@mutagent/cli 0.2.186 → 0.2.187

package/dist/bin/cli.js

@@ -37810,11 +37810,117 @@ import chalk64 from "chalk";
 
 // src/lib/integration-sources-input.ts
 init_errors();
-var CREATABLE_KINDS = ["langfuse", "openobserve"];
+
+// src/lib/integration-sources-guidance.ts
+init_errors();
+var SOURCES = "mutagent integrations sources";
+var READ_ONLY_CODE = "INTEGRATION_SOURCE_READ_ONLY";
+function testFailureWords(id, check, status) {
+  const http = status === undefined ? "" : ` (HTTP ${String(status)})`;
+  switch (check) {
+    case "credentials_refused":
+      return {
+        message: `The source refused the stored credentials${http}: check credentials_refused failed.`,
+        fix: `Get new keys from the source platform, then run: ${SOURCES} rotate ${id} … --secret-stdin`
+      };
+    case "unreachable":
+      return {
+        message: "The server could not reach the source host: check unreachable failed.",
+        fix: `Check the host is up and public (${SOURCES} list shows it); if it moved, remove the source and add it again.`
+      };
+    case "http_error":
+      return {
+        message: `The source answered with an error${http}: check http_error failed.`,
+        fix: "Check the source platform is healthy and the host is its API base URL, then test again."
+      };
+    case "invalid_response":
+      return {
+        message: "The host did not answer like the source platform: check invalid_response failed.",
+        fix: "Check --host is the platform API base URL (not a dashboard page), then remove and add the source again."
+      };
+    case "host_refused":
+      return {
+        message: "The source host resolves to an address the server may not call: check host_refused failed.",
+        fix: "Use the public URL of the trace platform: remove the source and add it with a public --host."
+      };
+    default:
+      return {
+        message: `The connection test failed${http}${check === undefined ? "" : `: check ${check} failed`}.`,
+        fix: `Run: ${SOURCES} test ${id} again; if it keeps failing, report it: mutagent feedback send --category bug -m "source test ${check ?? "failed"}"`
+      };
+  }
+}
+
+class SourceTestFailedError extends MutagentError {
+  sourceId;
+  check;
+  httpStatus;
+  testedAt;
+  constructor(sourceId, check, httpStatus, testedAt) {
+    const words = testFailureWords(sourceId, check, httpStatus);
+    super("INTEGRATION_SOURCE_TEST_FAILED", words.message, words.fix);
+    this.sourceId = sourceId;
+    this.check = check;
+    this.httpStatus = httpStatus;
+    this.testedAt = testedAt;
+  }
+  toJSON() {
+    return {
+      ...super.toJSON(),
+      sourceId: this.sourceId,
+      check: this.check ?? null,
+      ...this.httpStatus === undefined ? {} : { status: this.httpStatus },
+      testedAt: this.testedAt
+    };
+  }
+}
+function defaultFix(code, ctx) {
+  const id = ctx.id ?? "<id>";
+  const pullId = ctx.pullId ?? "<pullId>";
+  switch (code) {
+    case "INTEGRATION_SOURCE_NOT_FOUND":
+      return `Run: ${SOURCES} list`;
+    case "INTEGRATION_PULL_NOT_FOUND":
+      return `Run: ${SOURCES} pulls ${id}`;
+    case "INTEGRATION_PULL_NOT_READY":
+      return `Wait for the pull to succeed: ${SOURCES} pull-get ${id} ${pullId}`;
+    case "INTEGRATION_PULL_RUNNING":
+      return `Wait for it to finish (${SOURCES} pulls ${id}), then start another.`;
+    case "INTEGRATION_SOURCE_NAME_TAKEN":
+      return `Pick another name with --name (${SOURCES} list shows the names in use).`;
+    case "INTEGRATION_SOURCE_CREDENTIALS_INVALID":
+      return `Pass the credentials the source's kind takes: ${SOURCES} rotate --help`;
+    case "INTEGRATION_SOURCE_CREDENTIALS_UNREADABLE":
+      return `Rotate the credentials, then test again: ${SOURCES} rotate ${id} … --secret-stdin`;
+    case "INTEGRATION_SOURCE_NOT_TESTABLE":
+    case READ_ONLY_CODE:
+      return "OTLP traces arrive by push; there is nothing to test, rotate, pull or delete.";
+    case "INTEGRATION_SOURCE_HOST_INVALID":
+    case "INTEGRATION_SOURCE_HOST_REFUSED":
+      return "Pass --host the public base URL of the platform, e.g. https://cloud.langfuse.com.";
+    case "INTEGRATION_PULL_WINDOW_INVALID":
+      return "Pass --since and --until as ISO-8601 times, --since first.";
+    case "INTEGRATION_SOURCE_ENCRYPTION_UNAVAILABLE":
+    case "INTEGRATION_PULL_STORE_UNAVAILABLE":
+      return "The server is not configured for this: the platform operator must fix it; nothing on this machine can. " + 'Tell the user, or report it: mutagent feedback send --category bug -m "<what failed>"';
+    default:
+      return `Run: ${SOURCES} --help`;
+  }
+}
+var OPERATOR_CODES = new Set(["INTEGRATION_SOURCE_ENCRYPTION_UNAVAILABLE", "INTEGRATION_PULL_STORE_UNAVAILABLE"]);
+function fixFor(code, serverFix, ctx) {
+  if (OPERATOR_CODES.has(code))
+    return defaultFix(code, ctx);
+  return serverFix ?? defaultFix(code, ctx);
+}
+
+// src/lib/integration-sources-input.ts
+var CREATABLE_KINDS = ["langfuse", "openobserve", "dash0"];
 var OPENOBSERVE_SIGNALS = ["events", "spans"];
+var DASH0_DATASET = /^[a-zA-Z0-9_-]{3,26}$/;
 var MAX_PULL_LIMIT = 5000;
 var MAX_TAGS = 20;
-var SOURCES = "mutagent integrations sources";
+var SOURCES2 = "mutagent integrations sources";
 function invalid5(message, fix) {
   const error = new ValidationError(message);
   error.suggestion = fix;
@@ -37827,7 +37933,7 @@ function checkLength(flag, value, max) {
     throw invalid5(`${flag} is longer than ${String(max)} characters.`, `Shorten ${flag}.`);
   return value;
 }
-var ADD_HELP = `Run: ${SOURCES} add --help`;
+var ADD_HELP = `Run: ${SOURCES2} add --help`;
 function indirectSecret(flags, inputs) {
   if (flags.secretEnv !== undefined && flags.secretStdin === true) {
     throw invalid5("--secret-env and --secret-stdin were both given.", "Pass the secret one way only.");
@@ -37857,31 +37963,41 @@ function oneSecret(flagName, flagValue, flags, inputs) {
 function credentialsFor(kind, flags, inputs, verb) {
   if (kind === "langfuse") {
     if (flags.email !== undefined || flags.password !== undefined || flags.token !== undefined) {
-      throw invalid5("A langfuse source takes --public-key and a secret key, not --email, --password or --token.", `Run: ${SOURCES} ${verb} --public-key <pk-lf-…> --secret-stdin`);
+      throw invalid5("A langfuse source takes --public-key and a secret key, not --email, --password or --token.", `Run: ${SOURCES2} ${verb} --public-key <pk-lf-…> --secret-stdin`);
     }
     const secretKey = oneSecret("--secret-key", flags.secretKey, flags, inputs);
     if (flags.publicKey === undefined || secretKey === undefined) {
-      throw invalid5("A langfuse source needs --public-key and a secret key (--secret-key, --secret-env or --secret-stdin).", `Run: ${SOURCES} ${verb} --public-key <pk-lf-…> --secret-stdin`);
+      throw invalid5("A langfuse source needs --public-key and a secret key (--secret-key, --secret-env or --secret-stdin).", `Run: ${SOURCES2} ${verb} --public-key <pk-lf-…> --secret-stdin`);
     }
     return { publicKey: checkLength("--public-key", flags.publicKey, 512), secretKey: checkLength("the secret key", secretKey, 512) };
   }
+  if (kind === "dash0") {
+    if (flags.publicKey !== undefined || flags.secretKey !== undefined || flags.email !== undefined || flags.password !== undefined) {
+      throw invalid5("A dash0 source takes an auth token (--token), not --public-key, --secret-key, --email or --password.", `Run: ${SOURCES2} ${verb} --secret-env DASH0_AUTH_TOKEN (or --token, or --secret-stdin)`);
+    }
+    const authToken = oneSecret("--token", flags.token, flags, inputs);
+    if (authToken === undefined) {
+      throw invalid5("A dash0 source needs an auth token (--token, --secret-env or --secret-stdin).", `Run: ${SOURCES2} ${verb} --secret-env DASH0_AUTH_TOKEN (or --token, or --secret-stdin)`);
+    }
+    return { authToken: checkLength("the auth token", authToken, 512) };
+  }
   if (flags.publicKey !== undefined || flags.secretKey !== undefined) {
-    throw invalid5("An openobserve source takes --email with a password, or a --token; not --public-key or --secret-key.", `Run: ${SOURCES} ${verb} --token <token> (or --email <email> --secret-stdin)`);
+    throw invalid5("An openobserve source takes --email with a password, or a --token; not --public-key or --secret-key.", `Run: ${SOURCES2} ${verb} --token <token> (or --email <email> --secret-stdin)`);
   }
   if (flags.email !== undefined) {
     if (flags.token !== undefined)
       throw invalid5("--email and --token were both given.", "Pass --email with a password, or --token alone.");
     const password = oneSecret("--password", flags.password, flags, inputs);
     if (password === undefined) {
-      throw invalid5("--email needs a password (--password, --secret-env or --secret-stdin).", `Run: ${SOURCES} ${verb} --email <email> --secret-stdin`);
+      throw invalid5("--email needs a password (--password, --secret-env or --secret-stdin).", `Run: ${SOURCES2} ${verb} --email <email> --secret-stdin`);
     }
     return { email: checkLength("--email", flags.email, 512), password: checkLength("the password", password, 512) };
   }
   if (flags.password !== undefined)
-    throw invalid5("--password needs --email.", `Run: ${SOURCES} ${verb} --email <email> --secret-stdin`);
+    throw invalid5("--password needs --email.", `Run: ${SOURCES2} ${verb} --email <email> --secret-stdin`);
   const token = oneSecret("--token", flags.token, flags, inputs);
   if (token === undefined) {
-    throw invalid5("An openobserve source needs a --token, or --email with a password.", `Run: ${SOURCES} ${verb} --token <token> (or --email <email> --secret-stdin)`);
+    throw invalid5("An openobserve source needs a --token, or --email with a password.", `Run: ${SOURCES2} ${verb} --token <token> (or --email <email> --secret-stdin)`);
   }
   return { token: checkLength("the token", token, 512) };
 }
@@ -37889,7 +38005,7 @@ function creatableKind(kind) {
   if (CREATABLE_KINDS.includes(kind))
     return kind;
   if (kind === "otlp") {
-    throw invalid5("OTLP traces arrive by push through OTLP ingest; there is no OTLP source to add.", `Send traces to the OTLP endpoint; ${SOURCES} list shows them once they arrive.`);
+    throw invalid5("OTLP traces arrive by push through OTLP ingest; there is no OTLP source to add.", `Send traces to the OTLP endpoint; ${SOURCES2} list shows them once they arrive.`);
   }
   throw invalid5(`Unknown source kind "${kind}". Kinds: ${CREATABLE_KINDS.join(", ")}.`, ADD_HELP);
 }
@@ -37914,12 +38030,12 @@ function refuseKeyOptionsInSandbox(flags, verb) {
   const given = KEY_OPTIONS2.filter(([field]) => flags[field] !== undefined && flags[field] !== false).map(([, flag]) => flag);
   if (given.length === 0)
     return;
-  const fix = verb === "add" ? `Run the same ${SOURCES} add without ${given.join(", ")}: the answer is a one-time page where the user stores the key.` : "The user changes a stored key in Configuration → Integrations; it is never passed through a cloud session.";
+  const fix = verb === "add" ? `Run the same ${SOURCES2} add without ${given.join(", ")}: the answer is a one-time page where the user stores the key.` : "The user changes a stored key in Configuration → Integrations; it is never passed through a cloud session.";
   throw new MutagentError("SANDBOX_SCOPE", `Keys aren't passed through a cloud session, and ${given.join(", ")} ${given.length === 1 ? "carries" : "carry"} one. The user stores keys on a one-time page or in Configuration.`, fix);
 }
 var AT_SIGNS = /@|%40|＠/i;
 function sandboxHost(raw) {
-  const refuse = () => new MutagentError("SANDBOX_SCOPE", "--host isn't a plain base URL (http or https, no user:password, query or fragment), and a cloud session never passes anything that could carry a key. The user stores keys on a one-time page or in Configuration.", `Run the same ${SOURCES} add with --host as the base URL only, e.g. https://cloud.langfuse.com: the answer is a one-time page where the user stores the key.`);
+  const refuse = () => new MutagentError("SANDBOX_SCOPE", "--host isn't a plain base URL (http or https, no user:password, query or fragment), and a cloud session never passes anything that could carry a key. The user stores keys on a one-time page or in Configuration.", `Run the same ${SOURCES2} add with --host as the base URL only, e.g. https://cloud.langfuse.com: the answer is a one-time page where the user stores the key.`);
   if (AT_SIGNS.test(raw))
     throw refuse();
   let url;
@@ -37937,9 +38053,14 @@ function sandboxHost(raw) {
 function buildSourceBody(kindArg, flags, credentialsOf) {
   const kind = creatableKind(kindArg);
   if (flags.name === undefined)
-    throw invalid5("--name is required.", `Run: ${SOURCES} add ${kind} --name <name> …`);
+    throw invalid5("--name is required.", `Run: ${SOURCES2} add ${kind} --name <name> …`);
   const name = checkLength("--name", flags.name, 100);
   const host = flags.host === undefined ? undefined : checkLength("--host", flags.host, 2048);
+  if (kind !== "dash0" && flags.dataset !== undefined) {
+    throw invalid5(`--dataset is a dash0 setting; a ${kind} source has none.`, ADD_HELP);
+  }
+  if (kind === "dash0")
+    return dash0Body(name, host, flags, () => credentialsOf(kind));
   if (kind === "langfuse") {
     if (flags.openobserveOrg !== undefined || flags.stream !== undefined || flags.signal !== undefined) {
       throw invalid5("--openobserve-org, --stream and --signal are openobserve settings; a langfuse source has none.", ADD_HELP);
@@ -37948,7 +38069,7 @@ function buildSourceBody(kindArg, flags, credentialsOf) {
     return { kind, name, ...host === undefined ? {} : { host }, ...credentials === undefined ? {} : { credentials } };
   }
   if (host === undefined)
-    throw invalid5("An openobserve source needs --host (e.g. https://api.openobserve.ai).", `Run: ${SOURCES} add openobserve --host <url> …`);
+    throw invalid5("An openobserve source needs --host (e.g. https://api.openobserve.ai).", `Run: ${SOURCES2} add openobserve --host <url> …`);
   const org = flags.openobserveOrg === undefined ? undefined : checkLength("--openobserve-org", flags.openobserveOrg, 128);
   const stream = flags.stream === undefined ? undefined : checkLength("--stream", flags.stream, 256);
   if (flags.signal !== undefined && !OPENOBSERVE_SIGNALS.includes(flags.signal)) {
@@ -37965,6 +38086,25 @@ function buildSourceBody(kindArg, flags, credentialsOf) {
     ...credentials === undefined ? {} : { credentials }
   };
 }
+function dash0Body(name, host, flags, credentialsOf) {
+  if (flags.openobserveOrg !== undefined || flags.stream !== undefined || flags.signal !== undefined) {
+    throw invalid5("--openobserve-org, --stream and --signal are openobserve settings; a dash0 source has --dataset.", ADD_HELP);
+  }
+  if (host === undefined) {
+    throw invalid5("A dash0 source needs --host, the regional API URL (e.g. https://api.eu-west-1.aws.dash0.com).", `Run: ${SOURCES2} add dash0 --host <api url> …`);
+  }
+  if (flags.dataset !== undefined && !DASH0_DATASET.test(flags.dataset)) {
+    throw invalid5('--dataset must be 3-26 letters, digits, "-" or "_".', "Pass the dataset name from Dash0 Settings → Datasets, or omit --dataset for the default.");
+  }
+  const credentials = credentialsOf();
+  return {
+    kind: "dash0",
+    name,
+    host,
+    ...flags.dataset === undefined ? {} : { dataset: flags.dataset },
+    ...credentials === undefined ? {} : { credentials }
+  };
+}
 function instant(flag, value) {
   const ms = /^\d{4}-\d{2}-\d{2}/.test(value) ? Date.parse(value) : Number.NaN;
   if (Number.isNaN(ms))
@@ -38001,7 +38141,7 @@ function buildPullBody(flags) {
 function requireRemoveConsent(id, opts) {
   if (opts.force === true || opts.yes === true)
     return;
-  throw new MutagentError("CONFIRMATION_REQUIRED", `Removing trace source ${id} needs --force: its stored credentials, pulls and pulled traces are deleted.`, `Confirm with the user, then re-run: ${SOURCES} remove ${id} --force`);
+  throw new MutagentError("CONFIRMATION_REQUIRED", `Removing trace source ${id} needs --force: its stored credentials, pulls and pulled traces are deleted.`, `Confirm with the user, then re-run: ${SOURCES2} remove ${id} --force`);
 }
 function isVirtualRow(raw) {
   if (raw === undefined)
@@ -38010,108 +38150,9 @@ function isVirtualRow(raw) {
     return raw.virtual;
   return raw.kind === "otlp";
 }
-var READ_ONLY_CODE = "INTEGRATION_SOURCE_READ_ONLY";
 function readOnlyRefusal(id) {
   return new MutagentError(READ_ONLY_CODE, `${id} is OTLP ingest, a read-only source: OTLP traces arrive by push.`, "This row is derived from OTLP ingest: it lists while traces arrive and has nothing to rotate, test, pull or delete. " + "Its traces are already on the platform.");
 }
-function testFailureWords(id, check, status) {
-  const http = status === undefined ? "" : ` (HTTP ${String(status)})`;
-  switch (check) {
-    case "credentials_refused":
-      return {
-        message: `The source refused the stored credentials${http}: check credentials_refused failed.`,
-        fix: `Get new keys from the source platform, then run: ${SOURCES} rotate ${id} … --secret-stdin`
-      };
-    case "unreachable":
-      return {
-        message: "The server could not reach the source host: check unreachable failed.",
-        fix: `Check the host is up and public (${SOURCES} list shows it); if it moved, remove the source and add it again.`
-      };
-    case "http_error":
-      return {
-        message: `The source answered with an error${http}: check http_error failed.`,
-        fix: "Check the source platform is healthy and the host is its API base URL, then test again."
-      };
-    case "invalid_response":
-      return {
-        message: "The host did not answer like the source platform: check invalid_response failed.",
-        fix: "Check --host is the platform API base URL (not a dashboard page), then remove and add the source again."
-      };
-    case "host_refused":
-      return {
-        message: "The source host resolves to an address the server may not call: check host_refused failed.",
-        fix: "Use the public URL of the trace platform: remove the source and add it with a public --host."
-      };
-    default:
-      return {
-        message: `The connection test failed${http}${check === undefined ? "" : `: check ${check} failed`}.`,
-        fix: `Run: ${SOURCES} test ${id} again; if it keeps failing, report it: mutagent feedback send --category bug -m "source test ${check ?? "failed"}"`
-      };
-  }
-}
-
-class SourceTestFailedError extends MutagentError {
-  sourceId;
-  check;
-  httpStatus;
-  testedAt;
-  constructor(sourceId, check, httpStatus, testedAt) {
-    const words = testFailureWords(sourceId, check, httpStatus);
-    super("INTEGRATION_SOURCE_TEST_FAILED", words.message, words.fix);
-    this.sourceId = sourceId;
-    this.check = check;
-    this.httpStatus = httpStatus;
-    this.testedAt = testedAt;
-  }
-  toJSON() {
-    return {
-      ...super.toJSON(),
-      sourceId: this.sourceId,
-      check: this.check ?? null,
-      ...this.httpStatus === undefined ? {} : { status: this.httpStatus },
-      testedAt: this.testedAt
-    };
-  }
-}
-function defaultFix(code, ctx) {
-  const id = ctx.id ?? "<id>";
-  const pullId = ctx.pullId ?? "<pullId>";
-  switch (code) {
-    case "INTEGRATION_SOURCE_NOT_FOUND":
-      return `Run: ${SOURCES} list`;
-    case "INTEGRATION_PULL_NOT_FOUND":
-      return `Run: ${SOURCES} pulls ${id}`;
-    case "INTEGRATION_PULL_NOT_READY":
-      return `Wait for the pull to succeed: ${SOURCES} pull-get ${id} ${pullId}`;
-    case "INTEGRATION_PULL_RUNNING":
-      return `Wait for it to finish (${SOURCES} pulls ${id}), then start another.`;
-    case "INTEGRATION_SOURCE_NAME_TAKEN":
-      return `Pick another name with --name (${SOURCES} list shows the names in use).`;
-    case "INTEGRATION_SOURCE_CREDENTIALS_INVALID":
-      return `Pass the credentials the source's kind takes: ${SOURCES} rotate --help`;
-    case "INTEGRATION_SOURCE_CREDENTIALS_UNREADABLE":
-      return `Rotate the credentials, then test again: ${SOURCES} rotate ${id} … --secret-stdin`;
-    case "INTEGRATION_SOURCE_NOT_TESTABLE":
-    case READ_ONLY_CODE:
-      return "OTLP traces arrive by push; there is nothing to test, rotate, pull or delete.";
-    case "INTEGRATION_SOURCE_HOST_INVALID":
-    case "INTEGRATION_SOURCE_HOST_REFUSED":
-      return "Pass --host the public base URL of the platform, e.g. https://cloud.langfuse.com.";
-    case "INTEGRATION_PULL_WINDOW_INVALID":
-      return "Pass --since and --until as ISO-8601 times, --since first.";
-    case "INTEGRATION_SOURCE_ENCRYPTION_UNAVAILABLE":
-    case "INTEGRATION_PULL_STORE_UNAVAILABLE":
-      return "The server is not configured for this: the platform operator must fix it; nothing on this machine can. " + 'Tell the user, or report it: mutagent feedback send --category bug -m "<what failed>"';
-    default:
-      return `Run: ${SOURCES} --help`;
-  }
-}
-var OPERATOR_CODES = new Set(["INTEGRATION_SOURCE_ENCRYPTION_UNAVAILABLE", "INTEGRATION_PULL_STORE_UNAVAILABLE"]);
-function fixFor(code, serverFix, ctx) {
-  if (OPERATOR_CODES.has(code))
-    return defaultFix(code, ctx);
-  return serverFix ?? defaultFix(code, ctx);
-}
 
 // src/lib/integrations-api.ts
 init_config();
@@ -38321,7 +38362,7 @@ init_output();
 // src/commands/integrations/shared.ts
 init_errors();
 import { readFileSync as readFileSync24 } from "fs";
-var SOURCES2 = "mutagent integrations sources";
+var SOURCES3 = "mutagent integrations sources";
 function isJsonMode2(command) {
   return Boolean(command.optsWithGlobals().json);
 }
@@ -38363,7 +38404,7 @@ async function findWritableSource(conn, id) {
   return found;
 }
 function sourceNotFound(id) {
-  return new MutagentError("INTEGRATION_SOURCE_NOT_FOUND", `No trace source ${id} in this workspace.`, `Run: ${SOURCES2} list`);
+  return new MutagentError("INTEGRATION_SOURCE_NOT_FOUND", `No trace source ${id} in this workspace.`, `Run: ${SOURCES3} list`);
 }
 function readStdin2() {
   if (process.stdin.isTTY) {
@@ -38418,15 +38459,15 @@ function pullView(p) {
 function pullNext(id, p) {
   const status = p.status;
   if (status === "running") {
-    return { note: "Still running.", next: [`${SOURCES2} pull-get ${id} ${p.id} --json`] };
+    return { note: "Still running.", next: [`${SOURCES3} pull-get ${id} ${p.id} --json`] };
   }
   if (status === "failed") {
     return {
       note: `Failed: ${p.errorCode ?? "no reason recorded"}. Test the source, then pull again.`,
-      next: [`${SOURCES2} test ${id} --json`, `${SOURCES2} pull ${id} --json`]
+      next: [`${SOURCES3} test ${id} --json`, `${SOURCES3} pull ${id} --json`]
     };
   }
-  const read = [`${SOURCES2} pull-manifest ${id} ${p.id} --json`, `${SOURCES2} pull-traces ${id} ${p.id} --out traces.jsonl`];
+  const read = [`${SOURCES3} pull-manifest ${id} ${p.id} --json`, `${SOURCES3} pull-traces ${id} ${p.id} --out traces.jsonl`];
   if (p.complete === false) {
     const why = p.truncated ? `truncated (${p.truncationCause ?? "cause not recorded"})` : "short of the source total";
     return { note: `Succeeded but incomplete: ${why}. Do not treat these traces as the whole window.`, next: read };
@@ -38436,9 +38477,9 @@ function pullNext(id, p) {
 function registerPull(sources) {
   sources.command("pull").description("Start a pull of a source's traces into UniTF on the server").argument("<id>", "The source id").option("--since <time>", "Window start, ISO-8601 (omit for open)").option("--until <time>", "Window end, ISO-8601 (omit for open)").option("--limit <n>", "At most this many traces, 1-5000 (server default 500)").option("--agent-name <name>", "Only traces of this agent").option("--session-id <id>", "Only traces of this session").option("--tag <tag>", "Only traces with this tag (repeatable, at most 20)", (v, acc = []) => [...acc, v]).addHelpText("after", `
 Examples:
-  ${chalk64.dim("$")} ${SOURCES2} pull src_123
-  ${chalk64.dim("$")} ${SOURCES2} pull src_123 --since 2026-09-01T00:00:00Z --until 2026-09-02T00:00:00Z --limit 1000
-  ${chalk64.dim("$")} ${SOURCES2} pull src_123 --agent-name support-bot --tag prod --tag eu --json
+  ${chalk64.dim("$")} ${SOURCES3} pull src_123
+  ${chalk64.dim("$")} ${SOURCES3} pull src_123 --since 2026-09-01T00:00:00Z --until 2026-09-02T00:00:00Z --limit 1000
+  ${chalk64.dim("$")} ${SOURCES3} pull src_123 --agent-name support-bot --tag prod --tag eu --json
 
 Starts the pull and returns at once (status running). Poll it with pull-get; once it has
 succeeded, read pull-manifest and pull-traces. One running pull per source. A throttled or
@@ -38454,7 +38495,7 @@ AI Agent Directive:
       await findWritableSource(conn, id);
       const started = await conn.call((i) => i.startIntegrationSourcePull({ id, body }), { id });
       const links = pullLinks(id, started.id);
-      const next = [`${SOURCES2} pull-get ${id} ${started.id} --json`];
+      const next = [`${SOURCES3} pull-get ${id} ${started.id} --json`];
       if (isJson) {
         const directive = sourceDirective({
           template: "integration_pull_started",
@@ -38475,8 +38516,8 @@ AI Agent Directive:
 function registerPulls(sources) {
   sources.command("pulls").description("A source's pulls, newest first (at most 50; kept 90 days)").argument("<id>", "The source id").addHelpText("after", `
 Examples:
-  ${chalk64.dim("$")} ${SOURCES2} pulls src_123
-  ${chalk64.dim("$")} ${SOURCES2} pulls src_123 --json
+  ${chalk64.dim("$")} ${SOURCES3} pulls src_123
+  ${chalk64.dim("$")} ${SOURCES3} pulls src_123 --json
 
 AI Agent Directive:
   Reading is free. --json returns { pulls, count }.
@@ -38490,7 +38531,7 @@ AI Agent Directive:
         return;
       }
       if (list.items.length === 0) {
-        console.log(chalk64.gray(`No pulls. Start one: ${SOURCES2} pull ${id}`));
+        console.log(chalk64.gray(`No pulls. Start one: ${SOURCES3} pull ${id}`));
         return;
       }
       new OutputFormatter("table").output(list.items.map((p) => ({
@@ -38506,8 +38547,8 @@ AI Agent Directive:
 function registerPullGet(sources) {
   sources.command("pull-get").description("One pull: its status, counts and coverage").argument("<id>", "The source id").argument("<pullId>", "The pull id (from pull or pulls)").addHelpText("after", `
 Examples:
-  ${chalk64.dim("$")} ${SOURCES2} pull-get src_123 pull_456
-  ${chalk64.dim("$")} ${SOURCES2} pull-get src_123 pull_456 --json
+  ${chalk64.dim("$")} ${SOURCES3} pull-get src_123 pull_456
+  ${chalk64.dim("$")} ${SOURCES3} pull-get src_123 pull_456 --json
 
 AI Agent Directive:
   Reading is free: poll it while status is running. --json returns { pull, note, next, _links }.
@@ -38535,8 +38576,8 @@ AI Agent Directive:
 function registerPullManifest(sources) {
   sources.command("pull-manifest").description("A pull's unitf@0.1 manifest: what the JSONL holds and how completely").argument("<id>", "The source id").argument("<pullId>", "The pull id").addHelpText("after", `
 Examples:
-  ${chalk64.dim("$")} ${SOURCES2} pull-manifest src_123 pull_456
-  ${chalk64.dim("$")} ${SOURCES2} pull-manifest src_123 pull_456 --json
+  ${chalk64.dim("$")} ${SOURCES3} pull-manifest src_123 pull_456
+  ${chalk64.dim("$")} ${SOURCES3} pull-manifest src_123 pull_456 --json
 
 Available once the pull has succeeded (INTEGRATION_PULL_NOT_READY before).
 
@@ -38609,8 +38650,8 @@ var stdoutSink = {
 function registerPullTraces(sources) {
   sources.command("pull-traces").description("Stream a pull's UniTF JSONL to stdout, or to a file with --out").argument("<id>", "The source id").argument("<pullId>", "The pull id").option("-o, --out <file>", "Write the JSONL to this file instead of stdout").addHelpText("after", `
 Examples:
-  ${chalk64.dim("$")} ${SOURCES2} pull-traces src_123 pull_456 > traces.jsonl
-  ${chalk64.dim("$")} ${SOURCES2} pull-traces src_123 pull_456 --out traces.jsonl --json
+  ${chalk64.dim("$")} ${SOURCES3} pull-traces src_123 pull_456 > traces.jsonl
+  ${chalk64.dim("$")} ${SOURCES3} pull-traces src_123 pull_456 --out traces.jsonl --json
 
 One UniTF 0.1 trace per line, streamed as it arrives. Available once the pull has succeeded.
 --json: without --out, stdout is the JSONL unchanged (each line is already JSON; nothing
@@ -38672,7 +38713,7 @@ function shellQuote3(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 function rerunCommand(body) {
-  const parts = [`${SOURCES2} add ${shellQuote3(String(body.kind))}`, `--name ${shellQuote3(String(body.name))}`];
+  const parts = [`${SOURCES3} add ${shellQuote3(String(body.kind))}`, `--name ${shellQuote3(String(body.name))}`];
   if (typeof body.host === "string")
     parts.push(`--host ${shellQuote3(body.host)}`);
   if (typeof body.org === "string")
@@ -38681,6 +38722,8 @@ function rerunCommand(body) {
     parts.push(`--stream ${shellQuote3(body.stream)}`);
   if (typeof body.signal === "string")
     parts.push(`--signal ${shellQuote3(body.signal)}`);
+  if (typeof body.dataset === "string")
+    parts.push(`--dataset ${shellQuote3(body.dataset)}`);
   return parts.join(" ");
 }
 function printSecretRequired(isJson, detail, rerun) {
@@ -38712,7 +38755,7 @@ function secretInputs(flags) {
   return inputs;
 }
 function addCredentialOptions(cmd) {
-  return cmd.option("--public-key <key>", "langfuse: the public key (pk-lf-…)").option("--secret-key <key>", "langfuse: the secret key (sk-lf-…); prefer --secret-stdin or --secret-env").option("--email <email>", "openobserve: the user email, with a password").option("--password <password>", "openobserve: the password for --email; prefer --secret-stdin or --secret-env").option("--token <token>", 'openobserve: an issued token ("Basic …", "Bearer …" or base64), instead of --email').option("--secret-env <VAR>", "Read the kind's secret (secret key, password or token) from this environment variable").option("--secret-stdin", "Read the kind's secret from stdin (a trailing newline is dropped)");
+  return cmd.option("--public-key <key>", "langfuse: the public key (pk-lf-…)").option("--secret-key <key>", "langfuse: the secret key (sk-lf-…); prefer --secret-stdin or --secret-env").option("--email <email>", "openobserve: the user email, with a password").option("--password <password>", "openobserve: the password for --email; prefer --secret-stdin or --secret-env").option("--token <token>", 'openobserve: an issued token ("Basic …", "Bearer …" or base64), instead of --email; dash0: the auth token (auth_…)').option("--secret-env <VAR>", "Read the kind's secret (secret key, password or token) from this environment variable").option("--secret-stdin", "Read the kind's secret from stdin (a trailing newline is dropped)");
 }
 function row4(s) {
   const lastTest = s.readOnly ? s.ingest ? `latest trace ${s.ingest.latestTraceAt}` : "—" : s.lastTest ? `${s.lastTest.outcome}${s.lastTest.code ? ` (${s.lastTest.code})` : ""}` : "never";
@@ -38727,8 +38770,8 @@ function row4(s) {
 function registerList8(sources) {
   sources.command("list").alias("ls").description("Trace sources in the workspace, newest first").addHelpText("after", `
 Examples:
-  ${chalk66.dim("$")} ${SOURCES2} list
-  ${chalk66.dim("$")} ${SOURCES2} list --json
+  ${chalk66.dim("$")} ${SOURCES3} list
+  ${chalk66.dim("$")} ${SOURCES3} list --json
 
 Credentials are never returned; each source names its current ones by credentialRef.
 A row marked read-only is OTLP ingest: it lists while OTLP traces arrive (latest trace
@@ -38746,7 +38789,7 @@ AI Agent Directive:
         return;
       }
       if (all.length === 0) {
-        console.log(chalk66.gray(`No trace sources. Connect one: ${SOURCES2} add langfuse --name <name> --public-key <pk> --secret-stdin`));
+        console.log(chalk66.gray(`No trace sources. Connect one: ${SOURCES3} add langfuse --name <name> --public-key <pk> --secret-stdin`));
         return;
       }
       new OutputFormatter("table").output(all.map(row4));
@@ -38754,18 +38797,20 @@ AI Agent Directive:
   });
 }
 function registerAdd(sources) {
-  addCredentialOptions(sources.command("add").description("Connect a Langfuse or OpenObserve trace source (credentials are write-only)").argument("<kind>", "langfuse | openobserve").option("--name <name>", "A name, unique in the workspace (1-100 characters)").option("--host <url>", "Base URL: langfuse default https://cloud.langfuse.com; required for openobserve").option("--openobserve-org <org>", `openobserve: organization id, the model's org (default "default"); not the global --org`).option("--stream <stream>", 'openobserve: stream name (default "default")').option("--signal <signal>", "openobserve: events | spans (omit to detect it from the rows)")).addHelpText("after", `
+  addCredentialOptions(sources.command("add").description("Connect a Langfuse, OpenObserve or Dash0 trace source (credentials are write-only)").argument("<kind>", "langfuse | openobserve | dash0").option("--name <name>", "A name, unique in the workspace (1-100 characters)").option("--host <url>", "Base URL: langfuse default https://cloud.langfuse.com; required for openobserve; dash0: the regional API URL").option("--openobserve-org <org>", `openobserve: organization id, the model's org (default "default"); not the global --org`).option("--stream <stream>", 'openobserve: stream name (default "default")').option("--signal <signal>", "openobserve: events | spans (omit to detect it from the rows)").option("--dataset <dataset>", "dash0: the dataset to read (omit for the organization's default)")).addHelpText("after", `
 Examples:
-  ${chalk66.dim("$")} pass show langfuse/sk | ${SOURCES2} add langfuse --name prod --public-key pk-lf-… --secret-stdin
-  ${chalk66.dim("$")} ${SOURCES2} add langfuse --name self-hosted --host https://langfuse.example.com --public-key pk-lf-… --secret-env LANGFUSE_SECRET_KEY
-  ${chalk66.dim("$")} ${SOURCES2} add openobserve --name oo --host https://api.openobserve.ai --openobserve-org acme --email ops@acme.com --secret-stdin
-  ${chalk66.dim("$")} ${SOURCES2} add openobserve --name oo --host http://oo.internal.example:5080 --secret-env OO_TOKEN --json
-
-The secret (langfuse secret key; openobserve password with --email, or token without) comes
+  ${chalk66.dim("$")} pass show langfuse/sk | ${SOURCES3} add langfuse --name prod --public-key pk-lf-… --secret-stdin
+  ${chalk66.dim("$")} ${SOURCES3} add langfuse --name self-hosted --host https://langfuse.example.com --public-key pk-lf-… --secret-env LANGFUSE_SECRET_KEY
+  ${chalk66.dim("$")} ${SOURCES3} add openobserve --name oo --host https://api.openobserve.ai --openobserve-org acme --email ops@acme.com --secret-stdin
+  ${chalk66.dim("$")} ${SOURCES3} add openobserve --name oo --host http://oo.internal.example:5080 --secret-env OO_TOKEN --json
+  ${chalk66.dim("$")} ${SOURCES3} add dash0 --name dash0 --host https://api.eu-west-1.aws.dash0.com --dataset production --secret-env DASH0_AUTH_TOKEN
+
+The secret (langfuse secret key; openobserve password with --email, or token without; dash0
+auth token, from Settings → Auth Tokens, with --host from Settings → Endpoints → API) comes
 from its flag, from --secret-env <VAR>, or from stdin with --secret-stdin: exactly one. A flag
 leaves it in your shell history. Credentials are write-only: no output ever shows them.
 The host must be a public http(s) base URL. OTLP traces arrive by push; there is no otlp kind to add.
-Next: ${SOURCES2} test <id>.
+Next: ${SOURCES3} test <id>.
 
 In a cloud sandbox:
   Keys never go through the session: every key option (--public-key, --secret-key,
@@ -38801,7 +38846,7 @@ ${WRITE_DIRECTIVE}
         return;
       }
       const links = sourceLinks(view.id);
-      const next = [`${SOURCES2} test ${view.id} --json`, `${SOURCES2} pull ${view.id} --json`];
+      const next = [`${SOURCES3} test ${view.id} --json`, `${SOURCES3} pull ${view.id} --json`];
       if (isJson) {
         const directive = sourceDirective({ template: "integration_source_added", title: `Trace Source Added — ${view.name}`, fields: sourceFields(view), links, next });
         new OutputFormatter("json").output({ success: true, source: view, _links: links, _directive: directive });
@@ -38809,7 +38854,7 @@ ${WRITE_DIRECTIVE}
         return;
       }
       console.log(chalk66.green(`✓ Added ${view.kind} source ${view.name} (id: ${view.id})`));
-      console.log(`  Next: ${SOURCES2} test ${view.id}`);
+      console.log(`  Next: ${SOURCES3} test ${view.id}`);
     });
   });
 }
@@ -38824,8 +38869,8 @@ async function createSource(body, sandbox) {
 function registerRemove(sources) {
   sources.command("remove").description("Delete a trace source, its credentials, its pulls and their output").argument("<id>", "The source id (from list)").option("-f, --force", "Required: confirms the delete (every mode; there is no prompt)").option("-y, --yes", "Same as --force").addHelpText("after", `
 Examples:
-  ${chalk66.dim("$")} ${SOURCES2} remove src_123 --force
-  ${chalk66.dim("$")} ${SOURCES2} remove src_123 --force --json
+  ${chalk66.dim("$")} ${SOURCES3} remove src_123 --force
+  ${chalk66.dim("$")} ${SOURCES3} remove src_123 --force --json
 
 Destructive: without -f/--force (or --yes) it refuses and sends nothing, in a terminal
 or not, with --json or not. There is no confirmation prompt. Removing a source that is
@@ -38847,7 +38892,7 @@ AI Agent Directive:
           title: `Trace Source Removed — ${id}`,
           fields: { sourceId: id },
           links,
-          next: [`${SOURCES2} list --json`]
+          next: [`${SOURCES3} list --json`]
         });
         new OutputFormatter("json").output({ success: true, removedId: id, _links: links, _directive: directive });
         echoDirectiveToStderr(directive);
@@ -38860,8 +38905,8 @@ AI Agent Directive:
 function registerTest2(sources) {
   sources.command("test").description("Test a source's connection with its stored credentials").argument("<id>", "The source id").addHelpText("after", `
 Examples:
-  ${chalk66.dim("$")} ${SOURCES2} test src_123
-  ${chalk66.dim("$")} ${SOURCES2} test src_123 --json
+  ${chalk66.dim("$")} ${SOURCES3} test src_123
+  ${chalk66.dim("$")} ${SOURCES3} test src_123 --json
 
 One authenticated request from the server to the source; the outcome is recorded as the
 source's last test. A failed test exits 1 and names the check that failed:
@@ -38900,14 +38945,15 @@ In a cloud sandbox:
 function registerRotate(sources) {
   addCredentialOptions(sources.command("rotate").description("Replace a source's credentials (the key version goes up, the last test is cleared)").argument("<id>", "The source id")).addHelpText("after", `
 Examples:
-  ${chalk66.dim("$")} pass show langfuse/sk | ${SOURCES2} rotate src_123 --public-key pk-lf-… --secret-stdin
-  ${chalk66.dim("$")} ${SOURCES2} rotate src_456 --secret-env OO_TOKEN --json
-  ${chalk66.dim("$")} ${SOURCES2} rotate src_456 --email ops@acme.com --secret-stdin
+  ${chalk66.dim("$")} pass show langfuse/sk | ${SOURCES3} rotate src_123 --public-key pk-lf-… --secret-stdin
+  ${chalk66.dim("$")} ${SOURCES3} rotate src_456 --secret-env OO_TOKEN --json
+  ${chalk66.dim("$")} ${SOURCES3} rotate src_456 --email ops@acme.com --secret-stdin
 
 Takes the credentials the source's kind takes (it reads the source's kind first): langfuse
---public-key and a secret key; openobserve --email and a password, or a token. The secret
+--public-key and a secret key; openobserve --email and a password, or a token; dash0 an auth
+token. The secret
 comes from its flag, --secret-env <VAR> or --secret-stdin. Credentials are write-only.
-Next: ${SOURCES2} test <id>.
+Next: ${SOURCES3} test <id>.
 
 ${WRITE_DIRECTIVE}
 `).action(async (id, flags, command) => {
@@ -38923,7 +38969,7 @@ ${WRITE_DIRECTIVE}
       const rotated = await conn.call((i) => i.rotateIntegrationSourceCredentials({ id, body: { credentials } }), { id });
       const view = sourceView(rotated, undefined);
       const links = sourceLinks(id);
-      const next = [`${SOURCES2} test ${id} --json`];
+      const next = [`${SOURCES3} test ${id} --json`];
       if (isJson) {
         const directive = sourceDirective({ template: "integration_source_rotated", title: `Credentials Rotated — ${view.name}`, fields: sourceFields(view), links, next });
         new OutputFormatter("json").output({ success: true, source: view, _links: links, _directive: directive });
@@ -38931,7 +38977,7 @@ ${WRITE_DIRECTIVE}
         return;
       }
       console.log(chalk66.green(`✓ Rotated the credentials of ${view.name} (key version ${String(view.keyVersion)})`));
-      console.log(`  Next: ${SOURCES2} test ${id}`);
+      console.log(`  Next: ${SOURCES3} test ${id}`);
     });
   });
 }
@@ -38946,21 +38992,21 @@ function registerSourceVerbs(sources) {
 // src/commands/integrations/index.ts
 init_errors();
 function createSourcesCommand() {
-  const sources = new Command27("sources").description("Trace sources (Langfuse, OpenObserve): connect, test, rotate, and pull traces into UniTF");
+  const sources = new Command27("sources").description("Trace sources (Langfuse, OpenObserve, Dash0): connect, test, rotate, and pull traces into UniTF");
   registerSourceVerbs(sources);
   registerPullVerbs(sources);
   sources.addHelpText("after", `
 Examples:
-  ${chalk67.dim("$")} ${SOURCES2} list
-  ${chalk67.dim("$")} pass show langfuse/sk | ${SOURCES2} add langfuse --name prod --public-key pk-lf-… --secret-stdin
-  ${chalk67.dim("$")} ${SOURCES2} test <id>
-  ${chalk67.dim("$")} ${SOURCES2} rotate <id> --public-key pk-lf-… --secret-env LANGFUSE_SECRET_KEY
-  ${chalk67.dim("$")} ${SOURCES2} remove <id> --force
-  ${chalk67.dim("$")} ${SOURCES2} pull <id> [--since <iso>] [--until <iso>] [--limit <n>] [--agent-name <n>] [--session-id <s>] [--tag <t>]…
-  ${chalk67.dim("$")} ${SOURCES2} pulls <id>
-  ${chalk67.dim("$")} ${SOURCES2} pull-get <id> <pullId>
-  ${chalk67.dim("$")} ${SOURCES2} pull-manifest <id> <pullId>
-  ${chalk67.dim("$")} ${SOURCES2} pull-traces <id> <pullId> [--out <file>]
+  ${chalk67.dim("$")} ${SOURCES3} list
+  ${chalk67.dim("$")} pass show langfuse/sk | ${SOURCES3} add langfuse --name prod --public-key pk-lf-… --secret-stdin
+  ${chalk67.dim("$")} ${SOURCES3} test <id>
+  ${chalk67.dim("$")} ${SOURCES3} rotate <id> --public-key pk-lf-… --secret-env LANGFUSE_SECRET_KEY
+  ${chalk67.dim("$")} ${SOURCES3} remove <id> --force
+  ${chalk67.dim("$")} ${SOURCES3} pull <id> [--since <iso>] [--until <iso>] [--limit <n>] [--agent-name <n>] [--session-id <s>] [--tag <t>]…
+  ${chalk67.dim("$")} ${SOURCES3} pulls <id>
+  ${chalk67.dim("$")} ${SOURCES3} pull-get <id> <pullId>
+  ${chalk67.dim("$")} ${SOURCES3} pull-manifest <id> <pullId>
+  ${chalk67.dim("$")} ${SOURCES3} pull-traces <id> <pullId> [--out <file>]
 
 Credentials are write-only: they are stored encrypted and no command ever prints them.
 A secret comes from its flag, from --secret-env <VAR>, or from stdin with --secret-stdin.
@@ -38970,12 +39016,12 @@ or 'mutagent workspaces use'.
 ${EXIT_CODES_LINE}
 
 AI Agent Directive:
-  1. Read first: '${SOURCES2} list --json'. Reads need no confirmation.
+  1. Read first: '${SOURCES3} list --json'. Reads need no confirmation.
   2. add, rotate, remove and pull are writes: confirm with the user, then run them
      (remove with --force).
   3. Never ask the user to paste a secret into the chat. Have them run the command in
      their own terminal with --secret-stdin (piped) or --secret-env <VAR>.
-  4. Before trusting pulled traces, check '${SOURCES2} pull-manifest <id> <pullId> --json'
+  4. Before trusting pulled traces, check '${SOURCES3} pull-manifest <id> <pullId> --json'
      coverage.complete.
   5. On an error, run the command in suggestedAction once; never retry blind. When the
      fix names the platform operator, tell the user: it cannot be fixed from here.
@@ -38987,17 +39033,17 @@ function createIntegrationsCommand() {
   integrations.addCommand(createSourcesCommand());
   integrations.addHelpText("after", `
 Groups:
-  sources   Trace sources (Langfuse, OpenObserve) and pulls of their traces into UniTF
+  sources   Trace sources (Langfuse, OpenObserve, Dash0) and pulls of their traces into UniTF
 
 Deploy targets are not available yet: the platform has not built them, so there is no
 command for them. Messaging (GitHub, Slack, events, runs) lives in 'mutagent gateway'.
 
 Examples:
-  ${chalk67.dim("$")} ${SOURCES2} list
-  ${chalk67.dim("$")} ${SOURCES2} --help
+  ${chalk67.dim("$")} ${SOURCES3} list
+  ${chalk67.dim("$")} ${SOURCES3} --help
 
 AI Agent Directive:
-  Start with '${SOURCES2} list --json'. Do not look for a targets command; there is none yet.
+  Start with '${SOURCES3} list --json'. Do not look for a targets command; there is none yet.
 `);
   return integrations;
 }
@@ -44627,4 +44673,4 @@ if (process.env.CLI_VERSION) {
 }
 runCli(process.argv.slice(2), cliVersion);
 
-//# debugId=BBE3EBCBEECE0C5A64756E2164756E21
+//# debugId=B287580A222D152F64756E2164756E21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutagent/cli",
-  "version": "0.2.186",
+  "version": "0.2.187",
   "description": "Bun-native CLI for the MutagenT AI platform - auth, provider config, and lifecycle-tool installer for AI-native workflows",
   "type": "module",
   "bin": {
@@ -94,5 +94,5 @@
   "bugs": {
     "url": "https://docs.mutagent.io/support"
   },
-  "gitHead": "218a081952a0e9fa2990715980a549cc0d49969b"
+  "gitHead": "c93c4ae6a70e14b434b2539724baa9fc64830ab6"
 }