@runcofactor/cli 0.16.0 → 0.18.0

package/dist/{chunk-IGHDIWZU.js.map → chunk-VYTIJ6HJ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/auth.ts"],"sourcesContent":["import fs from 'node:fs/promises';\nimport os from 'node:os';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { readBrandEnv } from './brand.js';\n\ntype StoredAuth = {\n  token?: string;\n  apiUrl?: string;\n  orgId?: string;\n  orgName?: string;\n};\n\n/** Multi-profile auth file format */\ntype MultiProfileAuth = {\n  profiles: Record<string, StoredAuth>;\n  default: string;\n};\n\n/** Legacy flat format (single profile) */\ntype LegacyAuth = StoredAuth;\n\nconst AUTH_DIR = path.join(os.homedir(), '.config', 'canary-cli');\nconst AUTH_FILE = path.join(AUTH_DIR, 'auth.json');\n\n/* ── Shared argv helpers ─────────────────────────────────────────────── */\n\nexport function getArgValue(argv: string[], key: string): string | undefined {\n  const index = argv.indexOf(key);\n  if (index === -1 || index >= argv.length - 1) return undefined;\n  return argv[index + 1];\n}\n\nexport function hasFlag(argv: string[], ...flags: string[]): boolean {\n  return flags.some((flag) => argv.includes(flag));\n}\n\n/* ── Environment / profile mapping ───────────────────────────────────── */\n\n/** Map --env values to profile names for multi-profile auth storage */\nexport function envToProfile(env: string): string {\n  if (env === 'prod' || env === 'production') return 'production';\n  if (env === 'dev') return 'dev';\n  if (env === 'local') return 'local';\n  return env;\n}\n\nconst VALID_ENVS = ['prod', 'dev', 'local'];\n\n/** Environment URL mappings shared across CLI commands */\nexport const ENV_URLS: Record<string, { api: string; app: string }> = {\n  prod: {\n    api: 'https://api.trycanary.ai',\n    app: 'https://app.trycanary.ai',\n  },\n  production: {\n    api: 'https://api.trycanary.ai',\n    app: 'https://app.trycanary.ai',\n  },\n  dev: {\n    api: 'https://api.dev.trycanary.ai',\n    app: 'https://app.dev.trycanary.ai',\n  },\n  local: {\n    api: 'http://localhost:3000',\n    app: 'http://localhost:5173',\n  },\n};\n\n/** Derive the web-app URL that corresponds to a given API URL. */\nexport function resolveAppUrl(apiUrl: string): string {\n  for (const env of Object.values(ENV_URLS)) {\n    if (env.api === apiUrl) return env.app;\n  }\n  // Fallback for custom API URLs: replace \"api.\" at protocol boundary or \"/api\" path\n  return apiUrl.replace(/(:\\/\\/)api\\./, '$1app.').replace(/:3000\\b/, ':5173');\n}\n\nfunction isMultiProfile(data: unknown): data is MultiProfileAuth {\n  return typeof data === 'object' && data !== null && 'profiles' in data;\n}\n\n/** Read the raw auth file and normalize to multi-profile format */\nasync function readAuthFile(): Promise<MultiProfileAuth | null> {\n  try {\n    const content = await fs.readFile(AUTH_FILE, 'utf8');\n    const data = JSON.parse(content) as unknown;\n\n    if (isMultiProfile(data)) {\n      return data;\n    }\n\n    // Legacy flat format — treat as the \"default\" profile\n    const legacy = data as LegacyAuth;\n    return {\n      profiles: { default: legacy },\n      default: 'default',\n    };\n  } catch {\n    return null;\n  }\n}\n\nexport async function readStoredAuth(profile?: string): Promise<StoredAuth | null> {\n  const auth = await readAuthFile();\n  if (!auth) return null;\n\n  const key = profile ?? auth.default;\n  return auth.profiles[key] ?? null;\n}\n\nexport async function readStoredToken(profile?: string): Promise<string | null> {\n  const auth = await readStoredAuth(profile);\n  return auth?.token ?? null;\n}\n\nexport async function readStoredApiUrl(profile?: string): Promise<string | null> {\n  const auth = await readStoredAuth(profile);\n  return auth?.apiUrl ?? null;\n}\n\n/** Return all stored tokens across every profile */\nexport async function readAllStoredTokens(): Promise<string[]> {\n  const auth = await readAuthFile();\n  if (!auth) return [];\n  return Object.values(auth.profiles)\n    .map((p) => p.token)\n    .filter((t): t is string => !!t);\n}\n\nexport async function saveAuth(auth: StoredAuth, profile?: string): Promise<string> {\n  await fs.mkdir(AUTH_DIR, { recursive: true, mode: 0o700 });\n\n  // Read existing file (may be legacy or multi-profile)\n  let existing: MultiProfileAuth;\n  try {\n    const content = await fs.readFile(AUTH_FILE, 'utf8');\n    const data = JSON.parse(content) as unknown;\n\n    if (isMultiProfile(data)) {\n      existing = data;\n    } else {\n      // Migrate legacy flat format into profiles.default\n      existing = {\n        profiles: { default: data as LegacyAuth },\n        default: 'default',\n      };\n    }\n  } catch {\n    existing = { profiles: {}, default: 'default' };\n  }\n\n  const key = profile ?? 'default';\n  existing.profiles[key] = auth;\n\n  // Set default to this profile if no default exists yet\n  if (!existing.profiles[existing.default]) {\n    existing.default = key;\n  }\n\n  await fs.writeFile(AUTH_FILE, JSON.stringify(existing, null, 2), {\n    encoding: 'utf8',\n    mode: 0o600,\n  });\n  return AUTH_FILE;\n}\n\n/* ── Shared config resolution ────────────────────────────────────────── */\n\ntype ResolvedConfig = { apiUrl: string; token: string };\n\nasync function resolveConfigInternal(\n  argv: string[],\n  opts: { required: boolean }\n): Promise<ResolvedConfig | null> {\n  const env = getArgValue(argv, '--env');\n  const profile = env ? envToProfile(env) : undefined;\n\n  if (env && !ENV_URLS[env]) {\n    if (opts.required) {\n      console.error(`Unknown environment: ${env}`);\n      console.error(`Valid environments: ${VALID_ENVS.join(', ')}`);\n      process.exit(1);\n    }\n    return null;\n  }\n\n  const storedApiUrl = await readStoredApiUrl(profile);\n  const apiUrl =\n    getArgValue(argv, '--api-url') ??\n    (env ? ENV_URLS[env].api : undefined) ??\n    readBrandEnv('CANARY_API_URL') ??\n    storedApiUrl ??\n    'https://api.trycanary.ai';\n\n  const explicitToken = getArgValue(argv, '--token');\n\n  let token: string | null;\n  if (explicitToken) {\n    token = explicitToken;\n  } else if (profile) {\n    token = (await readStoredToken(profile)) ?? readBrandEnv('CANARY_API_TOKEN') ?? null;\n    if (!token && opts.required) {\n      console.error(`Error: No token found for \"${env}\" profile.`);\n      console.error(`Run: canary login --env ${env}`);\n      process.exit(1);\n    }\n  } else {\n    token = readBrandEnv('CANARY_API_TOKEN') ?? (await readStoredToken()) ?? null;\n    if (!token && opts.required) {\n      console.error('Error: No API token found.');\n      console.error('Run: canary login');\n      process.exit(1);\n    }\n  }\n\n  return token ? { apiUrl, token } : null;\n}\n\n/**\n * Resolve API URL and auth token from argv flags, env vars, and stored profiles.\n * Used by knobs, feature-flag, release, and debug-session commands.\n */\nexport async function resolveConfig(argv: string[]): Promise<ResolvedConfig> {\n  return (await resolveConfigInternal(argv, { required: true }))!;\n}\n\nexport async function resolveOptionalConfig(argv: string[]): Promise<ResolvedConfig | null> {\n  return resolveConfigInternal(argv, { required: false });\n}\n"],"mappings":";;;;;;AAAA,OAAO,QAAQ;AACf,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,OAAO,aAAa;AAmBpB,IAAM,WAAW,KAAK,KAAK,GAAG,QAAQ,GAAG,WAAW,YAAY;AAChE,IAAM,YAAY,KAAK,KAAK,UAAU,WAAW;AAI1C,SAAS,YAAY,MAAgB,KAAiC;AAC3E,QAAM,QAAQ,KAAK,QAAQ,GAAG;AAC9B,MAAI,UAAU,MAAM,SAAS,KAAK,SAAS,EAAG,QAAO;AACrD,SAAO,KAAK,QAAQ,CAAC;AACvB;AAEO,SAAS,QAAQ,SAAmB,OAA0B;AACnE,SAAO,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC;AACjD;AAKO,SAAS,aAAa,KAAqB;AAChD,MAAI,QAAQ,UAAU,QAAQ,aAAc,QAAO;AACnD,MAAI,QAAQ,MAAO,QAAO;AAC1B,MAAI,QAAQ,QAAS,QAAO;AAC5B,SAAO;AACT;AAEA,IAAM,aAAa,CAAC,QAAQ,OAAO,OAAO;AAGnC,IAAM,WAAyD;AAAA,EACpE,MAAM;AAAA,IACJ,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AAAA,EACA,YAAY;AAAA,IACV,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AAAA,EACA,KAAK;AAAA,IACH,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AAAA,EACA,OAAO;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AACF;AAGO,SAAS,cAAc,QAAwB;AACpD,aAAW,OAAO,OAAO,OAAO,QAAQ,GAAG;AACzC,QAAI,IAAI,QAAQ,OAAQ,QAAO,IAAI;AAAA,EACrC;AAEA,SAAO,OAAO,QAAQ,gBAAgB,QAAQ,EAAE,QAAQ,WAAW,OAAO;AAC5E;AAEA,SAAS,eAAe,MAAyC;AAC/D,SAAO,OAAO,SAAS,YAAY,SAAS,QAAQ,cAAc;AACpE;AAGA,eAAe,eAAiD;AAC9D,MAAI;AACF,UAAM,UAAU,MAAM,GAAG,SAAS,WAAW,MAAM;AACnD,UAAM,OAAO,KAAK,MAAM,OAAO;AAE/B,QAAI,eAAe,IAAI,GAAG;AACxB,aAAO;AAAA,IACT;AAGA,UAAM,SAAS;AACf,WAAO;AAAA,MACL,UAAU,EAAE,SAAS,OAAO;AAAA,MAC5B,SAAS;AAAA,IACX;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,eAAe,SAA8C;AACjF,QAAM,OAAO,MAAM,aAAa;AAChC,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,MAAM,WAAW,KAAK;AAC5B,SAAO,KAAK,SAAS,GAAG,KAAK;AAC/B;AAEA,eAAsB,gBAAgB,SAA0C;AAC9E,QAAM,OAAO,MAAM,eAAe,OAAO;AACzC,SAAO,MAAM,SAAS;AACxB;AAEA,eAAsB,iBAAiB,SAA0C;AAC/E,QAAM,OAAO,MAAM,eAAe,OAAO;AACzC,SAAO,MAAM,UAAU;AACzB;AAGA,eAAsB,sBAAyC;AAC7D,QAAM,OAAO,MAAM,aAAa;AAChC,MAAI,CAAC,KAAM,QAAO,CAAC;AACnB,SAAO,OAAO,OAAO,KAAK,QAAQ,EAC/B,IAAI,CAAC,MAAM,EAAE,KAAK,EAClB,OAAO,CAAC,MAAmB,CAAC,CAAC,CAAC;AACnC;AAEA,eAAsB,SAAS,MAAkB,SAAmC;AAClF,QAAM,GAAG,MAAM,UAAU,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAGzD,MAAI;AACJ,MAAI;AACF,UAAM,UAAU,MAAM,GAAG,SAAS,WAAW,MAAM;AACnD,UAAM,OAAO,KAAK,MAAM,OAAO;AAE/B,QAAI,eAAe,IAAI,GAAG;AACxB,iBAAW;AAAA,IACb,OAAO;AAEL,iBAAW;AAAA,QACT,UAAU,EAAE,SAAS,KAAmB;AAAA,QACxC,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF,QAAQ;AACN,eAAW,EAAE,UAAU,CAAC,GAAG,SAAS,UAAU;AAAA,EAChD;AAEA,QAAM,MAAM,WAAW;AACvB,WAAS,SAAS,GAAG,IAAI;AAGzB,MAAI,CAAC,SAAS,SAAS,SAAS,OAAO,GAAG;AACxC,aAAS,UAAU;AAAA,EACrB;AAEA,QAAM,GAAG,UAAU,WAAW,KAAK,UAAU,UAAU,MAAM,CAAC,GAAG;AAAA,IAC/D,UAAU;AAAA,IACV,MAAM;AAAA,EACR,CAAC;AACD,SAAO;AACT;AAMA,eAAe,sBACb,MACA,MACgC;AAChC,QAAM,MAAM,YAAY,MAAM,OAAO;AACrC,QAAM,UAAU,MAAM,aAAa,GAAG,IAAI;AAE1C,MAAI,OAAO,CAAC,SAAS,GAAG,GAAG;AACzB,QAAI,KAAK,UAAU;AACjB,cAAQ,MAAM,wBAAwB,GAAG,EAAE;AAC3C,cAAQ,MAAM,uBAAuB,WAAW,KAAK,IAAI,CAAC,EAAE;AAC5D,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,MAAM,iBAAiB,OAAO;AACnD,QAAM,SACJ,YAAY,MAAM,WAAW,MAC5B,MAAM,SAAS,GAAG,EAAE,MAAM,WAC3B,aAAa,gBAAgB,KAC7B,gBACA;AAEF,QAAM,gBAAgB,YAAY,MAAM,SAAS;AAEjD,MAAI;AACJ,MAAI,eAAe;AACjB,YAAQ;AAAA,EACV,WAAW,SAAS;AAClB,YAAS,MAAM,gBAAgB,OAAO,KAAM,aAAa,kBAAkB,KAAK;AAChF,QAAI,CAAC,SAAS,KAAK,UAAU;AAC3B,cAAQ,MAAM,8BAA8B,GAAG,YAAY;AAC3D,cAAQ,MAAM,2BAA2B,GAAG,EAAE;AAC9C,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,OAAO;AACL,YAAQ,aAAa,kBAAkB,KAAM,MAAM,gBAAgB,KAAM;AACzE,QAAI,CAAC,SAAS,KAAK,UAAU;AAC3B,cAAQ,MAAM,4BAA4B;AAC1C,cAAQ,MAAM,mBAAmB;AACjC,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AAEA,SAAO,QAAQ,EAAE,QAAQ,MAAM,IAAI;AACrC;AAMA,eAAsB,cAAc,MAAyC;AAC3E,SAAQ,MAAM,sBAAsB,MAAM,EAAE,UAAU,KAAK,CAAC;AAC9D;AAEA,eAAsB,sBAAsB,MAAgD;AAC1F,SAAO,sBAAsB,MAAM,EAAE,UAAU,MAAM,CAAC;AACxD;","names":[]}
+{"version":3,"sources":["../src/auth.ts"],"sourcesContent":["import fs from 'node:fs/promises';\nimport os from 'node:os';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { readBrandEnv } from './brand.js';\n\ntype StoredAuth = {\n  token?: string;\n  apiUrl?: string;\n  orgId?: string;\n  orgName?: string;\n};\n\n/** Multi-profile auth file format */\ntype MultiProfileAuth = {\n  profiles: Record<string, StoredAuth>;\n  default: string;\n};\n\n/** Legacy flat format (single profile) */\ntype LegacyAuth = StoredAuth;\n\nconst AUTH_DIR = path.join(os.homedir(), '.config', 'canary-cli');\nconst AUTH_FILE = path.join(AUTH_DIR, 'auth.json');\n\n/* ── Shared argv helpers ─────────────────────────────────────────────── */\n\nexport function getArgValue(argv: string[], key: string): string | undefined {\n  const index = argv.indexOf(key);\n  if (index === -1 || index >= argv.length - 1) return undefined;\n  return argv[index + 1];\n}\n\nexport function hasFlag(argv: string[], ...flags: string[]): boolean {\n  return flags.some((flag) => argv.includes(flag));\n}\n\n/* ── Environment / profile mapping ───────────────────────────────────── */\n\n/** Map --env values to profile names for multi-profile auth storage */\nexport function envToProfile(env: string): string {\n  if (env === 'prod' || env === 'production') return 'production';\n  if (env === 'dev') return 'dev';\n  if (env === 'local') return 'local';\n  return env;\n}\n\nconst VALID_ENVS = ['prod', 'dev', 'local'];\n\n/** Environment URL mappings shared across CLI commands */\nexport const ENV_URLS: Record<string, { api: string; app: string }> = {\n  prod: {\n    api: 'https://api.trycanary.ai',\n    app: 'https://app.trycanary.ai',\n  },\n  production: {\n    api: 'https://api.trycanary.ai',\n    app: 'https://app.trycanary.ai',\n  },\n  dev: {\n    api: 'https://api.dev.trycanary.ai',\n    app: 'https://app.dev.trycanary.ai',\n  },\n  local: {\n    api: 'http://localhost:3000',\n    app: 'http://localhost:5173',\n  },\n};\n\n/** Derive the web-app URL that corresponds to a given API URL. */\nexport function resolveAppUrl(apiUrl: string): string {\n  for (const env of Object.values(ENV_URLS)) {\n    if (env.api === apiUrl) return env.app;\n  }\n  // Fallback for custom API URLs: replace \"api.\" at protocol boundary or \"/api\" path\n  return apiUrl.replace(/(:\\/\\/)api\\./, '$1app.').replace(/:3000\\b/, ':5173');\n}\n\nfunction isMultiProfile(data: unknown): data is MultiProfileAuth {\n  return typeof data === 'object' && data !== null && 'profiles' in data;\n}\n\n/** Read the raw auth file and normalize to multi-profile format */\nasync function readAuthFile(): Promise<MultiProfileAuth | null> {\n  try {\n    const content = await fs.readFile(AUTH_FILE, 'utf8');\n    const data = JSON.parse(content) as unknown;\n\n    if (isMultiProfile(data)) {\n      return data;\n    }\n\n    // Legacy flat format — treat as the \"default\" profile\n    const legacy = data as LegacyAuth;\n    return {\n      profiles: { default: legacy },\n      default: 'default',\n    };\n  } catch {\n    return null;\n  }\n}\n\nexport async function readStoredAuth(profile?: string): Promise<StoredAuth | null> {\n  const auth = await readAuthFile();\n  if (!auth) return null;\n\n  const key = profile ?? auth.default;\n  return auth.profiles[key] ?? null;\n}\n\nexport async function readStoredToken(profile?: string): Promise<string | null> {\n  const auth = await readStoredAuth(profile);\n  return auth?.token ?? null;\n}\n\nexport async function readStoredApiUrl(profile?: string): Promise<string | null> {\n  const auth = await readStoredAuth(profile);\n  return auth?.apiUrl ?? null;\n}\n\n/** Return all stored tokens across every profile */\nexport async function readAllStoredTokens(): Promise<string[]> {\n  const auth = await readAuthFile();\n  if (!auth) return [];\n  return Object.values(auth.profiles)\n    .map((p) => p.token)\n    .filter((t): t is string => !!t);\n}\n\nexport async function saveAuth(auth: StoredAuth, profile?: string): Promise<string> {\n  await fs.mkdir(AUTH_DIR, { recursive: true, mode: 0o700 });\n\n  // Read existing file (may be legacy or multi-profile)\n  let existing: MultiProfileAuth;\n  try {\n    const content = await fs.readFile(AUTH_FILE, 'utf8');\n    const data = JSON.parse(content) as unknown;\n\n    if (isMultiProfile(data)) {\n      existing = data;\n    } else {\n      // Migrate legacy flat format into profiles.default\n      existing = {\n        profiles: { default: data as LegacyAuth },\n        default: 'default',\n      };\n    }\n  } catch {\n    existing = { profiles: {}, default: 'default' };\n  }\n\n  const key = profile ?? 'default';\n  existing.profiles[key] = auth;\n\n  // Set default to this profile if no default exists yet\n  if (!existing.profiles[existing.default]) {\n    existing.default = key;\n  }\n\n  await fs.writeFile(AUTH_FILE, JSON.stringify(existing, null, 2), {\n    encoding: 'utf8',\n    mode: 0o600,\n  });\n  return AUTH_FILE;\n}\n\n/* ── Shared config resolution ────────────────────────────────────────── */\n\ntype ResolvedConfig = { apiUrl: string; token: string };\n\nasync function resolveConfigInternal(\n  argv: string[],\n  opts: { required: boolean }\n): Promise<ResolvedConfig | null> {\n  const env = getArgValue(argv, '--env');\n  const profile = env ? envToProfile(env) : undefined;\n\n  if (env && !ENV_URLS[env]) {\n    if (opts.required) {\n      console.error(`Unknown environment: ${env}`);\n      console.error(`Valid environments: ${VALID_ENVS.join(', ')}`);\n      process.exit(1);\n    }\n    return null;\n  }\n\n  const storedApiUrl = await readStoredApiUrl(profile);\n  const apiUrl =\n    getArgValue(argv, '--api-url') ??\n    (env ? ENV_URLS[env].api : undefined) ??\n    readBrandEnv('CANARY_API_URL') ??\n    storedApiUrl ??\n    'https://api.trycanary.ai';\n\n  const explicitToken = getArgValue(argv, '--token');\n\n  let token: string | null;\n  if (explicitToken) {\n    token = explicitToken;\n  } else if (profile) {\n    token = (await readStoredToken(profile)) ?? readBrandEnv('CANARY_API_TOKEN') ?? null;\n    if (!token && opts.required) {\n      console.error(`Error: No token found for \"${env}\" profile.`);\n      console.error(`Run: canary login --env ${env}`);\n      process.exit(1);\n    }\n  } else {\n    token = readBrandEnv('CANARY_API_TOKEN') ?? (await readStoredToken()) ?? null;\n    if (!token && opts.required) {\n      console.error('Error: No API token found.');\n      console.error('Run: canary login');\n      process.exit(1);\n    }\n  }\n\n  return token ? { apiUrl, token } : null;\n}\n\n/**\n * Resolve API URL and auth token from argv flags, env vars, and stored profiles.\n * Used by knobs, feature-flag, release, and debug-session commands.\n */\nexport async function resolveConfig(argv: string[]): Promise<ResolvedConfig> {\n  return (await resolveConfigInternal(argv, { required: true }))!;\n}\n\nexport async function resolveOptionalConfig(argv: string[]): Promise<ResolvedConfig | null> {\n  return resolveConfigInternal(argv, { required: false });\n}\n\n/**\n * Where the effective auth token would come from for this invocation:\n * - `flag`   — explicit `--token`\n * - `env`    — CANARY_API_TOKEN / COFACTOR_API_TOKEN\n * - `stored` — an interactive `canary login` session in auth.json\n * - `none`   — no token resolvable\n *\n * Mirrors the precedence in `resolveConfigInternal` exactly (which differs by\n * whether a profile is selected). `stored` is the only \"logged in interactively\"\n * source; `flag`/`env` are API-key style auth used by CI/automation.\n */\nexport async function resolveAuthSource(\n  argv: string[]\n): Promise<'flag' | 'env' | 'stored' | 'none'> {\n  const env = getArgValue(argv, '--env');\n  if (env && !ENV_URLS[env]) return 'none';\n  const profile = env ? envToProfile(env) : undefined;\n\n  if (getArgValue(argv, '--token')) return 'flag';\n\n  if (profile) {\n    // With a profile, stored auth wins over the env var.\n    if (await readStoredToken(profile)) return 'stored';\n    if (readBrandEnv('CANARY_API_TOKEN')) return 'env';\n    return 'none';\n  }\n\n  // Without a profile, the env var wins over stored auth.\n  if (readBrandEnv('CANARY_API_TOKEN')) return 'env';\n  if (await readStoredToken()) return 'stored';\n  return 'none';\n}\n"],"mappings":";;;;;;AAAA,OAAO,QAAQ;AACf,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,OAAO,aAAa;AAmBpB,IAAM,WAAW,KAAK,KAAK,GAAG,QAAQ,GAAG,WAAW,YAAY;AAChE,IAAM,YAAY,KAAK,KAAK,UAAU,WAAW;AAI1C,SAAS,YAAY,MAAgB,KAAiC;AAC3E,QAAM,QAAQ,KAAK,QAAQ,GAAG;AAC9B,MAAI,UAAU,MAAM,SAAS,KAAK,SAAS,EAAG,QAAO;AACrD,SAAO,KAAK,QAAQ,CAAC;AACvB;AAEO,SAAS,QAAQ,SAAmB,OAA0B;AACnE,SAAO,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC;AACjD;AAKO,SAAS,aAAa,KAAqB;AAChD,MAAI,QAAQ,UAAU,QAAQ,aAAc,QAAO;AACnD,MAAI,QAAQ,MAAO,QAAO;AAC1B,MAAI,QAAQ,QAAS,QAAO;AAC5B,SAAO;AACT;AAEA,IAAM,aAAa,CAAC,QAAQ,OAAO,OAAO;AAGnC,IAAM,WAAyD;AAAA,EACpE,MAAM;AAAA,IACJ,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AAAA,EACA,YAAY;AAAA,IACV,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AAAA,EACA,KAAK;AAAA,IACH,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AAAA,EACA,OAAO;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AACF;AAGO,SAAS,cAAc,QAAwB;AACpD,aAAW,OAAO,OAAO,OAAO,QAAQ,GAAG;AACzC,QAAI,IAAI,QAAQ,OAAQ,QAAO,IAAI;AAAA,EACrC;AAEA,SAAO,OAAO,QAAQ,gBAAgB,QAAQ,EAAE,QAAQ,WAAW,OAAO;AAC5E;AAEA,SAAS,eAAe,MAAyC;AAC/D,SAAO,OAAO,SAAS,YAAY,SAAS,QAAQ,cAAc;AACpE;AAGA,eAAe,eAAiD;AAC9D,MAAI;AACF,UAAM,UAAU,MAAM,GAAG,SAAS,WAAW,MAAM;AACnD,UAAM,OAAO,KAAK,MAAM,OAAO;AAE/B,QAAI,eAAe,IAAI,GAAG;AACxB,aAAO;AAAA,IACT;AAGA,UAAM,SAAS;AACf,WAAO;AAAA,MACL,UAAU,EAAE,SAAS,OAAO;AAAA,MAC5B,SAAS;AAAA,IACX;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,eAAe,SAA8C;AACjF,QAAM,OAAO,MAAM,aAAa;AAChC,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,MAAM,WAAW,KAAK;AAC5B,SAAO,KAAK,SAAS,GAAG,KAAK;AAC/B;AAEA,eAAsB,gBAAgB,SAA0C;AAC9E,QAAM,OAAO,MAAM,eAAe,OAAO;AACzC,SAAO,MAAM,SAAS;AACxB;AAEA,eAAsB,iBAAiB,SAA0C;AAC/E,QAAM,OAAO,MAAM,eAAe,OAAO;AACzC,SAAO,MAAM,UAAU;AACzB;AAGA,eAAsB,sBAAyC;AAC7D,QAAM,OAAO,MAAM,aAAa;AAChC,MAAI,CAAC,KAAM,QAAO,CAAC;AACnB,SAAO,OAAO,OAAO,KAAK,QAAQ,EAC/B,IAAI,CAAC,MAAM,EAAE,KAAK,EAClB,OAAO,CAAC,MAAmB,CAAC,CAAC,CAAC;AACnC;AAEA,eAAsB,SAAS,MAAkB,SAAmC;AAClF,QAAM,GAAG,MAAM,UAAU,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAGzD,MAAI;AACJ,MAAI;AACF,UAAM,UAAU,MAAM,GAAG,SAAS,WAAW,MAAM;AACnD,UAAM,OAAO,KAAK,MAAM,OAAO;AAE/B,QAAI,eAAe,IAAI,GAAG;AACxB,iBAAW;AAAA,IACb,OAAO;AAEL,iBAAW;AAAA,QACT,UAAU,EAAE,SAAS,KAAmB;AAAA,QACxC,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF,QAAQ;AACN,eAAW,EAAE,UAAU,CAAC,GAAG,SAAS,UAAU;AAAA,EAChD;AAEA,QAAM,MAAM,WAAW;AACvB,WAAS,SAAS,GAAG,IAAI;AAGzB,MAAI,CAAC,SAAS,SAAS,SAAS,OAAO,GAAG;AACxC,aAAS,UAAU;AAAA,EACrB;AAEA,QAAM,GAAG,UAAU,WAAW,KAAK,UAAU,UAAU,MAAM,CAAC,GAAG;AAAA,IAC/D,UAAU;AAAA,IACV,MAAM;AAAA,EACR,CAAC;AACD,SAAO;AACT;AAMA,eAAe,sBACb,MACA,MACgC;AAChC,QAAM,MAAM,YAAY,MAAM,OAAO;AACrC,QAAM,UAAU,MAAM,aAAa,GAAG,IAAI;AAE1C,MAAI,OAAO,CAAC,SAAS,GAAG,GAAG;AACzB,QAAI,KAAK,UAAU;AACjB,cAAQ,MAAM,wBAAwB,GAAG,EAAE;AAC3C,cAAQ,MAAM,uBAAuB,WAAW,KAAK,IAAI,CAAC,EAAE;AAC5D,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,MAAM,iBAAiB,OAAO;AACnD,QAAM,SACJ,YAAY,MAAM,WAAW,MAC5B,MAAM,SAAS,GAAG,EAAE,MAAM,WAC3B,aAAa,gBAAgB,KAC7B,gBACA;AAEF,QAAM,gBAAgB,YAAY,MAAM,SAAS;AAEjD,MAAI;AACJ,MAAI,eAAe;AACjB,YAAQ;AAAA,EACV,WAAW,SAAS;AAClB,YAAS,MAAM,gBAAgB,OAAO,KAAM,aAAa,kBAAkB,KAAK;AAChF,QAAI,CAAC,SAAS,KAAK,UAAU;AAC3B,cAAQ,MAAM,8BAA8B,GAAG,YAAY;AAC3D,cAAQ,MAAM,2BAA2B,GAAG,EAAE;AAC9C,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,OAAO;AACL,YAAQ,aAAa,kBAAkB,KAAM,MAAM,gBAAgB,KAAM;AACzE,QAAI,CAAC,SAAS,KAAK,UAAU;AAC3B,cAAQ,MAAM,4BAA4B;AAC1C,cAAQ,MAAM,mBAAmB;AACjC,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AAEA,SAAO,QAAQ,EAAE,QAAQ,MAAM,IAAI;AACrC;AAMA,eAAsB,cAAc,MAAyC;AAC3E,SAAQ,MAAM,sBAAsB,MAAM,EAAE,UAAU,KAAK,CAAC;AAC9D;AAEA,eAAsB,sBAAsB,MAAgD;AAC1F,SAAO,sBAAsB,MAAM,EAAE,UAAU,MAAM,CAAC;AACxD;AAaA,eAAsB,kBACpB,MAC6C;AAC7C,QAAM,MAAM,YAAY,MAAM,OAAO;AACrC,MAAI,OAAO,CAAC,SAAS,GAAG,EAAG,QAAO;AAClC,QAAM,UAAU,MAAM,aAAa,GAAG,IAAI;AAE1C,MAAI,YAAY,MAAM,SAAS,EAAG,QAAO;AAEzC,MAAI,SAAS;AAEX,QAAI,MAAM,gBAAgB,OAAO,EAAG,QAAO;AAC3C,QAAI,aAAa,kBAAkB,EAAG,QAAO;AAC7C,WAAO;AAAA,EACT;AAGA,MAAI,aAAa,kBAAkB,EAAG,QAAO;AAC7C,MAAI,MAAM,gBAAgB,EAAG,QAAO;AACpC,SAAO;AACT;","names":[]}

package/dist/{credential-X6QKX473.js → credential-WOATCWOU.js}

@@ -3,16 +3,16 @@ import {
   apiRequest,
   fetchProperties,
   getApplicationArg
-} from "./chunk-UAJUZLDE.js";
+} from "./chunk-PVWG3V62.js";
 import {
   apiFetch,
   exitOnFailure
-} from "./chunk-3CZU7XCS.js";
+} from "./chunk-PWZ4ULCB.js";
 import {
   getArgValue,
   hasFlag,
   resolveConfig
-} from "./chunk-IGHDIWZU.js";
+} from "./chunk-VYTIJ6HJ.js";
 import "./chunk-32P26BZT.js";
 import "./chunk-JWHYXEA2.js";
 import "./chunk-GZVCNYR4.js";
@@ -451,4 +451,4 @@ async function runCredential(argv) {
 export {
   runCredential
 };
-//# sourceMappingURL=credential-X6QKX473.js.map
+//# sourceMappingURL=credential-WOATCWOU.js.map

package/dist/{credential-template-GD3D4MBI.js → credential-template-Q3DQE2AH.js}

@@ -3,13 +3,13 @@ import {
   apiRequest,
   fetchProperties,
   getApplicationArg
-} from "./chunk-UAJUZLDE.js";
-import "./chunk-3CZU7XCS.js";
+} from "./chunk-PVWG3V62.js";
+import "./chunk-PWZ4ULCB.js";
 import {
   getArgValue,
   hasFlag,
   resolveConfig
-} from "./chunk-IGHDIWZU.js";
+} from "./chunk-VYTIJ6HJ.js";
 import "./chunk-32P26BZT.js";
 import "./chunk-JWHYXEA2.js";
 import "./chunk-GZVCNYR4.js";
@@ -290,4 +290,4 @@ async function runCredentialTemplate(argv) {
 export {
   runCredentialTemplate
 };
-//# sourceMappingURL=credential-template-GD3D4MBI.js.map
+//# sourceMappingURL=credential-template-Q3DQE2AH.js.map

package/dist/{debug-workflow-AAEOAME2.js → debug-workflow-ZNP5XZQF.js}

@@ -1,8 +1,8 @@
 import { createRequire as __cr } from "module"; const require = __cr(import.meta.url);
 import {
   downloadStorageState
-} from "./chunk-UAJUZLDE.js";
-import "./chunk-3CZU7XCS.js";
+} from "./chunk-PVWG3V62.js";
+import "./chunk-PWZ4ULCB.js";
 import {
   acquireCloudLock,
   createSessionWithRelay,
@@ -13,7 +13,7 @@ import {
   getArgValue,
   hasFlag,
   resolveConfig
-} from "./chunk-IGHDIWZU.js";
+} from "./chunk-VYTIJ6HJ.js";
 import "./chunk-32P26BZT.js";
 import "./chunk-JWHYXEA2.js";
 import "./chunk-GZVCNYR4.js";
@@ -257,4 +257,4 @@ async function runDebugWorkflow(argv) {
 export {
   runDebugWorkflow
 };
-//# sourceMappingURL=debug-workflow-AAEOAME2.js.map
+//# sourceMappingURL=debug-workflow-ZNP5XZQF.js.map

package/dist/{dist-QLTVBUMD.js → dist-4COOAKY3.js}

@@ -3,8 +3,12 @@ import {
   BROWSER_LIFECYCLE_TOOLS,
   BrowserToolExecutor,
   CdpScreencastManager,
+  CpuOffloadPool,
+  CpuOffloadTimeoutError,
+  CpuOffloadWorkerError,
   CursorOverlay,
   DEFAULTS,
+  DEFAULT_CPU_OFFLOAD_TIMEOUT_MS,
   DEFAULT_VIEWPORT,
   FfmpegProcess,
   LARGE_GRID_CHAR_THRESHOLD,
@@ -34,9 +38,11 @@ import {
   compareEditingContexts,
   compareSnapshots,
   computeFingerprint,
+  configureCpuOffload,
   consoleLogger,
   cropImage,
   decodeV2Value,
+  defaultCpuOffloadSize,
   detectGrid,
   detectModal,
   detectModalFromYaml,
@@ -82,6 +88,7 @@ import {
   formatGridRow,
   formatSemanticDiff,
   formatSemanticSnapshot,
+  formatSnapshotMaybeOffloaded,
   getBrowserToolDefinitions,
   getBrowserToolDefinitionsWithLifecycle,
   getConsolidatedBrowserToolDefinitions,
@@ -92,6 +99,7 @@ import {
   hashFingerprint,
   highlightElement,
   identifyLargeGridRefs,
+  isCpuOffloadEnabled,
   isFfmpegAvailable,
   isMCPContentWithImages,
   isStableElement,
@@ -107,17 +115,19 @@ import {
   populateSearchContext,
   reconcileCellColumn,
   renderIfTimeout,
+  resolveCpuOffloadWorkerPath,
   restoreIndexedDB,
   searchElements,
   setCdpScreencastLogger,
   setPdfExtractLogger,
   setSnapshotAnalyzerLogger,
+  shutdownCpuOffload,
   sortMatchesByContext,
   withBrowserLaunchRetry,
   withRecoveryNotice,
   withRecoveryNoticeMCP,
   withToolTimeout
-} from "./chunk-AI3Y3AZH.js";
+} from "./chunk-7OO3RJYR.js";
 import "./chunk-JWHYXEA2.js";
 import "./chunk-GZVCNYR4.js";
 import "./chunk-6LEZCKKV.js";
@@ -126,8 +136,12 @@ export {
   BROWSER_LIFECYCLE_TOOLS,
   BrowserToolExecutor,
   CdpScreencastManager,
+  CpuOffloadPool,
+  CpuOffloadTimeoutError,
+  CpuOffloadWorkerError,
   CursorOverlay,
   DEFAULTS,
+  DEFAULT_CPU_OFFLOAD_TIMEOUT_MS,
   DEFAULT_VIEWPORT,
   FfmpegProcess,
   LARGE_GRID_CHAR_THRESHOLD,
@@ -158,9 +172,11 @@ export {
   compareEditingContexts,
   compareSnapshots,
   computeFingerprint,
+  configureCpuOffload,
   consoleLogger,
   cropImage,
   decodeV2Value,
+  defaultCpuOffloadSize,
   detectGrid,
   detectModal,
   detectModalFromYaml,
@@ -206,6 +222,7 @@ export {
   formatGridRow,
   formatSemanticDiff,
   formatSemanticSnapshot,
+  formatSnapshotMaybeOffloaded,
   getBrowserToolDefinitions,
   getBrowserToolDefinitionsWithLifecycle,
   getConsolidatedBrowserToolDefinitions,
@@ -216,6 +233,7 @@ export {
   hashFingerprint,
   highlightElement,
   identifyLargeGridRefs,
+  isCpuOffloadEnabled,
   isFfmpegAvailable,
   isMCPContentWithImages,
   isStableElement,
@@ -231,15 +249,17 @@ export {
   populateSearchContext,
   reconcileCellColumn,
   renderIfTimeout,
+  resolveCpuOffloadWorkerPath,
   restoreIndexedDB,
   searchElements,
   setCdpScreencastLogger,
   setPdfExtractLogger,
   setSnapshotAnalyzerLogger,
+  shutdownCpuOffload,
   sortMatchesByContext,
   withBrowserLaunchRetry,
   withRecoveryNotice,
   withRecoveryNoticeMCP,
   withToolTimeout
 };
-//# sourceMappingURL=dist-QLTVBUMD.js.map
+//# sourceMappingURL=dist-4COOAKY3.js.map

package/dist/{docs-BVUEXBY3.js → docs-XVU4LA7G.js}

@@ -1,13 +1,13 @@
 import { createRequire as __cr } from "module"; const require = __cr(import.meta.url);
 import {
   apiRequest
-} from "./chunk-UAJUZLDE.js";
-import "./chunk-3CZU7XCS.js";
+} from "./chunk-PVWG3V62.js";
+import "./chunk-PWZ4ULCB.js";
 import {
   getArgValue,
   hasFlag,
   resolveConfig
-} from "./chunk-IGHDIWZU.js";
+} from "./chunk-VYTIJ6HJ.js";
 import "./chunk-32P26BZT.js";
 import {
   getSubDir
@@ -448,4 +448,4 @@ async function runDocs(argv) {
 export {
   runDocs
 };
-//# sourceMappingURL=docs-BVUEXBY3.js.map
+//# sourceMappingURL=docs-XVU4LA7G.js.map

package/dist/{doctor-RHMKD4W5.js → doctor-PGNHD3TI.js}

@@ -2,13 +2,13 @@ import { createRequire as __cr } from "module"; const require = __cr(import.meta
 import {
   apiFetch,
   decodeJwtPayload
-} from "./chunk-3CZU7XCS.js";
+} from "./chunk-PWZ4ULCB.js";
 import {
   ENV_URLS,
   envToProfile,
   getArgValue,
   readStoredAuth
-} from "./chunk-IGHDIWZU.js";
+} from "./chunk-VYTIJ6HJ.js";
 import {
   readBrandEnv
 } from "./chunk-32P26BZT.js";
@@ -133,4 +133,4 @@ async function runAuthDoctor(argv) {
 export {
   runAuthDoctor
 };
-//# sourceMappingURL=doctor-RHMKD4W5.js.map
+//# sourceMappingURL=doctor-PGNHD3TI.js.map

package/dist/{environment-WE7VVE6I.js → environment-MRDNWU47.js}

@@ -2,13 +2,13 @@ import { createRequire as __cr } from "module"; const require = __cr(import.meta
 import {
   apiRequest,
   fetchProperties
-} from "./chunk-UAJUZLDE.js";
-import "./chunk-3CZU7XCS.js";
+} from "./chunk-PVWG3V62.js";
+import "./chunk-PWZ4ULCB.js";
 import {
   getArgValue,
   hasFlag,
   resolveConfig
-} from "./chunk-IGHDIWZU.js";
+} from "./chunk-VYTIJ6HJ.js";
 import "./chunk-32P26BZT.js";
 import "./chunk-JWHYXEA2.js";
 import "./chunk-GZVCNYR4.js";
@@ -218,4 +218,4 @@ async function runEnvironment(argv) {
 export {
   runEnvironment
 };
-//# sourceMappingURL=environment-WE7VVE6I.js.map
+//# sourceMappingURL=environment-MRDNWU47.js.map

package/dist/{feature-flag-VJO2TJFT.js → feature-flag-D3DQZ6DX.js}

@@ -4,13 +4,13 @@ import {
   fetchList,
   parseLifecycleStage,
   toLifecycleLabel
-} from "./chunk-UAJUZLDE.js";
-import "./chunk-3CZU7XCS.js";
+} from "./chunk-PVWG3V62.js";
+import "./chunk-PWZ4ULCB.js";
 import {
   getArgValue,
   hasFlag,
   resolveConfig
-} from "./chunk-IGHDIWZU.js";
+} from "./chunk-VYTIJ6HJ.js";
 import "./chunk-32P26BZT.js";
 import "./chunk-JWHYXEA2.js";
 import "./chunk-GZVCNYR4.js";
@@ -429,4 +429,4 @@ async function runFeatureFlag(argv) {
 export {
   runFeatureFlag
 };
-//# sourceMappingURL=feature-flag-VJO2TJFT.js.map
+//# sourceMappingURL=feature-flag-D3DQZ6DX.js.map

package/dist/index.js

@@ -1,16 +1,17 @@
 import { createRequire as __cr } from "module"; const require = __cr(import.meta.url);
 import {
   runRemoteTest
-} from "./chunk-LFFWD5JZ.js";
-import "./chunk-DT2CEH2V.js";
-import "./chunk-UAJUZLDE.js";
+} from "./chunk-IHCPMYKU.js";
+import "./chunk-VHVOTGBQ.js";
+import "./chunk-PVWG3V62.js";
 import {
+  debug,
   fetchOrExit,
   isSuperadminToken
-} from "./chunk-3CZU7XCS.js";
+} from "./chunk-PWZ4ULCB.js";
 import {
   runLogin
-} from "./chunk-G5SXUXSU.js";
+} from "./chunk-H7ZML5QL.js";
 import {
   checkForUpdate
 } from "./chunk-AQPJQ5AE.js";
@@ -20,9 +21,10 @@ import {
   hasFlag,
   readAllStoredTokens,
   readStoredAuth,
+  resolveAuthSource,
   resolveConfig,
   resolveOptionalConfig
-} from "./chunk-IGHDIWZU.js";
+} from "./chunk-VYTIJ6HJ.js";
 import {
   installConsoleBranding,
   readBrandEnv,
@@ -444,8 +446,7 @@ async function createCliUserEventRecorder(argv, cliVersion) {
       origin: "cli",
       onError: (error) => {
         const message = error instanceof Error ? error.message : String(error);
-        process3.stderr.write(`[canary] user event tracking skipped: ${message}
-`);
+        debug(`user event tracking skipped: ${message}`);
       }
     }),
     metadata: buildBaseMetadata(argv, cliVersion, config.apiUrl)
@@ -476,11 +477,11 @@ async function recordCliInstrumentationFailure(argv, cliVersion, stage, error) {
 }
 
 // src/index.ts
-var loadMcp = () => import("./mcp-GC2WOOZO.js").then((m) => m.runMcp);
-var loadDebugWorkflow = () => import("./debug-workflow-AAEOAME2.js").then((m) => m.runDebugWorkflow);
-var loadRecord = () => import("./record-HL4QA7OX.js").then((m) => m.runRecord);
-var loadSession = () => import("./session-X6IYGWYG.js").then((m) => m.runSession);
-var loadLocal = () => import("./local-CMAY54I5.js").then((m) => m.runLocal);
+var loadMcp = () => import("./mcp-57VVZTXM.js").then((m) => m.runMcp);
+var loadDebugWorkflow = () => import("./debug-workflow-ZNP5XZQF.js").then((m) => m.runDebugWorkflow);
+var loadRecord = () => import("./record-RWVGZZSW.js").then((m) => m.runRecord);
+var loadSession = () => import("./session-GDCMTNB3.js").then((m) => m.runSession);
+var loadLocal = () => import("./local-NSKOZHHA.js").then((m) => m.runLocal);
 function printVersion() {
   console.log(`canary v${version}`);
 }
@@ -804,7 +805,7 @@ async function executeCommand(command, rest) {
     return;
   }
   if (command === "install") {
-    const { runInstall } = await import("./install-CQLHNZ6U.js");
+    const { runInstall } = await import("./install-DMEFGQHD.js");
     await runInstall(rest);
     return;
   }
@@ -841,79 +842,79 @@ async function executeCommand(command, rest) {
     return;
   }
   if (command === "psql") {
-    const { runPsql } = await import("./psql-XGLBI6T7.js");
+    const { runPsql } = await import("./psql-4JHPJ2CO.js");
     await runPsql(rest);
     return;
   }
   if (command === "redis") {
-    const { runRedis } = await import("./redis-VJGCUJPV.js");
+    const { runRedis } = await import("./redis-N44ZZ6VB.js");
     await runRedis(rest);
     return;
   }
   if (command === "release") {
-    const { runRelease } = await import("./release-2SMK5Y3V.js");
+    const { runRelease } = await import("./release-R7GKLEAI.js");
     await runRelease(rest);
     return;
   }
   if (command === "docs") {
-    const { runDocs } = await import("./docs-BVUEXBY3.js");
+    const { runDocs } = await import("./docs-XVU4LA7G.js");
     await runDocs(rest);
     return;
   }
   if (command === "feature-flag") {
-    const { runFeatureFlag } = await import("./feature-flag-VJO2TJFT.js");
+    const { runFeatureFlag } = await import("./feature-flag-D3DQZ6DX.js");
     await runFeatureFlag(rest);
     return;
   }
   if (command === "product") {
-    const { runProduct } = await import("./product-BUJWPYKB.js");
+    const { runProduct } = await import("./product-WGOLTBRI.js");
     await runProduct(rest);
     return;
   }
   if (command === "metrics") {
-    const { runMetrics } = await import("./metrics-IXICURAA.js");
+    const { runMetrics } = await import("./metrics-DM4YQQZN.js");
     await runMetrics(rest);
     return;
   }
   if (command === "account") {
-    const { runAccount } = await import("./account-ZMV7NEFM.js");
+    const { runAccount } = await import("./account-ZSM2Q3RB.js");
     await runAccount(rest);
     return;
   }
   if (command === "scenarios" || command === "scenario") {
-    const { runScenarios } = await import("./scenarios-DM5FDCAF.js");
+    const { runScenarios } = await import("./scenarios-WUUUKP2S.js");
     await runScenarios(rest);
     return;
   }
   if (command === "knobs") {
-    const { runKnobs } = await import("./knobs-ETJAV6YM.js");
+    const { runKnobs } = await import("./knobs-NA6SPLHX.js");
     await runKnobs(rest);
     return;
   }
   if (command === "issues") {
-    const { runIssues } = await import("./issues-HK2JA5JS.js");
+    const { runIssues } = await import("./issues-E4YQ4DVC.js");
     await runIssues(rest);
     return;
   }
   if (command === "credential") {
-    const { runCredential } = await import("./credential-X6QKX473.js");
+    const { runCredential } = await import("./credential-WOATCWOU.js");
     await runCredential(rest);
     return;
   }
   if (command === "persona" || command === "personas" || // Backwards-compat aliases for the former "credential template" name.
   command === "credential-template" || command === "credential-templates") {
-    const { runCredentialTemplate } = await import("./credential-template-GD3D4MBI.js");
+    const { runCredentialTemplate } = await import("./credential-template-Q3DQE2AH.js");
     await runCredentialTemplate(rest);
     return;
   }
   if (command === "workflow") {
-    const { runWorkflow } = await import("./workflow-DC7WOTTW.js");
+    const { runWorkflow } = await import("./workflow-5BFRS4CE.js");
     await runWorkflow(rest);
     return;
   }
   if (command === "spec") {
-    const { resolveConfig: resolveConfig2 } = await import("./auth-DURHUZDW.js");
-    const { handleSpec } = await import("./spec-KO5QD6AY.js");
+    const { resolveConfig: resolveConfig2 } = await import("./auth-OYF5A4BY.js");
+    const { handleSpec } = await import("./spec-ESPA3H26.js");
     const wantsAuth = rest[0] === "compile" || rest[0] === "pull" || rest[0] === "diff";
     if (wantsAuth) {
       const { apiUrl, token } = await resolveConfig2(rest);
@@ -924,8 +925,8 @@ async function executeCommand(command, rest) {
     return;
   }
   if (command === "augmentor" || command === "augmentors") {
-    const { resolveConfig: resolveConfig2 } = await import("./auth-DURHUZDW.js");
-    const { runAugmentor } = await import("./augmentor-7T3L6ZR4.js");
+    const { resolveConfig: resolveConfig2 } = await import("./auth-OYF5A4BY.js");
+    const { runAugmentor } = await import("./augmentor-LSJLMJYP.js");
     if (rest[0] === void 0 || rest[0] === "help" || rest[0] === "--help") {
       await runAugmentor(rest, "", "");
     } else {
@@ -935,71 +936,71 @@ async function executeCommand(command, rest) {
     return;
   }
   if (command === "api-catalog") {
-    const { resolveConfig: resolveConfig2 } = await import("./auth-DURHUZDW.js");
-    const { runApiCatalog } = await import("./api-catalog-6HNOGVPA.js");
+    const { resolveConfig: resolveConfig2 } = await import("./auth-OYF5A4BY.js");
+    const { runApiCatalog } = await import("./api-catalog-MMPFWS52.js");
     const { apiUrl, token } = await resolveConfig2(rest);
     await runApiCatalog(rest, apiUrl, token);
     return;
   }
   if (command === "skill" || command === "skills") {
-    const { runSkill } = await import("./skill-ZU5V2EE5.js");
+    const { runSkill } = await import("./skill-3SP7MAA4.js");
     await runSkill(rest);
     return;
   }
   if (command === "task") {
-    const { runTask } = await import("./task-V3JMSJIM.js");
+    const { runTask } = await import("./task-PRR75HI4.js");
     await runTask(rest);
     return;
   }
   if (command === "test-suite") {
-    const { runTestSuite } = await import("./test-suite-NOYVK6YX.js");
+    const { runTestSuite } = await import("./test-suite-O3UY7EER.js");
     await runTestSuite(rest);
     return;
   }
   if (command === "triage") {
-    const { runTriage } = await import("./triage-4RFATHBE.js");
+    const { runTriage } = await import("./triage-2BKUBMMX.js");
     await runTriage(rest);
     return;
   }
   if (command === "application" || command === "applications" || command === "property" || command === "properties") {
-    const { runProperty } = await import("./property-4EXPWRNT.js");
+    const { runProperty } = await import("./property-B7QMGLVW.js");
     await runProperty(rest);
     return;
   }
   if (command === "environment" || command === "env") {
-    const { runEnvironment } = await import("./environment-WE7VVE6I.js");
+    const { runEnvironment } = await import("./environment-MRDNWU47.js");
     await runEnvironment(rest);
     return;
   }
   if (command === "sandbox") {
-    const { runSandbox } = await import("./sandbox-ORAPKOH3.js");
+    const { runSandbox } = await import("./sandbox-6D54ZQCG.js");
     await runSandbox(rest);
     return;
   }
   if (command === "attachment" || command === "attachments") {
-    const { runAttachment } = await import("./attachment-QAHR54HQ.js");
+    const { runAttachment } = await import("./attachment-NSYL5X3S.js");
     await runAttachment(rest);
     return;
   }
   if (command === "utilities") {
-    const { runUtilities } = await import("./utilities-3WMXE743.js");
+    const { runUtilities } = await import("./utilities-O3OO64T5.js");
     await runUtilities(rest);
     return;
   }
   if (command === "tag" || command === "tags") {
-    const { runTag } = await import("./tag-R5I72HJ6.js");
+    const { runTag } = await import("./tag-DAGHQZAR.js");
     await runTag(rest);
     return;
   }
   if (command === "trace") {
-    const { runTrace } = await import("./trace-NOYEKNO4.js");
+    const { runTrace } = await import("./trace-7LRHSPWN.js");
     await runTrace(rest);
     return;
   }
   if (command === "auth") {
     const sub = rest[0];
     if (sub === "doctor") {
-      const { runAuthDoctor } = await import("./doctor-RHMKD4W5.js");
+      const { runAuthDoctor } = await import("./doctor-PGNHD3TI.js");
       await runAuthDoctor(rest.slice(1));
       return;
     }
@@ -1033,8 +1034,10 @@ async function main(argv) {
     printVersion();
     return;
   }
-  if (command && COMMANDS_WITH_UPDATE_CHECK.has(command)) {
-    await checkForUpdate(version);
+  if (command && COMMANDS_WITH_UPDATE_CHECK.has(command) && !wantsMachineOutput) {
+    if (await resolveAuthSource(argv) === "stored") {
+      await checkForUpdate(version);
+    }
   }
   let tracking = null;
   try {