@get-dx/cli 0.8.0 → 0.10.0

package/dist/commands/snapshots.js

@@ -1,9 +1,10 @@
 import { Command } from "commander";
-import { createExampleText, getContext, parsePositiveIntOption, wrapAction, } from "../commandHelpers.js";
+import { createExampleText, getContext, parseCommaSeparatedValues, parsePositiveIntOption, wrapAction, } from "../commandHelpers.js";
 import { CliError, EXIT_CODES } from "../errors.js";
 import { request } from "../http.js";
 import { renderJson, renderRichText } from "../renderers.js";
 import { buildRuntime } from "../runtime.js";
+import { formatTeamMember } from "./teams.js";
 import * as ui from "../ui.js";
 export function snapshotsCommand() {
     const snapshots = new Command()
@@ -135,6 +136,89 @@ export function snapshotsCommand() {
             renderSnapshots(response.snapshots, runtime);
         }
     }));
+    const snapshotTeams = new Command()
+        .name("snapshotTeams")
+        .description("Work with snapshot teams");
+    snapshotTeams
+        .command("list")
+        .description("List teams for a snapshot")
+        .option("--id <id>", "The unique ID of the snapshot")
+        .addHelpText("afterAll", createExampleText([
+        {
+            label: "List teams for a snapshot",
+            command: "dx snapshots snapshotTeams list --id MjUyNbaY",
+        },
+        {
+            label: "List snapshot teams as JSON",
+            command: "dx --json snapshots snapshotTeams list --id MjUyNbaY",
+        },
+    ]))
+        .action(wrapAction(async (options, command) => {
+        const snapshotId = parseRequiredTextOption(options.id, "--id");
+        const runtime = await buildRuntime(getContext(command));
+        const response = await listSnapshotTeams(runtime, snapshotId);
+        if (runtime.context.json) {
+            renderJson(response);
+        }
+        else {
+            renderSnapshotTeams(response.snapshot_teams, snapshotId, runtime);
+        }
+    }));
+    snapshots.addCommand(snapshotTeams);
+    const workflowScores = new Command()
+        .name("workflowScores")
+        .description("Work with snapshot workflow scores");
+    workflowScores
+        .command("list")
+        .description("List workflow scores and details for a snapshot")
+        .option("--id <id>", "The unique ID of the snapshot")
+        .option("--team-ids <ids>", "Comma-separated team IDs")
+        .option("--snapshot-team-ids <ids>", "Comma-separated snapshot team IDs")
+        .option("--group-ids <ids>", "Comma-separated group IDs")
+        .option("--branch-ids <ids>", "Comma-separated branch IDs")
+        .option("--attribute-ids <ids>", "Comma-separated attribute IDs")
+        .addHelpText("afterAll", createExampleText([
+        {
+            label: "List workflow scores for a snapshot",
+            command: "dx snapshots workflowScores list --id MjUyNbaY",
+        },
+        {
+            label: "List snapshot workflow scores as JSON",
+            command: "dx --json snapshots workflowScores list --id MjUyNbaY",
+        },
+        {
+            label: "Filter workflow scores by team IDs",
+            command: "dx snapshots workflowScores list --id MjUyNbaY --team-ids MTExNDg5,MTExNDg4",
+        },
+        {
+            label: "Filter workflow scores by snapshot team IDs",
+            command: "dx snapshots workflowScores list --id MjUyNbaY --snapshot-team-ids NTcxMDM",
+        },
+        {
+            label: "Filter workflow scores by group IDs",
+            command: "dx snapshots workflowScores list --id MjUyNbaY --group-ids MzYyMjM",
+        },
+        {
+            label: "Filter workflow scores by attribute IDs",
+            command: "dx snapshots workflowScores list --id MjUyNbaY --attribute-ids NzI4OA",
+        },
+        {
+            label: "Filter workflow scores by branch IDs",
+            command: "dx snapshots workflowScores list --id MjUyNbaY --branch-ids MQ",
+        },
+    ]))
+        .action(wrapAction(async (options, command) => {
+        const snapshotId = parseRequiredTextOption(options.id, "--id");
+        const runtime = await buildRuntime(getContext(command));
+        const response = await listSnapshotWorkflowScores(runtime, snapshotId, options);
+        if (runtime.context.json) {
+            renderJson(response);
+        }
+        else {
+            renderSnapshotWorkflowScores(response, snapshotId, options, runtime);
+        }
+    }));
+    snapshots.addCommand(workflowScores);
     return snapshots;
 }
 async function listSnapshotDriverComments(runtime, options) {
@@ -159,6 +243,64 @@ async function listSnapshotCsatComments(runtime, options) {
     });
     return response.body;
 }
+async function listSnapshotTeams(runtime, snapshotId) {
+    const response = await request(runtime, "/snapshots.snapshotTeams.list", {
+        method: "GET",
+        query: { snapshot_id: snapshotId },
+    });
+    return response.body;
+}
+async function listSnapshotWorkflowScores(runtime, snapshotId, options) {
+    const response = await request(runtime, "/snapshots.workflowScores.list", {
+        method: "GET",
+        query: {
+            snapshot_id: snapshotId,
+            ...snapshotFilterQuery(options, "apiKey"),
+        },
+    });
+    return response.body;
+}
+// The web app names some filter params differently from the API. Attributes
+// have no webKey because the web app only accepts decoded tag IDs.
+const SNAPSHOT_FILTER_KEYS = [
+    { option: "teamIds", apiKey: "team_ids", webKey: "team_ids" },
+    {
+        option: "snapshotTeamIds",
+        apiKey: "snapshot_team_ids",
+        webKey: "snapshot_team_ids",
+    },
+    { option: "groupIds", apiKey: "group_ids", webKey: "group_ids" },
+    { option: "branchIds", apiKey: "branch_ids", webKey: "branch" },
+    { option: "attributeIds", apiKey: "attribute_ids" },
+];
+// The web app can't combine groups with snapshot teams (selecting a group
+// clears snapshot teams) and only selects one branch at a time, so drop those
+// filters from the link and report which ones were left out
+function snapshotWebFilters(options) {
+    const webOptions = { ...options };
+    const omittedFlags = [];
+    if (parseCommaSeparatedValues(options.groupIds) &&
+        parseCommaSeparatedValues(options.snapshotTeamIds)) {
+        webOptions.snapshotTeamIds = undefined;
+        omittedFlags.push("--snapshot-team-ids");
+    }
+    if ((parseCommaSeparatedValues(options.branchIds)?.length ?? 0) > 1) {
+        webOptions.branchIds = undefined;
+        omittedFlags.push("--branch-ids");
+    }
+    if (parseCommaSeparatedValues(options.attributeIds)) {
+        omittedFlags.push("--attribute-ids");
+    }
+    return { query: snapshotFilterQuery(webOptions, "webKey"), omittedFlags };
+}
+function snapshotFilterQuery(options, target) {
+    return Object.fromEntries(SNAPSHOT_FILTER_KEYS.flatMap((keys) => {
+        const key = keys[target];
+        return key
+            ? [[key, parseCommaSeparatedValues(options[keys.option])?.join(",")]]
+            : [];
+    }));
+}
 async function getSnapshotInfo(runtime, snapshotId) {
     const response = await request(runtime, "/snapshots.info", {
         method: "GET",
@@ -237,6 +379,22 @@ function renderSnapshotCsatComments(comments, nextCursor, snapshotId, runtime) {
     }
     renderRichText(blocks);
 }
+function renderSnapshotTeams(teams, snapshotId, runtime) {
+    const blocks = [ui.h1("Snapshot Teams")];
+    blocks.push(ui.p(`Displaying ${ui.bold(teams.length.toString())} teams.`));
+    blocks.push(ui.p(`Snapshot Team IDs are only valid within this snapshot and feed ${ui.code("snapshot_team_ids")} score filters. Use ${ui.code("team_id")} with ${ui.code("dx teams info --team-id")}.`));
+    blocks.push(ui.p(ui.link(snapshotWebLink(snapshotId, "drivers", runtime))));
+    if (teams.length === 0) {
+        blocks.push(ui.p(ui.dim("(None)")));
+        renderRichText(blocks);
+        return;
+    }
+    const rootTeams = buildSnapshotTeamTree(teams);
+    rootTeams.forEach((rootTeam) => {
+        appendSnapshotTeamBlock(blocks, rootTeam, 0);
+    });
+    renderRichText(blocks);
+}
 function renderSnapshotInfo(snapshot, snapshotId, runtime) {
     const teamScores = snapshot.team_scores ?? [];
     const blocks = [ui.h1("Snapshot Information")];
@@ -261,6 +419,70 @@ function renderSnapshotInfo(snapshot, snapshotId, runtime) {
     }
     renderRichText(blocks);
 }
+function renderSnapshotWorkflowScores(response, snapshotId, filterOptions, runtime) {
+    const { results } = response;
+    const filterDetails = workflowScoresFilterDetails(response.filters);
+    const webFilters = snapshotWebFilters(filterOptions);
+    const blocks = [ui.h1("Snapshot Workflow Scores")];
+    if (filterDetails.length > 0) {
+        blocks.push(ui.dl(filterDetails, { termWidth: 17 }));
+    }
+    blocks.push(ui.p(`Displaying ${ui.bold(results.length.toString())} ${results.length === 1 ? "workflow" : "workflows"}.`), ui.p(ui.link(
+    // Sort the web view by workflow name, ascending (sb = sort by, sr = sort reversed)
+    snapshotWebLink(snapshotId, "workflow", runtime, {
+        sb: "name",
+        sr: "false",
+        ...webFilters.query,
+    }))));
+    if (webFilters.omittedFlags.length > 0) {
+        blocks.push(ui.p(ui.dim(`Web link omits ${webFilters.omittedFlags.join(" and ")}; the web app can't apply those filters.`)));
+    }
+    if (results.length === 0) {
+        blocks.push(ui.p(ui.dim("(None)")));
+        renderRichText(blocks);
+        return;
+    }
+    for (const result of results) {
+        blocks.push(ui.h2(result.workflow.name));
+        blocks.push(ui.p(result.workflow.prompt));
+        if (result.hidden) {
+            blocks.push(ui.p(ui.dim("(Hidden)")));
+            continue;
+        }
+        const benchmark = result.workflow.benchmark;
+        const benchmarkValue = benchmark
+            ? `${benchmark.name} (${benchmark.year}) p50=${benchmark.p_50}, p75=${benchmark.p_75}, p90=${benchmark.p_90}`
+            : ui.dim("(None)");
+        blocks.push(ui.dl([
+            ui.dli("Workflow ID", result.workflow.id),
+            ui.dli("Score", formatNumber(result.score)),
+            optionalDetail("Respondents", formatNumber(result.total_respondents), result.total_respondents),
+            optionalDetail("Cohort size", formatNumber(result.total_cohort), result.total_cohort),
+            ui.dli("Unit", formatText(result.workflow.unit)),
+            ui.dli("Lower is better", result.workflow.lower_is_better ? "Yes" : "No"),
+            ui.dli("Benchmark", benchmarkValue),
+        ].filter((detail) => detail !== null), { termWidth: 17 }));
+        blocks.push(ui.h3("Distribution"));
+        blocks.push(ui.p(formatWorkflowDistributionTable(result.distribution)));
+    }
+    renderRichText(blocks);
+}
+function workflowScoresFilterDetails(filters) {
+    const names = (items) => items.map((item) => item.name).join(", ");
+    const attributes = filters.attribute_groups.flatMap((group) => group.attributes.map((attribute) => ({
+        id: attribute.id,
+        name: `${group.name}: ${attribute.name}`,
+    })));
+    return [
+        ["Teams", filters.teams],
+        ["Snapshot teams", filters.snapshot_teams],
+        ["Groups", filters.groups],
+        ["Branches", filters.branches],
+        ["Attributes", attributes],
+    ]
+        .filter(([, items]) => items.length > 0)
+        .map(([term, items]) => ui.dli(term, names(items)));
+}
 function renderSnapshots(snapshots, runtime) {
     const blocks = [ui.h1("Snapshots")];
     blocks.push(ui.p(`Displaying ${ui.bold(snapshots.length.toString())} snapshots.`));
@@ -298,6 +520,69 @@ function extractCsatComments(response) {
         response.comments ??
         []);
 }
+class SnapshotTeamTreeNode {
+    team;
+    children = [];
+    constructor(team) {
+        this.team = team;
+    }
+}
+function buildSnapshotTeamTree(teams) {
+    const nodes = new Map();
+    teams.forEach((team) => {
+        nodes.set(team.id, new SnapshotTeamTreeNode(team));
+    });
+    const rootTeams = [];
+    teams.forEach((team) => {
+        const currentNode = nodes.get(team.id);
+        if (currentNode.team.parent_id === null) {
+            // It's a top-level root node
+            rootTeams.push(currentNode);
+        }
+        else {
+            // Append it to its parent's children array
+            nodes.get(currentNode.team.parent_id).children.push(currentNode);
+        }
+    });
+    const sortNodes = (items) => {
+        items.sort((left, right) => compareSnapshotTeams(left.team, right.team));
+        for (const item of items) {
+            sortNodes(item.children);
+        }
+    };
+    sortNodes(rootTeams);
+    return rootTeams;
+}
+function compareSnapshotTeams(left, right) {
+    const leftName = left.name.toLocaleLowerCase();
+    const rightName = right.name.toLocaleLowerCase();
+    if (leftName !== rightName) {
+        return leftName.localeCompare(rightName);
+    }
+    // If the names are the same, compare the IDs
+    const leftId = left.id.toLocaleLowerCase();
+    const rightId = right.id.toLocaleLowerCase();
+    return leftId.localeCompare(rightId);
+}
+function appendSnapshotTeamBlock(blocks, node, depth) {
+    blocks.push(depth === 0
+        ? ui.h2(node.team.name)
+        : ui.h3(`${"↳".repeat(depth)} ${node.team.name}`));
+    const details = [
+        optionalDetail("Snapshot Team ID", formatText(node.team.id), node.team.id),
+        optionalDetail("Team ID", formatText(node.team.team_id), node.team.team_id),
+        // Match `dx teams info`: show "(None)" when the API returns a null manager,
+        // omit the row only when the field is absent entirely.
+        ui.dli("Manager", formatTeamMember(node.team.manager)),
+        optionalDetail("Parent ID", formatText(node.team.parent_id), node.team.parent_id),
+    ].filter((detail) => detail !== null);
+    if (details.length > 0) {
+        blocks.push(ui.dl(details, { termWidth: 18 }));
+    }
+    node.children.forEach((child) => {
+        appendSnapshotTeamBlock(blocks, child, depth + 1);
+    });
+}
 function formatCommentHeading(comment) {
     const heading = comment.item_name ??
         comment.driver_name ??
@@ -350,19 +635,44 @@ function formatBenchmarkTable(teamScore) {
         ["vs_90th", formatBenchmarkNumber(teamScore.vs_90th)],
     ];
     const columns = ["Benchmark", "Value"];
-    const widths = columns.map((column, index) => Math.max(column.length, ...rows.map((row) => row[index].length)));
-    const border = `+${widths.map((width) => "-".repeat(width + 2)).join("+")}+`;
-    const header = `| ${columns.map((column, index) => column.padEnd(widths[index])).join(" | ")} |`;
-    const body = rows.map((row) => `| ${row.map((cell, index) => cell.padEnd(widths[index])).join(" | ")} |`);
-    return [border, header, border, ...body, border].join("\n");
+    return buildTable(columns, rows);
 }
 function formatBenchmarkNumber(value) {
     return typeof value === "number" && Number.isFinite(value)
         ? value.toString()
         : "(None)";
 }
-function snapshotWebLink(snapshotId, section, runtime) {
-    return ui.webLink(`/snapshots/${snapshotId}/${section}`, runtime);
+function formatWorkflowDistributionTable(distribution) {
+    if (distribution.length === 0) {
+        return ui.dim("(None)");
+    }
+    const rows = distribution.map((item) => [
+        item.label.trim(),
+        item.value.toString(),
+        item.count.toString(),
+    ]);
+    const columns = ["Label", "Value", "Count"];
+    return buildTable(columns, rows);
+}
+function buildTable(columns, rows) {
+    const widths = columns.map((column, index) => Math.max(column.length, ...rows.map((row) => row[index].length)));
+    const border = `+${widths.map((width) => "-".repeat(width + 2)).join("+")}+`;
+    const header = `| ${columns.map((column, index) => column.padEnd(widths[index])).join(" | ")} |`;
+    const body = rows.map((row) => `| ${row.map((cell, index) => cell.padEnd(widths[index])).join(" | ")} |`);
+    return [border, header, border, ...body, border].join("\n");
+}
+function snapshotWebLink(snapshotId, section, runtime, queryParams = {}) {
+    let urlPath = `/snapshots/${snapshotId}/${section}`;
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(queryParams)) {
+        if (value !== undefined) {
+            params.set(key, value);
+        }
+    }
+    if (params.size > 0) {
+        urlPath += `?${params.toString()}`;
+    }
+    return ui.webLink(urlPath, runtime);
 }
 function parseRequiredTextOption(value, flag) {
     if (typeof value !== "string" || value.trim().length === 0) {

package/dist/commands/studio/reports.js

@@ -370,12 +370,20 @@ function studioReportToYaml(report) {
         viewer_emails: report.viewer_emails ?? [],
         edit_access_type: report.edit_access_type,
         editor_emails: report.editor_emails ?? [],
+        sections: report.sections?.map((section) => ({
+            id: section.id,
+            name: section.name,
+            description: section.description,
+        })),
         tiles: report.tiles.map((tile) => ({
             id: tile.id,
             title: tile.title,
             sql: tile.sql,
             chart_type: tile.chart_type,
             chart_config: tile.chart_config,
+            section_id: tile.section_id,
+            width: tile.width,
+            height: tile.height,
         })),
     };
     return stringifyYaml(payload, { blockQuote: "literal" });

package/dist/commands/teams.js

@@ -200,7 +200,7 @@ function formatTeamHeading(team) {
     }
     return null;
 }
-function formatTeamMember(member) {
+export function formatTeamMember(member) {
     if (!member) {
         return ui.dim("(None)");
     }

package/dist/commands/workflow-blank-template.yaml

@@ -31,6 +31,12 @@ trigger_type: ANY
 #   - squad_id: "<team id>"                 # user_id or squad_id
 #     squad_linkage_id: null                # optional
 
+# timeout: how long a run can stay in progress before it times out. Only
+# applies when execution_type is EVENT_DRIVEN (ignored for SIMPLE). One of
+# ONE_HOUR, SIX_HOURS, TWELVE_HOURS, ONE_DAY, THREE_DAYS, SEVEN_DAYS,
+# FOURTEEN_DAYS or THIRTY_DAYS. Optional; if not set, a default of 1 hour is used.
+# timeout: ONE_DAY
+
 # Which entities the workflow can run against (only used when scope is ENTITY).
 # entity_filter_type: "ENTITY_TYPES" or "SQL"
 entity_filter_type: ENTITY_TYPES

package/dist/commands/workflowsRendering.js

@@ -72,6 +72,9 @@ function coreContent(workflow) {
         ui.dli("Scope", workflowScopeLabel(workflow.scope)),
         ui.dli("Execution type", workflowExecutionTypeLabel(workflow.execution_type)),
         ui.dli("Who can run", `${workflowTriggerTypeLabel(workflow.trigger_type)}  ${ui.dim(workflowTriggerTypeDescription(workflow.trigger_type))}`),
+        ...(workflow.timeout
+            ? [ui.dli("Timeout", ui.code(workflow.timeout))]
+            : []),
     ], { termWidth: 16 }));
     return blocks;
 }

package/dist/config.js

@@ -41,6 +41,53 @@ export function readConfig() {
     }
     return stored;
 }
+/**
+ * Report on the state of the config file without hiding problems, unlike
+ * `readConfig`, which treats an unparseable file as empty.
+ */
+export function inspectConfigFile() {
+    const configPath = getConfigPath();
+    let stats;
+    let content;
+    try {
+        stats = fs.statSync(configPath);
+        content = fs.readFileSync(configPath, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            return { status: "missing", path: configPath };
+        }
+        return {
+            status: "invalid",
+            path: configPath,
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+    try {
+        const parsed = JSON.parse(content);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            return {
+                status: "invalid",
+                path: configPath,
+                error: "expected a JSON object",
+            };
+        }
+    }
+    catch (error) {
+        return {
+            status: "invalid",
+            path: configPath,
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+    return {
+        status: "ok",
+        path: configPath,
+        config: readConfig(),
+        sizeBytes: stats.size,
+        modifiedAt: stats.mtime,
+    };
+}
 export function persistCurrentVersionCache(cache) {
     writeConfig({ ...readConfig(), currentVersionCache: cache });
 }
@@ -89,20 +136,31 @@ function getConfigDir() {
  * Precedence: `DX_API_BASE_URL`, then persisted `apiBaseUrl`, then DX Cloud default.
  */
 export function resolveApiBaseUrl() {
-    if (process.env.DX_API_BASE_URL) {
-        return normalizeUrl(process.env.DX_API_BASE_URL);
-    }
-    return normalizeUrl(readConfig().apiBaseUrl || DEFAULT_API_BASE_URL);
+    return resolveApiBaseUrlWithSource().url;
+}
+/** Like `resolveApiBaseUrl`, but also reports where the value came from. */
+export function resolveApiBaseUrlWithSource() {
+    return resolveBaseUrl(process.env.DX_API_BASE_URL, readConfig().apiBaseUrl, DEFAULT_API_BASE_URL);
 }
 /**
  * Resolved web-app base URL for CLI deep links and browser OAuth.
  * Precedence: `DX_WEB_BASE_URL`, persisted `webBaseUrl`, then DX Cloud default.
  */
 export function resolveWebBaseUrl() {
-    if (process.env.DX_WEB_BASE_URL) {
-        return normalizeUrl(process.env.DX_WEB_BASE_URL);
+    return resolveWebBaseUrlWithSource().url;
+}
+/** Like `resolveWebBaseUrl`, but also reports where the value came from. */
+export function resolveWebBaseUrlWithSource() {
+    return resolveBaseUrl(process.env.DX_WEB_BASE_URL, readConfig().webBaseUrl, DEFAULT_WEB_BASE_URL);
+}
+function resolveBaseUrl(fromEnv, fromConfig, fallback) {
+    if (fromEnv) {
+        return { url: normalizeUrl(fromEnv), source: "env" };
     }
-    return normalizeUrl(readConfig().webBaseUrl || DEFAULT_WEB_BASE_URL);
+    if (fromConfig) {
+        return { url: normalizeUrl(fromConfig), source: "config" };
+    }
+    return { url: normalizeUrl(fallback), source: "default" };
 }
 // --- Deriving base URLs at login time -------------------------------------
 /**
@@ -151,14 +209,17 @@ export function deriveBaseUrlsFromEnv() {
             throw new CliError(`Could not recognize web base URL "${parsed.input}". Expected https://app.getdx.com, https://<account>.getdx.io, or a custom domain.`);
     }
 }
-function parseWebBaseUrl(raw) {
+export function parseWebBaseUrl(raw) {
     const normalized = raw.trim().replace(/\/$/, "");
-    if (!normalized || normalized === "app.getdx.com") {
+    if (!normalized) {
         return { type: "cloud" };
     }
     try {
         const url = new URL(normalized.startsWith("http") ? normalized : `https://${normalized}`);
         const host = url.hostname;
+        if (host === "app.getdx.com") {
+            return { type: "cloud" };
+        }
         const dedicatedMatch = host.match(/^(.+)\.getdx\.io$/);
         if (dedicatedMatch) {
             return { type: "dedicated", accountName: dedicatedMatch[1] };

package/dist/doctor/auth.js

@@ -0,0 +1,133 @@
+import dayjs from "dayjs";
+import { getAuthInfo } from "../commands/auth.js";
+import { HttpError } from "../errors.js";
+import { describeError, timed } from "./format.js";
+import { CHECK_TIMEOUT_MS, DOCTOR_HEADER } from "./probes.js";
+import { check } from "./types.js";
+const EXPIRY_WARNING_DAYS = 7;
+const SECTION = { id: "auth", title: "Auth" };
+export async function checkAuth(options) {
+    const { runtime, apiReachable, now } = options;
+    if (!runtime) {
+        return skipped("no token is configured");
+    }
+    if (!apiReachable) {
+        return skipped("the API is unreachable");
+    }
+    const host = new URL(runtime.apiBaseUrl).host;
+    let info;
+    let ms;
+    try {
+        ({ value: info, ms } = await timed(() => getAuthInfo(runtime, {
+            headers: DOCTOR_HEADER,
+            signal: AbortSignal.timeout(CHECK_TIMEOUT_MS),
+        })));
+    }
+    catch (error) {
+        return { ...SECTION, checks: [tokenErrorCheck(error, host)] };
+    }
+    const { auth, account } = info;
+    const checks = [
+        check("token_valid", "Token valid", "ok", `${tokenTypeName(auth.token_type)} "${auth.token_name}" (responded in ${ms}ms)`, {
+            data: {
+                token_type: auth.token_type,
+                token_name: auth.token_name,
+                scopes: auth.scopes,
+                created_at: auth.created_at,
+                ms,
+            },
+        }),
+        check("account", "Account", "ok", account.name, {
+            data: { name: account.name },
+        }),
+    ];
+    if (auth.token_type === "personal_access_token") {
+        checks.push(expiryCheck(auth.expires_at, now));
+    }
+    return { ...SECTION, checks };
+}
+function skipped(reason) {
+    return {
+        ...SECTION,
+        checks: [
+            check("token_valid", "Token valid", "skip", `skipped because ${reason}`),
+        ],
+    };
+}
+function tokenErrorCheck(error, host) {
+    if (error instanceof HttpError && error.status === 401) {
+        return check("token_valid", "Token valid", "fail", `token rejected by ${host} (HTTP 401: ${error.message})`, {
+            hint: "The token may be revoked, expired, or issued by a different DX instance. Run `dx auth login` to store a new one.",
+            data: { status: 401 },
+        });
+    }
+    if (error instanceof HttpError && error.status !== undefined) {
+        const { message, hint } = describeHttpFailure(error.status, error.message, host);
+        return check("token_valid", "Token valid", "fail", message, {
+            hint,
+            data: { status: error.status },
+        });
+    }
+    return check("token_valid", "Token valid", "fail", describeError(error, "auth.info request"), {
+        hint: `The API was reachable a moment ago, but this request to ${host} failed. Try again.`,
+        data: { status: null },
+    });
+}
+function describeHttpFailure(status, errorMessage, host) {
+    if (status === 403) {
+        return {
+            message: `access denied by ${host} (HTTP 403: ${errorMessage})`,
+            hint: "The token was recognized but this request was refused. An IP allowlist, proxy, or firewall may be blocking it. Check with your DX admin or network team.",
+        };
+    }
+    if (status === 429) {
+        return {
+            message: `rate limited by ${host} (HTTP 429)`,
+            hint: "Too many requests. Wait a minute and run `dx doctor` again.",
+        };
+    }
+    if (status >= 500) {
+        return {
+            message: `HTTP ${status}: ${errorMessage}`,
+            hint: "The DX API is having problems. Try again in a few minutes, and contact DX support if this persists.",
+        };
+    }
+    return {
+        message: `HTTP ${status}: ${errorMessage}`,
+        hint: "The DX API could not validate the token. Try again, and contact DX support if this persists.",
+    };
+}
+function expiryCheck(expiresAt, now) {
+    if (!expiresAt) {
+        return check("expires", "Expires", "ok", "never", {
+            data: { expires_at: null },
+        });
+    }
+    const expires = dayjs(expiresAt);
+    const days = expires.diff(dayjs(now), "day");
+    const date = expires.format("YYYY-MM-DD");
+    const data = { expires_at: expiresAt, days_remaining: days };
+    if (expires.isBefore(now)) {
+        return check("expires", "Expires", "fail", `expired on ${date}`, {
+            hint: "Create a new personal access token and run `dx auth login`.",
+            data,
+        });
+    }
+    if (days < EXPIRY_WARNING_DAYS) {
+        return check("expires", "Expires", "warn", `${date} (${days}d)`, {
+            hint: "This token expires soon. Create a new one and run `dx auth login`.",
+            data,
+        });
+    }
+    return check("expires", "Expires", "ok", `${date} (${days}d)`, { data });
+}
+function tokenTypeName(tokenType) {
+    switch (tokenType) {
+        case "account_web_api_token":
+            return "organization token";
+        case "personal_access_token":
+            return "personal access token";
+        default:
+            return String(tokenType);
+    }
+}