@coldtea/qa 0.1.0

package/dist/main.js

@@ -0,0 +1,4760 @@
+// ../cli-core/src/exitCode.ts
+var EXIT_PASS = 0;
+var EXIT_FAIL = 1;
+var EXIT_COULDNT_RUN = 2;
+var EXIT_CONFLICT = 3;
+var EXIT_CONFIG = 4;
+function assertNever(value) {
+  throw new Error(`Unhandled case: ${JSON.stringify(value)}`);
+}
+var AUTH_ERROR_CODES = /* @__PURE__ */ new Set([
+  "unauthorized",
+  "insufficient_scope"
+]);
+var CALLER_ERROR_CODES = /* @__PURE__ */ new Set([
+  "not_found",
+  "invalid_request",
+  "invalid_cursor",
+  "payload_too_large"
+]);
+function exitCodeFor(input) {
+  switch (input.kind) {
+    case "success":
+      return EXIT_PASS;
+    case "api_error": {
+      if (AUTH_ERROR_CODES.has(input.code)) {
+        return EXIT_CONFIG;
+      }
+      if (input.conflictCodes?.has(input.code)) {
+        return EXIT_CONFLICT;
+      }
+      if (CALLER_ERROR_CODES.has(input.code)) {
+        return EXIT_CONFIG;
+      }
+      if (input.status === 401 || input.status === 403) {
+        return EXIT_CONFIG;
+      }
+      if (input.status === 409) {
+        return EXIT_CONFLICT;
+      }
+      if (input.status === 400 || input.status === 404 || input.status === 413) {
+        return EXIT_CONFIG;
+      }
+      return EXIT_COULDNT_RUN;
+    }
+    case "config_error":
+      return EXIT_CONFIG;
+    default:
+      return assertNever(input);
+  }
+}
+
+// ../cli-core/src/http.ts
+var DEFAULT_BASE_URL = "https://www.coldtea.ai";
+var BASE_URL_ENV_VAR = "COLDTEA_BASE_URL";
+var REQUEST_ID_HEADER = "X-Coldtea-Request-Id";
+function baseUrlIsSetButEmpty(env) {
+  const raw = env[BASE_URL_ENV_VAR];
+  return raw !== void 0 && raw.trim() === "";
+}
+function resolveBaseUrl(env = process.env) {
+  const override = env[BASE_URL_ENV_VAR]?.trim();
+  if (!override) {
+    return DEFAULT_BASE_URL;
+  }
+  return override.replace(/\/+$/, "");
+}
+var ALLOW_INSECURE_HTTP_ENV_VAR = "COLDTEA_ALLOW_INSECURE_HTTP";
+function isLoopbackHost(hostname) {
+  const host = hostname.replace(/\.$/, "").toLowerCase();
+  if (host === "localhost" || host === "0.0.0.0") {
+    return true;
+  }
+  if (/^127(\.\d{1,3}){3}$/.test(host)) {
+    return true;
+  }
+  if (host.startsWith("[") && host.endsWith("]")) {
+    const v6 = host.slice(1, -1);
+    return v6 === "::1" || /^::ffff:7f[0-9a-f]{2}:[0-9a-f]{1,4}$/.test(v6);
+  }
+  return false;
+}
+function urlIsInsecure(raw, allowHttpAnywhere = false) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return true;
+  }
+  if (url.protocol === "https:") {
+    return false;
+  }
+  if (url.protocol !== "http:") {
+    return true;
+  }
+  return allowHttpAnywhere ? false : !isLoopbackHost(url.hostname);
+}
+function allowsInsecureHttp(env = process.env) {
+  return env[ALLOW_INSECURE_HTTP_ENV_VAR]?.trim() === "1";
+}
+function baseUrlIsInsecure(env = process.env) {
+  return urlIsInsecure(resolveBaseUrl(env), allowsInsecureHttp(env));
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readMeta(payload) {
+  const meta = isRecord(payload.meta) ? payload.meta : {};
+  return {
+    requestId: typeof meta.requestId === "string" ? meta.requestId : null,
+    nextCursor: typeof meta.nextCursor === "string" ? meta.nextCursor : null,
+    meta
+  };
+}
+function invalidResponse(message, requestId) {
+  return {
+    ok: false,
+    status: 0,
+    error: { code: "invalid_response", message, details: null },
+    requestId
+  };
+}
+async function v1Request(input) {
+  const fetchImpl = input.fetchImpl ?? fetch;
+  const baseUrl = input.baseUrl ?? DEFAULT_BASE_URL;
+  const url = `${baseUrl}${input.path}`;
+  const headers = {
+    Authorization: `Bearer ${input.apiKey}`
+  };
+  if (input.body !== void 0) {
+    headers["Content-Type"] = "application/json";
+  }
+  let response;
+  try {
+    response = await fetchImpl(url, {
+      method: input.method,
+      headers,
+      body: input.body === void 0 ? void 0 : JSON.stringify(input.body)
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      ok: false,
+      status: 0,
+      error: {
+        code: "network_error",
+        message: `Could not reach ${baseUrl}: ${message}`,
+        details: null
+      },
+      requestId: null
+    };
+  }
+  const headerRequestId = response.headers.get(REQUEST_ID_HEADER);
+  if (response.status === 204) {
+    return {
+      ok: true,
+      status: 204,
+      data: void 0,
+      nextCursor: null,
+      // A 204 has no body, so there is no `meta` to carry — the request id
+      // lives in the header alone.
+      meta: {},
+      requestId: headerRequestId
+    };
+  }
+  let payload;
+  try {
+    payload = await response.json();
+  } catch {
+    return invalidResponse(
+      `Expected JSON from ${url} but got a non-JSON ${response.status} response`,
+      headerRequestId
+    );
+  }
+  if (!isRecord(payload)) {
+    return invalidResponse(
+      `The ${response.status} response from ${url} is not a /v1 envelope`,
+      headerRequestId
+    );
+  }
+  const meta = readMeta(payload);
+  const requestId = meta.requestId ?? headerRequestId;
+  if (!response.ok) {
+    const error = isRecord(payload.error) ? payload.error : {};
+    return {
+      ok: false,
+      status: response.status,
+      error: {
+        code: typeof error.code === "string" ? error.code : "invalid_response",
+        message: typeof error.message === "string" ? error.message : `Request failed with status ${response.status}`,
+        details: error.details ?? null
+      },
+      requestId
+    };
+  }
+  if (!("data" in payload)) {
+    return invalidResponse(
+      `The ${response.status} response from ${url} is not a /v1 envelope`,
+      requestId
+    );
+  }
+  return {
+    ok: true,
+    status: response.status,
+    data: payload.data,
+    nextCursor: meta.nextCursor,
+    meta: meta.meta,
+    requestId
+  };
+}
+
+// ../cli-core/src/output.ts
+function shouldUseColor(env, stdoutIsTTY) {
+  if ("NO_COLOR" in env) {
+    return false;
+  }
+  return stdoutIsTTY;
+}
+function canPrompt(stdinIsTTY, stdoutIsTTY) {
+  return stdinIsTTY && stdoutIsTTY;
+}
+var Output = class {
+  json;
+  colorEnabled;
+  interactive;
+  /**
+   * Whether stdin is a terminal, separately from {@link interactive}.
+   *
+   * `interactive` is stdin AND stdout, which is the right question for "may I
+   * prompt". It is the WRONG question for "did someone pipe me a secret":
+   * `coldtea-qa credentials create … > out.txt` has a terminal stdin and a
+   * redirected stdout, so `interactive` is false while there is nothing to
+   * read — and a command that read stdin there would hang.
+   */
+  stdinIsTTY;
+  stdout;
+  stderr;
+  constructor(options) {
+    const env = options.env ?? process.env;
+    this.json = options.json;
+    this.stdout = options.stdout;
+    this.stderr = options.stderr;
+    this.colorEnabled = shouldUseColor(env, options.stdoutIsTTY ?? false);
+    this.stdinIsTTY = options.stdinIsTTY ?? false;
+    this.interactive = canPrompt(this.stdinIsTTY, options.stdoutIsTTY ?? false);
+  }
+  color(code, text) {
+    return this.colorEnabled ? `\x1B[${code}m${text}\x1B[0m` : text;
+  }
+  bold(text) {
+    return this.color("1", text);
+  }
+  dim(text) {
+    return this.color("2", text);
+  }
+  red(text) {
+    return this.color("31", text);
+  }
+  /** Machine output: the exact payload, one document, stdout. */
+  data(payload) {
+    this.stdout.write(`${JSON.stringify(payload, null, 2)}
+`);
+  }
+  /**
+   * A SUCCESS, IN THE SAME ENVELOPE THE API SENDS: `{ data, meta }`.
+   *
+   * `--json` used to unwrap to `data` alone, which threw `meta` away — so a
+   * SUCCESSFUL call could not give you a request id, the one thing the
+   * reference tells you to quote when reporting a problem, while a failing
+   * one could. Errors already used `{ error, meta }`; matching it here means
+   * one reader handles every response a Coldtea CLI emits and every response
+   * the API does.
+   */
+  success(data, meta) {
+    this.data({ data, meta });
+  }
+  /** Human output line. No-op under --json so stdout stays parseable. */
+  line(text = "") {
+    if (!this.json) {
+      this.stdout.write(`${text}
+`);
+    }
+  }
+  /**
+   * An error, to stderr in both modes. `requestId` is printed whenever the
+   * server gave one, so it can be quoted in support.
+   *
+   * `meta.requestId`, MATCHING THE API'S OWN ENVELOPE. This emitted a
+   * top-level `requestId` while `/v1` errors and every success this class
+   * writes carry `{ …, meta: { requestId } }` — so a caller who wrote one
+   * reader for the API's errors needed a second, different one for the
+   * CLI's, over the exact field the contract tells everyone to quote. Fixed
+   * before anything built on this file ships: after npm, this shape is
+   * frozen.
+   */
+  error(error, requestId = null) {
+    if (this.json) {
+      this.stderr.write(`${JSON.stringify({ error, meta: { requestId } })}
+`);
+      return;
+    }
+    this.stderr.write(
+      `${this.red("error")} ${error.message} (${error.code})
+`
+    );
+    if (requestId) {
+      this.stderr.write(`${this.dim(`request id: ${requestId}`)}
+`);
+    }
+  }
+  /**
+   * A human-readable line elaborating an error (e.g. one row per 409
+   * conflict), to stderr. No-op under --json: there the whole error —
+   * details included — is already the single JSON document on stderr, and
+   * extra prose would corrupt it.
+   */
+  errorNote(text) {
+    if (!this.json) {
+      this.stderr.write(`${text}
+`);
+    }
+  }
+};
+
+// ../cli-core/src/table.ts
+function renderTable(headers, rows) {
+  const widths = headers.map(
+    (header, column) => Math.max(header.length, ...rows.map((row) => (row[column] ?? "").length))
+  );
+  const renderRow = (cells) => cells.map(
+    (cell2, column) => (
+      // The last column is never padded: no trailing whitespace.
+      column === widths.length - 1 ? cell2 : cell2.padEnd(widths[column])
+    )
+  ).join("  ").trimEnd();
+  return [renderRow(headers), ...rows.map(renderRow)].join("\n");
+}
+
+// ../cli-core/src/config.ts
+var API_KEY_ENV_VAR = "COLDTEA_API_KEY";
+var API_KEY_PREFIX = "coldtea_sk_";
+function resolveApiKey(input) {
+  const env = input.env ?? process.env;
+  const raw = input.flag ?? env[API_KEY_ENV_VAR];
+  const apiKey = raw?.trim();
+  if (!apiKey) {
+    return {
+      ok: false,
+      message: `No API key. Set ${API_KEY_ENV_VAR} or pass --api-key. Keys are created in the Coldtea app, under Settings \u2192 API Keys.`
+    };
+  }
+  if (!apiKey.startsWith(API_KEY_PREFIX)) {
+    return {
+      ok: false,
+      message: `That does not look like a Coldtea API key: it should start with ${API_KEY_PREFIX}.`
+    };
+  }
+  return { ok: true, apiKey };
+}
+
+// ../cli-core/src/cli.ts
+import { parseArgs } from "node:util";
+
+// ../cli-core/src/shared.ts
+function requireApiKey(context, output) {
+  const key = resolveApiKey({ flag: context.flags.apiKey, env: context.env });
+  if (!key.ok) {
+    output.error({ code: "config_error", message: key.message, details: null });
+    return { ok: false, code: exitCodeFor({ kind: "config_error" }) };
+  }
+  return { ok: true, value: key.apiKey };
+}
+function usageError(output, message) {
+  output.error({ code: "config_error", message, details: null });
+  return exitCodeFor({ kind: "config_error" });
+}
+function isRetryableFailure(result) {
+  return result.status === 0 || result.status >= 500;
+}
+function apiFailure(output, result, options = {}) {
+  output.error(result.error, result.requestId);
+  if (result.error.code === "invalid_request" && isRecord2(result.error.details)) {
+    const issues = result.error.details.issues;
+    if (Array.isArray(issues)) {
+      for (const issue of issues.filter(isRecord2)) {
+        if (typeof issue.path === "string" && typeof issue.message === "string") {
+          output.errorNote(`  ${issue.path}: ${issue.message}`);
+        }
+      }
+    }
+  }
+  if (result.error.code === "insufficient_scope" && isRecord2(result.error.details)) {
+    const { required, granted } = result.error.details;
+    if (typeof required === "string") {
+      const holds = Array.isArray(granted) && granted.length > 0 ? granted.join(", ") : "nothing";
+      output.errorNote(`  Needs ${required}; this key holds ${holds}.`);
+      output.errorNote(
+        "  A key's access cannot be changed, only replaced. Create one in the Coldtea app under Settings \u2192 API Keys."
+      );
+      if (options.scopeNote !== void 0) {
+        output.errorNote(`  ${options.scopeNote}`);
+      }
+    }
+  }
+  return exitCodeFor({
+    kind: "api_error",
+    status: result.status,
+    code: result.error.code,
+    conflictCodes: options.conflictCodes
+  });
+}
+function api(context, apiKey, input) {
+  return v1Request({
+    ...input,
+    apiKey,
+    baseUrl: context.baseUrl,
+    fetchImpl: context.fetchImpl
+  });
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function asString(value) {
+  return typeof value === "string" ? value : null;
+}
+function asNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function cell(value) {
+  if (value === null || value === void 0) {
+    return "\u2014";
+  }
+  return String(value);
+}
+function formatEpoch(value) {
+  const ms = asNumber(value);
+  if (ms === null) {
+    return "\u2014";
+  }
+  const date = new Date(ms);
+  return Number.isNaN(date.getTime()) ? "\u2014" : date.toISOString();
+}
+function emitListJson(output, result) {
+  output.data({
+    data: result.data,
+    meta: {
+      ...result.meta,
+      nextCursor: result.nextCursor,
+      ...result.requestId === null ? {} : { requestId: result.requestId }
+    }
+  });
+}
+function emitJson(output, result) {
+  output.data({
+    data: result.data,
+    meta: {
+      ...result.meta,
+      ...result.requestId === null ? {} : { requestId: result.requestId }
+    }
+  });
+}
+function nextCursorFootnote(output, nextCursor) {
+  if (nextCursor !== null) {
+    output.line();
+    output.line(output.dim(`More pages: --cursor ${nextCursor}`));
+  }
+}
+var LIST_FLAGS = {
+  limit: { type: "string" },
+  cursor: { type: "string" }
+};
+function listQuery(values) {
+  const parts = [];
+  if (typeof values.limit === "string") {
+    parts.push(`limit=${encodeURIComponent(values.limit)}`);
+  }
+  if (typeof values.cursor === "string") {
+    parts.push(`cursor=${encodeURIComponent(values.cursor)}`);
+  }
+  return parts;
+}
+
+// ../cli-core/src/cli.ts
+var UNIVERSAL_FLAGS = {
+  json: { type: "boolean", default: false },
+  "api-key": { type: "string" },
+  // NO SHORT ALIASES, AND NO `version` AT ALL. In non-strict mode
+  // `parseArgs` expands ANY single-dash token into shorts, so with
+  // `short: "h"` on help, `tasks create "Title" -dash` read as -d -a -s -h,
+  // set help, printed usage and exited 0 — a green CI step that filed
+  // nothing. `-h`/`-v`/`--version` are bare-invocation tokens matched
+  // EXACTLY (see hasGlobalFlag); after a command, `-v` is an unknown
+  // option and exit 4, the same answer `git status --version` gives.
+  help: { type: "boolean", default: false }
+};
+function optionValueIndices(tokens) {
+  const consumed = /* @__PURE__ */ new Set();
+  for (const token of tokens ?? []) {
+    if (token.kind === "option" && token.inlineValue === false && token.value !== void 0) {
+      consumed.add(token.index + 1);
+    }
+  }
+  return consumed;
+}
+function hasGlobalFlag(argv, consumed, ...tokens) {
+  const terminator = argv.indexOf("--");
+  const end = terminator === -1 ? argv.length : terminator;
+  for (let index = 0; index < end; index += 1) {
+    if (!consumed.has(index) && tokens.includes(argv[index])) {
+      return true;
+    }
+  }
+  return false;
+}
+function defaultSleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function defaultReadStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function defaultReadLine(question) {
+  const { createInterface } = await import("node:readline/promises");
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    return await rl.question(question);
+  } finally {
+    rl.close();
+  }
+}
+function runCliFrom(definition) {
+  const globalOptions = {
+    ...UNIVERSAL_FLAGS,
+    ...definition.globalFlags ?? {}
+  };
+  function unionOptions() {
+    const options = { ...globalOptions };
+    for (const def of definition.commands) {
+      for (const [name, spec] of Object.entries(def.flags)) {
+        options[name] = spec;
+      }
+    }
+    return options;
+  }
+  function findCommand(positionals) {
+    for (const length of [2, 1]) {
+      const candidate = positionals.slice(0, length);
+      if (candidate.length < length) {
+        continue;
+      }
+      for (const def of definition.commands) {
+        if (def.words.length === length && def.words.every((word, index) => word === candidate[index])) {
+          return def;
+        }
+      }
+    }
+    return null;
+  }
+  function familyHelp(word) {
+    const def = definition.commands.find(
+      (candidate) => candidate.words[0] === word
+    );
+    return def ? def.help : null;
+  }
+  return async function runCli2(argv, io = {}) {
+    const env = io.env ?? process.env;
+    const stdout = io.stdout ?? process.stdout;
+    const stderr = io.stderr ?? process.stderr;
+    const stdoutIsTTY = io.stdoutIsTTY ?? Boolean(process.stdout.isTTY);
+    const stdinIsTTY = io.stdinIsTTY ?? Boolean(process.stdin.isTTY);
+    const loose = parseArgs({
+      args: argv,
+      options: unionOptions(),
+      allowPositionals: true,
+      strict: false,
+      tokens: true
+    });
+    const consumed = optionValueIndices(loose.tokens);
+    const [first, second] = loose.positionals;
+    if (first === void 0) {
+      if (hasGlobalFlag(argv, consumed, "--version", "-v")) {
+        stdout.write(`${definition.version}
+`);
+        return exitCodeFor({ kind: "success" });
+      }
+      if (hasGlobalFlag(argv, consumed, "--help", "-h")) {
+        stdout.write(definition.usage);
+        return exitCodeFor({ kind: "success" });
+      }
+      stderr.write(definition.usage);
+      return exitCodeFor({ kind: "config_error" });
+    }
+    if (first === "help") {
+      const help = second === void 0 ? definition.usage : familyHelp(second) ?? null;
+      if (help === null) {
+        stderr.write(`Unknown command "${second}"
+
+${definition.usage}`);
+        return exitCodeFor({ kind: "config_error" });
+      }
+      stdout.write(help);
+      return exitCodeFor({ kind: "success" });
+    }
+    const def = findCommand(loose.positionals);
+    if (def === null) {
+      const help = familyHelp(first);
+      if (help !== null && second === void 0 && hasGlobalFlag(argv, consumed, "--help")) {
+        stdout.write(help);
+        return exitCodeFor({ kind: "success" });
+      }
+      if (help !== null && second === void 0 && hasGlobalFlag(argv, consumed, "-h", "-v")) {
+        stderr.write(
+          `Unknown option. After a command, spell flags out: --help.
+
+${help}`
+        );
+        return exitCodeFor({ kind: "config_error" });
+      }
+      if (help !== null) {
+        stderr.write(
+          `Unknown command "${loose.positionals.slice(0, 2).join(" ")}"
+
+${help}`
+        );
+      } else {
+        stderr.write(`Unknown command "${first}"
+
+${definition.usage}`);
+      }
+      return exitCodeFor({ kind: "config_error" });
+    }
+    let parsed;
+    try {
+      parsed = parseArgs({
+        args: argv,
+        options: { ...globalOptions, ...def.flags },
+        allowPositionals: true,
+        strict: true
+      });
+    } catch (error) {
+      stderr.write(
+        `${error instanceof Error ? error.message : String(error)}
+
+${def.help}`
+      );
+      return exitCodeFor({ kind: "config_error" });
+    }
+    if (parsed.values.help === true) {
+      stdout.write(def.help);
+      return exitCodeFor({ kind: "success" });
+    }
+    const output = new Output({
+      json: parsed.values.json === true,
+      stdout,
+      stderr,
+      env,
+      stdoutIsTTY,
+      stdinIsTTY
+    });
+    if (baseUrlIsSetButEmpty(env)) {
+      return usageError(
+        output,
+        `${BASE_URL_ENV_VAR} is set but empty, which used to mean production. Unset it to use ${DEFAULT_BASE_URL}, or give it a full origin like http://localhost:3003.`
+      );
+    }
+    if (baseUrlIsInsecure(env)) {
+      return usageError(
+        output,
+        `${BASE_URL_ENV_VAR} must be an https origin \u2014 every request sends your API key there. Plain http is allowed only on loopback (localhost, 127.0.0.0/8, [::1]). For an http-only private host, set COLDTEA_ALLOW_INSECURE_HTTP=1 \u2014 knowing the key then travels in plaintext.`
+      );
+    }
+    const apiKeyFlag = typeof parsed.values["api-key"] === "string" ? parsed.values["api-key"] : void 0;
+    const base = {
+      env,
+      flags: {
+        json: parsed.values.json === true,
+        apiKey: apiKeyFlag
+      },
+      baseUrl: resolveBaseUrl(env),
+      fetchImpl: io.fetchImpl,
+      sleep: io.sleepImpl ?? defaultSleep,
+      now: io.nowImpl ?? Date.now,
+      readLine: io.readLineImpl ?? defaultReadLine,
+      readStdin: io.readStdinImpl ?? defaultReadStdin
+    };
+    const context = definition.buildContext({ base, values: parsed.values });
+    return def.run(context, output, {
+      values: parsed.values,
+      positionals: parsed.positionals.slice(def.words.length)
+    });
+  };
+}
+
+// src/config.ts
+var PROJECT_ID_ENV_VAR = "COLDTEA_PROJECT_ID";
+function resolveProjectId(input) {
+  const env = input.env ?? process.env;
+  const projectId = (input.flag ?? env[PROJECT_ID_ENV_VAR])?.trim();
+  return projectId ? projectId : null;
+}
+
+// src/exitCode.ts
+var RUN_OUTCOME_SEVERITY = {
+  failed: 5,
+  in_progress: 4,
+  couldnt_run: 3,
+  couldnt_verify: 2,
+  warning: 1,
+  passed: 0
+};
+var RUN_OUTCOMES = new Set(
+  Object.keys(RUN_OUTCOME_SEVERITY)
+);
+function worstOf(outcomes) {
+  let worst = "passed";
+  for (const outcome of outcomes) {
+    if (RUN_OUTCOME_SEVERITY[outcome] > RUN_OUTCOME_SEVERITY[worst]) {
+      worst = outcome;
+    }
+  }
+  return worst;
+}
+var QA_CONFLICT_CODES = /* @__PURE__ */ new Set([
+  "report_name_taken",
+  "repo_already_linked",
+  "idempotency_key_reused",
+  "project_merged",
+  "merge_in_progress",
+  "merge_repo_mismatch",
+  "environment_in_use",
+  "credential_in_use",
+  "build_already_confirmed",
+  "build_referenced_by_tests"
+]);
+function exitCodeForOutcome(outcome, failOnWarning) {
+  switch (outcome) {
+    case "passed":
+      return EXIT_PASS;
+    case "warning":
+      return failOnWarning ? EXIT_FAIL : EXIT_PASS;
+    case "failed":
+      return EXIT_FAIL;
+    case "couldnt_verify":
+      return EXIT_COULDNT_RUN;
+    case "couldnt_run":
+      return EXIT_COULDNT_RUN;
+    case "in_progress":
+      return EXIT_COULDNT_RUN;
+    default:
+      return assertNever(outcome);
+  }
+}
+function exitCodeFor2(input) {
+  switch (input.kind) {
+    case "success":
+    case "config_error":
+      return exitCodeFor(input);
+    case "run":
+      return exitCodeForOutcome(input.outcome, input.failOnWarning);
+    case "batch": {
+      const base = exitCodeForOutcome(input.worstOutcome, input.failOnWarning);
+      if (base === EXIT_PASS && input.skippedCount > 0) {
+        return EXIT_COULDNT_RUN;
+      }
+      return base;
+    }
+    case "api_error":
+      return exitCodeFor({
+        ...input,
+        conflictCodes: QA_CONFLICT_CODES
+      });
+    default:
+      return assertNever(input);
+  }
+}
+
+// src/commands/whoami.ts
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((v) => typeof v === "string");
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseMeData(data) {
+  if (!isRecord3(data)) {
+    return null;
+  }
+  const record = data;
+  const apiKey = isRecord3(record.apiKey) ? record.apiKey : null;
+  if (typeof record.organizationId !== "string" || typeof record.organizationName !== "string" || apiKey === null || typeof apiKey.name !== "string" || typeof apiKey.prefix !== "string" || typeof apiKey.last4 !== "string" || !isStringArray(apiKey.scopes)) {
+    return null;
+  }
+  return {
+    organizationId: record.organizationId,
+    organizationName: record.organizationName,
+    apiKey: {
+      name: apiKey.name,
+      prefix: apiKey.prefix,
+      last4: apiKey.last4,
+      scopes: apiKey.scopes,
+      createdAt: apiKey.createdAt,
+      lastUsedAt: apiKey.lastUsedAt
+    }
+  };
+}
+function formatTimestamp(value) {
+  if (value === null || value === void 0) {
+    return "never";
+  }
+  if (typeof value !== "number" && typeof value !== "string") {
+    return "never";
+  }
+  const date = new Date(value);
+  return Number.isNaN(date.getTime()) ? String(value) : date.toISOString();
+}
+async function whoami(context, output) {
+  const key = resolveApiKey({ flag: context.flags.apiKey, env: context.env });
+  if (!key.ok) {
+    output.error({ code: "config_error", message: key.message, details: null });
+    return exitCodeFor2({ kind: "config_error" });
+  }
+  const result = await v1Request({
+    method: "GET",
+    path: "/v1/me",
+    apiKey: key.apiKey,
+    baseUrl: context.baseUrl,
+    fetchImpl: context.fetchImpl
+  });
+  if (!result.ok) {
+    output.error(result.error, result.requestId);
+    return exitCodeFor2({
+      kind: "api_error",
+      status: result.status,
+      code: result.error.code
+    });
+  }
+  if (output.json) {
+    output.success(result.data, {
+      ...result.meta,
+      ...result.requestId === null ? {} : { requestId: result.requestId }
+    });
+    return exitCodeFor2({ kind: "success" });
+  }
+  const me = parseMeData(result.data);
+  if (me === null) {
+    output.error(
+      {
+        code: "invalid_response",
+        message: "The /v1/me response is missing expected fields",
+        details: null
+      },
+      result.requestId
+    );
+    return exitCodeFor2({
+      kind: "api_error",
+      status: 0,
+      code: "invalid_response"
+    });
+  }
+  output.line(
+    `${output.bold("Organization")}  ${me.organizationName} ${output.dim(`(${me.organizationId})`)}`
+  );
+  output.line(
+    `${output.bold("Key")}           ${me.apiKey.name} ${output.dim(`(${me.apiKey.prefix}\u2026${me.apiKey.last4})`)}`
+  );
+  output.line(`${output.bold("Scopes")}        ${me.apiKey.scopes.join(", ")}`);
+  output.line(
+    `${output.bold("Created")}       ${formatTimestamp(me.apiKey.createdAt)}`
+  );
+  output.line(
+    `${output.bold("Last used")}     ${formatTimestamp(me.apiKey.lastUsedAt)}`
+  );
+  return exitCodeFor2({ kind: "success" });
+}
+
+// src/commands/shared.ts
+function requireApiKey2(context, output) {
+  return requireApiKey(context, output);
+}
+function requireProjectId(context, output) {
+  if (context.projectId === null) {
+    output.error({
+      code: "config_error",
+      message: `This command needs a project. Pass --project or set ${PROJECT_ID_ENV_VAR}. \`coldtea-qa projects list\` shows the ids.`,
+      details: null
+    });
+    return { ok: false, code: exitCodeFor2({ kind: "config_error" }) };
+  }
+  return { ok: true, value: context.projectId };
+}
+function usageError2(output, message) {
+  return usageError(output, message);
+}
+function apiFailure2(output, result) {
+  return apiFailure(output, result, {
+    conflictCodes: QA_CONFLICT_CODES,
+    scopeNote: "The scopes are qa:read (list and read), qa:write (create, edit, delete, link a repo) and qa:run (start and stop runs)."
+  });
+}
+var VCS_FLAGS = {
+  "vcs-provider": { type: "string" },
+  "vcs-repository-id": { type: "string" },
+  "vcs-head-sha": { type: "string" },
+  "vcs-pr-number": { type: "string" }
+};
+function readVcsFlags(output, values, options) {
+  const names = [
+    "vcs-provider",
+    "vcs-repository-id",
+    "vcs-head-sha",
+    "vcs-pr-number"
+  ];
+  const required = options.requirePrNumber ? names : names.slice(0, 3);
+  const passed = (name) => typeof values[name] === "string";
+  const read = (name) => typeof values[name] === "string" ? values[name].trim() : "";
+  if (!names.some(passed)) {
+    return { ok: true, vcs: null };
+  }
+  if (!required.every(passed)) {
+    usageError2(
+      output,
+      options.requirePrNumber ? "--vcs-provider, --vcs-repository-id, --vcs-head-sha and --vcs-pr-number travel together" : "--vcs-provider, --vcs-repository-id and --vcs-head-sha travel together (pr-number is optional)"
+    );
+    return { ok: false };
+  }
+  if (required.some((name) => read(name) === "")) {
+    return { ok: true, vcs: null };
+  }
+  const vcs = {
+    provider: read("vcs-provider"),
+    repositoryId: read("vcs-repository-id"),
+    headSha: read("vcs-head-sha")
+  };
+  const prNumber = read("vcs-pr-number");
+  if (prNumber !== "") {
+    const parsed = Number(prNumber);
+    if (!Number.isInteger(parsed) || parsed <= 0) {
+      usageError2(output, "--vcs-pr-number must be a positive integer");
+      return { ok: false };
+    }
+    vcs.prNumber = parsed;
+  }
+  return { ok: true, vcs };
+}
+
+// src/commands/projects.ts
+var PROJECTS_HELP = `coldtea-qa projects \u2014 manage QA projects
+
+Usage
+  coldtea-qa projects list [--include-archived] [--limit <n>] [--cursor <c>]
+  coldtea-qa projects create <name>
+  coldtea-qa projects get <projectId>
+  coldtea-qa projects link-repo <projectId> --provider <github|bitbucket> --repository-id <id>
+
+Flags
+  --include-archived   List archived projects too
+  --provider           Repository provider: github or bitbucket
+  --repository-id      The provider's stable repository id (not owner/name)
+
+Notes
+  A project holds at most one repository. Linking over an existing link is
+  a conflict (exit 3); unlink first. repository-id is the provider's stable
+  id, never a URL.
+`;
+function projectRow(project) {
+  const repo = isRecord2(project.repo) ? `${cell(project.repo.provider)}:${cell(project.repo.repositoryId)}` : "\u2014";
+  const counts = isRecord2(project.counts) ? project.counts : {};
+  return [
+    cell(project.id),
+    cell(project.name),
+    repo,
+    cell(counts.tests),
+    cell(counts.groups),
+    formatEpoch(project.lastRunAt)
+  ];
+}
+function printProject(output, project) {
+  output.line(
+    `${output.bold("Project")}   ${cell(project.name)} ${output.dim(`(${cell(project.id)})`)}`
+  );
+  const repo = isRecord2(project.repo) ? `${cell(project.repo.provider)}:${cell(project.repo.repositoryId)}` : "not linked";
+  output.line(`${output.bold("Repo")}      ${repo}`);
+  const counts = isRecord2(project.counts) ? project.counts : {};
+  output.line(`${output.bold("Tests")}     ${cell(counts.tests)}`);
+  output.line(`${output.bold("Groups")}    ${cell(counts.groups)}`);
+  output.line(`${output.bold("Created")}   ${formatEpoch(project.createdAt)}`);
+  output.line(`${output.bold("Last run")}  ${formatEpoch(project.lastRunAt)}`);
+  if (project.archivedAt !== null && project.archivedAt !== void 0) {
+    output.line(
+      `${output.bold("Archived")}  ${formatEpoch(project.archivedAt)}`
+    );
+  }
+}
+var projectsList = {
+  words: ["projects", "list"],
+  summary: "projects list                List the organization's projects",
+  help: PROJECTS_HELP,
+  flags: {
+    ...LIST_FLAGS,
+    "include-archived": { type: "boolean", default: false }
+  },
+  async run(context, output, args) {
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const query = listQuery(args.values);
+    if (args.values["include-archived"] === true) {
+      query.push("includeArchived=true");
+    }
+    const suffix = query.length > 0 ? `?${query.join("&")}` : "";
+    const result = await api(context, key.value, {
+      method: "GET",
+      path: `/v1/projects${suffix}`
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitListJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    const projects = Array.isArray(result.data) ? result.data : [];
+    if (projects.length === 0) {
+      output.line(
+        'No projects. Create one: coldtea-qa projects create "Storefront"'
+      );
+    } else {
+      output.line(
+        renderTable(
+          ["ID", "NAME", "REPO", "TESTS", "GROUPS", "LAST RUN"],
+          projects.filter(isRecord2).map(projectRow)
+        )
+      );
+    }
+    nextCursorFootnote(output, result.nextCursor);
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var projectsCreate = {
+  words: ["projects", "create"],
+  summary: "projects create <name>       Create a project",
+  help: PROJECTS_HELP,
+  flags: {},
+  async run(context, output, args) {
+    const name = args.positionals[0];
+    if (!name) {
+      return usageError2(output, "Usage: coldtea-qa projects create <name>");
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const result = await api(context, key.value, {
+      method: "POST",
+      path: "/v1/projects",
+      body: { name }
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    if (isRecord2(result.data)) {
+      output.line(`Created project ${cell(result.data.id)}`);
+      printProject(output, result.data);
+    }
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var projectsGet = {
+  words: ["projects", "get"],
+  summary: "projects get <id>            Show one project",
+  help: PROJECTS_HELP,
+  flags: {},
+  async run(context, output, args) {
+    const projectId = args.positionals[0];
+    if (!projectId) {
+      return usageError2(output, "Usage: coldtea-qa projects get <projectId>");
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const result = await api(context, key.value, {
+      method: "GET",
+      path: `/v1/projects/${encodeURIComponent(projectId)}`
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    if (isRecord2(result.data)) {
+      const answeredId = asString(result.data.id);
+      if (answeredId !== null && answeredId !== projectId) {
+        output.line(
+          output.dim(
+            `${projectId} was merged away \u2014 showing the surviving project ${answeredId}.`
+          )
+        );
+      }
+      printProject(output, result.data);
+    }
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var projectsLinkRepo = {
+  words: ["projects", "link-repo"],
+  summary: "projects link-repo <id>      Link a repository (--provider, --repository-id)",
+  help: PROJECTS_HELP,
+  flags: {
+    provider: { type: "string" },
+    "repository-id": { type: "string" }
+  },
+  async run(context, output, args) {
+    const projectId = args.positionals[0];
+    const provider = args.values.provider;
+    const repositoryId = args.values["repository-id"];
+    if (!projectId || typeof provider !== "string" || typeof repositoryId !== "string") {
+      return usageError2(
+        output,
+        "Usage: coldtea-qa projects link-repo <projectId> --provider <github|bitbucket> --repository-id <id>"
+      );
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const result = await api(context, key.value, {
+      method: "POST",
+      path: `/v1/projects/${encodeURIComponent(projectId)}/repo`,
+      body: { provider, repositoryId }
+    });
+    if (!result.ok) {
+      const code = apiFailure2(output, result);
+      const details = isRecord2(result.error.details) ? result.error.details : {};
+      if (result.error.code === "report_name_taken" && Array.isArray(details.conflicts)) {
+        for (const conflict of details.conflicts.filter(isRecord2)) {
+          const takenBy = isRecord2(conflict.takenBy) ? `taken by ${cell(conflict.takenBy.projectName)} (${cell(conflict.takenBy.projectId)})` : "taken by another organization";
+          output.errorNote(`  \xB7 "${cell(conflict.reportName)}" \u2014 ${takenBy}`);
+        }
+        output.errorNote(
+          "  Rename those rules (or unlink on the other side), then link again."
+        );
+      }
+      if (result.error.code === "repo_already_linked" && isRecord2(details.repo)) {
+        output.errorNote(
+          `  Currently linked: ${cell(details.repo.provider)}:${cell(details.repo.repositoryId)}`
+        );
+      }
+      return code;
+    }
+    if (output.json) {
+      emitJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    if (isRecord2(result.data)) {
+      output.line(
+        `Linked ${cell(result.data.provider)}:${cell(result.data.repositoryId)} to ${projectId}`
+      );
+    }
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var projectCommands = [
+  projectsList,
+  projectsCreate,
+  projectsGet,
+  projectsLinkRepo
+];
+
+// src/commands/tests.ts
+var TESTS_HELP = `coldtea-qa tests \u2014 manage QA tests
+
+Usage
+  coldtea-qa tests list [--group <groupId>] [--limit <n>] [--cursor <c>]
+  coldtea-qa tests create <description> (--url <url> | --deployment | --mobile <android|ios>)
+                          [--title <t>] [--group <groupId>]
+  coldtea-qa tests get <testId>
+  coldtea-qa tests update <testId> [--title <t>] [--description <d>]
+                          [--url <url>] [--group <groupId>]
+  coldtea-qa tests delete <testId>
+
+Flags
+  --group        On list: only this group's tests. On create/update: the
+                 group the test belongs to (update --group moves it).
+  --url          create: the page a static_url test opens.
+                 update: change a static_url test's page.
+  --deployment   create: test the deployment URL of the linked repository
+  --mobile       create: test a mobile app build (android or ios)
+  --title        Short label (optional; the description is the test)
+  --description  update: replace the test's description
+
+Notes
+  list and create need a project (--project or COLDTEA_PROJECT_ID);
+  get/update/delete work on the test id alone. Exactly one target flag is
+  required on create. Deleting archives the test and cancels its runs.
+`;
+function chooseTarget(output, values) {
+  const chosen = [];
+  if (typeof values.url === "string") {
+    chosen.push({ type: "static_url", url: values.url });
+  }
+  if (values.deployment === true) {
+    chosen.push({ type: "deployment_url" });
+  }
+  if (typeof values.mobile === "string") {
+    if (values.mobile !== "android" && values.mobile !== "ios") {
+      usageError2(output, "--mobile must be android or ios");
+      return { ok: false };
+    }
+    chosen.push({ type: "mobile_app", platform: values.mobile });
+  }
+  if (chosen.length !== 1) {
+    usageError2(
+      output,
+      "A test needs exactly one target: --url <url>, --deployment, or --mobile <android|ios>"
+    );
+    return { ok: false };
+  }
+  return { ok: true, target: chosen[0] };
+}
+function describeTarget(target) {
+  if (!isRecord2(target)) {
+    return "\u2014";
+  }
+  switch (target.type) {
+    case "static_url":
+      return `url ${cell(target.url)}`;
+    case "deployment_url":
+      return "deployment";
+    case "mobile_app":
+      return `mobile ${cell(target.platform)}`;
+    default:
+      return cell(target.type);
+  }
+}
+function testRow(test) {
+  const label = typeof test.title === "string" && test.title !== "" ? test.title : typeof test.description === "string" ? test.description.length > 60 ? `${test.description.slice(0, 57)}\u2026` : test.description : "\u2014";
+  return [
+    cell(test.id),
+    label,
+    describeTarget(test.target),
+    cell(test.groupId),
+    formatEpoch(test.createdAt)
+  ];
+}
+function printTest(output, test) {
+  output.line(`${output.bold("Test")}         ${cell(test.id)}`);
+  output.line(`${output.bold("Title")}        ${cell(test.title)}`);
+  output.line(`${output.bold("Description")}  ${cell(test.description)}`);
+  output.line(`${output.bold("Target")}       ${describeTarget(test.target)}`);
+  output.line(`${output.bold("Group")}        ${cell(test.groupId)}`);
+  output.line(`${output.bold("Project")}      ${cell(test.projectId)}`);
+  const trigger = isRecord2(test.trigger) ? cell(test.trigger.type) : "\u2014";
+  output.line(`${output.bold("Trigger")}      ${trigger}`);
+  output.line(`${output.bold("Created")}      ${formatEpoch(test.createdAt)}`);
+  if (test.archivedAt !== null && test.archivedAt !== void 0) {
+    output.line(
+      `${output.bold("Archived")}     ${formatEpoch(test.archivedAt)}`
+    );
+  }
+}
+var testsList = {
+  words: ["tests", "list"],
+  summary: "tests list                   List a project's tests",
+  help: TESTS_HELP,
+  flags: { ...LIST_FLAGS, group: { type: "string" } },
+  async run(context, output, args) {
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const project = requireProjectId(context, output);
+    if (!project.ok) {
+      return project.code;
+    }
+    const query = listQuery(args.values);
+    if (typeof args.values.group === "string") {
+      query.push(`groupId=${encodeURIComponent(args.values.group)}`);
+    }
+    const suffix = query.length > 0 ? `?${query.join("&")}` : "";
+    const result = await api(context, key.value, {
+      method: "GET",
+      path: `/v1/projects/${encodeURIComponent(project.value)}/tests${suffix}`
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitListJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    const tests = Array.isArray(result.data) ? result.data : [];
+    if (tests.length === 0) {
+      output.line(
+        'No tests. Create one: coldtea-qa tests create "<what to check>" --url <url>'
+      );
+    } else {
+      output.line(
+        renderTable(
+          ["ID", "TEST", "TARGET", "GROUP", "CREATED"],
+          tests.filter(isRecord2).map(testRow)
+        )
+      );
+    }
+    nextCursorFootnote(output, result.nextCursor);
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var testsCreate = {
+  words: ["tests", "create"],
+  summary: "tests create <description>   Create a test (one target flag)",
+  help: TESTS_HELP,
+  flags: {
+    url: { type: "string" },
+    deployment: { type: "boolean", default: false },
+    mobile: { type: "string" },
+    title: { type: "string" },
+    group: { type: "string" }
+  },
+  async run(context, output, args) {
+    const description = args.positionals[0];
+    if (!description) {
+      return usageError2(
+        output,
+        "Usage: coldtea-qa tests create <description> (--url <url> | --deployment | --mobile <android|ios>)"
+      );
+    }
+    const choice = chooseTarget(output, args.values);
+    if (!choice.ok) {
+      return exitCodeFor2({ kind: "config_error" });
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const project = requireProjectId(context, output);
+    if (!project.ok) {
+      return project.code;
+    }
+    const body = {
+      description,
+      target: choice.target
+    };
+    if (typeof args.values.title === "string") {
+      body.title = args.values.title;
+    }
+    if (typeof args.values.group === "string") {
+      body.groupId = args.values.group;
+    }
+    const result = await api(context, key.value, {
+      method: "POST",
+      path: `/v1/projects/${encodeURIComponent(project.value)}/tests`,
+      body
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    if (isRecord2(result.data)) {
+      output.line(`Created test ${cell(result.data.id)}`);
+      printTest(output, result.data);
+    }
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var testsGet = {
+  words: ["tests", "get"],
+  summary: "tests get <id>               Show one test",
+  help: TESTS_HELP,
+  flags: {},
+  async run(context, output, args) {
+    const testId = args.positionals[0];
+    if (!testId) {
+      return usageError2(output, "Usage: coldtea-qa tests get <testId>");
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const result = await api(context, key.value, {
+      method: "GET",
+      path: `/v1/tests/${encodeURIComponent(testId)}`
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    if (isRecord2(result.data)) {
+      printTest(output, result.data);
+    }
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var testsUpdate = {
+  words: ["tests", "update"],
+  summary: "tests update <id>            Edit a test; --group moves it",
+  help: TESTS_HELP,
+  flags: {
+    title: { type: "string" },
+    description: { type: "string" },
+    url: { type: "string" },
+    group: { type: "string" }
+  },
+  async run(context, output, args) {
+    const testId = args.positionals[0];
+    if (!testId) {
+      return usageError2(
+        output,
+        "Usage: coldtea-qa tests update <testId> [--title] [--description] [--url] [--group]"
+      );
+    }
+    const body = {};
+    if (typeof args.values.title === "string") {
+      body.title = args.values.title;
+    }
+    if (typeof args.values.description === "string") {
+      body.description = args.values.description;
+    }
+    if (typeof args.values.url === "string") {
+      body.targetUrl = args.values.url;
+    }
+    if (typeof args.values.group === "string") {
+      body.groupId = args.values.group;
+    }
+    if (Object.keys(body).length === 0) {
+      return usageError2(
+        output,
+        "Nothing to update: pass at least one of --title, --description, --url, --group"
+      );
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const result = await api(context, key.value, {
+      method: "PATCH",
+      path: `/v1/tests/${encodeURIComponent(testId)}`,
+      body
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    if (isRecord2(result.data)) {
+      output.line(`Updated test ${cell(result.data.id)}`);
+      printTest(output, result.data);
+    }
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var testsDelete = {
+  words: ["tests", "delete"],
+  summary: "tests delete <id>            Archive a test (cancels its runs)",
+  help: TESTS_HELP,
+  flags: {},
+  async run(context, output, args) {
+    const testId = args.positionals[0];
+    if (!testId) {
+      return usageError2(output, "Usage: coldtea-qa tests delete <testId>");
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const result = await api(context, key.value, {
+      method: "DELETE",
+      path: `/v1/tests/${encodeURIComponent(testId)}`
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    output.line(`Archived test ${testId}`);
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var testCommands = [
+  testsList,
+  testsCreate,
+  testsGet,
+  testsUpdate,
+  testsDelete
+];
+
+// src/commands/groups.ts
+var GROUPS_HELP = `coldtea-qa groups \u2014 manage test groups
+
+Usage
+  coldtea-qa groups list [--limit <n>] [--cursor <c>]
+  coldtea-qa groups create <name> [--description <d>] [--environment <id>]
+  coldtea-qa groups get <groupId>
+  coldtea-qa groups update <groupId> [--name <n>] [--description <d>]
+                          [--environment <id> | --environment none]
+  coldtea-qa groups delete <groupId>
+
+Flags
+  --environment <id>  Where this group's runs open, unless a run overrides it
+                      with its own --environment. Pass "none" to clear it and
+                      have runs open signed out.
+
+Notes
+  list and create need a project (--project or COLDTEA_PROJECT_ID);
+  get/update/delete work on the group id alone. Deleting archives the
+  group AND its tests, and cancels their runs.
+`;
+function readEnvironmentFlag(value) {
+  if (typeof value !== "string" || value.trim() === "") {
+    return void 0;
+  }
+  return value.trim() === "none" ? null : value.trim();
+}
+function groupRow(group) {
+  const settings = isRecord2(group.settings) ? group.settings : {};
+  return [
+    cell(group.id),
+    cell(group.name),
+    cell(group.description),
+    cell(settings.environmentId),
+    formatEpoch(group.createdAt)
+  ];
+}
+function printGroup(output, group) {
+  output.line(
+    `${output.bold("Group")}        ${cell(group.name)} ${output.dim(`(${cell(group.id)})`)}`
+  );
+  output.line(`${output.bold("Description")}  ${cell(group.description)}`);
+  output.line(`${output.bold("Project")}      ${cell(group.projectId)}`);
+  const settings = isRecord2(group.settings) ? group.settings : {};
+  output.line(
+    `${output.bold("Environment")}  ${settings.environmentId === null ? "none \u2014 runs open signed out" : cell(settings.environmentId)}`
+  );
+  output.line(`${output.bold("Created")}      ${formatEpoch(group.createdAt)}`);
+  if (group.archivedAt !== null && group.archivedAt !== void 0) {
+    output.line(
+      `${output.bold("Archived")}     ${formatEpoch(group.archivedAt)}`
+    );
+  }
+}
+var groupsList = {
+  words: ["groups", "list"],
+  summary: "groups list                  List a project's groups",
+  help: GROUPS_HELP,
+  flags: { ...LIST_FLAGS },
+  async run(context, output, args) {
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const project = requireProjectId(context, output);
+    if (!project.ok) {
+      return project.code;
+    }
+    const query = listQuery(args.values);
+    const suffix = query.length > 0 ? `?${query.join("&")}` : "";
+    const result = await api(context, key.value, {
+      method: "GET",
+      path: `/v1/projects/${encodeURIComponent(project.value)}/groups${suffix}`
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitListJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    const groups = Array.isArray(result.data) ? result.data : [];
+    if (groups.length === 0) {
+      output.line('No groups. Create one: coldtea-qa groups create "Smoke"');
+    } else {
+      output.line(
+        renderTable(
+          ["ID", "NAME", "DESCRIPTION", "ENVIRONMENT", "CREATED"],
+          groups.filter(isRecord2).map(groupRow)
+        )
+      );
+    }
+    nextCursorFootnote(output, result.nextCursor);
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var groupsCreate = {
+  words: ["groups", "create"],
+  summary: "groups create <name>         Create a group",
+  help: GROUPS_HELP,
+  flags: {
+    description: { type: "string" },
+    environment: { type: "string" }
+  },
+  async run(context, output, args) {
+    const name = args.positionals[0];
+    if (!name) {
+      return usageError2(output, "Usage: coldtea-qa groups create <name>");
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const project = requireProjectId(context, output);
+    if (!project.ok) {
+      return project.code;
+    }
+    const body = { name };
+    if (typeof args.values.description === "string") {
+      body.description = args.values.description;
+    }
+    const environment = readEnvironmentFlag(args.values.environment);
+    if (environment !== void 0) {
+      body.settings = { environmentId: environment };
+    }
+    const result = await api(context, key.value, {
+      method: "POST",
+      path: `/v1/projects/${encodeURIComponent(project.value)}/groups`,
+      body
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    if (isRecord2(result.data)) {
+      output.line(`Created group ${cell(result.data.id)}`);
+      printGroup(output, result.data);
+    }
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var groupsGet = {
+  words: ["groups", "get"],
+  summary: "groups get <id>              Show one group",
+  help: GROUPS_HELP,
+  flags: {},
+  async run(context, output, args) {
+    const groupId = args.positionals[0];
+    if (!groupId) {
+      return usageError2(output, "Usage: coldtea-qa groups get <groupId>");
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const result = await api(context, key.value, {
+      method: "GET",
+      path: `/v1/groups/${encodeURIComponent(groupId)}`
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    if (isRecord2(result.data)) {
+      printGroup(output, result.data);
+    }
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var groupsUpdate = {
+  words: ["groups", "update"],
+  summary: "groups update <id>           Rename or re-describe a group",
+  help: GROUPS_HELP,
+  flags: {
+    name: { type: "string" },
+    description: { type: "string" },
+    environment: { type: "string" }
+  },
+  async run(context, output, args) {
+    const groupId = args.positionals[0];
+    if (!groupId) {
+      return usageError2(
+        output,
+        "Usage: coldtea-qa groups update <groupId> [--name] [--description]"
+      );
+    }
+    const body = {};
+    if (typeof args.values.name === "string") {
+      body.name = args.values.name;
+    }
+    if (typeof args.values.description === "string") {
+      body.description = args.values.description;
+    }
+    const environment = readEnvironmentFlag(args.values.environment);
+    if (environment !== void 0) {
+      body.settings = { environmentId: environment };
+    }
+    if (Object.keys(body).length === 0) {
+      return usageError2(
+        output,
+        "Nothing to update: pass --name, --description and/or --environment"
+      );
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const result = await api(context, key.value, {
+      method: "PATCH",
+      path: `/v1/groups/${encodeURIComponent(groupId)}`,
+      body
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    if (isRecord2(result.data)) {
+      output.line(`Updated group ${cell(result.data.id)}`);
+      printGroup(output, result.data);
+    }
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var groupsDelete = {
+  words: ["groups", "delete"],
+  summary: "groups delete <id>           Archive a group and its tests",
+  help: GROUPS_HELP,
+  flags: {},
+  async run(context, output, args) {
+    const groupId = args.positionals[0];
+    if (!groupId) {
+      return usageError2(output, "Usage: coldtea-qa groups delete <groupId>");
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const result = await api(context, key.value, {
+      method: "DELETE",
+      path: `/v1/groups/${encodeURIComponent(groupId)}`
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    output.line(`Archived group ${groupId} (its tests are archived too)`);
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var groupCommands = [
+  groupsList,
+  groupsCreate,
+  groupsGet,
+  groupsUpdate,
+  groupsDelete
+];
+
+// src/crid.ts
+import { randomBytes } from "node:crypto";
+import { execFileSync } from "node:child_process";
+var CI_SHA_ENV_VARS = [
+  "GITHUB_SHA",
+  // GitHub Actions
+  "CI_COMMIT_SHA",
+  // GitLab CI
+  "CIRCLE_SHA1",
+  // CircleCI
+  "BITBUCKET_COMMIT",
+  // Bitbucket Pipelines
+  "BUILDKITE_COMMIT",
+  // Buildkite
+  "VERCEL_GIT_COMMIT_SHA"
+  // Vercel builds
+];
+var SHA_PATTERN = /^[0-9a-f]{7,64}$/i;
+function defaultResolveGitSha() {
+  try {
+    const sha = execFileSync("git", ["rev-parse", "HEAD"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 2e3
+    }).trim();
+    return SHA_PATTERN.test(sha) ? sha : null;
+  } catch {
+    return null;
+  }
+}
+function defaultRandom() {
+  return randomBytes(6).toString("hex");
+}
+function discoverSha(options = {}) {
+  const env = options.env ?? process.env;
+  for (const name of CI_SHA_ENV_VARS) {
+    const value = env[name]?.trim();
+    if (value && SHA_PATTERN.test(value)) {
+      return value.toLowerCase();
+    }
+  }
+  return (options.resolveGitSha ?? defaultResolveGitSha)();
+}
+function deriveClientRequestId(testId, options = {}) {
+  const sha = discoverSha(options);
+  const suffix = sha ?? (options.random ?? defaultRandom)();
+  return `mqcr_${testId}_${suffix}`;
+}
+
+// src/duration.ts
+var DURATION_PATTERN = /^(\d+)(ms|s|m|h)?$/;
+var UNIT_MS = {
+  ms: 1,
+  s: 1e3,
+  m: 6e4,
+  h: 36e5
+};
+function parseDuration(raw) {
+  const match = DURATION_PATTERN.exec(raw.trim());
+  if (!match) {
+    return null;
+  }
+  const value = Number(match[1]);
+  const ms = value * UNIT_MS[match[2] ?? "s"];
+  return ms > 0 ? ms : null;
+}
+function formatDuration(ms) {
+  if (ms % 36e5 === 0) {
+    return `${ms / 36e5}h`;
+  }
+  if (ms % 6e4 === 0) {
+    return `${ms / 6e4}m`;
+  }
+  if (ms % 1e3 === 0) {
+    return `${ms / 1e3}s`;
+  }
+  return `${ms}ms`;
+}
+
+// src/poll.ts
+var DEFAULT_POLL_INTERVAL_MS = 3e3;
+var FAILURE_TOLERANCE = 3;
+async function poll(input) {
+  const intervalMs = input.intervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  const deadline = input.now() + input.timeoutMs;
+  let last = null;
+  let consecutiveFailures = 0;
+  for (; ; ) {
+    const step = await input.step();
+    if ("failure" in step) {
+      consecutiveFailures += 1;
+      if (!step.retryable || consecutiveFailures >= FAILURE_TOLERANCE) {
+        return { kind: "failed", failure: step.failure };
+      }
+    } else {
+      consecutiveFailures = 0;
+      if (step.done) {
+        return { kind: "done", value: step.value };
+      }
+      last = step.value;
+    }
+    if (input.now() >= deadline) {
+      return { kind: "timeout", last };
+    }
+    await input.sleep(intervalMs);
+  }
+}
+
+// src/commands/run.ts
+var RUN_HELP = `coldtea-qa run \u2014 start QA runs
+
+Usage
+  coldtea-qa run test <testId> [flags]
+  coldtea-qa run group <groupId> [flags]
+
+Flags
+  --wait               Follow the run(s) to a verdict; exit reflects it
+  --timeout <dur>      With --wait: how long to follow (90s, 10m, 2h;
+                       bare numbers are seconds; default 30m)
+  --label <text>       Label the run(s) in the dashboard
+  --target-url <url>   The deployment to test (required when the test
+                       targets deployment_url)
+  --build <artifactId> The uploaded build to run against (mobile tests
+                       without a default build)
+  --environment <id>   Run in this environment instead of the group's,
+                       replacing it whole rather than merging. Pass
+                       "none" to run signed out, as nobody; omit it to
+                       inherit the group's environment.
+
+Attaching a run to a pull request
+  --vcs-provider <p>        github or bitbucket
+  --vcs-repository-id <id>  The provider's stable repository id
+  --vcs-head-sha <sha>      The commit under test
+  --vcs-pr-number <n>       The pull request this run is for
+
+All four travel together; pass none of them to run without a pull
+request. They STAMP the run with its commit and PR so the dashboard and
+the report page show what was tested. They do NOT post a check back onto
+the PR: check names are reserved per repository by rules, so a check from
+CI comes from a webhook rule (POST /v1/hooks/<token>), not from here.
+
+An empty value counts as absent, so passing an unset CI variable (a branch
+build's $BITRISE_PULL_REQUEST, say) is safe rather than fatal.
+
+Exit codes (with --wait)
+  0 every run passed (warnings pass unless --fail-on-warning)
+  1 a run failed \u2014 the app is broken
+  2 couldn't run or verify, timed out, or the batch skipped tests
+Without --wait: 0 once the queue accepts, except a partial batch, which
+exits 2 \u2014 a test skipped at admission never ran, and neither did a queued
+run the listing does not show.
+
+A run whose outcome this CLI does not recognise is never dropped from a
+batch: the command fails and names it, because the alternative is exit 0
+on a batch it could not read.
+
+Retries
+  In CI, re-running the SAME commit with the SAME flags replays the
+  original run instead of billing twice. Same commit but DIFFERENT flags
+  (--label, --target-url, --build) answers 409 idempotency_key_reused by
+  design \u2014 keep the flags identical, or run on a new commit.
+`;
+var DEFAULT_WAIT_TIMEOUT_MS = 30 * 6e4;
+function asOutcome(value) {
+  return typeof value === "string" && RUN_OUTCOMES.has(value) ? value : null;
+}
+function resolveTimeout(output, values) {
+  if (typeof values.timeout !== "string") {
+    return { ok: true, timeoutMs: DEFAULT_WAIT_TIMEOUT_MS };
+  }
+  const timeoutMs = parseDuration(values.timeout);
+  if (timeoutMs === null) {
+    usageError2(
+      output,
+      "--timeout must be a positive duration like 90s, 10m or 2h"
+    );
+    return { ok: false };
+  }
+  return { ok: true, timeoutMs };
+}
+function startFailure(output, result, sentVcs) {
+  const code = apiFailure2(output, result);
+  if (sentVcs && result.error.code === "identity_unverifiable") {
+    output.errorNote(
+      "The --vcs-* flags are verified against the provider, so they need the Coldtea GitHub App connected to that repository. Without it, start the run without them: it still runs, it just is not attached to a pull request."
+    );
+  }
+  return code;
+}
+function startBody(crid, values, vcs) {
+  const body = { clientRequestId: crid };
+  if (vcs !== null) {
+    body.vcs = vcs;
+  }
+  const environment = typeof values.environment === "string" ? values.environment.trim() : "";
+  if (environment !== "") {
+    body.environmentId = environment === "none" ? null : environment;
+  }
+  if (typeof values.label === "string") {
+    body.label = values.label;
+  }
+  if (typeof values["target-url"] === "string") {
+    body.targetUrl = values["target-url"];
+  }
+  if (typeof values.build === "string") {
+    body.buildReference = {
+      type: "uploaded_file",
+      artifactId: values.build
+    };
+  }
+  return body;
+}
+var MALFORMED_RUN = {
+  code: "invalid_response",
+  message: "The /v1 run payload is missing expected fields",
+  retryable: true
+};
+function readRunView(data) {
+  if (!isRecord2(data)) {
+    return { ok: false, problem: MALFORMED_RUN };
+  }
+  const runId = asString(data.id);
+  if (runId === null || typeof data.outcome !== "string") {
+    return { ok: false, problem: MALFORMED_RUN };
+  }
+  const outcome = asOutcome(data.outcome);
+  if (outcome === null) {
+    return {
+      ok: false,
+      problem: {
+        code: "unsupported_outcome",
+        message: `Run ${runId} reports outcome "${data.outcome}", which this coldtea-qa does not know how to judge. Upgrade the CLI.`,
+        retryable: false
+      }
+    };
+  }
+  const runIssue = isRecord2(data.runIssue) ? {
+    kind: asString(data.runIssue.kind),
+    message: asString(data.runIssue.message)
+  } : null;
+  return {
+    ok: true,
+    view: {
+      runId,
+      outcome,
+      status: asString(data.status),
+      liveViewUrl: asString(data.liveViewUrl),
+      reportUrl: asString(data.reportUrl),
+      runIssue,
+      summary: asString(data.summary),
+      raw: data
+    }
+  };
+}
+function runViewFailure(problem, requestId) {
+  return {
+    ok: false,
+    status: 0,
+    error: { code: problem.code, message: problem.message, details: null },
+    requestId
+  };
+}
+function invalidRunResponse(output, requestId) {
+  output.error(
+    {
+      code: "invalid_response",
+      message: "The /v1 run payload is missing expected fields",
+      details: null
+    },
+    requestId
+  );
+  return exitCodeFor2({
+    kind: "api_error",
+    status: 0,
+    code: "invalid_response"
+  });
+}
+function printRunLine(output, view) {
+  const outcome = view.outcome === "failed" ? output.red(view.outcome) : view.outcome;
+  const reason = view.runIssue?.message ?? view.summary ?? view.runIssue?.kind ?? null;
+  const issue = reason === null ? "" : ` \u2014 ${reason}`;
+  output.line(`${view.runId}  ${outcome}${issue}`);
+  const link = view.reportUrl ?? view.liveViewUrl;
+  if (link !== null) {
+    output.line(`  ${output.dim(link)}`);
+  }
+}
+var runTest = {
+  words: ["run", "test"],
+  summary: "run test <id>                Start one test run (--wait follows it)",
+  help: RUN_HELP,
+  flags: {
+    wait: { type: "boolean", default: false },
+    environment: { type: "string" },
+    ...VCS_FLAGS,
+    timeout: { type: "string" },
+    label: { type: "string" },
+    "target-url": { type: "string" },
+    build: { type: "string" }
+  },
+  async run(context, output, args) {
+    const testId = args.positionals[0];
+    if (!testId) {
+      return usageError2(output, "Usage: coldtea-qa run test <testId>");
+    }
+    const timeout = resolveTimeout(output, args.values);
+    if (!timeout.ok) {
+      return exitCodeFor2({ kind: "config_error" });
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const vcsFlags = readVcsFlags(output, args.values, {
+      requirePrNumber: true
+    });
+    if (!vcsFlags.ok) {
+      return exitCodeFor2({ kind: "config_error" });
+    }
+    const crid = deriveClientRequestId(testId, { env: context.env });
+    const started = await api(context, key.value, {
+      method: "POST",
+      path: `/v1/tests/${encodeURIComponent(testId)}/runs`,
+      body: startBody(crid, args.values, vcsFlags.vcs)
+    });
+    if (!started.ok) {
+      return startFailure(output, started, vcsFlags.vcs !== null);
+    }
+    const runId = isRecord2(started.data) ? asString(started.data.runId) : null;
+    if (runId === null) {
+      return invalidRunResponse(output, started.requestId);
+    }
+    const replayed = isRecord2(started.data) && started.data.replayed === true;
+    if (args.values.wait !== true) {
+      const read = await api(context, key.value, {
+        method: "GET",
+        path: `/v1/runs/${encodeURIComponent(runId)}`
+      });
+      const parsed = read.ok ? readRunView(read.data) : null;
+      const view2 = parsed?.ok === true ? parsed.view : null;
+      if (output.json) {
+        output.success(view2?.raw ?? started.data, {});
+        return exitCodeFor2({ kind: "success" });
+      }
+      output.line(
+        replayed ? `Replayed run ${runId} \u2014 an earlier request for this test on this commit started it. Nothing new was queued.` : `Queued run ${runId}`
+      );
+      const link = view2?.reportUrl ?? view2?.liveViewUrl;
+      if (link) {
+        output.line(output.dim(link));
+      }
+      return exitCodeFor2({ kind: "success" });
+    }
+    let urlPrinted = false;
+    const result = await poll({
+      timeoutMs: timeout.timeoutMs,
+      sleep: context.sleep,
+      now: context.now,
+      step: async () => {
+        const read = await api(context, key.value, {
+          method: "GET",
+          path: `/v1/runs/${encodeURIComponent(runId)}`
+        });
+        if (!read.ok) {
+          return { failure: read, retryable: isRetryableFailure(read) };
+        }
+        const parsed = readRunView(read.data);
+        if (!parsed.ok) {
+          return {
+            failure: runViewFailure(parsed.problem, read.requestId),
+            retryable: parsed.problem.retryable
+          };
+        }
+        const view2 = parsed.view;
+        if (!urlPrinted && view2.liveViewUrl !== null) {
+          output.line(output.dim(`Live view: ${view2.liveViewUrl}`));
+          urlPrinted = true;
+        }
+        return { done: view2.outcome !== "in_progress", value: view2 };
+      }
+    });
+    if (result.kind === "failed") {
+      return pollUnreadable(output, result.failure, `Run ${runId}`);
+    }
+    if (result.kind === "timeout") {
+      const view2 = result.last;
+      if (output.json) {
+        output.success(view2?.raw ?? started.data, {});
+      } else {
+        output.line(
+          `Run ${runId} still in progress after ${formatDuration(timeout.timeoutMs)}`
+        );
+        const link = view2?.reportUrl ?? view2?.liveViewUrl;
+        if (link) {
+          output.line(output.dim(link));
+        }
+      }
+      return exitCodeFor2({
+        kind: "run",
+        outcome: "in_progress",
+        failOnWarning: context.flags.failOnWarning
+      });
+    }
+    const view = result.value;
+    if (output.json) {
+      output.success(view.raw, {});
+    } else {
+      printRunLine(output, view);
+    }
+    return exitCodeFor2({
+      kind: "run",
+      outcome: view.outcome,
+      failOnWarning: context.flags.failOnWarning
+    });
+  }
+};
+function pollUnreadable(output, failure, startedWhat) {
+  const code = apiFailure2(output, failure);
+  if (failure.error.code === "insufficient_scope") {
+    output.errorNote(
+      `  ${startedWhat} was started and IS running \u2014 this key just cannot read it back. Starting a run needs qa:run; following one needs qa:read. Use a key with both, or drop --wait and read the run with a qa:read key once it settles.`
+    );
+  }
+  return code;
+}
+async function fetchBatchRuns(context, apiKey, batchId) {
+  const views = [];
+  let cursor = null;
+  do {
+    const query = `batchId=${encodeURIComponent(batchId)}&limit=100${cursor === null ? "" : `&cursor=${encodeURIComponent(cursor)}`}`;
+    const page = await api(context, apiKey, {
+      method: "GET",
+      path: `/v1/runs?${query}`
+    });
+    if (!page.ok) {
+      return { ok: false, failure: page, retryable: isRetryableFailure(page) };
+    }
+    for (const item of Array.isArray(page.data) ? page.data : []) {
+      const parsed = readRunView(item);
+      if (!parsed.ok) {
+        return {
+          ok: false,
+          failure: runViewFailure(parsed.problem, page.requestId),
+          retryable: parsed.problem.retryable
+        };
+      }
+      views.push(parsed.view);
+    }
+    cursor = page.nextCursor;
+  } while (cursor !== null);
+  return { ok: true, views };
+}
+function batchCounters(data) {
+  const record = isRecord2(data) ? data : {};
+  const credits = isRecord2(record.insufficientCredits) ? {
+    cost: record.insufficientCredits.cost,
+    available: record.insufficientCredits.available
+  } : null;
+  return {
+    batchId: asString(record.batchId),
+    runCount: Array.isArray(record.runs) ? record.runs.length : 0,
+    // Absent on a server that predates the field, and `false` is the safe
+    // read: it means "say nothing extra" rather than "claim a replay".
+    replayed: record.replayed === true,
+    skippedCount: typeof record.skippedCount === "number" ? record.skippedCount : 0,
+    failedCount: typeof record.failedCount === "number" ? record.failedCount : 0,
+    insufficientCredits: credits
+  };
+}
+function reportUnseenRuns(output, queued, visible) {
+  output.error({
+    code: "incomplete_batch",
+    message: `The batch queued ${queued} run(s) but only ${visible} came back from /v1/runs. The missing run(s) were not judged.`,
+    details: { queued, visible }
+  });
+}
+var runGroup = {
+  words: ["run", "group"],
+  summary: "run group <id>               Start a batch of a group's tests",
+  help: RUN_HELP,
+  flags: {
+    wait: { type: "boolean", default: false },
+    environment: { type: "string" },
+    ...VCS_FLAGS,
+    timeout: { type: "string" },
+    label: { type: "string" },
+    "target-url": { type: "string" },
+    build: { type: "string" }
+  },
+  async run(context, output, args) {
+    const groupId = args.positionals[0];
+    if (!groupId) {
+      return usageError2(output, "Usage: coldtea-qa run group <groupId>");
+    }
+    const timeout = resolveTimeout(output, args.values);
+    if (!timeout.ok) {
+      return exitCodeFor2({ kind: "config_error" });
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const vcsFlags = readVcsFlags(output, args.values, {
+      requirePrNumber: true
+    });
+    if (!vcsFlags.ok) {
+      return exitCodeFor2({ kind: "config_error" });
+    }
+    const crid = deriveClientRequestId(groupId, { env: context.env });
+    const started = await api(context, key.value, {
+      method: "POST",
+      path: `/v1/groups/${encodeURIComponent(groupId)}/runs`,
+      body: startBody(crid, args.values, vcsFlags.vcs)
+    });
+    if (!started.ok) {
+      return startFailure(output, started, vcsFlags.vcs !== null);
+    }
+    const counters = batchCounters(started.data);
+    const batchId = counters.batchId;
+    if (batchId === null) {
+      return invalidRunResponse(output, started.requestId);
+    }
+    const neverRan = counters.skippedCount + counters.failedCount;
+    if (counters.runCount === 0 && neverRan === 0) {
+      if (!output.json) {
+        output.line(
+          `Batch ${counters.batchId}: 0 run(s) queued \u2014 nothing was tested.`
+        );
+      } else {
+        emitJson(output, started);
+      }
+      output.errorNote(
+        counters.replayed ? "  This is a REPLAY of an earlier batch for this group on this commit, which was empty when it ran. Nothing new started, and adding tests will not change it. Re-run on a new commit, or pass --label to start a fresh batch." : `  Group ${groupId} has no tests to run. See what is in it: coldtea-qa tests list --group ${groupId}`
+      );
+      return exitCodeFor2({
+        kind: "batch",
+        worstOutcome: "couldnt_run",
+        skippedCount: 0,
+        failOnWarning: context.flags.failOnWarning
+      });
+    }
+    if (!output.json) {
+      output.line(
+        `Batch ${counters.batchId}: ${counters.runCount} run(s) queued`
+      );
+      if (counters.skippedCount > 0) {
+        output.line(`Skipped at admission: ${counters.skippedCount}`);
+      }
+      if (counters.failedCount > 0) {
+        output.line(`Failed to start: ${counters.failedCount}`);
+      }
+      if (counters.insufficientCredits !== null) {
+        output.line(
+          `Insufficient credits: needs ${cell(counters.insufficientCredits.cost)}, available ${cell(counters.insufficientCredits.available)}`
+        );
+      }
+    }
+    if (counters.replayed && !output.json) {
+      output.line(
+        output.dim(
+          "Replayed: an earlier request for this group on this commit started these runs. Nothing new was queued."
+        )
+      );
+    }
+    if (args.values.wait !== true) {
+      const listed = await fetchBatchRuns(context, key.value, batchId);
+      if (output.json) {
+        emitJson(output, started);
+      }
+      if (!listed.ok) {
+        return apiFailure2(output, listed.failure);
+      }
+      if (!output.json) {
+        for (const view of listed.views) {
+          output.line(`${view.runId}  ${cell(view.status)}`);
+          const link = view.reportUrl ?? view.liveViewUrl;
+          if (link !== null) {
+            output.line(`  ${output.dim(link)}`);
+          }
+        }
+      }
+      const unseen = Math.max(counters.runCount - listed.views.length, 0);
+      if (unseen > 0) {
+        reportUnseenRuns(output, counters.runCount, listed.views.length);
+      }
+      const unaccounted = neverRan + unseen;
+      if (unaccounted > 0) {
+        return exitCodeFor2({
+          kind: "batch",
+          worstOutcome: "passed",
+          skippedCount: unaccounted,
+          failOnWarning: context.flags.failOnWarning
+        });
+      }
+      return exitCodeFor2({ kind: "success" });
+    }
+    if (counters.runCount === 0) {
+      if (output.json) {
+        emitJson(output, started);
+      }
+      if (neverRan > 0) {
+        return exitCodeFor2({
+          kind: "batch",
+          worstOutcome: "passed",
+          skippedCount: neverRan,
+          failOnWarning: context.flags.failOnWarning
+        });
+      }
+      return exitCodeFor2({ kind: "success" });
+    }
+    const result = await poll({
+      timeoutMs: timeout.timeoutMs,
+      sleep: context.sleep,
+      now: context.now,
+      step: async () => {
+        const listed = await fetchBatchRuns(context, key.value, batchId);
+        if (!listed.ok) {
+          return { failure: listed.failure, retryable: listed.retryable };
+        }
+        const done = listed.views.length >= counters.runCount && listed.views.every((view) => view.outcome !== "in_progress");
+        return { done, value: listed.views };
+      }
+    });
+    if (result.kind === "failed") {
+      return pollUnreadable(output, result.failure, `Batch ${batchId}`);
+    }
+    const timedOut = result.kind === "timeout";
+    const views = timedOut ? result.last ?? [] : result.value;
+    if (output.json) {
+      output.success(
+        {
+          batchId,
+          skippedCount: counters.skippedCount,
+          failedCount: counters.failedCount,
+          insufficientCredits: counters.insufficientCredits,
+          timedOut,
+          runs: views.map((view) => view.raw)
+        },
+        {}
+      );
+    } else {
+      if (timedOut) {
+        output.line(
+          `Batch ${batchId} still in progress after ${formatDuration(timeout.timeoutMs)}`
+        );
+      }
+      for (const view of views) {
+        printRunLine(output, view);
+      }
+    }
+    if (views.length < counters.runCount) {
+      reportUnseenRuns(output, counters.runCount, views.length);
+    }
+    const worstOutcome = timedOut ? worstOf(["in_progress", ...views.map((view) => view.outcome)]) : worstOf(views.map((view) => view.outcome));
+    return exitCodeFor2({
+      kind: "batch",
+      worstOutcome,
+      skippedCount: neverRan,
+      failOnWarning: context.flags.failOnWarning
+    });
+  }
+};
+var runCommands = [runTest, runGroup];
+
+// src/commands/runs.ts
+var RUNS_HELP = `coldtea-qa runs \u2014 inspect runs
+
+Usage
+  coldtea-qa runs get <runId>
+  coldtea-qa runs stop <runId>
+  coldtea-qa runs list [scope] [filters] [--limit <n>] [--cursor <c>]
+
+Scope (at most one; --test/--group/--batch override --project)
+  --project <id>    Runs in one project (or COLDTEA_PROJECT_ID)
+  --test <id>       One test's runs
+  --group <id>      One group's runs
+  --batch <id>      One batch's runs
+
+Filters
+  --status <s,\u2026>    queued, running, waiting, stopping, completed,
+                    failed, canceled (comma-separate for several)
+  --outcome <o,\u2026>   in_progress, passed, failed, warning,
+                    couldnt_verify, couldnt_run
+  --since <when>    Only runs created at/after this moment \u2014 epoch
+                    milliseconds or an ISO-8601 date/time
+
+Newest first. With no scope, the whole organization's runs.
+
+READ \`outcome\`, NOT \`status\`. A run that could not reach a verdict reports
+status "failed" with outcome "couldnt_verify" \u2014 branching on status calls an
+app broken when nothing was.
+`;
+function sinceToEpochMs(raw) {
+  if (/^\d+$/.test(raw)) {
+    return Number(raw);
+  }
+  const parsed = Date.parse(raw);
+  return Number.isNaN(parsed) ? null : parsed;
+}
+function runRow(run) {
+  return [
+    cell(run.id),
+    cell(run.status),
+    cell(run.outcome),
+    cell(run.testId),
+    cell(run.batchId),
+    formatEpoch(run.createdAt)
+  ];
+}
+var runsGet = {
+  words: ["runs", "get"],
+  summary: "runs get <id>                Show one run and why it ended that way",
+  help: RUNS_HELP,
+  flags: {},
+  async run(context, output, args) {
+    const runId = args.positionals[0];
+    if (!runId) {
+      return usageError2(output, "Usage: coldtea-qa runs get <runId>");
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const result = await api(context, key.value, {
+      method: "GET",
+      path: `/v1/runs/${encodeURIComponent(runId)}`
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    if (!isRecord2(result.data)) {
+      return exitCodeFor2({ kind: "success" });
+    }
+    const run = result.data;
+    output.line(`${output.bold("Run")}       ${cell(run.id)}`);
+    output.line(`${output.bold("Outcome")}   ${cell(run.outcome)}`);
+    output.line(
+      `${output.bold("Status")}    ${cell(run.status)} ${output.dim("(read outcome, not this)")}`
+    );
+    const issue = isRecord2(run.runIssue) ? run.runIssue : null;
+    if (issue) {
+      output.line(
+        `${output.bold("Why")}       ${cell(issue.message ?? issue.kind)}`
+      );
+    }
+    output.line(`${output.bold("Test")}      ${cell(run.testId)}`);
+    output.line(`${output.bold("Target")}    ${cell(run.targetUrl)}`);
+    output.line(`${output.bold("Started")}   ${formatEpoch(run.createdAt)}`);
+    output.line(`${output.bold("Finished")}  ${formatEpoch(run.completedAt)}`);
+    if (typeof run.summary === "string" && run.summary !== "") {
+      output.line();
+      output.line(run.summary);
+    }
+    if (typeof run.reportUrl === "string") {
+      output.line();
+      output.line(output.dim(run.reportUrl));
+    }
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var runsList = {
+  words: ["runs", "list"],
+  summary: "runs list                    List runs (filters mirror the API)",
+  help: RUNS_HELP,
+  flags: {
+    ...LIST_FLAGS,
+    test: { type: "string" },
+    group: { type: "string" },
+    batch: { type: "string" },
+    status: { type: "string" },
+    outcome: { type: "string" },
+    since: { type: "string" }
+  },
+  async run(context, output, args) {
+    const explicitScopes = ["test", "group", "batch"].filter(
+      (name) => typeof args.values[name] === "string"
+    );
+    if (explicitScopes.length > 1) {
+      return usageError2(
+        output,
+        "Pick one scope: --test, --group or --batch (they cannot combine)"
+      );
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const query = listQuery(args.values);
+    if (explicitScopes.length === 1) {
+      const name = explicitScopes[0];
+      const param = { test: "testId", group: "groupId", batch: "batchId" }[name];
+      query.push(`${param}=${encodeURIComponent(args.values[name])}`);
+    } else if (context.projectId !== null) {
+      query.push(`projectId=${encodeURIComponent(context.projectId)}`);
+    }
+    if (typeof args.values.status === "string") {
+      query.push(`status=${encodeURIComponent(args.values.status)}`);
+    }
+    if (typeof args.values.outcome === "string") {
+      query.push(`outcome=${encodeURIComponent(args.values.outcome)}`);
+    }
+    if (typeof args.values.since === "string") {
+      const since = sinceToEpochMs(args.values.since);
+      if (since === null) {
+        return usageError2(
+          output,
+          "--since must be epoch milliseconds or an ISO-8601 date/time"
+        );
+      }
+      query.push(`since=${since}`);
+    }
+    const suffix = query.length > 0 ? `?${query.join("&")}` : "";
+    const result = await api(context, key.value, {
+      method: "GET",
+      path: `/v1/runs${suffix}`
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitListJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    const runs = Array.isArray(result.data) ? result.data : [];
+    if (runs.length === 0) {
+      output.line("No runs.");
+    } else {
+      output.line(
+        renderTable(
+          ["ID", "STATUS", "OUTCOME", "TEST", "BATCH", "CREATED"],
+          runs.filter(isRecord2).map(runRow)
+        )
+      );
+    }
+    nextCursorFootnote(output, result.nextCursor);
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var runsStop = {
+  words: ["runs", "stop"],
+  summary: "runs stop <id>               Stop a run that is still going",
+  help: RUNS_HELP,
+  flags: {},
+  async run(context, output, args) {
+    const runId = args.positionals[0];
+    if (!runId) {
+      return usageError2(output, "Usage: coldtea-qa runs stop <runId>");
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const result = await api(context, key.value, {
+      method: "POST",
+      path: `/v1/runs/${encodeURIComponent(runId)}/stop`
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    const status = isRecord2(result.data) ? cell(result.data.status) : "\u2014";
+    output.line(
+      result.status === 202 ? `Stopping run ${runId} (${status})` : `Run ${runId} had already settled (${status})`
+    );
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var runsCommands = [runsGet, runsStop, runsList];
+
+// src/commands/builds.ts
+import { createHash } from "node:crypto";
+import { createReadStream, openAsBlob, promises as fs } from "node:fs";
+import { basename } from "node:path";
+var BUILDS_HELP = `coldtea-qa builds \u2014 upload app builds
+
+Usage
+  coldtea-qa builds upload <file> --platform <android|ios> [flags]
+  coldtea-qa builds get <buildId>
+
+Flags
+  --platform <p>            android (.apk) or ios (Simulator .app in
+                            .zip or .tar.gz)
+  --build-version <v>       Version label for the build
+  --vcs-provider <p>        Version-control provenance, passed through
+  --vcs-repository-id <id>  to registration (all three of provider,
+  --vcs-head-sha <sha>      repository-id and head-sha together;
+  --vcs-pr-number <n>       pr-number optional)
+  --no-wait                 Exit after confirm instead of waiting for
+                            registration
+  --timeout <dur>           How long to wait for registration
+                            (default 15m)
+
+upload needs a project (--project or COLDTEA_PROJECT_ID); get works on the
+build id alone. A failed registration exits 2 and prints the failure code
+(e.g. sha256_mismatch).
+
+\`--no-wait\` hands back a build id before registration finishes.
+\`builds get\` is how you read it afterwards \u2014 without it the id was unusable.
+`;
+var DEFAULT_BUILD_TIMEOUT_MS = 15 * 6e4;
+function sha256OfFile(path) {
+  return new Promise((resolve, reject) => {
+    const hash = createHash("sha256");
+    const stream = createReadStream(path);
+    stream.on("error", reject);
+    stream.on("data", (chunk) => hash.update(chunk));
+    stream.on("end", () => resolve(hash.digest("hex")));
+  });
+}
+function buildFailureExit(output, failure, requestId) {
+  const record = isRecord2(failure) ? failure : {};
+  const code = asString(record.code) ?? "registration_failed";
+  const message = asString(record.message) ?? "The build failed to register.";
+  output.error({ code, message, details: null }, requestId);
+  return exitCodeFor2({ kind: "api_error", status: 0, code });
+}
+var buildsUpload = {
+  words: ["builds", "upload"],
+  summary: "builds upload <file>         Upload a build (--platform required)",
+  help: BUILDS_HELP,
+  flags: {
+    platform: { type: "string" },
+    "build-version": { type: "string" },
+    ...VCS_FLAGS,
+    "no-wait": { type: "boolean", default: false },
+    timeout: { type: "string" }
+  },
+  async run(context, output, args) {
+    const filePath = args.positionals[0];
+    const platform = args.values.platform;
+    if (!filePath || typeof platform !== "string") {
+      return usageError2(
+        output,
+        "Usage: coldtea-qa builds upload <file> --platform <android|ios>"
+      );
+    }
+    if (platform !== "android" && platform !== "ios") {
+      return usageError2(output, "--platform must be android or ios");
+    }
+    const vcsFlags = readVcsFlags(output, args.values, {
+      requirePrNumber: false
+    });
+    if (!vcsFlags.ok) {
+      return exitCodeFor2({ kind: "config_error" });
+    }
+    let timeoutMs = DEFAULT_BUILD_TIMEOUT_MS;
+    if (typeof args.values.timeout === "string") {
+      const parsed = parseDuration(args.values.timeout);
+      if (parsed === null) {
+        return usageError2(
+          output,
+          "--timeout must be a positive duration like 90s, 10m or 2h"
+        );
+      }
+      timeoutMs = parsed;
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const project = requireProjectId(context, output);
+    if (!project.ok) {
+      return project.code;
+    }
+    let sizeBytes;
+    try {
+      const stat = await fs.stat(filePath);
+      if (!stat.isFile()) {
+        return usageError2(output, `${filePath} is not a file`);
+      }
+      sizeBytes = stat.size;
+    } catch {
+      return usageError2(output, `Cannot read ${filePath}`);
+    }
+    const fileName = basename(filePath);
+    let sha256;
+    try {
+      sha256 = await sha256OfFile(filePath);
+    } catch {
+      return usageError2(output, `Cannot read ${filePath}`);
+    }
+    const buildVersion = typeof args.values["build-version"] === "string" ? args.values["build-version"] : null;
+    const identity = createHash("sha256").update(
+      [
+        sha256,
+        fileName,
+        platform,
+        buildVersion ?? "",
+        JSON.stringify(vcsFlags.vcs ?? null)
+      ].join("")
+    ).digest("hex").slice(0, 32);
+    const initiateBody = {
+      platform,
+      fileName,
+      sizeBytes,
+      clientRequestId: `mqcr_build_${identity}`
+    };
+    if (buildVersion !== null) {
+      initiateBody.buildVersion = buildVersion;
+    }
+    if (vcsFlags.vcs !== null) {
+      initiateBody.vcs = vcsFlags.vcs;
+    }
+    const initiated = await api(context, key.value, {
+      method: "POST",
+      path: `/v1/projects/${encodeURIComponent(project.value)}/builds`,
+      body: initiateBody
+    });
+    if (!initiated.ok) {
+      return apiFailure2(output, initiated);
+    }
+    const initiatedData = isRecord2(initiated.data) ? initiated.data : {};
+    const buildId = asString(initiatedData.buildId);
+    const upload = isRecord2(initiatedData.upload) ? initiatedData.upload : null;
+    const uploadUrl = upload === null ? null : asString(upload.url);
+    const uploadId = upload === null ? null : asString(upload.uploadId);
+    const objectKey = upload === null ? null : asString(upload.objectKey);
+    if (buildId === null || upload === null || uploadUrl === null || uploadId === null || objectKey === null) {
+      output.error(
+        {
+          code: "invalid_response",
+          message: "The initiate response is missing expected fields",
+          details: null
+        },
+        initiated.requestId
+      );
+      return exitCodeFor2({
+        kind: "api_error",
+        status: 0,
+        code: "invalid_response"
+      });
+    }
+    if (urlIsInsecure(uploadUrl, allowsInsecureHttp(context.env))) {
+      output.error({
+        code: "insecure_upload_url",
+        message: `The server's upload URL is not https (${uploadUrl.split("?")[0]}). Refusing to send the build in plaintext. If this is a trusted http-only host, set COLDTEA_ALLOW_INSECURE_HTTP=1.`,
+        details: null
+      });
+      return exitCodeFor2({ kind: "config_error" });
+    }
+    output.line(`Build ${buildId}: uploading ${fileName} (${sizeBytes} bytes)`);
+    const fetchImpl = context.fetchImpl ?? fetch;
+    const uploadHeaders = {};
+    if (isRecord2(upload.headers)) {
+      for (const [name, value] of Object.entries(upload.headers)) {
+        if (typeof value === "string") {
+          uploadHeaders[name] = value;
+        }
+      }
+    }
+    let putStatus;
+    try {
+      const putResponse = await fetchImpl(uploadUrl, {
+        method: asString(upload.method) ?? "PUT",
+        headers: uploadHeaders,
+        body: await openAsBlob(filePath)
+      });
+      putStatus = putResponse.status;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      output.error({
+        code: "upload_failed",
+        message: `Could not upload to the signed URL: ${message}`,
+        details: null
+      });
+      return exitCodeFor2({
+        kind: "api_error",
+        status: 0,
+        code: "upload_failed"
+      });
+    }
+    if (putStatus < 200 || putStatus >= 300) {
+      output.error({
+        code: "upload_failed",
+        message: `The signed-URL upload answered ${putStatus}. Re-run to get a fresh URL (they expire after 10 minutes).`,
+        details: null
+      });
+      return exitCodeFor2({
+        kind: "api_error",
+        status: 0,
+        code: "upload_failed"
+      });
+    }
+    const confirmBody = {
+      uploadId,
+      objectKey,
+      fileName,
+      sizeBytes,
+      platform,
+      clientRequestId: `mqcr_confirm_${identity}`,
+      sha256
+    };
+    if (vcsFlags.vcs !== null) {
+      confirmBody.vcs = vcsFlags.vcs;
+    }
+    const confirmed = await api(context, key.value, {
+      method: "POST",
+      path: `/v1/builds/${encodeURIComponent(buildId)}/confirm`,
+      body: confirmBody
+    });
+    if (!confirmed.ok) {
+      return apiFailure2(output, confirmed);
+    }
+    if (args.values["no-wait"] === true) {
+      if (output.json) {
+        emitJson(output, confirmed);
+      } else {
+        output.line(`Build ${buildId} registering (--no-wait: not following)`);
+      }
+      return exitCodeFor2({ kind: "success" });
+    }
+    const result = await poll({
+      timeoutMs,
+      sleep: context.sleep,
+      now: context.now,
+      step: async () => {
+        const read = await api(context, key.value, {
+          method: "GET",
+          path: `/v1/builds/${encodeURIComponent(buildId)}`
+        });
+        if (!read.ok) {
+          return { failure: read, retryable: isRetryableFailure(read) };
+        }
+        const record2 = isRecord2(read.data) ? read.data : {};
+        const status = asString(record2.status);
+        return {
+          done: status === "ready" || status === "failed",
+          value: { record: record2, requestId: read.requestId }
+        };
+      }
+    });
+    if (result.kind === "failed") {
+      return apiFailure2(output, result.failure);
+    }
+    if (result.kind === "timeout") {
+      output.error({
+        code: "timeout",
+        message: `Build ${buildId} was still registering after ${formatDuration(timeoutMs)}. Poll it with: coldtea-qa builds \u2014 GET /v1/builds/${buildId}`,
+        details: null
+      });
+      return exitCodeFor2({ kind: "api_error", status: 0, code: "timeout" });
+    }
+    const { record, requestId } = result.value;
+    if (asString(record.status) === "failed") {
+      if (output.json) {
+        output.success(record, {});
+      }
+      return buildFailureExit(output, record.failure, requestId);
+    }
+    if (output.json) {
+      output.success(record, {});
+    } else {
+      output.line(`Build ${buildId} ready`);
+      output.line(`${output.bold("App")}       ${cell(record.appKey)}`);
+      output.line(`${output.bold("Version")}   ${cell(record.version)}`);
+      output.line(`${output.bold("Artifact")}  ${cell(record.artifactId)}`);
+      output.line(
+        output.dim(
+          "Run against it with: coldtea-qa run test <id> --build " + cell(record.artifactId)
+        )
+      );
+    }
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var buildsGet = {
+  words: ["builds", "get"],
+  summary: "builds get <id>              Show one build and its artifact",
+  help: BUILDS_HELP,
+  flags: {},
+  async run(context, output, args) {
+    const buildId = args.positionals[0];
+    if (!buildId) {
+      return usageError2(output, "Usage: coldtea-qa builds get <buildId>");
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const result = await api(context, key.value, {
+      method: "GET",
+      path: `/v1/builds/${encodeURIComponent(buildId)}`
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    if (!isRecord2(result.data)) {
+      return exitCodeFor2({ kind: "success" });
+    }
+    const build = result.data;
+    output.line(`${output.bold("Build")}     ${cell(build.buildId)}`);
+    output.line(`${output.bold("Status")}    ${cell(build.status)}`);
+    output.line(`${output.bold("Platform")}  ${cell(build.platform)}`);
+    output.line(`${output.bold("Version")}   ${cell(build.version)}`);
+    const artifactId = asString(build.artifactId);
+    output.line(`${output.bold("Artifact")}  ${artifactId ?? "\u2014"}`);
+    if (typeof build.failureCode === "string") {
+      output.line(`${output.bold("Failure")}   ${cell(build.failureCode)}`);
+    }
+    if (artifactId !== null) {
+      output.line();
+      output.line(
+        output.dim(
+          `Run against it with: coldtea-qa run test <id> --build ${artifactId}`
+        )
+      );
+    }
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var buildCommands = [buildsUpload, buildsGet];
+
+// src/commands/merge.ts
+var MERGE_HELP = `coldtea-qa merge \u2014 merge one project into another
+
+Usage
+  coldtea-qa merge <sourceProjectId> --into <survivorProjectId> [--yes]
+
+Flags
+  --into <id>      REQUIRED, named on purpose: the surviving project.
+                   The source project ends archived and merged into it.
+  --yes            Skip the interactive confirmation (CI)
+  --timeout <dur>  How long to follow the merge (default 30m)
+
+The plan is always printed first. Interactively you must type "merge" to
+proceed; without a terminal, --yes is required or nothing is merged
+(exit 4). A merge cannot be undone.
+`;
+var DEFAULT_MERGE_TIMEOUT_MS = 30 * 6e4;
+function printMoves(output, moved, verb) {
+  const record = isRecord2(moved) ? moved : {};
+  output.line(
+    `  ${verb}: ${cell(record.groups)} group(s), ${cell(record.tests)} test(s), ${cell(record.runs)} run(s), ${cell(record.environments)} environment(s), ${cell(record.rules)} rule(s), ${cell(record.reportNames)} report name(s)`
+  );
+  output.line(
+    `  ${verb}: ${cell(record.credentials)} credential(s), ${cell(record.testUsers)} test user(s), ${cell(record.authTargets)} sign-in(s)`
+  );
+}
+function printRepoOutcome(output, repo) {
+  const record = isRecord2(repo) ? repo : {};
+  switch (record.outcome) {
+    case "none":
+      output.line("  Repo: neither side is linked \u2014 nothing to transfer");
+      break;
+    case "transfer":
+      output.line(
+        `  Repo: ${cell(record.repositoryId)} transfers to the survivor`
+      );
+      break;
+    case "same_repo":
+      output.line(
+        "  Repo: both sides link the same repository \u2014 the redundant link is dropped"
+      );
+      break;
+    default:
+      output.line(`  Repo: ${cell(record.outcome)}`);
+  }
+}
+var merge = {
+  words: ["merge"],
+  summary: "merge <src> --into <id>      Merge a project into a survivor",
+  help: MERGE_HELP,
+  flags: {
+    into: { type: "string" },
+    yes: { type: "boolean", default: false },
+    timeout: { type: "string" }
+  },
+  async run(context, output, args) {
+    const source = args.positionals[0];
+    const into = args.values.into;
+    if (!source || typeof into !== "string" || into === "") {
+      return usageError2(
+        output,
+        "Usage: coldtea-qa merge <sourceProjectId> --into <survivorProjectId>"
+      );
+    }
+    let timeoutMs = DEFAULT_MERGE_TIMEOUT_MS;
+    if (typeof args.values.timeout === "string") {
+      const parsed = parseDuration(args.values.timeout);
+      if (parsed === null) {
+        return usageError2(
+          output,
+          "--timeout must be a positive duration like 90s, 10m or 2h"
+        );
+      }
+      timeoutMs = parsed;
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const plan = await api(context, key.value, {
+      method: "POST",
+      path: `/v1/projects/${encodeURIComponent(source)}/merge/plan`,
+      body: { into }
+    });
+    if (!plan.ok) {
+      return apiFailure2(output, plan);
+    }
+    const planData = isRecord2(plan.data) ? plan.data : {};
+    output.line(`Merge plan: ${source} \u2192 ${into}`);
+    printMoves(output, planData.moves, "Moves");
+    printRepoOutcome(output, planData.repo);
+    output.line();
+    if (args.values.yes !== true) {
+      if (!output.interactive) {
+        return usageError2(
+          output,
+          "A merge cannot be undone and needs confirmation: re-run with --yes (no interactive terminal to ask)."
+        );
+      }
+      const answer = await context.readLine(
+        `Merge ${source} into ${into}? This cannot be undone. Type "merge" to continue: `
+      );
+      if (answer.trim() !== "merge") {
+        return usageError2(output, "Not confirmed \u2014 nothing was merged.");
+      }
+    }
+    const started = await api(context, key.value, {
+      method: "POST",
+      path: `/v1/projects/${encodeURIComponent(source)}/merge`,
+      body: {
+        into,
+        // Stable on purpose: retrying the same merge replays/resumes it.
+        clientRequestId: `mqcr_merge_${source}_${into}`
+      }
+    });
+    if (!started.ok) {
+      return apiFailure2(output, started);
+    }
+    const mergeId = isRecord2(started.data) ? asString(started.data.mergeId) : null;
+    if (mergeId === null) {
+      output.error(
+        {
+          code: "invalid_response",
+          message: "The merge response is missing expected fields",
+          details: null
+        },
+        started.requestId
+      );
+      return exitCodeFor2({
+        kind: "api_error",
+        status: 0,
+        code: "invalid_response"
+      });
+    }
+    output.line(`Merge ${mergeId} running\u2026`);
+    const result = await poll({
+      timeoutMs,
+      sleep: context.sleep,
+      now: context.now,
+      step: async () => {
+        const read = await api(context, key.value, {
+          method: "GET",
+          path: `/v1/merges/${encodeURIComponent(mergeId)}`
+        });
+        if (!read.ok) {
+          return { failure: read, retryable: isRetryableFailure(read) };
+        }
+        const record2 = isRecord2(read.data) ? read.data : {};
+        const status = asString(record2.status);
+        return {
+          done: status === "completed" || status === "failed",
+          value: { record: record2, requestId: read.requestId }
+        };
+      }
+    });
+    if (result.kind === "failed") {
+      return apiFailure2(output, result.failure);
+    }
+    if (result.kind === "timeout") {
+      output.error({
+        code: "timeout",
+        message: `Merge ${mergeId} was still running after ${formatDuration(timeoutMs)}. It continues server-side; re-run the same command to follow it again.`,
+        details: null
+      });
+      return exitCodeFor2({ kind: "api_error", status: 0, code: "timeout" });
+    }
+    const { record, requestId } = result.value;
+    if (asString(record.status) === "failed") {
+      if (output.json) {
+        output.success(record, {});
+      }
+      output.error(
+        {
+          code: "merge_failed",
+          message: asString(record.failure) ?? "The merge failed part-way; what already moved stays moved. Re-running the same command resumes it.",
+          details: null
+        },
+        requestId
+      );
+      return exitCodeFor2({
+        kind: "api_error",
+        status: 0,
+        code: "merge_failed"
+      });
+    }
+    if (output.json) {
+      output.success(record, {});
+    } else {
+      output.line(`Merged ${source} into ${into}`);
+      printMoves(output, record.moved, "Moved");
+      output.line(output.dim(`References to ${source} now answer as ${into}.`));
+    }
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var mergeCommands = [merge];
+
+// src/commands/environments.ts
+var ENVIRONMENTS_HELP = `coldtea-qa environments \u2014 where runs open
+
+Usage
+  coldtea-qa environments list [--limit <n>] [--cursor <c>]
+  coldtea-qa environments create <name> --url <url>
+  coldtea-qa environments create <name> --url <url> --credential qcr_\u2026 \\
+                                        (--vercel-project <id> | --any-url)
+  coldtea-qa environments get env_\u2026
+  coldtea-qa environments update env_\u2026 [--name <n>] [--url <url>]
+                                       [--credential <id>] [--acknowledge]
+  coldtea-qa environments delete env_\u2026
+
+Flags
+  --url <url>        The address runs open, http or https. Required on create.
+  --credential <id>  A stored credential to get past a wall in front of it
+                     (coldtea-qa credentials list). Needs a scope, below.
+  --vercel-project   With --credential: spend it only on this Vercel project's
+                     deployments.
+  --any-url          With --credential: spend it on every URL a run brings.
+                     Unbounded, and said out loud rather than by omission.
+  --acknowledge      Required to change the URL or sign-in of an environment
+                     that trigger rules depend on. Without it the edit is
+                     refused with 409 naming how many rules and which.
+
+A stored credential always needs one of --vercel-project or --any-url. The
+address on this row does not bound it: a run brings its own URL, and the scope
+is the only thing saying which URLs the secret may be spent on.
+
+Notes
+  list and create need a project (--project or COLDTEA_PROJECT_ID); the rest
+  work on the environment id alone. An environment with no project is visible
+  in every project in the TeaHouse.
+
+  Only WEB environments are creatable here. A mobile environment needs a
+  device profile whose id comes from the provider, so make those in the app \u2014
+  --url is not the missing piece if you were after a mobile one.
+
+  Deleting is refused with exit 3 while a group or test still points at it.
+`;
+async function accessForCredential(context, apiKey, output, credentialId) {
+  const MAX_PAGES = 50;
+  let match;
+  let cursor = null;
+  let pages = 0;
+  let unlisted = 0;
+  do {
+    if (pages >= MAX_PAGES) {
+      usageError2(
+        output,
+        `Searched ${MAX_PAGES} pages of credentials without finding ${credentialId}. Check the id, or attach the credential in the app.`
+      );
+      return { ok: false };
+    }
+    pages += 1;
+    const page = await api(context, apiKey, {
+      method: "GET",
+      path: `/v1/credentials?limit=100${cursor === null ? "" : `&cursor=${encodeURIComponent(cursor)}`}`
+    });
+    if (!page.ok) {
+      apiFailure2(output, page);
+      return { ok: false };
+    }
+    match = (Array.isArray(page.data) ? page.data : []).filter(isRecord2).find((credential) => credential.credentialId === credentialId);
+    if (typeof page.meta.unlistedCredentials === "number") {
+      unlisted = page.meta.unlistedCredentials;
+    }
+    cursor = page.nextCursor;
+  } while (!match && cursor !== null);
+  if (!match) {
+    usageError2(
+      output,
+      unlisted > 0 ? `Could not find credential ${credentialId}. This listing cannot name ${unlisted} credential(s) stored before credentials recorded a TeaHouse, and it may be one of them \u2014 attach it in the Coldtea app, which can see them.` : `No credential ${credentialId} in this TeaHouse. List them with: coldtea-qa credentials list`
+    );
+    return { ok: false };
+  }
+  if (typeof match.wallType !== "string") {
+    usageError2(
+      output,
+      `Credential ${credentialId} has no method recorded, so it cannot be attached to an environment.`
+    );
+    return { ok: false };
+  }
+  return { ok: true, access: { type: match.wallType, credentialId } };
+}
+function optionalScope(output, values) {
+  const vercelProject = typeof values["vercel-project"] === "string" ? values["vercel-project"] : void 0;
+  const anyUrl = values["any-url"] === true;
+  if (vercelProject !== void 0 && anyUrl) {
+    usageError2(
+      output,
+      "Pick one: --vercel-project <id> bounds the credential to that project, --any-url does not bound it at all"
+    );
+    return { ok: false };
+  }
+  if (vercelProject !== void 0) {
+    return { ok: true, scope: { vercelProjectId: vercelProject } };
+  }
+  if (anyUrl) {
+    return { ok: true, scope: { allowAnyUrl: true } };
+  }
+  return { ok: true, scope: null };
+}
+function scopeForBorrow(output, values) {
+  const vercelProject = typeof values["vercel-project"] === "string" ? values["vercel-project"] : void 0;
+  const anyUrl = values["any-url"] === true;
+  if (vercelProject !== void 0 && anyUrl) {
+    usageError2(
+      output,
+      "Pick one: --vercel-project <id> bounds the credential to that project, --any-url does not bound it at all"
+    );
+    return { ok: false };
+  }
+  if (vercelProject !== void 0) {
+    return { ok: true, scope: { vercelProjectId: vercelProject } };
+  }
+  if (anyUrl) {
+    return { ok: true, scope: { allowAnyUrl: true } };
+  }
+  usageError2(
+    output,
+    "--credential needs a scope: the address on this environment does not bound the secret, because a run brings its own URL.\n  --vercel-project <id>  spend it only on that Vercel project's deployments\n  --any-url              spend it on every URL a run brings (unbounded)"
+  );
+  return { ok: false };
+}
+function checkUrlScheme(output, url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    usageError2(
+      output,
+      `--url must be a full address, e.g. https://staging.example \u2014 "${url}" is not one`
+    );
+    return false;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    usageError2(
+      output,
+      `--url must be http or https \u2014 "${parsed.protocol}" is not an address a run can open`
+    );
+    return false;
+  }
+  return true;
+}
+function printEnvironment(output, environment) {
+  output.line(
+    `${output.bold("Environment")}  ${cell(environment.name)} ${output.dim(`(${cell(environment.environmentId)})`)}`
+  );
+  output.line(`${output.bold("Kind")}         ${cell(environment.kind)}`);
+  const web = isRecord2(environment.web) ? environment.web : null;
+  if (web) {
+    output.line(`${output.bold("URL")}          ${cell(web.url)}`);
+    const access = isRecord2(web.access) ? cell(web.access.type) : "none";
+    output.line(`${output.bold("Access")}       ${access}`);
+    if (isRecord2(web.access) && web.access.type !== "none") {
+      const scope = isRecord2(web.scope) ? web.scope : null;
+      output.line(
+        `${output.bold("Scope")}        ${scope === null ? "unscoped \u2014 this credential may be spent on any URL a run brings" : scope.allowAnyUrl === true ? "any URL (unbounded)" : `Vercel project ${cell(scope.vercelProjectId)}`}`
+      );
+    }
+  }
+  const mobile = isRecord2(environment.mobile) ? environment.mobile : null;
+  if (mobile) {
+    output.line(`${output.bold("Platform")}     ${cell(mobile.platform)}`);
+  }
+  output.line(
+    `${output.bold("Project")}      ${environment.projectId === void 0 ? "every project in this TeaHouse" : cell(environment.projectId)}`
+  );
+  output.line(
+    `${output.bold("Credential")}   ${cell(environment.credentialName)}`
+  );
+  output.line(
+    `${output.bold("Created")}      ${formatEpoch(environment.createdAt)}`
+  );
+}
+var environmentsList = {
+  words: ["environments", "list"],
+  summary: "environments list            List where runs can open",
+  help: ENVIRONMENTS_HELP,
+  flags: { ...LIST_FLAGS },
+  async run(context, output, args) {
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const project = requireProjectId(context, output);
+    if (!project.ok) {
+      return project.code;
+    }
+    const query = listQuery(args.values);
+    const suffix = query.length > 0 ? `?${query.join("&")}` : "";
+    const result = await api(context, key.value, {
+      method: "GET",
+      path: `/v1/projects/${encodeURIComponent(project.value)}/environments${suffix}`
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitListJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    const environments = Array.isArray(result.data) ? result.data : [];
+    if (environments.length === 0) {
+      output.line(
+        'No environments. Create one: coldtea-qa environments create "Staging" --url <url>'
+      );
+    } else {
+      output.line(
+        renderTable(
+          ["ID", "NAME", "KIND", "URL", "CREDENTIAL"],
+          environments.filter(isRecord2).map((environment) => {
+            const web = isRecord2(environment.web) ? environment.web : null;
+            const mobile = isRecord2(environment.mobile) ? environment.mobile : null;
+            return [
+              cell(environment.environmentId),
+              cell(environment.name),
+              cell(environment.kind),
+              web ? cell(web.url) : mobile ? cell(mobile.platform) : "\u2014",
+              cell(environment.credentialName)
+            ];
+          })
+        )
+      );
+    }
+    nextCursorFootnote(output, result.nextCursor);
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var environmentsCreate = {
+  words: ["environments", "create"],
+  summary: "environments create <name>   Create a web environment (--url)",
+  help: ENVIRONMENTS_HELP,
+  flags: {
+    url: { type: "string" },
+    credential: { type: "string" },
+    "vercel-project": { type: "string" },
+    "any-url": { type: "boolean", default: false }
+  },
+  async run(context, output, args) {
+    const name = args.positionals[0];
+    const url = args.values.url;
+    if (!name || typeof url !== "string") {
+      return usageError2(
+        output,
+        "Usage: coldtea-qa environments create <name> --url <url>"
+      );
+    }
+    if (!checkUrlScheme(output, url)) {
+      return exitCodeFor2({ kind: "config_error" });
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const project = requireProjectId(context, output);
+    if (!project.ok) {
+      return project.code;
+    }
+    const web = { url, access: { type: "none" } };
+    if (typeof args.values.credential === "string") {
+      const scope = scopeForBorrow(output, args.values);
+      if (!scope.ok) {
+        return exitCodeFor2({ kind: "config_error" });
+      }
+      const access = await accessForCredential(
+        context,
+        key.value,
+        output,
+        args.values.credential
+      );
+      if (!access.ok) {
+        return exitCodeFor2({ kind: "config_error" });
+      }
+      web.access = access.access;
+      web.scope = scope.scope;
+    } else if (typeof args.values["vercel-project"] === "string" || args.values["any-url"] === true) {
+      return usageError2(
+        output,
+        "--vercel-project and --any-url only mean something with --credential: a scope bounds a stored secret, and this environment has none"
+      );
+    }
+    const result = await api(context, key.value, {
+      method: "POST",
+      path: `/v1/projects/${encodeURIComponent(project.value)}/environments`,
+      body: { name, kind: "web", web }
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    if (isRecord2(result.data)) {
+      output.line(`Created environment ${cell(result.data.environmentId)}`);
+      printEnvironment(output, result.data);
+    }
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var environmentsGet = {
+  words: ["environments", "get"],
+  summary: "environments get <id>        Show one environment",
+  help: ENVIRONMENTS_HELP,
+  flags: {},
+  async run(context, output, args) {
+    const environmentId = args.positionals[0];
+    if (!environmentId) {
+      return usageError2(output, "Usage: coldtea-qa environments get <id>");
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const result = await api(context, key.value, {
+      method: "GET",
+      path: `/v1/environments/${encodeURIComponent(environmentId)}`
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    if (isRecord2(result.data)) {
+      printEnvironment(output, result.data);
+    }
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var environmentsUpdate = {
+  words: ["environments", "update"],
+  summary: "environments update <id>     Edit one (--acknowledge for rules)",
+  help: ENVIRONMENTS_HELP,
+  flags: {
+    name: { type: "string" },
+    url: { type: "string" },
+    credential: { type: "string" },
+    "vercel-project": { type: "string" },
+    "any-url": { type: "boolean", default: false },
+    acknowledge: { type: "boolean", default: false }
+  },
+  async run(context, output, args) {
+    const environmentId = args.positionals[0];
+    if (!environmentId) {
+      return usageError2(
+        output,
+        "Usage: coldtea-qa environments update <id> [--name] [--url] [--credential]"
+      );
+    }
+    const wantsUpdate = typeof args.values.name === "string" || typeof args.values.url === "string" || typeof args.values.credential === "string";
+    if (!wantsUpdate) {
+      return usageError2(
+        output,
+        "Nothing to update: pass at least one of --name, --url, --credential"
+      );
+    }
+    if (typeof args.values.url === "string" && !checkUrlScheme(output, args.values.url)) {
+      return exitCodeFor2({ kind: "config_error" });
+    }
+    if (typeof args.values.credential !== "string" && (typeof args.values["vercel-project"] === "string" || args.values["any-url"] === true)) {
+      return usageError2(
+        output,
+        "--vercel-project and --any-url only mean something with --credential: a scope bounds a stored secret"
+      );
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const body = {};
+    if (typeof args.values.name === "string") {
+      body.name = args.values.name;
+    }
+    const web = {};
+    if (typeof args.values.url === "string") {
+      web.url = args.values.url;
+    }
+    if (typeof args.values.credential === "string") {
+      const scope = optionalScope(output, args.values);
+      if (!scope.ok) {
+        return exitCodeFor2({ kind: "config_error" });
+      }
+      const access = await accessForCredential(
+        context,
+        key.value,
+        output,
+        args.values.credential
+      );
+      if (!access.ok) {
+        return exitCodeFor2({ kind: "config_error" });
+      }
+      web.access = access.access;
+      if (scope.scope !== null) {
+        web.scope = scope.scope;
+      }
+    }
+    if (Object.keys(web).length > 0) {
+      body.web = web;
+    }
+    if (args.values.acknowledge === true) {
+      body.acknowledgeAffectedRules = true;
+    }
+    const result = await api(context, key.value, {
+      method: "PATCH",
+      path: `/v1/environments/${encodeURIComponent(environmentId)}`,
+      body
+    });
+    if (!result.ok) {
+      const code = apiFailure2(output, result);
+      if (result.error.code === "invalid_request" && /web\.scope is required/.test(result.error.message)) {
+        output.errorNote(
+          "  This environment has no scope to keep. Add --vercel-project <id> to bound the credential to one Vercel project, or --any-url to spend it on every URL a run brings."
+        );
+      }
+      if (result.error.code === "environment_edit_affects_rules") {
+        output.errorNote(
+          "  Trigger rules depend on this environment. Re-run with --acknowledge to change it anyway."
+        );
+      }
+      return code;
+    }
+    if (output.json) {
+      emitJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    if (isRecord2(result.data)) {
+      output.line(`Updated environment ${cell(result.data.environmentId)}`);
+      if (args.values["any-url"] === true) {
+        output.line(
+          output.dim(
+            "Scope is now UNBOUNDED: this credential may be spent on any URL a run brings. Re-bound it with --vercel-project <id>."
+          )
+        );
+      }
+      printEnvironment(output, result.data);
+    }
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var environmentsDelete = {
+  words: ["environments", "delete"],
+  summary: "environments delete <id>     Delete one (refused while in use)",
+  help: ENVIRONMENTS_HELP,
+  flags: {},
+  async run(context, output, args) {
+    const environmentId = args.positionals[0];
+    if (!environmentId) {
+      return usageError2(output, "Usage: coldtea-qa environments delete <id>");
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const result = await api(context, key.value, {
+      method: "DELETE",
+      path: `/v1/environments/${encodeURIComponent(environmentId)}`
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    output.line(`Deleted environment ${environmentId}`);
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var environmentCommands = [
+  environmentsList,
+  environmentsCreate,
+  environmentsGet,
+  environmentsUpdate,
+  environmentsDelete
+];
+
+// src/commands/rules.ts
+var RULES_HELP = `coldtea-qa rules \u2014 run QA without being asked
+
+Usage
+  coldtea-qa rules list [--limit <n>] [--cursor <c>]
+  coldtea-qa rules create <name> --webhook --groups mqg_a,mqg_b
+  coldtea-qa rules create <name> --deployment [--branch main] --groups \u2026
+  coldtea-qa rules create <name> --schedule "0 3 * * *" --against env_\u2026 \\
+                                 [--timezone UTC]
+  coldtea-qa rules update qtr_\u2026 [--name <n>] [--enable | --disable]
+  coldtea-qa rules delete qtr_\u2026
+
+When to run (exactly one)
+  --webhook          Your CI calls a URL. The URL is returned ONCE, on create.
+  --deployment       A deployment of the linked repository succeeded.
+  --schedule <cron>  On a clock, e.g. "0 3 * * *".
+
+Flags
+  --groups <ids>     Comma-separated group ids to run. Required on create.
+  --branch <name>    With --deployment: only this branch.
+  --pr-only          With --deployment: only deployments for a pull request.
+                     This is already the default \u2014 pass it to be explicit.
+  --all-deployments  With --deployment: every deployment, INCLUDING direct
+                     pushes to main. Wider than the default, so it is a flag
+                     you type rather than one you get by saying nothing.
+  --timezone <tz>    With --schedule: defaults to UTC.
+  --checks           Report a check back onto the pull request.
+  --against <id>     Run in this environment instead of each group's.
+                     REQUIRED with --schedule: a schedule has no deployment to
+                     bring an address with it, so something must say where the
+                     run opens.
+
+This is the only way a run reports a check onto a pull request. Starting a run
+directly stamps the commit and posts nothing \u2014 check names are reserved per
+repository by the rule that owns them.
+
+list and create need a project (--project or COLDTEA_PROJECT_ID); update and
+delete work on the rule id alone.
+`;
+function describeWhen(when) {
+  if (!isRecord2(when)) {
+    return "\u2014";
+  }
+  if (when.type === "schedule") {
+    return `schedule ${cell(when.cron)} ${cell(when.timezone)}`;
+  }
+  if (when.type === "webhook") {
+    return "webhook";
+  }
+  if (when.type === "deployment") {
+    const match = isRecord2(when.match) ? when.match : {};
+    const branch = match.branch === null ? "any branch" : cell(match.branch);
+    return `deployment ${branch}`;
+  }
+  return cell(when.type);
+}
+function printRule(output, rule) {
+  output.line(
+    `${output.bold("Rule")}      ${cell(rule.name)} ${output.dim(`(${cell(rule.ruleId)})`)}`
+  );
+  output.line(
+    `${output.bold("When")}      ${describeWhen(rule.when)}${rule.enabled === false ? " (disabled)" : ""}`
+  );
+  const run = isRecord2(rule.run) ? rule.run : {};
+  output.line(
+    `${output.bold("Runs")}      ${Array.isArray(run.groupIds) ? run.groupIds.join(", ") : "\u2014"}`
+  );
+  output.line(
+    `${output.bold("Checks")}    ${rule.checkRunsEnabled === true ? "yes" : "no"}`
+  );
+  output.line(`${output.bold("Against")}   ${cell(rule.against)}`);
+  output.line(`${output.bold("Created")}   ${formatEpoch(rule.createdAt)}`);
+  if (typeof rule.url === "string") {
+    output.line();
+    output.line(`${output.bold("Hook URL")}  ${rule.url}`);
+    output.line(
+      output.dim(
+        "Shown once \u2014 it contains the token. Store it in your CI's secrets now; there is no way to read it back."
+      )
+    );
+  }
+}
+var rulesList = {
+  words: ["rules", "list"],
+  summary: "rules list                   List a project's trigger rules",
+  help: RULES_HELP,
+  flags: { ...LIST_FLAGS },
+  async run(context, output, args) {
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const project = requireProjectId(context, output);
+    if (!project.ok) {
+      return project.code;
+    }
+    const query = listQuery(args.values);
+    const suffix = query.length > 0 ? `?${query.join("&")}` : "";
+    const result = await api(context, key.value, {
+      method: "GET",
+      path: `/v1/projects/${encodeURIComponent(project.value)}/rules${suffix}`
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitListJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    const rules = Array.isArray(result.data) ? result.data : [];
+    if (rules.length === 0) {
+      output.line(
+        'No rules, so QA runs only when something asks it to. Create one: coldtea-qa rules create "CI" --webhook --groups <ids>'
+      );
+    } else {
+      output.line(
+        renderTable(
+          ["ID", "NAME", "WHEN", "ENABLED", "CHECKS"],
+          rules.filter(isRecord2).map((rule) => [
+            cell(rule.ruleId),
+            cell(rule.name),
+            describeWhen(rule.when),
+            rule.enabled === false ? "no" : "yes",
+            rule.checkRunsEnabled === true ? "yes" : "no"
+          ])
+        )
+      );
+    }
+    nextCursorFootnote(output, result.nextCursor);
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var rulesCreate = {
+  words: ["rules", "create"],
+  summary: "rules create <name>          Create a trigger rule (one --when)",
+  help: RULES_HELP,
+  flags: {
+    webhook: { type: "boolean", default: false },
+    deployment: { type: "boolean", default: false },
+    schedule: { type: "string" },
+    timezone: { type: "string" },
+    branch: { type: "string" },
+    "pr-only": { type: "boolean", default: false },
+    "all-deployments": { type: "boolean", default: false },
+    groups: { type: "string" },
+    checks: { type: "boolean", default: false },
+    against: { type: "string" }
+  },
+  async run(context, output, args) {
+    const name = args.positionals[0];
+    if (!name) {
+      return usageError2(
+        output,
+        "Usage: coldtea-qa rules create <name> (--webhook | --deployment | --schedule <cron>) --groups <ids>"
+      );
+    }
+    const chosen = [];
+    if (args.values.webhook === true) {
+      chosen.push({ type: "webhook" });
+    }
+    if (args.values.deployment === true) {
+      const prOnly = args.values["pr-only"] === true;
+      const allDeployments = args.values["all-deployments"] === true;
+      if (prOnly && allDeployments) {
+        return usageError2(
+          output,
+          "Pick one: --pr-only runs on pull-request deployments, --all-deployments runs on every deployment including pushes to main"
+        );
+      }
+      const match = {
+        branch: typeof args.values.branch === "string" ? args.values.branch : null,
+        source: null
+      };
+      if (prOnly) {
+        match.requiresPullRequest = true;
+      }
+      if (allDeployments) {
+        match.requiresPullRequest = false;
+      }
+      chosen.push({ type: "deployment", match });
+    }
+    if (typeof args.values.schedule === "string") {
+      chosen.push({
+        type: "schedule",
+        cron: args.values.schedule,
+        timezone: typeof args.values.timezone === "string" ? args.values.timezone : "UTC"
+      });
+    }
+    if (chosen.length !== 1) {
+      return usageError2(
+        output,
+        "A rule needs exactly one trigger: --webhook, --deployment, or --schedule <cron>"
+      );
+    }
+    const groupIds = typeof args.values.groups === "string" ? args.values.groups.split(",").map((id) => id.trim()).filter((id) => id !== "") : [];
+    if (groupIds.length === 0) {
+      return usageError2(
+        output,
+        "--groups is required: comma-separated group ids this rule runs (coldtea-qa groups list)"
+      );
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const project = requireProjectId(context, output);
+    if (!project.ok) {
+      return project.code;
+    }
+    const body = {
+      name,
+      when: chosen[0],
+      run: { groupIds, explorationEnabled: false },
+      checkRunsEnabled: args.values.checks === true
+    };
+    if (typeof args.values.against === "string") {
+      body.against = args.values.against;
+    }
+    const result = await api(context, key.value, {
+      method: "POST",
+      path: `/v1/projects/${encodeURIComponent(project.value)}/rules`,
+      body
+    });
+    if (!result.ok) {
+      const code = apiFailure2(output, result);
+      if (result.error.code === "report_name_taken") {
+        output.errorNote(
+          "  Another project has reserved that check name on this repository. Rename the rule, or unlink there."
+        );
+      }
+      return code;
+    }
+    if (output.json) {
+      emitJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    if (isRecord2(result.data)) {
+      output.line(`Created rule ${cell(result.data.ruleId)}`);
+      printRule(output, result.data);
+    }
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var rulesUpdate = {
+  words: ["rules", "update"],
+  summary: "rules update <id>            Rename, enable or disable a rule",
+  help: RULES_HELP,
+  flags: {
+    name: { type: "string" },
+    enable: { type: "boolean", default: false },
+    disable: { type: "boolean", default: false },
+    checks: { type: "boolean", default: false },
+    "no-checks": { type: "boolean", default: false }
+  },
+  async run(context, output, args) {
+    const ruleId = args.positionals[0];
+    if (!ruleId) {
+      return usageError2(
+        output,
+        "Usage: coldtea-qa rules update <id> [--name <n>] [--enable | --disable]"
+      );
+    }
+    if (args.values.enable === true && args.values.disable === true) {
+      return usageError2(output, "Pick one: --enable or --disable");
+    }
+    if (args.values.checks === true && args.values["no-checks"] === true) {
+      return usageError2(output, "Pick one: --checks or --no-checks");
+    }
+    const body = {};
+    if (typeof args.values.name === "string") {
+      body.name = args.values.name;
+    }
+    if (args.values.enable === true) {
+      body.enabled = true;
+    }
+    if (args.values.disable === true) {
+      body.enabled = false;
+    }
+    if (args.values.checks === true) {
+      body.checkRunsEnabled = true;
+    }
+    if (args.values["no-checks"] === true) {
+      body.checkRunsEnabled = false;
+    }
+    if (Object.keys(body).length === 0) {
+      return usageError2(
+        output,
+        "Nothing to update: pass --name, --enable/--disable, or --checks/--no-checks"
+      );
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const result = await api(context, key.value, {
+      method: "PATCH",
+      path: `/v1/rules/${encodeURIComponent(ruleId)}`,
+      body
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    if (isRecord2(result.data)) {
+      output.line(`Updated rule ${cell(result.data.ruleId)}`);
+      printRule(output, result.data);
+    }
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var rulesDelete = {
+  words: ["rules", "delete"],
+  summary: "rules delete <id>            Delete a rule",
+  help: RULES_HELP,
+  flags: {},
+  async run(context, output, args) {
+    const ruleId = args.positionals[0];
+    if (!ruleId) {
+      return usageError2(output, "Usage: coldtea-qa rules delete <id>");
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const result = await api(context, key.value, {
+      method: "DELETE",
+      path: `/v1/rules/${encodeURIComponent(ruleId)}`
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    output.line(`Deleted rule ${ruleId}`);
+    output.line(
+      output.dim(
+        "The check name it reserved on the repository is free for another project now."
+      )
+    );
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var ruleCommands = [
+  rulesList,
+  rulesCreate,
+  rulesUpdate,
+  rulesDelete
+];
+
+// src/commands/credentials.ts
+var CREDENTIALS_HELP = `coldtea-qa credentials \u2014 stored secrets
+
+Usage
+  coldtea-qa credentials list [--project prj_\u2026] [--limit <n>] [--cursor <c>]
+  echo -n "<secret>" | coldtea-qa credentials create <name> --method <m> \\
+    [--username <u>] [--project prj_\u2026] [--environment env_\u2026]
+  coldtea-qa credentials rename qcr_\u2026 --name "<new name>"
+  echo -n "<secret>" | coldtea-qa credentials rotate qcr_\u2026 --method <m> [--username <u>]
+  coldtea-qa credentials delete qcr_\u2026
+
+Methods
+  vercel_bypass    A Vercel protection bypass token
+  basic_auth       HTTP basic auth; needs --username too
+  custom_headers   A flat JSON object of header names to values, sent as
+                   the name/value pairs the API wants.
+
+The secret is read from STDIN, never from a flag \u2014 a command line is visible
+in shell history, in \`ps\`, and in CI logs. Pipe it:
+
+  echo -n "$VERCEL_BYPASS" | coldtea-qa credentials create "Preview wall" \\
+    --method vercel_bypass
+
+Where it sits
+  --project <id>      The project this credential belongs to. Without the
+                      FLAG it is TeaHouse-wide \u2014 spendable from every project
+                      in the account. Placement is permanent: nothing can move
+                      a credential afterwards. COLDTEA_PROJECT_ID does not
+                      place one, on purpose; \`list\` does read it.
+  --environment <id>  The environment that owns it. Without one it belongs to
+                      nobody and stays attachable anywhere.
+
+Nothing reads a secret back. \`list\` shows metadata only, and rotating answers
+with the method and a timestamp. A listing may also say that credentials exist
+it cannot name \u2014 those were stored before credentials recorded a TeaHouse, and
+the Coldtea app shows them.
+
+Deleting is refused with exit 3 while an environment still references it.
+`;
+var METHODS = ["vercel_bypass", "basic_auth", "custom_headers"];
+function readMethod(output, value) {
+  if (typeof value !== "string" || !METHODS.includes(value)) {
+    usageError2(output, `--method must be one of: ${METHODS.join(", ")}`);
+    return null;
+  }
+  return value;
+}
+async function readSecretFromStdin(output, stdinIsTTY, readStdin) {
+  if (stdinIsTTY) {
+    usageError2(
+      output,
+      'Pipe the secret in rather than typing it as an argument, e.g.\n  echo -n "$TOKEN" | coldtea-qa credentials create "Preview wall" --method vercel_bypass'
+    );
+    return null;
+  }
+  const secret = (await readStdin()).replace(/\r?\n$/, "");
+  if (secret === "") {
+    usageError2(
+      output,
+      "Nothing arrived on stdin, so there is no secret to store."
+    );
+    return null;
+  }
+  return secret;
+}
+function secretPayload(output, method, secret, values) {
+  if (method === "vercel_bypass") {
+    return { method, token: secret };
+  }
+  if (method === "basic_auth") {
+    if (typeof values.username !== "string" || values.username === "") {
+      usageError2(output, "--username is required with --method basic_auth");
+      return null;
+    }
+    return { method, username: values.username, password: secret };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(secret);
+  } catch {
+    usageError2(
+      output,
+      'With --method custom_headers the piped value must be JSON, e.g. {"X-Api-Key":"\u2026"}'
+    );
+    return null;
+  }
+  if (!isRecord2(parsed)) {
+    usageError2(
+      output,
+      "custom_headers must be a JSON object of header names to values."
+    );
+    return null;
+  }
+  const headers = Object.entries(parsed).map(([name, value]) => ({
+    name,
+    value
+  }));
+  if (headers.length === 0) {
+    usageError2(output, "custom_headers needs at least one header.");
+    return null;
+  }
+  const MAX_HEADERS = 20;
+  if (headers.length > MAX_HEADERS) {
+    usageError2(
+      output,
+      `${headers.length} headers \u2014 the most a credential can hold is ${MAX_HEADERS}.`
+    );
+    return null;
+  }
+  const HEADER_NAME = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
+  const invalidName = headers.find(
+    ({ name }) => !HEADER_NAME.test(name.trim())
+  );
+  if (invalidName) {
+    const name = invalidName.name;
+    const reason = name.trim() === "" ? "a header name cannot be empty" : /[\s:]/.test(name) ? "header names cannot contain spaces or colons" : "header names may only use letters, digits and !#$%&'*+-.^_`|~";
+    const suggestion = name.trim().replace(/\s+/g, "-");
+    usageError2(
+      output,
+      `"${name}" is not a valid header name \u2014 ${reason}.` + (suggestion !== name && HEADER_NAME.test(suggestion) ? ` Did you mean "${suggestion}"?` : "")
+    );
+    return null;
+  }
+  const longName = headers.find(({ name }) => name.trim().length > 128);
+  if (longName) {
+    usageError2(
+      output,
+      `Header "${longName.name.slice(0, 32)}\u2026" is ${longName.name.trim().length} characters \u2014 a header name may be at most 128.`
+    );
+    return null;
+  }
+  const notAString = headers.find(({ value }) => typeof value !== "string");
+  if (notAString) {
+    usageError2(
+      output,
+      `Header "${notAString.name}" must be a string. custom_headers is a flat object of header names to values.`
+    );
+    return null;
+  }
+  const emptyValue = headers.find(
+    ({ value }) => value.trim() === ""
+  );
+  if (emptyValue) {
+    usageError2(
+      output,
+      `Header "${emptyValue.name}" has no value. A header a run sends empty is one the wall behind it will not accept.`
+    );
+    return null;
+  }
+  const brokenValue = headers.find(
+    ({ value }) => /[\r\n]/.test(value)
+  );
+  if (brokenValue) {
+    usageError2(
+      output,
+      `Header "${brokenValue.name}" has a line break in its value \u2014 a value that can carry one is a value that can be made to look like two headers.`
+    );
+    return null;
+  }
+  return { method, headers };
+}
+function unlistedCount(meta) {
+  return typeof meta.unlistedCredentials === "number" ? meta.unlistedCredentials : 0;
+}
+function unlistedFootnote(output, meta) {
+  const unlisted = unlistedCount(meta);
+  if (unlisted === 0) {
+    return;
+  }
+  output.line();
+  output.line(
+    output.dim(
+      `At least ${unlisted} more credential(s) exist that this listing cannot name \u2014 they were stored before credentials recorded a TeaHouse. The Coldtea app shows them.`
+    )
+  );
+}
+var credentialsList = {
+  words: ["credentials", "list"],
+  summary: "credentials list             List stored secrets (metadata only)",
+  help: CREDENTIALS_HELP,
+  flags: { ...LIST_FLAGS },
+  async run(context, output, args) {
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const query = listQuery(args.values);
+    if (context.projectId !== null) {
+      query.push(`projectId=${encodeURIComponent(context.projectId)}`);
+    }
+    const suffix = query.length > 0 ? `?${query.join("&")}` : "";
+    const result = await api(context, key.value, {
+      method: "GET",
+      path: `/v1/credentials${suffix}`
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitListJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    const credentials = Array.isArray(result.data) ? result.data : [];
+    if (credentials.length === 0) {
+      output.line(
+        unlistedCount(result.meta) > 0 ? "No credentials this listing can name." : 'No credentials. Store one: echo -n "$SECRET" | coldtea-qa credentials create "<name>" --method <m>'
+      );
+    } else {
+      output.line(
+        renderTable(
+          ["ID", "NAME", "METHOD", "USED BY", "UPDATED"],
+          credentials.filter(isRecord2).map((credential) => {
+            const used = Array.isArray(credential.environments) ? credential.environments.length : 0;
+            return [
+              cell(credential.credentialId),
+              cell(credential.name),
+              cell(credential.wallType),
+              used === 0 ? "nothing" : `${used} environment(s)`,
+              formatEpoch(credential.updatedAt)
+            ];
+          })
+        )
+      );
+    }
+    unlistedFootnote(output, result.meta);
+    nextCursorFootnote(output, result.nextCursor);
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var credentialsCreate = {
+  words: ["credentials", "create"],
+  summary: "credentials create <name>    Store a secret (piped on stdin)",
+  help: CREDENTIALS_HELP,
+  flags: {
+    method: { type: "string" },
+    username: { type: "string" },
+    environment: { type: "string" }
+  },
+  async run(context, output, args) {
+    const name = args.positionals[0];
+    if (!name) {
+      return usageError2(
+        output,
+        'Usage: echo -n "<secret>" | coldtea-qa credentials create <name> --method <m>'
+      );
+    }
+    const method = readMethod(output, args.values.method);
+    if (method === null) {
+      return exitCodeFor2({ kind: "config_error" });
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const secret = await readSecretFromStdin(
+      output,
+      output.stdinIsTTY,
+      context.readStdin
+    );
+    if (secret === null) {
+      return exitCodeFor2({ kind: "config_error" });
+    }
+    const payload = secretPayload(output, method, secret, args.values);
+    if (payload === null) {
+      return exitCodeFor2({ kind: "config_error" });
+    }
+    const body = { ...payload, name };
+    if (context.flags.project !== void 0) {
+      body.projectId = context.flags.project;
+    }
+    if (typeof args.values.environment === "string") {
+      body.environmentId = args.values.environment;
+    }
+    const result = await api(context, key.value, {
+      method: "POST",
+      path: "/v1/credentials",
+      body
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    if (isRecord2(result.data)) {
+      output.line(
+        `Stored credential ${cell(result.data.credentialId)} (${cell(result.data.wallType)})`
+      );
+      output.line(
+        output.dim(
+          `Attach it with: coldtea-qa environments create <name> --url <url> --credential ${cell(result.data.credentialId)}`
+        )
+      );
+    }
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var credentialsRename = {
+  words: ["credentials", "rename"],
+  summary: "credentials rename <id>      Rename one (--name)",
+  help: CREDENTIALS_HELP,
+  flags: { name: { type: "string" } },
+  async run(context, output, args) {
+    const credentialId = args.positionals[0];
+    if (!credentialId || typeof args.values.name !== "string") {
+      return usageError2(
+        output,
+        'Usage: coldtea-qa credentials rename <id> --name "<new name>"'
+      );
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const result = await api(context, key.value, {
+      method: "PATCH",
+      path: `/v1/credentials/${encodeURIComponent(credentialId)}`,
+      body: { name: args.values.name }
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    output.line(`Renamed credential ${credentialId}`);
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var credentialsRotate = {
+  words: ["credentials", "rotate"],
+  summary: "credentials rotate <id>      Replace the secret (piped on stdin)",
+  help: CREDENTIALS_HELP,
+  flags: { method: { type: "string" }, username: { type: "string" } },
+  async run(context, output, args) {
+    const credentialId = args.positionals[0];
+    if (!credentialId) {
+      return usageError2(
+        output,
+        'Usage: echo -n "<secret>" | coldtea-qa credentials rotate <id> --method <m>'
+      );
+    }
+    const method = readMethod(output, args.values.method);
+    if (method === null) {
+      return exitCodeFor2({ kind: "config_error" });
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const secret = await readSecretFromStdin(
+      output,
+      output.stdinIsTTY,
+      context.readStdin
+    );
+    if (secret === null) {
+      return exitCodeFor2({ kind: "config_error" });
+    }
+    const payload = secretPayload(output, method, secret, args.values);
+    if (payload === null) {
+      return exitCodeFor2({ kind: "config_error" });
+    }
+    const result = await api(context, key.value, {
+      method: "POST",
+      path: `/v1/credentials/${encodeURIComponent(credentialId)}/secret`,
+      body: payload
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    output.line(`Rotated credential ${credentialId}`);
+    output.line(
+      output.dim(
+        "Every environment that references it now signs in with the new secret."
+      )
+    );
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var credentialsDelete = {
+  words: ["credentials", "delete"],
+  summary: "credentials delete <id>      Delete one (refused while in use)",
+  help: CREDENTIALS_HELP,
+  flags: {},
+  async run(context, output, args) {
+    const credentialId = args.positionals[0];
+    if (!credentialId) {
+      return usageError2(output, "Usage: coldtea-qa credentials delete <id>");
+    }
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const result = await api(context, key.value, {
+      method: "DELETE",
+      path: `/v1/credentials/${encodeURIComponent(credentialId)}`
+    });
+    if (!result.ok) {
+      const code = apiFailure2(output, result);
+      if (result.error.code === "credential_in_use") {
+        output.errorNote(
+          "  Detach it from every environment that uses it first: coldtea-qa credentials list shows which."
+        );
+      }
+      return code;
+    }
+    output.line(`Deleted credential ${credentialId}`);
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var credentialCommands = [
+  credentialsList,
+  credentialsCreate,
+  credentialsRename,
+  credentialsRotate,
+  credentialsDelete
+];
+
+// src/commands/repositories.ts
+var REPOSITORIES_HELP = `coldtea-qa repositories \u2014 repositories we can see
+
+Usage
+  coldtea-qa repositories list [--provider <github|bitbucket>]
+                              [--limit <n>] [--cursor <c>]
+
+The repositories the Coldtea GitHub App or Bitbucket install can reach. Use
+the ID column with:
+
+  coldtea-qa projects link-repo prj_\u2026 --provider github --repository-id <id>
+
+Match on the id, never on the name: \`fullName\` is display only and follows
+a rename, while the id does not.
+`;
+var repositoriesList = {
+  words: ["repositories", "list"],
+  summary: "repositories list            List repositories we can see (for link-repo)",
+  help: REPOSITORIES_HELP,
+  flags: { ...LIST_FLAGS, provider: { type: "string" } },
+  async run(context, output, args) {
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const query = listQuery(args.values);
+    if (typeof args.values.provider === "string") {
+      query.push(`provider=${encodeURIComponent(args.values.provider)}`);
+    }
+    const suffix = query.length > 0 ? `?${query.join("&")}` : "";
+    const result = await api(context, key.value, {
+      method: "GET",
+      path: `/v1/repositories${suffix}`
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitListJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    const repositories = Array.isArray(result.data) ? result.data : [];
+    if (repositories.length === 0) {
+      output.line("No repositories. Connect the Coldtea app to one first.");
+    } else {
+      output.line(
+        renderTable(
+          ["ID", "PROVIDER", "NAME"],
+          repositories.filter(isRecord2).map((repo) => [
+            cell(repo.repositoryId),
+            cell(repo.provider),
+            cell(repo.fullName)
+          ])
+        )
+      );
+    }
+    nextCursorFootnote(output, result.nextCursor);
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var repositoryCommands = [repositoriesList];
+
+// src/commands/apps.ts
+var APPS_HELP = `coldtea-qa apps \u2014 registered mobile apps
+
+Usage
+  coldtea-qa apps list [--limit <n>] [--cursor <c>]
+
+The apps registered from uploaded builds, and the builds under each. Needs a
+project (--project or COLDTEA_PROJECT_ID).
+
+The ARTIFACT column is what a run is started against:
+
+  coldtea-qa run test mqt_\u2026 --build <artifactId>
+`;
+var SKIPS_HELP = `coldtea-qa skips \u2014 why a rule did not run
+
+Usage
+  coldtea-qa skips list [--rule <ruleId>] [--limit <n>] [--cursor <c>]
+
+A rule that declines to fire leaves no run behind, so this listing is the only
+record that it happened. Reasons include rule_disabled, project_not_active,
+out_of_scope, no_target_url, no_runnable_tests and insufficient_credits.
+
+Skips are kept for 30 days. An empty list means nothing was skipped in that
+window, not that nothing was ever skipped.
+
+Needs a project (--project or COLDTEA_PROJECT_ID).
+`;
+var appsList = {
+  words: ["apps", "list"],
+  summary: "apps list                    List a project's mobile apps",
+  help: APPS_HELP,
+  flags: { ...LIST_FLAGS },
+  async run(context, output, args) {
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const project = requireProjectId(context, output);
+    if (!project.ok) {
+      return project.code;
+    }
+    const query = listQuery(args.values);
+    const suffix = query.length > 0 ? `?${query.join("&")}` : "";
+    const result = await api(context, key.value, {
+      method: "GET",
+      path: `/v1/projects/${encodeURIComponent(project.value)}/apps${suffix}`
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitListJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    const apps = (Array.isArray(result.data) ? result.data : []).filter(
+      isRecord2
+    );
+    if (apps.length === 0) {
+      output.line("No apps. Upload a build first: coldtea-qa builds upload");
+      return exitCodeFor2({ kind: "success" });
+    }
+    const rows = apps.flatMap((app) => {
+      const builds = Array.isArray(app.builds) ? app.builds.filter(isRecord2) : [];
+      if (builds.length === 0) {
+        return [[cell(app.appKey), cell(app.platform), "\u2014", "\u2014", "\u2014"]];
+      }
+      return builds.map((build) => [
+        cell(app.appKey),
+        cell(app.platform),
+        cell(build.version),
+        cell(build.artifactId),
+        formatEpoch(build.createdAt)
+      ]);
+    });
+    output.line(
+      renderTable(["APP", "PLATFORM", "VERSION", "ARTIFACT", "CREATED"], rows)
+    );
+    nextCursorFootnote(output, result.nextCursor);
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var skipsList = {
+  words: ["skips", "list"],
+  summary: "skips list                   Why a project's rules did not run",
+  help: SKIPS_HELP,
+  flags: { ...LIST_FLAGS, rule: { type: "string" } },
+  async run(context, output, args) {
+    const key = requireApiKey2(context, output);
+    if (!key.ok) {
+      return key.code;
+    }
+    const project = requireProjectId(context, output);
+    if (!project.ok) {
+      return project.code;
+    }
+    const query = listQuery(args.values);
+    if (typeof args.values.rule === "string") {
+      query.push(`ruleId=${encodeURIComponent(args.values.rule)}`);
+    }
+    const suffix = query.length > 0 ? `?${query.join("&")}` : "";
+    const result = await api(context, key.value, {
+      method: "GET",
+      path: `/v1/projects/${encodeURIComponent(project.value)}/skips${suffix}`
+    });
+    if (!result.ok) {
+      return apiFailure2(output, result);
+    }
+    if (output.json) {
+      emitListJson(output, result);
+      return exitCodeFor2({ kind: "success" });
+    }
+    const skips = Array.isArray(result.data) ? result.data : [];
+    if (skips.length === 0) {
+      output.line(
+        "No skips in the last 30 days \u2014 that is as far back as they are kept. Either every rule that matched fired, or there are no rules yet (coldtea-qa rules list)."
+      );
+    } else {
+      output.line(
+        renderTable(
+          ["WHEN", "RULE", "TRIGGER", "REASON"],
+          skips.filter(isRecord2).map((skip) => [
+            formatEpoch(skip.at),
+            cell(skip.ruleId),
+            cell(skip.trigger),
+            cell(skip.reason)
+          ])
+        )
+      );
+    }
+    nextCursorFootnote(output, result.nextCursor);
+    return exitCodeFor2({ kind: "success" });
+  }
+};
+var appCommands = [appsList, skipsList];
+
+// src/main.ts
+var CLI_VERSION = "0.1.0";
+var WHOAMI_HELP = `coldtea-qa whoami \u2014 show the organization and key
+
+Usage
+  coldtea-qa whoami [--json]
+
+Calls GET /v1/me: which organization this key belongs to, the key's name,
+its scopes, and when it was last used.
+`;
+var whoamiCommand = {
+  words: ["whoami"],
+  summary: "whoami                       Show the organization and key this CLI authenticates as",
+  help: WHOAMI_HELP,
+  flags: {},
+  run: (context, output) => whoami(context, output)
+};
+var ALL_COMMANDS = [
+  whoamiCommand,
+  ...projectCommands,
+  ...testCommands,
+  ...groupCommands,
+  ...runCommands,
+  ...runsCommands,
+  ...buildCommands,
+  ...mergeCommands,
+  ...environmentCommands,
+  ...ruleCommands,
+  ...credentialCommands,
+  ...repositoryCommands,
+  ...appCommands
+];
+var USAGE = `coldtea-qa \u2014 Coldtea QA from the command line
+
+Usage
+  coldtea-qa <command> [flags]
+
+Start here
+  1  coldtea-qa whoami                      who you are, and what your key can do
+  2  coldtea-qa projects list               find a project id, then export
+                                            COLDTEA_PROJECT_ID
+  3  coldtea-qa groups create "Smoke"       tests live in groups
+  4  coldtea-qa tests create "Buy an item with a saved card" \\
+       --url https://shop.example           the description IS the test: say
+                                            what a person would do, in English
+  5  coldtea-qa run test mqt_\u2026 --wait       exit code is the verdict
+
+  Behind a login? Store the secret (coldtea-qa credentials create), point an
+  environment at the site (coldtea-qa environments create), then give the group
+  that environment (coldtea-qa groups update --environment).
+
+  Want it automatic on every pull request? coldtea-qa rules create.
+
+Commands
+${ALL_COMMANDS.map((def) => `  ${def.summary}`).join("\n")}
+
+  help [command]               Show help (e.g. coldtea-qa help run)
+
+Flags
+  --json              Machine-readable output on stdout
+  --project <id>      Project id (or COLDTEA_PROJECT_ID)
+  --api-key <key>     API key. Prefer COLDTEA_API_KEY: a flag is visible in
+                      \`ps\` while the process runs, in shell history, and in
+                      any CI log that echoes the step.
+  --fail-on-warning   Exit 1 when a run outcome is warning
+  --help              Show help. \`-h\` works on a bare \`coldtea-qa\`, but after
+                      a command spell it out \u2014 \`-h\` means HOST in too much
+                      tooling for a QA run to guess.
+  -v, --version       Print the version. Bare invocation only: after a command
+                      \`-v\` is an unknown option (exit 4), not a pass.
+
+Environment
+  COLDTEA_API_KEY     coldtea_sk_\u2026 key. The key identifies your organization.
+  COLDTEA_PROJECT_ID  Default project id
+  COLDTEA_BASE_URL    API origin (default https://www.coldtea.ai). Https
+                      only \u2014 plain http works on loopback, or with
+                      COLDTEA_ALLOW_INSECURE_HTTP=1
+  NO_COLOR            Disable color
+
+Exit codes
+  0 pass \xB7 1 fail \xB7 2 couldn't run or verify \xB7 3 conflict \xB7 4 auth/config
+
+  2 is worth retrying unchanged; 4 never is. A typo'd id or a malformed
+  request is 4, not 2 \u2014 retrying it can only fail again.
+`;
+var GLOBAL_FLAGS = {
+  "fail-on-warning": { type: "boolean", default: false },
+  project: { type: "string" }
+};
+var GLOBAL_OPTIONS = {
+  ...UNIVERSAL_FLAGS,
+  ...GLOBAL_FLAGS
+};
+var runCli = runCliFrom({
+  binary: "coldtea-qa",
+  version: CLI_VERSION,
+  usage: USAGE,
+  commands: ALL_COMMANDS,
+  globalFlags: GLOBAL_FLAGS,
+  buildContext: ({ base, values }) => ({
+    ...base,
+    flags: {
+      json: base.flags.json,
+      apiKey: base.flags.apiKey,
+      failOnWarning: values["fail-on-warning"] === true,
+      project: typeof values.project === "string" ? values.project : void 0
+    },
+    projectId: resolveProjectId({
+      flag: typeof values.project === "string" ? values.project : void 0,
+      env: base.env
+    })
+  })
+});
+export {
+  ALL_COMMANDS,
+  GLOBAL_FLAGS,
+  GLOBAL_OPTIONS,
+  runCli
+};