@cognite/cli 1.9.0-alpha.3 → 1.10.0-alpha.1

package/dist/cli/cli.js

@@ -1,13 +1,16 @@
 #!/usr/bin/env node
-var Dc=Object.defineProperty;var dr=e=>{throw TypeError(e)};var r=(e,t)=>Dc(e,"name",{value:t,configurable:!0});var ur=(e,t,n)=>t.has(e)||dr("Cannot "+n);var St=(e,t,n)=>(ur(e,t,"read from private field"),n?n.call(e):t.get(e)),mr=(e,t,n)=>t.has(e)?dr("Cannot add the same private member more than once"):t instanceof WeakSet?t.add(e):t.set(e,n),gr=(e,t,n,o)=>(ur(e,t,"write to private field"),o?o.call(e,n):t.set(e,n),n);import{writeSync as yh}from"fs";import{Command as hh}from"commander";var bn=class bn extends Error{constructor(t,n={}){super(t),this.name="HintedError",n.cause!==void 0&&(this.cause=n.cause);let o=this.deriveDefaults(n);this.hint=n.hint??o.hint,this.helpUrl=n.helpUrl??o.helpUrl,this.shouldReport=n.shouldReport??!0}deriveDefaults(t){return{hint:Oc(t.cause)}}};r(bn,"HintedError");var m=bn;function Ee(e){return e instanceof m}r(Ee,"isHintedError");var fr="https://docs.cognite.com/cdf/access/",Tc="https://status.cognite.com";function Rc(e){switch(e){case 401:return{hint:"Your credentials are invalid or expired. Check your client ID and secret.",helpUrl:fr};case 403:return{hint:"You don't have the required CDF capabilities. Please contact your CDF admin.",helpUrl:fr};case 413:return{hint:"The deployment exceeds the App Hosting size limit. Reduce the build output \u2014 remove unused assets, code-split bundles, or strip source maps."};case 429:return{hint:"You are being rate limited. Wait a few moments and retry. If this persists, contact CDF support."};case 500:case 502:case 503:case 504:return{hint:"CDF service error. The issue is on the server side. Check the status page and retry shortly.",helpUrl:Tc};default:return{}}}r(Rc,"defaultHintForStatus");var En=class En extends m{constructor(t,n){super(t,n),this.name="HintedHttpError",this.httpStatusCode=n.httpStatusCode,this.requestUrl=n.requestUrl,this.responseBody=n.responseBody}deriveDefaults(t){let{httpStatusCode:n}=t,o=Rc(n),i=super.deriveDefaults(t);return{hint:o.hint??i.hint,helpUrl:o.helpUrl}}};r(En,"HintedHttpError");var fe=En;function yr(e){return e instanceof fe}r(yr,"isHintedHttpError");function $c(e,t){if(e)switch(e){case"ENOTFOUND":return t.hostname?`DNS lookup failed for ${t.hostname}. Check your network, VPN, or proxy settings.`:"DNS lookup failed. Check your network, VPN, or proxy settings.";case"ECONNREFUSED":return t.hostname&&t.port?`Connection refused by ${t.hostname}:${t.port}. The service may be down or the port may be wrong.`:"Connection refused. The service may be down or the port may be wrong.";case"ECONNRESET":return"Connection was reset. The server closed the connection unexpectedly; check for proxy/firewall interference and retry.";case"ETIMEDOUT":return"Connection timed out. Check your network, VPN, or proxy settings, and retry.";case"EAI_AGAIN":return"Temporary DNS failure. Retry shortly; if it persists, check your DNS configuration.";case"CERT_HAS_EXPIRED":case"UNABLE_TO_VERIFY_LEAF_SIGNATURE":case"SELF_SIGNED_CERT_IN_CHAIN":return"TLS certificate validation failed. Check system clock and CA trust store; if you use a corporate proxy, ensure its root cert is trusted.";case"EACCES":return t.path?`Permission denied: ${t.path}. Check file ownership and permissions.`:"Permission denied. Check file ownership and permissions.";case"ENOENT":return t.path?`File or directory not found: ${t.path}.`:"File or directory not found.";case"EISDIR":return t.path?`Expected a file but found a directory: ${t.path}.`:"Expected a file but found a directory.";case"ENOSPC":return"No space left on device. Free up disk space and retry.";case"EADDRINUSE":return t.port?`Port ${t.port} is already in use. Stop the process using it or pick a different port.`:"Address is already in use. Stop the conflicting process or change the port.";case"EMFILE":case"ENFILE":return"Too many open files. Close other programs or raise the file descriptor limit.";default:return}}r($c,"hintForErrno");function Oc(e){let t=e,n=new Set;for(;t!=null&&!n.has(t)&&(n.add(t),typeof t=="object");){let o=t,i=$c(o.code,o);if(i!==void 0)return i;t=o.cause}}r(Oc,"hintForCause");import{Command as Fc,Option as wt}from"commander";var hr=Object.freeze({interactive:new wt("--interactive","Use browser-based authentication instead of env-var credentials").default(!1),baseUrl:new wt("--base-url <url>","CDF base URL (only with --interactive)"),project:new wt("--project <project>","CDF project name (only with --interactive)"),org:new wt("--org <org>","Organization hint for login (only with --interactive)")}),Eh=Object.values(hr).map(e=>e.long),Ct=class Ct extends Fc{constructor(t){super(t);for(let n of Object.values(hr))this.addOption(n)}createCommand(t){return new Ct(t)}};r(Ct,"BaseCommand");var ye=Ct,xn=class xn extends ye{constructor(t){super(t),this.configure()}};r(xn,"CommandGroup");var vt=xn;import{performance as Cr}from"perf_hooks";import{existsSync as Vc,readFileSync as Gc}from"fs";import{resolve as Yc}from"path";import{array as Sr,boolean as Lc,check as Be,forward as Ke,literal as Mc,maxLength as Uc,minLength as _c,nonEmpty as xe,object as wr,optional as he,picklist as jc,pipe as ae,safeParse as Nc,string as X,url as vr}from"valibot";var kn=ae(X(),xe("must not be empty")),Pn=ae(X(),xe("must not be empty"),Uc(256,"must be 256 characters or fewer")),In=ae(X(),xe("must not be empty"),vr("must be a valid URL")),Hc=ae(X(),xe("must not be empty"),vr("must be a valid URL")),Dn=ae(X(),xe("must not be empty")),Tn=ae(X(),xe("must not be empty")),Bc=ae(wr({org:Dn,project:Tn,baseUrl:In,deployClientId:he(X(),""),deploySecretName:he(X(),""),published:he(Lc(),!1),idpType:he(jc(["cdf","entra_id","oauth"]),"cdf"),tenantId:he(X()),scopes:he(Sr(ae(X(),xe("must not be empty")))),tokenUrl:he(Hc)}),Ke(Be(e=>e.idpType!=="entra_id"||!!e.tenantId,'must be set when idpType is "entra_id"'),["tenantId"]),Ke(Be(e=>e.idpType!=="oauth"||!!e.tokenUrl,'must be set when idpType is "oauth"'),["tokenUrl"]),Ke(Be(e=>!e.tokenUrl||e.idpType==="oauth",'must only be set when idpType is "oauth"'),["tokenUrl"]),Ke(Be(e=>e.idpType!=="oauth"||!!e.deployClientId,'must be set when idpType is "oauth"'),["deployClientId"]),Ke(Be(e=>e.idpType!=="oauth"||!!e.deploySecretName,'must be set when idpType is "oauth"'),["deploySecretName"]),Ke(Be(e=>!e.deployClientId||!!e.deploySecretName,"must be set when deployClientId is set"),["deploySecretName"])),Kc=wr({name:kn,externalId:Pn,versionTag:ae(X(),xe("must not be empty")),description:he(X(),""),deployments:ae(Sr(Bc),_c(1,"must contain at least one deployment")),infra:he(Mc("appsApi"))});function Rn(e){let t=Nc(Kc,e);if(t.success)return t.output;let n=t.issues[0],o=n.path?.map(s=>s.key).join(".")??"",i=o?`"${o}" `:"";throw new Error(`app.json: ${i}${n.message}`)}r(Rn,"validateAppConfig");function E(e,t={}){let{validator:n=Rn,existsSync:o=Vc,readFileSync:i=Gc}=t,s=Yc(e,"app.json");if(!o(s))throw new Error(`No app.json found at ${s}. Make sure you're running this command from your app's root directory.`);let a=i(s,"utf-8"),c;try{c=JSON.parse(a)}catch{throw new Error("Failed to parse app.json \u2014 check that it contains valid JSON.")}return n(c)}r(E,"loadAppConfig");var Ve=1e3,At;function qc(){At=Cr.now()}r(qc,"markActionStart");function Jc(){At=void 0}r(Jc,"resetActionStart");function $n(){if(At!==void 0)return Math.max(0,Math.round(Cr.now()-At))}r($n,"snapshotActionDurationMs");function Ar(){let e=$n();return Jc(),{...e!==void 0&&{actionDurationMs:e}}}r(Ar,"takePerformanceFields");var zc=new Set(["baseUrl","url","project","deployment","source","path","name","displayName","description","externalId"]);function On(e){return Object.fromEntries(Object.entries(e).map(([t,n])=>typeof n=="boolean"?[t,n]:zc.has(t)?[t,n]:[t,"[REDACTED]"]))}r(On,"sanitizeOptions");function Wc(e){let t=[],n=e;for(;n;)n.parent&&t.unshift(n.name()),n=n.parent;return t.join(" ")}r(Wc,"getCommandPath");function br(e){try{let t=e(process.cwd()),n=t.deployments[0];return{appName:t.name,appExternalId:t.externalId,appVersionTag:t.versionTag,...n&&{cogniteOrg:n.org,cogniteProject:n.project}}}catch{return{}}}r(br,"tryLoadAppConfig");function Fn(e){return e.filter(t=>!t.startsWith("-")).join(" ")||"unknown"}r(Fn,"commandFromArgv");function Er(e,t,n=E){e.hook("preAction",()=>{qc()}),e.hook("postAction",async(o,i)=>{try{let s={command:Wc(i),options:On(i.opts()),success:!0,...br(n),...Ar()};t.track("Flows.CLI.Command",{...s}),await t.flush(Ve)}catch{}})}r(Er,"instrument");async function xr(e,t,n=E){try{let o={command:Fn(t),options:{},success:!1,...br(n),...Ar()};e.track("Flows.CLI.Command",{...o}),await e.flush(Ve)}catch{}}r(xr,"trackFailure");var Xc=Object.freeze({create:"Flows.CLI.Agents.Create",push:"Flows.CLI.Agents.Push",open:"Flows.CLI.Agents.Open",publish:"Flows.CLI.Agents.Publish",unpublish:"Flows.CLI.Agents.Unpublish",pull:"Flows.CLI.Agents.Pull",list:"Flows.CLI.Agents.List",status:"Flows.CLI.Agents.Status",eval:"Flows.CLI.Agents.Eval"});async function kr(e,t){if(!e||t.name()==="eval")return;let n=Xc[t.name()];if(n)try{e.track(n,{command:t.name(),options:On(t.optsWithGlobals()),success:!0}),await e.flush(Ve)}catch{}}r(kr,"trackAgentsCommand");import{existsSync as Di}from"fs";import{mkdir as Ti,readFile as xi,writeFile as ao}from"fs/promises";import{basename as ld,dirname as pd,join as Je,resolve as co}from"path";import{fileURLToPath as dd}from"url";import{Option as Ue}from"commander";import Zc,{Chalk as Qc}from"chalk";var tt=new Qc({level:0});function P(e){return e.isTTY?Zc:tt}r(P,"chalkForStream");var el="ERR_USE_AFTER_CLOSE";function Ir(e){return e instanceof Error&&"code"in e&&e.code===el}r(Ir,"isReadlineClosedError");function tl(e){let t=Object.getPrototypeOf(e);return t===Object.prototype||t===null}r(tl,"isPlainObject");function Ln(e){return e==null||Ir(e)?!0:e instanceof Error?!1:!!(typeof e=="object"&&e!==null&&tl(e)&&Object.keys(e).length===0)}r(Ln,"isPromptCancel");var Pr=!1;function bt(){Pr||(Pr=!0,process.on("uncaughtException",e=>{Ir(e)&&(console.error(`
-Cancelled.`),process.exit(130)),console.error(e),process.exit(1)}),process.on("unhandledRejection",e=>{Ln(e)&&(console.error(`
-Cancelled.`),process.exit(130)),console.error(e),process.exit(1)}))}r(bt,"installCancelHandler");import{readFile as nl}from"fs/promises";import{join as ol}from"path";import{array as ot,looseObject as Dr,nullable as rl,object as Tr,optional as re,parse as Rr,record as il,string as V,unknown as sl}from"valibot";import{parse as al,stringify as cl}from"yaml";var T=Object.freeze({config:"agent.yaml",readme:"README.md",readmeTemplate:"README_TEMPLATE.md",evalDir:"eval",evalCases:"eval.yaml",evalCasesTemplate:"EVAL_CASES_TEMPLATE.yaml"}),Te=`${T.evalDir}/${T.evalCases}`,nt={dirName:"my-agent",model:"azure/gpt-4.1-mini",runtimeVersion:"1.3.0"};var ll=Tr({agentExternalId:V()}),pl=Tr({question:V()}),dl=Dr({name:V(),type:V(),description:V(),instructions:re(V()),configuration:re(rl(il(V(),sl())))}),$r=Dr({externalId:V(),name:V(),description:re(V()),instructions:re(V()),model:re(V()),runtimeVersion:re(V()),labels:re(ot(V())),exampleQuestions:re(ot(pl)),skills:re(ot(V())),subagents:re(ot(ll)),tools:re(ot(dl),[])});function ul(e){let t=al(e);return Rr($r,t)}r(ul,"parseAgentYaml");function ce(e){let t=Rr($r,e);return cl(t,{lineWidth:0})}r(ce,"serializeAgentYaml");async function Z(e){let t=ol(e,T.config),n;try{n=await nl(t,"utf8")}catch{throw new m(`No ${T.config} found at:
-  ${t}`,{hint:"Run this command from an agent project directory, or pass the directory as an argument.",shouldReport:!1})}return ul(n)}r(Z,"readAgentYaml");function Re(e){let{createdTime:t,lastUpdatedTime:n,ownerId:o,...i}=e;return i}r(Re,"toAgentCreate");import Or from"enquirer";var Mn=class Mn{constructor(t,n,o,i=[],s,a=Or.prompt.bind(Or)){this.dirArg=t;this.flags=n;this.isInteractive=o;this.availableModels=i;this.apiDefaultModel=s;this.promptFn=a}async resolve(){let t=await this.getDirName();return{dirName:t,externalId:this.flags.externalId?.trim()||t,name:await this.getDisplayName(t),description:await this.getDescription(),model:await this.getModel(),instructions:await this.getInstructions(),runtimeVersion:this.flags.runtimeVersion?.trim()||void 0}}async getDirName(){return this.dirArg?this.dirArg:this.isInteractive?rt(this.promptFn,{message:"Agent name (used as directory and externalId)",initial:"my-agent",validate:Fr("Agent name")}):nt.dirName}async getDisplayName(t){let n=this.flags.displayName?.trim();return n||(this.isInteractive?rt(this.promptFn,{message:"Display name",initial:t,validate:Fr("Display name")}):t)}async getDescription(){let t=this.flags.description?.trim();if(t)return t;if(this.isInteractive){let n=await rt(this.promptFn,{message:"Description (optional)",initial:"",validate:r(()=>!0,"validate")});if(n)return n}}async getModel(){let t=this.flags.model?.trim();return t||(this.isInteractive&&this.availableModels.length>0?rt(this.promptFn,{message:"Model",choices:this.availableModels,initial:Math.max(this.availableModels.indexOf(this.apiDefaultModel??""),0)}):this.apiDefaultModel??nt.model)}async getInstructions(){let t=this.flags.instructions?.trim();if(t)return t;if(this.isInteractive){let n=await rt(this.promptFn,{message:"Instructions (system prompt, leave blank for default)",initial:"",validate:r(()=>!0,"validate")});if(n)return n}return ml}};r(Mn,"AgentCreateResolver");var Et=Mn,ml=["Help users explore and understand the data in this project.","Use the available tools to retrieve data before answering.","When the data is insufficient, say so rather than guessing."].join(`
-`);function Fr(e){return r(function(n){return n.trim()?!0:`${e} is required`},"_requiredInner")}r(Fr,"required");async function rt(e,t){if("choices"in t){let{value:o}=await e({type:"select",name:"value",...t});return o.trim()}let{value:n}=await e({type:"input",name:"value",...t});return n.trim()}r(rt,"ask");var xt={"cdf-version":"beta"};function Q(e){async function t(l){let p=c(e.project).concat("/ai/agents");return(await e.post(p,{data:{items:[l]},headers:xt})).data.items[0]}r(t,"upsert");async function n(l){let p=c(e.project).concat("/ai/agents/byids"),d;try{d=await e.post(p,{data:{items:[{externalId:l}]},headers:xt})}catch(f){throw o(f)&&f.status===422?new m(`Agent "${l}" not found.`,{hint:"Check the externalId and try again.",shouldReport:!1}):f}let u=d.data?.items??[];if(!u.length)throw new m(`Agent "${l}" not found.`,{hint:"Check the externalId and try again.",shouldReport:!1});return u[0]}r(n,"getByExternalId");function o(l){return typeof l=="object"&&l!==null&&"status"in l&&typeof l.status=="number"}r(o,"isHttpError");async function i(){let l=c(e.project).concat("/ai/agents");return(await e.get(l,{headers:xt})).data}r(i,"list");async function s(){let l=c(e.project).concat("/ai/availability");return(await e.get(l,{headers:xt})).data}r(s,"getServiceAvailability");async function a(){let p=(await s()).items.find(d=>d.path==="/ai/agents");return{models:p?.supportedLanguageModels??[],defaultModel:p?.defaultLanguageModel}}r(a,"getAvailableModels");function c(l){return`/api/v1/projects/${encodeURIComponent(l)}`}return r(c,"getBaseUrl"),{upsert:t,getByExternalId:n,list:i,getServiceAvailability:s,getAvailableModels:a}}r(Q,"getAgentsService");import{CogniteClient as id}from"@cognite/sdk";import{existsSync as wl,mkdirSync as vl,readFileSync as Cl,renameSync as Al,rmSync as bl,writeFileSync as El}from"fs";import{dirname as xl}from"path";import{isoTimestamp as kl,literal as Pl,nonEmpty as jr,object as Il,pipe as Nr,safeParse as Dl,string as Hr}from"valibot";import{homedir as gl}from"os";import{join as Un}from"path";function F(e={}){let{env:t=process.env,homedir:n=gl}=e,o=t.COGNITE_CLI_HOME?.trim()||Un(n(),".cognite-cli");return{home:o,keysDir:Un(o,"keys"),sessionFile:Un(o,"session.json")}}r(F,"getConfig");import{inspect as fl}from"util";var _n="[REDACTED]",$e,kt=class kt{constructor(t){mr(this,$e);gr(this,$e,t)}toString(){return _n}toJSON(){return _n}[fl.custom](){return _n}expose(){return St(this,$e)}equals(t){return St(this,$e)===St(t,$e)}static from(t){return new kt(t)}};$e=new WeakMap,r(kt,"SensitiveString");var A=kt;var Oe="cognite-cli-session",yl=1280,hl=process.platform==="win32"?yl:1/0,jn="cognite-session/chunks=";function Pt(e,t){return`${e}/chunk/${t}`}r(Pt,"chunkAccount");function Nn(e){if(!e.startsWith(jn))return null;let t=Number(e.slice(jn.length));return Number.isFinite(t)&&t>0?t:null}r(Nn,"parseChunkCount");async function Sl(e,t){let{Entry:n}=await import("@napi-rs/keyring"),o=new n(e,t);return{setPassword:r(i=>o.setPassword(i),"setPassword"),getPassword:r(()=>o.getPassword(),"getPassword"),deleteCredential:r(()=>o.deleteCredential(),"deleteCredential")}}r(Sl,"defaultCreateEntry");function Hn(e){return{createEntry:e.createEntry??Sl,chunkSize:e.chunkSize??hl}}r(Hn,"resolveDeps");async function Lr(e,t,n={}){let{createEntry:o,chunkSize:i}=Hn(n),s=await o(Oe,e),a=s.getPassword();if(a!==null){let p=Nn(a);if(p!==null)for(let d=0;d<p;d++)(await o(Oe,Pt(e,d))).deleteCredential()}let c=t.expose();if(c.length<=i){s.setPassword(c);return}let l=[];for(let p=0;p<c.length;p+=i)l.push(c.slice(p,p+i));s.setPassword(`${jn}${l.length}`);for(let p=0;p<l.length;p++)(await o(Oe,Pt(e,p))).setPassword(l[p])}r(Lr,"storeSessionToken");async function Mr(e,t={}){let{createEntry:n}=Hn(t),o=(await n(Oe,e)).getPassword();if(o===null)return null;let i=Nn(o);if(i===null)return A.from(o);let s=[];for(let a=0;a<i;a++){let c=(await n(Oe,Pt(e,a))).getPassword();if(c===null)return null;s.push(c)}return A.from(s.join(""))}r(Mr,"readSessionToken");async function Ur(e,t={}){let{createEntry:n}=Hn(t),o=await n(Oe,e),i=o.getPassword();if(i!==null){let s=Nn(i);if(s!==null)for(let a=0;a<s;a++)(await n(Oe,Pt(e,a))).deleteCredential()}o.deleteCredential()}r(Ur,"deleteSessionToken");var It=1,Kn=r(e=>`${e}/accessToken`,"accessTokenAccount"),Vn=r(e=>`${e}/refreshToken`,"refreshTokenAccount"),_r=Nr(Hr(),jr("must not be empty"),kl("must be an ISO 8601 timestamp")),Tl=Il({version:Pl(It),org:Nr(Hr(),jr("must not be empty")),accessTokenExpiresAt:_r,refreshTokenExpiresAt:_r});function Dt(e){return{sessionFile:e.sessionFile??F().sessionFile,existsSync:e.existsSync??wl,readFileSync:e.readFileSync??Cl,writeFileSync:e.writeFileSync??El,mkdirSync:e.mkdirSync??vl,renameSync:e.renameSync??Al,rmSync:e.rmSync??bl,storeSecret:e.storeSecret??Lr,readSecret:e.readSecret??Mr,deleteSecret:e.deleteSecret??Ur}}r(Dt,"resolveDeps");var Bn="Run `npx @cognite/cli auth logout` to clear it, then `npx @cognite/cli auth login` to sign in again.";function Se(e={}){let t=Dt(e);if(!t.existsSync(t.sessionFile))return null;let n=t.readFileSync(t.sessionFile,"utf-8"),o;try{o=JSON.parse(n)}catch{throw new Error(`Session file at ${t.sessionFile} is not valid JSON. ${Bn}`)}let i=Dl(Tl,o);if(!i.success){let s=i.issues[0],a=s.path?.map(l=>l.key).join(".")??"",c=a?`"${a}" `:"";throw new Error(`Session file is invalid: ${c}${s.message}. ${Bn}`)}return i.output}r(Se,"readSessionMetadata");async function it(e={}){let t=Dt(e),n=Se(e);if(!n)return null;let[o,i]=await Promise.all([t.readSecret(Kn(n.org)),t.readSecret(Vn(n.org))]);if(!o||!i)throw new Error(`Session metadata exists but its tokens are missing from the keychain. ${Bn}`);return{...n,accessToken:o,refreshToken:i}}r(it,"readSession");async function Tt(e,t={}){let n=Dt(t);await n.storeSecret(Kn(e.org),e.accessToken),await n.storeSecret(Vn(e.org),e.refreshToken);let o={version:It,org:e.org,accessTokenExpiresAt:e.accessTokenExpiresAt,refreshTokenExpiresAt:e.refreshTokenExpiresAt};n.mkdirSync(xl(n.sessionFile),{recursive:!0,mode:448});let i=`${n.sessionFile}.tmp`;n.writeFileSync(i,`${JSON.stringify(o,null,2)}
-`,{mode:384});try{n.renameSync(i,n.sessionFile)}catch(s){throw n.rmSync(i,{force:!0}),s}}r(Tt,"writeSession");function Rl(e){if(!e.existsSync(e.sessionFile))return null;try{let t=JSON.parse(e.readFileSync(e.sessionFile,"utf-8"));if(t&&typeof t=="object"&&"org"in t){let n=t.org;return typeof n=="string"&&n.length>0?n:null}}catch{}return null}r(Rl,"readOrgLoosely");async function Rt(e={}){let t=Dt(e),n=Rl(t);t.rmSync(t.sessionFile,{force:!0}),n&&(await t.deleteSecret(Kn(n)),await t.deleteSecret(Vn(n)))}r(Rt,"clearSession");var $l=300*1e3;function Fe(e,t=new Date){let n=t.getTime();return Date.parse(e.refreshTokenExpiresAt)<=n?"EXPIRED":Date.parse(e.accessTokenExpiresAt)-n<=$l?"EXPIRING":"VALID"}r(Fe,"tokenState");import Sp from"path";import{lock as wp}from"proper-lockfile";import{None as sp,discovery as ap,tokenRevocation as cp,refreshTokenGrant as lp}from"openid-client";import zl from"os";import Wl from"path";import Xl from"open";import{buildAuthorizationUrl as Zl,calculatePKCECodeChallenge as Ql,discovery as ep,None as tp,randomPKCECodeVerifier as np,randomState as op}from"openid-client";import Br from"mixpanel";var Ol="5c4d853e7c3b77b1eb4468d5329b278c",Fl="api-eu.mixpanel.com",st="cognite-cli",Ll=2e3,Kr={env:process.env,init:Br.init.bind(Br)},Ml={track:r(()=>{},"track"),flush:r(async()=>{},"flush")};function Gn(e=process.env){return e.COGNITE_TELEMETRY_DISABLED==="1"||e.DO_NOT_TRACK==="1"}r(Gn,"isTelemetryDisabled");function Ul(e=process.env){if(e.GITHUB_ACTIONS)return"github-actions";if(e.TF_BUILD)return"azure-devops";if(e.GITLAB_CI)return"gitlab-ci";if(e.CIRCLECI)return"circleci";if(e.TRAVIS)return"travis-ci";if(e.BUILDKITE)return"buildkite";if(e.DRONE)return"drone";if(e.SEMAPHORE)return"semaphore";if(e.TEAMCITY_VERSION)return"teamcity";if(e.APPVEYOR)return"appveyor";if(e.CODEBUILD_BUILD_ID)return"aws-codebuild";if(e.HEROKU_TEST_RUN_ID)return"heroku-ci";if(e.BITBUCKET_BUILD_NUMBER)return"bitbucket-pipelines";if(e.JENKINS_URL||e.JENKINS_HOME)return"jenkins";if(e.CI&&e.CI!=="false"&&e.CI!=="0")return"ci-generic"}r(Ul,"detectCiEnvironment");function _l(e){return e.COGNITE_TELEMETRY_DEBUG==="1"}r(_l,"isDebug");function $t(e={}){let t=e.env??Kr.env,n=e.init??Kr.init,o=e.packageName,i=e.cliVersion,s=_l(t),a=Ul(t);if(Gn(t))return s&&process.stderr.write(`[telemetry] disabled \u2014 noop tracker
-`),Ml;let c,l=new Set;function p(){if(c)return c;try{return c=n(Ol,{geolocate:!1,keepAlive:!1,host:Fl}),c}catch{return}}return r(p,"getClient"),{track(d,u={}){let f=p();if(!f)return;let g={...u,applicationId:st,...o&&{packageName:o},...i&&{cliVersion:i},nodeVersion:process.version,platform:process.platform,...a&&{ciEnvironment:a}};s&&process.stderr.write(`[telemetry] track ${d} ${JSON.stringify(g)}
-`);let y=r(()=>{},"finish"),h=new Promise(S=>{y=S});l.add(h);try{f.track(d,g,y)}catch{y()}h.finally(()=>l.delete(h))},async flush(d=Ll){if(l.size===0)return;let u,f=new Promise(g=>{u=setTimeout(g,d),u.unref?.()});try{await Promise.race([Promise.allSettled([...l]),f])}finally{u&&clearTimeout(u)}s&&process.stderr.write(`[telemetry] flush done (${l.size} still pending)
-`)}}}r($t,"createTelemetry");import Bl from"https";import{authorizationCodeGrant as Kl}from"openid-client";function Vr(e){return e.replace(/[&<>"']/g,t=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[t]??t)}r(Vr,"escapeHtml");function Yn(e,t,n){let o=Vr(t),i=Vr(n);return`<html><body style="font-family: system-ui; padding: 40px; text-align: center;">
+var Pl=Object.defineProperty;var Br=e=>{throw TypeError(e)};var r=(e,t)=>Pl(e,"name",{value:t,configurable:!0});var Kr=(e,t,n)=>t.has(e)||Br("Cannot "+n);var xt=(e,t,n)=>(Kr(e,t,"read from private field"),n?n.call(e):t.get(e)),Vr=(e,t,n)=>t.has(e)?Br("Cannot add the same private member more than once"):t instanceof WeakSet?t.add(e):t.set(e,n),Gr=(e,t,n,o)=>(Kr(e,t,"write to private field"),o?o.call(e,n):t.set(e,n),n);import{writeSync as _S}from"fs";import{Command as jS}from"commander";var Gn=class Gn extends Error{constructor(t,n={}){super(t),this.name="HintedError",n.cause!==void 0&&(this.cause=n.cause);let o=this.deriveDefaults(n);this.hint=n.hint??o.hint,this.helpUrl=n.helpUrl??o.helpUrl,this.shouldReport=n.shouldReport??!0}deriveDefaults(t){return{hint:Dl(t.cause)}}};r(Gn,"HintedError");var m=Gn;function ue(e){return e instanceof m}r(ue,"isHintedError");var Yr="https://docs.cognite.com/cdf/access/",Tl="https://status.cognite.com";function Rl(e){switch(e){case 401:return{hint:"Your credentials are invalid or expired. Check your client ID and secret.",helpUrl:Yr};case 403:return{hint:"You don't have the required CDF capabilities. Please contact your CDF admin.",helpUrl:Yr};case 413:return{hint:"The deployment exceeds the App Hosting size limit. Reduce the build output \u2014 remove unused assets, code-split bundles, or strip source maps."};case 429:return{hint:"You are being rate limited. Wait a few moments and retry. If this persists, contact CDF support."};case 500:case 502:case 503:case 504:return{hint:"CDF service error. The issue is on the server side. Check the status page and retry shortly.",helpUrl:Tl};default:return{}}}r(Rl,"defaultHintForStatus");var Yn=class Yn extends m{constructor(t,n){super(t,n),this.name="HintedHttpError",this.httpStatusCode=n.httpStatusCode,this.requestUrl=n.requestUrl,this.responseBody=n.responseBody}deriveDefaults(t){let{httpStatusCode:n}=t,o=Rl(n),i=super.deriveDefaults(t);return{hint:o.hint??i.hint,helpUrl:o.helpUrl}}};r(Yn,"HintedHttpError");var de=Yn;function kt(e){return e instanceof de}r(kt,"isHintedHttpError");function Il(e,t){if(e)switch(e){case"ENOTFOUND":return t.hostname?`DNS lookup failed for ${t.hostname}. Check your network, VPN, or proxy settings.`:"DNS lookup failed. Check your network, VPN, or proxy settings.";case"ECONNREFUSED":return t.hostname&&t.port?`Connection refused by ${t.hostname}:${t.port}. The service may be down or the port may be wrong.`:"Connection refused. The service may be down or the port may be wrong.";case"ECONNRESET":return"Connection was reset. The server closed the connection unexpectedly; check for proxy/firewall interference and retry.";case"ETIMEDOUT":return"Connection timed out. Check your network, VPN, or proxy settings, and retry.";case"EAI_AGAIN":return"Temporary DNS failure. Retry shortly; if it persists, check your DNS configuration.";case"CERT_HAS_EXPIRED":case"UNABLE_TO_VERIFY_LEAF_SIGNATURE":case"SELF_SIGNED_CERT_IN_CHAIN":return"TLS certificate validation failed. Check system clock and CA trust store; if you use a corporate proxy, ensure its root cert is trusted.";case"EACCES":return t.path?`Permission denied: ${t.path}. Check file ownership and permissions.`:"Permission denied. Check file ownership and permissions.";case"ENOENT":return t.path?`File or directory not found: ${t.path}.`:"File or directory not found.";case"EISDIR":return t.path?`Expected a file but found a directory: ${t.path}.`:"Expected a file but found a directory.";case"ENOSPC":return"No space left on device. Free up disk space and retry.";case"EADDRINUSE":return t.port?`Port ${t.port} is already in use. Stop the process using it or pick a different port.`:"Address is already in use. Stop the conflicting process or change the port.";case"EMFILE":case"ENFILE":return"Too many open files. Close other programs or raise the file descriptor limit.";default:return}}r(Il,"hintForErrno");function Dl(e){let t=e,n=new Set;for(;t!=null&&!n.has(t)&&(n.add(t),typeof t=="object");){let o=t,i=Il(o.code,o);if(i!==void 0)return i;t=o.cause}}r(Dl,"hintForCause");import{Command as $l,Option as Pt}from"commander";var zr=Object.freeze({interactive:new Pt("--interactive","Use browser-based authentication instead of env-var credentials").default(!1),baseUrl:new Pt("--base-url <url>","CDF base URL (only with --interactive)"),project:new Pt("--project <project>","CDF project name (only with --interactive)"),org:new Pt("--org <org>","Organization hint for login (only with --interactive)")}),zS=Object.values(zr).map(e=>e.long),Rt=class Rt extends $l{constructor(t){super(t);for(let n of Object.values(zr))this.addOption(n)}createCommand(t){return new Rt(t)}};r(Rt,"BaseCommand");var Ee=Rt,zn=class zn extends Ee{constructor(t){super(t),this.configure()}};r(zn,"CommandGroup");var Tt=zn;import{performance as Zr}from"perf_hooks";import{existsSync as Bl,readFileSync as Kl}from"fs";import{resolve as Vl}from"path";import{array as qr,boolean as Ol,check as Ye,forward as ze,literal as Fl,maxLength as Ll,minLength as Ml,nonEmpty as Re,object as Jr,optional as be,picklist as Ul,pipe as me,safeParse as Nl,string as Q,url as Wr}from"valibot";var qn=me(Q(),Re("must not be empty")),Jn=me(Q(),Re("must not be empty"),Ll(256,"must be 256 characters or fewer")),Wn=me(Q(),Re("must not be empty"),Wr("must be a valid URL")),_l=me(Q(),Re("must not be empty"),Wr("must be a valid URL")),Zn=me(Q(),Re("must not be empty")),Xn=me(Q(),Re("must not be empty")),jl=me(Jr({org:Zn,project:Xn,baseUrl:Wn,deployClientId:be(Q(),""),deploySecretName:be(Q(),""),published:be(Ol(),!1),idpType:be(Ul(["cdf","entra_id","oauth"]),"cdf"),tenantId:be(Q()),scopes:be(qr(me(Q(),Re("must not be empty")))),tokenUrl:be(_l)}),ze(Ye(e=>e.idpType!=="entra_id"||!!e.tenantId,'must be set when idpType is "entra_id"'),["tenantId"]),ze(Ye(e=>e.idpType!=="oauth"||!!e.tokenUrl,'must be set when idpType is "oauth"'),["tokenUrl"]),ze(Ye(e=>!e.tokenUrl||e.idpType==="oauth",'must only be set when idpType is "oauth"'),["tokenUrl"]),ze(Ye(e=>e.idpType!=="oauth"||!!e.deployClientId,'must be set when idpType is "oauth"'),["deployClientId"]),ze(Ye(e=>e.idpType!=="oauth"||!!e.deploySecretName,'must be set when idpType is "oauth"'),["deploySecretName"]),ze(Ye(e=>!e.deployClientId||!!e.deploySecretName,"must be set when deployClientId is set"),["deploySecretName"])),Hl=Jr({name:qn,externalId:Jn,versionTag:me(Q(),Re("must not be empty")),description:be(Q(),""),deployments:me(qr(jl),Ml(1,"must contain at least one deployment")),infra:be(Fl("appsApi"))});function Qn(e){let t=Nl(Hl,e);if(t.success)return t.output;let n=t.issues[0],o=n.path?.map(s=>s.key).join(".")??"",i=o?`"${o}" `:"";throw new Error(`app.json: ${i}${n.message}`)}r(Qn,"validateAppConfig");function k(e,t={}){let{validator:n=Qn,existsSync:o=Bl,readFileSync:i=Kl}=t,s=Vl(e,"app.json");if(!o(s))throw new Error(`No app.json found at ${s}. Make sure you're running this command from your app's root directory.`);let a=i(s,"utf-8"),c;try{c=JSON.parse(a)}catch{throw new Error("Failed to parse app.json \u2014 check that it contains valid JSON.")}return n(c)}r(k,"loadAppConfig");var qe=1e3,It;function Gl(){It=Zr.now()}r(Gl,"markActionStart");function Yl(){It=void 0}r(Yl,"resetActionStart");function eo(){if(It!==void 0)return Math.max(0,Math.round(Zr.now()-It))}r(eo,"snapshotActionDurationMs");function Xr(){let e=eo();return Yl(),{...e!==void 0&&{actionDurationMs:e}}}r(Xr,"takePerformanceFields");var zl=new Set(["baseUrl","url","project","deployment","source","path","name","displayName","description","externalId"]);function to(e){return Object.fromEntries(Object.entries(e).map(([t,n])=>typeof n=="boolean"?[t,n]:zl.has(t)?[t,n]:[t,"[REDACTED]"]))}r(to,"sanitizeOptions");function ql(e){let t=[],n=e;for(;n;)n.parent&&t.unshift(n.name()),n=n.parent;return t.join(" ")}r(ql,"getCommandPath");function Qr(e){try{let t=e(process.cwd()),n=t.deployments[0];return{appName:t.name,appExternalId:t.externalId,appVersionTag:t.versionTag,...n&&{cogniteOrg:n.org,cogniteProject:n.project}}}catch{return{}}}r(Qr,"tryLoadAppConfig");function no(e){return e.filter(t=>!t.startsWith("-")).join(" ")||"unknown"}r(no,"commandFromArgv");function ei(e,t,n=k){e.hook("preAction",()=>{Gl()}),e.hook("postAction",async(o,i)=>{try{let s={command:ql(i),options:to(i.opts()),success:!0,...Qr(n),...Xr()};t.track("Flows.CLI.Command",{...s}),await t.flush(qe)}catch{}})}r(ei,"instrument");async function ti(e,t,n=k){try{let o={command:no(t),options:{},success:!1,...Qr(n),...Xr()};e.track("Flows.CLI.Command",{...o}),await e.flush(qe)}catch{}}r(ti,"trackFailure");var Jl=Object.freeze({create:"Flows.CLI.Agents.Create",push:"Flows.CLI.Agents.Push",open:"Flows.CLI.Agents.Open",publish:"Flows.CLI.Agents.Publish",unpublish:"Flows.CLI.Agents.Unpublish",pull:"Flows.CLI.Agents.Pull",list:"Flows.CLI.Agents.List",status:"Flows.CLI.Agents.Status",eval:"Flows.CLI.Agents.Eval"});async function ni(e,t){if(!e||t.name()==="eval")return;let n=Jl[t.name()];if(n)try{e.track(n,{command:t.name(),options:to(t.optsWithGlobals()),success:!0}),await e.flush(qe)}catch{}}r(ni,"trackAgentsCommand");import{existsSync as ps}from"fs";import{cp as au,mkdir as ds,readFile as Ro,writeFile as on}from"fs/promises";import{basename as Io,dirname as cu,join as he,resolve as Do}from"path";import{fileURLToPath as lu}from"url";import{Option as Be}from"commander";import Wl,{Chalk as Zl}from"chalk";var rt=new Zl({level:0});function P(e){return e.isTTY?Wl:rt}r(P,"chalkForStream");var Xl="ERR_USE_AFTER_CLOSE";function ri(e){return e instanceof Error&&"code"in e&&e.code===Xl}r(ri,"isReadlineClosedError");function Ql(e){let t=Object.getPrototypeOf(e);return t===Object.prototype||t===null}r(Ql,"isPlainObject");function oo(e){return e==null||ri(e)?!0:e instanceof Error?!1:!!(typeof e=="object"&&e!==null&&Ql(e)&&Object.keys(e).length===0)}r(oo,"isPromptCancel");var oi=!1;function Dt(){oi||(oi=!0,process.on("uncaughtException",e=>{ri(e)&&(console.error(`
+Cancelled.`),process.exit(130)),console.error(e),process.exit(1)}),process.on("unhandledRejection",e=>{oo(e)&&(console.error(`
+Cancelled.`),process.exit(130)),console.error(e),process.exit(1)}))}r(Dt,"installCancelHandler");import{readdir as ep,readFile as tp}from"fs/promises";import{basename as ci,join as li}from"path";import{array as it,looseObject as pi,nullable as np,object as di,optional as ie,parse as ui,record as op,string as V,unknown as rp}from"valibot";import{parse as ip,stringify as sp}from"yaml";var A=Object.freeze({configSuffix:".agent.yaml",configGlob:"*.agent.yaml",readme:"README.md",readmeTemplate:"README_TEMPLATE.md",agentsMd:"AGENTS.md",agentsMdTemplate:"AGENTS_TEMPLATE.md",evalDir:"eval",evalCases:"eval.yaml",evalCasesTemplate:"EVAL_CASES_TEMPLATE.yaml"});function Ie(e){return`${e.replace(/[^A-Za-z0-9._-]/g,"_")}${A.configSuffix}`}r(Ie,"agentConfigFileName");var Me=`${A.evalDir}/${A.evalCases}`,ii={dirName:"my-agent"},si=[".cursor/skills",".claude/skills"];var ai="cdf_industrial_v4";var ap=di({agentExternalId:V()}),cp=di({question:V()}),lp=pi({name:V(),type:V(),description:V(),instructions:ie(V()),configuration:ie(np(op(V(),rp())))}),mi=pi({externalId:V(),name:V(),description:ie(V()),instructions:ie(V()),model:ie(V()),runtimeVersion:ie(V()),labels:ie(it(V())),exampleQuestions:ie(it(cp)),skills:ie(it(V())),subagents:ie(it(ap)),tools:ie(it(lp),[])});function pp(e){let t=ip(e);return ui(mi,t)}r(pp,"parseAgentYaml");function ge(e){let t=ui(mi,e);return sp(t,{lineWidth:0})}r(ge,"serializeAgentYaml");async function st(e){let t;try{t=await ep(e,{withFileTypes:!0})}catch{return[]}let n=A.configSuffix.toLowerCase();return t.filter(o=>o.name.toLowerCase().endsWith(n)&&!o.isDirectory()).map(o=>o.name).sort()}r(st,"findAgentYamlNames");async function dp(e){let t=await st(e);if(t.length===0)throw new m(`No ${A.configGlob} found in:
+  ${e}`,{hint:"Run this command from an agent project directory, or pass the directory as an argument.",shouldReport:!1});if(t.length===1)return li(e,t[0]);let n=Ie(ci(e)).toLowerCase(),o=t.find(i=>i.toLowerCase()===n);if(o!==void 0)return li(e,o);throw new m(`Found multiple ${A.configGlob} files in:
+  ${e}
+${t.map(i=>`  - ${i}`).join(`
+`)}`,{hint:`Each agent needs its own directory. Move the extra definitions elsewhere, or name the one you want after its folder (${Ie(ci(e))}).`,shouldReport:!1})}r(dp,"resolveAgentYamlPath");async function De(e){return(await at(e)).agent}r(De,"readAgentYaml");async function at(e){let t=await dp(e),n=await tp(t,"utf8");return{path:t,agent:pp(n)}}r(at,"loadAgentYaml");function Ue(e){let{createdTime:t,lastUpdatedTime:n,ownerId:o,...i}=e;return i}r(Ue,"toAgentCreate");import gi from"enquirer";var ro=class ro{constructor(t,n,o,i=[],s=gi.prompt.bind(gi)){this.dirArg=t;this.flags=n;this.isInteractive=o;this.availableModels=i;this.promptFn=s}async resolve(){let t=await this.getDirName();return{dirName:t,externalId:this.flags.externalId?.trim()||t,name:await this.getDisplayName(t),description:await this.getDescription(),model:await this.getModel(),instructions:await this.getInstructions(),runtimeVersion:this.flags.runtimeVersion?.trim()||void 0}}async getDirName(){return this.dirArg?this.dirArg:this.isInteractive?ct(this.promptFn,{message:"Agent name (used as directory and externalId)",initial:"my-agent",validate:fi("Agent name")}):ii.dirName}async getDisplayName(t){let n=this.flags.displayName?.trim();return n||(this.isInteractive?ct(this.promptFn,{message:"Display name",initial:t,validate:fi("Display name")}):t)}async getDescription(){let t=this.flags.description?.trim();if(t)return t;if(this.isInteractive){let n=await ct(this.promptFn,{message:"Description (optional)",initial:"",validate:r(()=>!0,"validate")});if(n)return n}}async getModel(){let t=this.flags.model?.trim();if(t)return t;if(this.isInteractive&&this.availableModels.length>0)return ct(this.promptFn,{message:"Model",choices:this.availableModels,initial:0})}async getInstructions(){let t=this.flags.instructions?.trim();if(t)return t;if(this.isInteractive){let n=await ct(this.promptFn,{message:"Agent instructions (custom behavior; built-in platform guidance applies automatically)",initial:"",validate:r(()=>!0,"validate")});if(n)return n}return up}};r(ro,"AgentCreateResolver");var $t=ro,up=["Help users explore and understand the data in this project.","Use the available tools to retrieve data before answering.","When the data is insufficient, say so rather than guessing."].join(`
+`);function fi(e){return r(function(n){return n.trim()?!0:`${e} is required`},"_requiredInner")}r(fi,"required");async function ct(e,t){if("choices"in t){let{value:o}=await e({type:"select",name:"value",...t});return o.trim()}let{value:n}=await e({type:"input",name:"value",...t});return n.trim()}r(ct,"ask");var Ot={"cdf-version":"beta"};function ee(e){async function t(l){let p=c(e.project).concat("/ai/agents");return(await e.post(p,{data:{items:[l]},headers:Ot})).data.items[0]}r(t,"upsert");async function n(l){let p=c(e.project).concat("/ai/agents/byids"),d;try{d=await e.post(p,{data:{items:[{externalId:l}]},headers:Ot})}catch(f){throw o(f)&&f.status===422?new m(`Agent "${l}" not found.`,{hint:"Check the externalId and try again.",shouldReport:!1}):f}let u=d.data?.items??[];if(!u.length)throw new m(`Agent "${l}" not found.`,{hint:"Check the externalId and try again.",shouldReport:!1});return u[0]}r(n,"getByExternalId");function o(l){return typeof l=="object"&&l!==null&&"status"in l&&typeof l.status=="number"}r(o,"isHttpError");async function i(){let l=c(e.project).concat("/ai/agents");return(await e.get(l,{headers:Ot})).data}r(i,"list");async function s(){let l=c(e.project).concat("/ai/availability");return(await e.get(l,{headers:Ot})).data}r(s,"getServiceAvailability");async function a(){return(await s()).items.find(d=>d.path==="/ai/agents")?.supportedLanguageModels??[]}r(a,"getAvailableModels");function c(l){return`/api/v1/projects/${encodeURIComponent(l)}`}return r(c,"getBaseUrl"),{upsert:t,getByExternalId:n,list:i,getServiceAvailability:s,getAvailableModels:a}}r(ee,"getAgentsService");import{CogniteClient as ou}from"@cognite/sdk";import{existsSync as Sp,mkdirSync as wp,readFileSync as vp,renameSync as Cp,rmSync as Ap,writeFileSync as Ep}from"fs";import{dirname as bp}from"path";import{isoTimestamp as xp,literal as kp,nonEmpty as vi,object as Pp,pipe as Ci,safeParse as Tp,string as Ai}from"valibot";import{homedir as mp}from"os";import{join as io}from"path";function D(e={}){let{env:t=process.env,homedir:n=mp}=e,o=t.COGNITE_CLI_HOME?.trim()||io(n(),".cognite-cli");return{home:o,keysDir:io(o,"keys"),sessionFile:io(o,"session.json")}}r(D,"getConfig");import{inspect as gp}from"util";var so="[REDACTED]",Ne,Ft=class Ft{constructor(t){Vr(this,Ne);Gr(this,Ne,t)}toString(){return so}toJSON(){return so}[gp.custom](){return so}expose(){return xt(this,Ne)}equals(t){return xt(this,Ne)===xt(t,Ne)}static from(t){return new Ft(t)}};Ne=new WeakMap,r(Ft,"SensitiveString");var b=Ft;var _e="cognite-cli-session",fp=1280,hp=process.platform==="win32"?fp:1/0,ao="cognite-session/chunks=";function Lt(e,t){return`${e}/chunk/${t}`}r(Lt,"chunkAccount");function co(e){if(!e.startsWith(ao))return null;let t=Number(e.slice(ao.length));return Number.isFinite(t)&&t>0?t:null}r(co,"parseChunkCount");async function yp(e,t){let{Entry:n}=await import("@napi-rs/keyring"),o=new n(e,t);return{setPassword:r(i=>o.setPassword(i),"setPassword"),getPassword:r(()=>o.getPassword(),"getPassword"),deleteCredential:r(()=>o.deleteCredential(),"deleteCredential")}}r(yp,"defaultCreateEntry");function lo(e){return{createEntry:e.createEntry??yp,chunkSize:e.chunkSize??hp}}r(lo,"resolveDeps");async function hi(e,t,n={}){let{createEntry:o,chunkSize:i}=lo(n),s=await o(_e,e),a=s.getPassword();if(a!==null){let p=co(a);if(p!==null)for(let d=0;d<p;d++)(await o(_e,Lt(e,d))).deleteCredential()}let c=t.expose();if(c.length<=i){s.setPassword(c);return}let l=[];for(let p=0;p<c.length;p+=i)l.push(c.slice(p,p+i));s.setPassword(`${ao}${l.length}`);for(let p=0;p<l.length;p++)(await o(_e,Lt(e,p))).setPassword(l[p])}r(hi,"storeSessionToken");async function yi(e,t={}){let{createEntry:n}=lo(t),o=(await n(_e,e)).getPassword();if(o===null)return null;let i=co(o);if(i===null)return b.from(o);let s=[];for(let a=0;a<i;a++){let c=(await n(_e,Lt(e,a))).getPassword();if(c===null)return null;s.push(c)}return b.from(s.join(""))}r(yi,"readSessionToken");async function Si(e,t={}){let{createEntry:n}=lo(t),o=await n(_e,e),i=o.getPassword();if(i!==null){let s=co(i);if(s!==null)for(let a=0;a<s;a++)(await n(_e,Lt(e,a))).deleteCredential()}o.deleteCredential()}r(Si,"deleteSessionToken");var Mt=1,uo=r(e=>`${e}/accessToken`,"accessTokenAccount"),mo=r(e=>`${e}/refreshToken`,"refreshTokenAccount"),wi=Ci(Ai(),vi("must not be empty"),xp("must be an ISO 8601 timestamp")),Rp=Pp({version:kp(Mt),org:Ci(Ai(),vi("must not be empty")),accessTokenExpiresAt:wi,refreshTokenExpiresAt:wi});function Ut(e){return{sessionFile:e.sessionFile??D().sessionFile,existsSync:e.existsSync??Sp,readFileSync:e.readFileSync??vp,writeFileSync:e.writeFileSync??Ep,mkdirSync:e.mkdirSync??wp,renameSync:e.renameSync??Cp,rmSync:e.rmSync??Ap,storeSecret:e.storeSecret??hi,readSecret:e.readSecret??yi,deleteSecret:e.deleteSecret??Si}}r(Ut,"resolveDeps");var po="Run `npx @cognite/cli auth logout` to clear it, then `npx @cognite/cli auth login` to sign in again.";function xe(e={}){let t=Ut(e);if(!t.existsSync(t.sessionFile))return null;let n=t.readFileSync(t.sessionFile,"utf-8"),o;try{o=JSON.parse(n)}catch{throw new Error(`Session file at ${t.sessionFile} is not valid JSON. ${po}`)}let i=Tp(Rp,o);if(!i.success){let s=i.issues[0],a=s.path?.map(l=>l.key).join(".")??"",c=a?`"${a}" `:"";throw new Error(`Session file is invalid: ${c}${s.message}. ${po}`)}return i.output}r(xe,"readSessionMetadata");async function lt(e={}){let t=Ut(e),n=xe(e);if(!n)return null;let[o,i]=await Promise.all([t.readSecret(uo(n.org)),t.readSecret(mo(n.org))]);if(!o||!i)throw new Error(`Session metadata exists but its tokens are missing from the keychain. ${po}`);return{...n,accessToken:o,refreshToken:i}}r(lt,"readSession");async function Nt(e,t={}){let n=Ut(t);await n.storeSecret(uo(e.org),e.accessToken),await n.storeSecret(mo(e.org),e.refreshToken);let o={version:Mt,org:e.org,accessTokenExpiresAt:e.accessTokenExpiresAt,refreshTokenExpiresAt:e.refreshTokenExpiresAt};n.mkdirSync(bp(n.sessionFile),{recursive:!0,mode:448});let i=`${n.sessionFile}.tmp`;n.writeFileSync(i,`${JSON.stringify(o,null,2)}
+`,{mode:384});try{n.renameSync(i,n.sessionFile)}catch(s){throw n.rmSync(i,{force:!0}),s}}r(Nt,"writeSession");function Ip(e){if(!e.existsSync(e.sessionFile))return null;try{let t=JSON.parse(e.readFileSync(e.sessionFile,"utf-8"));if(t&&typeof t=="object"&&"org"in t){let n=t.org;return typeof n=="string"&&n.length>0?n:null}}catch{}return null}r(Ip,"readOrgLoosely");async function _t(e={}){let t=Ut(e),n=Ip(t);t.rmSync(t.sessionFile,{force:!0}),n&&(await t.deleteSecret(uo(n)),await t.deleteSecret(mo(n)))}r(_t,"clearSession");var Dp=300*1e3;function je(e,t=new Date){let n=t.getTime();return Date.parse(e.refreshTokenExpiresAt)<=n?"EXPIRED":Date.parse(e.accessTokenExpiresAt)-n<=Dp?"EXPIRING":"VALID"}r(je,"tokenState");import hd from"path";import{lock as yd}from"proper-lockfile";import{None as id,discovery as sd,tokenRevocation as ad,refreshTokenGrant as cd}from"openid-client";import{buildAuthorizationUrl as Wp,calculatePKCECodeChallenge as Zp,discovery as Xp,None as Qp,randomPKCECodeVerifier as ed,randomState as td}from"openid-client";import Ei from"mixpanel";var $p="5c4d853e7c3b77b1eb4468d5329b278c",Op="api-eu.mixpanel.com",pt="cognite-cli",Fp=2e3,bi={env:process.env,init:Ei.init.bind(Ei)},Lp={track:r(()=>{},"track"),flush:r(async()=>{},"flush")};function go(e=process.env){return e.COGNITE_TELEMETRY_DISABLED==="1"||e.DO_NOT_TRACK==="1"}r(go,"isTelemetryDisabled");function Mp(e=process.env){if(e.GITHUB_ACTIONS)return"github-actions";if(e.TF_BUILD)return"azure-devops";if(e.GITLAB_CI)return"gitlab-ci";if(e.CIRCLECI)return"circleci";if(e.TRAVIS)return"travis-ci";if(e.BUILDKITE)return"buildkite";if(e.DRONE)return"drone";if(e.SEMAPHORE)return"semaphore";if(e.TEAMCITY_VERSION)return"teamcity";if(e.APPVEYOR)return"appveyor";if(e.CODEBUILD_BUILD_ID)return"aws-codebuild";if(e.HEROKU_TEST_RUN_ID)return"heroku-ci";if(e.BITBUCKET_BUILD_NUMBER)return"bitbucket-pipelines";if(e.JENKINS_URL||e.JENKINS_HOME)return"jenkins";if(e.CI&&e.CI!=="false"&&e.CI!=="0")return"ci-generic"}r(Mp,"detectCiEnvironment");function Up(e){return e.COGNITE_TELEMETRY_DEBUG==="1"}r(Up,"isDebug");function jt(e={}){let t=e.env??bi.env,n=e.init??bi.init,o=e.packageName,i=e.cliVersion,s=Up(t),a=Mp(t);if(go(t))return s&&process.stderr.write(`[telemetry] disabled \u2014 noop tracker
+`),Lp;let c,l=new Set;function p(){if(c)return c;try{return c=n($p,{geolocate:!1,keepAlive:!1,host:Op}),c}catch{return}}return r(p,"getClient"),{track(d,u={}){let f=p();if(!f)return;let h={...u,applicationId:pt,...o&&{packageName:o},...i&&{cliVersion:i},nodeVersion:process.version,platform:process.platform,...a&&{ciEnvironment:a}};s&&process.stderr.write(`[telemetry] track ${d} ${JSON.stringify(h)}
+`);let g=r(()=>{},"finish"),y=new Promise(S=>{g=S});l.add(y);try{f.track(d,h,g)}catch{g()}y.finally(()=>l.delete(y))},async flush(d=Fp){if(l.size===0)return;let u,f=new Promise(h=>{u=setTimeout(h,d),u.unref?.()});try{await Promise.race([Promise.allSettled([...l]),f])}finally{u&&clearTimeout(u)}s&&process.stderr.write(`[telemetry] flush done (${l.size} still pending)
+`)}}}r(jt,"createTelemetry");var Ht={min:3100,max:3110},Np=`${Ht.min}-${Ht.max}`,dt=`3000, or ${Np}`;function Bt(e){return Number.isInteger(e)?e===3e3||e>=Ht.min&&e<=Ht.max:!1}r(Bt,"isAllowedCallbackPort");function Kt(e){return`Unsupported callback port ${typeof e=="string"?`"${e}"`:e} \u2014 only ${dt} are supported.`}r(Kt,"formatUnsupportedCallbackPort");import jp from"http";import{authorizationCodeGrant as Hp}from"openid-client";function xi(e){return e.replace(/[&<>"']/g,t=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[t]??t)}r(xi,"escapeHtml");function fo(e,t,n){let o=xi(t),i=xi(n);return`<html><body style="font-family: system-ui; padding: 40px; text-align: center;">
     <h1>${o}</h1><p>${i}</p><p>You can close this window.</p>${e==="success"?`<style>
       @keyframes checkmark {
         0% { transform: scale(0); }
@@ -16,22 +19,20 @@ Cancelled.`),process.exit(130)),console.error(e),process.exit(1)}))}r(bt,"instal
       }
       h1 { animation: checkmark 0.5s ease-out; }
     </style>`:""}
-  </body></html>`}r(Yn,"generateHtml");import Hl from"net";import{execFileSync as Gr}from"child_process";import{platform as jl}from"os";import Nl from"path";function G(e,t={}){let{platform:n=jl}=t;switch(n()){case"darwin":return e==="macos";case"win32":return e==="windows";default:return e==="other"}}r(G,"isOS");function Ot(e,t={}){let{exec:n=Gr,log:o=console.log}=t,[i,s]=G("macos",t)?["open",[e]]:G("windows",t)?["rundll32",["url.dll,FileProtocolHandler",e]]:["xdg-open",[e]];try{n(i,s)}catch{o(`Could not open browser \u2014 open manually:
-  ${e}`)}}r(Ot,"openInBrowser");function Yr(e,t={}){let{exec:n=Gr,log:o=console.log}=t,[i,s]=G("macos",t)?["open",["-R",e]]:G("windows",t)?["explorer",[`/select,${e}`]]:["xdg-open",[Nl.dirname(e)]];try{n(i,s)}catch{o(`Could not open file manager \u2014 files are at:
-  ${e}`)}}r(Yr,"revealInFileManager");function qr(e,t){return new Promise(n=>{let o=new Hl.Socket,i=r(s=>{o.removeAllListeners(),o.destroy(),n(s)},"done");o.setTimeout(500),o.once("connect",()=>i(!1)),o.once("timeout",()=>i(!0)),o.once("error",()=>i(!0)),o.connect(e,t)})}r(qr,"isHostPortFree");function Lt(e,t={}){return G("windows",t)?`Find the process: netstat -ano | findstr :${e}  then kill it: taskkill /PID <pid> /F`:`Free port ${e} (e.g. lsof -ti :${e} | xargs kill) and retry.`}r(Lt,"freePortHint");async function Jr(e){if(e<0)throw new Error(`Invalid port: ${e}`);return e===0?!0:(await Promise.all([qr(e,"127.0.0.1"),qr(e,"::1")])).every(Boolean)}r(Jr,"isPortFree");async function Vl(e,t,n,o,i,s){let a=new URL(e.url??"/",`https://${e.headers.host??"localhost"}`);if(a.pathname!=="/")return t.writeHead(404),t.end("Not found"),{shouldClose:!1};try{console.log("\u{1F504} Exchanging authorization code for tokens...");let c=await s.authorizationCodeGrant(n,a,{pkceCodeVerifier:o,expectedState:i});return t.writeHead(200,{"Content-Type":"text/html",Connection:"close"}),t.end(Yn("success","Login Successful!","You can close this window and return to the terminal.")),{shouldClose:!0,tokens:c}}catch(c){let l=c instanceof Error?c:new Error(String(c));return t.writeHead(400,{"Content-Type":"text/html",Connection:"close"}),t.end(Yn("error","Authentication Error",l.message)),{shouldClose:!0,error:l}}}r(Vl,"handleCallback");function Gl(e){let t=e/6e4,n=Math.round(t*10)/10;return`${n} ${n===1?"minute":"minutes"}`}r(Gl,"formatTimeoutMinutes");function zr(e,t,n,o,i,s={createServer:Bl.createServer,setTimeout:globalThis.setTimeout,clearTimeout:globalThis.clearTimeout,authorizationCodeGrant:Kl}){return new Promise((a,c)=>{let l=s.createServer(t,async(u,f)=>{try{let g=await Vl(u,f,n,o,i,s);g.shouldClose&&(d(),g.error?c(g.error):g.tokens?a(g.tokens):c(new Error("No tokens received")))}catch(g){d(),c(g instanceof Error?g:new Error(String(g)))}}),p=s.setTimeout(()=>{d(),c(new Error(`Login timeout - no response received within ${Gl(e.loginTimeout)}`))},e.loginTimeout);function d(){s.clearTimeout(p),l.close(),l.closeIdleConnections?.()}r(d,"cleanup"),l.on("error",u=>{d(),u.code==="EADDRINUSE"||u.code==="EACCES"?c(new m(`Port ${e.port} is already in use \u2014 the login callback server cannot start`,{cause:u,hint:Lt(e.port)})):c(new m(`Login callback server failed: ${u.message}`,{cause:u}))}),l.listen(e.port,"127.0.0.1",()=>{console.log(`\u{1F310} Local HTTPS server started on https://localhost:${e.port}`)})})}r(zr,"startCallbackServer");import{mkdirSync as Yl}from"fs";import{loadLocalCertificates as ql}from"@cognite/app-sdk/https";var Jl={loadLocalCertificates:ql,mkdirSync:Yl,logger:console};async function Wr(e,t=Jl){t.mkdirSync(e,{recursive:!0});let{cert:n,key:o,source:i}=await t.loadLocalCertificates({certDir:e}).catch(s=>{throw new m(`Failed to load SSL certificates from ${e}`,{cause:s,hint:"Run `npx @cognite/cli apps setup-https` to create trusted local certificates."})});return i==="mkcert"?t.logger.log("\u{1F510} Using mkcert certificates for HTTPS"):(t.logger.log("\u{1F510} Using in-memory self-signed certificate for HTTPS \u2014 your browser will give you a warning."),t.logger.log("   Run `npx @cognite/cli@latest apps setup-https` to install trusted local https certificates.")),{cert:n,key:o}}r(Wr,"getOrCreateCertificates");var qn="openid profile email",Jn={authority:"https://auth.cognite.com",clientId:"0404baaa-0a90-43a2-aba7-a110b53fb41c",redirectUri:"https://localhost:3000/",port:3e3,loginTimeout:300*1e3,certDir:Wl.join(zl.homedir(),".cdf-login")},rp={open:Xl,getOrCreateCertificates:Wr,startCallbackServer:zr,isPortFree:Jr,discovery:ep,buildAuthorizationUrl:Zl,randomPKCECodeVerifier:np,calculatePKCECodeChallenge:Ql,randomState:op,logger:console,telemetry:$t()};async function at(e,t=Jn,n){return n===void 0?Xr(e,t,rp):Xr(e,t,n)}r(at,"login");async function ip(e,t){let{discovery:n}=e;try{return await n(new URL(t.authority),t.clientId,void 0,tp())}catch(o){throw new m(`Failed to fetch OpenID configuration from ${t.authority}`,{cause:o})}}r(ip,"fetchOpenIdConfig");async function Xr(e,t,n){let{isPortFree:o,telemetry:i,logger:s,randomPKCECodeVerifier:a,calculatePKCECodeChallenge:c,randomState:l,buildAuthorizationUrl:p,getOrCreateCertificates:d,open:u,startCallbackServer:f}=n;if(!await o(t.port))throw i?.track("Flows.CLI.PortInUse",{port:t.port}),new m(`Port ${t.port} is already in use \u2014 the login callback server cannot start`,{hint:Lt(t.port)});s.log(`\u{1F510} Starting CDF login flow...
-`),s.log(`\u{1F4E1} Fetching OpenID configuration from ${t.authority}...`);let y=await ip(n,t),h=a(),S=await c(h),w=l(),C={redirect_uri:t.redirectUri,scope:t.scope??qn,code_challenge:S,code_challenge_method:"S256",state:w};e&&(C.organization_hint=e);let v=p(y,C).toString(),R=await d(t.certDir);e&&s.log(`\u{1F3E2} Organization: ${e}`),s.log(`\u{1F680} Opening browser for authentication...
-`);try{await u(v)}catch($){let b=$ instanceof Error?$.message:String($);s.error("\u274C Failed to open browser automatically."),s.error(`  Reason: ${b}`),s.error(`Please open this URL manually:
-`),s.error(v),s.error("")}return f(t,R,y,h,w)}r(Xr,"loginImpl");var zn={...Jn,scope:`${qn} offline_access`},pp=3600,dp=720*60*60;function Qr(e){return ap(new URL(e.authority),e.clientId,void 0,sp())}r(Qr,"discoverDefault");function Zr(e){let t=typeof e=="string"?Number(e):e;return typeof t=="number"&&Number.isFinite(t)?t:void 0}r(Zr,"asSeconds");function ei(e,t,n=new Date,o={}){let i=t.access_token?A.from(t.access_token):null;if(!i)throw new m("Login succeeded but no access token was returned.",{hint:"The identity provider did not return an access token. Please try logging in again."});let s=t.refresh_token?A.from(t.refresh_token):o.previousRefreshToken;if(!s)throw new m("Login succeeded but no refresh token was returned.",{hint:"The identity provider may not support the `offline_access` scope, which is required for persisted sessions."});let a=n.getTime(),c=(Zr(t.expires_in)??pp)*1e3,l=(Zr(t.refresh_expires_in)??dp)*1e3;return{version:It,org:e.org,accessToken:i,refreshToken:s,accessTokenExpiresAt:new Date(a+c).toISOString(),refreshTokenExpiresAt:new Date(a+l).toISOString()}}r(ei,"buildSession");async function ti(e,t={}){let{login:n=r((s,a)=>at(s,a),"login"),now:o=r(()=>new Date,"now")}=t,i=await n(e.org,zn);return ei(e,i,o())}r(ti,"loginForSession");async function ni(e,t={}){let{discovery:n=Qr,tokenRevocation:o=r((s,a)=>cp(s,a.expose()),"tokenRevocation")}=t,i=await n(zn);await o(i,e)}r(ni,"revokeRefreshToken");async function oi(e,t={}){let n=t.discovery??Qr,o=t.refreshTokenGrant??((c,l)=>lp(c,l.expose())),i=t.now??(()=>new Date),s=await n(zn),a=await o(s,e.refreshToken);return ei({org:e.org},a,i(),{previousRefreshToken:e.refreshToken})}r(oi,"refreshSession");function ri(e){if(typeof e!="object"||e===null)return!1;if("error"in e&&typeof e.error=="string"&&e.error==="invalid_grant")return!0;if(e instanceof Error)return/invalid_grant/i.test(e.message);let t="message"in e&&typeof e.message=="string"?e.message:"";return/invalid_grant/i.test(t)}r(ri,"isInvalidGrant");var up="https://auth.cognite.com",Wn=class Wn extends Error{constructor(n,o,i){super(o,i);this.kind=n;this.name="SessionVerificationError"}};r(Wn,"SessionVerificationError");var Ge=Wn;function mp(e){return e instanceof Error?"cause"in e&&e.cause instanceof Error?e.cause.message:e.message:String(e)}r(mp,"describeTransportError");function gp(e){return!(typeof e!="object"||e===null||"sub"in e&&typeof e.sub!="string"||"email"in e&&typeof e.email!="string"||"name"in e&&typeof e.name!="string"||"preferred_username"in e&&typeof e.preferred_username!="string")}r(gp,"isJwtClaims");function fp(e){try{let t=e.expose().split(".");if(t.length!==3)return{};let n=JSON.parse(Buffer.from(t[1],"base64url").toString("utf-8"));return gp(n)?n:{}}catch{return{}}}r(fp,"decodeJwtClaims");function yp(e){return typeof e!="object"||e===null?!1:"items"in e?Array.isArray(e.items)?e.items.every(t=>typeof t=="object"&&t!==null&&"name"in t&&typeof t.name=="string"):!1:!0}r(yp,"isCogIdpProjectsResponse");function hp(e){if(e)try{return new URL(e).host}catch{return}}r(hp,"clusterFromApiUrl");async function Mt(e,t={}){let n=t.fetch??globalThis.fetch,o=`${up}/api/v0/orgs/${encodeURIComponent(e.org)}/projects`,i;try{i=await n(o,{headers:{Authorization:`Bearer ${e.accessToken.expose()}`}})}catch(p){throw new Ge("unreachable",mp(p),{cause:p})}if(!i.ok)throw new Ge("rejected",`CogIdP rejected the token: ${i.status} ${i.statusText}`);let s=await i.json(),c=((yp(s)?s:{}).items??[]).map(p=>({name:p.name,cluster:hp(p.apiUrl),...p.isDefault?{isDefault:!0}:{}})),l=fp(e.accessToken);return{sub:l.sub??"unknown",email:l.email,name:l.name,preferredUsername:l.preferred_username,projects:c}}r(Mt,"fetchSessionUserInfo");var vp=3e4,Xn=class Xn extends m{constructor(t){super("Your session has expired.",{hint:"Run `cognite auth login` to sign in again.",shouldReport:!1,...t===void 0?{}:{cause:t}}),this.name="SessionExpiredError"}};r(Xn,"SessionExpiredError");var Le=Xn;function Ut(e){return new Le(e)}r(Ut,"expiredError");async function Cp(e,t,n){let o=await e(Sp.dirname(t),{stale:vp,retries:{retries:10,factor:1.5,minTimeout:100,maxTimeout:1e3}});try{return await n()}finally{await o()}}r(Cp,"withSessionLock");async function Ye(e={}){let t=e.readSession??(()=>it()),n=e.now??(()=>new Date),o=e.sessionFile??F().sessionFile,i=e.lock??wp,s=await t();if(!s)return;let a=Fe(s,n());if(a==="EXPIRED")throw Ut();return a==="VALID"?s:Cp(i,o,async()=>{let c=await t()??s,l=Fe(c,n());if(l==="EXPIRED")throw Ut();return l==="VALID"?c:Ap(c,e)})}r(Ye,"ensureFreshSession");async function Ap(e,t){let n=t.readSession??(()=>it()),o=t.writeSession??(s=>Tt(s)),i=t.refreshSession??(s=>oi(s));try{let s=await i(e);return await o(s),s}catch(s){if(!ri(s))throw s;let a=await n();if(a&&!a.refreshToken.equals(e.refreshToken))try{let c=await i(a);return await o(c),c}catch(c){throw Ut(c)}throw Ut(s)}}r(Ap,"refreshAndPersist");import{CogniteClient as vi}from"@cognite/sdk";function O(e=process.env){return e.COGNITE_ALPHA_ENABLE_SESSION_AUTH?.trim().toLowerCase()==="true"}r(O,"isSessionAuthEnabled");var ii="https://docs.cognite.com/cdf/access/";function Y(e){return e!==null&&typeof e=="object"}r(Y,"isRecord");function le(e){return e instanceof Error&&"status"in e&&typeof e.status=="number"}r(le,"isHttpError");function Zn(e){return Y(e.data)?e.data:void 0}r(Zn,"httpErrorResponseBody");function si(e){let t=Zn(e);if(!t)return;let n=t.error;if(Y(n)&&typeof n.message=="string")return n.message;if(typeof t.message=="string")return t.message}r(si,"cdfApiErrorMessage");function bp(e){switch(e){case 401:return`Your credentials are invalid or expired. Check your client ID and secret.
-  See: ${ii}`;case 403:return`You don't have the required CDF capabilities. Please contact your CDF admin.
-  See: ${ii}`;default:return}}r(bp,"httpStatusHint");function pe(e){let t=e instanceof Error?e:new Error(String(e));if(!le(t))return null;let n=bp(t.status);return n?Object.assign(new Error(`${t.message}
-  ${n}`),{cause:t}):null}r(pe,"enrichedHttpError");function Ep(e){if(!Y(e))return null;let t=e.missing;if(Array.isArray(t))return t;let n=e.data;if(Y(n)){let o=n.error;if(Y(o)&&Array.isArray(o.missing))return o.missing;if(Array.isArray(n.missing))return n.missing}return null}r(Ep,"findMissingArray");function xp(e,t){if(!le(e)||e.status!==400)return!1;let n=Ep(e);return n?n.some(o=>Y(o)&&typeof o.externalId=="string"&&t.includes(o.externalId)):!1}r(xp,"isMissingExternalIdError");function _t(e,t){return le(e)&&e.status===404||xp(e,t)}r(_t,"isNotFoundError");var ci=["DRAFT","PUBLISHED","DEPRECATED","ARCHIVED"],li=["ACTIVE","PREVIEW"],Qn=class Qn extends Error{constructor(t,n){super(`Version ${n} of app ${t} not found`),this.name="AppVersionNotFoundError",this.appExternalId=t,this.version=n}};r(Qn,"AppVersionNotFoundError");var ee=Qn,eo=class eo extends Error{constructor(t){super(`App ${t} not found`),this.name="AppNotFoundError",this.appExternalId=t}};r(eo,"AppNotFoundError");var qe=eo;function jt(e,t){return e.includes(t)}r(jt,"includesValue");function kp(e){return jt(ci,e)}r(kp,"isAppVersionLifecycleState");function Pp(e){return jt(li,e)}r(Pp,"isAppVersionAlias");function Ip(e){return typeof e.version=="string"&&kp(e.lifecycleState)&&typeof e.entrypoint=="string"&&typeof e.createdTime=="number"&&typeof e.createdBy=="string"&&typeof e.appExternalId=="string"&&(e.alias===void 0||Pp(e.alias))&&(e.comment===void 0||typeof e.comment=="string")}r(Ip,"isAppVersion");function ai(e){if(!Y(e)){let t=JSON.stringify(e)?.slice(0,200)??String(e);throw new Error(`Invalid version response: expected object, got ${t}`)}if(!Ip(e)){let t=JSON.stringify(e).slice(0,300);throw new Error(`Invalid version response: missing or malformed fields. Got: ${t}`)}return e}r(ai,"parseAppVersion");function Dp(e){if(!Y(e))throw new Error("Invalid app response: not an object");let{externalId:t,name:n,description:o}=e;if(typeof t!="string")throw new Error("Invalid app response: missing externalId");if(typeof n!="string")throw new Error("Invalid app response: missing name");if(o!=null&&typeof o!="string")throw new Error("Invalid app response: malformed description");return{externalId:t,name:n,description:typeof o=="string"?o:void 0}}r(Dp,"parseAppMetadata");var to=class to{constructor(t){this.client=t}get appsBasePath(){return`/api/v1/projects/${encodeURIComponent(this.client.project)}/apphosting/apps`}async createApp(t,n,o){try{await this.client.post(this.appsBasePath,{data:{items:[{externalId:t,name:n,description:o}]}})}catch(i){throw pe(i)??i}}async updateApps(t){try{await this.client.post(`${this.appsBasePath}/update`,{data:{items:t}})}catch(n){throw pe(n)??n}}async getApp(t){let n=`${this.appsBasePath}/${encodeURIComponent(t)}`;try{let o=await this.client.get(n);return Dp(o.data)}catch(o){throw _t(o,[t])?new qe(t):pe(o)??o}}async uploadVersion(t,n,o,i,s="index.html"){console.log(`\u{1F4E4} Uploading version ${n}...`);let a=new FormData;a.append("file",new Blob([new Uint8Array(o)]),i),a.append("version",n),a.append("entryPath",s);let c=encodeURIComponent(t),l=`${this.appsBasePath}/${c}/versions`,p=await this.client.authenticate();if(!p)throw new m("Failed to authenticate for upload",{hint:"Check your credentials and try again."});let d=A.from(p),u=`${this.client.getBaseUrl()}${l}`,f=new AbortController,g=setTimeout(()=>f.abort(),300*1e3),y;try{y=await fetch(u,{method:"POST",headers:{Authorization:`Bearer ${d.expose()}`},body:a,signal:f.signal})}catch(h){throw h instanceof Error&&h.name==="AbortError"?new m("Upload timed out after 5 minutes",{hint:"The upload took longer than 5 minutes. Try again \u2014 if it keeps timing out, check your network speed or bundle size."}):new m(`Failed to upload version to ${u}`,{cause:h,hint:"Check your network connection. Uploads can also fail behind a proxy that blocks multipart POST requests."})}finally{clearTimeout(g)}if(!y.ok){let h=await y.text(),S;try{S=JSON.parse(h)}catch{}let w=h;if(Y(S)){let $=S.error;if(typeof $=="string")w=$;else if(Y($)){let b=$.message,k=$.code;w=typeof b=="string"?b:k!=null?`Unknown error (code: ${k})`:h}else{let b=S.message;w=typeof b=="string"?b:h}}let C=y.headers.get("x-request-id"),v=C?` | X-Request-ID: ${C}`:"",R=Y(S)?S:h;throw new fe(`Upload failed: ${y.status} \u2014 ${w}${v}`,{httpStatusCode:y.status,requestUrl:u,responseBody:R})}console.log(`\u2705 Version ${n} uploaded`)}async getVersion(t,n){let o=encodeURIComponent(t),i=encodeURIComponent(n),s=`${this.appsBasePath}/${o}/versions/${i}`;try{let a=await this.client.get(s);return ai(a.data)}catch(a){throw _t(a,[t,n])?new ee(t,n):pe(a)??a}}async getActiveVersion(t){let n=encodeURIComponent(t),o=`${this.appsBasePath}/${n}/versions/list`;try{let i=await this.client.post(o,{data:{filter:{aliases:["ACTIVE"]}}});if(!Y(i.data)||!Array.isArray(i.data.items))throw new Error("Invalid versions/list response: expected an object with an items array");let{items:s}=i.data;if(s.length===0)return null;if(s.length>1)throw new Error(`Unexpected response: ${s.length} versions have the ACTIVE alias, expected at most 1`);return ai(s[0])}catch(i){if(_t(i,[t]))return null;throw pe(i)??i}}async deleteVersions(t,n){let o=encodeURIComponent(t),i=`${this.appsBasePath}/${o}/versions/delete`;try{await this.client.post(i,{data:{items:n.map(s=>({version:s}))}})}catch(s){throw pe(s)??s}}async updateVersions(t,n){let o=encodeURIComponent(t),i=`${this.appsBasePath}/${o}/versions/update`;try{await this.client.post(i,{data:{items:n}})}catch(s){throw pe(s)??s}}async submitSignatures(t,n,o){let i=encodeURIComponent(t),s=encodeURIComponent(n),a=`${this.appsBasePath}/${i}/versions/${s}/signatures`;try{await this.client.post(a,{data:{items:o}})}catch(c){throw pe(c)??c}}async listSignatures(t,n){let o=encodeURIComponent(t),i=encodeURIComponent(n),s=`${this.appsBasePath}/${o}/versions/${i}/signatures/list`;try{let a=await this.client.post(s,{data:{}});return $p(a.data)}catch(a){throw pe(a)??a}}};r(to,"AppHostingApi");var Nt=to,Tp=["VALID","REVOKED","EXPIRED","SIGNED_BEFORE_KEY_ISSUED","IAT_IN_FUTURE","BUNDLE_TOO_OLD","KEY_NOT_IN_REGISTRY","SCOPE_MISMATCH","VERIFICATION_FAILED"],Rp=["developer","certifier"];function $p(e){if(!Y(e))throw new Error("Invalid signatures response: expected an object with an items array");let{items:t}=e;if(!Array.isArray(t))throw new Error("Invalid signatures response: items property is missing or not an array");return t.flatMap(n=>{let o=Op(n);return o?[o]:[]})}r($p,"parseStoredSignatures");function Op(e){if(!Y(e))return null;let{signerKid:t,signerRole:n,signatureIat:o,receivedAt:i,createdTime:s,status:a}=e;return typeof t!="string"||t===""||!jt(Rp,n)||typeof o!="number"||typeof i!="number"||typeof s!="number"||!jt(Tp,a)?null:{signerKid:t,signerRole:n,signatureIat:o,receivedAt:i,createdTime:s,status:a}}r(Op,"parseStoredSignature");function no(e,t){let n=[];e.name!==t.name&&n.push({field:"name",remote:e.name,local:t.name});let o=e.description??"";return o!==t.description&&n.push({field:"description",remote:o,local:t.description}),n}r(no,"diffAppMetadata");function Fp(e){let t=["Cannot deploy: metadata in app.json differs from what's deployed:"];for(let{field:n,remote:o,local:i}of e){let s=`${n}:`.padEnd(14);t.push(`   ${s}"${o}" \u2192 "${i}"`)}return t.join(`
-`)}r(Fp,"formatMetadataDriftError");var oo=class oo{constructor(t){this.api=new Nt(t)}getVersion(t,n){return this.api.getVersion(t,n)}uploadVersion(t,n,o,i,s){return this.api.uploadVersion(t,n,o,i,s)}async ensureApp(t,n,o){console.log("\u{1F50D} Ensuring app exists...");try{await this.api.createApp(t,n,o),console.log(`\u2705 App '${t}' created`)}catch(i){if(le(i)&&i.status===409){console.log(`\u2705 App '${t}' already exists`),await this.checkMetadataDrift(t,n,o);return}throw i}}async checkMetadataDrift(t,n,o){let i;try{i=await this.getApp(t)}catch{return}let s=no(i,{name:n,description:o});if(s.length!==0)throw new m(Fp(s),{hint:"Run npx @cognite/cli apps metadata update to sync before deploying",shouldReport:!1})}getApp(t){return this.api.getApp(t)}async updateAppMetadata(t,n,o){await this.api.updateApps([{externalId:t,update:{name:{set:n},description:o?{set:o}:{setNull:!0}}}])}async submitSignatures(t,n,o){o.length!==0&&(console.log(`\u{1F50F} Submitting ${o.length} signature${o.length===1?"":"s"} for version ${n}...`),await this.api.submitSignatures(t,n,o),console.log("\u2705 Signatures stored"))}listSignatures(t,n){return this.api.listSignatures(t,n)}async publishVersion(t,n){await this.api.updateVersions(t,[{version:n,update:{lifecycleState:{set:"PUBLISHED"}}}])}async publishAndActivate(t,n){console.log(`\u{1F680} Publishing and activating version ${n}...`),await this.api.updateVersions(t,[{version:n,update:{lifecycleState:{set:"PUBLISHED"},alias:{set:"ACTIVE"}}}]),console.log(`\u2705 Version ${n} is now PUBLISHED and ACTIVE`)}getActiveVersion(t){return this.api.getActiveVersion(t)}async deactivateVersion(t,n){await this.api.updateVersions(t,[{version:n,update:{alias:{setNull:!0}}}])}async deleteVersion(t,n){await this.api.deleteVersions(t,[n])}async deprecateVersion(t,n){await this.api.updateVersions(t,[{version:n,update:{lifecycleState:{set:"DEPRECATED"}}}])}async archiveVersion(t,n){await this.api.updateVersions(t,[{version:n,update:{lifecycleState:{set:"ARCHIVED"}}}])}async activateVersion(t,n){let o=null;try{o=await this.api.getActiveVersion(t)}catch{o=null}let i=o&&o.version!==n?o.version:void 0;return await this.api.updateVersions(t,[{version:n,update:{alias:{set:"ACTIVE"}}}]),{supersededVersion:i}}async deploy(t,n,o,i,s,a,c=!1){console.log(`
+  </body></html>`}r(fo,"generateHtml");import _p from"net";function ki(e,t){return new Promise(n=>{let o=new _p.Socket,i=r(s=>{o.removeAllListeners(),o.destroy(),n(s)},"done");o.setTimeout(500),o.once("connect",()=>i(!1)),o.once("timeout",()=>i(!0)),o.once("error",()=>i(!0)),o.connect(e,t)})}r(ki,"isHostPortFree");function Vt(e){return`Port ${e} is already in use. Pin another callback port with --port <port> \u2014 supported ports are ${dt}.`}r(Vt,"freePortHint");async function Pi(e){if(e<0)throw new Error(`Invalid port: ${e}`);return e===0?!0:(await Promise.all([ki(e,"127.0.0.1"),ki(e,"::1")])).every(Boolean)}r(Pi,"isPortFree");async function Bp(e,t,n,o,i,s){let{authorizationCodeGrant:a,logger:c}=s,l=new URL(e.url??"/",`http://${e.headers.host??"localhost"}`);if(l.pathname!=="/")return t.writeHead(404),t.end("Not found"),{shouldClose:!1};try{c.log("\u{1F504} Exchanging authorization code for tokens...");let p=await a(n,l,{pkceCodeVerifier:o,expectedState:i});return t.writeHead(200,{"Content-Type":"text/html",Connection:"close"}),t.end(fo("success","Login Successful!","You can close this window and return to the terminal.")),{shouldClose:!0,tokens:p}}catch(p){let d=p instanceof Error?p:new Error(String(p));return t.writeHead(400,{"Content-Type":"text/html",Connection:"close"}),t.end(fo("error","Authentication Error",d.message)),{shouldClose:!0,error:d}}}r(Bp,"handleCallback");function Kp(e){let t=e/6e4,n=Math.round(t*10)/10;return`${n} ${n===1?"minute":"minutes"}`}r(Kp,"formatTimeoutMinutes");function Ti(e,t,n,o,i={createServer:jp.createServer,setTimeout:globalThis.setTimeout,clearTimeout:globalThis.clearTimeout,authorizationCodeGrant:Hp,logger:console}){let{createServer:s,setTimeout:a,clearTimeout:c,logger:l}=i;return new Promise((p,d)=>{let u=s(async(g,y)=>{try{let S=await Bp(g,y,t,n,o,i);S.shouldClose&&(h(),S.error?d(S.error):S.tokens?p(S.tokens):d(new Error("No tokens received")))}catch(S){h(),d(S instanceof Error?S:new Error(String(S)))}}),f=a(()=>{h(),d(new Error(`Login timeout - no response received within ${Kp(e.loginTimeout)}`))},e.loginTimeout);function h(){c(f),u.close(),u.closeIdleConnections?.()}r(h,"cleanup"),u.on("error",g=>{h(),g.code==="EADDRINUSE"||g.code==="EACCES"?d(new m(`Port ${e.port} is already in use \u2014 the login callback server cannot start`,{cause:g,hint:Vt(e.port)})):d(new m(`Login callback server failed: ${g.message}`,{cause:g}))}),u.listen(e.port,"127.0.0.1",()=>{l.log(`\u{1F310} Local HTTP server started on http://localhost:${e.port}`)})})}r(Ti,"startCallbackServer");import{spawn as Gp}from"child_process";import Yp from"open";import{parseArgsStringToArgv as zp}from"string-argv";function Vp(e){try{return new URL(e),!0}catch{return!1}}r(Vp,"isValidUrl");function Ri(e,t="url"){if(!Vp(e))throw new Error(`${t} must be a valid URL, got: ${e}`);return e}r(Ri,"parseUrl");var qp=5e3;async function Ii(e,t={}){let{open:n=Yp,spawn:o=r((p,d)=>{let u=Gp(p,d,{stdio:"ignore",detached:!0});return u.unref(),u},"spawn"),platform:i=process.platform,env:s=process.env,setTimeout:a=globalThis.setTimeout,clearTimeout:c=globalThis.clearTimeout}=t,l=s.BROWSER?.trim();if(i==="win32"&&l){let[p,...d]=zp(l);if(!p){await n(e);return}Ri(e,"openBrowser target"),await Jp(o,p,[...d,e],a,c);return}await n(e)}r(Ii,"openBrowser");function Jp(e,t,n,o,i){return new Promise((s,a)=>{let c=e(t,n),l=o(()=>{a(new Error(`Timed out waiting for "${t}" to spawn`))},qp);c.once("error",p=>{i(l),a(p)}),c.once("spawn",()=>{i(l),s()})})}r(Jp,"spawnBrowser");var ho="openid profile email";function yo(e){return`http://localhost:${e}/`}r(yo,"callbackRedirectUri");function nd(e=process.env){let t=e.COGNITE_IDP_BASE_URL?.trim();return t?t.replace(/\/+$/,""):"https://auth.cognite.com"}r(nd,"resolveIdpBaseUrl");var So=nd(),wo={authority:So,clientId:"0404baaa-0a90-43a2-aba7-a110b53fb41c",redirectUri:yo(3e3),port:3e3,loginTimeout:300*1e3},od={open:Ii,startCallbackServer:Ti,isPortFree:Pi,discovery:Xp,buildAuthorizationUrl:Wp,randomPKCECodeVerifier:ed,calculatePKCECodeChallenge:Zp,randomState:td,logger:console,telemetry:jt()};async function Gt(e,t=wo,n){return n===void 0?$i(e,t,od):$i(e,t,n)}r(Gt,"login");async function rd(e,t){let{discovery:n}=e;try{return await n(new URL(t.authority),t.clientId,void 0,Qp())}catch(o){throw new m(`Failed to fetch OpenID configuration from ${t.authority}`,{cause:o})}}r(rd,"fetchOpenIdConfig");async function $i(e,t,n){let{isPortFree:o,telemetry:i,logger:s,randomPKCECodeVerifier:a,calculatePKCECodeChallenge:c,randomState:l,buildAuthorizationUrl:p,open:d,startCallbackServer:u}=n;if(!await o(t.port))throw i?.track("Flows.CLI.PortInUse",{port:t.port}),new m(`Port ${t.port} is already in use \u2014 the login callback server cannot start`,{hint:Vt(t.port)});s.log(`\u{1F510} Starting CDF login flow...
+`),s.log(`\u{1F4E1} Fetching OpenID configuration from ${t.authority}...`);let h=await rd(n,t),g=a(),y=await c(g),S=l(),w={redirect_uri:t.redirectUri,scope:t.scope??ho,code_challenge:y,code_challenge_method:"S256",state:S};e&&(w.organization_hint=e);let v=p(h,w).toString();e&&s.log(`\u{1F3E2} Organization: ${e}`),s.log(`\u{1F680} Opening browser for authentication...
+`);try{await d(v)}catch(C){let x=C instanceof Error?C.message:String(C);s.error("\u274C Failed to open browser automatically."),s.error(`  Reason: ${x}`),s.error(`Please open this URL manually:
+`),s.error(v),s.error("")}return u(t,h,g,S)}r($i,"loginImpl");var Yt={...wo,scope:`${ho} offline_access`},ld=3600,pd=1500*60;function Fi(e){return sd(new URL(e.authority),e.clientId,void 0,id())}r(Fi,"discoverDefault");function Oi(e){let t=typeof e=="string"?Number(e):e;return typeof t=="number"&&Number.isFinite(t)?t:void 0}r(Oi,"asSeconds");function Li(e,t,n=new Date,o={}){let i=t.access_token?b.from(t.access_token):null;if(!i)throw new m("Login succeeded but no access token was returned.",{hint:"The identity provider did not return an access token. Please try logging in again."});let s=t.refresh_token?b.from(t.refresh_token):o.previousRefreshToken;if(!s)throw new m("Login succeeded but no refresh token was returned.",{hint:"The identity provider may not support the `offline_access` scope, which is required for persisted sessions."});let a=n.getTime(),c=(Oi(t.expires_in)??ld)*1e3,l=(Oi(t.refresh_expires_in)??pd)*1e3;return{version:Mt,org:e.org,accessToken:i,refreshToken:s,accessTokenExpiresAt:new Date(a+c).toISOString(),refreshTokenExpiresAt:new Date(a+l).toISOString()}}r(Li,"buildSession");async function Mi(e,t={}){if(e.port!==void 0&&!Bt(e.port))throw new m(Kt(e.port));let{login:n=r((a,c)=>Gt(a,c),"login"),now:o=r(()=>new Date,"now")}=t,i=e.port===void 0?Yt:{...Yt,port:e.port,redirectUri:yo(e.port)},s=await n(e.org,i);return Li(e,s,o())}r(Mi,"loginForSession");async function Ui(e,t={}){let{discovery:n=Fi,tokenRevocation:o=r((s,a)=>ad(s,a.expose()),"tokenRevocation")}=t,i=await n(Yt);await o(i,e)}r(Ui,"revokeRefreshToken");async function Ni(e,t={}){let n=t.discovery??Fi,o=t.refreshTokenGrant??((c,l)=>cd(c,l.expose())),i=t.now??(()=>new Date),s=await n(Yt),a=await o(s,e.refreshToken);return Li({org:e.org},a,i(),{previousRefreshToken:e.refreshToken})}r(Ni,"refreshSession");function _i(e){if(typeof e!="object"||e===null)return!1;if("error"in e&&typeof e.error=="string"&&e.error==="invalid_grant")return!0;if(e instanceof Error)return/invalid_grant/i.test(e.message);let t="message"in e&&typeof e.message=="string"?e.message:"";return/invalid_grant/i.test(t)}r(_i,"isInvalidGrant");var vo=class vo extends Error{constructor(n,o,i){super(o,i);this.kind=n;this.name="SessionVerificationError"}};r(vo,"SessionVerificationError");var Je=vo;function dd(e){return e instanceof Error?"cause"in e&&e.cause instanceof Error?e.cause.message:e.message:String(e)}r(dd,"describeTransportError");function ud(e){return!(typeof e!="object"||e===null||"sub"in e&&typeof e.sub!="string"||"email"in e&&typeof e.email!="string"||"name"in e&&typeof e.name!="string"||"preferred_username"in e&&typeof e.preferred_username!="string")}r(ud,"isJwtClaims");function md(e){try{let t=e.expose().split(".");if(t.length!==3)return{};let n=JSON.parse(Buffer.from(t[1],"base64url").toString("utf-8"));return ud(n)?n:{}}catch{return{}}}r(md,"decodeJwtClaims");function gd(e){return typeof e!="object"||e===null?!1:"items"in e?Array.isArray(e.items)?e.items.every(t=>typeof t=="object"&&t!==null&&"name"in t&&typeof t.name=="string"):!1:!0}r(gd,"isCogIdpProjectsResponse");function fd(e){if(e)try{return new URL(e).host}catch{return}}r(fd,"clusterFromApiUrl");async function zt(e,t={}){let n=t.fetch??globalThis.fetch,o=`${So}/api/v0/orgs/${encodeURIComponent(e.org)}/projects`,i;try{i=await n(o,{headers:{Authorization:`Bearer ${e.accessToken.expose()}`}})}catch(p){throw new Je("unreachable",dd(p),{cause:p})}if(!i.ok)throw new Je("rejected",`CogIdP rejected the token: ${i.status} ${i.statusText}`);let s=await i.json(),c=((gd(s)?s:{}).items??[]).map(p=>({name:p.name,cluster:fd(p.apiUrl),...p.isDefault?{isDefault:!0}:{}})),l=md(e.accessToken);return{sub:l.sub??"unknown",email:l.email,name:l.name,preferredUsername:l.preferred_username,projects:c}}r(zt,"fetchSessionUserInfo");var Sd=3e4,Co=class Co extends m{constructor(t){super("Your session has expired.",{hint:"Run `cognite auth login` to sign in again.",shouldReport:!1,...t===void 0?{}:{cause:t}}),this.name="SessionExpiredError"}};r(Co,"SessionExpiredError");var He=Co;function qt(e){return new He(e)}r(qt,"expiredError");async function wd(e,t,n){let o=await e(hd.dirname(t),{stale:Sd,retries:{retries:10,factor:1.5,minTimeout:100,maxTimeout:1e3}});try{return await n()}finally{await o()}}r(wd,"withSessionLock");async function We(e={}){let t=e.readSession??(()=>lt()),n=e.now??(()=>new Date),o=e.sessionFile??D().sessionFile,i=e.lock??yd,s=await t();if(!s)return;let a=je(s,n());if(a==="EXPIRED")throw qt();return a==="VALID"?s:wd(i,o,async()=>{let c=await t()??s,l=je(c,n());if(l==="EXPIRED")throw qt();return l==="VALID"?c:vd(c,e)})}r(We,"ensureFreshSession");async function vd(e,t){let n=t.readSession??(()=>lt()),o=t.writeSession??(s=>Nt(s)),i=t.refreshSession??(s=>Ni(s));try{let s=await i(e);return await o(s),s}catch(s){if(!_i(s))throw s;let a=await n();if(a&&!a.refreshToken.equals(e.refreshToken))try{let c=await i(a);return await o(c),c}catch(c){throw qt(c)}throw qt(s)}}r(vd,"refreshAndPersist");import{CogniteClient as nu}from"@cognite/sdk";var ji="https://docs.cognite.com/cdf/access/";function G(e){return e!==null&&typeof e=="object"}r(G,"isRecord");function se(e){return e instanceof Error&&"status"in e&&typeof e.status=="number"}r(se,"isHttpError");function Ao(e){return G(e.data)?e.data:void 0}r(Ao,"httpErrorResponseBody");function Hi(e){let t=Ao(e);if(!t)return;let n=t.error;if(G(n)&&typeof n.message=="string")return n.message;if(typeof t.message=="string")return t.message}r(Hi,"cdfApiErrorMessage");function Cd(e){switch(e){case 401:return`Your credentials are invalid or expired. Check your client ID and secret.
+  See: ${ji}`;case 403:return`You don't have the required CDF capabilities. Please contact your CDF admin.
+  See: ${ji}`;default:return}}r(Cd,"httpStatusHint");function fe(e){let t=e instanceof Error?e:new Error(String(e));if(!se(t))return null;let n=Cd(t.status);return n?Object.assign(new Error(`${t.message}
+  ${n}`),{cause:t}):null}r(fe,"enrichedHttpError");function Ad(e){if(!G(e))return null;let t=e.missing;if(Array.isArray(t))return t;let n=e.data;if(G(n)){let o=n.error;if(G(o)&&Array.isArray(o.missing))return o.missing;if(Array.isArray(n.missing))return n.missing}return null}r(Ad,"findMissingArray");function Ed(e,t){if(!se(e)||e.status!==400)return!1;let n=Ad(e);return n?n.some(o=>G(o)&&typeof o.externalId=="string"&&t.includes(o.externalId)):!1}r(Ed,"isMissingExternalIdError");function Jt(e,t){return se(e)&&e.status===404||Ed(e,t)}r(Jt,"isNotFoundError");var Ki=["DRAFT","PUBLISHED","DEPRECATED","ARCHIVED"],Vi=["ACTIVE","PREVIEW"],Eo=class Eo extends Error{constructor(t,n){super(`Version ${n} of app ${t} not found`),this.name="AppVersionNotFoundError",this.appExternalId=t,this.version=n}};r(Eo,"AppVersionNotFoundError");var te=Eo,bo=class bo extends Error{constructor(t){super(`App ${t} not found`),this.name="AppNotFoundError",this.appExternalId=t}};r(bo,"AppNotFoundError");var Ze=bo;function Wt(e,t){return e.includes(t)}r(Wt,"includesValue");function bd(e){return Wt(Ki,e)}r(bd,"isAppVersionLifecycleState");function xd(e){return Wt(Vi,e)}r(xd,"isAppVersionAlias");function kd(e){return typeof e.version=="string"&&bd(e.lifecycleState)&&typeof e.entrypoint=="string"&&typeof e.createdTime=="number"&&typeof e.createdBy=="string"&&typeof e.appExternalId=="string"&&(e.alias===void 0||xd(e.alias))&&(e.comment===void 0||typeof e.comment=="string")}r(kd,"isAppVersion");function Bi(e){if(!G(e)){let t=JSON.stringify(e)?.slice(0,200)??String(e);throw new Error(`Invalid version response: expected object, got ${t}`)}if(!kd(e)){let t=JSON.stringify(e).slice(0,300);throw new Error(`Invalid version response: missing or malformed fields. Got: ${t}`)}return e}r(Bi,"parseAppVersion");function Pd(e){if(!G(e))throw new Error("Invalid app response: not an object");let{externalId:t,name:n,description:o}=e;if(typeof t!="string")throw new Error("Invalid app response: missing externalId");if(typeof n!="string")throw new Error("Invalid app response: missing name");if(o!=null&&typeof o!="string")throw new Error("Invalid app response: malformed description");return{externalId:t,name:n,description:typeof o=="string"?o:void 0}}r(Pd,"parseAppMetadata");var xo=class xo{constructor(t){this.client=t}get appsBasePath(){return`/api/v1/projects/${encodeURIComponent(this.client.project)}/apphosting/apps`}async createApp(t,n,o){try{await this.client.post(this.appsBasePath,{data:{items:[{externalId:t,name:n,description:o}]}})}catch(i){throw fe(i)??i}}async updateApps(t){try{await this.client.post(`${this.appsBasePath}/update`,{data:{items:t}})}catch(n){throw fe(n)??n}}async getApp(t){let n=`${this.appsBasePath}/${encodeURIComponent(t)}`;try{let o=await this.client.get(n);return Pd(o.data)}catch(o){throw Jt(o,[t])?new Ze(t):fe(o)??o}}async uploadVersion(t,n,o,i,s="index.html"){console.log(`\u{1F4E4} Uploading version ${n}...`);let a=new FormData;a.append("file",new Blob([new Uint8Array(o)]),i),a.append("version",n),a.append("entryPath",s);let c=encodeURIComponent(t),l=`${this.appsBasePath}/${c}/versions`,p=await this.client.authenticate();if(!p)throw new m("Failed to authenticate for upload",{hint:"Check your credentials and try again."});let d=b.from(p),u=`${this.client.getBaseUrl()}${l}`,f=new AbortController,h=setTimeout(()=>f.abort(),300*1e3),g;try{g=await fetch(u,{method:"POST",headers:{Authorization:`Bearer ${d.expose()}`},body:a,signal:f.signal})}catch(y){throw y instanceof Error&&y.name==="AbortError"?new m("Upload timed out after 5 minutes",{hint:"The upload took longer than 5 minutes. Try again \u2014 if it keeps timing out, check your network speed or bundle size."}):new m(`Failed to upload version to ${u}`,{cause:y,hint:"Check your network connection. Uploads can also fail behind a proxy that blocks multipart POST requests."})}finally{clearTimeout(h)}if(!g.ok){let y=await g.text(),S;try{S=JSON.parse(y)}catch{}let w=y;if(G(S)){let M=S.error;if(typeof M=="string")w=M;else if(G(M)){let B=M.message,R=M.code;w=typeof B=="string"?B:R!=null?`Unknown error (code: ${R})`:y}else{let B=S.message;w=typeof B=="string"?B:y}}let v=g.headers.get("x-request-id"),C=v?` | X-Request-ID: ${v}`:"",x=G(S)?S:y;throw new de(`Upload failed: ${g.status} \u2014 ${w}${C}`,{httpStatusCode:g.status,requestUrl:u,responseBody:x})}console.log(`\u2705 Version ${n} uploaded`)}async getVersion(t,n){let o=encodeURIComponent(t),i=encodeURIComponent(n),s=`${this.appsBasePath}/${o}/versions/${i}`;try{let a=await this.client.get(s);return Bi(a.data)}catch(a){throw Jt(a,[t,n])?new te(t,n):fe(a)??a}}async getActiveVersion(t){let n=encodeURIComponent(t),o=`${this.appsBasePath}/${n}/versions/list`;try{let i=await this.client.post(o,{data:{filter:{aliases:["ACTIVE"]}}});if(!G(i.data)||!Array.isArray(i.data.items))throw new Error("Invalid versions/list response: expected an object with an items array");let{items:s}=i.data;if(s.length===0)return null;if(s.length>1)throw new Error(`Unexpected response: ${s.length} versions have the ACTIVE alias, expected at most 1`);return Bi(s[0])}catch(i){if(Jt(i,[t]))return null;throw fe(i)??i}}async deleteVersions(t,n){let o=encodeURIComponent(t),i=`${this.appsBasePath}/${o}/versions/delete`;try{await this.client.post(i,{data:{items:n.map(s=>({version:s}))}})}catch(s){throw fe(s)??s}}async updateVersions(t,n){let o=encodeURIComponent(t),i=`${this.appsBasePath}/${o}/versions/update`;try{await this.client.post(i,{data:{items:n}})}catch(s){throw fe(s)??s}}async submitSignatures(t,n,o){let i=encodeURIComponent(t),s=encodeURIComponent(n),a=`${this.appsBasePath}/${i}/versions/${s}/signatures`;try{await this.client.post(a,{data:{items:o}})}catch(c){throw fe(c)??c}}async listSignatures(t,n){let o=encodeURIComponent(t),i=encodeURIComponent(n),s=`${this.appsBasePath}/${o}/versions/${i}/signatures/list`;try{let a=await this.client.post(s,{data:{}});return Id(a.data)}catch(a){throw fe(a)??a}}};r(xo,"AppHostingApi");var Zt=xo,Td=["VALID","REVOKED","EXPIRED","SIGNED_BEFORE_KEY_ISSUED","IAT_IN_FUTURE","BUNDLE_TOO_OLD","KEY_NOT_IN_REGISTRY","SCOPE_MISMATCH","VERIFICATION_FAILED"],Rd=["developer","certifier"];function Id(e){if(!G(e))throw new Error("Invalid signatures response: expected an object with an items array");let{items:t}=e;if(!Array.isArray(t))throw new Error("Invalid signatures response: items property is missing or not an array");return t.flatMap(n=>{let o=Dd(n);return o?[o]:[]})}r(Id,"parseStoredSignatures");function Dd(e){if(!G(e))return null;let{signerKid:t,signerRole:n,signatureIat:o,receivedAt:i,createdTime:s,status:a}=e;return typeof t!="string"||t===""||!Wt(Rd,n)||typeof o!="number"||typeof i!="number"||typeof s!="number"||!Wt(Td,a)?null:{signerKid:t,signerRole:n,signatureIat:o,receivedAt:i,createdTime:s,status:a}}r(Dd,"parseStoredSignature");function ko(e,t){let n=[];e.name!==t.name&&n.push({field:"name",remote:e.name,local:t.name});let o=e.description??"";return o!==t.description&&n.push({field:"description",remote:o,local:t.description}),n}r(ko,"diffAppMetadata");function $d(e){let t=["Cannot deploy: metadata in app.json differs from what's deployed:"];for(let{field:n,remote:o,local:i}of e){let s=`${n}:`.padEnd(14);t.push(`   ${s}"${o}" \u2192 "${i}"`)}return t.join(`
+`)}r($d,"formatMetadataDriftError");var Po=class Po{constructor(t){this.api=new Zt(t)}getVersion(t,n){return this.api.getVersion(t,n)}uploadVersion(t,n,o,i,s){return this.api.uploadVersion(t,n,o,i,s)}async ensureApp(t,n,o){console.log("\u{1F50D} Ensuring app exists...");try{await this.api.createApp(t,n,o),console.log(`\u2705 App '${t}' created`)}catch(i){if(se(i)&&i.status===409){console.log(`\u2705 App '${t}' already exists`),await this.checkMetadataDrift(t,n,o);return}throw i}}async checkMetadataDrift(t,n,o){let i;try{i=await this.getApp(t)}catch{return}let s=ko(i,{name:n,description:o});if(s.length!==0)throw new m($d(s),{hint:"Run npx @cognite/cli apps metadata update to sync before deploying",shouldReport:!1})}getApp(t){return this.api.getApp(t)}async updateAppMetadata(t,n,o){await this.api.updateApps([{externalId:t,update:{name:{set:n},description:o?{set:o}:{setNull:!0}}}])}async submitSignatures(t,n,o){o.length!==0&&(console.log(`\u{1F50F} Submitting ${o.length} signature${o.length===1?"":"s"} for version ${n}...`),await this.api.submitSignatures(t,n,o),console.log("\u2705 Signatures stored"))}listSignatures(t,n){return this.api.listSignatures(t,n)}async publishVersion(t,n){await this.api.updateVersions(t,[{version:n,update:{lifecycleState:{set:"PUBLISHED"}}}])}async publishAndActivate(t,n){console.log(`\u{1F680} Publishing and activating version ${n}...`),await this.api.updateVersions(t,[{version:n,update:{lifecycleState:{set:"PUBLISHED"},alias:{set:"ACTIVE"}}}]),console.log(`\u2705 Version ${n} is now PUBLISHED and ACTIVE`)}getActiveVersion(t){return this.api.getActiveVersion(t)}async deactivateVersion(t,n){await this.api.updateVersions(t,[{version:n,update:{alias:{setNull:!0}}}])}async deleteVersion(t,n){await this.api.deleteVersions(t,[n])}async deprecateVersion(t,n){await this.api.updateVersions(t,[{version:n,update:{lifecycleState:{set:"DEPRECATED"}}}])}async archiveVersion(t,n){await this.api.updateVersions(t,[{version:n,update:{lifecycleState:{set:"ARCHIVED"}}}])}async activateVersion(t,n){let o=null;try{o=await this.api.getActiveVersion(t)}catch{o=null}let i=o&&o.version!==n?o.version:void 0;return await this.api.updateVersions(t,[{version:n,update:{alias:{set:"ACTIVE"}}}]),{supersededVersion:i}}async deploy(t,n,o,i,s,a,c=!1){console.log(`
 \u{1F680} Deploying application via App Hosting API...
 `),await this.ensureApp(t,n,o),await this.uploadVersion(t,i,s,a),c&&await this.publishAndActivate(t,i),console.log(`
-\u2705 Deployment successful!`)}};r(oo,"AppHostingClient");var U=oo;import Lp from"enquirer";function Mp(e){return`${e.org}/${e.project}`}r(Mp,"deploymentTarget");async function pi(e,t,n,o={isTTY:process.stdin.isTTY,confirm:r(i=>Lp.prompt({type:"confirm",name:"confirmed",message:i,initial:!1}),"confirm")}){if(!e.org)throw new Error("deployment org is not provided");if(!e.project)throw new Error("deployment project is not provided");let{isTTY:i,confirm:s}=o,a=Mp(e);if(t.confirmActionTarget!==void 0){if(t.confirmActionTarget===a)return;throw new m(`--confirm-action-target "${t.confirmActionTarget}" does not match the deployment this command resolved to ("${a}").`,{shouldReport:!1,hint:`Pass --confirm-action-target ${a} to ${n}.`})}if(console.warn(`
-Using session credentials \u2014 your token has access to all projects in the "${e.org}" organization.`),!i)throw new m("Session credentials detected but no TTY available for confirmation.",{shouldReport:!1,hint:"Pass --confirm-action-target <org/project> to skip the prompt, or configure deployClientId and deploySecretName in app.json."});let{confirmed:c}=await s(`Confirm ${n} to ${a}?`);if(!c)throw new m("Aborted.",{shouldReport:!1})}r(pi,"confirmActionTarget");import{CogniteClient as Yp}from"@cognite/sdk";function Up(e){return Math.floor(Math.random()*Math.min(2**e*250,15e3))}r(Up,"exponentialBackoffWithJitter");function _p(e){return new Promise(t=>setTimeout(t,e))}r(_p,"sleep");async function di(e,t={}){let n=t.maxAttempts??5,o=t.shouldRetry??(()=>!0),i=t.delayInMsCalculator??Up;if(n<1)throw new Error("`maxAttempts` must be 1 or greater");if(n>100)throw new Error("`maxAttempts` must be 100 or less");let s=1;for(;;)try{return await e()}catch(a){if(s>=n||!o(a))throw a;let c=i(s);t.onAttemptFail?.(a,s,c),await _p(c),s++}}r(di,"retryAsync");var jp="https://auth.cognite.com/oauth2/token",Np=r(e=>typeof e=="object"&&e!==null&&"access_token"in e&&typeof e.access_token=="string","hasAccessToken");async function ui({idp:e,tokenUrl:t,init:n,missingTokenHint:o}){let i;try{i=await di(()=>fetch(t,n),{maxAttempts:3})}catch(c){throw new m(`Failed to fetch access token from ${t}`,{cause:c})}if(!i.ok){let c=await i.text();throw new fe(`Failed to get token from ${e}: ${i.status} ${i.statusText}`,{httpStatusCode:i.status,requestUrl:t,responseBody:c})}let s=await i.text(),a;try{a=JSON.parse(s)}catch{throw new m(`Unexpected response from ${e} authentication (invalid JSON)`,{hint:o})}if(!Np(a))throw new m(`No access token in ${e} authentication response`,{hint:o});return A.from(a.access_token)}r(ui,"fetchOAuthToken");var Hp=r(()=>{let e=process.env.DEPLOYMENT_SECRETS;if(!e)return{};try{let t=JSON.parse(e),n={};for(let[o,i]of Object.entries(t))if(typeof i=="string"){let s=o.toLowerCase().replace(/_/g,"-");n[s]=i}return n}catch(t){return console.error("Error parsing DEPLOYMENT_SECRETS:",t),{}}},"loadSecretsFromEnv"),Bp=r(e=>{let t;if(process.env.DEPLOYMENT_SECRET&&(t=process.env.DEPLOYMENT_SECRET),t||(t=Hp()[e]),t||(t=process.env[e]),!t)throw new Error(`Secret not found in environment: ${e}`);return A.from(t)},"getSecretFromEnv"),Kp=r((e,t)=>{let n=t.expose();return ui({idp:"CDF",tokenUrl:jp,init:{method:"POST",headers:{Authorization:`Basic ${btoa(`${e}:${n}`)}`,"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"client_credentials"})},missingTokenHint:"Check the client ID in app.json and the deployment secret in your environment."})},"getTokenCdf"),mi=r(({idp:e,tokenUrl:t,clientId:n,clientSecret:o,scopes:i,missingTokenHint:s})=>ui({idp:e,tokenUrl:t,init:{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:n,client_secret:o,grant_type:"client_credentials",...i!==void 0?{scope:i.join(" ")}:{}})},missingTokenHint:s}),"getTokenWithClientCredentials"),Vp=r((e,t)=>{if(t!==void 0)return t.join(" ");if(!e)throw new Error("Entra ID authentication requires 'baseUrl' to be set in deployment configuration");try{return`${new URL(e).origin}/.default`}catch{throw new Error(`Entra ID authentication requires 'baseUrl' to be a valid CDF URL (e.g., https://cluster.cognitedata.com), got: ${e}`)}},"resolveEntraScope"),Gp=r((e,t,n,o,i)=>mi({idp:"Entra ID",tokenUrl:`https://login.microsoftonline.com/${n}/oauth2/v2.0/token`,clientId:e,clientSecret:t.expose(),scopes:i!==void 0?i:[Vp(o)],missingTokenHint:"Check the client ID and tenant ID in app.json and the deployment secret in your environment."}),"getTokenEntra"),ro=r(async(e,t=process.env)=>{if(t.COGNITE_TOKEN)return A.from(t.COGNITE_TOKEN);let{deployClientId:n,deploySecretName:o,idpType:i="cdf",tenantId:s,baseUrl:a,scopes:c,tokenUrl:l}=e,p=Bp(o);if(i==="oauth"){if(!l)throw new Error("OAuth authentication requires 'tokenUrl' in deployment configuration");return mi({idp:"OAuth",tokenUrl:l,clientId:n,clientSecret:p.expose(),scopes:c,missingTokenHint:"Check the tokenUrl, client ID, scopes, and deployment secret in app.json and your environment."})}if(i==="entra_id"){if(!s)throw new Error("Entra ID authentication requires 'tenantId' in deployment configuration");return Gp(n,p,s,a,c)}return Kp(n,p)},"getToken");async function Me(e,t,n=process.env,o){let i=await ro(e,n),s=n.COGNITE_BASE_URL??e.baseUrl,a=(o??(c=>new Yp(c)))({appId:t,project:e.project,baseUrl:s,oidcTokenProvider:r(async()=>i.expose(),"oidcTokenProvider")});return await a.authenticate(),a}r(Me,"getSdk");function io(e,t,n){return e?t.org&&e.org!==t.org?{reason:"DIFFERENT_ORG",org:void 0}:Fe(e,n)==="EXPIRED"?{reason:"SESSION_EXPIRED",org:void 0}:{org:e.org,reason:"VALID"}:{reason:"SESSION_MISSING",org:void 0}}r(io,"getSessionOrgIfValid");import qp from"enquirer";var Jp=r(e=>qp.prompt(e),"defaultPrompt");async function gi(e,t=Jp){let{choice:n}=await t({type:"select",name:"choice",message:"Authenticate as",choices:[{name:"session",message:`Reuse existing session for ${e}`},{name:"browser",message:"Sign in via browser"}]});return n}r(gi,"promptAuthMode");async function Ht(e,t,n,o){let i=o({appId:t,project:e.project,baseUrl:e.baseUrl,oidcTokenProvider:r(async()=>n.expose(),"oidcTokenProvider")});return await i.authenticate(),i}r(Ht,"buildAuthenticatedClient");async function fi(e,t,n){let{loginFn:o,createClient:i}=n,s=t.orgHint||e.org||void 0,a=await o(s);return Ht(e,t.appId,A.from(a.access_token),i)}r(fi,"resolveViaBrowser");import{HttpError as zp}from"@cognite/sdk";import{array as yi,number as Wp,object as hi,optional as Xp,safeParse as Zp,string as Qp}from"valibot";var ed=hi({projects:Xp(yi(hi({projectUrlName:Qp(),groups:yi(Wp())})))});function td(e,t){switch(e){case 401:return"Run `cognite auth login` to log in.";case 403:return"The token is valid but lacks access to this project. Ask your CDF admin to grant its service account access.";default:return e>=500?`${t} returned a server error \u2014 this is usually transient, so try again shortly.`:"Check that the deployment base URL and project in app.json are correct."}}r(td,"hintForStatus");var Si=r(async function(e){let t=e.getBaseUrl(),n;try{({data:n}=await e.get("/api/v1/token/inspect"))}catch(i){throw i instanceof zp?new m(`Could not verify project access against ${t} (${i.status}).`,{hint:td(i.status,t),cause:i}):new m(`Could not connect to ${t} to verify project access.`,{hint:"Check your network connection and verify that the base URL is correct.",cause:i})}let o=Zp(ed,n);if(!o.success)throw new m(`Unexpected response from ${t}/api/v1/token/inspect.`,{hint:"Retry; if it persists, your CLI may be out of date or a proxy is altering responses.",cause:new Error(JSON.stringify(o.issues))});return o.output},"inspectDeploymentToken");async function wi(e,t,n,o){if(!((await(o?.inspectToken||Si)(e)).projects??[]).some(c=>c.projectUrlName===t.project&&c.groups.length>0))throw new m(`Your session for organization "${n}" doesn't have access to project "${t.project}" on ${t.baseUrl}.`,{hint:`Check you signed in to the right organization, or have access to the project "${t.project}" within "${n}" organization; \`@cognite/cli auth status\` lists the projects you can reach within your already logged in session token.`})}r(wi,"assertProjectAccess");async function so(e,t,n,o){let i=await o.ensureFreshSession();if(!i)throw new m(`No credentials available for ${e.project} @ ${e.baseUrl}.`,{hint:"Run `cognite auth login` to login."});let s=await Ht(e,t,i.accessToken,o.createClient);return await wi(s,e,n),s}r(so,"resolveViaSession");async function _(e,t,n={}){let{isSessionAuthEnabled:o=O}=n;return o()?od(e,t,n):nd(e,t,n)}r(_,"buildAppHostingApiClient");var nd=r(async(e,t,n={})=>{let{login:o=at,getSdk:i=Me,createClient:s=r(a=>new vi(a),"createClient")}=n;if(t.interactive){let a=t.orgHint||e.org||void 0,c=await o(a),l=A.from(c.access_token),p=s({appId:t.appId,project:e.project,baseUrl:e.baseUrl,oidcTokenProvider:r(async()=>l.expose(),"oidcTokenProvider")});return await p.authenticate(),p}return i(e,t.appId)},"buildAppHostingApiClientWithoutSessionSupport");async function Bt(e,t,n={}){let o=await _(e,t,n);return new U(o)}r(Bt,"buildAppHostingClient");async function od(e,t,n={}){let{login:o=at,getSdk:i=Me,createClient:s=r(g=>new vi(g),"createClient"),readSessionMetadata:a=Se,ensureFreshSession:c=Ye,promptAuthMode:l=gi,confirmActionTarget:p=pi,now:d=r(()=>new Date,"now")}=n;if(t.interactive){let g=a(),{org:y}=io(g,e,d());return y&&await l(y)==="session"?so(e,t.appId,y,{ensureFreshSession:c,createClient:s}):fi(e,t,{loginFn:o,createClient:s})}if(e.deployClientId)return i(e,t.appId);let u=a();if(!u)throw new m(`No credentials available for ${e.project} @ ${e.baseUrl}.`,{hint:"Run `cognite auth login`, set deployClientId/deploySecretName in app.json, or pass --interactive."});let f=io(u,e,d());if(f.reason!=="VALID")throw rd(f.reason,u,e);if(!t.action)throw new Error("[internal] `action` is required on the persisted-session fallback path so confirmActionTarget runs. Pass `action` in the options given to buildAppHostingApiClient.");return await p(e,{confirmActionTarget:t.confirmActionTarget},t.action),so(e,t.appId,f.org,{ensureFreshSession:c,createClient:s})}r(od,"buildAppHostingClientWithSessionSupport");function rd(e,t,n){let o=`Run \`cognite auth login\` for "${n.org}", or pass --interactive.`;switch(e){case"SESSION_MISSING":return new m("Run `cognite auth login` to create a session.",{hint:"Alternatively, set deployClientId/deploySecretName in app.json, or pass --interactive."});case"SESSION_EXPIRED":return new m(`Your session for organization "${t.org}" has expired.`,{hint:o});case"DIFFERENT_ORG":return new m(`Your active session is for organization "${t.org}", but this command targets "${n.org}".`,{hint:o})}}r(rd,"sessionUnavailableError");import Ci from"enquirer";var Ai="Enter custom target...";function bi(e,t){let n=t.map((o,i)=>`  ${i}: ${o.org}/${o.project}`).join(`
+\u2705 Deployment successful!`)}};r(Po,"AppHostingClient");var U=Po;import Od from"enquirer";function Fd(e){return`${e.org}/${e.project}`}r(Fd,"targetLabel");var Xt=r(async function(e,t,n,o={isTTY:process.stdin.isTTY??!1,confirm:r(i=>Od.prompt({type:"confirm",name:"confirmed",message:i,initial:!1}),"confirm")}){let{isTTY:i,confirm:s}=o,a=Fd(e);if(t.confirmActionTarget!==void 0){if(t.confirmActionTarget===a)return;throw new m(`--confirm-action-target "${t.confirmActionTarget}" does not match the deployment this command resolved to ("${a}").`,{shouldReport:!1,hint:`Pass --confirm-action-target ${a} to ${n}.`})}if(console.warn(`
+Using session credentials \u2014 your token has access to all projects in the "${e.org}" organization.`),!i)throw new m("Session credentials detected but no TTY available for confirmation.",{shouldReport:!1,hint:"Pass --confirm-action-target <org/project> to skip the prompt, or configure deployClientId and deploySecretName in app.json."});let{confirmed:c}=await s(`Confirm ${n} to ${a}?`);if(!c)throw new m("Aborted.",{shouldReport:!1})},"confirmActionTarget");import Ld from"enquirer";var Md=r(e=>Ld.prompt(e),"defaultPrompt");function Ud(e){switch(e.method){case"client-credentials":return"Use client credentials from app.json";case"session":return`Reuse existing session for ${e.org}`;case"browser":return"One-off sign-in via browser (does not save a session; use `cognite auth login` for that)"}}r(Ud,"choiceLabel");async function Qt(e,t=Md){if(e.length===0)throw new m("No valid authentication method available.",{hint:"Run `cognite auth login` and authenticate to the correct organization, or set deployClientId/deploySecretName in app.json."});let n=e.map(a=>a.method);if(new Set(n).size!==n.length)throw new Error(`Cannot present a selection with duplicate method names (${n.join(", ")}).`);let o=Array.from(new Set(n)).join("|"),{choice:i}=await t({type:"select",name:"choice",message:`Multiple valid authentication methods detected (skip with --auth-method <${o}>). Authenticate with`,choices:e.map(a=>({name:a.method,message:Ud(a)}))}),s=e.find(a=>a.method===i);if(!s)throw new m(`Selected authentication method "${i}" was not offered.`,{hint:"Pass --auth-method to choose one of the offered methods explicitly."});return s}r(Qt,"promptAuthMethod");async function Gi(e,t,n,o={confirmActionTarget:Xt,promptAuthMethod:Qt,isTTY:process.stdin.isTTY??!1}){let{valid:i}=e;if(i.length===0)throw Nd(e,t);let s;if(n.authMethod){let a=i.find(c=>c.method===n.authMethod);if(!a)throw new m(`Pass --auth-method ${i.map(c=>c.method).join(" or --auth-method ")} \u2014 "${n.authMethod}" is not currently valid for ${t.project} @ ${t.baseUrl}.`,{hint:"Run `cognite auth login` for a session, set deployClientId/deploySecretName in app.json for client credentials, or pass --interactive for browser login."});s=a}else if(i.length===1)[s]=i;else if(o.isTTY)s=await o.promptAuthMethod(i);else throw new m(`Pass --auth-method ${i.map(a=>a.method).join("|")} to choose non-interactively \u2014 several are valid for ${t.project} @ ${t.baseUrl} and there is no TTY to prompt.`,{shouldReport:!1,hint:"Or re-run in an interactive terminal to pick from the prompt."});if(s.method==="session"&&n.action&&!n.interactive)await o.confirmActionTarget(t,{confirmActionTarget:n.confirmActionTarget},n.action);else if(n.confirmActionTarget!==void 0&&s.method!=="session")throw new m(`Remove --confirm-action-target \u2014 it only guards session credentials and is never validated against the selected deployment with ${s.method} authentication.`,{shouldReport:!1,hint:"Pass --auth-method session (or pick the session option at the prompt) if you meant to acknowledge a session target."});return s}r(Gi,"chooseAuthMethod");function Nd(e,t){let{invalidSession:n}=e;if(!n)return new m(`No credentials available for ${t.project} @ ${t.baseUrl}.`,{hint:"Run `cognite auth login`, set deployClientId/deploySecretName in app.json, or pass --interactive."});let o=`Run \`cognite auth login\` for "${t.org}", or pass --interactive.`;return n.reason==="SESSION_EXPIRED"?new m(`Your session for organization "${n.org}" has expired.`,{hint:o}):new m(`Your active session is for organization "${n.org}", but this command targets "${t.org}".`,{hint:o})}r(Nd,"createNoCredentialsError");function Yi(e,t,n){return e?t.org&&e.org!==t.org?{reason:"DIFFERENT_ORG",org:void 0}:je(e,n)==="EXPIRED"?{reason:"SESSION_EXPIRED",org:void 0}:{org:e.org,reason:"VALID"}:{reason:"SESSION_MISSING",org:void 0}}r(Yi,"getSessionOrgIfValid");function zi(e,t,n){let o=[];e.deployClientId&&o.push({method:"client-credentials",org:e.org});let i=n.readSessionMetadata(),s=Yi(i,e,n.now());return s.reason==="VALID"&&o.push({method:"session",org:s.org}),t.interactive&&o.push({method:"browser"}),i&&(s.reason==="SESSION_EXPIRED"||s.reason==="DIFFERENT_ORG")?{valid:o,invalidSession:{reason:s.reason,org:i.org}}:{valid:o}}r(zi,"validAuthMethods");import{CogniteClient as qd}from"@cognite/sdk";function _d(e){return Math.floor(Math.random()*Math.min(2**e*250,15e3))}r(_d,"exponentialBackoffWithJitter");function jd(e){return new Promise(t=>setTimeout(t,e))}r(jd,"sleep");async function qi(e,t={}){let n=t.maxAttempts??5,o=t.shouldRetry??(()=>!0),i=t.delayInMsCalculator??_d;if(n<1)throw new Error("`maxAttempts` must be 1 or greater");if(n>100)throw new Error("`maxAttempts` must be 100 or less");let s=1;for(;;)try{return await e()}catch(a){if(s>=n||!o(a))throw a;let c=i(s);t.onAttemptFail?.(a,s,c),await jd(c),s++}}r(qi,"retryAsync");var Hd="https://auth.cognite.com/oauth2/token",Bd=r(e=>typeof e=="object"&&e!==null&&"access_token"in e&&typeof e.access_token=="string","hasAccessToken");async function Ji({idp:e,tokenUrl:t,init:n,missingTokenHint:o}){let i;try{i=await qi(()=>fetch(t,n),{maxAttempts:3})}catch(c){throw new m(`Failed to fetch access token from ${t}`,{cause:c})}if(!i.ok){let c=await i.text();throw new de(`Failed to get token from ${e}: ${i.status} ${i.statusText}`,{httpStatusCode:i.status,requestUrl:t,responseBody:c})}let s=await i.text(),a;try{a=JSON.parse(s)}catch{throw new m(`Unexpected response from ${e} authentication (invalid JSON)`,{hint:o})}if(!Bd(a))throw new m(`No access token in ${e} authentication response`,{hint:o});return b.from(a.access_token)}r(Ji,"fetchOAuthToken");var Kd=r(e=>{let t=e.DEPLOYMENT_SECRETS;if(!t)return{};try{let n=JSON.parse(t),o={};for(let[i,s]of Object.entries(n))if(typeof s=="string"){let a=i.toLowerCase().replace(/_/g,"-");o[a]=s}return o}catch(n){return console.error("Error parsing DEPLOYMENT_SECRETS:",n),{}}},"loadSecretsFromEnv"),Vd=r((e,t)=>{let n;if(t.DEPLOYMENT_SECRET&&(n=t.DEPLOYMENT_SECRET),n||(n=Kd(t)[e]),n||(n=t[e]),!n)throw new m(`Set the ${e} environment variable (named by deploySecretName in app.json) to your deploy client secret, e.g. in a .env file.`,{shouldReport:!1,hint:"Alternatively, run `cognite auth login` to use your session, or pass --interactive for a one-off browser login."});return b.from(n)},"getSecretFromEnv"),Gd=r((e,t)=>{let n=t.expose();return Ji({idp:"CDF",tokenUrl:Hd,init:{method:"POST",headers:{Authorization:`Basic ${btoa(`${e}:${n}`)}`,"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"client_credentials"})},missingTokenHint:"Check the client ID in app.json and the deployment secret in your environment."})},"getTokenCdf"),Wi=r(({idp:e,tokenUrl:t,clientId:n,clientSecret:o,scopes:i,missingTokenHint:s})=>Ji({idp:e,tokenUrl:t,init:{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:n,client_secret:o,grant_type:"client_credentials",...i!==void 0?{scope:i.join(" ")}:{}})},missingTokenHint:s}),"getTokenWithClientCredentials"),Yd=r((e,t)=>{if(t!==void 0)return t.join(" ");if(!e)throw new Error("Entra ID authentication requires 'baseUrl' to be set in deployment configuration");try{return`${new URL(e).origin}/.default`}catch{throw new Error(`Entra ID authentication requires 'baseUrl' to be a valid CDF URL (e.g., https://cluster.cognitedata.com), got: ${e}`)}},"resolveEntraScope"),zd=r((e,t,n,o,i)=>Wi({idp:"Entra ID",tokenUrl:`https://login.microsoftonline.com/${n}/oauth2/v2.0/token`,clientId:e,clientSecret:t.expose(),scopes:i!==void 0?i:[Yd(o)],missingTokenHint:"Check the client ID and tenant ID in app.json and the deployment secret in your environment."}),"getTokenEntra"),To=r(async(e,t=process.env)=>{if(t.COGNITE_TOKEN)return b.from(t.COGNITE_TOKEN);let{deployClientId:n,deploySecretName:o,idpType:i="cdf",tenantId:s,baseUrl:a,scopes:c,tokenUrl:l}=e,p=Vd(o,t);if(i==="oauth"){if(!l)throw new Error("OAuth authentication requires 'tokenUrl' in deployment configuration");return Wi({idp:"OAuth",tokenUrl:l,clientId:n,clientSecret:p.expose(),scopes:c,missingTokenHint:"Check the tokenUrl, client ID, scopes, and deployment secret in app.json and your environment."})}if(i==="entra_id"){if(!s)throw new Error("Entra ID authentication requires 'tenantId' in deployment configuration");return zd(n,p,s,a,c)}return Gd(n,p)},"getToken");async function en(e,t,n=process.env,o){let i=await To(e,n),s=n.COGNITE_BASE_URL??e.baseUrl,a=(o??(c=>new qd(c)))({appId:t,project:e.project,baseUrl:s,oidcTokenProvider:r(async()=>i.expose(),"oidcTokenProvider")});return await a.authenticate(),a}r(en,"getSdk");async function tn(e,t,n,o){let i=o({appId:t,project:e.project,baseUrl:e.baseUrl,oidcTokenProvider:r(async()=>n.expose(),"oidcTokenProvider")});return await i.authenticate(),i}r(tn,"buildAuthenticatedClient");async function Zi(e,t,n){let{loginFn:o,createClient:i}=n,s=t.orgHint||e.org||void 0,a=await o(s);return tn(e,t.appId,b.from(a.access_token),i)}r(Zi,"resolveViaBrowser");import{HttpError as Jd}from"@cognite/sdk";import{array as Xi,number as Wd,object as Qi,optional as Zd,safeParse as Xd,string as Qd}from"valibot";var eu=Qi({projects:Zd(Xi(Qi({projectUrlName:Qd(),groups:Xi(Wd())})))});function tu(e,t){switch(e){case 401:return"Run `cognite auth login` to log in.";case 403:return"The token is valid but lacks access to this project. Ask your CDF admin to grant its service account access.";default:return e>=500?`${t} returned a server error \u2014 this is usually transient, so try again shortly.`:"Check that the deployment base URL and project in app.json are correct."}}r(tu,"hintForStatus");var es=r(async function(e){let t=e.getBaseUrl(),n;try{({data:n}=await e.get("/api/v1/token/inspect"))}catch(i){throw i instanceof Jd?new m(`Could not verify project access against ${t} (${i.status}).`,{hint:tu(i.status,t),cause:i}):new m(`Could not connect to ${t} to verify project access.`,{hint:"Check your network connection and verify that the base URL is correct.",cause:i})}let o=Xd(eu,n);if(!o.success)throw new m(`Unexpected response from ${t}/api/v1/token/inspect.`,{hint:"Retry; if it persists, your CLI may be out of date or a proxy is altering responses.",cause:new Error(JSON.stringify(o.issues))});return o.output},"inspectDeploymentToken");async function ts(e,t,n,o){if(!((await(o?.inspectToken||es)(e)).projects??[]).some(c=>c.projectUrlName===t.project&&c.groups.length>0))throw new m(`Your session for organization "${n}" doesn't have access to project "${t.project}" on ${t.baseUrl}.`,{hint:`Check you signed in to the right organization, or have access to the project "${t.project}" within "${n}" organization; \`@cognite/cli auth status\` lists the projects you can reach within your already logged in session token.`})}r(ts,"assertProjectAccess");async function ns(e,t,n,o){let i=await o.ensureFreshSession();if(!i)throw new m(`No credentials available for ${e.project} @ ${e.baseUrl}.`,{hint:"Run `cognite auth login` to login."});let s=await tn(e,t,i.accessToken,o.createClient);return await ts(s,e,n),s}r(ns,"resolveViaSession");async function os(e,t,n,o){switch(e.method){case"client-credentials":return o.getSdkFn(t,n.appId);case"session":return ns(t,n.appId,e.org,o);case"browser":return Zi(t,n,o)}}r(os,"buildClientForAuthMethod");async function _(e,t,n={}){let{login:o=Gt,getSdk:i=en,createClient:s=r(g=>new nu(g),"createClient"),readSessionMetadata:a=xe,ensureFreshSession:c=We,promptAuthMethod:l=Qt,confirmActionTarget:p=Xt,isTTY:d=process.stdin?.isTTY??!1,now:u=r(()=>new Date,"now")}=n,f=zi(e,t,{readSessionMetadata:a,now:u}),h=await Gi(f,e,t,{promptAuthMethod:l,confirmActionTarget:p,isTTY:d});return os(h,e,t,{loginFn:o,getSdkFn:i,createClient:s,ensureFreshSession:c})}r(_,"buildAppHostingApiClient");async function nn(e,t,n={}){let o=await _(e,t,n);return new U(o)}r(nn,"buildAppHostingClient");import rs from"enquirer";var is="Enter custom target...";function ss(e,t){let n=t.map((o,i)=>`  ${i}: ${o.org}/${o.project}`).join(`
 `);throw new Error(`Deployment "${e}" not found. Available deployments:
-${n}`)}r(bi,"deploymentNotFoundError");function L(e,t){if(e.length===0)throw new Error("No deployments configured in app.json");if(t===void 0)return e[0];if(/^\d+$/.test(t)){let o=e[Number.parseInt(t)];if(o)return o;bi(t,e)}let n=e.find(o=>o.project===t||`${o.org}/${o.project}`===t);if(n)return n;bi(t,e)}r(L,"findDeployment");function j(e){let t=[];return e.deployClientId||t.push("deployClientId"),e.deploySecretName||t.push("deploySecretName"),t}r(j,"getMissingCredentials");async function M(e,t){if(t.baseUrl&&t.project)return{org:t.org??"",project:t.project,baseUrl:t.baseUrl,deployClientId:"",deploySecretName:"",published:!1,idpType:"cdf"};if(t.deployment!==void 0)return L(e.deployments,t.deployment);let n=[...e.deployments.map(s=>`${s.org}/${s.project}`),Ai],{selected:o}=await Ci.prompt({type:"select",name:"selected",message:"Select deployment target",choices:n});if(o!==Ai){let s=e.deployments.find(a=>`${a.org}/${a.project}`===o);if(s)return s;throw new Error(`Deployment "${o}" could not be resolved from app.json.`)}let i=await Ci.prompt([{type:"input",name:"baseUrl",message:"CDF Base URL",initial:"https://api.cognitedata.com"},{type:"input",name:"project",message:"CDF Project",validate:r(s=>s?!0:"Project is required","validate")},{type:"input",name:"org",message:"Organization (for login hint)",initial:""}]);return{org:i.org||"",project:i.project,baseUrl:i.baseUrl,deployClientId:"",deploySecretName:"",published:!1,idpType:"cdf"}}r(M,"resolveDeployment");function Ei(e,t=process.cwd(),n={}){let o=n.readSessionMetadata??Se,i=n.loadAppConfig??E;if(e.org)return e.org;let s=o();if(s?.org)return s.org;try{let a=i(t),c=L(a.deployments,void 0);if(c.org)return c.org}catch{}throw new m("Could not determine org.",{hint:"Pass --org <org>, run `cognite auth login`, or run from an agent directory with app.json.",shouldReport:!1})}r(Ei,"resolveOrg");function I(e,t=1){return"  ".repeat(t).concat(e)}r(I,"indent");async function J(e,t=process.cwd(),n={}){let o=n.ensureFreshSession??Ye,i=n.fetchUserInfo??Mt,s=n.loadAppConfig??E,a=n.createClient??(l=>new id(l));if(e.interactive&&e.baseUrl&&e.project)return _(cd(e),{interactive:!0,appId:"cognite-cli",orgHint:e.org},n.getClient);let c=await sd(e,o,i,a);if(c)return c;try{let l=s(t),p=e.interactive?await M(l,e):L(l.deployments,void 0);return _(p,{interactive:e.interactive,appId:"cognite-cli",orgHint:e.org},n.getClient)}catch{}throw new m("Not signed in.",{hint:"Run `cognite auth login` to start a session, or pass --interactive --base-url <url> --project <project>.",shouldReport:!1})}r(J,"getAgentClient");async function sd(e,t,n,o){let i;try{i=await t()}catch(p){if(p instanceof Le)throw new m("Your session has expired.",{hint:"Run `cognite auth login` to sign in again.",shouldReport:!1,cause:p});return null}if(!i)return null;let s=await n(i),a=ad(e.project,s.projects),c=`https://${a.cluster}`,l=o({appId:"cognite-cli",project:a.name,baseUrl:c,oidcTokenProvider:r(async()=>((await t())?.accessToken??i.accessToken).expose(),"oidcTokenProvider")});return await l.authenticate(),l}r(sd,"trySessionClient");function ad(e,t){if(e){let o=t.find(i=>i.name===e);if(!o?.cluster)throw new m(`Project "${e}" not found in your session.`,{hint:t.length?`Available projects: ${t.map(i=>i.name).join(", ")}`:"Your session has no reachable projects. Check your org and permissions.",shouldReport:!1});return{...o,cluster:o.cluster}}let n=t.find(o=>o.isDefault);if(n?.cluster)return{...n,cluster:n.cluster};if(t.length===1&&t[0].cluster)return{...t[0],cluster:t[0].cluster};throw t.length===0?new m("No reachable projects found in your session.",{hint:"Check your org and permissions, or pass --project <project>.",shouldReport:!1}):new m("Multiple projects available \u2014 specify which one to use.",{hint:`Pass --project <name>. Available: ${t.map(o=>o.name).join(", ")}`,shouldReport:!1})}r(ad,"resolveSessionProject");function cd(e){return{org:e.org??"",project:e.project??"",baseUrl:e.baseUrl??"",deployClientId:"",deploySecretName:"",published:!1,idpType:"cdf"}}r(cd,"getDeployment");var lo=class lo extends ye{constructor(){super("create");this.handle=r(async(n,o,i)=>{let s=i.optsWithGlobals(),a=s.prompt;a&&bt();let c={externalId:s.externalId,displayName:s.displayName,description:s.description,model:s.model,instructions:s.instructions,runtimeVersion:s.runtimeVersion},l=n==="."||n==="./",p=gd(n,l),d={models:[],defaultModel:nt.model};try{let g=await J(s);d=await Q(g).getAvailableModels()}catch{}let u=await new Et(p,c,a,d.models,d.defaultModel).resolve(),f=fd(l,u.dirName);await yd(f,l,u.dirName),await ao(Je(f,T.config),this.buildAgentYaml(u)),await this.scaffoldEvalCases(f,u),await ao(Je(f,T.readme),await this.buildReadme(u)),this.printSummary(u)},"handle");this.buildAgentYaml=r(({dirName:n,...o})=>ce(o),"buildAgentYaml");this.buildReadme=r(async n=>{let o=await xi(Je(Pi,"agents","create",T.readmeTemplate),"utf8");return Ii(o,{displayName:n.name})},"buildReadme");this.scaffoldEvalCases=r(async(n,o)=>{let i=Je(n,T.evalDir);await Ti(i,{recursive:!0});let s=await xi(Je(Pi,"agents","create",T.evalCasesTemplate),"utf8"),a=Ii(s,{displayName:o.name});await ao(Je(i,T.evalCases),a)},"scaffoldEvalCases");this.printSummary=r(n=>{let o=P(process.stdout),i=n.dirName;console.log(),console.log(o.green(`Created agent project at ${i}/`)),console.log(),console.log(I(`directory: ${i}/`)),console.log(I(`externalId: ${n.externalId}`)),console.log(I(`display name: ${n.name}`)),n.model&&console.log(I(`model: ${n.model}`)),console.log(),console.log("Next steps:"),console.log(I(`1. Edit ${i}/${T.config} \u2014 add tools and refine instructions`)),console.log(I(`2. cognite agents push ${i}`)),console.log(I(`3. cognite agents open ${i}`)),console.log(I(`4. Edit ${i}/${Te} and run: cognite agents eval ${i}`)),console.log()},"printSummary");this.description("Scaffold a new agent project").argument("[dir]","Agent name / directory").addHelpText("after",ud);for(let n of Object.values(Ri))this.addOption(n);this.action(this.handle)}};r(lo,"CreateCommand");var Kt=lo,Ri=Object.freeze({externalId:new Ue("--external-id <id>","Agent externalId"),displayName:new Ue("--display-name <name>","Agent display name"),description:new Ue("--description <text>","Agent description"),model:new Ue("--model <model>","Language model (e.g. azure/gpt-4.1)"),instructions:new Ue("--instructions <text>","System prompt / instructions"),runtimeVersion:new Ue("--runtime-version <version>","Agent runtime version"),noPrompt:new Ue("--no-prompt","Skip interactive prompts, use defaults")}),fC=Object.values(Ri).map(e=>e.long),ud=`
+${n}`)}r(ss,"deploymentNotFoundError");function $(e,t){if(e.length===0)throw new Error("No deployments configured in app.json");if(t===void 0)return e[0];if(/^\d+$/.test(t)){let o=e[Number.parseInt(t)];if(o)return o;ss(t,e)}let n=e.find(o=>o.project===t||`${o.org}/${o.project}`===t);if(n)return n;ss(t,e)}r($,"findDeployment");async function L(e,t){if(t.confirmActionTarget!==void 0)throw new m("Pass -d/--deployment <target> to choose a target non-interactively \u2014 --confirm-action-target cannot be combined with --interactive.",{shouldReport:!1,hint:"--interactive already prompts for the target, so there is nothing for --confirm-action-target to acknowledge."});if(t.baseUrl&&t.project)return{org:t.org??"",project:t.project,baseUrl:t.baseUrl,deployClientId:"",deploySecretName:"",published:!1,idpType:"cdf"};if(t.deployment!==void 0)return $(e.deployments,t.deployment);let n=[...e.deployments.map(s=>`${s.org}/${s.project}`),is],{selected:o}=await rs.prompt({type:"select",name:"selected",message:"Select deployment target",choices:n});if(o!==is){let s=e.deployments.find(a=>`${a.org}/${a.project}`===o);if(s)return s;throw new Error(`Deployment "${o}" could not be resolved from app.json.`)}let i=await rs.prompt([{type:"input",name:"baseUrl",message:"CDF Base URL",initial:"https://api.cognitedata.com"},{type:"input",name:"project",message:"CDF Project",validate:r(s=>s?!0:"Project is required","validate")},{type:"input",name:"org",message:"Organization (for login hint)",initial:""}]);return{org:i.org||"",project:i.project,baseUrl:i.baseUrl,deployClientId:"",deploySecretName:"",published:!1,idpType:"cdf"}}r(L,"resolveDeployment");function as(e,t=process.cwd(),n={}){let o=n.readSessionMetadata??xe,i=n.loadAppConfig??k;if(e.org)return e.org;let s=o();if(s?.org)return s.org;try{let a=i(t),c=$(a.deployments,void 0);if(c.org)return c.org}catch{}throw new m("Could not determine org.",{hint:"Pass --org <org>, run `cognite auth login`, or run from an agent directory with app.json.",shouldReport:!1})}r(as,"resolveOrg");function T(e,t=1){return"  ".repeat(t).concat(e)}r(T,"indent");async function z(e,t=process.cwd(),n={}){let o=n.ensureFreshSession??We,i=n.fetchUserInfo??zt,s=n.loadAppConfig??k,a=n.createClient??(l=>new ou(l));if(e.interactive&&e.baseUrl&&e.project)return await _(su(e),{interactive:!0,appId:"cognite-cli",orgHint:e.org},n.getClient);let c=await ru(e,o,i,a);if(c)return c;try{let l=s(t),p=e.interactive?await L(l,e):$(l.deployments,void 0);return await _(p,{interactive:e.interactive,appId:"cognite-cli",orgHint:e.org},n.getClient)}catch{}throw new m("Not signed in.",{hint:"Run `cognite auth login` to start a session, or pass --interactive --base-url <url> --project <project>.",shouldReport:!1})}r(z,"getAgentClient");async function ru(e,t,n,o){let i;try{i=await t()}catch(p){if(p instanceof He)throw new m("Your session has expired.",{hint:"Run `cognite auth login` to sign in again.",shouldReport:!1,cause:p});return null}if(!i)return null;let s=await n(i),a=iu(e.project,s.projects),c=`https://${a.cluster}`,l=o({appId:"cognite-cli",project:a.name,baseUrl:c,oidcTokenProvider:r(async()=>((await t())?.accessToken??i.accessToken).expose(),"oidcTokenProvider")});return await l.authenticate(),l}r(ru,"trySessionClient");function iu(e,t){if(e){let o=t.find(i=>i.name===e);if(!o?.cluster)throw new m(`Project "${e}" not found in your session.`,{hint:t.length?`Available projects: ${t.map(i=>i.name).join(", ")}`:"Your session has no reachable projects. Check your org and permissions.",shouldReport:!1});return{...o,cluster:o.cluster}}let n=t.find(o=>o.isDefault);if(n?.cluster)return{...n,cluster:n.cluster};if(t.length===1&&t[0].cluster)return{...t[0],cluster:t[0].cluster};throw t.length===0?new m("No reachable projects found in your session.",{hint:"Check your org and permissions, or pass --project <project>.",shouldReport:!1}):new m("Multiple projects available \u2014 specify which one to use.",{hint:`Pass --project <name>. Available: ${t.map(o=>o.name).join(", ")}`,shouldReport:!1})}r(iu,"resolveSessionProject");function su(e){return{org:e.org??"",project:e.project??"",baseUrl:e.baseUrl??"",deployClientId:"",deploySecretName:"",published:!1,idpType:"cdf"}}r(su,"getDeployment");var $o=class $o extends Ee{constructor(){super("create");this.handle=r(async(n,o,i)=>{let s=i.optsWithGlobals(),a=s.prompt;a&&Dt();let c={externalId:s.externalId,displayName:s.displayName,description:s.description,model:s.model,instructions:s.instructions,runtimeVersion:s.runtimeVersion},l=n==="."||n==="./",p=uu(n,l),d=[];if(a&&!c.model?.trim())try{let h=await z(s);d=await ee(h).getAvailableModels()}catch{}let u=await new $t(p,c,a,d).resolve(),f=mu(l,u.dirName);await gu(f,l,u.dirName),await on(he(f,Ie(Io(f))),this.buildAgentYaml(u)),await this.scaffoldEvalCases(f,u),await on(he(f,A.readme),await this.buildReadme(u)),await this.scaffoldAgentsMd(f),await this.scaffoldSkills(f),this.printSummary(u)},"handle");this.buildAgentYaml=r(({dirName:n,...o})=>ge(o),"buildAgentYaml");this.buildReadme=r(async n=>{let o=await Ro(he(rn,"agents","create",A.readmeTemplate),"utf8");return ls(o,{displayName:n.name})},"buildReadme");this.scaffoldAgentsMd=r(async n=>{let o=await Ro(he(rn,"agents","create",A.agentsMdTemplate),"utf8");await on(he(n,A.agentsMd),o)},"scaffoldAgentsMd");this.scaffoldSkills=r(async n=>{let o=he(rn,"agents","create","skills");for(let i of si){let s=he(n,i);await au(o,s,{recursive:!0})}},"scaffoldSkills");this.scaffoldEvalCases=r(async(n,o)=>{let i=he(n,A.evalDir);await ds(i,{recursive:!0});let s=await Ro(he(rn,"agents","create",A.evalCasesTemplate),"utf8"),a=ls(s,{displayName:o.name});await on(he(i,A.evalCases),a)},"scaffoldEvalCases");this.printSummary=r(n=>{let o=P(process.stdout),i=n.dirName;console.log(),console.log(o.green(`Created agent project at ${i}/`)),console.log(),console.log(T(`directory: ${i}/`)),console.log(T(`externalId: ${n.externalId}`)),console.log(T(`display name: ${n.name}`)),n.model&&console.log(T(`model: ${n.model}`)),console.log(),console.log("Next steps:"),console.log(T(`1. Edit ${i}/${Ie(Io(i))} \u2014 add tools and refine instructions`)),console.log(T(`2. cognite agents push ${i}`)),console.log(T(`3. cognite agents open ${i}`)),console.log(T(`4. Edit ${i}/${Me} and run: cognite agents eval ${i}`)),console.log()},"printSummary");this.description("Scaffold a new agent project").argument("[dir]","Agent name / directory").addHelpText("after",pu);for(let n of Object.values(us))this.addOption(n);this.action(this.handle)}};r($o,"CreateCommand");var sn=$o,us=Object.freeze({externalId:new Be("--external-id <id>","Agent externalId"),displayName:new Be("--display-name <name>","Agent display name"),description:new Be("--description <text>","Agent description"),model:new Be("--model <model>","Language model (e.g. azure/gpt-4.1)"),instructions:new Be("--instructions <text>","Agent instructions"),runtimeVersion:new Be("--runtime-version <version>","Agent runtime version"),noPrompt:new Be("--no-prompt","Skip interactive prompts, use defaults")}),zA=Object.values(us).map(e=>e.long),pu=`
 Examples:
   cognite agents create                     Interactive scaffold
   cognite agents create my-agent            Scaffold with name "my-agent"
@@ -39,73 +40,144 @@ Examples:
     --description "Helps with maintenance" \\
     --model azure/gpt-4.1 \\
     --no-prompt                             Fully non-interactive
-`,$i=pd(dd(import.meta.url)),ki=co($i,"..","..","_templates"),md=co($i,"..","..","..","_templates"),Pi=Di(ki)?ki:md;function gd(e,t){return t?ld(process.cwd()):e}r(gd,"normalizeDirArg");function fd(e,t){return e?process.cwd():co(process.cwd(),t)}r(fd,"resolveTargetDir");async function yd(e,t,n){if(!t){if(Di(e))throw new m(`An agent folder named "${n}" already exists at:
-  ${e}`,{hint:"Use a different agent name or remove the existing directory.",shouldReport:!1});await Ti(e)}}r(yd,"ensureTargetDir");function Ii(e,t){return e.replace(/\{\{(\w+)\}\}/g,(n,o)=>t[o]??"")}r(Ii,"renderTemplate");import{resolve as pu}from"path";import{isDeepStrictEqual as du}from"util";import{Option as _e}from"commander";import{readFile as hd}from"fs/promises";import{join as po}from"path";import{array as we,literal as Vt,minLength as ct,nonEmpty as te,object as de,optional as ke,pipe as N,safeParse as Oi,string as ne,variant as Sd}from"valibot";import{parse as wd}from"yaml";var vd=de({type:Vt("correctness"),reference:N(ne(),te("must not be empty"))}),Cd=de({type:Vt("faithfulness"),context:N(ne(),te("must not be empty"))}),Ad=de({type:Vt("toolSelection")}),bd=de({type:Vt("toolInvocation")}),Ed=Sd("type",[vd,Cd,Ad,bd]),Fi=["correctness","faithfulness","toolSelection","toolInvocation"],xd=de({input:N(ne(),te("must not be empty")),scorers:ke(N(we(Ed),ct(1,"must contain at least one scorer")))}),kd=de({space:N(ne(),te("must not be empty")),externalId:N(ne(),te("must not be empty")),version:N(ne(),te("must not be empty"))}),uo=de({dataModels:ke(N(we(kd),ct(1,"must contain at least one data model"))),instanceSpaces:ke(N(we(N(ne(),te("must not be empty"))),ct(1,"must contain at least one instance space"))),appContext:ke(N(ne(),te("must not be empty")))}),Li=de({id:N(ne(),te("must not be empty")),tags:ke(we(N(ne(),te("tag must not be empty")))),turns:N(we(xd),ct(1,"must contain at least one turn")),...uo.entries}),Pd=de({include:ke(we(N(ne(),te("include path must not be empty")))),cases:ke(we(Li)),...uo.entries}),Id=de({tags:ke(we(N(ne(),te("tag must not be empty")))),cases:N(we(Li),ct(1,"must contain at least one case")),...uo.entries});function Mi(e,t){let n=e;if(t?.caseFilter&&t.caseFilter.length>0&&(n=n.filter(o=>t.caseFilter.includes(o.id))),t?.tagFilter&&t.tagFilter.length>0){let o=new Set(t.tagFilter);n=n.filter(i=>i.tags?.some(s=>o.has(s)))}if(n.length===0)throw new m("No eval cases matched the filter.",{hint:`Check the --case and --tag flag values against ${Te}.`,shouldReport:!1});return n}r(Mi,"filterEvalCases");async function Ui(e){let t=po(e,T.evalDir),n=po(t,T.evalCases),{cases:o,include:i,rootContext:s}=await Dd(n),a=await Td(i,t,s),c=[...o,...a];if(c.length===0)throw new m("No eval cases found.",{hint:`Add a cases list or an include field to ${Te}.`,shouldReport:!1});return Od(c),Fd(c),c}r(Ui,"loadEvalCases");async function Dd(e){let t=await _i(e,{missingFileHint:`Create ${Te} in your agent project directory.`}),n=Oi(Pd,t);if(!n.success)throw new m(`Invalid ${e}: ${ji(n.issues)}`,{shouldReport:!1});let{include:o,cases:i,...s}=n.output;return{cases:(i??[]).map(c=>Ni(c,Te,s)),include:o,rootContext:s}}r(Dd,"loadRootCasesFile");async function Td(e,t,n){return!e||e.length===0?[]:(await Promise.all(e.map(async i=>{let s=po(t,i),a=`eval/${i}`,c=await _i(s),l=Oi(Id,c);if(!l.success)throw new m(`Invalid ${s}: ${ji(l.issues)}`,{shouldReport:!1});let{tags:p,cases:d,...u}=l.output;return d.map(f=>Ni(f,a,n,{fileContext:u,fileTags:p}))}))).flat()}r(Td,"loadIncludedFiles");async function _i(e,t){let n;try{n=await hd(e,"utf8")}catch{throw new m(`Eval file not found:
-  ${e}`,{hint:t?.missingFileHint,shouldReport:!1})}try{return wd(n)}catch(o){throw new m(`Failed to parse ${e}: ${o instanceof Error?o.message:String(o)}`,{hint:"Check the YAML syntax of the file.",shouldReport:!1})}}r(_i,"readAndParseYaml");function ji(e){return e.map(t=>{let n=t.path?.map(o=>String(o.key)).join(".")??"";return n?`${n}: ${t.message}`:t.message}).join("; ")}r(ji,"formatValidationIssues");function Rd(e,t,n){let o=n?.dataModels??t?.dataModels??e.dataModels,i=n?.instanceSpaces??t?.instanceSpaces??e.instanceSpaces,s=n?.appContext??t?.appContext??e.appContext;if(!o&&!i&&!s)return;let a={};return o&&(a.dataModels=o),i&&(a.instanceSpaces=i),s&&(a.appContext=s),a}r(Rd,"mergeSessionContext");function $d(e,t){if(t){if(t.dataModels&&!t.instanceSpaces)throw new m(`Case "${e}" declares dataModels without instanceSpaces`,{hint:"Add instanceSpaces alongside dataModels in your session context.",shouldReport:!1});if(t.instanceSpaces&&!t.dataModels)throw new m(`Case "${e}" declares instanceSpaces without dataModels`,{hint:"Add dataModels alongside instanceSpaces in your session context.",shouldReport:!1})}}r($d,"assertDataModelScopePairing");function Ni(e,t,n,o){let{id:i,turns:s,tags:a,dataModels:c,instanceSpaces:l,appContext:p}=e,d=o?.fileTags&&o.fileTags.length>0?[...new Set([...o.fileTags,...a??[]])]:a,u=Rd(n,o?.fileContext,{dataModels:c,instanceSpaces:l,appContext:p});return $d(i,u),{id:i,turns:s,...d?{tags:d}:{},source:t,contextInformation:u}}r(Ni,"buildEvalCase");function Od(e){let t=new Map;for(let{id:n,source:o}of e){let i=t.get(n)??[];i.push(o),t.set(n,i)}for(let[n,o]of t){if(o.length<=1)continue;let s=[...new Set(o)].map(a=>`    - ${a}`).join(`
+`,ms=cu(lu(import.meta.url)),cs=Do(ms,"..","..","_templates"),du=Do(ms,"..","..","..","_templates"),rn=ps(cs)?cs:du;function uu(e,t){return t?Io(process.cwd()):e}r(uu,"normalizeDirArg");function mu(e,t){return e?process.cwd():Do(process.cwd(),t)}r(mu,"resolveTargetDir");async function gu(e,t,n){if(t){let o=await st(e);if(o.length>0){let i=o.length===1?"an agent definition":"agent definitions";throw new m(`This directory already contains ${i}:
+${o.map(s=>`  - ${s}`).join(`
+`)}`,{hint:"Scaffold into a new directory instead, or use `cognite agents pull <external-id> --force` to overwrite.",shouldReport:!1})}return}if(ps(e))throw new m(`An agent folder named "${n}" already exists at:
+  ${e}`,{hint:"Use a different agent name or remove the existing directory.",shouldReport:!1});await ds(e)}r(gu,"ensureTargetDir");function ls(e,t){return e.replace(/\{\{(\w+)\}\}/g,(n,o)=>t[o]??"")}r(ls,"renderTemplate");import{resolve as oa}from"path";import{isDeepStrictEqual as Tm}from"util";import{Option as ve}from"commander";function ye(e){return e.invokeError??e.scoreError?!1:e.evalCase.expectPass!==!1?e.passed:!e.passed}r(ye,"caseVerdictPassed");function Oo(e){return e.some(t=>!ye(t))}r(Oo,"hasCaseVerdictFailures");function ut(e){return e.filter(t=>!ye(t)).length}r(ut,"countCaseVerdictFailures");function mt(e){return e.filter(ye).length}r(mt,"countCaseVerdictPasses");function gt(e){return e.filter(t=>t.evalCase.expectPass===!1&&!t.invokeError&&!t.scoreError&&t.passed).length}r(gt,"countUnexpectedPasses");import{readFile as xu}from"fs/promises";import{join as Lo}from"path";import{safeParse as Ss}from"valibot";import{parse as ku}from"yaml";import{array as we,boolean as fu,literal as an,minLength as Xe,nonEmpty as q,object as ae,optional as Se,pipe as O,string as J,variant as hu}from"valibot";var yu=ae({type:an("correctness"),criteria:O(J(),q("must not be empty"))}),Su=ae({type:an("faithfulness"),groundTruth:O(J(),q("must not be empty"))}),wu=ae({name:O(J(),q("must not be empty")),description:O(J(),q("must not be empty"))}),ft=Se(O(we(wu),Xe(1,"must contain at least one tool"))),vu=ae({type:an("toolSelection"),tools:ft}),Cu=ae({type:an("toolInvocation"),tools:ft}),Au=hu("type",[yu,Su,vu,Cu]),gs=["correctness","faithfulness","toolSelection","toolInvocation"],Eu=ae({input:O(J(),q("must not be empty")),scorers:Se(O(we(Au),Xe(1,"must contain at least one scorer")))}),bu=ae({space:O(J(),q("must not be empty")),externalId:O(J(),q("must not be empty")),version:O(J(),q("must not be empty"))}),Fo=ae({dataModels:Se(O(we(bu),Xe(1,"must contain at least one data model"))),instanceSpaces:Se(O(we(O(J(),q("must not be empty"))),Xe(1,"must contain at least one instance space"))),appContext:Se(O(J(),q("must not be empty")))}),fs=ae({id:O(J(),q("must not be empty")),tags:Se(we(O(J(),q("tag must not be empty")))),expectPass:Se(fu(),!0),turns:O(we(Eu),Xe(1,"must contain at least one turn")),...Fo.entries,tools:ft}),hs=ae({include:Se(we(O(J(),q("include path must not be empty")))),cases:Se(we(fs)),...Fo.entries,tools:ft}),ys=ae({tags:Se(we(O(J(),q("tag must not be empty")))),cases:O(we(fs),Xe(1,"must contain at least one case")),...Fo.entries,tools:ft});function ws(e,t){let n=e,{caseFilter:o,tagFilter:i}=t??{};if(o&&o.length>0&&(n=n.filter(s=>o.includes(s.id))),i&&i.length>0){let s=new Set(i);n=n.filter(a=>a.tags?.some(c=>s.has(c)))}if(n.length===0)throw new m("No eval cases matched the filter.",{hint:`Check the --case and --tag flag values against ${Me}.`,shouldReport:!1});return n}r(ws,"filterEvalCases");async function vs(e){let t=Lo(e,A.evalDir),n=Lo(t,A.evalCases),{cases:o,include:i,rootContext:s,rootTools:a}=await Pu(n),c=await Tu(i,t,s,a),l=[...o,...c];if(l.length===0)throw new m("No eval cases found.",{hint:`Add a cases list or an include field to ${Me}.`,shouldReport:!1});return Du(l),$u(l),l}r(vs,"loadEvalCases");async function Pu(e){let t=await Cs(e,{missingFileHint:`Create ${Me} in your agent project directory.`}),n=Ss(hs,t);if(!n.success)throw new m(`Invalid ${e}: ${As(n.issues)}`,{shouldReport:!1});let{include:o,cases:i,tools:s,...a}=n.output;return{cases:(i??[]).map(l=>Es(l,Me,a,s)),include:o,rootContext:a,rootTools:s}}r(Pu,"loadRootCasesFile");async function Tu(e,t,n,o){return!e||e.length===0?[]:(await Promise.all(e.map(async s=>{let a=Lo(t,s),c=`eval/${s}`,l=await Cs(a),p=Ss(ys,l);if(!p.success)throw new m(`Invalid ${a}: ${As(p.issues)}`,{shouldReport:!1});let{tags:d,cases:u,tools:f,...h}=p.output;return u.map(g=>Es(g,c,n,o,{fileContext:h,fileTags:d,fileTools:f}))}))).flat()}r(Tu,"loadIncludedFiles");async function Cs(e,t){let n;try{n=await xu(e,"utf8")}catch{throw new m(`Eval file not found:
+  ${e}`,{hint:t?.missingFileHint,shouldReport:!1})}try{return ku(n)}catch(o){throw new m(`Failed to parse ${e}: ${o instanceof Error?o.message:String(o)}`,{hint:"Check the YAML syntax of the file.",shouldReport:!1})}}r(Cs,"readAndParseYaml");function As(e){return e.map(t=>{let n=t.path?.map(o=>String(o.key)).join(".")??"";return n?`${n}: ${t.message}`:t.message}).join("; ")}r(As,"formatValidationIssues");function Ru(e,t,n){let o=n?.dataModels??t?.dataModels??e.dataModels,i=n?.instanceSpaces??t?.instanceSpaces??e.instanceSpaces,s=n?.appContext??t?.appContext??e.appContext;if(!o&&!i&&!s)return;let a={};return o&&(a.dataModels=o),i&&(a.instanceSpaces=i),s&&(a.appContext=s),a}r(Ru,"mergeSessionContext");function Iu(e,t){if(t){if(t.dataModels&&!t.instanceSpaces)throw new m(`Case "${e}" declares dataModels without instanceSpaces`,{hint:"Add instanceSpaces alongside dataModels in your session context.",shouldReport:!1});if(t.instanceSpaces&&!t.dataModels)throw new m(`Case "${e}" declares instanceSpaces without dataModels`,{hint:"Add dataModels alongside instanceSpaces in your session context.",shouldReport:!1})}}r(Iu,"assertDataModelScopePairing");function Es(e,t,n,o,i){let{id:s,turns:a,tags:c,expectPass:l,dataModels:p,instanceSpaces:d,appContext:u,tools:f}=e,h=i?.fileTags&&i.fileTags.length>0?[...new Set([...i.fileTags,...c??[]])]:c,g=Ru(n,i?.fileContext,{dataModels:p,instanceSpaces:d,appContext:u});Iu(s,g);let y=f??i?.fileTools??o;return{id:s,turns:a,expectPass:l,...h?{tags:h}:{},source:t,contextInformation:g,...y?{tools:y}:{}}}r(Es,"buildEvalCase");function Du(e){let t=new Map;for(let{id:n,source:o}of e){let i=t.get(n)??[];i.push(o),t.set(n,i)}for(let[n,o]of t){if(o.length<=1)continue;let s=[...new Set(o)].map(a=>`    - ${a}`).join(`
 `);throw new m(`Duplicate case id "${n}"
   Defined in:
-${s}`,{hint:"Each case must have a unique id.",shouldReport:!1})}}r(Od,"assertUniqueCaseIds");function Fd(e){for(let t of e)if(!t.turns.some(o=>o.scorers&&o.scorers.length>0))throw new m(`Case "${t.id}" (${t.source}) has no scored turns`,{hint:"Add scorers to at least one turn in each case.",shouldReport:!1})}r(Fd,"assertCaseHasScoredTurn");var Ld=["name","description","instructions","model","runtimeVersion"],Md=["labels","tools","skills","subagents","exampleQuestions"];function Vi(e,t){let n=Re(e),o=Re(t),i=[];for(let s of Ld){let a=n[s],c=o[s];Ud(a,c)||i.push({field:s,local:Hi(a),remote:Hi(c)})}for(let s of Md){let a=n[s],c=o[s];_d(s,a,c)||i.push({field:s,local:Bi(s,a),remote:Bi(s,c)})}return i}r(Vi,"detectDrift");function Gi(e,t){let o=["Warning: local agent.yaml differs from deployed config.",`  Fields: ${e.map(i=>i.field).join(", ")}`];if(t?.verbose)for(let{field:i,remote:s,local:a}of e){let c=`${i}:`.padEnd(18);o.push(`   ${c}"${s}" \u2192 "${a}"`)}return o.push("  Run with --upsert to push local changes before evaluating."),o.join(`
-`)}r(Gi,"formatAgentDriftWarning");function Ud(e,t){return mo(e)===mo(t)}r(Ud,"scalarValuesEqual");function _d(e,t,n){return fo(go(t),e)===fo(go(n),e)}r(_d,"arrayValuesEqual");function mo(e){return e??""}r(mo,"normalizeOptionalString");function Hi(e){return mo(e)}r(Hi,"formatScalarValue");function Bi(e,t){return fo(go(t),e)}r(Bi,"formatArrayValue");function go(e){return e??[]}r(go,"normalizeArray");function fo(e,t){let n=[...e].sort((o,i)=>Ki(t,o).localeCompare(Ki(t,i)));return lt(n)}r(fo,"stableArrayStringify");function Ki(e,t){if(typeof t!="object"||t===null)return lt(t);let n=t;switch(e){case"tools":return String(n.name??"");case"subagents":return String(n.agentExternalId??"");case"exampleQuestions":return String(n.question??"");default:return lt(t)}}r(Ki,"arrayItemSortKey");function lt(e){if(e===null||typeof e!="object")return JSON.stringify(e);if(Array.isArray(e))return`[${e.map(o=>lt(o)).join(",")}]`;let t=e;return`{${Object.keys(t).sort().map(o=>`${JSON.stringify(o)}:${lt(t[o])}`).join(",")}}`}r(lt,"stableStringify");async function Yi(e,t){if(e)try{e.track("Flows.CLI.Agents.Eval",{...t}),await e.flush(Ve)}catch{}}r(Yi,"trackAgentsEval");function jd(e){return typeof e=="object"&&e!==null&&e.type==="result"&&Array.isArray(e.messages)}r(jd,"isSessionResult");function qi(e){let t=e.content?.text;if(typeof t=="string"&&t.length>0)return t;let n=[];for(let o of e.reasoning??[])for(let i of o.content??[])typeof i.text=="string"&&i.text.length>0&&n.push(i.text);return n.join(`
-`).trim()}r(qi,"messageText");function Gt(e){return e.map(t=>t.name).join(", ")}r(Gt,"formatToolNameList");var yo=500;function zi(e,t){return e.length<=t?e:`${e.slice(0,t)}\u2026 (${e.length-t} more chars)`}r(zi,"truncate");function Ji(e){try{return JSON.stringify(e)??String(e)}catch{return String(e)}}r(Ji,"safeJsonEncode");function Yt(e,t=1/0){if(e.input===void 0||e.input===null)return`${e.name}()`;let n;if(typeof e.input=="object"&&!Array.isArray(e.input)){let o=Object.entries(e.input);if(o.length===0)return`${e.name}()`;n=o.map(([i,s])=>`${i}=${Ji(s)}`).join(", ")}else n=Ji(e.input);return`${e.name}(${zi(n,t)})`}r(Yt,"formatToolInvocation");function Wi(e,t=yo){let n;try{n=typeof e=="string"?e:JSON.stringify(e)??String(e)}catch{n=String(e)}return n=n.replace(/\s+/g," ").trim(),zi(n,t)}r(Wi,"formatToolResultPreview");function Nd(e){let t=[];for(let n of e)for(let o of n.reasoning??[])for(let i of o.data??[]){let s=i.toolCall;typeof s?.name=="string"&&s.name.length>0&&t.push({name:s.name,input:s.input,result:s.result})}return t}r(Nd,"extractToolCalls");function Hd(e){let t=[];for(let n of e){let o=!1;for(let i of n.reasoning??[]){for(let s of i.data??[]){let a=s.toolCall;if(typeof a?.name=="string"&&a.name.length>0){o=!0;break}}if(o)break}if(!o)for(let i of n.actions??[]){let s=i.toolConfirmation;typeof s?.toolName=="string"&&s.toolName.length>0&&t.push({name:s.toolName,input:s.toolArguments})}}return t}r(Hd,"synthesizeToolConfirmationCalls");function Xi(e){let t=e.response;if(!jd(t))throw new Error("Unexpected agent chat response shape");let n=t.messages,o=n[n.length-1];if(!o)throw new Error("Agent returned no messages");let i=[...Nd(n),...Hd(n)],s=o.actions?.find(a=>a.type==="toolConfirmation");if(s){let a=s.actionId??s.id;if(!a)throw new Error("Tool confirmation action missing actionId (both actionId and id are absent)");return{output:qi(o),toolCalls:i,cursor:t.cursor,pendingToolConfirmation:{actionId:a,toolName:s.toolConfirmation?.toolName}}}return{output:qi(o),toolCalls:i,cursor:t.cursor}}r(Xi,"extractAgentTurn");function Qi(e){let{modelId:t,service:n,verbose:o}=e;return{specificationVersion:"v2",provider:"cdf",modelId:t,supportedUrls:{},async doGenerate(i){return Bd(i,{modelId:t,service:n,verbose:o})},async doStream(i){throw new Error("CDF chat completions judge does not support streaming")}}}r(Qi,"createCdfChatCompletionsModel");async function Bd(e,t){let{modelId:n,service:o,verbose:i}=t,s=Kd(e.responseFormat),a=Vd(e.prompt,s),c={model:n,messages:a,stream:!1,temperature:e.temperature,maxTokens:e.maxOutputTokens};i?.logJson("chat/completions request",c),i?.log("judge POST /ai/chat/completions");let l=performance.now(),p=await o.postChatCompletions(c);i?.log(`judge chat/completions HTTP 200 in ${((performance.now()-l)/1e3).toFixed(1)}s`),i?.logJson("chat/completions response",p);let d=p.choices[0]?.message?.content??"",u=p.choices[0]?.finishReason??"stop";return{content:[{type:"text",text:d}],finishReason:Gd(u),usage:{inputTokens:void 0,outputTokens:void 0,totalTokens:void 0},warnings:[],request:{body:c},response:{modelId:p.model??n,body:p}}}r(Bd,"generateWithCdf");function Kd(e){if(!e||e.type==="text")return;let t=e.schema?JSON.stringify(e.schema):'{"label":"string","explanation":"string"}',n=e.name?` (${e.name})`:"";return`Respond with a single valid JSON object only. No markdown code fences or extra text.${e.description?`
+${s}`,{hint:"Each case must have a unique id.",shouldReport:!1})}}r(Du,"assertUniqueCaseIds");function $u(e){for(let t of e)if(!t.turns.some(o=>o.scorers&&o.scorers.length>0))throw new m(`Case "${t.id}" (${t.source}) has no scored turns`,{hint:"Add scorers to at least one turn in each case.",shouldReport:!1})}r($u,"assertCaseHasScoredTurn");function $e(e){if(e===null||typeof e!="object")return JSON.stringify(e);let t=e.toJSON;if(typeof t=="function")return $e(t.call(e));if(Array.isArray(e))return`[${e.map($e).join(",")}]`;let n=e;return`{${Object.keys(n).filter(i=>n[i]!==void 0).sort().map(i=>`${JSON.stringify(i)}:${$e(n[i])}`).join(",")}}`}r($e,"stableStringify");function Mo(e){try{return $e(e)}catch{return String(e)}}r(Mo,"safeStableStringify");var Ou=["name","description","instructions","model","runtimeVersion"],Fu=["labels","tools","skills","subagents","exampleQuestions"];function Ps(e,t){let n=Ue(e),o=Ue(t),i=[];for(let s of Ou){let a=n[s],c=o[s];Lu(a,c)||i.push({field:s,local:bs(a),remote:bs(c)})}for(let s of Fu){let a=n[s],c=o[s];Mu(s,a,c)||i.push({field:s,local:xs(s,a),remote:xs(s,c)})}return i}r(Ps,"detectDrift");function Ts(e,t){let n=e.map(i=>i.field).join(", "),o=[`Warning: local ${A.configGlob} differs from deployed config.`,`  Fields: ${n}`];if(t?.verbose)for(let{field:i,remote:s,local:a}of e){let c=`${i}:`.padEnd(18);o.push(`   ${c}"${s}" \u2192 "${a}"`)}return o.push("  Run with --upsert to push local changes before evaluating."),o.join(`
+`)}r(Ts,"formatAgentDriftWarning");function Lu(e,t){return Uo(e)===Uo(t)}r(Lu,"scalarValuesEqual");function Mu(e,t,n){return _o(No(t),e)===_o(No(n),e)}r(Mu,"arrayValuesEqual");function Uo(e){return e??""}r(Uo,"normalizeOptionalString");function bs(e){return Uo(e)}r(bs,"formatScalarValue");function xs(e,t){return _o(No(t),e)}r(xs,"formatArrayValue");function No(e){return e??[]}r(No,"normalizeArray");function _o(e,t){let n=[...e].sort((o,i)=>ks(t,o).localeCompare(ks(t,i)));return $e(n)}r(_o,"stableArrayStringify");function ks(e,t){if(typeof t!="object"||t===null)return $e(t);let n=t;switch(e){case"tools":return String(n.name??"");case"subagents":return String(n.agentExternalId??"");case"exampleQuestions":return String(n.question??"");default:return $e(t)}}r(ks,"arrayItemSortKey");async function Rs(e,t){if(e)try{e.track("Flows.CLI.Agents.Eval",{...t}),await e.flush(qe)}catch{}}r(Rs,"trackAgentsEval");function Uu(e){return typeof e=="object"&&e!==null&&e.type==="result"&&Array.isArray(e.messages)}r(Uu,"isSessionResult");function jo(e){let t=e.content?.text;if(typeof t=="string"&&t.length>0)return t;let n=[];for(let o of e.reasoning??[])for(let i of o.content??[])typeof i.text=="string"&&i.text.length>0&&n.push(i.text);return n.join(`
+`).trim()}r(jo,"messageText");function cn(e){return e.map(t=>t.name).join(", ")}r(cn,"formatToolNameList");var Qe=500;function Is(e,t){return e.length<=t?e:`${e.slice(0,t)}\u2026 (${e.length-t} more chars)`}r(Is,"truncate");function Ho(e){try{return JSON.stringify(e)??String(e)}catch{return String(e)}}r(Ho,"safeJsonEncode");function et(e,t=1/0){if(e.input===void 0||e.input===null)return`${e.name}()`;let n;if(typeof e.input=="object"&&!Array.isArray(e.input)){let o=Object.entries(e.input);if(o.length===0)return`${e.name}()`;n=o.map(([i,s])=>`${i}=${Ho(s)}`).join(", ")}else n=Ho(e.input);return`${e.name}(${Is(n,t)})`}r(et,"formatToolInvocation");function ln(e,t=Qe){let n=typeof e=="string"?e:Ho(e);return n=n.replace(/\s+/g," ").trim(),Is(n,t)}r(ln,"formatToolResultPreview");function Nu(e){let t=[];for(let n of e)for(let o of n.reasoning??[])for(let i of o.data??[]){let s=i.toolCall;typeof s?.name=="string"&&s.name.length>0&&t.push({name:s.name,input:s.input,result:s.result})}return t}r(Nu,"extractToolCalls");function _u(e){let t=[];for(let n of e){let o=!1;for(let i of n.reasoning??[]){for(let s of i.data??[]){let a=s.toolCall;if(typeof a?.name=="string"&&a.name.length>0){o=!0;break}}if(o)break}if(!o)for(let i of n.actions??[]){let s=i.toolConfirmation;typeof s?.toolName=="string"&&s.toolName.length>0&&t.push({name:s.toolName,input:s.toolArguments,synthesized:!0})}}return t}r(_u,"synthesizeToolConfirmationCalls");function Ds(e,t){for(let n of t){if(n.synthesized){e.push(n);continue}let o=e.findIndex(i=>i.synthesized===!0&&i.name===n.name&&Mo(i.input)===Mo(n.input));o!==-1?e[o]=n:e.push(n)}}r(Ds,"mergeToolCalls");function $s(e){let t=e.response;if(!Uu(t))throw new Error("Unexpected agent chat response shape");let n=t.messages,o=n[n.length-1];if(!o)throw new Error("Agent returned no messages");let i=[...Nu(n),..._u(n)],s=o.actions?.find(c=>c.type==="toolConfirmation");if(s){let c=s.actionId??s.id;if(!c)throw new Error("Tool confirmation action missing actionId (both actionId and id are absent)");return{output:jo(o),toolCalls:i,cursor:t.cursor,pendingToolConfirmation:{actionId:c,toolName:s.toolConfirmation?.toolName}}}let a=o.actions?.find(c=>c.type==="userSession");if(a){let c=a.actionId??a.id;if(!c)throw new Error("User session action missing actionId (both actionId and id are absent)");return{output:jo(o),toolCalls:i,cursor:t.cursor,pendingUserSession:{actionId:c}}}return{output:jo(o),toolCalls:i,cursor:t.cursor}}r($s,"extractAgentTurn");function Fs(e){let{modelId:t,service:n,verbose:o}=e;return{specificationVersion:"v2",provider:"cdf",modelId:t,supportedUrls:{},async doGenerate(i){return ju(i,{modelId:t,service:n,verbose:o})},async doStream(i){throw new Error("CDF chat completions judge does not support streaming")}}}r(Fs,"createCdfChatCompletionsModel");async function ju(e,t){let{modelId:n,service:o,verbose:i}=t,s=Hu(e.responseFormat),a=Bu(e.prompt,s),c={model:n,messages:a,stream:!1,temperature:e.temperature,maxTokens:e.maxOutputTokens};i?.logJson("chat/completions request",c),i?.log("judge POST /ai/chat/completions");let l=performance.now(),p=await o.postChatCompletions(c);i?.log(`judge chat/completions HTTP 200 in ${((performance.now()-l)/1e3).toFixed(1)}s`),i?.logJson("chat/completions response",p);let d=p.choices[0]?.message?.content??"",u=p.choices[0]?.finishReason??"stop";return{content:[{type:"text",text:d}],finishReason:Ku(u),usage:{inputTokens:void 0,outputTokens:void 0,totalTokens:void 0},warnings:[],request:{body:c},response:{modelId:p.model??n,body:p}}}r(ju,"generateWithCdf");function Hu(e){if(!e||e.type==="text")return;let t=e.schema?JSON.stringify(e.schema):'{"label":"string","explanation":"string"}',n=e.name?` (${e.name})`:"";return`Respond with a single valid JSON object only. No markdown code fences or extra text.${e.description?`
 ${e.description}`:""}
-The JSON must conform to this schema${n}: ${t}`}r(Kd,"jsonResponseInstruction");function Vd(e,t){let n=[];t&&n.push({role:"system",content:t});for(let o of e){if(o.role==="system"){n.push({role:"system",content:o.content});continue}if(o.role==="user"){let i=Zi(o.content);i&&n.push({role:"user",content:i});continue}if(o.role==="assistant"){let i=Zi(o.content);i&&n.push({role:"assistant",content:i})}}return n}r(Vd,"toCdfMessages");function Zi(e){return e.filter(t=>t.type==="text"&&typeof t.text=="string").map(t=>t.text).join(`
-`)}r(Zi,"extractTextParts");function Gd(e){switch(e){case"stop":return"stop";case"length":return"length";case"content_filter":case"content-filter":return"content-filter";case"tool_calls":case"tool-calls":return"tool-calls";default:return"other"}}r(Gd,"mapFinishReason");var Yd="azure/gpt-5";function ho(e={}){return e.cliModelId?.trim()||process.env.EVAL_JUDGE_MODEL?.trim()||e.agentModelFallback?.trim()||Yd}r(ho,"resolveJudgeModelId");function es(e){let t=e.modelId??ho({cliModelId:e.cliModelId,agentModelFallback:e.agentModelFallback});return Qi({modelId:t,service:e.service,verbose:e.verbose})}r(es,"createJudgeModel");function ts(){let e=process.env.AGENT_CHAT_ROUTE?.trim().toLowerCase();return e==="public"||e==="agents"?"public":e==="internal"||e==="fusion"?"internal":"public"}r(ts,"resolveAgentChatRoute");function ns(e,t){let n=t==="internal"?"internal/agents/chat":"agents/chat";return`/api/v1/projects/${encodeURIComponent(e)}/ai/${n}`}r(ns,"formatAgentChatPath");function os(e){return`/api/v1/projects/${encodeURIComponent(e)}/ai/chat/completions`}r(os,"formatChatCompletionsPath");async function rs(e){let t=e.allowToolConfirmation!==!1,n=e.maxTurns??8,o=e.verbose;o?.log(`agentExternalId=${e.agentExternalId} | auto-allow tools=${t}`);let i=e.cursor,s,a,c=[],l="",p=0;for(let d=0;d<n;d+=1){p+=1;let u=`turn ${p}/${n}`,f=s&&i?{agentExternalId:e.agentExternalId,cursor:i,messages:[{role:"action",type:"toolConfirmation",actionId:s,status:"ALLOW"}]}:{agentExternalId:e.agentExternalId,...e.contextInformation?{contextInformation:e.contextInformation}:{},...i?{cursor:i}:{},messages:[{role:"user",content:{type:"text",text:e.input}}]};o?.log(`${u}: sending chat request\u2026`),o?.logJson(`${u} request body`,f),a=await e.service.postAgentChat(f),o?.logJson(`${u} response`,a);let g;try{g=Xi(a)}catch(y){throw new m(`Failed to parse agent response on turn ${p}/${n}`,{hint:"The CDF agent API returned an unexpected response shape. Run with --verbose to see the raw response.",cause:y})}if(c.push(...g.toolCalls),o?.log(`${u}: extracted output length=${g.output.length}, tools=[${Gt(g.toolCalls)}]`),g.output&&(l=g.output),g.pendingToolConfirmation){if(o?.log(`${u}: tool confirmation requested \u2014 tool=${g.pendingToolConfirmation.toolName??"?"} actionId=${g.pendingToolConfirmation.actionId}`),!t)throw new m(`Agent requested tool confirmation (${g.pendingToolConfirmation.toolName??"unknown"}) but allowToolConfirmation is false`,{hint:"Re-run with tool confirmation enabled, or adjust the agent to avoid confirmation prompts."});if(!g.cursor||!g.pendingToolConfirmation.actionId)throw new m("Tool confirmation missing cursor or actionId",{hint:"The agent API returned an incomplete tool-confirmation action. This may be an API bug \u2014 retry or report to CDF support."});i=g.cursor,s=g.pendingToolConfirmation.actionId,o?.log(`${u}: auto-ALLOW, continuing with cursor\u2026`);continue}return o?.log(`${u}: conversation complete`),{output:l,toolCalls:c,turns:p,cursor:g.cursor??i,lastResponse:a}}throw new m(`Agent chat exceeded ${n} turns (tool confirmation loop?)`,{hint:"The agent may be stuck in a tool-confirmation loop. Increase maxTurns or inspect the agent configuration."})}r(rs,"invokeAgentCase");import{createCorrectnessEvaluator as Xd}from"@arizeai/phoenix-evals/llm/createCorrectnessEvaluator";import{createFaithfulnessEvaluator as Zd}from"@arizeai/phoenix-evals/llm/createFaithfulnessEvaluator";import{createToolInvocationEvaluator as Qd}from"@arizeai/phoenix-evals/llm/createToolInvocationEvaluator";import{createToolSelectionEvaluator as eu}from"@arizeai/phoenix-evals/llm/createToolSelectionEvaluator";function is(e){return{log(t){e(t)},logJson(t,n,o=6e3){e(`${t}:
-${qd(n,o)}`)}}}r(is,"createEvalLogger");function qd(e,t=6e3){let n;try{n=JSON.stringify(e,null,2)??String(e)}catch{n=String(e)}return n.length<=t?n:`${n.slice(0,t)}
-\u2026 (${n.length-t} more chars)`}r(qd,"formatJson");function ss(e){return e<1e3?`${Math.round(e)}ms`:`${(e/1e3).toFixed(1)}s`}r(ss,"formatDurationMs");var Jd=.5,zd={correctness:{pass:"correct",fail:"incorrect"},faithfulness:{pass:"faithful",fail:"unfaithful"},toolSelection:{pass:"correct",fail:"incorrect"},toolInvocation:{pass:"correct",fail:"incorrect"}};function Wd(e,t){let n=zd[e];if(n){if(t.label===n.pass)return!0;if(t.label===n.fail)return!1}return(t.score??0)>=Jd}r(Wd,"scorerPassed");async function pt(e,t,n,o,i,s){s?.log(`scoring ${n.type} (Phoenix + CDF /ai/chat/completions)\u2026`),s?.logJson(`${n.type} judge input`,i);let a=performance.now(),c;try{c=await o.evaluate(i)}catch(d){if(Ee(d))throw d;let u=d instanceof Error?d.message:String(d);throw new m(`Phoenix ${n.type} judge failed (${u}). Judge uses CDF POST .../ai/chat/completions.`,{cause:d})}s?.log(`${n.type} judge finished in ${ss(performance.now()-a)}`),s?.logJson(`${n.type} judge result`,c);let l=Wd(n.type,c),p=typeof c.score=="number"?c.score:l?1:0;return{caseId:e,turnIndex:t,scorerType:n.type,score:p,label:c.label,explanation:c.explanation,passed:l}}r(pt,"runPhoenixLlmScorer");function as(e=[]){return e.map(t=>`${t.name}: ${t.description}`).join(`
-`)}r(as,"formatAvailableTools");function tu(e){return e.length>0?Gt(e):"No tools called"}r(tu,"formatToolSelection");function nu(e){return e.length>0?e.map(t=>Yt(t)).join(`
-`):"No tools called"}r(nu,"formatToolInvocations");function ou(e){let t=e.map(n=>`"${n}"`);return t.length<=1?t.join(""):`${t.slice(0,-1).join(", ")}, and ${t[t.length-1]}`}r(ou,"formatScorerTypeList");function ru(e,t){let n=e.turns.slice(0,t);return n.length===0?"":`Conversation so far:
+The JSON must conform to this schema${n}: ${t}`}r(Hu,"jsonResponseInstruction");function Bu(e,t){let n=[];t&&n.push({role:"system",content:t});for(let o of e){if(o.role==="system"){n.push({role:"system",content:o.content});continue}if(o.role==="user"){let i=Os(o.content);i&&n.push({role:"user",content:i});continue}if(o.role==="assistant"){let i=Os(o.content);i&&n.push({role:"assistant",content:i})}}return n}r(Bu,"toCdfMessages");function Os(e){return e.filter(t=>t.type==="text"&&typeof t.text=="string").map(t=>t.text).join(`
+`)}r(Os,"extractTextParts");function Ku(e){switch(e){case"stop":return"stop";case"length":return"length";case"content_filter":case"content-filter":return"content-filter";case"tool_calls":case"tool-calls":return"tool-calls";default:return"other"}}r(Ku,"mapFinishReason");var Vu="azure/gpt-5";function Bo(e={}){return e.cliModelId?.trim()||process.env.EVAL_JUDGE_MODEL?.trim()||e.agentModelFallback?.trim()||Vu}r(Bo,"resolveJudgeModelId");function Ls(e){let t=e.modelId??Bo({cliModelId:e.cliModelId,agentModelFallback:e.agentModelFallback});return Fs({modelId:t,service:e.service,verbose:e.verbose})}r(Ls,"createJudgeModel");import{mkdir as em,writeFile as tm}from"fs/promises";import{join as js}from"path";var Ke="report.json",Ko="report.md";var pn="eval-report";function dn(e){let t={name:e.name,message:e.message};ue(e)&&(e.hint&&(t.hint=e.hint),e.helpUrl&&(t.helpUrl=e.helpUrl)),kt(e)&&(t.http={status:e.httpStatusCode,...e.requestUrl!==void 0&&{url:e.requestUrl},...e.responseBody!==void 0&&{responseBody:e.responseBody}});let n=e.cause;return n instanceof Error&&(t.cause=dn(n)),t}r(dn,"serializeError");function Vo(e,t,n){return{version:1,meta:n,summary:{totalCases:e.totalCases,passedCases:e.passedCases,failedCases:e.failedCases,skippedCases:e.skippedCases,metExpectations:mt(e.results),verdictFailures:ut(e.results),unexpectedPassCount:gt(e.results)},cases:e.results.map(Us),traces:t}}r(Vo,"buildEvalReportDocument");function Us(e){let t=e.evalCase;return{id:t.id,source:t.source,...t.tags!==void 0&&t.tags.length>0&&{tags:t.tags},expectPass:t.expectPass!==!1,scorersPassed:e.passed,verdictPassed:ye(e),...t.contextInformation!==void 0&&{contextInformation:t.contextInformation},...e.run&&{turns:e.run.turns.map(n=>({input:n.input,output:n.output,toolCalls:n.toolCalls.map(o=>({name:o.name,...o.input!==void 0&&{input:o.input},...o.result!==void 0&&{result:o.result}})),apiRoundTrips:n.apiRoundTrips}))},scores:e.scores.map(n=>({turnIndex:n.turnIndex,scorerType:n.scorerType,score:n.score,...n.label!==void 0&&{label:n.label},...n.explanation!==void 0&&{explanation:n.explanation},passed:n.passed})),...e.invokeError&&{invokeError:dn(e.invokeError)},...e.scoreError&&{scoreError:dn(e.scoreError)}}}r(Us,"serializeCaseResult");function Yo(e){let t=e.summary.skippedCases>0?` (${e.summary.skippedCases} skipped)`:"";return Xu(`
+# Agent eval report
+
+- Agent: \`${e.meta.agentExternalId}\`
+- Judge model: \`${e.meta.judgeModelId}\`
+- Chat route: \`${e.meta.route}\`
+- Summary: **${e.summary.metExpectations}/${e.cases.length}** cases met expectations${t}
+- Full verbose-equivalent traces: \`${Ke}\` (${e.traces.length} event(s))
+
+${e.cases.map(Gu).join(`
+`)}
+${Ju(e.traces)}
+`)}r(Yo,"formatEvalReportMarkdown");function Gu(e){let t=e.verdictPassed?"PASS":"FAIL",n=e.expectPass===!1?" (expected fail)":"",o=e.tags&&e.tags.length>0?`- Tags: ${e.tags.map(i=>`\`${i}\``).join(", ")}
+`:"";return`
+## ${t}: \`${e.id}\`${n}
+
+- Source: \`${e.source}\`
+- Verdict: ${e.verdictPassed?"met expectations":"did not meet expectations"}
+- Scorers: ${e.scorersPassed?"all passed":"failed or missing"}
+${o}
+${e.invokeError?Ns("Invoke error",e.invokeError):""}${e.scoreError?Ns("Score error",e.scoreError):""}${Yu(e)}
+`}r(Gu,"formatCaseMarkdown");function Yu(e){return e.turns?e.turns.map((t,n)=>zu(t,n,e)).join(`
+`):e.scores.length>0?_s(e.scores,{showTurnIndex:!0}):""}r(Yu,"formatCaseBodyMarkdown");function zu(e,t,n){let i=(n.turns?.length??0)>1?`### Turn ${t+1}`:"### Turn",s=n.scores.filter(a=>a.turnIndex===t);return`
+${i}
+
+**Prompt**
+
+${Go(e.input)}
+
+**Response**
+
+${Go(e.output||"(empty)")}
+
+${qu(e.toolCalls)}${s.length>0?_s(s):""}
+`}r(zu,"formatTurnMarkdown");function qu(e){return e.length===0?"":`
+**Tool calls**
+
+${e.map(n=>{let o=et(n,Qe),i=n.result!==void 0?` \u2192 ${ln(n.result,Qe)}`:"";return`- ${Qu(`${o}${i}`)}`}).join(`
+`)}
+`}r(qu,"formatToolCallsMarkdown");function _s(e,t={}){return`
+**Scorers**
+
+${e.map(o=>{let i=t.showTurnIndex===!0?` (turn ${o.turnIndex+1})`:"",s=[o.label?`label=${o.label}`:void 0,`score=${o.score}`].filter(Boolean).join(", "),a=o.explanation?`
+  - ${o.explanation}`:"";return`- \`${o.scorerType}\`${i}: **${o.passed?"pass":"fail"}** (${s})${a}`}).join(`
+`)}
+`}r(_s,"formatScoresMarkdown");function Ju(e){if(e.length===0)return"";let t=e.slice(0,40),n=t.map(i=>i.type==="log"?`- ${i.message}`:`- JSON: ${i.label}`).join(`
+`),o=e.length>t.length?`
+- \u2026 ${e.length-t.length} more event(s) in \`${Ke}\``:"";return`
+## Debug traces (summary)
+
+Captured ${e.length} verbose-equivalent event(s). See \`${Ke}\` for full payloads (agent chat request/response, judge inputs, chat/completions I/O).
+
+${n}${o}
+`}r(Ju,"formatTracesMarkdown");function Ns(e,t){return`
+### ${e}
+
+${zo(`- Message: ${t.message}`,t.hint&&`- Hint: ${t.hint}`,t.helpUrl&&`- Help: ${t.helpUrl}`,t.http&&Wu(t.http),t.cause&&Zu(t.cause))}
+`}r(Ns,"formatErrorMarkdown");function Wu(e){let t=e.responseBody===void 0?void 0:`- Response body:
+
+${Go(typeof e.responseBody=="string"?e.responseBody:JSON.stringify(e.responseBody,null,2))}`;return zo(`- HTTP status: \`${e.status}\``,e.url&&`- URL: \`${e.url}\``,t)}r(Wu,"formatHttpErrorMarkdown");function Zu(e){return zo(`- Cause: ${e.name}: ${e.message}`,e.http&&`  - HTTP status: \`${e.http.status}\``,e.http?.url&&`  - URL: \`${e.http.url}\``)}r(Zu,"formatCauseMarkdown");function zo(...e){return e.filter(t=>!!t).join(`
+`)}r(zo,"lines");function Xu(e){return`${e.replace(/^\n+/,"").replace(/\n{3,}/g,`
+
+`).trimEnd()}
+`}r(Xu,"trimBlankLines");function Go(e){return`\`\`\`
+${e.replace(/```/g,"``\\`")}
+\`\`\``}r(Go,"fence");function Qu(e){let t=Math.max(0,...(e.match(/`+/g)??[]).map(i=>i.length)),n="`".repeat(t+1),o=e.startsWith("`")||e.endsWith("`")||e.startsWith(" ")||e.endsWith(" ")?" ":"";return`${n}${o}${e}${o}${n}`}r(Qu,"inlineCode");async function Hs(e){let t=e.mkdir??em,n=e.writeFile??tm,o=e.reportDir;await t(o,{recursive:!0});let i=Vo(e.summary,e.traces,{...e.meta,reportDir:o}),s=js(o,Ke),a=js(o,Ko);return await n(s,`${JSON.stringify(i,null,2)}
+`,"utf8"),await n(a,Yo(i),"utf8"),{jsonPath:s,mdPath:a}}r(Hs,"writeEvalReport");async function Bs(e,t,n){let o=(e.externalId!==void 0?e.externalId.trim():void 0)??(e.systemAgent?ai:void 0);if(e.externalId!==void 0&&o==="")throw new m("--external-id cannot be empty.",{hint:`Provide a valid agent external ID, or omit the flag to read from ${A.configGlob}.`,shouldReport:!1});if(o!==void 0)return{externalId:o,agentYaml:void 0};let i=await n(t);if(!i.externalId)throw new m("No agent specified.",{hint:`Provide --external-id, --system-agent, or run from a directory with ${A.configGlob}.`,shouldReport:!1});return{externalId:i.externalId,agentYaml:i}}r(Bs,"resolveAgentIdentity");var nm=new Set(["localhost","127.0.0.1"]),om="Pass an origin only, e.g. http://127.0.0.1:5000. Do not set COGNITE_BASE_URL to localhost \u2014 use AGENT_CHAT_BASE_URL instead.",rm="Use a loopback origin for local cog-ai. Chat request bodies (including session nonces) are only sent to loopback origins.";function im(){let e=process.env.AGENT_CHAT_ROUTE?.trim().toLowerCase();return e==="public"||e==="agents"?"public":e==="internal"||e==="fusion"?"internal":"public"}r(im,"resolveAgentChatRoute");function Ks(){let e=process.env.AGENT_CHAT_BASE_URL?.trim();if(!e)return;let t;try{t=new URL(e)}catch{throw ht(e,"must be a valid URL")}if(t.protocol!=="http:"&&t.protocol!=="https:")throw ht(e,"must use http or https");if(t.pathname!=="/"&&t.pathname!=="")throw ht(e,"must be an origin only (e.g. http://127.0.0.1:5000), not a full API path");if(t.search||t.hash)throw ht(e,"must not include query or fragment");if(!nm.has(t.hostname))throw ht(e,"must target a loopback host (localhost or 127.0.0.1)",rm);return t.origin}r(Ks,"resolveAgentChatBaseUrl");function Vs(e){return e?"internal":im()}r(Vs,"resolveEffectiveAgentChatRoute");function Gs(e,t){let n=t==="internal"?"internal/agents/chat":"agents/chat";return`/api/v1/projects/${encodeURIComponent(e)}/ai/${n}`}r(Gs,"formatAgentChatPath");function Ys(e){return`/api/v1/projects/${encodeURIComponent(e)}/ai/chat/completions`}r(Ys,"formatChatCompletionsPath");function un(e,t){return`${e.replace(/\/+$/,"")}${t.startsWith("/")?t:`/${t}`}`}r(un,"joinClientUrl");function ht(e,t,n=om){return new m(`Invalid agent chat base URL "${e}": ${t}.`,{hint:n,shouldReport:!1})}r(ht,"invalidChatBaseUrl");function sm(e){return{...e,messages:e.messages.map(t=>t.role==="action"&&t.type==="userSession"?{...t,nonce:"<redacted>"}:t)}}r(sm,"redactNonces");async function zs(e){let t=e.allowToolConfirmation!==!1,n=e.maxTurns??8,o=e.verbose;o?.log(`agentExternalId=${e.agentExternalId} | auto-allow tools=${t}`);let i=e.cursor,s,a,c,l,p=[],d="",u=0;for(let f=0;f<n;f+=1){u+=1;let h=`turn ${u}/${n}`,g;a&&c&&i?(g={agentExternalId:e.agentExternalId,cursor:i,messages:[{role:"action",type:"userSession",actionId:a,nonce:c}]},a=void 0,c=void 0):s&&i?(g={agentExternalId:e.agentExternalId,cursor:i,messages:[{role:"action",type:"toolConfirmation",actionId:s,status:"ALLOW"}]},s=void 0):g={agentExternalId:e.agentExternalId,...e.contextInformation?{contextInformation:e.contextInformation}:{},...i?{cursor:i}:{},messages:[{role:"user",content:{type:"text",text:e.input}}]},o?.log(`${h}: sending chat request\u2026`),o?.logJson(`${h} request body`,sm(g)),l=await e.service.postAgentChat(g),o?.logJson(`${h} response`,l);let y;try{y=$s(l)}catch(S){throw new m(`Failed to parse agent response on turn ${u}/${n}`,{hint:"The CDF agent API returned an unexpected response shape. Run with --verbose to see the raw response.",cause:S})}if(Ds(p,y.toolCalls),o?.log(`${h}: extracted output length=${y.output.length}, tools=[${cn(y.toolCalls)}]`),y.output&&(d=y.output),y.pendingToolConfirmation){if(o?.log(`${h}: tool confirmation requested \u2014 tool=${y.pendingToolConfirmation.toolName??"?"} actionId=${y.pendingToolConfirmation.actionId}`),!t)throw new m(`Agent requested tool confirmation (${y.pendingToolConfirmation.toolName??"unknown"}) but allowToolConfirmation is false`,{hint:"Re-run with tool confirmation enabled, or adjust the agent to avoid confirmation prompts."});if(!y.cursor||!y.pendingToolConfirmation.actionId)throw new m("Tool confirmation missing cursor or actionId",{hint:"The agent API returned an incomplete tool-confirmation action. This may be an API bug \u2014 retry or report to CDF support."});i=y.cursor,s=y.pendingToolConfirmation.actionId,o?.log(`${h}: auto-ALLOW, continuing with cursor\u2026`);continue}if(y.pendingUserSession){if(o?.log(`${h}: userSession requested \u2014 actionId=${y.pendingUserSession.actionId}, creating nonce\u2026`),!y.cursor||!y.pendingUserSession.actionId)throw new m("User session missing cursor or actionId",{hint:"The agent API returned an incomplete user-session action. This may be an API bug \u2014 retry or report to CDF support."});let S=await e.service.createSessionNonce();i=y.cursor,a=y.pendingUserSession.actionId,c=S,o?.log(`${h}: created nonce, continuing with cursor\u2026`);continue}return o?.log(`${h}: conversation complete`),{output:d,toolCalls:p,turns:u,cursor:y.cursor??i,lastResponse:l}}throw new m(`Agent chat exceeded ${n} turns (action loop?)`,{hint:"The agent may be stuck in a tool-confirmation or user-session loop. Increase maxTurns or inspect the agent configuration."})}r(zs,"invokeAgentCase");import{createCorrectnessEvaluator as um}from"@arizeai/phoenix-evals/llm/createCorrectnessEvaluator";import{createFaithfulnessEvaluator as mm}from"@arizeai/phoenix-evals/llm/createFaithfulnessEvaluator";import{createToolInvocationEvaluator as gm}from"@arizeai/phoenix-evals/llm/createToolInvocationEvaluator";import{createToolSelectionEvaluator as fm}from"@arizeai/phoenix-evals/llm/createToolSelectionEvaluator";function qs(e){return{log(t){e(t)},logJson(t,n,o=6e3){e(`${t}:
+${am(n,o)}`)}}}r(qs,"createEvalLogger");function Js(){let e=[];return{events:e,logger:{log(t){e.push({type:"log",message:t})},logJson(t,n){e.push({type:"json",label:t,value:cm(n)})}}}}r(Js,"createTraceCapture");function Ws(e,t){return{log(n){e.log(n),t.log(n)},logJson(n,o,i){e.logJson(n,o,i),t.logJson(n,o,i)}}}r(Ws,"teeEvalLogger");function am(e,t=6e3){let n;try{n=JSON.stringify(e,null,2)??String(e)}catch{n=String(e)}return n.length<=t?n:`${n.slice(0,t)}
+\u2026 (${n.length-t} more chars)`}r(am,"formatJson");function Zs(e){return e<1e3?`${Math.round(e)}ms`:`${(e/1e3).toFixed(1)}s`}r(Zs,"formatDurationMs");function cm(e){try{return JSON.parse(JSON.stringify(e)??"null")}catch{return String(e)}}r(cm,"cloneForTrace");var lm=.5,pm={correctness:{pass:"correct",fail:"incorrect"},faithfulness:{pass:"faithful",fail:"unfaithful"},toolSelection:{pass:"correct",fail:"incorrect"},toolInvocation:{pass:"correct",fail:"incorrect"}};function dm(e,t){let n=pm[e];if(n){if(t.label===n.pass)return!0;if(t.label===n.fail)return!1}return(t.score??0)>=lm}r(dm,"scorerPassed");async function yt(e,t,n,o,i,s){s?.log(`scoring ${n.type} (Phoenix + CDF /ai/chat/completions)\u2026`),s?.logJson(`${n.type} judge input`,i);let a=performance.now(),c;try{c=await o.evaluate(i)}catch(d){if(ue(d))throw d;let u=d instanceof Error?d.message:String(d);throw new m(`Phoenix ${n.type} judge failed (${u}). Judge uses CDF POST .../ai/chat/completions.`,{cause:d})}s?.log(`${n.type} judge finished in ${Zs(performance.now()-a)}`),s?.logJson(`${n.type} judge result`,c);let l=dm(n.type,c),p=typeof c.score=="number"?c.score:l?1:0;return{caseId:e,turnIndex:t,scorerType:n.type,score:p,label:c.label,explanation:c.explanation,passed:l}}r(yt,"runPhoenixLlmScorer");function Xs(e=[]){return e.map(t=>`${t.name}: ${t.description}`).join(`
+`)}r(Xs,"formatAvailableTools");function hm(e){return e.length>0?cn(e):"No tools called"}r(hm,"formatToolSelection");function ym(e){return e.length>0?e.map(t=>et(t)).join(`
+`):"No tools called"}r(ym,"formatToolInvocations");function Sm(e){let t=e.map(n=>`"${n}"`);return t.length<=1?t.join(""):`${t.slice(0,-1).join(", ")}, and ${t[t.length-1]}`}r(Sm,"formatScorerTypeList");function wm(e,t){let n=e.turns.slice(0,t);return n.length===0?"":`Conversation so far:
 `+n.map(o=>`User: ${o.input}
 Assistant: ${o.output}`).join(`
 `)+`
 
-`}r(ru,"conversationContext");async function iu(e,t,n,o,i,s){let a=o.turns[t];if(!a)throw new m(`No agent response recorded for turn ${t+1} of case "${e.id}" (${e.source}).`,{hint:"This is an internal mismatch between scored turns and executed turns."});let c=ru(o,t),l=s?.verbose;if(n.type==="correctness"){let d=Xd({model:i});return pt(e.id,t,n,d,{input:`${c}User question:
+`}r(wm,"conversationContext");async function vm(e,t,n,o,i,s){let a=o.turns[t];if(!a)throw new m(`No agent response recorded for turn ${t+1} of case "${e.id}" (${e.source}).`,{hint:"This is an internal mismatch between scored turns and executed turns."});let c=wm(o,t),l=s?.verbose;if(n.type==="correctness"){let d=um({model:i});return yt(e.id,t,n,d,{input:`${c}User question:
 ${a.input}
 
-Reference criteria:
-${n.reference}`,output:a.output},l)}if(n.type==="faithfulness"){let d=Zd({model:i});return pt(e.id,t,n,d,{input:c?`${c}Current question:
-${a.input}`:a.input,output:a.output,context:n.context},l)}if(n.type==="toolSelection"){let d=eu({model:i});return pt(e.id,t,n,d,{input:c?`${c}Current question:
-${a.input}`:a.input,availableTools:as(s?.tools),toolSelection:tu(a.toolCalls)},l)}if(n.type==="toolInvocation"){let d=Qd({model:i});return pt(e.id,t,n,d,{input:c?`${c}Current question:
-${a.input}`:a.input,availableTools:as(s?.tools),toolSelection:nu(a.toolCalls)},l)}let p=n;throw new m(`Scorer type "${p.type}" is not supported yet.`,{hint:`The CLI eval schema currently supports only ${ou(Fi)} scorers.`,shouldReport:!1})}r(iu,"evaluateScorer");async function su(e,t,n,o,i){let s=e.turns[t]?.scorers??[];return Promise.all(s.map(a=>iu(e,t,a,n,o,i)))}r(su,"scoreTurn");async function cs(e,t,n,o){return(await Promise.all(e.turns.map((s,a)=>su(e,a,t,n,o)))).flat()}r(cs,"scoreCase");function au(e){return e.length>0&&e.every(t=>t.passed)}r(au,"casePassed");function cu(e,t,n){if(n<=1)return e;let o=e instanceof Error?e.message:String(e);return new m(`turn ${t+1}/${n}: ${o}`,{hint:Ee(e)?e.hint:void 0,helpUrl:Ee(e)?e.helpUrl:void 0,shouldReport:Ee(e)?e.shouldReport:void 0,cause:e})}r(cu,"annotateTurnFailure");async function lu(e,t){let{service:n,agentExternalId:o,judgeModel:i,verbose:s}=t;s?.log(`--- case "${e.id}" (${e.source}) invoke ---`);let a;try{let c=[],l;for(let[p,d]of e.turns.entries()){s?.log(`  turn ${p+1}/${e.turns.length}: "${d.input}"`);let u;try{u=await rs({service:n,agentExternalId:o,input:d.input,cursor:l,contextInformation:e.contextInformation,allowToolConfirmation:t.allowToolConfirmation,verbose:s})}catch(f){throw cu(f,p,e.turns.length)}l=u.cursor,c.push({input:d.input,output:u.output,toolCalls:u.toolCalls,apiRoundTrips:u.turns})}a={caseId:e.id,turns:c}}catch(c){return{evalCase:e,scores:[],passed:!1,invokeError:c instanceof Error?c:new Error(String(c))}}s?.log(`--- case "${e.id}" (${e.source}) score (Phoenix) ---`);try{let c=await cs(e,a,i,{verbose:s,tools:t.tools});return{evalCase:e,run:a,scores:c,passed:au(c)}}catch(c){return{evalCase:e,run:a,scores:[],passed:!1,scoreError:c instanceof Error?c:new Error(String(c))}}}r(lu,"runCase");async function ls(e){let{cases:t,verbose:n}=e,o=[];for(let s of t){let a=await lu(s,e);if(o.push(a),e.failFast&&!a.passed){n?.log(`--- fail-fast: stopping after failed case "${s.id}" (${s.source}) ---`);break}}let i=o.filter(s=>s.passed).length;return{totalCases:t.length,passedCases:i,failedCases:o.length-i,skippedCases:t.length-o.length,results:o}}r(ls,"runEval");var ps={"cdf-version":"20230101-alpha"};function us(e,t){let n=ns(e.project,t),o=os(e.project);async function i(a){try{return(await e.post(n,{data:a,headers:ps})).data}catch(c){let l=t==="internal"&&le(c)&&c.status===404?" Try the public route: set AGENT_CHAT_ROUTE=public.":"";throw ds(c,"Agent chat",n,l||void 0)}}r(i,"postAgentChat");async function s(a){try{return(await e.post(o,{data:a,headers:ps})).data}catch(c){throw ds(c,"Chat completions",o)}}return r(s,"postChatCompletions"),{postAgentChat:i,postChatCompletions:s}}r(us,"getEvalService");function ds(e,t,n,o){if(!le(e))return e instanceof Error?e:new Error(String(e));let i=si(e),s=i?`: ${i}`:"",a=o??"";return new fe(`${t} failed (${e.status})${s}${a}`,{httpStatusCode:e.status,requestUrl:n,responseBody:Zn(e),cause:e})}r(ds,"wrapCdfApiError");function gs(e){if(!e)return"(none)";let t=[],n=e.dataModels?.length??0,o=e.instanceSpaces?.length??0;return(n>0||o>0)&&t.push(`${n} data model(s), ${o} space(s)`),e.appContext&&t.push("app context"),t.length>0?t.join(", "):"(none)"}r(gs,"formatSessionContextSummary");function uu(e){let t=e.filter(s=>s.contextInformation!==void 0);if(t.length===0)return;let n=t.map(s=>s.contextInformation),o=n[0];return t.length===e.length&&n.every(s=>du(s,o))?gs(o):`varies by case (${t.length}/${e.length})`}r(uu,"summarizeSessionContextForStdout");function ms(e,t){return t?[...t,e]:[e]}r(ms,"collectRepeatableValues");var So=Object.freeze({case:new _e("--case <id>","Run only cases with this id (repeatable)").argParser(ms),tag:new _e("--tag <tag>","Run only cases with this tag (repeatable)").argParser(ms),judgeModel:new _e("--judge-model <model>","LLM model for scoring eval cases (e.g. azure/gpt-5)"),upsert:new _e("--upsert","Push local agent.yaml to CDF before running evals"),failFast:new _e("--fail-fast","Stop after the first failing case; skip the rest"),verbose:new _e("-v, --verbose","Log request/response traces to stderr"),failOnToolConfirmation:new _e("--fail-on-tool-confirmation","Fail a case instead of auto-approving when the agent requests tool confirmation")}),LA=Object.values(So).map(e=>e.long).filter(e=>e!=null);function mu(e,t,n,o,i){if(e.length!==0){t(I(n.dim("toolsCalled:"),o));for(let s of e){let a=Yt(s,yo);!i||s.result===void 0||s.result===null?t(I(a,o+1)):t(I(`${a} ${n.dim(`\u2192 ${Wi(s.result)}`)}`,o+1))}}}r(mu,"formatToolCalls");function gu(e,t,n,o,i){let s=e.passed?n.green("\u2713"):n.red("\u2717"),a=o&&e.evalCase.source?`${e.evalCase.id} (${e.evalCase.source})`:e.evalCase.id;if(t(`${s} ${a}`),e.invokeError){t(I(n.red("invoke: fail"))),t(I(e.invokeError.message,2)),e.invokeError instanceof m&&e.invokeError.hint&&t(I(n.yellow(`\u{1F4A1} ${e.invokeError.hint}`),2));return}e.scoreError&&(t(I(n.red("score: fail"))),t(I(e.scoreError.message,2)),e.scoreError instanceof m&&e.scoreError.hint&&t(I(n.yellow(`\u{1F4A1} ${e.scoreError.hint}`),2)));let c=e.run?.turns.length??0,l=[...new Set([...Array.from({length:c},(d,u)=>u),...e.scores.map(d=>d.turnIndex)])].sort((d,u)=>d-u),p=l.length>1;for(let d of l){let u=p?2:1;p&&t(I(n.dim(`turn ${d+1}`)));let f=e.run?.turns[d];f&&mu(f.toolCalls,t,n,u,i);for(let g of e.scores.filter(y=>y.turnIndex===d)){let y=g.passed?n.green("pass"):n.red("fail");t(I(`${g.scorerType}: ${y}`,u)),g.explanation&&t(I(n.dim(g.explanation),u+1))}}}r(gu,"formatCaseResult");async function fu(e,t,n,o){if(n.upsert){await t.upsert(Re(e)),o.writeStdout(o.c.green(`Pushed agent "${e.externalId}" to project "${o.project}"`));return}try{let i=await t.getByExternalId(e.externalId),s=Vi(e,i);s.length>0&&o.writeStderr(o.c.yellow(Gi(s,{verbose:n.verbose})))}catch(i){if(i instanceof m&&i.message.includes("not found"))o.writeStderr(o.c.yellow(`Warning: agent "${e.externalId}" is not deployed in CDF. Run with --upsert to push local config before evaluating.`));else{let s=i instanceof Error?i.message:String(i);o.writeStderr(o.c.yellow(`Warning: failed to fetch deployed agent "${e.externalId}": ${s}`))}}}r(fu,"ensureAgentConfigBeforeEval");async function fs(e,t,n={}){let o=n.readAgentYaml??Z,i=n.loadEvalCases??Ui,s=n.writeStdout??(D=>console.log(D)),a=n.writeStderr??(D=>console.error(D)),c=n.chalk??P(process.stdout),l=n.getAgentClient??J,p=n.getAgentsService??Q,d=n.getEvalService??us,u=n.runEval??ls,f=pu(e??"."),g=await o(f),y=await i(f),h=Mi(y,{caseFilter:t.case,tagFilter:t.tag}),S=[...new Set(y.map(D=>D.source))],w=S.length>1,C=await l(t,f),v=p(C);await fu(g,v,t,{project:C.project,writeStdout:s,writeStderr:a,c});let R=ts(),$=d(C,R),b=t.verbose?is(D=>console.error(D)):void 0,k=ho({cliModelId:t.judgeModel,agentModelFallback:g.model});w&&s(`Matched ${h.length} of ${y.length} case(s) across ${S.length} file(s)`);let W=uu(h);W!==void 0&&s(`Session context: ${W}`),s(`Judge model: ${c.cyan(k)}`),b?.log(`Agent: ${g.externalId}`);for(let D of h)b?.log(`  ${D.id}: ${gs(D.contextInformation)}`);for(let D of S){let q=y.filter(et=>et.source===D).length;b?.log(`  ${D} (${q} case(s))`)}b?.log(`Loaded ${h.length} case(s): ${h.map(D=>D.id).join(", ")}`),b?.log(`judge model: ${k} (source: ${t.judgeModel?"--judge-model flag":process.env.EVAL_JUDGE_MODEL?"EVAL_JUDGE_MODEL env":g.model?"agent.yaml model fallback":"default"})`),b?.log(`agent chat route: ${R}`);let ge=es({cliModelId:t.judgeModel,agentModelFallback:g.model,service:$,verbose:b}),x=await u({cases:h,service:$,agentExternalId:g.externalId,judgeModel:ge,verbose:b,tools:g.tools,allowToolConfirmation:!t.failOnToolConfirmation,failFast:t.failFast});for(let D of x.results)gu(D,s,c,w,t.verbose??!1);let ie=`${x.passedCases}/${x.totalCases} cases passed`,be=x.failedCases>0?c.bold(c.red(ie)):c.bold(c.green(ie));s(`
-${be}`),x.skippedCases>0&&s(c.yellow(`Stopped early (--fail-fast): ${x.skippedCases} case(s) not run.`)),x.failedCases>0&&(process.exitCode=1);let He=Array.from(new Set(h.flatMap(D=>D.turns.flatMap(q=>q.scorers?.map(et=>et.type)??[])))),se=$n();await Yi(n.telemetry,{caseCount:x.totalCases,passCount:x.passedCases,failCount:x.failedCases,scorersUsed:He,success:x.failedCases===0,...se!==void 0&&{actionDurationMs:se}})}r(fs,"handleAgentsEval");import{Option as vu}from"commander";function qt(e,t){return e.map((n,o)=>Math.max(n.length,...t.map(i=>i[o].length)))}r(qt,"computeColumnWidths");function dt(e,t,n=e){return e.map((o,i)=>n[i]+" ".repeat(Math.max(0,t[i]-o.length))).join("  ").trimEnd()}r(dt,"formatTableRow");import{writeFile as ys}from"fs/promises";import{join as hu,resolve as Su}from"path";import{resolve as yu}from"path";async function ue(e,t,n={}){let o=n.readAgentYaml??Z,i=n.getAgentClient??J,s=n.getAgentsService??Q,a=yu(e??"."),c=await o(a),l=await i(t,a);await s(l).upsert(Re(c));let d=P(process.stdout);return console.log(d.green(`Pushed agent "${c.externalId}" to project "${l.project}"`)),{client:l,agentYaml:c}}r(ue,"handleAgentsPush");var ve="published",wo=class wo extends ye{constructor(){super("publish");this.handle=r(async(n,o,i)=>{let s=i.optsWithGlobals(),a=Su(n??"."),c=await Z(a),l=c.labels??[],p=hu(a,T.config);if(l.includes(ve))await ue(n,s);else{let u={...c,labels:[...l,ve]};await ys(p,ce(u));try{await ue(n,s)}catch(f){throw await ys(p,ce(c)),f}}let d=P(process.stdout);console.log(d.green(`Published agent "${c.externalId}"`))},"handle");this.description("Promote a draft agent to production").argument("[dir]","Agent project directory").addHelpText("after",wu),this.action(this.handle)}};r(wo,"PublishCommand");var Jt=wo,wu=`
+Criteria:
+${n.criteria}`,output:a.output},l)}if(n.type==="faithfulness"){let d=mm({model:i});return yt(e.id,t,n,d,{input:c?`${c}Current question:
+${a.input}`:a.input,output:a.output,context:n.groundTruth},l)}if(n.type==="toolSelection"||n.type==="toolInvocation"){let d=n.tools??e.tools??s?.tools??[];if(d.length===0){let f=s?.tools===void 0?`Add a tools field to the scorer, case, or eval.yaml root (${A.configGlob} is not used with --external-id/--system-agent).`:`Add a tools field to the scorer, case, or eval.yaml root, or declare tools in ${A.configGlob}.`,h=`Warning: Skipping ${n.type} scorer on case "${e.id}": no tools available.`;return l?.log(h),s?.warn?.(h,f),null}if(n.type==="toolSelection"){let f=fm({model:i});return yt(e.id,t,n,f,{input:c?`${c}Current question:
+${a.input}`:a.input,availableTools:Xs(d),toolSelection:hm(a.toolCalls)},l)}let u=gm({model:i});return yt(e.id,t,n,u,{input:c?`${c}Current question:
+${a.input}`:a.input,availableTools:Xs(d),toolSelection:ym(a.toolCalls)},l)}let p=n;throw new m(`Scorer type "${p.type}" is not supported yet.`,{hint:`The CLI eval schema currently supports only ${Sm(gs)} scorers.`,shouldReport:!1})}r(vm,"evaluateScorer");async function Cm(e,t,n,o,i){let s=e.turns[t]?.scorers??[];return(await Promise.all(s.map(c=>vm(e,t,c,n,o,i)))).filter(c=>c!==null)}r(Cm,"scoreTurn");async function Qs(e,t,n,o){return(await Promise.all(e.turns.map((s,a)=>Cm(e,a,t,n,o)))).flat()}r(Qs,"scoreCase");function Am(e){return e.length>0&&e.every(t=>t.passed)}r(Am,"casePassed");function Em(e,t,n){if(n<=1)return e;let o=e instanceof Error?e.message:String(e);return new m(`turn ${t+1}/${n}: ${o}`,{hint:ue(e)?e.hint:void 0,helpUrl:ue(e)?e.helpUrl:void 0,shouldReport:ue(e)?e.shouldReport:void 0,cause:e})}r(Em,"annotateTurnFailure");async function bm(e,t){let{service:n,agentExternalId:o,judgeModel:i,verbose:s}=t;s?.log(`--- case "${e.id}" (${e.source}) invoke ---`);let a;try{let c=[],l;for(let[p,d]of e.turns.entries()){s?.log(`  turn ${p+1}/${e.turns.length}: "${d.input}"`);let u;try{u=await zs({service:n,agentExternalId:o,input:d.input,cursor:l,contextInformation:e.contextInformation,allowToolConfirmation:t.allowToolConfirmation,verbose:s})}catch(f){throw Em(f,p,e.turns.length)}l=u.cursor,c.push({input:d.input,output:u.output,toolCalls:u.toolCalls,apiRoundTrips:u.turns})}a={caseId:e.id,turns:c}}catch(c){return{evalCase:e,scores:[],passed:!1,invokeError:c instanceof Error?c:new Error(String(c))}}s?.log(`--- case "${e.id}" (${e.source}) score (Phoenix) ---`);try{let c=await Qs(e,a,i,{verbose:s,tools:t.tools,warn:t.warn});return{evalCase:e,run:a,scores:c,passed:Am(c)}}catch(c){return{evalCase:e,run:a,scores:[],passed:!1,scoreError:c instanceof Error?c:new Error(String(c))}}}r(bm,"runCase");async function ea(e){let{cases:t,verbose:n}=e,o=[];for(let s of t){let a=await bm(s,e);if(o.push(a),e.failFast&&!ye(a)){n?.log(`--- fail-fast: stopping after failed case "${s.id}" (${s.source}) ---`);break}}let i=o.filter(s=>s.passed).length;return{totalCases:t.length,passedCases:i,failedCases:o.length-i,skippedCases:t.length-o.length,results:o}}r(ea,"runEval");var ta={"cdf-version":"20230101-alpha"};function na(e,t,n={}){let{chatBaseUrl:o}=n,i=Gs(e.project,t),s=Ys(e.project),a=o?un(o,i):i,c=o?a:un(e.getBaseUrl(),i),l=un(e.getBaseUrl(),s);async function p(h){try{return(await e.post(a,{data:h,headers:ta})).data}catch(g){if(!se(g))throw xm(g,o);let y=!o&&t==="internal"&&g.status===404?" Try the public route: set AGENT_CHAT_ROUTE=public.":"";throw qo(g,"Agent chat",c,y||void 0)}}r(p,"postAgentChat");async function d(h){try{return(await e.post(s,{data:h,headers:ta})).data}catch(g){throw qo(g,"Chat completions",l)}}r(d,"postChatCompletions");async function u(){let h=`/api/v1/projects/${encodeURIComponent(e.project)}/sessions`;try{return await f({oneshotTokenExchange:!0},h)}catch(g){if(Pm(g))return await f({tokenExchange:!0},h);throw g}}r(u,"createSessionNonce");async function f(h,g){try{let y=await e.sessions.create([h]),S=y?.[0]?.nonce;if(!S)throw new m("Session creation returned no nonce",{hint:"The Sessions API returned an empty items list. Retry, or check IdP configuration for this project.",cause:new Error(`Response items: ${JSON.stringify(y)}`)});return S}catch(y){throw y instanceof m?y:qo(y,"Session creation",g)}}return r(f,"requestSessionNonce"),{postAgentChat:p,postChatCompletions:d,createSessionNonce:u,agentChatUrl:c,chatCompletionsUrl:l}}r(na,"getEvalService");function xm(e,t){return e instanceof Error?!t||!km(e)?e:new m(`Agent chat failed: could not connect to ${t}`,{hint:`Is cog-ai running? Try GET ${t}/health`,cause:e,shouldReport:!1}):new Error(String(e))}r(xm,"wrapConnectError");function km(e){let t=e,n=new Set;for(;t!=null&&!n.has(t)&&(n.add(t),typeof t=="object");){let o=t.code;if(o==="ECONNREFUSED"||o==="ENOTFOUND"||o==="ECONNRESET")return!0;t=t.cause}return!1}r(km,"isConnectError");function Pm(e){let t=e instanceof de?e.httpStatusCode:se(e)?e.status:void 0;return t===400||t===401||t===403}r(Pm,"isSessionTypeRejected");function qo(e,t,n,o){if(!se(e))return e instanceof Error?e:new Error(String(e));let i=Hi(e),s=i?`: ${i}`:"",a=o??"";return new de(`${t} failed (${e.status})${s}${a}`,{httpStatusCode:e.status,requestUrl:n,responseBody:Ao(e),cause:e})}r(qo,"wrapCdfApiError");function ia(e){if(!e)return"(none)";let t=[],n=e.dataModels?.length??0,o=e.instanceSpaces?.length??0;return(n>0||o>0)&&t.push(`${n} data model(s), ${o} space(s)`),e.appContext&&t.push("app context"),t.length>0?t.join(", "):"(none)"}r(ia,"formatSessionContextSummary");function Rm(e){let t=e.filter(s=>s.contextInformation!==void 0);if(t.length===0)return;let n=t.map(s=>s.contextInformation),o=n[0];return t.length===e.length&&n.every(s=>Tm(s,o))?ia(o):`varies by case (${t.length}/${e.length})`}r(Rm,"summarizeSessionContextForStdout");function ra(e,t){return t?[...t,e]:[e]}r(ra,"collectRepeatableValues");var Jo=Object.freeze({case:new ve("--case <id>","Run only cases with this id (repeatable)").argParser(ra),tag:new ve("--tag <tag>","Run only cases with this tag (repeatable)").argParser(ra),judgeModel:new ve("--judge-model <model>","LLM model for scoring eval cases (e.g. azure/gpt-5)"),externalId:new ve("--external-id <id>",`Agent external ID (alternative to reading from ${A.configGlob})`).conflicts("systemAgent"),systemAgent:new ve("--system-agent","Evaluate the Cognite system agent (currently cdf_industrial_v4)").conflicts("externalId"),upsert:new ve("--upsert",`Push the local ${A.configGlob} to CDF before running evals`).conflicts("externalId").conflicts("systemAgent"),failFast:new ve("--fail-fast","Stop after the first failing case; skip the rest"),verbose:new ve("-v, --verbose","Log request/response traces to stderr"),failOnToolConfirmation:new ve("--fail-on-tool-confirmation","Fail a case instead of auto-approving when the agent requests tool confirmation"),reportDir:new ve("--report-dir [path]",`Write structured eval reports (report.json + report.md); defaults to ${pn} when the path is omitted`).preset(pn)}),tx=Object.values(Jo).map(e=>e.long).filter(e=>e!=null);function Im(e,t){return e.expectPass===!1?t.dim(" (expected fail)"):""}r(Im,"formatExpectedFailSuffix");function Dm(e,t,n,o,i){if(e.length!==0){t(T(n.dim("toolsCalled:"),o));for(let s of e){let a=et(s,Qe);!i||s.result===void 0||s.result===null?t(T(a,o+1)):t(T(`${a} ${n.dim(`\u2192 ${ln(s.result)}`)}`,o+1))}}}r(Dm,"formatToolCalls");function $m(e,t,n,o,i){let a=ye(e)?n.green("\u2713"):n.red("\u2717"),c=Im(e.evalCase,n),l=o&&e.evalCase.source?`${e.evalCase.id} (${e.evalCase.source})`:e.evalCase.id;if(t(`${a} ${l}${c}`),e.invokeError){t(T(n.red("invoke: fail"))),t(T(e.invokeError.message,2)),e.invokeError instanceof m&&e.invokeError.hint&&t(T(n.yellow(`\u{1F4A1} ${e.invokeError.hint}`),2));return}e.scoreError&&(t(T(n.red("score: fail"))),t(T(e.scoreError.message,2)),e.scoreError instanceof m&&e.scoreError.hint&&t(T(n.yellow(`\u{1F4A1} ${e.scoreError.hint}`),2)));let p=e.run?.turns.length??0,d=[...new Set([...Array.from({length:p},(f,h)=>h),...e.scores.map(f=>f.turnIndex)])].sort((f,h)=>f-h),u=d.length>1;for(let f of d){let h=u?2:1;u&&t(T(n.dim(`turn ${f+1}`)));let g=e.run?.turns[f];g&&Dm(g.toolCalls,t,n,h,i);for(let y of e.scores.filter(S=>S.turnIndex===f)){let S=y.passed?n.green("pass"):n.red("fail");t(T(`${y.scorerType}: ${S}`,h)),y.explanation&&t(T(n.dim(y.explanation),h+1))}}}r($m,"formatCaseResult");async function Om(e,t,n,o){if(n.upsert){await t.upsert(Ue(e)),o.writeStdout(o.c.green(`Pushed agent "${e.externalId}" to project "${o.project}"`));return}try{let i=await t.getByExternalId(e.externalId),s=Ps(e,i);s.length>0&&o.writeStderr(o.c.yellow(Ts(s,{verbose:n.verbose})))}catch(i){if(i instanceof m&&i.message.includes("not found"))o.writeStderr(o.c.yellow(`Warning: agent "${e.externalId}" is not deployed in CDF. Run with --upsert to push local config before evaluating.`));else{let s=i instanceof Error?i.message:String(i);o.writeStderr(o.c.yellow(`Warning: failed to fetch deployed agent "${e.externalId}": ${s}`))}}}r(Om,"ensureAgentConfigBeforeEval");async function sa(e,t,n={}){let o=n.readAgentYaml??De,i=n.loadEvalCases??vs,s=n.writeStdout??(E=>console.log(E)),a=n.writeStderr??(E=>console.error(E)),c=n.chalk??P(process.stdout),l=n.getAgentClient??z,p=n.getAgentsService??ee,d=n.getEvalService??na,u=n.runEval??ea,f=n.writeEvalReport??Hs,h=oa(e??"."),{externalId:g,agentYaml:y}=await Bs(t,h,o);if(t.upsert&&y===void 0)throw new m(`--upsert requires a local ${A.configGlob} to push.`,{hint:`Remove --upsert, or add an agent definition (${A.configGlob}) to this directory.`,shouldReport:!1});let S=await i(h),w=ws(S,{caseFilter:t.case,tagFilter:t.tag}),v=[...new Set(S.map(E=>E.source))],C=v.length>1,x=await l(t,h),M=p(x);y!==void 0&&await Om(y,M,t,{project:x.project,writeStdout:s,writeStderr:a,c});let B=Ks(),R=Vs(B),Y=d(x,R,B?{chatBaseUrl:B}:{}),ce=t.reportDir!==void 0&&t.reportDir.length>0?oa(t.reportDir):void 0,I=ce!==void 0?Js():void 0,oe=t.verbose?qs(E=>a(E)):void 0,F=I&&oe?Ws(oe,I.logger):I?.logger??oe,re=Bo({cliModelId:t.judgeModel,agentModelFallback:y?.model});C&&s(`Matched ${w.length} of ${S.length} case(s) across ${v.length} file(s)`);let K=Rm(w);K!==void 0&&s(`Session context: ${K}`),s(`Judge model: ${c.cyan(re)}`),F?.log(`Agent: ${g}`);for(let E of w)F?.log(`  ${E.id}: ${ia(E.contextInformation)}`);for(let E of v){let pe=S.filter(Vn=>Vn.source===E).length;F?.log(`  ${E} (${pe} case(s))`)}F?.log(`Loaded ${w.length} case(s): ${w.map(E=>E.id).join(", ")}`),F?.log(`judge model: ${re} (source: ${t.judgeModel?"--judge-model flag":process.env.EVAL_JUDGE_MODEL?"EVAL_JUDGE_MODEL env":y?.model?`${A.configGlob} model fallback`:"default"})`),F?.log(`agent chat route: ${R}`),F?.log(`agent chat URL: ${Y.agentChatUrl}`),F?.log(`chat completions URL: ${Y.chatCompletionsUrl}`);let Bn=Ls({cliModelId:t.judgeModel,agentModelFallback:y?.model,service:Y,verbose:F}),le=await u({cases:w,service:Y,agentExternalId:g,judgeModel:Bn,verbose:F,tools:y?.tools,warn:r((E,pe)=>{a(c.yellow(pe?`${E}
+  hint: ${pe}`:E))},"warn"),allowToolConfirmation:!t.failOnToolConfirmation,failFast:t.failFast});for(let E of le.results)$m(E,s,c,C,t.verbose??!1),E.evalCase.expectPass===!1&&!E.invokeError&&!E.scoreError&&E.passed&&a(c.yellow(`Warning: case "${E.evalCase.id}" expected scorers to fail but they passed.`));let Kn=Oo(le.results),_r=mt(le.results),jr=`${_r}/${le.results.length} cases met expectations`,xl=Kn?c.bold(c.red(jr)):c.bold(c.green(jr));if(s(`
+${xl}`),le.skippedCases>0&&s(c.yellow(`Stopped early (--fail-fast): ${le.skippedCases} case(s) not run.`)),ce!==void 0&&I!==void 0)try{let{jsonPath:E,mdPath:pe}=await f({reportDir:ce,summary:le,traces:I.events,meta:{agentExternalId:g,judgeModelId:re,route:R}});s(`Wrote eval report: ${E}`),s(`Wrote eval report: ${pe}`)}catch(E){let pe=E instanceof Error?E.message:String(E);a(c.yellow(`Warning: failed to write eval report: ${pe}`))}Kn&&(process.exitCode=1);let kl=Array.from(new Set(w.flatMap(E=>E.turns.flatMap(pe=>pe.scorers?.map(Vn=>Vn.type)??[])))),Hr=eo();await Rs(n.telemetry,{caseCount:le.totalCases,passCount:_r,failCount:ut(le.results),unexpectedPassCount:gt(le.results),scorersUsed:kl,success:!Kn,...Hr!==void 0&&{actionDurationMs:Hr}})}r(sa,"handleAgentsEval");import{Option as Um}from"commander";function mn(e,t){return e.map((n,o)=>Math.max(n.length,...t.map(i=>i[o].length)))}r(mn,"computeColumnWidths");function St(e,t,n=e){return e.map((o,i)=>n[i]+" ".repeat(Math.max(0,t[i]-o.length))).join("  ").trimEnd()}r(St,"formatTableRow");import{writeFile as aa}from"fs/promises";import{resolve as Lm}from"path";import{resolve as Fm}from"path";async function Ce(e,t,n={}){let o=n.readAgentYaml??De,i=n.getAgentClient??z,s=n.getAgentsService??ee,a=Fm(e??"."),c=await o(a),l=await i(t,a);await s(l).upsert(Ue(c));let d=P(process.stdout);return console.log(d.green(`Pushed agent "${c.externalId}" to project "${l.project}"`)),{client:l,agentYaml:c}}r(Ce,"handleAgentsPush");var ke="published",Wo=class Wo extends Ee{constructor(){super("publish");this.handle=r(async(n,o,i)=>{let s=i.optsWithGlobals(),a=Lm(n??"."),{path:c,agent:l}=await at(a),p=l.labels??[];if(p.includes(ke))await Ce(n,s);else{let u={...l,labels:[...p,ke]};await aa(c,ge(u));try{await Ce(n,s)}catch(f){throw await aa(c,ge(l)),f}}let d=P(process.stdout);console.log(d.green(`Published agent "${l.externalId}"`))},"handle");this.description("Promote a draft agent to production").argument("[dir]","Agent project directory").addHelpText("after",Mm),this.action(this.handle)}};r(Wo,"PublishCommand");var gn=Wo,Mm=`
 Examples:
   cognite agents publish              Publish agent in current directory
   cognite agents publish ./my-agent   Publish agent in my-agent directory
-`;var hs=Object.freeze({json:new vu("--json","Output as JSON")});async function Ss(e,t={}){let n=t.getAgentClient??J,o=t.getAgentsService??Q,i=await n(e,process.cwd()),c=(await o(i).list()).items;if(e.json){console.log(JSON.stringify(c,null,2));return}if(c.length===0){console.log(`No agents found in project "${i.project}".`);return}let l=P(process.stdout),p=c.map(w=>({externalId:w.externalId,name:w.name,status:w.labels?.includes(ve)?"published":"draft",model:w.model,updated:vo(w.lastUpdatedTime)})),d=["externalId","name","status","model","updated"],u=["External ID","Name","Status","Model","Updated"],f=p.map(w=>d.map(C=>w[C])),g=qt(u,f);console.log(),console.log(l.bold(dt(u,g))),console.log(l.dim(g.map(w=>"\u2500".repeat(w)).join("  ")));for(let w of p){let C=w.status==="published"?l.green(w.status):l.yellow(w.status),v=d.map($=>w[$]),R=d.map($=>$==="status"?C:w[$]);console.log(dt(v,g,R))}console.log();let y=p.filter(w=>w.status==="published").length,h=p.length-y,S=[`${p.length} agent${p.length===1?"":"s"}`];y>0&&S.push(`${y} published`),h>0&&S.push(`${h} draft`),console.log(S.join(", "))}r(Ss,"handleAgentsList");function vo(e,t=Date.now()){let n=t-e;if(n<0)return"just now";let o=Math.floor(n/1e3);if(o<60)return"just now";let i=Math.floor(o/60);if(i<60)return`${i}m ago`;let s=Math.floor(i/60);return s<24?`${s}h ago`:`${Math.floor(s/24)}d ago`}r(vo,"formatRelativeTime");import{resolve as Cu}from"path";import{Option as Au}from"commander";function ws(e,t){let{org:n,project:o,baseUrl:i}=e,s;try{s=new URL(i).hostname}catch{return null}let{externalId:a,versionTag:c}=t,l=new URLSearchParams({cluster:s,customAppVersion:c,workspace:"industrial-tools"});return`https://${n}.fusion.cognite.com/${o}/flows-apps/app/${encodeURIComponent(a)}?${l}`}r(ws,"generateFusionUrl");function vs(e){let{org:t,project:n,cluster:o,agentExternalId:i}=e,s=new URLSearchParams({cluster:o,atlasOverride:i});return`https://${t}.fusion.cognite.com/${n}?${s}`}r(vs,"generateAtlasAgentUrl");var Co=Object.freeze({upsert:new Au("--upsert","Push the agent to CDF before opening (upsert draft)").default(!1)}),Cb=Object.values(Co).map(e=>e.long).filter(e=>e!=null);function bu(e){try{return new URL(e.getBaseUrl()).hostname}catch{throw new m("Could not determine cluster from client base URL.",{hint:"Check your --base-url or session project configuration.",shouldReport:!1})}}r(bu,"clusterFromBaseUrl");async function Cs(e,t,n={}){let o=n.handleAgentsPush??ue,i=n.readAgentYaml??Z,s=n.getAgentClient??J,a=n.resolveOrg??Ei,c=n.openInBrowser??Ot,l=Cu(e??"."),{client:p,agentYaml:d}=t.upsert?await o(e,t):{agentYaml:await i(l),client:await s(t,l)},u=a(t,l),f=p.project,g=bu(p),y=vs({org:u,project:f,cluster:g,agentExternalId:d.externalId}),h=P(process.stdout);console.log(h.cyan(`Opening ${y}`)),c(y)}r(Cs,"handleAgentsOpen");import{existsSync as Eu}from"fs";import{mkdir as xu,writeFile as ku}from"fs/promises";import{join as Pu,resolve as Iu}from"path";import{Option as As}from"commander";async function bs(e,t,n={getAgentClient:{}}){let o=await J(t,process.cwd(),n.getAgentClient),i=await Q(o).getByExternalId(e),s=Iu(t.dir),a=Pu(s,T.config);if(Eu(a)&&!t.force)throw new m(`${T.config} already exists at:
-  ${a}`,{hint:"Use --force to overwrite the existing file.",shouldReport:!1});await xu(s,{recursive:!0}),await ku(a,ce(i));let c=P(process.stdout);console.log(c.green(`Pulled agent "${i.name}" (${e}) to ${a}`))}r(bs,"handleAgentsPull");var Ao=Object.freeze({externalId:{name:"external-id",description:"externalId of the agent to pull"}}),bo=Object.freeze({dir:new As("--dir <path>","Output directory").default("."),force:new As("--force",`Overwrite existing ${T.config} without prompting`)}),Fb=Object.values(bo).map(e=>e.long).filter(e=>e!=null);import{resolve as Du}from"path";import{Option as Es}from"commander";var xs=Object.freeze({externalId:new Es("--external-id <id>","Agent external ID (alternative to reading from agent.yaml)"),json:new Es("--json","Output as JSON")});function Tu(e){return e.labels?.includes(ve)?"published":"draft"}r(Tu,"describeAgentStatus");function Ru(e,t=Date.now()){return e==null||isNaN(e)?"unknown":`${new Date(e).toISOString()} (${vo(e,t)})`}r(Ru,"formatUpdatedAt");function $u(e){let t=e.tools??[];if(t.length===0)return["Tools: none"];let n=[`Tools (${t.length}):`];for(let o of t)n.push(I(`- ${o.type}: ${o.description}`));return n}r($u,"formatTools");function Ou(e){let t=e.skills??[];if(t.length===0)return["Skills: none"];let n=[`Skills (${t.length}):`];for(let o of t)n.push(I(`- ${o}`));return n}r(Ou,"formatSkills");function Fu(e){let t=e.subagents??[];if(t.length===0)return["Sub-agents: none"];let n=[`Sub-agents (${t.length}):`];for(let o of t)n.push(I(`- ${o.agentExternalId}`));return n}r(Fu,"formatSubagents");function Lu(e,t,n=Date.now()){let o=Tu(e);return["",`Agent:    ${t.bold(e.name)} (${t.dim(e.externalId)})`,`Status:   ${o==="published"?t.green(o):t.yellow(o)}`,`Model:    ${e.model}`,`Updated:  ${t.dim(Ru(e.lastUpdatedTime,n))}`,"",...$u(e),"",...Ou(e),"",...Fu(e),...o==="draft"?["","Run `npx @cognite/cli agents publish .` to publish this agent."]:[]]}r(Lu,"renderAgentStatus");async function ks(e,t,n={}){let o=n.readAgentYaml??Z,i=n.getAgentClient??J,s=n.getAgentsService??Q,a=Du(e??"."),c;if(t.externalId!==void 0){let f=t.externalId.trim();if(!f)throw new m("--external-id cannot be empty.",{hint:"Provide a valid agent external ID, or omit the flag to read from agent.yaml.",shouldReport:!1});c=f}else c=(await o(a)).externalId;let l=await i(t,a),d=await s(l).getByExternalId(c);if(t.json){console.log(JSON.stringify(d,null,2));return}let u=Lu(d,P(process.stdout));for(let f of u)console.log(f)}r(ks,"handleAgentsStatus");import{writeFile as Ps}from"fs/promises";import{join as Mu,resolve as Uu}from"path";var Eo=class Eo extends ye{constructor(){super("unpublish");this.handle=r(async(n,o,i)=>{let s=i.optsWithGlobals(),a=Uu(n??"."),c=Mu(a,T.config),l=await Z(a),p=l.labels??[];if(p.includes(ve)){let u={...l,labels:p.filter(f=>f!==ve)};await Ps(c,ce(u));try{await ue(n,s)}catch(f){throw await Ps(c,ce(l)),f}}else await ue(n,s);let d=P(process.stdout);console.log(d.green(`Unpublished agent "${l.externalId}"`))},"handle");this.description("Retract a published agent back to draft").argument("[dir]","Agent project directory").addHelpText("after",_u),this.action(this.handle)}};r(Eo,"UnpublishCommand");var zt=Eo,_u=`
+`;var ca=Object.freeze({json:new Um("--json","Output as JSON")});async function la(e,t={}){let n=t.getAgentClient??z,o=t.getAgentsService??ee,i=await n(e,process.cwd()),c=(await o(i).list()).items;if(e.json){console.log(JSON.stringify(c,null,2));return}if(c.length===0){console.log(`No agents found in project "${i.project}".`);return}let l=P(process.stdout),p=c.map(w=>({externalId:w.externalId,name:w.name,status:w.labels?.includes(ke)?"published":"draft",model:w.model,updated:Zo(w.lastUpdatedTime)})),d=["externalId","name","status","model","updated"],u=["External ID","Name","Status","Model","Updated"],f=p.map(w=>d.map(v=>w[v])),h=mn(u,f);console.log(),console.log(l.bold(St(u,h))),console.log(l.dim(h.map(w=>"\u2500".repeat(w)).join("  ")));for(let w of p){let v=w.status==="published"?l.green(w.status):l.yellow(w.status),C=d.map(M=>w[M]),x=d.map(M=>M==="status"?v:w[M]);console.log(St(C,h,x))}console.log();let g=p.filter(w=>w.status==="published").length,y=p.length-g,S=[`${p.length} agent${p.length===1?"":"s"}`];g>0&&S.push(`${g} published`),y>0&&S.push(`${y} draft`),console.log(S.join(", "))}r(la,"handleAgentsList");function Zo(e,t=Date.now()){let n=t-e;if(n<0)return"just now";let o=Math.floor(n/1e3);if(o<60)return"just now";let i=Math.floor(o/60);if(i<60)return`${i}m ago`;let s=Math.floor(i/60);return s<24?`${s}h ago`:`${Math.floor(s/24)}d ago`}r(Zo,"formatRelativeTime");import{resolve as jm}from"path";import{Option as Hm}from"commander";function pa(e,t){let{org:n,project:o,baseUrl:i}=e,s;try{s=new URL(i).hostname}catch{return null}let{externalId:a,versionTag:c}=t,l=new URLSearchParams({cluster:s,customAppVersion:c,workspace:"industrial-tools"});return`https://${n}.fusion.cognite.com/${o}/flows-apps/app/${encodeURIComponent(a)}?${l}`}r(pa,"generateFusionUrl");function da(e){let{org:t,project:n,cluster:o,agentExternalId:i}=e,s=new URLSearchParams({cluster:o,atlasOverride:i});return`https://${t}.fusion.cognite.com/${n}?${s}`}r(da,"generateAtlasAgentUrl");import{execFileSync as ua}from"child_process";import{platform as Nm}from"os";import _m from"path";function X(e,t={}){let{platform:n=Nm}=t;switch(n()){case"darwin":return e==="macos";case"win32":return e==="windows";default:return e==="other"}}r(X,"isOS");function fn(e,t={}){let{exec:n=ua,log:o=console.log}=t,[i,s]=X("macos",t)?["open",[e]]:X("windows",t)?["rundll32",["url.dll,FileProtocolHandler",e]]:["xdg-open",[e]];try{return n(i,s),!0}catch{return o(`Could not open browser \u2014 open manually:
+  ${e}`),!1}}r(fn,"openInBrowser");function ma(e,t={}){let{exec:n=ua,log:o=console.log}=t,[i,s]=X("macos",t)?["open",["-R",e]]:X("windows",t)?["explorer",[`/select,${e}`]]:["xdg-open",[_m.dirname(e)]];try{n(i,s)}catch{o(`Could not open file manager \u2014 files are at:
+  ${e}`)}}r(ma,"revealInFileManager");var Xo=Object.freeze({upsert:new Hm("--upsert","Push the agent to CDF before opening (upsert draft)").default(!1)}),Yx=Object.values(Xo).map(e=>e.long).filter(e=>e!=null);function Bm(e){try{return new URL(e.getBaseUrl()).hostname}catch{throw new m("Could not determine cluster from client base URL.",{hint:"Check your --base-url or session project configuration.",shouldReport:!1})}}r(Bm,"clusterFromBaseUrl");async function ga(e,t,n={}){let o=n.handleAgentsPush??Ce,i=n.readAgentYaml??De,s=n.getAgentClient??z,a=n.resolveOrg??as,c=n.openInBrowser??fn,l=jm(e??"."),{client:p,agentYaml:d}=t.upsert?await o(e,t):{agentYaml:await i(l),client:await s(t,l)},u=a(t,l),f=p.project,h=Bm(p),g=da({org:u,project:f,cluster:h,agentExternalId:d.externalId}),y=P(process.stdout);console.log(y.cyan(`Opening ${g}`)),c(g)}r(ga,"handleAgentsOpen");import{mkdir as Km,writeFile as Vm}from"fs/promises";import{basename as Gm,join as Ym,resolve as zm}from"path";import{Option as qm}from"commander";async function fa(e,t,n,o={getAgentClient:{}}){let i=await z(n,process.cwd(),o.getAgentClient),s=await ee(i).getByExternalId(e),a=zm(t??"."),c=Ie(Gm(a)),l=(await st(a)).find(u=>u.toLowerCase()===c.toLowerCase()),p=Ym(a,l??c);if(l!==void 0&&!n.force)throw new m(`${l} already exists at:
+  ${p}`,{hint:"Use --force to overwrite the existing file.",shouldReport:!1});await Km(a,{recursive:!0}),await Vm(p,ge(s));let d=P(process.stdout);console.log(d.green(`Pulled agent "${s.name}" (${e}) to ${p}`))}r(fa,"handleAgentsPull");var wt=Object.freeze({externalId:{name:"external-id",description:"externalId of the agent to pull"},dir:{name:"dir",description:"Agent project directory"}}),Qo=Object.freeze({force:new qm("--force","Overwrite the existing agent definition without prompting")}),rk=Object.values(Qo).map(e=>e.long).filter(e=>e!=null);import{resolve as Jm}from"path";import{Option as ha}from"commander";var ya=Object.freeze({externalId:new ha("--external-id <id>",`Agent external ID (alternative to reading from ${A.configGlob})`),json:new ha("--json","Output as JSON")});function Wm(e){return e.labels?.includes(ke)?"published":"draft"}r(Wm,"describeAgentStatus");function Zm(e,t=Date.now()){return e==null||isNaN(e)?"unknown":`${new Date(e).toISOString()} (${Zo(e,t)})`}r(Zm,"formatUpdatedAt");function Xm(e){let t=e.tools??[];if(t.length===0)return["Tools: none"];let n=[`Tools (${t.length}):`];for(let o of t)n.push(T(`- ${o.type}: ${o.description}`));return n}r(Xm,"formatTools");function Qm(e){let t=e.skills??[];if(t.length===0)return["Skills: none"];let n=[`Skills (${t.length}):`];for(let o of t)n.push(T(`- ${o}`));return n}r(Qm,"formatSkills");function eg(e){let t=e.subagents??[];if(t.length===0)return["Sub-agents: none"];let n=[`Sub-agents (${t.length}):`];for(let o of t)n.push(T(`- ${o.agentExternalId}`));return n}r(eg,"formatSubagents");function tg(e,t,n=Date.now()){let o=Wm(e);return["",`Agent:    ${t.bold(e.name)} (${t.dim(e.externalId)})`,`Status:   ${o==="published"?t.green(o):t.yellow(o)}`,`Model:    ${e.model}`,`Updated:  ${t.dim(Zm(e.lastUpdatedTime,n))}`,"",...Xm(e),"",...Qm(e),"",...eg(e),...o==="draft"?["","Run `npx @cognite/cli agents publish .` to publish this agent."]:[]]}r(tg,"renderAgentStatus");async function Sa(e,t,n={}){let o=n.readAgentYaml??De,i=n.getAgentClient??z,s=n.getAgentsService??ee,a=Jm(e??"."),c;if(t.externalId!==void 0){let f=t.externalId.trim();if(!f)throw new m("--external-id cannot be empty.",{hint:`Provide a valid agent external ID, or omit the flag to read from ${A.configGlob}.`,shouldReport:!1});c=f}else c=(await o(a)).externalId;let l=await i(t,a),d=await s(l).getByExternalId(c);if(t.json){console.log(JSON.stringify(d,null,2));return}let u=tg(d,P(process.stdout));for(let f of u)console.log(f)}r(Sa,"handleAgentsStatus");import{writeFile as wa}from"fs/promises";import{resolve as ng}from"path";var er=class er extends Ee{constructor(){super("unpublish");this.handle=r(async(n,o,i)=>{let s=i.optsWithGlobals(),a=ng(n??"."),{path:c,agent:l}=await at(a),p=l.labels??[];if(p.includes(ke)){let u={...l,labels:p.filter(f=>f!==ke)};await wa(c,ge(u));try{await Ce(n,s)}catch(f){throw await wa(c,ge(l)),f}}else await Ce(n,s);let d=P(process.stdout);console.log(d.green(`Unpublished agent "${l.externalId}"`))},"handle");this.description("Retract a published agent back to draft").argument("[dir]","Agent project directory").addHelpText("after",og),this.action(this.handle)}};r(er,"UnpublishCommand");var hn=er,og=`
 Examples:
   cognite agents unpublish              Unpublish agent in current directory
   cognite agents unpublish ./my-agent   Unpublish agent in my-agent directory
-`;var ko=class ko extends vt{constructor(t,n){super(t),this.telemetry=n}configure(){this.description("Manage Atlas agents \u2014 create, iterate, and publish agents to Cognite Data Fusion"),this.hook("postAction",(t,n)=>kr(this.telemetry,n)),this.create(),this.push(),this.open(),this.publish(),this.unpublish(),this.pull(),this.list(),this.status(),this.eval()}create(){let t=new Kt;return this.addCommand(t),t}push(){return this.command("push").description("Push a draft agent to CDF for interactive testing").argument("[dir]","Agent project directory").action(async(t,n,o)=>{await ue(t,o.optsWithGlobals())})}open(){let t=this.command("open").description("Open the agent in Fusion for interactive testing").argument("[dir]","Agent project directory");for(let n of Object.values(Co))t.addOption(n);return t.action((n,o,i)=>Cs(n,i.optsWithGlobals()))}publish(){let t=new Jt;return this.addCommand(t),t}unpublish(){let t=new zt;return this.addCommand(t),t}pull(){let t=this.command("pull").description("Pull an existing agent from CDF into the local project").argument(`<${Ao.externalId.name}>`,Ao.externalId.description);for(let n of Object.values(bo))t.addOption(n);return t.action((n,o,i)=>bs(n,i.optsWithGlobals()))}list(){let t=this.command("list").description("List agents in the CDF project");for(let n of Object.values(hs))t.addOption(n);return t.action((n,o)=>Ss(o.optsWithGlobals()))}status(){let t=this.command("status").description("Show the current status of the agent in CDF").argument("[dir]","Agent project directory");for(let n of Object.values(xs))t.addOption(n);return t.action(async(n,o,i)=>ks(n,i.optsWithGlobals()))}eval(){let t=this.command("eval").description("Run eval cases for an agent").argument("[dir]","Agent directory");for(let n of Object.values(So))t.addOption(n);return t.action((n,o,i)=>fs(n,i.optsWithGlobals(),{telemetry:this.telemetry}))}};r(ko,"AgentsCommand");var xo=ko;function Is(e,t={}){let n=new xo("agents",t.telemetry);return e.addCommand(n),n}r(Is,"registerAgentsCommand");import{existsSync as um,readFileSync as mm}from"fs";import{join as gm,resolve as an}from"path";import{verifyBundle as fm}from"@cognite/app-sdk/codesigning";import{decodeProtectedHeader as ym}from"jose";import Do from"enquirer";import{email as ju,pipe as Nu,safeParse as Hu,string as Bu}from"valibot";var Ku=Nu(Bu(),ju());function ze(e,t="email"){let n=e.trim();if(!n)throw new Error(`${t} is required`);if(!Hu(Ku,n).success)throw new Error(`${t} must look like an email (user@example.com); got "${e}"`);return n}r(ze,"parseEmail");function We(e,t="--expires"){let n=Number(e);if(!Number.isInteger(n)||n<1||n>12)throw new Error(`${t} must be an integer between 1 and 12 (months); got "${e}"`);return n}r(We,"parseExpiryMonths");import{execFileSync as Xt}from"child_process";import{execFileSync as Vu}from"child_process";function Wt(e={}){let{execFileSync:t=Vu}=e;try{return t("git",["--version"],{stdio:"ignore"}),!0}catch{return!1}}r(Wt,"isGitInstalled");function me(e={}){if(!Wt(e))throw new m("Git is not installed or not found on PATH.",{hint:"Install Git (https://git-scm.com) and ensure it is on your PATH, then try again.",shouldReport:!1})}r(me,"throwIfGitMissing");function Zt(e,t={}){let{execFileSync:n=Xt}=t;try{return n("git",["-C",e,"status"],{stdio:"ignore"}),!0}catch{return!1}}r(Zt,"isInsideGitRepo");function Ds(e,t={}){let{execFileSync:n=Xt}=t;n("git",["-C",e,"init"],{stdio:"pipe"}),n("git",["-C",e,"add","."],{stdio:"pipe"}),n("git",["-C",e,"commit","-m","Initial commit","--no-gpg-sign","--no-verify"],{stdio:"pipe"})}r(Ds,"gitInitAndCommit");function Ts(e={}){let{execFileSync:t=Xt}=e;try{return String(t("git",["config","--get","user.name"],{encoding:"utf-8",stdio:["ignore","pipe","ignore"]})).trim()||void 0}catch{return}}r(Ts,"gitUserName");function Rs(e={}){let{execFileSync:t=Xt}=e;try{return String(t("git",["config","--get","user.email"],{encoding:"utf-8",stdio:["ignore","pipe","ignore"]})).trim()||void 0}catch{return}}r(Rs,"gitUserEmail");var Qt=3,$s="Signing identity (kid) \u2014 e.g. jsmith-dev-001 (lowercase letters, digits, hyphens)",Os=`Key expiry in months (${1}-${12})`,Fs="Email address for the registry entry",Ls=`Passphrase for the encrypted private key (min ${15} chars)`,Ms="Confirm passphrase",Us=r(()=>`Passphrase must be at least ${15} characters`,"passphraseTooShortMsg"),_s=r(e=>`Passphrases do not match (attempt ${e}/${Qt}).
-`,"passphraseMismatchMsg"),js=`Passphrase confirmation failed after ${Qt} attempts`,Ns=r(e=>`A signing key with kid "${e}" already exists. Overwrite it?`,"confirmOverwriteMsg"),Hs="How would you like to submit your key registration?",Bs="Open in browser",Ks="Copy link to clipboard";async function en(e){return Do.prompt(e)}r(en,"defaultPrompt");function To(e){return t=>{try{return e(t),!0}catch(n){return n instanceof Error?n.message:"Invalid"}}}r(To,"parserAsValidator");var Yu=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;function Ne(e){let t=e.trim();if(!t)throw new Error("--kid must not be empty");if(t.length>64)throw new Error("--kid must be 64 characters or fewer");if(!Yu.test(t))throw new Error("--kid must contain only lowercase letters, digits, and hyphens, and must not start or end with a hyphen (e.g. jsmith-dev-001)");return t}r(Ne,"parseKid");async function Vs(e={}){let{prompt:t=en}=e,{kid:n}=await t({type:"input",name:"kid",message:$s,validate:To(Ne)});return Ne(n)}r(Vs,"promptKid");async function Gs(e={}){let{prompt:t=r(o=>Do.prompt(o),"prompt")}=e,{action:n}=await t({type:"select",name:"action",message:Hs,choices:[{name:"browser",message:Bs},{name:"clipboard",message:Ks}]});if(n!=="browser"&&n!=="clipboard")throw new Error(`Unexpected Zendesk action: ${n}`);return n}r(Gs,"promptZendeskAction");async function Ys(e={}){let{prompt:t=en}=e,{months:n}=await t({type:"input",name:"months",message:Os,initial:String(6),validate:To(o=>We(o,"expiry"))});return We(n,"expiry")}r(Ys,"promptExpiryMonths");async function qs(e={}){let{prompt:t=en,gitUserEmail:n=Rs}=e,{email:o}=await t({type:"input",name:"email",message:Fs,initial:n(),validate:To(i=>ze(i,"email"))});return ze(o,"email")}r(qs,"promptEmail");async function Js(e={}){let{prompt:t=en,stderr:n=process.stderr}=e;for(let o=1;o<=Qt;o+=1){let{passphrase:i}=await t({type:"password",name:"passphrase",message:Ls,validate:r(a=>a.length>=15?!0:Us(),"validate")}),{confirm:s}=await t({type:"password",name:"confirm",message:Ms});if(i===s)return A.from(i);n.write(_s(o))}throw new Error(js)}r(Js,"promptPassphrase");async function zs(e,t={}){let{prompt:n=r(i=>Do.prompt(i),"prompt")}=t,{confirmed:o}=await n({type:"confirm",name:"confirmed",message:Ns(e),initial:!1});return o}r(zs,"promptConfirmOverwrite");import{existsSync as nm,readdirSync as om,readFileSync as rm}from"fs";import{join as Ro}from"path";import{execFile as qu}from"child_process";import{promisify as Ju}from"util";var Ws="cognite-flows",zu=Ju(qu),Xs=r((e,t)=>zu(e,t),"defaultExecFile"),Wu=-25300,Xu=Wu&255;function Zu(e){if(!(e instanceof Error)||!("code"in e)||e.code!==Xu)return!1;let t="stderr"in e?String(e.stderr):"";return/could not be found/i.test(t)||t===""}r(Zu,"isKeychainNotFoundError");async function Zs(e,t,n={}){let o=t.expose();if(!G("macos",n))throw new Error("Keychain storage is only supported on macOS");let{execFile:i=Xs}=n;await i("security",["add-generic-password","-a",e,"-s",Ws,"-w",Buffer.from(o,"utf-8").toString("base64"),"-U"])}r(Zs,"storeKeyInKeychain");async function tn(e,t={}){if(!G("macos",t))return null;let{execFile:n=Xs}=t;try{let{stdout:o}=await n("security",["find-generic-password","-a",e,"-s",Ws,"-w"]);return A.from(Buffer.from(o.trim(),"base64").toString("utf-8"))}catch(o){if(Zu(o))return null;throw o}}r(tn,"readKeyFromKeychain");var ea="cognite-cli-signing",Qu="The native @napi-rs/keyring binary failed to load for this platform. Reinstall the CLI, or regenerate the key with `--output <path>` to use passphrase-encrypted file storage instead.",em="Multiple Windows Credential Manager entries match this kid. Open Credential Manager (Control Panel \u2192 User Accounts \u2192 Credential Manager \u2192 Windows Credentials) and remove the duplicates.",Qs="Windows Credential Manager failed unexpectedly. Regenerate the key with `--output <path>` to fall back to passphrase-encrypted file storage.";function tm(e){if(!(e instanceof Error))return Qs;let t=e.message.toLowerCase();return t.includes("cannot find module")||t.includes("module_not_found")||t.includes("failed to load native binding")?Qu:t.includes("ambiguous")?em:Qs}r(tm,"hintFor");function ta(e,t,n){return new m(`Failed to ${e} signing key for kid "${t}" in Windows Credential Manager`,{cause:n,hint:tm(n),shouldReport:!1})}r(ta,"wrapKeyringError");async function na(e,t){let{Entry:n}=await import("@napi-rs/keyring"),o=new n(e,t);return{setPassword:r(i=>o.setPassword(i),"setPassword"),getPassword:r(()=>o.getPassword(),"getPassword"),deleteCredential:r(()=>o.deleteCredential(),"deleteCredential")}}r(na,"defaultCreateEntry");async function oa(e,t,n={}){let{createEntry:o=na}=n,i=Buffer.from(t.expose(),"utf-8").toString("base64");try{(await o(ea,e)).setPassword(i)}catch(s){throw ta("store",e,s)}}r(oa,"storeSigningKey");async function nn(e,t={}){let{createEntry:n=na}=t;try{let i=(await n(ea,e)).getPassword();return i===null?null:A.from(Buffer.from(i,"base64").toString("utf-8"))}catch(o){throw ta("read",e,o)}}r(nn,"readSigningKey");var Pe=".pub.pem",$o=".key.jwe",Oo=".meta.json";function on(e){switch(e.kind){case"keychain":return"OS credential store";case"encrypted-file":return e.path;case"public-only":return"public-only (private key missing)"}}r(on,"formatLocalKeySource");function im(e){return{existsSync:e.existsSync??nm,readdirSync:e.readdirSync??om,readFileSync:e.readFileSync??((t,n)=>rm(t,n)),isOS:e.isOS??(t=>G(t)),readKeyFromKeychain:e.readKeyFromKeychain??(t=>tn(t)),readSigningKey:e.readSigningKey??(t=>nn(t))}}r(im,"resolveDeps");function sm(e){try{let t=JSON.parse(e);if(typeof t=="object"&&t!==null&&!Array.isArray(t)&&"email"in t&&typeof t.email=="string")return t.email}catch{}}r(sm,"readEmailFromMeta");function am(e,t){return t.existsSync(e)?t.readdirSync(e).filter(n=>n.endsWith(Pe)):[]}r(am,"publicKeyEntries");function cm(e){return e.slice(0,-Pe.length)}r(cm,"kidFromPublicKeyFilename");async function lm(e,t,n){if(n.isOS("macos")&&await n.readKeyFromKeychain(e).catch(()=>null)!==null)return{kind:"keychain"};if(n.isOS("windows")&&await n.readSigningKey(e).catch(()=>null)!==null)return{kind:"keychain"};let o=Ro(t,`${e}${$o}`);return n.existsSync(o)?{kind:"encrypted-file",path:o}:{kind:"public-only"}}r(lm,"resolveSource");async function rn(e=F().keysDir,t={}){let n=im(t),o=new Set,i=am(e,n).flatMap(s=>{let a=cm(s);return!a||o.has(a)?[]:(o.add(a),[{kid:a,entry:s}])});return Promise.all(i.map(async({kid:s,entry:a})=>{let c=await lm(s,e,n),l=Ro(e,`${s}${Oo}`),p;try{p=sm(n.readFileSync(l,"utf8"))}catch{}return{kid:s,source:c,publicKeyPath:Ro(e,a),email:p}}))}r(rn,"discoverLocalKeys");import{createReadStream as pm}from"fs";function sn(e){let t=pm(e);return new ReadableStream({start(n){t.on("data",o=>{let i=typeof o=="string"?Buffer.from(o):o;n.enqueue(new Uint8Array(i))}),t.on("end",()=>n.close()),t.on("error",o=>n.error(o))},cancel(){t.destroy()}})}r(sn,"createWebStreamFromFile");import dm from"path";var ra=".cognite-bundles";function ia(e,t){return`${e}-${t}.zip`}r(ia,"bundleFileName");function oe(e,t,n){return dm.join(e,ra,ia(t,n))}r(oe,"bundlePath");var sa=[".dev.sig",".cert.sig",".sig"];function hm(e){return{existsSync:e.existsSync??um,readFileSync:e.readFileSync??((t,n)=>mm(t,n)),createBundleStream:e.createBundleStream??sn,verifyBundle:e.verifyBundle??fm,loadAppConfig:e.loadAppConfig??E,defaultKeyDir:e.defaultKeyDir??(()=>F().keysDir)}}r(hm,"resolveDeps");function Sm(e,t){return sa.map(n=>`${e}${n}`).find(n=>t(n))}r(Sm,"findSiblingSignature");function wm(e){let t=e.split(".");return t.length===3&&t.every(n=>n.length>0)}r(wm,"isCompactJws");function vm(e){try{let t=ym(e);return typeof t.kid=="string"?t.kid:void 0}catch{return}}r(vm,"readKidFromToken");function Cm(e,t,n){let{existsSync:o,readFileSync:i}=n;try{Ne(e)}catch(a){throw new m(a instanceof Error?a.message:String(a),{shouldReport:!1})}if(!o(t))throw new m(`Key directory not found: ${t}`,{shouldReport:!1});let s=gm(t,`${e}${Pe}`);if(!o(s))throw new m(`No public key found for kid "${e}" in ${t}`,{shouldReport:!1});try{return i(s,"utf-8")}catch(a){throw new m(`Failed to read public key file: ${s}`,{cause:a,shouldReport:!1})}}r(Cm,"resolvePublicKeyForKid");function Am(e,t){let{payload:n,kid:o}=e;if(console.log(`Verified ${n.appId}@${n.version}`),console.log(`  kid:    ${o}`),console.log(`  hash:   ${n.bundleSha256}`),n.scopes&&n.scopes.length>0){let i=n.scopes.map(s=>`${s.org}/${s.project}`).join(", ");console.log(`  scopes: ${i}`)}t&&console.log(JSON.stringify(n,null,2))}r(Am,"printResult");async function aa(e,t,n={},o=process.cwd()){let{existsSync:i,readFileSync:s,loadAppConfig:a,createBundleStream:c,verifyBundle:l,defaultKeyDir:p}=hm(n),d;if(e)d=an(o,e);else{let y;try{y=a(o)}catch(h){let S=h instanceof Error?h.message:String(h);throw new m(S,{cause:h,hint:"Run this command from a Cognite app directory (one with app.json), or pass [bundle] explicitly.",shouldReport:!1})}d=oe(o,y.externalId,y.versionTag)}if(!i(d)){let y=e?void 0:"Default derived from app.json \u2014 pass [bundle] explicitly to override.";throw new m(`Bundle not found: ${d}`,{hint:y,shouldReport:!1})}let u=t.sig?an(o,t.sig):Sm(d,i);if(!u)throw new m("No signature file found.",{hint:`Pass --sig <path> or place one of ${sa.map(y=>`${d}${y}`).join(", ")} next to the bundle.`,shouldReport:!1});if(!i(u))throw new m(`Signature file not found: ${u}`,{shouldReport:!1});let f;try{f=s(u,"utf-8").trim()}catch(y){throw new m(`Failed to read signature file: ${u}`,{cause:y,shouldReport:!1})}if(!wm(f))throw new m(`Malformed JWS in ${u}`,{hint:"Expected a compact JWS (header.payload.signature \u2014 three base64url segments).",shouldReport:!1});let g;if(t.key){let y=an(o,t.key);if(!i(y))throw new m(`Public key not found: ${y}`,{shouldReport:!1});try{g=s(y,"utf-8")}catch(h){throw new m(`Failed to read public key file: ${y}`,{cause:h,shouldReport:!1})}}else{let y=t.keyDir?an(o,t.keyDir):p(),h=vm(f);if(!h)throw new m("Token header has no kid.",{hint:"Pass --key <path> to a public key PEM.",shouldReport:!1});g=Cm(h,y,{existsSync:i,readFileSync:s})}try{let y=await l({token:f,publicKeyPem:g,bundleStream:c(d)});Am(y,t.verbose??!1)}catch(y){let h=y instanceof Error?y.message:String(y);throw new m(`Bundle rejected: ${h}`,{shouldReport:!1})}}r(aa,"handleVerify");function ca(e,t={}){return e.command("verify [bundle]").description("Verify a signed app bundle locally (default: derived from app.json)").option("-s, --sig <path>","Path to the signature file (default: sibling .dev.sig / .cert.sig / .sig)").option("--key <path>","Path to a public key PEM file").option("--key-dir <path>","Directory of <kid>.pub.pem files \u2014 kid is read from the token header (default: $COGNITE_CLI_HOME/keys)").option("-v, --verbose","Print the full decoded payload after verification").addHelpText("after",`
+`;var nr=class nr extends Tt{constructor(t,n){super(t),this.telemetry=n}configure(){this.description("Manage Atlas agents \u2014 create, iterate, and publish agents to Cognite Data Fusion"),this.hook("postAction",(t,n)=>ni(this.telemetry,n)),this.create(),this.push(),this.open(),this.publish(),this.unpublish(),this.pull(),this.list(),this.status(),this.eval()}create(){let t=new sn;return this.addCommand(t),t}push(){return this.command("push").description("Push a draft agent to CDF for interactive testing").argument("[dir]","Agent project directory").action(async(t,n,o)=>{await Ce(t,o.optsWithGlobals())})}open(){let t=this.command("open").description("Open the agent in Fusion for interactive testing").argument("[dir]","Agent project directory");for(let n of Object.values(Xo))t.addOption(n);return t.action((n,o,i)=>ga(n,i.optsWithGlobals()))}publish(){let t=new gn;return this.addCommand(t),t}unpublish(){let t=new hn;return this.addCommand(t),t}pull(){let t=this.command("pull").description("Pull an existing agent from CDF into the local project").argument(`<${wt.externalId.name}>`,wt.externalId.description).argument(`[${wt.dir.name}]`,wt.dir.description);for(let n of Object.values(Qo))t.addOption(n);return t.action((n,o,i,s)=>fa(n,o,s.optsWithGlobals()))}list(){let t=this.command("list").description("List agents in the CDF project");for(let n of Object.values(ca))t.addOption(n);return t.action((n,o)=>la(o.optsWithGlobals()))}status(){let t=this.command("status").description("Show the current status of the agent in CDF").argument("[dir]","Agent project directory");for(let n of Object.values(ya))t.addOption(n);return t.action(async(n,o,i)=>Sa(n,i.optsWithGlobals()))}eval(){let t=this.command("eval").description("Run eval cases for an agent").argument("[dir]","Agent directory");for(let n of Object.values(Jo))t.addOption(n);return t.action((n,o,i)=>sa(n,i.optsWithGlobals(),{telemetry:this.telemetry}))}};r(nr,"AgentsCommand");var tr=nr;function va(e,t={}){let n=new tr("agents",t.telemetry);return e.addCommand(n),n}r(va,"registerAgentsCommand");import{existsSync as Ig,readFileSync as Dg}from"fs";import{join as $g,resolve as kn}from"path";import{verifyBundle as Og}from"@cognite/app-sdk/codesigning";import{decodeProtectedHeader as Fg}from"jose";import or from"enquirer";import{email as rg,pipe as ig,safeParse as sg,string as ag}from"valibot";var cg=ig(ag(),rg());function tt(e,t="email"){let n=e.trim();if(!n)throw new Error(`${t} is required`);if(!sg(cg,n).success)throw new Error(`${t} must look like an email (user@example.com); got "${e}"`);return n}r(tt,"parseEmail");import{execFileSync as Sn}from"child_process";import{execFileSync as lg}from"child_process";function yn(e={}){let{execFileSync:t=lg}=e;try{return t("git",["--version"],{stdio:"ignore"}),!0}catch{return!1}}r(yn,"isGitInstalled");function Ae(e={}){if(!yn(e))throw new m("Git is not installed or not found on PATH.",{hint:"Install Git (https://git-scm.com) and ensure it is on your PATH, then try again.",shouldReport:!1})}r(Ae,"throwIfGitMissing");function wn(e,t={}){let{execFileSync:n=Sn}=t;try{return n("git",["-C",e,"status"],{stdio:"ignore"}),!0}catch{return!1}}r(wn,"isInsideGitRepo");function Ca(e,t={}){let{execFileSync:n=Sn}=t;n("git",["-C",e,"init"],{stdio:"pipe"}),n("git",["-C",e,"add","."],{stdio:"pipe"}),n("git",["-C",e,"commit","-m","Initial commit","--no-gpg-sign","--no-verify"],{stdio:"pipe"})}r(Ca,"gitInitAndCommit");function Aa(e={}){let{execFileSync:t=Sn}=e;try{return String(t("git",["config","--get","user.name"],{encoding:"utf-8",stdio:["ignore","pipe","ignore"]})).trim()||void 0}catch{return}}r(Aa,"gitUserName");function Ea(e={}){let{execFileSync:t=Sn}=e;try{return String(t("git",["config","--get","user.email"],{encoding:"utf-8",stdio:["ignore","pipe","ignore"]})).trim()||void 0}catch{return}}r(Ea,"gitUserEmail");var vn=3,ba="Signing identity (kid) \u2014 e.g. jsmith-dev-001 (lowercase letters, digits, hyphens)",xa="Email address for the registry entry",ka=`Passphrase for the encrypted private key (min ${15} chars)`,Pa="Confirm passphrase",Ta=r(()=>`Passphrase must be at least ${15} characters`,"passphraseTooShortMsg"),Ra=r(e=>`Passphrases do not match (attempt ${e}/${vn}).
+`,"passphraseMismatchMsg"),Ia=`Passphrase confirmation failed after ${vn} attempts`,Da=r(e=>`A signing key with kid "${e}" already exists. Overwrite it?`,"confirmOverwriteMsg"),$a="How would you like to submit your key registration?",Oa="Open in browser",Fa="Copy link to clipboard";async function rr(e){return or.prompt(e)}r(rr,"defaultPrompt");function La(e){return t=>{try{return e(t),!0}catch(n){return n instanceof Error?n.message:"Invalid"}}}r(La,"parserAsValidator");var pg=/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;function Ge(e){let t=e.trim();if(!t)throw new Error("--kid must not be empty");if(t.length>64)throw new Error("--kid must be 64 characters or fewer");if(!pg.test(t))throw new Error("--kid must contain only lowercase letters, digits, and hyphens, and must not start or end with a hyphen (e.g. jsmith-dev-001)");return t}r(Ge,"parseKid");async function Ma(e={}){let{prompt:t=rr}=e,{kid:n}=await t({type:"input",name:"kid",message:ba,validate:La(Ge)});return Ge(n)}r(Ma,"promptKid");async function Ua(e={}){let{prompt:t=r(o=>or.prompt(o),"prompt")}=e,{action:n}=await t({type:"select",name:"action",message:$a,choices:[{name:"browser",message:Oa},{name:"clipboard",message:Fa}]});if(n!=="browser"&&n!=="clipboard")throw new Error(`Unexpected Zendesk action: ${n}`);return n}r(Ua,"promptZendeskAction");async function Na(e={}){let{prompt:t=rr,gitUserEmail:n=Ea}=e,{email:o}=await t({type:"input",name:"email",message:xa,initial:n(),validate:La(i=>tt(i,"email"))});return tt(o,"email")}r(Na,"promptEmail");async function _a(e={}){let{prompt:t=rr,stderr:n=process.stderr}=e;for(let o=1;o<=vn;o+=1){let{passphrase:i}=await t({type:"password",name:"passphrase",message:ka,validate:r(a=>a.length>=15?!0:Ta(),"validate")}),{confirm:s}=await t({type:"password",name:"confirm",message:Pa});if(i===s)return b.from(i);n.write(Ra(o))}throw new Error(Ia)}r(_a,"promptPassphrase");async function ja(e,t={}){let{prompt:n=r(i=>or.prompt(i),"prompt")}=t,{confirmed:o}=await n({type:"confirm",name:"confirmed",message:Da(e),initial:!1});return o}r(ja,"promptConfirmOverwrite");import{existsSync as vg,readdirSync as Cg,readFileSync as Ag}from"fs";import{join as sr}from"path";import{execFile as dg}from"child_process";import{promisify as ug}from"util";var Ha="cognite-flows",mg=ug(dg),Ba=r((e,t)=>mg(e,t),"defaultExecFile"),gg=-25300,fg=gg&255;function hg(e){if(!(e instanceof Error)||!("code"in e)||e.code!==fg)return!1;let t="stderr"in e?String(e.stderr):"";return/could not be found/i.test(t)||t===""}r(hg,"isKeychainNotFoundError");async function Ka(e,t,n={}){let o=t.expose();if(!X("macos",n))throw new Error("Keychain storage is only supported on macOS");let{execFile:i=Ba}=n;await i("security",["add-generic-password","-a",e,"-s",Ha,"-w",Buffer.from(o,"utf-8").toString("base64"),"-U"])}r(Ka,"storeKeyInKeychain");async function Cn(e,t={}){if(!X("macos",t))return null;let{execFile:n=Ba}=t;try{let{stdout:o}=await n("security",["find-generic-password","-a",e,"-s",Ha,"-w"]);return b.from(Buffer.from(o.trim(),"base64").toString("utf-8"))}catch(o){if(hg(o))return null;throw o}}r(Cn,"readKeyFromKeychain");var Ga="cognite-cli-signing",yg="The native @napi-rs/keyring binary failed to load for this platform. Reinstall the CLI, or regenerate the key with `--output <path>` to use passphrase-encrypted file storage instead.",Sg="Multiple Windows Credential Manager entries match this kid. Open Credential Manager (Control Panel \u2192 User Accounts \u2192 Credential Manager \u2192 Windows Credentials) and remove the duplicates.",Va="Windows Credential Manager failed unexpectedly. Regenerate the key with `--output <path>` to fall back to passphrase-encrypted file storage.";function wg(e){if(!(e instanceof Error))return Va;let t=e.message.toLowerCase();return t.includes("cannot find module")||t.includes("module_not_found")||t.includes("failed to load native binding")?yg:t.includes("ambiguous")?Sg:Va}r(wg,"hintFor");function Ya(e,t,n){return new m(`Failed to ${e} signing key for kid "${t}" in Windows Credential Manager`,{cause:n,hint:wg(n),shouldReport:!1})}r(Ya,"wrapKeyringError");async function za(e,t){let{Entry:n}=await import("@napi-rs/keyring"),o=new n(e,t);return{setPassword:r(i=>o.setPassword(i),"setPassword"),getPassword:r(()=>o.getPassword(),"getPassword"),deleteCredential:r(()=>o.deleteCredential(),"deleteCredential")}}r(za,"defaultCreateEntry");async function qa(e,t,n={}){let{createEntry:o=za}=n,i=Buffer.from(t.expose(),"utf-8").toString("base64");try{(await o(Ga,e)).setPassword(i)}catch(s){throw Ya("store",e,s)}}r(qa,"storeSigningKey");async function An(e,t={}){let{createEntry:n=za}=t;try{let i=(await n(Ga,e)).getPassword();return i===null?null:b.from(Buffer.from(i,"base64").toString("utf-8"))}catch(o){throw Ya("read",e,o)}}r(An,"readSigningKey");var Oe=".pub.pem",ar=".key.jwe",cr=".meta.json";function En(e){switch(e.kind){case"keychain":return"OS credential store";case"encrypted-file":return e.path;case"public-only":return"public-only (private key missing)"}}r(En,"formatLocalKeySource");function Eg(e){return{existsSync:e.existsSync??vg,readdirSync:e.readdirSync??Cg,readFileSync:e.readFileSync??((t,n)=>Ag(t,n)),isOS:e.isOS??(t=>X(t)),readKeyFromKeychain:e.readKeyFromKeychain??(t=>Cn(t)),readSigningKey:e.readSigningKey??(t=>An(t))}}r(Eg,"resolveDeps");function bg(e){try{let t=JSON.parse(e);if(typeof t=="object"&&t!==null&&!Array.isArray(t)&&"email"in t&&typeof t.email=="string")return t.email}catch{}}r(bg,"readEmailFromMeta");function xg(e,t){return t.existsSync(e)?t.readdirSync(e).filter(n=>n.endsWith(Oe)):[]}r(xg,"publicKeyEntries");function kg(e){return e.slice(0,-Oe.length)}r(kg,"kidFromPublicKeyFilename");async function Pg(e,t,n){if(n.isOS("macos")&&await n.readKeyFromKeychain(e).catch(()=>null)!==null)return{kind:"keychain"};if(n.isOS("windows")&&await n.readSigningKey(e).catch(()=>null)!==null)return{kind:"keychain"};let o=sr(t,`${e}${ar}`);return n.existsSync(o)?{kind:"encrypted-file",path:o}:{kind:"public-only"}}r(Pg,"resolveSource");async function bn(e=D().keysDir,t={}){let n=Eg(t),o=new Set,i=xg(e,n).flatMap(s=>{let a=kg(s);return!a||o.has(a)?[]:(o.add(a),[{kid:a,entry:s}])});return Promise.all(i.map(async({kid:s,entry:a})=>{let c=await Pg(s,e,n),l=sr(e,`${s}${cr}`),p;try{p=bg(n.readFileSync(l,"utf8"))}catch{}return{kid:s,source:c,publicKeyPath:sr(e,a),email:p}}))}r(bn,"discoverLocalKeys");import{createReadStream as Tg}from"fs";function xn(e){let t=Tg(e);return new ReadableStream({start(n){t.on("data",o=>{let i=typeof o=="string"?Buffer.from(o):o;n.enqueue(new Uint8Array(i))}),t.on("end",()=>n.close()),t.on("error",o=>n.error(o))},cancel(){t.destroy()}})}r(xn,"createWebStreamFromFile");import Rg from"path";var Ja=".cognite-bundles";function Wa(e,t){return`${e}-${t}.zip`}r(Wa,"bundleFileName");function ne(e,t,n){return Rg.join(e,Ja,Wa(t,n))}r(ne,"bundlePath");var Za=[".dev.sig",".cert.sig",".sig"];function Lg(e){return{existsSync:e.existsSync??Ig,readFileSync:e.readFileSync??((t,n)=>Dg(t,n)),createBundleStream:e.createBundleStream??xn,verifyBundle:e.verifyBundle??Og,loadAppConfig:e.loadAppConfig??k,defaultKeyDir:e.defaultKeyDir??(()=>D().keysDir)}}r(Lg,"resolveDeps");function Mg(e,t){return Za.map(n=>`${e}${n}`).find(n=>t(n))}r(Mg,"findSiblingSignature");function Ug(e){let t=e.split(".");return t.length===3&&t.every(n=>n.length>0)}r(Ug,"isCompactJws");function Ng(e){try{let t=Fg(e);return typeof t.kid=="string"?t.kid:void 0}catch{return}}r(Ng,"readKidFromToken");function _g(e,t,n){let{existsSync:o,readFileSync:i}=n;try{Ge(e)}catch(a){throw new m(a instanceof Error?a.message:String(a),{shouldReport:!1})}if(!o(t))throw new m(`Key directory not found: ${t}`,{shouldReport:!1});let s=$g(t,`${e}${Oe}`);if(!o(s))throw new m(`No public key found for kid "${e}" in ${t}`,{shouldReport:!1});try{return i(s,"utf-8")}catch(a){throw new m(`Failed to read public key file: ${s}`,{cause:a,shouldReport:!1})}}r(_g,"resolvePublicKeyForKid");function jg(e,t){let{payload:n,kid:o}=e;if(console.log(`Verified ${n.appId}@${n.version}`),console.log(`  kid:    ${o}`),console.log(`  hash:   ${n.bundleSha256}`),n.scopes&&n.scopes.length>0){let i=n.scopes.map(s=>`${s.org}/${s.project}`).join(", ");console.log(`  scopes: ${i}`)}t&&console.log(JSON.stringify(n,null,2))}r(jg,"printResult");async function Xa(e,t,n={},o=process.cwd()){let{existsSync:i,readFileSync:s,loadAppConfig:a,createBundleStream:c,verifyBundle:l,defaultKeyDir:p}=Lg(n),d;if(e)d=kn(o,e);else{let g;try{g=a(o)}catch(y){let S=y instanceof Error?y.message:String(y);throw new m(S,{cause:y,hint:"Run this command from a Cognite app directory (one with app.json), or pass [bundle] explicitly.",shouldReport:!1})}d=ne(o,g.externalId,g.versionTag)}if(!i(d)){let g=e?void 0:"Default derived from app.json \u2014 pass [bundle] explicitly to override.";throw new m(`Bundle not found: ${d}`,{hint:g,shouldReport:!1})}let u=t.sig?kn(o,t.sig):Mg(d,i);if(!u)throw new m("No signature file found.",{hint:`Pass --sig <path> or place one of ${Za.map(g=>`${d}${g}`).join(", ")} next to the bundle.`,shouldReport:!1});if(!i(u))throw new m(`Signature file not found: ${u}`,{shouldReport:!1});let f;try{f=s(u,"utf-8").trim()}catch(g){throw new m(`Failed to read signature file: ${u}`,{cause:g,shouldReport:!1})}if(!Ug(f))throw new m(`Malformed JWS in ${u}`,{hint:"Expected a compact JWS (header.payload.signature \u2014 three base64url segments).",shouldReport:!1});let h;if(t.key){let g=kn(o,t.key);if(!i(g))throw new m(`Public key not found: ${g}`,{shouldReport:!1});try{h=s(g,"utf-8")}catch(y){throw new m(`Failed to read public key file: ${g}`,{cause:y,shouldReport:!1})}}else{let g=t.keyDir?kn(o,t.keyDir):p(),y=Ng(f);if(!y)throw new m("Token header has no kid.",{hint:"Pass --key <path> to a public key PEM.",shouldReport:!1});h=_g(y,g,{existsSync:i,readFileSync:s})}try{let g=await l({token:f,publicKeyPem:h,bundleStream:c(d)});jg(g,t.verbose??!1)}catch(g){let y=g instanceof Error?g.message:String(g);throw new m(`Bundle rejected: ${y}`,{shouldReport:!1})}}r(Xa,"handleVerify");function Qa(e,t={}){return e.command("verify [bundle]").description("Verify a signed app bundle locally (default: derived from app.json)").option("-s, --sig <path>","Path to the signature file (default: sibling .dev.sig / .cert.sig / .sig)").option("--key <path>","Path to a public key PEM file").option("--key-dir <path>","Directory of <kid>.pub.pem files \u2014 kid is read from the token header (default: $COGNITE_CLI_HOME/keys)").option("-v, --verbose","Print the full decoded payload after verification").addHelpText("after",`
 Bundles are stored in .cognite-bundles/<externalId>-<versionTag>.zip by default.
 
 Examples:
   cognite apps verify                                                        Verify default bundle (path from app.json)
   cognite apps verify .cognite-bundles/my-app-1.0.0.zip                     Verify a specific bundle
   cognite apps verify .cognite-bundles/my-app-1.0.0.zip --sig my-app-1.0.0.zip.dev.sig  Verify with explicit signature
-  cognite apps verify .cognite-bundles/my-app-1.0.0.zip --key /path/to/pub.pem          Verify with explicit public key`).action((n,o)=>aa(n,o,t))}r(ca,"registerVerifyCommand");import{existsSync as bm}from"fs";import{resolve as Em}from"path";import{config as xm}from"dotenv";function B(e,t={existsSync:bm,config:xm}){let n=Em(e,".env");t.existsSync(n)&&(console.log(`Loading environment variables from ${n}`),t.config({path:n}))}r(B,"loadEnvFile");function K(e){e.infra!=="appsApi"&&(console.error(`
+  cognite apps verify .cognite-bundles/my-app-1.0.0.zip --key /path/to/pub.pem          Verify with explicit public key`).action((n,o)=>Xa(n,o,t))}r(Qa,"registerVerifyCommand");import{existsSync as Hg}from"fs";import{resolve as Bg}from"path";import{config as Kg}from"dotenv";function j(e,t={existsSync:Hg,config:Kg}){let n=Bg(e,".env");t.existsSync(n)&&(console.log(`Loading environment variables from ${n}`),t.config({path:n}))}r(j,"loadEnvFile");function H(e){e.infra!=="appsApi"&&(console.error(`
 \u26A0\uFE0F  Legacy infrastructure is no longer supported.
 
 Your app.json is missing \`"infra": "appsApi"\`, which means it was created for
 the old CDF Application Registry. This deploy path has been removed.
 
 To migrate: add \`"infra": "appsApi"\` to your app.json, wire up the correct authentication and re-deploy.
-`),process.exit(1))}r(K,"assertAppHostingInfra");async function km(e,t,n){let o=await _(e,{interactive:t.interactive,appId:n,orgHint:t.org,confirmActionTarget:t.confirmActionTarget,action:"activate"});return new U(o)}r(km,"defaultBuildApiClient");async function Pm(e,t={}){let{loadEnvFile:n=B,loadAppConfig:o=E,getApiClient:i=km,isSessionAuthEnabled:s=O}=t,a=process.cwd();n(a);let c=o(a);K(c);let l=e.interactive?await M(c,e):L(c.deployments,e.deployment);if(!e.interactive&&!s()){let y=j(l);if(y.length>0)throw new Error(`Deployment ${l.org}/${l.project} is missing ${y.join(" and ")} in app.json. Use \`npx @cognite/cli@latest apps activate --interactive\` for browser-based authentication instead.`)}let p=await i(l,e,c.externalId),{externalId:d,versionTag:u}=c,f;try{f=await p.getVersion(d,u)}catch(y){throw y instanceof ee?new Error(`Version ${u} of ${d} has not been deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):y}if(f.alias==="ACTIVE"){console.log(`  ${d} @ ${u} is already ACTIVE \u2014 nothing to do.`);return}if(f.lifecycleState==="DEPRECATED"||f.lifecycleState==="ARCHIVED")throw new Error(`Cannot activate ${d} @ ${u}: version is ${f.lifecycleState} (terminal).`);f.lifecycleState==="DRAFT"&&(await p.publishVersion(d,u),console.log(`\u2713 Published    ${d} @ ${u} is now PUBLISHED`));let{supersededVersion:g}=await p.activateVersion(d,u);console.log(`\u2713 Activated    ${d} @ ${u} is now ACTIVE`),g&&console.log(`  Superseded  ${g} \u2192 PUBLISHED`)}r(Pm,"handleActivate");function la(e,t={isSessionAuthEnabled:O}){let{isSessionAuthEnabled:n}=t,o=e.command("activate").description("Activate the current app version (publish if needed, then set ACTIVE alias)").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)");return n()&&o.option("--confirm-action-target <target>","Acknowledge the org/project this command will act on, skipping the interactive prompt (value must match the resolved target)"),o.addHelpText("after",`
+`),process.exit(1))}r(H,"assertAppHostingInfra");import{Option as ec}from"commander";var Vg={"client-credentials":!0,session:!0,browser:!0};function lr(){return new ec("--auth-method <method>","Authentication method to use when several are valid, skipping the selection prompt").choices(Object.keys(Vg))}r(lr,"authMethodOption");function Gg(){return new ec("--confirm-action-target <target>","Acknowledge the org/project this command will act on, skipping the interactive prompt (value must match the resolved target)")}r(Gg,"confirmActionTargetOption");function W(){return[Gg(),lr()]}r(W,"sessionAuthOptions");async function Yg(e,t,n){let o=await _(e,{interactive:t.interactive,appId:n,orgHint:t.org,authMethod:t.authMethod,confirmActionTarget:t.confirmActionTarget,action:"activate"});return new U(o)}r(Yg,"defaultBuildApiClient");async function zg(e,t={}){let{loadEnvFile:n=j,loadAppConfig:o=k,getApiClient:i=Yg}=t,s=process.cwd();n(s);let a=o(s);H(a);let c=e.interactive?await L(a,e):$(a.deployments,e.deployment),l=await i(c,e,a.externalId),{externalId:p,versionTag:d}=a,u;try{u=await l.getVersion(p,d)}catch(h){throw h instanceof te?new Error(`Version ${d} of ${p} has not been deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):h}if(u.alias==="ACTIVE"){console.log(`  ${p} @ ${d} is already ACTIVE \u2014 nothing to do.`);return}if(u.lifecycleState==="DEPRECATED"||u.lifecycleState==="ARCHIVED")throw new Error(`Cannot activate ${p} @ ${d}: version is ${u.lifecycleState} (terminal).`);u.lifecycleState==="DRAFT"&&(await l.publishVersion(p,d),console.log(`\u2713 Published    ${p} @ ${d} is now PUBLISHED`));let{supersededVersion:f}=await l.activateVersion(p,d);console.log(`\u2713 Activated    ${p} @ ${d} is now ACTIVE`),f&&console.log(`  Superseded  ${f} \u2192 PUBLISHED`)}r(zg,"handleActivate");function tc(e){let t=e.command("activate").description("Activate the current app version (publish if needed, then set ACTIVE alias)").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)");return W().forEach(n=>t.addOption(n)),t.addHelpText("after",`
 Examples:
   npx @cognite/cli apps activate .                   Activate using env-var auth
-  npx @cognite/cli apps activate . --interactive     Activate using browser auth (no secrets needed)`).action((i,s)=>Pm(s))}r(la,"registerActivateCommand");import{basename as xa,dirname as cg,normalize as lg,resolve as un}from"path";import{fileURLToPath as pg,pathToFileURL as dg}from"url";import{Logger as ug,runner as mg}from"hygen";import{safeParse as Im}from"valibot";function ut(e,t){return n=>{let o=Im(t,n);return o.success?!0:`${e} ${o.issues[0].message}`}}r(ut,"toPromptValidator");var pa={name:ut("App name",Pn),displayName:ut("Display name",kn),baseUrl:ut("Base URL",In),org:ut("Org",Dn),project:ut("Project",Tn)};function Dm(e,t){return e?async n=>{let o=t(n);return o===!0?e(n):o}:t}r(Dm,"composeValidators");function cn(e){return e.map(t=>{if(!(t.name in pa))return t;let n=pa[t.name];return{...t,validate:Dm(t.validate,n)}})}r(cn,"applySchemaValidators");import{basename as da}from"path";import ua from"enquirer";function Fo(e){return e.replace(/[A-Z]/g,(t,n)=>n===0?t.toLowerCase():`-${t.toLowerCase()}`)}r(Fo,"kebabCase");var Tm={type:"confirm",name:"useSpecKit",message:["Enable spec-driven development?","  Adds the github/spec-kit slash commands (/speckit.specify, .clarify, .plan, .tasks, .implement)","  to your app for use in Claude Code, Cursor, or GitHub Copilot. They walk you through writing SPEC.md and","  generating a plan, tasks, and implementation."].join(`
-`),initial:!1};async function Rm(e,t,n){return e!==void 0?e:t?!!(await n([Tm])).useSpecKit:!1}r(Rm,"resolveSpecKit");function $m(e){return typeof e=="function"}r($m,"isFunctionInitial");function ma(e){return(e??"").trim().replace(/\/+$/,"")||"api"}r(ma,"normalizeCluster");function ga({isCurrentDir:e,dirName:t,onAppName:n,onUseSpecKit:o,presets:i={},specKit:s,prompt:a=ua.prompt.bind(ua)}){return()=>({prompt:r(async c=>{if(!Array.isArray(c))return a([c]);let l=Object.fromEntries(Object.entries(i).filter(k=>k[1]!==void 0)),p=Object.keys(l).length>0,d=e?da(process.cwd()):t?da(t):null,u=p&&d!==null,f=!u&&d?c.map(k=>k.name==="name"?{...k,initial:d}:k):c,g=cn(f),y=u&&d?{...l,name:d}:l,h=new Set(Object.keys(y)),S=g.filter(k=>!h.has(k.name)),w=S.findIndex(k=>k.name==="baseUrl"),C;if(u){let k=ma(y.cluster),W=r(x=>$m(x.initial)?x.initial():x.initial,"resolveInitial"),ge=r(x=>{if(x.name==="baseUrl")return`https://${k}.cognitedata.com`;let ie=W(x);if(ie===void 0)throw new Error(`Non-interactive mode: --${Fo(x.name)} has no default. Pass it as a flag.`);return ie},"deriveValue");C=Object.fromEntries(S.map(x=>[x.name,ge(x)]))}else if(w!==-1){let k=S.filter(se=>se.name!=="baseUrl"),W=k.length>0?await a(k):{},ge=typeof W.cluster=="string"?W.cluster:"",ie=`https://${ma(ge||y.cluster)}.cognitedata.com`,be=S[w],He=await a([{...be,initial:ie}]);C={...W,...He}}else C=S.length>0?await a(S):{};let v={...y,...C},R=typeof v.name=="string"?v.name:"";R&&n(R);let b=await Rm(s,!u&&S.length>0,a);return o?.(b),{...v,name:R,useCurrentDir:e,directoryName:e?void 0:t??void 0,useSpecKit:b}},"prompt")})}r(ga,"createAppPrompter");async function fa(e,t,n){let o=[];Object.values(t).some(s=>s!==void 0)&&n!==null&&o.push({key:"name",value:n,label:"directory"});for(let[s,a]of Object.entries(t))a!==void 0&&o.push({key:s,value:a,label:`--${Fo(s)}`});for(let{key:s,value:a,label:c}of o){let l=e.find(d=>d.name===s)?.validate;if(!l)continue;let p=await l(a);if(p!==!0)throw new Error(`Invalid ${c}: ${p}`)}}r(fa,"validatePresets");import{cpSync as ha,existsSync as Sa,mkdirSync as pn,readdirSync as _m,readFileSync as jm,writeFileSync as Lo}from"fs";import{basename as Nm,dirname as Mo,posix as Hm,resolve as H}from"path";import{fileURLToPath as wa}from"url";import{copyFileSync as Om,symlinkSync as Fm}from"fs";import{dirname as Lm,join as Mm}from"path";function Um(e){if(e&&typeof e=="object"&&"code"in e&&typeof e.code=="string")return e.code}r(Um,"errno");function ya(e){return e instanceof Error?e.message:String(e)}r(ya,"messageOf");function ln({target:e,linkPath:t,label:n,symlink:o=Fm,copyFile:i=Om}){try{return o(e,t),!0}catch(s){let a=Um(s);if(a==="EEXIST")return!0;let c=ya(s);if(a==="EPERM"||a==="EACCES")try{let l=Mm(Lm(t),e);return i(l,t),console.log(`\u2139\uFE0F  Wrote ${n} as a copy of ${e} (symlinks need Developer Mode or an elevated shell on Windows).`),!0}catch(l){return console.warn(`\u26A0\uFE0F  Could not create ${n} symlink: ${c} (copy fallback also failed: ${ya(l)})`),!1}return console.warn(`\u26A0\uFE0F  Could not create ${n} symlink:`,c),!1}}r(ln,"linkOrCopyOrWarn");var Bm=H(Mo(wa(import.meta.url)),"..","..","_vendor","spec-kit"),Km=H(Mo(wa(import.meta.url)),"..","..","_cognite-spec-extensions"),Vm=["claude-code","cursor","github-copilot"],Gm={branch_numbering:"sequential"};function va({appDir:e,vendorDir:t=Bm,cogniteExtensionsDir:n=Km,agents:o=Vm}){let i=H(e,".specify"),s=H(i,"memory"),a=new Set(o),c=`prepare spec-kit install for appDir=${e}`,p=[{srcRoot:t,from:"templates",to:".specify/templates"},{srcRoot:t,from:"scripts/bash",to:".specify/scripts/bash"},{srcRoot:t,from:"commands",to:".claude/commands",agent:"claude-code"},{srcRoot:t,from:"commands",to:".cursor/commands",agent:"cursor"},{srcRoot:n,from:"commands",to:".claude/commands",agent:"claude-code"},{srcRoot:n,from:"commands",to:".cursor/commands",agent:"cursor"},{srcRoot:n,from:"templates",to:".specify/templates"}].filter(({agent:d})=>!d||a.has(d));try{for(let{srcRoot:u,from:f,to:g}of p){let y=H(e,g);c=`copy ${Nm(u)}/${f} to ${g}`,pn(Mo(y),{recursive:!0}),ha(H(u,f),y,{recursive:!0})}if(a.has("github-copilot")){let u=H(e,".github","agents"),f=H(e,".github","prompts");c="create .github/agents and .github/prompts dirs",pn(u,{recursive:!0}),pn(f,{recursive:!0});for(let g of[H(t,"commands"),H(n,"commands")])if(Sa(g))for(let y of _m(g)){if(!y.endsWith(".md"))continue;let h=y.slice(0,-3);c=`copy ${y} to .github/agents/${h}.agent.md`,Lo(H(u,`${h}.agent.md`),jm(H(g,y))),c=`write .github/prompts/${h}.prompt.md`,Lo(H(f,`${h}.prompt.md`),`---
-agent: ${h}
+  npx @cognite/cli apps activate . --interactive     Activate using browser auth (no secrets needed)`).action((n,o)=>zg(o))}r(tc,"registerActivateCommand");import{basename as yc,dirname as Rf,normalize as If,resolve as Dn}from"path";import{fileURLToPath as Df,pathToFileURL as $f}from"url";import{Logger as Of,runner as Ff}from"hygen";import{safeParse as qg}from"valibot";function vt(e,t){return n=>{let o=qg(t,n);return o.success?!0:`${e} ${o.issues[0].message}`}}r(vt,"toPromptValidator");var nc={name:vt("App name",Jn),displayName:vt("Display name",qn),baseUrl:vt("Base URL",Wn),org:vt("Org",Zn),project:vt("Project",Xn)};function Jg(e,t){return e?async n=>{let o=t(n);return o===!0?e(n):o}:t}r(Jg,"composeValidators");function Pn(e){return e.map(t=>{if(!(t.name in nc))return t;let n=nc[t.name];return{...t,validate:Jg(t.validate,n)}})}r(Pn,"applySchemaValidators");import{basename as oc}from"path";import rc from"enquirer";function pr(e){return e.replace(/[A-Z]/g,(t,n)=>n===0?t.toLowerCase():`-${t.toLowerCase()}`)}r(pr,"kebabCase");var Wg={type:"confirm",name:"useSpecKit",message:["Enable spec-driven development?","  Adds the github/spec-kit slash commands (/speckit.specify, .clarify, .plan, .tasks, .implement)","  to your app for use in Claude Code, Cursor, or GitHub Copilot. They walk you through writing SPEC.md and","  generating a plan, tasks, and implementation."].join(`
+`),initial:!1};async function Zg(e,t,n){return e!==void 0?e:t?!!(await n([Wg])).useSpecKit:!1}r(Zg,"resolveSpecKit");function Xg(e){return typeof e=="function"}r(Xg,"isFunctionInitial");function ic(e){return(e??"").trim().replace(/\/+$/,"")||"api"}r(ic,"normalizeCluster");function sc({isCurrentDir:e,dirName:t,onAppName:n,onUseSpecKit:o,presets:i={},specKit:s,prompt:a=rc.prompt.bind(rc)}){return()=>({prompt:r(async c=>{if(!Array.isArray(c))return a([c]);let l=Object.fromEntries(Object.entries(i).filter(R=>R[1]!==void 0)),p=Object.keys(l).length>0,d=e?oc(process.cwd()):t?oc(t):null,u=p&&d!==null,f=!u&&d?c.map(R=>R.name==="name"?{...R,initial:d}:R):c,h=Pn(f),g=u&&d?{...l,name:d}:l,y=new Set(Object.keys(g)),S=h.filter(R=>!y.has(R.name)),w=S.findIndex(R=>R.name==="baseUrl"),v;if(u){let R=ic(g.cluster),Y=r(I=>Xg(I.initial)?I.initial():I.initial,"resolveInitial"),ce=r(I=>{if(I.name==="baseUrl")return`https://${R}.cognitedata.com`;let oe=Y(I);if(oe===void 0)throw new Error(`Non-interactive mode: --${pr(I.name)} has no default. Pass it as a flag.`);return oe},"deriveValue");v=Object.fromEntries(S.map(I=>[I.name,ce(I)]))}else if(w!==-1){let R=S.filter(K=>K.name!=="baseUrl"),Y=R.length>0?await a(R):{},ce=typeof Y.cluster=="string"?Y.cluster:"",oe=`https://${ic(ce||g.cluster)}.cognitedata.com`,F=S[w],re=await a([{...F,initial:oe}]);v={...Y,...re}}else v=S.length>0?await a(S):{};let C={...g,...v},x=typeof C.name=="string"?C.name:"";x&&n(x);let B=await Zg(s,!u&&S.length>0,a);return o?.(B),{...C,name:x,useCurrentDir:e,directoryName:e?void 0:t??void 0,useSpecKit:B}},"prompt")})}r(sc,"createAppPrompter");async function ac(e,t,n){let o=[];Object.values(t).some(s=>s!==void 0)&&n!==null&&o.push({key:"name",value:n,label:"directory"});for(let[s,a]of Object.entries(t))a!==void 0&&o.push({key:s,value:a,label:`--${pr(s)}`});for(let{key:s,value:a,label:c}of o){let l=e.find(d=>d.name===s)?.validate;if(!l)continue;let p=await l(a);if(p!==!0)throw new Error(`Invalid ${c}: ${p}`)}}r(ac,"validatePresets");import{cpSync as lc,existsSync as pc,mkdirSync as Rn,readdirSync as rf,readFileSync as sf,writeFileSync as dr}from"fs";import{basename as af,dirname as ur,posix as cf,resolve as N}from"path";import{fileURLToPath as dc}from"url";import{copyFileSync as Qg,symlinkSync as ef}from"fs";import{dirname as tf,join as nf}from"path";function of(e){if(e&&typeof e=="object"&&"code"in e&&typeof e.code=="string")return e.code}r(of,"errno");function cc(e){return e instanceof Error?e.message:String(e)}r(cc,"messageOf");function Tn({target:e,linkPath:t,label:n,symlink:o=ef,copyFile:i=Qg}){try{return o(e,t),!0}catch(s){let a=of(s);if(a==="EEXIST")return!0;let c=cc(s);if(a==="EPERM"||a==="EACCES")try{let l=nf(tf(t),e);return i(l,t),console.log(`\u2139\uFE0F  Wrote ${n} as a copy of ${e} (symlinks need Developer Mode or an elevated shell on Windows).`),!0}catch(l){return console.warn(`\u26A0\uFE0F  Could not create ${n} symlink: ${c} (copy fallback also failed: ${cc(l)})`),!1}return console.warn(`\u26A0\uFE0F  Could not create ${n} symlink:`,c),!1}}r(Tn,"linkOrCopyOrWarn");var lf=N(ur(dc(import.meta.url)),"..","..","_vendor","spec-kit"),pf=N(ur(dc(import.meta.url)),"..","..","_cognite-spec-extensions"),df=["claude-code","cursor","github-copilot"],uf={branch_numbering:"sequential"};function uc({appDir:e,vendorDir:t=lf,cogniteExtensionsDir:n=pf,agents:o=df}){let i=N(e,".specify"),s=N(i,"memory"),a=new Set(o),c=`prepare spec-kit install for appDir=${e}`,p=[{srcRoot:t,from:"templates",to:".specify/templates"},{srcRoot:t,from:"scripts/bash",to:".specify/scripts/bash"},{srcRoot:t,from:"commands",to:".claude/commands",agent:"claude-code"},{srcRoot:t,from:"commands",to:".cursor/commands",agent:"cursor"},{srcRoot:n,from:"commands",to:".claude/commands",agent:"claude-code"},{srcRoot:n,from:"commands",to:".cursor/commands",agent:"cursor"},{srcRoot:n,from:"templates",to:".specify/templates"}].filter(({agent:d})=>!d||a.has(d));try{for(let{srcRoot:u,from:f,to:h}of p){let g=N(e,h);c=`copy ${af(u)}/${f} to ${h}`,Rn(ur(g),{recursive:!0}),lc(N(u,f),g,{recursive:!0})}if(a.has("github-copilot")){let u=N(e,".github","agents"),f=N(e,".github","prompts");c="create .github/agents and .github/prompts dirs",Rn(u,{recursive:!0}),Rn(f,{recursive:!0});for(let h of[N(t,"commands"),N(n,"commands")])if(pc(h))for(let g of rf(h)){if(!g.endsWith(".md"))continue;let y=g.slice(0,-3);c=`copy ${g} to .github/agents/${y}.agent.md`,dr(N(u,`${y}.agent.md`),sf(N(h,g))),c=`write .github/prompts/${y}.prompt.md`,dr(N(f,`${y}.prompt.md`),`---
+agent: ${y}
 ---
-`)}}let d=H(i,"extensions.yml");Sa(d)||(c="write .specify/extensions.yml",ha(H(n,"extensions.yml"),d)),c=`write init-options.json under specifyDir=${i}`,Lo(H(i,"init-options.json"),`${JSON.stringify(Gm,null,2)}
-`),c=`link .specify/memory/constitution.md in specifyDir=${i}`,pn(s,{recursive:!0}),ln({target:Hm.join("..","..","AGENTS.md"),linkPath:H(s,"constitution.md"),label:".specify/memory/constitution.md"})}catch(d){let u=d instanceof Error?d.message:String(d);throw new Error(`installSpecKit failed while ${c} (appDir=${e}, vendorDir=${t}): ${u}`,{cause:d})}}r(va,"installSpecKit");import{execFileSync as dn}from"child_process";import{mkdtempSync as Ym,readdirSync as qm,rmSync as Jm}from"fs";import{createRequire as zm}from"module";import{tmpdir as Wm}from"os";import{join as Xm,resolve as Ca}from"path";import{InvalidArgumentError as Zm}from"commander";import Qm from"enquirer";var Aa="cognitedata/builder-skills",Uo=["claude-code","cursor","github-copilot","opencode","codex"],eg=zm(import.meta.url).resolve("skills/bin/cli.mjs");function _o(e,t={}){try{dn(process.execPath,[eg,...e],{stdio:"inherit",cwd:process.cwd(),...t,env:{...process.env,...t.env,DISABLE_TELEMETRY:"1"}})}catch(n){throw me(),new m(`Skills CLI failed (${e.join(" ")})`,{cause:n,hint:"Check your internet connection and try again."})}}r(_o,"execSkillsCli");function tg(){return Uo.map(e=>["add",Aa,"-a",e,"--skill","*","-y"])}r(tg,"pullAllArgsPerAgent");var ng=1e4;async function ba(e,t={}){let n=t.exec??_o;me();let o=t.timeout??ng,i=t.readdir??(c=>qm(c));for(let c of tg())try{n(c,{cwd:e,timeout:o,stdio:["pipe","pipe","inherit"]})}catch(l){let p=l instanceof Error?l.message:String(l);console.warn("\u26A0\uFE0F  Could not pull skills for args ["+c.join(" ")+"]:",p)}let s=new Set;for(let c of[Ca(e,".claude","skills"),Ca(e,".agents","skills")])try{i(c).forEach(l=>s.add(l))}catch{}let a=s.size;a>0?console.log(`Installed ${a} skills successfully.`):console.log("No skills were installed.")}r(ba,"pullAllSkillsInto");function og(e){if(!/^[\w.-]+\/[\w.-]+$/.test(e))throw new Zm("Expected owner/repo format (e.g., cognitedata/builder-skills)");return e}r(og,"validateSource");function rg(e){let t=Ym(Xm(Wm(),"skills-"));try{try{dn("git",["clone","--depth","1","--filter=blob:none","--no-checkout","-q",`https://github.com/${e}.git`,t],{stdio:"ignore"})}catch(o){throw me(),new m(`Failed to clone skills repository "${e}".`,{hint:"Check your internet connection and try again.",shouldReport:!1,cause:o})}let n;try{n=dn("git",["ls-tree","-d","--name-only","HEAD:skills"],{cwd:t})}catch{n=dn("git",["ls-tree","-d","--name-only","HEAD"],{cwd:t})}return n.toString().trim().split(/\r?\n/).filter(o=>!!o&&!o.startsWith("."))}finally{Jm(t,{recursive:!0,force:!0})}}r(rg,"listRemoteSkills");async function ig(e,t={}){let n=r(c=>Qm.prompt(c),"defaultPrompt"),{listSkills:o=rg,prompt:i=n}=t,s=o(e),{selected:a}=await i({type:"multiselect",name:"selected",message:"Select skills to install  (space to toggle, a to toggle all, enter to confirm)",choices:s});return a}r(ig,"pickSkillsInteractive");function sg(e,t,n){let o=["add",e.source,"-a",t];return e.skill?o.push("--skill",e.skill):n&&n.length>0?o.push("--skill",...n,"-y"):o.push("--skill","*","-y"),e.global&&o.push("--global"),o}r(sg,"buildPullArgs");async function ag(e){me(),console.log(`Pulling skills from ${e.source}...`);let t;if(e.interactive&&!e.skill){try{t=await ig(e.source)}catch(o){if(o instanceof m)throw o;let i=o instanceof Error?o.message:String(o);console.error(`Failed to resolve skills interactively: ${i}`),process.exitCode=1;return}if(t.length===0){console.log("No skills selected.");return}}let n=!1;for(let o of Uo)try{_o(sg(e,o,t))}catch(i){let s=i instanceof Error?i.message:String(i);console.warn(`\u26A0\uFE0F  Could not pull skills for ${o}: ${s}`),n=!0}n?(console.log(`
+`)}}let d=N(i,"extensions.yml");pc(d)||(c="write .specify/extensions.yml",lc(N(n,"extensions.yml"),d)),c=`write init-options.json under specifyDir=${i}`,dr(N(i,"init-options.json"),`${JSON.stringify(uf,null,2)}
+`),c=`link .specify/memory/constitution.md in specifyDir=${i}`,Rn(s,{recursive:!0}),Tn({target:cf.join("..","..","AGENTS.md"),linkPath:N(s,"constitution.md"),label:".specify/memory/constitution.md"})}catch(d){let u=d instanceof Error?d.message:String(d);throw new Error(`installSpecKit failed while ${c} (appDir=${e}, vendorDir=${t}): ${u}`,{cause:d})}}r(uc,"installSpecKit");import{execFileSync as In}from"child_process";import{mkdtempSync as mf,readdirSync as gf,rmSync as ff}from"fs";import{createRequire as hf}from"module";import{tmpdir as yf}from"os";import{join as Sf,resolve as mc}from"path";import{InvalidArgumentError as wf}from"commander";import vf from"enquirer";var gc="cognitedata/builder-skills",mr=["claude-code","cursor","github-copilot","opencode","codex"],Cf=hf(import.meta.url).resolve("skills/bin/cli.mjs");function gr(e,t={}){try{In(process.execPath,[Cf,...e],{stdio:"inherit",cwd:process.cwd(),...t,env:{...process.env,...t.env,DISABLE_TELEMETRY:"1"}})}catch(n){throw Ae(),new m(`Skills CLI failed (${e.join(" ")})`,{cause:n,hint:"Check your internet connection and try again."})}}r(gr,"execSkillsCli");function Af(){return mr.map(e=>["add",gc,"-a",e,"--skill","*","-y"])}r(Af,"pullAllArgsPerAgent");var Ef=1e4;async function fc(e,t={}){let n=t.exec??gr;Ae();let o=t.timeout??Ef,i=t.readdir??(c=>gf(c));for(let c of Af())try{n(c,{cwd:e,timeout:o,stdio:["pipe","pipe","inherit"]})}catch(l){let p=l instanceof Error?l.message:String(l);console.warn("\u26A0\uFE0F  Could not pull skills for args ["+c.join(" ")+"]:",p)}let s=new Set;for(let c of[mc(e,".claude","skills"),mc(e,".agents","skills")])try{i(c).forEach(l=>s.add(l))}catch{}let a=s.size;a>0?console.log(`Installed ${a} skills successfully.`):console.log("No skills were installed.")}r(fc,"pullAllSkillsInto");function bf(e){if(!/^[\w.-]+\/[\w.-]+$/.test(e))throw new wf("Expected owner/repo format (e.g., cognitedata/builder-skills)");return e}r(bf,"validateSource");function xf(e){let t=mf(Sf(yf(),"skills-"));try{try{In("git",["clone","--depth","1","--filter=blob:none","--no-checkout","-q",`https://github.com/${e}.git`,t],{stdio:"ignore"})}catch(o){throw Ae(),new m(`Failed to clone skills repository "${e}".`,{hint:"Check your internet connection and try again.",shouldReport:!1,cause:o})}let n;try{n=In("git",["ls-tree","-d","--name-only","HEAD:skills"],{cwd:t})}catch{n=In("git",["ls-tree","-d","--name-only","HEAD"],{cwd:t})}return n.toString().trim().split(/\r?\n/).filter(o=>!!o&&!o.startsWith("."))}finally{ff(t,{recursive:!0,force:!0})}}r(xf,"listRemoteSkills");async function kf(e,t={}){let n=r(c=>vf.prompt(c),"defaultPrompt"),{listSkills:o=xf,prompt:i=n}=t,s=o(e),{selected:a}=await i({type:"multiselect",name:"selected",message:"Select skills to install  (space to toggle, a to toggle all, enter to confirm)",choices:s});return a}r(kf,"pickSkillsInteractive");function Pf(e,t,n){let o=["add",e.source,"-a",t];return e.skill?o.push("--skill",e.skill):n&&n.length>0?o.push("--skill",...n,"-y"):o.push("--skill","*","-y"),e.global&&o.push("--global"),o}r(Pf,"buildPullArgs");async function Tf(e){Ae(),console.log(`Pulling skills from ${e.source}...`);let t;if(e.interactive&&!e.skill){try{t=await kf(e.source)}catch(o){if(o instanceof m)throw o;let i=o instanceof Error?o.message:String(o);console.error(`Failed to resolve skills interactively: ${i}`),process.exitCode=1;return}if(t.length===0){console.log("No skills selected.");return}}let n=!1;for(let o of mr)try{gr(Pf(e,o,t))}catch(i){let s=i instanceof Error?i.message:String(i);console.warn(`\u26A0\uFE0F  Could not pull skills for ${o}: ${s}`),n=!0}n?(console.log(`
 Skills pulled with some errors (see warnings above)`),process.exitCode=1):console.log(`
-Skills pulled successfully`)}r(ag,"handlePull");function Ea(e){let t=e.command("skills").summary("Manage AI agent skills for your app").description(`Manage AI agent skills for your app.
-Supports: ${Uo.join(", ")}`).addHelpText("after",`
+Skills pulled successfully`)}r(Tf,"handlePull");function hc(e){let t=e.command("skills").summary("Manage AI agent skills for your app").description(`Manage AI agent skills for your app.
+Supports: ${mr.join(", ")}`).addHelpText("after",`
 Examples:
   npx @cognite/cli apps skills pull                               Pull all skills
   npx @cognite/cli apps skills pull --skill create-client-tool    Pull a specific skill
-  npx @cognite/cli apps skills list                               List installed skills`);return t.command("pull").description("Pull all skills into your project").option("--source <owner/repo>","Skills repository",og,Aa).option("--skill <name>","Pull a specific skill by name").option("-i, --interactive","Interactively select which skills to install",!1).option("--global","Install skills globally",!1).action(ag),t.command("list").description("List installed skills").action(()=>{_o(["list"])}),t}r(Ea,"registerSkillsCommand");var ka=un(cg(pg(import.meta.url)),"..","..","_templates");async function gg(){let e=un(ka,"app","new","prompt.js");return(await import(dg(e).href)).default}r(gg,"loadPromptDefs");function fg(e,t){return!e||t?null:lg(e)}r(fg,"resolveDirName");function yg(e,t,n){if(e)return{cwd:process.cwd(),display:"."};let o=t??n;if(!o)throw new Error("App creation completed without a target directory or name.");return{cwd:un(process.cwd(),o),display:o}}r(yg,"resolveAppLocation");function hg(e,t,n){let o=`  npm install
+  npx @cognite/cli apps skills list                               List installed skills`);return t.command("pull").description("Pull all skills into your project").option("--source <owner/repo>","Skills repository",bf,gc).option("--skill <name>","Pull a specific skill by name").option("-i, --interactive","Interactively select which skills to install",!1).option("--global","Install skills globally",!1).action(Tf),t.command("list").description("List installed skills").action(()=>{gr(["list"])}),t}r(hc,"registerSkillsCommand");var Sc=Dn(Rf(Df(import.meta.url)),"..","..","_templates");async function Lf(){let e=Dn(Sc,"app","new","prompt.js");return(await import($f(e).href)).default}r(Lf,"loadPromptDefs");function Mf(e,t){return!e||t?null:If(e)}r(Mf,"resolveDirName");function Uf(e,t,n){if(e)return{cwd:process.cwd(),display:"."};let o=t??n;if(!o)throw new Error("App creation completed without a target directory or name.");return{cwd:Dn(process.cwd(),o),display:o}}r(Uf,"resolveAppLocation");function Nf(e,t,n){let o=`  npm install
   npm run dev`,i="To deploy your app:",s="npx @cognite/cli apps deploy --interactive",a=n?`
 To start spec-driven development:
   Run /speckit.specify in Claude Code, Cursor, or GitHub Copilot and describe your app.
@@ -132,7 +204,7 @@ ${i}
   cd "${t}"
   ${s}
 ${c}
-`)}r(hg,"printSuccessMessage");async function Sg(e){try{console.log("\u{1F9E0} Pulling skills into your app..."),await ba(e)}catch(t){let n=t instanceof Error?t.message:String(t);console.warn("\u26A0\uFE0F  Could not pull skills:",n)}}r(Sg,"pullSkillsInto");function wg(e,t={}){let{isGitInstalled:n=Wt,isInsideGitRepo:o=Zt,gitInitAndCommit:i=Ds}=t;if(!n()){console.warn("git not found \u2014 skipping git repository initialisation");return}if(!o(e)){console.log("Initialising git repository...");try{i(e)}catch(s){let c=(s&&typeof s=="object"&&"stderr"in s&&s.stderr?String(s.stderr).trim():"")||(s instanceof Error?s.message:String(s));console.warn("Could not initialise git repository:",c)}}}r(wg,"maybeInitGit");async function vg(e,t){let n=e==="."||e==="./",o=fg(e,n),i=null,s=!1,a={displayName:t.displayName,description:t.description,org:t.org,project:t.project,cluster:t.cluster,baseUrl:t.baseUrl},c=await gg(),l=cn(c),p=n?xa(process.cwd()):o?xa(o):null;await fa(l,a,p);let d=ga({isCurrentDir:n,dirName:o,onAppName:r(f=>{i=f},"onAppName"),onUseSpecKit:r(f=>{s=f},"onUseSpecKit"),presets:a,specKit:t.specKit});await mg(["app","new"],{templates:ka,cwd:process.cwd(),logger:new ug(console.log.bind(console)),createPrompter:d,debug:!!process.env.DEBUG});let u=yg(n,o,i);ln({target:"AGENTS.md",linkPath:un(u.cwd,"CLAUDE.md"),label:"CLAUDE.md"}),s&&va({appDir:u.cwd}),await Sg(u.cwd),wg(u.cwd),hg(n,u.display,s)}r(vg,"handleCreate");function Pa(e){return e.command("create").description("Create a new application.").argument("[directory]","Target directory (. for current, or subdirectory name)").option("--display-name <name>","App display name (skips the prompt)").option("--description <description>","App description (skips the prompt)").option("--org <org>","Deployment org (skips the prompt)").option("--project <project>","Deployment project (skips the prompt)").option("--cluster <cluster>","CDF cluster, e.g. greenfield (skips the prompt)").option("--base-url <url>","CDF base URL, e.g. https://greenfield.cognitedata.com (skips the prompt; defaults to cluster-derived URL when omitted)").option("--spec-kit","Install spec-kit slash commands (skips the prompt)").option("--no-spec-kit","Skip spec-kit installation (skips the prompt)").addHelpText("after",`
+`)}r(Nf,"printSuccessMessage");async function _f(e){try{console.log("\u{1F9E0} Pulling skills into your app..."),await fc(e)}catch(t){let n=t instanceof Error?t.message:String(t);console.warn("\u26A0\uFE0F  Could not pull skills:",n)}}r(_f,"pullSkillsInto");function jf(e,t={}){let{isGitInstalled:n=yn,isInsideGitRepo:o=wn,gitInitAndCommit:i=Ca}=t;if(!n()){console.warn("git not found \u2014 skipping git repository initialisation");return}if(!o(e)){console.log("Initialising git repository...");try{i(e)}catch(s){let c=(s&&typeof s=="object"&&"stderr"in s&&s.stderr?String(s.stderr).trim():"")||(s instanceof Error?s.message:String(s));console.warn("Could not initialise git repository:",c)}}}r(jf,"maybeInitGit");async function Hf(e,t){let n=e==="."||e==="./",o=Mf(e,n),i=null,s=!1,a={displayName:t.displayName,description:t.description,org:t.org,project:t.project,cluster:t.cluster,baseUrl:t.baseUrl},c=await Lf(),l=Pn(c),p=n?yc(process.cwd()):o?yc(o):null;await ac(l,a,p);let d=sc({isCurrentDir:n,dirName:o,onAppName:r(f=>{i=f},"onAppName"),onUseSpecKit:r(f=>{s=f},"onUseSpecKit"),presets:a,specKit:t.specKit});await Ff(["app","new"],{templates:Sc,cwd:process.cwd(),logger:new Of(console.log.bind(console)),createPrompter:d,debug:!!process.env.DEBUG});let u=Uf(n,o,i);Tn({target:"AGENTS.md",linkPath:Dn(u.cwd,"CLAUDE.md"),label:"CLAUDE.md"}),s&&uc({appDir:u.cwd}),await _f(u.cwd),jf(u.cwd),Nf(n,u.display,s)}r(Hf,"handleCreate");function wc(e){return e.command("create").description("Create a new application.").argument("[directory]","Target directory (. for current, or subdirectory name)").option("--display-name <name>","App display name (skips the prompt)").option("--description <description>","App description (skips the prompt)").option("--org <org>","Deployment org (skips the prompt)").option("--project <project>","Deployment project (skips the prompt)").option("--cluster <cluster>","CDF cluster, e.g. greenfield (skips the prompt)").option("--base-url <url>","CDF base URL, e.g. https://greenfield.cognitedata.com (skips the prompt; defaults to cluster-derived URL when omitted)").option("--spec-kit","Install spec-kit slash commands (skips the prompt)").option("--no-spec-kit","Skip spec-kit installation (skips the prompt)").addHelpText("after",`
 Non-interactive use (CI, scripts, AI agents):
   Pass [directory] plus --display-name, --description, --org, --project, --cluster, --base-url
   to skip every prompt. Missing flags fall back to the interactive prompt.
@@ -145,31 +217,30 @@ Examples:
     --display-name "My App" --description "My app" \\
     --org cog-atlas --project atlas-greenfield --cluster greenfield \\
     --base-url https://greenfield.cognitedata.com
-                                             Fully non-interactive`).action(vg)}r(Pa,"registerCreateCommand");import Cg from"path";async function Ag(e,t,n){return Bt(e,{interactive:t.interactive,appId:n,orgHint:t.org,confirmActionTarget:t.confirmActionTarget,action:"deactivate"})}r(Ag,"defaultBuildApiClient");async function bg(e,t,n={}){let{loadEnvFile:o=B,loadAppConfig:i=E,getApiClient:s=Ag,isSessionAuthEnabled:a=O}=n,c=Cg.resolve(process.cwd(),e);o(c);let l=i(c);K(l);let p=t.interactive?await M(l,t):L(l.deployments,t.deployment);if(!t.interactive&&!a()){let g=j(p);if(g.length>0)throw new Error(`Deployment ${p.org}/${p.project} is missing ${g.join(" and ")} in app.json. Use \`npx @cognite/cli@latest apps deactivate --interactive\` for browser-based authentication instead.`)}let{externalId:d}=l,u=await s(p,t,d),f=await u.getActiveVersion(d);if(!f){console.log(`  ${d} has no active version \u2014 nothing to deactivate.`);return}await u.deactivateVersion(d,f.version),console.log(`\u2713 Deactivated  ${d} @ ${f.version} \u2014 active alias removed`)}r(bg,"handleDeactivate");function Ia(e,t={isSessionAuthEnabled:O}){let{isSessionAuthEnabled:n}=t,o=e.command("deactivate").description("Deactivate the app by removing its active version from service").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)");return n()&&o.option("--confirm-action-target <target>","Acknowledge the org/project this command will act on, skipping the interactive prompt (value must match the resolved target)"),o.addHelpText("after",`
+                                             Fully non-interactive`).action(Hf)}r(wc,"registerCreateCommand");import Bf from"path";async function Kf(e,t,n){return nn(e,{interactive:t.interactive,appId:n,orgHint:t.org,authMethod:t.authMethod,confirmActionTarget:t.confirmActionTarget,action:"deactivate"})}r(Kf,"defaultBuildApiClient");async function Vf(e,t,n={}){let{loadEnvFile:o=j,loadAppConfig:i=k,getApiClient:s=Kf}=n,a=Bf.resolve(process.cwd(),e);o(a);let c=i(a);H(c);let l=t.interactive?await L(c,t):$(c.deployments,t.deployment),{externalId:p}=c,d=await s(l,t,p),u=await d.getActiveVersion(p);if(!u){console.log(`  ${p} has no active version \u2014 nothing to deactivate.`);return}await d.deactivateVersion(p,u.version),console.log(`\u2713 Deactivated  ${p} @ ${u.version} \u2014 active alias removed`)}r(Vf,"handleDeactivate");function vc(e){let t=e.command("deactivate").description("Deactivate the app by removing its active version from service").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)");return W().forEach(n=>t.addOption(n)),t.addHelpText("after",`
 Examples:
   npx @cognite/cli apps deactivate .                   Deactivate using env-var auth
-  npx @cognite/cli apps deactivate . --interactive     Deactivate using browser auth (no secrets needed)`).action((i,s)=>bg(i,s))}r(Ia,"registerDeactivateCommand");import Eg from"path";import xg from"enquirer";async function kg(e,t,n){return Bt(e,{interactive:t.interactive,appId:n,orgHint:t.org,confirmActionTarget:t.confirmActionTarget,action:"delete"})}r(kg,"defaultBuildApiClient");async function Pg(e){let{confirmed:t}=await xg.prompt({type:"confirm",name:"confirmed",message:e,initial:!1});return t}r(Pg,"defaultConfirm");async function Ig(e,t,n={}){let{loadEnvFile:o=B,loadAppConfig:i=E,getApiClient:s=kg,confirm:a=Pg,isSessionAuthEnabled:c=O}=n,l=Eg.resolve(process.cwd(),e);o(l);let p=i(l);K(p);let d=t.interactive?await M(p,t):L(p.deployments,t.deployment);if(!t.interactive&&!c()){let h=j(d);if(h.length>0)throw new m(`Deployment ${d.org}/${d.project} is missing ${h.join(" and ")} in app.json.`,{hint:"Use `npx @cognite/cli@latest apps delete --interactive` for browser-based authentication instead."})}let u=await s(d,t,p.externalId),{externalId:f,versionTag:g}=p,y;try{y=await u.getVersion(f,g)}catch(h){throw h instanceof ee?new m(`Version ${g} of ${f} has not been deployed yet.`,{hint:"Run `npx @cognite/cli apps deploy` first."}):h}if(y.alias==="ACTIVE")throw new m(`Cannot archive ${f} @ ${g}: version is currently ACTIVE.`,{hint:"Run `npx @cognite/cli apps deactivate` first."});if(y.lifecycleState==="ARCHIVED"){console.log(`  ${f} @ ${g} is already ARCHIVED \u2014 nothing to do.`);return}if(!t.force&&!await a(`Delete ${f} @ ${g}?`)){process.stderr.write(`Aborted.
-`);return}if(y.lifecycleState==="DRAFT"){await u.deleteVersion(f,g),console.log(`\u2713 Deleted     ${f} @ ${g} (DRAFT removed)`);return}y.lifecycleState==="PUBLISHED"&&(await u.deprecateVersion(f,g),console.log(`\u2713 Deprecated  ${f} @ ${g} is now DEPRECATED`)),await u.archiveVersion(f,g),console.log(`\u2713 Archived    ${f} @ ${g} is now ARCHIVED`)}r(Ig,"handleDelete");function Da(e,t={isSessionAuthEnabled:O}){let{isSessionAuthEnabled:n}=t,o=e.command("delete").description("Archive the current app version").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").option("-f, --force","Skip confirmation prompt",!1);return n()&&o.option("--confirm-action-target <target>","Acknowledge the org/project this command will act on, skipping the interactive prompt (value must match the resolved target)"),o.addHelpText("after",`
+  npx @cognite/cli apps deactivate . --interactive     Deactivate using browser auth (no secrets needed)`).action((n,o)=>Vf(n,o))}r(vc,"registerDeactivateCommand");import Gf from"path";import Yf from"enquirer";async function zf(e,t,n){return nn(e,{interactive:t.interactive,appId:n,orgHint:t.org,authMethod:t.authMethod,confirmActionTarget:t.confirmActionTarget,action:"delete"})}r(zf,"defaultBuildApiClient");async function qf(e){let{confirmed:t}=await Yf.prompt({type:"confirm",name:"confirmed",message:e,initial:!1});return t}r(qf,"defaultConfirm");async function Jf(e,t,n={}){let{loadEnvFile:o=j,loadAppConfig:i=k,getApiClient:s=zf,confirm:a=qf}=n,c=Gf.resolve(process.cwd(),e);o(c);let l=i(c);H(l);let p=t.interactive?await L(l,t):$(l.deployments,t.deployment),d=await s(p,t,l.externalId),{externalId:u,versionTag:f}=l,h;try{h=await d.getVersion(u,f)}catch(g){throw g instanceof te?new m(`Version ${f} of ${u} has not been deployed yet.`,{hint:"Run `npx @cognite/cli apps deploy` first."}):g}if(h.alias==="ACTIVE")throw new m(`Cannot archive ${u} @ ${f}: version is currently ACTIVE.`,{hint:"Run `npx @cognite/cli apps deactivate` first."});if(h.lifecycleState==="ARCHIVED"){console.log(`  ${u} @ ${f} is already ARCHIVED \u2014 nothing to do.`);return}if(!t.force&&!await a(`Delete ${u} @ ${f}?`)){process.stderr.write(`Aborted.
+`);return}if(h.lifecycleState==="DRAFT"){await d.deleteVersion(u,f),console.log(`\u2713 Deleted     ${u} @ ${f} (DRAFT removed)`);return}h.lifecycleState==="PUBLISHED"&&(await d.deprecateVersion(u,f),console.log(`\u2713 Deprecated  ${u} @ ${f} is now DEPRECATED`)),await d.archiveVersion(u,f),console.log(`\u2713 Archived    ${u} @ ${f} is now ARCHIVED`)}r(Jf,"handleDelete");function Cc(e){let t=e.command("delete").description("Archive the current app version").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").option("-f, --force","Skip confirmation prompt",!1);return W().forEach(n=>t.addOption(n)),t.addHelpText("after",`
 Examples:
   npx @cognite/cli apps delete .                   Archive using env-var auth
   npx @cognite/cli apps delete . --interactive     Archive using browser auth (no secrets needed)
-  npx @cognite/cli apps delete . --force           Skip confirmation prompt`).action((i,s)=>Ig(i,s))}r(Da,"registerDeleteCommand");import{existsSync as Bg}from"fs";import{rm as Kg}from"fs/promises";import Ra from"enquirer";import{existsSync as Mg}from"fs";import{mkdir as Ug,readFile as _g}from"fs/promises";import{basename as jg,dirname as Ng}from"path";import{execFileSync as mn}from"child_process";import Ce from"fs";import z from"path";import{parseAndValidateManifestConfig as Dg}from"@cognite/app-sdk/vite";import{BlobReader as Tg,Uint8ArrayWriter as Rg,ZipWriter as $g}from"@zip.js/zip.js";var jo="package.json",No="package-lock.json",Ta="manifest.json",Ho=".cognite",Og=[/^\.env(\..+)?$/i,/^\.secrets?$/i,/^\.token/i,/^\.cognite/i,/\.(key|pem|p12|pfx|jks|crt)$/i],Bo=class Bo{constructor(t="dist"){this.distPath=z.isAbsolute(t)?t:z.join(process.cwd(),t),this.appRoot=z.dirname(this.distPath)}validateBuildDirectory(){if(!Ce.existsSync(this.distPath))throw new Error(`Build directory "${this.distPath}" not found. Run build first.`);let t=z.join(this.appRoot,jo);if(!Ce.existsSync(t))throw new Error(`"${t}" not found. It is required for deployment.`);let n=z.join(this.appRoot,No);if(!Ce.existsSync(n))throw new Error(`"${n}" not found. It is required for deployment.`)}async createZip(t="app.zip",n=!1){this.validateBuildDirectory(),console.log("\u{1F4E6} Packaging application...");let o=new $g(new Rg,{level:9}),i=r(async(l,p)=>{await o.add(p,new Tg(await Ce.openAsBlob(l))),n&&console.log(`  \u{1F4C4} ${p}`)},"addFile"),s=r(async l=>{let p=await Ce.promises.readdir(l,{withFileTypes:!0});for(let d of p){let u=z.join(l,d.name);d.isDirectory()?await s(u):await i(u,z.relative(this.distPath,u).replace(/\\/g,"/"))}},"addDir"),a;try{await s(this.distPath);let l=z.join(this.appRoot,jo);await i(l,z.posix.join(Ho,jo));let p=z.join(this.appRoot,Ta);if(Ce.existsSync(p)){let u=Ce.readFileSync(p,"utf-8");Dg(u,p),await i(p,z.posix.join(Ho,Ta))}let d=z.join(this.appRoot,No);await i(d,z.posix.join(Ho,No)),a=await o.close()}catch(l){let p=l instanceof Error?l.message:String(l);throw new Error(`Failed to create zip: ${p}`)}try{await Ce.promises.writeFile(t,a)}catch(l){throw new m(`Failed to write bundle to ${t}`,{cause:l})}let c=(a.byteLength/1024/1024).toFixed(2);return console.log(`\u2705 App packaged: ${t} (${c} MB)`),t}async createSourceArchive(t){console.log("\u{1F4E6} Packaging source for review...");let n;try{n=mn("git",["-C",this.appRoot,"rev-parse","--show-toplevel"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim()}catch(l){throw me(),new m("Source packaging requires a git repository.",{hint:"Run `git init` first.",shouldReport:!1,cause:l})}let o=mn("git",["-C",this.appRoot,"rev-parse","--show-prefix"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim(),i=o?o.replace(/\/$/,""):".",s=i==="."?"HEAD":`HEAD:${i}`;this.validateNoSensitiveFiles(n,s);try{mn("git",["-C",n,"archive","--format=zip",`--output=${t}`,s])}catch(l){let p=l instanceof Error?l.message:String(l);throw new Error(`Failed to create source archive: ${p}`)}let c=(Ce.statSync(t).size/1024/1024).toFixed(2);return console.log(`\u2705 Source packaged: ${z.basename(t)} (${c} MB)`),t}validateNoSensitiveFiles(t,n){let o=mn("git",["-C",t,"ls-tree","-r","--name-only",n],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().split(`
-`).filter(Boolean),i=r(a=>a.split("/").some(c=>Og.some(l=>l.test(c))),"isSensitive"),s=o.filter(i);if(s.length>0)throw new Error(`Source archive would include sensitive files \u2014 remove them from git tracking first:
+  npx @cognite/cli apps delete . --force           Skip confirmation prompt`).action((n,o)=>Jf(n,o))}r(Cc,"registerDeleteCommand");import{existsSync as lh}from"fs";import{rm as ph}from"fs/promises";import Ec from"enquirer";import{existsSync as oh}from"fs";import{mkdir as rh,readFile as ih}from"fs/promises";import{basename as sh,dirname as ah}from"path";import{execFileSync as $n}from"child_process";import Pe from"fs";import Z from"path";import{parseAndValidateManifestConfig as Wf}from"@cognite/app-sdk/vite";import{BlobReader as Zf,Uint8ArrayWriter as Xf,ZipWriter as Qf}from"@zip.js/zip.js";var fr="package.json",hr="package-lock.json",Ac="manifest.json",yr=".cognite",eh=[/^\.env(\..+)?$/i,/^\.secrets?$/i,/^\.token/i,/^\.cognite/i,/\.(key|pem|p12|pfx|jks|crt)$/i],Sr=class Sr{constructor(t="dist"){this.distPath=Z.isAbsolute(t)?t:Z.join(process.cwd(),t),this.appRoot=Z.dirname(this.distPath)}validateBuildDirectory(){if(!Pe.existsSync(this.distPath))throw new Error(`Build directory "${this.distPath}" not found. Run build first.`);let t=Z.join(this.appRoot,fr);if(!Pe.existsSync(t))throw new Error(`"${t}" not found. It is required for deployment.`);let n=Z.join(this.appRoot,hr);if(!Pe.existsSync(n))throw new Error(`"${n}" not found. It is required for deployment.`)}async createZip(t="app.zip",n=!1){this.validateBuildDirectory(),console.log("\u{1F4E6} Packaging application...");let o=new Qf(new Xf,{level:9}),i=r(async(l,p)=>{await o.add(p,new Zf(await Pe.openAsBlob(l))),n&&console.log(`  \u{1F4C4} ${p}`)},"addFile"),s=r(async l=>{let p=await Pe.promises.readdir(l,{withFileTypes:!0});for(let d of p){let u=Z.join(l,d.name);d.isDirectory()?await s(u):await i(u,Z.relative(this.distPath,u).replace(/\\/g,"/"))}},"addDir"),a;try{await s(this.distPath);let l=Z.join(this.appRoot,fr);await i(l,Z.posix.join(yr,fr));let p=Z.join(this.appRoot,Ac);if(Pe.existsSync(p)){let u=Pe.readFileSync(p,"utf-8");Wf(u,p),await i(p,Z.posix.join(yr,Ac))}let d=Z.join(this.appRoot,hr);await i(d,Z.posix.join(yr,hr)),a=await o.close()}catch(l){let p=l instanceof Error?l.message:String(l);throw new Error(`Failed to create zip: ${p}`)}try{await Pe.promises.writeFile(t,a)}catch(l){throw new m(`Failed to write bundle to ${t}`,{cause:l})}let c=(a.byteLength/1024/1024).toFixed(2);return console.log(`\u2705 App packaged: ${t} (${c} MB)`),t}async createSourceArchive(t){console.log("\u{1F4E6} Packaging source for review...");let n;try{n=$n("git",["-C",this.appRoot,"rev-parse","--show-toplevel"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim()}catch(l){throw Ae(),new m("Source packaging requires a git repository.",{hint:"Run `git init` first.",shouldReport:!1,cause:l})}let o=$n("git",["-C",this.appRoot,"rev-parse","--show-prefix"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim(),i=o?o.replace(/\/$/,""):".",s=i==="."?"HEAD":`HEAD:${i}`;this.validateNoSensitiveFiles(n,s);try{$n("git",["-C",n,"archive","--format=zip",`--output=${t}`,s])}catch(l){let p=l instanceof Error?l.message:String(l);throw new Error(`Failed to create source archive: ${p}`)}let c=(Pe.statSync(t).size/1024/1024).toFixed(2);return console.log(`\u2705 Source packaged: ${Z.basename(t)} (${c} MB)`),t}validateNoSensitiveFiles(t,n){let o=$n("git",["-C",t,"ls-tree","-r","--name-only",n],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().split(`
+`).filter(Boolean),i=r(a=>a.split("/").some(c=>eh.some(l=>l.test(c))),"isSensitive"),s=o.filter(i);if(s.length>0)throw new Error(`Source archive would include sensitive files \u2014 remove them from git tracking first:
 `+s.map(a=>`  ${a}`).join(`
 `)+`
-Hint: git rm --cached <file>`)}};r(Bo,"ApplicationPackager");var Ae=Bo;import{existsSync as Fg,readFileSync as Lg}from"fs";var Ie=[".dev.sig",".cert.sig"];function mt(e,t={}){let n=t.existsSync??Fg,o=t.readFileSync??((s,a)=>Lg(s,a)),i=[];for(let s of Ie){let a=`${e}${s}`;if(!n(a))continue;let c=o(a,"utf8").trim();c.length>0&&i.push(c)}return i}r(mt,"discoverSignatures");async function gt(e,t,{existsSync:n=Mg,mkdir:o=Ug,createZip:i=r((s,a)=>new Ae(s).createZip(a,!0),"createZipFn")}={}){let{externalId:s,versionTag:a}=e,c=oe(t,s,a);if(n(c)){let p=Ie.some(d=>n(`${c}${d}`))?"A signed bundle already exists here. Re-deploying will invalidate the signing process. Bump versionTag in app.json to deploy as a new version, or delete the bundle and its .sig files then re-sign after deploying.":"Bump versionTag in app.json to deploy as a new version, or delete the existing bundle from .cognite-bundles/ to redeploy the same version.";throw new m(`Bundle already exists: ${c}`,{hint:p,shouldReport:!1})}await o(Ng(c),{recursive:!0}),await i(`${t}/dist`,c)}r(gt,"packageBundle");async function Xe(e,t,n,o,{readFile:i=_g,upload:s=r(async(a,c)=>new U(e).deploy(t.externalId,t.name,t.description,t.versionTag,a,c,o),"uploadFn")}={}){let a=oe(n,t.externalId,t.versionTag),c;try{c=await i(a)}catch(l){throw new m(`Failed to read bundle file: ${a}`,{cause:l})}await s(c,jg(a))}r(Xe,"uploadBundle");var Ko=r(async(e,t,n)=>{let o=await Me(e,n);await gt(t,n),await Xe(o,t,n,e.published)},"deploy"),Vo=r(async(e,t,n)=>{let o=await Me(e,n);await Xe(o,t,n,e.published)},"deployBundle");import{execSync as Hg}from"child_process";function gn(e,t=!0,n={execSync:Hg}){console.log("\u{1F4E6} Building app with npm...");try{n.execSync("npm run build",{cwd:e,stdio:t?"inherit":"pipe"})}catch(o){throw new m(`npm run build failed in ${e}`,{cause:o,hint:"Check the build output above for errors."})}console.log("\u2705 Build successful")}r(gn,"buildApp");async function Vg(e){let{confirmed:t}=await Ra.prompt({type:"confirm",name:"confirmed",message:e,initial:!1});return t}r(Vg,"defaultConfirm");async function Gg(e,t){let{selected:n}=await Ra.prompt({type:"select",name:"selected",message:e,choices:t});return n}r(Gg,"defaultSelect");async function Yg(e){await Kg(e,{force:!0})}r(Yg,"defaultRm");function qg(e,t,n){return n(e)?t.skipBuild?"use-existing":process.stdout.isTTY?"prompt":"package-fresh":"package-fresh"}r(qg,"classifyExistingBundle");async function Jg(e,t){let{versionTag:n,hasSigs:o}=e,i=o?`A signed bundle for v${n} already exists. What would you like to do?`:`A bundle for v${n} already exists. What would you like to do?`,s=await t.select(i,[{name:"reuse",message:"Deploy the existing bundle without rebuilding"},{name:"rebuild",message:"Rebuild and deploy (overwrites the existing bundle)",...o?{hint:"\u2014 discards existing signatures"}:{}},{name:"cancel",message:"Cancel \u2014 do nothing"}]);if(s==="rebuild"&&o){let a=P(process.stderr);if(console.warn(a.bold.red(`
-WARNING: this bundle is already signed.`)),console.warn(a.red(`Rebuilding overwrites the bundle and permanently discards its signatures (${Ie.join(", ")}). You will have to re-sign before publishing.
-`)),!await t.confirm("Rebuild anyway and discard the existing signatures?"))return"cancel"}return s==="reuse"?"reuse":s==="rebuild"?"rebuild":"cancel"}r(Jg,"promptBundleAction");async function zg(e,t){for(let n of[e,...Ie.map(o=>`${e}${o}`)])t.existsSync(n)&&await t.rm(n)}r(zg,"removeBundleArtifacts");function Go(e){let{appConfig:t,deployment:n,interactive:o}=e,i=o?"Deploy (Interactive)":"Deploy",s=o?`${n.project} @ ${n.baseUrl}`:`${n.org}/${n.project}`;console.log(["",i,"=".repeat(i.length),`App: ${t.name} (${t.externalId})`,`Version: ${t.versionTag}`,`Target: ${s}`,""].join(`
-`))}r(Go,"printDeployInfo");function Yo(e){let{appConfig:t,deployment:n}=e;console.log(`
+Hint: git rm --cached <file>`)}};r(Sr,"ApplicationPackager");var Te=Sr;import{existsSync as th,readFileSync as nh}from"fs";var Fe=[".dev.sig",".cert.sig"];function Ct(e,t={}){let n=t.existsSync??th,o=t.readFileSync??((s,a)=>nh(s,a)),i=[];for(let s of Fe){let a=`${e}${s}`;if(!n(a))continue;let c=o(a,"utf8").trim();c.length>0&&i.push(c)}return i}r(Ct,"discoverSignatures");async function wr(e,t,{existsSync:n=oh,mkdir:o=rh,createZip:i=r((s,a)=>new Te(s).createZip(a,!0),"createZipFn")}={}){let{externalId:s,versionTag:a}=e,c=ne(t,s,a);if(n(c)){let p=Fe.some(d=>n(`${c}${d}`))?"A signed bundle already exists here. Re-deploying will invalidate the signing process. Bump versionTag in app.json to deploy as a new version, or delete the bundle and its .sig files then re-sign after deploying.":"Bump versionTag in app.json to deploy as a new version, or delete the existing bundle from .cognite-bundles/ to redeploy the same version.";throw new m(`Bundle already exists: ${c}`,{hint:p,shouldReport:!1})}await o(ah(c),{recursive:!0}),await i(`${t}/dist`,c)}r(wr,"packageBundle");async function vr(e,t,n,o,{readFile:i=ih,upload:s=r(async(a,c)=>new U(e).deploy(t.externalId,t.name,t.description,t.versionTag,a,c,o),"uploadFn")}={}){let a=ne(n,t.externalId,t.versionTag),c;try{c=await i(a)}catch(l){throw new m(`Failed to read bundle file: ${a}`,{cause:l})}await s(c,sh(a))}r(vr,"uploadBundle");import{execSync as ch}from"child_process";function On(e,t=!0,n={execSync:ch}){console.log("\u{1F4E6} Building app with npm...");try{n.execSync("npm run build",{cwd:e,stdio:t?"inherit":"pipe"})}catch(o){throw new m(`npm run build failed in ${e}`,{cause:o,hint:"Check the build output above for errors."})}console.log("\u2705 Build successful")}r(On,"buildApp");async function dh(e){let{confirmed:t}=await Ec.prompt({type:"confirm",name:"confirmed",message:e,initial:!1});return t}r(dh,"defaultConfirm");async function uh(e,t){let{selected:n}=await Ec.prompt({type:"select",name:"selected",message:e,choices:t});return n}r(uh,"defaultSelect");async function mh(e){await ph(e,{force:!0})}r(mh,"defaultRm");function gh(e,t,n){return n(e)?t.skipBuild?"use-existing":process.stdout.isTTY?"prompt":"package-fresh":"package-fresh"}r(gh,"classifyExistingBundle");async function fh(e,t){let{versionTag:n,hasSigs:o}=e,i=o?`A signed bundle for v${n} already exists. What would you like to do?`:`A bundle for v${n} already exists. What would you like to do?`,s=await t.select(i,[{name:"reuse",message:"Deploy the existing bundle without rebuilding"},{name:"rebuild",message:"Rebuild and deploy (overwrites the existing bundle)",...o?{hint:"\u2014 discards existing signatures"}:{}},{name:"cancel",message:"Cancel \u2014 do nothing"}]);if(s==="rebuild"&&o){let a=P(process.stderr);if(console.warn(a.bold.red(`
+WARNING: this bundle is already signed.`)),console.warn(a.red(`Rebuilding overwrites the bundle and permanently discards its signatures (${Fe.join(", ")}). You will have to re-sign before publishing.
+`)),!await t.confirm("Rebuild anyway and discard the existing signatures?"))return"cancel"}return s==="reuse"?"reuse":s==="rebuild"?"rebuild":"cancel"}r(fh,"promptBundleAction");async function hh(e,t){for(let n of[e,...Fe.map(o=>`${e}${o}`)])t.existsSync(n)&&await t.rm(n)}r(hh,"removeBundleArtifacts");function bc(e){let{appConfig:t,deployment:n,interactive:o}=e,i=o?"Deploy (Interactive)":"Deploy",s=o?`${n.project} @ ${n.baseUrl}`:`${n.org}/${n.project}`;console.log(["",i,"=".repeat(i.length),`App: ${t.name} (${t.externalId})`,`Version: ${t.versionTag}`,`Target: ${s}`,""].join(`
+`))}r(bc,"printDeployInfo");function xc(e){let{appConfig:t,deployment:n}=e;console.log(`
 Successfully deployed ${t.name} version ${t.versionTag} to ${n.org?`${n.org}/`:""}${n.project}`),console.log("App is deployed in draft mode");let o=t.deployments.length>1?` -d ${n.project}`:"";console.log(`
 To sign:     npx @cognite/cli apps sign --interactive${o}`),console.log(`To publish:  npx @cognite/cli apps publish .${o}`),console.log(`To activate: npx @cognite/cli apps activate .${o}`),console.log(`
-To submit for certification: npx @cognite/cli apps submit`);let i=ws(n,t);i&&console.log(`
+To submit for certification: npx @cognite/cli apps submit`);let i=pa(n,t);i&&console.log(`
 Open your app:
-   ${i}`)}r(Yo,"printDeployResult");async function Wg(e,t){let{appConfig:n,deployment:o,cwd:i,options:s,useExistingBundle:a}=e,{deployFn:c,buildApp:l,isSessionAuthEnabled:p,buildClient:d,packageBundle:u,uploadBundle:f}=t;if(p()&&!s.interactive&&j(o).length){Go({appConfig:n,deployment:o,interactive:!1}),!s.skipBuild&&!a&&l(i);let y=await d(o,{interactive:!1,appId:n.externalId,orgHint:s.org,confirmActionTarget:s.confirmActionTarget,action:"deploy"});console.log(`
-Deploying to ${o.org}/${o.project}...`);let h={externalId:n.externalId,name:n.name,description:n.description,versionTag:n.versionTag};a||await u(h,i),await f(y,h,i,!1),Yo({appConfig:n,deployment:o});return}let g=j(o);if(g.length>0)throw new Error(`Deployment ${o.org}/${o.project} is missing ${g.join(" and ")} in app.json. Use \`cognite apps deploy --interactive\` for browser-based authentication instead.`);Go({appConfig:n,deployment:o,interactive:!1}),!s.skipBuild&&!a&&l(i),console.log(`
-Deploying to ${o.org}/${o.project}...`),await c({...o,published:!1},{externalId:n.externalId,name:n.name,description:n.description,versionTag:n.versionTag},i),Yo({appConfig:n,deployment:o})}r(Wg,"handleDeployNonInteractive");async function Xg(e,t){let{appConfig:n,deployment:o,cwd:i,options:s,useExistingBundle:a}=e,{buildApp:c}=t;Go({appConfig:n,deployment:o,interactive:!0}),!s.skipBuild&&!a&&c(i);let l=await _(o,{interactive:!0,appId:n.externalId,orgHint:s.org});console.log(`
-Deploying to ${o.project}...`);let p={externalId:n.externalId,name:n.name,description:n.description,versionTag:n.versionTag};a||await gt(p,i),await Xe(l,p,i,!1),Yo({appConfig:n,deployment:o})}r(Xg,"handleDeployInteractive");async function Zg(e,t=process.cwd(),n={}){let{loadEnvFile:o=B,loadAppConfig:i=E,deploy:s=Ko,deployBundle:a=Vo,confirm:c=Vg,select:l=Gg,existsSync:p=Bg,rm:d=Yg,buildApp:u=gn,isSessionAuthEnabled:f=O,buildClient:g=_,packageBundle:y=gt,uploadBundle:h=Xe}=n;o(t);let S=i(t);K(S);let w=oe(t,S.externalId,S.versionTag),C=qg(w,e,p),v=C==="use-existing";if(C==="prompt"){let b=Ie.some(W=>p(`${w}${W}`)),k=await Jg({versionTag:S.versionTag,hasSigs:b},{select:l,confirm:c});if(k==="cancel"){console.log(`
-Deployment cancelled. Nothing was deployed.`);return}k==="reuse"?v=!0:await zg(w,{existsSync:p,rm:d})}if(e.interactive){let b=await M(S,e);await Xg({appConfig:S,deployment:b,cwd:t,options:e,useExistingBundle:v},{buildApp:u});return}let R=L(S.deployments,e.deployment);await Wg({appConfig:S,deployment:R,cwd:t,options:e,useExistingBundle:v},{deployFn:v?a:s,buildApp:u,isSessionAuthEnabled:f,buildClient:g,packageBundle:y,uploadBundle:h})}r(Zg,"handleDeploy");function $a(e,t={isSessionAuthEnabled:O}){let{isSessionAuthEnabled:n}=t,o=n()?"Deploy your app to Cognite Data Fusion. Run `auth login` to sign in, or use --interactive for a one-off browser login (no env-var secrets required).":"Deploy your app to Cognite Data Fusion. Use --interactive for browser-based login (no env-var secrets required).",i=e.command("deploy").description(o).option("-d, --deployment <target>","Deployment target (index or project name)").option("--skip-build","Skip the build step",!1).option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)");return n()&&i.option("--confirm-action-target <target>","Acknowledge the org/project this command will act on, skipping the interactive prompt (value must match the resolved target)"),i.addHelpText("after",`
+   ${i}`)}r(xc,"printDeployResult");function kc(e){let{externalId:t,name:n,description:o,versionTag:i}=e;return{externalId:t,name:n,description:o,versionTag:i}}r(kc,"toApp");async function yh(e,t){let{appConfig:n,deployment:o,cwd:i,options:s,useExistingBundle:a}=e,{buildApp:c,buildClient:l,packageBundle:p,uploadBundle:d}=t;bc({appConfig:n,deployment:o,interactive:!1});let u=await l(o,{interactive:!1,appId:n.externalId,orgHint:s.org,authMethod:s.authMethod,confirmActionTarget:s.confirmActionTarget,action:"deploy"});!s.skipBuild&&!a&&c(i),console.log(`
+Deploying to ${o.org}/${o.project}...`);let f=kc(n);a||await p(f,i),await d(u,f,i,!1),xc({appConfig:n,deployment:o})}r(yh,"handleDeployNonInteractive");async function Sh(e,t){let{appConfig:n,deployment:o,cwd:i,options:s,useExistingBundle:a}=e,{buildApp:c,buildClient:l,packageBundle:p,uploadBundle:d}=t;bc({appConfig:n,deployment:o,interactive:!0}),!s.skipBuild&&!a&&c(i);let u=await l(o,{interactive:!0,appId:n.externalId,orgHint:s.org,authMethod:s.authMethod});console.log(`
+Deploying to ${o.project}...`);let f=kc(n);a||await p(f,i),await d(u,f,i,!1),xc({appConfig:n,deployment:o})}r(Sh,"handleDeployInteractive");async function wh(e,t=process.cwd(),n={}){let{loadEnvFile:o=j,loadAppConfig:i=k,confirm:s=dh,select:a=uh,existsSync:c=lh,rm:l=mh,buildApp:p=On,buildClient:d=_,packageBundle:u=wr,uploadBundle:f=vr}=n;o(t);let h=i(t);H(h);let g=ne(t,h.externalId,h.versionTag),y=gh(g,e,c),S=y==="use-existing";if(y==="prompt"){let v=Fe.some(x=>c(`${g}${x}`)),C=await fh({versionTag:h.versionTag,hasSigs:v},{select:a,confirm:s});if(C==="cancel"){console.log(`
+Deployment cancelled. Nothing was deployed.`);return}C==="reuse"?S=!0:await hh(g,{existsSync:c,rm:l})}if(e.interactive){let v=await L(h,e);await Sh({appConfig:h,deployment:v,cwd:t,options:e,useExistingBundle:S},{buildApp:p,buildClient:d,packageBundle:u,uploadBundle:f});return}let w=$(h.deployments,e.deployment);await yh({appConfig:h,deployment:w,cwd:t,options:e,useExistingBundle:S},{buildApp:p,buildClient:d,packageBundle:u,uploadBundle:f})}r(wh,"handleDeploy");function Pc(e){let t=e.command("deploy").description("Deploy your app to Cognite Data Fusion. Run `auth login` to sign in, or use --interactive for a one-off browser login (no env-var secrets required).").option("-d, --deployment <target>","Deployment target (index or project name)").option("--skip-build","Skip the build step",!1).option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)");return W().forEach(n=>t.addOption(n)),t.addHelpText("after",`
 Environment (non-interactive):
   deployClientId and deploySecretName are configured per deployment in app.json.
   deploySecretName is the name of the environment variable that holds the client
@@ -183,10 +254,10 @@ Examples:
   npx @cognite/cli apps deploy -d my-project      Deploy to project by name
   npx @cognite/cli apps deploy --skip-build       Deploy without rebuilding
   npx @cognite/cli apps deploy --interactive      Browser auth, prompts for target
-  npx @cognite/cli apps deploy --interactive -d 0 Browser auth, target chosen non-interactively`).action(s=>Zg(s))}r($a,"registerDeployCommand");import hn from"fs";import sf from"os";import De from"path";import af from"enquirer";import qo from"fs";import fn from"path";import{BlobReader as Qg,Uint8ArrayWriter as ef,ZipReader as tf}from"@zip.js/zip.js";import ft from"path";function Oa(e,t){let n=ft.resolve(e),o=ft.resolve(t),i=ft.relative(n,o);return i===""||ft.isAbsolute(i)?!1:i!==".."&&!i.startsWith(`..${ft.sep}`)}r(Oa,"isSafePath");var nf=1e5,of=2*1024**3;async function Fa(e,t,n={}){let{openAsBlob:o=r(d=>qo.openAsBlob(d),"openAsBlob"),mkdir:i=r((d,u)=>qo.promises.mkdir(d,u),"mkdir"),writeFile:s=r((d,u)=>qo.promises.writeFile(d,u),"writeFile"),maxEntries:a=nf,maxTotalBytes:c=of}=n,l=await o(e),p=new tf(new Qg(l));try{let d;try{d=await p.getEntries()}catch(g){throw new m(`Could not read bundle: ${fn.basename(e)} is not a valid zip file.`,{hint:"Make sure you are passing the correct bundle path.",shouldReport:!1,cause:g})}let u=0,f=0;for(let g of d){if(g.directory)continue;if(f++,f>a)throw new Error(`Zip contains too many entries (limit: ${a})`);if(u+=g.uncompressedSize,u>c)throw new Error(`Zip exceeds maximum allowed size (limit: ${Math.round(c/(1024*1024))} MB)`);if(fn.isAbsolute(g.filename))throw new Error(`Malicious zip entry rejected: ${g.filename}`);let y=fn.join(t,g.filename);if(!Oa(t,y))throw new Error(`Malicious zip entry rejected: ${g.filename}`);let h=await g.getData(new ef);await i(fn.dirname(y),{recursive:!0}),await s(y,h)}}finally{await p.close()}}r(Fa,"extractZip");import{execFileSync as rf}from"child_process";function Ma(e){return e instanceof Error&&"status"in e&&typeof e.status=="number"}r(Ma,"isExitError");function La(e){if(!Ma(e)||e.status!==1)throw e}r(La,"swallowDiffExit");var Jo=class Jo{constructor(t={execFileSync:rf}){this.deps=t}isSupported(){try{return this.deps.execFileSync("git",["--version"],{stdio:"pipe"}),!0}catch{return!1}}isIdentical(t,n){try{return this.deps.execFileSync("git",["diff","--no-index","--quiet","--ignore-cr-at-eol",t,n]),!0}catch(o){if(Ma(o)&&o.status===1)return!1;throw o}}showStat(t,n){try{this.deps.execFileSync("git",["--no-pager","diff","--stat","--no-index","--ignore-cr-at-eol",t,n],{stdio:"inherit"})}catch(o){La(o)}}showDiff(t,n,{usePager:o=!0}={}){let i=[];o||i.push("--no-pager"),i.push("diff","--word-diff=color","--no-index","--ignore-cr-at-eol",t,n);try{this.deps.execFileSync("git",i,{stdio:"inherit"})}catch(s){La(s)}}};r(Jo,"GitDiffer");var yn=Jo;var cf=r(async e=>(await af.prompt([{type:"confirm",name:"answer",message:e,initial:!1}])).answer,"defaultConfirm");async function lf(e,t,n={}){let{cwd:o=process.cwd(),buildApp:i=gn,createPackager:s=r(v=>new Ae(v),"createPackager"),extractZip:a=Fa,differ:c=new yn,existsSync:l=r(v=>hn.existsSync(v),"existsSync"),mkdtemp:p=r(v=>hn.promises.mkdtemp(v),"mkdtemp"),mkdir:d=r(async(v,R)=>{await hn.promises.mkdir(v,R)},"mkdir"),rm:u=r((v,R)=>hn.promises.rm(v,R),"rm"),isInteractive:f=r(()=>!!(process.stdin.isTTY&&process.stdout.isTTY),"isInteractive"),confirm:g=cf,setExitCode:y=r(v=>{process.exitCode=v},"setExitCode")}=n;if(!c.isSupported())throw new m("git is required for the diff command",{hint:"Install git and ensure it is in your PATH.",shouldReport:!1});if(!l(e))throw new m(`Bundle not found: ${e}`,{hint:"Check the file path and try again.",shouldReport:!1});if(!t.skipBuild)await i(o);else{let v=De.join(o,"dist");if(!l(v))throw new m("dist directory not found.",{hint:"Run without --skip-build to build the app first, or run `pnpm build` manually.",shouldReport:!1})}let h=await p(De.join(sf.tmpdir(),"cognite-diff-")),S=De.join(h,"ours.zip"),w=De.join(h,"ours"),C=De.join(h,"theirs");try{if(await d(w,{recursive:!0}),await d(C,{recursive:!0}),await s(De.join(o,"dist")).createZip(S),console.log(`
-Extracting bundles...`),await a(S,w),await a(e,C),c.isIdentical(w,C)){console.log(`
+  npx @cognite/cli apps deploy --interactive -d 0 Browser auth, target chosen non-interactively`).action(n=>wh(n))}r(Pc,"registerDeployCommand");import Mn from"fs";import kh from"os";import Le from"path";import Ph from"enquirer";import Cr from"fs";import Fn from"path";import{BlobReader as vh,Uint8ArrayWriter as Ch,ZipReader as Ah}from"@zip.js/zip.js";import At from"path";function Tc(e,t){let n=At.resolve(e),o=At.resolve(t),i=At.relative(n,o);return i===""||At.isAbsolute(i)?!1:i!==".."&&!i.startsWith(`..${At.sep}`)}r(Tc,"isSafePath");var Eh=1e5,bh=2*1024**3;async function Rc(e,t,n={}){let{openAsBlob:o=r(d=>Cr.openAsBlob(d),"openAsBlob"),mkdir:i=r((d,u)=>Cr.promises.mkdir(d,u),"mkdir"),writeFile:s=r((d,u)=>Cr.promises.writeFile(d,u),"writeFile"),maxEntries:a=Eh,maxTotalBytes:c=bh}=n,l=await o(e),p=new Ah(new vh(l));try{let d;try{d=await p.getEntries()}catch(h){throw new m(`Could not read bundle: ${Fn.basename(e)} is not a valid zip file.`,{hint:"Make sure you are passing the correct bundle path.",shouldReport:!1,cause:h})}let u=0,f=0;for(let h of d){if(h.directory)continue;if(f++,f>a)throw new Error(`Zip contains too many entries (limit: ${a})`);if(u+=h.uncompressedSize,u>c)throw new Error(`Zip exceeds maximum allowed size (limit: ${Math.round(c/(1024*1024))} MB)`);if(Fn.isAbsolute(h.filename))throw new Error(`Malicious zip entry rejected: ${h.filename}`);let g=Fn.join(t,h.filename);if(!Tc(t,g))throw new Error(`Malicious zip entry rejected: ${h.filename}`);let y=await h.getData(new Ch);await i(Fn.dirname(g),{recursive:!0}),await s(g,y)}}finally{await p.close()}}r(Rc,"extractZip");import{execFileSync as xh}from"child_process";function Dc(e){return e instanceof Error&&"status"in e&&typeof e.status=="number"}r(Dc,"isExitError");function Ic(e){if(!Dc(e)||e.status!==1)throw e}r(Ic,"swallowDiffExit");var Ar=class Ar{constructor(t={execFileSync:xh}){this.deps=t}isSupported(){try{return this.deps.execFileSync("git",["--version"],{stdio:"pipe"}),!0}catch{return!1}}isIdentical(t,n){try{return this.deps.execFileSync("git",["diff","--no-index","--quiet","--ignore-cr-at-eol",t,n]),!0}catch(o){if(Dc(o)&&o.status===1)return!1;throw o}}showStat(t,n){try{this.deps.execFileSync("git",["--no-pager","diff","--stat","--no-index","--ignore-cr-at-eol",t,n],{stdio:"inherit"})}catch(o){Ic(o)}}showDiff(t,n,{usePager:o=!0}={}){let i=[];o||i.push("--no-pager"),i.push("diff","--word-diff=color","--no-index","--ignore-cr-at-eol",t,n);try{this.deps.execFileSync("git",i,{stdio:"inherit"})}catch(s){Ic(s)}}};r(Ar,"GitDiffer");var Ln=Ar;var Th=r(async e=>(await Ph.prompt([{type:"confirm",name:"answer",message:e,initial:!1}])).answer,"defaultConfirm");async function Rh(e,t,n={}){let{cwd:o=process.cwd(),buildApp:i=On,createPackager:s=r(C=>new Te(C),"createPackager"),extractZip:a=Rc,differ:c=new Ln,existsSync:l=r(C=>Mn.existsSync(C),"existsSync"),mkdtemp:p=r(C=>Mn.promises.mkdtemp(C),"mkdtemp"),mkdir:d=r(async(C,x)=>{await Mn.promises.mkdir(C,x)},"mkdir"),rm:u=r((C,x)=>Mn.promises.rm(C,x),"rm"),isInteractive:f=r(()=>!!(process.stdin.isTTY&&process.stdout.isTTY),"isInteractive"),confirm:h=Th,setExitCode:g=r(C=>{process.exitCode=C},"setExitCode")}=n;if(!c.isSupported())throw new m("git is required for the diff command",{hint:"Install git and ensure it is in your PATH.",shouldReport:!1});if(!l(e))throw new m(`Bundle not found: ${e}`,{hint:"Check the file path and try again.",shouldReport:!1});if(!t.skipBuild)await i(o);else{let C=Le.join(o,"dist");if(!l(C))throw new m("dist directory not found.",{hint:"Run without --skip-build to build the app first, or run `pnpm build` manually.",shouldReport:!1})}let y=await p(Le.join(kh.tmpdir(),"cognite-diff-")),S=Le.join(y,"ours.zip"),w=Le.join(y,"ours"),v=Le.join(y,"theirs");try{if(await d(w,{recursive:!0}),await d(v,{recursive:!0}),await s(Le.join(o,"dist")).createZip(S),console.log(`
+Extracting bundles...`),await a(S,w),await a(e,v),c.isIdentical(w,v)){console.log(`
 Bundles are identical`);return}console.log(`
-\u274C The local build at ${De.join(o,"dist")} differs from ${De.basename(e)}.`);let R=f();(t.showStat!==void 0?t.showStat:R&&await g("Show stat summary?"))&&c.showStat(w,C),(t.showDiff!==void 0?t.showDiff:R&&await g("Show full diff?"))&&c.showDiff(w,C,{usePager:t.pager}),y(1)}finally{await u(h,{recursive:!0,force:!0})}}r(lf,"handleDiff");function Ua(e){return e.command("diff <bundle>").description("Diff a trusted local build against an untrusted bundle zip").option("--skip-build","Skip rebuilding the app before diffing",!1).option("--no-pager","Disable the pager and print diff output directly").option("--show-stat","Show a compact stat summary when bundles differ").option("--show-diff","Show the full word diff when bundles differ").addHelpText("after",`
+\u274C The local build at ${Le.join(o,"dist")} differs from ${Le.basename(e)}.`);let x=f();(t.showStat!==void 0?t.showStat:x&&await h("Show stat summary?"))&&c.showStat(w,v),(t.showDiff!==void 0?t.showDiff:x&&await h("Show full diff?"))&&c.showDiff(w,v,{usePager:t.pager}),g(1)}finally{await u(y,{recursive:!0,force:!0})}}r(Rh,"handleDiff");function $c(e){return e.command("diff <bundle>").description("Diff a trusted local build against an untrusted bundle zip").option("--skip-build","Skip rebuilding the app before diffing",!1).option("--no-pager","Disable the pager and print diff output directly").option("--show-stat","Show a compact stat summary when bundles differ").option("--show-diff","Show the full word diff when bundles differ").addHelpText("after",`
 Builds the current source, packages it, then extracts both the local build
 and the provided bundle to temporary directories and runs:
 
@@ -197,73 +268,74 @@ Exit code 0 means the bundles are identical; exit code 1 means they differ.
 Examples:
   npx @cognite/cli apps diff untrusted.zip
   npx @cognite/cli apps diff untrusted.zip --skip-build
-  npx @cognite/cli apps diff untrusted.zip --show-stat --show-diff --no-pager`).action((t,n)=>lf(t,n))}r(Ua,"registerDiffCommand");function pf(e,t){console.log(""),console.log(`Updating metadata for '${e}':`);for(let{field:n,remote:o,local:i}of t){let s=`${n}:`.padEnd(13);console.log(`  ${s}"${o}" \u2192 "${i||"(none)"}"`)}}r(pf,"printMetadataDiff");async function df(e,t=process.cwd(),n={}){let{loadEnvFile:o=B,loadAppConfig:i=E,buildApiClient:s=_,createMetadataClient:a=r(S=>new U(S),"createMetadataClient"),getMissingCredentials:c=j,isSessionAuthEnabled:l=O}=n;o(t);let p=i(t);K(p);let d=e.interactive?await M(p,e):L(p.deployments,e.deployment);if(!e.interactive&&!l()){let S=c(d);if(S.length>0)throw new Error(`Deployment ${d.org}/${d.project} is missing ${S.join(" and ")} in app.json. Use \`cognite apps metadata update --interactive\` for browser-based authentication instead.`)}let u=await s(d,{interactive:e.interactive,appId:p.externalId,orgHint:e.org,confirmActionTarget:e.confirmActionTarget,action:"metadata update"}),f=a(u),g;try{g=await f.getApp(p.externalId)}catch(S){throw S instanceof qe?new Error(`App '${p.externalId}' is not deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):S}let y={name:p.name,description:p.description||""},h=no(g,y);if(h.length===0){console.log(""),console.log(`Metadata for '${p.externalId}' already matches the deployed app \u2014 nothing to update.`),console.log("Edit name/description in app.json to change them.");return}pf(p.externalId,h),await f.updateAppMetadata(p.externalId,p.name,p.description),console.log(""),console.log(`\u2705 Metadata for '${p.externalId}' updated`)}r(df,"handleUpdateMetadata");function _a(e,t={isSessionAuthEnabled:O}){let{isSessionAuthEnabled:n}=t,o=e.command("metadata").summary("Manage the deployed app's metadata").description("Manage the deployed app's metadata (name and description)."),i=o.command("update").description("Update the deployed app's name and description from app.json").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)");return n()&&i.option("--confirm-action-target <target>","Acknowledge the org/project this command will act on, skipping the interactive prompt (value must match the resolved target)"),i.addHelpText("after",`
+  npx @cognite/cli apps diff untrusted.zip --show-stat --show-diff --no-pager`).action((t,n)=>Rh(t,n))}r($c,"registerDiffCommand");function Ih(e,t){console.log(""),console.log(`Updating metadata for '${e}':`);for(let{field:n,remote:o,local:i}of t){let s=`${n}:`.padEnd(13);console.log(`  ${s}"${o}" \u2192 "${i||"(none)"}"`)}}r(Ih,"printMetadataDiff");async function Dh(e,t=process.cwd(),n={}){let{loadEnvFile:o=j,loadAppConfig:i=k,buildApiClient:s=_,createMetadataClient:a=r(g=>new U(g),"createMetadataClient")}=n;o(t);let c=i(t);H(c);let l=e.interactive?await L(c,e):$(c.deployments,e.deployment),p=await s(l,{interactive:e.interactive,appId:c.externalId,orgHint:e.org,authMethod:e.authMethod,confirmActionTarget:e.confirmActionTarget,action:"metadata update"}),d=a(p),u;try{u=await d.getApp(c.externalId)}catch(g){throw g instanceof Ze?new Error(`App '${c.externalId}' is not deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):g}let f={name:c.name,description:c.description||""},h=ko(u,f);if(h.length===0){console.log(""),console.log(`Metadata for '${c.externalId}' already matches the deployed app \u2014 nothing to update.`),console.log("Edit name/description in app.json to change them.");return}Ih(c.externalId,h),await d.updateAppMetadata(c.externalId,c.name,c.description),console.log(""),console.log(`\u2705 Metadata for '${c.externalId}' updated`)}r(Dh,"handleUpdateMetadata");function Oc(e){let t=e.command("metadata").summary("Manage the deployed app's metadata").description("Manage the deployed app's metadata (name and description)."),n=t.command("update").description("Update the deployed app's name and description from app.json").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)");return W().forEach(o=>n.addOption(o)),n.addHelpText("after",`
 Examples:
   npx @cognite/cli apps metadata update .                Push name/description using env-var auth
-  npx @cognite/cli apps metadata update . --interactive  Push using browser auth (no secrets needed)`).action((s,a)=>df(a)),o}r(_a,"registerMetadataCommand");async function uf(e,t,n){let o=await _(e,{interactive:t.interactive,appId:n.externalId,orgHint:t.org,confirmActionTarget:t.confirmActionTarget,action:"publish"});return new U(o)}r(uf,"defaultBuildApiClient");async function mf(e,t={}){let n=t.loadEnvFile??B,o=t.loadAppConfig??E,i=t.buildApiClient??uf,s=t.discoverSignatures??mt,a=t.isSessionAuthEnabled??O,c=process.cwd();n(c);let l=o(c);K(l);let p=e.interactive?await M(l,e):L(l.deployments,e.deployment);if(!e.interactive&&!a()){let h=j(p);if(h.length>0)throw new Error(`Deployment ${p.org}/${p.project} is missing ${h.join(" and ")} in app.json. Use \`cognite apps publish --interactive\` for browser-based authentication instead.`)}let d=await i(p,e,l),{externalId:u,versionTag:f}=l,g;try{g=await d.getVersion(u,f)}catch(h){throw h instanceof ee?new Error(`Version ${f} of ${u} has not been deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):h}if(g.alias==="ACTIVE"){console.log(`  ${u} @ ${f} is already ACTIVE \u2014 nothing to do.`);return}if(g.lifecycleState==="PUBLISHED"){console.log(`  ${u} @ ${f} is already PUBLISHED \u2014 nothing to do.`);return}if(g.lifecycleState==="DEPRECATED"||g.lifecycleState==="ARCHIVED")throw new Error(`Cannot publish ${u} @ ${f}: version is ${g.lifecycleState} (terminal).`);let y=s(oe(c,u,f));y.length>0&&await d.submitSignatures(u,f,y),await d.publishVersion(u,f),console.log(`\u2713 Published    ${u} @ ${f} is now PUBLISHED`),console.log(""),console.log("Run `npx @cognite/cli apps activate .` to make it active.")}r(mf,"handlePublish");function ja(e,t={isSessionAuthEnabled:O}){let{isSessionAuthEnabled:n}=t,o=e.command("publish").description("Publish the current app version (transition DRAFT \u2192 PUBLISHED)").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)");return n()&&o.option("--confirm-action-target <target>","Acknowledge the org/project this command will act on, skipping the interactive prompt (value must match the resolved target)"),o.addHelpText("after",`
+  npx @cognite/cli apps metadata update . --interactive  Push using browser auth (no secrets needed)`).action((o,i)=>Dh(i)),t}r(Oc,"registerMetadataCommand");async function $h(e,t,n){let o=await _(e,{interactive:t.interactive,appId:n.externalId,orgHint:t.org,authMethod:t.authMethod,confirmActionTarget:t.confirmActionTarget,action:"publish"});return new U(o)}r($h,"defaultBuildApiClient");async function Oh(e,t={}){let n=t.loadEnvFile??j,o=t.loadAppConfig??k,i=t.buildApiClient??$h,s=t.discoverSignatures??Ct,a=process.cwd();n(a);let c=o(a);H(c);let l=e.interactive?await L(c,e):$(c.deployments,e.deployment),p=await i(l,e,c),{externalId:d,versionTag:u}=c,f;try{f=await p.getVersion(d,u)}catch(g){throw g instanceof te?new Error(`Version ${u} of ${d} has not been deployed yet. Run \`npx @cognite/cli apps deploy\` first.`):g}if(f.alias==="ACTIVE"){console.log(`  ${d} @ ${u} is already ACTIVE \u2014 nothing to do.`);return}if(f.lifecycleState==="PUBLISHED"){console.log(`  ${d} @ ${u} is already PUBLISHED \u2014 nothing to do.`);return}if(f.lifecycleState==="DEPRECATED"||f.lifecycleState==="ARCHIVED")throw new Error(`Cannot publish ${d} @ ${u}: version is ${f.lifecycleState} (terminal).`);let h=s(ne(a,d,u));h.length>0&&await p.submitSignatures(d,u,h),await p.publishVersion(d,u),console.log(`\u2713 Published    ${d} @ ${u} is now PUBLISHED`),console.log(""),console.log("Run `npx @cognite/cli apps activate .` to make it active.")}r(Oh,"handlePublish");function Fc(e){let t=e.command("publish").description("Publish the current app version (transition DRAFT \u2192 PUBLISHED)").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)");return W().forEach(n=>t.addOption(n)),t.addHelpText("after",`
 Examples:
   npx @cognite/cli apps publish .                    Publish using env-var auth
-  npx @cognite/cli apps publish . --interactive      Publish using browser auth (no secrets needed)`).action((i,s)=>mf(s))}r(ja,"registerPublishCommand");import{spawnSync as gf}from"child_process";import{mkdirSync as ff}from"fs";import{join as yf,resolve as Na}from"path";var hf=["localhost","local.cognite.ai","*.local.cognite.ai"],Sf={info:r(e=>{process.stdout.write(`${e}
+  npx @cognite/cli apps publish . --interactive      Publish using browser auth (no secrets needed)`).action((n,o)=>Oh(o))}r(Fc,"registerPublishCommand");import{spawnSync as Fh}from"child_process";import{mkdirSync as Lh}from"fs";import{join as Mh,resolve as Lc}from"path";var Uh=["localhost","local.cognite.ai","*.local.cognite.ai"],Nh={info:r(e=>{process.stdout.write(`${e}
 `)},"info"),error:r(e=>{process.stderr.write(`${e}
-`)},"error")},wf={spawnSync:gf,mkdirSync:ff,logger:Sf,getConfig:F};function vf(e){let t=e("mkcert",["-help"],{stdio:"ignore"});return t.status===0||t.status===1}r(vf,"hasMkcert");function Cf({certDir:e,domains:t=hf,deps:n={}}={}){let o={...wf,...n},{spawnSync:i,mkdirSync:s,logger:a}=o,c=e??yf(o.getConfig().home,"certificates","mkcert");if(!vf(i))throw a.error("Error: mkcert is not installed."),a.error("Install it with: brew install mkcert (macOS, Linux, WSL)"),a.error("On Windows: choco install mkcert  (or scoop install mkcert)"),a.error("See https://github.com/FiloSottile/mkcert#installation for other methods."),new Error("mkcert is not installed");if(a.info("\u2139\uFE0F  Installing mkcert root CA into your local trust store."),a.info("   This allows your browser to trust locally-generated certificates."),a.info("   You may be prompted for your system password."),i("mkcert",["-install"],{stdio:"inherit"}).status!==0)throw new Error("`mkcert -install` failed");s(c,{recursive:!0});let p=Na(c,"localhost.pem"),d=Na(c,"localhost-key.pem");if(i("mkcert",["-cert-file",p,"-key-file",d,...t],{stdio:"inherit"}).status!==0)throw new Error("mkcert failed to generate certificates");return a.info(""),a.info("Certificates generated:"),a.info(`  cert: ${p}`),a.info(`  key:  ${d}`),{certFile:p,keyFile:d}}r(Cf,"setupHttps");function Af(e){Cf({certDir:e.certDir})}r(Af,"handleSetupHttps");function Ha(e){return e.command("setup-https").description("Generate trusted local HTTPS certificates via mkcert").option("--cert-dir <path>","Directory to write certs into (default: ~/.cognite-cli/certificates/mkcert)").addHelpText("after",`
+`)},"error")},_h={spawnSync:Fh,mkdirSync:Lh,logger:Nh,getConfig:D};function jh(e){let t=e("mkcert",["-help"],{stdio:"ignore"});return t.status===0||t.status===1}r(jh,"hasMkcert");function Hh({certDir:e,domains:t=Uh,deps:n={}}={}){let o={..._h,...n},{spawnSync:i,mkdirSync:s,logger:a}=o,c=e??Mh(o.getConfig().home,"certificates","mkcert");if(!jh(i))throw a.error("Error: mkcert is not installed."),a.error("Install it with: brew install mkcert (macOS, Linux, WSL)"),a.error("On Windows: choco install mkcert  (or scoop install mkcert)"),a.error("See https://github.com/FiloSottile/mkcert#installation for other methods."),new Error("mkcert is not installed");if(a.info("\u2139\uFE0F  Installing mkcert root CA into your local trust store."),a.info("   This allows your browser to trust locally-generated certificates."),a.info("   You may be prompted for your system password."),i("mkcert",["-install"],{stdio:"inherit"}).status!==0)throw new Error("`mkcert -install` failed");s(c,{recursive:!0});let p=Lc(c,"localhost.pem"),d=Lc(c,"localhost-key.pem");if(i("mkcert",["-cert-file",p,"-key-file",d,...t],{stdio:"inherit"}).status!==0)throw new Error("mkcert failed to generate certificates");return a.info(""),a.info("Certificates generated:"),a.info(`  cert: ${p}`),a.info(`  key:  ${d}`),{certFile:p,keyFile:d}}r(Hh,"setupHttps");function Bh(e){Hh({certDir:e.certDir})}r(Bh,"handleSetupHttps");function Mc(e){return e.command("setup-https").description("Generate trusted local HTTPS certificates via mkcert").option("--cert-dir <path>","Directory to write certs into (default: ~/.cognite-cli/certificates/mkcert)").addHelpText("after",`
 Examples:
   npx @cognite/cli@latest apps setup-https                     Generate certs in ~/.cognite-cli/certificates/mkcert
-  npx @cognite/cli@latest apps setup-https --cert-dir certs    Use a custom directory`).action(t=>Af(t))}r(Ha,"registerSetupHttpsCommand");import{existsSync as Hf,writeFileSync as Bf}from"fs";import{basename as Kf,dirname as Vf,join as Gf,resolve as Qo}from"path";import{parseScope as Yf,signBundle as qf,validateScopes as Jf}from"@cognite/app-sdk/codesigning";import{existsSync as _f,readFileSync as jf}from"fs";import{pbkdf2 as xf,randomBytes as kf}from"crypto";import{promisify as Pf}from"util";import{CompactEncrypt as If,base64url as Ba,compactDecrypt as Df}from"jose";var bf=new TextEncoder,Ef=new TextDecoder,zo={encode:r(e=>bf.encode(e),"encode"),decode:r(e=>Ef.decode(e),"decode")};var Tf=Pf(xf),Zo=6e5,Rf="sha512",Wo="PBKDF2-HMAC-SHA512",Xo=16,Sn="A256GCM",$f=32,wn=2e6;async function Ka(e,t,n){return await Tf(e,t,n,$f,Rf)}r(Ka,"deriveKey");async function Va(e,t,n=Zo){if(!Number.isInteger(n)||n<1||n>wn)throw new Error(`Invalid iterations: must be an integer between 1 and ${wn}`);let o=kf(Xo),i=await Ka(t.expose(),o,n);return await new If(zo.encode(e.expose())).setProtectedHeader({alg:"dir",enc:Sn,kdf:Wo,kdf_iter:n,kdf_salt:Ba.encode(o)}).encrypt(i)}r(Va,"encryptStringAsJwe");async function Ga(e,t){let{plaintext:n}=await Df(e,async o=>{if(!e.length)throw new Error("Unexpected JWE empty value");let i=t.expose();if(i.length<15)throw new Error(`Invalid passphrase: must be at least ${15} characters`);if(o.alg!=="dir")throw new Error(`Unexpected JWE alg "${String(o.alg)}"; only "dir" is supported`);if(o.enc!==Sn)throw new Error(`Unexpected JWE enc "${String(o.enc)}"; only "${Sn}" is supported`);if(o.kdf!==Wo)throw new Error(`Unexpected KDF "${String(o.kdf)}"; only "${Wo}" is supported`);let s=Number(o.kdf_iter);if(!Number.isInteger(s)||s<1||s>wn)throw new Error(`Invalid kdf_iter in JWE header: must be an integer between 1 and ${wn}`);if(typeof o.kdf_salt!="string")throw new Error("Missing kdf_salt in JWE header");let a=Ba.decode(o.kdf_salt);if(a.length!==Xo)throw new Error(`Invalid kdf_salt length in JWE header: expected ${Xo} bytes, got ${a.length}`);return await Ka(i,a,s)},{keyManagementAlgorithms:["dir"],contentEncryptionAlgorithms:[Sn]});return zo.decode(n)}r(Ga,"decryptJweAsString");function Ya(e){let t=e.trim();return t.startsWith("eyJ")&&t.split(".").length===5}r(Ya,"isJweCompact");import Of from"enquirer";async function Ff(e){return Of.prompt(e)}r(Ff,"defaultPrompt");async function qa(e,t={}){let{prompt:n=Ff}=t,{passphrase:o}=await n({type:"password",name:"passphrase",message:e});return A.from(o)}r(qa,"promptPassphrase");import Mf from"enquirer";import{statSync as Lf}from"fs";function Ja(e,t=Lf){return e.map(n=>({key:n,mtime:t(n.publicKeyPath).mtimeMs})).sort((n,o)=>o.mtime-n.mtime).map(({key:n})=>n)}r(Ja,"sortByMtime");async function Uf(e){return Mf.prompt(e)}r(Uf,"defaultPrompt");async function za(e,t={}){if(e.length===1)return e[0];let{prompt:n=Uf,sortByMtime:o=Ja}=t,i=o(e),s=i[0],{choice:a}=await n({type:"select",name:"choice",message:"Select signing identity",choices:[{name:"latest",message:`Use latest: ${s.kid}`},{name:"pick",message:"Pick from list"}]});if(a==="latest")return s;if(a==="pick"){let{kid:c}=await n({type:"select",name:"kid",message:"Select signing identity",choices:i.map(p=>({name:p.kid,message:[p.kid,p.email,on(p.source)].filter(Boolean).join("  \u2014  ")}))}),l=i.find(p=>p.kid===c);if(!l)throw new Error("No signing identity selected");return l}else throw new Error(`Unexpected choice: "${a}"`)}r(za,"promptSigningIdentity");function Nf(e){return{existsSync:e.existsSync??_f,readFileSync:e.readFileSync??((t,n)=>jf(t,n)),readKeyFromKeychain:e.readKeyFromKeychain??tn,readSigningKey:e.readSigningKey??nn,isOS:e.isOS??(t=>G(t)),decryptJweAsString:e.decryptJweAsString??Ga,discoverLocalKeys:e.discoverLocalKeys??rn,keysDir:e.keysDir??F().keysDir,promptPassphrase:e.promptPassphrase??qa,promptSigningIdentity:e.promptSigningIdentity??za}}r(Nf,"resolveDeps");async function Wa(e,t={}){let n=Nf(t);if(e.keyPath){if(!n.existsSync(e.keyPath))throw new Error(`Key file not found: ${e.keyPath}`);if(!e.kid)throw new Error("--signing-identity <kid> is required when using --key");let s=n.readFileSync(e.keyPath,"utf-8").trim();if(Ya(s)){if(!e.interactive)throw new Error(`Key at ${e.keyPath} is passphrase-encrypted. Pass --interactive to enter the passphrase.`);let a=await n.promptPassphrase(`Passphrase for key ${e.kid}: `);return{privateKeyPem:A.from(await n.decryptJweAsString(s,a)),kid:e.kid}}return{privateKeyPem:A.from(s),kid:e.kid}}let o=await n.discoverLocalKeys(n.keysDir);if(o.length===0)throw new Error("No signing keys found. Run `cognite keys generate` or pass --key.");let i;if(e.kid)i=o.find(s=>s.kid===e.kid);else if(e.interactive)i=await n.promptSigningIdentity(o);else throw new Error("--signing-identity <kid> is required. Pass --interactive to select it interactively.");if(!i)throw new Error(`No key found with kid "${e.kid}"`);switch(i.source.kind){case"keychain":{let s=n.isOS("macos")?await n.readKeyFromKeychain(i.kid):await n.readSigningKey(i.kid);if(!s)throw new Error(`Key "${i.kid}" not found in OS credential store`);return{privateKeyPem:s,kid:i.kid}}case"encrypted-file":{if(!e.interactive)throw new Error(`Key "${i.kid}" is passphrase-encrypted. Pass --interactive to enter the passphrase, or store the key in macOS Keychain for non-interactive use.`);let s=await n.promptPassphrase(`Passphrase for key ${i.kid}: `);return{privateKeyPem:A.from(await n.decryptJweAsString(n.readFileSync(i.source.path,"utf-8"),s)),kid:i.kid}}case"public-only":throw new Error(`Key "${i.kid}" has no private key on this machine (public-only).`)}}r(Wa,"resolvePrivateKey");var zf=r(async(e,t,n,o,i)=>{let s=await _(e,{interactive:i.browserAuth??!1,appId:t,orgHint:i.org});await new U(s).submitSignatures(t,n,o)},"defaultSubmitSignatures");function Wf(e){return{existsSync:e.existsSync??Hf,writeFileSync:e.writeFileSync??Bf,createBundleStream:e.createBundleStream??sn,signBundle:e.signBundle??qf,parseScope:e.parseScope??Yf,validateScopes:e.validateScopes??Jf,loadAppConfig:e.loadAppConfig??E,resolvePrivateKey:e.resolvePrivateKey??(t=>Wa(t)),submitSignatures:e.submitSignatures??zf,discoverSignatures:e.discoverSignatures??mt}}r(Wf,"resolveDeps");async function Xa(e,t,n={},o=process.cwd()){let i=Wf(n),s=t.appid,a=t.appVersion,c=[],l=i.loadAppConfig(o);if(s=s??l.externalId,a=a??l.versionTag,t.scope&&t.scope.length>0?c=t.scope.map(i.parseScope):c=l.deployments.map(C=>({org:C.org,project:C.project})),!s)throw new Error("--appid is required (or set externalId in app.json)");if(!a)throw new Error("--app-version is required (or set versionTag in app.json)");let p=e?Qo(o,e):oe(o,s,a);if(!i.existsSync(p)){let C=e?"":" (default derived from app.json \u2014 pass [bundle] explicitly to override, or run `cognite apps deploy` first to populate .cognite-bundles/)";throw new Error(`Bundle not found: ${p}${C}`)}let d=i.validateScopes(c);if(d.length>0)throw new Error(`Invalid scopes:
+  npx @cognite/cli@latest apps setup-https --cert-dir certs    Use a custom directory`).action(t=>Bh(t))}r(Mc,"registerSetupHttpsCommand");import{existsSync as ay,writeFileSync as cy}from"fs";import{basename as ly,dirname as py,join as dy,resolve as Pr}from"path";import{parseScope as uy,signBundle as my,validateScopes as gy}from"@cognite/app-sdk/codesigning";import{existsSync as ry,readFileSync as iy}from"fs";import{pbkdf2 as Gh,randomBytes as Yh}from"crypto";import{promisify as zh}from"util";import{CompactEncrypt as qh,base64url as Uc,compactDecrypt as Jh}from"jose";var Kh=new TextEncoder,Vh=new TextDecoder,Er={encode:r(e=>Kh.encode(e),"encode"),decode:r(e=>Vh.decode(e),"decode")};var Wh=zh(Gh),kr=6e5,Zh="sha512",br="PBKDF2-HMAC-SHA512",xr=16,Un="A256GCM",Xh=32,Nn=2e6;async function Nc(e,t,n){return await Wh(e,t,n,Xh,Zh)}r(Nc,"deriveKey");async function _c(e,t,n=kr){if(!Number.isInteger(n)||n<1||n>Nn)throw new Error(`Invalid iterations: must be an integer between 1 and ${Nn}`);let o=Yh(xr),i=await Nc(t.expose(),o,n);return await new qh(Er.encode(e.expose())).setProtectedHeader({alg:"dir",enc:Un,kdf:br,kdf_iter:n,kdf_salt:Uc.encode(o)}).encrypt(i)}r(_c,"encryptStringAsJwe");async function jc(e,t){let{plaintext:n}=await Jh(e,async o=>{if(!e.length)throw new Error("Unexpected JWE empty value");let i=t.expose();if(i.length<15)throw new Error(`Invalid passphrase: must be at least ${15} characters`);if(o.alg!=="dir")throw new Error(`Unexpected JWE alg "${String(o.alg)}"; only "dir" is supported`);if(o.enc!==Un)throw new Error(`Unexpected JWE enc "${String(o.enc)}"; only "${Un}" is supported`);if(o.kdf!==br)throw new Error(`Unexpected KDF "${String(o.kdf)}"; only "${br}" is supported`);let s=Number(o.kdf_iter);if(!Number.isInteger(s)||s<1||s>Nn)throw new Error(`Invalid kdf_iter in JWE header: must be an integer between 1 and ${Nn}`);if(typeof o.kdf_salt!="string")throw new Error("Missing kdf_salt in JWE header");let a=Uc.decode(o.kdf_salt);if(a.length!==xr)throw new Error(`Invalid kdf_salt length in JWE header: expected ${xr} bytes, got ${a.length}`);return await Nc(i,a,s)},{keyManagementAlgorithms:["dir"],contentEncryptionAlgorithms:[Un]});return Er.decode(n)}r(jc,"decryptJweAsString");function Hc(e){let t=e.trim();return t.startsWith("eyJ")&&t.split(".").length===5}r(Hc,"isJweCompact");import Qh from"enquirer";async function ey(e){return Qh.prompt(e)}r(ey,"defaultPrompt");async function Bc(e,t={}){let{prompt:n=ey}=t,{passphrase:o}=await n({type:"password",name:"passphrase",message:e});return b.from(o)}r(Bc,"promptPassphrase");import ny from"enquirer";import{statSync as ty}from"fs";function Kc(e,t=ty){return e.map(n=>({key:n,mtime:t(n.publicKeyPath).mtimeMs})).sort((n,o)=>o.mtime-n.mtime).map(({key:n})=>n)}r(Kc,"sortByMtime");async function oy(e){return ny.prompt(e)}r(oy,"defaultPrompt");async function Vc(e,t={}){if(e.length===1)return e[0];let{prompt:n=oy,sortByMtime:o=Kc}=t,i=o(e),s=i[0],{choice:a}=await n({type:"select",name:"choice",message:"Select signing identity",choices:[{name:"latest",message:`Use latest: ${s.kid}`},{name:"pick",message:"Pick from list"}]});if(a==="latest")return s;if(a==="pick"){let{kid:c}=await n({type:"select",name:"kid",message:"Select signing identity",choices:i.map(p=>({name:p.kid,message:[p.kid,p.email,En(p.source)].filter(Boolean).join("  \u2014  ")}))}),l=i.find(p=>p.kid===c);if(!l)throw new Error("No signing identity selected");return l}else throw new Error(`Unexpected choice: "${a}"`)}r(Vc,"promptSigningIdentity");function sy(e){return{existsSync:e.existsSync??ry,readFileSync:e.readFileSync??((t,n)=>iy(t,n)),readKeyFromKeychain:e.readKeyFromKeychain??Cn,readSigningKey:e.readSigningKey??An,isOS:e.isOS??(t=>X(t)),decryptJweAsString:e.decryptJweAsString??jc,discoverLocalKeys:e.discoverLocalKeys??bn,keysDir:e.keysDir??D().keysDir,promptPassphrase:e.promptPassphrase??Bc,promptSigningIdentity:e.promptSigningIdentity??Vc}}r(sy,"resolveDeps");async function Gc(e,t={}){let n=sy(t);if(e.keyPath){if(!n.existsSync(e.keyPath))throw new Error(`Key file not found: ${e.keyPath}`);if(!e.kid)throw new Error("--signing-identity <kid> is required when using --key");let s=n.readFileSync(e.keyPath,"utf-8").trim();if(Hc(s)){if(!e.interactive)throw new Error(`Key at ${e.keyPath} is passphrase-encrypted. Pass --interactive to enter the passphrase.`);let a=await n.promptPassphrase(`Passphrase for key ${e.kid}: `);return{privateKeyPem:b.from(await n.decryptJweAsString(s,a)),kid:e.kid}}return{privateKeyPem:b.from(s),kid:e.kid}}let o=await n.discoverLocalKeys(n.keysDir);if(o.length===0)throw new Error("No signing keys found. Run `cognite keys generate` or pass --key.");let i;if(e.kid)i=o.find(s=>s.kid===e.kid);else if(e.interactive)i=await n.promptSigningIdentity(o);else throw new Error("--signing-identity <kid> is required. Pass --interactive to select it interactively.");if(!i)throw new Error(`No key found with kid "${e.kid}"`);switch(i.source.kind){case"keychain":{let s=n.isOS("macos")?await n.readKeyFromKeychain(i.kid):await n.readSigningKey(i.kid);if(!s)throw new Error(`Key "${i.kid}" not found in OS credential store`);return{privateKeyPem:s,kid:i.kid}}case"encrypted-file":{if(!e.interactive)throw new Error(`Key "${i.kid}" is passphrase-encrypted. Pass --interactive to enter the passphrase, or store the key in macOS Keychain for non-interactive use.`);let s=await n.promptPassphrase(`Passphrase for key ${i.kid}: `);return{privateKeyPem:b.from(await n.decryptJweAsString(n.readFileSync(i.source.path,"utf-8"),s)),kid:i.kid}}case"public-only":throw new Error(`Key "${i.kid}" has no private key on this machine (public-only).`)}}r(Gc,"resolvePrivateKey");var fy=r(async(e,t,n,o,i)=>{let s=await _(e,{interactive:i.browserAuth??!1,appId:t,orgHint:i.org,authMethod:i.authMethod,confirmActionTarget:i.confirmActionTarget,action:"sign"});await new U(s).submitSignatures(t,n,o)},"defaultSubmitSignatures");function hy(e){return{existsSync:e.existsSync??ay,writeFileSync:e.writeFileSync??cy,createBundleStream:e.createBundleStream??xn,signBundle:e.signBundle??my,parseScope:e.parseScope??uy,validateScopes:e.validateScopes??gy,loadAppConfig:e.loadAppConfig??k,resolvePrivateKey:e.resolvePrivateKey??(t=>Gc(t)),submitSignatures:e.submitSignatures??fy,discoverSignatures:e.discoverSignatures??Ct}}r(hy,"resolveDeps");async function Yc(e,t,n={},o=process.cwd()){let i=hy(n),s=t.appid,a=t.appVersion,c=[],l=i.loadAppConfig(o);if(s=s??l.externalId,a=a??l.versionTag,t.scope&&t.scope.length>0?c=t.scope.map(i.parseScope):c=l.deployments.map(v=>({org:v.org,project:v.project})),!s)throw new Error("--appid is required (or set externalId in app.json)");if(!a)throw new Error("--app-version is required (or set versionTag in app.json)");let p=e?Pr(o,e):ne(o,s,a);if(!i.existsSync(p)){let v=e?"":" (default derived from app.json \u2014 pass [bundle] explicitly to override, or run `cognite apps deploy` first to populate .cognite-bundles/)";throw new Error(`Bundle not found: ${p}${v}`)}let d=i.validateScopes(c);if(d.length>0)throw new Error(`Invalid scopes:
   ${d.join(`
-  `)}`);let{privateKeyPem:u,kid:f}=await i.resolvePrivateKey({keyPath:t.key?Qo(o,t.key):void 0,kid:t.signingIdentity,interactive:t.interactive}),g=i.createBundleStream(p),y=await i.signBundle({privateKeyPem:u.expose(),kid:f,appId:s,version:a,bundleStream:g,role:t.asCertifier?"certifier":"developer",scopes:c}),h=t.output?Qo(o,t.output):Gf(Vf(p),`${Kf(p)}.${t.asCertifier?"cert":"dev"}.sig`);i.writeFileSync(h,y.token,"utf-8"),console.log(`\u2705 Signed: ${h}`),console.log(`   kid:    ${y.kid}`),console.log(`   bundle: ${y.payload.bundleSha256}`),console.log(`   scopes: ${y.payload.scopes.map(C=>`${C.org}/${C.project}`).join(", ")}`),t.verbose&&console.log(`
-Payload:`,JSON.stringify(y.payload,null,2));let S=Array.from(new Set([...i.discoverSignatures(p),y.token])),w=t.interactive?await M(l,{deployment:t.deployment,baseUrl:t.baseUrl,project:t.project,org:t.org}):L(l.deployments,t.deployment);if(!t.browserAuth){let C=j(w);if(C.length>0)throw new Error(`Deployment ${w.org}/${w.project} is missing ${C.join(" and ")} in app.json. Pass --browser-auth to authenticate via browser instead.`)}await i.submitSignatures(w,s,a,S,t),console.log(`
-To publish:  npx @cognite/cli apps publish .`)}r(Xa,"handleSign");function Za(e,t={}){return e.command("sign [bundle]").description("Sign an app bundle (defaults to .cognite-bundles/<app>-<version>.zip)").option("--key <path>","Private key PEM file path").option("-s, --signing-identity <kid>","Key ID for Keychain or file lookup").option("--appid <id>","Application ID (default: externalId from app.json)").option("-i, --identifier <id>","Alias for --appid").option("--app-version <version>","App version (default: versionTag from app.json)").option("--scope <org/project...>","Deployment scope(s) (default: deployments from app.json)").option("-r, --requirements <org/project...>","Alias for --scope").option("-o, --output <path>","Output file path (default: <bundle>.<dev|cert>.sig)").option("-v, --verbose","Display full payload after signing").option("--as-certifier","Counter-sign a developer signature as certifier").option("--interactive","Enable interactive prompts (key selection, passphrase, deployment target selection)",!1).option("--browser-auth","Use browser-based PKCE auth when submitting the signature",!1).option("-d, --deployment <target>","Deployment target from app.json (index or name; submit step only)").option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive or --browser-auth)").action((n,o)=>{let i={...o,appid:o.identifier??o.appid,scope:o.requirements??o.scope};return Xa(n,i,t)})}r(Za,"registerSignCommand");function Xf(e){return e.alias==="ACTIVE"?"ACTIVE":e.lifecycleState}r(Xf,"describeStatus");function Zf(e){if(e.length===0)return["Signatures: none stored"];let t=["Signatures:"];for(let n of e){let o=n.status==="VALID"?"\u2705":"\u274C",i=new Date(n.signatureIat).toISOString();t.push(`  ${o} ${n.signerKid}  (${n.signerRole}, signed ${i}) \u2014 ${n.status}`)}return t}r(Zf,"formatSignatures");async function Qf(e){let t=process.cwd();B(t);let n=E(t);K(n);let o=e.interactive?await M(n,e):L(n.deployments,e.deployment);if(!e.interactive){let a=j(o);if(a.length>0)throw new Error(`Deployment ${o.org}/${o.project} is missing ${a.join(" and ")} in app.json. Use \`cognite apps status --interactive\` for browser-based authentication instead.`)}let i=await _(o,{interactive:e.interactive,appId:n.externalId,orgHint:e.org}),s=new U(i);console.log(""),console.log(`App:     ${n.name} (${n.externalId})`),console.log(`Version: ${n.versionTag}  (local)`);try{let a=await s.getVersion(n.externalId,n.versionTag);console.log(`Status:  ${Xf(a)}`);let c=await ey(s,n.externalId,n.versionTag);if(console.log(""),c==="endpoint-unavailable")console.log("Signatures: backend endpoint not available on this cluster yet");else for(let l of Zf(c))console.log(l);a.lifecycleState==="DRAFT"&&(console.log(""),console.log("Run `npx @cognite/cli apps publish .` to publish this version."))}catch(a){if(a instanceof ee){console.log("Status:  not deployed yet"),console.log(""),console.log("Run `npx @cognite/cli apps deploy` to upload this version.");return}throw a}}r(Qf,"handleStatus");async function ey(e,t,n){try{return await e.listSignatures(t,n)}catch(o){if(le(o)&&o.status===404||o instanceof Error&&/status code: 404/.test(o.message))return"endpoint-unavailable";throw o}}r(ey,"fetchSignatures");function Qa(e){return e.command("status").description("Show the deployment status and signatures of the current app version").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addHelpText("after",`
+  `)}`);let{privateKeyPem:u,kid:f}=await i.resolvePrivateKey({keyPath:t.key?Pr(o,t.key):void 0,kid:t.signingIdentity,interactive:t.interactive}),h=i.createBundleStream(p),g=await i.signBundle({privateKeyPem:u.expose(),kid:f,appId:s,version:a,bundleStream:h,role:t.asCertifier?"certifier":"developer",scopes:c}),y=t.output?Pr(o,t.output):dy(py(p),`${ly(p)}.${t.asCertifier?"cert":"dev"}.sig`);i.writeFileSync(y,g.token,"utf-8"),console.log(`\u2705 Signed: ${y}`),console.log(`   kid:    ${g.kid}`),console.log(`   bundle: ${g.payload.bundleSha256}`),console.log(`   scopes: ${g.payload.scopes.map(v=>`${v.org}/${v.project}`).join(", ")}`),t.verbose&&console.log(`
+Payload:`,JSON.stringify(g.payload,null,2));let S=Array.from(new Set([...i.discoverSignatures(p),g.token])),w=t.interactive?await L(l,{deployment:t.deployment,baseUrl:t.baseUrl,project:t.project,org:t.org}):$(l.deployments,t.deployment);await i.submitSignatures(w,s,a,S,t),console.log(`
+To publish:  npx @cognite/cli apps publish .`)}r(Yc,"handleSign");function zc(e,t={}){let n=e.command("sign [bundle]").description("Sign an app bundle (defaults to .cognite-bundles/<app>-<version>.zip)").option("--key <path>","Private key PEM file path").option("-s, --signing-identity <kid>","Key ID for Keychain or file lookup").option("--appid <id>","Application ID (default: externalId from app.json)").option("-i, --identifier <id>","Alias for --appid").option("--app-version <version>","App version (default: versionTag from app.json)").option("--scope <org/project...>","Deployment scope(s) (default: deployments from app.json)").option("-r, --requirements <org/project...>","Alias for --scope").option("-o, --output <path>","Output file path (default: <bundle>.<dev|cert>.sig)").option("-v, --verbose","Display full payload after signing").option("--as-certifier","Counter-sign a developer signature as certifier").option("--interactive","Enable interactive prompts (key selection, passphrase, deployment target selection)",!1).option("--browser-auth","Use browser-based PKCE auth when submitting the signature",!1).option("-d, --deployment <target>","Deployment target from app.json (index or name; submit step only)").option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive or --browser-auth)");return W().forEach(o=>n.addOption(o)),n.action((o,i)=>{let s={...i,appid:i.identifier??i.appid,scope:i.requirements??i.scope};return Yc(o,s,t)})}r(zc,"registerSignCommand");function yy(e){return e.alias==="ACTIVE"?"ACTIVE":e.lifecycleState}r(yy,"describeStatus");function Sy(e){if(e.length===0)return["Signatures: none stored"];let t=["Signatures:"];for(let n of e){let o=n.status==="VALID"?"\u2705":"\u274C",i=new Date(n.signatureIat).toISOString();t.push(`  ${o} ${n.signerKid}  (${n.signerRole}, signed ${i}) \u2014 ${n.status}`)}return t}r(Sy,"formatSignatures");async function wy(e,t,n){let o=await _(e,{interactive:t.interactive,appId:n,orgHint:t.org,authMethod:t.authMethod});return new U(o)}r(wy,"defaultBuildApiClient");async function vy(e,t={}){let{loadEnvFile:n=j,loadAppConfig:o=k,getApiClient:i=wy}=t,s=process.cwd();n(s);let a=o(s);H(a);let c=e.interactive?await L(a,e):$(a.deployments,e.deployment),l=await i(c,e,a.externalId);console.log(""),console.log(`App:     ${a.name} (${a.externalId})`),console.log(`Version: ${a.versionTag}  (local)`);try{let p=await l.getVersion(a.externalId,a.versionTag);console.log(`Status:  ${yy(p)}`);let d=await Cy(l,a.externalId,a.versionTag);if(console.log(""),d==="endpoint-unavailable")console.log("Signatures: backend endpoint not available on this cluster yet");else for(let u of Sy(d))console.log(u);p.lifecycleState==="DRAFT"&&(console.log(""),console.log("Run `npx @cognite/cli apps publish .` to publish this version."))}catch(p){if(p instanceof te){console.log("Status:  not deployed yet"),console.log(""),console.log("Run `npx @cognite/cli apps deploy` to upload this version.");return}throw p}}r(vy,"handleStatus");async function Cy(e,t,n){try{return await e.listSignatures(t,n)}catch(o){if(se(o)&&o.status===404||o instanceof Error&&/status code: 404/.test(o.message))return"endpoint-unavailable";throw o}}r(Cy,"fetchSignatures");function qc(e){return e.command("status").description("Show the deployment status and signatures of the current app version").argument("[path]","Path to the app folder (only `.` is currently supported)",".").option("-d, --deployment <target>","Deployment target from app.json (index or name)").option("--interactive","Use browser-based authentication instead of env-var credentials",!1).option("--base-url <url>","CDF base URL (only with --interactive)").option("--project <project>","CDF project name (only with --interactive)").option("--org <org>","Organization hint for login (only with --interactive)").addOption(lr()).addHelpText("after",`
 Examples:
   npx @cognite/cli apps status .                     Status using env-var auth
-  npx @cognite/cli apps status . --interactive       Status using browser auth (no secrets needed)`).action((t,n)=>Qf(n))}r(Qa,"registerStatusCommand");import{execFileSync as nr}from"child_process";import tr from"fs";import yt from"path";import ry from"readline";var ec="https://cognite.zendesk.com",ty="360001234312",ny="tf_360015295097",oy="cognite_flows_certifications";function tc(e,t,n){let o=new URLSearchParams({ticket_form_id:ty,tf_priority:"normal",tf_subject:e,[ny]:oy,tf_description:t});return`${n}/hc/en-us/requests/new?${o}`}r(tc,"buildUrl");function nc(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;")}r(nc,"escapeHtml");function er(e){return e.map(nc).join("<br>")}r(er,"toHtml");function oc(e,t=ec){let{appName:n,externalId:o,versionTag:i,archiveName:s,developerName:a,cdfProject:c,cdfCluster:l}=e,p=["Dear Cognite Platform Team,","","I would like to submit my Flows app for review and certification.","",`App name: ${n}`,`App external ID: ${o}`,`Version: ${i}`,c?`CDF project: ${c}`:void 0,l?`CDF cluster: ${l}`:void 0,"","`npx @cognite/cli apps submit` verified App-Brief.md,","code-review-report.md, and design-review-report.md are committed to git.","","Attached (all from dist/submit/):",`[ ] ${s??"src-<sha>.zip"} \u2014 source archive`,`[ ] ${o}-${i}.zip \u2014 deploy bundle`,"[ ] Screen recording of the application (required for design review)","","Best regards,",a??"[Your name]"];return tc(`App Review Request: ${n}`,er(p.filter(d=>d!==void 0)),t)}r(oc,"buildAppReviewUrl");function rc(e,t,n,o,i=ec){let s=er(["Dear Cognite Platform Team,","","I would like to register my Flows app signing key for certified deployments.","",`Key ID (kid): ${e}`,`Developer email: ${t}`,`Expires: ${n}`,"","Please add the following entry to public_keys.yaml:"]),a=`<pre>${nc(o.replace(/\r\n/g,`
-`))}</pre>`,c=er(["","Best Regards,","[Your name]","","(This registration request was generated by `npx @cognite/cli keys generate`.)"]);return tc(`Public Key Registration: ${t}`,`${s}<br>${a}${c}`,i)}r(rc,"buildKeyRegistrationUrl");function iy(){return new Promise(e=>{let t=ry.createInterface({input:process.stdin,output:process.stdout});t.question(`
-Press Enter to open the Zendesk form in your browser and reveal dist/submit/ in your file manager...`,()=>{t.close(),e()})})}r(iy,"defaultPressEnter");var sy=[{pattern:"App-Brief.md",label:"App-Brief.md",skill:"flows-app-brief"},{pattern:"reviews/code-review/*/code-review-report.md",label:"reviews/code-review/feedback-round-<N>/code-review-report.md",skill:"flows-code-review"},{pattern:"reviews/design-review/*/design-review-report.md",label:"reviews/design-review/feedback-round-<N>/design-review-report.md",skill:"flows-design-review"}];function ay(e){let t=sy.filter(({pattern:n})=>nr("git",["-C",e,"ls-files","--",n],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().length===0);if(t.length>0){let n=t.map(({label:o,skill:i})=>`  ${o}  \u2192  /${i}`);throw new Error(`Certification files are missing or not committed. Run the required skills in Claude Code first:
+  npx @cognite/cli apps status . --interactive       Status using browser auth (no secrets needed)`).action((n,o)=>vy(o))}r(qc,"registerStatusCommand");import{execFileSync as Ir}from"child_process";import Rr from"fs";import Et from"path";import xy from"readline";var Jc="https://cognite.zendesk.com",Ay="360001234312",Ey="tf_360015295097",by="cognite_flows_certifications";function Wc(e,t,n){let o=new URLSearchParams({ticket_form_id:Ay,tf_priority:"normal",tf_subject:e,[Ey]:by,tf_description:t});return`${n}/hc/en-us/requests/new?${o}`}r(Wc,"buildUrl");function Zc(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;")}r(Zc,"escapeHtml");function Tr(e){return e.map(Zc).join("<br>")}r(Tr,"toHtml");function Xc(e,t=Jc){let{appName:n,externalId:o,versionTag:i,archiveName:s,developerName:a,cdfProject:c,cdfCluster:l}=e,p=["Dear Cognite Platform Team,","","I would like to submit my Flows app for review and certification.","",`App name: ${n}`,`App external ID: ${o}`,`Version: ${i}`,c?`CDF project: ${c}`:void 0,l?`CDF cluster: ${l}`:void 0,"","`npx @cognite/cli apps submit` verified App-Brief.md,","code-review-report.md, and design-review-report.md are committed to git.","","Attached (all from dist/submit/):",`[ ] ${s??"src-<sha>.zip"} \u2014 source archive`,`[ ] ${o}-${i}.zip \u2014 deploy bundle`,"[ ] Screen recording of the application (required for design review)","","Best regards,",a??"[Your name]"];return Wc(`App Review Request: ${n}`,Tr(p.filter(d=>d!==void 0)),t)}r(Xc,"buildAppReviewUrl");function Qc(e,t,n,o,i=Jc){let s=Tr(["Dear Cognite Platform Team,","","I would like to register my Flows app signing key for certified deployments.","",`Key ID (kid): ${e}`,`Developer email: ${t}`,`Expires: ${n}`,"","Please add the following entry to public_keys.yaml:"]),a=`<pre>${Zc(o.replace(/\r\n/g,`
+`))}</pre>`,c=Tr(["","Best Regards,","[Your name]","","(This registration request was generated by `npx @cognite/cli keys generate`.)"]);return Wc(`Public Key Registration: ${t}`,`${s}<br>${a}${c}`,i)}r(Qc,"buildKeyRegistrationUrl");function ky(){return new Promise(e=>{let t=xy.createInterface({input:process.stdin,output:process.stdout});t.question(`
+Press Enter to open the Zendesk form in your browser and reveal dist/submit/ in your file manager...`,()=>{t.close(),e()})})}r(ky,"defaultPressEnter");var Py=[{pattern:"App-Brief.md",label:"App-Brief.md",skill:"flows-app-brief"},{pattern:"reviews/code-review/*/code-review-report.md",label:"reviews/code-review/feedback-round-<N>/code-review-report.md",skill:"flows-code-review"},{pattern:"reviews/design-review/*/design-review-report.md",label:"reviews/design-review/feedback-round-<N>/design-review-report.md",skill:"flows-design-review"}];function Ty(e){let t=Py.filter(({pattern:n})=>Ir("git",["-C",e,"ls-files","--",n],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().length===0);if(t.length>0){let n=t.map(({label:o,skill:i})=>`  ${o}  \u2192  /${i}`);throw new Error(`Certification files are missing or not committed. Run the required skills in Claude Code first:
 
 `+n.join(`
-`)+"\n\nAfter running the skills, commit the generated files and re-run `apps submit`.")}}r(ay,"assertArtifactsCommitted");async function cy(e=process.cwd(),t={}){let{openInBrowser:n=Ot,revealInFileManager:o=Yr,pressEnter:i=iy,isInteractive:s=r(()=>process.stdout.isTTY===!0,"isInteractive")}=t;if(me(),!Zt(e))throw new Error("Not a git repository. Run this command from your app's root directory.");B(e);let a=E(e);K(a),ay(e);let c=yt.join(e,"dist","submit");tr.mkdirSync(c,{recursive:!0});let l=nr("git",["-C",e,"rev-parse","--short","HEAD"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim();if(nr("git",["-C",e,"status","--porcelain"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().length>0)throw new Error(`Working tree has uncommitted changes. Commit or stash them before submitting for certification.
+`)+"\n\nAfter running the skills, commit the generated files and re-run `apps submit`.")}}r(Ty,"assertArtifactsCommitted");var Ry="\u2197 Launched your browser \u2014 look for a new tab with the Zendesk form.";async function Iy(e=process.cwd(),t={}){let{openInBrowser:n=fn,revealInFileManager:o=ma,pressEnter:i=ky,isInteractive:s=r(()=>process.stdout.isTTY===!0,"isInteractive")}=t;if(Ae(),!wn(e))throw new Error("Not a git repository. Run this command from your app's root directory.");j(e);let a=k(e);H(a),Ty(e);let c=Et.join(e,"dist","submit");Rr.mkdirSync(c,{recursive:!0});let l=Ir("git",["-C",e,"rev-parse","--short","HEAD"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim();if(Ir("git",["-C",e,"status","--porcelain"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().length>0)throw new Error(`Working tree has uncommitted changes. Commit or stash them before submitting for certification.
 
-The source archive must exactly match the committed code so reviewers can verify what they receive.`);let d=`src-${l}.zip`,u=yt.join(c,d);await new Ae(yt.join(e,"dist")).createSourceArchive(u);let g=`${a.externalId}-${a.versionTag}.zip`,y=yt.join(e,".cognite-bundles",g),h=!1;tr.existsSync(y)&&(tr.copyFileSync(y,yt.join(c,g)),h=!0);let S=oc({appName:a.name,externalId:a.externalId,versionTag:a.versionTag,archiveName:d,developerName:Ts(),cdfProject:a.deployments[0].project,cdfCluster:a.deployments[0].baseUrl});console.log(`
-\u2705 Certification package ready: dist/submit/`),console.log(`   ${d} \u2014 source archive (commit ${l})`),console.log(h?`   ${g} \u2014 deploy bundle`:"   \u26A0 Deploy bundle missing \u2014 run `apps deploy` to generate it, then re-run submit"),console.log("   \u2190 add your screen recording to this folder"),console.log(`
-Attach all files from dist/submit/ to the Zendesk ticket.`),console.log(`
-\u{1F517} ${S}`),s()&&(await i(),n(S),o(u))}r(cy,"handleSubmit");function ic(e){return e.command("submit").description("Package source and open a pre-filled Zendesk form for app certification submission").addHelpText("after",`
+The source archive must exactly match the committed code so reviewers can verify what they receive.`);let d=`src-${l}.zip`,u=Et.join(c,d);await new Te(Et.join(e,"dist")).createSourceArchive(u);let h=`${a.externalId}-${a.versionTag}.zip`,g=Et.join(e,".cognite-bundles",h),y=!1;Rr.existsSync(g)&&(Rr.copyFileSync(g,Et.join(c,h)),y=!0);let S=Xc({appName:a.name,externalId:a.externalId,versionTag:a.versionTag,archiveName:d,developerName:Aa(),cdfProject:a.deployments[0].project,cdfCluster:a.deployments[0].baseUrl});if(console.log(`
+\u2705 Certification package ready: dist/submit/`),console.log(`   ${d} \u2014 source archive (commit ${l})`),console.log(y?`   ${h} \u2014 deploy bundle`:"   \u26A0 Deploy bundle missing \u2014 run `apps deploy` to generate it, then re-run submit"),console.log("   \u2190 add your screen recording to this folder"),console.log(`
+Attach all files from dist/submit/ to the Zendesk ticket.`),s()){await i();let w=n(S);o(u),w&&(console.log(`
+${Ry}`),console.log("   If nothing opened, submit here:"),console.log(`   \u{1F517} ${S}`))}else console.log(`
+\u{1F517} ${S}`)}r(Iy,"handleSubmit");function el(e){return e.command("submit").description("Package source and open a pre-filled Zendesk form for app certification submission").addHelpText("after",`
 Examples:
-  npx @cognite/cli apps submit          Package source, open browser + file manager`).action(()=>cy())}r(ic,"registerSubmitCommand");function sc(e){let t=e.command("apps").description("Manage Fusion Custom Apps \u2014 create, deploy, and manage version lifecycle");return Pa(t),$a(t),Ua(t),Qa(t),_a(t),ja(t),la(t),Ia(t),Da(t),Ha(t),ic(t),Ea(t),Za(t),ca(t),t}r(sc,"registerAppsCommand");import or from"enquirer";function ly(e){return{loadAppConfig:e.loadAppConfig??E,cwd:e.cwd??(()=>process.cwd()),loginForSession:e.loginForSession??(t=>ti(t)),writeSession:e.writeSession??(t=>Tt(t)),readSessionMetadata:e.readSessionMetadata??(()=>Se()),clearSession:e.clearSession??(()=>Rt()),promptSelectOrg:e.promptSelectOrg??py,promptOrg:e.promptOrg??dy,promptConfirm:e.promptConfirm??uy,logger:e.logger??console,platform:e.platform??process.platform}}r(ly,"resolveDeps");async function py(e){let{selected:t}=await or.prompt({type:"select",name:"selected",message:"Select the organization to sign in to",choices:e});return t}r(py,"defaultPromptSelectOrg");async function dy(){let{org:e}=await or.prompt({type:"input",name:"org",message:"Enter your organization name",validate:r(t=>t.trim().length>0?!0:"Organization name is required","validate")});return e.trim()}r(dy,"defaultPromptOrg");async function uy(e){let{confirmed:t}=await or.prompt({type:"confirm",name:"confirmed",message:e,initial:!1});return t}r(uy,"defaultPromptConfirm");async function my(e,t){let{logger:n,promptSelectOrg:o,promptOrg:i}=t;if(e.org)return e.org;let s=gy(t);if(s){let a=[...new Set(s.deployments.map(c=>c.org))];return a.length===1?(n.log(`Resolved organization from app.json: ${a[0]}`),a[0]):o(a)}return i()}r(my,"resolveOrg");function gy(e){let{loadAppConfig:t,cwd:n}=e;try{return t(n())}catch(o){let i=o instanceof Error?o.message:String(o);if(/No app\.json found/.test(i))return null;throw o}}r(gy,"tryLoadAppConfig");function fy(e){switch(e){case"darwin":return"macOS Keychain";case"win32":return"Windows Credential Manager";default:return"Secret Service (libsecret / KWallet)"}}r(fy,"keyringBackendLabel");function yy(e){let t=e,n=new Set;for(;t!=null&&!n.has(t)&&(n.add(t),typeof t=="object");){if("code"in t&&t.code==="ERR_DLOPEN_FAILED")return!0;let o="message"in t&&typeof t.message=="string"?t.message:null;if(o&&/cannot find native binding/i.test(o))return!0;t="cause"in t?t.cause:void 0}return!1}r(yy,"isNativeModuleLoadError");async function hy(e,t){let{logger:n,loginForSession:o,writeSession:i,readSessionMetadata:s,clearSession:a,promptConfirm:c,platform:l}=t,p=s();if(p){if(!e.force&&Fe(p)!=="EXPIRED"&&!await c(`A session for organization "${p.org}" already exists. Replace it?`)){n.error("Aborted.");return}await a()}let d=await my(e,t),u=await o({org:d});try{await i(u)}catch(g){if(yy(g)){let y=l==="win32"?"Install the Microsoft Visual C++ Redistributable from https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist and restart your terminal, then run `cognite auth login` again.":"Ensure the required system libraries are installed for your platform, then run `cognite auth login` again.";throw new m("The keyring native module could not be loaded \u2014 tokens were not persisted.",{hint:y,cause:g})}throw new m("Login succeeded but tokens could not be saved to the credential store.",{hint:`Ensure a credential store (${fy(l)}) is available and unlocked, then run \`cognite auth login\` again.`,cause:g})}let f=P(process.stdout);n.log(""),n.log(`${f.green("\u2713")} Signed in to organization ${u.org}`)}r(hy,"handleLogin");function Sy(e){return e.commands.find(t=>t.name()==="auth")??e.command("auth").description("Manage your persisted CDF login session")}r(Sy,"getOrCreateAuthGroup");function ac(e,t={}){let n=ly(t);Sy(e).command("login").description("Sign in via the browser and persist a refreshable session").option("--org <org>","Organization to sign in to (resolved from app.json or prompted when omitted)").option("--force","Replace an existing session without prompting").action(i=>hy(i,n))}r(ac,"registerAuthLoginCommand");function wy(e){return{readSession:e.readSession??(()=>it()),readSessionMetadata:e.readSessionMetadata??(()=>Se()),clearSession:e.clearSession??(()=>Rt()),revokeRefreshToken:e.revokeRefreshToken??(t=>ni(t)),logger:e.logger??console}}r(wy,"resolveDeps");async function vy(e){let{readSessionMetadata:t,readSession:n,clearSession:o,revokeRefreshToken:i,logger:s}=e,a=null;try{a=t()}catch{await o(),s.log("Cleared corrupt session.");return}if(!a){s.log("No active session.");return}let c;try{c=(await n())?.refreshToken}catch{}if(await o(),c)try{await i(c)}catch{s.error("Logged out locally, but revoking the token at the identity provider failed. It may remain valid until it expires naturally."),s.log("Logged out.");return}s.log("Logged out.")}r(vy,"handleLogout");function Cy(e){return e.commands.find(t=>t.name()==="auth")??e.command("auth").description("Manage your persisted CDF login session")}r(Cy,"getOrCreateAuthGroup");function cc(e,t={}){let n=wy(t);Cy(e).command("logout").description("Revoke and remove the persisted session").action(()=>vy(n))}r(cc,"registerAuthLogoutCommand");var Ay="auth.cognite.com";function by(e){return{ensureFreshSession:e.ensureFreshSession??Ye,fetchUserInfo:e.fetchUserInfo??(t=>Mt(t)),logger:e.logger??console}}r(by,"resolveDeps");function Ey(e){return e.email??e.preferredUsername??e.name??e.sub}r(Ey,"describeUser");var xy="(unknown cluster)";function ky(e,t){if(e.length===0)return["  - Projects:      (none)"];let n=new Map;for(let i of e){let s=i.cluster??xy,a=n.get(s);a?a.push(i):n.set(s,[i])}let o=[`  - Projects (${e.length}):`];for(let[i,s]of n){o.push(`      ${t.dim(i)}`);for(let a of s){let c=a.isDefault?` ${t.green("[default]")}`:"";o.push(`        ${a.name}${c}`)}}return o}r(ky,"formatProjects");function Py(){switch(process.platform){case"darwin":return"macOS Keychain";case"win32":return"Windows Credential Manager";default:return"Secret Service (libsecret / KWallet)"}}r(Py,"keyringBackendLabel");async function Iy(e){let{ensureFreshSession:t,fetchUserInfo:n,logger:o}=e,i;try{i=await t()}catch(s){if(s instanceof Le){o.error("  Session expired. Run `npx @cognite/cli auth login` to sign in again."),process.exitCode=1;return}throw s}if(!i){o.error("Not signed in. Run `npx @cognite/cli auth login` to start a session."),process.exitCode=1;return}o.log(i.org);try{let s=await n(i),a=P(process.stdout);o.log(`  ${a.green("\u2713")} Signed in as ${Ey(s)}`);for(let c of ky(s.projects,a))o.log(c);o.log(`  - Token storage: ${Py()}`)}catch(s){if(s instanceof Ge&&s.kind==="unreachable")o.error(`  \u2717 Couldn't reach Cognite (${Ay}): ${s.message}`),o.error("    Check your network connection, or run `npx @cognite/cli auth login` to sign in again.");else{let a=s instanceof Error?s.message:String(s);o.error(`  \u2717 ${a}`),o.error("    Run `npx @cognite/cli auth login` to sign in again.")}process.exitCode=1}}r(Iy,"handleStatus");function Dy(e){return e.commands.find(t=>t.name()==="auth")??e.command("auth").description("Manage your persisted CDF login session")}r(Dy,"getOrCreateAuthGroup");function lc(e,t={}){let n=by(t);Dy(e).command("status").alias("whoami").description("Show the active session, verified against the identity provider").action(()=>Iy(n))}r(lc,"registerAuthStatusCommand");import{existsSync as Oy,mkdirSync as Fy,writeFileSync as Ly}from"fs";import{dirname as sr,join as ht}from"path";import{generateSigningKeyPair as My}from"@cognite/app-sdk/codesigning";import Uy from"open";function pc(e,t){let n=e.getUTCFullYear(),o=e.getUTCMonth()+t,i=new Date(Date.UTC(n,o+1,0)).getUTCDate(),s=Math.min(e.getUTCDate(),i);return new Date(Date.UTC(n,o,s))}r(pc,"addMonthsClamped");function rr(e){return e.toISOString().slice(0,10)}r(rr,"formatIsoDate");function dc(e=new Date){return rr(e)}r(dc,"todayIso");var vn=Uint8Array.from([48,42,48,5,6,3,43,101,112,3,33,0]),uc=32,mc=44,gc=60,Ty="services/app-hosting/src/kotlin/com/cognite/apphosting/signing/public_keys.yaml";function Ry(e){let t=e.replace(/-----BEGIN [^-]+-----/g,"").replace(/-----END [^-]+-----/g,"").replace(/\s+/g,"");if(t.length!==mc&&t.length!==gc)throw new Error(`Unexpected Ed25519 public key base64 length: got ${t.length} chars, expected ${mc} (raw) or ${gc} (X.509-wrapped)`);let n=Buffer.from(t,"base64");if(n.length===vn.length+uc&&n.subarray(0,vn.length).equals(vn))return n.subarray(vn.length).toString("base64");if(n.length===uc)return n.toString("base64");throw new Error(`Unexpected Ed25519 public key length: got ${n.length} bytes, expected 32 (raw) or 44 (X.509-wrapped)`)}r(Ry,"pemBodyOneLine");function ir(e,t=tt,n=new Date){let o=fc(e.issuedAt??dc(n)),i=fc(e.expires),s=Ry(e.publicKeyPem),a="    ",c=r((p,d)=>`${a}${t.cyan(p)}${t.dim(":")} ${d}
+  npx @cognite/cli apps submit          Package source, open browser + file manager`).action(()=>Iy())}r(el,"registerSubmitCommand");function tl(e){let t=e.command("apps").description("Manage Fusion Custom Apps \u2014 create, deploy, and manage version lifecycle");return wc(t),Pc(t),$c(t),qc(t),Oc(t),Fc(t),tc(t),vc(t),Cc(t),Mc(t),el(t),hc(t),zc(t),Qa(t),t}r(tl,"registerAppsCommand");import Dr from"enquirer";function Dy(e){return{loadAppConfig:e.loadAppConfig??k,cwd:e.cwd??(()=>process.cwd()),loginForSession:e.loginForSession??(t=>Mi(t)),writeSession:e.writeSession??(t=>Nt(t)),readSessionMetadata:e.readSessionMetadata??(()=>xe()),clearSession:e.clearSession??(()=>_t()),promptSelectOrg:e.promptSelectOrg??$y,promptOrg:e.promptOrg??Oy,promptConfirm:e.promptConfirm??Fy,logger:e.logger??console,platform:e.platform??process.platform}}r(Dy,"resolveDeps");async function $y(e){let{selected:t}=await Dr.prompt({type:"select",name:"selected",message:"Select the organization to sign in to",choices:e});return t}r($y,"defaultPromptSelectOrg");async function Oy(){let{org:e}=await Dr.prompt({type:"input",name:"org",message:"Enter your organization name",validate:r(t=>t.trim().length>0?!0:"Organization name is required","validate")});return e.trim()}r(Oy,"defaultPromptOrg");async function Fy(e){let{confirmed:t}=await Dr.prompt({type:"confirm",name:"confirmed",message:e,initial:!1});return t}r(Fy,"defaultPromptConfirm");function Ly(e){if(e.port===void 0)return;let t=Number(e.port);if(!Bt(t))throw new m(Kt(e.port));return t}r(Ly,"resolvePort");async function My(e,t){let{logger:n,promptSelectOrg:o,promptOrg:i}=t;if(e.org)return e.org;let s=Uy(t);if(s){let a=[...new Set(s.deployments.map(c=>c.org))];return a.length===1?(n.log(`Resolved organization from app.json: ${a[0]}`),a[0]):o(a)}return i()}r(My,"resolveOrg");function Uy(e){let{loadAppConfig:t,cwd:n}=e;try{return t(n())}catch(o){let i=o instanceof Error?o.message:String(o);if(/No app\.json found/.test(i))return null;throw o}}r(Uy,"tryLoadAppConfig");function Ny(e){switch(e){case"darwin":return"macOS Keychain";case"win32":return"Windows Credential Manager";default:return"Secret Service (libsecret / KWallet)"}}r(Ny,"keyringBackendLabel");function _y(e){let t=e,n=new Set;for(;t!=null&&!n.has(t)&&(n.add(t),typeof t=="object");){if("code"in t&&t.code==="ERR_DLOPEN_FAILED")return!0;let o="message"in t&&typeof t.message=="string"?t.message:null;if(o&&/cannot find native binding/i.test(o))return!0;t="cause"in t?t.cause:void 0}return!1}r(_y,"isNativeModuleLoadError");async function jy(e,t){let{logger:n,loginForSession:o,writeSession:i,readSessionMetadata:s,clearSession:a,promptConfirm:c,platform:l}=t,p=Ly(e),d=s();if(d){if(!e.force&&je(d)!=="EXPIRED"&&!await c(`A session for organization "${d.org}" already exists. Replace it?`)){n.error("Aborted.");return}await a()}let u=await My(e,t),f=await o({org:u,port:p});try{await i(f)}catch(g){if(_y(g)){let y=l==="win32"?"Install the Microsoft Visual C++ Redistributable from https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist and restart your terminal, then run `cognite auth login` again.":"Ensure the required system libraries are installed for your platform, then run `cognite auth login` again.";throw new m("The keyring native module could not be loaded \u2014 tokens were not persisted.",{hint:y,cause:g})}throw new m("Login succeeded but tokens could not be saved to the credential store.",{hint:`Ensure a credential store (${Ny(l)}) is available and unlocked, then run \`cognite auth login\` again.`,cause:g})}let h=P(process.stdout);n.log(""),n.log(`${h.green("\u2713")} Signed in to organization ${f.org}`)}r(jy,"handleLogin");function Hy(e){return e.commands.find(t=>t.name()==="auth")??e.command("auth").description("Manage your persisted CDF login session")}r(Hy,"getOrCreateAuthGroup");function nl(e,t={}){let n=Dy(t);Hy(e).command("login").description("Sign in via the browser and persist a refreshable session").option("--org <org>","Organization to sign in to (resolved from app.json or prompted when omitted)").option("--force","Replace an existing session without prompting").option("--port <port>",`Pin the local callback port for the OAuth redirect (${dt}). Defaults to 3000.`).action(i=>jy(i,n))}r(nl,"registerAuthLoginCommand");function By(e){return{readSession:e.readSession??(()=>lt()),readSessionMetadata:e.readSessionMetadata??(()=>xe()),clearSession:e.clearSession??(()=>_t()),revokeRefreshToken:e.revokeRefreshToken??(t=>Ui(t)),logger:e.logger??console}}r(By,"resolveDeps");async function Ky(e){let{readSessionMetadata:t,readSession:n,clearSession:o,revokeRefreshToken:i,logger:s}=e,a=null;try{a=t()}catch{await o(),s.log("Cleared corrupt session.");return}if(!a){s.log("No active session.");return}let c;try{c=(await n())?.refreshToken}catch{}if(await o(),c)try{await i(c)}catch{s.error("Logged out locally, but revoking the token at the identity provider failed. It may remain valid until it expires naturally."),s.log("Logged out.");return}s.log("Logged out.")}r(Ky,"handleLogout");function Vy(e){return e.commands.find(t=>t.name()==="auth")??e.command("auth").description("Manage your persisted CDF login session")}r(Vy,"getOrCreateAuthGroup");function ol(e,t={}){let n=By(t);Vy(e).command("logout").description("Revoke and remove the persisted session").action(()=>Ky(n))}r(ol,"registerAuthLogoutCommand");var Gy="auth.cognite.com";function Yy(e){return{ensureFreshSession:e.ensureFreshSession??We,fetchUserInfo:e.fetchUserInfo??(t=>zt(t)),logger:e.logger??console}}r(Yy,"resolveDeps");function zy(e){return e.email??e.preferredUsername??e.name??e.sub}r(zy,"describeUser");var qy="(unknown cluster)";function Jy(e,t){if(e.length===0)return["  - Projects:      (none)"];let n=new Map;for(let i of e){let s=i.cluster??qy,a=n.get(s);a?a.push(i):n.set(s,[i])}let o=[`  - Projects (${e.length}):`];for(let[i,s]of n){o.push(`      ${t.dim(i)}`);for(let a of s){let c=a.isDefault?` ${t.green("[default]")}`:"";o.push(`        ${a.name}${c}`)}}return o}r(Jy,"formatProjects");function Wy(){switch(process.platform){case"darwin":return"macOS Keychain";case"win32":return"Windows Credential Manager";default:return"Secret Service (libsecret / KWallet)"}}r(Wy,"keyringBackendLabel");async function Zy(e){let{ensureFreshSession:t,fetchUserInfo:n,logger:o}=e,i;try{i=await t()}catch(s){if(s instanceof He){o.error("  Session expired. Run `npx @cognite/cli auth login` to sign in again."),process.exitCode=1;return}throw s}if(!i){o.error("Not signed in. Run `npx @cognite/cli auth login` to start a session."),process.exitCode=1;return}o.log(i.org);try{let s=await n(i),a=P(process.stdout);o.log(`  ${a.green("\u2713")} Signed in as ${zy(s)}`);for(let c of Jy(s.projects,a))o.log(c);o.log(`  - Token storage: ${Wy()}`)}catch(s){if(s instanceof Je&&s.kind==="unreachable")o.error(`  \u2717 Couldn't reach Cognite (${Gy}): ${s.message}`),o.error("    Check your network connection, or run `npx @cognite/cli auth login` to sign in again.");else{let a=s instanceof Error?s.message:String(s);o.error(`  \u2717 ${a}`),o.error("    Run `npx @cognite/cli auth login` to sign in again.")}process.exitCode=1}}r(Zy,"handleStatus");function Xy(e){return e.commands.find(t=>t.name()==="auth")??e.command("auth").description("Manage your persisted CDF login session")}r(Xy,"getOrCreateAuthGroup");function rl(e,t={}){let n=Yy(t);Xy(e).command("status").alias("whoami").description("Show the active session, verified against the identity provider").action(()=>Zy(n))}r(rl,"registerAuthStatusCommand");import{existsSync as nS,mkdirSync as oS,writeFileSync as rS}from"fs";import{dirname as Fr,join as bt}from"path";import{generateSigningKeyPair as iS}from"@cognite/app-sdk/codesigning";import sS from"open";function il(e,t){let n=e.getUTCFullYear(),o=e.getUTCMonth()+t,i=new Date(Date.UTC(n,o+1,0)).getUTCDate(),s=Math.min(e.getUTCDate(),i);return new Date(Date.UTC(n,o,s))}r(il,"addMonthsClamped");function $r(e){return e.toISOString().slice(0,10)}r($r,"formatIsoDate");function sl(e=new Date){return $r(e)}r(sl,"todayIso");var _n=Uint8Array.from([48,42,48,5,6,3,43,101,112,3,33,0]),al=32,cl=44,ll=60,Qy="services/app-hosting/src/kotlin/com/cognite/apphosting/signing/public_keys.yaml";function eS(e){let t=e.replace(/-----BEGIN [^-]+-----/g,"").replace(/-----END [^-]+-----/g,"").replace(/\s+/g,"");if(t.length!==cl&&t.length!==ll)throw new Error(`Unexpected Ed25519 public key base64 length: got ${t.length} chars, expected ${cl} (raw) or ${ll} (X.509-wrapped)`);let n=Buffer.from(t,"base64");if(n.length===_n.length+al&&n.subarray(0,_n.length).equals(_n))return n.subarray(_n.length).toString("base64");if(n.length===al)return n.toString("base64");throw new Error(`Unexpected Ed25519 public key length: got ${n.length} bytes, expected 32 (raw) or 44 (X.509-wrapped)`)}r(eS,"pemBodyOneLine");function Or(e,t=rt,n=new Date){let o=pl(e.issuedAt??sl(n)),i=pl(e.expires),s=eS(e.publicKeyPem),a="    ",c=r((p,d)=>`${a}${t.cyan(p)}${t.dim(":")} ${d}
 `,"kv"),l="";return l+=`
-${t.bold("Add this entry to")} ${t.magenta(Ty)} ${t.bold("under")} ${t.cyan("publicKeys:")}
+${t.bold("Add this entry to")} ${t.magenta(Qy)} ${t.bold("under")} ${t.cyan("publicKeys:")}
 
 `,l+=`  ${t.dim("-")} ${t.cyan("kid")}${t.dim(":")} ${t.green(e.kid)}
-`,l+=c("publicKey",t.green(s)),l+=c("email",t.yellow(e.email)),l+=c("roles",`${t.dim("[")}${t.yellow("developer")}${t.dim("]")}`),l+=c("issuedAt",t.green(o)),l+=c("expiresAt",t.green(i)),l+=c("revokedAt",t.dim("null")),l}r(ir,"renderRegistryYamlBlock");function fc(e){let t=e.trim();if(/^\d{4}-\d{2}-\d{2}$/.test(t))return`${t}T00:00:00Z`;let n=new Date(t);if(Number.isNaN(n.getTime()))throw new Error(`Invalid date '${e}': expected YYYY-MM-DD or ISO-8601 instant`);return n.toISOString()}r(fc,"toIsoInstant");import $y from"clipboardy";function yc(e){return $y.write(e)}r(yc,"copyToClipboard");function _y(e){return{writeFileSync:e.writeFileSync??Ly,mkdirSync:e.mkdirSync??Fy,existsSync:e.existsSync??Oy,generateSigningKeyPair:e.generateSigningKeyPair??My,encryptStringAsJwe:e.encryptStringAsJwe??Va,storeKeyInKeychain:e.storeKeyInKeychain??Zs,storeSigningKey:e.storeSigningKey??oa,isOS:e.isOS??(t=>G(t)),promptKid:e.promptKid??Vs,promptExpiryMonths:e.promptExpiryMonths??Ys,promptEmail:e.promptEmail??qs,promptPassphrase:e.promptPassphrase??Js,promptConfirmOverwrite:e.promptConfirmOverwrite??zs,discoverLocalKeys:e.discoverLocalKeys??(()=>rn()),promptZendeskAction:e.promptZendeskAction??Gs,openUrl:e.openUrl??(t=>Uy(t)),copyToClipboard:e.copyToClipboard??yc}}r(_y,"resolveDeps");function Sc(e,t={}){let n=_y(t),o=e.command("keys").description("Manage code signing keys");o.command("generate").description("Generate an Ed25519 keypair for code signing").option("-o, --output <path>","Encrypted private key output path (forces file storage even on macOS)").option("--no-keychain",`Skip the OS credential store (macOS Keychain / Windows Credential Manager) and write a passphrase-encrypted private key under ${F().keysDir} instead`).option("-e, --expires <months>",`Validity in months (${1}-${12}); skips the interactive prompt`).option("--email <address>","Email address for the registry entry; skips the interactive prompt").option("--kid <identifier>","Signing identity name for the registry (e.g. jsmith-dev-001); skips the interactive prompt").option("--force","Overwrite an existing key without prompting for confirmation").option("--copy-link","Copy the Zendesk registration link to the clipboard without prompting").option("--interactive","Prompt for any required flags that are not supplied",!1).action(i=>By(i,n)),o.command("list").description("List local signing identities and their storage location").action(()=>jy(n))}r(Sc,"registerKeysCommand");async function jy(e){let t=await e.discoverLocalKeys();if(t.length===0){process.stdout.write(`No signing identities found.
-`),process.stdout.write(`Run \`cognite keys generate\` to create one (storage: ${F().keysDir}).
-`);return}let n=["KID","SOURCE","EMAIL"],o=t.map(a=>[a.kid,on(a.source),a.email??"\u2014"]),i=qt(n,o),s=r(a=>dt(a,i),"fmt");process.stdout.write(`${s(n)}
+`,l+=c("publicKey",t.green(s)),l+=c("email",t.yellow(e.email)),l+=c("roles",`${t.dim("[")}${t.yellow("developer")}${t.dim("]")}`),l+=c("issuedAt",t.green(o)),l+=c("expiresAt",t.green(i)),l+=c("revokedAt",t.dim("null")),l}r(Or,"renderRegistryYamlBlock");function pl(e){let t=e.trim();if(/^\d{4}-\d{2}-\d{2}$/.test(t))return`${t}T00:00:00Z`;let n=new Date(t);if(Number.isNaN(n.getTime()))throw new Error(`Invalid date '${e}': expected YYYY-MM-DD or ISO-8601 instant`);return n.toISOString()}r(pl,"toIsoInstant");import tS from"clipboardy";function dl(e){return tS.write(e)}r(dl,"copyToClipboard");var ul=12;function aS(e){return{writeFileSync:e.writeFileSync??rS,mkdirSync:e.mkdirSync??oS,existsSync:e.existsSync??nS,generateSigningKeyPair:e.generateSigningKeyPair??iS,encryptStringAsJwe:e.encryptStringAsJwe??_c,storeKeyInKeychain:e.storeKeyInKeychain??Ka,storeSigningKey:e.storeSigningKey??qa,isOS:e.isOS??(t=>X(t)),promptKid:e.promptKid??Ma,promptEmail:e.promptEmail??Na,promptPassphrase:e.promptPassphrase??_a,promptConfirmOverwrite:e.promptConfirmOverwrite??ja,discoverLocalKeys:e.discoverLocalKeys??(()=>bn()),promptZendeskAction:e.promptZendeskAction??Ua,openUrl:e.openUrl??(t=>sS(t)),copyToClipboard:e.copyToClipboard??dl}}r(aS,"resolveDeps");function gl(e,t={}){let n=aS(t),o=e.command("keys").description("Manage code signing keys");o.command("generate").description("Generate an Ed25519 keypair for code signing").option("-o, --output <path>","Encrypted private key output path (forces file storage even on macOS)").option("--no-keychain",`Skip the OS credential store (macOS Keychain / Windows Credential Manager) and write a passphrase-encrypted private key under ${D().keysDir} instead`).option("--email <address>","Email address for the registry entry; skips the interactive prompt").option("--kid <identifier>","Signing identity name for the registry (e.g. jsmith-dev-001); skips the interactive prompt").option("--force","Overwrite an existing key without prompting for confirmation").option("--copy-link","Copy the Zendesk registration link to the clipboard without prompting").option("--interactive","Prompt for any required flags that are not supplied",!1).action(i=>dS(i,n)),o.command("list").description("List local signing identities and their storage location").action(()=>cS(n))}r(gl,"registerKeysCommand");async function cS(e){let t=await e.discoverLocalKeys();if(t.length===0){process.stdout.write(`No signing identities found.
+`),process.stdout.write(`Run \`cognite keys generate\` to create one (storage: ${D().keysDir}).
+`);return}let n=["KID","SOURCE","EMAIL"],o=t.map(a=>[a.kid,En(a.source),a.email??"\u2014"]),i=mn(n,o),s=r(a=>St(a,i),"fmt");process.stdout.write(`${s(n)}
 `);for(let a of o)process.stdout.write(`${s(a)}
-`)}r(jy,"handleList");function hc(e,t,n){let o=ht(F().keysDir,`${e}${Pe}`);return n.mkdirSync(sr(o),{recursive:!0}),n.writeFileSync(o,t),o}r(hc,"writePublicKey");async function Ny(e,t,n,o,i,{force:s=!1}={}){let a=o??ht(F().keysDir,`${e}${$o}`);if(i.mkdirSync(sr(a),{recursive:!0}),!s&&i.existsSync(a))throw new Error(`Refusing to overwrite existing key at ${a}. Delete it first if you really want to regenerate: rm ${a}`);let c=await i.encryptStringAsJwe(t,n);return i.writeFileSync(a,c,{mode:384}),a}r(Ny,"writeEncryptedPrivateKey");function Hy(e,t,n){let o=[];if(e.expires===void 0)o.push("--expires <months> is required. Pass --interactive to enter it interactively.");else try{We(e.expires)}catch(i){o.push(i instanceof Error?i.message:String(i))}if(e.kid===void 0)o.push("--kid <identifier> is required. Pass --interactive to enter it interactively.");else try{let i=Ne(e.kid),s=ht(F().keysDir,`${i}${Pe}`);n(s)&&!e.force&&o.push(`Key "${i}" already exists. Use --force to overwrite without prompting.`)}catch(i){o.push(i instanceof Error?i.message:String(i))}if(e.email===void 0)o.push("--email <address> is required. Pass --interactive to enter it interactively.");else try{ze(e.email,"--email")}catch(i){o.push(i instanceof Error?i.message:String(i))}return t||o.push("A passphrase is required for encrypted key storage. Pass --interactive to enter it interactively."),o}r(Hy,"collectNonInteractiveErrors");async function By(e,t,n=new Date){let{isOS:o,existsSync:i,mkdirSync:s,writeFileSync:a,generateSigningKeyPair:c,storeKeyInKeychain:l,storeSigningKey:p,promptExpiryMonths:d,promptKid:u,promptEmail:f,promptPassphrase:g,promptConfirmOverwrite:y}=t,h=e.interactive??!1,S=e.keychain!==!1&&!e.output&&(o("macos")||o("windows"));if(!h){let q=Hy(e,S,i);if(q.length>0)throw new Error(q.join(`
-`))}let w;e.expires!==void 0?w=We(e.expires):w=await d();let C=rr(pc(n,w)),v;e.kid!==void 0?v=Ne(e.kid):v=await u();let R=ht(F().keysDir,`${v}${Pe}`),$=i(R);if($&&!e.force&&!await y(v)){process.stderr.write(`Aborted.
-`);return}let b;e.email!==void 0?b=ze(e.email,"--email"):b=await f();let k=S?{kind:"keychain"}:{kind:"file",passphrase:await g()};process.stderr.write(`
+`)}r(cS,"handleList");function ml(e,t,n){let o=bt(D().keysDir,`${e}${Oe}`);return n.mkdirSync(Fr(o),{recursive:!0}),n.writeFileSync(o,t),o}r(ml,"writePublicKey");async function lS(e,t,n,o,i,{force:s=!1}={}){let a=o??bt(D().keysDir,`${e}${ar}`);if(i.mkdirSync(Fr(a),{recursive:!0}),!s&&i.existsSync(a))throw new Error(`Refusing to overwrite existing key at ${a}. Delete it first if you really want to regenerate: rm ${a}`);let c=await i.encryptStringAsJwe(t,n);return i.writeFileSync(a,c,{mode:384}),a}r(lS,"writeEncryptedPrivateKey");function pS(e,t,n){let o=[];if(e.kid===void 0)o.push("--kid <identifier> is required. Pass --interactive to enter it interactively.");else try{let i=Ge(e.kid),s=bt(D().keysDir,`${i}${Oe}`);n(s)&&!e.force&&o.push(`Key "${i}" already exists. Use --force to overwrite without prompting.`)}catch(i){o.push(i instanceof Error?i.message:String(i))}if(e.email===void 0)o.push("--email <address> is required. Pass --interactive to enter it interactively.");else try{tt(e.email,"--email")}catch(i){o.push(i instanceof Error?i.message:String(i))}return t||o.push("A passphrase is required for encrypted key storage. Pass --interactive to enter it interactively."),o}r(pS,"collectNonInteractiveErrors");async function dS(e,t,n=new Date){let{isOS:o,existsSync:i,mkdirSync:s,writeFileSync:a,generateSigningKeyPair:c,storeKeyInKeychain:l,storeSigningKey:p,promptKid:d,promptEmail:u,promptPassphrase:f,promptConfirmOverwrite:h}=t,g=e.interactive??!1,y=e.keychain!==!1&&!e.output&&(o("macos")||o("windows"));if(!g){let K=pS(e,y,i);if(K.length>0)throw new Error(K.join(`
+`))}let S=$r(il(n,ul)),w;e.kid!==void 0?w=Ge(e.kid):w=await d();let v=bt(D().keysDir,`${w}${Oe}`),C=i(v);if(C&&!e.force&&!await h(w)){process.stderr.write(`Aborted.
+`);return}let x;e.email!==void 0?x=tt(e.email,"--email"):x=await u();let M=y?{kind:"keychain"}:{kind:"file",passphrase:await f()};process.stderr.write(`
 Generating Ed25519 keypair...
 
-`);let{privateKeyPem:W,publicKeyPem:ge}=await c(v),x=A.from(W);if(k.kind==="keychain"){o("macos")?await l(v,x):await p(v,x);let q=hc(v,ge,t);process.stderr.write(`Public key:  ${q}
-`),process.stderr.write(`Private key: OS credential store (account: ${v})
-`)}else{let q=await Ny(v,x,k.passphrase,e.output,t,{force:$}),et=hc(v,ge,t);process.stderr.write(`Public key:  ${et}
-`),process.stderr.write(`Private key: ${q} (JWE, AES-256-GCM, PBKDF2-SHA512 x${Zo.toLocaleString()})
-`)}let ie=ht(F().keysDir,`${v}${Oo}`);s(sr(ie),{recursive:!0}),a(ie,JSON.stringify({email:b}));let be=P(process.stderr);process.stderr.write(`
-Signing identity (kid): ${be.green(v)}
-`),process.stderr.write(`Expires: ${C} (${w} month${w===1?"":"s"} from today)
-`);let He={kid:v,publicKeyPem:ge,email:b,expires:C};h||(process.stderr.write(`
+`);let{privateKeyPem:B,publicKeyPem:R}=await c(w),Y=b.from(B);if(M.kind==="keychain"){o("macos")?await l(w,Y):await p(w,Y);let K=ml(w,R,t);process.stderr.write(`Public key:  ${K}
+`),process.stderr.write(`Private key: OS credential store (account: ${w})
+`)}else{let K=await lS(w,Y,M.passphrase,e.output,t,{force:C}),Bn=ml(w,R,t);process.stderr.write(`Public key:  ${Bn}
+`),process.stderr.write(`Private key: ${K} (JWE, AES-256-GCM, PBKDF2-SHA512 x${kr.toLocaleString()})
+`)}let ce=bt(D().keysDir,`${w}${cr}`);s(Fr(ce),{recursive:!0}),a(ce,JSON.stringify({email:x}));let I=P(process.stderr);process.stderr.write(`
+Signing identity (kid): ${I.green(w)}
+`),process.stderr.write(`Expires: ${S} (${ul} months from today)
+`);let oe={kid:w,publicKeyPem:R,email:x,expires:S};g||(process.stderr.write(`
 Key registration data:
 
-`),process.stderr.write(ir(He,be,n)));let se=rc(v,b,C,ir(He,tt,n));process.stderr.write(`
-${be.bold("Next:")}
+`),process.stderr.write(Or(oe,I,n)));let F=Qc(w,x,S,Or(oe,rt,n));process.stderr.write(`
+${I.bold("Next:")}
 `),process.stderr.write(`  1. Register your signing key \u2014 submit this pre-filled Zendesk request:
-`);let D;if(e.copyLink?D="clipboard":h?D=await t.promptZendeskAction():D=null,D==="browser")try{await t.openUrl(se),process.stderr.write(`     Opening in browser...
-`)}catch{process.stderr.write(`     URL: ${se}
-`)}else if(D==="clipboard"){let q=!1;try{await t.copyToClipboard(se),q=!0}catch{}process.stderr.write(q&&!e.copyLink?`     Link copied to clipboard.
-`:`     URL: ${se}
-`)}else process.stderr.write(`     URL: ${se}
+`);let re;if(e.copyLink?re="clipboard":g?re=await t.promptZendeskAction():re=null,re==="browser")try{await t.openUrl(F),process.stderr.write(`     Opening in browser...
+`)}catch{process.stderr.write(`     URL: ${F}
+`)}else if(re==="clipboard"){let K=!1;try{await t.copyToClipboard(F),K=!0}catch{}process.stderr.write(K&&!e.copyLink?`     Link copied to clipboard.
+`:`     URL: ${F}
+`)}else process.stderr.write(`     URL: ${F}
 `);process.stderr.write(`
   2. Once your key is approved, sign your Dune app:
-`),process.stderr.write(`     ${be.cyan(`cognite sign -s ${v}`)}
-`)}r(By,"handleGenerate");function wc(e,t={}){let{isSessionAuthEnabled:n=O}=t;return sc(e),n()&&(ac(e),cc(e),lc(e)),Sc(e),e}r(wc,"registerCommands");import{homedir as Ky,userInfo as Vy}from"os";var Gy=Ky(),Yy=(()=>{try{return Vy().username}catch{return""}})();function Ze(e,t=Gy){if(!t||t==="/")return e;let n=e.replaceAll(t,"~"),o=t.replaceAll("\\","/");return o!==t&&(n=n.replaceAll(o,"~")),n=n.replace(/(?<![A-Za-z0-9_])[A-Za-z]:[/\\]Users[/\\][^\s/\\]+(?=[/\\]|$)/g,"~"),n=n.replace(/(?<![A-Za-z0-9_])\/(?:Users|home)\/[^\s/]+(?=[/\\]|$)/g,"~"),n}r(Ze,"redactHomedir");function qy(e,t=Yy){if(!t||t.length<3)return e;let n=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),o=new RegExp("(^|[\\/\\s:])"+n+"(?=[\\/\\s:.@]|$)","g");return e.replace(o,"$1<user>")}r(qy,"redactUsername");var Jy=/(['"]?(?:access_token|accessToken|client_secret|clientSecret|refresh_token|refreshToken|password|token|passphrase)['"]?\s*:\s*)(?:"(?:\\.|[^\\"])*"|'(?:\\.|[^\\'])*')/gi;function vc(e){return e.replace(Jy,(t,n)=>{let o=t[n.length];return`${n}${o}[REDACTED]${o}`})}r(vc,"redactCredentials");var zy=1e3,Wy="https://0a118cb02e3be57b1838bcfb5783a2bf@o4508040730968064.ingest.de.sentry.io/4510719268290640",Xy={captureError:r(async()=>{},"captureError"),flush:r(async()=>{},"flush")};function Zy(e){return e.packageName&&e.cliVersion?`${e.packageName}@${e.cliVersion}`:e.cliVersion??"unknown"}r(Zy,"buildRelease");var Qy="192.0.2.0";function eh(e){return e?.map(t=>({...t,...t.filename!==void 0&&{filename:Ze(t.filename)},...t.abs_path!==void 0&&{abs_path:Ze(t.abs_path)},...t.module!==void 0&&{module:Ze(t.module)}}))}r(eh,"scrubStackFrames");function Cn(e){return vc(qy(Ze(e)))}r(Cn,"redactPii");function th(e){let t={...e.user,email:void 0,username:void 0,ip_address:Qy,id:void 0},n=e.exception?.values?.map(s=>({...s,value:s.value!==void 0?Cn(s.value):s.value,...s.stacktrace!==void 0&&{stacktrace:{...s.stacktrace,frames:eh(s.stacktrace.frames)}}})),o=e.contexts?.cli,i=o!==void 0?Object.fromEntries(Object.entries(o).map(([s,a])=>[s,typeof a=="string"?Cn(a):a])):void 0;return{...e,message:e.message!==void 0?Cn(e.message):e.message,...typeof e.culprit=="string"&&{culprit:Cn(e.culprit)},user:t,server_name:void 0,...n!==void 0&&{exception:{...e.exception,values:n}},...i!==void 0&&{contexts:{...e.contexts,cli:i}}}}r(th,"scrubPii");function Cc(e={}){let t=e.env??process.env;if(Gn(t))return Xy;let n=Zy(e),o="production",i=null,s=null;function a(){return{dsn:Wy,release:n,environment:o,defaultIntegrations:!1,integrations:[],sendDefaultPii:!1,enableLogs:!1,initialScope:{tags:{component:"cli",applicationId:st},contexts:{cli:{applicationId:st,node:process.version,platform:process.platform}}},beforeSend:th}}r(a,"buildInitOptions");async function c(){return i||(s||(s=(async()=>{try{let l=e.sdk??await import("@sentry/node");return l.init(a()),i=l,l}catch{return null}})()),s)}return r(c,"ensureSdk"),{async captureError(l,p){try{let d=await c();if(!d)return;d.captureException(l,nh(l,p))}catch{}},async flush(l=zy){try{if(!i)return;await i.flush(l)}catch{}}}}r(Cc,"createErrorReporter");function nh(e,t){let n={level:"fatal"},o={applicationId:st,node:process.version,platform:process.platform};if(t?.command&&(n.tags={command:t.command},o.command=t.command),Ee(e)&&(e.hint&&(o.hint=e.hint),e.helpUrl&&(o.helpUrl=e.helpUrl),o.shouldReport=e.shouldReport),n.contexts={cli:o},yr(e)&&(n.contexts.http={url:e.requestUrl!==void 0?Ze(e.requestUrl):void 0,status_code:e.httpStatusCode},e.responseBody!==void 0)){let i=typeof e.responseBody=="string"?e.responseBody:JSON.stringify(e.responseBody);n.extra={responseBody:vc(Ze(i))}}return n}r(nh,"buildCaptureContext");import{mkdirSync as oh,readFileSync as rh,writeFileSync as ih}from"fs";import{homedir as sh}from"os";import{resolve as An}from"path";import{debuglog as ah}from"util";import{lt as ch,parse as Ac}from"semver";var lh="https://registry.npmjs.org/@cognite/cli/latest",ph=1500,bc="upgrade-check.json",Ec=An(process.env.XDG_CACHE_HOME||An(sh(),".cache"),"@cognite","cli"),ar=ah("cognite-flows");function dh(e,t){return!e||!t||!Ac(e)||!Ac(t)?!1:ch(e,t)}r(dh,"isOutdated");async function uh({timeout:e=ph,registryUrl:t=lh,fetchImpl:n=globalThis.fetch}={}){if(typeof n!="function")return null;try{let o=await n(t,{signal:AbortSignal.timeout(e)});if(!o?.ok)return null;let i=await o.json();return typeof i?.version=="string"?i.version:null}catch(o){return ar("fetchLatestVersion failed (%s): %O",t,o),null}}r(uh,"fetchLatestVersion");function mh(e=Ec,t=864e5){try{let n=rh(An(e,bc),"utf-8"),o=JSON.parse(n);return typeof o.latest!="string"||typeof o.fetchedAt!="number"||Date.now()-o.fetchedAt>t?null:{latest:o.latest,fetchedAt:o.fetchedAt}}catch(n){return ar("readUpgradeCheckCache failed (%s): %O",e,n),null}}r(mh,"readUpgradeCheckCache");function gh(e,t){try{oh(e,{recursive:!0});let n={latest:t,fetchedAt:Date.now()};ih(An(e,bc),JSON.stringify(n))}catch(n){ar("writeUpgradeCheckCache failed (%s): %O",e,n)}}r(gh,"writeUpgradeCheckCache");async function fh({cacheDir:e=Ec,...t}={}){let n=await uh(t);n&&gh(e,n)}r(fh,"startBackgroundUpgradeCheck");function xc(e,{onOutdated:t,cacheDir:n,...o}={}){let i=mh(n);if(i){dh(e,i.latest)&&t?.(e,i.latest);return}fh({cacheDir:n,...o})}r(xc,"preActionUpgradeCheck");import{default as XR,chalkStderr as kc}from"chalk";function Pc(e,t){let n=[`\u26A0  Update available: ${e} -> ${t}`,"   Run npx @cognite/cli@latest"],o=Math.max(...n.map(c=>[...c].length))+2,i="\u2500".repeat(o),s=r(c=>`\u2502 ${c}${" ".repeat(o-1-[...c].length)}\u2502`,"pad"),a=[`\u250C${i}\u2510`,...n.map(s),`\u2514${i}\u2518`].join(`
-`);return kc.bold.yellow(a)}r(Pc,"formatUpgradeWarning");function Sh(e){return e instanceof Error&&"code"in e&&typeof e.code=="string"&&e.code==="DEP0040"}r(Sh,"isDep0040Warning");var lr=process,wh=lr.emit.bind(lr);lr.emit=function(e,...t){return e==="warning"&&Sh(t[0])?!1:wh(e,...t)};bt();var Qe=new hh;Qe.name("cognite").description("Build and deploy React apps to Cognite Data Fusion").version("1.9.0-alpha.3").showHelpAfterError().configureOutput({writeOut:r(e=>yh(1,e),"writeOut")});Qe.hook("preAction",()=>{xc("1.9.0-alpha.3",{onOutdated:r((e,t)=>{console.warn(`
-${Pc(e,t)}
-`)},"onOutdated")})});wc(Qe);var pr=$t({packageName:"@cognite/cli",cliVersion:"1.9.0-alpha.3"}),Ic=Cc({packageName:"@cognite/cli",cliVersion:"1.9.0-alpha.3"});Er(Qe,pr);Is(Qe,{telemetry:pr});var cr=process.argv.slice(2);Qe.parseAsync(cr,{from:"user"}).catch(async e=>{await xr(pr,cr),Ln(e)&&(console.error(`
-Cancelled.`),process.exit(130)),(!(e instanceof m)||e.shouldReport)&&(await Ic.captureError(e,{command:Fn(cr)}),await Ic.flush());let t=e instanceof Error?e.message:String(e);console.error(`\u274C ${t}`),e instanceof m&&(e.hint||e.helpUrl)&&(console.error(""),e.hint&&console.error(`\u{1F4A1} ${e.hint}`),e.helpUrl&&console.error(`\u{1F4DA} ${e.helpUrl}`)),process.exit(1)});
+`),process.stderr.write(`     ${I.cyan(`cognite sign -s ${w}`)}
+`)}r(dS,"handleGenerate");function fl(e){return tl(e),nl(e),ol(e),rl(e),gl(e),e}r(fl,"registerCommands");import{homedir as uS,userInfo as mS}from"os";var gS=uS(),fS=(()=>{try{return mS().username}catch{return""}})();function nt(e,t=gS){if(!t||t==="/")return e;let n=e.replaceAll(t,"~"),o=t.replaceAll("\\","/");return o!==t&&(n=n.replaceAll(o,"~")),n=n.replace(/(?<![A-Za-z0-9_])[A-Za-z]:[/\\]Users[/\\][^\s/\\]+(?=[/\\]|$)/g,"~"),n=n.replace(/(?<![A-Za-z0-9_])\/(?:Users|home)\/[^\s/]+(?=[/\\]|$)/g,"~"),n}r(nt,"redactHomedir");function hS(e,t=fS){if(!t||t.length<3)return e;let n=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),o=new RegExp("(^|[\\/\\s:])"+n+"(?=[\\/\\s:.@]|$)","g");return e.replace(o,"$1<user>")}r(hS,"redactUsername");var yS=/(['"]?(?:access_token|accessToken|client_secret|clientSecret|refresh_token|refreshToken|password|token|passphrase)['"]?\s*:\s*)(?:"(?:\\.|[^\\"])*"|'(?:\\.|[^\\'])*')/gi;function hl(e){return e.replace(yS,(t,n)=>{let o=t[n.length];return`${n}${o}[REDACTED]${o}`})}r(hl,"redactCredentials");var SS=1e3,wS="https://0a118cb02e3be57b1838bcfb5783a2bf@o4508040730968064.ingest.de.sentry.io/4510719268290640",vS={captureError:r(async()=>{},"captureError"),flush:r(async()=>{},"flush")};function CS(e){return e.packageName&&e.cliVersion?`${e.packageName}@${e.cliVersion}`:e.cliVersion??"unknown"}r(CS,"buildRelease");var AS="192.0.2.0";function ES(e){return e?.map(t=>({...t,...t.filename!==void 0&&{filename:nt(t.filename)},...t.abs_path!==void 0&&{abs_path:nt(t.abs_path)},...t.module!==void 0&&{module:nt(t.module)}}))}r(ES,"scrubStackFrames");function jn(e){return hl(hS(nt(e)))}r(jn,"redactPii");function bS(e){let t={...e.user,email:void 0,username:void 0,ip_address:AS,id:void 0},n=e.exception?.values?.map(s=>({...s,value:s.value!==void 0?jn(s.value):s.value,...s.stacktrace!==void 0&&{stacktrace:{...s.stacktrace,frames:ES(s.stacktrace.frames)}}})),o=e.contexts?.cli,i=o!==void 0?Object.fromEntries(Object.entries(o).map(([s,a])=>[s,typeof a=="string"?jn(a):a])):void 0;return{...e,message:e.message!==void 0?jn(e.message):e.message,...typeof e.culprit=="string"&&{culprit:jn(e.culprit)},user:t,server_name:void 0,...n!==void 0&&{exception:{...e.exception,values:n}},...i!==void 0&&{contexts:{...e.contexts,cli:i}}}}r(bS,"scrubPii");function yl(e={}){let t=e.env??process.env;if(go(t))return vS;let n=CS(e),o="production",i=null,s=null;function a(){return{dsn:wS,release:n,environment:o,defaultIntegrations:!1,integrations:[],sendDefaultPii:!1,enableLogs:!1,initialScope:{tags:{component:"cli",applicationId:pt},contexts:{cli:{applicationId:pt,node:process.version,platform:process.platform}}},beforeSend:bS}}r(a,"buildInitOptions");async function c(){return i||(s||(s=(async()=>{try{let l=e.sdk??await import("@sentry/node");return l.init(a()),i=l,l}catch{return null}})()),s)}return r(c,"ensureSdk"),{async captureError(l,p){try{let d=await c();if(!d)return;d.captureException(l,xS(l,p))}catch{}},async flush(l=SS){try{if(!i)return;await i.flush(l)}catch{}}}}r(yl,"createErrorReporter");function xS(e,t){let n={level:"fatal"},o={applicationId:pt,node:process.version,platform:process.platform};if(t?.command&&(n.tags={command:t.command},o.command=t.command),ue(e)&&(e.hint&&(o.hint=e.hint),e.helpUrl&&(o.helpUrl=e.helpUrl),o.shouldReport=e.shouldReport),n.contexts={cli:o},kt(e)&&(n.contexts.http={url:e.requestUrl!==void 0?nt(e.requestUrl):void 0,status_code:e.httpStatusCode},e.responseBody!==void 0)){let i=typeof e.responseBody=="string"?e.responseBody:JSON.stringify(e.responseBody);n.extra={responseBody:hl(nt(i))}}return n}r(xS,"buildCaptureContext");import{mkdirSync as kS,readFileSync as PS,writeFileSync as TS}from"fs";import{homedir as RS}from"os";import{resolve as Hn}from"path";import{debuglog as IS}from"util";import{lt as DS,parse as Sl}from"semver";var $S="https://registry.npmjs.org/@cognite/cli/latest",OS=1500,wl="upgrade-check.json",vl=Hn(process.env.XDG_CACHE_HOME||Hn(RS(),".cache"),"@cognite","cli"),Lr=IS("cognite-flows");function FS(e,t){return!e||!t||!Sl(e)||!Sl(t)?!1:DS(e,t)}r(FS,"isOutdated");async function LS({timeout:e=OS,registryUrl:t=$S,fetchImpl:n=globalThis.fetch}={}){if(typeof n!="function")return null;try{let o=await n(t,{signal:AbortSignal.timeout(e)});if(!o?.ok)return null;let i=await o.json();return typeof i?.version=="string"?i.version:null}catch(o){return Lr("fetchLatestVersion failed (%s): %O",t,o),null}}r(LS,"fetchLatestVersion");function MS(e=vl,t=864e5){try{let n=PS(Hn(e,wl),"utf-8"),o=JSON.parse(n);return typeof o.latest!="string"||typeof o.fetchedAt!="number"||Date.now()-o.fetchedAt>t?null:{latest:o.latest,fetchedAt:o.fetchedAt}}catch(n){return Lr("readUpgradeCheckCache failed (%s): %O",e,n),null}}r(MS,"readUpgradeCheckCache");function US(e,t){try{kS(e,{recursive:!0});let n={latest:t,fetchedAt:Date.now()};TS(Hn(e,wl),JSON.stringify(n))}catch(n){Lr("writeUpgradeCheckCache failed (%s): %O",e,n)}}r(US,"writeUpgradeCheckCache");async function NS({cacheDir:e=vl,...t}={}){let n=await LS(t);n&&US(e,n)}r(NS,"startBackgroundUpgradeCheck");function Cl(e,{onOutdated:t,cacheDir:n,...o}={}){let i=MS(n);if(i){FS(e,i.latest)&&t?.(e,i.latest);return}NS({cacheDir:n,...o})}r(Cl,"preActionUpgradeCheck");import{default as EF,chalkStderr as Al}from"chalk";function El(e,t){let n=[`\u26A0  Update available: ${e} -> ${t}`,"   Run npx @cognite/cli@latest"],o=Math.max(...n.map(c=>[...c].length))+2,i="\u2500".repeat(o),s=r(c=>`\u2502 ${c}${" ".repeat(o-1-[...c].length)}\u2502`,"pad"),a=[`\u250C${i}\u2510`,...n.map(s),`\u2514${i}\u2518`].join(`
+`);return Al.bold.yellow(a)}r(El,"formatUpgradeWarning");function HS(e){return e instanceof Error&&"code"in e&&typeof e.code=="string"&&e.code==="DEP0040"}r(HS,"isDep0040Warning");var Ur=process,BS=Ur.emit.bind(Ur);Ur.emit=function(e,...t){return e==="warning"&&HS(t[0])?!1:BS(e,...t)};Dt();var ot=new jS;ot.name("cognite").description("Build and deploy React apps and Atlas agents to Cognite Data Fusion").version("1.10.0-alpha.1").showHelpAfterError().configureOutput({writeOut:r(e=>_S(1,e),"writeOut")});ot.hook("preAction",()=>{Cl("1.10.0-alpha.1",{onOutdated:r((e,t)=>{console.warn(`
+${El(e,t)}
+`)},"onOutdated")})});fl(ot);var Nr=jt({packageName:"@cognite/cli",cliVersion:"1.10.0-alpha.1"}),bl=yl({packageName:"@cognite/cli",cliVersion:"1.10.0-alpha.1"});ei(ot,Nr);va(ot,{telemetry:Nr});var Mr=process.argv.slice(2);ot.parseAsync(Mr,{from:"user"}).catch(async e=>{await ti(Nr,Mr),oo(e)&&(console.error(`
+Cancelled.`),process.exit(130)),(!(e instanceof m)||e.shouldReport)&&(await bl.captureError(e,{command:no(Mr)}),await bl.flush());let t=e instanceof Error?e.message:String(e);console.error(`\u274C ${t}`),e instanceof m&&(e.hint||e.helpUrl)&&(console.error(""),e.hint&&console.error(`\u{1F4A1} ${e.hint}`),e.helpUrl&&console.error(`\u{1F4DA} ${e.helpUrl}`)),process.exit(1)});