@cursor/july 0.1.1 → 0.1.2

package/dist/internal/cli-deploy.js

@@ -0,0 +1,731 @@
+/**
+ * `agentkit deploy | deployments | deployment | stop | rotate-token |
+ * rotate-pod-credential | secrets set|list|unset` — Heroku-style deploys
+ * onto Cursor's managed agent-serve hosting.
+ *
+ * All intelligence is server-side (backend/server/src/agentServe/); these
+ * handlers resolve parameters (credentials, team, slug, the project's
+ * `hosting` manifest block), call the management API through
+ * `deploy-client.ts`, poll status, and render.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { basename, resolve } from "node:path";
+import { CursorBackendClient } from "./cursor/backend-client.js";
+import { cursorBackendUrl, resolveApiKey, SIGN_IN_HINT, } from "./cursor/credentials.js";
+import { AgentServeDeployClient, DeployApiError, slugFromDirectoryName, TERMINAL_DEPLOY_STATUSES, validateDeploymentSlug, } from "./deploy-client.js";
+import { isAgentProjectDir, loadAgentProject } from "./discovery.js";
+import { CLI_COMMAND_NAME as CLI } from "./distribution.js";
+import { isValidCursorEventRepo, validateSettableSecretName, } from "./hosting.js";
+const DEFAULT_POLL_INTERVAL_MS = 3000;
+const DEFAULT_DEPLOY_TIMEOUT_MS = 10 * 60 * 1000;
+/**
+ * Shared preamble: credentials → client → team id. Returns an exit code
+ * (with the error already rendered) when resolution fails.
+ */
+function prepare(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d;
+        const out = (_a = options.out) !== null && _a !== void 0 ? _a : ((text) => void process.stdout.write(text));
+        const err = (_b = options.err) !== null && _b !== void 0 ? _b : ((text) => void process.stderr.write(text));
+        const resolved = yield resolveApiKey(options.apiKey === undefined ? undefined : { apiKey: options.apiKey });
+        if (resolved === undefined) {
+            err(`Not signed in to Cursor. ${SIGN_IN_HINT}\n`);
+            return 1;
+        }
+        const client = new AgentServeDeployClient(Object.assign({ backendUrl: resolved.backendUrl, apiKey: resolved.apiKey }, (options.fetchImpl === undefined
+            ? {}
+            : { fetchImpl: options.fetchImpl })));
+        let teamId;
+        if (options.team !== undefined) {
+            teamId = Number.parseInt(options.team, 10);
+            if (Number.isNaN(teamId) || teamId <= 0) {
+                err(`Invalid --team: ${options.team} (expected a positive team id)\n`);
+                return 1;
+            }
+        }
+        else {
+            const account = new CursorBackendClient(Object.assign({ backendUrl: resolved.backendUrl, apiKey: resolved.apiKey }, (options.fetchImpl === undefined
+                ? {}
+                : { fetchImpl: options.fetchImpl })));
+            let identity;
+            try {
+                identity = yield account.getMe();
+            }
+            catch (error) {
+                err(`Could not resolve your team from the Cursor account: ${describeError(error)}\nPass --team <id> explicitly.\n`);
+                return 1;
+            }
+            if (identity.teamId === undefined || identity.teamId <= 0) {
+                err("This Cursor account has no default team; pass --team <id> (find it in the Cursor dashboard URL).\n");
+                return 1;
+            }
+            teamId = identity.teamId;
+            err(`Using team ${teamId}${identity.teamName === undefined ? "" : ` (${identity.teamName})`} — the account's team; pass --team to override.\n`);
+        }
+        return {
+            client,
+            teamId,
+            json: options.json === true,
+            noWait: options.noWait === true,
+            pollIntervalMs: (_c = options.pollIntervalMs) !== null && _c !== void 0 ? _c : DEFAULT_POLL_INTERVAL_MS,
+            timeoutMs: (_d = options.timeoutMs) !== null && _d !== void 0 ? _d : DEFAULT_DEPLOY_TIMEOUT_MS,
+            out,
+            err,
+        };
+    });
+}
+// ============================================================================
+// deploy
+// ============================================================================
+export function cmdDeploy(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d;
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        const dir = resolve((_a = options.dir) !== null && _a !== void 0 ? _a : ".");
+        let slug;
+        if (options.slug !== undefined) {
+            const slugError = validateDeploymentSlug(options.slug);
+            if (slugError !== undefined) {
+                ctx.err(`${slugError}\n`);
+                return 1;
+            }
+            slug = options.slug;
+        }
+        else {
+            const derived = slugFromDirectoryName(basename(dir));
+            if (derived === undefined) {
+                ctx.err(`Could not derive a deployment slug from the directory name ${JSON.stringify(basename(dir))}; pass --slug.\n`);
+                return 1;
+            }
+            slug = derived;
+            ctx.err(`Deploying as "${slug}" (from the directory name).\n`);
+        }
+        if (options.repo !== undefined && !options.repo.startsWith("https://")) {
+            ctx.err(`Invalid --repo: ${options.repo} (expected an https:// git repository URL)\n`);
+            return 1;
+        }
+        for (const repo of (_b = options.cursorEventsRepos) !== null && _b !== void 0 ? _b : []) {
+            if (!isValidCursorEventRepo(repo)) {
+                ctx.err(`Invalid --cursor-events-repo: ${repo} (expected owner/name)\n`);
+                return 1;
+            }
+        }
+        // The package manifest (`defineAgent({ hosting })`) is the source of
+        // truth for egress domains and expected secret names; flags override or
+        // augment it. Directories without an agent project (static placeholder
+        // deploys) simply have no manifest.
+        const hosting = yield readHostingManifest(dir);
+        const egressAllowedDomains = [
+            ...new Set([
+                ...((_c = hosting === null || hosting === void 0 ? void 0 : hosting.egressDomains) !== null && _c !== void 0 ? _c : []),
+                ...((_d = options.allowDomains) !== null && _d !== void 0 ? _d : []),
+            ]),
+        ];
+        // Today's only source shape: the control plane builds from a git ref (or
+        // serves the static placeholder). See DeploySource for the artifact seam.
+        const source = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ kind: "git-ref" }, (options.repo === undefined ? {} : { gitRepoUrl: options.repo })), (options.ref === undefined ? {} : { gitRef: options.ref })), (options.path === undefined ? {} : { agentPath: options.path })), (options.cursorEventsRepos === undefined ||
+            options.cursorEventsRepos.length === 0
+            ? {}
+            : { cursorEventRepos: options.cursorEventsRepos })), (egressAllowedDomains.length === 0 ? {} : { egressAllowedDomains }));
+        let accepted;
+        try {
+            accepted = yield ctx.client.deploy({ teamId: ctx.teamId, slug, source });
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        const aliasUrl = ctx.client.aliasUrl(accepted.engineAlias);
+        if (!ctx.json && accepted.aliasToken !== undefined) {
+            ctx.out(aliasTokenBlock(accepted.aliasToken));
+        }
+        if (ctx.noWait) {
+            if (ctx.json) {
+                ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
+            }
+            else {
+                ctx.out(`Deploy accepted: ${slug} (team ${ctx.teamId}, generation ${accepted.generation}, ${accepted.deploymentKind})\n` +
+                    `  alias: ${aliasUrl}\n` +
+                    `Check progress with \`${CLI} deployment ${slug} --team ${ctx.teamId}\`.\n`);
+            }
+            return 0;
+        }
+        let detail;
+        try {
+            detail = yield pollUntil(ctx, slug, TERMINAL_DEPLOY_STATUSES);
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        warnMissingSecrets(ctx, slug, hosting === null || hosting === void 0 ? void 0 : hosting.secretNames, detail.secretNames);
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify(accepted.aliasToken === undefined
+                ? detail
+                : Object.assign(Object.assign({}, detail), { aliasToken: accepted.aliasToken }), null, 2)}\n`);
+            return detail.status === "running" ? 0 : 1;
+        }
+        if (detail.status !== "running") {
+            ctx.err(`Deployment ${slug} ended ${detail.status}${detail.lastError === null || detail.lastError === undefined
+                ? ""
+                : `: ${detail.lastError}`}\n`);
+            return 1;
+        }
+        ctx.out(`Deployed ${slug} (team ${ctx.teamId})\n` +
+            `  status:      running\n` +
+            `  generation:  ${detail.generation}\n` +
+            `  kind:        ${detail.deploymentKind}\n` +
+            `  alias:       ${aliasUrl}\n` +
+            `  playground:  ${aliasUrl}/playground (send X-Agent-Alias-Token)\n`);
+        return 0;
+    });
+}
+/**
+ * Read the `hosting` block from the project manifest at `dir`, or
+ * undefined when the directory is not an agent project (static deploys
+ * have nothing to discover).
+ */
+function readHostingManifest(dir) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (!(yield isAgentProjectDir(dir))) {
+            return undefined;
+        }
+        const project = yield loadAgentProject(dir);
+        return project.agent.hosting;
+    });
+}
+/**
+ * Friendly post-deploy nudge: the manifest declares secrets the agent
+ * expects, but the deployment does not have them all set yet.
+ */
+function warnMissingSecrets(ctx, slug, declared, set) {
+    if (declared === undefined || declared.length === 0) {
+        return;
+    }
+    const setNames = new Set(set !== null && set !== void 0 ? set : []);
+    const missing = declared.filter((name) => !setNames.has(name));
+    if (missing.length === 0) {
+        return;
+    }
+    ctx.err(`warning: secrets declared in the agent manifest but not set on ${slug}: ${missing.join(", ")}\n` +
+        `  set them with \`${CLI} secrets set ${slug} ${missing.join(" ")}\`\n`);
+}
+// ============================================================================
+// deployments (list)
+// ============================================================================
+export function cmdDeployments(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        let deployments;
+        try {
+            deployments = yield ctx.client.listDeployments({ teamId: ctx.teamId });
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify({ deployments }, null, 2)}\n`);
+            return 0;
+        }
+        if (deployments.length === 0) {
+            ctx.out(`No deployments on team ${ctx.teamId}. Create one with \`${CLI} deploy\`.\n`);
+            return 0;
+        }
+        ctx.out(`${renderTable(["SLUG", "STATUS", "GEN", "KIND", "UPDATED"], deployments.map((d) => { var _a; return [
+            d.slug,
+            d.status,
+            String(d.generation),
+            d.deploymentKind,
+            (_a = d.desiredUpdatedAt) !== null && _a !== void 0 ? _a : "",
+        ]; }))}\n`);
+        return 0;
+    });
+}
+// ============================================================================
+// deployment <slug> (detail)
+// ============================================================================
+export function cmdDeploymentStatus(slug, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        if (slug === undefined || slug === "") {
+            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} deployment <slug> [--team <id>] [--json]\n`);
+            return 1;
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        let detail;
+        try {
+            detail = yield ctx.client.getDeployment({ teamId: ctx.teamId, slug });
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify(detail, null, 2)}\n`);
+            return 0;
+        }
+        const aliasUrl = ctx.client.aliasUrl(detail.engineAlias);
+        const lines = [
+            `${detail.slug} (team ${detail.teamId})`,
+            `  status:      ${detail.status}`,
+            `  generation:  ${detail.generation}`,
+            `  kind:        ${detail.deploymentKind}`,
+            `  alias:       ${aliasUrl}`,
+        ];
+        if (detail.gitRepoUrl !== null && detail.gitRepoUrl !== undefined) {
+            lines.push(`  repo:        ${detail.gitRepoUrl} @ ${(_b = detail.gitRef) !== null && _b !== void 0 ? _b : ""}`);
+        }
+        if (detail.serviceAccountId !== undefined &&
+            detail.serviceAccountId !== null) {
+            lines.push(`  service account: ${detail.serviceAccountId}`);
+        }
+        if (detail.egressAllowedDomains !== undefined &&
+            detail.egressAllowedDomains.length > 0) {
+            lines.push(`  egress:      ${detail.egressAllowedDomains.join(", ")}`);
+        }
+        if (detail.secretNames !== undefined && detail.secretNames.length > 0) {
+            lines.push(`  secrets:     ${detail.secretNames.join(", ")}`);
+        }
+        if (detail.podCredentialMaskedKey !== undefined &&
+            detail.podCredentialMaskedKey !== null) {
+            lines.push(`  pod credential: ${detail.podCredentialMaskedKey}`);
+        }
+        if (detail.engineUrl !== null && detail.engineUrl !== undefined) {
+            lines.push(`  engine:      ${detail.engineUrl}`);
+        }
+        if (detail.engineAccess !== null &&
+            detail.engineAccess !== undefined &&
+            typeof detail.engineAccess === "object") {
+            lines.push(`  engine access: ${detail.engineAccess.url} (expires ${detail.engineAccess.expiresAt})`);
+        }
+        if (detail.lastError !== null && detail.lastError !== undefined) {
+            lines.push(`  last error:  ${detail.lastError}`);
+        }
+        if (detail.desiredUpdatedAt !== undefined) {
+            lines.push(`  updated:     ${detail.desiredUpdatedAt}`);
+        }
+        ctx.out(`${lines.join("\n")}\n`);
+        return 0;
+    });
+}
+// ============================================================================
+// stop <slug>
+// ============================================================================
+export function cmdStop(slug, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (slug === undefined || slug === "") {
+            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} stop <slug> [--team <id>] [--json] [--no-wait]\n`);
+            return 1;
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        let accepted;
+        try {
+            accepted = yield ctx.client.stopDeployment({ teamId: ctx.teamId, slug });
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.noWait) {
+            if (ctx.json) {
+                ctx.out(`${JSON.stringify(accepted, null, 2)}\n`);
+            }
+            else {
+                ctx.out(`Stop accepted for ${slug} (status: ${accepted.status}).\n`);
+            }
+            return 0;
+        }
+        let detail;
+        try {
+            detail = yield pollUntil(ctx, slug, new Set(["stopped"]));
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify(detail, null, 2)}\n`);
+        }
+        else {
+            ctx.out(`Stopped ${slug} (team ${ctx.teamId}).\n`);
+        }
+        return 0;
+    });
+}
+// ============================================================================
+// rotate-token <slug>
+// ============================================================================
+export function cmdRotateToken(slug, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (slug === undefined || slug === "") {
+            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} rotate-token <slug> [--team <id>]\n`);
+            return 1;
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        let aliasToken;
+        try {
+            aliasToken = yield ctx.client.rotateAliasToken({
+                teamId: ctx.teamId,
+                slug,
+            });
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify({ aliasToken }, null, 2)}\n`);
+            return 0;
+        }
+        ctx.out(`Rotated the alias token for ${slug}. The old token stopped working immediately.\n${aliasTokenBlock(aliasToken)}`);
+        return 0;
+    });
+}
+// ============================================================================
+// rotate-pod-credential <slug>
+// ============================================================================
+export function cmdRotatePodCredential(slug, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (slug === undefined || slug === "") {
+            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} rotate-pod-credential <slug> [--team <id>]\n`);
+            return 1;
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        let podCredentialMaskedKey;
+        try {
+            podCredentialMaskedKey = yield ctx.client.rotatePodCredential({
+                teamId: ctx.teamId,
+                slug,
+            });
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify({ podCredentialMaskedKey }, null, 2)}\n`);
+            return 0;
+        }
+        ctx.out(`Rotated the pod credential for ${slug}: ${podCredentialMaskedKey}\n` +
+            `The running pod keeps the old credential until the next deploy — run \`${CLI} deploy --slug ${slug}\` to apply it.\n`);
+        return 0;
+    });
+}
+// ============================================================================
+// secrets set|list|unset
+// ============================================================================
+export function cmdSecretsSet(slug, specs, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c;
+        const usageErr = (_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t));
+        if (slug === undefined || slug === "" || specs.length === 0) {
+            usageErr(`Usage: ${CLI} secrets set <slug> NAME[=VALUE] [NAME2[=VALUE2] ...] [--team <id>] [--json]\n` +
+                `NAMEs without =VALUE are prompted for (hidden input; reads stdin when piped).\n`);
+            return 1;
+        }
+        // Parse and validate every name before prompting for any value, so a
+        // typo in the last name cannot waste typed-in secrets.
+        const parsed = [];
+        for (const spec of specs) {
+            const eq = spec.indexOf("=");
+            const name = eq === -1 ? spec : spec.slice(0, eq);
+            const nameError = validateSettableSecretName(name);
+            if (nameError !== undefined) {
+                usageErr(`${nameError}\n`);
+                return 1;
+            }
+            parsed.push(eq === -1 ? { name } : { name, value: spec.slice(eq + 1) });
+        }
+        if (parsed.some((entry) => entry.value !== undefined)) {
+            usageErr(`warning: secret values passed as arguments can end up in shell history; prefer \`${CLI} secrets set ${slug} NAME\` and enter the value at the hidden prompt.\n`);
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        const stdin = (_b = options.stdin) !== null && _b !== void 0 ? _b : process.stdin;
+        const readValue = createSecretValueReader(stdin, ctx.err);
+        const secrets = [];
+        for (const entry of parsed) {
+            secrets.push({
+                name: entry.name,
+                value: (_c = entry.value) !== null && _c !== void 0 ? _c : (yield readValue(entry.name)),
+            });
+        }
+        let secretNames;
+        try {
+            secretNames = yield ctx.client.setSecrets({
+                teamId: ctx.teamId,
+                slug,
+                secrets,
+            });
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify({ secretNames }, null, 2)}\n`);
+            return 0;
+        }
+        ctx.out(`Set ${secrets.length} secret${secrets.length === 1 ? "" : "s"} on ${slug}.\n` +
+            `Secrets now set: ${secretNames.join(", ")}\n` +
+            `The engine picks them up on its next deploy.\n`);
+        return 0;
+    });
+}
+export function cmdSecretsList(slug, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (slug === undefined || slug === "") {
+            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} secrets list <slug> [--team <id>] [--json]\n`);
+            return 1;
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        let secrets;
+        try {
+            secrets = yield ctx.client.listSecrets({ teamId: ctx.teamId, slug });
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify({ secrets }, null, 2)}\n`);
+            return 0;
+        }
+        if (secrets.length === 0) {
+            ctx.out(`No secrets set on ${slug}. Add one with \`${CLI} secrets set ${slug} NAME\`.\n`);
+            return 0;
+        }
+        ctx.out(`${renderTable(["NAME", "CREATED"], secrets.map((secret) => [secret.name, secret.createdAt]))}\n`);
+        return 0;
+    });
+}
+export function cmdSecretsUnset(slug, name, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (slug === undefined || slug === "" || name === undefined || name === "") {
+            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} secrets unset <slug> NAME [--team <id>]\n`);
+            return 1;
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        try {
+            yield ctx.client.deleteSecret({ teamId: ctx.teamId, slug, name });
+        }
+        catch (error) {
+            if (error instanceof DeployApiError && error.status === 404) {
+                ctx.err(`No secret named ${name} on deployment ${slug} — check \`${CLI} secrets list ${slug}\` (and the slug / --team).\n`);
+                return 1;
+            }
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify({ removed: name }, null, 2)}\n`);
+        }
+        else {
+            ctx.out(`Removed secret ${name} from ${slug}.\n`);
+        }
+        return 0;
+    });
+}
+/**
+ * Returns a reader for interactive secret values: hidden (no-echo) prompt
+ * when `stdin` is a TTY, otherwise one line per secret from the piped
+ * stream. One reader per command so piped lines are consumed in order.
+ */
+function createSecretValueReader(stdin, err) {
+    if (stdin.isTTY === true) {
+        return (name) => promptHidden(stdin, err, `Value for ${name}: `);
+    }
+    const readLine = createLineReader(stdin);
+    return (name) => __awaiter(this, void 0, void 0, function* () {
+        const line = yield readLine();
+        if (line === undefined) {
+            throw new DeployApiError(`stdin ended before a value for ${name} was provided (pipe one line per secret).`, 0);
+        }
+        return line;
+    });
+}
+/** Raw-mode hidden prompt: echoes nothing, supports backspace and Ctrl-C. */
+function promptHidden(stdin, err, prompt) {
+    return new Promise((resolvePromise, reject) => {
+        var _a;
+        err(prompt);
+        (_a = stdin.setRawMode) === null || _a === void 0 ? void 0 : _a.call(stdin, true);
+        stdin.resume();
+        let value = "";
+        const cleanup = () => {
+            var _a;
+            stdin.off("data", onData);
+            (_a = stdin.setRawMode) === null || _a === void 0 ? void 0 : _a.call(stdin, false);
+            stdin.pause();
+            err("\n");
+        };
+        const onData = (chunk) => {
+            const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+            for (const ch of text) {
+                if (ch === "\r" || ch === "\n") {
+                    cleanup();
+                    resolvePromise(value);
+                    return;
+                }
+                if (ch === "\u0003") {
+                    cleanup();
+                    reject(new DeployApiError("Aborted.", 0));
+                    return;
+                }
+                if (ch === "\u007f" || ch === "\b") {
+                    value = value.slice(0, -1);
+                    continue;
+                }
+                value += ch;
+            }
+        };
+        stdin.on("data", onData);
+    });
+}
+/** Buffered line reader over a piped stream; undefined once it ends. */
+function createLineReader(stream) {
+    let buffer = "";
+    let ended = false;
+    const waiters = [];
+    const drain = () => {
+        var _a, _b;
+        while (waiters.length > 0) {
+            const newline = buffer.indexOf("\n");
+            if (newline !== -1) {
+                const line = buffer.slice(0, newline).replace(/\r$/, "");
+                buffer = buffer.slice(newline + 1);
+                (_a = waiters.shift()) === null || _a === void 0 ? void 0 : _a(line);
+                continue;
+            }
+            if (!ended) {
+                return;
+            }
+            // Stream ended: a trailing unterminated line still counts once.
+            const rest = buffer;
+            buffer = "";
+            (_b = waiters.shift()) === null || _b === void 0 ? void 0 : _b(rest === "" ? undefined : rest.replace(/\r$/, ""));
+        }
+    };
+    stream.on("data", (chunk) => {
+        buffer += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+        drain();
+    });
+    stream.on("end", () => {
+        ended = true;
+        drain();
+    });
+    stream.resume();
+    return () => new Promise((resolvePromise) => {
+        waiters.push(resolvePromise);
+        drain();
+    });
+}
+// ============================================================================
+// Polling + rendering helpers
+// ============================================================================
+/**
+ * Poll deployment status every `pollIntervalMs` until it lands in
+ * `terminal` (single-line progress on a TTY, one line per transition
+ * otherwise). Throws DeployApiError on request failures or timeout.
+ */
+function pollUntil(ctx, slug, terminal) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const startedAt = Date.now();
+        const tty = process.stderr.isTTY === true;
+        let lastStatus;
+        let sawProgress = false;
+        const report = (status) => {
+            if (ctx.json) {
+                return;
+            }
+            const elapsed = Math.round((Date.now() - startedAt) / 1000);
+            if (tty) {
+                ctx.err(`\r\x1b[2K${slug}: ${status} (${elapsed}s)`);
+                sawProgress = true;
+            }
+            else if (status !== lastStatus) {
+                ctx.err(`${slug}: ${status}\n`);
+            }
+            lastStatus = status;
+        };
+        const finishProgressLine = () => {
+            if (tty && sawProgress) {
+                ctx.err("\n");
+            }
+        };
+        for (;;) {
+            const detail = yield ctx.client
+                .getDeployment({ teamId: ctx.teamId, slug })
+                .catch((error) => {
+                finishProgressLine();
+                throw error;
+            });
+            report(detail.status);
+            if (terminal.has(detail.status)) {
+                finishProgressLine();
+                return detail;
+            }
+            if (Date.now() - startedAt >= ctx.timeoutMs) {
+                finishProgressLine();
+                throw new DeployApiError(`Timed out after ${Math.round(ctx.timeoutMs / 1000)}s waiting for ${slug} (last status: ${detail.status}). It may still converge — check \`${CLI} deployment ${slug} --team ${ctx.teamId}\`.`, 0);
+            }
+            yield sleep(ctx.pollIntervalMs);
+        }
+    });
+}
+function aliasTokenBlock(aliasToken) {
+    return (`\n  Alias token (shown ONCE — save it now, it cannot be retrieved again):\n\n` +
+        `    ${aliasToken}\n\n` +
+        `  Send it as the X-Agent-Alias-Token header on requests to the alias URL.\n` +
+        `  Lost tokens: \`${CLI} rotate-token <slug>\` mints a replacement.\n\n`);
+}
+function renderApiError(error, err) {
+    if (error instanceof DeployApiError) {
+        err(`${error.message}\n`);
+        return 1;
+    }
+    throw error;
+}
+function renderTable(header, rows) {
+    const widths = header.map((h, i) => Math.max(h.length, ...rows.map((row) => { var _a; return ((_a = row[i]) !== null && _a !== void 0 ? _a : "").length; })));
+    const renderRow = (row) => row
+        .map((cell, i) => { var _a; return cell.padEnd((_a = widths[i]) !== null && _a !== void 0 ? _a : 0); })
+        .join("  ")
+        .trimEnd();
+    return [renderRow(header), ...rows.map(renderRow)].join("\n");
+}
+function describeError(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function sleep(ms) {
+    return new Promise((resolvePromise) => setTimeout(resolvePromise, ms));
+}