@cognite/cli 1.3.4-alpha.selfsigned → 1.4.0-alpha.sdk-gen

package/dist/cli/cli.js

@@ -1,14 +1,84 @@
 #!/usr/bin/env node
-import{a as o,e as He}from"../chunk-A5ASLC6T.js";import{writeSync as Ki}from"fs";import{Command as ji}from"commander";var Be="https://docs.cognite.com/cdf/access/";function D(e){return e!==null&&typeof e=="object"}o(D,"isRecord");function G(e){return e instanceof Error&&"status"in e&&typeof e.status=="number"}o(G,"isHttpError");function Tr(e){switch(e){case 401:return`Your credentials are invalid or expired. Check your client ID and secret.
-  See: ${Be}`;case 403:return`You don't have the required CDF capabilities. Please contact your CDF admin.
-  See: ${Be}`;default:return}}o(Tr,"httpStatusHint");function H(e){let t=e instanceof Error?e:new Error(String(e));if(!G(t))return null;let r=Tr(t.status);return r?Object.assign(new Error(`${t.message}
-  ${r}`),{cause:t}):null}o(H,"enrichedHttpError");function Ir(e){if(!D(e))return null;let t=e.missing;if(Array.isArray(t))return t;let r=e.data;if(D(r)){let n=r.error;if(D(n)&&Array.isArray(n.missing))return n.missing;if(Array.isArray(r.missing))return r.missing}return null}o(Ir,"findMissingArray");function $r(e,t){if(!G(e)||e.status!==400)return!1;let r=Ir(e);return r?r.some(n=>D(n)&&typeof n.externalId=="string"&&t.includes(n.externalId)):!1}o($r,"isMissingExternalIdError");function pe(e,t){return G(e)&&e.status===404||$r(e,t)}o(pe,"isNotFoundError");var Ye=["DRAFT","PUBLISHED","DEPRECATED","ARCHIVED"],Je=["ACTIVE","PREVIEW"],le=class le extends Error{constructor(t,r){super(`Version ${r} of app ${t} not found`),this.name="AppVersionNotFoundError",this.appExternalId=t,this.version=r}};o(le,"AppVersionNotFoundError");var C=le;function Xe(e,t){return e.includes(t)}o(Xe,"includesValue");function Fr(e){return Xe(Ye,e)}o(Fr,"isAppVersionLifecycleState");function _r(e){return Xe(Je,e)}o(_r,"isAppVersionAlias");function Rr(e){return typeof e.version=="string"&&Fr(e.lifecycleState)&&typeof e.entrypoint=="string"&&typeof e.createdTime=="number"&&typeof e.createdBy=="string"&&typeof e.appExternalId=="string"&&(e.alias===void 0||_r(e.alias))&&(e.comment===void 0||typeof e.comment=="string")}o(Rr,"isAppVersion");function Ge(e){if(!D(e))throw new Error("Invalid version response: not an object");if(!Rr(e))throw new Error("Invalid version response: missing or malformed fields");return e}o(Ge,"parseAppVersion");var me=class me{constructor(t){this.client=t}get appsBasePath(){return`/api/v1/projects/${encodeURIComponent(this.client.project)}/apphosting/apps`}async createApp(t,r,n){try{await this.client.post(this.appsBasePath,{data:{items:[{externalId:t,name:r,description:n}]}})}catch(i){throw H(i)??i}}async uploadVersion(t,r,n,i,s="index.html"){console.log(`\u{1F4E4} Uploading version ${r}...`);let a=new FormData;a.append("file",new Blob([new Uint8Array(n)]),i),a.append("version",r),a.append("entryPath",s);let c=encodeURIComponent(t),p=`${this.appsBasePath}/${c}/versions`,l=await this.client.authenticate(),m=`${this.client.getBaseUrl()}${p}`,d=new AbortController,u=setTimeout(()=>d.abort(),300*1e3),f;try{f=await fetch(m,{method:"POST",headers:{Authorization:`Bearer ${l}`},body:a,signal:d.signal})}catch(g){throw g instanceof Error&&g.name==="AbortError"?new Error("Upload timed out after 5 minutes"):g}finally{clearTimeout(u)}if(!f.ok){let g=await f.text(),A=g;try{let U=JSON.parse(g);if(D(U)){let P=U.error;if(typeof P=="string")A=P;else if(D(P)){let k=P.message,y=P.code;A=typeof k=="string"?k:y!=null?`Unknown error (code: ${y})`:g}else{let k=U.message;A=typeof k=="string"?k:g}}}catch{}let v=f.headers.get("x-request-id"),Z=v?` | X-Request-ID: ${v}`:"",V=Object.assign(new Error(`Upload failed: ${f.status} \u2014 ${A}${Z}`),{status:f.status});throw H(V)??V}console.log(`\u2705 Version ${r} uploaded`)}async getVersion(t,r){let n=encodeURIComponent(t),i=encodeURIComponent(r),s=`${this.appsBasePath}/${n}/versions/${i}`;try{let a=await this.client.get(s);return Ge(a.data)}catch(a){throw pe(a,[t,r])?new C(t,r):H(a)??a}}async getActiveVersion(t){let r=encodeURIComponent(t),n=`${this.appsBasePath}/${r}/active`;try{let i=await this.client.get(n);return Ge(i.data)}catch(i){if(pe(i,[t]))return null;throw H(i)??i}}async updateVersions(t,r){let n=encodeURIComponent(t),i=`${this.appsBasePath}/${n}/versions/update`;try{await this.client.post(i,{data:{items:r}})}catch(s){throw H(s)??s}}};o(me,"AppHostingApi");var ee=me;var de=class de{constructor(t){this.api=new ee(t)}getVersion(t,r){return this.api.getVersion(t,r)}uploadVersion(t,r,n,i,s){return this.api.uploadVersion(t,r,n,i,s)}async ensureApp(t,r,n){console.log("\u{1F50D} Ensuring app exists...");try{await this.api.createApp(t,r,n),console.log(`\u2705 App '${t}' created`)}catch(i){if(G(i)&&i.status===409){console.log(`\u2705 App '${t}' already exists`);return}throw i}}async publishVersion(t,r){await this.api.updateVersions(t,[{version:r,update:{lifecycleState:{set:"PUBLISHED"}}}])}async publishAndActivate(t,r){console.log(`\u{1F680} Publishing and activating version ${r}...`),await this.api.updateVersions(t,[{version:r,update:{lifecycleState:{set:"PUBLISHED"},alias:{set:"ACTIVE"}}}]),console.log(`\u2705 Version ${r} is now PUBLISHED and ACTIVE`)}async activateVersion(t,r){let n=null;try{n=await this.api.getActiveVersion(t)}catch{n=null}let i=n&&n.version!==r?n.version:void 0;return await this.api.updateVersions(t,[{version:r,update:{alias:{set:"ACTIVE"}}}]),{supersededVersion:i}}async deploy(t,r,n,i,s,a,c=!1){console.log(`
-\u{1F680} Deploying application via App Hosting API...
-`);try{await this.ensureApp(t,r,n),await this.uploadVersion(t,i,s,a),c&&await this.publishAndActivate(t,i),console.log(`
-\u2705 Deployment successful!`)}catch(p){let l=p instanceof Error?p.message:String(p);throw Object.assign(new Error(`Deployment failed: ${l}`),{cause:p})}}};o(de,"AppHostingClient");var h=de;import{existsSync as Gr,readFileSync as Yr}from"fs";import{resolve as Jr}from"path";import{array as Or,boolean as Ur,check as ze,forward as qe,literal as Lr,maxLength as Nr,minLength as Kr,nonEmpty as L,object as We,optional as T,picklist as jr,pipe as x,safeParse as Mr,string as w,url as Vr}from"valibot";var ue=x(w(),L("must not be empty")),ge=x(w(),L("must not be empty"),Nr(256,"must be 256 characters or fewer")),fe=x(w(),L("must not be empty"),Vr("must be a valid URL")),ye=x(w(),L("must not be empty")),he=x(w(),L("must not be empty")),Hr=x(We({org:ye,project:he,baseUrl:fe,deployClientId:T(w(),""),deploySecretName:T(w(),""),published:T(Ur(),!1),idpType:T(jr(["cdf","entra_id"]),"cdf"),tenantId:T(w()),scope:T(x(w(),L("must not be empty")))}),qe(ze(e=>e.idpType!=="entra_id"||!!e.tenantId,'must be set when idpType is "entra_id"'),["tenantId"]),qe(ze(e=>!e.deployClientId||!!e.deploySecretName,"must be set when deployClientId is set"),["deploySecretName"])),Br=We({name:ue,externalId:ge,versionTag:x(w(),L("must not be empty")),description:T(w(),""),deployments:x(Or(Hr),Kr(1,"must contain at least one deployment")),infra:T(Lr("appsApi"))});function Ee(e){let t=Mr(Br,e);if(t.success)return t.output;let r=t.issues[0],n=r.path?.map(s=>s.key).join(".")??"",i=n?`"${n}" `:"";throw new Error(`app.json: ${i}${r.message}`)}o(Ee,"validateAppConfig");function S(e,t={}){let{validator:r=Ee,existsSync:n=Gr,readFileSync:i=Yr}=t,s=Jr(e,"app.json");if(!n(s))throw new Error("No app.json found in current directory. Make sure you're running this command from your app's root directory.");let a=i(s,"utf-8"),c;try{c=JSON.parse(a)}catch{throw new Error("Failed to parse app.json \u2014 check that it contains valid JSON.")}return r(c)}o(S,"loadAppConfig");import{CogniteClient as wn}from"@cognite/sdk";import{CogniteClient as Zr}from"@cognite/sdk";var Xr=o(()=>{let e=process.env.DEPLOYMENT_SECRETS;if(!e)return{};try{let t=JSON.parse(e),r={};for(let[n,i]of Object.entries(t))if(typeof i=="string"){let s=n.toLowerCase().replace(/_/g,"-");r[s]=i}return r}catch(t){return console.error("Error parsing DEPLOYMENT_SECRETS:",t),{}}},"loadSecretsFromEnv"),zr=o(e=>{let t;if(process.env.DEPLOYMENT_SECRET&&(t=process.env.DEPLOYMENT_SECRET),t||(t=Xr()[e]),t||(t=process.env[e]),!t)throw new Error(`Secret not found in environment: ${e}`);return t},"getSecretFromEnv"),qr=o(e=>{if(!e)return"";try{return new URL(e).hostname.replace(/\.cognitedata\.com$/,"")}catch{let t=e.replace(/^https?:\/\//,"");return t=t.split("/")[0],t=t.split(":")[0],t=t.replace(/\.cognitedata\.com$/,""),t}},"extractClusterFromUrl"),Wr=o(async(e,t)=>{let r=`Basic ${btoa(`${e}:${t}`)}`,n=await fetch("https://auth.cognite.com/oauth2/token",{method:"POST",headers:{Authorization:r,"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"client_credentials"})});if(!n.ok){let s=await n.text();throw new Error(`Failed to get token from CDF: ${n.status} ${n.statusText}
-${s}`)}let i=await n.json();if(!i.access_token)throw new Error("No access token returned from CDF authentication");return i.access_token},"getTokenCdf"),Qr=o(async(e,t,r,n,i)=>{let s;if(i)s=i;else{if(!n)throw new Error("Entra ID authentication requires 'baseUrl' to be set in deployment configuration");let l=qr(n);if(!l)throw new Error(`Entra ID authentication requires 'baseUrl' to be a valid CDF URL (e.g., https://cluster.cognitedata.com), got: ${n}`);s=`https://${l}.cognitedata.com/.default`}let a=`https://login.microsoftonline.com/${r}/oauth2/v2.0/token`,c=await fetch(a,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:e,client_secret:t,scope:s,grant_type:"client_credentials"})});if(!c.ok){let l=await c.text();throw new Error(`Failed to get token from Entra ID: ${c.status} ${c.statusText}
-${l}`)}let p=await c.json();if(!p.access_token)throw new Error("No access token returned from Entra ID authentication");return p.access_token},"getTokenEntra"),we=o(async(e,t=process.env)=>{if(t.COGNITE_TOKEN)return t.COGNITE_TOKEN;let{deployClientId:r,deploySecretName:n,idpType:i="cdf",tenantId:s,baseUrl:a,scope:c}=e,p=zr(n);if(i==="entra_id"){if(!s)throw new Error("Entra ID authentication requires 'tenantId' in deployment configuration");return Qr(r,p,s,a,c)}return Wr(r,p)},"getToken");var Y=o(async(e,t,r=process.env)=>{let n=await we(e,r),i=r.COGNITE_BASE_URL??e.baseUrl,s=new Zr({appId:t,project:e.project,baseUrl:i,oidcTokenProvider:o(async()=>n,"oidcTokenProvider")});return await s.authenticate(),s},"getSdk");import cn from"os";import pn from"path";import ln from"open";import{buildAuthorizationUrl as mn,calculatePKCECodeChallenge as dn,discovery as un,None as gn,randomPKCECodeVerifier as fn,randomState as yn}from"openid-client";import en from"https";import{authorizationCodeGrant as tn}from"openid-client";function Qe(e){return e.replace(/[&<>"']/g,t=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[t]??t)}o(Qe,"escapeHtml");function Se(e,t,r){let n=Qe(t),i=Qe(r);return`<html><body style="font-family: system-ui; padding: 40px; text-align: center;">
-    <h1>${n}</h1><p>${i}</p><p>You can close this window.</p>${e==="success"?`<style>
+import{a as i,e as gr}from"../chunk-VTE66IK5.js";import{writeSync as kl}from"fs";import{Command as Cl}from"commander";import{existsSync as en,readFileSync as Pe,writeFileSync as Dt,mkdirSync as Us}from"fs";import{resolve as z}from"path";import{fileURLToPath as Vs}from"url";import{CogniteClient as Ms}from"@cognite/sdk";import Tt from"enquirer";import{mkdirSync as Xo,readFileSync as Zo,rmSync as es,writeFileSync as ye}from"fs";import{resolve as ee}from"path";import{generate as Ur}from"@graphql-codegen/cli";import{GraphQLSchema as Ko,GraphQLObjectType as Uo,GraphQLNonNull as G,GraphQLList as fe,GraphQLString as oe,GraphQLInt as Vo,GraphQLInputObjectType as Or,printSchema as Mo}from"graphql";function je(e){return{space:e.space,externalId:e.externalId,version:e.version}}i(je,"toSharedViewId");function no(e){switch(e){case"text":return"String";case"boolean":return"Boolean";case"int32":case"int64":return"Int";case"float32":case"float64":return"Float";case"timestamp":return"DateTime";case"date":return"Date";case"json":return"JSON";case"timeseries":return"CogniteTimeSeriesReference";case"file":return"CogniteFileReference";case"sequence":return"CogniteSequenceReference";case"enum":return"String";default:return"String"}}i(no,"dmsTypeToGraphQL");function fr(e){if(!("source"in e)){if(e.type?.type==="direct")return e.type.list?e.type.source?{kind:"directRelationList",targetView:je(e.type.source)}:{kind:"scalar",isList:!1,graphqlType:"JSON"}:e.type.source?{kind:"directRelation",targetView:je(e.type.source)}:{kind:"scalar",isList:!1,graphqlType:"JSON"};if(e.type?.type==="enum"){let t=e.type,r={};if(typeof t=="object"&&t!==null&&"values"in t){let n=t.values;if(typeof n=="object"&&n!==null)for(let[o,s]of Object.entries(n))r[o]={name:typeof s=="object"&&s!==null&&"name"in s?String(s.name):void 0}}return{kind:"enum",values:Object.keys(r),valueNames:Object.fromEntries(Object.entries(r).map(([n,o])=>[n,o.name??n]))}}return{kind:"scalar",isList:e.type!==void 0&&"list"in e.type&&e.type.list===!0,graphqlType:e.type?.type?no(e.type.type):"String"}}if("through"in e)return{kind:e.connectionType==="single_reverse_direct_relation"?"reverseDirect":"reverseList",sourceView:je(e.source),throughProperty:e.through.identifier};if(e.connectionType==="single_edge_connection"||e.connectionType==="multi_edge_connection"){let t=e.direction==="inwards"?"inwards":"outwards";return{kind:"edge",targetView:je(e.source),direction:t}}return{kind:"scalar"}}i(fr,"parsePropertyDescriptor");var yr=new Set(["String","Boolean","Int","Float","DateTime","Date"]);var io=new Set(["String","Int","Float","DateTime","Date"]);function Ke(e){return e.kind==="directRelation"||e.kind==="enum"?!0:e.kind!=="scalar"||e.isList===!0?!1:yr.has(e.graphqlType??"String")}i(Ke,"isFilterableDescriptor");function Ue(e){return e.kind==="enum"?!0:e.kind!=="scalar"||e.isList===!0?!1:yr.has(e.graphqlType??"String")}i(Ue,"isSortableDescriptor");function hr(e){return e.kind==="directRelation"||e.kind==="enum"?!0:e.kind==="scalar"&&e.isList!==!0&&io.has(e.graphqlType??"")}i(hr,"hasInOpDescriptor");function Sr(e){return e.kind==="scalar"&&e.isList===!0}i(Sr,"hasListOpsDescriptor");function Ce(e){return e.usedFor!=="edge"}i(Ce,"isNodeOrAll");function N(e){return Object.entries(e.properties).map(([t,r])=>[t,fr(r),r.description])}i(N,"parsedProperties");import{GraphQLObjectType as wr,GraphQLNonNull as xe,GraphQLString as ht,GraphQLFloat as Ge,GraphQLList as mo,GraphQLEnumType as uo}from"graphql";import{GraphQLScalarType as X,Kind as $}from"graphql";function Ve(e){switch(e.kind){case $.STRING:case $.BOOLEAN:return e.value;case $.INT:return parseInt(e.value,10);case $.FLOAT:return parseFloat(e.value);case $.OBJECT:{let t={};for(let r of e.fields)t[r.name.value]=Ve(r.value);return t}case $.LIST:return e.values.map(Ve);case $.NULL:return null;default:return null}}i(Ve,"parseLiteralJSON");var oo=new X({name:"DateTime",serialize:i(e=>e,"serialize"),parseValue:i(e=>e,"parseValue"),parseLiteral:i(e=>e.kind===$.STRING?e.value:null,"parseLiteral")}),so=new X({name:"Date",serialize:i(e=>e,"serialize"),parseValue:i(e=>e,"parseValue"),parseLiteral:i(e=>e.kind===$.STRING?e.value:null,"parseLiteral")}),ft=new X({name:"JSON",serialize:i(e=>e,"serialize"),parseValue:i(e=>e,"parseValue"),parseLiteral:Ve}),ao=new X({name:"CogniteTimeSeriesReference",serialize:i(e=>e,"serialize"),parseValue:i(e=>e,"parseValue"),parseLiteral:i(e=>e.kind===$.STRING?e.value:null,"parseLiteral")}),po=new X({name:"CogniteFileReference",serialize:i(e=>e,"serialize"),parseValue:i(e=>e,"parseValue"),parseLiteral:i(e=>e.kind===$.STRING?e.value:null,"parseLiteral")}),co=new X({name:"CogniteSequenceReference",serialize:i(e=>e,"serialize"),parseValue:i(e=>e,"parseValue"),parseLiteral:i(e=>e.kind===$.STRING?e.value:null,"parseLiteral")}),Me=new X({name:"ListLimit",description:"Limit for list/search queries (1\u20131000).",serialize:i(e=>e,"serialize"),parseValue:i(e=>e,"parseValue"),parseLiteral:i(e=>e.kind===$.INT?parseInt(e.value,10):null,"parseLiteral")}),lo=new X({name:"DirectRelationList",description:"A list of direct-relation node references ({ space, externalId }).",serialize:i(e=>e,"serialize"),parseValue:i(e=>e,"parseValue"),parseLiteral:Ve}),Z={DateTime:oo,Date:so,JSON:ft,CogniteTimeSeriesReference:ao,CogniteFileReference:po,CogniteSequenceReference:co,ListLimit:Me,DirectRelationList:lo},yt={DateTime:"string",Date:"string",JSON:"unknown",CogniteTimeSeriesReference:"string",CogniteFileReference:"string",CogniteSequenceReference:"string",ListLimit:"number",DirectRelationList:"Array<{ space: string; externalId: string }>"};var go=new uo({name:"AggregateFunction",values:{count:{value:"count"},avg:{value:"avg"},sum:{value:"sum"},min:{value:"min"},max:{value:"max"},histogram:{value:"histogram"}}}),vr={function:{type:new xe(go)},property:{type:ht},interval:{type:Ge}},fo=new wr({name:"HistogramBucket",fields:{start:{type:new xe(Ge)},count:{type:new xe(Ge)}}}),kr=new wr({name:"AggregateResult",fields:{aggregate:{type:new xe(ht)},property:{type:ht},value:{type:Ge},buckets:{type:new mo(new xe(fo))},group:{type:ft}}});import{GraphQLObjectType as wt,GraphQLNonNull as me,GraphQLList as yo,GraphQLString as St,GraphQLBoolean as ho}from"graphql";var So=new wt({name:"PageInfo",fields:{endCursor:{type:St},hasNextPage:{type:new me(ho)}}}),He=new wt({name:"NodeReference",fields:{space:{type:new me(St)},externalId:{type:new me(St)}}});function Be(e,t){return new wt({name:`${e}Connection`,fields:{items:{type:new me(new yo(new me(t)))},pageInfo:{type:new me(So)}}})}i(Be,"makeConnectionType");import{GraphQLInputObjectType as ue,GraphQLList as R,GraphQLNonNull as Pr,GraphQLString as ie,GraphQLBoolean as T,GraphQLFloat as Po,GraphQLInt as Ao}from"graphql";import{GraphQLObjectType as wo,GraphQLNonNull as Cr,GraphQLList as vo,GraphQLString as qe,GraphQLBoolean as ko,GraphQLInt as Co,GraphQLFloat as xo,GraphQLEnumType as bo}from"graphql";function xr(e){return e==="String"?qe:e==="Boolean"?ko:e==="Int"?Co:e==="Float"?xo:Z[e]??qe}i(xr,"scalarForName");function br(e){return{typeRegistry:new Map,connectionRegistry:new Map,viewsByExtId:new Map(e.map(t=>[t.externalId,t])),enumRegistry:new Map,enumFilterRegistry:new Map}}i(br,"createTypeContext");function Eo(e){let t=e.replace(/[^_A-Za-z0-9]/g,"_");return/^[0-9]/.test(t)&&(t=`_${t}`),t||"_UNKNOWN"}i(Eo,"sanitizeEnumValue");function vt(e,t,r,n){let o=r.enumRegistry.get(e);if(o)return o;let s=new bo({name:e,values:Object.fromEntries(t.map(a=>[Eo(a),{value:a,description:n?.[a]}]))});return r.enumRegistry.set(e,s),s}i(vt,"getOrCreateEnumType");function Er(e,t){return new wo({name:e.externalId,description:e.description??e.name,fields:i(()=>{let r={space:{type:new Cr(qe)},externalId:{type:new Cr(qe)}};for(let[n,o,s]of N(e))if(o.kind==="scalar")o.isList?r[n]={type:new vo(xr(o.graphqlType??"String")),description:s}:r[n]={type:xr(o.graphqlType??"String"),description:s};else if(o.kind==="enum"){let a=`${e.externalId}${n.charAt(0).toUpperCase()}${n.slice(1)}`;r[n]={type:vt(a,o.values,t,o.valueNames),description:s}}else if(o.kind==="directRelation"){let a=t.typeRegistry.get(o.targetView.externalId)??He;r[n]={type:a,description:s}}else if(o.kind==="directRelationList")r[n]={type:Z.DirectRelationList,description:s};else if(o.kind==="reverseList"||o.kind==="edge"){let a=o.kind==="reverseList"?o.sourceView.externalId:o.targetView.externalId,p=t.typeRegistry.get(a)??He,c=t.connectionRegistry.get(a);c||(c=Be(a,p),t.connectionRegistry.set(a,c)),r[n]={type:c,description:s}}else if(o.kind==="reverseDirect"){let a=t.typeRegistry.get(o.sourceView.externalId)??He;r[n]={type:a,description:s}}return r},"fields")})}i(Er,"generateViewObjectType");function ge(e,t,r){let n={isNull:{type:T},exists:{type:T},eq:{type:t}};return r.hasIn&&(n.in={type:new R(t)}),r.hasPrefix&&(n.prefix={type:ie}),r.hasRange&&(n.gte={type:t},n.gt={type:t},n.lte={type:t},n.lt={type:t}),r.hasListOps&&(n.containsAny={type:new R(t)},n.containsAll={type:new R(t)},n.overlaps={type:new R(t)}),new ue({name:e,fields:n})}i(ge,"makeScalarFilter");var Qe=ge("StringFilter",ie,{hasIn:!0,hasPrefix:!0}),Io=ge("BooleanFilter",T,{}),Do=ge("IntFilter",Ao,{hasIn:!0,hasRange:!0}),$o=ge("FloatFilter",Po,{hasIn:!0,hasRange:!0}),To=ge("DateTimeFilter",Z.DateTime,{hasIn:!0,hasRange:!0}),Ro=ge("DateFilter",Z.Date,{hasIn:!0,hasRange:!0}),Oo=new ue({name:"StringListFilter",fields:{isNull:{type:T},exists:{type:T},containsAny:{type:new R(ie)},containsAll:{type:new R(ie)},overlaps:{type:new R(ie)}}}),be=new ue({name:"DirectRelationRef",fields:{space:{type:new Pr(ie)},externalId:{type:new Pr(ie)}}}),Fo=new ue({name:"DirectRelationFilter",fields:{isNull:{type:T},exists:{type:T},eq:{type:be},in:{type:new R(be)}}});function Lo(e){switch(e){case"String":return Qe;case"Boolean":return Io;case"Int":return Do;case"Float":return $o;case"DateTime":return To;case"Date":return Ro;default:return Qe}}i(Lo,"scalarFilterForName");var Ar=["space","externalId"];function Ir(e,t,r){let n=t.get(e.externalId),o={};for(let a of Ar)o[a]={type:Qe};let s=new Set(Ar);for(let[a,p]of N(e)){if(s.has(a))continue;let c=Ke(p),d=Sr(p);if(!(!c&&!d))if(p.kind==="directRelation"){let l={isNull:{type:T},exists:{type:T},eq:{type:be},in:{type:new R(be)}};hr(p)&&(l.in={type:new R(be)});let m=t.get(p.targetView.externalId);m&&(l.nested={type:m}),o[a]=m?{type:new ue({name:`_${e.externalId}_${a}_Filter`,fields:l})}:{type:Fo}}else if(p.kind==="enum"){let l=`${e.externalId}${a.charAt(0).toUpperCase()}${a.slice(1)}`,m=vt(l,p.values,r),f=r.enumFilterRegistry.get(l);f||(f=new ue({name:`${l}Filter`,fields:{isNull:{type:T},exists:{type:T},eq:{type:m},in:{type:new R(m)}}}),r.enumFilterRegistry.set(l,f)),o[a]={type:f}}else if(d)o[a]={type:Oo};else{let l=p.kind==="scalar"?p.graphqlType??"String":"String",m=Lo(l);m&&(o[a]={type:m})}}return{...o,hasData:{type:T},matchAll:{type:T},_and:{type:new R(n)},_or:{type:new R(n)},_not:{type:n}}}i(Ir,"generateFilterFields");import{GraphQLEnumType as Dr,GraphQLInputObjectType as $r,GraphQLList as No,GraphQLNonNull as Je,GraphQLString as _o,GraphQLBoolean as jo}from"graphql";var Ye=new Dr({name:"SortDirection",values:{ASC:{value:"ascending"},DESC:{value:"descending"}}});function Tr(e){let t=[];for(let[n,o]of N(e))Ue(o)&&t.push(n);if(t.length===0)return null;let r=new Dr({name:`${e.externalId}SortField`,values:Object.fromEntries(t.map(n=>[n,{value:n}]))});return new $r({name:`${e.externalId}Sort`,fields:{field:{type:new Je(r)},direction:{type:new Je(Ye)},nullsFirst:{type:jo}}})}i(Tr,"generateSortInput");var Rr=new $r({name:"SearchSort",fields:{property:{type:new Je(new No(new Je(_o)))},direction:{type:Ye}}});function Fr(e){let t=e.filter(Ce),r=br(t);for(let l of t){let m=Er(l,r);r.typeRegistry.set(l.externalId,m)}let n=new Map;for(let l of t){let m=new Or({name:`${l.externalId}Filter`,fields:i(()=>Ir(l,n,r),"fields")});n.set(l.externalId,m)}let o={};for(let l of t){let m=l.externalId,f=r.typeRegistry.get(m),g=r.connectionRegistry.get(m);g||(g=Be(m,f),r.connectionRegistry.set(m,g));let y=n.get(m),w=Tr(l),u={limit:{type:Me},cursor:{type:oe},filter:{type:y}};w&&(u.sort={type:new fe(w)}),o[`query${m}`]={type:new G(g),args:u},o[`get${m}ById`]={type:f,args:{space:{type:new G(oe)},externalId:{type:new G(oe)}}},o[`count${m}`]={type:new G(Vo),args:{filter:{type:y}}},o[`search${m}`]={type:new G(g),args:{query:{type:oe},limit:{type:Me},filter:{type:y},sort:{type:new fe(new G(Rr))},properties:{type:new fe(new G(oe))}}},o[`aggregate${m}`]={type:new G(new fe(new G(kr))),args:{filter:{type:y},aggregates:{type:new fe(new G(new Or({name:`${m}AggregateRequest`,fields:vr})))},groupBy:{type:new fe(new G(oe))},query:{type:oe}}}}let s=[];for(let[l,m]of r.typeRegistry)s.push({name:m.name,source:`typeRegistry[${l}]`});for(let[l,m]of r.connectionRegistry)s.push({name:m.name,source:`connectionRegistry[${l}]`});let a=new Map;for(let{name:l,source:m}of s)a.has(l)||a.set(l,[]),a.get(l).push(m);for(let[l,m]of a)m.length>1&&console.error(`[dune] duplicate type "${l}" from: ${m.join(", ")}`);let p=new Ko({query:new Uo({name:"Query",fields:o}),types:[Ye,...Object.values(Z),...r.enumRegistry.values()]}),c=new Map;for(let l of t){let m=new Map;for(let[f,g]of N(l))m.set(f,g);c.set(l.externalId,{view:{space:l.space,externalId:l.externalId,version:l.version},properties:m})}let d={view(l){let m=c.get(l.externalId);if(!m)throw new Error(`SchemaKnowledge: no view for externalId "${l.externalId}"`);return m},property(l,m){return c.get(l.externalId)?.properties.get(m)}};return{schema:p,sdl:Mo(p),schemaKnowledge:d}}i(Fr,"buildSchema");async function Lr(e,t){let n=(await t.dataModels.retrieve([{space:e.space,externalId:e.dataModelExternalId,version:e.dataModelVersion}],{inlineViews:!1})).items[0];if(!n)throw new Error(`Data model ${e.space}/${e.dataModelExternalId}/${e.dataModelVersion} not found`);if(!n.views?.length)throw new Error(`Data model ${e.space}/${e.dataModelExternalId}/${e.dataModelVersion} has no views`);let o=n.views.map(a=>({space:a.space,externalId:a.externalId,version:a.version}));return(await t.views.retrieve(o,{includeInheritedProperties:!0})).items}i(Lr,"fetchViews");import{GraphQLObjectType as Go,GraphQLNonNull as Ho,GraphQLList as Bo,isScalarType as qo,isEnumType as Qo,parse as Jo,print as Yo}from"graphql";function kt(e,t){let r=e.getType(t);if(!(r instanceof Go))return[];let n=r.getFields(),o=[];for(let[s,a]of Object.entries(n)){let p=a.type;for(;p instanceof Ho||p instanceof Bo;)p=p.ofType;(qo(p)||Qo(p))&&o.push(s)}return o}i(kt,"scalarFieldsFor");function zo(e,t){let r=kt(e,t),n=["space","externalId"];for(let o of["name","description"])r.includes(o)&&n.push(o);return n.join(" ")}i(zo,"minimalRelationFields");function Nr(e,t,r){let n=[];for(let[o,s]of N(e))if(s.kind==="directRelation"||s.kind==="reverseDirect"){let a=s.kind==="directRelation"?s.targetView.externalId:s.sourceView.externalId;if(r)n.push(`${o} { ${zo(t,a)} }`);else{let c=["space","externalId",...kt(t,a).filter(d=>d!=="space"&&d!=="externalId")];n.push(`${o} { ${c.join(" ")} }`)}}else!r&&(s.kind==="reverseList"||s.kind==="edge")&&n.push(`${o} { items { space externalId } pageInfo { hasNextPage endCursor } }`);return n}i(Nr,"relationFieldsFor");function _r(e,t,r,n){return`query ${e}(${t}) {
+  ${e}(${r}) {
+    items {
+      ${n}
+    }
+    pageInfo { hasNextPage endCursor }
+  }
+}`}i(_r,"paginatedOp");function jr(e,t){let r=e.externalId,n=kt(t,r),o=Nr(e,t,!0),s=Nr(e,t,!1),a=[...n,...o].join(`
+      `),p=[...n,...s].join(`
+    `),c=!!t.getType(`${r}Sort`),d=_r(`query${r}`,c?`$limit: ListLimit, $cursor: String, $filter: ${r}Filter, $sort: [${r}Sort!]`:`$limit: ListLimit, $cursor: String, $filter: ${r}Filter`,c?"limit: $limit, cursor: $cursor, filter: $filter, sort: $sort":"limit: $limit, cursor: $cursor, filter: $filter",a),l=_r(`search${r}`,`$query: String, $limit: ListLimit, $filter: ${r}Filter, $sort: [SearchSort!], $properties: [String!]`,"query: $query, limit: $limit, filter: $filter, sort: $sort, properties: $properties",a),m=`query get${r}ById($space: String!, $externalId: String!) {
+    get${r}ById(space: $space, externalId: $externalId) {
+      ${p}
+    }
+  }
+  `,f=`query count${r}($filter: ${r}Filter) {
+    count${r}(filter: $filter)
+  }`,g=`query aggregate${r}($filter: ${r}Filter, $aggregates: [${r}AggregateRequest!], $groupBy: [String!], $query: String) {
+    aggregate${r}(filter: $filter, aggregates: $aggregates, groupBy: $groupBy, query: $query) {
+      aggregate
+      property
+      value
+      buckets { start count }
+      group
+    }
+  }`;return Yo(Jo([d,m,f,l,g].join(`
+
+`)))}i(jr,"generateViewOperations");function Wo(e){return{availableOnList:e.kind==="scalar"||e.kind==="directRelationList",returnsMany:e.kind==="reverseList"||e.kind==="edge"||e.kind==="directRelationList",filterable:Ke(e),sortable:Ue(e)}}i(Wo,"fetchCharacteristics");function Kr(e,t=new Date){return{generatedAt:t.toISOString(),views:e.map(r=>({space:r.space,externalId:r.externalId,version:r.version,properties:Object.fromEntries(N(r).map(([n,o])=>{let s={kind:o.kind,fetch:Wo(o)};return(o.kind==="directRelation"||o.kind==="directRelationList")&&(s.targetView=o.targetView),[n,s]}))}))}}i(Kr,"buildSdkMetadata");async function Vr(e,t,r){let n=await Lr(e,t),o=new Set,s=n.filter(u=>o.has(u.externalId)?(console.error(`[dune] dedup: dropped ${u.space}/${u.externalId} (duplicate externalId)`),!1):(o.add(u.externalId),!0));console.error(`[dune] views after dedup: ${s.length} (was ${n.length})`);let{schema:a,sdl:p}=Fr(s),c=s.filter(Ce),d=ee(r,e.name);es(d,{recursive:!0,force:!0}),Xo(d,{recursive:!0}),ye(ee(d,"schema.graphql"),p,"utf-8"),ye(ee(d,"sdk-metadata.json"),JSON.stringify(Kr(c),null,2),"utf-8"),ye(ee(d,"views.generated.ts"),`import type { ViewDefinition } from '@cognite/cli/sdk-runtime';
+
+// Auto-generated \u2014 do not edit.
+export const views: ViewDefinition[] = ${JSON.stringify(c,null,2)};
+`,"utf-8"),await Ur({schema:p,generates:{[ee(d,"types.generated.ts")]:{plugins:["typescript"],config:{scalars:yt}}}},!0);for(let u of c){let S=jr(u,a),h=ee(d,`${u.externalId}.generated.ts`);await Ur({schema:p,documents:S,generates:{[h]:{plugins:["typescript-operations","typescript-generic-sdk"],config:{scalars:yt,namespacedImportName:"Types"}}}},!0);let v=Zo(h,"utf-8");v=v.replace(/^import \{ DocumentNode \} from 'graphql';$/m,"import type { DocumentNode } from 'graphql';").replace(/Requester<C = \{\}>/g,"Requester<C = Record<string, never>>"),v.includes("import type * as Types")||(v=v.replace(/^import type \{ DocumentNode \} from 'graphql';$/m,`import type { DocumentNode } from 'graphql';
+import type * as Types from './types.generated.js';`));let k=[...v.matchAll(/^import\b[\s\S]*?;\n?/gm)].map(x=>x[0]);if(k.length>0){let x=v.replace(/^import\b[\s\S]*?;\n?/gm,"").replace(/^\n+/,""),V=i((F,E)=>{let B=i(Y=>Y.match(/from '([^']+)'/)?.[1]?.toLowerCase()??"","p");return B(F).localeCompare(B(E))},"byPath"),b=k.filter(F=>!/from '\./.test(F)).sort(V),M=k.filter(F=>/from '\./.test(F)).sort(V);v=[...b,"",...M,"",x].join(`
+`)}ye(h,v)}let l=c.map(u=>u.externalId).sort((u,S)=>u.localeCompare(S)),m=i(u=>u.replace(/([a-z0-9])([A-Z])/g,"$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g,"$1 $2").split(/[\s_-]+/).filter(Boolean).map(S=>S.charAt(0).toUpperCase()+S.slice(1).toLowerCase()).join(""),"normalizeTypeName"),f=[...l.map(u=>`import { getSdk as get${u}Sdk } from './${u}.generated.js';`),"import { views } from './views.generated.js';"].sort((u,S)=>{let h=i(v=>v.match(/from '(\.\/[^']+)'/)?.[1]??"","path");return h(u).localeCompare(h(S),void 0,{sensitivity:"base"})}).join(`
+`),g=l.map(u=>`    ...get${u}Sdk(requester),`).join(`
+`),y=l.map(u=>{let S=m(u);return`export type {
+${["query","get","count","search","aggregate"].flatMap(k=>{let x=k==="get"?`Get${S}ById`:`${k.charAt(0).toUpperCase()+k.slice(1)}${S}`;return[`  ${x}Query`,`  ${x}QueryVariables`]}).join(`,
+`)},
+} from './${u}.generated.js';`}).join(`
+`);ye(ee(d,"index.ts"),`import { createDuneRuntimeFromViews } from '@cognite/cli/sdk-runtime';
+import type { CogniteClient } from '@cognite/sdk';
+
+${f}
+
+export * from './types.generated.js';
+${y}
+
+// Internal \u2014 merges all per-view getSdk() functions.
+// Not exported: callers use createSdk() instead.
+function makeSdk(requester: Parameters<typeof get${l[0]}Sdk>[0]) {
+  return {
+${g}
+  };
+}
+
+export type Sdk = ReturnType<typeof makeSdk>;
+
+/**
+ * Creates a fully-typed SDK backed by the Dune runtime.
+ * Queries are executed in-process via graphql-js and translated to DMS API calls \u2014
+ * no CDF GraphQL endpoint is involved.
+ */
+export function createSdk(client: CogniteClient): Sdk {
+  const runtime = createDuneRuntimeFromViews(views, client);
+  return makeSdk(runtime.requester);
+}
+`,"utf-8");let w=l.flatMap(u=>[`    query${u}: vi.fn<Sdk['query${u}']>(() => Promise.resolve({ query${u}: { items: [], pageInfo: { hasNextPage: false, endCursor: null } } })),`,`    get${u}ById: vi.fn<Sdk['get${u}ById']>(() => Promise.resolve({ get${u}ById: null })),`,`    count${u}: vi.fn<Sdk['count${u}']>(() => Promise.resolve({ count${u}: 0 })),`,`    search${u}: vi.fn<Sdk['search${u}']>(() => Promise.resolve({ search${u}: { items: [], pageInfo: { hasNextPage: false, endCursor: null } } })),`,`    aggregate${u}: vi.fn<Sdk['aggregate${u}']>(() => Promise.resolve({ aggregate${u}: [] })),`]).join(`
+`);return ye(ee(d,"test-helpers.ts"),`import { vi } from 'vitest';
+
+import type { Sdk } from './index.js';
+
+export function makeMockSdk(overrides: Partial<Sdk> = {}): Sdk {
+  return {
+${w}
+    ...overrides,
+  };
+}
+`,"utf-8"),{sdkDir:d,viewCount:c.length}}i(Vr,"generateSdk");var ts=i(()=>{let e=process.env.DEPLOYMENT_SECRETS;if(!e)return{};try{let t=JSON.parse(e),r={};for(let[n,o]of Object.entries(t))if(typeof o=="string"){let s=n.toLowerCase().replace(/_/g,"-");r[s]=o}return r}catch(t){return console.error("Error parsing DEPLOYMENT_SECRETS:",t),{}}},"loadSecretsFromEnv"),rs=i(e=>{let t;if(process.env.DEPLOYMENT_SECRET&&(t=process.env.DEPLOYMENT_SECRET),t||(t=ts()[e]),t||(t=process.env[e]),!t)throw new Error(`Secret not found in environment: ${e}`);return t},"getSecretFromEnv"),ns=i(e=>{if(!e)return"";try{return new URL(e).hostname.replace(/\.cognitedata\.com$/,"")}catch{let t=e.replace(/^https?:\/\//,"");return t=t.split("/")[0],t=t.split(":")[0],t=t.replace(/\.cognitedata\.com$/,""),t}},"extractClusterFromUrl"),is=i(async(e,t)=>{let r=`Basic ${btoa(`${e}:${t}`)}`,n=await fetch("https://auth.cognite.com/oauth2/token",{method:"POST",headers:{Authorization:r,"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"client_credentials"})});if(!n.ok){let s=await n.text();throw new Error(`Failed to get token from CDF: ${n.status} ${n.statusText}
+${s}`)}let o=await n.json();if(!o.access_token)throw new Error("No access token returned from CDF authentication");return o.access_token},"getTokenCdf"),os=i(async(e,t,r,n)=>{if(!n)throw new Error("Entra ID authentication requires 'baseUrl' to be set in deployment configuration");let o=ns(n);if(!o)throw new Error(`Entra ID authentication requires 'baseUrl' to be a valid CDF URL (e.g., https://cluster.cognitedata.com), got: ${n}`);let s=`https://login.microsoftonline.com/${r}/oauth2/v2.0/token`,a=`https://${o}.cognitedata.com/.default`,p=await fetch(s,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:e,client_secret:t,scope:a,grant_type:"client_credentials"})});if(!p.ok){let d=await p.text();throw new Error(`Failed to get token from Entra ID: ${p.status} ${p.statusText}
+${d}`)}let c=await p.json();if(!c.access_token)throw new Error("No access token returned from Entra ID authentication");return c.access_token},"getTokenEntra"),Ee=i(async(e,t=process.env)=>{if(t.COGNITE_TOKEN)return t.COGNITE_TOKEN;let{deployClientId:r,deploySecretName:n,idpType:o="cdf",tenantId:s,baseUrl:a}=e,p=rs(n);if(o==="entra_id"){if(!s)throw new Error("Entra ID authentication requires 'tenantId' in deployment configuration");return os(r,p,s,a)}return is(r,p)},"getToken");import us from"os";import gs from"path";import fs from"open";import{buildAuthorizationUrl as ys,calculatePKCECodeChallenge as hs,discovery as Ss,None as ws,randomPKCECodeVerifier as vs,randomState as ks}from"openid-client";import ss from"https";import{authorizationCodeGrant as as}from"openid-client";function Mr(e){return e.replace(/[&<>"']/g,t=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[t]??t)}i(Mr,"escapeHtml");function Ct(e,t,r){let n=Mr(t),o=Mr(r);return`<html><body style="font-family: system-ui; padding: 40px; text-align: center;">
+    <h1>${n}</h1><p>${o}</p><p>You can close this window.</p>${e==="success"?`<style>
       @keyframes checkmark {
         0% { transform: scale(0); }
         50% { transform: scale(1.2); }
@@ -16,40 +86,77 @@ ${l}`)}let p=await c.json();if(!p.access_token)throw new Error("No access token
       }
       h1 { animation: checkmark 0.5s ease-out; }
     </style>`:""}
-  </body></html>`}o(Se,"generateHtml");async function rn(e,t,r,n,i,s){let a=new URL(e.url??"/",`https://${e.headers.host??"localhost"}`);if(a.pathname!=="/")return t.writeHead(404),t.end("Not found"),{shouldClose:!1};try{console.log("\u{1F504} Exchanging authorization code for tokens...");let c=await s.authorizationCodeGrant(r,a,{pkceCodeVerifier:n,expectedState:i});return t.writeHead(200,{"Content-Type":"text/html"}),t.end(Se("success","Login Successful!","You can close this window and return to the terminal.")),{shouldClose:!0,tokens:c}}catch(c){let p=c instanceof Error?c:new Error(String(c));return t.writeHead(400,{"Content-Type":"text/html"}),t.end(Se("error","Authentication Error",p.message)),{shouldClose:!0,error:p}}}o(rn,"handleCallback");function nn(e){let t=e/6e4,r=Math.round(t*10)/10;return`${r} ${r===1?"minute":"minutes"}`}o(nn,"formatTimeoutMinutes");function Ze(e,t,r,n,i,s={createServer:en.createServer,setTimeout:globalThis.setTimeout,clearTimeout:globalThis.clearTimeout,authorizationCodeGrant:tn}){return new Promise((a,c)=>{let p,l=s.setTimeout(()=>{p?.close(),c(new Error(`Login timeout - no response received within ${nn(e.loginTimeout)}`))},e.loginTimeout);p=s.createServer(t,async(m,d)=>{try{let u=await rn(m,d,r,n,i,s);u.shouldClose&&(s.clearTimeout(l),p?.close(),u.error?c(u.error):u.tokens?a(u.tokens):c(new Error("No tokens received")))}catch(u){s.clearTimeout(l),p?.close(),c(u instanceof Error?u:new Error(String(u)))}}),p.on("error",m=>{s.clearTimeout(l),m.code==="EADDRINUSE"?console.error(`\u274C Port ${e.port} is already in use.`):console.error(`\u274C Server error: ${m.message}`),c(m)}),p.listen(e.port,"127.0.0.1",()=>{console.log(`\u{1F310} Local HTTPS server started on https://localhost:${e.port}`)})})}o(Ze,"startCallbackServer");import te from"fs";import et from"path";import on from"selfsigned";function sn(e,t,r){return{key:r.readFileSync(e),cert:r.readFileSync(t)}}o(sn,"loadCertificates");async function an(e,t,r,n){console.log("\u{1F510} Generating self-signed certificate for HTTPS..."),n.existsSync(e)||n.mkdirSync(e,{recursive:!0});let i=await n.generate([{name:"commonName",value:"localhost"}],{days:365,keySize:2048});return n.writeFileSync(t,i.private),n.writeFileSync(r,i.cert),console.log("\u2705 Certificate generated and saved locally"),{key:Buffer.from(i.private),cert:Buffer.from(i.cert)}}o(an,"generateCertificate");async function tt(e,t={existsSync:te.existsSync,readFileSync:o(r=>te.readFileSync(r),"readFileSync"),writeFileSync:o((r,n)=>te.writeFileSync(r,n),"writeFileSync"),mkdirSync:o((r,n)=>{te.mkdirSync(r,n)},"mkdirSync"),generate:on.generate}){let r=et.join(e,"localhost-key.pem"),n=et.join(e,"localhost-cert.pem");return t.existsSync(r)&&t.existsSync(n)?sn(r,n,t):an(e,r,n,t)}o(tt,"getOrCreateCertificates");var hn={authority:"https://auth.cognite.com",clientId:"0404baaa-0a90-43a2-aba7-a110b53fb41c",redirectUri:"https://localhost:3000/",port:3e3,loginTimeout:300*1e3,certDir:pn.join(cn.homedir(),".cdf-login")},En={open:ln,getOrCreateCertificates:tt,startCallbackServer:Ze,discovery:un,buildAuthorizationUrl:mn,randomPKCECodeVerifier:fn,calculatePKCECodeChallenge:dn,randomState:yn,logger:console};async function nt(e,t=hn,r){return r===void 0?rt(e,t,En):rt(e,t,r)}o(nt,"login");async function rt(e,t,r){r.logger.log(`\u{1F510} Starting CDF login flow...
-`),r.logger.log(`\u{1F4E1} Fetching OpenID configuration from ${t.authority}...`);let n;try{n=await r.discovery(new URL(t.authority),t.clientId,void 0,gn())}catch(m){let d=m instanceof Error&&m.cause instanceof Error?m.cause:void 0;if(d!=null&&("code"in d&&typeof d.code=="string"&&(d.code==="UNABLE_TO_GET_ISSUER_CERT_LOCALLY"||d.code==="UNABLE_TO_VERIFY_LEAF_SIGNATURE"||d.code==="CERT_UNTRUSTED"||d.code==="SELF_SIGNED_CERT_IN_CHAIN")||d.message.toLowerCase().includes("certificate")))throw new Error(`TLS certificate error connecting to ${t.authority}.
-Your network likely uses a corporate proxy with SSL inspection.
-Set NODE_EXTRA_CA_CERTS to your CA bundle and retry:
-  NODE_EXTRA_CA_CERTS=/path/to/ca-bundle.crt cognite apps deploy --interactive`,{cause:m});let f=d?`: ${d.message}`:"";throw new Error(`Could not reach ${t.authority}${f}`,{cause:m})}let i=r.randomPKCECodeVerifier(),s=await r.calculatePKCECodeChallenge(i),a=r.randomState(),c={redirect_uri:t.redirectUri,scope:"openid profile email",code_challenge:s,code_challenge_method:"S256",state:a};e&&(c.organization_hint=e);let p=r.buildAuthorizationUrl(n,c).toString(),l=await r.getOrCreateCertificates(t.certDir);e&&r.logger.log(`\u{1F3E2} Organization: ${e}`),r.logger.log(`\u{1F680} Opening browser for authentication...
-`);try{await r.open(p)}catch(m){let d=m instanceof Error?m.message:String(m);r.logger.error("\u274C Failed to open browser automatically."),r.logger.error(`  Reason: ${d}`),r.logger.error(`Please open this URL manually:
-`),r.logger.error(p),r.logger.error("")}return r.startCallbackServer(t,l,n,i,a)}o(rt,"loginImpl");async function I(e,t,r={}){let{login:n=nt,getSdk:i=Y,createClient:s=o(a=>new wn(a),"createClient")}=r;if(t.interactive){let a=t.orgHint||e.org||void 0,c=await n(a),p=s({appId:t.appId,project:e.project,baseUrl:e.baseUrl,getToken:o(async()=>c.access_token,"getToken")});return await p.authenticate(),p}return i(e,t.appId)}o(I,"getClientForDeployment");import ot from"enquirer";var it="Enter custom target...";function st(e,t){let r=t.map((n,i)=>`  ${i}: ${n.org}/${n.project}`).join(`
+  </body></html>`}i(Ct,"generateHtml");async function ps(e,t,r,n,o,s){let a=new URL(e.url??"/",`https://${e.headers.host??"localhost"}`);if(a.pathname!=="/")return t.writeHead(404),t.end("Not found"),{shouldClose:!1};try{console.log("\u{1F504} Exchanging authorization code for tokens...");let p=await s.authorizationCodeGrant(r,a,{pkceCodeVerifier:n,expectedState:o});return t.writeHead(200,{"Content-Type":"text/html"}),t.end(Ct("success","Login Successful!","You can close this window and return to the terminal.")),{shouldClose:!0,tokens:p}}catch(p){let c=p instanceof Error?p:new Error(String(p));return t.writeHead(400,{"Content-Type":"text/html"}),t.end(Ct("error","Authentication Error",c.message)),{shouldClose:!0,error:c}}}i(ps,"handleCallback");function cs(e){let t=e/6e4,r=Math.round(t*10)/10;return`${r} ${r===1?"minute":"minutes"}`}i(cs,"formatTimeoutMinutes");function Gr(e,t,r,n,o,s={createServer:ss.createServer,setTimeout:globalThis.setTimeout,clearTimeout:globalThis.clearTimeout,authorizationCodeGrant:as}){return new Promise((a,p)=>{let c=s.createServer(t,async(m,f)=>{try{let g=await ps(m,f,r,n,o,s);g.shouldClose&&(l(),g.error?p(g.error):g.tokens?a(g.tokens):p(new Error("No tokens received")))}catch(g){l(),p(g instanceof Error?g:new Error(String(g)))}}),d=s.setTimeout(()=>{l(),p(new Error(`Login timeout - no response received within ${cs(e.loginTimeout)}`))},e.loginTimeout);function l(){s.clearTimeout(d),c.close()}i(l,"cleanup"),c.on("error",m=>{l(),m.code==="EADDRINUSE"?console.error(`\u274C Port ${e.port} is already in use.`):console.error(`\u274C Server error: ${m.message}`),p(m)}),c.listen(e.port,"127.0.0.1",()=>{console.log(`\u{1F310} Local HTTPS server started on https://localhost:${e.port}`)})})}i(Gr,"startCallbackServer");import{mkdirSync as ls}from"fs";import{loadLocalCertificates as ds}from"@cognite/app-sdk/https";var ms={loadLocalCertificates:ds,mkdirSync:ls,logger:console};async function Hr(e,t=ms){t.mkdirSync(e,{recursive:!0});let{cert:r,key:n,source:o}=await t.loadLocalCertificates({certDir:e});return o==="mkcert"?t.logger.log("\u{1F510} Using mkcert certificates for HTTPS"):(t.logger.log("\u{1F510} Using in-memory self-signed certificate for HTTPS \u2014 your browser will give you a warning."),t.logger.log("   Run `npx @cognite/cli@latest apps setup-https` to install trusted local https certificates.")),{cert:r,key:n}}i(Hr,"getOrCreateCertificates");var Cs={authority:"https://auth.cognite.com",clientId:"0404baaa-0a90-43a2-aba7-a110b53fb41c",redirectUri:"https://localhost:3000/",port:3e3,loginTimeout:300*1e3,certDir:gs.join(us.homedir(),".cdf-login")},xs={open:fs,getOrCreateCertificates:Hr,startCallbackServer:Gr,discovery:Ss,buildAuthorizationUrl:ys,randomPKCECodeVerifier:vs,calculatePKCECodeChallenge:hs,randomState:ks,logger:console};async function ze(e,t=Cs,r){return r===void 0?Br(e,t,xs):Br(e,t,r)}i(ze,"login");async function Br(e,t,r){r.logger.log(`\u{1F510} Starting CDF login flow...
+`),r.logger.log(`\u{1F4E1} Fetching OpenID configuration from ${t.authority}...`);let n=await r.discovery(new URL(t.authority),t.clientId,void 0,ws()),o=r.randomPKCECodeVerifier(),s=await r.calculatePKCECodeChallenge(o),a=r.randomState(),p={redirect_uri:t.redirectUri,scope:"openid profile email",code_challenge:s,code_challenge_method:"S256",state:a};e&&(p.organization_hint=e);let c=r.buildAuthorizationUrl(n,p).toString(),d=await r.getOrCreateCertificates(t.certDir);e&&r.logger.log(`\u{1F3E2} Organization: ${e}`),r.logger.log(`\u{1F680} Opening browser for authentication...
+`);try{await r.open(c)}catch(l){let m=l instanceof Error?l.message:String(l);r.logger.error("\u274C Failed to open browser automatically."),r.logger.error(`  Reason: ${m}`),r.logger.error(`Please open this URL manually:
+`),r.logger.error(c),r.logger.error("")}return r.startCallbackServer(t,d,n,o,a)}i(Br,"loginImpl");import{existsSync as Fs,readFileSync as Ls}from"fs";import{resolve as Ns}from"path";import{array as bs,boolean as Es,check as qr,forward as Qr,literal as Ps,maxLength as As,minLength as Is,nonEmpty as he,object as Jr,optional as se,picklist as Ds,pipe as te,safeParse as $s,string as q,url as Ts}from"valibot";var xt=te(q(),he("must not be empty")),bt=te(q(),he("must not be empty"),As(256,"must be 256 characters or fewer")),Et=te(q(),he("must not be empty"),Ts("must be a valid URL")),Pt=te(q(),he("must not be empty")),At=te(q(),he("must not be empty")),Rs=te(Jr({org:Pt,project:At,baseUrl:Et,deployClientId:se(q(),""),deploySecretName:se(q(),""),published:se(Es(),!1),idpType:se(Ds(["cdf","entra_id"]),"cdf"),tenantId:se(q())}),Qr(qr(e=>e.idpType!=="entra_id"||!!e.tenantId,'must be set when idpType is "entra_id"'),["tenantId"]),Qr(qr(e=>!e.deployClientId||!!e.deploySecretName,"must be set when deployClientId is set"),["deploySecretName"])),Os=Jr({name:xt,externalId:bt,versionTag:te(q(),he("must not be empty")),description:se(q(),""),deployments:te(bs(Rs),Is(1,"must contain at least one deployment")),infra:se(Ps("appsApi"))});function It(e){let t=$s(Os,e);if(t.success)return t.output;let r=t.issues[0],n=r.path?.map(s=>s.key).join(".")??"",o=n?`"${n}" `:"";throw new Error(`app.json: ${o}${r.message}`)}i(It,"validateAppConfig");function C(e,t={}){let{validator:r=It,existsSync:n=Fs,readFileSync:o=Ls}=t,s=Ns(e,"app.json");if(!n(s))throw new Error(`No app.json found at ${s}. Make sure you're running this command from your app's root directory.`);let a=o(s,"utf-8"),p;try{p=JSON.parse(a)}catch{throw new Error("Failed to parse app.json \u2014 check that it contains valid JSON.")}return r(p)}i(C,"loadAppConfig");import Yr from"enquirer";var zr="Enter custom target...";function Wr(e,t){let r=t.map((n,o)=>`  ${o}: ${n.org}/${n.project}`).join(`
 `);throw new Error(`Deployment "${e}" not found. Available deployments:
-${r}`)}o(st,"deploymentNotFoundError");function b(e,t){if(e.length===0)throw new Error("No deployments configured in app.json");if(t===void 0)return e[0];if(/^\d+$/.test(t)){let n=e[Number.parseInt(t)];if(n)return n;st(t,e)}let r=e.find(n=>n.project===t||`${n.org}/${n.project}`===t);if(r)return r;st(t,e)}o(b,"findDeployment");function $(e){let t=[];return e.deployClientId||t.push("deployClientId"),e.deploySecretName||t.push("deploySecretName"),t}o($,"getMissingCredentials");async function F(e,t){if(t.baseUrl&&t.project)return{org:t.org??"",project:t.project,baseUrl:t.baseUrl,deployClientId:"",deploySecretName:"",published:!1,idpType:"cdf"};if(t.deployment!==void 0)return b(e.deployments,t.deployment);let r=[...e.deployments.map(s=>`${s.org}/${s.project}`),it],{selected:n}=await ot.prompt({type:"select",name:"selected",message:"Select deployment target",choices:r});if(n!==it){let s=e.deployments.find(a=>`${a.org}/${a.project}`===n);if(s)return s;throw new Error(`Deployment "${n}" could not be resolved from app.json.`)}let i=await ot.prompt([{type:"input",name:"baseUrl",message:"CDF Base URL",initial:"https://api.cognitedata.com"},{type:"input",name:"project",message:"CDF Project",validate:o(s=>s?!0:"Project is required","validate")},{type:"input",name:"org",message:"Organization (for login hint)",initial:""}]);return{org:i.org||"",project:i.project,baseUrl:i.baseUrl,deployClientId:"",deploySecretName:"",published:!1,idpType:"cdf"}}o(F,"resolveDeployment");import{existsSync as Sn}from"fs";import{resolve as Cn}from"path";import{config as vn}from"dotenv";function _(e,t={existsSync:Sn,config:vn}){let r=Cn(e,".env");t.existsSync(r)&&(console.log(`Loading environment variables from ${r}`),t.config({path:r}))}o(_,"loadEnvFile");function R(e){e.infra!=="appsApi"&&(console.error(`
+${r}`)}i(Wr,"deploymentNotFoundError");function O(e,t){if(e.length===0)throw new Error("No deployments configured in app.json");if(t===void 0)return e[0];if(/^\d+$/.test(t)){let n=e[Number.parseInt(t)];if(n)return n;Wr(t,e)}let r=e.find(n=>n.project===t||`${n.org}/${n.project}`===t);if(r)return r;Wr(t,e)}i(O,"findDeployment");function I(e){let t=[];return e.deployClientId||t.push("deployClientId"),e.deploySecretName||t.push("deploySecretName"),t}i(I,"getMissingCredentials");async function _(e,t){if(t.baseUrl&&t.project)return{org:t.org??"",project:t.project,baseUrl:t.baseUrl,deployClientId:"",deploySecretName:"",published:!1,idpType:"cdf"};if(t.deployment!==void 0)return O(e.deployments,t.deployment);let r=[...e.deployments.map(s=>`${s.org}/${s.project}`),zr],{selected:n}=await Yr.prompt({type:"select",name:"selected",message:"Select deployment target",choices:r});if(n!==zr){let s=e.deployments.find(a=>`${a.org}/${a.project}`===n);if(s)return s;throw new Error(`Deployment "${n}" could not be resolved from app.json.`)}let o=await Yr.prompt([{type:"input",name:"baseUrl",message:"CDF Base URL",initial:"https://api.cognitedata.com"},{type:"input",name:"project",message:"CDF Project",validate:i(s=>s?!0:"Project is required","validate")},{type:"input",name:"org",message:"Organization (for login hint)",initial:""}]);return{org:o.org||"",project:o.project,baseUrl:o.baseUrl,deployClientId:"",deploySecretName:"",published:!1,idpType:"cdf"}}i(_,"resolveDeployment");import{existsSync as _s}from"fs";import{resolve as js}from"path";import{config as Ks}from"dotenv";function P(e,t={existsSync:_s,config:Ks}){let r=js(e,".env");t.existsSync(r)&&(console.log(`Loading environment variables from ${r}`),t.config({path:r}))}i(P,"loadEnvFile");var We=Symbol("BACK");async function tn(e,t={}){let r=process.cwd();P(r);let n=e.deployments[0],{baseUrl:o,project:s}=n;if(t.interactive){console.log(`Starting browser login...
+`);let c=await ze(t.orgHint??n.org??void 0);if(!c?.access_token)throw new Error("No access token received");return console.log(`
+\u2705 Authentication successful!
+`),{token:c.access_token,baseUrl:o,project:s}}if(process.env.COGNITE_TOKEN)return{token:process.env.COGNITE_TOKEN,baseUrl:o,project:s};let a=I(n);if(a.length>0)throw new Error(`Missing deployment credentials (${a.join(", ")}). Set COGNITE_TOKEN in .env, configure deployClientId/deploySecretName, or run with --interactive for browser login.`);let p=await Ee(n);return console.log(`\u2705 Authenticated
+`),{token:p,baseUrl:o,project:s}}i(tn,"resolveAuth");async function $t(e,t,r){let n=t.map((p,c)=>({name:r(p,c),value:c})),o={type:"select",name:"answer",message:e,choices:n.map(p=>p.name)},{answer:s}=await Tt.prompt(o),a=n.findIndex(p=>p.name===s);return t[a]}i($t,"pick");async function Gs(e,t,r){let n=t.map((d,l)=>r(d,l)),o=new Map(n.map((d,l)=>[d,l])),s={type:"autocomplete",name:"answer",message:e,limit:12,choices:n},{answer:a}=await Tt.prompt(s);if(o.has(a))return t[o.get(a)];let p=i(d=>String(d).replace(/\[[0-9;]*m/g,"").trim(),"clean"),c=p(a);for(let[d,l]of o)if(p(d)===c)return t[l];for(let[d,l]of o)if(p(d).includes(c)||c.includes(p(d)))return t[l];throw new Error(`Could not match selection "${a}" to any item`)}i(Gs,"searchPick");async function Hs(e,t=""){let r={type:"input",name:"answer",message:e,initial:t},{answer:n}=await Tt.prompt(r);return n}i(Hs,"ask");async function Bs(e,t,r={}){let n=await fetch(e,{method:r.method??"GET",headers:{Authorization:`Bearer ${t}`,"Content-Type":"application/json"},body:r.body!==void 0?JSON.stringify(r.body):void 0});if(!n.ok){let o=await n.text().catch(()=>"");throw new Error(`CDF API error ${n.status} ${n.statusText}: ${o}`)}return n.json()}i(Bs,"cdfFetch");async function qs(e,t,r){return(await Bs(`${e}/api/v1/projects/${t}/models/datamodels?includeGlobal=true&limit=1000`,r)).items??[]}i(qs,"fetchDataModels");async function Qs(e,t={}){let r=process.cwd();process.chdir(e);try{P(e);let n=C(e),{token:o,baseUrl:s,project:a}=await tn(n,t),p=null;async function c(){return p||(p=await qs(s,a,o),p.sort((f,g)=>`${f.space}/${f.externalId}`.localeCompare(`${g.space}/${g.externalId}`))),p}i(c,"getModels");let d={chosenModel:null,sdkName:null},l=[async()=>{console.log(`
+\u{1F510} Fetching data models...`);let f=await c();if(f.length===0)throw new Error("No data models found.");return console.log(`\u{1F50D} Found ${f.length} model(s). Type to search.
+`),d.chosenModel=await Gs("\u{1F4E6} Select a data model:",f,g=>`${g.space}  \u2192  ${g.externalId} / ${g.version}${g.name?`  \u2014 ${g.name}`:""}`),!0},async()=>{let f=d.chosenModel.externalId.replace(/([a-z0-9])([A-Z])/g,"$1-$2").replace(/[^a-zA-Z0-9-_]/g,"-").toLowerCase(),g=await Hs(`
+SDK name (folder under src/generated_sdks/, "back" to go back):`,f);if(g.toLowerCase()==="back")return We;let u=(JSON.parse(Pe(z(e,"app.json"),"utf-8")).generatedSdks??[]).find(S=>S.name===g);if(u){console.log(`
+\u26A0\uFE0F  An SDK named "${g}" already exists in app.json:`),console.log(`   ${u.dataModelSpace} / ${u.dataModelExternalId} @ ${u.dataModelVersion}`);let S=await $t("What would you like to do?",["Replace existing entry","Pick a different name","Cancel"],h=>h);if(S==="Cancel"&&(console.log(`
+Cancelled.
+`),process.exit(0)),S==="Pick a different name")return We}return d.sdkName=g,!0},async()=>{let f={name:d.sdkName,dataModelSpace:d.chosenModel.space,dataModelExternalId:d.chosenModel.externalId,dataModelVersion:String(d.chosenModel.version)};console.log(`
+\u2500\u2500 Summary \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500`),console.log(`   Space:     ${f.dataModelSpace}`),console.log(`   Model:     ${f.dataModelExternalId} @ ${f.dataModelVersion}`),console.log("   Views:     all"),console.log(`   SDK name:  ${d.sdkName}`),console.log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");let g=await $t("Write to app.json?",["Yes","Back","Cancel"],y=>y);return g==="Back"?We:(g==="Cancel"&&(console.log(`
+Cancelled.
+`),process.exit(0)),Js(e,f),!0)}],m=0;for(;m<l.length;)await l[m]()===We?(m=Math.max(0,m-1),console.log("")):m++;return{sdkName:d.sdkName,auth:{token:o,baseUrl:s,project:a}}}finally{process.chdir(r)}}i(Qs,"runWizard");function Js(e,t){let r=z(e,"app.json"),n=JSON.parse(Pe(r,"utf-8"));n.generatedSdks=[...n.generatedSdks??[],t],Dt(r,JSON.stringify(n,null,2)+`
+`);let o=z(e,".dune","sdk-configs");try{en(o)||Us(o,{recursive:!0}),Dt(z(o,`${t.name}.json`),JSON.stringify(t,null,2)+`
+`),console.log(`
+\u2705 Added "${t.name}" to app.json`),console.log(`   Config saved to .dune/sdk-configs/${t.name}.json`)}catch{console.log(`
+\u2705 Added "${t.name}" to app.json`)}t.instanceSpaces&&console.log(`   Scoped to: ${t.instanceSpaces.join(", ")}`),t.views&&console.log(`   Views: ${t.views.map(s=>s.externalId).join(", ")}`),console.log("")}i(Js,"writeEntry");async function Xr(e,t,r,n={}){let o=r??process.cwd();P(o);let s=C(o),p=(JSON.parse(Pe(z(o,"app.json"),"utf-8")).generatedSdks??[]).find(w=>w.name===e);p||(console.error(`No SDK named "${e}" in generatedSdks`),process.exit(1));let{token:c}=t??await tn(s,n),d=s.deployments[0],l=new Ms({appId:s.externalId,project:d.project,baseUrl:d.baseUrl,oidcTokenProvider:i(async()=>c,"oidcTokenProvider")});await l.authenticate();let m=z(o,"src/generated_sdks");console.log(`
+\u2699\uFE0F  Generating "${p.name}" (${p.dataModelSpace}/${p.dataModelExternalId}@${p.dataModelVersion})...`);let{sdkDir:f,viewCount:g}=await Vr({name:p.name,space:p.dataModelSpace,dataModelExternalId:p.dataModelExternalId,dataModelVersion:p.dataModelVersion},l,m);console.log(`\u2705 Generated SDK for ${g} view(s) \u2192 ${f}`);let y=z(o,"package.json");if(en(y)){let w=JSON.parse(Pe(y,"utf-8")),u=w.dependencies??{},S=[];u.graphql||(u.graphql="^16.0.0",S.push("graphql")),u["graphql-tag"]||(u["graphql-tag"]="^2.12.0",S.push("graphql-tag"));let h=n.linkLocal?`file:${z(Vs(import.meta.url),"../../..")}`:"^1.4.0-alpha.sdk-gen";u["@cognite/cli"]!==h&&(u["@cognite/cli"]=h,S.push("@cognite/cli")),S.length>0&&(w.dependencies=u,Dt(y,JSON.stringify(w,null,2)+`
+`,"utf-8"),console.log(`
+\u{1F4E6} Updated package.json: ${S.join(", ")} (run npm install)`))}}i(Xr,"generate");function Zr(e){return{interactive:e.interactive,orgHint:e.org,linkLocal:e.linkLocal}}i(Zr,"sdkCommandOptions");function rn(e){e.command("sdk").summary("Add or regenerate typed GraphQL SDKs from CDF data models").description(`Add or regenerate typed GraphQL SDKs from CDF data models.
+Run with --interactive for the guided wizard (pick a data model, update app.json, generate types).`).option("--interactive","Run the guided wizard (pick data model, update app.json, generate types)").option("--org <org>","Organization hint for login (only with --interactive)").option("--link-local","Point @cognite/cli at the local monorepo package (default: use published version from npm)").passThroughOptions().addHelpText("after",`
+Examples:
+  npx @cognite/cli apps sdk --interactive              Guided setup: pick a data model, add to app.json, generate types
+  npx @cognite/cli apps sdk generate                   Regenerate types for SDKs already in app.json
+  npx @cognite/cli apps sdk generate my-sdk            Regenerate a specific SDK by name
+
+Without --interactive, this command only shows help. Use --interactive for the guided wizard.
+Non-interactive auth for generate uses the same env vars as apps deploy (COGNITE_TOKEN or deployment credentials).`).action(async function(r){if(!r.interactive){this.outputHelp();return}let n=process.cwd(),o=Zr(r),{sdkName:s,auth:a}=await Qs(n,o);await Xr(s,a,n,o)}).command("generate [name]").description("Regenerate TypeScript types for an existing SDK from app.json").option("--interactive","Authenticate via browser login (same as apps deploy --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").option("--link-local","Point @cognite/cli at the local monorepo package (default: use published version from npm)").action(async(r,n)=>{let o=process.cwd(),s=Zr(n),p=JSON.parse(Pe(z(o,"app.json"),"utf-8")).generatedSdks??[];p.length===0&&(console.error('No generatedSdks entries found in app.json. Run "cognite apps sdk --interactive" first.'),process.exit(1));let c=r??(p.length===1?p[0].name:await $t("Which SDK to regenerate?",p,d=>d.name));await Xr(typeof c=="string"?c:c.name,void 0,o,s)})}i(rn,"registerSdkCommand");import{createReadStream as qa,existsSync as Qa,writeFileSync as Ja}from"fs";import{basename as Ya,dirname as za,join as Wa,resolve as Gt}from"path";import{parseScope as Xa,signBundle as Za,validateScopes as ep}from"@cognite/app-sdk/codesigning";var nn="https://docs.cognite.com/cdf/access/";function Q(e){return e!==null&&typeof e=="object"}i(Q,"isRecord");function ae(e){return e instanceof Error&&"status"in e&&typeof e.status=="number"}i(ae,"isHttpError");function Ys(e){switch(e){case 401:return`Your credentials are invalid or expired. Check your client ID and secret.
+  See: ${nn}`;case 403:return`You don't have the required CDF capabilities. Please contact your CDF admin.
+  See: ${nn}`;default:return}}i(Ys,"httpStatusHint");function re(e){let t=e instanceof Error?e:new Error(String(e));if(!ae(t))return null;let r=Ys(t.status);return r?Object.assign(new Error(`${t.message}
+  ${r}`),{cause:t}):null}i(re,"enrichedHttpError");function zs(e){if(!Q(e))return null;let t=e.missing;if(Array.isArray(t))return t;let r=e.data;if(Q(r)){let n=r.error;if(Q(n)&&Array.isArray(n.missing))return n.missing;if(Array.isArray(r.missing))return r.missing}return null}i(zs,"findMissingArray");function Ws(e,t){if(!ae(e)||e.status!==400)return!1;let r=zs(e);return r?r.some(n=>Q(n)&&typeof n.externalId=="string"&&t.includes(n.externalId)):!1}i(Ws,"isMissingExternalIdError");function Rt(e,t){return ae(e)&&e.status===404||Ws(e,t)}i(Rt,"isNotFoundError");var sn=["DRAFT","PUBLISHED","DEPRECATED","ARCHIVED"],an=["ACTIVE","PREVIEW"],Ot=class Ot extends Error{constructor(t,r){super(`Version ${r} of app ${t} not found`),this.name="AppVersionNotFoundError",this.appExternalId=t,this.version=r}};i(Ot,"AppVersionNotFoundError");var J=Ot;function Xe(e,t){return e.includes(t)}i(Xe,"includesValue");function Xs(e){return Xe(sn,e)}i(Xs,"isAppVersionLifecycleState");function Zs(e){return Xe(an,e)}i(Zs,"isAppVersionAlias");function ea(e){return typeof e.version=="string"&&Xs(e.lifecycleState)&&typeof e.entrypoint=="string"&&typeof e.createdTime=="number"&&typeof e.createdBy=="string"&&typeof e.appExternalId=="string"&&(e.alias===void 0||Zs(e.alias))&&(e.comment===void 0||typeof e.comment=="string")}i(ea,"isAppVersion");function on(e){if(!Q(e))throw new Error("Invalid version response: not an object");if(!ea(e))throw new Error("Invalid version response: missing or malformed fields");return e}i(on,"parseAppVersion");var Ft=class Ft{constructor(t){this.client=t}get appsBasePath(){return`/api/v1/projects/${encodeURIComponent(this.client.project)}/apphosting/apps`}async createApp(t,r,n){try{await this.client.post(this.appsBasePath,{data:{items:[{externalId:t,name:r,description:n}]}})}catch(o){throw re(o)??o}}async uploadVersion(t,r,n,o,s="index.html"){console.log(`\u{1F4E4} Uploading version ${r}...`);let a=new FormData;a.append("file",new Blob([new Uint8Array(n)]),o),a.append("version",r),a.append("entryPath",s);let p=encodeURIComponent(t),c=`${this.appsBasePath}/${p}/versions`,d=await this.client.authenticate(),l=`${this.client.getBaseUrl()}${c}`,m=new AbortController,f=setTimeout(()=>m.abort(),300*1e3),g;try{g=await fetch(l,{method:"POST",headers:{Authorization:`Bearer ${d}`},body:a,signal:m.signal})}catch(y){throw y instanceof Error&&y.name==="AbortError"?new Error("Upload timed out after 5 minutes"):y}finally{clearTimeout(f)}if(!g.ok){let y=await g.text(),w=y;try{let v=JSON.parse(y);if(Q(v)){let k=v.error;if(typeof k=="string")w=k;else if(Q(k)){let x=k.message,V=k.code;w=typeof x=="string"?x:V!=null?`Unknown error (code: ${V})`:y}else{let x=v.message;w=typeof x=="string"?x:y}}}catch{}let u=g.headers.get("x-request-id"),S=u?` | X-Request-ID: ${u}`:"",h=Object.assign(new Error(`Upload failed: ${g.status} \u2014 ${w}${S}`),{status:g.status});throw re(h)??h}console.log(`\u2705 Version ${r} uploaded`)}async getVersion(t,r){let n=encodeURIComponent(t),o=encodeURIComponent(r),s=`${this.appsBasePath}/${n}/versions/${o}`;try{let a=await this.client.get(s);return on(a.data)}catch(a){throw Rt(a,[t,r])?new J(t,r):re(a)??a}}async getActiveVersion(t){let r=encodeURIComponent(t),n=`${this.appsBasePath}/${r}/active`;try{let o=await this.client.get(n);return on(o.data)}catch(o){if(Rt(o,[t]))return null;throw re(o)??o}}async updateVersions(t,r){let n=encodeURIComponent(t),o=`${this.appsBasePath}/${n}/versions/update`;try{await this.client.post(o,{data:{items:r}})}catch(s){throw re(s)??s}}async submitSignatures(t,r,n){let o=encodeURIComponent(t),s=encodeURIComponent(r),a=`${this.appsBasePath}/${o}/versions/${s}/signatures`;try{await this.client.post(a,{data:{items:n}})}catch(p){throw re(p)??p}}async listSignatures(t,r){let n=encodeURIComponent(t),o=encodeURIComponent(r),s=`${this.appsBasePath}/${n}/versions/${o}/signatures/list`;try{let a=await this.client.post(s,{data:{}});return na(a.data)}catch(a){throw re(a)??a}}};i(Ft,"AppHostingApi");var Ze=Ft,ta=["VALID","REVOKED","EXPIRED","SIGNED_BEFORE_KEY_ISSUED","IAT_IN_FUTURE","BUNDLE_TOO_OLD","KEY_NOT_IN_REGISTRY"],ra=["developer","certifier"];function na(e){if(!Q(e))throw new Error("Invalid signatures response: expected an object with an items array");let{items:t}=e;if(!Array.isArray(t))throw new Error("Invalid signatures response: items property is missing or not an array");return t.flatMap(r=>{let n=ia(r);return n?[n]:[]})}i(na,"parseStoredSignatures");function ia(e){if(!Q(e))return null;let{signerKid:t,signerRole:r,signatureIat:n,receivedAt:o,createdTime:s,status:a}=e;return typeof t!="string"||t===""||!Xe(ra,r)||typeof n!="number"||typeof o!="number"||typeof s!="number"||!Xe(ta,a)?null:{signerKid:t,signerRole:r,signatureIat:n,receivedAt:o,createdTime:s,status:a}}i(ia,"parseStoredSignature");var Lt=class Lt{constructor(t){this.api=new Ze(t)}getVersion(t,r){return this.api.getVersion(t,r)}uploadVersion(t,r,n,o,s){return this.api.uploadVersion(t,r,n,o,s)}async ensureApp(t,r,n){console.log("\u{1F50D} Ensuring app exists...");try{await this.api.createApp(t,r,n),console.log(`\u2705 App '${t}' created`)}catch(o){if(ae(o)&&o.status===409){console.log(`\u2705 App '${t}' already exists`);return}throw o}}async submitSignatures(t,r,n){n.length!==0&&(console.log(`\u{1F50F} Submitting ${n.length} signature${n.length===1?"":"s"} for version ${r}...`),await this.api.submitSignatures(t,r,n),console.log("\u2705 Signatures stored"))}listSignatures(t,r){return this.api.listSignatures(t,r)}async publishVersion(t,r){await this.api.updateVersions(t,[{version:r,update:{lifecycleState:{set:"PUBLISHED"}}}])}async publishAndActivate(t,r){console.log(`\u{1F680} Publishing and activating version ${r}...`),await this.api.updateVersions(t,[{version:r,update:{lifecycleState:{set:"PUBLISHED"},alias:{set:"ACTIVE"}}}]),console.log(`\u2705 Version ${r} is now PUBLISHED and ACTIVE`)}getActiveVersion(t){return this.api.getActiveVersion(t)}async deactivateVersion(t,r){await this.api.updateVersions(t,[{version:r,update:{alias:{setNull:!0}}}])}async activateVersion(t,r){let n=null;try{n=await this.api.getActiveVersion(t)}catch{n=null}let o=n&&n.version!==r?n.version:void 0;return await this.api.updateVersions(t,[{version:r,update:{alias:{set:"ACTIVE"}}}]),{supersededVersion:o}}async deploy(t,r,n,o,s,a,p=!1){console.log(`
+\u{1F680} Deploying application via App Hosting API...
+`);try{await this.ensureApp(t,r,n),await this.uploadVersion(t,o,s,a),p&&await this.publishAndActivate(t,o),console.log(`
+\u2705 Deployment successful!`)}catch(c){let d=c instanceof Error?c.message:String(c);throw Object.assign(new Error(`Deployment failed: ${d}`),{cause:c})}}};i(Lt,"AppHostingClient");var A=Lt;import oa from"path";var pn=".cognite-bundles";function cn(e,t){return`${e}-${t}.zip`}i(cn,"bundleFileName");function pe(e,t,r){return oa.join(e,pn,cn(t,r))}i(pe,"bundlePath");import{existsSync as sa,readFileSync as aa}from"fs";var ln=[".dev.sig",".cert.sig"];function Ae(e,t={}){let r=t.existsSync??sa,n=t.readFileSync??((s,a)=>aa(s,a)),o=[];for(let s of ln){let a=`${e}${s}`;if(!r(a))continue;let p=n(a,"utf8").trim();p.length>0&&o.push(p)}return o}i(Ae,"discoverSignatures");import{CogniteClient as ca}from"@cognite/sdk";import{CogniteClient as pa}from"@cognite/sdk";async function Ie(e,t,r=process.env,n){let o=await Ee(e,r),s=r.COGNITE_BASE_URL??e.baseUrl,a=(n??(p=>new pa(p)))({appId:t,project:e.project,baseUrl:s,oidcTokenProvider:i(async()=>o,"oidcTokenProvider")});return await a.authenticate(),a}i(Ie,"getSdk");async function j(e,t,r={}){let{login:n=ze,getSdk:o=Ie,createClient:s=i(a=>new ca(a),"createClient")}=r;if(t.interactive){let a=t.orgHint||e.org||void 0,p=await n(a),c=s({appId:t.appId,project:e.project,baseUrl:e.baseUrl,getToken:i(async()=>p.access_token,"getToken")});return await c.authenticate(),c}return o(e,t.appId)}i(j,"getClientForDeployment");import{existsSync as Ga,readFileSync as Ha}from"fs";import{execFile as ma}from"child_process";import{promisify as ua}from"util";import{execFileSync as dn}from"child_process";import{platform as la}from"os";import da from"path";function H(e,t={}){let{platform:r=la}=t;switch(r()){case"darwin":return e==="macos";case"win32":return e==="windows";default:return e==="other"}}i(H,"isOS");function mn(e,t={}){let{exec:r=dn,log:n=console.log}=t,[o,s]=H("macos",t)?["open",[e]]:H("windows",t)?["rundll32",["url.dll,FileProtocolHandler",e]]:["xdg-open",[e]];try{r(o,s)}catch{n(`Could not open browser \u2014 open manually:
+  ${e}`)}}i(mn,"openInBrowser");function un(e,t={}){let{exec:r=dn,log:n=console.log}=t,[o,s]=H("macos",t)?["open",["-R",e]]:H("windows",t)?["explorer",[`/select,${e}`]]:["xdg-open",[da.dirname(e)]];try{r(o,s)}catch{n(`Could not open file manager \u2014 files are at:
+  ${e}`)}}i(un,"revealInFileManager");var fn="cognite-flows",ga=ua(ma),yn=i((e,t)=>ga(e,t),"defaultExecFile"),fa=-25300,ya=fa&255;function ha(e){if(!(e instanceof Error)||!("code"in e)||e.code!==ya)return!1;let t="stderr"in e?String(e.stderr):"";return/could not be found/i.test(t)||t===""}i(ha,"isKeychainNotFoundError");async function hn(e,t,r={}){if(!H("macos",r))throw new Error("Keychain storage is only supported on macOS");let{execFile:n=yn}=r;await n("security",["add-generic-password","-a",e,"-s",fn,"-w",Buffer.from(t,"utf-8").toString("base64"),"-U"])}i(hn,"storeKeyInKeychain");async function et(e,t={}){if(!H("macos",t))return null;let{execFile:r=yn}=t;try{let{stdout:n}=await r("security",["find-generic-password","-a",e,"-s",fn,"-w"]);return Buffer.from(n.trim(),"base64").toString("utf-8")}catch(n){if(ha(n))return null;throw n}}i(et,"readKeyFromKeychain");import{pbkdf2 as va,randomBytes as ka}from"crypto";import{promisify as Ca}from"util";import{CompactEncrypt as xa,base64url as Sn,compactDecrypt as ba}from"jose";var Sa=new TextEncoder,wa=new TextDecoder,Nt={encode:i(e=>Sa.encode(e),"encode"),decode:i(e=>wa.decode(e),"decode")};var Ea=Ca(va),Kt=6e5,Pa="sha512",_t="PBKDF2-HMAC-SHA512",jt=16,tt="A256GCM",Aa=32,rt=2e6;async function wn(e,t,r){return await Ea(e,t,r,Aa,Pa)}i(wn,"deriveKey");async function vn(e,t,r=Kt){if(!Number.isInteger(r)||r<1||r>rt)throw new Error(`Invalid iterations: must be an integer between 1 and ${rt}`);let n=ka(jt),o=await wn(t,n,r);return await new xa(Nt.encode(e)).setProtectedHeader({alg:"dir",enc:tt,kdf:_t,kdf_iter:r,kdf_salt:Sn.encode(n)}).encrypt(o)}i(vn,"encryptStringAsJwe");async function kn(e,t){let{plaintext:r}=await ba(e,async n=>{if(!e.length)throw new Error("Unexpected JWE empty value");if(t.length<15)throw new Error(`Invalid passphrase it should be at least ${15} but got ${t.length}`);if(n.alg!=="dir")throw new Error(`Unexpected JWE alg "${String(n.alg)}"; only "dir" is supported`);if(n.enc!==tt)throw new Error(`Unexpected JWE enc "${String(n.enc)}"; only "${tt}" is supported`);if(n.kdf!==_t)throw new Error(`Unexpected KDF "${String(n.kdf)}"; only "${_t}" is supported`);let o=Number(n.kdf_iter);if(!Number.isInteger(o)||o<1||o>rt)throw new Error(`Invalid kdf_iter in JWE header: must be an integer between 1 and ${rt}`);if(typeof n.kdf_salt!="string")throw new Error("Missing kdf_salt in JWE header");let s=Sn.decode(n.kdf_salt);if(s.length!==jt)throw new Error(`Invalid kdf_salt length in JWE header: expected ${jt} bytes, got ${s.length}`);return await wn(t,s,o)},{keyManagementAlgorithms:["dir"],contentEncryptionAlgorithms:[tt]});return Nt.decode(r)}i(kn,"decryptJweAsString");function Ia(e){let t=e.trim();return t.startsWith("eyJ")&&t.split(".").length===5}i(Ia,"isJweCompact");var Cn=Ia;import{existsSync as $a,readdirSync as Ta,readFileSync as Ra}from"fs";import{join as Ut}from"path";import{homedir as Da}from"os";import{join as xn}from"path";function K(e={}){let{env:t=process.env,homedir:r=Da}=e,n=t.COGNITE_CLI_HOME?.trim()||xn(r(),".cognite-cli");return{home:n,keysDir:xn(n,"keys")}}i(K,"getConfig");var Se=".pub.pem",Vt=".key.jwe",Mt=".meta.json";function nt(e){switch(e.kind){case"keychain":return"Keychain";case"encrypted-file":return e.path;case"public-only":return"public-only (private key missing)"}}i(nt,"formatLocalKeySource");function Oa(e){return{existsSync:e.existsSync??$a,readdirSync:e.readdirSync??Ta,readFileSync:e.readFileSync??((t,r)=>Ra(t,r)),isOS:e.isOS??(t=>H(t)),readKeyFromKeychain:e.readKeyFromKeychain??(t=>et(t))}}i(Oa,"resolveDeps");function Fa(e){try{let t=JSON.parse(e);if(typeof t=="object"&&t!==null&&!Array.isArray(t)&&"email"in t&&typeof t.email=="string")return t.email}catch{}}i(Fa,"readEmailFromMeta");function La(e,t){return t.existsSync(e)?t.readdirSync(e).filter(r=>r.endsWith(Se)):[]}i(La,"publicKeyEntries");function Na(e){return e.slice(0,-Se.length)}i(Na,"kidFromPublicKeyFilename");async function _a(e,t,r){if(r.isOS("macos")&&await r.readKeyFromKeychain(e).catch(()=>null)!==null)return{kind:"keychain"};let n=Ut(t,`${e}${Vt}`);return r.existsSync(n)?{kind:"encrypted-file",path:n}:{kind:"public-only"}}i(_a,"resolveSource");async function it(e=K().keysDir,t={}){let r=Oa(t),n=new Set,o=La(e,r).flatMap(s=>{let a=Na(s);return!a||n.has(a)?[]:(n.add(a),[{kid:a,entry:s}])});return Promise.all(o.map(async({kid:s,entry:a})=>{let p=await _a(s,e,r),c=Ut(e,`${s}${Mt}`),d;try{d=Fa(r.readFileSync(c,"utf8"))}catch{}return{kid:s,source:p,publicKeyPath:Ut(e,a),email:d}}))}i(it,"discoverLocalKeys");import ja from"enquirer";async function Ka(e){return ja.prompt(e)}i(Ka,"defaultPrompt");async function bn(e,t={}){let{prompt:r=Ka}=t,{passphrase:n}=await r({type:"password",name:"passphrase",message:e});return n}i(bn,"promptPassphrase");import Va from"enquirer";import{statSync as Ua}from"fs";function En(e,t=Ua){return e.map(r=>({key:r,mtime:t(r.publicKeyPath).mtimeMs})).sort((r,n)=>n.mtime-r.mtime).map(({key:r})=>r)}i(En,"sortByMtime");async function Ma(e){return Va.prompt(e)}i(Ma,"defaultPrompt");async function Pn(e,t={}){if(e.length===1)return e[0];let{prompt:r=Ma,sortByMtime:n=En}=t,o=n(e),s=o[0],{choice:a}=await r({type:"select",name:"choice",message:"Select signing identity",choices:[{name:"latest",message:`Use latest: ${s.kid}`},{name:"pick",message:"Pick from list"}]});if(a==="latest")return s;if(a==="pick"){let{kid:p}=await r({type:"select",name:"kid",message:"Select signing identity",choices:o.map(d=>({name:d.kid,message:[d.kid,d.email,nt(d.source)].filter(Boolean).join("  \u2014  ")}))}),c=o.find(d=>d.kid===p);if(!c)throw new Error("No signing identity selected");return c}else throw new Error(`Unexpected choice: "${a}"`)}i(Pn,"promptSigningIdentity");function Ba(e){return{existsSync:e.existsSync??Ga,readFileSync:e.readFileSync??((t,r)=>Ha(t,r)),readKeyFromKeychain:e.readKeyFromKeychain??et,decryptJweAsString:e.decryptJweAsString??kn,discoverLocalKeys:e.discoverLocalKeys??it,keysDir:e.keysDir??K().keysDir,promptPassphrase:e.promptPassphrase??bn,promptSigningIdentity:e.promptSigningIdentity??Pn}}i(Ba,"resolveDeps");async function An(e,t={}){let r=Ba(t);if(e.keyPath){if(!r.existsSync(e.keyPath))throw new Error(`Key file not found: ${e.keyPath}`);if(!e.kid)throw new Error("--signing-identity <kid> is required when using --key");let s=r.readFileSync(e.keyPath,"utf-8").trim();if(Cn(s)){if(!e.interactive)throw new Error(`Key at ${e.keyPath} is passphrase-encrypted. Pass --interactive to enter the passphrase.`);let a=await r.promptPassphrase(`Passphrase for key ${e.kid}: `);return{privateKeyPem:await r.decryptJweAsString(s,a),kid:e.kid}}return{privateKeyPem:s,kid:e.kid}}let n=await r.discoverLocalKeys(r.keysDir);if(n.length===0)throw new Error("No signing keys found. Run `cognite keys generate` or pass --key.");let o;if(e.kid)o=n.find(s=>s.kid===e.kid);else if(e.interactive)o=await r.promptSigningIdentity(n);else throw new Error("--signing-identity <kid> is required. Pass --interactive to select it interactively.");if(!o)throw new Error(`No key found with kid "${e.kid}"`);switch(o.source.kind){case"keychain":{let s=await r.readKeyFromKeychain(o.kid);if(!s)throw new Error(`Key "${o.kid}" not found in Keychain`);return{privateKeyPem:s,kid:o.kid}}case"encrypted-file":{if(!e.interactive)throw new Error(`Key "${o.kid}" is passphrase-encrypted. Pass --interactive to enter the passphrase, or store the key in macOS Keychain for non-interactive use.`);let s=await r.promptPassphrase(`Passphrase for key ${o.kid}: `);return{privateKeyPem:await r.decryptJweAsString(r.readFileSync(o.source.path,"utf-8"),s),kid:o.kid}}case"public-only":throw new Error(`Key "${o.kid}" has no private key on this machine (public-only).`)}}i(An,"resolvePrivateKey");var tp=i(async(e,t,r,n,o)=>{let s=await j(e,{interactive:o.browserAuth??!1,appId:t,orgHint:o.org});await new A(s).submitSignatures(t,r,n)},"defaultSubmitSignatures");function rp(e){let t=qa(e);return new ReadableStream({start(r){t.on("data",n=>{let o=typeof n=="string"?Buffer.from(n):n;r.enqueue(new Uint8Array(o))}),t.on("end",()=>r.close()),t.on("error",n=>r.error(n))},cancel(){t.destroy()}})}i(rp,"createWebStreamFromFile");function np(e){return{existsSync:e.existsSync??Qa,writeFileSync:e.writeFileSync??Ja,createBundleStream:e.createBundleStream??rp,signBundle:e.signBundle??Za,parseScope:e.parseScope??Xa,validateScopes:e.validateScopes??ep,loadAppConfig:e.loadAppConfig??C,resolvePrivateKey:e.resolvePrivateKey??(t=>An(t)),submitSignatures:e.submitSignatures??tp,discoverSignatures:e.discoverSignatures??Ae}}i(np,"resolveDeps");async function In(e,t,r={},n=process.cwd()){let o=np(r),s=t.appid,a=t.appVersion,p=[],c=o.loadAppConfig(n);if(s=s??c.externalId,a=a??c.versionTag,t.scope&&t.scope.length>0?p=t.scope.map(o.parseScope):p=c.deployments.map(h=>({org:h.org,project:h.project})),!s)throw new Error("--appid is required (or set externalId in app.json)");if(!a)throw new Error("--app-version is required (or set versionTag in app.json)");let d=e?Gt(n,e):pe(n,s,a);if(!o.existsSync(d)){let h=e?"":" (default derived from app.json \u2014 pass [bundle] explicitly to override, or run `cognite apps deploy` first to populate .cognite-bundles/)";throw new Error(`Bundle not found: ${d}${h}`)}let l=o.validateScopes(p);if(l.length>0)throw new Error(`Invalid scopes:
+  ${l.join(`
+  `)}`);let{privateKeyPem:m,kid:f}=await o.resolvePrivateKey({keyPath:t.key?Gt(n,t.key):void 0,kid:t.signingIdentity,interactive:t.interactive}),g=o.createBundleStream(d),y=await o.signBundle({privateKeyPem:m,kid:f,appId:s,version:a,bundleStream:g,role:t.asCertifier?"certifier":"developer",scopes:p}),w=t.output?Gt(n,t.output):Wa(za(d),`${Ya(d)}.${t.asCertifier?"cert":"dev"}.sig`);o.writeFileSync(w,y.token,"utf-8"),console.log(`\u2705 Signed: ${w}`),console.log(`   kid:    ${y.kid}`),console.log(`   bundle: ${y.payload.bundleSha256}`),console.log(`   scopes: ${y.payload.scopes.map(h=>`${h.org}/${h.project}`).join(", ")}`),t.verbose&&console.log(`
+Payload:`,JSON.stringify(y.payload,null,2));let u=Array.from(new Set([...o.discoverSignatures(d),y.token])),S=t.interactive?await _(c,{deployment:t.deployment,baseUrl:t.baseUrl,project:t.project,org:t.org}):O(c.deployments,t.deployment);if(!t.browserAuth){let h=I(S);if(h.length>0)throw new Error(`Deployment ${S.org}/${S.project} is missing ${h.join(" and ")} in app.json. Pass --browser-auth to authenticate via browser instead.`)}await o.submitSignatures(S,s,a,u,t),console.log(`
+To publish:  npx @cognite/cli apps publish .`)}i(In,"handleSign");function Dn(e,t={}){return e.command("sign [bundle]").description("Sign an app bundle (defaults to .cognite-bundles/<app>-<version>.zip)").option("--key <path>","Private key PEM file path").option("-s, --signing-identity <kid>","Key ID for Keychain or file lookup").option("--appid <id>","Application ID (default: externalId from app.json)").option("-i, --identifier <id>","Alias for --appid").option("--app-version <version>","App version (default: versionTag from app.json)").option("--scope <org/project...>","Deployment scope(s) (default: deployments from app.json)").option("-r, --requirements <org/project...>","Alias for --scope").option("-o, --output <path>","Output file path (default: <bundle>.<dev|cert>.sig)").option("-v, --verbose","Display full payload after signing").option("--as-certifier","Counter-sign a developer signature as certifier").option("--interactive","Enable interactive prompts (key selection, passphrase, deployment target selection)",!1).option("--browser-auth","Use browser-based PKCE auth when submitting the signature",!1).option("-d, --deployment <target>","Deployment target from app.json (index or name; submit step only)").option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive or --browser-auth)").action((r,n)=>{let o={...n,appid:n.identifier??n.appid,scope:n.requirements??n.scope};return In(r,o,t)})}i(Dn,"registerSignCommand");function U(e){e.infra!=="appsApi"&&(console.error(`
 \u26A0\uFE0F  Legacy infrastructure is no longer supported.
 
 Your app.json is missing \`"infra": "appsApi"\`, which means it was created for
 the old CDF Application Registry. This deploy path has been removed.
 
 To migrate: add \`"infra": "appsApi"\` to your app.json, wire up the correct authentication and re-deploy.
-`),process.exit(1))}o(R,"assertAppHostingInfra");async function Pn(e){let t=process.cwd();_(t);let r=S(t);R(r);let n=e.interactive?await F(r,e):b(r.deployments,e.deployment);if(!e.interactive){let m=$(n);if(m.length>0)throw new Error(`Deployment ${n.org}/${n.project} is missing ${m.join(" and ")} in app.json. Use \`npx @cognite/cli@latest apps activate --interactive\` for browser-based authentication instead.`)}let i=await I(n,{interactive:e.interactive,appId:r.externalId,orgHint:e.org}),s=new h(i),{externalId:a,versionTag:c}=r,p;try{p=await s.getVersion(a,c)}catch(m){throw m instanceof C?new Error(`Version ${c} of ${a} has not been deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):m}if(p.alias==="ACTIVE"){console.log(`  ${a} @ ${c} is already ACTIVE \u2014 nothing to do.`);return}if(p.lifecycleState==="DEPRECATED"||p.lifecycleState==="ARCHIVED")throw new Error(`Cannot activate ${a} @ ${c}: version is ${p.lifecycleState} (terminal).`);p.lifecycleState==="DRAFT"&&(await s.publishVersion(a,c),console.log(`\u2713 Published  ${a} @ ${c} is now PUBLISHED`));let{supersededVersion:l}=await s.activateVersion(a,c);console.log(`\u2713 Activated   ${a} @ ${c} is now ACTIVE`),l&&console.log(`  Superseded  ${l} \u2192 PUBLISHED`)}o(Pn,"handleActivate");function at(e){return e.command("activate").description("Activate the current app version (publish if needed, then set ACTIVE alias)").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
+`),process.exit(1))}i(U,"assertAppHostingInfra");async function ip(e){let t=process.cwd();P(t);let r=C(t);U(r);let n=e.interactive?await _(r,e):O(r.deployments,e.deployment);if(!e.interactive){let l=I(n);if(l.length>0)throw new Error(`Deployment ${n.org}/${n.project} is missing ${l.join(" and ")} in app.json. Use \`npx @cognite/cli@latest apps activate --interactive\` for browser-based authentication instead.`)}let o=await j(n,{interactive:e.interactive,appId:r.externalId,orgHint:e.org}),s=new A(o),{externalId:a,versionTag:p}=r,c;try{c=await s.getVersion(a,p)}catch(l){throw l instanceof J?new Error(`Version ${p} of ${a} has not been deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):l}if(c.alias==="ACTIVE"){console.log(`  ${a} @ ${p} is already ACTIVE \u2014 nothing to do.`);return}if(c.lifecycleState==="DEPRECATED"||c.lifecycleState==="ARCHIVED")throw new Error(`Cannot activate ${a} @ ${p}: version is ${c.lifecycleState} (terminal).`);c.lifecycleState==="DRAFT"&&(await s.publishVersion(a,p),console.log(`\u2713 Published    ${a} @ ${p} is now PUBLISHED`));let{supersededVersion:d}=await s.activateVersion(a,p);console.log(`\u2713 Activated    ${a} @ ${p} is now ACTIVE`),d&&console.log(`  Superseded  ${d} \u2192 PUBLISHED`)}i(ip,"handleActivate");function $n(e){return e.command("activate").description("Activate the current app version (publish if needed, then set ACTIVE alias)").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
 Examples:
   npx @cognite/cli apps activate .                   Activate using env-var auth
-  npx @cognite/cli apps activate . --interactive     Activate using browser auth (no secrets needed)`).action((t,r)=>Pn(r))}o(at,"registerActivateCommand");import{readdirSync as Un}from"fs";import{basename as ht,dirname as Ln,normalize as Nn,resolve as X}from"path";import{fileURLToPath as Kn,pathToFileURL as jn}from"url";import{Logger as Mn,runner as Vn}from"hygen";import{safeParse as xn}from"valibot";function J(e,t){return r=>{let n=xn(t,r);return n.success?!0:`${e} ${n.issues[0].message}`}}o(J,"toPromptValidator");var ct={name:J("App name",ge),displayName:J("Display name",ue),baseUrl:J("Base URL",fe),org:J("Org",ye),project:J("Project",he)};function bn(e,t){return e?async r=>{let n=t(r);return n===!0?e(r):n}:t}o(bn,"composeValidators");function re(e){return e.map(t=>{if(!(t.name in ct))return t;let r=ct[t.name];return{...t,validate:bn(t.validate,r)}})}o(re,"applySchemaValidators");import{basename as lt}from"path";import mt from"enquirer";function pt(e){return e.replace(/[A-Z]/g,(t,r)=>r===0?t.toLowerCase():`-${t.toLowerCase()}`)}o(pt,"kebabCase");var An={type:"confirm",name:"useSpecKit",message:["Enable spec-driven development?","  Adds the github/spec-kit slash commands (/speckit.specify, .clarify, .plan, .tasks, .implement)","  to your app for use in Claude Code or Cursor. They walk you through writing SPEC.md and","  generating a plan, tasks, and implementation."].join(`
-`),initial:!1};async function kn(e){return!!(await e([An])).useSpecKit}o(kn,"promptForSpecKit");async function Dn(e,t,r){return e!==void 0?e:t?kn(r):!1}o(Dn,"resolveSpecKit");function dt({isCurrentDir:e,dirName:t,onAppName:r,onUseSpecKit:n,presets:i={},specKit:s,prompt:a=mt.prompt.bind(mt)}){return()=>({prompt:o(async c=>{if(!Array.isArray(c))return a([c]);let p=Object.fromEntries(Object.entries(i).filter(y=>y[1]!==void 0)),l=Object.keys(p).length>0,m=e?lt(process.cwd()):t?lt(t):null,d=l&&m!==null,u=!d&&m?c.map(y=>y.name==="name"?{...y,initial:m}:y):c,f=re(u),g=d?{...p,name:m}:p,A=new Set(Object.keys(g)),v=f.filter(y=>!A.has(y.name)),Z=v.findIndex(y=>y.name==="baseUrl"),V;if(Z!==-1){let y=v.filter(Dr=>Dr.name!=="baseUrl"),ce=y.length>0?await a(y):{},Pr=typeof ce.cluster=="string"?ce.cluster:"",xr=typeof g.cluster=="string"?g.cluster:"",br=`https://${(Pr||xr).trim().replace(/\/+$/,"")||"api"}.cognitedata.com`,Ar=v[Z],kr=await a([{...Ar,initial:br}]);V={...ce,...kr}}else V=v.length>0?await a(v):{};let U={...g,...V},P=typeof U.name=="string"?U.name:"";P&&r(P);let k=await Dn(s,v.length>0,a);return n?.(k),{...U,name:P,useCurrentDir:e,directoryName:e?void 0:t??void 0,useSpecKit:k}},"prompt")})}o(dt,"createAppPrompter");async function ut(e,t,r){let n=[];Object.values(t).some(s=>s!==void 0)&&r!==null&&n.push({key:"name",value:r,label:"directory"});for(let[s,a]of Object.entries(t))a!==void 0&&n.push({key:s,value:a,label:`--${pt(s)}`});for(let{key:s,value:a,label:c}of n){let p=e.find(m=>m.name===s)?.validate;if(!p)continue;let l=await p(a);if(l!==!0)throw new Error(`Invalid ${c}: ${l}`)}}o(ut,"validatePresets");import{cpSync as In,mkdirSync as gt,writeFileSync as $n}from"fs";import{dirname as ft,resolve as N}from"path";import{fileURLToPath as Fn}from"url";import{symlinkSync as Tn}from"fs";function ne({target:e,linkPath:t,label:r,symlink:n=Tn}){try{return n(e,t),!0}catch(i){if(i instanceof Error&&"code"in i&&i.code==="EEXIST")return!0;let s=i instanceof Error?i.message:String(i);return console.warn(`\u26A0\uFE0F  Could not create ${r} symlink:`,s),!1}}o(ne,"symlinkOrWarn");var _n=N(ft(Fn(import.meta.url)),"..","..","_vendor","spec-kit"),Rn={branch_numbering:"sequential"},On=[{from:"templates",to:".specify/templates"},{from:"scripts/bash",to:".specify/scripts/bash"},{from:"commands",to:".claude/commands"},{from:"commands",to:".cursor/commands"}];function yt({appDir:e,vendorDir:t=_n}){let r=N(e,".specify"),n=N(r,"memory"),i=`prepare spec-kit install for appDir=${e}`;try{for(let{from:s,to:a}of On){let c=N(e,a);i=`copy ${s} to ${a}`,gt(ft(c),{recursive:!0}),In(N(t,s),c,{recursive:!0})}i=`write init-options.json under specifyDir=${r}`,$n(N(r,"init-options.json"),`${JSON.stringify(Rn,null,2)}
-`),i=`link .specify/memory/constitution.md in specifyDir=${r}`,gt(n,{recursive:!0}),ne({target:"../../AGENTS.md",linkPath:N(n,"constitution.md"),label:".specify/memory/constitution.md"})}catch(s){let a=s instanceof Error?s.message:String(s);throw new Error(`installSpecKit failed while ${i} (appDir=${e}, vendorDir=${t}): ${a}`,{cause:s})}}o(yt,"installSpecKit");var Et=X(Ln(Kn(import.meta.url)),"..","..","_templates");async function Hn(){let e=X(Et,"app","new","prompt.js");return(await import(jn(e).href)).default}o(Hn,"loadPromptDefs");function Bn(e,t){return!e||t?null:Nn(e)}o(Bn,"resolveDirName");function Gn(e,t,r){if(e)return{cwd:process.cwd(),display:"."};let n=t??r;if(!n)throw new Error("App creation completed without a target directory or name.");return{cwd:X(process.cwd(),n),display:n}}o(Gn,"resolveAppLocation");function Yn(e,t,r){let n=`  npm install
-  npm run dev`,i="To deploy your app:",s="npx @cognite/cli apps deploy --interactive",a=r?`
+  npx @cognite/cli apps activate . --interactive     Activate using browser auth (no secrets needed)`).action((t,r)=>ip(r))}i($n,"registerActivateCommand");import{readdirSync as Cp}from"fs";import{basename as Hn,dirname as xp,normalize as bp,resolve as Te}from"path";import{fileURLToPath as Ep,pathToFileURL as Pp}from"url";import{Logger as Ap,runner as Ip}from"hygen";import{execFileSync as De}from"child_process";function ot(e={}){let{execFileSync:t=De}=e;try{return t("git",["--version"],{stdio:"ignore"}),!0}catch{return!1}}i(ot,"isGitInstalled");function st(e,t={}){let{execFileSync:r=De}=t;try{return r("git",["-C",e,"status"],{stdio:"ignore"}),!0}catch{return!1}}i(st,"isInsideGitRepo");function Tn(e,t={}){let{execFileSync:r=De}=t;r("git",["-C",e,"init"],{stdio:"pipe"}),r("git",["-C",e,"add","."],{stdio:"pipe"}),r("git",["-C",e,"commit","-m","Initial commit","--no-gpg-sign","--no-verify"],{stdio:"pipe"})}i(Tn,"gitInitAndCommit");function Rn(e={}){let{execFileSync:t=De}=e;try{return String(t("git",["config","--get","user.name"],{encoding:"utf-8",stdio:["ignore","pipe","ignore"]})).trim()||void 0}catch{return}}i(Rn,"gitUserName");function On(e={}){let{execFileSync:t=De}=e;try{return String(t("git",["config","--get","user.email"],{encoding:"utf-8",stdio:["ignore","pipe","ignore"]})).trim()||void 0}catch{return}}i(On,"gitUserEmail");import{safeParse as op}from"valibot";function $e(e,t){return r=>{let n=op(t,r);return n.success?!0:`${e} ${n.issues[0].message}`}}i($e,"toPromptValidator");var Fn={name:$e("App name",bt),displayName:$e("Display name",xt),baseUrl:$e("Base URL",Et),org:$e("Org",Pt),project:$e("Project",At)};function sp(e,t){return e?async r=>{let n=t(r);return n===!0?e(r):n}:t}i(sp,"composeValidators");function at(e){return e.map(t=>{if(!(t.name in Fn))return t;let r=Fn[t.name];return{...t,validate:sp(t.validate,r)}})}i(at,"applySchemaValidators");import{basename as Ln}from"path";import Nn from"enquirer";function Ht(e){return e.replace(/[A-Z]/g,(t,r)=>r===0?t.toLowerCase():`-${t.toLowerCase()}`)}i(Ht,"kebabCase");var ap={type:"confirm",name:"useSpecKit",message:["Enable spec-driven development?","  Adds the github/spec-kit slash commands (/speckit.specify, .clarify, .plan, .tasks, .implement)","  to your app for use in Claude Code or Cursor. They walk you through writing SPEC.md and","  generating a plan, tasks, and implementation."].join(`
+`),initial:!1};async function pp(e,t,r){return e!==void 0?e:t?!!(await r([ap])).useSpecKit:!1}i(pp,"resolveSpecKit");function cp(e){return typeof e=="function"}i(cp,"isFunctionInitial");function _n(e){return(e??"").trim().replace(/\/+$/,"")||"api"}i(_n,"normalizeCluster");function jn({isCurrentDir:e,dirName:t,onAppName:r,onUseSpecKit:n,presets:o={},specKit:s,prompt:a=Nn.prompt.bind(Nn)}){return()=>({prompt:i(async p=>{if(!Array.isArray(p))return a([p]);let c=Object.fromEntries(Object.entries(o).filter(b=>b[1]!==void 0)),d=Object.keys(c).length>0,l=e?Ln(process.cwd()):t?Ln(t):null,m=d&&l!==null,f=!m&&l?p.map(b=>b.name==="name"?{...b,initial:l}:b):p,g=at(f),y=m&&l?{...c,name:l}:c,w=new Set(Object.keys(y)),u=g.filter(b=>!w.has(b.name)),S=u.findIndex(b=>b.name==="baseUrl"),h;if(m){let b=_n(y.cluster),M=i(E=>cp(E.initial)?E.initial():E.initial,"resolveInitial"),F=i(E=>{if(E.name==="baseUrl")return`https://${b}.cognitedata.com`;let B=M(E);if(B===void 0)throw new Error(`Non-interactive mode: --${Ht(E.name)} has no default. Pass it as a flag.`);return B},"deriveValue");h=Object.fromEntries(u.map(E=>[E.name,F(E)]))}else if(S!==-1){let b=u.filter(L=>L.name!=="baseUrl"),M=b.length>0?await a(b):{},F=typeof M.cluster=="string"?M.cluster:"",B=`https://${_n(F||y.cluster)}.cognitedata.com`,Y=u[S],ne=await a([{...Y,initial:B}]);h={...M,...ne}}else h=u.length>0?await a(u):{};let v={...y,...h},k=typeof v.name=="string"?v.name:"";k&&r(k);let V=await pp(s,!m&&u.length>0,a);return n?.(V),{...v,name:k,useCurrentDir:e,directoryName:e?void 0:t??void 0,useSpecKit:V}},"prompt")})}i(jn,"createAppPrompter");async function Kn(e,t,r){let n=[];Object.values(t).some(s=>s!==void 0)&&r!==null&&n.push({key:"name",value:r,label:"directory"});for(let[s,a]of Object.entries(t))a!==void 0&&n.push({key:s,value:a,label:`--${Ht(s)}`});for(let{key:s,value:a,label:p}of n){let c=e.find(l=>l.name===s)?.validate;if(!c)continue;let d=await c(a);if(d!==!0)throw new Error(`Invalid ${p}: ${d}`)}}i(Kn,"validatePresets");import{cpSync as fp,mkdirSync as Vn,writeFileSync as yp}from"fs";import{dirname as Mn,posix as hp,resolve as le}from"path";import{fileURLToPath as Sp}from"url";import{copyFileSync as lp,symlinkSync as dp}from"fs";import{dirname as mp,join as up}from"path";function gp(e){if(e&&typeof e=="object"&&"code"in e&&typeof e.code=="string")return e.code}i(gp,"errno");function Un(e){return e instanceof Error?e.message:String(e)}i(Un,"messageOf");function pt({target:e,linkPath:t,label:r,symlink:n=dp,copyFile:o=lp}){try{return n(e,t),!0}catch(s){let a=gp(s);if(a==="EEXIST")return!0;let p=Un(s);if(a==="EPERM"||a==="EACCES")try{let c=up(mp(t),e);return o(c,t),console.log(`\u2139\uFE0F  Wrote ${r} as a copy of ${e} (symlinks need Developer Mode or an elevated shell on Windows).`),!0}catch(c){return console.warn(`\u26A0\uFE0F  Could not create ${r} symlink: ${p} (copy fallback also failed: ${Un(c)})`),!1}return console.warn(`\u26A0\uFE0F  Could not create ${r} symlink:`,p),!1}}i(pt,"linkOrCopyOrWarn");var wp=le(Mn(Sp(import.meta.url)),"..","..","_vendor","spec-kit"),vp={branch_numbering:"sequential"},kp=[{from:"templates",to:".specify/templates"},{from:"scripts/bash",to:".specify/scripts/bash"},{from:"commands",to:".claude/commands"},{from:"commands",to:".cursor/commands"}];function Gn({appDir:e,vendorDir:t=wp}){let r=le(e,".specify"),n=le(r,"memory"),o=`prepare spec-kit install for appDir=${e}`;try{for(let{from:s,to:a}of kp){let p=le(e,a);o=`copy ${s} to ${a}`,Vn(Mn(p),{recursive:!0}),fp(le(t,s),p,{recursive:!0})}o=`write init-options.json under specifyDir=${r}`,yp(le(r,"init-options.json"),`${JSON.stringify(vp,null,2)}
+`),o=`link .specify/memory/constitution.md in specifyDir=${r}`,Vn(n,{recursive:!0}),pt({target:hp.join("..","..","AGENTS.md"),linkPath:le(n,"constitution.md"),label:".specify/memory/constitution.md"})}catch(s){let a=s instanceof Error?s.message:String(s);throw new Error(`installSpecKit failed while ${o} (appDir=${e}, vendorDir=${t}): ${a}`,{cause:s})}}i(Gn,"installSpecKit");var Bn=Te(xp(Ep(import.meta.url)),"..","..","_templates");async function Dp(){let e=Te(Bn,"app","new","prompt.js");return(await import(Pp(e).href)).default}i(Dp,"loadPromptDefs");function $p(e,t){return!e||t?null:bp(e)}i($p,"resolveDirName");function Tp(e,t,r){if(e)return{cwd:process.cwd(),display:"."};let n=t??r;if(!n)throw new Error("App creation completed without a target directory or name.");return{cwd:Te(process.cwd(),n),display:n}}i(Tp,"resolveAppLocation");function Rp(e,t,r){let n=`  npm install
+  npm run dev`,o="To deploy your app:",s="npx @cognite/cli apps deploy --interactive",a=r?`
 To start spec-driven development:
   Run /speckit.specify in Claude Code or Cursor and describe your app.
-`:"",c=`  # Or fully non-interactive (deploys first target from app.json):
+`:"",p=`  # Or fully non-interactive (deploys first target from app.json):
   npx @cognite/cli apps deploy`;if(e){console.log(`
 \u2705 App created successfully in current directory!
 
 Next steps:
 ${n}
 ${a}
-${i}
+${o}
   ${s}
-${c}
+${p}
 `);return}console.log(`
 \u2705 App created successfully!
 
@@ -59,12 +166,12 @@ Or:
   cd "${t}"
 ${n}
 ${a}
-${i}
+${o}
   cd "${t}"
   ${s}
-${c}
-`)}o(Yn,"printSuccessMessage");async function Jn(e){try{let{execSkillsCli:t,pullAllArgs:r}=await import("../skills-GQ5TZKCM.js");console.log("\u{1F9E0} Pulling skills into your app..."),t(r(),{cwd:e,timeout:3e4,stdio:["pipe","pipe","inherit"]});let n=X(e,".agents","skills"),i=0;try{i=Un(n).length}catch{console.warn(`Skills directory not found after pull \u2014 no skills may have been installed (expected: ${n})`)}let s=i>0?`${i} skills`:"skills";console.log(`\u2705 Installed ${s} successfully to
- ${n}`)}catch(t){let r=t instanceof Error?t.message:String(t);console.warn("\u26A0\uFE0F  Could not pull skills:",r)}}o(Jn,"pullSkillsInto");async function Xn(e,t){let r=e==="."||e==="./",n=Bn(e,r),i=null,s=!1,a={displayName:t.displayName,description:t.description,org:t.org,project:t.project,cluster:t.cluster,baseUrl:t.baseUrl},c=await Hn(),p=re(c),l=r?ht(process.cwd()):n?ht(n):null;await ut(p,a,l);let m=dt({isCurrentDir:r,dirName:n,onAppName:o(u=>{i=u},"onAppName"),onUseSpecKit:o(u=>{s=u},"onUseSpecKit"),presets:a,specKit:t.specKit});await Vn(["app","new"],{templates:Et,cwd:process.cwd(),logger:new Mn(console.log.bind(console)),createPrompter:m,debug:!!process.env.DEBUG});let d=Gn(r,n,i);ne({target:"AGENTS.md",linkPath:X(d.cwd,"CLAUDE.md"),label:"CLAUDE.md"}),s&&yt({appDir:d.cwd}),Yn(r,d.display,s),await Jn(d.cwd)}o(Xn,"handleCreate");function wt(e){return e.command("create").description("Create a new application.").argument("[directory]","Target directory (. for current, or subdirectory name)").option("--display-name <name>","App display name (skips the prompt)").option("--description <description>","App description (skips the prompt)").option("--org <org>","Deployment org (skips the prompt)").option("--project <project>","Deployment project (skips the prompt)").option("--cluster <cluster>","CDF cluster, e.g. greenfield (skips the prompt)").option("--base-url <url>","CDF base URL, e.g. https://greenfield.cognitedata.com (skips the prompt; defaults to cluster-derived URL when omitted)").option("--spec-kit","Install spec-kit slash commands (skips the prompt)").option("--no-spec-kit","Skip spec-kit installation (skips the prompt)").addHelpText("after",`
+${p}
+`)}i(Rp,"printSuccessMessage");async function Op(e){try{let{execSkillsCli:t,pullAllArgs:r}=await import("../skills-SV7BPHAZ.js");console.log("\u{1F9E0} Pulling skills into your app..."),t(r(),{cwd:e,timeout:3e4,stdio:["pipe","pipe","inherit"]});let n=Te(e,".agents","skills"),o=0;try{o=Cp(n).length}catch{console.warn(`Skills directory not found after pull \u2014 no skills may have been installed (expected: ${n})`)}let s=o>0?`${o} skills`:"skills";console.log(`\u2705 Installed ${s} successfully to
+ ${n}`)}catch(t){let r=t instanceof Error?t.message:String(t);console.warn("\u26A0\uFE0F  Could not pull skills:",r)}}i(Op,"pullSkillsInto");function Fp(e,t={}){let{isGitInstalled:r=ot,isInsideGitRepo:n=st,gitInitAndCommit:o=Tn}=t;if(!r()){console.warn("git not found \u2014 skipping git repository initialisation");return}if(!n(e)){console.log("Initialising git repository...");try{o(e)}catch(s){let p=(s&&typeof s=="object"&&"stderr"in s&&s.stderr?String(s.stderr).trim():"")||(s instanceof Error?s.message:String(s));console.warn("Could not initialise git repository:",p)}}}i(Fp,"maybeInitGit");async function Lp(e,t){let r=e==="."||e==="./",n=$p(e,r),o=null,s=!1,a={displayName:t.displayName,description:t.description,org:t.org,project:t.project,cluster:t.cluster,baseUrl:t.baseUrl},p=await Dp(),c=at(p),d=r?Hn(process.cwd()):n?Hn(n):null;await Kn(c,a,d);let l=jn({isCurrentDir:r,dirName:n,onAppName:i(f=>{o=f},"onAppName"),onUseSpecKit:i(f=>{s=f},"onUseSpecKit"),presets:a,specKit:t.specKit});await Ip(["app","new","--cliVersion","1.4.0-alpha.sdk-gen"],{templates:Bn,cwd:process.cwd(),logger:new Ap(console.log.bind(console)),createPrompter:l,debug:!!process.env.DEBUG});let m=Tp(r,n,o);pt({target:"AGENTS.md",linkPath:Te(m.cwd,"CLAUDE.md"),label:"CLAUDE.md"}),s&&Gn({appDir:m.cwd}),await Op(m.cwd),Fp(m.cwd),Rp(r,m.display,s)}i(Lp,"handleCreate");function qn(e){return e.command("create").description("Create a new application.").argument("[directory]","Target directory (. for current, or subdirectory name)").option("--display-name <name>","App display name (skips the prompt)").option("--description <description>","App description (skips the prompt)").option("--org <org>","Deployment org (skips the prompt)").option("--project <project>","Deployment project (skips the prompt)").option("--cluster <cluster>","CDF cluster, e.g. greenfield (skips the prompt)").option("--base-url <url>","CDF base URL, e.g. https://greenfield.cognitedata.com (skips the prompt; defaults to cluster-derived URL when omitted)").option("--spec-kit","Install spec-kit slash commands (skips the prompt)").option("--no-spec-kit","Skip spec-kit installation (skips the prompt)").addHelpText("after",`
 Non-interactive use (CI, scripts, AI agents):
   Pass [directory] plus --display-name, --description, --org, --project, --cluster, --base-url
   to skip every prompt. Missing flags fall back to the interactive prompt.
@@ -77,14 +184,22 @@ Examples:
     --display-name "My App" --description "My app" \\
     --org cog-atlas --project atlas-greenfield --cluster greenfield \\
     --base-url https://greenfield.cognitedata.com
-                                             Fully non-interactive`).action(Xn)}o(wt,"registerCreateCommand");import{readFile as to,unlink as ro}from"fs/promises";import{basename as no}from"path";import Ct from"fs";import Zn from"path";import O from"fs";import E from"path";import{parseAndValidateManifestConfig as zn}from"@cognite/app-sdk/vite";import{BlobReader as qn,Uint8ArrayWriter as Wn,ZipWriter as Qn}from"@zip.js/zip.js";var Ce="package.json",ve="package-lock.json",St="manifest.json",Pe=".cognite",xe=class xe{constructor(t="dist"){this.distPath=E.isAbsolute(t)?t:E.join(process.cwd(),t),this.appRoot=E.dirname(this.distPath)}validateBuildDirectory(){if(!O.existsSync(this.distPath))throw new Error(`Build directory "${this.distPath}" not found. Run build first.`);let t=E.join(this.appRoot,Ce);if(!O.existsSync(t))throw new Error(`"${t}" not found. It is required for deployment.`);let r=E.join(this.appRoot,ve);if(!O.existsSync(r))throw new Error(`"${r}" not found. It is required for deployment.`)}async createZip(t="app.zip",r=!1){this.validateBuildDirectory(),console.log("\u{1F4E6} Packaging application...");let n=new Qn(new Wn,{level:9}),i=o(async(p,l)=>{await n.add(l,new qn(await O.openAsBlob(p))),r&&console.log(`  \u{1F4C4} ${l}`)},"addFile"),s=o(async p=>{let l=await O.promises.readdir(p,{withFileTypes:!0});for(let m of l){let d=E.join(p,m.name);m.isDirectory()?await s(d):await i(d,E.relative(this.distPath,d).replace(/\\/g,"/"))}},"addDir"),a;try{await s(this.distPath);let p=E.join(this.appRoot,Ce);await i(p,E.posix.join(Pe,Ce));let l=E.join(this.appRoot,St);if(O.existsSync(l)){let d=O.readFileSync(l,"utf-8");zn(d,l),await i(l,E.posix.join(Pe,St))}let m=E.join(this.appRoot,ve);await i(m,E.posix.join(Pe,ve)),a=await n.close()}catch(p){let l=p instanceof Error?p.message:String(p);throw new Error(`Failed to create zip: ${l}`)}await O.promises.writeFile(t,a);let c=(a.byteLength/1024/1024).toFixed(2);return console.log(`\u2705 App packaged: ${t} (${c} MB)`),t}};o(xe,"ApplicationPackager");var K=xe;var be=o(async(e,t,r)=>{let n=await new K(`${r}/dist`).createZip("app.zip",!0);try{let{externalId:i,name:s,description:a,versionTag:c}=t,p=await Y(e,r),l=new h(p),m=Ct.readFileSync(n),d=Zn.basename(n);await l.deploy(i,s,a,c,m,d,e.published)}finally{try{Ct.unlinkSync(n)}catch{}}},"deploy");import{execSync as eo}from"child_process";function Ae(e,t=!0,r={execSync:eo}){console.log("\u{1F4E6} Building app with npm..."),r.execSync("npm run build",{cwd:e,stdio:t?"inherit":"pipe"}),console.log("\u2705 Build successful")}o(Ae,"buildApp");function vt(e,t){let{org:r,project:n,baseUrl:i}=e,s;try{s=new URL(i).hostname}catch{return null}let{externalId:a,versionTag:c}=t,p=new URLSearchParams({cluster:s,customAppVersion:c,workspace:"industrial-tools"});return`https://${r}.fusion.cognite.com/${n}/flows-apps/app/${encodeURIComponent(a)}?${p}`}o(vt,"generateFusionUrl");function Pt(e,t,r){let n=r?"\u{1F680} Deploy (Interactive)":"\u{1F680} Deploy",i=r?`${t.project} @ ${t.baseUrl}`:`${t.org}/${t.project}`;console.log(["",n,"=".repeat(n.length),`App: ${e.name} (${e.externalId})`,`Version: ${e.versionTag}`,`Target: ${i}`,""].join(`
-`))}o(Pt,"printDeployInfo");function xt(e,t){console.log(`
+                                             Fully non-interactive`).action(Lp)}i(qn,"registerCreateCommand");import Np from"path";async function _p(e,t,r){let n=await j(e,{interactive:t.interactive,appId:r,orgHint:t.org});return new A(n)}i(_p,"defaultGetApiClient");async function jp(e,t,r={}){let{loadEnvFile:n=P,loadAppConfig:o=C,getApiClient:s=_p}=r,a=Np.resolve(process.cwd(),e);n(a);let p=o(a);U(p);let c=t.interactive?await _(p,t):O(p.deployments,t.deployment);if(!t.interactive){let f=I(c);if(f.length>0)throw new Error(`Deployment ${c.org}/${c.project} is missing ${f.join(" and ")} in app.json. Use \`npx @cognite/cli@latest apps deactivate --interactive\` for browser-based authentication instead.`)}let d=await s(c,t,p.externalId),{externalId:l}=p,m=await d.getActiveVersion(l);if(!m){console.log(`  ${l} has no active version \u2014 nothing to deactivate.`);return}await d.deactivateVersion(l,m.version),console.log(`\u2713 Deactivated  ${l} @ ${m.version} \u2014 active alias removed`)}i(jp,"handleDeactivate");function Qn(e){return e.command("deactivate").description("Deactivate the app by removing its active version from service").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
+Examples:
+  npx @cognite/cli apps deactivate .                   Deactivate using env-var auth
+  npx @cognite/cli apps deactivate . --interactive     Deactivate using browser auth (no secrets needed)`).action((t,r)=>jp(t,r))}i(Qn,"registerDeactivateCommand");import{mkdir as Hp,readFile as Bp}from"fs/promises";import{basename as qp,dirname as Qp}from"path";import{execFileSync as ct}from"child_process";import W from"fs";import D from"path";import{parseAndValidateManifestConfig as Kp}from"@cognite/app-sdk/vite";import{BlobReader as Up,Uint8ArrayWriter as Vp,ZipWriter as Mp}from"@zip.js/zip.js";var Bt="package.json",qt="package-lock.json",Jn="manifest.json",Qt=".cognite",Gp=[/^\.env(\..+)?$/i,/^\.secrets?$/i,/^\.token/i,/^\.cognite/i,/\.(key|pem|p12|pfx|jks|crt)$/i],Jt=class Jt{constructor(t="dist"){this.distPath=D.isAbsolute(t)?t:D.join(process.cwd(),t),this.appRoot=D.dirname(this.distPath)}validateBuildDirectory(){if(!W.existsSync(this.distPath))throw new Error(`Build directory "${this.distPath}" not found. Run build first.`);let t=D.join(this.appRoot,Bt);if(!W.existsSync(t))throw new Error(`"${t}" not found. It is required for deployment.`);let r=D.join(this.appRoot,qt);if(!W.existsSync(r))throw new Error(`"${r}" not found. It is required for deployment.`)}async createZip(t="app.zip",r=!1){this.validateBuildDirectory(),console.log("\u{1F4E6} Packaging application...");let n=new Mp(new Vp,{level:9}),o=i(async(c,d)=>{await n.add(d,new Up(await W.openAsBlob(c))),r&&console.log(`  \u{1F4C4} ${d}`)},"addFile"),s=i(async c=>{let d=await W.promises.readdir(c,{withFileTypes:!0});for(let l of d){let m=D.join(c,l.name);l.isDirectory()?await s(m):await o(m,D.relative(this.distPath,m).replace(/\\/g,"/"))}},"addDir"),a;try{await s(this.distPath);let c=D.join(this.appRoot,Bt);await o(c,D.posix.join(Qt,Bt));let d=D.join(this.appRoot,Jn);if(W.existsSync(d)){let m=W.readFileSync(d,"utf-8");Kp(m,d),await o(d,D.posix.join(Qt,Jn))}let l=D.join(this.appRoot,qt);await o(l,D.posix.join(Qt,qt)),a=await n.close()}catch(c){let d=c instanceof Error?c.message:String(c);throw new Error(`Failed to create zip: ${d}`)}await W.promises.writeFile(t,a);let p=(a.byteLength/1024/1024).toFixed(2);return console.log(`\u2705 App packaged: ${t} (${p} MB)`),t}async createSourceArchive(t){console.log("\u{1F4E6} Packaging source for review...");let r;try{r=ct("git",["-C",this.appRoot,"rev-parse","--show-toplevel"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim()}catch(c){throw c instanceof Error&&"code"in c&&c.code==="ENOENT"?new Error("git not found. Install git and ensure it is in your PATH."):new Error("Source packaging requires a git repository. Run `git init` first.")}let n=ct("git",["-C",this.appRoot,"rev-parse","--show-prefix"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim(),o=n?n.replace(/\/$/,""):".",s=o==="."?"HEAD":`HEAD:${o}`;this.validateNoSensitiveFiles(r,s);try{ct("git",["-C",r,"archive","--format=zip",`--output=${t}`,s])}catch(c){let d=c instanceof Error?c.message:String(c);throw new Error(`Failed to create source archive: ${d}`)}let p=(W.statSync(t).size/1024/1024).toFixed(2);return console.log(`\u2705 Source packaged: ${D.basename(t)} (${p} MB)`),t}validateNoSensitiveFiles(t,r){let n=ct("git",["-C",t,"ls-tree","-r","--name-only",r],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().split(`
+`).filter(Boolean),o=i(a=>a.split("/").some(p=>Gp.some(c=>c.test(p))),"isSensitive"),s=n.filter(o);if(s.length>0)throw new Error(`Source archive would include sensitive files \u2014 remove them from git tracking first:
+`+s.map(a=>`  ${a}`).join(`
+`)+`
+Hint: git rm --cached <file>`)}};i(Jt,"ApplicationPackager");var de=Jt;async function lt(e,t,r,n){let{externalId:o,name:s,description:a,versionTag:p}=t,c=pe(r,o,p);await Hp(Qp(c),{recursive:!0}),await new de(`${r}/dist`).createZip(c,!0);let d=await Bp(c);await new A(e).deploy(o,s,a,p,d,qp(c),n)}i(lt,"packageAndUpload");var Yt=i(async(e,t,r)=>{let n=await Ie(e,r);await lt(n,t,r,e.published)},"deploy");import{execSync as Jp}from"child_process";function zt(e,t=!0,r={execSync:Jp}){console.log("\u{1F4E6} Building app with npm..."),r.execSync("npm run build",{cwd:e,stdio:t?"inherit":"pipe"}),console.log("\u2705 Build successful")}i(zt,"buildApp");function Yn(e,t){let{org:r,project:n,baseUrl:o}=e,s;try{s=new URL(o).hostname}catch{return null}let{externalId:a,versionTag:p}=t,c=new URLSearchParams({cluster:s,customAppVersion:p,workspace:"industrial-tools"});return`https://${r}.fusion.cognite.com/${n}/flows-apps/app/${encodeURIComponent(a)}?${c}`}i(Yn,"generateFusionUrl");function zn(e,t,r){let n=r?"\u{1F680} Deploy (Interactive)":"\u{1F680} Deploy",o=r?`${t.project} @ ${t.baseUrl}`:`${t.org}/${t.project}`;console.log(["",n,"=".repeat(n.length),`App: ${e.name} (${e.externalId})`,`Version: ${e.versionTag}`,`Target: ${o}`,""].join(`
+`))}i(zn,"printDeployInfo");function Wn(e,t){console.log(`
 \u2705 Successfully deployed ${e.name} version ${e.versionTag} to ${t.org?`${t.org}/`:""}${t.project}`),console.log("\u{1F512} App is deployed in draft mode");let r=e.deployments.length>1?` -d ${t.project}`:"";console.log(`
-To publish:  npx @cognite/cli apps publish .${r}`),console.log(`To activate: npx @cognite/cli apps activate .${r}`);let n=vt(t,e);n&&console.log(`
+To sign:     npx @cognite/cli apps sign --interactive${r}`),console.log(`To publish:  npx @cognite/cli apps publish .${r}`),console.log(`To activate: npx @cognite/cli apps activate .${r}`),console.log(`
+To submit for certification: npx @cognite/cli apps submit`);let n=Yn(t,e);n&&console.log(`
 \u{1F517} Open your app:
-   ${n}`)}o(xt,"printDeployResult");async function oo(e,t,r,n,i){let s=$(t);if(s.length>0)throw new Error(`Deployment ${t.org}/${t.project} is missing ${s.join(" and ")} in app.json. Use \`cognite apps deploy --interactive\` for browser-based authentication instead.`);Pt(e,t,!1),n.skipBuild||Ae(r),console.log(`
-\u{1F4E4} Deploying to ${t.org}/${t.project}...`),await i({...t,published:!1},{externalId:e.externalId,name:e.name,description:e.description,versionTag:e.versionTag},r),xt(e,t)}o(oo,"handleDeployNonInteractive");async function io(e,t,r,n){Pt(e,t,!0),n.skipBuild||Ae(r);let i=await I(t,{interactive:!0,appId:e.externalId,orgHint:n.org});console.log(`
-\u{1F4E4} Deploying to ${t.project}...`);let s=await new K(`${r}/dist`).createZip("app.zip",!0);try{let a=await to(s);await new h(i).deploy(e.externalId,e.name,e.description,e.versionTag,a,no(s),!1),xt(e,t)}finally{await ro(s).catch(()=>{})}}o(io,"handleDeployInteractive");async function so(e,t=process.cwd(),r={}){let{loadEnvFile:n=_,loadAppConfig:i=S,deploy:s=be}=r;n(t);let a=i(t);if(R(a),e.interactive){let p=await F(a,e);await io(a,p,t,e);return}let c=b(a.deployments,e.deployment);await oo(a,c,t,e,s)}o(so,"handleDeploy");function bt(e){return e.command("deploy").description("Deploy your app to Cognite Data Fusion. Use --interactive for browser-based login (no env-var secrets required).").option("-d, --deployment <target>","Deployment target (index or project name)").option("--skip-build","Skip the build step",!1).option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
+   ${n}`)}i(Wn,"printDeployResult");async function Yp(e,t,r,n,o){let s=I(t);if(s.length>0)throw new Error(`Deployment ${t.org}/${t.project} is missing ${s.join(" and ")} in app.json. Use \`cognite apps deploy --interactive\` for browser-based authentication instead.`);zn(e,t,!1),n.skipBuild||zt(r),console.log(`
+\u{1F4E4} Deploying to ${t.org}/${t.project}...`),await o({...t,published:!1},{externalId:e.externalId,name:e.name,description:e.description,versionTag:e.versionTag},r),Wn(e,t)}i(Yp,"handleDeployNonInteractive");async function zp(e,t,r,n){zn(e,t,!0),n.skipBuild||zt(r);let o=await j(t,{interactive:!0,appId:e.externalId,orgHint:n.org});console.log(`
+\u{1F4E4} Deploying to ${t.project}...`),await lt(o,{externalId:e.externalId,name:e.name,description:e.description,versionTag:e.versionTag},r,!1),Wn(e,t)}i(zp,"handleDeployInteractive");async function Wp(e,t=process.cwd(),r={}){let{loadEnvFile:n=P,loadAppConfig:o=C,deploy:s=Yt}=r;n(t);let a=o(t);if(U(a),e.interactive){let c=await _(a,e);await zp(a,c,t,e);return}let p=O(a.deployments,e.deployment);await Yp(a,p,t,e,s)}i(Wp,"handleDeploy");function Xn(e){return e.command("deploy").description("Deploy your app to Cognite Data Fusion. Use --interactive for browser-based login (no env-var secrets required).").option("-d, --deployment <target>","Deployment target (index or project name)").option("--skip-build","Skip the build step",!1).option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
 Environment (non-interactive):
   deployClientId and deploySecretName are configured per deployment in app.json.
   deploySecretName is the name of the environment variable that holds the client
@@ -98,42 +213,73 @@ Examples:
   npx @cognite/cli apps deploy -d my-project      Deploy to project by name
   npx @cognite/cli apps deploy --skip-build       Deploy without rebuilding
   npx @cognite/cli apps deploy --interactive      Browser auth, prompts for target
-  npx @cognite/cli apps deploy --interactive -d 0 Browser auth, target chosen non-interactively`).action(t=>so(t))}o(bt,"registerDeployCommand");async function ao(e){let t=process.cwd();_(t);let r=S(t);R(r);let n=e.interactive?await F(r,e):b(r.deployments,e.deployment);if(!e.interactive){let l=$(n);if(l.length>0)throw new Error(`Deployment ${n.org}/${n.project} is missing ${l.join(" and ")} in app.json. Use \`cognite apps publish --interactive\` for browser-based authentication instead.`)}let i=await I(n,{interactive:e.interactive,appId:r.externalId,orgHint:e.org}),s=new h(i),{externalId:a,versionTag:c}=r,p;try{p=await s.getVersion(a,c)}catch(l){throw l instanceof C?new Error(`Version ${c} of ${a} has not been deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):l}if(p.alias==="ACTIVE"){console.log(`  ${a} @ ${c} is already ACTIVE \u2014 nothing to do.`);return}if(p.lifecycleState==="PUBLISHED"){console.log(`  ${a} @ ${c} is already PUBLISHED \u2014 nothing to do.`);return}if(p.lifecycleState==="DEPRECATED"||p.lifecycleState==="ARCHIVED")throw new Error(`Cannot publish ${a} @ ${c}: version is ${p.lifecycleState} (terminal).`);await s.publishVersion(a,c),console.log(`\u2713 Published  ${a} @ ${c} is now PUBLISHED`),console.log(""),console.log("Run `npx @cognite/cli apps activate .` to make it active.")}o(ao,"handlePublish");function At(e){return e.command("publish").description("Publish the current app version (transition DRAFT \u2192 PUBLISHED)").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
+  npx @cognite/cli apps deploy --interactive -d 0 Browser auth, target chosen non-interactively`).action(t=>Wp(t))}i(Xn,"registerDeployCommand");async function Xp(e,t,r){let n=await j(e,{interactive:t.interactive,appId:r.externalId,orgHint:t.org});return new A(n)}i(Xp,"defaultBuildApiClient");async function Zp(e,t={}){let r=t.loadEnvFile??P,n=t.loadAppConfig??C,o=t.buildApiClient??Xp,s=t.discoverSignatures??Ae,a=process.cwd();r(a);let p=n(a);U(p);let c=e.interactive?await _(p,e):O(p.deployments,e.deployment);if(!e.interactive){let y=I(c);if(y.length>0)throw new Error(`Deployment ${c.org}/${c.project} is missing ${y.join(" and ")} in app.json. Use \`cognite apps publish --interactive\` for browser-based authentication instead.`)}let d=await o(c,e,p),{externalId:l,versionTag:m}=p,f;try{f=await d.getVersion(l,m)}catch(y){throw y instanceof J?new Error(`Version ${m} of ${l} has not been deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):y}if(f.alias==="ACTIVE"){console.log(`  ${l} @ ${m} is already ACTIVE \u2014 nothing to do.`);return}if(f.lifecycleState==="PUBLISHED"){console.log(`  ${l} @ ${m} is already PUBLISHED \u2014 nothing to do.`);return}if(f.lifecycleState==="DEPRECATED"||f.lifecycleState==="ARCHIVED")throw new Error(`Cannot publish ${l} @ ${m}: version is ${f.lifecycleState} (terminal).`);let g=s(pe(a,l,m));g.length>0&&await d.submitSignatures(l,m,g),await d.publishVersion(l,m),console.log(`\u2713 Published    ${l} @ ${m} is now PUBLISHED`),console.log(""),console.log("Run `npx @cognite/cli apps activate .` to make it active.")}i(Zp,"handlePublish");function Zn(e){return e.command("publish").description("Publish the current app version (transition DRAFT \u2192 PUBLISHED)").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
 Examples:
   npx @cognite/cli apps publish .                    Publish using env-var auth
-  npx @cognite/cli apps publish . --interactive      Publish using browser auth (no secrets needed)`).action((t,r)=>ao(r))}o(At,"registerPublishCommand");function co(e){return e.alias==="ACTIVE"?"ACTIVE":e.lifecycleState}o(co,"describeStatus");async function po(e){let t=process.cwd();_(t);let r=S(t);R(r);let n=e.interactive?await F(r,e):b(r.deployments,e.deployment);if(!e.interactive){let a=$(n);if(a.length>0)throw new Error(`Deployment ${n.org}/${n.project} is missing ${a.join(" and ")} in app.json. Use \`cognite apps status --interactive\` for browser-based authentication instead.`)}let i=await I(n,{interactive:e.interactive,appId:r.externalId,orgHint:e.org}),s=new h(i);console.log(""),console.log(`App:     ${r.name} (${r.externalId})`),console.log(`Version: ${r.versionTag}  (local)`);try{let a=await s.getVersion(r.externalId,r.versionTag),c=co(a);console.log(`Status:  ${c}`),a.lifecycleState==="DRAFT"&&(console.log(""),console.log("Run `npx @cognite/cli apps publish .` to publish this version."))}catch(a){if(a instanceof C){console.log("Status:  not deployed yet"),console.log(""),console.log("Run `npx @cognite/cli apps deploy` to upload this version.");return}throw a}}o(po,"handleStatus");function kt(e){return e.command("status").description("Show the deployment status of the current app version").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
+  npx @cognite/cli apps publish . --interactive      Publish using browser auth (no secrets needed)`).action((t,r)=>Zp(r))}i(Zn,"registerPublishCommand");import{spawnSync as ec}from"child_process";import{mkdirSync as tc}from"fs";import{resolve as Wt}from"path";var rc=["localhost","local.cognite.ai","*.local.cognite.ai"],nc={info:i(e=>{process.stdout.write(`${e}
+`)},"info"),error:i(e=>{process.stderr.write(`${e}
+`)},"error")},ic={spawnSync:ec,mkdirSync:tc,logger:nc};function oc(e){let t=e("mkcert",["-help"],{stdio:"ignore"});return t.status===0||t.status===1}i(oc,"hasMkcert");function sc({certDir:e=Wt(process.cwd(),"certificates/mkcert"),domains:t=rc,deps:r={}}={}){let n={...ic,...r},{spawnSync:o,mkdirSync:s,logger:a}=n;if(!oc(o))throw a.error("Error: mkcert is not installed."),a.error("Install it with: brew install mkcert (macOS, Linux, WSL)"),a.error("On Windows: choco install mkcert  (or scoop install mkcert)"),a.error("See https://github.com/FiloSottile/mkcert#installation for other methods."),new Error("mkcert is not installed");if(a.info("\u2139\uFE0F  Installing mkcert root CA into your local trust store."),a.info("   This allows your browser to trust locally-generated certificates."),a.info("   You may be prompted for your system password."),o("mkcert",["-install"],{stdio:"inherit"}).status!==0)throw new Error("`mkcert -install` failed");s(e,{recursive:!0});let c=Wt(e,"localhost.pem"),d=Wt(e,"localhost-key.pem");if(o("mkcert",["-cert-file",c,"-key-file",d,...t],{stdio:"inherit"}).status!==0)throw new Error("mkcert failed to generate certificates");return a.info(""),a.info("Certificates generated:"),a.info(`  cert: ${c}`),a.info(`  key:  ${d}`),{certFile:c,keyFile:d}}i(sc,"setupHttps");function ac(e){sc({certDir:e.certDir})}i(ac,"handleSetupHttps");function ei(e){return e.command("setup-https").description("Generate trusted local HTTPS certificates via mkcert").option("--cert-dir <path>","Directory to write certs into (default: ./certificates/mkcert)").addHelpText("after",`
+Examples:
+  npx @cognite/cli@latest apps setup-https                     Generate certs in ./certificates/mkcert
+  npx @cognite/cli@latest apps setup-https --cert-dir certs    Use a custom directory`).action(t=>ac(t))}i(ei,"registerSetupHttpsCommand");function pc(e){return e.alias==="ACTIVE"?"ACTIVE":e.lifecycleState}i(pc,"describeStatus");function cc(e){if(e.length===0)return["Signatures: none stored"];let t=["Signatures:"];for(let r of e){let n=r.status==="VALID"?"\u2705":"\u274C",o=new Date(r.signatureIat).toISOString();t.push(`  ${n} ${r.signerKid}  (${r.signerRole}, signed ${o}) \u2014 ${r.status}`)}return t}i(cc,"formatSignatures");async function lc(e){let t=process.cwd();P(t);let r=C(t);U(r);let n=e.interactive?await _(r,e):O(r.deployments,e.deployment);if(!e.interactive){let a=I(n);if(a.length>0)throw new Error(`Deployment ${n.org}/${n.project} is missing ${a.join(" and ")} in app.json. Use \`cognite apps status --interactive\` for browser-based authentication instead.`)}let o=await j(n,{interactive:e.interactive,appId:r.externalId,orgHint:e.org}),s=new A(o);console.log(""),console.log(`App:     ${r.name} (${r.externalId})`),console.log(`Version: ${r.versionTag}  (local)`);try{let a=await s.getVersion(r.externalId,r.versionTag);console.log(`Status:  ${pc(a)}`);let p=await dc(s,r.externalId,r.versionTag);if(console.log(""),p==="endpoint-unavailable")console.log("Signatures: backend endpoint not available on this cluster yet");else for(let c of cc(p))console.log(c);a.lifecycleState==="DRAFT"&&(console.log(""),console.log("Run `npx @cognite/cli apps publish .` to publish this version."))}catch(a){if(a instanceof J){console.log("Status:  not deployed yet"),console.log(""),console.log("Run `npx @cognite/cli apps deploy` to upload this version.");return}throw a}}i(lc,"handleStatus");async function dc(e,t,r){try{return await e.listSignatures(t,r)}catch(n){if(ae(n)&&n.status===404||n instanceof Error&&/status code: 404/.test(n.message))return"endpoint-unavailable";throw n}}i(dc,"fetchSignatures");function ti(e){return e.command("status").description("Show the deployment status and signatures of the current app version").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
 Examples:
   npx @cognite/cli apps status .                     Status using env-var auth
-  npx @cognite/cli apps status . --interactive       Status using browser auth (no secrets needed)`).action((t,r)=>po(r))}o(kt,"registerStatusCommand");function Dt(e){let t=e.command("apps").description("Manage Fusion Custom Apps \u2014 create, deploy, and manage version lifecycle");return wt(t),bt(t),kt(t),At(t),at(t),He(t),t}o(Dt,"registerAppsCommand");import{existsSync as oi,mkdirSync as ii,writeFileSync as si}from"fs";import{dirname as Oe,join as Ue}from"path";import{execFile as mo}from"child_process";import{promisify as uo}from"util";import{platform as lo}from"os";function j(e={}){let{platform:t=lo}=e;return t()==="darwin"}o(j,"isMacOS");var Tt="cognite-flows",go=uo(mo),It=o((e,t)=>go(e,t),"defaultExecFile"),fo=-25300,yo=fo&255;function ho(e){if(!(e instanceof Error)||!("code"in e)||e.code!==yo)return!1;let t="stderr"in e?String(e.stderr):"";return/could not be found/i.test(t)||t===""}o(ho,"isKeychainNotFoundError");async function $t(e,t,r={}){if(!j(r))throw new Error("Keychain storage is only supported on macOS");let{execFile:n=It}=r;await n("security",["add-generic-password","-a",e,"-s",Tt,"-w",Buffer.from(t,"utf-8").toString("base64"),"-U"])}o($t,"storeKeyInKeychain");async function Ft(e,t={}){if(!j(t))return null;let{execFile:r=It}=t;try{let{stdout:n}=await r("security",["find-generic-password","-a",e,"-s",Tt,"-w"]);return Buffer.from(n.trim(),"base64").toString("utf-8")}catch(n){if(ho(n))return null;throw n}}o(Ft,"readKeyFromKeychain");import{pbkdf2 as So,randomBytes as Co}from"crypto";import{promisify as vo}from"util";import{CompactEncrypt as Po,base64url as xo,compactDecrypt as tp}from"jose";var Eo=new TextEncoder,wo=new TextDecoder,_t={encode:o(e=>Eo.encode(e),"encode"),decode:o(e=>wo.decode(e),"decode")};var bo=vo(So),ke=6e5,Ao="sha512",ko="PBKDF2-HMAC-SHA512",Do=16,To="A256GCM",Io=32,Rt=2e6;async function $o(e,t,r){return await bo(e,t,r,Io,Ao)}o($o,"deriveKey");async function Ot(e,t,r=ke){if(!Number.isInteger(r)||r<1||r>Rt)throw new Error(`Invalid iterations: must be an integer between 1 and ${Rt}`);let n=Co(Do),i=await $o(t,n,r);return await new Po(_t.encode(e)).setProtectedHeader({alg:"dir",enc:To,kdf:ko,kdf_iter:r,kdf_salt:xo.encode(n)}).encrypt(i)}o(Ot,"encryptStringAsJwe");import{calculateJwkThumbprint as Fo,exportJWK as _o,exportPKCS8 as Ro,exportSPKI as Oo,generateKeyPair as Uo}from"jose";async function Ut(){let{publicKey:e,privateKey:t}=await Uo("EdDSA",{extractable:!0}),r=await Ro(t),n=await Oo(e),i=await _o(e),s=await Fo(i);return{privateKeyPem:r,publicKeyPem:n,kid:s}}o(Ut,"generateSigningKeyPair");import{existsSync as No,readdirSync as Ko,readFileSync as jo}from"fs";import{join as oe}from"path";import{homedir as Lo}from"os";import{join as Lt}from"path";function M(e={}){let{env:t=process.env,homedir:r=Lo}=e,n=t.DUNE_HOME?.trim()||Lt(r(),".dune");return{home:n,keysDir:Lt(n,"keys")}}o(M,"getConfig");var ie=".pub.pem",De=".key.jwe",Mo=".pem",Te=".meta.json";function Nt(e){switch(e.kind){case"keychain":return"Keychain";case"encrypted-file":return e.path;case"legacy-unencrypted-file":return`${e.path} (unencrypted \u2014 rotate)`;case"public-only":return"public-only (private key missing)"}}o(Nt,"formatLocalKeySource");function Vo(e){return{existsSync:e.existsSync??No,readdirSync:e.readdirSync??Ko,readFileSync:e.readFileSync??((t,r)=>jo(t,r)),isMacOS:e.isMacOS??(()=>j()),readKeyFromKeychain:e.readKeyFromKeychain??(t=>Ft(t))}}o(Vo,"resolveDeps");function Ho(e){try{let t=JSON.parse(e);if(typeof t=="object"&&t!==null&&!Array.isArray(t)&&"email"in t&&typeof t.email=="string")return t.email}catch{}}o(Ho,"readEmailFromMeta");function Bo(e,t){return t.existsSync(e)?t.readdirSync(e).filter(r=>r.endsWith(ie)):[]}o(Bo,"publicKeyEntries");function Go(e){return e.slice(0,-ie.length)}o(Go,"kidFromPublicKeyFilename");async function Yo(e,t,r){if(r.isMacOS()&&await r.readKeyFromKeychain(e).catch(()=>null)!==null)return{kind:"keychain"};let n=oe(t,`${e}${De}`);if(r.existsSync(n))return{kind:"encrypted-file",path:n};let i=oe(t,`${e}${Mo}`);return r.existsSync(i)?{kind:"legacy-unencrypted-file",path:i}:{kind:"public-only"}}o(Yo,"resolveSource");async function Kt(e=M().keysDir,t={}){let r=Vo(t),n=new Set,i=Bo(e,r).flatMap(s=>{let a=Go(s);return!a||n.has(a)?[]:(n.add(a),[{kid:a,entry:s}])});return Promise.all(i.map(async({kid:s,entry:a})=>{let c=await Yo(s,e,r),p=oe(e,`${s}${Te}`),l;try{l=Ho(r.readFileSync(p,"utf8"))}catch{}return{kid:s,source:c,publicKeyPath:oe(e,a),email:l}}))}o(Kt,"discoverLocalKeys");function jt(e,t){let r=e.getUTCFullYear(),n=e.getUTCMonth()+t,i=new Date(Date.UTC(r,n+1,0)).getUTCDate(),s=Math.min(e.getUTCDate(),i);return new Date(Date.UTC(r,n,s))}o(jt,"addMonthsClamped");function Ie(e){return e.toISOString().slice(0,10)}o(Ie,"formatIsoDate");function Mt(e=new Date){return Ie(e)}o(Mt,"todayIso");import Jo,{Chalk as Xo}from"chalk";var $e=new Xo({level:0});function Vt(e){return e.isTTY?Jo:$e}o(Vt,"chalkForStream");function zo(e){return e.replace(/-----BEGIN [^-]+-----/g,"").replace(/-----END [^-]+-----/g,"").replace(/\s+/g,"")}o(zo,"pemBodyOneLine");function Ht(e,t=$e,r=new Date){let n=e.issuedAt??Mt(r),i=zo(e.publicKeyPem),s="  ",a=o((p,l)=>`${s}${t.cyan(p)}${t.dim(":")} ${l}
+  npx @cognite/cli apps status . --interactive       Status using browser auth (no secrets needed)`).action((t,r)=>lc(r))}i(ti,"registerStatusCommand");import{execFileSync as er}from"child_process";import Zt from"fs";import Re from"path";import hc from"readline";var ri="https://cognite.zendesk.com",mc="360001234312",uc="tf_360015295097",gc="cognite_flows",fc="360004885031";function yc(e,t){let r=new URLSearchParams({locale:"en-us",brand_id:fc,return_to:e});return`${t}/access?${r}`}i(yc,"withLogin");function ni(e,t,r){let n=new URLSearchParams({ticket_form_id:mc,tf_priority:"normal",tf_subject:e,[uc]:gc,tf_description:t});return yc(`${r}/hc/en-us/requests/new?${n}`,r)}i(ni,"buildUrl");function ii(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;")}i(ii,"escapeHtml");function Xt(e){return e.map(ii).join("<br>")}i(Xt,"toHtml");function oi(e,t=ri){let{appName:r,externalId:n,versionTag:o,archiveName:s,developerName:a,cdfProject:p,cdfCluster:c}=e,d=["Dear Cognite Platform Team,","","I would like to submit my Flows app for review and certification.","",`App name: ${r}`,`App external ID: ${n}`,`Version: ${o}`,p?`CDF project: ${p}`:void 0,c?`CDF cluster: ${c}`:void 0,"","`npx @cognite/cli apps submit` verified App-Brief.md,","code-review-report.md, and design-review-report.md are committed to git.","","Attached (all from dist/submit/):",`[ ] ${s??"src-<sha>.zip"} \u2014 source archive`,`[ ] ${n}-${o}.zip \u2014 deploy bundle`,"[ ] Screen recording of the application (required for design review)","","Best regards,",a??"[Your name]"];return ni(`App Review Request: ${r}`,Xt(d.filter(l=>l!==void 0)),t)}i(oi,"buildAppReviewUrl");function si(e,t,r,n,o=ri){let s=Xt(["Dear Cognite Platform Team,","","I would like to register my Flows app signing key for certified deployments.","",`Key ID (kid): ${e}`,`Developer email: ${t}`,`Expires: ${r}`,"","Please add the following entry to public_keys.yaml:"]),a=`<pre>${ii(n.replace(/\r\n/g,`
+`))}</pre>`,p=Xt(["","Best Regards,","[Your name]","","(This registration request was generated by `npx @cognite/cli keys generate`.)"]);return ni(`Public Key Registration: ${t}`,`${s}<br>${a}${p}`,o)}i(si,"buildKeyRegistrationUrl");function Sc(){return new Promise(e=>{let t=hc.createInterface({input:process.stdin,output:process.stdout});t.question(`
+Press Enter to open the Zendesk form in your browser and reveal dist/submit/ in your file manager...`,()=>{t.close(),e()})})}i(Sc,"defaultPressEnter");var wc=[{pattern:"App-Brief.md",label:"App-Brief.md",skill:"flows-app-brief"},{pattern:"reviews/code-review/*/code-review-report.md",label:"reviews/code-review/feedback-round-<N>/code-review-report.md",skill:"flows-code-review"},{pattern:"reviews/design-review/*/design-review-report.md",label:"reviews/design-review/feedback-round-<N>/design-review-report.md",skill:"flows-design-review"}];function vc(e){let t=wc.filter(({pattern:r})=>er("git",["-C",e,"ls-files","--",r],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().length===0);if(t.length>0){let r=t.map(({label:n,skill:o})=>`  ${n}  \u2192  /${o}`);throw new Error(`Certification files are missing or not committed. Run the required skills in Claude Code first:
+
+`+r.join(`
+`)+"\n\nAfter running the skills, commit the generated files and re-run `apps submit`.")}}i(vc,"assertArtifactsCommitted");async function kc(e=process.cwd(),t={}){let{openInBrowser:r=mn,revealInFileManager:n=un,pressEnter:o=Sc,isInteractive:s=i(()=>process.stdout.isTTY===!0,"isInteractive")}=t;if(!ot())throw new Error("git is not installed. Install git and ensure it is in your PATH.");if(!st(e))throw new Error("Not a git repository. Run this command from your app's root directory.");P(e);let a=C(e);U(a),vc(e);let p=Re.join(e,"dist","submit");Zt.mkdirSync(p,{recursive:!0});let c=er("git",["-C",e,"rev-parse","--short","HEAD"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim();if(er("git",["-C",e,"status","--porcelain"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().length>0)throw new Error(`Working tree has uncommitted changes. Commit or stash them before submitting for certification.
+
+The source archive must exactly match the committed code so reviewers can verify what they receive.`);let l=`src-${c}.zip`,m=Re.join(p,l);await new de(Re.join(e,"dist")).createSourceArchive(m);let g=`${a.externalId}-${a.versionTag}.zip`,y=Re.join(e,".cognite-bundles",g),w=!1;Zt.existsSync(y)&&(Zt.copyFileSync(y,Re.join(p,g)),w=!0);let u=oi({appName:a.name,externalId:a.externalId,versionTag:a.versionTag,archiveName:l,developerName:Rn(),cdfProject:a.deployments[0].project,cdfCluster:a.deployments[0].baseUrl});console.log(`
+\u2705 Certification package ready: dist/submit/`),console.log(`   ${l} \u2014 source archive (commit ${c})`),console.log(w?`   ${g} \u2014 deploy bundle`:"   \u26A0 Deploy bundle missing \u2014 run `apps deploy` to generate it, then re-run submit"),console.log("   \u2190 add your screen recording to this folder"),console.log(`
+Attach all files from dist/submit/ to the Zendesk ticket.`),console.log(`
+\u{1F517} ${u}`),s()&&(await o(),r(u),n(m))}i(kc,"handleSubmit");function ai(e){return e.command("submit").description("Package source and open a pre-filled Zendesk form for app certification submission").addHelpText("after",`
+Examples:
+  npx @cognite/cli apps submit          Package source, open browser + file manager`).action(()=>kc())}i(ai,"registerSubmitCommand");function pi(e){let t=e.command("apps").description("Manage Fusion Custom Apps \u2014 create, deploy, and manage version lifecycle").enablePositionalOptions();return qn(t),Xn(t),ti(t),Zn(t),$n(t),Qn(t),ei(t),ai(t),gr(t),rn(t),Dn(t),t}i(pi,"registerAppsCommand");import{existsSync as Fc,mkdirSync as Lc,writeFileSync as Nc}from"fs";import{dirname as ar,join as Le}from"path";import{generateSigningKeyPair as _c}from"@cognite/app-sdk/codesigning";import jc from"open";function ci(e,t){let r=e.getUTCFullYear(),n=e.getUTCMonth()+t,o=new Date(Date.UTC(r,n+1,0)).getUTCDate(),s=Math.min(e.getUTCDate(),o);return new Date(Date.UTC(r,n,s))}i(ci,"addMonthsClamped");function tr(e){return e.toISOString().slice(0,10)}i(tr,"formatIsoDate");function li(e=new Date){return tr(e)}i(li,"todayIso");import Cc,{Chalk as xc}from"chalk";var Oe=new xc({level:0});function di(e){return e.isTTY?Cc:Oe}i(di,"chalkForStream");var dt=Uint8Array.from([48,42,48,5,6,3,43,101,112,3,33,0]),mi=32,ui=44,gi=60,bc="services/app-hosting/src/kotlin/com/cognite/apphosting/signing/public_keys.yaml";function Ec(e){let t=e.replace(/-----BEGIN [^-]+-----/g,"").replace(/-----END [^-]+-----/g,"").replace(/\s+/g,"");if(t.length!==ui&&t.length!==gi)throw new Error(`Unexpected Ed25519 public key base64 length: got ${t.length} chars, expected ${ui} (raw) or ${gi} (X.509-wrapped)`);let r=Buffer.from(t,"base64");if(r.length===dt.length+mi&&r.subarray(0,dt.length).equals(dt))return r.subarray(dt.length).toString("base64");if(r.length===mi)return r.toString("base64");throw new Error(`Unexpected Ed25519 public key length: got ${r.length} bytes, expected 32 (raw) or 44 (X.509-wrapped)`)}i(Ec,"pemBodyOneLine");function rr(e,t=Oe,r=new Date){let n=fi(e.issuedAt??li(r)),o=fi(e.expires),s=Ec(e.publicKeyPem),a="    ",p=i((d,l)=>`${a}${t.cyan(d)}${t.dim(":")} ${l}
 `,"kv"),c="";return c+=`
-${t.bold("Add this entry to")} ${t.magenta("services/app-hosting/config/signing-keys.yaml")} ${t.bold("under")} ${t.cyan("public_keys:")}
+${t.bold("Add this entry to")} ${t.magenta(bc)} ${t.bold("under")} ${t.cyan("publicKeys:")}
 
-`,c+=`${t.dim("-")} ${t.cyan("kid")}${t.dim(":")} ${t.green(e.kid)}
-`,c+=a("public_key",t.green(i)),c+=a("email",t.yellow(e.email)),c+=a("capabilities",`${t.dim("[")}${t.yellow("developer")}${t.dim("]")}`),c+=a("issued_at",t.green(n)),c+=a("expires",t.green(e.expires)),c+=a("revoked_at",t.dim("null")),c}o(Ht,"renderRegistryEntry");import{email as qo,pipe as Wo,safeParse as Qo,string as Zo}from"valibot";var ei=Wo(Zo(),qo());function q(e,t="email"){let r=e.trim();if(!r)throw new Error(`${t} is required`);if(!Qo(ei,r).success)throw new Error(`${t} must look like an email (user@example.com); got "${e}"`);return r}o(q,"parseEmail");function W(e,t="--expires"){let r=Number(e);if(!Number.isInteger(r)||r<1||r>12)throw new Error(`${t} must be an integer between 1 and 12 (months); got "${e}"`);return r}o(W,"parseExpiryMonths");import ni from"enquirer";import{execFileSync as ti}from"child_process";function Bt(e={}){let{execFileSync:t=ti}=e;try{return String(t("git",["config","--get","user.email"],{encoding:"utf-8",stdio:["ignore","pipe","ignore"]})).trim()||void 0}catch{return}}o(Bt,"gitUserEmail");var se=3,Gt=`Key expiry in months (${1}-${12})`,Yt="Email address for the registry entry",Jt=`Passphrase for the encrypted private key (min ${15} chars)`,Xt="Confirm passphrase",zt=o(()=>`Passphrase must be at least ${15} characters`,"passphraseTooShortMsg"),qt=o(e=>`Passphrases do not match (attempt ${e}/${se}).
-`,"passphraseMismatchMsg"),Wt=`Passphrase confirmation failed after ${se} attempts`;async function Re(e){return ni.prompt(e)}o(Re,"defaultPrompt");function Qt(e){return t=>{try{return e(t),!0}catch(r){return r instanceof Error?r.message:"Invalid"}}}o(Qt,"parserAsValidator");async function Zt(e={}){let{prompt:t=Re}=e,{months:r}=await t({type:"input",name:"months",message:Gt,initial:String(6),validate:Qt(n=>W(n,"expiry"))});return W(r,"expiry")}o(Zt,"promptExpiryMonths");async function er(e={}){let{prompt:t=Re,gitUserEmail:r=Bt}=e,{email:n}=await t({type:"input",name:"email",message:Yt,initial:r(),validate:Qt(i=>q(i,"email"))});return q(n,"email")}o(er,"promptEmail");async function tr(e={}){let{prompt:t=Re,stderr:r=process.stderr}=e;for(let n=1;n<=se;n+=1){let{passphrase:i}=await t({type:"password",name:"passphrase",message:Jt,validate:o(a=>a.length>=15?!0:zt(),"validate")}),{confirm:s}=await t({type:"password",name:"confirm",message:Xt});if(i===s)return i;r.write(qt(n))}throw new Error(Wt)}o(tr,"promptPassphrase");function ai(e){return{writeFileSync:e.writeFileSync??si,mkdirSync:e.mkdirSync??ii,existsSync:e.existsSync??oi,generateSigningKeyPair:e.generateSigningKeyPair??Ut,encryptStringAsJwe:e.encryptStringAsJwe??Ot,storeKeyInKeychain:e.storeKeyInKeychain??$t,isMacOS:e.isMacOS??j,promptExpiryMonths:e.promptExpiryMonths??Zt,promptEmail:e.promptEmail??er,promptPassphrase:e.promptPassphrase??tr,discoverLocalKeys:e.discoverLocalKeys??(()=>Kt())}}o(ai,"resolveDeps");function nr(e,t={}){let r=ai(t),n=e.command("keys").description("Manage code signing keys");n.command("generate").description("Generate an Ed25519 keypair for code signing").option("-o, --output <path>","Encrypted private key output path (forces file storage even on macOS)").option("--no-keychain","Skip macOS Keychain and write a passphrase-encrypted private key under ~/.dune/keys/ instead").option("-e, --expires <months>",`Validity in months (${1}-${12}); skips the interactive prompt`).option("--email <address>","Email address for the registry entry; skips the interactive prompt").action(i=>li(i,r)),n.command("list").description("List local signing identities and their storage location").action(()=>ci(r))}o(nr,"registerKeysCommand");async function ci(e){let t=await e.discoverLocalKeys();if(t.length===0){process.stdout.write(`No signing identities found.
-`),process.stdout.write(`Run \`cognite keys generate\` to create one (storage: ${M().keysDir}).
-`);return}let r=["KID","SOURCE","EMAIL"],n=t.map(a=>[a.kid,Nt(a.source),a.email??"\u2014"]),i=r.map((a,c)=>Math.max(a.length,...n.map(p=>p[c].length))),s=o(a=>a.map((c,p)=>c.padEnd(i[p])).join("  ").trimEnd(),"fmt");process.stdout.write(`${s(r)}
+`,c+=`  ${t.dim("-")} ${t.cyan("kid")}${t.dim(":")} ${t.green(e.kid)}
+`,c+=p("publicKey",t.green(s)),c+=p("email",t.yellow(e.email)),c+=p("roles",`${t.dim("[")}${t.yellow("developer")}${t.dim("]")}`),c+=p("issuedAt",t.green(n)),c+=p("expiresAt",t.green(o)),c+=p("revokedAt",t.dim("null")),c}i(rr,"renderRegistryYamlBlock");function fi(e){let t=e.trim();if(/^\d{4}-\d{2}-\d{2}$/.test(t))return`${t}T00:00:00Z`;let r=new Date(t);if(Number.isNaN(r.getTime()))throw new Error(`Invalid date '${e}': expected YYYY-MM-DD or ISO-8601 instant`);return r.toISOString()}i(fi,"toIsoInstant");import Pc from"clipboardy";function yi(e){return Pc.write(e)}i(yi,"copyToClipboard");import{email as Ac,pipe as Ic,safeParse as Dc,string as $c}from"valibot";var Tc=Ic($c(),Ac());function we(e,t="email"){let r=e.trim();if(!r)throw new Error(`${t} is required`);if(!Dc(Tc,r).success)throw new Error(`${t} must look like an email (user@example.com); got "${e}"`);return r}i(we,"parseEmail");function ve(e,t="--expires"){let r=Number(e);if(!Number.isInteger(r)||r<1||r>12)throw new Error(`${t} must be an integer between 1 and 12 (months); got "${e}"`);return r}i(ve,"parseExpiryMonths");import or from"enquirer";var mt=3,hi="Signing identity (kid) \u2014 e.g. jsmith-dev-001 (lowercase letters, digits, hyphens)",Si=`Key expiry in months (${1}-${12})`,wi="Email address for the registry entry",vi=`Passphrase for the encrypted private key (min ${15} chars)`,ki="Confirm passphrase",Ci=i(()=>`Passphrase must be at least ${15} characters`,"passphraseTooShortMsg"),xi=i(e=>`Passphrases do not match (attempt ${e}/${mt}).
+`,"passphraseMismatchMsg"),bi=`Passphrase confirmation failed after ${mt} attempts`,Ei=i(e=>`A signing key with kid "${e}" already exists. Overwrite it?`,"confirmOverwriteMsg"),Pi="How would you like to submit your key registration?",Ai="Open in browser",Ii="Copy link to clipboard";async function ut(e){return or.prompt(e)}i(ut,"defaultPrompt");function sr(e){return t=>{try{return e(t),!0}catch(r){return r instanceof Error?r.message:"Invalid"}}}i(sr,"parserAsValidator");var Oc=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;function Fe(e){let t=e.trim();if(!t)throw new Error("--kid must not be empty");if(t.length>64)throw new Error("--kid must be 64 characters or fewer");if(!Oc.test(t))throw new Error("--kid must contain only lowercase letters, digits, and hyphens, and must not start or end with a hyphen (e.g. jsmith-dev-001)");return t}i(Fe,"parseKid");async function Di(e={}){let{prompt:t=ut}=e,{kid:r}=await t({type:"input",name:"kid",message:hi,validate:sr(Fe)});return Fe(r)}i(Di,"promptKid");async function $i(e={}){let{prompt:t=i(n=>or.prompt(n),"prompt")}=e,{action:r}=await t({type:"select",name:"action",message:Pi,choices:[{name:"browser",message:Ai},{name:"clipboard",message:Ii}]});if(r!=="browser"&&r!=="clipboard")throw new Error(`Unexpected Zendesk action: ${r}`);return r}i($i,"promptZendeskAction");async function Ti(e={}){let{prompt:t=ut}=e,{months:r}=await t({type:"input",name:"months",message:Si,initial:String(6),validate:sr(n=>ve(n,"expiry"))});return ve(r,"expiry")}i(Ti,"promptExpiryMonths");async function Ri(e={}){let{prompt:t=ut,gitUserEmail:r=On}=e,{email:n}=await t({type:"input",name:"email",message:wi,initial:r(),validate:sr(o=>we(o,"email"))});return we(n,"email")}i(Ri,"promptEmail");async function Oi(e={}){let{prompt:t=ut,stderr:r=process.stderr}=e;for(let n=1;n<=mt;n+=1){let{passphrase:o}=await t({type:"password",name:"passphrase",message:vi,validate:i(a=>a.length>=15?!0:Ci(),"validate")}),{confirm:s}=await t({type:"password",name:"confirm",message:ki});if(o===s)return o;r.write(xi(n))}throw new Error(bi)}i(Oi,"promptPassphrase");async function Fi(e,t={}){let{prompt:r=i(o=>or.prompt(o),"prompt")}=t,{confirmed:n}=await r({type:"confirm",name:"confirmed",message:Ei(e),initial:!1});return n}i(Fi,"promptConfirmOverwrite");function Kc(e){return{writeFileSync:e.writeFileSync??Nc,mkdirSync:e.mkdirSync??Lc,existsSync:e.existsSync??Fc,generateSigningKeyPair:e.generateSigningKeyPair??_c,encryptStringAsJwe:e.encryptStringAsJwe??vn,storeKeyInKeychain:e.storeKeyInKeychain??hn,isOS:e.isOS??(t=>H(t)),promptKid:e.promptKid??Di,promptExpiryMonths:e.promptExpiryMonths??Ti,promptEmail:e.promptEmail??Ri,promptPassphrase:e.promptPassphrase??Oi,promptConfirmOverwrite:e.promptConfirmOverwrite??Fi,discoverLocalKeys:e.discoverLocalKeys??(()=>it()),promptZendeskAction:e.promptZendeskAction??$i,openUrl:e.openUrl??(t=>jc(t)),copyToClipboard:e.copyToClipboard??yi}}i(Kc,"resolveDeps");function Ni(e,t={}){let r=Kc(t),n=e.command("keys").description("Manage code signing keys");n.command("generate").description("Generate an Ed25519 keypair for code signing").option("-o, --output <path>","Encrypted private key output path (forces file storage even on macOS)").option("--no-keychain",`Skip macOS Keychain and write a passphrase-encrypted private key under ${K().keysDir} instead`).option("-e, --expires <months>",`Validity in months (${1}-${12}); skips the interactive prompt`).option("--email <address>","Email address for the registry entry; skips the interactive prompt").option("--kid <identifier>","Signing identity name for the registry (e.g. jsmith-dev-001); skips the interactive prompt").option("--force","Overwrite an existing key without prompting for confirmation").option("--copy-link","Copy the Zendesk registration link to the clipboard without prompting").option("--interactive","Prompt for any required flags that are not supplied",!1).action(o=>Gc(o,r)),n.command("list").description("List local signing identities and their storage location").action(()=>Uc(r))}i(Ni,"registerKeysCommand");async function Uc(e){let t=await e.discoverLocalKeys();if(t.length===0){process.stdout.write(`No signing identities found.
+`),process.stdout.write(`Run \`cognite keys generate\` to create one (storage: ${K().keysDir}).
+`);return}let r=["KID","SOURCE","EMAIL"],n=t.map(a=>[a.kid,nt(a.source),a.email??"\u2014"]),o=r.map((a,p)=>Math.max(a.length,...n.map(c=>c[p].length))),s=i(a=>a.map((p,c)=>p.padEnd(o[c])).join("  ").trimEnd(),"fmt");process.stdout.write(`${s(r)}
 `);for(let a of n)process.stdout.write(`${s(a)}
-`)}o(ci,"handleList");function rr(e,t,r){let n=Ue(M().keysDir,`${e}${ie}`);return r.mkdirSync(Oe(n),{recursive:!0}),r.writeFileSync(n,t),n}o(rr,"writePublicKey");async function pi(e,t,r,n,i){let s=n??Ue(M().keysDir,`${e}${De}`);if(i.mkdirSync(Oe(s),{recursive:!0}),i.existsSync(s))throw new Error(`Refusing to overwrite existing key at ${s}. Delete it first if you really want to regenerate: rm ${s}`);let a=await i.encryptStringAsJwe(t,r);return i.writeFileSync(s,a,{mode:384}),s}o(pi,"writeEncryptedPrivateKey");async function li(e,t,r=new Date){let n=e.keychain!==!1&&t.isMacOS()&&!e.output,i=e.expires!==void 0?W(e.expires):await t.promptExpiryMonths(),s=Ie(jt(r,i)),a=e.email!==void 0?q(e.email,"--email"):await t.promptEmail(),c=n?null:await t.promptPassphrase();process.stderr.write(`
+`)}i(Uc,"handleList");function Li(e,t,r){let n=Le(K().keysDir,`${e}${Se}`);return r.mkdirSync(ar(n),{recursive:!0}),r.writeFileSync(n,t),n}i(Li,"writePublicKey");async function Vc(e,t,r,n,o,{force:s=!1}={}){let a=n??Le(K().keysDir,`${e}${Vt}`);if(o.mkdirSync(ar(a),{recursive:!0}),!s&&o.existsSync(a))throw new Error(`Refusing to overwrite existing key at ${a}. Delete it first if you really want to regenerate: rm ${a}`);let p=await o.encryptStringAsJwe(t,r);return o.writeFileSync(a,p,{mode:384}),a}i(Vc,"writeEncryptedPrivateKey");function Mc(e,t,r){let n=[];if(e.expires===void 0)n.push("--expires <months> is required. Pass --interactive to enter it interactively.");else try{ve(e.expires)}catch(o){n.push(o instanceof Error?o.message:String(o))}if(e.kid===void 0)n.push("--kid <identifier> is required. Pass --interactive to enter it interactively.");else try{let o=Fe(e.kid),s=Le(K().keysDir,`${o}${Se}`);r(s)&&!e.force&&n.push(`Key "${o}" already exists. Use --force to overwrite without prompting.`)}catch(o){n.push(o instanceof Error?o.message:String(o))}if(e.email===void 0)n.push("--email <address> is required. Pass --interactive to enter it interactively.");else try{we(e.email,"--email")}catch(o){n.push(o instanceof Error?o.message:String(o))}return t||n.push("A passphrase is required for encrypted key storage. Pass --interactive to enter it interactively."),n}i(Mc,"collectNonInteractiveErrors");async function Gc(e,t,r=new Date){let{isOS:n,existsSync:o,mkdirSync:s,writeFileSync:a,generateSigningKeyPair:p,storeKeyInKeychain:c,promptExpiryMonths:d,promptKid:l,promptEmail:m,promptPassphrase:f,promptConfirmOverwrite:g}=t,y=e.interactive??!1,w=e.keychain!==!1&&n("macos")&&!e.output;if(!y){let L=Mc(e,w,o);if(L.length>0)throw new Error(L.join(`
+`))}let u;e.expires!==void 0?u=ve(e.expires):u=await d();let S=tr(ci(r,u)),h;e.kid!==void 0?h=Fe(e.kid):h=await l();let v=Le(K().keysDir,`${h}${Se}`),k=o(v);if(k&&!e.force&&!await g(h)){process.stderr.write(`Aborted.
+`);return}let x;e.email!==void 0?x=we(e.email,"--email"):x=await m();let V=w?{kind:"keychain"}:{kind:"file",passphrase:await f()};process.stderr.write(`
 Generating Ed25519 keypair...
 
-`);let{privateKeyPem:p,publicKeyPem:l,kid:m}=await t.generateSigningKeyPair();if(n){await t.storeKeyInKeychain(m,p);let f=rr(m,l,t);process.stderr.write(`Public key:  ${f}
-`),process.stderr.write(`Private key: macOS Keychain (service: cognite-dune, account: ${m})
-`)}else{if(c===null)throw new Error("passphrase is required when not using Keychain");let f=await pi(m,p,c,e.output,t),g=rr(m,l,t);process.stderr.write(`Public key:  ${g}
-`),process.stderr.write(`Private key: ${f} (JWE, AES-256-GCM, PBKDF2-SHA512 x${ke.toLocaleString()})
-`),t.isMacOS()||process.stderr.write(`   (macOS Keychain integration is the default on darwin; on this OS we use the file.)
-`)}let d=Ue(M().keysDir,`${m}${Te}`);t.mkdirSync(Oe(d),{recursive:!0}),t.writeFileSync(d,JSON.stringify({email:a}));let u=Vt(process.stderr);process.stderr.write(`
-Signing identity (kid): ${u.green(m)}
-`),process.stderr.write(`Expires: ${s} (${i} month${i===1?"":"s"} from today)
-`),process.stderr.write(Ht({kid:m,publicKeyPem:l,email:a,expires:s},u,r)),process.stderr.write(`
-${u.bold("Next:")} open a PR against the ${u.magenta("infrastructure")} repo with that block, then \`${u.cyan(`cognite sign -s ${m}`)}\`
-`)}o(li,"handleGenerate");var or=1e3,mi=new Set(["baseUrl","url","project","deployment","source","path","name","displayName","description"]);function di(e){return Object.fromEntries(Object.entries(e).map(([t,r])=>typeof r=="boolean"?[t,r]:mi.has(t)?[t,r]:[t,"[REDACTED]"]))}o(di,"sanitize");function ui(e){let t=[],r=e;for(;r;)r.parent&&t.unshift(r.name()),r=r.parent;return t.join(" ")}o(ui,"getCommandPath");function ir(e){try{let t=e(process.cwd());return{appExternalId:t.externalId,appVersionTag:t.versionTag}}catch{return{}}}o(ir,"tryLoadAppConfig");function Le(e){return e.filter(t=>!t.startsWith("-")).join(" ")||"unknown"}o(Le,"commandFromArgv");function sr(e,t,r=S){e.hook("postAction",async(n,i)=>{try{let s={command:ui(i),options:di(i.opts()),success:!0,...ir(r)};t.track("Flows.CLI.Command",s),await t.flush(or)}catch{}})}o(sr,"instrument");async function ar(e,t,r=S){try{let n={command:Le(t),options:{},success:!1,...ir(r)};e.track("Flows.CLI.Command",n),await e.flush(or)}catch{}}o(ar,"trackFailure");var gi="ERR_USE_AFTER_CLOSE";function pr(e){return e instanceof Error&&"code"in e&&e.code===gi}o(pr,"isReadlineClosedError");function fi(e){let t=Object.getPrototypeOf(e);return t===Object.prototype||t===null}o(fi,"isPlainObject");function Ne(e){return e==null||pr(e)?!0:e instanceof Error?!1:!!(typeof e=="object"&&e!==null&&fi(e)&&Object.keys(e).length===0)}o(Ne,"isPromptCancel");var cr=!1;function lr(){cr||(cr=!0,process.on("uncaughtException",e=>{pr(e)&&(console.error(`
-Cancelled.`),process.exit(130)),console.error(e),process.exit(1)}),process.on("unhandledRejection",e=>{Ne(e)&&(console.error(`
-Cancelled.`),process.exit(130)),console.error(e),process.exit(1)}))}o(lr,"installCancelHandler");import mr from"mixpanel";var yi="5c4d853e7c3b77b1eb4468d5329b278c",Q="cognite-cli",hi=2e3,dr={env:process.env,init:mr.init.bind(mr)},Ei={track:o(()=>{},"track"),flush:o(async()=>{},"flush")};function Ke(e=process.env){return e.COGNITE_TELEMETRY_DISABLED==="1"||e.DO_NOT_TRACK==="1"}o(Ke,"isTelemetryDisabled");function wi(e){return e.COGNITE_TELEMETRY_DEBUG==="1"}o(wi,"isDebug");function ur(e={}){let t=e.env??dr.env,r=e.init??dr.init,n=e.packageName,i=e.cliVersion,s=wi(t);if(Ke(t))return s&&process.stderr.write(`[telemetry] disabled \u2014 noop tracker
-`),Ei;let a,c=new Set;function p(){if(a)return a;try{return a=r(yi,{geolocate:!1,keepAlive:!1}),a}catch{return}}return o(p,"getClient"),{track(l,m={}){let d=p();if(!d)return;let u={...m,applicationId:Q,...n&&{packageName:n},...i&&{cliVersion:i},nodeVersion:process.version,platform:process.platform};s&&process.stderr.write(`[telemetry] track ${l} ${JSON.stringify(u)}
-`);let f=o(()=>{},"finish"),g=new Promise(A=>{f=A});c.add(g);try{d.track(l,u,f)}catch{f()}g.finally(()=>c.delete(g))},async flush(l=hi){if(c.size===0)return;let m,d=new Promise(u=>{m=setTimeout(u,l),m.unref?.()});try{await Promise.race([Promise.allSettled([...c]),d])}finally{m&&clearTimeout(m)}s&&process.stderr.write(`[telemetry] flush done (${c.size} still pending)
-`)}}}o(ur,"createTelemetry");var Si=1e3,Ci="https://0a118cb02e3be57b1838bcfb5783a2bf@o4508040730968064.ingest.de.sentry.io/4510719268290640",vi={captureError:o(async()=>{},"captureError"),flush:o(async()=>{},"flush")};function Pi(e){return e.packageName&&e.cliVersion?`${e.packageName}@${e.cliVersion}`:e.cliVersion??"unknown"}o(Pi,"buildRelease");var xi="192.0.2.0";function bi(e){let t={...e.user,email:void 0,username:void 0,ip_address:xi,id:void 0};return{...e,user:t,server_name:void 0}}o(bi,"scrubPii");function gr(e={}){let t=e.env??process.env;if(Ke(t))return vi;let r=Pi(e),n="production",i=null,s=null;function a(){return{dsn:Ci,release:r,environment:n,defaultIntegrations:!1,integrations:[],sendDefaultPii:!1,enableLogs:!1,initialScope:{tags:{component:"cli",applicationId:Q},contexts:{cli:{applicationId:Q,node:process.version,platform:process.platform}}},beforeSend:bi}}o(a,"buildInitOptions");async function c(){return i||(s||(s=(async()=>{try{let p=e.sdk??await import("@sentry/node");return p.init(a()),i=p,p}catch{return null}})()),s)}return o(c,"ensureSdk"),{async captureError(p,l){try{let m=await c();if(!m)return;let d={level:"fatal"};l?.command&&(d.tags={command:l.command},d.contexts={cli:{applicationId:Q,node:process.version,platform:process.platform,command:l.command}}),m.captureException(p,d)}catch{}},async flush(p=Si){try{if(!i)return;await i.flush(p)}catch{}}}}o(gr,"createErrorReporter");import{mkdirSync as Ai,readFileSync as ki,writeFileSync as Di}from"fs";import{homedir as Ti}from"os";import{resolve as ae}from"path";import{debuglog as Ii}from"util";import{lt as $i,parse as fr}from"semver";var Fi="https://registry.npmjs.org/@cognite/cli/latest",_i=1500,yr="upgrade-check.json",hr=ae(process.env.XDG_CACHE_HOME||ae(Ti(),".cache"),"@cognite","cli"),je=Ii("cognite-flows");function Ri(e,t){return!e||!t||!fr(e)||!fr(t)?!1:$i(e,t)}o(Ri,"isOutdated");async function Oi({timeout:e=_i,registryUrl:t=Fi,fetchImpl:r=globalThis.fetch}={}){if(typeof r!="function")return null;try{let n=await r(t,{signal:AbortSignal.timeout(e)});if(!n?.ok)return null;let i=await n.json();return typeof i?.version=="string"?i.version:null}catch(n){return je("fetchLatestVersion failed (%s): %O",t,n),null}}o(Oi,"fetchLatestVersion");function Ui(e=hr,t=864e5){try{let r=ki(ae(e,yr),"utf-8"),n=JSON.parse(r);return typeof n.latest!="string"||typeof n.fetchedAt!="number"||Date.now()-n.fetchedAt>t?null:{latest:n.latest,fetchedAt:n.fetchedAt}}catch(r){return je("readUpgradeCheckCache failed (%s): %O",e,r),null}}o(Ui,"readUpgradeCheckCache");function Li(e,t){try{Ai(e,{recursive:!0});let r={latest:t,fetchedAt:Date.now()};Di(ae(e,yr),JSON.stringify(r))}catch(r){je("writeUpgradeCheckCache failed (%s): %O",e,r)}}o(Li,"writeUpgradeCheckCache");async function Ni({cacheDir:e=hr,...t}={}){let r=await Oi(t);r&&Li(e,r)}o(Ni,"startBackgroundUpgradeCheck");function Er(e,{onOutdated:t,cacheDir:r,...n}={}){let i=Ui(r);if(i){Ri(e,i.latest)&&t?.(e,i.latest);return}Ni({cacheDir:r,...n})}o(Er,"preActionUpgradeCheck");import{default as $l,chalkStderr as wr}from"chalk";function Sr(e,t){let r=[`\u26A0  Update available: ${e} -> ${t}`,"   Run npx @cognite/cli@latest"],n=Math.max(...r.map(c=>[...c].length))+2,i="\u2500".repeat(n),s=o(c=>`\u2502 ${c}${" ".repeat(n-1-[...c].length)}\u2502`,"pad"),a=[`\u250C${i}\u2510`,...r.map(s),`\u2514${i}\u2518`].join(`
-`);return wr.bold.yellow(a)}o(Sr,"formatUpgradeWarning");function Mi(e){return e instanceof Error&&"code"in e&&typeof e.code=="string"&&e.code==="DEP0040"}o(Mi,"isDep0040Warning");var Ve=process,Vi=Ve.emit.bind(Ve);Ve.emit=function(e,...t){return e==="warning"&&Mi(t[0])?!1:Vi(e,...t)};lr();var B=new ji;B.name("cognite").description("Build and deploy React apps to Cognite Data Fusion").version("1.3.4-alpha.selfsigned").showHelpAfterError().configureOutput({writeOut:o(e=>Ki(1,e),"writeOut")});B.hook("preAction",()=>{Er("1.3.4-alpha.selfsigned",{onOutdated:o((e,t)=>{console.warn(`
-${Sr(e,t)}
-`)},"onOutdated")})});Dt(B);nr(B);var vr=ur({packageName:"@cognite/cli",cliVersion:"1.3.4-alpha.selfsigned"}),Cr=gr({packageName:"@cognite/cli",cliVersion:"1.3.4-alpha.selfsigned"});sr(B,vr);var Me=process.argv.slice(2);B.parseAsync(Me,{from:"user"}).catch(async e=>{if(await ar(vr,Me),Ne(e)&&(console.error(`
-Cancelled.`),process.exit(130)),await Cr.captureError(e,{command:Le(Me)}),await Cr.flush(),e instanceof Error){console.error(`\u274C ${e.message}`);let t=e.cause;for(;t instanceof Error;)console.error(`   Caused by: ${t.message}`),t=t.cause}else console.error(e);process.exit(1)});
+`);let{privateKeyPem:b,publicKeyPem:M}=await p(h);if(V.kind==="keychain"){await c(h,b);let L=Li(h,M,t);process.stderr.write(`Public key:  ${L}
+`),process.stderr.write(`Private key: macOS Keychain (service: cognite-dune, account: ${h})
+`)}else{let L=await Vc(h,b,V.passphrase,e.output,t,{force:k}),ro=Li(h,M,t);process.stderr.write(`Public key:  ${ro}
+`),process.stderr.write(`Private key: ${L} (JWE, AES-256-GCM, PBKDF2-SHA512 x${Kt.toLocaleString()})
+`),n("macos")||process.stderr.write(`   (macOS Keychain integration is the default on darwin; on this OS we use the file.)
+`)}let F=Le(K().keysDir,`${h}${Mt}`);s(ar(F),{recursive:!0}),a(F,JSON.stringify({email:x}));let E=di(process.stderr);process.stderr.write(`
+Signing identity (kid): ${E.green(h)}
+`),process.stderr.write(`Expires: ${S} (${u} month${u===1?"":"s"} from today)
+`);let B={kid:h,publicKeyPem:M,email:x,expires:S};y||(process.stderr.write(`
+Key registration data:
+
+`),process.stderr.write(rr(B,E,r)));let Y=si(h,x,S,rr(B,Oe,r));process.stderr.write(`
+${E.bold("Next:")}
+`),process.stderr.write(`  1. Register your signing key \u2014 submit this pre-filled Zendesk request:
+`);let ne;if(e.copyLink?ne="clipboard":y?ne=await t.promptZendeskAction():ne=null,ne==="browser")try{await t.openUrl(Y),process.stderr.write(`     Opening in browser...
+`)}catch{process.stderr.write(`     URL: ${Y}
+`)}else if(ne==="clipboard"){let L=!1;try{await t.copyToClipboard(Y),L=!0}catch{}process.stderr.write(L&&!e.copyLink?`     Link copied to clipboard.
+`:`     URL: ${Y}
+`)}else process.stderr.write(`     URL: ${Y}
+`);process.stderr.write(`
+  2. Once your key is approved, sign your Dune app:
+`),process.stderr.write(`     ${E.cyan(`cognite sign -s ${h}`)}
+`)}i(Gc,"handleGenerate");var _i=1e3,Hc=new Set(["baseUrl","url","project","deployment","source","path","name","displayName","description"]);function Bc(e){return Object.fromEntries(Object.entries(e).map(([t,r])=>typeof r=="boolean"?[t,r]:Hc.has(t)?[t,r]:[t,"[REDACTED]"]))}i(Bc,"sanitize");function qc(e){let t=[],r=e;for(;r;)r.parent&&t.unshift(r.name()),r=r.parent;return t.join(" ")}i(qc,"getCommandPath");function ji(e){try{let t=e(process.cwd());return{appExternalId:t.externalId,appVersionTag:t.versionTag}}catch{return{}}}i(ji,"tryLoadAppConfig");function pr(e){return e.filter(t=>!t.startsWith("-")).join(" ")||"unknown"}i(pr,"commandFromArgv");function Ki(e,t,r=C){e.hook("postAction",async(n,o)=>{try{let s={command:qc(o),options:Bc(o.opts()),success:!0,...ji(r)};t.track("Flows.CLI.Command",{...s}),await t.flush(_i)}catch{}})}i(Ki,"instrument");async function Ui(e,t,r=C){try{let n={command:pr(t),options:{},success:!1,...ji(r)};e.track("Flows.CLI.Command",{...n}),await e.flush(_i)}catch{}}i(Ui,"trackFailure");var Qc="ERR_USE_AFTER_CLOSE";function Mi(e){return e instanceof Error&&"code"in e&&e.code===Qc}i(Mi,"isReadlineClosedError");function Jc(e){let t=Object.getPrototypeOf(e);return t===Object.prototype||t===null}i(Jc,"isPlainObject");function cr(e){return e==null||Mi(e)?!0:e instanceof Error?!1:!!(typeof e=="object"&&e!==null&&Jc(e)&&Object.keys(e).length===0)}i(cr,"isPromptCancel");var Vi=!1;function Gi(){Vi||(Vi=!0,process.on("uncaughtException",e=>{Mi(e)&&(console.error(`
+Cancelled.`),process.exit(130)),console.error(e),process.exit(1)}),process.on("unhandledRejection",e=>{cr(e)&&(console.error(`
+Cancelled.`),process.exit(130)),console.error(e),process.exit(1)}))}i(Gi,"installCancelHandler");import{homedir as Zc}from"os";import Hi from"mixpanel";var Yc="5c4d853e7c3b77b1eb4468d5329b278c",Ne="cognite-cli",zc=2e3,Bi={env:process.env,init:Hi.init.bind(Hi)},Wc={track:i(()=>{},"track"),flush:i(async()=>{},"flush")};function lr(e=process.env){return e.COGNITE_TELEMETRY_DISABLED==="1"||e.DO_NOT_TRACK==="1"}i(lr,"isTelemetryDisabled");function Xc(e){return e.COGNITE_TELEMETRY_DEBUG==="1"}i(Xc,"isDebug");function qi(e={}){let t=e.env??Bi.env,r=e.init??Bi.init,n=e.packageName,o=e.cliVersion,s=Xc(t);if(lr(t))return s&&process.stderr.write(`[telemetry] disabled \u2014 noop tracker
+`),Wc;let a,p=new Set;function c(){if(a)return a;try{return a=r(Yc,{geolocate:!1,keepAlive:!1}),a}catch{return}}return i(c,"getClient"),{track(d,l={}){let m=c();if(!m)return;let f={...l,applicationId:Ne,...n&&{packageName:n},...o&&{cliVersion:o},nodeVersion:process.version,platform:process.platform};s&&process.stderr.write(`[telemetry] track ${d} ${JSON.stringify(f)}
+`);let g=i(()=>{},"finish"),y=new Promise(w=>{g=w});p.add(y);try{m.track(d,f,g)}catch{g()}y.finally(()=>p.delete(y))},async flush(d=zc){if(p.size===0)return;let l,m=new Promise(f=>{l=setTimeout(f,d),l.unref?.()});try{await Promise.race([Promise.allSettled([...p]),m])}finally{l&&clearTimeout(l)}s&&process.stderr.write(`[telemetry] flush done (${p.size} still pending)
+`)}}}i(qi,"createTelemetry");var el=Zc();function _e(e,t=el){if(!t||t==="/")return e;let r=e.replaceAll(t,"~"),n=t.replaceAll("\\","/");return n!==t&&(r=r.replaceAll(n,"~")),r=r.replace(/(?<![A-Za-z0-9_])[A-Za-z]:[/\\]Users[/\\][^\s/\\]+(?=[/\\]|$)/g,"~"),r=r.replace(/(?<![A-Za-z0-9_])\/(?:Users|home)\/[^\s/]+(?=[/\\]|$)/g,"~"),r}i(_e,"redactHomedir");var tl=1e3,rl="https://0a118cb02e3be57b1838bcfb5783a2bf@o4508040730968064.ingest.de.sentry.io/4510719268290640",nl={captureError:i(async()=>{},"captureError"),flush:i(async()=>{},"flush")};function il(e){return e.packageName&&e.cliVersion?`${e.packageName}@${e.cliVersion}`:e.cliVersion??"unknown"}i(il,"buildRelease");var ol="192.0.2.0";function sl(e){return e?.map(t=>({...t,...t.filename!==void 0&&{filename:_e(t.filename)},...t.abs_path!==void 0&&{abs_path:_e(t.abs_path)},...t.module!==void 0&&{module:_e(t.module)}}))}i(sl,"scrubStackFrames");function al(e){let t={...e.user,email:void 0,username:void 0,ip_address:ol,id:void 0},r=e.exception?.values?.map(n=>({...n,value:n.value!==void 0?_e(n.value):n.value,...n.stacktrace!==void 0&&{stacktrace:{...n.stacktrace,frames:sl(n.stacktrace.frames)}}}));return{...e,message:e.message!==void 0?_e(e.message):e.message,user:t,server_name:void 0,...r!==void 0&&{exception:{...e.exception,values:r}}}}i(al,"scrubPii");function Qi(e={}){let t=e.env??process.env;if(lr(t))return nl;let r=il(e),n="production",o=null,s=null;function a(){return{dsn:rl,release:r,environment:n,defaultIntegrations:!1,integrations:[],sendDefaultPii:!1,enableLogs:!1,initialScope:{tags:{component:"cli",applicationId:Ne},contexts:{cli:{applicationId:Ne,node:process.version,platform:process.platform}}},beforeSend:al}}i(a,"buildInitOptions");async function p(){return o||(s||(s=(async()=>{try{let c=e.sdk??await import("@sentry/node");return c.init(a()),o=c,c}catch{return null}})()),s)}return i(p,"ensureSdk"),{async captureError(c,d){try{let l=await p();if(!l)return;let m={level:"fatal"};d?.command&&(m.tags={command:d.command},m.contexts={cli:{applicationId:Ne,node:process.version,platform:process.platform,command:d.command}}),l.captureException(c,m)}catch{}},async flush(c=tl){try{if(!o)return;await o.flush(c)}catch{}}}}i(Qi,"createErrorReporter");import{mkdirSync as pl,readFileSync as cl,writeFileSync as ll}from"fs";import{homedir as dl}from"os";import{resolve as gt}from"path";import{debuglog as ml}from"util";import{lt as ul,parse as Ji}from"semver";var gl="https://registry.npmjs.org/@cognite/cli/latest",fl=1500,Yi="upgrade-check.json",zi=gt(process.env.XDG_CACHE_HOME||gt(dl(),".cache"),"@cognite","cli"),dr=ml("cognite-flows");function yl(e,t){return!e||!t||!Ji(e)||!Ji(t)?!1:ul(e,t)}i(yl,"isOutdated");async function hl({timeout:e=fl,registryUrl:t=gl,fetchImpl:r=globalThis.fetch}={}){if(typeof r!="function")return null;try{let n=await r(t,{signal:AbortSignal.timeout(e)});if(!n?.ok)return null;let o=await n.json();return typeof o?.version=="string"?o.version:null}catch(n){return dr("fetchLatestVersion failed (%s): %O",t,n),null}}i(hl,"fetchLatestVersion");function Sl(e=zi,t=864e5){try{let r=cl(gt(e,Yi),"utf-8"),n=JSON.parse(r);return typeof n.latest!="string"||typeof n.fetchedAt!="number"||Date.now()-n.fetchedAt>t?null:{latest:n.latest,fetchedAt:n.fetchedAt}}catch(r){return dr("readUpgradeCheckCache failed (%s): %O",e,r),null}}i(Sl,"readUpgradeCheckCache");function wl(e,t){try{pl(e,{recursive:!0});let r={latest:t,fetchedAt:Date.now()};ll(gt(e,Yi),JSON.stringify(r))}catch(r){dr("writeUpgradeCheckCache failed (%s): %O",e,r)}}i(wl,"writeUpgradeCheckCache");async function vl({cacheDir:e=zi,...t}={}){let r=await hl(t);r&&wl(e,r)}i(vl,"startBackgroundUpgradeCheck");function Wi(e,{onOutdated:t,cacheDir:r,...n}={}){let o=Sl(r);if(o){yl(e,o.latest)&&t?.(e,o.latest);return}vl({cacheDir:r,...n})}i(Wi,"preActionUpgradeCheck");import{default as fS,chalkStderr as Xi}from"chalk";function Zi(e,t){let r=[`\u26A0  Update available: ${e} -> ${t}`,"   Run npx @cognite/cli@latest"],n=Math.max(...r.map(p=>[...p].length))+2,o="\u2500".repeat(n),s=i(p=>`\u2502 ${p}${" ".repeat(n-1-[...p].length)}\u2502`,"pad"),a=[`\u250C${o}\u2510`,...r.map(s),`\u2514${o}\u2518`].join(`
+`);return Xi.bold.yellow(a)}i(Zi,"formatUpgradeWarning");function xl(e){return e instanceof Error&&"code"in e&&typeof e.code=="string"&&e.code==="DEP0040"}i(xl,"isDep0040Warning");var ur=process,bl=ur.emit.bind(ur);ur.emit=function(e,...t){return e==="warning"&&xl(t[0])?!1:bl(e,...t)};Gi();var ke=new Cl;ke.name("cognite").description("Build and deploy React apps to Cognite Data Fusion").version("1.4.0-alpha.sdk-gen").enablePositionalOptions().showHelpAfterError().configureOutput({writeOut:i(e=>kl(1,e),"writeOut")});ke.hook("preAction",()=>{Wi("1.4.0-alpha.sdk-gen",{onOutdated:i((e,t)=>{console.warn(`
+${Zi(e,t)}
+`)},"onOutdated")})});pi(ke);Ni(ke);var to=qi({packageName:"@cognite/cli",cliVersion:"1.4.0-alpha.sdk-gen"}),eo=Qi({packageName:"@cognite/cli",cliVersion:"1.4.0-alpha.sdk-gen"});Ki(ke,to);var mr=process.argv.slice(2);ke.parseAsync(mr,{from:"user"}).catch(async e=>{await Ui(to,mr),cr(e)&&(console.error(`
+Cancelled.`),process.exit(130)),await eo.captureError(e,{command:pr(mr)}),await eo.flush(),console.error(e instanceof Error?`\u274C ${e.message}`:e),process.exit(1)});