@orizm/cli 2.2.7 → 3.0.1

package/dist/run-with-context-DJNnEigg.cjs

@@ -0,0 +1,943 @@
+const require_cli_main = require('./cli/main.cjs');
+const require_token_store = require('./token-store--9GYVL7N.cjs');
+const require_oauth_client = require('./oauth-client-CdD0evAV.cjs');
+let _praha_byethrow = require("@praha/byethrow");
+let valibot = require("valibot");
+valibot = require_cli_main.__toESM(valibot, 1);
+let node_fs_promises = require("node:fs/promises");
+let node_path = require("node:path");
+node_path = require_cli_main.__toESM(node_path, 1);
+
+//#region src/cli/auth/refresh.ts
+const REFRESH_THRESHOLD_MS = 60 * 1e3;
+var TokenRefresher = class {
+	#store;
+	#inflight = /* @__PURE__ */ new Map();
+	constructor(store) {
+		this.#store = store;
+	}
+	async getValidAccessToken(issuerUrl) {
+		const entry = await this.#store.get(issuerUrl);
+		if (entry === void 0) return _praha_byethrow.Result.fail({ type: "no_token" });
+		if (!isExpiringSoon(entry.expiresAt)) return _praha_byethrow.Result.succeed(entry.accessToken);
+		return this.#toAccessToken(this.#refreshOnce(issuerUrl));
+	}
+	async forceRefresh(issuerUrl) {
+		return this.#toAccessToken(this.#refreshOnce(issuerUrl));
+	}
+	async #toAccessToken(pending) {
+		const result = await pending;
+		if (_praha_byethrow.Result.isFailure(result)) return result;
+		return _praha_byethrow.Result.succeed(result.value.accessToken);
+	}
+	#refreshOnce(issuerUrl) {
+		const existing = this.#inflight.get(issuerUrl);
+		if (existing !== void 0) return existing;
+		const pending = this.#doRefresh(issuerUrl).finally(() => this.#inflight.delete(issuerUrl));
+		this.#inflight.set(issuerUrl, pending);
+		return pending;
+	}
+	async #doRefresh(issuerUrl) {
+		const entry = await this.#store.get(issuerUrl);
+		if (entry === void 0) return _praha_byethrow.Result.fail({ type: "no_token" });
+		const refreshed = await require_oauth_client.refreshTokens({
+			issuerUrl,
+			refreshToken: entry.refreshToken
+		});
+		if (_praha_byethrow.Result.isFailure(refreshed)) {
+			await this.#store.remove(issuerUrl);
+			return _praha_byethrow.Result.fail({
+				type: "refresh_failed",
+				reason: refreshed.error.reason
+			});
+		}
+		const updated = {
+			...entry,
+			accessToken: refreshed.value.accessToken,
+			refreshToken: refreshed.value.refreshToken,
+			idToken: refreshed.value.idToken,
+			scope: refreshed.value.scope,
+			expiresAt: refreshed.value.expiresAt
+		};
+		await this.#store.set(issuerUrl, updated);
+		return _praha_byethrow.Result.succeed(updated);
+	}
+};
+function isExpiringSoon(expiresAt) {
+	return Date.parse(expiresAt) - Date.now() <= REFRESH_THRESHOLD_MS;
+}
+
+//#endregion
+//#region src/cli/context/project.ts
+const ProjectFileSchema = valibot.object({
+	projectName: valibot.pipe(valibot.string(), valibot.nonEmpty()),
+	organizationName: valibot.optional(valibot.pipe(valibot.string(), valibot.nonEmpty()))
+});
+async function readNearestProjectFile(cwd = process.cwd()) {
+	let dir = node_path.default.resolve(cwd);
+	for (;;) {
+		const file = node_path.default.join(dir, ".orizm", "project.json");
+		const raw = await (0, node_fs_promises.readFile)(file, "utf-8").catch((error) => {
+			if (error.code === "ENOENT") return void 0;
+			throw error;
+		});
+		if (raw !== void 0) {
+			const parsed = valibot.safeParse(ProjectFileSchema, safeJsonParse(raw));
+			if (!parsed.success) return _praha_byethrow.Result.fail({
+				type: "project_json_invalid",
+				path: file
+			});
+			return _praha_byethrow.Result.succeed({
+				path: file,
+				context: parsed.output
+			});
+		}
+		const parent = node_path.default.dirname(dir);
+		if (parent === dir) return _praha_byethrow.Result.succeed(void 0);
+		dir = parent;
+	}
+}
+async function resolveProjectName(params) {
+	if (params.flag != null && params.flag !== "") return _praha_byethrow.Result.succeed(params.flag);
+	if (params.env != null && params.env !== "") return _praha_byethrow.Result.succeed(params.env);
+	const found = await readNearestProjectFile(params.cwd);
+	if (_praha_byethrow.Result.isFailure(found)) return found;
+	if (found.value === void 0) return _praha_byethrow.Result.fail({ type: "no_project_context" });
+	return _praha_byethrow.Result.succeed(found.value.context.projectName);
+}
+async function resolveOrganizationName(params) {
+	if (params.flag != null && params.flag !== "") return _praha_byethrow.Result.succeed(params.flag);
+	const found = await readNearestProjectFile(params.cwd);
+	if (_praha_byethrow.Result.isFailure(found)) return found;
+	const organizationName = found.value?.context.organizationName;
+	if (organizationName == null || organizationName === "") return _praha_byethrow.Result.fail({ type: "no_organization_context" });
+	return _praha_byethrow.Result.succeed(organizationName);
+}
+async function resolveLinkDirectory(cwd = process.cwd()) {
+	let dir = node_path.default.resolve(cwd);
+	for (;;) {
+		if (await (0, node_fs_promises.access)(node_path.default.join(dir, ".orizm", "project.json")).then(() => true, () => false)) return dir;
+		const parent = node_path.default.dirname(dir);
+		if (parent === dir) return node_path.default.resolve(cwd);
+		dir = parent;
+	}
+}
+async function readProjectFileAt(dir) {
+	const raw = await (0, node_fs_promises.readFile)(node_path.default.join(node_path.default.resolve(dir), ".orizm", "project.json"), "utf-8").catch((error) => {
+		if (error.code === "ENOENT") return void 0;
+		throw error;
+	});
+	if (raw === void 0) return void 0;
+	const parsed = valibot.safeParse(ProjectFileSchema, safeJsonParse(raw));
+	return parsed.success ? parsed.output : void 0;
+}
+async function writeProjectFile(dir, context) {
+	const orizmDir = node_path.default.join(node_path.default.resolve(dir), ".orizm");
+	await (0, node_fs_promises.mkdir)(orizmDir, { recursive: true });
+	const file = node_path.default.join(orizmDir, "project.json");
+	await (0, node_fs_promises.writeFile)(file, JSON.stringify(context, null, 2) + "\n", "utf-8");
+	return file;
+}
+function safeJsonParse(raw) {
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return;
+	}
+}
+
+//#endregion
+//#region src/cli/credentials/resolve.ts
+async function resolveCredentials(params) {
+	if (await params.store.get(params.issuerUrl) !== void 0) return _praha_byethrow.Result.succeed({
+		type: "bearer",
+		issuerUrl: params.issuerUrl
+	});
+	if (params.apiKey !== void 0) return _praha_byethrow.Result.succeed({
+		type: "api-key",
+		apiKey: params.apiKey
+	});
+	return _praha_byethrow.Result.fail({ type: "no_credentials" });
+}
+
+//#endregion
+//#region ../internal-shared/dist/assert-valid-url-origin-XeiLzH_m.mjs
+const PATH_PARAM_RE = /\{[^{}]+\}/g;
+const supportsRequestInitExt = () => {
+	return typeof process === "object" && Number.parseInt(process?.versions?.node?.substring(0, 2)) >= 18 && process.versions.undici;
+};
+function randomID() {
+	return Math.random().toString(36).slice(2, 11);
+}
+function createClient(clientOptions) {
+	let { baseUrl = "", Request: CustomRequest = globalThis.Request, fetch: baseFetch = globalThis.fetch, querySerializer: globalQuerySerializer, bodySerializer: globalBodySerializer, pathSerializer: globalPathSerializer, headers: baseHeaders, requestInitExt = void 0, ...baseOptions } = { ...clientOptions };
+	requestInitExt = supportsRequestInitExt() ? requestInitExt : void 0;
+	baseUrl = removeTrailingSlash(baseUrl);
+	const globalMiddlewares = [];
+	async function coreFetch(schemaPath, fetchOptions) {
+		const { baseUrl: localBaseUrl, fetch = baseFetch, Request = CustomRequest, headers, params = {}, parseAs = "json", querySerializer: requestQuerySerializer, bodySerializer = globalBodySerializer ?? defaultBodySerializer, pathSerializer: requestPathSerializer, body, middleware: requestMiddlewares = [], ...init } = fetchOptions || {};
+		let finalBaseUrl = baseUrl;
+		if (localBaseUrl) finalBaseUrl = removeTrailingSlash(localBaseUrl) ?? baseUrl;
+		let querySerializer = typeof globalQuerySerializer === "function" ? globalQuerySerializer : createQuerySerializer(globalQuerySerializer);
+		if (requestQuerySerializer) querySerializer = typeof requestQuerySerializer === "function" ? requestQuerySerializer : createQuerySerializer({
+			...typeof globalQuerySerializer === "object" ? globalQuerySerializer : {},
+			...requestQuerySerializer
+		});
+		const pathSerializer = requestPathSerializer || globalPathSerializer || defaultPathSerializer;
+		const serializedBody = body === void 0 ? void 0 : bodySerializer(body, mergeHeaders(baseHeaders, headers, params.header));
+		const finalHeaders = mergeHeaders(serializedBody === void 0 || serializedBody instanceof FormData ? {} : { "Content-Type": "application/json" }, baseHeaders, headers, params.header);
+		const finalMiddlewares = [...globalMiddlewares, ...requestMiddlewares];
+		const requestInit = {
+			redirect: "follow",
+			...baseOptions,
+			...init,
+			body: serializedBody,
+			headers: finalHeaders
+		};
+		let id;
+		let options;
+		let request = new Request(createFinalURL(schemaPath, {
+			baseUrl: finalBaseUrl,
+			params,
+			querySerializer,
+			pathSerializer
+		}), requestInit);
+		let response;
+		for (const key in init) if (!(key in request)) request[key] = init[key];
+		if (finalMiddlewares.length) {
+			id = randomID();
+			options = Object.freeze({
+				baseUrl: finalBaseUrl,
+				fetch,
+				parseAs,
+				querySerializer,
+				bodySerializer,
+				pathSerializer
+			});
+			for (const m of finalMiddlewares) if (m && typeof m === "object" && typeof m.onRequest === "function") {
+				const result = await m.onRequest({
+					request,
+					schemaPath,
+					params,
+					options,
+					id
+				});
+				if (result) if (result instanceof Request) request = result;
+				else if (result instanceof Response) {
+					response = result;
+					break;
+				} else throw new Error("onRequest: must return new Request() or Response() when modifying the request");
+			}
+		}
+		if (!response) {
+			try {
+				response = await fetch(request, requestInitExt);
+			} catch (error2) {
+				let errorAfterMiddleware = error2;
+				if (finalMiddlewares.length) for (let i = finalMiddlewares.length - 1; i >= 0; i--) {
+					const m = finalMiddlewares[i];
+					if (m && typeof m === "object" && typeof m.onError === "function") {
+						const result = await m.onError({
+							request,
+							error: errorAfterMiddleware,
+							schemaPath,
+							params,
+							options,
+							id
+						});
+						if (result) {
+							if (result instanceof Response) {
+								errorAfterMiddleware = void 0;
+								response = result;
+								break;
+							}
+							if (result instanceof Error) {
+								errorAfterMiddleware = result;
+								continue;
+							}
+							throw new Error("onError: must return new Response() or instance of Error");
+						}
+					}
+				}
+				if (errorAfterMiddleware) throw errorAfterMiddleware;
+			}
+			if (finalMiddlewares.length) for (let i = finalMiddlewares.length - 1; i >= 0; i--) {
+				const m = finalMiddlewares[i];
+				if (m && typeof m === "object" && typeof m.onResponse === "function") {
+					const result = await m.onResponse({
+						request,
+						response,
+						schemaPath,
+						params,
+						options,
+						id
+					});
+					if (result) {
+						if (!(result instanceof Response)) throw new Error("onResponse: must return new Response() when modifying the response");
+						response = result;
+					}
+				}
+			}
+		}
+		const contentLength = response.headers.get("Content-Length");
+		if (response.status === 204 || request.method === "HEAD" || contentLength === "0" && !response.headers.get("Transfer-Encoding")?.includes("chunked")) return response.ok ? {
+			data: void 0,
+			response
+		} : {
+			error: void 0,
+			response
+		};
+		if (response.ok) {
+			const getResponseData = async () => {
+				if (parseAs === "stream") return response.body;
+				if (parseAs === "json" && !contentLength) {
+					const raw = await response.text();
+					return raw ? JSON.parse(raw) : void 0;
+				}
+				return await response[parseAs]();
+			};
+			return {
+				data: await getResponseData(),
+				response
+			};
+		}
+		let error = await response.text();
+		try {
+			error = JSON.parse(error);
+		} catch {}
+		return {
+			error,
+			response
+		};
+	}
+	return {
+		request(method, url, init) {
+			return coreFetch(url, {
+				...init,
+				method: method.toUpperCase()
+			});
+		},
+		/** Call a GET endpoint */
+		GET(url, init) {
+			return coreFetch(url, {
+				...init,
+				method: "GET"
+			});
+		},
+		/** Call a PUT endpoint */
+		PUT(url, init) {
+			return coreFetch(url, {
+				...init,
+				method: "PUT"
+			});
+		},
+		/** Call a POST endpoint */
+		POST(url, init) {
+			return coreFetch(url, {
+				...init,
+				method: "POST"
+			});
+		},
+		/** Call a DELETE endpoint */
+		DELETE(url, init) {
+			return coreFetch(url, {
+				...init,
+				method: "DELETE"
+			});
+		},
+		/** Call a OPTIONS endpoint */
+		OPTIONS(url, init) {
+			return coreFetch(url, {
+				...init,
+				method: "OPTIONS"
+			});
+		},
+		/** Call a HEAD endpoint */
+		HEAD(url, init) {
+			return coreFetch(url, {
+				...init,
+				method: "HEAD"
+			});
+		},
+		/** Call a PATCH endpoint */
+		PATCH(url, init) {
+			return coreFetch(url, {
+				...init,
+				method: "PATCH"
+			});
+		},
+		/** Call a TRACE endpoint */
+		TRACE(url, init) {
+			return coreFetch(url, {
+				...init,
+				method: "TRACE"
+			});
+		},
+		/** Register middleware */
+		use(...middleware) {
+			for (const m of middleware) {
+				if (!m) continue;
+				if (typeof m !== "object" || !("onRequest" in m || "onResponse" in m || "onError" in m)) throw new Error("Middleware must be an object with one of `onRequest()`, `onResponse() or `onError()`");
+				globalMiddlewares.push(m);
+			}
+		},
+		/** Unregister middleware */
+		eject(...middleware) {
+			for (const m of middleware) {
+				const i = globalMiddlewares.indexOf(m);
+				if (i !== -1) globalMiddlewares.splice(i, 1);
+			}
+		}
+	};
+}
+function serializePrimitiveParam(name, value, options) {
+	if (value === void 0 || value === null) return "";
+	if (typeof value === "object") throw new Error("Deeply-nested arrays/objects aren’t supported. Provide your own `querySerializer()` to handle these.");
+	return `${name}=${options?.allowReserved === true ? value : encodeURIComponent(value)}`;
+}
+function serializeObjectParam(name, value, options) {
+	if (!value || typeof value !== "object") return "";
+	const values = [];
+	const joiner = {
+		simple: ",",
+		label: ".",
+		matrix: ";"
+	}[options.style] || "&";
+	if (options.style !== "deepObject" && options.explode === false) {
+		for (const k in value) values.push(k, options.allowReserved === true ? value[k] : encodeURIComponent(value[k]));
+		const final2 = values.join(",");
+		switch (options.style) {
+			case "form": return `${name}=${final2}`;
+			case "label": return `.${final2}`;
+			case "matrix": return `;${name}=${final2}`;
+			default: return final2;
+		}
+	}
+	for (const k in value) {
+		const finalName = options.style === "deepObject" ? `${name}[${k}]` : k;
+		values.push(serializePrimitiveParam(finalName, value[k], options));
+	}
+	const final = values.join(joiner);
+	return options.style === "label" || options.style === "matrix" ? `${joiner}${final}` : final;
+}
+function serializeArrayParam(name, value, options) {
+	if (!Array.isArray(value)) return "";
+	if (options.explode === false) {
+		const joiner2 = {
+			form: ",",
+			spaceDelimited: "%20",
+			pipeDelimited: "|"
+		}[options.style] || ",";
+		const final = (options.allowReserved === true ? value : value.map((v) => encodeURIComponent(v))).join(joiner2);
+		switch (options.style) {
+			case "simple": return final;
+			case "label": return `.${final}`;
+			case "matrix": return `;${name}=${final}`;
+			default: return `${name}=${final}`;
+		}
+	}
+	const joiner = {
+		simple: ",",
+		label: ".",
+		matrix: ";"
+	}[options.style] || "&";
+	const values = [];
+	for (const v of value) if (options.style === "simple" || options.style === "label") values.push(options.allowReserved === true ? v : encodeURIComponent(v));
+	else values.push(serializePrimitiveParam(name, v, options));
+	return options.style === "label" || options.style === "matrix" ? `${joiner}${values.join(joiner)}` : values.join(joiner);
+}
+function createQuerySerializer(options) {
+	return function querySerializer(queryParams) {
+		const search = [];
+		if (queryParams && typeof queryParams === "object") for (const name in queryParams) {
+			const value = queryParams[name];
+			if (value === void 0 || value === null) continue;
+			if (Array.isArray(value)) {
+				if (value.length === 0) continue;
+				search.push(serializeArrayParam(name, value, {
+					style: "form",
+					explode: true,
+					...options?.array,
+					allowReserved: options?.allowReserved || false
+				}));
+				continue;
+			}
+			if (typeof value === "object") {
+				search.push(serializeObjectParam(name, value, {
+					style: "deepObject",
+					explode: true,
+					...options?.object,
+					allowReserved: options?.allowReserved || false
+				}));
+				continue;
+			}
+			search.push(serializePrimitiveParam(name, value, options));
+		}
+		return search.join("&");
+	};
+}
+function defaultPathSerializer(pathname, pathParams) {
+	let nextURL = pathname;
+	for (const match of pathname.match(PATH_PARAM_RE) ?? []) {
+		let name = match.substring(1, match.length - 1);
+		let explode = false;
+		let style = "simple";
+		if (name.endsWith("*")) {
+			explode = true;
+			name = name.substring(0, name.length - 1);
+		}
+		if (name.startsWith(".")) {
+			style = "label";
+			name = name.substring(1);
+		} else if (name.startsWith(";")) {
+			style = "matrix";
+			name = name.substring(1);
+		}
+		if (!pathParams || pathParams[name] === void 0 || pathParams[name] === null) continue;
+		const value = pathParams[name];
+		if (Array.isArray(value)) {
+			nextURL = nextURL.replace(match, serializeArrayParam(name, value, {
+				style,
+				explode
+			}));
+			continue;
+		}
+		if (typeof value === "object") {
+			nextURL = nextURL.replace(match, serializeObjectParam(name, value, {
+				style,
+				explode
+			}));
+			continue;
+		}
+		if (style === "matrix") {
+			nextURL = nextURL.replace(match, `;${serializePrimitiveParam(name, value)}`);
+			continue;
+		}
+		nextURL = nextURL.replace(match, style === "label" ? `.${encodeURIComponent(value)}` : encodeURIComponent(value));
+	}
+	return nextURL;
+}
+function defaultBodySerializer(body, headers) {
+	if (body instanceof FormData) return body;
+	if (headers) {
+		if ((headers.get instanceof Function ? headers.get("Content-Type") ?? headers.get("content-type") : headers["Content-Type"] ?? headers["content-type"]) === "application/x-www-form-urlencoded") return new URLSearchParams(body).toString();
+	}
+	return JSON.stringify(body);
+}
+function createFinalURL(pathname, options) {
+	let finalURL = `${options.baseUrl}${pathname}`;
+	if (options.params?.path) finalURL = options.pathSerializer(finalURL, options.params.path);
+	let search = options.querySerializer(options.params.query ?? {});
+	if (search.startsWith("?")) search = search.substring(1);
+	if (search) finalURL += `?${search}`;
+	return finalURL;
+}
+function mergeHeaders(...allHeaders) {
+	const finalHeaders = new Headers();
+	for (const h of allHeaders) {
+		if (!h || typeof h !== "object") continue;
+		const iterator = h instanceof Headers ? h.entries() : Object.entries(h);
+		for (const [k, v] of iterator) if (v === null) finalHeaders.delete(k);
+		else if (Array.isArray(v)) for (const v2 of v) finalHeaders.append(k, v2);
+		else if (v !== void 0) finalHeaders.set(k, v);
+	}
+	return finalHeaders;
+}
+function removeTrailingSlash(url) {
+	if (url.endsWith("/")) return url.substring(0, url.length - 1);
+	return url;
+}
+function assertValidUrlOrigin(origin) {
+	if (new URL(origin).origin !== origin) throw new Error(`${origin} is not a valid URL origin`);
+}
+
+//#endregion
+//#region ../internal-shared/dist/api-clients/dev-v2-api-client.mjs
+function createDeveloperAPIv2Client({ serverOrigin = "", fetch, headers }) {
+	if (serverOrigin) assertValidUrlOrigin(serverOrigin);
+	return createClient({
+		baseUrl: `${serverOrigin}/api/dev/v2`,
+		fetch,
+		headers
+	});
+}
+
+//#endregion
+//#region src/cli/api/client.ts
+function createAuthenticatedClient(params) {
+	const authFetch = buildAuthFetch(params.credentials, params.refresher);
+	return createDeveloperAPIv2Client({
+		serverOrigin: params.baseUrl,
+		fetch: authFetch
+	});
+}
+function buildAuthFetch(credentials, refresher) {
+	if (credentials.type === "api-key") {
+		const { apiKey } = credentials;
+		return async (input, init) => {
+			const request = new Request(input, init);
+			request.headers.set("x-api-key", apiKey);
+			return globalThis.fetch(request);
+		};
+	}
+	const { issuerUrl } = credentials;
+	return async (input, init) => {
+		const token = await refresher.getValidAccessToken(issuerUrl);
+		if (_praha_byethrow.Result.isFailure(token)) return unauthorizedResponse();
+		const request = new Request(input, init);
+		const retryRequest = request.clone();
+		request.headers.set("Authorization", `Bearer ${token.value}`);
+		const first = await globalThis.fetch(request);
+		if (first.status !== 401) return first;
+		const refreshed = await refresher.forceRefresh(issuerUrl);
+		if (_praha_byethrow.Result.isFailure(refreshed)) return first;
+		retryRequest.headers.set("Authorization", `Bearer ${refreshed.value}`);
+		return globalThis.fetch(retryRequest);
+	};
+}
+function unauthorizedResponse() {
+	return new Response(JSON.stringify({
+		type: "unauthorized",
+		title: "Unauthorized",
+		detail: "Authentication is required. Run `orizm auth login`."
+	}), {
+		status: 401,
+		headers: { "content-type": "application/json" }
+	});
+}
+
+//#endregion
+//#region src/cli/api/errors.ts
+const ProblemSchema = valibot.object({
+	type: valibot.string(),
+	title: valibot.string(),
+	detail: valibot.string(),
+	fields: valibot.optional(valibot.array(valibot.union([valibot.string(), valibot.object({
+		field: valibot.string(),
+		message: valibot.string()
+	})])))
+});
+function isSuccess(result) {
+	return result.response.ok && result.error === void 0;
+}
+function toResult(result) {
+	if (result.response.status >= 500) throw new Error(`Server responded with ${result.response.status}`);
+	if (!isSuccess(result)) return failFromProblem(result.error, result.response);
+	return {
+		type: "Success",
+		value: result.data
+	};
+}
+function failFromProblem(error, response) {
+	const problem = valibot.safeParse(ProblemSchema, error);
+	if (!problem.success) throw new Error(`Unexpected API response (status ${response.status})`);
+	const apiError = toApiError(problem.output);
+	if (apiError === void 0) throw new Error(`Unhandled API error type: ${problem.output.type}`);
+	return _praha_byethrow.Result.fail(apiError);
+}
+function toApiError(problem) {
+	switch (problem.type) {
+		case "bad-request": return {
+			type: "bad_request",
+			detail: problem.detail,
+			fields: objectFields(problem.fields)
+		};
+		case "unauthorized": return {
+			type: "unauthorized",
+			detail: problem.detail
+		};
+		case "forbidden": return {
+			type: "forbidden",
+			detail: problem.detail
+		};
+		case "not-found": return {
+			type: "not_found",
+			detail: problem.detail
+		};
+		case "conflict": return {
+			type: "conflict",
+			detail: problem.detail
+		};
+		default: return;
+	}
+}
+function objectFields(fields) {
+	if (fields === void 0) return [];
+	return fields.filter((field) => typeof field !== "string");
+}
+
+//#endregion
+//#region src/cli/api/organizations.ts
+async function fetchOrganizations(client) {
+	return toResult(await client.GET("/organizations"));
+}
+async function resolveOrganizationId(client, name) {
+	const organizations = await fetchOrganizations(client);
+	if (_praha_byethrow.Result.isFailure(organizations)) return organizations;
+	const matched = organizations.value.find((org) => org.name === name);
+	if (matched === void 0) return _praha_byethrow.Result.fail({
+		type: "organization_not_found",
+		name
+	});
+	return _praha_byethrow.Result.succeed(matched.id);
+}
+
+//#endregion
+//#region src/cli/context/gitignore.ts
+const ENTRY = ".orizm/";
+function gitignoreHasEntry(content) {
+	return content.split(/\r?\n/).map((line) => line.trim()).some((line) => line === ".orizm" || line === ".orizm/");
+}
+function enoentToUndefined(error) {
+	if (error.code === "ENOENT") return void 0;
+	throw error;
+}
+async function gitignoreContainsEntry(dir) {
+	const existing = await (0, node_fs_promises.readFile)(node_path.default.join(dir, ".gitignore"), "utf-8").catch(enoentToUndefined);
+	return existing !== void 0 && gitignoreHasEntry(existing);
+}
+async function appendGitignoreEntry(dir) {
+	const file = node_path.default.join(dir, ".gitignore");
+	const existing = await (0, node_fs_promises.readFile)(file, "utf-8").catch(enoentToUndefined);
+	await (0, node_fs_promises.writeFile)(file, `${existing == null || existing === "" || existing.endsWith("\n") ? existing ?? "" : existing + "\n"}${ENTRY}\n`, "utf-8");
+}
+
+//#endregion
+//#region src/cli/ui/prompt.ts
+async function confirm(message, initial = false) {
+	return await require_cli_main.logger.prompt(message, {
+		type: "confirm",
+		initial
+	}) === true;
+}
+async function promptText(message) {
+	const answer = await require_cli_main.logger.prompt(message, { type: "text" });
+	return typeof answer === "string" ? answer : void 0;
+}
+async function select(message, options) {
+	const answer = await require_cli_main.logger.prompt(message, {
+		type: "select",
+		options,
+		cancel: "null"
+	});
+	return typeof answer === "string" ? answer : void 0;
+}
+
+//#endregion
+//#region src/cli/commands/api-errors.ts
+function apiErrorFailure(error) {
+	switch (error.type) {
+		case "bad_request": {
+			const fieldLines = error.fields.map((field) => `\n  - ${field.field}: ${field.message}`);
+			return _praha_byethrow.Result.fail({ message: `${error.detail}${fieldLines.join("")}` });
+		}
+		case "unauthorized": return _praha_byethrow.Result.fail({ message: `Not authorized: ${error.detail}. Run \`orizm auth login\` or check ORIZM_API_KEY.` });
+		case "forbidden": return _praha_byethrow.Result.fail({ message: `Forbidden: ${error.detail}` });
+		case "not_found": return _praha_byethrow.Result.fail({ message: `Not found: ${error.detail}` });
+		case "conflict": return _praha_byethrow.Result.fail({ message: `Conflict: ${error.detail}` });
+	}
+}
+
+//#endregion
+//#region src/cli/commands/link-flow.ts
+async function runLinkFlow(ctx, options) {
+	const linkDir = await resolveLinkDirectory(options.cwd);
+	const existing = await readProjectFileAt(linkDir);
+	if (existing !== void 0) {
+		if (!await options.prompts.confirmOverwrite(existing)) return _praha_byethrow.Result.succeed({ linked: false });
+	}
+	const organizations = await fetchOrganizations(ctx.client);
+	if (_praha_byethrow.Result.isFailure(organizations)) return apiErrorFailure(organizations.error);
+	if (organizations.value.length === 0) return _praha_byethrow.Result.fail({ message: "You do not belong to any organization." });
+	const organization = await options.prompts.selectOrganization(organizations.value);
+	if (organization === void 0) return _praha_byethrow.Result.succeed({ linked: false });
+	const projects = toResult(await ctx.client.GET("/projects", { params: { query: { organizationId: organization.id } } }));
+	if (_praha_byethrow.Result.isFailure(projects)) return apiErrorFailure(projects.error);
+	if (projects.value.length === 0) return _praha_byethrow.Result.fail({ message: `Organization "${organization.name}" has no projects.` });
+	const project = await options.prompts.selectProject(projects.value);
+	if (project === void 0) return _praha_byethrow.Result.succeed({ linked: false });
+	const file = await writeProjectFile(linkDir, {
+		projectName: project.name,
+		organizationName: organization.name
+	});
+	const gitignoreNote = await ensureGitignore(linkDir, options.prompts.confirmGitignore);
+	return _praha_byethrow.Result.succeed({
+		linked: true,
+		projectName: project.name,
+		organizationName: organization.name,
+		file,
+		gitignoreNote
+	});
+}
+async function ensureGitignore(linkDir, confirmGitignore) {
+	if (await gitignoreContainsEntry(linkDir)) return "";
+	if (!await confirmGitignore()) return "Skipped updating .gitignore. Consider ignoring .orizm/ yourself.";
+	await appendGitignoreEntry(linkDir);
+	return "Added .orizm/ to .gitignore.";
+}
+async function promptSelectFromList(items, message, label, value) {
+	const selected = await select(message, items.map((item) => ({
+		label: label(item),
+		value: value(item)
+	})));
+	if (selected === void 0) return void 0;
+	return items.find((item) => value(item) === selected);
+}
+function defaultLinkPrompts() {
+	return {
+		confirmOverwrite: (existing) => confirm(`This directory is already linked to "${existing.projectName}". Overwrite?`, false),
+		selectOrganization: (organizations) => promptSelectFromList(organizations, "Select an organization:", (organization) => `${organization.displayName} (${organization.name})`, (organization) => organization.name),
+		selectProject: (projects) => promptSelectFromList(projects, "Select a project:", (project) => `${project.displayName} (${project.name})`, (project) => project.name),
+		confirmGitignore: () => confirm("Add .orizm/ to .gitignore?", true)
+	};
+}
+
+//#endregion
+//#region src/cli/commands/run-with-context.ts
+async function resolveAuth(options) {
+	const env = require_token_store.resolveEnv(options.envSource);
+	if (_praha_byethrow.Result.isFailure(env)) return _praha_byethrow.Result.fail({ message: "Invalid environment variable configuration for Orizm." });
+	const store = options.store ?? new require_token_store.FileTokenStore();
+	const refresher = new TokenRefresher(store);
+	const credentials = await resolveCredentials({
+		store,
+		issuerUrl: env.value.issuerUrl,
+		apiKey: env.value.apiKey
+	});
+	if (_praha_byethrow.Result.isFailure(credentials)) return _praha_byethrow.Result.fail({ message: "Not authenticated. Run `orizm auth login`, or set ORIZM_API_KEY." });
+	if (credentials.value.type === "bearer") {
+		const token = await refresher.getValidAccessToken(env.value.issuerUrl);
+		if (_praha_byethrow.Result.isFailure(token)) return _praha_byethrow.Result.fail({ message: "Your session has expired or was revoked. Run `orizm auth login` to sign in again." });
+	}
+	const client = createAuthenticatedClient({
+		baseUrl: env.value.baseUrl,
+		credentials: credentials.value,
+		refresher
+	});
+	return _praha_byethrow.Result.succeed({
+		context: {
+			baseUrl: env.value.baseUrl,
+			client
+		},
+		env: env.value
+	});
+}
+async function runWithAuth(handler, options = {}) {
+	const auth = await resolveAuth(options);
+	if (_praha_byethrow.Result.isFailure(auth)) return auth;
+	return handler(auth.value.context);
+}
+async function runWithContext(args, handler, options = {}) {
+	const auth = await resolveAuth(options);
+	if (_praha_byethrow.Result.isFailure(auth)) return auth;
+	const project = await resolveProjectName({
+		flag: typeof args.project === "string" ? args.project : void 0,
+		env: auth.value.env.project,
+		cwd: options.cwd
+	});
+	if (_praha_byethrow.Result.isFailure(project)) {
+		if (project.error.type === "no_project_context") {
+			const linked = await tryInteractiveLink(auth.value.context, options);
+			if (linked !== void 0) {
+				if (_praha_byethrow.Result.isFailure(linked)) return linked;
+				return handler({
+					...auth.value.context,
+					projectName: linked.value
+				});
+			}
+		}
+		return _praha_byethrow.Result.fail(projectContextFailure(project.error));
+	}
+	return handler({
+		...auth.value.context,
+		projectName: project.value
+	});
+}
+async function tryInteractiveLink(ctx, options) {
+	if (!(options.isTTY ?? process.stdin.isTTY === true)) return void 0;
+	require_cli_main.notice("No project is linked to this directory yet. Select one to continue.");
+	const flow = await runLinkFlow(ctx, {
+		cwd: options.cwd ?? process.cwd(),
+		prompts: options.linkPrompts ?? defaultLinkPrompts()
+	});
+	if (_praha_byethrow.Result.isFailure(flow)) return flow;
+	if (!flow.value.linked) return _praha_byethrow.Result.fail(projectContextFailure({ type: "no_project_context" }));
+	require_cli_main.notice(`Linked to project ${flow.value.projectName} (organization ${flow.value.organizationName}).`);
+	if (flow.value.gitignoreNote !== "") require_cli_main.notice(flow.value.gitignoreNote);
+	return _praha_byethrow.Result.succeed(flow.value.projectName);
+}
+function projectContextFailure(error) {
+	switch (error.type) {
+		case "project_json_invalid": return { message: `Invalid project file: ${error.path}` };
+		case "no_project_context": return { message: "No project selected. Run `orizm link`, pass --project <name>, or set ORIZM_PROJECT." };
+	}
+}
+
+//#endregion
+Object.defineProperty(exports, 'apiErrorFailure', {
+  enumerable: true,
+  get: function () {
+    return apiErrorFailure;
+  }
+});
+Object.defineProperty(exports, 'confirm', {
+  enumerable: true,
+  get: function () {
+    return confirm;
+  }
+});
+Object.defineProperty(exports, 'defaultLinkPrompts', {
+  enumerable: true,
+  get: function () {
+    return defaultLinkPrompts;
+  }
+});
+Object.defineProperty(exports, 'fetchOrganizations', {
+  enumerable: true,
+  get: function () {
+    return fetchOrganizations;
+  }
+});
+Object.defineProperty(exports, 'promptText', {
+  enumerable: true,
+  get: function () {
+    return promptText;
+  }
+});
+Object.defineProperty(exports, 'resolveOrganizationId', {
+  enumerable: true,
+  get: function () {
+    return resolveOrganizationId;
+  }
+});
+Object.defineProperty(exports, 'resolveOrganizationName', {
+  enumerable: true,
+  get: function () {
+    return resolveOrganizationName;
+  }
+});
+Object.defineProperty(exports, 'runLinkFlow', {
+  enumerable: true,
+  get: function () {
+    return runLinkFlow;
+  }
+});
+Object.defineProperty(exports, 'runWithAuth', {
+  enumerable: true,
+  get: function () {
+    return runWithAuth;
+  }
+});
+Object.defineProperty(exports, 'runWithContext', {
+  enumerable: true,
+  get: function () {
+    return runWithContext;
+  }
+});
+Object.defineProperty(exports, 'toResult', {
+  enumerable: true,
+  get: function () {
+    return toResult;
+  }
+});
+//# sourceMappingURL=run-with-context-DJNnEigg.cjs.map