@cognite/cli 1.9.0 → 1.10.0-alpha.2

package/README.md

@@ -12,10 +12,6 @@ npx @cognite/cli apps create
 
 This prompts for your app name, org, project, and cluster, then generates a fully configured React + TypeScript project.
 
-## Feature Flags
-
-Set environment variable `COGNITE_ALPHA_ENABLE_SESSION_AUTH` to true in order to enable session authentication enabling auth login and logout commands which will let you skip browser login by securely persisting access tokens on your machine.
-
 ## Authentication
 
 New apps created with `npx @cognite/cli apps create` depend on [`@cognite/app-sdk`](https://www.npmjs.com/package/@cognite/app-sdk) — **not `@cognite/cli`** — for auth and host integration. `@cognite/cli` is the CLI used to scaffold, develop, and deploy the app; the generated app itself talks to the Fusion app host via `@cognite/app-sdk`'s Comlink handshake. The template wires this up for you.
@@ -28,6 +24,14 @@ Deploy interactively via browser OAuth:
 npx @cognite/cli apps deploy --interactive
 ```
 
+For local non-interactive deploys, sign in once to persist a refreshable
+session — `apps deploy` picks it up automatically:
+
+```bash
+npx @cognite/cli auth login
+npx @cognite/cli apps deploy
+```
+
 For CI, set your client secret as an environment variable and run:
 
 ```bash
@@ -69,6 +73,7 @@ Browse available skills at [cognitedata/builder-skills](https://github.com/cogni
 ## Requirements
 
 - Node.js ≥ 20
+- npm ≥ 11.10.0 to install/build generated apps — enforced via `engines.npm` + `engine-strict=true` in the generated app's `.npmrc`. Not required for running `@cognite/cli` itself (e.g. via `npx`).
 - React ≥ 18 (optional peer dependency — only needed for auth components)
 
 ## Telemetry

package/_templates/agents/create/AGENTS_TEMPLATE.md

@@ -0,0 +1,182 @@
+# Agent Project — AI Development Guide
+
+This file is for **AI coding assistants** (Cursor, Claude Code, etc.) working in this
+repository. Humans should start with `README.md`.
+
+## Project layout
+
+| Path | Purpose |
+|------|---------|
+| `<name>.agent.yaml` | Agent definition — read this file for current field values |
+| `eval/eval.yaml` | Eval cases and optional `include:` fragments under `eval/` |
+| `README.md` | Human-oriented quick start and workflow |
+
+## Reference documentation
+
+For full field schemas, tool types, scorer details, and CLI flags beyond what this
+file covers, see the Cognite CLI agents documentation:
+
+- [Cognite CLI — Agents](https://docs.cognite.com/dev/sdks/cognite-cli/agents)
+- [Eval cases JSON Schema](https://docs.cognite.com/assets/schemas/agent-eval-cases.schema.json)
+
+## CLI validation
+
+The CLI validates both `<name>.agent.yaml` and `eval/eval.yaml` at runtime. Schema errors
+surface before commands execute — you do not need to validate YAML manually:
+
+- **`<name>.agent.yaml`** is parsed and checked when you run `push`, `status`, `eval`, or
+  other commands that read the project.
+- **`eval/eval.yaml`** (and any `include:` fragments) is validated at the start of
+  `cognite agents eval` before cases run.
+
+Use the scaffolded templates and examples as your reference for valid field shapes.
+
+## Design principle: discover via tools
+
+Agents should **retrieve** answers with declared tools, not rely on eval YAML to inject
+facts into the chat. Evals should validate that behavior.
+
+- Use `dataModels`, `instanceSpaces`, and `appContext` to scope **where** the agent
+  operates (plant, site, spaces) — not to paste answer text the agent should have found.
+- **`faithfulness` `groundTruth`** is supplied to the **LLM judge only**. It does not replace
+  tool use when you are testing retrieval.
+
+**Do not** put expected answer facts in `appContext` to make a discovery test pass:
+
+```yaml
+# Wrong — agent sees the answer without using tools
+appContext: "Pump P-101 was shut down on 2024-03-15."
+turns:
+  - input: "When was P-101 shut down?"
+    scorers:
+      - type: faithfulness
+        groundTruth: "Pump P-101 was shut down on 2024-03-15."
+```
+
+```yaml
+# Right — judge checks grounding; agent must still retrieve in production
+turns:
+  - input: "When was P-101 shut down?"
+    scorers:
+      - type: faithfulness
+        groundTruth: |
+          Pump P-101 was shut down on 2024-03-15 due to bearing wear.
+```
+
+## Two-layer prompts
+
+- **`instructions`** in `<name>.agent.yaml` is the builder-editable system guidance for this agent.
+- The platform may apply additional system behavior that is not editable in this file.
+
+## Workflow
+
+`create` → edit `<name>.agent.yaml` → `cognite agents push` → `cognite agents open` (manual test)
+→ `cognite agents eval` → `cognite agents publish` when ready.
+
+Other commands: `pull`, `list`, `status`, `unpublish`. See `README.md` for examples.
+
+**Eval runs against deployed config.** Push first, or run `cognite agents eval --upsert`.
+To evaluate a deployed agent without a local `<name>.agent.yaml` (e.g. Cognite system agents
+you cannot pull), use `cognite agents eval --system-agent` or
+`cognite agents eval --external-id <id>`. Pass `[dir]` at a folder that contains
+`eval.yaml` (flat suite) or an agent project with `eval/eval.yaml`. Do not put both
+layouts in the same directory.
+`--system-agent` and `--external-id` cannot be used together.
+Auth: `cognite auth login`; optional env vars are documented in the CLI package
+`env.example` (do not commit secrets).
+
+## Eval essentials
+
+- Cases live in `eval/eval.yaml`; split suites with `include:` (paths relative to `eval/`).
+- Filter runs: `--tag`, `--case` (repeatable), `--fail-fast`, `-v`.
+- Use `--system-agent` to evaluate the Cognite-managed system agent without `<name>.agent.yaml`,
+  or `--external-id <id>` for any other deployed agent. These flags skip `<name>.agent.yaml`
+  entirely — pass `[dir]` at a folder with `eval.yaml`, or point at this project for
+  `eval/eval.yaml`.
+- Multi-turn cases thread the conversation cursor; scorers run on the turns that declare them.
+
+| Scorer | Use when | Required / notable fields |
+|--------|----------|---------------------------|
+| `correctness` | General answer quality | `criteria` |
+| `faithfulness` | Output must match judge-supplied facts | `groundTruth` |
+| `toolSelection` | Whether the agent picked the right tools (names only) | Optional `tools`; use runtime names (see below) |
+| `toolInvocation` | Whether tool arguments match the question | Optional `tools`; put parameter details in each tool `description` (see below) |
+
+Phoenix metric docs: [Correctness](https://arize.com/docs/phoenix/evaluation/pre-built-metrics/correctness),
+[Faithfulness](https://arize.com/docs/phoenix/evaluation/pre-built-metrics/faithfulness),
+[Tool Selection](https://arize.com/docs/phoenix/evaluation/pre-built-metrics/tool-selection),
+[Tool Invocation](https://arize.com/docs/phoenix/evaluation/pre-built-metrics/tool-invocation).
+
+### Tool scorers: `tools` field and gotchas
+
+`toolSelection` and `toolInvocation` need a resolved tool list for the LLM judge.
+The judge does a **literal name membership check** — if the names don't match what
+the agent actually called, the scorer will report `incorrect` even when tool use
+was appropriate.
+
+**Eval `tools` are NOT `<name>.agent.yaml` tools.** `<name>.agent.yaml` declares tools for the
+agent runtime (config-time names like `query`). Eval `tools` declare what the
+*judge* should expect the agent to *call* at runtime (e.g. `find_assets`, `execute`).
+These are often different names.
+
+**Three categories of tools:**
+
+- **Custom tools** (user-defined): config name = runtime name. Tool scorers work
+  with tools from `<name>.agent.yaml` — no eval `tools` needed.
+- **Cognite platform tools** (`query`, `ask_document`, etc.): the runtime decomposes
+  these into sub-tools (`find_assets`, `list_views`) whose names differ from config.
+  Declare runtime tool names in eval `tools`, or use `correctness`/`faithfulness`
+  to evaluate outcomes instead.
+- **System tools** (sandbox `execute`, `commandTool`): never in any config. Declare
+  them in eval `tools`, or use `correctness`.
+
+**Discovering runtime tool names:** Run eval once with `-v` or `--report-dir` and
+look at the `toolsCalled:` output to see what the agent actually invoked.
+
+**Tool list cascade** (most specific wins, whole-array replace — not merge-by-name):
+
+```
+scorer.tools → case.tools → included-file.tools → root eval.yaml tools → <name>.agent.yaml tools
+```
+
+With `--external-id` or `--system-agent`, `<name>.agent.yaml` is skipped entirely —
+declare eval `tools` at root, file, case, or scorer level.
+
+**Empty resolution skips the scorer.** If no tools resolve after the full cascade,
+the scorer is skipped with a stderr warning (not a misleading "incorrect" verdict).
+Other scorers on the same turn still run. A case whose *only* scorers were all
+skipped fails the verdict (zero scores).
+
+**`toolInvocation` description quality:** The judge evaluates arguments against
+whatever you put in each tool's `description`. Include parameter details for
+accurate invocation scoring:
+
+```yaml
+tools:
+  - name: find_assets
+    description: |
+      Find assets in the knowledge graph.
+      Parameters: filter (string, required), limit (integer, optional).
+```
+
+Without parameter details, the judge can only check whether arguments "seem
+reasonable" for the user's question — it cannot verify schema compliance.
+
+## Eval YAML inheritance
+
+Fields resolve at three levels for session context and case-level tools: root
+`eval/eval.yaml` → included file → individual case. Scorer-level `tools` on a turn
+override case/file/root (and `<name>.agent.yaml` fallback) for that scorer only.
+
+- **`tags`** — union (file-level tags merge into each case's tags, deduplicated).
+- **`dataModels`, `instanceSpaces`, `appContext`** — per-field replace (most specific wins; no deep merge).
+- **`tools`** — whole-array replace at each level (not merge-by-name). Used by
+  `toolSelection` / `toolInvocation`; does not change what tools the agent can call —
+  only what the judge considers when scoring.
+
+## Conventions for AI assistants
+
+- Minimize scope when editing YAML; match existing case `id` style and tags.
+- Do not commit credentials; use environment variables.
+- For detailed eval authoring or debugging workflows, use project skills under
+  `.cursor/skills` or `.claude/skills` when they are present.

package/_templates/agents/create/EVAL_CASES_TEMPLATE.yaml

@@ -1,77 +1,41 @@
 # Eval cases for {{displayName}}
-#
-# Each case is a conversation with the agent plus one or more "scorers" that
-# judge the responses. An LLM judge grades every scored turn. Run the suite with:
-#
-#   cognite agents eval
-#
-# Supported scorer types:
-#   - correctness:   compares the answer to a reference description you provide
-#                    (`reference`). Use it when you can describe a good answer.
-#   - faithfulness:  checks the answer is grounded in the supplied `context` and
-#                    does not hallucinate. Use it for retrieval / grounded answers.
-#   - toolSelection: checks whether the agent picked an appropriate tool (or
-#                    correctly used none) for the question, based on the tools
-#                    configured in agent.yaml. Requires no extra fields, but only
-#                    makes sense once you've added tools (see README.md's
-#                    "Adding tools" section).
-#   - toolInvocation: checks whether the agent invoked tools with correct
-#                    arguments and formatting. Complements toolSelection — use
-#                    both when you need full tool-calling coverage. Requires no
-#                    extra fields.
-#
-# These are placeholders — edit the inputs, references, and context to match what
-# your agent actually does, then add more cases over time.
+# Run with: cognite agents eval
+# Add more cases and scorer types as you add tools. See README.md.
 
 # To split cases across multiple files as your suite grows, add:
 #   include:
 #     - cases/maintenance.yaml
 
+# Optional: tools for toolSelection / toolInvocation scorers (judge rubric — NOT the same
+# as <name>.agent.yaml tools). <name>.agent.yaml configures the runtime (e.g. query); eval tools use
+# names the agent actually calls (e.g. find_assets, execute). Omit when <name>.agent.yaml names
+# match runtime calls; required when using --external-id / --system-agent.
+# tools:
+#   - name: find_assets
+#     description: |
+#       Find assets in the knowledge graph.
+#       Parameters: filter (string, required), limit (integer, optional).
+
 cases:
-  # Single-turn case scored for correctness.
+  # Single-turn case: the agent should explain what it can help with.
   - id: greeting
     turns:
       - input: "Hi, what can you help me with?"
         scorers:
           - type: correctness
-            # Describe what a good answer looks like; the judge compares against this.
-            reference: >-
+            criteria: >-
               A friendly greeting that briefly explains what this agent can help
               the user with.
 
-  # Single-turn case scored for faithfulness against supplied context.
-  - id: grounded-answer
-    turns:
-      - input: "Where is the main compressor located?"
-        scorers:
-          - type: faithfulness
-            # The answer must be grounded in this context and not invent facts.
-            context: >-
-              The main compressor (unit C-101) is installed on Deck 2 of the
-              North platform, next to the gas separation train.
-
-  # Single-turn case scored for tool selection. Assumes you've added the
-  # `find_assets` tool from README.md's "Adding tools" example — the judge
-  # checks whether the agent picked an appropriate tool (or none) based on
-  # the tools listed in agent.yaml.
-  - id: find-assets-tool
-    turns:
-      - input: "Find assets related to compressors in the knowledge graph."
-        scorers:
-          - type: toolSelection
-          - type: toolInvocation
-
   # Multi-turn case: the agent should carry context across turns.
-  - id: assets-followup
+  - id: follow-up
     turns:
-      - input: "List the assets in the cooling system."
+      - input: "What can you help me with?"
         scorers:
           - type: correctness
-            reference: "Lists the assets that belong to the cooling system."
-      - input: "Now show only the ones that are currently active."
+            criteria: "Describes the agent's capabilities."
+      - input: "Can you elaborate on the first thing you mentioned?"
         scorers:
           - type: correctness
-            # Relies on the previous turn — the judge sees the earlier turns as context.
-            reference: >-
-              Narrows the previously listed cooling-system assets down to only
-              the active ones.
+            criteria: >-
+              Expands on a capability mentioned in the previous response.

package/_templates/agents/create/README_TEMPLATE.md

@@ -1,6 +1,6 @@
 # {{displayName}}
 
-> Edit `agent.yaml` to configure your agent — tools, model, instructions.
+> Edit `<name>.agent.yaml` to configure your agent — tools, model, instructions.
 
 ## Quick start
 
@@ -19,24 +19,28 @@ cognite agents publish
 
 | Path | Purpose |
 |------|---------|
-| `agent.yaml` | Agent definition (externalId, tools, model, instructions) |
+| `<name>.agent.yaml` | Agent definition (externalId, tools, model, instructions), named after this folder |
 | `eval/eval.yaml` | Example eval cases — run with `cognite agents eval` |
 | `README.md` | This file |
 
 ## Evaluating the agent
 
 `eval/eval.yaml` contains starter test cases (single-turn and multi-turn) that
-grade the agent's responses with an LLM judge. After pushing the agent, run:
+grade the agent's responses with an LLM judge. The default cases are designed to
+pass on a freshly pushed agent — push first, then run:
 
 ```bash
 cognite agents eval
 ```
 
 Edit the cases to match what your agent does, and add more over time.
+Add tools in `<name>.agent.yaml` before adding tool-scorer eval cases (`toolSelection`, `toolInvocation`).
 
 ## Adding tools
 
-Edit the `tools` array in `agent.yaml`. Available tool types:
+Edit the `tools` array in `<name>.agent.yaml`. Common tool types (illustrative — may not
+reflect all available types; check the Cognite documentation or the agent builder
+UI in Fusion for the latest list):
 
 - `analyzeData` — analyze tabular or structured data
 - `analyzeImage` — analyze images and P&ID diagrams
@@ -74,5 +78,8 @@ tools:
 
 ## Deployment with Toolkit
 
-The generated `agent.yaml` is compatible with [Cognite Toolkit](https://docs.cognite.com/cdf/deploy/toolkit/).
-Place it in your Toolkit module under `agents/` and deploy with `cdf deploy`.
+The generated `<name>.agent.yaml` is compatible with [Cognite Toolkit](https://docs.cognite.com/cdf/deploy/toolkit/).
+Place it in your Toolkit module under `agents/` and deploy with `cdf deploy`. Toolkit
+treats the `<name>` part as a label and reads the `externalId` from inside the file,
+so you can rename the file freely — the CLI keeps working as long as the folder holds
+one definition.

package/_templates/agents/create/skills/check-agent/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: check-agent
+description: >-
+  Review <name>.agent.yaml and eval setup locally — description, instructions, tool alignment,
+  and common eval mismatches. Use when reviewing an agent, linting config, or asking
+  if anything looks wrong before push or publish.
+---
+
+# Check agent
+
+Produce a short markdown report from **local files only**. Do not call CDF APIs unless the user explicitly asks; for deployed state, suggest `cognite agents status`.
+
+## Workflow
+
+1. Read `<name>.agent.yaml` — `name`, `description`, `instructions`, `tools`, `exampleQuestions`, labels (e.g. published).
+2. Read `eval/eval.yaml` and any `include:` files under `eval/`.
+3. Read `AGENTS.md` when you need eval or prompt conventions.
+4. Run checks and label each finding **error**, **warn**, or **info** with a concrete fix:
+
+| Check | Severity | Rule |
+|-------|----------|------|
+| `description` missing or empty | warn | Add a clear user-facing description. |
+| `instructions` empty or obvious scaffold placeholder | warn | Replace with real guidance (see write-instructions skill). |
+| Tool named in `instructions` but not in `tools[]` | error | Add the tool or remove the mention. |
+| Tool in `tools[]` never mentioned in `instructions` | info | Document when/how to use it. |
+| `toolSelection` / `toolInvocation` in eval but no tools resolve (no eval `tools` at any cascade level and no `<name>.agent.yaml` `tools`) | error | Add a `tools` field at root, file, case, or scorer level in eval yaml, or add tools to `<name>.agent.yaml`. With `--external-id`/`--system-agent`, `<name>.agent.yaml` is not loaded. |
+| `labels` includes published but `exampleQuestions` empty | warn | Add starter questions for Fusion. |
+| Eval case ids duplicated | error | Rename ids in `eval/eval.yaml`. |
+
+5. Optionally skim `README.md` for project-specific tool setup the checks above cannot see.
+
+Keep the report scannable: bullet list grouped by severity, then suggested command order (`check-agent` → edit → `push` → `eval`).
+
+## Anti-patterns
+
+- Do not block on network or credentials for a default review.
+- Do not rewrite `instructions` in full during a review — flag issues and offer the write-instructions skill if the user wants a rewrite.
+- Do not invent tool config schemas — point to `README.md` and `<name>.agent.yaml` examples.
+
+## Cross-references
+
+- To improve `instructions` → **write-instructions** skill, then re-run this check.
+- To add or fix eval coverage → **write-eval-case** skill.
+- After a failed eval → **debug-eval** skill.

package/_templates/agents/create/skills/debug-eval/SKILL.md

@@ -0,0 +1,36 @@
+---
+name: debug-eval
+description: >-
+  Diagnose Cognite agent eval failures from CLI output — config drift, deployment,
+  invoke errors, and scorer rationales. Use when eval failed, a scorer failed, or
+  the user pastes eval run output.
+---
+
+# Debug eval
+
+Work through failures systematically using the user’s eval output (paste or summary).
+
+## Workflow
+
+1. Identify the failing **case id**, **turn**, and **scorer type** (if any). Note exit code and whether the whole suite or one case failed.
+2. **Config drift** — local `<name>.agent.yaml` / `eval/eval.yaml` may differ from what CDF runs. Suggest `cognite agents push` or `cognite agents eval --upsert` so eval matches the project on disk.
+3. **Not deployed** — if push was never done or status is stale, suggest `cognite agents push` and `cognite agents status` (run `cognite agents status --help` for flags).
+4. **Invoke / runtime errors** — auth, routing, or agent errors before scoring. Suggest `cognite auth login`, confirm project/cluster flags, and re-run with verbosity from `cognite agents eval --help` (e.g. `-v`).
+5. **Scorer failures** — read the judge rationale. For `correctness`, compare the response to `criteria`. For `faithfulness`, check `groundTruth` vs actual tool-retrieved facts. For tool scorers, check where the tool list resolved from (scorer → case → file → root `eval/eval.yaml` → `<name>.agent.yaml`); confirm runtime tool names match what the agent called (`toolsCalled:` output). A "Skipping … no tools available" warning means no tools resolved at all — add a `tools` field at the appropriate cascade level.
+   - **Common gotcha:** `<name>.agent.yaml` declares config-time names (e.g. `query`) but the agent calls runtime sub-tools (e.g. `find_assets`). Override with runtime names in eval `tools`.
+   - **`--external-id` / `--system-agent`:** `<name>.agent.yaml` tools are not loaded; tools must come from eval yaml.
+6. **Narrow the run** — suggest isolating with `--case` (repeatable), `--tag`, or `--fail-fast` per `cognite agents eval --help`.
+7. For scorer semantics or field meaning, read **AGENTS.md** rather than guessing.
+
+Summarize likely root cause, concrete next step, and whether the fix is config, deployment, auth, instructions, or the eval case itself.
+
+## Anti-patterns
+
+- Do not assume eval uses local YAML without push/`--upsert` unless the user confirmed deployment state.
+- Do not change `criteria` or `groundTruth` to match a bad hallucination — fix retrieval, instructions, or the case intent.
+- Do not list every CLI flag from memory — delegate to `--help`.
+
+## Cross-references
+
+- If the case design or scorers are wrong → **write-eval-case** skill.
+- If the agent behavior but instructions are weak → **write-instructions** skill, then **check-agent** for alignment.

package/_templates/agents/create/skills/write-eval-case/SKILL.md

@@ -0,0 +1,39 @@
+---
+name: write-eval-case
+description: >-
+  Guide authoring eval cases in eval/eval.yaml — scorer choice, multi-turn patterns,
+  and YAML structure. Use when adding tests, extending the eval suite, or validating
+  agent behavior for a Cognite agent project.
+---
+
+# Write eval case
+
+Help the user add or edit cases in `eval/eval.yaml` (or an `include:` fragment under `eval/`).
+
+## Workflow
+
+1. Read `<name>.agent.yaml` — note declared tools, model, and what the agent is meant to do.
+2. Read `AGENTS.md` — use the eval essentials table for scorer types and required fields, plus inheritance rules for `tags`, `dataModels`, `instanceSpaces`, and `appContext`.
+3. Ask what behavior to test: single-turn vs multi-turn, happy path vs edge case, and whether tool use should be exercised.
+4. Choose scorers using the AGENTS.md table:
+   - `correctness` when a good answer can be described in `criteria`.
+   - `faithfulness` when grounding against judge-only `groundTruth` matters (retrieval / facts).
+   - `toolSelection` / `toolInvocation` when tools are available via the cascade: scorer `tools` → case `tools` → file `tools` → root `eval/eval.yaml` `tools` → `<name>.agent.yaml` `tools`. Use runtime names (e.g. `find_assets`, `execute`), not config-time names (e.g. `query`). For `toolInvocation`, include parameter details in each tool's `description`.
+5. Draft YAML: unique `id`, optional `tags`, one or more `turns` with `input` and `scorers` on the turns you want judged.
+6. Validate locally: every case has at least one scored turn; no duplicate `id` values across the suite; tool scorers have tools resolvable via the cascade (eval yaml or `<name>.agent.yaml`).
+7. Remind the user that eval runs against **deployed** config — run `cognite agents push` first, or use `cognite agents eval --upsert`. For run filters and flags, run `cognite agents eval --help`.
+
+Match existing `id` and tag style in the file. Prefer small, focused cases over one huge conversation.
+
+## Anti-patterns
+
+- Do not put answer facts in `appContext` so the agent passes without using tools — see AGENTS.md “discover via tools”.
+- Do not add `toolSelection` or `toolInvocation` when no tools resolve from the cascade (eval yaml levels + `<name>.agent.yaml`). If tools are empty, these scorers are skipped with a warning — not scored as "incorrect."
+- Do not use `<name>.agent.yaml` config-time names (e.g. `query`) in eval `tools` when the agent calls different runtime sub-tools (e.g. `find_assets`). Run eval with `-v` to discover actual tool names.
+- Do not duplicate case `id` values or leave turns unscored when the user expects a pass/fail result.
+- Do not inline full scorer schemas in chat — point to `AGENTS.md` and the scaffolded examples in `eval/eval.yaml`.
+
+## Cross-references
+
+- If the agent cannot pass because instructions are vague or wrong → use the **write-instructions** skill, then re-run eval.
+- If a run fails and the case looks correct → use the **debug-eval** skill.

package/_templates/agents/create/skills/write-instructions/SKILL.md

@@ -0,0 +1,39 @@
+---
+name: write-instructions
+description: >-
+  Guide writing or improving agent instructions in <name>.agent.yaml — purpose, constraints,
+  tool usage, and response style. Use when improving the system prompt, clarifying
+  behavior, or aligning instructions with declared tools.
+---
+
+# Write instructions
+
+Edit the `instructions` field in `<name>.agent.yaml`. Platform system behavior may apply on top; you only control the builder-editable layer.
+
+## Workflow
+
+1. Read `<name>.agent.yaml` — current `instructions`, `description`, `tools`, and any `appContext`-related fields you should stay consistent with.
+2. Read `AGENTS.md` — **Two-layer prompts** (your instructions vs platform behavior) and **discover via tools** (agents should retrieve with tools, not rely on hidden cheat sheets).
+3. Clarify with the user: primary audience, tone, allowed/refused actions, and which tools must be used for which tasks.
+4. Structure the prompt clearly:
+   - **Purpose** — what the agent is for in one short block.
+   - **Working principles** — how to reason, when to use tools, how to handle uncertainty.
+   - **Constraints** — safety, data scope, “do not” rules, org/project facts that must not be guessed.
+   - **Response style** — format, brevity, widgets or tables if the project uses them.
+5. For every entry in `tools[]`, add explicit guidance: when to call it, what inputs mean, and what to do if the tool fails.
+6. Remove contradictions, vague placeholders, and duplicate rules. Prefer specific, testable guidance evals can target.
+7. After edits, suggest `cognite agents push` and a targeted `cognite agents eval` (see `cognite agents eval --help`).
+
+Propose changes as a unified diff or full `instructions` block the user can paste into `<name>.agent.yaml`.
+
+## Anti-patterns
+
+- Do not promise capabilities no tool or platform feature provides.
+- Do not embed secrets, tokens, or user credentials in instructions.
+- Do not tell the agent to ignore tools when evals expect tool use (or the reverse).
+- Do not paste entire scorer or CLI reference docs — link to `AGENTS.md` and `--help`.
+
+## Cross-references
+
+- After rewriting → run **check-agent** to verify tool/instruction alignment and eval consistency.
+- If evals fail on grounding or retrieval → **debug-eval** skill; if cases need updates → **write-eval-case** skill.

package/_templates/app/new/root/app.json.ejs.t

@@ -12,7 +12,6 @@ to: '<%= useCurrentDir ? "" : ((directoryName || name) + "/") %>app.json'
       "org": "<%= org %>",
       "project": "<%= project %>",
       "baseUrl": "<%= baseUrl %>",
-      "published": false,
       "deployClientId": "",
       "deploySecretName": "<%= (org + '_' + project + '_' + cluster).replace(/-/g, '_').toUpperCase() %>"
     }

package/_templates/app/new/root/package.json.ejs.t

@@ -28,7 +28,7 @@ to: '<%= useCurrentDir ? "" : ((directoryName || name) + "/") %>package.json'
   "dependencies": {
     "@cognite/aura": "^0.3.5",
     "@cognite/sdk": "^10.10.0",
-    "@cognite/app-sdk": "^0.8.0",
+    "@cognite/app-sdk": "^0.9.0",
     "@tabler/icons-react": "^3.35.0",
     "@tanstack/react-query": "^5.90.10",
     "clsx": "^2.1.1",

package/dist/chunk-NZKQBLAX.js

@@ -0,0 +1,12 @@
+var ke=Object.defineProperty;var ie=n=>{throw TypeError(n)};var s=(n,e)=>ke(n,"name",{value:e,configurable:!0});var se=(n,e,t)=>e.has(n)||ie("Cannot "+t);var D=(n,e,t)=>(se(n,e,"read from private field"),t?t.call(n):e.get(n)),oe=(n,e,t)=>e.has(n)?ie("Cannot add the same private member more than once"):e instanceof WeakSet?e.add(n):e.set(n,t),ae=(n,e,t,r)=>(se(n,e,"write to private field"),r?r.call(n,t):e.set(n,t),t);import{existsSync as dt}from"fs";import{mkdir as lt,readFile as ut}from"fs/promises";import{basename as gt,dirname as ft}from"path";var M=class M extends Error{constructor(e,t={}){super(e),this.name="HintedError",t.cause!==void 0&&(this.cause=t.cause);let r=this.deriveDefaults(t);this.hint=t.hint??r.hint,this.helpUrl=t.helpUrl??r.helpUrl,this.shouldReport=t.shouldReport??!0}deriveDefaults(e){return{hint:Ce(e.cause)}}};s(M,"HintedError");var l=M;var pe="https://docs.cognite.com/cdf/access/",xe="https://status.cognite.com";function Ie(n){switch(n){case 401:return{hint:"Your credentials are invalid or expired. Check your client ID and secret.",helpUrl:pe};case 403:return{hint:"You don't have the required CDF capabilities. Please contact your CDF admin.",helpUrl:pe};case 413:return{hint:"The deployment exceeds the App Hosting size limit. Reduce the build output \u2014 remove unused assets, code-split bundles, or strip source maps."};case 429:return{hint:"You are being rate limited. Wait a few moments and retry. If this persists, contact CDF support."};case 500:case 502:case 503:case 504:return{hint:"CDF service error. The issue is on the server side. Check the status page and retry shortly.",helpUrl:xe};default:return{}}}s(Ie,"defaultHintForStatus");var j=class j extends l{constructor(e,t){super(e,t),this.name="HintedHttpError",this.httpStatusCode=t.httpStatusCode,this.requestUrl=t.requestUrl,this.responseBody=t.responseBody}deriveDefaults(e){let{httpStatusCode:t}=e,r=Ie(t),i=super.deriveDefaults(e);return{hint:r.hint??i.hint,helpUrl:r.helpUrl}}};s(j,"HintedHttpError");var k=j;function Pe(n,e){if(n)switch(n){case"ENOTFOUND":return e.hostname?`DNS lookup failed for ${e.hostname}. Check your network, VPN, or proxy settings.`:"DNS lookup failed. Check your network, VPN, or proxy settings.";case"ECONNREFUSED":return e.hostname&&e.port?`Connection refused by ${e.hostname}:${e.port}. The service may be down or the port may be wrong.`:"Connection refused. The service may be down or the port may be wrong.";case"ECONNRESET":return"Connection was reset. The server closed the connection unexpectedly; check for proxy/firewall interference and retry.";case"ETIMEDOUT":return"Connection timed out. Check your network, VPN, or proxy settings, and retry.";case"EAI_AGAIN":return"Temporary DNS failure. Retry shortly; if it persists, check your DNS configuration.";case"CERT_HAS_EXPIRED":case"UNABLE_TO_VERIFY_LEAF_SIGNATURE":case"SELF_SIGNED_CERT_IN_CHAIN":return"TLS certificate validation failed. Check system clock and CA trust store; if you use a corporate proxy, ensure its root cert is trusted.";case"EACCES":return e.path?`Permission denied: ${e.path}. Check file ownership and permissions.`:"Permission denied. Check file ownership and permissions.";case"ENOENT":return e.path?`File or directory not found: ${e.path}.`:"File or directory not found.";case"EISDIR":return e.path?`Expected a file but found a directory: ${e.path}.`:"Expected a file but found a directory.";case"ENOSPC":return"No space left on device. Free up disk space and retry.";case"EADDRINUSE":return e.port?`Port ${e.port} is already in use. Stop the process using it or pick a different port.`:"Address is already in use. Stop the conflicting process or change the port.";case"EMFILE":case"ENFILE":return"Too many open files. Close other programs or raise the file descriptor limit.";default:return}}s(Pe,"hintForErrno");function Ce(n){let e=n,t=new Set;for(;e!=null&&!t.has(e)&&(t.add(e),typeof e=="object");){let r=e,i=Pe(r.code,r);if(i!==void 0)return i;e=r.cause}}s(Ce,"hintForCause");import{inspect as be}from"util";var G="[REDACTED]",w,$=class ${constructor(e){oe(this,w);ae(this,w,e)}toString(){return G}toJSON(){return G}[be.custom](){return G}expose(){return D(this,w)}equals(e){return D(this,w)===D(e,w)}static from(e){return new $(e)}};w=new WeakMap,s($,"SensitiveString");var E=$;var ce="https://docs.cognite.com/cdf/access/";function g(n){return n!==null&&typeof n=="object"}s(g,"isRecord");function C(n){return n instanceof Error&&"status"in n&&typeof n.status=="number"}s(C,"isHttpError");function Re(n){switch(n){case 401:return`Your credentials are invalid or expired. Check your client ID and secret.
+  See: ${ce}`;case 403:return`You don't have the required CDF capabilities. Please contact your CDF admin.
+  See: ${ce}`;default:return}}s(Re,"httpStatusHint");function f(n){let e=n instanceof Error?n:new Error(String(n));if(!C(e))return null;let t=Re(e.status);return t?Object.assign(new Error(`${e.message}
+  ${t}`),{cause:e}):null}s(f,"enrichedHttpError");function Te(n){if(!g(n))return null;let e=n.missing;if(Array.isArray(e))return e;let t=n.data;if(g(t)){let r=t.error;if(g(r)&&Array.isArray(r.missing))return r.missing;if(Array.isArray(t.missing))return t.missing}return null}s(Te,"findMissingArray");function De(n,e){if(!C(n)||n.status!==400)return!1;let t=Te(n);return t?t.some(r=>g(r)&&typeof r.externalId=="string"&&e.includes(r.externalId)):!1}s(De,"isMissingExternalIdError");function U(n,e){return C(n)&&n.status===404||De(n,e)}s(U,"isNotFoundError");var le=["DRAFT","PUBLISHED","DEPRECATED","ARCHIVED"],ue=["ACTIVE","PREVIEW"],q=class q extends Error{constructor(e,t){super(`Version ${t} of app ${e} not found`),this.name="AppVersionNotFoundError",this.appExternalId=e,this.version=t}};s(q,"AppVersionNotFoundError");var N=q,J=class J extends Error{constructor(e){super(`App ${e} not found`),this.name="AppNotFoundError",this.appExternalId=e}};s(J,"AppNotFoundError");var V=J;function F(n,e){return n.includes(e)}s(F,"includesValue");function $e(n){return F(le,n)}s($e,"isAppVersionLifecycleState");function Ue(n){return F(ue,n)}s(Ue,"isAppVersionAlias");function Ne(n){return typeof n.version=="string"&&$e(n.lifecycleState)&&typeof n.entrypoint=="string"&&typeof n.createdTime=="number"&&typeof n.createdBy=="string"&&typeof n.appExternalId=="string"&&(n.alias===void 0||Ue(n.alias))&&(n.comment===void 0||typeof n.comment=="string")}s(Ne,"isAppVersion");function de(n){if(!g(n)){let e=JSON.stringify(n)?.slice(0,200)??String(n);throw new Error(`Invalid version response: expected object, got ${e}`)}if(!Ne(n)){let e=JSON.stringify(n).slice(0,300);throw new Error(`Invalid version response: missing or malformed fields. Got: ${e}`)}return n}s(de,"parseAppVersion");function Ve(n){if(!g(n))throw new Error("Invalid app response: not an object");let{externalId:e,name:t,description:r}=n;if(typeof e!="string")throw new Error("Invalid app response: missing externalId");if(typeof t!="string")throw new Error("Invalid app response: missing name");if(r!=null&&typeof r!="string")throw new Error("Invalid app response: malformed description");return{externalId:e,name:t,description:typeof r=="string"?r:void 0}}s(Ve,"parseAppMetadata");var z=class z{constructor(e){this.client=e}get appsBasePath(){return`/api/v1/projects/${encodeURIComponent(this.client.project)}/apphosting/apps`}async createApp(e,t,r){try{await this.client.post(this.appsBasePath,{data:{items:[{externalId:e,name:t,description:r}]}})}catch(i){throw f(i)??i}}async updateApps(e){try{await this.client.post(`${this.appsBasePath}/update`,{data:{items:e}})}catch(t){throw f(t)??t}}async getApp(e){let t=`${this.appsBasePath}/${encodeURIComponent(e)}`;try{let r=await this.client.get(t);return Ve(r.data)}catch(r){throw U(r,[e])?new V(e):f(r)??r}}async uploadVersion(e,t,r,i,o="index.html"){console.log(`\u{1F4E4} Uploading version ${t}...`);let a=new FormData;a.append("file",new Blob([new Uint8Array(r)]),i),a.append("version",t),a.append("entryPath",o);let p=encodeURIComponent(e),c=`${this.appsBasePath}/${p}/versions`,d=await this.client.authenticate();if(!d)throw new l("Failed to authenticate for upload",{hint:"Check your credentials and try again."});let S=E.from(d),h=`${this.client.getBaseUrl()}${c}`,te=new AbortController,we=setTimeout(()=>te.abort(),300*1e3),A;try{A=await fetch(h,{method:"POST",headers:{Authorization:`Bearer ${S.expose()}`},body:a,signal:te.signal})}catch(m){throw m instanceof Error&&m.name==="AbortError"?new l("Upload timed out after 5 minutes",{hint:"The upload took longer than 5 minutes. Try again \u2014 if it keeps timing out, check your network speed or bundle size."}):new l(`Failed to upload version to ${h}`,{cause:m,hint:"Check your network connection. Uploads can also fail behind a proxy that blocks multipart POST requests."})}finally{clearTimeout(we)}if(!A.ok){let m=await A.text(),v;try{v=JSON.parse(m)}catch{}let T=m;if(g(v)){let I=v.error;if(typeof I=="string")T=I;else if(g(I)){let P=I.message,re=I.code;T=typeof P=="string"?P:re!=null?`Unknown error (code: ${re})`:m}else{let P=v.message;T=typeof P=="string"?P:m}}let ne=A.headers.get("x-request-id"),Ae=ne?` | X-Request-ID: ${ne}`:"",ve=g(v)?v:m;throw new k(`Upload failed: ${A.status} \u2014 ${T}${Ae}`,{httpStatusCode:A.status,requestUrl:h,responseBody:ve})}console.log(`\u2705 Version ${t} uploaded`)}async getVersion(e,t){let r=encodeURIComponent(e),i=encodeURIComponent(t),o=`${this.appsBasePath}/${r}/versions/${i}`;try{let a=await this.client.get(o);return de(a.data)}catch(a){throw U(a,[e,t])?new N(e,t):f(a)??a}}async getActiveVersion(e){let t=encodeURIComponent(e),r=`${this.appsBasePath}/${t}/versions/list`;try{let i=await this.client.post(r,{data:{filter:{aliases:["ACTIVE"]}}});if(!g(i.data)||!Array.isArray(i.data.items))throw new Error("Invalid versions/list response: expected an object with an items array");let{items:o}=i.data;if(o.length===0)return null;if(o.length>1)throw new Error(`Unexpected response: ${o.length} versions have the ACTIVE alias, expected at most 1`);return de(o[0])}catch(i){if(U(i,[e]))return null;throw f(i)??i}}async deleteVersions(e,t){let r=encodeURIComponent(e),i=`${this.appsBasePath}/${r}/versions/delete`;try{await this.client.post(i,{data:{items:t.map(o=>({version:o}))}})}catch(o){throw f(o)??o}}async updateVersions(e,t){let r=encodeURIComponent(e),i=`${this.appsBasePath}/${r}/versions/update`;try{await this.client.post(i,{data:{items:t}})}catch(o){throw f(o)??o}}async submitSignatures(e,t,r){let i=encodeURIComponent(e),o=encodeURIComponent(t),a=`${this.appsBasePath}/${i}/versions/${o}/signatures`;try{await this.client.post(a,{data:{items:r}})}catch(p){throw f(p)??p}}async listSignatures(e,t){let r=encodeURIComponent(e),i=encodeURIComponent(t),o=`${this.appsBasePath}/${r}/versions/${i}/signatures/list`;try{let a=await this.client.post(o,{data:{}});return _e(a.data)}catch(a){throw f(a)??a}}};s(z,"AppHostingApi");var O=z,Fe=["VALID","REVOKED","EXPIRED","SIGNED_BEFORE_KEY_ISSUED","IAT_IN_FUTURE","BUNDLE_TOO_OLD","KEY_NOT_IN_REGISTRY","SCOPE_MISMATCH","VERIFICATION_FAILED"],Oe=["developer","certifier"];function _e(n){if(!g(n))throw new Error("Invalid signatures response: expected an object with an items array");let{items:e}=n;if(!Array.isArray(e))throw new Error("Invalid signatures response: items property is missing or not an array");return e.flatMap(t=>{let r=Be(t);return r?[r]:[]})}s(_e,"parseStoredSignatures");function Be(n){if(!g(n))return null;let{signerKid:e,signerRole:t,signatureIat:r,receivedAt:i,createdTime:o,status:a}=n;return typeof e!="string"||e===""||!F(Oe,t)||typeof r!="number"||typeof i!="number"||typeof o!="number"||!F(Fe,a)?null:{signerKid:e,signerRole:t,signatureIat:r,receivedAt:i,createdTime:o,status:a}}s(Be,"parseStoredSignature");function Le(n,e){let t=[];n.name!==e.name&&t.push({field:"name",remote:n.name,local:e.name});let r=n.description??"";return r!==e.description&&t.push({field:"description",remote:r,local:e.description}),t}s(Le,"diffAppMetadata");function He(n){let e=["Cannot deploy: metadata in app.json differs from what's deployed:"];for(let{field:t,remote:r,local:i}of n){let o=`${t}:`.padEnd(14);e.push(`   ${o}"${r}" \u2192 "${i}"`)}return e.join(`
+`)}s(He,"formatMetadataDriftError");var Y=class Y{constructor(e){this.api=new O(e)}getVersion(e,t){return this.api.getVersion(e,t)}uploadVersion(e,t,r,i,o){return this.api.uploadVersion(e,t,r,i,o)}async ensureApp(e,t,r){console.log("\u{1F50D} Ensuring app exists...");try{await this.api.createApp(e,t,r),console.log(`\u2705 App '${e}' created`)}catch(i){if(C(i)&&i.status===409){console.log(`\u2705 App '${e}' already exists`),await this.checkMetadataDrift(e,t,r);return}throw i}}async checkMetadataDrift(e,t,r){let i;try{i=await this.getApp(e)}catch{return}let o=Le(i,{name:t,description:r});if(o.length!==0)throw new l(He(o),{hint:"Run npx @cognite/cli apps metadata update to sync before deploying",shouldReport:!1})}getApp(e){return this.api.getApp(e)}async updateAppMetadata(e,t,r){await this.api.updateApps([{externalId:e,update:{name:{set:t},description:r?{set:r}:{setNull:!0}}}])}async submitSignatures(e,t,r){r.length!==0&&(console.log(`\u{1F50F} Submitting ${r.length} signature${r.length===1?"":"s"} for version ${t}...`),await this.api.submitSignatures(e,t,r),console.log("\u2705 Signatures stored"))}listSignatures(e,t){return this.api.listSignatures(e,t)}async publishVersion(e,t){await this.api.updateVersions(e,[{version:t,update:{lifecycleState:{set:"PUBLISHED"}}}])}async publishAndActivate(e,t){console.log(`\u{1F680} Publishing and activating version ${t}...`),await this.api.updateVersions(e,[{version:t,update:{lifecycleState:{set:"PUBLISHED"},alias:{set:"ACTIVE"}}}]),console.log(`\u2705 Version ${t} is now PUBLISHED and ACTIVE`)}getActiveVersion(e){return this.api.getActiveVersion(e)}async deactivateVersion(e,t){await this.api.updateVersions(e,[{version:t,update:{alias:{setNull:!0}}}])}async deleteVersion(e,t){await this.api.deleteVersions(e,[t])}async deprecateVersion(e,t){await this.api.updateVersions(e,[{version:t,update:{lifecycleState:{set:"DEPRECATED"}}}])}async archiveVersion(e,t){await this.api.updateVersions(e,[{version:t,update:{lifecycleState:{set:"ARCHIVED"}}}])}async activateVersion(e,t){let r=null;try{r=await this.api.getActiveVersion(e)}catch{r=null}let i=r&&r.version!==t?r.version:void 0;return await this.api.updateVersions(e,[{version:t,update:{alias:{set:"ACTIVE"}}}]),{supersededVersion:i}}async deploy(e,t,r,i,o,a,p=!1){console.log(`
+\u{1F680} Deploying application via App Hosting API...
+`),await this.ensureApp(e,t,r),await this.uploadVersion(e,i,o,a),p&&await this.publishAndActivate(e,i),console.log(`
+\u2705 Deployment successful!`)}};s(Y,"AppHostingClient");var b=Y;import{execFileSync as L}from"child_process";import y from"fs";import u from"path";import{parseAndValidateManifestConfig as Ye}from"@cognite/app-sdk/vite";import{BlobReader as Ke,Uint8ArrayWriter as We,ZipWriter as Xe}from"@zip.js/zip.js";import{execFileSync as Me}from"child_process";function je(n={}){let{execFileSync:e=Me}=n;try{return e("git",["--version"],{stdio:"ignore"}),!0}catch{return!1}}s(je,"isGitInstalled");function ge(n={}){if(!je(n))throw new l("Git is not installed or not found on PATH.",{hint:"Install Git (https://git-scm.com) and ensure it is on your PATH, then try again.",shouldReport:!1})}s(ge,"throwIfGitMissing");import Ge from"path";var _=".cognite-bundles";function fe(n,e){return`${n}-${e}.zip`}s(fe,"bundleFileName");function B(n,e,t){return Ge.join(n,_,fe(e,t))}s(B,"bundlePath");import{existsSync as qe,readFileSync as Je}from"fs";var x=[".dev.sig",".cert.sig"];function ze(n,e={}){let t=e.existsSync??qe,r=e.readFileSync??((o,a)=>Je(o,a)),i=[];for(let o of x){let a=`${n}${o}`;if(!t(a))continue;let p=r(a,"utf8").trim();p.length>0&&i.push(p)}return i}s(ze,"discoverSignatures");var K="package.json",W="package-lock.json",he="manifest.json",X=".cognite",Ze=[/^\.env(\..+)?$/i,/^\.secrets?$/i,/^\.token/i,/^\.cognite/i,/\.(key|pem|p12|pfx|jks|crt)$/i];function Qe(n){let[e,t,...r]=n.split("/");return e!==_||t===void 0||r.length>0?!1:t.endsWith(".zip")||x.some(i=>t.endsWith(`.zip${i}`))}s(Qe,"isBundleArtifact");var Z=class Z{constructor(e="dist"){this.distPath=u.isAbsolute(e)?e:u.join(process.cwd(),e),this.appRoot=u.dirname(this.distPath)}validateBuildDirectory(){if(!y.existsSync(this.distPath))throw new Error(`Build directory "${this.distPath}" not found. Run build first.`);let e=u.join(this.appRoot,K);if(!y.existsSync(e))throw new Error(`"${e}" not found. It is required for deployment.`);let t=u.join(this.appRoot,W);if(!y.existsSync(t))throw new Error(`"${t}" not found. It is required for deployment.`)}async createZip(e="app.zip",t=!1){this.validateBuildDirectory(),console.log("\u{1F4E6} Packaging application...");let r=new Xe(new We,{level:9}),i=s(async(c,d)=>{await r.add(d,new Ke(await y.openAsBlob(c))),t&&console.log(`  \u{1F4C4} ${d}`)},"addFile"),o=s(async c=>{let d=await y.promises.readdir(c,{withFileTypes:!0});for(let S of d){let h=u.join(c,S.name);S.isDirectory()?await o(h):await i(h,u.relative(this.distPath,h).replace(/\\/g,"/"))}},"addDir"),a;try{await o(this.distPath);let c=u.join(this.appRoot,K);await i(c,u.posix.join(X,K));let d=u.join(this.appRoot,he);if(y.existsSync(d)){let h=y.readFileSync(d,"utf-8");Ye(h,d),await i(d,u.posix.join(X,he))}let S=u.join(this.appRoot,W);await i(S,u.posix.join(X,W)),a=await r.close()}catch(c){let d=c instanceof Error?c.message:String(c);throw new Error(`Failed to create zip: ${d}`)}try{await y.promises.writeFile(e,a)}catch(c){throw new l(`Failed to write bundle to ${e}`,{cause:c})}let p=(a.byteLength/1024/1024).toFixed(2);return console.log(`\u2705 App packaged: ${e} (${p} MB)`),e}async createSourceArchive(e){console.log("\u{1F4E6} Packaging source for review...");let t;try{t=L("git",["-C",this.appRoot,"rev-parse","--show-toplevel"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim()}catch(c){throw ge(),new l("Source packaging requires a git repository.",{hint:"Run `git init` first.",shouldReport:!1,cause:c})}let r=L("git",["-C",this.appRoot,"rev-parse","--show-prefix"],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim(),i=r?r.replace(/\/$/,""):".",o=i==="."?"HEAD":`HEAD:${i}`;this.validateNoSensitiveFiles(t,o);try{L("git",["-C",t,"archive","--format=zip",`--output=${e}`,o])}catch(c){let d=c instanceof Error?c.message:String(c);throw new Error(`Failed to create source archive: ${d}`)}let p=(y.statSync(e).size/1024/1024).toFixed(2);return console.log(`\u2705 Source packaged: ${u.basename(e)} (${p} MB)`),e}validateNoSensitiveFiles(e,t){let r=L("git",["-C",e,"ls-tree","-r","--name-only",t],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim().split(`
+`).filter(Boolean),i=s(a=>{let p=a.replace(/\\/g,"/");return!Qe(p)&&p.split("/").some(c=>Ze.some(d=>d.test(c)))},"isSensitive"),o=r.filter(i);if(o.length>0)throw new Error(`Source archive would include sensitive files \u2014 remove them from git tracking first:
+`+o.map(a=>`  ${a}`).join(`
+`)+`
+Hint: git rm --cached <file>`)}};s(Z,"ApplicationPackager");var R=Z;import{CogniteClient as ct}from"@cognite/sdk";function et(n){return Math.floor(Math.random()*Math.min(2**n*250,15e3))}s(et,"exponentialBackoffWithJitter");function tt(n){return new Promise(e=>setTimeout(e,n))}s(tt,"sleep");async function me(n,e={}){let t=e.maxAttempts??5,r=e.shouldRetry??(()=>!0),i=e.delayInMsCalculator??et;if(t<1)throw new Error("`maxAttempts` must be 1 or greater");if(t>100)throw new Error("`maxAttempts` must be 100 or less");let o=1;for(;;)try{return await n()}catch(a){if(o>=t||!r(a))throw a;let p=i(o);e.onAttemptFail?.(a,o,p),await tt(p),o++}}s(me,"retryAsync");var nt="https://auth.cognite.com/oauth2/token",rt=s(n=>typeof n=="object"&&n!==null&&"access_token"in n&&typeof n.access_token=="string","hasAccessToken");async function ye({idp:n,tokenUrl:e,init:t,missingTokenHint:r}){let i;try{i=await me(()=>fetch(e,t),{maxAttempts:3})}catch(p){throw new l(`Failed to fetch access token from ${e}`,{cause:p})}if(!i.ok){let p=await i.text();throw new k(`Failed to get token from ${n}: ${i.status} ${i.statusText}`,{httpStatusCode:i.status,requestUrl:e,responseBody:p})}let o=await i.text(),a;try{a=JSON.parse(o)}catch{throw new l(`Unexpected response from ${n} authentication (invalid JSON)`,{hint:r})}if(!rt(a))throw new l(`No access token in ${n} authentication response`,{hint:r});return E.from(a.access_token)}s(ye,"fetchOAuthToken");var it=s(n=>{let e=n.DEPLOYMENT_SECRETS;if(!e)return{};try{let t=JSON.parse(e),r={};for(let[i,o]of Object.entries(t))if(typeof o=="string"){let a=i.toLowerCase().replace(/_/g,"-");r[a]=o}return r}catch(t){return console.error("Error parsing DEPLOYMENT_SECRETS:",t),{}}},"loadSecretsFromEnv"),st=s((n,e)=>{let t;if(e.DEPLOYMENT_SECRET&&(t=e.DEPLOYMENT_SECRET),t||(t=it(e)[n]),t||(t=e[n]),!t)throw new l(`Set the ${n} environment variable (named by deploySecretName in app.json) to your deploy client secret, e.g. in a .env file.`,{shouldReport:!1,hint:"Alternatively, run `cognite auth login` to use your session, or pass --interactive for a one-off browser login."});return E.from(t)},"getSecretFromEnv"),ot=s((n,e)=>{let t=e.expose();return ye({idp:"CDF",tokenUrl:nt,init:{method:"POST",headers:{Authorization:`Basic ${btoa(`${n}:${t}`)}`,"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"client_credentials"})},missingTokenHint:"Check the client ID in app.json and the deployment secret in your environment."})},"getTokenCdf"),Se=s(({idp:n,tokenUrl:e,clientId:t,clientSecret:r,scopes:i,missingTokenHint:o})=>ye({idp:n,tokenUrl:e,init:{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:t,client_secret:r,grant_type:"client_credentials",...i!==void 0?{scope:i.join(" ")}:{}})},missingTokenHint:o}),"getTokenWithClientCredentials"),at=s((n,e)=>{if(e!==void 0)return e.join(" ");if(!n)throw new Error("Entra ID authentication requires 'baseUrl' to be set in deployment configuration");try{return`${new URL(n).origin}/.default`}catch{throw new Error(`Entra ID authentication requires 'baseUrl' to be a valid CDF URL (e.g., https://cluster.cognitedata.com), got: ${n}`)}},"resolveEntraScope"),pt=s((n,e,t,r,i)=>Se({idp:"Entra ID",tokenUrl:`https://login.microsoftonline.com/${t}/oauth2/v2.0/token`,clientId:n,clientSecret:e.expose(),scopes:i!==void 0?i:[at(r)],missingTokenHint:"Check the client ID and tenant ID in app.json and the deployment secret in your environment."}),"getTokenEntra"),Q=s(async(n,e=process.env)=>{if(e.COGNITE_TOKEN)return E.from(e.COGNITE_TOKEN);let{deployClientId:t,deploySecretName:r,idpType:i="cdf",tenantId:o,baseUrl:a,scopes:p,tokenUrl:c}=n,d=st(r,e);if(i==="oauth"){if(!c)throw new Error("OAuth authentication requires 'tokenUrl' in deployment configuration");return Se({idp:"OAuth",tokenUrl:c,clientId:t,clientSecret:d.expose(),scopes:p,missingTokenHint:"Check the tokenUrl, client ID, scopes, and deployment secret in app.json and your environment."})}if(i==="entra_id"){if(!o)throw new Error("Entra ID authentication requires 'tenantId' in deployment configuration");return pt(t,d,o,a,p)}return ot(t,d)},"getToken");async function H(n,e,t=process.env,r){let i=await Q(n,t),o=t.COGNITE_BASE_URL??n.baseUrl,a=(r??(p=>new ct(p)))({appId:e,project:n.project,baseUrl:o,oidcTokenProvider:s(async()=>i.expose(),"oidcTokenProvider")});return await a.authenticate(),a}s(H,"getSdk");async function Ee(n,e,{existsSync:t=dt,mkdir:r=lt,createZip:i=s((o,a)=>new R(o).createZip(a,!0),"createZipFn")}={}){let{externalId:o,versionTag:a}=n,p=B(e,o,a);if(t(p)){let d=x.some(S=>t(`${p}${S}`))?"A signed bundle already exists here. Re-deploying will invalidate the signing process. Bump versionTag in app.json to deploy as a new version, or delete the bundle and its .sig files then re-sign after deploying.":"Bump versionTag in app.json to deploy as a new version, or delete the existing bundle from .cognite-bundles/ to redeploy the same version.";throw new l(`Bundle already exists: ${p}`,{hint:d,shouldReport:!1})}await r(ft(p),{recursive:!0}),await i(`${e}/dist`,p)}s(Ee,"packageBundle");async function ee(n,e,t,r,{readFile:i=ut,upload:o=s(async(a,p)=>new b(n).deploy(e.externalId,e.name,e.description,e.versionTag,a,p,r),"uploadFn")}={}){let a=B(t,e.externalId,e.versionTag),p;try{p=await i(a)}catch(c){throw new l(`Failed to read bundle file: ${a}`,{cause:c})}await o(p,gt(a))}s(ee,"uploadBundle");var ht=s(async(n,e,t)=>{let r=await H(n,t);await Ee(e,t),await ee(r,e,t,n.published)},"deploy"),mt=s(async(n,e,t)=>{let r=await H(n,t);await ee(r,e,t,n.published)},"deployBundle");export{b as a,_ as b,fe as c,B as d,x as e,ze as f,R as g,Q as h,H as i,Ee as j,ee as k,ht as l,mt as m};