@runcofactor/cli 0.10.0

package/dist/attachment-SJC7D7FY.js

@@ -0,0 +1,276 @@
+import { createRequire as __cr } from "module"; const require = __cr(import.meta.url);
+import {
+  apiRequest
+} from "./chunk-WOHL4FTB.js";
+import "./chunk-SJJW77WN.js";
+import "./chunk-3CZU7XCS.js";
+import {
+  getArgValue,
+  hasFlag,
+  resolveConfig
+} from "./chunk-A4OFTUVV.js";
+import "./chunk-JWHYXEA2.js";
+import "./chunk-VKVL7WBN.js";
+
+// src/attachment.ts
+import fs from "fs/promises";
+import path from "path";
+import process from "process";
+var VALID_KINDS = ["all", "image", "pdf", "spreadsheet", "data"];
+function printAttachmentHelp() {
+  console.log(
+    [
+      "Usage: canary attachment <sub-command> [options]",
+      "",
+      "Sub-commands:",
+      "  list [options]                   List uploaded attachments",
+      "  upload <file> [options]          Upload a local file; prints the new ID",
+      "  get <id> [--url]                 Print attachment metadata (or signed URL)",
+      "  delete <id>                      Soft-delete an attachment",
+      "",
+      "List options:",
+      "  --kind <kind>        Filter: all, image, pdf, spreadsheet, data (default: all)",
+      "  --search <query>     Search by filename",
+      "  --page <n>           Page number (default: 1)",
+      "  --page-size <n>      Page size (default: 25)",
+      "  --json               Output raw JSON",
+      "",
+      "Upload options:",
+      "  --filename <name>    Override filename (default: basename of file)",
+      "  --json               Output raw JSON",
+      "",
+      "Get options:",
+      "  --url                Print short-lived signed download URL",
+      "  --json               Output raw JSON",
+      "",
+      "Tip: use the returned ID in a node's `configJson.attachmentIds` array",
+      "for action or notification nodes when creating/patching workflows.",
+      "",
+      "Common options:",
+      "  --env <env>          Target environment (prod, dev, local)",
+      "  --api-url <url>      API URL override",
+      "  --token <key>        API token override"
+    ].join("\n")
+  );
+}
+function formatSize(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+function truncate(s, max) {
+  return s.length <= max ? s : s.slice(0, max - 1) + "\u2026";
+}
+async function handleList(argv, apiUrl, token) {
+  const kind = getArgValue(argv, "--kind");
+  const search = getArgValue(argv, "--search");
+  const page = getArgValue(argv, "--page");
+  const pageSize = getArgValue(argv, "--page-size");
+  const jsonOutput = hasFlag(argv, "--json");
+  if (kind && !VALID_KINDS.includes(kind)) {
+    console.error(`Error: invalid --kind "${kind}". Must be one of: ${VALID_KINDS.join(", ")}`);
+    process.exit(1);
+  }
+  const params = new URLSearchParams();
+  if (kind) params.set("kind", kind);
+  if (search) params.set("search", search);
+  if (page) params.set("page", page);
+  if (pageSize) params.set("pageSize", pageSize);
+  const qs = params.toString();
+  const route = `/org/attachments${qs ? `?${qs}` : ""}`;
+  const result = await apiRequest(apiUrl, token, "GET", route);
+  if (!result.ok) {
+    console.error(`Error: ${result.error}`);
+    process.exit(1);
+  }
+  if (jsonOutput) {
+    console.log(JSON.stringify({ data: result.data, pagination: result.pagination }, null, 2));
+    return;
+  }
+  const { data, pagination } = result;
+  console.log(
+    `Attachments: ${pagination.totalItems} total (page ${pagination.page}/${pagination.totalPages})
+`
+  );
+  if (data.length === 0) {
+    console.log("No attachments found.");
+    return;
+  }
+  const idW = 36;
+  const nameW = 40;
+  const typeW = 24;
+  const sizeW = 10;
+  console.log(
+    ["ID".padEnd(idW), "Filename".padEnd(nameW), "Type".padEnd(typeW), "Size".padEnd(sizeW)].join(
+      "  "
+    )
+  );
+  for (const a of data) {
+    console.log(
+      [
+        a.id.padEnd(idW),
+        truncate(a.filename, nameW).padEnd(nameW),
+        truncate(a.contentType, typeW).padEnd(typeW),
+        formatSize(a.sizeBytes).padEnd(sizeW)
+      ].join("  ")
+    );
+  }
+}
+async function handleUpload(argv, apiUrl, token) {
+  const filePath = argv.find((a) => !a.startsWith("-"));
+  if (!filePath) {
+    console.error("Error: missing file path.");
+    console.error("Usage: canary attachment upload <file> [--filename <name>]");
+    process.exit(1);
+  }
+  const overrideName = getArgValue(argv, "--filename");
+  const jsonOutput = hasFlag(argv, "--json");
+  let buf;
+  try {
+    buf = await fs.readFile(filePath);
+  } catch (err) {
+    console.error(`Error: failed to read ${filePath}: ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+  }
+  const filename = overrideName ?? path.basename(filePath);
+  const form = new FormData();
+  form.append("files", new Blob([new Uint8Array(buf)]), filename);
+  const res = await fetch(`${apiUrl}/org/attachments`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}` },
+    body: form
+  });
+  if (res.status === 401) {
+    console.error("Error: Unauthorized. Run: canary login");
+    process.exit(1);
+  }
+  let body;
+  try {
+    body = await res.json();
+  } catch {
+    console.error(`Error: invalid JSON response (${res.status})`);
+    process.exit(1);
+  }
+  if (!body.ok || !body.data || body.data.length === 0) {
+    console.error(`Error: ${body.error ?? `upload failed (${res.status})`}`);
+    process.exit(1);
+  }
+  const [created] = body.data;
+  if (jsonOutput) {
+    console.log(JSON.stringify(created, null, 2));
+    return;
+  }
+  console.log(`\u2713 Uploaded ${created.filename}`);
+  console.log(`  ID: ${created.id}`);
+  console.log(`  Type: ${created.contentType}`);
+  console.log(`  Size: ${formatSize(created.sizeBytes)}`);
+  console.log("");
+  console.log("Reference in a workflow node:");
+  console.log(`  configJson.attachmentIds = ["${created.id}"]`);
+}
+async function handleGet(argv, apiUrl, token) {
+  const id = argv.find((a) => !a.startsWith("-"));
+  if (!id) {
+    console.error("Error: missing attachment ID.");
+    console.error("Usage: canary attachment get <id> [--url]");
+    process.exit(1);
+  }
+  const wantUrl = hasFlag(argv, "--url");
+  const jsonOutput = hasFlag(argv, "--json");
+  if (wantUrl) {
+    const result = await apiRequest(
+      apiUrl,
+      token,
+      "GET",
+      `/org/attachments/${id}/url`
+    );
+    if (!result.ok || !result.url) {
+      console.error(`Error: ${result.error ?? "failed to fetch signed URL"}`);
+      process.exit(1);
+    }
+    if (jsonOutput) {
+      console.log(JSON.stringify({ id, url: result.url }, null, 2));
+    } else {
+      console.log(result.url);
+    }
+    return;
+  }
+  const res = await fetch(`${apiUrl}/org/attachments/resolve`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+    body: JSON.stringify({ ids: [id] })
+  });
+  if (res.status === 401) {
+    console.error("Error: Unauthorized. Run: canary login");
+    process.exit(1);
+  }
+  const body = await res.json();
+  if (!body.ok || !body.data || body.data.length === 0) {
+    console.error(`Error: ${body.error ?? "attachment not found"}`);
+    process.exit(1);
+  }
+  const [att] = body.data;
+  if (jsonOutput) {
+    console.log(JSON.stringify(att, null, 2));
+    return;
+  }
+  console.log(`${att.filename}`);
+  console.log(`  ID: ${att.id}`);
+  console.log(`  Type: ${att.contentType}`);
+  console.log(`  Size: ${formatSize(att.sizeBytes)}`);
+  console.log(`  Created: ${att.createdAt}`);
+}
+async function handleDelete(argv, apiUrl, token) {
+  const id = argv.find((a) => !a.startsWith("-"));
+  if (!id) {
+    console.error("Error: missing attachment ID.");
+    console.error("Usage: canary attachment delete <id>");
+    process.exit(1);
+  }
+  const jsonOutput = hasFlag(argv, "--json");
+  const result = await apiRequest(
+    apiUrl,
+    token,
+    "DELETE",
+    `/org/attachments/${id}`
+  );
+  if (!result.ok) {
+    console.error(`Error: ${result.error ?? "delete failed"}`);
+    process.exit(1);
+  }
+  if (jsonOutput) {
+    console.log(JSON.stringify({ ok: true, id }, null, 2));
+    return;
+  }
+  console.log(`\u2713 Deleted attachment ${id}`);
+}
+async function runAttachment(argv) {
+  const [subCommand, ...rest] = argv;
+  if (!subCommand || subCommand === "help" || hasFlag(argv, "--help", "-h")) {
+    printAttachmentHelp();
+    return;
+  }
+  const { apiUrl, token } = await resolveConfig(rest);
+  switch (subCommand) {
+    case "list":
+      await handleList(rest, apiUrl, token);
+      return;
+    case "upload":
+      await handleUpload(rest, apiUrl, token);
+      return;
+    case "get":
+      await handleGet(rest, apiUrl, token);
+      return;
+    case "delete":
+      await handleDelete(rest, apiUrl, token);
+      return;
+    default:
+      console.error(`Unknown attachment sub-command: ${subCommand}`);
+      printAttachmentHelp();
+      process.exit(1);
+  }
+}
+export {
+  runAttachment
+};
+//# sourceMappingURL=attachment-SJC7D7FY.js.map

package/dist/attachment-SJC7D7FY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/attachment.ts"],"sourcesContent":["/**\n * CLI Attachment Commands\n *\n * List, upload, fetch, and delete org-scoped attachments used by action\n * and notification nodes (config.attachmentIds).\n *\n * @module attachment\n */\n\nimport fs from 'node:fs/promises';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { resolveConfig, getArgValue, hasFlag } from './auth.js';\nimport { apiRequest } from './cli-helpers.js';\n\ntype AttachmentListItem = {\n  id: string;\n  filename: string;\n  contentType: string;\n  sizeBytes: number;\n  createdAt: string;\n  createdBy: string | null;\n};\n\ntype ListResponse = {\n  ok: boolean;\n  error?: string;\n  data: AttachmentListItem[];\n  pagination: { page: number; pageSize: number; totalItems: number; totalPages: number };\n};\n\ntype UploadResponse = {\n  ok: boolean;\n  error?: string;\n  data?: AttachmentListItem[];\n};\n\ntype UrlResponse = { ok: boolean; error?: string; url?: string };\n\nconst VALID_KINDS = ['all', 'image', 'pdf', 'spreadsheet', 'data'] as const;\n\nfunction printAttachmentHelp(): void {\n  console.log(\n    [\n      'Usage: canary attachment <sub-command> [options]',\n      '',\n      'Sub-commands:',\n      '  list [options]                   List uploaded attachments',\n      '  upload <file> [options]          Upload a local file; prints the new ID',\n      '  get <id> [--url]                 Print attachment metadata (or signed URL)',\n      '  delete <id>                      Soft-delete an attachment',\n      '',\n      'List options:',\n      '  --kind <kind>        Filter: all, image, pdf, spreadsheet, data (default: all)',\n      '  --search <query>     Search by filename',\n      '  --page <n>           Page number (default: 1)',\n      '  --page-size <n>      Page size (default: 25)',\n      '  --json               Output raw JSON',\n      '',\n      'Upload options:',\n      '  --filename <name>    Override filename (default: basename of file)',\n      '  --json               Output raw JSON',\n      '',\n      'Get options:',\n      '  --url                Print short-lived signed download URL',\n      '  --json               Output raw JSON',\n      '',\n      'Tip: use the returned ID in a node\\'s `configJson.attachmentIds` array',\n      'for action or notification nodes when creating/patching workflows.',\n      '',\n      'Common options:',\n      '  --env <env>          Target environment (prod, dev, local)',\n      '  --api-url <url>      API URL override',\n      '  --token <key>        API token override',\n    ].join('\\n')\n  );\n}\n\nfunction formatSize(bytes: number): string {\n  if (bytes < 1024) return `${bytes} B`;\n  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;\n  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;\n}\n\nfunction truncate(s: string, max: number): string {\n  return s.length <= max ? s : s.slice(0, max - 1) + '…';\n}\n\nasync function handleList(argv: string[], apiUrl: string, token: string): Promise<void> {\n  const kind = getArgValue(argv, '--kind');\n  const search = getArgValue(argv, '--search');\n  const page = getArgValue(argv, '--page');\n  const pageSize = getArgValue(argv, '--page-size');\n  const jsonOutput = hasFlag(argv, '--json');\n\n  if (kind && !VALID_KINDS.includes(kind as (typeof VALID_KINDS)[number])) {\n    console.error(`Error: invalid --kind \"${kind}\". Must be one of: ${VALID_KINDS.join(', ')}`);\n    process.exit(1);\n  }\n\n  const params = new URLSearchParams();\n  if (kind) params.set('kind', kind);\n  if (search) params.set('search', search);\n  if (page) params.set('page', page);\n  if (pageSize) params.set('pageSize', pageSize);\n\n  const qs = params.toString();\n  const route = `/org/attachments${qs ? `?${qs}` : ''}`;\n  const result = await apiRequest<ListResponse>(apiUrl, token, 'GET', route);\n\n  if (!result.ok) {\n    console.error(`Error: ${result.error}`);\n    process.exit(1);\n  }\n\n  if (jsonOutput) {\n    console.log(JSON.stringify({ data: result.data, pagination: result.pagination }, null, 2));\n    return;\n  }\n\n  const { data, pagination } = result;\n  console.log(\n    `Attachments: ${pagination.totalItems} total (page ${pagination.page}/${pagination.totalPages})\\n`\n  );\n\n  if (data.length === 0) {\n    console.log('No attachments found.');\n    return;\n  }\n\n  const idW = 36;\n  const nameW = 40;\n  const typeW = 24;\n  const sizeW = 10;\n\n  console.log(\n    ['ID'.padEnd(idW), 'Filename'.padEnd(nameW), 'Type'.padEnd(typeW), 'Size'.padEnd(sizeW)].join(\n      '  '\n    )\n  );\n  for (const a of data) {\n    console.log(\n      [\n        a.id.padEnd(idW),\n        truncate(a.filename, nameW).padEnd(nameW),\n        truncate(a.contentType, typeW).padEnd(typeW),\n        formatSize(a.sizeBytes).padEnd(sizeW),\n      ].join('  ')\n    );\n  }\n}\n\nasync function handleUpload(argv: string[], apiUrl: string, token: string): Promise<void> {\n  const filePath = argv.find((a) => !a.startsWith('-'));\n  if (!filePath) {\n    console.error('Error: missing file path.');\n    console.error('Usage: canary attachment upload <file> [--filename <name>]');\n    process.exit(1);\n  }\n\n  const overrideName = getArgValue(argv, '--filename');\n  const jsonOutput = hasFlag(argv, '--json');\n\n  let buf: Buffer;\n  try {\n    buf = await fs.readFile(filePath);\n  } catch (err) {\n    console.error(`Error: failed to read ${filePath}: ${err instanceof Error ? err.message : String(err)}`);\n    process.exit(1);\n  }\n\n  const filename = overrideName ?? path.basename(filePath);\n  const form = new FormData();\n  form.append('files', new Blob([new Uint8Array(buf)]), filename);\n\n  const res = await fetch(`${apiUrl}/org/attachments`, {\n    method: 'POST',\n    headers: { Authorization: `Bearer ${token}` },\n    body: form,\n  });\n\n  if (res.status === 401) {\n    console.error('Error: Unauthorized. Run: canary login');\n    process.exit(1);\n  }\n\n  let body: UploadResponse;\n  try {\n    body = (await res.json()) as UploadResponse;\n  } catch {\n    console.error(`Error: invalid JSON response (${res.status})`);\n    process.exit(1);\n  }\n\n  if (!body.ok || !body.data || body.data.length === 0) {\n    console.error(`Error: ${body.error ?? `upload failed (${res.status})`}`);\n    process.exit(1);\n  }\n\n  const [created] = body.data;\n\n  if (jsonOutput) {\n    console.log(JSON.stringify(created, null, 2));\n    return;\n  }\n\n  console.log(`\\u2713 Uploaded ${created.filename}`);\n  console.log(`  ID: ${created.id}`);\n  console.log(`  Type: ${created.contentType}`);\n  console.log(`  Size: ${formatSize(created.sizeBytes)}`);\n  console.log('');\n  console.log('Reference in a workflow node:');\n  console.log(`  configJson.attachmentIds = [\"${created.id}\"]`);\n}\n\nasync function handleGet(argv: string[], apiUrl: string, token: string): Promise<void> {\n  const id = argv.find((a) => !a.startsWith('-'));\n  if (!id) {\n    console.error('Error: missing attachment ID.');\n    console.error('Usage: canary attachment get <id> [--url]');\n    process.exit(1);\n  }\n\n  const wantUrl = hasFlag(argv, '--url');\n  const jsonOutput = hasFlag(argv, '--json');\n\n  if (wantUrl) {\n    const result = await apiRequest<UrlResponse>(\n      apiUrl,\n      token,\n      'GET',\n      `/org/attachments/${id}/url`\n    );\n    if (!result.ok || !result.url) {\n      console.error(`Error: ${result.error ?? 'failed to fetch signed URL'}`);\n      process.exit(1);\n    }\n    if (jsonOutput) {\n      console.log(JSON.stringify({ id, url: result.url }, null, 2));\n    } else {\n      console.log(result.url);\n    }\n    return;\n  }\n\n  // No dedicated GET by id metadata endpoint; use bulk resolve as the read path.\n  const res = await fetch(`${apiUrl}/org/attachments/resolve`, {\n    method: 'POST',\n    headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },\n    body: JSON.stringify({ ids: [id] }),\n  });\n  if (res.status === 401) {\n    console.error('Error: Unauthorized. Run: canary login');\n    process.exit(1);\n  }\n  const body = (await res.json()) as { ok: boolean; error?: string; data?: AttachmentListItem[] };\n  if (!body.ok || !body.data || body.data.length === 0) {\n    console.error(`Error: ${body.error ?? 'attachment not found'}`);\n    process.exit(1);\n  }\n  const [att] = body.data;\n  if (jsonOutput) {\n    console.log(JSON.stringify(att, null, 2));\n    return;\n  }\n  console.log(`${att.filename}`);\n  console.log(`  ID: ${att.id}`);\n  console.log(`  Type: ${att.contentType}`);\n  console.log(`  Size: ${formatSize(att.sizeBytes)}`);\n  console.log(`  Created: ${att.createdAt}`);\n}\n\nasync function handleDelete(argv: string[], apiUrl: string, token: string): Promise<void> {\n  const id = argv.find((a) => !a.startsWith('-'));\n  if (!id) {\n    console.error('Error: missing attachment ID.');\n    console.error('Usage: canary attachment delete <id>');\n    process.exit(1);\n  }\n  const jsonOutput = hasFlag(argv, '--json');\n\n  const result = await apiRequest<{ ok: boolean; error?: string }>(\n    apiUrl,\n    token,\n    'DELETE',\n    `/org/attachments/${id}`\n  );\n\n  if (!result.ok) {\n    console.error(`Error: ${result.error ?? 'delete failed'}`);\n    process.exit(1);\n  }\n\n  if (jsonOutput) {\n    console.log(JSON.stringify({ ok: true, id }, null, 2));\n    return;\n  }\n  console.log(`\\u2713 Deleted attachment ${id}`);\n}\n\nexport async function runAttachment(argv: string[]): Promise<void> {\n  const [subCommand, ...rest] = argv;\n\n  if (!subCommand || subCommand === 'help' || hasFlag(argv, '--help', '-h')) {\n    printAttachmentHelp();\n    return;\n  }\n\n  const { apiUrl, token } = await resolveConfig(rest);\n\n  switch (subCommand) {\n    case 'list':\n      await handleList(rest, apiUrl, token);\n      return;\n    case 'upload':\n      await handleUpload(rest, apiUrl, token);\n      return;\n    case 'get':\n      await handleGet(rest, apiUrl, token);\n      return;\n    case 'delete':\n      await handleDelete(rest, apiUrl, token);\n      return;\n    default:\n      console.error(`Unknown attachment sub-command: ${subCommand}`);\n      printAttachmentHelp();\n      process.exit(1);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AASA,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,OAAO,aAAa;AA4BpB,IAAM,cAAc,CAAC,OAAO,SAAS,OAAO,eAAe,MAAM;AAEjE,SAAS,sBAA4B;AACnC,UAAQ;AAAA,IACN;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AACF;AAEA,SAAS,WAAW,OAAuB;AACzC,MAAI,QAAQ,KAAM,QAAO,GAAG,KAAK;AACjC,MAAI,QAAQ,OAAO,KAAM,QAAO,IAAI,QAAQ,MAAM,QAAQ,CAAC,CAAC;AAC5D,SAAO,IAAI,SAAS,OAAO,OAAO,QAAQ,CAAC,CAAC;AAC9C;AAEA,SAAS,SAAS,GAAW,KAAqB;AAChD,SAAO,EAAE,UAAU,MAAM,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,IAAI;AACrD;AAEA,eAAe,WAAW,MAAgB,QAAgB,OAA8B;AACtF,QAAM,OAAO,YAAY,MAAM,QAAQ;AACvC,QAAM,SAAS,YAAY,MAAM,UAAU;AAC3C,QAAM,OAAO,YAAY,MAAM,QAAQ;AACvC,QAAM,WAAW,YAAY,MAAM,aAAa;AAChD,QAAM,aAAa,QAAQ,MAAM,QAAQ;AAEzC,MAAI,QAAQ,CAAC,YAAY,SAAS,IAAoC,GAAG;AACvE,YAAQ,MAAM,0BAA0B,IAAI,sBAAsB,YAAY,KAAK,IAAI,CAAC,EAAE;AAC1F,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,QAAM,SAAS,IAAI,gBAAgB;AACnC,MAAI,KAAM,QAAO,IAAI,QAAQ,IAAI;AACjC,MAAI,OAAQ,QAAO,IAAI,UAAU,MAAM;AACvC,MAAI,KAAM,QAAO,IAAI,QAAQ,IAAI;AACjC,MAAI,SAAU,QAAO,IAAI,YAAY,QAAQ;AAE7C,QAAM,KAAK,OAAO,SAAS;AAC3B,QAAM,QAAQ,mBAAmB,KAAK,IAAI,EAAE,KAAK,EAAE;AACnD,QAAM,SAAS,MAAM,WAAyB,QAAQ,OAAO,OAAO,KAAK;AAEzE,MAAI,CAAC,OAAO,IAAI;AACd,YAAQ,MAAM,UAAU,OAAO,KAAK,EAAE;AACtC,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,MAAI,YAAY;AACd,YAAQ,IAAI,KAAK,UAAU,EAAE,MAAM,OAAO,MAAM,YAAY,OAAO,WAAW,GAAG,MAAM,CAAC,CAAC;AACzF;AAAA,EACF;AAEA,QAAM,EAAE,MAAM,WAAW,IAAI;AAC7B,UAAQ;AAAA,IACN,gBAAgB,WAAW,UAAU,gBAAgB,WAAW,IAAI,IAAI,WAAW,UAAU;AAAA;AAAA,EAC/F;AAEA,MAAI,KAAK,WAAW,GAAG;AACrB,YAAQ,IAAI,uBAAuB;AACnC;AAAA,EACF;AAEA,QAAM,MAAM;AACZ,QAAM,QAAQ;AACd,QAAM,QAAQ;AACd,QAAM,QAAQ;AAEd,UAAQ;AAAA,IACN,CAAC,KAAK,OAAO,GAAG,GAAG,WAAW,OAAO,KAAK,GAAG,OAAO,OAAO,KAAK,GAAG,OAAO,OAAO,KAAK,CAAC,EAAE;AAAA,MACvF;AAAA,IACF;AAAA,EACF;AACA,aAAW,KAAK,MAAM;AACpB,YAAQ;AAAA,MACN;AAAA,QACE,EAAE,GAAG,OAAO,GAAG;AAAA,QACf,SAAS,EAAE,UAAU,KAAK,EAAE,OAAO,KAAK;AAAA,QACxC,SAAS,EAAE,aAAa,KAAK,EAAE,OAAO,KAAK;AAAA,QAC3C,WAAW,EAAE,SAAS,EAAE,OAAO,KAAK;AAAA,MACtC,EAAE,KAAK,IAAI;AAAA,IACb;AAAA,EACF;AACF;AAEA,eAAe,aAAa,MAAgB,QAAgB,OAA8B;AACxF,QAAM,WAAW,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,CAAC;AACpD,MAAI,CAAC,UAAU;AACb,YAAQ,MAAM,2BAA2B;AACzC,YAAQ,MAAM,4DAA4D;AAC1E,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,QAAM,eAAe,YAAY,MAAM,YAAY;AACnD,QAAM,aAAa,QAAQ,MAAM,QAAQ;AAEzC,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,GAAG,SAAS,QAAQ;AAAA,EAClC,SAAS,KAAK;AACZ,YAAQ,MAAM,yBAAyB,QAAQ,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AACtG,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,QAAM,WAAW,gBAAgB,KAAK,SAAS,QAAQ;AACvD,QAAM,OAAO,IAAI,SAAS;AAC1B,OAAK,OAAO,SAAS,IAAI,KAAK,CAAC,IAAI,WAAW,GAAG,CAAC,CAAC,GAAG,QAAQ;AAE9D,QAAM,MAAM,MAAM,MAAM,GAAG,MAAM,oBAAoB;AAAA,IACnD,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,IAC5C,MAAM;AAAA,EACR,CAAC;AAED,MAAI,IAAI,WAAW,KAAK;AACtB,YAAQ,MAAM,wCAAwC;AACtD,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,MAAI;AACJ,MAAI;AACF,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB,QAAQ;AACN,YAAQ,MAAM,iCAAiC,IAAI,MAAM,GAAG;AAC5D,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,MAAI,CAAC,KAAK,MAAM,CAAC,KAAK,QAAQ,KAAK,KAAK,WAAW,GAAG;AACpD,YAAQ,MAAM,UAAU,KAAK,SAAS,kBAAkB,IAAI,MAAM,GAAG,EAAE;AACvE,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,QAAM,CAAC,OAAO,IAAI,KAAK;AAEvB,MAAI,YAAY;AACd,YAAQ,IAAI,KAAK,UAAU,SAAS,MAAM,CAAC,CAAC;AAC5C;AAAA,EACF;AAEA,UAAQ,IAAI,mBAAmB,QAAQ,QAAQ,EAAE;AACjD,UAAQ,IAAI,SAAS,QAAQ,EAAE,EAAE;AACjC,UAAQ,IAAI,WAAW,QAAQ,WAAW,EAAE;AAC5C,UAAQ,IAAI,WAAW,WAAW,QAAQ,SAAS,CAAC,EAAE;AACtD,UAAQ,IAAI,EAAE;AACd,UAAQ,IAAI,+BAA+B;AAC3C,UAAQ,IAAI,kCAAkC,QAAQ,EAAE,IAAI;AAC9D;AAEA,eAAe,UAAU,MAAgB,QAAgB,OAA8B;AACrF,QAAM,KAAK,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,CAAC;AAC9C,MAAI,CAAC,IAAI;AACP,YAAQ,MAAM,+BAA+B;AAC7C,YAAQ,MAAM,2CAA2C;AACzD,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,QAAM,UAAU,QAAQ,MAAM,OAAO;AACrC,QAAM,aAAa,QAAQ,MAAM,QAAQ;AAEzC,MAAI,SAAS;AACX,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,MACA,oBAAoB,EAAE;AAAA,IACxB;AACA,QAAI,CAAC,OAAO,MAAM,CAAC,OAAO,KAAK;AAC7B,cAAQ,MAAM,UAAU,OAAO,SAAS,4BAA4B,EAAE;AACtE,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,QAAI,YAAY;AACd,cAAQ,IAAI,KAAK,UAAU,EAAE,IAAI,KAAK,OAAO,IAAI,GAAG,MAAM,CAAC,CAAC;AAAA,IAC9D,OAAO;AACL,cAAQ,IAAI,OAAO,GAAG;AAAA,IACxB;AACA;AAAA,EACF;AAGA,QAAM,MAAM,MAAM,MAAM,GAAG,MAAM,4BAA4B;AAAA,IAC3D,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,KAAK,IAAI,gBAAgB,mBAAmB;AAAA,IAChF,MAAM,KAAK,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;AAAA,EACpC,CAAC;AACD,MAAI,IAAI,WAAW,KAAK;AACtB,YAAQ,MAAM,wCAAwC;AACtD,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,MAAI,CAAC,KAAK,MAAM,CAAC,KAAK,QAAQ,KAAK,KAAK,WAAW,GAAG;AACpD,YAAQ,MAAM,UAAU,KAAK,SAAS,sBAAsB,EAAE;AAC9D,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,QAAM,CAAC,GAAG,IAAI,KAAK;AACnB,MAAI,YAAY;AACd,YAAQ,IAAI,KAAK,UAAU,KAAK,MAAM,CAAC,CAAC;AACxC;AAAA,EACF;AACA,UAAQ,IAAI,GAAG,IAAI,QAAQ,EAAE;AAC7B,UAAQ,IAAI,SAAS,IAAI,EAAE,EAAE;AAC7B,UAAQ,IAAI,WAAW,IAAI,WAAW,EAAE;AACxC,UAAQ,IAAI,WAAW,WAAW,IAAI,SAAS,CAAC,EAAE;AAClD,UAAQ,IAAI,cAAc,IAAI,SAAS,EAAE;AAC3C;AAEA,eAAe,aAAa,MAAgB,QAAgB,OAA8B;AACxF,QAAM,KAAK,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,CAAC;AAC9C,MAAI,CAAC,IAAI;AACP,YAAQ,MAAM,+BAA+B;AAC7C,YAAQ,MAAM,sCAAsC;AACpD,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,QAAM,aAAa,QAAQ,MAAM,QAAQ;AAEzC,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA,oBAAoB,EAAE;AAAA,EACxB;AAEA,MAAI,CAAC,OAAO,IAAI;AACd,YAAQ,MAAM,UAAU,OAAO,SAAS,eAAe,EAAE;AACzD,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,MAAI,YAAY;AACd,YAAQ,IAAI,KAAK,UAAU,EAAE,IAAI,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC;AACrD;AAAA,EACF;AACA,UAAQ,IAAI,6BAA6B,EAAE,EAAE;AAC/C;AAEA,eAAsB,cAAc,MAA+B;AACjE,QAAM,CAAC,YAAY,GAAG,IAAI,IAAI;AAE9B,MAAI,CAAC,cAAc,eAAe,UAAU,QAAQ,MAAM,UAAU,IAAI,GAAG;AACzE,wBAAoB;AACpB;AAAA,EACF;AAEA,QAAM,EAAE,QAAQ,MAAM,IAAI,MAAM,cAAc,IAAI;AAElD,UAAQ,YAAY;AAAA,IAClB,KAAK;AACH,YAAM,WAAW,MAAM,QAAQ,KAAK;AACpC;AAAA,IACF,KAAK;AACH,YAAM,aAAa,MAAM,QAAQ,KAAK;AACtC;AAAA,IACF,KAAK;AACH,YAAM,UAAU,MAAM,QAAQ,KAAK;AACnC;AAAA,IACF,KAAK;AACH,YAAM,aAAa,MAAM,QAAQ,KAAK;AACtC;AAAA,IACF;AACE,cAAQ,MAAM,mCAAmC,UAAU,EAAE;AAC7D,0BAAoB;AACpB,cAAQ,KAAK,CAAC;AAAA,EAClB;AACF;","names":[]}

package/dist/auth-EN6NQCJY.js

@@ -0,0 +1,31 @@
+import { createRequire as __cr } from "module"; const require = __cr(import.meta.url);
+import {
+  ENV_URLS,
+  envToProfile,
+  getArgValue,
+  hasFlag,
+  readAllStoredTokens,
+  readStoredApiUrl,
+  readStoredAuth,
+  readStoredToken,
+  resolveAppUrl,
+  resolveConfig,
+  resolveOptionalConfig,
+  saveAuth
+} from "./chunk-A4OFTUVV.js";
+import "./chunk-VKVL7WBN.js";
+export {
+  ENV_URLS,
+  envToProfile,
+  getArgValue,
+  hasFlag,
+  readAllStoredTokens,
+  readStoredApiUrl,
+  readStoredAuth,
+  readStoredToken,
+  resolveAppUrl,
+  resolveConfig,
+  resolveOptionalConfig,
+  saveAuth
+};
+//# sourceMappingURL=auth-EN6NQCJY.js.map

package/dist/auth-EN6NQCJY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/bin.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { createRequire as __cr } from "module"; const require = __cr(import.meta.url);
+
+// src/bin.ts
+import { main } from "./index.js";
+void main(process.argv.slice(2));
+//# sourceMappingURL=bin.js.map

package/dist/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/bin.ts"],"sourcesContent":["import { main } from \"./index.js\";\n\nvoid main(process.argv.slice(2));\n"],"mappings":";;;;AAAA,SAAS,YAAY;AAErB,KAAK,KAAK,QAAQ,KAAK,MAAM,CAAC,CAAC;","names":[]}

package/dist/chunk-3CZU7XCS.js

@@ -0,0 +1,272 @@
+import { createRequire as __cr } from "module"; const require = __cr(import.meta.url);
+
+// src/jwt.ts
+function decodeJwtPayload(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    const base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const json = Buffer.from(base64, "base64").toString("utf8");
+    const payload = JSON.parse(json);
+    if (typeof payload !== "object" || payload === null || Array.isArray(payload)) {
+      return null;
+    }
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function isSuperadminToken(token) {
+  if (!token) return false;
+  const payload = decodeJwtPayload(token);
+  return payload?.is_superadmin === true;
+}
+
+// src/api-fetch.ts
+import process from "process";
+var CANARY_REQUEST_ID_HEADER = "x-canary-request-id";
+var DEFAULT_TIMEOUT_MS = 3e4;
+var JWT_EXP_SKEW_SEC = 60;
+function redactSecrets(text) {
+  return text.replace(/Bearer\s+[A-Za-z0-9._-]+/gi, "Bearer [redacted]").replace(/\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g, "[redacted-jwt]");
+}
+function redactUrl(url) {
+  const q = url.indexOf("?");
+  return q === -1 ? url : `${url.slice(0, q)}?[redacted]`;
+}
+function isDebug() {
+  return process.env.CANARY_DEBUG === "1" || process.env.CANARY_DEBUG === "true" || process.argv.includes("--debug");
+}
+function debug(line) {
+  if (isDebug()) {
+    process.stderr.write(`[canary-debug] ${line}
+`);
+  }
+}
+var TLS_CODES = /* @__PURE__ */ new Set([
+  "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+  "UNABLE_TO_GET_ISSUER_CERT",
+  "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+  "SELF_SIGNED_CERT_IN_CHAIN",
+  "DEPTH_ZERO_SELF_SIGNED_CERT",
+  "CERT_HAS_EXPIRED",
+  "CERT_UNTRUSTED",
+  "ERR_TLS_CERT_ALTNAME_INVALID",
+  "CERT_SIGNATURE_FAILURE"
+]);
+function extractErrorCode(err) {
+  if (!err || typeof err !== "object") return null;
+  const withCode = err;
+  if (typeof withCode.code === "string") return withCode.code;
+  if (withCode.cause) return extractErrorCode(withCode.cause);
+  return null;
+}
+function looksLikeHtml(body, contentType) {
+  if (contentType && contentType.toLowerCase().includes("text/html")) return true;
+  const trimmed = body.trimStart();
+  return trimmed.startsWith("<!") || trimmed.startsWith("<html") || trimmed.startsWith("<HTML");
+}
+function jwtExpStatus(token) {
+  if (!token) return "unknown";
+  const payload = decodeJwtPayload(token);
+  const exp = payload && typeof payload.exp === "number" ? payload.exp : null;
+  if (exp === null) return "unknown";
+  const nowSec = Math.floor(Date.now() / 1e3);
+  return exp < nowSec - JWT_EXP_SKEW_SEC ? "expired" : "valid";
+}
+var warnedAboutPlaintext = false;
+function maybeWarnPlaintextAuth(url, hasAuthHeader2) {
+  if (!hasAuthHeader2 || warnedAboutPlaintext) return;
+  if (!url.startsWith("http://")) return;
+  try {
+    const host = new URL(url).hostname;
+    if (host === "localhost" || host === "127.0.0.1" || host === "::1") return;
+  } catch {
+    return;
+  }
+  warnedAboutPlaintext = true;
+  process.stderr.write(
+    `[canary] WARNING: sending Authorization over plaintext http:// (${url}). Your API token may be exposed to the network. Use https:// in CANARY_API_URL.
+`
+  );
+}
+function hasAuthHeader(init) {
+  const h = init.headers;
+  if (!h) return false;
+  if (h instanceof Headers) return h.has("authorization");
+  if (Array.isArray(h)) return h.some(([k]) => k.toLowerCase() === "authorization");
+  return Object.keys(h).some((k) => k.toLowerCase() === "authorization");
+}
+async function apiFetch(url, init = {}) {
+  const { token, timeoutMs, ...fetchInit } = init;
+  maybeWarnPlaintextAuth(url, hasAuthHeader(fetchInit));
+  debug(`\u2192 ${fetchInit.method ?? "GET"} ${redactUrl(url)}`);
+  const timeout = timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const timeoutSignal = timeout > 0 ? AbortSignal.timeout(timeout) : null;
+  const effectiveSignal = fetchInit.signal && timeoutSignal ? AbortSignal.any([fetchInit.signal, timeoutSignal]) : fetchInit.signal ?? timeoutSignal ?? void 0;
+  let response;
+  try {
+    response = await fetch(url, { ...fetchInit, signal: effectiveSignal });
+  } catch (err) {
+    const isTimeout = err?.name === "TimeoutError" || Boolean(timeoutSignal?.aborted);
+    if (isTimeout) {
+      const msg2 = `Request to ${redactUrl(url)} timed out after ${timeout}ms.`;
+      debug(`\u2716 network timeout`);
+      return {
+        ok: false,
+        failure: { kind: "network", status: null, url, message: msg2, cause: err }
+      };
+    }
+    const code = extractErrorCode(err);
+    if (code && TLS_CODES.has(code)) {
+      const msg2 = [
+        `TLS verification failed talking to ${redactUrl(url)} (${code}).`,
+        "A corporate proxy (Zscaler, Netskope, ZPA, Cloudflare Access) is likely intercepting HTTPS.",
+        "Fixes: point Node at the proxy's root CA with",
+        "    NODE_EXTRA_CA_CERTS=/path/to/corporate-root.pem canary \u2026",
+        "or on Node 20+ enable the system trust store with",
+        "    NODE_OPTIONS=--use-system-ca canary \u2026"
+      ].join("\n");
+      debug(`\u2716 tls ${code}`);
+      return { ok: false, failure: { kind: "tls", status: null, url, message: msg2, cause: err } };
+    }
+    const msg = `Network error reaching ${redactUrl(url)}: ${String(err.message ?? err)}`;
+    debug(`\u2716 network ${msg}`);
+    return { ok: false, failure: { kind: "network", status: null, url, message: msg, cause: err } };
+  }
+  const requestId = response.headers.get(CANARY_REQUEST_ID_HEADER);
+  const contentType = response.headers.get("content-type");
+  debug(`\u2190 ${response.status} ${redactUrl(url)} (ct=${contentType ?? "n/a"} rid=${requestId ?? "none"})`);
+  if (response.ok) {
+    return { ok: true, response, requestId };
+  }
+  const bodyText = await response.clone().text().catch(() => "");
+  const snippet = redactSecrets(bodyText.slice(0, 200));
+  if (looksLikeHtml(bodyText, contentType)) {
+    return {
+      ok: false,
+      failure: {
+        kind: "html-body",
+        status: response.status,
+        url,
+        contentType: contentType ?? void 0,
+        requestId,
+        body: snippet,
+        message: [
+          `Got an HTML response from ${url} (status ${response.status}).`,
+          "A corporate proxy block page or captive portal is intercepting this request \u2014 the",
+          "response did not come from the Canary API.",
+          "Check that your proxy (e.g. Zscaler) allowlists the API hostname, and that any",
+          "required sign-in to the proxy itself is current.",
+          snippet ? `First bytes: ${snippet.replace(/\s+/g, " ")}` : ""
+        ].filter(Boolean).join("\n")
+      }
+    };
+  }
+  if ((response.status === 401 || response.status === 403) && !requestId) {
+    return {
+      ok: false,
+      failure: {
+        kind: "proxy-injected-4xx",
+        status: response.status,
+        url,
+        contentType: contentType ?? void 0,
+        requestId,
+        body: snippet,
+        message: [
+          `Got ${response.status} from ${url} but the response is missing the \`${CANARY_REQUEST_ID_HEADER}\` header.`,
+          "This response was almost certainly injected by a corporate proxy (Zscaler, Netskope,",
+          'Cloudflare Access) rather than returned by our API \u2014 retrying "canary login" will not fix it.',
+          "Ask your IT team to allowlist the API host, or re-auth to the proxy and try again."
+        ].join("\n")
+      }
+    };
+  }
+  if (response.status === 401) {
+    const jwtStatus = jwtExpStatus(token);
+    if (jwtStatus === "valid") {
+      return {
+        ok: false,
+        failure: {
+          kind: "token-revoked",
+          status: 401,
+          url,
+          requestId,
+          body: snippet,
+          message: [
+            "Server rejected a token that is still valid locally (unexpired JWT).",
+            "Likely causes: the token was revoked, the server's signing key rotated, or the",
+            "user/org was deactivated. `canary login` will issue a fresh token."
+          ].join("\n")
+        }
+      };
+    }
+    if (jwtStatus === "expired") {
+      return {
+        ok: false,
+        failure: {
+          kind: "token-expired",
+          status: 401,
+          url,
+          requestId,
+          body: snippet,
+          message: "Your stored token has expired. Run: canary login"
+        }
+      };
+    }
+    return {
+      ok: false,
+      failure: {
+        kind: "unauthorized",
+        status: 401,
+        url,
+        requestId,
+        body: snippet,
+        message: "Unauthorized. Run: canary login"
+      }
+    };
+  }
+  return {
+    ok: false,
+    failure: {
+      kind: "http-error",
+      status: response.status,
+      url,
+      contentType: contentType ?? void 0,
+      requestId,
+      body: bodyText,
+      message: `${response.status} ${response.statusText}${snippet ? `: ${snippet}` : ""}`
+    }
+  };
+}
+function isTerminalFailure(failure) {
+  return failure.kind !== "http-error";
+}
+function exitOnFailure(failure) {
+  process.stderr.write(`Error: ${failure.message}
+`);
+  if (isDebug() && failure.body && failure.kind !== "html-body") {
+    process.stderr.write(`[canary-debug] body: ${failure.body}
+`);
+  }
+  process.exit(1);
+}
+async function fetchOrExit(url, init = {}) {
+  const result = await apiFetch(url, init);
+  if (result.ok) return result.response;
+  if (isTerminalFailure(result.failure)) exitOnFailure(result.failure);
+  return new Response(result.failure.body ?? "", {
+    status: result.failure.status ?? 500,
+    headers: result.failure.contentType ? { "content-type": result.failure.contentType } : void 0
+  });
+}
+
+export {
+  decodeJwtPayload,
+  isSuperadminToken,
+  apiFetch,
+  isTerminalFailure,
+  exitOnFailure,
+  fetchOrExit
+};
+//# sourceMappingURL=chunk-3CZU7XCS.js.map