@cognite/cli 1.5.0 → 1.6.0-alpha.sdk-gen

package/dist/cli/cli.js

@@ -1,14 +1,84 @@
 #!/usr/bin/env node
-var no=Object.defineProperty;var o=(e,t)=>no(e,"name",{value:t,configurable:!0});import{writeSync as Bp}from"fs";import{Command as Gp}from"commander";var Ke=class Ke extends Error{constructor(t,r={}){super(t),this.name="HintedError",r.cause!==void 0&&(this.cause=r.cause);let n=this.deriveDefaults(r);this.hint=r.hint??n.hint,this.helpUrl=r.helpUrl??n.helpUrl,this.shouldReport=r.shouldReport??!0}deriveDefaults(t){return{hint:ao(t.cause)}}};o(Ke,"HintedError");var D=Ke;function Nt(e){return e instanceof D}o(Nt,"isHintedError");var Lt="https://docs.cognite.com/cdf/access/",oo="https://status.cognite.com";function io(e){switch(e){case 401:return{hint:"Your credentials are invalid or expired. Check your client ID and secret.",helpUrl:Lt};case 403:return{hint:"You don't have the required CDF capabilities. Please contact your CDF admin.",helpUrl:Lt};case 413:return{hint:"The deployment exceeds the App Hosting size limit. Reduce the build output \u2014 remove unused assets, code-split bundles, or strip source maps."};case 429:return{hint:"You are being rate limited. Wait a few moments and retry. If this persists, contact CDF support."};case 500:case 502:case 503:case 504:return{hint:"CDF service error. The issue is on the server side. Check the status page and retry shortly.",helpUrl:oo};default:return{}}}o(io,"defaultHintForStatus");var je=class je extends D{constructor(t,r){super(t,r),this.name="HintedHttpError",this.httpStatusCode=r.httpStatusCode,this.requestUrl=r.requestUrl,this.responseBody=r.responseBody}deriveDefaults(t){let{httpStatusCode:r}=t,n=io(r),i=super.deriveDefaults(t);return{hint:n.hint??i.hint,helpUrl:n.helpUrl}}};o(je,"HintedHttpError");var pe=je;function Kt(e){return e instanceof pe}o(Kt,"isHintedHttpError");function so(e,t){if(e)switch(e){case"ENOTFOUND":return t.hostname?`DNS lookup failed for ${t.hostname}. Check your network, VPN, or proxy settings.`:"DNS lookup failed. Check your network, VPN, or proxy settings.";case"ECONNREFUSED":return t.hostname&&t.port?`Connection refused by ${t.hostname}:${t.port}. The service may be down or the port may be wrong.`:"Connection refused. The service may be down or the port may be wrong.";case"ECONNRESET":return"Connection was reset. The server closed the connection unexpectedly; check for proxy/firewall interference and retry.";case"ETIMEDOUT":return"Connection timed out. Check your network, VPN, or proxy settings, and retry.";case"EAI_AGAIN":return"Temporary DNS failure. Retry shortly; if it persists, check your DNS configuration.";case"CERT_HAS_EXPIRED":case"UNABLE_TO_VERIFY_LEAF_SIGNATURE":case"SELF_SIGNED_CERT_IN_CHAIN":return"TLS certificate validation failed. Check system clock and CA trust store; if you use a corporate proxy, ensure its root cert is trusted.";case"EACCES":return t.path?`Permission denied: ${t.path}. Check file ownership and permissions.`:"Permission denied. Check file ownership and permissions.";case"ENOENT":return t.path?`File or directory not found: ${t.path}.`:"File or directory not found.";case"EISDIR":return t.path?`Expected a file but found a directory: ${t.path}.`:"Expected a file but found a directory.";case"ENOSPC":return"No space left on device. Free up disk space and retry.";case"EADDRINUSE":return t.port?`Port ${t.port} is already in use. Stop the process using it or pick a different port.`:"Address is already in use. Stop the conflicting process or change the port.";case"EMFILE":case"ENFILE":return"Too many open files. Close other programs or raise the file descriptor limit.";default:return}}o(so,"hintForErrno");function ao(e){let t=e,r=new Set;for(;t!=null&&!r.has(t)&&(r.add(t),typeof t=="object");){let n=t,i=so(n.code,n);if(i!==void 0)return i;t=n.cause}}o(ao,"hintForCause");var jt="https://docs.cognite.com/cdf/access/";function L(e){return e!==null&&typeof e=="object"}o(L,"isRecord");function z(e){return e instanceof Error&&"status"in e&&typeof e.status=="number"}o(z,"isHttpError");function po(e){switch(e){case 401:return`Your credentials are invalid or expired. Check your client ID and secret.
-  See: ${jt}`;case 403:return`You don't have the required CDF capabilities. Please contact your CDF admin.
-  See: ${jt}`;default:return}}o(po,"httpStatusHint");function W(e){let t=e instanceof Error?e:new Error(String(e));if(!z(t))return null;let r=po(t.status);return r?Object.assign(new Error(`${t.message}
-  ${r}`),{cause:t}):null}o(W,"enrichedHttpError");function co(e){if(!L(e))return null;let t=e.missing;if(Array.isArray(t))return t;let r=e.data;if(L(r)){let n=r.error;if(L(n)&&Array.isArray(n.missing))return n.missing;if(Array.isArray(r.missing))return r.missing}return null}o(co,"findMissingArray");function lo(e,t){if(!z(e)||e.status!==400)return!1;let r=co(e);return r?r.some(n=>L(n)&&typeof n.externalId=="string"&&t.includes(n.externalId)):!1}o(lo,"isMissingExternalIdError");function Me(e,t){return z(e)&&e.status===404||lo(e,t)}o(Me,"isNotFoundError");var Ht=["DRAFT","PUBLISHED","DEPRECATED","ARCHIVED"],Vt=["ACTIVE","PREVIEW"],He=class He extends Error{constructor(t,r){super(`Version ${r} of app ${t} not found`),this.name="AppVersionNotFoundError",this.appExternalId=t,this.version=r}};o(He,"AppVersionNotFoundError");var j=He;function Se(e,t){return e.includes(t)}o(Se,"includesValue");function mo(e){return Se(Ht,e)}o(mo,"isAppVersionLifecycleState");function uo(e){return Se(Vt,e)}o(uo,"isAppVersionAlias");function go(e){return typeof e.version=="string"&&mo(e.lifecycleState)&&typeof e.entrypoint=="string"&&typeof e.createdTime=="number"&&typeof e.createdBy=="string"&&typeof e.appExternalId=="string"&&(e.alias===void 0||uo(e.alias))&&(e.comment===void 0||typeof e.comment=="string")}o(go,"isAppVersion");function Mt(e){if(!L(e))throw new Error("Invalid version response: not an object");if(!go(e))throw new Error("Invalid version response: missing or malformed fields");return e}o(Mt,"parseAppVersion");var Ve=class Ve{constructor(t){this.client=t}get appsBasePath(){return`/api/v1/projects/${encodeURIComponent(this.client.project)}/apphosting/apps`}async createApp(t,r,n){try{await this.client.post(this.appsBasePath,{data:{items:[{externalId:t,name:r,description:n}]}})}catch(i){throw W(i)??i}}async uploadVersion(t,r,n,i,s="index.html"){console.log(`\u{1F4E4} Uploading version ${r}...`);let a=new FormData;a.append("file",new Blob([new Uint8Array(n)]),i),a.append("version",r),a.append("entryPath",s);let p=encodeURIComponent(t),c=`${this.appsBasePath}/${p}/versions`,l=await this.client.authenticate(),d=`${this.client.getBaseUrl()}${c}`,m=new AbortController,y=setTimeout(()=>m.abort(),300*1e3),g;try{g=await fetch(d,{method:"POST",headers:{Authorization:`Bearer ${l}`},body:a,signal:m.signal})}catch(u){throw u instanceof Error&&u.name==="AbortError"?new Error("Upload timed out after 5 minutes"):u}finally{clearTimeout(y)}if(!g.ok){let u=await g.text(),S;try{S=JSON.parse(u)}catch{}let h=u;if(L(S)){let U=S.error;if(typeof U=="string")h=U;else if(L(U)){let x=U.message,M=U.code;h=typeof x=="string"?x:M!=null?`Unknown error (code: ${M})`:u}else{let x=S.message;h=typeof x=="string"?x:u}}let k=g.headers.get("x-request-id"),f=k?` | X-Request-ID: ${k}`:"";throw new pe(`Upload failed: ${g.status} \u2014 ${h}${f}`,{httpStatusCode:g.status,requestUrl:d,responseBody:L(S)?S:u})}console.log(`\u2705 Version ${r} uploaded`)}async getVersion(t,r){let n=encodeURIComponent(t),i=encodeURIComponent(r),s=`${this.appsBasePath}/${n}/versions/${i}`;try{let a=await this.client.get(s);return Mt(a.data)}catch(a){throw Me(a,[t,r])?new j(t,r):W(a)??a}}async getActiveVersion(t){let r=encodeURIComponent(t),n=`${this.appsBasePath}/${r}/active`;try{let i=await this.client.get(n);return Mt(i.data)}catch(i){if(Me(i,[t]))return null;throw W(i)??i}}async updateVersions(t,r){let n=encodeURIComponent(t),i=`${this.appsBasePath}/${n}/versions/update`;try{await this.client.post(i,{data:{items:r}})}catch(s){throw W(s)??s}}async submitSignatures(t,r,n){let i=encodeURIComponent(t),s=encodeURIComponent(r),a=`${this.appsBasePath}/${i}/versions/${s}/signatures`;try{await this.client.post(a,{data:{items:n}})}catch(p){throw W(p)??p}}async listSignatures(t,r){let n=encodeURIComponent(t),i=encodeURIComponent(r),s=`${this.appsBasePath}/${n}/versions/${i}/signatures/list`;try{let a=await this.client.post(s,{data:{}});return ho(a.data)}catch(a){throw W(a)??a}}};o(Ve,"AppHostingApi");var we=Ve,fo=["VALID","REVOKED","EXPIRED","SIGNED_BEFORE_KEY_ISSUED","IAT_IN_FUTURE","BUNDLE_TOO_OLD","KEY_NOT_IN_REGISTRY"],yo=["developer","certifier"];function ho(e){if(!L(e))throw new Error("Invalid signatures response: expected an object with an items array");let{items:t}=e;if(!Array.isArray(t))throw new Error("Invalid signatures response: items property is missing or not an array");return t.flatMap(r=>{let n=So(r);return n?[n]:[]})}o(ho,"parseStoredSignatures");function So(e){if(!L(e))return null;let{signerKid:t,signerRole:r,signatureIat:n,receivedAt:i,createdTime:s,status:a}=e;return typeof t!="string"||t===""||!Se(yo,r)||typeof n!="number"||typeof i!="number"||typeof s!="number"||!Se(fo,a)?null:{signerKid:t,signerRole:r,signatureIat:n,receivedAt:i,createdTime:s,status:a}}o(So,"parseStoredSignature");var Be=class Be{constructor(t){this.api=new we(t)}getVersion(t,r){return this.api.getVersion(t,r)}uploadVersion(t,r,n,i,s){return this.api.uploadVersion(t,r,n,i,s)}async ensureApp(t,r,n){console.log("\u{1F50D} Ensuring app exists...");try{await this.api.createApp(t,r,n),console.log(`\u2705 App '${t}' created`)}catch(i){if(z(i)&&i.status===409){console.log(`\u2705 App '${t}' already exists`);return}throw i}}async submitSignatures(t,r,n){n.length!==0&&(console.log(`\u{1F50F} Submitting ${n.length} signature${n.length===1?"":"s"} for version ${r}...`),await this.api.submitSignatures(t,r,n),console.log("\u2705 Signatures stored"))}listSignatures(t,r){return this.api.listSignatures(t,r)}async publishVersion(t,r){await this.api.updateVersions(t,[{version:r,update:{lifecycleState:{set:"PUBLISHED"}}}])}async publishAndActivate(t,r){console.log(`\u{1F680} Publishing and activating version ${r}...`),await this.api.updateVersions(t,[{version:r,update:{lifecycleState:{set:"PUBLISHED"},alias:{set:"ACTIVE"}}}]),console.log(`\u2705 Version ${r} is now PUBLISHED and ACTIVE`)}getActiveVersion(t){return this.api.getActiveVersion(t)}async deactivateVersion(t,r){await this.api.updateVersions(t,[{version:r,update:{alias:{setNull:!0}}}])}async activateVersion(t,r){let n=null;try{n=await this.api.getActiveVersion(t)}catch{n=null}let i=n&&n.version!==r?n.version:void 0;return await this.api.updateVersions(t,[{version:r,update:{alias:{set:"ACTIVE"}}}]),{supersededVersion:i}}async deploy(t,r,n,i,s,a,p=!1){console.log(`
-\u{1F680} Deploying application via App Hosting API...
-`);try{await this.ensureApp(t,r,n),await this.uploadVersion(t,i,s,a),p&&await this.publishAndActivate(t,i),console.log(`
-\u2705 Deployment successful!`)}catch(c){let l=c instanceof Error?c.message:String(c);throw Object.assign(new Error(`Deployment failed: ${l}`),{cause:c})}}};o(Be,"AppHostingClient");var E=Be;import{existsSync as Do,readFileSync as Io}from"fs";import{resolve as $o}from"path";import{array as Yt,boolean as wo,check as Bt,forward as Gt,literal as vo,maxLength as Co,minLength as Eo,nonEmpty as X,object as qt,optional as G,picklist as ko,pipe as V,safeParse as Po,string as N,url as bo}from"valibot";var Ge=V(N(),X("must not be empty")),Ye=V(N(),X("must not be empty"),Co(256,"must be 256 characters or fewer")),qe=V(N(),X("must not be empty"),bo("must be a valid URL")),Je=V(N(),X("must not be empty")),ze=V(N(),X("must not be empty")),xo=V(qt({org:Je,project:ze,baseUrl:qe,deployClientId:G(N(),""),deploySecretName:G(N(),""),published:G(wo(),!1),idpType:G(ko(["cdf","entra_id"]),"cdf"),tenantId:G(N()),scopes:G(Yt(V(N(),X("must not be empty"))))}),Gt(Bt(e=>e.idpType!=="entra_id"||!!e.tenantId,'must be set when idpType is "entra_id"'),["tenantId"]),Gt(Bt(e=>!e.deployClientId||!!e.deploySecretName,"must be set when deployClientId is set"),["deploySecretName"])),Ao=qt({name:Ge,externalId:Ye,versionTag:V(N(),X("must not be empty")),description:G(N(),""),deployments:V(Yt(xo),Eo(1,"must contain at least one deployment")),infra:G(vo("appsApi"))});function We(e){let t=Po(Ao,e);if(t.success)return t.output;let r=t.issues[0],n=r.path?.map(s=>s.key).join(".")??"",i=n?`"${n}" `:"";throw new Error(`app.json: ${i}${r.message}`)}o(We,"validateAppConfig");function v(e,t={}){let{validator:r=We,existsSync:n=Do,readFileSync:i=Io}=t,s=$o(e,"app.json");if(!n(s))throw new Error(`No app.json found at ${s}. Make sure you're running this command from your app's root directory.`);let a=i(s,"utf-8"),p;try{p=JSON.parse(a)}catch{throw new Error("Failed to parse app.json \u2014 check that it contains valid JSON.")}return r(p)}o(v,"loadAppConfig");import{CogniteClient as ii}from"@cognite/sdk";import{CogniteClient as Ko}from"@cognite/sdk";function Ro(e){return Math.floor(Math.random()*Math.min(2**e*250,15e3))}o(Ro,"exponentialBackoffWithJitter");function To(e){return new Promise(t=>setTimeout(t,e))}o(To,"sleep");async function Xe(e,t={}){let r=t.maxAttempts??5,n=t.shouldRetry??(()=>!0),i=t.delayInMsCalculator??Ro;if(r<1)throw new Error("`maxAttempts` must be 1 or greater");if(r>100)throw new Error("`maxAttempts` must be 100 or less");let s=1;for(;;)try{return await e()}catch(a){if(s>=r||!n(a))throw a;let p=i(s);t.onAttemptFail?.(a,s,p),await To(p),s++}}o(Xe,"retryAsync");var Fo=o(()=>{let e=process.env.DEPLOYMENT_SECRETS;if(!e)return{};try{let t=JSON.parse(e),r={};for(let[n,i]of Object.entries(t))if(typeof i=="string"){let s=n.toLowerCase().replace(/_/g,"-");r[s]=i}return r}catch(t){return console.error("Error parsing DEPLOYMENT_SECRETS:",t),{}}},"loadSecretsFromEnv"),Oo=o(e=>{let t;if(process.env.DEPLOYMENT_SECRET&&(t=process.env.DEPLOYMENT_SECRET),t||(t=Fo()[e]),t||(t=process.env[e]),!t)throw new Error(`Secret not found in environment: ${e}`);return t},"getSecretFromEnv"),_o=o(e=>{if(!e)return"";try{return new URL(e).hostname.replace(/\.cognitedata\.com$/,"")}catch{let t=e.replace(/^https?:\/\//,"");return t=t.split("/")[0],t=t.split(":")[0],t=t.replace(/\.cognitedata\.com$/,""),t}},"extractClusterFromUrl"),Uo=o(async(e,t)=>{let r=`Basic ${btoa(`${e}:${t}`)}`,n="https://auth.cognite.com/oauth2/token",i={grant_type:"client_credentials"},s;try{s=await Xe(()=>fetch(n,{method:"POST",headers:{Authorization:r,"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(i)}),{maxAttempts:3})}catch(p){throw new D(`Failed to fetch access token from ${n}`,{cause:p})}if(!s.ok){let p=await s.text();throw new Error(`Failed to get token from CDF: ${s.status} ${s.statusText}
-${p}`)}let a=await s.json();if(!a.access_token)throw new Error("No access token returned from CDF authentication");return a.access_token},"getTokenCdf"),Lo=o((e,t)=>{if(t!==void 0)return t.join(" ");if(!e)throw new Error("Entra ID authentication requires 'baseUrl' to be set in deployment configuration");let r=_o(e);if(!r)throw new Error(`Entra ID authentication requires 'baseUrl' to be a valid CDF URL (e.g., https://cluster.cognitedata.com), got: ${e}`);return`https://${r}.cognitedata.com/.default`},"resolveEntraScope"),No=o(async(e,t,r,n,i)=>{let s=`https://login.microsoftonline.com/${r}/oauth2/v2.0/token`,a=Lo(n,i),p;try{p=await Xe(()=>fetch(s,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:e,client_secret:t,grant_type:"client_credentials",...a?{scope:a}:{}})}),{maxAttempts:3})}catch(l){throw new D(`Failed to fetch access token from ${s}`,{cause:l})}if(!p.ok){let l=await p.text();throw new Error(`Failed to get token from Entra ID: ${p.status} ${p.statusText}
-${l}`)}let c=await p.json();if(!c.access_token)throw new Error("No access token returned from Entra ID authentication");return c.access_token},"getTokenEntra"),Ze=o(async(e,t=process.env)=>{if(t.COGNITE_TOKEN)return t.COGNITE_TOKEN;let{deployClientId:r,deploySecretName:n,idpType:i="cdf",tenantId:s,baseUrl:a,scopes:p}=e,c=Oo(n);if(i==="entra_id"){if(!s)throw new Error("Entra ID authentication requires 'tenantId' in deployment configuration");return No(r,c,s,a,p)}return Uo(r,c)},"getToken");async function ce(e,t,r=process.env,n){let i=await Ze(e,r),s=r.COGNITE_BASE_URL??e.baseUrl,a=(n??(p=>new Ko(p)))({appId:t,project:e.project,baseUrl:s,oidcTokenProvider:o(async()=>i,"oidcTokenProvider")});return await a.authenticate(),a}o(ce,"getSdk");import qo from"os";import Jo from"path";import zo from"open";import{buildAuthorizationUrl as Wo,calculatePKCECodeChallenge as Xo,discovery as Zo,None as Qo,randomPKCECodeVerifier as ei,randomState as ti}from"openid-client";import jo from"https";import{authorizationCodeGrant as Mo}from"openid-client";function Jt(e){return e.replace(/[&<>"']/g,t=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[t]??t)}o(Jt,"escapeHtml");function Qe(e,t,r){let n=Jt(t),i=Jt(r);return`<html><body style="font-family: system-ui; padding: 40px; text-align: center;">
-    <h1>${n}</h1><p>${i}</p><p>You can close this window.</p>${e==="success"?`<style>
+var hs=Object.defineProperty;var Wr=e=>{throw TypeError(e)};var i=(e,t)=>hs(e,"name",{value:t,configurable:!0});var Xr=(e,t,r)=>t.has(e)||Wr("Cannot "+r);var Zr=(e,t,r)=>(Xr(e,t,"read from private field"),r?r.call(e):t.get(e)),en=(e,t,r)=>t.has(e)?Wr("Cannot add the same private member more than once"):t instanceof WeakSet?t.add(e):t.set(e,r),tn=(e,t,r,n)=>(Xr(e,t,"write to private field"),n?n.call(e,r):t.set(e,r),r);import{writeSync as Qm}from"fs";import{Command as Jm}from"commander";var Lt=class Lt extends Error{constructor(t,r={}){super(t),this.name="HintedError",r.cause!==void 0&&(this.cause=r.cause);let n=this.deriveDefaults(r);this.hint=r.hint??n.hint,this.helpUrl=r.helpUrl??n.helpUrl,this.shouldReport=r.shouldReport??!0}deriveDefaults(t){return{hint:ks(t.cause)}}};i(Lt,"HintedError");var y=Lt;function nn(e){return e instanceof y}i(nn,"isHintedError");var rn="https://docs.cognite.com/cdf/access/",Ss="https://status.cognite.com";function ws(e){switch(e){case 401:return{hint:"Your credentials are invalid or expired. Check your client ID and secret.",helpUrl:rn};case 403:return{hint:"You don't have the required CDF capabilities. Please contact your CDF admin.",helpUrl:rn};case 413:return{hint:"The deployment exceeds the App Hosting size limit. Reduce the build output \u2014 remove unused assets, code-split bundles, or strip source maps."};case 429:return{hint:"You are being rate limited. Wait a few moments and retry. If this persists, contact CDF support."};case 500:case 502:case 503:case 504:return{hint:"CDF service error. The issue is on the server side. Check the status page and retry shortly.",helpUrl:Ss};default:return{}}}i(ws,"defaultHintForStatus");var Nt=class Nt extends y{constructor(t,r){super(t,r),this.name="HintedHttpError",this.httpStatusCode=r.httpStatusCode,this.requestUrl=r.requestUrl,this.responseBody=r.responseBody}deriveDefaults(t){let{httpStatusCode:r}=t,n=ws(r),o=super.deriveDefaults(t);return{hint:n.hint??o.hint,helpUrl:n.helpUrl}}};i(Nt,"HintedHttpError");var le=Nt;function on(e){return e instanceof le}i(on,"isHintedHttpError");function vs(e,t){if(e)switch(e){case"ENOTFOUND":return t.hostname?`DNS lookup failed for ${t.hostname}. Check your network, VPN, or proxy settings.`:"DNS lookup failed. Check your network, VPN, or proxy settings.";case"ECONNREFUSED":return t.hostname&&t.port?`Connection refused by ${t.hostname}:${t.port}. The service may be down or the port may be wrong.`:"Connection refused. The service may be down or the port may be wrong.";case"ECONNRESET":return"Connection was reset. The server closed the connection unexpectedly; check for proxy/firewall interference and retry.";case"ETIMEDOUT":return"Connection timed out. Check your network, VPN, or proxy settings, and retry.";case"EAI_AGAIN":return"Temporary DNS failure. Retry shortly; if it persists, check your DNS configuration.";case"CERT_HAS_EXPIRED":case"UNABLE_TO_VERIFY_LEAF_SIGNATURE":case"SELF_SIGNED_CERT_IN_CHAIN":return"TLS certificate validation failed. Check system clock and CA trust store; if you use a corporate proxy, ensure its root cert is trusted.";case"EACCES":return t.path?`Permission denied: ${t.path}. Check file ownership and permissions.`:"Permission denied. Check file ownership and permissions.";case"ENOENT":return t.path?`File or directory not found: ${t.path}.`:"File or directory not found.";case"EISDIR":return t.path?`Expected a file but found a directory: ${t.path}.`:"Expected a file but found a directory.";case"ENOSPC":return"No space left on device. Free up disk space and retry.";case"EADDRINUSE":return t.port?`Port ${t.port} is already in use. Stop the process using it or pick a different port.`:"Address is already in use. Stop the conflicting process or change the port.";case"EMFILE":case"ENFILE":return"Too many open files. Close other programs or raise the file descriptor limit.";default:return}}i(vs,"hintForErrno");function ks(e){let t=e,r=new Set;for(;t!=null&&!r.has(t)&&(r.add(t),typeof t=="object");){let n=t,o=vs(n.code,n);if(o!==void 0)return o;t=n.cause}}i(ks,"hintForCause");import{existsSync as Up,readFileSync as Mp,writeFileSync as Vp}from"fs";import{resolve as or}from"path";import{fileURLToPath as jp}from"url";import{CogniteClient as Kp}from"@cognite/sdk";import ar from"enquirer";import{mkdirSync as ha,rmSync as Sa,writeFileSync as Oe}from"fs";import{resolve as z}from"path";import{generate as Un}from"@graphql-codegen/cli";import{GraphQLSchema as na,GraphQLObjectType as ia,GraphQLNonNull as G,GraphQLList as Ee,GraphQLString as ue,GraphQLInt as oa,GraphQLInputObjectType as $n,printSchema as sa}from"graphql";function Ye(e){return{space:e.space,externalId:e.externalId,version:e.version}}i(Ye,"toSharedViewId");function Cs(e){switch(e){case"text":return"String";case"boolean":return"Boolean";case"int32":case"int64":return"Int";case"float32":case"float64":return"Float";case"timestamp":return"DateTime";case"date":return"Date";case"json":return"JSON";case"timeseries":return"CogniteTimeSeriesReference";case"file":return"CogniteFileReference";case"sequence":return"CogniteSequenceReference";case"enum":return"String";default:return"String"}}i(Cs,"dmsTypeToGraphQL");function sn(e){if(!("source"in e)){if(e.type?.type==="direct")return e.type.list?e.type.source?{kind:"directRelationList",targetView:Ye(e.type.source)}:{kind:"scalar",isList:!1,graphqlType:"JSON"}:e.type.source?{kind:"directRelation",targetView:Ye(e.type.source)}:{kind:"scalar",isList:!1,graphqlType:"JSON"};if(e.type?.type==="enum"){let t=e.type,r={};if(typeof t=="object"&&t!==null&&"values"in t){let n=t.values;if(typeof n=="object"&&n!==null)for(let[o,s]of Object.entries(n))r[o]={name:typeof s=="object"&&s!==null&&"name"in s?String(s.name):void 0}}return{kind:"enum",values:Object.keys(r),valueNames:Object.fromEntries(Object.entries(r).map(([n,o])=>[n,o.name??n]))}}return{kind:"scalar",isList:e.type!==void 0&&"list"in e.type&&e.type.list===!0,graphqlType:e.type?.type?Cs(e.type.type):"String"}}if("through"in e)return{kind:e.connectionType==="single_reverse_direct_relation"?"reverseDirect":"reverseList",sourceView:Ye(e.source),throughProperty:e.through.identifier};if(e.connectionType==="single_edge_connection"||e.connectionType==="multi_edge_connection"){let t=e.direction==="inwards"?"inwards":"outwards";return{kind:"edge",targetView:Ye(e.source),direction:t}}return{kind:"scalar"}}i(sn,"parsePropertyDescriptor");var an=new Set(["String","Boolean","Int","Float","DateTime","Date"]);var xs=new Set(["String","Int","Float","DateTime","Date"]);function ze(e){return e.kind==="directRelation"||e.kind==="enum"?!0:e.kind!=="scalar"||e.isList===!0?!1:an.has(e.graphqlType??"String")}i(ze,"isFilterableDescriptor");function We(e){return e.kind==="enum"?!0:e.kind!=="scalar"||e.isList===!0?!1:an.has(e.graphqlType??"String")}i(We,"isSortableDescriptor");function pn(e){return e.kind==="directRelation"||e.kind==="enum"?!0:e.kind==="scalar"&&e.isList!==!0&&xs.has(e.graphqlType??"")}i(pn,"hasInOpDescriptor");function cn(e){return e.kind==="scalar"&&e.isList===!0}i(cn,"hasListOpsDescriptor");var dn=/^[A-Za-z_][A-Za-z0-9_]*$/;function mn(e){return dn.test(e)}i(mn,"isSafeExternalId");function _t(e,t){if(!mn(e))throw new Error(`Unsafe externalId for ${t}: "${e}" \u2014 must match ${dn}. externalIds are interpolated into file paths and emitted TypeScript source and must contain only ASCII letters, digits, and underscore (and not start with a digit).`)}i(_t,"assertSafeExternalId");var ln=/^[a-z][a-z0-9_-]*$/;function de(e){if(!ln.test(e))throw new Error(`Unsafe SDK name: "${e}" \u2014 must match ${ln}. SDK names become folders under src/generated_sdks/ and must contain only lowercase ASCII letters, digits, hyphen, and underscore.`)}i(de,"assertSafeSdkName");function we(e){return e.usedFor!=="edge"}i(we,"isNodeOrAll");function ve(e){return{query:`query${e}`,getById:`get${e}ById`,count:`count${e}`,search:`search${e}`,aggregate:`aggregate${e}`}}i(ve,"viewOperationNames");function un(e){let t=new Set;return e.filter(r=>t.has(r.externalId)?!1:(t.add(r.externalId),!0))}i(un,"dedupeByExternalId");function V(e){return Object.entries(e.properties).map(([t,r])=>[t,sn(r),r.description])}i(V,"parsedProperties");function gn(e){return e.map(t=>({...t,properties:Object.fromEntries(Object.entries(t.properties).map(([r,n])=>[r,Es(n)]))}))}i(gn,"viewsForGeneratedFile");function Es(e){if("source"in e)return e;let{type:t}=e;if(!t||t.type!=="enum")return e;let{list:r,maxListSize:n,...o}=t;return{...e,type:o}}i(Es,"stripDeprecatedEnumList");import{GraphQLObjectType as fn,GraphQLNonNull as Te,GraphQLString as Mt,GraphQLFloat as tt,GraphQLList as Rs,GraphQLEnumType as Ts}from"graphql";import{GraphQLScalarType as ne,Kind as O}from"graphql";function Xe(e){switch(e.kind){case O.STRING:case O.BOOLEAN:return e.value;case O.INT:return parseInt(e.value,10);case O.FLOAT:return parseFloat(e.value);case O.OBJECT:{let t={};for(let r of e.fields)t[r.name.value]=Xe(r.value);return t}case O.LIST:return e.values.map(Xe);case O.NULL:return null;default:return null}}i(Xe,"parseLiteralJSON");var bs=new ne({name:"DateTime",serialize:i(e=>e,"serialize"),parseValue:i(e=>e,"parseValue"),parseLiteral:i(e=>e.kind===O.STRING?e.value:null,"parseLiteral")}),Ps=new ne({name:"Date",serialize:i(e=>e,"serialize"),parseValue:i(e=>e,"parseValue"),parseLiteral:i(e=>e.kind===O.STRING?e.value:null,"parseLiteral")}),Ut=new ne({name:"JSON",serialize:i(e=>e,"serialize"),parseValue:i(e=>e,"parseValue"),parseLiteral:Xe}),As=new ne({name:"CogniteTimeSeriesReference",serialize:i(e=>e,"serialize"),parseValue:i(e=>e,"parseValue"),parseLiteral:i(e=>e.kind===O.STRING?e.value:null,"parseLiteral")}),Is=new ne({name:"CogniteFileReference",serialize:i(e=>e,"serialize"),parseValue:i(e=>e,"parseValue"),parseLiteral:i(e=>e.kind===O.STRING?e.value:null,"parseLiteral")}),Ds=new ne({name:"CogniteSequenceReference",serialize:i(e=>e,"serialize"),parseValue:i(e=>e,"parseValue"),parseLiteral:i(e=>e.kind===O.STRING?e.value:null,"parseLiteral")}),Ze=new ne({name:"ListLimit",description:"Limit for list/search queries (1\u20131000).",serialize:i(e=>e,"serialize"),parseValue:i(e=>e,"parseValue"),parseLiteral:i(e=>e.kind===O.INT?parseInt(e.value,10):null,"parseLiteral")}),$s=new ne({name:"DirectRelationList",description:"A list of direct-relation node references ({ space, externalId }).",serialize:i(e=>e,"serialize"),parseValue:i(e=>e,"parseValue"),parseLiteral:Xe}),ie={DateTime:bs,Date:Ps,JSON:Ut,CogniteTimeSeriesReference:As,CogniteFileReference:Is,CogniteSequenceReference:Ds,ListLimit:Ze,DirectRelationList:$s},et={DateTime:"string",Date:"string",JSON:"unknown",CogniteTimeSeriesReference:"string",CogniteFileReference:"string",CogniteSequenceReference:"string",ListLimit:"number",DirectRelationList:"Array<{ space: string; externalId: string }>"};var Fs=new Ts({name:"AggregateFunction",values:{count:{value:"count"},avg:{value:"avg"},sum:{value:"sum"},min:{value:"min"},max:{value:"max"},histogram:{value:"histogram"}}}),yn={function:{type:new Te(Fs)},property:{type:Mt},interval:{type:tt}},Os=new fn({name:"HistogramBucket",fields:{start:{type:new Te(tt)},count:{type:new Te(tt)}}}),hn=new fn({name:"AggregateResult",fields:{aggregate:{type:new Te(Mt)},property:{type:Mt},value:{type:tt},buckets:{type:new Rs(new Te(Os))},group:{type:Ut}}});import{GraphQLObjectType as jt,GraphQLNonNull as ke,GraphQLList as Ls,GraphQLString as Vt,GraphQLBoolean as Ns}from"graphql";var _s=new jt({name:"PageInfo",fields:{endCursor:{type:Vt},hasNextPage:{type:new ke(Ns)}}}),rt=new jt({name:"NodeReference",fields:{space:{type:new ke(Vt)},externalId:{type:new ke(Vt)}}});function nt(e,t){return new jt({name:`${e}Connection`,fields:{items:{type:new ke(new Ls(new ke(t)))},pageInfo:{type:new ke(_s)}}})}i(nt,"makeConnectionType");import{GraphQLInputObjectType as Ce,GraphQLList as N,GraphQLNonNull as xn,GraphQLString as me,GraphQLBoolean as L,GraphQLFloat as Gs,GraphQLInt as Bs}from"graphql";import{GraphQLObjectType as Us,GraphQLNonNull as Sn,GraphQLList as Ms,GraphQLString as it,GraphQLBoolean as Vs,GraphQLInt as vn,GraphQLFloat as js,GraphQLEnumType as Ks}from"graphql";function wn(e){return e==="String"?it:e==="Boolean"?Vs:e==="Int"?vn:e==="Float"?js:ie[e]??it}i(wn,"scalarForName");function kn(e){return{typeRegistry:new Map,connectionRegistry:new Map,viewsByExtId:new Map(e.map(t=>[t.externalId,t])),enumRegistry:new Map,enumFilterRegistry:new Map}}i(kn,"createTypeContext");function Hs(e){let t=e.replace(/[^_A-Za-z0-9]/g,"_");return/^[0-9]/.test(t)&&(t=`_${t}`),t||"_UNKNOWN"}i(Hs,"sanitizeEnumValue");function Kt(e,t,r,n){let o=r.enumRegistry.get(e);if(o)return o;let s=new Ks({name:e,values:Object.fromEntries(t.map(a=>[Hs(a),{value:a,description:n?.[a]}]))});return r.enumRegistry.set(e,s),s}i(Kt,"getOrCreateEnumType");function Cn(e,t){return new Us({name:e.externalId,description:e.description??e.name,fields:i(()=>{let r={space:{type:new Sn(it)},externalId:{type:new Sn(it)}};for(let[n,o,s]of V(e))if(o.kind==="scalar")o.isList?r[n]={type:new Ms(wn(o.graphqlType??"String")),description:s}:r[n]={type:wn(o.graphqlType??"String"),description:s};else if(o.kind==="enum"){let a=`${e.externalId}${n.charAt(0).toUpperCase()}${n.slice(1)}`;r[n]={type:Kt(a,o.values,t,o.valueNames),description:s}}else if(o.kind==="directRelation"){let a=t.typeRegistry.get(o.targetView.externalId)??rt;r[n]={type:a,description:s}}else if(o.kind==="directRelationList")r[n]={type:ie.DirectRelationList,description:s};else if(o.kind==="reverseList"||o.kind==="edge"){let a=o.kind==="reverseList"?o.sourceView.externalId:o.targetView.externalId,p=t.typeRegistry.get(a)??rt,c=t.connectionRegistry.get(a);c||(c=nt(a,p),t.connectionRegistry.set(a,c)),r[n]={type:c,description:s,args:{limit:{type:vn}}}}else if(o.kind==="reverseDirect"){let a=t.typeRegistry.get(o.sourceView.externalId)??rt;r[n]={type:a,description:s}}return r},"fields")})}i(Cn,"generateViewObjectType");function xe(e,t,r){let n={isNull:{type:L},exists:{type:L},eq:{type:t}};return r.hasIn&&(n.in={type:new N(t)}),r.hasPrefix&&(n.prefix={type:me}),r.hasRange&&(n.gte={type:t},n.gt={type:t},n.lte={type:t},n.lt={type:t}),r.hasListOps&&(n.containsAny={type:new N(t)},n.containsAll={type:new N(t)},n.overlaps={type:new N(t)}),new Ce({name:e,fields:n})}i(xe,"makeScalarFilter");var Ht=xe("StringFilter",me,{hasIn:!0,hasPrefix:!0}),qs=xe("BooleanFilter",L,{}),Qs=xe("IntFilter",Bs,{hasIn:!0,hasRange:!0}),Js=xe("FloatFilter",Gs,{hasIn:!0,hasRange:!0}),Ys=xe("DateTimeFilter",ie.DateTime,{hasIn:!0,hasRange:!0}),zs=xe("DateFilter",ie.Date,{hasIn:!0,hasRange:!0}),Ws=new Ce({name:"StringListFilter",fields:{isNull:{type:L},exists:{type:L},containsAny:{type:new N(me)},containsAll:{type:new N(me)},overlaps:{type:new N(me)}}}),Fe=new Ce({name:"DirectRelationRef",fields:{space:{type:new xn(me)},externalId:{type:new xn(me)}}}),Xs=new Ce({name:"DirectRelationFilter",fields:{isNull:{type:L},exists:{type:L},eq:{type:Fe},in:{type:new N(Fe)}}});function Zs(e){switch(e){case"String":return Ht;case"Boolean":return qs;case"Int":return Qs;case"Float":return Js;case"DateTime":return Ys;case"Date":return zs;default:return Ht}}i(Zs,"scalarFilterForName");var En=["space","externalId"];function bn(e,t,r){let n=t.get(e.externalId),o={};for(let a of En)o[a]={type:Ht};let s=new Set(En);for(let[a,p]of V(e)){if(s.has(a))continue;let c=ze(p),l=cn(p);if(!(!c&&!l))if(p.kind==="directRelation"){let m={isNull:{type:L},exists:{type:L},eq:{type:Fe},in:{type:new N(Fe)}};pn(p)&&(m.in={type:new N(Fe)});let d=t.get(p.targetView.externalId);d&&(m.nested={type:d}),o[a]=d?{type:new Ce({name:`_${e.externalId}_${a}_Filter`,fields:m})}:{type:Xs}}else if(p.kind==="enum"){let m=`${e.externalId}${a.charAt(0).toUpperCase()}${a.slice(1)}`,d=Kt(m,p.values,r),u=r.enumFilterRegistry.get(m);u||(u=new Ce({name:`${m}Filter`,fields:{isNull:{type:L},exists:{type:L},eq:{type:d},in:{type:new N(d)}}}),r.enumFilterRegistry.set(m,u)),o[a]={type:u}}else if(l)o[a]={type:Ws};else{let m=p.kind==="scalar"?p.graphqlType??"String":"String",d=Zs(m);d&&(o[a]={type:d})}}return{...o,hasData:{type:L},matchAll:{type:L},_and:{type:new N(n)},_or:{type:new N(n)},_not:{type:n}}}i(bn,"generateFilterFields");import{GraphQLEnumType as Pn,GraphQLInputObjectType as An,GraphQLList as ea,GraphQLNonNull as ot,GraphQLString as ta,GraphQLBoolean as ra}from"graphql";var st=new Pn({name:"SortDirection",values:{ASC:{value:"ascending"},DESC:{value:"descending"}}});function In(e){let t=[];for(let[n,o]of V(e))We(o)&&t.push(n);if(t.length===0)return null;let r=new Pn({name:`${e.externalId}SortField`,values:Object.fromEntries(t.map(n=>[n,{value:n}]))});return new An({name:`${e.externalId}Sort`,fields:{field:{type:new ot(r)},direction:{type:new ot(st)},nullsFirst:{type:ra}}})}i(In,"generateSortInput");var Dn=new An({name:"SearchSort",fields:{property:{type:new ot(new ea(new ot(ta)))},direction:{type:st}}});function Rn(e){let t=e.filter(we),r=kn(t);for(let d of t){let u=Cn(d,r);r.typeRegistry.set(d.externalId,u)}let n=new Map;for(let d of t){let u=new $n({name:`${d.externalId}Filter`,fields:i(()=>bn(d,n,r),"fields")});n.set(d.externalId,u)}let o={};for(let d of t){let u=d.externalId,f=ve(u),g=r.typeRegistry.get(u),h=r.connectionRegistry.get(u);h||(h=nt(u,g),r.connectionRegistry.set(u,h));let w=n.get(u),C=In(d),S={limit:{type:Ze},cursor:{type:ue},filter:{type:w}};C&&(S.sort={type:new Ee(C)}),o[f.query]={type:new G(h),args:S},o[f.getById]={type:g,args:{space:{type:new G(ue)},externalId:{type:new G(ue)}}},o[f.count]={type:new G(oa),args:{filter:{type:w}}},o[f.search]={type:new G(h),args:{query:{type:ue},limit:{type:Ze},filter:{type:w},sort:{type:new Ee(new G(Dn))},properties:{type:new Ee(new G(ue))}}},o[f.aggregate]={type:new G(new Ee(new G(hn))),args:{filter:{type:w},aggregates:{type:new Ee(new G(new $n({name:`${u}AggregateRequest`,fields:yn})))},groupBy:{type:new Ee(new G(ue))},query:{type:ue}}}}let s=[];for(let[d,u]of r.typeRegistry)s.push({name:u.name,source:`typeRegistry[${d}]`});for(let[d,u]of r.connectionRegistry)s.push({name:u.name,source:`connectionRegistry[${d}]`});let a=new Map;for(let{name:d,source:u}of s)a.has(d)||a.set(d,[]),a.get(d).push(u);for(let[d,u]of a)if(u.length>1)throw new Error(`[dune] duplicate GraphQL type "${d}" from: ${u.join(", ")}`);let p=new na({query:new ia({name:"Query",fields:o}),types:[st,...Object.values(ie),...r.enumRegistry.values()]}),c=new Map,l=new Map;for(let d of t){let u=new Map;for(let[g,h]of V(d))u.set(g,h);let f={view:{space:d.space,externalId:d.externalId,version:d.version},properties:u};c.set(`${d.space}:${d.externalId}`,f),l.set(d.externalId,f)}let m={view(d){let u=c.get(`${d.space}:${d.externalId}`)??l.get(d.externalId);if(!u)throw new Error(`SchemaKnowledge: no view for "${d.space}:${d.externalId}"`);return u},property(d,u){return(c.get(`${d.space}:${d.externalId}`)??l.get(d.externalId))?.properties.get(u)}};return{schema:p,sdl:sa(p),schemaKnowledge:m}}i(Rn,"buildSchema");async function Tn(e,t){let n=(await t.dataModels.retrieve([{space:e.space,externalId:e.dataModelExternalId,version:e.dataModelVersion}],{inlineViews:!1})).items[0];if(!n)throw new Error(`Data model ${e.space}/${e.dataModelExternalId}/${e.dataModelVersion} not found`);if(!n.views?.length)throw new Error(`Data model ${e.space}/${e.dataModelExternalId}/${e.dataModelVersion} has no views`);let o=n.views.map(a=>({space:a.space,externalId:a.externalId,version:a.version}));return(await t.views.retrieve(o,{includeInheritedProperties:!0})).items}i(Tn,"fetchViews");import{GraphQLObjectType as aa,GraphQLNonNull as pa,GraphQLList as ca,isScalarType as la,isEnumType as da,parse as ma,print as ua}from"graphql";function Gt(e,t){let r=e.getType(t);if(!(r instanceof aa))return[];let n=r.getFields(),o=[];for(let[s,a]of Object.entries(n)){let p=a.type;for(;p instanceof pa||p instanceof ca;)p=p.ofType;(la(p)||da(p))&&o.push(s)}return o}i(Gt,"scalarFieldsFor");function ga(e,t){let r=Gt(e,t),n=["space","externalId"];for(let o of["name","description"])r.includes(o)&&n.push(o);return n.join(" ")}i(ga,"minimalRelationFields");function Fn(e,t,r){let n=[];for(let[o,s]of V(e))if(s.kind==="directRelation"||s.kind==="reverseDirect"){let a=s.kind==="directRelation"?s.targetView.externalId:s.sourceView.externalId;if(r)n.push(`${o} { ${ga(t,a)} }`);else{let c=["space","externalId",...Gt(t,a).filter(l=>l!=="space"&&l!=="externalId")];n.push(`${o} { ${c.join(" ")} }`)}}else!r&&(s.kind==="reverseList"||s.kind==="edge")&&n.push(`${o} { items { space externalId } pageInfo { hasNextPage endCursor } }`);return n}i(Fn,"relationFieldsFor");function On(e,t,r,n){return`query ${e}(${t}) {
+  ${e}(${r}) {
+    items {
+      ${n}
+    }
+    pageInfo { hasNextPage endCursor }
+  }
+}`}i(On,"paginatedOp");function fa(e,t){let r=e.externalId,n=Gt(t,r),o=Fn(e,t,!0),s=Fn(e,t,!1),a=[...n,...o].join(`
+      `),p=[...n,...s].join(`
+    `),c=!!t.getType(`${r}Sort`),l=ve(r),m=On(l.query,c?`$limit: ListLimit, $cursor: String, $filter: ${r}Filter, $sort: [${r}Sort!]`:`$limit: ListLimit, $cursor: String, $filter: ${r}Filter`,c?"limit: $limit, cursor: $cursor, filter: $filter, sort: $sort":"limit: $limit, cursor: $cursor, filter: $filter",a),d=On(l.search,`$query: String, $limit: ListLimit, $filter: ${r}Filter, $sort: [SearchSort!], $properties: [String!]`,"query: $query, limit: $limit, filter: $filter, sort: $sort, properties: $properties",a),u=`query ${l.getById}($space: String!, $externalId: String!) {
+    ${l.getById}(space: $space, externalId: $externalId) {
+      ${p}
+    }
+  }
+  `,f=`query ${l.count}($filter: ${r}Filter) {
+    ${l.count}(filter: $filter)
+  }`,g=`query ${l.aggregate}($filter: ${r}Filter, $aggregates: [${r}AggregateRequest!], $groupBy: [String!], $query: String) {
+    ${l.aggregate}(filter: $filter, aggregates: $aggregates, groupBy: $groupBy, query: $query) {
+      aggregate
+      property
+      value
+      buckets { start count }
+      group
+    }
+  }`;return ua(ma([m,u,f,d,g].join(`
+
+`)))}i(fa,"generateViewOperations");function Ln(e,t){return e.filter(we).map(r=>fa(r,t)).join(`
+
+`)}i(Ln,"generateOperations");function ya(e){return{availableOnList:e.kind==="scalar"||e.kind==="directRelationList",returnsMany:e.kind==="reverseList"||e.kind==="edge"||e.kind==="directRelationList",filterable:ze(e),sortable:We(e)}}i(ya,"fetchCharacteristics");function Nn(e,t=new Date){return{generatedAt:t.toISOString(),views:e.map(r=>({space:r.space,externalId:r.externalId,version:r.version,properties:Object.fromEntries(V(r).map(([n,o])=>{let s={kind:o.kind,fetch:ya(o)};return(o.kind==="directRelation"||o.kind==="directRelationList")&&(s.targetView=o.targetView),[n,s]}))}))}}i(Nn,"buildSdkMetadata");var _n="change-case-all#upperCaseFirst";function at(e){let t=ve(e),r=i(n=>`{ ${n}: { items: [], pageInfo: { hasNextPage: false, endCursor: null } } }`,"page");return[{method:t.query,doc:`Query${e}`,data:`Query${e}Query`,vars:`Query${e}QueryVariables`,emptyResult:r(t.query)},{method:t.getById,doc:`Get${e}ById`,data:`Get${e}ByIdQuery`,vars:`Get${e}ByIdQueryVariables`,emptyResult:`{ ${t.getById}: null }`},{method:t.count,doc:`Count${e}`,data:`Count${e}Query`,vars:`Count${e}QueryVariables`,emptyResult:`{ ${t.count}: 0 }`},{method:t.search,doc:`Search${e}`,data:`Search${e}Query`,vars:`Search${e}QueryVariables`,emptyResult:r(t.search)},{method:t.aggregate,doc:`Aggregate${e}`,data:`Aggregate${e}Query`,vars:`Aggregate${e}QueryVariables`,emptyResult:`{ ${t.aggregate}: [] }`}]}i(at,"opsFor");var wa=i(e=>at(e).flatMap(t=>[t.data,t.vars]),"typeNamesFor");function va(e,t){let r=i(n=>n.match(/from '(\.\/[^']+)'/)?.[1]??"","path");return r(e).localeCompare(r(t),void 0,{sensitivity:"base"})}i(va,"byImportPath");function ka(e){let t=un(e),r=new Set(t);for(let n of e)r.has(n)||console.warn(`[dune] dedup: dropped ${n.space}/${n.externalId} (duplicate externalId)`);return console.log(`[dune] views after dedup: ${t.length} (was ${e.length})`),t}i(ka,"dedupeWithLogging");function Ca(e,t){Oe(z(e,"views.generated.ts"),`import type { ViewDefinition } from '@cognite/cli/sdk-runtime';
+
+// Auto-generated \u2014 do not edit.
+export const views: ViewDefinition[] = ${JSON.stringify(gn(t),null,2)};
+`,"utf-8")}i(Ca,"writeViewsFile");async function xa(e,t){await Un({schema:t,generates:{[z(e,"types.generated.ts")]:{plugins:["typescript"],config:{scalars:et}}}},!0)}i(xa,"generateBaseTypes");async function Ea(e,t,r,n){let o=Ln(n,r);await Un({schema:t,documents:o,generates:{[z(e,"operations.generated.ts")]:{plugins:["typescript-operations"],config:{scalars:et,namingConvention:_n}},[z(e,"documents.generated.ts")]:{plugins:["typescript-document-nodes"],config:{scalars:et,namingConvention:_n,documentMode:"graphQLTag"}}}},!0)}i(Ea,"generateOperationsAndDocuments");function ba(e,t){let r=t.flatMap(a=>at(a).map(p=>p.doc)),n=t.flatMap(wa),o=[`import { ${r.join(", ")} } from './documents.generated';`,`import type { ${n.join(", ")} } from './operations.generated';`,"import { views } from './views.generated';"].sort(va).join(`
+`),s=t.flatMap(a=>at(a).map(p=>`    ${p.method}: (...args: SdkArgs<${p.vars}>) => requester<${p.data}, ${p.vars}>(${p.doc}, ...args),`)).join(`
+`);Oe(z(e,"index.ts"),`import { createDuneRuntimeFromViews } from '@cognite/cli/sdk-runtime';
+import type { CogniteClient } from '@cognite/sdk';
+import type { DocumentNode } from 'graphql';
+
+${o}
+
+export * from './types.generated';
+export type { ${n.join(", ")} } from './operations.generated';
+
+type DuneRequester = <TData, TVariables>(doc: DocumentNode, variables?: TVariables) => Promise<TData>;
+
+type SdkArgs<V> = Partial<V> extends V ? [variables?: V] : [variables: V];
+
+function makeSdk(requester: DuneRequester) {
+  return {
+${s}
+  };
+}
+
+export type Sdk = ReturnType<typeof makeSdk>;
+
+/**
+ * Creates a fully-typed SDK backed by the Dune runtime.
+ * Queries are executed in-process via graphql-js and translated to DMS API calls \u2014
+ * no CDF GraphQL endpoint is involved.
+ */
+export function createSdk(client: Parameters<typeof createDuneRuntimeFromViews>[1]): Sdk {
+  const runtime = createDuneRuntimeFromViews(views, client);
+  return makeSdk(runtime.requester);
+}
+`,"utf-8")}i(ba,"writeBarrel");function Pa(e,t){let r=t.flatMap(n=>at(n).map(o=>`    ${o.method}: vi.fn<Sdk['${o.method}']>(() => Promise.resolve(${o.emptyResult})),`)).join(`
+`);Oe(z(e,"test-helpers.ts"),`import { vi } from 'vitest';
+
+import type { Sdk } from './index';
+
+export function makeMockSdk(overrides: Partial<Sdk> = {}): Sdk {
+  return {
+${r}
+    ...overrides,
+  };
+}
+`,"utf-8")}i(Pa,"writeTestHelpers");async function Mn(e,t,r){let n=ka(await Tn(e,t));for(let l of n)_t(l.externalId,"codegen view");de(e.name);let{schema:o,sdl:s}=Rn(n),a=n.filter(we),p=z(r,e.name);Sa(p,{recursive:!0,force:!0}),ha(p,{recursive:!0}),Oe(z(p,"schema.graphql"),s,"utf-8"),Oe(z(p,"sdk-metadata.json"),JSON.stringify(Nn(a),null,2),"utf-8"),Ca(p,a),await xa(p,s),await Ea(p,s,o,a);let c=a.map(l=>l.externalId).sort((l,m)=>l.localeCompare(m));return ba(p,c),Pa(p,c),{sdkDir:p,viewCount:a.length}}i(Mn,"generateSdk");import{existsSync as Na,readFileSync as _a}from"fs";import{resolve as Ua}from"path";import{array as Vn,boolean as Aa,check as be,forward as Pe,literal as Ia,maxLength as Da,minLength as $a,nonEmpty as oe,object as jn,optional as W,picklist as Ra,pipe as q,safeParse as Ta,string as j,url as Kn}from"valibot";var Bt=q(j(),oe("must not be empty")),qt=q(j(),oe("must not be empty"),Da(256,"must be 256 characters or fewer")),Qt=q(j(),oe("must not be empty"),Kn("must be a valid URL")),Fa=q(j(),oe("must not be empty"),Kn("must be a valid URL")),Jt=q(j(),oe("must not be empty")),Yt=q(j(),oe("must not be empty")),Oa=q(jn({org:Jt,project:Yt,baseUrl:Qt,deployClientId:W(j(),""),deploySecretName:W(j(),""),published:W(Aa(),!1),idpType:W(Ra(["cdf","entra_id","oauth"]),"cdf"),tenantId:W(j()),scopes:W(Vn(q(j(),oe("must not be empty")))),tokenUrl:W(Fa)}),Pe(be(e=>e.idpType!=="entra_id"||!!e.tenantId,'must be set when idpType is "entra_id"'),["tenantId"]),Pe(be(e=>e.idpType!=="oauth"||!!e.tokenUrl,'must be set when idpType is "oauth"'),["tokenUrl"]),Pe(be(e=>!e.tokenUrl||e.idpType==="oauth",'must only be set when idpType is "oauth"'),["tokenUrl"]),Pe(be(e=>e.idpType!=="oauth"||!!e.deployClientId,'must be set when idpType is "oauth"'),["deployClientId"]),Pe(be(e=>e.idpType!=="oauth"||!!e.deploySecretName,'must be set when idpType is "oauth"'),["deploySecretName"]),Pe(be(e=>!e.deployClientId||!!e.deploySecretName,"must be set when deployClientId is set"),["deploySecretName"])),La=jn({name:Bt,externalId:qt,versionTag:q(j(),oe("must not be empty")),description:W(j(),""),deployments:q(Vn(Oa),$a(1,"must contain at least one deployment")),infra:W(Ia("appsApi"))});function zt(e){let t=Ta(La,e);if(t.success)return t.output;let r=t.issues[0],n=r.path?.map(s=>s.key).join(".")??"",o=n?`"${n}" `:"";throw new Error(`app.json: ${o}${r.message}`)}i(zt,"validateAppConfig");function v(e,t={}){let{validator:r=zt,existsSync:n=Na,readFileSync:o=_a}=t,s=Ua(e,"app.json");if(!n(s))throw new Error(`No app.json found at ${s}. Make sure you're running this command from your app's root directory.`);let a=o(s,"utf-8"),p;try{p=JSON.parse(a)}catch{throw new Error("Failed to parse app.json \u2014 check that it contains valid JSON.")}return r(p)}i(v,"loadAppConfig");import{CogniteClient as xp}from"@cognite/sdk";import{CogniteClient as Ya}from"@cognite/sdk";function Ma(e){return Math.floor(Math.random()*Math.min(2**e*250,15e3))}i(Ma,"exponentialBackoffWithJitter");function Va(e){return new Promise(t=>setTimeout(t,e))}i(Va,"sleep");async function Hn(e,t={}){let r=t.maxAttempts??5,n=t.shouldRetry??(()=>!0),o=t.delayInMsCalculator??Ma;if(r<1)throw new Error("`maxAttempts` must be 1 or greater");if(r>100)throw new Error("`maxAttempts` must be 100 or less");let s=1;for(;;)try{return await e()}catch(a){if(s>=r||!n(a))throw a;let p=o(s);t.onAttemptFail?.(a,s,p),await Va(p),s++}}i(Hn,"retryAsync");import{inspect as ja}from"util";var Wt="[REDACTED]",Le,pt=class pt{constructor(t){en(this,Le);tn(this,Le,t)}toString(){return Wt}toJSON(){return Wt}[ja.custom](){return Wt}expose(){return Zr(this,Le)}static from(t){return new pt(t)}};Le=new WeakMap,i(pt,"SensitiveString");var k=pt;var Ka="https://auth.cognite.com/oauth2/token",Ha=i(e=>typeof e=="object"&&e!==null&&"access_token"in e&&typeof e.access_token=="string","hasAccessToken");async function Gn({idp:e,tokenUrl:t,init:r,missingTokenHint:n}){let o;try{o=await Hn(()=>fetch(t,r),{maxAttempts:3})}catch(p){throw new y(`Failed to fetch access token from ${t}`,{cause:p})}if(!o.ok){let p=await o.text();throw new le(`Failed to get token from ${e}: ${o.status} ${o.statusText}`,{httpStatusCode:o.status,requestUrl:t,responseBody:p})}let s=await o.text(),a;try{a=JSON.parse(s)}catch{throw new y(`Unexpected response from ${e} authentication (invalid JSON)`,{hint:n})}if(!Ha(a))throw new y(`No access token in ${e} authentication response`,{hint:n});return k.from(a.access_token)}i(Gn,"fetchOAuthToken");var Ga=i(()=>{let e=process.env.DEPLOYMENT_SECRETS;if(!e)return{};try{let t=JSON.parse(e),r={};for(let[n,o]of Object.entries(t))if(typeof o=="string"){let s=n.toLowerCase().replace(/_/g,"-");r[s]=o}return r}catch(t){return console.error("Error parsing DEPLOYMENT_SECRETS:",t),{}}},"loadSecretsFromEnv"),Ba=i(e=>{let t;if(process.env.DEPLOYMENT_SECRET&&(t=process.env.DEPLOYMENT_SECRET),t||(t=Ga()[e]),t||(t=process.env[e]),!t)throw new Error(`Secret not found in environment: ${e}`);return k.from(t)},"getSecretFromEnv"),qa=i((e,t)=>{let r=t.expose();return Gn({idp:"CDF",tokenUrl:Ka,init:{method:"POST",headers:{Authorization:`Basic ${btoa(`${e}:${r}`)}`,"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"client_credentials"})},missingTokenHint:"Check the client ID in app.json and the deployment secret in your environment."})},"getTokenCdf"),Bn=i(({idp:e,tokenUrl:t,clientId:r,clientSecret:n,scopes:o,missingTokenHint:s})=>Gn({idp:e,tokenUrl:t,init:{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:r,client_secret:n,grant_type:"client_credentials",...o!==void 0?{scope:o.join(" ")}:{}})},missingTokenHint:s}),"getTokenWithClientCredentials"),Qa=i((e,t)=>{if(t!==void 0)return t.join(" ");if(!e)throw new Error("Entra ID authentication requires 'baseUrl' to be set in deployment configuration");try{return`${new URL(e).origin}/.default`}catch{throw new Error(`Entra ID authentication requires 'baseUrl' to be a valid CDF URL (e.g., https://cluster.cognitedata.com), got: ${e}`)}},"resolveEntraScope"),Ja=i((e,t,r,n,o)=>Bn({idp:"Entra ID",tokenUrl:`https://login.microsoftonline.com/${r}/oauth2/v2.0/token`,clientId:e,clientSecret:t.expose(),scopes:o!==void 0?o:[Qa(n)],missingTokenHint:"Check the client ID and tenant ID in app.json and the deployment secret in your environment."}),"getTokenEntra"),Xt=i(async(e,t=process.env)=>{if(t.COGNITE_TOKEN)return k.from(t.COGNITE_TOKEN);let{deployClientId:r,deploySecretName:n,idpType:o="cdf",tenantId:s,baseUrl:a,scopes:p,tokenUrl:c}=e,l=Ba(n);if(o==="oauth"){if(!c)throw new Error("OAuth authentication requires 'tokenUrl' in deployment configuration");return Bn({idp:"OAuth",tokenUrl:c,clientId:r,clientSecret:l.expose(),scopes:p,missingTokenHint:"Check the tokenUrl, client ID, scopes, and deployment secret in app.json and your environment."})}if(o==="entra_id"){if(!s)throw new Error("Entra ID authentication requires 'tenantId' in deployment configuration");return Ja(r,l,s,a,p)}return qa(r,l)},"getToken");async function Ne(e,t,r=process.env,n){let o=await Xt(e,r),s=r.COGNITE_BASE_URL??e.baseUrl,a=(n??(p=>new Ya(p)))({appId:t,project:e.project,baseUrl:s,oidcTokenProvider:i(async()=>o.expose(),"oidcTokenProvider")});return await a.authenticate(),a}i(Ne,"getSdk");import dp from"os";import mp from"path";import up from"open";import{buildAuthorizationUrl as gp,calculatePKCECodeChallenge as fp,discovery as yp,None as hp,randomPKCECodeVerifier as Sp,randomState as wp}from"openid-client";import qn from"mixpanel";var za="5c4d853e7c3b77b1eb4468d5329b278c",_e="cognite-cli",Wa=2e3,Qn={env:process.env,init:qn.init.bind(qn)},Xa={track:i(()=>{},"track"),flush:i(async()=>{},"flush")};function Zt(e=process.env){return e.COGNITE_TELEMETRY_DISABLED==="1"||e.DO_NOT_TRACK==="1"}i(Zt,"isTelemetryDisabled");function Za(e=process.env){if(e.GITHUB_ACTIONS)return"github-actions";if(e.TF_BUILD)return"azure-devops";if(e.GITLAB_CI)return"gitlab-ci";if(e.CIRCLECI)return"circleci";if(e.TRAVIS)return"travis-ci";if(e.BUILDKITE)return"buildkite";if(e.DRONE)return"drone";if(e.SEMAPHORE)return"semaphore";if(e.TEAMCITY_VERSION)return"teamcity";if(e.APPVEYOR)return"appveyor";if(e.CODEBUILD_BUILD_ID)return"aws-codebuild";if(e.HEROKU_TEST_RUN_ID)return"heroku-ci";if(e.BITBUCKET_BUILD_NUMBER)return"bitbucket-pipelines";if(e.JENKINS_URL||e.JENKINS_HOME)return"jenkins";if(e.CI&&e.CI!=="false"&&e.CI!=="0")return"ci-generic"}i(Za,"detectCiEnvironment");function ep(e){return e.COGNITE_TELEMETRY_DEBUG==="1"}i(ep,"isDebug");function ct(e={}){let t=e.env??Qn.env,r=e.init??Qn.init,n=e.packageName,o=e.cliVersion,s=ep(t),a=Za(t);if(Zt(t))return s&&process.stderr.write(`[telemetry] disabled \u2014 noop tracker
+`),Xa;let p,c=new Set;function l(){if(p)return p;try{return p=r(za,{geolocate:!1,keepAlive:!1}),p}catch{return}}return i(l,"getClient"),{track(m,d={}){let u=l();if(!u)return;let f={...d,applicationId:_e,...n&&{packageName:n},...o&&{cliVersion:o},nodeVersion:process.version,platform:process.platform,...a&&{ciEnvironment:a}};s&&process.stderr.write(`[telemetry] track ${m} ${JSON.stringify(f)}
+`);let g=i(()=>{},"finish"),h=new Promise(w=>{g=w});c.add(h);try{u.track(m,f,g)}catch{g()}h.finally(()=>c.delete(h))},async flush(m=Wa){if(c.size===0)return;let d,u=new Promise(f=>{d=setTimeout(f,m),d.unref?.()});try{await Promise.race([Promise.allSettled([...c]),u])}finally{d&&clearTimeout(d)}s&&process.stderr.write(`[telemetry] flush done (${c.size} still pending)
+`)}}}i(ct,"createTelemetry");import ip from"https";import{authorizationCodeGrant as op}from"openid-client";function Jn(e){return e.replace(/[&<>"']/g,t=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[t]??t)}i(Jn,"escapeHtml");function er(e,t,r){let n=Jn(t),o=Jn(r);return`<html><body style="font-family: system-ui; padding: 40px; text-align: center;">
+    <h1>${n}</h1><p>${o}</p><p>You can close this window.</p>${e==="success"?`<style>
       @keyframes checkmark {
         0% { transform: scale(0); }
         50% { transform: scale(1.2); }
@@ -16,32 +86,77 @@ ${l}`)}let c=await p.json();if(!c.access_token)throw new Error("No access token
       }
       h1 { animation: checkmark 0.5s ease-out; }
     </style>`:""}
-  </body></html>`}o(Qe,"generateHtml");async function Ho(e,t,r,n,i,s){let a=new URL(e.url??"/",`https://${e.headers.host??"localhost"}`);if(a.pathname!=="/")return t.writeHead(404),t.end("Not found"),{shouldClose:!1};try{console.log("\u{1F504} Exchanging authorization code for tokens...");let p=await s.authorizationCodeGrant(r,a,{pkceCodeVerifier:n,expectedState:i});return t.writeHead(200,{"Content-Type":"text/html"}),t.end(Qe("success","Login Successful!","You can close this window and return to the terminal.")),{shouldClose:!0,tokens:p}}catch(p){let c=p instanceof Error?p:new Error(String(p));return t.writeHead(400,{"Content-Type":"text/html"}),t.end(Qe("error","Authentication Error",c.message)),{shouldClose:!0,error:c}}}o(Ho,"handleCallback");function Vo(e){let t=e/6e4,r=Math.round(t*10)/10;return`${r} ${r===1?"minute":"minutes"}`}o(Vo,"formatTimeoutMinutes");function zt(e,t,r,n,i,s={createServer:jo.createServer,setTimeout:globalThis.setTimeout,clearTimeout:globalThis.clearTimeout,authorizationCodeGrant:Mo}){return new Promise((a,p)=>{let c=s.createServer(t,async(m,y)=>{try{let g=await Ho(m,y,r,n,i,s);g.shouldClose&&(d(),g.error?p(g.error):g.tokens?a(g.tokens):p(new Error("No tokens received")))}catch(g){d(),p(g instanceof Error?g:new Error(String(g)))}}),l=s.setTimeout(()=>{d(),p(new Error(`Login timeout - no response received within ${Vo(e.loginTimeout)}`))},e.loginTimeout);function d(){s.clearTimeout(l),c.close()}o(d,"cleanup"),c.on("error",m=>{d(),m.code==="EADDRINUSE"?console.error(`\u274C Port ${e.port} is already in use.`):console.error(`\u274C Server error: ${m.message}`),p(m)}),c.listen(e.port,"127.0.0.1",()=>{console.log(`\u{1F310} Local HTTPS server started on https://localhost:${e.port}`)})})}o(zt,"startCallbackServer");import{mkdirSync as Bo}from"fs";import{loadLocalCertificates as Go}from"@cognite/app-sdk/https";var Yo={loadLocalCertificates:Go,mkdirSync:Bo,logger:console};async function Wt(e,t=Yo){t.mkdirSync(e,{recursive:!0});let{cert:r,key:n,source:i}=await t.loadLocalCertificates({certDir:e});return i==="mkcert"?t.logger.log("\u{1F510} Using mkcert certificates for HTTPS"):(t.logger.log("\u{1F510} Using in-memory self-signed certificate for HTTPS \u2014 your browser will give you a warning."),t.logger.log("   Run `npx @cognite/cli@latest apps setup-https` to install trusted local https certificates.")),{cert:r,key:n}}o(Wt,"getOrCreateCertificates");var ri={authority:"https://auth.cognite.com",clientId:"0404baaa-0a90-43a2-aba7-a110b53fb41c",redirectUri:"https://localhost:3000/",port:3e3,loginTimeout:300*1e3,certDir:Jo.join(qo.homedir(),".cdf-login")},ni={open:zo,getOrCreateCertificates:Wt,startCallbackServer:zt,discovery:Zo,buildAuthorizationUrl:Wo,randomPKCECodeVerifier:ei,calculatePKCECodeChallenge:Xo,randomState:ti,logger:console};async function Zt(e,t=ri,r){return r===void 0?Xt(e,t,ni):Xt(e,t,r)}o(Zt,"login");async function oi(e,t){try{return await e.discovery(new URL(t.authority),t.clientId,void 0,Qo())}catch(r){throw new D(`Failed to fetch OpenID configuration from ${t.authority}`,{cause:r})}}o(oi,"fetchOpenIdConfig");async function Xt(e,t,r){r.logger.log(`\u{1F510} Starting CDF login flow...
-`),r.logger.log(`\u{1F4E1} Fetching OpenID configuration from ${t.authority}...`);let n=await oi(r,t),i=r.randomPKCECodeVerifier(),s=await r.calculatePKCECodeChallenge(i),a=r.randomState(),p={redirect_uri:t.redirectUri,scope:"openid profile email",code_challenge:s,code_challenge_method:"S256",state:a};e&&(p.organization_hint=e);let c=r.buildAuthorizationUrl(n,p).toString(),l=await r.getOrCreateCertificates(t.certDir);e&&r.logger.log(`\u{1F3E2} Organization: ${e}`),r.logger.log(`\u{1F680} Opening browser for authentication...
-`);try{await r.open(c)}catch(d){let m=d instanceof Error?d.message:String(d);r.logger.error("\u274C Failed to open browser automatically."),r.logger.error(`  Reason: ${m}`),r.logger.error(`Please open this URL manually:
-`),r.logger.error(c),r.logger.error("")}return r.startCallbackServer(t,l,n,i,a)}o(Xt,"loginImpl");async function I(e,t,r={}){let{login:n=Zt,getSdk:i=ce,createClient:s=o(a=>new ii(a),"createClient")}=r;if(t.interactive){let a=t.orgHint||e.org||void 0,p=await n(a),c=s({appId:t.appId,project:e.project,baseUrl:e.baseUrl,getToken:o(async()=>p.access_token,"getToken")});return await c.authenticate(),c}return i(e,t.appId)}o(I,"getClientForDeployment");import Qt from"enquirer";var er="Enter custom target...";function tr(e,t){let r=t.map((n,i)=>`  ${i}: ${n.org}/${n.project}`).join(`
+  </body></html>`}i(er,"generateHtml");import np from"net";import{execFileSync as Yn}from"child_process";import{platform as tp}from"os";import rp from"path";function _(e,t={}){let{platform:r=tp}=t;switch(r()){case"darwin":return e==="macos";case"win32":return e==="windows";default:return e==="other"}}i(_,"isOS");function zn(e,t={}){let{exec:r=Yn,log:n=console.log}=t,[o,s]=_("macos",t)?["open",[e]]:_("windows",t)?["rundll32",["url.dll,FileProtocolHandler",e]]:["xdg-open",[e]];try{r(o,s)}catch{n(`Could not open browser \u2014 open manually:
+  ${e}`)}}i(zn,"openInBrowser");function Wn(e,t={}){let{exec:r=Yn,log:n=console.log}=t,[o,s]=_("macos",t)?["open",["-R",e]]:_("windows",t)?["explorer",[`/select,${e}`]]:["xdg-open",[rp.dirname(e)]];try{r(o,s)}catch{n(`Could not open file manager \u2014 files are at:
+  ${e}`)}}i(Wn,"revealInFileManager");function Xn(e,t){return new Promise(r=>{let n=new np.Socket,o=i(s=>{n.removeAllListeners(),n.destroy(),r(s)},"done");n.setTimeout(500),n.once("connect",()=>o(!1)),n.once("timeout",()=>o(!0)),n.once("error",()=>o(!0)),n.connect(e,t)})}i(Xn,"isHostPortFree");function lt(e,t={}){return _("windows",t)?`Find the process: netstat -ano | findstr :${e}  then kill it: taskkill /PID <pid> /F`:`Free port ${e} (e.g. lsof -ti :${e} | xargs kill) and retry.`}i(lt,"freePortHint");async function Zn(e){if(e<0)throw new Error(`Invalid port: ${e}`);return e===0?!0:(await Promise.all([Xn(e,"127.0.0.1"),Xn(e,"::1")])).every(Boolean)}i(Zn,"isPortFree");async function sp(e,t,r,n,o,s){let a=new URL(e.url??"/",`https://${e.headers.host??"localhost"}`);if(a.pathname!=="/")return t.writeHead(404),t.end("Not found"),{shouldClose:!1};try{console.log("\u{1F504} Exchanging authorization code for tokens...");let p=await s.authorizationCodeGrant(r,a,{pkceCodeVerifier:n,expectedState:o});return t.writeHead(200,{"Content-Type":"text/html"}),t.end(er("success","Login Successful!","You can close this window and return to the terminal.")),{shouldClose:!0,tokens:p}}catch(p){let c=p instanceof Error?p:new Error(String(p));return t.writeHead(400,{"Content-Type":"text/html"}),t.end(er("error","Authentication Error",c.message)),{shouldClose:!0,error:c}}}i(sp,"handleCallback");function ap(e){let t=e/6e4,r=Math.round(t*10)/10;return`${r} ${r===1?"minute":"minutes"}`}i(ap,"formatTimeoutMinutes");function ei(e,t,r,n,o,s={createServer:ip.createServer,setTimeout:globalThis.setTimeout,clearTimeout:globalThis.clearTimeout,authorizationCodeGrant:op}){return new Promise((a,p)=>{let c=s.createServer(t,async(d,u)=>{try{let f=await sp(d,u,r,n,o,s);f.shouldClose&&(m(),f.error?p(f.error):f.tokens?a(f.tokens):p(new Error("No tokens received")))}catch(f){m(),p(f instanceof Error?f:new Error(String(f)))}}),l=s.setTimeout(()=>{m(),p(new Error(`Login timeout - no response received within ${ap(e.loginTimeout)}`))},e.loginTimeout);function m(){s.clearTimeout(l),c.close()}i(m,"cleanup"),c.on("error",d=>{m(),d.code==="EADDRINUSE"||d.code==="EACCES"?p(new y(`Port ${e.port} is already in use \u2014 the login callback server cannot start`,{cause:d,hint:lt(e.port)})):p(new y(`Login callback server failed: ${d.message}`,{cause:d}))}),c.listen(e.port,"127.0.0.1",()=>{console.log(`\u{1F310} Local HTTPS server started on https://localhost:${e.port}`)})})}i(ei,"startCallbackServer");import{mkdirSync as pp}from"fs";import{loadLocalCertificates as cp}from"@cognite/app-sdk/https";var lp={loadLocalCertificates:cp,mkdirSync:pp,logger:console};async function ti(e,t=lp){t.mkdirSync(e,{recursive:!0});let{cert:r,key:n,source:o}=await t.loadLocalCertificates({certDir:e}).catch(s=>{throw new y(`Failed to load SSL certificates from ${e}`,{cause:s,hint:"Run `npx @cognite/cli apps setup-https` to create trusted local certificates."})});return o==="mkcert"?t.logger.log("\u{1F510} Using mkcert certificates for HTTPS"):(t.logger.log("\u{1F510} Using in-memory self-signed certificate for HTTPS \u2014 your browser will give you a warning."),t.logger.log("   Run `npx @cognite/cli@latest apps setup-https` to install trusted local https certificates.")),{cert:r,key:n}}i(ti,"getOrCreateCertificates");var vp={authority:"https://auth.cognite.com",clientId:"0404baaa-0a90-43a2-aba7-a110b53fb41c",redirectUri:"https://localhost:3000/",port:3e3,loginTimeout:300*1e3,certDir:mp.join(dp.homedir(),".cdf-login")},kp={open:up,getOrCreateCertificates:ti,startCallbackServer:ei,isPortFree:Zn,discovery:yp,buildAuthorizationUrl:gp,randomPKCECodeVerifier:Sp,calculatePKCECodeChallenge:fp,randomState:wp,logger:console,telemetry:ct()};async function ni(e,t=vp,r){return r===void 0?ri(e,t,kp):ri(e,t,r)}i(ni,"login");async function Cp(e,t){try{return await e.discovery(new URL(t.authority),t.clientId,void 0,hp())}catch(r){throw new y(`Failed to fetch OpenID configuration from ${t.authority}`,{cause:r})}}i(Cp,"fetchOpenIdConfig");async function ri(e,t,r){if(!await r.isPortFree(t.port))throw r.telemetry?.track("Flows.CLI.PortInUse",{port:t.port}),new y(`Port ${t.port} is already in use \u2014 the login callback server cannot start`,{hint:lt(t.port)});r.logger.log(`\u{1F510} Starting CDF login flow...
+`),r.logger.log(`\u{1F4E1} Fetching OpenID configuration from ${t.authority}...`);let o=await Cp(r,t),s=r.randomPKCECodeVerifier(),a=await r.calculatePKCECodeChallenge(s),p=r.randomState(),c={redirect_uri:t.redirectUri,scope:"openid profile email",code_challenge:a,code_challenge_method:"S256",state:p};e&&(c.organization_hint=e);let l=r.buildAuthorizationUrl(o,c).toString(),m=await r.getOrCreateCertificates(t.certDir);e&&r.logger.log(`\u{1F3E2} Organization: ${e}`),r.logger.log(`\u{1F680} Opening browser for authentication...
+`);try{await r.open(l)}catch(d){let u=d instanceof Error?d.message:String(d);r.logger.error("\u274C Failed to open browser automatically."),r.logger.error(`  Reason: ${u}`),r.logger.error(`Please open this URL manually:
+`),r.logger.error(l),r.logger.error("")}return r.startCallbackServer(t,m,o,s,p)}i(ri,"loginImpl");async function b(e,t,r={}){let{login:n=ni,getSdk:o=Ne,createClient:s=i(a=>new xp(a),"createClient")}=r;if(t.interactive){let a=t.orgHint||e.org||void 0,p=await n(a),c=k.from(p.access_token),l=s({appId:t.appId,project:e.project,baseUrl:e.baseUrl,getToken:i(async()=>c.expose(),"getToken")});return await l.authenticate(),l}return o(e,t.appId)}i(b,"getClientForDeployment");import{existsSync as Ep}from"fs";import{resolve as bp}from"path";import{config as Pp}from"dotenv";function P(e,t={existsSync:Ep,config:Pp}){let r=bp(e,".env");t.existsSync(r)&&(console.log(`Loading environment variables from ${r}`),t.config({path:r}))}i(P,"loadEnvFile");import{readFileSync as Ap,writeFileSync as ii,renameSync as Ip,existsSync as Dp,mkdirSync as $p}from"fs";import{resolve as Ue}from"path";import{array as rr,object as si,optional as oi,parse as Rp,record as Tp,safeParse as Fp,string as X,unknown as Op}from"valibot";var Lp=si({space:X(),externalId:X(),version:X()}),Np=si({name:X(),dataModelSpace:X(),dataModelExternalId:X(),dataModelVersion:X(),views:oi(rr(Lp)),instanceSpaces:oi(rr(X()))}),_p=Tp(X(),Op());function nr(e){let t;try{t=Ap(e,"utf-8")}catch(n){throw n.code==="ENOENT"?new Error(`app.json not found at "${e}". Run this command from the root of a Cognite app.`):n}let r;try{r=JSON.parse(t)}catch(n){throw new Error(`app.json at "${e}" is not valid JSON: ${n.message}`)}return Rp(_p,r)}i(nr,"readAppJson");function ir(e,t){let r=Ue(e,"app.json"),o=nr(r)["sdk-gen-alpha-version"];if(typeof o!="string"||o.length===0)throw new Error(`This app is not enabled for the SDK generator alpha.
+app.json is missing "sdk-gen-alpha-version". The SDK generator is an alpha feature \u2014 scaffold a new app with the alpha CLI to use it.`);if(o!==t)throw new Error(`SDK generator alpha version mismatch.
+app.json requires @cognite/cli@${o}, but you are running @cognite/cli@${t}.
+Run the matching alpha instead: npx @cognite/cli@${o} apps sdk generate`)}i(ir,"assertSdkGenAlpha");function Me(e){let t=Ue(e,"app.json"),n=nr(t).generatedSdks;if(n===void 0)return[];let o=Fp(rr(Np),n);if(!o.success){let s=o.issues[0],a=s.path?.map(p=>p.key).join(".")??"";throw new Error(`app.json: generatedSdks${a?`.${a}`:""}: ${s.message}`)}return o.output}i(Me,"readGeneratedSdks");function ai(e,t,r={}){de(t.name);let n=Ue(e,"app.json"),o=nr(n),s=Me(e),a=s.find(d=>d.name===t.name),p;if(a){if(!r.replace)throw new Error(`An SDK named "${t.name}" already exists in app.json. Pass { replace: true } to overwrite, or pick a different name.`);p=s.map(d=>d.name===t.name?t:d)}else p=[...s,t];let c=Ue(e,".dune","sdk-configs");Dp(c)||$p(c,{recursive:!0});let l=Ue(c,`${t.name}.json`);ii(l,JSON.stringify(t,null,2)+`
+`),o.generatedSdks=p;let m=`${n}.tmp`;ii(m,JSON.stringify(o,null,2)+`
+`),Ip(m,n)}i(ai,"writeGeneratedSdkEntry");var pr=class pr extends Error{constructor(){super("Wizard cancelled by user")}};i(pr,"WizardCancelled");var je=pr,Ve=Symbol("BACK"),Hp=new RegExp("\x1B\\[[0-9;]*m","g");async function li(e,t){P(e);let r=v(e),n=r.deployments[0],o=await b(n,{interactive:t.interactive??!1,appId:r.externalId,orgHint:t.orgHint});if(t.interactive&&console.log(`\u2705 Authenticated
+`),!(o instanceof Kp))throw new Error("[dune] getClientForDeployment did not return a CogniteClient");return o}i(li,"resolveClient");async function sr(e,t,r){let n=t.map((p,c)=>({name:r(p,c),value:c})),o={type:"select",name:"answer",message:e,choices:n.map(p=>p.name)},{answer:s}=await ar.prompt(o),a=n.findIndex(p=>p.name===s);return t[a]}i(sr,"pick");async function Gp(e,t,r){let n=t.map((l,m)=>r(l,m)),o=new Map(n.map((l,m)=>[l,m])),s={type:"autocomplete",name:"answer",message:e,limit:12,choices:n},{answer:a}=await ar.prompt(s);if(o.has(a))return t[o.get(a)];let p=i(l=>String(l).replace(Hp,"").trim(),"clean"),c=p(a);for(let[l,m]of o)if(p(l)===c)return t[m];for(let[l,m]of o)if(p(l).includes(c)||c.includes(p(l)))return t[m];throw new Error(`Could not match selection "${a}" to any item`)}i(Gp,"searchPick");async function Bp(e,t=""){let r={type:"input",name:"answer",message:e,initial:t},{answer:n}=await ar.prompt(r);return n}i(Bp,"ask");async function qp(e,t={}){ir(e,"1.6.0-alpha.sdk-gen");let r=process.cwd();process.chdir(e);try{let n=await li(e,t),o={chosenModel:null,sdkName:null,replaceExisting:!1},s=[async()=>{console.log(`
+\u{1F510} Fetching data models...`);let c=(await n.dataModels.list({limit:1e3,includeGlobal:!0})).items.map(l=>({space:l.space,externalId:l.externalId,version:l.version,name:l.name}));if(c.sort((l,m)=>`${l.space}/${l.externalId}`.localeCompare(`${m.space}/${m.externalId}`)),c.length===0)throw new Error("No data models found.");return console.log(`\u{1F50D} Found ${c.length} model(s). Type to search.
+`),o.chosenModel=await Gp("\u{1F4E6} Select a data model:",c,l=>`${l.space}  \u2192  ${l.externalId} / ${l.version}${l.name?`  \u2014 ${l.name}`:""}`),!0},async()=>{let p=o.chosenModel.externalId.replace(/([a-z0-9])([A-Z])/g,"$1-$2").replace(/[^a-zA-Z0-9-_]/g,"-").toLowerCase(),c=await Bp(`
+SDK name (folder under src/generated_sdks/, "back" to go back):`,p);if(c.toLowerCase()==="back")return Ve;try{de(c)}catch(d){return console.log(`
+\u26A0\uFE0F  ${d instanceof Error?d.message:String(d)}
+Please enter a valid name.
+`),Ve}let m=Me(e).find(d=>d.name===c);if(o.replaceExisting=!1,m){console.log(`
+\u26A0\uFE0F  An SDK named "${c}" already exists in app.json:`),console.log(`   ${m.dataModelSpace} / ${m.dataModelExternalId} @ ${m.dataModelVersion}`);let d=await sr("What would you like to do?",["Replace existing entry","Pick a different name","Cancel"],u=>u);if(d==="Cancel")throw new je;if(d==="Pick a different name")return Ve;o.replaceExisting=!0}return o.sdkName=c,!0},async()=>{let p={name:o.sdkName,dataModelSpace:o.chosenModel.space,dataModelExternalId:o.chosenModel.externalId,dataModelVersion:String(o.chosenModel.version)};console.log(`
+\u2500\u2500 Summary \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500`),console.log(`   Space:     ${p.dataModelSpace}`),console.log(`   Model:     ${p.dataModelExternalId} @ ${p.dataModelVersion}`),console.log("   Views:     all"),console.log(`   SDK name:  ${o.sdkName}`),console.log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");let c=await sr("Write to app.json?",["Yes","Back","Cancel"],l=>l);if(c==="Back")return Ve;if(c==="Cancel")throw new je;return ai(e,p,{replace:o.replaceExisting}),console.log(`
+\u2705 Added "${p.name}" to app.json`),console.log(`   Config saved to .dune/sdk-configs/${p.name}.json`),console.log(""),!0}],a=0;for(;a<s.length;)await s[a]()===Ve?(a=Math.max(0,a-1),console.log("")):a++;return{sdkName:o.sdkName,client:n}}finally{process.chdir(r)}}i(qp,"runWizard");async function pi(e,t,r,n={}){let o=r??process.cwd();ir(o,"1.6.0-alpha.sdk-gen");let s=Me(o).find(d=>d.name===e);if(!s)throw new Error(`No SDK named "${e}" in generatedSdks`);let a=t??await li(o,n),p=or(o,"src/generated_sdks");console.log(`
+\u2699\uFE0F  Generating "${s.name}" (${s.dataModelSpace}/${s.dataModelExternalId}@${s.dataModelVersion})...`);let{sdkDir:c,viewCount:l}=await Mn({name:s.name,space:s.dataModelSpace,dataModelExternalId:s.dataModelExternalId,dataModelVersion:s.dataModelVersion},a,p);console.log(`\u2705 Generated SDK for ${l} view(s) \u2192 ${c}`);let m=or(o,"package.json");if(Up(m)){let d=JSON.parse(Mp(m,"utf-8"));if(typeof d!="object"||d===null||Array.isArray(d))throw new Error(`package.json at "${m}" is not a JSON object`);let u=d,f=typeof u.dependencies=="object"&&u.dependencies!==null?{...u.dependencies}:{},g=[];f.graphql||(f.graphql="^16.0.0",g.push("graphql")),f["graphql-tag"]||(f["graphql-tag"]="^2.12.0",g.push("graphql-tag"));let h=n.linkLocal?`file:${or(jp(import.meta.url),"../../..")}`:"^1.6.0-alpha.sdk-gen";(!f["@cognite/cli"]||n.linkLocal)&&(f["@cognite/cli"]=h,g.push("@cognite/cli")),g.length>0&&(u.dependencies=f,Vp(m,JSON.stringify(u,null,2)+`
+`,"utf-8"),console.log(`
+\u{1F4E6} Updated package.json: ${g.join(", ")} (run npm install)`))}}i(pi,"generate");function ci(e){return{interactive:e.interactive,orgHint:e.org,linkLocal:e.linkLocal}}i(ci,"sdkCommandOptions");function di(e){e.command("sdk").summary("Add or regenerate typed GraphQL SDKs from CDF data models").description(`Add or regenerate typed GraphQL SDKs from CDF data models.
+Run with --interactive for the guided wizard (pick a data model, update app.json, generate types).`).option("--interactive","Run the guided wizard (pick data model, update app.json, generate types)").option("--org <org>","Organization hint for login (only with --interactive)").option("--link-local","Point @cognite/cli at the local monorepo package (default: use published version from npm)").passThroughOptions().addHelpText("after",`
+Examples:
+  npx @cognite/cli apps sdk --interactive              Guided setup: pick a data model, add to app.json, generate types
+  npx @cognite/cli apps sdk generate                   Regenerate types for SDKs already in app.json
+  npx @cognite/cli apps sdk generate my-sdk            Regenerate a specific SDK by name
+
+Without --interactive, this command only shows help. Use --interactive for the guided wizard.
+Non-interactive auth for generate uses the same env vars as apps deploy (COGNITE_TOKEN or deployment credentials).`).action(async function(r){if(!r.interactive){this.outputHelp();return}let n=process.cwd(),o=ci(r);try{let{sdkName:s,client:a}=await qp(n,o);await pi(s,a,n,o)}catch(s){if(s instanceof je){console.log(`
+Cancelled.
+`),process.exitCode=0;return}throw s}}).command("generate [name]").description("Regenerate TypeScript types for an existing SDK from app.json").option("--interactive","Authenticate via browser login (same as apps deploy --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").option("--link-local","Point @cognite/cli at the local monorepo package (default: use published version from npm)").action(async(r,n)=>{let o=process.cwd(),s=ci(n),a=Me(o);if(a.length===0)throw new Error('No generatedSdks entries found in app.json. Run "cognite apps sdk --interactive" first.');let p=r??(a.length===1?a[0].name:(await sr("Which SDK to regenerate?",a,c=>c.name)).name);await pi(p,void 0,o,s)})}i(di,"registerSdkCommand");import{existsSync as hc,readFileSync as Sc}from"fs";import{join as wc,resolve as wt}from"path";import{verifyBundle as vc}from"@cognite/app-sdk/codesigning";import{decodeProtectedHeader as kc}from"jose";import dr from"enquirer";import{email as Qp,pipe as Jp,safeParse as Yp,string as zp}from"valibot";var Wp=Jp(zp(),Qp());function Ae(e,t="email"){let r=e.trim();if(!r)throw new Error(`${t} is required`);if(!Yp(Wp,r).success)throw new Error(`${t} must look like an email (user@example.com); got "${e}"`);return r}i(Ae,"parseEmail");function Ie(e,t="--expires"){let r=Number(e);if(!Number.isInteger(r)||r<1||r>12)throw new Error(`${t} must be an integer between 1 and 12 (months); got "${e}"`);return r}i(Ie,"parseExpiryMonths");import{execFileSync as Ke}from"child_process";function dt(e={}){let{execFileSync:t=Ke}=e;try{return t("git",["--version"],{stdio:"ignore"}),!0}catch{return!1}}i(dt,"isGitInstalled");function mt(e,t={}){let{execFileSync:r=Ke}=t;try{return r("git",["-C",e,"status"],{stdio:"ignore"}),!0}catch{return!1}}i(mt,"isInsideGitRepo");function mi(e,t={}){let{execFileSync:r=Ke}=t;r("git",["-C",e,"init"],{stdio:"pipe"}),r("git",["-C",e,"add","."],{stdio:"pipe"}),r("git",["-C",e,"commit","-m","Initial commit","--no-gpg-sign","--no-verify"],{stdio:"pipe"})}i(mi,"gitInitAndCommit");function ui(e={}){let{execFileSync:t=Ke}=e;try{return String(t("git",["config","--get","user.name"],{encoding:"utf-8",stdio:["ignore","pipe","ignore"]})).trim()||void 0}catch{return}}i(ui,"gitUserName");function gi(e={}){let{execFileSync:t=Ke}=e;try{return String(t("git",["config","--get","user.email"],{encoding:"utf-8",stdio:["ignore","pipe","ignore"]})).trim()||void 0}catch{return}}i(gi,"gitUserEmail");var ut=3,fi="Signing identity (kid) \u2014 e.g. jsmith-dev-001 (lowercase letters, digits, hyphens)",yi=`Key expiry in months (${1}-${12})`,hi="Email address for the registry entry",Si=`Passphrase for the encrypted private key (min ${15} chars)`,wi="Confirm passphrase",vi=i(()=>`Passphrase must be at least ${15} characters`,"passphraseTooShortMsg"),ki=i(e=>`Passphrases do not match (attempt ${e}/${ut}).
+`,"passphraseMismatchMsg"),Ci=`Passphrase confirmation failed after ${ut} attempts`,xi=i(e=>`A signing key with kid "${e}" already exists. Overwrite it?`,"confirmOverwriteMsg"),Ei="How would you like to submit your key registration?",bi="Open in browser",Pi="Copy link to clipboard";async function gt(e){return dr.prompt(e)}i(gt,"defaultPrompt");function mr(e){return t=>{try{return e(t),!0}catch(r){return r instanceof Error?r.message:"Invalid"}}}i(mr,"parserAsValidator");var Zp=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;function fe(e){let t=e.trim();if(!t)throw new Error("--kid must not be empty");if(t.length>64)throw new Error("--kid must be 64 characters or fewer");if(!Zp.test(t))throw new Error("--kid must contain only lowercase letters, digits, and hyphens, and must not start or end with a hyphen (e.g. jsmith-dev-001)");return t}i(fe,"parseKid");async function Ai(e={}){let{prompt:t=gt}=e,{kid:r}=await t({type:"input",name:"kid",message:fi,validate:mr(fe)});return fe(r)}i(Ai,"promptKid");async function Ii(e={}){let{prompt:t=i(n=>dr.prompt(n),"prompt")}=e,{action:r}=await t({type:"select",name:"action",message:Ei,choices:[{name:"browser",message:bi},{name:"clipboard",message:Pi}]});if(r!=="browser"&&r!=="clipboard")throw new Error(`Unexpected Zendesk action: ${r}`);return r}i(Ii,"promptZendeskAction");async function Di(e={}){let{prompt:t=gt}=e,{months:r}=await t({type:"input",name:"months",message:yi,initial:String(6),validate:mr(n=>Ie(n,"expiry"))});return Ie(r,"expiry")}i(Di,"promptExpiryMonths");async function $i(e={}){let{prompt:t=gt,gitUserEmail:r=gi}=e,{email:n}=await t({type:"input",name:"email",message:hi,initial:r(),validate:mr(o=>Ae(o,"email"))});return Ae(n,"email")}i($i,"promptEmail");async function Ri(e={}){let{prompt:t=gt,stderr:r=process.stderr}=e;for(let n=1;n<=ut;n+=1){let{passphrase:o}=await t({type:"password",name:"passphrase",message:Si,validate:i(a=>a.length>=15?!0:vi(),"validate")}),{confirm:s}=await t({type:"password",name:"confirm",message:wi});if(o===s)return k.from(o);r.write(ki(n))}throw new Error(Ci)}i(Ri,"promptPassphrase");async function Ti(e,t={}){let{prompt:r=i(o=>dr.prompt(o),"prompt")}=t,{confirmed:n}=await r({type:"confirm",name:"confirmed",message:xi(e),initial:!1});return n}i(Ti,"promptConfirmOverwrite");import{existsSync as ac,readdirSync as pc,readFileSync as cc}from"fs";import{join as gr}from"path";import{execFile as ec}from"child_process";import{promisify as tc}from"util";var Fi="cognite-flows",rc=tc(ec),Oi=i((e,t)=>rc(e,t),"defaultExecFile"),nc=-25300,ic=nc&255;function oc(e){if(!(e instanceof Error)||!("code"in e)||e.code!==ic)return!1;let t="stderr"in e?String(e.stderr):"";return/could not be found/i.test(t)||t===""}i(oc,"isKeychainNotFoundError");async function Li(e,t,r={}){let n=t.expose();if(!_("macos",r))throw new Error("Keychain storage is only supported on macOS");let{execFile:o=Oi}=r;await o("security",["add-generic-password","-a",e,"-s",Fi,"-w",Buffer.from(n,"utf-8").toString("base64"),"-U"])}i(Li,"storeKeyInKeychain");async function ft(e,t={}){if(!_("macos",t))return null;let{execFile:r=Oi}=t;try{let{stdout:n}=await r("security",["find-generic-password","-a",e,"-s",Fi,"-w"]);return k.from(Buffer.from(n.trim(),"base64").toString("utf-8"))}catch(n){if(oc(n))return null;throw n}}i(ft,"readKeyFromKeychain");import{homedir as sc}from"os";import{join as ur}from"path";function D(e={}){let{env:t=process.env,homedir:r=sc}=e,n=t.COGNITE_CLI_HOME?.trim()||ur(r(),".cognite-cli");return{home:n,keysDir:ur(n,"keys"),sessionFile:ur(n,"session.json")}}i(D,"getConfig");var se=".pub.pem",fr=".key.jwe",yr=".meta.json";function yt(e){switch(e.kind){case"keychain":return"Keychain";case"encrypted-file":return e.path;case"public-only":return"public-only (private key missing)"}}i(yt,"formatLocalKeySource");function lc(e){return{existsSync:e.existsSync??ac,readdirSync:e.readdirSync??pc,readFileSync:e.readFileSync??((t,r)=>cc(t,r)),isOS:e.isOS??(t=>_(t)),readKeyFromKeychain:e.readKeyFromKeychain??(t=>ft(t))}}i(lc,"resolveDeps");function dc(e){try{let t=JSON.parse(e);if(typeof t=="object"&&t!==null&&!Array.isArray(t)&&"email"in t&&typeof t.email=="string")return t.email}catch{}}i(dc,"readEmailFromMeta");function mc(e,t){return t.existsSync(e)?t.readdirSync(e).filter(r=>r.endsWith(se)):[]}i(mc,"publicKeyEntries");function uc(e){return e.slice(0,-se.length)}i(uc,"kidFromPublicKeyFilename");async function gc(e,t,r){if(r.isOS("macos")&&await r.readKeyFromKeychain(e).catch(()=>null)!==null)return{kind:"keychain"};let n=gr(t,`${e}${fr}`);return r.existsSync(n)?{kind:"encrypted-file",path:n}:{kind:"public-only"}}i(gc,"resolveSource");async function ht(e=D().keysDir,t={}){let r=lc(t),n=new Set,o=mc(e,r).flatMap(s=>{let a=uc(s);return!a||n.has(a)?[]:(n.add(a),[{kid:a,entry:s}])});return Promise.all(o.map(async({kid:s,entry:a})=>{let p=await gc(s,e,r),c=gr(e,`${s}${yr}`),l;try{l=dc(r.readFileSync(c,"utf8"))}catch{}return{kid:s,source:p,publicKeyPath:gr(e,a),email:l}}))}i(ht,"discoverLocalKeys");import{createReadStream as fc}from"fs";function St(e){let t=fc(e);return new ReadableStream({start(r){t.on("data",n=>{let o=typeof n=="string"?Buffer.from(n):n;r.enqueue(new Uint8Array(o))}),t.on("end",()=>r.close()),t.on("error",n=>r.error(n))},cancel(){t.destroy()}})}i(St,"createWebStreamFromFile");import yc from"path";var Ni=".cognite-bundles";function _i(e,t){return`${e}-${t}.zip`}i(_i,"bundleFileName");function Z(e,t,r){return yc.join(e,Ni,_i(t,r))}i(Z,"bundlePath");var Ui=[".dev.sig",".cert.sig",".sig"];function Cc(e){return{existsSync:e.existsSync??hc,readFileSync:e.readFileSync??((t,r)=>Sc(t,r)),createBundleStream:e.createBundleStream??St,verifyBundle:e.verifyBundle??vc,loadAppConfig:e.loadAppConfig??v,defaultKeyDir:e.defaultKeyDir??(()=>D().keysDir)}}i(Cc,"resolveDeps");function xc(e,t){return Ui.map(r=>`${e}${r}`).find(r=>t(r))}i(xc,"findSiblingSignature");function Ec(e){let t=e.split(".");return t.length===3&&t.every(r=>r.length>0)}i(Ec,"isCompactJws");function bc(e){try{let t=kc(e);return typeof t.kid=="string"?t.kid:void 0}catch{return}}i(bc,"readKidFromToken");function Pc(e,t,r){try{fe(e)}catch(o){throw new y(o instanceof Error?o.message:String(o),{shouldReport:!1})}if(!r.existsSync(t))throw new y(`Key directory not found: ${t}`,{shouldReport:!1});let n=wc(t,`${e}${se}`);if(!r.existsSync(n))throw new y(`No public key found for kid "${e}" in ${t}`,{shouldReport:!1});try{return r.readFileSync(n,"utf-8")}catch(o){throw new y(`Failed to read public key file: ${n}`,{cause:o,shouldReport:!1})}}i(Pc,"resolvePublicKeyForKid");function Ac(e,t){let{payload:r,kid:n}=e;if(console.log(`Verified ${r.appId}@${r.version}`),console.log(`  kid:    ${n}`),console.log(`  hash:   ${r.bundleSha256}`),r.scopes&&r.scopes.length>0){let o=r.scopes.map(s=>`${s.org}/${s.project}`).join(", ");console.log(`  scopes: ${o}`)}t&&console.log(JSON.stringify(r,null,2))}i(Ac,"printResult");async function Mi(e,t,r={},n=process.cwd()){let o=Cc(r),s;if(e)s=wt(n,e);else{let l;try{l=o.loadAppConfig(n)}catch(m){let d=m instanceof Error?m.message:String(m);throw new y(d,{cause:m,hint:"Run this command from a Cognite app directory (one with app.json), or pass [bundle] explicitly.",shouldReport:!1})}s=Z(n,l.externalId,l.versionTag)}if(!o.existsSync(s)){let l=e?void 0:"Default derived from app.json \u2014 pass [bundle] explicitly to override.";throw new y(`Bundle not found: ${s}`,{hint:l,shouldReport:!1})}let a=t.sig?wt(n,t.sig):xc(s,o.existsSync);if(!a)throw new y("No signature file found.",{hint:`Pass --sig <path> or place one of ${Ui.map(l=>`${s}${l}`).join(", ")} next to the bundle.`,shouldReport:!1});if(!o.existsSync(a))throw new y(`Signature file not found: ${a}`,{shouldReport:!1});let p;try{p=o.readFileSync(a,"utf-8").trim()}catch(l){throw new y(`Failed to read signature file: ${a}`,{cause:l,shouldReport:!1})}if(!Ec(p))throw new y(`Malformed JWS in ${a}`,{hint:"Expected a compact JWS (header.payload.signature \u2014 three base64url segments).",shouldReport:!1});let c;if(t.key){let l=wt(n,t.key);if(!o.existsSync(l))throw new y(`Public key not found: ${l}`,{shouldReport:!1});try{c=o.readFileSync(l,"utf-8")}catch(m){throw new y(`Failed to read public key file: ${l}`,{cause:m,shouldReport:!1})}}else{let l=t.keyDir?wt(n,t.keyDir):o.defaultKeyDir(),m=bc(p);if(!m)throw new y("Token header has no kid.",{hint:"Pass --key <path> to a public key PEM.",shouldReport:!1});c=Pc(m,l,o)}try{let l=await o.verifyBundle({token:p,publicKeyPem:c,bundleStream:o.createBundleStream(s)});Ac(l,t.verbose??!1)}catch(l){let m=l instanceof Error?l.message:String(l);throw new y(`Bundle rejected: ${m}`,{shouldReport:!1})}}i(Mi,"handleVerify");function Vi(e,t={}){return e.command("verify [bundle]").description("Verify a signed app bundle locally (default: derived from app.json)").option("-s, --sig <path>","Path to the signature file (default: sibling .dev.sig / .cert.sig / .sig)").option("--key <path>","Path to a public key PEM file").option("--key-dir <path>","Directory of <kid>.pub.pem files \u2014 kid is read from the token header (default: $COGNITE_CLI_HOME/keys)").option("-v, --verbose","Print the full decoded payload after verification").addHelpText("after",`
+Bundles are stored in .cognite-bundles/<externalId>-<versionTag>.zip by default.
+
+Examples:
+  cognite apps verify                                                        Verify default bundle (path from app.json)
+  cognite apps verify .cognite-bundles/my-app-1.0.0.zip                     Verify a specific bundle
+  cognite apps verify .cognite-bundles/my-app-1.0.0.zip --sig my-app-1.0.0.zip.dev.sig  Verify with explicit signature
+  cognite apps verify .cognite-bundles/my-app-1.0.0.zip --key /path/to/pub.pem          Verify with explicit public key`).action((r,n)=>Mi(r,n,t))}i(Vi,"registerVerifyCommand");var ji="https://docs.cognite.com/cdf/access/";function U(e){return e!==null&&typeof e=="object"}i(U,"isRecord");function ye(e){return e instanceof Error&&"status"in e&&typeof e.status=="number"}i(ye,"isHttpError");function Ic(e){switch(e){case 401:return`Your credentials are invalid or expired. Check your client ID and secret.
+  See: ${ji}`;case 403:return`You don't have the required CDF capabilities. Please contact your CDF admin.
+  See: ${ji}`;default:return}}i(Ic,"httpStatusHint");function ee(e){let t=e instanceof Error?e:new Error(String(e));if(!ye(t))return null;let r=Ic(t.status);return r?Object.assign(new Error(`${t.message}
+  ${r}`),{cause:t}):null}i(ee,"enrichedHttpError");function Dc(e){if(!U(e))return null;let t=e.missing;if(Array.isArray(t))return t;let r=e.data;if(U(r)){let n=r.error;if(U(n)&&Array.isArray(n.missing))return n.missing;if(Array.isArray(r.missing))return r.missing}return null}i(Dc,"findMissingArray");function $c(e,t){if(!ye(e)||e.status!==400)return!1;let r=Dc(e);return r?r.some(n=>U(n)&&typeof n.externalId=="string"&&t.includes(n.externalId)):!1}i($c,"isMissingExternalIdError");function vt(e,t){return ye(e)&&e.status===404||$c(e,t)}i(vt,"isNotFoundError");var Hi=["DRAFT","PUBLISHED","DEPRECATED","ARCHIVED"],Gi=["ACTIVE","PREVIEW"],hr=class hr extends Error{constructor(t,r){super(`Version ${r} of app ${t} not found`),this.name="AppVersionNotFoundError",this.appExternalId=t,this.version=r}};i(hr,"AppVersionNotFoundError");var Q=hr,Sr=class Sr extends Error{constructor(t){super(`App ${t} not found`),this.name="AppNotFoundError",this.appExternalId=t}};i(Sr,"AppNotFoundError");var De=Sr;function kt(e,t){return e.includes(t)}i(kt,"includesValue");function Rc(e){return kt(Hi,e)}i(Rc,"isAppVersionLifecycleState");function Tc(e){return kt(Gi,e)}i(Tc,"isAppVersionAlias");function Fc(e){return typeof e.version=="string"&&Rc(e.lifecycleState)&&typeof e.entrypoint=="string"&&typeof e.createdTime=="number"&&typeof e.createdBy=="string"&&typeof e.appExternalId=="string"&&(e.alias===void 0||Tc(e.alias))&&(e.comment===void 0||typeof e.comment=="string")}i(Fc,"isAppVersion");function Ki(e){if(!U(e)){let t=JSON.stringify(e)?.slice(0,200)??String(e);throw new Error(`Invalid version response: expected object, got ${t}`)}if(!Fc(e)){let t=JSON.stringify(e).slice(0,300);throw new Error(`Invalid version response: missing or malformed fields. Got: ${t}`)}return e}i(Ki,"parseAppVersion");function Oc(e){if(!U(e))throw new Error("Invalid app response: not an object");let{externalId:t,name:r,description:n}=e;if(typeof t!="string")throw new Error("Invalid app response: missing externalId");if(typeof r!="string")throw new Error("Invalid app response: missing name");if(n!=null&&typeof n!="string")throw new Error("Invalid app response: malformed description");return{externalId:t,name:r,description:typeof n=="string"?n:void 0}}i(Oc,"parseAppMetadata");var wr=class wr{constructor(t){this.client=t}get appsBasePath(){return`/api/v1/projects/${encodeURIComponent(this.client.project)}/apphosting/apps`}async createApp(t,r,n){try{await this.client.post(this.appsBasePath,{data:{items:[{externalId:t,name:r,description:n}]}})}catch(o){throw ee(o)??o}}async updateApps(t){try{await this.client.post(`${this.appsBasePath}/update`,{data:{items:t}})}catch(r){throw ee(r)??r}}async getApp(t){let r=`${this.appsBasePath}/${encodeURIComponent(t)}`;try{let n=await this.client.get(r);return Oc(n.data)}catch(n){throw vt(n,[t])?new De(t):ee(n)??n}}async uploadVersion(t,r,n,o,s="index.html"){console.log(`\u{1F4E4} Uploading version ${r}...`);let a=new FormData;a.append("file",new Blob([new Uint8Array(n)]),o),a.append("version",r),a.append("entryPath",s);let p=encodeURIComponent(t),c=`${this.appsBasePath}/${p}/versions`,l=await this.client.authenticate();if(!l)throw new y("Failed to authenticate for upload",{hint:"Check your credentials and try again."});let m=k.from(l),d=`${this.client.getBaseUrl()}${c}`,u=new AbortController,f=setTimeout(()=>u.abort(),300*1e3),g;try{g=await fetch(d,{method:"POST",headers:{Authorization:`Bearer ${m.expose()}`},body:a,signal:u.signal})}catch(h){throw h instanceof Error&&h.name==="AbortError"?new y("Upload timed out after 5 minutes",{hint:"The upload took longer than 5 minutes. Try again \u2014 if it keeps timing out, check your network speed or bundle size."}):new y(`Failed to upload version to ${d}`,{cause:h,hint:"Check your network connection. Uploads can also fail behind a proxy that blocks multipart POST requests."})}finally{clearTimeout(f)}if(!g.ok){let h=await g.text(),w;try{w=JSON.parse(h)}catch{}let C=h;if(U(w)){let M=w.error;if(typeof M=="string")C=M;else if(U(M)){let H=M.message,x=M.code;C=typeof H=="string"?H:x!=null?`Unknown error (code: ${x})`:h}else{let H=w.message;C=typeof H=="string"?H:h}}let S=g.headers.get("x-request-id"),ae=S?` | X-Request-ID: ${S}`:"",re=U(w)?w:h;throw new le(`Upload failed: ${g.status} \u2014 ${C}${ae}`,{httpStatusCode:g.status,requestUrl:d,responseBody:re})}console.log(`\u2705 Version ${r} uploaded`)}async getVersion(t,r){let n=encodeURIComponent(t),o=encodeURIComponent(r),s=`${this.appsBasePath}/${n}/versions/${o}`;try{let a=await this.client.get(s);return Ki(a.data)}catch(a){throw vt(a,[t,r])?new Q(t,r):ee(a)??a}}async getActiveVersion(t){let r=encodeURIComponent(t),n=`${this.appsBasePath}/${r}/versions/list`;try{let o=await this.client.post(n,{data:{filter:{aliases:["ACTIVE"]}}});if(!U(o.data)||!Array.isArray(o.data.items))throw new Error("Invalid versions/list response: expected an object with an items array");let{items:s}=o.data;if(s.length===0)return null;if(s.length>1)throw new Error(`Unexpected response: ${s.length} versions have the ACTIVE alias, expected at most 1`);return Ki(s[0])}catch(o){if(vt(o,[t]))return null;throw ee(o)??o}}async updateVersions(t,r){let n=encodeURIComponent(t),o=`${this.appsBasePath}/${n}/versions/update`;try{await this.client.post(o,{data:{items:r}})}catch(s){throw ee(s)??s}}async submitSignatures(t,r,n){let o=encodeURIComponent(t),s=encodeURIComponent(r),a=`${this.appsBasePath}/${o}/versions/${s}/signatures`;try{await this.client.post(a,{data:{items:n}})}catch(p){throw ee(p)??p}}async listSignatures(t,r){let n=encodeURIComponent(t),o=encodeURIComponent(r),s=`${this.appsBasePath}/${n}/versions/${o}/signatures/list`;try{let a=await this.client.post(s,{data:{}});return _c(a.data)}catch(a){throw ee(a)??a}}};i(wr,"AppHostingApi");var Ct=wr,Lc=["VALID","REVOKED","EXPIRED","SIGNED_BEFORE_KEY_ISSUED","IAT_IN_FUTURE","BUNDLE_TOO_OLD","KEY_NOT_IN_REGISTRY"],Nc=["developer","certifier"];function _c(e){if(!U(e))throw new Error("Invalid signatures response: expected an object with an items array");let{items:t}=e;if(!Array.isArray(t))throw new Error("Invalid signatures response: items property is missing or not an array");return t.flatMap(r=>{let n=Uc(r);return n?[n]:[]})}i(_c,"parseStoredSignatures");function Uc(e){if(!U(e))return null;let{signerKid:t,signerRole:r,signatureIat:n,receivedAt:o,createdTime:s,status:a}=e;return typeof t!="string"||t===""||!kt(Nc,r)||typeof n!="number"||typeof o!="number"||typeof s!="number"||!kt(Lc,a)?null:{signerKid:t,signerRole:r,signatureIat:n,receivedAt:o,createdTime:s,status:a}}i(Uc,"parseStoredSignature");function vr(e,t){let r=[];e.name!==t.name&&r.push({field:"name",remote:e.name,local:t.name});let n=e.description??"";return n!==t.description&&r.push({field:"description",remote:n,local:t.description}),r}i(vr,"diffAppMetadata");function Mc(e){let t=["Cannot deploy: metadata in app.json differs from what's deployed:"];for(let{field:r,remote:n,local:o}of e){let s=`${r}:`.padEnd(14);t.push(`   ${s}"${n}" \u2192 "${o}"`)}return t.join(`
+`)}i(Mc,"formatMetadataDriftError");var kr=class kr{constructor(t){this.api=new Ct(t)}getVersion(t,r){return this.api.getVersion(t,r)}uploadVersion(t,r,n,o,s){return this.api.uploadVersion(t,r,n,o,s)}async ensureApp(t,r,n){console.log("\u{1F50D} Ensuring app exists...");try{await this.api.createApp(t,r,n),console.log(`\u2705 App '${t}' created`)}catch(o){if(ye(o)&&o.status===409){console.log(`\u2705 App '${t}' already exists`),await this.checkMetadataDrift(t,r,n);return}throw o}}async checkMetadataDrift(t,r,n){let o;try{o=await this.getApp(t)}catch{return}let s=vr(o,{name:r,description:n});if(s.length!==0)throw new y(Mc(s),{hint:"Run npx @cognite/cli apps metadata update to sync before deploying",shouldReport:!1})}getApp(t){return this.api.getApp(t)}async updateAppMetadata(t,r,n){await this.api.updateApps([{externalId:t,update:{name:{set:r},description:n?{set:n}:{setNull:!0}}}])}async submitSignatures(t,r,n){n.length!==0&&(console.log(`\u{1F50F} Submitting ${n.length} signature${n.length===1?"":"s"} for version ${r}...`),await this.api.submitSignatures(t,r,n),console.log("\u2705 Signatures stored"))}listSignatures(t,r){return this.api.listSignatures(t,r)}async publishVersion(t,r){await this.api.updateVersions(t,[{version:r,update:{lifecycleState:{set:"PUBLISHED"}}}])}async publishAndActivate(t,r){console.log(`\u{1F680} Publishing and activating version ${r}...`),await this.api.updateVersions(t,[{version:r,update:{lifecycleState:{set:"PUBLISHED"},alias:{set:"ACTIVE"}}}]),console.log(`\u2705 Version ${r} is now PUBLISHED and ACTIVE`)}getActiveVersion(t){return this.api.getActiveVersion(t)}async deactivateVersion(t,r){await this.api.updateVersions(t,[{version:r,update:{alias:{setNull:!0}}}])}async activateVersion(t,r){let n=null;try{n=await this.api.getActiveVersion(t)}catch{n=null}let o=n&&n.version!==r?n.version:void 0;return await this.api.updateVersions(t,[{version:r,update:{alias:{set:"ACTIVE"}}}]),{supersededVersion:o}}async deploy(t,r,n,o,s,a,p=!1){console.log(`
+\u{1F680} Deploying application via App Hosting API...
+`),await this.ensureApp(t,r,n),await this.uploadVersion(t,o,s,a),p&&await this.publishAndActivate(t,o),console.log(`
+\u2705 Deployment successful!`)}};i(kr,"AppHostingClient");var E=kr;import Bi from"enquirer";var qi="Enter custom target...";function Qi(e,t){let r=t.map((n,o)=>`  ${o}: ${n.org}/${n.project}`).join(`
 `);throw new Error(`Deployment "${e}" not found. Available deployments:
-${r}`)}o(tr,"deploymentNotFoundError");function b(e,t){if(e.length===0)throw new Error("No deployments configured in app.json");if(t===void 0)return e[0];if(/^\d+$/.test(t)){let n=e[Number.parseInt(t)];if(n)return n;tr(t,e)}let r=e.find(n=>n.project===t||`${n.org}/${n.project}`===t);if(r)return r;tr(t,e)}o(b,"findDeployment");function $(e){let t=[];return e.deployClientId||t.push("deployClientId"),e.deploySecretName||t.push("deploySecretName"),t}o($,"getMissingCredentials");async function R(e,t){if(t.baseUrl&&t.project)return{org:t.org??"",project:t.project,baseUrl:t.baseUrl,deployClientId:"",deploySecretName:"",published:!1,idpType:"cdf"};if(t.deployment!==void 0)return b(e.deployments,t.deployment);let r=[...e.deployments.map(s=>`${s.org}/${s.project}`),er],{selected:n}=await Qt.prompt({type:"select",name:"selected",message:"Select deployment target",choices:r});if(n!==er){let s=e.deployments.find(a=>`${a.org}/${a.project}`===n);if(s)return s;throw new Error(`Deployment "${n}" could not be resolved from app.json.`)}let i=await Qt.prompt([{type:"input",name:"baseUrl",message:"CDF Base URL",initial:"https://api.cognitedata.com"},{type:"input",name:"project",message:"CDF Project",validate:o(s=>s?!0:"Project is required","validate")},{type:"input",name:"org",message:"Organization (for login hint)",initial:""}]);return{org:i.org||"",project:i.project,baseUrl:i.baseUrl,deployClientId:"",deploySecretName:"",published:!1,idpType:"cdf"}}o(R,"resolveDeployment");import{existsSync as si}from"fs";import{resolve as ai}from"path";import{config as pi}from"dotenv";function T(e,t={existsSync:si,config:pi}){let r=ai(e,".env");t.existsSync(r)&&(console.log(`Loading environment variables from ${r}`),t.config({path:r}))}o(T,"loadEnvFile");function F(e){e.infra!=="appsApi"&&(console.error(`
+${r}`)}i(Qi,"deploymentNotFoundError");function A(e,t){if(e.length===0)throw new Error("No deployments configured in app.json");if(t===void 0)return e[0];if(/^\d+$/.test(t)){let n=e[Number.parseInt(t)];if(n)return n;Qi(t,e)}let r=e.find(n=>n.project===t||`${n.org}/${n.project}`===t);if(r)return r;Qi(t,e)}i(A,"findDeployment");function $(e){let t=[];return e.deployClientId||t.push("deployClientId"),e.deploySecretName||t.push("deploySecretName"),t}i($,"getMissingCredentials");async function R(e,t){if(t.baseUrl&&t.project)return{org:t.org??"",project:t.project,baseUrl:t.baseUrl,deployClientId:"",deploySecretName:"",published:!1,idpType:"cdf"};if(t.deployment!==void 0)return A(e.deployments,t.deployment);let r=[...e.deployments.map(s=>`${s.org}/${s.project}`),qi],{selected:n}=await Bi.prompt({type:"select",name:"selected",message:"Select deployment target",choices:r});if(n!==qi){let s=e.deployments.find(a=>`${a.org}/${a.project}`===n);if(s)return s;throw new Error(`Deployment "${n}" could not be resolved from app.json.`)}let o=await Bi.prompt([{type:"input",name:"baseUrl",message:"CDF Base URL",initial:"https://api.cognitedata.com"},{type:"input",name:"project",message:"CDF Project",validate:i(s=>s?!0:"Project is required","validate")},{type:"input",name:"org",message:"Organization (for login hint)",initial:""}]);return{org:o.org||"",project:o.project,baseUrl:o.baseUrl,deployClientId:"",deploySecretName:"",published:!1,idpType:"cdf"}}i(R,"resolveDeployment");function T(e){e.infra!=="appsApi"&&(console.error(`
 \u26A0\uFE0F  Legacy infrastructure is no longer supported.
 
 Your app.json is missing \`"infra": "appsApi"\`, which means it was created for
 the old CDF Application Registry. This deploy path has been removed.
 
 To migrate: add \`"infra": "appsApi"\` to your app.json, wire up the correct authentication and re-deploy.
-`),process.exit(1))}o(F,"assertAppHostingInfra");async function ci(e){let t=process.cwd();T(t);let r=v(t);F(r);let n=e.interactive?await R(r,e):b(r.deployments,e.deployment);if(!e.interactive){let d=$(n);if(d.length>0)throw new Error(`Deployment ${n.org}/${n.project} is missing ${d.join(" and ")} in app.json. Use \`npx @cognite/cli@latest apps activate --interactive\` for browser-based authentication instead.`)}let i=await I(n,{interactive:e.interactive,appId:r.externalId,orgHint:e.org}),s=new E(i),{externalId:a,versionTag:p}=r,c;try{c=await s.getVersion(a,p)}catch(d){throw d instanceof j?new Error(`Version ${p} of ${a} has not been deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):d}if(c.alias==="ACTIVE"){console.log(`  ${a} @ ${p} is already ACTIVE \u2014 nothing to do.`);return}if(c.lifecycleState==="DEPRECATED"||c.lifecycleState==="ARCHIVED")throw new Error(`Cannot activate ${a} @ ${p}: version is ${c.lifecycleState} (terminal).`);c.lifecycleState==="DRAFT"&&(await s.publishVersion(a,p),console.log(`\u2713 Published    ${a} @ ${p} is now PUBLISHED`));let{supersededVersion:l}=await s.activateVersion(a,p);console.log(`\u2713 Activated    ${a} @ ${p} is now ACTIVE`),l&&console.log(`  Superseded  ${l} \u2192 PUBLISHED`)}o(ci,"handleActivate");function rr(e){return e.command("activate").description("Activate the current app version (publish if needed, then set ACTIVE alias)").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
+`),process.exit(1))}i(T,"assertAppHostingInfra");async function Vc(e){let t=process.cwd();P(t);let r=v(t);T(r);let n=e.interactive?await R(r,e):A(r.deployments,e.deployment);if(!e.interactive){let m=$(n);if(m.length>0)throw new Error(`Deployment ${n.org}/${n.project} is missing ${m.join(" and ")} in app.json. Use \`npx @cognite/cli@latest apps activate --interactive\` for browser-based authentication instead.`)}let o=await b(n,{interactive:e.interactive,appId:r.externalId,orgHint:e.org}),s=new E(o),{externalId:a,versionTag:p}=r,c;try{c=await s.getVersion(a,p)}catch(m){throw m instanceof Q?new Error(`Version ${p} of ${a} has not been deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):m}if(c.alias==="ACTIVE"){console.log(`  ${a} @ ${p} is already ACTIVE \u2014 nothing to do.`);return}if(c.lifecycleState==="DEPRECATED"||c.lifecycleState==="ARCHIVED")throw new Error(`Cannot activate ${a} @ ${p}: version is ${c.lifecycleState} (terminal).`);c.lifecycleState==="DRAFT"&&(await s.publishVersion(a,p),console.log(`\u2713 Published    ${a} @ ${p} is now PUBLISHED`));let{supersededVersion:l}=await s.activateVersion(a,p);console.log(`\u2713 Activated    ${a} @ ${p} is now ACTIVE`),l&&console.log(`  Superseded  ${l} \u2192 PUBLISHED`)}i(Vc,"handleActivate");function Ji(e){return e.command("activate").description("Activate the current app version (publish if needed, then set ACTIVE alias)").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
 Examples:
   npx @cognite/cli apps activate .                   Activate using env-var auth
-  npx @cognite/cli apps activate . --interactive     Activate using browser auth (no secrets needed)`).action((t,r)=>ci(r))}o(rr,"registerActivateCommand");import{basename as wr,dirname as Bi,normalize as Gi,resolve as xe}from"path";import{fileURLToPath as Yi,pathToFileURL as qi}from"url";import{Logger as Ji,runner as zi}from"hygen";import{execFileSync as le}from"child_process";function ve(e={}){let{execFileSync:t=le}=e;try{return t("git",["--version"],{stdio:"ignore"}),!0}catch{return!1}}o(ve,"isGitInstalled");function Ce(e,t={}){let{execFileSync:r=le}=t;try{return r("git",["-C",e,"status"],{stdio:"ignore"}),!0}catch{return!1}}o(Ce,"isInsideGitRepo");function nr(e,t={}){let{execFileSync:r=le}=t;r("git",["-C",e,"init"],{stdio:"pipe"}),r("git",["-C",e,"add","."],{stdio:"pipe"}),r("git",["-C",e,"commit","-m","Initial commit","--no-gpg-sign","--no-verify"],{stdio:"pipe"})}o(nr,"gitInitAndCommit");function or(e={}){let{execFileSync:t=le}=e;try{return String(t("git",["config","--get","user.name"],{encoding:"utf-8",stdio:["ignore","pipe","ignore"]})).trim()||void 0}catch{return}}o(or,"gitUserName");function ir(e={}){let{execFileSync:t=le}=e;try{return String(t("git",["config","--get","user.email"],{encoding:"utf-8",stdio:["ignore","pipe","ignore"]})).trim()||void 0}catch{return}}o(ir,"gitUserEmail");import{safeParse as li}from"valibot";function de(e,t){return r=>{let n=li(t,r);return n.success?!0:`${e} ${n.issues[0].message}`}}o(de,"toPromptValidator");var sr={name:de("App name",Ye),displayName:de("Display name",Ge),baseUrl:de("Base URL",qe),org:de("Org",Je),project:de("Project",ze)};function di(e,t){return e?async r=>{let n=t(r);return n===!0?e(r):n}:t}o(di,"composeValidators");function Ee(e){return e.map(t=>{if(!(t.name in sr))return t;let r=sr[t.name];return{...t,validate:di(t.validate,r)}})}o(Ee,"applySchemaValidators");import{basename as ar}from"path";import pr from"enquirer";function et(e){return e.replace(/[A-Z]/g,(t,r)=>r===0?t.toLowerCase():`-${t.toLowerCase()}`)}o(et,"kebabCase");var mi={type:"confirm",name:"useSpecKit",message:["Enable spec-driven development?","  Adds the github/spec-kit slash commands (/speckit.specify, .clarify, .plan, .tasks, .implement)","  to your app for use in Claude Code or Cursor. They walk you through writing SPEC.md and","  generating a plan, tasks, and implementation."].join(`
-`),initial:!1};async function ui(e,t,r){return e!==void 0?e:t?!!(await r([mi])).useSpecKit:!1}o(ui,"resolveSpecKit");function gi(e){return typeof e=="function"}o(gi,"isFunctionInitial");function cr(e){return(e??"").trim().replace(/\/+$/,"")||"api"}o(cr,"normalizeCluster");function lr({isCurrentDir:e,dirName:t,onAppName:r,onUseSpecKit:n,presets:i={},specKit:s,prompt:a=pr.prompt.bind(pr)}){return()=>({prompt:o(async p=>{if(!Array.isArray(p))return a([p]);let c=Object.fromEntries(Object.entries(i).filter(w=>w[1]!==void 0)),l=Object.keys(c).length>0,d=e?ar(process.cwd()):t?ar(t):null,m=l&&d!==null,y=!m&&d?p.map(w=>w.name==="name"?{...w,initial:d}:w):p,g=Ee(y),u=m&&d?{...c,name:d}:c,S=new Set(Object.keys(u)),h=g.filter(w=>!S.has(w.name)),k=h.findIndex(w=>w.name==="baseUrl"),f;if(m){let w=cr(u.cluster),H=o(C=>gi(C.initial)?C.initial():C.initial,"resolveInitial"),te=o(C=>{if(C.name==="baseUrl")return`https://${w}.cognitedata.com`;let Y=H(C);if(Y===void 0)throw new Error(`Non-interactive mode: --${et(C.name)} has no default. Pass it as a flag.`);return Y},"deriveValue");f=Object.fromEntries(h.map(C=>[C.name,te(C)]))}else if(k!==-1){let w=h.filter(A=>A.name!=="baseUrl"),H=w.length>0?await a(w):{},te=typeof H.cluster=="string"?H.cluster:"",Y=`https://${cr(te||u.cluster)}.cognitedata.com`,q=h[k],J=await a([{...q,initial:Y}]);f={...H,...J}}else f=h.length>0?await a(h):{};let U={...u,...f},x=typeof U.name=="string"?U.name:"";x&&r(x);let ae=await ui(s,!m&&h.length>0,a);return n?.(ae),{...U,name:x,useCurrentDir:e,directoryName:e?void 0:t??void 0,useSpecKit:ae}},"prompt")})}o(lr,"createAppPrompter");async function dr(e,t,r){let n=[];Object.values(t).some(s=>s!==void 0)&&r!==null&&n.push({key:"name",value:r,label:"directory"});for(let[s,a]of Object.entries(t))a!==void 0&&n.push({key:s,value:a,label:`--${et(s)}`});for(let{key:s,value:a,label:p}of n){let c=e.find(d=>d.name===s)?.validate;if(!c)continue;let l=await c(a);if(l!==!0)throw new Error(`Invalid ${p}: ${l}`)}}o(dr,"validatePresets");import{cpSync as tt,existsSync as vi,mkdirSync as rt,writeFileSync as Ci}from"fs";import{dirname as Pe,posix as Ei,resolve as O}from"path";import{fileURLToPath as ur}from"url";import{copyFileSync as fi,symlinkSync as yi}from"fs";import{dirname as hi,join as Si}from"path";function wi(e){if(e&&typeof e=="object"&&"code"in e&&typeof e.code=="string")return e.code}o(wi,"errno");function mr(e){return e instanceof Error?e.message:String(e)}o(mr,"messageOf");function ke({target:e,linkPath:t,label:r,symlink:n=yi,copyFile:i=fi}){try{return n(e,t),!0}catch(s){let a=wi(s);if(a==="EEXIST")return!0;let p=mr(s);if(a==="EPERM"||a==="EACCES")try{let c=Si(hi(t),e);return i(c,t),console.log(`\u2139\uFE0F  Wrote ${r} as a copy of ${e} (symlinks need Developer Mode or an elevated shell on Windows).`),!0}catch(c){return console.warn(`\u26A0\uFE0F  Could not create ${r} symlink: ${p} (copy fallback also failed: ${mr(c)})`),!1}return console.warn(`\u26A0\uFE0F  Could not create ${r} symlink:`,p),!1}}o(ke,"linkOrCopyOrWarn");var ki=O(Pe(ur(import.meta.url)),"..","..","_vendor","spec-kit"),Pi=O(Pe(ur(import.meta.url)),"..","..","_cognite-spec-extensions"),bi={branch_numbering:"sequential"},xi=[{from:"templates",to:".specify/templates"},{from:"scripts/bash",to:".specify/scripts/bash"},{from:"commands",to:".claude/commands"},{from:"commands",to:".cursor/commands"}],Ai=[{from:"commands",to:".claude/commands"},{from:"commands",to:".cursor/commands"},{from:"templates",to:".specify/templates"}];function gr({appDir:e,vendorDir:t=ki,cogniteExtensionsDir:r=Pi}){let n=O(e,".specify"),i=O(n,"memory"),s=`prepare spec-kit install for appDir=${e}`;try{for(let{from:p,to:c}of xi){let l=O(e,c);s=`copy ${p} to ${c}`,rt(Pe(l),{recursive:!0}),tt(O(t,p),l,{recursive:!0})}for(let{from:p,to:c}of Ai){let l=O(e,c);s=`copy cognite extension ${p} to ${c}`,rt(Pe(l),{recursive:!0}),tt(O(r,p),l,{recursive:!0})}let a=O(n,"extensions.yml");vi(a)||(s="write .specify/extensions.yml",tt(O(r,"extensions.yml"),a)),s=`write init-options.json under specifyDir=${n}`,Ci(O(n,"init-options.json"),`${JSON.stringify(bi,null,2)}
-`),s=`link .specify/memory/constitution.md in specifyDir=${n}`,rt(i,{recursive:!0}),ke({target:Ei.join("..","..","AGENTS.md"),linkPath:O(i,"constitution.md"),label:".specify/memory/constitution.md"})}catch(a){let p=a instanceof Error?a.message:String(a);throw new Error(`installSpecKit failed while ${s} (appDir=${e}, vendorDir=${t}): ${p}`,{cause:a})}}o(gr,"installSpecKit");import{execFileSync as be}from"child_process";import{mkdtempSync as Di,readdirSync as Ii,rmSync as $i}from"fs";import{createRequire as Ri}from"module";import{tmpdir as Ti}from"os";import{join as Fi,resolve as fr}from"path";import{InvalidArgumentError as Oi}from"commander";import _i from"enquirer";var yr="cognitedata/builder-skills",nt=["claude-code","cursor","github-copilot","opencode","codex"],Ui=Ri(import.meta.url).resolve("skills/bin/cli.mjs");function ot(e,t={}){be(process.execPath,[Ui,...e],{stdio:"inherit",cwd:process.cwd(),...t})}o(ot,"execSkillsCli");function Li(){return nt.map(e=>["add",yr,"-a",e,"--skill","*","-y"])}o(Li,"pullAllArgsPerAgent");var Ni=1e4;async function hr(e,t={}){let r=t.exec??ot,n=t.timeout??Ni,i=t.readdir??(p=>Ii(p));for(let p of Li())try{r(p,{cwd:e,timeout:n,stdio:["pipe","pipe","inherit"]})}catch(c){let l=c instanceof Error?c.message:String(c);console.warn("\u26A0\uFE0F  Could not pull skills for args ["+p.join(" ")+"]:",l)}let s=new Set;for(let p of[fr(e,".claude","skills"),fr(e,".agents","skills")])try{i(p).forEach(c=>s.add(c))}catch{}let a=s.size;a>0?console.log(`Installed ${a} skills successfully.`):console.log("No skills were installed.")}o(hr,"pullAllSkillsInto");function Ki(e){if(!/^[\w.-]+\/[\w.-]+$/.test(e))throw new Oi("Expected owner/repo format (e.g., cognitedata/builder-skills)");return e}o(Ki,"validateSource");function ji(e){let t=Di(Fi(Ti(),"skills-"));try{try{be("git",["clone","--depth","1","--filter=blob:none","--no-checkout","-q",`https://github.com/${e}.git`,t],{stdio:"ignore"})}catch{throw new Error(`Failed to clone skills repository "${e}". Please check your internet connection and ensure git is installed.`)}let r;try{r=be("git",["ls-tree","-d","--name-only","HEAD:skills"],{cwd:t})}catch{r=be("git",["ls-tree","-d","--name-only","HEAD"],{cwd:t})}return r.toString().trim().split(/\r?\n/).filter(n=>!!n&&!n.startsWith("."))}finally{$i(t,{recursive:!0,force:!0})}}o(ji,"listRemoteSkills");async function Mi(e,t={}){let r=o(p=>_i.prompt(p),"defaultPrompt"),{listSkills:n=ji,prompt:i=r}=t,s=n(e),{selected:a}=await i({type:"multiselect",name:"selected",message:"Select skills to install  (space to toggle, a to toggle all, enter to confirm)",choices:s});return a}o(Mi,"pickSkillsInteractive");function Hi(e,t,r){let n=["add",e.source,"-a",t];return e.skill?n.push("--skill",e.skill):r&&r.length>0?n.push("--skill",...r,"-y"):n.push("--skill","*","-y"),e.global&&n.push("--global"),n}o(Hi,"buildPullArgs");async function Vi(e){console.log(`Pulling skills from ${e.source}...`);let t;if(e.interactive&&!e.skill){try{t=await Mi(e.source)}catch(n){let i=n instanceof Error?n.message:String(n);console.error(`Failed to resolve skills interactively: ${i}`),process.exitCode=1;return}if(t.length===0){console.log("No skills selected.");return}}let r=!1;for(let n of nt)try{ot(Hi(e,n,t))}catch(i){let s=i instanceof Error?i.message:String(i);console.warn(`\u26A0\uFE0F  Could not pull skills for ${n}: ${s}`),r=!0}r?(console.log(`
+  npx @cognite/cli apps activate . --interactive     Activate using browser auth (no secrets needed)`).action((t,r)=>Vc(r))}i(Ji,"registerActivateCommand");import{basename as po,dirname as kl,normalize as Cl,resolve as At}from"path";import{fileURLToPath as xl,pathToFileURL as El}from"url";import{Logger as bl,runner as Pl}from"hygen";import{safeParse as jc}from"valibot";function He(e,t){return r=>{let n=jc(t,r);return n.success?!0:`${e} ${n.issues[0].message}`}}i(He,"toPromptValidator");var Yi={name:He("App name",qt),displayName:He("Display name",Bt),baseUrl:He("Base URL",Qt),org:He("Org",Jt),project:He("Project",Yt)};function Kc(e,t){return e?async r=>{let n=t(r);return n===!0?e(r):n}:t}i(Kc,"composeValidators");function xt(e){return e.map(t=>{if(!(t.name in Yi))return t;let r=Yi[t.name];return{...t,validate:Kc(t.validate,r)}})}i(xt,"applySchemaValidators");import{basename as zi}from"path";import Wi from"enquirer";function Cr(e){return e.replace(/[A-Z]/g,(t,r)=>r===0?t.toLowerCase():`-${t.toLowerCase()}`)}i(Cr,"kebabCase");var Hc={type:"confirm",name:"useSpecKit",message:["Enable spec-driven development?","  Adds the github/spec-kit slash commands (/speckit.specify, .clarify, .plan, .tasks, .implement)","  to your app for use in Claude Code or Cursor. They walk you through writing SPEC.md and","  generating a plan, tasks, and implementation."].join(`
+`),initial:!1};async function Gc(e,t,r){return e!==void 0?e:t?!!(await r([Hc])).useSpecKit:!1}i(Gc,"resolveSpecKit");function Bc(e){return typeof e=="function"}i(Bc,"isFunctionInitial");function Xi(e){return(e??"").trim().replace(/\/+$/,"")||"api"}i(Xi,"normalizeCluster");function Zi({isCurrentDir:e,dirName:t,onAppName:r,onUseSpecKit:n,presets:o={},specKit:s,prompt:a=Wi.prompt.bind(Wi)}){return()=>({prompt:i(async p=>{if(!Array.isArray(p))return a([p]);let c=Object.fromEntries(Object.entries(o).filter(x=>x[1]!==void 0)),l=Object.keys(c).length>0,m=e?zi(process.cwd()):t?zi(t):null,d=l&&m!==null,u=!d&&m?p.map(x=>x.name==="name"?{...x,initial:m}:x):p,f=xt(u),g=d&&m?{...c,name:m}:c,h=new Set(Object.keys(g)),w=f.filter(x=>!h.has(x.name)),C=w.findIndex(x=>x.name==="baseUrl"),S;if(d){let x=Xi(g.cluster),J=i(I=>Bc(I.initial)?I.initial():I.initial,"resolveInitial"),Se=i(I=>{if(I.name==="baseUrl")return`https://${x}.cognitedata.com`;let Y=J(I);if(Y===void 0)throw new Error(`Non-interactive mode: --${Cr(I.name)} has no default. Pass it as a flag.`);return Y},"deriveValue");S=Object.fromEntries(w.map(I=>[I.name,Se(I)]))}else if(C!==-1){let x=w.filter(ce=>ce.name!=="baseUrl"),J=x.length>0?await a(x):{},Se=typeof J.cluster=="string"?J.cluster:"",Y=`https://${Xi(Se||g.cluster)}.cognitedata.com`,Je=w[C],pe=await a([{...Je,initial:Y}]);S={...J,...pe}}else S=w.length>0?await a(w):{};let ae={...g,...S},re=typeof ae.name=="string"?ae.name:"";re&&r(re);let H=await Gc(s,!d&&w.length>0,a);return n?.(H),{...ae,name:re,useCurrentDir:e,directoryName:e?void 0:t??void 0,useSpecKit:H}},"prompt")})}i(Zi,"createAppPrompter");async function eo(e,t,r){let n=[];Object.values(t).some(s=>s!==void 0)&&r!==null&&n.push({key:"name",value:r,label:"directory"});for(let[s,a]of Object.entries(t))a!==void 0&&n.push({key:s,value:a,label:`--${Cr(s)}`});for(let{key:s,value:a,label:p}of n){let c=e.find(m=>m.name===s)?.validate;if(!c)continue;let l=await c(a);if(l!==!0)throw new Error(`Invalid ${p}: ${l}`)}}i(eo,"validatePresets");import{cpSync as xr,existsSync as Wc,mkdirSync as Er,writeFileSync as Xc}from"fs";import{dirname as bt,posix as Zc,resolve as K}from"path";import{fileURLToPath as ro}from"url";import{copyFileSync as qc,symlinkSync as Qc}from"fs";import{dirname as Jc,join as Yc}from"path";function zc(e){if(e&&typeof e=="object"&&"code"in e&&typeof e.code=="string")return e.code}i(zc,"errno");function to(e){return e instanceof Error?e.message:String(e)}i(to,"messageOf");function Et({target:e,linkPath:t,label:r,symlink:n=Qc,copyFile:o=qc}){try{return n(e,t),!0}catch(s){let a=zc(s);if(a==="EEXIST")return!0;let p=to(s);if(a==="EPERM"||a==="EACCES")try{let c=Yc(Jc(t),e);return o(c,t),console.log(`\u2139\uFE0F  Wrote ${r} as a copy of ${e} (symlinks need Developer Mode or an elevated shell on Windows).`),!0}catch(c){return console.warn(`\u26A0\uFE0F  Could not create ${r} symlink: ${p} (copy fallback also failed: ${to(c)})`),!1}return console.warn(`\u26A0\uFE0F  Could not create ${r} symlink:`,p),!1}}i(Et,"linkOrCopyOrWarn");var el=K(bt(ro(import.meta.url)),"..","..","_vendor","spec-kit"),tl=K(bt(ro(import.meta.url)),"..","..","_cognite-spec-extensions"),rl={branch_numbering:"sequential"},nl=[{from:"templates",to:".specify/templates"},{from:"scripts/bash",to:".specify/scripts/bash"},{from:"commands",to:".claude/commands"},{from:"commands",to:".cursor/commands"}],il=[{from:"commands",to:".claude/commands"},{from:"commands",to:".cursor/commands"},{from:"templates",to:".specify/templates"}];function no({appDir:e,vendorDir:t=el,cogniteExtensionsDir:r=tl}){let n=K(e,".specify"),o=K(n,"memory"),s=`prepare spec-kit install for appDir=${e}`;try{for(let{from:p,to:c}of nl){let l=K(e,c);s=`copy ${p} to ${c}`,Er(bt(l),{recursive:!0}),xr(K(t,p),l,{recursive:!0})}for(let{from:p,to:c}of il){let l=K(e,c);s=`copy cognite extension ${p} to ${c}`,Er(bt(l),{recursive:!0}),xr(K(r,p),l,{recursive:!0})}let a=K(n,"extensions.yml");Wc(a)||(s="write .specify/extensions.yml",xr(K(r,"extensions.yml"),a)),s=`write init-options.json under specifyDir=${n}`,Xc(K(n,"init-options.json"),`${JSON.stringify(rl,null,2)}
+`),s=`link .specify/memory/constitution.md in specifyDir=${n}`,Er(o,{recursive:!0}),Et({target:Zc.join("..","..","AGENTS.md"),linkPath:K(o,"constitution.md"),label:".specify/memory/constitution.md"})}catch(a){let p=a instanceof Error?a.message:String(a);throw new Error(`installSpecKit failed while ${s} (appDir=${e}, vendorDir=${t}): ${p}`,{cause:a})}}i(no,"installSpecKit");import{execFileSync as Pt}from"child_process";import{mkdtempSync as ol,readdirSync as sl,rmSync as al}from"fs";import{createRequire as pl}from"module";import{tmpdir as cl}from"os";import{join as ll,resolve as io}from"path";import{InvalidArgumentError as dl}from"commander";import ml from"enquirer";var oo="cognitedata/builder-skills",br=["claude-code","cursor","github-copilot","opencode","codex"],ul=pl(import.meta.url).resolve("skills/bin/cli.mjs");function Pr(e,t={}){try{Pt(process.execPath,[ul,...e],{stdio:"inherit",cwd:process.cwd(),...t,env:{...process.env,...t.env,DISABLE_TELEMETRY:"1"}})}catch(r){throw new y(`Skills CLI failed (${e.join(" ")})`,{cause:r,hint:"Check your internet connection and that git is installed, then try again."})}}i(Pr,"execSkillsCli");function gl(){return br.map(e=>["add",oo,"-a",e,"--skill","*","-y"])}i(gl,"pullAllArgsPerAgent");var fl=1e4;async function so(e,t={}){let r=t.exec??Pr,n=t.timeout??fl,o=t.readdir??(p=>sl(p));for(let p of gl())try{r(p,{cwd:e,timeout:n,stdio:["pipe","pipe","inherit"]})}catch(c){let l=c instanceof Error?c.message:String(c);console.warn("\u26A0\uFE0F  Could not pull skills for args ["+p.join(" ")+"]:",l)}let s=new Set;for(let p of[io(e,".claude","skills"),io(e,".agents","skills")])try{o(p).forEach(c=>s.add(c))}catch{}let a=s.size;a>0?console.log(`Installed ${a} skills successfully.`):console.log("No skills were installed.")}i(so,"pullAllSkillsInto");function yl(e){if(!/^[\w.-]+\/[\w.-]+$/.test(e))throw new dl("Expected owner/repo format (e.g., cognitedata/builder-skills)");return e}i(yl,"validateSource");function hl(e){let t=ol(ll(cl(),"skills-"));try{try{Pt("git",["clone","--depth","1","--filter=blob:none","--no-checkout","-q",`https://github.com/${e}.git`,t],{stdio:"ignore"})}catch{throw new Error(`Failed to clone skills repository "${e}". Please check your internet connection and ensure git is installed.`)}let r;try{r=Pt("git",["ls-tree","-d","--name-only","HEAD:skills"],{cwd:t})}catch{r=Pt("git",["ls-tree","-d","--name-only","HEAD"],{cwd:t})}return r.toString().trim().split(/\r?\n/).filter(n=>!!n&&!n.startsWith("."))}finally{al(t,{recursive:!0,force:!0})}}i(hl,"listRemoteSkills");async function Sl(e,t={}){let r=i(p=>ml.prompt(p),"defaultPrompt"),{listSkills:n=hl,prompt:o=r}=t,s=n(e),{selected:a}=await o({type:"multiselect",name:"selected",message:"Select skills to install  (space to toggle, a to toggle all, enter to confirm)",choices:s});return a}i(Sl,"pickSkillsInteractive");function wl(e,t,r){let n=["add",e.source,"-a",t];return e.skill?n.push("--skill",e.skill):r&&r.length>0?n.push("--skill",...r,"-y"):n.push("--skill","*","-y"),e.global&&n.push("--global"),n}i(wl,"buildPullArgs");async function vl(e){console.log(`Pulling skills from ${e.source}...`);let t;if(e.interactive&&!e.skill){try{t=await Sl(e.source)}catch(n){let o=n instanceof Error?n.message:String(n);console.error(`Failed to resolve skills interactively: ${o}`),process.exitCode=1;return}if(t.length===0){console.log("No skills selected.");return}}let r=!1;for(let n of br)try{Pr(wl(e,n,t))}catch(o){let s=o instanceof Error?o.message:String(o);console.warn(`\u26A0\uFE0F  Could not pull skills for ${n}: ${s}`),r=!0}r?(console.log(`
 Skills pulled with some errors (see warnings above)`),process.exitCode=1):console.log(`
-Skills pulled successfully`)}o(Vi,"handlePull");function Sr(e){let t=e.command("skills").summary("Manage AI agent skills for your app").description(`Manage AI agent skills for your app.
-Supports: ${nt.join(", ")}`).addHelpText("after",`
+Skills pulled successfully`)}i(vl,"handlePull");function ao(e){let t=e.command("skills").summary("Manage AI agent skills for your app").description(`Manage AI agent skills for your app.
+Supports: ${br.join(", ")}`).addHelpText("after",`
 Examples:
   npx @cognite/cli apps skills pull                               Pull all skills
   npx @cognite/cli apps skills pull --skill create-client-tool    Pull a specific skill
-  npx @cognite/cli apps skills list                               List installed skills`);return t.command("pull").description("Pull all skills into your project").option("--source <owner/repo>","Skills repository",Ki,yr).option("--skill <name>","Pull a specific skill by name").option("-i, --interactive","Interactively select which skills to install",!1).option("--global","Install skills globally",!1).action(Vi),t.command("list").description("List installed skills").action(()=>{ot(["list"])}),t}o(Sr,"registerSkillsCommand");var vr=xe(Bi(Yi(import.meta.url)),"..","..","_templates");async function Wi(){let e=xe(vr,"app","new","prompt.js");return(await import(qi(e).href)).default}o(Wi,"loadPromptDefs");function Xi(e,t){return!e||t?null:Gi(e)}o(Xi,"resolveDirName");function Zi(e,t,r){if(e)return{cwd:process.cwd(),display:"."};let n=t??r;if(!n)throw new Error("App creation completed without a target directory or name.");return{cwd:xe(process.cwd(),n),display:n}}o(Zi,"resolveAppLocation");function Qi(e,t,r){let n=`  npm install
-  npm run dev`,i="To deploy your app:",s="npx @cognite/cli apps deploy --interactive",a=r?`
+  npx @cognite/cli apps skills list                               List installed skills`);return t.command("pull").description("Pull all skills into your project").option("--source <owner/repo>","Skills repository",yl,oo).option("--skill <name>","Pull a specific skill by name").option("-i, --interactive","Interactively select which skills to install",!1).option("--global","Install skills globally",!1).action(vl),t.command("list").description("List installed skills").action(()=>{Pr(["list"])}),t}i(ao,"registerSkillsCommand");var co=At(kl(xl(import.meta.url)),"..","..","_templates");async function Al(){let e=At(co,"app","new","prompt.js");return(await import(El(e).href)).default}i(Al,"loadPromptDefs");function Il(e,t){return!e||t?null:Cl(e)}i(Il,"resolveDirName");function Dl(e,t,r){if(e)return{cwd:process.cwd(),display:"."};let n=t??r;if(!n)throw new Error("App creation completed without a target directory or name.");return{cwd:At(process.cwd(),n),display:n}}i(Dl,"resolveAppLocation");function $l(e,t,r){let n=`  npm install
+  npm run dev`,o="To deploy your app:",s="npx @cognite/cli apps deploy --interactive",a=r?`
 To start spec-driven development:
   Run /speckit.specify in Claude Code or Cursor and describe your app.
 `:"",p=`  # Or fully non-interactive (deploys first target from app.json):
@@ -51,7 +166,7 @@ To start spec-driven development:
 Next steps:
 ${n}
 ${a}
-${i}
+${o}
   ${s}
 ${p}
 `);return}console.log(`
@@ -63,11 +178,11 @@ Or:
   cd "${t}"
 ${n}
 ${a}
-${i}
+${o}
   cd "${t}"
   ${s}
 ${p}
-`)}o(Qi,"printSuccessMessage");async function es(e){try{console.log("\u{1F9E0} Pulling skills into your app..."),await hr(e)}catch(t){let r=t instanceof Error?t.message:String(t);console.warn("\u26A0\uFE0F  Could not pull skills:",r)}}o(es,"pullSkillsInto");function ts(e,t={}){let{isGitInstalled:r=ve,isInsideGitRepo:n=Ce,gitInitAndCommit:i=nr}=t;if(!r()){console.warn("git not found \u2014 skipping git repository initialisation");return}if(!n(e)){console.log("Initialising git repository...");try{i(e)}catch(s){let p=(s&&typeof s=="object"&&"stderr"in s&&s.stderr?String(s.stderr).trim():"")||(s instanceof Error?s.message:String(s));console.warn("Could not initialise git repository:",p)}}}o(ts,"maybeInitGit");async function rs(e,t){let r=e==="."||e==="./",n=Xi(e,r),i=null,s=!1,a={displayName:t.displayName,description:t.description,org:t.org,project:t.project,cluster:t.cluster,baseUrl:t.baseUrl},p=await Wi(),c=Ee(p),l=r?wr(process.cwd()):n?wr(n):null;await dr(c,a,l);let d=lr({isCurrentDir:r,dirName:n,onAppName:o(y=>{i=y},"onAppName"),onUseSpecKit:o(y=>{s=y},"onUseSpecKit"),presets:a,specKit:t.specKit});await zi(["app","new"],{templates:vr,cwd:process.cwd(),logger:new Ji(console.log.bind(console)),createPrompter:d,debug:!!process.env.DEBUG});let m=Zi(r,n,i);ke({target:"AGENTS.md",linkPath:xe(m.cwd,"CLAUDE.md"),label:"CLAUDE.md"}),s&&gr({appDir:m.cwd}),await es(m.cwd),ts(m.cwd),Qi(r,m.display,s)}o(rs,"handleCreate");function Cr(e){return e.command("create").description("Create a new application.").argument("[directory]","Target directory (. for current, or subdirectory name)").option("--display-name <name>","App display name (skips the prompt)").option("--description <description>","App description (skips the prompt)").option("--org <org>","Deployment org (skips the prompt)").option("--project <project>","Deployment project (skips the prompt)").option("--cluster <cluster>","CDF cluster, e.g. greenfield (skips the prompt)").option("--base-url <url>","CDF base URL, e.g. https://greenfield.cognitedata.com (skips the prompt; defaults to cluster-derived URL when omitted)").option("--spec-kit","Install spec-kit slash commands (skips the prompt)").option("--no-spec-kit","Skip spec-kit installation (skips the prompt)").addHelpText("after",`
+`)}i($l,"printSuccessMessage");async function Rl(e){try{console.log("\u{1F9E0} Pulling skills into your app..."),await so(e)}catch(t){let r=t instanceof Error?t.message:String(t);console.warn("\u26A0\uFE0F  Could not pull skills:",r)}}i(Rl,"pullSkillsInto");function Tl(e,t={}){let{isGitInstalled:r=dt,isInsideGitRepo:n=mt,gitInitAndCommit:o=mi}=t;if(!r()){console.warn("git not found \u2014 skipping git repository initialisation");return}if(!n(e)){console.log("Initialising git repository...");try{o(e)}catch(s){let p=(s&&typeof s=="object"&&"stderr"in s&&s.stderr?String(s.stderr).trim():"")||(s instanceof Error?s.message:String(s));console.warn("Could not initialise git repository:",p)}}}i(Tl,"maybeInitGit");async function Fl(e,t){let r=e==="."||e==="./",n=Il(e,r),o=null,s=!1,a={displayName:t.displayName,description:t.description,org:t.org,project:t.project,cluster:t.cluster,baseUrl:t.baseUrl},p=await Al(),c=xt(p),l=r?po(process.cwd()):n?po(n):null;await eo(c,a,l);let m=Zi({isCurrentDir:r,dirName:n,onAppName:i(u=>{o=u},"onAppName"),onUseSpecKit:i(u=>{s=u},"onUseSpecKit"),presets:a,specKit:t.specKit});await Pl(["app","new","--cliVersion","1.6.0-alpha.sdk-gen"],{templates:co,cwd:process.cwd(),logger:new bl(console.log.bind(console)),createPrompter:m,debug:!!process.env.DEBUG});let d=Dl(r,n,o);Et({target:"AGENTS.md",linkPath:At(d.cwd,"CLAUDE.md"),label:"CLAUDE.md"}),s&&no({appDir:d.cwd}),await Rl(d.cwd),Tl(d.cwd),$l(r,d.display,s)}i(Fl,"handleCreate");function lo(e){return e.command("create").description("Create a new application.").argument("[directory]","Target directory (. for current, or subdirectory name)").option("--display-name <name>","App display name (skips the prompt)").option("--description <description>","App description (skips the prompt)").option("--org <org>","Deployment org (skips the prompt)").option("--project <project>","Deployment project (skips the prompt)").option("--cluster <cluster>","CDF cluster, e.g. greenfield (skips the prompt)").option("--base-url <url>","CDF base URL, e.g. https://greenfield.cognitedata.com (skips the prompt; defaults to cluster-derived URL when omitted)").option("--spec-kit","Install spec-kit slash commands (skips the prompt)").option("--no-spec-kit","Skip spec-kit installation (skips the prompt)").addHelpText("after",`
 Non-interactive use (CI, scripts, AI agents):
   Pass [directory] plus --display-name, --description, --org, --project, --cluster, --base-url
   to skip every prompt. Missing flags fall back to the interactive prompt.
@@ -80,22 +195,22 @@ Examples:
     --display-name "My App" --description "My app" \\
     --org cog-atlas --project atlas-greenfield --cluster greenfield \\
     --base-url https://greenfield.cognitedata.com
-                                             Fully non-interactive`).action(rs)}o(Cr,"registerCreateCommand");import ns from"path";async function os(e,t,r){let n=await I(e,{interactive:t.interactive,appId:r,orgHint:t.org});return new E(n)}o(os,"defaultGetApiClient");async function is(e,t,r={}){let{loadEnvFile:n=T,loadAppConfig:i=v,getApiClient:s=os}=r,a=ns.resolve(process.cwd(),e);n(a);let p=i(a);F(p);let c=t.interactive?await R(p,t):b(p.deployments,t.deployment);if(!t.interactive){let y=$(c);if(y.length>0)throw new Error(`Deployment ${c.org}/${c.project} is missing ${y.join(" and ")} in app.json. Use \`npx @cognite/cli@latest apps deactivate --interactive\` for browser-based authentication instead.`)}let l=await s(c,t,p.externalId),{externalId:d}=p,m=await l.getActiveVersion(d);if(!m){console.log(`  ${d} has no active version \u2014 nothing to deactivate.`);return}await l.deactivateVersion(d,m.version),console.log(`\u2713 Deactivated  ${d} @ ${m.version} \u2014 active alias removed`)}o(is,"handleDeactivate");function Er(e){return e.command("deactivate").description("Deactivate the app by removing its active version from service").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
+                                             Fully non-interactive`).action(Fl)}i(lo,"registerCreateCommand");import Ol from"path";async function Ll(e,t,r){let n=await b(e,{interactive:t.interactive,appId:r,orgHint:t.org});return new E(n)}i(Ll,"defaultGetApiClient");async function Nl(e,t,r={}){let{loadEnvFile:n=P,loadAppConfig:o=v,getApiClient:s=Ll}=r,a=Ol.resolve(process.cwd(),e);n(a);let p=o(a);T(p);let c=t.interactive?await R(p,t):A(p.deployments,t.deployment);if(!t.interactive){let u=$(c);if(u.length>0)throw new Error(`Deployment ${c.org}/${c.project} is missing ${u.join(" and ")} in app.json. Use \`npx @cognite/cli@latest apps deactivate --interactive\` for browser-based authentication instead.`)}let{externalId:l}=p,m=await s(c,t,l),d=await m.getActiveVersion(l);if(!d){console.log(`  ${l} has no active version \u2014 nothing to deactivate.`);return}await m.deactivateVersion(l,d.version),console.log(`\u2713 Deactivated  ${l} @ ${d.version} \u2014 active alias removed`)}i(Nl,"handleDeactivate");function mo(e){return e.command("deactivate").description("Deactivate the app by removing its active version from service").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
 Examples:
   npx @cognite/cli apps deactivate .                   Deactivate using env-var auth
-  npx @cognite/cli apps deactivate . --interactive     Deactivate using browser auth (no secrets needed)`).action((t,r)=>is(t,r))}o(Er,"registerDeactivateCommand");import{mkdir as ms,readFile as us}from"fs/promises";import{basename as gs,dirname as fs}from"path";import{execFileSync as Ae}from"child_process";import B from"fs";import P from"path";import{parseAndValidateManifestConfig as ss}from"@cognite/app-sdk/vite";import{BlobReader as as,Uint8ArrayWriter as ps,ZipWriter as cs}from"@zip.js/zip.js";var it="package.json",st="package-lock.json",kr="manifest.json",at=".cognite",ls=[/^\.env(\..+)?$/i,/^\.secrets?$/i,/^\.token/i,/^\.cognite/i,/\.(key|pem|p12|pfx|jks|crt)$/i],pt=class pt{constructor(t="dist"){this.distPath=P.isAbsolute(t)?t:P.join(process.cwd(),t),this.appRoot=P.dirname(this.distPath)}validateBuildDirectory(){if(!B.existsSync(this.distPath))throw new Error(`Build directory "${this.distPath}" not found. Run build first.`);let t=P.join(this.appRoot,it);if(!B.existsSync(t))throw new Error(`"${t}" not found. It is required for deployment.`);let r=P.join(this.appRoot,st);if(!B.existsSync(r))throw new Error(`"${r}" not found. It is required for deployment.`)}async createZip(t="app.zip",r=!1){this.validateBuildDirectory(),console.log("\u{1F4E6} Packaging application...");let n=new cs(new ps,{level:9}),i=o(async(c,l)=>{await n.add(l,new as(await B.openAsBlob(c))),r&&console.log(`  \u{1F4C4} ${l}`)},"addFile"),s=o(async c=>{let l=await B.promises.readdir(c,{withFileTypes:!0});for(let d of l){let m=P.join(c,d.name);d.isDirectory()?await s(m):await i(m,P.relative(this.distPath,m).replace(/\\/g,"/"))}},"addDir"),a;try{await s(this.distPath);let c=P.join(this.appRoot,it);await i(c,P.posix.join(at,it));let l=P.join(this.appRoot,kr);if(B.existsSync(l)){let m=B.readFileSync(l,"utf-8");ss(m,l),await i(l,P.posix.join(at,kr))}let d=P.join(this.appRoot,st);await i(d,P.posix.join(at,st)),a=await n.close()}catch(c){let l=c instanceof Error?c.message:String(c);throw new Error(`Failed to create zip: ${l}`)}await B.promises.writeFile(t,a);let p=(a.byteLength/1024/1024).toFixed(2);return console.log(`\u2705 App packaged: ${t} (${p} MB)`),t}async createSourceArchive(t){console.log("\u{1F4E6} Packaging source for review...");let r;try{r=Ae("git",["-C",this.appRoot,"rev-parse","--show-toplevel"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim()}catch(c){throw c instanceof Error&&"code"in c&&c.code==="ENOENT"?new Error("git not found. Install git and ensure it is in your PATH."):new Error("Source packaging requires a git repository. Run `git init` first.")}let n=Ae("git",["-C",this.appRoot,"rev-parse","--show-prefix"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim(),i=n?n.replace(/\/$/,""):".",s=i==="."?"HEAD":`HEAD:${i}`;this.validateNoSensitiveFiles(r,s);try{Ae("git",["-C",r,"archive","--format=zip",`--output=${t}`,s])}catch(c){let l=c instanceof Error?c.message:String(c);throw new Error(`Failed to create source archive: ${l}`)}let p=(B.statSync(t).size/1024/1024).toFixed(2);return console.log(`\u2705 Source packaged: ${P.basename(t)} (${p} MB)`),t}validateNoSensitiveFiles(t,r){let n=Ae("git",["-C",t,"ls-tree","-r","--name-only",r],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().split(`
-`).filter(Boolean),i=o(a=>a.split("/").some(p=>ls.some(c=>c.test(p))),"isSensitive"),s=n.filter(i);if(s.length>0)throw new Error(`Source archive would include sensitive files \u2014 remove them from git tracking first:
+  npx @cognite/cli apps deactivate . --interactive     Deactivate using browser auth (no secrets needed)`).action((t,r)=>Nl(t,r))}i(mo,"registerDeactivateCommand");import{mkdir as Kl,readFile as Hl}from"fs/promises";import{basename as Gl,dirname as Bl}from"path";import{execFileSync as It}from"child_process";import te from"fs";import F from"path";import{parseAndValidateManifestConfig as _l}from"@cognite/app-sdk/vite";import{BlobReader as Ul,Uint8ArrayWriter as Ml,ZipWriter as Vl}from"@zip.js/zip.js";var Ar="package.json",Ir="package-lock.json",uo="manifest.json",Dr=".cognite",jl=[/^\.env(\..+)?$/i,/^\.secrets?$/i,/^\.token/i,/^\.cognite/i,/\.(key|pem|p12|pfx|jks|crt)$/i],$r=class $r{constructor(t="dist"){this.distPath=F.isAbsolute(t)?t:F.join(process.cwd(),t),this.appRoot=F.dirname(this.distPath)}validateBuildDirectory(){if(!te.existsSync(this.distPath))throw new Error(`Build directory "${this.distPath}" not found. Run build first.`);let t=F.join(this.appRoot,Ar);if(!te.existsSync(t))throw new Error(`"${t}" not found. It is required for deployment.`);let r=F.join(this.appRoot,Ir);if(!te.existsSync(r))throw new Error(`"${r}" not found. It is required for deployment.`)}async createZip(t="app.zip",r=!1){this.validateBuildDirectory(),console.log("\u{1F4E6} Packaging application...");let n=new Vl(new Ml,{level:9}),o=i(async(c,l)=>{await n.add(l,new Ul(await te.openAsBlob(c))),r&&console.log(`  \u{1F4C4} ${l}`)},"addFile"),s=i(async c=>{let l=await te.promises.readdir(c,{withFileTypes:!0});for(let m of l){let d=F.join(c,m.name);m.isDirectory()?await s(d):await o(d,F.relative(this.distPath,d).replace(/\\/g,"/"))}},"addDir"),a;try{await s(this.distPath);let c=F.join(this.appRoot,Ar);await o(c,F.posix.join(Dr,Ar));let l=F.join(this.appRoot,uo);if(te.existsSync(l)){let d=te.readFileSync(l,"utf-8");_l(d,l),await o(l,F.posix.join(Dr,uo))}let m=F.join(this.appRoot,Ir);await o(m,F.posix.join(Dr,Ir)),a=await n.close()}catch(c){let l=c instanceof Error?c.message:String(c);throw new Error(`Failed to create zip: ${l}`)}try{await te.promises.writeFile(t,a)}catch(c){throw new y(`Failed to write bundle to ${t}`,{cause:c})}let p=(a.byteLength/1024/1024).toFixed(2);return console.log(`\u2705 App packaged: ${t} (${p} MB)`),t}async createSourceArchive(t){console.log("\u{1F4E6} Packaging source for review...");let r;try{r=It("git",["-C",this.appRoot,"rev-parse","--show-toplevel"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim()}catch(c){throw c instanceof Error&&"code"in c&&c.code==="ENOENT"?new Error("git not found. Install git and ensure it is in your PATH."):new Error("Source packaging requires a git repository. Run `git init` first.")}let n=It("git",["-C",this.appRoot,"rev-parse","--show-prefix"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim(),o=n?n.replace(/\/$/,""):".",s=o==="."?"HEAD":`HEAD:${o}`;this.validateNoSensitiveFiles(r,s);try{It("git",["-C",r,"archive","--format=zip",`--output=${t}`,s])}catch(c){let l=c instanceof Error?c.message:String(c);throw new Error(`Failed to create source archive: ${l}`)}let p=(te.statSync(t).size/1024/1024).toFixed(2);return console.log(`\u2705 Source packaged: ${F.basename(t)} (${p} MB)`),t}validateNoSensitiveFiles(t,r){let n=It("git",["-C",t,"ls-tree","-r","--name-only",r],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().split(`
+`).filter(Boolean),o=i(a=>a.split("/").some(p=>jl.some(c=>c.test(p))),"isSensitive"),s=n.filter(o);if(s.length>0)throw new Error(`Source archive would include sensitive files \u2014 remove them from git tracking first:
 `+s.map(a=>`  ${a}`).join(`
 `)+`
-Hint: git rm --cached <file>`)}};o(pt,"ApplicationPackager");var Z=pt;import ds from"path";var Pr=".cognite-bundles";function br(e,t){return`${e}-${t}.zip`}o(br,"bundleFileName");function Q(e,t,r){return ds.join(e,Pr,br(t,r))}o(Q,"bundlePath");async function De(e,t,r,n){let{externalId:i,name:s,description:a,versionTag:p}=t,c=Q(r,i,p);await ms(fs(c),{recursive:!0}),await new Z(`${r}/dist`).createZip(c,!0);let l=await us(c);await new E(e).deploy(i,s,a,p,l,gs(c),n)}o(De,"packageAndUpload");var ct=o(async(e,t,r)=>{let n=await ce(e,r);await De(n,t,r,e.published)},"deploy");import{existsSync as ys,readFileSync as hs}from"fs";var xr=[".dev.sig",".cert.sig"];function me(e,t={}){let r=t.existsSync??ys,n=t.readFileSync??((s,a)=>hs(s,a)),i=[];for(let s of xr){let a=`${e}${s}`;if(!r(a))continue;let p=n(a,"utf8").trim();p.length>0&&i.push(p)}return i}o(me,"discoverSignatures");import{execSync as Ss}from"child_process";function lt(e,t=!0,r={execSync:Ss}){console.log("\u{1F4E6} Building app with npm..."),r.execSync("npm run build",{cwd:e,stdio:t?"inherit":"pipe"}),console.log("\u2705 Build successful")}o(lt,"buildApp");function Ar(e,t){let{org:r,project:n,baseUrl:i}=e,s;try{s=new URL(i).hostname}catch{return null}let{externalId:a,versionTag:p}=t,c=new URLSearchParams({cluster:s,customAppVersion:p,workspace:"industrial-tools"});return`https://${r}.fusion.cognite.com/${n}/flows-apps/app/${encodeURIComponent(a)}?${c}`}o(Ar,"generateFusionUrl");function Dr(e,t,r){let n=r?"\u{1F680} Deploy (Interactive)":"\u{1F680} Deploy",i=r?`${t.project} @ ${t.baseUrl}`:`${t.org}/${t.project}`;console.log(["",n,"=".repeat(n.length),`App: ${e.name} (${e.externalId})`,`Version: ${e.versionTag}`,`Target: ${i}`,""].join(`
-`))}o(Dr,"printDeployInfo");function Ir(e,t){console.log(`
+Hint: git rm --cached <file>`)}};i($r,"ApplicationPackager");var he=$r;async function Dt(e,t,r,n){let{externalId:o,name:s,description:a,versionTag:p}=t,c=Z(r,o,p);await Kl(Bl(c),{recursive:!0}),await new he(`${r}/dist`).createZip(c,!0);let l;try{l=await Hl(c)}catch(m){throw new y(`Failed to read bundle file: ${c}`,{cause:m})}await new E(e).deploy(o,s,a,p,l,Gl(c),n)}i(Dt,"packageAndUpload");var Rr=i(async(e,t,r)=>{let n=await Ne(e,r);await Dt(n,t,r,e.published)},"deploy");import{existsSync as ql,readFileSync as Ql}from"fs";var go=[".dev.sig",".cert.sig"];function Ge(e,t={}){let r=t.existsSync??ql,n=t.readFileSync??((s,a)=>Ql(s,a)),o=[];for(let s of go){let a=`${e}${s}`;if(!r(a))continue;let p=n(a,"utf8").trim();p.length>0&&o.push(p)}return o}i(Ge,"discoverSignatures");import{execSync as Jl}from"child_process";function Tr(e,t=!0,r={execSync:Jl}){console.log("\u{1F4E6} Building app with npm...");try{r.execSync("npm run build",{cwd:e,stdio:t?"inherit":"pipe"})}catch(n){throw new y(`npm run build failed in ${e}`,{cause:n,hint:"Check the build output above for errors."})}console.log("\u2705 Build successful")}i(Tr,"buildApp");function fo(e,t){let{org:r,project:n,baseUrl:o}=e,s;try{s=new URL(o).hostname}catch{return null}let{externalId:a,versionTag:p}=t,c=new URLSearchParams({cluster:s,customAppVersion:p,workspace:"industrial-tools"});return`https://${r}.fusion.cognite.com/${n}/flows-apps/app/${encodeURIComponent(a)}?${c}`}i(fo,"generateFusionUrl");function yo(e,t,r){let n=r?"\u{1F680} Deploy (Interactive)":"\u{1F680} Deploy",o=r?`${t.project} @ ${t.baseUrl}`:`${t.org}/${t.project}`;console.log(["",n,"=".repeat(n.length),`App: ${e.name} (${e.externalId})`,`Version: ${e.versionTag}`,`Target: ${o}`,""].join(`
+`))}i(yo,"printDeployInfo");function ho(e,t){console.log(`
 \u2705 Successfully deployed ${e.name} version ${e.versionTag} to ${t.org?`${t.org}/`:""}${t.project}`),console.log("\u{1F512} App is deployed in draft mode");let r=e.deployments.length>1?` -d ${t.project}`:"";console.log(`
 To sign:     npx @cognite/cli apps sign --interactive${r}`),console.log(`To publish:  npx @cognite/cli apps publish .${r}`),console.log(`To activate: npx @cognite/cli apps activate .${r}`),console.log(`
-To submit for certification: npx @cognite/cli apps submit`);let n=Ar(t,e);n&&console.log(`
+To submit for certification: npx @cognite/cli apps submit`);let n=fo(t,e);n&&console.log(`
 \u{1F517} Open your app:
-   ${n}`)}o(Ir,"printDeployResult");async function ws(e,t,r,n,i){let s=$(t);if(s.length>0)throw new Error(`Deployment ${t.org}/${t.project} is missing ${s.join(" and ")} in app.json. Use \`cognite apps deploy --interactive\` for browser-based authentication instead.`);Dr(e,t,!1),n.skipBuild||lt(r),console.log(`
-\u{1F4E4} Deploying to ${t.org}/${t.project}...`),await i({...t,published:!1},{externalId:e.externalId,name:e.name,description:e.description,versionTag:e.versionTag},r),Ir(e,t)}o(ws,"handleDeployNonInteractive");async function vs(e,t,r,n){Dr(e,t,!0),n.skipBuild||lt(r);let i=await I(t,{interactive:!0,appId:e.externalId,orgHint:n.org});console.log(`
-\u{1F4E4} Deploying to ${t.project}...`),await De(i,{externalId:e.externalId,name:e.name,description:e.description,versionTag:e.versionTag},r,!1),Ir(e,t)}o(vs,"handleDeployInteractive");async function Cs(e,t=process.cwd(),r={}){let{loadEnvFile:n=T,loadAppConfig:i=v,deploy:s=ct}=r;n(t);let a=i(t);if(F(a),e.interactive){let c=await R(a,e);await vs(a,c,t,e);return}let p=b(a.deployments,e.deployment);await ws(a,p,t,e,s)}o(Cs,"handleDeploy");function $r(e){return e.command("deploy").description("Deploy your app to Cognite Data Fusion. Use --interactive for browser-based login (no env-var secrets required).").option("-d, --deployment <target>","Deployment target (index or project name)").option("--skip-build","Skip the build step",!1).option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
+   ${n}`)}i(ho,"printDeployResult");async function Yl(e,t,r,n,o){let s=$(t);if(s.length>0)throw new Error(`Deployment ${t.org}/${t.project} is missing ${s.join(" and ")} in app.json. Use \`cognite apps deploy --interactive\` for browser-based authentication instead.`);yo(e,t,!1),n.skipBuild||Tr(r),console.log(`
+\u{1F4E4} Deploying to ${t.org}/${t.project}...`),await o({...t,published:!1},{externalId:e.externalId,name:e.name,description:e.description,versionTag:e.versionTag},r),ho(e,t)}i(Yl,"handleDeployNonInteractive");async function zl(e,t,r,n){yo(e,t,!0),n.skipBuild||Tr(r);let o=await b(t,{interactive:!0,appId:e.externalId,orgHint:n.org});console.log(`
+\u{1F4E4} Deploying to ${t.project}...`),await Dt(o,{externalId:e.externalId,name:e.name,description:e.description,versionTag:e.versionTag},r,!1),ho(e,t)}i(zl,"handleDeployInteractive");async function Wl(e,t=process.cwd(),r={}){let{loadEnvFile:n=P,loadAppConfig:o=v,deploy:s=Rr}=r;n(t);let a=o(t);if(T(a),e.interactive){let c=await R(a,e);await zl(a,c,t,e);return}let p=A(a.deployments,e.deployment);await Yl(a,p,t,e,s)}i(Wl,"handleDeploy");function So(e){return e.command("deploy").description("Deploy your app to Cognite Data Fusion. Use --interactive for browser-based login (no env-var secrets required).").option("-d, --deployment <target>","Deployment target (index or project name)").option("--skip-build","Skip the build step",!1).option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
 Environment (non-interactive):
   deployClientId and deploySecretName are configured per deployment in app.json.
   deploySecretName is the name of the environment variable that holds the client
@@ -109,79 +224,76 @@ Examples:
   npx @cognite/cli apps deploy -d my-project      Deploy to project by name
   npx @cognite/cli apps deploy --skip-build       Deploy without rebuilding
   npx @cognite/cli apps deploy --interactive      Browser auth, prompts for target
-  npx @cognite/cli apps deploy --interactive -d 0 Browser auth, target chosen non-interactively`).action(t=>Cs(t))}o($r,"registerDeployCommand");async function Es(e,t,r){let n=await I(e,{interactive:t.interactive,appId:r.externalId,orgHint:t.org});return new E(n)}o(Es,"defaultBuildApiClient");async function ks(e,t={}){let r=t.loadEnvFile??T,n=t.loadAppConfig??v,i=t.buildApiClient??Es,s=t.discoverSignatures??me,a=process.cwd();r(a);let p=n(a);F(p);let c=e.interactive?await R(p,e):b(p.deployments,e.deployment);if(!e.interactive){let u=$(c);if(u.length>0)throw new Error(`Deployment ${c.org}/${c.project} is missing ${u.join(" and ")} in app.json. Use \`cognite apps publish --interactive\` for browser-based authentication instead.`)}let l=await i(c,e,p),{externalId:d,versionTag:m}=p,y;try{y=await l.getVersion(d,m)}catch(u){throw u instanceof j?new Error(`Version ${m} of ${d} has not been deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):u}if(y.alias==="ACTIVE"){console.log(`  ${d} @ ${m} is already ACTIVE \u2014 nothing to do.`);return}if(y.lifecycleState==="PUBLISHED"){console.log(`  ${d} @ ${m} is already PUBLISHED \u2014 nothing to do.`);return}if(y.lifecycleState==="DEPRECATED"||y.lifecycleState==="ARCHIVED")throw new Error(`Cannot publish ${d} @ ${m}: version is ${y.lifecycleState} (terminal).`);let g=s(Q(a,d,m));g.length>0&&await l.submitSignatures(d,m,g),await l.publishVersion(d,m),console.log(`\u2713 Published    ${d} @ ${m} is now PUBLISHED`),console.log(""),console.log("Run `npx @cognite/cli apps activate .` to make it active.")}o(ks,"handlePublish");function Rr(e){return e.command("publish").description("Publish the current app version (transition DRAFT \u2192 PUBLISHED)").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
+  npx @cognite/cli apps deploy --interactive -d 0 Browser auth, target chosen non-interactively`).action(t=>Wl(t))}i(So,"registerDeployCommand");function Xl(e,t){console.log(""),console.log(`Updating metadata for '${e}':`);for(let{field:r,remote:n,local:o}of t){let s=`${r}:`.padEnd(13);console.log(`  ${s}"${n}" \u2192 "${o||"(none)"}"`)}}i(Xl,"printMetadataDiff");async function Zl(e,t=process.cwd(),r={}){let{loadEnvFile:n=P,loadAppConfig:o=v,getClientForDeployment:s=b,createMetadataClient:a=i(h=>new E(h),"createMetadataClient"),getMissingCredentials:p=$}=r;n(t);let c=o(t);T(c);let l=e.interactive?await R(c,e):A(c.deployments,e.deployment);if(!e.interactive){let h=p(l);if(h.length>0)throw new Error(`Deployment ${l.org}/${l.project} is missing ${h.join(" and ")} in app.json. Use \`cognite apps metadata update --interactive\` for browser-based authentication instead.`)}let m=await s(l,{interactive:e.interactive,appId:c.externalId,orgHint:e.org}),d=a(m),u;try{u=await d.getApp(c.externalId)}catch(h){throw h instanceof De?new Error(`App '${c.externalId}' is not deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):h}let f={name:c.name,description:c.description||""},g=vr(u,f);if(g.length===0){console.log(""),console.log(`Metadata for '${c.externalId}' already matches the deployed app \u2014 nothing to update.`),console.log("Edit name/description in app.json to change them.");return}Xl(c.externalId,g),await d.updateAppMetadata(c.externalId,c.name,c.description),console.log(""),console.log(`\u2705 Metadata for '${c.externalId}' updated`)}i(Zl,"handleUpdateMetadata");function wo(e){let t=e.command("metadata").summary("Manage the deployed app's metadata").description("Manage the deployed app's metadata (name and description).");return t.command("update").description("Update the deployed app's name and description from app.json").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
+Examples:
+  npx @cognite/cli apps metadata update .                Push name/description using env-var auth
+  npx @cognite/cli apps metadata update . --interactive  Push using browser auth (no secrets needed)`).action((r,n)=>Zl(n)),t}i(wo,"registerMetadataCommand");async function ed(e,t,r){let n=await b(e,{interactive:t.interactive,appId:r.externalId,orgHint:t.org});return new E(n)}i(ed,"defaultBuildApiClient");async function td(e,t={}){let r=t.loadEnvFile??P,n=t.loadAppConfig??v,o=t.buildApiClient??ed,s=t.discoverSignatures??Ge,a=process.cwd();r(a);let p=n(a);T(p);let c=e.interactive?await R(p,e):A(p.deployments,e.deployment);if(!e.interactive){let g=$(c);if(g.length>0)throw new Error(`Deployment ${c.org}/${c.project} is missing ${g.join(" and ")} in app.json. Use \`cognite apps publish --interactive\` for browser-based authentication instead.`)}let l=await o(c,e,p),{externalId:m,versionTag:d}=p,u;try{u=await l.getVersion(m,d)}catch(g){throw g instanceof Q?new Error(`Version ${d} of ${m} has not been deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):g}if(u.alias==="ACTIVE"){console.log(`  ${m} @ ${d} is already ACTIVE \u2014 nothing to do.`);return}if(u.lifecycleState==="PUBLISHED"){console.log(`  ${m} @ ${d} is already PUBLISHED \u2014 nothing to do.`);return}if(u.lifecycleState==="DEPRECATED"||u.lifecycleState==="ARCHIVED")throw new Error(`Cannot publish ${m} @ ${d}: version is ${u.lifecycleState} (terminal).`);let f=s(Z(a,m,d));f.length>0&&await l.submitSignatures(m,d,f),await l.publishVersion(m,d),console.log(`\u2713 Published    ${m} @ ${d} is now PUBLISHED`),console.log(""),console.log("Run `npx @cognite/cli apps activate .` to make it active.")}i(td,"handlePublish");function vo(e){return e.command("publish").description("Publish the current app version (transition DRAFT \u2192 PUBLISHED)").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
 Examples:
   npx @cognite/cli apps publish .                    Publish using env-var auth
-  npx @cognite/cli apps publish . --interactive      Publish using browser auth (no secrets needed)`).action((t,r)=>ks(r))}o(Rr,"registerPublishCommand");import{spawnSync as Ps}from"child_process";import{mkdirSync as bs}from"fs";import{resolve as dt}from"path";var xs=["localhost","local.cognite.ai","*.local.cognite.ai"],As={info:o(e=>{process.stdout.write(`${e}
-`)},"info"),error:o(e=>{process.stderr.write(`${e}
-`)},"error")},Ds={spawnSync:Ps,mkdirSync:bs,logger:As};function Is(e){let t=e("mkcert",["-help"],{stdio:"ignore"});return t.status===0||t.status===1}o(Is,"hasMkcert");function $s({certDir:e=dt(process.cwd(),"certificates/mkcert"),domains:t=xs,deps:r={}}={}){let n={...Ds,...r},{spawnSync:i,mkdirSync:s,logger:a}=n;if(!Is(i))throw a.error("Error: mkcert is not installed."),a.error("Install it with: brew install mkcert (macOS, Linux, WSL)"),a.error("On Windows: choco install mkcert  (or scoop install mkcert)"),a.error("See https://github.com/FiloSottile/mkcert#installation for other methods."),new Error("mkcert is not installed");if(a.info("\u2139\uFE0F  Installing mkcert root CA into your local trust store."),a.info("   This allows your browser to trust locally-generated certificates."),a.info("   You may be prompted for your system password."),i("mkcert",["-install"],{stdio:"inherit"}).status!==0)throw new Error("`mkcert -install` failed");s(e,{recursive:!0});let c=dt(e,"localhost.pem"),l=dt(e,"localhost-key.pem");if(i("mkcert",["-cert-file",c,"-key-file",l,...t],{stdio:"inherit"}).status!==0)throw new Error("mkcert failed to generate certificates");return a.info(""),a.info("Certificates generated:"),a.info(`  cert: ${c}`),a.info(`  key:  ${l}`),{certFile:c,keyFile:l}}o($s,"setupHttps");function Rs(e){$s({certDir:e.certDir})}o(Rs,"handleSetupHttps");function Tr(e){return e.command("setup-https").description("Generate trusted local HTTPS certificates via mkcert").option("--cert-dir <path>","Directory to write certs into (default: ./certificates/mkcert)").addHelpText("after",`
+  npx @cognite/cli apps publish . --interactive      Publish using browser auth (no secrets needed)`).action((t,r)=>td(r))}i(vo,"registerPublishCommand");import{spawnSync as rd}from"child_process";import{mkdirSync as nd}from"fs";import{resolve as Fr}from"path";var id=["localhost","local.cognite.ai","*.local.cognite.ai"],od={info:i(e=>{process.stdout.write(`${e}
+`)},"info"),error:i(e=>{process.stderr.write(`${e}
+`)},"error")},sd={spawnSync:rd,mkdirSync:nd,logger:od};function ad(e){let t=e("mkcert",["-help"],{stdio:"ignore"});return t.status===0||t.status===1}i(ad,"hasMkcert");function pd({certDir:e=Fr(process.cwd(),"certificates/mkcert"),domains:t=id,deps:r={}}={}){let n={...sd,...r},{spawnSync:o,mkdirSync:s,logger:a}=n;if(!ad(o))throw a.error("Error: mkcert is not installed."),a.error("Install it with: brew install mkcert (macOS, Linux, WSL)"),a.error("On Windows: choco install mkcert  (or scoop install mkcert)"),a.error("See https://github.com/FiloSottile/mkcert#installation for other methods."),new Error("mkcert is not installed");if(a.info("\u2139\uFE0F  Installing mkcert root CA into your local trust store."),a.info("   This allows your browser to trust locally-generated certificates."),a.info("   You may be prompted for your system password."),o("mkcert",["-install"],{stdio:"inherit"}).status!==0)throw new Error("`mkcert -install` failed");s(e,{recursive:!0});let c=Fr(e,"localhost.pem"),l=Fr(e,"localhost-key.pem");if(o("mkcert",["-cert-file",c,"-key-file",l,...t],{stdio:"inherit"}).status!==0)throw new Error("mkcert failed to generate certificates");return a.info(""),a.info("Certificates generated:"),a.info(`  cert: ${c}`),a.info(`  key:  ${l}`),{certFile:c,keyFile:l}}i(pd,"setupHttps");function cd(e){pd({certDir:e.certDir})}i(cd,"handleSetupHttps");function ko(e){return e.command("setup-https").description("Generate trusted local HTTPS certificates via mkcert").option("--cert-dir <path>","Directory to write certs into (default: ./certificates/mkcert)").addHelpText("after",`
 Examples:
   npx @cognite/cli@latest apps setup-https                     Generate certs in ./certificates/mkcert
-  npx @cognite/cli@latest apps setup-https --cert-dir certs    Use a custom directory`).action(t=>Rs(t))}o(Tr,"registerSetupHttpsCommand");import{createReadStream as ga,existsSync as fa,writeFileSync as ya}from"fs";import{basename as ha,dirname as Sa,join as wa,resolve as wt}from"path";import{parseScope as va,signBundle as Ca,validateScopes as Ea}from"@cognite/app-sdk/codesigning";import{existsSync as da,readFileSync as ma}from"fs";import{execFile as Os}from"child_process";import{promisify as _s}from"util";import{execFileSync as Fr}from"child_process";import{platform as Ts}from"os";import Fs from"path";function K(e,t={}){let{platform:r=Ts}=t;switch(r()){case"darwin":return e==="macos";case"win32":return e==="windows";default:return e==="other"}}o(K,"isOS");function Or(e,t={}){let{exec:r=Fr,log:n=console.log}=t,[i,s]=K("macos",t)?["open",[e]]:K("windows",t)?["rundll32",["url.dll,FileProtocolHandler",e]]:["xdg-open",[e]];try{r(i,s)}catch{n(`Could not open browser \u2014 open manually:
-  ${e}`)}}o(Or,"openInBrowser");function _r(e,t={}){let{exec:r=Fr,log:n=console.log}=t,[i,s]=K("macos",t)?["open",["-R",e]]:K("windows",t)?["explorer",[`/select,${e}`]]:["xdg-open",[Fs.dirname(e)]];try{r(i,s)}catch{n(`Could not open file manager \u2014 files are at:
-  ${e}`)}}o(_r,"revealInFileManager");var Lr="cognite-flows",Us=_s(Os),Nr=o((e,t)=>Us(e,t),"defaultExecFile"),Ls=-25300,Ns=Ls&255;function Ks(e){if(!(e instanceof Error)||!("code"in e)||e.code!==Ns)return!1;let t="stderr"in e?String(e.stderr):"";return/could not be found/i.test(t)||t===""}o(Ks,"isKeychainNotFoundError");async function Kr(e,t,r={}){if(!K("macos",r))throw new Error("Keychain storage is only supported on macOS");let{execFile:n=Nr}=r;await n("security",["add-generic-password","-a",e,"-s",Lr,"-w",Buffer.from(t,"utf-8").toString("base64"),"-U"])}o(Kr,"storeKeyInKeychain");async function Ie(e,t={}){if(!K("macos",t))return null;let{execFile:r=Nr}=t;try{let{stdout:n}=await r("security",["find-generic-password","-a",e,"-s",Lr,"-w"]);return Buffer.from(n.trim(),"base64").toString("utf-8")}catch(n){if(Ks(n))return null;throw n}}o(Ie,"readKeyFromKeychain");import{homedir as js}from"os";import{join as jr}from"path";function _(e={}){let{env:t=process.env,homedir:r=js}=e,n=t.COGNITE_CLI_HOME?.trim()||jr(r(),".cognite-cli");return{home:n,keysDir:jr(n,"keys")}}o(_,"getConfig");import{pbkdf2 as Vs,randomBytes as Bs}from"crypto";import{promisify as Gs}from"util";import{CompactEncrypt as Ys,base64url as Mr,compactDecrypt as qs}from"jose";var Ms=new TextEncoder,Hs=new TextDecoder,mt={encode:o(e=>Ms.encode(e),"encode"),decode:o(e=>Hs.decode(e),"decode")};var Js=Gs(Vs),ft=6e5,zs="sha512",ut="PBKDF2-HMAC-SHA512",gt=16,$e="A256GCM",Ws=32,Re=2e6;async function Hr(e,t,r){return await Js(e,t,r,Ws,zs)}o(Hr,"deriveKey");async function Vr(e,t,r=ft){if(!Number.isInteger(r)||r<1||r>Re)throw new Error(`Invalid iterations: must be an integer between 1 and ${Re}`);let n=Bs(gt),i=await Hr(t,n,r);return await new Ys(mt.encode(e)).setProtectedHeader({alg:"dir",enc:$e,kdf:ut,kdf_iter:r,kdf_salt:Mr.encode(n)}).encrypt(i)}o(Vr,"encryptStringAsJwe");async function Br(e,t){let{plaintext:r}=await qs(e,async n=>{if(!e.length)throw new Error("Unexpected JWE empty value");if(t.length<15)throw new Error(`Invalid passphrase it should be at least ${15} but got ${t.length}`);if(n.alg!=="dir")throw new Error(`Unexpected JWE alg "${String(n.alg)}"; only "dir" is supported`);if(n.enc!==$e)throw new Error(`Unexpected JWE enc "${String(n.enc)}"; only "${$e}" is supported`);if(n.kdf!==ut)throw new Error(`Unexpected KDF "${String(n.kdf)}"; only "${ut}" is supported`);let i=Number(n.kdf_iter);if(!Number.isInteger(i)||i<1||i>Re)throw new Error(`Invalid kdf_iter in JWE header: must be an integer between 1 and ${Re}`);if(typeof n.kdf_salt!="string")throw new Error("Missing kdf_salt in JWE header");let s=Mr.decode(n.kdf_salt);if(s.length!==gt)throw new Error(`Invalid kdf_salt length in JWE header: expected ${gt} bytes, got ${s.length}`);return await Hr(t,s,i)},{keyManagementAlgorithms:["dir"],contentEncryptionAlgorithms:[$e]});return mt.decode(r)}o(Br,"decryptJweAsString");function Xs(e){let t=e.trim();return t.startsWith("eyJ")&&t.split(".").length===5}o(Xs,"isJweCompact");var Gr=Xs;import{existsSync as Zs,readdirSync as Qs,readFileSync as ea}from"fs";import{join as yt}from"path";var re=".pub.pem",ht=".key.jwe",St=".meta.json";function Te(e){switch(e.kind){case"keychain":return"Keychain";case"encrypted-file":return e.path;case"public-only":return"public-only (private key missing)"}}o(Te,"formatLocalKeySource");function ta(e){return{existsSync:e.existsSync??Zs,readdirSync:e.readdirSync??Qs,readFileSync:e.readFileSync??((t,r)=>ea(t,r)),isOS:e.isOS??(t=>K(t)),readKeyFromKeychain:e.readKeyFromKeychain??(t=>Ie(t))}}o(ta,"resolveDeps");function ra(e){try{let t=JSON.parse(e);if(typeof t=="object"&&t!==null&&!Array.isArray(t)&&"email"in t&&typeof t.email=="string")return t.email}catch{}}o(ra,"readEmailFromMeta");function na(e,t){return t.existsSync(e)?t.readdirSync(e).filter(r=>r.endsWith(re)):[]}o(na,"publicKeyEntries");function oa(e){return e.slice(0,-re.length)}o(oa,"kidFromPublicKeyFilename");async function ia(e,t,r){if(r.isOS("macos")&&await r.readKeyFromKeychain(e).catch(()=>null)!==null)return{kind:"keychain"};let n=yt(t,`${e}${ht}`);return r.existsSync(n)?{kind:"encrypted-file",path:n}:{kind:"public-only"}}o(ia,"resolveSource");async function Fe(e=_().keysDir,t={}){let r=ta(t),n=new Set,i=na(e,r).flatMap(s=>{let a=oa(s);return!a||n.has(a)?[]:(n.add(a),[{kid:a,entry:s}])});return Promise.all(i.map(async({kid:s,entry:a})=>{let p=await ia(s,e,r),c=yt(e,`${s}${St}`),l;try{l=ra(r.readFileSync(c,"utf8"))}catch{}return{kid:s,source:p,publicKeyPath:yt(e,a),email:l}}))}o(Fe,"discoverLocalKeys");import sa from"enquirer";async function aa(e){return sa.prompt(e)}o(aa,"defaultPrompt");async function Yr(e,t={}){let{prompt:r=aa}=t,{passphrase:n}=await r({type:"password",name:"passphrase",message:e});return n}o(Yr,"promptPassphrase");import ca from"enquirer";import{statSync as pa}from"fs";function qr(e,t=pa){return e.map(r=>({key:r,mtime:t(r.publicKeyPath).mtimeMs})).sort((r,n)=>n.mtime-r.mtime).map(({key:r})=>r)}o(qr,"sortByMtime");async function la(e){return ca.prompt(e)}o(la,"defaultPrompt");async function Jr(e,t={}){if(e.length===1)return e[0];let{prompt:r=la,sortByMtime:n=qr}=t,i=n(e),s=i[0],{choice:a}=await r({type:"select",name:"choice",message:"Select signing identity",choices:[{name:"latest",message:`Use latest: ${s.kid}`},{name:"pick",message:"Pick from list"}]});if(a==="latest")return s;if(a==="pick"){let{kid:p}=await r({type:"select",name:"kid",message:"Select signing identity",choices:i.map(l=>({name:l.kid,message:[l.kid,l.email,Te(l.source)].filter(Boolean).join("  \u2014  ")}))}),c=i.find(l=>l.kid===p);if(!c)throw new Error("No signing identity selected");return c}else throw new Error(`Unexpected choice: "${a}"`)}o(Jr,"promptSigningIdentity");function ua(e){return{existsSync:e.existsSync??da,readFileSync:e.readFileSync??((t,r)=>ma(t,r)),readKeyFromKeychain:e.readKeyFromKeychain??Ie,decryptJweAsString:e.decryptJweAsString??Br,discoverLocalKeys:e.discoverLocalKeys??Fe,keysDir:e.keysDir??_().keysDir,promptPassphrase:e.promptPassphrase??Yr,promptSigningIdentity:e.promptSigningIdentity??Jr}}o(ua,"resolveDeps");async function zr(e,t={}){let r=ua(t);if(e.keyPath){if(!r.existsSync(e.keyPath))throw new Error(`Key file not found: ${e.keyPath}`);if(!e.kid)throw new Error("--signing-identity <kid> is required when using --key");let s=r.readFileSync(e.keyPath,"utf-8").trim();if(Gr(s)){if(!e.interactive)throw new Error(`Key at ${e.keyPath} is passphrase-encrypted. Pass --interactive to enter the passphrase.`);let a=await r.promptPassphrase(`Passphrase for key ${e.kid}: `);return{privateKeyPem:await r.decryptJweAsString(s,a),kid:e.kid}}return{privateKeyPem:s,kid:e.kid}}let n=await r.discoverLocalKeys(r.keysDir);if(n.length===0)throw new Error("No signing keys found. Run `cognite keys generate` or pass --key.");let i;if(e.kid)i=n.find(s=>s.kid===e.kid);else if(e.interactive)i=await r.promptSigningIdentity(n);else throw new Error("--signing-identity <kid> is required. Pass --interactive to select it interactively.");if(!i)throw new Error(`No key found with kid "${e.kid}"`);switch(i.source.kind){case"keychain":{let s=await r.readKeyFromKeychain(i.kid);if(!s)throw new Error(`Key "${i.kid}" not found in Keychain`);return{privateKeyPem:s,kid:i.kid}}case"encrypted-file":{if(!e.interactive)throw new Error(`Key "${i.kid}" is passphrase-encrypted. Pass --interactive to enter the passphrase, or store the key in macOS Keychain for non-interactive use.`);let s=await r.promptPassphrase(`Passphrase for key ${i.kid}: `);return{privateKeyPem:await r.decryptJweAsString(r.readFileSync(i.source.path,"utf-8"),s),kid:i.kid}}case"public-only":throw new Error(`Key "${i.kid}" has no private key on this machine (public-only).`)}}o(zr,"resolvePrivateKey");var ka=o(async(e,t,r,n,i)=>{let s=await I(e,{interactive:i.browserAuth??!1,appId:t,orgHint:i.org});await new E(s).submitSignatures(t,r,n)},"defaultSubmitSignatures");function Pa(e){let t=ga(e);return new ReadableStream({start(r){t.on("data",n=>{let i=typeof n=="string"?Buffer.from(n):n;r.enqueue(new Uint8Array(i))}),t.on("end",()=>r.close()),t.on("error",n=>r.error(n))},cancel(){t.destroy()}})}o(Pa,"createWebStreamFromFile");function ba(e){return{existsSync:e.existsSync??fa,writeFileSync:e.writeFileSync??ya,createBundleStream:e.createBundleStream??Pa,signBundle:e.signBundle??Ca,parseScope:e.parseScope??va,validateScopes:e.validateScopes??Ea,loadAppConfig:e.loadAppConfig??v,resolvePrivateKey:e.resolvePrivateKey??(t=>zr(t)),submitSignatures:e.submitSignatures??ka,discoverSignatures:e.discoverSignatures??me}}o(ba,"resolveDeps");async function Wr(e,t,r={},n=process.cwd()){let i=ba(r),s=t.appid,a=t.appVersion,p=[],c=i.loadAppConfig(n);if(s=s??c.externalId,a=a??c.versionTag,t.scope&&t.scope.length>0?p=t.scope.map(i.parseScope):p=c.deployments.map(f=>({org:f.org,project:f.project})),!s)throw new Error("--appid is required (or set externalId in app.json)");if(!a)throw new Error("--app-version is required (or set versionTag in app.json)");let l=e?wt(n,e):Q(n,s,a);if(!i.existsSync(l)){let f=e?"":" (default derived from app.json \u2014 pass [bundle] explicitly to override, or run `cognite apps deploy` first to populate .cognite-bundles/)";throw new Error(`Bundle not found: ${l}${f}`)}let d=i.validateScopes(p);if(d.length>0)throw new Error(`Invalid scopes:
-  ${d.join(`
-  `)}`);let{privateKeyPem:m,kid:y}=await i.resolvePrivateKey({keyPath:t.key?wt(n,t.key):void 0,kid:t.signingIdentity,interactive:t.interactive}),g=i.createBundleStream(l),u=await i.signBundle({privateKeyPem:m,kid:y,appId:s,version:a,bundleStream:g,role:t.asCertifier?"certifier":"developer",scopes:p}),S=t.output?wt(n,t.output):wa(Sa(l),`${ha(l)}.${t.asCertifier?"cert":"dev"}.sig`);i.writeFileSync(S,u.token,"utf-8"),console.log(`\u2705 Signed: ${S}`),console.log(`   kid:    ${u.kid}`),console.log(`   bundle: ${u.payload.bundleSha256}`),console.log(`   scopes: ${u.payload.scopes.map(f=>`${f.org}/${f.project}`).join(", ")}`),t.verbose&&console.log(`
-Payload:`,JSON.stringify(u.payload,null,2));let h=Array.from(new Set([...i.discoverSignatures(l),u.token])),k=t.interactive?await R(c,{deployment:t.deployment,baseUrl:t.baseUrl,project:t.project,org:t.org}):b(c.deployments,t.deployment);if(!t.browserAuth){let f=$(k);if(f.length>0)throw new Error(`Deployment ${k.org}/${k.project} is missing ${f.join(" and ")} in app.json. Pass --browser-auth to authenticate via browser instead.`)}await i.submitSignatures(k,s,a,h,t),console.log(`
-To publish:  npx @cognite/cli apps publish .`)}o(Wr,"handleSign");function Xr(e,t={}){return e.command("sign [bundle]").description("Sign an app bundle (defaults to .cognite-bundles/<app>-<version>.zip)").option("--key <path>","Private key PEM file path").option("-s, --signing-identity <kid>","Key ID for Keychain or file lookup").option("--appid <id>","Application ID (default: externalId from app.json)").option("-i, --identifier <id>","Alias for --appid").option("--app-version <version>","App version (default: versionTag from app.json)").option("--scope <org/project...>","Deployment scope(s) (default: deployments from app.json)").option("-r, --requirements <org/project...>","Alias for --scope").option("-o, --output <path>","Output file path (default: <bundle>.<dev|cert>.sig)").option("-v, --verbose","Display full payload after signing").option("--as-certifier","Counter-sign a developer signature as certifier").option("--interactive","Enable interactive prompts (key selection, passphrase, deployment target selection)",!1).option("--browser-auth","Use browser-based PKCE auth when submitting the signature",!1).option("-d, --deployment <target>","Deployment target from app.json (index or name; submit step only)").option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive or --browser-auth)").action((r,n)=>{let i={...n,appid:n.identifier??n.appid,scope:n.requirements??n.scope};return Wr(r,i,t)})}o(Xr,"registerSignCommand");function xa(e){return e.alias==="ACTIVE"?"ACTIVE":e.lifecycleState}o(xa,"describeStatus");function Aa(e){if(e.length===0)return["Signatures: none stored"];let t=["Signatures:"];for(let r of e){let n=r.status==="VALID"?"\u2705":"\u274C",i=new Date(r.signatureIat).toISOString();t.push(`  ${n} ${r.signerKid}  (${r.signerRole}, signed ${i}) \u2014 ${r.status}`)}return t}o(Aa,"formatSignatures");async function Da(e){let t=process.cwd();T(t);let r=v(t);F(r);let n=e.interactive?await R(r,e):b(r.deployments,e.deployment);if(!e.interactive){let a=$(n);if(a.length>0)throw new Error(`Deployment ${n.org}/${n.project} is missing ${a.join(" and ")} in app.json. Use \`cognite apps status --interactive\` for browser-based authentication instead.`)}let i=await I(n,{interactive:e.interactive,appId:r.externalId,orgHint:e.org}),s=new E(i);console.log(""),console.log(`App:     ${r.name} (${r.externalId})`),console.log(`Version: ${r.versionTag}  (local)`);try{let a=await s.getVersion(r.externalId,r.versionTag);console.log(`Status:  ${xa(a)}`);let p=await Ia(s,r.externalId,r.versionTag);if(console.log(""),p==="endpoint-unavailable")console.log("Signatures: backend endpoint not available on this cluster yet");else for(let c of Aa(p))console.log(c);a.lifecycleState==="DRAFT"&&(console.log(""),console.log("Run `npx @cognite/cli apps publish .` to publish this version."))}catch(a){if(a instanceof j){console.log("Status:  not deployed yet"),console.log(""),console.log("Run `npx @cognite/cli apps deploy` to upload this version.");return}throw a}}o(Da,"handleStatus");async function Ia(e,t,r){try{return await e.listSignatures(t,r)}catch(n){if(z(n)&&n.status===404||n instanceof Error&&/status code: 404/.test(n.message))return"endpoint-unavailable";throw n}}o(Ia,"fetchSignatures");function Zr(e){return e.command("status").description("Show the deployment status and signatures of the current app version").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
+  npx @cognite/cli@latest apps setup-https --cert-dir certs    Use a custom directory`).action(t=>cd(t))}i(ko,"registerSetupHttpsCommand");import{existsSync as Dd,writeFileSync as $d}from"fs";import{basename as Rd,dirname as Td,join as Fd,resolve as Ur}from"path";import{parseScope as Od,signBundle as Ld,validateScopes as Nd}from"@cognite/app-sdk/codesigning";import{existsSync as Pd,readFileSync as Ad}from"fs";import{pbkdf2 as md,randomBytes as ud}from"crypto";import{promisify as gd}from"util";import{CompactEncrypt as fd,base64url as Co,compactDecrypt as yd}from"jose";var ld=new TextEncoder,dd=new TextDecoder,Or={encode:i(e=>ld.encode(e),"encode"),decode:i(e=>dd.decode(e),"decode")};var hd=gd(md),_r=6e5,Sd="sha512",Lr="PBKDF2-HMAC-SHA512",Nr=16,$t="A256GCM",wd=32,Rt=2e6;async function xo(e,t,r){return await hd(e,t,r,wd,Sd)}i(xo,"deriveKey");async function Eo(e,t,r=_r){if(!Number.isInteger(r)||r<1||r>Rt)throw new Error(`Invalid iterations: must be an integer between 1 and ${Rt}`);let n=ud(Nr),o=await xo(t.expose(),n,r);return await new fd(Or.encode(e.expose())).setProtectedHeader({alg:"dir",enc:$t,kdf:Lr,kdf_iter:r,kdf_salt:Co.encode(n)}).encrypt(o)}i(Eo,"encryptStringAsJwe");async function bo(e,t){let{plaintext:r}=await yd(e,async n=>{if(!e.length)throw new Error("Unexpected JWE empty value");let o=t.expose();if(o.length<15)throw new Error(`Invalid passphrase: must be at least ${15} characters`);if(n.alg!=="dir")throw new Error(`Unexpected JWE alg "${String(n.alg)}"; only "dir" is supported`);if(n.enc!==$t)throw new Error(`Unexpected JWE enc "${String(n.enc)}"; only "${$t}" is supported`);if(n.kdf!==Lr)throw new Error(`Unexpected KDF "${String(n.kdf)}"; only "${Lr}" is supported`);let s=Number(n.kdf_iter);if(!Number.isInteger(s)||s<1||s>Rt)throw new Error(`Invalid kdf_iter in JWE header: must be an integer between 1 and ${Rt}`);if(typeof n.kdf_salt!="string")throw new Error("Missing kdf_salt in JWE header");let a=Co.decode(n.kdf_salt);if(a.length!==Nr)throw new Error(`Invalid kdf_salt length in JWE header: expected ${Nr} bytes, got ${a.length}`);return await xo(o,a,s)},{keyManagementAlgorithms:["dir"],contentEncryptionAlgorithms:[$t]});return Or.decode(r)}i(bo,"decryptJweAsString");function vd(e){let t=e.trim();return t.startsWith("eyJ")&&t.split(".").length===5}i(vd,"isJweCompact");var Po=vd;import kd from"enquirer";async function Cd(e){return kd.prompt(e)}i(Cd,"defaultPrompt");async function Ao(e,t={}){let{prompt:r=Cd}=t,{passphrase:n}=await r({type:"password",name:"passphrase",message:e});return k.from(n)}i(Ao,"promptPassphrase");import Ed from"enquirer";import{statSync as xd}from"fs";function Io(e,t=xd){return e.map(r=>({key:r,mtime:t(r.publicKeyPath).mtimeMs})).sort((r,n)=>n.mtime-r.mtime).map(({key:r})=>r)}i(Io,"sortByMtime");async function bd(e){return Ed.prompt(e)}i(bd,"defaultPrompt");async function Do(e,t={}){if(e.length===1)return e[0];let{prompt:r=bd,sortByMtime:n=Io}=t,o=n(e),s=o[0],{choice:a}=await r({type:"select",name:"choice",message:"Select signing identity",choices:[{name:"latest",message:`Use latest: ${s.kid}`},{name:"pick",message:"Pick from list"}]});if(a==="latest")return s;if(a==="pick"){let{kid:p}=await r({type:"select",name:"kid",message:"Select signing identity",choices:o.map(l=>({name:l.kid,message:[l.kid,l.email,yt(l.source)].filter(Boolean).join("  \u2014  ")}))}),c=o.find(l=>l.kid===p);if(!c)throw new Error("No signing identity selected");return c}else throw new Error(`Unexpected choice: "${a}"`)}i(Do,"promptSigningIdentity");function Id(e){return{existsSync:e.existsSync??Pd,readFileSync:e.readFileSync??((t,r)=>Ad(t,r)),readKeyFromKeychain:e.readKeyFromKeychain??ft,decryptJweAsString:e.decryptJweAsString??bo,discoverLocalKeys:e.discoverLocalKeys??ht,keysDir:e.keysDir??D().keysDir,promptPassphrase:e.promptPassphrase??Ao,promptSigningIdentity:e.promptSigningIdentity??Do}}i(Id,"resolveDeps");async function $o(e,t={}){let r=Id(t);if(e.keyPath){if(!r.existsSync(e.keyPath))throw new Error(`Key file not found: ${e.keyPath}`);if(!e.kid)throw new Error("--signing-identity <kid> is required when using --key");let s=r.readFileSync(e.keyPath,"utf-8").trim();if(Po(s)){if(!e.interactive)throw new Error(`Key at ${e.keyPath} is passphrase-encrypted. Pass --interactive to enter the passphrase.`);let a=await r.promptPassphrase(`Passphrase for key ${e.kid}: `);return{privateKeyPem:k.from(await r.decryptJweAsString(s,a)),kid:e.kid}}return{privateKeyPem:k.from(s),kid:e.kid}}let n=await r.discoverLocalKeys(r.keysDir);if(n.length===0)throw new Error("No signing keys found. Run `cognite keys generate` or pass --key.");let o;if(e.kid)o=n.find(s=>s.kid===e.kid);else if(e.interactive)o=await r.promptSigningIdentity(n);else throw new Error("--signing-identity <kid> is required. Pass --interactive to select it interactively.");if(!o)throw new Error(`No key found with kid "${e.kid}"`);switch(o.source.kind){case"keychain":{let s=await r.readKeyFromKeychain(o.kid);if(!s)throw new Error(`Key "${o.kid}" not found in Keychain`);return{privateKeyPem:s,kid:o.kid}}case"encrypted-file":{if(!e.interactive)throw new Error(`Key "${o.kid}" is passphrase-encrypted. Pass --interactive to enter the passphrase, or store the key in macOS Keychain for non-interactive use.`);let s=await r.promptPassphrase(`Passphrase for key ${o.kid}: `);return{privateKeyPem:k.from(await r.decryptJweAsString(r.readFileSync(o.source.path,"utf-8"),s)),kid:o.kid}}case"public-only":throw new Error(`Key "${o.kid}" has no private key on this machine (public-only).`)}}i($o,"resolvePrivateKey");var _d=i(async(e,t,r,n,o)=>{let s=await b(e,{interactive:o.browserAuth??!1,appId:t,orgHint:o.org});await new E(s).submitSignatures(t,r,n)},"defaultSubmitSignatures");function Ud(e){return{existsSync:e.existsSync??Dd,writeFileSync:e.writeFileSync??$d,createBundleStream:e.createBundleStream??St,signBundle:e.signBundle??Ld,parseScope:e.parseScope??Od,validateScopes:e.validateScopes??Nd,loadAppConfig:e.loadAppConfig??v,resolvePrivateKey:e.resolvePrivateKey??(t=>$o(t)),submitSignatures:e.submitSignatures??_d,discoverSignatures:e.discoverSignatures??Ge}}i(Ud,"resolveDeps");async function Ro(e,t,r={},n=process.cwd()){let o=Ud(r),s=t.appid,a=t.appVersion,p=[],c=o.loadAppConfig(n);if(s=s??c.externalId,a=a??c.versionTag,t.scope&&t.scope.length>0?p=t.scope.map(o.parseScope):p=c.deployments.map(S=>({org:S.org,project:S.project})),!s)throw new Error("--appid is required (or set externalId in app.json)");if(!a)throw new Error("--app-version is required (or set versionTag in app.json)");let l=e?Ur(n,e):Z(n,s,a);if(!o.existsSync(l)){let S=e?"":" (default derived from app.json \u2014 pass [bundle] explicitly to override, or run `cognite apps deploy` first to populate .cognite-bundles/)";throw new Error(`Bundle not found: ${l}${S}`)}let m=o.validateScopes(p);if(m.length>0)throw new Error(`Invalid scopes:
+  ${m.join(`
+  `)}`);let{privateKeyPem:d,kid:u}=await o.resolvePrivateKey({keyPath:t.key?Ur(n,t.key):void 0,kid:t.signingIdentity,interactive:t.interactive}),f=o.createBundleStream(l),g=await o.signBundle({privateKeyPem:d.expose(),kid:u,appId:s,version:a,bundleStream:f,role:t.asCertifier?"certifier":"developer",scopes:p}),h=t.output?Ur(n,t.output):Fd(Td(l),`${Rd(l)}.${t.asCertifier?"cert":"dev"}.sig`);o.writeFileSync(h,g.token,"utf-8"),console.log(`\u2705 Signed: ${h}`),console.log(`   kid:    ${g.kid}`),console.log(`   bundle: ${g.payload.bundleSha256}`),console.log(`   scopes: ${g.payload.scopes.map(S=>`${S.org}/${S.project}`).join(", ")}`),t.verbose&&console.log(`
+Payload:`,JSON.stringify(g.payload,null,2));let w=Array.from(new Set([...o.discoverSignatures(l),g.token])),C=t.interactive?await R(c,{deployment:t.deployment,baseUrl:t.baseUrl,project:t.project,org:t.org}):A(c.deployments,t.deployment);if(!t.browserAuth){let S=$(C);if(S.length>0)throw new Error(`Deployment ${C.org}/${C.project} is missing ${S.join(" and ")} in app.json. Pass --browser-auth to authenticate via browser instead.`)}await o.submitSignatures(C,s,a,w,t),console.log(`
+To publish:  npx @cognite/cli apps publish .`)}i(Ro,"handleSign");function To(e,t={}){return e.command("sign [bundle]").description("Sign an app bundle (defaults to .cognite-bundles/<app>-<version>.zip)").option("--key <path>","Private key PEM file path").option("-s, --signing-identity <kid>","Key ID for Keychain or file lookup").option("--appid <id>","Application ID (default: externalId from app.json)").option("-i, --identifier <id>","Alias for --appid").option("--app-version <version>","App version (default: versionTag from app.json)").option("--scope <org/project...>","Deployment scope(s) (default: deployments from app.json)").option("-r, --requirements <org/project...>","Alias for --scope").option("-o, --output <path>","Output file path (default: <bundle>.<dev|cert>.sig)").option("-v, --verbose","Display full payload after signing").option("--as-certifier","Counter-sign a developer signature as certifier").option("--interactive","Enable interactive prompts (key selection, passphrase, deployment target selection)",!1).option("--browser-auth","Use browser-based PKCE auth when submitting the signature",!1).option("-d, --deployment <target>","Deployment target from app.json (index or name; submit step only)").option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive or --browser-auth)").action((r,n)=>{let o={...n,appid:n.identifier??n.appid,scope:n.requirements??n.scope};return Ro(r,o,t)})}i(To,"registerSignCommand");function Md(e){return e.alias==="ACTIVE"?"ACTIVE":e.lifecycleState}i(Md,"describeStatus");function Vd(e){if(e.length===0)return["Signatures: none stored"];let t=["Signatures:"];for(let r of e){let n=r.status==="VALID"?"\u2705":"\u274C",o=new Date(r.signatureIat).toISOString();t.push(`  ${n} ${r.signerKid}  (${r.signerRole}, signed ${o}) \u2014 ${r.status}`)}return t}i(Vd,"formatSignatures");async function jd(e){let t=process.cwd();P(t);let r=v(t);T(r);let n=e.interactive?await R(r,e):A(r.deployments,e.deployment);if(!e.interactive){let a=$(n);if(a.length>0)throw new Error(`Deployment ${n.org}/${n.project} is missing ${a.join(" and ")} in app.json. Use \`cognite apps status --interactive\` for browser-based authentication instead.`)}let o=await b(n,{interactive:e.interactive,appId:r.externalId,orgHint:e.org}),s=new E(o);console.log(""),console.log(`App:     ${r.name} (${r.externalId})`),console.log(`Version: ${r.versionTag}  (local)`);try{let a=await s.getVersion(r.externalId,r.versionTag);console.log(`Status:  ${Md(a)}`);let p=await Kd(s,r.externalId,r.versionTag);if(console.log(""),p==="endpoint-unavailable")console.log("Signatures: backend endpoint not available on this cluster yet");else for(let c of Vd(p))console.log(c);a.lifecycleState==="DRAFT"&&(console.log(""),console.log("Run `npx @cognite/cli apps publish .` to publish this version."))}catch(a){if(a instanceof Q){console.log("Status:  not deployed yet"),console.log(""),console.log("Run `npx @cognite/cli apps deploy` to upload this version.");return}throw a}}i(jd,"handleStatus");async function Kd(e,t,r){try{return await e.listSignatures(t,r)}catch(n){if(ye(n)&&n.status===404||n instanceof Error&&/status code: 404/.test(n.message))return"endpoint-unavailable";throw n}}i(Kd,"fetchSignatures");function Fo(e){return e.command("status").description("Show the deployment status and signatures of the current app version").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
 Examples:
   npx @cognite/cli apps status .                     Status using env-var auth
-  npx @cognite/cli apps status . --interactive       Status using browser auth (no secrets needed)`).action((t,r)=>Da(r))}o(Zr,"registerStatusCommand");import{execFileSync as Et}from"child_process";import Ct from"fs";import ue from"path";import Fa from"readline";var Qr="https://cognite.zendesk.com",$a="360001234312",Ra="tf_360015295097",Ta="cognite_flows_certifications";function en(e,t,r){let n=new URLSearchParams({ticket_form_id:$a,tf_priority:"normal",tf_subject:e,[Ra]:Ta,tf_description:t});return`${r}/hc/en-us/requests/new?${n}`}o(en,"buildUrl");function tn(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;")}o(tn,"escapeHtml");function vt(e){return e.map(tn).join("<br>")}o(vt,"toHtml");function rn(e,t=Qr){let{appName:r,externalId:n,versionTag:i,archiveName:s,developerName:a,cdfProject:p,cdfCluster:c}=e,l=["Dear Cognite Platform Team,","","I would like to submit my Flows app for review and certification.","",`App name: ${r}`,`App external ID: ${n}`,`Version: ${i}`,p?`CDF project: ${p}`:void 0,c?`CDF cluster: ${c}`:void 0,"","`npx @cognite/cli apps submit` verified App-Brief.md,","code-review-report.md, and design-review-report.md are committed to git.","","Attached (all from dist/submit/):",`[ ] ${s??"src-<sha>.zip"} \u2014 source archive`,`[ ] ${n}-${i}.zip \u2014 deploy bundle`,"[ ] Screen recording of the application (required for design review)","","Best regards,",a??"[Your name]"];return en(`App Review Request: ${r}`,vt(l.filter(d=>d!==void 0)),t)}o(rn,"buildAppReviewUrl");function nn(e,t,r,n,i=Qr){let s=vt(["Dear Cognite Platform Team,","","I would like to register my Flows app signing key for certified deployments.","",`Key ID (kid): ${e}`,`Developer email: ${t}`,`Expires: ${r}`,"","Please add the following entry to public_keys.yaml:"]),a=`<pre>${tn(n.replace(/\r\n/g,`
-`))}</pre>`,p=vt(["","Best Regards,","[Your name]","","(This registration request was generated by `npx @cognite/cli keys generate`.)"]);return en(`Public Key Registration: ${t}`,`${s}<br>${a}${p}`,i)}o(nn,"buildKeyRegistrationUrl");function Oa(){return new Promise(e=>{let t=Fa.createInterface({input:process.stdin,output:process.stdout});t.question(`
-Press Enter to open the Zendesk form in your browser and reveal dist/submit/ in your file manager...`,()=>{t.close(),e()})})}o(Oa,"defaultPressEnter");var _a=[{pattern:"App-Brief.md",label:"App-Brief.md",skill:"flows-app-brief"},{pattern:"reviews/code-review/*/code-review-report.md",label:"reviews/code-review/feedback-round-<N>/code-review-report.md",skill:"flows-code-review"},{pattern:"reviews/design-review/*/design-review-report.md",label:"reviews/design-review/feedback-round-<N>/design-review-report.md",skill:"flows-design-review"}];function Ua(e){let t=_a.filter(({pattern:r})=>Et("git",["-C",e,"ls-files","--",r],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().length===0);if(t.length>0){let r=t.map(({label:n,skill:i})=>`  ${n}  \u2192  /${i}`);throw new Error(`Certification files are missing or not committed. Run the required skills in Claude Code first:
+  npx @cognite/cli apps status . --interactive       Status using browser auth (no secrets needed)`).action((t,r)=>jd(r))}i(Fo,"registerStatusCommand");import{execFileSync as jr}from"child_process";import Vr from"fs";import Be from"path";import qd from"readline";var Oo="https://cognite.zendesk.com",Hd="360001234312",Gd="tf_360015295097",Bd="cognite_flows_certifications";function Lo(e,t,r){let n=new URLSearchParams({ticket_form_id:Hd,tf_priority:"normal",tf_subject:e,[Gd]:Bd,tf_description:t});return`${r}/hc/en-us/requests/new?${n}`}i(Lo,"buildUrl");function No(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;")}i(No,"escapeHtml");function Mr(e){return e.map(No).join("<br>")}i(Mr,"toHtml");function _o(e,t=Oo){let{appName:r,externalId:n,versionTag:o,archiveName:s,developerName:a,cdfProject:p,cdfCluster:c}=e,l=["Dear Cognite Platform Team,","","I would like to submit my Flows app for review and certification.","",`App name: ${r}`,`App external ID: ${n}`,`Version: ${o}`,p?`CDF project: ${p}`:void 0,c?`CDF cluster: ${c}`:void 0,"","`npx @cognite/cli apps submit` verified App-Brief.md,","code-review-report.md, and design-review-report.md are committed to git.","","Attached (all from dist/submit/):",`[ ] ${s??"src-<sha>.zip"} \u2014 source archive`,`[ ] ${n}-${o}.zip \u2014 deploy bundle`,"[ ] Screen recording of the application (required for design review)","","Best regards,",a??"[Your name]"];return Lo(`App Review Request: ${r}`,Mr(l.filter(m=>m!==void 0)),t)}i(_o,"buildAppReviewUrl");function Uo(e,t,r,n,o=Oo){let s=Mr(["Dear Cognite Platform Team,","","I would like to register my Flows app signing key for certified deployments.","",`Key ID (kid): ${e}`,`Developer email: ${t}`,`Expires: ${r}`,"","Please add the following entry to public_keys.yaml:"]),a=`<pre>${No(n.replace(/\r\n/g,`
+`))}</pre>`,p=Mr(["","Best Regards,","[Your name]","","(This registration request was generated by `npx @cognite/cli keys generate`.)"]);return Lo(`Public Key Registration: ${t}`,`${s}<br>${a}${p}`,o)}i(Uo,"buildKeyRegistrationUrl");function Qd(){return new Promise(e=>{let t=qd.createInterface({input:process.stdin,output:process.stdout});t.question(`
+Press Enter to open the Zendesk form in your browser and reveal dist/submit/ in your file manager...`,()=>{t.close(),e()})})}i(Qd,"defaultPressEnter");var Jd=[{pattern:"App-Brief.md",label:"App-Brief.md",skill:"flows-app-brief"},{pattern:"reviews/code-review/*/code-review-report.md",label:"reviews/code-review/feedback-round-<N>/code-review-report.md",skill:"flows-code-review"},{pattern:"reviews/design-review/*/design-review-report.md",label:"reviews/design-review/feedback-round-<N>/design-review-report.md",skill:"flows-design-review"}];function Yd(e){let t=Jd.filter(({pattern:r})=>jr("git",["-C",e,"ls-files","--",r],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().length===0);if(t.length>0){let r=t.map(({label:n,skill:o})=>`  ${n}  \u2192  /${o}`);throw new Error(`Certification files are missing or not committed. Run the required skills in Claude Code first:
 
 `+r.join(`
-`)+"\n\nAfter running the skills, commit the generated files and re-run `apps submit`.")}}o(Ua,"assertArtifactsCommitted");async function La(e=process.cwd(),t={}){let{openInBrowser:r=Or,revealInFileManager:n=_r,pressEnter:i=Oa,isInteractive:s=o(()=>process.stdout.isTTY===!0,"isInteractive")}=t;if(!ve())throw new Error("git is not installed. Install git and ensure it is in your PATH.");if(!Ce(e))throw new Error("Not a git repository. Run this command from your app's root directory.");T(e);let a=v(e);F(a),Ua(e);let p=ue.join(e,"dist","submit");Ct.mkdirSync(p,{recursive:!0});let c=Et("git",["-C",e,"rev-parse","--short","HEAD"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim();if(Et("git",["-C",e,"status","--porcelain"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().length>0)throw new Error(`Working tree has uncommitted changes. Commit or stash them before submitting for certification.
+`)+"\n\nAfter running the skills, commit the generated files and re-run `apps submit`.")}}i(Yd,"assertArtifactsCommitted");async function zd(e=process.cwd(),t={}){let{openInBrowser:r=zn,revealInFileManager:n=Wn,pressEnter:o=Qd,isInteractive:s=i(()=>process.stdout.isTTY===!0,"isInteractive")}=t;if(!dt())throw new Error("git is not installed. Install git and ensure it is in your PATH.");if(!mt(e))throw new Error("Not a git repository. Run this command from your app's root directory.");P(e);let a=v(e);T(a),Yd(e);let p=Be.join(e,"dist","submit");Vr.mkdirSync(p,{recursive:!0});let c=jr("git",["-C",e,"rev-parse","--short","HEAD"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim();if(jr("git",["-C",e,"status","--porcelain"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().length>0)throw new Error(`Working tree has uncommitted changes. Commit or stash them before submitting for certification.
 
-The source archive must exactly match the committed code so reviewers can verify what they receive.`);let d=`src-${c}.zip`,m=ue.join(p,d);await new Z(ue.join(e,"dist")).createSourceArchive(m);let g=`${a.externalId}-${a.versionTag}.zip`,u=ue.join(e,".cognite-bundles",g),S=!1;Ct.existsSync(u)&&(Ct.copyFileSync(u,ue.join(p,g)),S=!0);let h=rn({appName:a.name,externalId:a.externalId,versionTag:a.versionTag,archiveName:d,developerName:or(),cdfProject:a.deployments[0].project,cdfCluster:a.deployments[0].baseUrl});console.log(`
-\u2705 Certification package ready: dist/submit/`),console.log(`   ${d} \u2014 source archive (commit ${c})`),console.log(S?`   ${g} \u2014 deploy bundle`:"   \u26A0 Deploy bundle missing \u2014 run `apps deploy` to generate it, then re-run submit"),console.log("   \u2190 add your screen recording to this folder"),console.log(`
+The source archive must exactly match the committed code so reviewers can verify what they receive.`);let m=`src-${c}.zip`,d=Be.join(p,m);await new he(Be.join(e,"dist")).createSourceArchive(d);let f=`${a.externalId}-${a.versionTag}.zip`,g=Be.join(e,".cognite-bundles",f),h=!1;Vr.existsSync(g)&&(Vr.copyFileSync(g,Be.join(p,f)),h=!0);let w=_o({appName:a.name,externalId:a.externalId,versionTag:a.versionTag,archiveName:m,developerName:ui(),cdfProject:a.deployments[0].project,cdfCluster:a.deployments[0].baseUrl});console.log(`
+\u2705 Certification package ready: dist/submit/`),console.log(`   ${m} \u2014 source archive (commit ${c})`),console.log(h?`   ${f} \u2014 deploy bundle`:"   \u26A0 Deploy bundle missing \u2014 run `apps deploy` to generate it, then re-run submit"),console.log("   \u2190 add your screen recording to this folder"),console.log(`
 Attach all files from dist/submit/ to the Zendesk ticket.`),console.log(`
-\u{1F517} ${h}`),s()&&(await i(),r(h),n(m))}o(La,"handleSubmit");function on(e){return e.command("submit").description("Package source and open a pre-filled Zendesk form for app certification submission").addHelpText("after",`
+\u{1F517} ${w}`),s()&&(await o(),r(w),n(d))}i(zd,"handleSubmit");function Mo(e){return e.command("submit").description("Package source and open a pre-filled Zendesk form for app certification submission").addHelpText("after",`
 Examples:
-  npx @cognite/cli apps submit          Package source, open browser + file manager`).action(()=>La())}o(on,"registerSubmitCommand");function sn(e){let t=e.command("apps").description("Manage Fusion Custom Apps \u2014 create, deploy, and manage version lifecycle");return Cr(t),$r(t),Zr(t),Rr(t),rr(t),Er(t),Tr(t),on(t),Sr(t),Xr(t),t}o(sn,"registerAppsCommand");import{existsSync as Wa,mkdirSync as Xa,writeFileSync as Za}from"fs";import{dirname as It,join as ye}from"path";import{generateSigningKeyPair as Qa}from"@cognite/app-sdk/codesigning";import ep from"open";import bt from"enquirer";import{email as Na,pipe as Ka,safeParse as ja,string as Ma}from"valibot";var Ha=Ka(Ma(),Na());function ne(e,t="email"){let r=e.trim();if(!r)throw new Error(`${t} is required`);if(!ja(Ha,r).success)throw new Error(`${t} must look like an email (user@example.com); got "${e}"`);return r}o(ne,"parseEmail");function oe(e,t="--expires"){let r=Number(e);if(!Number.isInteger(r)||r<1||r>12)throw new Error(`${t} must be an integer between 1 and 12 (months); got "${e}"`);return r}o(oe,"parseExpiryMonths");var Oe=3,an="Signing identity (kid) \u2014 e.g. jsmith-dev-001 (lowercase letters, digits, hyphens)",pn=`Key expiry in months (${1}-${12})`,cn="Email address for the registry entry",ln=`Passphrase for the encrypted private key (min ${15} chars)`,dn="Confirm passphrase",mn=o(()=>`Passphrase must be at least ${15} characters`,"passphraseTooShortMsg"),un=o(e=>`Passphrases do not match (attempt ${e}/${Oe}).
-`,"passphraseMismatchMsg"),gn=`Passphrase confirmation failed after ${Oe} attempts`,fn=o(e=>`A signing key with kid "${e}" already exists. Overwrite it?`,"confirmOverwriteMsg"),yn="How would you like to submit your key registration?",hn="Open in browser",Sn="Copy link to clipboard";async function _e(e){return bt.prompt(e)}o(_e,"defaultPrompt");function xt(e){return t=>{try{return e(t),!0}catch(r){return r instanceof Error?r.message:"Invalid"}}}o(xt,"parserAsValidator");var Ba=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;function ge(e){let t=e.trim();if(!t)throw new Error("--kid must not be empty");if(t.length>64)throw new Error("--kid must be 64 characters or fewer");if(!Ba.test(t))throw new Error("--kid must contain only lowercase letters, digits, and hyphens, and must not start or end with a hyphen (e.g. jsmith-dev-001)");return t}o(ge,"parseKid");async function wn(e={}){let{prompt:t=_e}=e,{kid:r}=await t({type:"input",name:"kid",message:an,validate:xt(ge)});return ge(r)}o(wn,"promptKid");async function vn(e={}){let{prompt:t=o(n=>bt.prompt(n),"prompt")}=e,{action:r}=await t({type:"select",name:"action",message:yn,choices:[{name:"browser",message:hn},{name:"clipboard",message:Sn}]});if(r!=="browser"&&r!=="clipboard")throw new Error(`Unexpected Zendesk action: ${r}`);return r}o(vn,"promptZendeskAction");async function Cn(e={}){let{prompt:t=_e}=e,{months:r}=await t({type:"input",name:"months",message:pn,initial:String(6),validate:xt(n=>oe(n,"expiry"))});return oe(r,"expiry")}o(Cn,"promptExpiryMonths");async function En(e={}){let{prompt:t=_e,gitUserEmail:r=ir}=e,{email:n}=await t({type:"input",name:"email",message:cn,initial:r(),validate:xt(i=>ne(i,"email"))});return ne(n,"email")}o(En,"promptEmail");async function kn(e={}){let{prompt:t=_e,stderr:r=process.stderr}=e;for(let n=1;n<=Oe;n+=1){let{passphrase:i}=await t({type:"password",name:"passphrase",message:ln,validate:o(a=>a.length>=15?!0:mn(),"validate")}),{confirm:s}=await t({type:"password",name:"confirm",message:dn});if(i===s)return i;r.write(un(n))}throw new Error(gn)}o(kn,"promptPassphrase");async function Pn(e,t={}){let{prompt:r=o(i=>bt.prompt(i),"prompt")}=t,{confirmed:n}=await r({type:"confirm",name:"confirmed",message:fn(e),initial:!1});return n}o(Pn,"promptConfirmOverwrite");function bn(e,t){let r=e.getUTCFullYear(),n=e.getUTCMonth()+t,i=new Date(Date.UTC(r,n+1,0)).getUTCDate(),s=Math.min(e.getUTCDate(),i);return new Date(Date.UTC(r,n,s))}o(bn,"addMonthsClamped");function At(e){return e.toISOString().slice(0,10)}o(At,"formatIsoDate");function xn(e=new Date){return At(e)}o(xn,"todayIso");import Ga,{Chalk as Ya}from"chalk";var fe=new Ya({level:0});function An(e){return e.isTTY?Ga:fe}o(An,"chalkForStream");var Ue=Uint8Array.from([48,42,48,5,6,3,43,101,112,3,33,0]),Dn=32,In=44,$n=60,qa="services/app-hosting/src/kotlin/com/cognite/apphosting/signing/public_keys.yaml";function Ja(e){let t=e.replace(/-----BEGIN [^-]+-----/g,"").replace(/-----END [^-]+-----/g,"").replace(/\s+/g,"");if(t.length!==In&&t.length!==$n)throw new Error(`Unexpected Ed25519 public key base64 length: got ${t.length} chars, expected ${In} (raw) or ${$n} (X.509-wrapped)`);let r=Buffer.from(t,"base64");if(r.length===Ue.length+Dn&&r.subarray(0,Ue.length).equals(Ue))return r.subarray(Ue.length).toString("base64");if(r.length===Dn)return r.toString("base64");throw new Error(`Unexpected Ed25519 public key length: got ${r.length} bytes, expected 32 (raw) or 44 (X.509-wrapped)`)}o(Ja,"pemBodyOneLine");function Dt(e,t=fe,r=new Date){let n=Rn(e.issuedAt??xn(r)),i=Rn(e.expires),s=Ja(e.publicKeyPem),a="    ",p=o((l,d)=>`${a}${t.cyan(l)}${t.dim(":")} ${d}
+  npx @cognite/cli apps submit          Package source, open browser + file manager`).action(()=>zd())}i(Mo,"registerSubmitCommand");function Vo(e){let t=e.command("apps").description("Manage Fusion Custom Apps \u2014 create, deploy, and manage version lifecycle");return lo(t),So(t),Fo(t),wo(t),vo(t),Ji(t),mo(t),ko(t),Mo(t),ao(t),di(t),To(t),Vi(t),t}i(Vo,"registerAppsCommand");import{existsSync as rm,mkdirSync as nm,writeFileSync as im}from"fs";import{dirname as Gr,join as Qe}from"path";import{generateSigningKeyPair as om}from"@cognite/app-sdk/codesigning";import sm from"open";function jo(e,t){let r=e.getUTCFullYear(),n=e.getUTCMonth()+t,o=new Date(Date.UTC(r,n+1,0)).getUTCDate(),s=Math.min(e.getUTCDate(),o);return new Date(Date.UTC(r,n,s))}i(jo,"addMonthsClamped");function Kr(e){return e.toISOString().slice(0,10)}i(Kr,"formatIsoDate");function Ko(e=new Date){return Kr(e)}i(Ko,"todayIso");import Wd,{Chalk as Xd}from"chalk";var qe=new Xd({level:0});function Ho(e){return e.isTTY?Wd:qe}i(Ho,"chalkForStream");var Tt=Uint8Array.from([48,42,48,5,6,3,43,101,112,3,33,0]),Go=32,Bo=44,qo=60,Zd="services/app-hosting/src/kotlin/com/cognite/apphosting/signing/public_keys.yaml";function em(e){let t=e.replace(/-----BEGIN [^-]+-----/g,"").replace(/-----END [^-]+-----/g,"").replace(/\s+/g,"");if(t.length!==Bo&&t.length!==qo)throw new Error(`Unexpected Ed25519 public key base64 length: got ${t.length} chars, expected ${Bo} (raw) or ${qo} (X.509-wrapped)`);let r=Buffer.from(t,"base64");if(r.length===Tt.length+Go&&r.subarray(0,Tt.length).equals(Tt))return r.subarray(Tt.length).toString("base64");if(r.length===Go)return r.toString("base64");throw new Error(`Unexpected Ed25519 public key length: got ${r.length} bytes, expected 32 (raw) or 44 (X.509-wrapped)`)}i(em,"pemBodyOneLine");function Hr(e,t=qe,r=new Date){let n=Qo(e.issuedAt??Ko(r)),o=Qo(e.expires),s=em(e.publicKeyPem),a="    ",p=i((l,m)=>`${a}${t.cyan(l)}${t.dim(":")} ${m}
 `,"kv"),c="";return c+=`
-${t.bold("Add this entry to")} ${t.magenta(qa)} ${t.bold("under")} ${t.cyan("publicKeys:")}
+${t.bold("Add this entry to")} ${t.magenta(Zd)} ${t.bold("under")} ${t.cyan("publicKeys:")}
 
 `,c+=`  ${t.dim("-")} ${t.cyan("kid")}${t.dim(":")} ${t.green(e.kid)}
-`,c+=p("publicKey",t.green(s)),c+=p("email",t.yellow(e.email)),c+=p("roles",`${t.dim("[")}${t.yellow("developer")}${t.dim("]")}`),c+=p("issuedAt",t.green(n)),c+=p("expiresAt",t.green(i)),c+=p("revokedAt",t.dim("null")),c}o(Dt,"renderRegistryYamlBlock");function Rn(e){let t=e.trim();if(/^\d{4}-\d{2}-\d{2}$/.test(t))return`${t}T00:00:00Z`;let r=new Date(t);if(Number.isNaN(r.getTime()))throw new Error(`Invalid date '${e}': expected YYYY-MM-DD or ISO-8601 instant`);return r.toISOString()}o(Rn,"toIsoInstant");import za from"clipboardy";function Tn(e){return za.write(e)}o(Tn,"copyToClipboard");function tp(e){return{writeFileSync:e.writeFileSync??Za,mkdirSync:e.mkdirSync??Xa,existsSync:e.existsSync??Wa,generateSigningKeyPair:e.generateSigningKeyPair??Qa,encryptStringAsJwe:e.encryptStringAsJwe??Vr,storeKeyInKeychain:e.storeKeyInKeychain??Kr,isOS:e.isOS??(t=>K(t)),promptKid:e.promptKid??wn,promptExpiryMonths:e.promptExpiryMonths??Cn,promptEmail:e.promptEmail??En,promptPassphrase:e.promptPassphrase??kn,promptConfirmOverwrite:e.promptConfirmOverwrite??Pn,discoverLocalKeys:e.discoverLocalKeys??(()=>Fe()),promptZendeskAction:e.promptZendeskAction??vn,openUrl:e.openUrl??(t=>ep(t)),copyToClipboard:e.copyToClipboard??Tn}}o(tp,"resolveDeps");function On(e,t={}){let r=tp(t),n=e.command("keys").description("Manage code signing keys");n.command("generate").description("Generate an Ed25519 keypair for code signing").option("-o, --output <path>","Encrypted private key output path (forces file storage even on macOS)").option("--no-keychain",`Skip macOS Keychain and write a passphrase-encrypted private key under ${_().keysDir} instead`).option("-e, --expires <months>",`Validity in months (${1}-${12}); skips the interactive prompt`).option("--email <address>","Email address for the registry entry; skips the interactive prompt").option("--kid <identifier>","Signing identity name for the registry (e.g. jsmith-dev-001); skips the interactive prompt").option("--force","Overwrite an existing key without prompting for confirmation").option("--copy-link","Copy the Zendesk registration link to the clipboard without prompting").option("--interactive","Prompt for any required flags that are not supplied",!1).action(i=>ip(i,r)),n.command("list").description("List local signing identities and their storage location").action(()=>rp(r))}o(On,"registerKeysCommand");async function rp(e){let t=await e.discoverLocalKeys();if(t.length===0){process.stdout.write(`No signing identities found.
-`),process.stdout.write(`Run \`cognite keys generate\` to create one (storage: ${_().keysDir}).
-`);return}let r=["KID","SOURCE","EMAIL"],n=t.map(a=>[a.kid,Te(a.source),a.email??"\u2014"]),i=r.map((a,p)=>Math.max(a.length,...n.map(c=>c[p].length))),s=o(a=>a.map((p,c)=>p.padEnd(i[c])).join("  ").trimEnd(),"fmt");process.stdout.write(`${s(r)}
+`,c+=p("publicKey",t.green(s)),c+=p("email",t.yellow(e.email)),c+=p("roles",`${t.dim("[")}${t.yellow("developer")}${t.dim("]")}`),c+=p("issuedAt",t.green(n)),c+=p("expiresAt",t.green(o)),c+=p("revokedAt",t.dim("null")),c}i(Hr,"renderRegistryYamlBlock");function Qo(e){let t=e.trim();if(/^\d{4}-\d{2}-\d{2}$/.test(t))return`${t}T00:00:00Z`;let r=new Date(t);if(Number.isNaN(r.getTime()))throw new Error(`Invalid date '${e}': expected YYYY-MM-DD or ISO-8601 instant`);return r.toISOString()}i(Qo,"toIsoInstant");import tm from"clipboardy";function Jo(e){return tm.write(e)}i(Jo,"copyToClipboard");function am(e){return{writeFileSync:e.writeFileSync??im,mkdirSync:e.mkdirSync??nm,existsSync:e.existsSync??rm,generateSigningKeyPair:e.generateSigningKeyPair??om,encryptStringAsJwe:e.encryptStringAsJwe??Eo,storeKeyInKeychain:e.storeKeyInKeychain??Li,isOS:e.isOS??(t=>_(t)),promptKid:e.promptKid??Ai,promptExpiryMonths:e.promptExpiryMonths??Di,promptEmail:e.promptEmail??$i,promptPassphrase:e.promptPassphrase??Ri,promptConfirmOverwrite:e.promptConfirmOverwrite??Ti,discoverLocalKeys:e.discoverLocalKeys??(()=>ht()),promptZendeskAction:e.promptZendeskAction??Ii,openUrl:e.openUrl??(t=>sm(t)),copyToClipboard:e.copyToClipboard??Jo}}i(am,"resolveDeps");function zo(e,t={}){let r=am(t),n=e.command("keys").description("Manage code signing keys");n.command("generate").description("Generate an Ed25519 keypair for code signing").option("-o, --output <path>","Encrypted private key output path (forces file storage even on macOS)").option("--no-keychain",`Skip macOS Keychain and write a passphrase-encrypted private key under ${D().keysDir} instead`).option("-e, --expires <months>",`Validity in months (${1}-${12}); skips the interactive prompt`).option("--email <address>","Email address for the registry entry; skips the interactive prompt").option("--kid <identifier>","Signing identity name for the registry (e.g. jsmith-dev-001); skips the interactive prompt").option("--force","Overwrite an existing key without prompting for confirmation").option("--copy-link","Copy the Zendesk registration link to the clipboard without prompting").option("--interactive","Prompt for any required flags that are not supplied",!1).action(o=>dm(o,r)),n.command("list").description("List local signing identities and their storage location").action(()=>pm(r))}i(zo,"registerKeysCommand");async function pm(e){let t=await e.discoverLocalKeys();if(t.length===0){process.stdout.write(`No signing identities found.
+`),process.stdout.write(`Run \`cognite keys generate\` to create one (storage: ${D().keysDir}).
+`);return}let r=["KID","SOURCE","EMAIL"],n=t.map(a=>[a.kid,yt(a.source),a.email??"\u2014"]),o=r.map((a,p)=>Math.max(a.length,...n.map(c=>c[p].length))),s=i(a=>a.map((p,c)=>p.padEnd(o[c])).join("  ").trimEnd(),"fmt");process.stdout.write(`${s(r)}
 `);for(let a of n)process.stdout.write(`${s(a)}
-`)}o(rp,"handleList");function Fn(e,t,r){let n=ye(_().keysDir,`${e}${re}`);return r.mkdirSync(It(n),{recursive:!0}),r.writeFileSync(n,t),n}o(Fn,"writePublicKey");async function np(e,t,r,n,i,{force:s=!1}={}){let a=n??ye(_().keysDir,`${e}${ht}`);if(i.mkdirSync(It(a),{recursive:!0}),!s&&i.existsSync(a))throw new Error(`Refusing to overwrite existing key at ${a}. Delete it first if you really want to regenerate: rm ${a}`);let p=await i.encryptStringAsJwe(t,r);return i.writeFileSync(a,p,{mode:384}),a}o(np,"writeEncryptedPrivateKey");function op(e,t,r){let n=[];if(e.expires===void 0)n.push("--expires <months> is required. Pass --interactive to enter it interactively.");else try{oe(e.expires)}catch(i){n.push(i instanceof Error?i.message:String(i))}if(e.kid===void 0)n.push("--kid <identifier> is required. Pass --interactive to enter it interactively.");else try{let i=ge(e.kid),s=ye(_().keysDir,`${i}${re}`);r(s)&&!e.force&&n.push(`Key "${i}" already exists. Use --force to overwrite without prompting.`)}catch(i){n.push(i instanceof Error?i.message:String(i))}if(e.email===void 0)n.push("--email <address> is required. Pass --interactive to enter it interactively.");else try{ne(e.email,"--email")}catch(i){n.push(i instanceof Error?i.message:String(i))}return t||n.push("A passphrase is required for encrypted key storage. Pass --interactive to enter it interactively."),n}o(op,"collectNonInteractiveErrors");async function ip(e,t,r=new Date){let{isOS:n,existsSync:i,mkdirSync:s,writeFileSync:a,generateSigningKeyPair:p,storeKeyInKeychain:c,promptExpiryMonths:l,promptKid:d,promptEmail:m,promptPassphrase:y,promptConfirmOverwrite:g}=t,u=e.interactive??!1,S=e.keychain!==!1&&n("macos")&&!e.output;if(!u){let A=op(e,S,i);if(A.length>0)throw new Error(A.join(`
-`))}let h;e.expires!==void 0?h=oe(e.expires):h=await l();let k=At(bn(r,h)),f;e.kid!==void 0?f=ge(e.kid):f=await d();let U=ye(_().keysDir,`${f}${re}`),x=i(U);if(x&&!e.force&&!await g(f)){process.stderr.write(`Aborted.
-`);return}let M;e.email!==void 0?M=ne(e.email,"--email"):M=await m();let ae=S?{kind:"keychain"}:{kind:"file",passphrase:await y()};process.stderr.write(`
+`)}i(pm,"handleList");function Yo(e,t,r){let n=Qe(D().keysDir,`${e}${se}`);return r.mkdirSync(Gr(n),{recursive:!0}),r.writeFileSync(n,t),n}i(Yo,"writePublicKey");async function cm(e,t,r,n,o,{force:s=!1}={}){let a=n??Qe(D().keysDir,`${e}${fr}`);if(o.mkdirSync(Gr(a),{recursive:!0}),!s&&o.existsSync(a))throw new Error(`Refusing to overwrite existing key at ${a}. Delete it first if you really want to regenerate: rm ${a}`);let p=await o.encryptStringAsJwe(t,r);return o.writeFileSync(a,p,{mode:384}),a}i(cm,"writeEncryptedPrivateKey");function lm(e,t,r){let n=[];if(e.expires===void 0)n.push("--expires <months> is required. Pass --interactive to enter it interactively.");else try{Ie(e.expires)}catch(o){n.push(o instanceof Error?o.message:String(o))}if(e.kid===void 0)n.push("--kid <identifier> is required. Pass --interactive to enter it interactively.");else try{let o=fe(e.kid),s=Qe(D().keysDir,`${o}${se}`);r(s)&&!e.force&&n.push(`Key "${o}" already exists. Use --force to overwrite without prompting.`)}catch(o){n.push(o instanceof Error?o.message:String(o))}if(e.email===void 0)n.push("--email <address> is required. Pass --interactive to enter it interactively.");else try{Ae(e.email,"--email")}catch(o){n.push(o instanceof Error?o.message:String(o))}return t||n.push("A passphrase is required for encrypted key storage. Pass --interactive to enter it interactively."),n}i(lm,"collectNonInteractiveErrors");async function dm(e,t,r=new Date){let{isOS:n,existsSync:o,mkdirSync:s,writeFileSync:a,generateSigningKeyPair:p,storeKeyInKeychain:c,promptExpiryMonths:l,promptKid:m,promptEmail:d,promptPassphrase:u,promptConfirmOverwrite:f}=t,g=e.interactive??!1,h=e.keychain!==!1&&n("macos")&&!e.output;if(!g){let B=lm(e,h,o);if(B.length>0)throw new Error(B.join(`
+`))}let w;e.expires!==void 0?w=Ie(e.expires):w=await l();let C=Kr(jo(r,w)),S;e.kid!==void 0?S=fe(e.kid):S=await m();let ae=Qe(D().keysDir,`${S}${se}`),re=o(ae);if(re&&!e.force&&!await f(S)){process.stderr.write(`Aborted.
+`);return}let M;e.email!==void 0?M=Ae(e.email,"--email"):M=await d();let H=h?{kind:"keychain"}:{kind:"file",passphrase:await u()};process.stderr.write(`
 Generating Ed25519 keypair...
 
-`);let{privateKeyPem:w,publicKeyPem:H}=await p(f);if(ae.kind==="keychain"){await c(f,w);let A=Fn(f,H,t);process.stderr.write(`Public key:  ${A}
-`),process.stderr.write(`Private key: macOS Keychain (service: cognite-dune, account: ${f})
-`)}else{let A=await np(f,w,ae.passphrase,e.output,t,{force:x}),ro=Fn(f,H,t);process.stderr.write(`Public key:  ${ro}
-`),process.stderr.write(`Private key: ${A} (JWE, AES-256-GCM, PBKDF2-SHA512 x${ft.toLocaleString()})
+`);let{privateKeyPem:x,publicKeyPem:J}=await p(S),Se=k.from(x);if(H.kind==="keychain"){await c(S,Se);let B=Yo(S,J,t);process.stderr.write(`Public key:  ${B}
+`),process.stderr.write(`Private key: macOS Keychain (service: cognite-dune, account: ${S})
+`)}else{let B=await cm(S,Se,H.passphrase,e.output,t,{force:re}),ys=Yo(S,J,t);process.stderr.write(`Public key:  ${ys}
+`),process.stderr.write(`Private key: ${B} (JWE, AES-256-GCM, PBKDF2-SHA512 x${_r.toLocaleString()})
 `),n("macos")||process.stderr.write(`   (macOS Keychain integration is the default on darwin; on this OS we use the file.)
-`)}let te=ye(_().keysDir,`${f}${St}`);s(It(te),{recursive:!0}),a(te,JSON.stringify({email:M}));let C=An(process.stderr);process.stderr.write(`
-Signing identity (kid): ${C.green(f)}
-`),process.stderr.write(`Expires: ${k} (${h} month${h===1?"":"s"} from today)
-`);let Y={kid:f,publicKeyPem:H,email:M,expires:k};u||(process.stderr.write(`
+`)}let I=Qe(D().keysDir,`${S}${yr}`);s(Gr(I),{recursive:!0}),a(I,JSON.stringify({email:M}));let Y=Ho(process.stderr);process.stderr.write(`
+Signing identity (kid): ${Y.green(S)}
+`),process.stderr.write(`Expires: ${C} (${w} month${w===1?"":"s"} from today)
+`);let Je={kid:S,publicKeyPem:J,email:M,expires:C};g||(process.stderr.write(`
 Key registration data:
 
-`),process.stderr.write(Dt(Y,C,r)));let q=nn(f,M,k,Dt(Y,fe,r));process.stderr.write(`
-${C.bold("Next:")}
+`),process.stderr.write(Hr(Je,Y,r)));let pe=Uo(S,M,C,Hr(Je,qe,r));process.stderr.write(`
+${Y.bold("Next:")}
 `),process.stderr.write(`  1. Register your signing key \u2014 submit this pre-filled Zendesk request:
-`);let J;if(e.copyLink?J="clipboard":u?J=await t.promptZendeskAction():J=null,J==="browser")try{await t.openUrl(q),process.stderr.write(`     Opening in browser...
-`)}catch{process.stderr.write(`     URL: ${q}
-`)}else if(J==="clipboard"){let A=!1;try{await t.copyToClipboard(q),A=!0}catch{}process.stderr.write(A&&!e.copyLink?`     Link copied to clipboard.
-`:`     URL: ${q}
-`)}else process.stderr.write(`     URL: ${q}
+`);let ce;if(e.copyLink?ce="clipboard":g?ce=await t.promptZendeskAction():ce=null,ce==="browser")try{await t.openUrl(pe),process.stderr.write(`     Opening in browser...
+`)}catch{process.stderr.write(`     URL: ${pe}
+`)}else if(ce==="clipboard"){let B=!1;try{await t.copyToClipboard(pe),B=!0}catch{}process.stderr.write(B&&!e.copyLink?`     Link copied to clipboard.
+`:`     URL: ${pe}
+`)}else process.stderr.write(`     URL: ${pe}
 `);process.stderr.write(`
   2. Once your key is approved, sign your Dune app:
-`),process.stderr.write(`     ${C.cyan(`cognite sign -s ${f}`)}
-`)}o(ip,"handleGenerate");import{performance as _n}from"perf_hooks";var Un=1e3,Le;function sp(){Le=_n.now()}o(sp,"markActionStart");function ap(){Le=void 0}o(ap,"resetActionStart");function pp(){if(Le!==void 0)return Math.max(0,Math.round(_n.now()-Le))}o(pp,"snapshotActionDurationMs");function Ln(){let e=pp();return ap(),{...e!==void 0&&{actionDurationMs:e}}}o(Ln,"takePerformanceFields");var cp=new Set(["baseUrl","url","project","deployment","source","path","name","displayName","description"]);function lp(e){return Object.fromEntries(Object.entries(e).map(([t,r])=>typeof r=="boolean"?[t,r]:cp.has(t)?[t,r]:[t,"[REDACTED]"]))}o(lp,"sanitize");function dp(e){let t=[],r=e;for(;r;)r.parent&&t.unshift(r.name()),r=r.parent;return t.join(" ")}o(dp,"getCommandPath");function Nn(e){try{let t=e(process.cwd());return{appExternalId:t.externalId,appVersionTag:t.versionTag}}catch{return{}}}o(Nn,"tryLoadAppConfig");function $t(e){return e.filter(t=>!t.startsWith("-")).join(" ")||"unknown"}o($t,"commandFromArgv");function Kn(e,t,r=v){e.hook("preAction",()=>{sp()}),e.hook("postAction",async(n,i)=>{try{let s={command:dp(i),options:lp(i.opts()),success:!0,...Nn(r),...Ln()};t.track("Flows.CLI.Command",{...s}),await t.flush(Un)}catch{}})}o(Kn,"instrument");async function jn(e,t,r=v){try{let n={command:$t(t),options:{},success:!1,...Nn(r),...Ln()};e.track("Flows.CLI.Command",{...n}),await e.flush(Un)}catch{}}o(jn,"trackFailure");var mp="ERR_USE_AFTER_CLOSE";function Hn(e){return e instanceof Error&&"code"in e&&e.code===mp}o(Hn,"isReadlineClosedError");function up(e){let t=Object.getPrototypeOf(e);return t===Object.prototype||t===null}o(up,"isPlainObject");function Rt(e){return e==null||Hn(e)?!0:e instanceof Error?!1:!!(typeof e=="object"&&e!==null&&up(e)&&Object.keys(e).length===0)}o(Rt,"isPromptCancel");var Mn=!1;function Vn(){Mn||(Mn=!0,process.on("uncaughtException",e=>{Hn(e)&&(console.error(`
-Cancelled.`),process.exit(130)),console.error(e),process.exit(1)}),process.on("unhandledRejection",e=>{Rt(e)&&(console.error(`
-Cancelled.`),process.exit(130)),console.error(e),process.exit(1)}))}o(Vn,"installCancelHandler");import{homedir as Sp,userInfo as wp}from"os";import Bn from"mixpanel";var gp="5c4d853e7c3b77b1eb4468d5329b278c",he="cognite-cli",fp=2e3,Gn={env:process.env,init:Bn.init.bind(Bn)},yp={track:o(()=>{},"track"),flush:o(async()=>{},"flush")};function Tt(e=process.env){return e.COGNITE_TELEMETRY_DISABLED==="1"||e.DO_NOT_TRACK==="1"}o(Tt,"isTelemetryDisabled");function hp(e){return e.COGNITE_TELEMETRY_DEBUG==="1"}o(hp,"isDebug");function Yn(e={}){let t=e.env??Gn.env,r=e.init??Gn.init,n=e.packageName,i=e.cliVersion,s=hp(t);if(Tt(t))return s&&process.stderr.write(`[telemetry] disabled \u2014 noop tracker
-`),yp;let a,p=new Set;function c(){if(a)return a;try{return a=r(gp,{geolocate:!1,keepAlive:!1}),a}catch{return}}return o(c,"getClient"),{track(l,d={}){let m=c();if(!m)return;let y={...d,applicationId:he,...n&&{packageName:n},...i&&{cliVersion:i},nodeVersion:process.version,platform:process.platform};s&&process.stderr.write(`[telemetry] track ${l} ${JSON.stringify(y)}
-`);let g=o(()=>{},"finish"),u=new Promise(S=>{g=S});p.add(u);try{m.track(l,y,g)}catch{g()}u.finally(()=>p.delete(u))},async flush(l=fp){if(p.size===0)return;let d,m=new Promise(y=>{d=setTimeout(y,l),d.unref?.()});try{await Promise.race([Promise.allSettled([...p]),m])}finally{d&&clearTimeout(d)}s&&process.stderr.write(`[telemetry] flush done (${p.size} still pending)
-`)}}}o(Yn,"createTelemetry");var vp=Sp(),Cp=(()=>{try{return wp().username}catch{return""}})();function ie(e,t=vp){if(!t||t==="/")return e;let r=e.replaceAll(t,"~"),n=t.replaceAll("\\","/");return n!==t&&(r=r.replaceAll(n,"~")),r=r.replace(/(?<![A-Za-z0-9_])[A-Za-z]:[/\\]Users[/\\][^\s/\\]+(?=[/\\]|$)/g,"~"),r=r.replace(/(?<![A-Za-z0-9_])\/(?:Users|home)\/[^\s/]+(?=[/\\]|$)/g,"~"),r}o(ie,"redactHomedir");function Ep(e,t=Cp){if(!t||t.length<3)return e;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),n=new RegExp("(^|[\\/\\s:])"+r+"(?=[\\/\\s:.@]|$)","g");return e.replace(n,"$1<user>")}o(Ep,"redactUsername");var kp=1e3,Pp="https://0a118cb02e3be57b1838bcfb5783a2bf@o4508040730968064.ingest.de.sentry.io/4510719268290640",bp={captureError:o(async()=>{},"captureError"),flush:o(async()=>{},"flush")};function xp(e){return e.packageName&&e.cliVersion?`${e.packageName}@${e.cliVersion}`:e.cliVersion??"unknown"}o(xp,"buildRelease");var Ap="192.0.2.0";function Dp(e){return e?.map(t=>({...t,...t.filename!==void 0&&{filename:ie(t.filename)},...t.abs_path!==void 0&&{abs_path:ie(t.abs_path)},...t.module!==void 0&&{module:ie(t.module)}}))}o(Dp,"scrubStackFrames");function Ft(e){return Ep(ie(e))}o(Ft,"redactPii");function Ip(e){let t={...e.user,email:void 0,username:void 0,ip_address:Ap,id:void 0},r=e.exception?.values?.map(s=>({...s,value:s.value!==void 0?Ft(s.value):s.value,...s.stacktrace!==void 0&&{stacktrace:{...s.stacktrace,frames:Dp(s.stacktrace.frames)}}})),n=e.contexts?.cli,i=n!==void 0?Object.fromEntries(Object.entries(n).map(([s,a])=>[s,typeof a=="string"?Ft(a):a])):void 0;return{...e,message:e.message!==void 0?Ft(e.message):e.message,user:t,server_name:void 0,...r!==void 0&&{exception:{...e.exception,values:r}},...i!==void 0&&{contexts:{...e.contexts,cli:i}}}}o(Ip,"scrubPii");function qn(e={}){let t=e.env??process.env;if(Tt(t))return bp;let r=xp(e),n="production",i=null,s=null;function a(){return{dsn:Pp,release:r,environment:n,defaultIntegrations:!1,integrations:[],sendDefaultPii:!1,enableLogs:!1,initialScope:{tags:{component:"cli",applicationId:he},contexts:{cli:{applicationId:he,node:process.version,platform:process.platform}}},beforeSend:Ip}}o(a,"buildInitOptions");async function p(){return i||(s||(s=(async()=>{try{let c=e.sdk??await import("@sentry/node");return c.init(a()),i=c,c}catch{return null}})()),s)}return o(p,"ensureSdk"),{async captureError(c,l){try{let d=await p();if(!d)return;d.captureException(c,$p(c,l))}catch{}},async flush(c=kp){try{if(!i)return;await i.flush(c)}catch{}}}}o(qn,"createErrorReporter");function $p(e,t){let r={level:"fatal"},n={applicationId:he,node:process.version,platform:process.platform};if(t?.command&&(r.tags={command:t.command},n.command=t.command),Nt(e)&&(e.hint&&(n.hint=e.hint),e.helpUrl&&(n.helpUrl=e.helpUrl),n.shouldReport=e.shouldReport),r.contexts={cli:n},Kt(e)&&(r.contexts.http={url:e.requestUrl!==void 0?ie(e.requestUrl):void 0,status_code:e.httpStatusCode},e.responseBody!==void 0)){let i=typeof e.responseBody=="string"?e.responseBody:JSON.stringify(e.responseBody);r.extra={responseBody:ie(i)}}return r}o($p,"buildCaptureContext");import{mkdirSync as Rp,readFileSync as Tp,writeFileSync as Fp}from"fs";import{homedir as Op}from"os";import{resolve as Ne}from"path";import{debuglog as _p}from"util";import{lt as Up,parse as Jn}from"semver";var Lp="https://registry.npmjs.org/@cognite/cli/latest",Np=1500,zn="upgrade-check.json",Wn=Ne(process.env.XDG_CACHE_HOME||Ne(Op(),".cache"),"@cognite","cli"),Ot=_p("cognite-flows");function Kp(e,t){return!e||!t||!Jn(e)||!Jn(t)?!1:Up(e,t)}o(Kp,"isOutdated");async function jp({timeout:e=Np,registryUrl:t=Lp,fetchImpl:r=globalThis.fetch}={}){if(typeof r!="function")return null;try{let n=await r(t,{signal:AbortSignal.timeout(e)});if(!n?.ok)return null;let i=await n.json();return typeof i?.version=="string"?i.version:null}catch(n){return Ot("fetchLatestVersion failed (%s): %O",t,n),null}}o(jp,"fetchLatestVersion");function Mp(e=Wn,t=864e5){try{let r=Tp(Ne(e,zn),"utf-8"),n=JSON.parse(r);return typeof n.latest!="string"||typeof n.fetchedAt!="number"||Date.now()-n.fetchedAt>t?null:{latest:n.latest,fetchedAt:n.fetchedAt}}catch(r){return Ot("readUpgradeCheckCache failed (%s): %O",e,r),null}}o(Mp,"readUpgradeCheckCache");function Hp(e,t){try{Rp(e,{recursive:!0});let r={latest:t,fetchedAt:Date.now()};Fp(Ne(e,zn),JSON.stringify(r))}catch(r){Ot("writeUpgradeCheckCache failed (%s): %O",e,r)}}o(Hp,"writeUpgradeCheckCache");async function Vp({cacheDir:e=Wn,...t}={}){let r=await jp(t);r&&Hp(e,r)}o(Vp,"startBackgroundUpgradeCheck");function Xn(e,{onOutdated:t,cacheDir:r,...n}={}){let i=Mp(r);if(i){Kp(e,i.latest)&&t?.(e,i.latest);return}Vp({cacheDir:r,...n})}o(Xn,"preActionUpgradeCheck");import{default as _f,chalkStderr as Zn}from"chalk";function Qn(e,t){let r=[`\u26A0  Update available: ${e} -> ${t}`,"   Run npx @cognite/cli@latest"],n=Math.max(...r.map(p=>[...p].length))+2,i="\u2500".repeat(n),s=o(p=>`\u2502 ${p}${" ".repeat(n-1-[...p].length)}\u2502`,"pad"),a=[`\u250C${i}\u2510`,...r.map(s),`\u2514${i}\u2518`].join(`
-`);return Zn.bold.yellow(a)}o(Qn,"formatUpgradeWarning");function Yp(e){return e instanceof Error&&"code"in e&&typeof e.code=="string"&&e.code==="DEP0040"}o(Yp,"isDep0040Warning");var Ut=process,qp=Ut.emit.bind(Ut);Ut.emit=function(e,...t){return e==="warning"&&Yp(t[0])?!1:qp(e,...t)};Vn();var se=new Gp;se.name("cognite").description("Build and deploy React apps to Cognite Data Fusion").version("1.5.0").showHelpAfterError().configureOutput({writeOut:o(e=>Bp(1,e),"writeOut")});se.hook("preAction",()=>{Xn("1.5.0",{onOutdated:o((e,t)=>{console.warn(`
-${Qn(e,t)}
-`)},"onOutdated")})});sn(se);On(se);var to=Yn({packageName:"@cognite/cli",cliVersion:"1.5.0"}),eo=qn({packageName:"@cognite/cli",cliVersion:"1.5.0"});Kn(se,to);var _t=process.argv.slice(2);se.parseAsync(_t,{from:"user"}).catch(async e=>{await jn(to,_t),Rt(e)&&(console.error(`
-Cancelled.`),process.exit(130)),(!(e instanceof D)||e.shouldReport)&&(await eo.captureError(e,{command:$t(_t)}),await eo.flush());let t=e instanceof Error?e.message:String(e);console.error(`\u274C ${t}`),e instanceof D&&(e.hint||e.helpUrl)&&(console.error(""),e.hint&&console.error(`\u{1F4A1} ${e.hint}`),e.helpUrl&&console.error(`\u{1F4DA} ${e.helpUrl}`)),process.exit(1)});
+`),process.stderr.write(`     ${Y.cyan(`cognite sign -s ${S}`)}
+`)}i(dm,"handleGenerate");import{performance as Wo}from"perf_hooks";var Xo=1e3,Ft;function mm(){Ft=Wo.now()}i(mm,"markActionStart");function um(){Ft=void 0}i(um,"resetActionStart");function gm(){if(Ft!==void 0)return Math.max(0,Math.round(Wo.now()-Ft))}i(gm,"snapshotActionDurationMs");function Zo(){let e=gm();return um(),{...e!==void 0&&{actionDurationMs:e}}}i(Zo,"takePerformanceFields");var fm=new Set(["baseUrl","url","project","deployment","source","path","name","displayName","description"]);function ym(e){return Object.fromEntries(Object.entries(e).map(([t,r])=>typeof r=="boolean"?[t,r]:fm.has(t)?[t,r]:[t,"[REDACTED]"]))}i(ym,"sanitize");function hm(e){let t=[],r=e;for(;r;)r.parent&&t.unshift(r.name()),r=r.parent;return t.join(" ")}i(hm,"getCommandPath");function es(e){try{let t=e(process.cwd()),r=t.deployments[0];return{appName:t.name,appExternalId:t.externalId,appVersionTag:t.versionTag,...r&&{cogniteOrg:r.org,cogniteProject:r.project}}}catch{return{}}}i(es,"tryLoadAppConfig");function Br(e){return e.filter(t=>!t.startsWith("-")).join(" ")||"unknown"}i(Br,"commandFromArgv");function ts(e,t,r=v){e.hook("preAction",()=>{mm()}),e.hook("postAction",async(n,o)=>{try{let s={command:hm(o),options:ym(o.opts()),success:!0,...es(r),...Zo()};t.track("Flows.CLI.Command",{...s}),await t.flush(Xo)}catch{}})}i(ts,"instrument");async function rs(e,t,r=v){try{let n={command:Br(t),options:{},success:!1,...es(r),...Zo()};e.track("Flows.CLI.Command",{...n}),await e.flush(Xo)}catch{}}i(rs,"trackFailure");var Sm="ERR_USE_AFTER_CLOSE";function is(e){return e instanceof Error&&"code"in e&&e.code===Sm}i(is,"isReadlineClosedError");function wm(e){let t=Object.getPrototypeOf(e);return t===Object.prototype||t===null}i(wm,"isPlainObject");function qr(e){return e==null||is(e)?!0:e instanceof Error?!1:!!(typeof e=="object"&&e!==null&&wm(e)&&Object.keys(e).length===0)}i(qr,"isPromptCancel");var ns=!1;function os(){ns||(ns=!0,process.on("uncaughtException",e=>{is(e)&&(console.error(`
+Cancelled.`),process.exit(130)),console.error(e),process.exit(1)}),process.on("unhandledRejection",e=>{qr(e)&&(console.error(`
+Cancelled.`),process.exit(130)),console.error(e),process.exit(1)}))}i(os,"installCancelHandler");import{homedir as vm,userInfo as km}from"os";var Cm=vm(),xm=(()=>{try{return km().username}catch{return""}})();function $e(e,t=Cm){if(!t||t==="/")return e;let r=e.replaceAll(t,"~"),n=t.replaceAll("\\","/");return n!==t&&(r=r.replaceAll(n,"~")),r=r.replace(/(?<![A-Za-z0-9_])[A-Za-z]:[/\\]Users[/\\][^\s/\\]+(?=[/\\]|$)/g,"~"),r=r.replace(/(?<![A-Za-z0-9_])\/(?:Users|home)\/[^\s/]+(?=[/\\]|$)/g,"~"),r}i($e,"redactHomedir");function Em(e,t=xm){if(!t||t.length<3)return e;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),n=new RegExp("(^|[\\/\\s:])"+r+"(?=[\\/\\s:.@]|$)","g");return e.replace(n,"$1<user>")}i(Em,"redactUsername");var bm=/(['"]?(?:access_token|accessToken|client_secret|clientSecret|refresh_token|refreshToken|password|token|passphrase)['"]?\s*:\s*)(?:"(?:\\.|[^\\"])*"|'(?:\\.|[^\\'])*')/gi;function ss(e){return e.replace(bm,(t,r)=>{let n=t[r.length];return`${r}${n}[REDACTED]${n}`})}i(ss,"redactCredentials");var Pm=1e3,Am="https://0a118cb02e3be57b1838bcfb5783a2bf@o4508040730968064.ingest.de.sentry.io/4510719268290640",Im={captureError:i(async()=>{},"captureError"),flush:i(async()=>{},"flush")};function Dm(e){return e.packageName&&e.cliVersion?`${e.packageName}@${e.cliVersion}`:e.cliVersion??"unknown"}i(Dm,"buildRelease");var $m="192.0.2.0";function Rm(e){return e?.map(t=>({...t,...t.filename!==void 0&&{filename:$e(t.filename)},...t.abs_path!==void 0&&{abs_path:$e(t.abs_path)},...t.module!==void 0&&{module:$e(t.module)}}))}i(Rm,"scrubStackFrames");function Qr(e){return ss(Em($e(e)))}i(Qr,"redactPii");function Tm(e){let t={...e.user,email:void 0,username:void 0,ip_address:$m,id:void 0},r=e.exception?.values?.map(s=>({...s,value:s.value!==void 0?Qr(s.value):s.value,...s.stacktrace!==void 0&&{stacktrace:{...s.stacktrace,frames:Rm(s.stacktrace.frames)}}})),n=e.contexts?.cli,o=n!==void 0?Object.fromEntries(Object.entries(n).map(([s,a])=>[s,typeof a=="string"?Qr(a):a])):void 0;return{...e,message:e.message!==void 0?Qr(e.message):e.message,user:t,server_name:void 0,...r!==void 0&&{exception:{...e.exception,values:r}},...o!==void 0&&{contexts:{...e.contexts,cli:o}}}}i(Tm,"scrubPii");function as(e={}){let t=e.env??process.env;if(Zt(t))return Im;let r=Dm(e),n="production",o=null,s=null;function a(){return{dsn:Am,release:r,environment:n,defaultIntegrations:!1,integrations:[],sendDefaultPii:!1,enableLogs:!1,initialScope:{tags:{component:"cli",applicationId:_e},contexts:{cli:{applicationId:_e,node:process.version,platform:process.platform}}},beforeSend:Tm}}i(a,"buildInitOptions");async function p(){return o||(s||(s=(async()=>{try{let c=e.sdk??await import("@sentry/node");return c.init(a()),o=c,c}catch{return null}})()),s)}return i(p,"ensureSdk"),{async captureError(c,l){try{let m=await p();if(!m)return;m.captureException(c,Fm(c,l))}catch{}},async flush(c=Pm){try{if(!o)return;await o.flush(c)}catch{}}}}i(as,"createErrorReporter");function Fm(e,t){let r={level:"fatal"},n={applicationId:_e,node:process.version,platform:process.platform};if(t?.command&&(r.tags={command:t.command},n.command=t.command),nn(e)&&(e.hint&&(n.hint=e.hint),e.helpUrl&&(n.helpUrl=e.helpUrl),n.shouldReport=e.shouldReport),r.contexts={cli:n},on(e)&&(r.contexts.http={url:e.requestUrl!==void 0?$e(e.requestUrl):void 0,status_code:e.httpStatusCode},e.responseBody!==void 0)){let o=typeof e.responseBody=="string"?e.responseBody:JSON.stringify(e.responseBody);r.extra={responseBody:ss($e(o))}}return r}i(Fm,"buildCaptureContext");import{mkdirSync as Om,readFileSync as Lm,writeFileSync as Nm}from"fs";import{homedir as _m}from"os";import{resolve as Ot}from"path";import{debuglog as Um}from"util";import{lt as Mm,parse as ps}from"semver";var Vm="https://registry.npmjs.org/@cognite/cli/latest",jm=1500,cs="upgrade-check.json",ls=Ot(process.env.XDG_CACHE_HOME||Ot(_m(),".cache"),"@cognite","cli"),Jr=Um("cognite-flows");function Km(e,t){return!e||!t||!ps(e)||!ps(t)?!1:Mm(e,t)}i(Km,"isOutdated");async function Hm({timeout:e=jm,registryUrl:t=Vm,fetchImpl:r=globalThis.fetch}={}){if(typeof r!="function")return null;try{let n=await r(t,{signal:AbortSignal.timeout(e)});if(!n?.ok)return null;let o=await n.json();return typeof o?.version=="string"?o.version:null}catch(n){return Jr("fetchLatestVersion failed (%s): %O",t,n),null}}i(Hm,"fetchLatestVersion");function Gm(e=ls,t=864e5){try{let r=Lm(Ot(e,cs),"utf-8"),n=JSON.parse(r);return typeof n.latest!="string"||typeof n.fetchedAt!="number"||Date.now()-n.fetchedAt>t?null:{latest:n.latest,fetchedAt:n.fetchedAt}}catch(r){return Jr("readUpgradeCheckCache failed (%s): %O",e,r),null}}i(Gm,"readUpgradeCheckCache");function Bm(e,t){try{Om(e,{recursive:!0});let r={latest:t,fetchedAt:Date.now()};Nm(Ot(e,cs),JSON.stringify(r))}catch(r){Jr("writeUpgradeCheckCache failed (%s): %O",e,r)}}i(Bm,"writeUpgradeCheckCache");async function qm({cacheDir:e=ls,...t}={}){let r=await Hm(t);r&&Bm(e,r)}i(qm,"startBackgroundUpgradeCheck");function ds(e,{onOutdated:t,cacheDir:r,...n}={}){let o=Gm(r);if(o){Km(e,o.latest)&&t?.(e,o.latest);return}qm({cacheDir:r,...n})}i(ds,"preActionUpgradeCheck");import{default as hC,chalkStderr as ms}from"chalk";function us(e,t){let r=[`\u26A0  Update available: ${e} -> ${t}`,"   Run npx @cognite/cli@latest"],n=Math.max(...r.map(p=>[...p].length))+2,o="\u2500".repeat(n),s=i(p=>`\u2502 ${p}${" ".repeat(n-1-[...p].length)}\u2502`,"pad"),a=[`\u250C${o}\u2510`,...r.map(s),`\u2514${o}\u2518`].join(`
+`);return ms.bold.yellow(a)}i(us,"formatUpgradeWarning");function Ym(e){return e instanceof Error&&"code"in e&&typeof e.code=="string"&&e.code==="DEP0040"}i(Ym,"isDep0040Warning");var zr=process,zm=zr.emit.bind(zr);zr.emit=function(e,...t){return e==="warning"&&Ym(t[0])?!1:zm(e,...t)};os();var Re=new Jm;Re.name("cognite").description("Build and deploy React apps to Cognite Data Fusion").version("1.6.0-alpha.sdk-gen").enablePositionalOptions().showHelpAfterError().configureOutput({writeOut:i(e=>Qm(1,e),"writeOut")});Re.hook("preAction",()=>{ds("1.6.0-alpha.sdk-gen",{onOutdated:i((e,t)=>{console.warn(`
+${us(e,t)}
+`)},"onOutdated")})});Vo(Re);zo(Re);var fs=ct({packageName:"@cognite/cli",cliVersion:"1.6.0-alpha.sdk-gen"}),gs=as({packageName:"@cognite/cli",cliVersion:"1.6.0-alpha.sdk-gen"});ts(Re,fs);var Yr=process.argv.slice(2);Re.parseAsync(Yr,{from:"user"}).catch(async e=>{await rs(fs,Yr),qr(e)&&(console.error(`
+Cancelled.`),process.exit(130)),(!(e instanceof y)||e.shouldReport)&&(await gs.captureError(e,{command:Br(Yr)}),await gs.flush());let t=e instanceof Error?e.message:String(e);console.error(`\u274C ${t}`),e instanceof y&&(e.hint||e.helpUrl)&&(console.error(""),e.hint&&console.error(`\u{1F4A1} ${e.hint}`),e.helpUrl&&console.error(`\u{1F4DA} ${e.helpUrl}`)),process.exit(1)});