@cognite/cli 1.8.0-alpha.263 → 1.8.0-alpha.267

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/dist/cli/cli.js +78 -78
  2. package/package.json +1 -1
package/dist/cli/cli.js CHANGED
@@ -1,25 +1,25 @@
1
1
  #!/usr/bin/env node
2
- var ms=Object.defineProperty;var zn=e=>{throw TypeError(e)};var o=(e,t)=>ms(e,"name",{value:t,configurable:!0});var Wn=(e,t,n)=>t.has(e)||zn("Cannot "+n);var He=(e,t,n)=>(Wn(e,t,"read from private field"),n?n.call(e):t.get(e)),Jn=(e,t,n)=>t.has(e)?zn("Cannot add the same private member more than once"):t instanceof WeakSet?t.add(e):t.set(e,n),Xn=(e,t,n,r)=>(Wn(e,t,"write to private field"),r?r.call(e,n):t.set(e,n),n);import{writeSync as lm}from"fs";import{Command as dm}from"commander";var $t=class $t extends Error{constructor(t,n={}){super(t),this.name="HintedError",n.cause!==void 0&&(this.cause=n.cause);let r=this.deriveDefaults(n);this.hint=n.hint??r.hint,this.helpUrl=n.helpUrl??r.helpUrl,this.shouldReport=n.shouldReport??!0}deriveDefaults(t){return{hint:hs(t.cause)}}};o($t,"HintedError");var m=$t;function Qn(e){return e instanceof m}o(Qn,"isHintedError");var Zn="https://docs.cognite.com/cdf/access/",fs="https://status.cognite.com";function gs(e){switch(e){case 401:return{hint:"Your credentials are invalid or expired. Check your client ID and secret.",helpUrl:Zn};case 403:return{hint:"You don't have the required CDF capabilities. Please contact your CDF admin.",helpUrl:Zn};case 413:return{hint:"The deployment exceeds the App Hosting size limit. Reduce the build output \u2014 remove unused assets, code-split bundles, or strip source maps."};case 429:return{hint:"You are being rate limited. Wait a few moments and retry. If this persists, contact CDF support."};case 500:case 502:case 503:case 504:return{hint:"CDF service error. The issue is on the server side. Check the status page and retry shortly.",helpUrl:fs};default:return{}}}o(gs,"defaultHintForStatus");var Ot=class Ot extends m{constructor(t,n){super(t,n),this.name="HintedHttpError",this.httpStatusCode=n.httpStatusCode,this.requestUrl=n.requestUrl,this.responseBody=n.responseBody}deriveDefaults(t){let{httpStatusCode:n}=t,r=gs(n),i=super.deriveDefaults(t);return{hint:r.hint??i.hint,helpUrl:r.helpUrl}}};o(Ot,"HintedHttpError");var pe=Ot;function er(e){return e instanceof pe}o(er,"isHintedHttpError");function ys(e,t){if(e)switch(e){case"ENOTFOUND":return t.hostname?`DNS lookup failed for ${t.hostname}. Check your network, VPN, or proxy settings.`:"DNS lookup failed. Check your network, VPN, or proxy settings.";case"ECONNREFUSED":return t.hostname&&t.port?`Connection refused by ${t.hostname}:${t.port}. The service may be down or the port may be wrong.`:"Connection refused. The service may be down or the port may be wrong.";case"ECONNRESET":return"Connection was reset. The server closed the connection unexpectedly; check for proxy/firewall interference and retry.";case"ETIMEDOUT":return"Connection timed out. Check your network, VPN, or proxy settings, and retry.";case"EAI_AGAIN":return"Temporary DNS failure. Retry shortly; if it persists, check your DNS configuration.";case"CERT_HAS_EXPIRED":case"UNABLE_TO_VERIFY_LEAF_SIGNATURE":case"SELF_SIGNED_CERT_IN_CHAIN":return"TLS certificate validation failed. Check system clock and CA trust store; if you use a corporate proxy, ensure its root cert is trusted.";case"EACCES":return t.path?`Permission denied: ${t.path}. Check file ownership and permissions.`:"Permission denied. Check file ownership and permissions.";case"ENOENT":return t.path?`File or directory not found: ${t.path}.`:"File or directory not found.";case"EISDIR":return t.path?`Expected a file but found a directory: ${t.path}.`:"Expected a file but found a directory.";case"ENOSPC":return"No space left on device. Free up disk space and retry.";case"EADDRINUSE":return t.port?`Port ${t.port} is already in use. Stop the process using it or pick a different port.`:"Address is already in use. Stop the conflicting process or change the port.";case"EMFILE":case"ENFILE":return"Too many open files. Close other programs or raise the file descriptor limit.";default:return}}o(ys,"hintForErrno");function hs(e){let t=e,n=new Set;for(;t!=null&&!n.has(t)&&(n.add(t),typeof t=="object");){let r=t,i=ys(r.code,r);if(i!==void 0)return i;t=r.cause}}o(hs,"hintForCause");function E(e=process.env){return e.COGNITE_ALPHA_ENABLE_SESSION_AUTH?.trim().toLowerCase()==="true"}o(E,"isSessionAuthEnabled");import{existsSync as aa,readFileSync as pa}from"fs";import{join as ca,resolve as Qe}from"path";import{verifyBundle as la}from"@cognite/app-sdk/codesigning";import{decodeProtectedHeader as da}from"jose";import Lt from"enquirer";import{email as Ss,pipe as ws,safeParse as vs,string as Cs}from"valibot";var As=ws(Cs(),Ss());function Se(e,t="email"){let n=e.trim();if(!n)throw new Error(`${t} is required`);if(!vs(As,n).success)throw new Error(`${t} must look like an email (user@example.com); got "${e}"`);return n}o(Se,"parseEmail");function we(e,t="--expires"){let n=Number(e);if(!Number.isInteger(n)||n<1||n>12)throw new Error(`${t} must be an integer between 1 and 12 (months); got "${e}"`);return n}o(we,"parseExpiryMonths");import{execFileSync as Ke}from"child_process";import{execFileSync as Es}from"child_process";function je(e={}){let{execFileSync:t=Es}=e;try{return t("git",["--version"],{stdio:"ignore"}),!0}catch{return!1}}o(je,"isGitInstalled");function q(e={}){if(!je(e))throw new m("Git is not installed or not found on PATH.",{hint:"Install Git (https://git-scm.com) and ensure it is on your PATH, then try again.",shouldReport:!1})}o(q,"throwIfGitMissing");function Be(e,t={}){let{execFileSync:n=Ke}=t;try{return n("git",["-C",e,"status"],{stdio:"ignore"}),!0}catch{return!1}}o(Be,"isInsideGitRepo");function tr(e,t={}){let{execFileSync:n=Ke}=t;n("git",["-C",e,"init"],{stdio:"pipe"}),n("git",["-C",e,"add","."],{stdio:"pipe"}),n("git",["-C",e,"commit","-m","Initial commit","--no-gpg-sign","--no-verify"],{stdio:"pipe"})}o(tr,"gitInitAndCommit");function nr(e={}){let{execFileSync:t=Ke}=e;try{return String(t("git",["config","--get","user.name"],{encoding:"utf-8",stdio:["ignore","pipe","ignore"]})).trim()||void 0}catch{return}}o(nr,"gitUserName");function rr(e={}){let{execFileSync:t=Ke}=e;try{return String(t("git",["config","--get","user.email"],{encoding:"utf-8",stdio:["ignore","pipe","ignore"]})).trim()||void 0}catch{return}}o(rr,"gitUserEmail");import{inspect as bs}from"util";var Mt="[REDACTED]",ce,Ve=class Ve{constructor(t){Jn(this,ce);Xn(this,ce,t)}toString(){return Mt}toJSON(){return Mt}[bs.custom](){return Mt}expose(){return He(this,ce)}equals(t){return He(this,ce)===He(t,ce)}static from(t){return new Ve(t)}};ce=new WeakMap,o(Ve,"SensitiveString");var C=Ve;var Ge=3,or="Signing identity (kid) \u2014 e.g. jsmith-dev-001 (lowercase letters, digits, hyphens)",ir=`Key expiry in months (${1}-${12})`,sr="Email address for the registry entry",ar=`Passphrase for the encrypted private key (min ${15} chars)`,pr="Confirm passphrase",cr=o(()=>`Passphrase must be at least ${15} characters`,"passphraseTooShortMsg"),lr=o(e=>`Passphrases do not match (attempt ${e}/${Ge}).
3
- `,"passphraseMismatchMsg"),dr=`Passphrase confirmation failed after ${Ge} attempts`,ur=o(e=>`A signing key with kid "${e}" already exists. Overwrite it?`,"confirmOverwriteMsg"),mr="How would you like to submit your key registration?",fr="Open in browser",gr="Copy link to clipboard";async function Ye(e){return Lt.prompt(e)}o(Ye,"defaultPrompt");function Nt(e){return t=>{try{return e(t),!0}catch(n){return n instanceof Error?n.message:"Invalid"}}}o(Nt,"parserAsValidator");var xs=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;function de(e){let t=e.trim();if(!t)throw new Error("--kid must not be empty");if(t.length>64)throw new Error("--kid must be 64 characters or fewer");if(!xs.test(t))throw new Error("--kid must contain only lowercase letters, digits, and hyphens, and must not start or end with a hyphen (e.g. jsmith-dev-001)");return t}o(de,"parseKid");async function yr(e={}){let{prompt:t=Ye}=e,{kid:n}=await t({type:"input",name:"kid",message:or,validate:Nt(de)});return de(n)}o(yr,"promptKid");async function hr(e={}){let{prompt:t=o(r=>Lt.prompt(r),"prompt")}=e,{action:n}=await t({type:"select",name:"action",message:mr,choices:[{name:"browser",message:fr},{name:"clipboard",message:gr}]});if(n!=="browser"&&n!=="clipboard")throw new Error(`Unexpected Zendesk action: ${n}`);return n}o(hr,"promptZendeskAction");async function Sr(e={}){let{prompt:t=Ye}=e,{months:n}=await t({type:"input",name:"months",message:ir,initial:String(6),validate:Nt(r=>we(r,"expiry"))});return we(n,"expiry")}o(Sr,"promptExpiryMonths");async function wr(e={}){let{prompt:t=Ye,gitUserEmail:n=rr}=e,{email:r}=await t({type:"input",name:"email",message:sr,initial:n(),validate:Nt(i=>Se(i,"email"))});return Se(r,"email")}o(wr,"promptEmail");async function vr(e={}){let{prompt:t=Ye,stderr:n=process.stderr}=e;for(let r=1;r<=Ge;r+=1){let{passphrase:i}=await t({type:"password",name:"passphrase",message:ar,validate:o(a=>a.length>=15?!0:cr(),"validate")}),{confirm:s}=await t({type:"password",name:"confirm",message:pr});if(i===s)return C.from(i);n.write(lr(r))}throw new Error(dr)}o(vr,"promptPassphrase");async function Cr(e,t={}){let{prompt:n=o(i=>Lt.prompt(i),"prompt")}=t,{confirmed:r}=await n({type:"confirm",name:"confirmed",message:ur(e),initial:!1});return r}o(Cr,"promptConfirmOverwrite");import{existsSync as Ns,readdirSync as Hs,readFileSync as js}from"fs";import{join as jt}from"path";import{execFile as Is}from"child_process";import{promisify as Ts}from"util";import{execFileSync as Ar}from"child_process";import{platform as Ps}from"os";import Ds from"path";function L(e,t={}){let{platform:n=Ps}=t;switch(n()){case"darwin":return e==="macos";case"win32":return e==="windows";default:return e==="other"}}o(L,"isOS");function Er(e,t={}){let{exec:n=Ar,log:r=console.log}=t,[i,s]=L("macos",t)?["open",[e]]:L("windows",t)?["rundll32",["url.dll,FileProtocolHandler",e]]:["xdg-open",[e]];try{n(i,s)}catch{r(`Could not open browser \u2014 open manually:
4
- ${e}`)}}o(Er,"openInBrowser");function br(e,t={}){let{exec:n=Ar,log:r=console.log}=t,[i,s]=L("macos",t)?["open",["-R",e]]:L("windows",t)?["explorer",[`/select,${e}`]]:["xdg-open",[Ds.dirname(e)]];try{n(i,s)}catch{r(`Could not open file manager \u2014 files are at:
5
- ${e}`)}}o(br,"revealInFileManager");var kr="cognite-flows",Rs=Ts(Is),xr=o((e,t)=>Rs(e,t),"defaultExecFile"),Fs=-25300,$s=Fs&255;function Os(e){if(!(e instanceof Error)||!("code"in e)||e.code!==$s)return!1;let t="stderr"in e?String(e.stderr):"";return/could not be found/i.test(t)||t===""}o(Os,"isKeychainNotFoundError");async function Pr(e,t,n={}){let r=t.expose();if(!L("macos",n))throw new Error("Keychain storage is only supported on macOS");let{execFile:i=xr}=n;await i("security",["add-generic-password","-a",e,"-s",kr,"-w",Buffer.from(r,"utf-8").toString("base64"),"-U"])}o(Pr,"storeKeyInKeychain");async function ze(e,t={}){if(!L("macos",t))return null;let{execFile:n=xr}=t;try{let{stdout:r}=await n("security",["find-generic-password","-a",e,"-s",kr,"-w"]);return C.from(Buffer.from(r.trim(),"base64").toString("utf-8"))}catch(r){if(Os(r))return null;throw r}}o(ze,"readKeyFromKeychain");var Ir="cognite-cli-signing",Ms="The native @napi-rs/keyring binary failed to load for this platform. Reinstall the CLI, or regenerate the key with `--output <path>` to use passphrase-encrypted file storage instead.",Us="Multiple Windows Credential Manager entries match this kid. Open Credential Manager (Control Panel \u2192 User Accounts \u2192 Credential Manager \u2192 Windows Credentials) and remove the duplicates.",Dr="Windows Credential Manager failed unexpectedly. Regenerate the key with `--output <path>` to fall back to passphrase-encrypted file storage.";function _s(e){if(!(e instanceof Error))return Dr;let t=e.message.toLowerCase();return t.includes("cannot find module")||t.includes("module_not_found")||t.includes("failed to load native binding")?Ms:t.includes("ambiguous")?Us:Dr}o(_s,"hintFor");function Tr(e,t,n){return new m(`Failed to ${e} signing key for kid "${t}" in Windows Credential Manager`,{cause:n,hint:_s(n),shouldReport:!1})}o(Tr,"wrapKeyringError");async function Rr(e,t){let{Entry:n}=await import("@napi-rs/keyring"),r=new n(e,t);return{setPassword:o(i=>r.setPassword(i),"setPassword"),getPassword:o(()=>r.getPassword(),"getPassword"),deleteCredential:o(()=>r.deleteCredential(),"deleteCredential")}}o(Rr,"defaultCreateEntry");async function Fr(e,t,n={}){let{createEntry:r=Rr}=n,i=Buffer.from(t.expose(),"utf-8").toString("base64");try{(await r(Ir,e)).setPassword(i)}catch(s){throw Tr("store",e,s)}}o(Fr,"storeSigningKey");async function We(e,t={}){let{createEntry:n=Rr}=t;try{let i=(await n(Ir,e)).getPassword();return i===null?null:C.from(Buffer.from(i,"base64").toString("utf-8"))}catch(r){throw Tr("read",e,r)}}o(We,"readSigningKey");import{homedir as Ls}from"os";import{join as Ht}from"path";function P(e={}){let{env:t=process.env,homedir:n=Ls}=e,r=t.COGNITE_CLI_HOME?.trim()||Ht(n(),".cognite-cli");return{home:r,keysDir:Ht(r,"keys"),sessionFile:Ht(r,"session.json")}}o(P,"getConfig");var ee=".pub.pem",Kt=".key.jwe",Bt=".meta.json";function Je(e){switch(e.kind){case"keychain":return"OS credential store";case"encrypted-file":return e.path;case"public-only":return"public-only (private key missing)"}}o(Je,"formatLocalKeySource");function Ks(e){return{existsSync:e.existsSync??Ns,readdirSync:e.readdirSync??Hs,readFileSync:e.readFileSync??((t,n)=>js(t,n)),isOS:e.isOS??(t=>L(t)),readKeyFromKeychain:e.readKeyFromKeychain??(t=>ze(t)),readSigningKey:e.readSigningKey??(t=>We(t))}}o(Ks,"resolveDeps");function Bs(e){try{let t=JSON.parse(e);if(typeof t=="object"&&t!==null&&!Array.isArray(t)&&"email"in t&&typeof t.email=="string")return t.email}catch{}}o(Bs,"readEmailFromMeta");function Vs(e,t){return t.existsSync(e)?t.readdirSync(e).filter(n=>n.endsWith(ee)):[]}o(Vs,"publicKeyEntries");function Gs(e){return e.slice(0,-ee.length)}o(Gs,"kidFromPublicKeyFilename");async function Ys(e,t,n){if(n.isOS("macos")&&await n.readKeyFromKeychain(e).catch(()=>null)!==null)return{kind:"keychain"};if(n.isOS("windows")&&await n.readSigningKey(e).catch(()=>null)!==null)return{kind:"keychain"};let r=jt(t,`${e}${Kt}`);return n.existsSync(r)?{kind:"encrypted-file",path:r}:{kind:"public-only"}}o(Ys,"resolveSource");async function Xe(e=P().keysDir,t={}){let n=Ks(t),r=new Set,i=Vs(e,n).flatMap(s=>{let a=Gs(s);return!a||r.has(a)?[]:(r.add(a),[{kid:a,entry:s}])});return Promise.all(i.map(async({kid:s,entry:a})=>{let p=await Ys(s,e,n),c=jt(e,`${s}${Bt}`),l;try{l=Bs(n.readFileSync(c,"utf8"))}catch{}return{kid:s,source:p,publicKeyPath:jt(e,a),email:l}}))}o(Xe,"discoverLocalKeys");import{createReadStream as qs}from"fs";function Ze(e){let t=qs(e);return new ReadableStream({start(n){t.on("data",r=>{let i=typeof r=="string"?Buffer.from(r):r;n.enqueue(new Uint8Array(i))}),t.on("end",()=>n.close()),t.on("error",r=>n.error(r))},cancel(){t.destroy()}})}o(Ze,"createWebStreamFromFile");import zs from"path";var $r=".cognite-bundles";function Or(e,t){return`${e}-${t}.zip`}o(Or,"bundleFileName");function K(e,t,n){return zs.join(e,$r,Or(t,n))}o(K,"bundlePath");import{existsSync as oa,readFileSync as ia}from"fs";import{resolve as sa}from"path";import{array as Mr,boolean as Ws,check as ve,forward as Ce,literal as Js,maxLength as Xs,minLength as Zs,nonEmpty as te,object as Ur,optional as X,picklist as Qs,pipe as z,safeParse as ea,string as B,url as _r}from"valibot";var Vt=z(B(),te("must not be empty")),Gt=z(B(),te("must not be empty"),Xs(256,"must be 256 characters or fewer")),Yt=z(B(),te("must not be empty"),_r("must be a valid URL")),ta=z(B(),te("must not be empty"),_r("must be a valid URL")),qt=z(B(),te("must not be empty")),zt=z(B(),te("must not be empty")),na=z(Ur({org:qt,project:zt,baseUrl:Yt,deployClientId:X(B(),""),deploySecretName:X(B(),""),published:X(Ws(),!1),idpType:X(Qs(["cdf","entra_id","oauth"]),"cdf"),tenantId:X(B()),scopes:X(Mr(z(B(),te("must not be empty")))),tokenUrl:X(ta)}),Ce(ve(e=>e.idpType!=="entra_id"||!!e.tenantId,'must be set when idpType is "entra_id"'),["tenantId"]),Ce(ve(e=>e.idpType!=="oauth"||!!e.tokenUrl,'must be set when idpType is "oauth"'),["tokenUrl"]),Ce(ve(e=>!e.tokenUrl||e.idpType==="oauth",'must only be set when idpType is "oauth"'),["tokenUrl"]),Ce(ve(e=>e.idpType!=="oauth"||!!e.deployClientId,'must be set when idpType is "oauth"'),["deployClientId"]),Ce(ve(e=>e.idpType!=="oauth"||!!e.deploySecretName,'must be set when idpType is "oauth"'),["deploySecretName"]),Ce(ve(e=>!e.deployClientId||!!e.deploySecretName,"must be set when deployClientId is set"),["deploySecretName"])),ra=Ur({name:Vt,externalId:Gt,versionTag:z(B(),te("must not be empty")),description:X(B(),""),deployments:z(Mr(na),Zs(1,"must contain at least one deployment")),infra:X(Js("appsApi"))});function Wt(e){let t=ea(ra,e);if(t.success)return t.output;let n=t.issues[0],r=n.path?.map(s=>s.key).join(".")??"",i=r?`"${r}" `:"";throw new Error(`app.json: ${i}${n.message}`)}o(Wt,"validateAppConfig");function b(e,t={}){let{validator:n=Wt,existsSync:r=oa,readFileSync:i=ia}=t,s=sa(e,"app.json");if(!r(s))throw new Error(`No app.json found at ${s}. Make sure you're running this command from your app's root directory.`);let a=i(s,"utf-8"),p;try{p=JSON.parse(a)}catch{throw new Error("Failed to parse app.json \u2014 check that it contains valid JSON.")}return n(p)}o(b,"loadAppConfig");var Lr=[".dev.sig",".cert.sig",".sig"];function ua(e){return{existsSync:e.existsSync??aa,readFileSync:e.readFileSync??((t,n)=>pa(t,n)),createBundleStream:e.createBundleStream??Ze,verifyBundle:e.verifyBundle??la,loadAppConfig:e.loadAppConfig??b,defaultKeyDir:e.defaultKeyDir??(()=>P().keysDir)}}o(ua,"resolveDeps");function ma(e,t){return Lr.map(n=>`${e}${n}`).find(n=>t(n))}o(ma,"findSiblingSignature");function fa(e){let t=e.split(".");return t.length===3&&t.every(n=>n.length>0)}o(fa,"isCompactJws");function ga(e){try{let t=da(e);return typeof t.kid=="string"?t.kid:void 0}catch{return}}o(ga,"readKidFromToken");function ya(e,t,n){let{existsSync:r,readFileSync:i}=n;try{de(e)}catch(a){throw new m(a instanceof Error?a.message:String(a),{shouldReport:!1})}if(!r(t))throw new m(`Key directory not found: ${t}`,{shouldReport:!1});let s=ca(t,`${e}${ee}`);if(!r(s))throw new m(`No public key found for kid "${e}" in ${t}`,{shouldReport:!1});try{return i(s,"utf-8")}catch(a){throw new m(`Failed to read public key file: ${s}`,{cause:a,shouldReport:!1})}}o(ya,"resolvePublicKeyForKid");function ha(e,t){let{payload:n,kid:r}=e;if(console.log(`Verified ${n.appId}@${n.version}`),console.log(` kid: ${r}`),console.log(` hash: ${n.bundleSha256}`),n.scopes&&n.scopes.length>0){let i=n.scopes.map(s=>`${s.org}/${s.project}`).join(", ");console.log(` scopes: ${i}`)}t&&console.log(JSON.stringify(n,null,2))}o(ha,"printResult");async function Nr(e,t,n={},r=process.cwd()){let{existsSync:i,readFileSync:s,loadAppConfig:a,createBundleStream:p,verifyBundle:c,defaultKeyDir:l}=ua(n),d;if(e)d=Qe(r,e);else{let f;try{f=a(r)}catch(h){let S=h instanceof Error?h.message:String(h);throw new m(S,{cause:h,hint:"Run this command from a Cognite app directory (one with app.json), or pass [bundle] explicitly.",shouldReport:!1})}d=K(r,f.externalId,f.versionTag)}if(!i(d)){let f=e?void 0:"Default derived from app.json \u2014 pass [bundle] explicitly to override.";throw new m(`Bundle not found: ${d}`,{hint:f,shouldReport:!1})}let u=t.sig?Qe(r,t.sig):ma(d,i);if(!u)throw new m("No signature file found.",{hint:`Pass --sig <path> or place one of ${Lr.map(f=>`${d}${f}`).join(", ")} next to the bundle.`,shouldReport:!1});if(!i(u))throw new m(`Signature file not found: ${u}`,{shouldReport:!1});let y;try{y=s(u,"utf-8").trim()}catch(f){throw new m(`Failed to read signature file: ${u}`,{cause:f,shouldReport:!1})}if(!fa(y))throw new m(`Malformed JWS in ${u}`,{hint:"Expected a compact JWS (header.payload.signature \u2014 three base64url segments).",shouldReport:!1});let g;if(t.key){let f=Qe(r,t.key);if(!i(f))throw new m(`Public key not found: ${f}`,{shouldReport:!1});try{g=s(f,"utf-8")}catch(h){throw new m(`Failed to read public key file: ${f}`,{cause:h,shouldReport:!1})}}else{let f=t.keyDir?Qe(r,t.keyDir):l(),h=ga(y);if(!h)throw new m("Token header has no kid.",{hint:"Pass --key <path> to a public key PEM.",shouldReport:!1});g=ya(h,f,{existsSync:i,readFileSync:s})}try{let f=await c({token:y,publicKeyPem:g,bundleStream:p(d)});ha(f,t.verbose??!1)}catch(f){let h=f instanceof Error?f.message:String(f);throw new m(`Bundle rejected: ${h}`,{shouldReport:!1})}}o(Nr,"handleVerify");function Hr(e,t={}){return e.command("verify [bundle]").description("Verify a signed app bundle locally (default: derived from app.json)").option("-s, --sig <path>","Path to the signature file (default: sibling .dev.sig / .cert.sig / .sig)").option("--key <path>","Path to a public key PEM file").option("--key-dir <path>","Directory of <kid>.pub.pem files \u2014 kid is read from the token header (default: $COGNITE_CLI_HOME/keys)").option("-v, --verbose","Print the full decoded payload after verification").addHelpText("after",`
2
+ var fs=Object.defineProperty;var Wn=e=>{throw TypeError(e)};var o=(e,t)=>fs(e,"name",{value:t,configurable:!0});var Jn=(e,t,n)=>t.has(e)||Wn("Cannot "+n);var He=(e,t,n)=>(Jn(e,t,"read from private field"),n?n.call(e):t.get(e)),Xn=(e,t,n)=>t.has(e)?Wn("Cannot add the same private member more than once"):t instanceof WeakSet?t.add(e):t.set(e,n),Zn=(e,t,n,r)=>(Jn(e,t,"write to private field"),r?r.call(e,n):t.set(e,n),n);import{writeSync as um}from"fs";import{Command as mm}from"commander";var Ft=class Ft extends Error{constructor(t,n={}){super(t),this.name="HintedError",n.cause!==void 0&&(this.cause=n.cause);let r=this.deriveDefaults(n);this.hint=n.hint??r.hint,this.helpUrl=n.helpUrl??r.helpUrl,this.shouldReport=n.shouldReport??!0}deriveDefaults(t){return{hint:Ss(t.cause)}}};o(Ft,"HintedError");var m=Ft;function er(e){return e instanceof m}o(er,"isHintedError");var Qn="https://docs.cognite.com/cdf/access/",gs="https://status.cognite.com";function ys(e){switch(e){case 401:return{hint:"Your credentials are invalid or expired. Check your client ID and secret.",helpUrl:Qn};case 403:return{hint:"You don't have the required CDF capabilities. Please contact your CDF admin.",helpUrl:Qn};case 413:return{hint:"The deployment exceeds the App Hosting size limit. Reduce the build output \u2014 remove unused assets, code-split bundles, or strip source maps."};case 429:return{hint:"You are being rate limited. Wait a few moments and retry. If this persists, contact CDF support."};case 500:case 502:case 503:case 504:return{hint:"CDF service error. The issue is on the server side. Check the status page and retry shortly.",helpUrl:gs};default:return{}}}o(ys,"defaultHintForStatus");var $t=class $t extends m{constructor(t,n){super(t,n),this.name="HintedHttpError",this.httpStatusCode=n.httpStatusCode,this.requestUrl=n.requestUrl,this.responseBody=n.responseBody}deriveDefaults(t){let{httpStatusCode:n}=t,r=ys(n),i=super.deriveDefaults(t);return{hint:r.hint??i.hint,helpUrl:r.helpUrl}}};o($t,"HintedHttpError");var pe=$t;function tr(e){return e instanceof pe}o(tr,"isHintedHttpError");function hs(e,t){if(e)switch(e){case"ENOTFOUND":return t.hostname?`DNS lookup failed for ${t.hostname}. Check your network, VPN, or proxy settings.`:"DNS lookup failed. Check your network, VPN, or proxy settings.";case"ECONNREFUSED":return t.hostname&&t.port?`Connection refused by ${t.hostname}:${t.port}. The service may be down or the port may be wrong.`:"Connection refused. The service may be down or the port may be wrong.";case"ECONNRESET":return"Connection was reset. The server closed the connection unexpectedly; check for proxy/firewall interference and retry.";case"ETIMEDOUT":return"Connection timed out. Check your network, VPN, or proxy settings, and retry.";case"EAI_AGAIN":return"Temporary DNS failure. Retry shortly; if it persists, check your DNS configuration.";case"CERT_HAS_EXPIRED":case"UNABLE_TO_VERIFY_LEAF_SIGNATURE":case"SELF_SIGNED_CERT_IN_CHAIN":return"TLS certificate validation failed. Check system clock and CA trust store; if you use a corporate proxy, ensure its root cert is trusted.";case"EACCES":return t.path?`Permission denied: ${t.path}. Check file ownership and permissions.`:"Permission denied. Check file ownership and permissions.";case"ENOENT":return t.path?`File or directory not found: ${t.path}.`:"File or directory not found.";case"EISDIR":return t.path?`Expected a file but found a directory: ${t.path}.`:"Expected a file but found a directory.";case"ENOSPC":return"No space left on device. Free up disk space and retry.";case"EADDRINUSE":return t.port?`Port ${t.port} is already in use. Stop the process using it or pick a different port.`:"Address is already in use. Stop the conflicting process or change the port.";case"EMFILE":case"ENFILE":return"Too many open files. Close other programs or raise the file descriptor limit.";default:return}}o(hs,"hintForErrno");function Ss(e){let t=e,n=new Set;for(;t!=null&&!n.has(t)&&(n.add(t),typeof t=="object");){let r=t,i=hs(r.code,r);if(i!==void 0)return i;t=r.cause}}o(Ss,"hintForCause");function E(e=process.env){return e.COGNITE_ALPHA_ENABLE_SESSION_AUTH?.trim().toLowerCase()==="true"}o(E,"isSessionAuthEnabled");import{existsSync as pa,readFileSync as ca}from"fs";import{join as la,resolve as Qe}from"path";import{verifyBundle as da}from"@cognite/app-sdk/codesigning";import{decodeProtectedHeader as ua}from"jose";import _t from"enquirer";import{email as ws,pipe as vs,safeParse as As,string as Cs}from"valibot";var Es=vs(Cs(),ws());function Se(e,t="email"){let n=e.trim();if(!n)throw new Error(`${t} is required`);if(!As(Es,n).success)throw new Error(`${t} must look like an email (user@example.com); got "${e}"`);return n}o(Se,"parseEmail");function we(e,t="--expires"){let n=Number(e);if(!Number.isInteger(n)||n<1||n>12)throw new Error(`${t} must be an integer between 1 and 12 (months); got "${e}"`);return n}o(we,"parseExpiryMonths");import{execFileSync as Ke}from"child_process";import{execFileSync as bs}from"child_process";function je(e={}){let{execFileSync:t=bs}=e;try{return t("git",["--version"],{stdio:"ignore"}),!0}catch{return!1}}o(je,"isGitInstalled");function q(e={}){if(!je(e))throw new m("Git is not installed or not found on PATH.",{hint:"Install Git (https://git-scm.com) and ensure it is on your PATH, then try again.",shouldReport:!1})}o(q,"throwIfGitMissing");function Be(e,t={}){let{execFileSync:n=Ke}=t;try{return n("git",["-C",e,"status"],{stdio:"ignore"}),!0}catch{return!1}}o(Be,"isInsideGitRepo");function nr(e,t={}){let{execFileSync:n=Ke}=t;n("git",["-C",e,"init"],{stdio:"pipe"}),n("git",["-C",e,"add","."],{stdio:"pipe"}),n("git",["-C",e,"commit","-m","Initial commit","--no-gpg-sign","--no-verify"],{stdio:"pipe"})}o(nr,"gitInitAndCommit");function rr(e={}){let{execFileSync:t=Ke}=e;try{return String(t("git",["config","--get","user.name"],{encoding:"utf-8",stdio:["ignore","pipe","ignore"]})).trim()||void 0}catch{return}}o(rr,"gitUserName");function or(e={}){let{execFileSync:t=Ke}=e;try{return String(t("git",["config","--get","user.email"],{encoding:"utf-8",stdio:["ignore","pipe","ignore"]})).trim()||void 0}catch{return}}o(or,"gitUserEmail");import{inspect as ks}from"util";var Ot="[REDACTED]",ce,Ve=class Ve{constructor(t){Xn(this,ce);Zn(this,ce,t)}toString(){return Ot}toJSON(){return Ot}[ks.custom](){return Ot}expose(){return He(this,ce)}equals(t){return He(this,ce)===He(t,ce)}static from(t){return new Ve(t)}};ce=new WeakMap,o(Ve,"SensitiveString");var A=Ve;var Ge=3,ir="Signing identity (kid) \u2014 e.g. jsmith-dev-001 (lowercase letters, digits, hyphens)",sr=`Key expiry in months (${1}-${12})`,ar="Email address for the registry entry",pr=`Passphrase for the encrypted private key (min ${15} chars)`,cr="Confirm passphrase",lr=o(()=>`Passphrase must be at least ${15} characters`,"passphraseTooShortMsg"),dr=o(e=>`Passphrases do not match (attempt ${e}/${Ge}).
3
+ `,"passphraseMismatchMsg"),ur=`Passphrase confirmation failed after ${Ge} attempts`,mr=o(e=>`A signing key with kid "${e}" already exists. Overwrite it?`,"confirmOverwriteMsg"),fr="How would you like to submit your key registration?",gr="Open in browser",yr="Copy link to clipboard";async function Ye(e){return _t.prompt(e)}o(Ye,"defaultPrompt");function Lt(e){return t=>{try{return e(t),!0}catch(n){return n instanceof Error?n.message:"Invalid"}}}o(Lt,"parserAsValidator");var Ps=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;function de(e){let t=e.trim();if(!t)throw new Error("--kid must not be empty");if(t.length>64)throw new Error("--kid must be 64 characters or fewer");if(!Ps.test(t))throw new Error("--kid must contain only lowercase letters, digits, and hyphens, and must not start or end with a hyphen (e.g. jsmith-dev-001)");return t}o(de,"parseKid");async function hr(e={}){let{prompt:t=Ye}=e,{kid:n}=await t({type:"input",name:"kid",message:ir,validate:Lt(de)});return de(n)}o(hr,"promptKid");async function Sr(e={}){let{prompt:t=o(r=>_t.prompt(r),"prompt")}=e,{action:n}=await t({type:"select",name:"action",message:fr,choices:[{name:"browser",message:gr},{name:"clipboard",message:yr}]});if(n!=="browser"&&n!=="clipboard")throw new Error(`Unexpected Zendesk action: ${n}`);return n}o(Sr,"promptZendeskAction");async function wr(e={}){let{prompt:t=Ye}=e,{months:n}=await t({type:"input",name:"months",message:sr,initial:String(6),validate:Lt(r=>we(r,"expiry"))});return we(n,"expiry")}o(wr,"promptExpiryMonths");async function vr(e={}){let{prompt:t=Ye,gitUserEmail:n=or}=e,{email:r}=await t({type:"input",name:"email",message:ar,initial:n(),validate:Lt(i=>Se(i,"email"))});return Se(r,"email")}o(vr,"promptEmail");async function Ar(e={}){let{prompt:t=Ye,stderr:n=process.stderr}=e;for(let r=1;r<=Ge;r+=1){let{passphrase:i}=await t({type:"password",name:"passphrase",message:pr,validate:o(a=>a.length>=15?!0:lr(),"validate")}),{confirm:s}=await t({type:"password",name:"confirm",message:cr});if(i===s)return A.from(i);n.write(dr(r))}throw new Error(ur)}o(Ar,"promptPassphrase");async function Cr(e,t={}){let{prompt:n=o(i=>_t.prompt(i),"prompt")}=t,{confirmed:r}=await n({type:"confirm",name:"confirmed",message:mr(e),initial:!1});return r}o(Cr,"promptConfirmOverwrite");import{existsSync as Hs,readdirSync as js,readFileSync as Ks}from"fs";import{join as Ht}from"path";import{execFile as Ts}from"child_process";import{promisify as Rs}from"util";import{execFileSync as Er}from"child_process";import{platform as Ds}from"os";import Is from"path";function L(e,t={}){let{platform:n=Ds}=t;switch(n()){case"darwin":return e==="macos";case"win32":return e==="windows";default:return e==="other"}}o(L,"isOS");function br(e,t={}){let{exec:n=Er,log:r=console.log}=t,[i,s]=L("macos",t)?["open",[e]]:L("windows",t)?["rundll32",["url.dll,FileProtocolHandler",e]]:["xdg-open",[e]];try{n(i,s)}catch{r(`Could not open browser \u2014 open manually:
4
+ ${e}`)}}o(br,"openInBrowser");function kr(e,t={}){let{exec:n=Er,log:r=console.log}=t,[i,s]=L("macos",t)?["open",["-R",e]]:L("windows",t)?["explorer",[`/select,${e}`]]:["xdg-open",[Is.dirname(e)]];try{n(i,s)}catch{r(`Could not open file manager \u2014 files are at:
5
+ ${e}`)}}o(kr,"revealInFileManager");var xr="cognite-flows",Fs=Rs(Ts),Pr=o((e,t)=>Fs(e,t),"defaultExecFile"),$s=-25300,Os=$s&255;function Ms(e){if(!(e instanceof Error)||!("code"in e)||e.code!==Os)return!1;let t="stderr"in e?String(e.stderr):"";return/could not be found/i.test(t)||t===""}o(Ms,"isKeychainNotFoundError");async function Dr(e,t,n={}){let r=t.expose();if(!L("macos",n))throw new Error("Keychain storage is only supported on macOS");let{execFile:i=Pr}=n;await i("security",["add-generic-password","-a",e,"-s",xr,"-w",Buffer.from(r,"utf-8").toString("base64"),"-U"])}o(Dr,"storeKeyInKeychain");async function ze(e,t={}){if(!L("macos",t))return null;let{execFile:n=Pr}=t;try{let{stdout:r}=await n("security",["find-generic-password","-a",e,"-s",xr,"-w"]);return A.from(Buffer.from(r.trim(),"base64").toString("utf-8"))}catch(r){if(Ms(r))return null;throw r}}o(ze,"readKeyFromKeychain");var Tr="cognite-cli-signing",Us="The native @napi-rs/keyring binary failed to load for this platform. Reinstall the CLI, or regenerate the key with `--output <path>` to use passphrase-encrypted file storage instead.",_s="Multiple Windows Credential Manager entries match this kid. Open Credential Manager (Control Panel \u2192 User Accounts \u2192 Credential Manager \u2192 Windows Credentials) and remove the duplicates.",Ir="Windows Credential Manager failed unexpectedly. Regenerate the key with `--output <path>` to fall back to passphrase-encrypted file storage.";function Ls(e){if(!(e instanceof Error))return Ir;let t=e.message.toLowerCase();return t.includes("cannot find module")||t.includes("module_not_found")||t.includes("failed to load native binding")?Us:t.includes("ambiguous")?_s:Ir}o(Ls,"hintFor");function Rr(e,t,n){return new m(`Failed to ${e} signing key for kid "${t}" in Windows Credential Manager`,{cause:n,hint:Ls(n),shouldReport:!1})}o(Rr,"wrapKeyringError");async function Fr(e,t){let{Entry:n}=await import("@napi-rs/keyring"),r=new n(e,t);return{setPassword:o(i=>r.setPassword(i),"setPassword"),getPassword:o(()=>r.getPassword(),"getPassword"),deleteCredential:o(()=>r.deleteCredential(),"deleteCredential")}}o(Fr,"defaultCreateEntry");async function $r(e,t,n={}){let{createEntry:r=Fr}=n,i=Buffer.from(t.expose(),"utf-8").toString("base64");try{(await r(Tr,e)).setPassword(i)}catch(s){throw Rr("store",e,s)}}o($r,"storeSigningKey");async function We(e,t={}){let{createEntry:n=Fr}=t;try{let i=(await n(Tr,e)).getPassword();return i===null?null:A.from(Buffer.from(i,"base64").toString("utf-8"))}catch(r){throw Rr("read",e,r)}}o(We,"readSigningKey");import{homedir as Ns}from"os";import{join as Nt}from"path";function P(e={}){let{env:t=process.env,homedir:n=Ns}=e,r=t.COGNITE_CLI_HOME?.trim()||Nt(n(),".cognite-cli");return{home:r,keysDir:Nt(r,"keys"),sessionFile:Nt(r,"session.json")}}o(P,"getConfig");var ee=".pub.pem",jt=".key.jwe",Kt=".meta.json";function Je(e){switch(e.kind){case"keychain":return"OS credential store";case"encrypted-file":return e.path;case"public-only":return"public-only (private key missing)"}}o(Je,"formatLocalKeySource");function Bs(e){return{existsSync:e.existsSync??Hs,readdirSync:e.readdirSync??js,readFileSync:e.readFileSync??((t,n)=>Ks(t,n)),isOS:e.isOS??(t=>L(t)),readKeyFromKeychain:e.readKeyFromKeychain??(t=>ze(t)),readSigningKey:e.readSigningKey??(t=>We(t))}}o(Bs,"resolveDeps");function Vs(e){try{let t=JSON.parse(e);if(typeof t=="object"&&t!==null&&!Array.isArray(t)&&"email"in t&&typeof t.email=="string")return t.email}catch{}}o(Vs,"readEmailFromMeta");function Gs(e,t){return t.existsSync(e)?t.readdirSync(e).filter(n=>n.endsWith(ee)):[]}o(Gs,"publicKeyEntries");function Ys(e){return e.slice(0,-ee.length)}o(Ys,"kidFromPublicKeyFilename");async function qs(e,t,n){if(n.isOS("macos")&&await n.readKeyFromKeychain(e).catch(()=>null)!==null)return{kind:"keychain"};if(n.isOS("windows")&&await n.readSigningKey(e).catch(()=>null)!==null)return{kind:"keychain"};let r=Ht(t,`${e}${jt}`);return n.existsSync(r)?{kind:"encrypted-file",path:r}:{kind:"public-only"}}o(qs,"resolveSource");async function Xe(e=P().keysDir,t={}){let n=Bs(t),r=new Set,i=Gs(e,n).flatMap(s=>{let a=Ys(s);return!a||r.has(a)?[]:(r.add(a),[{kid:a,entry:s}])});return Promise.all(i.map(async({kid:s,entry:a})=>{let p=await qs(s,e,n),c=Ht(e,`${s}${Kt}`),l;try{l=Vs(n.readFileSync(c,"utf8"))}catch{}return{kid:s,source:p,publicKeyPath:Ht(e,a),email:l}}))}o(Xe,"discoverLocalKeys");import{createReadStream as zs}from"fs";function Ze(e){let t=zs(e);return new ReadableStream({start(n){t.on("data",r=>{let i=typeof r=="string"?Buffer.from(r):r;n.enqueue(new Uint8Array(i))}),t.on("end",()=>n.close()),t.on("error",r=>n.error(r))},cancel(){t.destroy()}})}o(Ze,"createWebStreamFromFile");import Ws from"path";var Or=".cognite-bundles";function Mr(e,t){return`${e}-${t}.zip`}o(Mr,"bundleFileName");function B(e,t,n){return Ws.join(e,Or,Mr(t,n))}o(B,"bundlePath");import{existsSync as ia,readFileSync as sa}from"fs";import{resolve as aa}from"path";import{array as Ur,boolean as Js,check as ve,forward as Ae,literal as Xs,maxLength as Zs,minLength as Qs,nonEmpty as te,object as _r,optional as X,picklist as ea,pipe as z,safeParse as ta,string as V,url as Lr}from"valibot";var Bt=z(V(),te("must not be empty")),Vt=z(V(),te("must not be empty"),Zs(256,"must be 256 characters or fewer")),Gt=z(V(),te("must not be empty"),Lr("must be a valid URL")),na=z(V(),te("must not be empty"),Lr("must be a valid URL")),Yt=z(V(),te("must not be empty")),qt=z(V(),te("must not be empty")),ra=z(_r({org:Yt,project:qt,baseUrl:Gt,deployClientId:X(V(),""),deploySecretName:X(V(),""),published:X(Js(),!1),idpType:X(ea(["cdf","entra_id","oauth"]),"cdf"),tenantId:X(V()),scopes:X(Ur(z(V(),te("must not be empty")))),tokenUrl:X(na)}),Ae(ve(e=>e.idpType!=="entra_id"||!!e.tenantId,'must be set when idpType is "entra_id"'),["tenantId"]),Ae(ve(e=>e.idpType!=="oauth"||!!e.tokenUrl,'must be set when idpType is "oauth"'),["tokenUrl"]),Ae(ve(e=>!e.tokenUrl||e.idpType==="oauth",'must only be set when idpType is "oauth"'),["tokenUrl"]),Ae(ve(e=>e.idpType!=="oauth"||!!e.deployClientId,'must be set when idpType is "oauth"'),["deployClientId"]),Ae(ve(e=>e.idpType!=="oauth"||!!e.deploySecretName,'must be set when idpType is "oauth"'),["deploySecretName"]),Ae(ve(e=>!e.deployClientId||!!e.deploySecretName,"must be set when deployClientId is set"),["deploySecretName"])),oa=_r({name:Bt,externalId:Vt,versionTag:z(V(),te("must not be empty")),description:X(V(),""),deployments:z(Ur(ra),Qs(1,"must contain at least one deployment")),infra:X(Xs("appsApi"))});function zt(e){let t=ta(oa,e);if(t.success)return t.output;let n=t.issues[0],r=n.path?.map(s=>s.key).join(".")??"",i=r?`"${r}" `:"";throw new Error(`app.json: ${i}${n.message}`)}o(zt,"validateAppConfig");function b(e,t={}){let{validator:n=zt,existsSync:r=ia,readFileSync:i=sa}=t,s=aa(e,"app.json");if(!r(s))throw new Error(`No app.json found at ${s}. Make sure you're running this command from your app's root directory.`);let a=i(s,"utf-8"),p;try{p=JSON.parse(a)}catch{throw new Error("Failed to parse app.json \u2014 check that it contains valid JSON.")}return n(p)}o(b,"loadAppConfig");var Nr=[".dev.sig",".cert.sig",".sig"];function ma(e){return{existsSync:e.existsSync??pa,readFileSync:e.readFileSync??((t,n)=>ca(t,n)),createBundleStream:e.createBundleStream??Ze,verifyBundle:e.verifyBundle??da,loadAppConfig:e.loadAppConfig??b,defaultKeyDir:e.defaultKeyDir??(()=>P().keysDir)}}o(ma,"resolveDeps");function fa(e,t){return Nr.map(n=>`${e}${n}`).find(n=>t(n))}o(fa,"findSiblingSignature");function ga(e){let t=e.split(".");return t.length===3&&t.every(n=>n.length>0)}o(ga,"isCompactJws");function ya(e){try{let t=ua(e);return typeof t.kid=="string"?t.kid:void 0}catch{return}}o(ya,"readKidFromToken");function ha(e,t,n){let{existsSync:r,readFileSync:i}=n;try{de(e)}catch(a){throw new m(a instanceof Error?a.message:String(a),{shouldReport:!1})}if(!r(t))throw new m(`Key directory not found: ${t}`,{shouldReport:!1});let s=la(t,`${e}${ee}`);if(!r(s))throw new m(`No public key found for kid "${e}" in ${t}`,{shouldReport:!1});try{return i(s,"utf-8")}catch(a){throw new m(`Failed to read public key file: ${s}`,{cause:a,shouldReport:!1})}}o(ha,"resolvePublicKeyForKid");function Sa(e,t){let{payload:n,kid:r}=e;if(console.log(`Verified ${n.appId}@${n.version}`),console.log(` kid: ${r}`),console.log(` hash: ${n.bundleSha256}`),n.scopes&&n.scopes.length>0){let i=n.scopes.map(s=>`${s.org}/${s.project}`).join(", ");console.log(` scopes: ${i}`)}t&&console.log(JSON.stringify(n,null,2))}o(Sa,"printResult");async function Hr(e,t,n={},r=process.cwd()){let{existsSync:i,readFileSync:s,loadAppConfig:a,createBundleStream:p,verifyBundle:c,defaultKeyDir:l}=ma(n),d;if(e)d=Qe(r,e);else{let f;try{f=a(r)}catch(h){let S=h instanceof Error?h.message:String(h);throw new m(S,{cause:h,hint:"Run this command from a Cognite app directory (one with app.json), or pass [bundle] explicitly.",shouldReport:!1})}d=B(r,f.externalId,f.versionTag)}if(!i(d)){let f=e?void 0:"Default derived from app.json \u2014 pass [bundle] explicitly to override.";throw new m(`Bundle not found: ${d}`,{hint:f,shouldReport:!1})}let u=t.sig?Qe(r,t.sig):fa(d,i);if(!u)throw new m("No signature file found.",{hint:`Pass --sig <path> or place one of ${Nr.map(f=>`${d}${f}`).join(", ")} next to the bundle.`,shouldReport:!1});if(!i(u))throw new m(`Signature file not found: ${u}`,{shouldReport:!1});let y;try{y=s(u,"utf-8").trim()}catch(f){throw new m(`Failed to read signature file: ${u}`,{cause:f,shouldReport:!1})}if(!ga(y))throw new m(`Malformed JWS in ${u}`,{hint:"Expected a compact JWS (header.payload.signature \u2014 three base64url segments).",shouldReport:!1});let g;if(t.key){let f=Qe(r,t.key);if(!i(f))throw new m(`Public key not found: ${f}`,{shouldReport:!1});try{g=s(f,"utf-8")}catch(h){throw new m(`Failed to read public key file: ${f}`,{cause:h,shouldReport:!1})}}else{let f=t.keyDir?Qe(r,t.keyDir):l(),h=ya(y);if(!h)throw new m("Token header has no kid.",{hint:"Pass --key <path> to a public key PEM.",shouldReport:!1});g=ha(h,f,{existsSync:i,readFileSync:s})}try{let f=await c({token:y,publicKeyPem:g,bundleStream:p(d)});Sa(f,t.verbose??!1)}catch(f){let h=f instanceof Error?f.message:String(f);throw new m(`Bundle rejected: ${h}`,{shouldReport:!1})}}o(Hr,"handleVerify");function jr(e,t={}){return e.command("verify [bundle]").description("Verify a signed app bundle locally (default: derived from app.json)").option("-s, --sig <path>","Path to the signature file (default: sibling .dev.sig / .cert.sig / .sig)").option("--key <path>","Path to a public key PEM file").option("--key-dir <path>","Directory of <kid>.pub.pem files \u2014 kid is read from the token header (default: $COGNITE_CLI_HOME/keys)").option("-v, --verbose","Print the full decoded payload after verification").addHelpText("after",`
6
6
  Bundles are stored in .cognite-bundles/<externalId>-<versionTag>.zip by default.
7
7
 
8
8
  Examples:
9
9
  cognite apps verify Verify default bundle (path from app.json)
10
10
  cognite apps verify .cognite-bundles/my-app-1.0.0.zip Verify a specific bundle
11
11
  cognite apps verify .cognite-bundles/my-app-1.0.0.zip --sig my-app-1.0.0.zip.dev.sig Verify with explicit signature
12
- cognite apps verify .cognite-bundles/my-app-1.0.0.zip --key /path/to/pub.pem Verify with explicit public key`).action((n,r)=>Nr(n,r,t))}o(Hr,"registerVerifyCommand");var jr="https://docs.cognite.com/cdf/access/";function H(e){return e!==null&&typeof e=="object"}o(H,"isRecord");function ue(e){return e instanceof Error&&"status"in e&&typeof e.status=="number"}o(ue,"isHttpError");function Sa(e){switch(e){case 401:return`Your credentials are invalid or expired. Check your client ID and secret.
13
- See: ${jr}`;case 403:return`You don't have the required CDF capabilities. Please contact your CDF admin.
14
- See: ${jr}`;default:return}}o(Sa,"httpStatusHint");function W(e){let t=e instanceof Error?e:new Error(String(e));if(!ue(t))return null;let n=Sa(t.status);return n?Object.assign(new Error(`${t.message}
15
- ${n}`),{cause:t}):null}o(W,"enrichedHttpError");function wa(e){if(!H(e))return null;let t=e.missing;if(Array.isArray(t))return t;let n=e.data;if(H(n)){let r=n.error;if(H(r)&&Array.isArray(r.missing))return r.missing;if(Array.isArray(n.missing))return n.missing}return null}o(wa,"findMissingArray");function va(e,t){if(!ue(e)||e.status!==400)return!1;let n=wa(e);return n?n.some(r=>H(r)&&typeof r.externalId=="string"&&t.includes(r.externalId)):!1}o(va,"isMissingExternalIdError");function et(e,t){return ue(e)&&e.status===404||va(e,t)}o(et,"isNotFoundError");var Br=["DRAFT","PUBLISHED","DEPRECATED","ARCHIVED"],Vr=["ACTIVE","PREVIEW"],Jt=class Jt extends Error{constructor(t,n){super(`Version ${n} of app ${t} not found`),this.name="AppVersionNotFoundError",this.appExternalId=t,this.version=n}};o(Jt,"AppVersionNotFoundError");var V=Jt,Xt=class Xt extends Error{constructor(t){super(`App ${t} not found`),this.name="AppNotFoundError",this.appExternalId=t}};o(Xt,"AppNotFoundError");var Ae=Xt;function tt(e,t){return e.includes(t)}o(tt,"includesValue");function Ca(e){return tt(Br,e)}o(Ca,"isAppVersionLifecycleState");function Aa(e){return tt(Vr,e)}o(Aa,"isAppVersionAlias");function Ea(e){return typeof e.version=="string"&&Ca(e.lifecycleState)&&typeof e.entrypoint=="string"&&typeof e.createdTime=="number"&&typeof e.createdBy=="string"&&typeof e.appExternalId=="string"&&(e.alias===void 0||Aa(e.alias))&&(e.comment===void 0||typeof e.comment=="string")}o(Ea,"isAppVersion");function Kr(e){if(!H(e)){let t=JSON.stringify(e)?.slice(0,200)??String(e);throw new Error(`Invalid version response: expected object, got ${t}`)}if(!Ea(e)){let t=JSON.stringify(e).slice(0,300);throw new Error(`Invalid version response: missing or malformed fields. Got: ${t}`)}return e}o(Kr,"parseAppVersion");function ba(e){if(!H(e))throw new Error("Invalid app response: not an object");let{externalId:t,name:n,description:r}=e;if(typeof t!="string")throw new Error("Invalid app response: missing externalId");if(typeof n!="string")throw new Error("Invalid app response: missing name");if(r!=null&&typeof r!="string")throw new Error("Invalid app response: malformed description");return{externalId:t,name:n,description:typeof r=="string"?r:void 0}}o(ba,"parseAppMetadata");var Zt=class Zt{constructor(t){this.client=t}get appsBasePath(){return`/api/v1/projects/${encodeURIComponent(this.client.project)}/apphosting/apps`}async createApp(t,n,r){try{await this.client.post(this.appsBasePath,{data:{items:[{externalId:t,name:n,description:r}]}})}catch(i){throw W(i)??i}}async updateApps(t){try{await this.client.post(`${this.appsBasePath}/update`,{data:{items:t}})}catch(n){throw W(n)??n}}async getApp(t){let n=`${this.appsBasePath}/${encodeURIComponent(t)}`;try{let r=await this.client.get(n);return ba(r.data)}catch(r){throw et(r,[t])?new Ae(t):W(r)??r}}async uploadVersion(t,n,r,i,s="index.html"){console.log(`\u{1F4E4} Uploading version ${n}...`);let a=new FormData;a.append("file",new Blob([new Uint8Array(r)]),i),a.append("version",n),a.append("entryPath",s);let p=encodeURIComponent(t),c=`${this.appsBasePath}/${p}/versions`,l=await this.client.authenticate();if(!l)throw new m("Failed to authenticate for upload",{hint:"Check your credentials and try again."});let d=C.from(l),u=`${this.client.getBaseUrl()}${c}`,y=new AbortController,g=setTimeout(()=>y.abort(),300*1e3),f;try{f=await fetch(u,{method:"POST",headers:{Authorization:`Bearer ${d.expose()}`},body:a,signal:y.signal})}catch(h){throw h instanceof Error&&h.name==="AbortError"?new m("Upload timed out after 5 minutes",{hint:"The upload took longer than 5 minutes. Try again \u2014 if it keeps timing out, check your network speed or bundle size."}):new m(`Failed to upload version to ${u}`,{cause:h,hint:"Check your network connection. Uploads can also fail behind a proxy that blocks multipart POST requests."})}finally{clearTimeout(g)}if(!f.ok){let h=await f.text(),S;try{S=JSON.parse(h)}catch{}let A=h;if(H(S)){let U=S.error;if(typeof U=="string")A=U;else if(H(U)){let x=U.message,k=U.code;A=typeof x=="string"?x:k!=null?`Unknown error (code: ${k})`:h}else{let x=S.message;A=typeof x=="string"?x:h}}let v=f.headers.get("x-request-id"),w=v?` | X-Request-ID: ${v}`:"",D=H(S)?S:h;throw new pe(`Upload failed: ${f.status} \u2014 ${A}${w}`,{httpStatusCode:f.status,requestUrl:u,responseBody:D})}console.log(`\u2705 Version ${n} uploaded`)}async getVersion(t,n){let r=encodeURIComponent(t),i=encodeURIComponent(n),s=`${this.appsBasePath}/${r}/versions/${i}`;try{let a=await this.client.get(s);return Kr(a.data)}catch(a){throw et(a,[t,n])?new V(t,n):W(a)??a}}async getActiveVersion(t){let n=encodeURIComponent(t),r=`${this.appsBasePath}/${n}/versions/list`;try{let i=await this.client.post(r,{data:{filter:{aliases:["ACTIVE"]}}});if(!H(i.data)||!Array.isArray(i.data.items))throw new Error("Invalid versions/list response: expected an object with an items array");let{items:s}=i.data;if(s.length===0)return null;if(s.length>1)throw new Error(`Unexpected response: ${s.length} versions have the ACTIVE alias, expected at most 1`);return Kr(s[0])}catch(i){if(et(i,[t]))return null;throw W(i)??i}}async deleteVersions(t,n){let r=encodeURIComponent(t),i=`${this.appsBasePath}/${r}/versions/delete`;try{await this.client.post(i,{data:{items:n.map(s=>({version:s}))}})}catch(s){throw W(s)??s}}async updateVersions(t,n){let r=encodeURIComponent(t),i=`${this.appsBasePath}/${r}/versions/update`;try{await this.client.post(i,{data:{items:n}})}catch(s){throw W(s)??s}}async submitSignatures(t,n,r){let i=encodeURIComponent(t),s=encodeURIComponent(n),a=`${this.appsBasePath}/${i}/versions/${s}/signatures`;try{await this.client.post(a,{data:{items:r}})}catch(p){throw W(p)??p}}async listSignatures(t,n){let r=encodeURIComponent(t),i=encodeURIComponent(n),s=`${this.appsBasePath}/${r}/versions/${i}/signatures/list`;try{let a=await this.client.post(s,{data:{}});return Pa(a.data)}catch(a){throw W(a)??a}}};o(Zt,"AppHostingApi");var nt=Zt,ka=["VALID","REVOKED","EXPIRED","SIGNED_BEFORE_KEY_ISSUED","IAT_IN_FUTURE","BUNDLE_TOO_OLD","KEY_NOT_IN_REGISTRY","SCOPE_MISMATCH","VERIFICATION_FAILED"],xa=["developer","certifier"];function Pa(e){if(!H(e))throw new Error("Invalid signatures response: expected an object with an items array");let{items:t}=e;if(!Array.isArray(t))throw new Error("Invalid signatures response: items property is missing or not an array");return t.flatMap(n=>{let r=Da(n);return r?[r]:[]})}o(Pa,"parseStoredSignatures");function Da(e){if(!H(e))return null;let{signerKid:t,signerRole:n,signatureIat:r,receivedAt:i,createdTime:s,status:a}=e;return typeof t!="string"||t===""||!tt(xa,n)||typeof r!="number"||typeof i!="number"||typeof s!="number"||!tt(ka,a)?null:{signerKid:t,signerRole:n,signatureIat:r,receivedAt:i,createdTime:s,status:a}}o(Da,"parseStoredSignature");function Qt(e,t){let n=[];e.name!==t.name&&n.push({field:"name",remote:e.name,local:t.name});let r=e.description??"";return r!==t.description&&n.push({field:"description",remote:r,local:t.description}),n}o(Qt,"diffAppMetadata");function Ia(e){let t=["Cannot deploy: metadata in app.json differs from what's deployed:"];for(let{field:n,remote:r,local:i}of e){let s=`${n}:`.padEnd(14);t.push(` ${s}"${r}" \u2192 "${i}"`)}return t.join(`
16
- `)}o(Ia,"formatMetadataDriftError");var en=class en{constructor(t){this.api=new nt(t)}getVersion(t,n){return this.api.getVersion(t,n)}uploadVersion(t,n,r,i,s){return this.api.uploadVersion(t,n,r,i,s)}async ensureApp(t,n,r){console.log("\u{1F50D} Ensuring app exists...");try{await this.api.createApp(t,n,r),console.log(`\u2705 App '${t}' created`)}catch(i){if(ue(i)&&i.status===409){console.log(`\u2705 App '${t}' already exists`),await this.checkMetadataDrift(t,n,r);return}throw i}}async checkMetadataDrift(t,n,r){let i;try{i=await this.getApp(t)}catch{return}let s=Qt(i,{name:n,description:r});if(s.length!==0)throw new m(Ia(s),{hint:"Run npx @cognite/cli apps metadata update to sync before deploying",shouldReport:!1})}getApp(t){return this.api.getApp(t)}async updateAppMetadata(t,n,r){await this.api.updateApps([{externalId:t,update:{name:{set:n},description:r?{set:r}:{setNull:!0}}}])}async submitSignatures(t,n,r){r.length!==0&&(console.log(`\u{1F50F} Submitting ${r.length} signature${r.length===1?"":"s"} for version ${n}...`),await this.api.submitSignatures(t,n,r),console.log("\u2705 Signatures stored"))}listSignatures(t,n){return this.api.listSignatures(t,n)}async publishVersion(t,n){await this.api.updateVersions(t,[{version:n,update:{lifecycleState:{set:"PUBLISHED"}}}])}async publishAndActivate(t,n){console.log(`\u{1F680} Publishing and activating version ${n}...`),await this.api.updateVersions(t,[{version:n,update:{lifecycleState:{set:"PUBLISHED"},alias:{set:"ACTIVE"}}}]),console.log(`\u2705 Version ${n} is now PUBLISHED and ACTIVE`)}getActiveVersion(t){return this.api.getActiveVersion(t)}async deactivateVersion(t,n){await this.api.updateVersions(t,[{version:n,update:{alias:{setNull:!0}}}])}async deleteVersion(t,n){await this.api.deleteVersions(t,[n])}async deprecateVersion(t,n){await this.api.updateVersions(t,[{version:n,update:{lifecycleState:{set:"DEPRECATED"}}}])}async archiveVersion(t,n){await this.api.updateVersions(t,[{version:n,update:{lifecycleState:{set:"ARCHIVED"}}}])}async activateVersion(t,n){let r=null;try{r=await this.api.getActiveVersion(t)}catch{r=null}let i=r&&r.version!==n?r.version:void 0;return await this.api.updateVersions(t,[{version:n,update:{alias:{set:"ACTIVE"}}}]),{supersededVersion:i}}async deploy(t,n,r,i,s,a,p=!1){console.log(`
12
+ cognite apps verify .cognite-bundles/my-app-1.0.0.zip --key /path/to/pub.pem Verify with explicit public key`).action((n,r)=>Hr(n,r,t))}o(jr,"registerVerifyCommand");var Kr="https://docs.cognite.com/cdf/access/";function j(e){return e!==null&&typeof e=="object"}o(j,"isRecord");function ue(e){return e instanceof Error&&"status"in e&&typeof e.status=="number"}o(ue,"isHttpError");function wa(e){switch(e){case 401:return`Your credentials are invalid or expired. Check your client ID and secret.
13
+ See: ${Kr}`;case 403:return`You don't have the required CDF capabilities. Please contact your CDF admin.
14
+ See: ${Kr}`;default:return}}o(wa,"httpStatusHint");function W(e){let t=e instanceof Error?e:new Error(String(e));if(!ue(t))return null;let n=wa(t.status);return n?Object.assign(new Error(`${t.message}
15
+ ${n}`),{cause:t}):null}o(W,"enrichedHttpError");function va(e){if(!j(e))return null;let t=e.missing;if(Array.isArray(t))return t;let n=e.data;if(j(n)){let r=n.error;if(j(r)&&Array.isArray(r.missing))return r.missing;if(Array.isArray(n.missing))return n.missing}return null}o(va,"findMissingArray");function Aa(e,t){if(!ue(e)||e.status!==400)return!1;let n=va(e);return n?n.some(r=>j(r)&&typeof r.externalId=="string"&&t.includes(r.externalId)):!1}o(Aa,"isMissingExternalIdError");function et(e,t){return ue(e)&&e.status===404||Aa(e,t)}o(et,"isNotFoundError");var Vr=["DRAFT","PUBLISHED","DEPRECATED","ARCHIVED"],Gr=["ACTIVE","PREVIEW"],Wt=class Wt extends Error{constructor(t,n){super(`Version ${n} of app ${t} not found`),this.name="AppVersionNotFoundError",this.appExternalId=t,this.version=n}};o(Wt,"AppVersionNotFoundError");var G=Wt,Jt=class Jt extends Error{constructor(t){super(`App ${t} not found`),this.name="AppNotFoundError",this.appExternalId=t}};o(Jt,"AppNotFoundError");var Ce=Jt;function tt(e,t){return e.includes(t)}o(tt,"includesValue");function Ca(e){return tt(Vr,e)}o(Ca,"isAppVersionLifecycleState");function Ea(e){return tt(Gr,e)}o(Ea,"isAppVersionAlias");function ba(e){return typeof e.version=="string"&&Ca(e.lifecycleState)&&typeof e.entrypoint=="string"&&typeof e.createdTime=="number"&&typeof e.createdBy=="string"&&typeof e.appExternalId=="string"&&(e.alias===void 0||Ea(e.alias))&&(e.comment===void 0||typeof e.comment=="string")}o(ba,"isAppVersion");function Br(e){if(!j(e)){let t=JSON.stringify(e)?.slice(0,200)??String(e);throw new Error(`Invalid version response: expected object, got ${t}`)}if(!ba(e)){let t=JSON.stringify(e).slice(0,300);throw new Error(`Invalid version response: missing or malformed fields. Got: ${t}`)}return e}o(Br,"parseAppVersion");function ka(e){if(!j(e))throw new Error("Invalid app response: not an object");let{externalId:t,name:n,description:r}=e;if(typeof t!="string")throw new Error("Invalid app response: missing externalId");if(typeof n!="string")throw new Error("Invalid app response: missing name");if(r!=null&&typeof r!="string")throw new Error("Invalid app response: malformed description");return{externalId:t,name:n,description:typeof r=="string"?r:void 0}}o(ka,"parseAppMetadata");var Xt=class Xt{constructor(t){this.client=t}get appsBasePath(){return`/api/v1/projects/${encodeURIComponent(this.client.project)}/apphosting/apps`}async createApp(t,n,r){try{await this.client.post(this.appsBasePath,{data:{items:[{externalId:t,name:n,description:r}]}})}catch(i){throw W(i)??i}}async updateApps(t){try{await this.client.post(`${this.appsBasePath}/update`,{data:{items:t}})}catch(n){throw W(n)??n}}async getApp(t){let n=`${this.appsBasePath}/${encodeURIComponent(t)}`;try{let r=await this.client.get(n);return ka(r.data)}catch(r){throw et(r,[t])?new Ce(t):W(r)??r}}async uploadVersion(t,n,r,i,s="index.html"){console.log(`\u{1F4E4} Uploading version ${n}...`);let a=new FormData;a.append("file",new Blob([new Uint8Array(r)]),i),a.append("version",n),a.append("entryPath",s);let p=encodeURIComponent(t),c=`${this.appsBasePath}/${p}/versions`,l=await this.client.authenticate();if(!l)throw new m("Failed to authenticate for upload",{hint:"Check your credentials and try again."});let d=A.from(l),u=`${this.client.getBaseUrl()}${c}`,y=new AbortController,g=setTimeout(()=>y.abort(),300*1e3),f;try{f=await fetch(u,{method:"POST",headers:{Authorization:`Bearer ${d.expose()}`},body:a,signal:y.signal})}catch(h){throw h instanceof Error&&h.name==="AbortError"?new m("Upload timed out after 5 minutes",{hint:"The upload took longer than 5 minutes. Try again \u2014 if it keeps timing out, check your network speed or bundle size."}):new m(`Failed to upload version to ${u}`,{cause:h,hint:"Check your network connection. Uploads can also fail behind a proxy that blocks multipart POST requests."})}finally{clearTimeout(g)}if(!f.ok){let h=await f.text(),S;try{S=JSON.parse(h)}catch{}let C=h;if(j(S)){let U=S.error;if(typeof U=="string")C=U;else if(j(U)){let x=U.message,k=U.code;C=typeof x=="string"?x:k!=null?`Unknown error (code: ${k})`:h}else{let x=S.message;C=typeof x=="string"?x:h}}let v=f.headers.get("x-request-id"),w=v?` | X-Request-ID: ${v}`:"",D=j(S)?S:h;throw new pe(`Upload failed: ${f.status} \u2014 ${C}${w}`,{httpStatusCode:f.status,requestUrl:u,responseBody:D})}console.log(`\u2705 Version ${n} uploaded`)}async getVersion(t,n){let r=encodeURIComponent(t),i=encodeURIComponent(n),s=`${this.appsBasePath}/${r}/versions/${i}`;try{let a=await this.client.get(s);return Br(a.data)}catch(a){throw et(a,[t,n])?new G(t,n):W(a)??a}}async getActiveVersion(t){let n=encodeURIComponent(t),r=`${this.appsBasePath}/${n}/versions/list`;try{let i=await this.client.post(r,{data:{filter:{aliases:["ACTIVE"]}}});if(!j(i.data)||!Array.isArray(i.data.items))throw new Error("Invalid versions/list response: expected an object with an items array");let{items:s}=i.data;if(s.length===0)return null;if(s.length>1)throw new Error(`Unexpected response: ${s.length} versions have the ACTIVE alias, expected at most 1`);return Br(s[0])}catch(i){if(et(i,[t]))return null;throw W(i)??i}}async deleteVersions(t,n){let r=encodeURIComponent(t),i=`${this.appsBasePath}/${r}/versions/delete`;try{await this.client.post(i,{data:{items:n.map(s=>({version:s}))}})}catch(s){throw W(s)??s}}async updateVersions(t,n){let r=encodeURIComponent(t),i=`${this.appsBasePath}/${r}/versions/update`;try{await this.client.post(i,{data:{items:n}})}catch(s){throw W(s)??s}}async submitSignatures(t,n,r){let i=encodeURIComponent(t),s=encodeURIComponent(n),a=`${this.appsBasePath}/${i}/versions/${s}/signatures`;try{await this.client.post(a,{data:{items:r}})}catch(p){throw W(p)??p}}async listSignatures(t,n){let r=encodeURIComponent(t),i=encodeURIComponent(n),s=`${this.appsBasePath}/${r}/versions/${i}/signatures/list`;try{let a=await this.client.post(s,{data:{}});return Da(a.data)}catch(a){throw W(a)??a}}};o(Xt,"AppHostingApi");var nt=Xt,xa=["VALID","REVOKED","EXPIRED","SIGNED_BEFORE_KEY_ISSUED","IAT_IN_FUTURE","BUNDLE_TOO_OLD","KEY_NOT_IN_REGISTRY","SCOPE_MISMATCH","VERIFICATION_FAILED"],Pa=["developer","certifier"];function Da(e){if(!j(e))throw new Error("Invalid signatures response: expected an object with an items array");let{items:t}=e;if(!Array.isArray(t))throw new Error("Invalid signatures response: items property is missing or not an array");return t.flatMap(n=>{let r=Ia(n);return r?[r]:[]})}o(Da,"parseStoredSignatures");function Ia(e){if(!j(e))return null;let{signerKid:t,signerRole:n,signatureIat:r,receivedAt:i,createdTime:s,status:a}=e;return typeof t!="string"||t===""||!tt(Pa,n)||typeof r!="number"||typeof i!="number"||typeof s!="number"||!tt(xa,a)?null:{signerKid:t,signerRole:n,signatureIat:r,receivedAt:i,createdTime:s,status:a}}o(Ia,"parseStoredSignature");function Zt(e,t){let n=[];e.name!==t.name&&n.push({field:"name",remote:e.name,local:t.name});let r=e.description??"";return r!==t.description&&n.push({field:"description",remote:r,local:t.description}),n}o(Zt,"diffAppMetadata");function Ta(e){let t=["Cannot deploy: metadata in app.json differs from what's deployed:"];for(let{field:n,remote:r,local:i}of e){let s=`${n}:`.padEnd(14);t.push(` ${s}"${r}" \u2192 "${i}"`)}return t.join(`
16
+ `)}o(Ta,"formatMetadataDriftError");var Qt=class Qt{constructor(t){this.api=new nt(t)}getVersion(t,n){return this.api.getVersion(t,n)}uploadVersion(t,n,r,i,s){return this.api.uploadVersion(t,n,r,i,s)}async ensureApp(t,n,r){console.log("\u{1F50D} Ensuring app exists...");try{await this.api.createApp(t,n,r),console.log(`\u2705 App '${t}' created`)}catch(i){if(ue(i)&&i.status===409){console.log(`\u2705 App '${t}' already exists`),await this.checkMetadataDrift(t,n,r);return}throw i}}async checkMetadataDrift(t,n,r){let i;try{i=await this.getApp(t)}catch{return}let s=Zt(i,{name:n,description:r});if(s.length!==0)throw new m(Ta(s),{hint:"Run npx @cognite/cli apps metadata update to sync before deploying",shouldReport:!1})}getApp(t){return this.api.getApp(t)}async updateAppMetadata(t,n,r){await this.api.updateApps([{externalId:t,update:{name:{set:n},description:r?{set:r}:{setNull:!0}}}])}async submitSignatures(t,n,r){r.length!==0&&(console.log(`\u{1F50F} Submitting ${r.length} signature${r.length===1?"":"s"} for version ${n}...`),await this.api.submitSignatures(t,n,r),console.log("\u2705 Signatures stored"))}listSignatures(t,n){return this.api.listSignatures(t,n)}async publishVersion(t,n){await this.api.updateVersions(t,[{version:n,update:{lifecycleState:{set:"PUBLISHED"}}}])}async publishAndActivate(t,n){console.log(`\u{1F680} Publishing and activating version ${n}...`),await this.api.updateVersions(t,[{version:n,update:{lifecycleState:{set:"PUBLISHED"},alias:{set:"ACTIVE"}}}]),console.log(`\u2705 Version ${n} is now PUBLISHED and ACTIVE`)}getActiveVersion(t){return this.api.getActiveVersion(t)}async deactivateVersion(t,n){await this.api.updateVersions(t,[{version:n,update:{alias:{setNull:!0}}}])}async deleteVersion(t,n){await this.api.deleteVersions(t,[n])}async deprecateVersion(t,n){await this.api.updateVersions(t,[{version:n,update:{lifecycleState:{set:"DEPRECATED"}}}])}async archiveVersion(t,n){await this.api.updateVersions(t,[{version:n,update:{lifecycleState:{set:"ARCHIVED"}}}])}async activateVersion(t,n){let r=null;try{r=await this.api.getActiveVersion(t)}catch{r=null}let i=r&&r.version!==n?r.version:void 0;return await this.api.updateVersions(t,[{version:n,update:{alias:{set:"ACTIVE"}}}]),{supersededVersion:i}}async deploy(t,n,r,i,s,a,p=!1){console.log(`
17
17
  \u{1F680} Deploying application via App Hosting API...
18
18
  `),await this.ensureApp(t,n,r),await this.uploadVersion(t,i,s,a),p&&await this.publishAndActivate(t,i),console.log(`
19
- \u2705 Deployment successful!`)}};o(en,"AppHostingClient");var I=en;import{CogniteClient as Do}from"@cognite/sdk";import Va from"os";import Ga from"path";import Ya from"open";import{buildAuthorizationUrl as qa,calculatePKCECodeChallenge as za,discovery as Wa,None as Ja,randomPKCECodeVerifier as Xa,randomState as Za}from"openid-client";import Gr from"mixpanel";var Ta="5c4d853e7c3b77b1eb4468d5329b278c",Ra="api-eu.mixpanel.com",xe="cognite-cli",Fa=2e3,Yr={env:process.env,init:Gr.init.bind(Gr)},$a={track:o(()=>{},"track"),flush:o(async()=>{},"flush")};function tn(e=process.env){return e.COGNITE_TELEMETRY_DISABLED==="1"||e.DO_NOT_TRACK==="1"}o(tn,"isTelemetryDisabled");function Oa(e=process.env){if(e.GITHUB_ACTIONS)return"github-actions";if(e.TF_BUILD)return"azure-devops";if(e.GITLAB_CI)return"gitlab-ci";if(e.CIRCLECI)return"circleci";if(e.TRAVIS)return"travis-ci";if(e.BUILDKITE)return"buildkite";if(e.DRONE)return"drone";if(e.SEMAPHORE)return"semaphore";if(e.TEAMCITY_VERSION)return"teamcity";if(e.APPVEYOR)return"appveyor";if(e.CODEBUILD_BUILD_ID)return"aws-codebuild";if(e.HEROKU_TEST_RUN_ID)return"heroku-ci";if(e.BITBUCKET_BUILD_NUMBER)return"bitbucket-pipelines";if(e.JENKINS_URL||e.JENKINS_HOME)return"jenkins";if(e.CI&&e.CI!=="false"&&e.CI!=="0")return"ci-generic"}o(Oa,"detectCiEnvironment");function Ma(e){return e.COGNITE_TELEMETRY_DEBUG==="1"}o(Ma,"isDebug");function rt(e={}){let t=e.env??Yr.env,n=e.init??Yr.init,r=e.packageName,i=e.cliVersion,s=Ma(t),a=Oa(t);if(tn(t))return s&&process.stderr.write(`[telemetry] disabled \u2014 noop tracker
20
- `),$a;let p,c=new Set;function l(){if(p)return p;try{return p=n(Ta,{geolocate:!1,keepAlive:!1,host:Ra}),p}catch{return}}return o(l,"getClient"),{track(d,u={}){let y=l();if(!y)return;let g={...u,applicationId:xe,...r&&{packageName:r},...i&&{cliVersion:i},nodeVersion:process.version,platform:process.platform,...a&&{ciEnvironment:a}};s&&process.stderr.write(`[telemetry] track ${d} ${JSON.stringify(g)}
21
- `);let f=o(()=>{},"finish"),h=new Promise(S=>{f=S});c.add(h);try{y.track(d,g,f)}catch{f()}h.finally(()=>c.delete(h))},async flush(d=Fa){if(c.size===0)return;let u,y=new Promise(g=>{u=setTimeout(g,d),u.unref?.()});try{await Promise.race([Promise.allSettled([...c]),y])}finally{u&&clearTimeout(u)}s&&process.stderr.write(`[telemetry] flush done (${c.size} still pending)
22
- `)}}}o(rt,"createTelemetry");import _a from"https";import{authorizationCodeGrant as La}from"openid-client";function qr(e){return e.replace(/[&<>"']/g,t=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[t]??t)}o(qr,"escapeHtml");function nn(e,t,n){let r=qr(t),i=qr(n);return`<html><body style="font-family: system-ui; padding: 40px; text-align: center;">
19
+ \u2705 Deployment successful!`)}};o(Qt,"AppHostingClient");var I=Qt;import{CogniteClient as Io}from"@cognite/sdk";import Ga from"os";import Ya from"path";import qa from"open";import{buildAuthorizationUrl as za,calculatePKCECodeChallenge as Wa,discovery as Ja,None as Xa,randomPKCECodeVerifier as Za,randomState as Qa}from"openid-client";import Yr from"mixpanel";var Ra="5c4d853e7c3b77b1eb4468d5329b278c",Fa="api-eu.mixpanel.com",Pe="cognite-cli",$a=2e3,qr={env:process.env,init:Yr.init.bind(Yr)},Oa={track:o(()=>{},"track"),flush:o(async()=>{},"flush")};function en(e=process.env){return e.COGNITE_TELEMETRY_DISABLED==="1"||e.DO_NOT_TRACK==="1"}o(en,"isTelemetryDisabled");function Ma(e=process.env){if(e.GITHUB_ACTIONS)return"github-actions";if(e.TF_BUILD)return"azure-devops";if(e.GITLAB_CI)return"gitlab-ci";if(e.CIRCLECI)return"circleci";if(e.TRAVIS)return"travis-ci";if(e.BUILDKITE)return"buildkite";if(e.DRONE)return"drone";if(e.SEMAPHORE)return"semaphore";if(e.TEAMCITY_VERSION)return"teamcity";if(e.APPVEYOR)return"appveyor";if(e.CODEBUILD_BUILD_ID)return"aws-codebuild";if(e.HEROKU_TEST_RUN_ID)return"heroku-ci";if(e.BITBUCKET_BUILD_NUMBER)return"bitbucket-pipelines";if(e.JENKINS_URL||e.JENKINS_HOME)return"jenkins";if(e.CI&&e.CI!=="false"&&e.CI!=="0")return"ci-generic"}o(Ma,"detectCiEnvironment");function Ua(e){return e.COGNITE_TELEMETRY_DEBUG==="1"}o(Ua,"isDebug");function rt(e={}){let t=e.env??qr.env,n=e.init??qr.init,r=e.packageName,i=e.cliVersion,s=Ua(t),a=Ma(t);if(en(t))return s&&process.stderr.write(`[telemetry] disabled \u2014 noop tracker
20
+ `),Oa;let p,c=new Set;function l(){if(p)return p;try{return p=n(Ra,{geolocate:!1,keepAlive:!1,host:Fa}),p}catch{return}}return o(l,"getClient"),{track(d,u={}){let y=l();if(!y)return;let g={...u,applicationId:Pe,...r&&{packageName:r},...i&&{cliVersion:i},nodeVersion:process.version,platform:process.platform,...a&&{ciEnvironment:a}};s&&process.stderr.write(`[telemetry] track ${d} ${JSON.stringify(g)}
21
+ `);let f=o(()=>{},"finish"),h=new Promise(S=>{f=S});c.add(h);try{y.track(d,g,f)}catch{f()}h.finally(()=>c.delete(h))},async flush(d=$a){if(c.size===0)return;let u,y=new Promise(g=>{u=setTimeout(g,d),u.unref?.()});try{await Promise.race([Promise.allSettled([...c]),y])}finally{u&&clearTimeout(u)}s&&process.stderr.write(`[telemetry] flush done (${c.size} still pending)
22
+ `)}}}o(rt,"createTelemetry");import La from"https";import{authorizationCodeGrant as Na}from"openid-client";function zr(e){return e.replace(/[&<>"']/g,t=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[t]??t)}o(zr,"escapeHtml");function tn(e,t,n){let r=zr(t),i=zr(n);return`<html><body style="font-family: system-ui; padding: 40px; text-align: center;">
23
23
  <h1>${r}</h1><p>${i}</p><p>You can close this window.</p>${e==="success"?`<style>
24
24
  @keyframes checkmark {
25
25
  0% { transform: scale(0); }
@@ -28,36 +28,36 @@ Examples:
28
28
  }
29
29
  h1 { animation: checkmark 0.5s ease-out; }
30
30
  </style>`:""}
31
- </body></html>`}o(nn,"generateHtml");import Ua from"net";function zr(e,t){return new Promise(n=>{let r=new Ua.Socket,i=o(s=>{r.removeAllListeners(),r.destroy(),n(s)},"done");r.setTimeout(500),r.once("connect",()=>i(!1)),r.once("timeout",()=>i(!0)),r.once("error",()=>i(!0)),r.connect(e,t)})}o(zr,"isHostPortFree");function ot(e,t={}){return L("windows",t)?`Find the process: netstat -ano | findstr :${e} then kill it: taskkill /PID <pid> /F`:`Free port ${e} (e.g. lsof -ti :${e} | xargs kill) and retry.`}o(ot,"freePortHint");async function Wr(e){if(e<0)throw new Error(`Invalid port: ${e}`);return e===0?!0:(await Promise.all([zr(e,"127.0.0.1"),zr(e,"::1")])).every(Boolean)}o(Wr,"isPortFree");async function Na(e,t,n,r,i,s){let a=new URL(e.url??"/",`https://${e.headers.host??"localhost"}`);if(a.pathname!=="/")return t.writeHead(404),t.end("Not found"),{shouldClose:!1};try{console.log("\u{1F504} Exchanging authorization code for tokens...");let p=await s.authorizationCodeGrant(n,a,{pkceCodeVerifier:r,expectedState:i});return t.writeHead(200,{"Content-Type":"text/html",Connection:"close"}),t.end(nn("success","Login Successful!","You can close this window and return to the terminal.")),{shouldClose:!0,tokens:p}}catch(p){let c=p instanceof Error?p:new Error(String(p));return t.writeHead(400,{"Content-Type":"text/html",Connection:"close"}),t.end(nn("error","Authentication Error",c.message)),{shouldClose:!0,error:c}}}o(Na,"handleCallback");function Ha(e){let t=e/6e4,n=Math.round(t*10)/10;return`${n} ${n===1?"minute":"minutes"}`}o(Ha,"formatTimeoutMinutes");function Jr(e,t,n,r,i,s={createServer:_a.createServer,setTimeout:globalThis.setTimeout,clearTimeout:globalThis.clearTimeout,authorizationCodeGrant:La}){return new Promise((a,p)=>{let c=s.createServer(t,async(u,y)=>{try{let g=await Na(u,y,n,r,i,s);g.shouldClose&&(d(),g.error?p(g.error):g.tokens?a(g.tokens):p(new Error("No tokens received")))}catch(g){d(),p(g instanceof Error?g:new Error(String(g)))}}),l=s.setTimeout(()=>{d(),p(new Error(`Login timeout - no response received within ${Ha(e.loginTimeout)}`))},e.loginTimeout);function d(){s.clearTimeout(l),c.close(),c.closeIdleConnections?.()}o(d,"cleanup"),c.on("error",u=>{d(),u.code==="EADDRINUSE"||u.code==="EACCES"?p(new m(`Port ${e.port} is already in use \u2014 the login callback server cannot start`,{cause:u,hint:ot(e.port)})):p(new m(`Login callback server failed: ${u.message}`,{cause:u}))}),c.listen(e.port,"127.0.0.1",()=>{console.log(`\u{1F310} Local HTTPS server started on https://localhost:${e.port}`)})})}o(Jr,"startCallbackServer");import{mkdirSync as ja}from"fs";import{loadLocalCertificates as Ka}from"@cognite/app-sdk/https";var Ba={loadLocalCertificates:Ka,mkdirSync:ja,logger:console};async function Xr(e,t=Ba){t.mkdirSync(e,{recursive:!0});let{cert:n,key:r,source:i}=await t.loadLocalCertificates({certDir:e}).catch(s=>{throw new m(`Failed to load SSL certificates from ${e}`,{cause:s,hint:"Run `npx @cognite/cli apps setup-https` to create trusted local certificates."})});return i==="mkcert"?t.logger.log("\u{1F510} Using mkcert certificates for HTTPS"):(t.logger.log("\u{1F510} Using in-memory self-signed certificate for HTTPS \u2014 your browser will give you a warning."),t.logger.log(" Run `npx @cognite/cli@latest apps setup-https` to install trusted local https certificates.")),{cert:n,key:r}}o(Xr,"getOrCreateCertificates");var rn="openid profile email",on={authority:"https://auth.cognite.com",clientId:"0404baaa-0a90-43a2-aba7-a110b53fb41c",redirectUri:"https://localhost:3000/",port:3e3,loginTimeout:300*1e3,certDir:Ga.join(Va.homedir(),".cdf-login")},Qa={open:Ya,getOrCreateCertificates:Xr,startCallbackServer:Jr,isPortFree:Wr,discovery:Wa,buildAuthorizationUrl:qa,randomPKCECodeVerifier:Xa,calculatePKCECodeChallenge:za,randomState:Za,logger:console,telemetry:rt()};async function Pe(e,t=on,n){return n===void 0?Zr(e,t,Qa):Zr(e,t,n)}o(Pe,"login");async function ep(e,t){let{discovery:n}=e;try{return await n(new URL(t.authority),t.clientId,void 0,Ja())}catch(r){throw new m(`Failed to fetch OpenID configuration from ${t.authority}`,{cause:r})}}o(ep,"fetchOpenIdConfig");async function Zr(e,t,n){let{isPortFree:r,telemetry:i,logger:s,randomPKCECodeVerifier:a,calculatePKCECodeChallenge:p,randomState:c,buildAuthorizationUrl:l,getOrCreateCertificates:d,open:u,startCallbackServer:y}=n;if(!await r(t.port))throw i?.track("Flows.CLI.PortInUse",{port:t.port}),new m(`Port ${t.port} is already in use \u2014 the login callback server cannot start`,{hint:ot(t.port)});s.log(`\u{1F510} Starting CDF login flow...
32
- `),s.log(`\u{1F4E1} Fetching OpenID configuration from ${t.authority}...`);let f=await ep(n,t),h=a(),S=await p(h),A=c(),v={redirect_uri:t.redirectUri,scope:t.scope??rn,code_challenge:S,code_challenge_method:"S256",state:A};e&&(v.organization_hint=e);let w=l(f,v).toString(),D=await d(t.certDir);e&&s.log(`\u{1F3E2} Organization: ${e}`),s.log(`\u{1F680} Opening browser for authentication...
31
+ </body></html>`}o(tn,"generateHtml");import _a from"net";function Wr(e,t){return new Promise(n=>{let r=new _a.Socket,i=o(s=>{r.removeAllListeners(),r.destroy(),n(s)},"done");r.setTimeout(500),r.once("connect",()=>i(!1)),r.once("timeout",()=>i(!0)),r.once("error",()=>i(!0)),r.connect(e,t)})}o(Wr,"isHostPortFree");function ot(e,t={}){return L("windows",t)?`Find the process: netstat -ano | findstr :${e} then kill it: taskkill /PID <pid> /F`:`Free port ${e} (e.g. lsof -ti :${e} | xargs kill) and retry.`}o(ot,"freePortHint");async function Jr(e){if(e<0)throw new Error(`Invalid port: ${e}`);return e===0?!0:(await Promise.all([Wr(e,"127.0.0.1"),Wr(e,"::1")])).every(Boolean)}o(Jr,"isPortFree");async function Ha(e,t,n,r,i,s){let a=new URL(e.url??"/",`https://${e.headers.host??"localhost"}`);if(a.pathname!=="/")return t.writeHead(404),t.end("Not found"),{shouldClose:!1};try{console.log("\u{1F504} Exchanging authorization code for tokens...");let p=await s.authorizationCodeGrant(n,a,{pkceCodeVerifier:r,expectedState:i});return t.writeHead(200,{"Content-Type":"text/html",Connection:"close"}),t.end(tn("success","Login Successful!","You can close this window and return to the terminal.")),{shouldClose:!0,tokens:p}}catch(p){let c=p instanceof Error?p:new Error(String(p));return t.writeHead(400,{"Content-Type":"text/html",Connection:"close"}),t.end(tn("error","Authentication Error",c.message)),{shouldClose:!0,error:c}}}o(Ha,"handleCallback");function ja(e){let t=e/6e4,n=Math.round(t*10)/10;return`${n} ${n===1?"minute":"minutes"}`}o(ja,"formatTimeoutMinutes");function Xr(e,t,n,r,i,s={createServer:La.createServer,setTimeout:globalThis.setTimeout,clearTimeout:globalThis.clearTimeout,authorizationCodeGrant:Na}){return new Promise((a,p)=>{let c=s.createServer(t,async(u,y)=>{try{let g=await Ha(u,y,n,r,i,s);g.shouldClose&&(d(),g.error?p(g.error):g.tokens?a(g.tokens):p(new Error("No tokens received")))}catch(g){d(),p(g instanceof Error?g:new Error(String(g)))}}),l=s.setTimeout(()=>{d(),p(new Error(`Login timeout - no response received within ${ja(e.loginTimeout)}`))},e.loginTimeout);function d(){s.clearTimeout(l),c.close(),c.closeIdleConnections?.()}o(d,"cleanup"),c.on("error",u=>{d(),u.code==="EADDRINUSE"||u.code==="EACCES"?p(new m(`Port ${e.port} is already in use \u2014 the login callback server cannot start`,{cause:u,hint:ot(e.port)})):p(new m(`Login callback server failed: ${u.message}`,{cause:u}))}),c.listen(e.port,"127.0.0.1",()=>{console.log(`\u{1F310} Local HTTPS server started on https://localhost:${e.port}`)})})}o(Xr,"startCallbackServer");import{mkdirSync as Ka}from"fs";import{loadLocalCertificates as Ba}from"@cognite/app-sdk/https";var Va={loadLocalCertificates:Ba,mkdirSync:Ka,logger:console};async function Zr(e,t=Va){t.mkdirSync(e,{recursive:!0});let{cert:n,key:r,source:i}=await t.loadLocalCertificates({certDir:e}).catch(s=>{throw new m(`Failed to load SSL certificates from ${e}`,{cause:s,hint:"Run `npx @cognite/cli apps setup-https` to create trusted local certificates."})});return i==="mkcert"?t.logger.log("\u{1F510} Using mkcert certificates for HTTPS"):(t.logger.log("\u{1F510} Using in-memory self-signed certificate for HTTPS \u2014 your browser will give you a warning."),t.logger.log(" Run `npx @cognite/cli@latest apps setup-https` to install trusted local https certificates.")),{cert:n,key:r}}o(Zr,"getOrCreateCertificates");var nn="openid profile email",rn={authority:"https://auth.cognite.com",clientId:"0404baaa-0a90-43a2-aba7-a110b53fb41c",redirectUri:"https://localhost:3000/",port:3e3,loginTimeout:300*1e3,certDir:Ya.join(Ga.homedir(),".cdf-login")},ep={open:qa,getOrCreateCertificates:Zr,startCallbackServer:Xr,isPortFree:Jr,discovery:Ja,buildAuthorizationUrl:za,randomPKCECodeVerifier:Za,calculatePKCECodeChallenge:Wa,randomState:Qa,logger:console,telemetry:rt()};async function De(e,t=rn,n){return n===void 0?Qr(e,t,ep):Qr(e,t,n)}o(De,"login");async function tp(e,t){let{discovery:n}=e;try{return await n(new URL(t.authority),t.clientId,void 0,Xa())}catch(r){throw new m(`Failed to fetch OpenID configuration from ${t.authority}`,{cause:r})}}o(tp,"fetchOpenIdConfig");async function Qr(e,t,n){let{isPortFree:r,telemetry:i,logger:s,randomPKCECodeVerifier:a,calculatePKCECodeChallenge:p,randomState:c,buildAuthorizationUrl:l,getOrCreateCertificates:d,open:u,startCallbackServer:y}=n;if(!await r(t.port))throw i?.track("Flows.CLI.PortInUse",{port:t.port}),new m(`Port ${t.port} is already in use \u2014 the login callback server cannot start`,{hint:ot(t.port)});s.log(`\u{1F510} Starting CDF login flow...
32
+ `),s.log(`\u{1F4E1} Fetching OpenID configuration from ${t.authority}...`);let f=await tp(n,t),h=a(),S=await p(h),C=c(),v={redirect_uri:t.redirectUri,scope:t.scope??nn,code_challenge:S,code_challenge_method:"S256",state:C};e&&(v.organization_hint=e);let w=l(f,v).toString(),D=await d(t.certDir);e&&s.log(`\u{1F3E2} Organization: ${e}`),s.log(`\u{1F680} Opening browser for authentication...
33
33
  `);try{await u(w)}catch(U){let x=U instanceof Error?U.message:String(U);s.error("\u274C Failed to open browser automatically."),s.error(` Reason: ${x}`),s.error(`Please open this URL manually:
34
- `),s.error(w),s.error("")}return y(t,D,f,h,A)}o(Zr,"loginImpl");import tp from"enquirer";function np(e){return`${e.org}/${e.project}`}o(np,"targetLabel");var it=o(async function(e,t,n,r={isTTY:process.stdin.isTTY,confirm:o(i=>tp.prompt({type:"confirm",name:"confirmed",message:i,initial:!1}),"confirm")}){let{isTTY:i,confirm:s}=r,a=np(e);if(t.confirmActionTarget!==void 0){if(t.confirmActionTarget===a)return;throw new m(`--confirm-action-target "${t.confirmActionTarget}" does not match the deployment this command resolved to ("${a}").`,{shouldReport:!1,hint:`Pass --confirm-action-target ${a} to ${n}.`})}if(console.warn(`
35
- Using session credentials \u2014 your token has access to all projects in the "${e.org}" organization.`),!i)throw new m("Session credentials detected but no TTY available for confirmation.",{shouldReport:!1,hint:"Pass --confirm-action-target <org/project> to skip the prompt, or configure deployClientId and deploySecretName in app.json."});let{confirmed:p}=await s(`Confirm ${n} to ${a}?`);if(!p)throw new m("Aborted.",{shouldReport:!1})},"confirmActionTarget");import rp from"enquirer";var op=o(e=>rp.prompt(e),"defaultPrompt");function ip(e){switch(e.method){case"client-credentials":return"Use client credentials from app.json";case"session":return`Reuse existing session for ${e.org}`;case"browser":return"One-off sign-in via browser (does not save a session; use `cognite auth login` for that)"}}o(ip,"choiceLabel");async function st(e,t=op){if(e.length===0)throw new m("No valid authentication method available.",{hint:"Run `cognite auth login` and authenticate to the correct organization, or set deployClientId/deploySecretName in app.json."});let n=e.map(a=>a.method);if(new Set(n).size!==n.length)throw new Error(`Cannot present a selection with duplicate method names (${n.join(", ")}).`);let r=Array.from(new Set(n)).join("|"),{choice:i}=await t({type:"select",name:"choice",message:`Multiple valid authentication methods detected (skip with --auth-method <${r}>). Authenticate with`,choices:e.map(a=>({name:a.method,message:ip(a)}))}),s=e.find(a=>a.method===i);if(!s)throw new m(`Selected authentication method "${i}" was not offered.`,{hint:"Pass --auth-method to choose one of the offered methods explicitly."});return s}o(st,"promptAuthMethod");async function Qr(e,t,n,r={confirmActionTarget:it,promptAuthMethod:st,isTTY:process.stdin.isTTY}){let{valid:i}=e;if(i.length===0)throw sp(e,t);let s;if(n.authMethod){let a=i.find(p=>p.method===n.authMethod);if(!a)throw new m(`Pass --auth-method ${i.map(p=>p.method).join(" or --auth-method ")} \u2014 "${n.authMethod}" is not currently valid for ${t.project} @ ${t.baseUrl}.`,{hint:"Run `cognite auth login` for a session, set deployClientId/deploySecretName in app.json for client credentials, or pass --interactive for browser login."});s=a}else if(i.length===1)[s]=i;else if(r.isTTY)s=await r.promptAuthMethod(i);else throw new m(`Pass --auth-method ${i.map(a=>a.method).join("|")} to choose non-interactively \u2014 several are valid for ${t.project} @ ${t.baseUrl} and there is no TTY to prompt.`,{shouldReport:!1,hint:"Or re-run in an interactive terminal to pick from the prompt."});return s.method==="session"&&n.action&&await r.confirmActionTarget(t,{confirmActionTarget:n.confirmActionTarget},n.action),s}o(Qr,"chooseAuthMethod");function sp(e,t){let{invalidSession:n}=e;if(!n)return new m(`No credentials available for ${t.project} @ ${t.baseUrl}.`,{hint:"Run `cognite auth login`, set deployClientId/deploySecretName in app.json, or pass --interactive."});let r=`Run \`cognite auth login\` for "${t.org}", or pass --interactive.`;return n.reason==="SESSION_EXPIRED"?new m(`Your session for organization "${n.org}" has expired.`,{hint:r}):new m(`Your active session is for organization "${n.org}", but this command targets "${t.org}".`,{hint:r})}o(sp,"createNoCredentialsError");import{existsSync as lp,mkdirSync as dp,readFileSync as up,renameSync as mp,rmSync as fp,writeFileSync as gp}from"fs";import{dirname as yp}from"path";import{isoTimestamp as hp,literal as Sp,nonEmpty as oo,object as wp,pipe as io,safeParse as vp,string as so}from"valibot";var me="cognite-cli-session",ap=1280,pp=process.platform==="win32"?ap:1/0,sn="cognite-session/chunks=";function at(e,t){return`${e}/chunk/${t}`}o(at,"chunkAccount");function an(e){if(!e.startsWith(sn))return null;let t=Number(e.slice(sn.length));return Number.isFinite(t)&&t>0?t:null}o(an,"parseChunkCount");async function cp(e,t){let{Entry:n}=await import("@napi-rs/keyring"),r=new n(e,t);return{setPassword:o(i=>r.setPassword(i),"setPassword"),getPassword:o(()=>r.getPassword(),"getPassword"),deleteCredential:o(()=>r.deleteCredential(),"deleteCredential")}}o(cp,"defaultCreateEntry");function pn(e){return{createEntry:e.createEntry??cp,chunkSize:e.chunkSize??pp}}o(pn,"resolveDeps");async function eo(e,t,n={}){let{createEntry:r,chunkSize:i}=pn(n),s=await r(me,e),a=s.getPassword();if(a!==null){let l=an(a);if(l!==null)for(let d=0;d<l;d++)(await r(me,at(e,d))).deleteCredential()}let p=t.expose();if(p.length<=i){s.setPassword(p);return}let c=[];for(let l=0;l<p.length;l+=i)c.push(p.slice(l,l+i));s.setPassword(`${sn}${c.length}`);for(let l=0;l<c.length;l++)(await r(me,at(e,l))).setPassword(c[l])}o(eo,"storeSessionToken");async function to(e,t={}){let{createEntry:n}=pn(t),r=(await n(me,e)).getPassword();if(r===null)return null;let i=an(r);if(i===null)return C.from(r);let s=[];for(let a=0;a<i;a++){let p=(await n(me,at(e,a))).getPassword();if(p===null)return null;s.push(p)}return C.from(s.join(""))}o(to,"readSessionToken");async function no(e,t={}){let{createEntry:n}=pn(t),r=await n(me,e),i=r.getPassword();if(i!==null){let s=an(i);if(s!==null)for(let a=0;a<s;a++)(await n(me,at(e,a))).deleteCredential()}r.deleteCredential()}o(no,"deleteSessionToken");var pt=1,ln=o(e=>`${e}/accessToken`,"accessTokenAccount"),dn=o(e=>`${e}/refreshToken`,"refreshTokenAccount"),ro=io(so(),oo("must not be empty"),hp("must be an ISO 8601 timestamp")),Cp=wp({version:Sp(pt),org:io(so(),oo("must not be empty")),accessTokenExpiresAt:ro,refreshTokenExpiresAt:ro});function ct(e){return{sessionFile:e.sessionFile??P().sessionFile,existsSync:e.existsSync??lp,readFileSync:e.readFileSync??up,writeFileSync:e.writeFileSync??gp,mkdirSync:e.mkdirSync??dp,renameSync:e.renameSync??mp,rmSync:e.rmSync??fp,storeSecret:e.storeSecret??eo,readSecret:e.readSecret??to,deleteSecret:e.deleteSecret??no}}o(ct,"resolveDeps");var cn="Run `npx @cognite/cli auth logout` to clear it, then `npx @cognite/cli auth login` to sign in again.";function fe(e={}){let t=ct(e);if(!t.existsSync(t.sessionFile))return null;let n=t.readFileSync(t.sessionFile,"utf-8"),r;try{r=JSON.parse(n)}catch{throw new Error(`Session file at ${t.sessionFile} is not valid JSON. ${cn}`)}let i=vp(Cp,r);if(!i.success){let s=i.issues[0],a=s.path?.map(c=>c.key).join(".")??"",p=a?`"${a}" `:"";throw new Error(`Session file is invalid: ${p}${s.message}. ${cn}`)}return i.output}o(fe,"readSessionMetadata");async function De(e={}){let t=ct(e),n=fe(e);if(!n)return null;let[r,i]=await Promise.all([t.readSecret(ln(n.org)),t.readSecret(dn(n.org))]);if(!r||!i)throw new Error(`Session metadata exists but its tokens are missing from the keychain. ${cn}`);return{...n,accessToken:r,refreshToken:i}}o(De,"readSession");async function lt(e,t={}){let n=ct(t);await n.storeSecret(ln(e.org),e.accessToken),await n.storeSecret(dn(e.org),e.refreshToken);let r={version:pt,org:e.org,accessTokenExpiresAt:e.accessTokenExpiresAt,refreshTokenExpiresAt:e.refreshTokenExpiresAt};n.mkdirSync(yp(n.sessionFile),{recursive:!0,mode:448});let i=`${n.sessionFile}.tmp`;n.writeFileSync(i,`${JSON.stringify(r,null,2)}
36
- `,{mode:384});try{n.renameSync(i,n.sessionFile)}catch(s){throw n.rmSync(i,{force:!0}),s}}o(lt,"writeSession");function Ap(e){if(!e.existsSync(e.sessionFile))return null;try{let t=JSON.parse(e.readFileSync(e.sessionFile,"utf-8"));if(t&&typeof t=="object"&&"org"in t){let n=t.org;return typeof n=="string"&&n.length>0?n:null}}catch{}return null}o(Ap,"readOrgLoosely");async function dt(e={}){let t=ct(e),n=Ap(t);t.rmSync(t.sessionFile,{force:!0}),n&&(await t.deleteSecret(ln(n)),await t.deleteSecret(dn(n)))}o(dt,"clearSession");var Ep=300*1e3;function ge(e,t=new Date){let n=t.getTime();return Date.parse(e.refreshTokenExpiresAt)<=n?"EXPIRED":Date.parse(e.accessTokenExpiresAt)-n<=Ep?"EXPIRING":"VALID"}o(ge,"tokenState");import Up from"path";import{lock as _p}from"proper-lockfile";import{None as bp,discovery as kp,tokenRevocation as xp,refreshTokenGrant as Pp}from"openid-client";var un={...on,scope:`${rn} offline_access`},Dp=3600,Ip=720*60*60;function po(e){return kp(new URL(e.authority),e.clientId,void 0,bp())}o(po,"discoverDefault");function ao(e){let t=typeof e=="string"?Number(e):e;return typeof t=="number"&&Number.isFinite(t)?t:void 0}o(ao,"asSeconds");function co(e,t,n=new Date,r={}){let i=t.access_token?C.from(t.access_token):null;if(!i)throw new m("Login succeeded but no access token was returned.",{hint:"The identity provider did not return an access token. Please try logging in again."});let s=t.refresh_token?C.from(t.refresh_token):r.previousRefreshToken;if(!s)throw new m("Login succeeded but no refresh token was returned.",{hint:"The identity provider may not support the `offline_access` scope, which is required for persisted sessions."});let a=n.getTime(),p=(ao(t.expires_in)??Dp)*1e3,c=(ao(t.refresh_expires_in)??Ip)*1e3;return{version:pt,org:e.org,accessToken:i,refreshToken:s,accessTokenExpiresAt:new Date(a+p).toISOString(),refreshTokenExpiresAt:new Date(a+c).toISOString()}}o(co,"buildSession");async function lo(e,t={}){let{login:n=o((s,a)=>Pe(s,a),"login"),now:r=o(()=>new Date,"now")}=t,i=await n(e.org,un);return co(e,i,r())}o(lo,"loginForSession");async function uo(e,t={}){let{discovery:n=po,tokenRevocation:r=o((s,a)=>xp(s,a.expose()),"tokenRevocation")}=t,i=await n(un);await r(i,e)}o(uo,"revokeRefreshToken");async function mo(e,t={}){let n=t.discovery??po,r=t.refreshTokenGrant??((p,c)=>Pp(p,c.expose())),i=t.now??(()=>new Date),s=await n(un),a=await r(s,e.refreshToken);return co({org:e.org},a,i(),{previousRefreshToken:e.refreshToken})}o(mo,"refreshSession");function fo(e){if(typeof e!="object"||e===null)return!1;if("error"in e&&typeof e.error=="string"&&e.error==="invalid_grant")return!0;if(e instanceof Error)return/invalid_grant/i.test(e.message);let t="message"in e&&typeof e.message=="string"?e.message:"";return/invalid_grant/i.test(t)}o(fo,"isInvalidGrant");var Tp="https://auth.cognite.com",mn=class mn extends Error{constructor(n,r,i){super(r,i);this.kind=n;this.name="SessionVerificationError"}};o(mn,"SessionVerificationError");var Ee=mn;function Rp(e){return e instanceof Error?"cause"in e&&e.cause instanceof Error?e.cause.message:e.message:String(e)}o(Rp,"describeTransportError");function Fp(e){return!(typeof e!="object"||e===null||"sub"in e&&typeof e.sub!="string"||"email"in e&&typeof e.email!="string"||"name"in e&&typeof e.name!="string"||"preferred_username"in e&&typeof e.preferred_username!="string")}o(Fp,"isJwtClaims");function $p(e){try{let t=e.expose().split(".");if(t.length!==3)return{};let n=JSON.parse(Buffer.from(t[1],"base64url").toString("utf-8"));return Fp(n)?n:{}}catch{return{}}}o($p,"decodeJwtClaims");function Op(e){return typeof e!="object"||e===null?!1:"items"in e?Array.isArray(e.items)?e.items.every(t=>typeof t=="object"&&t!==null&&"name"in t&&typeof t.name=="string"):!1:!0}o(Op,"isCogIdpProjectsResponse");function Mp(e){if(e)try{return new URL(e).host}catch{return}}o(Mp,"clusterFromApiUrl");async function go(e,t={}){let n=t.fetch??globalThis.fetch,r=`${Tp}/api/v0/orgs/${encodeURIComponent(e.org)}/projects`,i;try{i=await n(r,{headers:{Authorization:`Bearer ${e.accessToken.expose()}`}})}catch(l){throw new Ee("unreachable",Rp(l),{cause:l})}if(!i.ok)throw new Ee("rejected",`CogIdP rejected the token: ${i.status} ${i.statusText}`);let s=await i.json(),p=((Op(s)?s:{}).items??[]).map(l=>({name:l.name,cluster:Mp(l.apiUrl),...l.isDefault?{isDefault:!0}:{}})),c=$p(e.accessToken);return{sub:c.sub??"unknown",email:c.email,name:c.name,preferredUsername:c.preferred_username,projects:p}}o(go,"fetchSessionUserInfo");var Lp=3e4,fn=class fn extends m{constructor(t){super("Your session has expired.",{hint:"Run `cognite auth login` to sign in again.",shouldReport:!1,...t===void 0?{}:{cause:t}}),this.name="SessionExpiredError"}};o(fn,"SessionExpiredError");var Ie=fn;function ut(e){return new Ie(e)}o(ut,"expiredError");async function Np(e,t,n){let r=await e(Up.dirname(t),{stale:Lp,retries:{retries:10,factor:1.5,minTimeout:100,maxTimeout:1e3}});try{return await n()}finally{await r()}}o(Np,"withSessionLock");async function mt(e={}){let t=e.readSession??(()=>De()),n=e.now??(()=>new Date),r=e.sessionFile??P().sessionFile,i=e.lock??_p,s=await t();if(!s)return;let a=ge(s,n());if(a==="EXPIRED")throw ut();return a==="VALID"?s:Np(i,r,async()=>{let p=await t()??s,c=ge(p,n());if(c==="EXPIRED")throw ut();return c==="VALID"?p:Hp(p,e)})}o(mt,"ensureFreshSession");async function Hp(e,t){let n=t.readSession??(()=>De()),r=t.writeSession??(s=>lt(s)),i=t.refreshSession??(s=>mo(s));try{let s=await i(e);return await r(s),s}catch(s){if(!fo(s))throw s;let a=await n();if(a&&!a.refreshToken.equals(e.refreshToken))try{let p=await i(a);return await r(p),p}catch(p){throw ut(p)}throw ut(s)}}o(Hp,"refreshAndPersist");function yo(e,t,n){return e?t.org&&e.org!==t.org?{reason:"DIFFERENT_ORG",org:void 0}:ge(e,n)==="EXPIRED"?{reason:"SESSION_EXPIRED",org:void 0}:{org:e.org,reason:"VALID"}:{reason:"SESSION_MISSING",org:void 0}}o(yo,"getSessionOrgIfValid");function ho(e,t,n){let r=[];e.deployClientId&&r.push({method:"client-credentials",org:e.org});let i=n.readSessionMetadata(),s=yo(i,e,n.now());return s.reason==="VALID"&&r.push({method:"session",org:s.org}),t.interactive&&r.push({method:"browser"}),i&&(s.reason==="SESSION_EXPIRED"||s.reason==="DIFFERENT_ORG")?{valid:r,invalidSession:{reason:s.reason,org:i.org}}:{valid:r}}o(ho,"validAuthMethods");import{CogniteClient as Jp}from"@cognite/sdk";function jp(e){return Math.floor(Math.random()*Math.min(2**e*250,15e3))}o(jp,"exponentialBackoffWithJitter");function Kp(e){return new Promise(t=>setTimeout(t,e))}o(Kp,"sleep");async function So(e,t={}){let n=t.maxAttempts??5,r=t.shouldRetry??(()=>!0),i=t.delayInMsCalculator??jp;if(n<1)throw new Error("`maxAttempts` must be 1 or greater");if(n>100)throw new Error("`maxAttempts` must be 100 or less");let s=1;for(;;)try{return await e()}catch(a){if(s>=n||!r(a))throw a;let p=i(s);t.onAttemptFail?.(a,s,p),await Kp(p),s++}}o(So,"retryAsync");var Bp="https://auth.cognite.com/oauth2/token",Vp=o(e=>typeof e=="object"&&e!==null&&"access_token"in e&&typeof e.access_token=="string","hasAccessToken");async function wo({idp:e,tokenUrl:t,init:n,missingTokenHint:r}){let i;try{i=await So(()=>fetch(t,n),{maxAttempts:3})}catch(p){throw new m(`Failed to fetch access token from ${t}`,{cause:p})}if(!i.ok){let p=await i.text();throw new pe(`Failed to get token from ${e}: ${i.status} ${i.statusText}`,{httpStatusCode:i.status,requestUrl:t,responseBody:p})}let s=await i.text(),a;try{a=JSON.parse(s)}catch{throw new m(`Unexpected response from ${e} authentication (invalid JSON)`,{hint:r})}if(!Vp(a))throw new m(`No access token in ${e} authentication response`,{hint:r});return C.from(a.access_token)}o(wo,"fetchOAuthToken");var Gp=o(e=>{let t=e.DEPLOYMENT_SECRETS;if(!t)return{};try{let n=JSON.parse(t),r={};for(let[i,s]of Object.entries(n))if(typeof s=="string"){let a=i.toLowerCase().replace(/_/g,"-");r[a]=s}return r}catch(n){return console.error("Error parsing DEPLOYMENT_SECRETS:",n),{}}},"loadSecretsFromEnv"),Yp=o((e,t)=>{let n;if(t.DEPLOYMENT_SECRET&&(n=t.DEPLOYMENT_SECRET),n||(n=Gp(t)[e]),n||(n=t[e]),!n)throw new m(`Set the ${e} environment variable (named by deploySecretName in app.json) to your deploy client secret, e.g. in a .env file.`,{shouldReport:!1,hint:E(t)?"Alternatively, run `cognite auth login` to use your session, or pass --interactive for a one-off browser login.":"Alternatively, pass --interactive for a one-off browser login."});return C.from(n)},"getSecretFromEnv"),qp=o((e,t)=>{let n=t.expose();return wo({idp:"CDF",tokenUrl:Bp,init:{method:"POST",headers:{Authorization:`Basic ${btoa(`${e}:${n}`)}`,"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"client_credentials"})},missingTokenHint:"Check the client ID in app.json and the deployment secret in your environment."})},"getTokenCdf"),vo=o(({idp:e,tokenUrl:t,clientId:n,clientSecret:r,scopes:i,missingTokenHint:s})=>wo({idp:e,tokenUrl:t,init:{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:n,client_secret:r,grant_type:"client_credentials",...i!==void 0?{scope:i.join(" ")}:{}})},missingTokenHint:s}),"getTokenWithClientCredentials"),zp=o((e,t)=>{if(t!==void 0)return t.join(" ");if(!e)throw new Error("Entra ID authentication requires 'baseUrl' to be set in deployment configuration");try{return`${new URL(e).origin}/.default`}catch{throw new Error(`Entra ID authentication requires 'baseUrl' to be a valid CDF URL (e.g., https://cluster.cognitedata.com), got: ${e}`)}},"resolveEntraScope"),Wp=o((e,t,n,r,i)=>vo({idp:"Entra ID",tokenUrl:`https://login.microsoftonline.com/${n}/oauth2/v2.0/token`,clientId:e,clientSecret:t.expose(),scopes:i!==void 0?i:[zp(r)],missingTokenHint:"Check the client ID and tenant ID in app.json and the deployment secret in your environment."}),"getTokenEntra"),gn=o(async(e,t=process.env)=>{if(t.COGNITE_TOKEN)return C.from(t.COGNITE_TOKEN);let{deployClientId:n,deploySecretName:r,idpType:i="cdf",tenantId:s,baseUrl:a,scopes:p,tokenUrl:c}=e,l=Yp(r,t);if(i==="oauth"){if(!c)throw new Error("OAuth authentication requires 'tokenUrl' in deployment configuration");return vo({idp:"OAuth",tokenUrl:c,clientId:n,clientSecret:l.expose(),scopes:p,missingTokenHint:"Check the tokenUrl, client ID, scopes, and deployment secret in app.json and your environment."})}if(i==="entra_id"){if(!s)throw new Error("Entra ID authentication requires 'tenantId' in deployment configuration");return Wp(n,l,s,a,p)}return qp(n,l)},"getToken");async function ye(e,t,n=process.env,r){let i=await gn(e,n),s=n.COGNITE_BASE_URL??e.baseUrl,a=(r??(p=>new Jp(p)))({appId:t,project:e.project,baseUrl:s,oidcTokenProvider:o(async()=>i.expose(),"oidcTokenProvider")});return await a.authenticate(),a}o(ye,"getSdk");async function ft(e,t,n,r){let i=r({appId:t,project:e.project,baseUrl:e.baseUrl,oidcTokenProvider:o(async()=>n.expose(),"oidcTokenProvider")});return await i.authenticate(),i}o(ft,"buildAuthenticatedClient");async function Co(e,t,n){let{loginFn:r,createClient:i}=n,s=t.orgHint||e.org||void 0,a=await r(s);return ft(e,t.appId,C.from(a.access_token),i)}o(Co,"resolveViaBrowser");import{HttpError as Xp}from"@cognite/sdk";import{array as Ao,number as Zp,object as Eo,optional as Qp,safeParse as ec,string as tc}from"valibot";var nc=Eo({projects:Qp(Ao(Eo({projectUrlName:tc(),groups:Ao(Zp())})))});function rc(e,t){switch(e){case 401:return"Run `cognite auth login` to log in.";case 403:return"The token is valid but lacks access to this project. Ask your CDF admin to grant its service account access.";default:return e>=500?`${t} returned a server error \u2014 this is usually transient, so try again shortly.`:"Check that the deployment base URL and project in app.json are correct."}}o(rc,"hintForStatus");var bo=o(async function(e){let t=e.getBaseUrl(),n;try{({data:n}=await e.get("/api/v1/token/inspect"))}catch(i){throw i instanceof Xp?new m(`Could not verify project access against ${t} (${i.status}).`,{hint:rc(i.status,t),cause:i}):new m(`Could not connect to ${t} to verify project access.`,{hint:"Check your network connection and verify that the base URL is correct.",cause:i})}let r=ec(nc,n);if(!r.success)throw new m(`Unexpected response from ${t}/api/v1/token/inspect.`,{hint:"Retry; if it persists, your CLI may be out of date or a proxy is altering responses.",cause:new Error(JSON.stringify(r.issues))});return r.output},"inspectDeploymentToken");async function ko(e,t,n,r){if(!((await(r?.inspectToken||bo)(e)).projects??[]).some(p=>p.projectUrlName===t.project&&p.groups.length>0))throw new m(`Your session for organization "${n}" doesn't have access to project "${t.project}" on ${t.baseUrl}.`,{hint:`Check you signed in to the right organization, or have access to the project "${t.project}" within "${n}" organization; \`@cognite/cli auth status\` lists the projects you can reach within your already logged in session token.`})}o(ko,"assertProjectAccess");async function xo(e,t,n,r){let i=await r.ensureFreshSession();if(!i)throw new m(`No credentials available for ${e.project} @ ${e.baseUrl}.`,{hint:"Run `cognite auth login` to login."});let s=await ft(e,t,i.accessToken,r.createClient);return await ko(s,e,n),s}o(xo,"resolveViaSession");async function Po(e,t,n,r){switch(e.method){case"client-credentials":return r.getSdkFn(t,n.appId);case"session":return xo(t,n.appId,e.org,r);case"browser":return Co(t,n,r)}}o(Po,"buildClientForAuthMethod");async function j(e,t,n={}){let{isSessionAuthEnabled:r=E}=n;return r()?ic(e,t,n):oc(e,t,n)}o(j,"buildAppHostingApiClient");var oc=o(async(e,t,n={})=>{let{login:r=Pe,getSdk:i=ye,createClient:s=o(a=>new Do(a),"createClient")}=n;if(t.interactive){let a=t.orgHint||e.org||void 0,p=await r(a),c=C.from(p.access_token),l=s({appId:t.appId,project:e.project,baseUrl:e.baseUrl,getToken:o(async()=>c.expose(),"getToken")});return await l.authenticate(),l}return i(e,t.appId)},"buildAppHostingApiClientWithoutSessionSupport");async function gt(e,t,n={}){let r=await j(e,t,n);return new I(r)}o(gt,"buildAppHostingClient");async function ic(e,t,n={}){let{login:r=Pe,getSdk:i=ye,createClient:s=o(f=>new Do(f),"createClient"),readSessionMetadata:a=fe,ensureFreshSession:p=mt,promptAuthMethod:c=st,confirmActionTarget:l=it,isTTY:d=process.stdin.isTTY,now:u=o(()=>new Date,"now")}=n,y=ho(e,t,{readSessionMetadata:a,now:u}),g=await Qr(y,e,t,{promptAuthMethod:c,confirmActionTarget:l,isTTY:d});return Po(g,e,t,{loginFn:r,getSdkFn:i,createClient:s,ensureFreshSession:p})}o(ic,"buildAppHostingClientWithSessionSupport");import Io from"enquirer";var To="Enter custom target...";function Ro(e,t){let n=t.map((r,i)=>` ${i}: ${r.org}/${r.project}`).join(`
34
+ `),s.error(w),s.error("")}return y(t,D,f,h,C)}o(Qr,"loginImpl");import np from"enquirer";function rp(e){return`${e.org}/${e.project}`}o(rp,"targetLabel");var it=o(async function(e,t,n,r={isTTY:process.stdin.isTTY,confirm:o(i=>np.prompt({type:"confirm",name:"confirmed",message:i,initial:!1}),"confirm")}){let{isTTY:i,confirm:s}=r,a=rp(e);if(t.confirmActionTarget!==void 0){if(t.confirmActionTarget===a)return;throw new m(`--confirm-action-target "${t.confirmActionTarget}" does not match the deployment this command resolved to ("${a}").`,{shouldReport:!1,hint:`Pass --confirm-action-target ${a} to ${n}.`})}if(console.warn(`
35
+ Using session credentials \u2014 your token has access to all projects in the "${e.org}" organization.`),!i)throw new m("Session credentials detected but no TTY available for confirmation.",{shouldReport:!1,hint:"Pass --confirm-action-target <org/project> to skip the prompt, or configure deployClientId and deploySecretName in app.json."});let{confirmed:p}=await s(`Confirm ${n} to ${a}?`);if(!p)throw new m("Aborted.",{shouldReport:!1})},"confirmActionTarget");import op from"enquirer";var ip=o(e=>op.prompt(e),"defaultPrompt");function sp(e){switch(e.method){case"client-credentials":return"Use client credentials from app.json";case"session":return`Reuse existing session for ${e.org}`;case"browser":return"One-off sign-in via browser (does not save a session; use `cognite auth login` for that)"}}o(sp,"choiceLabel");async function st(e,t=ip){if(e.length===0)throw new m("No valid authentication method available.",{hint:"Run `cognite auth login` and authenticate to the correct organization, or set deployClientId/deploySecretName in app.json."});let n=e.map(a=>a.method);if(new Set(n).size!==n.length)throw new Error(`Cannot present a selection with duplicate method names (${n.join(", ")}).`);let r=Array.from(new Set(n)).join("|"),{choice:i}=await t({type:"select",name:"choice",message:`Multiple valid authentication methods detected (skip with --auth-method <${r}>). Authenticate with`,choices:e.map(a=>({name:a.method,message:sp(a)}))}),s=e.find(a=>a.method===i);if(!s)throw new m(`Selected authentication method "${i}" was not offered.`,{hint:"Pass --auth-method to choose one of the offered methods explicitly."});return s}o(st,"promptAuthMethod");async function eo(e,t,n,r={confirmActionTarget:it,promptAuthMethod:st,isTTY:process.stdin.isTTY}){let{valid:i}=e;if(i.length===0)throw ap(e,t);let s;if(n.authMethod){let a=i.find(p=>p.method===n.authMethod);if(!a)throw new m(`Pass --auth-method ${i.map(p=>p.method).join(" or --auth-method ")} \u2014 "${n.authMethod}" is not currently valid for ${t.project} @ ${t.baseUrl}.`,{hint:"Run `cognite auth login` for a session, set deployClientId/deploySecretName in app.json for client credentials, or pass --interactive for browser login."});s=a}else if(i.length===1)[s]=i;else if(r.isTTY)s=await r.promptAuthMethod(i);else throw new m(`Pass --auth-method ${i.map(a=>a.method).join("|")} to choose non-interactively \u2014 several are valid for ${t.project} @ ${t.baseUrl} and there is no TTY to prompt.`,{shouldReport:!1,hint:"Or re-run in an interactive terminal to pick from the prompt."});if(s.method==="session"&&n.action&&!n.interactive)await r.confirmActionTarget(t,{confirmActionTarget:n.confirmActionTarget},n.action);else if(n.confirmActionTarget!==void 0&&s.method!=="session")throw new m(`Remove --confirm-action-target \u2014 it only guards session credentials and is never validated against the selected deployment with ${s.method} authentication.`,{shouldReport:!1,hint:"Pass --auth-method session (or pick the session option at the prompt) if you meant to acknowledge a session target."});return s}o(eo,"chooseAuthMethod");function ap(e,t){let{invalidSession:n}=e;if(!n)return new m(`No credentials available for ${t.project} @ ${t.baseUrl}.`,{hint:"Run `cognite auth login`, set deployClientId/deploySecretName in app.json, or pass --interactive."});let r=`Run \`cognite auth login\` for "${t.org}", or pass --interactive.`;return n.reason==="SESSION_EXPIRED"?new m(`Your session for organization "${n.org}" has expired.`,{hint:r}):new m(`Your active session is for organization "${n.org}", but this command targets "${t.org}".`,{hint:r})}o(ap,"createNoCredentialsError");import{existsSync as dp,mkdirSync as up,readFileSync as mp,renameSync as fp,rmSync as gp,writeFileSync as yp}from"fs";import{dirname as hp}from"path";import{isoTimestamp as Sp,literal as wp,nonEmpty as io,object as vp,pipe as so,safeParse as Ap,string as ao}from"valibot";var me="cognite-cli-session",pp=1280,cp=process.platform==="win32"?pp:1/0,on="cognite-session/chunks=";function at(e,t){return`${e}/chunk/${t}`}o(at,"chunkAccount");function sn(e){if(!e.startsWith(on))return null;let t=Number(e.slice(on.length));return Number.isFinite(t)&&t>0?t:null}o(sn,"parseChunkCount");async function lp(e,t){let{Entry:n}=await import("@napi-rs/keyring"),r=new n(e,t);return{setPassword:o(i=>r.setPassword(i),"setPassword"),getPassword:o(()=>r.getPassword(),"getPassword"),deleteCredential:o(()=>r.deleteCredential(),"deleteCredential")}}o(lp,"defaultCreateEntry");function an(e){return{createEntry:e.createEntry??lp,chunkSize:e.chunkSize??cp}}o(an,"resolveDeps");async function to(e,t,n={}){let{createEntry:r,chunkSize:i}=an(n),s=await r(me,e),a=s.getPassword();if(a!==null){let l=sn(a);if(l!==null)for(let d=0;d<l;d++)(await r(me,at(e,d))).deleteCredential()}let p=t.expose();if(p.length<=i){s.setPassword(p);return}let c=[];for(let l=0;l<p.length;l+=i)c.push(p.slice(l,l+i));s.setPassword(`${on}${c.length}`);for(let l=0;l<c.length;l++)(await r(me,at(e,l))).setPassword(c[l])}o(to,"storeSessionToken");async function no(e,t={}){let{createEntry:n}=an(t),r=(await n(me,e)).getPassword();if(r===null)return null;let i=sn(r);if(i===null)return A.from(r);let s=[];for(let a=0;a<i;a++){let p=(await n(me,at(e,a))).getPassword();if(p===null)return null;s.push(p)}return A.from(s.join(""))}o(no,"readSessionToken");async function ro(e,t={}){let{createEntry:n}=an(t),r=await n(me,e),i=r.getPassword();if(i!==null){let s=sn(i);if(s!==null)for(let a=0;a<s;a++)(await n(me,at(e,a))).deleteCredential()}r.deleteCredential()}o(ro,"deleteSessionToken");var pt=1,cn=o(e=>`${e}/accessToken`,"accessTokenAccount"),ln=o(e=>`${e}/refreshToken`,"refreshTokenAccount"),oo=so(ao(),io("must not be empty"),Sp("must be an ISO 8601 timestamp")),Cp=vp({version:wp(pt),org:so(ao(),io("must not be empty")),accessTokenExpiresAt:oo,refreshTokenExpiresAt:oo});function ct(e){return{sessionFile:e.sessionFile??P().sessionFile,existsSync:e.existsSync??dp,readFileSync:e.readFileSync??mp,writeFileSync:e.writeFileSync??yp,mkdirSync:e.mkdirSync??up,renameSync:e.renameSync??fp,rmSync:e.rmSync??gp,storeSecret:e.storeSecret??to,readSecret:e.readSecret??no,deleteSecret:e.deleteSecret??ro}}o(ct,"resolveDeps");var pn="Run `npx @cognite/cli auth logout` to clear it, then `npx @cognite/cli auth login` to sign in again.";function fe(e={}){let t=ct(e);if(!t.existsSync(t.sessionFile))return null;let n=t.readFileSync(t.sessionFile,"utf-8"),r;try{r=JSON.parse(n)}catch{throw new Error(`Session file at ${t.sessionFile} is not valid JSON. ${pn}`)}let i=Ap(Cp,r);if(!i.success){let s=i.issues[0],a=s.path?.map(c=>c.key).join(".")??"",p=a?`"${a}" `:"";throw new Error(`Session file is invalid: ${p}${s.message}. ${pn}`)}return i.output}o(fe,"readSessionMetadata");async function Ie(e={}){let t=ct(e),n=fe(e);if(!n)return null;let[r,i]=await Promise.all([t.readSecret(cn(n.org)),t.readSecret(ln(n.org))]);if(!r||!i)throw new Error(`Session metadata exists but its tokens are missing from the keychain. ${pn}`);return{...n,accessToken:r,refreshToken:i}}o(Ie,"readSession");async function lt(e,t={}){let n=ct(t);await n.storeSecret(cn(e.org),e.accessToken),await n.storeSecret(ln(e.org),e.refreshToken);let r={version:pt,org:e.org,accessTokenExpiresAt:e.accessTokenExpiresAt,refreshTokenExpiresAt:e.refreshTokenExpiresAt};n.mkdirSync(hp(n.sessionFile),{recursive:!0,mode:448});let i=`${n.sessionFile}.tmp`;n.writeFileSync(i,`${JSON.stringify(r,null,2)}
36
+ `,{mode:384});try{n.renameSync(i,n.sessionFile)}catch(s){throw n.rmSync(i,{force:!0}),s}}o(lt,"writeSession");function Ep(e){if(!e.existsSync(e.sessionFile))return null;try{let t=JSON.parse(e.readFileSync(e.sessionFile,"utf-8"));if(t&&typeof t=="object"&&"org"in t){let n=t.org;return typeof n=="string"&&n.length>0?n:null}}catch{}return null}o(Ep,"readOrgLoosely");async function dt(e={}){let t=ct(e),n=Ep(t);t.rmSync(t.sessionFile,{force:!0}),n&&(await t.deleteSecret(cn(n)),await t.deleteSecret(ln(n)))}o(dt,"clearSession");var bp=300*1e3;function ge(e,t=new Date){let n=t.getTime();return Date.parse(e.refreshTokenExpiresAt)<=n?"EXPIRED":Date.parse(e.accessTokenExpiresAt)-n<=bp?"EXPIRING":"VALID"}o(ge,"tokenState");import _p from"path";import{lock as Lp}from"proper-lockfile";import{None as kp,discovery as xp,tokenRevocation as Pp,refreshTokenGrant as Dp}from"openid-client";var dn={...rn,scope:`${nn} offline_access`},Ip=3600,Tp=720*60*60;function co(e){return xp(new URL(e.authority),e.clientId,void 0,kp())}o(co,"discoverDefault");function po(e){let t=typeof e=="string"?Number(e):e;return typeof t=="number"&&Number.isFinite(t)?t:void 0}o(po,"asSeconds");function lo(e,t,n=new Date,r={}){let i=t.access_token?A.from(t.access_token):null;if(!i)throw new m("Login succeeded but no access token was returned.",{hint:"The identity provider did not return an access token. Please try logging in again."});let s=t.refresh_token?A.from(t.refresh_token):r.previousRefreshToken;if(!s)throw new m("Login succeeded but no refresh token was returned.",{hint:"The identity provider may not support the `offline_access` scope, which is required for persisted sessions."});let a=n.getTime(),p=(po(t.expires_in)??Ip)*1e3,c=(po(t.refresh_expires_in)??Tp)*1e3;return{version:pt,org:e.org,accessToken:i,refreshToken:s,accessTokenExpiresAt:new Date(a+p).toISOString(),refreshTokenExpiresAt:new Date(a+c).toISOString()}}o(lo,"buildSession");async function uo(e,t={}){let{login:n=o((s,a)=>De(s,a),"login"),now:r=o(()=>new Date,"now")}=t,i=await n(e.org,dn);return lo(e,i,r())}o(uo,"loginForSession");async function mo(e,t={}){let{discovery:n=co,tokenRevocation:r=o((s,a)=>Pp(s,a.expose()),"tokenRevocation")}=t,i=await n(dn);await r(i,e)}o(mo,"revokeRefreshToken");async function fo(e,t={}){let n=t.discovery??co,r=t.refreshTokenGrant??((p,c)=>Dp(p,c.expose())),i=t.now??(()=>new Date),s=await n(dn),a=await r(s,e.refreshToken);return lo({org:e.org},a,i(),{previousRefreshToken:e.refreshToken})}o(fo,"refreshSession");function go(e){if(typeof e!="object"||e===null)return!1;if("error"in e&&typeof e.error=="string"&&e.error==="invalid_grant")return!0;if(e instanceof Error)return/invalid_grant/i.test(e.message);let t="message"in e&&typeof e.message=="string"?e.message:"";return/invalid_grant/i.test(t)}o(go,"isInvalidGrant");var Rp="https://auth.cognite.com",un=class un extends Error{constructor(n,r,i){super(r,i);this.kind=n;this.name="SessionVerificationError"}};o(un,"SessionVerificationError");var Ee=un;function Fp(e){return e instanceof Error?"cause"in e&&e.cause instanceof Error?e.cause.message:e.message:String(e)}o(Fp,"describeTransportError");function $p(e){return!(typeof e!="object"||e===null||"sub"in e&&typeof e.sub!="string"||"email"in e&&typeof e.email!="string"||"name"in e&&typeof e.name!="string"||"preferred_username"in e&&typeof e.preferred_username!="string")}o($p,"isJwtClaims");function Op(e){try{let t=e.expose().split(".");if(t.length!==3)return{};let n=JSON.parse(Buffer.from(t[1],"base64url").toString("utf-8"));return $p(n)?n:{}}catch{return{}}}o(Op,"decodeJwtClaims");function Mp(e){return typeof e!="object"||e===null?!1:"items"in e?Array.isArray(e.items)?e.items.every(t=>typeof t=="object"&&t!==null&&"name"in t&&typeof t.name=="string"):!1:!0}o(Mp,"isCogIdpProjectsResponse");function Up(e){if(e)try{return new URL(e).host}catch{return}}o(Up,"clusterFromApiUrl");async function yo(e,t={}){let n=t.fetch??globalThis.fetch,r=`${Rp}/api/v0/orgs/${encodeURIComponent(e.org)}/projects`,i;try{i=await n(r,{headers:{Authorization:`Bearer ${e.accessToken.expose()}`}})}catch(l){throw new Ee("unreachable",Fp(l),{cause:l})}if(!i.ok)throw new Ee("rejected",`CogIdP rejected the token: ${i.status} ${i.statusText}`);let s=await i.json(),p=((Mp(s)?s:{}).items??[]).map(l=>({name:l.name,cluster:Up(l.apiUrl),...l.isDefault?{isDefault:!0}:{}})),c=Op(e.accessToken);return{sub:c.sub??"unknown",email:c.email,name:c.name,preferredUsername:c.preferred_username,projects:p}}o(yo,"fetchSessionUserInfo");var Np=3e4,mn=class mn extends m{constructor(t){super("Your session has expired.",{hint:"Run `cognite auth login` to sign in again.",shouldReport:!1,...t===void 0?{}:{cause:t}}),this.name="SessionExpiredError"}};o(mn,"SessionExpiredError");var Te=mn;function ut(e){return new Te(e)}o(ut,"expiredError");async function Hp(e,t,n){let r=await e(_p.dirname(t),{stale:Np,retries:{retries:10,factor:1.5,minTimeout:100,maxTimeout:1e3}});try{return await n()}finally{await r()}}o(Hp,"withSessionLock");async function mt(e={}){let t=e.readSession??(()=>Ie()),n=e.now??(()=>new Date),r=e.sessionFile??P().sessionFile,i=e.lock??Lp,s=await t();if(!s)return;let a=ge(s,n());if(a==="EXPIRED")throw ut();return a==="VALID"?s:Hp(i,r,async()=>{let p=await t()??s,c=ge(p,n());if(c==="EXPIRED")throw ut();return c==="VALID"?p:jp(p,e)})}o(mt,"ensureFreshSession");async function jp(e,t){let n=t.readSession??(()=>Ie()),r=t.writeSession??(s=>lt(s)),i=t.refreshSession??(s=>fo(s));try{let s=await i(e);return await r(s),s}catch(s){if(!go(s))throw s;let a=await n();if(a&&!a.refreshToken.equals(e.refreshToken))try{let p=await i(a);return await r(p),p}catch(p){throw ut(p)}throw ut(s)}}o(jp,"refreshAndPersist");function ho(e,t,n){return e?t.org&&e.org!==t.org?{reason:"DIFFERENT_ORG",org:void 0}:ge(e,n)==="EXPIRED"?{reason:"SESSION_EXPIRED",org:void 0}:{org:e.org,reason:"VALID"}:{reason:"SESSION_MISSING",org:void 0}}o(ho,"getSessionOrgIfValid");function So(e,t,n){let r=[];e.deployClientId&&r.push({method:"client-credentials",org:e.org});let i=n.readSessionMetadata(),s=ho(i,e,n.now());return s.reason==="VALID"&&r.push({method:"session",org:s.org}),t.interactive&&r.push({method:"browser"}),i&&(s.reason==="SESSION_EXPIRED"||s.reason==="DIFFERENT_ORG")?{valid:r,invalidSession:{reason:s.reason,org:i.org}}:{valid:r}}o(So,"validAuthMethods");import{CogniteClient as Xp}from"@cognite/sdk";function Kp(e){return Math.floor(Math.random()*Math.min(2**e*250,15e3))}o(Kp,"exponentialBackoffWithJitter");function Bp(e){return new Promise(t=>setTimeout(t,e))}o(Bp,"sleep");async function wo(e,t={}){let n=t.maxAttempts??5,r=t.shouldRetry??(()=>!0),i=t.delayInMsCalculator??Kp;if(n<1)throw new Error("`maxAttempts` must be 1 or greater");if(n>100)throw new Error("`maxAttempts` must be 100 or less");let s=1;for(;;)try{return await e()}catch(a){if(s>=n||!r(a))throw a;let p=i(s);t.onAttemptFail?.(a,s,p),await Bp(p),s++}}o(wo,"retryAsync");var Vp="https://auth.cognite.com/oauth2/token",Gp=o(e=>typeof e=="object"&&e!==null&&"access_token"in e&&typeof e.access_token=="string","hasAccessToken");async function vo({idp:e,tokenUrl:t,init:n,missingTokenHint:r}){let i;try{i=await wo(()=>fetch(t,n),{maxAttempts:3})}catch(p){throw new m(`Failed to fetch access token from ${t}`,{cause:p})}if(!i.ok){let p=await i.text();throw new pe(`Failed to get token from ${e}: ${i.status} ${i.statusText}`,{httpStatusCode:i.status,requestUrl:t,responseBody:p})}let s=await i.text(),a;try{a=JSON.parse(s)}catch{throw new m(`Unexpected response from ${e} authentication (invalid JSON)`,{hint:r})}if(!Gp(a))throw new m(`No access token in ${e} authentication response`,{hint:r});return A.from(a.access_token)}o(vo,"fetchOAuthToken");var Yp=o(e=>{let t=e.DEPLOYMENT_SECRETS;if(!t)return{};try{let n=JSON.parse(t),r={};for(let[i,s]of Object.entries(n))if(typeof s=="string"){let a=i.toLowerCase().replace(/_/g,"-");r[a]=s}return r}catch(n){return console.error("Error parsing DEPLOYMENT_SECRETS:",n),{}}},"loadSecretsFromEnv"),qp=o((e,t)=>{let n;if(t.DEPLOYMENT_SECRET&&(n=t.DEPLOYMENT_SECRET),n||(n=Yp(t)[e]),n||(n=t[e]),!n)throw new m(`Set the ${e} environment variable (named by deploySecretName in app.json) to your deploy client secret, e.g. in a .env file.`,{shouldReport:!1,hint:E(t)?"Alternatively, run `cognite auth login` to use your session, or pass --interactive for a one-off browser login.":"Alternatively, pass --interactive for a one-off browser login."});return A.from(n)},"getSecretFromEnv"),zp=o((e,t)=>{let n=t.expose();return vo({idp:"CDF",tokenUrl:Vp,init:{method:"POST",headers:{Authorization:`Basic ${btoa(`${e}:${n}`)}`,"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"client_credentials"})},missingTokenHint:"Check the client ID in app.json and the deployment secret in your environment."})},"getTokenCdf"),Ao=o(({idp:e,tokenUrl:t,clientId:n,clientSecret:r,scopes:i,missingTokenHint:s})=>vo({idp:e,tokenUrl:t,init:{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:n,client_secret:r,grant_type:"client_credentials",...i!==void 0?{scope:i.join(" ")}:{}})},missingTokenHint:s}),"getTokenWithClientCredentials"),Wp=o((e,t)=>{if(t!==void 0)return t.join(" ");if(!e)throw new Error("Entra ID authentication requires 'baseUrl' to be set in deployment configuration");try{return`${new URL(e).origin}/.default`}catch{throw new Error(`Entra ID authentication requires 'baseUrl' to be a valid CDF URL (e.g., https://cluster.cognitedata.com), got: ${e}`)}},"resolveEntraScope"),Jp=o((e,t,n,r,i)=>Ao({idp:"Entra ID",tokenUrl:`https://login.microsoftonline.com/${n}/oauth2/v2.0/token`,clientId:e,clientSecret:t.expose(),scopes:i!==void 0?i:[Wp(r)],missingTokenHint:"Check the client ID and tenant ID in app.json and the deployment secret in your environment."}),"getTokenEntra"),fn=o(async(e,t=process.env)=>{if(t.COGNITE_TOKEN)return A.from(t.COGNITE_TOKEN);let{deployClientId:n,deploySecretName:r,idpType:i="cdf",tenantId:s,baseUrl:a,scopes:p,tokenUrl:c}=e,l=qp(r,t);if(i==="oauth"){if(!c)throw new Error("OAuth authentication requires 'tokenUrl' in deployment configuration");return Ao({idp:"OAuth",tokenUrl:c,clientId:n,clientSecret:l.expose(),scopes:p,missingTokenHint:"Check the tokenUrl, client ID, scopes, and deployment secret in app.json and your environment."})}if(i==="entra_id"){if(!s)throw new Error("Entra ID authentication requires 'tenantId' in deployment configuration");return Jp(n,l,s,a,p)}return zp(n,l)},"getToken");async function ye(e,t,n=process.env,r){let i=await fn(e,n),s=n.COGNITE_BASE_URL??e.baseUrl,a=(r??(p=>new Xp(p)))({appId:t,project:e.project,baseUrl:s,oidcTokenProvider:o(async()=>i.expose(),"oidcTokenProvider")});return await a.authenticate(),a}o(ye,"getSdk");async function be(e,t,n,r){let i=r({appId:t,project:e.project,baseUrl:e.baseUrl,oidcTokenProvider:o(async()=>n.expose(),"oidcTokenProvider")});return await i.authenticate(),i}o(be,"buildAuthenticatedClient");async function Co(e,t,n){let{loginFn:r,createClient:i}=n,s=t.orgHint||e.org||void 0,a=await r(s);return be(e,t.appId,A.from(a.access_token),i)}o(Co,"resolveViaBrowser");import{HttpError as Zp}from"@cognite/sdk";import{array as Eo,number as Qp,object as bo,optional as ec,safeParse as tc,string as nc}from"valibot";var rc=bo({projects:ec(Eo(bo({projectUrlName:nc(),groups:Eo(Qp())})))});function oc(e,t){switch(e){case 401:return"Run `cognite auth login` to log in.";case 403:return"The token is valid but lacks access to this project. Ask your CDF admin to grant its service account access.";default:return e>=500?`${t} returned a server error \u2014 this is usually transient, so try again shortly.`:"Check that the deployment base URL and project in app.json are correct."}}o(oc,"hintForStatus");var ko=o(async function(e){let t=e.getBaseUrl(),n;try{({data:n}=await e.get("/api/v1/token/inspect"))}catch(i){throw i instanceof Zp?new m(`Could not verify project access against ${t} (${i.status}).`,{hint:oc(i.status,t),cause:i}):new m(`Could not connect to ${t} to verify project access.`,{hint:"Check your network connection and verify that the base URL is correct.",cause:i})}let r=tc(rc,n);if(!r.success)throw new m(`Unexpected response from ${t}/api/v1/token/inspect.`,{hint:"Retry; if it persists, your CLI may be out of date or a proxy is altering responses.",cause:new Error(JSON.stringify(r.issues))});return r.output},"inspectDeploymentToken");async function xo(e,t,n,r){if(!((await(r?.inspectToken||ko)(e)).projects??[]).some(p=>p.projectUrlName===t.project&&p.groups.length>0))throw new m(`Your session for organization "${n}" doesn't have access to project "${t.project}" on ${t.baseUrl}.`,{hint:`Check you signed in to the right organization, or have access to the project "${t.project}" within "${n}" organization; \`@cognite/cli auth status\` lists the projects you can reach within your already logged in session token.`})}o(xo,"assertProjectAccess");async function Po(e,t,n,r){let i=await r.ensureFreshSession();if(!i)throw new m(`No credentials available for ${e.project} @ ${e.baseUrl}.`,{hint:"Run `cognite auth login` to login."});let s=await be(e,t,i.accessToken,r.createClient);return await xo(s,e,n),s}o(Po,"resolveViaSession");async function Do(e,t,n,r){switch(e.method){case"client-credentials":return r.getSdkFn(t,n.appId);case"session":return Po(t,n.appId,e.org,r);case"browser":return Co(t,n,r)}}o(Do,"buildClientForAuthMethod");async function K(e,t,n={}){let{isSessionAuthEnabled:r=E}=n;return r()?sc(e,t,n):ic(e,t,n)}o(K,"buildAppHostingApiClient");var ic=o(async(e,t,n={})=>{let{login:r=De,getSdk:i=ye,createClient:s=o(a=>new Io(a),"createClient")}=n;if(t.interactive){let a=t.orgHint||e.org||void 0,p=await r(a);return be(e,t.appId,A.from(p.access_token),s)}return i(e,t.appId)},"buildAppHostingApiClientWithoutSessionSupport");async function ft(e,t,n={}){let r=await K(e,t,n);return new I(r)}o(ft,"buildAppHostingClient");async function sc(e,t,n={}){let{login:r=De,getSdk:i=ye,createClient:s=o(f=>new Io(f),"createClient"),readSessionMetadata:a=fe,ensureFreshSession:p=mt,promptAuthMethod:c=st,confirmActionTarget:l=it,isTTY:d=process.stdin.isTTY,now:u=o(()=>new Date,"now")}=n,y=So(e,t,{readSessionMetadata:a,now:u}),g=await eo(y,e,t,{promptAuthMethod:c,confirmActionTarget:l,isTTY:d});return Do(g,e,t,{loginFn:r,getSdkFn:i,createClient:s,ensureFreshSession:p})}o(sc,"buildAppHostingClientWithSessionSupport");import To from"enquirer";var Ro="Enter custom target...";function Fo(e,t){let n=t.map((r,i)=>` ${i}: ${r.org}/${r.project}`).join(`
37
37
  `);throw new Error(`Deployment "${e}" not found. Available deployments:
38
- ${n}`)}o(Ro,"deploymentNotFoundError");function T(e,t){if(e.length===0)throw new Error("No deployments configured in app.json");if(t===void 0)return e[0];if(/^\d+$/.test(t)){let r=e[Number.parseInt(t)];if(r)return r;Ro(t,e)}let n=e.find(r=>r.project===t||`${r.org}/${r.project}`===t);if(n)return n;Ro(t,e)}o(T,"findDeployment");function F(e){let t=[];return e.deployClientId||t.push("deployClientId"),e.deploySecretName||t.push("deploySecretName"),t}o(F,"getMissingCredentials");async function $(e,t){if(t.baseUrl&&t.project)return{org:t.org??"",project:t.project,baseUrl:t.baseUrl,deployClientId:"",deploySecretName:"",published:!1,idpType:"cdf"};if(t.deployment!==void 0)return T(e.deployments,t.deployment);let n=[...e.deployments.map(s=>`${s.org}/${s.project}`),To],{selected:r}=await Io.prompt({type:"select",name:"selected",message:"Select deployment target",choices:n});if(r!==To){let s=e.deployments.find(a=>`${a.org}/${a.project}`===r);if(s)return s;throw new Error(`Deployment "${r}" could not be resolved from app.json.`)}let i=await Io.prompt([{type:"input",name:"baseUrl",message:"CDF Base URL",initial:"https://api.cognitedata.com"},{type:"input",name:"project",message:"CDF Project",validate:o(s=>s?!0:"Project is required","validate")},{type:"input",name:"org",message:"Organization (for login hint)",initial:""}]);return{org:i.org||"",project:i.project,baseUrl:i.baseUrl,deployClientId:"",deploySecretName:"",published:!1,idpType:"cdf"}}o($,"resolveDeployment");import{existsSync as sc}from"fs";import{resolve as ac}from"path";import{config as pc}from"dotenv";function O(e,t={existsSync:sc,config:pc}){let n=ac(e,".env");t.existsSync(n)&&(console.log(`Loading environment variables from ${n}`),t.config({path:n}))}o(O,"loadEnvFile");function M(e){e.infra!=="appsApi"&&(console.error(`
38
+ ${n}`)}o(Fo,"deploymentNotFoundError");function T(e,t){if(e.length===0)throw new Error("No deployments configured in app.json");if(t===void 0)return e[0];if(/^\d+$/.test(t)){let r=e[Number.parseInt(t)];if(r)return r;Fo(t,e)}let n=e.find(r=>r.project===t||`${r.org}/${r.project}`===t);if(n)return n;Fo(t,e)}o(T,"findDeployment");function F(e){let t=[];return e.deployClientId||t.push("deployClientId"),e.deploySecretName||t.push("deploySecretName"),t}o(F,"getMissingCredentials");async function $(e,t){if(t.confirmActionTarget!==void 0)throw new m("Pass -d/--deployment <target> to choose a target non-interactively \u2014 --confirm-action-target cannot be combined with --interactive.",{shouldReport:!1,hint:"--interactive already prompts for the target, so there is nothing for --confirm-action-target to acknowledge."});if(t.baseUrl&&t.project)return{org:t.org??"",project:t.project,baseUrl:t.baseUrl,deployClientId:"",deploySecretName:"",published:!1,idpType:"cdf"};if(t.deployment!==void 0)return T(e.deployments,t.deployment);let n=[...e.deployments.map(s=>`${s.org}/${s.project}`),Ro],{selected:r}=await To.prompt({type:"select",name:"selected",message:"Select deployment target",choices:n});if(r!==Ro){let s=e.deployments.find(a=>`${a.org}/${a.project}`===r);if(s)return s;throw new Error(`Deployment "${r}" could not be resolved from app.json.`)}let i=await To.prompt([{type:"input",name:"baseUrl",message:"CDF Base URL",initial:"https://api.cognitedata.com"},{type:"input",name:"project",message:"CDF Project",validate:o(s=>s?!0:"Project is required","validate")},{type:"input",name:"org",message:"Organization (for login hint)",initial:""}]);return{org:i.org||"",project:i.project,baseUrl:i.baseUrl,deployClientId:"",deploySecretName:"",published:!1,idpType:"cdf"}}o($,"resolveDeployment");import{existsSync as ac}from"fs";import{resolve as pc}from"path";import{config as cc}from"dotenv";function O(e,t={existsSync:ac,config:cc}){let n=pc(e,".env");t.existsSync(n)&&(console.log(`Loading environment variables from ${n}`),t.config({path:n}))}o(O,"loadEnvFile");function M(e){e.infra!=="appsApi"&&(console.error(`
39
39
  \u26A0\uFE0F Legacy infrastructure is no longer supported.
40
40
 
41
41
  Your app.json is missing \`"infra": "appsApi"\`, which means it was created for
42
42
  the old CDF Application Registry. This deploy path has been removed.
43
43
 
44
44
  To migrate: add \`"infra": "appsApi"\` to your app.json, wire up the correct authentication and re-deploy.
45
- `),process.exit(1))}o(M,"assertAppHostingInfra");import{Option as Fo}from"commander";var cc={"client-credentials":!0,session:!0,browser:!0};function Te(){return new Fo("--auth-method <method>","Authentication method to use when several are valid, skipping the selection prompt").choices(Object.keys(cc))}o(Te,"authMethodOption");function lc(){return new Fo("--confirm-action-target <target>","Acknowledge the org/project this command will act on, skipping the interactive prompt (value must match the resolved target)")}o(lc,"confirmActionTargetOption");function G(){return[lc(),Te()]}o(G,"sessionAuthOptions");async function dc(e,t,n){let r=await j(e,{interactive:t.interactive,appId:n,orgHint:t.org,authMethod:t.authMethod,confirmActionTarget:t.confirmActionTarget,action:"activate"});return new I(r)}o(dc,"defaultBuildApiClient");async function uc(e,t={}){let{loadEnvFile:n=O,loadAppConfig:r=b,getApiClient:i=dc,isSessionAuthEnabled:s=E}=t,a=process.cwd();n(a);let p=r(a);M(p);let c=e.interactive?await $(p,e):T(p.deployments,e.deployment);if(!e.interactive&&!s()){let f=F(c);if(f.length>0)throw new Error(`Deployment ${c.org}/${c.project} is missing ${f.join(" and ")} in app.json. Use \`npx @cognite/cli@latest apps activate --interactive\` for browser-based authentication instead.`)}let l=await i(c,e,p.externalId),{externalId:d,versionTag:u}=p,y;try{y=await l.getVersion(d,u)}catch(f){throw f instanceof V?new Error(`Version ${u} of ${d} has not been deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):f}if(y.alias==="ACTIVE"){console.log(` ${d} @ ${u} is already ACTIVE \u2014 nothing to do.`);return}if(y.lifecycleState==="DEPRECATED"||y.lifecycleState==="ARCHIVED")throw new Error(`Cannot activate ${d} @ ${u}: version is ${y.lifecycleState} (terminal).`);y.lifecycleState==="DRAFT"&&(await l.publishVersion(d,u),console.log(`\u2713 Published ${d} @ ${u} is now PUBLISHED`));let{supersededVersion:g}=await l.activateVersion(d,u);console.log(`\u2713 Activated ${d} @ ${u} is now ACTIVE`),g&&console.log(` Superseded ${g} \u2192 PUBLISHED`)}o(uc,"handleActivate");function $o(e,t={isSessionAuthEnabled:E}){let{isSessionAuthEnabled:n}=t,r=e.command("activate").description("Activate the current app version (publish if needed, then set ACTIVE alias)").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)");return n()&&G().forEach(i=>r.addOption(i)),r.addHelpText("after",`
45
+ `),process.exit(1))}o(M,"assertAppHostingInfra");import{Option as $o}from"commander";var lc={"client-credentials":!0,session:!0,browser:!0};function gn(){return new $o("--auth-method <method>","Authentication method to use when several are valid, skipping the selection prompt").choices(Object.keys(lc))}o(gn,"authMethodOption");function dc(){return new $o("--confirm-action-target <target>","Acknowledge the org/project this command will act on, skipping the interactive prompt (value must match the resolved target)")}o(dc,"confirmActionTargetOption");function N(){return[dc(),gn()]}o(N,"sessionAuthOptions");async function uc(e,t,n){let r=await K(e,{interactive:t.interactive,appId:n,orgHint:t.org,authMethod:t.authMethod,confirmActionTarget:t.confirmActionTarget,action:"activate"});return new I(r)}o(uc,"defaultBuildApiClient");async function mc(e,t={}){let{loadEnvFile:n=O,loadAppConfig:r=b,getApiClient:i=uc,isSessionAuthEnabled:s=E}=t,a=process.cwd();n(a);let p=r(a);M(p);let c=e.interactive?await $(p,e):T(p.deployments,e.deployment);if(!e.interactive&&!s()){let f=F(c);if(f.length>0)throw new Error(`Deployment ${c.org}/${c.project} is missing ${f.join(" and ")} in app.json. Use \`npx @cognite/cli@latest apps activate --interactive\` for browser-based authentication instead.`)}let l=await i(c,e,p.externalId),{externalId:d,versionTag:u}=p,y;try{y=await l.getVersion(d,u)}catch(f){throw f instanceof G?new Error(`Version ${u} of ${d} has not been deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):f}if(y.alias==="ACTIVE"){console.log(` ${d} @ ${u} is already ACTIVE \u2014 nothing to do.`);return}if(y.lifecycleState==="DEPRECATED"||y.lifecycleState==="ARCHIVED")throw new Error(`Cannot activate ${d} @ ${u}: version is ${y.lifecycleState} (terminal).`);y.lifecycleState==="DRAFT"&&(await l.publishVersion(d,u),console.log(`\u2713 Published ${d} @ ${u} is now PUBLISHED`));let{supersededVersion:g}=await l.activateVersion(d,u);console.log(`\u2713 Activated ${d} @ ${u} is now ACTIVE`),g&&console.log(` Superseded ${g} \u2192 PUBLISHED`)}o(mc,"handleActivate");function Oo(e,t={isSessionAuthEnabled:E}){let{isSessionAuthEnabled:n}=t,r=e.command("activate").description("Activate the current app version (publish if needed, then set ACTIVE alias)").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)");return n()&&N().forEach(i=>r.addOption(i)),r.addHelpText("after",`
46
46
  Examples:
47
47
  npx @cognite/cli apps activate . Activate using env-var auth
48
- npx @cognite/cli apps activate . --interactive Activate using browser auth (no secrets needed)`).action((i,s)=>uc(s))}o($o,"registerActivateCommand");import{basename as Wo,dirname as qc,normalize as zc,resolve as vt}from"path";import{fileURLToPath as Wc,pathToFileURL as Jc}from"url";import{Logger as Xc,runner as Zc}from"hygen";import{safeParse as mc}from"valibot";function Re(e,t){return n=>{let r=mc(t,n);return r.success?!0:`${e} ${r.issues[0].message}`}}o(Re,"toPromptValidator");var Oo={name:Re("App name",Gt),displayName:Re("Display name",Vt),baseUrl:Re("Base URL",Yt),org:Re("Org",qt),project:Re("Project",zt)};function fc(e,t){return e?async n=>{let r=t(n);return r===!0?e(n):r}:t}o(fc,"composeValidators");function yt(e){return e.map(t=>{if(!(t.name in Oo))return t;let n=Oo[t.name];return{...t,validate:fc(t.validate,n)}})}o(yt,"applySchemaValidators");import{basename as Mo}from"path";import Uo from"enquirer";function yn(e){return e.replace(/[A-Z]/g,(t,n)=>n===0?t.toLowerCase():`-${t.toLowerCase()}`)}o(yn,"kebabCase");var gc={type:"confirm",name:"useSpecKit",message:["Enable spec-driven development?"," Adds the github/spec-kit slash commands (/speckit.specify, .clarify, .plan, .tasks, .implement)"," to your app for use in Claude Code, Cursor, or GitHub Copilot. They walk you through writing SPEC.md and"," generating a plan, tasks, and implementation."].join(`
49
- `),initial:!1};async function yc(e,t,n){return e!==void 0?e:t?!!(await n([gc])).useSpecKit:!1}o(yc,"resolveSpecKit");function hc(e){return typeof e=="function"}o(hc,"isFunctionInitial");function _o(e){return(e??"").trim().replace(/\/+$/,"")||"api"}o(_o,"normalizeCluster");function Lo({isCurrentDir:e,dirName:t,onAppName:n,onUseSpecKit:r,presets:i={},specKit:s,prompt:a=Uo.prompt.bind(Uo)}){return()=>({prompt:o(async p=>{if(!Array.isArray(p))return a([p]);let c=Object.fromEntries(Object.entries(i).filter(k=>k[1]!==void 0)),l=Object.keys(c).length>0,d=e?Mo(process.cwd()):t?Mo(t):null,u=l&&d!==null,y=!u&&d?p.map(k=>k.name==="name"?{...k,initial:d}:k):p,g=yt(y),f=u&&d?{...c,name:d}:c,h=new Set(Object.keys(f)),S=g.filter(k=>!h.has(k.name)),A=S.findIndex(k=>k.name==="baseUrl"),v;if(u){let k=_o(f.cluster),J=o(_=>hc(_.initial)?_.initial():_.initial,"resolveInitial"),ie=o(_=>{if(_.name==="baseUrl")return`https://${k}.cognitedata.com`;let se=J(_);if(se===void 0)throw new Error(`Non-interactive mode: --${yn(_.name)} has no default. Pass it as a flag.`);return se},"deriveValue");v=Object.fromEntries(S.map(_=>[_.name,ie(_)]))}else if(A!==-1){let k=S.filter(ae=>ae.name!=="baseUrl"),J=k.length>0?await a(k):{},ie=typeof J.cluster=="string"?J.cluster:"",se=`https://${_o(ie||f.cluster)}.cognitedata.com`,he=S[A],Ne=await a([{...he,initial:se}]);v={...J,...Ne}}else v=S.length>0?await a(S):{};let w={...f,...v},D=typeof w.name=="string"?w.name:"";D&&n(D);let x=await yc(s,!u&&S.length>0,a);return r?.(x),{...w,name:D,useCurrentDir:e,directoryName:e?void 0:t??void 0,useSpecKit:x}},"prompt")})}o(Lo,"createAppPrompter");async function No(e,t,n){let r=[];Object.values(t).some(s=>s!==void 0)&&n!==null&&r.push({key:"name",value:n,label:"directory"});for(let[s,a]of Object.entries(t))a!==void 0&&r.push({key:s,value:a,label:`--${yn(s)}`});for(let{key:s,value:a,label:p}of r){let c=e.find(d=>d.name===s)?.validate;if(!c)continue;let l=await c(a);if(l!==!0)throw new Error(`Invalid ${p}: ${l}`)}}o(No,"validatePresets");import{cpSync as jo,existsSync as Ko,mkdirSync as St,readdirSync as Ec,readFileSync as bc,writeFileSync as hn}from"fs";import{basename as kc,dirname as Sn,posix as xc,resolve as R}from"path";import{fileURLToPath as Bo}from"url";import{copyFileSync as Sc,symlinkSync as wc}from"fs";import{dirname as vc,join as Cc}from"path";function Ac(e){if(e&&typeof e=="object"&&"code"in e&&typeof e.code=="string")return e.code}o(Ac,"errno");function Ho(e){return e instanceof Error?e.message:String(e)}o(Ho,"messageOf");function ht({target:e,linkPath:t,label:n,symlink:r=wc,copyFile:i=Sc}){try{return r(e,t),!0}catch(s){let a=Ac(s);if(a==="EEXIST")return!0;let p=Ho(s);if(a==="EPERM"||a==="EACCES")try{let c=Cc(vc(t),e);return i(c,t),console.log(`\u2139\uFE0F Wrote ${n} as a copy of ${e} (symlinks need Developer Mode or an elevated shell on Windows).`),!0}catch(c){return console.warn(`\u26A0\uFE0F Could not create ${n} symlink: ${p} (copy fallback also failed: ${Ho(c)})`),!1}return console.warn(`\u26A0\uFE0F Could not create ${n} symlink:`,p),!1}}o(ht,"linkOrCopyOrWarn");var Pc=R(Sn(Bo(import.meta.url)),"..","..","_vendor","spec-kit"),Dc=R(Sn(Bo(import.meta.url)),"..","..","_cognite-spec-extensions"),Ic=["claude-code","cursor","github-copilot"],Tc={branch_numbering:"sequential"};function Vo({appDir:e,vendorDir:t=Pc,cogniteExtensionsDir:n=Dc,agents:r=Ic}){let i=R(e,".specify"),s=R(i,"memory"),a=new Set(r),p=`prepare spec-kit install for appDir=${e}`,l=[{srcRoot:t,from:"templates",to:".specify/templates"},{srcRoot:t,from:"scripts/bash",to:".specify/scripts/bash"},{srcRoot:t,from:"commands",to:".claude/commands",agent:"claude-code"},{srcRoot:t,from:"commands",to:".cursor/commands",agent:"cursor"},{srcRoot:n,from:"commands",to:".claude/commands",agent:"claude-code"},{srcRoot:n,from:"commands",to:".cursor/commands",agent:"cursor"},{srcRoot:n,from:"templates",to:".specify/templates"}].filter(({agent:d})=>!d||a.has(d));try{for(let{srcRoot:u,from:y,to:g}of l){let f=R(e,g);p=`copy ${kc(u)}/${y} to ${g}`,St(Sn(f),{recursive:!0}),jo(R(u,y),f,{recursive:!0})}if(a.has("github-copilot")){let u=R(e,".github","agents"),y=R(e,".github","prompts");p="create .github/agents and .github/prompts dirs",St(u,{recursive:!0}),St(y,{recursive:!0});for(let g of[R(t,"commands"),R(n,"commands")])if(Ko(g))for(let f of Ec(g)){if(!f.endsWith(".md"))continue;let h=f.slice(0,-3);p=`copy ${f} to .github/agents/${h}.agent.md`,hn(R(u,`${h}.agent.md`),bc(R(g,f))),p=`write .github/prompts/${h}.prompt.md`,hn(R(y,`${h}.prompt.md`),`---
48
+ npx @cognite/cli apps activate . --interactive Activate using browser auth (no secrets needed)`).action((i,s)=>mc(s))}o(Oo,"registerActivateCommand");import{basename as Jo,dirname as zc,normalize as Wc,resolve as wt}from"path";import{fileURLToPath as Jc,pathToFileURL as Xc}from"url";import{Logger as Zc,runner as Qc}from"hygen";import{safeParse as fc}from"valibot";function Re(e,t){return n=>{let r=fc(t,n);return r.success?!0:`${e} ${r.issues[0].message}`}}o(Re,"toPromptValidator");var Mo={name:Re("App name",Vt),displayName:Re("Display name",Bt),baseUrl:Re("Base URL",Gt),org:Re("Org",Yt),project:Re("Project",qt)};function gc(e,t){return e?async n=>{let r=t(n);return r===!0?e(n):r}:t}o(gc,"composeValidators");function gt(e){return e.map(t=>{if(!(t.name in Mo))return t;let n=Mo[t.name];return{...t,validate:gc(t.validate,n)}})}o(gt,"applySchemaValidators");import{basename as Uo}from"path";import _o from"enquirer";function yn(e){return e.replace(/[A-Z]/g,(t,n)=>n===0?t.toLowerCase():`-${t.toLowerCase()}`)}o(yn,"kebabCase");var yc={type:"confirm",name:"useSpecKit",message:["Enable spec-driven development?"," Adds the github/spec-kit slash commands (/speckit.specify, .clarify, .plan, .tasks, .implement)"," to your app for use in Claude Code, Cursor, or GitHub Copilot. They walk you through writing SPEC.md and"," generating a plan, tasks, and implementation."].join(`
49
+ `),initial:!1};async function hc(e,t,n){return e!==void 0?e:t?!!(await n([yc])).useSpecKit:!1}o(hc,"resolveSpecKit");function Sc(e){return typeof e=="function"}o(Sc,"isFunctionInitial");function Lo(e){return(e??"").trim().replace(/\/+$/,"")||"api"}o(Lo,"normalizeCluster");function No({isCurrentDir:e,dirName:t,onAppName:n,onUseSpecKit:r,presets:i={},specKit:s,prompt:a=_o.prompt.bind(_o)}){return()=>({prompt:o(async p=>{if(!Array.isArray(p))return a([p]);let c=Object.fromEntries(Object.entries(i).filter(k=>k[1]!==void 0)),l=Object.keys(c).length>0,d=e?Uo(process.cwd()):t?Uo(t):null,u=l&&d!==null,y=!u&&d?p.map(k=>k.name==="name"?{...k,initial:d}:k):p,g=gt(y),f=u&&d?{...c,name:d}:c,h=new Set(Object.keys(f)),S=g.filter(k=>!h.has(k.name)),C=S.findIndex(k=>k.name==="baseUrl"),v;if(u){let k=Lo(f.cluster),J=o(_=>Sc(_.initial)?_.initial():_.initial,"resolveInitial"),ie=o(_=>{if(_.name==="baseUrl")return`https://${k}.cognitedata.com`;let se=J(_);if(se===void 0)throw new Error(`Non-interactive mode: --${yn(_.name)} has no default. Pass it as a flag.`);return se},"deriveValue");v=Object.fromEntries(S.map(_=>[_.name,ie(_)]))}else if(C!==-1){let k=S.filter(ae=>ae.name!=="baseUrl"),J=k.length>0?await a(k):{},ie=typeof J.cluster=="string"?J.cluster:"",se=`https://${Lo(ie||f.cluster)}.cognitedata.com`,he=S[C],Ne=await a([{...he,initial:se}]);v={...J,...Ne}}else v=S.length>0?await a(S):{};let w={...f,...v},D=typeof w.name=="string"?w.name:"";D&&n(D);let x=await hc(s,!u&&S.length>0,a);return r?.(x),{...w,name:D,useCurrentDir:e,directoryName:e?void 0:t??void 0,useSpecKit:x}},"prompt")})}o(No,"createAppPrompter");async function Ho(e,t,n){let r=[];Object.values(t).some(s=>s!==void 0)&&n!==null&&r.push({key:"name",value:n,label:"directory"});for(let[s,a]of Object.entries(t))a!==void 0&&r.push({key:s,value:a,label:`--${yn(s)}`});for(let{key:s,value:a,label:p}of r){let c=e.find(d=>d.name===s)?.validate;if(!c)continue;let l=await c(a);if(l!==!0)throw new Error(`Invalid ${p}: ${l}`)}}o(Ho,"validatePresets");import{cpSync as Ko,existsSync as Bo,mkdirSync as ht,readdirSync as bc,readFileSync as kc,writeFileSync as hn}from"fs";import{basename as xc,dirname as Sn,posix as Pc,resolve as R}from"path";import{fileURLToPath as Vo}from"url";import{copyFileSync as wc,symlinkSync as vc}from"fs";import{dirname as Ac,join as Cc}from"path";function Ec(e){if(e&&typeof e=="object"&&"code"in e&&typeof e.code=="string")return e.code}o(Ec,"errno");function jo(e){return e instanceof Error?e.message:String(e)}o(jo,"messageOf");function yt({target:e,linkPath:t,label:n,symlink:r=vc,copyFile:i=wc}){try{return r(e,t),!0}catch(s){let a=Ec(s);if(a==="EEXIST")return!0;let p=jo(s);if(a==="EPERM"||a==="EACCES")try{let c=Cc(Ac(t),e);return i(c,t),console.log(`\u2139\uFE0F Wrote ${n} as a copy of ${e} (symlinks need Developer Mode or an elevated shell on Windows).`),!0}catch(c){return console.warn(`\u26A0\uFE0F Could not create ${n} symlink: ${p} (copy fallback also failed: ${jo(c)})`),!1}return console.warn(`\u26A0\uFE0F Could not create ${n} symlink:`,p),!1}}o(yt,"linkOrCopyOrWarn");var Dc=R(Sn(Vo(import.meta.url)),"..","..","_vendor","spec-kit"),Ic=R(Sn(Vo(import.meta.url)),"..","..","_cognite-spec-extensions"),Tc=["claude-code","cursor","github-copilot"],Rc={branch_numbering:"sequential"};function Go({appDir:e,vendorDir:t=Dc,cogniteExtensionsDir:n=Ic,agents:r=Tc}){let i=R(e,".specify"),s=R(i,"memory"),a=new Set(r),p=`prepare spec-kit install for appDir=${e}`,l=[{srcRoot:t,from:"templates",to:".specify/templates"},{srcRoot:t,from:"scripts/bash",to:".specify/scripts/bash"},{srcRoot:t,from:"commands",to:".claude/commands",agent:"claude-code"},{srcRoot:t,from:"commands",to:".cursor/commands",agent:"cursor"},{srcRoot:n,from:"commands",to:".claude/commands",agent:"claude-code"},{srcRoot:n,from:"commands",to:".cursor/commands",agent:"cursor"},{srcRoot:n,from:"templates",to:".specify/templates"}].filter(({agent:d})=>!d||a.has(d));try{for(let{srcRoot:u,from:y,to:g}of l){let f=R(e,g);p=`copy ${xc(u)}/${y} to ${g}`,ht(Sn(f),{recursive:!0}),Ko(R(u,y),f,{recursive:!0})}if(a.has("github-copilot")){let u=R(e,".github","agents"),y=R(e,".github","prompts");p="create .github/agents and .github/prompts dirs",ht(u,{recursive:!0}),ht(y,{recursive:!0});for(let g of[R(t,"commands"),R(n,"commands")])if(Bo(g))for(let f of bc(g)){if(!f.endsWith(".md"))continue;let h=f.slice(0,-3);p=`copy ${f} to .github/agents/${h}.agent.md`,hn(R(u,`${h}.agent.md`),kc(R(g,f))),p=`write .github/prompts/${h}.prompt.md`,hn(R(y,`${h}.prompt.md`),`---
50
50
  agent: ${h}
51
51
  ---
52
- `)}}let d=R(i,"extensions.yml");Ko(d)||(p="write .specify/extensions.yml",jo(R(n,"extensions.yml"),d)),p=`write init-options.json under specifyDir=${i}`,hn(R(i,"init-options.json"),`${JSON.stringify(Tc,null,2)}
53
- `),p=`link .specify/memory/constitution.md in specifyDir=${i}`,St(s,{recursive:!0}),ht({target:xc.join("..","..","AGENTS.md"),linkPath:R(s,"constitution.md"),label:".specify/memory/constitution.md"})}catch(d){let u=d instanceof Error?d.message:String(d);throw new Error(`installSpecKit failed while ${p} (appDir=${e}, vendorDir=${t}): ${u}`,{cause:d})}}o(Vo,"installSpecKit");import{execFileSync as wt}from"child_process";import{mkdtempSync as Rc,readdirSync as Fc,rmSync as $c}from"fs";import{createRequire as Oc}from"module";import{tmpdir as Mc}from"os";import{join as Uc,resolve as Go}from"path";import{InvalidArgumentError as _c}from"commander";import Lc from"enquirer";var Yo="cognitedata/builder-skills",wn=["claude-code","cursor","github-copilot","opencode","codex"],Nc=Oc(import.meta.url).resolve("skills/bin/cli.mjs");function vn(e,t={}){try{wt(process.execPath,[Nc,...e],{stdio:"inherit",cwd:process.cwd(),...t,env:{...process.env,...t.env,DISABLE_TELEMETRY:"1"}})}catch(n){throw q(),new m(`Skills CLI failed (${e.join(" ")})`,{cause:n,hint:"Check your internet connection and try again."})}}o(vn,"execSkillsCli");function Hc(){return wn.map(e=>["add",Yo,"-a",e,"--skill","*","-y"])}o(Hc,"pullAllArgsPerAgent");var jc=1e4;async function qo(e,t={}){let n=t.exec??vn;q();let r=t.timeout??jc,i=t.readdir??(p=>Fc(p));for(let p of Hc())try{n(p,{cwd:e,timeout:r,stdio:["pipe","pipe","inherit"]})}catch(c){let l=c instanceof Error?c.message:String(c);console.warn("\u26A0\uFE0F Could not pull skills for args ["+p.join(" ")+"]:",l)}let s=new Set;for(let p of[Go(e,".claude","skills"),Go(e,".agents","skills")])try{i(p).forEach(c=>s.add(c))}catch{}let a=s.size;a>0?console.log(`Installed ${a} skills successfully.`):console.log("No skills were installed.")}o(qo,"pullAllSkillsInto");function Kc(e){if(!/^[\w.-]+\/[\w.-]+$/.test(e))throw new _c("Expected owner/repo format (e.g., cognitedata/builder-skills)");return e}o(Kc,"validateSource");function Bc(e){let t=Rc(Uc(Mc(),"skills-"));try{try{wt("git",["clone","--depth","1","--filter=blob:none","--no-checkout","-q",`https://github.com/${e}.git`,t],{stdio:"ignore"})}catch(r){throw q(),new m(`Failed to clone skills repository "${e}".`,{hint:"Check your internet connection and try again.",shouldReport:!1,cause:r})}let n;try{n=wt("git",["ls-tree","-d","--name-only","HEAD:skills"],{cwd:t})}catch{n=wt("git",["ls-tree","-d","--name-only","HEAD"],{cwd:t})}return n.toString().trim().split(/\r?\n/).filter(r=>!!r&&!r.startsWith("."))}finally{$c(t,{recursive:!0,force:!0})}}o(Bc,"listRemoteSkills");async function Vc(e,t={}){let n=o(p=>Lc.prompt(p),"defaultPrompt"),{listSkills:r=Bc,prompt:i=n}=t,s=r(e),{selected:a}=await i({type:"multiselect",name:"selected",message:"Select skills to install (space to toggle, a to toggle all, enter to confirm)",choices:s});return a}o(Vc,"pickSkillsInteractive");function Gc(e,t,n){let r=["add",e.source,"-a",t];return e.skill?r.push("--skill",e.skill):n&&n.length>0?r.push("--skill",...n,"-y"):r.push("--skill","*","-y"),e.global&&r.push("--global"),r}o(Gc,"buildPullArgs");async function Yc(e){q(),console.log(`Pulling skills from ${e.source}...`);let t;if(e.interactive&&!e.skill){try{t=await Vc(e.source)}catch(r){if(r instanceof m)throw r;let i=r instanceof Error?r.message:String(r);console.error(`Failed to resolve skills interactively: ${i}`),process.exitCode=1;return}if(t.length===0){console.log("No skills selected.");return}}let n=!1;for(let r of wn)try{vn(Gc(e,r,t))}catch(i){let s=i instanceof Error?i.message:String(i);console.warn(`\u26A0\uFE0F Could not pull skills for ${r}: ${s}`),n=!0}n?(console.log(`
52
+ `)}}let d=R(i,"extensions.yml");Bo(d)||(p="write .specify/extensions.yml",Ko(R(n,"extensions.yml"),d)),p=`write init-options.json under specifyDir=${i}`,hn(R(i,"init-options.json"),`${JSON.stringify(Rc,null,2)}
53
+ `),p=`link .specify/memory/constitution.md in specifyDir=${i}`,ht(s,{recursive:!0}),yt({target:Pc.join("..","..","AGENTS.md"),linkPath:R(s,"constitution.md"),label:".specify/memory/constitution.md"})}catch(d){let u=d instanceof Error?d.message:String(d);throw new Error(`installSpecKit failed while ${p} (appDir=${e}, vendorDir=${t}): ${u}`,{cause:d})}}o(Go,"installSpecKit");import{execFileSync as St}from"child_process";import{mkdtempSync as Fc,readdirSync as $c,rmSync as Oc}from"fs";import{createRequire as Mc}from"module";import{tmpdir as Uc}from"os";import{join as _c,resolve as Yo}from"path";import{InvalidArgumentError as Lc}from"commander";import Nc from"enquirer";var qo="cognitedata/builder-skills",wn=["claude-code","cursor","github-copilot","opencode","codex"],Hc=Mc(import.meta.url).resolve("skills/bin/cli.mjs");function vn(e,t={}){try{St(process.execPath,[Hc,...e],{stdio:"inherit",cwd:process.cwd(),...t,env:{...process.env,...t.env,DISABLE_TELEMETRY:"1"}})}catch(n){throw q(),new m(`Skills CLI failed (${e.join(" ")})`,{cause:n,hint:"Check your internet connection and try again."})}}o(vn,"execSkillsCli");function jc(){return wn.map(e=>["add",qo,"-a",e,"--skill","*","-y"])}o(jc,"pullAllArgsPerAgent");var Kc=1e4;async function zo(e,t={}){let n=t.exec??vn;q();let r=t.timeout??Kc,i=t.readdir??(p=>$c(p));for(let p of jc())try{n(p,{cwd:e,timeout:r,stdio:["pipe","pipe","inherit"]})}catch(c){let l=c instanceof Error?c.message:String(c);console.warn("\u26A0\uFE0F Could not pull skills for args ["+p.join(" ")+"]:",l)}let s=new Set;for(let p of[Yo(e,".claude","skills"),Yo(e,".agents","skills")])try{i(p).forEach(c=>s.add(c))}catch{}let a=s.size;a>0?console.log(`Installed ${a} skills successfully.`):console.log("No skills were installed.")}o(zo,"pullAllSkillsInto");function Bc(e){if(!/^[\w.-]+\/[\w.-]+$/.test(e))throw new Lc("Expected owner/repo format (e.g., cognitedata/builder-skills)");return e}o(Bc,"validateSource");function Vc(e){let t=Fc(_c(Uc(),"skills-"));try{try{St("git",["clone","--depth","1","--filter=blob:none","--no-checkout","-q",`https://github.com/${e}.git`,t],{stdio:"ignore"})}catch(r){throw q(),new m(`Failed to clone skills repository "${e}".`,{hint:"Check your internet connection and try again.",shouldReport:!1,cause:r})}let n;try{n=St("git",["ls-tree","-d","--name-only","HEAD:skills"],{cwd:t})}catch{n=St("git",["ls-tree","-d","--name-only","HEAD"],{cwd:t})}return n.toString().trim().split(/\r?\n/).filter(r=>!!r&&!r.startsWith("."))}finally{Oc(t,{recursive:!0,force:!0})}}o(Vc,"listRemoteSkills");async function Gc(e,t={}){let n=o(p=>Nc.prompt(p),"defaultPrompt"),{listSkills:r=Vc,prompt:i=n}=t,s=r(e),{selected:a}=await i({type:"multiselect",name:"selected",message:"Select skills to install (space to toggle, a to toggle all, enter to confirm)",choices:s});return a}o(Gc,"pickSkillsInteractive");function Yc(e,t,n){let r=["add",e.source,"-a",t];return e.skill?r.push("--skill",e.skill):n&&n.length>0?r.push("--skill",...n,"-y"):r.push("--skill","*","-y"),e.global&&r.push("--global"),r}o(Yc,"buildPullArgs");async function qc(e){q(),console.log(`Pulling skills from ${e.source}...`);let t;if(e.interactive&&!e.skill){try{t=await Gc(e.source)}catch(r){if(r instanceof m)throw r;let i=r instanceof Error?r.message:String(r);console.error(`Failed to resolve skills interactively: ${i}`),process.exitCode=1;return}if(t.length===0){console.log("No skills selected.");return}}let n=!1;for(let r of wn)try{vn(Yc(e,r,t))}catch(i){let s=i instanceof Error?i.message:String(i);console.warn(`\u26A0\uFE0F Could not pull skills for ${r}: ${s}`),n=!0}n?(console.log(`
54
54
  Skills pulled with some errors (see warnings above)`),process.exitCode=1):console.log(`
55
- Skills pulled successfully`)}o(Yc,"handlePull");function zo(e){let t=e.command("skills").summary("Manage AI agent skills for your app").description(`Manage AI agent skills for your app.
55
+ Skills pulled successfully`)}o(qc,"handlePull");function Wo(e){let t=e.command("skills").summary("Manage AI agent skills for your app").description(`Manage AI agent skills for your app.
56
56
  Supports: ${wn.join(", ")}`).addHelpText("after",`
57
57
  Examples:
58
58
  npx @cognite/cli apps skills pull Pull all skills
59
59
  npx @cognite/cli apps skills pull --skill create-client-tool Pull a specific skill
60
- npx @cognite/cli apps skills list List installed skills`);return t.command("pull").description("Pull all skills into your project").option("--source <owner/repo>","Skills repository",Kc,Yo).option("--skill <name>","Pull a specific skill by name").option("-i, --interactive","Interactively select which skills to install",!1).option("--global","Install skills globally",!1).action(Yc),t.command("list").description("List installed skills").action(()=>{vn(["list"])}),t}o(zo,"registerSkillsCommand");var Jo=vt(qc(Wc(import.meta.url)),"..","..","_templates");async function Qc(){let e=vt(Jo,"app","new","prompt.js");return(await import(Jc(e).href)).default}o(Qc,"loadPromptDefs");function el(e,t){return!e||t?null:zc(e)}o(el,"resolveDirName");function tl(e,t,n){if(e)return{cwd:process.cwd(),display:"."};let r=t??n;if(!r)throw new Error("App creation completed without a target directory or name.");return{cwd:vt(process.cwd(),r),display:r}}o(tl,"resolveAppLocation");function nl(e,t,n){let r=` npm install
60
+ npx @cognite/cli apps skills list List installed skills`);return t.command("pull").description("Pull all skills into your project").option("--source <owner/repo>","Skills repository",Bc,qo).option("--skill <name>","Pull a specific skill by name").option("-i, --interactive","Interactively select which skills to install",!1).option("--global","Install skills globally",!1).action(qc),t.command("list").description("List installed skills").action(()=>{vn(["list"])}),t}o(Wo,"registerSkillsCommand");var Xo=wt(zc(Jc(import.meta.url)),"..","..","_templates");async function el(){let e=wt(Xo,"app","new","prompt.js");return(await import(Xc(e).href)).default}o(el,"loadPromptDefs");function tl(e,t){return!e||t?null:Wc(e)}o(tl,"resolveDirName");function nl(e,t,n){if(e)return{cwd:process.cwd(),display:"."};let r=t??n;if(!r)throw new Error("App creation completed without a target directory or name.");return{cwd:wt(process.cwd(),r),display:r}}o(nl,"resolveAppLocation");function rl(e,t,n){let r=` npm install
61
61
  npm run dev`,i="To deploy your app:",s="npx @cognite/cli apps deploy --interactive",a=n?`
62
62
  To start spec-driven development:
63
63
  Run /speckit.specify in Claude Code, Cursor, or GitHub Copilot and describe your app.
@@ -84,7 +84,7 @@ ${i}
84
84
  cd "${t}"
85
85
  ${s}
86
86
  ${p}
87
- `)}o(nl,"printSuccessMessage");async function rl(e){try{console.log("\u{1F9E0} Pulling skills into your app..."),await qo(e)}catch(t){let n=t instanceof Error?t.message:String(t);console.warn("\u26A0\uFE0F Could not pull skills:",n)}}o(rl,"pullSkillsInto");function ol(e,t={}){let{isGitInstalled:n=je,isInsideGitRepo:r=Be,gitInitAndCommit:i=tr}=t;if(!n()){console.warn("git not found \u2014 skipping git repository initialisation");return}if(!r(e)){console.log("Initialising git repository...");try{i(e)}catch(s){let p=(s&&typeof s=="object"&&"stderr"in s&&s.stderr?String(s.stderr).trim():"")||(s instanceof Error?s.message:String(s));console.warn("Could not initialise git repository:",p)}}}o(ol,"maybeInitGit");async function il(e,t){let n=e==="."||e==="./",r=el(e,n),i=null,s=!1,a={displayName:t.displayName,description:t.description,org:t.org,project:t.project,cluster:t.cluster,baseUrl:t.baseUrl},p=await Qc(),c=yt(p),l=n?Wo(process.cwd()):r?Wo(r):null;await No(c,a,l);let d=Lo({isCurrentDir:n,dirName:r,onAppName:o(y=>{i=y},"onAppName"),onUseSpecKit:o(y=>{s=y},"onUseSpecKit"),presets:a,specKit:t.specKit});await Zc(["app","new"],{templates:Jo,cwd:process.cwd(),logger:new Xc(console.log.bind(console)),createPrompter:d,debug:!!process.env.DEBUG});let u=tl(n,r,i);ht({target:"AGENTS.md",linkPath:vt(u.cwd,"CLAUDE.md"),label:"CLAUDE.md"}),s&&Vo({appDir:u.cwd}),await rl(u.cwd),ol(u.cwd),nl(n,u.display,s)}o(il,"handleCreate");function Xo(e){return e.command("create").description("Create a new application.").argument("[directory]","Target directory (. for current, or subdirectory name)").option("--display-name <name>","App display name (skips the prompt)").option("--description <description>","App description (skips the prompt)").option("--org <org>","Deployment org (skips the prompt)").option("--project <project>","Deployment project (skips the prompt)").option("--cluster <cluster>","CDF cluster, e.g. greenfield (skips the prompt)").option("--base-url <url>","CDF base URL, e.g. https://greenfield.cognitedata.com (skips the prompt; defaults to cluster-derived URL when omitted)").option("--spec-kit","Install spec-kit slash commands (skips the prompt)").option("--no-spec-kit","Skip spec-kit installation (skips the prompt)").addHelpText("after",`
87
+ `)}o(rl,"printSuccessMessage");async function ol(e){try{console.log("\u{1F9E0} Pulling skills into your app..."),await zo(e)}catch(t){let n=t instanceof Error?t.message:String(t);console.warn("\u26A0\uFE0F Could not pull skills:",n)}}o(ol,"pullSkillsInto");function il(e,t={}){let{isGitInstalled:n=je,isInsideGitRepo:r=Be,gitInitAndCommit:i=nr}=t;if(!n()){console.warn("git not found \u2014 skipping git repository initialisation");return}if(!r(e)){console.log("Initialising git repository...");try{i(e)}catch(s){let p=(s&&typeof s=="object"&&"stderr"in s&&s.stderr?String(s.stderr).trim():"")||(s instanceof Error?s.message:String(s));console.warn("Could not initialise git repository:",p)}}}o(il,"maybeInitGit");async function sl(e,t){let n=e==="."||e==="./",r=tl(e,n),i=null,s=!1,a={displayName:t.displayName,description:t.description,org:t.org,project:t.project,cluster:t.cluster,baseUrl:t.baseUrl},p=await el(),c=gt(p),l=n?Jo(process.cwd()):r?Jo(r):null;await Ho(c,a,l);let d=No({isCurrentDir:n,dirName:r,onAppName:o(y=>{i=y},"onAppName"),onUseSpecKit:o(y=>{s=y},"onUseSpecKit"),presets:a,specKit:t.specKit});await Qc(["app","new"],{templates:Xo,cwd:process.cwd(),logger:new Zc(console.log.bind(console)),createPrompter:d,debug:!!process.env.DEBUG});let u=nl(n,r,i);yt({target:"AGENTS.md",linkPath:wt(u.cwd,"CLAUDE.md"),label:"CLAUDE.md"}),s&&Go({appDir:u.cwd}),await ol(u.cwd),il(u.cwd),rl(n,u.display,s)}o(sl,"handleCreate");function Zo(e){return e.command("create").description("Create a new application.").argument("[directory]","Target directory (. for current, or subdirectory name)").option("--display-name <name>","App display name (skips the prompt)").option("--description <description>","App description (skips the prompt)").option("--org <org>","Deployment org (skips the prompt)").option("--project <project>","Deployment project (skips the prompt)").option("--cluster <cluster>","CDF cluster, e.g. greenfield (skips the prompt)").option("--base-url <url>","CDF base URL, e.g. https://greenfield.cognitedata.com (skips the prompt; defaults to cluster-derived URL when omitted)").option("--spec-kit","Install spec-kit slash commands (skips the prompt)").option("--no-spec-kit","Skip spec-kit installation (skips the prompt)").addHelpText("after",`
88
88
  Non-interactive use (CI, scripts, AI agents):
89
89
  Pass [directory] plus --display-name, --description, --org, --project, --cluster, --base-url
90
90
  to skip every prompt. Missing flags fall back to the interactive prompt.
@@ -97,31 +97,31 @@ Examples:
97
97
  --display-name "My App" --description "My app" \\
98
98
  --org cog-atlas --project atlas-greenfield --cluster greenfield \\
99
99
  --base-url https://greenfield.cognitedata.com
100
- Fully non-interactive`).action(il)}o(Xo,"registerCreateCommand");import sl from"path";async function al(e,t,n){return gt(e,{interactive:t.interactive,appId:n,orgHint:t.org,authMethod:t.authMethod,confirmActionTarget:t.confirmActionTarget,action:"deactivate"})}o(al,"defaultBuildApiClient");async function pl(e,t,n={}){let{loadEnvFile:r=O,loadAppConfig:i=b,getApiClient:s=al,isSessionAuthEnabled:a=E}=n,p=sl.resolve(process.cwd(),e);r(p);let c=i(p);M(c);let l=t.interactive?await $(c,t):T(c.deployments,t.deployment);if(!t.interactive&&!a()){let g=F(l);if(g.length>0)throw new Error(`Deployment ${l.org}/${l.project} is missing ${g.join(" and ")} in app.json. Use \`npx @cognite/cli@latest apps deactivate --interactive\` for browser-based authentication instead.`)}let{externalId:d}=c,u=await s(l,t,d),y=await u.getActiveVersion(d);if(!y){console.log(` ${d} has no active version \u2014 nothing to deactivate.`);return}await u.deactivateVersion(d,y.version),console.log(`\u2713 Deactivated ${d} @ ${y.version} \u2014 active alias removed`)}o(pl,"handleDeactivate");function Zo(e,t={isSessionAuthEnabled:E}){let{isSessionAuthEnabled:n}=t,r=e.command("deactivate").description("Deactivate the app by removing its active version from service").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)");return n()&&G().forEach(i=>r.addOption(i)),r.addHelpText("after",`
100
+ Fully non-interactive`).action(sl)}o(Zo,"registerCreateCommand");import al from"path";async function pl(e,t,n){return ft(e,{interactive:t.interactive,appId:n,orgHint:t.org,authMethod:t.authMethod,confirmActionTarget:t.confirmActionTarget,action:"deactivate"})}o(pl,"defaultBuildApiClient");async function cl(e,t,n={}){let{loadEnvFile:r=O,loadAppConfig:i=b,getApiClient:s=pl,isSessionAuthEnabled:a=E}=n,p=al.resolve(process.cwd(),e);r(p);let c=i(p);M(c);let l=t.interactive?await $(c,t):T(c.deployments,t.deployment);if(!t.interactive&&!a()){let g=F(l);if(g.length>0)throw new Error(`Deployment ${l.org}/${l.project} is missing ${g.join(" and ")} in app.json. Use \`npx @cognite/cli@latest apps deactivate --interactive\` for browser-based authentication instead.`)}let{externalId:d}=c,u=await s(l,t,d),y=await u.getActiveVersion(d);if(!y){console.log(` ${d} has no active version \u2014 nothing to deactivate.`);return}await u.deactivateVersion(d,y.version),console.log(`\u2713 Deactivated ${d} @ ${y.version} \u2014 active alias removed`)}o(cl,"handleDeactivate");function Qo(e,t={isSessionAuthEnabled:E}){let{isSessionAuthEnabled:n}=t,r=e.command("deactivate").description("Deactivate the app by removing its active version from service").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)");return n()&&N().forEach(i=>r.addOption(i)),r.addHelpText("after",`
101
101
  Examples:
102
102
  npx @cognite/cli apps deactivate . Deactivate using env-var auth
103
- npx @cognite/cli apps deactivate . --interactive Deactivate using browser auth (no secrets needed)`).action((i,s)=>pl(i,s))}o(Zo,"registerDeactivateCommand");import cl from"path";import ll from"enquirer";async function dl(e,t,n){return gt(e,{interactive:t.interactive,appId:n,orgHint:t.org,authMethod:t.authMethod,confirmActionTarget:t.confirmActionTarget,action:"delete"})}o(dl,"defaultBuildApiClient");async function ul(e){let{confirmed:t}=await ll.prompt({type:"confirm",name:"confirmed",message:e,initial:!1});return t}o(ul,"defaultConfirm");async function ml(e,t,n={}){let{loadEnvFile:r=O,loadAppConfig:i=b,getApiClient:s=dl,confirm:a=ul,isSessionAuthEnabled:p=E}=n,c=cl.resolve(process.cwd(),e);r(c);let l=i(c);M(l);let d=t.interactive?await $(l,t):T(l.deployments,t.deployment);if(!t.interactive&&!p()){let h=F(d);if(h.length>0)throw new m(`Deployment ${d.org}/${d.project} is missing ${h.join(" and ")} in app.json.`,{hint:"Use `npx @cognite/cli@latest apps delete --interactive` for browser-based authentication instead."})}let u=await s(d,t,l.externalId),{externalId:y,versionTag:g}=l,f;try{f=await u.getVersion(y,g)}catch(h){throw h instanceof V?new m(`Version ${g} of ${y} has not been deployed yet.`,{hint:"Run `npx @cognite/cli apps deploy` first."}):h}if(f.alias==="ACTIVE")throw new m(`Cannot archive ${y} @ ${g}: version is currently ACTIVE.`,{hint:"Run `npx @cognite/cli apps deactivate` first."});if(f.lifecycleState==="ARCHIVED"){console.log(` ${y} @ ${g} is already ARCHIVED \u2014 nothing to do.`);return}if(!t.force&&!await a(`Delete ${y} @ ${g}?`)){process.stderr.write(`Aborted.
104
- `);return}if(f.lifecycleState==="DRAFT"){await u.deleteVersion(y,g),console.log(`\u2713 Deleted ${y} @ ${g} (DRAFT removed)`);return}f.lifecycleState==="PUBLISHED"&&(await u.deprecateVersion(y,g),console.log(`\u2713 Deprecated ${y} @ ${g} is now DEPRECATED`)),await u.archiveVersion(y,g),console.log(`\u2713 Archived ${y} @ ${g} is now ARCHIVED`)}o(ml,"handleDelete");function Qo(e,t={isSessionAuthEnabled:E}){let{isSessionAuthEnabled:n}=t,r=e.command("delete").description("Archive the current app version").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").option("-f, --force","Skip confirmation prompt",!1);return n()&&G().forEach(i=>r.addOption(i)),r.addHelpText("after",`
103
+ npx @cognite/cli apps deactivate . --interactive Deactivate using browser auth (no secrets needed)`).action((i,s)=>cl(i,s))}o(Qo,"registerDeactivateCommand");import ll from"path";import dl from"enquirer";async function ul(e,t,n){return ft(e,{interactive:t.interactive,appId:n,orgHint:t.org,authMethod:t.authMethod,confirmActionTarget:t.confirmActionTarget,action:"delete"})}o(ul,"defaultBuildApiClient");async function ml(e){let{confirmed:t}=await dl.prompt({type:"confirm",name:"confirmed",message:e,initial:!1});return t}o(ml,"defaultConfirm");async function fl(e,t,n={}){let{loadEnvFile:r=O,loadAppConfig:i=b,getApiClient:s=ul,confirm:a=ml,isSessionAuthEnabled:p=E}=n,c=ll.resolve(process.cwd(),e);r(c);let l=i(c);M(l);let d=t.interactive?await $(l,t):T(l.deployments,t.deployment);if(!t.interactive&&!p()){let h=F(d);if(h.length>0)throw new m(`Deployment ${d.org}/${d.project} is missing ${h.join(" and ")} in app.json.`,{hint:"Use `npx @cognite/cli@latest apps delete --interactive` for browser-based authentication instead."})}let u=await s(d,t,l.externalId),{externalId:y,versionTag:g}=l,f;try{f=await u.getVersion(y,g)}catch(h){throw h instanceof G?new m(`Version ${g} of ${y} has not been deployed yet.`,{hint:"Run `npx @cognite/cli apps deploy` first."}):h}if(f.alias==="ACTIVE")throw new m(`Cannot archive ${y} @ ${g}: version is currently ACTIVE.`,{hint:"Run `npx @cognite/cli apps deactivate` first."});if(f.lifecycleState==="ARCHIVED"){console.log(` ${y} @ ${g} is already ARCHIVED \u2014 nothing to do.`);return}if(!t.force&&!await a(`Delete ${y} @ ${g}?`)){process.stderr.write(`Aborted.
104
+ `);return}if(f.lifecycleState==="DRAFT"){await u.deleteVersion(y,g),console.log(`\u2713 Deleted ${y} @ ${g} (DRAFT removed)`);return}f.lifecycleState==="PUBLISHED"&&(await u.deprecateVersion(y,g),console.log(`\u2713 Deprecated ${y} @ ${g} is now DEPRECATED`)),await u.archiveVersion(y,g),console.log(`\u2713 Archived ${y} @ ${g} is now ARCHIVED`)}o(fl,"handleDelete");function ei(e,t={isSessionAuthEnabled:E}){let{isSessionAuthEnabled:n}=t,r=e.command("delete").description("Archive the current app version").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").option("-f, --force","Skip confirmation prompt",!1);return n()&&N().forEach(i=>r.addOption(i)),r.addHelpText("after",`
105
105
  Examples:
106
106
  npx @cognite/cli apps delete . Archive using env-var auth
107
107
  npx @cognite/cli apps delete . --interactive Archive using browser auth (no secrets needed)
108
- npx @cognite/cli apps delete . --force Skip confirmation prompt`).action((i,s)=>ml(i,s))}o(Qo,"registerDeleteCommand");import{existsSync as Il}from"fs";import{rm as Tl}from"fs/promises";import ni from"enquirer";import{existsSync as Cl}from"fs";import{mkdir as Al,readFile as El}from"fs/promises";import{basename as bl,dirname as kl}from"path";import{execFileSync as Ct}from"child_process";import Z from"fs";import N from"path";import{parseAndValidateManifestConfig as fl}from"@cognite/app-sdk/vite";import{BlobReader as gl,Uint8ArrayWriter as yl,ZipWriter as hl}from"@zip.js/zip.js";var Cn="package.json",An="package-lock.json",ei="manifest.json",En=".cognite",Sl=[/^\.env(\..+)?$/i,/^\.secrets?$/i,/^\.token/i,/^\.cognite/i,/\.(key|pem|p12|pfx|jks|crt)$/i],bn=class bn{constructor(t="dist"){this.distPath=N.isAbsolute(t)?t:N.join(process.cwd(),t),this.appRoot=N.dirname(this.distPath)}validateBuildDirectory(){if(!Z.existsSync(this.distPath))throw new Error(`Build directory "${this.distPath}" not found. Run build first.`);let t=N.join(this.appRoot,Cn);if(!Z.existsSync(t))throw new Error(`"${t}" not found. It is required for deployment.`);let n=N.join(this.appRoot,An);if(!Z.existsSync(n))throw new Error(`"${n}" not found. It is required for deployment.`)}async createZip(t="app.zip",n=!1){this.validateBuildDirectory(),console.log("\u{1F4E6} Packaging application...");let r=new hl(new yl,{level:9}),i=o(async(c,l)=>{await r.add(l,new gl(await Z.openAsBlob(c))),n&&console.log(` \u{1F4C4} ${l}`)},"addFile"),s=o(async c=>{let l=await Z.promises.readdir(c,{withFileTypes:!0});for(let d of l){let u=N.join(c,d.name);d.isDirectory()?await s(u):await i(u,N.relative(this.distPath,u).replace(/\\/g,"/"))}},"addDir"),a;try{await s(this.distPath);let c=N.join(this.appRoot,Cn);await i(c,N.posix.join(En,Cn));let l=N.join(this.appRoot,ei);if(Z.existsSync(l)){let u=Z.readFileSync(l,"utf-8");fl(u,l),await i(l,N.posix.join(En,ei))}let d=N.join(this.appRoot,An);await i(d,N.posix.join(En,An)),a=await r.close()}catch(c){let l=c instanceof Error?c.message:String(c);throw new Error(`Failed to create zip: ${l}`)}try{await Z.promises.writeFile(t,a)}catch(c){throw new m(`Failed to write bundle to ${t}`,{cause:c})}let p=(a.byteLength/1024/1024).toFixed(2);return console.log(`\u2705 App packaged: ${t} (${p} MB)`),t}async createSourceArchive(t){console.log("\u{1F4E6} Packaging source for review...");let n;try{n=Ct("git",["-C",this.appRoot,"rev-parse","--show-toplevel"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim()}catch(c){throw q(),new m("Source packaging requires a git repository.",{hint:"Run `git init` first.",shouldReport:!1,cause:c})}let r=Ct("git",["-C",this.appRoot,"rev-parse","--show-prefix"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim(),i=r?r.replace(/\/$/,""):".",s=i==="."?"HEAD":`HEAD:${i}`;this.validateNoSensitiveFiles(n,s);try{Ct("git",["-C",n,"archive","--format=zip",`--output=${t}`,s])}catch(c){let l=c instanceof Error?c.message:String(c);throw new Error(`Failed to create source archive: ${l}`)}let p=(Z.statSync(t).size/1024/1024).toFixed(2);return console.log(`\u2705 Source packaged: ${N.basename(t)} (${p} MB)`),t}validateNoSensitiveFiles(t,n){let r=Ct("git",["-C",t,"ls-tree","-r","--name-only",n],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().split(`
109
- `).filter(Boolean),i=o(a=>a.split("/").some(p=>Sl.some(c=>c.test(p))),"isSensitive"),s=r.filter(i);if(s.length>0)throw new Error(`Source archive would include sensitive files \u2014 remove them from git tracking first:
108
+ npx @cognite/cli apps delete . --force Skip confirmation prompt`).action((i,s)=>fl(i,s))}o(ei,"registerDeleteCommand");import{existsSync as Tl}from"fs";import{rm as Rl}from"fs/promises";import ri from"enquirer";import{existsSync as Cl}from"fs";import{mkdir as El,readFile as bl}from"fs/promises";import{basename as kl,dirname as xl}from"path";import{execFileSync as vt}from"child_process";import Z from"fs";import H from"path";import{parseAndValidateManifestConfig as gl}from"@cognite/app-sdk/vite";import{BlobReader as yl,Uint8ArrayWriter as hl,ZipWriter as Sl}from"@zip.js/zip.js";var An="package.json",Cn="package-lock.json",ti="manifest.json",En=".cognite",wl=[/^\.env(\..+)?$/i,/^\.secrets?$/i,/^\.token/i,/^\.cognite/i,/\.(key|pem|p12|pfx|jks|crt)$/i],bn=class bn{constructor(t="dist"){this.distPath=H.isAbsolute(t)?t:H.join(process.cwd(),t),this.appRoot=H.dirname(this.distPath)}validateBuildDirectory(){if(!Z.existsSync(this.distPath))throw new Error(`Build directory "${this.distPath}" not found. Run build first.`);let t=H.join(this.appRoot,An);if(!Z.existsSync(t))throw new Error(`"${t}" not found. It is required for deployment.`);let n=H.join(this.appRoot,Cn);if(!Z.existsSync(n))throw new Error(`"${n}" not found. It is required for deployment.`)}async createZip(t="app.zip",n=!1){this.validateBuildDirectory(),console.log("\u{1F4E6} Packaging application...");let r=new Sl(new hl,{level:9}),i=o(async(c,l)=>{await r.add(l,new yl(await Z.openAsBlob(c))),n&&console.log(` \u{1F4C4} ${l}`)},"addFile"),s=o(async c=>{let l=await Z.promises.readdir(c,{withFileTypes:!0});for(let d of l){let u=H.join(c,d.name);d.isDirectory()?await s(u):await i(u,H.relative(this.distPath,u).replace(/\\/g,"/"))}},"addDir"),a;try{await s(this.distPath);let c=H.join(this.appRoot,An);await i(c,H.posix.join(En,An));let l=H.join(this.appRoot,ti);if(Z.existsSync(l)){let u=Z.readFileSync(l,"utf-8");gl(u,l),await i(l,H.posix.join(En,ti))}let d=H.join(this.appRoot,Cn);await i(d,H.posix.join(En,Cn)),a=await r.close()}catch(c){let l=c instanceof Error?c.message:String(c);throw new Error(`Failed to create zip: ${l}`)}try{await Z.promises.writeFile(t,a)}catch(c){throw new m(`Failed to write bundle to ${t}`,{cause:c})}let p=(a.byteLength/1024/1024).toFixed(2);return console.log(`\u2705 App packaged: ${t} (${p} MB)`),t}async createSourceArchive(t){console.log("\u{1F4E6} Packaging source for review...");let n;try{n=vt("git",["-C",this.appRoot,"rev-parse","--show-toplevel"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim()}catch(c){throw q(),new m("Source packaging requires a git repository.",{hint:"Run `git init` first.",shouldReport:!1,cause:c})}let r=vt("git",["-C",this.appRoot,"rev-parse","--show-prefix"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim(),i=r?r.replace(/\/$/,""):".",s=i==="."?"HEAD":`HEAD:${i}`;this.validateNoSensitiveFiles(n,s);try{vt("git",["-C",n,"archive","--format=zip",`--output=${t}`,s])}catch(c){let l=c instanceof Error?c.message:String(c);throw new Error(`Failed to create source archive: ${l}`)}let p=(Z.statSync(t).size/1024/1024).toFixed(2);return console.log(`\u2705 Source packaged: ${H.basename(t)} (${p} MB)`),t}validateNoSensitiveFiles(t,n){let r=vt("git",["-C",t,"ls-tree","-r","--name-only",n],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().split(`
109
+ `).filter(Boolean),i=o(a=>a.split("/").some(p=>wl.some(c=>c.test(p))),"isSensitive"),s=r.filter(i);if(s.length>0)throw new Error(`Source archive would include sensitive files \u2014 remove them from git tracking first:
110
110
  `+s.map(a=>` ${a}`).join(`
111
111
  `)+`
112
- Hint: git rm --cached <file>`)}};o(bn,"ApplicationPackager");var Q=bn;import{existsSync as wl,readFileSync as vl}from"fs";var ne=[".dev.sig",".cert.sig"];function Fe(e,t={}){let n=t.existsSync??wl,r=t.readFileSync??((s,a)=>vl(s,a)),i=[];for(let s of ne){let a=`${e}${s}`;if(!n(a))continue;let p=r(a,"utf8").trim();p.length>0&&i.push(p)}return i}o(Fe,"discoverSignatures");async function At(e,t,{existsSync:n=Cl,mkdir:r=Al,createZip:i=o((s,a)=>new Q(s).createZip(a,!0),"createZipFn")}={}){let{externalId:s,versionTag:a}=e,p=K(t,s,a);if(n(p)){let l=ne.some(d=>n(`${p}${d}`))?"A signed bundle already exists here. Re-deploying will invalidate the signing process. Bump versionTag in app.json to deploy as a new version, or delete the bundle and its .sig files then re-sign after deploying.":"Bump versionTag in app.json to deploy as a new version, or delete the existing bundle from .cognite-bundles/ to redeploy the same version.";throw new m(`Bundle already exists: ${p}`,{hint:l,shouldReport:!1})}await r(kl(p),{recursive:!0}),await i(`${t}/dist`,p)}o(At,"packageBundle");async function $e(e,t,n,r,{readFile:i=El,upload:s=o(async(a,p)=>new I(e).deploy(t.externalId,t.name,t.description,t.versionTag,a,p,r),"uploadFn")}={}){let a=K(n,t.externalId,t.versionTag),p;try{p=await i(a)}catch(c){throw new m(`Failed to read bundle file: ${a}`,{cause:c})}await s(p,bl(a))}o($e,"uploadBundle");var kn=o(async(e,t,n)=>{let r=await ye(e,n);await At(t,n),await $e(r,t,n,e.published)},"deploy"),xn=o(async(e,t,n)=>{let r=await ye(e,n);await $e(r,t,n,e.published)},"deployBundle");import{execSync as xl}from"child_process";function Et(e,t=!0,n={execSync:xl}){console.log("\u{1F4E6} Building app with npm...");try{n.execSync("npm run build",{cwd:e,stdio:t?"inherit":"pipe"})}catch(r){throw new m(`npm run build failed in ${e}`,{cause:r,hint:"Check the build output above for errors."})}console.log("\u2705 Build successful")}o(Et,"buildApp");function ti(e,t){let{org:n,project:r,baseUrl:i}=e,s;try{s=new URL(i).hostname}catch{return null}let{externalId:a,versionTag:p}=t,c=new URLSearchParams({cluster:s,customAppVersion:p,workspace:"industrial-tools"});return`https://${n}.fusion.cognite.com/${r}/flows-apps/app/${encodeURIComponent(a)}?${c}`}o(ti,"generateFusionUrl");import Pl,{Chalk as Dl}from"chalk";var Oe=new Dl({level:0});function re(e){return e.isTTY?Pl:Oe}o(re,"chalkForStream");async function Rl(e){let{confirmed:t}=await ni.prompt({type:"confirm",name:"confirmed",message:e,initial:!1});return t}o(Rl,"defaultConfirm");async function Fl(e,t){let{selected:n}=await ni.prompt({type:"select",name:"selected",message:e,choices:t});return n}o(Fl,"defaultSelect");async function $l(e){await Tl(e,{force:!0})}o($l,"defaultRm");function Ol(e,t,n){return n(e)?t.skipBuild?"use-existing":process.stdout.isTTY?"prompt":"package-fresh":"package-fresh"}o(Ol,"classifyExistingBundle");async function Ml(e,t){let{versionTag:n,hasSigs:r}=e,i=r?`A signed bundle for v${n} already exists. What would you like to do?`:`A bundle for v${n} already exists. What would you like to do?`,s=await t.select(i,[{name:"reuse",message:"Deploy the existing bundle without rebuilding"},{name:"rebuild",message:"Rebuild and deploy (overwrites the existing bundle)",...r?{hint:"\u2014 discards existing signatures"}:{}},{name:"cancel",message:"Cancel \u2014 do nothing"}]);if(s==="rebuild"&&r){let a=re(process.stderr);if(console.warn(a.bold.red(`
112
+ Hint: git rm --cached <file>`)}};o(bn,"ApplicationPackager");var Q=bn;import{existsSync as vl,readFileSync as Al}from"fs";var ne=[".dev.sig",".cert.sig"];function Fe(e,t={}){let n=t.existsSync??vl,r=t.readFileSync??((s,a)=>Al(s,a)),i=[];for(let s of ne){let a=`${e}${s}`;if(!n(a))continue;let p=r(a,"utf8").trim();p.length>0&&i.push(p)}return i}o(Fe,"discoverSignatures");async function At(e,t,{existsSync:n=Cl,mkdir:r=El,createZip:i=o((s,a)=>new Q(s).createZip(a,!0),"createZipFn")}={}){let{externalId:s,versionTag:a}=e,p=B(t,s,a);if(n(p)){let l=ne.some(d=>n(`${p}${d}`))?"A signed bundle already exists here. Re-deploying will invalidate the signing process. Bump versionTag in app.json to deploy as a new version, or delete the bundle and its .sig files then re-sign after deploying.":"Bump versionTag in app.json to deploy as a new version, or delete the existing bundle from .cognite-bundles/ to redeploy the same version.";throw new m(`Bundle already exists: ${p}`,{hint:l,shouldReport:!1})}await r(xl(p),{recursive:!0}),await i(`${t}/dist`,p)}o(At,"packageBundle");async function $e(e,t,n,r,{readFile:i=bl,upload:s=o(async(a,p)=>new I(e).deploy(t.externalId,t.name,t.description,t.versionTag,a,p,r),"uploadFn")}={}){let a=B(n,t.externalId,t.versionTag),p;try{p=await i(a)}catch(c){throw new m(`Failed to read bundle file: ${a}`,{cause:c})}await s(p,kl(a))}o($e,"uploadBundle");var kn=o(async(e,t,n)=>{let r=await ye(e,n);await At(t,n),await $e(r,t,n,e.published)},"deploy"),xn=o(async(e,t,n)=>{let r=await ye(e,n);await $e(r,t,n,e.published)},"deployBundle");import{execSync as Pl}from"child_process";function Ct(e,t=!0,n={execSync:Pl}){console.log("\u{1F4E6} Building app with npm...");try{n.execSync("npm run build",{cwd:e,stdio:t?"inherit":"pipe"})}catch(r){throw new m(`npm run build failed in ${e}`,{cause:r,hint:"Check the build output above for errors."})}console.log("\u2705 Build successful")}o(Ct,"buildApp");function ni(e,t){let{org:n,project:r,baseUrl:i}=e,s;try{s=new URL(i).hostname}catch{return null}let{externalId:a,versionTag:p}=t,c=new URLSearchParams({cluster:s,customAppVersion:p,workspace:"industrial-tools"});return`https://${n}.fusion.cognite.com/${r}/flows-apps/app/${encodeURIComponent(a)}?${c}`}o(ni,"generateFusionUrl");import Dl,{Chalk as Il}from"chalk";var Oe=new Il({level:0});function re(e){return e.isTTY?Dl:Oe}o(re,"chalkForStream");async function Fl(e){let{confirmed:t}=await ri.prompt({type:"confirm",name:"confirmed",message:e,initial:!1});return t}o(Fl,"defaultConfirm");async function $l(e,t){let{selected:n}=await ri.prompt({type:"select",name:"selected",message:e,choices:t});return n}o($l,"defaultSelect");async function Ol(e){await Rl(e,{force:!0})}o(Ol,"defaultRm");function Ml(e,t,n){return n(e)?t.skipBuild?"use-existing":process.stdout.isTTY?"prompt":"package-fresh":"package-fresh"}o(Ml,"classifyExistingBundle");async function Ul(e,t){let{versionTag:n,hasSigs:r}=e,i=r?`A signed bundle for v${n} already exists. What would you like to do?`:`A bundle for v${n} already exists. What would you like to do?`,s=await t.select(i,[{name:"reuse",message:"Deploy the existing bundle without rebuilding"},{name:"rebuild",message:"Rebuild and deploy (overwrites the existing bundle)",...r?{hint:"\u2014 discards existing signatures"}:{}},{name:"cancel",message:"Cancel \u2014 do nothing"}]);if(s==="rebuild"&&r){let a=re(process.stderr);if(console.warn(a.bold.red(`
113
113
  WARNING: this bundle is already signed.`)),console.warn(a.red(`Rebuilding overwrites the bundle and permanently discards its signatures (${ne.join(", ")}). You will have to re-sign before publishing.
114
- `)),!await t.confirm("Rebuild anyway and discard the existing signatures?"))return"cancel"}return s==="reuse"?"reuse":s==="rebuild"?"rebuild":"cancel"}o(Ml,"promptBundleAction");async function Ul(e,t){for(let n of[e,...ne.map(r=>`${e}${r}`)])t.existsSync(n)&&await t.rm(n)}o(Ul,"removeBundleArtifacts");function Pn(e){let{appConfig:t,deployment:n,interactive:r}=e,i=r?"Deploy (Interactive)":"Deploy",s=r?`${n.project} @ ${n.baseUrl}`:`${n.org}/${n.project}`;console.log(["",i,"=".repeat(i.length),`App: ${t.name} (${t.externalId})`,`Version: ${t.versionTag}`,`Target: ${s}`,""].join(`
114
+ `)),!await t.confirm("Rebuild anyway and discard the existing signatures?"))return"cancel"}return s==="reuse"?"reuse":s==="rebuild"?"rebuild":"cancel"}o(Ul,"promptBundleAction");async function _l(e,t){for(let n of[e,...ne.map(r=>`${e}${r}`)])t.existsSync(n)&&await t.rm(n)}o(_l,"removeBundleArtifacts");function Pn(e){let{appConfig:t,deployment:n,interactive:r}=e,i=r?"Deploy (Interactive)":"Deploy",s=r?`${n.project} @ ${n.baseUrl}`:`${n.org}/${n.project}`;console.log(["",i,"=".repeat(i.length),`App: ${t.name} (${t.externalId})`,`Version: ${t.versionTag}`,`Target: ${s}`,""].join(`
115
115
  `))}o(Pn,"printDeployInfo");function Dn(e){let{appConfig:t,deployment:n}=e;console.log(`
116
116
  Successfully deployed ${t.name} version ${t.versionTag} to ${n.org?`${n.org}/`:""}${n.project}`),console.log("App is deployed in draft mode");let r=t.deployments.length>1?` -d ${n.project}`:"";console.log(`
117
117
  To sign: npx @cognite/cli apps sign --interactive${r}`),console.log(`To publish: npx @cognite/cli apps publish .${r}`),console.log(`To activate: npx @cognite/cli apps activate .${r}`),console.log(`
118
- To submit for certification: npx @cognite/cli apps submit`);let i=ti(n,t);i&&console.log(`
118
+ To submit for certification: npx @cognite/cli apps submit`);let i=ni(n,t);i&&console.log(`
119
119
  Open your app:
120
- ${i}`)}o(Dn,"printDeployResult");async function _l(e,t){let{appConfig:n,deployment:r,cwd:i,options:s,useExistingBundle:a}=e,{deployFn:p,buildApp:c,isSessionAuthEnabled:l,buildClient:d,packageBundle:u,uploadBundle:y}=t;if(l()&&!s.interactive){Pn({appConfig:n,deployment:r,interactive:!1}),!s.skipBuild&&!a&&c(i);let f=await d(r,{interactive:!1,appId:n.externalId,orgHint:s.org,authMethod:s.authMethod,confirmActionTarget:s.confirmActionTarget,action:"deploy"});console.log(`
121
- Deploying to ${r.org}/${r.project}...`);let h={externalId:n.externalId,name:n.name,description:n.description,versionTag:n.versionTag};a||await u(h,i),await y(f,h,i,!1),Dn({appConfig:n,deployment:r});return}let g=F(r);if(g.length>0)throw new Error(`Deployment ${r.org}/${r.project} is missing ${g.join(" and ")} in app.json. Use \`cognite apps deploy --interactive\` for browser-based authentication instead.`);Pn({appConfig:n,deployment:r,interactive:!1}),!s.skipBuild&&!a&&c(i),console.log(`
122
- Deploying to ${r.org}/${r.project}...`),await p({...r,published:!1},{externalId:n.externalId,name:n.name,description:n.description,versionTag:n.versionTag},i),Dn({appConfig:n,deployment:r})}o(_l,"handleDeployNonInteractive");async function Ll(e,t){let{appConfig:n,deployment:r,cwd:i,options:s,useExistingBundle:a}=e,{buildApp:p,buildClient:c,packageBundle:l,uploadBundle:d}=t;Pn({appConfig:n,deployment:r,interactive:!0}),!s.skipBuild&&!a&&p(i);let u=await c(r,{interactive:!0,appId:n.externalId,orgHint:s.org,authMethod:s.authMethod});console.log(`
123
- Deploying to ${r.project}...`);let y={externalId:n.externalId,name:n.name,description:n.description,versionTag:n.versionTag};a||await l(y,i),await d(u,y,i,!1),Dn({appConfig:n,deployment:r})}o(Ll,"handleDeployInteractive");async function Nl(e,t=process.cwd(),n={}){let{loadEnvFile:r=O,loadAppConfig:i=b,deploy:s=kn,deployBundle:a=xn,confirm:p=Rl,select:c=Fl,existsSync:l=Il,rm:d=$l,buildApp:u=Et,isSessionAuthEnabled:y=E,buildClient:g=j,packageBundle:f=At,uploadBundle:h=$e}=n;r(t);let S=i(t);M(S);let A=K(t,S.externalId,S.versionTag),v=Ol(A,e,l),w=v==="use-existing";if(v==="prompt"){let x=ne.some(J=>l(`${A}${J}`)),k=await Ml({versionTag:S.versionTag,hasSigs:x},{select:c,confirm:p});if(k==="cancel"){console.log(`
124
- Deployment cancelled. Nothing was deployed.`);return}k==="reuse"?w=!0:await Ul(A,{existsSync:l,rm:d})}if(e.interactive){let x=await $(S,e);await Ll({appConfig:S,deployment:x,cwd:t,options:e,useExistingBundle:w},{buildApp:u,buildClient:g,packageBundle:f,uploadBundle:h});return}let D=T(S.deployments,e.deployment);await _l({appConfig:S,deployment:D,cwd:t,options:e,useExistingBundle:w},{deployFn:w?a:s,buildApp:u,isSessionAuthEnabled:y,buildClient:g,packageBundle:f,uploadBundle:h})}o(Nl,"handleDeploy");function ri(e,t={isSessionAuthEnabled:E}){let{isSessionAuthEnabled:n}=t,r=n()?"Deploy your app to Cognite Data Fusion. Run `auth login` to sign in, or use --interactive for a one-off browser login (no env-var secrets required).":"Deploy your app to Cognite Data Fusion. Use --interactive for browser-based login (no env-var secrets required).",i=e.command("deploy").description(r).option("-d, --deployment <target>","Deployment target (index or project name)").option("--skip-build","Skip the build step",!1).option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)");return n()&&G().forEach(s=>i.addOption(s)),i.addHelpText("after",`
120
+ ${i}`)}o(Dn,"printDeployResult");function In(e){let{externalId:t,name:n,description:r,versionTag:i}=e;return{externalId:t,name:n,description:r,versionTag:i}}o(In,"toApp");async function Ll(e,t){let{appConfig:n,deployment:r,cwd:i,options:s,useExistingBundle:a}=e,{deployFn:p,buildApp:c,isSessionAuthEnabled:l,buildClient:d,packageBundle:u,uploadBundle:y}=t;if(l()&&!s.interactive){Pn({appConfig:n,deployment:r,interactive:!1}),!s.skipBuild&&!a&&c(i);let f=await d(r,{interactive:!1,appId:n.externalId,orgHint:s.org,authMethod:s.authMethod,confirmActionTarget:s.confirmActionTarget,action:"deploy"});console.log(`
121
+ Deploying to ${r.org}/${r.project}...`);let h=In(n);a||await u(h,i),await y(f,h,i,!1),Dn({appConfig:n,deployment:r});return}let g=F(r);if(g.length>0)throw new Error(`Deployment ${r.org}/${r.project} is missing ${g.join(" and ")} in app.json. Use \`cognite apps deploy --interactive\` for browser-based authentication instead.`);Pn({appConfig:n,deployment:r,interactive:!1}),!s.skipBuild&&!a&&c(i),console.log(`
122
+ Deploying to ${r.org}/${r.project}...`),await p({...r,published:!1},In(n),i),Dn({appConfig:n,deployment:r})}o(Ll,"handleDeployNonInteractive");async function Nl(e,t){let{appConfig:n,deployment:r,cwd:i,options:s,useExistingBundle:a}=e,{buildApp:p,buildClient:c,packageBundle:l,uploadBundle:d}=t;Pn({appConfig:n,deployment:r,interactive:!0}),!s.skipBuild&&!a&&p(i);let u=await c(r,{interactive:!0,appId:n.externalId,orgHint:s.org,authMethod:s.authMethod});console.log(`
123
+ Deploying to ${r.project}...`);let y=In(n);a||await l(y,i),await d(u,y,i,!1),Dn({appConfig:n,deployment:r})}o(Nl,"handleDeployInteractive");async function Hl(e,t=process.cwd(),n={}){let{loadEnvFile:r=O,loadAppConfig:i=b,deploy:s=kn,deployBundle:a=xn,confirm:p=Fl,select:c=$l,existsSync:l=Tl,rm:d=Ol,buildApp:u=Ct,isSessionAuthEnabled:y=E,buildClient:g=K,packageBundle:f=At,uploadBundle:h=$e}=n;r(t);let S=i(t);M(S);let C=B(t,S.externalId,S.versionTag),v=Ml(C,e,l),w=v==="use-existing";if(v==="prompt"){let x=ne.some(J=>l(`${C}${J}`)),k=await Ul({versionTag:S.versionTag,hasSigs:x},{select:c,confirm:p});if(k==="cancel"){console.log(`
124
+ Deployment cancelled. Nothing was deployed.`);return}k==="reuse"?w=!0:await _l(C,{existsSync:l,rm:d})}if(e.interactive){let x=await $(S,e);await Nl({appConfig:S,deployment:x,cwd:t,options:e,useExistingBundle:w},{buildApp:u,buildClient:g,packageBundle:f,uploadBundle:h});return}let D=T(S.deployments,e.deployment);await Ll({appConfig:S,deployment:D,cwd:t,options:e,useExistingBundle:w},{deployFn:w?a:s,buildApp:u,isSessionAuthEnabled:y,buildClient:g,packageBundle:f,uploadBundle:h})}o(Hl,"handleDeploy");function oi(e,t={isSessionAuthEnabled:E}){let{isSessionAuthEnabled:n}=t,r=n()?"Deploy your app to Cognite Data Fusion. Run `auth login` to sign in, or use --interactive for a one-off browser login (no env-var secrets required).":"Deploy your app to Cognite Data Fusion. Use --interactive for browser-based login (no env-var secrets required).",i=e.command("deploy").description(r).option("-d, --deployment <target>","Deployment target (index or project name)").option("--skip-build","Skip the build step",!1).option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)");return n()&&N().forEach(s=>i.addOption(s)),i.addHelpText("after",`
125
125
  Environment (non-interactive):
126
126
  deployClientId and deploySecretName are configured per deployment in app.json.
127
127
  deploySecretName is the name of the environment variable that holds the client
@@ -135,10 +135,10 @@ Examples:
135
135
  npx @cognite/cli apps deploy -d my-project Deploy to project by name
136
136
  npx @cognite/cli apps deploy --skip-build Deploy without rebuilding
137
137
  npx @cognite/cli apps deploy --interactive Browser auth, prompts for target
138
- npx @cognite/cli apps deploy --interactive -d 0 Browser auth, target chosen non-interactively`).action(s=>Nl(s))}o(ri,"registerDeployCommand");import xt from"fs";import Yl from"os";import oe from"path";import ql from"enquirer";import In from"fs";import bt from"path";import{BlobReader as Hl,Uint8ArrayWriter as jl,ZipReader as Kl}from"@zip.js/zip.js";import Me from"path";function oi(e,t){let n=Me.resolve(e),r=Me.resolve(t),i=Me.relative(n,r);return i===""||Me.isAbsolute(i)?!1:i!==".."&&!i.startsWith(`..${Me.sep}`)}o(oi,"isSafePath");var Bl=1e5,Vl=2*1024**3;async function ii(e,t,n={}){let{openAsBlob:r=o(d=>In.openAsBlob(d),"openAsBlob"),mkdir:i=o((d,u)=>In.promises.mkdir(d,u),"mkdir"),writeFile:s=o((d,u)=>In.promises.writeFile(d,u),"writeFile"),maxEntries:a=Bl,maxTotalBytes:p=Vl}=n,c=await r(e),l=new Kl(new Hl(c));try{let d;try{d=await l.getEntries()}catch(g){throw new m(`Could not read bundle: ${bt.basename(e)} is not a valid zip file.`,{hint:"Make sure you are passing the correct bundle path.",shouldReport:!1,cause:g})}let u=0,y=0;for(let g of d){if(g.directory)continue;if(y++,y>a)throw new Error(`Zip contains too many entries (limit: ${a})`);if(u+=g.uncompressedSize,u>p)throw new Error(`Zip exceeds maximum allowed size (limit: ${Math.round(p/(1024*1024))} MB)`);if(bt.isAbsolute(g.filename))throw new Error(`Malicious zip entry rejected: ${g.filename}`);let f=bt.join(t,g.filename);if(!oi(t,f))throw new Error(`Malicious zip entry rejected: ${g.filename}`);let h=await g.getData(new jl);await i(bt.dirname(f),{recursive:!0}),await s(f,h)}}finally{await l.close()}}o(ii,"extractZip");import{execFileSync as Gl}from"child_process";function ai(e){return e instanceof Error&&"status"in e&&typeof e.status=="number"}o(ai,"isExitError");function si(e){if(!ai(e)||e.status!==1)throw e}o(si,"swallowDiffExit");var Tn=class Tn{constructor(t={execFileSync:Gl}){this.deps=t}isSupported(){try{return this.deps.execFileSync("git",["--version"],{stdio:"pipe"}),!0}catch{return!1}}isIdentical(t,n){try{return this.deps.execFileSync("git",["diff","--no-index","--quiet","--ignore-cr-at-eol",t,n]),!0}catch(r){if(ai(r)&&r.status===1)return!1;throw r}}showStat(t,n){try{this.deps.execFileSync("git",["--no-pager","diff","--stat","--no-index","--ignore-cr-at-eol",t,n],{stdio:"inherit"})}catch(r){si(r)}}showDiff(t,n,{usePager:r=!0}={}){let i=[];r||i.push("--no-pager"),i.push("diff","--word-diff=color","--no-index","--ignore-cr-at-eol",t,n);try{this.deps.execFileSync("git",i,{stdio:"inherit"})}catch(s){si(s)}}};o(Tn,"GitDiffer");var kt=Tn;var zl=o(async e=>(await ql.prompt([{type:"confirm",name:"answer",message:e,initial:!1}])).answer,"defaultConfirm");async function Wl(e,t,n={}){let{cwd:r=process.cwd(),buildApp:i=Et,createPackager:s=o(w=>new Q(w),"createPackager"),extractZip:a=ii,differ:p=new kt,existsSync:c=o(w=>xt.existsSync(w),"existsSync"),mkdtemp:l=o(w=>xt.promises.mkdtemp(w),"mkdtemp"),mkdir:d=o(async(w,D)=>{await xt.promises.mkdir(w,D)},"mkdir"),rm:u=o((w,D)=>xt.promises.rm(w,D),"rm"),isInteractive:y=o(()=>!!(process.stdin.isTTY&&process.stdout.isTTY),"isInteractive"),confirm:g=zl,setExitCode:f=o(w=>{process.exitCode=w},"setExitCode")}=n;if(!p.isSupported())throw new m("git is required for the diff command",{hint:"Install git and ensure it is in your PATH.",shouldReport:!1});if(!c(e))throw new m(`Bundle not found: ${e}`,{hint:"Check the file path and try again.",shouldReport:!1});if(!t.skipBuild)await i(r);else{let w=oe.join(r,"dist");if(!c(w))throw new m("dist directory not found.",{hint:"Run without --skip-build to build the app first, or run `pnpm build` manually.",shouldReport:!1})}let h=await l(oe.join(Yl.tmpdir(),"cognite-diff-")),S=oe.join(h,"ours.zip"),A=oe.join(h,"ours"),v=oe.join(h,"theirs");try{if(await d(A,{recursive:!0}),await d(v,{recursive:!0}),await s(oe.join(r,"dist")).createZip(S),console.log(`
139
- Extracting bundles...`),await a(S,A),await a(e,v),p.isIdentical(A,v)){console.log(`
138
+ npx @cognite/cli apps deploy --interactive -d 0 Browser auth, target chosen non-interactively`).action(s=>Hl(s))}o(oi,"registerDeployCommand");import kt from"fs";import ql from"os";import oe from"path";import zl from"enquirer";import Tn from"fs";import Et from"path";import{BlobReader as jl,Uint8ArrayWriter as Kl,ZipReader as Bl}from"@zip.js/zip.js";import Me from"path";function ii(e,t){let n=Me.resolve(e),r=Me.resolve(t),i=Me.relative(n,r);return i===""||Me.isAbsolute(i)?!1:i!==".."&&!i.startsWith(`..${Me.sep}`)}o(ii,"isSafePath");var Vl=1e5,Gl=2*1024**3;async function si(e,t,n={}){let{openAsBlob:r=o(d=>Tn.openAsBlob(d),"openAsBlob"),mkdir:i=o((d,u)=>Tn.promises.mkdir(d,u),"mkdir"),writeFile:s=o((d,u)=>Tn.promises.writeFile(d,u),"writeFile"),maxEntries:a=Vl,maxTotalBytes:p=Gl}=n,c=await r(e),l=new Bl(new jl(c));try{let d;try{d=await l.getEntries()}catch(g){throw new m(`Could not read bundle: ${Et.basename(e)} is not a valid zip file.`,{hint:"Make sure you are passing the correct bundle path.",shouldReport:!1,cause:g})}let u=0,y=0;for(let g of d){if(g.directory)continue;if(y++,y>a)throw new Error(`Zip contains too many entries (limit: ${a})`);if(u+=g.uncompressedSize,u>p)throw new Error(`Zip exceeds maximum allowed size (limit: ${Math.round(p/(1024*1024))} MB)`);if(Et.isAbsolute(g.filename))throw new Error(`Malicious zip entry rejected: ${g.filename}`);let f=Et.join(t,g.filename);if(!ii(t,f))throw new Error(`Malicious zip entry rejected: ${g.filename}`);let h=await g.getData(new Kl);await i(Et.dirname(f),{recursive:!0}),await s(f,h)}}finally{await l.close()}}o(si,"extractZip");import{execFileSync as Yl}from"child_process";function pi(e){return e instanceof Error&&"status"in e&&typeof e.status=="number"}o(pi,"isExitError");function ai(e){if(!pi(e)||e.status!==1)throw e}o(ai,"swallowDiffExit");var Rn=class Rn{constructor(t={execFileSync:Yl}){this.deps=t}isSupported(){try{return this.deps.execFileSync("git",["--version"],{stdio:"pipe"}),!0}catch{return!1}}isIdentical(t,n){try{return this.deps.execFileSync("git",["diff","--no-index","--quiet","--ignore-cr-at-eol",t,n]),!0}catch(r){if(pi(r)&&r.status===1)return!1;throw r}}showStat(t,n){try{this.deps.execFileSync("git",["--no-pager","diff","--stat","--no-index","--ignore-cr-at-eol",t,n],{stdio:"inherit"})}catch(r){ai(r)}}showDiff(t,n,{usePager:r=!0}={}){let i=[];r||i.push("--no-pager"),i.push("diff","--word-diff=color","--no-index","--ignore-cr-at-eol",t,n);try{this.deps.execFileSync("git",i,{stdio:"inherit"})}catch(s){ai(s)}}};o(Rn,"GitDiffer");var bt=Rn;var Wl=o(async e=>(await zl.prompt([{type:"confirm",name:"answer",message:e,initial:!1}])).answer,"defaultConfirm");async function Jl(e,t,n={}){let{cwd:r=process.cwd(),buildApp:i=Ct,createPackager:s=o(w=>new Q(w),"createPackager"),extractZip:a=si,differ:p=new bt,existsSync:c=o(w=>kt.existsSync(w),"existsSync"),mkdtemp:l=o(w=>kt.promises.mkdtemp(w),"mkdtemp"),mkdir:d=o(async(w,D)=>{await kt.promises.mkdir(w,D)},"mkdir"),rm:u=o((w,D)=>kt.promises.rm(w,D),"rm"),isInteractive:y=o(()=>!!(process.stdin.isTTY&&process.stdout.isTTY),"isInteractive"),confirm:g=Wl,setExitCode:f=o(w=>{process.exitCode=w},"setExitCode")}=n;if(!p.isSupported())throw new m("git is required for the diff command",{hint:"Install git and ensure it is in your PATH.",shouldReport:!1});if(!c(e))throw new m(`Bundle not found: ${e}`,{hint:"Check the file path and try again.",shouldReport:!1});if(!t.skipBuild)await i(r);else{let w=oe.join(r,"dist");if(!c(w))throw new m("dist directory not found.",{hint:"Run without --skip-build to build the app first, or run `pnpm build` manually.",shouldReport:!1})}let h=await l(oe.join(ql.tmpdir(),"cognite-diff-")),S=oe.join(h,"ours.zip"),C=oe.join(h,"ours"),v=oe.join(h,"theirs");try{if(await d(C,{recursive:!0}),await d(v,{recursive:!0}),await s(oe.join(r,"dist")).createZip(S),console.log(`
139
+ Extracting bundles...`),await a(S,C),await a(e,v),p.isIdentical(C,v)){console.log(`
140
140
  Bundles are identical`);return}console.log(`
141
- \u274C The local build at ${oe.join(r,"dist")} differs from ${oe.basename(e)}.`);let D=y();(t.showStat!==void 0?t.showStat:D&&await g("Show stat summary?"))&&p.showStat(A,v),(t.showDiff!==void 0?t.showDiff:D&&await g("Show full diff?"))&&p.showDiff(A,v,{usePager:t.pager}),f(1)}finally{await u(h,{recursive:!0,force:!0})}}o(Wl,"handleDiff");function pi(e){return e.command("diff <bundle>").description("Diff a trusted local build against an untrusted bundle zip").option("--skip-build","Skip rebuilding the app before diffing",!1).option("--no-pager","Disable the pager and print diff output directly").option("--show-stat","Show a compact stat summary when bundles differ").option("--show-diff","Show the full word diff when bundles differ").addHelpText("after",`
141
+ \u274C The local build at ${oe.join(r,"dist")} differs from ${oe.basename(e)}.`);let D=y();(t.showStat!==void 0?t.showStat:D&&await g("Show stat summary?"))&&p.showStat(C,v),(t.showDiff!==void 0?t.showDiff:D&&await g("Show full diff?"))&&p.showDiff(C,v,{usePager:t.pager}),f(1)}finally{await u(h,{recursive:!0,force:!0})}}o(Jl,"handleDiff");function ci(e){return e.command("diff <bundle>").description("Diff a trusted local build against an untrusted bundle zip").option("--skip-build","Skip rebuilding the app before diffing",!1).option("--no-pager","Disable the pager and print diff output directly").option("--show-stat","Show a compact stat summary when bundles differ").option("--show-diff","Show the full word diff when bundles differ").addHelpText("after",`
142
142
  Builds the current source, packages it, then extracts both the local build
143
143
  and the provided bundle to temporary directories and runs:
144
144
 
@@ -149,75 +149,75 @@ Exit code 0 means the bundles are identical; exit code 1 means they differ.
149
149
  Examples:
150
150
  npx @cognite/cli apps diff untrusted.zip
151
151
  npx @cognite/cli apps diff untrusted.zip --skip-build
152
- npx @cognite/cli apps diff untrusted.zip --show-stat --show-diff --no-pager`).action((t,n)=>Wl(t,n))}o(pi,"registerDiffCommand");function Jl(e,t){console.log(""),console.log(`Updating metadata for '${e}':`);for(let{field:n,remote:r,local:i}of t){let s=`${n}:`.padEnd(13);console.log(` ${s}"${r}" \u2192 "${i||"(none)"}"`)}}o(Jl,"printMetadataDiff");async function Xl(e,t=process.cwd(),n={}){let{loadEnvFile:r=O,loadAppConfig:i=b,buildApiClient:s=j,createMetadataClient:a=o(S=>new I(S),"createMetadataClient"),getMissingCredentials:p=F,isSessionAuthEnabled:c=E}=n;r(t);let l=i(t);M(l);let d=e.interactive?await $(l,e):T(l.deployments,e.deployment);if(!e.interactive&&!c()){let S=p(d);if(S.length>0)throw new Error(`Deployment ${d.org}/${d.project} is missing ${S.join(" and ")} in app.json. Use \`cognite apps metadata update --interactive\` for browser-based authentication instead.`)}let u=await s(d,{interactive:e.interactive,appId:l.externalId,orgHint:e.org,authMethod:e.authMethod,confirmActionTarget:e.confirmActionTarget,action:"metadata update"}),y=a(u),g;try{g=await y.getApp(l.externalId)}catch(S){throw S instanceof Ae?new Error(`App '${l.externalId}' is not deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):S}let f={name:l.name,description:l.description||""},h=Qt(g,f);if(h.length===0){console.log(""),console.log(`Metadata for '${l.externalId}' already matches the deployed app \u2014 nothing to update.`),console.log("Edit name/description in app.json to change them.");return}Jl(l.externalId,h),await y.updateAppMetadata(l.externalId,l.name,l.description),console.log(""),console.log(`\u2705 Metadata for '${l.externalId}' updated`)}o(Xl,"handleUpdateMetadata");function ci(e,t={isSessionAuthEnabled:E}){let{isSessionAuthEnabled:n}=t,r=e.command("metadata").summary("Manage the deployed app's metadata").description("Manage the deployed app's metadata (name and description)."),i=r.command("update").description("Update the deployed app's name and description from app.json").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)");return n()&&G().forEach(s=>i.addOption(s)),i.addHelpText("after",`
152
+ npx @cognite/cli apps diff untrusted.zip --show-stat --show-diff --no-pager`).action((t,n)=>Jl(t,n))}o(ci,"registerDiffCommand");function Xl(e,t){console.log(""),console.log(`Updating metadata for '${e}':`);for(let{field:n,remote:r,local:i}of t){let s=`${n}:`.padEnd(13);console.log(` ${s}"${r}" \u2192 "${i||"(none)"}"`)}}o(Xl,"printMetadataDiff");async function Zl(e,t=process.cwd(),n={}){let{loadEnvFile:r=O,loadAppConfig:i=b,buildApiClient:s=K,createMetadataClient:a=o(S=>new I(S),"createMetadataClient"),getMissingCredentials:p=F,isSessionAuthEnabled:c=E}=n;r(t);let l=i(t);M(l);let d=e.interactive?await $(l,e):T(l.deployments,e.deployment);if(!e.interactive&&!c()){let S=p(d);if(S.length>0)throw new Error(`Deployment ${d.org}/${d.project} is missing ${S.join(" and ")} in app.json. Use \`cognite apps metadata update --interactive\` for browser-based authentication instead.`)}let u=await s(d,{interactive:e.interactive,appId:l.externalId,orgHint:e.org,authMethod:e.authMethod,confirmActionTarget:e.confirmActionTarget,action:"metadata update"}),y=a(u),g;try{g=await y.getApp(l.externalId)}catch(S){throw S instanceof Ce?new Error(`App '${l.externalId}' is not deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):S}let f={name:l.name,description:l.description||""},h=Zt(g,f);if(h.length===0){console.log(""),console.log(`Metadata for '${l.externalId}' already matches the deployed app \u2014 nothing to update.`),console.log("Edit name/description in app.json to change them.");return}Xl(l.externalId,h),await y.updateAppMetadata(l.externalId,l.name,l.description),console.log(""),console.log(`\u2705 Metadata for '${l.externalId}' updated`)}o(Zl,"handleUpdateMetadata");function li(e,t={isSessionAuthEnabled:E}){let{isSessionAuthEnabled:n}=t,r=e.command("metadata").summary("Manage the deployed app's metadata").description("Manage the deployed app's metadata (name and description)."),i=r.command("update").description("Update the deployed app's name and description from app.json").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)");return n()&&N().forEach(s=>i.addOption(s)),i.addHelpText("after",`
153
153
  Examples:
154
154
  npx @cognite/cli apps metadata update . Push name/description using env-var auth
155
- npx @cognite/cli apps metadata update . --interactive Push using browser auth (no secrets needed)`).action((s,a)=>Xl(a)),r}o(ci,"registerMetadataCommand");async function Zl(e,t,n){let r=await j(e,{interactive:t.interactive,appId:n.externalId,orgHint:t.org,authMethod:t.authMethod,confirmActionTarget:t.confirmActionTarget,action:"publish"});return new I(r)}o(Zl,"defaultBuildApiClient");async function Ql(e,t={}){let n=t.loadEnvFile??O,r=t.loadAppConfig??b,i=t.buildApiClient??Zl,s=t.discoverSignatures??Fe,a=t.isSessionAuthEnabled??E,p=process.cwd();n(p);let c=r(p);M(c);let l=e.interactive?await $(c,e):T(c.deployments,e.deployment);if(!e.interactive&&!a()){let h=F(l);if(h.length>0)throw new Error(`Deployment ${l.org}/${l.project} is missing ${h.join(" and ")} in app.json. Use \`cognite apps publish --interactive\` for browser-based authentication instead.`)}let d=await i(l,e,c),{externalId:u,versionTag:y}=c,g;try{g=await d.getVersion(u,y)}catch(h){throw h instanceof V?new Error(`Version ${y} of ${u} has not been deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):h}if(g.alias==="ACTIVE"){console.log(` ${u} @ ${y} is already ACTIVE \u2014 nothing to do.`);return}if(g.lifecycleState==="PUBLISHED"){console.log(` ${u} @ ${y} is already PUBLISHED \u2014 nothing to do.`);return}if(g.lifecycleState==="DEPRECATED"||g.lifecycleState==="ARCHIVED")throw new Error(`Cannot publish ${u} @ ${y}: version is ${g.lifecycleState} (terminal).`);let f=s(K(p,u,y));f.length>0&&await d.submitSignatures(u,y,f),await d.publishVersion(u,y),console.log(`\u2713 Published ${u} @ ${y} is now PUBLISHED`),console.log(""),console.log("Run `npx @cognite/cli apps activate .` to make it active.")}o(Ql,"handlePublish");function li(e,t={isSessionAuthEnabled:E}){let{isSessionAuthEnabled:n}=t,r=e.command("publish").description("Publish the current app version (transition DRAFT \u2192 PUBLISHED)").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)");return n()&&G().forEach(i=>r.addOption(i)),r.addHelpText("after",`
155
+ npx @cognite/cli apps metadata update . --interactive Push using browser auth (no secrets needed)`).action((s,a)=>Zl(a)),r}o(li,"registerMetadataCommand");async function Ql(e,t,n){let r=await K(e,{interactive:t.interactive,appId:n.externalId,orgHint:t.org,authMethod:t.authMethod,confirmActionTarget:t.confirmActionTarget,action:"publish"});return new I(r)}o(Ql,"defaultBuildApiClient");async function ed(e,t={}){let n=t.loadEnvFile??O,r=t.loadAppConfig??b,i=t.buildApiClient??Ql,s=t.discoverSignatures??Fe,a=t.isSessionAuthEnabled??E,p=process.cwd();n(p);let c=r(p);M(c);let l=e.interactive?await $(c,e):T(c.deployments,e.deployment);if(!e.interactive&&!a()){let h=F(l);if(h.length>0)throw new Error(`Deployment ${l.org}/${l.project} is missing ${h.join(" and ")} in app.json. Use \`cognite apps publish --interactive\` for browser-based authentication instead.`)}let d=await i(l,e,c),{externalId:u,versionTag:y}=c,g;try{g=await d.getVersion(u,y)}catch(h){throw h instanceof G?new Error(`Version ${y} of ${u} has not been deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):h}if(g.alias==="ACTIVE"){console.log(` ${u} @ ${y} is already ACTIVE \u2014 nothing to do.`);return}if(g.lifecycleState==="PUBLISHED"){console.log(` ${u} @ ${y} is already PUBLISHED \u2014 nothing to do.`);return}if(g.lifecycleState==="DEPRECATED"||g.lifecycleState==="ARCHIVED")throw new Error(`Cannot publish ${u} @ ${y}: version is ${g.lifecycleState} (terminal).`);let f=s(B(p,u,y));f.length>0&&await d.submitSignatures(u,y,f),await d.publishVersion(u,y),console.log(`\u2713 Published ${u} @ ${y} is now PUBLISHED`),console.log(""),console.log("Run `npx @cognite/cli apps activate .` to make it active.")}o(ed,"handlePublish");function di(e,t={isSessionAuthEnabled:E}){let{isSessionAuthEnabled:n}=t,r=e.command("publish").description("Publish the current app version (transition DRAFT \u2192 PUBLISHED)").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)");return n()&&N().forEach(i=>r.addOption(i)),r.addHelpText("after",`
156
156
  Examples:
157
157
  npx @cognite/cli apps publish . Publish using env-var auth
158
- npx @cognite/cli apps publish . --interactive Publish using browser auth (no secrets needed)`).action((i,s)=>Ql(s))}o(li,"registerPublishCommand");import{spawnSync as ed}from"child_process";import{mkdirSync as td}from"fs";import{join as nd,resolve as di}from"path";var rd=["localhost","local.cognite.ai","*.local.cognite.ai"],od={info:o(e=>{process.stdout.write(`${e}
158
+ npx @cognite/cli apps publish . --interactive Publish using browser auth (no secrets needed)`).action((i,s)=>ed(s))}o(di,"registerPublishCommand");import{spawnSync as td}from"child_process";import{mkdirSync as nd}from"fs";import{join as rd,resolve as ui}from"path";var od=["localhost","local.cognite.ai","*.local.cognite.ai"],id={info:o(e=>{process.stdout.write(`${e}
159
159
  `)},"info"),error:o(e=>{process.stderr.write(`${e}
160
- `)},"error")},id={spawnSync:ed,mkdirSync:td,logger:od,getConfig:P};function sd(e){let t=e("mkcert",["-help"],{stdio:"ignore"});return t.status===0||t.status===1}o(sd,"hasMkcert");function ad({certDir:e,domains:t=rd,deps:n={}}={}){let r={...id,...n},{spawnSync:i,mkdirSync:s,logger:a}=r,p=e??nd(r.getConfig().home,"certificates","mkcert");if(!sd(i))throw a.error("Error: mkcert is not installed."),a.error("Install it with: brew install mkcert (macOS, Linux, WSL)"),a.error("On Windows: choco install mkcert (or scoop install mkcert)"),a.error("See https://github.com/FiloSottile/mkcert#installation for other methods."),new Error("mkcert is not installed");if(a.info("\u2139\uFE0F Installing mkcert root CA into your local trust store."),a.info(" This allows your browser to trust locally-generated certificates."),a.info(" You may be prompted for your system password."),i("mkcert",["-install"],{stdio:"inherit"}).status!==0)throw new Error("`mkcert -install` failed");s(p,{recursive:!0});let l=di(p,"localhost.pem"),d=di(p,"localhost-key.pem");if(i("mkcert",["-cert-file",l,"-key-file",d,...t],{stdio:"inherit"}).status!==0)throw new Error("mkcert failed to generate certificates");return a.info(""),a.info("Certificates generated:"),a.info(` cert: ${l}`),a.info(` key: ${d}`),{certFile:l,keyFile:d}}o(ad,"setupHttps");function pd(e){ad({certDir:e.certDir})}o(pd,"handleSetupHttps");function ui(e){return e.command("setup-https").description("Generate trusted local HTTPS certificates via mkcert").option("--cert-dir <path>","Directory to write certs into (default: ~/.cognite-cli/certificates/mkcert)").addHelpText("after",`
160
+ `)},"error")},sd={spawnSync:td,mkdirSync:nd,logger:id,getConfig:P};function ad(e){let t=e("mkcert",["-help"],{stdio:"ignore"});return t.status===0||t.status===1}o(ad,"hasMkcert");function pd({certDir:e,domains:t=od,deps:n={}}={}){let r={...sd,...n},{spawnSync:i,mkdirSync:s,logger:a}=r,p=e??rd(r.getConfig().home,"certificates","mkcert");if(!ad(i))throw a.error("Error: mkcert is not installed."),a.error("Install it with: brew install mkcert (macOS, Linux, WSL)"),a.error("On Windows: choco install mkcert (or scoop install mkcert)"),a.error("See https://github.com/FiloSottile/mkcert#installation for other methods."),new Error("mkcert is not installed");if(a.info("\u2139\uFE0F Installing mkcert root CA into your local trust store."),a.info(" This allows your browser to trust locally-generated certificates."),a.info(" You may be prompted for your system password."),i("mkcert",["-install"],{stdio:"inherit"}).status!==0)throw new Error("`mkcert -install` failed");s(p,{recursive:!0});let l=ui(p,"localhost.pem"),d=ui(p,"localhost-key.pem");if(i("mkcert",["-cert-file",l,"-key-file",d,...t],{stdio:"inherit"}).status!==0)throw new Error("mkcert failed to generate certificates");return a.info(""),a.info("Certificates generated:"),a.info(` cert: ${l}`),a.info(` key: ${d}`),{certFile:l,keyFile:d}}o(pd,"setupHttps");function cd(e){pd({certDir:e.certDir})}o(cd,"handleSetupHttps");function mi(e){return e.command("setup-https").description("Generate trusted local HTTPS certificates via mkcert").option("--cert-dir <path>","Directory to write certs into (default: ~/.cognite-cli/certificates/mkcert)").addHelpText("after",`
161
161
  Examples:
162
162
  npx @cognite/cli@latest apps setup-https Generate certs in ~/.cognite-cli/certificates/mkcert
163
- npx @cognite/cli@latest apps setup-https --cert-dir certs Use a custom directory`).action(t=>pd(t))}o(ui,"registerSetupHttpsCommand");import{existsSync as Pd,writeFileSync as Dd}from"fs";import{basename as Id,dirname as Td,join as Rd,resolve as Mn}from"path";import{parseScope as Fd,signBundle as $d,validateScopes as Od}from"@cognite/app-sdk/codesigning";import{existsSync as bd,readFileSync as kd}from"fs";import{pbkdf2 as dd,randomBytes as ud}from"crypto";import{promisify as md}from"util";import{CompactEncrypt as fd,base64url as mi,compactDecrypt as gd}from"jose";var cd=new TextEncoder,ld=new TextDecoder,Rn={encode:o(e=>cd.encode(e),"encode"),decode:o(e=>ld.decode(e),"decode")};var yd=md(dd),On=6e5,hd="sha512",Fn="PBKDF2-HMAC-SHA512",$n=16,Pt="A256GCM",Sd=32,Dt=2e6;async function fi(e,t,n){return await yd(e,t,n,Sd,hd)}o(fi,"deriveKey");async function gi(e,t,n=On){if(!Number.isInteger(n)||n<1||n>Dt)throw new Error(`Invalid iterations: must be an integer between 1 and ${Dt}`);let r=ud($n),i=await fi(t.expose(),r,n);return await new fd(Rn.encode(e.expose())).setProtectedHeader({alg:"dir",enc:Pt,kdf:Fn,kdf_iter:n,kdf_salt:mi.encode(r)}).encrypt(i)}o(gi,"encryptStringAsJwe");async function yi(e,t){let{plaintext:n}=await gd(e,async r=>{if(!e.length)throw new Error("Unexpected JWE empty value");let i=t.expose();if(i.length<15)throw new Error(`Invalid passphrase: must be at least ${15} characters`);if(r.alg!=="dir")throw new Error(`Unexpected JWE alg "${String(r.alg)}"; only "dir" is supported`);if(r.enc!==Pt)throw new Error(`Unexpected JWE enc "${String(r.enc)}"; only "${Pt}" is supported`);if(r.kdf!==Fn)throw new Error(`Unexpected KDF "${String(r.kdf)}"; only "${Fn}" is supported`);let s=Number(r.kdf_iter);if(!Number.isInteger(s)||s<1||s>Dt)throw new Error(`Invalid kdf_iter in JWE header: must be an integer between 1 and ${Dt}`);if(typeof r.kdf_salt!="string")throw new Error("Missing kdf_salt in JWE header");let a=mi.decode(r.kdf_salt);if(a.length!==$n)throw new Error(`Invalid kdf_salt length in JWE header: expected ${$n} bytes, got ${a.length}`);return await fi(i,a,s)},{keyManagementAlgorithms:["dir"],contentEncryptionAlgorithms:[Pt]});return Rn.decode(n)}o(yi,"decryptJweAsString");function hi(e){let t=e.trim();return t.startsWith("eyJ")&&t.split(".").length===5}o(hi,"isJweCompact");import wd from"enquirer";async function vd(e){return wd.prompt(e)}o(vd,"defaultPrompt");async function Si(e,t={}){let{prompt:n=vd}=t,{passphrase:r}=await n({type:"password",name:"passphrase",message:e});return C.from(r)}o(Si,"promptPassphrase");import Ad from"enquirer";import{statSync as Cd}from"fs";function wi(e,t=Cd){return e.map(n=>({key:n,mtime:t(n.publicKeyPath).mtimeMs})).sort((n,r)=>r.mtime-n.mtime).map(({key:n})=>n)}o(wi,"sortByMtime");async function Ed(e){return Ad.prompt(e)}o(Ed,"defaultPrompt");async function vi(e,t={}){if(e.length===1)return e[0];let{prompt:n=Ed,sortByMtime:r=wi}=t,i=r(e),s=i[0],{choice:a}=await n({type:"select",name:"choice",message:"Select signing identity",choices:[{name:"latest",message:`Use latest: ${s.kid}`},{name:"pick",message:"Pick from list"}]});if(a==="latest")return s;if(a==="pick"){let{kid:p}=await n({type:"select",name:"kid",message:"Select signing identity",choices:i.map(l=>({name:l.kid,message:[l.kid,l.email,Je(l.source)].filter(Boolean).join(" \u2014 ")}))}),c=i.find(l=>l.kid===p);if(!c)throw new Error("No signing identity selected");return c}else throw new Error(`Unexpected choice: "${a}"`)}o(vi,"promptSigningIdentity");function xd(e){return{existsSync:e.existsSync??bd,readFileSync:e.readFileSync??((t,n)=>kd(t,n)),readKeyFromKeychain:e.readKeyFromKeychain??ze,readSigningKey:e.readSigningKey??We,isOS:e.isOS??(t=>L(t)),decryptJweAsString:e.decryptJweAsString??yi,discoverLocalKeys:e.discoverLocalKeys??Xe,keysDir:e.keysDir??P().keysDir,promptPassphrase:e.promptPassphrase??Si,promptSigningIdentity:e.promptSigningIdentity??vi}}o(xd,"resolveDeps");async function Ci(e,t={}){let n=xd(t);if(e.keyPath){if(!n.existsSync(e.keyPath))throw new Error(`Key file not found: ${e.keyPath}`);if(!e.kid)throw new Error("--signing-identity <kid> is required when using --key");let s=n.readFileSync(e.keyPath,"utf-8").trim();if(hi(s)){if(!e.interactive)throw new Error(`Key at ${e.keyPath} is passphrase-encrypted. Pass --interactive to enter the passphrase.`);let a=await n.promptPassphrase(`Passphrase for key ${e.kid}: `);return{privateKeyPem:C.from(await n.decryptJweAsString(s,a)),kid:e.kid}}return{privateKeyPem:C.from(s),kid:e.kid}}let r=await n.discoverLocalKeys(n.keysDir);if(r.length===0)throw new Error("No signing keys found. Run `cognite keys generate` or pass --key.");let i;if(e.kid)i=r.find(s=>s.kid===e.kid);else if(e.interactive)i=await n.promptSigningIdentity(r);else throw new Error("--signing-identity <kid> is required. Pass --interactive to select it interactively.");if(!i)throw new Error(`No key found with kid "${e.kid}"`);switch(i.source.kind){case"keychain":{let s=n.isOS("macos")?await n.readKeyFromKeychain(i.kid):await n.readSigningKey(i.kid);if(!s)throw new Error(`Key "${i.kid}" not found in OS credential store`);return{privateKeyPem:s,kid:i.kid}}case"encrypted-file":{if(!e.interactive)throw new Error(`Key "${i.kid}" is passphrase-encrypted. Pass --interactive to enter the passphrase, or store the key in macOS Keychain for non-interactive use.`);let s=await n.promptPassphrase(`Passphrase for key ${i.kid}: `);return{privateKeyPem:C.from(await n.decryptJweAsString(n.readFileSync(i.source.path,"utf-8"),s)),kid:i.kid}}case"public-only":throw new Error(`Key "${i.kid}" has no private key on this machine (public-only).`)}}o(Ci,"resolvePrivateKey");var Md=o(async(e,t,n,r,i)=>{let s=await j(e,{interactive:i.browserAuth??!1,appId:t,orgHint:i.org,authMethod:i.authMethod});await new I(s).submitSignatures(t,n,r)},"defaultSubmitSignatures");function Ud(e){return{existsSync:e.existsSync??Pd,writeFileSync:e.writeFileSync??Dd,createBundleStream:e.createBundleStream??Ze,signBundle:e.signBundle??$d,parseScope:e.parseScope??Fd,validateScopes:e.validateScopes??Od,loadAppConfig:e.loadAppConfig??b,resolvePrivateKey:e.resolvePrivateKey??(t=>Ci(t)),submitSignatures:e.submitSignatures??Md,discoverSignatures:e.discoverSignatures??Fe}}o(Ud,"resolveDeps");async function Ai(e,t,n={},r=process.cwd()){let i=Ud(n),s=t.appid,a=t.appVersion,p=[],c=i.loadAppConfig(r);if(s=s??c.externalId,a=a??c.versionTag,t.scope&&t.scope.length>0?p=t.scope.map(i.parseScope):p=c.deployments.map(v=>({org:v.org,project:v.project})),!s)throw new Error("--appid is required (or set externalId in app.json)");if(!a)throw new Error("--app-version is required (or set versionTag in app.json)");let l=e?Mn(r,e):K(r,s,a);if(!i.existsSync(l)){let v=e?"":" (default derived from app.json \u2014 pass [bundle] explicitly to override, or run `cognite apps deploy` first to populate .cognite-bundles/)";throw new Error(`Bundle not found: ${l}${v}`)}let d=i.validateScopes(p);if(d.length>0)throw new Error(`Invalid scopes:
163
+ npx @cognite/cli@latest apps setup-https --cert-dir certs Use a custom directory`).action(t=>cd(t))}o(mi,"registerSetupHttpsCommand");import{existsSync as Dd,writeFileSync as Id}from"fs";import{basename as Td,dirname as Rd,join as Fd,resolve as Un}from"path";import{parseScope as $d,signBundle as Od,validateScopes as Md}from"@cognite/app-sdk/codesigning";import{existsSync as kd,readFileSync as xd}from"fs";import{pbkdf2 as ud,randomBytes as md}from"crypto";import{promisify as fd}from"util";import{CompactEncrypt as gd,base64url as fi,compactDecrypt as yd}from"jose";var ld=new TextEncoder,dd=new TextDecoder,Fn={encode:o(e=>ld.encode(e),"encode"),decode:o(e=>dd.decode(e),"decode")};var hd=fd(ud),Mn=6e5,Sd="sha512",$n="PBKDF2-HMAC-SHA512",On=16,xt="A256GCM",wd=32,Pt=2e6;async function gi(e,t,n){return await hd(e,t,n,wd,Sd)}o(gi,"deriveKey");async function yi(e,t,n=Mn){if(!Number.isInteger(n)||n<1||n>Pt)throw new Error(`Invalid iterations: must be an integer between 1 and ${Pt}`);let r=md(On),i=await gi(t.expose(),r,n);return await new gd(Fn.encode(e.expose())).setProtectedHeader({alg:"dir",enc:xt,kdf:$n,kdf_iter:n,kdf_salt:fi.encode(r)}).encrypt(i)}o(yi,"encryptStringAsJwe");async function hi(e,t){let{plaintext:n}=await yd(e,async r=>{if(!e.length)throw new Error("Unexpected JWE empty value");let i=t.expose();if(i.length<15)throw new Error(`Invalid passphrase: must be at least ${15} characters`);if(r.alg!=="dir")throw new Error(`Unexpected JWE alg "${String(r.alg)}"; only "dir" is supported`);if(r.enc!==xt)throw new Error(`Unexpected JWE enc "${String(r.enc)}"; only "${xt}" is supported`);if(r.kdf!==$n)throw new Error(`Unexpected KDF "${String(r.kdf)}"; only "${$n}" is supported`);let s=Number(r.kdf_iter);if(!Number.isInteger(s)||s<1||s>Pt)throw new Error(`Invalid kdf_iter in JWE header: must be an integer between 1 and ${Pt}`);if(typeof r.kdf_salt!="string")throw new Error("Missing kdf_salt in JWE header");let a=fi.decode(r.kdf_salt);if(a.length!==On)throw new Error(`Invalid kdf_salt length in JWE header: expected ${On} bytes, got ${a.length}`);return await gi(i,a,s)},{keyManagementAlgorithms:["dir"],contentEncryptionAlgorithms:[xt]});return Fn.decode(n)}o(hi,"decryptJweAsString");function Si(e){let t=e.trim();return t.startsWith("eyJ")&&t.split(".").length===5}o(Si,"isJweCompact");import vd from"enquirer";async function Ad(e){return vd.prompt(e)}o(Ad,"defaultPrompt");async function wi(e,t={}){let{prompt:n=Ad}=t,{passphrase:r}=await n({type:"password",name:"passphrase",message:e});return A.from(r)}o(wi,"promptPassphrase");import Ed from"enquirer";import{statSync as Cd}from"fs";function vi(e,t=Cd){return e.map(n=>({key:n,mtime:t(n.publicKeyPath).mtimeMs})).sort((n,r)=>r.mtime-n.mtime).map(({key:n})=>n)}o(vi,"sortByMtime");async function bd(e){return Ed.prompt(e)}o(bd,"defaultPrompt");async function Ai(e,t={}){if(e.length===1)return e[0];let{prompt:n=bd,sortByMtime:r=vi}=t,i=r(e),s=i[0],{choice:a}=await n({type:"select",name:"choice",message:"Select signing identity",choices:[{name:"latest",message:`Use latest: ${s.kid}`},{name:"pick",message:"Pick from list"}]});if(a==="latest")return s;if(a==="pick"){let{kid:p}=await n({type:"select",name:"kid",message:"Select signing identity",choices:i.map(l=>({name:l.kid,message:[l.kid,l.email,Je(l.source)].filter(Boolean).join(" \u2014 ")}))}),c=i.find(l=>l.kid===p);if(!c)throw new Error("No signing identity selected");return c}else throw new Error(`Unexpected choice: "${a}"`)}o(Ai,"promptSigningIdentity");function Pd(e){return{existsSync:e.existsSync??kd,readFileSync:e.readFileSync??((t,n)=>xd(t,n)),readKeyFromKeychain:e.readKeyFromKeychain??ze,readSigningKey:e.readSigningKey??We,isOS:e.isOS??(t=>L(t)),decryptJweAsString:e.decryptJweAsString??hi,discoverLocalKeys:e.discoverLocalKeys??Xe,keysDir:e.keysDir??P().keysDir,promptPassphrase:e.promptPassphrase??wi,promptSigningIdentity:e.promptSigningIdentity??Ai}}o(Pd,"resolveDeps");async function Ci(e,t={}){let n=Pd(t);if(e.keyPath){if(!n.existsSync(e.keyPath))throw new Error(`Key file not found: ${e.keyPath}`);if(!e.kid)throw new Error("--signing-identity <kid> is required when using --key");let s=n.readFileSync(e.keyPath,"utf-8").trim();if(Si(s)){if(!e.interactive)throw new Error(`Key at ${e.keyPath} is passphrase-encrypted. Pass --interactive to enter the passphrase.`);let a=await n.promptPassphrase(`Passphrase for key ${e.kid}: `);return{privateKeyPem:A.from(await n.decryptJweAsString(s,a)),kid:e.kid}}return{privateKeyPem:A.from(s),kid:e.kid}}let r=await n.discoverLocalKeys(n.keysDir);if(r.length===0)throw new Error("No signing keys found. Run `cognite keys generate` or pass --key.");let i;if(e.kid)i=r.find(s=>s.kid===e.kid);else if(e.interactive)i=await n.promptSigningIdentity(r);else throw new Error("--signing-identity <kid> is required. Pass --interactive to select it interactively.");if(!i)throw new Error(`No key found with kid "${e.kid}"`);switch(i.source.kind){case"keychain":{let s=n.isOS("macos")?await n.readKeyFromKeychain(i.kid):await n.readSigningKey(i.kid);if(!s)throw new Error(`Key "${i.kid}" not found in OS credential store`);return{privateKeyPem:s,kid:i.kid}}case"encrypted-file":{if(!e.interactive)throw new Error(`Key "${i.kid}" is passphrase-encrypted. Pass --interactive to enter the passphrase, or store the key in macOS Keychain for non-interactive use.`);let s=await n.promptPassphrase(`Passphrase for key ${i.kid}: `);return{privateKeyPem:A.from(await n.decryptJweAsString(n.readFileSync(i.source.path,"utf-8"),s)),kid:i.kid}}case"public-only":throw new Error(`Key "${i.kid}" has no private key on this machine (public-only).`)}}o(Ci,"resolvePrivateKey");var Ud=o(async(e,t,n,r,i)=>{let s=await K(e,{interactive:i.browserAuth??!1,appId:t,orgHint:i.org,authMethod:i.authMethod,confirmActionTarget:i.confirmActionTarget,action:"sign"});await new I(s).submitSignatures(t,n,r)},"defaultSubmitSignatures");function _d(e){return{existsSync:e.existsSync??Dd,writeFileSync:e.writeFileSync??Id,createBundleStream:e.createBundleStream??Ze,signBundle:e.signBundle??Od,parseScope:e.parseScope??$d,validateScopes:e.validateScopes??Md,loadAppConfig:e.loadAppConfig??b,resolvePrivateKey:e.resolvePrivateKey??(t=>Ci(t)),submitSignatures:e.submitSignatures??Ud,discoverSignatures:e.discoverSignatures??Fe,isSessionAuthEnabled:e.isSessionAuthEnabled??E}}o(_d,"resolveDeps");async function Ei(e,t,n={},r=process.cwd()){let i=_d(n),s=t.appid,a=t.appVersion,p=[],c=i.loadAppConfig(r);if(s=s??c.externalId,a=a??c.versionTag,t.scope&&t.scope.length>0?p=t.scope.map(i.parseScope):p=c.deployments.map(v=>({org:v.org,project:v.project})),!s)throw new Error("--appid is required (or set externalId in app.json)");if(!a)throw new Error("--app-version is required (or set versionTag in app.json)");let l=e?Un(r,e):B(r,s,a);if(!i.existsSync(l)){let v=e?"":" (default derived from app.json \u2014 pass [bundle] explicitly to override, or run `cognite apps deploy` first to populate .cognite-bundles/)";throw new Error(`Bundle not found: ${l}${v}`)}let d=i.validateScopes(p);if(d.length>0)throw new Error(`Invalid scopes:
164
164
  ${d.join(`
165
- `)}`);let{privateKeyPem:u,kid:y}=await i.resolvePrivateKey({keyPath:t.key?Mn(r,t.key):void 0,kid:t.signingIdentity,interactive:t.interactive}),g=i.createBundleStream(l),f=await i.signBundle({privateKeyPem:u.expose(),kid:y,appId:s,version:a,bundleStream:g,role:t.asCertifier?"certifier":"developer",scopes:p}),h=t.output?Mn(r,t.output):Rd(Td(l),`${Id(l)}.${t.asCertifier?"cert":"dev"}.sig`);i.writeFileSync(h,f.token,"utf-8"),console.log(`\u2705 Signed: ${h}`),console.log(` kid: ${f.kid}`),console.log(` bundle: ${f.payload.bundleSha256}`),console.log(` scopes: ${f.payload.scopes.map(v=>`${v.org}/${v.project}`).join(", ")}`),t.verbose&&console.log(`
166
- Payload:`,JSON.stringify(f.payload,null,2));let S=Array.from(new Set([...i.discoverSignatures(l),f.token])),A=t.interactive?await $(c,{deployment:t.deployment,baseUrl:t.baseUrl,project:t.project,org:t.org}):T(c.deployments,t.deployment);if(!t.browserAuth){let v=F(A);if(v.length>0)throw new Error(`Deployment ${A.org}/${A.project} is missing ${v.join(" and ")} in app.json. Pass --browser-auth to authenticate via browser instead.`)}await i.submitSignatures(A,s,a,S,t),console.log(`
167
- To publish: npx @cognite/cli apps publish .`)}o(Ai,"handleSign");function Ei(e,t={},n={isSessionAuthEnabled:E}){let r=e.command("sign [bundle]").description("Sign an app bundle (defaults to .cognite-bundles/<app>-<version>.zip)").option("--key <path>","Private key PEM file path").option("-s, --signing-identity <kid>","Key ID for Keychain or file lookup").option("--appid <id>","Application ID (default: externalId from app.json)").option("-i, --identifier <id>","Alias for --appid").option("--app-version <version>","App version (default: versionTag from app.json)").option("--scope <org/project...>","Deployment scope(s) (default: deployments from app.json)").option("-r, --requirements <org/project...>","Alias for --scope").option("-o, --output <path>","Output file path (default: <bundle>.<dev|cert>.sig)").option("-v, --verbose","Display full payload after signing").option("--as-certifier","Counter-sign a developer signature as certifier").option("--interactive","Enable interactive prompts (key selection, passphrase, deployment target selection)",!1).option("--browser-auth","Use browser-based PKCE auth when submitting the signature",!1).option("-d, --deployment <target>","Deployment target from app.json (index or name; submit step only)").option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive or --browser-auth)");return n.isSessionAuthEnabled()&&r.addOption(Te()),r.action((i,s)=>{let a={...s,appid:s.identifier??s.appid,scope:s.requirements??s.scope};return Ai(i,a,t)})}o(Ei,"registerSignCommand");function _d(e){return e.alias==="ACTIVE"?"ACTIVE":e.lifecycleState}o(_d,"describeStatus");function Ld(e){if(e.length===0)return["Signatures: none stored"];let t=["Signatures:"];for(let n of e){let r=n.status==="VALID"?"\u2705":"\u274C",i=new Date(n.signatureIat).toISOString();t.push(` ${r} ${n.signerKid} (${n.signerRole}, signed ${i}) \u2014 ${n.status}`)}return t}o(Ld,"formatSignatures");async function Nd(e){let t=process.cwd();O(t);let n=b(t);M(n);let r=e.interactive?await $(n,e):T(n.deployments,e.deployment);if(!e.interactive){let a=F(r);if(a.length>0)throw new Error(`Deployment ${r.org}/${r.project} is missing ${a.join(" and ")} in app.json. Use \`cognite apps status --interactive\` for browser-based authentication instead.`)}let i=await j(r,{interactive:e.interactive,appId:n.externalId,orgHint:e.org,authMethod:e.authMethod}),s=new I(i);console.log(""),console.log(`App: ${n.name} (${n.externalId})`),console.log(`Version: ${n.versionTag} (local)`);try{let a=await s.getVersion(n.externalId,n.versionTag);console.log(`Status: ${_d(a)}`);let p=await Hd(s,n.externalId,n.versionTag);if(console.log(""),p==="endpoint-unavailable")console.log("Signatures: backend endpoint not available on this cluster yet");else for(let c of Ld(p))console.log(c);a.lifecycleState==="DRAFT"&&(console.log(""),console.log("Run `npx @cognite/cli apps publish .` to publish this version."))}catch(a){if(a instanceof V){console.log("Status: not deployed yet"),console.log(""),console.log("Run `npx @cognite/cli apps deploy` to upload this version.");return}throw a}}o(Nd,"handleStatus");async function Hd(e,t,n){try{return await e.listSignatures(t,n)}catch(r){if(ue(r)&&r.status===404||r instanceof Error&&/status code: 404/.test(r.message))return"endpoint-unavailable";throw r}}o(Hd,"fetchSignatures");function bi(e,t={isSessionAuthEnabled:E}){let n=e.command("status").description("Show the deployment status and signatures of the current app version").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)");return t.isSessionAuthEnabled()&&n.addOption(Te()),n.addHelpText("after",`
165
+ `)}`);let{privateKeyPem:u,kid:y}=await i.resolvePrivateKey({keyPath:t.key?Un(r,t.key):void 0,kid:t.signingIdentity,interactive:t.interactive}),g=i.createBundleStream(l),f=await i.signBundle({privateKeyPem:u.expose(),kid:y,appId:s,version:a,bundleStream:g,role:t.asCertifier?"certifier":"developer",scopes:p}),h=t.output?Un(r,t.output):Fd(Rd(l),`${Td(l)}.${t.asCertifier?"cert":"dev"}.sig`);i.writeFileSync(h,f.token,"utf-8"),console.log(`\u2705 Signed: ${h}`),console.log(` kid: ${f.kid}`),console.log(` bundle: ${f.payload.bundleSha256}`),console.log(` scopes: ${f.payload.scopes.map(v=>`${v.org}/${v.project}`).join(", ")}`),t.verbose&&console.log(`
166
+ Payload:`,JSON.stringify(f.payload,null,2));let S=Array.from(new Set([...i.discoverSignatures(l),f.token])),C=t.interactive?await $(c,{deployment:t.deployment,baseUrl:t.baseUrl,project:t.project,org:t.org}):T(c.deployments,t.deployment);if(!t.browserAuth&&!i.isSessionAuthEnabled()){let v=F(C);if(v.length>0)throw new Error(`Deployment ${C.org}/${C.project} is missing ${v.join(" and ")} in app.json. Pass --browser-auth to authenticate via browser instead.`)}await i.submitSignatures(C,s,a,S,t),console.log(`
167
+ To publish: npx @cognite/cli apps publish .`)}o(Ei,"handleSign");function bi(e,t={},n={isSessionAuthEnabled:E}){let r=e.command("sign [bundle]").description("Sign an app bundle (defaults to .cognite-bundles/<app>-<version>.zip)").option("--key <path>","Private key PEM file path").option("-s, --signing-identity <kid>","Key ID for Keychain or file lookup").option("--appid <id>","Application ID (default: externalId from app.json)").option("-i, --identifier <id>","Alias for --appid").option("--app-version <version>","App version (default: versionTag from app.json)").option("--scope <org/project...>","Deployment scope(s) (default: deployments from app.json)").option("-r, --requirements <org/project...>","Alias for --scope").option("-o, --output <path>","Output file path (default: <bundle>.<dev|cert>.sig)").option("-v, --verbose","Display full payload after signing").option("--as-certifier","Counter-sign a developer signature as certifier").option("--interactive","Enable interactive prompts (key selection, passphrase, deployment target selection)",!1).option("--browser-auth","Use browser-based PKCE auth when submitting the signature",!1).option("-d, --deployment <target>","Deployment target from app.json (index or name; submit step only)").option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive or --browser-auth)");return n.isSessionAuthEnabled()&&N().forEach(i=>r.addOption(i)),r.action((i,s)=>{let a={...s,appid:s.identifier??s.appid,scope:s.requirements??s.scope};return Ei(i,a,t)})}o(bi,"registerSignCommand");function Ld(e){return e.alias==="ACTIVE"?"ACTIVE":e.lifecycleState}o(Ld,"describeStatus");function Nd(e){if(e.length===0)return["Signatures: none stored"];let t=["Signatures:"];for(let n of e){let r=n.status==="VALID"?"\u2705":"\u274C",i=new Date(n.signatureIat).toISOString();t.push(` ${r} ${n.signerKid} (${n.signerRole}, signed ${i}) \u2014 ${n.status}`)}return t}o(Nd,"formatSignatures");async function Hd(e,t,n){let r=await K(e,{interactive:t.interactive,appId:n,orgHint:t.org,authMethod:t.authMethod});return new I(r)}o(Hd,"defaultBuildApiClient");async function jd(e,t={}){let{loadEnvFile:n=O,loadAppConfig:r=b,getApiClient:i=Hd,isSessionAuthEnabled:s=E}=t,a=process.cwd();n(a);let p=r(a);M(p);let c=e.interactive?await $(p,e):T(p.deployments,e.deployment);if(!e.interactive&&!s()){let d=F(c);if(d.length>0)throw new Error(`Deployment ${c.org}/${c.project} is missing ${d.join(" and ")} in app.json. Use \`cognite apps status --interactive\` for browser-based authentication instead.`)}let l=await i(c,e,p.externalId);console.log(""),console.log(`App: ${p.name} (${p.externalId})`),console.log(`Version: ${p.versionTag} (local)`);try{let d=await l.getVersion(p.externalId,p.versionTag);console.log(`Status: ${Ld(d)}`);let u=await Kd(l,p.externalId,p.versionTag);if(console.log(""),u==="endpoint-unavailable")console.log("Signatures: backend endpoint not available on this cluster yet");else for(let y of Nd(u))console.log(y);d.lifecycleState==="DRAFT"&&(console.log(""),console.log("Run `npx @cognite/cli apps publish .` to publish this version."))}catch(d){if(d instanceof G){console.log("Status: not deployed yet"),console.log(""),console.log("Run `npx @cognite/cli apps deploy` to upload this version.");return}throw d}}o(jd,"handleStatus");async function Kd(e,t,n){try{return await e.listSignatures(t,n)}catch(r){if(ue(r)&&r.status===404||r instanceof Error&&/status code: 404/.test(r.message))return"endpoint-unavailable";throw r}}o(Kd,"fetchSignatures");function ki(e,t={isSessionAuthEnabled:E}){let n=e.command("status").description("Show the deployment status and signatures of the current app version").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)");return t.isSessionAuthEnabled()&&n.addOption(gn()),n.addHelpText("after",`
168
168
  Examples:
169
169
  npx @cognite/cli apps status . Status using env-var auth
170
- npx @cognite/cli apps status . --interactive Status using browser auth (no secrets needed)`).action((r,i)=>Nd(i))}o(bi,"registerStatusCommand");import{execFileSync as Ln}from"child_process";import _n from"fs";import Ue from"path";import Vd from"readline";var ki="https://cognite.zendesk.com",jd="360001234312",Kd="tf_360015295097",Bd="cognite_flows_certifications";function xi(e,t,n){let r=new URLSearchParams({ticket_form_id:jd,tf_priority:"normal",tf_subject:e,[Kd]:Bd,tf_description:t});return`${n}/hc/en-us/requests/new?${r}`}o(xi,"buildUrl");function Pi(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;")}o(Pi,"escapeHtml");function Un(e){return e.map(Pi).join("<br>")}o(Un,"toHtml");function Di(e,t=ki){let{appName:n,externalId:r,versionTag:i,archiveName:s,developerName:a,cdfProject:p,cdfCluster:c}=e,l=["Dear Cognite Platform Team,","","I would like to submit my Flows app for review and certification.","",`App name: ${n}`,`App external ID: ${r}`,`Version: ${i}`,p?`CDF project: ${p}`:void 0,c?`CDF cluster: ${c}`:void 0,"","`npx @cognite/cli apps submit` verified App-Brief.md,","code-review-report.md, and design-review-report.md are committed to git.","","Attached (all from dist/submit/):",`[ ] ${s??"src-<sha>.zip"} \u2014 source archive`,`[ ] ${r}-${i}.zip \u2014 deploy bundle`,"[ ] Screen recording of the application (required for design review)","","Best regards,",a??"[Your name]"];return xi(`App Review Request: ${n}`,Un(l.filter(d=>d!==void 0)),t)}o(Di,"buildAppReviewUrl");function Ii(e,t,n,r,i=ki){let s=Un(["Dear Cognite Platform Team,","","I would like to register my Flows app signing key for certified deployments.","",`Key ID (kid): ${e}`,`Developer email: ${t}`,`Expires: ${n}`,"","Please add the following entry to public_keys.yaml:"]),a=`<pre>${Pi(r.replace(/\r\n/g,`
171
- `))}</pre>`,p=Un(["","Best Regards,","[Your name]","","(This registration request was generated by `npx @cognite/cli keys generate`.)"]);return xi(`Public Key Registration: ${t}`,`${s}<br>${a}${p}`,i)}o(Ii,"buildKeyRegistrationUrl");function Gd(){return new Promise(e=>{let t=Vd.createInterface({input:process.stdin,output:process.stdout});t.question(`
172
- Press Enter to open the Zendesk form in your browser and reveal dist/submit/ in your file manager...`,()=>{t.close(),e()})})}o(Gd,"defaultPressEnter");var Yd=[{pattern:"App-Brief.md",label:"App-Brief.md",skill:"flows-app-brief"},{pattern:"reviews/code-review/*/code-review-report.md",label:"reviews/code-review/feedback-round-<N>/code-review-report.md",skill:"flows-code-review"},{pattern:"reviews/design-review/*/design-review-report.md",label:"reviews/design-review/feedback-round-<N>/design-review-report.md",skill:"flows-design-review"}];function qd(e){let t=Yd.filter(({pattern:n})=>Ln("git",["-C",e,"ls-files","--",n],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().length===0);if(t.length>0){let n=t.map(({label:r,skill:i})=>` ${r} \u2192 /${i}`);throw new Error(`Certification files are missing or not committed. Run the required skills in Claude Code first:
170
+ npx @cognite/cli apps status . --interactive Status using browser auth (no secrets needed)`).action((r,i)=>jd(i))}o(ki,"registerStatusCommand");import{execFileSync as Nn}from"child_process";import Ln from"fs";import Ue from"path";import Yd from"readline";var xi="https://cognite.zendesk.com",Bd="360001234312",Vd="tf_360015295097",Gd="cognite_flows_certifications";function Pi(e,t,n){let r=new URLSearchParams({ticket_form_id:Bd,tf_priority:"normal",tf_subject:e,[Vd]:Gd,tf_description:t});return`${n}/hc/en-us/requests/new?${r}`}o(Pi,"buildUrl");function Di(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;")}o(Di,"escapeHtml");function _n(e){return e.map(Di).join("<br>")}o(_n,"toHtml");function Ii(e,t=xi){let{appName:n,externalId:r,versionTag:i,archiveName:s,developerName:a,cdfProject:p,cdfCluster:c}=e,l=["Dear Cognite Platform Team,","","I would like to submit my Flows app for review and certification.","",`App name: ${n}`,`App external ID: ${r}`,`Version: ${i}`,p?`CDF project: ${p}`:void 0,c?`CDF cluster: ${c}`:void 0,"","`npx @cognite/cli apps submit` verified App-Brief.md,","code-review-report.md, and design-review-report.md are committed to git.","","Attached (all from dist/submit/):",`[ ] ${s??"src-<sha>.zip"} \u2014 source archive`,`[ ] ${r}-${i}.zip \u2014 deploy bundle`,"[ ] Screen recording of the application (required for design review)","","Best regards,",a??"[Your name]"];return Pi(`App Review Request: ${n}`,_n(l.filter(d=>d!==void 0)),t)}o(Ii,"buildAppReviewUrl");function Ti(e,t,n,r,i=xi){let s=_n(["Dear Cognite Platform Team,","","I would like to register my Flows app signing key for certified deployments.","",`Key ID (kid): ${e}`,`Developer email: ${t}`,`Expires: ${n}`,"","Please add the following entry to public_keys.yaml:"]),a=`<pre>${Di(r.replace(/\r\n/g,`
171
+ `))}</pre>`,p=_n(["","Best Regards,","[Your name]","","(This registration request was generated by `npx @cognite/cli keys generate`.)"]);return Pi(`Public Key Registration: ${t}`,`${s}<br>${a}${p}`,i)}o(Ti,"buildKeyRegistrationUrl");function qd(){return new Promise(e=>{let t=Yd.createInterface({input:process.stdin,output:process.stdout});t.question(`
172
+ Press Enter to open the Zendesk form in your browser and reveal dist/submit/ in your file manager...`,()=>{t.close(),e()})})}o(qd,"defaultPressEnter");var zd=[{pattern:"App-Brief.md",label:"App-Brief.md",skill:"flows-app-brief"},{pattern:"reviews/code-review/*/code-review-report.md",label:"reviews/code-review/feedback-round-<N>/code-review-report.md",skill:"flows-code-review"},{pattern:"reviews/design-review/*/design-review-report.md",label:"reviews/design-review/feedback-round-<N>/design-review-report.md",skill:"flows-design-review"}];function Wd(e){let t=zd.filter(({pattern:n})=>Nn("git",["-C",e,"ls-files","--",n],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().length===0);if(t.length>0){let n=t.map(({label:r,skill:i})=>` ${r} \u2192 /${i}`);throw new Error(`Certification files are missing or not committed. Run the required skills in Claude Code first:
173
173
 
174
174
  `+n.join(`
175
- `)+"\n\nAfter running the skills, commit the generated files and re-run `apps submit`.")}}o(qd,"assertArtifactsCommitted");async function zd(e=process.cwd(),t={}){let{openInBrowser:n=Er,revealInFileManager:r=br,pressEnter:i=Gd,isInteractive:s=o(()=>process.stdout.isTTY===!0,"isInteractive")}=t;if(q(),!Be(e))throw new Error("Not a git repository. Run this command from your app's root directory.");O(e);let a=b(e);M(a),qd(e);let p=Ue.join(e,"dist","submit");_n.mkdirSync(p,{recursive:!0});let c=Ln("git",["-C",e,"rev-parse","--short","HEAD"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim();if(Ln("git",["-C",e,"status","--porcelain"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().length>0)throw new Error(`Working tree has uncommitted changes. Commit or stash them before submitting for certification.
175
+ `)+"\n\nAfter running the skills, commit the generated files and re-run `apps submit`.")}}o(Wd,"assertArtifactsCommitted");async function Jd(e=process.cwd(),t={}){let{openInBrowser:n=br,revealInFileManager:r=kr,pressEnter:i=qd,isInteractive:s=o(()=>process.stdout.isTTY===!0,"isInteractive")}=t;if(q(),!Be(e))throw new Error("Not a git repository. Run this command from your app's root directory.");O(e);let a=b(e);M(a),Wd(e);let p=Ue.join(e,"dist","submit");Ln.mkdirSync(p,{recursive:!0});let c=Nn("git",["-C",e,"rev-parse","--short","HEAD"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim();if(Nn("git",["-C",e,"status","--porcelain"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().length>0)throw new Error(`Working tree has uncommitted changes. Commit or stash them before submitting for certification.
176
176
 
177
- The source archive must exactly match the committed code so reviewers can verify what they receive.`);let d=`src-${c}.zip`,u=Ue.join(p,d);await new Q(Ue.join(e,"dist")).createSourceArchive(u);let g=`${a.externalId}-${a.versionTag}.zip`,f=Ue.join(e,".cognite-bundles",g),h=!1;_n.existsSync(f)&&(_n.copyFileSync(f,Ue.join(p,g)),h=!0);let S=Di({appName:a.name,externalId:a.externalId,versionTag:a.versionTag,archiveName:d,developerName:nr(),cdfProject:a.deployments[0].project,cdfCluster:a.deployments[0].baseUrl});console.log(`
177
+ The source archive must exactly match the committed code so reviewers can verify what they receive.`);let d=`src-${c}.zip`,u=Ue.join(p,d);await new Q(Ue.join(e,"dist")).createSourceArchive(u);let g=`${a.externalId}-${a.versionTag}.zip`,f=Ue.join(e,".cognite-bundles",g),h=!1;Ln.existsSync(f)&&(Ln.copyFileSync(f,Ue.join(p,g)),h=!0);let S=Ii({appName:a.name,externalId:a.externalId,versionTag:a.versionTag,archiveName:d,developerName:rr(),cdfProject:a.deployments[0].project,cdfCluster:a.deployments[0].baseUrl});console.log(`
178
178
  \u2705 Certification package ready: dist/submit/`),console.log(` ${d} \u2014 source archive (commit ${c})`),console.log(h?` ${g} \u2014 deploy bundle`:" \u26A0 Deploy bundle missing \u2014 run `apps deploy` to generate it, then re-run submit"),console.log(" \u2190 add your screen recording to this folder"),console.log(`
179
179
  Attach all files from dist/submit/ to the Zendesk ticket.`),console.log(`
180
- \u{1F517} ${S}`),s()&&(await i(),n(S),r(u))}o(zd,"handleSubmit");function Ti(e){return e.command("submit").description("Package source and open a pre-filled Zendesk form for app certification submission").addHelpText("after",`
180
+ \u{1F517} ${S}`),s()&&(await i(),n(S),r(u))}o(Jd,"handleSubmit");function Ri(e){return e.command("submit").description("Package source and open a pre-filled Zendesk form for app certification submission").addHelpText("after",`
181
181
  Examples:
182
- npx @cognite/cli apps submit Package source, open browser + file manager`).action(()=>zd())}o(Ti,"registerSubmitCommand");function Ri(e){let t=e.command("apps").description("Manage Fusion Custom Apps \u2014 create, deploy, and manage version lifecycle");return Xo(t),ri(t),pi(t),bi(t),ci(t),li(t),$o(t),Zo(t),Qo(t),ui(t),Ti(t),zo(t),Ei(t),Hr(t),t}o(Ri,"registerAppsCommand");import Nn from"enquirer";function Wd(e){return{loadAppConfig:e.loadAppConfig??b,cwd:e.cwd??(()=>process.cwd()),loginForSession:e.loginForSession??(t=>lo(t)),writeSession:e.writeSession??(t=>lt(t)),readSessionMetadata:e.readSessionMetadata??(()=>fe()),clearSession:e.clearSession??(()=>dt()),promptSelectOrg:e.promptSelectOrg??Jd,promptOrg:e.promptOrg??Xd,promptConfirm:e.promptConfirm??Zd,logger:e.logger??console,platform:e.platform??process.platform}}o(Wd,"resolveDeps");async function Jd(e){let{selected:t}=await Nn.prompt({type:"select",name:"selected",message:"Select the organization to sign in to",choices:e});return t}o(Jd,"defaultPromptSelectOrg");async function Xd(){let{org:e}=await Nn.prompt({type:"input",name:"org",message:"Enter your organization name",validate:o(t=>t.trim().length>0?!0:"Organization name is required","validate")});return e.trim()}o(Xd,"defaultPromptOrg");async function Zd(e){let{confirmed:t}=await Nn.prompt({type:"confirm",name:"confirmed",message:e,initial:!1});return t}o(Zd,"defaultPromptConfirm");async function Qd(e,t){let{logger:n,promptSelectOrg:r,promptOrg:i}=t;if(e.org)return e.org;let s=eu(t);if(s){let a=[...new Set(s.deployments.map(p=>p.org))];return a.length===1?(n.log(`Resolved organization from app.json: ${a[0]}`),a[0]):r(a)}return i()}o(Qd,"resolveOrg");function eu(e){let{loadAppConfig:t,cwd:n}=e;try{return t(n())}catch(r){let i=r instanceof Error?r.message:String(r);if(/No app\.json found/.test(i))return null;throw r}}o(eu,"tryLoadAppConfig");function tu(e){switch(e){case"darwin":return"macOS Keychain";case"win32":return"Windows Credential Manager";default:return"Secret Service (libsecret / KWallet)"}}o(tu,"keyringBackendLabel");function nu(e){let t=e,n=new Set;for(;t!=null&&!n.has(t)&&(n.add(t),typeof t=="object");){if("code"in t&&t.code==="ERR_DLOPEN_FAILED")return!0;let r="message"in t&&typeof t.message=="string"?t.message:null;if(r&&/cannot find native binding/i.test(r))return!0;t="cause"in t?t.cause:void 0}return!1}o(nu,"isNativeModuleLoadError");async function ru(e,t){let{logger:n,loginForSession:r,writeSession:i,readSessionMetadata:s,clearSession:a,promptConfirm:p,platform:c}=t,l=s();if(l){if(!e.force&&ge(l)!=="EXPIRED"&&!await p(`A session for organization "${l.org}" already exists. Replace it?`)){n.error("Aborted.");return}await a()}let d=await Qd(e,t),u=await r({org:d});try{await i(u)}catch(g){if(nu(g)){let f=c==="win32"?"Install the Microsoft Visual C++ Redistributable from https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist and restart your terminal, then run `cognite auth login` again.":"Ensure the required system libraries are installed for your platform, then run `cognite auth login` again.";throw new m("The keyring native module could not be loaded \u2014 tokens were not persisted.",{hint:f,cause:g})}throw new m("Login succeeded but tokens could not be saved to the credential store.",{hint:`Ensure a credential store (${tu(c)}) is available and unlocked, then run \`cognite auth login\` again.`,cause:g})}let y=re(process.stdout);n.log(""),n.log(`${y.green("\u2713")} Signed in to organization ${u.org}`)}o(ru,"handleLogin");function ou(e){return e.commands.find(t=>t.name()==="auth")??e.command("auth").description("Manage your persisted CDF login session")}o(ou,"getOrCreateAuthGroup");function Fi(e,t={}){let n=Wd(t);ou(e).command("login").description("Sign in via the browser and persist a refreshable session").option("--org <org>","Organization to sign in to (resolved from app.json or prompted when omitted)").option("--force","Replace an existing session without prompting").action(i=>ru(i,n))}o(Fi,"registerAuthLoginCommand");function iu(e){return{readSession:e.readSession??(()=>De()),readSessionMetadata:e.readSessionMetadata??(()=>fe()),clearSession:e.clearSession??(()=>dt()),revokeRefreshToken:e.revokeRefreshToken??(t=>uo(t)),logger:e.logger??console}}o(iu,"resolveDeps");async function su(e){let{readSessionMetadata:t,readSession:n,clearSession:r,revokeRefreshToken:i,logger:s}=e,a=null;try{a=t()}catch{await r(),s.log("Cleared corrupt session.");return}if(!a){s.log("No active session.");return}let p;try{p=(await n())?.refreshToken}catch{}if(await r(),p)try{await i(p)}catch{s.error("Logged out locally, but revoking the token at the identity provider failed. It may remain valid until it expires naturally."),s.log("Logged out.");return}s.log("Logged out.")}o(su,"handleLogout");function au(e){return e.commands.find(t=>t.name()==="auth")??e.command("auth").description("Manage your persisted CDF login session")}o(au,"getOrCreateAuthGroup");function $i(e,t={}){let n=iu(t);au(e).command("logout").description("Revoke and remove the persisted session").action(()=>su(n))}o($i,"registerAuthLogoutCommand");var pu="auth.cognite.com";function cu(e){return{ensureFreshSession:e.ensureFreshSession??mt,fetchUserInfo:e.fetchUserInfo??(t=>go(t)),logger:e.logger??console}}o(cu,"resolveDeps");function lu(e){return e.email??e.preferredUsername??e.name??e.sub}o(lu,"describeUser");var du="(unknown cluster)";function uu(e,t){if(e.length===0)return[" - Projects: (none)"];let n=new Map;for(let i of e){let s=i.cluster??du,a=n.get(s);a?a.push(i):n.set(s,[i])}let r=[` - Projects (${e.length}):`];for(let[i,s]of n){r.push(` ${t.dim(i)}`);for(let a of s){let p=a.isDefault?` ${t.green("[default]")}`:"";r.push(` ${a.name}${p}`)}}return r}o(uu,"formatProjects");function mu(){switch(process.platform){case"darwin":return"macOS Keychain";case"win32":return"Windows Credential Manager";default:return"Secret Service (libsecret / KWallet)"}}o(mu,"keyringBackendLabel");async function fu(e){let{ensureFreshSession:t,fetchUserInfo:n,logger:r}=e,i;try{i=await t()}catch(s){if(s instanceof Ie){r.error(" Session expired. Run `npx @cognite/cli auth login` to sign in again."),process.exitCode=1;return}throw s}if(!i){r.error("Not signed in. Run `npx @cognite/cli auth login` to start a session."),process.exitCode=1;return}r.log(i.org);try{let s=await n(i),a=re(process.stdout);r.log(` ${a.green("\u2713")} Signed in as ${lu(s)}`);for(let p of uu(s.projects,a))r.log(p);r.log(` - Token storage: ${mu()}`)}catch(s){if(s instanceof Ee&&s.kind==="unreachable")r.error(` \u2717 Couldn't reach Cognite (${pu}): ${s.message}`),r.error(" Check your network connection, or run `npx @cognite/cli auth login` to sign in again.");else{let a=s instanceof Error?s.message:String(s);r.error(` \u2717 ${a}`),r.error(" Run `npx @cognite/cli auth login` to sign in again.")}process.exitCode=1}}o(fu,"handleStatus");function gu(e){return e.commands.find(t=>t.name()==="auth")??e.command("auth").description("Manage your persisted CDF login session")}o(gu,"getOrCreateAuthGroup");function Oi(e,t={}){let n=cu(t);gu(e).command("status").alias("whoami").description("Show the active session, verified against the identity provider").action(()=>fu(n))}o(Oi,"registerAuthStatusCommand");import{existsSync as wu,mkdirSync as vu,writeFileSync as Cu}from"fs";import{dirname as Kn,join as _e}from"path";import{generateSigningKeyPair as Au}from"@cognite/app-sdk/codesigning";import Eu from"open";function Mi(e,t){let n=e.getUTCFullYear(),r=e.getUTCMonth()+t,i=new Date(Date.UTC(n,r+1,0)).getUTCDate(),s=Math.min(e.getUTCDate(),i);return new Date(Date.UTC(n,r,s))}o(Mi,"addMonthsClamped");function Hn(e){return e.toISOString().slice(0,10)}o(Hn,"formatIsoDate");function Ui(e=new Date){return Hn(e)}o(Ui,"todayIso");var It=Uint8Array.from([48,42,48,5,6,3,43,101,112,3,33,0]),_i=32,Li=44,Ni=60,yu="services/app-hosting/src/kotlin/com/cognite/apphosting/signing/public_keys.yaml";function hu(e){let t=e.replace(/-----BEGIN [^-]+-----/g,"").replace(/-----END [^-]+-----/g,"").replace(/\s+/g,"");if(t.length!==Li&&t.length!==Ni)throw new Error(`Unexpected Ed25519 public key base64 length: got ${t.length} chars, expected ${Li} (raw) or ${Ni} (X.509-wrapped)`);let n=Buffer.from(t,"base64");if(n.length===It.length+_i&&n.subarray(0,It.length).equals(It))return n.subarray(It.length).toString("base64");if(n.length===_i)return n.toString("base64");throw new Error(`Unexpected Ed25519 public key length: got ${n.length} bytes, expected 32 (raw) or 44 (X.509-wrapped)`)}o(hu,"pemBodyOneLine");function jn(e,t=Oe,n=new Date){let r=Hi(e.issuedAt??Ui(n)),i=Hi(e.expires),s=hu(e.publicKeyPem),a=" ",p=o((l,d)=>`${a}${t.cyan(l)}${t.dim(":")} ${d}
182
+ npx @cognite/cli apps submit Package source, open browser + file manager`).action(()=>Jd())}o(Ri,"registerSubmitCommand");function Fi(e){let t=e.command("apps").description("Manage Fusion Custom Apps \u2014 create, deploy, and manage version lifecycle");return Zo(t),oi(t),ci(t),ki(t),li(t),di(t),Oo(t),Qo(t),ei(t),mi(t),Ri(t),Wo(t),bi(t),jr(t),t}o(Fi,"registerAppsCommand");import Hn from"enquirer";function Xd(e){return{loadAppConfig:e.loadAppConfig??b,cwd:e.cwd??(()=>process.cwd()),loginForSession:e.loginForSession??(t=>uo(t)),writeSession:e.writeSession??(t=>lt(t)),readSessionMetadata:e.readSessionMetadata??(()=>fe()),clearSession:e.clearSession??(()=>dt()),promptSelectOrg:e.promptSelectOrg??Zd,promptOrg:e.promptOrg??Qd,promptConfirm:e.promptConfirm??eu,logger:e.logger??console,platform:e.platform??process.platform}}o(Xd,"resolveDeps");async function Zd(e){let{selected:t}=await Hn.prompt({type:"select",name:"selected",message:"Select the organization to sign in to",choices:e});return t}o(Zd,"defaultPromptSelectOrg");async function Qd(){let{org:e}=await Hn.prompt({type:"input",name:"org",message:"Enter your organization name",validate:o(t=>t.trim().length>0?!0:"Organization name is required","validate")});return e.trim()}o(Qd,"defaultPromptOrg");async function eu(e){let{confirmed:t}=await Hn.prompt({type:"confirm",name:"confirmed",message:e,initial:!1});return t}o(eu,"defaultPromptConfirm");async function tu(e,t){let{logger:n,promptSelectOrg:r,promptOrg:i}=t;if(e.org)return e.org;let s=nu(t);if(s){let a=[...new Set(s.deployments.map(p=>p.org))];return a.length===1?(n.log(`Resolved organization from app.json: ${a[0]}`),a[0]):r(a)}return i()}o(tu,"resolveOrg");function nu(e){let{loadAppConfig:t,cwd:n}=e;try{return t(n())}catch(r){let i=r instanceof Error?r.message:String(r);if(/No app\.json found/.test(i))return null;throw r}}o(nu,"tryLoadAppConfig");function ru(e){switch(e){case"darwin":return"macOS Keychain";case"win32":return"Windows Credential Manager";default:return"Secret Service (libsecret / KWallet)"}}o(ru,"keyringBackendLabel");function ou(e){let t=e,n=new Set;for(;t!=null&&!n.has(t)&&(n.add(t),typeof t=="object");){if("code"in t&&t.code==="ERR_DLOPEN_FAILED")return!0;let r="message"in t&&typeof t.message=="string"?t.message:null;if(r&&/cannot find native binding/i.test(r))return!0;t="cause"in t?t.cause:void 0}return!1}o(ou,"isNativeModuleLoadError");async function iu(e,t){let{logger:n,loginForSession:r,writeSession:i,readSessionMetadata:s,clearSession:a,promptConfirm:p,platform:c}=t,l=s();if(l){if(!e.force&&ge(l)!=="EXPIRED"&&!await p(`A session for organization "${l.org}" already exists. Replace it?`)){n.error("Aborted.");return}await a()}let d=await tu(e,t),u=await r({org:d});try{await i(u)}catch(g){if(ou(g)){let f=c==="win32"?"Install the Microsoft Visual C++ Redistributable from https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist and restart your terminal, then run `cognite auth login` again.":"Ensure the required system libraries are installed for your platform, then run `cognite auth login` again.";throw new m("The keyring native module could not be loaded \u2014 tokens were not persisted.",{hint:f,cause:g})}throw new m("Login succeeded but tokens could not be saved to the credential store.",{hint:`Ensure a credential store (${ru(c)}) is available and unlocked, then run \`cognite auth login\` again.`,cause:g})}let y=re(process.stdout);n.log(""),n.log(`${y.green("\u2713")} Signed in to organization ${u.org}`)}o(iu,"handleLogin");function su(e){return e.commands.find(t=>t.name()==="auth")??e.command("auth").description("Manage your persisted CDF login session")}o(su,"getOrCreateAuthGroup");function $i(e,t={}){let n=Xd(t);su(e).command("login").description("Sign in via the browser and persist a refreshable session").option("--org <org>","Organization to sign in to (resolved from app.json or prompted when omitted)").option("--force","Replace an existing session without prompting").action(i=>iu(i,n))}o($i,"registerAuthLoginCommand");function au(e){return{readSession:e.readSession??(()=>Ie()),readSessionMetadata:e.readSessionMetadata??(()=>fe()),clearSession:e.clearSession??(()=>dt()),revokeRefreshToken:e.revokeRefreshToken??(t=>mo(t)),logger:e.logger??console}}o(au,"resolveDeps");async function pu(e){let{readSessionMetadata:t,readSession:n,clearSession:r,revokeRefreshToken:i,logger:s}=e,a=null;try{a=t()}catch{await r(),s.log("Cleared corrupt session.");return}if(!a){s.log("No active session.");return}let p;try{p=(await n())?.refreshToken}catch{}if(await r(),p)try{await i(p)}catch{s.error("Logged out locally, but revoking the token at the identity provider failed. It may remain valid until it expires naturally."),s.log("Logged out.");return}s.log("Logged out.")}o(pu,"handleLogout");function cu(e){return e.commands.find(t=>t.name()==="auth")??e.command("auth").description("Manage your persisted CDF login session")}o(cu,"getOrCreateAuthGroup");function Oi(e,t={}){let n=au(t);cu(e).command("logout").description("Revoke and remove the persisted session").action(()=>pu(n))}o(Oi,"registerAuthLogoutCommand");var lu="auth.cognite.com";function du(e){return{ensureFreshSession:e.ensureFreshSession??mt,fetchUserInfo:e.fetchUserInfo??(t=>yo(t)),logger:e.logger??console}}o(du,"resolveDeps");function uu(e){return e.email??e.preferredUsername??e.name??e.sub}o(uu,"describeUser");var mu="(unknown cluster)";function fu(e,t){if(e.length===0)return[" - Projects: (none)"];let n=new Map;for(let i of e){let s=i.cluster??mu,a=n.get(s);a?a.push(i):n.set(s,[i])}let r=[` - Projects (${e.length}):`];for(let[i,s]of n){r.push(` ${t.dim(i)}`);for(let a of s){let p=a.isDefault?` ${t.green("[default]")}`:"";r.push(` ${a.name}${p}`)}}return r}o(fu,"formatProjects");function gu(){switch(process.platform){case"darwin":return"macOS Keychain";case"win32":return"Windows Credential Manager";default:return"Secret Service (libsecret / KWallet)"}}o(gu,"keyringBackendLabel");async function yu(e){let{ensureFreshSession:t,fetchUserInfo:n,logger:r}=e,i;try{i=await t()}catch(s){if(s instanceof Te){r.error(" Session expired. Run `npx @cognite/cli auth login` to sign in again."),process.exitCode=1;return}throw s}if(!i){r.error("Not signed in. Run `npx @cognite/cli auth login` to start a session."),process.exitCode=1;return}r.log(i.org);try{let s=await n(i),a=re(process.stdout);r.log(` ${a.green("\u2713")} Signed in as ${uu(s)}`);for(let p of fu(s.projects,a))r.log(p);r.log(` - Token storage: ${gu()}`)}catch(s){if(s instanceof Ee&&s.kind==="unreachable")r.error(` \u2717 Couldn't reach Cognite (${lu}): ${s.message}`),r.error(" Check your network connection, or run `npx @cognite/cli auth login` to sign in again.");else{let a=s instanceof Error?s.message:String(s);r.error(` \u2717 ${a}`),r.error(" Run `npx @cognite/cli auth login` to sign in again.")}process.exitCode=1}}o(yu,"handleStatus");function hu(e){return e.commands.find(t=>t.name()==="auth")??e.command("auth").description("Manage your persisted CDF login session")}o(hu,"getOrCreateAuthGroup");function Mi(e,t={}){let n=du(t);hu(e).command("status").alias("whoami").description("Show the active session, verified against the identity provider").action(()=>yu(n))}o(Mi,"registerAuthStatusCommand");import{existsSync as Au,mkdirSync as Cu,writeFileSync as Eu}from"fs";import{dirname as Bn,join as _e}from"path";import{generateSigningKeyPair as bu}from"@cognite/app-sdk/codesigning";import ku from"open";function Ui(e,t){let n=e.getUTCFullYear(),r=e.getUTCMonth()+t,i=new Date(Date.UTC(n,r+1,0)).getUTCDate(),s=Math.min(e.getUTCDate(),i);return new Date(Date.UTC(n,r,s))}o(Ui,"addMonthsClamped");function jn(e){return e.toISOString().slice(0,10)}o(jn,"formatIsoDate");function _i(e=new Date){return jn(e)}o(_i,"todayIso");var Dt=Uint8Array.from([48,42,48,5,6,3,43,101,112,3,33,0]),Li=32,Ni=44,Hi=60,Su="services/app-hosting/src/kotlin/com/cognite/apphosting/signing/public_keys.yaml";function wu(e){let t=e.replace(/-----BEGIN [^-]+-----/g,"").replace(/-----END [^-]+-----/g,"").replace(/\s+/g,"");if(t.length!==Ni&&t.length!==Hi)throw new Error(`Unexpected Ed25519 public key base64 length: got ${t.length} chars, expected ${Ni} (raw) or ${Hi} (X.509-wrapped)`);let n=Buffer.from(t,"base64");if(n.length===Dt.length+Li&&n.subarray(0,Dt.length).equals(Dt))return n.subarray(Dt.length).toString("base64");if(n.length===Li)return n.toString("base64");throw new Error(`Unexpected Ed25519 public key length: got ${n.length} bytes, expected 32 (raw) or 44 (X.509-wrapped)`)}o(wu,"pemBodyOneLine");function Kn(e,t=Oe,n=new Date){let r=ji(e.issuedAt??_i(n)),i=ji(e.expires),s=wu(e.publicKeyPem),a=" ",p=o((l,d)=>`${a}${t.cyan(l)}${t.dim(":")} ${d}
183
183
  `,"kv"),c="";return c+=`
184
- ${t.bold("Add this entry to")} ${t.magenta(yu)} ${t.bold("under")} ${t.cyan("publicKeys:")}
184
+ ${t.bold("Add this entry to")} ${t.magenta(Su)} ${t.bold("under")} ${t.cyan("publicKeys:")}
185
185
 
186
186
  `,c+=` ${t.dim("-")} ${t.cyan("kid")}${t.dim(":")} ${t.green(e.kid)}
187
- `,c+=p("publicKey",t.green(s)),c+=p("email",t.yellow(e.email)),c+=p("roles",`${t.dim("[")}${t.yellow("developer")}${t.dim("]")}`),c+=p("issuedAt",t.green(r)),c+=p("expiresAt",t.green(i)),c+=p("revokedAt",t.dim("null")),c}o(jn,"renderRegistryYamlBlock");function Hi(e){let t=e.trim();if(/^\d{4}-\d{2}-\d{2}$/.test(t))return`${t}T00:00:00Z`;let n=new Date(t);if(Number.isNaN(n.getTime()))throw new Error(`Invalid date '${e}': expected YYYY-MM-DD or ISO-8601 instant`);return n.toISOString()}o(Hi,"toIsoInstant");import Su from"clipboardy";function ji(e){return Su.write(e)}o(ji,"copyToClipboard");function Ki(e,t){return e.map((n,r)=>Math.max(n.length,...t.map(i=>i[r].length)))}o(Ki,"computeColumnWidths");function Bi(e,t,n=e){return e.map((r,i)=>n[i]+" ".repeat(Math.max(0,t[i]-r.length))).join(" ").trimEnd()}o(Bi,"formatTableRow");function bu(e){return{writeFileSync:e.writeFileSync??Cu,mkdirSync:e.mkdirSync??vu,existsSync:e.existsSync??wu,generateSigningKeyPair:e.generateSigningKeyPair??Au,encryptStringAsJwe:e.encryptStringAsJwe??gi,storeKeyInKeychain:e.storeKeyInKeychain??Pr,storeSigningKey:e.storeSigningKey??Fr,isOS:e.isOS??(t=>L(t)),promptKid:e.promptKid??yr,promptExpiryMonths:e.promptExpiryMonths??Sr,promptEmail:e.promptEmail??wr,promptPassphrase:e.promptPassphrase??vr,promptConfirmOverwrite:e.promptConfirmOverwrite??Cr,discoverLocalKeys:e.discoverLocalKeys??(()=>Xe()),promptZendeskAction:e.promptZendeskAction??hr,openUrl:e.openUrl??(t=>Eu(t)),copyToClipboard:e.copyToClipboard??ji}}o(bu,"resolveDeps");function Gi(e,t={}){let n=bu(t),r=e.command("keys").description("Manage code signing keys");r.command("generate").description("Generate an Ed25519 keypair for code signing").option("-o, --output <path>","Encrypted private key output path (forces file storage even on macOS)").option("--no-keychain",`Skip the OS credential store (macOS Keychain / Windows Credential Manager) and write a passphrase-encrypted private key under ${P().keysDir} instead`).option("-e, --expires <months>",`Validity in months (${1}-${12}); skips the interactive prompt`).option("--email <address>","Email address for the registry entry; skips the interactive prompt").option("--kid <identifier>","Signing identity name for the registry (e.g. jsmith-dev-001); skips the interactive prompt").option("--force","Overwrite an existing key without prompting for confirmation").option("--copy-link","Copy the Zendesk registration link to the clipboard without prompting").option("--interactive","Prompt for any required flags that are not supplied",!1).action(i=>Du(i,n)),r.command("list").description("List local signing identities and their storage location").action(()=>ku(n))}o(Gi,"registerKeysCommand");async function ku(e){let t=await e.discoverLocalKeys();if(t.length===0){process.stdout.write(`No signing identities found.
187
+ `,c+=p("publicKey",t.green(s)),c+=p("email",t.yellow(e.email)),c+=p("roles",`${t.dim("[")}${t.yellow("developer")}${t.dim("]")}`),c+=p("issuedAt",t.green(r)),c+=p("expiresAt",t.green(i)),c+=p("revokedAt",t.dim("null")),c}o(Kn,"renderRegistryYamlBlock");function ji(e){let t=e.trim();if(/^\d{4}-\d{2}-\d{2}$/.test(t))return`${t}T00:00:00Z`;let n=new Date(t);if(Number.isNaN(n.getTime()))throw new Error(`Invalid date '${e}': expected YYYY-MM-DD or ISO-8601 instant`);return n.toISOString()}o(ji,"toIsoInstant");import vu from"clipboardy";function Ki(e){return vu.write(e)}o(Ki,"copyToClipboard");function Bi(e,t){return e.map((n,r)=>Math.max(n.length,...t.map(i=>i[r].length)))}o(Bi,"computeColumnWidths");function Vi(e,t,n=e){return e.map((r,i)=>n[i]+" ".repeat(Math.max(0,t[i]-r.length))).join(" ").trimEnd()}o(Vi,"formatTableRow");function xu(e){return{writeFileSync:e.writeFileSync??Eu,mkdirSync:e.mkdirSync??Cu,existsSync:e.existsSync??Au,generateSigningKeyPair:e.generateSigningKeyPair??bu,encryptStringAsJwe:e.encryptStringAsJwe??yi,storeKeyInKeychain:e.storeKeyInKeychain??Dr,storeSigningKey:e.storeSigningKey??$r,isOS:e.isOS??(t=>L(t)),promptKid:e.promptKid??hr,promptExpiryMonths:e.promptExpiryMonths??wr,promptEmail:e.promptEmail??vr,promptPassphrase:e.promptPassphrase??Ar,promptConfirmOverwrite:e.promptConfirmOverwrite??Cr,discoverLocalKeys:e.discoverLocalKeys??(()=>Xe()),promptZendeskAction:e.promptZendeskAction??Sr,openUrl:e.openUrl??(t=>ku(t)),copyToClipboard:e.copyToClipboard??Ki}}o(xu,"resolveDeps");function Yi(e,t={}){let n=xu(t),r=e.command("keys").description("Manage code signing keys");r.command("generate").description("Generate an Ed25519 keypair for code signing").option("-o, --output <path>","Encrypted private key output path (forces file storage even on macOS)").option("--no-keychain",`Skip the OS credential store (macOS Keychain / Windows Credential Manager) and write a passphrase-encrypted private key under ${P().keysDir} instead`).option("-e, --expires <months>",`Validity in months (${1}-${12}); skips the interactive prompt`).option("--email <address>","Email address for the registry entry; skips the interactive prompt").option("--kid <identifier>","Signing identity name for the registry (e.g. jsmith-dev-001); skips the interactive prompt").option("--force","Overwrite an existing key without prompting for confirmation").option("--copy-link","Copy the Zendesk registration link to the clipboard without prompting").option("--interactive","Prompt for any required flags that are not supplied",!1).action(i=>Tu(i,n)),r.command("list").description("List local signing identities and their storage location").action(()=>Pu(n))}o(Yi,"registerKeysCommand");async function Pu(e){let t=await e.discoverLocalKeys();if(t.length===0){process.stdout.write(`No signing identities found.
188
188
  `),process.stdout.write(`Run \`cognite keys generate\` to create one (storage: ${P().keysDir}).
189
- `);return}let n=["KID","SOURCE","EMAIL"],r=t.map(a=>[a.kid,Je(a.source),a.email??"\u2014"]),i=Ki(n,r),s=o(a=>Bi(a,i),"fmt");process.stdout.write(`${s(n)}
189
+ `);return}let n=["KID","SOURCE","EMAIL"],r=t.map(a=>[a.kid,Je(a.source),a.email??"\u2014"]),i=Bi(n,r),s=o(a=>Vi(a,i),"fmt");process.stdout.write(`${s(n)}
190
190
  `);for(let a of r)process.stdout.write(`${s(a)}
191
- `)}o(ku,"handleList");function Vi(e,t,n){let r=_e(P().keysDir,`${e}${ee}`);return n.mkdirSync(Kn(r),{recursive:!0}),n.writeFileSync(r,t),r}o(Vi,"writePublicKey");async function xu(e,t,n,r,i,{force:s=!1}={}){let a=r??_e(P().keysDir,`${e}${Kt}`);if(i.mkdirSync(Kn(a),{recursive:!0}),!s&&i.existsSync(a))throw new Error(`Refusing to overwrite existing key at ${a}. Delete it first if you really want to regenerate: rm ${a}`);let p=await i.encryptStringAsJwe(t,n);return i.writeFileSync(a,p,{mode:384}),a}o(xu,"writeEncryptedPrivateKey");function Pu(e,t,n){let r=[];if(e.expires===void 0)r.push("--expires <months> is required. Pass --interactive to enter it interactively.");else try{we(e.expires)}catch(i){r.push(i instanceof Error?i.message:String(i))}if(e.kid===void 0)r.push("--kid <identifier> is required. Pass --interactive to enter it interactively.");else try{let i=de(e.kid),s=_e(P().keysDir,`${i}${ee}`);n(s)&&!e.force&&r.push(`Key "${i}" already exists. Use --force to overwrite without prompting.`)}catch(i){r.push(i instanceof Error?i.message:String(i))}if(e.email===void 0)r.push("--email <address> is required. Pass --interactive to enter it interactively.");else try{Se(e.email,"--email")}catch(i){r.push(i instanceof Error?i.message:String(i))}return t||r.push("A passphrase is required for encrypted key storage. Pass --interactive to enter it interactively."),r}o(Pu,"collectNonInteractiveErrors");async function Du(e,t,n=new Date){let{isOS:r,existsSync:i,mkdirSync:s,writeFileSync:a,generateSigningKeyPair:p,storeKeyInKeychain:c,storeSigningKey:l,promptExpiryMonths:d,promptKid:u,promptEmail:y,promptPassphrase:g,promptConfirmOverwrite:f}=t,h=e.interactive??!1,S=e.keychain!==!1&&!e.output&&(r("macos")||r("windows"));if(!h){let Y=Pu(e,S,i);if(Y.length>0)throw new Error(Y.join(`
192
- `))}let A;e.expires!==void 0?A=we(e.expires):A=await d();let v=Hn(Mi(n,A)),w;e.kid!==void 0?w=de(e.kid):w=await u();let D=_e(P().keysDir,`${w}${ee}`),U=i(D);if(U&&!e.force&&!await f(w)){process.stderr.write(`Aborted.
191
+ `)}o(Pu,"handleList");function Gi(e,t,n){let r=_e(P().keysDir,`${e}${ee}`);return n.mkdirSync(Bn(r),{recursive:!0}),n.writeFileSync(r,t),r}o(Gi,"writePublicKey");async function Du(e,t,n,r,i,{force:s=!1}={}){let a=r??_e(P().keysDir,`${e}${jt}`);if(i.mkdirSync(Bn(a),{recursive:!0}),!s&&i.existsSync(a))throw new Error(`Refusing to overwrite existing key at ${a}. Delete it first if you really want to regenerate: rm ${a}`);let p=await i.encryptStringAsJwe(t,n);return i.writeFileSync(a,p,{mode:384}),a}o(Du,"writeEncryptedPrivateKey");function Iu(e,t,n){let r=[];if(e.expires===void 0)r.push("--expires <months> is required. Pass --interactive to enter it interactively.");else try{we(e.expires)}catch(i){r.push(i instanceof Error?i.message:String(i))}if(e.kid===void 0)r.push("--kid <identifier> is required. Pass --interactive to enter it interactively.");else try{let i=de(e.kid),s=_e(P().keysDir,`${i}${ee}`);n(s)&&!e.force&&r.push(`Key "${i}" already exists. Use --force to overwrite without prompting.`)}catch(i){r.push(i instanceof Error?i.message:String(i))}if(e.email===void 0)r.push("--email <address> is required. Pass --interactive to enter it interactively.");else try{Se(e.email,"--email")}catch(i){r.push(i instanceof Error?i.message:String(i))}return t||r.push("A passphrase is required for encrypted key storage. Pass --interactive to enter it interactively."),r}o(Iu,"collectNonInteractiveErrors");async function Tu(e,t,n=new Date){let{isOS:r,existsSync:i,mkdirSync:s,writeFileSync:a,generateSigningKeyPair:p,storeKeyInKeychain:c,storeSigningKey:l,promptExpiryMonths:d,promptKid:u,promptEmail:y,promptPassphrase:g,promptConfirmOverwrite:f}=t,h=e.interactive??!1,S=e.keychain!==!1&&!e.output&&(r("macos")||r("windows"));if(!h){let Y=Iu(e,S,i);if(Y.length>0)throw new Error(Y.join(`
192
+ `))}let C;e.expires!==void 0?C=we(e.expires):C=await d();let v=jn(Ui(n,C)),w;e.kid!==void 0?w=de(e.kid):w=await u();let D=_e(P().keysDir,`${w}${ee}`),U=i(D);if(U&&!e.force&&!await f(w)){process.stderr.write(`Aborted.
193
193
  `);return}let x;e.email!==void 0?x=Se(e.email,"--email"):x=await y();let k=S?{kind:"keychain"}:{kind:"file",passphrase:await g()};process.stderr.write(`
194
194
  Generating Ed25519 keypair...
195
195
 
196
- `);let{privateKeyPem:J,publicKeyPem:ie}=await p(w),_=C.from(J);if(k.kind==="keychain"){r("macos")?await c(w,_):await l(w,_);let Y=Vi(w,ie,t);process.stderr.write(`Public key: ${Y}
196
+ `);let{privateKeyPem:J,publicKeyPem:ie}=await p(w),_=A.from(J);if(k.kind==="keychain"){r("macos")?await c(w,_):await l(w,_);let Y=Gi(w,ie,t);process.stderr.write(`Public key: ${Y}
197
197
  `),process.stderr.write(`Private key: OS credential store (account: ${w})
198
- `)}else{let Y=await xu(w,_,k.passphrase,e.output,t,{force:U}),us=Vi(w,ie,t);process.stderr.write(`Public key: ${us}
199
- `),process.stderr.write(`Private key: ${Y} (JWE, AES-256-GCM, PBKDF2-SHA512 x${On.toLocaleString()})
200
- `)}let se=_e(P().keysDir,`${w}${Bt}`);s(Kn(se),{recursive:!0}),a(se,JSON.stringify({email:x}));let he=re(process.stderr);process.stderr.write(`
198
+ `)}else{let Y=await Du(w,_,k.passphrase,e.output,t,{force:U}),ms=Gi(w,ie,t);process.stderr.write(`Public key: ${ms}
199
+ `),process.stderr.write(`Private key: ${Y} (JWE, AES-256-GCM, PBKDF2-SHA512 x${Mn.toLocaleString()})
200
+ `)}let se=_e(P().keysDir,`${w}${Kt}`);s(Bn(se),{recursive:!0}),a(se,JSON.stringify({email:x}));let he=re(process.stderr);process.stderr.write(`
201
201
  Signing identity (kid): ${he.green(w)}
202
- `),process.stderr.write(`Expires: ${v} (${A} month${A===1?"":"s"} from today)
202
+ `),process.stderr.write(`Expires: ${v} (${C} month${C===1?"":"s"} from today)
203
203
  `);let Ne={kid:w,publicKeyPem:ie,email:x,expires:v};h||(process.stderr.write(`
204
204
  Key registration data:
205
205
 
206
- `),process.stderr.write(jn(Ne,he,n)));let ae=Ii(w,x,v,jn(Ne,Oe,n));process.stderr.write(`
206
+ `),process.stderr.write(Kn(Ne,he,n)));let ae=Ti(w,x,v,Kn(Ne,Oe,n));process.stderr.write(`
207
207
  ${he.bold("Next:")}
208
208
  `),process.stderr.write(` 1. Register your signing key \u2014 submit this pre-filled Zendesk request:
209
- `);let ke;if(e.copyLink?ke="clipboard":h?ke=await t.promptZendeskAction():ke=null,ke==="browser")try{await t.openUrl(ae),process.stderr.write(` Opening in browser...
209
+ `);let xe;if(e.copyLink?xe="clipboard":h?xe=await t.promptZendeskAction():xe=null,xe==="browser")try{await t.openUrl(ae),process.stderr.write(` Opening in browser...
210
210
  `)}catch{process.stderr.write(` URL: ${ae}
211
- `)}else if(ke==="clipboard"){let Y=!1;try{await t.copyToClipboard(ae),Y=!0}catch{}process.stderr.write(Y&&!e.copyLink?` Link copied to clipboard.
211
+ `)}else if(xe==="clipboard"){let Y=!1;try{await t.copyToClipboard(ae),Y=!0}catch{}process.stderr.write(Y&&!e.copyLink?` Link copied to clipboard.
212
212
  `:` URL: ${ae}
213
213
  `)}else process.stderr.write(` URL: ${ae}
214
214
  `);process.stderr.write(`
215
215
  2. Once your key is approved, sign your Dune app:
216
216
  `),process.stderr.write(` ${he.cyan(`cognite sign -s ${w}`)}
217
- `)}o(Du,"handleGenerate");function Yi(e,t={}){let{isSessionAuthEnabled:n=E}=t;return Ri(e),n()&&(Fi(e),$i(e),Oi(e)),Gi(e),e}o(Yi,"registerCommands");import{performance as qi}from"perf_hooks";var zi=1e3,Tt;function Iu(){Tt=qi.now()}o(Iu,"markActionStart");function Tu(){Tt=void 0}o(Tu,"resetActionStart");function Ru(){if(Tt!==void 0)return Math.max(0,Math.round(qi.now()-Tt))}o(Ru,"snapshotActionDurationMs");function Wi(){let e=Ru();return Tu(),{...e!==void 0&&{actionDurationMs:e}}}o(Wi,"takePerformanceFields");var Fu=new Set(["baseUrl","url","project","deployment","source","path","name","displayName","description","externalId"]);function $u(e){return Object.fromEntries(Object.entries(e).map(([t,n])=>typeof n=="boolean"?[t,n]:Fu.has(t)?[t,n]:[t,"[REDACTED]"]))}o($u,"sanitizeOptions");function Ou(e){let t=[],n=e;for(;n;)n.parent&&t.unshift(n.name()),n=n.parent;return t.join(" ")}o(Ou,"getCommandPath");function Ji(e){try{let t=e(process.cwd()),n=t.deployments[0];return{appName:t.name,appExternalId:t.externalId,appVersionTag:t.versionTag,...n&&{cogniteOrg:n.org,cogniteProject:n.project}}}catch{return{}}}o(Ji,"tryLoadAppConfig");function Bn(e){return e.filter(t=>!t.startsWith("-")).join(" ")||"unknown"}o(Bn,"commandFromArgv");function Xi(e,t,n=b){e.hook("preAction",()=>{Iu()}),e.hook("postAction",async(r,i)=>{try{let s={command:Ou(i),options:$u(i.opts()),success:!0,...Ji(n),...Wi()};t.track("Flows.CLI.Command",{...s}),await t.flush(zi)}catch{}})}o(Xi,"instrument");async function Zi(e,t,n=b){try{let r={command:Bn(t),options:{},success:!1,...Ji(n),...Wi()};e.track("Flows.CLI.Command",{...r}),await e.flush(zi)}catch{}}o(Zi,"trackFailure");var Mu="ERR_USE_AFTER_CLOSE";function es(e){return e instanceof Error&&"code"in e&&e.code===Mu}o(es,"isReadlineClosedError");function Uu(e){let t=Object.getPrototypeOf(e);return t===Object.prototype||t===null}o(Uu,"isPlainObject");function Vn(e){return e==null||es(e)?!0:e instanceof Error?!1:!!(typeof e=="object"&&e!==null&&Uu(e)&&Object.keys(e).length===0)}o(Vn,"isPromptCancel");var Qi=!1;function ts(){Qi||(Qi=!0,process.on("uncaughtException",e=>{es(e)&&(console.error(`
218
- Cancelled.`),process.exit(130)),console.error(e),process.exit(1)}),process.on("unhandledRejection",e=>{Vn(e)&&(console.error(`
219
- Cancelled.`),process.exit(130)),console.error(e),process.exit(1)}))}o(ts,"installCancelHandler");import{homedir as _u,userInfo as Lu}from"os";var Nu=_u(),Hu=(()=>{try{return Lu().username}catch{return""}})();function be(e,t=Nu){if(!t||t==="/")return e;let n=e.replaceAll(t,"~"),r=t.replaceAll("\\","/");return r!==t&&(n=n.replaceAll(r,"~")),n=n.replace(/(?<![A-Za-z0-9_])[A-Za-z]:[/\\]Users[/\\][^\s/\\]+(?=[/\\]|$)/g,"~"),n=n.replace(/(?<![A-Za-z0-9_])\/(?:Users|home)\/[^\s/]+(?=[/\\]|$)/g,"~"),n}o(be,"redactHomedir");function ju(e,t=Hu){if(!t||t.length<3)return e;let n=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),r=new RegExp("(^|[\\/\\s:])"+n+"(?=[\\/\\s:.@]|$)","g");return e.replace(r,"$1<user>")}o(ju,"redactUsername");var Ku=/(['"]?(?:access_token|accessToken|client_secret|clientSecret|refresh_token|refreshToken|password|token|passphrase)['"]?\s*:\s*)(?:"(?:\\.|[^\\"])*"|'(?:\\.|[^\\'])*')/gi;function ns(e){return e.replace(Ku,(t,n)=>{let r=t[n.length];return`${n}${r}[REDACTED]${r}`})}o(ns,"redactCredentials");var Bu=1e3,Vu="https://0a118cb02e3be57b1838bcfb5783a2bf@o4508040730968064.ingest.de.sentry.io/4510719268290640",Gu={captureError:o(async()=>{},"captureError"),flush:o(async()=>{},"flush")};function Yu(e){return e.packageName&&e.cliVersion?`${e.packageName}@${e.cliVersion}`:e.cliVersion??"unknown"}o(Yu,"buildRelease");var qu="192.0.2.0";function zu(e){return e?.map(t=>({...t,...t.filename!==void 0&&{filename:be(t.filename)},...t.abs_path!==void 0&&{abs_path:be(t.abs_path)},...t.module!==void 0&&{module:be(t.module)}}))}o(zu,"scrubStackFrames");function Rt(e){return ns(ju(be(e)))}o(Rt,"redactPii");function Wu(e){let t={...e.user,email:void 0,username:void 0,ip_address:qu,id:void 0},n=e.exception?.values?.map(s=>({...s,value:s.value!==void 0?Rt(s.value):s.value,...s.stacktrace!==void 0&&{stacktrace:{...s.stacktrace,frames:zu(s.stacktrace.frames)}}})),r=e.contexts?.cli,i=r!==void 0?Object.fromEntries(Object.entries(r).map(([s,a])=>[s,typeof a=="string"?Rt(a):a])):void 0;return{...e,message:e.message!==void 0?Rt(e.message):e.message,...typeof e.culprit=="string"&&{culprit:Rt(e.culprit)},user:t,server_name:void 0,...n!==void 0&&{exception:{...e.exception,values:n}},...i!==void 0&&{contexts:{...e.contexts,cli:i}}}}o(Wu,"scrubPii");function rs(e={}){let t=e.env??process.env;if(tn(t))return Gu;let n=Yu(e),r="production",i=null,s=null;function a(){return{dsn:Vu,release:n,environment:r,defaultIntegrations:!1,integrations:[],sendDefaultPii:!1,enableLogs:!1,initialScope:{tags:{component:"cli",applicationId:xe},contexts:{cli:{applicationId:xe,node:process.version,platform:process.platform}}},beforeSend:Wu}}o(a,"buildInitOptions");async function p(){return i||(s||(s=(async()=>{try{let c=e.sdk??await import("@sentry/node");return c.init(a()),i=c,c}catch{return null}})()),s)}return o(p,"ensureSdk"),{async captureError(c,l){try{let d=await p();if(!d)return;d.captureException(c,Ju(c,l))}catch{}},async flush(c=Bu){try{if(!i)return;await i.flush(c)}catch{}}}}o(rs,"createErrorReporter");function Ju(e,t){let n={level:"fatal"},r={applicationId:xe,node:process.version,platform:process.platform};if(t?.command&&(n.tags={command:t.command},r.command=t.command),Qn(e)&&(e.hint&&(r.hint=e.hint),e.helpUrl&&(r.helpUrl=e.helpUrl),r.shouldReport=e.shouldReport),n.contexts={cli:r},er(e)&&(n.contexts.http={url:e.requestUrl!==void 0?be(e.requestUrl):void 0,status_code:e.httpStatusCode},e.responseBody!==void 0)){let i=typeof e.responseBody=="string"?e.responseBody:JSON.stringify(e.responseBody);n.extra={responseBody:ns(be(i))}}return n}o(Ju,"buildCaptureContext");import{mkdirSync as Xu,readFileSync as Zu,writeFileSync as Qu}from"fs";import{homedir as em}from"os";import{resolve as Ft}from"path";import{debuglog as tm}from"util";import{lt as nm,parse as os}from"semver";var rm="https://registry.npmjs.org/@cognite/cli/latest",om=1500,is="upgrade-check.json",ss=Ft(process.env.XDG_CACHE_HOME||Ft(em(),".cache"),"@cognite","cli"),Gn=tm("cognite-flows");function im(e,t){return!e||!t||!os(e)||!os(t)?!1:nm(e,t)}o(im,"isOutdated");async function sm({timeout:e=om,registryUrl:t=rm,fetchImpl:n=globalThis.fetch}={}){if(typeof n!="function")return null;try{let r=await n(t,{signal:AbortSignal.timeout(e)});if(!r?.ok)return null;let i=await r.json();return typeof i?.version=="string"?i.version:null}catch(r){return Gn("fetchLatestVersion failed (%s): %O",t,r),null}}o(sm,"fetchLatestVersion");function am(e=ss,t=864e5){try{let n=Zu(Ft(e,is),"utf-8"),r=JSON.parse(n);return typeof r.latest!="string"||typeof r.fetchedAt!="number"||Date.now()-r.fetchedAt>t?null:{latest:r.latest,fetchedAt:r.fetchedAt}}catch(n){return Gn("readUpgradeCheckCache failed (%s): %O",e,n),null}}o(am,"readUpgradeCheckCache");function pm(e,t){try{Xu(e,{recursive:!0});let n={latest:t,fetchedAt:Date.now()};Qu(Ft(e,is),JSON.stringify(n))}catch(n){Gn("writeUpgradeCheckCache failed (%s): %O",e,n)}}o(pm,"writeUpgradeCheckCache");async function cm({cacheDir:e=ss,...t}={}){let n=await sm(t);n&&pm(e,n)}o(cm,"startBackgroundUpgradeCheck");function as(e,{onOutdated:t,cacheDir:n,...r}={}){let i=am(n);if(i){im(e,i.latest)&&t?.(e,i.latest);return}cm({cacheDir:n,...r})}o(as,"preActionUpgradeCheck");import{default as Pb,chalkStderr as ps}from"chalk";function cs(e,t){let n=[`\u26A0 Update available: ${e} -> ${t}`," Run npx @cognite/cli@latest"],r=Math.max(...n.map(p=>[...p].length))+2,i="\u2500".repeat(r),s=o(p=>`\u2502 ${p}${" ".repeat(r-1-[...p].length)}\u2502`,"pad"),a=[`\u250C${i}\u2510`,...n.map(s),`\u2514${i}\u2518`].join(`
220
- `);return ps.bold.yellow(a)}o(cs,"formatUpgradeWarning");function um(e){return e instanceof Error&&"code"in e&&typeof e.code=="string"&&e.code==="DEP0040"}o(um,"isDep0040Warning");var qn=process,mm=qn.emit.bind(qn);qn.emit=function(e,...t){return e==="warning"&&um(t[0])?!1:mm(e,...t)};ts();var Le=new dm;Le.name("cognite").description("Build and deploy React apps to Cognite Data Fusion").version("1.8.0-alpha.263").showHelpAfterError().configureOutput({writeOut:o(e=>lm(1,e),"writeOut")});Le.hook("preAction",()=>{as("1.8.0-alpha.263",{onOutdated:o((e,t)=>{console.warn(`
221
- ${cs(e,t)}
222
- `)},"onOutdated")})});Yi(Le);var ds=rt({packageName:"@cognite/cli",cliVersion:"1.8.0-alpha.263"}),ls=rs({packageName:"@cognite/cli",cliVersion:"1.8.0-alpha.263"});Xi(Le,ds);var Yn=process.argv.slice(2);Le.parseAsync(Yn,{from:"user"}).catch(async e=>{await Zi(ds,Yn),Vn(e)&&(console.error(`
223
- Cancelled.`),process.exit(130)),(!(e instanceof m)||e.shouldReport)&&(await ls.captureError(e,{command:Bn(Yn)}),await ls.flush());let t=e instanceof Error?e.message:String(e);console.error(`\u274C ${t}`),e instanceof m&&(e.hint||e.helpUrl)&&(console.error(""),e.hint&&console.error(`\u{1F4A1} ${e.hint}`),e.helpUrl&&console.error(`\u{1F4DA} ${e.helpUrl}`)),process.exit(1)});
217
+ `)}o(Tu,"handleGenerate");function qi(e,t={}){let{isSessionAuthEnabled:n=E}=t;return Fi(e),n()&&($i(e),Oi(e),Mi(e)),Yi(e),e}o(qi,"registerCommands");import{performance as zi}from"perf_hooks";var Wi=1e3,It;function Ru(){It=zi.now()}o(Ru,"markActionStart");function Fu(){It=void 0}o(Fu,"resetActionStart");function $u(){if(It!==void 0)return Math.max(0,Math.round(zi.now()-It))}o($u,"snapshotActionDurationMs");function Ji(){let e=$u();return Fu(),{...e!==void 0&&{actionDurationMs:e}}}o(Ji,"takePerformanceFields");var Ou=new Set(["baseUrl","url","project","deployment","source","path","name","displayName","description","externalId"]);function Mu(e){return Object.fromEntries(Object.entries(e).map(([t,n])=>typeof n=="boolean"?[t,n]:Ou.has(t)?[t,n]:[t,"[REDACTED]"]))}o(Mu,"sanitizeOptions");function Uu(e){let t=[],n=e;for(;n;)n.parent&&t.unshift(n.name()),n=n.parent;return t.join(" ")}o(Uu,"getCommandPath");function Xi(e){try{let t=e(process.cwd()),n=t.deployments[0];return{appName:t.name,appExternalId:t.externalId,appVersionTag:t.versionTag,...n&&{cogniteOrg:n.org,cogniteProject:n.project}}}catch{return{}}}o(Xi,"tryLoadAppConfig");function Vn(e){return e.filter(t=>!t.startsWith("-")).join(" ")||"unknown"}o(Vn,"commandFromArgv");function Zi(e,t,n=b){e.hook("preAction",()=>{Ru()}),e.hook("postAction",async(r,i)=>{try{let s={command:Uu(i),options:Mu(i.opts()),success:!0,...Xi(n),...Ji()};t.track("Flows.CLI.Command",{...s}),await t.flush(Wi)}catch{}})}o(Zi,"instrument");async function Qi(e,t,n=b){try{let r={command:Vn(t),options:{},success:!1,...Xi(n),...Ji()};e.track("Flows.CLI.Command",{...r}),await e.flush(Wi)}catch{}}o(Qi,"trackFailure");var _u="ERR_USE_AFTER_CLOSE";function ts(e){return e instanceof Error&&"code"in e&&e.code===_u}o(ts,"isReadlineClosedError");function Lu(e){let t=Object.getPrototypeOf(e);return t===Object.prototype||t===null}o(Lu,"isPlainObject");function Gn(e){return e==null||ts(e)?!0:e instanceof Error?!1:!!(typeof e=="object"&&e!==null&&Lu(e)&&Object.keys(e).length===0)}o(Gn,"isPromptCancel");var es=!1;function ns(){es||(es=!0,process.on("uncaughtException",e=>{ts(e)&&(console.error(`
218
+ Cancelled.`),process.exit(130)),console.error(e),process.exit(1)}),process.on("unhandledRejection",e=>{Gn(e)&&(console.error(`
219
+ Cancelled.`),process.exit(130)),console.error(e),process.exit(1)}))}o(ns,"installCancelHandler");import{homedir as Nu,userInfo as Hu}from"os";var ju=Nu(),Ku=(()=>{try{return Hu().username}catch{return""}})();function ke(e,t=ju){if(!t||t==="/")return e;let n=e.replaceAll(t,"~"),r=t.replaceAll("\\","/");return r!==t&&(n=n.replaceAll(r,"~")),n=n.replace(/(?<![A-Za-z0-9_])[A-Za-z]:[/\\]Users[/\\][^\s/\\]+(?=[/\\]|$)/g,"~"),n=n.replace(/(?<![A-Za-z0-9_])\/(?:Users|home)\/[^\s/]+(?=[/\\]|$)/g,"~"),n}o(ke,"redactHomedir");function Bu(e,t=Ku){if(!t||t.length<3)return e;let n=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),r=new RegExp("(^|[\\/\\s:])"+n+"(?=[\\/\\s:.@]|$)","g");return e.replace(r,"$1<user>")}o(Bu,"redactUsername");var Vu=/(['"]?(?:access_token|accessToken|client_secret|clientSecret|refresh_token|refreshToken|password|token|passphrase)['"]?\s*:\s*)(?:"(?:\\.|[^\\"])*"|'(?:\\.|[^\\'])*')/gi;function rs(e){return e.replace(Vu,(t,n)=>{let r=t[n.length];return`${n}${r}[REDACTED]${r}`})}o(rs,"redactCredentials");var Gu=1e3,Yu="https://0a118cb02e3be57b1838bcfb5783a2bf@o4508040730968064.ingest.de.sentry.io/4510719268290640",qu={captureError:o(async()=>{},"captureError"),flush:o(async()=>{},"flush")};function zu(e){return e.packageName&&e.cliVersion?`${e.packageName}@${e.cliVersion}`:e.cliVersion??"unknown"}o(zu,"buildRelease");var Wu="192.0.2.0";function Ju(e){return e?.map(t=>({...t,...t.filename!==void 0&&{filename:ke(t.filename)},...t.abs_path!==void 0&&{abs_path:ke(t.abs_path)},...t.module!==void 0&&{module:ke(t.module)}}))}o(Ju,"scrubStackFrames");function Tt(e){return rs(Bu(ke(e)))}o(Tt,"redactPii");function Xu(e){let t={...e.user,email:void 0,username:void 0,ip_address:Wu,id:void 0},n=e.exception?.values?.map(s=>({...s,value:s.value!==void 0?Tt(s.value):s.value,...s.stacktrace!==void 0&&{stacktrace:{...s.stacktrace,frames:Ju(s.stacktrace.frames)}}})),r=e.contexts?.cli,i=r!==void 0?Object.fromEntries(Object.entries(r).map(([s,a])=>[s,typeof a=="string"?Tt(a):a])):void 0;return{...e,message:e.message!==void 0?Tt(e.message):e.message,...typeof e.culprit=="string"&&{culprit:Tt(e.culprit)},user:t,server_name:void 0,...n!==void 0&&{exception:{...e.exception,values:n}},...i!==void 0&&{contexts:{...e.contexts,cli:i}}}}o(Xu,"scrubPii");function os(e={}){let t=e.env??process.env;if(en(t))return qu;let n=zu(e),r="production",i=null,s=null;function a(){return{dsn:Yu,release:n,environment:r,defaultIntegrations:!1,integrations:[],sendDefaultPii:!1,enableLogs:!1,initialScope:{tags:{component:"cli",applicationId:Pe},contexts:{cli:{applicationId:Pe,node:process.version,platform:process.platform}}},beforeSend:Xu}}o(a,"buildInitOptions");async function p(){return i||(s||(s=(async()=>{try{let c=e.sdk??await import("@sentry/node");return c.init(a()),i=c,c}catch{return null}})()),s)}return o(p,"ensureSdk"),{async captureError(c,l){try{let d=await p();if(!d)return;d.captureException(c,Zu(c,l))}catch{}},async flush(c=Gu){try{if(!i)return;await i.flush(c)}catch{}}}}o(os,"createErrorReporter");function Zu(e,t){let n={level:"fatal"},r={applicationId:Pe,node:process.version,platform:process.platform};if(t?.command&&(n.tags={command:t.command},r.command=t.command),er(e)&&(e.hint&&(r.hint=e.hint),e.helpUrl&&(r.helpUrl=e.helpUrl),r.shouldReport=e.shouldReport),n.contexts={cli:r},tr(e)&&(n.contexts.http={url:e.requestUrl!==void 0?ke(e.requestUrl):void 0,status_code:e.httpStatusCode},e.responseBody!==void 0)){let i=typeof e.responseBody=="string"?e.responseBody:JSON.stringify(e.responseBody);n.extra={responseBody:rs(ke(i))}}return n}o(Zu,"buildCaptureContext");import{mkdirSync as Qu,readFileSync as em,writeFileSync as tm}from"fs";import{homedir as nm}from"os";import{resolve as Rt}from"path";import{debuglog as rm}from"util";import{lt as om,parse as is}from"semver";var im="https://registry.npmjs.org/@cognite/cli/latest",sm=1500,ss="upgrade-check.json",as=Rt(process.env.XDG_CACHE_HOME||Rt(nm(),".cache"),"@cognite","cli"),Yn=rm("cognite-flows");function am(e,t){return!e||!t||!is(e)||!is(t)?!1:om(e,t)}o(am,"isOutdated");async function pm({timeout:e=sm,registryUrl:t=im,fetchImpl:n=globalThis.fetch}={}){if(typeof n!="function")return null;try{let r=await n(t,{signal:AbortSignal.timeout(e)});if(!r?.ok)return null;let i=await r.json();return typeof i?.version=="string"?i.version:null}catch(r){return Yn("fetchLatestVersion failed (%s): %O",t,r),null}}o(pm,"fetchLatestVersion");function cm(e=as,t=864e5){try{let n=em(Rt(e,ss),"utf-8"),r=JSON.parse(n);return typeof r.latest!="string"||typeof r.fetchedAt!="number"||Date.now()-r.fetchedAt>t?null:{latest:r.latest,fetchedAt:r.fetchedAt}}catch(n){return Yn("readUpgradeCheckCache failed (%s): %O",e,n),null}}o(cm,"readUpgradeCheckCache");function lm(e,t){try{Qu(e,{recursive:!0});let n={latest:t,fetchedAt:Date.now()};tm(Rt(e,ss),JSON.stringify(n))}catch(n){Yn("writeUpgradeCheckCache failed (%s): %O",e,n)}}o(lm,"writeUpgradeCheckCache");async function dm({cacheDir:e=as,...t}={}){let n=await pm(t);n&&lm(e,n)}o(dm,"startBackgroundUpgradeCheck");function ps(e,{onOutdated:t,cacheDir:n,...r}={}){let i=cm(n);if(i){am(e,i.latest)&&t?.(e,i.latest);return}dm({cacheDir:n,...r})}o(ps,"preActionUpgradeCheck");import{default as Fb,chalkStderr as cs}from"chalk";function ls(e,t){let n=[`\u26A0 Update available: ${e} -> ${t}`," Run npx @cognite/cli@latest"],r=Math.max(...n.map(p=>[...p].length))+2,i="\u2500".repeat(r),s=o(p=>`\u2502 ${p}${" ".repeat(r-1-[...p].length)}\u2502`,"pad"),a=[`\u250C${i}\u2510`,...n.map(s),`\u2514${i}\u2518`].join(`
220
+ `);return cs.bold.yellow(a)}o(ls,"formatUpgradeWarning");function fm(e){return e instanceof Error&&"code"in e&&typeof e.code=="string"&&e.code==="DEP0040"}o(fm,"isDep0040Warning");var zn=process,gm=zn.emit.bind(zn);zn.emit=function(e,...t){return e==="warning"&&fm(t[0])?!1:gm(e,...t)};ns();var Le=new mm;Le.name("cognite").description("Build and deploy React apps to Cognite Data Fusion").version("1.8.0-alpha.267").showHelpAfterError().configureOutput({writeOut:o(e=>um(1,e),"writeOut")});Le.hook("preAction",()=>{ps("1.8.0-alpha.267",{onOutdated:o((e,t)=>{console.warn(`
221
+ ${ls(e,t)}
222
+ `)},"onOutdated")})});qi(Le);var us=rt({packageName:"@cognite/cli",cliVersion:"1.8.0-alpha.267"}),ds=os({packageName:"@cognite/cli",cliVersion:"1.8.0-alpha.267"});Zi(Le,us);var qn=process.argv.slice(2);Le.parseAsync(qn,{from:"user"}).catch(async e=>{await Qi(us,qn),Gn(e)&&(console.error(`
223
+ Cancelled.`),process.exit(130)),(!(e instanceof m)||e.shouldReport)&&(await ds.captureError(e,{command:Vn(qn)}),await ds.flush());let t=e instanceof Error?e.message:String(e);console.error(`\u274C ${t}`),e instanceof m&&(e.hint||e.helpUrl)&&(console.error(""),e.hint&&console.error(`\u{1F4A1} ${e.hint}`),e.helpUrl&&console.error(`\u{1F4DA} ${e.helpUrl}`)),process.exit(1)});
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@cognite/cli",
3
- "version": "1.8.0-alpha.263",
3
+ "version": "1.8.0-alpha.267",
4
4
  "description": "CLI for Cognite Data Fusion",
5
5
  "license": "SEE LICENSE IN LICENSE.md",
6
6
  "author": "Cognite",