@ganakailabs/cloudeval-cli 0.26.11 → 0.27.0

package/dist/cli.js

@@ -26,17 +26,20 @@ import {
   writeCliConfigValue
 } from "./chunk-QSBGUI25.js";
 import {
+  clearActiveCLITraceContext,
+  createCLITraceContext,
   getBundledAgentProfile,
   getBundledAgentProfiles,
   getCLIHeaders,
   isSensitiveSecretKey,
   normalizeApiBase,
   redactSensitiveSecrets,
-  redactSensitiveText
-} from "./chunk-2OLI5VOG.js";
+  redactSensitiveText,
+  setActiveCLITraceContext
+} from "./chunk-USSCB2ZU.js";
 import {
   CLI_VERSION
-} from "./chunk-Y5L2F7X3.js";
+} from "./chunk-YW5JWFYV.js";
 
 // src/runtime/prepareInk.ts
 import fs from "fs";
@@ -1649,7 +1652,7 @@ var resolveReportProjectId = async ({
   if (!token) {
     throw new Error("No project specified. Use --project <id> for report access.");
   }
-  const resolvedWorkspace = workspace ?? await import("./dist-MQQKC6DZ.js").then((core) => ({
+  const resolvedWorkspace = workspace ?? await import("./dist-PEYJDO7A.js").then((core) => ({
     checkUserStatus: core.checkUserStatus,
     getProjects: core.getProjects
   }));
@@ -1678,7 +1681,7 @@ var warnIfAccessKeyFromCliOption = (options, command) => {
 };
 var resolveAuthContext = async (options, command, deps) => {
   const baseUrl = await deps.resolveBaseUrl(options, command);
-  const core = await import("./dist-MQQKC6DZ.js");
+  const core = await import("./dist-PEYJDO7A.js");
   core.assertSecureBaseUrl(baseUrl);
   warnIfAccessKeyFromCliOption(options, command);
   let accessKey = options.accessKey;
@@ -1764,7 +1767,7 @@ var resolveToken = async (options, baseUrl, deps, command) => {
   if (options.accessKey) {
     return options.accessKey;
   }
-  const { getAuthToken } = await import("./dist-MQQKC6DZ.js");
+  const { getAuthToken } = await import("./dist-PEYJDO7A.js");
   try {
     return await getAuthToken({
       accessKey: options.accessKey,
@@ -1775,7 +1778,7 @@ var resolveToken = async (options, baseUrl, deps, command) => {
     if (!canLogin) {
       throw error;
     }
-    const { login } = await import("./dist-MQQKC6DZ.js");
+    const { login } = await import("./dist-PEYJDO7A.js");
     process.stderr.write("Authentication required. Starting login flow...\n");
     const token = await login(baseUrl, {
       headless: Boolean(process.env.SSH_TTY || process.env.CLOUDEVAL_HEADLESS_LOGIN)
@@ -1941,7 +1944,7 @@ var registerReportsCommand = (program2, deps) => {
         token,
         requestedProjectId: options.project
       });
-      const core = await import("./dist-MQQKC6DZ.js");
+      const core = await import("./dist-PEYJDO7A.js");
       const status = token ? await core.checkUserStatus(baseUrl, token) : void 0;
       const reports2 = await core.listReports({
         baseUrl,
@@ -1963,7 +1966,7 @@ var registerReportsCommand = (program2, deps) => {
     try {
       const baseUrl = await deps.resolveBaseUrl(options, command);
       const token = await resolveToken(options, baseUrl, deps, command);
-      const core = await import("./dist-MQQKC6DZ.js");
+      const core = await import("./dist-PEYJDO7A.js");
       const status = token ? await core.checkUserStatus(baseUrl, token) : void 0;
       const projectId = await resolveReportProjectId({
         baseUrl,
@@ -2066,7 +2069,7 @@ var registerReportsCommand = (program2, deps) => {
       try {
         const baseUrl = await deps.resolveBaseUrl(options, command);
         const token = await resolveToken(options, baseUrl, deps, command);
-        const core = await import("./dist-MQQKC6DZ.js");
+        const core = await import("./dist-PEYJDO7A.js");
         const status = token ? await core.checkUserStatus(baseUrl, token) : void 0;
         const projectId = await resolveReportProjectId({
           baseUrl,
@@ -2136,7 +2139,7 @@ var registerReportsCommand = (program2, deps) => {
         token,
         requestedProjectId: options.project
       });
-      const core = await import("./dist-MQQKC6DZ.js");
+      const core = await import("./dist-PEYJDO7A.js");
       const status = token ? await core.checkUserStatus(baseUrl, token) : void 0;
       const report = await core.getWafReport({
         baseUrl,
@@ -2175,7 +2178,7 @@ var registerReportsCommand = (program2, deps) => {
         token,
         requestedProjectId: options.project
       });
-      const core = await import("./dist-MQQKC6DZ.js");
+      const core = await import("./dist-PEYJDO7A.js");
       const status = token ? await core.checkUserStatus(baseUrl, token) : void 0;
       const report = await core.getReport({
         baseUrl,
@@ -2203,7 +2206,7 @@ var registerReportsCommand = (program2, deps) => {
         token,
         requestedProjectId: options.project
       });
-      const core = await import("./dist-MQQKC6DZ.js");
+      const core = await import("./dist-PEYJDO7A.js");
       const status = token ? await core.checkUserStatus(baseUrl, token) : void 0;
       const report = await core.getCostReport({
         baseUrl,
@@ -2232,7 +2235,7 @@ var registerReportsCommand = (program2, deps) => {
           token,
           requestedProjectId: options.project
         });
-        const core = await import("./dist-MQQKC6DZ.js");
+        const core = await import("./dist-PEYJDO7A.js");
         const status = token ? await core.checkUserStatus(baseUrl, token) : void 0;
         const report = await core.getWafReport({
           baseUrl,
@@ -2410,14 +2413,41 @@ var parseGateConfig = (configText) => {
     const match = configText.match(new RegExp(`^\\s*${key}\\s*:\\s*([^\\s#]+)`, "m"));
     return match ? match[1].trim() : void 0;
   };
+  const firstStringValue = (...keys) => {
+    for (const key of keys) {
+      const value = stringValue2(key);
+      if (value !== void 0) {
+        return value;
+      }
+    }
+    return void 0;
+  };
   const numberValue2 = (key) => {
     const match = configText.match(new RegExp(`^\\s*${key}\\s*:\\s*([0-9]+(?:\\.[0-9]+)?)`, "m"));
     return match ? Number(match[1]) : void 0;
   };
+  const firstNumberValue = (...keys) => {
+    for (const key of keys) {
+      const value = numberValue2(key);
+      if (value !== void 0) {
+        return value;
+      }
+    }
+    return void 0;
+  };
   const booleanValue2 = (key) => {
     const match = configText.match(new RegExp(`^\\s*${key}\\s*:\\s*(true|false)`, "im"));
     return match ? match[1].toLowerCase() === "true" : void 0;
   };
+  const firstBooleanValue = (...keys) => {
+    for (const key of keys) {
+      const value = booleanValue2(key);
+      if (value !== void 0) {
+        return value;
+      }
+    }
+    return void 0;
+  };
   const pillarScoreMins = {};
   const pillarBlock = configText.match(/^(\s*)pillars\s*:\s*$(?<body>(?:\n\s+[-\w]+\s*:\s*[0-9]+(?:\.[0-9]+)?\s*)+)/m);
   const pillarBody = pillarBlock?.groups?.body ?? "";
@@ -2439,15 +2469,21 @@ var parseGateConfig = (configText) => {
       pillarScoreMins[key] = value;
     }
   }
-  const enforcement = stringValue2("enforcement")?.toLowerCase();
+  const enforcement = firstStringValue("enforcement", "mode")?.toLowerCase();
   return {
-    enforcement: enforcement === "warn" ? "warn" : "required",
-    overallScoreMin: numberValue2("overall_score_min") ?? 80,
-    pillarScoreMin: numberValue2("pillar_score_min"),
+    enforcement: enforcement === "warn" || enforcement === "comment_only" ? "warn" : "required",
+    overallScoreMin: firstNumberValue("overall_score_min", "minimum_well_architected_score") ?? 80,
+    pillarScoreMin: firstNumberValue("pillar_score_min", "minimum_pillar_score"),
     pillarScoreMins,
-    failOnHighRisk: booleanValue2("fail_on_high_risk") ?? true,
-    failOnValidationErrors: booleanValue2("fail_on_validation_errors") ?? true,
-    maxMonthlyCost: numberValue2("max_monthly_cost")
+    failOnHighRisk: firstBooleanValue(
+      "fail_on_high_risk",
+      "fail_when_high_risk_findings_exist"
+    ) ?? true,
+    failOnValidationErrors: firstBooleanValue(
+      "fail_on_validation_errors",
+      "fail_when_validation_fails"
+    ) ?? true,
+    maxMonthlyCost: firstNumberValue("max_monthly_cost", "max_monthly_cost_usd")
   };
 };
 var numberFrom = (...values) => {
@@ -2493,11 +2529,13 @@ var reviewReportStatus = (report) => ({
 var reviewReportStatuses = ({
   cost,
   waf,
-  preload
+  preload,
+  graph
 }) => ({
   cost: reviewReportStatus(cost),
   wellArchitected: reviewReportStatus(waf),
-  preload: reviewReportStatus(preload)
+  preload: reviewReportStatus(preload),
+  graph: reviewReportStatus(graph)
 });
 var publicJobStatus = (value) => {
   const record = firstRecord(value);
@@ -2534,18 +2572,198 @@ var formatMoney = (amount, currency, fallback = "not available") => {
   }
   return currency ? `${numericAmount} ${currency}` : String(numericAmount);
 };
-var formatValidation = (validation) => {
-  const policyFailed = displayNumber(validation?.policyChecks?.failed);
-  const unitFailed = displayNumber(validation?.unitTests?.failed);
-  return `Policy checks ${policyFailed} failed, unit tests ${unitFailed} failed`;
+var trimNumber = (value, fractionDigits = 2) => Number.isInteger(value) ? String(value) : String(Number(value.toFixed(fractionDigits)));
+var formatScore = (value, fallback = "unknown") => {
+  const numericValue = numberFrom(value);
+  return numericValue === void 0 ? fallback : `${trimNumber(numericValue)}/100`;
+};
+var scoreRating = (value) => {
+  const numericValue = numberFrom(value);
+  if (numericValue === void 0) {
+    return void 0;
+  }
+  if (numericValue >= 90) {
+    return "EXCELLENT";
+  }
+  if (numericValue >= 75) {
+    return "GOOD";
+  }
+  if (numericValue >= 50) {
+    return "FAIR";
+  }
+  if (numericValue >= 30) {
+    return "POOR";
+  }
+  return "CRITICAL";
 };
-var compactValidation = (validation) => {
+var scoreRatingIcon = (rating) => {
+  switch (rating) {
+    case "EXCELLENT":
+      return "\u{1F7E2}";
+    case "GOOD":
+      return "\u{1F535}";
+    case "FAIR":
+      return "\u{1F7E1}";
+    case "POOR":
+      return "\u{1F7E0}";
+    case "CRITICAL":
+      return "\u{1F534}";
+    default:
+      return "\u26AA";
+  }
+};
+var formatMonthlyMoney = (amount, currency, fallback = "not available") => {
+  const value = formatMoney(amount, currency, fallback);
+  return value === fallback ? value : `${value}/mo`;
+};
+var compactBudgetLabel = (amount, currency) => {
+  if (amount === void 0 || !Number.isFinite(amount)) {
+    return void 0;
+  }
+  if (Math.abs(amount) >= 1e6) {
+    return `${trimNumber(amount / 1e6, 1)}M`;
+  }
+  if (Math.abs(amount) >= 1e3) {
+    return `${trimNumber(amount / 1e3, 1)}K`;
+  }
+  return formatMonthlyMoney(amount, currency);
+};
+var costSummaryLine = (cost) => {
+  const amount = numberFrom(cost?.amount);
+  if (amount === void 0) {
+    return "\u26AA Cost: not available";
+  }
+  const formattedCost = formatMonthlyMoney(amount, cost?.currency);
+  const threshold = numberFrom(cost?.threshold);
+  if (threshold === void 0) {
+    return `\u26AA Cost: ${formattedCost} (not gated)`;
+  }
+  const budget = compactBudgetLabel(threshold, cost?.currency) ?? "configured";
+  return String(cost?.status ?? "").toLowerCase() === "fail" ? `\u{1F534} Cost: ${formattedCost} (over ${budget} budget)` : `\u{1F7E2} Cost: ${formattedCost} (under ${budget} budget)`;
+};
+var statusIcon = (status) => {
+  switch (String(status ?? "").toLowerCase()) {
+    case "pass":
+    case "passed":
+    case "success":
+    case "succeeded":
+      return "\u{1F7E2}";
+    case "warn":
+    case "warning":
+      return "\u{1F7E1}";
+    case "fail":
+    case "failed":
+    case "error":
+      return "\u{1F534}";
+    default:
+      return "\u26AA";
+  }
+};
+var formatValidation = (validation) => {
   const policyFailed = numberFrom(validation?.policyChecks?.failed);
   const unitFailed = numberFrom(validation?.unitTests?.failed);
   if (policyFailed === 0 && unitFailed === 0) {
-    return "validation clean";
+    return "Validation clean";
   }
-  return formatValidation(validation);
+  const parts = [];
+  if (unitFailed !== void 0) {
+    parts.push(unitFailed === 0 ? "unit tests clean" : `${unitFailed} unit tests failed`);
+  }
+  if (policyFailed !== void 0) {
+    parts.push(policyFailed === 0 ? "policy checks clean" : `${policyFailed} policy checks failed`);
+  }
+  return parts.length ? parts.join(", ") : "Validation not available";
+};
+var validationSummaryLine = (validation) => {
+  const unitFailed = numberFrom(validation?.unitTests?.failed);
+  if (unitFailed === void 0) {
+    return "\u26AA Validation: not available";
+  }
+  return unitFailed > 0 ? `\u{1F534} Validation: ${unitFailed} unit tests failed` : "\u{1F7E2} Validation: GOOD";
+};
+var policySummaryLine = (validation) => {
+  const policyFailed = numberFrom(validation?.policyChecks?.failed);
+  if (policyFailed === void 0) {
+    return "\u26AA Policy checks: not available";
+  }
+  return policyFailed > 0 ? `\u{1F534} Policy checks: ${policyFailed} failed` : "\u{1F7E2} Policy checks: GOOD";
+};
+var validationDetailLines = (validation) => {
+  if (!validation) {
+    return ["- Validation data was not available."];
+  }
+  const lines = [];
+  const unitTotal = numberFrom(validation.unitTests?.total);
+  const unitPassed = numberFrom(validation.unitTests?.passed);
+  const unitFailed = numberFrom(validation.unitTests?.failed);
+  if (unitTotal !== void 0 || unitPassed !== void 0 || unitFailed !== void 0) {
+    const parts = [];
+    if (unitPassed !== void 0) parts.push(`**${unitPassed} passed**`);
+    if (unitFailed !== void 0) parts.push(`**${unitFailed} failed**`);
+    if (unitTotal !== void 0) parts.push(`${unitTotal} total`);
+    lines.push(`- Unit tests: ${parts.join(", ")}`);
+  }
+  const policyTotal = numberFrom(validation.policyChecks?.total);
+  const policyPassed = numberFrom(validation.policyChecks?.passed);
+  const policyFailed = numberFrom(validation.policyChecks?.failed);
+  if (policyTotal !== void 0 || policyPassed !== void 0 || policyFailed !== void 0) {
+    const parts = [];
+    if (policyPassed !== void 0) parts.push(`**${policyPassed} passed**`);
+    if (policyFailed !== void 0) parts.push(`**${policyFailed} failed**`);
+    if (policyTotal !== void 0) parts.push(`${policyTotal} total`);
+    lines.push(`- Policy checks: ${parts.join(", ")}`);
+  }
+  return lines.length ? lines : ["- Validation data was not available."];
+};
+var namedAmount = (record) => numberFrom(
+  record.amount,
+  record.monthly_cost,
+  record.monthlyCost,
+  record.cost,
+  record.value
+);
+var namedLabel = (record, fallback) => String(record.name ?? record.service ?? record.label ?? record.category ?? fallback);
+var mermaidLabel = (value) => value.replace(/"/g, "'");
+var costServiceRows = (services, currency) => (Array.isArray(services) ? services : []).map((service, index) => {
+  const record = asRecord(service);
+  const amount = namedAmount(record);
+  if (amount === void 0) {
+    return void 0;
+  }
+  const rowCurrency = String(record.currency ?? currency ?? "") || void 0;
+  return {
+    name: namedLabel(record, `Service ${index + 1}`),
+    amount,
+    ...rowCurrency ? { currency: rowCurrency } : {}
+  };
+}).filter((service) => service !== void 0);
+var reconcileCostServiceRows = (services, totalAmount, currency) => {
+  const total = numberFrom(totalAmount);
+  if (total === void 0 || services.length === 0) {
+    return services;
+  }
+  const serviceSum = services.reduce((sum, service) => sum + service.amount, 0);
+  if (serviceSum > total + 1e-3) {
+    return [
+      {
+        name: "Reported total",
+        amount: total,
+        ...currency ? { currency } : {}
+      }
+    ];
+  }
+  const delta = Number((total - serviceSum).toFixed(3));
+  if (delta > 1e-3) {
+    return [
+      ...services,
+      {
+        name: "Other",
+        amount: delta,
+        ...currency ? { currency } : {}
+      }
+    ];
+  }
+  return services;
 };
 var markdownLink = (label, url) => url ? `[${label}](${url})` : label;
 var extractPillars = (waf) => {
@@ -2615,11 +2833,65 @@ var extractValidation = ({
     }
   };
 };
+var extractArchitectureInsights = ({
+  waf,
+  preload,
+  graph,
+  project
+}) => {
+  const graphNodes = Array.isArray(graph?.nodes) ? graph.nodes : [];
+  const graphEdges = Array.isArray(graph?.edges) ? graph.edges : [];
+  const graphResourceTypes = new Set(
+    graphNodes.map((node) => asRecord(node).type).filter((type) => typeof type === "string" && type.trim().length > 0)
+  );
+  const metrics = firstRecord(
+    preload?.reports?.architecture?.metrics,
+    preload?.latest_payloads?.architecture?.summary,
+    waf?.architecture,
+    waf?.parsed?.architecture,
+    project?.architecture,
+    project?.graph
+  );
+  const resources = numberFrom(
+    metrics?.resource_count,
+    metrics?.resourceCount,
+    metrics?.resources,
+    metrics?.node_count,
+    metrics?.nodeCount,
+    graphNodes.length || void 0
+  );
+  const relationships = numberFrom(
+    metrics?.relationship_count,
+    metrics?.relationshipCount,
+    metrics?.relationships,
+    metrics?.edge_count,
+    metrics?.edgeCount,
+    graphEdges.length || void 0
+  );
+  const resourceTypes = numberFrom(
+    metrics?.resource_type_count,
+    metrics?.resourceTypeCount,
+    metrics?.types,
+    metrics?.resource_types,
+    metrics?.resourceTypes,
+    graphResourceTypes.size || void 0
+  );
+  if (resources === void 0 && relationships === void 0 && resourceTypes === void 0) {
+    return void 0;
+  }
+  return {
+    resources,
+    relationships,
+    resourceTypes,
+    relationshipDensity: resources !== void 0 && resources > 0 && relationships !== void 0 ? relationships / resources : void 0
+  };
+};
 var evaluateGate = ({
   configText,
   waf,
   cost,
   preload,
+  graph,
   project
 }) => {
   const gateConfig = parseGateConfig(configText);
@@ -2672,6 +2944,7 @@ var evaluateGate = ({
     };
   });
   const validation = extractValidation({ waf, preload, project });
+  const architecture = extractArchitectureInsights({ waf, preload, graph, project });
   const wellArchitected = {
     overall: {
       score: overallScore,
@@ -2710,7 +2983,8 @@ var evaluateGate = ({
       monthlyCost,
       wellArchitected,
       cost: costSummary,
-      validation
+      validation,
+      architecture
     };
   }
   const failures = [];
@@ -2749,7 +3023,8 @@ var evaluateGate = ({
     monthlyCost,
     wellArchitected,
     cost: costSummary,
-    validation
+    validation,
+    architecture
   };
 };
 var safeFetch = async (input) => {
@@ -2865,7 +3140,7 @@ var fetchReviewReports = async ({
   projectId,
   userId
 }) => {
-  const [cost, waf, preload] = await Promise.all([
+  const [cost, waf, preload, graph] = await Promise.all([
     safeFetch({
       baseUrl,
       authToken: token,
@@ -2880,9 +3155,14 @@ var fetchReviewReports = async ({
       baseUrl,
       authToken: token,
       path: `/reports/preload/${encodeURIComponent(projectId)}?user_id=${encodeURIComponent(userId)}&include_payload=true`
+    }) : Promise.resolve(void 0),
+    userId ? safeFetch({
+      baseUrl,
+      authToken: token,
+      path: `/projects/${encodeURIComponent(projectId)}/graph?user_id=${encodeURIComponent(userId)}`
     }) : Promise.resolve(void 0)
   ]);
-  return { cost, waf, preload };
+  return { cost, waf, preload, graph };
 };
 var waitForReviewReports = async ({
   baseUrl,
@@ -2906,8 +3186,11 @@ var waitForReviewReports = async ({
 };
 var buildAiSummaryPrompt = (data) => [
   "Write a concise CloudEval pull request review summary in Markdown.",
-  "Focus on gate status, Well-Architected posture, cost posture, and security/operational risks.",
-  "Keep it under 160 words. Do not invent facts not present below.",
+  "Return exactly two sections: Short Summary and Details.",
+  "Short Summary: one dense paragraph under 45 words with gate status, Well-Architected posture, validation, and cost.",
+  "Details: short bullets with bold labels only when useful, such as **Key risks:**, **Cost posture:**, and **Recommended next step:**.",
+  "Keep the full response under 180 words. Do not invent facts not present below.",
+  "Do not include citations, source markers, hidden tool ids, or HTML comments.",
   "",
   `Project: ${data.projectId}`,
   `Repository: ${data.repo ?? "unknown"}`,
@@ -2924,10 +3207,81 @@ var isTransientAiSummaryText = (text) => {
   if (!text?.trim()) {
     return false;
   }
-  return /too many requests|rate[- ]?limit|try again in a moment|temporarily unavailable/i.test(
+  return /too many requests|rate[- ]?limit|try again in a moment|temporarily unavailable|something went wrong while processing|please try again or ask a different question|did not complete within/i.test(
     text
   );
 };
+var normalizeAiSummaryMarkdown = (text) => {
+  return normalizeAiSummarySections(text).markdown;
+};
+var normalizeAiSummarySections = (text) => {
+  const trimmed = String(text ?? "").trim();
+  if (!trimmed) {
+    return { shortSummary: "", detailsMarkdown: "", markdown: "" };
+  }
+  const withNewlines = sanitizeAiSummaryMarkdown(trimmed.replace(/\\n/g, "\n"));
+  const requestMatch = /\bRequest:\s*/i.exec(withNewlines);
+  const sourceText = requestMatch ? withNewlines.slice(requestMatch.index + requestMatch[0].length).split(/\n\s*\nThe request reached\b/i)[0].trim() || withNewlines : withNewlines;
+  const sections = splitAiSummarySections(sourceText);
+  return {
+    ...sections,
+    markdown: renderAiSummarySections(sections.shortSummary, sections.detailsMarkdown)
+  };
+};
+var sanitizeAiSummaryMarkdown = (text) => text.replace(/<!--[\s\S]*?-->/g, "").replace(/\s*\[S_[A-Za-z0-9_:-]+\]/g, "").replace(/\n{3,}/g, "\n\n").trim();
+var stripAiSectionLabel = (text, label) => text.replace(new RegExp(`^\\s*#{0,6}\\s*\\*\\*?${label}\\*\\*?\\s*:?\\s*`, "i"), "").replace(new RegExp(`^\\s*${label}\\s*:?\\s*`, "i"), "").trim();
+var normalizeAiDetailHeadings = (text) => text.split("\n").map((line) => {
+  const cleaned = line.replace(/^\s*#{1,6}\s*/, "").replace(/^\s*[-*]\s+/, "").trimEnd();
+  const labelMatch = cleaned.match(/^\*\*(Key risks|Cost posture|Recommended next step|Recommendation|Validation|Impact):\*\*\s*(.*)$/i) ?? cleaned.match(/^\*\*(Key risks|Cost posture|Recommended next step|Recommendation|Validation|Impact)\*\*\s*:\s*(.*)$/i) ?? cleaned.match(/^(Key risks|Cost posture|Recommended next step|Recommendation|Validation|Impact)\s*:\s*(.*)$/i);
+  if (!labelMatch) {
+    return cleaned;
+  }
+  return `- **${labelMatch[1]}:** ${labelMatch[2]}`.trimEnd();
+}).join("\n").trim();
+var splitAiSummarySections = (text) => {
+  const cleaned = sanitizeAiSummaryMarkdown(text).replace(/^\s*#{1,6}\s*AI summary\s*$/gim, "").trim();
+  const shortMatch = /\bShort Summary\s*:\s*/i.exec(cleaned);
+  const detailsMatch = /\bDetails\s*:\s*/i.exec(cleaned);
+  if (shortMatch && detailsMatch && shortMatch.index < detailsMatch.index) {
+    const shortSummary2 = stripAiSectionLabel(
+      cleaned.slice(shortMatch.index, detailsMatch.index).trim(),
+      "Short Summary"
+    );
+    const detailsMarkdown2 = normalizeAiDetailHeadings(
+      stripAiSectionLabel(cleaned.slice(detailsMatch.index).trim(), "Details")
+    );
+    return { shortSummary: shortSummary2, detailsMarkdown: detailsMarkdown2 };
+  }
+  const paragraphs = cleaned.split(/\n\s*\n/).map((paragraph) => paragraph.trim()).filter(Boolean);
+  const shortSummary = stripAiSectionLabel(paragraphs[0] ?? cleaned, "Short Summary");
+  const detailsMarkdown = normalizeAiDetailHeadings(paragraphs.slice(1).join("\n\n"));
+  return { shortSummary, detailsMarkdown };
+};
+var renderAiSummarySections = (shortSummary, detailsMarkdown) => {
+  const lines = [`**Short summary:** ${shortSummary.trim()}`];
+  if (detailsMarkdown.trim()) {
+    lines.push(
+      "",
+      "<details>",
+      "<summary>AI details</summary>",
+      "",
+      detailsMarkdown.trim(),
+      "",
+      "</details>"
+    );
+  }
+  return lines.join("\n");
+};
+var aiSummaryAttemptTimeoutMs = () => {
+  const raw = process.env.CLOUDEVAL_REVIEW_AI_ATTEMPT_TIMEOUT_MS;
+  if (raw?.trim()) {
+    const parsed = Number.parseInt(raw.trim(), 10);
+    if (Number.isFinite(parsed) && parsed > 0) {
+      return parsed;
+    }
+  }
+  return 18e4;
+};
 var aiSummaryRetryDelaysMs = () => {
   const raw = process.env.CLOUDEVAL_REVIEW_AI_RETRY_DELAYS_MS;
   if (raw?.trim()) {
@@ -2945,11 +3299,23 @@ var generateAiSummaryAttempt = async ({
   agentProfileId,
   data
 }) => {
-  const core = await import("./dist-MQQKC6DZ.js");
+  const core = await import("./dist-PEYJDO7A.js");
   const threadId = `review-${data.projectId}-${Date.now()}`;
   let markdown = "";
   let chatState = { ...core.initialChatState, threadId };
-  for await (const chunk of core.streamChat({
+  const attemptTimeoutMs = aiSummaryAttemptTimeoutMs();
+  let timedOut = false;
+  let timeoutId;
+  const timeoutPromise = new Promise((_, reject) => {
+    timeoutId = setTimeout(() => {
+      timedOut = true;
+      reject(
+        new Error(`AI summary did not complete within ${attemptTimeoutMs}ms.`)
+      );
+    }, attemptTimeoutMs);
+    timeoutId.unref?.();
+  });
+  const iterator = core.streamChat({
     baseUrl,
     authToken: token,
     message: buildAiSummaryPrompt(data),
@@ -2977,35 +3343,94 @@ var generateAiSummaryAttempt = async ({
     completeAfterResponse: true,
     responseCompletionGraceMs: 250,
     streamIdleTimeoutMs: 12e4
-  })) {
-    chatState = core.reduceChunk(chatState, chunk);
-    const latestMessage = [...chatState.messages ?? []].reverse().find((message) => message.role === "assistant");
-    const chunkAssistantMessage = Array.isArray(chunk?.messages) ? [...chunk.messages].reverse().find((message) => message?.role === "assistant" && typeof message?.content === "string")?.content : void 0;
-    const content = chunk?.content;
-    if (typeof chunkAssistantMessage === "string" && chunkAssistantMessage.trim()) {
-      markdown = chunkAssistantMessage;
+  });
+  try {
+    while (true) {
+      const next = await Promise.race([iterator.next(), timeoutPromise]);
+      if (next.done) {
+        break;
+      }
+      const chunk = next.value;
+      chatState = core.reduceChunk(chatState, chunk);
+      const latestMessage = [...chatState.messages ?? []].reverse().find((message) => message.role === "assistant");
+      const chunkAssistantMessage = Array.isArray(chunk?.messages) ? [...chunk.messages].reverse().find((message) => message?.role === "assistant" && typeof message?.content === "string")?.content : void 0;
+      const content = chunk?.content;
+      if (typeof chunkAssistantMessage === "string" && chunkAssistantMessage.trim()) {
+        markdown = chunkAssistantMessage;
+      }
+      if (chunk.type === "responding" && typeof content === "string") {
+        markdown = latestMessage?.content || `${markdown}${content}`;
+      }
+    }
+  } finally {
+    if (timeoutId) {
+      clearTimeout(timeoutId);
     }
-    if (chunk.type === "responding" && typeof content === "string") {
-      markdown = latestMessage?.content || `${markdown}${content}`;
+    if (timedOut) {
+      await iterator.return?.(void 0).catch(() => void 0);
     }
   }
   const finalMessage = [...chatState.messages ?? []].reverse().find((message) => message.role === "assistant");
+  const rawMarkdown = String(finalMessage?.content || markdown).trim();
+  const normalized = normalizeAiSummarySections(rawMarkdown);
   return {
     enabled: true,
     status: "ok",
     mode,
     ...mode === "agent" ? { agentProfileId: agentProfileId ?? "architecture" } : {},
     ...model ? { model } : {},
-    markdown: String(finalMessage?.content || markdown).trim(),
+    ...normalized,
     threadId
   };
 };
 var generateAiSummary = async (input) => {
   const retryDelays = aiSummaryRetryDelaysMs();
   let lastResult;
+  let activeInput = input;
+  let fallbackFromMode;
   for (let attemptIndex = 0; attemptIndex <= retryDelays.length; attemptIndex += 1) {
-    const result = await generateAiSummaryAttempt(input);
+    let result;
+    try {
+      result = await generateAiSummaryAttempt(activeInput);
+    } catch (error) {
+      const message = error?.message ?? "AI summary failed";
+      if (!isTransientAiSummaryText(message)) {
+        throw error;
+      }
+      result = {
+        enabled: true,
+        status: "transient_error",
+        mode: activeInput.mode,
+        ...activeInput.mode === "agent" ? { agentProfileId: activeInput.agentProfileId ?? "architecture" } : {},
+        ...activeInput.model ? { model: activeInput.model } : {},
+        markdown: message,
+        error: message
+      };
+    }
     result.attempts = attemptIndex + 1;
+    if (fallbackFromMode) {
+      result.fallbackFromMode = fallbackFromMode;
+    }
+    const normalizedSummary = typeof result.shortSummary === "string" || typeof result.detailsMarkdown === "string" ? {
+      shortSummary: String(result.shortSummary ?? "").trim(),
+      detailsMarkdown: String(result.detailsMarkdown ?? "").trim(),
+      markdown: renderAiSummarySections(
+        String(result.shortSummary ?? "").trim(),
+        String(result.detailsMarkdown ?? "").trim()
+      )
+    } : normalizeAiSummarySections(result.markdown);
+    result = { ...result, ...normalizedSummary };
+    if (isTransientAiSummaryText(result.markdown)) {
+      const normalizedError = normalizeAiSummaryMarkdown(result.error);
+      if (normalizedError && !isTransientAiSummaryText(normalizedError)) {
+        result = {
+          ...result,
+          ...normalizeAiSummarySections(normalizedError)
+        };
+        result.status = "ok";
+        delete result.error;
+      }
+    }
     lastResult = result;
     if (!isTransientAiSummaryText(result.markdown)) {
       return result;
@@ -3015,14 +3440,23 @@ var generateAiSummary = async (input) => {
       break;
     }
     await sleep2(retryDelay);
+    if (activeInput.mode === "agent") {
+      fallbackFromMode = "agent";
+      activeInput = {
+        ...input,
+        mode: "ask",
+        agentProfileId: void 0
+      };
+    }
   }
   return {
     ...lastResult ?? {},
     enabled: true,
     status: "unavailable",
-    mode: input.mode,
-    ...input.mode === "agent" ? { agentProfileId: input.agentProfileId ?? "architecture" } : {},
+    mode: activeInput.mode,
+    ...activeInput.mode === "agent" ? { agentProfileId: activeInput.agentProfileId ?? "architecture" } : {},
     ...input.model ? { model: input.model } : {},
+    ...fallbackFromMode ? { fallbackFromMode } : {},
     attempts: lastResult?.attempts ?? retryDelays.length + 1,
     error: lastResult?.markdown || "AI summary unavailable",
     markdown: "AI summary unavailable: CloudEval AI was rate-limited. Retry the workflow or rerun `cloudeval review`."
@@ -3030,18 +3464,55 @@ var generateAiSummary = async (input) => {
 };
 var buildMarkdownSummary = (data) => {
   const gateStatus = String(data.gate?.status ?? "unknown").toUpperCase();
-  const score = data.gate?.overallScore ?? "unknown";
+  const score = data.gate?.overallScore ?? data.gate?.wellArchitected?.overall?.score;
   const cost = data.gate?.cost?.monthly;
   const validation = data.gate?.validation;
+  const architecture = data.gate?.architecture;
   const projectLabel = String(data.project?.name ?? data.projectName ?? data.projectId);
   const projectDisplay = markdownLink(projectLabel, data.project?.url ?? data.projectUrl);
   const source = data.repo ? `${data.repo}${data.ref ? ` @ ${data.ref}` : ""}` : data.ref ?? "unknown source";
   const commit = String(data.commitSha ?? "unknown").slice(0, 12);
-  const pillarLines = Array.isArray(data.gate?.wellArchitected?.pillars) ? data.gate.wellArchitected.pillars.map(
-    (pillar) => `- ${pillar.label}: ${pillar.score} - ${String(pillar.status ?? "unknown").toUpperCase()}`
-  ) : [];
+  const pillarLines = Array.isArray(data.gate?.wellArchitected?.pillars) ? data.gate.wellArchitected.pillars.map((pillar) => {
+    const rating = scoreRating(pillar.score);
+    return `| ${pillar.label} | **${formatScore(pillar.score)}** | ${scoreRatingIcon(rating)} ${rating ?? "UNKNOWN"} |`;
+  }) : [];
+  const riskLines = [
+    ["High-risk findings", data.gate?.wellArchitected?.risks?.high],
+    ["Medium-risk findings", data.gate?.wellArchitected?.risks?.medium],
+    ["Critical findings", data.gate?.wellArchitected?.risks?.critical]
+  ].filter(([, value]) => numberFrom(value) !== void 0).map(([label, value]) => `- ${label}: **${displayNumber(value)}**`);
+  const costServices = reconcileCostServiceRows(
+    costServiceRows(data.gate?.cost?.topServices, cost?.currency),
+    cost?.amount,
+    cost?.currency
+  );
+  const positiveCostServices = costServices.filter((service) => service.amount > 0);
+  const architectureLines = [
+    ["Resources", architecture?.resources],
+    ["Relationships", architecture?.relationships],
+    ["Resource types", architecture?.resourceTypes]
+  ].filter(([, value]) => numberFrom(value) !== void 0).map(([label, value]) => `- ${label}: **${displayNumber(value)}**`);
+  const density = numberFrom(architecture?.relationshipDensity);
+  if (density !== void 0) {
+    architectureLines.push(
+      `- Graph connectivity: **${trimNumber(density, 2)} relationships per resource**`
+    );
+  }
+  const resourceCount = numberFrom(architecture?.resources);
+  const resourceTypeCount = numberFrom(architecture?.resourceTypes);
+  if (resourceCount !== void 0 && resourceTypeCount !== void 0) {
+    architectureLines.push(
+      `- Resource diversity: **${displayNumber(resourceTypeCount)} types across ${displayNumber(resourceCount)} resources**`
+    );
+  }
+  const overallRating = scoreRating(score);
   const lines = [
-    `**${gateStatus}** for ${projectDisplay}: Well-Architected ${score}, cost ${formatMoney(cost?.amount, cost?.currency)}, ${compactValidation(validation)}.`,
+    `${statusIcon(data.gate?.status)} **Overall** : ${gateStatus}`,
+    `${scoreRatingIcon(overallRating)} Well-Architected Posture: ${formatScore(score)} (${overallRating ?? "UNKNOWN"})`,
+    validationSummaryLine(validation),
+    policySummaryLine(validation),
+    costSummaryLine(cost),
+    `**Cloudeval Project**: ${projectDisplay}`,
     "",
     `Source: \`${source}\` \xB7 commit \`${commit}\``
   ];
@@ -3055,38 +3526,75 @@ var buildMarkdownSummary = (data) => {
     lines.push(
       "",
       "<details>",
-      "<summary>Well-Architected details</summary>",
+      "<summary>Well-Architected drilldown</summary>",
+      "",
+      ...riskLines,
       "",
-      `- Overall score: ${score}`,
+      "| Pillar | Score | Rating |",
+      "| --- | ---: | --- |",
       ...pillarLines,
       "",
       "</details>"
     );
   }
   if (cost?.amount !== void 0 || cost?.threshold !== void 0) {
-    const costLines = [`- Monthly estimate: ${formatMoney(cost?.amount, cost?.currency)}`];
+    const costLines = [];
     if (data.gate?.cost?.estimatedSavings?.amount !== void 0) {
       costLines.push(
-        `- Estimated savings: ${formatMoney(data.gate.cost.estimatedSavings.amount, data.gate.cost.estimatedSavings.currency)}`
+        `- Estimated savings: **${formatMonthlyMoney(data.gate.cost.estimatedSavings.amount, data.gate.cost.estimatedSavings.currency)}**`
+      );
+    }
+    if (costServices.length) {
+      costLines.push(
+        "",
+        "| Service | Monthly cost |",
+        "| --- | ---: |",
+        ...costServices.map(
+          (service) => `| ${service.name} | **${formatMonthlyMoney(service.amount, service.currency)}** |`
+        )
+      );
+    }
+    if (positiveCostServices.length) {
+      costLines.push(
+        "",
+        "```mermaid",
+        "pie title Monthly cost by service",
+        ...positiveCostServices.map(
+          (service) => `  "${mermaidLabel(service.name)}" : ${trimNumber(service.amount, 3)}`
+        ),
+        "```"
       );
     }
+    if (costLines.length) {
+      lines.push(
+        "",
+        "<details>",
+        "<summary>Cost drilldown</summary>",
+        "",
+        ...costLines,
+        "",
+        "</details>"
+      );
+    }
+  }
+  if (validation) {
     lines.push(
       "",
       "<details>",
-      "<summary>Cost details</summary>",
+      "<summary>Validation details</summary>",
       "",
-      ...costLines,
+      ...validationDetailLines(validation),
       "",
       "</details>"
     );
   }
-  if (validation) {
+  if (architectureLines.length) {
     lines.push(
       "",
       "<details>",
-      "<summary>Validation details</summary>",
+      "<summary>Architecture insights</summary>",
       "",
-      `- ${formatValidation(validation)}`,
+      ...architectureLines,
       "",
       "</details>"
     );
@@ -3150,7 +3658,7 @@ var registerReviewCommand = (program2, deps) => {
           9e5
         )
       }) : void 0;
-      const [{ cost, waf, preload }, configText] = await Promise.all([
+      const [{ cost, waf, preload, graph }, configText] = await Promise.all([
         waitForReviewReports({
           baseUrl: context.baseUrl,
           token: context.token,
@@ -3188,8 +3696,8 @@ var registerReviewCommand = (program2, deps) => {
         commitSha,
         sourceRoot,
         sync: reviewSyncStatus(sync, finalStatus),
-        reports: reviewReportStatuses({ cost, waf, preload }),
-        gate: evaluateGate({ configText, waf, cost, preload, project })
+        reports: reviewReportStatuses({ cost, waf, preload, graph }),
+        gate: evaluateGate({ configText, waf, cost, preload, graph, project })
       };
       if (options.aiSummary !== false) {
         try {
@@ -4567,7 +5075,7 @@ var runChatRecipe = async (recipe, prompt2, options, command, deps) => {
   });
   progressWriter.write({ type: "auth", step: "auth", message: "Resolving authentication" });
   const context = await resolveAuthContext(options, command, deps);
-  const core = await import("./dist-MQQKC6DZ.js");
+  const core = await import("./dist-PEYJDO7A.js");
   progressWriter.write({
     type: "request",
     step: "project",
@@ -5652,21 +6160,36 @@ var readWorkspaceConfig = (content) => {
   };
 };
 var generateWorkspaceConfig = (entry, parameters, sourceEntry) => {
-  const parameterLine = parameters ? `    parameters: ${parameters}
-` : "";
+  const parameterLine = parameters ? `    parameters: ${parameters}` : "";
   const sourceEntryLine = sourceEntry ? `    source_entry: ${sourceEntry}` : "";
   return [
+    "# CloudEval config v1. Paths are relative to this workspace root.",
+    "# Visualization source for diagrams and reports.",
     "version: 1",
     "stacks:",
-    "  - id: main",
+    "  - id: primary-architecture",
+    "    name: Primary architecture",
     `    entry: ${entry}`,
     sourceEntryLine,
-    parameterLine.trimEnd(),
+    parameterLine,
     "resolve:",
+    "  # Follow relative ARM templateLink files when building the analysis bundle.",
     "  linked_templates: true",
     "analysis:",
+    "  # Run the normal import -> resolve -> report refresh pipeline after upload.",
     "  auto_resolve_on_import: true",
     "  auto_refresh_on_resolve: true",
+    "",
+    "# Optional CI gates for `cloudeval review` and GitHub Actions.",
+    "# Uncomment and tune these when pull requests should be blocked by CloudEval.",
+    "# ci:",
+    "#   gates:",
+    "#     enforcement: block_pull_request",
+    "#     minimum_well_architected_score: 80",
+    "#     minimum_pillar_score: 75",
+    "#     fail_when_high_risk_findings_exist: true",
+    "#     fail_when_validation_fails: true",
+    "#     max_monthly_cost_usd: 500",
     ""
   ].filter((line) => line.length > 0).join("\n");
 };
@@ -6036,7 +6559,7 @@ var configureDiagramExportCommand = (command, deps) => addAuthOptions(command, d
       const context = requireAuthUser(
         await resolveAuthContext(options, actionCommand, deps)
       );
-      const core = await import("./dist-MQQKC6DZ.js");
+      const core = await import("./dist-PEYJDO7A.js");
       const projects = await core.getProjects(
         context.baseUrl,
         context.token,
@@ -6113,7 +6636,7 @@ var registerProjectsCommand = (program2, deps) => {
   addCommon(addAuthOptions(projects.command("list").description("List projects"), deps.defaultBaseUrl)).action(async (options, command) => {
     try {
       const context = await resolveAuthContext(options, command, deps);
-      const core = await import("./dist-MQQKC6DZ.js");
+      const core = await import("./dist-PEYJDO7A.js");
       const data = await listProjectsForContext(core, context);
       const url = buildFrontendUrl({ baseUrl: frontendBase(context, options), target: "projects" });
       await writeProjectListOutput({ data, options, frontendUrl: url });
@@ -6131,7 +6654,7 @@ var registerProjectsCommand = (program2, deps) => {
   ).action(async (id, options, command) => {
     try {
       const context = await resolveAuthContext(options, command, deps);
-      const core = await import("./dist-MQQKC6DZ.js");
+      const core = await import("./dist-PEYJDO7A.js");
       const list = await listProjectsForContext(core, context);
       const data = list.find((project) => project.id === id);
       if (!data) {
@@ -6196,7 +6719,7 @@ var registerProjectsCommand = (program2, deps) => {
     try {
       assertSingleProjectSource(options);
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-      const core = await import("./dist-MQQKC6DZ.js");
+      const core = await import("./dist-PEYJDO7A.js");
       const template = await fileBlob(options.templateFile);
       const parameters = await fileBlob(options.parametersFile);
       const workspace = options.workspaceDir ? await collectWorkspaceFiles(options.workspaceDir, options) : void 0;
@@ -6325,7 +6848,7 @@ var registerConnectionsCommand = (program2, deps) => {
   addCommon2(addAuthOptions(connections.command("list").description("List connections"), deps.defaultBaseUrl)).action(async (options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-      const core = await import("./dist-MQQKC6DZ.js");
+      const core = await import("./dist-PEYJDO7A.js");
       const data = await core.listConnections({
         baseUrl: context.baseUrl,
         authToken: context.token,
@@ -6350,7 +6873,7 @@ var registerConnectionsCommand = (program2, deps) => {
   ).action(async (id, options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-      const core = await import("./dist-MQQKC6DZ.js");
+      const core = await import("./dist-PEYJDO7A.js");
       const data = await core.getConnection({
         baseUrl: context.baseUrl,
         authToken: context.token,
@@ -6688,7 +7211,7 @@ var checkoutReturnUrl = (context, options) => options.returnTo || billingUrl(con
 var runTopUpCheckout = async (commandName, packId, options, command, deps) => {
   try {
     const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-    const core = await import("./dist-MQQKC6DZ.js");
+    const core = await import("./dist-PEYJDO7A.js");
     const returnTo = checkoutReturnUrl(context, options);
     const session = await core.createTopUpCheckoutSession({
       baseUrl: context.baseUrl,
@@ -6728,7 +7251,7 @@ var registerBillingCommands = (program2, deps) => {
   ).action(async (options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-      const core = await import("./dist-MQQKC6DZ.js");
+      const core = await import("./dist-PEYJDO7A.js");
       const range = rangeToDates("30d");
       const [entitlement, usageSummary] = await Promise.all([
         core.getBillingEntitlement({
@@ -6758,7 +7281,7 @@ var registerBillingCommands = (program2, deps) => {
   addCommon3(addAuthOptions(billing.command("summary").description("Show billing summary"), deps.defaultBaseUrl)).action(async (options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-      const core = await import("./dist-MQQKC6DZ.js");
+      const core = await import("./dist-PEYJDO7A.js");
       const range = rangeToDates("30d");
       const [entitlement, subscriptionStatus, usageSummary] = await Promise.all([
         core.getBillingEntitlement({ baseUrl: context.baseUrl, authToken: context.token }),
@@ -6794,7 +7317,7 @@ var registerBillingCommands = (program2, deps) => {
   addCommon3(addAuthOptions(billing.command("plans").description("Show billing plans"), deps.defaultBaseUrl)).action(async (options, command) => {
     try {
       const context = await resolveAuthContext(options, command, deps);
-      const core = await import("./dist-MQQKC6DZ.js");
+      const core = await import("./dist-PEYJDO7A.js");
       const data = await core.getBillingConfig({ baseUrl: context.baseUrl, authToken: context.token });
       const url = billingUrl(context, { ...options, tab: "plans" });
       await write("billing plans", data, options, url);
@@ -6806,7 +7329,7 @@ var registerBillingCommands = (program2, deps) => {
   addCommon3(addAuthOptions(billing.command("usage").description("Show billing usage summary"), deps.defaultBaseUrl)).option("--range <range>", "Usage range: 7d, 30d, 90d, all", "30d").option("--start-at <iso>", "Start timestamp").option("--end-at <iso>", "End timestamp").option("--granularity <value>", "Granularity: hour, day, month", "day").option("--action-type <type>", "Action type filter").option("--model <name>", "Model filter").option("--outcome <outcome>", "Outcome filter").option("--charge-status <status>", "Charge status filter").action(async (options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-      const core = await import("./dist-MQQKC6DZ.js");
+      const core = await import("./dist-PEYJDO7A.js");
       const range = rangeToDates(options.range);
       const data = await core.getBillingUsageSummary({
         baseUrl: context.baseUrl,
@@ -6829,7 +7352,7 @@ var registerBillingCommands = (program2, deps) => {
   addCommon3(addAuthOptions(billing.command("ledger").description("Show billing ledger"), deps.defaultBaseUrl)).option("--range <range>", "Usage range: 7d, 30d, 90d, all", "30d").option("--start-at <iso>", "Start timestamp").option("--end-at <iso>", "End timestamp").option("--action-type <type>", "Action type filter").option("--model <name>", "Model filter").option("--outcome <outcome>", "Outcome filter").option("--charge-status <status>", "Charge status filter").option("--limit <n>", "Page size", "25").option("--cursor <cursor>", "Pagination cursor").action(async (options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-      const core = await import("./dist-MQQKC6DZ.js");
+      const core = await import("./dist-PEYJDO7A.js");
       const range = rangeToDates(options.range);
       const data = await core.getBillingUsageLedger({
         baseUrl: context.baseUrl,
@@ -6857,7 +7380,7 @@ var registerBillingCommands = (program2, deps) => {
     addCommon3(addAuthOptions(billing.command(name).description(`Show billing ${name}`), deps.defaultBaseUrl)).option("--limit <n>", "Result limit", "25").action(async (options, command) => {
       try {
         const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-        const core = await import("./dist-MQQKC6DZ.js");
+        const core = await import("./dist-PEYJDO7A.js");
         const data = await core[getter]({
           baseUrl: context.baseUrl,
           authToken: context.token,
@@ -6875,7 +7398,7 @@ var registerBillingCommands = (program2, deps) => {
   addCommon3(addAuthOptions(topups, deps.defaultBaseUrl)).option("--limit <n>", "Result limit", "25").action(async (options, command) => {
     try {
       const context = requireAuthUser(await resolveAuthContext(options, command, deps));
-      const core = await import("./dist-MQQKC6DZ.js");
+      const core = await import("./dist-PEYJDO7A.js");
       const data = await core.getTopUpPacks({
         baseUrl: context.baseUrl,
         authToken: context.token
@@ -7404,12 +7927,13 @@ var getRule = async (input) => fetchCloudEvalJson({
 
 // src/telemetry.ts
 import os3 from "os";
+import { createHash } from "crypto";
 
 // src/telemetryConnectionString.generated.ts
 var PACKAGED_APPLICATIONINSIGHTS_CONNECTION_STRING = "InstrumentationKey=ca7b6ae2-ce35-4e67-8756-439ebe2da618;IngestionEndpoint=https://westeurope-5.in.applicationinsights.azure.com/;LiveEndpoint=https://westeurope.livediagnostics.monitor.azure.com/;ApplicationId=28327903-cb61-4210-bed7-d4d8f9f65cfe";
 
 // src/telemetry.ts
-var TELEMETRY_SCHEMA_VERSION = "1";
+var TELEMETRY_SCHEMA_VERSION = "2";
 var TRUE_VALUES = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
 var FALSE_VALUES = /* @__PURE__ */ new Set(["0", "false", "no", "off"]);
 var PROPERTY_ALLOWLIST = /* @__PURE__ */ new Set([
@@ -7421,23 +7945,20 @@ var PROPERTY_ALLOWLIST = /* @__PURE__ */ new Set([
   "command",
   "completionShell",
   "completions",
-  "email",
   "errorCategory",
   "exitCode",
-  "firstName",
   "format",
-  "fullName",
   "installSource",
   "installerResult",
   "installerType",
   "interactive",
-  "lastName",
   "mcpSetup",
   "nodeVersion",
   "os",
   "osVersionMajor",
   "previousCliVersion",
   "requestedVersion",
+  "requestId",
   "resolvedVersion",
   "runtime",
   "subcommand",
@@ -7447,8 +7968,10 @@ var PROPERTY_ALLOWLIST = /* @__PURE__ */ new Set([
   "toolName",
   "toolset",
   "targetCliVersion",
+  "traceId",
   "tuiInitialTab",
-  "updateAction"
+  "updateAction",
+  "user_hash"
 ]);
 var MEASUREMENT_ALLOWLIST = /* @__PURE__ */ new Set(["durationMs"]);
 var trimString = (value) => {
@@ -7516,16 +8039,12 @@ var buildTelemetryUserProperties = (user) => {
   if (!user || typeof user !== "object") {
     return {};
   }
-  const email = trimString(user.email);
-  const fullName = trimString(user.fullName) || trimString(user.full_name) || trimString(user.name);
-  const firstName = trimString(user.firstName);
-  const lastName = trimString(user.lastName);
-  const nameParts = fullName?.split(/\s+/).filter(Boolean) || [];
+  const internalId = trimString(user.id) || trimString(user.userId) || trimString(user.user_id) || trimString(user.accountId) || trimString(user.account_id);
+  if (!internalId) {
+    return {};
+  }
   return {
-    ...email ? { email } : {},
-    ...firstName || nameParts[0] ? { firstName: firstName || nameParts[0] } : {},
-    ...lastName || nameParts.length > 1 ? { lastName: lastName || nameParts[nameParts.length - 1] } : {},
-    ...fullName ? { fullName } : {}
+    user_hash: `h_${createHash("sha256").update("cloudeval-cli:user:").update(internalId).digest("hex").slice(0, 32)}`
   };
 };
 var classifyTelemetryError = (error) => {
@@ -7585,6 +8104,16 @@ var createApplicationInsightsClient = async (connectionString) => {
   disableDiskRetryCaching(client);
   return client;
 };
+var setTelemetryClientRole = (client) => {
+  try {
+    const context = client.context;
+    const cloudRoleKey = context?.keys?.cloudRole;
+    if (cloudRoleKey && context?.tags) {
+      context.tags[cloudRoleKey] = "cloudeval-cli";
+    }
+  } catch {
+  }
+};
 var disableDiskRetryCaching = (client) => {
   try {
     client.setUseDiskRetryCaching?.(false);
@@ -7641,6 +8170,7 @@ var createCliTelemetry = async (options) => {
   let client;
   try {
     client = options.clientFactory ? options.clientFactory(connectionString) : await createApplicationInsightsClient(connectionString);
+    setTelemetryClientRole(client);
   } catch {
     return createNoopTelemetry();
   }
@@ -9546,7 +10076,7 @@ var reportsFrontendUrl = (config, input) => buildFrontendUrl({
   reportVerbosity: input.reportVerbosity
 });
 var resolveAuth = async (config, options = {}) => {
-  const core = await import("./dist-MQQKC6DZ.js");
+  const core = await import("./dist-PEYJDO7A.js");
   core.assertSecureBaseUrl(config.baseUrl);
   let token;
   try {
@@ -9642,7 +10172,7 @@ var assertModelAvailable = async (config, token) => {
   if (!config.model) {
     return;
   }
-  const core = await import("./dist-MQQKC6DZ.js");
+  const core = await import("./dist-PEYJDO7A.js");
   try {
     const response = await fetch(
       `${core.normalizeApiBase(config.baseUrl)}/models`,
@@ -9899,7 +10429,7 @@ var buildToolHandlers = (serverOptions) => {
   });
   handlers.set("agent_profiles_list", async (args) => {
     const config = await resolveInvocationConfig(serverOptions, args);
-    const core = await import("./dist-MQQKC6DZ.js");
+    const core = await import("./dist-PEYJDO7A.js");
     const data = await listProfilesForDiscovery(core, config.baseUrl);
     return withEnvelope({
       command: "agents list",
@@ -9912,7 +10442,7 @@ var buildToolHandlers = (serverOptions) => {
       throw new Error("profileId is required.");
     }
     const config = await resolveInvocationConfig(serverOptions, args);
-    const core = await import("./dist-MQQKC6DZ.js");
+    const core = await import("./dist-PEYJDO7A.js");
     const data = await getProfileForDiscovery(core, config.baseUrl, profileId);
     return withEnvelope({
       command: "agents show",
@@ -10549,7 +11079,7 @@ var buildToolHandlers = (serverOptions) => {
   });
   handlers.set("auth_status", async (args) => {
     const config = await resolveInvocationConfig(serverOptions, args);
-    const core = await import("./dist-MQQKC6DZ.js");
+    const core = await import("./dist-PEYJDO7A.js");
     const data = await core.getAuthStatus(config.baseUrl, { validate: true });
     return withEnvelope({
       command: "auth status",
@@ -10558,7 +11088,7 @@ var buildToolHandlers = (serverOptions) => {
   });
   handlers.set("status", async (args) => {
     const config = await resolveInvocationConfig(serverOptions, args);
-    const core = await import("./dist-MQQKC6DZ.js");
+    const core = await import("./dist-PEYJDO7A.js");
     const auth = await core.getAuthStatus(config.baseUrl, { validate: true });
     return withEnvelope({
       command: "status",
@@ -10589,7 +11119,7 @@ var buildToolHandlers = (serverOptions) => {
       }
     ];
     try {
-      const core = await import("./dist-MQQKC6DZ.js");
+      const core = await import("./dist-PEYJDO7A.js");
       core.assertSecureBaseUrl(config.baseUrl);
       checks.push({
         id: "base-url-secure",
@@ -11109,7 +11639,7 @@ var buildToolHandlers = (serverOptions) => {
     } catch {
       token = config.accessKey;
     }
-    const core = await import("./dist-MQQKC6DZ.js");
+    const core = await import("./dist-PEYJDO7A.js");
     const data = await core.getBillingConfig({
       baseUrl: config.baseUrl,
       authToken: token
@@ -11963,7 +12493,7 @@ var registerCapabilitiesCommand = (program2, deps) => {
     warnIfAccessKeyFromCliOption(options, command);
     let data = capabilities;
     if (options.live) {
-      const core = await import("./dist-MQQKC6DZ.js");
+      const core = await import("./dist-PEYJDO7A.js");
       const baseUrl = await deps.resolveBaseUrl(options, command);
       const accessKey = options.accessKeyStdin ? await deps.readStdinValue() : options.accessKey;
       const token = await core.getAuthToken({ accessKey, baseUrl });
@@ -12101,7 +12631,7 @@ var writeCredentialOutput = async (input) => {
 };
 var resolveCoreAuth = async (options, command, deps) => {
   const context = await resolveAuthContext(options, command, deps);
-  const core = await import("./dist-MQQKC6DZ.js");
+  const core = await import("./dist-PEYJDO7A.js");
   return { ...context, core };
 };
 var parseCapabilities = (value) => value?.split(",").map((item) => item.trim()).filter(Boolean);
@@ -12418,7 +12948,7 @@ var registerAgentsCommand = (program2, deps) => {
   const agents = program2.command("agents").description("CloudEval Agent Profile utilities");
   addAgentOutputOptions(agents.command("list").description("List Agent Profiles"), deps).action(async (options, command) => {
     const baseUrl = await deps.resolveBaseUrl(options, command);
-    const core = await import("./dist-MQQKC6DZ.js");
+    const core = await import("./dist-PEYJDO7A.js");
     core.assertSecureBaseUrl(baseUrl);
     const data = await listProfilesForDiscovery2(core, baseUrl);
     await writeProfiles({
@@ -12434,7 +12964,7 @@ var registerAgentsCommand = (program2, deps) => {
     deps
   ).action(async (profileId, options, command) => {
     const baseUrl = await deps.resolveBaseUrl(options, command);
-    const core = await import("./dist-MQQKC6DZ.js");
+    const core = await import("./dist-PEYJDO7A.js");
     core.assertSecureBaseUrl(baseUrl);
     const data = await getProfileForDiscovery2(core, baseUrl, profileId);
     await writeProfiles({
@@ -12453,7 +12983,7 @@ var registerAgentsCommand = (program2, deps) => {
       const cliProfile = getActiveConfigProfile(command);
       const cliConfig = await loadCliConfig(cliProfile);
       const auth = await resolveAuthContext(options, command, deps);
-      const core = await import("./dist-MQQKC6DZ.js");
+      const core = await import("./dist-PEYJDO7A.js");
       const profileResponse = await core.getAgentProfile({
         baseUrl: auth.baseUrl,
         authToken: auth.token,
@@ -12951,7 +13481,7 @@ var registerDiagnosticsCommands = (program2, deps) => {
     const baseUrl = await deps.resolveBaseUrl(options, command);
     const profile = getActiveConfigProfile(command);
     const config = await loadCliConfig(profile);
-    const core = await import("./dist-MQQKC6DZ.js");
+    const core = await import("./dist-PEYJDO7A.js");
     const auth = await core.getAuthStatus(baseUrl, { validate: true });
     if (options.format === "text" || !options.format) {
       process.stdout.write(
@@ -13001,7 +13531,7 @@ var registerDiagnosticsCommands = (program2, deps) => {
       detail: getCliConfigPath(profile)
     });
     try {
-      const core = await import("./dist-MQQKC6DZ.js");
+      const core = await import("./dist-PEYJDO7A.js");
       core.assertSecureBaseUrl(baseUrl);
       checks.push({
         id: "base-url-secure",
@@ -13101,7 +13631,7 @@ var resolveToken2 = async (options, deps, baseUrl, command) => {
     return options.accessKey;
   }
   try {
-    const core = await import("./dist-MQQKC6DZ.js");
+    const core = await import("./dist-PEYJDO7A.js");
     return await core.getAuthToken({
       baseUrl
     });
@@ -13185,7 +13715,7 @@ var registerModelsCommand = (program2, deps) => {
     let source = "fallback";
     let modelList = fallbackModels;
     try {
-      const core = await import("./dist-MQQKC6DZ.js");
+      const core = await import("./dist-PEYJDO7A.js");
       const response = await fetch(`${core.normalizeApiBase(baseUrl)}/models`, {
         headers: {
           Accept: "application/json",
@@ -14364,7 +14894,7 @@ var uninstallCompletionScript = async (shell) => {
 var runInteractiveLoginOnboarding = async (baseUrl, token) => {
   const [{ render }, { Onboarding }] = await Promise.all([
     import("ink"),
-    import("./Onboarding-CORIICF5.js")
+    import("./Onboarding-GAN3Q5TS.js")
   ]);
   await new Promise((resolve) => {
     let app;
@@ -14630,7 +15160,13 @@ var getActiveCliTelemetry = () => activeTelemetry;
 var initializeCommandTelemetry = async (actionCommand, options) => {
   activeTelemetryStartedAt = Date.now();
   activeTelemetryFinished = false;
-  activeTelemetryProperties = telemetryPropertiesForCommand(actionCommand, options);
+  const traceContext = createCLITraceContext();
+  setActiveCLITraceContext(traceContext);
+  activeTelemetryProperties = {
+    ...telemetryPropertiesForCommand(actionCommand, options),
+    traceId: traceContext.traceId,
+    requestId: traceContext.requestId
+  };
   const config = await resolveCliConfig(actionCommand);
   activeTelemetry = await createCliTelemetry({
     config,
@@ -14639,27 +15175,33 @@ var initializeCommandTelemetry = async (actionCommand, options) => {
 };
 var finishCommandTelemetry = async (exitCode, error) => {
   if (!activeTelemetry || activeTelemetryFinished) {
+    clearActiveCLITraceContext();
     return;
   }
   activeTelemetryFinished = true;
   const durationMs = Math.max(0, Date.now() - activeTelemetryStartedAt);
-  if (error) {
-    await activeTelemetry.track("cli.error", {
+  try {
+    if (error) {
+      await activeTelemetry.track("cli.error", {
+        ...activeTelemetryProperties,
+        durationMs,
+        exitCode,
+        success: false,
+        errorCategory: classifyTelemetryError(error)
+      });
+    }
+    await activeTelemetry.track("cli.command", {
       ...activeTelemetryProperties,
       durationMs,
       exitCode,
-      success: false,
-      errorCategory: classifyTelemetryError(error)
+      success: exitCode === 0,
+      ...error ? { errorCategory: classifyTelemetryError(error) } : {}
     });
+    await activeTelemetry.flush();
+  } finally {
+    clearActiveCLITraceContext();
+    activeTelemetry = void 0;
   }
-  await activeTelemetry.track("cli.command", {
-    ...activeTelemetryProperties,
-    durationMs,
-    exitCode,
-    success: exitCode === 0,
-    ...error ? { errorCategory: classifyTelemetryError(error) } : {}
-  });
-  await activeTelemetry.flush();
 };
 var exitCli = async (exitCode, error) => {
   await finishCommandTelemetry(exitCode, error);
@@ -14686,7 +15228,7 @@ var resolveBaseUrl = async (options, command) => {
     });
   }
   try {
-    const { getAuthStatus } = await import("./dist-MQQKC6DZ.js");
+    const { getAuthStatus } = await import("./dist-PEYJDO7A.js");
     const status = await getAuthStatus();
     const storedBaseUrl = status.baseUrl;
     if (storedBaseUrl && shouldUseStoredBaseUrl(storedBaseUrl)) {
@@ -14760,7 +15302,7 @@ program.command("login").description("Authenticate with Cloudeval").option(
       checkUserStatus,
       ensurePlaygroundProject,
       login
-    } = await import("./dist-MQQKC6DZ.js");
+    } = await import("./dist-PEYJDO7A.js");
     assertSecureBaseUrl(options.baseUrl);
     const headlessEnvironment = isHeadlessEnvironment();
     const headlessLogin = options.headless || headlessEnvironment;
@@ -14835,7 +15377,7 @@ program.command("logout").description("Log out and clear stored authentication s
   DEFAULT_BASE_URL
 ).option("--all-devices", "Revoke sessions on all devices", false).action(async (options) => {
   try {
-    const { assertSecureBaseUrl, logout } = await import("./dist-MQQKC6DZ.js");
+    const { assertSecureBaseUrl, logout } = await import("./dist-PEYJDO7A.js");
     assertSecureBaseUrl(options.baseUrl);
     const result = await logout({
       baseUrl: options.baseUrl,
@@ -14869,7 +15411,7 @@ authCommand.command("status").description("Show current authentication status").
   DEFAULT_BASE_URL
 ).option("--format <format>", "Output format: text, json, ndjson, markdown", "text").option("--show-sensitive-ids", "Show full account/session identifiers in command output", false).option("-v, --verbose", "Enable verbose logging and show full non-token identifiers", false).action(async (options, command) => {
   try {
-    const { assertSecureBaseUrl, getAuthStatus } = await import("./dist-MQQKC6DZ.js");
+    const { assertSecureBaseUrl, getAuthStatus } = await import("./dist-PEYJDO7A.js");
     const effectiveBaseUrl = await resolveBaseUrl(options, command);
     assertSecureBaseUrl(effectiveBaseUrl);
     const status = await getAuthStatus(effectiveBaseUrl, { validate: true });
@@ -15086,10 +15628,10 @@ program.command("tui").description("Open the CloudEval Terminal UI").option(
   "Access key for automation",
   process.env.CLOUDEVAL_ACCESS_KEY
 ).option("--access-key-stdin", "Read access key from stdin (recommended for automation)", false).option("--model <name>", "Model name").option("--debug", "Log raw chunks", false).option("--health-check", "Enable health check (disabled by default)").option("--no-banner", "Disable ASCII banner").option("--animate", "Enable TUI animations (default)").option("--no-anim", "Disable TUI animations").option("-v, --verbose", "Enable verbose logging", false).action(async (options, command) => {
-  const { assertSecureBaseUrl } = await import("./dist-MQQKC6DZ.js");
+  const { assertSecureBaseUrl } = await import("./dist-PEYJDO7A.js");
   const [{ render }, { App }] = await Promise.all([
     import("ink"),
-    import("./App-VZXTX4H7.js")
+    import("./App-GQMIIL3U.js")
   ]);
   const baseUrl = await resolveBaseUrl(options, command);
   assertSecureBaseUrl(baseUrl);
@@ -15144,10 +15686,10 @@ program.command("chat").description("Start an interactive chat session").option(
   "Access key for automation",
   process.env.CLOUDEVAL_ACCESS_KEY
 ).option("--access-key-stdin", "Read access key from stdin (recommended for automation)", false).option("--conversation <id>", "Conversation/thread id to resume").option("--continue", "Resume the most recent local chat session", false).option("--resume <id-or-title>", "Resume a local chat session by thread id or title").option("--model <name>", "Model name").option("--mode <mode>", "Initial chat mode: ask, agent").option("--debug", "Log raw chunks", false).option("--health-check", "Enable health check (disabled by default)").option("--no-banner", "Disable ASCII banner").option("--animate", "Enable TUI animations (default)").option("--no-anim", "Disable TUI animations").option("-v, --verbose", "Enable verbose logging", false).action(async (options, command) => {
-  const { assertSecureBaseUrl } = await import("./dist-MQQKC6DZ.js");
+  const { assertSecureBaseUrl } = await import("./dist-PEYJDO7A.js");
   const [{ render }, { App }] = await Promise.all([
     import("ink"),
-    import("./App-VZXTX4H7.js")
+    import("./App-GQMIIL3U.js")
   ]);
   const baseUrl = await resolveBaseUrl(options, command);
   assertSecureBaseUrl(baseUrl);
@@ -15222,7 +15764,7 @@ program.command("ask").alias("agent").description("Ask a single question or run
   const question = Array.isArray(questionParts) ? questionParts.join(" ") : String(questionParts);
   const commandName = command.parent?.args?.[0] === "agent" ? "agent" : "ask";
   const selectedMode = commandName === "agent" ? "agent" : "ask";
-  const { assertSecureBaseUrl } = await import("./dist-MQQKC6DZ.js");
+  const { assertSecureBaseUrl } = await import("./dist-PEYJDO7A.js");
   const baseUrl = await resolveBaseUrl(options, command);
   assertSecureBaseUrl(baseUrl);
   const selectedProfile = getActiveConfigProfile(command);
@@ -15263,7 +15805,7 @@ program.command("ask").alias("agent").description("Ask a single question or run
     const fs14 = await import("fs");
     const fsPromises = await import("fs/promises");
     const { randomUUID: randomUUID5 } = await import("crypto");
-    const core = await import("./dist-MQQKC6DZ.js");
+    const core = await import("./dist-PEYJDO7A.js");
     const {
       streamChat,
       reduceChunk,
@@ -15319,7 +15861,7 @@ program.command("ask").alias("agent").description("Ask a single question or run
             console.error("Authentication required. Starting login process...\n");
           }
           try {
-            const { login } = await import("./dist-MQQKC6DZ.js");
+            const { login } = await import("./dist-PEYJDO7A.js");
             verboseLog("Calling interactive login", { baseUrl });
             token = await login(baseUrl, {
               headless: isHeadlessEnvironment()
@@ -15383,7 +15925,7 @@ program.command("ask").alias("agent").description("Ask a single question or run
         message: error.message
       });
     }
-    const { resolveAskProject } = await import("./resolveAskProject-KQKI5GRT.js");
+    const { resolveAskProject } = await import("./resolveAskProject-DQJXPS5G.js");
     let project;
     try {
       project = await resolveAskProject({
@@ -15901,7 +16443,7 @@ Error: ${errorMsg}
 program.command("banner").description("Preview the startup banner and terminal capabilities").action(async () => {
   const { render } = await import("ink");
   const BannerPreview = React.lazy(async () => ({
-    default: (await import("./Banner-URKZ37H4.js")).Banner
+    default: (await import("./Banner-J2ESX3JN.js")).Banner
   }));
   render(
     /* @__PURE__ */ jsx(React.Suspense, { fallback: null, children: /* @__PURE__ */ jsx(BannerPreview, { disable: false }) })