@rebasepro/cli 0.25.0-canary.ge06257e → 0.25.0

package/dist/{context-BM-oOMNX.js.map → context-CyflUrKg.js.map}

@@ -1 +1 @@
-{"version":3,"file":"context-BM-oOMNX.js","names":[],"sources":["../src/commands/cloud/errors.ts","../src/commands/cloud/context.ts"],"sourcesContent":["/**\n * Turning a control-plane failure into something the caller can act on.\n *\n * The control plane talks to Kubernetes, and when Kubernetes refuses it, the\n * refusal travels back verbatim: a whole `Status` object, the request headers,\n * an `audit-id`, an `x-kubernetes-pf-flowschema-uid`. That reached the user's\n * terminal unedited. Two things are wrong with it beyond the noise.\n *\n * The first is that the one sentence that matters is buried in the middle of a\n * JSON blob, so the remedy — if there is one — is the hardest part to find.\n *\n * The second is worse, and is the reason this file exists rather than a\n * `slice(0, 200)`. A `403` naming a `system:serviceaccount:` is a statement\n * about the PLATFORM's own credentials: some role the control plane runs as is\n * missing a grant. Nothing in the user's project can change that — not the\n * collections, not `rebase.json`, not the deploy flags — and the error, printed\n * raw in the middle of `rebase cloud deploy`, reads exactly like a project\n * fault. Someone acting on that reading deletes working code looking for the\n * cause. (That is not hypothetical: three cron jobs were removed from a project\n * to test whether they caused a `cronjobs.batch` 403. They did not.)\n *\n * So this classifies before it summarises, and says whose problem it is.\n */\n\nimport { parseEnvBoolean } from \"@rebasepro/types\";\n\n/** What a Kubernetes API refusal carries, once it is found. */\nexport interface KubernetesStatus {\n    message?: string;\n    reason?: string;\n    code?: number;\n    details?: { group?: string; kind?: string; name?: string };\n}\n\nexport interface ErrorSummary {\n    /** One line, safe to print. Never the raw body. */\n    message: string;\n    /** A remedy, when one exists — or the reason there is none. */\n    hint?: string;\n    /** A stable code for `--json` callers to branch on. */\n    code: string;\n    /**\n     * Whether the failure is the platform's rather than the project's.\n     *\n     * The whole point of the summary: a caller that retries or mutates the\n     * project on a platform-side refusal makes things worse, and an agent\n     * cannot tell from the prose.\n     */\n    platform: boolean;\n    /** The untouched original, printed only under `--debug`. */\n    raw: string;\n}\n\n/**\n * The service accounts a Kubernetes 403 can name, and what each means.\n *\n * `system:serviceaccount:` is the platform's own identity — the control plane's\n * pod, or a tenant's operator. A project cannot grant it anything, because the\n * grant lives in a cluster the project does not own. `system:anonymous` is the\n * same fact with the credential missing entirely.\n */\nconst PLATFORM_PRINCIPAL_RE = /system:(?:serviceaccount:|anonymous|node:)/;\n\n/**\n * A Kubernetes `Status` object embedded anywhere in a message.\n *\n * Scanned for rather than parsed off the front: the control plane wraps it\n * (\"Failed to create the tenant namespace: …\"), the client library appends\n * headers after it, and both halves are worth keeping out of the summary.\n * Balanced-brace scanning rather than a regex, because `details.causes` nests\n * and a lazy `\\{.*?\\}` truncates the object at the first inner brace — which\n * parses to nothing and silently falls through to the raw message.\n */\nexport function extractKubernetesStatus(text: string): KubernetesStatus | undefined {\n    for (let start = text.indexOf(\"{\"); start !== -1; start = text.indexOf(\"{\", start + 1)) {\n        let depth = 0;\n        let inString = false;\n        let escaped = false;\n        for (let i = start; i < text.length; i++) {\n            const ch = text[i];\n            if (escaped) {\n                escaped = false;\n                continue;\n            }\n            if (ch === \"\\\\\") {\n                escaped = true;\n                continue;\n            }\n            if (ch === '\"') {\n                inString = !inString;\n                continue;\n            }\n            if (inString) continue;\n            if (ch === \"{\") depth++;\n            else if (ch === \"}\") {\n                depth--;\n                if (depth !== 0) continue;\n                const candidate = text.slice(start, i + 1);\n                let parsed: unknown;\n                try {\n                    parsed = JSON.parse(candidate);\n                } catch {\n                    break; // Not JSON; try the next opening brace.\n                }\n                const obj = parsed as Record<string, unknown> & KubernetesStatus;\n                // `kind: \"Status\"` is the marker the API server always sets on a\n                // refusal. Requiring it means an ordinary JSON body in an error\n                // message — a validation report, say — is left alone.\n                if (obj?.kind === \"Status\" || (obj?.status === \"Failure\" && typeof obj.code === \"number\")) {\n                    return {\n                        message: typeof obj.message === \"string\" ? obj.message : undefined,\n                        reason: typeof obj.reason === \"string\" ? obj.reason : undefined,\n                        code: typeof obj.code === \"number\" ? obj.code : undefined,\n                        details: (obj.details as KubernetesStatus[\"details\"]) ?? undefined\n                    };\n                }\n                break;\n            }\n        }\n    }\n    return undefined;\n}\n\n/**\n * Strip the transport noise a Kubernetes client appends to its own message.\n *\n * Only ever applied to the fallback path — when no `Status` was found, the\n * message is all there is, and cutting it at the first header keeps the\n * sentence while dropping the `audit-id` and the flowschema uid nobody outside\n * the cluster can use.\n */\nfunction trimTransportNoise(message: string): string {\n    const cut = message.search(\n        /\\s*(?:headers:|HTTP request failed|audit-id|x-kubernetes-pf-|\\{\"kind\":\"Status\")/i\n    );\n    const trimmed = (cut > 0 ? message.slice(0, cut) : message).trim();\n    return trimmed.replace(/[\\s:,-]+$/, \"\");\n}\n\n/** The longest a summary may be before it stops being one. */\nconst MAX_SUMMARY = 300;\n\n/**\n * One actionable line (plus a hint) from whatever the control plane returned.\n *\n * `status` is the HTTP status of the control-plane call itself, which is a\n * different number from the `code` inside an embedded Kubernetes `Status` — the\n * control plane routinely answers 500 while the cluster answered 403, and it is\n * the inner one that says what happened.\n */\nexport function summarizeError(error: unknown, context: string): ErrorSummary {\n    const err = error as { status?: number; message?: string; code?: string };\n    const raw = err?.message ?? String(error);\n    const k8s = extractKubernetesStatus(raw);\n\n    if (k8s) {\n        const inner = k8s.message?.trim() ?? \"\";\n        const forbidden = k8s.code === 403 || k8s.reason === \"Forbidden\";\n        const platform = forbidden && PLATFORM_PRINCIPAL_RE.test(inner);\n\n        if (platform) {\n            return {\n                // Named as the platform's before the sentence that follows, so\n                // the first thing read is whose problem it is.\n                message: `${context}: the platform's own cluster credentials were refused by Kubernetes.`,\n                hint:\n                    `${truncate(inner)}\\n`\n                    + \"  This is a platform-side permission, not something your project can grant. \"\n                    + \"Nothing in your code, collections or deploy flags will change it — \"\n                    + \"report it with the message above rather than retrying or changing the project.\",\n                code: \"platform_permission_denied\",\n                platform: true,\n                raw\n            };\n        }\n\n        return {\n            message: `${context}: ${truncate(inner || k8s.reason || \"the cluster refused the request\")}`,\n            hint: k8s.code ? `Kubernetes answered ${k8s.code}${k8s.reason ? ` (${k8s.reason})` : \"\"}.` : undefined,\n            code: k8s.reason ? `k8s_${k8s.reason.toLowerCase()}` : \"k8s_error\",\n            platform: false,\n            raw\n        };\n    }\n\n    // Not a Kubernetes refusal. Still worth trimming: the same transport dumps\n    // its headers onto plenty of errors that carry no `Status` at all.\n    const trimmed = trimTransportNoise(raw);\n    return {\n        message: `${context}${err?.status ? ` (${err.status})` : \"\"}: ${truncate(trimmed || raw)}`,\n        code: err?.code ?? (err?.status ? `http_${err.status}` : \"request_failed\"),\n        platform: false,\n        raw\n    };\n}\n\nfunction truncate(text: string): string {\n    const flat = text.replace(/\\s+/g, \" \").trim();\n    return flat.length > MAX_SUMMARY ? `${flat.slice(0, MAX_SUMMARY - 1)}…` : flat;\n}\n\n/**\n * Whether the caller asked for the untouched body.\n *\n * `--debug` is already what `bin/rebase.js` prints after every failure as the\n * thing to add, so the raw payload hangs off the flag people are told to reach\n * for rather than off one invented here.\n *\n * The one reader of `REBASE_DEBUG` in the commands, spelled as the bin spells\n * it. It used to be `=== \"1\"` here while the quote fallbacks in `resources.ts`\n * tested the raw string for truthiness, so `=true` hid the body and `=0`\n * printed the fallback.\n */\nexport function wantsRawError(argv: readonly string[] = process.argv): boolean {\n    return argv.includes(\"--debug\") || parseEnvBoolean(process.env.REBASE_DEBUG) === true;\n}\n","/**\n * Shared foundation for the `rebase cloud` command family.\n *\n * Everything cloud subcommands need in common lives here:\n *   - credential storage  (~/.rebase/credentials.json, keyed per control-plane host)\n *   - project link file    (.rebase/cloud.json in the project dir)\n *   - control-plane URL resolution\n *   - an authenticated `@rebasepro/client` instance (createCloudClient / requireClient)\n *   - small output helpers shared across subcommands\n *\n * The control plane is itself a Rebase app, so we reuse the same SDK the web\n * console uses (`@rebasepro/client`). Auth, token refresh, the data REST client\n * and function invocation all come from the SDK — the CLI only supplies a\n * file-backed AuthStorage so a login persists across invocations.\n */\nimport fs from \"fs\";\nimport os from \"os\";\nimport path from \"path\";\nimport { spawn } from \"child_process\";\nimport chalk from \"chalk\";\nimport arg from \"arg\";\nimport inquirer from \"inquirer\";\nimport { createMemoryStorage, createRebaseClient, type AuthStorage } from \"@rebasepro/client\";\nimport { findProjectRoot } from \"../../utils/project\";\nimport { parseCommandArgs } from \"../../utils/args\";\nimport { cliUserAgent } from \"../../utils/version\";\nimport { summarizeError, wantsRawError } from \"./errors\";\nimport { parseEnvBoolean } from \"@rebasepro/types\";\n\n/* ═══════════════════════════════════════════════════════════════\n   Constants & paths\n   ═══════════════════════════════════════════════════════════════ */\n\n/** Default hosted control plane (the Rebase Cloud console origin). */\nconst DEFAULT_CLOUD_URL = \"https://app.rebase.pro\";\n\n/** The storage key the SDK's auth module reads/writes the session under. */\nconst SDK_SESSION_KEY = \"rebase_auth\";\n\n/** ~/.rebase/credentials.json — one file, many hosts. */\nfunction credentialsPath(): string {\n    return path.join(os.homedir(), \".rebase\", \"credentials.json\");\n}\n\n/** Project-local link file: <project>/.rebase/cloud.json */\n/**\n * The billing account an organization row points at, whichever key it arrived under.\n *\n * REST serves every column under its own property name, so the relation comes\n * back as `billingAccountId`. Both readers in this CLI checked\n * `billing_account_id` and `billingAccount` — neither is what arrives — so\n * `rebase cloud billing` answered \"no billing account\" for every organization,\n * and the deploy pre-check never saw an internal plan. The other two spellings\n * are still accepted: older servers and fixtures send them.\n */\nexport function billingAccountIdOf(org: unknown): string | number | undefined {\n    if (typeof org !== \"object\" || org === null) return undefined;\n    for (const key of [\"billingAccountId\", \"billing_account_id\", \"billingAccount\"]) {\n        const value = (org as Record<string, unknown>)[key];\n        if (typeof value === \"string\" || typeof value === \"number\") return value;\n    }\n    return undefined;\n}\n\nexport function projectLinkPath(cwd: string = process.cwd()): string {\n    const root = findProjectRoot(cwd) || cwd;\n    return path.join(root, \".rebase\", \"cloud.json\");\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   Credentials file model\n   ═══════════════════════════════════════════════════════════════\n\n   {\n     \"current\": \"https://app.rebase.pro\",\n     \"contexts\": {\n       \"https://app.rebase.pro\": { \"auth\": \"<sdk session json>\", \"org\": \"42\" }\n     }\n   }\n*/\n\ninterface CloudContextEntry {\n    /** Raw JSON blob the SDK auth module persists (the RebaseSession). */\n    auth?: string;\n    /** Active organization id for this host, if the user selected one. */\n    org?: string;\n}\n\ninterface CredentialsFile {\n    current?: string;\n    contexts: Record<string, CloudContextEntry>;\n}\n\nfunction readCredentials(): CredentialsFile {\n    try {\n        const raw = fs.readFileSync(credentialsPath(), \"utf-8\");\n        const parsed = JSON.parse(raw) as CredentialsFile;\n        if (!parsed.contexts) parsed.contexts = {};\n        return parsed;\n    } catch {\n        return { contexts: {} };\n    }\n}\n\nfunction writeCredentials(data: CredentialsFile): void {\n    const file = credentialsPath();\n    fs.mkdirSync(path.dirname(file), { recursive: true });\n    // Written with private perms — this file holds refresh tokens.\n    fs.writeFileSync(file, JSON.stringify(data, null, 2), { mode: 0o600 });\n    try {\n        fs.chmodSync(file, 0o600);\n    } catch {\n        // best effort on platforms without chmod semantics\n    }\n}\n\n/** Host that a bare `rebase cloud` command should target, if any. */\nfunction currentContextUrl(): string | undefined {\n    return readCredentials().current;\n}\n\n/** Persist the active organization id for a host. */\nexport function setContextOrg(url: string, org: string | undefined): void {\n    const creds = readCredentials();\n    const entry = creds.contexts[url] || {};\n    if (org) entry.org = org;\n    else delete entry.org;\n    creds.contexts[url] = entry;\n    writeCredentials(creds);\n}\n\nexport function getContextOrg(url: string): string | undefined {\n    return readCredentials().contexts[url]?.org;\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   File-backed AuthStorage (per host)\n   ═══════════════════════════════════════════════════════════════ */\n\nfunction createFileAuthStorage(url: string): AuthStorage {\n    return {\n        getItem(key) {\n            if (key !== SDK_SESSION_KEY) return null;\n            return readCredentials().contexts[url]?.auth ?? null;\n        },\n        setItem(key, value) {\n            if (key !== SDK_SESSION_KEY) return;\n            const creds = readCredentials();\n            const entry = creds.contexts[url] || {};\n            entry.auth = value;\n            creds.contexts[url] = entry;\n            if (!creds.current) creds.current = url;\n            writeCredentials(creds);\n        },\n        removeItem(key) {\n            if (key !== SDK_SESSION_KEY) return;\n            const creds = readCredentials();\n            if (creds.contexts[url]) {\n                delete creds.contexts[url].auth;\n                delete creds.contexts[url].org;\n            }\n            writeCredentials(creds);\n        }\n    };\n}\n\n/** Mark a host as the active context (called on login). */\nexport function setCurrentContext(url: string): void {\n    const creds = readCredentials();\n    creds.current = url;\n    if (!creds.contexts[url]) creds.contexts[url] = {};\n    writeCredentials(creds);\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   URL resolution\n   ═══════════════════════════════════════════════════════════════\n\n   Priority: --url flag > REBASE_CLOUD_URL env > CLOUD link's url\n             > stored current context > default hosted URL.\n\n   A **direct** link is deliberately absent from that list; see below.\n*/\n\n/**\n * Where the control-plane URL came from. `link` is the one a repository chose\n * rather than the user — see {@link isKnownControlPlane}.\n */\nexport type CloudUrlSource = \"flag\" | \"env\" | \"link\" | \"context\" | \"default\";\n\nexport function resolveCloudUrl(rawArgs: string[]): string {\n    return resolveCloudTarget(rawArgs).url;\n}\n\n/** The control-plane URL, and which rung of the ladder above supplied it. */\nexport function resolveCloudTarget(rawArgs: string[]): { url: string; source: CloudUrlSource } {\n    const parsed = arg({ \"--url\": String }, { argv: rawArgs.slice(2),\npermissive: true });\n    if (parsed[\"--url\"]) return { url: normalizeUrl(parsed[\"--url\"]),\nsource: \"flag\" };\n    if (process.env.REBASE_CLOUD_URL) return { url: normalizeUrl(process.env.REBASE_CLOUD_URL),\nsource: \"env\" };\n\n    const link = readLink();\n    /*\n     * A direct link is a tenant, not a control plane.\n     *\n     * `rebase cloud link <url>` points this checkout at ONE running Rebase API\n     * — \"no control plane, no login\", as its own help page puts it — so its URL\n     * is the customer's own backend. Returning it here made it the control\n     * plane for the entire `cloud` family: `whoami` reported \"Not logged in to\n     * https://api.example.com\", and following that printed remedy POSTed the\n     * user's *control-plane* email and password to the tenant host.\n     *\n     * Commands that genuinely need a control plane refuse instead — see\n     * `refuseDirectLink`, which every one of them reaches through\n     * `requireClient` (and `login`, which builds its client directly).\n     */\n    if (link?.url && link.mode !== \"direct\") return { url: normalizeUrl(link.url),\nsource: \"link\" };\n\n    const current = currentContextUrl();\n    if (current) return { url: normalizeUrl(current),\nsource: \"context\" };\n\n    return { url: DEFAULT_CLOUD_URL,\nsource: \"default\" };\n}\n\n/**\n * Whether a control-plane host is one the user chose: the platform's own, or a\n * host already in their credentials file because they signed in to it.\n *\n * A link file is part of the repository, and a cloned repository is not the\n * user's to trust with their password. `login` asks before sending one to a\n * linked host that is neither.\n */\nexport function isKnownControlPlane(url: string): boolean {\n    return url === DEFAULT_CLOUD_URL || Object.hasOwn(readCredentials().contexts, url);\n}\n\n/**\n * Refuse to run a control-plane command in a directory linked straight at a\n * backend.\n *\n * The alternative — quietly using the default control plane — would be worse\n * than the bug it replaces: the user asked for `https://api.example.com` and\n * would get an answer about `app.rebase.pro` with nothing saying so. Naming the\n * link, and both ways out of it, is the whole message.\n *\n * `--project` and `--url` are the ways out, so a line carrying either passes\n * through: both say, explicitly, which control-plane subject the caller means.\n */\nexport function refuseDirectLink(rawArgs: string[]): void {\n    const link = readLink();\n    if (link?.mode !== \"direct\") return;\n\n    const parsed = arg(\n        { \"--project\": String,\n\"-p\": \"--project\",\n\"--url\": String },\n        { argv: rawArgs.slice(2),\npermissive: true }\n    );\n    if (parsed[\"--project\"] || parsed[\"--url\"]) return;\n\n    fail(\n        `This directory is linked directly to ${chalk.cyan(link.url)} — `\n        + `${chalk.bold(\"rebase cloud unlink\")} first, or pass ${chalk.bold(\"--project\")}.`,\n        \"A direct link is one backend, not a control plane: it has no projects, no organizations and no session.\",\n        \"direct_link\"\n    );\n}\n\nfunction normalizeUrl(url: string): string {\n    let u = url.trim().replace(/\\/+$/, \"\");\n    if (!/^https?:\\/\\//.test(u)) u = `https://${u}`;\n    return u;\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   Rebase client factory + auth guard\n   ═══════════════════════════════════════════════════════════════ */\n\nexport type CloudClient = ReturnType<typeof createRebaseClient>;\n\n/**\n * Build an SDK client bound to a control-plane host, backed by the on-disk\n * credential store. `autoRefresh` is disabled so we never leave a dangling\n * setTimeout that keeps the CLI process alive; token refresh is done on demand\n * by `requireClient`.\n */\nexport function createCloudClient(url: string): CloudClient {\n    return createRebaseClient({\n        baseUrl: url,\n        // No cloud subcommand needs a socket. The one that looks like it might —\n        // `logs -f` — polls `deployments.findById` on a timer (see\n        // `streamBuildLogs`), so nothing here ever opens a channel or an\n        // `observe()`.\n        //\n        // This used to say `websocketUrl: \"\"` and mean the same thing. It stopped\n        // meaning it when the client grew a diagnostic for the case it produces:\n        // realtime is on unless you switch it off, so \"on, with no usable URL\"\n        // reads as a misconfiguration and warns. The warning is right — and it\n        // was firing on every single `rebase cloud` invocation, telling the user\n        // to fix the CLI's own client construction, in prose they had no way to\n        // act on. `realtime: false` is the escape it names: it is the difference\n        // between \"no socket, because I never asked for one\" and \"no socket, and\n        // I do not know why\".\n        realtime: false,\n        // Every control-plane request says which CLI is calling. The control\n        // plane's wire format moves ahead of what is published to npm, so it\n        // has to be able to answer an old client with `CLI_TOO_OLD` and the\n        // minimum version — and it cannot do that for a caller that never\n        // identified itself. Until this line, none of them did.\n        headers: { \"User-Agent\": cliUserAgent() },\n        auth: {\n            storage: createFileAuthStorage(url),\n            persistSession: true,\n            autoRefresh: false\n        }\n    });\n}\n\n/**\n * The environment variable that authenticates the cloud family with a token\n * instead of a `cloud login` session — for CI and agents, which have no\n * terminal to log in at and should not hold a person's password.\n */\nexport const TOKEN_ENV = \"REBASE_TOKEN\";\n\n/** `REBASE_TOKEN`, trimmed, or undefined when it is unset or blank. */\nexport function envToken(): string | undefined {\n    const value = process.env[TOKEN_ENV]?.trim();\n    return value ? value : undefined;\n}\n\n/** The token each token-authenticated client was built with — see {@link freshAccessToken}. */\nconst STATIC_TOKENS = new WeakMap<object, string>();\n\n/**\n * A client that sends `token` as its bearer and nothing else.\n *\n * No session: the token is not refreshed, and the credentials file is neither\n * read nor written — a CI job's token must not become, or replace, the login\n * of whoever owns the machine. A 401 is answered by {@link explainRefusedToken}\n * rather than by the SDK's session refresh, because there is no session to\n * refresh and \"log in again\" is the wrong remedy for a token.\n */\nexport function createTokenClient(url: string, token: string): CloudClient {\n    const client = createRebaseClient({\n        baseUrl: url,\n        realtime: false,\n        headers: { \"User-Agent\": cliUserAgent() },\n        token,\n        auth: {\n            storage: createMemoryStorage(),\n            persistSession: false,\n            autoRefresh: false\n        }\n    });\n    client.setOnUnauthorized(() => explainRefusedToken(url, token));\n    STATIC_TOKENS.set(client, token);\n    return client;\n}\n\n/**\n * Why the control plane answered a token-authenticated request with 401, and\n * what to do about it. Never returns.\n *\n * Two different causes reach the same status. Usually the token itself was\n * refused — it expired, was revoked, or belongs to another control plane — and\n * the remedy is a new token. But a few endpoints take only a person's session\n * (`/auth/me` among them), and those refuse a perfectly good token too. One\n * request to `/api/auth/scopes`, which accepts a token, tells the two apart, so\n * neither is answered with the other's remedy.\n */\nasync function explainRefusedToken(url: string, token: string): Promise<never> {\n    let tokenAccepted = false;\n    try {\n        const probe = await fetch(`${url}/api/auth/scopes`, {\n            headers: { Authorization: `Bearer ${token}`, \"User-Agent\": cliUserAgent() }\n        });\n        tokenAccepted = probe.ok;\n    } catch {\n        // Unreachable: say what is certain — the request was refused.\n    }\n    if (tokenAccepted) {\n        fail(\n            `This command needs a signed-in session, and ${TOKEN_ENV} is an API token.`,\n            `Unset ${TOKEN_ENV} and run ${chalk.bold(\"rebase cloud login\")} to run it.`,\n            \"session_required\"\n        );\n    }\n    fail(\n        `${TOKEN_ENV} was rejected by ${url}: it has expired, been revoked, or was not issued by this control plane.`,\n        `Create a new one with ${chalk.bold(\"rebase cloud tokens create\")} and put it in ${TOKEN_ENV}.`,\n        \"token_rejected\"\n    );\n}\n\n/** Two minutes of head-room before a token is treated as expired. */\nconst EXPIRY_BUFFER_MS = 120_000;\n\n/** The half of a client that holds its session — all {@link freshAccessToken} reads. */\nexport interface SessionHolder {\n    auth: {\n        getSession(): { accessToken: string; expiresAt: number } | null;\n        refreshSession(): Promise<{ accessToken: string }>;\n    };\n}\n\n/**\n * An access token with time left on it, refreshed first if it is close to\n * expiry. Rejects when there is no session, or it cannot be refreshed.\n *\n * For the requests the SDK does not make itself. Its own calls refresh and\n * retry on a 401; a raw `fetch` or a tunnel handshake presents whatever token\n * it was handed, and `createCloudClient` never refreshes in the background. A\n * token read once at the start of a command that runs for longer than it\n * lives — a deploy's build, a `db connect` left open — is refused by the time\n * it is used, so it is read here at the moment it is sent.\n *\n * A client built from `REBASE_TOKEN` has no session; its token is returned\n * as it is, since there is nothing to refresh it with.\n */\nexport async function freshAccessToken(client: SessionHolder): Promise<string> {\n    const fixed = STATIC_TOKENS.get(client);\n    if (fixed) return fixed;\n    const session = client.auth.getSession();\n    if (session?.accessToken && session.expiresAt > Date.now() + EXPIRY_BUFFER_MS) return session.accessToken;\n    return (await client.auth.refreshSession()).accessToken;\n}\n\n/**\n * Return an authenticated client for the resolved host.\n *\n * With `REBASE_TOKEN` set, that token is the credential for every request and\n * the stored login is not consulted at all. Otherwise it is the `cloud login`\n * session — see {@link requireSessionClient}.\n */\nexport async function requireClient(rawArgs: string[]): Promise<{ client: CloudClient; url: string }> {\n    const token = envToken();\n    if (!token) return requireSessionClient(rawArgs);\n    // Before anything else: everything downstream of here is a control-plane\n    // call, and a direct-linked directory has no control plane to make it\n    // against.\n    refuseDirectLink(rawArgs);\n    const url = resolveCloudUrl(rawArgs);\n    return { client: createTokenClient(url, token), url };\n}\n\n/**\n * Return a client holding the `cloud login` session for the resolved host,\n * refreshing the access token if it is close to expiry, whether or not\n * `REBASE_TOKEN` is set. Exits with a helpful message when there is no usable\n * session (never logged in, or the refresh token was revoked).\n *\n * For the commands a token cannot run — minting and revoking tokens: a key that\n * could mint keys could mint its own successor, so the control plane refuses\n * every key on those routes.\n */\nexport async function requireSessionClient(rawArgs: string[]): Promise<{ client: CloudClient; url: string }> {\n    // Before anything else: everything downstream of here is a control-plane\n    // call, and a direct-linked directory has no control plane to make it\n    // against.\n    refuseDirectLink(rawArgs);\n    const url = resolveCloudUrl(rawArgs);\n    const client = createCloudClient(url);\n    const session = client.auth.getSession();\n\n    if (!session || !session.accessToken) {\n        if (envToken()) {\n            fail(\n                `This command needs a signed-in session for ${chalk.cyan(url)}, and ${TOKEN_ENV} is an API token.`,\n                `A token cannot manage tokens. Run ${chalk.bold(\"rebase cloud login\")} first.`,\n                \"session_required\"\n            );\n        }\n        fail(\n            `Not logged in to ${chalk.cyan(url)}.`,\n            `Run ${chalk.bold(\"rebase cloud login\")} first.`,\n            \"not_logged_in\"\n        );\n    }\n\n    if (session.expiresAt <= Date.now() + EXPIRY_BUFFER_MS) {\n        try {\n            await client.auth.refreshSession();\n        } catch {\n            fail(\n                `Your session for ${chalk.cyan(url)} has expired.`,\n                `Run ${chalk.bold(\"rebase cloud login\")} to sign in again.`,\n                // Distinct from `not_logged_in`: a caller retrying on a stale\n                // session should re-authenticate, not conclude it was never set\n                // up. Same remedy, different diagnosis.\n                \"session_expired\"\n            );\n        }\n    }\n\n    return { client,\nurl };\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   Platform configuration\n   ═══════════════════════════════════════════════════════════════ */\n\n/** One place a deploy can actually land, as the control plane describes it. */\nexport interface DeployTarget {\n    clusterId?: string | null;\n    provider: string;\n    region?: string;\n    label?: string;\n    baseDomain?: string;\n}\n\nexport interface PlatformConfig {\n    tenantBaseDomain?: string;\n    deployTargets?: DeployTarget[];\n}\n\n/**\n * The control plane's public, non-secret self-description (`platform-config`).\n *\n * None of it is knowable from the CLI side: it is per-deployment configuration —\n * production serves tenants at `rebase.website` on GKE, a dev control plane at\n * `localhost` on Docker. Guessing produced two separate lies: a congratulation\n * URL that resolved nowhere near the app, and a `provider` the project does not\n * run on (see `createProject`).\n *\n * Cached per host for the process: it is fixed for a control plane's lifetime,\n * and `projects list` formats one host per row off a single fetch.\n *\n * @returns the config, or `undefined` if the control plane doesn't serve\n *   `platform-config` (an older deployment) or the request failed. A failure is\n *   cached too — a short-lived CLI should not retry once per row. Note the\n *   distinction callers rely on: `undefined` means \"this control plane cannot\n *   tell us\", whereas `deployTargets: []` is a control plane stating that it has\n *   no infrastructure configured.\n */\nconst platformConfigCache = new Map<string, Promise<PlatformConfig | undefined>>();\n\nexport function fetchPlatformConfig(client: CloudClient, url: string): Promise<PlatformConfig | undefined> {\n    let pending = platformConfigCache.get(url);\n    if (!pending) {\n        pending = client.functions\n            .invoke<PlatformConfig>(\"platform-config\", undefined, { method: \"GET\" })\n            .then((cfg) => cfg ?? undefined)\n            .catch(() => undefined);\n        platformConfigCache.set(url, pending);\n    }\n    return pending;\n}\n\n/**\n * The base domain tenant projects are served at, derived from the same\n * TENANT_BASE_DOMAIN the ingress and the console read (see\n * saas/backend/src/utils/tenant-domain.ts).\n */\nexport function fetchTenantBaseDomain(client: CloudClient, url: string): Promise<string | undefined> {\n    return fetchPlatformConfig(client, url).then((cfg) => cfg?.tenantBaseDomain?.trim() || undefined);\n}\n\n/**\n * The infrastructure a deploy for this control plane would ACTUALLY use, in the\n * resolver's own preference order (saas/backend/src/k8s/resolve.ts).\n *\n * @returns the targets, or `undefined` when the control plane cannot say.\n */\nexport function fetchDeployTargets(client: CloudClient, url: string): Promise<DeployTarget[] | undefined> {\n    return fetchPlatformConfig(client, url).then((cfg) =>\n        Array.isArray(cfg?.deployTargets) ? cfg.deployTargets : undefined\n    );\n}\n\n/**\n * Public host for a project — `<subdomain>.<base>`, or the bare subdomain when\n * the base domain is unknown.\n *\n * It deliberately never falls back to a guessed domain. The user copies this\n * string into a browser, so a plausible-but-wrong hostname is worse than an\n * obviously incomplete one: `acme.rebase.pro` looks reachable and isn't, while\n * `acme` reads as \"the subdomain is acme\" and prompts no wasted debugging.\n */\nexport function formatTenantHost(\n    subdomain: string | undefined,\n    baseDomain: string | undefined\n): string | undefined {\n    if (!subdomain) return undefined;\n    return baseDomain ? `${subdomain}.${baseDomain}` : subdomain;\n}\n\n/** The fields of a project row this module needs to render a host. */\nexport interface HostableProject {\n    subdomain?: string;\n    /** Resolved server-side; absent on control planes older than the host hook. */\n    host?: string;\n}\n\n/**\n * The host to display for a project.\n *\n * Prefers `host` off the record: the control plane resolves it through the same\n * `tenantHost()` the ingress uses, so it accounts for the project's *cluster*\n * base domain. The CLI cannot compute that itself — `clusters` is admin-only\n * under RLS, so a normal user's token cannot read `baseDomain`, and a project on\n * a second cluster is served somewhere the platform default does not name.\n *\n * `baseDomain` (from `platform-config`) remains the fallback for a control plane\n * that predates the hook — right for the single-cluster case, which is every\n * project today.\n */\nexport function projectHost(\n    project: HostableProject,\n    baseDomain: string | undefined\n): string | undefined {\n    return project.host || formatTenantHost(project.subdomain, baseDomain);\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   Project link file (.rebase/cloud.json)\n   ═══════════════════════════════════════════════════════════════ */\n\nexport interface ProjectLink {\n    url: string;\n    projectId: string;\n    /** The project's subdomain — the slug users see in console URLs and type into --project. */\n    slug?: string;\n    projectName?: string;\n    orgId?: string;\n    /**\n     * Base URL of the project's own API.\n     *\n     * For a cloud project this is a convenience derived from the subdomain. For\n     * a **self-hosted** project it is the entire link: there is no control plane\n     * to look anything up in, so `projectId` is empty and this is what commands\n     * resolve against.\n     *\n     * Keeping both kinds of link in one file is deliberate. A second link file\n     * for self-hosting would fork every command that reads one, and the tooling\n     * would drift into being cloud-only by accident.\n     */\n    apiUrl?: string;\n    /**\n     * How this checkout is linked. Absent means `cloud` — which is every link\n     * written before this field existed.\n     */\n    mode?: \"cloud\" | \"direct\";\n}\n\nexport function readLink(cwd: string = process.cwd()): ProjectLink | null {\n    try {\n        return JSON.parse(fs.readFileSync(projectLinkPath(cwd), \"utf-8\")) as ProjectLink;\n    } catch {\n        return null;\n    }\n}\n\nexport function writeLink(link: ProjectLink, cwd: string = process.cwd()): void {\n    const file = projectLinkPath(cwd);\n    fs.mkdirSync(path.dirname(file), { recursive: true });\n    fs.writeFileSync(file, JSON.stringify(link, null, 2));\n}\n\nexport function removeLink(cwd: string = process.cwd()): boolean {\n    const file = projectLinkPath(cwd);\n    if (fs.existsSync(file)) {\n        fs.rmSync(file);\n        return true;\n    }\n    return false;\n}\n\n/**\n * Flags that may appear anywhere on a `rebase cloud` line, including *before*\n * the resource group.\n *\n * They have to be declared wherever positionals are resolved, because `arg`'s\n * `permissive: true` does not merely tolerate an undeclared flag — it pushes it\n * into `_` alongside the positionals, and for a flag that takes a value it\n * pushes the value in too. So `cloud --project acme storage create` parsed\n * without this spec yields `_` of `[\"--project\", \"acme\", \"storage\", \"create\"]`,\n * and the group reads as `\"acme\"`: a real project name, in the group position,\n * dispatching to nothing. Skipping tokens that start with `-` does not save you\n * there — the damage is the orphaned value, which looks exactly like a\n * positional.\n *\n * Only genuinely global flags belong here. Group-specific ones (`--bucket`,\n * `--region`, …) are declared by the handler that owns them. They can still\n * precede the action — or stand in for it, on a group with a default — so the\n * dispatcher also declares every one that takes a value: `CLOUD_VALUE_FLAGS`\n * in `index.ts`.\n *\n * `-p` is `--project` in eighteen places and `--password` in `login`. That\n * ambiguity does not matter to the one caller that reads this spec: it resolves\n * positionals and never looks at a flag's value, so all it needs to know is\n * that `-p` takes one. Anything that wants the value must keep declaring it\n * itself, with the meaning its own command gives it.\n */\nexport const GLOBAL_CLOUD_FLAGS = {\n    \"--json\": Boolean,\n    \"--yes\": Boolean,\n    \"--help\": Boolean,\n    \"--project\": String,\n    /* `resolveCloudUrl` reads this off the raw line for EVERY command in the\n       family — it is the first entry in the URL priority list — so a strict\n       parse that did not declare it would reject a flag the CLI itself honours\n       on the command being parsed. */\n    \"--url\": String,\n    \"-p\": \"--project\",\n    \"-y\": \"--yes\",\n    \"-h\": \"--help\"\n} as const;\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\n/**\n * The raw project reference to operate on: explicit `--project` flag wins,\n * otherwise the linked project. Exits with guidance when neither is present.\n * The value is a slug (the project's subdomain, as shown in console URLs) or,\n * for old scripts and link files, a raw project UUID.\n */\nexport function requireProjectRef(rawArgs: string[]): string {\n    const parsed = arg({ \"--project\": String,\n\"-p\": \"--project\" }, { argv: rawArgs.slice(2),\npermissive: true });\n    if (parsed[\"--project\"]) return parsed[\"--project\"];\n    const link = readLink();\n    if (link?.projectId) return link.projectId;\n    fail(\n        \"No project specified and this directory is not linked.\",\n        `Pass ${chalk.bold(\"--project <slug>\")} or run ${chalk.bold(\"rebase cloud link\")}.`,\n        \"no_project\"\n    );\n}\n\n/**\n * Resolve a project reference — slug or UUID — to the internal id the API\n * takes, or undefined when no such project is visible. Slugs cost one lookup;\n * UUIDs pass through untouched so linked directories and old scripts skip the\n * round-trip.\n */\nexport async function lookupProjectId(ref: string, client: CloudClient): Promise<string | undefined> {\n    if (UUID_RE.test(ref)) return ref;\n    const res = await client.data.collection(\"projects\").find({\n        where: { subdomain: [\"==\", ref] },\n        limit: 1\n    });\n    const row = res.data[0] as { id?: string | number } | undefined;\n    return row?.id === undefined ? undefined : String(row.id);\n}\n\n/** Like `lookupProjectId`, but exits with guidance when the ref matches nothing. */\nexport async function resolveProjectRef(ref: string, client: CloudClient): Promise<string> {\n    const id = await lookupProjectId(ref, client);\n    if (id === undefined) {\n        fail(\n            `No project with slug ${chalk.bold(ref)}.`,\n            `List yours with ${chalk.bold(\"rebase cloud projects\")}.`,\n            \"project_not_found\"\n        );\n    }\n    return id;\n}\n\n/** `requireProjectRef` + `resolveProjectRef` in one step. */\nexport async function requireProject(rawArgs: string[], client: CloudClient): Promise<string> {\n    return resolveProjectRef(requireProjectRef(rawArgs), client);\n}\n\n/**\n * The project reference to SHOW: the slug the user typed or the linked slug.\n * Never resolves — for human output only. Old link files predate `slug` and\n * fall back to the stored id.\n */\nexport function displayProjectRef(rawArgs: string[]): string {\n    const parsed = arg({ \"--project\": String,\n\"-p\": \"--project\" }, { argv: rawArgs.slice(2),\npermissive: true });\n    if (parsed[\"--project\"]) return parsed[\"--project\"];\n    const link = readLink();\n    return link?.slug || link?.projectId || \"\";\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   Machine-readable output mode\n   ═══════════════════════════════════════════════════════════════\n\n   Rebase is built for agents, and the CLI is their primary interface. An agent\n   must never scrape a colorized table, so every cloud command can emit a single\n   JSON value instead of human output.\n\n   JSON mode is on when ANY of these hold:\n     • `--json` was passed,\n     • `REBASE_JSON=1` is set, or\n     • stdout is not a TTY (piped/redirected — i.e. a program is reading it).\n\n   In JSON mode a command prints exactly one JSON value to stdout and nothing\n   else; errors print `{\"error\":{...}}` and exit non-zero. The mode is a\n   process-global set once, at dispatch, by `initOutputMode` — every helper here\n   (fail, reportError, emit) reads it so the whole family is consistent.\n\n   ── The stream contract ─────────────────────────────────────────────────────\n\n   The mode decides the SHAPE of the result. It does not decide which stream\n   anything lands on; that rule is fixed and holds in both modes:\n\n     stdout  the command's result, and nothing else — one human rendering or\n             one JSON value. A caller may redirect it into a parser.\n     stderr  everything that is not the result: progress, advice, warnings,\n             errors, and the interactive prompts.\n\n   Nothing is written to both. That is the whole rule, and it is worth stating\n   because the family drifted off it in a way that reads as a bug in the report\n   itself: a warning from the SDK went to stderr while the report went to\n   stdout, so `whoami 2>&1` interleaved two unrelated voices and the header\n   looked like it had been printed twice.\n\n   The practical consequence for a new command: the ONLY things that may call\n   `console.log` are inside an `emit` human closure. Progress and next-step\n   advice go through `note`, cautions through `warn`, outcomes through\n   `success` — all of which write to stderr. `keyValues` prints result rows and\n   so stays on stdout, which is why it belongs inside the `emit` closure too.\n*/\n\nlet JSON_MODE = false;\n\n/**\n * Resolve and latch the output mode for this invocation. Call once at the top of\n * `cloudCommand`, before anything can print or `fail`. Returns the resolved mode\n * (handy for tests, which otherwise leave it at its `false` default).\n */\nexport function initOutputMode(rawArgs: string[]): boolean {\n    const parsed = arg({ \"--json\": Boolean }, { argv: rawArgs.slice(2),\npermissive: true });\n    // Most explicit wins. `REBASE_JSON=0` is the half that was missing: the\n    // \"stdout is not a TTY\" rule is right for a result, and wrong for the reader\n    // who ran `rebase cloud env --help | less` and got a JSON object. There was\n    // no way to say so — `--json` could only turn the mode ON, and `REBASE_JSON`\n    // was tested against \"1\" alone, so any other value including \"0\" fell\n    // through to the TTY test and set it anyway. Any spelling of yes or no now\n    // decides; only an unset or unrecognised value leaves it to the TTY.\n    if (parsed[\"--json\"]) JSON_MODE = true;\n    else JSON_MODE = parseEnvBoolean(process.env.REBASE_JSON) ?? process.stdout.isTTY !== true;\n    return JSON_MODE;\n}\n\n/** Whether the current invocation is emitting machine-readable JSON. */\nexport function isJsonMode(): boolean {\n    return JSON_MODE;\n}\n\n/** Force the mode (tests only — production latches it via `initOutputMode`). */\nexport function setJsonModeForTest(value: boolean): void {\n    JSON_MODE = value;\n}\n\n/** Strip ANSI colour codes — JSON output must never carry terminal escapes. */\n// eslint-disable-next-line no-control-regex\nconst ANSI_RE = /\u001b\\[[0-9;]*m/g;\nfunction stripAnsi(s: string): string {\n    return s.replace(ANSI_RE, \"\");\n}\n\n/**\n * Write one JSON value to stdout, followed by a newline.\n *\n * Indented, because the overwhelmingly common reader is a person or an agent\n * looking at a terminal — JSON mode is entered automatically whenever stdout is\n * not a TTY, so `rebase cloud deployments list` piped anywhere at all produced\n * a project's entire deployment history as one unwrapped line. `JSON.parse`\n * does not care about the whitespace; everything else does.\n */\nexport function printJson(value: unknown): void {\n    process.stdout.write(JSON.stringify(value, null, 2) + \"\\n\");\n}\n\n/**\n * The one output primitive every new command uses: in JSON mode emit `json`\n * (and nothing else); otherwise run `human`. Keeping the two behind a single\n * call is what guarantees a command can never print a table AND a JSON blob.\n */\nexport function emit<T>(human: () => void, json: JsonArg<T>): void {\n    if (JSON_MODE) printJson(json);\n    else human();\n}\n\n/**\n * The JSON payload, which must be a value and not a producer of one.\n *\n * `json: unknown` accepted a function without complaint, and four call sites in\n * `resources.ts` passed `() => ({ … })` — mirroring the human argument beside\n * it, which *is* a thunk. In JSON mode `printJson` then stringified a function,\n * which is `undefined`. So `rebase cloud compute`, `compute set` and two\n * cluster commands printed the single word `undefined` on every piped or\n * `--json` run — and since this family forces JSON mode off a TTY, that is\n * every scripted use of them.\n *\n * Typed so the mistake cannot be made again: a function resolves the parameter\n * to `never`, and the call site fails to compile.\n */\nexport type JsonArg<T> = T extends (...args: never[]) => unknown ? never : T;\n\n/**\n * Print a help page — the human one, or a machine-readable description of the\n * same command in JSON mode.\n *\n * `--help` is the one place where \"stdout is not a TTY\" is a weak signal: a\n * person runs `rebase cloud db --help | less` and wants the page. But the rule\n * this family promises is that stdout carries one JSON value whenever it is not\n * a terminal, and a help page is the easiest possible thing to describe\n * structurally — so rather than carve out an exception, help answers the same\n * question in the reader's own language. For an agent, `--help` piped is then a\n * discovery call rather than 60 lines of ANSI to scrape.\n *\n * `env` shipped this shape first, alone; this generalises it so every group\n * answers the same way.\n */\nexport function emitHelp(\n    command: string,\n    actions: Array<string | HelpAction>,\n    human: () => void,\n    extra: Record<string, unknown> = {}\n): void {\n    emit(human, { command,\nactions: actions.map(entry => describeAction(entry, command)),\n...extra });\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   Group help pages\n   ═══════════════════════════════════════════════════════════════ */\n\n/**\n * One action on a group's help page.\n *\n * The page used to exist twice: a hand-formatted template literal for a\n * terminal, and a bare list of action WORDS for everything else. So the two\n * answers to `--help` were not the same answer — piped, `rebase cloud env\n * --help` said `[\"list\",\"set\",\"unset\",\"reveal\",\"pull\"]` and not one description,\n * not one flag, and not the sentence about build-time variables that is the\n * whole reason the page exists. This family forces JSON mode off a TTY, so that\n * was every scripted and every agent-driven read of it.\n *\n * One description, rendered twice.\n */\nexport interface HelpAction {\n    /** The action word: `set`, `backup restore`. */\n    action: string;\n    /** The usage tail after the word: `KEY=VALUE`, `<domain>`, `[-y]`. */\n    args?: string;\n    /** One line: what it does. */\n    description: string;\n    /** Flags this action takes of its own, `[flag, description]`. */\n    flags?: Array<[string, string]>;\n    /** The heading it sits under, on a page that groups its actions. */\n    section?: string;\n}\n\n/** A whole group page — `rebase cloud env --help`. */\nexport interface GroupHelp {\n    /** The command words, no leading `rebase`: `cloud env`, or `cloud` itself. */\n    command: string;\n    /** The title's tail: \"Environment variables\". */\n    title: string;\n    actions: HelpAction[];\n    /** Options that belong to the group rather than to one action. */\n    options?: Array<[string, string]>;\n    /** Closing paragraphs — the things a reader gets wrong more than once. */\n    notes?: string[];\n}\n\n/**\n * Normalise an action for the JSON form. Strings stay legal — the index page\n * lists group names, which are not actions of the command being described.\n *\n * `command` is the page's own command (`cloud env`), so the usage line a caller\n * reads is a line it can run: without it the answer said `rebase cloud set\n * KEY=VALUE`, which is a command that does not exist.\n */\nfunction describeAction(entry: string | HelpAction, command: string): Record<string, unknown> {\n    if (typeof entry === \"string\") return { action: entry,\ndescription: \"\",\nflags: [] };\n    return {\n        action: entry.action,\n        usage: `rebase ${command} ${entry.action}${entry.args ? ` ${entry.args}` : \"\"}`,\n        description: entry.description,\n        flags: (entry.flags ?? []).map(([flag, description]) => ({ flag,\ndescription }))\n    };\n}\n\n/**\n * Flags every cloud command accepts, documented once.\n *\n * Lives here rather than in `action-help.ts` because both help renderers print\n * it and `action-help` imports this module, not the other way round.\n */\nexport const GLOBAL_HELP_FLAGS: Array<[string, string]> = [\n    [\"--project, -p <slug>\", \"Operate on a project without linking this directory\"],\n    [\"--json\", \"Machine-readable output (also when piped, or REBASE_JSON=1)\"],\n    [\"--url <origin>\", \"Target a specific control plane (or REBASE_CLOUD_URL)\"],\n    [\"--yes, -y\", \"Skip confirmation prompts\"],\n    [\"--debug\", \"Print the untouched error body after a failure\"]\n];\n\n/**\n * Flag names `parseCloudArgs` adds to every command in the family.\n *\n * Derived from `GLOBAL_CLOUD_FLAGS` rather than listed again — a second copy is\n * how a global gains a spelling that the collision sweep does not know about.\n * `--debug` is the one addition: `bin/rebase.js` takes it off `process.argv`\n * itself, so no cloud spec declares it and every command still accepts it.\n */\nexport const GLOBAL_SPEC_KEYS = new Set([...Object.keys(GLOBAL_CLOUD_FLAGS), \"--debug\"]);\n\n/** Column width for an action word (+ its args) before its description. */\nconst HELP_COLUMN = 28;\n\n/**\n * The gap after `text` in a `width`-wide column, never less than one space.\n *\n * `padEnd` returns the string unchanged when it is already at the width, which\n * glues the description onto the flag: `--connection-string <url>The external…`.\n */\nfunction pad(text: string, width: number): string {\n    return \" \".repeat(Math.max(1, width - text.length));\n}\n\n/**\n * Print a group's page — the human one, and the same content as JSON when piped.\n */\nexport function printGroupHelp(page: GroupHelp): void {\n    emitHelp(\n        page.command,\n        page.actions,\n        () => {\n            console.log(\"\");\n            console.log(`${chalk.bold(`rebase ${page.command}`)} — ${page.title}`);\n            console.log(\"\");\n            console.log(chalk.green.bold(\"Usage\"));\n            console.log(`  rebase ${page.command} ${chalk.blue(\"<action>\")} [options]`);\n\n            let section: string | undefined;\n            for (const entry of page.actions) {\n                const heading = entry.section ?? \"Commands\";\n                if (heading !== section) {\n                    section = heading;\n                    console.log(\"\");\n                    console.log(chalk.green.bold(heading));\n                }\n                const word = `${entry.action}${entry.args ? ` ${entry.args}` : \"\"}`;\n                console.log(\n                    `  ${chalk.blue.bold(entry.action)}${entry.args ? ` ${chalk.gray(entry.args)}` : \"\"}`\n                    + `${pad(word, HELP_COLUMN)}${entry.description}`\n                );\n                for (const [flag, description] of entry.flags ?? []) {\n                    console.log(`      ${chalk.blue(flag)}${pad(flag, HELP_COLUMN - 4)}${chalk.gray(description)}`);\n                }\n            }\n\n            if (page.options?.length) {\n                console.log(\"\");\n                console.log(chalk.green.bold(\"Options\"));\n                for (const [flag, description] of page.options) {\n                    console.log(`  ${chalk.blue(flag)}${pad(flag, HELP_COLUMN)}${description}`);\n                }\n            }\n\n            console.log(\"\");\n            console.log(chalk.green.bold(\"Global options\"));\n            for (const [flag, description] of GLOBAL_HELP_FLAGS) {\n                console.log(`  ${chalk.blue(flag)}${pad(flag, HELP_COLUMN)}${chalk.gray(description)}`);\n            }\n\n            if (page.notes?.length) {\n                console.log(\"\");\n                for (const note of page.notes) console.log(chalk.gray(`  ${note}`));\n            }\n            console.log(\"\");\n        },\n        {\n            usage: `rebase ${page.command} <action> [options]`,\n            summary: page.title,\n            options: (page.options ?? []).map(([flag, description]) => ({ flag,\ndescription })),\n            globalFlags: GLOBAL_HELP_FLAGS.map(([flag, description]) => ({ flag,\ndescription })),\n            notes: page.notes ?? []\n        }\n    );\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   Output helpers\n   ═══════════════════════════════════════════════════════════════ */\n\n/**\n * Print a warning (+ optional hint) — in every output mode, always to stderr.\n *\n * `emit` is for a command's *result*, and JSON mode legitimately replaces the\n * human rendering of one. A warning is not a result: it says the command is\n * about to do something the caller may not have meant, and that is exactly as\n * true when the output is piped. Gating one on `!isJsonMode()` deleted it\n * precisely where nobody was watching the terminal — a `--source` deploy ejected\n * a live project off the managed runtime and said so only to a TTY that wasn't\n * there.\n *\n * stdout carries the JSON value and nothing else, so warnings go to stderr:\n * a machine parser reading stdout cannot be corrupted by one. Only the\n * *formatting* may depend on the mode — colour and indentation for a terminal,\n * plain ASCII otherwise. Whether a warning is emitted at all may not.\n *\n * Anything a caller might branch on belongs in the JSON payload as well; stderr\n * is for whoever reads the transcript afterwards.\n */\nexport function warn(message: string, hint?: string): void {\n    if (JSON_MODE) {\n        process.stderr.write(`warning: ${stripAnsi(message)}\\n`);\n        if (hint) process.stderr.write(`  ${stripAnsi(hint)}\\n`);\n        return;\n    }\n    console.error(\"\");\n    console.error(chalk.yellow(`  ⚠ ${message}`));\n    if (hint) console.error(chalk.gray(`    ${hint}`));\n}\n\n/**\n * Print an error (+ optional hint) and exit non-zero. Never returns.\n *\n * `code` is the field a caller branches on, and it defaults to `\"error\"` rather\n * than `null`. An envelope whose only machine-readable field is null is not\n * machine-readable — `{\"error\":{\"message\":\"No project specified…\",\"code\":null}}`\n * forced the very substring-matching on `message` that the envelope exists to\n * make unnecessary, and `message` is the field most likely to be reworded.\n *\n * `\"error\"` is deliberately a poor code: it says \"this refusal has not been\n * classified yet\" without ever being absent. Anything a caller might plausibly\n * want to distinguish — `usage`, `not_found`, `unauthenticated` — passes a real\n * one. Codes are part of the CLI's contract once shipped; see\n * `cloud-reporting.test.ts`, which pins the ones commands are documented to\n * return.\n */\nexport function fail(message: string, hint?: string, code?: string): never {\n    if (JSON_MODE) {\n        printJson({ error: { message: stripAnsi(message),\ncode: code ?? \"error\",\nhint: hint ? stripAnsi(hint) : undefined } });\n        process.exit(1);\n    }\n    console.error(\"\");\n    console.error(chalk.red(`  ✗ ${message}`));\n    if (hint) console.error(chalk.gray(`  ${hint}`));\n    console.error(\"\");\n    process.exit(1);\n}\n\n/**\n * Confirm a destructive/irreversible action, respecting non-interactive use.\n *\n * With `--yes`/`-y` it proceeds silently. In JSON mode or a non-TTY it REFUSES\n * to prompt — a prompt that can hang is a known repo landmine — and fails,\n * telling the caller to pass `--yes`. Only an interactive terminal gets a real\n * confirm prompt; declining there aborts cleanly (exit 0).\n */\nexport async function confirmDestructive(opts: { yes: boolean; prompt: string }): Promise<void> {\n    if (opts.yes) return;\n    if (JSON_MODE || process.stdin.isTTY !== true) {\n        fail(\n            \"This action is destructive and needs confirmation.\",\n            `Re-run with ${chalk.bold(\"--yes\")} to proceed.`,\n            \"confirmation_required\"\n        );\n    }\n    const { confirmed } = (await inquirer.prompt([\n        { type: \"confirm\",\nname: \"confirmed\",\ndefault: false,\nmessage: opts.prompt }\n    ] as Parameters<typeof inquirer.prompt>[0])) as { confirmed: boolean };\n    if (!confirmed) {\n        // stderr: declining is not a result. Unreachable in JSON mode — the\n        // guard above already refused rather than prompt — so stdout stays\n        // empty and the exit code carries the outcome.\n        console.error(chalk.gray(\"  Aborted.\"));\n        process.exit(0);\n    }\n}\n\n/**\n * Refuse, rather than prompt, when there is nobody to answer.\n *\n * `confirmDestructive` has always done this for yes/no confirmations. The\n * *value* prompts had no such guard: `cloud login`, `cloud link`, `cloud use`,\n * `cloud orgs create` and `cloud db create` all called `inquirer.prompt`\n * unconditionally, so piping any of them — which is how an agent runs every\n * command in this family — parked the process on a prompt reading from a stdin\n * that was never going to produce a line. A hang is the worst failure mode\n * available here: no output, no exit code, nothing to retry on.\n *\n * @param what   what the prompt would have asked for, e.g. \"an email and password\"\n * @param flags  the flags that supply it non-interactively\n */\nexport function requireInteractive(what: string, flags: string): void {\n    if (JSON_MODE || process.stdin.isTTY !== true) {\n        fail(\n            `This command needs ${what}, and there is no terminal to ask on.`,\n            `Pass ${chalk.bold(flags)}.`,\n            \"input_required\"\n        );\n    }\n}\n\n/**\n * Resolve one cloud command's flags and ARGUMENTS from the full `process.argv`.\n *\n * This replaces `cloudPositionals`, which was `rawArgs.slice(3).filter(a =>\n * !a.startsWith(\"-\"))`. Dropping `-`-prefixed tokens looks like it solves the\n * permissive-parse problem and does not: a flag that takes a VALUE leaves the\n * value behind, an ordinary word in the argument position that no filter can\n * tell from a real one. `--project` is the flag every one of these commands\n * documents, so the failure was reachable from the help page:\n *\n *   rebase cloud env unset -p acme            → removed the variable \"acme\"\n *   rebase cloud env set KEY -p acme          → stored the value \"acme\"\n *   rebase cloud domains add -p acme          → registered the domain \"acme\"\n *   rebase cloud webhooks delete -p acme 42   → deleted webhook \"acme\", not 42\n *   rebase cloud cancel -p acme               → cancelled deployment id \"acme\"\n *\n * The filter's other half is quieter. A flag nobody declared *is* dropped by\n * it — but only from the operands, never from the run: nothing rejects it, so\n * the command proceeds with the argument missing or defaulted. `db backup\n * --dry-run` listed backups, `domains remove --dry-run` detached the domain,\n * and `env set KEY=v --secrett` stored the value as an ordinary variable that\n * `env reveal` will hand back. The one place an undeclared flag became the\n * argument outright is `projects info|delete`, which resolved its id through\n * `positionals()` instead — that skips only LEADING `-` tokens, so `projects\n * delete --force` looked up a project named \"--force\".\n *\n * So: parse the whole line strictly, through the same `parseCommandArgs` the\n * non-cloud commands use — `arg` then consumes each declared flag *with its\n * value* wherever it appears, and rejects the undeclared, leaving `_` holding\n * the command words followed by the real arguments. `commandWords` counts from\n * `cloud` itself (`cloud env set` ⇒ 3), and is applied to the parsed\n * positionals, so a flag written before the group shifts nothing.\n *\n * Two things this adds over calling `parseCommandArgs` directly, and the reason\n * it is worth a wrapper:\n *\n *  - `GLOBAL_CLOUD_FLAGS` is merged in. `--json`, `--yes` and `--project` may\n *    appear anywhere on a cloud line including before the group, so a strict\n *    parse that did not declare them would reject the CLI's own documented\n *    usage. (`parseCommandArgs` adds `--debug`/`--help` on top of that.)\n *  - A parse error is reported through `fail`, not thrown. A throw reaches\n *    `bin/rebase.js`, which prints `✗ …` to stderr — which is right for every\n *    other command and wrong here: `rebase cloud` is in JSON mode whenever\n *    stdout is not a TTY, i.e. always for the agents this family is built for,\n *    and it promises them exactly one JSON value. `fail` keeps that promise,\n *    with the same `usage` code the other refusals in this family use.\n */\nexport function parseCloudArgs<S extends arg.Spec>(opts: {\n    spec: S;\n    rawArgs: string[];\n    commandWords: number;\n    /** Names the command in errors, e.g. `cloud env set` (no leading `rebase`). */\n    command: string;\n    maxPositionals?: number;\n}): { flags: arg.Result<S & typeof GLOBAL_CLOUD_FLAGS>; positionals: string[] } {\n    const spec = { ...GLOBAL_CLOUD_FLAGS,\n...opts.spec };\n    try {\n        const parsed = parseCommandArgs({ ...opts,\nspec });\n        return { flags: parsed.flags,\npositionals: parsed.positionals };\n    } catch (err) {\n        fail(err instanceof Error ? err.message : String(err), undefined, \"usage\");\n    }\n}\n\n/**\n * Refuse an action word its group does not dispatch. Returns for `undefined`,\n * which is every group's default action.\n *\n * The groups that switch on their action already do this in a `default:` case.\n * The groups written as a chain of `if (action === \"x\") return …` did not: a\n * word that matched nothing fell out of the chain into the *default* action, so\n * `rebase cloud storage creat` listed the buckets and exited 0, and\n * `rebase cloud billing usage` printed the account. Reporting a typo as a\n * successful run of a different command is the failure mode this family exists\n * to not have — an agent branching on the exit code learns nothing, and a person\n * reads the output of a command they did not ask for.\n *\n * One spelling, so the code is `unknown_command` everywhere rather than the\n * default `\"error\"` half of them used, and the hint always names the group's own\n * `--help` rather than the index page.\n */\nexport function requireKnownAction(\n    group: string,\n    action: string | undefined,\n    known: readonly string[]\n): void {\n    if (action === undefined || known.includes(action)) return;\n    fail(\n        `Unknown ${group} command: ${action}`,\n        `Run \\`rebase cloud ${group} --help\\`. Actions: ${known.join(\", \")}.`,\n        \"unknown_command\"\n    );\n}\n\n/**\n * `--timeout <seconds>` as milliseconds, or `fallbackMs` when it was not given.\n *\n * One function rather than one per command, because two commands take this flag\n * and a second copy is where the two would come to disagree about what\n * `--timeout 0` means.\n *\n * A value this cannot read is a refusal, not a fall back to the default. The\n * whole reason a caller passes a timeout is that it has a deadline of its own;\n * quietly substituting a different one is how a fifteen-minute wait turns up\n * inside a five-minute CI step, having been asked for `--timeout 30s`.\n */\nexport function resolveTimeoutMs(\n    value: string | undefined,\n    opts: { fallbackMs: number; command: string }\n): number {\n    if (value === undefined) return opts.fallbackMs;\n    const seconds = Number(value);\n    if (!Number.isFinite(seconds) || seconds <= 0) {\n        fail(\n            `--timeout takes a number of seconds (got \"${value}\").`,\n            `Run \\`rebase ${opts.command} --help\\`.`,\n            \"usage\"\n        );\n    }\n    return seconds * 1000;\n}\n\n/**\n * Announce an outcome — \"Logged in as …\", \"Deleted project …\".\n *\n * On **stderr**, in both modes. It reads like a result and is not one: the\n * result is the JSON value (or the table) on stdout, and every JSON payload in\n * this family already carries `success: true`. Leaving this on stdout meant a\n * successful `rebase cloud link | jq` was handed a green tick followed by an\n * object — one stream, two syntaxes, and only the second parseable.\n *\n * It stays visible in JSON mode, unlike `note`: an agent that got a `success`\n * line on a command it expected to refuse has learned something.\n */\nexport function success(message: string): void {\n    if (JSON_MODE) {\n        process.stderr.write(`${stripAnsi(message)}\\n`);\n        return;\n    }\n    console.error(\"\");\n    console.error(chalk.bold.green(`  ✓ ${message}`));\n    console.error(\"\");\n}\n\n/**\n * Narrate progress, or point at the next step — \"Signing in to …\", \"Redeploy\n * for the tenant to pick this up\".\n *\n * stderr, and **suppressed entirely in JSON mode**. This is the one helper that\n * a mode may silence, and the distinction from `warn` is worth keeping sharp:\n *\n *   - A warning is a *condition*. It is as true when piped as when watched, so\n *     silencing it hides something the caller would want to know. `warn` never\n *     silences.\n *   - A note is *hand-holding*. \"Next: run `rebase generate-sdk`\" tells a person\n *     what to type; the agent reading the JSON already has the same information\n *     structurally, or does not need it. Printing it anyway is transcript noise.\n *\n * When in doubt it is a warning. The cost of a needless warning is a line; the\n * cost of a swallowed one is the deploy that ejected a project off the managed\n * runtime and said so only to a terminal nobody was looking at.\n */\nexport function note(message: string, indent = \"  \"): void {\n    if (JSON_MODE) return;\n    console.error(`${indent}${message}`);\n}\n\n/** A blank spacer line on the narration stream. No-op in JSON mode. */\nexport function noteBlank(): void {\n    if (JSON_MODE) return;\n    console.error(\"\");\n}\n\n/** Colorize a deployment / resource status token. */\nexport function colorStatus(status: string | undefined): string {\n    switch (status) {\n        case \"active\":\n        case \"success\":\n        case \"connected\":\n            return chalk.green(status);\n        case \"deploying\":\n        case \"provisioning\":\n        case \"pending_billing\":\n        case \"untested\":\n            return chalk.yellow(status ?? \"\");\n        case \"failed\":\n            return chalk.red(status);\n        case \"stopped\":\n            return chalk.gray(status);\n        default:\n            return chalk.gray(status ?? \"unknown\");\n    }\n}\n\n/**\n * Render a two-column key/value block with aligned keys. Empty rows are skipped\n * — including `null`, which the API sends for an unset column and which used to\n * print the literal string \"null\" (e.g. `Custom domain: null`).\n */\nexport function keyValues(rows: Array<[string, string | null | undefined]>): void {\n    const width = Math.max(...rows.map(([k]) => k.length));\n    for (const [k, v] of rows) {\n        if (v === undefined || v === null || v === \"\") continue;\n        console.log(`  ${chalk.gray(`${k}:`.padEnd(width + 1))} ${v}`);\n    }\n}\n\n/**\n * Surface an SDK/HTTP error consistently. The SDK throws RebaseApiError with\n * a `.status` and `.message`; anything else falls back to its string form.\n *\n * The message is summarised rather than printed — see `summarizeError`. What\n * arrives here is routinely a whole Kubernetes `Status` object with the request\n * headers appended, and the one sentence worth reading is inside it. The\n * untouched body is still available, behind `--debug`, on stderr where it\n * cannot corrupt the JSON value on stdout.\n */\nexport function reportError(e: unknown, context: string): never {\n    const err = e as { status?: number; message?: string; code?: string };\n    const summary = summarizeError(e, context);\n\n    if (wantsRawError()) {\n        process.stderr.write(`\\n${summary.raw}\\n\\n`);\n    }\n\n    if (JSON_MODE) {\n        printJson({\n            error: {\n                message: stripAnsi(summary.message),\n                // The SDK supplies a code for errors the API classified. When it\n                // does not, the HTTP status still classifies it well enough to\n                // branch on — `http_401` and `http_502` want very different\n                // handling, and both used to arrive as `null`. A cluster\n                // refusal classifies itself, and `platform` below says whether\n                // acting on it is even the caller's business.\n                code: summary.code,\n                status: err?.status ?? null,\n                hint: summary.hint ? stripAnsi(summary.hint) : undefined,\n                platform: summary.platform,\n                context\n            }\n        });\n        process.exit(1);\n    }\n    fail(summary.message, summary.hint, summary.code);\n}\n\n/**\n * Open a URL in the user's default browser (best effort). Always announces the\n * URL first so it stays usable over SSH or when no browser is available.\n *\n * The announcement is narration, not the result — it goes to stderr, and in\n * JSON mode it is silent. Every caller `emit`s the same URL in its payload, so\n * a machine reader gets it from the one place it is guaranteed to be parseable\n * rather than from a line that happens to end in a URL.\n */\nexport function openUrl(target: string, label = \"Opening\"): void {\n    noteBlank();\n    note(`${label} ${chalk.cyan(target)}`);\n    noteBlank();\n    const opener =\n        process.platform === \"darwin\" ? \"open\" : process.platform === \"win32\" ? \"start\" : \"xdg-open\";\n    try {\n        const child = spawn(opener, [target], {\n            stdio: \"ignore\",\n            detached: true,\n            shell: process.platform === \"win32\"\n        });\n        child.on(\"error\", () => {\n            /* URL already printed for manual copy */\n        });\n        child.unref();\n    } catch {\n        /* URL already printed */\n    }\n}\n\n/**\n * The one thing every control-plane row is required to have.\n *\n * The subcommands each declare their own row shape — `OrgRow`, `ProjectRow`,\n * `DatabaseRow`, `DeploymentRow` — and every one of them is an `id` plus\n * fields that are all optional, because a control plane older than a given\n * column simply does not send it. The reads are written that way too\n * (`o.name ?? \"(unnamed)\"`, `row.slug ? … : \"\"`).\n */\nexport interface CloudRow {\n    id: string | number;\n}\n\n/**\n * Read the control plane's rows as a subcommand's row shape.\n *\n * `client.data.collection(...)` is typed against the *generated* schema of the\n * project the SDK is pointed at, and the control-plane collections this CLI\n * reads are not in one — so every row arrives as an open\n * `Record<string, unknown>`. A declared `interface` gets no implicit index\n * signature, so it does not overlap that, and a direct `as` is refused: which\n * is how ten call sites came to write `as unknown as XRow[]`, an assertion\n * about a wire payload with nothing checking it in either direction.\n *\n * There is exactly one invariant to check and this checks it. Everything else\n * the shapes declare is optional and already read as such, so there is nothing\n * further to verify — but a row with no usable `id` is not a row any of these\n * commands can act on, and passing it through was how a listing came to print\n * `[undefined]` and a lookup came to compare against the string `\"undefined\"`.\n */\nexport function cloudRows<T extends CloudRow>(rows: readonly Record<string, unknown>[] | undefined): T[] {\n    return (rows ?? []).filter((row): row is Record<string, unknown> & T =>\n        typeof row?.id === \"string\" || typeof row?.id === \"number\");\n}\n\n/** {@link cloudRows} for an endpoint that returns a single row. */\nexport function cloudRow<T extends CloudRow>(row: Record<string, unknown> | undefined): T | undefined {\n    return cloudRows<T>(row ? [row] : [])[0];\n}\n\n/**\n * {@link cloudRows} for a write that must have produced a row.\n *\n * `create()` returning something with no usable `id` means the control plane\n * accepted the write and then described it in a way this CLI cannot act on.\n * The callers all go straight on to use that id — `setContextOrg(url,\n * String(created.id))` — so asserting the shape, which is what stood here,\n * turned a control-plane fault into an organization whose active id is the\n * seven-letter string `\"undefined\"`, stored in the user's config file.\n */\nexport function requireCloudRow<T extends CloudRow>(\n    row: Record<string, unknown> | undefined,\n    what: string\n): T {\n    const parsed = cloudRow<T>(row);\n    if (!parsed) throw new Error(`The control plane accepted the ${what} but returned no id for it.`);\n    return parsed;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6DA,IAAM,wBAAwB;;;;;;;;;;;AAY9B,SAAgB,wBAAwB,MAA4C;CAChF,KAAK,IAAI,QAAQ,KAAK,QAAQ,GAAG,GAAG,UAAU,IAAI,QAAQ,KAAK,QAAQ,KAAK,QAAQ,CAAC,GAAG;EACpF,IAAI,QAAQ;EACZ,IAAI,WAAW;EACf,IAAI,UAAU;EACd,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,KAAK;GACtC,MAAM,KAAK,KAAK;GAChB,IAAI,SAAS;IACT,UAAU;IACV;GACJ;GACA,IAAI,OAAO,MAAM;IACb,UAAU;IACV;GACJ;GACA,IAAI,OAAO,MAAK;IACZ,WAAW,CAAC;IACZ;GACJ;GACA,IAAI,UAAU;GACd,IAAI,OAAO,KAAK;QACX,IAAI,OAAO,KAAK;IACjB;IACA,IAAI,UAAU,GAAG;IACjB,MAAM,YAAY,KAAK,MAAM,OAAO,IAAI,CAAC;IACzC,IAAI;IACJ,IAAI;KACA,SAAS,KAAK,MAAM,SAAS;IACjC,QAAQ;KACJ;IACJ;IACA,MAAM,MAAM;IAIZ,IAAI,KAAK,SAAS,YAAa,KAAK,WAAW,aAAa,OAAO,IAAI,SAAS,UAC5E,OAAO;KACH,SAAS,OAAO,IAAI,YAAY,WAAW,IAAI,UAAU,KAAA;KACzD,QAAQ,OAAO,IAAI,WAAW,WAAW,IAAI,SAAS,KAAA;KACtD,MAAM,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO,KAAA;KAChD,SAAU,IAAI,WAA2C,KAAA;IAC7D;IAEJ;GACJ;EACJ;CACJ;AAEJ;;;;;;;;;AAUA,SAAS,mBAAmB,SAAyB;CACjD,MAAM,MAAM,QAAQ,OAChB,kFACJ;CAEA,QADiB,MAAM,IAAI,QAAQ,MAAM,GAAG,GAAG,IAAI,QAAA,CAAS,KACrD,CAAA,CAAQ,QAAQ,aAAa,EAAE;AAC1C;;AAGA,IAAM,cAAc;;;;;;;;;AAUpB,SAAgB,eAAe,OAAgB,SAA+B;CAC1E,MAAM,MAAM;CACZ,MAAM,MAAM,KAAK,WAAW,OAAO,KAAK;CACxC,MAAM,MAAM,wBAAwB,GAAG;CAEvC,IAAI,KAAK;EACL,MAAM,QAAQ,IAAI,SAAS,KAAK,KAAK;EAIrC,KAHkB,IAAI,SAAS,OAAO,IAAI,WAAW,gBACvB,sBAAsB,KAAK,KAAK,GAG1D,OAAO;GAGH,SAAS,GAAG,QAAQ;GACpB,MACI,GAAG,SAAS,KAAK,EAAE;GAIvB,MAAM;GACN,UAAU;GACV;EACJ;EAGJ,OAAO;GACH,SAAS,GAAG,QAAQ,IAAI,SAAS,SAAS,IAAI,UAAU,iCAAiC;GACzF,MAAM,IAAI,OAAO,uBAAuB,IAAI,OAAO,IAAI,SAAS,KAAK,IAAI,OAAO,KAAK,GAAG,KAAK,KAAA;GAC7F,MAAM,IAAI,SAAS,OAAO,IAAI,OAAO,YAAY,MAAM;GACvD,UAAU;GACV;EACJ;CACJ;CAIA,MAAM,UAAU,mBAAmB,GAAG;CACtC,OAAO;EACH,SAAS,GAAG,UAAU,KAAK,SAAS,KAAK,IAAI,OAAO,KAAK,GAAG,IAAI,SAAS,WAAW,GAAG;EACvF,MAAM,KAAK,SAAS,KAAK,SAAS,QAAQ,IAAI,WAAW;EACzD,UAAU;EACV;CACJ;AACJ;AAEA,SAAS,SAAS,MAAsB;CACpC,MAAM,OAAO,KAAK,QAAQ,QAAQ,GAAG,CAAC,CAAC,KAAK;CAC5C,OAAO,KAAK,SAAS,cAAc,GAAG,KAAK,MAAM,GAAG,cAAc,CAAC,EAAE,KAAK;AAC9E;;;;;;;;;;;;;AAcA,SAAgB,cAAc,OAA0B,QAAQ,MAAe;CAC3E,OAAO,KAAK,SAAS,SAAS,KAAK,gBAAgB,QAAQ,IAAI,YAAY,MAAM;AACrF;;;;;;;;;;;;;;;;;;;ACrLA,IAAM,oBAAoB;;AAG1B,IAAM,kBAAkB;;AAGxB,SAAS,kBAA0B;CAC/B,OAAO,KAAK,KAAK,GAAG,QAAQ,GAAG,WAAW,kBAAkB;AAChE;;;;;;;;;;;;AAaA,SAAgB,mBAAmB,KAA2C;CAC1E,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO,KAAA;CACpD,KAAK,MAAM,OAAO;EAAC;EAAoB;EAAsB;CAAgB,GAAG;EAC5E,MAAM,QAAS,IAAgC;EAC/C,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UAAU,OAAO;CACvE;AAEJ;AAEA,SAAgB,gBAAgB,MAAc,QAAQ,IAAI,GAAW;CACjE,MAAM,OAAO,gBAAgB,GAAG,KAAK;CACrC,OAAO,KAAK,KAAK,MAAM,WAAW,YAAY;AAClD;AA0BA,SAAS,kBAAmC;CACxC,IAAI;EACA,MAAM,MAAM,GAAG,aAAa,gBAAgB,GAAG,OAAO;EACtD,MAAM,SAAS,KAAK,MAAM,GAAG;EAC7B,IAAI,CAAC,OAAO,UAAU,OAAO,WAAW,CAAC;EACzC,OAAO;CACX,QAAQ;EACJ,OAAO,EAAE,UAAU,CAAC,EAAE;CAC1B;AACJ;AAEA,SAAS,iBAAiB,MAA6B;CACnD,MAAM,OAAO,gBAAgB;CAC7B,GAAG,UAAU,KAAK,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;CAEpD,GAAG,cAAc,MAAM,KAAK,UAAU,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;CACrE,IAAI;EACA,GAAG,UAAU,MAAM,GAAK;CAC5B,QAAQ,CAER;AACJ;;AAGA,SAAS,oBAAwC;CAC7C,OAAO,gBAAgB,CAAC,CAAC;AAC7B;;AAGA,SAAgB,cAAc,KAAa,KAA+B;CACtE,MAAM,QAAQ,gBAAgB;CAC9B,MAAM,QAAQ,MAAM,SAAS,QAAQ,CAAC;CACtC,IAAI,KAAK,MAAM,MAAM;MAChB,OAAO,MAAM;CAClB,MAAM,SAAS,OAAO;CACtB,iBAAiB,KAAK;AAC1B;AAEA,SAAgB,cAAc,KAAiC;CAC3D,OAAO,gBAAgB,CAAC,CAAC,SAAS,IAAI,EAAE;AAC5C;AAMA,SAAS,sBAAsB,KAA0B;CACrD,OAAO;EACH,QAAQ,KAAK;GACT,IAAI,QAAQ,iBAAiB,OAAO;GACpC,OAAO,gBAAgB,CAAC,CAAC,SAAS,IAAI,EAAE,QAAQ;EACpD;EACA,QAAQ,KAAK,OAAO;GAChB,IAAI,QAAQ,iBAAiB;GAC7B,MAAM,QAAQ,gBAAgB;GAC9B,MAAM,QAAQ,MAAM,SAAS,QAAQ,CAAC;GACtC,MAAM,OAAO;GACb,MAAM,SAAS,OAAO;GACtB,IAAI,CAAC,MAAM,SAAS,MAAM,UAAU;GACpC,iBAAiB,KAAK;EAC1B;EACA,WAAW,KAAK;GACZ,IAAI,QAAQ,iBAAiB;GAC7B,MAAM,QAAQ,gBAAgB;GAC9B,IAAI,MAAM,SAAS,MAAM;IACrB,OAAO,MAAM,SAAS,IAAI,CAAC;IAC3B,OAAO,MAAM,SAAS,IAAI,CAAC;GAC/B;GACA,iBAAiB,KAAK;EAC1B;CACJ;AACJ;;AAGA,SAAgB,kBAAkB,KAAmB;CACjD,MAAM,QAAQ,gBAAgB;CAC9B,MAAM,UAAU;CAChB,IAAI,CAAC,MAAM,SAAS,MAAM,MAAM,SAAS,OAAO,CAAC;CACjD,iBAAiB,KAAK;AAC1B;AAkBA,SAAgB,gBAAgB,SAA2B;CACvD,OAAO,mBAAmB,OAAO,CAAC,CAAC;AACvC;;AAGA,SAAgB,mBAAmB,SAA4D;CAC3F,MAAM,SAAS,IAAI,EAAE,SAAS,OAAO,GAAG;EAAE,MAAM,QAAQ,MAAM,CAAC;EACnE,YAAY;CAAK,CAAC;CACd,IAAI,OAAO,UAAU,OAAO;EAAE,KAAK,aAAa,OAAO,QAAQ;EACnE,QAAQ;CAAO;CACX,IAAI,QAAQ,IAAI,kBAAkB,OAAO;EAAE,KAAK,aAAa,QAAQ,IAAI,gBAAgB;EAC7F,QAAQ;CAAM;CAEV,MAAM,OAAO,SAAS;CAetB,IAAI,MAAM,OAAO,KAAK,SAAS,UAAU,OAAO;EAAE,KAAK,aAAa,KAAK,GAAG;EAChF,QAAQ;CAAO;CAEX,MAAM,UAAU,kBAAkB;CAClC,IAAI,SAAS,OAAO;EAAE,KAAK,aAAa,OAAO;EACnD,QAAQ;CAAU;CAEd,OAAO;EAAE,KAAK;EAClB,QAAQ;CAAU;AAClB;;;;;;;;;AAUA,SAAgB,oBAAoB,KAAsB;CACtD,OAAO,QAAQ,qBAAqB,OAAO,OAAO,gBAAgB,CAAC,CAAC,UAAU,GAAG;AACrF;;;;;;;;;;;;;AAcA,SAAgB,iBAAiB,SAAyB;CACtD,MAAM,OAAO,SAAS;CACtB,IAAI,MAAM,SAAS,UAAU;CAE7B,MAAM,SAAS,IACX;EAAE,aAAa;EACvB,MAAM;EACN,SAAS;CAAO,GACR;EAAE,MAAM,QAAQ,MAAM,CAAC;EAC/B,YAAY;CAAK,CACb;CACA,IAAI,OAAO,gBAAgB,OAAO,UAAU;CAE5C,KACI,wCAAwC,MAAM,KAAK,KAAK,GAAG,EAAE,KACxD,MAAM,KAAK,qBAAqB,EAAE,kBAAkB,MAAM,KAAK,WAAW,EAAE,IACjF,2GACA,aACJ;AACJ;AAEA,SAAS,aAAa,KAAqB;CACvC,IAAI,IAAI,IAAI,KAAK,CAAC,CAAC,QAAQ,QAAQ,EAAE;CACrC,IAAI,CAAC,eAAe,KAAK,CAAC,GAAG,IAAI,WAAW;CAC5C,OAAO;AACX;;;;;;;AAcA,SAAgB,kBAAkB,KAA0B;CACxD,OAAO,mBAAmB;EACtB,SAAS;EAeT,UAAU;EAMV,SAAS,EAAE,cAAc,aAAa,EAAE;EACxC,MAAM;GACF,SAAS,sBAAsB,GAAG;GAClC,gBAAgB;GAChB,aAAa;EACjB;CACJ,CAAC;AACL;;;;;;AAOA,IAAa,YAAY;;AAGzB,SAAgB,WAA+B;CAC3C,MAAM,QAAQ,QAAQ,IAAI,UAAU,EAAE,KAAK;CAC3C,OAAO,QAAQ,QAAQ,KAAA;AAC3B;;AAGA,IAAM,gCAAgB,IAAI,QAAwB;;;;;;;;;;AAWlD,SAAgB,kBAAkB,KAAa,OAA4B;CACvE,MAAM,SAAS,mBAAmB;EAC9B,SAAS;EACT,UAAU;EACV,SAAS,EAAE,cAAc,aAAa,EAAE;EACxC;EACA,MAAM;GACF,SAAS,oBAAoB;GAC7B,gBAAgB;GAChB,aAAa;EACjB;CACJ,CAAC;CACD,OAAO,wBAAwB,oBAAoB,KAAK,KAAK,CAAC;CAC9D,cAAc,IAAI,QAAQ,KAAK;CAC/B,OAAO;AACX;;;;;;;;;;;;AAaA,eAAe,oBAAoB,KAAa,OAA+B;CAC3E,IAAI,gBAAgB;CACpB,IAAI;EAIA,iBAAgB,MAHI,MAAM,GAAG,IAAI,mBAAmB,EAChD,SAAS;GAAE,eAAe,UAAU;GAAS,cAAc,aAAa;EAAE,EAC9E,CAAC,EAAA,CACqB;CAC1B,QAAQ,CAER;CACA,IAAI,eACA,KACI,+CAA+C,UAAU,oBACzD,SAAS,UAAU,WAAW,MAAM,KAAK,oBAAoB,EAAE,cAC/D,kBACJ;CAEJ,KACI,GAAG,UAAU,mBAAmB,IAAI,2EACpC,yBAAyB,MAAM,KAAK,4BAA4B,EAAE,iBAAiB,UAAU,IAC7F,gBACJ;AACJ;;AAGA,IAAM,mBAAmB;;;;;;;;;;;;;;;AAwBzB,eAAsB,iBAAiB,QAAwC;CAC3E,MAAM,QAAQ,cAAc,IAAI,MAAM;CACtC,IAAI,OAAO,OAAO;CAClB,MAAM,UAAU,OAAO,KAAK,WAAW;CACvC,IAAI,SAAS,eAAe,QAAQ,YAAY,KAAK,IAAI,IAAI,kBAAkB,OAAO,QAAQ;CAC9F,QAAQ,MAAM,OAAO,KAAK,eAAe,EAAA,CAAG;AAChD;;;;;;;;AASA,eAAsB,cAAc,SAAkE;CAClG,MAAM,QAAQ,SAAS;CACvB,IAAI,CAAC,OAAO,OAAO,qBAAqB,OAAO;CAI/C,iBAAiB,OAAO;CACxB,MAAM,MAAM,gBAAgB,OAAO;CACnC,OAAO;EAAE,QAAQ,kBAAkB,KAAK,KAAK;EAAG;CAAI;AACxD;;;;;;;;;;;AAYA,eAAsB,qBAAqB,SAAkE;CAIzG,iBAAiB,OAAO;CACxB,MAAM,MAAM,gBAAgB,OAAO;CACnC,MAAM,SAAS,kBAAkB,GAAG;CACpC,MAAM,UAAU,OAAO,KAAK,WAAW;CAEvC,IAAI,CAAC,WAAW,CAAC,QAAQ,aAAa;EAClC,IAAI,SAAS,GACT,KACI,8CAA8C,MAAM,KAAK,GAAG,EAAE,QAAQ,UAAU,oBAChF,qCAAqC,MAAM,KAAK,oBAAoB,EAAE,UACtE,kBACJ;EAEJ,KACI,oBAAoB,MAAM,KAAK,GAAG,EAAE,IACpC,OAAO,MAAM,KAAK,oBAAoB,EAAE,UACxC,eACJ;CACJ;CAEA,IAAI,QAAQ,aAAa,KAAK,IAAI,IAAI,kBAClC,IAAI;EACA,MAAM,OAAO,KAAK,eAAe;CACrC,QAAQ;EACJ,KACI,oBAAoB,MAAM,KAAK,GAAG,EAAE,gBACpC,OAAO,MAAM,KAAK,oBAAoB,EAAE,qBAIxC,iBACJ;CACJ;CAGJ,OAAO;EAAE;EACb;CAAI;AACJ;;;;;;;;;;;;;;;;;;;;AAuCA,IAAM,sCAAsB,IAAI,IAAiD;AAEjF,SAAgB,oBAAoB,QAAqB,KAAkD;CACvG,IAAI,UAAU,oBAAoB,IAAI,GAAG;CACzC,IAAI,CAAC,SAAS;EACV,UAAU,OAAO,UACZ,OAAuB,mBAAmB,KAAA,GAAW,EAAE,QAAQ,MAAM,CAAC,CAAC,CACvE,MAAM,QAAQ,OAAO,KAAA,CAAS,CAAC,CAC/B,YAAY,KAAA,CAAS;EAC1B,oBAAoB,IAAI,KAAK,OAAO;CACxC;CACA,OAAO;AACX;;;;;;AAOA,SAAgB,sBAAsB,QAAqB,KAA0C;CACjG,OAAO,oBAAoB,QAAQ,GAAG,CAAC,CAAC,MAAM,QAAQ,KAAK,kBAAkB,KAAK,KAAK,KAAA,CAAS;AACpG;;;;;;;AAQA,SAAgB,mBAAmB,QAAqB,KAAkD;CACtG,OAAO,oBAAoB,QAAQ,GAAG,CAAC,CAAC,MAAM,QAC1C,MAAM,QAAQ,KAAK,aAAa,IAAI,IAAI,gBAAgB,KAAA,CAC5D;AACJ;;;;;;;;;;AAWA,SAAgB,iBACZ,WACA,YACkB;CAClB,IAAI,CAAC,WAAW,OAAO,KAAA;CACvB,OAAO,aAAa,GAAG,UAAU,GAAG,eAAe;AACvD;;;;;;;;;;;;;;AAsBA,SAAgB,YACZ,SACA,YACkB;CAClB,OAAO,QAAQ,QAAQ,iBAAiB,QAAQ,WAAW,UAAU;AACzE;AAiCA,SAAgB,SAAS,MAAc,QAAQ,IAAI,GAAuB;CACtE,IAAI;EACA,OAAO,KAAK,MAAM,GAAG,aAAa,gBAAgB,GAAG,GAAG,OAAO,CAAC;CACpE,QAAQ;EACJ,OAAO;CACX;AACJ;AAEA,SAAgB,UAAU,MAAmB,MAAc,QAAQ,IAAI,GAAS;CAC5E,MAAM,OAAO,gBAAgB,GAAG;CAChC,GAAG,UAAU,KAAK,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;CACpD,GAAG,cAAc,MAAM,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AACxD;AAEA,SAAgB,WAAW,MAAc,QAAQ,IAAI,GAAY;CAC7D,MAAM,OAAO,gBAAgB,GAAG;CAChC,IAAI,GAAG,WAAW,IAAI,GAAG;EACrB,GAAG,OAAO,IAAI;EACd,OAAO;CACX;CACA,OAAO;AACX;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,IAAa,qBAAqB;CAC9B,UAAU;CACV,SAAS;CACT,UAAU;CACV,aAAa;CAKb,SAAS;CACT,MAAM;CACN,MAAM;CACN,MAAM;AACV;AAEA,IAAM,UAAU;;;;;;;AAQhB,SAAgB,kBAAkB,SAA2B;CACzD,MAAM,SAAS,IAAI;EAAE,aAAa;EACtC,MAAM;CAAY,GAAG;EAAE,MAAM,QAAQ,MAAM,CAAC;EAC5C,YAAY;CAAK,CAAC;CACd,IAAI,OAAO,cAAc,OAAO,OAAO;CACvC,MAAM,OAAO,SAAS;CACtB,IAAI,MAAM,WAAW,OAAO,KAAK;CACjC,KACI,0DACA,QAAQ,MAAM,KAAK,kBAAkB,EAAE,UAAU,MAAM,KAAK,mBAAmB,EAAE,IACjF,YACJ;AACJ;;;;;;;AAQA,eAAsB,gBAAgB,KAAa,QAAkD;CACjG,IAAI,QAAQ,KAAK,GAAG,GAAG,OAAO;CAK9B,MAAM,OAAM,MAJM,OAAO,KAAK,WAAW,UAAU,CAAC,CAAC,KAAK;EACtD,OAAO,EAAE,WAAW,CAAC,MAAM,GAAG,EAAE;EAChC,OAAO;CACX,CAAC,EAAA,CACe,KAAK;CACrB,OAAO,KAAK,OAAO,KAAA,IAAY,KAAA,IAAY,OAAO,IAAI,EAAE;AAC5D;;AAGA,eAAsB,kBAAkB,KAAa,QAAsC;CACvF,MAAM,KAAK,MAAM,gBAAgB,KAAK,MAAM;CAC5C,IAAI,OAAO,KAAA,GACP,KACI,wBAAwB,MAAM,KAAK,GAAG,EAAE,IACxC,mBAAmB,MAAM,KAAK,uBAAuB,EAAE,IACvD,mBACJ;CAEJ,OAAO;AACX;;AAGA,eAAsB,eAAe,SAAmB,QAAsC;CAC1F,OAAO,kBAAkB,kBAAkB,OAAO,GAAG,MAAM;AAC/D;;;;;;AAOA,SAAgB,kBAAkB,SAA2B;CACzD,MAAM,SAAS,IAAI;EAAE,aAAa;EACtC,MAAM;CAAY,GAAG;EAAE,MAAM,QAAQ,MAAM,CAAC;EAC5C,YAAY;CAAK,CAAC;CACd,IAAI,OAAO,cAAc,OAAO,OAAO;CACvC,MAAM,OAAO,SAAS;CACtB,OAAO,MAAM,QAAQ,MAAM,aAAa;AAC5C;AA2CA,IAAI,YAAY;;;;;;AAOhB,SAAgB,eAAe,SAA4B;CAUvD,IATe,IAAI,EAAE,UAAU,QAAQ,GAAG;EAAE,MAAM,QAAQ,MAAM,CAAC;EACrE,YAAY;CAAK,CAQT,CAAA,CAAO,WAAW,YAAY;MAC7B,YAAY,gBAAgB,QAAQ,IAAI,WAAW,KAAK,QAAQ,OAAO,UAAU;CACtF,OAAO;AACX;;AAGA,SAAgB,aAAsB;CAClC,OAAO;AACX;;AASA,IAAM,UAAU;AAChB,SAAS,UAAU,GAAmB;CAClC,OAAO,EAAE,QAAQ,SAAS,EAAE;AAChC;;;;;;;;;;AAWA,SAAgB,UAAU,OAAsB;CAC5C,QAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,MAAM,CAAC,IAAI,IAAI;AAC9D;;;;;;AAOA,SAAgB,KAAQ,OAAmB,MAAwB;CAC/D,IAAI,WAAW,UAAU,IAAI;MACxB,MAAM;AACf;;;;;;;;;;;;;;;;AAiCA,SAAgB,SACZ,SACA,SACA,OACA,QAAiC,CAAC,GAC9B;CACJ,KAAK,OAAO;EAAE;EAClB,SAAS,QAAQ,KAAI,UAAS,eAAe,OAAO,OAAO,CAAC;EAC5D,GAAG;CAAM,CAAC;AACV;;;;;;;;;AAqDA,SAAS,eAAe,OAA4B,SAA0C;CAC1F,IAAI,OAAO,UAAU,UAAU,OAAO;EAAE,QAAQ;EACpD,aAAa;EACb,OAAO,CAAC;CAAE;CACN,OAAO;EACH,QAAQ,MAAM;EACd,OAAO,UAAU,QAAQ,GAAG,MAAM,SAAS,MAAM,OAAO,IAAI,MAAM,SAAS;EAC3E,aAAa,MAAM;EACnB,QAAQ,MAAM,SAAS,CAAC,EAAA,CAAG,KAAK,CAAC,MAAM,kBAAkB;GAAE;GACnE;EAAY,EAAE;CACV;AACJ;;;;;;;AAQA,IAAa,oBAA6C;CACtD,CAAC,wBAAwB,qDAAqD;CAC9E,CAAC,UAAU,6DAA6D;CACxE,CAAC,kBAAkB,uDAAuD;CAC1E,CAAC,aAAa,2BAA2B;CACzC,CAAC,WAAW,gDAAgD;AAChE;AAUwC,CAAC,GAAG,OAAO,KAAK,kBAAkB,CAAY;;AAGtF,IAAM,cAAc;;;;;;;AAQpB,SAAS,IAAI,MAAc,OAAuB;CAC9C,OAAO,IAAI,OAAO,KAAK,IAAI,GAAG,QAAQ,KAAK,MAAM,CAAC;AACtD;;;;AAKA,SAAgB,eAAe,MAAuB;CAClD,SACI,KAAK,SACL,KAAK,eACC;EACF,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,GAAG,MAAM,KAAK,UAAU,KAAK,SAAS,EAAE,KAAK,KAAK,OAAO;EACrE,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,MAAM,MAAM,KAAK,OAAO,CAAC;EACrC,QAAQ,IAAI,YAAY,KAAK,QAAQ,GAAG,MAAM,KAAK,UAAU,EAAE,WAAW;EAE1E,IAAI;EACJ,KAAK,MAAM,SAAS,KAAK,SAAS;GAC9B,MAAM,UAAU,MAAM,WAAW;GACjC,IAAI,YAAY,SAAS;IACrB,UAAU;IACV,QAAQ,IAAI,EAAE;IACd,QAAQ,IAAI,MAAM,MAAM,KAAK,OAAO,CAAC;GACzC;GACA,MAAM,OAAO,GAAG,MAAM,SAAS,MAAM,OAAO,IAAI,MAAM,SAAS;GAC/D,QAAQ,IACJ,KAAK,MAAM,KAAK,KAAK,MAAM,MAAM,IAAI,MAAM,OAAO,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAC5E,IAAI,MAAM,WAAW,IAAI,MAAM,aACxC;GACA,KAAK,MAAM,CAAC,MAAM,gBAAgB,MAAM,SAAS,CAAC,GAC9C,QAAQ,IAAI,SAAS,MAAM,KAAK,IAAI,IAAI,IAAI,MAAM,cAAc,CAAC,IAAI,MAAM,KAAK,WAAW,GAAG;EAEtG;EAEA,IAAI,KAAK,SAAS,QAAQ;GACtB,QAAQ,IAAI,EAAE;GACd,QAAQ,IAAI,MAAM,MAAM,KAAK,SAAS,CAAC;GACvC,KAAK,MAAM,CAAC,MAAM,gBAAgB,KAAK,SACnC,QAAQ,IAAI,KAAK,MAAM,KAAK,IAAI,IAAI,IAAI,MAAM,WAAW,IAAI,aAAa;EAElF;EAEA,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,MAAM,MAAM,KAAK,gBAAgB,CAAC;EAC9C,KAAK,MAAM,CAAC,MAAM,gBAAgB,mBAC9B,QAAQ,IAAI,KAAK,MAAM,KAAK,IAAI,IAAI,IAAI,MAAM,WAAW,IAAI,MAAM,KAAK,WAAW,GAAG;EAG1F,IAAI,KAAK,OAAO,QAAQ;GACpB,QAAQ,IAAI,EAAE;GACd,KAAK,MAAM,QAAQ,KAAK,OAAO,QAAQ,IAAI,MAAM,KAAK,KAAK,MAAM,CAAC;EACtE;EACA,QAAQ,IAAI,EAAE;CAClB,GACA;EACI,OAAO,UAAU,KAAK,QAAQ;EAC9B,SAAS,KAAK;EACd,UAAU,KAAK,WAAW,CAAC,EAAA,CAAG,KAAK,CAAC,MAAM,kBAAkB;GAAE;GAC1E;EAAY,EAAE;EACF,aAAa,kBAAkB,KAAK,CAAC,MAAM,kBAAkB;GAAE;GAC3E;EAAY,EAAE;EACF,OAAO,KAAK,SAAS,CAAC;CAC1B,CACJ;AACJ;;;;;;;;;;;;;;;;;;;;AAyBA,SAAgB,KAAK,SAAiB,MAAqB;CACvD,IAAI,WAAW;EACX,QAAQ,OAAO,MAAM,YAAY,UAAU,OAAO,EAAE,GAAG;EACvD,IAAI,MAAM,QAAQ,OAAO,MAAM,KAAK,UAAU,IAAI,EAAE,GAAG;EACvD;CACJ;CACA,QAAQ,MAAM,EAAE;CAChB,QAAQ,MAAM,MAAM,OAAO,OAAO,SAAS,CAAC;CAC5C,IAAI,MAAM,QAAQ,MAAM,MAAM,KAAK,OAAO,MAAM,CAAC;AACrD;;;;;;;;;;;;;;;;;AAkBA,SAAgB,KAAK,SAAiB,MAAe,MAAsB;CACvE,IAAI,WAAW;EACX,UAAU,EAAE,OAAO;GAAE,SAAS,UAAU,OAAO;GACvD,MAAM,QAAQ;GACd,MAAM,OAAO,UAAU,IAAI,IAAI,KAAA;EAAU,EAAE,CAAC;EACpC,QAAQ,KAAK,CAAC;CAClB;CACA,QAAQ,MAAM,EAAE;CAChB,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,CAAC;CACzC,IAAI,MAAM,QAAQ,MAAM,MAAM,KAAK,KAAK,MAAM,CAAC;CAC/C,QAAQ,MAAM,EAAE;CAChB,QAAQ,KAAK,CAAC;AAClB;;;;;;;;;AAUA,eAAsB,mBAAmB,MAAuD;CAC5F,IAAI,KAAK,KAAK;CACd,IAAI,aAAa,QAAQ,MAAM,UAAU,MACrC,KACI,sDACA,eAAe,MAAM,KAAK,OAAO,EAAE,eACnC,uBACJ;CAEJ,MAAM,EAAE,cAAe,MAAM,SAAS,OAAO,CACzC;EAAE,MAAM;EAChB,MAAM;EACN,SAAS;EACT,SAAS,KAAK;CAAO,CACjB,CAA0C;CAC1C,IAAI,CAAC,WAAW;EAIZ,QAAQ,MAAM,MAAM,KAAK,YAAY,CAAC;EACtC,QAAQ,KAAK,CAAC;CAClB;AACJ;;;;;;;;;;;;;;;AAgBA,SAAgB,mBAAmB,MAAc,OAAqB;CAClE,IAAI,aAAa,QAAQ,MAAM,UAAU,MACrC,KACI,sBAAsB,KAAK,wCAC3B,QAAQ,MAAM,KAAK,KAAK,EAAE,IAC1B,gBACJ;AAER;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,SAAgB,eAAmC,MAO6B;CAC5E,MAAM,OAAO;EAAE,GAAG;EACtB,GAAG,KAAK;CAAK;CACT,IAAI;EACA,MAAM,SAAS,iBAAiB;GAAE,GAAG;GAC7C;EAAK,CAAC;EACE,OAAO;GAAE,OAAO,OAAO;GAC/B,aAAa,OAAO;EAAY;CAC5B,SAAS,KAAK;EACV,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAAG,KAAA,GAAW,OAAO;CAC7E;AACJ;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,mBACZ,OACA,QACA,OACI;CACJ,IAAI,WAAW,KAAA,KAAa,MAAM,SAAS,MAAM,GAAG;CACpD,KACI,WAAW,MAAM,YAAY,UAC7B,sBAAsB,MAAM,sBAAsB,MAAM,KAAK,IAAI,EAAE,IACnE,iBACJ;AACJ;;;;;;;;;;;;;AAcA,SAAgB,iBACZ,OACA,MACM;CACN,IAAI,UAAU,KAAA,GAAW,OAAO,KAAK;CACrC,MAAM,UAAU,OAAO,KAAK;CAC5B,IAAI,CAAC,OAAO,SAAS,OAAO,KAAK,WAAW,GACxC,KACI,6CAA6C,MAAM,MACnD,gBAAgB,KAAK,QAAQ,aAC7B,OACJ;CAEJ,OAAO,UAAU;AACrB;;;;;;;;;;;;;AAcA,SAAgB,QAAQ,SAAuB;CAC3C,IAAI,WAAW;EACX,QAAQ,OAAO,MAAM,GAAG,UAAU,OAAO,EAAE,GAAG;EAC9C;CACJ;CACA,QAAQ,MAAM,EAAE;CAChB,QAAQ,MAAM,MAAM,KAAK,MAAM,OAAO,SAAS,CAAC;CAChD,QAAQ,MAAM,EAAE;AACpB;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,KAAK,SAAiB,SAAS,MAAY;CACvD,IAAI,WAAW;CACf,QAAQ,MAAM,GAAG,SAAS,SAAS;AACvC;;AAGA,SAAgB,YAAkB;CAC9B,IAAI,WAAW;CACf,QAAQ,MAAM,EAAE;AACpB;;AAGA,SAAgB,YAAY,QAAoC;CAC5D,QAAQ,QAAR;EACI,KAAK;EACL,KAAK;EACL,KAAK,aACD,OAAO,MAAM,MAAM,MAAM;EAC7B,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,YACD,OAAO,MAAM,OAAO,UAAU,EAAE;EACpC,KAAK,UACD,OAAO,MAAM,IAAI,MAAM;EAC3B,KAAK,WACD,OAAO,MAAM,KAAK,MAAM;EAC5B,SACI,OAAO,MAAM,KAAK,UAAU,SAAS;CAC7C;AACJ;;;;;;AAOA,SAAgB,UAAU,MAAwD;CAC9E,MAAM,QAAQ,KAAK,IAAI,GAAG,KAAK,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;CACrD,KAAK,MAAM,CAAC,GAAG,MAAM,MAAM;EACvB,IAAI,MAAM,KAAA,KAAa,MAAM,QAAQ,MAAM,IAAI;EAC/C,QAAQ,IAAI,KAAK,MAAM,KAAK,GAAG,EAAE,GAAG,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,GAAG;CACjE;AACJ;;;;;;;;;;;AAYA,SAAgB,YAAY,GAAY,SAAwB;CAC5D,MAAM,MAAM;CACZ,MAAM,UAAU,eAAe,GAAG,OAAO;CAEzC,IAAI,cAAc,GACd,QAAQ,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK;CAG/C,IAAI,WAAW;EACX,UAAU,EACN,OAAO;GACH,SAAS,UAAU,QAAQ,OAAO;GAOlC,MAAM,QAAQ;GACd,QAAQ,KAAK,UAAU;GACvB,MAAM,QAAQ,OAAO,UAAU,QAAQ,IAAI,IAAI,KAAA;GAC/C,UAAU,QAAQ;GAClB;EACJ,EACJ,CAAC;EACD,QAAQ,KAAK,CAAC;CAClB;CACA,KAAK,QAAQ,SAAS,QAAQ,MAAM,QAAQ,IAAI;AACpD;;;;;;;;;;AAWA,SAAgB,QAAQ,QAAgB,QAAQ,WAAiB;CAC7D,UAAU;CACV,KAAK,GAAG,MAAM,GAAG,MAAM,KAAK,MAAM,GAAG;CACrC,UAAU;CACV,MAAM,SACF,QAAQ,aAAa,WAAW,SAAS,QAAQ,aAAa,UAAU,UAAU;CACtF,IAAI;EACA,MAAM,QAAQ,MAAM,QAAQ,CAAC,MAAM,GAAG;GAClC,OAAO;GACP,UAAU;GACV,OAAO,QAAQ,aAAa;EAChC,CAAC;EACD,MAAM,GAAG,eAAe,CAExB,CAAC;EACD,MAAM,MAAM;CAChB,QAAQ,CAER;AACJ;;;;;;;;;;;;;;;;;;AAgCA,SAAgB,UAA8B,MAA2D;CACrG,QAAQ,QAAQ,CAAC,EAAA,CAAG,QAAQ,QACxB,OAAO,KAAK,OAAO,YAAY,OAAO,KAAK,OAAO,QAAQ;AAClE;;AAGA,SAAgB,SAA6B,KAAyD;CAClG,OAAO,UAAa,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;AAC1C;;;;;;;;;;;AAYA,SAAgB,gBACZ,KACA,MACC;CACD,MAAM,SAAS,SAAY,GAAG;CAC9B,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,kCAAkC,KAAK,4BAA4B;CAChG,OAAO;AACX"}
+{"version":3,"file":"context-CyflUrKg.js","names":[],"sources":["../src/commands/cloud/errors.ts","../src/commands/cloud/context.ts"],"sourcesContent":["/**\n * Turning a control-plane failure into something the caller can act on.\n *\n * The control plane talks to Kubernetes, and when Kubernetes refuses it, the\n * refusal travels back verbatim: a whole `Status` object, the request headers,\n * an `audit-id`, an `x-kubernetes-pf-flowschema-uid`. That reached the user's\n * terminal unedited. Two things are wrong with it beyond the noise.\n *\n * The first is that the one sentence that matters is buried in the middle of a\n * JSON blob, so the remedy — if there is one — is the hardest part to find.\n *\n * The second is worse, and is the reason this file exists rather than a\n * `slice(0, 200)`. A `403` naming a `system:serviceaccount:` is a statement\n * about the PLATFORM's own credentials: some role the control plane runs as is\n * missing a grant. Nothing in the user's project can change that — not the\n * collections, not `rebase.json`, not the deploy flags — and the error, printed\n * raw in the middle of `rebase cloud deploy`, reads exactly like a project\n * fault. Someone acting on that reading deletes working code looking for the\n * cause. (That is not hypothetical: three cron jobs were removed from a project\n * to test whether they caused a `cronjobs.batch` 403. They did not.)\n *\n * So this classifies before it summarises, and says whose problem it is.\n */\n\nimport { parseEnvBoolean } from \"@rebasepro/types\";\n\n/** What a Kubernetes API refusal carries, once it is found. */\nexport interface KubernetesStatus {\n    message?: string;\n    reason?: string;\n    code?: number;\n    details?: { group?: string; kind?: string; name?: string };\n}\n\nexport interface ErrorSummary {\n    /** One line, safe to print. Never the raw body. */\n    message: string;\n    /** A remedy, when one exists — or the reason there is none. */\n    hint?: string;\n    /** A stable code for `--json` callers to branch on. */\n    code: string;\n    /**\n     * Whether the failure is the platform's rather than the project's.\n     *\n     * The whole point of the summary: a caller that retries or mutates the\n     * project on a platform-side refusal makes things worse, and an agent\n     * cannot tell from the prose.\n     */\n    platform: boolean;\n    /** The untouched original, printed only under `--debug`. */\n    raw: string;\n}\n\n/**\n * The service accounts a Kubernetes 403 can name, and what each means.\n *\n * `system:serviceaccount:` is the platform's own identity — the control plane's\n * pod, or a tenant's operator. A project cannot grant it anything, because the\n * grant lives in a cluster the project does not own. `system:anonymous` is the\n * same fact with the credential missing entirely.\n */\nconst PLATFORM_PRINCIPAL_RE = /system:(?:serviceaccount:|anonymous|node:)/;\n\n/**\n * A Kubernetes `Status` object embedded anywhere in a message.\n *\n * Scanned for rather than parsed off the front: the control plane wraps it\n * (\"Failed to create the tenant namespace: …\"), the client library appends\n * headers after it, and both halves are worth keeping out of the summary.\n * Balanced-brace scanning rather than a regex, because `details.causes` nests\n * and a lazy `\\{.*?\\}` truncates the object at the first inner brace — which\n * parses to nothing and silently falls through to the raw message.\n */\nexport function extractKubernetesStatus(text: string): KubernetesStatus | undefined {\n    for (let start = text.indexOf(\"{\"); start !== -1; start = text.indexOf(\"{\", start + 1)) {\n        let depth = 0;\n        let inString = false;\n        let escaped = false;\n        for (let i = start; i < text.length; i++) {\n            const ch = text[i];\n            if (escaped) {\n                escaped = false;\n                continue;\n            }\n            if (ch === \"\\\\\") {\n                escaped = true;\n                continue;\n            }\n            if (ch === '\"') {\n                inString = !inString;\n                continue;\n            }\n            if (inString) continue;\n            if (ch === \"{\") depth++;\n            else if (ch === \"}\") {\n                depth--;\n                if (depth !== 0) continue;\n                const candidate = text.slice(start, i + 1);\n                let parsed: unknown;\n                try {\n                    parsed = JSON.parse(candidate);\n                } catch {\n                    break; // Not JSON; try the next opening brace.\n                }\n                const obj = parsed as Record<string, unknown> & KubernetesStatus;\n                // `kind: \"Status\"` is the marker the API server always sets on a\n                // refusal. Requiring it means an ordinary JSON body in an error\n                // message — a validation report, say — is left alone.\n                if (obj?.kind === \"Status\" || (obj?.status === \"Failure\" && typeof obj.code === \"number\")) {\n                    return {\n                        message: typeof obj.message === \"string\" ? obj.message : undefined,\n                        reason: typeof obj.reason === \"string\" ? obj.reason : undefined,\n                        code: typeof obj.code === \"number\" ? obj.code : undefined,\n                        details: (obj.details as KubernetesStatus[\"details\"]) ?? undefined\n                    };\n                }\n                break;\n            }\n        }\n    }\n    return undefined;\n}\n\n/**\n * Strip the transport noise a Kubernetes client appends to its own message.\n *\n * Only ever applied to the fallback path — when no `Status` was found, the\n * message is all there is, and cutting it at the first header keeps the\n * sentence while dropping the `audit-id` and the flowschema uid nobody outside\n * the cluster can use.\n */\nfunction trimTransportNoise(message: string): string {\n    const cut = message.search(\n        /\\s*(?:headers:|HTTP request failed|audit-id|x-kubernetes-pf-|\\{\"kind\":\"Status\")/i\n    );\n    const trimmed = (cut > 0 ? message.slice(0, cut) : message).trim();\n    return trimmed.replace(/[\\s:,-]+$/, \"\");\n}\n\n/** The longest a summary may be before it stops being one. */\nconst MAX_SUMMARY = 300;\n\n/**\n * One actionable line (plus a hint) from whatever the control plane returned.\n *\n * `status` is the HTTP status of the control-plane call itself, which is a\n * different number from the `code` inside an embedded Kubernetes `Status` — the\n * control plane routinely answers 500 while the cluster answered 403, and it is\n * the inner one that says what happened.\n */\nexport function summarizeError(error: unknown, context: string): ErrorSummary {\n    const err = error as { status?: number; message?: string; code?: string };\n    const raw = err?.message ?? String(error);\n    const k8s = extractKubernetesStatus(raw);\n\n    if (k8s) {\n        const inner = k8s.message?.trim() ?? \"\";\n        const forbidden = k8s.code === 403 || k8s.reason === \"Forbidden\";\n        const platform = forbidden && PLATFORM_PRINCIPAL_RE.test(inner);\n\n        if (platform) {\n            return {\n                // Named as the platform's before the sentence that follows, so\n                // the first thing read is whose problem it is.\n                message: `${context}: the platform's own cluster credentials were refused by Kubernetes.`,\n                hint:\n                    `${truncate(inner)}\\n`\n                    + \"  This is a platform-side permission, not something your project can grant. \"\n                    + \"Nothing in your code, collections or deploy flags will change it — \"\n                    + \"report it with the message above rather than retrying or changing the project.\",\n                code: \"platform_permission_denied\",\n                platform: true,\n                raw\n            };\n        }\n\n        return {\n            message: `${context}: ${truncate(inner || k8s.reason || \"the cluster refused the request\")}`,\n            hint: k8s.code ? `Kubernetes answered ${k8s.code}${k8s.reason ? ` (${k8s.reason})` : \"\"}.` : undefined,\n            code: k8s.reason ? `k8s_${k8s.reason.toLowerCase()}` : \"k8s_error\",\n            platform: false,\n            raw\n        };\n    }\n\n    // Not a Kubernetes refusal. Still worth trimming: the same transport dumps\n    // its headers onto plenty of errors that carry no `Status` at all.\n    const trimmed = trimTransportNoise(raw);\n    return {\n        message: `${context}${err?.status ? ` (${err.status})` : \"\"}: ${truncate(trimmed || raw)}`,\n        code: err?.code ?? (err?.status ? `http_${err.status}` : \"request_failed\"),\n        platform: false,\n        raw\n    };\n}\n\nfunction truncate(text: string): string {\n    const flat = text.replace(/\\s+/g, \" \").trim();\n    return flat.length > MAX_SUMMARY ? `${flat.slice(0, MAX_SUMMARY - 1)}…` : flat;\n}\n\n/**\n * Whether the caller asked for the untouched body.\n *\n * `--debug` is already what `bin/rebase.js` prints after every failure as the\n * thing to add, so the raw payload hangs off the flag people are told to reach\n * for rather than off one invented here.\n *\n * The one reader of `REBASE_DEBUG` in the commands, spelled as the bin spells\n * it. It used to be `=== \"1\"` here while the quote fallbacks in `resources.ts`\n * tested the raw string for truthiness, so `=true` hid the body and `=0`\n * printed the fallback.\n */\nexport function wantsRawError(argv: readonly string[] = process.argv): boolean {\n    return argv.includes(\"--debug\") || parseEnvBoolean(process.env.REBASE_DEBUG) === true;\n}\n","/**\n * Shared foundation for the `rebase cloud` command family.\n *\n * Everything cloud subcommands need in common lives here:\n *   - credential storage  (~/.rebase/credentials.json, keyed per control-plane host)\n *   - project link file    (.rebase/cloud.json in the project dir)\n *   - control-plane URL resolution\n *   - an authenticated `@rebasepro/client` instance (createCloudClient / requireClient)\n *   - small output helpers shared across subcommands\n *\n * The control plane is itself a Rebase app, so we reuse the same SDK the web\n * console uses (`@rebasepro/client`). Auth, token refresh, the data REST client\n * and function invocation all come from the SDK — the CLI only supplies a\n * file-backed AuthStorage so a login persists across invocations.\n */\nimport fs from \"fs\";\nimport os from \"os\";\nimport path from \"path\";\nimport { spawn } from \"child_process\";\nimport chalk from \"chalk\";\nimport arg from \"arg\";\nimport inquirer from \"inquirer\";\nimport { createMemoryStorage, createRebaseClient, type AuthStorage } from \"@rebasepro/client\";\nimport { findProjectRoot } from \"../../utils/project\";\nimport { parseCommandArgs } from \"../../utils/args\";\nimport { cliUserAgent } from \"../../utils/version\";\nimport { summarizeError, wantsRawError } from \"./errors\";\nimport { parseEnvBoolean } from \"@rebasepro/types\";\n\n/* ═══════════════════════════════════════════════════════════════\n   Constants & paths\n   ═══════════════════════════════════════════════════════════════ */\n\n/** Default hosted control plane (the Rebase Cloud console origin). */\nconst DEFAULT_CLOUD_URL = \"https://app.rebase.pro\";\n\n/** The storage key the SDK's auth module reads/writes the session under. */\nconst SDK_SESSION_KEY = \"rebase_auth\";\n\n/** ~/.rebase/credentials.json — one file, many hosts. */\nfunction credentialsPath(): string {\n    return path.join(os.homedir(), \".rebase\", \"credentials.json\");\n}\n\n/** Project-local link file: <project>/.rebase/cloud.json */\n/**\n * The billing account an organization row points at, whichever key it arrived under.\n *\n * REST serves every column under its own property name, so the relation comes\n * back as `billingAccountId`. Both readers in this CLI checked\n * `billing_account_id` and `billingAccount` — neither is what arrives — so\n * `rebase cloud billing` answered \"no billing account\" for every organization,\n * and the deploy pre-check never saw an internal plan. The other two spellings\n * are still accepted: older servers and fixtures send them.\n */\nexport function billingAccountIdOf(org: unknown): string | number | undefined {\n    if (typeof org !== \"object\" || org === null) return undefined;\n    for (const key of [\"billingAccountId\", \"billing_account_id\", \"billingAccount\"]) {\n        const value = (org as Record<string, unknown>)[key];\n        if (typeof value === \"string\" || typeof value === \"number\") return value;\n    }\n    return undefined;\n}\n\nexport function projectLinkPath(cwd: string = process.cwd()): string {\n    const root = findProjectRoot(cwd) || cwd;\n    return path.join(root, \".rebase\", \"cloud.json\");\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   Credentials file model\n   ═══════════════════════════════════════════════════════════════\n\n   {\n     \"current\": \"https://app.rebase.pro\",\n     \"contexts\": {\n       \"https://app.rebase.pro\": { \"auth\": \"<sdk session json>\", \"org\": \"42\" }\n     }\n   }\n*/\n\ninterface CloudContextEntry {\n    /** Raw JSON blob the SDK auth module persists (the RebaseSession). */\n    auth?: string;\n    /** Active organization id for this host, if the user selected one. */\n    org?: string;\n}\n\ninterface CredentialsFile {\n    current?: string;\n    contexts: Record<string, CloudContextEntry>;\n}\n\nfunction readCredentials(): CredentialsFile {\n    try {\n        const raw = fs.readFileSync(credentialsPath(), \"utf-8\");\n        const parsed = JSON.parse(raw) as CredentialsFile;\n        if (!parsed.contexts) parsed.contexts = {};\n        return parsed;\n    } catch {\n        return { contexts: {} };\n    }\n}\n\nfunction writeCredentials(data: CredentialsFile): void {\n    const file = credentialsPath();\n    fs.mkdirSync(path.dirname(file), { recursive: true });\n    // Written with private perms — this file holds refresh tokens.\n    fs.writeFileSync(file, JSON.stringify(data, null, 2), { mode: 0o600 });\n    try {\n        fs.chmodSync(file, 0o600);\n    } catch {\n        // best effort on platforms without chmod semantics\n    }\n}\n\n/** Host that a bare `rebase cloud` command should target, if any. */\nfunction currentContextUrl(): string | undefined {\n    return readCredentials().current;\n}\n\n/** Persist the active organization id for a host. */\nexport function setContextOrg(url: string, org: string | undefined): void {\n    const creds = readCredentials();\n    const entry = creds.contexts[url] || {};\n    if (org) entry.org = org;\n    else delete entry.org;\n    creds.contexts[url] = entry;\n    writeCredentials(creds);\n}\n\nexport function getContextOrg(url: string): string | undefined {\n    return readCredentials().contexts[url]?.org;\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   File-backed AuthStorage (per host)\n   ═══════════════════════════════════════════════════════════════ */\n\nfunction createFileAuthStorage(url: string): AuthStorage {\n    return {\n        getItem(key) {\n            if (key !== SDK_SESSION_KEY) return null;\n            return readCredentials().contexts[url]?.auth ?? null;\n        },\n        setItem(key, value) {\n            if (key !== SDK_SESSION_KEY) return;\n            const creds = readCredentials();\n            const entry = creds.contexts[url] || {};\n            entry.auth = value;\n            creds.contexts[url] = entry;\n            if (!creds.current) creds.current = url;\n            writeCredentials(creds);\n        },\n        removeItem(key) {\n            if (key !== SDK_SESSION_KEY) return;\n            const creds = readCredentials();\n            if (creds.contexts[url]) {\n                delete creds.contexts[url].auth;\n                delete creds.contexts[url].org;\n            }\n            writeCredentials(creds);\n        }\n    };\n}\n\n/** Mark a host as the active context (called on login). */\nexport function setCurrentContext(url: string): void {\n    const creds = readCredentials();\n    creds.current = url;\n    if (!creds.contexts[url]) creds.contexts[url] = {};\n    writeCredentials(creds);\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   URL resolution\n   ═══════════════════════════════════════════════════════════════\n\n   Priority: --url flag > REBASE_CLOUD_URL env > CLOUD link's url\n             > stored current context > default hosted URL.\n\n   A **direct** link is deliberately absent from that list; see below.\n*/\n\n/**\n * Where the control-plane URL came from. `link` is the one a repository chose\n * rather than the user — see {@link isKnownControlPlane}.\n */\nexport type CloudUrlSource = \"flag\" | \"env\" | \"link\" | \"context\" | \"default\";\n\nexport function resolveCloudUrl(rawArgs: string[]): string {\n    return resolveCloudTarget(rawArgs).url;\n}\n\n/** The control-plane URL, and which rung of the ladder above supplied it. */\nexport function resolveCloudTarget(rawArgs: string[]): { url: string; source: CloudUrlSource } {\n    const parsed = arg({ \"--url\": String }, { argv: rawArgs.slice(2),\npermissive: true });\n    if (parsed[\"--url\"]) return { url: normalizeUrl(parsed[\"--url\"]),\nsource: \"flag\" };\n    if (process.env.REBASE_CLOUD_URL) return { url: normalizeUrl(process.env.REBASE_CLOUD_URL),\nsource: \"env\" };\n\n    const link = readLink();\n    /*\n     * A direct link is a tenant, not a control plane.\n     *\n     * `rebase cloud link <url>` points this checkout at ONE running Rebase API\n     * — \"no control plane, no login\", as its own help page puts it — so its URL\n     * is the customer's own backend. Returning it here made it the control\n     * plane for the entire `cloud` family: `whoami` reported \"Not logged in to\n     * https://api.example.com\", and following that printed remedy POSTed the\n     * user's *control-plane* email and password to the tenant host.\n     *\n     * Commands that genuinely need a control plane refuse instead — see\n     * `refuseDirectLink`, which every one of them reaches through\n     * `requireClient` (and `login`, which builds its client directly).\n     */\n    if (link?.url && link.mode !== \"direct\") return { url: normalizeUrl(link.url),\nsource: \"link\" };\n\n    const current = currentContextUrl();\n    if (current) return { url: normalizeUrl(current),\nsource: \"context\" };\n\n    return { url: DEFAULT_CLOUD_URL,\nsource: \"default\" };\n}\n\n/**\n * Whether a control-plane host is one the user chose: the platform's own, or a\n * host already in their credentials file because they signed in to it.\n *\n * A link file is part of the repository, and a cloned repository is not the\n * user's to trust with their password. `login` asks before sending one to a\n * linked host that is neither.\n */\nexport function isKnownControlPlane(url: string): boolean {\n    return url === DEFAULT_CLOUD_URL || Object.hasOwn(readCredentials().contexts, url);\n}\n\n/**\n * Refuse to run a control-plane command in a directory linked straight at a\n * backend.\n *\n * The alternative — quietly using the default control plane — would be worse\n * than the bug it replaces: the user asked for `https://api.example.com` and\n * would get an answer about `app.rebase.pro` with nothing saying so. Naming the\n * link, and both ways out of it, is the whole message.\n *\n * `--project` and `--url` are the ways out, so a line carrying either passes\n * through: both say, explicitly, which control-plane subject the caller means.\n */\nexport function refuseDirectLink(rawArgs: string[]): void {\n    const link = readLink();\n    if (link?.mode !== \"direct\") return;\n\n    const parsed = arg(\n        { \"--project\": String,\n\"-p\": \"--project\",\n\"--url\": String },\n        { argv: rawArgs.slice(2),\npermissive: true }\n    );\n    if (parsed[\"--project\"] || parsed[\"--url\"]) return;\n\n    fail(\n        `This directory is linked directly to ${chalk.cyan(link.url)} — `\n        + `${chalk.bold(\"rebase cloud unlink\")} first, or pass ${chalk.bold(\"--project\")}.`,\n        \"A direct link is one backend, not a control plane: it has no projects, no organizations and no session.\",\n        \"direct_link\"\n    );\n}\n\nfunction normalizeUrl(url: string): string {\n    let u = url.trim().replace(/\\/+$/, \"\");\n    if (!/^https?:\\/\\//.test(u)) u = `https://${u}`;\n    return u;\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   Rebase client factory + auth guard\n   ═══════════════════════════════════════════════════════════════ */\n\nexport type CloudClient = ReturnType<typeof createRebaseClient>;\n\n/**\n * Build an SDK client bound to a control-plane host, backed by the on-disk\n * credential store. `autoRefresh` is disabled so we never leave a dangling\n * setTimeout that keeps the CLI process alive; token refresh is done on demand\n * by `requireClient`.\n */\nexport function createCloudClient(url: string): CloudClient {\n    return createRebaseClient({\n        baseUrl: url,\n        // No cloud subcommand needs a socket. The one that looks like it might —\n        // `logs -f` — polls `deployments.findById` on a timer (see\n        // `streamBuildLogs`), so nothing here ever opens a channel or an\n        // `observe()`.\n        //\n        // This used to say `websocketUrl: \"\"` and mean the same thing. It stopped\n        // meaning it when the client grew a diagnostic for the case it produces:\n        // realtime is on unless you switch it off, so \"on, with no usable URL\"\n        // reads as a misconfiguration and warns. The warning is right — and it\n        // was firing on every single `rebase cloud` invocation, telling the user\n        // to fix the CLI's own client construction, in prose they had no way to\n        // act on. `realtime: false` is the escape it names: it is the difference\n        // between \"no socket, because I never asked for one\" and \"no socket, and\n        // I do not know why\".\n        realtime: false,\n        // Every control-plane request says which CLI is calling. The control\n        // plane's wire format moves ahead of what is published to npm, so it\n        // has to be able to answer an old client with `CLI_TOO_OLD` and the\n        // minimum version — and it cannot do that for a caller that never\n        // identified itself. Until this line, none of them did.\n        headers: { \"User-Agent\": cliUserAgent() },\n        auth: {\n            storage: createFileAuthStorage(url),\n            persistSession: true,\n            autoRefresh: false\n        }\n    });\n}\n\n/**\n * The environment variable that authenticates the cloud family with a token\n * instead of a `cloud login` session — for CI and agents, which have no\n * terminal to log in at and should not hold a person's password.\n */\nexport const TOKEN_ENV = \"REBASE_TOKEN\";\n\n/** `REBASE_TOKEN`, trimmed, or undefined when it is unset or blank. */\nexport function envToken(): string | undefined {\n    const value = process.env[TOKEN_ENV]?.trim();\n    return value ? value : undefined;\n}\n\n/** The token each token-authenticated client was built with — see {@link freshAccessToken}. */\nconst STATIC_TOKENS = new WeakMap<object, string>();\n\n/**\n * A client that sends `token` as its bearer and nothing else.\n *\n * No session: the token is not refreshed, and the credentials file is neither\n * read nor written — a CI job's token must not become, or replace, the login\n * of whoever owns the machine. A 401 is answered by {@link explainRefusedToken}\n * rather than by the SDK's session refresh, because there is no session to\n * refresh and \"log in again\" is the wrong remedy for a token.\n */\nexport function createTokenClient(url: string, token: string): CloudClient {\n    const client = createRebaseClient({\n        baseUrl: url,\n        realtime: false,\n        headers: { \"User-Agent\": cliUserAgent() },\n        token,\n        auth: {\n            storage: createMemoryStorage(),\n            persistSession: false,\n            autoRefresh: false\n        }\n    });\n    client.setOnUnauthorized(() => explainRefusedToken(url, token));\n    STATIC_TOKENS.set(client, token);\n    return client;\n}\n\n/**\n * Why the control plane answered a token-authenticated request with 401, and\n * what to do about it. Never returns.\n *\n * Two different causes reach the same status. Usually the token itself was\n * refused — it expired, was revoked, or belongs to another control plane — and\n * the remedy is a new token. But a few endpoints take only a person's session\n * (`/auth/me` among them), and those refuse a perfectly good token too. One\n * request to `/api/auth/scopes`, which accepts a token, tells the two apart, so\n * neither is answered with the other's remedy.\n */\nasync function explainRefusedToken(url: string, token: string): Promise<never> {\n    let tokenAccepted = false;\n    try {\n        const probe = await fetch(`${url}/api/auth/scopes`, {\n            headers: { Authorization: `Bearer ${token}`, \"User-Agent\": cliUserAgent() }\n        });\n        tokenAccepted = probe.ok;\n    } catch {\n        // Unreachable: say what is certain — the request was refused.\n    }\n    if (tokenAccepted) {\n        fail(\n            `This command needs a signed-in session, and ${TOKEN_ENV} is an API token.`,\n            `Unset ${TOKEN_ENV} and run ${chalk.bold(\"rebase cloud login\")} to run it.`,\n            \"session_required\"\n        );\n    }\n    fail(\n        `${TOKEN_ENV} was rejected by ${url}: it has expired, been revoked, or was not issued by this control plane.`,\n        `Create a new one with ${chalk.bold(\"rebase cloud tokens create\")} and put it in ${TOKEN_ENV}.`,\n        \"token_rejected\"\n    );\n}\n\n/** Two minutes of head-room before a token is treated as expired. */\nconst EXPIRY_BUFFER_MS = 120_000;\n\n/** The half of a client that holds its session — all {@link freshAccessToken} reads. */\nexport interface SessionHolder {\n    auth: {\n        getSession(): { accessToken: string; expiresAt: number } | null;\n        refreshSession(): Promise<{ accessToken: string }>;\n    };\n}\n\n/**\n * An access token with time left on it, refreshed first if it is close to\n * expiry. Rejects when there is no session, or it cannot be refreshed.\n *\n * For the requests the SDK does not make itself. Its own calls refresh and\n * retry on a 401; a raw `fetch` or a tunnel handshake presents whatever token\n * it was handed, and `createCloudClient` never refreshes in the background. A\n * token read once at the start of a command that runs for longer than it\n * lives — a deploy's build, a `db connect` left open — is refused by the time\n * it is used, so it is read here at the moment it is sent.\n *\n * A client built from `REBASE_TOKEN` has no session; its token is returned\n * as it is, since there is nothing to refresh it with.\n */\nexport async function freshAccessToken(client: SessionHolder): Promise<string> {\n    const fixed = STATIC_TOKENS.get(client);\n    if (fixed) return fixed;\n    const session = client.auth.getSession();\n    if (session?.accessToken && session.expiresAt > Date.now() + EXPIRY_BUFFER_MS) return session.accessToken;\n    return (await client.auth.refreshSession()).accessToken;\n}\n\n/**\n * Return an authenticated client for the resolved host.\n *\n * With `REBASE_TOKEN` set, that token is the credential for every request and\n * the stored login is not consulted at all. Otherwise it is the `cloud login`\n * session — see {@link requireSessionClient}.\n */\nexport async function requireClient(rawArgs: string[]): Promise<{ client: CloudClient; url: string }> {\n    const token = envToken();\n    if (!token) return requireSessionClient(rawArgs);\n    // Before anything else: everything downstream of here is a control-plane\n    // call, and a direct-linked directory has no control plane to make it\n    // against.\n    refuseDirectLink(rawArgs);\n    const url = resolveCloudUrl(rawArgs);\n    return { client: createTokenClient(url, token), url };\n}\n\n/**\n * Return a client holding the `cloud login` session for the resolved host,\n * refreshing the access token if it is close to expiry, whether or not\n * `REBASE_TOKEN` is set. Exits with a helpful message when there is no usable\n * session (never logged in, or the refresh token was revoked).\n *\n * For the commands a token cannot run — minting and revoking tokens: a key that\n * could mint keys could mint its own successor, so the control plane refuses\n * every key on those routes.\n */\nexport async function requireSessionClient(rawArgs: string[]): Promise<{ client: CloudClient; url: string }> {\n    // Before anything else: everything downstream of here is a control-plane\n    // call, and a direct-linked directory has no control plane to make it\n    // against.\n    refuseDirectLink(rawArgs);\n    const url = resolveCloudUrl(rawArgs);\n    const client = createCloudClient(url);\n    const session = client.auth.getSession();\n\n    if (!session || !session.accessToken) {\n        if (envToken()) {\n            fail(\n                `This command needs a signed-in session for ${chalk.cyan(url)}, and ${TOKEN_ENV} is an API token.`,\n                `A token cannot manage tokens. Run ${chalk.bold(\"rebase cloud login\")} first.`,\n                \"session_required\"\n            );\n        }\n        fail(\n            `Not logged in to ${chalk.cyan(url)}.`,\n            `Run ${chalk.bold(\"rebase cloud login\")} first.`,\n            \"not_logged_in\"\n        );\n    }\n\n    if (session.expiresAt <= Date.now() + EXPIRY_BUFFER_MS) {\n        try {\n            await client.auth.refreshSession();\n        } catch {\n            fail(\n                `Your session for ${chalk.cyan(url)} has expired.`,\n                `Run ${chalk.bold(\"rebase cloud login\")} to sign in again.`,\n                // Distinct from `not_logged_in`: a caller retrying on a stale\n                // session should re-authenticate, not conclude it was never set\n                // up. Same remedy, different diagnosis.\n                \"session_expired\"\n            );\n        }\n    }\n\n    return { client,\nurl };\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   Platform configuration\n   ═══════════════════════════════════════════════════════════════ */\n\n/** One place a deploy can actually land, as the control plane describes it. */\nexport interface DeployTarget {\n    clusterId?: string | null;\n    provider: string;\n    region?: string;\n    label?: string;\n    baseDomain?: string;\n}\n\nexport interface PlatformConfig {\n    tenantBaseDomain?: string;\n    deployTargets?: DeployTarget[];\n}\n\n/**\n * The control plane's public, non-secret self-description (`platform-config`).\n *\n * None of it is knowable from the CLI side: it is per-deployment configuration —\n * production serves tenants at `rebase.website` on GKE, a dev control plane at\n * `localhost` on Docker. Guessing produced two separate lies: a congratulation\n * URL that resolved nowhere near the app, and a `provider` the project does not\n * run on (see `createProject`).\n *\n * Cached per host for the process: it is fixed for a control plane's lifetime,\n * and `projects list` formats one host per row off a single fetch.\n *\n * @returns the config, or `undefined` if the control plane doesn't serve\n *   `platform-config` (an older deployment) or the request failed. A failure is\n *   cached too — a short-lived CLI should not retry once per row. Note the\n *   distinction callers rely on: `undefined` means \"this control plane cannot\n *   tell us\", whereas `deployTargets: []` is a control plane stating that it has\n *   no infrastructure configured.\n */\nconst platformConfigCache = new Map<string, Promise<PlatformConfig | undefined>>();\n\nexport function fetchPlatformConfig(client: CloudClient, url: string): Promise<PlatformConfig | undefined> {\n    let pending = platformConfigCache.get(url);\n    if (!pending) {\n        pending = client.functions\n            .invoke<PlatformConfig>(\"platform-config\", undefined, { method: \"GET\" })\n            .then((cfg) => cfg ?? undefined)\n            .catch(() => undefined);\n        platformConfigCache.set(url, pending);\n    }\n    return pending;\n}\n\n/**\n * The base domain tenant projects are served at, derived from the same\n * TENANT_BASE_DOMAIN the ingress and the console read (see\n * saas/backend/src/utils/tenant-domain.ts).\n */\nexport function fetchTenantBaseDomain(client: CloudClient, url: string): Promise<string | undefined> {\n    return fetchPlatformConfig(client, url).then((cfg) => cfg?.tenantBaseDomain?.trim() || undefined);\n}\n\n/**\n * The infrastructure a deploy for this control plane would ACTUALLY use, in the\n * resolver's own preference order (saas/backend/src/k8s/resolve.ts).\n *\n * @returns the targets, or `undefined` when the control plane cannot say.\n */\nexport function fetchDeployTargets(client: CloudClient, url: string): Promise<DeployTarget[] | undefined> {\n    return fetchPlatformConfig(client, url).then((cfg) =>\n        Array.isArray(cfg?.deployTargets) ? cfg.deployTargets : undefined\n    );\n}\n\n/**\n * Public host for a project — `<subdomain>.<base>`, or the bare subdomain when\n * the base domain is unknown.\n *\n * It deliberately never falls back to a guessed domain. The user copies this\n * string into a browser, so a plausible-but-wrong hostname is worse than an\n * obviously incomplete one: `acme.rebase.pro` looks reachable and isn't, while\n * `acme` reads as \"the subdomain is acme\" and prompts no wasted debugging.\n */\nexport function formatTenantHost(\n    subdomain: string | undefined,\n    baseDomain: string | undefined\n): string | undefined {\n    if (!subdomain) return undefined;\n    return baseDomain ? `${subdomain}.${baseDomain}` : subdomain;\n}\n\n/** The fields of a project row this module needs to render a host. */\nexport interface HostableProject {\n    subdomain?: string;\n    /** Resolved server-side; absent on control planes older than the host hook. */\n    host?: string;\n}\n\n/**\n * The host to display for a project.\n *\n * Prefers `host` off the record: the control plane resolves it through the same\n * `tenantHost()` the ingress uses, so it accounts for the project's *cluster*\n * base domain. The CLI cannot compute that itself — `clusters` is admin-only\n * under RLS, so a normal user's token cannot read `baseDomain`, and a project on\n * a second cluster is served somewhere the platform default does not name.\n *\n * `baseDomain` (from `platform-config`) remains the fallback for a control plane\n * that predates the hook — right for the single-cluster case, which is every\n * project today.\n */\nexport function projectHost(\n    project: HostableProject,\n    baseDomain: string | undefined\n): string | undefined {\n    return project.host || formatTenantHost(project.subdomain, baseDomain);\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   Project link file (.rebase/cloud.json)\n   ═══════════════════════════════════════════════════════════════ */\n\nexport interface ProjectLink {\n    url: string;\n    projectId: string;\n    /** The project's subdomain — the slug users see in console URLs and type into --project. */\n    slug?: string;\n    projectName?: string;\n    orgId?: string;\n    /**\n     * Base URL of the project's own API.\n     *\n     * For a cloud project this is a convenience derived from the subdomain. For\n     * a **self-hosted** project it is the entire link: there is no control plane\n     * to look anything up in, so `projectId` is empty and this is what commands\n     * resolve against.\n     *\n     * Keeping both kinds of link in one file is deliberate. A second link file\n     * for self-hosting would fork every command that reads one, and the tooling\n     * would drift into being cloud-only by accident.\n     */\n    apiUrl?: string;\n    /**\n     * How this checkout is linked. Absent means `cloud` — which is every link\n     * written before this field existed.\n     */\n    mode?: \"cloud\" | \"direct\";\n}\n\nexport function readLink(cwd: string = process.cwd()): ProjectLink | null {\n    try {\n        return JSON.parse(fs.readFileSync(projectLinkPath(cwd), \"utf-8\")) as ProjectLink;\n    } catch {\n        return null;\n    }\n}\n\nexport function writeLink(link: ProjectLink, cwd: string = process.cwd()): void {\n    const file = projectLinkPath(cwd);\n    fs.mkdirSync(path.dirname(file), { recursive: true });\n    fs.writeFileSync(file, JSON.stringify(link, null, 2));\n}\n\nexport function removeLink(cwd: string = process.cwd()): boolean {\n    const file = projectLinkPath(cwd);\n    if (fs.existsSync(file)) {\n        fs.rmSync(file);\n        return true;\n    }\n    return false;\n}\n\n/**\n * Flags that may appear anywhere on a `rebase cloud` line, including *before*\n * the resource group.\n *\n * They have to be declared wherever positionals are resolved, because `arg`'s\n * `permissive: true` does not merely tolerate an undeclared flag — it pushes it\n * into `_` alongside the positionals, and for a flag that takes a value it\n * pushes the value in too. So `cloud --project acme storage create` parsed\n * without this spec yields `_` of `[\"--project\", \"acme\", \"storage\", \"create\"]`,\n * and the group reads as `\"acme\"`: a real project name, in the group position,\n * dispatching to nothing. Skipping tokens that start with `-` does not save you\n * there — the damage is the orphaned value, which looks exactly like a\n * positional.\n *\n * Only genuinely global flags belong here. Group-specific ones (`--bucket`,\n * `--region`, …) are declared by the handler that owns them. They can still\n * precede the action — or stand in for it, on a group with a default — so the\n * dispatcher also declares every one that takes a value: `CLOUD_VALUE_FLAGS`\n * in `index.ts`.\n *\n * `-p` is `--project` in eighteen places and `--password` in `login`. That\n * ambiguity does not matter to the one caller that reads this spec: it resolves\n * positionals and never looks at a flag's value, so all it needs to know is\n * that `-p` takes one. Anything that wants the value must keep declaring it\n * itself, with the meaning its own command gives it.\n */\nexport const GLOBAL_CLOUD_FLAGS = {\n    \"--json\": Boolean,\n    \"--yes\": Boolean,\n    \"--help\": Boolean,\n    \"--project\": String,\n    /* `resolveCloudUrl` reads this off the raw line for EVERY command in the\n       family — it is the first entry in the URL priority list — so a strict\n       parse that did not declare it would reject a flag the CLI itself honours\n       on the command being parsed. */\n    \"--url\": String,\n    \"-p\": \"--project\",\n    \"-y\": \"--yes\",\n    \"-h\": \"--help\"\n} as const;\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\n/**\n * The raw project reference to operate on: explicit `--project` flag wins,\n * otherwise the linked project. Exits with guidance when neither is present.\n * The value is a slug (the project's subdomain, as shown in console URLs) or,\n * for old scripts and link files, a raw project UUID.\n */\nexport function requireProjectRef(rawArgs: string[]): string {\n    const parsed = arg({ \"--project\": String,\n\"-p\": \"--project\" }, { argv: rawArgs.slice(2),\npermissive: true });\n    if (parsed[\"--project\"]) return parsed[\"--project\"];\n    const link = readLink();\n    if (link?.projectId) return link.projectId;\n    fail(\n        \"No project specified and this directory is not linked.\",\n        `Pass ${chalk.bold(\"--project <slug>\")} or run ${chalk.bold(\"rebase cloud link\")}.`,\n        \"no_project\"\n    );\n}\n\n/**\n * Resolve a project reference — slug or UUID — to the internal id the API\n * takes, or undefined when no such project is visible. Slugs cost one lookup;\n * UUIDs pass through untouched so linked directories and old scripts skip the\n * round-trip.\n */\nexport async function lookupProjectId(ref: string, client: CloudClient): Promise<string | undefined> {\n    if (UUID_RE.test(ref)) return ref;\n    const res = await client.data.collection(\"projects\").find({\n        where: { subdomain: [\"==\", ref] },\n        limit: 1\n    });\n    const row = res.data[0] as { id?: string | number } | undefined;\n    return row?.id === undefined ? undefined : String(row.id);\n}\n\n/** Like `lookupProjectId`, but exits with guidance when the ref matches nothing. */\nexport async function resolveProjectRef(ref: string, client: CloudClient): Promise<string> {\n    const id = await lookupProjectId(ref, client);\n    if (id === undefined) {\n        fail(\n            `No project with slug ${chalk.bold(ref)}.`,\n            `List yours with ${chalk.bold(\"rebase cloud projects\")}.`,\n            \"project_not_found\"\n        );\n    }\n    return id;\n}\n\n/** `requireProjectRef` + `resolveProjectRef` in one step. */\nexport async function requireProject(rawArgs: string[], client: CloudClient): Promise<string> {\n    return resolveProjectRef(requireProjectRef(rawArgs), client);\n}\n\n/**\n * The project reference to SHOW: the slug the user typed or the linked slug.\n * Never resolves — for human output only. Old link files predate `slug` and\n * fall back to the stored id.\n */\nexport function displayProjectRef(rawArgs: string[]): string {\n    const parsed = arg({ \"--project\": String,\n\"-p\": \"--project\" }, { argv: rawArgs.slice(2),\npermissive: true });\n    if (parsed[\"--project\"]) return parsed[\"--project\"];\n    const link = readLink();\n    return link?.slug || link?.projectId || \"\";\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   Machine-readable output mode\n   ═══════════════════════════════════════════════════════════════\n\n   Rebase is built for agents, and the CLI is their primary interface. An agent\n   must never scrape a colorized table, so every cloud command can emit a single\n   JSON value instead of human output.\n\n   JSON mode is on when ANY of these hold:\n     • `--json` was passed,\n     • `REBASE_JSON=1` is set, or\n     • stdout is not a TTY (piped/redirected — i.e. a program is reading it).\n\n   In JSON mode a command prints exactly one JSON value to stdout and nothing\n   else; errors print `{\"error\":{...}}` and exit non-zero. The mode is a\n   process-global set once, at dispatch, by `initOutputMode` — every helper here\n   (fail, reportError, emit) reads it so the whole family is consistent.\n\n   ── The stream contract ─────────────────────────────────────────────────────\n\n   The mode decides the SHAPE of the result. It does not decide which stream\n   anything lands on; that rule is fixed and holds in both modes:\n\n     stdout  the command's result, and nothing else — one human rendering or\n             one JSON value. A caller may redirect it into a parser.\n     stderr  everything that is not the result: progress, advice, warnings,\n             errors, and the interactive prompts.\n\n   Nothing is written to both. That is the whole rule, and it is worth stating\n   because the family drifted off it in a way that reads as a bug in the report\n   itself: a warning from the SDK went to stderr while the report went to\n   stdout, so `whoami 2>&1` interleaved two unrelated voices and the header\n   looked like it had been printed twice.\n\n   The practical consequence for a new command: the ONLY things that may call\n   `console.log` are inside an `emit` human closure. Progress and next-step\n   advice go through `note`, cautions through `warn`, outcomes through\n   `success` — all of which write to stderr. `keyValues` prints result rows and\n   so stays on stdout, which is why it belongs inside the `emit` closure too.\n*/\n\nlet JSON_MODE = false;\n\n/**\n * Resolve and latch the output mode for this invocation. Call once at the top of\n * `cloudCommand`, before anything can print or `fail`. Returns the resolved mode\n * (handy for tests, which otherwise leave it at its `false` default).\n */\nexport function initOutputMode(rawArgs: string[]): boolean {\n    const parsed = arg({ \"--json\": Boolean }, { argv: rawArgs.slice(2),\npermissive: true });\n    // Most explicit wins. `REBASE_JSON=0` is the half that was missing: the\n    // \"stdout is not a TTY\" rule is right for a result, and wrong for the reader\n    // who ran `rebase cloud env --help | less` and got a JSON object. There was\n    // no way to say so — `--json` could only turn the mode ON, and `REBASE_JSON`\n    // was tested against \"1\" alone, so any other value including \"0\" fell\n    // through to the TTY test and set it anyway. Any spelling of yes or no now\n    // decides; only an unset or unrecognised value leaves it to the TTY.\n    if (parsed[\"--json\"]) JSON_MODE = true;\n    else JSON_MODE = parseEnvBoolean(process.env.REBASE_JSON) ?? process.stdout.isTTY !== true;\n    return JSON_MODE;\n}\n\n/** Whether the current invocation is emitting machine-readable JSON. */\nexport function isJsonMode(): boolean {\n    return JSON_MODE;\n}\n\n/** Force the mode (tests only — production latches it via `initOutputMode`). */\nexport function setJsonModeForTest(value: boolean): void {\n    JSON_MODE = value;\n}\n\n/** Strip ANSI colour codes — JSON output must never carry terminal escapes. */\n// eslint-disable-next-line no-control-regex\nconst ANSI_RE = /\u001b\\[[0-9;]*m/g;\nfunction stripAnsi(s: string): string {\n    return s.replace(ANSI_RE, \"\");\n}\n\n/**\n * Write one JSON value to stdout, followed by a newline.\n *\n * Indented, because the overwhelmingly common reader is a person or an agent\n * looking at a terminal — JSON mode is entered automatically whenever stdout is\n * not a TTY, so `rebase cloud deployments list` piped anywhere at all produced\n * a project's entire deployment history as one unwrapped line. `JSON.parse`\n * does not care about the whitespace; everything else does.\n */\nexport function printJson(value: unknown): void {\n    process.stdout.write(JSON.stringify(value, null, 2) + \"\\n\");\n}\n\n/**\n * The one output primitive every new command uses: in JSON mode emit `json`\n * (and nothing else); otherwise run `human`. Keeping the two behind a single\n * call is what guarantees a command can never print a table AND a JSON blob.\n */\nexport function emit<T>(human: () => void, json: JsonArg<T>): void {\n    if (JSON_MODE) printJson(json);\n    else human();\n}\n\n/**\n * The JSON payload, which must be a value and not a producer of one.\n *\n * `json: unknown` accepted a function without complaint, and four call sites in\n * `resources.ts` passed `() => ({ … })` — mirroring the human argument beside\n * it, which *is* a thunk. In JSON mode `printJson` then stringified a function,\n * which is `undefined`. So `rebase cloud compute`, `compute set` and two\n * cluster commands printed the single word `undefined` on every piped or\n * `--json` run — and since this family forces JSON mode off a TTY, that is\n * every scripted use of them.\n *\n * Typed so the mistake cannot be made again: a function resolves the parameter\n * to `never`, and the call site fails to compile.\n */\nexport type JsonArg<T> = T extends (...args: never[]) => unknown ? never : T;\n\n/**\n * Print a help page — the human one, or a machine-readable description of the\n * same command in JSON mode.\n *\n * `--help` is the one place where \"stdout is not a TTY\" is a weak signal: a\n * person runs `rebase cloud db --help | less` and wants the page. But the rule\n * this family promises is that stdout carries one JSON value whenever it is not\n * a terminal, and a help page is the easiest possible thing to describe\n * structurally — so rather than carve out an exception, help answers the same\n * question in the reader's own language. For an agent, `--help` piped is then a\n * discovery call rather than 60 lines of ANSI to scrape.\n *\n * `env` shipped this shape first, alone; this generalises it so every group\n * answers the same way.\n */\nexport function emitHelp(\n    command: string,\n    actions: Array<string | HelpAction>,\n    human: () => void,\n    extra: Record<string, unknown> = {}\n): void {\n    emit(human, { command,\nactions: actions.map(entry => describeAction(entry, command)),\n...extra });\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   Group help pages\n   ═══════════════════════════════════════════════════════════════ */\n\n/**\n * One action on a group's help page.\n *\n * The page used to exist twice: a hand-formatted template literal for a\n * terminal, and a bare list of action WORDS for everything else. So the two\n * answers to `--help` were not the same answer — piped, `rebase cloud env\n * --help` said `[\"list\",\"set\",\"unset\",\"reveal\",\"pull\"]` and not one description,\n * not one flag, and not the sentence about build-time variables that is the\n * whole reason the page exists. This family forces JSON mode off a TTY, so that\n * was every scripted and every agent-driven read of it.\n *\n * One description, rendered twice.\n */\nexport interface HelpAction {\n    /** The action word: `set`, `backup restore`. */\n    action: string;\n    /** The usage tail after the word: `KEY=VALUE`, `<domain>`, `[-y]`. */\n    args?: string;\n    /** One line: what it does. */\n    description: string;\n    /** Flags this action takes of its own, `[flag, description]`. */\n    flags?: Array<[string, string]>;\n    /** The heading it sits under, on a page that groups its actions. */\n    section?: string;\n}\n\n/** A whole group page — `rebase cloud env --help`. */\nexport interface GroupHelp {\n    /** The command words, no leading `rebase`: `cloud env`, or `cloud` itself. */\n    command: string;\n    /** The title's tail: \"Environment variables\". */\n    title: string;\n    actions: HelpAction[];\n    /** Options that belong to the group rather than to one action. */\n    options?: Array<[string, string]>;\n    /** Closing paragraphs — the things a reader gets wrong more than once. */\n    notes?: string[];\n}\n\n/**\n * Normalise an action for the JSON form. Strings stay legal — the index page\n * lists group names, which are not actions of the command being described.\n *\n * `command` is the page's own command (`cloud env`), so the usage line a caller\n * reads is a line it can run: without it the answer said `rebase cloud set\n * KEY=VALUE`, which is a command that does not exist.\n */\nfunction describeAction(entry: string | HelpAction, command: string): Record<string, unknown> {\n    if (typeof entry === \"string\") return { action: entry,\ndescription: \"\",\nflags: [] };\n    return {\n        action: entry.action,\n        usage: `rebase ${command} ${entry.action}${entry.args ? ` ${entry.args}` : \"\"}`,\n        description: entry.description,\n        flags: (entry.flags ?? []).map(([flag, description]) => ({ flag,\ndescription }))\n    };\n}\n\n/**\n * Flags every cloud command accepts, documented once.\n *\n * Lives here rather than in `action-help.ts` because both help renderers print\n * it and `action-help` imports this module, not the other way round.\n */\nexport const GLOBAL_HELP_FLAGS: Array<[string, string]> = [\n    [\"--project, -p <slug>\", \"Operate on a project without linking this directory\"],\n    [\"--json\", \"Machine-readable output (also when piped, or REBASE_JSON=1)\"],\n    [\"--url <origin>\", \"Target a specific control plane (or REBASE_CLOUD_URL)\"],\n    [\"--yes, -y\", \"Skip confirmation prompts\"],\n    [\"--debug\", \"Print the untouched error body after a failure\"]\n];\n\n/**\n * Flag names `parseCloudArgs` adds to every command in the family.\n *\n * Derived from `GLOBAL_CLOUD_FLAGS` rather than listed again — a second copy is\n * how a global gains a spelling that the collision sweep does not know about.\n * `--debug` is the one addition: `bin/rebase.js` takes it off `process.argv`\n * itself, so no cloud spec declares it and every command still accepts it.\n */\nexport const GLOBAL_SPEC_KEYS = new Set([...Object.keys(GLOBAL_CLOUD_FLAGS), \"--debug\"]);\n\n/** Column width for an action word (+ its args) before its description. */\nconst HELP_COLUMN = 28;\n\n/**\n * The gap after `text` in a `width`-wide column, never less than one space.\n *\n * `padEnd` returns the string unchanged when it is already at the width, which\n * glues the description onto the flag: `--connection-string <url>The external…`.\n */\nfunction pad(text: string, width: number): string {\n    return \" \".repeat(Math.max(1, width - text.length));\n}\n\n/**\n * Print a group's page — the human one, and the same content as JSON when piped.\n */\nexport function printGroupHelp(page: GroupHelp): void {\n    emitHelp(\n        page.command,\n        page.actions,\n        () => {\n            console.log(\"\");\n            console.log(`${chalk.bold(`rebase ${page.command}`)} — ${page.title}`);\n            console.log(\"\");\n            console.log(chalk.green.bold(\"Usage\"));\n            console.log(`  rebase ${page.command} ${chalk.blue(\"<action>\")} [options]`);\n\n            let section: string | undefined;\n            for (const entry of page.actions) {\n                const heading = entry.section ?? \"Commands\";\n                if (heading !== section) {\n                    section = heading;\n                    console.log(\"\");\n                    console.log(chalk.green.bold(heading));\n                }\n                const word = `${entry.action}${entry.args ? ` ${entry.args}` : \"\"}`;\n                console.log(\n                    `  ${chalk.blue.bold(entry.action)}${entry.args ? ` ${chalk.gray(entry.args)}` : \"\"}`\n                    + `${pad(word, HELP_COLUMN)}${entry.description}`\n                );\n                for (const [flag, description] of entry.flags ?? []) {\n                    console.log(`      ${chalk.blue(flag)}${pad(flag, HELP_COLUMN - 4)}${chalk.gray(description)}`);\n                }\n            }\n\n            if (page.options?.length) {\n                console.log(\"\");\n                console.log(chalk.green.bold(\"Options\"));\n                for (const [flag, description] of page.options) {\n                    console.log(`  ${chalk.blue(flag)}${pad(flag, HELP_COLUMN)}${description}`);\n                }\n            }\n\n            console.log(\"\");\n            console.log(chalk.green.bold(\"Global options\"));\n            for (const [flag, description] of GLOBAL_HELP_FLAGS) {\n                console.log(`  ${chalk.blue(flag)}${pad(flag, HELP_COLUMN)}${chalk.gray(description)}`);\n            }\n\n            if (page.notes?.length) {\n                console.log(\"\");\n                for (const note of page.notes) console.log(chalk.gray(`  ${note}`));\n            }\n            console.log(\"\");\n        },\n        {\n            usage: `rebase ${page.command} <action> [options]`,\n            summary: page.title,\n            options: (page.options ?? []).map(([flag, description]) => ({ flag,\ndescription })),\n            globalFlags: GLOBAL_HELP_FLAGS.map(([flag, description]) => ({ flag,\ndescription })),\n            notes: page.notes ?? []\n        }\n    );\n}\n\n/* ═══════════════════════════════════════════════════════════════\n   Output helpers\n   ═══════════════════════════════════════════════════════════════ */\n\n/**\n * Print a warning (+ optional hint) — in every output mode, always to stderr.\n *\n * `emit` is for a command's *result*, and JSON mode legitimately replaces the\n * human rendering of one. A warning is not a result: it says the command is\n * about to do something the caller may not have meant, and that is exactly as\n * true when the output is piped. Gating one on `!isJsonMode()` deleted it\n * precisely where nobody was watching the terminal — a `--source` deploy ejected\n * a live project off the managed runtime and said so only to a TTY that wasn't\n * there.\n *\n * stdout carries the JSON value and nothing else, so warnings go to stderr:\n * a machine parser reading stdout cannot be corrupted by one. Only the\n * *formatting* may depend on the mode — colour and indentation for a terminal,\n * plain ASCII otherwise. Whether a warning is emitted at all may not.\n *\n * Anything a caller might branch on belongs in the JSON payload as well; stderr\n * is for whoever reads the transcript afterwards.\n */\nexport function warn(message: string, hint?: string): void {\n    if (JSON_MODE) {\n        process.stderr.write(`warning: ${stripAnsi(message)}\\n`);\n        if (hint) process.stderr.write(`  ${stripAnsi(hint)}\\n`);\n        return;\n    }\n    console.error(\"\");\n    console.error(chalk.yellow(`  ⚠ ${message}`));\n    if (hint) console.error(chalk.gray(`    ${hint}`));\n}\n\n/**\n * Print an error (+ optional hint) and exit non-zero. Never returns.\n *\n * `code` is the field a caller branches on, and it defaults to `\"error\"` rather\n * than `null`. An envelope whose only machine-readable field is null is not\n * machine-readable — `{\"error\":{\"message\":\"No project specified…\",\"code\":null}}`\n * forced the very substring-matching on `message` that the envelope exists to\n * make unnecessary, and `message` is the field most likely to be reworded.\n *\n * `\"error\"` is deliberately a poor code: it says \"this refusal has not been\n * classified yet\" without ever being absent. Anything a caller might plausibly\n * want to distinguish — `usage`, `not_found`, `unauthenticated` — passes a real\n * one. Codes are part of the CLI's contract once shipped; see\n * `cloud-reporting.test.ts`, which pins the ones commands are documented to\n * return.\n */\nexport function fail(message: string, hint?: string, code?: string): never {\n    if (JSON_MODE) {\n        printJson({ error: { message: stripAnsi(message),\ncode: code ?? \"error\",\nhint: hint ? stripAnsi(hint) : undefined } });\n        process.exit(1);\n    }\n    console.error(\"\");\n    console.error(chalk.red(`  ✗ ${message}`));\n    if (hint) console.error(chalk.gray(`  ${hint}`));\n    console.error(\"\");\n    process.exit(1);\n}\n\n/**\n * Confirm a destructive/irreversible action, respecting non-interactive use.\n *\n * With `--yes`/`-y` it proceeds silently. In JSON mode or a non-TTY it REFUSES\n * to prompt — a prompt that can hang is a known repo landmine — and fails,\n * telling the caller to pass `--yes`. Only an interactive terminal gets a real\n * confirm prompt; declining there aborts cleanly (exit 0).\n */\nexport async function confirmDestructive(opts: { yes: boolean; prompt: string }): Promise<void> {\n    if (opts.yes) return;\n    if (JSON_MODE || process.stdin.isTTY !== true) {\n        fail(\n            \"This action is destructive and needs confirmation.\",\n            `Re-run with ${chalk.bold(\"--yes\")} to proceed.`,\n            \"confirmation_required\"\n        );\n    }\n    const { confirmed } = (await inquirer.prompt([\n        { type: \"confirm\",\nname: \"confirmed\",\ndefault: false,\nmessage: opts.prompt }\n    ] as Parameters<typeof inquirer.prompt>[0])) as { confirmed: boolean };\n    if (!confirmed) {\n        // stderr: declining is not a result. Unreachable in JSON mode — the\n        // guard above already refused rather than prompt — so stdout stays\n        // empty and the exit code carries the outcome.\n        console.error(chalk.gray(\"  Aborted.\"));\n        process.exit(0);\n    }\n}\n\n/**\n * Refuse, rather than prompt, when there is nobody to answer.\n *\n * `confirmDestructive` has always done this for yes/no confirmations. The\n * *value* prompts had no such guard: `cloud login`, `cloud link`, `cloud use`,\n * `cloud orgs create` and `cloud db create` all called `inquirer.prompt`\n * unconditionally, so piping any of them — which is how an agent runs every\n * command in this family — parked the process on a prompt reading from a stdin\n * that was never going to produce a line. A hang is the worst failure mode\n * available here: no output, no exit code, nothing to retry on.\n *\n * @param what   what the prompt would have asked for, e.g. \"an email and password\"\n * @param flags  the flags that supply it non-interactively\n */\nexport function requireInteractive(what: string, flags: string): void {\n    if (JSON_MODE || process.stdin.isTTY !== true) {\n        fail(\n            `This command needs ${what}, and there is no terminal to ask on.`,\n            `Pass ${chalk.bold(flags)}.`,\n            \"input_required\"\n        );\n    }\n}\n\n/**\n * Resolve one cloud command's flags and ARGUMENTS from the full `process.argv`.\n *\n * This replaces `cloudPositionals`, which was `rawArgs.slice(3).filter(a =>\n * !a.startsWith(\"-\"))`. Dropping `-`-prefixed tokens looks like it solves the\n * permissive-parse problem and does not: a flag that takes a VALUE leaves the\n * value behind, an ordinary word in the argument position that no filter can\n * tell from a real one. `--project` is the flag every one of these commands\n * documents, so the failure was reachable from the help page:\n *\n *   rebase cloud env unset -p acme            → removed the variable \"acme\"\n *   rebase cloud env set KEY -p acme          → stored the value \"acme\"\n *   rebase cloud domains add -p acme          → registered the domain \"acme\"\n *   rebase cloud webhooks delete -p acme 42   → deleted webhook \"acme\", not 42\n *   rebase cloud cancel -p acme               → cancelled deployment id \"acme\"\n *\n * The filter's other half is quieter. A flag nobody declared *is* dropped by\n * it — but only from the operands, never from the run: nothing rejects it, so\n * the command proceeds with the argument missing or defaulted. `db backup\n * --dry-run` listed backups, `domains remove --dry-run` detached the domain,\n * and `env set KEY=v --secrett` stored the value as an ordinary variable that\n * `env reveal` will hand back. The one place an undeclared flag became the\n * argument outright is `projects info|delete`, which resolved its id through\n * `positionals()` instead — that skips only LEADING `-` tokens, so `projects\n * delete --force` looked up a project named \"--force\".\n *\n * So: parse the whole line strictly, through the same `parseCommandArgs` the\n * non-cloud commands use — `arg` then consumes each declared flag *with its\n * value* wherever it appears, and rejects the undeclared, leaving `_` holding\n * the command words followed by the real arguments. `commandWords` counts from\n * `cloud` itself (`cloud env set` ⇒ 3), and is applied to the parsed\n * positionals, so a flag written before the group shifts nothing.\n *\n * Two things this adds over calling `parseCommandArgs` directly, and the reason\n * it is worth a wrapper:\n *\n *  - `GLOBAL_CLOUD_FLAGS` is merged in. `--json`, `--yes` and `--project` may\n *    appear anywhere on a cloud line including before the group, so a strict\n *    parse that did not declare them would reject the CLI's own documented\n *    usage. (`parseCommandArgs` adds `--debug`/`--help` on top of that.)\n *  - A parse error is reported through `fail`, not thrown. A throw reaches\n *    `bin/rebase.js`, which prints `✗ …` to stderr — which is right for every\n *    other command and wrong here: `rebase cloud` is in JSON mode whenever\n *    stdout is not a TTY, i.e. always for the agents this family is built for,\n *    and it promises them exactly one JSON value. `fail` keeps that promise,\n *    with the same `usage` code the other refusals in this family use.\n */\nexport function parseCloudArgs<S extends arg.Spec>(opts: {\n    spec: S;\n    rawArgs: string[];\n    commandWords: number;\n    /** Names the command in errors, e.g. `cloud env set` (no leading `rebase`). */\n    command: string;\n    maxPositionals?: number;\n}): { flags: arg.Result<S & typeof GLOBAL_CLOUD_FLAGS>; positionals: string[] } {\n    const spec = { ...GLOBAL_CLOUD_FLAGS,\n...opts.spec };\n    try {\n        const parsed = parseCommandArgs({ ...opts,\nspec });\n        return { flags: parsed.flags,\npositionals: parsed.positionals };\n    } catch (err) {\n        fail(err instanceof Error ? err.message : String(err), undefined, \"usage\");\n    }\n}\n\n/**\n * Refuse an action word its group does not dispatch. Returns for `undefined`,\n * which is every group's default action.\n *\n * The groups that switch on their action already do this in a `default:` case.\n * The groups written as a chain of `if (action === \"x\") return …` did not: a\n * word that matched nothing fell out of the chain into the *default* action, so\n * `rebase cloud storage creat` listed the buckets and exited 0, and\n * `rebase cloud billing usage` printed the account. Reporting a typo as a\n * successful run of a different command is the failure mode this family exists\n * to not have — an agent branching on the exit code learns nothing, and a person\n * reads the output of a command they did not ask for.\n *\n * One spelling, so the code is `unknown_command` everywhere rather than the\n * default `\"error\"` half of them used, and the hint always names the group's own\n * `--help` rather than the index page.\n */\nexport function requireKnownAction(\n    group: string,\n    action: string | undefined,\n    known: readonly string[]\n): void {\n    if (action === undefined || known.includes(action)) return;\n    fail(\n        `Unknown ${group} command: ${action}`,\n        `Run \\`rebase cloud ${group} --help\\`. Actions: ${known.join(\", \")}.`,\n        \"unknown_command\"\n    );\n}\n\n/**\n * `--timeout <seconds>` as milliseconds, or `fallbackMs` when it was not given.\n *\n * One function rather than one per command, because two commands take this flag\n * and a second copy is where the two would come to disagree about what\n * `--timeout 0` means.\n *\n * A value this cannot read is a refusal, not a fall back to the default. The\n * whole reason a caller passes a timeout is that it has a deadline of its own;\n * quietly substituting a different one is how a fifteen-minute wait turns up\n * inside a five-minute CI step, having been asked for `--timeout 30s`.\n */\nexport function resolveTimeoutMs(\n    value: string | undefined,\n    opts: { fallbackMs: number; command: string }\n): number {\n    if (value === undefined) return opts.fallbackMs;\n    const seconds = Number(value);\n    if (!Number.isFinite(seconds) || seconds <= 0) {\n        fail(\n            `--timeout takes a number of seconds (got \"${value}\").`,\n            `Run \\`rebase ${opts.command} --help\\`.`,\n            \"usage\"\n        );\n    }\n    return seconds * 1000;\n}\n\n/**\n * Announce an outcome — \"Logged in as …\", \"Deleted project …\".\n *\n * On **stderr**, in both modes. It reads like a result and is not one: the\n * result is the JSON value (or the table) on stdout, and every JSON payload in\n * this family already carries `success: true`. Leaving this on stdout meant a\n * successful `rebase cloud link | jq` was handed a green tick followed by an\n * object — one stream, two syntaxes, and only the second parseable.\n *\n * It stays visible in JSON mode, unlike `note`: an agent that got a `success`\n * line on a command it expected to refuse has learned something.\n */\nexport function success(message: string): void {\n    if (JSON_MODE) {\n        process.stderr.write(`${stripAnsi(message)}\\n`);\n        return;\n    }\n    console.error(\"\");\n    console.error(chalk.bold.green(`  ✓ ${message}`));\n    console.error(\"\");\n}\n\n/**\n * Narrate progress, or point at the next step — \"Signing in to …\", \"Redeploy\n * for the tenant to pick this up\".\n *\n * stderr, and **suppressed entirely in JSON mode**. This is the one helper that\n * a mode may silence, and the distinction from `warn` is worth keeping sharp:\n *\n *   - A warning is a *condition*. It is as true when piped as when watched, so\n *     silencing it hides something the caller would want to know. `warn` never\n *     silences.\n *   - A note is *hand-holding*. \"Next: run `rebase generate-sdk`\" tells a person\n *     what to type; the agent reading the JSON already has the same information\n *     structurally, or does not need it. Printing it anyway is transcript noise.\n *\n * When in doubt it is a warning. The cost of a needless warning is a line; the\n * cost of a swallowed one is the deploy that ejected a project off the managed\n * runtime and said so only to a terminal nobody was looking at.\n */\nexport function note(message: string, indent = \"  \"): void {\n    if (JSON_MODE) return;\n    console.error(`${indent}${message}`);\n}\n\n/** A blank spacer line on the narration stream. No-op in JSON mode. */\nexport function noteBlank(): void {\n    if (JSON_MODE) return;\n    console.error(\"\");\n}\n\n/** Colorize a deployment / resource status token. */\nexport function colorStatus(status: string | undefined): string {\n    switch (status) {\n        case \"active\":\n        case \"success\":\n        case \"connected\":\n            return chalk.green(status);\n        case \"deploying\":\n        case \"provisioning\":\n        case \"pending_billing\":\n        case \"untested\":\n            return chalk.yellow(status ?? \"\");\n        case \"failed\":\n            return chalk.red(status);\n        case \"stopped\":\n            return chalk.gray(status);\n        default:\n            return chalk.gray(status ?? \"unknown\");\n    }\n}\n\n/**\n * Render a two-column key/value block with aligned keys. Empty rows are skipped\n * — including `null`, which the API sends for an unset column and which used to\n * print the literal string \"null\" (e.g. `Custom domain: null`).\n */\nexport function keyValues(rows: Array<[string, string | null | undefined]>): void {\n    const width = Math.max(...rows.map(([k]) => k.length));\n    for (const [k, v] of rows) {\n        if (v === undefined || v === null || v === \"\") continue;\n        console.log(`  ${chalk.gray(`${k}:`.padEnd(width + 1))} ${v}`);\n    }\n}\n\n/**\n * Surface an SDK/HTTP error consistently. The SDK throws RebaseApiError with\n * a `.status` and `.message`; anything else falls back to its string form.\n *\n * The message is summarised rather than printed — see `summarizeError`. What\n * arrives here is routinely a whole Kubernetes `Status` object with the request\n * headers appended, and the one sentence worth reading is inside it. The\n * untouched body is still available, behind `--debug`, on stderr where it\n * cannot corrupt the JSON value on stdout.\n */\nexport function reportError(e: unknown, context: string): never {\n    const err = e as { status?: number; message?: string; code?: string };\n    const summary = summarizeError(e, context);\n\n    if (wantsRawError()) {\n        process.stderr.write(`\\n${summary.raw}\\n\\n`);\n    }\n\n    if (JSON_MODE) {\n        printJson({\n            error: {\n                message: stripAnsi(summary.message),\n                // The SDK supplies a code for errors the API classified. When it\n                // does not, the HTTP status still classifies it well enough to\n                // branch on — `http_401` and `http_502` want very different\n                // handling, and both used to arrive as `null`. A cluster\n                // refusal classifies itself, and `platform` below says whether\n                // acting on it is even the caller's business.\n                code: summary.code,\n                status: err?.status ?? null,\n                hint: summary.hint ? stripAnsi(summary.hint) : undefined,\n                platform: summary.platform,\n                context\n            }\n        });\n        process.exit(1);\n    }\n    fail(summary.message, summary.hint, summary.code);\n}\n\n/**\n * Open a URL in the user's default browser (best effort). Always announces the\n * URL first so it stays usable over SSH or when no browser is available.\n *\n * The announcement is narration, not the result — it goes to stderr, and in\n * JSON mode it is silent. Every caller `emit`s the same URL in its payload, so\n * a machine reader gets it from the one place it is guaranteed to be parseable\n * rather than from a line that happens to end in a URL.\n */\nexport function openUrl(target: string, label = \"Opening\"): void {\n    noteBlank();\n    note(`${label} ${chalk.cyan(target)}`);\n    noteBlank();\n    const opener =\n        process.platform === \"darwin\" ? \"open\" : process.platform === \"win32\" ? \"start\" : \"xdg-open\";\n    try {\n        const child = spawn(opener, [target], {\n            stdio: \"ignore\",\n            detached: true,\n            shell: process.platform === \"win32\"\n        });\n        child.on(\"error\", () => {\n            /* URL already printed for manual copy */\n        });\n        child.unref();\n    } catch {\n        /* URL already printed */\n    }\n}\n\n/**\n * The one thing every control-plane row is required to have.\n *\n * The subcommands each declare their own row shape — `OrgRow`, `ProjectRow`,\n * `DatabaseRow`, `DeploymentRow` — and every one of them is an `id` plus\n * fields that are all optional, because a control plane older than a given\n * column simply does not send it. The reads are written that way too\n * (`o.name ?? \"(unnamed)\"`, `row.slug ? … : \"\"`).\n */\nexport interface CloudRow {\n    id: string | number;\n}\n\n/**\n * Read the control plane's rows as a subcommand's row shape.\n *\n * `client.data.collection(...)` is typed against the *generated* schema of the\n * project the SDK is pointed at, and the control-plane collections this CLI\n * reads are not in one — so every row arrives as an open\n * `Record<string, unknown>`. A declared `interface` gets no implicit index\n * signature, so it does not overlap that, and a direct `as` is refused: which\n * is how ten call sites came to write `as unknown as XRow[]`, an assertion\n * about a wire payload with nothing checking it in either direction.\n *\n * There is exactly one invariant to check and this checks it. Everything else\n * the shapes declare is optional and already read as such, so there is nothing\n * further to verify — but a row with no usable `id` is not a row any of these\n * commands can act on, and passing it through was how a listing came to print\n * `[undefined]` and a lookup came to compare against the string `\"undefined\"`.\n */\nexport function cloudRows<T extends CloudRow>(rows: readonly Record<string, unknown>[] | undefined): T[] {\n    return (rows ?? []).filter((row): row is Record<string, unknown> & T =>\n        typeof row?.id === \"string\" || typeof row?.id === \"number\");\n}\n\n/** {@link cloudRows} for an endpoint that returns a single row. */\nexport function cloudRow<T extends CloudRow>(row: Record<string, unknown> | undefined): T | undefined {\n    return cloudRows<T>(row ? [row] : [])[0];\n}\n\n/**\n * {@link cloudRows} for a write that must have produced a row.\n *\n * `create()` returning something with no usable `id` means the control plane\n * accepted the write and then described it in a way this CLI cannot act on.\n * The callers all go straight on to use that id — `setContextOrg(url,\n * String(created.id))` — so asserting the shape, which is what stood here,\n * turned a control-plane fault into an organization whose active id is the\n * seven-letter string `\"undefined\"`, stored in the user's config file.\n */\nexport function requireCloudRow<T extends CloudRow>(\n    row: Record<string, unknown> | undefined,\n    what: string\n): T {\n    const parsed = cloudRow<T>(row);\n    if (!parsed) throw new Error(`The control plane accepted the ${what} but returned no id for it.`);\n    return parsed;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6DA,IAAM,wBAAwB;;;;;;;;;;;AAY9B,SAAgB,wBAAwB,MAA4C;CAChF,KAAK,IAAI,QAAQ,KAAK,QAAQ,GAAG,GAAG,UAAU,IAAI,QAAQ,KAAK,QAAQ,KAAK,QAAQ,CAAC,GAAG;EACpF,IAAI,QAAQ;EACZ,IAAI,WAAW;EACf,IAAI,UAAU;EACd,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,KAAK;GACtC,MAAM,KAAK,KAAK;GAChB,IAAI,SAAS;IACT,UAAU;IACV;GACJ;GACA,IAAI,OAAO,MAAM;IACb,UAAU;IACV;GACJ;GACA,IAAI,OAAO,MAAK;IACZ,WAAW,CAAC;IACZ;GACJ;GACA,IAAI,UAAU;GACd,IAAI,OAAO,KAAK;QACX,IAAI,OAAO,KAAK;IACjB;IACA,IAAI,UAAU,GAAG;IACjB,MAAM,YAAY,KAAK,MAAM,OAAO,IAAI,CAAC;IACzC,IAAI;IACJ,IAAI;KACA,SAAS,KAAK,MAAM,SAAS;IACjC,QAAQ;KACJ;IACJ;IACA,MAAM,MAAM;IAIZ,IAAI,KAAK,SAAS,YAAa,KAAK,WAAW,aAAa,OAAO,IAAI,SAAS,UAC5E,OAAO;KACH,SAAS,OAAO,IAAI,YAAY,WAAW,IAAI,UAAU,KAAA;KACzD,QAAQ,OAAO,IAAI,WAAW,WAAW,IAAI,SAAS,KAAA;KACtD,MAAM,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO,KAAA;KAChD,SAAU,IAAI,WAA2C,KAAA;IAC7D;IAEJ;GACJ;EACJ;CACJ;AAEJ;;;;;;;;;AAUA,SAAS,mBAAmB,SAAyB;CACjD,MAAM,MAAM,QAAQ,OAChB,kFACJ;CAEA,QADiB,MAAM,IAAI,QAAQ,MAAM,GAAG,GAAG,IAAI,QAAA,CAAS,KACrD,CAAA,CAAQ,QAAQ,aAAa,EAAE;AAC1C;;AAGA,IAAM,cAAc;;;;;;;;;AAUpB,SAAgB,eAAe,OAAgB,SAA+B;CAC1E,MAAM,MAAM;CACZ,MAAM,MAAM,KAAK,WAAW,OAAO,KAAK;CACxC,MAAM,MAAM,wBAAwB,GAAG;CAEvC,IAAI,KAAK;EACL,MAAM,QAAQ,IAAI,SAAS,KAAK,KAAK;EAIrC,KAHkB,IAAI,SAAS,OAAO,IAAI,WAAW,gBACvB,sBAAsB,KAAK,KAAK,GAG1D,OAAO;GAGH,SAAS,GAAG,QAAQ;GACpB,MACI,GAAG,SAAS,KAAK,EAAE;GAIvB,MAAM;GACN,UAAU;GACV;EACJ;EAGJ,OAAO;GACH,SAAS,GAAG,QAAQ,IAAI,SAAS,SAAS,IAAI,UAAU,iCAAiC;GACzF,MAAM,IAAI,OAAO,uBAAuB,IAAI,OAAO,IAAI,SAAS,KAAK,IAAI,OAAO,KAAK,GAAG,KAAK,KAAA;GAC7F,MAAM,IAAI,SAAS,OAAO,IAAI,OAAO,YAAY,MAAM;GACvD,UAAU;GACV;EACJ;CACJ;CAIA,MAAM,UAAU,mBAAmB,GAAG;CACtC,OAAO;EACH,SAAS,GAAG,UAAU,KAAK,SAAS,KAAK,IAAI,OAAO,KAAK,GAAG,IAAI,SAAS,WAAW,GAAG;EACvF,MAAM,KAAK,SAAS,KAAK,SAAS,QAAQ,IAAI,WAAW;EACzD,UAAU;EACV;CACJ;AACJ;AAEA,SAAS,SAAS,MAAsB;CACpC,MAAM,OAAO,KAAK,QAAQ,QAAQ,GAAG,CAAC,CAAC,KAAK;CAC5C,OAAO,KAAK,SAAS,cAAc,GAAG,KAAK,MAAM,GAAG,cAAc,CAAC,EAAE,KAAK;AAC9E;;;;;;;;;;;;;AAcA,SAAgB,cAAc,OAA0B,QAAQ,MAAe;CAC3E,OAAO,KAAK,SAAS,SAAS,KAAK,gBAAgB,QAAQ,IAAI,YAAY,MAAM;AACrF;;;;;;;;;;;;;;;;;;;ACrLA,IAAM,oBAAoB;;AAG1B,IAAM,kBAAkB;;AAGxB,SAAS,kBAA0B;CAC/B,OAAO,KAAK,KAAK,GAAG,QAAQ,GAAG,WAAW,kBAAkB;AAChE;;;;;;;;;;;;AAaA,SAAgB,mBAAmB,KAA2C;CAC1E,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO,KAAA;CACpD,KAAK,MAAM,OAAO;EAAC;EAAoB;EAAsB;CAAgB,GAAG;EAC5E,MAAM,QAAS,IAAgC;EAC/C,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UAAU,OAAO;CACvE;AAEJ;AAEA,SAAgB,gBAAgB,MAAc,QAAQ,IAAI,GAAW;CACjE,MAAM,OAAO,gBAAgB,GAAG,KAAK;CACrC,OAAO,KAAK,KAAK,MAAM,WAAW,YAAY;AAClD;AA0BA,SAAS,kBAAmC;CACxC,IAAI;EACA,MAAM,MAAM,GAAG,aAAa,gBAAgB,GAAG,OAAO;EACtD,MAAM,SAAS,KAAK,MAAM,GAAG;EAC7B,IAAI,CAAC,OAAO,UAAU,OAAO,WAAW,CAAC;EACzC,OAAO;CACX,QAAQ;EACJ,OAAO,EAAE,UAAU,CAAC,EAAE;CAC1B;AACJ;AAEA,SAAS,iBAAiB,MAA6B;CACnD,MAAM,OAAO,gBAAgB;CAC7B,GAAG,UAAU,KAAK,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;CAEpD,GAAG,cAAc,MAAM,KAAK,UAAU,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;CACrE,IAAI;EACA,GAAG,UAAU,MAAM,GAAK;CAC5B,QAAQ,CAER;AACJ;;AAGA,SAAS,oBAAwC;CAC7C,OAAO,gBAAgB,CAAC,CAAC;AAC7B;;AAGA,SAAgB,cAAc,KAAa,KAA+B;CACtE,MAAM,QAAQ,gBAAgB;CAC9B,MAAM,QAAQ,MAAM,SAAS,QAAQ,CAAC;CACtC,IAAI,KAAK,MAAM,MAAM;MAChB,OAAO,MAAM;CAClB,MAAM,SAAS,OAAO;CACtB,iBAAiB,KAAK;AAC1B;AAEA,SAAgB,cAAc,KAAiC;CAC3D,OAAO,gBAAgB,CAAC,CAAC,SAAS,IAAI,EAAE;AAC5C;AAMA,SAAS,sBAAsB,KAA0B;CACrD,OAAO;EACH,QAAQ,KAAK;GACT,IAAI,QAAQ,iBAAiB,OAAO;GACpC,OAAO,gBAAgB,CAAC,CAAC,SAAS,IAAI,EAAE,QAAQ;EACpD;EACA,QAAQ,KAAK,OAAO;GAChB,IAAI,QAAQ,iBAAiB;GAC7B,MAAM,QAAQ,gBAAgB;GAC9B,MAAM,QAAQ,MAAM,SAAS,QAAQ,CAAC;GACtC,MAAM,OAAO;GACb,MAAM,SAAS,OAAO;GACtB,IAAI,CAAC,MAAM,SAAS,MAAM,UAAU;GACpC,iBAAiB,KAAK;EAC1B;EACA,WAAW,KAAK;GACZ,IAAI,QAAQ,iBAAiB;GAC7B,MAAM,QAAQ,gBAAgB;GAC9B,IAAI,MAAM,SAAS,MAAM;IACrB,OAAO,MAAM,SAAS,IAAI,CAAC;IAC3B,OAAO,MAAM,SAAS,IAAI,CAAC;GAC/B;GACA,iBAAiB,KAAK;EAC1B;CACJ;AACJ;;AAGA,SAAgB,kBAAkB,KAAmB;CACjD,MAAM,QAAQ,gBAAgB;CAC9B,MAAM,UAAU;CAChB,IAAI,CAAC,MAAM,SAAS,MAAM,MAAM,SAAS,OAAO,CAAC;CACjD,iBAAiB,KAAK;AAC1B;AAkBA,SAAgB,gBAAgB,SAA2B;CACvD,OAAO,mBAAmB,OAAO,CAAC,CAAC;AACvC;;AAGA,SAAgB,mBAAmB,SAA4D;CAC3F,MAAM,SAAS,IAAI,EAAE,SAAS,OAAO,GAAG;EAAE,MAAM,QAAQ,MAAM,CAAC;EACnE,YAAY;CAAK,CAAC;CACd,IAAI,OAAO,UAAU,OAAO;EAAE,KAAK,aAAa,OAAO,QAAQ;EACnE,QAAQ;CAAO;CACX,IAAI,QAAQ,IAAI,kBAAkB,OAAO;EAAE,KAAK,aAAa,QAAQ,IAAI,gBAAgB;EAC7F,QAAQ;CAAM;CAEV,MAAM,OAAO,SAAS;CAetB,IAAI,MAAM,OAAO,KAAK,SAAS,UAAU,OAAO;EAAE,KAAK,aAAa,KAAK,GAAG;EAChF,QAAQ;CAAO;CAEX,MAAM,UAAU,kBAAkB;CAClC,IAAI,SAAS,OAAO;EAAE,KAAK,aAAa,OAAO;EACnD,QAAQ;CAAU;CAEd,OAAO;EAAE,KAAK;EAClB,QAAQ;CAAU;AAClB;;;;;;;;;AAUA,SAAgB,oBAAoB,KAAsB;CACtD,OAAO,QAAQ,qBAAqB,OAAO,OAAO,gBAAgB,CAAC,CAAC,UAAU,GAAG;AACrF;;;;;;;;;;;;;AAcA,SAAgB,iBAAiB,SAAyB;CACtD,MAAM,OAAO,SAAS;CACtB,IAAI,MAAM,SAAS,UAAU;CAE7B,MAAM,SAAS,IACX;EAAE,aAAa;EACvB,MAAM;EACN,SAAS;CAAO,GACR;EAAE,MAAM,QAAQ,MAAM,CAAC;EAC/B,YAAY;CAAK,CACb;CACA,IAAI,OAAO,gBAAgB,OAAO,UAAU;CAE5C,KACI,wCAAwC,MAAM,KAAK,KAAK,GAAG,EAAE,KACxD,MAAM,KAAK,qBAAqB,EAAE,kBAAkB,MAAM,KAAK,WAAW,EAAE,IACjF,2GACA,aACJ;AACJ;AAEA,SAAS,aAAa,KAAqB;CACvC,IAAI,IAAI,IAAI,KAAK,CAAC,CAAC,QAAQ,QAAQ,EAAE;CACrC,IAAI,CAAC,eAAe,KAAK,CAAC,GAAG,IAAI,WAAW;CAC5C,OAAO;AACX;;;;;;;AAcA,SAAgB,kBAAkB,KAA0B;CACxD,OAAO,mBAAmB;EACtB,SAAS;EAeT,UAAU;EAMV,SAAS,EAAE,cAAc,aAAa,EAAE;EACxC,MAAM;GACF,SAAS,sBAAsB,GAAG;GAClC,gBAAgB;GAChB,aAAa;EACjB;CACJ,CAAC;AACL;;;;;;AAOA,IAAa,YAAY;;AAGzB,SAAgB,WAA+B;CAC3C,MAAM,QAAQ,QAAQ,IAAI,UAAU,EAAE,KAAK;CAC3C,OAAO,QAAQ,QAAQ,KAAA;AAC3B;;AAGA,IAAM,gCAAgB,IAAI,QAAwB;;;;;;;;;;AAWlD,SAAgB,kBAAkB,KAAa,OAA4B;CACvE,MAAM,SAAS,mBAAmB;EAC9B,SAAS;EACT,UAAU;EACV,SAAS,EAAE,cAAc,aAAa,EAAE;EACxC;EACA,MAAM;GACF,SAAS,oBAAoB;GAC7B,gBAAgB;GAChB,aAAa;EACjB;CACJ,CAAC;CACD,OAAO,wBAAwB,oBAAoB,KAAK,KAAK,CAAC;CAC9D,cAAc,IAAI,QAAQ,KAAK;CAC/B,OAAO;AACX;;;;;;;;;;;;AAaA,eAAe,oBAAoB,KAAa,OAA+B;CAC3E,IAAI,gBAAgB;CACpB,IAAI;EAIA,iBAAgB,MAHI,MAAM,GAAG,IAAI,mBAAmB,EAChD,SAAS;GAAE,eAAe,UAAU;GAAS,cAAc,aAAa;EAAE,EAC9E,CAAC,EAAA,CACqB;CAC1B,QAAQ,CAER;CACA,IAAI,eACA,KACI,+CAA+C,UAAU,oBACzD,SAAS,UAAU,WAAW,MAAM,KAAK,oBAAoB,EAAE,cAC/D,kBACJ;CAEJ,KACI,GAAG,UAAU,mBAAmB,IAAI,2EACpC,yBAAyB,MAAM,KAAK,4BAA4B,EAAE,iBAAiB,UAAU,IAC7F,gBACJ;AACJ;;AAGA,IAAM,mBAAmB;;;;;;;;;;;;;;;AAwBzB,eAAsB,iBAAiB,QAAwC;CAC3E,MAAM,QAAQ,cAAc,IAAI,MAAM;CACtC,IAAI,OAAO,OAAO;CAClB,MAAM,UAAU,OAAO,KAAK,WAAW;CACvC,IAAI,SAAS,eAAe,QAAQ,YAAY,KAAK,IAAI,IAAI,kBAAkB,OAAO,QAAQ;CAC9F,QAAQ,MAAM,OAAO,KAAK,eAAe,EAAA,CAAG;AAChD;;;;;;;;AASA,eAAsB,cAAc,SAAkE;CAClG,MAAM,QAAQ,SAAS;CACvB,IAAI,CAAC,OAAO,OAAO,qBAAqB,OAAO;CAI/C,iBAAiB,OAAO;CACxB,MAAM,MAAM,gBAAgB,OAAO;CACnC,OAAO;EAAE,QAAQ,kBAAkB,KAAK,KAAK;EAAG;CAAI;AACxD;;;;;;;;;;;AAYA,eAAsB,qBAAqB,SAAkE;CAIzG,iBAAiB,OAAO;CACxB,MAAM,MAAM,gBAAgB,OAAO;CACnC,MAAM,SAAS,kBAAkB,GAAG;CACpC,MAAM,UAAU,OAAO,KAAK,WAAW;CAEvC,IAAI,CAAC,WAAW,CAAC,QAAQ,aAAa;EAClC,IAAI,SAAS,GACT,KACI,8CAA8C,MAAM,KAAK,GAAG,EAAE,QAAQ,UAAU,oBAChF,qCAAqC,MAAM,KAAK,oBAAoB,EAAE,UACtE,kBACJ;EAEJ,KACI,oBAAoB,MAAM,KAAK,GAAG,EAAE,IACpC,OAAO,MAAM,KAAK,oBAAoB,EAAE,UACxC,eACJ;CACJ;CAEA,IAAI,QAAQ,aAAa,KAAK,IAAI,IAAI,kBAClC,IAAI;EACA,MAAM,OAAO,KAAK,eAAe;CACrC,QAAQ;EACJ,KACI,oBAAoB,MAAM,KAAK,GAAG,EAAE,gBACpC,OAAO,MAAM,KAAK,oBAAoB,EAAE,qBAIxC,iBACJ;CACJ;CAGJ,OAAO;EAAE;EACb;CAAI;AACJ;;;;;;;;;;;;;;;;;;;;AAuCA,IAAM,sCAAsB,IAAI,IAAiD;AAEjF,SAAgB,oBAAoB,QAAqB,KAAkD;CACvG,IAAI,UAAU,oBAAoB,IAAI,GAAG;CACzC,IAAI,CAAC,SAAS;EACV,UAAU,OAAO,UACZ,OAAuB,mBAAmB,KAAA,GAAW,EAAE,QAAQ,MAAM,CAAC,CAAC,CACvE,MAAM,QAAQ,OAAO,KAAA,CAAS,CAAC,CAC/B,YAAY,KAAA,CAAS;EAC1B,oBAAoB,IAAI,KAAK,OAAO;CACxC;CACA,OAAO;AACX;;;;;;AAOA,SAAgB,sBAAsB,QAAqB,KAA0C;CACjG,OAAO,oBAAoB,QAAQ,GAAG,CAAC,CAAC,MAAM,QAAQ,KAAK,kBAAkB,KAAK,KAAK,KAAA,CAAS;AACpG;;;;;;;AAQA,SAAgB,mBAAmB,QAAqB,KAAkD;CACtG,OAAO,oBAAoB,QAAQ,GAAG,CAAC,CAAC,MAAM,QAC1C,MAAM,QAAQ,KAAK,aAAa,IAAI,IAAI,gBAAgB,KAAA,CAC5D;AACJ;;;;;;;;;;AAWA,SAAgB,iBACZ,WACA,YACkB;CAClB,IAAI,CAAC,WAAW,OAAO,KAAA;CACvB,OAAO,aAAa,GAAG,UAAU,GAAG,eAAe;AACvD;;;;;;;;;;;;;;AAsBA,SAAgB,YACZ,SACA,YACkB;CAClB,OAAO,QAAQ,QAAQ,iBAAiB,QAAQ,WAAW,UAAU;AACzE;AAiCA,SAAgB,SAAS,MAAc,QAAQ,IAAI,GAAuB;CACtE,IAAI;EACA,OAAO,KAAK,MAAM,GAAG,aAAa,gBAAgB,GAAG,GAAG,OAAO,CAAC;CACpE,QAAQ;EACJ,OAAO;CACX;AACJ;AAEA,SAAgB,UAAU,MAAmB,MAAc,QAAQ,IAAI,GAAS;CAC5E,MAAM,OAAO,gBAAgB,GAAG;CAChC,GAAG,UAAU,KAAK,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;CACpD,GAAG,cAAc,MAAM,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AACxD;AAEA,SAAgB,WAAW,MAAc,QAAQ,IAAI,GAAY;CAC7D,MAAM,OAAO,gBAAgB,GAAG;CAChC,IAAI,GAAG,WAAW,IAAI,GAAG;EACrB,GAAG,OAAO,IAAI;EACd,OAAO;CACX;CACA,OAAO;AACX;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,IAAa,qBAAqB;CAC9B,UAAU;CACV,SAAS;CACT,UAAU;CACV,aAAa;CAKb,SAAS;CACT,MAAM;CACN,MAAM;CACN,MAAM;AACV;AAEA,IAAM,UAAU;;;;;;;AAQhB,SAAgB,kBAAkB,SAA2B;CACzD,MAAM,SAAS,IAAI;EAAE,aAAa;EACtC,MAAM;CAAY,GAAG;EAAE,MAAM,QAAQ,MAAM,CAAC;EAC5C,YAAY;CAAK,CAAC;CACd,IAAI,OAAO,cAAc,OAAO,OAAO;CACvC,MAAM,OAAO,SAAS;CACtB,IAAI,MAAM,WAAW,OAAO,KAAK;CACjC,KACI,0DACA,QAAQ,MAAM,KAAK,kBAAkB,EAAE,UAAU,MAAM,KAAK,mBAAmB,EAAE,IACjF,YACJ;AACJ;;;;;;;AAQA,eAAsB,gBAAgB,KAAa,QAAkD;CACjG,IAAI,QAAQ,KAAK,GAAG,GAAG,OAAO;CAK9B,MAAM,OAAM,MAJM,OAAO,KAAK,WAAW,UAAU,CAAC,CAAC,KAAK;EACtD,OAAO,EAAE,WAAW,CAAC,MAAM,GAAG,EAAE;EAChC,OAAO;CACX,CAAC,EAAA,CACe,KAAK;CACrB,OAAO,KAAK,OAAO,KAAA,IAAY,KAAA,IAAY,OAAO,IAAI,EAAE;AAC5D;;AAGA,eAAsB,kBAAkB,KAAa,QAAsC;CACvF,MAAM,KAAK,MAAM,gBAAgB,KAAK,MAAM;CAC5C,IAAI,OAAO,KAAA,GACP,KACI,wBAAwB,MAAM,KAAK,GAAG,EAAE,IACxC,mBAAmB,MAAM,KAAK,uBAAuB,EAAE,IACvD,mBACJ;CAEJ,OAAO;AACX;;AAGA,eAAsB,eAAe,SAAmB,QAAsC;CAC1F,OAAO,kBAAkB,kBAAkB,OAAO,GAAG,MAAM;AAC/D;;;;;;AAOA,SAAgB,kBAAkB,SAA2B;CACzD,MAAM,SAAS,IAAI;EAAE,aAAa;EACtC,MAAM;CAAY,GAAG;EAAE,MAAM,QAAQ,MAAM,CAAC;EAC5C,YAAY;CAAK,CAAC;CACd,IAAI,OAAO,cAAc,OAAO,OAAO;CACvC,MAAM,OAAO,SAAS;CACtB,OAAO,MAAM,QAAQ,MAAM,aAAa;AAC5C;AA2CA,IAAI,YAAY;;;;;;AAOhB,SAAgB,eAAe,SAA4B;CAUvD,IATe,IAAI,EAAE,UAAU,QAAQ,GAAG;EAAE,MAAM,QAAQ,MAAM,CAAC;EACrE,YAAY;CAAK,CAQT,CAAA,CAAO,WAAW,YAAY;MAC7B,YAAY,gBAAgB,QAAQ,IAAI,WAAW,KAAK,QAAQ,OAAO,UAAU;CACtF,OAAO;AACX;;AAGA,SAAgB,aAAsB;CAClC,OAAO;AACX;;AASA,IAAM,UAAU;AAChB,SAAS,UAAU,GAAmB;CAClC,OAAO,EAAE,QAAQ,SAAS,EAAE;AAChC;;;;;;;;;;AAWA,SAAgB,UAAU,OAAsB;CAC5C,QAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,MAAM,CAAC,IAAI,IAAI;AAC9D;;;;;;AAOA,SAAgB,KAAQ,OAAmB,MAAwB;CAC/D,IAAI,WAAW,UAAU,IAAI;MACxB,MAAM;AACf;;;;;;;;;;;;;;;;AAiCA,SAAgB,SACZ,SACA,SACA,OACA,QAAiC,CAAC,GAC9B;CACJ,KAAK,OAAO;EAAE;EAClB,SAAS,QAAQ,KAAI,UAAS,eAAe,OAAO,OAAO,CAAC;EAC5D,GAAG;CAAM,CAAC;AACV;;;;;;;;;AAqDA,SAAS,eAAe,OAA4B,SAA0C;CAC1F,IAAI,OAAO,UAAU,UAAU,OAAO;EAAE,QAAQ;EACpD,aAAa;EACb,OAAO,CAAC;CAAE;CACN,OAAO;EACH,QAAQ,MAAM;EACd,OAAO,UAAU,QAAQ,GAAG,MAAM,SAAS,MAAM,OAAO,IAAI,MAAM,SAAS;EAC3E,aAAa,MAAM;EACnB,QAAQ,MAAM,SAAS,CAAC,EAAA,CAAG,KAAK,CAAC,MAAM,kBAAkB;GAAE;GACnE;EAAY,EAAE;CACV;AACJ;;;;;;;AAQA,IAAa,oBAA6C;CACtD,CAAC,wBAAwB,qDAAqD;CAC9E,CAAC,UAAU,6DAA6D;CACxE,CAAC,kBAAkB,uDAAuD;CAC1E,CAAC,aAAa,2BAA2B;CACzC,CAAC,WAAW,gDAAgD;AAChE;AAUwC,CAAC,GAAG,OAAO,KAAK,kBAAkB,CAAY;;AAGtF,IAAM,cAAc;;;;;;;AAQpB,SAAS,IAAI,MAAc,OAAuB;CAC9C,OAAO,IAAI,OAAO,KAAK,IAAI,GAAG,QAAQ,KAAK,MAAM,CAAC;AACtD;;;;AAKA,SAAgB,eAAe,MAAuB;CAClD,SACI,KAAK,SACL,KAAK,eACC;EACF,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,GAAG,MAAM,KAAK,UAAU,KAAK,SAAS,EAAE,KAAK,KAAK,OAAO;EACrE,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,MAAM,MAAM,KAAK,OAAO,CAAC;EACrC,QAAQ,IAAI,YAAY,KAAK,QAAQ,GAAG,MAAM,KAAK,UAAU,EAAE,WAAW;EAE1E,IAAI;EACJ,KAAK,MAAM,SAAS,KAAK,SAAS;GAC9B,MAAM,UAAU,MAAM,WAAW;GACjC,IAAI,YAAY,SAAS;IACrB,UAAU;IACV,QAAQ,IAAI,EAAE;IACd,QAAQ,IAAI,MAAM,MAAM,KAAK,OAAO,CAAC;GACzC;GACA,MAAM,OAAO,GAAG,MAAM,SAAS,MAAM,OAAO,IAAI,MAAM,SAAS;GAC/D,QAAQ,IACJ,KAAK,MAAM,KAAK,KAAK,MAAM,MAAM,IAAI,MAAM,OAAO,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAC5E,IAAI,MAAM,WAAW,IAAI,MAAM,aACxC;GACA,KAAK,MAAM,CAAC,MAAM,gBAAgB,MAAM,SAAS,CAAC,GAC9C,QAAQ,IAAI,SAAS,MAAM,KAAK,IAAI,IAAI,IAAI,MAAM,cAAc,CAAC,IAAI,MAAM,KAAK,WAAW,GAAG;EAEtG;EAEA,IAAI,KAAK,SAAS,QAAQ;GACtB,QAAQ,IAAI,EAAE;GACd,QAAQ,IAAI,MAAM,MAAM,KAAK,SAAS,CAAC;GACvC,KAAK,MAAM,CAAC,MAAM,gBAAgB,KAAK,SACnC,QAAQ,IAAI,KAAK,MAAM,KAAK,IAAI,IAAI,IAAI,MAAM,WAAW,IAAI,aAAa;EAElF;EAEA,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,MAAM,MAAM,KAAK,gBAAgB,CAAC;EAC9C,KAAK,MAAM,CAAC,MAAM,gBAAgB,mBAC9B,QAAQ,IAAI,KAAK,MAAM,KAAK,IAAI,IAAI,IAAI,MAAM,WAAW,IAAI,MAAM,KAAK,WAAW,GAAG;EAG1F,IAAI,KAAK,OAAO,QAAQ;GACpB,QAAQ,IAAI,EAAE;GACd,KAAK,MAAM,QAAQ,KAAK,OAAO,QAAQ,IAAI,MAAM,KAAK,KAAK,MAAM,CAAC;EACtE;EACA,QAAQ,IAAI,EAAE;CAClB,GACA;EACI,OAAO,UAAU,KAAK,QAAQ;EAC9B,SAAS,KAAK;EACd,UAAU,KAAK,WAAW,CAAC,EAAA,CAAG,KAAK,CAAC,MAAM,kBAAkB;GAAE;GAC1E;EAAY,EAAE;EACF,aAAa,kBAAkB,KAAK,CAAC,MAAM,kBAAkB;GAAE;GAC3E;EAAY,EAAE;EACF,OAAO,KAAK,SAAS,CAAC;CAC1B,CACJ;AACJ;;;;;;;;;;;;;;;;;;;;AAyBA,SAAgB,KAAK,SAAiB,MAAqB;CACvD,IAAI,WAAW;EACX,QAAQ,OAAO,MAAM,YAAY,UAAU,OAAO,EAAE,GAAG;EACvD,IAAI,MAAM,QAAQ,OAAO,MAAM,KAAK,UAAU,IAAI,EAAE,GAAG;EACvD;CACJ;CACA,QAAQ,MAAM,EAAE;CAChB,QAAQ,MAAM,MAAM,OAAO,OAAO,SAAS,CAAC;CAC5C,IAAI,MAAM,QAAQ,MAAM,MAAM,KAAK,OAAO,MAAM,CAAC;AACrD;;;;;;;;;;;;;;;;;AAkBA,SAAgB,KAAK,SAAiB,MAAe,MAAsB;CACvE,IAAI,WAAW;EACX,UAAU,EAAE,OAAO;GAAE,SAAS,UAAU,OAAO;GACvD,MAAM,QAAQ;GACd,MAAM,OAAO,UAAU,IAAI,IAAI,KAAA;EAAU,EAAE,CAAC;EACpC,QAAQ,KAAK,CAAC;CAClB;CACA,QAAQ,MAAM,EAAE;CAChB,QAAQ,MAAM,MAAM,IAAI,OAAO,SAAS,CAAC;CACzC,IAAI,MAAM,QAAQ,MAAM,MAAM,KAAK,KAAK,MAAM,CAAC;CAC/C,QAAQ,MAAM,EAAE;CAChB,QAAQ,KAAK,CAAC;AAClB;;;;;;;;;AAUA,eAAsB,mBAAmB,MAAuD;CAC5F,IAAI,KAAK,KAAK;CACd,IAAI,aAAa,QAAQ,MAAM,UAAU,MACrC,KACI,sDACA,eAAe,MAAM,KAAK,OAAO,EAAE,eACnC,uBACJ;CAEJ,MAAM,EAAE,cAAe,MAAM,SAAS,OAAO,CACzC;EAAE,MAAM;EAChB,MAAM;EACN,SAAS;EACT,SAAS,KAAK;CAAO,CACjB,CAA0C;CAC1C,IAAI,CAAC,WAAW;EAIZ,QAAQ,MAAM,MAAM,KAAK,YAAY,CAAC;EACtC,QAAQ,KAAK,CAAC;CAClB;AACJ;;;;;;;;;;;;;;;AAgBA,SAAgB,mBAAmB,MAAc,OAAqB;CAClE,IAAI,aAAa,QAAQ,MAAM,UAAU,MACrC,KACI,sBAAsB,KAAK,wCAC3B,QAAQ,MAAM,KAAK,KAAK,EAAE,IAC1B,gBACJ;AAER;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,SAAgB,eAAmC,MAO6B;CAC5E,MAAM,OAAO;EAAE,GAAG;EACtB,GAAG,KAAK;CAAK;CACT,IAAI;EACA,MAAM,SAAS,iBAAiB;GAAE,GAAG;GAC7C;EAAK,CAAC;EACE,OAAO;GAAE,OAAO,OAAO;GAC/B,aAAa,OAAO;EAAY;CAC5B,SAAS,KAAK;EACV,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAAG,KAAA,GAAW,OAAO;CAC7E;AACJ;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,mBACZ,OACA,QACA,OACI;CACJ,IAAI,WAAW,KAAA,KAAa,MAAM,SAAS,MAAM,GAAG;CACpD,KACI,WAAW,MAAM,YAAY,UAC7B,sBAAsB,MAAM,sBAAsB,MAAM,KAAK,IAAI,EAAE,IACnE,iBACJ;AACJ;;;;;;;;;;;;;AAcA,SAAgB,iBACZ,OACA,MACM;CACN,IAAI,UAAU,KAAA,GAAW,OAAO,KAAK;CACrC,MAAM,UAAU,OAAO,KAAK;CAC5B,IAAI,CAAC,OAAO,SAAS,OAAO,KAAK,WAAW,GACxC,KACI,6CAA6C,MAAM,MACnD,gBAAgB,KAAK,QAAQ,aAC7B,OACJ;CAEJ,OAAO,UAAU;AACrB;;;;;;;;;;;;;AAcA,SAAgB,QAAQ,SAAuB;CAC3C,IAAI,WAAW;EACX,QAAQ,OAAO,MAAM,GAAG,UAAU,OAAO,EAAE,GAAG;EAC9C;CACJ;CACA,QAAQ,MAAM,EAAE;CAChB,QAAQ,MAAM,MAAM,KAAK,MAAM,OAAO,SAAS,CAAC;CAChD,QAAQ,MAAM,EAAE;AACpB;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,KAAK,SAAiB,SAAS,MAAY;CACvD,IAAI,WAAW;CACf,QAAQ,MAAM,GAAG,SAAS,SAAS;AACvC;;AAGA,SAAgB,YAAkB;CAC9B,IAAI,WAAW;CACf,QAAQ,MAAM,EAAE;AACpB;;AAGA,SAAgB,YAAY,QAAoC;CAC5D,QAAQ,QAAR;EACI,KAAK;EACL,KAAK;EACL,KAAK,aACD,OAAO,MAAM,MAAM,MAAM;EAC7B,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,YACD,OAAO,MAAM,OAAO,UAAU,EAAE;EACpC,KAAK,UACD,OAAO,MAAM,IAAI,MAAM;EAC3B,KAAK,WACD,OAAO,MAAM,KAAK,MAAM;EAC5B,SACI,OAAO,MAAM,KAAK,UAAU,SAAS;CAC7C;AACJ;;;;;;AAOA,SAAgB,UAAU,MAAwD;CAC9E,MAAM,QAAQ,KAAK,IAAI,GAAG,KAAK,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;CACrD,KAAK,MAAM,CAAC,GAAG,MAAM,MAAM;EACvB,IAAI,MAAM,KAAA,KAAa,MAAM,QAAQ,MAAM,IAAI;EAC/C,QAAQ,IAAI,KAAK,MAAM,KAAK,GAAG,EAAE,GAAG,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,GAAG;CACjE;AACJ;;;;;;;;;;;AAYA,SAAgB,YAAY,GAAY,SAAwB;CAC5D,MAAM,MAAM;CACZ,MAAM,UAAU,eAAe,GAAG,OAAO;CAEzC,IAAI,cAAc,GACd,QAAQ,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK;CAG/C,IAAI,WAAW;EACX,UAAU,EACN,OAAO;GACH,SAAS,UAAU,QAAQ,OAAO;GAOlC,MAAM,QAAQ;GACd,QAAQ,KAAK,UAAU;GACvB,MAAM,QAAQ,OAAO,UAAU,QAAQ,IAAI,IAAI,KAAA;GAC/C,UAAU,QAAQ;GAClB;EACJ,EACJ,CAAC;EACD,QAAQ,KAAK,CAAC;CAClB;CACA,KAAK,QAAQ,SAAS,QAAQ,MAAM,QAAQ,IAAI;AACpD;;;;;;;;;;AAWA,SAAgB,QAAQ,QAAgB,QAAQ,WAAiB;CAC7D,UAAU;CACV,KAAK,GAAG,MAAM,GAAG,MAAM,KAAK,MAAM,GAAG;CACrC,UAAU;CACV,MAAM,SACF,QAAQ,aAAa,WAAW,SAAS,QAAQ,aAAa,UAAU,UAAU;CACtF,IAAI;EACA,MAAM,QAAQ,MAAM,QAAQ,CAAC,MAAM,GAAG;GAClC,OAAO;GACP,UAAU;GACV,OAAO,QAAQ,aAAa;EAChC,CAAC;EACD,MAAM,GAAG,eAAe,CAExB,CAAC;EACD,MAAM,MAAM;CAChB,QAAQ,CAER;AACJ;;;;;;;;;;;;;;;;;;AAgCA,SAAgB,UAA8B,MAA2D;CACrG,QAAQ,QAAQ,CAAC,EAAA,CAAG,QAAQ,QACxB,OAAO,KAAK,OAAO,YAAY,OAAO,KAAK,OAAO,QAAQ;AAClE;;AAGA,SAAgB,SAA6B,KAAyD;CAClG,OAAO,UAAa,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;AAC1C;;;;;;;;;;;AAYA,SAAgB,gBACZ,KACA,MACC;CACD,MAAM,SAAS,SAAY,GAAG;CAC9B,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,kCAAkC,KAAK,4BAA4B;CAChG,OAAO;AACX"}