@ekanos/cli 0.1.10 → 0.2.1

package/dist/commands/status.js

@@ -3,8 +3,10 @@ import * as path from 'node:path';
 import { refreshStoredSession, resolveAuthEnvironment, resolveIdentity, } from '../auth/session.js';
 import { CliError, authRequiredError, gateFailedError, preconditionError, } from '../errors.js';
 import { ERROR_CODES } from '../exit-codes.js';
+import { formatFindings, relativeTime } from '../findings-renderer.js';
 import { EKANOS_CONFIG_FILENAME, loadProject } from '../project.js';
 import { listSubmissions, } from '../publish-api.js';
+import { fetchSeatsWithOneRefresh } from '../seats.js';
 import { announceUpdate, checkForUpdate } from '../update-notice.js';
 import { readProjectVersion } from './publish.js';
 /** `--watch`'s poll interval — matches the mission brief exactly. */
@@ -35,8 +37,12 @@ const WATCH_TERMINAL_STATES = new Set(['gated', 'dev', 'rejected']);
  * Exit 0 whenever the report itself could be assembled — EXCEPT under
  * `--watch` (see below), whose exit code carries the gate's verdict instead.
  *
- * `--findings` requests each version's full finding list (`?detail=findings`
- * server-side) instead of just error/warn counts.
+ * The submission listing always requests the full `?detail=findings` shape
+ * server-side (needed so THIS PROJECT's latest-error auto-inline rendering
+ * — see `humanSummary` — has findings to inspect without a second
+ * round-trip). `--findings` no longer changes what's FETCHED; it changes
+ * what's RENDERED inline in human mode: every shown version's findings,
+ * not just the latest's error-severity ones.
  *
  * `--watch` turns `status` into a blocking wait: it requires a project with
  * a resolved source and a live session (both are PRECONDITIONs here, not
@@ -49,9 +55,21 @@ const WATCH_TERMINAL_STATES = new Set(['gated', 'dev', 'rejected']);
  * branches on it identically whether the gate ran inline (future) or via
  * this poll (today). `--json --watch` still emits exactly ONE envelope, at
  * completion — the polling itself only ever writes to stderr via `ctx.log`.
+ *
+ * Human-mode rendering is PROJECT-SCOPED: the server lists every
+ * submission for the resolved source (an org-level bucket shared by every
+ * project publishing there — `listSubmissions` has no server-side slug
+ * filter, see `publish-api.ts`'s wire contract), so "THIS PROJECT" groups
+ * the rows matching this project's own slug and "OTHER INTEGRATIONS IN
+ * SOURCE …" collapses everything else to one summary line per integration
+ * (or, with `--all`, the same table shape).
+ * The `--json` envelope stays additive-compatible: `submissions` is still
+ * the full, unfiltered list, with `data.project.scopedSubmissions` and
+ * `data.otherIntegrations` layered on top for a consumer that wants the
+ * pre-grouped view without re-deriving it.
  */
 export async function runStatus(ctx, args) {
-    var _a, _b, _c;
+    var _a, _b, _c, _d, _e, _f, _g, _h;
     const env = resolveAuthEnvironment(ctx, args.host, args.env, {
         projectDir: args.dir,
     });
@@ -76,7 +94,6 @@ export async function runStatus(ctx, args) {
     // never to produce.
     const live = stored ? ((_a = env.store.read(env.host)) !== null && _a !== void 0 ? _a : stored) : null;
     const project = readProjectReport(args.dir);
-    const detail = args.findings || args.watch ? 'findings' : undefined;
     if (args.watch) {
         if (!session.authenticated || !live) {
             throw authRequiredError(`"ekanos status --watch" needs a live session on ${env.host}.`, `Run "ekanos login --host ${env.host}" and retry.`);
@@ -92,7 +109,13 @@ export async function runStatus(ctx, args) {
     }
     let submissions = null;
     if ((project === null || project === void 0 ? void 0 : project.source) && session.authenticated && live) {
-        submissions = await listWithOneRefresh(env, live, project.source, detail);
+        // Always the full `?detail=findings` shape, `--findings` or not: THIS
+        // PROJECT's auto-inline latest-error rendering (see `humanSummary`)
+        // needs the findings array to decide whether to render, not just the
+        // counts — and `data.project.scopedSubmissions` carries the same
+        // richer shape in the JSON envelope regardless of the flag. `--findings`
+        // now controls how much of it gets rendered inline, not what's fetched.
+        submissions = await listWithOneRefresh(env, live, project.source, 'findings');
     }
     else if ((project === null || project === void 0 ? void 0 : project.source) && !session.authenticated) {
         ctx.log(`ekanos: not logged in to ${env.host} — skipping the submission list. ` +
@@ -103,8 +126,26 @@ export async function runStatus(ctx, args) {
             '"ekanos publish --source <slug>" saves one, and status will list ' +
             'submissions from then on.');
     }
-    return ctx.succeed(Object.assign(Object.assign(Object.assign({ host: env.host }, session), { credentialsPath: env.store.filePath, project,
-        submissions }), (notice ? { toolchain: notice } : {})), humanSummary(env.host, session, project, submissions, (_c = args.findings) !== null && _c !== void 0 ? _c : false));
+    const projectIntegration = project && submissions
+        ? ((_c = submissions.find((s) => s.slug === project.slug)) !== null && _c !== void 0 ? _c : null)
+        : null;
+    const otherIntegrations = submissions
+        ? submissions
+            .filter((s) => s.slug !== (project === null || project === void 0 ? void 0 : project.slug))
+            .map((s) => summarizeIntegration(s))
+        : null;
+    // Best-effort, human-mode-only add-on for the header's "publish target
+    // (+ seat role)" line — same degrade-to-null contract as `whoami`'s own
+    // seat lookup. Skipped entirely in JSON mode: nothing in the envelope
+    // needs it, and it would otherwise be an extra network round-trip every
+    // existing `--json` caller pays for no reason.
+    const seatRole = !ctx.jsonMode && (project === null || project === void 0 ? void 0 : project.source) && session.authenticated && live
+        ? await fetchSeatRoleQuietly(env, live, project.source)
+        : null;
+    return ctx.succeed(Object.assign(Object.assign(Object.assign(Object.assign({ host: env.host }, session), { credentialsPath: env.store.filePath, project: project
+            ? Object.assign(Object.assign({}, project), { scopedSubmissions: submissions
+                    ? ((_d = projectIntegration === null || projectIntegration === void 0 ? void 0 : projectIntegration.versions) !== null && _d !== void 0 ? _d : [])
+                    : null }) : null, submissions }), (otherIntegrations !== null ? { otherIntegrations } : {})), (notice ? { toolchain: notice } : {})), humanSummary(ctx.ui, (_e = project === null || project === void 0 ? void 0 : project.dir) !== null && _e !== void 0 ? _e : path.resolve(args.dir), env.host, session, project, submissions, { findings: (_f = args.findings) !== null && _f !== void 0 ? _f : false, all: (_g = args.all) !== null && _g !== void 0 ? _g : false }, seatRole, (_h = args.now) !== null && _h !== void 0 ? _h : new Date()));
 }
 /**
  * The `--watch` poll loop. Targets THIS project's current submission —
@@ -122,7 +163,10 @@ async function runWatch(ctx, env, project, args) {
     }
     const targetVersion = readProjectVersion(project.dir);
     const sleep = (_a = args.sleep) !== null && _a !== void 0 ? _a : defaultSleep;
-    ctx.log(`ekanos: watching ${project.slug}@${targetVersion} on ${env.host} ` +
+    // Glyph-only restyle — the poll contract itself (exit codes, timing,
+    // JSON envelope) is unchanged.
+    const waitGlyph = ctx.jsonMode ? '' : `${ctx.ui.dim(ctx.ui.glyphs.info)} `;
+    ctx.log(`${waitGlyph}ekanos: watching ${project.slug}@${targetVersion} on ${env.host} ` +
         `(polling every ${WATCH_POLL_INTERVAL_MS / 1000}s)…`);
     for (;;) {
         // Re-read the session from the credential store on EVERY iteration —
@@ -145,7 +189,7 @@ async function runWatch(ctx, env, project, args) {
         if (version && WATCH_TERMINAL_STATES.has(version.state)) {
             return reportWatchOutcome(ctx, project.slug, version);
         }
-        ctx.log(`ekanos: ${project.slug}@${targetVersion} is ` +
+        ctx.log(`${waitGlyph}ekanos: ${project.slug}@${targetVersion} is ` +
             `${version ? version.state : 'not visible yet'} — waiting…`);
         await sleep(WATCH_POLL_INTERVAL_MS);
     }
@@ -239,48 +283,273 @@ async function listWithOneRefresh(env, session, source, detail) {
     // it. This is unreachable in practice; belt and braces for a racing revoke.
     throw authRequiredError(`The session for ${env.host} could not authorize the submission list.`, `Run "ekanos login --host ${env.host}" and retry.`);
 }
-function humanSummary(host, session, project, submissions, showFindings) {
+/**
+ * `whoami`'s seat-lookup degradation, narrowed to one source's role: a
+ * network hiccup, MFA, or a deployment predating the seats route must never
+ * turn a working `status` into a failing one — the header simply omits the
+ * "(role)" suffix.
+ */
+async function fetchSeatRoleQuietly(env, session, source) {
+    try {
+        const result = await fetchSeatsWithOneRefresh(env, session);
+        if (result.status !== 'ok')
+            return null;
+        const seat = result.sources.find((s) => s.slug === source);
+        return seat ? seat.roles.join(', ') : null;
+    }
+    catch (_a) {
+        return null;
+    }
+}
+function tryReadProjectVersion(dir) {
+    try {
+        return readProjectVersion(dir);
+    }
+    catch (_a) {
+        return null;
+    }
+}
+function timestampMs(iso) {
+    if (!iso)
+        return 0;
+    const parsed = new Date(iso).getTime();
+    return Number.isNaN(parsed) ? 0 : parsed;
+}
+/**
+ * Newest-first by `gatedAt ?? submittedAt`. Ties (including two versions
+ * with no timestamp at all) keep their original, server-given order —
+ * `Array#sort` is stable, and a stable no-op is the right answer when there
+ * is nothing to compare.
+ */
+export function sortVersionsNewestFirst(versions) {
+    return [...versions].sort((a, b) => {
+        var _a, _b;
+        return timestampMs((_a = b.gatedAt) !== null && _a !== void 0 ? _a : b.submittedAt) -
+            timestampMs((_b = a.gatedAt) !== null && _b !== void 0 ? _b : a.submittedAt);
+    });
+}
+function versionAge(version, now) {
+    var _a;
+    const timestamp = (_a = version.gatedAt) !== null && _a !== void 0 ? _a : version.submittedAt;
+    return timestamp ? relativeTime(timestamp, now) : '—';
+}
+export function findingsCellParts(ui, version) {
+    var _a, _b;
+    if (version.errorCount === null && version.warnCount === null) {
+        return { text: '—', paint: ui.dim };
+    }
+    const errorCount = (_a = version.errorCount) !== null && _a !== void 0 ? _a : 0;
+    const warnCount = (_b = version.warnCount) !== null && _b !== void 0 ? _b : 0;
+    if (errorCount === 0 && warnCount === 0) {
+        return { text: '0', paint: (text) => text };
+    }
+    const parts = [];
+    if (errorCount > 0)
+        parts.push(`${errorCount}E`);
+    if (warnCount > 0)
+        parts.push(`${warnCount}W`);
+    return { text: parts.join(' '), paint: errorCount > 0 ? ui.err : ui.warn };
+}
+export function stateColorFor(ui, state) {
+    if (state === 'dev' || state === 'prod')
+        return ui.ok;
+    if (state === 'gated')
+        return ui.accent;
+    if (state === 'submitted')
+        return ui.dim;
+    if (state === 'rejected' || state === 'revoked')
+        return ui.err;
+    return (text) => text;
+}
+/**
+ * A VERSION/STATE/AGE/FINDINGS table, built by hand rather than via
+ * `ui.table`: STATE and FINDINGS need per-cell color, and `ui.table` sizes
+ * columns from the raw cell strings it's handed — a colored cell's ANSI
+ * escapes would inflate that width and misalign the column. `ui.ts`'s own
+ * doc comment on `padCell` names this exact tradeoff ("ignoring color codes
+ * in length math is the CALLER's job — pad before coloring, never after"),
+ * so this pads against the PLAIN text first and colors the already-padded
+ * string — the same rule `ui.table` documents, just applied here instead of
+ * inside it.
+ */
+export function renderVersionsTable(ui, versions, now) {
+    const headers = ['VERSION', 'STATE', 'AGE', 'FINDINGS'];
+    const rows = versions.map((version) => {
+        const findings = findingsCellParts(ui, version);
+        return {
+            version: version.version,
+            state: version.state,
+            age: versionAge(version, now),
+            findingsText: findings.text,
+            findingsPaint: findings.paint,
+            statePaint: stateColorFor(ui, version.state),
+        };
+    });
+    const widths = [
+        Math.max(headers[0].length, ...rows.map((r) => r.version.length)),
+        Math.max(headers[1].length, ...rows.map((r) => r.state.length)),
+        Math.max(headers[2].length, ...rows.map((r) => r.age.length)),
+        Math.max(headers[3].length, ...rows.map((r) => r.findingsText.length)),
+    ];
+    const headerLine = headers
+        .map((header, i) => ui.dim(header.padEnd(widths[i])))
+        .join('  ');
+    const bodyLines = rows.map((row) => [
+        row.version.padEnd(widths[0]),
+        row.statePaint(row.state.padEnd(widths[1])),
+        row.age.padEnd(widths[2]),
+        row.findingsPaint(row.findingsText.padEnd(widths[3])),
+    ].join('  '));
+    return [headerLine, ...bodyLines].join('\n');
+}
+/**
+ * The findings shown directly under THIS PROJECT's table. `--findings`
+ * forces every version's own findings inline; otherwise only the LATEST
+ * version's ERROR-severity findings auto-render (the moment a partner most
+ * needs them, no flag required), and a dim pointer at `ekanos status
+ * --findings` covers everything else with a nonzero count.
+ */
+function renderThisProjectFindings(ui, cwd, sorted, forceAll) {
+    var _a, _b, _c;
+    if (forceAll) {
+        const blocks = sorted
+            .filter((v) => v.findings && v.findings.length > 0)
+            .map((v) => [
+            `  ${ui.dim(`${v.version}:`)}`,
+            indentLines(formatFindings(ui, v.findings, { cwd }), 4),
+        ].join('\n'));
+        return blocks.length > 0 ? blocks.join('\n\n') : null;
+    }
+    const [latest, ...older] = sorted;
+    const latestErrors = ((_a = latest === null || latest === void 0 ? void 0 : latest.findings) !== null && _a !== void 0 ? _a : []).filter((f) => f.severity === 'error');
+    if (latest && latestErrors.length > 0 && latest.findings) {
+        return indentLines(formatFindings(ui, latest.findings, { cwd }), 2);
+    }
+    const latestNonzero = ((_b = latest === null || latest === void 0 ? void 0 : latest.errorCount) !== null && _b !== void 0 ? _b : 0) > 0 || ((_c = latest === null || latest === void 0 ? void 0 : latest.warnCount) !== null && _c !== void 0 ? _c : 0) > 0;
+    const olderNonzero = older.some((v) => { var _a, _b; return ((_a = v.errorCount) !== null && _a !== void 0 ? _a : 0) > 0 || ((_b = v.warnCount) !== null && _b !== void 0 ? _b : 0) > 0; });
+    return latestNonzero || olderNonzero
+        ? `  ${ui.dim('→ details: ekanos status --findings')}`
+        : null;
+}
+export function summarizeIntegration(integration) {
+    var _a, _b, _c;
+    const latest = (_a = sortVersionsNewestFirst(integration.versions)[0]) !== null && _a !== void 0 ? _a : null;
+    return {
+        slug: integration.slug,
+        name: integration.name,
+        versionsCount: integration.versions.length,
+        latestVersion: (_b = latest === null || latest === void 0 ? void 0 : latest.version) !== null && _b !== void 0 ? _b : null,
+        latestState: (_c = latest === null || latest === void 0 ? void 0 : latest.state) !== null && _c !== void 0 ? _c : null,
+    };
+}
+function indentLines(block, spaces) {
+    const prefix = ' '.repeat(spaces);
+    return block
+        .split('\n')
+        .map((line) => `${prefix}${line}`)
+        .join('\n');
+}
+function buildHeaderRows(host, session, project, seatRole) {
     var _a, _b, _c, _d;
-    const lines = [];
-    lines.push(session.authenticated
-        ? `status: logged in to ${host} as ${(_b = (_a = session.user) === null || _a === void 0 ? void 0 : _a.email) !== null && _b !== void 0 ? _b : (_c = session.user) === null || _c === void 0 ? void 0 : _c.id}${session.expiresAt ? ` (session expires ${session.expiresAt})` : ''}.`
-        : `status: not logged in to ${host}.`);
+    const rows = [
+        [
+            'identity',
+            session.authenticated
+                ? ((_d = (_b = (_a = session.user) === null || _a === void 0 ? void 0 : _a.email) !== null && _b !== void 0 ? _b : (_c = session.user) === null || _c === void 0 ? void 0 : _c.id) !== null && _d !== void 0 ? _d : 'unknown')
+                : 'not logged in',
+        ],
+        ['host', host],
+    ];
     if (project) {
-        lines.push(`  project: ${project.slug} in ${project.dir}` +
-            (project.source
-                ? ` (source "${project.source}")`
-                : ' (no source configured yet)'));
+        const version = tryReadProjectVersion(project.dir);
+        rows.push([
+            'project',
+            version ? `${project.slug}@${version}` : project.slug,
+        ]);
+        rows.push([
+            'target',
+            project.source
+                ? `${project.source}${seatRole ? ` (${seatRole})` : ''}`
+                : 'none (no source configured yet)',
+        ]);
+    }
+    return rows;
+}
+/**
+ * The closing `ui.nextAction` line, chosen from the LATEST version of THIS
+ * project — `null` (no closing line at all) whenever nothing is pending:
+ * no submission yet, or the latest is already `dev`/`prod`/`revoked`.
+ */
+export function buildNextAction(ui, latest) {
+    if (!latest)
+        return null;
+    if (latest.state === 'rejected') {
+        return ui.nextAction('ekanos status --findings', 'see what failed');
+    }
+    if (latest.state === 'gated') {
+        return `\n${ui.dim('→ awaiting admission (runs hourly)')}`;
+    }
+    if (latest.state === 'submitted') {
+        return `\n${ui.dim('→ awaiting gate result')}`;
+    }
+    return null;
+}
+function humanSummary(ui, cwd, host, session, project, submissions, args, seatRole, now) {
+    var _a, _b, _c, _d;
+    const lines = [];
+    lines.push(ui.keyValue(buildHeaderRows(host, session, project, seatRole)));
+    if (!session.authenticated) {
+        if (session.hint)
+            lines.push('', ui.dim(session.hint));
+        return lines.join('\n');
+    }
+    if (!project) {
+        lines.push('', ui.dim('project: none (no ekanos.json here).'));
+        return lines.join('\n');
+    }
+    if (!project.source) {
+        lines.push('', ui.dim('project: no "source" configured yet — the first ' +
+            '"ekanos publish --source <slug>" saves one.'));
+        return lines.join('\n');
+    }
+    if (!submissions) {
+        return lines.join('\n');
+    }
+    const projectIntegration = (_a = submissions.find((s) => s.slug === project.slug)) !== null && _a !== void 0 ? _a : null;
+    const others = submissions.filter((s) => s.slug !== project.slug);
+    lines.push('', ui.section('this project'));
+    const sorted = projectIntegration
+        ? sortVersionsNewestFirst(projectIntegration.versions)
+        : [];
+    if (sorted.length === 0) {
+        lines.push(`  ${ui.dim('no submissions yet for this project.')}`);
     }
     else {
-        lines.push('  project: none (no ekanos.json here).');
+        lines.push(indentLines(renderVersionsTable(ui, sorted, now), 2));
+        const findingsBlock = renderThisProjectFindings(ui, cwd, sorted, args.findings);
+        if (findingsBlock)
+            lines.push('', findingsBlock);
+    }
+    lines.push('', ui.section(`other integrations in source ${project.source}`));
+    if (others.length === 0) {
+        lines.push(`  ${ui.dim('none.')}`);
     }
-    if (submissions) {
-        if (submissions.length === 0) {
-            lines.push('  submissions: none yet.');
+    else if (args.all) {
+        for (const integration of others) {
+            const otherSorted = sortVersionsNewestFirst(integration.versions);
+            lines.push(`  ${ui.dim(integration.slug)}`);
+            lines.push(indentLines(renderVersionsTable(ui, otherSorted, now), 4));
         }
-        for (const integration of submissions) {
-            for (const version of integration.versions) {
-                lines.push(`  submissions: ${integration.slug}@${version.version} — ` +
-                    `${version.state}${version.submittedAt ? ` (submitted ${version.submittedAt})` : ''}${gateCountsSuffix(version)}`);
-                if (showFindings) {
-                    for (const finding of (_d = version.findings) !== null && _d !== void 0 ? _d : []) {
-                        lines.push(`    [${finding.severity}] ${finding.check}: ${finding.message} ` +
-                            `— ${finding.hint}`);
-                    }
-                }
-            }
+    }
+    else {
+        for (const integration of others) {
+            const summary = summarizeIntegration(integration);
+            lines.push(`  ${ui.dim(`${summary.slug} — ${summary.versionsCount} version${summary.versionsCount === 1 ? '' : 's'}, latest ${(_b = summary.latestVersion) !== null && _b !== void 0 ? _b : '?'} ${(_c = summary.latestState) !== null && _c !== void 0 ? _c : '?'}`)}`);
         }
     }
+    const action = buildNextAction(ui, (_d = sorted[0]) !== null && _d !== void 0 ? _d : null);
+    if (action)
+        lines.push(action);
     return lines.join('\n');
 }
-/** ` (N errors, M warnings)`, omitted entirely until a gate has actually run. */
-function gateCountsSuffix(version) {
-    var _a, _b;
-    if (version.errorCount === null && version.warnCount === null)
-        return '';
-    const errorCount = (_a = version.errorCount) !== null && _a !== void 0 ? _a : 0;
-    const warnCount = (_b = version.warnCount) !== null && _b !== void 0 ? _b : 0;
-    return (` (${errorCount} error${errorCount === 1 ? '' : 's'}, ` +
-        `${warnCount} warning${warnCount === 1 ? '' : 's'})`);
-}
 //# sourceMappingURL=status.js.map

package/dist/commands/status.js.map

@@ -1 +1 @@
-{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,QAAQ,EACR,iBAAiB,EACjB,eAAe,EACf,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,WAAW,EAAiB,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAGL,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C,qEAAqE;AACrE,MAAM,sBAAsB,GAAG,KAAM,CAAC;AAEtC;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;AAgCpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAe,EACf,IAAgB;;IAEhB,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE;QAC3D,UAAU,EAAE,IAAI,CAAC,GAAG;KACrB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAExC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,SAAS;KAC7B,CAAC,CAAC;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE5B,MAAM,OAAO,GAAG,MAAM;QACpB,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC;QACjC,CAAC,CAAC;YACE,aAAa,EAAE,KAAK;YACpB,IAAI,EAAE,4BAA4B,GAAG,CAAC,IAAI,eAAe;SAC1D,CAAC;IAEN,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,oBAAoB;IACpB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAA,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAI,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAElE,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,iBAAiB,CACrB,mDAAmD,GAAG,CAAC,IAAI,GAAG,EAC9D,4BAA4B,GAAG,CAAC,IAAI,cAAc,CACnD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,iBAAiB,CACrB,2BAA2B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EACpD,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,iBAAiB,CACrB,kDAAkD,EAClD,8DAA8D;gBAC5D,8CAA8C,CACjD,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,WAAW,GAA+B,IAAI,CAAC;IAEnD,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,KAAI,OAAO,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QACrD,WAAW,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;SAAM,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,KAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACrD,GAAG,CAAC,GAAG,CACL,4BAA4B,GAAG,CAAC,IAAI,mCAAmC;YACrE,CAAC,MAAA,OAAO,CAAC,IAAI,mCAAI,EAAE,CAAC,CACvB,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACtC,GAAG,CAAC,GAAG,CACL,sEAAsE;YACpE,mEAAmE;YACnE,2BAA2B,CAC9B,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,6CAEd,IAAI,EAAE,GAAG,CAAC,IAAI,IACX,OAAO,KACV,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,EACnC,OAAO;QACP,WAAW,KACR,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAE1C,YAAY,CACV,GAAG,CAAC,IAAI,EACR,OAAO,EACP,OAAO,EACP,WAAW,EACX,MAAA,IAAI,CAAC,QAAQ,mCAAI,KAAK,CACvB,CACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,QAAQ,CACrB,GAAe,EACf,GAA8C,EAC9C,OAAsB,EACtB,IAAgB;;IAEhB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,uEAAuE;QACvE,gDAAgD;QAChD,MAAM,iBAAiB,CACrB,kDAAkD,EAClD,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,MAAA,IAAI,CAAC,KAAK,mCAAI,YAAY,CAAC;IAEzC,GAAG,CAAC,GAAG,CACL,oBAAoB,OAAO,CAAC,IAAI,IAAI,aAAa,OAAO,GAAG,CAAC,IAAI,GAAG;QACjE,kBAAkB,sBAAsB,GAAG,IAAI,KAAK,CACvD,CAAC;IAEF,SAAS,CAAC;QACR,qEAAqE;QACrE,wEAAwE;QACxE,sEAAsE;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,oEAAoE;QACpE,iEAAiE;QACjE,sEAAsE;QACtE,gEAAgE;QAChE,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,iBAAiB,CACrB,mBAAmB,GAAG,CAAC,IAAI,qCAAqC;gBAC9D,6BAA6B,EAC/B,4BAA4B,GAAG,CAAC,IAAI,cAAc,CACnD,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAC3C,GAAG,EACH,OAAO,EACP,MAAM,EACN,UAAU,CACX,CAAC;QACF,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAEvE,IAAI,OAAO,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,OAAO,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;QAED,GAAG,CAAC,GAAG,CACL,WAAW,OAAO,CAAC,IAAI,IAAI,aAAa,MAAM;YAC5C,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,aAAa,CAC9D,CAAC;QAEF,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,YAAiC,EACjC,IAAY,EACZ,OAAe;;IAEf,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC9D,OAAO,MAAA,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,mCAAI,IAAI,CAAC;AAC1E,CAAC;AAED,SAAS,kBAAkB,CACzB,GAAe,EACf,IAAY,EACZ,OAA0B;;IAE1B,MAAM,IAAI,GAAG;QACX,IAAI;QACJ,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ,EAAE,MAAA,OAAO,CAAC,QAAQ,mCAAI,EAAE;QAChC,MAAM,EAAE,MAAA,OAAO,CAAC,MAAM,mCAAI,EAAE;KAC7B,CAAC;IAEF,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,GAAG,CAAC,IAAI,CACb,eAAe,CACb,GAAG,IAAI,IAAI,OAAO,CAAC,OAAO,4BAA4B;YACpD,IAAI,MAAA,IAAI,CAAC,UAAU,mCAAI,CAAC,SAAS,IAAI,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,EACvE,iEAAiE;YAC/D,uCAAuC,CAC1C,EACD,IAAI,CACL,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,CAChB,IAAI,EACJ,mBAAmB,IAAI,IAAI,OAAO,CAAC,OAAO,YAAY,OAAO,CAAC,KAAK,GAAG;QACpE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,WAAW,IAAI,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAC/F,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CACzB,GAA8C,EAC9C,MAAqB;IAErB,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAEjE,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;YACrE,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,aAAa,EAAE,CAAC;YAC1E,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAW;;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAErC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IAEvC,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,UAAU;QACtB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QACzB,MAAM,EAAE,MAAA,MAAM,CAAC,OAAO,CAAC,MAAM,mCAAI,IAAI;KACtC,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,KAAK,UAAU,kBAAkB,CAC/B,GAA8C,EAC9C,OAAsB,EACtB,MAAc,EACd,MAAmB;IAEnB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE;QACzE,MAAM;KACP,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,YAAY,CAAC;IAErD,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,GAAG,CAAC,IAAI,EACR,SAAS,CAAC,WAAW,EACrB,MAAM,EACN;QACE,MAAM;KACP,CACF,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,YAAY,CAAC;IAEvD,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,iBAAiB,CACrB,mBAAmB,GAAG,CAAC,IAAI,2CAA2C,EACtE,4BAA4B,GAAG,CAAC,IAAI,cAAc,CACnD,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,IAAY,EACZ,OAAsB,EACtB,OAA6B,EAC7B,WAAuC,EACvC,YAAqB;;IAErB,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CACR,OAAO,CAAC,aAAa;QACnB,CAAC,CAAC,wBAAwB,IAAI,OAC1B,MAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,KAAK,mCAAI,MAAA,OAAO,CAAC,IAAI,0CAAE,EACvC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;QAC1E,CAAC,CAAC,4BAA4B,IAAI,GAAG,CACxC,CAAC;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,CAAC,IAAI,CACR,cAAc,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,GAAG,EAAE;YAC5C,CAAC,OAAO,CAAC,MAAM;gBACb,CAAC,CAAC,aAAa,OAAO,CAAC,MAAM,IAAI;gBACjC,CAAC,CAAC,6BAA6B,CAAC,CACrC,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACzC,CAAC;QAED,KAAK,MAAM,WAAW,IAAI,WAAW,EAAE,CAAC;YACtC,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;gBAC3C,KAAK,CAAC,IAAI,CACR,kBAAkB,WAAW,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK;oBACxD,GAAG,OAAO,CAAC,KAAK,GACd,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAChE,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,CACjC,CAAC;gBAEF,IAAI,YAAY,EAAE,CAAC;oBACjB,KAAK,MAAM,OAAO,IAAI,MAAA,OAAO,CAAC,QAAQ,mCAAI,EAAE,EAAE,CAAC;wBAC7C,KAAK,CAAC,IAAI,CACR,QAAQ,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,OAAO,GAAG;4BAC/D,KAAK,OAAO,CAAC,IAAI,EAAE,CACtB,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,OAA0B;;IAClD,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAEzE,MAAM,UAAU,GAAG,MAAA,OAAO,CAAC,UAAU,mCAAI,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,SAAS,mCAAI,CAAC,CAAC;IAEzC,OAAO,CACL,KAAK,UAAU,SAAS,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI;QACvD,GAAG,SAAS,WAAW,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CACrD,CAAC;AACJ,CAAC","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport type { StoredSession } from '../auth/credential-store';\nimport {\n  refreshStoredSession,\n  resolveAuthEnvironment,\n  resolveIdentity,\n} from '../auth/session';\nimport type { CliContext } from '../context';\nimport {\n  CliError,\n  authRequiredError,\n  gateFailedError,\n  preconditionError,\n} from '../errors';\nimport { ERROR_CODES, type ExitCode } from '../exit-codes';\nimport { EKANOS_CONFIG_FILENAME, loadProject } from '../project';\nimport {\n  type SubmissionListing,\n  type SubmissionVersion,\n  listSubmissions,\n} from '../publish-api';\nimport { announceUpdate, checkForUpdate } from '../update-notice';\nimport { readProjectVersion } from './publish';\n\n/** `--watch`'s poll interval — matches the mission brief exactly. */\nconst WATCH_POLL_INTERVAL_MS = 30_000;\n\n/**\n * The states `--watch` stops on. `submitted` is the only non-terminal state\n * a version can be in when watching starts (an already-`gated`/`dev`/\n * `rejected` version resolves on the very first check, no polling needed).\n */\nconst WATCH_TERMINAL_STATES = new Set(['gated', 'dev', 'rejected']);\n\nexport interface StatusArgs {\n  host?: string;\n  /** Project directory (may contain ekanos.json). Defaults to cwd. */\n  dir: string;\n  env: Record<string, string | undefined>;\n  /** Render each version's full finding list, not just error/warn counts. */\n  findings?: boolean;\n  /**\n   * Block until this project's current (slug, version) submission reaches a\n   * terminal-for-waiting state (gated, dev, rejected), polling every 30s.\n   * Changes the command's exit-code contract — see `runStatus`'s docstring.\n   */\n  watch?: boolean;\n  /** Injectable for tests — see `auth/device-flow.ts`'s identical pattern. */\n  sleep?: (ms: number) => Promise<void>;\n}\n\ninterface SessionReport {\n  authenticated: boolean;\n  user?: { id: string; email: string | null; name: string | null };\n  expiresAt?: string;\n  hint?: string;\n}\n\ninterface ProjectReport {\n  dir: string;\n  slug: string;\n  source: string | null;\n}\n\n/**\n * `status` — the read verb: where am I pointed, who am I, and what has this\n * project submitted?\n *\n * Three sections, each degrading gracefully rather than failing:\n *\n *  - **session** — whoami's server-side identity check, but an absent or dead\n *    session reports `authenticated: false` with a hint instead of exit 4. A\n *    partner asking \"what is my state?\" must get an answer, not an error whose\n *    answer it is.\n *  - **project** — the ekanos.json in `--dir` (default cwd), when there is\n *    one. No project is an ordinary state for `status`, never an error.\n *  - **submissions** — `GET /api/partner/submissions?source=…` for the\n *    project's resolved source, only when both a session and a source exist.\n *    Server errors here DO map through the taxonomy: an unreachable host or a\n *    missing source is a fault to surface, not a state to absorb.\n *\n * Exit 0 whenever the report itself could be assembled — EXCEPT under\n * `--watch` (see below), whose exit code carries the gate's verdict instead.\n *\n * `--findings` requests each version's full finding list (`?detail=findings`\n * server-side) instead of just error/warn counts.\n *\n * `--watch` turns `status` into a blocking wait: it requires a project with\n * a resolved source and a live session (both are PRECONDITIONs here, not\n * degraded-to-false states — there is nothing to watch without them), then\n * polls `GET /api/partner/submissions?detail=findings` every 30s for THIS\n * project's current (slug, package.json version) submission until it reaches\n * a terminal-for-waiting state: `gated`/`dev` exit 0, `rejected` exits 10\n * (GATE_FAILED) with the findings carried in `data` — the same shape\n * `publish`'s own gate refusal uses, so an agent's fix-then-retry loop\n * branches on it identically whether the gate ran inline (future) or via\n * this poll (today). `--json --watch` still emits exactly ONE envelope, at\n * completion — the polling itself only ever writes to stderr via `ctx.log`.\n */\nexport async function runStatus(\n  ctx: CliContext,\n  args: StatusArgs,\n): Promise<ExitCode> {\n  const env = resolveAuthEnvironment(ctx, args.host, args.env, {\n    projectDir: args.dir,\n  });\n\n  const stored = env.store.read(env.host);\n\n  const notice = await checkForUpdate({\n    env: args.env,\n    host: env.host,\n    session: stored ?? undefined,\n  });\n  announceUpdate(ctx, notice);\n\n  const session = stored\n    ? await probeSession(env, stored)\n    : {\n        authenticated: false,\n        hint: `Run \"ekanos login --host ${env.host}\" to sign in.`,\n      };\n\n  // probeSession may have refreshed the session — persisting a NEW access\n  // token and ROTATING the refresh token on disk. Re-read before using it:\n  // the pre-probe object now holds a dead access token and an already-spent\n  // refresh token, and presenting those would turn \"logged in, token was\n  // merely stale\" into a hard exit-4 — the one failure this command promises\n  // never to produce.\n  const live = stored ? (env.store.read(env.host) ?? stored) : null;\n\n  const project = readProjectReport(args.dir);\n\n  const detail = args.findings || args.watch ? 'findings' : undefined;\n\n  if (args.watch) {\n    if (!session.authenticated || !live) {\n      throw authRequiredError(\n        `\"ekanos status --watch\" needs a live session on ${env.host}.`,\n        `Run \"ekanos login --host ${env.host}\" and retry.`,\n      );\n    }\n\n    if (!project) {\n      throw preconditionError(\n        `No ekanos.json found in ${path.resolve(args.dir)}.`,\n        'Run \"ekanos publish\" at least once before watching its gate result.',\n      );\n    }\n\n    if (!project.source) {\n      throw preconditionError(\n        'This project has no \"source\" in ekanos.json yet.',\n        'Run \"ekanos publish\" at least once (it saves the source you ' +\n          'publish to) before watching its gate result.',\n      );\n    }\n\n    return runWatch(ctx, env, project, args);\n  }\n\n  let submissions: SubmissionListing[] | null = null;\n\n  if (project?.source && session.authenticated && live) {\n    submissions = await listWithOneRefresh(env, live, project.source, detail);\n  } else if (project?.source && !session.authenticated) {\n    ctx.log(\n      `ekanos: not logged in to ${env.host} — skipping the submission list. ` +\n        (session.hint ?? ''),\n    );\n  } else if (project && !project.source) {\n    ctx.log(\n      'ekanos: this project has no \"source\" in ekanos.json yet — the first ' +\n        '\"ekanos publish --source <slug>\" saves one, and status will list ' +\n        'submissions from then on.',\n    );\n  }\n\n  return ctx.succeed(\n    {\n      host: env.host,\n      ...session,\n      credentialsPath: env.store.filePath,\n      project,\n      submissions,\n      ...(notice ? { toolchain: notice } : {}),\n    },\n    humanSummary(\n      env.host,\n      session,\n      project,\n      submissions,\n      args.findings ?? false,\n    ),\n  );\n}\n\n/**\n * The `--watch` poll loop. Targets THIS project's current submission —\n * `project.slug` + the version presently in `package.json` (the same value\n * `publish` would submit right now) — not \"whatever's most recent,\" so\n * watching after a publish can never resolve against a stale prior version.\n */\nasync function runWatch(\n  ctx: CliContext,\n  env: ReturnType<typeof resolveAuthEnvironment>,\n  project: ProjectReport,\n  args: StatusArgs,\n): Promise<ExitCode> {\n  const source = project.source;\n  if (!source) {\n    // Unreachable — the caller already checked — but keeps this function's\n    // own type honest without a non-null assertion.\n    throw preconditionError(\n      'This project has no \"source\" in ekanos.json yet.',\n      'Run \"ekanos publish\" at least once before watching its gate result.',\n    );\n  }\n\n  const targetVersion = readProjectVersion(project.dir);\n  const sleep = args.sleep ?? defaultSleep;\n\n  ctx.log(\n    `ekanos: watching ${project.slug}@${targetVersion} on ${env.host} ` +\n      `(polling every ${WATCH_POLL_INTERVAL_MS / 1000}s)…`,\n  );\n\n  for (;;) {\n    // Re-read the session from the credential store on EVERY iteration —\n    // never carry one over in a closure. Auth0 rotates the refresh token on\n    // every use (see `refreshStoredSession`'s docstring), so a token this\n    // loop already consumed is dead by the next iteration; the store is the\n    // persisted source of truth for whichever refresh most recently landed\n    // — this loop's own (via `listWithOneRefresh` below, which persists\n    // through `refreshStoredSession`), or a concurrent one from another\n    // process (another terminal running login/publish/status --watch\n    // against the same host). Threading the refreshed session back out of\n    // `listWithOneRefresh` instead would only cover the first case.\n    const current = env.store.read(env.host);\n\n    if (!current) {\n      throw authRequiredError(\n        `The session for ${env.host} is gone — \"ekanos status --watch\" ` +\n          'cannot continue without it.',\n        `Run \"ekanos login --host ${env.host}\" and retry.`,\n      );\n    }\n\n    const integrations = await listWithOneRefresh(\n      env,\n      current,\n      source,\n      'findings',\n    );\n    const version = findVersion(integrations, project.slug, targetVersion);\n\n    if (version && WATCH_TERMINAL_STATES.has(version.state)) {\n      return reportWatchOutcome(ctx, project.slug, version);\n    }\n\n    ctx.log(\n      `ekanos: ${project.slug}@${targetVersion} is ` +\n        `${version ? version.state : 'not visible yet'} — waiting…`,\n    );\n\n    await sleep(WATCH_POLL_INTERVAL_MS);\n  }\n}\n\nfunction findVersion(\n  integrations: SubmissionListing[],\n  slug: string,\n  version: string,\n): SubmissionVersion | null {\n  const integration = integrations.find((i) => i.slug === slug);\n  return integration?.versions.find((v) => v.version === version) ?? null;\n}\n\nfunction reportWatchOutcome(\n  ctx: CliContext,\n  slug: string,\n  version: SubmissionVersion,\n): ExitCode {\n  const data = {\n    slug,\n    version: version.version,\n    state: version.state,\n    gatedAt: version.gatedAt,\n    errorCount: version.errorCount,\n    warnCount: version.warnCount,\n    findings: version.findings ?? [],\n    stages: version.stages ?? [],\n  };\n\n  if (version.state === 'rejected') {\n    return ctx.fail(\n      gateFailedError(\n        `${slug}@${version.version} was rejected by the gate ` +\n          `(${data.errorCount ?? 0} error${data.errorCount === 1 ? '' : 's'}).`,\n        'Resolve the error-severity findings in data.findings, bump the ' +\n          'version, and re-run \"ekanos publish\".',\n      ),\n      data,\n    );\n  }\n\n  return ctx.succeed(\n    data,\n    `status --watch: ${slug}@${version.version} is now \"${version.state}\"` +\n      `${data.warnCount ? ` (${data.warnCount} warning${data.warnCount === 1 ? '' : 's'})` : ''}.`,\n  );\n}\n\nfunction defaultSleep(ms: number): Promise<void> {\n  return new Promise((resolve) => {\n    setTimeout(resolve, ms);\n  });\n}\n\n/**\n * whoami's identity resolution, with AUTH_REQUIRED absorbed into\n * `authenticated: false`. Anything else — network, precondition, MFA mapped\n * to auth by `fetchIdentity` — still propagates: \"the host was unreachable\"\n * must never be reported as \"you are logged out\".\n */\nasync function probeSession(\n  env: ReturnType<typeof resolveAuthEnvironment>,\n  stored: StoredSession,\n): Promise<SessionReport> {\n  try {\n    const { identity, session } = await resolveIdentity(env, stored);\n\n    return {\n      authenticated: true,\n      user: { id: identity.id, email: identity.email, name: identity.name },\n      expiresAt: session.expiresAt,\n    };\n  } catch (error) {\n    if (error instanceof CliError && error.code === ERROR_CODES.AUTH_REQUIRED) {\n      return { authenticated: false, hint: error.hint };\n    }\n\n    throw error;\n  }\n}\n\n/**\n * Lenient project read: no ekanos.json means \"not in a project\", which is an\n * answer, not an error. An ekanos.json that EXISTS but does not load keeps\n * `loadProject`'s strict behaviour — a broken project file is a fault the\n * partner needs named, whatever verb they ran.\n */\nfunction readProjectReport(dir: string): ProjectReport | null {\n  const projectDir = path.resolve(dir);\n\n  if (!fs.existsSync(path.join(projectDir, EKANOS_CONFIG_FILENAME))) {\n    return null;\n  }\n\n  const loaded = loadProject(projectDir);\n\n  return {\n    dir: loaded.projectDir,\n    slug: loaded.primary.slug,\n    source: loaded.project.source ?? null,\n  };\n}\n\n/** Mirrors publish's one-refresh-one-retry on a stale access token. */\nasync function listWithOneRefresh(\n  env: ReturnType<typeof resolveAuthEnvironment>,\n  session: StoredSession,\n  source: string,\n  detail?: 'findings',\n): Promise<SubmissionListing[]> {\n  const first = await listSubmissions(env.host, session.accessToken, source, {\n    detail,\n  });\n\n  if (first.status === 'ok') return first.integrations;\n\n  const refreshed = await refreshStoredSession(env, session);\n  const second = await listSubmissions(\n    env.host,\n    refreshed.accessToken,\n    source,\n    {\n      detail,\n    },\n  );\n\n  if (second.status === 'ok') return second.integrations;\n\n  // Authenticated a moment ago, unauthorized twice here: report the list as\n  // unavailable rather than the session as dead — probeSession already proved\n  // it. This is unreachable in practice; belt and braces for a racing revoke.\n  throw authRequiredError(\n    `The session for ${env.host} could not authorize the submission list.`,\n    `Run \"ekanos login --host ${env.host}\" and retry.`,\n  );\n}\n\nfunction humanSummary(\n  host: string,\n  session: SessionReport,\n  project: ProjectReport | null,\n  submissions: SubmissionListing[] | null,\n  showFindings: boolean,\n): string {\n  const lines: string[] = [];\n\n  lines.push(\n    session.authenticated\n      ? `status: logged in to ${host} as ${\n          session.user?.email ?? session.user?.id\n        }${session.expiresAt ? ` (session expires ${session.expiresAt})` : ''}.`\n      : `status: not logged in to ${host}.`,\n  );\n\n  if (project) {\n    lines.push(\n      `  project: ${project.slug} in ${project.dir}` +\n        (project.source\n          ? ` (source \"${project.source}\")`\n          : ' (no source configured yet)'),\n    );\n  } else {\n    lines.push('  project: none (no ekanos.json here).');\n  }\n\n  if (submissions) {\n    if (submissions.length === 0) {\n      lines.push('  submissions: none yet.');\n    }\n\n    for (const integration of submissions) {\n      for (const version of integration.versions) {\n        lines.push(\n          `  submissions: ${integration.slug}@${version.version} — ` +\n            `${version.state}${\n              version.submittedAt ? ` (submitted ${version.submittedAt})` : ''\n            }${gateCountsSuffix(version)}`,\n        );\n\n        if (showFindings) {\n          for (const finding of version.findings ?? []) {\n            lines.push(\n              `    [${finding.severity}] ${finding.check}: ${finding.message} ` +\n                `— ${finding.hint}`,\n            );\n          }\n        }\n      }\n    }\n  }\n\n  return lines.join('\\n');\n}\n\n/** ` (N errors, M warnings)`, omitted entirely until a gate has actually run. */\nfunction gateCountsSuffix(version: SubmissionVersion): string {\n  if (version.errorCount === null && version.warnCount === null) return '';\n\n  const errorCount = version.errorCount ?? 0;\n  const warnCount = version.warnCount ?? 0;\n\n  return (\n    ` (${errorCount} error${errorCount === 1 ? '' : 's'}, ` +\n    `${warnCount} warning${warnCount === 1 ? '' : 's'})`\n  );\n}\n"]}
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,QAAQ,EACR,iBAAiB,EACjB,eAAe,EACf,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,WAAW,EAAiB,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,EAGL,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C,qEAAqE;AACrE,MAAM,sBAAsB,GAAG,KAAM,CAAC;AAEtC;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;AA0CpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAe,EACf,IAAgB;;IAEhB,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE;QAC3D,UAAU,EAAE,IAAI,CAAC,GAAG;KACrB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAExC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,SAAS;KAC7B,CAAC,CAAC;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE5B,MAAM,OAAO,GAAG,MAAM;QACpB,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC;QACjC,CAAC,CAAC;YACE,aAAa,EAAE,KAAK;YACpB,IAAI,EAAE,4BAA4B,GAAG,CAAC,IAAI,eAAe;SAC1D,CAAC;IAEN,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,oBAAoB;IACpB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAA,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAI,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAElE,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE5C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,iBAAiB,CACrB,mDAAmD,GAAG,CAAC,IAAI,GAAG,EAC9D,4BAA4B,GAAG,CAAC,IAAI,cAAc,CACnD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,iBAAiB,CACrB,2BAA2B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EACpD,qEAAqE,CACtE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,iBAAiB,CACrB,kDAAkD,EAClD,8DAA8D;gBAC5D,8CAA8C,CACjD,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,WAAW,GAA+B,IAAI,CAAC;IAEnD,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,KAAI,OAAO,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QACrD,sEAAsE;QACtE,oEAAoE;QACpE,qEAAqE;QACrE,iEAAiE;QACjE,yEAAyE;QACzE,wEAAwE;QACxE,WAAW,GAAG,MAAM,kBAAkB,CACpC,GAAG,EACH,IAAI,EACJ,OAAO,CAAC,MAAM,EACd,UAAU,CACX,CAAC;IACJ,CAAC;SAAM,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,KAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACrD,GAAG,CAAC,GAAG,CACL,4BAA4B,GAAG,CAAC,IAAI,mCAAmC;YACrE,CAAC,MAAA,OAAO,CAAC,IAAI,mCAAI,EAAE,CAAC,CACvB,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACtC,GAAG,CAAC,GAAG,CACL,sEAAsE;YACpE,mEAAmE;YACnE,2BAA2B,CAC9B,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,GACtB,OAAO,IAAI,WAAW;QACpB,CAAC,CAAC,CAAC,MAAA,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,mCAAI,IAAI,CAAC;QAC5D,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,iBAAiB,GAAG,WAAW;QACnC,CAAC,CAAC,WAAW;aACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,MAAK,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,CAAA,CAAC;aACvC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC;IAET,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,wEAAwE;IACxE,+CAA+C;IAC/C,MAAM,QAAQ,GACZ,CAAC,GAAG,CAAC,QAAQ,KAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,CAAA,IAAI,OAAO,CAAC,aAAa,IAAI,IAAI;QAC/D,CAAC,CAAC,MAAM,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC;IAEX,OAAO,GAAG,CAAC,OAAO,2DAEd,IAAI,EAAE,GAAG,CAAC,IAAI,IACX,OAAO,KACV,eAAe,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,EACnC,OAAO,EAAE,OAAO;YACd,CAAC,iCACM,OAAO,KACV,iBAAiB,EAAE,WAAW;oBAC5B,CAAC,CAAC,CAAC,MAAA,kBAAkB,aAAlB,kBAAkB,uBAAlB,kBAAkB,CAAE,QAAQ,mCAAI,EAAE,CAAC;oBACtC,CAAC,CAAC,IAAI,IAEZ,CAAC,CAAC,IAAI,EACR,WAAW,KACR,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACzD,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAE1C,YAAY,CACV,GAAG,CAAC,EAAE,EACN,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,mCAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EACtC,GAAG,CAAC,IAAI,EACR,OAAO,EACP,OAAO,EACP,WAAW,EACX,EAAE,QAAQ,EAAE,MAAA,IAAI,CAAC,QAAQ,mCAAI,KAAK,EAAE,GAAG,EAAE,MAAA,IAAI,CAAC,GAAG,mCAAI,KAAK,EAAE,EAC5D,QAAQ,EACR,MAAA,IAAI,CAAC,GAAG,mCAAI,IAAI,IAAI,EAAE,CACvB,CACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,QAAQ,CACrB,GAAe,EACf,GAA8C,EAC9C,OAAsB,EACtB,IAAgB;;IAEhB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,uEAAuE;QACvE,gDAAgD;QAChD,MAAM,iBAAiB,CACrB,kDAAkD,EAClD,qEAAqE,CACtE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,MAAA,IAAI,CAAC,KAAK,mCAAI,YAAY,CAAC;IAEzC,qEAAqE;IACrE,+BAA+B;IAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;IAE3E,GAAG,CAAC,GAAG,CACL,GAAG,SAAS,oBAAoB,OAAO,CAAC,IAAI,IAAI,aAAa,OAAO,GAAG,CAAC,IAAI,GAAG;QAC7E,kBAAkB,sBAAsB,GAAG,IAAI,KAAK,CACvD,CAAC;IAEF,SAAS,CAAC;QACR,qEAAqE;QACrE,wEAAwE;QACxE,sEAAsE;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,oEAAoE;QACpE,iEAAiE;QACjE,sEAAsE;QACtE,gEAAgE;QAChE,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,iBAAiB,CACrB,mBAAmB,GAAG,CAAC,IAAI,qCAAqC;gBAC9D,6BAA6B,EAC/B,4BAA4B,GAAG,CAAC,IAAI,cAAc,CACnD,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAC3C,GAAG,EACH,OAAO,EACP,MAAM,EACN,UAAU,CACX,CAAC;QACF,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAEvE,IAAI,OAAO,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,OAAO,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;QAED,GAAG,CAAC,GAAG,CACL,GAAG,SAAS,WAAW,OAAO,CAAC,IAAI,IAAI,aAAa,MAAM;YACxD,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,aAAa,CAC9D,CAAC;QAEF,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,YAAiC,EACjC,IAAY,EACZ,OAAe;;IAEf,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC9D,OAAO,MAAA,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,mCAAI,IAAI,CAAC;AAC1E,CAAC;AAED,SAAS,kBAAkB,CACzB,GAAe,EACf,IAAY,EACZ,OAA0B;;IAE1B,MAAM,IAAI,GAAG;QACX,IAAI;QACJ,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ,EAAE,MAAA,OAAO,CAAC,QAAQ,mCAAI,EAAE;QAChC,MAAM,EAAE,MAAA,OAAO,CAAC,MAAM,mCAAI,EAAE;KAC7B,CAAC;IAEF,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,GAAG,CAAC,IAAI,CACb,eAAe,CACb,GAAG,IAAI,IAAI,OAAO,CAAC,OAAO,4BAA4B;YACpD,IAAI,MAAA,IAAI,CAAC,UAAU,mCAAI,CAAC,SAAS,IAAI,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,EACvE,iEAAiE;YAC/D,uCAAuC,CAC1C,EACD,IAAI,CACL,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,CAChB,IAAI,EACJ,mBAAmB,IAAI,IAAI,OAAO,CAAC,OAAO,YAAY,OAAO,CAAC,KAAK,GAAG;QACpE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,WAAW,IAAI,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAC/F,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CACzB,GAA8C,EAC9C,MAAqB;IAErB,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAEjE,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;YACrE,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,aAAa,EAAE,CAAC;YAC1E,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAW;;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAErC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IAEvC,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,UAAU;QACtB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;QACzB,MAAM,EAAE,MAAA,MAAM,CAAC,OAAO,CAAC,MAAM,mCAAI,IAAI;KACtC,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,KAAK,UAAU,kBAAkB,CAC/B,GAA8C,EAC9C,OAAsB,EACtB,MAAc,EACd,MAAmB;IAEnB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE;QACzE,MAAM;KACP,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,YAAY,CAAC;IAErD,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,GAAG,CAAC,IAAI,EACR,SAAS,CAAC,WAAW,EACrB,MAAM,EACN;QACE,MAAM;KACP,CACF,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,YAAY,CAAC;IAEvD,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,iBAAiB,CACrB,mBAAmB,GAAG,CAAC,IAAI,2CAA2C,EACtE,4BAA4B,GAAG,CAAC,IAAI,cAAc,CACnD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CACjC,GAA8C,EAC9C,OAAsB,EACtB,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAExC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAA8B;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IACvC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAsC;IAEtC,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;;QACP,OAAA,WAAW,CAAC,MAAA,CAAC,CAAC,OAAO,mCAAI,CAAC,CAAC,WAAW,CAAC;YACvC,WAAW,CAAC,MAAA,CAAC,CAAC,OAAO,mCAAI,CAAC,CAAC,WAAW,CAAC,CAAA;KAAA,CAC1C,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,OAA0B,EAAE,GAAS;;IACvD,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,OAAO,mCAAI,OAAO,CAAC,WAAW,CAAC;IACzD,OAAO,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,EAAM,EACN,OAA0B;;IAE1B,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC9D,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,UAAU,GAAG,MAAA,OAAO,CAAC,UAAU,mCAAI,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,SAAS,mCAAI,CAAC,CAAC;IAEzC,IAAI,UAAU,KAAK,CAAC,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,UAAU,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC;IACjD,IAAI,SAAS,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC;IAE/C,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAAM,EAAE,KAAa;IACjD,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACtD,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,EAAE,CAAC,MAAM,CAAC;IACxC,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,EAAE,CAAC,GAAG,CAAC;IACzC,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC,GAAG,CAAC;IAC/D,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,EAAM,EACN,QAAsC,EACtC,GAAS;IAET,MAAM,OAAO,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,CAAU,CAAC;IAEjE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACpC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC;YAC7B,YAAY,EAAE,QAAQ,CAAC,IAAI;YAC3B,aAAa,EAAE,QAAQ,CAAC,KAAK;YAC7B,UAAU,EAAE,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC;SAC7C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAqC;QAC/C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;KACvE,CAAC;IAEF,MAAM,UAAU,GAAG,OAAO;SACvB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;SACrD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACjC;QACE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7B,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACzB,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;KACtD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IAEF,OAAO,CAAC,UAAU,EAAE,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAChC,EAAM,EACN,GAAW,EACX,MAAoC,EACpC,QAAiB;;IAEjB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,MAAM;aAClB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;aAClD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACT;YACE,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,GAAG,CAAC,EAAE;YAC9B,WAAW,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC,QAAS,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;SACzD,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QAEJ,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,CAAC;IAED,MAAM,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC;IAClC,MAAM,YAAY,GAAG,CAAC,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,QAAQ,mCAAI,EAAE,CAAC,CAAC,MAAM,CAClD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAC9B,CAAC;IAEF,IAAI,MAAM,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzD,OAAO,WAAW,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,aAAa,GACjB,CAAC,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,UAAU,mCAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,mCAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAC7B,CAAC,CAAC,EAAE,EAAE,eAAC,OAAA,CAAC,MAAA,CAAC,CAAC,UAAU,mCAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAA,CAAC,CAAC,SAAS,mCAAI,CAAC,CAAC,GAAG,CAAC,CAAA,EAAA,CACzD,CAAC;IAEF,OAAO,aAAa,IAAI,YAAY;QAClC,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,qCAAqC,CAAC,EAAE;QACtD,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAUD,MAAM,UAAU,oBAAoB,CAClC,WAA8B;;IAE9B,MAAM,MAAM,GAAG,MAAA,uBAAuB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,mCAAI,IAAI,CAAC;IACxE,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,IAAI;QACtB,IAAI,EAAE,WAAW,CAAC,IAAI;QACtB,aAAa,EAAE,WAAW,CAAC,QAAQ,CAAC,MAAM;QAC1C,aAAa,EAAE,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,mCAAI,IAAI;QACtC,WAAW,EAAE,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,KAAK,mCAAI,IAAI;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,MAAc;IAChD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,KAAK;SACT,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;SACjC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,OAAsB,EACtB,OAA6B,EAC7B,QAAuB;;IAEvB,MAAM,IAAI,GAAkB;QAC1B;YACE,UAAU;YACV,OAAO,CAAC,aAAa;gBACnB,CAAC,CAAC,CAAC,MAAA,MAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,KAAK,mCAAI,MAAA,OAAO,CAAC,IAAI,0CAAE,EAAE,mCAAI,SAAS,CAAC;gBACxD,CAAC,CAAC,eAAe;SACpB;QACD,CAAC,MAAM,EAAE,IAAI,CAAC;KACf,CAAC;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC;YACR,SAAS;YACT,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI;SACtD,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ;YACR,OAAO,CAAC,MAAM;gBACZ,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACxD,CAAC,CAAC,iCAAiC;SACtC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,EAAM,EACN,MAAgC;IAEhC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAChC,OAAO,EAAE,CAAC,UAAU,CAAC,0BAA0B,EAAE,iBAAiB,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,KAAK,EAAE,CAAC,GAAG,CAAC,oCAAoC,CAAC,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QACjC,OAAO,KAAK,EAAE,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,CAAC;IACjD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CACnB,EAAM,EACN,GAAW,EACX,IAAY,EACZ,OAAsB,EACtB,OAA6B,EAC7B,WAAuC,EACvC,IAAyC,EACzC,QAAuB,EACvB,GAAS;;IAET,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE3E,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC,CAAC;QAC/D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CACR,EAAE,EACF,EAAE,CAAC,GAAG,CACJ,kDAAkD;YAChD,6CAA6C,CAChD,CACF,CAAC;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,kBAAkB,GACtB,MAAA,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,mCAAI,IAAI,CAAC;IAC3D,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,kBAAkB;QAC/B,CAAC,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,QAAQ,CAAC;QACtD,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,sCAAsC,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAEjE,MAAM,aAAa,GAAG,yBAAyB,CAC7C,EAAE,EACF,GAAG,EACH,MAAM,EACN,IAAI,CAAC,QAAQ,CACd,CAAC;QACF,IAAI,aAAa;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,gCAAgC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAE7E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC;SAAM,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,WAAW,IAAI,MAAM,EAAE,CAAC;YACjC,MAAM,WAAW,GAAG,uBAAuB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YAClE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5C,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,WAAW,IAAI,MAAM,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;YAClD,KAAK,CAAC,IAAI,CACR,KAAK,EAAE,CAAC,GAAG,CACT,GAAG,OAAO,CAAC,IAAI,MAAM,OAAO,CAAC,aAAa,WACxC,OAAO,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GACrC,YAAY,MAAA,OAAO,CAAC,aAAa,mCAAI,GAAG,IACtC,MAAA,OAAO,CAAC,WAAW,mCAAI,GACzB,EAAE,CACH,EAAE,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,EAAE,MAAA,MAAM,CAAC,CAAC,CAAC,mCAAI,IAAI,CAAC,CAAC;IACtD,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAE/B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport type { StoredSession } from '../auth/credential-store';\nimport {\n  refreshStoredSession,\n  resolveAuthEnvironment,\n  resolveIdentity,\n} from '../auth/session';\nimport type { CliContext } from '../context';\nimport {\n  CliError,\n  authRequiredError,\n  gateFailedError,\n  preconditionError,\n} from '../errors';\nimport { ERROR_CODES, type ExitCode } from '../exit-codes';\nimport { formatFindings, relativeTime } from '../findings-renderer';\nimport { EKANOS_CONFIG_FILENAME, loadProject } from '../project';\nimport {\n  type SubmissionListing,\n  type SubmissionVersion,\n  listSubmissions,\n} from '../publish-api';\nimport { fetchSeatsWithOneRefresh } from '../seats';\nimport type { KeyValueRow, Ui } from '../ui';\nimport { announceUpdate, checkForUpdate } from '../update-notice';\nimport { readProjectVersion } from './publish';\n\n/** `--watch`'s poll interval — matches the mission brief exactly. */\nconst WATCH_POLL_INTERVAL_MS = 30_000;\n\n/**\n * The states `--watch` stops on. `submitted` is the only non-terminal state\n * a version can be in when watching starts (an already-`gated`/`dev`/\n * `rejected` version resolves on the very first check, no polling needed).\n */\nconst WATCH_TERMINAL_STATES = new Set(['gated', 'dev', 'rejected']);\n\nexport interface StatusArgs {\n  host?: string;\n  /** Project directory (may contain ekanos.json). Defaults to cwd. */\n  dir: string;\n  env: Record<string, string | undefined>;\n  /** Render each version's full finding list, not just error/warn counts. */\n  findings?: boolean;\n  /**\n   * Expand \"OTHER INTEGRATIONS IN SOURCE …\" from one summary line per\n   * integration into the same VERSION/STATE/AGE/FINDINGS table shape THIS\n   * PROJECT's section uses. Human mode only — the JSON envelope's\n   * `submissions` already carries every integration's full version history\n   * regardless of this flag.\n   */\n  all?: boolean;\n  /**\n   * Block until this project's current (slug, version) submission reaches a\n   * terminal-for-waiting state (gated, dev, rejected), polling every 30s.\n   * Changes the command's exit-code contract — see `runStatus`'s docstring.\n   */\n  watch?: boolean;\n  /** Injectable for tests — see `auth/device-flow.ts`'s identical pattern. */\n  sleep?: (ms: number) => Promise<void>;\n  /** Injectable \"now\" for deterministic AGE rendering in tests. Defaults to `new Date()`. */\n  now?: Date;\n}\n\ninterface SessionReport {\n  authenticated: boolean;\n  user?: { id: string; email: string | null; name: string | null };\n  expiresAt?: string;\n  hint?: string;\n}\n\ninterface ProjectReport {\n  dir: string;\n  slug: string;\n  source: string | null;\n}\n\n/**\n * `status` — the read verb: where am I pointed, who am I, and what has this\n * project submitted?\n *\n * Three sections, each degrading gracefully rather than failing:\n *\n *  - **session** — whoami's server-side identity check, but an absent or dead\n *    session reports `authenticated: false` with a hint instead of exit 4. A\n *    partner asking \"what is my state?\" must get an answer, not an error whose\n *    answer it is.\n *  - **project** — the ekanos.json in `--dir` (default cwd), when there is\n *    one. No project is an ordinary state for `status`, never an error.\n *  - **submissions** — `GET /api/partner/submissions?source=…` for the\n *    project's resolved source, only when both a session and a source exist.\n *    Server errors here DO map through the taxonomy: an unreachable host or a\n *    missing source is a fault to surface, not a state to absorb.\n *\n * Exit 0 whenever the report itself could be assembled — EXCEPT under\n * `--watch` (see below), whose exit code carries the gate's verdict instead.\n *\n * The submission listing always requests the full `?detail=findings` shape\n * server-side (needed so THIS PROJECT's latest-error auto-inline rendering\n * — see `humanSummary` — has findings to inspect without a second\n * round-trip). `--findings` no longer changes what's FETCHED; it changes\n * what's RENDERED inline in human mode: every shown version's findings,\n * not just the latest's error-severity ones.\n *\n * `--watch` turns `status` into a blocking wait: it requires a project with\n * a resolved source and a live session (both are PRECONDITIONs here, not\n * degraded-to-false states — there is nothing to watch without them), then\n * polls `GET /api/partner/submissions?detail=findings` every 30s for THIS\n * project's current (slug, package.json version) submission until it reaches\n * a terminal-for-waiting state: `gated`/`dev` exit 0, `rejected` exits 10\n * (GATE_FAILED) with the findings carried in `data` — the same shape\n * `publish`'s own gate refusal uses, so an agent's fix-then-retry loop\n * branches on it identically whether the gate ran inline (future) or via\n * this poll (today). `--json --watch` still emits exactly ONE envelope, at\n * completion — the polling itself only ever writes to stderr via `ctx.log`.\n *\n * Human-mode rendering is PROJECT-SCOPED: the server lists every\n * submission for the resolved source (an org-level bucket shared by every\n * project publishing there — `listSubmissions` has no server-side slug\n * filter, see `publish-api.ts`'s wire contract), so \"THIS PROJECT\" groups\n * the rows matching this project's own slug and \"OTHER INTEGRATIONS IN\n * SOURCE …\" collapses everything else to one summary line per integration\n * (or, with `--all`, the same table shape).\n * The `--json` envelope stays additive-compatible: `submissions` is still\n * the full, unfiltered list, with `data.project.scopedSubmissions` and\n * `data.otherIntegrations` layered on top for a consumer that wants the\n * pre-grouped view without re-deriving it.\n */\nexport async function runStatus(\n  ctx: CliContext,\n  args: StatusArgs,\n): Promise<ExitCode> {\n  const env = resolveAuthEnvironment(ctx, args.host, args.env, {\n    projectDir: args.dir,\n  });\n\n  const stored = env.store.read(env.host);\n\n  const notice = await checkForUpdate({\n    env: args.env,\n    host: env.host,\n    session: stored ?? undefined,\n  });\n  announceUpdate(ctx, notice);\n\n  const session = stored\n    ? await probeSession(env, stored)\n    : {\n        authenticated: false,\n        hint: `Run \"ekanos login --host ${env.host}\" to sign in.`,\n      };\n\n  // probeSession may have refreshed the session — persisting a NEW access\n  // token and ROTATING the refresh token on disk. Re-read before using it:\n  // the pre-probe object now holds a dead access token and an already-spent\n  // refresh token, and presenting those would turn \"logged in, token was\n  // merely stale\" into a hard exit-4 — the one failure this command promises\n  // never to produce.\n  const live = stored ? (env.store.read(env.host) ?? stored) : null;\n\n  const project = readProjectReport(args.dir);\n\n  if (args.watch) {\n    if (!session.authenticated || !live) {\n      throw authRequiredError(\n        `\"ekanos status --watch\" needs a live session on ${env.host}.`,\n        `Run \"ekanos login --host ${env.host}\" and retry.`,\n      );\n    }\n\n    if (!project) {\n      throw preconditionError(\n        `No ekanos.json found in ${path.resolve(args.dir)}.`,\n        'Run \"ekanos publish\" at least once before watching its gate result.',\n      );\n    }\n\n    if (!project.source) {\n      throw preconditionError(\n        'This project has no \"source\" in ekanos.json yet.',\n        'Run \"ekanos publish\" at least once (it saves the source you ' +\n          'publish to) before watching its gate result.',\n      );\n    }\n\n    return runWatch(ctx, env, project, args);\n  }\n\n  let submissions: SubmissionListing[] | null = null;\n\n  if (project?.source && session.authenticated && live) {\n    // Always the full `?detail=findings` shape, `--findings` or not: THIS\n    // PROJECT's auto-inline latest-error rendering (see `humanSummary`)\n    // needs the findings array to decide whether to render, not just the\n    // counts — and `data.project.scopedSubmissions` carries the same\n    // richer shape in the JSON envelope regardless of the flag. `--findings`\n    // now controls how much of it gets rendered inline, not what's fetched.\n    submissions = await listWithOneRefresh(\n      env,\n      live,\n      project.source,\n      'findings',\n    );\n  } else if (project?.source && !session.authenticated) {\n    ctx.log(\n      `ekanos: not logged in to ${env.host} — skipping the submission list. ` +\n        (session.hint ?? ''),\n    );\n  } else if (project && !project.source) {\n    ctx.log(\n      'ekanos: this project has no \"source\" in ekanos.json yet — the first ' +\n        '\"ekanos publish --source <slug>\" saves one, and status will list ' +\n        'submissions from then on.',\n    );\n  }\n\n  const projectIntegration =\n    project && submissions\n      ? (submissions.find((s) => s.slug === project.slug) ?? null)\n      : null;\n\n  const otherIntegrations = submissions\n    ? submissions\n        .filter((s) => s.slug !== project?.slug)\n        .map((s) => summarizeIntegration(s))\n    : null;\n\n  // Best-effort, human-mode-only add-on for the header's \"publish target\n  // (+ seat role)\" line — same degrade-to-null contract as `whoami`'s own\n  // seat lookup. Skipped entirely in JSON mode: nothing in the envelope\n  // needs it, and it would otherwise be an extra network round-trip every\n  // existing `--json` caller pays for no reason.\n  const seatRole =\n    !ctx.jsonMode && project?.source && session.authenticated && live\n      ? await fetchSeatRoleQuietly(env, live, project.source)\n      : null;\n\n  return ctx.succeed(\n    {\n      host: env.host,\n      ...session,\n      credentialsPath: env.store.filePath,\n      project: project\n        ? {\n            ...project,\n            scopedSubmissions: submissions\n              ? (projectIntegration?.versions ?? [])\n              : null,\n          }\n        : null,\n      submissions,\n      ...(otherIntegrations !== null ? { otherIntegrations } : {}),\n      ...(notice ? { toolchain: notice } : {}),\n    },\n    humanSummary(\n      ctx.ui,\n      project?.dir ?? path.resolve(args.dir),\n      env.host,\n      session,\n      project,\n      submissions,\n      { findings: args.findings ?? false, all: args.all ?? false },\n      seatRole,\n      args.now ?? new Date(),\n    ),\n  );\n}\n\n/**\n * The `--watch` poll loop. Targets THIS project's current submission —\n * `project.slug` + the version presently in `package.json` (the same value\n * `publish` would submit right now) — not \"whatever's most recent,\" so\n * watching after a publish can never resolve against a stale prior version.\n */\nasync function runWatch(\n  ctx: CliContext,\n  env: ReturnType<typeof resolveAuthEnvironment>,\n  project: ProjectReport,\n  args: StatusArgs,\n): Promise<ExitCode> {\n  const source = project.source;\n  if (!source) {\n    // Unreachable — the caller already checked — but keeps this function's\n    // own type honest without a non-null assertion.\n    throw preconditionError(\n      'This project has no \"source\" in ekanos.json yet.',\n      'Run \"ekanos publish\" at least once before watching its gate result.',\n    );\n  }\n\n  const targetVersion = readProjectVersion(project.dir);\n  const sleep = args.sleep ?? defaultSleep;\n\n  // Glyph-only restyle — the poll contract itself (exit codes, timing,\n  // JSON envelope) is unchanged.\n  const waitGlyph = ctx.jsonMode ? '' : `${ctx.ui.dim(ctx.ui.glyphs.info)} `;\n\n  ctx.log(\n    `${waitGlyph}ekanos: watching ${project.slug}@${targetVersion} on ${env.host} ` +\n      `(polling every ${WATCH_POLL_INTERVAL_MS / 1000}s)…`,\n  );\n\n  for (;;) {\n    // Re-read the session from the credential store on EVERY iteration —\n    // never carry one over in a closure. Auth0 rotates the refresh token on\n    // every use (see `refreshStoredSession`'s docstring), so a token this\n    // loop already consumed is dead by the next iteration; the store is the\n    // persisted source of truth for whichever refresh most recently landed\n    // — this loop's own (via `listWithOneRefresh` below, which persists\n    // through `refreshStoredSession`), or a concurrent one from another\n    // process (another terminal running login/publish/status --watch\n    // against the same host). Threading the refreshed session back out of\n    // `listWithOneRefresh` instead would only cover the first case.\n    const current = env.store.read(env.host);\n\n    if (!current) {\n      throw authRequiredError(\n        `The session for ${env.host} is gone — \"ekanos status --watch\" ` +\n          'cannot continue without it.',\n        `Run \"ekanos login --host ${env.host}\" and retry.`,\n      );\n    }\n\n    const integrations = await listWithOneRefresh(\n      env,\n      current,\n      source,\n      'findings',\n    );\n    const version = findVersion(integrations, project.slug, targetVersion);\n\n    if (version && WATCH_TERMINAL_STATES.has(version.state)) {\n      return reportWatchOutcome(ctx, project.slug, version);\n    }\n\n    ctx.log(\n      `${waitGlyph}ekanos: ${project.slug}@${targetVersion} is ` +\n        `${version ? version.state : 'not visible yet'} — waiting…`,\n    );\n\n    await sleep(WATCH_POLL_INTERVAL_MS);\n  }\n}\n\nfunction findVersion(\n  integrations: SubmissionListing[],\n  slug: string,\n  version: string,\n): SubmissionVersion | null {\n  const integration = integrations.find((i) => i.slug === slug);\n  return integration?.versions.find((v) => v.version === version) ?? null;\n}\n\nfunction reportWatchOutcome(\n  ctx: CliContext,\n  slug: string,\n  version: SubmissionVersion,\n): ExitCode {\n  const data = {\n    slug,\n    version: version.version,\n    state: version.state,\n    gatedAt: version.gatedAt,\n    errorCount: version.errorCount,\n    warnCount: version.warnCount,\n    findings: version.findings ?? [],\n    stages: version.stages ?? [],\n  };\n\n  if (version.state === 'rejected') {\n    return ctx.fail(\n      gateFailedError(\n        `${slug}@${version.version} was rejected by the gate ` +\n          `(${data.errorCount ?? 0} error${data.errorCount === 1 ? '' : 's'}).`,\n        'Resolve the error-severity findings in data.findings, bump the ' +\n          'version, and re-run \"ekanos publish\".',\n      ),\n      data,\n    );\n  }\n\n  return ctx.succeed(\n    data,\n    `status --watch: ${slug}@${version.version} is now \"${version.state}\"` +\n      `${data.warnCount ? ` (${data.warnCount} warning${data.warnCount === 1 ? '' : 's'})` : ''}.`,\n  );\n}\n\nfunction defaultSleep(ms: number): Promise<void> {\n  return new Promise((resolve) => {\n    setTimeout(resolve, ms);\n  });\n}\n\n/**\n * whoami's identity resolution, with AUTH_REQUIRED absorbed into\n * `authenticated: false`. Anything else — network, precondition, MFA mapped\n * to auth by `fetchIdentity` — still propagates: \"the host was unreachable\"\n * must never be reported as \"you are logged out\".\n */\nasync function probeSession(\n  env: ReturnType<typeof resolveAuthEnvironment>,\n  stored: StoredSession,\n): Promise<SessionReport> {\n  try {\n    const { identity, session } = await resolveIdentity(env, stored);\n\n    return {\n      authenticated: true,\n      user: { id: identity.id, email: identity.email, name: identity.name },\n      expiresAt: session.expiresAt,\n    };\n  } catch (error) {\n    if (error instanceof CliError && error.code === ERROR_CODES.AUTH_REQUIRED) {\n      return { authenticated: false, hint: error.hint };\n    }\n\n    throw error;\n  }\n}\n\n/**\n * Lenient project read: no ekanos.json means \"not in a project\", which is an\n * answer, not an error. An ekanos.json that EXISTS but does not load keeps\n * `loadProject`'s strict behaviour — a broken project file is a fault the\n * partner needs named, whatever verb they ran.\n */\nfunction readProjectReport(dir: string): ProjectReport | null {\n  const projectDir = path.resolve(dir);\n\n  if (!fs.existsSync(path.join(projectDir, EKANOS_CONFIG_FILENAME))) {\n    return null;\n  }\n\n  const loaded = loadProject(projectDir);\n\n  return {\n    dir: loaded.projectDir,\n    slug: loaded.primary.slug,\n    source: loaded.project.source ?? null,\n  };\n}\n\n/** Mirrors publish's one-refresh-one-retry on a stale access token. */\nasync function listWithOneRefresh(\n  env: ReturnType<typeof resolveAuthEnvironment>,\n  session: StoredSession,\n  source: string,\n  detail?: 'findings',\n): Promise<SubmissionListing[]> {\n  const first = await listSubmissions(env.host, session.accessToken, source, {\n    detail,\n  });\n\n  if (first.status === 'ok') return first.integrations;\n\n  const refreshed = await refreshStoredSession(env, session);\n  const second = await listSubmissions(\n    env.host,\n    refreshed.accessToken,\n    source,\n    {\n      detail,\n    },\n  );\n\n  if (second.status === 'ok') return second.integrations;\n\n  // Authenticated a moment ago, unauthorized twice here: report the list as\n  // unavailable rather than the session as dead — probeSession already proved\n  // it. This is unreachable in practice; belt and braces for a racing revoke.\n  throw authRequiredError(\n    `The session for ${env.host} could not authorize the submission list.`,\n    `Run \"ekanos login --host ${env.host}\" and retry.`,\n  );\n}\n\n/**\n * `whoami`'s seat-lookup degradation, narrowed to one source's role: a\n * network hiccup, MFA, or a deployment predating the seats route must never\n * turn a working `status` into a failing one — the header simply omits the\n * \"(role)\" suffix.\n */\nasync function fetchSeatRoleQuietly(\n  env: ReturnType<typeof resolveAuthEnvironment>,\n  session: StoredSession,\n  source: string,\n): Promise<string | null> {\n  try {\n    const result = await fetchSeatsWithOneRefresh(env, session);\n    if (result.status !== 'ok') return null;\n\n    const seat = result.sources.find((s) => s.slug === source);\n    return seat ? seat.roles.join(', ') : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction tryReadProjectVersion(dir: string): string | null {\n  try {\n    return readProjectVersion(dir);\n  } catch {\n    return null;\n  }\n}\n\nfunction timestampMs(iso: string | null | undefined): number {\n  if (!iso) return 0;\n  const parsed = new Date(iso).getTime();\n  return Number.isNaN(parsed) ? 0 : parsed;\n}\n\n/**\n * Newest-first by `gatedAt ?? submittedAt`. Ties (including two versions\n * with no timestamp at all) keep their original, server-given order —\n * `Array#sort` is stable, and a stable no-op is the right answer when there\n * is nothing to compare.\n */\nexport function sortVersionsNewestFirst(\n  versions: readonly SubmissionVersion[],\n): SubmissionVersion[] {\n  return [...versions].sort(\n    (a, b) =>\n      timestampMs(b.gatedAt ?? b.submittedAt) -\n      timestampMs(a.gatedAt ?? a.submittedAt),\n  );\n}\n\nfunction versionAge(version: SubmissionVersion, now: Date): string {\n  const timestamp = version.gatedAt ?? version.submittedAt;\n  return timestamp ? relativeTime(timestamp, now) : '—';\n}\n\nexport function findingsCellParts(\n  ui: Ui,\n  version: SubmissionVersion,\n): { text: string; paint: (text: string) => string } {\n  if (version.errorCount === null && version.warnCount === null) {\n    return { text: '—', paint: ui.dim };\n  }\n\n  const errorCount = version.errorCount ?? 0;\n  const warnCount = version.warnCount ?? 0;\n\n  if (errorCount === 0 && warnCount === 0) {\n    return { text: '0', paint: (text) => text };\n  }\n\n  const parts: string[] = [];\n  if (errorCount > 0) parts.push(`${errorCount}E`);\n  if (warnCount > 0) parts.push(`${warnCount}W`);\n\n  return { text: parts.join(' '), paint: errorCount > 0 ? ui.err : ui.warn };\n}\n\nexport function stateColorFor(ui: Ui, state: string): (text: string) => string {\n  if (state === 'dev' || state === 'prod') return ui.ok;\n  if (state === 'gated') return ui.accent;\n  if (state === 'submitted') return ui.dim;\n  if (state === 'rejected' || state === 'revoked') return ui.err;\n  return (text) => text;\n}\n\n/**\n * A VERSION/STATE/AGE/FINDINGS table, built by hand rather than via\n * `ui.table`: STATE and FINDINGS need per-cell color, and `ui.table` sizes\n * columns from the raw cell strings it's handed — a colored cell's ANSI\n * escapes would inflate that width and misalign the column. `ui.ts`'s own\n * doc comment on `padCell` names this exact tradeoff (\"ignoring color codes\n * in length math is the CALLER's job — pad before coloring, never after\"),\n * so this pads against the PLAIN text first and colors the already-padded\n * string — the same rule `ui.table` documents, just applied here instead of\n * inside it.\n */\nexport function renderVersionsTable(\n  ui: Ui,\n  versions: readonly SubmissionVersion[],\n  now: Date,\n): string {\n  const headers = ['VERSION', 'STATE', 'AGE', 'FINDINGS'] as const;\n\n  const rows = versions.map((version) => {\n    const findings = findingsCellParts(ui, version);\n    return {\n      version: version.version,\n      state: version.state,\n      age: versionAge(version, now),\n      findingsText: findings.text,\n      findingsPaint: findings.paint,\n      statePaint: stateColorFor(ui, version.state),\n    };\n  });\n\n  const widths: [number, number, number, number] = [\n    Math.max(headers[0].length, ...rows.map((r) => r.version.length)),\n    Math.max(headers[1].length, ...rows.map((r) => r.state.length)),\n    Math.max(headers[2].length, ...rows.map((r) => r.age.length)),\n    Math.max(headers[3].length, ...rows.map((r) => r.findingsText.length)),\n  ];\n\n  const headerLine = headers\n    .map((header, i) => ui.dim(header.padEnd(widths[i]!)))\n    .join('  ');\n\n  const bodyLines = rows.map((row) =>\n    [\n      row.version.padEnd(widths[0]),\n      row.statePaint(row.state.padEnd(widths[1])),\n      row.age.padEnd(widths[2]),\n      row.findingsPaint(row.findingsText.padEnd(widths[3])),\n    ].join('  '),\n  );\n\n  return [headerLine, ...bodyLines].join('\\n');\n}\n\n/**\n * The findings shown directly under THIS PROJECT's table. `--findings`\n * forces every version's own findings inline; otherwise only the LATEST\n * version's ERROR-severity findings auto-render (the moment a partner most\n * needs them, no flag required), and a dim pointer at `ekanos status\n * --findings` covers everything else with a nonzero count.\n */\nfunction renderThisProjectFindings(\n  ui: Ui,\n  cwd: string,\n  sorted: readonly SubmissionVersion[],\n  forceAll: boolean,\n): string | null {\n  if (forceAll) {\n    const blocks = sorted\n      .filter((v) => v.findings && v.findings.length > 0)\n      .map((v) =>\n        [\n          `  ${ui.dim(`${v.version}:`)}`,\n          indentLines(formatFindings(ui, v.findings!, { cwd }), 4),\n        ].join('\\n'),\n      );\n\n    return blocks.length > 0 ? blocks.join('\\n\\n') : null;\n  }\n\n  const [latest, ...older] = sorted;\n  const latestErrors = (latest?.findings ?? []).filter(\n    (f) => f.severity === 'error',\n  );\n\n  if (latest && latestErrors.length > 0 && latest.findings) {\n    return indentLines(formatFindings(ui, latest.findings, { cwd }), 2);\n  }\n\n  const latestNonzero =\n    (latest?.errorCount ?? 0) > 0 || (latest?.warnCount ?? 0) > 0;\n  const olderNonzero = older.some(\n    (v) => (v.errorCount ?? 0) > 0 || (v.warnCount ?? 0) > 0,\n  );\n\n  return latestNonzero || olderNonzero\n    ? `  ${ui.dim('→ details: ekanos status --findings')}`\n    : null;\n}\n\nexport interface OtherIntegrationSummary {\n  slug: string;\n  name: string | null;\n  versionsCount: number;\n  latestVersion: string | null;\n  latestState: string | null;\n}\n\nexport function summarizeIntegration(\n  integration: SubmissionListing,\n): OtherIntegrationSummary {\n  const latest = sortVersionsNewestFirst(integration.versions)[0] ?? null;\n  return {\n    slug: integration.slug,\n    name: integration.name,\n    versionsCount: integration.versions.length,\n    latestVersion: latest?.version ?? null,\n    latestState: latest?.state ?? null,\n  };\n}\n\nfunction indentLines(block: string, spaces: number): string {\n  const prefix = ' '.repeat(spaces);\n  return block\n    .split('\\n')\n    .map((line) => `${prefix}${line}`)\n    .join('\\n');\n}\n\nfunction buildHeaderRows(\n  host: string,\n  session: SessionReport,\n  project: ProjectReport | null,\n  seatRole: string | null,\n): readonly KeyValueRow[] {\n  const rows: KeyValueRow[] = [\n    [\n      'identity',\n      session.authenticated\n        ? (session.user?.email ?? session.user?.id ?? 'unknown')\n        : 'not logged in',\n    ],\n    ['host', host],\n  ];\n\n  if (project) {\n    const version = tryReadProjectVersion(project.dir);\n    rows.push([\n      'project',\n      version ? `${project.slug}@${version}` : project.slug,\n    ]);\n    rows.push([\n      'target',\n      project.source\n        ? `${project.source}${seatRole ? ` (${seatRole})` : ''}`\n        : 'none (no source configured yet)',\n    ]);\n  }\n\n  return rows;\n}\n\n/**\n * The closing `ui.nextAction` line, chosen from the LATEST version of THIS\n * project — `null` (no closing line at all) whenever nothing is pending:\n * no submission yet, or the latest is already `dev`/`prod`/`revoked`.\n */\nexport function buildNextAction(\n  ui: Ui,\n  latest: SubmissionVersion | null,\n): string | null {\n  if (!latest) return null;\n\n  if (latest.state === 'rejected') {\n    return ui.nextAction('ekanos status --findings', 'see what failed');\n  }\n  if (latest.state === 'gated') {\n    return `\\n${ui.dim('→ awaiting admission (runs hourly)')}`;\n  }\n  if (latest.state === 'submitted') {\n    return `\\n${ui.dim('→ awaiting gate result')}`;\n  }\n\n  return null;\n}\n\nfunction humanSummary(\n  ui: Ui,\n  cwd: string,\n  host: string,\n  session: SessionReport,\n  project: ProjectReport | null,\n  submissions: SubmissionListing[] | null,\n  args: { findings: boolean; all: boolean },\n  seatRole: string | null,\n  now: Date,\n): string {\n  const lines: string[] = [];\n\n  lines.push(ui.keyValue(buildHeaderRows(host, session, project, seatRole)));\n\n  if (!session.authenticated) {\n    if (session.hint) lines.push('', ui.dim(session.hint));\n    return lines.join('\\n');\n  }\n\n  if (!project) {\n    lines.push('', ui.dim('project: none (no ekanos.json here).'));\n    return lines.join('\\n');\n  }\n\n  if (!project.source) {\n    lines.push(\n      '',\n      ui.dim(\n        'project: no \"source\" configured yet — the first ' +\n          '\"ekanos publish --source <slug>\" saves one.',\n      ),\n    );\n    return lines.join('\\n');\n  }\n\n  if (!submissions) {\n    return lines.join('\\n');\n  }\n\n  const projectIntegration =\n    submissions.find((s) => s.slug === project.slug) ?? null;\n  const others = submissions.filter((s) => s.slug !== project.slug);\n\n  lines.push('', ui.section('this project'));\n\n  const sorted = projectIntegration\n    ? sortVersionsNewestFirst(projectIntegration.versions)\n    : [];\n\n  if (sorted.length === 0) {\n    lines.push(`  ${ui.dim('no submissions yet for this project.')}`);\n  } else {\n    lines.push(indentLines(renderVersionsTable(ui, sorted, now), 2));\n\n    const findingsBlock = renderThisProjectFindings(\n      ui,\n      cwd,\n      sorted,\n      args.findings,\n    );\n    if (findingsBlock) lines.push('', findingsBlock);\n  }\n\n  lines.push('', ui.section(`other integrations in source ${project.source}`));\n\n  if (others.length === 0) {\n    lines.push(`  ${ui.dim('none.')}`);\n  } else if (args.all) {\n    for (const integration of others) {\n      const otherSorted = sortVersionsNewestFirst(integration.versions);\n      lines.push(`  ${ui.dim(integration.slug)}`);\n      lines.push(indentLines(renderVersionsTable(ui, otherSorted, now), 4));\n    }\n  } else {\n    for (const integration of others) {\n      const summary = summarizeIntegration(integration);\n      lines.push(\n        `  ${ui.dim(\n          `${summary.slug} — ${summary.versionsCount} version${\n            summary.versionsCount === 1 ? '' : 's'\n          }, latest ${summary.latestVersion ?? '?'} ${\n            summary.latestState ?? '?'\n          }`,\n        )}`,\n      );\n    }\n  }\n\n  const action = buildNextAction(ui, sorted[0] ?? null);\n  if (action) lines.push(action);\n\n  return lines.join('\\n');\n}\n"]}