@enterpriseai/cli 3.19.1 → 3.19.3

package/dist/lib/support-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"support-context.js","sourceRoot":"","sources":["../../src/lib/support-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,SAAS,EACT,SAAS,EACT,YAAY,EACZ,UAAU,EACV,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAWlF,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAChC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAChC,2FAA2F;AAC3F,MAAM,CAAC,MAAM,kBAAkB,GAAG,wDAAwD,CAAC;AAE3F,IAAI,WAAW,GAAG,KAAK,CAAC;AACxB,IAAI,WAAW,GAAqE,EAAE,CAAC;AACvF,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAE9B,SAAS,0BAA0B;IACjC,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;SAC/B,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;SACtE,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAe,CAAC,CAAC;AACzC,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,WAAW,GAAG,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;QAC/E,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,qBAAqB,CAAC,OAAO,GAAG,gBAAgB,EAAE;IAChE,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,WAAW,OAAO,CAAC,CAAC;AAC9E,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,kBAAkB,CAAC,KAA0B;IAC3D,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QAC/C,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC,IAAI,EAAE;QACvE,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,QAAQ,GAAG,YAAY,CAAC;QAC5B,GAAG,KAAK;QACR,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,WAAW;QACzC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO,EAAE,KAAK,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,OAAO,EAAE,KAAK,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9E,OAAO;KACR,CAAC,IAAI,iBAAiB,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/D,OAAO,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC1E,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC;mBAChF,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,WAAW,GAAG;QACZ,GAAG,WAAW;QACd,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAC,KAAgC;QAClC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,wIAAwI;AACxI,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,KAAK,KAAK,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC;QAAE,OAAO;IAE9F,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;IACtG,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC;IAC3C,MAAM,UAAU,GAAG,QAAQ,EAAE,UAAU,IAAI,KAAK,EAAE,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC;IACnF,kBAAkB,CAAC;QACjB,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO,WAAW,KAAK,aAAa,IAAI,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC;WACzE,WAAW,KAAK,YAAY,IAAI,WAAW,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;IACrC,MAAM,aAAa,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;IACpD,MAAM,OAAO,GAAwB;QACnC,OAAO,EAAE,WAAW;QACpB,QAAQ;QACR,GAAG,WAAW;QACd,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC;IAEF,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,aAAa,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B;IACzC,IAAI,iBAAiB;QAAE,OAAO;IAC9B,iBAAiB,GAAG,IAAI,CAAC;IACzB,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;IAC3C,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,wBAAwB,GAAG,KAAK,CAAC;IAErC,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,IAAe,EAAW,EAAE;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,UAAU;YAC1E,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpD,IAAI,IAAI,IAAI,CAAC,uBAAuB,EAAE,EAAE,CAAC;YACvC,+FAA+F;YAC/F,UAAU,GAAG,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAC9D,kBAAkB,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC5C,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;oBAChD,sBAAsB,CAAC,OAAO,CAAC,CAAC;oBAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;oBACjC,wBAAwB,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;2BAC5C,CAAC,OAAO,MAAM,EAAE,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBAClG,CAAC;gBAAC,MAAM,CAAC;oBACP,4DAA4D;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAY,CAAC;IACvE,CAAC,CAAgC,CAAC;IAElC,OAAO,CAAC,EAAE,CAAC,0BAA0B,EAAE,CAAC,KAAK,EAAE,EAAE;QAC/C,kBAAkB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE;QAC9B,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO;QAC3B,IAAI,CAAC,uBAAuB,EAAE,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,sDAAsD,CAAC,CAAC,CAAC;YACzG,CAAC;QACH,CAAC;QACD,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,kBAAkB,IAAI,CAAC,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,IAAI,GAAG,iBAAiB,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;eAC9C,CAAC,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;eACnD,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG;eAC5B,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;eAC3E,OAAO,CAAC,QAAQ,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,GAAG,GAAG;eAC/C,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAChG,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,CAAC;YAC5B,GAAG,CAAC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtF,CAAC,CAAC;QACH,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,UAAU,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;YACtD,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,oDAAoD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC"}

package/dist/lib/support-redaction.d.ts

@@ -0,0 +1,10 @@
+/** A key-name heuristic; opaque credentials under unrelated keys still need explicit sensitive values. */
+export declare function isSupportSensitiveKey(key: string): boolean;
+/**
+ * Removes known credential values, credential-shaped text and unsafe terminal controls before review.
+ * Supply values from every credential source: pattern matching alone cannot identify opaque secrets.
+ */
+export declare function redactSupportText(text: string, sensitiveValues?: readonly string[]): string;
+/** Redacts a JSON-compatible tree without mutating it; sensitive-key values become placeholders and strings use text redaction. */
+export declare function redactSupportBundle<T>(value: T, sensitiveValues?: readonly string[]): T;
+//# sourceMappingURL=support-redaction.d.ts.map

package/dist/lib/support-redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"support-redaction.d.ts","sourceRoot":"","sources":["../../src/lib/support-redaction.ts"],"names":[],"mappings":"AAEA,0GAA0G;AAC1G,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,CAmB/F;AAED,mIAAmI;AACnI,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,eAAe,GAAE,SAAS,MAAM,EAAO,GAAG,CAAC,CAS3F"}

package/dist/lib/support-redaction.js

@@ -0,0 +1,44 @@
+const sensitiveKey = /token|secret|password|passwd|pwd|api[_-]?key|account[_-]?key|authorization|cookie|credential|connection[_-]?string|private[_-]?key/i;
+/** A key-name heuristic; opaque credentials under unrelated keys still need explicit sensitive values. */
+export function isSupportSensitiveKey(key) {
+    return sensitiveKey.test(key);
+}
+/**
+ * Removes known credential values, credential-shaped text and unsafe terminal controls before review.
+ * Supply values from every credential source: pattern matching alone cannot identify opaque secrets.
+ */
+export function redactSupportText(text, sensitiveValues = []) {
+    let safe = text;
+    for (const value of sensitiveValues) {
+        if (value)
+            safe = safe.split(value).join('[redacted]');
+    }
+    return safe
+        .replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, '[redacted-private-key]')
+        .replace(/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi, '$1 [redacted]')
+        .replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, '[redacted-jwt]')
+        .replace(/\b(?:gh[pousr]_[A-Za-z0-9_]+|github_pat_[A-Za-z0-9_]+|sk-[A-Za-z0-9_-]{16,})\b/g, '[redacted-key]')
+        .replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/gi, '$1[redacted]@')
+        .replace(/((?:["']?[\w.-]*(?:token|secret|password|passwd|pwd|api[_-]?key|account[_-]?key|cookie|credential|authorization|connection[_-]?string|private[_-]?key)[\w.-]*["']?\s*[:=]\s*))(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s,;}]+)/gi, '$1[redacted]')
+        .replace(/((?:--[\w-]*(?:token|secret|password|passwd|pwd|api[_-]?key|account[_-]?key|authorization|cookie|credential|connection[_-]?string|private[_-]?key)[\w-]*)\s+)(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s]+)/gi, '$1[redacted]')
+        .replace(/([?&](?:sig|signature|access_token|token|key|code)=)[^&#\s]*/gi, '$1[redacted]')
+        .replace(/#draft=[^\s"']+/gi, '#draft=[redacted]')
+        // eslint-disable-next-line no-control-regex -- Upstream terminal escapes must not execute during report review.
+        .replace(/\u001b\[[0-?]*[ -/]*[@-~]/g, '')
+        // eslint-disable-next-line no-control-regex -- Strip upstream terminal controls while retaining readable lines and tabs.
+        .replace(/[\u0000-\u0008\u000b-\u001f\u007f]/g, '');
+}
+/** Redacts a JSON-compatible tree without mutating it; sensitive-key values become placeholders and strings use text redaction. */
+export function redactSupportBundle(value, sensitiveValues = []) {
+    if (typeof value === 'string')
+        return redactSupportText(value, sensitiveValues);
+    if (Array.isArray(value))
+        return value.map(item => redactSupportBundle(item, sensitiveValues));
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+            key, isSupportSensitiveKey(key) ? '[redacted]' : redactSupportBundle(item, sensitiveValues),
+        ]));
+    }
+    return value;
+}
+//# sourceMappingURL=support-redaction.js.map

package/dist/lib/support-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"support-redaction.js","sourceRoot":"","sources":["../../src/lib/support-redaction.ts"],"names":[],"mappings":"AAAA,MAAM,YAAY,GAAG,qIAAqI,CAAC;AAE3J,0GAA0G;AAC1G,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,kBAAqC,EAAE;IACrF,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,KAAK;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAAI;SACR,OAAO,CAAC,6EAA6E,EAAE,wBAAwB,CAAC;SAChH,OAAO,CAAC,0CAA0C,EAAE,eAAe,CAAC;SACpE,OAAO,CAAC,wDAAwD,EAAE,gBAAgB,CAAC;SACnF,OAAO,CAAC,iFAAiF,EAAE,gBAAgB,CAAC;SAC5G,OAAO,CAAC,uCAAuC,EAAE,eAAe,CAAC;SACjE,OAAO,CAAC,mOAAmO,EAAE,cAAc,CAAC;SAC5P,OAAO,CAAC,+MAA+M,EAAE,cAAc,CAAC;SACxO,OAAO,CAAC,gEAAgE,EAAE,cAAc,CAAC;SACzF,OAAO,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;QAClD,gHAAgH;SAC/G,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC;QAC1C,yHAAyH;SACxH,OAAO,CAAC,qCAAqC,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,mIAAmI;AACnI,MAAM,UAAU,mBAAmB,CAAI,KAAQ,EAAE,kBAAqC,EAAE;IACtF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,iBAAiB,CAAC,KAAK,EAAE,eAAe,CAAM,CAAC;IACrF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAM,CAAC;IACpG,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YACnE,GAAG,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,EAAE,eAAe,CAAC;SAC5F,CAAC,CAAM,CAAC;IACX,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/lib/support-report.d.ts

@@ -0,0 +1,68 @@
+import type { StoredTokens } from './auth.js';
+/** Deadline for one draft POST, including its bounded response body. */
+export declare const SUPPORT_TIMEOUT_MS = 10000;
+/** Report inputs; `yes` asserts the person approved this exact bundle before submission. */
+export interface SupportOptions {
+    readonly format?: string;
+    readonly source?: string;
+    readonly tool?: string;
+    readonly toolVersion?: string;
+    readonly command?: string;
+    readonly exitCode?: string;
+    readonly errorCode?: string;
+    readonly description?: string;
+    readonly yes?: boolean;
+    readonly open?: boolean;
+}
+/** Redacted website draft payload; tenant and app labels are diagnostic context, not authorization. */
+export interface SupportBundle {
+    readonly source: 'eai-cli' | 'harness';
+    readonly tool: {
+        readonly name: string;
+        readonly version: string;
+    };
+    readonly cli: {
+        readonly command?: string;
+        readonly exitCode?: number;
+        readonly errorCode?: string;
+        readonly reasonCode?: string;
+    };
+    readonly cliVersion: string;
+    readonly service: 'eai-cli';
+    readonly category: 'technical';
+    readonly summary: string;
+    readonly description: string;
+    readonly os: 'macos' | 'windows' | 'linux' | 'unknown';
+    readonly environment: 'dev' | 'test' | 'prod' | 'local' | 'unknown';
+    readonly tenantId?: string;
+    readonly tenantName?: string;
+    readonly appId?: string;
+    readonly appName?: string;
+    readonly error?: string;
+    readonly occurredAt?: string;
+}
+/** Safe draft failure code and message, excluding server response content and credentials. */
+export declare class SupportRequestError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/** Resolve a trusted origin from user profile/runtime settings; project files cannot redirect the saved bearer. */
+export declare function resolveSupportWebsite(): Promise<string>;
+/** Collect a bounded, redacted report from the saved session, current project and canonical error metadata. */
+export declare function collectSupportBundle(options: SupportOptions, session: StoredTokens | null): Promise<SupportBundle>;
+/** Validated one-time capability link and expiry returned by the website. */
+export interface SupportDraft {
+    readonly url: string;
+    readonly expiresAt: string;
+}
+/**
+ * Create one non-idempotent draft after consent; ambiguous failures never trigger a retry.
+ * @param website Trusted origin from resolveSupportWebsite.
+ * @param bundle Locally redacted payload returned by collectSupportBundle.
+ * @param bearer Access token from the saved eai login session.
+ * @param timeoutMs Deadline for the request and bounded response read.
+ * @returns A validated fragment link, or null when the website rejects the session with 401.
+ * @throws SupportRequestError for safe HTTP, response-validation or ambiguous request failures.
+ */
+export declare function createSupportDraft(website: string, bundle: SupportBundle, bearer: string, timeoutMs?: number): Promise<SupportDraft | null>;
+//# sourceMappingURL=support-report.d.ts.map

package/dist/lib/support-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"support-report.d.ts","sourceRoot":"","sources":["../../src/lib/support-report.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAQ9C,wEAAwE;AACxE,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAGzC,4FAA4F;AAC5F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,uGAAuG;AACvG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,QAAQ,CAAC,GAAG,EAAE;QAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnI,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,WAAW,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,8FAA8F;AAC9F,qBAAa,mBAAoB,SAAQ,KAAK;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CACnD;AAED,mHAAmH;AACnH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC,CAc7D;AAQD,+GAA+G;AAC/G,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,CAwCxH;AAED,6EAA6E;AAC7E,MAAM,WAAW,YAAY;IAAG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAElF;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,SAAqB,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAmD7J"}

package/dist/lib/support-report.js

@@ -0,0 +1,165 @@
+import { createRequire } from 'node:module';
+import { platform, release } from 'node:os';
+import { findProjectRoot, loadEnvFile } from './config.js';
+import { getActiveProfile, loadProfileConfig } from './profile.js';
+import { findGuidanceByCodeOrReason } from './error-guidance/catalog.js';
+import { readSupportContext } from './support-context.js';
+import { isSupportSensitiveKey, redactSupportBundle, redactSupportText } from './support-redaction.js';
+const require = createRequire(import.meta.url);
+const { version: cliVersion } = require('../../package.json');
+/** Deadline for one draft POST, including its bounded response body. */
+export const SUPPORT_TIMEOUT_MS = 10_000;
+const MAX_RESPONSE_BYTES = 8_192;
+/** Safe draft failure code and message, excluding server response content and credentials. */
+export class SupportRequestError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+/** Resolve a trusted origin from user profile/runtime settings; project files cannot redirect the saved bearer. */
+export async function resolveSupportWebsite() {
+    const profile = getActiveProfile();
+    const config = await loadProfileConfig(profile);
+    const value = process.env.EAI_WEBSITE_URL || config?.websiteUrl
+        || (profile === 'default' ? 'https://www.enterpriseaigroup.com' : undefined);
+    if (!value)
+        throw new Error('Configure websiteUrl for the active CLI profile before preparing a support report.');
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error('The configured support website must be a valid origin.');
+    }
+    const loopback = ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+    if ((url.protocol !== 'https:' && !(url.protocol === 'http:' && loopback))
+        || url.username || url.password || url.search || url.hash || url.pathname !== '/') {
+        throw new Error('The support website must be an HTTPS origin (HTTP is allowed for a local fixture).');
+    }
+    return url.origin;
+}
+function boundedOption(value, limit, label) {
+    if (value !== undefined && (!value.trim() || value.length > limit)) {
+        throw new Error(`${label} must be nonempty and at most ${limit} characters.`);
+    }
+}
+/** Collect a bounded, redacted report from the saved session, current project and canonical error metadata. */
+export async function collectSupportBundle(options, session) {
+    if (options.format && !['text', 'json'].includes(options.format))
+        throw new Error('Use --format text or --format json.');
+    const source = options.source ?? (options.tool ? 'harness' : 'eai-cli');
+    if (source !== 'harness' && source !== 'eai-cli')
+        throw new Error('Use --source eai-cli or --source harness.');
+    boundedOption(options.tool, 80, 'Tool name');
+    boundedOption(options.toolVersion, 100, 'Tool version');
+    boundedOption(options.command, 500, 'Command');
+    boundedOption(options.description, 6000, 'Description');
+    const exitCode = options.exitCode === undefined ? undefined : Number(options.exitCode);
+    if (exitCode !== undefined && (!/^-?\d+$/.test(options.exitCode) || !Number.isInteger(exitCode)
+        || exitCode < -2147483648 || exitCode > 2147483647))
+        throw new Error('Exit code must be a signed 32-bit integer.');
+    const context = readSupportContext();
+    const guidance = findGuidanceByCodeOrReason(options.errorCode ?? context?.errorCode ?? context?.reasonCode ?? '');
+    if (options.errorCode && !guidance)
+        throw new Error('Unknown error code or reason. Run eai errors list --format json.');
+    const projectRoot = await findProjectRoot();
+    const env = projectRoot ? await loadEnvFile(projectRoot) : {};
+    const sensitiveValues = [...new Set([session?.accessToken, session?.refreshToken,
+            ...[...Object.entries(env), ...Object.entries(process.env)]
+                .filter(([key]) => isSupportSensitiveKey(key)).map(([, value]) => value)]
+            .filter((value) => typeof value === 'string' && value.length > 0))];
+    const safe = (value, limit) => value ? redactSupportText(value, sensitiveValues).slice(0, limit) : undefined;
+    const os = platform() === 'darwin' ? 'macos' : platform() === 'win32' ? 'windows' : platform() === 'linux' ? 'linux' : 'unknown';
+    const profile = getActiveProfile();
+    const environment = ['dev', 'test', 'prod', 'local'].includes(profile) ? profile : profile === 'default' ? 'prod' : 'unknown';
+    const command = safe(options.command ?? context?.command, 500);
+    const description = safe(options.description ?? [
+        'Help requested for an EAI CLI command.', `CLI version: ${cliVersion}`, `OS: ${os} ${release()}`,
+        command ? `Command: ${command}` : '', guidance ? `Error: ${guidance.code} (${guidance.reasonCode})` : '',
+    ].filter(Boolean).join('\n'), 6000).trim();
+    if (description.length < 10)
+        throw new Error('Description must contain at least 10 characters after redaction.');
+    return redactSupportBundle({
+        source, tool: { name: safe(options.tool ?? 'eai-cli', 80), version: safe(options.toolVersion ?? (options.tool ? undefined : cliVersion), 100) ?? '' },
+        cli: { command, exitCode: exitCode ?? context?.exitCode, errorCode: guidance?.code, reasonCode: guidance?.reasonCode },
+        cliVersion, service: 'eai-cli', category: 'technical', summary: safe(guidance?.title ?? 'Help with EAI CLI', 180),
+        description, os, environment,
+        tenantId: safe(env.EAI_TENANT_ID ?? env.NEXT_PUBLIC_EAI_TENANT_ID ?? env.TENANT_DEFAULT_ID ?? session?.activeTenantId, 160),
+        tenantName: safe(env.EAI_TENANT_NAME ?? session?.activeTenantName, 160),
+        appId: safe(env.EAI_APP_KEY ?? env.NEXT_PUBLIC_EAI_APP_KEY, 160), appName: safe(env.NEXT_PUBLIC_APP_NAME, 160),
+        error: safe(guidance?.title, 4000), occurredAt: context?.recordedAt,
+    }, sensitiveValues);
+}
+/**
+ * Create one non-idempotent draft after consent; ambiguous failures never trigger a retry.
+ * @param website Trusted origin from resolveSupportWebsite.
+ * @param bundle Locally redacted payload returned by collectSupportBundle.
+ * @param bearer Access token from the saved eai login session.
+ * @param timeoutMs Deadline for the request and bounded response read.
+ * @returns A validated fragment link, or null when the website rejects the session with 401.
+ * @throws SupportRequestError for safe HTTP, response-validation or ambiguous request failures.
+ */
+export async function createSupportDraft(website, bundle, bearer, timeoutMs = SUPPORT_TIMEOUT_MS) {
+    try {
+        // Draft creates are not idempotent. A timeout must never trigger an automatic retry.
+        const response = await fetch(`${website}/api/support/drafts`, {
+            method: 'POST', redirect: 'error', signal: AbortSignal.timeout(timeoutMs),
+            headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${bearer}` }, body: JSON.stringify(bundle),
+        });
+        if (response.status !== 201) {
+            await response.body?.cancel();
+            if (response.status === 401)
+                return null;
+            const messages = {
+                400: 'The website rejected the support report fields.', 413: 'The support report is too large.',
+                429: 'The support report limit was reached. Try again later.',
+                503: 'The support website is temporarily unavailable.',
+            };
+            throw new SupportRequestError(`http_${response.status}`, messages[response.status] ?? 'The support website could not create a draft.');
+        }
+        if (!response.headers.get('content-type')?.includes('application/json') || !response.body) {
+            await response.body?.cancel();
+            throw new SupportRequestError('invalid_response', 'The support website returned an invalid draft response.');
+        }
+        const reader = response.body.getReader();
+        const chunks = [];
+        let bytes = 0;
+        try {
+            while (true) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                bytes += value.byteLength;
+                if (bytes > MAX_RESPONSE_BYTES) {
+                    await reader.cancel();
+                    throw new SupportRequestError('invalid_response', 'The support website returned an invalid draft response.');
+                }
+                chunks.push(value);
+            }
+        }
+        finally {
+            reader.releaseLock();
+        }
+        const data = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+        if (!data || typeof data !== 'object')
+            throw new SupportRequestError('invalid_response', 'The support website returned an invalid draft response.');
+        const { id, token, expiresAt, redeemUrl } = data;
+        if (typeof id !== 'string' || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)
+            || typeof token !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(token)
+            || typeof expiresAt !== 'string' || !Number.isFinite(Date.parse(expiresAt)) || Date.parse(expiresAt) <= Date.now()
+            || redeemUrl !== `${website}/support#draft=${id}.${token}`) {
+            throw new SupportRequestError('invalid_response', 'The support website returned an invalid draft response.');
+        }
+        return { url: redeemUrl, expiresAt };
+    }
+    catch (error) {
+        if (error instanceof SupportRequestError)
+            throw error;
+        if (error instanceof SyntaxError)
+            throw new SupportRequestError('invalid_response', 'The support website returned an invalid draft response.');
+        throw new SupportRequestError('request_failed', 'The support request failed or timed out. No retry was sent; a draft may have been created.');
+    }
+}
+//# sourceMappingURL=support-report.js.map

package/dist/lib/support-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"support-report.js","sourceRoot":"","sources":["../../src/lib/support-report.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAEvG,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAwB,CAAC;AACrF,wEAAwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AACzC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAoCjC,8FAA8F;AAC9F,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACvB;IAArB,YAAqB,IAAY,EAAE,OAAe;QAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAAhD,SAAI,GAAJ,IAAI,CAAQ;IAAqC,CAAC;CACxE;AAED,mHAAmH;AACnH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,MAAM,EAAE,UAAU;WAC1D,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/E,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;IAClH,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAAC,CAAC;IAClH,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5E,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,CAAC;WACrE,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB,EAAE,KAAa,EAAE,KAAa;IAC5E,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,KAAK,cAAc,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,+GAA+G;AAC/G,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAuB,EAAE,OAA4B;IAC9F,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/G,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAC7C,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;IACxD,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/C,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvF,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;WAC3F,QAAQ,GAAG,CAAC,UAAU,IAAI,QAAQ,GAAG,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACrH,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,EAAE,SAAS,IAAI,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;IAClH,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACxH,MAAM,WAAW,GAAG,MAAM,eAAe,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY;YAC9E,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;iBACxD,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;aAC1E,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,CAAC,KAAyB,EAAE,KAAa,EAAsB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7J,MAAM,EAAE,GAAG,QAAQ,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACjI,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAuC,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9J,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI;QAC9C,wCAAwC,EAAE,gBAAgB,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,OAAO,EAAE,EAAE;QAChG,OAAO,CAAC,CAAC,CAAC,YAAY,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE;KACzG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAE,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,WAAW,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACjH,OAAO,mBAAmB,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,SAAS,EAAE,EAAE,CAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE;QACtJ,GAAG,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,IAAI,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE;QACtH,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,mBAAmB,EAAE,GAAG,CAAE;QAClH,WAAW,EAAE,EAAE,EAAE,WAAW;QAC5B,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,yBAAyB,IAAI,GAAG,CAAC,iBAAiB,IAAI,OAAO,EAAE,cAAc,EAAE,GAAG,CAAC;QAC3H,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC;QACvE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,uBAAuB,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC;QAC9G,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU;KACpE,EAAE,eAAe,CAAC,CAAC;AACtB,CAAC;AAKD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAe,EAAE,MAAqB,EAAE,MAAc,EAAE,SAAS,GAAG,kBAAkB;IAC7H,IAAI,CAAC;QACH,qFAAqF;QACrF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,qBAAqB,EAAE;YAC5D,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;YACzE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;SACjH,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACzC,MAAM,QAAQ,GAA2B;gBACvC,GAAG,EAAE,iDAAiD,EAAE,GAAG,EAAE,kCAAkC;gBAC/F,GAAG,EAAE,wDAAwD;gBAC7D,GAAG,EAAE,iDAAiD;aACvD,CAAC;YACF,MAAM,IAAI,mBAAmB,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,+CAA+C,CAAC,CAAC;QACzI,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC1F,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9B,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,yDAAyD,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,CAAC;YACH,OAAO,IAAI,EAAE,CAAC;gBACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,IAAI;oBAAE,MAAM;gBAChB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;gBAC1B,IAAI,KAAK,GAAG,kBAAkB,EAAE,CAAC;oBAC/B,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;oBACtB,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,yDAAyD,CAAC,CAAC;gBAC/G,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;gBAAS,CAAC;YAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAC,CAAC;QACnC,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,yDAAyD,CAAC,CAAC;QACpJ,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,IAA+B,CAAC;QAC5E,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,iEAAiE,CAAC,IAAI,CAAC,EAAE,CAAC;eACpG,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;eAC/D,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;eAC/G,SAAS,KAAK,GAAG,OAAO,kBAAkB,EAAE,IAAI,KAAK,EAAE,EAAE,CAAC;YAC7D,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,yDAAyD,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mBAAmB;YAAE,MAAM,KAAK,CAAC;QACtD,IAAI,KAAK,YAAY,WAAW;YAAE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,EAAE,yDAAyD,CAAC,CAAC;QAC/I,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,4FAA4F,CAAC,CAAC;IAChJ,CAAC;AACH,CAAC"}

package/package.json

@@ -1,19 +1,19 @@
 {
   "name": "@enterpriseai/cli",
-  "version": "3.19.1",
+  "version": "3.19.3",
   "description": "EnterpriseAI CLI for app setup, validation, deployment readiness, and platform operations",
   "type": "module",
   "bin": {
     "eai": "dist/index.js"
   },
   "scripts": {
-    "build": "tsc",
+    "build": "node scripts/clean-build-output.cjs && tsc",
     "dev": "tsc --watch",
     "start": "node dist/index.js",
     "lint": "eslint src/",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
-    "test:eai-cli:ci": "mkdir -p test-results && vitest run tests/unit/managed-profile-gateway.test.ts tests/unit/gofer-resource-override.test.ts tests/unit/init-app-binding.test.ts tests/unit/object-type-identifiers.test.ts tests/unit/release-terminology.test.ts tests/unit/ai-surfaces.test.ts tests/unit/eai-managed-deploy.test.ts tests/unit/eai-managed-deploy-write.test.ts tests/unit/eai-managed-source.test.ts tests/unit/eai-managed-source-race.test.ts tests/unit/eai-managed-source-client.test.ts tests/integration/object-type-documentation.test.ts tests/integration/login.test.ts tests/integration/whoami.test.ts tests/integration/tenant.test.ts tests/integration/init.test.ts tests/integration/create.test.ts tests/integration/splash.test.ts tests/integration/help.test.ts tests/integration/describe-contract.test.ts tests/integration/start.test.ts tests/integration/dev.test.ts tests/integration/update.test.ts tests/integration/output.test.ts tests/integration/error-guidance.test.ts tests/integration/resources-command.test.ts tests/integration/agent-guide.test.ts tests/integration/agent-discovery-eval.test.ts tests/integration/gofer.test.ts tests/integration/provision.test.ts tests/integration/types.test.ts tests/integration/user.test.ts tests/integration/publicapi.test.ts tests/integration/publicapi-v4-only.test.ts tests/integration/docs-classify.test.ts tests/integration/classifier.test.ts tests/integration/platform-api-client.test.ts tests/integration/eai-managed-deploy.test.ts tests/integration/vertical.test.ts tests/integration/dedicated-tenant-lifecycle.test.ts tests/integration/runtime-contract.test.ts tests/integration/inquirer-prompt-types.test.ts tests/integration/full-e2e-smoke.test.ts tests/integration/release-metadata.test.ts --reporter=default --reporter=junit --outputFile=test-results/eai-cli-results.xml",
+    "test:eai-cli:ci": "mkdir -p test-results && vitest run tests/unit/managed-profile-gateway.test.ts tests/unit/gofer-resource-override.test.ts tests/unit/init-app-binding.test.ts tests/unit/object-type-identifiers.test.ts tests/unit/release-terminology.test.ts tests/unit/ai-surfaces.test.ts tests/unit/eai-managed-deploy.test.ts tests/unit/eai-managed-deploy-write.test.ts tests/unit/eai-managed-source.test.ts tests/unit/eai-managed-source-race.test.ts tests/unit/eai-managed-source-client.test.ts tests/integration/object-type-documentation.test.ts tests/integration/login.test.ts tests/integration/whoami.test.ts tests/integration/tenant.test.ts tests/integration/init.test.ts tests/integration/create.test.ts tests/integration/splash.test.ts tests/integration/help.test.ts tests/integration/describe-contract.test.ts tests/integration/start.test.ts tests/integration/dev.test.ts tests/integration/update.test.ts tests/integration/output.test.ts tests/integration/error-guidance.test.ts tests/integration/resources-command.test.ts tests/integration/agent-guide.test.ts tests/integration/agent-discovery-eval.test.ts tests/integration/gofer.test.ts tests/integration/provision.test.ts tests/integration/types.test.ts tests/integration/user.test.ts tests/integration/publicapi.test.ts tests/integration/publicapi-v4-only.test.ts tests/integration/docs-classify.test.ts tests/integration/classifier.test.ts tests/integration/platform-api-client.test.ts tests/integration/eai-managed-deploy.test.ts tests/integration/vertical.test.ts tests/integration/dedicated-tenant-lifecycle.test.ts tests/integration/runtime-contract.test.ts tests/integration/inquirer-prompt-types.test.ts tests/integration/full-e2e-smoke.test.ts tests/integration/release-metadata.test.ts tests/integration/support.test.ts tests/integration/support-context.test.ts tests/unit/support-report.test.ts --reporter=default --reporter=junit --outputFile=test-results/eai-cli-results.xml",
     "test:e2e-local": "bash scripts/test-local-dedicated-tenant-lifecycle.sh",
     "smoke:resourceapi-lifecycle": "bash scripts/smoke-resourceapi-schema-sync-lifecycle.sh",
     "smoke:eai-full:check": "node scripts/eai-full-e2e-smoke.cjs --check",
@@ -22,7 +22,7 @@
     "test:watch": "vitest",
     "test:ui": "vitest --ui",
     "test:coverage": "vitest run --coverage",
-    "prepare": "tsc",
+    "prepare": "npm run build",
     "lint:no-placeholder": "! grep -r EAI_CLI_CLIENT_ID_PLACEHOLDER src/",
     "sync:gofer": "node scripts/sync-gofer-resources.cjs",
     "sync:linked-sources": "node scripts/sync-linked-sources.js",
@@ -88,6 +88,7 @@
   },
   "devDependencies": {
     "@eslint/js": "10.0.1",
+    "@next/env": "15.5.27",
     "@types/node": "24.13.3",
     "@vitest/ui": "4.1.8",
     "eslint": "10.4.1",

package/resources/deploy/eai-app-template/.github/workflows/eai-app.yml

@@ -234,6 +234,7 @@ jobs:
             --target-tenant-id "$TARGET_TENANT_ID" \
             --operation-id "$OPERATION_ID" \
             --nonce "$NONCE" \
+            --ref "$GITHUB_REF" \
             --expected-config-hash "$CONFIG_HASH" \
             --environment "$DEPLOY_ENVIRONMENT" \
             --preferred-environment "$PREFERRED_DEPLOY_ENVIRONMENT" \
@@ -450,7 +451,7 @@ jobs:
         shell: bash
         run: |
           if [[ "$LOCAL_E2E_TUNNEL" == true ]]; then
-            [[ "$SOURCE_MODE" == eai-cli-generated && "$GITHUB_EVENT_NAME" == workflow_dispatch && "$REUSABLE_CALL" != true ]]
+            [[ ( "$SOURCE_MODE" == eai-cli-generated || "$SOURCE_MODE" == source-unknown ) && "$GITHUB_EVENT_NAME" == workflow_dispatch && "$REUSABLE_CALL" != true ]]
             [[ "$DEPLOY_ENVIRONMENT" == dev || "$DEPLOY_ENVIRONMENT" == preview ]]
             [[ "$EAI_BOUND_PUBLIC_API_URL" =~ ^https://[a-z0-9-]+-8000\.[a-z0-9-]+\.devtunnels\.ms$ ]]
           else
@@ -795,14 +796,33 @@ jobs:
             const local = evidence.localE2e;
             const repositoryId = process.env.GITHUB_REPOSITORY_ID;
             const expiresAt = process.env.LOCAL_E2E_EXPIRES_AT;
-            if (!local || Object.keys(local).sort().join(',') !== 'audience,expiresAt,mode,origin,templateCommitSha' ||
-                local.mode !== 'local-tunnel-v1' || local.origin !== process.env.EAI_BOUND_PUBLIC_API_URL ||
+            const sourceUnknownLocal = process.env.SOURCE_MODE === 'source-unknown';
+            const expectedKeys = sourceUnknownLocal
+              ? 'audience,expiresAt,mode,nonceDigest,origin'
+              : 'audience,expiresAt,mode,origin,templateCommitSha';
+            if (!local || Object.keys(local).sort().join(',') !== expectedKeys ||
+                local.mode !== (sourceUnknownLocal ? 'source-unknown-local-v1' : 'local-tunnel-v1') ||
+                local.origin !== process.env.EAI_BOUND_PUBLIC_API_URL ||
                 local.expiresAt !== expiresAt || !/^[1-9][0-9]*$/.test(repositoryId) ||
-                !/^[a-f0-9]{40}$/.test(local.templateCommitSha) || Date.parse(expiresAt) <= Date.now()) {
+                Date.parse(expiresAt) <= Date.now()) {
               throw new Error('Build evidence local endpoint binding changed.');
             }
-            const tuple = ['eai.cli-managed-local-e2e-aud.v1', local.origin, evidence.operationId, repositoryId, local.templateCommitSha, expiresAt];
-            const audience = 'api://enterprise-ai-publicapi/eai-cli-generated/local-v1/' + createHash('sha256').update(JSON.stringify(tuple)).digest('hex');
+            if (sourceUnknownLocal && local.nonceDigest !== 'sha256:' + createHash('sha256').update(evidence.nonce).digest('hex')) {
+              throw new Error('Build evidence local nonce binding changed.');
+            }
+            if (!sourceUnknownLocal && !/^[a-f0-9]{40}$/.test(local.templateCommitSha)) {
+              throw new Error('Build evidence local template binding changed.');
+            }
+            const tuple = sourceUnknownLocal
+              ? ['eai.source-unknown-local-e2e-aud.v1', local.origin, process.env.TENANT_ID,
+                  process.env.TARGET_TENANT_ID || process.env.TENANT_ID, process.env.APP_KEY, evidence.operationId,
+                  repositoryId, evidence.workflowPath, evidence.ref, evidence.commitSha,
+                  evidence.configHash, local.nonceDigest, expiresAt]
+              : ['eai.cli-managed-local-e2e-aud.v1', local.origin, evidence.operationId, repositoryId, local.templateCommitSha, expiresAt];
+            const prefix = sourceUnknownLocal
+              ? 'api://enterprise-ai-publicapi/source-unknown/local-v1/'
+              : 'api://enterprise-ai-publicapi/eai-cli-generated/local-v1/';
+            const audience = prefix + createHash('sha256').update(JSON.stringify(tuple)).digest('hex');
             if (local.audience !== audience) throw new Error('Build evidence local OIDC audience changed.');
           } else if (evidence.localE2e !== undefined) {
             throw new Error('Unexpected local endpoint binding in build evidence.');
@@ -1016,7 +1036,7 @@ jobs:
           set -euo pipefail
           validate_endpoint_and_audience() {
             if [[ "$LOCAL_E2E_TUNNEL" == true ]]; then
-              [[ "$SOURCE_MODE" == eai-cli-generated && "$GITHUB_EVENT_NAME" == workflow_dispatch && "$REUSABLE_CALL" != true ]]
+              [[ ( "$SOURCE_MODE" == eai-cli-generated || "$SOURCE_MODE" == source-unknown ) && "$GITHUB_EVENT_NAME" == workflow_dispatch && "$REUSABLE_CALL" != true ]]
               [[ "$DEPLOY_ENVIRONMENT" == dev || "$DEPLOY_ENVIRONMENT" == preview ]]
               [[ "$EAI_BOUND_PUBLIC_API_URL" =~ ^https://[a-z0-9-]+-8000\.[a-z0-9-]+\.devtunnels\.ms$ ]]
               node - <<'NODE'
@@ -1032,14 +1052,27 @@ jobs:
           const local = evidence.localE2e;
           const repoId = process.env.GITHUB_REPOSITORY_ID;
           const expiry = process.env.LOCAL_E2E_EXPIRES_AT;
-          if (!local || Object.keys(local).sort().join(',') !== 'audience,expiresAt,mode,origin,templateCommitSha' ||
-              local.mode !== 'local-tunnel-v1' || local.origin !== process.env.EAI_BOUND_PUBLIC_API_URL ||
+          const sourceUnknownLocal = process.env.SOURCE_MODE === 'source-unknown';
+          const expectedKeys = sourceUnknownLocal
+            ? 'audience,expiresAt,mode,nonceDigest,origin'
+            : 'audience,expiresAt,mode,origin,templateCommitSha';
+          if (!local || Object.keys(local).sort().join(',') !== expectedKeys ||
+              local.mode !== (sourceUnknownLocal ? 'source-unknown-local-v1' : 'local-tunnel-v1') ||
+              local.origin !== process.env.EAI_BOUND_PUBLIC_API_URL ||
               local.expiresAt !== expiry || !/^[1-9][0-9]*$/.test(repoId) ||
-              !/^cli-managed-[a-f0-9]{32}$/.test(evidence.operationId) ||
-              !/^[a-f0-9]{40}$/.test(local.templateCommitSha) ||
               !Number.isFinite(Date.parse(expiry)) || Date.parse(expiry) <= Date.now()) process.exit(1);
-          const tuple = ['eai.cli-managed-local-e2e-aud.v1', local.origin, evidence.operationId, repoId, local.templateCommitSha, expiry];
-          const audience = 'api://enterprise-ai-publicapi/eai-cli-generated/local-v1/' + createHash('sha256').update(JSON.stringify(tuple)).digest('hex');
+          const tuple = sourceUnknownLocal
+            ? ['eai.source-unknown-local-e2e-aud.v1', local.origin, process.env.TENANT_ID,
+                evidence.targetTenantId || process.env.TENANT_ID, process.env.APP_KEY, evidence.operationId, repoId,
+                evidence.workflowPath, evidence.ref, evidence.commitSha, evidence.configHash,
+                local.nonceDigest, expiry]
+            : ['eai.cli-managed-local-e2e-aud.v1', local.origin, evidence.operationId, repoId, local.templateCommitSha, expiry];
+          if (sourceUnknownLocal ? local.nonceDigest !== 'sha256:' + createHash('sha256').update(evidence.nonce).digest('hex')
+              : !/^[a-f0-9]{40}$/.test(local.templateCommitSha)) process.exit(1);
+          const prefix = sourceUnknownLocal
+            ? 'api://enterprise-ai-publicapi/source-unknown/local-v1/'
+            : 'api://enterprise-ai-publicapi/eai-cli-generated/local-v1/';
+          const audience = prefix + createHash('sha256').update(JSON.stringify(tuple)).digest('hex');
           if (local.audience !== audience) process.exit(1);
           process.stdout.write(audience);
           NODE

package/resources/deploy/eai-app-template/producer-pin.json

@@ -2,28 +2,28 @@
   "schemaVersion": "eai.managed-deploy-producer-pin.v1",
   "repository": "eai-support/eai-app-template",
   "candidate": {
-    "commit": "3af817f688d374b6260dcffcecb53c4bb94675ef",
+    "commit": "d777e97d188c1a5a611d1bc14fbb16a3ea1d9acb",
     "workflow": {
       "path": ".github/workflows/eai-app.yml",
-      "sha256": "sha256:e672ee440a434b9d681a73bb00b15c3a2dbb5b0561825cfd7e6abaefd892a4cb"
+      "sha256": "sha256:bce4e34fe5c47377e6a679966a37257d944cd00ccf3c15b4ba437f144ed559ed"
     },
     "collector": {
       "path": "scripts/source-unknown-deployment-evidence.mjs",
-      "sha256": "sha256:ed320c87186579afb3a8a7c9f65b8aea0feadc415a8ec8a0329f741dc106b42f"
+      "sha256": "sha256:06e7f33bf1db1d7adbebb75a76d2756e46371318f36d2518c5cfbb58ad4f5e1c"
     },
     "evidenceTest": {
       "path": "tests/source-unknown-deployment-evidence.test.mjs",
-      "sha256": "sha256:a332a9a41b905a67284ca610303d172cbdccdf394a9c130949a71b3eec22ff61"
+      "sha256": "sha256:fe5f8381d882ac39656b67b30e1e18193cb676a8aba26a6776a88880a3bb5827"
     }
   },
   "releaseGate": {
     "status": "released",
-    "tag": "v1.0.7",
-    "commit": "3af817f688d374b6260dcffcecb53c4bb94675ef"
+    "tag": "v1.0.12",
+    "commit": "d777e97d188c1a5a611d1bc14fbb16a3ea1d9acb"
   },
   "githubProducerIdentity": {
     "profile": "github-environment-v1",
-    "templateCommitSha": "3af817f688d374b6260dcffcecb53c4bb94675ef",
-    "workflowSha256": "sha256:e672ee440a434b9d681a73bb00b15c3a2dbb5b0561825cfd7e6abaefd892a4cb"
+    "templateCommitSha": "d777e97d188c1a5a611d1bc14fbb16a3ea1d9acb",
+    "workflowSha256": "sha256:bce4e34fe5c47377e6a679966a37257d944cd00ccf3c15b4ba437f144ed559ed"
   }
 }

package/resources/deploy/eai-app-template/scripts/source-unknown-deployment-evidence.mjs

@@ -181,7 +181,7 @@ function localE2eBinding(options, mode, environment, root) {
   const operationId = option(options, 'operationId');
   const repositoryId = option(options, 'repositoryId');
   if (
-    mode !== 'eai-cli-generated' ||
+    !['eai-cli-generated', 'source-unknown'].includes(mode) ||
     !['preview', 'dev'].includes(environment) ||
     option(options, 'githubEventName') !== 'workflow_dispatch' ||
     option(options, 'reusableCall') === 'true' ||
@@ -189,7 +189,6 @@ function localE2eBinding(options, mode, environment, root) {
     !/^[1-9][0-9]*$/.test(repositoryId) ||
     !Number.isSafeInteger(Number(repositoryId)) ||
     String(Number(repositoryId)) !== repositoryId ||
-    !/^cli-managed-[a-f0-9]{32}$/.test(operationId) ||
     !/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d+)?\+00:00$/.test(expiresAt) ||
     !Number.isFinite(Date.parse(expiresAt)) ||
     Date.parse(expiresAt) <= Date.now() ||
@@ -197,6 +196,34 @@ function localE2eBinding(options, mode, environment, root) {
   ) {
     throw new Error('Local deployment requires an exact direct DEV/preview tunnel binding.');
   }
+  if (mode === 'source-unknown') {
+    const nonce = option(options, 'nonce');
+    const tenantId = option(options, 'tenantId');
+    const targetTenant = option(options, 'targetTenantId') || tenantId;
+    const appKey = option(options, 'appKey');
+    const workflowPath = option(options, 'workflow', '.github/workflows/eai-app.yml');
+    const ref = option(options, 'ref', process.env.GITHUB_REF || '');
+    const commitSha = option(options, 'commit', process.env.GITHUB_SHA || '');
+    const configHash = option(options, 'expectedConfigHash');
+    if (!/^source-unknown-[a-f0-9]{16}$/.test(operationId)
+      || !tenantId || !targetTenant || !appKey || !nonce
+      || workflowPath !== CANONICAL_WORKFLOW_PATH
+      || !/^refs\/heads\//.test(ref)
+      || !/^[a-f0-9]{40}$/.test(commitSha)
+      || !SHA256_DIGEST.test(configHash)) {
+      throw new Error('Local source-unknown operation binding is incomplete.');
+    }
+    const nonceDigest = `sha256:${createHash('sha256').update(nonce).digest('hex')}`;
+    const fields = ['eai.source-unknown-local-e2e-aud.v1', origin, tenantId,
+      targetTenant, appKey, operationId, repositoryId, workflowPath, ref,
+      commitSha, configHash, nonceDigest, expiresAt];
+    return { mode: 'source-unknown-local-v1', origin, expiresAt, nonceDigest,
+      audience: 'api://enterprise-ai-publicapi/source-unknown/local-v1/'
+        + createHash('sha256').update(JSON.stringify(fields)).digest('hex') };
+  }
+  if (!/^cli-managed-[a-f0-9]{32}$/.test(operationId)) {
+    throw new Error('Local CLI operation binding is invalid.');
+  }
   const binding = JSON.parse(readRegularFileNoFollow(root, '.eai/cli-managed-source-operation.json').toString('utf8'));
   if (
     binding.schemaVersion !== 'eai.cli_managed_source_operation.v1' ||