@cognite/cli 1.6.0 → 1.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/cli/cli.js CHANGED
@@ -1,28 +1,26 @@
1
1
  #!/usr/bin/env node
2
- var wo=Object.defineProperty;var o=(e,t)=>wo(e,"name",{value:t,configurable:!0});import{writeSync as Cc}from"fs";import{Command as Ec}from"commander";var Ye=class Ye extends Error{constructor(t,n={}){super(t),this.name="HintedError",n.cause!==void 0&&(this.cause=n.cause);let r=this.deriveDefaults(n);this.hint=n.hint??r.hint,this.helpUrl=n.helpUrl??r.helpUrl,this.shouldReport=n.shouldReport??!0}deriveDefaults(t){return{hint:ko(t.cause)}}};o(Ye,"HintedError");var u=Ye;function Yt(e){return e instanceof u}o(Yt,"isHintedError");var qt="https://docs.cognite.com/cdf/access/",vo="https://status.cognite.com";function Co(e){switch(e){case 401:return{hint:"Your credentials are invalid or expired. Check your client ID and secret.",helpUrl:qt};case 403:return{hint:"You don't have the required CDF capabilities. Please contact your CDF admin.",helpUrl:qt};case 413:return{hint:"The deployment exceeds the App Hosting size limit. Reduce the build output \u2014 remove unused assets, code-split bundles, or strip source maps."};case 429:return{hint:"You are being rate limited. Wait a few moments and retry. If this persists, contact CDF support."};case 500:case 502:case 503:case 504:return{hint:"CDF service error. The issue is on the server side. Check the status page and retry shortly.",helpUrl:vo};default:return{}}}o(Co,"defaultHintForStatus");var Je=class Je extends u{constructor(t,n){super(t,n),this.name="HintedHttpError",this.httpStatusCode=n.httpStatusCode,this.requestUrl=n.requestUrl,this.responseBody=n.responseBody}deriveDefaults(t){let{httpStatusCode:n}=t,r=Co(n),i=super.deriveDefaults(t);return{hint:r.hint??i.hint,helpUrl:r.helpUrl}}};o(Je,"HintedHttpError");var Q=Je;function Jt(e){return e instanceof Q}o(Jt,"isHintedHttpError");function Eo(e,t){if(e)switch(e){case"ENOTFOUND":return t.hostname?`DNS lookup failed for ${t.hostname}. Check your network, VPN, or proxy settings.`:"DNS lookup failed. Check your network, VPN, or proxy settings.";case"ECONNREFUSED":return t.hostname&&t.port?`Connection refused by ${t.hostname}:${t.port}. The service may be down or the port may be wrong.`:"Connection refused. The service may be down or the port may be wrong.";case"ECONNRESET":return"Connection was reset. The server closed the connection unexpectedly; check for proxy/firewall interference and retry.";case"ETIMEDOUT":return"Connection timed out. Check your network, VPN, or proxy settings, and retry.";case"EAI_AGAIN":return"Temporary DNS failure. Retry shortly; if it persists, check your DNS configuration.";case"CERT_HAS_EXPIRED":case"UNABLE_TO_VERIFY_LEAF_SIGNATURE":case"SELF_SIGNED_CERT_IN_CHAIN":return"TLS certificate validation failed. Check system clock and CA trust store; if you use a corporate proxy, ensure its root cert is trusted.";case"EACCES":return t.path?`Permission denied: ${t.path}. Check file ownership and permissions.`:"Permission denied. Check file ownership and permissions.";case"ENOENT":return t.path?`File or directory not found: ${t.path}.`:"File or directory not found.";case"EISDIR":return t.path?`Expected a file but found a directory: ${t.path}.`:"Expected a file but found a directory.";case"ENOSPC":return"No space left on device. Free up disk space and retry.";case"EADDRINUSE":return t.port?`Port ${t.port} is already in use. Stop the process using it or pick a different port.`:"Address is already in use. Stop the conflicting process or change the port.";case"EMFILE":case"ENFILE":return"Too many open files. Close other programs or raise the file descriptor limit.";default:return}}o(Eo,"hintForErrno");function ko(e){let t=e,n=new Set;for(;t!=null&&!n.has(t)&&(n.add(t),typeof t=="object");){let r=t,i=Eo(r.code,r);if(i!==void 0)return i;t=r.cause}}o(ko,"hintForCause");import{existsSync as pi,readFileSync as ci}from"fs";import{join as li,resolve as Ie}from"path";import{verifyBundle as di}from"@cognite/app-sdk/codesigning";import{decodeProtectedHeader as mi}from"jose";import Xe from"enquirer";import{email as bo,pipe as Po,safeParse as xo,string as Ao}from"valibot";var Do=Po(Ao(),bo());function ie(e,t="email"){let n=e.trim();if(!n)throw new Error(`${t} is required`);if(!xo(Do,n).success)throw new Error(`${t} must look like an email (user@example.com); got "${e}"`);return n}o(ie,"parseEmail");function se(e,t="--expires"){let n=Number(e);if(!Number.isInteger(n)||n<1||n>12)throw new Error(`${t} must be an integer between 1 and 12 (months); got "${e}"`);return n}o(se,"parseExpiryMonths");import{execFileSync as ue}from"child_process";function Ce(e={}){let{execFileSync:t=ue}=e;try{return t("git",["--version"],{stdio:"ignore"}),!0}catch{return!1}}o(Ce,"isGitInstalled");function Ee(e,t={}){let{execFileSync:n=ue}=t;try{return n("git",["-C",e,"status"],{stdio:"ignore"}),!0}catch{return!1}}o(Ee,"isInsideGitRepo");function zt(e,t={}){let{execFileSync:n=ue}=t;n("git",["-C",e,"init"],{stdio:"pipe"}),n("git",["-C",e,"add","."],{stdio:"pipe"}),n("git",["-C",e,"commit","-m","Initial commit","--no-gpg-sign","--no-verify"],{stdio:"pipe"})}o(zt,"gitInitAndCommit");function Wt(e={}){let{execFileSync:t=ue}=e;try{return String(t("git",["config","--get","user.name"],{encoding:"utf-8",stdio:["ignore","pipe","ignore"]})).trim()||void 0}catch{return}}o(Wt,"gitUserName");function Xt(e={}){let{execFileSync:t=ue}=e;try{return String(t("git",["config","--get","user.email"],{encoding:"utf-8",stdio:["ignore","pipe","ignore"]})).trim()||void 0}catch{return}}o(Xt,"gitUserEmail");var ke=3,Zt="Signing identity (kid) \u2014 e.g. jsmith-dev-001 (lowercase letters, digits, hyphens)",Qt=`Key expiry in months (${1}-${12})`,en="Email address for the registry entry",tn=`Passphrase for the encrypted private key (min ${15} chars)`,nn="Confirm passphrase",rn=o(()=>`Passphrase must be at least ${15} characters`,"passphraseTooShortMsg"),on=o(e=>`Passphrases do not match (attempt ${e}/${ke}).
3
- `,"passphraseMismatchMsg"),sn=`Passphrase confirmation failed after ${ke} attempts`,an=o(e=>`A signing key with kid "${e}" already exists. Overwrite it?`,"confirmOverwriteMsg"),pn="How would you like to submit your key registration?",cn="Open in browser",ln="Copy link to clipboard";async function be(e){return Xe.prompt(e)}o(be,"defaultPrompt");function Ze(e){return t=>{try{return e(t),!0}catch(n){return n instanceof Error?n.message:"Invalid"}}}o(Ze,"parserAsValidator");var $o=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;function te(e){let t=e.trim();if(!t)throw new Error("--kid must not be empty");if(t.length>64)throw new Error("--kid must be 64 characters or fewer");if(!$o.test(t))throw new Error("--kid must contain only lowercase letters, digits, and hyphens, and must not start or end with a hyphen (e.g. jsmith-dev-001)");return t}o(te,"parseKid");async function dn(e={}){let{prompt:t=be}=e,{kid:n}=await t({type:"input",name:"kid",message:Zt,validate:Ze(te)});return te(n)}o(dn,"promptKid");async function mn(e={}){let{prompt:t=o(r=>Xe.prompt(r),"prompt")}=e,{action:n}=await t({type:"select",name:"action",message:pn,choices:[{name:"browser",message:cn},{name:"clipboard",message:ln}]});if(n!=="browser"&&n!=="clipboard")throw new Error(`Unexpected Zendesk action: ${n}`);return n}o(mn,"promptZendeskAction");async function un(e={}){let{prompt:t=be}=e,{months:n}=await t({type:"input",name:"months",message:Qt,initial:String(6),validate:Ze(r=>se(r,"expiry"))});return se(n,"expiry")}o(un,"promptExpiryMonths");async function gn(e={}){let{prompt:t=be,gitUserEmail:n=Xt}=e,{email:r}=await t({type:"input",name:"email",message:en,initial:n(),validate:Ze(i=>ie(i,"email"))});return ie(r,"email")}o(gn,"promptEmail");async function fn(e={}){let{prompt:t=be,stderr:n=process.stderr}=e;for(let r=1;r<=ke;r+=1){let{passphrase:i}=await t({type:"password",name:"passphrase",message:tn,validate:o(a=>a.length>=15?!0:rn(),"validate")}),{confirm:s}=await t({type:"password",name:"confirm",message:nn});if(i===s)return i;n.write(on(r))}throw new Error(sn)}o(fn,"promptPassphrase");async function yn(e,t={}){let{prompt:n=o(i=>Xe.prompt(i),"prompt")}=t,{confirmed:r}=await n({type:"confirm",name:"confirmed",message:an(e),initial:!1});return r}o(yn,"promptConfirmOverwrite");import{existsSync as Ko,readdirSync as Ho,readFileSync as jo}from"fs";import{join as et}from"path";import{execFile as To}from"child_process";import{promisify as Oo}from"util";import{execFileSync as hn}from"child_process";import{platform as Fo}from"os";import Ro from"path";function T(e,t={}){let{platform:n=Fo}=t;switch(n()){case"darwin":return e==="macos";case"win32":return e==="windows";default:return e==="other"}}o(T,"isOS");function Sn(e,t={}){let{exec:n=hn,log:r=console.log}=t,[i,s]=T("macos",t)?["open",[e]]:T("windows",t)?["rundll32",["url.dll,FileProtocolHandler",e]]:["xdg-open",[e]];try{n(i,s)}catch{r(`Could not open browser \u2014 open manually:
4
- ${e}`)}}o(Sn,"openInBrowser");function wn(e,t={}){let{exec:n=hn,log:r=console.log}=t,[i,s]=T("macos",t)?["open",["-R",e]]:T("windows",t)?["explorer",[`/select,${e}`]]:["xdg-open",[Ro.dirname(e)]];try{n(i,s)}catch{r(`Could not open file manager \u2014 files are at:
5
- ${e}`)}}o(wn,"revealInFileManager");var vn="cognite-flows",Uo=Oo(To),Cn=o((e,t)=>Uo(e,t),"defaultExecFile"),_o=-25300,Lo=_o&255;function No(e){if(!(e instanceof Error)||!("code"in e)||e.code!==Lo)return!1;let t="stderr"in e?String(e.stderr):"";return/could not be found/i.test(t)||t===""}o(No,"isKeychainNotFoundError");async function En(e,t,n={}){if(!T("macos",n))throw new Error("Keychain storage is only supported on macOS");let{execFile:r=Cn}=n;await r("security",["add-generic-password","-a",e,"-s",vn,"-w",Buffer.from(t,"utf-8").toString("base64"),"-U"])}o(En,"storeKeyInKeychain");async function Pe(e,t={}){if(!T("macos",t))return null;let{execFile:n=Cn}=t;try{let{stdout:r}=await n("security",["find-generic-password","-a",e,"-s",vn,"-w"]);return Buffer.from(r.trim(),"base64").toString("utf-8")}catch(r){if(No(r))return null;throw r}}o(Pe,"readKeyFromKeychain");import{homedir as Mo}from"os";import{join as kn}from"path";function x(e={}){let{env:t=process.env,homedir:n=Mo}=e,r=t.COGNITE_CLI_HOME?.trim()||kn(n(),".cognite-cli");return{home:r,keysDir:kn(r,"keys")}}o(x,"getConfig");var J=".pub.pem",tt=".key.jwe",nt=".meta.json";function xe(e){switch(e.kind){case"keychain":return"Keychain";case"encrypted-file":return e.path;case"public-only":return"public-only (private key missing)"}}o(xe,"formatLocalKeySource");function Vo(e){return{existsSync:e.existsSync??Ko,readdirSync:e.readdirSync??Ho,readFileSync:e.readFileSync??((t,n)=>jo(t,n)),isOS:e.isOS??(t=>T(t)),readKeyFromKeychain:e.readKeyFromKeychain??(t=>Pe(t))}}o(Vo,"resolveDeps");function Bo(e){try{let t=JSON.parse(e);if(typeof t=="object"&&t!==null&&!Array.isArray(t)&&"email"in t&&typeof t.email=="string")return t.email}catch{}}o(Bo,"readEmailFromMeta");function Go(e,t){return t.existsSync(e)?t.readdirSync(e).filter(n=>n.endsWith(J)):[]}o(Go,"publicKeyEntries");function qo(e){return e.slice(0,-J.length)}o(qo,"kidFromPublicKeyFilename");async function Yo(e,t,n){if(n.isOS("macos")&&await n.readKeyFromKeychain(e).catch(()=>null)!==null)return{kind:"keychain"};let r=et(t,`${e}${tt}`);return n.existsSync(r)?{kind:"encrypted-file",path:r}:{kind:"public-only"}}o(Yo,"resolveSource");async function Ae(e=x().keysDir,t={}){let n=Vo(t),r=new Set,i=Go(e,n).flatMap(s=>{let a=qo(s);return!a||r.has(a)?[]:(r.add(a),[{kid:a,entry:s}])});return Promise.all(i.map(async({kid:s,entry:a})=>{let p=await Yo(s,e,n),c=et(e,`${s}${nt}`),l;try{l=Bo(n.readFileSync(c,"utf8"))}catch{}return{kid:s,source:p,publicKeyPath:et(e,a),email:l}}))}o(Ae,"discoverLocalKeys");import{createReadStream as Jo}from"fs";function De(e){let t=Jo(e);return new ReadableStream({start(n){t.on("data",r=>{let i=typeof r=="string"?Buffer.from(r):r;n.enqueue(new Uint8Array(i))}),t.on("end",()=>n.close()),t.on("error",r=>n.error(r))},cancel(){t.destroy()}})}o(De,"createWebStreamFromFile");import zo from"path";var bn=".cognite-bundles";function Pn(e,t){return`${e}-${t}.zip`}o(Pn,"bundleFileName");function B(e,t,n){return zo.join(e,bn,Pn(t,n))}o(B,"bundlePath");import{existsSync as ii,readFileSync as si}from"fs";import{resolve as ai}from"path";import{array as xn,boolean as Wo,check as ae,forward as pe,literal as Xo,maxLength as Zo,minLength as Qo,nonEmpty as z,object as An,optional as G,picklist as ei,pipe as K,safeParse as ti,string as L,url as Dn}from"valibot";var rt=K(L(),z("must not be empty")),ot=K(L(),z("must not be empty"),Zo(256,"must be 256 characters or fewer")),it=K(L(),z("must not be empty"),Dn("must be a valid URL")),ni=K(L(),z("must not be empty"),Dn("must be a valid URL")),st=K(L(),z("must not be empty")),at=K(L(),z("must not be empty")),ri=K(An({org:st,project:at,baseUrl:it,deployClientId:G(L(),""),deploySecretName:G(L(),""),published:G(Wo(),!1),idpType:G(ei(["cdf","entra_id","oauth"]),"cdf"),tenantId:G(L()),scopes:G(xn(K(L(),z("must not be empty")))),tokenUrl:G(ni)}),pe(ae(e=>e.idpType!=="entra_id"||!!e.tenantId,'must be set when idpType is "entra_id"'),["tenantId"]),pe(ae(e=>e.idpType!=="oauth"||!!e.tokenUrl,'must be set when idpType is "oauth"'),["tokenUrl"]),pe(ae(e=>!e.tokenUrl||e.idpType==="oauth",'must only be set when idpType is "oauth"'),["tokenUrl"]),pe(ae(e=>e.idpType!=="oauth"||!!e.deployClientId,'must be set when idpType is "oauth"'),["deployClientId"]),pe(ae(e=>e.idpType!=="oauth"||!!e.deploySecretName,'must be set when idpType is "oauth"'),["deploySecretName"]),pe(ae(e=>!e.deployClientId||!!e.deploySecretName,"must be set when deployClientId is set"),["deploySecretName"])),oi=An({name:rt,externalId:ot,versionTag:K(L(),z("must not be empty")),description:G(L(),""),deployments:K(xn(ri),Qo(1,"must contain at least one deployment")),infra:G(Xo("appsApi"))});function pt(e){let t=ti(oi,e);if(t.success)return t.output;let n=t.issues[0],r=n.path?.map(s=>s.key).join(".")??"",i=r?`"${r}" `:"";throw new Error(`app.json: ${i}${n.message}`)}o(pt,"validateAppConfig");function v(e,t={}){let{validator:n=pt,existsSync:r=ii,readFileSync:i=si}=t,s=ai(e,"app.json");if(!r(s))throw new Error(`No app.json found at ${s}. Make sure you're running this command from your app's root directory.`);let a=i(s,"utf-8"),p;try{p=JSON.parse(a)}catch{throw new Error("Failed to parse app.json \u2014 check that it contains valid JSON.")}return n(p)}o(v,"loadAppConfig");var In=[".dev.sig",".cert.sig",".sig"];function ui(e){return{existsSync:e.existsSync??pi,readFileSync:e.readFileSync??((t,n)=>ci(t,n)),createBundleStream:e.createBundleStream??De,verifyBundle:e.verifyBundle??di,loadAppConfig:e.loadAppConfig??v,defaultKeyDir:e.defaultKeyDir??(()=>x().keysDir)}}o(ui,"resolveDeps");function gi(e,t){return In.map(n=>`${e}${n}`).find(n=>t(n))}o(gi,"findSiblingSignature");function fi(e){let t=e.split(".");return t.length===3&&t.every(n=>n.length>0)}o(fi,"isCompactJws");function yi(e){try{let t=mi(e);return typeof t.kid=="string"?t.kid:void 0}catch{return}}o(yi,"readKidFromToken");function hi(e,t,n){try{te(e)}catch(i){throw new u(i instanceof Error?i.message:String(i),{shouldReport:!1})}if(!n.existsSync(t))throw new u(`Key directory not found: ${t}`,{shouldReport:!1});let r=li(t,`${e}${J}`);if(!n.existsSync(r))throw new u(`No public key found for kid "${e}" in ${t}`,{shouldReport:!1});try{return n.readFileSync(r,"utf-8")}catch(i){throw new u(`Failed to read public key file: ${r}`,{cause:i,shouldReport:!1})}}o(hi,"resolvePublicKeyForKid");function Si(e,t){let{payload:n,kid:r}=e;if(console.log(`Verified ${n.appId}@${n.version}`),console.log(` kid: ${r}`),console.log(` hash: ${n.bundleSha256}`),n.scopes&&n.scopes.length>0){let i=n.scopes.map(s=>`${s.org}/${s.project}`).join(", ");console.log(` scopes: ${i}`)}t&&console.log(JSON.stringify(n,null,2))}o(Si,"printResult");async function $n(e,t,n={},r=process.cwd()){let i=ui(n),s;if(e)s=Ie(r,e);else{let l;try{l=i.loadAppConfig(r)}catch(d){let m=d instanceof Error?d.message:String(d);throw new u(m,{cause:d,hint:"Run this command from a Cognite app directory (one with app.json), or pass [bundle] explicitly.",shouldReport:!1})}s=B(r,l.externalId,l.versionTag)}if(!i.existsSync(s)){let l=e?void 0:"Default derived from app.json \u2014 pass [bundle] explicitly to override.";throw new u(`Bundle not found: ${s}`,{hint:l,shouldReport:!1})}let a=t.sig?Ie(r,t.sig):gi(s,i.existsSync);if(!a)throw new u("No signature file found.",{hint:`Pass --sig <path> or place one of ${In.map(l=>`${s}${l}`).join(", ")} next to the bundle.`,shouldReport:!1});if(!i.existsSync(a))throw new u(`Signature file not found: ${a}`,{shouldReport:!1});let p;try{p=i.readFileSync(a,"utf-8").trim()}catch(l){throw new u(`Failed to read signature file: ${a}`,{cause:l,shouldReport:!1})}if(!fi(p))throw new u(`Malformed JWS in ${a}`,{hint:"Expected a compact JWS (header.payload.signature \u2014 three base64url segments).",shouldReport:!1});let c;if(t.key){let l=Ie(r,t.key);if(!i.existsSync(l))throw new u(`Public key not found: ${l}`,{shouldReport:!1});try{c=i.readFileSync(l,"utf-8")}catch(d){throw new u(`Failed to read public key file: ${l}`,{cause:d,shouldReport:!1})}}else{let l=t.keyDir?Ie(r,t.keyDir):i.defaultKeyDir(),d=yi(p);if(!d)throw new u("Token header has no kid.",{hint:"Pass --key <path> to a public key PEM.",shouldReport:!1});c=hi(d,l,i)}try{let l=await i.verifyBundle({token:p,publicKeyPem:c,bundleStream:i.createBundleStream(s)});Si(l,t.verbose??!1)}catch(l){let d=l instanceof Error?l.message:String(l);throw new u(`Bundle rejected: ${d}`,{shouldReport:!1})}}o($n,"handleVerify");function Fn(e,t={}){return e.command("verify [bundle]").description("Verify a signed app bundle locally (default: derived from app.json)").option("-s, --sig <path>","Path to the signature file (default: sibling .dev.sig / .cert.sig / .sig)").option("--key <path>","Path to a public key PEM file").option("--key-dir <path>","Directory of <kid>.pub.pem files \u2014 kid is read from the token header (default: $COGNITE_CLI_HOME/keys)").option("-v, --verbose","Print the full decoded payload after verification").addHelpText("after",`
2
+ var $o=Object.defineProperty;var Zt=e=>{throw TypeError(e)};var o=(e,t)=>$o(e,"name",{value:t,configurable:!0});var Qt=(e,t,r)=>t.has(e)||Zt("Cannot "+r);var er=(e,t,r)=>(Qt(e,t,"read from private field"),r?r.call(e):t.get(e)),tr=(e,t,r)=>t.has(e)?Zt("Cannot add the same private member more than once"):t instanceof WeakSet?t.add(e):t.set(e,r),rr=(e,t,r,n)=>(Qt(e,t,"write to private field"),n?n.call(e,r):t.set(e,r),r);import{writeSync as _c}from"fs";import{Command as Lc}from"commander";var Xe=class Xe extends Error{constructor(t,r={}){super(t),this.name="HintedError",r.cause!==void 0&&(this.cause=r.cause);let n=this.deriveDefaults(r);this.hint=r.hint??n.hint,this.helpUrl=r.helpUrl??n.helpUrl,this.shouldReport=r.shouldReport??!0}deriveDefaults(t){return{hint:Oo(t.cause)}}};o(Xe,"HintedError");var g=Xe;function or(e){return e instanceof g}o(or,"isHintedError");var nr="https://docs.cognite.com/cdf/access/",To="https://status.cognite.com";function Ro(e){switch(e){case 401:return{hint:"Your credentials are invalid or expired. Check your client ID and secret.",helpUrl:nr};case 403:return{hint:"You don't have the required CDF capabilities. Please contact your CDF admin.",helpUrl:nr};case 413:return{hint:"The deployment exceeds the App Hosting size limit. Reduce the build output \u2014 remove unused assets, code-split bundles, or strip source maps."};case 429:return{hint:"You are being rate limited. Wait a few moments and retry. If this persists, contact CDF support."};case 500:case 502:case 503:case 504:return{hint:"CDF service error. The issue is on the server side. Check the status page and retry shortly.",helpUrl:To};default:return{}}}o(Ro,"defaultHintForStatus");var Ze=class Ze extends g{constructor(t,r){super(t,r),this.name="HintedHttpError",this.httpStatusCode=r.httpStatusCode,this.requestUrl=r.requestUrl,this.responseBody=r.responseBody}deriveDefaults(t){let{httpStatusCode:r}=t,n=Ro(r),i=super.deriveDefaults(t);return{hint:n.hint??i.hint,helpUrl:n.helpUrl}}};o(Ze,"HintedHttpError");var te=Ze;function ir(e){return e instanceof te}o(ir,"isHintedHttpError");function Fo(e,t){if(e)switch(e){case"ENOTFOUND":return t.hostname?`DNS lookup failed for ${t.hostname}. Check your network, VPN, or proxy settings.`:"DNS lookup failed. Check your network, VPN, or proxy settings.";case"ECONNREFUSED":return t.hostname&&t.port?`Connection refused by ${t.hostname}:${t.port}. The service may be down or the port may be wrong.`:"Connection refused. The service may be down or the port may be wrong.";case"ECONNRESET":return"Connection was reset. The server closed the connection unexpectedly; check for proxy/firewall interference and retry.";case"ETIMEDOUT":return"Connection timed out. Check your network, VPN, or proxy settings, and retry.";case"EAI_AGAIN":return"Temporary DNS failure. Retry shortly; if it persists, check your DNS configuration.";case"CERT_HAS_EXPIRED":case"UNABLE_TO_VERIFY_LEAF_SIGNATURE":case"SELF_SIGNED_CERT_IN_CHAIN":return"TLS certificate validation failed. Check system clock and CA trust store; if you use a corporate proxy, ensure its root cert is trusted.";case"EACCES":return t.path?`Permission denied: ${t.path}. Check file ownership and permissions.`:"Permission denied. Check file ownership and permissions.";case"ENOENT":return t.path?`File or directory not found: ${t.path}.`:"File or directory not found.";case"EISDIR":return t.path?`Expected a file but found a directory: ${t.path}.`:"Expected a file but found a directory.";case"ENOSPC":return"No space left on device. Free up disk space and retry.";case"EADDRINUSE":return t.port?`Port ${t.port} is already in use. Stop the process using it or pick a different port.`:"Address is already in use. Stop the conflicting process or change the port.";case"EMFILE":case"ENFILE":return"Too many open files. Close other programs or raise the file descriptor limit.";default:return}}o(Fo,"hintForErrno");function Oo(e){let t=e,r=new Set;for(;t!=null&&!r.has(t)&&(r.add(t),typeof t=="object");){let n=t,i=Fo(n.code,n);if(i!==void 0)return i;t=n.cause}}o(Oo,"hintForCause");import{existsSync as vi,readFileSync as Ci}from"fs";import{join as Ei,resolve as Fe}from"path";import{verifyBundle as ki}from"@cognite/app-sdk/codesigning";import{decodeProtectedHeader as bi}from"jose";import rt from"enquirer";import{email as Uo,pipe as _o,safeParse as Lo,string as No}from"valibot";var Ko=_o(No(),Uo());function ae(e,t="email"){let r=e.trim();if(!r)throw new Error(`${t} is required`);if(!Lo(Ko,r).success)throw new Error(`${t} must look like an email (user@example.com); got "${e}"`);return r}o(ae,"parseEmail");function pe(e,t="--expires"){let r=Number(e);if(!Number.isInteger(r)||r<1||r>12)throw new Error(`${t} must be an integer between 1 and 12 (months); got "${e}"`);return r}o(pe,"parseExpiryMonths");import{execFileSync as ge}from"child_process";function be(e={}){let{execFileSync:t=ge}=e;try{return t("git",["--version"],{stdio:"ignore"}),!0}catch{return!1}}o(be,"isGitInstalled");function Pe(e,t={}){let{execFileSync:r=ge}=t;try{return r("git",["-C",e,"status"],{stdio:"ignore"}),!0}catch{return!1}}o(Pe,"isInsideGitRepo");function sr(e,t={}){let{execFileSync:r=ge}=t;r("git",["-C",e,"init"],{stdio:"pipe"}),r("git",["-C",e,"add","."],{stdio:"pipe"}),r("git",["-C",e,"commit","-m","Initial commit","--no-gpg-sign","--no-verify"],{stdio:"pipe"})}o(sr,"gitInitAndCommit");function ar(e={}){let{execFileSync:t=ge}=e;try{return String(t("git",["config","--get","user.name"],{encoding:"utf-8",stdio:["ignore","pipe","ignore"]})).trim()||void 0}catch{return}}o(ar,"gitUserName");function pr(e={}){let{execFileSync:t=ge}=e;try{return String(t("git",["config","--get","user.email"],{encoding:"utf-8",stdio:["ignore","pipe","ignore"]})).trim()||void 0}catch{return}}o(pr,"gitUserEmail");import{inspect as Mo}from"util";var Qe="[REDACTED]",fe,xe=class xe{constructor(t){tr(this,fe);rr(this,fe,t)}toString(){return Qe}toJSON(){return Qe}[Mo.custom](){return Qe}expose(){return er(this,fe)}static from(t){return new xe(t)}};fe=new WeakMap,o(xe,"SensitiveString");var v=xe;var Ae=3,cr="Signing identity (kid) \u2014 e.g. jsmith-dev-001 (lowercase letters, digits, hyphens)",lr=`Key expiry in months (${1}-${12})`,dr="Email address for the registry entry",mr=`Passphrase for the encrypted private key (min ${15} chars)`,ur="Confirm passphrase",gr=o(()=>`Passphrase must be at least ${15} characters`,"passphraseTooShortMsg"),fr=o(e=>`Passphrases do not match (attempt ${e}/${Ae}).
3
+ `,"passphraseMismatchMsg"),yr=`Passphrase confirmation failed after ${Ae} attempts`,hr=o(e=>`A signing key with kid "${e}" already exists. Overwrite it?`,"confirmOverwriteMsg"),Sr="How would you like to submit your key registration?",wr="Open in browser",vr="Copy link to clipboard";async function De(e){return rt.prompt(e)}o(De,"defaultPrompt");function nt(e){return t=>{try{return e(t),!0}catch(r){return r instanceof Error?r.message:"Invalid"}}}o(nt,"parserAsValidator");var jo=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;function ne(e){let t=e.trim();if(!t)throw new Error("--kid must not be empty");if(t.length>64)throw new Error("--kid must be 64 characters or fewer");if(!jo.test(t))throw new Error("--kid must contain only lowercase letters, digits, and hyphens, and must not start or end with a hyphen (e.g. jsmith-dev-001)");return t}o(ne,"parseKid");async function Cr(e={}){let{prompt:t=De}=e,{kid:r}=await t({type:"input",name:"kid",message:cr,validate:nt(ne)});return ne(r)}o(Cr,"promptKid");async function Er(e={}){let{prompt:t=o(n=>rt.prompt(n),"prompt")}=e,{action:r}=await t({type:"select",name:"action",message:Sr,choices:[{name:"browser",message:wr},{name:"clipboard",message:vr}]});if(r!=="browser"&&r!=="clipboard")throw new Error(`Unexpected Zendesk action: ${r}`);return r}o(Er,"promptZendeskAction");async function kr(e={}){let{prompt:t=De}=e,{months:r}=await t({type:"input",name:"months",message:lr,initial:String(6),validate:nt(n=>pe(n,"expiry"))});return pe(r,"expiry")}o(kr,"promptExpiryMonths");async function br(e={}){let{prompt:t=De,gitUserEmail:r=pr}=e,{email:n}=await t({type:"input",name:"email",message:dr,initial:r(),validate:nt(i=>ae(i,"email"))});return ae(n,"email")}o(br,"promptEmail");async function Pr(e={}){let{prompt:t=De,stderr:r=process.stderr}=e;for(let n=1;n<=Ae;n+=1){let{passphrase:i}=await t({type:"password",name:"passphrase",message:mr,validate:o(a=>a.length>=15?!0:gr(),"validate")}),{confirm:s}=await t({type:"password",name:"confirm",message:ur});if(i===s)return v.from(i);r.write(fr(n))}throw new Error(yr)}o(Pr,"promptPassphrase");async function xr(e,t={}){let{prompt:r=o(i=>rt.prompt(i),"prompt")}=t,{confirmed:n}=await r({type:"confirm",name:"confirmed",message:hr(e),initial:!1});return n}o(xr,"promptConfirmOverwrite");import{existsSync as Zo,readdirSync as Qo,readFileSync as ei}from"fs";import{join as st}from"path";import{execFile as Go}from"child_process";import{promisify as Yo}from"util";import{execFileSync as Ar}from"child_process";import{platform as Vo}from"os";import Bo from"path";function _(e,t={}){let{platform:r=Vo}=t;switch(r()){case"darwin":return e==="macos";case"win32":return e==="windows";default:return e==="other"}}o(_,"isOS");function Dr(e,t={}){let{exec:r=Ar,log:n=console.log}=t,[i,s]=_("macos",t)?["open",[e]]:_("windows",t)?["rundll32",["url.dll,FileProtocolHandler",e]]:["xdg-open",[e]];try{r(i,s)}catch{n(`Could not open browser \u2014 open manually:
4
+ ${e}`)}}o(Dr,"openInBrowser");function Ir(e,t={}){let{exec:r=Ar,log:n=console.log}=t,[i,s]=_("macos",t)?["open",["-R",e]]:_("windows",t)?["explorer",[`/select,${e}`]]:["xdg-open",[Bo.dirname(e)]];try{r(i,s)}catch{n(`Could not open file manager \u2014 files are at:
5
+ ${e}`)}}o(Ir,"revealInFileManager");var $r="cognite-flows",qo=Yo(Go),Tr=o((e,t)=>qo(e,t),"defaultExecFile"),Jo=-25300,zo=Jo&255;function Wo(e){if(!(e instanceof Error)||!("code"in e)||e.code!==zo)return!1;let t="stderr"in e?String(e.stderr):"";return/could not be found/i.test(t)||t===""}o(Wo,"isKeychainNotFoundError");async function Rr(e,t,r={}){let n=t.expose();if(!_("macos",r))throw new Error("Keychain storage is only supported on macOS");let{execFile:i=Tr}=r;await i("security",["add-generic-password","-a",e,"-s",$r,"-w",Buffer.from(n,"utf-8").toString("base64"),"-U"])}o(Rr,"storeKeyInKeychain");async function Ie(e,t={}){if(!_("macos",t))return null;let{execFile:r=Tr}=t;try{let{stdout:n}=await r("security",["find-generic-password","-a",e,"-s",$r,"-w"]);return v.from(Buffer.from(n.trim(),"base64").toString("utf-8"))}catch(n){if(Wo(n))return null;throw n}}o(Ie,"readKeyFromKeychain");import{homedir as Xo}from"os";import{join as it}from"path";function D(e={}){let{env:t=process.env,homedir:r=Xo}=e,n=t.COGNITE_CLI_HOME?.trim()||it(r(),".cognite-cli");return{home:n,keysDir:it(n,"keys"),sessionFile:it(n,"session.json")}}o(D,"getConfig");var X=".pub.pem",at=".key.jwe",pt=".meta.json";function $e(e){switch(e.kind){case"keychain":return"Keychain";case"encrypted-file":return e.path;case"public-only":return"public-only (private key missing)"}}o($e,"formatLocalKeySource");function ti(e){return{existsSync:e.existsSync??Zo,readdirSync:e.readdirSync??Qo,readFileSync:e.readFileSync??((t,r)=>ei(t,r)),isOS:e.isOS??(t=>_(t)),readKeyFromKeychain:e.readKeyFromKeychain??(t=>Ie(t))}}o(ti,"resolveDeps");function ri(e){try{let t=JSON.parse(e);if(typeof t=="object"&&t!==null&&!Array.isArray(t)&&"email"in t&&typeof t.email=="string")return t.email}catch{}}o(ri,"readEmailFromMeta");function ni(e,t){return t.existsSync(e)?t.readdirSync(e).filter(r=>r.endsWith(X)):[]}o(ni,"publicKeyEntries");function oi(e){return e.slice(0,-X.length)}o(oi,"kidFromPublicKeyFilename");async function ii(e,t,r){if(r.isOS("macos")&&await r.readKeyFromKeychain(e).catch(()=>null)!==null)return{kind:"keychain"};let n=st(t,`${e}${at}`);return r.existsSync(n)?{kind:"encrypted-file",path:n}:{kind:"public-only"}}o(ii,"resolveSource");async function Te(e=D().keysDir,t={}){let r=ti(t),n=new Set,i=ni(e,r).flatMap(s=>{let a=oi(s);return!a||n.has(a)?[]:(n.add(a),[{kid:a,entry:s}])});return Promise.all(i.map(async({kid:s,entry:a})=>{let p=await ii(s,e,r),c=st(e,`${s}${pt}`),l;try{l=ri(r.readFileSync(c,"utf8"))}catch{}return{kid:s,source:p,publicKeyPath:st(e,a),email:l}}))}o(Te,"discoverLocalKeys");import{createReadStream as si}from"fs";function Re(e){let t=si(e);return new ReadableStream({start(r){t.on("data",n=>{let i=typeof n=="string"?Buffer.from(n):n;r.enqueue(new Uint8Array(i))}),t.on("end",()=>r.close()),t.on("error",n=>r.error(n))},cancel(){t.destroy()}})}o(Re,"createWebStreamFromFile");import ai from"path";var Fr=".cognite-bundles";function Or(e,t){return`${e}-${t}.zip`}o(Or,"bundleFileName");function q(e,t,r){return ai.join(e,Fr,Or(t,r))}o(q,"bundlePath");import{existsSync as hi,readFileSync as Si}from"fs";import{resolve as wi}from"path";import{array as Ur,boolean as pi,check as ce,forward as le,literal as ci,maxLength as li,minLength as di,nonEmpty as Z,object as _r,optional as J,picklist as mi,pipe as V,safeParse as ui,string as N,url as Lr}from"valibot";var ct=V(N(),Z("must not be empty")),lt=V(N(),Z("must not be empty"),li(256,"must be 256 characters or fewer")),dt=V(N(),Z("must not be empty"),Lr("must be a valid URL")),gi=V(N(),Z("must not be empty"),Lr("must be a valid URL")),mt=V(N(),Z("must not be empty")),ut=V(N(),Z("must not be empty")),fi=V(_r({org:mt,project:ut,baseUrl:dt,deployClientId:J(N(),""),deploySecretName:J(N(),""),published:J(pi(),!1),idpType:J(mi(["cdf","entra_id","oauth"]),"cdf"),tenantId:J(N()),scopes:J(Ur(V(N(),Z("must not be empty")))),tokenUrl:J(gi)}),le(ce(e=>e.idpType!=="entra_id"||!!e.tenantId,'must be set when idpType is "entra_id"'),["tenantId"]),le(ce(e=>e.idpType!=="oauth"||!!e.tokenUrl,'must be set when idpType is "oauth"'),["tokenUrl"]),le(ce(e=>!e.tokenUrl||e.idpType==="oauth",'must only be set when idpType is "oauth"'),["tokenUrl"]),le(ce(e=>e.idpType!=="oauth"||!!e.deployClientId,'must be set when idpType is "oauth"'),["deployClientId"]),le(ce(e=>e.idpType!=="oauth"||!!e.deploySecretName,'must be set when idpType is "oauth"'),["deploySecretName"]),le(ce(e=>!e.deployClientId||!!e.deploySecretName,"must be set when deployClientId is set"),["deploySecretName"])),yi=_r({name:ct,externalId:lt,versionTag:V(N(),Z("must not be empty")),description:J(N(),""),deployments:V(Ur(fi),di(1,"must contain at least one deployment")),infra:J(ci("appsApi"))});function gt(e){let t=ui(yi,e);if(t.success)return t.output;let r=t.issues[0],n=r.path?.map(s=>s.key).join(".")??"",i=n?`"${n}" `:"";throw new Error(`app.json: ${i}${r.message}`)}o(gt,"validateAppConfig");function C(e,t={}){let{validator:r=gt,existsSync:n=hi,readFileSync:i=Si}=t,s=wi(e,"app.json");if(!n(s))throw new Error(`No app.json found at ${s}. Make sure you're running this command from your app's root directory.`);let a=i(s,"utf-8"),p;try{p=JSON.parse(a)}catch{throw new Error("Failed to parse app.json \u2014 check that it contains valid JSON.")}return r(p)}o(C,"loadAppConfig");var Nr=[".dev.sig",".cert.sig",".sig"];function Pi(e){return{existsSync:e.existsSync??vi,readFileSync:e.readFileSync??((t,r)=>Ci(t,r)),createBundleStream:e.createBundleStream??Re,verifyBundle:e.verifyBundle??ki,loadAppConfig:e.loadAppConfig??C,defaultKeyDir:e.defaultKeyDir??(()=>D().keysDir)}}o(Pi,"resolveDeps");function xi(e,t){return Nr.map(r=>`${e}${r}`).find(r=>t(r))}o(xi,"findSiblingSignature");function Ai(e){let t=e.split(".");return t.length===3&&t.every(r=>r.length>0)}o(Ai,"isCompactJws");function Di(e){try{let t=bi(e);return typeof t.kid=="string"?t.kid:void 0}catch{return}}o(Di,"readKidFromToken");function Ii(e,t,r){let{existsSync:n,readFileSync:i}=r;try{ne(e)}catch(a){throw new g(a instanceof Error?a.message:String(a),{shouldReport:!1})}if(!n(t))throw new g(`Key directory not found: ${t}`,{shouldReport:!1});let s=Ei(t,`${e}${X}`);if(!n(s))throw new g(`No public key found for kid "${e}" in ${t}`,{shouldReport:!1});try{return i(s,"utf-8")}catch(a){throw new g(`Failed to read public key file: ${s}`,{cause:a,shouldReport:!1})}}o(Ii,"resolvePublicKeyForKid");function $i(e,t){let{payload:r,kid:n}=e;if(console.log(`Verified ${r.appId}@${r.version}`),console.log(` kid: ${n}`),console.log(` hash: ${r.bundleSha256}`),r.scopes&&r.scopes.length>0){let i=r.scopes.map(s=>`${s.org}/${s.project}`).join(", ");console.log(` scopes: ${i}`)}t&&console.log(JSON.stringify(r,null,2))}o($i,"printResult");async function Kr(e,t,r={},n=process.cwd()){let{existsSync:i,readFileSync:s,loadAppConfig:a,createBundleStream:p,verifyBundle:c,defaultKeyDir:l}=Pi(r),d;if(e)d=Fe(n,e);else{let u;try{u=a(n)}catch(f){let w=f instanceof Error?f.message:String(f);throw new g(w,{cause:f,hint:"Run this command from a Cognite app directory (one with app.json), or pass [bundle] explicitly.",shouldReport:!1})}d=q(n,u.externalId,u.versionTag)}if(!i(d)){let u=e?void 0:"Default derived from app.json \u2014 pass [bundle] explicitly to override.";throw new g(`Bundle not found: ${d}`,{hint:u,shouldReport:!1})}let m=t.sig?Fe(n,t.sig):xi(d,i);if(!m)throw new g("No signature file found.",{hint:`Pass --sig <path> or place one of ${Nr.map(u=>`${d}${u}`).join(", ")} next to the bundle.`,shouldReport:!1});if(!i(m))throw new g(`Signature file not found: ${m}`,{shouldReport:!1});let y;try{y=s(m,"utf-8").trim()}catch(u){throw new g(`Failed to read signature file: ${m}`,{cause:u,shouldReport:!1})}if(!Ai(y))throw new g(`Malformed JWS in ${m}`,{hint:"Expected a compact JWS (header.payload.signature \u2014 three base64url segments).",shouldReport:!1});let S;if(t.key){let u=Fe(n,t.key);if(!i(u))throw new g(`Public key not found: ${u}`,{shouldReport:!1});try{S=s(u,"utf-8")}catch(f){throw new g(`Failed to read public key file: ${u}`,{cause:f,shouldReport:!1})}}else{let u=t.keyDir?Fe(n,t.keyDir):l(),f=Di(y);if(!f)throw new g("Token header has no kid.",{hint:"Pass --key <path> to a public key PEM.",shouldReport:!1});S=Ii(f,u,{existsSync:i,readFileSync:s})}try{let u=await c({token:y,publicKeyPem:S,bundleStream:p(d)});$i(u,t.verbose??!1)}catch(u){let f=u instanceof Error?u.message:String(u);throw new g(`Bundle rejected: ${f}`,{shouldReport:!1})}}o(Kr,"handleVerify");function Mr(e,t={}){return e.command("verify [bundle]").description("Verify a signed app bundle locally (default: derived from app.json)").option("-s, --sig <path>","Path to the signature file (default: sibling .dev.sig / .cert.sig / .sig)").option("--key <path>","Path to a public key PEM file").option("--key-dir <path>","Directory of <kid>.pub.pem files \u2014 kid is read from the token header (default: $COGNITE_CLI_HOME/keys)").option("-v, --verbose","Print the full decoded payload after verification").addHelpText("after",`
6
6
  Bundles are stored in .cognite-bundles/<externalId>-<versionTag>.zip by default.
7
7
 
8
8
  Examples:
9
9
  cognite apps verify Verify default bundle (path from app.json)
10
10
  cognite apps verify .cognite-bundles/my-app-1.0.0.zip Verify a specific bundle
11
11
  cognite apps verify .cognite-bundles/my-app-1.0.0.zip --sig my-app-1.0.0.zip.dev.sig Verify with explicit signature
12
- cognite apps verify .cognite-bundles/my-app-1.0.0.zip --key /path/to/pub.pem Verify with explicit public key`).action((n,r)=>$n(n,r,t))}o(Fn,"registerVerifyCommand");var Rn="https://docs.cognite.com/cdf/access/";function O(e){return e!==null&&typeof e=="object"}o(O,"isRecord");function ne(e){return e instanceof Error&&"status"in e&&typeof e.status=="number"}o(ne,"isHttpError");function wi(e){switch(e){case 401:return`Your credentials are invalid or expired. Check your client ID and secret.
13
- See: ${Rn}`;case 403:return`You don't have the required CDF capabilities. Please contact your CDF admin.
14
- See: ${Rn}`;default:return}}o(wi,"httpStatusHint");function q(e){let t=e instanceof Error?e:new Error(String(e));if(!ne(t))return null;let n=wi(t.status);return n?Object.assign(new Error(`${t.message}
15
- ${n}`),{cause:t}):null}o(q,"enrichedHttpError");function vi(e){if(!O(e))return null;let t=e.missing;if(Array.isArray(t))return t;let n=e.data;if(O(n)){let r=n.error;if(O(r)&&Array.isArray(r.missing))return r.missing;if(Array.isArray(n.missing))return n.missing}return null}o(vi,"findMissingArray");function Ci(e,t){if(!ne(e)||e.status!==400)return!1;let n=vi(e);return n?n.some(r=>O(r)&&typeof r.externalId=="string"&&t.includes(r.externalId)):!1}o(Ci,"isMissingExternalIdError");function $e(e,t){return ne(e)&&e.status===404||Ci(e,t)}o($e,"isNotFoundError");var On=["DRAFT","PUBLISHED","DEPRECATED","ARCHIVED"],Un=["ACTIVE","PREVIEW"],ct=class ct extends Error{constructor(t,n){super(`Version ${n} of app ${t} not found`),this.name="AppVersionNotFoundError",this.appExternalId=t,this.version=n}};o(ct,"AppVersionNotFoundError");var H=ct,lt=class lt extends Error{constructor(t){super(`App ${t} not found`),this.name="AppNotFoundError",this.appExternalId=t}};o(lt,"AppNotFoundError");var ce=lt;function Fe(e,t){return e.includes(t)}o(Fe,"includesValue");function Ei(e){return Fe(On,e)}o(Ei,"isAppVersionLifecycleState");function ki(e){return Fe(Un,e)}o(ki,"isAppVersionAlias");function bi(e){return typeof e.version=="string"&&Ei(e.lifecycleState)&&typeof e.entrypoint=="string"&&typeof e.createdTime=="number"&&typeof e.createdBy=="string"&&typeof e.appExternalId=="string"&&(e.alias===void 0||ki(e.alias))&&(e.comment===void 0||typeof e.comment=="string")}o(bi,"isAppVersion");function Tn(e){if(!O(e)){let t=JSON.stringify(e)?.slice(0,200)??String(e);throw new Error(`Invalid version response: expected object, got ${t}`)}if(!bi(e)){let t=JSON.stringify(e).slice(0,300);throw new Error(`Invalid version response: missing or malformed fields. Got: ${t}`)}return e}o(Tn,"parseAppVersion");function Pi(e){if(!O(e))throw new Error("Invalid app response: not an object");let{externalId:t,name:n,description:r}=e;if(typeof t!="string")throw new Error("Invalid app response: missing externalId");if(typeof n!="string")throw new Error("Invalid app response: missing name");if(r!=null&&typeof r!="string")throw new Error("Invalid app response: malformed description");return{externalId:t,name:n,description:typeof r=="string"?r:void 0}}o(Pi,"parseAppMetadata");var dt=class dt{constructor(t){this.client=t}get appsBasePath(){return`/api/v1/projects/${encodeURIComponent(this.client.project)}/apphosting/apps`}async createApp(t,n,r){try{await this.client.post(this.appsBasePath,{data:{items:[{externalId:t,name:n,description:r}]}})}catch(i){throw q(i)??i}}async updateApps(t){try{await this.client.post(`${this.appsBasePath}/update`,{data:{items:t}})}catch(n){throw q(n)??n}}async getApp(t){let n=`${this.appsBasePath}/${encodeURIComponent(t)}`;try{let r=await this.client.get(n);return Pi(r.data)}catch(r){throw $e(r,[t])?new ce(t):q(r)??r}}async uploadVersion(t,n,r,i,s="index.html"){console.log(`\u{1F4E4} Uploading version ${n}...`);let a=new FormData;a.append("file",new Blob([new Uint8Array(r)]),i),a.append("version",n),a.append("entryPath",s);let p=encodeURIComponent(t),c=`${this.appsBasePath}/${p}/versions`,l=await this.client.authenticate(),d=`${this.client.getBaseUrl()}${c}`,m=new AbortController,y=setTimeout(()=>m.abort(),300*1e3),f;try{f=await fetch(d,{method:"POST",headers:{Authorization:`Bearer ${l}`},body:a,signal:m.signal})}catch(g){throw g instanceof Error&&g.name==="AbortError"?new u("Upload timed out after 5 minutes",{hint:"The upload took longer than 5 minutes. Try again \u2014 if it keeps timing out, check your network speed or bundle size."}):new u(`Failed to upload version to ${d}`,{cause:g,hint:"Check your network connection. Uploads can also fail behind a proxy that blocks multipart POST requests."})}finally{clearTimeout(y)}if(!f.ok){let g=await f.text(),S;try{S=JSON.parse(g)}catch{}let w=g;if(O(S)){let M=S.error;if(typeof M=="string")w=M;else if(O(M)){let U=M.message,j=M.code;w=typeof U=="string"?U:j!=null?`Unknown error (code: ${j})`:g}else{let U=S.message;w=typeof U=="string"?U:g}}let P=f.headers.get("x-request-id"),h=P?` | X-Request-ID: ${P}`:"";throw new Q(`Upload failed: ${f.status} \u2014 ${w}${h}`,{httpStatusCode:f.status,requestUrl:d,responseBody:O(S)?S:g})}console.log(`\u2705 Version ${n} uploaded`)}async getVersion(t,n){let r=encodeURIComponent(t),i=encodeURIComponent(n),s=`${this.appsBasePath}/${r}/versions/${i}`;try{let a=await this.client.get(s);return Tn(a.data)}catch(a){throw $e(a,[t,n])?new H(t,n):q(a)??a}}async getActiveVersion(t){let n=encodeURIComponent(t),r=`${this.appsBasePath}/${n}/versions/list`;try{let i=await this.client.post(r,{data:{filter:{aliases:["ACTIVE"]}}});if(!O(i.data)||!Array.isArray(i.data.items))throw new Error("Invalid versions/list response: expected an object with an items array");let{items:s}=i.data;if(s.length===0)return null;if(s.length>1)throw new Error(`Unexpected response: ${s.length} versions have the ACTIVE alias, expected at most 1`);return Tn(s[0])}catch(i){if($e(i,[t]))return null;throw q(i)??i}}async updateVersions(t,n){let r=encodeURIComponent(t),i=`${this.appsBasePath}/${r}/versions/update`;try{await this.client.post(i,{data:{items:n}})}catch(s){throw q(s)??s}}async submitSignatures(t,n,r){let i=encodeURIComponent(t),s=encodeURIComponent(n),a=`${this.appsBasePath}/${i}/versions/${s}/signatures`;try{await this.client.post(a,{data:{items:r}})}catch(p){throw q(p)??p}}async listSignatures(t,n){let r=encodeURIComponent(t),i=encodeURIComponent(n),s=`${this.appsBasePath}/${r}/versions/${i}/signatures/list`;try{let a=await this.client.post(s,{data:{}});return Di(a.data)}catch(a){throw q(a)??a}}};o(dt,"AppHostingApi");var Re=dt,xi=["VALID","REVOKED","EXPIRED","SIGNED_BEFORE_KEY_ISSUED","IAT_IN_FUTURE","BUNDLE_TOO_OLD","KEY_NOT_IN_REGISTRY"],Ai=["developer","certifier"];function Di(e){if(!O(e))throw new Error("Invalid signatures response: expected an object with an items array");let{items:t}=e;if(!Array.isArray(t))throw new Error("Invalid signatures response: items property is missing or not an array");return t.flatMap(n=>{let r=Ii(n);return r?[r]:[]})}o(Di,"parseStoredSignatures");function Ii(e){if(!O(e))return null;let{signerKid:t,signerRole:n,signatureIat:r,receivedAt:i,createdTime:s,status:a}=e;return typeof t!="string"||t===""||!Fe(Ai,n)||typeof r!="number"||typeof i!="number"||typeof s!="number"||!Fe(xi,a)?null:{signerKid:t,signerRole:n,signatureIat:r,receivedAt:i,createdTime:s,status:a}}o(Ii,"parseStoredSignature");function mt(e,t){let n=[];e.name!==t.name&&n.push({field:"name",remote:e.name,local:t.name});let r=e.description??"";return r!==t.description&&n.push({field:"description",remote:r,local:t.description}),n}o(mt,"diffAppMetadata");function $i(e){let t=["Cannot deploy: metadata in app.json differs from what's deployed:"];for(let{field:n,remote:r,local:i}of e){let s=`${n}:`.padEnd(14);t.push(` ${s}"${r}" \u2192 "${i}"`)}return t.join(`
16
- `)}o($i,"formatMetadataDriftError");var ut=class ut{constructor(t){this.api=new Re(t)}getVersion(t,n){return this.api.getVersion(t,n)}uploadVersion(t,n,r,i,s){return this.api.uploadVersion(t,n,r,i,s)}async ensureApp(t,n,r){console.log("\u{1F50D} Ensuring app exists...");try{await this.api.createApp(t,n,r),console.log(`\u2705 App '${t}' created`)}catch(i){if(ne(i)&&i.status===409){console.log(`\u2705 App '${t}' already exists`),await this.checkMetadataDrift(t,n,r);return}throw i}}async checkMetadataDrift(t,n,r){let i;try{i=await this.getApp(t)}catch{return}let s=mt(i,{name:n,description:r});if(s.length!==0)throw new u($i(s),{hint:"Run npx @cognite/cli apps metadata update to sync before deploying",shouldReport:!1})}getApp(t){return this.api.getApp(t)}async updateAppMetadata(t,n,r){await this.api.updateApps([{externalId:t,update:{name:{set:n},description:r?{set:r}:{setNull:!0}}}])}async submitSignatures(t,n,r){r.length!==0&&(console.log(`\u{1F50F} Submitting ${r.length} signature${r.length===1?"":"s"} for version ${n}...`),await this.api.submitSignatures(t,n,r),console.log("\u2705 Signatures stored"))}listSignatures(t,n){return this.api.listSignatures(t,n)}async publishVersion(t,n){await this.api.updateVersions(t,[{version:n,update:{lifecycleState:{set:"PUBLISHED"}}}])}async publishAndActivate(t,n){console.log(`\u{1F680} Publishing and activating version ${n}...`),await this.api.updateVersions(t,[{version:n,update:{lifecycleState:{set:"PUBLISHED"},alias:{set:"ACTIVE"}}}]),console.log(`\u2705 Version ${n} is now PUBLISHED and ACTIVE`)}getActiveVersion(t){return this.api.getActiveVersion(t)}async deactivateVersion(t,n){await this.api.updateVersions(t,[{version:n,update:{alias:{setNull:!0}}}])}async activateVersion(t,n){let r=null;try{r=await this.api.getActiveVersion(t)}catch{r=null}let i=r&&r.version!==n?r.version:void 0;return await this.api.updateVersions(t,[{version:n,update:{alias:{set:"ACTIVE"}}}]),{supersededVersion:i}}async deploy(t,n,r,i,s,a,p=!1){console.log(`
12
+ cognite apps verify .cognite-bundles/my-app-1.0.0.zip --key /path/to/pub.pem Verify with explicit public key`).action((r,n)=>Kr(r,n,t))}o(Mr,"registerVerifyCommand");var Hr="https://docs.cognite.com/cdf/access/";function L(e){return e!==null&&typeof e=="object"}o(L,"isRecord");function oe(e){return e instanceof Error&&"status"in e&&typeof e.status=="number"}o(oe,"isHttpError");function Ti(e){switch(e){case 401:return`Your credentials are invalid or expired. Check your client ID and secret.
13
+ See: ${Hr}`;case 403:return`You don't have the required CDF capabilities. Please contact your CDF admin.
14
+ See: ${Hr}`;default:return}}o(Ti,"httpStatusHint");function z(e){let t=e instanceof Error?e:new Error(String(e));if(!oe(t))return null;let r=Ti(t.status);return r?Object.assign(new Error(`${t.message}
15
+ ${r}`),{cause:t}):null}o(z,"enrichedHttpError");function Ri(e){if(!L(e))return null;let t=e.missing;if(Array.isArray(t))return t;let r=e.data;if(L(r)){let n=r.error;if(L(n)&&Array.isArray(n.missing))return n.missing;if(Array.isArray(r.missing))return r.missing}return null}o(Ri,"findMissingArray");function Fi(e,t){if(!oe(e)||e.status!==400)return!1;let r=Ri(e);return r?r.some(n=>L(n)&&typeof n.externalId=="string"&&t.includes(n.externalId)):!1}o(Fi,"isMissingExternalIdError");function Oe(e,t){return oe(e)&&e.status===404||Fi(e,t)}o(Oe,"isNotFoundError");var Vr=["DRAFT","PUBLISHED","DEPRECATED","ARCHIVED"],Br=["ACTIVE","PREVIEW"],ft=class ft extends Error{constructor(t,r){super(`Version ${r} of app ${t} not found`),this.name="AppVersionNotFoundError",this.appExternalId=t,this.version=r}};o(ft,"AppVersionNotFoundError");var B=ft,yt=class yt extends Error{constructor(t){super(`App ${t} not found`),this.name="AppNotFoundError",this.appExternalId=t}};o(yt,"AppNotFoundError");var de=yt;function Ue(e,t){return e.includes(t)}o(Ue,"includesValue");function Oi(e){return Ue(Vr,e)}o(Oi,"isAppVersionLifecycleState");function Ui(e){return Ue(Br,e)}o(Ui,"isAppVersionAlias");function _i(e){return typeof e.version=="string"&&Oi(e.lifecycleState)&&typeof e.entrypoint=="string"&&typeof e.createdTime=="number"&&typeof e.createdBy=="string"&&typeof e.appExternalId=="string"&&(e.alias===void 0||Ui(e.alias))&&(e.comment===void 0||typeof e.comment=="string")}o(_i,"isAppVersion");function jr(e){if(!L(e)){let t=JSON.stringify(e)?.slice(0,200)??String(e);throw new Error(`Invalid version response: expected object, got ${t}`)}if(!_i(e)){let t=JSON.stringify(e).slice(0,300);throw new Error(`Invalid version response: missing or malformed fields. Got: ${t}`)}return e}o(jr,"parseAppVersion");function Li(e){if(!L(e))throw new Error("Invalid app response: not an object");let{externalId:t,name:r,description:n}=e;if(typeof t!="string")throw new Error("Invalid app response: missing externalId");if(typeof r!="string")throw new Error("Invalid app response: missing name");if(n!=null&&typeof n!="string")throw new Error("Invalid app response: malformed description");return{externalId:t,name:r,description:typeof n=="string"?n:void 0}}o(Li,"parseAppMetadata");var ht=class ht{constructor(t){this.client=t}get appsBasePath(){return`/api/v1/projects/${encodeURIComponent(this.client.project)}/apphosting/apps`}async createApp(t,r,n){try{await this.client.post(this.appsBasePath,{data:{items:[{externalId:t,name:r,description:n}]}})}catch(i){throw z(i)??i}}async updateApps(t){try{await this.client.post(`${this.appsBasePath}/update`,{data:{items:t}})}catch(r){throw z(r)??r}}async getApp(t){let r=`${this.appsBasePath}/${encodeURIComponent(t)}`;try{let n=await this.client.get(r);return Li(n.data)}catch(n){throw Oe(n,[t])?new de(t):z(n)??n}}async uploadVersion(t,r,n,i,s="index.html"){console.log(`\u{1F4E4} Uploading version ${r}...`);let a=new FormData;a.append("file",new Blob([new Uint8Array(n)]),i),a.append("version",r),a.append("entryPath",s);let p=encodeURIComponent(t),c=`${this.appsBasePath}/${p}/versions`,l=await this.client.authenticate();if(!l)throw new g("Failed to authenticate for upload",{hint:"Check your credentials and try again."});let d=v.from(l),m=`${this.client.getBaseUrl()}${c}`,y=new AbortController,S=setTimeout(()=>y.abort(),300*1e3),u;try{u=await fetch(m,{method:"POST",headers:{Authorization:`Bearer ${d.expose()}`},body:a,signal:y.signal})}catch(f){throw f instanceof Error&&f.name==="AbortError"?new g("Upload timed out after 5 minutes",{hint:"The upload took longer than 5 minutes. Try again \u2014 if it keeps timing out, check your network speed or bundle size."}):new g(`Failed to upload version to ${m}`,{cause:f,hint:"Check your network connection. Uploads can also fail behind a proxy that blocks multipart POST requests."})}finally{clearTimeout(S)}if(!u.ok){let f=await u.text(),w;try{w=JSON.parse(f)}catch{}let E=f;if(L(w)){let P=w.error;if(typeof P=="string")E=P;else if(L(P)){let U=P.message,k=P.code;E=typeof U=="string"?U:k!=null?`Unknown error (code: ${k})`:f}else{let U=w.message;E=typeof U=="string"?U:f}}let h=u.headers.get("x-request-id"),M=h?` | X-Request-ID: ${h}`:"",H=L(w)?w:f;throw new te(`Upload failed: ${u.status} \u2014 ${E}${M}`,{httpStatusCode:u.status,requestUrl:m,responseBody:H})}console.log(`\u2705 Version ${r} uploaded`)}async getVersion(t,r){let n=encodeURIComponent(t),i=encodeURIComponent(r),s=`${this.appsBasePath}/${n}/versions/${i}`;try{let a=await this.client.get(s);return jr(a.data)}catch(a){throw Oe(a,[t,r])?new B(t,r):z(a)??a}}async getActiveVersion(t){let r=encodeURIComponent(t),n=`${this.appsBasePath}/${r}/versions/list`;try{let i=await this.client.post(n,{data:{filter:{aliases:["ACTIVE"]}}});if(!L(i.data)||!Array.isArray(i.data.items))throw new Error("Invalid versions/list response: expected an object with an items array");let{items:s}=i.data;if(s.length===0)return null;if(s.length>1)throw new Error(`Unexpected response: ${s.length} versions have the ACTIVE alias, expected at most 1`);return jr(s[0])}catch(i){if(Oe(i,[t]))return null;throw z(i)??i}}async updateVersions(t,r){let n=encodeURIComponent(t),i=`${this.appsBasePath}/${n}/versions/update`;try{await this.client.post(i,{data:{items:r}})}catch(s){throw z(s)??s}}async submitSignatures(t,r,n){let i=encodeURIComponent(t),s=encodeURIComponent(r),a=`${this.appsBasePath}/${i}/versions/${s}/signatures`;try{await this.client.post(a,{data:{items:n}})}catch(p){throw z(p)??p}}async listSignatures(t,r){let n=encodeURIComponent(t),i=encodeURIComponent(r),s=`${this.appsBasePath}/${n}/versions/${i}/signatures/list`;try{let a=await this.client.post(s,{data:{}});return Mi(a.data)}catch(a){throw z(a)??a}}};o(ht,"AppHostingApi");var _e=ht,Ni=["VALID","REVOKED","EXPIRED","SIGNED_BEFORE_KEY_ISSUED","IAT_IN_FUTURE","BUNDLE_TOO_OLD","KEY_NOT_IN_REGISTRY"],Ki=["developer","certifier"];function Mi(e){if(!L(e))throw new Error("Invalid signatures response: expected an object with an items array");let{items:t}=e;if(!Array.isArray(t))throw new Error("Invalid signatures response: items property is missing or not an array");return t.flatMap(r=>{let n=Hi(r);return n?[n]:[]})}o(Mi,"parseStoredSignatures");function Hi(e){if(!L(e))return null;let{signerKid:t,signerRole:r,signatureIat:n,receivedAt:i,createdTime:s,status:a}=e;return typeof t!="string"||t===""||!Ue(Ki,r)||typeof n!="number"||typeof i!="number"||typeof s!="number"||!Ue(Ni,a)?null:{signerKid:t,signerRole:r,signatureIat:n,receivedAt:i,createdTime:s,status:a}}o(Hi,"parseStoredSignature");function St(e,t){let r=[];e.name!==t.name&&r.push({field:"name",remote:e.name,local:t.name});let n=e.description??"";return n!==t.description&&r.push({field:"description",remote:n,local:t.description}),r}o(St,"diffAppMetadata");function ji(e){let t=["Cannot deploy: metadata in app.json differs from what's deployed:"];for(let{field:r,remote:n,local:i}of e){let s=`${r}:`.padEnd(14);t.push(` ${s}"${n}" \u2192 "${i}"`)}return t.join(`
16
+ `)}o(ji,"formatMetadataDriftError");var wt=class wt{constructor(t){this.api=new _e(t)}getVersion(t,r){return this.api.getVersion(t,r)}uploadVersion(t,r,n,i,s){return this.api.uploadVersion(t,r,n,i,s)}async ensureApp(t,r,n){console.log("\u{1F50D} Ensuring app exists...");try{await this.api.createApp(t,r,n),console.log(`\u2705 App '${t}' created`)}catch(i){if(oe(i)&&i.status===409){console.log(`\u2705 App '${t}' already exists`),await this.checkMetadataDrift(t,r,n);return}throw i}}async checkMetadataDrift(t,r,n){let i;try{i=await this.getApp(t)}catch{return}let s=St(i,{name:r,description:n});if(s.length!==0)throw new g(ji(s),{hint:"Run npx @cognite/cli apps metadata update to sync before deploying",shouldReport:!1})}getApp(t){return this.api.getApp(t)}async updateAppMetadata(t,r,n){await this.api.updateApps([{externalId:t,update:{name:{set:r},description:n?{set:n}:{setNull:!0}}}])}async submitSignatures(t,r,n){n.length!==0&&(console.log(`\u{1F50F} Submitting ${n.length} signature${n.length===1?"":"s"} for version ${r}...`),await this.api.submitSignatures(t,r,n),console.log("\u2705 Signatures stored"))}listSignatures(t,r){return this.api.listSignatures(t,r)}async publishVersion(t,r){await this.api.updateVersions(t,[{version:r,update:{lifecycleState:{set:"PUBLISHED"}}}])}async publishAndActivate(t,r){console.log(`\u{1F680} Publishing and activating version ${r}...`),await this.api.updateVersions(t,[{version:r,update:{lifecycleState:{set:"PUBLISHED"},alias:{set:"ACTIVE"}}}]),console.log(`\u2705 Version ${r} is now PUBLISHED and ACTIVE`)}getActiveVersion(t){return this.api.getActiveVersion(t)}async deactivateVersion(t,r){await this.api.updateVersions(t,[{version:r,update:{alias:{setNull:!0}}}])}async activateVersion(t,r){let n=null;try{n=await this.api.getActiveVersion(t)}catch{n=null}let i=n&&n.version!==r?n.version:void 0;return await this.api.updateVersions(t,[{version:r,update:{alias:{set:"ACTIVE"}}}]),{supersededVersion:i}}async deploy(t,r,n,i,s,a,p=!1){console.log(`
17
17
  \u{1F680} Deploying application via App Hosting API...
18
- `),await this.ensureApp(t,n,r),await this.uploadVersion(t,i,s,a),p&&await this.publishAndActivate(t,i),console.log(`
19
- \u2705 Deployment successful!`)}};o(ut,"AppHostingClient");var E=ut;import{CogniteClient as ds}from"@cognite/sdk";import{CogniteClient as Ki}from"@cognite/sdk";function Fi(e){return Math.floor(Math.random()*Math.min(2**e*250,15e3))}o(Fi,"exponentialBackoffWithJitter");function Ri(e){return new Promise(t=>setTimeout(t,e))}o(Ri,"sleep");async function _n(e,t={}){let n=t.maxAttempts??5,r=t.shouldRetry??(()=>!0),i=t.delayInMsCalculator??Fi;if(n<1)throw new Error("`maxAttempts` must be 1 or greater");if(n>100)throw new Error("`maxAttempts` must be 100 or less");let s=1;for(;;)try{return await e()}catch(a){if(s>=n||!r(a))throw a;let p=i(s);t.onAttemptFail?.(a,s,p),await Ri(p),s++}}o(_n,"retryAsync");var Ti="https://auth.cognite.com/oauth2/token",Oi=o(e=>typeof e=="object"&&e!==null&&"access_token"in e&&typeof e.access_token=="string","hasAccessToken");async function Ln({idp:e,tokenUrl:t,init:n,missingTokenHint:r}){let i;try{i=await _n(()=>fetch(t,n),{maxAttempts:3})}catch(p){throw new u(`Failed to fetch access token from ${t}`,{cause:p})}if(!i.ok){let p=await i.text();throw new Q(`Failed to get token from ${e}: ${i.status} ${i.statusText}`,{httpStatusCode:i.status,requestUrl:t,responseBody:p})}let s=await i.text(),a;try{a=JSON.parse(s)}catch{throw new u(`Unexpected response from ${e} authentication (invalid JSON):
20
- ${s}`,{hint:r})}if(!Oi(a))throw new u(`No access token in ${e} authentication response:
21
- ${s}`,{hint:r});return a.access_token}o(Ln,"fetchOAuthToken");var Ui=o(()=>{let e=process.env.DEPLOYMENT_SECRETS;if(!e)return{};try{let t=JSON.parse(e),n={};for(let[r,i]of Object.entries(t))if(typeof i=="string"){let s=r.toLowerCase().replace(/_/g,"-");n[s]=i}return n}catch(t){return console.error("Error parsing DEPLOYMENT_SECRETS:",t),{}}},"loadSecretsFromEnv"),_i=o(e=>{let t;if(process.env.DEPLOYMENT_SECRET&&(t=process.env.DEPLOYMENT_SECRET),t||(t=Ui()[e]),t||(t=process.env[e]),!t)throw new Error(`Secret not found in environment: ${e}`);return t},"getSecretFromEnv"),Li=o((e,t)=>Ln({idp:"CDF",tokenUrl:Ti,init:{method:"POST",headers:{Authorization:`Basic ${btoa(`${e}:${t}`)}`,"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"client_credentials"})},missingTokenHint:"Check the client ID in app.json and the deployment secret in your environment."}),"getTokenCdf"),Nn=o(({idp:e,tokenUrl:t,clientId:n,clientSecret:r,scopes:i,missingTokenHint:s})=>Ln({idp:e,tokenUrl:t,init:{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:n,client_secret:r,grant_type:"client_credentials",...i!==void 0?{scope:i.join(" ")}:{}})},missingTokenHint:s}),"getTokenWithClientCredentials"),Ni=o((e,t)=>{if(t!==void 0)return t.join(" ");if(!e)throw new Error("Entra ID authentication requires 'baseUrl' to be set in deployment configuration");try{return`${new URL(e).origin}/.default`}catch{throw new Error(`Entra ID authentication requires 'baseUrl' to be a valid CDF URL (e.g., https://cluster.cognitedata.com), got: ${e}`)}},"resolveEntraScope"),Mi=o((e,t,n,r,i)=>Nn({idp:"Entra ID",tokenUrl:`https://login.microsoftonline.com/${n}/oauth2/v2.0/token`,clientId:e,clientSecret:t,scopes:i!==void 0?i:[Ni(r)],missingTokenHint:"Check the client ID and tenant ID in app.json and the deployment secret in your environment."}),"getTokenEntra"),gt=o(async(e,t=process.env)=>{if(t.COGNITE_TOKEN)return t.COGNITE_TOKEN;let{deployClientId:n,deploySecretName:r,idpType:i="cdf",tenantId:s,baseUrl:a,scopes:p,tokenUrl:c}=e,l=_i(r);if(i==="oauth"){if(!c)throw new Error("OAuth authentication requires 'tokenUrl' in deployment configuration");return Nn({idp:"OAuth",tokenUrl:c,clientId:n,clientSecret:l,scopes:p,missingTokenHint:"Check the tokenUrl, client ID, scopes, and deployment secret in app.json and your environment."})}if(i==="entra_id"){if(!s)throw new Error("Entra ID authentication requires 'tenantId' in deployment configuration");return Mi(n,l,s,a,p)}return Li(n,l)},"getToken");async function ge(e,t,n=process.env,r){let i=await gt(e,n),s=n.COGNITE_BASE_URL??e.baseUrl,a=(r??(p=>new Ki(p)))({appId:t,project:e.project,baseUrl:s,oidcTokenProvider:o(async()=>i,"oidcTokenProvider")});return await a.authenticate(),a}o(ge,"getSdk");import Qi from"os";import es from"path";import ts from"open";import{buildAuthorizationUrl as ns,calculatePKCECodeChallenge as rs,discovery as os,None as is,randomPKCECodeVerifier as ss,randomState as as}from"openid-client";import Mn from"mixpanel";var Hi="5c4d853e7c3b77b1eb4468d5329b278c",fe="cognite-cli",ji=2e3,Kn={env:process.env,init:Mn.init.bind(Mn)},Vi={track:o(()=>{},"track"),flush:o(async()=>{},"flush")};function ft(e=process.env){return e.COGNITE_TELEMETRY_DISABLED==="1"||e.DO_NOT_TRACK==="1"}o(ft,"isTelemetryDisabled");function Bi(e){return e.COGNITE_TELEMETRY_DEBUG==="1"}o(Bi,"isDebug");function Te(e={}){let t=e.env??Kn.env,n=e.init??Kn.init,r=e.packageName,i=e.cliVersion,s=Bi(t);if(ft(t))return s&&process.stderr.write(`[telemetry] disabled \u2014 noop tracker
22
- `),Vi;let a,p=new Set;function c(){if(a)return a;try{return a=n(Hi,{geolocate:!1,keepAlive:!1}),a}catch{return}}return o(c,"getClient"),{track(l,d={}){let m=c();if(!m)return;let y={...d,applicationId:fe,...r&&{packageName:r},...i&&{cliVersion:i},nodeVersion:process.version,platform:process.platform};s&&process.stderr.write(`[telemetry] track ${l} ${JSON.stringify(y)}
23
- `);let f=o(()=>{},"finish"),g=new Promise(S=>{f=S});p.add(g);try{m.track(l,y,f)}catch{f()}g.finally(()=>p.delete(g))},async flush(l=ji){if(p.size===0)return;let d,m=new Promise(y=>{d=setTimeout(y,l),d.unref?.()});try{await Promise.race([Promise.allSettled([...p]),m])}finally{d&&clearTimeout(d)}s&&process.stderr.write(`[telemetry] flush done (${p.size} still pending)
24
- `)}}}o(Te,"createTelemetry");import qi from"https";import{authorizationCodeGrant as Yi}from"openid-client";function Hn(e){return e.replace(/[&<>"']/g,t=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[t]??t)}o(Hn,"escapeHtml");function yt(e,t,n){let r=Hn(t),i=Hn(n);return`<html><body style="font-family: system-ui; padding: 40px; text-align: center;">
25
- <h1>${r}</h1><p>${i}</p><p>You can close this window.</p>${e==="success"?`<style>
18
+ `),await this.ensureApp(t,r,n),await this.uploadVersion(t,i,s,a),p&&await this.publishAndActivate(t,i),console.log(`
19
+ \u2705 Deployment successful!`)}};o(wt,"AppHostingClient");var b=wt;import{CogniteClient as Ps}from"@cognite/sdk";import{CogniteClient as Zi}from"@cognite/sdk";function Vi(e){return Math.floor(Math.random()*Math.min(2**e*250,15e3))}o(Vi,"exponentialBackoffWithJitter");function Bi(e){return new Promise(t=>setTimeout(t,e))}o(Bi,"sleep");async function Gr(e,t={}){let r=t.maxAttempts??5,n=t.shouldRetry??(()=>!0),i=t.delayInMsCalculator??Vi;if(r<1)throw new Error("`maxAttempts` must be 1 or greater");if(r>100)throw new Error("`maxAttempts` must be 100 or less");let s=1;for(;;)try{return await e()}catch(a){if(s>=r||!n(a))throw a;let p=i(s);t.onAttemptFail?.(a,s,p),await Bi(p),s++}}o(Gr,"retryAsync");var Gi="https://auth.cognite.com/oauth2/token",Yi=o(e=>typeof e=="object"&&e!==null&&"access_token"in e&&typeof e.access_token=="string","hasAccessToken");async function Yr({idp:e,tokenUrl:t,init:r,missingTokenHint:n}){let i;try{i=await Gr(()=>fetch(t,r),{maxAttempts:3})}catch(p){throw new g(`Failed to fetch access token from ${t}`,{cause:p})}if(!i.ok){let p=await i.text();throw new te(`Failed to get token from ${e}: ${i.status} ${i.statusText}`,{httpStatusCode:i.status,requestUrl:t,responseBody:p})}let s=await i.text(),a;try{a=JSON.parse(s)}catch{throw new g(`Unexpected response from ${e} authentication (invalid JSON)`,{hint:n})}if(!Yi(a))throw new g(`No access token in ${e} authentication response`,{hint:n});return v.from(a.access_token)}o(Yr,"fetchOAuthToken");var qi=o(()=>{let e=process.env.DEPLOYMENT_SECRETS;if(!e)return{};try{let t=JSON.parse(e),r={};for(let[n,i]of Object.entries(t))if(typeof i=="string"){let s=n.toLowerCase().replace(/_/g,"-");r[s]=i}return r}catch(t){return console.error("Error parsing DEPLOYMENT_SECRETS:",t),{}}},"loadSecretsFromEnv"),Ji=o(e=>{let t;if(process.env.DEPLOYMENT_SECRET&&(t=process.env.DEPLOYMENT_SECRET),t||(t=qi()[e]),t||(t=process.env[e]),!t)throw new Error(`Secret not found in environment: ${e}`);return v.from(t)},"getSecretFromEnv"),zi=o((e,t)=>{let r=t.expose();return Yr({idp:"CDF",tokenUrl:Gi,init:{method:"POST",headers:{Authorization:`Basic ${btoa(`${e}:${r}`)}`,"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"client_credentials"})},missingTokenHint:"Check the client ID in app.json and the deployment secret in your environment."})},"getTokenCdf"),qr=o(({idp:e,tokenUrl:t,clientId:r,clientSecret:n,scopes:i,missingTokenHint:s})=>Yr({idp:e,tokenUrl:t,init:{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:r,client_secret:n,grant_type:"client_credentials",...i!==void 0?{scope:i.join(" ")}:{}})},missingTokenHint:s}),"getTokenWithClientCredentials"),Wi=o((e,t)=>{if(t!==void 0)return t.join(" ");if(!e)throw new Error("Entra ID authentication requires 'baseUrl' to be set in deployment configuration");try{return`${new URL(e).origin}/.default`}catch{throw new Error(`Entra ID authentication requires 'baseUrl' to be a valid CDF URL (e.g., https://cluster.cognitedata.com), got: ${e}`)}},"resolveEntraScope"),Xi=o((e,t,r,n,i)=>qr({idp:"Entra ID",tokenUrl:`https://login.microsoftonline.com/${r}/oauth2/v2.0/token`,clientId:e,clientSecret:t.expose(),scopes:i!==void 0?i:[Wi(n)],missingTokenHint:"Check the client ID and tenant ID in app.json and the deployment secret in your environment."}),"getTokenEntra"),vt=o(async(e,t=process.env)=>{if(t.COGNITE_TOKEN)return v.from(t.COGNITE_TOKEN);let{deployClientId:r,deploySecretName:n,idpType:i="cdf",tenantId:s,baseUrl:a,scopes:p,tokenUrl:c}=e,l=Ji(n);if(i==="oauth"){if(!c)throw new Error("OAuth authentication requires 'tokenUrl' in deployment configuration");return qr({idp:"OAuth",tokenUrl:c,clientId:r,clientSecret:l.expose(),scopes:p,missingTokenHint:"Check the tokenUrl, client ID, scopes, and deployment secret in app.json and your environment."})}if(i==="entra_id"){if(!s)throw new Error("Entra ID authentication requires 'tenantId' in deployment configuration");return Xi(r,l,s,a,p)}return zi(r,l)},"getToken");async function ye(e,t,r=process.env,n){let i=await vt(e,r),s=r.COGNITE_BASE_URL??e.baseUrl,a=(n??(p=>new Zi(p)))({appId:t,project:e.project,baseUrl:s,oidcTokenProvider:o(async()=>i.expose(),"oidcTokenProvider")});return await a.authenticate(),a}o(ye,"getSdk");import ms from"os";import us from"path";import gs from"open";import{buildAuthorizationUrl as fs,calculatePKCECodeChallenge as ys,discovery as hs,None as Ss,randomPKCECodeVerifier as ws,randomState as vs}from"openid-client";import Jr from"mixpanel";var Qi="5c4d853e7c3b77b1eb4468d5329b278c",he="cognite-cli",es=2e3,zr={env:process.env,init:Jr.init.bind(Jr)},ts={track:o(()=>{},"track"),flush:o(async()=>{},"flush")};function Ct(e=process.env){return e.COGNITE_TELEMETRY_DISABLED==="1"||e.DO_NOT_TRACK==="1"}o(Ct,"isTelemetryDisabled");function rs(e=process.env){if(e.GITHUB_ACTIONS)return"github-actions";if(e.TF_BUILD)return"azure-devops";if(e.GITLAB_CI)return"gitlab-ci";if(e.CIRCLECI)return"circleci";if(e.TRAVIS)return"travis-ci";if(e.BUILDKITE)return"buildkite";if(e.DRONE)return"drone";if(e.SEMAPHORE)return"semaphore";if(e.TEAMCITY_VERSION)return"teamcity";if(e.APPVEYOR)return"appveyor";if(e.CODEBUILD_BUILD_ID)return"aws-codebuild";if(e.HEROKU_TEST_RUN_ID)return"heroku-ci";if(e.BITBUCKET_BUILD_NUMBER)return"bitbucket-pipelines";if(e.JENKINS_URL||e.JENKINS_HOME)return"jenkins";if(e.CI&&e.CI!=="false"&&e.CI!=="0")return"ci-generic"}o(rs,"detectCiEnvironment");function ns(e){return e.COGNITE_TELEMETRY_DEBUG==="1"}o(ns,"isDebug");function Le(e={}){let t=e.env??zr.env,r=e.init??zr.init,n=e.packageName,i=e.cliVersion,s=ns(t),a=rs(t);if(Ct(t))return s&&process.stderr.write(`[telemetry] disabled \u2014 noop tracker
20
+ `),ts;let p,c=new Set;function l(){if(p)return p;try{return p=r(Qi,{geolocate:!1,keepAlive:!1}),p}catch{return}}return o(l,"getClient"),{track(d,m={}){let y=l();if(!y)return;let S={...m,applicationId:he,...n&&{packageName:n},...i&&{cliVersion:i},nodeVersion:process.version,platform:process.platform,...a&&{ciEnvironment:a}};s&&process.stderr.write(`[telemetry] track ${d} ${JSON.stringify(S)}
21
+ `);let u=o(()=>{},"finish"),f=new Promise(w=>{u=w});c.add(f);try{y.track(d,S,u)}catch{u()}f.finally(()=>c.delete(f))},async flush(d=es){if(c.size===0)return;let m,y=new Promise(S=>{m=setTimeout(S,d),m.unref?.()});try{await Promise.race([Promise.allSettled([...c]),y])}finally{m&&clearTimeout(m)}s&&process.stderr.write(`[telemetry] flush done (${c.size} still pending)
22
+ `)}}}o(Le,"createTelemetry");import is from"https";import{authorizationCodeGrant as ss}from"openid-client";function Wr(e){return e.replace(/[&<>"']/g,t=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[t]??t)}o(Wr,"escapeHtml");function Et(e,t,r){let n=Wr(t),i=Wr(r);return`<html><body style="font-family: system-ui; padding: 40px; text-align: center;">
23
+ <h1>${n}</h1><p>${i}</p><p>You can close this window.</p>${e==="success"?`<style>
26
24
  @keyframes checkmark {
27
25
  0% { transform: scale(0); }
28
26
  50% { transform: scale(1.2); }
@@ -30,32 +28,32 @@ ${s}`,{hint:r});return a.access_token}o(Ln,"fetchOAuthToken");var Ui=o(()=>{let
30
28
  }
31
29
  h1 { animation: checkmark 0.5s ease-out; }
32
30
  </style>`:""}
33
- </body></html>`}o(yt,"generateHtml");import Gi from"net";function jn(e,t){return new Promise(n=>{let r=new Gi.Socket,i=o(s=>{r.removeAllListeners(),r.destroy(),n(s)},"done");r.setTimeout(500),r.once("connect",()=>i(!1)),r.once("timeout",()=>i(!0)),r.once("error",()=>i(!0)),r.connect(e,t)})}o(jn,"isHostPortFree");function Oe(e,t={}){return T("windows",t)?`Find the process: netstat -ano | findstr :${e} then kill it: taskkill /PID <pid> /F`:`Free port ${e} (e.g. lsof -ti :${e} | xargs kill) and retry.`}o(Oe,"freePortHint");async function Vn(e){if(e<0)throw new Error(`Invalid port: ${e}`);return e===0?!0:(await Promise.all([jn(e,"127.0.0.1"),jn(e,"::1")])).every(Boolean)}o(Vn,"isPortFree");async function Ji(e,t,n,r,i,s){let a=new URL(e.url??"/",`https://${e.headers.host??"localhost"}`);if(a.pathname!=="/")return t.writeHead(404),t.end("Not found"),{shouldClose:!1};try{console.log("\u{1F504} Exchanging authorization code for tokens...");let p=await s.authorizationCodeGrant(n,a,{pkceCodeVerifier:r,expectedState:i});return t.writeHead(200,{"Content-Type":"text/html"}),t.end(yt("success","Login Successful!","You can close this window and return to the terminal.")),{shouldClose:!0,tokens:p}}catch(p){let c=p instanceof Error?p:new Error(String(p));return t.writeHead(400,{"Content-Type":"text/html"}),t.end(yt("error","Authentication Error",c.message)),{shouldClose:!0,error:c}}}o(Ji,"handleCallback");function zi(e){let t=e/6e4,n=Math.round(t*10)/10;return`${n} ${n===1?"minute":"minutes"}`}o(zi,"formatTimeoutMinutes");function Bn(e,t,n,r,i,s={createServer:qi.createServer,setTimeout:globalThis.setTimeout,clearTimeout:globalThis.clearTimeout,authorizationCodeGrant:Yi}){return new Promise((a,p)=>{let c=s.createServer(t,async(m,y)=>{try{let f=await Ji(m,y,n,r,i,s);f.shouldClose&&(d(),f.error?p(f.error):f.tokens?a(f.tokens):p(new Error("No tokens received")))}catch(f){d(),p(f instanceof Error?f:new Error(String(f)))}}),l=s.setTimeout(()=>{d(),p(new Error(`Login timeout - no response received within ${zi(e.loginTimeout)}`))},e.loginTimeout);function d(){s.clearTimeout(l),c.close()}o(d,"cleanup"),c.on("error",m=>{d(),m.code==="EADDRINUSE"||m.code==="EACCES"?p(new u(`Port ${e.port} is already in use \u2014 the login callback server cannot start`,{cause:m,hint:Oe(e.port)})):p(new u(`Login callback server failed: ${m.message}`,{cause:m}))}),c.listen(e.port,"127.0.0.1",()=>{console.log(`\u{1F310} Local HTTPS server started on https://localhost:${e.port}`)})})}o(Bn,"startCallbackServer");import{mkdirSync as Wi}from"fs";import{loadLocalCertificates as Xi}from"@cognite/app-sdk/https";var Zi={loadLocalCertificates:Xi,mkdirSync:Wi,logger:console};async function Gn(e,t=Zi){t.mkdirSync(e,{recursive:!0});let{cert:n,key:r,source:i}=await t.loadLocalCertificates({certDir:e}).catch(s=>{throw new u(`Failed to load SSL certificates from ${e}`,{cause:s,hint:"Run `npx @cognite/cli apps setup-https` to create trusted local certificates."})});return i==="mkcert"?t.logger.log("\u{1F510} Using mkcert certificates for HTTPS"):(t.logger.log("\u{1F510} Using in-memory self-signed certificate for HTTPS \u2014 your browser will give you a warning."),t.logger.log(" Run `npx @cognite/cli@latest apps setup-https` to install trusted local https certificates.")),{cert:n,key:r}}o(Gn,"getOrCreateCertificates");var ps={authority:"https://auth.cognite.com",clientId:"0404baaa-0a90-43a2-aba7-a110b53fb41c",redirectUri:"https://localhost:3000/",port:3e3,loginTimeout:300*1e3,certDir:es.join(Qi.homedir(),".cdf-login")},cs={open:ts,getOrCreateCertificates:Gn,startCallbackServer:Bn,isPortFree:Vn,discovery:os,buildAuthorizationUrl:ns,randomPKCECodeVerifier:ss,calculatePKCECodeChallenge:rs,randomState:as,logger:console,telemetry:Te()};async function Yn(e,t=ps,n){return n===void 0?qn(e,t,cs):qn(e,t,n)}o(Yn,"login");async function ls(e,t){try{return await e.discovery(new URL(t.authority),t.clientId,void 0,is())}catch(n){throw new u(`Failed to fetch OpenID configuration from ${t.authority}`,{cause:n})}}o(ls,"fetchOpenIdConfig");async function qn(e,t,n){if(!await n.isPortFree(t.port))throw n.telemetry?.track("Flows.CLI.PortInUse",{port:t.port}),new u(`Port ${t.port} is already in use \u2014 the login callback server cannot start`,{hint:Oe(t.port)});n.logger.log(`\u{1F510} Starting CDF login flow...
34
- `),n.logger.log(`\u{1F4E1} Fetching OpenID configuration from ${t.authority}...`);let i=await ls(n,t),s=n.randomPKCECodeVerifier(),a=await n.calculatePKCECodeChallenge(s),p=n.randomState(),c={redirect_uri:t.redirectUri,scope:"openid profile email",code_challenge:a,code_challenge_method:"S256",state:p};e&&(c.organization_hint=e);let l=n.buildAuthorizationUrl(i,c).toString(),d=await n.getOrCreateCertificates(t.certDir);e&&n.logger.log(`\u{1F3E2} Organization: ${e}`),n.logger.log(`\u{1F680} Opening browser for authentication...
35
- `);try{await n.open(l)}catch(m){let y=m instanceof Error?m.message:String(m);n.logger.error("\u274C Failed to open browser automatically."),n.logger.error(` Reason: ${y}`),n.logger.error(`Please open this URL manually:
36
- `),n.logger.error(l),n.logger.error("")}return n.startCallbackServer(t,d,i,s,p)}o(qn,"loginImpl");async function A(e,t,n={}){let{login:r=Yn,getSdk:i=ge,createClient:s=o(a=>new ds(a),"createClient")}=n;if(t.interactive){let a=t.orgHint||e.org||void 0,p=await r(a),c=s({appId:t.appId,project:e.project,baseUrl:e.baseUrl,getToken:o(async()=>p.access_token,"getToken")});return await c.authenticate(),c}return i(e,t.appId)}o(A,"getClientForDeployment");import Jn from"enquirer";var zn="Enter custom target...";function Wn(e,t){let n=t.map((r,i)=>` ${i}: ${r.org}/${r.project}`).join(`
31
+ </body></html>`}o(Et,"generateHtml");import os from"net";function Xr(e,t){return new Promise(r=>{let n=new os.Socket,i=o(s=>{n.removeAllListeners(),n.destroy(),r(s)},"done");n.setTimeout(500),n.once("connect",()=>i(!1)),n.once("timeout",()=>i(!0)),n.once("error",()=>i(!0)),n.connect(e,t)})}o(Xr,"isHostPortFree");function Ne(e,t={}){return _("windows",t)?`Find the process: netstat -ano | findstr :${e} then kill it: taskkill /PID <pid> /F`:`Free port ${e} (e.g. lsof -ti :${e} | xargs kill) and retry.`}o(Ne,"freePortHint");async function Zr(e){if(e<0)throw new Error(`Invalid port: ${e}`);return e===0?!0:(await Promise.all([Xr(e,"127.0.0.1"),Xr(e,"::1")])).every(Boolean)}o(Zr,"isPortFree");async function as(e,t,r,n,i,s){let a=new URL(e.url??"/",`https://${e.headers.host??"localhost"}`);if(a.pathname!=="/")return t.writeHead(404),t.end("Not found"),{shouldClose:!1};try{console.log("\u{1F504} Exchanging authorization code for tokens...");let p=await s.authorizationCodeGrant(r,a,{pkceCodeVerifier:n,expectedState:i});return t.writeHead(200,{"Content-Type":"text/html"}),t.end(Et("success","Login Successful!","You can close this window and return to the terminal.")),{shouldClose:!0,tokens:p}}catch(p){let c=p instanceof Error?p:new Error(String(p));return t.writeHead(400,{"Content-Type":"text/html"}),t.end(Et("error","Authentication Error",c.message)),{shouldClose:!0,error:c}}}o(as,"handleCallback");function ps(e){let t=e/6e4,r=Math.round(t*10)/10;return`${r} ${r===1?"minute":"minutes"}`}o(ps,"formatTimeoutMinutes");function Qr(e,t,r,n,i,s={createServer:is.createServer,setTimeout:globalThis.setTimeout,clearTimeout:globalThis.clearTimeout,authorizationCodeGrant:ss}){return new Promise((a,p)=>{let c=s.createServer(t,async(m,y)=>{try{let S=await as(m,y,r,n,i,s);S.shouldClose&&(d(),S.error?p(S.error):S.tokens?a(S.tokens):p(new Error("No tokens received")))}catch(S){d(),p(S instanceof Error?S:new Error(String(S)))}}),l=s.setTimeout(()=>{d(),p(new Error(`Login timeout - no response received within ${ps(e.loginTimeout)}`))},e.loginTimeout);function d(){s.clearTimeout(l),c.close()}o(d,"cleanup"),c.on("error",m=>{d(),m.code==="EADDRINUSE"||m.code==="EACCES"?p(new g(`Port ${e.port} is already in use \u2014 the login callback server cannot start`,{cause:m,hint:Ne(e.port)})):p(new g(`Login callback server failed: ${m.message}`,{cause:m}))}),c.listen(e.port,"127.0.0.1",()=>{console.log(`\u{1F310} Local HTTPS server started on https://localhost:${e.port}`)})})}o(Qr,"startCallbackServer");import{mkdirSync as cs}from"fs";import{loadLocalCertificates as ls}from"@cognite/app-sdk/https";var ds={loadLocalCertificates:ls,mkdirSync:cs,logger:console};async function en(e,t=ds){t.mkdirSync(e,{recursive:!0});let{cert:r,key:n,source:i}=await t.loadLocalCertificates({certDir:e}).catch(s=>{throw new g(`Failed to load SSL certificates from ${e}`,{cause:s,hint:"Run `npx @cognite/cli apps setup-https` to create trusted local certificates."})});return i==="mkcert"?t.logger.log("\u{1F510} Using mkcert certificates for HTTPS"):(t.logger.log("\u{1F510} Using in-memory self-signed certificate for HTTPS \u2014 your browser will give you a warning."),t.logger.log(" Run `npx @cognite/cli@latest apps setup-https` to install trusted local https certificates.")),{cert:r,key:n}}o(en,"getOrCreateCertificates");var Cs="openid profile email",Es={authority:"https://auth.cognite.com",clientId:"0404baaa-0a90-43a2-aba7-a110b53fb41c",redirectUri:"https://localhost:3000/",port:3e3,loginTimeout:300*1e3,certDir:us.join(ms.homedir(),".cdf-login")},ks={open:gs,getOrCreateCertificates:en,startCallbackServer:Qr,isPortFree:Zr,discovery:hs,buildAuthorizationUrl:fs,randomPKCECodeVerifier:ws,calculatePKCECodeChallenge:ys,randomState:vs,logger:console,telemetry:Le()};async function rn(e,t=Es,r){return r===void 0?tn(e,t,ks):tn(e,t,r)}o(rn,"login");async function bs(e,t){let{discovery:r}=e;try{return await r(new URL(t.authority),t.clientId,void 0,Ss())}catch(n){throw new g(`Failed to fetch OpenID configuration from ${t.authority}`,{cause:n})}}o(bs,"fetchOpenIdConfig");async function tn(e,t,r){let{isPortFree:n,telemetry:i,logger:s,randomPKCECodeVerifier:a,calculatePKCECodeChallenge:p,randomState:c,buildAuthorizationUrl:l,getOrCreateCertificates:d,open:m,startCallbackServer:y}=r;if(!await n(t.port))throw i?.track("Flows.CLI.PortInUse",{port:t.port}),new g(`Port ${t.port} is already in use \u2014 the login callback server cannot start`,{hint:Ne(t.port)});s.log(`\u{1F510} Starting CDF login flow...
32
+ `),s.log(`\u{1F4E1} Fetching OpenID configuration from ${t.authority}...`);let u=await bs(r,t),f=a(),w=await p(f),E=c(),h={redirect_uri:t.redirectUri,scope:t.scope??Cs,code_challenge:w,code_challenge_method:"S256",state:E};e&&(h.organization_hint=e);let M=l(u,h).toString(),H=await d(t.certDir);e&&s.log(`\u{1F3E2} Organization: ${e}`),s.log(`\u{1F680} Opening browser for authentication...
33
+ `);try{await m(M)}catch(P){let U=P instanceof Error?P.message:String(P);s.error("\u274C Failed to open browser automatically."),s.error(` Reason: ${U}`),s.error(`Please open this URL manually:
34
+ `),s.error(M),s.error("")}return y(t,H,u,f,E)}o(tn,"loginImpl");async function I(e,t,r={}){let{login:n=rn,getSdk:i=ye,createClient:s=o(a=>new Ps(a),"createClient")}=r;if(t.interactive){let a=t.orgHint||e.org||void 0,p=await n(a),c=v.from(p.access_token),l=s({appId:t.appId,project:e.project,baseUrl:e.baseUrl,getToken:o(async()=>c.expose(),"getToken")});return await l.authenticate(),l}return i(e,t.appId)}o(I,"getClientForDeployment");import nn from"enquirer";var on="Enter custom target...";function sn(e,t){let r=t.map((n,i)=>` ${i}: ${n.org}/${n.project}`).join(`
37
35
  `);throw new Error(`Deployment "${e}" not found. Available deployments:
38
- ${n}`)}o(Wn,"deploymentNotFoundError");function b(e,t){if(e.length===0)throw new Error("No deployments configured in app.json");if(t===void 0)return e[0];if(/^\d+$/.test(t)){let r=e[Number.parseInt(t)];if(r)return r;Wn(t,e)}let n=e.find(r=>r.project===t||`${r.org}/${r.project}`===t);if(n)return n;Wn(t,e)}o(b,"findDeployment");function D(e){let t=[];return e.deployClientId||t.push("deployClientId"),e.deploySecretName||t.push("deploySecretName"),t}o(D,"getMissingCredentials");async function I(e,t){if(t.baseUrl&&t.project)return{org:t.org??"",project:t.project,baseUrl:t.baseUrl,deployClientId:"",deploySecretName:"",published:!1,idpType:"cdf"};if(t.deployment!==void 0)return b(e.deployments,t.deployment);let n=[...e.deployments.map(s=>`${s.org}/${s.project}`),zn],{selected:r}=await Jn.prompt({type:"select",name:"selected",message:"Select deployment target",choices:n});if(r!==zn){let s=e.deployments.find(a=>`${a.org}/${a.project}`===r);if(s)return s;throw new Error(`Deployment "${r}" could not be resolved from app.json.`)}let i=await Jn.prompt([{type:"input",name:"baseUrl",message:"CDF Base URL",initial:"https://api.cognitedata.com"},{type:"input",name:"project",message:"CDF Project",validate:o(s=>s?!0:"Project is required","validate")},{type:"input",name:"org",message:"Organization (for login hint)",initial:""}]);return{org:i.org||"",project:i.project,baseUrl:i.baseUrl,deployClientId:"",deploySecretName:"",published:!1,idpType:"cdf"}}o(I,"resolveDeployment");import{existsSync as ms}from"fs";import{resolve as us}from"path";import{config as gs}from"dotenv";function $(e,t={existsSync:ms,config:gs}){let n=us(e,".env");t.existsSync(n)&&(console.log(`Loading environment variables from ${n}`),t.config({path:n}))}o($,"loadEnvFile");function F(e){e.infra!=="appsApi"&&(console.error(`
36
+ ${r}`)}o(sn,"deploymentNotFoundError");function x(e,t){if(e.length===0)throw new Error("No deployments configured in app.json");if(t===void 0)return e[0];if(/^\d+$/.test(t)){let n=e[Number.parseInt(t)];if(n)return n;sn(t,e)}let r=e.find(n=>n.project===t||`${n.org}/${n.project}`===t);if(r)return r;sn(t,e)}o(x,"findDeployment");function $(e){let t=[];return e.deployClientId||t.push("deployClientId"),e.deploySecretName||t.push("deploySecretName"),t}o($,"getMissingCredentials");async function T(e,t){if(t.baseUrl&&t.project)return{org:t.org??"",project:t.project,baseUrl:t.baseUrl,deployClientId:"",deploySecretName:"",published:!1,idpType:"cdf"};if(t.deployment!==void 0)return x(e.deployments,t.deployment);let r=[...e.deployments.map(s=>`${s.org}/${s.project}`),on],{selected:n}=await nn.prompt({type:"select",name:"selected",message:"Select deployment target",choices:r});if(n!==on){let s=e.deployments.find(a=>`${a.org}/${a.project}`===n);if(s)return s;throw new Error(`Deployment "${n}" could not be resolved from app.json.`)}let i=await nn.prompt([{type:"input",name:"baseUrl",message:"CDF Base URL",initial:"https://api.cognitedata.com"},{type:"input",name:"project",message:"CDF Project",validate:o(s=>s?!0:"Project is required","validate")},{type:"input",name:"org",message:"Organization (for login hint)",initial:""}]);return{org:i.org||"",project:i.project,baseUrl:i.baseUrl,deployClientId:"",deploySecretName:"",published:!1,idpType:"cdf"}}o(T,"resolveDeployment");import{existsSync as xs}from"fs";import{resolve as As}from"path";import{config as Ds}from"dotenv";function R(e,t={existsSync:xs,config:Ds}){let r=As(e,".env");t.existsSync(r)&&(console.log(`Loading environment variables from ${r}`),t.config({path:r}))}o(R,"loadEnvFile");function F(e){e.infra!=="appsApi"&&(console.error(`
39
37
  \u26A0\uFE0F Legacy infrastructure is no longer supported.
40
38
 
41
39
  Your app.json is missing \`"infra": "appsApi"\`, which means it was created for
42
40
  the old CDF Application Registry. This deploy path has been removed.
43
41
 
44
42
  To migrate: add \`"infra": "appsApi"\` to your app.json, wire up the correct authentication and re-deploy.
45
- `),process.exit(1))}o(F,"assertAppHostingInfra");async function fs(e){let t=process.cwd();$(t);let n=v(t);F(n);let r=e.interactive?await I(n,e):b(n.deployments,e.deployment);if(!e.interactive){let d=D(r);if(d.length>0)throw new Error(`Deployment ${r.org}/${r.project} is missing ${d.join(" and ")} in app.json. Use \`npx @cognite/cli@latest apps activate --interactive\` for browser-based authentication instead.`)}let i=await A(r,{interactive:e.interactive,appId:n.externalId,orgHint:e.org}),s=new E(i),{externalId:a,versionTag:p}=n,c;try{c=await s.getVersion(a,p)}catch(d){throw d instanceof H?new Error(`Version ${p} of ${a} has not been deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):d}if(c.alias==="ACTIVE"){console.log(` ${a} @ ${p} is already ACTIVE \u2014 nothing to do.`);return}if(c.lifecycleState==="DEPRECATED"||c.lifecycleState==="ARCHIVED")throw new Error(`Cannot activate ${a} @ ${p}: version is ${c.lifecycleState} (terminal).`);c.lifecycleState==="DRAFT"&&(await s.publishVersion(a,p),console.log(`\u2713 Published ${a} @ ${p} is now PUBLISHED`));let{supersededVersion:l}=await s.activateVersion(a,p);console.log(`\u2713 Activated ${a} @ ${p} is now ACTIVE`),l&&console.log(` Superseded ${l} \u2192 PUBLISHED`)}o(fs,"handleActivate");function Xn(e){return e.command("activate").description("Activate the current app version (publish if needed, then set ACTIVE alias)").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
43
+ `),process.exit(1))}o(F,"assertAppHostingInfra");async function Is(e){let t=process.cwd();R(t);let r=C(t);F(r);let n=e.interactive?await T(r,e):x(r.deployments,e.deployment);if(!e.interactive){let d=$(n);if(d.length>0)throw new Error(`Deployment ${n.org}/${n.project} is missing ${d.join(" and ")} in app.json. Use \`npx @cognite/cli@latest apps activate --interactive\` for browser-based authentication instead.`)}let i=await I(n,{interactive:e.interactive,appId:r.externalId,orgHint:e.org}),s=new b(i),{externalId:a,versionTag:p}=r,c;try{c=await s.getVersion(a,p)}catch(d){throw d instanceof B?new Error(`Version ${p} of ${a} has not been deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):d}if(c.alias==="ACTIVE"){console.log(` ${a} @ ${p} is already ACTIVE \u2014 nothing to do.`);return}if(c.lifecycleState==="DEPRECATED"||c.lifecycleState==="ARCHIVED")throw new Error(`Cannot activate ${a} @ ${p}: version is ${c.lifecycleState} (terminal).`);c.lifecycleState==="DRAFT"&&(await s.publishVersion(a,p),console.log(`\u2713 Published ${a} @ ${p} is now PUBLISHED`));let{supersededVersion:l}=await s.activateVersion(a,p);console.log(`\u2713 Activated ${a} @ ${p} is now ACTIVE`),l&&console.log(` Superseded ${l} \u2192 PUBLISHED`)}o(Is,"handleActivate");function an(e){return e.command("activate").description("Activate the current app version (publish if needed, then set ACTIVE alias)").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
46
44
  Examples:
47
45
  npx @cognite/cli apps activate . Activate using env-var auth
48
- npx @cognite/cli apps activate . --interactive Activate using browser auth (no secrets needed)`).action((t,n)=>fs(n))}o(Xn,"registerActivateCommand");import{basename as dr,dirname as Ws,normalize as Xs,resolve as Me}from"path";import{fileURLToPath as Zs,pathToFileURL as Qs}from"url";import{Logger as ea,runner as ta}from"hygen";import{safeParse as ys}from"valibot";function ye(e,t){return n=>{let r=ys(t,n);return r.success?!0:`${e} ${r.issues[0].message}`}}o(ye,"toPromptValidator");var Zn={name:ye("App name",ot),displayName:ye("Display name",rt),baseUrl:ye("Base URL",it),org:ye("Org",st),project:ye("Project",at)};function hs(e,t){return e?async n=>{let r=t(n);return r===!0?e(n):r}:t}o(hs,"composeValidators");function Ue(e){return e.map(t=>{if(!(t.name in Zn))return t;let n=Zn[t.name];return{...t,validate:hs(t.validate,n)}})}o(Ue,"applySchemaValidators");import{basename as Qn}from"path";import er from"enquirer";function ht(e){return e.replace(/[A-Z]/g,(t,n)=>n===0?t.toLowerCase():`-${t.toLowerCase()}`)}o(ht,"kebabCase");var Ss={type:"confirm",name:"useSpecKit",message:["Enable spec-driven development?"," Adds the github/spec-kit slash commands (/speckit.specify, .clarify, .plan, .tasks, .implement)"," to your app for use in Claude Code or Cursor. They walk you through writing SPEC.md and"," generating a plan, tasks, and implementation."].join(`
49
- `),initial:!1};async function ws(e,t,n){return e!==void 0?e:t?!!(await n([Ss])).useSpecKit:!1}o(ws,"resolveSpecKit");function vs(e){return typeof e=="function"}o(vs,"isFunctionInitial");function tr(e){return(e??"").trim().replace(/\/+$/,"")||"api"}o(tr,"normalizeCluster");function nr({isCurrentDir:e,dirName:t,onAppName:n,onUseSpecKit:r,presets:i={},specKit:s,prompt:a=er.prompt.bind(er)}){return()=>({prompt:o(async p=>{if(!Array.isArray(p))return a([p]);let c=Object.fromEntries(Object.entries(i).filter(C=>C[1]!==void 0)),l=Object.keys(c).length>0,d=e?Qn(process.cwd()):t?Qn(t):null,m=l&&d!==null,y=!m&&d?p.map(C=>C.name==="name"?{...C,initial:d}:C):p,f=Ue(y),g=m&&d?{...c,name:d}:c,S=new Set(Object.keys(g)),w=f.filter(C=>!S.has(C.name)),P=w.findIndex(C=>C.name==="baseUrl"),h;if(m){let C=tr(g.cluster),V=o(k=>vs(k.initial)?k.initial():k.initial,"resolveInitial"),oe=o(k=>{if(k.name==="baseUrl")return`https://${C}.cognitedata.com`;let W=V(k);if(W===void 0)throw new Error(`Non-interactive mode: --${ht(k.name)} has no default. Pass it as a flag.`);return W},"deriveValue");h=Object.fromEntries(w.map(k=>[k.name,oe(k)]))}else if(P!==-1){let C=w.filter(_=>_.name!=="baseUrl"),V=C.length>0?await a(C):{},oe=typeof V.cluster=="string"?V.cluster:"",W=`https://${tr(oe||g.cluster)}.cognitedata.com`,X=w[P],Z=await a([{...X,initial:W}]);h={...V,...Z}}else h=w.length>0?await a(w):{};let M={...g,...h},U=typeof M.name=="string"?M.name:"";U&&n(U);let me=await ws(s,!m&&w.length>0,a);return r?.(me),{...M,name:U,useCurrentDir:e,directoryName:e?void 0:t??void 0,useSpecKit:me}},"prompt")})}o(nr,"createAppPrompter");async function rr(e,t,n){let r=[];Object.values(t).some(s=>s!==void 0)&&n!==null&&r.push({key:"name",value:n,label:"directory"});for(let[s,a]of Object.entries(t))a!==void 0&&r.push({key:s,value:a,label:`--${ht(s)}`});for(let{key:s,value:a,label:p}of r){let c=e.find(d=>d.name===s)?.validate;if(!c)continue;let l=await c(a);if(l!==!0)throw new Error(`Invalid ${p}: ${l}`)}}o(rr,"validatePresets");import{cpSync as St,existsSync as xs,mkdirSync as wt,writeFileSync as As}from"fs";import{dirname as Le,posix as Ds,resolve as N}from"path";import{fileURLToPath as ir}from"url";import{copyFileSync as Cs,symlinkSync as Es}from"fs";import{dirname as ks,join as bs}from"path";function Ps(e){if(e&&typeof e=="object"&&"code"in e&&typeof e.code=="string")return e.code}o(Ps,"errno");function or(e){return e instanceof Error?e.message:String(e)}o(or,"messageOf");function _e({target:e,linkPath:t,label:n,symlink:r=Es,copyFile:i=Cs}){try{return r(e,t),!0}catch(s){let a=Ps(s);if(a==="EEXIST")return!0;let p=or(s);if(a==="EPERM"||a==="EACCES")try{let c=bs(ks(t),e);return i(c,t),console.log(`\u2139\uFE0F Wrote ${n} as a copy of ${e} (symlinks need Developer Mode or an elevated shell on Windows).`),!0}catch(c){return console.warn(`\u26A0\uFE0F Could not create ${n} symlink: ${p} (copy fallback also failed: ${or(c)})`),!1}return console.warn(`\u26A0\uFE0F Could not create ${n} symlink:`,p),!1}}o(_e,"linkOrCopyOrWarn");var Is=N(Le(ir(import.meta.url)),"..","..","_vendor","spec-kit"),$s=N(Le(ir(import.meta.url)),"..","..","_cognite-spec-extensions"),Fs={branch_numbering:"sequential"},Rs=[{from:"templates",to:".specify/templates"},{from:"scripts/bash",to:".specify/scripts/bash"},{from:"commands",to:".claude/commands"},{from:"commands",to:".cursor/commands"}],Ts=[{from:"commands",to:".claude/commands"},{from:"commands",to:".cursor/commands"},{from:"templates",to:".specify/templates"}];function sr({appDir:e,vendorDir:t=Is,cogniteExtensionsDir:n=$s}){let r=N(e,".specify"),i=N(r,"memory"),s=`prepare spec-kit install for appDir=${e}`;try{for(let{from:p,to:c}of Rs){let l=N(e,c);s=`copy ${p} to ${c}`,wt(Le(l),{recursive:!0}),St(N(t,p),l,{recursive:!0})}for(let{from:p,to:c}of Ts){let l=N(e,c);s=`copy cognite extension ${p} to ${c}`,wt(Le(l),{recursive:!0}),St(N(n,p),l,{recursive:!0})}let a=N(r,"extensions.yml");xs(a)||(s="write .specify/extensions.yml",St(N(n,"extensions.yml"),a)),s=`write init-options.json under specifyDir=${r}`,As(N(r,"init-options.json"),`${JSON.stringify(Fs,null,2)}
50
- `),s=`link .specify/memory/constitution.md in specifyDir=${r}`,wt(i,{recursive:!0}),_e({target:Ds.join("..","..","AGENTS.md"),linkPath:N(i,"constitution.md"),label:".specify/memory/constitution.md"})}catch(a){let p=a instanceof Error?a.message:String(a);throw new Error(`installSpecKit failed while ${s} (appDir=${e}, vendorDir=${t}): ${p}`,{cause:a})}}o(sr,"installSpecKit");import{execFileSync as Ne}from"child_process";import{mkdtempSync as Os,readdirSync as Us,rmSync as _s}from"fs";import{createRequire as Ls}from"module";import{tmpdir as Ns}from"os";import{join as Ms,resolve as ar}from"path";import{InvalidArgumentError as Ks}from"commander";import Hs from"enquirer";var pr="cognitedata/builder-skills",vt=["claude-code","cursor","github-copilot","opencode","codex"],js=Ls(import.meta.url).resolve("skills/bin/cli.mjs");function Ct(e,t={}){try{Ne(process.execPath,[js,...e],{stdio:"inherit",cwd:process.cwd(),...t,env:{...process.env,...t.env,DISABLE_TELEMETRY:"1"}})}catch(n){throw new u(`Skills CLI failed (${e.join(" ")})`,{cause:n,hint:"Check your internet connection and that git is installed, then try again."})}}o(Ct,"execSkillsCli");function Vs(){return vt.map(e=>["add",pr,"-a",e,"--skill","*","-y"])}o(Vs,"pullAllArgsPerAgent");var Bs=1e4;async function cr(e,t={}){let n=t.exec??Ct,r=t.timeout??Bs,i=t.readdir??(p=>Us(p));for(let p of Vs())try{n(p,{cwd:e,timeout:r,stdio:["pipe","pipe","inherit"]})}catch(c){let l=c instanceof Error?c.message:String(c);console.warn("\u26A0\uFE0F Could not pull skills for args ["+p.join(" ")+"]:",l)}let s=new Set;for(let p of[ar(e,".claude","skills"),ar(e,".agents","skills")])try{i(p).forEach(c=>s.add(c))}catch{}let a=s.size;a>0?console.log(`Installed ${a} skills successfully.`):console.log("No skills were installed.")}o(cr,"pullAllSkillsInto");function Gs(e){if(!/^[\w.-]+\/[\w.-]+$/.test(e))throw new Ks("Expected owner/repo format (e.g., cognitedata/builder-skills)");return e}o(Gs,"validateSource");function qs(e){let t=Os(Ms(Ns(),"skills-"));try{try{Ne("git",["clone","--depth","1","--filter=blob:none","--no-checkout","-q",`https://github.com/${e}.git`,t],{stdio:"ignore"})}catch{throw new Error(`Failed to clone skills repository "${e}". Please check your internet connection and ensure git is installed.`)}let n;try{n=Ne("git",["ls-tree","-d","--name-only","HEAD:skills"],{cwd:t})}catch{n=Ne("git",["ls-tree","-d","--name-only","HEAD"],{cwd:t})}return n.toString().trim().split(/\r?\n/).filter(r=>!!r&&!r.startsWith("."))}finally{_s(t,{recursive:!0,force:!0})}}o(qs,"listRemoteSkills");async function Ys(e,t={}){let n=o(p=>Hs.prompt(p),"defaultPrompt"),{listSkills:r=qs,prompt:i=n}=t,s=r(e),{selected:a}=await i({type:"multiselect",name:"selected",message:"Select skills to install (space to toggle, a to toggle all, enter to confirm)",choices:s});return a}o(Ys,"pickSkillsInteractive");function Js(e,t,n){let r=["add",e.source,"-a",t];return e.skill?r.push("--skill",e.skill):n&&n.length>0?r.push("--skill",...n,"-y"):r.push("--skill","*","-y"),e.global&&r.push("--global"),r}o(Js,"buildPullArgs");async function zs(e){console.log(`Pulling skills from ${e.source}...`);let t;if(e.interactive&&!e.skill){try{t=await Ys(e.source)}catch(r){let i=r instanceof Error?r.message:String(r);console.error(`Failed to resolve skills interactively: ${i}`),process.exitCode=1;return}if(t.length===0){console.log("No skills selected.");return}}let n=!1;for(let r of vt)try{Ct(Js(e,r,t))}catch(i){let s=i instanceof Error?i.message:String(i);console.warn(`\u26A0\uFE0F Could not pull skills for ${r}: ${s}`),n=!0}n?(console.log(`
46
+ npx @cognite/cli apps activate . --interactive Activate using browser auth (no secrets needed)`).action((t,r)=>Is(r))}o(an,"registerActivateCommand");import{basename as Cn,dirname as la,normalize as da,resolve as Ve}from"path";import{fileURLToPath as ma,pathToFileURL as ua}from"url";import{Logger as ga,runner as fa}from"hygen";import{safeParse as $s}from"valibot";function Se(e,t){return r=>{let n=$s(t,r);return n.success?!0:`${e} ${n.issues[0].message}`}}o(Se,"toPromptValidator");var pn={name:Se("App name",lt),displayName:Se("Display name",ct),baseUrl:Se("Base URL",dt),org:Se("Org",mt),project:Se("Project",ut)};function Ts(e,t){return e?async r=>{let n=t(r);return n===!0?e(r):n}:t}o(Ts,"composeValidators");function Ke(e){return e.map(t=>{if(!(t.name in pn))return t;let r=pn[t.name];return{...t,validate:Ts(t.validate,r)}})}o(Ke,"applySchemaValidators");import{basename as cn}from"path";import ln from"enquirer";function kt(e){return e.replace(/[A-Z]/g,(t,r)=>r===0?t.toLowerCase():`-${t.toLowerCase()}`)}o(kt,"kebabCase");var Rs={type:"confirm",name:"useSpecKit",message:["Enable spec-driven development?"," Adds the github/spec-kit slash commands (/speckit.specify, .clarify, .plan, .tasks, .implement)"," to your app for use in Claude Code or Cursor. They walk you through writing SPEC.md and"," generating a plan, tasks, and implementation."].join(`
47
+ `),initial:!1};async function Fs(e,t,r){return e!==void 0?e:t?!!(await r([Rs])).useSpecKit:!1}o(Fs,"resolveSpecKit");function Os(e){return typeof e=="function"}o(Os,"isFunctionInitial");function dn(e){return(e??"").trim().replace(/\/+$/,"")||"api"}o(dn,"normalizeCluster");function mn({isCurrentDir:e,dirName:t,onAppName:r,onUseSpecKit:n,presets:i={},specKit:s,prompt:a=ln.prompt.bind(ln)}){return()=>({prompt:o(async p=>{if(!Array.isArray(p))return a([p]);let c=Object.fromEntries(Object.entries(i).filter(k=>k[1]!==void 0)),l=Object.keys(c).length>0,d=e?cn(process.cwd()):t?cn(t):null,m=l&&d!==null,y=!m&&d?p.map(k=>k.name==="name"?{...k,initial:d}:k):p,S=Ke(y),u=m&&d?{...c,name:d}:c,f=new Set(Object.keys(u)),w=S.filter(k=>!f.has(k.name)),E=w.findIndex(k=>k.name==="baseUrl"),h;if(m){let k=dn(u.cluster),G=o(A=>Os(A.initial)?A.initial():A.initial,"resolveInitial"),se=o(A=>{if(A.name==="baseUrl")return`https://${k}.cognitedata.com`;let Y=G(A);if(Y===void 0)throw new Error(`Non-interactive mode: --${kt(A.name)} has no default. Pass it as a flag.`);return Y},"deriveValue");h=Object.fromEntries(w.map(A=>[A.name,se(A)]))}else if(E!==-1){let k=w.filter(ee=>ee.name!=="baseUrl"),G=k.length>0?await a(k):{},se=typeof G.cluster=="string"?G.cluster:"",Y=`https://${dn(se||u.cluster)}.cognitedata.com`,ke=w[E],Q=await a([{...ke,initial:Y}]);h={...G,...Q}}else h=w.length>0?await a(w):{};let M={...u,...h},H=typeof M.name=="string"?M.name:"";H&&r(H);let U=await Fs(s,!m&&w.length>0,a);return n?.(U),{...M,name:H,useCurrentDir:e,directoryName:e?void 0:t??void 0,useSpecKit:U}},"prompt")})}o(mn,"createAppPrompter");async function un(e,t,r){let n=[];Object.values(t).some(s=>s!==void 0)&&r!==null&&n.push({key:"name",value:r,label:"directory"});for(let[s,a]of Object.entries(t))a!==void 0&&n.push({key:s,value:a,label:`--${kt(s)}`});for(let{key:s,value:a,label:p}of n){let c=e.find(d=>d.name===s)?.validate;if(!c)continue;let l=await c(a);if(l!==!0)throw new Error(`Invalid ${p}: ${l}`)}}o(un,"validatePresets");import{cpSync as bt,existsSync as Ms,mkdirSync as Pt,writeFileSync as Hs}from"fs";import{dirname as He,posix as js,resolve as K}from"path";import{fileURLToPath as fn}from"url";import{copyFileSync as Us,symlinkSync as _s}from"fs";import{dirname as Ls,join as Ns}from"path";function Ks(e){if(e&&typeof e=="object"&&"code"in e&&typeof e.code=="string")return e.code}o(Ks,"errno");function gn(e){return e instanceof Error?e.message:String(e)}o(gn,"messageOf");function Me({target:e,linkPath:t,label:r,symlink:n=_s,copyFile:i=Us}){try{return n(e,t),!0}catch(s){let a=Ks(s);if(a==="EEXIST")return!0;let p=gn(s);if(a==="EPERM"||a==="EACCES")try{let c=Ns(Ls(t),e);return i(c,t),console.log(`\u2139\uFE0F Wrote ${r} as a copy of ${e} (symlinks need Developer Mode or an elevated shell on Windows).`),!0}catch(c){return console.warn(`\u26A0\uFE0F Could not create ${r} symlink: ${p} (copy fallback also failed: ${gn(c)})`),!1}return console.warn(`\u26A0\uFE0F Could not create ${r} symlink:`,p),!1}}o(Me,"linkOrCopyOrWarn");var Vs=K(He(fn(import.meta.url)),"..","..","_vendor","spec-kit"),Bs=K(He(fn(import.meta.url)),"..","..","_cognite-spec-extensions"),Gs={branch_numbering:"sequential"},Ys=[{from:"templates",to:".specify/templates"},{from:"scripts/bash",to:".specify/scripts/bash"},{from:"commands",to:".claude/commands"},{from:"commands",to:".cursor/commands"}],qs=[{from:"commands",to:".claude/commands"},{from:"commands",to:".cursor/commands"},{from:"templates",to:".specify/templates"}];function yn({appDir:e,vendorDir:t=Vs,cogniteExtensionsDir:r=Bs}){let n=K(e,".specify"),i=K(n,"memory"),s=`prepare spec-kit install for appDir=${e}`;try{for(let{from:p,to:c}of Ys){let l=K(e,c);s=`copy ${p} to ${c}`,Pt(He(l),{recursive:!0}),bt(K(t,p),l,{recursive:!0})}for(let{from:p,to:c}of qs){let l=K(e,c);s=`copy cognite extension ${p} to ${c}`,Pt(He(l),{recursive:!0}),bt(K(r,p),l,{recursive:!0})}let a=K(n,"extensions.yml");Ms(a)||(s="write .specify/extensions.yml",bt(K(r,"extensions.yml"),a)),s=`write init-options.json under specifyDir=${n}`,Hs(K(n,"init-options.json"),`${JSON.stringify(Gs,null,2)}
48
+ `),s=`link .specify/memory/constitution.md in specifyDir=${n}`,Pt(i,{recursive:!0}),Me({target:js.join("..","..","AGENTS.md"),linkPath:K(i,"constitution.md"),label:".specify/memory/constitution.md"})}catch(a){let p=a instanceof Error?a.message:String(a);throw new Error(`installSpecKit failed while ${s} (appDir=${e}, vendorDir=${t}): ${p}`,{cause:a})}}o(yn,"installSpecKit");import{execFileSync as je}from"child_process";import{mkdtempSync as Js,readdirSync as zs,rmSync as Ws}from"fs";import{createRequire as Xs}from"module";import{tmpdir as Zs}from"os";import{join as Qs,resolve as hn}from"path";import{InvalidArgumentError as ea}from"commander";import ta from"enquirer";var Sn="cognitedata/builder-skills",xt=["claude-code","cursor","github-copilot","opencode","codex"],ra=Xs(import.meta.url).resolve("skills/bin/cli.mjs");function At(e,t={}){try{je(process.execPath,[ra,...e],{stdio:"inherit",cwd:process.cwd(),...t,env:{...process.env,...t.env,DISABLE_TELEMETRY:"1"}})}catch(r){throw new g(`Skills CLI failed (${e.join(" ")})`,{cause:r,hint:"Check your internet connection and that git is installed, then try again."})}}o(At,"execSkillsCli");function na(){return xt.map(e=>["add",Sn,"-a",e,"--skill","*","-y"])}o(na,"pullAllArgsPerAgent");var oa=1e4;async function wn(e,t={}){let r=t.exec??At,n=t.timeout??oa,i=t.readdir??(p=>zs(p));for(let p of na())try{r(p,{cwd:e,timeout:n,stdio:["pipe","pipe","inherit"]})}catch(c){let l=c instanceof Error?c.message:String(c);console.warn("\u26A0\uFE0F Could not pull skills for args ["+p.join(" ")+"]:",l)}let s=new Set;for(let p of[hn(e,".claude","skills"),hn(e,".agents","skills")])try{i(p).forEach(c=>s.add(c))}catch{}let a=s.size;a>0?console.log(`Installed ${a} skills successfully.`):console.log("No skills were installed.")}o(wn,"pullAllSkillsInto");function ia(e){if(!/^[\w.-]+\/[\w.-]+$/.test(e))throw new ea("Expected owner/repo format (e.g., cognitedata/builder-skills)");return e}o(ia,"validateSource");function sa(e){let t=Js(Qs(Zs(),"skills-"));try{try{je("git",["clone","--depth","1","--filter=blob:none","--no-checkout","-q",`https://github.com/${e}.git`,t],{stdio:"ignore"})}catch{throw new Error(`Failed to clone skills repository "${e}". Please check your internet connection and ensure git is installed.`)}let r;try{r=je("git",["ls-tree","-d","--name-only","HEAD:skills"],{cwd:t})}catch{r=je("git",["ls-tree","-d","--name-only","HEAD"],{cwd:t})}return r.toString().trim().split(/\r?\n/).filter(n=>!!n&&!n.startsWith("."))}finally{Ws(t,{recursive:!0,force:!0})}}o(sa,"listRemoteSkills");async function aa(e,t={}){let r=o(p=>ta.prompt(p),"defaultPrompt"),{listSkills:n=sa,prompt:i=r}=t,s=n(e),{selected:a}=await i({type:"multiselect",name:"selected",message:"Select skills to install (space to toggle, a to toggle all, enter to confirm)",choices:s});return a}o(aa,"pickSkillsInteractive");function pa(e,t,r){let n=["add",e.source,"-a",t];return e.skill?n.push("--skill",e.skill):r&&r.length>0?n.push("--skill",...r,"-y"):n.push("--skill","*","-y"),e.global&&n.push("--global"),n}o(pa,"buildPullArgs");async function ca(e){console.log(`Pulling skills from ${e.source}...`);let t;if(e.interactive&&!e.skill){try{t=await aa(e.source)}catch(n){let i=n instanceof Error?n.message:String(n);console.error(`Failed to resolve skills interactively: ${i}`),process.exitCode=1;return}if(t.length===0){console.log("No skills selected.");return}}let r=!1;for(let n of xt)try{At(pa(e,n,t))}catch(i){let s=i instanceof Error?i.message:String(i);console.warn(`\u26A0\uFE0F Could not pull skills for ${n}: ${s}`),r=!0}r?(console.log(`
51
49
  Skills pulled with some errors (see warnings above)`),process.exitCode=1):console.log(`
52
- Skills pulled successfully`)}o(zs,"handlePull");function lr(e){let t=e.command("skills").summary("Manage AI agent skills for your app").description(`Manage AI agent skills for your app.
53
- Supports: ${vt.join(", ")}`).addHelpText("after",`
50
+ Skills pulled successfully`)}o(ca,"handlePull");function vn(e){let t=e.command("skills").summary("Manage AI agent skills for your app").description(`Manage AI agent skills for your app.
51
+ Supports: ${xt.join(", ")}`).addHelpText("after",`
54
52
  Examples:
55
53
  npx @cognite/cli apps skills pull Pull all skills
56
54
  npx @cognite/cli apps skills pull --skill create-client-tool Pull a specific skill
57
- npx @cognite/cli apps skills list List installed skills`);return t.command("pull").description("Pull all skills into your project").option("--source <owner/repo>","Skills repository",Gs,pr).option("--skill <name>","Pull a specific skill by name").option("-i, --interactive","Interactively select which skills to install",!1).option("--global","Install skills globally",!1).action(zs),t.command("list").description("List installed skills").action(()=>{Ct(["list"])}),t}o(lr,"registerSkillsCommand");var mr=Me(Ws(Zs(import.meta.url)),"..","..","_templates");async function na(){let e=Me(mr,"app","new","prompt.js");return(await import(Qs(e).href)).default}o(na,"loadPromptDefs");function ra(e,t){return!e||t?null:Xs(e)}o(ra,"resolveDirName");function oa(e,t,n){if(e)return{cwd:process.cwd(),display:"."};let r=t??n;if(!r)throw new Error("App creation completed without a target directory or name.");return{cwd:Me(process.cwd(),r),display:r}}o(oa,"resolveAppLocation");function ia(e,t,n){let r=` npm install
58
- npm run dev`,i="To deploy your app:",s="npx @cognite/cli apps deploy --interactive",a=n?`
55
+ npx @cognite/cli apps skills list List installed skills`);return t.command("pull").description("Pull all skills into your project").option("--source <owner/repo>","Skills repository",ia,Sn).option("--skill <name>","Pull a specific skill by name").option("-i, --interactive","Interactively select which skills to install",!1).option("--global","Install skills globally",!1).action(ca),t.command("list").description("List installed skills").action(()=>{At(["list"])}),t}o(vn,"registerSkillsCommand");var En=Ve(la(ma(import.meta.url)),"..","..","_templates");async function ya(){let e=Ve(En,"app","new","prompt.js");return(await import(ua(e).href)).default}o(ya,"loadPromptDefs");function ha(e,t){return!e||t?null:da(e)}o(ha,"resolveDirName");function Sa(e,t,r){if(e)return{cwd:process.cwd(),display:"."};let n=t??r;if(!n)throw new Error("App creation completed without a target directory or name.");return{cwd:Ve(process.cwd(),n),display:n}}o(Sa,"resolveAppLocation");function wa(e,t,r){let n=` npm install
56
+ npm run dev`,i="To deploy your app:",s="npx @cognite/cli apps deploy --interactive",a=r?`
59
57
  To start spec-driven development:
60
58
  Run /speckit.specify in Claude Code or Cursor and describe your app.
61
59
  `:"",p=` # Or fully non-interactive (deploys first target from app.json):
@@ -63,7 +61,7 @@ To start spec-driven development:
63
61
  \u2705 App created successfully in current directory!
64
62
 
65
63
  Next steps:
66
- ${r}
64
+ ${n}
67
65
  ${a}
68
66
  ${i}
69
67
  ${s}
@@ -75,13 +73,13 @@ To open in Cursor:
75
73
  cursor "${t}"
76
74
  Or:
77
75
  cd "${t}"
78
- ${r}
76
+ ${n}
79
77
  ${a}
80
78
  ${i}
81
79
  cd "${t}"
82
80
  ${s}
83
81
  ${p}
84
- `)}o(ia,"printSuccessMessage");async function sa(e){try{console.log("\u{1F9E0} Pulling skills into your app..."),await cr(e)}catch(t){let n=t instanceof Error?t.message:String(t);console.warn("\u26A0\uFE0F Could not pull skills:",n)}}o(sa,"pullSkillsInto");function aa(e,t={}){let{isGitInstalled:n=Ce,isInsideGitRepo:r=Ee,gitInitAndCommit:i=zt}=t;if(!n()){console.warn("git not found \u2014 skipping git repository initialisation");return}if(!r(e)){console.log("Initialising git repository...");try{i(e)}catch(s){let p=(s&&typeof s=="object"&&"stderr"in s&&s.stderr?String(s.stderr).trim():"")||(s instanceof Error?s.message:String(s));console.warn("Could not initialise git repository:",p)}}}o(aa,"maybeInitGit");async function pa(e,t){let n=e==="."||e==="./",r=ra(e,n),i=null,s=!1,a={displayName:t.displayName,description:t.description,org:t.org,project:t.project,cluster:t.cluster,baseUrl:t.baseUrl},p=await na(),c=Ue(p),l=n?dr(process.cwd()):r?dr(r):null;await rr(c,a,l);let d=nr({isCurrentDir:n,dirName:r,onAppName:o(y=>{i=y},"onAppName"),onUseSpecKit:o(y=>{s=y},"onUseSpecKit"),presets:a,specKit:t.specKit});await ta(["app","new"],{templates:mr,cwd:process.cwd(),logger:new ea(console.log.bind(console)),createPrompter:d,debug:!!process.env.DEBUG});let m=oa(n,r,i);_e({target:"AGENTS.md",linkPath:Me(m.cwd,"CLAUDE.md"),label:"CLAUDE.md"}),s&&sr({appDir:m.cwd}),await sa(m.cwd),aa(m.cwd),ia(n,m.display,s)}o(pa,"handleCreate");function ur(e){return e.command("create").description("Create a new application.").argument("[directory]","Target directory (. for current, or subdirectory name)").option("--display-name <name>","App display name (skips the prompt)").option("--description <description>","App description (skips the prompt)").option("--org <org>","Deployment org (skips the prompt)").option("--project <project>","Deployment project (skips the prompt)").option("--cluster <cluster>","CDF cluster, e.g. greenfield (skips the prompt)").option("--base-url <url>","CDF base URL, e.g. https://greenfield.cognitedata.com (skips the prompt; defaults to cluster-derived URL when omitted)").option("--spec-kit","Install spec-kit slash commands (skips the prompt)").option("--no-spec-kit","Skip spec-kit installation (skips the prompt)").addHelpText("after",`
82
+ `)}o(wa,"printSuccessMessage");async function va(e){try{console.log("\u{1F9E0} Pulling skills into your app..."),await wn(e)}catch(t){let r=t instanceof Error?t.message:String(t);console.warn("\u26A0\uFE0F Could not pull skills:",r)}}o(va,"pullSkillsInto");function Ca(e,t={}){let{isGitInstalled:r=be,isInsideGitRepo:n=Pe,gitInitAndCommit:i=sr}=t;if(!r()){console.warn("git not found \u2014 skipping git repository initialisation");return}if(!n(e)){console.log("Initialising git repository...");try{i(e)}catch(s){let p=(s&&typeof s=="object"&&"stderr"in s&&s.stderr?String(s.stderr).trim():"")||(s instanceof Error?s.message:String(s));console.warn("Could not initialise git repository:",p)}}}o(Ca,"maybeInitGit");async function Ea(e,t){let r=e==="."||e==="./",n=ha(e,r),i=null,s=!1,a={displayName:t.displayName,description:t.description,org:t.org,project:t.project,cluster:t.cluster,baseUrl:t.baseUrl},p=await ya(),c=Ke(p),l=r?Cn(process.cwd()):n?Cn(n):null;await un(c,a,l);let d=mn({isCurrentDir:r,dirName:n,onAppName:o(y=>{i=y},"onAppName"),onUseSpecKit:o(y=>{s=y},"onUseSpecKit"),presets:a,specKit:t.specKit});await fa(["app","new"],{templates:En,cwd:process.cwd(),logger:new ga(console.log.bind(console)),createPrompter:d,debug:!!process.env.DEBUG});let m=Sa(r,n,i);Me({target:"AGENTS.md",linkPath:Ve(m.cwd,"CLAUDE.md"),label:"CLAUDE.md"}),s&&yn({appDir:m.cwd}),await va(m.cwd),Ca(m.cwd),wa(r,m.display,s)}o(Ea,"handleCreate");function kn(e){return e.command("create").description("Create a new application.").argument("[directory]","Target directory (. for current, or subdirectory name)").option("--display-name <name>","App display name (skips the prompt)").option("--description <description>","App description (skips the prompt)").option("--org <org>","Deployment org (skips the prompt)").option("--project <project>","Deployment project (skips the prompt)").option("--cluster <cluster>","CDF cluster, e.g. greenfield (skips the prompt)").option("--base-url <url>","CDF base URL, e.g. https://greenfield.cognitedata.com (skips the prompt; defaults to cluster-derived URL when omitted)").option("--spec-kit","Install spec-kit slash commands (skips the prompt)").option("--no-spec-kit","Skip spec-kit installation (skips the prompt)").addHelpText("after",`
85
83
  Non-interactive use (CI, scripts, AI agents):
86
84
  Pass [directory] plus --display-name, --description, --org, --project, --cluster, --base-url
87
85
  to skip every prompt. Missing flags fall back to the interactive prompt.
@@ -94,22 +92,22 @@ Examples:
94
92
  --display-name "My App" --description "My app" \\
95
93
  --org cog-atlas --project atlas-greenfield --cluster greenfield \\
96
94
  --base-url https://greenfield.cognitedata.com
97
- Fully non-interactive`).action(pa)}o(ur,"registerCreateCommand");import ca from"path";async function la(e,t,n){let r=await A(e,{interactive:t.interactive,appId:n,orgHint:t.org});return new E(r)}o(la,"defaultGetApiClient");async function da(e,t,n={}){let{loadEnvFile:r=$,loadAppConfig:i=v,getApiClient:s=la}=n,a=ca.resolve(process.cwd(),e);r(a);let p=i(a);F(p);let c=t.interactive?await I(p,t):b(p.deployments,t.deployment);if(!t.interactive){let y=D(c);if(y.length>0)throw new Error(`Deployment ${c.org}/${c.project} is missing ${y.join(" and ")} in app.json. Use \`npx @cognite/cli@latest apps deactivate --interactive\` for browser-based authentication instead.`)}let{externalId:l}=p,d=await s(c,t,l),m=await d.getActiveVersion(l);if(!m){console.log(` ${l} has no active version \u2014 nothing to deactivate.`);return}await d.deactivateVersion(l,m.version),console.log(`\u2713 Deactivated ${l} @ ${m.version} \u2014 active alias removed`)}o(da,"handleDeactivate");function gr(e){return e.command("deactivate").description("Deactivate the app by removing its active version from service").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
95
+ Fully non-interactive`).action(Ea)}o(kn,"registerCreateCommand");import ka from"path";async function ba(e,t,r){let n=await I(e,{interactive:t.interactive,appId:r,orgHint:t.org});return new b(n)}o(ba,"defaultGetApiClient");async function Pa(e,t,r={}){let{loadEnvFile:n=R,loadAppConfig:i=C,getApiClient:s=ba}=r,a=ka.resolve(process.cwd(),e);n(a);let p=i(a);F(p);let c=t.interactive?await T(p,t):x(p.deployments,t.deployment);if(!t.interactive){let y=$(c);if(y.length>0)throw new Error(`Deployment ${c.org}/${c.project} is missing ${y.join(" and ")} in app.json. Use \`npx @cognite/cli@latest apps deactivate --interactive\` for browser-based authentication instead.`)}let{externalId:l}=p,d=await s(c,t,l),m=await d.getActiveVersion(l);if(!m){console.log(` ${l} has no active version \u2014 nothing to deactivate.`);return}await d.deactivateVersion(l,m.version),console.log(`\u2713 Deactivated ${l} @ ${m.version} \u2014 active alias removed`)}o(Pa,"handleDeactivate");function bn(e){return e.command("deactivate").description("Deactivate the app by removing its active version from service").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
98
96
  Examples:
99
97
  npx @cognite/cli apps deactivate . Deactivate using env-var auth
100
- npx @cognite/cli apps deactivate . --interactive Deactivate using browser auth (no secrets needed)`).action((t,n)=>da(t,n))}o(gr,"registerDeactivateCommand");import{mkdir as ha,readFile as Sa}from"fs/promises";import{basename as wa,dirname as va}from"path";import{execFileSync as Ke}from"child_process";import Y from"fs";import R from"path";import{parseAndValidateManifestConfig as ma}from"@cognite/app-sdk/vite";import{BlobReader as ua,Uint8ArrayWriter as ga,ZipWriter as fa}from"@zip.js/zip.js";var Et="package.json",kt="package-lock.json",fr="manifest.json",bt=".cognite",ya=[/^\.env(\..+)?$/i,/^\.secrets?$/i,/^\.token/i,/^\.cognite/i,/\.(key|pem|p12|pfx|jks|crt)$/i],Pt=class Pt{constructor(t="dist"){this.distPath=R.isAbsolute(t)?t:R.join(process.cwd(),t),this.appRoot=R.dirname(this.distPath)}validateBuildDirectory(){if(!Y.existsSync(this.distPath))throw new Error(`Build directory "${this.distPath}" not found. Run build first.`);let t=R.join(this.appRoot,Et);if(!Y.existsSync(t))throw new Error(`"${t}" not found. It is required for deployment.`);let n=R.join(this.appRoot,kt);if(!Y.existsSync(n))throw new Error(`"${n}" not found. It is required for deployment.`)}async createZip(t="app.zip",n=!1){this.validateBuildDirectory(),console.log("\u{1F4E6} Packaging application...");let r=new fa(new ga,{level:9}),i=o(async(c,l)=>{await r.add(l,new ua(await Y.openAsBlob(c))),n&&console.log(` \u{1F4C4} ${l}`)},"addFile"),s=o(async c=>{let l=await Y.promises.readdir(c,{withFileTypes:!0});for(let d of l){let m=R.join(c,d.name);d.isDirectory()?await s(m):await i(m,R.relative(this.distPath,m).replace(/\\/g,"/"))}},"addDir"),a;try{await s(this.distPath);let c=R.join(this.appRoot,Et);await i(c,R.posix.join(bt,Et));let l=R.join(this.appRoot,fr);if(Y.existsSync(l)){let m=Y.readFileSync(l,"utf-8");ma(m,l),await i(l,R.posix.join(bt,fr))}let d=R.join(this.appRoot,kt);await i(d,R.posix.join(bt,kt)),a=await r.close()}catch(c){let l=c instanceof Error?c.message:String(c);throw new Error(`Failed to create zip: ${l}`)}try{await Y.promises.writeFile(t,a)}catch(c){throw new u(`Failed to write bundle to ${t}`,{cause:c})}let p=(a.byteLength/1024/1024).toFixed(2);return console.log(`\u2705 App packaged: ${t} (${p} MB)`),t}async createSourceArchive(t){console.log("\u{1F4E6} Packaging source for review...");let n;try{n=Ke("git",["-C",this.appRoot,"rev-parse","--show-toplevel"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim()}catch(c){throw c instanceof Error&&"code"in c&&c.code==="ENOENT"?new Error("git not found. Install git and ensure it is in your PATH."):new Error("Source packaging requires a git repository. Run `git init` first.")}let r=Ke("git",["-C",this.appRoot,"rev-parse","--show-prefix"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim(),i=r?r.replace(/\/$/,""):".",s=i==="."?"HEAD":`HEAD:${i}`;this.validateNoSensitiveFiles(n,s);try{Ke("git",["-C",n,"archive","--format=zip",`--output=${t}`,s])}catch(c){let l=c instanceof Error?c.message:String(c);throw new Error(`Failed to create source archive: ${l}`)}let p=(Y.statSync(t).size/1024/1024).toFixed(2);return console.log(`\u2705 Source packaged: ${R.basename(t)} (${p} MB)`),t}validateNoSensitiveFiles(t,n){let r=Ke("git",["-C",t,"ls-tree","-r","--name-only",n],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().split(`
101
- `).filter(Boolean),i=o(a=>a.split("/").some(p=>ya.some(c=>c.test(p))),"isSensitive"),s=r.filter(i);if(s.length>0)throw new Error(`Source archive would include sensitive files \u2014 remove them from git tracking first:
98
+ npx @cognite/cli apps deactivate . --interactive Deactivate using browser auth (no secrets needed)`).action((t,r)=>Pa(t,r))}o(bn,"registerDeactivateCommand");import{mkdir as Ta,readFile as Ra}from"fs/promises";import{basename as Fa,dirname as Oa}from"path";import{execFileSync as Be}from"child_process";import W from"fs";import O from"path";import{parseAndValidateManifestConfig as xa}from"@cognite/app-sdk/vite";import{BlobReader as Aa,Uint8ArrayWriter as Da,ZipWriter as Ia}from"@zip.js/zip.js";var Dt="package.json",It="package-lock.json",Pn="manifest.json",$t=".cognite",$a=[/^\.env(\..+)?$/i,/^\.secrets?$/i,/^\.token/i,/^\.cognite/i,/\.(key|pem|p12|pfx|jks|crt)$/i],Tt=class Tt{constructor(t="dist"){this.distPath=O.isAbsolute(t)?t:O.join(process.cwd(),t),this.appRoot=O.dirname(this.distPath)}validateBuildDirectory(){if(!W.existsSync(this.distPath))throw new Error(`Build directory "${this.distPath}" not found. Run build first.`);let t=O.join(this.appRoot,Dt);if(!W.existsSync(t))throw new Error(`"${t}" not found. It is required for deployment.`);let r=O.join(this.appRoot,It);if(!W.existsSync(r))throw new Error(`"${r}" not found. It is required for deployment.`)}async createZip(t="app.zip",r=!1){this.validateBuildDirectory(),console.log("\u{1F4E6} Packaging application...");let n=new Ia(new Da,{level:9}),i=o(async(c,l)=>{await n.add(l,new Aa(await W.openAsBlob(c))),r&&console.log(` \u{1F4C4} ${l}`)},"addFile"),s=o(async c=>{let l=await W.promises.readdir(c,{withFileTypes:!0});for(let d of l){let m=O.join(c,d.name);d.isDirectory()?await s(m):await i(m,O.relative(this.distPath,m).replace(/\\/g,"/"))}},"addDir"),a;try{await s(this.distPath);let c=O.join(this.appRoot,Dt);await i(c,O.posix.join($t,Dt));let l=O.join(this.appRoot,Pn);if(W.existsSync(l)){let m=W.readFileSync(l,"utf-8");xa(m,l),await i(l,O.posix.join($t,Pn))}let d=O.join(this.appRoot,It);await i(d,O.posix.join($t,It)),a=await n.close()}catch(c){let l=c instanceof Error?c.message:String(c);throw new Error(`Failed to create zip: ${l}`)}try{await W.promises.writeFile(t,a)}catch(c){throw new g(`Failed to write bundle to ${t}`,{cause:c})}let p=(a.byteLength/1024/1024).toFixed(2);return console.log(`\u2705 App packaged: ${t} (${p} MB)`),t}async createSourceArchive(t){console.log("\u{1F4E6} Packaging source for review...");let r;try{r=Be("git",["-C",this.appRoot,"rev-parse","--show-toplevel"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim()}catch(c){throw c instanceof Error&&"code"in c&&c.code==="ENOENT"?new Error("git not found. Install git and ensure it is in your PATH."):new Error("Source packaging requires a git repository. Run `git init` first.")}let n=Be("git",["-C",this.appRoot,"rev-parse","--show-prefix"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim(),i=n?n.replace(/\/$/,""):".",s=i==="."?"HEAD":`HEAD:${i}`;this.validateNoSensitiveFiles(r,s);try{Be("git",["-C",r,"archive","--format=zip",`--output=${t}`,s])}catch(c){let l=c instanceof Error?c.message:String(c);throw new Error(`Failed to create source archive: ${l}`)}let p=(W.statSync(t).size/1024/1024).toFixed(2);return console.log(`\u2705 Source packaged: ${O.basename(t)} (${p} MB)`),t}validateNoSensitiveFiles(t,r){let n=Be("git",["-C",t,"ls-tree","-r","--name-only",r],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().split(`
99
+ `).filter(Boolean),i=o(a=>a.split("/").some(p=>$a.some(c=>c.test(p))),"isSensitive"),s=n.filter(i);if(s.length>0)throw new Error(`Source archive would include sensitive files \u2014 remove them from git tracking first:
102
100
  `+s.map(a=>` ${a}`).join(`
103
101
  `)+`
104
- Hint: git rm --cached <file>`)}};o(Pt,"ApplicationPackager");var re=Pt;async function He(e,t,n,r){let{externalId:i,name:s,description:a,versionTag:p}=t,c=B(n,i,p);await ha(va(c),{recursive:!0}),await new re(`${n}/dist`).createZip(c,!0);let l;try{l=await Sa(c)}catch(d){throw new u(`Failed to read bundle file: ${c}`,{cause:d})}await new E(e).deploy(i,s,a,p,l,wa(c),r)}o(He,"packageAndUpload");var xt=o(async(e,t,n)=>{let r=await ge(e,n);await He(r,t,n,e.published)},"deploy");import{existsSync as Ca,readFileSync as Ea}from"fs";var yr=[".dev.sig",".cert.sig"];function he(e,t={}){let n=t.existsSync??Ca,r=t.readFileSync??((s,a)=>Ea(s,a)),i=[];for(let s of yr){let a=`${e}${s}`;if(!n(a))continue;let p=r(a,"utf8").trim();p.length>0&&i.push(p)}return i}o(he,"discoverSignatures");import{execSync as ka}from"child_process";function At(e,t=!0,n={execSync:ka}){console.log("\u{1F4E6} Building app with npm...");try{n.execSync("npm run build",{cwd:e,stdio:t?"inherit":"pipe"})}catch(r){throw new u(`npm run build failed in ${e}`,{cause:r,hint:"Check the build output above for errors."})}console.log("\u2705 Build successful")}o(At,"buildApp");function hr(e,t){let{org:n,project:r,baseUrl:i}=e,s;try{s=new URL(i).hostname}catch{return null}let{externalId:a,versionTag:p}=t,c=new URLSearchParams({cluster:s,customAppVersion:p,workspace:"industrial-tools"});return`https://${n}.fusion.cognite.com/${r}/flows-apps/app/${encodeURIComponent(a)}?${c}`}o(hr,"generateFusionUrl");function Sr(e,t,n){let r=n?"\u{1F680} Deploy (Interactive)":"\u{1F680} Deploy",i=n?`${t.project} @ ${t.baseUrl}`:`${t.org}/${t.project}`;console.log(["",r,"=".repeat(r.length),`App: ${e.name} (${e.externalId})`,`Version: ${e.versionTag}`,`Target: ${i}`,""].join(`
105
- `))}o(Sr,"printDeployInfo");function wr(e,t){console.log(`
106
- \u2705 Successfully deployed ${e.name} version ${e.versionTag} to ${t.org?`${t.org}/`:""}${t.project}`),console.log("\u{1F512} App is deployed in draft mode");let n=e.deployments.length>1?` -d ${t.project}`:"";console.log(`
107
- To sign: npx @cognite/cli apps sign --interactive${n}`),console.log(`To publish: npx @cognite/cli apps publish .${n}`),console.log(`To activate: npx @cognite/cli apps activate .${n}`),console.log(`
108
- To submit for certification: npx @cognite/cli apps submit`);let r=hr(t,e);r&&console.log(`
102
+ Hint: git rm --cached <file>`)}};o(Tt,"ApplicationPackager");var ie=Tt;async function Ge(e,t,r,n){let{externalId:i,name:s,description:a,versionTag:p}=t,c=q(r,i,p);await Ta(Oa(c),{recursive:!0}),await new ie(`${r}/dist`).createZip(c,!0);let l;try{l=await Ra(c)}catch(d){throw new g(`Failed to read bundle file: ${c}`,{cause:d})}await new b(e).deploy(i,s,a,p,l,Fa(c),n)}o(Ge,"packageAndUpload");var Rt=o(async(e,t,r)=>{let n=await ye(e,r);await Ge(n,t,r,e.published)},"deploy");import{existsSync as Ua,readFileSync as _a}from"fs";var xn=[".dev.sig",".cert.sig"];function we(e,t={}){let r=t.existsSync??Ua,n=t.readFileSync??((s,a)=>_a(s,a)),i=[];for(let s of xn){let a=`${e}${s}`;if(!r(a))continue;let p=n(a,"utf8").trim();p.length>0&&i.push(p)}return i}o(we,"discoverSignatures");import{execSync as La}from"child_process";function Ft(e,t=!0,r={execSync:La}){console.log("\u{1F4E6} Building app with npm...");try{r.execSync("npm run build",{cwd:e,stdio:t?"inherit":"pipe"})}catch(n){throw new g(`npm run build failed in ${e}`,{cause:n,hint:"Check the build output above for errors."})}console.log("\u2705 Build successful")}o(Ft,"buildApp");function An(e,t){let{org:r,project:n,baseUrl:i}=e,s;try{s=new URL(i).hostname}catch{return null}let{externalId:a,versionTag:p}=t,c=new URLSearchParams({cluster:s,customAppVersion:p,workspace:"industrial-tools"});return`https://${r}.fusion.cognite.com/${n}/flows-apps/app/${encodeURIComponent(a)}?${c}`}o(An,"generateFusionUrl");function Dn(e,t,r){let n=r?"\u{1F680} Deploy (Interactive)":"\u{1F680} Deploy",i=r?`${t.project} @ ${t.baseUrl}`:`${t.org}/${t.project}`;console.log(["",n,"=".repeat(n.length),`App: ${e.name} (${e.externalId})`,`Version: ${e.versionTag}`,`Target: ${i}`,""].join(`
103
+ `))}o(Dn,"printDeployInfo");function In(e,t){console.log(`
104
+ \u2705 Successfully deployed ${e.name} version ${e.versionTag} to ${t.org?`${t.org}/`:""}${t.project}`),console.log("\u{1F512} App is deployed in draft mode");let r=e.deployments.length>1?` -d ${t.project}`:"";console.log(`
105
+ To sign: npx @cognite/cli apps sign --interactive${r}`),console.log(`To publish: npx @cognite/cli apps publish .${r}`),console.log(`To activate: npx @cognite/cli apps activate .${r}`),console.log(`
106
+ To submit for certification: npx @cognite/cli apps submit`);let n=An(t,e);n&&console.log(`
109
107
  \u{1F517} Open your app:
110
- ${r}`)}o(wr,"printDeployResult");async function ba(e,t,n,r,i){let s=D(t);if(s.length>0)throw new Error(`Deployment ${t.org}/${t.project} is missing ${s.join(" and ")} in app.json. Use \`cognite apps deploy --interactive\` for browser-based authentication instead.`);Sr(e,t,!1),r.skipBuild||At(n),console.log(`
111
- \u{1F4E4} Deploying to ${t.org}/${t.project}...`),await i({...t,published:!1},{externalId:e.externalId,name:e.name,description:e.description,versionTag:e.versionTag},n),wr(e,t)}o(ba,"handleDeployNonInteractive");async function Pa(e,t,n,r){Sr(e,t,!0),r.skipBuild||At(n);let i=await A(t,{interactive:!0,appId:e.externalId,orgHint:r.org});console.log(`
112
- \u{1F4E4} Deploying to ${t.project}...`),await He(i,{externalId:e.externalId,name:e.name,description:e.description,versionTag:e.versionTag},n,!1),wr(e,t)}o(Pa,"handleDeployInteractive");async function xa(e,t=process.cwd(),n={}){let{loadEnvFile:r=$,loadAppConfig:i=v,deploy:s=xt}=n;r(t);let a=i(t);if(F(a),e.interactive){let c=await I(a,e);await Pa(a,c,t,e);return}let p=b(a.deployments,e.deployment);await ba(a,p,t,e,s)}o(xa,"handleDeploy");function vr(e){return e.command("deploy").description("Deploy your app to Cognite Data Fusion. Use --interactive for browser-based login (no env-var secrets required).").option("-d, --deployment <target>","Deployment target (index or project name)").option("--skip-build","Skip the build step",!1).option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
108
+ ${n}`)}o(In,"printDeployResult");async function Na(e,t,r,n,i){let s=$(t);if(s.length>0)throw new Error(`Deployment ${t.org}/${t.project} is missing ${s.join(" and ")} in app.json. Use \`cognite apps deploy --interactive\` for browser-based authentication instead.`);Dn(e,t,!1),n.skipBuild||Ft(r),console.log(`
109
+ \u{1F4E4} Deploying to ${t.org}/${t.project}...`),await i({...t,published:!1},{externalId:e.externalId,name:e.name,description:e.description,versionTag:e.versionTag},r),In(e,t)}o(Na,"handleDeployNonInteractive");async function Ka(e,t,r,n){Dn(e,t,!0),n.skipBuild||Ft(r);let i=await I(t,{interactive:!0,appId:e.externalId,orgHint:n.org});console.log(`
110
+ \u{1F4E4} Deploying to ${t.project}...`),await Ge(i,{externalId:e.externalId,name:e.name,description:e.description,versionTag:e.versionTag},r,!1),In(e,t)}o(Ka,"handleDeployInteractive");async function Ma(e,t=process.cwd(),r={}){let{loadEnvFile:n=R,loadAppConfig:i=C,deploy:s=Rt}=r;n(t);let a=i(t);if(F(a),e.interactive){let c=await T(a,e);await Ka(a,c,t,e);return}let p=x(a.deployments,e.deployment);await Na(a,p,t,e,s)}o(Ma,"handleDeploy");function $n(e){return e.command("deploy").description("Deploy your app to Cognite Data Fusion. Use --interactive for browser-based login (no env-var secrets required).").option("-d, --deployment <target>","Deployment target (index or project name)").option("--skip-build","Skip the build step",!1).option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
113
111
  Environment (non-interactive):
114
112
  deployClientId and deploySecretName are configured per deployment in app.json.
115
113
  deploySecretName is the name of the environment variable that holds the client
@@ -123,76 +121,76 @@ Examples:
123
121
  npx @cognite/cli apps deploy -d my-project Deploy to project by name
124
122
  npx @cognite/cli apps deploy --skip-build Deploy without rebuilding
125
123
  npx @cognite/cli apps deploy --interactive Browser auth, prompts for target
126
- npx @cognite/cli apps deploy --interactive -d 0 Browser auth, target chosen non-interactively`).action(t=>xa(t))}o(vr,"registerDeployCommand");function Aa(e,t){console.log(""),console.log(`Updating metadata for '${e}':`);for(let{field:n,remote:r,local:i}of t){let s=`${n}:`.padEnd(13);console.log(` ${s}"${r}" \u2192 "${i||"(none)"}"`)}}o(Aa,"printMetadataDiff");async function Da(e,t=process.cwd(),n={}){let{loadEnvFile:r=$,loadAppConfig:i=v,getClientForDeployment:s=A,createMetadataClient:a=o(S=>new E(S),"createMetadataClient"),getMissingCredentials:p=D}=n;r(t);let c=i(t);F(c);let l=e.interactive?await I(c,e):b(c.deployments,e.deployment);if(!e.interactive){let S=p(l);if(S.length>0)throw new Error(`Deployment ${l.org}/${l.project} is missing ${S.join(" and ")} in app.json. Use \`cognite apps metadata update --interactive\` for browser-based authentication instead.`)}let d=await s(l,{interactive:e.interactive,appId:c.externalId,orgHint:e.org}),m=a(d),y;try{y=await m.getApp(c.externalId)}catch(S){throw S instanceof ce?new Error(`App '${c.externalId}' is not deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):S}let f={name:c.name,description:c.description||""},g=mt(y,f);if(g.length===0){console.log(""),console.log(`Metadata for '${c.externalId}' already matches the deployed app \u2014 nothing to update.`),console.log("Edit name/description in app.json to change them.");return}Aa(c.externalId,g),await m.updateAppMetadata(c.externalId,c.name,c.description),console.log(""),console.log(`\u2705 Metadata for '${c.externalId}' updated`)}o(Da,"handleUpdateMetadata");function Cr(e){let t=e.command("metadata").summary("Manage the deployed app's metadata").description("Manage the deployed app's metadata (name and description).");return t.command("update").description("Update the deployed app's name and description from app.json").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
124
+ npx @cognite/cli apps deploy --interactive -d 0 Browser auth, target chosen non-interactively`).action(t=>Ma(t))}o($n,"registerDeployCommand");function Ha(e,t){console.log(""),console.log(`Updating metadata for '${e}':`);for(let{field:r,remote:n,local:i}of t){let s=`${r}:`.padEnd(13);console.log(` ${s}"${n}" \u2192 "${i||"(none)"}"`)}}o(Ha,"printMetadataDiff");async function ja(e,t=process.cwd(),r={}){let{loadEnvFile:n=R,loadAppConfig:i=C,getClientForDeployment:s=I,createMetadataClient:a=o(f=>new b(f),"createMetadataClient"),getMissingCredentials:p=$}=r;n(t);let c=i(t);F(c);let l=e.interactive?await T(c,e):x(c.deployments,e.deployment);if(!e.interactive){let f=p(l);if(f.length>0)throw new Error(`Deployment ${l.org}/${l.project} is missing ${f.join(" and ")} in app.json. Use \`cognite apps metadata update --interactive\` for browser-based authentication instead.`)}let d=await s(l,{interactive:e.interactive,appId:c.externalId,orgHint:e.org}),m=a(d),y;try{y=await m.getApp(c.externalId)}catch(f){throw f instanceof de?new Error(`App '${c.externalId}' is not deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):f}let S={name:c.name,description:c.description||""},u=St(y,S);if(u.length===0){console.log(""),console.log(`Metadata for '${c.externalId}' already matches the deployed app \u2014 nothing to update.`),console.log("Edit name/description in app.json to change them.");return}Ha(c.externalId,u),await m.updateAppMetadata(c.externalId,c.name,c.description),console.log(""),console.log(`\u2705 Metadata for '${c.externalId}' updated`)}o(ja,"handleUpdateMetadata");function Tn(e){let t=e.command("metadata").summary("Manage the deployed app's metadata").description("Manage the deployed app's metadata (name and description).");return t.command("update").description("Update the deployed app's name and description from app.json").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
127
125
  Examples:
128
126
  npx @cognite/cli apps metadata update . Push name/description using env-var auth
129
- npx @cognite/cli apps metadata update . --interactive Push using browser auth (no secrets needed)`).action((n,r)=>Da(r)),t}o(Cr,"registerMetadataCommand");async function Ia(e,t,n){let r=await A(e,{interactive:t.interactive,appId:n.externalId,orgHint:t.org});return new E(r)}o(Ia,"defaultBuildApiClient");async function $a(e,t={}){let n=t.loadEnvFile??$,r=t.loadAppConfig??v,i=t.buildApiClient??Ia,s=t.discoverSignatures??he,a=process.cwd();n(a);let p=r(a);F(p);let c=e.interactive?await I(p,e):b(p.deployments,e.deployment);if(!e.interactive){let g=D(c);if(g.length>0)throw new Error(`Deployment ${c.org}/${c.project} is missing ${g.join(" and ")} in app.json. Use \`cognite apps publish --interactive\` for browser-based authentication instead.`)}let l=await i(c,e,p),{externalId:d,versionTag:m}=p,y;try{y=await l.getVersion(d,m)}catch(g){throw g instanceof H?new Error(`Version ${m} of ${d} has not been deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):g}if(y.alias==="ACTIVE"){console.log(` ${d} @ ${m} is already ACTIVE \u2014 nothing to do.`);return}if(y.lifecycleState==="PUBLISHED"){console.log(` ${d} @ ${m} is already PUBLISHED \u2014 nothing to do.`);return}if(y.lifecycleState==="DEPRECATED"||y.lifecycleState==="ARCHIVED")throw new Error(`Cannot publish ${d} @ ${m}: version is ${y.lifecycleState} (terminal).`);let f=s(B(a,d,m));f.length>0&&await l.submitSignatures(d,m,f),await l.publishVersion(d,m),console.log(`\u2713 Published ${d} @ ${m} is now PUBLISHED`),console.log(""),console.log("Run `npx @cognite/cli apps activate .` to make it active.")}o($a,"handlePublish");function Er(e){return e.command("publish").description("Publish the current app version (transition DRAFT \u2192 PUBLISHED)").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
127
+ npx @cognite/cli apps metadata update . --interactive Push using browser auth (no secrets needed)`).action((r,n)=>ja(n)),t}o(Tn,"registerMetadataCommand");async function Va(e,t,r){let n=await I(e,{interactive:t.interactive,appId:r.externalId,orgHint:t.org});return new b(n)}o(Va,"defaultBuildApiClient");async function Ba(e,t={}){let r=t.loadEnvFile??R,n=t.loadAppConfig??C,i=t.buildApiClient??Va,s=t.discoverSignatures??we,a=process.cwd();r(a);let p=n(a);F(p);let c=e.interactive?await T(p,e):x(p.deployments,e.deployment);if(!e.interactive){let u=$(c);if(u.length>0)throw new Error(`Deployment ${c.org}/${c.project} is missing ${u.join(" and ")} in app.json. Use \`cognite apps publish --interactive\` for browser-based authentication instead.`)}let l=await i(c,e,p),{externalId:d,versionTag:m}=p,y;try{y=await l.getVersion(d,m)}catch(u){throw u instanceof B?new Error(`Version ${m} of ${d} has not been deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):u}if(y.alias==="ACTIVE"){console.log(` ${d} @ ${m} is already ACTIVE \u2014 nothing to do.`);return}if(y.lifecycleState==="PUBLISHED"){console.log(` ${d} @ ${m} is already PUBLISHED \u2014 nothing to do.`);return}if(y.lifecycleState==="DEPRECATED"||y.lifecycleState==="ARCHIVED")throw new Error(`Cannot publish ${d} @ ${m}: version is ${y.lifecycleState} (terminal).`);let S=s(q(a,d,m));S.length>0&&await l.submitSignatures(d,m,S),await l.publishVersion(d,m),console.log(`\u2713 Published ${d} @ ${m} is now PUBLISHED`),console.log(""),console.log("Run `npx @cognite/cli apps activate .` to make it active.")}o(Ba,"handlePublish");function Rn(e){return e.command("publish").description("Publish the current app version (transition DRAFT \u2192 PUBLISHED)").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
130
128
  Examples:
131
129
  npx @cognite/cli apps publish . Publish using env-var auth
132
- npx @cognite/cli apps publish . --interactive Publish using browser auth (no secrets needed)`).action((t,n)=>$a(n))}o(Er,"registerPublishCommand");import{spawnSync as Fa}from"child_process";import{mkdirSync as Ra}from"fs";import{resolve as Dt}from"path";var Ta=["localhost","local.cognite.ai","*.local.cognite.ai"],Oa={info:o(e=>{process.stdout.write(`${e}
130
+ npx @cognite/cli apps publish . --interactive Publish using browser auth (no secrets needed)`).action((t,r)=>Ba(r))}o(Rn,"registerPublishCommand");import{spawnSync as Ga}from"child_process";import{mkdirSync as Ya}from"fs";import{resolve as Ot}from"path";var qa=["localhost","local.cognite.ai","*.local.cognite.ai"],Ja={info:o(e=>{process.stdout.write(`${e}
133
131
  `)},"info"),error:o(e=>{process.stderr.write(`${e}
134
- `)},"error")},Ua={spawnSync:Fa,mkdirSync:Ra,logger:Oa};function _a(e){let t=e("mkcert",["-help"],{stdio:"ignore"});return t.status===0||t.status===1}o(_a,"hasMkcert");function La({certDir:e=Dt(process.cwd(),"certificates/mkcert"),domains:t=Ta,deps:n={}}={}){let r={...Ua,...n},{spawnSync:i,mkdirSync:s,logger:a}=r;if(!_a(i))throw a.error("Error: mkcert is not installed."),a.error("Install it with: brew install mkcert (macOS, Linux, WSL)"),a.error("On Windows: choco install mkcert (or scoop install mkcert)"),a.error("See https://github.com/FiloSottile/mkcert#installation for other methods."),new Error("mkcert is not installed");if(a.info("\u2139\uFE0F Installing mkcert root CA into your local trust store."),a.info(" This allows your browser to trust locally-generated certificates."),a.info(" You may be prompted for your system password."),i("mkcert",["-install"],{stdio:"inherit"}).status!==0)throw new Error("`mkcert -install` failed");s(e,{recursive:!0});let c=Dt(e,"localhost.pem"),l=Dt(e,"localhost-key.pem");if(i("mkcert",["-cert-file",c,"-key-file",l,...t],{stdio:"inherit"}).status!==0)throw new Error("mkcert failed to generate certificates");return a.info(""),a.info("Certificates generated:"),a.info(` cert: ${c}`),a.info(` key: ${l}`),{certFile:c,keyFile:l}}o(La,"setupHttps");function Na(e){La({certDir:e.certDir})}o(Na,"handleSetupHttps");function kr(e){return e.command("setup-https").description("Generate trusted local HTTPS certificates via mkcert").option("--cert-dir <path>","Directory to write certs into (default: ./certificates/mkcert)").addHelpText("after",`
132
+ `)},"error")},za={spawnSync:Ga,mkdirSync:Ya,logger:Ja};function Wa(e){let t=e("mkcert",["-help"],{stdio:"ignore"});return t.status===0||t.status===1}o(Wa,"hasMkcert");function Xa({certDir:e=Ot(process.cwd(),"certificates/mkcert"),domains:t=qa,deps:r={}}={}){let n={...za,...r},{spawnSync:i,mkdirSync:s,logger:a}=n;if(!Wa(i))throw a.error("Error: mkcert is not installed."),a.error("Install it with: brew install mkcert (macOS, Linux, WSL)"),a.error("On Windows: choco install mkcert (or scoop install mkcert)"),a.error("See https://github.com/FiloSottile/mkcert#installation for other methods."),new Error("mkcert is not installed");if(a.info("\u2139\uFE0F Installing mkcert root CA into your local trust store."),a.info(" This allows your browser to trust locally-generated certificates."),a.info(" You may be prompted for your system password."),i("mkcert",["-install"],{stdio:"inherit"}).status!==0)throw new Error("`mkcert -install` failed");s(e,{recursive:!0});let c=Ot(e,"localhost.pem"),l=Ot(e,"localhost-key.pem");if(i("mkcert",["-cert-file",c,"-key-file",l,...t],{stdio:"inherit"}).status!==0)throw new Error("mkcert failed to generate certificates");return a.info(""),a.info("Certificates generated:"),a.info(` cert: ${c}`),a.info(` key: ${l}`),{certFile:c,keyFile:l}}o(Xa,"setupHttps");function Za(e){Xa({certDir:e.certDir})}o(Za,"handleSetupHttps");function Fn(e){return e.command("setup-https").description("Generate trusted local HTTPS certificates via mkcert").option("--cert-dir <path>","Directory to write certs into (default: ./certificates/mkcert)").addHelpText("after",`
135
133
  Examples:
136
134
  npx @cognite/cli@latest apps setup-https Generate certs in ./certificates/mkcert
137
- npx @cognite/cli@latest apps setup-https --cert-dir certs Use a custom directory`).action(t=>Na(t))}o(kr,"registerSetupHttpsCommand");import{existsSync as op,writeFileSync as ip}from"fs";import{basename as sp,dirname as ap,join as pp,resolve as Tt}from"path";import{parseScope as cp,signBundle as lp,validateScopes as dp}from"@cognite/app-sdk/codesigning";import{existsSync as tp,readFileSync as np}from"fs";import{pbkdf2 as Ha,randomBytes as ja}from"crypto";import{promisify as Va}from"util";import{CompactEncrypt as Ba,base64url as br,compactDecrypt as Ga}from"jose";var Ma=new TextEncoder,Ka=new TextDecoder,It={encode:o(e=>Ma.encode(e),"encode"),decode:o(e=>Ka.decode(e),"decode")};var qa=Va(Ha),Rt=6e5,Ya="sha512",$t="PBKDF2-HMAC-SHA512",Ft=16,je="A256GCM",Ja=32,Ve=2e6;async function Pr(e,t,n){return await qa(e,t,n,Ja,Ya)}o(Pr,"deriveKey");async function xr(e,t,n=Rt){if(!Number.isInteger(n)||n<1||n>Ve)throw new Error(`Invalid iterations: must be an integer between 1 and ${Ve}`);let r=ja(Ft),i=await Pr(t,r,n);return await new Ba(It.encode(e)).setProtectedHeader({alg:"dir",enc:je,kdf:$t,kdf_iter:n,kdf_salt:br.encode(r)}).encrypt(i)}o(xr,"encryptStringAsJwe");async function Ar(e,t){let{plaintext:n}=await Ga(e,async r=>{if(!e.length)throw new Error("Unexpected JWE empty value");if(t.length<15)throw new Error(`Invalid passphrase it should be at least ${15} but got ${t.length}`);if(r.alg!=="dir")throw new Error(`Unexpected JWE alg "${String(r.alg)}"; only "dir" is supported`);if(r.enc!==je)throw new Error(`Unexpected JWE enc "${String(r.enc)}"; only "${je}" is supported`);if(r.kdf!==$t)throw new Error(`Unexpected KDF "${String(r.kdf)}"; only "${$t}" is supported`);let i=Number(r.kdf_iter);if(!Number.isInteger(i)||i<1||i>Ve)throw new Error(`Invalid kdf_iter in JWE header: must be an integer between 1 and ${Ve}`);if(typeof r.kdf_salt!="string")throw new Error("Missing kdf_salt in JWE header");let s=br.decode(r.kdf_salt);if(s.length!==Ft)throw new Error(`Invalid kdf_salt length in JWE header: expected ${Ft} bytes, got ${s.length}`);return await Pr(t,s,i)},{keyManagementAlgorithms:["dir"],contentEncryptionAlgorithms:[je]});return It.decode(n)}o(Ar,"decryptJweAsString");function za(e){let t=e.trim();return t.startsWith("eyJ")&&t.split(".").length===5}o(za,"isJweCompact");var Dr=za;import Wa from"enquirer";async function Xa(e){return Wa.prompt(e)}o(Xa,"defaultPrompt");async function Ir(e,t={}){let{prompt:n=Xa}=t,{passphrase:r}=await n({type:"password",name:"passphrase",message:e});return r}o(Ir,"promptPassphrase");import Qa from"enquirer";import{statSync as Za}from"fs";function $r(e,t=Za){return e.map(n=>({key:n,mtime:t(n.publicKeyPath).mtimeMs})).sort((n,r)=>r.mtime-n.mtime).map(({key:n})=>n)}o($r,"sortByMtime");async function ep(e){return Qa.prompt(e)}o(ep,"defaultPrompt");async function Fr(e,t={}){if(e.length===1)return e[0];let{prompt:n=ep,sortByMtime:r=$r}=t,i=r(e),s=i[0],{choice:a}=await n({type:"select",name:"choice",message:"Select signing identity",choices:[{name:"latest",message:`Use latest: ${s.kid}`},{name:"pick",message:"Pick from list"}]});if(a==="latest")return s;if(a==="pick"){let{kid:p}=await n({type:"select",name:"kid",message:"Select signing identity",choices:i.map(l=>({name:l.kid,message:[l.kid,l.email,xe(l.source)].filter(Boolean).join(" \u2014 ")}))}),c=i.find(l=>l.kid===p);if(!c)throw new Error("No signing identity selected");return c}else throw new Error(`Unexpected choice: "${a}"`)}o(Fr,"promptSigningIdentity");function rp(e){return{existsSync:e.existsSync??tp,readFileSync:e.readFileSync??((t,n)=>np(t,n)),readKeyFromKeychain:e.readKeyFromKeychain??Pe,decryptJweAsString:e.decryptJweAsString??Ar,discoverLocalKeys:e.discoverLocalKeys??Ae,keysDir:e.keysDir??x().keysDir,promptPassphrase:e.promptPassphrase??Ir,promptSigningIdentity:e.promptSigningIdentity??Fr}}o(rp,"resolveDeps");async function Rr(e,t={}){let n=rp(t);if(e.keyPath){if(!n.existsSync(e.keyPath))throw new Error(`Key file not found: ${e.keyPath}`);if(!e.kid)throw new Error("--signing-identity <kid> is required when using --key");let s=n.readFileSync(e.keyPath,"utf-8").trim();if(Dr(s)){if(!e.interactive)throw new Error(`Key at ${e.keyPath} is passphrase-encrypted. Pass --interactive to enter the passphrase.`);let a=await n.promptPassphrase(`Passphrase for key ${e.kid}: `);return{privateKeyPem:await n.decryptJweAsString(s,a),kid:e.kid}}return{privateKeyPem:s,kid:e.kid}}let r=await n.discoverLocalKeys(n.keysDir);if(r.length===0)throw new Error("No signing keys found. Run `cognite keys generate` or pass --key.");let i;if(e.kid)i=r.find(s=>s.kid===e.kid);else if(e.interactive)i=await n.promptSigningIdentity(r);else throw new Error("--signing-identity <kid> is required. Pass --interactive to select it interactively.");if(!i)throw new Error(`No key found with kid "${e.kid}"`);switch(i.source.kind){case"keychain":{let s=await n.readKeyFromKeychain(i.kid);if(!s)throw new Error(`Key "${i.kid}" not found in Keychain`);return{privateKeyPem:s,kid:i.kid}}case"encrypted-file":{if(!e.interactive)throw new Error(`Key "${i.kid}" is passphrase-encrypted. Pass --interactive to enter the passphrase, or store the key in macOS Keychain for non-interactive use.`);let s=await n.promptPassphrase(`Passphrase for key ${i.kid}: `);return{privateKeyPem:await n.decryptJweAsString(n.readFileSync(i.source.path,"utf-8"),s),kid:i.kid}}case"public-only":throw new Error(`Key "${i.kid}" has no private key on this machine (public-only).`)}}o(Rr,"resolvePrivateKey");var mp=o(async(e,t,n,r,i)=>{let s=await A(e,{interactive:i.browserAuth??!1,appId:t,orgHint:i.org});await new E(s).submitSignatures(t,n,r)},"defaultSubmitSignatures");function up(e){return{existsSync:e.existsSync??op,writeFileSync:e.writeFileSync??ip,createBundleStream:e.createBundleStream??De,signBundle:e.signBundle??lp,parseScope:e.parseScope??cp,validateScopes:e.validateScopes??dp,loadAppConfig:e.loadAppConfig??v,resolvePrivateKey:e.resolvePrivateKey??(t=>Rr(t)),submitSignatures:e.submitSignatures??mp,discoverSignatures:e.discoverSignatures??he}}o(up,"resolveDeps");async function Tr(e,t,n={},r=process.cwd()){let i=up(n),s=t.appid,a=t.appVersion,p=[],c=i.loadAppConfig(r);if(s=s??c.externalId,a=a??c.versionTag,t.scope&&t.scope.length>0?p=t.scope.map(i.parseScope):p=c.deployments.map(h=>({org:h.org,project:h.project})),!s)throw new Error("--appid is required (or set externalId in app.json)");if(!a)throw new Error("--app-version is required (or set versionTag in app.json)");let l=e?Tt(r,e):B(r,s,a);if(!i.existsSync(l)){let h=e?"":" (default derived from app.json \u2014 pass [bundle] explicitly to override, or run `cognite apps deploy` first to populate .cognite-bundles/)";throw new Error(`Bundle not found: ${l}${h}`)}let d=i.validateScopes(p);if(d.length>0)throw new Error(`Invalid scopes:
135
+ npx @cognite/cli@latest apps setup-https --cert-dir certs Use a custom directory`).action(t=>Za(t))}o(Fn,"registerSetupHttpsCommand");import{existsSync as Sp,writeFileSync as wp}from"fs";import{basename as vp,dirname as Cp,join as Ep,resolve as Kt}from"path";import{parseScope as kp,signBundle as bp,validateScopes as Pp}from"@cognite/app-sdk/codesigning";import{existsSync as fp,readFileSync as yp}from"fs";import{pbkdf2 as tp,randomBytes as rp}from"crypto";import{promisify as np}from"util";import{CompactEncrypt as op,base64url as On,compactDecrypt as ip}from"jose";var Qa=new TextEncoder,ep=new TextDecoder,Ut={encode:o(e=>Qa.encode(e),"encode"),decode:o(e=>ep.decode(e),"decode")};var sp=np(tp),Nt=6e5,ap="sha512",_t="PBKDF2-HMAC-SHA512",Lt=16,Ye="A256GCM",pp=32,qe=2e6;async function Un(e,t,r){return await sp(e,t,r,pp,ap)}o(Un,"deriveKey");async function _n(e,t,r=Nt){if(!Number.isInteger(r)||r<1||r>qe)throw new Error(`Invalid iterations: must be an integer between 1 and ${qe}`);let n=rp(Lt),i=await Un(t.expose(),n,r);return await new op(Ut.encode(e.expose())).setProtectedHeader({alg:"dir",enc:Ye,kdf:_t,kdf_iter:r,kdf_salt:On.encode(n)}).encrypt(i)}o(_n,"encryptStringAsJwe");async function Ln(e,t){let{plaintext:r}=await ip(e,async n=>{if(!e.length)throw new Error("Unexpected JWE empty value");let i=t.expose();if(i.length<15)throw new Error(`Invalid passphrase: must be at least ${15} characters`);if(n.alg!=="dir")throw new Error(`Unexpected JWE alg "${String(n.alg)}"; only "dir" is supported`);if(n.enc!==Ye)throw new Error(`Unexpected JWE enc "${String(n.enc)}"; only "${Ye}" is supported`);if(n.kdf!==_t)throw new Error(`Unexpected KDF "${String(n.kdf)}"; only "${_t}" is supported`);let s=Number(n.kdf_iter);if(!Number.isInteger(s)||s<1||s>qe)throw new Error(`Invalid kdf_iter in JWE header: must be an integer between 1 and ${qe}`);if(typeof n.kdf_salt!="string")throw new Error("Missing kdf_salt in JWE header");let a=On.decode(n.kdf_salt);if(a.length!==Lt)throw new Error(`Invalid kdf_salt length in JWE header: expected ${Lt} bytes, got ${a.length}`);return await Un(i,a,s)},{keyManagementAlgorithms:["dir"],contentEncryptionAlgorithms:[Ye]});return Ut.decode(r)}o(Ln,"decryptJweAsString");function cp(e){let t=e.trim();return t.startsWith("eyJ")&&t.split(".").length===5}o(cp,"isJweCompact");var Nn=cp;import lp from"enquirer";async function dp(e){return lp.prompt(e)}o(dp,"defaultPrompt");async function Kn(e,t={}){let{prompt:r=dp}=t,{passphrase:n}=await r({type:"password",name:"passphrase",message:e});return v.from(n)}o(Kn,"promptPassphrase");import up from"enquirer";import{statSync as mp}from"fs";function Mn(e,t=mp){return e.map(r=>({key:r,mtime:t(r.publicKeyPath).mtimeMs})).sort((r,n)=>n.mtime-r.mtime).map(({key:r})=>r)}o(Mn,"sortByMtime");async function gp(e){return up.prompt(e)}o(gp,"defaultPrompt");async function Hn(e,t={}){if(e.length===1)return e[0];let{prompt:r=gp,sortByMtime:n=Mn}=t,i=n(e),s=i[0],{choice:a}=await r({type:"select",name:"choice",message:"Select signing identity",choices:[{name:"latest",message:`Use latest: ${s.kid}`},{name:"pick",message:"Pick from list"}]});if(a==="latest")return s;if(a==="pick"){let{kid:p}=await r({type:"select",name:"kid",message:"Select signing identity",choices:i.map(l=>({name:l.kid,message:[l.kid,l.email,$e(l.source)].filter(Boolean).join(" \u2014 ")}))}),c=i.find(l=>l.kid===p);if(!c)throw new Error("No signing identity selected");return c}else throw new Error(`Unexpected choice: "${a}"`)}o(Hn,"promptSigningIdentity");function hp(e){return{existsSync:e.existsSync??fp,readFileSync:e.readFileSync??((t,r)=>yp(t,r)),readKeyFromKeychain:e.readKeyFromKeychain??Ie,decryptJweAsString:e.decryptJweAsString??Ln,discoverLocalKeys:e.discoverLocalKeys??Te,keysDir:e.keysDir??D().keysDir,promptPassphrase:e.promptPassphrase??Kn,promptSigningIdentity:e.promptSigningIdentity??Hn}}o(hp,"resolveDeps");async function jn(e,t={}){let r=hp(t);if(e.keyPath){if(!r.existsSync(e.keyPath))throw new Error(`Key file not found: ${e.keyPath}`);if(!e.kid)throw new Error("--signing-identity <kid> is required when using --key");let s=r.readFileSync(e.keyPath,"utf-8").trim();if(Nn(s)){if(!e.interactive)throw new Error(`Key at ${e.keyPath} is passphrase-encrypted. Pass --interactive to enter the passphrase.`);let a=await r.promptPassphrase(`Passphrase for key ${e.kid}: `);return{privateKeyPem:v.from(await r.decryptJweAsString(s,a)),kid:e.kid}}return{privateKeyPem:v.from(s),kid:e.kid}}let n=await r.discoverLocalKeys(r.keysDir);if(n.length===0)throw new Error("No signing keys found. Run `cognite keys generate` or pass --key.");let i;if(e.kid)i=n.find(s=>s.kid===e.kid);else if(e.interactive)i=await r.promptSigningIdentity(n);else throw new Error("--signing-identity <kid> is required. Pass --interactive to select it interactively.");if(!i)throw new Error(`No key found with kid "${e.kid}"`);switch(i.source.kind){case"keychain":{let s=await r.readKeyFromKeychain(i.kid);if(!s)throw new Error(`Key "${i.kid}" not found in Keychain`);return{privateKeyPem:s,kid:i.kid}}case"encrypted-file":{if(!e.interactive)throw new Error(`Key "${i.kid}" is passphrase-encrypted. Pass --interactive to enter the passphrase, or store the key in macOS Keychain for non-interactive use.`);let s=await r.promptPassphrase(`Passphrase for key ${i.kid}: `);return{privateKeyPem:v.from(await r.decryptJweAsString(r.readFileSync(i.source.path,"utf-8"),s)),kid:i.kid}}case"public-only":throw new Error(`Key "${i.kid}" has no private key on this machine (public-only).`)}}o(jn,"resolvePrivateKey");var xp=o(async(e,t,r,n,i)=>{let s=await I(e,{interactive:i.browserAuth??!1,appId:t,orgHint:i.org});await new b(s).submitSignatures(t,r,n)},"defaultSubmitSignatures");function Ap(e){return{existsSync:e.existsSync??Sp,writeFileSync:e.writeFileSync??wp,createBundleStream:e.createBundleStream??Re,signBundle:e.signBundle??bp,parseScope:e.parseScope??kp,validateScopes:e.validateScopes??Pp,loadAppConfig:e.loadAppConfig??C,resolvePrivateKey:e.resolvePrivateKey??(t=>jn(t)),submitSignatures:e.submitSignatures??xp,discoverSignatures:e.discoverSignatures??we}}o(Ap,"resolveDeps");async function Vn(e,t,r={},n=process.cwd()){let i=Ap(r),s=t.appid,a=t.appVersion,p=[],c=i.loadAppConfig(n);if(s=s??c.externalId,a=a??c.versionTag,t.scope&&t.scope.length>0?p=t.scope.map(i.parseScope):p=c.deployments.map(h=>({org:h.org,project:h.project})),!s)throw new Error("--appid is required (or set externalId in app.json)");if(!a)throw new Error("--app-version is required (or set versionTag in app.json)");let l=e?Kt(n,e):q(n,s,a);if(!i.existsSync(l)){let h=e?"":" (default derived from app.json \u2014 pass [bundle] explicitly to override, or run `cognite apps deploy` first to populate .cognite-bundles/)";throw new Error(`Bundle not found: ${l}${h}`)}let d=i.validateScopes(p);if(d.length>0)throw new Error(`Invalid scopes:
138
136
  ${d.join(`
139
- `)}`);let{privateKeyPem:m,kid:y}=await i.resolvePrivateKey({keyPath:t.key?Tt(r,t.key):void 0,kid:t.signingIdentity,interactive:t.interactive}),f=i.createBundleStream(l),g=await i.signBundle({privateKeyPem:m,kid:y,appId:s,version:a,bundleStream:f,role:t.asCertifier?"certifier":"developer",scopes:p}),S=t.output?Tt(r,t.output):pp(ap(l),`${sp(l)}.${t.asCertifier?"cert":"dev"}.sig`);i.writeFileSync(S,g.token,"utf-8"),console.log(`\u2705 Signed: ${S}`),console.log(` kid: ${g.kid}`),console.log(` bundle: ${g.payload.bundleSha256}`),console.log(` scopes: ${g.payload.scopes.map(h=>`${h.org}/${h.project}`).join(", ")}`),t.verbose&&console.log(`
140
- Payload:`,JSON.stringify(g.payload,null,2));let w=Array.from(new Set([...i.discoverSignatures(l),g.token])),P=t.interactive?await I(c,{deployment:t.deployment,baseUrl:t.baseUrl,project:t.project,org:t.org}):b(c.deployments,t.deployment);if(!t.browserAuth){let h=D(P);if(h.length>0)throw new Error(`Deployment ${P.org}/${P.project} is missing ${h.join(" and ")} in app.json. Pass --browser-auth to authenticate via browser instead.`)}await i.submitSignatures(P,s,a,w,t),console.log(`
141
- To publish: npx @cognite/cli apps publish .`)}o(Tr,"handleSign");function Or(e,t={}){return e.command("sign [bundle]").description("Sign an app bundle (defaults to .cognite-bundles/<app>-<version>.zip)").option("--key <path>","Private key PEM file path").option("-s, --signing-identity <kid>","Key ID for Keychain or file lookup").option("--appid <id>","Application ID (default: externalId from app.json)").option("-i, --identifier <id>","Alias for --appid").option("--app-version <version>","App version (default: versionTag from app.json)").option("--scope <org/project...>","Deployment scope(s) (default: deployments from app.json)").option("-r, --requirements <org/project...>","Alias for --scope").option("-o, --output <path>","Output file path (default: <bundle>.<dev|cert>.sig)").option("-v, --verbose","Display full payload after signing").option("--as-certifier","Counter-sign a developer signature as certifier").option("--interactive","Enable interactive prompts (key selection, passphrase, deployment target selection)",!1).option("--browser-auth","Use browser-based PKCE auth when submitting the signature",!1).option("-d, --deployment <target>","Deployment target from app.json (index or name; submit step only)").option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive or --browser-auth)").action((n,r)=>{let i={...r,appid:r.identifier??r.appid,scope:r.requirements??r.scope};return Tr(n,i,t)})}o(Or,"registerSignCommand");function gp(e){return e.alias==="ACTIVE"?"ACTIVE":e.lifecycleState}o(gp,"describeStatus");function fp(e){if(e.length===0)return["Signatures: none stored"];let t=["Signatures:"];for(let n of e){let r=n.status==="VALID"?"\u2705":"\u274C",i=new Date(n.signatureIat).toISOString();t.push(` ${r} ${n.signerKid} (${n.signerRole}, signed ${i}) \u2014 ${n.status}`)}return t}o(fp,"formatSignatures");async function yp(e){let t=process.cwd();$(t);let n=v(t);F(n);let r=e.interactive?await I(n,e):b(n.deployments,e.deployment);if(!e.interactive){let a=D(r);if(a.length>0)throw new Error(`Deployment ${r.org}/${r.project} is missing ${a.join(" and ")} in app.json. Use \`cognite apps status --interactive\` for browser-based authentication instead.`)}let i=await A(r,{interactive:e.interactive,appId:n.externalId,orgHint:e.org}),s=new E(i);console.log(""),console.log(`App: ${n.name} (${n.externalId})`),console.log(`Version: ${n.versionTag} (local)`);try{let a=await s.getVersion(n.externalId,n.versionTag);console.log(`Status: ${gp(a)}`);let p=await hp(s,n.externalId,n.versionTag);if(console.log(""),p==="endpoint-unavailable")console.log("Signatures: backend endpoint not available on this cluster yet");else for(let c of fp(p))console.log(c);a.lifecycleState==="DRAFT"&&(console.log(""),console.log("Run `npx @cognite/cli apps publish .` to publish this version."))}catch(a){if(a instanceof H){console.log("Status: not deployed yet"),console.log(""),console.log("Run `npx @cognite/cli apps deploy` to upload this version.");return}throw a}}o(yp,"handleStatus");async function hp(e,t,n){try{return await e.listSignatures(t,n)}catch(r){if(ne(r)&&r.status===404||r instanceof Error&&/status code: 404/.test(r.message))return"endpoint-unavailable";throw r}}o(hp,"fetchSignatures");function Ur(e){return e.command("status").description("Show the deployment status and signatures of the current app version").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
137
+ `)}`);let{privateKeyPem:m,kid:y}=await i.resolvePrivateKey({keyPath:t.key?Kt(n,t.key):void 0,kid:t.signingIdentity,interactive:t.interactive}),S=i.createBundleStream(l),u=await i.signBundle({privateKeyPem:m.expose(),kid:y,appId:s,version:a,bundleStream:S,role:t.asCertifier?"certifier":"developer",scopes:p}),f=t.output?Kt(n,t.output):Ep(Cp(l),`${vp(l)}.${t.asCertifier?"cert":"dev"}.sig`);i.writeFileSync(f,u.token,"utf-8"),console.log(`\u2705 Signed: ${f}`),console.log(` kid: ${u.kid}`),console.log(` bundle: ${u.payload.bundleSha256}`),console.log(` scopes: ${u.payload.scopes.map(h=>`${h.org}/${h.project}`).join(", ")}`),t.verbose&&console.log(`
138
+ Payload:`,JSON.stringify(u.payload,null,2));let w=Array.from(new Set([...i.discoverSignatures(l),u.token])),E=t.interactive?await T(c,{deployment:t.deployment,baseUrl:t.baseUrl,project:t.project,org:t.org}):x(c.deployments,t.deployment);if(!t.browserAuth){let h=$(E);if(h.length>0)throw new Error(`Deployment ${E.org}/${E.project} is missing ${h.join(" and ")} in app.json. Pass --browser-auth to authenticate via browser instead.`)}await i.submitSignatures(E,s,a,w,t),console.log(`
139
+ To publish: npx @cognite/cli apps publish .`)}o(Vn,"handleSign");function Bn(e,t={}){return e.command("sign [bundle]").description("Sign an app bundle (defaults to .cognite-bundles/<app>-<version>.zip)").option("--key <path>","Private key PEM file path").option("-s, --signing-identity <kid>","Key ID for Keychain or file lookup").option("--appid <id>","Application ID (default: externalId from app.json)").option("-i, --identifier <id>","Alias for --appid").option("--app-version <version>","App version (default: versionTag from app.json)").option("--scope <org/project...>","Deployment scope(s) (default: deployments from app.json)").option("-r, --requirements <org/project...>","Alias for --scope").option("-o, --output <path>","Output file path (default: <bundle>.<dev|cert>.sig)").option("-v, --verbose","Display full payload after signing").option("--as-certifier","Counter-sign a developer signature as certifier").option("--interactive","Enable interactive prompts (key selection, passphrase, deployment target selection)",!1).option("--browser-auth","Use browser-based PKCE auth when submitting the signature",!1).option("-d, --deployment <target>","Deployment target from app.json (index or name; submit step only)").option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive or --browser-auth)").action((r,n)=>{let i={...n,appid:n.identifier??n.appid,scope:n.requirements??n.scope};return Vn(r,i,t)})}o(Bn,"registerSignCommand");function Dp(e){return e.alias==="ACTIVE"?"ACTIVE":e.lifecycleState}o(Dp,"describeStatus");function Ip(e){if(e.length===0)return["Signatures: none stored"];let t=["Signatures:"];for(let r of e){let n=r.status==="VALID"?"\u2705":"\u274C",i=new Date(r.signatureIat).toISOString();t.push(` ${n} ${r.signerKid} (${r.signerRole}, signed ${i}) \u2014 ${r.status}`)}return t}o(Ip,"formatSignatures");async function $p(e){let t=process.cwd();R(t);let r=C(t);F(r);let n=e.interactive?await T(r,e):x(r.deployments,e.deployment);if(!e.interactive){let a=$(n);if(a.length>0)throw new Error(`Deployment ${n.org}/${n.project} is missing ${a.join(" and ")} in app.json. Use \`cognite apps status --interactive\` for browser-based authentication instead.`)}let i=await I(n,{interactive:e.interactive,appId:r.externalId,orgHint:e.org}),s=new b(i);console.log(""),console.log(`App: ${r.name} (${r.externalId})`),console.log(`Version: ${r.versionTag} (local)`);try{let a=await s.getVersion(r.externalId,r.versionTag);console.log(`Status: ${Dp(a)}`);let p=await Tp(s,r.externalId,r.versionTag);if(console.log(""),p==="endpoint-unavailable")console.log("Signatures: backend endpoint not available on this cluster yet");else for(let c of Ip(p))console.log(c);a.lifecycleState==="DRAFT"&&(console.log(""),console.log("Run `npx @cognite/cli apps publish .` to publish this version."))}catch(a){if(a instanceof B){console.log("Status: not deployed yet"),console.log(""),console.log("Run `npx @cognite/cli apps deploy` to upload this version.");return}throw a}}o($p,"handleStatus");async function Tp(e,t,r){try{return await e.listSignatures(t,r)}catch(n){if(oe(n)&&n.status===404||n instanceof Error&&/status code: 404/.test(n.message))return"endpoint-unavailable";throw n}}o(Tp,"fetchSignatures");function Gn(e){return e.command("status").description("Show the deployment status and signatures of the current app version").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
142
140
  Examples:
143
141
  npx @cognite/cli apps status . Status using env-var auth
144
- npx @cognite/cli apps status . --interactive Status using browser auth (no secrets needed)`).action((t,n)=>yp(n))}o(Ur,"registerStatusCommand");import{execFileSync as _t}from"child_process";import Ut from"fs";import Se from"path";import Cp from"readline";var _r="https://cognite.zendesk.com",Sp="360001234312",wp="tf_360015295097",vp="cognite_flows_certifications";function Lr(e,t,n){let r=new URLSearchParams({ticket_form_id:Sp,tf_priority:"normal",tf_subject:e,[wp]:vp,tf_description:t});return`${n}/hc/en-us/requests/new?${r}`}o(Lr,"buildUrl");function Nr(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;")}o(Nr,"escapeHtml");function Ot(e){return e.map(Nr).join("<br>")}o(Ot,"toHtml");function Mr(e,t=_r){let{appName:n,externalId:r,versionTag:i,archiveName:s,developerName:a,cdfProject:p,cdfCluster:c}=e,l=["Dear Cognite Platform Team,","","I would like to submit my Flows app for review and certification.","",`App name: ${n}`,`App external ID: ${r}`,`Version: ${i}`,p?`CDF project: ${p}`:void 0,c?`CDF cluster: ${c}`:void 0,"","`npx @cognite/cli apps submit` verified App-Brief.md,","code-review-report.md, and design-review-report.md are committed to git.","","Attached (all from dist/submit/):",`[ ] ${s??"src-<sha>.zip"} \u2014 source archive`,`[ ] ${r}-${i}.zip \u2014 deploy bundle`,"[ ] Screen recording of the application (required for design review)","","Best regards,",a??"[Your name]"];return Lr(`App Review Request: ${n}`,Ot(l.filter(d=>d!==void 0)),t)}o(Mr,"buildAppReviewUrl");function Kr(e,t,n,r,i=_r){let s=Ot(["Dear Cognite Platform Team,","","I would like to register my Flows app signing key for certified deployments.","",`Key ID (kid): ${e}`,`Developer email: ${t}`,`Expires: ${n}`,"","Please add the following entry to public_keys.yaml:"]),a=`<pre>${Nr(r.replace(/\r\n/g,`
145
- `))}</pre>`,p=Ot(["","Best Regards,","[Your name]","","(This registration request was generated by `npx @cognite/cli keys generate`.)"]);return Lr(`Public Key Registration: ${t}`,`${s}<br>${a}${p}`,i)}o(Kr,"buildKeyRegistrationUrl");function Ep(){return new Promise(e=>{let t=Cp.createInterface({input:process.stdin,output:process.stdout});t.question(`
146
- Press Enter to open the Zendesk form in your browser and reveal dist/submit/ in your file manager...`,()=>{t.close(),e()})})}o(Ep,"defaultPressEnter");var kp=[{pattern:"App-Brief.md",label:"App-Brief.md",skill:"flows-app-brief"},{pattern:"reviews/code-review/*/code-review-report.md",label:"reviews/code-review/feedback-round-<N>/code-review-report.md",skill:"flows-code-review"},{pattern:"reviews/design-review/*/design-review-report.md",label:"reviews/design-review/feedback-round-<N>/design-review-report.md",skill:"flows-design-review"}];function bp(e){let t=kp.filter(({pattern:n})=>_t("git",["-C",e,"ls-files","--",n],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().length===0);if(t.length>0){let n=t.map(({label:r,skill:i})=>` ${r} \u2192 /${i}`);throw new Error(`Certification files are missing or not committed. Run the required skills in Claude Code first:
142
+ npx @cognite/cli apps status . --interactive Status using browser auth (no secrets needed)`).action((t,r)=>$p(r))}o(Gn,"registerStatusCommand");import{execFileSync as jt}from"child_process";import Ht from"fs";import ve from"path";import Up from"readline";var Yn="https://cognite.zendesk.com",Rp="360001234312",Fp="tf_360015295097",Op="cognite_flows_certifications";function qn(e,t,r){let n=new URLSearchParams({ticket_form_id:Rp,tf_priority:"normal",tf_subject:e,[Fp]:Op,tf_description:t});return`${r}/hc/en-us/requests/new?${n}`}o(qn,"buildUrl");function Jn(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;")}o(Jn,"escapeHtml");function Mt(e){return e.map(Jn).join("<br>")}o(Mt,"toHtml");function zn(e,t=Yn){let{appName:r,externalId:n,versionTag:i,archiveName:s,developerName:a,cdfProject:p,cdfCluster:c}=e,l=["Dear Cognite Platform Team,","","I would like to submit my Flows app for review and certification.","",`App name: ${r}`,`App external ID: ${n}`,`Version: ${i}`,p?`CDF project: ${p}`:void 0,c?`CDF cluster: ${c}`:void 0,"","`npx @cognite/cli apps submit` verified App-Brief.md,","code-review-report.md, and design-review-report.md are committed to git.","","Attached (all from dist/submit/):",`[ ] ${s??"src-<sha>.zip"} \u2014 source archive`,`[ ] ${n}-${i}.zip \u2014 deploy bundle`,"[ ] Screen recording of the application (required for design review)","","Best regards,",a??"[Your name]"];return qn(`App Review Request: ${r}`,Mt(l.filter(d=>d!==void 0)),t)}o(zn,"buildAppReviewUrl");function Wn(e,t,r,n,i=Yn){let s=Mt(["Dear Cognite Platform Team,","","I would like to register my Flows app signing key for certified deployments.","",`Key ID (kid): ${e}`,`Developer email: ${t}`,`Expires: ${r}`,"","Please add the following entry to public_keys.yaml:"]),a=`<pre>${Jn(n.replace(/\r\n/g,`
143
+ `))}</pre>`,p=Mt(["","Best Regards,","[Your name]","","(This registration request was generated by `npx @cognite/cli keys generate`.)"]);return qn(`Public Key Registration: ${t}`,`${s}<br>${a}${p}`,i)}o(Wn,"buildKeyRegistrationUrl");function _p(){return new Promise(e=>{let t=Up.createInterface({input:process.stdin,output:process.stdout});t.question(`
144
+ Press Enter to open the Zendesk form in your browser and reveal dist/submit/ in your file manager...`,()=>{t.close(),e()})})}o(_p,"defaultPressEnter");var Lp=[{pattern:"App-Brief.md",label:"App-Brief.md",skill:"flows-app-brief"},{pattern:"reviews/code-review/*/code-review-report.md",label:"reviews/code-review/feedback-round-<N>/code-review-report.md",skill:"flows-code-review"},{pattern:"reviews/design-review/*/design-review-report.md",label:"reviews/design-review/feedback-round-<N>/design-review-report.md",skill:"flows-design-review"}];function Np(e){let t=Lp.filter(({pattern:r})=>jt("git",["-C",e,"ls-files","--",r],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().length===0);if(t.length>0){let r=t.map(({label:n,skill:i})=>` ${n} \u2192 /${i}`);throw new Error(`Certification files are missing or not committed. Run the required skills in Claude Code first:
147
145
 
148
- `+n.join(`
149
- `)+"\n\nAfter running the skills, commit the generated files and re-run `apps submit`.")}}o(bp,"assertArtifactsCommitted");async function Pp(e=process.cwd(),t={}){let{openInBrowser:n=Sn,revealInFileManager:r=wn,pressEnter:i=Ep,isInteractive:s=o(()=>process.stdout.isTTY===!0,"isInteractive")}=t;if(!Ce())throw new Error("git is not installed. Install git and ensure it is in your PATH.");if(!Ee(e))throw new Error("Not a git repository. Run this command from your app's root directory.");$(e);let a=v(e);F(a),bp(e);let p=Se.join(e,"dist","submit");Ut.mkdirSync(p,{recursive:!0});let c=_t("git",["-C",e,"rev-parse","--short","HEAD"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim();if(_t("git",["-C",e,"status","--porcelain"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().length>0)throw new Error(`Working tree has uncommitted changes. Commit or stash them before submitting for certification.
146
+ `+r.join(`
147
+ `)+"\n\nAfter running the skills, commit the generated files and re-run `apps submit`.")}}o(Np,"assertArtifactsCommitted");async function Kp(e=process.cwd(),t={}){let{openInBrowser:r=Dr,revealInFileManager:n=Ir,pressEnter:i=_p,isInteractive:s=o(()=>process.stdout.isTTY===!0,"isInteractive")}=t;if(!be())throw new Error("git is not installed. Install git and ensure it is in your PATH.");if(!Pe(e))throw new Error("Not a git repository. Run this command from your app's root directory.");R(e);let a=C(e);F(a),Np(e);let p=ve.join(e,"dist","submit");Ht.mkdirSync(p,{recursive:!0});let c=jt("git",["-C",e,"rev-parse","--short","HEAD"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim();if(jt("git",["-C",e,"status","--porcelain"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().length>0)throw new Error(`Working tree has uncommitted changes. Commit or stash them before submitting for certification.
150
148
 
151
- The source archive must exactly match the committed code so reviewers can verify what they receive.`);let d=`src-${c}.zip`,m=Se.join(p,d);await new re(Se.join(e,"dist")).createSourceArchive(m);let f=`${a.externalId}-${a.versionTag}.zip`,g=Se.join(e,".cognite-bundles",f),S=!1;Ut.existsSync(g)&&(Ut.copyFileSync(g,Se.join(p,f)),S=!0);let w=Mr({appName:a.name,externalId:a.externalId,versionTag:a.versionTag,archiveName:d,developerName:Wt(),cdfProject:a.deployments[0].project,cdfCluster:a.deployments[0].baseUrl});console.log(`
152
- \u2705 Certification package ready: dist/submit/`),console.log(` ${d} \u2014 source archive (commit ${c})`),console.log(S?` ${f} \u2014 deploy bundle`:" \u26A0 Deploy bundle missing \u2014 run `apps deploy` to generate it, then re-run submit"),console.log(" \u2190 add your screen recording to this folder"),console.log(`
149
+ The source archive must exactly match the committed code so reviewers can verify what they receive.`);let d=`src-${c}.zip`,m=ve.join(p,d);await new ie(ve.join(e,"dist")).createSourceArchive(m);let S=`${a.externalId}-${a.versionTag}.zip`,u=ve.join(e,".cognite-bundles",S),f=!1;Ht.existsSync(u)&&(Ht.copyFileSync(u,ve.join(p,S)),f=!0);let w=zn({appName:a.name,externalId:a.externalId,versionTag:a.versionTag,archiveName:d,developerName:ar(),cdfProject:a.deployments[0].project,cdfCluster:a.deployments[0].baseUrl});console.log(`
150
+ \u2705 Certification package ready: dist/submit/`),console.log(` ${d} \u2014 source archive (commit ${c})`),console.log(f?` ${S} \u2014 deploy bundle`:" \u26A0 Deploy bundle missing \u2014 run `apps deploy` to generate it, then re-run submit"),console.log(" \u2190 add your screen recording to this folder"),console.log(`
153
151
  Attach all files from dist/submit/ to the Zendesk ticket.`),console.log(`
154
- \u{1F517} ${w}`),s()&&(await i(),n(w),r(m))}o(Pp,"handleSubmit");function Hr(e){return e.command("submit").description("Package source and open a pre-filled Zendesk form for app certification submission").addHelpText("after",`
152
+ \u{1F517} ${w}`),s()&&(await i(),r(w),n(m))}o(Kp,"handleSubmit");function Xn(e){return e.command("submit").description("Package source and open a pre-filled Zendesk form for app certification submission").addHelpText("after",`
155
153
  Examples:
156
- npx @cognite/cli apps submit Package source, open browser + file manager`).action(()=>Pp())}o(Hr,"registerSubmitCommand");function jr(e){let t=e.command("apps").description("Manage Fusion Custom Apps \u2014 create, deploy, and manage version lifecycle");return ur(t),vr(t),Ur(t),Cr(t),Er(t),Xn(t),gr(t),kr(t),Hr(t),lr(t),Or(t),Fn(t),t}o(jr,"registerAppsCommand");import{existsSync as Fp,mkdirSync as Rp,writeFileSync as Tp}from"fs";import{dirname as Mt,join as ve}from"path";import{generateSigningKeyPair as Op}from"@cognite/app-sdk/codesigning";import Up from"open";function Vr(e,t){let n=e.getUTCFullYear(),r=e.getUTCMonth()+t,i=new Date(Date.UTC(n,r+1,0)).getUTCDate(),s=Math.min(e.getUTCDate(),i);return new Date(Date.UTC(n,r,s))}o(Vr,"addMonthsClamped");function Lt(e){return e.toISOString().slice(0,10)}o(Lt,"formatIsoDate");function Br(e=new Date){return Lt(e)}o(Br,"todayIso");import xp,{Chalk as Ap}from"chalk";var we=new Ap({level:0});function Gr(e){return e.isTTY?xp:we}o(Gr,"chalkForStream");var Be=Uint8Array.from([48,42,48,5,6,3,43,101,112,3,33,0]),qr=32,Yr=44,Jr=60,Dp="services/app-hosting/src/kotlin/com/cognite/apphosting/signing/public_keys.yaml";function Ip(e){let t=e.replace(/-----BEGIN [^-]+-----/g,"").replace(/-----END [^-]+-----/g,"").replace(/\s+/g,"");if(t.length!==Yr&&t.length!==Jr)throw new Error(`Unexpected Ed25519 public key base64 length: got ${t.length} chars, expected ${Yr} (raw) or ${Jr} (X.509-wrapped)`);let n=Buffer.from(t,"base64");if(n.length===Be.length+qr&&n.subarray(0,Be.length).equals(Be))return n.subarray(Be.length).toString("base64");if(n.length===qr)return n.toString("base64");throw new Error(`Unexpected Ed25519 public key length: got ${n.length} bytes, expected 32 (raw) or 44 (X.509-wrapped)`)}o(Ip,"pemBodyOneLine");function Nt(e,t=we,n=new Date){let r=zr(e.issuedAt??Br(n)),i=zr(e.expires),s=Ip(e.publicKeyPem),a=" ",p=o((l,d)=>`${a}${t.cyan(l)}${t.dim(":")} ${d}
154
+ npx @cognite/cli apps submit Package source, open browser + file manager`).action(()=>Kp())}o(Xn,"registerSubmitCommand");function Zn(e){let t=e.command("apps").description("Manage Fusion Custom Apps \u2014 create, deploy, and manage version lifecycle");return kn(t),$n(t),Gn(t),Tn(t),Rn(t),an(t),bn(t),Fn(t),Xn(t),vn(t),Bn(t),Mr(t),t}o(Zn,"registerAppsCommand");import{existsSync as Gp,mkdirSync as Yp,writeFileSync as qp}from"fs";import{dirname as Gt,join as Ee}from"path";import{generateSigningKeyPair as Jp}from"@cognite/app-sdk/codesigning";import zp from"open";function Qn(e,t){let r=e.getUTCFullYear(),n=e.getUTCMonth()+t,i=new Date(Date.UTC(r,n+1,0)).getUTCDate(),s=Math.min(e.getUTCDate(),i);return new Date(Date.UTC(r,n,s))}o(Qn,"addMonthsClamped");function Vt(e){return e.toISOString().slice(0,10)}o(Vt,"formatIsoDate");function eo(e=new Date){return Vt(e)}o(eo,"todayIso");import Mp,{Chalk as Hp}from"chalk";var Ce=new Hp({level:0});function to(e){return e.isTTY?Mp:Ce}o(to,"chalkForStream");var Je=Uint8Array.from([48,42,48,5,6,3,43,101,112,3,33,0]),ro=32,no=44,oo=60,jp="services/app-hosting/src/kotlin/com/cognite/apphosting/signing/public_keys.yaml";function Vp(e){let t=e.replace(/-----BEGIN [^-]+-----/g,"").replace(/-----END [^-]+-----/g,"").replace(/\s+/g,"");if(t.length!==no&&t.length!==oo)throw new Error(`Unexpected Ed25519 public key base64 length: got ${t.length} chars, expected ${no} (raw) or ${oo} (X.509-wrapped)`);let r=Buffer.from(t,"base64");if(r.length===Je.length+ro&&r.subarray(0,Je.length).equals(Je))return r.subarray(Je.length).toString("base64");if(r.length===ro)return r.toString("base64");throw new Error(`Unexpected Ed25519 public key length: got ${r.length} bytes, expected 32 (raw) or 44 (X.509-wrapped)`)}o(Vp,"pemBodyOneLine");function Bt(e,t=Ce,r=new Date){let n=io(e.issuedAt??eo(r)),i=io(e.expires),s=Vp(e.publicKeyPem),a=" ",p=o((l,d)=>`${a}${t.cyan(l)}${t.dim(":")} ${d}
157
155
  `,"kv"),c="";return c+=`
158
- ${t.bold("Add this entry to")} ${t.magenta(Dp)} ${t.bold("under")} ${t.cyan("publicKeys:")}
156
+ ${t.bold("Add this entry to")} ${t.magenta(jp)} ${t.bold("under")} ${t.cyan("publicKeys:")}
159
157
 
160
158
  `,c+=` ${t.dim("-")} ${t.cyan("kid")}${t.dim(":")} ${t.green(e.kid)}
161
- `,c+=p("publicKey",t.green(s)),c+=p("email",t.yellow(e.email)),c+=p("roles",`${t.dim("[")}${t.yellow("developer")}${t.dim("]")}`),c+=p("issuedAt",t.green(r)),c+=p("expiresAt",t.green(i)),c+=p("revokedAt",t.dim("null")),c}o(Nt,"renderRegistryYamlBlock");function zr(e){let t=e.trim();if(/^\d{4}-\d{2}-\d{2}$/.test(t))return`${t}T00:00:00Z`;let n=new Date(t);if(Number.isNaN(n.getTime()))throw new Error(`Invalid date '${e}': expected YYYY-MM-DD or ISO-8601 instant`);return n.toISOString()}o(zr,"toIsoInstant");import $p from"clipboardy";function Wr(e){return $p.write(e)}o(Wr,"copyToClipboard");function _p(e){return{writeFileSync:e.writeFileSync??Tp,mkdirSync:e.mkdirSync??Rp,existsSync:e.existsSync??Fp,generateSigningKeyPair:e.generateSigningKeyPair??Op,encryptStringAsJwe:e.encryptStringAsJwe??xr,storeKeyInKeychain:e.storeKeyInKeychain??En,isOS:e.isOS??(t=>T(t)),promptKid:e.promptKid??dn,promptExpiryMonths:e.promptExpiryMonths??un,promptEmail:e.promptEmail??gn,promptPassphrase:e.promptPassphrase??fn,promptConfirmOverwrite:e.promptConfirmOverwrite??yn,discoverLocalKeys:e.discoverLocalKeys??(()=>Ae()),promptZendeskAction:e.promptZendeskAction??mn,openUrl:e.openUrl??(t=>Up(t)),copyToClipboard:e.copyToClipboard??Wr}}o(_p,"resolveDeps");function Zr(e,t={}){let n=_p(t),r=e.command("keys").description("Manage code signing keys");r.command("generate").description("Generate an Ed25519 keypair for code signing").option("-o, --output <path>","Encrypted private key output path (forces file storage even on macOS)").option("--no-keychain",`Skip macOS Keychain and write a passphrase-encrypted private key under ${x().keysDir} instead`).option("-e, --expires <months>",`Validity in months (${1}-${12}); skips the interactive prompt`).option("--email <address>","Email address for the registry entry; skips the interactive prompt").option("--kid <identifier>","Signing identity name for the registry (e.g. jsmith-dev-001); skips the interactive prompt").option("--force","Overwrite an existing key without prompting for confirmation").option("--copy-link","Copy the Zendesk registration link to the clipboard without prompting").option("--interactive","Prompt for any required flags that are not supplied",!1).action(i=>Kp(i,n)),r.command("list").description("List local signing identities and their storage location").action(()=>Lp(n))}o(Zr,"registerKeysCommand");async function Lp(e){let t=await e.discoverLocalKeys();if(t.length===0){process.stdout.write(`No signing identities found.
162
- `),process.stdout.write(`Run \`cognite keys generate\` to create one (storage: ${x().keysDir}).
163
- `);return}let n=["KID","SOURCE","EMAIL"],r=t.map(a=>[a.kid,xe(a.source),a.email??"\u2014"]),i=n.map((a,p)=>Math.max(a.length,...r.map(c=>c[p].length))),s=o(a=>a.map((p,c)=>p.padEnd(i[c])).join(" ").trimEnd(),"fmt");process.stdout.write(`${s(n)}
164
- `);for(let a of r)process.stdout.write(`${s(a)}
165
- `)}o(Lp,"handleList");function Xr(e,t,n){let r=ve(x().keysDir,`${e}${J}`);return n.mkdirSync(Mt(r),{recursive:!0}),n.writeFileSync(r,t),r}o(Xr,"writePublicKey");async function Np(e,t,n,r,i,{force:s=!1}={}){let a=r??ve(x().keysDir,`${e}${tt}`);if(i.mkdirSync(Mt(a),{recursive:!0}),!s&&i.existsSync(a))throw new Error(`Refusing to overwrite existing key at ${a}. Delete it first if you really want to regenerate: rm ${a}`);let p=await i.encryptStringAsJwe(t,n);return i.writeFileSync(a,p,{mode:384}),a}o(Np,"writeEncryptedPrivateKey");function Mp(e,t,n){let r=[];if(e.expires===void 0)r.push("--expires <months> is required. Pass --interactive to enter it interactively.");else try{se(e.expires)}catch(i){r.push(i instanceof Error?i.message:String(i))}if(e.kid===void 0)r.push("--kid <identifier> is required. Pass --interactive to enter it interactively.");else try{let i=te(e.kid),s=ve(x().keysDir,`${i}${J}`);n(s)&&!e.force&&r.push(`Key "${i}" already exists. Use --force to overwrite without prompting.`)}catch(i){r.push(i instanceof Error?i.message:String(i))}if(e.email===void 0)r.push("--email <address> is required. Pass --interactive to enter it interactively.");else try{ie(e.email,"--email")}catch(i){r.push(i instanceof Error?i.message:String(i))}return t||r.push("A passphrase is required for encrypted key storage. Pass --interactive to enter it interactively."),r}o(Mp,"collectNonInteractiveErrors");async function Kp(e,t,n=new Date){let{isOS:r,existsSync:i,mkdirSync:s,writeFileSync:a,generateSigningKeyPair:p,storeKeyInKeychain:c,promptExpiryMonths:l,promptKid:d,promptEmail:m,promptPassphrase:y,promptConfirmOverwrite:f}=t,g=e.interactive??!1,S=e.keychain!==!1&&r("macos")&&!e.output;if(!g){let _=Mp(e,S,i);if(_.length>0)throw new Error(_.join(`
166
- `))}let w;e.expires!==void 0?w=se(e.expires):w=await l();let P=Lt(Vr(n,w)),h;e.kid!==void 0?h=te(e.kid):h=await d();let M=ve(x().keysDir,`${h}${J}`),U=i(M);if(U&&!e.force&&!await f(h)){process.stderr.write(`Aborted.
167
- `);return}let j;e.email!==void 0?j=ie(e.email,"--email"):j=await m();let me=S?{kind:"keychain"}:{kind:"file",passphrase:await y()};process.stderr.write(`
159
+ `,c+=p("publicKey",t.green(s)),c+=p("email",t.yellow(e.email)),c+=p("roles",`${t.dim("[")}${t.yellow("developer")}${t.dim("]")}`),c+=p("issuedAt",t.green(n)),c+=p("expiresAt",t.green(i)),c+=p("revokedAt",t.dim("null")),c}o(Bt,"renderRegistryYamlBlock");function io(e){let t=e.trim();if(/^\d{4}-\d{2}-\d{2}$/.test(t))return`${t}T00:00:00Z`;let r=new Date(t);if(Number.isNaN(r.getTime()))throw new Error(`Invalid date '${e}': expected YYYY-MM-DD or ISO-8601 instant`);return r.toISOString()}o(io,"toIsoInstant");import Bp from"clipboardy";function so(e){return Bp.write(e)}o(so,"copyToClipboard");function Wp(e){return{writeFileSync:e.writeFileSync??qp,mkdirSync:e.mkdirSync??Yp,existsSync:e.existsSync??Gp,generateSigningKeyPair:e.generateSigningKeyPair??Jp,encryptStringAsJwe:e.encryptStringAsJwe??_n,storeKeyInKeychain:e.storeKeyInKeychain??Rr,isOS:e.isOS??(t=>_(t)),promptKid:e.promptKid??Cr,promptExpiryMonths:e.promptExpiryMonths??kr,promptEmail:e.promptEmail??br,promptPassphrase:e.promptPassphrase??Pr,promptConfirmOverwrite:e.promptConfirmOverwrite??xr,discoverLocalKeys:e.discoverLocalKeys??(()=>Te()),promptZendeskAction:e.promptZendeskAction??Er,openUrl:e.openUrl??(t=>zp(t)),copyToClipboard:e.copyToClipboard??so}}o(Wp,"resolveDeps");function po(e,t={}){let r=Wp(t),n=e.command("keys").description("Manage code signing keys");n.command("generate").description("Generate an Ed25519 keypair for code signing").option("-o, --output <path>","Encrypted private key output path (forces file storage even on macOS)").option("--no-keychain",`Skip macOS Keychain and write a passphrase-encrypted private key under ${D().keysDir} instead`).option("-e, --expires <months>",`Validity in months (${1}-${12}); skips the interactive prompt`).option("--email <address>","Email address for the registry entry; skips the interactive prompt").option("--kid <identifier>","Signing identity name for the registry (e.g. jsmith-dev-001); skips the interactive prompt").option("--force","Overwrite an existing key without prompting for confirmation").option("--copy-link","Copy the Zendesk registration link to the clipboard without prompting").option("--interactive","Prompt for any required flags that are not supplied",!1).action(i=>ec(i,r)),n.command("list").description("List local signing identities and their storage location").action(()=>Xp(r))}o(po,"registerKeysCommand");async function Xp(e){let t=await e.discoverLocalKeys();if(t.length===0){process.stdout.write(`No signing identities found.
160
+ `),process.stdout.write(`Run \`cognite keys generate\` to create one (storage: ${D().keysDir}).
161
+ `);return}let r=["KID","SOURCE","EMAIL"],n=t.map(a=>[a.kid,$e(a.source),a.email??"\u2014"]),i=r.map((a,p)=>Math.max(a.length,...n.map(c=>c[p].length))),s=o(a=>a.map((p,c)=>p.padEnd(i[c])).join(" ").trimEnd(),"fmt");process.stdout.write(`${s(r)}
162
+ `);for(let a of n)process.stdout.write(`${s(a)}
163
+ `)}o(Xp,"handleList");function ao(e,t,r){let n=Ee(D().keysDir,`${e}${X}`);return r.mkdirSync(Gt(n),{recursive:!0}),r.writeFileSync(n,t),n}o(ao,"writePublicKey");async function Zp(e,t,r,n,i,{force:s=!1}={}){let a=n??Ee(D().keysDir,`${e}${at}`);if(i.mkdirSync(Gt(a),{recursive:!0}),!s&&i.existsSync(a))throw new Error(`Refusing to overwrite existing key at ${a}. Delete it first if you really want to regenerate: rm ${a}`);let p=await i.encryptStringAsJwe(t,r);return i.writeFileSync(a,p,{mode:384}),a}o(Zp,"writeEncryptedPrivateKey");function Qp(e,t,r){let n=[];if(e.expires===void 0)n.push("--expires <months> is required. Pass --interactive to enter it interactively.");else try{pe(e.expires)}catch(i){n.push(i instanceof Error?i.message:String(i))}if(e.kid===void 0)n.push("--kid <identifier> is required. Pass --interactive to enter it interactively.");else try{let i=ne(e.kid),s=Ee(D().keysDir,`${i}${X}`);r(s)&&!e.force&&n.push(`Key "${i}" already exists. Use --force to overwrite without prompting.`)}catch(i){n.push(i instanceof Error?i.message:String(i))}if(e.email===void 0)n.push("--email <address> is required. Pass --interactive to enter it interactively.");else try{ae(e.email,"--email")}catch(i){n.push(i instanceof Error?i.message:String(i))}return t||n.push("A passphrase is required for encrypted key storage. Pass --interactive to enter it interactively."),n}o(Qp,"collectNonInteractiveErrors");async function ec(e,t,r=new Date){let{isOS:n,existsSync:i,mkdirSync:s,writeFileSync:a,generateSigningKeyPair:p,storeKeyInKeychain:c,promptExpiryMonths:l,promptKid:d,promptEmail:m,promptPassphrase:y,promptConfirmOverwrite:S}=t,u=e.interactive??!1,f=e.keychain!==!1&&n("macos")&&!e.output;if(!u){let j=Qp(e,f,i);if(j.length>0)throw new Error(j.join(`
164
+ `))}let w;e.expires!==void 0?w=pe(e.expires):w=await l();let E=Vt(Qn(r,w)),h;e.kid!==void 0?h=ne(e.kid):h=await d();let M=Ee(D().keysDir,`${h}${X}`),H=i(M);if(H&&!e.force&&!await S(h)){process.stderr.write(`Aborted.
165
+ `);return}let P;e.email!==void 0?P=ae(e.email,"--email"):P=await m();let U=f?{kind:"keychain"}:{kind:"file",passphrase:await y()};process.stderr.write(`
168
166
  Generating Ed25519 keypair...
169
167
 
170
- `);let{privateKeyPem:C,publicKeyPem:V}=await p(h);if(me.kind==="keychain"){await c(h,C);let _=Xr(h,V,t);process.stderr.write(`Public key: ${_}
168
+ `);let{privateKeyPem:k,publicKeyPem:G}=await p(h),se=v.from(k);if(U.kind==="keychain"){await c(h,se);let j=ao(h,G,t);process.stderr.write(`Public key: ${j}
171
169
  `),process.stderr.write(`Private key: macOS Keychain (service: cognite-dune, account: ${h})
172
- `)}else{let _=await Np(h,C,me.passphrase,e.output,t,{force:U}),So=Xr(h,V,t);process.stderr.write(`Public key: ${So}
173
- `),process.stderr.write(`Private key: ${_} (JWE, AES-256-GCM, PBKDF2-SHA512 x${Rt.toLocaleString()})
174
- `),r("macos")||process.stderr.write(` (macOS Keychain integration is the default on darwin; on this OS we use the file.)
175
- `)}let oe=ve(x().keysDir,`${h}${nt}`);s(Mt(oe),{recursive:!0}),a(oe,JSON.stringify({email:j}));let k=Gr(process.stderr);process.stderr.write(`
176
- Signing identity (kid): ${k.green(h)}
177
- `),process.stderr.write(`Expires: ${P} (${w} month${w===1?"":"s"} from today)
178
- `);let W={kid:h,publicKeyPem:V,email:j,expires:P};g||(process.stderr.write(`
170
+ `)}else{let j=await Zp(h,se,U.passphrase,e.output,t,{force:H}),Io=ao(h,G,t);process.stderr.write(`Public key: ${Io}
171
+ `),process.stderr.write(`Private key: ${j} (JWE, AES-256-GCM, PBKDF2-SHA512 x${Nt.toLocaleString()})
172
+ `),n("macos")||process.stderr.write(` (macOS Keychain integration is the default on darwin; on this OS we use the file.)
173
+ `)}let A=Ee(D().keysDir,`${h}${pt}`);s(Gt(A),{recursive:!0}),a(A,JSON.stringify({email:P}));let Y=to(process.stderr);process.stderr.write(`
174
+ Signing identity (kid): ${Y.green(h)}
175
+ `),process.stderr.write(`Expires: ${E} (${w} month${w===1?"":"s"} from today)
176
+ `);let ke={kid:h,publicKeyPem:G,email:P,expires:E};u||(process.stderr.write(`
179
177
  Key registration data:
180
178
 
181
- `),process.stderr.write(Nt(W,k,n)));let X=Kr(h,j,P,Nt(W,we,n));process.stderr.write(`
182
- ${k.bold("Next:")}
179
+ `),process.stderr.write(Bt(ke,Y,r)));let Q=Wn(h,P,E,Bt(ke,Ce,r));process.stderr.write(`
180
+ ${Y.bold("Next:")}
183
181
  `),process.stderr.write(` 1. Register your signing key \u2014 submit this pre-filled Zendesk request:
184
- `);let Z;if(e.copyLink?Z="clipboard":g?Z=await t.promptZendeskAction():Z=null,Z==="browser")try{await t.openUrl(X),process.stderr.write(` Opening in browser...
185
- `)}catch{process.stderr.write(` URL: ${X}
186
- `)}else if(Z==="clipboard"){let _=!1;try{await t.copyToClipboard(X),_=!0}catch{}process.stderr.write(_&&!e.copyLink?` Link copied to clipboard.
187
- `:` URL: ${X}
188
- `)}else process.stderr.write(` URL: ${X}
182
+ `);let ee;if(e.copyLink?ee="clipboard":u?ee=await t.promptZendeskAction():ee=null,ee==="browser")try{await t.openUrl(Q),process.stderr.write(` Opening in browser...
183
+ `)}catch{process.stderr.write(` URL: ${Q}
184
+ `)}else if(ee==="clipboard"){let j=!1;try{await t.copyToClipboard(Q),j=!0}catch{}process.stderr.write(j&&!e.copyLink?` Link copied to clipboard.
185
+ `:` URL: ${Q}
186
+ `)}else process.stderr.write(` URL: ${Q}
189
187
  `);process.stderr.write(`
190
188
  2. Once your key is approved, sign your Dune app:
191
- `),process.stderr.write(` ${k.cyan(`cognite sign -s ${h}`)}
192
- `)}o(Kp,"handleGenerate");import{performance as Qr}from"perf_hooks";var eo=1e3,Ge;function Hp(){Ge=Qr.now()}o(Hp,"markActionStart");function jp(){Ge=void 0}o(jp,"resetActionStart");function Vp(){if(Ge!==void 0)return Math.max(0,Math.round(Qr.now()-Ge))}o(Vp,"snapshotActionDurationMs");function to(){let e=Vp();return jp(),{...e!==void 0&&{actionDurationMs:e}}}o(to,"takePerformanceFields");var Bp=new Set(["baseUrl","url","project","deployment","source","path","name","displayName","description"]);function Gp(e){return Object.fromEntries(Object.entries(e).map(([t,n])=>typeof n=="boolean"?[t,n]:Bp.has(t)?[t,n]:[t,"[REDACTED]"]))}o(Gp,"sanitize");function qp(e){let t=[],n=e;for(;n;)n.parent&&t.unshift(n.name()),n=n.parent;return t.join(" ")}o(qp,"getCommandPath");function no(e){try{let t=e(process.cwd());return{appExternalId:t.externalId,appVersionTag:t.versionTag}}catch{return{}}}o(no,"tryLoadAppConfig");function Kt(e){return e.filter(t=>!t.startsWith("-")).join(" ")||"unknown"}o(Kt,"commandFromArgv");function ro(e,t,n=v){e.hook("preAction",()=>{Hp()}),e.hook("postAction",async(r,i)=>{try{let s={command:qp(i),options:Gp(i.opts()),success:!0,...no(n),...to()};t.track("Flows.CLI.Command",{...s}),await t.flush(eo)}catch{}})}o(ro,"instrument");async function oo(e,t,n=v){try{let r={command:Kt(t),options:{},success:!1,...no(n),...to()};e.track("Flows.CLI.Command",{...r}),await e.flush(eo)}catch{}}o(oo,"trackFailure");var Yp="ERR_USE_AFTER_CLOSE";function so(e){return e instanceof Error&&"code"in e&&e.code===Yp}o(so,"isReadlineClosedError");function Jp(e){let t=Object.getPrototypeOf(e);return t===Object.prototype||t===null}o(Jp,"isPlainObject");function Ht(e){return e==null||so(e)?!0:e instanceof Error?!1:!!(typeof e=="object"&&e!==null&&Jp(e)&&Object.keys(e).length===0)}o(Ht,"isPromptCancel");var io=!1;function ao(){io||(io=!0,process.on("uncaughtException",e=>{so(e)&&(console.error(`
193
- Cancelled.`),process.exit(130)),console.error(e),process.exit(1)}),process.on("unhandledRejection",e=>{Ht(e)&&(console.error(`
194
- Cancelled.`),process.exit(130)),console.error(e),process.exit(1)}))}o(ao,"installCancelHandler");import{homedir as zp,userInfo as Wp}from"os";var Xp=zp(),Zp=(()=>{try{return Wp().username}catch{return""}})();function le(e,t=Xp){if(!t||t==="/")return e;let n=e.replaceAll(t,"~"),r=t.replaceAll("\\","/");return r!==t&&(n=n.replaceAll(r,"~")),n=n.replace(/(?<![A-Za-z0-9_])[A-Za-z]:[/\\]Users[/\\][^\s/\\]+(?=[/\\]|$)/g,"~"),n=n.replace(/(?<![A-Za-z0-9_])\/(?:Users|home)\/[^\s/]+(?=[/\\]|$)/g,"~"),n}o(le,"redactHomedir");function Qp(e,t=Zp){if(!t||t.length<3)return e;let n=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),r=new RegExp("(^|[\\/\\s:])"+n+"(?=[\\/\\s:.@]|$)","g");return e.replace(r,"$1<user>")}o(Qp,"redactUsername");var ec=1e3,tc="https://0a118cb02e3be57b1838bcfb5783a2bf@o4508040730968064.ingest.de.sentry.io/4510719268290640",nc={captureError:o(async()=>{},"captureError"),flush:o(async()=>{},"flush")};function rc(e){return e.packageName&&e.cliVersion?`${e.packageName}@${e.cliVersion}`:e.cliVersion??"unknown"}o(rc,"buildRelease");var oc="192.0.2.0";function ic(e){return e?.map(t=>({...t,...t.filename!==void 0&&{filename:le(t.filename)},...t.abs_path!==void 0&&{abs_path:le(t.abs_path)},...t.module!==void 0&&{module:le(t.module)}}))}o(ic,"scrubStackFrames");function jt(e){return Qp(le(e))}o(jt,"redactPii");function sc(e){let t={...e.user,email:void 0,username:void 0,ip_address:oc,id:void 0},n=e.exception?.values?.map(s=>({...s,value:s.value!==void 0?jt(s.value):s.value,...s.stacktrace!==void 0&&{stacktrace:{...s.stacktrace,frames:ic(s.stacktrace.frames)}}})),r=e.contexts?.cli,i=r!==void 0?Object.fromEntries(Object.entries(r).map(([s,a])=>[s,typeof a=="string"?jt(a):a])):void 0;return{...e,message:e.message!==void 0?jt(e.message):e.message,user:t,server_name:void 0,...n!==void 0&&{exception:{...e.exception,values:n}},...i!==void 0&&{contexts:{...e.contexts,cli:i}}}}o(sc,"scrubPii");function po(e={}){let t=e.env??process.env;if(ft(t))return nc;let n=rc(e),r="production",i=null,s=null;function a(){return{dsn:tc,release:n,environment:r,defaultIntegrations:!1,integrations:[],sendDefaultPii:!1,enableLogs:!1,initialScope:{tags:{component:"cli",applicationId:fe},contexts:{cli:{applicationId:fe,node:process.version,platform:process.platform}}},beforeSend:sc}}o(a,"buildInitOptions");async function p(){return i||(s||(s=(async()=>{try{let c=e.sdk??await import("@sentry/node");return c.init(a()),i=c,c}catch{return null}})()),s)}return o(p,"ensureSdk"),{async captureError(c,l){try{let d=await p();if(!d)return;d.captureException(c,ac(c,l))}catch{}},async flush(c=ec){try{if(!i)return;await i.flush(c)}catch{}}}}o(po,"createErrorReporter");function ac(e,t){let n={level:"fatal"},r={applicationId:fe,node:process.version,platform:process.platform};if(t?.command&&(n.tags={command:t.command},r.command=t.command),Yt(e)&&(e.hint&&(r.hint=e.hint),e.helpUrl&&(r.helpUrl=e.helpUrl),r.shouldReport=e.shouldReport),n.contexts={cli:r},Jt(e)&&(n.contexts.http={url:e.requestUrl!==void 0?le(e.requestUrl):void 0,status_code:e.httpStatusCode},e.responseBody!==void 0)){let i=typeof e.responseBody=="string"?e.responseBody:JSON.stringify(e.responseBody);n.extra={responseBody:le(i)}}return n}o(ac,"buildCaptureContext");import{mkdirSync as pc,readFileSync as cc,writeFileSync as lc}from"fs";import{homedir as dc}from"os";import{resolve as qe}from"path";import{debuglog as mc}from"util";import{lt as uc,parse as co}from"semver";var gc="https://registry.npmjs.org/@cognite/cli/latest",fc=1500,lo="upgrade-check.json",mo=qe(process.env.XDG_CACHE_HOME||qe(dc(),".cache"),"@cognite","cli"),Vt=mc("cognite-flows");function yc(e,t){return!e||!t||!co(e)||!co(t)?!1:uc(e,t)}o(yc,"isOutdated");async function hc({timeout:e=fc,registryUrl:t=gc,fetchImpl:n=globalThis.fetch}={}){if(typeof n!="function")return null;try{let r=await n(t,{signal:AbortSignal.timeout(e)});if(!r?.ok)return null;let i=await r.json();return typeof i?.version=="string"?i.version:null}catch(r){return Vt("fetchLatestVersion failed (%s): %O",t,r),null}}o(hc,"fetchLatestVersion");function Sc(e=mo,t=864e5){try{let n=cc(qe(e,lo),"utf-8"),r=JSON.parse(n);return typeof r.latest!="string"||typeof r.fetchedAt!="number"||Date.now()-r.fetchedAt>t?null:{latest:r.latest,fetchedAt:r.fetchedAt}}catch(n){return Vt("readUpgradeCheckCache failed (%s): %O",e,n),null}}o(Sc,"readUpgradeCheckCache");function wc(e,t){try{pc(e,{recursive:!0});let n={latest:t,fetchedAt:Date.now()};lc(qe(e,lo),JSON.stringify(n))}catch(n){Vt("writeUpgradeCheckCache failed (%s): %O",e,n)}}o(wc,"writeUpgradeCheckCache");async function vc({cacheDir:e=mo,...t}={}){let n=await hc(t);n&&wc(e,n)}o(vc,"startBackgroundUpgradeCheck");function uo(e,{onOutdated:t,cacheDir:n,...r}={}){let i=Sc(n);if(i){yc(e,i.latest)&&t?.(e,i.latest);return}vc({cacheDir:n,...r})}o(uo,"preActionUpgradeCheck");import{default as nh,chalkStderr as go}from"chalk";function fo(e,t){let n=[`\u26A0 Update available: ${e} -> ${t}`," Run npx @cognite/cli@latest"],r=Math.max(...n.map(p=>[...p].length))+2,i="\u2500".repeat(r),s=o(p=>`\u2502 ${p}${" ".repeat(r-1-[...p].length)}\u2502`,"pad"),a=[`\u250C${i}\u2510`,...n.map(s),`\u2514${i}\u2518`].join(`
195
- `);return go.bold.yellow(a)}o(fo,"formatUpgradeWarning");function kc(e){return e instanceof Error&&"code"in e&&typeof e.code=="string"&&e.code==="DEP0040"}o(kc,"isDep0040Warning");var Gt=process,bc=Gt.emit.bind(Gt);Gt.emit=function(e,...t){return e==="warning"&&kc(t[0])?!1:bc(e,...t)};ao();var de=new Ec;de.name("cognite").description("Build and deploy React apps to Cognite Data Fusion").version("1.6.0").showHelpAfterError().configureOutput({writeOut:o(e=>Cc(1,e),"writeOut")});de.hook("preAction",()=>{uo("1.6.0",{onOutdated:o((e,t)=>{console.warn(`
196
- ${fo(e,t)}
197
- `)},"onOutdated")})});jr(de);Zr(de);var ho=Te({packageName:"@cognite/cli",cliVersion:"1.6.0"}),yo=po({packageName:"@cognite/cli",cliVersion:"1.6.0"});ro(de,ho);var Bt=process.argv.slice(2);de.parseAsync(Bt,{from:"user"}).catch(async e=>{await oo(ho,Bt),Ht(e)&&(console.error(`
198
- Cancelled.`),process.exit(130)),(!(e instanceof u)||e.shouldReport)&&(await yo.captureError(e,{command:Kt(Bt)}),await yo.flush());let t=e instanceof Error?e.message:String(e);console.error(`\u274C ${t}`),e instanceof u&&(e.hint||e.helpUrl)&&(console.error(""),e.hint&&console.error(`\u{1F4A1} ${e.hint}`),e.helpUrl&&console.error(`\u{1F4DA} ${e.helpUrl}`)),process.exit(1)});
189
+ `),process.stderr.write(` ${Y.cyan(`cognite sign -s ${h}`)}
190
+ `)}o(ec,"handleGenerate");import{performance as co}from"perf_hooks";var lo=1e3,ze;function tc(){ze=co.now()}o(tc,"markActionStart");function rc(){ze=void 0}o(rc,"resetActionStart");function nc(){if(ze!==void 0)return Math.max(0,Math.round(co.now()-ze))}o(nc,"snapshotActionDurationMs");function mo(){let e=nc();return rc(),{...e!==void 0&&{actionDurationMs:e}}}o(mo,"takePerformanceFields");var oc=new Set(["baseUrl","url","project","deployment","source","path","name","displayName","description"]);function ic(e){return Object.fromEntries(Object.entries(e).map(([t,r])=>typeof r=="boolean"?[t,r]:oc.has(t)?[t,r]:[t,"[REDACTED]"]))}o(ic,"sanitize");function sc(e){let t=[],r=e;for(;r;)r.parent&&t.unshift(r.name()),r=r.parent;return t.join(" ")}o(sc,"getCommandPath");function uo(e){try{let t=e(process.cwd()),r=t.deployments[0];return{appName:t.name,appExternalId:t.externalId,appVersionTag:t.versionTag,...r&&{cogniteOrg:r.org,cogniteProject:r.project}}}catch{return{}}}o(uo,"tryLoadAppConfig");function Yt(e){return e.filter(t=>!t.startsWith("-")).join(" ")||"unknown"}o(Yt,"commandFromArgv");function go(e,t,r=C){e.hook("preAction",()=>{tc()}),e.hook("postAction",async(n,i)=>{try{let s={command:sc(i),options:ic(i.opts()),success:!0,...uo(r),...mo()};t.track("Flows.CLI.Command",{...s}),await t.flush(lo)}catch{}})}o(go,"instrument");async function fo(e,t,r=C){try{let n={command:Yt(t),options:{},success:!1,...uo(r),...mo()};e.track("Flows.CLI.Command",{...n}),await e.flush(lo)}catch{}}o(fo,"trackFailure");var ac="ERR_USE_AFTER_CLOSE";function ho(e){return e instanceof Error&&"code"in e&&e.code===ac}o(ho,"isReadlineClosedError");function pc(e){let t=Object.getPrototypeOf(e);return t===Object.prototype||t===null}o(pc,"isPlainObject");function qt(e){return e==null||ho(e)?!0:e instanceof Error?!1:!!(typeof e=="object"&&e!==null&&pc(e)&&Object.keys(e).length===0)}o(qt,"isPromptCancel");var yo=!1;function So(){yo||(yo=!0,process.on("uncaughtException",e=>{ho(e)&&(console.error(`
191
+ Cancelled.`),process.exit(130)),console.error(e),process.exit(1)}),process.on("unhandledRejection",e=>{qt(e)&&(console.error(`
192
+ Cancelled.`),process.exit(130)),console.error(e),process.exit(1)}))}o(So,"installCancelHandler");import{homedir as cc,userInfo as lc}from"os";var dc=cc(),mc=(()=>{try{return lc().username}catch{return""}})();function me(e,t=dc){if(!t||t==="/")return e;let r=e.replaceAll(t,"~"),n=t.replaceAll("\\","/");return n!==t&&(r=r.replaceAll(n,"~")),r=r.replace(/(?<![A-Za-z0-9_])[A-Za-z]:[/\\]Users[/\\][^\s/\\]+(?=[/\\]|$)/g,"~"),r=r.replace(/(?<![A-Za-z0-9_])\/(?:Users|home)\/[^\s/]+(?=[/\\]|$)/g,"~"),r}o(me,"redactHomedir");function uc(e,t=mc){if(!t||t.length<3)return e;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),n=new RegExp("(^|[\\/\\s:])"+r+"(?=[\\/\\s:.@]|$)","g");return e.replace(n,"$1<user>")}o(uc,"redactUsername");var gc=/(['"]?(?:access_token|accessToken|client_secret|clientSecret|refresh_token|refreshToken|password|token|passphrase)['"]?\s*:\s*)(?:"(?:\\.|[^\\"])*"|'(?:\\.|[^\\'])*')/gi;function wo(e){return e.replace(gc,(t,r)=>{let n=t[r.length];return`${r}${n}[REDACTED]${n}`})}o(wo,"redactCredentials");var fc=1e3,yc="https://0a118cb02e3be57b1838bcfb5783a2bf@o4508040730968064.ingest.de.sentry.io/4510719268290640",hc={captureError:o(async()=>{},"captureError"),flush:o(async()=>{},"flush")};function Sc(e){return e.packageName&&e.cliVersion?`${e.packageName}@${e.cliVersion}`:e.cliVersion??"unknown"}o(Sc,"buildRelease");var wc="192.0.2.0";function vc(e){return e?.map(t=>({...t,...t.filename!==void 0&&{filename:me(t.filename)},...t.abs_path!==void 0&&{abs_path:me(t.abs_path)},...t.module!==void 0&&{module:me(t.module)}}))}o(vc,"scrubStackFrames");function Jt(e){return wo(uc(me(e)))}o(Jt,"redactPii");function Cc(e){let t={...e.user,email:void 0,username:void 0,ip_address:wc,id:void 0},r=e.exception?.values?.map(s=>({...s,value:s.value!==void 0?Jt(s.value):s.value,...s.stacktrace!==void 0&&{stacktrace:{...s.stacktrace,frames:vc(s.stacktrace.frames)}}})),n=e.contexts?.cli,i=n!==void 0?Object.fromEntries(Object.entries(n).map(([s,a])=>[s,typeof a=="string"?Jt(a):a])):void 0;return{...e,message:e.message!==void 0?Jt(e.message):e.message,user:t,server_name:void 0,...r!==void 0&&{exception:{...e.exception,values:r}},...i!==void 0&&{contexts:{...e.contexts,cli:i}}}}o(Cc,"scrubPii");function vo(e={}){let t=e.env??process.env;if(Ct(t))return hc;let r=Sc(e),n="production",i=null,s=null;function a(){return{dsn:yc,release:r,environment:n,defaultIntegrations:!1,integrations:[],sendDefaultPii:!1,enableLogs:!1,initialScope:{tags:{component:"cli",applicationId:he},contexts:{cli:{applicationId:he,node:process.version,platform:process.platform}}},beforeSend:Cc}}o(a,"buildInitOptions");async function p(){return i||(s||(s=(async()=>{try{let c=e.sdk??await import("@sentry/node");return c.init(a()),i=c,c}catch{return null}})()),s)}return o(p,"ensureSdk"),{async captureError(c,l){try{let d=await p();if(!d)return;d.captureException(c,Ec(c,l))}catch{}},async flush(c=fc){try{if(!i)return;await i.flush(c)}catch{}}}}o(vo,"createErrorReporter");function Ec(e,t){let r={level:"fatal"},n={applicationId:he,node:process.version,platform:process.platform};if(t?.command&&(r.tags={command:t.command},n.command=t.command),or(e)&&(e.hint&&(n.hint=e.hint),e.helpUrl&&(n.helpUrl=e.helpUrl),n.shouldReport=e.shouldReport),r.contexts={cli:n},ir(e)&&(r.contexts.http={url:e.requestUrl!==void 0?me(e.requestUrl):void 0,status_code:e.httpStatusCode},e.responseBody!==void 0)){let i=typeof e.responseBody=="string"?e.responseBody:JSON.stringify(e.responseBody);r.extra={responseBody:wo(me(i))}}return r}o(Ec,"buildCaptureContext");import{mkdirSync as kc,readFileSync as bc,writeFileSync as Pc}from"fs";import{homedir as xc}from"os";import{resolve as We}from"path";import{debuglog as Ac}from"util";import{lt as Dc,parse as Co}from"semver";var Ic="https://registry.npmjs.org/@cognite/cli/latest",$c=1500,Eo="upgrade-check.json",ko=We(process.env.XDG_CACHE_HOME||We(xc(),".cache"),"@cognite","cli"),zt=Ac("cognite-flows");function Tc(e,t){return!e||!t||!Co(e)||!Co(t)?!1:Dc(e,t)}o(Tc,"isOutdated");async function Rc({timeout:e=$c,registryUrl:t=Ic,fetchImpl:r=globalThis.fetch}={}){if(typeof r!="function")return null;try{let n=await r(t,{signal:AbortSignal.timeout(e)});if(!n?.ok)return null;let i=await n.json();return typeof i?.version=="string"?i.version:null}catch(n){return zt("fetchLatestVersion failed (%s): %O",t,n),null}}o(Rc,"fetchLatestVersion");function Fc(e=ko,t=864e5){try{let r=bc(We(e,Eo),"utf-8"),n=JSON.parse(r);return typeof n.latest!="string"||typeof n.fetchedAt!="number"||Date.now()-n.fetchedAt>t?null:{latest:n.latest,fetchedAt:n.fetchedAt}}catch(r){return zt("readUpgradeCheckCache failed (%s): %O",e,r),null}}o(Fc,"readUpgradeCheckCache");function Oc(e,t){try{kc(e,{recursive:!0});let r={latest:t,fetchedAt:Date.now()};Pc(We(e,Eo),JSON.stringify(r))}catch(r){zt("writeUpgradeCheckCache failed (%s): %O",e,r)}}o(Oc,"writeUpgradeCheckCache");async function Uc({cacheDir:e=ko,...t}={}){let r=await Rc(t);r&&Oc(e,r)}o(Uc,"startBackgroundUpgradeCheck");function bo(e,{onOutdated:t,cacheDir:r,...n}={}){let i=Fc(r);if(i){Tc(e,i.latest)&&t?.(e,i.latest);return}Uc({cacheDir:r,...n})}o(bo,"preActionUpgradeCheck");import{default as Dh,chalkStderr as Po}from"chalk";function xo(e,t){let r=[`\u26A0 Update available: ${e} -> ${t}`," Run npx @cognite/cli@latest"],n=Math.max(...r.map(p=>[...p].length))+2,i="\u2500".repeat(n),s=o(p=>`\u2502 ${p}${" ".repeat(n-1-[...p].length)}\u2502`,"pad"),a=[`\u250C${i}\u2510`,...r.map(s),`\u2514${i}\u2518`].join(`
193
+ `);return Po.bold.yellow(a)}o(xo,"formatUpgradeWarning");function Nc(e){return e instanceof Error&&"code"in e&&typeof e.code=="string"&&e.code==="DEP0040"}o(Nc,"isDep0040Warning");var Xt=process,Kc=Xt.emit.bind(Xt);Xt.emit=function(e,...t){return e==="warning"&&Nc(t[0])?!1:Kc(e,...t)};So();var ue=new Lc;ue.name("cognite").description("Build and deploy React apps to Cognite Data Fusion").version("1.7.0").showHelpAfterError().configureOutput({writeOut:o(e=>_c(1,e),"writeOut")});ue.hook("preAction",()=>{bo("1.7.0",{onOutdated:o((e,t)=>{console.warn(`
194
+ ${xo(e,t)}
195
+ `)},"onOutdated")})});Zn(ue);po(ue);var Do=Le({packageName:"@cognite/cli",cliVersion:"1.7.0"}),Ao=vo({packageName:"@cognite/cli",cliVersion:"1.7.0"});go(ue,Do);var Wt=process.argv.slice(2);ue.parseAsync(Wt,{from:"user"}).catch(async e=>{await fo(Do,Wt),qt(e)&&(console.error(`
196
+ Cancelled.`),process.exit(130)),(!(e instanceof g)||e.shouldReport)&&(await Ao.captureError(e,{command:Yt(Wt)}),await Ao.flush());let t=e instanceof Error?e.message:String(e);console.error(`\u274C ${t}`),e instanceof g&&(e.hint||e.helpUrl)&&(console.error(""),e.hint&&console.error(`\u{1F4A1} ${e.hint}`),e.helpUrl&&console.error(`\u{1F4DA} ${e.helpUrl}`)),process.exit(1)});