npm - @runcofactor/cli - Versions diffs - 0.54.0 → 0.56.0 - Mend

@runcofactor/cli 0.54.0 → 0.56.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (253) hide show

package/dist/chunk-4MFMPC5P.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../src/auth.ts","../src/api-fetch.ts","../src/debug.ts","../src/argv.ts","../src/jwt.ts","../src/default-urls.ts"],"sourcesContent":["import fs from 'node:fs/promises';\nimport os from 'node:os';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { readBrandEnv } from './brand.js';\nimport { setActingTarget } from './api-fetch.js';\nimport { DEFAULT_API_URL, DEFAULT_APP_URL } from './default-urls.js';\nimport { isFreeTextFlag, isFreeTextValue } from './argv.js';\n\nexport type StoredAuth = {\n token?: string;\n apiUrl?: string;\n orgId?: string;\n orgName?: string;\n /**\n * The org's vanity app subdomain at login time, when it has one. Cached so\n * printed links land on the org's own host without a lookup per command.\n *\n * May go stale if the org is later renamed; retired labels redirect to the\n * current host, so a stale value costs a redirect rather than a dead link.\n */\n appSubdomain?: string | null;\n /**\n * Which environment this session belongs to (`production` | `dev` | `local` |\n * custom). Purely for display/filtering — `apiUrl` already encodes the env —\n * so the same org can hold a session in more than one environment at once.\n */\n envLabel?: string;\n /**\n * `ade`: the login inside an ADE session, written by the guest's `ade-init`.\n * Its `token` is a 15-min ADE JWT that the CLI re-exchanges from `adeToken`\n * (the session's per-claim CLI token) at `POST /auth/ade/token` as it nears\n * expiry, never through `/auth/refresh`. Absent for an ordinary login.\n */\n kind?: 'ade';\n adeToken?: string;\n /** ISO time the `ade` profile's `token` expires. */\n tokenExpiresAt?: string;\n};\n\n/** Multi-profile auth file format */\ntype MultiProfileAuth = {\n profiles: Record<string, StoredAuth>;\n default: string;\n};\n\n/** Legacy flat format (single profile) */\ntype LegacyAuth = StoredAuth;\n\n/**\n * Resolve where the multi-profile auth file lives. Honors a\n * `CANARY_CONFIG_DIR` / `COFACTOR_CONFIG_DIR` override (for non-standard config\n * locations and tests), else the default `~/.config/canary-cli`.\n */\nfunction getAuthPaths(): { dir: string; file: string } {\n const dir = readBrandEnv('CANARY_CONFIG_DIR') ?? defaultConfigDir();\n return { dir, file: path.join(dir, 'auth.json') };\n}\n\n/** The standard config directory, ignoring any `CANARY_CONFIG_DIR` override. */\nexport function defaultConfigDir(): string {\n return path.join(os.homedir(), '.config', 'canary-cli');\n}\n\n/** The config directory this invocation reads and writes sessions in. */\nexport function activeConfigDir(): string {\n return getAuthPaths().dir;\n}\n\n/* ── Shared argv helpers ─────────────────────────────────────────────── */\n\nexport function getArgValue(argv: string[], key: string): string | undefined {\n for (let i = 0; i < argv.length; i++) {\n const token = argv[i];\n if (token === key) return i < argv.length - 1 ? argv[i + 1] : undefined;\n if (token.startsWith(`${key}=`)) return token.slice(key.length + 1);\n }\n return undefined;\n}\n\n/** The flag an argument starts with, without its value: errors must not echo a fused `--token`. */\nfunction flagName(token: string): string {\n return token.trim().split(/[\\s=]/)[0];\n}\n\n/** Global flags that always take a value; a missing value must never fall back to the default profile. */\nexport const GLOBAL_VALUE_FLAGS = ['--org', '--env', '--api-url', '--target-org', '--token'];\n\n/**\n * Reject argv that the flag parser would silently misread, before any command\n * resolves credentials. An ignored `--org` / `--env` quietly retargets the\n * default profile (often prod), so these are hard errors:\n * - one token holding several flags (`\"--org X --env dev\"`, from an unquoted\n * zsh variable, which zsh does not word-split);\n * - a global value flag with no value, or whose value holds another flag.\n * The free-text value of a flag such as `--description` is not checked, so\n * `--description \"--org Acme\"` passes, unless it starts with `--org=`, which\n * getArgValue would read as the selector. zsh drops an empty unquoted `$DESC`, so\n * `--description $DESC $SEL` also passes, with the selector as the description:\n * the argv is identical, and that case is accepted. Errors name the flag only:\n * a fused `--token` would otherwise print the credential.\n */\nexport function assertWellFormedGlobalFlags(argv: string[]): void {\n const refuse = (message: string): never => {\n console.error(`Error: ${message}`);\n process.exit(1);\n };\n for (let i = 0; i < argv.length; i++) {\n const token = argv[i];\n if (isFreeTextValue(argv, i)) {\n // getArgValue reads any `--org=...` word as the selector, even as another flag's value.\n if (token.includes('=') && GLOBAL_VALUE_FLAGS.includes(token.split('=')[0])) {\n refuse(`the value of ${argv[i - 1]} starts with ${flagName(token)}=, which the CLI would read as ${flagName(token)}.`);\n }\n continue;\n }\n if (/^\\s+--/.test(token)) {\n refuse(\n `an argument starting \" ${flagName(token)}\" has leading whitespace, so its flag would be ignored. Remove the leading space.`\n );\n }\n if (!token.startsWith('--')) continue;\n const [name, ...inline] = token.split('=');\n // `--description=x --org A` is free text the user attached with `=`; `--limit=1 --org A` is fused.\n const freeTextInline = inline.length > 0 && isFreeTextFlag(name);\n if (/\\s/.test(name) || (!freeTextInline && /\\s--[\\w-]+/.test(token))) {\n refuse(\n `${flagName(token)} reached the CLI fused with what follows it, as ONE argument, so it would be ignored. ` +\n 'The shell did not split it (zsh does not word-split an unquoted $VAR). ' +\n 'Pass each flag and value as its own argument. If this is the value of another flag, attach it with = ' +\n '(--flag=--org ...) or pass it as its own argument after that flag.'\n );\n }\n if (!GLOBAL_VALUE_FLAGS.includes(name)) continue;\n const value = inline.length > 0 ? inline.join('=') : argv[i + 1];\n if (!value || (inline.length === 0 && value.startsWith('--'))) refuse(`${name} requires a value.`);\n if (/^\\s|\\s--[\\w-]+/.test(value)) {\n refuse(`the value of ${name} holds another flag or leading whitespace; pass each flag and value as its own argument.`);\n }\n }\n}\n\nexport function hasFlag(argv: string[], ...flags: string[]): boolean {\n return flags.some((flag) => argv.includes(flag));\n}\n\n/* ── Environment / profile mapping ───────────────────────────────────── */\n\n/** Map --env values to profile names for multi-profile auth storage */\nexport function envToProfile(env: string): string {\n if (env === 'prod' || env === 'production') return 'production';\n if (env === 'dev') return 'dev';\n if (env === 'local') return 'local';\n return env;\n}\n\nconst VALID_ENVS = ['prod', 'dev', 'local'];\n\n/** Environment URL mappings shared across CLI commands */\nexport const ENV_URLS: Record<string, { api: string; app: string }> = {\n prod: {\n api: DEFAULT_API_URL,\n app: DEFAULT_APP_URL,\n },\n production: {\n api: DEFAULT_API_URL,\n app: DEFAULT_APP_URL,\n },\n dev: {\n api: 'https://api.dev.runcofactor.com',\n app: 'https://app.dev.runcofactor.com',\n },\n local: {\n api: 'http://localhost:3000',\n app: 'http://localhost:5173',\n },\n};\n\n/** Reverse of `ENV_URLS`: the env label (`production`|`dev`|`local`) for an API\n * URL, or `undefined` for a custom URL. Used to tag stored sessions. */\nexport function envLabelForApiUrl(apiUrl: string): string | undefined {\n for (const [key, urls] of Object.entries(ENV_URLS)) {\n if (urls.api === apiUrl) return envToProfile(key);\n }\n return undefined;\n}\n\n/**\n * Storage key for an org's session, scoped by environment so the same org can\n * be logged into prod and dev at once without one clobbering the other\n * (`org-123@dev` vs `org-123@production`).\n */\nexport function orgProfileKey(orgId: string, envLabel?: string): string {\n return envLabel ? `${orgId}@${envLabel}` : orgId;\n}\n\n/**\n * Derive the web-app URL for a given API URL, always on the cofactor domain.\n *\n * Canary is retired as a brand, so anything we print should send people to\n * cofactor even when the session itself was established against a trycanary\n * host (those hosts stay live and keep working — only the printed link moves).\n * localhost is left alone: there is no cofactor equivalent of a dev server.\n */\nexport function resolveAppUrl(apiUrl: string): string {\n const derived = (() => {\n for (const env of Object.values(ENV_URLS)) {\n if (env.api === apiUrl) return env.app;\n }\n // Fallback for custom API URLs: replace \"api.\" at protocol boundary or \"/api\" path\n return apiUrl.replace(/(:\\/\\/)api\\./, '$1app.').replace(/:3000\\b/, ':5173');\n })();\n return derived.replace(/\\btrycanary\\.ai\\b/, 'runcofactor.com');\n}\n\n/**\n * A DNS label, matching the shape the API validates an `app_subdomain` against\n * (and the web app's `TENANT_LABEL_PATTERN`). Keep the two in sync.\n */\nconst TENANT_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;\n\n/**\n * The app URL to print for a session — the org's own host when it has a vanity\n * subdomain, otherwise the shared one.\n *\n * A link to the shared host is not wrong so much as unhelpful for an org with\n * its own host: the shared host resolves whichever org the browser session\n * happens to be on, which may not be the org the command was run against.\n *\n * A label that isn't a DNS label falls back to the shared host rather than\n * being spliced in. Today the only writer is our own API, which validates it —\n * but `hostname = \"cf/evil.\" + host` does not throw, it silently truncates the\n * host to `cf` and drops our domain entirely, so failing closed is cheap\n * insurance against a link that points somewhere unintended.\n */\nexport function resolveOrgAppUrl(apiUrl: string, appSubdomain?: string | null): string {\n const appUrl = resolveAppUrl(apiUrl);\n if (!appSubdomain || !TENANT_LABEL_PATTERN.test(appSubdomain)) return appUrl;\n\n const url = new URL(appUrl);\n // Only the cofactor app hosts carry per-org subdomains; a localhost or\n // custom host has nowhere to put the label.\n if (!url.hostname.startsWith('app.') || !url.hostname.endsWith('.runcofactor.com')) {\n return appUrl;\n }\n url.hostname = `${appSubdomain}.${url.hostname}`;\n return url.toString().replace(/\\/$/, '');\n}\n\nfunction isMultiProfile(data: unknown): data is MultiProfileAuth {\n return typeof data === 'object' && data !== null && 'profiles' in data;\n}\n\n/** Read the raw auth file and normalize to multi-profile format */\nasync function readAuthFile(configDir?: string): Promise<MultiProfileAuth | null> {\n try {\n const content = await fs.readFile(configDir ? path.join(configDir, 'auth.json') : getAuthPaths().file, 'utf8');\n const data = JSON.parse(content) as unknown;\n\n if (isMultiProfile(data)) {\n return data;\n }\n\n // Legacy flat format — treat as the \"default\" profile\n const legacy = data as LegacyAuth;\n return {\n profiles: { default: legacy },\n default: 'default',\n };\n } catch {\n return null;\n }\n}\n\nexport async function readStoredAuth(profile?: string): Promise<StoredAuth | null> {\n const auth = await readAuthFile();\n if (!auth) return null;\n\n const key = profile ?? auth.default;\n return auth.profiles[key] ?? null;\n}\n\nexport async function readStoredToken(profile?: string): Promise<string | null> {\n const auth = await readStoredAuth(profile);\n return auth?.token ?? null;\n}\n\nexport async function readStoredApiUrl(profile?: string): Promise<string | null> {\n const auth = await readStoredAuth(profile);\n return auth?.apiUrl ?? null;\n}\n\n/** Return all stored tokens across every profile */\nexport async function readAllStoredTokens(): Promise<string[]> {\n const auth = await readAuthFile();\n if (!auth) return [];\n return Object.values(auth.profiles)\n .map((p) => p.token)\n .filter((t): t is string => !!t);\n}\n\n/** An `ade` profile's JWT is re-exchanged when it has less than this left. */\nconst ADE_REFRESH_MARGIN_MS = 60_000;\nconst ADE_EXCHANGE_TIMEOUT_MS = 30_000;\n\n/**\n * The access token of an `ade` profile: its stored JWT while it has more than\n * a minute left, else a fresh one from `POST /auth/ade/token`, saved back to\n * the profile. Null only when the exchange is refused (401/403: the session\n * ended, or its user left the org); any other failure throws, so a deploy\n * blip is never reported as an ended session.\n *\n * Parallel commands may all re-exchange at once; each gets a valid JWT, and\n * the file is replaced by an atomic rename, so none reads a torn file. The\n * read-modify-rename is not locked: an `ade` profile lives alone in the\n * session's own config directory (/run/cofactor/ade/cli), so there is no\n * other profile a concurrent write could lose.\n */\nasync function freshAdeAccessToken(auth: StoredAuth): Promise<string | null> {\n if (auth.token && auth.tokenExpiresAt && Date.parse(auth.tokenExpiresAt) - Date.now() > ADE_REFRESH_MARGIN_MS) return auth.token;\n if (!auth.adeToken || !auth.apiUrl) return null;\n const response = await fetch(`${auth.apiUrl}/auth/ade/token`, {\n method: 'POST',\n headers: { 'content-type': 'application/json' },\n body: JSON.stringify({ token: auth.adeToken }),\n signal: AbortSignal.timeout(ADE_EXCHANGE_TIMEOUT_MS),\n });\n if (response.status === 401 || response.status === 403) return null;\n const body = (await response.json().catch(() => null)) as { data?: { accessToken?: unknown; expiresAt?: unknown } } | null;\n const accessToken = body?.data?.accessToken;\n const expiresAt = body?.data?.expiresAt;\n if (!response.ok || typeof accessToken !== 'string' || typeof expiresAt !== 'string') {\n throw new Error(`the ADE login could not be refreshed (HTTP ${response.status}); try again`);\n }\n const { dir, file } = getAuthPaths();\n const current = await readAuthFile();\n const key = current && Object.entries(current.profiles).find(([, profile]) => profile.adeToken === auth.adeToken)?.[0];\n if (current && key) {\n current.profiles[key] = { ...auth, token: accessToken, tokenExpiresAt: expiresAt };\n const temp = path.join(dir, `.auth.json.${process.pid}.tmp`);\n try {\n await fs.writeFile(temp, JSON.stringify(current, null, 2), { encoding: 'utf8', mode: 0o600 });\n await fs.rename(temp, file);\n } catch (error) {\n // The new JWT is valid either way; the next command re-exchanges.\n await fs.rm(temp, { force: true }).catch(() => undefined);\n console.error(`Warning: the refreshed ADE login could not be saved: ${error instanceof Error ? error.message : String(error)}`);\n }\n }\n return accessToken;\n}\n\nexport async function saveAuth(auth: StoredAuth, profile?: string): Promise<string> {\n const { dir: AUTH_DIR, file: AUTH_FILE } = getAuthPaths();\n await fs.mkdir(AUTH_DIR, { recursive: true, mode: 0o700 });\n\n // Read existing file (may be legacy or multi-profile)\n let existing: MultiProfileAuth;\n try {\n const content = await fs.readFile(AUTH_FILE, 'utf8');\n const data = JSON.parse(content) as unknown;\n\n if (isMultiProfile(data)) {\n existing = data;\n } else {\n // Migrate legacy flat format into profiles.default\n existing = {\n profiles: { default: data as LegacyAuth },\n default: 'default',\n };\n }\n } catch {\n existing = { profiles: {}, default: 'default' };\n }\n\n const key = profile ?? 'default';\n existing.profiles[key] = auth;\n\n // Set default to this profile if no default exists yet\n if (!existing.profiles[existing.default]) {\n existing.default = key;\n }\n\n await fs.writeFile(AUTH_FILE, JSON.stringify(existing, null, 2), {\n encoding: 'utf8',\n mode: 0o600,\n });\n // writeFile's mode only applies on creation; enforce 0600 on overwrite too.\n await fs.chmod(AUTH_FILE, 0o600).catch(() => {});\n return AUTH_FILE;\n}\n\n/* ── Multi-org session lookup ────────────────────────────────────────── */\n\nexport type StoredProfile = { key: string; auth: StoredAuth };\n\n/** Enumerate every stored session (profile) plus the current default key. */\nexport async function readAllProfiles(): Promise<{\n profiles: StoredProfile[];\n default: string;\n}> {\n const auth = await readAuthFile();\n if (!auth) return { profiles: [], default: 'default' };\n return {\n profiles: Object.entries(auth.profiles).map(([key, a]) => ({ key, auth: a })),\n default: auth.default,\n };\n}\n\nexport type SessionMatch =\n | { kind: 'match'; key: string; auth: StoredAuth }\n | { kind: 'none' }\n | { kind: 'ambiguous'; candidates: StoredProfile[] };\n\n/**\n * Find the stored session for an org, selected by `orgId` (exact) or `orgName`\n * (case-insensitive). When `env` is given it narrows to sessions in that\n * environment, so the same org can be logged in across prod/dev without clashing.\n * Returns `ambiguous` when a bare name matches sessions in multiple envs.\n * `apiUrl` replaces the env filter: it selects a login made with a custom `--api-url`\n * (no env label) by exact API URL, so callers pass `env` or `apiUrl`, never both.\n */\nexport async function findSessionByOrg(\n selector: string,\n env?: string,\n configDir?: string,\n apiUrl?: string\n): Promise<SessionMatch> {\n const auth = await readAuthFile(configDir);\n if (!auth) return { kind: 'none' };\n\n const sel = selector.toLowerCase();\n const all = Object.entries(auth.profiles).map(([key, a]) => ({ key, auth: a }));\n\n // Exact orgId match is unambiguous — prefer it over name matches.\n const byId = all.filter(({ auth: a }) => a.orgId === selector);\n let candidates = byId.length > 0 ? byId : all.filter(({ auth: a }) => a.orgName?.toLowerCase() === sel);\n\n // When --env is given, restrict to sessions in that environment — ALWAYS, even\n // for a single candidate. Otherwise a lone prod session would resolve under\n // `--env dev` and its token would be sent to the dev host (fail-open). No\n // match in the requested env → fall through to `none` so the caller errors.\n if (apiUrl) {\n // A login made with a custom --api-url carries no env label; match its host exactly.\n candidates = candidates.filter(({ auth: a }) => a.apiUrl === apiUrl);\n } else if (env) {\n const wantEnv = envToProfile(env);\n const wantApi = ENV_URLS[env]?.api;\n candidates = candidates.filter(\n ({ auth: a }) => a.envLabel === wantEnv || (!!wantApi && a.apiUrl === wantApi)\n );\n }\n\n // Collapse duplicate profiles that point at the SAME session: login mirrors a\n // session under both an org-scoped key (`org@env`) and the env-name key (for\n // `--env` lookups), so identical entries must not read as an ambiguous\n // multi-env match. Comparison is by token — the JWT is the real identity — so a\n // future refactor must not \"fix\" this into trusting local orgName/orgId fields.\n // The org-scoped key sorts first (written first), so it survives as representative.\n if (candidates.length > 1) {\n const seen = new Map<string, StoredProfile>();\n for (const c of candidates) {\n const idKey = c.auth.token ?? c.key;\n if (!seen.has(idKey)) seen.set(idKey, c);\n }\n candidates = [...seen.values()];\n }\n\n // `login` writes the org-scoped key (`orgProfileKey`) on every login, but the\n // env-name mirror (`production`, `dev`, …) only on `login --env`. After\n // `login --org X --env prod` then a plain `login --org X`, the mirror holds an\n // older token for the same org and env, and `--org X --env prod` failed as\n // ambiguous. The org-scoped key is the latest login for that org and env, so\n // it wins over its own mirror — deliberately, even if that login was another\n // user. The mirror's orgId/envLabel only decide which entry is discarded; the\n // survivor already passed the selector and env filter above.\n if (candidates.length > 1) {\n const keys = new Set(candidates.map((c) => c.key));\n const isShadowedEnvMirror = ({ key, auth: a }: StoredProfile) =>\n !!a.orgId && !!a.envLabel && key === a.envLabel && keys.has(orgProfileKey(a.orgId, a.envLabel));\n candidates = candidates.filter((c) => !isShadowedEnvMirror(c));\n }\n\n if (candidates.length === 0) return { kind: 'none' };\n if (candidates.length === 1) return { kind: 'match', key: candidates[0].key, auth: candidates[0].auth };\n return { kind: 'ambiguous', candidates };\n}\n\n/** Point the persistent `default` at an existing profile key. */\nexport async function setDefaultProfile(key: string): Promise<void> {\n const auth = await readAuthFile();\n if (!auth || !auth.profiles[key]) {\n throw new Error(`No stored session for profile \"${key}\".`);\n }\n auth.default = key;\n const { dir: AUTH_DIR, file: AUTH_FILE } = getAuthPaths();\n await fs.mkdir(AUTH_DIR, { recursive: true, mode: 0o700 });\n await fs.writeFile(AUTH_FILE, JSON.stringify(auth, null, 2), {\n encoding: 'utf8',\n mode: 0o600,\n });\n // writeFile's mode only applies on creation; enforce 0600 on overwrite too.\n await fs.chmod(AUTH_FILE, 0o600).catch(() => {});\n}\n\n/* ── Shared config resolution ────────────────────────────────────────── */\n\ntype ResolvedConfig = {\n apiUrl: string;\n token: string;\n /**\n * The selected org's vanity app subdomain, when the invocation resolved to a\n * stored session that has one. Carried here so any command can print a link\n * on the org's own host via {@link resolveOrgAppUrl} without re-reading the\n * auth file or widening its own signature.\n *\n * Undefined for token-only auth (`--token`, `CANARY_API_TOKEN`), where there\n * is no stored profile to read it from — those callers get the shared host,\n * which is the same link they get today.\n */\n appSubdomain?: string | null;\n};\n\n/**\n * Which stored session an invocation targets, before falling back to `--env`\n * profile / default. Returns the org selector string when one is in play (from\n * `--org` or `CANARY_ORG`), else `null`. With `--env` the selector still applies:\n * the (org, env) pair must resolve to one session or the command fails, so\n * `CANARY_ORG` is never silently dropped.\n */\nexport function getOrgSelector(argv: string[]): string | null {\n return getArgValue(argv, '--org') || (readBrandEnv('CANARY_ORG') ?? null);\n}\n\n/**\n * The API URL for this invocation, with no token and no `--org` session: `--api-url`, then `--env`,\n * then the env var, then the stored login's URL, then production. An unknown `--env` falls through:\n * `resolveConfig` rejects it before getting here, but callers that skip it (guides, which need no\n * login) get no validation and no `--org` session lookup.\n */\nexport async function resolveApiUrl(argv: string[]): Promise<string> {\n const env = getArgValue(argv, '--env');\n const profile = env ? envToProfile(env) : undefined;\n return (\n getArgValue(argv, '--api-url') ??\n (env ? ENV_URLS[env]?.api : undefined) ??\n readBrandEnv('CANARY_API_URL') ??\n (await readStoredApiUrl(profile)) ??\n DEFAULT_API_URL\n );\n}\n\nasync function resolveConfigInternal(\n argv: string[],\n opts: { required: boolean }\n): Promise<ResolvedConfig | null> {\n const env = getArgValue(argv, '--env');\n const profile = env ? envToProfile(env) : undefined;\n\n if (env && !ENV_URLS[env]) {\n if (opts.required) {\n console.error(`Unknown environment: ${env}`);\n console.error(`Valid environments: ${VALID_ENVS.join(', ')}`);\n process.exit(1);\n }\n return null;\n }\n\n // `--org <name|id>` (or CANARY_ORG) picks one of your logged-in sessions to\n // act as. It's an opt-in selector layered on top of the existing --env /\n // default resolution — a bare command with no --org behaves exactly as before.\n const orgSelector = getOrgSelector(argv);\n let selectedAuth: StoredAuth | null = null;\n if (orgSelector) {\n const match = await findSessionByOrg(orgSelector, env);\n if (match.kind === 'none') {\n if (opts.required) {\n printNoSessionForOrg(orgSelector, await readAllProfiles());\n process.exit(1);\n }\n return null;\n }\n if (match.kind === 'ambiguous') {\n if (opts.required) {\n printAmbiguousOrg(orgSelector, match.candidates);\n process.exit(1);\n }\n return null;\n }\n selectedAuth = match.auth;\n }\n\n let apiUrl: string;\n if (selectedAuth) {\n // The selected session's host is authoritative: never silently repoint an\n // org's bearer token to a different host via --api-url / CANARY_API_URL.\n apiUrl = selectedAuth.apiUrl ?? DEFAULT_API_URL;\n const explicitApiUrl = getArgValue(argv, '--api-url');\n if (explicitApiUrl && explicitApiUrl !== apiUrl) {\n if (opts.required) {\n console.error(`Error: the \"${orgSelector}\" session uses ${apiUrl}, but --api-url is ${explicitApiUrl}.`);\n console.error('Omit --api-url, or log that org in against the other host.');\n process.exit(1);\n }\n return null;\n }\n } else {\n apiUrl = await resolveApiUrl(argv);\n }\n\n const explicitToken = getArgValue(argv, '--token');\n\n // The session the token actually came from, when it came from one at all.\n // Tracked rather than re-derived afterwards: a `??` chain over \"selected\n // session, else stored profile\" cannot tell \"this org has no subdomain\"\n // (a real `null`) from \"no session was selected\", and would graft an\n // unrelated org's vanity host onto the link — the wrong org entirely.\n let tokenSource: StoredAuth | null = null;\n\n let token: string | null;\n if (explicitToken) {\n token = explicitToken;\n } else if (selectedAuth) {\n // An --org / CANARY_ORG selection points at a specific stored session.\n token = selectedAuth.token ?? readBrandEnv('CANARY_API_TOKEN') ?? null;\n if (selectedAuth.token) tokenSource = selectedAuth;\n if (!token && opts.required) {\n console.error(`Error: No token stored for org \"${orgSelector}\".`);\n console.error(`Run: canary login --org \"${orgSelector}\"`);\n process.exit(1);\n }\n } else if (profile) {\n const storedAuth = await readStoredAuth(profile);\n token = storedAuth?.token ?? readBrandEnv('CANARY_API_TOKEN') ?? null;\n if (storedAuth?.token) tokenSource = storedAuth;\n if (!token && opts.required) {\n console.error(`Error: No token found for \"${env}\" profile.`);\n console.error(`Run: canary login --env ${env}`);\n process.exit(1);\n }\n } else {\n const envToken = readBrandEnv('CANARY_API_TOKEN');\n if (envToken) {\n token = envToken;\n } else {\n const storedAuth = await readStoredAuth();\n token = storedAuth?.token ?? null;\n if (storedAuth?.token) tokenSource = storedAuth;\n }\n if (!token && opts.required) {\n console.error('Error: No API token found.');\n console.error('Run: canary login');\n process.exit(1);\n }\n }\n\n // An ADE session's login carries a 15-min JWT, re-exchanged as it nears expiry.\n if (!explicitToken && tokenSource?.kind === 'ade') {\n token = await freshAdeAccessToken(tokenSource).catch((error: unknown) => {\n console.error(`Error: ${error instanceof Error ? error.message : String(error)}`);\n process.exit(1);\n });\n if (!token && opts.required) {\n console.error(\"Error: this ADE session's Cofactor login has ended (the session ended, or you are no longer in the org).\");\n process.exit(1);\n }\n }\n\n // An explicit --org/CANARY_ORG selection names the org outright, so it wins\n // even when its stored session held no token and the credential came from the\n // environment — `apiUrl` above already treats the selection as authoritative\n // in exactly that case, and the two must not disagree about which org this\n // invocation is acting as. Otherwise only the session that supplied the\n // credential names a host; token-only auth names no org and keeps the shared\n // one, the same link it produced before.\n const appSubdomain = (selectedAuth ?? tokenSource)?.appSubdomain ?? null;\n\n const source = selectedAuth ?? tokenSource;\n setActingTarget({\n orgName: source?.orgName ?? null,\n orgId: source?.orgId ?? null,\n env: source?.envLabel ?? env ?? null,\n apiUrl,\n });\n\n return token ? { apiUrl, token, appSubdomain } : null;\n}\n\n/** Error output when `--org`/`CANARY_ORG` names an org with no stored session. */\nexport function printNoSessionForOrg(\n selector: string,\n all: { profiles: StoredProfile[] }\n): void {\n console.error(`Error: No logged-in session for org \"${selector}\".`);\n const withOrg = all.profiles.filter((p) => p.auth.orgName || p.auth.orgId);\n if (withOrg.length > 0) {\n console.error('\\nLogged-in orgs:');\n for (const { auth: a } of withOrg) {\n const envLabel = a.envLabel ? ` [${a.envLabel}]` : '';\n console.error(` - ${a.orgName ?? '(unnamed)'} (${a.orgId ?? '?'})${envLabel}`);\n }\n }\n console.error(`\\nTo add one: canary login --org \"${selector}\"`);\n console.error(\n 'Note: --org selects which of your orgs to act as. Superadmin commands that\\n' +\n 'target a different org use --target-org instead.'\n );\n}\n\n/** Error output when a selector matches more than one session. Distinguishes an\n * env split (same org in prod+dev → narrow with --env) from a genuine name clash\n * across distinct orgs (→ select by org ID, --env won't help). */\nexport function printAmbiguousOrg(selector: string, candidates: StoredProfile[]): void {\n const distinctOrgs = new Set(candidates.map((c) => c.auth.orgId ?? c.key));\n if (distinctOrgs.size <= 1) {\n console.error(`Error: Org \"${selector}\" is logged into multiple environments. Narrow with --env:`);\n } else {\n console.error(`Error: \"${selector}\" matches multiple orgs. Select by org ID:`);\n }\n for (const { auth: a } of candidates) {\n const envLabel = a.envLabel ?? '(unknown env)';\n console.error(` - ${a.orgName ?? '(unnamed)'} (${a.orgId ?? '?'}) [${envLabel}]`);\n }\n}\n\n/**\n * Resolve API URL and auth token from argv flags, env vars, and stored profiles.\n * Used by knobs, feature-flag, release, and debug-session commands.\n */\nexport async function resolveConfig(argv: string[]): Promise<ResolvedConfig> {\n return (await resolveConfigInternal(argv, { required: true }))!;\n}\n\nexport async function resolveOptionalConfig(argv: string[]): Promise<ResolvedConfig | null> {\n return resolveConfigInternal(argv, { required: false });\n}\n\n/**\n * Where the effective auth token would come from for this invocation:\n * - `flag` — explicit `--token`\n * - `env` — CANARY_API_TOKEN / COFACTOR_API_TOKEN\n * - `stored` — an interactive `canary login` session in auth.json\n * - `none` — no token resolvable\n *\n * Mirrors the precedence in `resolveConfigInternal` exactly (which differs by\n * whether a profile is selected). `stored` is the only \"logged in interactively\"\n * source; `flag`/`env` are API-key style auth used by CI/automation.\n */\nexport async function resolveAuthSource(\n argv: string[]\n): Promise<'flag' | 'env' | 'stored' | 'none'> {\n const env = getArgValue(argv, '--env');\n if (env && !ENV_URLS[env]) return 'none';\n const profile = env ? envToProfile(env) : undefined;\n\n if (getArgValue(argv, '--token')) return 'flag';\n\n const orgSelector = getOrgSelector(argv);\n if (orgSelector) {\n const match = await findSessionByOrg(orgSelector, env);\n if (match.kind === 'match' && match.auth.token) return 'stored';\n if (readBrandEnv('CANARY_API_TOKEN')) return 'env';\n return 'none';\n }\n\n if (profile) {\n // With a profile, stored auth wins over the env var.\n if (await readStoredToken(profile)) return 'stored';\n if (readBrandEnv('CANARY_API_TOKEN')) return 'env';\n return 'none';\n }\n\n // Without a profile, the env var wins over stored auth.\n if (readBrandEnv('CANARY_API_TOKEN')) return 'env';\n if (await readStoredToken()) return 'stored';\n return 'none';\n}\n","/**\n * Central fetch wrapper for the Canary CLI.\n *\n * Exists to classify failures so corporate-proxy interference (Zscaler,\n * Netskope, Cloudflare Access, etc.) is distinguishable from real auth\n * expiry. Every non-2xx or transport error gets a specific, actionable\n * message instead of the historical blanket \"session may have expired.\"\n *\n * Set CANARY_DEBUG=1 (or pass --debug to the CLI) to log every request\n * and its classification — this is what affected users should share\n * with us or their IT/Zscaler admin.\n */\n\nimport process from 'node:process';\nimport { debug, isDebug } from './debug.js';\nimport { decodeJwtPayload } from './jwt.js';\n\n/** Header every canary API response carries. Absence => response did not come from our API. */\nconst CANARY_REQUEST_ID_HEADER = 'x-canary-request-id';\n\n/** Default per-request timeout. Zscaler-half-opened sockets have been observed\n * hanging indefinitely; the CLI should give up and classify rather than hang. */\nconst DEFAULT_TIMEOUT_MS = 30_000;\n\n/** Treat a JWT exp within this grace window as still valid — tolerates the\n * typical handful of seconds of client-clock skew so we don't mislabel a\n * 30-second-fast clock as `token-revoked`. */\nconst JWT_EXP_SKEW_SEC = 60;\n\n/**\n * Best-effort scrub of `Bearer <token>` and bare three-segment JWTs from\n * error text before we print it. Doctor output is explicitly coached to be\n * shared with IT — if a proxy block page reflects the Authorization header,\n * we do not want the token in that paste.\n */\nfunction redactSecrets(text: string): string {\n return text\n .replace(/Bearer\\s+[A-Za-z0-9._-]+/gi, 'Bearer [redacted]')\n .replace(/\\beyJ[A-Za-z0-9_-]{6,}\\.[A-Za-z0-9_-]{6,}\\.[A-Za-z0-9_-]{6,}\\b/g, '[redacted-jwt]');\n}\n\n/** Strip query string — query params sometimes carry one-time tokens. */\nfunction redactUrl(url: string): string {\n const q = url.indexOf('?');\n return q === -1 ? url : `${url.slice(0, q)}?[redacted]`;\n}\n\nexport type FailureKind =\n | 'tls'\n | 'network'\n | 'html-body'\n | 'proxy-injected-4xx'\n | 'token-revoked'\n | 'token-expired'\n | 'unauthorized'\n | 'http-error';\n\nexport interface ClassifiedFailure {\n kind: FailureKind;\n status: number | null;\n url: string;\n message: string;\n /**\n * Response body text. Full body for `http-error` (so callers can parse\n * structured error payloads); truncated snippet for proxy/TLS failures\n * where the body is likely an HTML block page.\n */\n body?: string;\n /** Best-effort content-type. */\n contentType?: string;\n /** Raw error object for transport failures. */\n cause?: unknown;\n /**\n * Value of `x-canary-request-id` on the response, if any. Present means\n * the response came from our API (even for `token-revoked` / `token-expired`\n * / `unauthorized`); absent means the response was injected or the request\n * never reached us.\n */\n requestId?: string | null;\n}\n\n/**\n * Node/undici TLS error codes that indicate a MITM proxy (Zscaler et al.)\n * is intercepting HTTPS without the user trusting the proxy's root CA.\n */\nconst TLS_CODES = new Set([\n 'UNABLE_TO_VERIFY_LEAF_SIGNATURE',\n 'UNABLE_TO_GET_ISSUER_CERT',\n 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY',\n 'SELF_SIGNED_CERT_IN_CHAIN',\n 'DEPTH_ZERO_SELF_SIGNED_CERT',\n 'CERT_HAS_EXPIRED',\n 'CERT_UNTRUSTED',\n 'ERR_TLS_CERT_ALTNAME_INVALID',\n 'CERT_SIGNATURE_FAILURE',\n]);\n\nfunction extractErrorCode(err: unknown): string | null {\n if (!err || typeof err !== 'object') return null;\n const withCode = err as { code?: unknown; cause?: unknown };\n if (typeof withCode.code === 'string') return withCode.code;\n if (withCode.cause) return extractErrorCode(withCode.cause);\n return null;\n}\n\nfunction looksLikeHtml(body: string, contentType: string | null): boolean {\n if (contentType && contentType.toLowerCase().includes('text/html')) return true;\n const trimmed = body.trimStart();\n return trimmed.startsWith('<!') || trimmed.startsWith('<html') || trimmed.startsWith('<HTML');\n}\n\n/** Decode JWT `exp` and compare to now (with a small skew grace); null if undecodable. */\nfunction jwtExpStatus(token: string | undefined): 'expired' | 'valid' | 'unknown' {\n if (!token) return 'unknown';\n const payload = decodeJwtPayload(token);\n const exp = payload && typeof payload.exp === 'number' ? (payload.exp as number) : null;\n if (exp === null) return 'unknown';\n const nowSec = Math.floor(Date.now() / 1000);\n return exp < nowSec - JWT_EXP_SKEW_SEC ? 'expired' : 'valid';\n}\n\n/** Warn once per process when sending Authorization to a non-local http:// URL. */\nlet warnedAboutPlaintext = false;\nfunction maybeWarnPlaintextAuth(url: string, hasAuthHeader: boolean): void {\n if (!hasAuthHeader || warnedAboutPlaintext) return;\n if (!url.startsWith('http://')) return;\n try {\n const host = new URL(url).hostname;\n if (host === 'localhost' || host === '127.0.0.1' || host === '::1') return;\n } catch {\n return;\n }\n warnedAboutPlaintext = true;\n process.stderr.write(\n `[canary] WARNING: sending Authorization over plaintext http:// (${url}). ` +\n 'Your API token may be exposed to the network. Use https:// in CANARY_API_URL.\\n'\n );\n}\n\nfunction hasAuthHeader(init: RequestInit): boolean {\n const h = init.headers;\n if (!h) return false;\n if (h instanceof Headers) return h.has('authorization');\n if (Array.isArray(h)) return h.some(([k]) => k.toLowerCase() === 'authorization');\n return Object.keys(h).some((k) => k.toLowerCase() === 'authorization');\n}\n\n/** Who the current invocation resolved to act as; set by config resolution. */\nlet actingTarget: { orgName: string | null; orgId: string | null; env: string | null; apiUrl: string } | null = null;\nlet announcedWrite = false;\n\nexport function setActingTarget(target: NonNullable<typeof actingTarget>): void {\n actingTarget = target;\n}\n\n/** Name the org and environment a write is aimed at, once per process, so a misdirected write is visible. */\nfunction announceWriteTarget(url: string, method: string): void {\n if (announcedWrite || method === 'GET') return;\n announcedWrite = true;\n const t = actingTarget;\n const target = t?.apiUrl ?? url;\n let origin = target;\n try {\n origin = new URL(target).origin;\n } catch {\n // Malformed --api-url: print it raw; the request below classifies the failure.\n }\n process.stderr.write(\n `acting as ${t?.orgName ?? 'unknown org'} (${t?.orgId ?? 'unknown id'}) on ${t?.env ?? 'unknown env'} ${origin}\\n`\n );\n}\n\n/**\n * Wrap global `fetch` with classification. Always resolves — never throws —\n * so callers can make a single uniform decision from the returned shape.\n */\nexport async function apiFetch(\n url: string,\n init: RequestInit & { token?: string; timeoutMs?: number } = {}\n): Promise<\n | { ok: true; response: Response; requestId: string | null }\n | { ok: false; failure: ClassifiedFailure }\n> {\n const { token, timeoutMs, ...fetchInit } = init;\n maybeWarnPlaintextAuth(url, hasAuthHeader(fetchInit));\n announceWriteTarget(url, (fetchInit.method ?? 'GET').toUpperCase());\n debug(`→ ${fetchInit.method ?? 'GET'} ${redactUrl(url)}`);\n\n // Merge caller-supplied signal with our timeout so both can abort.\n // timeoutMs <= 0 disables the timeout (use for long-lived SSE streams).\n const timeout = timeoutMs ?? DEFAULT_TIMEOUT_MS;\n const timeoutSignal = timeout > 0 ? AbortSignal.timeout(timeout) : null;\n const effectiveSignal =\n fetchInit.signal && timeoutSignal\n ? AbortSignal.any([fetchInit.signal, timeoutSignal])\n : (fetchInit.signal ?? timeoutSignal ?? undefined);\n\n let response: Response;\n try {\n response = await fetch(url, { ...fetchInit, signal: effectiveSignal });\n } catch (err) {\n const isTimeout =\n (err as { name?: string })?.name === 'TimeoutError' ||\n Boolean(timeoutSignal?.aborted);\n if (isTimeout) {\n const msg = `Request to ${redactUrl(url)} timed out after ${timeout}ms.`;\n debug(`✖ network timeout`);\n return {\n ok: false,\n failure: { kind: 'network', status: null, url, message: msg, cause: err },\n };\n }\n const code = extractErrorCode(err);\n if (code && TLS_CODES.has(code)) {\n const msg = [\n `TLS verification failed talking to ${redactUrl(url)} (${code}).`,\n 'A corporate proxy (Zscaler, Netskope, ZPA, Cloudflare Access) is likely intercepting HTTPS.',\n 'Fixes: point Node at the proxy\\'s root CA with',\n ' NODE_EXTRA_CA_CERTS=/path/to/corporate-root.pem canary …',\n 'or on Node 20+ enable the system trust store with',\n ' NODE_OPTIONS=--use-system-ca canary …',\n ].join('\\n');\n debug(`✖ tls ${code}`);\n return { ok: false, failure: { kind: 'tls', status: null, url, message: msg, cause: err } };\n }\n const msg = `Network error reaching ${redactUrl(url)}: ${String((err as Error).message ?? err)}`;\n debug(`✖ network ${msg}`);\n return { ok: false, failure: { kind: 'network', status: null, url, message: msg, cause: err } };\n }\n\n const requestId = response.headers.get(CANARY_REQUEST_ID_HEADER);\n const contentType = response.headers.get('content-type');\n debug(`← ${response.status} ${redactUrl(url)} (ct=${contentType ?? 'n/a'} rid=${requestId ?? 'none'})`);\n\n if (response.ok) {\n return { ok: true, response, requestId };\n }\n\n // Read body once so we can classify and still return something useful.\n // Scrub secrets before constructing user-facing `snippet`; `bodyText` is\n // kept intact for callers that parse structured JSON error bodies.\n const bodyText = await response.clone().text().catch(() => '');\n const snippet = redactSecrets(bodyText.slice(0, 200));\n\n // HTML on a JSON endpoint => proxy block page or captive portal.\n if (looksLikeHtml(bodyText, contentType)) {\n return {\n ok: false,\n failure: {\n kind: 'html-body',\n status: response.status,\n url,\n contentType: contentType ?? undefined,\n requestId,\n body: snippet,\n message: [\n `Got an HTML response from ${url} (status ${response.status}).`,\n 'A corporate proxy block page or captive portal is intercepting this request — the',\n 'response did not come from the Canary API.',\n 'Check that your proxy (e.g. Zscaler) allowlists the API hostname, and that any',\n 'required sign-in to the proxy itself is current.',\n snippet ? `First bytes: ${snippet.replace(/\\s+/g, ' ')}` : '',\n ]\n .filter(Boolean)\n .join('\\n'),\n },\n };\n }\n\n // 401/403 without our header => not our response.\n if ((response.status === 401 || response.status === 403) && !requestId) {\n return {\n ok: false,\n failure: {\n kind: 'proxy-injected-4xx',\n status: response.status,\n url,\n contentType: contentType ?? undefined,\n requestId,\n body: snippet,\n message: [\n `Got ${response.status} from ${url} but the response is missing the \\`${CANARY_REQUEST_ID_HEADER}\\` header.`,\n 'This response was almost certainly injected by a corporate proxy (Zscaler, Netskope,',\n 'Cloudflare Access) rather than returned by our API — retrying \"canary login\" will not fix it.',\n 'Ask your IT team to allowlist the API host, or re-auth to the proxy and try again.',\n ].join('\\n'),\n },\n };\n }\n\n if (response.status === 401) {\n const jwtStatus = jwtExpStatus(token);\n if (jwtStatus === 'valid') {\n return {\n ok: false,\n failure: {\n kind: 'token-revoked',\n status: 401,\n url,\n requestId,\n body: snippet,\n message: [\n 'Server rejected a token that is still valid locally (unexpired JWT).',\n 'Likely causes: the token was revoked, the server\\'s signing key rotated, or the',\n 'user/org was deactivated. `canary login` will issue a fresh token.',\n ].join('\\n'),\n },\n };\n }\n if (jwtStatus === 'expired') {\n return {\n ok: false,\n failure: {\n kind: 'token-expired',\n status: 401,\n url,\n requestId,\n body: snippet,\n message: 'Your stored token has expired. Run: canary login',\n },\n };\n }\n return {\n ok: false,\n failure: {\n kind: 'unauthorized',\n status: 401,\n url,\n requestId,\n body: snippet,\n message: 'Unauthorized. Run: canary login',\n },\n };\n }\n\n return {\n ok: false,\n failure: {\n kind: 'http-error',\n status: response.status,\n url,\n contentType: contentType ?? undefined,\n requestId,\n body: bodyText,\n message: `${response.status} ${response.statusText}${snippet ? `: ${snippet}` : ''}`,\n },\n };\n}\n\n/**\n * Kinds of failure the user can't recover from by retrying the same call —\n * no token on disk, proxy interception, TLS mismatch, rejected JWT. Callers\n * should `exitOnFailure` immediately for these. `http-error` is excluded\n * because the caller often needs to pretty-print a structured error body.\n */\nexport function isTerminalFailure(failure: ClassifiedFailure): boolean {\n return failure.kind !== 'http-error';\n}\n\n/**\n * Print a classified failure and exit(1). Use from command handlers that\n * have no way to recover — matches the historical behavior of the various\n * `if (res.status === 401) { console.error(...); process.exit(1); }` blocks.\n */\nexport function exitOnFailure(failure: ClassifiedFailure): never {\n process.stderr.write(`Error: ${failure.message}\\n`);\n if (isDebug() && failure.body && failure.kind !== 'html-body') {\n process.stderr.write(`[canary-debug] body: ${failure.body}\\n`);\n }\n process.exit(1);\n}\n\n/**\n * Drop-in for `fetch()` in CLI call sites that parse the body themselves:\n * exits the process for terminal failures (TLS/proxy/unauthorized) so the\n * user sees a diagnostic, and returns a Response otherwise — whether 2xx\n * or an HTTP error (so the caller can still inspect .status / .json()).\n */\nexport async function fetchOrExit(\n url: string,\n init: RequestInit & { token?: string; timeoutMs?: number } = {}\n): Promise<Response> {\n const result = await apiFetch(url, init);\n if (result.ok) return result.response;\n if (isTerminalFailure(result.failure)) exitOnFailure(result.failure);\n // http-error: reconstruct a Response the caller can json() / read status on.\n return new Response(result.failure.body ?? '', {\n status: result.failure.status ?? 500,\n headers: result.failure.contentType\n ? { 'content-type': result.failure.contentType }\n : undefined,\n });\n}\n","import process from 'node:process';\nimport { splitAtSeparator } from './argv.js';\n\n/**\n * Whether verbose CLI diagnostics are enabled. Opt-in only, so normal runs stay\n * quiet — set CANARY_DEBUG=1 (or =true) or pass --debug. Diagnostics always go\n * to stderr so they never pollute stdout-piped (`--json`) output.\n */\nexport function isDebug(): boolean {\n return (\n process.env.CANARY_DEBUG === '1' ||\n process.env.CANARY_DEBUG === 'true' ||\n splitAtSeparator(process.argv.slice(2)).options.includes('--debug')\n );\n}\n\n/** Write a diagnostic line to stderr, but only when debug mode is enabled. */\nexport function debug(line: string): void {\n if (isDebug()) {\n process.stderr.write(`[canary-debug] ${line}\\n`);\n }\n}\n","/**\n * POSIX-style split at the first `--`: `options` are the CLI's own words,\n * `passthrough` is the command after the separator, which no flag scanning\n * (help, version, config, telemetry) may read.\n */\nexport function splitAtSeparator(argv: string[]): { options: string[]; passthrough: string[] } {\n const separator = argv.indexOf('--');\n return {\n options: separator === -1 ? argv : argv.slice(0, separator),\n passthrough: separator === -1 ? [] : argv.slice(separator + 1),\n };\n}\n\n/**\n * Flags whose value is free text, so it may legitimately start with a flag-like\n * word: `--description \"--org Acme\"`. Only the word after one of these is exempt\n * from the fused-flag check; after any other flag (a switch, a typo, a flag this\n * list does not name) a fused `\"--org X --env prod\"` is still refused, and the\n * error names the escape. Keep it to flags whose value is a name or\n * prose (`--application` is a name lookup that fails loudly on a bad name): a\n * fused selector after a listed flag becomes its value instead of being refused.\n */\nconst FREE_TEXT_FLAGS = new Set([\n '--application', '--body', '--cleanup', '--content', '--description', '--label', '--message', '--name',\n '--preflight', '--prompt', '--query', '--reason', '--search', '--summary', '--title',\n]);\n\n/**\n * Whether `argv[i]` is the free-text value of the flag just before it. A word\n * that is itself a well-formed flag (`--x` or `--x=y`, no whitespace) is never\n * a value, so a bare trailing `--org` after `--description` is still checked.\n */\nexport function isFreeTextValue(argv: string[], i: number): boolean {\n return isFreeTextFlag(argv[i - 1] ?? '') && !/^--[\\w-]+(=\\S*)?$/.test(argv[i]);\n}\n\nexport function isFreeTextFlag(flag: string): boolean {\n return FREE_TEXT_FLAGS.has(flag);\n}\n","/**\n * JWT payload decoder for CLI superadmin detection.\n *\n * Decodes the payload section of a JWT locally (no signature verification,\n * no network calls). Used to conditionally show superadmin CLI commands.\n *\n * @module\n */\n\n/**\n * Decode the payload (second segment) of a JWT without verifying the signature.\n * Returns the parsed JSON object, or `null` if the token is malformed.\n */\nexport function decodeJwtPayload(token: string): Record<string, unknown> | null {\n try {\n const parts = token.split(\".\");\n if (parts.length !== 3) return null;\n\n const base64 = parts[1]!.replace(/-/g, \"+\").replace(/_/g, \"/\");\n const json = Buffer.from(base64, \"base64\").toString(\"utf8\");\n const payload: unknown = JSON.parse(json);\n\n if (typeof payload !== \"object\" || payload === null || Array.isArray(payload)) {\n return null;\n }\n return payload as Record<string, unknown>;\n } catch {\n return null;\n }\n}\n\n/**\n * Returns `true` when the JWT's `is_superadmin` claim is exactly `true`.\n * Returns `false` for any invalid, missing, or non-superadmin token.\n */\nexport function isSuperadminToken(token: string | null | undefined): boolean {\n if (!token) return false;\n const payload = decodeJwtPayload(token);\n return payload?.is_superadmin === true;\n}\n","/**\n * Compiled-in default platform URLs for the CLI.\n *\n * Single source of truth — every command's final `??` fallback resolves here,\n * so the prod default lives in exactly one place. Runtime overrides still win\n * (`--api-url` / `--app-url` flags, `CANARY_API_URL` / `COFACTOR_API_URL` env,\n * `--env`, and stored profile). Both the `canary` and `cofactor` brands share\n * this default; `trycanary.ai` 301-redirects to `runcofactor.com`, so the old\n * host keeps working for anyone with it saved.\n */\nexport const DEFAULT_API_URL = 'https://api.runcofactor.com';\nexport const DEFAULT_APP_URL = 'https://app.runcofactor.com';\n"],"mappings":";;;;;;AAAA,OAAO,QAAQ;AACf,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,OAAOA,cAAa;;;ACUpB,OAAOC,cAAa;;;ACbpB,OAAO,aAAa;;;ACKb,SAAS,iBAAiB,MAA8D;AAC7F,QAAM,YAAY,KAAK,QAAQ,IAAI;AACnC,SAAO;AAAA,IACL,SAAS,cAAc,KAAK,OAAO,KAAK,MAAM,GAAG,SAAS;AAAA,IAC1D,aAAa,cAAc,KAAK,CAAC,IAAI,KAAK,MAAM,YAAY,CAAC;AAAA,EAC/D;AACF;AAWA,IAAM,kBAAkB,oBAAI,IAAI;AAAA,EAC9B;AAAA,EAAiB;AAAA,EAAU;AAAA,EAAa;AAAA,EAAa;AAAA,EAAiB;AAAA,EAAW;AAAA,EAAa;AAAA,EAC9F;AAAA,EAAe;AAAA,EAAY;AAAA,EAAW;AAAA,EAAY;AAAA,EAAY;AAAA,EAAa;AAC7E,CAAC;AAOM,SAAS,gBAAgB,MAAgB,GAAoB;AAClE,SAAO,eAAe,KAAK,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,oBAAoB,KAAK,KAAK,CAAC,CAAC;AAC/E;AAEO,SAAS,eAAe,MAAuB;AACpD,SAAO,gBAAgB,IAAI,IAAI;AACjC;;;AD9BO,SAAS,UAAmB;AACjC,SACE,QAAQ,IAAI,iBAAiB,OAC7B,QAAQ,IAAI,iBAAiB,UAC7B,iBAAiB,QAAQ,KAAK,MAAM,CAAC,CAAC,EAAE,QAAQ,SAAS,SAAS;AAEtE;AAGO,SAAS,MAAM,MAAoB;AACxC,MAAI,QAAQ,GAAG;AACb,YAAQ,OAAO,MAAM,kBAAkB,IAAI;AAAA,CAAI;AAAA,EACjD;AACF;;;AERO,SAAS,iBAAiB,OAA+C;AAC9E,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAE/B,UAAM,SAAS,MAAM,CAAC,EAAG,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC7D,UAAM,OAAO,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,MAAM;AAC1D,UAAM,UAAmB,KAAK,MAAM,IAAI;AAExC,QAAI,OAAO,YAAY,YAAY,YAAY,QAAQ,MAAM,QAAQ,OAAO,GAAG;AAC7E,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMO,SAAS,kBAAkB,OAA2C;AAC3E,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAU,iBAAiB,KAAK;AACtC,SAAO,SAAS,kBAAkB;AACpC;;;AHrBA,IAAM,2BAA2B;AAIjC,IAAM,qBAAqB;AAK3B,IAAM,mBAAmB;AAQzB,SAAS,cAAc,MAAsB;AAC3C,SAAO,KACJ,QAAQ,8BAA8B,mBAAmB,EACzD,QAAQ,mEAAmE,gBAAgB;AAChG;AAGA,SAAS,UAAU,KAAqB;AACtC,QAAM,IAAI,IAAI,QAAQ,GAAG;AACzB,SAAO,MAAM,KAAK,MAAM,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC;AAC5C;AAwCA,IAAM,YAAY,oBAAI,IAAI;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,iBAAiB,KAA6B;AACrD,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,WAAW;AACjB,MAAI,OAAO,SAAS,SAAS,SAAU,QAAO,SAAS;AACvD,MAAI,SAAS,MAAO,QAAO,iBAAiB,SAAS,KAAK;AAC1D,SAAO;AACT;AAEA,SAAS,cAAc,MAAc,aAAqC;AACxE,MAAI,eAAe,YAAY,YAAY,EAAE,SAAS,WAAW,EAAG,QAAO;AAC3E,QAAM,UAAU,KAAK,UAAU;AAC/B,SAAO,QAAQ,WAAW,IAAI,KAAK,QAAQ,WAAW,OAAO,KAAK,QAAQ,WAAW,OAAO;AAC9F;AAGA,SAAS,aAAa,OAA4D;AAChF,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAU,iBAAiB,KAAK;AACtC,QAAM,MAAM,WAAW,OAAO,QAAQ,QAAQ,WAAY,QAAQ,MAAiB;AACnF,MAAI,QAAQ,KAAM,QAAO;AACzB,QAAM,SAAS,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC3C,SAAO,MAAM,SAAS,mBAAmB,YAAY;AACvD;AAGA,IAAI,uBAAuB;AAC3B,SAAS,uBAAuB,KAAaC,gBAA8B;AACzE,MAAI,CAACA,kBAAiB,qBAAsB;AAC5C,MAAI,CAAC,IAAI,WAAW,SAAS,EAAG;AAChC,MAAI;AACF,UAAM,OAAO,IAAI,IAAI,GAAG,EAAE;AAC1B,QAAI,SAAS,eAAe,SAAS,eAAe,SAAS,MAAO;AAAA,EACtE,QAAQ;AACN;AAAA,EACF;AACA,yBAAuB;AACvB,EAAAC,SAAQ,OAAO;AAAA,IACb,mEAAmE,GAAG;AAAA;AAAA,EAExE;AACF;AAEA,SAAS,cAAc,MAA4B;AACjD,QAAM,IAAI,KAAK;AACf,MAAI,CAAC,EAAG,QAAO;AACf,MAAI,aAAa,QAAS,QAAO,EAAE,IAAI,eAAe;AACtD,MAAI,MAAM,QAAQ,CAAC,EAAG,QAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,MAAM,eAAe;AAChF,SAAO,OAAO,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,MAAM,eAAe;AACvE;AAGA,IAAI,eAA4G;AAChH,IAAI,iBAAiB;AAEd,SAAS,gBAAgB,QAAgD;AAC9E,iBAAe;AACjB;AAGA,SAAS,oBAAoB,KAAa,QAAsB;AAC9D,MAAI,kBAAkB,WAAW,MAAO;AACxC,mBAAiB;AACjB,QAAM,IAAI;AACV,QAAM,SAAS,GAAG,UAAU;AAC5B,MAAI,SAAS;AACb,MAAI;AACF,aAAS,IAAI,IAAI,MAAM,EAAE;AAAA,EAC3B,QAAQ;AAAA,EAER;AACA,EAAAA,SAAQ,OAAO;AAAA,IACb,aAAa,GAAG,WAAW,aAAa,KAAK,GAAG,SAAS,YAAY,QAAQ,GAAG,OAAO,aAAa,IAAI,MAAM;AAAA;AAAA,EAChH;AACF;AAMA,eAAsB,SACpB,KACA,OAA6D,CAAC,GAI9D;AACA,QAAM,EAAE,OAAO,WAAW,GAAG,UAAU,IAAI;AAC3C,yBAAuB,KAAK,cAAc,SAAS,CAAC;AACpD,sBAAoB,MAAM,UAAU,UAAU,OAAO,YAAY,CAAC;AAClE,QAAM,UAAK,UAAU,UAAU,KAAK,IAAI,UAAU,GAAG,CAAC,EAAE;AAIxD,QAAM,UAAU,aAAa;AAC7B,QAAM,gBAAgB,UAAU,IAAI,YAAY,QAAQ,OAAO,IAAI;AACnE,QAAM,kBACJ,UAAU,UAAU,gBAChB,YAAY,IAAI,CAAC,UAAU,QAAQ,aAAa,CAAC,IAChD,UAAU,UAAU,iBAAiB;AAE5C,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,MAAM,KAAK,EAAE,GAAG,WAAW,QAAQ,gBAAgB,CAAC;AAAA,EACvE,SAAS,KAAK;AACZ,UAAM,YACH,KAA2B,SAAS,kBACrC,QAAQ,eAAe,OAAO;AAChC,QAAI,WAAW;AACb,YAAMC,OAAM,cAAc,UAAU,GAAG,CAAC,oBAAoB,OAAO;AACnE,YAAM,wBAAmB;AACzB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,SAAS,EAAE,MAAM,WAAW,QAAQ,MAAM,KAAK,SAASA,MAAK,OAAO,IAAI;AAAA,MAC1E;AAAA,IACF;AACA,UAAM,OAAO,iBAAiB,GAAG;AACjC,QAAI,QAAQ,UAAU,IAAI,IAAI,GAAG;AAC/B,YAAMA,OAAM;AAAA,QACV,sCAAsC,UAAU,GAAG,CAAC,KAAK,IAAI;AAAA,QAC7D;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI;AACX,YAAM,cAAS,IAAI,EAAE;AACrB,aAAO,EAAE,IAAI,OAAO,SAAS,EAAE,MAAM,OAAO,QAAQ,MAAM,KAAK,SAASA,MAAK,OAAO,IAAI,EAAE;AAAA,IAC5F;AACA,UAAM,MAAM,0BAA0B,UAAU,GAAG,CAAC,KAAK,OAAQ,IAAc,WAAW,GAAG,CAAC;AAC9F,UAAM,kBAAa,GAAG,EAAE;AACxB,WAAO,EAAE,IAAI,OAAO,SAAS,EAAE,MAAM,WAAW,QAAQ,MAAM,KAAK,SAAS,KAAK,OAAO,IAAI,EAAE;AAAA,EAChG;AAEA,QAAM,YAAY,SAAS,QAAQ,IAAI,wBAAwB;AAC/D,QAAM,cAAc,SAAS,QAAQ,IAAI,cAAc;AACvD,QAAM,UAAK,SAAS,MAAM,IAAI,UAAU,GAAG,CAAC,QAAQ,eAAe,KAAK,QAAQ,aAAa,MAAM,GAAG;AAEtG,MAAI,SAAS,IAAI;AACf,WAAO,EAAE,IAAI,MAAM,UAAU,UAAU;AAAA,EACzC;AAKA,QAAM,WAAW,MAAM,SAAS,MAAM,EAAE,KAAK,EAAE,MAAM,MAAM,EAAE;AAC7D,QAAM,UAAU,cAAc,SAAS,MAAM,GAAG,GAAG,CAAC;AAGpD,MAAI,cAAc,UAAU,WAAW,GAAG;AACxC,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS;AAAA,QACP,MAAM;AAAA,QACN,QAAQ,SAAS;AAAA,QACjB;AAAA,QACA,aAAa,eAAe;AAAA,QAC5B;AAAA,QACA,MAAM;AAAA,QACN,SAAS;AAAA,UACP,6BAA6B,GAAG,YAAY,SAAS,MAAM;AAAA,UAC3D;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,UAAU,gBAAgB,QAAQ,QAAQ,QAAQ,GAAG,CAAC,KAAK;AAAA,QAC7D,EACG,OAAO,OAAO,EACd,KAAK,IAAI;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAGA,OAAK,SAAS,WAAW,OAAO,SAAS,WAAW,QAAQ,CAAC,WAAW;AACtE,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS;AAAA,QACP,MAAM;AAAA,QACN,QAAQ,SAAS;AAAA,QACjB;AAAA,QACA,aAAa,eAAe;AAAA,QAC5B;AAAA,QACA,MAAM;AAAA,QACN,SAAS;AAAA,UACP,OAAO,SAAS,MAAM,SAAS,GAAG,sCAAsC,wBAAwB;AAAA,UAChG;AAAA,UACA;AAAA,UACA;AAAA,QACF,EAAE,KAAK,IAAI;AAAA,MACb;AAAA,IACF;AAAA,EACF;AAEA,MAAI,SAAS,WAAW,KAAK;AAC3B,UAAM,YAAY,aAAa,KAAK;AACpC,QAAI,cAAc,SAAS;AACzB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,SAAS;AAAA,UACP,MAAM;AAAA,UACN,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,UACA,MAAM;AAAA,UACN,SAAS;AAAA,YACP;AAAA,YACA;AAAA,YACA;AAAA,UACF,EAAE,KAAK,IAAI;AAAA,QACb;AAAA,MACF;AAAA,IACF;AACA,QAAI,cAAc,WAAW;AAC3B,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,SAAS;AAAA,UACP,MAAM;AAAA,UACN,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,UACA,MAAM;AAAA,UACN,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS;AAAA,QACP,MAAM;AAAA,QACN,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,MAAM;AAAA,QACN,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,SAAS;AAAA,MACP,MAAM;AAAA,MACN,QAAQ,SAAS;AAAA,MACjB;AAAA,MACA,aAAa,eAAe;AAAA,MAC5B;AAAA,MACA,MAAM;AAAA,MACN,SAAS,GAAG,SAAS,MAAM,IAAI,SAAS,UAAU,GAAG,UAAU,KAAK,OAAO,KAAK,EAAE;AAAA,IACpF;AAAA,EACF;AACF;AAQO,SAAS,kBAAkB,SAAqC;AACrE,SAAO,QAAQ,SAAS;AAC1B;AAOO,SAAS,cAAc,SAAmC;AAC/D,EAAAD,SAAQ,OAAO,MAAM,UAAU,QAAQ,OAAO;AAAA,CAAI;AAClD,MAAI,QAAQ,KAAK,QAAQ,QAAQ,QAAQ,SAAS,aAAa;AAC7D,IAAAA,SAAQ,OAAO,MAAM,wBAAwB,QAAQ,IAAI;AAAA,CAAI;AAAA,EAC/D;AACA,EAAAA,SAAQ,KAAK,CAAC;AAChB;AAQA,eAAsB,YACpB,KACA,OAA6D,CAAC,GAC3C;AACnB,QAAM,SAAS,MAAM,SAAS,KAAK,IAAI;AACvC,MAAI,OAAO,GAAI,QAAO,OAAO;AAC7B,MAAI,kBAAkB,OAAO,OAAO,EAAG,eAAc,OAAO,OAAO;AAEnE,SAAO,IAAI,SAAS,OAAO,QAAQ,QAAQ,IAAI;AAAA,IAC7C,QAAQ,OAAO,QAAQ,UAAU;AAAA,IACjC,SAAS,OAAO,QAAQ,cACpB,EAAE,gBAAgB,OAAO,QAAQ,YAAY,IAC7C;AAAA,EACN,CAAC;AACH;;;AI9XO,IAAM,kBAAkB;AACxB,IAAM,kBAAkB;;;AL2C/B,SAAS,eAA8C;AACrD,QAAM,MAAM,aAAa,mBAAmB,KAAK,iBAAiB;AAClE,SAAO,EAAE,KAAK,MAAM,KAAK,KAAK,KAAK,WAAW,EAAE;AAClD;AAGO,SAAS,mBAA2B;AACzC,SAAO,KAAK,KAAK,GAAG,QAAQ,GAAG,WAAW,YAAY;AACxD;AAGO,SAAS,kBAA0B;AACxC,SAAO,aAAa,EAAE;AACxB;AAIO,SAAS,YAAY,MAAgB,KAAiC;AAC3E,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,QAAQ,KAAK,CAAC;AACpB,QAAI,UAAU,IAAK,QAAO,IAAI,KAAK,SAAS,IAAI,KAAK,IAAI,CAAC,IAAI;AAC9D,QAAI,MAAM,WAAW,GAAG,GAAG,GAAG,EAAG,QAAO,MAAM,MAAM,IAAI,SAAS,CAAC;AAAA,EACpE;AACA,SAAO;AACT;AAGA,SAAS,SAAS,OAAuB;AACvC,SAAO,MAAM,KAAK,EAAE,MAAM,OAAO,EAAE,CAAC;AACtC;AAGO,IAAM,qBAAqB,CAAC,SAAS,SAAS,aAAa,gBAAgB,SAAS;AAgBpF,SAAS,4BAA4B,MAAsB;AAChE,QAAM,SAAS,CAAC,YAA2B;AACzC,YAAQ,MAAM,UAAU,OAAO,EAAE;AACjC,IAAAE,SAAQ,KAAK,CAAC;AAAA,EAChB;AACA,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,QAAQ,KAAK,CAAC;AACpB,QAAI,gBAAgB,MAAM,CAAC,GAAG;AAE5B,UAAI,MAAM,SAAS,GAAG,KAAK,mBAAmB,SAAS,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,GAAG;AAC3E,eAAO,gBAAgB,KAAK,IAAI,CAAC,CAAC,gBAAgB,SAAS,KAAK,CAAC,kCAAkC,SAAS,KAAK,CAAC,GAAG;AAAA,MACvH;AACA;AAAA,IACF;AACA,QAAI,SAAS,KAAK,KAAK,GAAG;AACxB;AAAA,QACE,0BAA0B,SAAS,KAAK,CAAC;AAAA,MAC3C;AAAA,IACF;AACA,QAAI,CAAC,MAAM,WAAW,IAAI,EAAG;AAC7B,UAAM,CAAC,MAAM,GAAG,MAAM,IAAI,MAAM,MAAM,GAAG;AAEzC,UAAM,iBAAiB,OAAO,SAAS,KAAK,eAAe,IAAI;AAC/D,QAAI,KAAK,KAAK,IAAI,KAAM,CAAC,kBAAkB,aAAa,KAAK,KAAK,GAAI;AACpE;AAAA,QACE,GAAG,SAAS,KAAK,CAAC;AAAA,MAIpB;AAAA,IACF;AACA,QAAI,CAAC,mBAAmB,SAAS,IAAI,EAAG;AACxC,UAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC;AAC/D,QAAI,CAAC,SAAU,OAAO,WAAW,KAAK,MAAM,WAAW,IAAI,EAAI,QAAO,GAAG,IAAI,oBAAoB;AACjG,QAAI,iBAAiB,KAAK,KAAK,GAAG;AAChC,aAAO,gBAAgB,IAAI,0FAA0F;AAAA,IACvH;AAAA,EACF;AACF;AAEO,SAAS,QAAQ,SAAmB,OAA0B;AACnE,SAAO,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC;AACjD;AAKO,SAAS,aAAa,KAAqB;AAChD,MAAI,QAAQ,UAAU,QAAQ,aAAc,QAAO;AACnD,MAAI,QAAQ,MAAO,QAAO;AAC1B,MAAI,QAAQ,QAAS,QAAO;AAC5B,SAAO;AACT;AAEA,IAAM,aAAa,CAAC,QAAQ,OAAO,OAAO;AAGnC,IAAM,WAAyD;AAAA,EACpE,MAAM;AAAA,IACJ,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AAAA,EACA,YAAY;AAAA,IACV,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AAAA,EACA,KAAK;AAAA,IACH,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AAAA,EACA,OAAO;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AACF;AAIO,SAAS,kBAAkB,QAAoC;AACpE,aAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAClD,QAAI,KAAK,QAAQ,OAAQ,QAAO,aAAa,GAAG;AAAA,EAClD;AACA,SAAO;AACT;AAOO,SAAS,cAAc,OAAe,UAA2B;AACtE,SAAO,WAAW,GAAG,KAAK,IAAI,QAAQ,KAAK;AAC7C;AAUO,SAAS,cAAc,QAAwB;AACpD,QAAM,WAAW,MAAM;AACrB,eAAW,OAAO,OAAO,OAAO,QAAQ,GAAG;AACzC,UAAI,IAAI,QAAQ,OAAQ,QAAO,IAAI;AAAA,IACrC;AAEA,WAAO,OAAO,QAAQ,gBAAgB,QAAQ,EAAE,QAAQ,WAAW,OAAO;AAAA,EAC5E,GAAG;AACH,SAAO,QAAQ,QAAQ,qBAAqB,iBAAiB;AAC/D;AAMA,IAAM,uBAAuB;AAgBtB,SAAS,iBAAiB,QAAgB,cAAsC;AACrF,QAAM,SAAS,cAAc,MAAM;AACnC,MAAI,CAAC,gBAAgB,CAAC,qBAAqB,KAAK,YAAY,EAAG,QAAO;AAEtE,QAAM,MAAM,IAAI,IAAI,MAAM;AAG1B,MAAI,CAAC,IAAI,SAAS,WAAW,MAAM,KAAK,CAAC,IAAI,SAAS,SAAS,kBAAkB,GAAG;AAClF,WAAO;AAAA,EACT;AACA,MAAI,WAAW,GAAG,YAAY,IAAI,IAAI,QAAQ;AAC9C,SAAO,IAAI,SAAS,EAAE,QAAQ,OAAO,EAAE;AACzC;AAEA,SAAS,eAAe,MAAyC;AAC/D,SAAO,OAAO,SAAS,YAAY,SAAS,QAAQ,cAAc;AACpE;AAGA,eAAe,aAAa,WAAsD;AAChF,MAAI;AACF,UAAM,UAAU,MAAM,GAAG,SAAS,YAAY,KAAK,KAAK,WAAW,WAAW,IAAI,aAAa,EAAE,MAAM,MAAM;AAC7G,UAAM,OAAO,KAAK,MAAM,OAAO;AAE/B,QAAI,eAAe,IAAI,GAAG;AACxB,aAAO;AAAA,IACT;AAGA,UAAM,SAAS;AACf,WAAO;AAAA,MACL,UAAU,EAAE,SAAS,OAAO;AAAA,MAC5B,SAAS;AAAA,IACX;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,eAAe,SAA8C;AACjF,QAAM,OAAO,MAAM,aAAa;AAChC,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,MAAM,WAAW,KAAK;AAC5B,SAAO,KAAK,SAAS,GAAG,KAAK;AAC/B;AAEA,eAAsB,gBAAgB,SAA0C;AAC9E,QAAM,OAAO,MAAM,eAAe,OAAO;AACzC,SAAO,MAAM,SAAS;AACxB;AAEA,eAAsB,iBAAiB,SAA0C;AAC/E,QAAM,OAAO,MAAM,eAAe,OAAO;AACzC,SAAO,MAAM,UAAU;AACzB;AAGA,eAAsB,sBAAyC;AAC7D,QAAM,OAAO,MAAM,aAAa;AAChC,MAAI,CAAC,KAAM,QAAO,CAAC;AACnB,SAAO,OAAO,OAAO,KAAK,QAAQ,EAC/B,IAAI,CAAC,MAAM,EAAE,KAAK,EAClB,OAAO,CAAC,MAAmB,CAAC,CAAC,CAAC;AACnC;AAGA,IAAM,wBAAwB;AAC9B,IAAM,0BAA0B;AAehC,eAAe,oBAAoB,MAA0C;AAC3E,MAAI,KAAK,SAAS,KAAK,kBAAkB,KAAK,MAAM,KAAK,cAAc,IAAI,KAAK,IAAI,IAAI,sBAAuB,QAAO,KAAK;AAC3H,MAAI,CAAC,KAAK,YAAY,CAAC,KAAK,OAAQ,QAAO;AAC3C,QAAM,WAAW,MAAM,MAAM,GAAG,KAAK,MAAM,mBAAmB;AAAA,IAC5D,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,EAAE,OAAO,KAAK,SAAS,CAAC;AAAA,IAC7C,QAAQ,YAAY,QAAQ,uBAAuB;AAAA,EACrD,CAAC;AACD,MAAI,SAAS,WAAW,OAAO,SAAS,WAAW,IAAK,QAAO;AAC/D,QAAM,OAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AACpD,QAAM,cAAc,MAAM,MAAM;AAChC,QAAM,YAAY,MAAM,MAAM;AAC9B,MAAI,CAAC,SAAS,MAAM,OAAO,gBAAgB,YAAY,OAAO,cAAc,UAAU;AACpF,UAAM,IAAI,MAAM,8CAA8C,SAAS,MAAM,cAAc;AAAA,EAC7F;AACA,QAAM,EAAE,KAAK,KAAK,IAAI,aAAa;AACnC,QAAM,UAAU,MAAM,aAAa;AACnC,QAAM,MAAM,WAAW,OAAO,QAAQ,QAAQ,QAAQ,EAAE,KAAK,CAAC,CAAC,EAAE,OAAO,MAAM,QAAQ,aAAa,KAAK,QAAQ,IAAI,CAAC;AACrH,MAAI,WAAW,KAAK;AAClB,YAAQ,SAAS,GAAG,IAAI,EAAE,GAAG,MAAM,OAAO,aAAa,gBAAgB,UAAU;AACjF,UAAM,OAAO,KAAK,KAAK,KAAK,cAAcA,SAAQ,GAAG,MAAM;AAC3D,QAAI;AACF,YAAM,GAAG,UAAU,MAAM,KAAK,UAAU,SAAS,MAAM,CAAC,GAAG,EAAE,UAAU,QAAQ,MAAM,IAAM,CAAC;AAC5F,YAAM,GAAG,OAAO,MAAM,IAAI;AAAA,IAC5B,SAAS,OAAO;AAEd,YAAM,GAAG,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AACxD,cAAQ,MAAM,wDAAwD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAAA,IAChI;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,SAAS,MAAkB,SAAmC;AAClF,QAAM,EAAE,KAAK,UAAU,MAAM,UAAU,IAAI,aAAa;AACxD,QAAM,GAAG,MAAM,UAAU,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAGzD,MAAI;AACJ,MAAI;AACF,UAAM,UAAU,MAAM,GAAG,SAAS,WAAW,MAAM;AACnD,UAAM,OAAO,KAAK,MAAM,OAAO;AAE/B,QAAI,eAAe,IAAI,GAAG;AACxB,iBAAW;AAAA,IACb,OAAO;AAEL,iBAAW;AAAA,QACT,UAAU,EAAE,SAAS,KAAmB;AAAA,QACxC,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF,QAAQ;AACN,eAAW,EAAE,UAAU,CAAC,GAAG,SAAS,UAAU;AAAA,EAChD;AAEA,QAAM,MAAM,WAAW;AACvB,WAAS,SAAS,GAAG,IAAI;AAGzB,MAAI,CAAC,SAAS,SAAS,SAAS,OAAO,GAAG;AACxC,aAAS,UAAU;AAAA,EACrB;AAEA,QAAM,GAAG,UAAU,WAAW,KAAK,UAAU,UAAU,MAAM,CAAC,GAAG;AAAA,IAC/D,UAAU;AAAA,IACV,MAAM;AAAA,EACR,CAAC;AAED,QAAM,GAAG,MAAM,WAAW,GAAK,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AAC/C,SAAO;AACT;AAOA,eAAsB,kBAGnB;AACD,QAAM,OAAO,MAAM,aAAa;AAChC,MAAI,CAAC,KAAM,QAAO,EAAE,UAAU,CAAC,GAAG,SAAS,UAAU;AACrD,SAAO;AAAA,IACL,UAAU,OAAO,QAAQ,KAAK,QAAQ,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,EAAE;AAAA,IAC5E,SAAS,KAAK;AAAA,EAChB;AACF;AAeA,eAAsB,iBACpB,UACA,KACA,WACA,QACuB;AACvB,QAAM,OAAO,MAAM,aAAa,SAAS;AACzC,MAAI,CAAC,KAAM,QAAO,EAAE,MAAM,OAAO;AAEjC,QAAM,MAAM,SAAS,YAAY;AACjC,QAAM,MAAM,OAAO,QAAQ,KAAK,QAAQ,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,EAAE;AAG9E,QAAM,OAAO,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,QAAQ;AAC7D,MAAI,aAAa,KAAK,SAAS,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,YAAY,MAAM,GAAG;AAMtG,MAAI,QAAQ;AAEV,iBAAa,WAAW,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,MAAM;AAAA,EACrE,WAAW,KAAK;AACd,UAAM,UAAU,aAAa,GAAG;AAChC,UAAM,UAAU,SAAS,GAAG,GAAG;AAC/B,iBAAa,WAAW;AAAA,MACtB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,WAAY,CAAC,CAAC,WAAW,EAAE,WAAW;AAAA,IACxE;AAAA,EACF;AAQA,MAAI,WAAW,SAAS,GAAG;AACzB,UAAM,OAAO,oBAAI,IAA2B;AAC5C,eAAW,KAAK,YAAY;AAC1B,YAAM,QAAQ,EAAE,KAAK,SAAS,EAAE;AAChC,UAAI,CAAC,KAAK,IAAI,KAAK,EAAG,MAAK,IAAI,OAAO,CAAC;AAAA,IACzC;AACA,iBAAa,CAAC,GAAG,KAAK,OAAO,CAAC;AAAA,EAChC;AAUA,MAAI,WAAW,SAAS,GAAG;AACzB,UAAM,OAAO,IAAI,IAAI,WAAW,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;AACjD,UAAM,sBAAsB,CAAC,EAAE,KAAK,MAAM,EAAE,MAC1C,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,YAAY,QAAQ,EAAE,YAAY,KAAK,IAAI,cAAc,EAAE,OAAO,EAAE,QAAQ,CAAC;AAChG,iBAAa,WAAW,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;AAAA,EAC/D;AAEA,MAAI,WAAW,WAAW,EAAG,QAAO,EAAE,MAAM,OAAO;AACnD,MAAI,WAAW,WAAW,EAAG,QAAO,EAAE,MAAM,SAAS,KAAK,WAAW,CAAC,EAAE,KAAK,MAAM,WAAW,CAAC,EAAE,KAAK;AACtG,SAAO,EAAE,MAAM,aAAa,WAAW;AACzC;AAGA,eAAsB,kBAAkB,KAA4B;AAClE,QAAM,OAAO,MAAM,aAAa;AAChC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAS,GAAG,GAAG;AAChC,UAAM,IAAI,MAAM,kCAAkC,GAAG,IAAI;AAAA,EAC3D;AACA,OAAK,UAAU;AACf,QAAM,EAAE,KAAK,UAAU,MAAM,UAAU,IAAI,aAAa;AACxD,QAAM,GAAG,MAAM,UAAU,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACzD,QAAM,GAAG,UAAU,WAAW,KAAK,UAAU,MAAM,MAAM,CAAC,GAAG;AAAA,IAC3D,UAAU;AAAA,IACV,MAAM;AAAA,EACR,CAAC;AAED,QAAM,GAAG,MAAM,WAAW,GAAK,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AACjD;AA2BO,SAAS,eAAe,MAA+B;AAC5D,SAAO,YAAY,MAAM,OAAO,MAAM,aAAa,YAAY,KAAK;AACtE;AAQA,eAAsB,cAAc,MAAiC;AACnE,QAAM,MAAM,YAAY,MAAM,OAAO;AACrC,QAAM,UAAU,MAAM,aAAa,GAAG,IAAI;AAC1C,SACE,YAAY,MAAM,WAAW,MAC5B,MAAM,SAAS,GAAG,GAAG,MAAM,WAC5B,aAAa,gBAAgB,KAC5B,MAAM,iBAAiB,OAAO,KAC/B;AAEJ;AAEA,eAAe,sBACb,MACA,MACgC;AAChC,QAAM,MAAM,YAAY,MAAM,OAAO;AACrC,QAAM,UAAU,MAAM,aAAa,GAAG,IAAI;AAE1C,MAAI,OAAO,CAAC,SAAS,GAAG,GAAG;AACzB,QAAI,KAAK,UAAU;AACjB,cAAQ,MAAM,wBAAwB,GAAG,EAAE;AAC3C,cAAQ,MAAM,uBAAuB,WAAW,KAAK,IAAI,CAAC,EAAE;AAC5D,MAAAA,SAAQ,KAAK,CAAC;AAAA,IAChB;AACA,WAAO;AAAA,EACT;AAKA,QAAM,cAAc,eAAe,IAAI;AACvC,MAAI,eAAkC;AACtC,MAAI,aAAa;AACf,UAAM,QAAQ,MAAM,iBAAiB,aAAa,GAAG;AACrD,QAAI,MAAM,SAAS,QAAQ;AACzB,UAAI,KAAK,UAAU;AACjB,6BAAqB,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAAA,SAAQ,KAAK,CAAC;AAAA,MAChB;AACA,aAAO;AAAA,IACT;AACA,QAAI,MAAM,SAAS,aAAa;AAC9B,UAAI,KAAK,UAAU;AACjB,0BAAkB,aAAa,MAAM,UAAU;AAC/C,QAAAA,SAAQ,KAAK,CAAC;AAAA,MAChB;AACA,aAAO;AAAA,IACT;AACA,mBAAe,MAAM;AAAA,EACvB;AAEA,MAAI;AACJ,MAAI,cAAc;AAGhB,aAAS,aAAa,UAAU;AAChC,UAAM,iBAAiB,YAAY,MAAM,WAAW;AACpD,QAAI,kBAAkB,mBAAmB,QAAQ;AAC/C,UAAI,KAAK,UAAU;AACjB,gBAAQ,MAAM,eAAe,WAAW,kBAAkB,MAAM,sBAAsB,cAAc,GAAG;AACvG,gBAAQ,MAAM,4DAA4D;AAC1E,QAAAA,SAAQ,KAAK,CAAC;AAAA,MAChB;AACA,aAAO;AAAA,IACT;AAAA,EACF,OAAO;AACL,aAAS,MAAM,cAAc,IAAI;AAAA,EACnC;AAEA,QAAM,gBAAgB,YAAY,MAAM,SAAS;AAOjD,MAAI,cAAiC;AAErC,MAAI;AACJ,MAAI,eAAe;AACjB,YAAQ;AAAA,EACV,WAAW,cAAc;AAEvB,YAAQ,aAAa,SAAS,aAAa,kBAAkB,KAAK;AAClE,QAAI,aAAa,MAAO,eAAc;AACtC,QAAI,CAAC,SAAS,KAAK,UAAU;AAC3B,cAAQ,MAAM,mCAAmC,WAAW,IAAI;AAChE,cAAQ,MAAM,4BAA4B,WAAW,GAAG;AACxD,MAAAA,SAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,WAAW,SAAS;AAClB,UAAM,aAAa,MAAM,eAAe,OAAO;AAC/C,YAAQ,YAAY,SAAS,aAAa,kBAAkB,KAAK;AACjE,QAAI,YAAY,MAAO,eAAc;AACrC,QAAI,CAAC,SAAS,KAAK,UAAU;AAC3B,cAAQ,MAAM,8BAA8B,GAAG,YAAY;AAC3D,cAAQ,MAAM,2BAA2B,GAAG,EAAE;AAC9C,MAAAA,SAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,OAAO;AACL,UAAM,WAAW,aAAa,kBAAkB;AAChD,QAAI,UAAU;AACZ,cAAQ;AAAA,IACV,OAAO;AACL,YAAM,aAAa,MAAM,eAAe;AACxC,cAAQ,YAAY,SAAS;AAC7B,UAAI,YAAY,MAAO,eAAc;AAAA,IACvC;AACA,QAAI,CAAC,SAAS,KAAK,UAAU;AAC3B,cAAQ,MAAM,4BAA4B;AAC1C,cAAQ,MAAM,mBAAmB;AACjC,MAAAA,SAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AAGA,MAAI,CAAC,iBAAiB,aAAa,SAAS,OAAO;AACjD,YAAQ,MAAM,oBAAoB,WAAW,EAAE,MAAM,CAAC,UAAmB;AACvE,cAAQ,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAChF,MAAAA,SAAQ,KAAK,CAAC;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,KAAK,UAAU;AAC3B,cAAQ,MAAM,0GAA0G;AACxH,MAAAA,SAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AASA,QAAM,gBAAgB,gBAAgB,cAAc,gBAAgB;AAEpE,QAAM,SAAS,gBAAgB;AAC/B,kBAAgB;AAAA,IACd,SAAS,QAAQ,WAAW;AAAA,IAC5B,OAAO,QAAQ,SAAS;AAAA,IACxB,KAAK,QAAQ,YAAY,OAAO;AAAA,IAChC;AAAA,EACF,CAAC;AAED,SAAO,QAAQ,EAAE,QAAQ,OAAO,aAAa,IAAI;AACnD;AAGO,SAAS,qBACd,UACA,KACM;AACN,UAAQ,MAAM,wCAAwC,QAAQ,IAAI;AAClE,QAAM,UAAU,IAAI,SAAS,OAAO,CAAC,MAAM,EAAE,KAAK,WAAW,EAAE,KAAK,KAAK;AACzE,MAAI,QAAQ,SAAS,GAAG;AACtB,YAAQ,MAAM,mBAAmB;AACjC,eAAW,EAAE,MAAM,EAAE,KAAK,SAAS;AACjC,YAAM,WAAW,EAAE,WAAW,KAAK,EAAE,QAAQ,MAAM;AACnD,cAAQ,MAAM,OAAO,EAAE,WAAW,WAAW,KAAK,EAAE,SAAS,GAAG,IAAI,QAAQ,EAAE;AAAA,IAChF;AAAA,EACF;AACA,UAAQ,MAAM;AAAA,mCAAsC,QAAQ,GAAG;AAC/D,UAAQ;AAAA,IACN;AAAA,EAEF;AACF;AAKO,SAAS,kBAAkB,UAAkB,YAAmC;AACrF,QAAM,eAAe,IAAI,IAAI,WAAW,IAAI,CAAC,MAAM,EAAE,KAAK,SAAS,EAAE,GAAG,CAAC;AACzE,MAAI,aAAa,QAAQ,GAAG;AAC1B,YAAQ,MAAM,eAAe,QAAQ,4DAA4D;AAAA,EACnG,OAAO;AACL,YAAQ,MAAM,WAAW,QAAQ,4CAA4C;AAAA,EAC/E;AACA,aAAW,EAAE,MAAM,EAAE,KAAK,YAAY;AACpC,UAAM,WAAW,EAAE,YAAY;AAC/B,YAAQ,MAAM,OAAO,EAAE,WAAW,WAAW,KAAK,EAAE,SAAS,GAAG,MAAM,QAAQ,GAAG;AAAA,EACnF;AACF;AAMA,eAAsB,cAAc,MAAyC;AAC3E,SAAQ,MAAM,sBAAsB,MAAM,EAAE,UAAU,KAAK,CAAC;AAC9D;AAEA,eAAsB,sBAAsB,MAAgD;AAC1F,SAAO,sBAAsB,MAAM,EAAE,UAAU,MAAM,CAAC;AACxD;AAaA,eAAsB,kBACpB,MAC6C;AAC7C,QAAM,MAAM,YAAY,MAAM,OAAO;AACrC,MAAI,OAAO,CAAC,SAAS,GAAG,EAAG,QAAO;AAClC,QAAM,UAAU,MAAM,aAAa,GAAG,IAAI;AAE1C,MAAI,YAAY,MAAM,SAAS,EAAG,QAAO;AAEzC,QAAM,cAAc,eAAe,IAAI;AACvC,MAAI,aAAa;AACf,UAAM,QAAQ,MAAM,iBAAiB,aAAa,GAAG;AACrD,QAAI,MAAM,SAAS,WAAW,MAAM,KAAK,MAAO,QAAO;AACvD,QAAI,aAAa,kBAAkB,EAAG,QAAO;AAC7C,WAAO;AAAA,EACT;AAEA,MAAI,SAAS;AAEX,QAAI,MAAM,gBAAgB,OAAO,EAAG,QAAO;AAC3C,QAAI,aAAa,kBAAkB,EAAG,QAAO;AAC7C,WAAO;AAAA,EACT;AAGA,MAAI,aAAa,kBAAkB,EAAG,QAAO;AAC7C,MAAI,MAAM,gBAAgB,EAAG,QAAO;AACpC,SAAO;AACT;","names":["process","process","hasAuthHeader","process","msg","process"]}

package/dist/{chunk-2M4PZK6Q.js → chunk-56HFZHQM.js} RENAMED Viewed

@@ -1,25 +1,25 @@
 import { createRequire as __cr } from "module"; import { fileURLToPath as __fup } from "url"; import { dirname as __dn } from "path"; const require = __cr(import.meta.url); const __filename = __fup(import.meta.url); const __dirname = __dn(__filename);
 import {
   formatTeardownLines
-} from "./chunk-L4Y5PZUE.js";
+} from "./chunk-3LGCHNBC.js";
 import {
   runTrace
-} from "./chunk-JAIMLQOU.js";
+} from "./chunk-GCD4EHCD.js";
 import {
   apiRequest
-} from "./chunk-TRC63RSK.js";
+} from "./chunk-EWK44F6V.js";
 import {
   openUrl
-} from "./chunk-IVWWYKAM.js";
+} from "./chunk-K2IDR6FR.js";
 import {
   getArgValue,
   hasFlag
-} from "./chunk-ZFN5FWN2.js";
+} from "./chunk-4MFMPC5P.js";
 import {
   command,
   writeRawOutput,
   writeUntrustedText
-} from "./chunk-KNWKOKM7.js";
+} from "./chunk-2OHYMT3A.js";
 // src/workflow-debug.ts
 import process from "process";
@@ -1026,7 +1026,7 @@ async function materializeRunWorkspace(opts) {
     apiUrl: opts.apiUrl,
     token: opts.token
   });
-  const { assembleWorkspace, inProcessTraceReader } = await import("./src-ZKVNVLXY.js");
+  const { assembleWorkspace, inProcessTraceReader } = await import("./src-VLV36QYH.js");
   const dataUrl = `${opts.apiUrl}/workflows/${encodeURIComponent(workflowId)}/runs/${encodeURIComponent(opts.runId)}/debug/materialize-data`;
   const dataRes = await fetch(dataUrl, { headers: { Authorization: `Bearer ${opts.token}` } });
   if (!dataRes.ok) {
@@ -1174,4 +1174,4 @@ export {
   formatRetention,
   materializeRunWorkspace
 };
-//# sourceMappingURL=chunk-2M4PZK6Q.js.map
+//# sourceMappingURL=chunk-56HFZHQM.js.map

package/dist/{chunk-AQOHNAEN.js → chunk-5OYWNS6D.js} RENAMED Viewed

@@ -1,18 +1,19 @@
 import { createRequire as __cr } from "module"; import { fileURLToPath as __fup } from "url"; import { dirname as __dn } from "path"; const require = __cr(import.meta.url); const __filename = __fup(import.meta.url); const __dirname = __dn(__filename);
 import {
   UUID_RE,
+  getScalarArgValue,
   resolveTestSuite
-} from "./chunk-TRC63RSK.js";
+} from "./chunk-EWK44F6V.js";
 import {
   resolveConfig
-} from "./chunk-ZFN5FWN2.js";
+} from "./chunk-4MFMPC5P.js";
 import {
   writeRawOutput
-} from "./chunk-KNWKOKM7.js";
+} from "./chunk-2OHYMT3A.js";
 import {
   WORKFLOW_TEST_FAILED_STATUSES,
   WORKFLOW_TEST_SUCCESS_STATUSES
-} from "./chunk-R2CVV7QT.js";
+} from "./chunk-RHWPZKRV.js";
 // src/remote-test.ts
 import process from "process";
@@ -259,7 +260,7 @@ function formatTriggerFailure(status, body) {
   return `Failed to start tests: ${status}
 ${body}`;
 }
-async function triggerNamedSuiteRun(apiUrl, token, suiteArg, environmentId, environmentMode, verbose, externalSelection, externalAreas, pinnedCommit, externalHostShape) {
+async function triggerNamedSuiteRun(apiUrl, token, suiteArg, environmentId, environmentMode, verbose, externalSelection, externalAreas, pinnedCommit, externalHostShape, externalTriageEnabled) {
   const authHeaders = {
     Authorization: `Bearer ${token}`,
     "Content-Type": "application/json"
@@ -278,6 +279,7 @@ async function triggerNamedSuiteRun(apiUrl, token, suiteArg, environmentId, envi
   if (externalSelection) runBody.externalSelection = externalSelection;
   if (externalAreas) runBody.externalAreas = externalAreas;
   if (externalHostShape !== void 0) runBody.externalHostShape = externalHostShape;
+  if (externalTriageEnabled !== void 0) runBody.externalTriageEnabled = externalTriageEnabled;
   const runRes = await fetch(`${apiUrl}/test-suites/${match.id}/run`, {
     method: "POST",
     headers: authHeaders,
@@ -355,6 +357,7 @@ async function streamExternalRun(apiUrl, token, run, verbose) {
           console.log("");
           console.log("\u2500".repeat(50));
           console.log(summary.message);
+          if (run.pinnedCommit) console.log(`Pinned at: ${run.pinnedCommit}`);
           console.log(`Run: ${apiUrl.replace(/\/api\/?$/, "")}${run.runUrl}`);
           exitCode = summary.exitCode;
         }
@@ -380,6 +383,13 @@ async function streamExternalRun(apiUrl, token, run, verbose) {
   process.exit(exitCode);
 }
 async function runRemoteTest(argv) {
+  const triageFlags = argv.filter((arg) => arg === "--triage" || arg.startsWith("--triage="));
+  const triage = getScalarArgValue(argv, "--triage");
+  if (triageFlags.length > 1 || triageFlags.length === 1 && triage !== "on" && triage !== "off") {
+    console.error("Error: pass --triage on|off once.");
+    process.exit(1);
+  }
+  const externalTriageEnabled = triage === void 0 ? void 0 : triage === "on";
   if (argv.some((arg) => arg.startsWith("--external-host-shape="))) {
     console.error("Error: use --external-host-shape <shape> with a space; equals syntax is not supported.");
     process.exit(1);
@@ -408,8 +418,8 @@ async function runRemoteTest(argv) {
     console.error("Error: --at requires --suite <name|id>.");
     process.exit(1);
   }
-  if ((externalSpec || externalGrep || areaArg !== void 0 || externalHostShape !== void 0) && !suiteArg) {
-    console.error("Error: --area, --external-spec, --external-grep and --external-host-shape require --suite <name|id>.");
+  if ((externalSpec || externalGrep || areaArg !== void 0 || externalHostShape !== void 0 || externalTriageEnabled !== void 0) && !suiteArg) {
+    console.error("Error: --area, --external-spec, --external-grep, --external-host-shape and --triage require --suite <name|id>.");
     process.exit(1);
   }
   if (areaArg !== void 0 && externalSpec) {
@@ -463,7 +473,8 @@ async function runRemoteTest(argv) {
       externalSpec || externalGrep ? { ...externalSpec ? { specPath: externalSpec } : {}, ...externalGrep ? { grep: externalGrep } : {} } : void 0,
       externalAreas,
       pinnedCommitArg,
-      externalHostShape
+      externalHostShape,
+      externalTriageEnabled
     );
     if (triggered.kind === "external") {
       return await streamExternalRun(apiUrl, token, triggered, verbose);
@@ -627,4 +638,4 @@ export {
   streamExternalRun,
   runRemoteTest
 };
-//# sourceMappingURL=chunk-AQOHNAEN.js.map
+//# sourceMappingURL=chunk-5OYWNS6D.js.map

package/dist/chunk-5OYWNS6D.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../src/remote-test.ts","../src/remote-test-config.ts","../src/remote-test-format.ts"],"sourcesContent":["/**\n * Remote Test Command\n *\n * Triggers workflow tests on the Canary platform and streams results via SSE.\n * Designed for CI/CD pipelines. Exit codes: 0 every runnable test settled with\n * no failures, 1 one or more hard failures, 2 no failures but at least one\n * workflow was inconclusive (the platform never produced a verdict).\n *\n * Usage:\n * canary test-suite run [options]\n *\n * Options:\n * --token <key> API key (or set CANARY_API_TOKEN env var)\n * --api-url <url> API URL (default: https://api.runcofactor.com)\n * --tag <tag> Filter workflows by tag\n * --name-pattern <pat> Filter workflows by name pattern\n * --external-host-shape <shape> Reserve one exact dedicated host for an external v2 suite\n * --verbose, -v Show all events (not just results)\n */\n\nimport process from 'node:process';\nimport { createParser, type EventSourceMessage } from 'eventsource-parser';\nimport type {\n WorkflowTestEvent,\n WorkflowTestStatus,\n WorkflowTestSuiteEvent,\n} from '@chatsdet/types';\nimport { resolveConfig } from './auth';\nimport { resolveTestConfig, type ResolvedConfig } from './remote-test-config';\nimport { getScalarArgValue, resolveTestSuite, UUID_RE } from './cli-helpers.js';\nimport { writeRawOutput } from './brand.js';\nimport {\n buildQueryParams,\n extractWorkflowName,\n formatFailedTests,\n formatExternalRunSummary,\n formatStreamClosedBeforeCompletion,\n formatStreamReadFailure,\n formatSummary,\n formatTestResultLine,\n getArgValue,\n hasFlag,\n trackFailedTest,\n type FailedTestTracker,\n type SuiteSummaryStats,\n} from './remote-test-format';\n\n/** No suite event seen yet — `formatSummary` reads this as \"no workflows\". */\nconst EMPTY_SUITE_STATS: SuiteSummaryStats = {\n totalWorkflows: 0,\n completedWorkflows: 0,\n successfulWorkflows: 0,\n failedWorkflows: 0,\n inconclusiveWorkflows: 0,\n skippedWorkflows: 0,\n degradedWorkflows: 0,\n waitingWorkflows: 0,\n};\n\n\ntype TriggerResponse = {\n ok: boolean;\n jobId?: string;\n suiteId?: string;\n startedAt?: string;\n appUrl?: string;\n error?: string;\n};\n\n/**\n * The message for a refused trigger: a typed user error's own sentence (e.g. why\n * no workflows matched), otherwise the status and raw body.\n */\nfunction formatTriggerFailure(status: number, body: string): string {\n try {\n const parsed = JSON.parse(body) as { userError?: boolean; error?: unknown };\n if (parsed.userError === true && typeof parsed.error === 'string') {\n return `Error: ${parsed.error}`;\n }\n } catch {\n // Not JSON (a proxy error page, say) — fall through to the raw body.\n }\n return `Failed to start tests: ${status}\\n${body}`;\n}\n\n// Export internals for testing\nexport const __internals = {\n getArgValue,\n hasFlag,\n buildQueryParams,\n extractWorkflowName,\n formatSummary,\n formatTestResultLine,\n trackFailedTest,\n formatExternalRunSummary,\n formatFailedTests,\n formatStreamReadFailure,\n formatStreamClosedBeforeCompletion,\n resolveTestConfig,\n UUID_RE,\n triggerNamedSuiteRun,\n};\n\ntype NamedSuiteTrigger =\n | { kind: 'native'; executionId: string; jobId: string; pinnedCommit: string | null }\n // Rerun responses omit the pin; named image-suite runs return the resolved version.\n | { kind: 'external'; runId: string; jobId: string; runUrl: string; pinnedCommit?: string | null };\n\n/**\n * Resolve a `--suite <name|id>` argument to a suite id and trigger a layered\n * run via POST /test-suites/:id/run. Returns the execution id (used as the SSE\n * stream key) and the orchestrator job id.\n */\nasync function triggerNamedSuiteRun(\n apiUrl: string,\n token: string,\n suiteArg: string,\n environmentId: string | undefined,\n environmentMode: 'mixed' | 'force',\n verbose: boolean,\n externalSelection?: { specPath?: string; grep?: string },\n externalAreas?: string[],\n pinnedCommit?: string,\n externalHostShape?: string,\n externalTriageEnabled?: boolean\n): Promise<NamedSuiteTrigger> {\n const authHeaders = {\n Authorization: `Bearer ${token}`,\n 'Content-Type': 'application/json',\n };\n\n // Resolve name → id (exact id is accepted as-is; otherwise match by name).\n const match = await resolveTestSuite(suiteArg, apiUrl, token);\n\n // The name came from the database, so it must bypass console branding — a\n // suite really named \"Canary Smoke\" would otherwise print as \"Cofactor\n // Smoke\". See writeRawOutput's contract in brand.ts.\n writeRawOutput(`Starting test suite: ${match.name}`);\n console.log(` Env mode: ${environmentMode}`);\n if (environmentMode === 'force' && environmentId) console.log(` Environment: ${environmentId}`);\n if (pinnedCommit) console.log(` Pinned at: ${pinnedCommit} (never feeds visual baselines)`);\n console.log('');\n\n const runBody: {\n environmentId?: string;\n environmentMode: 'mixed' | 'force';\n externalSelection?: { specPath?: string; grep?: string };\n externalAreas?: string[];\n externalHostShape?: string;\n externalTriageEnabled?: boolean;\n at?: string;\n } = {\n environmentMode,\n };\n // `!== undefined`, not truthiness: an empty value must reach the server and be refused, never run unpinned.\n if (pinnedCommit !== undefined) runBody.at = pinnedCommit;\n if (environmentMode === 'force' && environmentId) runBody.environmentId = environmentId;\n if (externalSelection) runBody.externalSelection = externalSelection;\n if (externalAreas) runBody.externalAreas = externalAreas;\n if (externalHostShape !== undefined) runBody.externalHostShape = externalHostShape;\n if (externalTriageEnabled !== undefined) runBody.externalTriageEnabled = externalTriageEnabled;\n\n const runRes = await fetch(`${apiUrl}/test-suites/${match.id}/run`, {\n method: 'POST',\n headers: authHeaders,\n body: JSON.stringify(runBody),\n });\n if (!runRes.ok) {\n const body = await runRes.text();\n // A refused pin says why in `reason`; show it rather than the raw body.\n try {\n const refused = JSON.parse(body) as { userError?: boolean; error?: string; reason?: string };\n if (refused.userError === true && refused.reason) {\n console.error(`Error: ${refused.error ?? 'The suite cannot run'}: ${refused.reason}`);\n process.exit(1);\n }\n } catch {\n // Not JSON (a proxy error page, say): fall through to the raw body.\n }\n console.error(`Failed to start suite: ${runRes.status}`);\n console.error(body);\n process.exit(1);\n }\n const runJson = (await runRes.json()) as {\n ok: boolean;\n data?: NamedSuiteTrigger;\n error?: string;\n };\n if (!runJson.ok || !runJson.data) {\n console.error(`Failed to start suite: ${runJson.error ?? 'Unknown error'}`);\n process.exit(1);\n }\n if (verbose) {\n console.log(\n runJson.data.kind === 'external'\n ? `External run ID: ${runJson.data.runId}`\n : `Execution ID: ${runJson.data.executionId}`\n );\n console.log(`Job ID: ${runJson.data.jobId}`);\n console.log('');\n }\n return runJson.data;\n}\n\nexport async function streamExternalRun(\n apiUrl: string,\n token: string,\n run: Extract<NamedSuiteTrigger, { kind: 'external' }>,\n verbose: boolean\n): Promise<never> {\n const response = await fetch(`${apiUrl}/jobs/${run.runId}/stream`, {\n headers: { Authorization: `Bearer ${token}`, Accept: 'text/event-stream' },\n });\n if (!response.ok || !response.body) {\n console.error(`Failed to connect to external run stream: ${response.status}`);\n process.exit(1);\n }\n\n let sealed = false;\n let exitCode = 1;\n const parser = createParser({\n onEvent: (event: EventSourceMessage) => {\n if (!event.data || !event.event?.startsWith('external-run.')) return;\n try {\n const data = JSON.parse(event.data) as Record<string, unknown>;\n if (verbose) console.log(`[${event.event}] ${JSON.stringify(data)}`);\n if (event.event === 'external-run.shard' && !verbose) {\n console.log(\n ` shard ${String(data.shardIndex)}/${String(data.shardTotal)}: ${String(data.phase)} (attempt ${String(data.attempt)})`\n );\n }\n if (event.event === 'external-run.status' && data.status === 'canceled') {\n sealed = true;\n exitCode = 1;\n console.error('External test run was canceled.');\n }\n if (event.event === 'external-run.sealed') {\n sealed = true;\n const total = Number(data.total ?? 0);\n const passed = Number(data.passed ?? 0);\n const failed = Number(data.failed ?? 0);\n const flaky = Number(data.flaky ?? 0);\n const skipped = Number(data.skipped ?? 0);\n const summary = formatExternalRunSummary({\n total,\n passed,\n failed,\n flaky,\n skipped,\n resultsTruncated: data.resultsTruncated === true,\n });\n console.log('');\n console.log('─'.repeat(50));\n console.log(summary.message);\n if (run.pinnedCommit) console.log(`Pinned at: ${run.pinnedCommit}`);\n console.log(`Run: ${apiUrl.replace(/\\/api\\/?$/, '')}${run.runUrl}`);\n exitCode = summary.exitCode;\n }\n } catch (error) {\n if (verbose) console.error(`Ignored malformed stream event: ${String(error)}`);\n }\n },\n });\n const reader = response.body.getReader();\n const decoder = new TextDecoder();\n try {\n while (!sealed) {\n const { done, value } = await reader.read();\n if (done) break;\n parser.feed(decoder.decode(value, { stream: true }));\n }\n } catch (error) {\n console.error(formatStreamReadFailure(error));\n } finally {\n reader.releaseLock();\n }\n if (!sealed) console.error(formatStreamClosedBeforeCompletion());\n process.exit(exitCode);\n}\n\nexport async function runRemoteTest(argv: string[]): Promise<void> {\n const triageFlags = argv.filter((arg) => arg === '--triage' || arg.startsWith('--triage='));\n const triage = getScalarArgValue(argv, '--triage');\n if (triageFlags.length > 1 || (triageFlags.length === 1 && triage !== 'on' && triage !== 'off')) {\n console.error('Error: pass --triage on|off once.');\n process.exit(1);\n }\n const externalTriageEnabled = triage === undefined ? undefined : triage === 'on';\n if (argv.some((arg) => arg.startsWith('--external-host-shape='))) {\n console.error('Error: use --external-host-shape <shape> with a space; equals syntax is not supported.');\n process.exit(1);\n }\n const { apiUrl, token } = await resolveConfig(argv);\n\n const tag = getArgValue(argv, '--tag');\n const namePattern = getArgValue(argv, '--name-pattern');\n // \"--application\" is the user-facing flag; \"--property\" stays as a backwards-compat alias.\n const propertyArg = getArgValue(argv, '--application') ?? getArgValue(argv, '--property');\n const environmentArg = getArgValue(argv, '--environment');\n const suiteArg = getArgValue(argv, '--suite');\n const externalSpec = getArgValue(argv, '--external-spec');\n const externalGrep = getArgValue(argv, '--external-grep');\n const externalHostShape = getArgValue(argv, '--external-host-shape');\n if (hasFlag(argv, '--external-host-shape') && (!externalHostShape || externalHostShape.startsWith('--'))) {\n console.error('Error: --external-host-shape needs a provider shape.');\n process.exit(1);\n }\n const areaArg = getArgValue(argv, '--area');\n const verbose = hasFlag(argv, '--verbose', '-v');\n const pinnedCommitArg = getArgValue(argv, '--at');\n // A pin that fails open would run an unpinned suite the caller never asked for.\n if (hasFlag(argv, '--at') && !pinnedCommitArg) {\n console.error('Error: --at needs <sha|pushId|tag>.');\n process.exit(1);\n }\n if (pinnedCommitArg !== undefined && !suiteArg) {\n console.error('Error: --at requires --suite <name|id>.');\n process.exit(1);\n }\n if ((externalSpec || externalGrep || areaArg !== undefined || externalHostShape !== undefined || externalTriageEnabled !== undefined) && !suiteArg) {\n console.error('Error: --area, --external-spec, --external-grep, --external-host-shape and --triage require --suite <name|id>.');\n process.exit(1);\n }\n // A spec path already names the tests to run, so it cannot also be narrowed\n // to areas. A title regex can: it is applied inside each area.\n if (areaArg !== undefined && externalSpec) {\n console.error(\n 'Error: --area cannot be combined with --external-spec (a spec path picks its own tests). ' +\n 'Use --external-grep to filter within an area.'\n );\n process.exit(1);\n }\n // One area or several: `--area a,b` fans out one sandbox per area, exactly as\n // a full run does, so the run page still groups by area.\n //\n // Tested for `undefined`, not truthiness: `--area \"\"` parses to the empty\n // string, and treating that as \"no selection\" would quietly run the whole\n // suite when the user plainly asked to narrow it.\n const externalAreas =\n areaArg === undefined\n ? undefined\n : areaArg\n .split(',')\n .map((area) => area.trim())\n .filter((area) => area.length > 0);\n if (externalAreas && externalAreas.length === 0) {\n console.error('Error: --area needs at least one area name.');\n process.exit(1);\n }\n\n // Env mode: 'mixed' (default) runs each flow on its own preferred env; 'force'\n // pins the whole suite to --environment (which then becomes required).\n const envModeArg = getArgValue(argv, '--env-mode');\n if (envModeArg !== undefined && envModeArg !== 'mixed' && envModeArg !== 'force') {\n console.error(`Error: --env-mode must be \"mixed\" or \"force\" (got \"${envModeArg}\").`);\n process.exit(1);\n }\n const environmentMode: 'mixed' | 'force' =\n (envModeArg as 'mixed' | 'force' | undefined) ?? (environmentArg ? 'force' : 'mixed');\n if (environmentMode === 'force' && !environmentArg) {\n console.error('Error: --env-mode force requires --environment <name|id>.');\n process.exit(1);\n }\n\n // 0. Resolve property/environment if specified\n let resolvedConfig: ResolvedConfig = {};\n if (propertyArg || environmentArg) {\n try {\n resolvedConfig = await resolveTestConfig(apiUrl, token, propertyArg, environmentArg);\n } catch (err) {\n console.error(`${err instanceof Error ? err.message : String(err)}`);\n process.exit(1);\n }\n }\n\n console.log('Starting remote workflow tests...');\n if (resolvedConfig.propertyId) console.log(` Application: ${propertyArg}`);\n if (resolvedConfig.environmentId) console.log(` Environment: ${environmentArg}`);\n if (tag) console.log(` Filtering by tag: ${tag}`);\n if (namePattern) console.log(` Filtering by name pattern: ${namePattern}`);\n console.log('');\n\n let suiteId: string;\n let jobId: string | undefined;\n let appUrl: string | undefined;\n let pinnedCommit: string | null = null;\n\n if (suiteArg) {\n // Named, layered suite run. Resolve name→id, then POST /test-suites/:id/run.\n const triggered = await triggerNamedSuiteRun(\n apiUrl,\n token,\n suiteArg,\n resolvedConfig.environmentId,\n environmentMode,\n verbose,\n externalSpec || externalGrep\n ? { ...(externalSpec ? { specPath: externalSpec } : {}), ...(externalGrep ? { grep: externalGrep } : {}) }\n : undefined,\n externalAreas,\n pinnedCommitArg,\n externalHostShape,\n externalTriageEnabled\n );\n if (triggered.kind === 'external') {\n return await streamExternalRun(apiUrl, token, triggered, verbose);\n }\n pinnedCommit = triggered.pinnedCommit;\n suiteId = triggered.executionId;\n jobId = triggered.jobId;\n } else {\n // 1. Trigger test run\n const queryParams = new URLSearchParams();\n if (tag) queryParams.set('tag', tag);\n if (namePattern) queryParams.set('namePattern', namePattern);\n\n const triggerUrl = `${apiUrl}/workflows/test-runs${queryParams.toString() ? `?${queryParams}` : ''}`;\n\n const body: Record<string, string> = { environmentMode };\n if (resolvedConfig.propertyId) body.propertyId = resolvedConfig.propertyId;\n if (environmentMode === 'force' && resolvedConfig.environmentId)\n body.environmentId = resolvedConfig.environmentId;\n\n let triggerRes: Response;\n try {\n triggerRes = await fetch(triggerUrl, {\n method: 'POST',\n headers: {\n Authorization: `Bearer ${token}`,\n 'Content-Type': 'application/json',\n },\n body: JSON.stringify(body),\n });\n } catch (err) {\n console.error(`Failed to connect to API: ${err}`);\n process.exit(1);\n }\n\n if (!triggerRes.ok) {\n console.error(formatTriggerFailure(triggerRes.status, await triggerRes.text()));\n process.exit(1);\n }\n\n const triggerData = (await triggerRes.json()) as TriggerResponse;\n if (!triggerData.ok || !triggerData.suiteId) {\n console.error(`Failed to start tests: ${triggerData.error ?? 'Unknown error'}`);\n process.exit(1);\n }\n suiteId = triggerData.suiteId;\n jobId = triggerData.jobId;\n appUrl = triggerData.appUrl;\n }\n\n if (verbose) {\n console.log(`Suite ID: ${suiteId}`);\n console.log(`Job ID: ${jobId}`);\n console.log('');\n }\n\n // 2. Subscribe to SSE stream\n const streamUrl = `${apiUrl}/workflows/test-runs/stream?suiteId=${suiteId}`;\n\n let streamRes: Response;\n try {\n streamRes = await fetch(streamUrl, {\n headers: {\n Authorization: `Bearer ${token}`,\n Accept: 'text/event-stream',\n },\n });\n } catch (err) {\n console.error(`Failed to connect to event stream: ${err}`);\n process.exit(1);\n }\n\n if (!streamRes.ok || !streamRes.body) {\n console.error(`Failed to connect to event stream: ${streamRes.status}`);\n process.exit(1);\n }\n\n // Track state\n let hasCompleted = false;\n const workflowNames = new Map<string, string>();\n const failedTests: FailedTestTracker = new Map();\n // The last suite event wins: its counters are recomputed server-side from the\n // deduplicated latest attempt per test, so they are authoritative over\n // anything this process could tally from the individual test events.\n let suiteStats: SuiteSummaryStats = EMPTY_SUITE_STATS;\n let streamInterrupted = false;\n\n // 3. Parse SSE events\n const parser = createParser({\n onEvent: (event: EventSourceMessage) => {\n if (!event.data) return;\n\n try {\n const data = JSON.parse(event.data) as\n | WorkflowTestEvent\n | WorkflowTestSuiteEvent\n | { error?: string };\n\n if (verbose) {\n console.log(`[${event.event}] ${JSON.stringify(data)}`);\n }\n\n if (event.event === 'workflow-test') {\n const testEvent = data as WorkflowTestEvent;\n const { status, workflowId, message } = testEvent;\n const name =\n workflowNames.get(workflowId) ||\n message?.replace(/^Flow \"(.+)\" .*$/, '$1') ||\n workflowId;\n\n if (message?.startsWith('Flow \"')) {\n const match = message.match(/^Flow \"(.+?)\" /);\n if (match) workflowNames.set(workflowId, match[1]);\n }\n\n // Tracked regardless of verbosity: the \"Failed tests\" section at the\n // end is built from this, and a later attempt's pass retracts an\n // earlier failure here.\n trackFailedTest(failedTests, {\n status,\n workflowId,\n name,\n testRunId: testEvent.testRunId,\n });\n\n if (!verbose) {\n const line = formatTestResultLine({\n status,\n name,\n errorMessage: testEvent.errorMessage,\n skipReason: testEvent.skipReason,\n });\n if (line) console.log(line);\n }\n }\n\n if (event.event === 'workflow-test-suite') {\n const suiteEvent = data as WorkflowTestSuiteEvent;\n suiteStats = suiteEvent;\n\n if (suiteEvent.status === 'completed') {\n hasCompleted = true;\n }\n }\n\n if (event.event === 'error') {\n const errorData = data as { error?: string };\n console.error(`Stream error: ${errorData.error ?? 'Unknown error'}`);\n streamInterrupted = true;\n }\n } catch {\n // Ignore parse errors for keepalive, etc.\n }\n },\n });\n\n const reader = streamRes.body.getReader();\n const decoder = new TextDecoder();\n\n try {\n while (!hasCompleted) {\n const { done, value } = await reader.read();\n if (done) {\n if (!hasCompleted) {\n streamInterrupted = true;\n console.error(formatStreamClosedBeforeCompletion());\n }\n break;\n }\n parser.feed(decoder.decode(value, { stream: true }));\n }\n } catch (err) {\n streamInterrupted = true;\n console.error(formatStreamReadFailure(err));\n } finally {\n reader.releaseLock();\n }\n\n // 4. Print summary\n console.log('');\n console.log('─'.repeat(50));\n\n // One rule for the verdict, shared with the unit tests, instead of a second\n // copy of it inline here — the no-workflows case included.\n const summary = formatSummary(suiteStats);\n console.log(summary.message);\n if (pinnedCommit) console.log(`Pinned at: ${pinnedCommit}`);\n\n // A truncated stream makes every counter above a partial read: a workflow\n // that would have failed may simply not have reported yet. Collapse to a\n // plain failure rather than keeping a verdict the partial read cannot\n // support, and say so, so the printed summary and the exit code agree\n // instead of pairing \"PASSED\" with a non-zero exit.\n let exitCode = summary.exitCode;\n if (streamInterrupted) {\n console.log('Result stream did not complete — the summary above is a partial read.');\n exitCode = 1;\n }\n\n const failedSection = formatFailedTests([...failedTests.values()], appUrl);\n if (failedSection) {\n console.log(failedSection);\n }\n\n if (suiteStats.failedWorkflows > 0) {\n console.log('');\n console.log(`Triage: canary triage wait ${suiteId}`);\n }\n\n process.exit(exitCode);\n}\n","import { UUID_RE } from './cli-helpers.js';\n\ntype TestConfigProperty = {\n id: string;\n name: string;\n baseUrl: string;\n environments: Array<{\n id: string;\n name: string;\n url: string;\n isDefault: boolean;\n environmentKindId?: string | null;\n environmentKindName?: string | null;\n }>;\n};\n\ntype TestConfigResponse = {\n ok: boolean;\n properties: TestConfigProperty[];\n error?: string;\n};\n\nexport type ResolvedConfig = {\n propertyId?: string;\n environmentId?: string;\n};\n\nexport async function resolveTestConfig(\n apiUrl: string,\n token: string,\n propertyArg?: string,\n environmentArg?: string\n): Promise<ResolvedConfig> {\n if (!propertyArg && !environmentArg) return {};\n\n const res = await fetch(`${apiUrl}/workflows/test-config`, {\n headers: { Authorization: `Bearer ${token}` },\n });\n\n if (!res.ok) {\n const text = await res.text();\n throw new Error(`Failed to fetch test config: ${res.status} ${text}`);\n }\n\n const data = (await res.json()) as TestConfigResponse;\n if (!data.ok || !data.properties) {\n throw new Error(`Failed to fetch test config: ${data.error ?? 'Unknown error'}`);\n }\n\n const { properties } = data;\n let property: TestConfigProperty | undefined;\n\n if (propertyArg) {\n if (UUID_RE.test(propertyArg)) {\n property = properties.find((p) => p.id === propertyArg);\n } else {\n property = properties.find((p) => p.name.toLowerCase() === propertyArg.toLowerCase());\n }\n if (!property) {\n const available = properties.map((p) => ` - ${p.name} (${p.id})`).join('\\n');\n throw new Error(\n `Application \"${propertyArg}\" not found.\\nAvailable applications:\\n${available}`\n );\n }\n } else if (environmentArg) {\n // --environment without --application: auto-resolve if single application\n if (properties.length === 0) {\n throw new Error('No applications found in your organization.');\n }\n if (properties.length > 1) {\n const available = properties.map((p) => ` - ${p.name} (${p.id})`).join('\\n');\n throw new Error(\n `--environment requires --application when multiple applications exist.\\nAvailable applications:\\n${available}`\n );\n }\n property = properties[0];\n }\n\n const result: ResolvedConfig = {};\n if (property) {\n result.propertyId = property.id;\n\n if (environmentArg) {\n let env: TestConfigProperty['environments'][number] | undefined;\n if (UUID_RE.test(environmentArg)) {\n env = property.environments.find((e) => e.id === environmentArg);\n } else {\n env = property.environments.find(\n (e) =>\n e.name.toLowerCase() === environmentArg.toLowerCase() ||\n e.environmentKindName?.toLowerCase() === environmentArg.toLowerCase()\n );\n }\n if (!env) {\n const available = property.environments\n .map((e) => ` - ${e.name}${e.isDefault ? ' (default)' : ''} (${e.id})`)\n .join('\\n');\n throw new Error(\n `Environment \"${environmentArg}\" not found for application \"${property.name}\".\\nAvailable environments:\\n${available}`\n );\n }\n result.environmentId = env.id;\n }\n }\n\n return result;\n}\n","import {\n WORKFLOW_TEST_FAILED_STATUSES,\n WORKFLOW_TEST_SUCCESS_STATUSES,\n type WorkflowTestStatus,\n type WorkflowTestSuiteEvent,\n} from '@chatsdet/types';\n\nexport function getArgValue(argv: string[], key: string): string | undefined {\n const index = argv.indexOf(key);\n if (index === -1 || index >= argv.length - 1) return undefined;\n return argv[index + 1];\n}\n\nexport function hasFlag(argv: string[], ...flags: string[]): boolean {\n return flags.some((flag) => argv.includes(flag));\n}\n\nexport function buildQueryParams(tag?: string, namePattern?: string): string {\n const params = new URLSearchParams();\n if (tag) params.set('tag', tag);\n if (namePattern) params.set('namePattern', namePattern);\n return params.toString();\n}\n\nexport function extractWorkflowName(message: string | undefined, workflowId: string): string {\n if (!message) return workflowId;\n const match = message.match(/^Flow \"(.+?)\" /);\n return match ? match[1] : workflowId;\n}\n\nexport type FailedTest = { name: string; testRunId: string };\n\n/**\n * Failed tests keyed by `workflowId` rather than accumulated in a list.\n *\n * A retried test arrives as a `failed` event followed by a `flaky_success`\n * event for the SAME workflow. Keying by workflow is what lets the later pass\n * remove the earlier failure — an append-only list left the run listed under\n * \"Failed tests\" while the summary line directly above it counted the workflow\n * as a pass.\n *\n * KNOWN LIMITATION: suite scenario expansion fans one workflow out to several\n * test runs in the same execution, which share a `workflowId` and differ only\n * by `scenarioId`. A failing scenario followed by a passing one would therefore\n * retract the failure from this list. The CLI cannot key more precisely today —\n * `WorkflowTestEvent` carries no `scenarioId` over SSE — and keying by\n * `testRunId` instead would break the retry case above, which is the one that\n * actually occurs: of 7,847 production test runs in the 30 days to 2026-09-11,\n * zero had a `scenario_id`. Closing this properly means adding `scenarioId` to\n * the SSE payload, not guessing here. Note the summary COUNTS come from the\n * suite event and stay correct either way; only this list is affected.\n */\nexport type FailedTestTracker = Map<string, FailedTest>;\n\n/**\n * Record or clear one workflow's failure state from a single test event.\n *\n * Only hard failures are listed: `inconclusive`, `skipped` and `degraded` are\n * terminal without being failures (see `WORKFLOW_TEST_FAILED_STATUSES`), and\n * listing them under \"Failed tests\" would overstate what actually broke.\n */\nexport function trackFailedTest(\n tracker: FailedTestTracker,\n event: { status: WorkflowTestStatus; workflowId: string; name: string; testRunId: string }\n): void {\n if (WORKFLOW_TEST_SUCCESS_STATUSES.has(event.status)) {\n tracker.delete(event.workflowId);\n return;\n }\n if (WORKFLOW_TEST_FAILED_STATUSES.has(event.status)) {\n tracker.set(event.workflowId, { name: event.name, testRunId: event.testRunId });\n }\n}\n\n/** Keep a failure message from swamping the result line it annotates. */\nconst ERROR_EXCERPT_LIMIT = 200;\n\nconst excerpt = (text: string | null | undefined): string | null => {\n const trimmed = text?.trim();\n if (!trimmed) return null;\n return trimmed.length > ERROR_EXCERPT_LIMIT\n ? `${trimmed.slice(0, ERROR_EXCERPT_LIMIT)}\\u2026`\n : trimmed;\n};\n\n/**\n * Render one test's result line, or null while the test is still in flight.\n *\n * The `switch` is exhaustive over `WorkflowTestStatus` on purpose: the previous\n * if/else chain covered 4 of the 11 statuses and silently printed nothing for\n * the other 7, so a suite could finish having shown the operator fewer results\n * than it ran. The `never` assignment in the default makes adding a status to\n * the enum a typecheck failure here rather than another silent omission.\n */\nexport function formatTestResultLine(event: {\n status: WorkflowTestStatus;\n name: string;\n errorMessage?: string | null;\n skipReason?: string | null;\n}): string | null {\n const { status, name } = event;\n const detail = excerpt(event.errorMessage);\n const reason = excerpt(event.skipReason);\n\n switch (status) {\n case 'queued':\n case 'running':\n // In-flight: the terminal event for this test is still coming.\n return null;\n case 'waiting':\n return ` \\u23F3 ${name} (waiting for scheduled time)`;\n case 'success':\n return ` \\u2713 ${name}`;\n case 'flaky_success':\n return ` \\u2713 ${name} (flaky \\u2014 passed on retry)`;\n case 'failed':\n return detail ? ` \\u2717 ${name}\\n Error: ${detail}` : ` \\u2717 ${name}`;\n case 'timeout':\n return detail\n ? ` \\u2717 ${name} (timed out)\\n Error: ${detail}`\n : ` \\u2717 ${name} (timed out)`;\n case 'canceled':\n return ` \\u2717 ${name} (canceled)`;\n case 'inconclusive':\n return detail\n ? ` ? ${name} (inconclusive \\u2014 no verdict)\\n Reason: ${detail}`\n : ` ? ${name} (inconclusive \\u2014 no verdict)`;\n case 'skipped':\n return reason ? ` \\u2013 ${name} (skipped: ${reason})` : ` \\u2013 ${name} (skipped)`;\n case 'degraded':\n return ` \\u2013 ${name} (degraded \\u2014 not run)`;\n default: {\n // Compile-time exhaustiveness; at runtime a status from a server newer\n // than this CLI reaches here, and a bare status word is a worse line than\n // none. The suite counters still force exit 2 for it (see formatSummary).\n const exhaustive: never = status;\n void exhaustive;\n return null;\n }\n }\n}\n\nexport function formatFailedTests(\n failedTests: FailedTest[],\n appUrl: string | undefined\n): string | null {\n if (failedTests.length === 0 || !appUrl) return null;\n\n const lines = ['', 'Failed tests:'];\n for (const t of failedTests) {\n lines.push(` \\u2717 ${t.name}`);\n lines.push(` ${appUrl}/runs/tests/${t.testRunId}`);\n }\n return lines.join('\\n');\n}\n\n/** A suite ran, but at least one workflow produced no verdict. */\nexport const EXIT_INCONCLUSIVE = 2;\n\n/**\n * Counters the verdict is computed from — read straight off one\n * `workflow-test-suite` event, so this cannot drift from the wire shape.\n */\nexport type SuiteSummaryStats = Pick<\n WorkflowTestSuiteEvent,\n | 'totalWorkflows'\n | 'completedWorkflows'\n | 'successfulWorkflows'\n | 'failedWorkflows'\n | 'inconclusiveWorkflows'\n | 'skippedWorkflows'\n | 'degradedWorkflows'\n | 'waitingWorkflows'\n>;\n\n/**\n * Summarize a finished suite and decide the process exit code.\n *\n * Three outcomes, not two. A run that produced no verdict — the platform\n * errored before it could check the product — is neither a pass nor a failure;\n * calling it a pass is how production suites that ran 9/9, 10/10 and 12/12\n * inconclusive each reported a green CI build having verified nothing. A real\n * failure still outranks one: a suite with both exits 1, because a product bug\n * is the more actionable signal.\n *\n * The green test is deliberately an INVARIANT rather than a list of the\n * statuses we currently know about: a suite is clean only when every workflow\n * is accounted for as passed, skipped, degraded, or still scheduled. Asking\n * instead whether `inconclusiveWorkflows > 0` would reopen this very bug the\n * day a new no-verdict status gets its own counter column — it would land in\n * neither term and exit 0 silently. Stated this way, anything the CLI cannot\n * account for forces exit 2, including a counter an older server never sent.\n *\n * The explicit `inconclusiveWorkflows` check is kept ALONGSIDE the invariant\n * rather than replaced by it, because the two fail in opposite directions and\n * neither can produce a false green alone. 24 of 2,164 production executions\n * in the 60 days to 2026-09-11 report counters summing ABOVE `totalWorkflows`\n * (overlapping counters), which zeroes `noVerdict` — and would hide a known\n * inconclusive behind an arithmetic artifact if the invariant were the only\n * test. No such execution has a non-zero inconclusive count today; this keeps\n * that from being load-bearing.\n */\nexport function formatSummary(stats: SuiteSummaryStats): { message: string; exitCode: number } {\n const {\n totalWorkflows,\n successfulWorkflows,\n failedWorkflows,\n completedWorkflows,\n inconclusiveWorkflows,\n skippedWorkflows,\n degradedWorkflows,\n waitingWorkflows,\n } = stats;\n\n if (totalWorkflows === 0) {\n return { message: 'No workflows found matching the filter criteria.', exitCode: 0 };\n }\n\n // Clamped per counter, not just on the total: production emits a NEGATIVE\n // `waitingWorkflows` on some executions (six in the 60 days to 2026-09-11,\n // e.g. total 31 / successful 31 / waiting -2 — a server-side counter\n // decremented past zero). Summed raw, that corrupt counter drags the total\n // below `totalWorkflows` and fails an all-green suite, which is a far worse\n // outcome than the miscount it comes from.\n const accountedFor =\n Math.max(0, successfulWorkflows) +\n Math.max(0, failedWorkflows) +\n Math.max(0, skippedWorkflows) +\n Math.max(0, degradedWorkflows) +\n Math.max(0, waitingWorkflows);\n const noVerdict = Math.max(0, totalWorkflows - accountedFor);\n\n const passRate = Math.round((successfulWorkflows / totalWorkflows) * 100);\n const stillWaiting = totalWorkflows - completedWorkflows;\n\n let message: string;\n let exitCode: number;\n\n if (failedWorkflows > 0) {\n message = `FAILED: ${failedWorkflows} of ${totalWorkflows} workflows failed (${passRate}% pass rate)`;\n if (inconclusiveWorkflows > 0) {\n message += `, ${inconclusiveWorkflows} inconclusive`;\n }\n exitCode = 1;\n } else if (noVerdict > 0 || inconclusiveWorkflows > 0) {\n // Whichever term actually fired: when overlapping counters zero `noVerdict`,\n // the inconclusive count is the only honest number left to report.\n const withoutVerdict = Math.max(noVerdict, inconclusiveWorkflows);\n message =\n `INCONCLUSIVE: ${withoutVerdict} of ${totalWorkflows} workflows produced no verdict ` +\n `(${successfulWorkflows} passed)`;\n exitCode = EXIT_INCONCLUSIVE;\n } else {\n message = `PASSED: ${successfulWorkflows} of ${totalWorkflows} workflows passed`;\n exitCode = 0;\n }\n\n if (stillWaiting > 0) {\n message += `\\nNote: ${stillWaiting} workflow(s) are still waiting (scheduled for later)`;\n }\n\n // Counters that sum past the total are impossible, so the verdict above rests\n // on numbers that disagree with each other. Surfaced rather than acted on: all\n // 24 such executions in the 60 days to 2026-09-11 also had failures and so\n // exit 1 regardless, and promoting an overcount to a failure on its own would\n // redden builds over a server-side miscount with no evidence anything is\n // actually wrong with the run.\n if (accountedFor > totalWorkflows) {\n message += `\\nNote: the server reported ${accountedFor} outcomes for ${totalWorkflows} workflows — counters disagree.`;\n }\n\n return { message, exitCode };\n}\n\nexport function formatExternalRunSummary(stats: {\n total: number;\n passed: number;\n failed: number;\n flaky: number;\n skipped: number;\n resultsTruncated: boolean;\n}): { message: string; exitCode: number } {\n const { total, passed, failed, flaky, skipped, resultsTruncated } = stats;\n\n if (resultsTruncated) {\n return {\n message: `FAILED: external run ended with incomplete results (${total} collected)`,\n exitCode: 1,\n };\n }\n if (total === 0) {\n return { message: 'FAILED: external run produced no test results', exitCode: 1 };\n }\n if (failed > 0) {\n return { message: `FAILED: ${failed} of ${total} external tests failed`, exitCode: 1 };\n }\n return {\n message: `PASSED: ${passed} passed, ${flaky} flaky, ${skipped} skipped`,\n exitCode: 0,\n };\n}\n\nexport function formatStreamReadFailure(error: unknown): string {\n const detail = error instanceof Error && error.message.trim() ? ` (${error.message})` : '';\n return [\n `Test result stream ended unexpectedly${detail}.`,\n 'The test suite may still be running in Canary.',\n 'Re-run the command or check the test suite in the app for final status.',\n ].join(' ');\n}\n\nexport function formatStreamClosedBeforeCompletion(): string {\n return [\n 'Test result stream ended before the suite completed.',\n 'The test suite may still be running in Canary.',\n 'Re-run the command or check the test suite in the app for final status.',\n ].join(' ');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAoBA,OAAO,aAAa;AACpB,SAAS,oBAA6C;;;ACMtD,eAAsB,kBACpB,QACA,OACA,aACA,gBACyB;AACzB,MAAI,CAAC,eAAe,CAAC,eAAgB,QAAO,CAAC;AAE7C,QAAM,MAAM,MAAM,MAAM,GAAG,MAAM,0BAA0B;AAAA,IACzD,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,EAC9C,CAAC;AAED,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAM,IAAI,MAAM,gCAAgC,IAAI,MAAM,IAAI,IAAI,EAAE;AAAA,EACtE;AAEA,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,MAAI,CAAC,KAAK,MAAM,CAAC,KAAK,YAAY;AAChC,UAAM,IAAI,MAAM,gCAAgC,KAAK,SAAS,eAAe,EAAE;AAAA,EACjF;AAEA,QAAM,EAAE,WAAW,IAAI;AACvB,MAAI;AAEJ,MAAI,aAAa;AACf,QAAI,QAAQ,KAAK,WAAW,GAAG;AAC7B,iBAAW,WAAW,KAAK,CAAC,MAAM,EAAE,OAAO,WAAW;AAAA,IACxD,OAAO;AACL,iBAAW,WAAW,KAAK,CAAC,MAAM,EAAE,KAAK,YAAY,MAAM,YAAY,YAAY,CAAC;AAAA,IACtF;AACA,QAAI,CAAC,UAAU;AACb,YAAM,YAAY,WAAW,IAAI,CAAC,MAAM,OAAO,EAAE,IAAI,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,IAAI;AAC5E,YAAM,IAAI;AAAA,QACR,gBAAgB,WAAW;AAAA;AAAA,EAA0C,SAAS;AAAA,MAChF;AAAA,IACF;AAAA,EACF,WAAW,gBAAgB;AAEzB,QAAI,WAAW,WAAW,GAAG;AAC3B,YAAM,IAAI,MAAM,6CAA6C;AAAA,IAC/D;AACA,QAAI,WAAW,SAAS,GAAG;AACzB,YAAM,YAAY,WAAW,IAAI,CAAC,MAAM,OAAO,EAAE,IAAI,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,IAAI;AAC5E,YAAM,IAAI;AAAA,QACR;AAAA;AAAA,EAAoG,SAAS;AAAA,MAC/G;AAAA,IACF;AACA,eAAW,WAAW,CAAC;AAAA,EACzB;AAEA,QAAM,SAAyB,CAAC;AAChC,MAAI,UAAU;AACZ,WAAO,aAAa,SAAS;AAE7B,QAAI,gBAAgB;AAClB,UAAI;AACJ,UAAI,QAAQ,KAAK,cAAc,GAAG;AAChC,cAAM,SAAS,aAAa,KAAK,CAAC,MAAM,EAAE,OAAO,cAAc;AAAA,MACjE,OAAO;AACL,cAAM,SAAS,aAAa;AAAA,UAC1B,CAAC,MACC,EAAE,KAAK,YAAY,MAAM,eAAe,YAAY,KACpD,EAAE,qBAAqB,YAAY,MAAM,eAAe,YAAY;AAAA,QACxE;AAAA,MACF;AACA,UAAI,CAAC,KAAK;AACR,cAAM,YAAY,SAAS,aACxB,IAAI,CAAC,MAAM,OAAO,EAAE,IAAI,GAAG,EAAE,YAAY,eAAe,EAAE,KAAK,EAAE,EAAE,GAAG,EACtE,KAAK,IAAI;AACZ,cAAM,IAAI;AAAA,UACR,gBAAgB,cAAc,gCAAgC,SAAS,IAAI;AAAA;AAAA,EAAgC,SAAS;AAAA,QACtH;AAAA,MACF;AACA,aAAO,gBAAgB,IAAI;AAAA,IAC7B;AAAA,EACF;AAEA,SAAO;AACT;;;ACnGO,SAAS,YAAY,MAAgB,KAAiC;AAC3E,QAAM,QAAQ,KAAK,QAAQ,GAAG;AAC9B,MAAI,UAAU,MAAM,SAAS,KAAK,SAAS,EAAG,QAAO;AACrD,SAAO,KAAK,QAAQ,CAAC;AACvB;AAEO,SAAS,QAAQ,SAAmB,OAA0B;AACnE,SAAO,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC;AACjD;AA8CO,SAAS,gBACd,SACA,OACM;AACN,MAAI,+BAA+B,IAAI,MAAM,MAAM,GAAG;AACpD,YAAQ,OAAO,MAAM,UAAU;AAC/B;AAAA,EACF;AACA,MAAI,8BAA8B,IAAI,MAAM,MAAM,GAAG;AACnD,YAAQ,IAAI,MAAM,YAAY,EAAE,MAAM,MAAM,MAAM,WAAW,MAAM,UAAU,CAAC;AAAA,EAChF;AACF;AAGA,IAAM,sBAAsB;AAE5B,IAAM,UAAU,CAAC,SAAmD;AAClE,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,QAAQ,SAAS,sBACpB,GAAG,QAAQ,MAAM,GAAG,mBAAmB,CAAC,WACxC;AACN;AAWO,SAAS,qBAAqB,OAKnB;AAChB,QAAM,EAAE,QAAQ,KAAK,IAAI;AACzB,QAAM,SAAS,QAAQ,MAAM,YAAY;AACzC,QAAM,SAAS,QAAQ,MAAM,UAAU;AAEvC,UAAQ,QAAQ;AAAA,IACd,KAAK;AAAA,IACL,KAAK;AAEH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,YAAY,IAAI;AAAA,IACzB,KAAK;AACH,aAAO,YAAY,IAAI;AAAA,IACzB,KAAK;AACH,aAAO,YAAY,IAAI;AAAA,IACzB,KAAK;AACH,aAAO,SAAS,YAAY,IAAI;AAAA,aAAgB,MAAM,KAAK,YAAY,IAAI;AAAA,IAC7E,KAAK;AACH,aAAO,SACH,YAAY,IAAI;AAAA,aAA4B,MAAM,KAClD,YAAY,IAAI;AAAA,IACtB,KAAK;AACH,aAAO,YAAY,IAAI;AAAA,IACzB,KAAK;AACH,aAAO,SACH,OAAO,IAAI;AAAA,cAAkD,MAAM,KACnE,OAAO,IAAI;AAAA,IACjB,KAAK;AACH,aAAO,SAAS,YAAY,IAAI,cAAc,MAAM,MAAM,YAAY,IAAI;AAAA,IAC5E,KAAK;AACH,aAAO,YAAY,IAAI;AAAA,IACzB,SAAS;AAIP,YAAM,aAAoB;AAC1B,WAAK;AACL,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEO,SAAS,kBACd,aACA,QACe;AACf,MAAI,YAAY,WAAW,KAAK,CAAC,OAAQ,QAAO;AAEhD,QAAM,QAAQ,CAAC,IAAI,eAAe;AAClC,aAAW,KAAK,aAAa;AAC3B,UAAM,KAAK,YAAY,EAAE,IAAI,EAAE;AAC/B,UAAM,KAAK,OAAO,MAAM,eAAe,EAAE,SAAS,EAAE;AAAA,EACtD;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAGO,IAAM,oBAAoB;AA6C1B,SAAS,cAAc,OAAiE;AAC7F,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,MAAI,mBAAmB,GAAG;AACxB,WAAO,EAAE,SAAS,oDAAoD,UAAU,EAAE;AAAA,EACpF;AAQA,QAAM,eACJ,KAAK,IAAI,GAAG,mBAAmB,IAC/B,KAAK,IAAI,GAAG,eAAe,IAC3B,KAAK,IAAI,GAAG,gBAAgB,IAC5B,KAAK,IAAI,GAAG,iBAAiB,IAC7B,KAAK,IAAI,GAAG,gBAAgB;AAC9B,QAAM,YAAY,KAAK,IAAI,GAAG,iBAAiB,YAAY;AAE3D,QAAM,WAAW,KAAK,MAAO,sBAAsB,iBAAkB,GAAG;AACxE,QAAM,eAAe,iBAAiB;AAEtC,MAAI;AACJ,MAAI;AAEJ,MAAI,kBAAkB,GAAG;AACvB,cAAU,WAAW,eAAe,OAAO,cAAc,sBAAsB,QAAQ;AACvF,QAAI,wBAAwB,GAAG;AAC7B,iBAAW,KAAK,qBAAqB;AAAA,IACvC;AACA,eAAW;AAAA,EACb,WAAW,YAAY,KAAK,wBAAwB,GAAG;AAGrD,UAAM,iBAAiB,KAAK,IAAI,WAAW,qBAAqB;AAChE,cACE,iBAAiB,cAAc,OAAO,cAAc,mCAChD,mBAAmB;AACzB,eAAW;AAAA,EACb,OAAO;AACL,cAAU,WAAW,mBAAmB,OAAO,cAAc;AAC7D,eAAW;AAAA,EACb;AAEA,MAAI,eAAe,GAAG;AACpB,eAAW;AAAA,QAAW,YAAY;AAAA,EACpC;AAQA,MAAI,eAAe,gBAAgB;AACjC,eAAW;AAAA,4BAA+B,YAAY,iBAAiB,cAAc;AAAA,EACvF;AAEA,SAAO,EAAE,SAAS,SAAS;AAC7B;AAEO,SAAS,yBAAyB,OAOC;AACxC,QAAM,EAAE,OAAO,QAAQ,QAAQ,OAAO,SAAS,iBAAiB,IAAI;AAEpE,MAAI,kBAAkB;AACpB,WAAO;AAAA,MACL,SAAS,uDAAuD,KAAK;AAAA,MACrE,UAAU;AAAA,IACZ;AAAA,EACF;AACA,MAAI,UAAU,GAAG;AACf,WAAO,EAAE,SAAS,iDAAiD,UAAU,EAAE;AAAA,EACjF;AACA,MAAI,SAAS,GAAG;AACd,WAAO,EAAE,SAAS,WAAW,MAAM,OAAO,KAAK,0BAA0B,UAAU,EAAE;AAAA,EACvF;AACA,SAAO;AAAA,IACL,SAAS,WAAW,MAAM,YAAY,KAAK,WAAW,OAAO;AAAA,IAC7D,UAAU;AAAA,EACZ;AACF;AAEO,SAAS,wBAAwB,OAAwB;AAC9D,QAAM,SAAS,iBAAiB,SAAS,MAAM,QAAQ,KAAK,IAAI,KAAK,MAAM,OAAO,MAAM;AACxF,SAAO;AAAA,IACL,wCAAwC,MAAM;AAAA,IAC9C;AAAA,IACA;AAAA,EACF,EAAE,KAAK,GAAG;AACZ;AAEO,SAAS,qCAA6C;AAC3D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,GAAG;AACZ;;;AF7QA,IAAM,oBAAuC;AAAA,EAC3C,gBAAgB;AAAA,EAChB,oBAAoB;AAAA,EACpB,qBAAqB;AAAA,EACrB,iBAAiB;AAAA,EACjB,uBAAuB;AAAA,EACvB,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,kBAAkB;AACpB;AAgBA,SAAS,qBAAqB,QAAgB,MAAsB;AAClE,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,QAAI,OAAO,cAAc,QAAQ,OAAO,OAAO,UAAU,UAAU;AACjE,aAAO,UAAU,OAAO,KAAK;AAAA,IAC/B;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,0BAA0B,MAAM;AAAA,EAAK,IAAI;AAClD;AA8BA,eAAe,qBACb,QACA,OACA,UACA,eACA,iBACA,SACA,mBACA,eACA,cACA,mBACA,uBAC4B;AAC5B,QAAM,cAAc;AAAA,IAClB,eAAe,UAAU,KAAK;AAAA,IAC9B,gBAAgB;AAAA,EAClB;AAGA,QAAM,QAAQ,MAAM,iBAAiB,UAAU,QAAQ,KAAK;AAK5D,iBAAe,wBAAwB,MAAM,IAAI,EAAE;AACnD,UAAQ,IAAI,eAAe,eAAe,EAAE;AAC5C,MAAI,oBAAoB,WAAW,cAAe,SAAQ,IAAI,kBAAkB,aAAa,EAAE;AAC/F,MAAI,aAAc,SAAQ,IAAI,gBAAgB,YAAY,iCAAiC;AAC3F,UAAQ,IAAI,EAAE;AAEd,QAAM,UAQF;AAAA,IACF;AAAA,EACF;AAEA,MAAI,iBAAiB,OAAW,SAAQ,KAAK;AAC7C,MAAI,oBAAoB,WAAW,cAAe,SAAQ,gBAAgB;AAC1E,MAAI,kBAAmB,SAAQ,oBAAoB;AACnD,MAAI,cAAe,SAAQ,gBAAgB;AAC3C,MAAI,sBAAsB,OAAW,SAAQ,oBAAoB;AACjE,MAAI,0BAA0B,OAAW,SAAQ,wBAAwB;AAEzE,QAAM,SAAS,MAAM,MAAM,GAAG,MAAM,gBAAgB,MAAM,EAAE,QAAQ;AAAA,IAClE,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,MAAM,KAAK,UAAU,OAAO;AAAA,EAC9B,CAAC;AACD,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,OAAO,MAAM,OAAO,KAAK;AAE/B,QAAI;AACF,YAAM,UAAU,KAAK,MAAM,IAAI;AAC/B,UAAI,QAAQ,cAAc,QAAQ,QAAQ,QAAQ;AAChD,gBAAQ,MAAM,UAAU,QAAQ,SAAS,sBAAsB,KAAK,QAAQ,MAAM,EAAE;AACpF,gBAAQ,KAAK,CAAC;AAAA,MAChB;AAAA,IACF,QAAQ;AAAA,IAER;AACA,YAAQ,MAAM,0BAA0B,OAAO,MAAM,EAAE;AACvD,YAAQ,MAAM,IAAI;AAClB,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,QAAM,UAAW,MAAM,OAAO,KAAK;AAKnC,MAAI,CAAC,QAAQ,MAAM,CAAC,QAAQ,MAAM;AAChC,YAAQ,MAAM,0BAA0B,QAAQ,SAAS,eAAe,EAAE;AAC1E,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,MAAI,SAAS;AACX,YAAQ;AAAA,MACN,QAAQ,KAAK,SAAS,aAClB,oBAAoB,QAAQ,KAAK,KAAK,KACtC,iBAAiB,QAAQ,KAAK,WAAW;AAAA,IAC/C;AACA,YAAQ,IAAI,WAAW,QAAQ,KAAK,KAAK,EAAE;AAC3C,YAAQ,IAAI,EAAE;AAAA,EAChB;AACA,SAAO,QAAQ;AACjB;AAEA,eAAsB,kBACpB,QACA,OACA,KACA,SACgB;AAChB,QAAM,WAAW,MAAM,MAAM,GAAG,MAAM,SAAS,IAAI,KAAK,WAAW;AAAA,IACjE,SAAS,EAAE,eAAe,UAAU,KAAK,IAAI,QAAQ,oBAAoB;AAAA,EAC3E,CAAC;AACD,MAAI,CAAC,SAAS,MAAM,CAAC,SAAS,MAAM;AAClC,YAAQ,MAAM,6CAA6C,SAAS,MAAM,EAAE;AAC5E,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,MAAI,SAAS;AACb,MAAI,WAAW;AACf,QAAM,SAAS,aAAa;AAAA,IAC1B,SAAS,CAAC,UAA8B;AACtC,UAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,OAAO,WAAW,eAAe,EAAG;AAC9D,UAAI;AACF,cAAM,OAAO,KAAK,MAAM,MAAM,IAAI;AAClC,YAAI,QAAS,SAAQ,IAAI,IAAI,MAAM,KAAK,KAAK,KAAK,UAAU,IAAI,CAAC,EAAE;AACnE,YAAI,MAAM,UAAU,wBAAwB,CAAC,SAAS;AACpD,kBAAQ;AAAA,YACN,WAAW,OAAO,KAAK,UAAU,CAAC,IAAI,OAAO,KAAK,UAAU,CAAC,KAAK,OAAO,KAAK,KAAK,CAAC,aAAa,OAAO,KAAK,OAAO,CAAC;AAAA,UACvH;AAAA,QACF;AACA,YAAI,MAAM,UAAU,yBAAyB,KAAK,WAAW,YAAY;AACvE,mBAAS;AACT,qBAAW;AACX,kBAAQ,MAAM,iCAAiC;AAAA,QACjD;AACA,YAAI,MAAM,UAAU,uBAAuB;AACzC,mBAAS;AACT,gBAAM,QAAQ,OAAO,KAAK,SAAS,CAAC;AACpC,gBAAM,SAAS,OAAO,KAAK,UAAU,CAAC;AACtC,gBAAM,SAAS,OAAO,KAAK,UAAU,CAAC;AACtC,gBAAM,QAAQ,OAAO,KAAK,SAAS,CAAC;AACpC,gBAAM,UAAU,OAAO,KAAK,WAAW,CAAC;AACxC,gBAAM,UAAU,yBAAyB;AAAA,YACvC;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA,kBAAkB,KAAK,qBAAqB;AAAA,UAC9C,CAAC;AACD,kBAAQ,IAAI,EAAE;AACd,kBAAQ,IAAI,SAAI,OAAO,EAAE,CAAC;AAC1B,kBAAQ,IAAI,QAAQ,OAAO;AAC3B,cAAI,IAAI,aAAc,SAAQ,IAAI,cAAc,IAAI,YAAY,EAAE;AAClE,kBAAQ,IAAI,QAAQ,OAAO,QAAQ,aAAa,EAAE,CAAC,GAAG,IAAI,MAAM,EAAE;AAClE,qBAAW,QAAQ;AAAA,QACrB;AAAA,MACF,SAAS,OAAO;AACd,YAAI,QAAS,SAAQ,MAAM,mCAAmC,OAAO,KAAK,CAAC,EAAE;AAAA,MAC/E;AAAA,IACF;AAAA,EACF,CAAC;AACD,QAAM,SAAS,SAAS,KAAK,UAAU;AACvC,QAAM,UAAU,IAAI,YAAY;AAChC,MAAI;AACF,WAAO,CAAC,QAAQ;AACd,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AACV,aAAO,KAAK,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC,CAAC;AAAA,IACrD;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,wBAAwB,KAAK,CAAC;AAAA,EAC9C,UAAE;AACA,WAAO,YAAY;AAAA,EACrB;AACA,MAAI,CAAC,OAAQ,SAAQ,MAAM,mCAAmC,CAAC;AAC/D,UAAQ,KAAK,QAAQ;AACvB;AAEA,eAAsB,cAAc,MAA+B;AACjE,QAAM,cAAc,KAAK,OAAO,CAAC,QAAQ,QAAQ,cAAc,IAAI,WAAW,WAAW,CAAC;AAC1F,QAAM,SAAS,kBAAkB,MAAM,UAAU;AACjD,MAAI,YAAY,SAAS,KAAM,YAAY,WAAW,KAAK,WAAW,QAAQ,WAAW,OAAQ;AAC/F,YAAQ,MAAM,mCAAmC;AACjD,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,QAAM,wBAAwB,WAAW,SAAY,SAAY,WAAW;AAC5E,MAAI,KAAK,KAAK,CAAC,QAAQ,IAAI,WAAW,wBAAwB,CAAC,GAAG;AAChE,YAAQ,MAAM,wFAAwF;AACtG,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,QAAM,EAAE,QAAQ,MAAM,IAAI,MAAM,cAAc,IAAI;AAElD,QAAM,MAAM,YAAY,MAAM,OAAO;AACrC,QAAM,cAAc,YAAY,MAAM,gBAAgB;AAEtD,QAAM,cAAc,YAAY,MAAM,eAAe,KAAK,YAAY,MAAM,YAAY;AACxF,QAAM,iBAAiB,YAAY,MAAM,eAAe;AACxD,QAAM,WAAW,YAAY,MAAM,SAAS;AAC5C,QAAM,eAAe,YAAY,MAAM,iBAAiB;AACxD,QAAM,eAAe,YAAY,MAAM,iBAAiB;AACxD,QAAM,oBAAoB,YAAY,MAAM,uBAAuB;AACnE,MAAI,QAAQ,MAAM,uBAAuB,MAAM,CAAC,qBAAqB,kBAAkB,WAAW,IAAI,IAAI;AACxG,YAAQ,MAAM,sDAAsD;AACpE,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,QAAM,UAAU,YAAY,MAAM,QAAQ;AAC1C,QAAM,UAAU,QAAQ,MAAM,aAAa,IAAI;AAC/C,QAAM,kBAAkB,YAAY,MAAM,MAAM;AAEhD,MAAI,QAAQ,MAAM,MAAM,KAAK,CAAC,iBAAiB;AAC7C,YAAQ,MAAM,qCAAqC;AACnD,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,MAAI,oBAAoB,UAAa,CAAC,UAAU;AAC9C,YAAQ,MAAM,yCAAyC;AACvD,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,OAAK,gBAAgB,gBAAgB,YAAY,UAAa,sBAAsB,UAAa,0BAA0B,WAAc,CAAC,UAAU;AAClJ,YAAQ,MAAM,gHAAgH;AAC9H,YAAQ,KAAK,CAAC;AAAA,EAChB;AAGA,MAAI,YAAY,UAAa,cAAc;AACzC,YAAQ;AAAA,MACN;AAAA,IAEF;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB;AAOA,QAAM,gBACJ,YAAY,SACR,SACA,QACG,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;AACzC,MAAI,iBAAiB,cAAc,WAAW,GAAG;AAC/C,YAAQ,MAAM,6CAA6C;AAC3D,YAAQ,KAAK,CAAC;AAAA,EAChB;AAIA,QAAM,aAAa,YAAY,MAAM,YAAY;AACjD,MAAI,eAAe,UAAa,eAAe,WAAW,eAAe,SAAS;AAChF,YAAQ,MAAM,sDAAsD,UAAU,KAAK;AACnF,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,QAAM,kBACH,eAAiD,iBAAiB,UAAU;AAC/E,MAAI,oBAAoB,WAAW,CAAC,gBAAgB;AAClD,YAAQ,MAAM,2DAA2D;AACzE,YAAQ,KAAK,CAAC;AAAA,EAChB;AAGA,MAAI,iBAAiC,CAAC;AACtC,MAAI,eAAe,gBAAgB;AACjC,QAAI;AACF,uBAAiB,MAAM,kBAAkB,QAAQ,OAAO,aAAa,cAAc;AAAA,IACrF,SAAS,KAAK;AACZ,cAAQ,MAAM,GAAG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AACnE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AAEA,UAAQ,IAAI,mCAAmC;AAC/C,MAAI,eAAe,WAAY,SAAQ,IAAI,kBAAkB,WAAW,EAAE;AAC1E,MAAI,eAAe,cAAe,SAAQ,IAAI,kBAAkB,cAAc,EAAE;AAChF,MAAI,IAAK,SAAQ,IAAI,uBAAuB,GAAG,EAAE;AACjD,MAAI,YAAa,SAAQ,IAAI,gCAAgC,WAAW,EAAE;AAC1E,UAAQ,IAAI,EAAE;AAEd,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI,eAA8B;AAElC,MAAI,UAAU;AAEZ,UAAM,YAAY,MAAM;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA,gBAAgB,eACZ,EAAE,GAAI,eAAe,EAAE,UAAU,aAAa,IAAI,CAAC,GAAI,GAAI,eAAe,EAAE,MAAM,aAAa,IAAI,CAAC,EAAG,IACvG;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,UAAU,SAAS,YAAY;AACjC,aAAO,MAAM,kBAAkB,QAAQ,OAAO,WAAW,OAAO;AAAA,IAClE;AACA,mBAAe,UAAU;AACzB,cAAU,UAAU;AACpB,YAAQ,UAAU;AAAA,EACpB,OAAO;AAEL,UAAM,cAAc,IAAI,gBAAgB;AACxC,QAAI,IAAK,aAAY,IAAI,OAAO,GAAG;AACnC,QAAI,YAAa,aAAY,IAAI,eAAe,WAAW;AAE3D,UAAM,aAAa,GAAG,MAAM,uBAAuB,YAAY,SAAS,IAAI,IAAI,WAAW,KAAK,EAAE;AAElG,UAAM,OAA+B,EAAE,gBAAgB;AACvD,QAAI,eAAe,WAAY,MAAK,aAAa,eAAe;AAChE,QAAI,oBAAoB,WAAW,eAAe;AAChD,WAAK,gBAAgB,eAAe;AAEtC,QAAI;AACJ,QAAI;AACF,mBAAa,MAAM,MAAM,YAAY;AAAA,QACnC,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,eAAe,UAAU,KAAK;AAAA,UAC9B,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,UAAU,IAAI;AAAA,MAC3B,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,cAAQ,MAAM,6BAA6B,GAAG,EAAE;AAChD,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,QAAI,CAAC,WAAW,IAAI;AAClB,cAAQ,MAAM,qBAAqB,WAAW,QAAQ,MAAM,WAAW,KAAK,CAAC,CAAC;AAC9E,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,cAAe,MAAM,WAAW,KAAK;AAC3C,QAAI,CAAC,YAAY,MAAM,CAAC,YAAY,SAAS;AAC3C,cAAQ,MAAM,0BAA0B,YAAY,SAAS,eAAe,EAAE;AAC9E,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,cAAU,YAAY;AACtB,YAAQ,YAAY;AACpB,aAAS,YAAY;AAAA,EACvB;AAEA,MAAI,SAAS;AACX,YAAQ,IAAI,aAAa,OAAO,EAAE;AAClC,YAAQ,IAAI,WAAW,KAAK,EAAE;AAC9B,YAAQ,IAAI,EAAE;AAAA,EAChB;AAGA,QAAM,YAAY,GAAG,MAAM,uCAAuC,OAAO;AAEzE,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,MAAM,WAAW;AAAA,MACjC,SAAS;AAAA,QACP,eAAe,UAAU,KAAK;AAAA,QAC9B,QAAQ;AAAA,MACV;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,YAAQ,MAAM,sCAAsC,GAAG,EAAE;AACzD,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,MAAI,CAAC,UAAU,MAAM,CAAC,UAAU,MAAM;AACpC,YAAQ,MAAM,sCAAsC,UAAU,MAAM,EAAE;AACtE,YAAQ,KAAK,CAAC;AAAA,EAChB;AAGA,MAAI,eAAe;AACnB,QAAM,gBAAgB,oBAAI,IAAoB;AAC9C,QAAM,cAAiC,oBAAI,IAAI;AAI/C,MAAI,aAAgC;AACpC,MAAI,oBAAoB;AAGxB,QAAM,SAAS,aAAa;AAAA,IAC1B,SAAS,CAAC,UAA8B;AACtC,UAAI,CAAC,MAAM,KAAM;AAEjB,UAAI;AACF,cAAM,OAAO,KAAK,MAAM,MAAM,IAAI;AAKlC,YAAI,SAAS;AACX,kBAAQ,IAAI,IAAI,MAAM,KAAK,KAAK,KAAK,UAAU,IAAI,CAAC,EAAE;AAAA,QACxD;AAEA,YAAI,MAAM,UAAU,iBAAiB;AACnC,gBAAM,YAAY;AAClB,gBAAM,EAAE,QAAQ,YAAY,QAAQ,IAAI;AACxC,gBAAM,OACJ,cAAc,IAAI,UAAU,KAC5B,SAAS,QAAQ,oBAAoB,IAAI,KACzC;AAEF,cAAI,SAAS,WAAW,QAAQ,GAAG;AACjC,kBAAM,QAAQ,QAAQ,MAAM,gBAAgB;AAC5C,gBAAI,MAAO,eAAc,IAAI,YAAY,MAAM,CAAC,CAAC;AAAA,UACnD;AAKA,0BAAgB,aAAa;AAAA,YAC3B;AAAA,YACA;AAAA,YACA;AAAA,YACA,WAAW,UAAU;AAAA,UACvB,CAAC;AAED,cAAI,CAAC,SAAS;AACZ,kBAAM,OAAO,qBAAqB;AAAA,cAChC;AAAA,cACA;AAAA,cACA,cAAc,UAAU;AAAA,cACxB,YAAY,UAAU;AAAA,YACxB,CAAC;AACD,gBAAI,KAAM,SAAQ,IAAI,IAAI;AAAA,UAC5B;AAAA,QACF;AAEA,YAAI,MAAM,UAAU,uBAAuB;AACzC,gBAAM,aAAa;AACnB,uBAAa;AAEb,cAAI,WAAW,WAAW,aAAa;AACrC,2BAAe;AAAA,UACjB;AAAA,QACF;AAEA,YAAI,MAAM,UAAU,SAAS;AAC3B,gBAAM,YAAY;AAClB,kBAAQ,MAAM,iBAAiB,UAAU,SAAS,eAAe,EAAE;AACnE,8BAAoB;AAAA,QACtB;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF,CAAC;AAED,QAAM,SAAS,UAAU,KAAK,UAAU;AACxC,QAAM,UAAU,IAAI,YAAY;AAEhC,MAAI;AACF,WAAO,CAAC,cAAc;AACpB,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,MAAM;AACR,YAAI,CAAC,cAAc;AACjB,8BAAoB;AACpB,kBAAQ,MAAM,mCAAmC,CAAC;AAAA,QACpD;AACA;AAAA,MACF;AACA,aAAO,KAAK,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC,CAAC;AAAA,IACrD;AAAA,EACF,SAAS,KAAK;AACZ,wBAAoB;AACpB,YAAQ,MAAM,wBAAwB,GAAG,CAAC;AAAA,EAC5C,UAAE;AACA,WAAO,YAAY;AAAA,EACrB;AAGA,UAAQ,IAAI,EAAE;AACd,UAAQ,IAAI,SAAI,OAAO,EAAE,CAAC;AAI1B,QAAM,UAAU,cAAc,UAAU;AACxC,UAAQ,IAAI,QAAQ,OAAO;AAC3B,MAAI,aAAc,SAAQ,IAAI,cAAc,YAAY,EAAE;AAO1D,MAAI,WAAW,QAAQ;AACvB,MAAI,mBAAmB;AACrB,YAAQ,IAAI,4EAAuE;AACnF,eAAW;AAAA,EACb;AAEA,QAAM,gBAAgB,kBAAkB,CAAC,GAAG,YAAY,OAAO,CAAC,GAAG,MAAM;AACzE,MAAI,eAAe;AACjB,YAAQ,IAAI,aAAa;AAAA,EAC3B;AAEA,MAAI,WAAW,kBAAkB,GAAG;AAClC,YAAQ,IAAI,EAAE;AACd,YAAQ,IAAI,8BAA8B,OAAO,EAAE;AAAA,EACrD;AAEA,UAAQ,KAAK,QAAQ;AACvB;","names":[]}

package/dist/{chunk-RA2NRAWU.js → chunk-62EXS76C.js} RENAMED Viewed

@@ -1,24 +1,24 @@
 import { createRequire as __cr } from "module"; import { fileURLToPath as __fup } from "url"; import { dirname as __dn } from "path"; const require = __cr(import.meta.url); const __filename = __fup(import.meta.url); const __dirname = __dn(__filename);
 import {
   loadTeamsChannels
-} from "./chunk-MQQCUU5S.js";
+} from "./chunk-DEVD2WD2.js";
 import {
   resolveTeamsChannelRefs
-} from "./chunk-YACDH6MJ.js";
+} from "./chunk-XHEVDABB.js";
 import {
   apiRequest,
   fetchList,
   getArgValues,
   getPositionalArg
-} from "./chunk-TRC63RSK.js";
+} from "./chunk-EWK44F6V.js";
 import {
   GLOBAL_VALUE_FLAGS,
   getArgValue,
   hasFlag
-} from "./chunk-ZFN5FWN2.js";
+} from "./chunk-4MFMPC5P.js";
 import {
   writeRawOutput
-} from "./chunk-KNWKOKM7.js";
+} from "./chunk-2OHYMT3A.js";
 // src/slack-channels.ts
 var SLACK_CHANNELS_PATH = "/integrations/slack/channels";
@@ -440,4 +440,4 @@ export {
   createRule,
   updateRule
 };
-//# sourceMappingURL=chunk-RA2NRAWU.js.map
+//# sourceMappingURL=chunk-62EXS76C.js.map