-    const Ctor = globalThis.WebSocket;
-    if (!Ctor)
-        throw new Error("global WebSocket unavailable; pass wsFactory (Node >= 22 exposes one)");
-    return new Ctor(url);
-}
-export function printFrame(frame) {
-    console.log(`${LOG_PREFIX} frame ${JSON.stringify(frame)}`);
-}
-async function fetchHeadCursor(opts, signal) {
-    const url = `${opts.baseUrl.replace(/\/+$/, "")}/snapshot?head=1`;
-    const res = await (opts.fetchImpl ?? fetch)(url, { headers: { authorization: `Bearer ${await opts.getToken()}` }, signal });
-    if (!res.ok) {
-        const body = (await res.text()).slice(0, 200);
-        throw new Error(`head-only snapshot fetch failed: ${res.status} ${res.statusText} at ${url} — ${body}`);
-    }
-    const head = (await res.json());
-    if (head.accountId !== opts.accountId) {
-        throw new Error(`head-only snapshot is for account ${JSON.stringify(head.accountId)} but this session is for ${JSON.stringify(opts.accountId)} — the key and the configured account disagree`);
-    }
-    if (typeof head.cursor !== "number" || !Number.isInteger(head.cursor) || head.cursor < 0) {
-        throw new Error(`head-only snapshot returned a non-integer cursor: ${JSON.stringify(head.cursor)}`);
-    }
-    return head.cursor;
-}
-/**
- * Build the events-only client. Construction reads the cursor file ONCE (throwing on a corrupt file
- * or a cross-account reuse); the position is then kept in memory and persisted after every
- * SUCCESSFUL reaction. React first, persist second: an async reaction is awaited before its cursor
- * persists and later frames queue behind it in seq order; a failed reaction halts the stream and
- * closes the socket so the SDK's reconnect replays from the last good cursor.
- */
-export function createLiveEventsClient(sdk, opts) {
-    let state = opts.fromHead ? null : readCursorFile(opts.cursorFile, opts.accountId);
-    const log = opts.log ??
-        ((level, msg, extra) => console[level === "error" ? "error" : "log"](`${LOG_PREFIX} ${msg}`, extra ?? ""));
-    const persist = (next) => {
-        state = next;
-        writeCursorFile(opts.cursorFile, next);
-    };
-    const reseedHead = async (signal) => {
-        const cursor = await fetchHeadCursor(opts, signal);
-        persist({ account: opts.accountId, cursor });
-        log("info", `cursor re-seeded to tenant head ${cursor} (head-only; no rows applied)`);
-        opts.onReseed?.(cursor);
-        return cursor;
-    };
-    const react = opts.onEvent ?? printFrame;
-    let socket = null;
-    let halted = false;
-    let inFlight = null;
-    const queued = [];
-    const advance = (frame) => {
-        if (state && state.cursor >= frame.seq)
-            return;
-        persist({ account: frame.accountId, cursor: frame.seq });
-    };
-    const fail = (frame, err) => {
-        halted = true;
-        queued.length = 0;
-        inFlight = null;
-        log("error", `reaction failed for ${frame.entity} seq=${frame.seq}; cursor left at ${state?.cursor ?? "none"} — reconnecting so the replay re-offers it`, err);
-        const ws = socket;
-        socket = null;
-        try {
-            ws?.close();
-        }
-        catch {
-            // already closing/closed
-        }
-    };
-    const settle = (frame) => {
-        advance(frame);
-        inFlight = null;
-        const next = queued.shift();
-        if (next)
-            run(next);
-    };
-    const run = (frame) => {
-        let result;
-        try {
-            result = react(frame);
-        }
-        catch (err) {
-            fail(frame, err);
-            return;
-        }
-        if (result && typeof result.then === "function") {
-            const p = result.then(() => {
-                if (inFlight === p)
-                    settle(frame);
-            }, (err) => {
-                if (inFlight === p)
-                    fail(frame, err);
-            });
-            inFlight = p;
-            return;
-        }
-        advance(frame);
-    };
-    const wrappedFactory = (url) => {
-        const ws = (opts.wsFactory ?? defaultWsFactory)(url);
-        socket = ws;
-        halted = false;
-        queued.length = 0;
-        inFlight = null;
-        return ws;
-    };
-    const client = new sdk.LiveSyncClient({
-        baseUrl: opts.baseUrl,
-        accountId: opts.accountId,
-        auth: opts.auth,
-        reseed: reseedHead,
-        getCursor: () => state?.cursor ?? null,
-        onChange: (frame) => {
-            if (frame.accountId !== opts.accountId) {
-                const msg = `refusing frame for account ${JSON.stringify(frame.accountId)} — this session is for ${JSON.stringify(opts.accountId)} (cursor left at ${state?.cursor ?? "none"})`;
-                log("error", msg);
-                throw new Error(msg);
-            }
-            if (halted)
-                return;
-            if (inFlight) {
-                queued.push(frame);
-                return;
-            }
-            run(frame);
-        },
-        onStatus: opts.onStatus ??
-            ((status) => {
-                log("info", `status=${status}`);
-            }),
-        backoffMs: opts.backoffMs,
-        maxBackoffMs: opts.maxBackoffMs,
-        wsFactory: wrappedFactory,
-        log,
-    });
-    return { client, cursor: () => state?.cursor ?? null, reseedHead };
-}

package/dist/watch/cursor-file.js

@@ -1,62 +0,0 @@
-// watch/cursor-file.ts — the durable cursor store for the events-only `watch` consumer, ported whole
-// from the cloud's tested host-sync implementation. The file is the whole state:
-//
-//   { "account": "<tenant id>", "cursor": 41 }
-//
-// The account field is load-bearing: a cursor is a position in ONE tenant's change log, so the file
-// refuses to be read for a different account than the one stamped in it (a named throw naming both
-// accounts). A torn or corrupt file also fails loudly; the only "no state yet" is the file's absence.
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { dirname } from "node:path";
-export class CursorFileError extends Error {
-    path;
-    constructor(message, path) {
-        super(message);
-        this.path = path;
-        this.name = "CursorFileError";
-    }
-}
-function validateShape(parsed) {
-    if (typeof parsed !== "object" || parsed === null)
-        return { ok: false, error: "content is not a JSON object" };
-    const { account, cursor } = parsed;
-    if (typeof account !== "string" || account.trim() === "")
-        return { ok: false, error: "account is missing or not a non-empty string" };
-    if (typeof cursor !== "number" || !Number.isInteger(cursor) || cursor < 0)
-        return { ok: false, error: "cursor is missing or not a non-negative integer" };
-    return { ok: true, state: { account, cursor } };
-}
-/** Returns null ONLY when the file is absent. Throws CursorFileError on an unreadable, corrupt, or
- *  wrongly shaped file, and on a cross-account file when `expectAccount` is given. */
-export function readCursorFile(path, expectAccount) {
-    if (!existsSync(path))
-        return null;
-    let raw;
-    try {
-        raw = readFileSync(path, "utf8");
-    }
-    catch (err) {
-        throw new CursorFileError(`cannot read cursor file: ${err instanceof Error ? err.message : String(err)}`, path);
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        throw new CursorFileError("cursor file is not valid JSON (torn write?) — delete it to re-seed from the tenant head, at the cost of replaying nothing in between", path);
-    }
-    const shape = validateShape(parsed);
-    if (!shape.ok)
-        throw new CursorFileError(`cursor file is malformed: ${shape.error}`, path);
-    if (expectAccount !== undefined && shape.state.account !== expectAccount) {
-        throw new CursorFileError(`cursor file belongs to account ${JSON.stringify(shape.state.account)} but this session is for ${JSON.stringify(expectAccount)} — a cursor is a position in ONE tenant's feed; move or delete the file rather than replaying one tenant's position against another`, path);
-    }
-    return shape.state;
-}
-/** Atomic: a sibling temp file, then rename over the target. */
-export function writeCursorFile(path, state) {
-    mkdirSync(dirname(path), { recursive: true });
-    const tmp = `${path}.tmp`;
-    writeFileSync(tmp, `${JSON.stringify(state)}\n`, "utf8");
-    renameSync(tmp, path);
-}

package/dist/watch.js

@@ -1,175 +0,0 @@
-// watch.ts — `watch [--team K] [--ticket T]... [--project P] [--exec CMD] [--cursor-file] [--from]`:
-// one JSON line per in-scope change frame, cursor advanced after the reaction, over the SDK's live
-// stream. Scope is filtered on the client from the frame's entity and row; a project scope resolves
-// an issue reference to its project through GET /api/v1/issues/:ref, cached in memory.
-import { spawn } from "node:child_process";
-import { flagList, flagString } from "./args.js";
-import { apiBase, requireConfig, watchCursorPathFor } from "./config.js";
-import { loadContract } from "./contract.js";
-import { CliError, UsageError } from "./errors.js";
-import { apiClient } from "./transport.js";
-import { authStrategyFor, bearerFor } from "./oauth.js";
-import { loadSdk } from "./sdk.js";
-import { createLiveEventsClient } from "./watch/consumer.js";
-import { CursorFileError } from "./watch/cursor-file.js";
-const ROW_ISSUE_REFS = ["identifier", "linear_issue_identifier", "issue_identifier", "issue_id", "linear_issue_id"];
-/** Decide whether one frame falls inside the scope. An empty scope admits everything. Rows that only
- *  carry an issue reference (comments, sessions, PRs) resolve it through `resolve` for project scope. */
-export async function inScope(frame, scope, resolve) {
-    const hasScope = Boolean(scope.teamId || scope.teamKey || (scope.tickets && scope.tickets.length) || scope.projectId);
-    if (!hasScope)
-        return true;
-    const row = frame.row ?? {};
-    const refs = ROW_ISSUE_REFS.map((k) => row[k]).filter((v) => typeof v === "string" && v !== "");
-    const upperTickets = (scope.tickets ?? []).map((t) => t.toUpperCase());
-    if (upperTickets.length > 0) {
-        if (refs.some((r) => upperTickets.includes(r.toUpperCase())))
-            return true;
-        for (const r of refs) {
-            const info = await resolve(r);
-            if (info?.identifier && upperTickets.includes(info.identifier.toUpperCase()))
-                return true;
-        }
-    }
-    if (scope.projectId) {
-        if (row.project_id === scope.projectId || row.id === scope.projectId)
-            return true;
-        for (const r of refs) {
-            const info = await resolve(r);
-            if (info?.projectId === scope.projectId)
-                return true;
-        }
-    }
-    if (scope.teamId || scope.teamKey) {
-        if (scope.teamId && (row.team_id === scope.teamId || row.teamId === scope.teamId))
-            return true;
-        if (scope.teamKey && refs.some((r) => /^[A-Za-z]+-\d+$/.test(r) && r.toUpperCase().startsWith(`${scope.teamKey.toUpperCase()}-`)))
-            return true;
-        for (const r of refs) {
-            const info = await resolve(r);
-            if (info && scope.teamId && info.teamId === scope.teamId)
-                return true;
-            if (info?.identifier && scope.teamKey && info.identifier.toUpperCase().startsWith(`${scope.teamKey.toUpperCase()}-`))
-                return true;
-        }
-    }
-    return false;
-}
-/** Resolve issue references through the API, cached per process. */
-export function apiIssueResolver(cfg, ctx) {
-    const api = apiClient(cfg, ctx);
-    const cache = new Map();
-    return async (ref) => {
-        if (cache.has(ref))
-            return cache.get(ref);
-        let out = null;
-        try {
-            const res = await api.getJson(`/api/v1/issues/${encodeURIComponent(ref)}`, { accept: [404] });
-            if (res.status !== 404 && res.body) {
-                out = {
-                    id: typeof res.body.id === "string" ? res.body.id : null,
-                    identifier: typeof res.body.identifier === "string" ? res.body.identifier : null,
-                    projectId: typeof res.body.project_id === "string" ? res.body.project_id : null,
-                    teamId: typeof res.body.team_id === "string" ? res.body.team_id : null,
-                };
-            }
-        }
-        catch {
-            out = null;
-        }
-        cache.set(ref, out);
-        return out;
-    };
-}
-/**
- * Run `--exec CMD` once with the frame on stdin; a non-zero exit is a failed reaction.
- *
- * The child's EXIT CODE is the whole contract, and a broken pipe is not a failure on its own. A
- * handler that exits before reading the frame is ordinary and often correct — `grep -q`, `head -1`,
- * a script that fails fast — and so is one that simply died. In every one of those cases the write
- * lands on a pipe with nothing at the other end and raises EPIPE asynchronously. Node delivers that
- * as an `error` event on the child's stdin, and a stream with no `error` listener rethrows it as an
- * unhandled error, which takes down the whole watch: one misbehaving handler and the customer stops
- * receiving their tenant's events. So the pipe is allowed to break, and the exit code still decides.
- */
-export function execReaction(cmd, env) {
-    return (frame) => new Promise((resolve, reject) => {
-        const child = spawn("sh", ["-c", cmd], { stdio: ["pipe", "inherit", "inherit"], env });
-        child.on("error", reject);
-        child.on("close", (code) => (code === 0 ? resolve() : reject(new Error(`--exec exited ${code}`))));
-        // Listen before writing: attaching afterwards races the synchronous part of `end()`.
-        child.stdin.on("error", () => { });
-        try {
-            if (child.stdin.writable)
-                child.stdin.end(`${JSON.stringify(frame)}\n`);
-        }
-        catch {
-            // A stdin already destroyed throws here rather than emitting; same verdict, wait for close.
-        }
-    });
-}
-export async function runWatch(ctx, cfg, opts, deps = {}) {
-    const sdk = deps.sdk ?? (await loadSdk());
-    const resolve = deps.resolver ?? apiIssueResolver(cfg, ctx);
-    const react = opts.exec ? execReaction(opts.exec, ctx.env) : undefined;
-    let handle;
-    try {
-        handle = buildHandle();
-    }
-    catch (err) {
-        if (err instanceof CursorFileError)
-            throw new CliError(`${err.message} (${err.path})`, "cursor-file");
-        throw err;
-    }
-    deps.onHandle?.(handle);
-    const stopped = deps.waitForStop ??
-        (() => new Promise((done) => {
-            process.once("SIGINT", () => done());
-            process.once("SIGTERM", () => done());
-        }));
-    const running = handle.client.start();
-    await stopped();
-    handle.client.stop();
-    await running;
-    return 0;
-    function buildHandle() {
-        return createLiveEventsClient(sdk, {
-            baseUrl: apiBase(cfg),
-            accountId: cfg.account,
-            auth: authStrategyFor(ctx, cfg),
-            getToken: () => bearerFor(ctx, cfg),
-            cursorFile: opts.cursorFile ?? watchCursorPathFor(ctx.home),
-            fromHead: opts.fromHead,
-            fetchImpl: ctx.fetch,
-            wsFactory: deps.wsFactory,
-            backoffMs: deps.backoffMs,
-            maxBackoffMs: deps.maxBackoffMs,
-            log: (level, msg) => ctx.stderr(`[watch ${level}] ${msg}`),
-            onStatus: (s) => ctx.stderr(`[watch] status=${s}`),
-            onReseed: (cursor) => ctx.stderr(`[watch] resync: cursor moved to head ${cursor}`),
-            onEvent: async (frame) => {
-                if (!(await inScope(frame, opts.scope, resolve)))
-                    return;
-                ctx.stdout(JSON.stringify(frame));
-                if (react)
-                    await react(frame);
-            },
-        });
-    }
-}
-export async function cmdWatch(args, ctx, deps = {}) {
-    const cfg = requireConfig(ctx);
-    const from = flagString(args, "from") ?? "cursor";
-    if (from !== "cursor" && from !== "head")
-        throw new UsageError("--from must be cursor or head");
-    const scope = { tickets: flagList(args, "ticket"), projectId: flagString(args, "project") };
-    const teamKey = flagString(args, "team");
-    if (teamKey) {
-        const { doc } = await loadContract(ctx, cfg);
-        const team = doc.teams.find((t) => (t.key ?? "").toUpperCase() === teamKey.toUpperCase());
-        scope.teamKey = teamKey;
-        if (team)
-            scope.teamId = team.id;
-    }
-    return runWatch(ctx, cfg, { scope, exec: flagString(args, "exec"), cursorFile: flagString(args, "cursor-file"), fromHead: from === "head" }, deps);
-}