@orizm/cli 2.2.6 → 3.0.0

package/dist/run-with-context-CVhmzAFZ.mjs

@@ -0,0 +1,876 @@
+import { a as notice, i as logger } from "./cli/main.mjs";
+import { n as resolveEnv, t as FileTokenStore } from "./token-store-reCGF86F.mjs";
+import { r as refreshTokens } from "./oauth-client-QHuDa4fW.mjs";
+import { Result } from "@praha/byethrow";
+import * as v from "valibot";
+import { access, mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+//#region src/cli/auth/refresh.ts
+const REFRESH_THRESHOLD_MS = 60 * 1e3;
+var TokenRefresher = class {
+	#store;
+	#inflight = /* @__PURE__ */ new Map();
+	constructor(store) {
+		this.#store = store;
+	}
+	async getValidAccessToken(issuerUrl) {
+		const entry = await this.#store.get(issuerUrl);
+		if (entry === void 0) return Result.fail({ type: "no_token" });
+		if (!isExpiringSoon(entry.expiresAt)) return Result.succeed(entry.accessToken);
+		return this.#toAccessToken(this.#refreshOnce(issuerUrl));
+	}
+	async forceRefresh(issuerUrl) {
+		return this.#toAccessToken(this.#refreshOnce(issuerUrl));
+	}
+	async #toAccessToken(pending) {
+		const result = await pending;
+		if (Result.isFailure(result)) return result;
+		return Result.succeed(result.value.accessToken);
+	}
+	#refreshOnce(issuerUrl) {
+		const existing = this.#inflight.get(issuerUrl);
+		if (existing !== void 0) return existing;
+		const pending = this.#doRefresh(issuerUrl).finally(() => this.#inflight.delete(issuerUrl));
+		this.#inflight.set(issuerUrl, pending);
+		return pending;
+	}
+	async #doRefresh(issuerUrl) {
+		const entry = await this.#store.get(issuerUrl);
+		if (entry === void 0) return Result.fail({ type: "no_token" });
+		const refreshed = await refreshTokens({
+			issuerUrl,
+			refreshToken: entry.refreshToken
+		});
+		if (Result.isFailure(refreshed)) {
+			await this.#store.remove(issuerUrl);
+			return Result.fail({
+				type: "refresh_failed",
+				reason: refreshed.error.reason
+			});
+		}
+		const updated = {
+			...entry,
+			accessToken: refreshed.value.accessToken,
+			refreshToken: refreshed.value.refreshToken,
+			idToken: refreshed.value.idToken,
+			scope: refreshed.value.scope,
+			expiresAt: refreshed.value.expiresAt
+		};
+		await this.#store.set(issuerUrl, updated);
+		return Result.succeed(updated);
+	}
+};
+function isExpiringSoon(expiresAt) {
+	return Date.parse(expiresAt) - Date.now() <= REFRESH_THRESHOLD_MS;
+}
+
+//#endregion
+//#region src/cli/context/project.ts
+const ProjectFileSchema = v.object({
+	projectName: v.pipe(v.string(), v.nonEmpty()),
+	organizationName: v.optional(v.pipe(v.string(), v.nonEmpty()))
+});
+async function readNearestProjectFile(cwd = process.cwd()) {
+	let dir = path.resolve(cwd);
+	for (;;) {
+		const file = path.join(dir, ".orizm", "project.json");
+		const raw = await readFile(file, "utf-8").catch((error) => {
+			if (error.code === "ENOENT") return void 0;
+			throw error;
+		});
+		if (raw !== void 0) {
+			const parsed = v.safeParse(ProjectFileSchema, safeJsonParse(raw));
+			if (!parsed.success) return Result.fail({
+				type: "project_json_invalid",
+				path: file
+			});
+			return Result.succeed({
+				path: file,
+				context: parsed.output
+			});
+		}
+		const parent = path.dirname(dir);
+		if (parent === dir) return Result.succeed(void 0);
+		dir = parent;
+	}
+}
+async function resolveProjectName(params) {
+	if (params.flag != null && params.flag !== "") return Result.succeed(params.flag);
+	if (params.env != null && params.env !== "") return Result.succeed(params.env);
+	const found = await readNearestProjectFile(params.cwd);
+	if (Result.isFailure(found)) return found;
+	if (found.value === void 0) return Result.fail({ type: "no_project_context" });
+	return Result.succeed(found.value.context.projectName);
+}
+async function resolveOrganizationName(params) {
+	if (params.flag != null && params.flag !== "") return Result.succeed(params.flag);
+	const found = await readNearestProjectFile(params.cwd);
+	if (Result.isFailure(found)) return found;
+	const organizationName = found.value?.context.organizationName;
+	if (organizationName == null || organizationName === "") return Result.fail({ type: "no_organization_context" });
+	return Result.succeed(organizationName);
+}
+async function resolveLinkDirectory(cwd = process.cwd()) {
+	let dir = path.resolve(cwd);
+	for (;;) {
+		if (await access(path.join(dir, ".orizm", "project.json")).then(() => true, () => false)) return dir;
+		const parent = path.dirname(dir);
+		if (parent === dir) return path.resolve(cwd);
+		dir = parent;
+	}
+}
+async function readProjectFileAt(dir) {
+	const raw = await readFile(path.join(path.resolve(dir), ".orizm", "project.json"), "utf-8").catch((error) => {
+		if (error.code === "ENOENT") return void 0;
+		throw error;
+	});
+	if (raw === void 0) return void 0;
+	const parsed = v.safeParse(ProjectFileSchema, safeJsonParse(raw));
+	return parsed.success ? parsed.output : void 0;
+}
+async function writeProjectFile(dir, context) {
+	const orizmDir = path.join(path.resolve(dir), ".orizm");
+	await mkdir(orizmDir, { recursive: true });
+	const file = path.join(orizmDir, "project.json");
+	await writeFile(file, JSON.stringify(context, null, 2) + "\n", "utf-8");
+	return file;
+}
+function safeJsonParse(raw) {
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return;
+	}
+}
+
+//#endregion
+//#region src/cli/credentials/resolve.ts
+async function resolveCredentials(params) {
+	if (await params.store.get(params.issuerUrl) !== void 0) return Result.succeed({
+		type: "bearer",
+		issuerUrl: params.issuerUrl
+	});
+	if (params.apiKey !== void 0) return Result.succeed({
+		type: "api-key",
+		apiKey: params.apiKey
+	});
+	return Result.fail({ type: "no_credentials" });
+}
+
+//#endregion
+//#region ../internal-shared/dist/assert-valid-url-origin-XeiLzH_m.mjs
+const PATH_PARAM_RE = /\{[^{}]+\}/g;
+const supportsRequestInitExt = () => {
+	return typeof process === "object" && Number.parseInt(process?.versions?.node?.substring(0, 2)) >= 18 && process.versions.undici;
+};
+function randomID() {
+	return Math.random().toString(36).slice(2, 11);
+}
+function createClient(clientOptions) {
+	let { baseUrl = "", Request: CustomRequest = globalThis.Request, fetch: baseFetch = globalThis.fetch, querySerializer: globalQuerySerializer, bodySerializer: globalBodySerializer, pathSerializer: globalPathSerializer, headers: baseHeaders, requestInitExt = void 0, ...baseOptions } = { ...clientOptions };
+	requestInitExt = supportsRequestInitExt() ? requestInitExt : void 0;
+	baseUrl = removeTrailingSlash(baseUrl);
+	const globalMiddlewares = [];
+	async function coreFetch(schemaPath, fetchOptions) {
+		const { baseUrl: localBaseUrl, fetch = baseFetch, Request = CustomRequest, headers, params = {}, parseAs = "json", querySerializer: requestQuerySerializer, bodySerializer = globalBodySerializer ?? defaultBodySerializer, pathSerializer: requestPathSerializer, body, middleware: requestMiddlewares = [], ...init } = fetchOptions || {};
+		let finalBaseUrl = baseUrl;
+		if (localBaseUrl) finalBaseUrl = removeTrailingSlash(localBaseUrl) ?? baseUrl;
+		let querySerializer = typeof globalQuerySerializer === "function" ? globalQuerySerializer : createQuerySerializer(globalQuerySerializer);
+		if (requestQuerySerializer) querySerializer = typeof requestQuerySerializer === "function" ? requestQuerySerializer : createQuerySerializer({
+			...typeof globalQuerySerializer === "object" ? globalQuerySerializer : {},
+			...requestQuerySerializer
+		});
+		const pathSerializer = requestPathSerializer || globalPathSerializer || defaultPathSerializer;
+		const serializedBody = body === void 0 ? void 0 : bodySerializer(body, mergeHeaders(baseHeaders, headers, params.header));
+		const finalHeaders = mergeHeaders(serializedBody === void 0 || serializedBody instanceof FormData ? {} : { "Content-Type": "application/json" }, baseHeaders, headers, params.header);
+		const finalMiddlewares = [...globalMiddlewares, ...requestMiddlewares];
+		const requestInit = {
+			redirect: "follow",
+			...baseOptions,
+			...init,
+			body: serializedBody,
+			headers: finalHeaders
+		};
+		let id;
+		let options;
+		let request = new Request(createFinalURL(schemaPath, {
+			baseUrl: finalBaseUrl,
+			params,
+			querySerializer,
+			pathSerializer
+		}), requestInit);
+		let response;
+		for (const key in init) if (!(key in request)) request[key] = init[key];
+		if (finalMiddlewares.length) {
+			id = randomID();
+			options = Object.freeze({
+				baseUrl: finalBaseUrl,
+				fetch,
+				parseAs,
+				querySerializer,
+				bodySerializer,
+				pathSerializer
+			});
+			for (const m of finalMiddlewares) if (m && typeof m === "object" && typeof m.onRequest === "function") {
+				const result = await m.onRequest({
+					request,
+					schemaPath,
+					params,
+					options,
+					id
+				});
+				if (result) if (result instanceof Request) request = result;
+				else if (result instanceof Response) {
+					response = result;
+					break;
+				} else throw new Error("onRequest: must return new Request() or Response() when modifying the request");
+			}
+		}
+		if (!response) {
+			try {
+				response = await fetch(request, requestInitExt);
+			} catch (error2) {
+				let errorAfterMiddleware = error2;
+				if (finalMiddlewares.length) for (let i = finalMiddlewares.length - 1; i >= 0; i--) {
+					const m = finalMiddlewares[i];
+					if (m && typeof m === "object" && typeof m.onError === "function") {
+						const result = await m.onError({
+							request,
+							error: errorAfterMiddleware,
+							schemaPath,
+							params,
+							options,
+							id
+						});
+						if (result) {
+							if (result instanceof Response) {
+								errorAfterMiddleware = void 0;
+								response = result;
+								break;
+							}
+							if (result instanceof Error) {
+								errorAfterMiddleware = result;
+								continue;
+							}
+							throw new Error("onError: must return new Response() or instance of Error");
+						}
+					}
+				}
+				if (errorAfterMiddleware) throw errorAfterMiddleware;
+			}
+			if (finalMiddlewares.length) for (let i = finalMiddlewares.length - 1; i >= 0; i--) {
+				const m = finalMiddlewares[i];
+				if (m && typeof m === "object" && typeof m.onResponse === "function") {
+					const result = await m.onResponse({
+						request,
+						response,
+						schemaPath,
+						params,
+						options,
+						id
+					});
+					if (result) {
+						if (!(result instanceof Response)) throw new Error("onResponse: must return new Response() when modifying the response");
+						response = result;
+					}
+				}
+			}
+		}
+		const contentLength = response.headers.get("Content-Length");
+		if (response.status === 204 || request.method === "HEAD" || contentLength === "0" && !response.headers.get("Transfer-Encoding")?.includes("chunked")) return response.ok ? {
+			data: void 0,
+			response
+		} : {
+			error: void 0,
+			response
+		};
+		if (response.ok) {
+			const getResponseData = async () => {
+				if (parseAs === "stream") return response.body;
+				if (parseAs === "json" && !contentLength) {
+					const raw = await response.text();
+					return raw ? JSON.parse(raw) : void 0;
+				}
+				return await response[parseAs]();
+			};
+			return {
+				data: await getResponseData(),
+				response
+			};
+		}
+		let error = await response.text();
+		try {
+			error = JSON.parse(error);
+		} catch {}
+		return {
+			error,
+			response
+		};
+	}
+	return {
+		request(method, url, init) {
+			return coreFetch(url, {
+				...init,
+				method: method.toUpperCase()
+			});
+		},
+		/** Call a GET endpoint */
+		GET(url, init) {
+			return coreFetch(url, {
+				...init,
+				method: "GET"
+			});
+		},
+		/** Call a PUT endpoint */
+		PUT(url, init) {
+			return coreFetch(url, {
+				...init,
+				method: "PUT"
+			});
+		},
+		/** Call a POST endpoint */
+		POST(url, init) {
+			return coreFetch(url, {
+				...init,
+				method: "POST"
+			});
+		},
+		/** Call a DELETE endpoint */
+		DELETE(url, init) {
+			return coreFetch(url, {
+				...init,
+				method: "DELETE"
+			});
+		},
+		/** Call a OPTIONS endpoint */
+		OPTIONS(url, init) {
+			return coreFetch(url, {
+				...init,
+				method: "OPTIONS"
+			});
+		},
+		/** Call a HEAD endpoint */
+		HEAD(url, init) {
+			return coreFetch(url, {
+				...init,
+				method: "HEAD"
+			});
+		},
+		/** Call a PATCH endpoint */
+		PATCH(url, init) {
+			return coreFetch(url, {
+				...init,
+				method: "PATCH"
+			});
+		},
+		/** Call a TRACE endpoint */
+		TRACE(url, init) {
+			return coreFetch(url, {
+				...init,
+				method: "TRACE"
+			});
+		},
+		/** Register middleware */
+		use(...middleware) {
+			for (const m of middleware) {
+				if (!m) continue;
+				if (typeof m !== "object" || !("onRequest" in m || "onResponse" in m || "onError" in m)) throw new Error("Middleware must be an object with one of `onRequest()`, `onResponse() or `onError()`");
+				globalMiddlewares.push(m);
+			}
+		},
+		/** Unregister middleware */
+		eject(...middleware) {
+			for (const m of middleware) {
+				const i = globalMiddlewares.indexOf(m);
+				if (i !== -1) globalMiddlewares.splice(i, 1);
+			}
+		}
+	};
+}
+function serializePrimitiveParam(name, value, options) {
+	if (value === void 0 || value === null) return "";
+	if (typeof value === "object") throw new Error("Deeply-nested arrays/objects aren’t supported. Provide your own `querySerializer()` to handle these.");
+	return `${name}=${options?.allowReserved === true ? value : encodeURIComponent(value)}`;
+}
+function serializeObjectParam(name, value, options) {
+	if (!value || typeof value !== "object") return "";
+	const values = [];
+	const joiner = {
+		simple: ",",
+		label: ".",
+		matrix: ";"
+	}[options.style] || "&";
+	if (options.style !== "deepObject" && options.explode === false) {
+		for (const k in value) values.push(k, options.allowReserved === true ? value[k] : encodeURIComponent(value[k]));
+		const final2 = values.join(",");
+		switch (options.style) {
+			case "form": return `${name}=${final2}`;
+			case "label": return `.${final2}`;
+			case "matrix": return `;${name}=${final2}`;
+			default: return final2;
+		}
+	}
+	for (const k in value) {
+		const finalName = options.style === "deepObject" ? `${name}[${k}]` : k;
+		values.push(serializePrimitiveParam(finalName, value[k], options));
+	}
+	const final = values.join(joiner);
+	return options.style === "label" || options.style === "matrix" ? `${joiner}${final}` : final;
+}
+function serializeArrayParam(name, value, options) {
+	if (!Array.isArray(value)) return "";
+	if (options.explode === false) {
+		const joiner2 = {
+			form: ",",
+			spaceDelimited: "%20",
+			pipeDelimited: "|"
+		}[options.style] || ",";
+		const final = (options.allowReserved === true ? value : value.map((v) => encodeURIComponent(v))).join(joiner2);
+		switch (options.style) {
+			case "simple": return final;
+			case "label": return `.${final}`;
+			case "matrix": return `;${name}=${final}`;
+			default: return `${name}=${final}`;
+		}
+	}
+	const joiner = {
+		simple: ",",
+		label: ".",
+		matrix: ";"
+	}[options.style] || "&";
+	const values = [];
+	for (const v of value) if (options.style === "simple" || options.style === "label") values.push(options.allowReserved === true ? v : encodeURIComponent(v));
+	else values.push(serializePrimitiveParam(name, v, options));
+	return options.style === "label" || options.style === "matrix" ? `${joiner}${values.join(joiner)}` : values.join(joiner);
+}
+function createQuerySerializer(options) {
+	return function querySerializer(queryParams) {
+		const search = [];
+		if (queryParams && typeof queryParams === "object") for (const name in queryParams) {
+			const value = queryParams[name];
+			if (value === void 0 || value === null) continue;
+			if (Array.isArray(value)) {
+				if (value.length === 0) continue;
+				search.push(serializeArrayParam(name, value, {
+					style: "form",
+					explode: true,
+					...options?.array,
+					allowReserved: options?.allowReserved || false
+				}));
+				continue;
+			}
+			if (typeof value === "object") {
+				search.push(serializeObjectParam(name, value, {
+					style: "deepObject",
+					explode: true,
+					...options?.object,
+					allowReserved: options?.allowReserved || false
+				}));
+				continue;
+			}
+			search.push(serializePrimitiveParam(name, value, options));
+		}
+		return search.join("&");
+	};
+}
+function defaultPathSerializer(pathname, pathParams) {
+	let nextURL = pathname;
+	for (const match of pathname.match(PATH_PARAM_RE) ?? []) {
+		let name = match.substring(1, match.length - 1);
+		let explode = false;
+		let style = "simple";
+		if (name.endsWith("*")) {
+			explode = true;
+			name = name.substring(0, name.length - 1);
+		}
+		if (name.startsWith(".")) {
+			style = "label";
+			name = name.substring(1);
+		} else if (name.startsWith(";")) {
+			style = "matrix";
+			name = name.substring(1);
+		}
+		if (!pathParams || pathParams[name] === void 0 || pathParams[name] === null) continue;
+		const value = pathParams[name];
+		if (Array.isArray(value)) {
+			nextURL = nextURL.replace(match, serializeArrayParam(name, value, {
+				style,
+				explode
+			}));
+			continue;
+		}
+		if (typeof value === "object") {
+			nextURL = nextURL.replace(match, serializeObjectParam(name, value, {
+				style,
+				explode
+			}));
+			continue;
+		}
+		if (style === "matrix") {
+			nextURL = nextURL.replace(match, `;${serializePrimitiveParam(name, value)}`);
+			continue;
+		}
+		nextURL = nextURL.replace(match, style === "label" ? `.${encodeURIComponent(value)}` : encodeURIComponent(value));
+	}
+	return nextURL;
+}
+function defaultBodySerializer(body, headers) {
+	if (body instanceof FormData) return body;
+	if (headers) {
+		if ((headers.get instanceof Function ? headers.get("Content-Type") ?? headers.get("content-type") : headers["Content-Type"] ?? headers["content-type"]) === "application/x-www-form-urlencoded") return new URLSearchParams(body).toString();
+	}
+	return JSON.stringify(body);
+}
+function createFinalURL(pathname, options) {
+	let finalURL = `${options.baseUrl}${pathname}`;
+	if (options.params?.path) finalURL = options.pathSerializer(finalURL, options.params.path);
+	let search = options.querySerializer(options.params.query ?? {});
+	if (search.startsWith("?")) search = search.substring(1);
+	if (search) finalURL += `?${search}`;
+	return finalURL;
+}
+function mergeHeaders(...allHeaders) {
+	const finalHeaders = new Headers();
+	for (const h of allHeaders) {
+		if (!h || typeof h !== "object") continue;
+		const iterator = h instanceof Headers ? h.entries() : Object.entries(h);
+		for (const [k, v] of iterator) if (v === null) finalHeaders.delete(k);
+		else if (Array.isArray(v)) for (const v2 of v) finalHeaders.append(k, v2);
+		else if (v !== void 0) finalHeaders.set(k, v);
+	}
+	return finalHeaders;
+}
+function removeTrailingSlash(url) {
+	if (url.endsWith("/")) return url.substring(0, url.length - 1);
+	return url;
+}
+function assertValidUrlOrigin(origin) {
+	if (new URL(origin).origin !== origin) throw new Error(`${origin} is not a valid URL origin`);
+}
+
+//#endregion
+//#region ../internal-shared/dist/api-clients/dev-v2-api-client.mjs
+function createDeveloperAPIv2Client({ serverOrigin = "", fetch, headers }) {
+	if (serverOrigin) assertValidUrlOrigin(serverOrigin);
+	return createClient({
+		baseUrl: `${serverOrigin}/api/dev/v2`,
+		fetch,
+		headers
+	});
+}
+
+//#endregion
+//#region src/cli/api/client.ts
+function createAuthenticatedClient(params) {
+	const authFetch = buildAuthFetch(params.credentials, params.refresher);
+	return createDeveloperAPIv2Client({
+		serverOrigin: params.baseUrl,
+		fetch: authFetch
+	});
+}
+function buildAuthFetch(credentials, refresher) {
+	if (credentials.type === "api-key") {
+		const { apiKey } = credentials;
+		return async (input, init) => {
+			const request = new Request(input, init);
+			request.headers.set("x-api-key", apiKey);
+			return globalThis.fetch(request);
+		};
+	}
+	const { issuerUrl } = credentials;
+	return async (input, init) => {
+		const token = await refresher.getValidAccessToken(issuerUrl);
+		if (Result.isFailure(token)) return unauthorizedResponse();
+		const request = new Request(input, init);
+		const retryRequest = request.clone();
+		request.headers.set("Authorization", `Bearer ${token.value}`);
+		const first = await globalThis.fetch(request);
+		if (first.status !== 401) return first;
+		const refreshed = await refresher.forceRefresh(issuerUrl);
+		if (Result.isFailure(refreshed)) return first;
+		retryRequest.headers.set("Authorization", `Bearer ${refreshed.value}`);
+		return globalThis.fetch(retryRequest);
+	};
+}
+function unauthorizedResponse() {
+	return new Response(JSON.stringify({
+		type: "unauthorized",
+		title: "Unauthorized",
+		detail: "Authentication is required. Run `orizm auth login`."
+	}), {
+		status: 401,
+		headers: { "content-type": "application/json" }
+	});
+}
+
+//#endregion
+//#region src/cli/api/errors.ts
+const ProblemSchema = v.object({
+	type: v.string(),
+	title: v.string(),
+	detail: v.string(),
+	fields: v.optional(v.array(v.union([v.string(), v.object({
+		field: v.string(),
+		message: v.string()
+	})])))
+});
+function isSuccess(result) {
+	return result.response.ok && result.error === void 0;
+}
+function toResult(result) {
+	if (result.response.status >= 500) throw new Error(`Server responded with ${result.response.status}`);
+	if (!isSuccess(result)) return failFromProblem(result.error, result.response);
+	return {
+		type: "Success",
+		value: result.data
+	};
+}
+function failFromProblem(error, response) {
+	const problem = v.safeParse(ProblemSchema, error);
+	if (!problem.success) throw new Error(`Unexpected API response (status ${response.status})`);
+	const apiError = toApiError(problem.output);
+	if (apiError === void 0) throw new Error(`Unhandled API error type: ${problem.output.type}`);
+	return Result.fail(apiError);
+}
+function toApiError(problem) {
+	switch (problem.type) {
+		case "bad-request": return {
+			type: "bad_request",
+			detail: problem.detail,
+			fields: objectFields(problem.fields)
+		};
+		case "unauthorized": return {
+			type: "unauthorized",
+			detail: problem.detail
+		};
+		case "forbidden": return {
+			type: "forbidden",
+			detail: problem.detail
+		};
+		case "not-found": return {
+			type: "not_found",
+			detail: problem.detail
+		};
+		case "conflict": return {
+			type: "conflict",
+			detail: problem.detail
+		};
+		default: return;
+	}
+}
+function objectFields(fields) {
+	if (fields === void 0) return [];
+	return fields.filter((field) => typeof field !== "string");
+}
+
+//#endregion
+//#region src/cli/api/organizations.ts
+async function fetchOrganizations(client) {
+	return toResult(await client.GET("/organizations"));
+}
+async function resolveOrganizationId(client, name) {
+	const organizations = await fetchOrganizations(client);
+	if (Result.isFailure(organizations)) return organizations;
+	const matched = organizations.value.find((org) => org.name === name);
+	if (matched === void 0) return Result.fail({
+		type: "organization_not_found",
+		name
+	});
+	return Result.succeed(matched.id);
+}
+
+//#endregion
+//#region src/cli/context/gitignore.ts
+const ENTRY = ".orizm/";
+function gitignoreHasEntry(content) {
+	return content.split(/\r?\n/).map((line) => line.trim()).some((line) => line === ".orizm" || line === ".orizm/");
+}
+function enoentToUndefined(error) {
+	if (error.code === "ENOENT") return void 0;
+	throw error;
+}
+async function gitignoreContainsEntry(dir) {
+	const existing = await readFile(path.join(dir, ".gitignore"), "utf-8").catch(enoentToUndefined);
+	return existing !== void 0 && gitignoreHasEntry(existing);
+}
+async function appendGitignoreEntry(dir) {
+	const file = path.join(dir, ".gitignore");
+	const existing = await readFile(file, "utf-8").catch(enoentToUndefined);
+	await writeFile(file, `${existing == null || existing === "" || existing.endsWith("\n") ? existing ?? "" : existing + "\n"}${ENTRY}\n`, "utf-8");
+}
+
+//#endregion
+//#region src/cli/ui/prompt.ts
+async function confirm(message, initial = false) {
+	return await logger.prompt(message, {
+		type: "confirm",
+		initial
+	}) === true;
+}
+async function promptText(message) {
+	const answer = await logger.prompt(message, { type: "text" });
+	return typeof answer === "string" ? answer : void 0;
+}
+async function select(message, options) {
+	const answer = await logger.prompt(message, {
+		type: "select",
+		options,
+		cancel: "null"
+	});
+	return typeof answer === "string" ? answer : void 0;
+}
+
+//#endregion
+//#region src/cli/commands/api-errors.ts
+function apiErrorFailure(error) {
+	switch (error.type) {
+		case "bad_request": {
+			const fieldLines = error.fields.map((field) => `\n  - ${field.field}: ${field.message}`);
+			return Result.fail({ message: `${error.detail}${fieldLines.join("")}` });
+		}
+		case "unauthorized": return Result.fail({ message: `Not authorized: ${error.detail}. Run \`orizm auth login\` or check ORIZM_API_KEY.` });
+		case "forbidden": return Result.fail({ message: `Forbidden: ${error.detail}` });
+		case "not_found": return Result.fail({ message: `Not found: ${error.detail}` });
+		case "conflict": return Result.fail({ message: `Conflict: ${error.detail}` });
+	}
+}
+
+//#endregion
+//#region src/cli/commands/link-flow.ts
+async function runLinkFlow(ctx, options) {
+	const linkDir = await resolveLinkDirectory(options.cwd);
+	const existing = await readProjectFileAt(linkDir);
+	if (existing !== void 0) {
+		if (!await options.prompts.confirmOverwrite(existing)) return Result.succeed({ linked: false });
+	}
+	const organizations = await fetchOrganizations(ctx.client);
+	if (Result.isFailure(organizations)) return apiErrorFailure(organizations.error);
+	if (organizations.value.length === 0) return Result.fail({ message: "You do not belong to any organization." });
+	const organization = await options.prompts.selectOrganization(organizations.value);
+	if (organization === void 0) return Result.succeed({ linked: false });
+	const projects = toResult(await ctx.client.GET("/projects", { params: { query: { organizationId: organization.id } } }));
+	if (Result.isFailure(projects)) return apiErrorFailure(projects.error);
+	if (projects.value.length === 0) return Result.fail({ message: `Organization "${organization.name}" has no projects.` });
+	const project = await options.prompts.selectProject(projects.value);
+	if (project === void 0) return Result.succeed({ linked: false });
+	const file = await writeProjectFile(linkDir, {
+		projectName: project.name,
+		organizationName: organization.name
+	});
+	const gitignoreNote = await ensureGitignore(linkDir, options.prompts.confirmGitignore);
+	return Result.succeed({
+		linked: true,
+		projectName: project.name,
+		organizationName: organization.name,
+		file,
+		gitignoreNote
+	});
+}
+async function ensureGitignore(linkDir, confirmGitignore) {
+	if (await gitignoreContainsEntry(linkDir)) return "";
+	if (!await confirmGitignore()) return "Skipped updating .gitignore. Consider ignoring .orizm/ yourself.";
+	await appendGitignoreEntry(linkDir);
+	return "Added .orizm/ to .gitignore.";
+}
+async function promptSelectFromList(items, message, label, value) {
+	const selected = await select(message, items.map((item) => ({
+		label: label(item),
+		value: value(item)
+	})));
+	if (selected === void 0) return void 0;
+	return items.find((item) => value(item) === selected);
+}
+function defaultLinkPrompts() {
+	return {
+		confirmOverwrite: (existing) => confirm(`This directory is already linked to "${existing.projectName}". Overwrite?`, false),
+		selectOrganization: (organizations) => promptSelectFromList(organizations, "Select an organization:", (organization) => `${organization.displayName} (${organization.name})`, (organization) => organization.name),
+		selectProject: (projects) => promptSelectFromList(projects, "Select a project:", (project) => `${project.displayName} (${project.name})`, (project) => project.name),
+		confirmGitignore: () => confirm("Add .orizm/ to .gitignore?", true)
+	};
+}
+
+//#endregion
+//#region src/cli/commands/run-with-context.ts
+async function resolveAuth(options) {
+	const env = resolveEnv(options.envSource);
+	if (Result.isFailure(env)) return Result.fail({ message: "Invalid environment variable configuration for Orizm." });
+	const store = options.store ?? new FileTokenStore();
+	const refresher = new TokenRefresher(store);
+	const credentials = await resolveCredentials({
+		store,
+		issuerUrl: env.value.issuerUrl,
+		apiKey: env.value.apiKey
+	});
+	if (Result.isFailure(credentials)) return Result.fail({ message: "Not authenticated. Run `orizm auth login`, or set ORIZM_API_KEY." });
+	if (credentials.value.type === "bearer") {
+		const token = await refresher.getValidAccessToken(env.value.issuerUrl);
+		if (Result.isFailure(token)) return Result.fail({ message: "Your session has expired or was revoked. Run `orizm auth login` to sign in again." });
+	}
+	const client = createAuthenticatedClient({
+		baseUrl: env.value.baseUrl,
+		credentials: credentials.value,
+		refresher
+	});
+	return Result.succeed({
+		context: {
+			baseUrl: env.value.baseUrl,
+			client
+		},
+		env: env.value
+	});
+}
+async function runWithAuth(handler, options = {}) {
+	const auth = await resolveAuth(options);
+	if (Result.isFailure(auth)) return auth;
+	return handler(auth.value.context);
+}
+async function runWithContext(args, handler, options = {}) {
+	const auth = await resolveAuth(options);
+	if (Result.isFailure(auth)) return auth;
+	const project = await resolveProjectName({
+		flag: typeof args.project === "string" ? args.project : void 0,
+		env: auth.value.env.project,
+		cwd: options.cwd
+	});
+	if (Result.isFailure(project)) {
+		if (project.error.type === "no_project_context") {
+			const linked = await tryInteractiveLink(auth.value.context, options);
+			if (linked !== void 0) {
+				if (Result.isFailure(linked)) return linked;
+				return handler({
+					...auth.value.context,
+					projectName: linked.value
+				});
+			}
+		}
+		return Result.fail(projectContextFailure(project.error));
+	}
+	return handler({
+		...auth.value.context,
+		projectName: project.value
+	});
+}
+async function tryInteractiveLink(ctx, options) {
+	if (!(options.isTTY ?? process.stdin.isTTY === true)) return void 0;
+	notice("No project is linked to this directory yet. Select one to continue.");
+	const flow = await runLinkFlow(ctx, {
+		cwd: options.cwd ?? process.cwd(),
+		prompts: options.linkPrompts ?? defaultLinkPrompts()
+	});
+	if (Result.isFailure(flow)) return flow;
+	if (!flow.value.linked) return Result.fail(projectContextFailure({ type: "no_project_context" }));
+	notice(`Linked to project ${flow.value.projectName} (organization ${flow.value.organizationName}).`);
+	if (flow.value.gitignoreNote !== "") notice(flow.value.gitignoreNote);
+	return Result.succeed(flow.value.projectName);
+}
+function projectContextFailure(error) {
+	switch (error.type) {
+		case "project_json_invalid": return { message: `Invalid project file: ${error.path}` };
+		case "no_project_context": return { message: "No project selected. Run `orizm link`, pass --project <name>, or set ORIZM_PROJECT." };
+	}
+}
+
+//#endregion
+export { apiErrorFailure as a, fetchOrganizations as c, resolveOrganizationName as d, runLinkFlow as i, resolveOrganizationId as l, runWithContext as n, confirm as o, defaultLinkPrompts as r, promptText as s, runWithAuth as t, toResult as u };
+//# sourceMappingURL=run-with-context-CVhmzAFZ.mjs.map