@runcofactor/cli 0.55.0 → 0.56.0

package/dist/{workflow-cache-ACGM3BOI.js → workflow-cache-MNLEMRMM.js}

@@ -24,35 +24,35 @@ import {
   serializeNodeDecisionLog,
   timelineActionCode,
   traceActionWithPreview
-} from "./chunk-YEH7UIUY.js";
+} from "./chunk-KTZRI27M.js";
 import {
   materializeRunWorkspace
-} from "./chunk-MB4FS35J.js";
-import "./chunk-W6DL4IP6.js";
-import "./chunk-Z72GWGH2.js";
+} from "./chunk-56HFZHQM.js";
+import "./chunk-3LGCHNBC.js";
+import "./chunk-GCD4EHCD.js";
 import "./chunk-PBTGJYM5.js";
-import "./chunk-3KBYI6RR.js";
+import "./chunk-H6ZMKNP7.js";
 import {
   apiRequest,
   promptInput
-} from "./chunk-WWUEKQLR.js";
-import "./chunk-ZZZ33KTO.js";
+} from "./chunk-EWK44F6V.js";
+import "./chunk-K2IDR6FR.js";
 import "./chunk-S3Q7MDCS.js";
 import {
   getArgValue,
   hasFlag
-} from "./chunk-BJHAVM7Z.js";
+} from "./chunk-4MFMPC5P.js";
 import {
   writeRawOutput
-} from "./chunk-KL2ARGH6.js";
+} from "./chunk-2OHYMT3A.js";
 import "./chunk-AK7WEGGB.js";
 import "./chunk-5QHORHJT.js";
 import {
   parseTraceArchive
-} from "./chunk-JQG3V5E3.js";
+} from "./chunk-2E3STBHS.js";
 import {
   matchAssertionSpecsToVerifySteps
-} from "./chunk-U3MRXQZS.js";
+} from "./chunk-RHWPZKRV.js";
 import "./chunk-TOWZAG3I.js";
 
 // src/workflow-cache.ts
@@ -621,7 +621,7 @@ async function handleWorkflowCache(argv, apiUrl, token) {
       await handleConvergenceReport(rest, apiUrl, token);
       return;
     case "convergence-resolve": {
-      const { handleConvergenceResolve } = await import("./workflow-cache-convergence-resolve-KEQDQMKL.js");
+      const { handleConvergenceResolve } = await import("./workflow-cache-convergence-resolve-G5HJM6MF.js");
       await handleConvergenceResolve(rest, apiUrl, token);
       return;
     }
@@ -1594,7 +1594,7 @@ async function handleSubstrate(argv) {
     process2.exit(1);
   }
   const actionIndex = Number(actionIndexRaw);
-  const { SubstrateMaterializer: SubstrateMaterializer2 } = await import("./src-ECZWYNSV.js");
+  const { SubstrateMaterializer: SubstrateMaterializer2 } = await import("./src-KH6WSBJV.js");
   const path3 = await import("path");
   const traceZipPath = path3.join(workspace, "browser", "trace.zip");
   const materializer = new SubstrateMaterializer2({
@@ -1630,8 +1630,8 @@ async function handleLocator(argv) {
     }
   }
   const actionIndex = Number(actionIndexRaw);
-  const { HeadlessDomSession: HeadlessDomSession2, SubstrateMaterializer: SubstrateMaterializer2, LocatorVerifier: LocatorVerifier2, buildLocator } = await import("./src-ECZWYNSV.js");
-  const { parseSnapshot } = await import("./src-OKSAEHQS.js");
+  const { HeadlessDomSession: HeadlessDomSession2, SubstrateMaterializer: SubstrateMaterializer2, LocatorVerifier: LocatorVerifier2, buildLocator } = await import("./src-KH6WSBJV.js");
+  const { parseSnapshot } = await import("./src-2X5OQRPJ.js");
   const path3 = await import("path");
   const session = new HeadlessDomSession2();
   const traceZipPath = path3.join(workspace, "browser", "trace.zip");
@@ -1804,4 +1804,4 @@ export {
   readCacheRecipeFile,
   timelineActionCode
 };
-//# sourceMappingURL=workflow-cache-ACGM3BOI.js.map
+//# sourceMappingURL=workflow-cache-MNLEMRMM.js.map

package/dist/{workflow-cache-convergence-resolve-KEQDQMKL.js → workflow-cache-convergence-resolve-G5HJM6MF.js}

@@ -1,16 +1,16 @@
 import { createRequire as __cr } from "module"; import { fileURLToPath as __fup } from "url"; import { dirname as __dn } from "path"; const require = __cr(import.meta.url); const __filename = __fup(import.meta.url); const __dirname = __dn(__filename);
 import {
   apiRequest
-} from "./chunk-WWUEKQLR.js";
+} from "./chunk-EWK44F6V.js";
 import "./chunk-S3Q7MDCS.js";
 import {
   getArgValue,
   hasFlag
-} from "./chunk-BJHAVM7Z.js";
+} from "./chunk-4MFMPC5P.js";
 import {
   writeRawOutput
-} from "./chunk-KL2ARGH6.js";
-import "./chunk-U3MRXQZS.js";
+} from "./chunk-2OHYMT3A.js";
+import "./chunk-RHWPZKRV.js";
 import "./chunk-TOWZAG3I.js";
 
 // src/workflow-cache-convergence-resolve.ts
@@ -42,4 +42,4 @@ async function handleConvergenceResolve(argv, apiUrl, token) {
 export {
   handleConvergenceResolve
 };
-//# sourceMappingURL=workflow-cache-convergence-resolve-KEQDQMKL.js.map
+//# sourceMappingURL=workflow-cache-convergence-resolve-G5HJM6MF.js.map

package/dist/{workflow-debug-TVLBNRCB.js → workflow-debug-TNBUGSBK.js}

@@ -4,19 +4,19 @@ import {
   handleWorkflowDebug,
   materializeRunWorkspace,
   resolveWorkflowIdForRun
-} from "./chunk-MB4FS35J.js";
-import "./chunk-W6DL4IP6.js";
-import "./chunk-Z72GWGH2.js";
-import "./chunk-3KBYI6RR.js";
-import "./chunk-WWUEKQLR.js";
-import "./chunk-ZZZ33KTO.js";
+} from "./chunk-56HFZHQM.js";
+import "./chunk-3LGCHNBC.js";
+import "./chunk-GCD4EHCD.js";
+import "./chunk-H6ZMKNP7.js";
+import "./chunk-EWK44F6V.js";
+import "./chunk-K2IDR6FR.js";
 import "./chunk-S3Q7MDCS.js";
-import "./chunk-BJHAVM7Z.js";
-import "./chunk-KL2ARGH6.js";
+import "./chunk-4MFMPC5P.js";
+import "./chunk-2OHYMT3A.js";
 import "./chunk-AK7WEGGB.js";
 import "./chunk-5QHORHJT.js";
-import "./chunk-JQG3V5E3.js";
-import "./chunk-U3MRXQZS.js";
+import "./chunk-2E3STBHS.js";
+import "./chunk-RHWPZKRV.js";
 import "./chunk-TOWZAG3I.js";
 export {
   formatRetention,
@@ -24,4 +24,4 @@ export {
   materializeRunWorkspace,
   resolveWorkflowIdForRun
 };
-//# sourceMappingURL=workflow-debug-TVLBNRCB.js.map
+//# sourceMappingURL=workflow-debug-TNBUGSBK.js.map

package/dist/{workflow-feedback-GB5VPGE2.js → workflow-feedback-G2ZXAUGI.js}

@@ -1,16 +1,16 @@
 import { createRequire as __cr } from "module"; import { fileURLToPath as __fup } from "url"; import { dirname as __dn } from "path"; const require = __cr(import.meta.url); const __filename = __fup(import.meta.url); const __dirname = __dn(__filename);
 import {
   apiRequest
-} from "./chunk-WWUEKQLR.js";
+} from "./chunk-EWK44F6V.js";
 import "./chunk-S3Q7MDCS.js";
 import {
   getArgValue,
   hasFlag
-} from "./chunk-BJHAVM7Z.js";
+} from "./chunk-4MFMPC5P.js";
 import {
   writeRawOutput
-} from "./chunk-KL2ARGH6.js";
-import "./chunk-U3MRXQZS.js";
+} from "./chunk-2OHYMT3A.js";
+import "./chunk-RHWPZKRV.js";
 import "./chunk-TOWZAG3I.js";
 
 // src/workflow-feedback.ts
@@ -154,4 +154,4 @@ async function handleWorkflowFeedback(argv, apiUrl, token) {
 export {
   handleWorkflowFeedback
 };
-//# sourceMappingURL=workflow-feedback-GB5VPGE2.js.map
+//# sourceMappingURL=workflow-feedback-G2ZXAUGI.js.map

package/dist/{workflow-fork-2IPJNR76.js → workflow-fork-6HHOMC2D.js}

@@ -5,16 +5,16 @@ import {
 import {
   apiRequest,
   getPositionalArg
-} from "./chunk-WWUEKQLR.js";
+} from "./chunk-EWK44F6V.js";
 import "./chunk-S3Q7MDCS.js";
 import {
   getArgValue,
   hasFlag
-} from "./chunk-BJHAVM7Z.js";
+} from "./chunk-4MFMPC5P.js";
 import {
   writeRawOutput
-} from "./chunk-KL2ARGH6.js";
-import "./chunk-U3MRXQZS.js";
+} from "./chunk-2OHYMT3A.js";
+import "./chunk-RHWPZKRV.js";
 import "./chunk-TOWZAG3I.js";
 
 // src/workflow-fork.ts
@@ -239,4 +239,4 @@ export {
   buildForkNodeMap,
   handleWorkflowFork
 };
-//# sourceMappingURL=workflow-fork-2IPJNR76.js.map
+//# sourceMappingURL=workflow-fork-6HHOMC2D.js.map

package/dist/{workflow-promotion-QEQUXVUT.js → workflow-promotion-RG7L6JZT.js}

@@ -5,15 +5,15 @@ import {
   getPositionalArg,
   getScalarArgValue,
   resolveTestSuite
-} from "./chunk-WWUEKQLR.js";
+} from "./chunk-EWK44F6V.js";
 import "./chunk-S3Q7MDCS.js";
-import "./chunk-BJHAVM7Z.js";
+import "./chunk-4MFMPC5P.js";
 import {
   writeRawOutput
-} from "./chunk-KL2ARGH6.js";
+} from "./chunk-2OHYMT3A.js";
 import {
   parsePromoteOn
-} from "./chunk-U3MRXQZS.js";
+} from "./chunk-RHWPZKRV.js";
 import "./chunk-TOWZAG3I.js";
 
 // src/workflow-promotion.ts
@@ -59,4 +59,4 @@ function usageError(message) {
 export {
   handleWorkflowPromotion
 };
-//# sourceMappingURL=workflow-promotion-QEQUXVUT.js.map
+//# sourceMappingURL=workflow-promotion-RG7L6JZT.js.map

package/dist/{workflow-proposals-KHGTPMD4.js → workflow-proposals-ZNF2F3UE.js}

@@ -6,16 +6,16 @@ import {
 } from "./chunk-DEK6B6LX.js";
 import {
   apiRequest
-} from "./chunk-WWUEKQLR.js";
+} from "./chunk-EWK44F6V.js";
 import "./chunk-S3Q7MDCS.js";
 import {
   getArgValue,
   hasFlag
-} from "./chunk-BJHAVM7Z.js";
+} from "./chunk-4MFMPC5P.js";
 import {
   writeRawOutput
-} from "./chunk-KL2ARGH6.js";
-import "./chunk-U3MRXQZS.js";
+} from "./chunk-2OHYMT3A.js";
+import "./chunk-RHWPZKRV.js";
 import "./chunk-TOWZAG3I.js";
 
 // src/workflow-proposals.ts
@@ -379,4 +379,4 @@ export {
   _internalsForTesting,
   handleWorkflowProposals
 };
-//# sourceMappingURL=workflow-proposals-KHGTPMD4.js.map
+//# sourceMappingURL=workflow-proposals-ZNF2F3UE.js.map

package/dist/{workflow-revisions-F5KQEEXB.js → workflow-revisions-TP64Z6FO.js}

@@ -1,16 +1,16 @@
 import { createRequire as __cr } from "module"; import { fileURLToPath as __fup } from "url"; import { dirname as __dn } from "path"; const require = __cr(import.meta.url); const __filename = __fup(import.meta.url); const __dirname = __dn(__filename);
 import {
   apiRequest
-} from "./chunk-WWUEKQLR.js";
+} from "./chunk-EWK44F6V.js";
 import "./chunk-S3Q7MDCS.js";
 import {
   getArgValue,
   hasFlag
-} from "./chunk-BJHAVM7Z.js";
+} from "./chunk-4MFMPC5P.js";
 import {
   writeRawOutput
-} from "./chunk-KL2ARGH6.js";
-import "./chunk-U3MRXQZS.js";
+} from "./chunk-2OHYMT3A.js";
+import "./chunk-RHWPZKRV.js";
 import "./chunk-TOWZAG3I.js";
 
 // src/workflow-revisions.ts
@@ -75,4 +75,4 @@ async function handleWorkflowRevisions(argv, apiUrl, token) {
 export {
   handleWorkflowRevisions
 };
-//# sourceMappingURL=workflow-revisions-F5KQEEXB.js.map
+//# sourceMappingURL=workflow-revisions-TP64Z6FO.js.map

package/dist/{workflow-status-66HC5MEA.js → workflow-status-5RG3JX56.js}

@@ -2,18 +2,18 @@ import { createRequire as __cr } from "module"; import { fileURLToPath as __fup
 import {
   apiRequest,
   readTextOrFile
-} from "./chunk-WWUEKQLR.js";
+} from "./chunk-EWK44F6V.js";
 import "./chunk-S3Q7MDCS.js";
 import {
   getArgValue,
   hasFlag
-} from "./chunk-BJHAVM7Z.js";
+} from "./chunk-4MFMPC5P.js";
 import {
   writeRawOutput
-} from "./chunk-KL2ARGH6.js";
+} from "./chunk-2OHYMT3A.js";
 import {
   WORKFLOW_MANAGEMENT_STATUSES
-} from "./chunk-U3MRXQZS.js";
+} from "./chunk-RHWPZKRV.js";
 import "./chunk-TOWZAG3I.js";
 
 // src/workflow-status.ts
@@ -282,4 +282,4 @@ export {
   handleWorkflowEvents,
   handleWorkflowStatus
 };
-//# sourceMappingURL=workflow-status-66HC5MEA.js.map
+//# sourceMappingURL=workflow-status-5RG3JX56.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runcofactor/cli",
-  "version": "0.55.0",
+  "version": "0.56.0",
   "private": false,
   "type": "module",
   "engines": {
@@ -45,7 +45,7 @@
   },
   "dependencies": {
     "@firecrawl/pdf-inspector": "1.25.2",
-    "@modelcontextprotocol/sdk": "^1.31.0",
+    "@modelcontextprotocol/sdk": "^1.32.0",
     "@napi-rs/canvas": "1.0.13",
     "eventsource-parser": "^4.0.0",
     "playwright": "1.62.1",
@@ -54,6 +54,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
+    "@chatsdet/ade-relay-protocol": "workspace:*",
     "@chatsdet/browser-core": "workspace:*",
     "@chatsdet/canary-spec": "workspace:*",
     "@chatsdet/content": "workspace:*",

package/dist/chunk-3TZABC7D.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/proofs.ts"],"sourcesContent":["/**\n * `cofactor proofs`: the Cofactor tests a pull request lists as proving it.\n *\n * - `attach`, `detach` and `render` record criteria and their evidence and print\n *   the block for the pull request description, so nobody hand-formats one.\n * - `check` evaluates the pull request's proofs; `status` shows them.\n *\n * Backed by `/proofs/*` in `apps/api/src/proofs/routes.ts`.\n *\n * @module proofs\n */\n\nimport process from 'node:process';\nimport { execFileSync } from 'node:child_process';\nimport { appendFile, readFile } from 'node:fs/promises';\nimport { formatProofNone, type ProofVerdict } from '@chatsdet/types';\nimport { printServedGuide } from './guide.js';\nimport { getArgValue, hasFlag, resolveConfig } from './auth.js';\nimport { apiRequest, getArgValues, readStdin, readTextOrFile } from './cli-helpers.js';\nimport { writeRawOutput } from './brand.js';\nimport { resolveApplicationId } from './environment.js';\n\ntype ApiResult<T> = { ok: boolean; error?: string; data?: T };\ntype ProofStatusView = {\n  proof: { headSha: string };\n  verdict: ProofVerdict;\n};\n\nconst HELP = [\n  'Usage: cofactor proofs <sub-command>',\n  '',\n  '  guide [--json]   Print the offline guide to proving a change with tests (no login needed)',\n  '  status --repo <owner/repo> --pr <n> [--json]   Proofs attached to the pull request',\n  '  attach --pr <n> --application <app> --criterion <n> (--test <wf_…> --run <wrun_…> | --perf-run <prun_…> | --eval-run <aerun_…>) --asserted <text> [--text <text> --detail <text>] [--node <id> --base <sha>] [--sha <sha> --tree <tree>]',\n  '    Perf evidence must be completed, faster or no-change, and on --sha; a slower run is refused. Attach a newer run and detach stale evidence.',\n  '    Eval evidence must be a completed, full, passing run on --sha; a partial, failing or other-commit run is refused. Attach as many eval runs as you have; every one must pass.',\n  '    A test with any visual_checkpoint node is a UI test; attach runs it at the PR base and shows checkpoint diffs.',\n  '    An approved test that is not a fork is cited as an existing test: its run proves it still works, and it is never promoted.',\n  '  attach --pr <n> --application <app> --criterion <n> --manual --notes <text|@file> [--artifact <https-url>]... [--text <text> --detail <text>] [--sha <sha>]',\n  '    Only when Cofactor cannot prove the criterion: say what you did and why. Passes the check, marked manual; never promotes anything.',\n  '  render --pr <n>                              Print the pull request proof block: a stoplight per criterion as of the head the server tracks for the PR, with run links',\n  '  render --none \"<reason>\"                     The block for a pull request with no observable criterion (dependency bump, docs-only change): say why',\n  '  detach --pr <n> --criterion <n> [--test <wf_…>|--perf-run <prun_…>|--eval-run <aerun_…>|--manual]  Remove a criterion or one evidence item',\n  '  check --pr <n> --sha <sha> [--body-file <path>|--body -]  Evaluate the pull request proofs',\n].join('\\n');\n\nexport async function runProofs(argv: string[]): Promise<void> {\n  const [subCommand, ...rest] = argv;\n  if (!subCommand || subCommand === 'help' || hasFlag(argv, '--help', '-h')) {\n    console.log(HELP);\n    return;\n  }\n  if (subCommand === 'guide') {\n    await printServedGuide('proofs', rest);\n    return;\n  }\n  if (subCommand === 'render' && hasFlag(rest, '--none')) return handleRenderNone(rest);\n  const { apiUrl, token } = await resolveConfig(argv);\n  switch (subCommand) {\n    case 'status':\n      return handleStatus(rest, apiUrl, token);\n    case 'attach':\n      return handleAttach(rest, apiUrl, token);\n    case 'render':\n      return handleRender(rest, apiUrl, token);\n    case 'detach':\n      return handleDetach(rest, apiUrl, token);\n    case 'check':\n      return handleCheck(rest, apiUrl, token);\n    default:\n      console.error(`Unknown proofs sub-command: ${subCommand}\\n\\n${HELP}`);\n      process.exit(1);\n  }\n}\n\nasync function handleStatus(argv: string[], apiUrl: string, token: string): Promise<void> {\n  const pr = getArgValue(argv, '--pr');\n  if (!pr) {\n    console.error('Usage: cofactor proofs status --repo <owner/repo> --pr <number> [--json]');\n    process.exit(1);\n  }\n  const repo = resolveRepo(argv);\n  const query = new URLSearchParams({ repo, pr });\n  const res = await apiRequest<ApiResult<{ proof: ProofStatusView | null }>>(\n    apiUrl,\n    token,\n    'GET',\n    `/proofs/status?${query}`\n  );\n  if (!res.ok || !res.data) {\n    console.error(`Error: ${res.error ?? 'could not read the pull request proofs'}`);\n    process.exit(1);\n  }\n  if (hasFlag(argv, '--json')) {\n    writeRawOutput(JSON.stringify(res.data, null, 2));\n    return;\n  }\n  const proof = res.data.proof;\n  if (!proof) {\n    console.log(`#${pr} has no attached proof criteria.`);\n    return;\n  }\n  console.log(`#${pr} proof status at ${proof.proof.headSha}:`);\n  writeRawOutput(proof.verdict.summaryMarkdown);\n}\n\nasync function handleAttach(argv: string[], apiUrl: string, token: string): Promise<void> {\n  if (hasFlag(argv, '--manual')) return handleAttachManual(argv, apiUrl, token);\n  const pr = requiredNumber(argv, '--pr');\n  const criterion = requiredNumber(argv, '--criterion');\n  const application = getArgValue(argv, '--application');\n  const test = getArgValue(argv, '--test');\n  const run = getArgValue(argv, '--run');\n  const perfRun = getArgValue(argv, '--perf-run');\n  const evalRun = getArgValue(argv, '--eval-run');\n  const asserted = getArgValue(argv, '--asserted');\n  const subjectCount =\n    Number(test !== undefined || run !== undefined) + Number(perfRun !== undefined) + Number(evalRun !== undefined);\n  if (['--test', '--run', '--perf-run', '--eval-run'].some((flag) => flagCount(argv, flag) > 1))\n    usageError('Pass each evidence subject flag at most once.');\n  if (\n    (hasFlag(argv, '--test') && !test) || (hasFlag(argv, '--run') && !run) ||\n    (hasFlag(argv, '--perf-run') && !perfRun) || (hasFlag(argv, '--eval-run') && !evalRun)\n  )\n    usageError('--test, --run, --perf-run and --eval-run each require a value.');\n  if (!application || !asserted || subjectCount !== 1 || (test === undefined) !== (run === undefined))\n    usageError('Usage: cofactor proofs attach --pr <n> --application <app> --criterion <n> (--test <wf_…> --run <wrun_…> | --perf-run <prun_…> | --eval-run <aerun_…>) --asserted <text> [--text <text> --detail <text>]');\n  if ((perfRun !== undefined || evalRun !== undefined) && (hasFlag(argv, '--node') || hasFlag(argv, '--tree') || hasFlag(argv, '--base')))\n    usageError('--node, --tree and --base can only be used with --test.');\n  const applicationId = await resolveApplicationId(argv, apiUrl, token);\n  const repo = resolveRepo(argv);\n  const body: Record<string, unknown> = { repo, application: applicationId, pr, criterion, asserted };\n  if (perfRun !== undefined || evalRun !== undefined) {\n    body.sha = resolveCleanCheckoutSha(argv);\n    if (perfRun !== undefined) body.perfRun = perfRun;\n    else body.evalRun = evalRun;\n  } else {\n    const { sha, tree } = resolveCheckoutCommit(argv);\n    const base = getArgValue(argv, '--base') ?? resolveDefaultBaseCommit();\n    Object.assign(body, { test, run, sha, tree, ...(base ? { base } : {}) });\n  }\n  const text = getArgValue(argv, '--text');\n  const detail = getArgValue(argv, '--detail');\n  const node = getArgValue(argv, '--node');\n  if (text !== undefined) body.text = text;\n  if (detail !== undefined) body.detail = detail;\n  if (node !== undefined) body.node = node;\n  const res = await apiRequest<ApiResult<{ proofId: string; criterion: unknown; evidence: unknown }>>(\n    apiUrl,\n    token,\n    'POST',\n    '/proofs/attach',\n    body\n  );\n  if (!res.ok || !res.data) return fail(res.error ?? 'could not attach proof evidence');\n  writeRawOutput(JSON.stringify(res.data, null, 2));\n}\n\nconst MANUAL_USAGE =\n  'Usage: cofactor proofs attach --pr <n> --application <app> --criterion <n> --manual --notes <text|@file> [--artifact <https-url>]... [--text <text> --detail <text>]';\n\n/** M23: the agent's own account of a criterion Cofactor could not prove. */\nasync function handleAttachManual(argv: string[], apiUrl: string, token: string): Promise<void> {\n  const conflicting = ['--test', '--run', '--perf-run', '--eval-run', '--asserted', '--node', '--tree', '--base'].filter((flag) => hasFlag(argv, flag));\n  if (conflicting.length > 0)\n    usageError(`--manual takes --notes instead of a test, run or asserted line; remove ${conflicting.join(', ')}.`);\n  const pr = requiredNumber(argv, '--pr');\n  const criterion = requiredNumber(argv, '--criterion');\n  const application = getArgValue(argv, '--application');\n  const notesValue = getArgValue(argv, '--notes');\n  if (!application || !notesValue) usageError(`--manual requires --application and --notes.\\n${MANUAL_USAGE}`);\n  const notes = readTextOrFile(notesValue).trim();\n  if (!notes) usageError('--manual requires non-empty --notes: what you did, and why Cofactor could not prove it.');\n  const artifacts = hasFlag(argv, '--artifact') ? getArgValues(argv, '--artifact') : [];\n  const applicationId = await resolveApplicationId(argv, apiUrl, token);\n  const body: Record<string, unknown> = {\n    repo: resolveRepo(argv),\n    application: applicationId,\n    pr,\n    criterion,\n    manual: true,\n    notes,\n    artifacts,\n    sha: resolveCleanCheckoutSha(argv),\n  };\n  const text = getArgValue(argv, '--text');\n  const detail = getArgValue(argv, '--detail');\n  if (text !== undefined) body.text = text;\n  if (detail !== undefined) body.detail = detail;\n  const res = await apiRequest<ApiResult<{ proofId: string; criterion: unknown; evidence: unknown }>>(\n    apiUrl,\n    token,\n    'POST',\n    '/proofs/attach',\n    body\n  );\n  if (!res.ok || !res.data) return fail(res.error ?? 'could not attach manual evidence');\n  writeRawOutput(JSON.stringify(res.data, null, 2));\n}\n\n/** `render --none`: needs no login or server; the reason is the whole block. */\nfunction handleRenderNone(argv: string[]): void {\n  const reason = getArgValue(argv, '--none')?.trim();\n  if (!reason) return fail('--none takes a reason: say why no test is possible, and what would make one possible.');\n  if (reason.includes('<!--') || reason.includes('-->')) return fail('the reason cannot contain an HTML comment marker.');\n  writeRawOutput(formatProofNone(reason));\n}\n\nasync function handleRender(argv: string[], apiUrl: string, token: string): Promise<void> {\n  const pr = requiredNumber(argv, '--pr');\n  const repo = resolveRepo(argv);\n  const query = new URLSearchParams({ repo, pr: String(pr) });\n  const res = await apiRequest<ApiResult<{ body: string }>>(\n    apiUrl,\n    token,\n    'GET',\n    `/proofs/render?${query}`\n  );\n  if (!res.ok || !res.data) return fail(res.error ?? 'could not render pull request proofs');\n  writeRawOutput(res.data.body);\n}\n\nasync function handleDetach(argv: string[], apiUrl: string, token: string): Promise<void> {\n  const pr = requiredNumber(argv, '--pr');\n  const criterion = requiredNumber(argv, '--criterion');\n  const repo = resolveRepo(argv);\n  const test = getArgValue(argv, '--test');\n  const perfRun = getArgValue(argv, '--perf-run');\n  const evalRun = getArgValue(argv, '--eval-run');\n  const manual = hasFlag(argv, '--manual');\n  if (['--test', '--perf-run', '--eval-run'].some((flag) => flagCount(argv, flag) > 1))\n    usageError('Pass each evidence subject flag at most once.');\n  if (Number(test !== undefined) + Number(perfRun !== undefined) + Number(evalRun !== undefined) + Number(manual) > 1)\n    usageError('Pass at most one of --test, --perf-run, --eval-run and --manual.');\n  if ((hasFlag(argv, '--test') && !test) || (hasFlag(argv, '--perf-run') && !perfRun) || (hasFlag(argv, '--eval-run') && !evalRun))\n    usageError('--test, --perf-run and --eval-run each require a value.');\n  const res = await apiRequest<ApiResult<{ deleted: true }>>(\n    apiUrl,\n    token,\n    'POST',\n    '/proofs/detach',\n    { repo, pr, criterion, ...(test ? { test } : {}), ...(perfRun ? { perfRun } : {}), ...(evalRun ? { evalRun } : {}), ...(manual ? { manual: true } : {}) }\n  );\n  if (!res.ok || !res.data) return fail(res.error ?? 'could not detach proof criterion');\n  writeRawOutput(JSON.stringify(res.data, null, 2));\n}\n\nasync function handleCheck(argv: string[], apiUrl: string, token: string): Promise<void> {\n  const pr = requiredNumber(argv, '--pr');\n  const sha = getArgValue(argv, '--sha');\n  if (!sha) usageError('Usage: cofactor proofs check --pr <n> --sha <sha> [--body-file <path>|--body -]');\n  const repo = resolveRepo(argv);\n  const bodyInput = getArgValue(argv, '--body');\n  const bodyFile = getArgValue(argv, '--body-file');\n  if (bodyInput !== undefined && (bodyInput !== '-' || bodyFile !== undefined)) {\n    usageError('Use --body - for stdin or --body-file <path>.');\n  }\n  if (bodyInput === undefined && bodyFile === undefined) {\n    usageError('Pass the pull request body with --body - or --body-file <path>.');\n  }\n  let body: string;\n  try {\n    body = bodyInput === '-' ? await readStdin() : await readFile(bodyFile!, 'utf8');\n  } catch (error) {\n    return fail(`could not read pull request body: ${error instanceof Error ? error.message : String(error)}`);\n  }\n  const res = await apiRequest<ApiResult<ProofVerdict | null>>(\n    apiUrl,\n    token,\n    'POST',\n    '/proofs/check',\n    { repo, pr, sha, body }\n  );\n  if (!res.ok) return fail(res.error ?? 'could not check pull request proofs');\n  const verdict = res.data;\n  if (!verdict) return;\n  if (verdict.summaryMarkdown) {\n    writeRawOutput(verdict.summaryMarkdown);\n    const summaryFile = process.env.GITHUB_STEP_SUMMARY;\n    if (summaryFile) {\n      try {\n        await appendFile(summaryFile, `${verdict.summaryMarkdown}\\n`, 'utf8');\n      } catch (error) {\n        return fail(`could not append GitHub step summary: ${error instanceof Error ? error.message : String(error)}`);\n      }\n    }\n  }\n  if (verdict.conclusion === 'failure') process.exit(1);\n}\n\n/** Resolve an explicit repo, Actions context, or the checkout's origin remote. */\nexport function resolveRepo(argv: string[]): string {\n  const explicit = getArgValue(argv, '--repo');\n  const candidate = explicit ?? process.env.GITHUB_REPOSITORY ?? originRepository();\n  const repo = parseRepository(candidate);\n  if (!repo) usageError('Could not determine a GitHub repository. Pass --repo <owner/repo> or set GITHUB_REPOSITORY.');\n  return repo;\n}\n\nexport function parseRepository(value: string): string | null {\n  const normalized = value.trim();\n  const bare = normalized.match(/^([^/\\s:]+)\\/([^/\\s:]+?)(?:\\.git)?$/i);\n  if (bare) return `${bare[1]}/${bare[2]}`.toLowerCase();\n  const scp = normalized.match(/^git@github\\.com:([^/\\s:]+)\\/([^/\\s:]+?)(?:\\.git)?$/i);\n  if (scp) return `${scp[1]}/${scp[2]}`.toLowerCase();\n  try {\n    const url = new URL(normalized);\n    if (!['http:', 'https:', 'ssh:'].includes(url.protocol) || url.hostname.toLowerCase() !== 'github.com') return null;\n    const path = url.pathname.match(/^\\/([^/\\s]+)\\/([^/\\s]+?)(?:\\.git)?\\/?$/i);\n    return path ? `${path[1]}/${path[2]}`.toLowerCase() : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction originRepository(): string {\n  try {\n    return execFileSync('git', ['remote', 'get-url', 'origin'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();\n  } catch {\n    return '';\n  }\n}\n\nfunction resolveCheckoutCommit(argv: string[]): { sha: string; tree: string } {\n  const explicitSha = getArgValue(argv, '--sha');\n  const explicitTree = getArgValue(argv, '--tree');\n  if (explicitSha !== undefined && explicitTree !== undefined) {\n    return { sha: explicitSha, tree: explicitTree };\n  }\n  if (gitOutput(['status', '--porcelain'])) {\n    return fail('the working tree is dirty; commit and push, sync, and run again');\n  }\n  const sha = explicitSha ?? gitRevision('HEAD');\n  const tree = explicitTree ?? gitRevision('HEAD^{tree}');\n  return { sha, tree };\n}\n\nfunction resolveCleanCheckoutSha(argv: string[]): string {\n  if (gitOutput(['status', '--porcelain'])) return fail('the working tree is dirty; commit and push, sync, and run again');\n  return getArgValue(argv, '--sha') ?? gitRevision('HEAD');\n}\n\nfunction resolveDefaultBaseCommit(): string | undefined {\n  try {\n    const defaultRef = execFileSync('git', ['symbolic-ref', 'refs/remotes/origin/HEAD'], {\n      encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],\n    }).trim();\n    return execFileSync('git', ['merge-base', 'HEAD', defaultRef], {\n      encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],\n    }).trim() || undefined;\n  } catch {\n    // The server resolves its current base when the CLI cannot compute a merge base.\n    process.stderr.write('Could not resolve the default base commit; the server will resolve the current base.\\n');\n    return undefined;\n  }\n}\n\nfunction gitOutput(args: string[]): string {\n  try {\n    return execFileSync('git', args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();\n  } catch {\n    return fail('could not inspect the working tree; run this command from a git checkout');\n  }\n}\n\nfunction gitRevision(revision: string): string {\n  try {\n    return execFileSync('git', ['rev-parse', revision], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();\n  } catch {\n    return fail(`could not resolve ${revision}; run this command from a git checkout`);\n  }\n}\n\nfunction requiredNumber(argv: string[], flag: string): number {\n  const value = getArgValue(argv, flag);\n  const parsed = value ? Number(value) : Number.NaN;\n  if (!Number.isSafeInteger(parsed) || parsed < 1) usageError(`${flag} must be a positive integer.`);\n  return parsed;\n}\n\nfunction flagCount(argv: string[], flag: string): number {\n  return argv.filter((arg) => arg === flag).length;\n}\n\nfunction usageError(message: string): never {\n  console.error(`Error: ${message}`);\n  process.exit(1);\n}\n\nfunction fail(message: string): never {\n  console.error(`Error: ${message}`);\n  process.exit(1);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,OAAO,aAAa;AACpB,SAAS,oBAAoB;AAC7B,SAAS,YAAY,gBAAgB;AAcrC,IAAM,OAAO;AAAA,EACX;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,EAAE,KAAK,IAAI;AAEX,eAAsB,UAAU,MAA+B;AAC7D,QAAM,CAAC,YAAY,GAAG,IAAI,IAAI;AAC9B,MAAI,CAAC,cAAc,eAAe,UAAU,QAAQ,MAAM,UAAU,IAAI,GAAG;AACzE,YAAQ,IAAI,IAAI;AAChB;AAAA,EACF;AACA,MAAI,eAAe,SAAS;AAC1B,UAAM,iBAAiB,UAAU,IAAI;AACrC;AAAA,EACF;AACA,MAAI,eAAe,YAAY,QAAQ,MAAM,QAAQ,EAAG,QAAO,iBAAiB,IAAI;AACpF,QAAM,EAAE,QAAQ,MAAM,IAAI,MAAM,cAAc,IAAI;AAClD,UAAQ,YAAY;AAAA,IAClB,KAAK;AACH,aAAO,aAAa,MAAM,QAAQ,KAAK;AAAA,IACzC,KAAK;AACH,aAAO,aAAa,MAAM,QAAQ,KAAK;AAAA,IACzC,KAAK;AACH,aAAO,aAAa,MAAM,QAAQ,KAAK;AAAA,IACzC,KAAK;AACH,aAAO,aAAa,MAAM,QAAQ,KAAK;AAAA,IACzC,KAAK;AACH,aAAO,YAAY,MAAM,QAAQ,KAAK;AAAA,IACxC;AACE,cAAQ,MAAM,+BAA+B,UAAU;AAAA;AAAA,EAAO,IAAI,EAAE;AACpE,cAAQ,KAAK,CAAC;AAAA,EAClB;AACF;AAEA,eAAe,aAAa,MAAgB,QAAgB,OAA8B;AACxF,QAAM,KAAK,YAAY,MAAM,MAAM;AACnC,MAAI,CAAC,IAAI;AACP,YAAQ,MAAM,0EAA0E;AACxF,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,QAAM,OAAO,YAAY,IAAI;AAC7B,QAAM,QAAQ,IAAI,gBAAgB,EAAE,MAAM,GAAG,CAAC;AAC9C,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,KAAK;AAAA,EACzB;AACA,MAAI,CAAC,IAAI,MAAM,CAAC,IAAI,MAAM;AACxB,YAAQ,MAAM,UAAU,IAAI,SAAS,wCAAwC,EAAE;AAC/E,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,MAAI,QAAQ,MAAM,QAAQ,GAAG;AAC3B,mBAAe,KAAK,UAAU,IAAI,MAAM,MAAM,CAAC,CAAC;AAChD;AAAA,EACF;AACA,QAAM,QAAQ,IAAI,KAAK;AACvB,MAAI,CAAC,OAAO;AACV,YAAQ,IAAI,IAAI,EAAE,kCAAkC;AACpD;AAAA,EACF;AACA,UAAQ,IAAI,IAAI,EAAE,oBAAoB,MAAM,MAAM,OAAO,GAAG;AAC5D,iBAAe,MAAM,QAAQ,eAAe;AAC9C;AAEA,eAAe,aAAa,MAAgB,QAAgB,OAA8B;AACxF,MAAI,QAAQ,MAAM,UAAU,EAAG,QAAO,mBAAmB,MAAM,QAAQ,KAAK;AAC5E,QAAM,KAAK,eAAe,MAAM,MAAM;AACtC,QAAM,YAAY,eAAe,MAAM,aAAa;AACpD,QAAM,cAAc,YAAY,MAAM,eAAe;AACrD,QAAM,OAAO,YAAY,MAAM,QAAQ;AACvC,QAAM,MAAM,YAAY,MAAM,OAAO;AACrC,QAAM,UAAU,YAAY,MAAM,YAAY;AAC9C,QAAM,UAAU,YAAY,MAAM,YAAY;AAC9C,QAAM,WAAW,YAAY,MAAM,YAAY;AAC/C,QAAM,eACJ,OAAO,SAAS,UAAa,QAAQ,MAAS,IAAI,OAAO,YAAY,MAAS,IAAI,OAAO,YAAY,MAAS;AAChH,MAAI,CAAC,UAAU,SAAS,cAAc,YAAY,EAAE,KAAK,CAAC,SAAS,UAAU,MAAM,IAAI,IAAI,CAAC;AAC1F,eAAW,+CAA+C;AAC5D,MACG,QAAQ,MAAM,QAAQ,KAAK,CAAC,QAAU,QAAQ,MAAM,OAAO,KAAK,CAAC,OACjE,QAAQ,MAAM,YAAY,KAAK,CAAC,WAAa,QAAQ,MAAM,YAAY,KAAK,CAAC;AAE9E,eAAW,gEAAgE;AAC7E,MAAI,CAAC,eAAe,CAAC,YAAY,iBAAiB,KAAM,SAAS,YAAgB,QAAQ;AACvF,eAAW,8NAA0M;AACvN,OAAK,YAAY,UAAa,YAAY,YAAe,QAAQ,MAAM,QAAQ,KAAK,QAAQ,MAAM,QAAQ,KAAK,QAAQ,MAAM,QAAQ;AACnI,eAAW,yDAAyD;AACtE,QAAM,gBAAgB,MAAM,qBAAqB,MAAM,QAAQ,KAAK;AACpE,QAAM,OAAO,YAAY,IAAI;AAC7B,QAAM,OAAgC,EAAE,MAAM,aAAa,eAAe,IAAI,WAAW,SAAS;AAClG,MAAI,YAAY,UAAa,YAAY,QAAW;AAClD,SAAK,MAAM,wBAAwB,IAAI;AACvC,QAAI,YAAY,OAAW,MAAK,UAAU;AAAA,QACrC,MAAK,UAAU;AAAA,EACtB,OAAO;AACL,UAAM,EAAE,KAAK,KAAK,IAAI,sBAAsB,IAAI;AAChD,UAAM,OAAO,YAAY,MAAM,QAAQ,KAAK,yBAAyB;AACrE,WAAO,OAAO,MAAM,EAAE,MAAM,KAAK,KAAK,MAAM,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC,EAAG,CAAC;AAAA,EACzE;AACA,QAAM,OAAO,YAAY,MAAM,QAAQ;AACvC,QAAM,SAAS,YAAY,MAAM,UAAU;AAC3C,QAAM,OAAO,YAAY,MAAM,QAAQ;AACvC,MAAI,SAAS,OAAW,MAAK,OAAO;AACpC,MAAI,WAAW,OAAW,MAAK,SAAS;AACxC,MAAI,SAAS,OAAW,MAAK,OAAO;AACpC,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,IAAI,MAAM,CAAC,IAAI,KAAM,QAAO,KAAK,IAAI,SAAS,iCAAiC;AACpF,iBAAe,KAAK,UAAU,IAAI,MAAM,MAAM,CAAC,CAAC;AAClD;AAEA,IAAM,eACJ;AAGF,eAAe,mBAAmB,MAAgB,QAAgB,OAA8B;AAC9F,QAAM,cAAc,CAAC,UAAU,SAAS,cAAc,cAAc,cAAc,UAAU,UAAU,QAAQ,EAAE,OAAO,CAAC,SAAS,QAAQ,MAAM,IAAI,CAAC;AACpJ,MAAI,YAAY,SAAS;AACvB,eAAW,0EAA0E,YAAY,KAAK,IAAI,CAAC,GAAG;AAChH,QAAM,KAAK,eAAe,MAAM,MAAM;AACtC,QAAM,YAAY,eAAe,MAAM,aAAa;AACpD,QAAM,cAAc,YAAY,MAAM,eAAe;AACrD,QAAM,aAAa,YAAY,MAAM,SAAS;AAC9C,MAAI,CAAC,eAAe,CAAC,WAAY,YAAW;AAAA,EAAiD,YAAY,EAAE;AAC3G,QAAM,QAAQ,eAAe,UAAU,EAAE,KAAK;AAC9C,MAAI,CAAC,MAAO,YAAW,yFAAyF;AAChH,QAAM,YAAY,QAAQ,MAAM,YAAY,IAAI,aAAa,MAAM,YAAY,IAAI,CAAC;AACpF,QAAM,gBAAgB,MAAM,qBAAqB,MAAM,QAAQ,KAAK;AACpE,QAAM,OAAgC;AAAA,IACpC,MAAM,YAAY,IAAI;AAAA,IACtB,aAAa;AAAA,IACb;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA,KAAK,wBAAwB,IAAI;AAAA,EACnC;AACA,QAAM,OAAO,YAAY,MAAM,QAAQ;AACvC,QAAM,SAAS,YAAY,MAAM,UAAU;AAC3C,MAAI,SAAS,OAAW,MAAK,OAAO;AACpC,MAAI,WAAW,OAAW,MAAK,SAAS;AACxC,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,IAAI,MAAM,CAAC,IAAI,KAAM,QAAO,KAAK,IAAI,SAAS,kCAAkC;AACrF,iBAAe,KAAK,UAAU,IAAI,MAAM,MAAM,CAAC,CAAC;AAClD;AAGA,SAAS,iBAAiB,MAAsB;AAC9C,QAAM,SAAS,YAAY,MAAM,QAAQ,GAAG,KAAK;AACjD,MAAI,CAAC,OAAQ,QAAO,KAAK,uFAAuF;AAChH,MAAI,OAAO,SAAS,MAAM,KAAK,OAAO,SAAS,KAAK,EAAG,QAAO,KAAK,mDAAmD;AACtH,iBAAe,gBAAgB,MAAM,CAAC;AACxC;AAEA,eAAe,aAAa,MAAgB,QAAgB,OAA8B;AACxF,QAAM,KAAK,eAAe,MAAM,MAAM;AACtC,QAAM,OAAO,YAAY,IAAI;AAC7B,QAAM,QAAQ,IAAI,gBAAgB,EAAE,MAAM,IAAI,OAAO,EAAE,EAAE,CAAC;AAC1D,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,KAAK;AAAA,EACzB;AACA,MAAI,CAAC,IAAI,MAAM,CAAC,IAAI,KAAM,QAAO,KAAK,IAAI,SAAS,sCAAsC;AACzF,iBAAe,IAAI,KAAK,IAAI;AAC9B;AAEA,eAAe,aAAa,MAAgB,QAAgB,OAA8B;AACxF,QAAM,KAAK,eAAe,MAAM,MAAM;AACtC,QAAM,YAAY,eAAe,MAAM,aAAa;AACpD,QAAM,OAAO,YAAY,IAAI;AAC7B,QAAM,OAAO,YAAY,MAAM,QAAQ;AACvC,QAAM,UAAU,YAAY,MAAM,YAAY;AAC9C,QAAM,UAAU,YAAY,MAAM,YAAY;AAC9C,QAAM,SAAS,QAAQ,MAAM,UAAU;AACvC,MAAI,CAAC,UAAU,cAAc,YAAY,EAAE,KAAK,CAAC,SAAS,UAAU,MAAM,IAAI,IAAI,CAAC;AACjF,eAAW,+CAA+C;AAC5D,MAAI,OAAO,SAAS,MAAS,IAAI,OAAO,YAAY,MAAS,IAAI,OAAO,YAAY,MAAS,IAAI,OAAO,MAAM,IAAI;AAChH,eAAW,kEAAkE;AAC/E,MAAK,QAAQ,MAAM,QAAQ,KAAK,CAAC,QAAU,QAAQ,MAAM,YAAY,KAAK,CAAC,WAAa,QAAQ,MAAM,YAAY,KAAK,CAAC;AACtH,eAAW,yDAAyD;AACtE,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,EAAE,MAAM,IAAI,WAAW,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC,GAAI,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC,GAAI,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC,GAAI,GAAI,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC,EAAG;AAAA,EAC1J;AACA,MAAI,CAAC,IAAI,MAAM,CAAC,IAAI,KAAM,QAAO,KAAK,IAAI,SAAS,kCAAkC;AACrF,iBAAe,KAAK,UAAU,IAAI,MAAM,MAAM,CAAC,CAAC;AAClD;AAEA,eAAe,YAAY,MAAgB,QAAgB,OAA8B;AACvF,QAAM,KAAK,eAAe,MAAM,MAAM;AACtC,QAAM,MAAM,YAAY,MAAM,OAAO;AACrC,MAAI,CAAC,IAAK,YAAW,iFAAiF;AACtG,QAAM,OAAO,YAAY,IAAI;AAC7B,QAAM,YAAY,YAAY,MAAM,QAAQ;AAC5C,QAAM,WAAW,YAAY,MAAM,aAAa;AAChD,MAAI,cAAc,WAAc,cAAc,OAAO,aAAa,SAAY;AAC5E,eAAW,+CAA+C;AAAA,EAC5D;AACA,MAAI,cAAc,UAAa,aAAa,QAAW;AACrD,eAAW,iEAAiE;AAAA,EAC9E;AACA,MAAI;AACJ,MAAI;AACF,WAAO,cAAc,MAAM,MAAM,UAAU,IAAI,MAAM,SAAS,UAAW,MAAM;AAAA,EACjF,SAAS,OAAO;AACd,WAAO,KAAK,qCAAqC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAAA,EAC3G;AACA,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,EAAE,MAAM,IAAI,KAAK,KAAK;AAAA,EACxB;AACA,MAAI,CAAC,IAAI,GAAI,QAAO,KAAK,IAAI,SAAS,qCAAqC;AAC3E,QAAM,UAAU,IAAI;AACpB,MAAI,CAAC,QAAS;AACd,MAAI,QAAQ,iBAAiB;AAC3B,mBAAe,QAAQ,eAAe;AACtC,UAAM,cAAc,QAAQ,IAAI;AAChC,QAAI,aAAa;AACf,UAAI;AACF,cAAM,WAAW,aAAa,GAAG,QAAQ,eAAe;AAAA,GAAM,MAAM;AAAA,MACtE,SAAS,OAAO;AACd,eAAO,KAAK,yCAAyC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAAA,MAC/G;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,eAAe,UAAW,SAAQ,KAAK,CAAC;AACtD;AAGO,SAAS,YAAY,MAAwB;AAClD,QAAM,WAAW,YAAY,MAAM,QAAQ;AAC3C,QAAM,YAAY,YAAY,QAAQ,IAAI,qBAAqB,iBAAiB;AAChF,QAAM,OAAO,gBAAgB,SAAS;AACtC,MAAI,CAAC,KAAM,YAAW,6FAA6F;AACnH,SAAO;AACT;AAEO,SAAS,gBAAgB,OAA8B;AAC5D,QAAM,aAAa,MAAM,KAAK;AAC9B,QAAM,OAAO,WAAW,MAAM,sCAAsC;AACpE,MAAI,KAAM,QAAO,GAAG,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,YAAY;AACrD,QAAM,MAAM,WAAW,MAAM,sDAAsD;AACnF,MAAI,IAAK,QAAO,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,YAAY;AAClD,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,UAAU;AAC9B,QAAI,CAAC,CAAC,SAAS,UAAU,MAAM,EAAE,SAAS,IAAI,QAAQ,KAAK,IAAI,SAAS,YAAY,MAAM,aAAc,QAAO;AAC/G,UAAM,OAAO,IAAI,SAAS,MAAM,yCAAyC;AACzE,WAAO,OAAO,GAAG,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,YAAY,IAAI;AAAA,EACxD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAA2B;AAClC,MAAI;AACF,WAAO,aAAa,OAAO,CAAC,UAAU,WAAW,QAAQ,GAAG,EAAE,UAAU,QAAQ,OAAO,CAAC,UAAU,QAAQ,QAAQ,EAAE,CAAC,EAAE,KAAK;AAAA,EAC9H,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,sBAAsB,MAA+C;AAC5E,QAAM,cAAc,YAAY,MAAM,OAAO;AAC7C,QAAM,eAAe,YAAY,MAAM,QAAQ;AAC/C,MAAI,gBAAgB,UAAa,iBAAiB,QAAW;AAC3D,WAAO,EAAE,KAAK,aAAa,MAAM,aAAa;AAAA,EAChD;AACA,MAAI,UAAU,CAAC,UAAU,aAAa,CAAC,GAAG;AACxC,WAAO,KAAK,iEAAiE;AAAA,EAC/E;AACA,QAAM,MAAM,eAAe,YAAY,MAAM;AAC7C,QAAM,OAAO,gBAAgB,YAAY,aAAa;AACtD,SAAO,EAAE,KAAK,KAAK;AACrB;AAEA,SAAS,wBAAwB,MAAwB;AACvD,MAAI,UAAU,CAAC,UAAU,aAAa,CAAC,EAAG,QAAO,KAAK,iEAAiE;AACvH,SAAO,YAAY,MAAM,OAAO,KAAK,YAAY,MAAM;AACzD;AAEA,SAAS,2BAA+C;AACtD,MAAI;AACF,UAAM,aAAa,aAAa,OAAO,CAAC,gBAAgB,0BAA0B,GAAG;AAAA,MACnF,UAAU;AAAA,MAAQ,OAAO,CAAC,UAAU,QAAQ,QAAQ;AAAA,IACtD,CAAC,EAAE,KAAK;AACR,WAAO,aAAa,OAAO,CAAC,cAAc,QAAQ,UAAU,GAAG;AAAA,MAC7D,UAAU;AAAA,MAAQ,OAAO,CAAC,UAAU,QAAQ,QAAQ;AAAA,IACtD,CAAC,EAAE,KAAK,KAAK;AAAA,EACf,QAAQ;AAEN,YAAQ,OAAO,MAAM,wFAAwF;AAC7G,WAAO;AAAA,EACT;AACF;AAEA,SAAS,UAAU,MAAwB;AACzC,MAAI;AACF,WAAO,aAAa,OAAO,MAAM,EAAE,UAAU,QAAQ,OAAO,CAAC,UAAU,QAAQ,QAAQ,EAAE,CAAC,EAAE,KAAK;AAAA,EACnG,QAAQ;AACN,WAAO,KAAK,0EAA0E;AAAA,EACxF;AACF;AAEA,SAAS,YAAY,UAA0B;AAC7C,MAAI;AACF,WAAO,aAAa,OAAO,CAAC,aAAa,QAAQ,GAAG,EAAE,UAAU,QAAQ,OAAO,CAAC,UAAU,QAAQ,QAAQ,EAAE,CAAC,EAAE,KAAK;AAAA,EACtH,QAAQ;AACN,WAAO,KAAK,qBAAqB,QAAQ,wCAAwC;AAAA,EACnF;AACF;AAEA,SAAS,eAAe,MAAgB,MAAsB;AAC5D,QAAM,QAAQ,YAAY,MAAM,IAAI;AACpC,QAAM,SAAS,QAAQ,OAAO,KAAK,IAAI,OAAO;AAC9C,MAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,EAAG,YAAW,GAAG,IAAI,8BAA8B;AACjG,SAAO;AACT;AAEA,SAAS,UAAU,MAAgB,MAAsB;AACvD,SAAO,KAAK,OAAO,CAAC,QAAQ,QAAQ,IAAI,EAAE;AAC5C;AAEA,SAAS,WAAW,SAAwB;AAC1C,UAAQ,MAAM,UAAU,OAAO,EAAE;AACjC,UAAQ,KAAK,CAAC;AAChB;AAEA,SAAS,KAAK,SAAwB;AACpC,UAAQ,MAAM,UAAU,OAAO,EAAE;AACjC,UAAQ,KAAK,CAAC;AAChB;","names":[]}

package/dist/chunk-BJHAVM7Z.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/auth.ts","../src/api-fetch.ts","../src/debug.ts","../src/argv.ts","../src/jwt.ts","../src/default-urls.ts"],"sourcesContent":["import fs from 'node:fs/promises';\nimport os from 'node:os';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { readBrandEnv } from './brand.js';\nimport { setActingTarget } from './api-fetch.js';\nimport { DEFAULT_API_URL, DEFAULT_APP_URL } from './default-urls.js';\nimport { isFreeTextFlag, isFreeTextValue } from './argv.js';\n\nexport type StoredAuth = {\n  token?: string;\n  apiUrl?: string;\n  orgId?: string;\n  orgName?: string;\n  /**\n   * The org's vanity app subdomain at login time, when it has one. Cached so\n   * printed links land on the org's own host without a lookup per command.\n   *\n   * May go stale if the org is later renamed; retired labels redirect to the\n   * current host, so a stale value costs a redirect rather than a dead link.\n   */\n  appSubdomain?: string | null;\n  /**\n   * Which environment this session belongs to (`production` | `dev` | `local` |\n   * custom). Purely for display/filtering — `apiUrl` already encodes the env —\n   * so the same org can hold a session in more than one environment at once.\n   */\n  envLabel?: string;\n};\n\n/** Multi-profile auth file format */\ntype MultiProfileAuth = {\n  profiles: Record<string, StoredAuth>;\n  default: string;\n};\n\n/** Legacy flat format (single profile) */\ntype LegacyAuth = StoredAuth;\n\n/**\n * Resolve where the multi-profile auth file lives. Honors a\n * `CANARY_CONFIG_DIR` / `COFACTOR_CONFIG_DIR` override (for non-standard config\n * locations and tests), else the default `~/.config/canary-cli`.\n */\nfunction getAuthPaths(): { dir: string; file: string } {\n  const dir = readBrandEnv('CANARY_CONFIG_DIR') ?? defaultConfigDir();\n  return { dir, file: path.join(dir, 'auth.json') };\n}\n\n/** The standard config directory, ignoring any `CANARY_CONFIG_DIR` override. */\nexport function defaultConfigDir(): string {\n  return path.join(os.homedir(), '.config', 'canary-cli');\n}\n\n/** The config directory this invocation reads and writes sessions in. */\nexport function activeConfigDir(): string {\n  return getAuthPaths().dir;\n}\n\n/* ── Shared argv helpers ─────────────────────────────────────────────── */\n\nexport function getArgValue(argv: string[], key: string): string | undefined {\n  for (let i = 0; i < argv.length; i++) {\n    const token = argv[i];\n    if (token === key) return i < argv.length - 1 ? argv[i + 1] : undefined;\n    if (token.startsWith(`${key}=`)) return token.slice(key.length + 1);\n  }\n  return undefined;\n}\n\n/** The flag an argument starts with, without its value: errors must not echo a fused `--token`. */\nfunction flagName(token: string): string {\n  return token.trim().split(/[\\s=]/)[0];\n}\n\n/** Global flags that always take a value; a missing value must never fall back to the default profile. */\nexport const GLOBAL_VALUE_FLAGS = ['--org', '--env', '--api-url', '--target-org', '--token'];\n\n/**\n * Reject argv that the flag parser would silently misread, before any command\n * resolves credentials. An ignored `--org` / `--env` quietly retargets the\n * default profile (often prod), so these are hard errors:\n * - one token holding several flags (`\"--org X --env dev\"`, from an unquoted\n *   zsh variable, which zsh does not word-split);\n * - a global value flag with no value, or whose value holds another flag.\n * The free-text value of a flag such as `--description` is not checked, so\n * `--description \"--org Acme\"` passes, unless it starts with `--org=`, which\n * getArgValue would read as the selector. zsh drops an empty unquoted `$DESC`, so\n * `--description $DESC $SEL` also passes, with the selector as the description:\n * the argv is identical, and that case is accepted. Errors name the flag only:\n * a fused `--token` would otherwise print the credential.\n */\nexport function assertWellFormedGlobalFlags(argv: string[]): void {\n  const refuse = (message: string): never => {\n    console.error(`Error: ${message}`);\n    process.exit(1);\n  };\n  for (let i = 0; i < argv.length; i++) {\n    const token = argv[i];\n    if (isFreeTextValue(argv, i)) {\n      // getArgValue reads any `--org=...` word as the selector, even as another flag's value.\n      if (token.includes('=') && GLOBAL_VALUE_FLAGS.includes(token.split('=')[0])) {\n        refuse(`the value of ${argv[i - 1]} starts with ${flagName(token)}=, which the CLI would read as ${flagName(token)}.`);\n      }\n      continue;\n    }\n    if (/^\\s+--/.test(token)) {\n      refuse(\n        `an argument starting \" ${flagName(token)}\" has leading whitespace, so its flag would be ignored. Remove the leading space.`\n      );\n    }\n    if (!token.startsWith('--')) continue;\n    const [name, ...inline] = token.split('=');\n    // `--description=x --org A` is free text the user attached with `=`; `--limit=1 --org A` is fused.\n    const freeTextInline = inline.length > 0 && isFreeTextFlag(name);\n    if (/\\s/.test(name) || (!freeTextInline && /\\s--[\\w-]+/.test(token))) {\n      refuse(\n        `${flagName(token)} reached the CLI fused with what follows it, as ONE argument, so it would be ignored. ` +\n          'The shell did not split it (zsh does not word-split an unquoted $VAR). ' +\n          'Pass each flag and value as its own argument. If this is the value of another flag, attach it with = ' +\n          '(--flag=--org ...) or pass it as its own argument after that flag.'\n      );\n    }\n    if (!GLOBAL_VALUE_FLAGS.includes(name)) continue;\n    const value = inline.length > 0 ? inline.join('=') : argv[i + 1];\n    if (!value || (inline.length === 0 && value.startsWith('--'))) refuse(`${name} requires a value.`);\n    if (/^\\s|\\s--[\\w-]+/.test(value)) {\n      refuse(`the value of ${name} holds another flag or leading whitespace; pass each flag and value as its own argument.`);\n    }\n  }\n}\n\nexport function hasFlag(argv: string[], ...flags: string[]): boolean {\n  return flags.some((flag) => argv.includes(flag));\n}\n\n/* ── Environment / profile mapping ───────────────────────────────────── */\n\n/** Map --env values to profile names for multi-profile auth storage */\nexport function envToProfile(env: string): string {\n  if (env === 'prod' || env === 'production') return 'production';\n  if (env === 'dev') return 'dev';\n  if (env === 'local') return 'local';\n  return env;\n}\n\nconst VALID_ENVS = ['prod', 'dev', 'local'];\n\n/** Environment URL mappings shared across CLI commands */\nexport const ENV_URLS: Record<string, { api: string; app: string }> = {\n  prod: {\n    api: DEFAULT_API_URL,\n    app: DEFAULT_APP_URL,\n  },\n  production: {\n    api: DEFAULT_API_URL,\n    app: DEFAULT_APP_URL,\n  },\n  dev: {\n    api: 'https://api.dev.runcofactor.com',\n    app: 'https://app.dev.runcofactor.com',\n  },\n  local: {\n    api: 'http://localhost:3000',\n    app: 'http://localhost:5173',\n  },\n};\n\n/** Reverse of `ENV_URLS`: the env label (`production`|`dev`|`local`) for an API\n * URL, or `undefined` for a custom URL. Used to tag stored sessions. */\nexport function envLabelForApiUrl(apiUrl: string): string | undefined {\n  for (const [key, urls] of Object.entries(ENV_URLS)) {\n    if (urls.api === apiUrl) return envToProfile(key);\n  }\n  return undefined;\n}\n\n/**\n * Storage key for an org's session, scoped by environment so the same org can\n * be logged into prod and dev at once without one clobbering the other\n * (`org-123@dev` vs `org-123@production`).\n */\nexport function orgProfileKey(orgId: string, envLabel?: string): string {\n  return envLabel ? `${orgId}@${envLabel}` : orgId;\n}\n\n/**\n * Derive the web-app URL for a given API URL, always on the cofactor domain.\n *\n * Canary is retired as a brand, so anything we print should send people to\n * cofactor even when the session itself was established against a trycanary\n * host (those hosts stay live and keep working — only the printed link moves).\n * localhost is left alone: there is no cofactor equivalent of a dev server.\n */\nexport function resolveAppUrl(apiUrl: string): string {\n  const derived = (() => {\n    for (const env of Object.values(ENV_URLS)) {\n      if (env.api === apiUrl) return env.app;\n    }\n    // Fallback for custom API URLs: replace \"api.\" at protocol boundary or \"/api\" path\n    return apiUrl.replace(/(:\\/\\/)api\\./, '$1app.').replace(/:3000\\b/, ':5173');\n  })();\n  return derived.replace(/\\btrycanary\\.ai\\b/, 'runcofactor.com');\n}\n\n/**\n * A DNS label, matching the shape the API validates an `app_subdomain` against\n * (and the web app's `TENANT_LABEL_PATTERN`). Keep the two in sync.\n */\nconst TENANT_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;\n\n/**\n * The app URL to print for a session — the org's own host when it has a vanity\n * subdomain, otherwise the shared one.\n *\n * A link to the shared host is not wrong so much as unhelpful for an org with\n * its own host: the shared host resolves whichever org the browser session\n * happens to be on, which may not be the org the command was run against.\n *\n * A label that isn't a DNS label falls back to the shared host rather than\n * being spliced in. Today the only writer is our own API, which validates it —\n * but `hostname = \"cf/evil.\" + host` does not throw, it silently truncates the\n * host to `cf` and drops our domain entirely, so failing closed is cheap\n * insurance against a link that points somewhere unintended.\n */\nexport function resolveOrgAppUrl(apiUrl: string, appSubdomain?: string | null): string {\n  const appUrl = resolveAppUrl(apiUrl);\n  if (!appSubdomain || !TENANT_LABEL_PATTERN.test(appSubdomain)) return appUrl;\n\n  const url = new URL(appUrl);\n  // Only the cofactor app hosts carry per-org subdomains; a localhost or\n  // custom host has nowhere to put the label.\n  if (!url.hostname.startsWith('app.') || !url.hostname.endsWith('.runcofactor.com')) {\n    return appUrl;\n  }\n  url.hostname = `${appSubdomain}.${url.hostname}`;\n  return url.toString().replace(/\\/$/, '');\n}\n\nfunction isMultiProfile(data: unknown): data is MultiProfileAuth {\n  return typeof data === 'object' && data !== null && 'profiles' in data;\n}\n\n/** Read the raw auth file and normalize to multi-profile format */\nasync function readAuthFile(configDir?: string): Promise<MultiProfileAuth | null> {\n  try {\n    const content = await fs.readFile(configDir ? path.join(configDir, 'auth.json') : getAuthPaths().file, 'utf8');\n    const data = JSON.parse(content) as unknown;\n\n    if (isMultiProfile(data)) {\n      return data;\n    }\n\n    // Legacy flat format — treat as the \"default\" profile\n    const legacy = data as LegacyAuth;\n    return {\n      profiles: { default: legacy },\n      default: 'default',\n    };\n  } catch {\n    return null;\n  }\n}\n\nexport async function readStoredAuth(profile?: string): Promise<StoredAuth | null> {\n  const auth = await readAuthFile();\n  if (!auth) return null;\n\n  const key = profile ?? auth.default;\n  return auth.profiles[key] ?? null;\n}\n\nexport async function readStoredToken(profile?: string): Promise<string | null> {\n  const auth = await readStoredAuth(profile);\n  return auth?.token ?? null;\n}\n\nexport async function readStoredApiUrl(profile?: string): Promise<string | null> {\n  const auth = await readStoredAuth(profile);\n  return auth?.apiUrl ?? null;\n}\n\n/** Return all stored tokens across every profile */\nexport async function readAllStoredTokens(): Promise<string[]> {\n  const auth = await readAuthFile();\n  if (!auth) return [];\n  return Object.values(auth.profiles)\n    .map((p) => p.token)\n    .filter((t): t is string => !!t);\n}\n\nexport async function saveAuth(auth: StoredAuth, profile?: string): Promise<string> {\n  const { dir: AUTH_DIR, file: AUTH_FILE } = getAuthPaths();\n  await fs.mkdir(AUTH_DIR, { recursive: true, mode: 0o700 });\n\n  // Read existing file (may be legacy or multi-profile)\n  let existing: MultiProfileAuth;\n  try {\n    const content = await fs.readFile(AUTH_FILE, 'utf8');\n    const data = JSON.parse(content) as unknown;\n\n    if (isMultiProfile(data)) {\n      existing = data;\n    } else {\n      // Migrate legacy flat format into profiles.default\n      existing = {\n        profiles: { default: data as LegacyAuth },\n        default: 'default',\n      };\n    }\n  } catch {\n    existing = { profiles: {}, default: 'default' };\n  }\n\n  const key = profile ?? 'default';\n  existing.profiles[key] = auth;\n\n  // Set default to this profile if no default exists yet\n  if (!existing.profiles[existing.default]) {\n    existing.default = key;\n  }\n\n  await fs.writeFile(AUTH_FILE, JSON.stringify(existing, null, 2), {\n    encoding: 'utf8',\n    mode: 0o600,\n  });\n  // writeFile's mode only applies on creation; enforce 0600 on overwrite too.\n  await fs.chmod(AUTH_FILE, 0o600).catch(() => {});\n  return AUTH_FILE;\n}\n\n/* ── Multi-org session lookup ────────────────────────────────────────── */\n\nexport type StoredProfile = { key: string; auth: StoredAuth };\n\n/** Enumerate every stored session (profile) plus the current default key. */\nexport async function readAllProfiles(): Promise<{\n  profiles: StoredProfile[];\n  default: string;\n}> {\n  const auth = await readAuthFile();\n  if (!auth) return { profiles: [], default: 'default' };\n  return {\n    profiles: Object.entries(auth.profiles).map(([key, a]) => ({ key, auth: a })),\n    default: auth.default,\n  };\n}\n\nexport type SessionMatch =\n  | { kind: 'match'; key: string; auth: StoredAuth }\n  | { kind: 'none' }\n  | { kind: 'ambiguous'; candidates: StoredProfile[] };\n\n/**\n * Find the stored session for an org, selected by `orgId` (exact) or `orgName`\n * (case-insensitive). When `env` is given it narrows to sessions in that\n * environment, so the same org can be logged in across prod/dev without clashing.\n * Returns `ambiguous` when a bare name matches sessions in multiple envs.\n * `apiUrl` replaces the env filter: it selects a login made with a custom `--api-url`\n * (no env label) by exact API URL, so callers pass `env` or `apiUrl`, never both.\n */\nexport async function findSessionByOrg(\n  selector: string,\n  env?: string,\n  configDir?: string,\n  apiUrl?: string\n): Promise<SessionMatch> {\n  const auth = await readAuthFile(configDir);\n  if (!auth) return { kind: 'none' };\n\n  const sel = selector.toLowerCase();\n  const all = Object.entries(auth.profiles).map(([key, a]) => ({ key, auth: a }));\n\n  // Exact orgId match is unambiguous — prefer it over name matches.\n  const byId = all.filter(({ auth: a }) => a.orgId === selector);\n  let candidates = byId.length > 0 ? byId : all.filter(({ auth: a }) => a.orgName?.toLowerCase() === sel);\n\n  // When --env is given, restrict to sessions in that environment — ALWAYS, even\n  // for a single candidate. Otherwise a lone prod session would resolve under\n  // `--env dev` and its token would be sent to the dev host (fail-open). No\n  // match in the requested env → fall through to `none` so the caller errors.\n  if (apiUrl) {\n    // A login made with a custom --api-url carries no env label; match its host exactly.\n    candidates = candidates.filter(({ auth: a }) => a.apiUrl === apiUrl);\n  } else if (env) {\n    const wantEnv = envToProfile(env);\n    const wantApi = ENV_URLS[env]?.api;\n    candidates = candidates.filter(\n      ({ auth: a }) => a.envLabel === wantEnv || (!!wantApi && a.apiUrl === wantApi)\n    );\n  }\n\n  // Collapse duplicate profiles that point at the SAME session: login mirrors a\n  // session under both an org-scoped key (`org@env`) and the env-name key (for\n  // `--env` lookups), so identical entries must not read as an ambiguous\n  // multi-env match. Comparison is by token — the JWT is the real identity — so a\n  // future refactor must not \"fix\" this into trusting local orgName/orgId fields.\n  // The org-scoped key sorts first (written first), so it survives as representative.\n  if (candidates.length > 1) {\n    const seen = new Map<string, StoredProfile>();\n    for (const c of candidates) {\n      const idKey = c.auth.token ?? c.key;\n      if (!seen.has(idKey)) seen.set(idKey, c);\n    }\n    candidates = [...seen.values()];\n  }\n\n  // `login` writes the org-scoped key (`orgProfileKey`) on every login, but the\n  // env-name mirror (`production`, `dev`, …) only on `login --env`. After\n  // `login --org X --env prod` then a plain `login --org X`, the mirror holds an\n  // older token for the same org and env, and `--org X --env prod` failed as\n  // ambiguous. The org-scoped key is the latest login for that org and env, so\n  // it wins over its own mirror — deliberately, even if that login was another\n  // user. The mirror's orgId/envLabel only decide which entry is discarded; the\n  // survivor already passed the selector and env filter above.\n  if (candidates.length > 1) {\n    const keys = new Set(candidates.map((c) => c.key));\n    const isShadowedEnvMirror = ({ key, auth: a }: StoredProfile) =>\n      !!a.orgId && !!a.envLabel && key === a.envLabel && keys.has(orgProfileKey(a.orgId, a.envLabel));\n    candidates = candidates.filter((c) => !isShadowedEnvMirror(c));\n  }\n\n  if (candidates.length === 0) return { kind: 'none' };\n  if (candidates.length === 1) return { kind: 'match', key: candidates[0].key, auth: candidates[0].auth };\n  return { kind: 'ambiguous', candidates };\n}\n\n/** Point the persistent `default` at an existing profile key. */\nexport async function setDefaultProfile(key: string): Promise<void> {\n  const auth = await readAuthFile();\n  if (!auth || !auth.profiles[key]) {\n    throw new Error(`No stored session for profile \"${key}\".`);\n  }\n  auth.default = key;\n  const { dir: AUTH_DIR, file: AUTH_FILE } = getAuthPaths();\n  await fs.mkdir(AUTH_DIR, { recursive: true, mode: 0o700 });\n  await fs.writeFile(AUTH_FILE, JSON.stringify(auth, null, 2), {\n    encoding: 'utf8',\n    mode: 0o600,\n  });\n  // writeFile's mode only applies on creation; enforce 0600 on overwrite too.\n  await fs.chmod(AUTH_FILE, 0o600).catch(() => {});\n}\n\n/* ── Shared config resolution ────────────────────────────────────────── */\n\ntype ResolvedConfig = {\n  apiUrl: string;\n  token: string;\n  /**\n   * The selected org's vanity app subdomain, when the invocation resolved to a\n   * stored session that has one. Carried here so any command can print a link\n   * on the org's own host via {@link resolveOrgAppUrl} without re-reading the\n   * auth file or widening its own signature.\n   *\n   * Undefined for token-only auth (`--token`, `CANARY_API_TOKEN`), where there\n   * is no stored profile to read it from — those callers get the shared host,\n   * which is the same link they get today.\n   */\n  appSubdomain?: string | null;\n};\n\n/**\n * Which stored session an invocation targets, before falling back to `--env`\n * profile / default. Returns the org selector string when one is in play (from\n * `--org` or `CANARY_ORG`), else `null`. With `--env` the selector still applies:\n * the (org, env) pair must resolve to one session or the command fails, so\n * `CANARY_ORG` is never silently dropped.\n */\nexport function getOrgSelector(argv: string[]): string | null {\n  return getArgValue(argv, '--org') || (readBrandEnv('CANARY_ORG') ?? null);\n}\n\n/**\n * The API URL for this invocation, with no token and no `--org` session: `--api-url`, then `--env`,\n * then the env var, then the stored login's URL, then production. An unknown `--env` falls through:\n * `resolveConfig` rejects it before getting here, but callers that skip it (guides, which need no\n * login) get no validation and no `--org` session lookup.\n */\nexport async function resolveApiUrl(argv: string[]): Promise<string> {\n  const env = getArgValue(argv, '--env');\n  const profile = env ? envToProfile(env) : undefined;\n  return (\n    getArgValue(argv, '--api-url') ??\n    (env ? ENV_URLS[env]?.api : undefined) ??\n    readBrandEnv('CANARY_API_URL') ??\n    (await readStoredApiUrl(profile)) ??\n    DEFAULT_API_URL\n  );\n}\n\nasync function resolveConfigInternal(\n  argv: string[],\n  opts: { required: boolean }\n): Promise<ResolvedConfig | null> {\n  const env = getArgValue(argv, '--env');\n  const profile = env ? envToProfile(env) : undefined;\n\n  if (env && !ENV_URLS[env]) {\n    if (opts.required) {\n      console.error(`Unknown environment: ${env}`);\n      console.error(`Valid environments: ${VALID_ENVS.join(', ')}`);\n      process.exit(1);\n    }\n    return null;\n  }\n\n  // `--org <name|id>` (or CANARY_ORG) picks one of your logged-in sessions to\n  // act as. It's an opt-in selector layered on top of the existing --env /\n  // default resolution — a bare command with no --org behaves exactly as before.\n  const orgSelector = getOrgSelector(argv);\n  let selectedAuth: StoredAuth | null = null;\n  if (orgSelector) {\n    const match = await findSessionByOrg(orgSelector, env);\n    if (match.kind === 'none') {\n      if (opts.required) {\n        printNoSessionForOrg(orgSelector, await readAllProfiles());\n        process.exit(1);\n      }\n      return null;\n    }\n    if (match.kind === 'ambiguous') {\n      if (opts.required) {\n        printAmbiguousOrg(orgSelector, match.candidates);\n        process.exit(1);\n      }\n      return null;\n    }\n    selectedAuth = match.auth;\n  }\n\n  let apiUrl: string;\n  if (selectedAuth) {\n    // The selected session's host is authoritative: never silently repoint an\n    // org's bearer token to a different host via --api-url / CANARY_API_URL.\n    apiUrl = selectedAuth.apiUrl ?? DEFAULT_API_URL;\n    const explicitApiUrl = getArgValue(argv, '--api-url');\n    if (explicitApiUrl && explicitApiUrl !== apiUrl) {\n      if (opts.required) {\n        console.error(`Error: the \"${orgSelector}\" session uses ${apiUrl}, but --api-url is ${explicitApiUrl}.`);\n        console.error('Omit --api-url, or log that org in against the other host.');\n        process.exit(1);\n      }\n      return null;\n    }\n  } else {\n    apiUrl = await resolveApiUrl(argv);\n  }\n\n  const explicitToken = getArgValue(argv, '--token');\n\n  // The session the token actually came from, when it came from one at all.\n  // Tracked rather than re-derived afterwards: a `??` chain over \"selected\n  // session, else stored profile\" cannot tell \"this org has no subdomain\"\n  // (a real `null`) from \"no session was selected\", and would graft an\n  // unrelated org's vanity host onto the link — the wrong org entirely.\n  let tokenSource: StoredAuth | null = null;\n\n  let token: string | null;\n  if (explicitToken) {\n    token = explicitToken;\n  } else if (selectedAuth) {\n    // An --org / CANARY_ORG selection points at a specific stored session.\n    token = selectedAuth.token ?? readBrandEnv('CANARY_API_TOKEN') ?? null;\n    if (selectedAuth.token) tokenSource = selectedAuth;\n    if (!token && opts.required) {\n      console.error(`Error: No token stored for org \"${orgSelector}\".`);\n      console.error(`Run: canary login --org \"${orgSelector}\"`);\n      process.exit(1);\n    }\n  } else if (profile) {\n    const storedAuth = await readStoredAuth(profile);\n    token = storedAuth?.token ?? readBrandEnv('CANARY_API_TOKEN') ?? null;\n    if (storedAuth?.token) tokenSource = storedAuth;\n    if (!token && opts.required) {\n      console.error(`Error: No token found for \"${env}\" profile.`);\n      console.error(`Run: canary login --env ${env}`);\n      process.exit(1);\n    }\n  } else {\n    const envToken = readBrandEnv('CANARY_API_TOKEN');\n    if (envToken) {\n      token = envToken;\n    } else {\n      const storedAuth = await readStoredAuth();\n      token = storedAuth?.token ?? null;\n      if (storedAuth?.token) tokenSource = storedAuth;\n    }\n    if (!token && opts.required) {\n      console.error('Error: No API token found.');\n      console.error('Run: canary login');\n      process.exit(1);\n    }\n  }\n\n  // An explicit --org/CANARY_ORG selection names the org outright, so it wins\n  // even when its stored session held no token and the credential came from the\n  // environment — `apiUrl` above already treats the selection as authoritative\n  // in exactly that case, and the two must not disagree about which org this\n  // invocation is acting as. Otherwise only the session that supplied the\n  // credential names a host; token-only auth names no org and keeps the shared\n  // one, the same link it produced before.\n  const appSubdomain = (selectedAuth ?? tokenSource)?.appSubdomain ?? null;\n\n  const source = selectedAuth ?? tokenSource;\n  setActingTarget({\n    orgName: source?.orgName ?? null,\n    orgId: source?.orgId ?? null,\n    env: source?.envLabel ?? env ?? null,\n    apiUrl,\n  });\n\n  return token ? { apiUrl, token, appSubdomain } : null;\n}\n\n/** Error output when `--org`/`CANARY_ORG` names an org with no stored session. */\nexport function printNoSessionForOrg(\n  selector: string,\n  all: { profiles: StoredProfile[] }\n): void {\n  console.error(`Error: No logged-in session for org \"${selector}\".`);\n  const withOrg = all.profiles.filter((p) => p.auth.orgName || p.auth.orgId);\n  if (withOrg.length > 0) {\n    console.error('\\nLogged-in orgs:');\n    for (const { auth: a } of withOrg) {\n      const envLabel = a.envLabel ? ` [${a.envLabel}]` : '';\n      console.error(`  - ${a.orgName ?? '(unnamed)'} (${a.orgId ?? '?'})${envLabel}`);\n    }\n  }\n  console.error(`\\nTo add one:  canary login --org \"${selector}\"`);\n  console.error(\n    'Note: --org selects which of your orgs to act as. Superadmin commands that\\n' +\n      'target a different org use --target-org instead.'\n  );\n}\n\n/** Error output when a selector matches more than one session. Distinguishes an\n * env split (same org in prod+dev → narrow with --env) from a genuine name clash\n * across distinct orgs (→ select by org ID, --env won't help). */\nexport function printAmbiguousOrg(selector: string, candidates: StoredProfile[]): void {\n  const distinctOrgs = new Set(candidates.map((c) => c.auth.orgId ?? c.key));\n  if (distinctOrgs.size <= 1) {\n    console.error(`Error: Org \"${selector}\" is logged into multiple environments. Narrow with --env:`);\n  } else {\n    console.error(`Error: \"${selector}\" matches multiple orgs. Select by org ID:`);\n  }\n  for (const { auth: a } of candidates) {\n    const envLabel = a.envLabel ?? '(unknown env)';\n    console.error(`  - ${a.orgName ?? '(unnamed)'} (${a.orgId ?? '?'}) [${envLabel}]`);\n  }\n}\n\n/**\n * Resolve API URL and auth token from argv flags, env vars, and stored profiles.\n * Used by knobs, feature-flag, release, and debug-session commands.\n */\nexport async function resolveConfig(argv: string[]): Promise<ResolvedConfig> {\n  return (await resolveConfigInternal(argv, { required: true }))!;\n}\n\nexport async function resolveOptionalConfig(argv: string[]): Promise<ResolvedConfig | null> {\n  return resolveConfigInternal(argv, { required: false });\n}\n\n/**\n * Where the effective auth token would come from for this invocation:\n * - `flag`   — explicit `--token`\n * - `env`    — CANARY_API_TOKEN / COFACTOR_API_TOKEN\n * - `stored` — an interactive `canary login` session in auth.json\n * - `none`   — no token resolvable\n *\n * Mirrors the precedence in `resolveConfigInternal` exactly (which differs by\n * whether a profile is selected). `stored` is the only \"logged in interactively\"\n * source; `flag`/`env` are API-key style auth used by CI/automation.\n */\nexport async function resolveAuthSource(\n  argv: string[]\n): Promise<'flag' | 'env' | 'stored' | 'none'> {\n  const env = getArgValue(argv, '--env');\n  if (env && !ENV_URLS[env]) return 'none';\n  const profile = env ? envToProfile(env) : undefined;\n\n  if (getArgValue(argv, '--token')) return 'flag';\n\n  const orgSelector = getOrgSelector(argv);\n  if (orgSelector) {\n    const match = await findSessionByOrg(orgSelector, env);\n    if (match.kind === 'match' && match.auth.token) return 'stored';\n    if (readBrandEnv('CANARY_API_TOKEN')) return 'env';\n    return 'none';\n  }\n\n  if (profile) {\n    // With a profile, stored auth wins over the env var.\n    if (await readStoredToken(profile)) return 'stored';\n    if (readBrandEnv('CANARY_API_TOKEN')) return 'env';\n    return 'none';\n  }\n\n  // Without a profile, the env var wins over stored auth.\n  if (readBrandEnv('CANARY_API_TOKEN')) return 'env';\n  if (await readStoredToken()) return 'stored';\n  return 'none';\n}\n","/**\n * Central fetch wrapper for the Canary CLI.\n *\n * Exists to classify failures so corporate-proxy interference (Zscaler,\n * Netskope, Cloudflare Access, etc.) is distinguishable from real auth\n * expiry. Every non-2xx or transport error gets a specific, actionable\n * message instead of the historical blanket \"session may have expired.\"\n *\n * Set CANARY_DEBUG=1 (or pass --debug to the CLI) to log every request\n * and its classification — this is what affected users should share\n * with us or their IT/Zscaler admin.\n */\n\nimport process from 'node:process';\nimport { debug, isDebug } from './debug.js';\nimport { decodeJwtPayload } from './jwt.js';\n\n/** Header every canary API response carries. Absence => response did not come from our API. */\nconst CANARY_REQUEST_ID_HEADER = 'x-canary-request-id';\n\n/** Default per-request timeout. Zscaler-half-opened sockets have been observed\n * hanging indefinitely; the CLI should give up and classify rather than hang. */\nconst DEFAULT_TIMEOUT_MS = 30_000;\n\n/** Treat a JWT exp within this grace window as still valid — tolerates the\n * typical handful of seconds of client-clock skew so we don't mislabel a\n * 30-second-fast clock as `token-revoked`. */\nconst JWT_EXP_SKEW_SEC = 60;\n\n/**\n * Best-effort scrub of `Bearer <token>` and bare three-segment JWTs from\n * error text before we print it. Doctor output is explicitly coached to be\n * shared with IT — if a proxy block page reflects the Authorization header,\n * we do not want the token in that paste.\n */\nfunction redactSecrets(text: string): string {\n  return text\n    .replace(/Bearer\\s+[A-Za-z0-9._-]+/gi, 'Bearer [redacted]')\n    .replace(/\\beyJ[A-Za-z0-9_-]{6,}\\.[A-Za-z0-9_-]{6,}\\.[A-Za-z0-9_-]{6,}\\b/g, '[redacted-jwt]');\n}\n\n/** Strip query string — query params sometimes carry one-time tokens. */\nfunction redactUrl(url: string): string {\n  const q = url.indexOf('?');\n  return q === -1 ? url : `${url.slice(0, q)}?[redacted]`;\n}\n\nexport type FailureKind =\n  | 'tls'\n  | 'network'\n  | 'html-body'\n  | 'proxy-injected-4xx'\n  | 'token-revoked'\n  | 'token-expired'\n  | 'unauthorized'\n  | 'http-error';\n\nexport interface ClassifiedFailure {\n  kind: FailureKind;\n  status: number | null;\n  url: string;\n  message: string;\n  /**\n   * Response body text. Full body for `http-error` (so callers can parse\n   * structured error payloads); truncated snippet for proxy/TLS failures\n   * where the body is likely an HTML block page.\n   */\n  body?: string;\n  /** Best-effort content-type. */\n  contentType?: string;\n  /** Raw error object for transport failures. */\n  cause?: unknown;\n  /**\n   * Value of `x-canary-request-id` on the response, if any. Present means\n   * the response came from our API (even for `token-revoked` / `token-expired`\n   * / `unauthorized`); absent means the response was injected or the request\n   * never reached us.\n   */\n  requestId?: string | null;\n}\n\n/**\n * Node/undici TLS error codes that indicate a MITM proxy (Zscaler et al.)\n * is intercepting HTTPS without the user trusting the proxy's root CA.\n */\nconst TLS_CODES = new Set([\n  'UNABLE_TO_VERIFY_LEAF_SIGNATURE',\n  'UNABLE_TO_GET_ISSUER_CERT',\n  'UNABLE_TO_GET_ISSUER_CERT_LOCALLY',\n  'SELF_SIGNED_CERT_IN_CHAIN',\n  'DEPTH_ZERO_SELF_SIGNED_CERT',\n  'CERT_HAS_EXPIRED',\n  'CERT_UNTRUSTED',\n  'ERR_TLS_CERT_ALTNAME_INVALID',\n  'CERT_SIGNATURE_FAILURE',\n]);\n\nfunction extractErrorCode(err: unknown): string | null {\n  if (!err || typeof err !== 'object') return null;\n  const withCode = err as { code?: unknown; cause?: unknown };\n  if (typeof withCode.code === 'string') return withCode.code;\n  if (withCode.cause) return extractErrorCode(withCode.cause);\n  return null;\n}\n\nfunction looksLikeHtml(body: string, contentType: string | null): boolean {\n  if (contentType && contentType.toLowerCase().includes('text/html')) return true;\n  const trimmed = body.trimStart();\n  return trimmed.startsWith('<!') || trimmed.startsWith('<html') || trimmed.startsWith('<HTML');\n}\n\n/** Decode JWT `exp` and compare to now (with a small skew grace); null if undecodable. */\nfunction jwtExpStatus(token: string | undefined): 'expired' | 'valid' | 'unknown' {\n  if (!token) return 'unknown';\n  const payload = decodeJwtPayload(token);\n  const exp = payload && typeof payload.exp === 'number' ? (payload.exp as number) : null;\n  if (exp === null) return 'unknown';\n  const nowSec = Math.floor(Date.now() / 1000);\n  return exp < nowSec - JWT_EXP_SKEW_SEC ? 'expired' : 'valid';\n}\n\n/** Warn once per process when sending Authorization to a non-local http:// URL. */\nlet warnedAboutPlaintext = false;\nfunction maybeWarnPlaintextAuth(url: string, hasAuthHeader: boolean): void {\n  if (!hasAuthHeader || warnedAboutPlaintext) return;\n  if (!url.startsWith('http://')) return;\n  try {\n    const host = new URL(url).hostname;\n    if (host === 'localhost' || host === '127.0.0.1' || host === '::1') return;\n  } catch {\n    return;\n  }\n  warnedAboutPlaintext = true;\n  process.stderr.write(\n    `[canary] WARNING: sending Authorization over plaintext http:// (${url}). ` +\n      'Your API token may be exposed to the network. Use https:// in CANARY_API_URL.\\n'\n  );\n}\n\nfunction hasAuthHeader(init: RequestInit): boolean {\n  const h = init.headers;\n  if (!h) return false;\n  if (h instanceof Headers) return h.has('authorization');\n  if (Array.isArray(h)) return h.some(([k]) => k.toLowerCase() === 'authorization');\n  return Object.keys(h).some((k) => k.toLowerCase() === 'authorization');\n}\n\n/** Who the current invocation resolved to act as; set by config resolution. */\nlet actingTarget: { orgName: string | null; orgId: string | null; env: string | null; apiUrl: string } | null = null;\nlet announcedWrite = false;\n\nexport function setActingTarget(target: NonNullable<typeof actingTarget>): void {\n  actingTarget = target;\n}\n\n/** Name the org and environment a write is aimed at, once per process, so a misdirected write is visible. */\nfunction announceWriteTarget(url: string, method: string): void {\n  if (announcedWrite || method === 'GET') return;\n  announcedWrite = true;\n  const t = actingTarget;\n  const target = t?.apiUrl ?? url;\n  let origin = target;\n  try {\n    origin = new URL(target).origin;\n  } catch {\n    // Malformed --api-url: print it raw; the request below classifies the failure.\n  }\n  process.stderr.write(\n    `acting as ${t?.orgName ?? 'unknown org'} (${t?.orgId ?? 'unknown id'}) on ${t?.env ?? 'unknown env'} ${origin}\\n`\n  );\n}\n\n/**\n * Wrap global `fetch` with classification. Always resolves — never throws —\n * so callers can make a single uniform decision from the returned shape.\n */\nexport async function apiFetch(\n  url: string,\n  init: RequestInit & { token?: string; timeoutMs?: number } = {}\n): Promise<\n  | { ok: true; response: Response; requestId: string | null }\n  | { ok: false; failure: ClassifiedFailure }\n> {\n  const { token, timeoutMs, ...fetchInit } = init;\n  maybeWarnPlaintextAuth(url, hasAuthHeader(fetchInit));\n  announceWriteTarget(url, (fetchInit.method ?? 'GET').toUpperCase());\n  debug(`→ ${fetchInit.method ?? 'GET'} ${redactUrl(url)}`);\n\n  // Merge caller-supplied signal with our timeout so both can abort.\n  // timeoutMs <= 0 disables the timeout (use for long-lived SSE streams).\n  const timeout = timeoutMs ?? DEFAULT_TIMEOUT_MS;\n  const timeoutSignal = timeout > 0 ? AbortSignal.timeout(timeout) : null;\n  const effectiveSignal =\n    fetchInit.signal && timeoutSignal\n      ? AbortSignal.any([fetchInit.signal, timeoutSignal])\n      : (fetchInit.signal ?? timeoutSignal ?? undefined);\n\n  let response: Response;\n  try {\n    response = await fetch(url, { ...fetchInit, signal: effectiveSignal });\n  } catch (err) {\n    const isTimeout =\n      (err as { name?: string })?.name === 'TimeoutError' ||\n      Boolean(timeoutSignal?.aborted);\n    if (isTimeout) {\n      const msg = `Request to ${redactUrl(url)} timed out after ${timeout}ms.`;\n      debug(`✖ network timeout`);\n      return {\n        ok: false,\n        failure: { kind: 'network', status: null, url, message: msg, cause: err },\n      };\n    }\n    const code = extractErrorCode(err);\n    if (code && TLS_CODES.has(code)) {\n      const msg = [\n        `TLS verification failed talking to ${redactUrl(url)} (${code}).`,\n        'A corporate proxy (Zscaler, Netskope, ZPA, Cloudflare Access) is likely intercepting HTTPS.',\n        'Fixes: point Node at the proxy\\'s root CA with',\n        '    NODE_EXTRA_CA_CERTS=/path/to/corporate-root.pem canary …',\n        'or on Node 20+ enable the system trust store with',\n        '    NODE_OPTIONS=--use-system-ca canary …',\n      ].join('\\n');\n      debug(`✖ tls ${code}`);\n      return { ok: false, failure: { kind: 'tls', status: null, url, message: msg, cause: err } };\n    }\n    const msg = `Network error reaching ${redactUrl(url)}: ${String((err as Error).message ?? err)}`;\n    debug(`✖ network ${msg}`);\n    return { ok: false, failure: { kind: 'network', status: null, url, message: msg, cause: err } };\n  }\n\n  const requestId = response.headers.get(CANARY_REQUEST_ID_HEADER);\n  const contentType = response.headers.get('content-type');\n  debug(`← ${response.status} ${redactUrl(url)} (ct=${contentType ?? 'n/a'} rid=${requestId ?? 'none'})`);\n\n  if (response.ok) {\n    return { ok: true, response, requestId };\n  }\n\n  // Read body once so we can classify and still return something useful.\n  // Scrub secrets before constructing user-facing `snippet`; `bodyText` is\n  // kept intact for callers that parse structured JSON error bodies.\n  const bodyText = await response.clone().text().catch(() => '');\n  const snippet = redactSecrets(bodyText.slice(0, 200));\n\n  // HTML on a JSON endpoint => proxy block page or captive portal.\n  if (looksLikeHtml(bodyText, contentType)) {\n    return {\n      ok: false,\n      failure: {\n        kind: 'html-body',\n        status: response.status,\n        url,\n        contentType: contentType ?? undefined,\n        requestId,\n        body: snippet,\n        message: [\n          `Got an HTML response from ${url} (status ${response.status}).`,\n          'A corporate proxy block page or captive portal is intercepting this request — the',\n          'response did not come from the Canary API.',\n          'Check that your proxy (e.g. Zscaler) allowlists the API hostname, and that any',\n          'required sign-in to the proxy itself is current.',\n          snippet ? `First bytes: ${snippet.replace(/\\s+/g, ' ')}` : '',\n        ]\n          .filter(Boolean)\n          .join('\\n'),\n      },\n    };\n  }\n\n  // 401/403 without our header => not our response.\n  if ((response.status === 401 || response.status === 403) && !requestId) {\n    return {\n      ok: false,\n      failure: {\n        kind: 'proxy-injected-4xx',\n        status: response.status,\n        url,\n        contentType: contentType ?? undefined,\n        requestId,\n        body: snippet,\n        message: [\n          `Got ${response.status} from ${url} but the response is missing the \\`${CANARY_REQUEST_ID_HEADER}\\` header.`,\n          'This response was almost certainly injected by a corporate proxy (Zscaler, Netskope,',\n          'Cloudflare Access) rather than returned by our API — retrying \"canary login\" will not fix it.',\n          'Ask your IT team to allowlist the API host, or re-auth to the proxy and try again.',\n        ].join('\\n'),\n      },\n    };\n  }\n\n  if (response.status === 401) {\n    const jwtStatus = jwtExpStatus(token);\n    if (jwtStatus === 'valid') {\n      return {\n        ok: false,\n        failure: {\n          kind: 'token-revoked',\n          status: 401,\n          url,\n          requestId,\n          body: snippet,\n          message: [\n            'Server rejected a token that is still valid locally (unexpired JWT).',\n            'Likely causes: the token was revoked, the server\\'s signing key rotated, or the',\n            'user/org was deactivated. `canary login` will issue a fresh token.',\n          ].join('\\n'),\n        },\n      };\n    }\n    if (jwtStatus === 'expired') {\n      return {\n        ok: false,\n        failure: {\n          kind: 'token-expired',\n          status: 401,\n          url,\n          requestId,\n          body: snippet,\n          message: 'Your stored token has expired. Run: canary login',\n        },\n      };\n    }\n    return {\n      ok: false,\n      failure: {\n        kind: 'unauthorized',\n        status: 401,\n        url,\n        requestId,\n        body: snippet,\n        message: 'Unauthorized. Run: canary login',\n      },\n    };\n  }\n\n  return {\n    ok: false,\n    failure: {\n      kind: 'http-error',\n      status: response.status,\n      url,\n      contentType: contentType ?? undefined,\n      requestId,\n      body: bodyText,\n      message: `${response.status} ${response.statusText}${snippet ? `: ${snippet}` : ''}`,\n    },\n  };\n}\n\n/**\n * Kinds of failure the user can't recover from by retrying the same call —\n * no token on disk, proxy interception, TLS mismatch, rejected JWT. Callers\n * should `exitOnFailure` immediately for these. `http-error` is excluded\n * because the caller often needs to pretty-print a structured error body.\n */\nexport function isTerminalFailure(failure: ClassifiedFailure): boolean {\n  return failure.kind !== 'http-error';\n}\n\n/**\n * Print a classified failure and exit(1). Use from command handlers that\n * have no way to recover — matches the historical behavior of the various\n * `if (res.status === 401) { console.error(...); process.exit(1); }` blocks.\n */\nexport function exitOnFailure(failure: ClassifiedFailure): never {\n  process.stderr.write(`Error: ${failure.message}\\n`);\n  if (isDebug() && failure.body && failure.kind !== 'html-body') {\n    process.stderr.write(`[canary-debug] body: ${failure.body}\\n`);\n  }\n  process.exit(1);\n}\n\n/**\n * Drop-in for `fetch()` in CLI call sites that parse the body themselves:\n * exits the process for terminal failures (TLS/proxy/unauthorized) so the\n * user sees a diagnostic, and returns a Response otherwise — whether 2xx\n * or an HTTP error (so the caller can still inspect .status / .json()).\n */\nexport async function fetchOrExit(\n  url: string,\n  init: RequestInit & { token?: string; timeoutMs?: number } = {}\n): Promise<Response> {\n  const result = await apiFetch(url, init);\n  if (result.ok) return result.response;\n  if (isTerminalFailure(result.failure)) exitOnFailure(result.failure);\n  // http-error: reconstruct a Response the caller can json() / read status on.\n  return new Response(result.failure.body ?? '', {\n    status: result.failure.status ?? 500,\n    headers: result.failure.contentType\n      ? { 'content-type': result.failure.contentType }\n      : undefined,\n  });\n}\n","import process from 'node:process';\nimport { splitAtSeparator } from './argv.js';\n\n/**\n * Whether verbose CLI diagnostics are enabled. Opt-in only, so normal runs stay\n * quiet — set CANARY_DEBUG=1 (or =true) or pass --debug. Diagnostics always go\n * to stderr so they never pollute stdout-piped (`--json`) output.\n */\nexport function isDebug(): boolean {\n  return (\n    process.env.CANARY_DEBUG === '1' ||\n    process.env.CANARY_DEBUG === 'true' ||\n    splitAtSeparator(process.argv.slice(2)).options.includes('--debug')\n  );\n}\n\n/** Write a diagnostic line to stderr, but only when debug mode is enabled. */\nexport function debug(line: string): void {\n  if (isDebug()) {\n    process.stderr.write(`[canary-debug] ${line}\\n`);\n  }\n}\n","/**\n * POSIX-style split at the first `--`: `options` are the CLI's own words,\n * `passthrough` is the command after the separator, which no flag scanning\n * (help, version, config, telemetry) may read.\n */\nexport function splitAtSeparator(argv: string[]): { options: string[]; passthrough: string[] } {\n  const separator = argv.indexOf('--');\n  return {\n    options: separator === -1 ? argv : argv.slice(0, separator),\n    passthrough: separator === -1 ? [] : argv.slice(separator + 1),\n  };\n}\n\n/**\n * Flags whose value is free text, so it may legitimately start with a flag-like\n * word: `--description \"--org Acme\"`. Only the word after one of these is exempt\n * from the fused-flag check; after any other flag (a switch, a typo, a flag this\n * list does not name) a fused `\"--org X --env prod\"` is still refused, and the\n * error names the escape. Keep it to flags whose value is a name or\n * prose (`--application` is a name lookup that fails loudly on a bad name): a\n * fused selector after a listed flag becomes its value instead of being refused.\n */\nconst FREE_TEXT_FLAGS = new Set([\n  '--application', '--body', '--cleanup', '--content', '--description', '--label', '--message', '--name',\n  '--preflight', '--prompt', '--query', '--reason', '--search', '--summary', '--title',\n]);\n\n/**\n * Whether `argv[i]` is the free-text value of the flag just before it. A word\n * that is itself a well-formed flag (`--x` or `--x=y`, no whitespace) is never\n * a value, so a bare trailing `--org` after `--description` is still checked.\n */\nexport function isFreeTextValue(argv: string[], i: number): boolean {\n  return isFreeTextFlag(argv[i - 1] ?? '') && !/^--[\\w-]+(=\\S*)?$/.test(argv[i]);\n}\n\nexport function isFreeTextFlag(flag: string): boolean {\n  return FREE_TEXT_FLAGS.has(flag);\n}\n","/**\n * JWT payload decoder for CLI superadmin detection.\n *\n * Decodes the payload section of a JWT locally (no signature verification,\n * no network calls). Used to conditionally show superadmin CLI commands.\n *\n * @module\n */\n\n/**\n * Decode the payload (second segment) of a JWT without verifying the signature.\n * Returns the parsed JSON object, or `null` if the token is malformed.\n */\nexport function decodeJwtPayload(token: string): Record<string, unknown> | null {\n  try {\n    const parts = token.split(\".\");\n    if (parts.length !== 3) return null;\n\n    const base64 = parts[1]!.replace(/-/g, \"+\").replace(/_/g, \"/\");\n    const json = Buffer.from(base64, \"base64\").toString(\"utf8\");\n    const payload: unknown = JSON.parse(json);\n\n    if (typeof payload !== \"object\" || payload === null || Array.isArray(payload)) {\n      return null;\n    }\n    return payload as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Returns `true` when the JWT's `is_superadmin` claim is exactly `true`.\n * Returns `false` for any invalid, missing, or non-superadmin token.\n */\nexport function isSuperadminToken(token: string | null | undefined): boolean {\n  if (!token) return false;\n  const payload = decodeJwtPayload(token);\n  return payload?.is_superadmin === true;\n}\n","/**\n * Compiled-in default platform URLs for the CLI.\n *\n * Single source of truth — every command's final `??` fallback resolves here,\n * so the prod default lives in exactly one place. Runtime overrides still win\n * (`--api-url` / `--app-url` flags, `CANARY_API_URL` / `COFACTOR_API_URL` env,\n * `--env`, and stored profile). Both the `canary` and `cofactor` brands share\n * this default; `trycanary.ai` 301-redirects to `runcofactor.com`, so the old\n * host keeps working for anyone with it saved.\n */\nexport const DEFAULT_API_URL = 'https://api.runcofactor.com';\nexport const DEFAULT_APP_URL = 'https://app.runcofactor.com';\n"],"mappings":";;;;;;AAAA,OAAO,QAAQ;AACf,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,OAAOA,cAAa;;;ACUpB,OAAOC,cAAa;;;ACbpB,OAAO,aAAa;;;ACKb,SAAS,iBAAiB,MAA8D;AAC7F,QAAM,YAAY,KAAK,QAAQ,IAAI;AACnC,SAAO;AAAA,IACL,SAAS,cAAc,KAAK,OAAO,KAAK,MAAM,GAAG,SAAS;AAAA,IAC1D,aAAa,cAAc,KAAK,CAAC,IAAI,KAAK,MAAM,YAAY,CAAC;AAAA,EAC/D;AACF;AAWA,IAAM,kBAAkB,oBAAI,IAAI;AAAA,EAC9B;AAAA,EAAiB;AAAA,EAAU;AAAA,EAAa;AAAA,EAAa;AAAA,EAAiB;AAAA,EAAW;AAAA,EAAa;AAAA,EAC9F;AAAA,EAAe;AAAA,EAAY;AAAA,EAAW;AAAA,EAAY;AAAA,EAAY;AAAA,EAAa;AAC7E,CAAC;AAOM,SAAS,gBAAgB,MAAgB,GAAoB;AAClE,SAAO,eAAe,KAAK,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,oBAAoB,KAAK,KAAK,CAAC,CAAC;AAC/E;AAEO,SAAS,eAAe,MAAuB;AACpD,SAAO,gBAAgB,IAAI,IAAI;AACjC;;;AD9BO,SAAS,UAAmB;AACjC,SACE,QAAQ,IAAI,iBAAiB,OAC7B,QAAQ,IAAI,iBAAiB,UAC7B,iBAAiB,QAAQ,KAAK,MAAM,CAAC,CAAC,EAAE,QAAQ,SAAS,SAAS;AAEtE;AAGO,SAAS,MAAM,MAAoB;AACxC,MAAI,QAAQ,GAAG;AACb,YAAQ,OAAO,MAAM,kBAAkB,IAAI;AAAA,CAAI;AAAA,EACjD;AACF;;;AERO,SAAS,iBAAiB,OAA+C;AAC9E,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAE/B,UAAM,SAAS,MAAM,CAAC,EAAG,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC7D,UAAM,OAAO,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,MAAM;AAC1D,UAAM,UAAmB,KAAK,MAAM,IAAI;AAExC,QAAI,OAAO,YAAY,YAAY,YAAY,QAAQ,MAAM,QAAQ,OAAO,GAAG;AAC7E,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMO,SAAS,kBAAkB,OAA2C;AAC3E,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAU,iBAAiB,KAAK;AACtC,SAAO,SAAS,kBAAkB;AACpC;;;AHrBA,IAAM,2BAA2B;AAIjC,IAAM,qBAAqB;AAK3B,IAAM,mBAAmB;AAQzB,SAAS,cAAc,MAAsB;AAC3C,SAAO,KACJ,QAAQ,8BAA8B,mBAAmB,EACzD,QAAQ,mEAAmE,gBAAgB;AAChG;AAGA,SAAS,UAAU,KAAqB;AACtC,QAAM,IAAI,IAAI,QAAQ,GAAG;AACzB,SAAO,MAAM,KAAK,MAAM,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC;AAC5C;AAwCA,IAAM,YAAY,oBAAI,IAAI;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,iBAAiB,KAA6B;AACrD,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,WAAW;AACjB,MAAI,OAAO,SAAS,SAAS,SAAU,QAAO,SAAS;AACvD,MAAI,SAAS,MAAO,QAAO,iBAAiB,SAAS,KAAK;AAC1D,SAAO;AACT;AAEA,SAAS,cAAc,MAAc,aAAqC;AACxE,MAAI,eAAe,YAAY,YAAY,EAAE,SAAS,WAAW,EAAG,QAAO;AAC3E,QAAM,UAAU,KAAK,UAAU;AAC/B,SAAO,QAAQ,WAAW,IAAI,KAAK,QAAQ,WAAW,OAAO,KAAK,QAAQ,WAAW,OAAO;AAC9F;AAGA,SAAS,aAAa,OAA4D;AAChF,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAU,iBAAiB,KAAK;AACtC,QAAM,MAAM,WAAW,OAAO,QAAQ,QAAQ,WAAY,QAAQ,MAAiB;AACnF,MAAI,QAAQ,KAAM,QAAO;AACzB,QAAM,SAAS,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC3C,SAAO,MAAM,SAAS,mBAAmB,YAAY;AACvD;AAGA,IAAI,uBAAuB;AAC3B,SAAS,uBAAuB,KAAaC,gBAA8B;AACzE,MAAI,CAACA,kBAAiB,qBAAsB;AAC5C,MAAI,CAAC,IAAI,WAAW,SAAS,EAAG;AAChC,MAAI;AACF,UAAM,OAAO,IAAI,IAAI,GAAG,EAAE;AAC1B,QAAI,SAAS,eAAe,SAAS,eAAe,SAAS,MAAO;AAAA,EACtE,QAAQ;AACN;AAAA,EACF;AACA,yBAAuB;AACvB,EAAAC,SAAQ,OAAO;AAAA,IACb,mEAAmE,GAAG;AAAA;AAAA,EAExE;AACF;AAEA,SAAS,cAAc,MAA4B;AACjD,QAAM,IAAI,KAAK;AACf,MAAI,CAAC,EAAG,QAAO;AACf,MAAI,aAAa,QAAS,QAAO,EAAE,IAAI,eAAe;AACtD,MAAI,MAAM,QAAQ,CAAC,EAAG,QAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,MAAM,eAAe;AAChF,SAAO,OAAO,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,MAAM,eAAe;AACvE;AAGA,IAAI,eAA4G;AAChH,IAAI,iBAAiB;AAEd,SAAS,gBAAgB,QAAgD;AAC9E,iBAAe;AACjB;AAGA,SAAS,oBAAoB,KAAa,QAAsB;AAC9D,MAAI,kBAAkB,WAAW,MAAO;AACxC,mBAAiB;AACjB,QAAM,IAAI;AACV,QAAM,SAAS,GAAG,UAAU;AAC5B,MAAI,SAAS;AACb,MAAI;AACF,aAAS,IAAI,IAAI,MAAM,EAAE;AAAA,EAC3B,QAAQ;AAAA,EAER;AACA,EAAAA,SAAQ,OAAO;AAAA,IACb,aAAa,GAAG,WAAW,aAAa,KAAK,GAAG,SAAS,YAAY,QAAQ,GAAG,OAAO,aAAa,IAAI,MAAM;AAAA;AAAA,EAChH;AACF;AAMA,eAAsB,SACpB,KACA,OAA6D,CAAC,GAI9D;AACA,QAAM,EAAE,OAAO,WAAW,GAAG,UAAU,IAAI;AAC3C,yBAAuB,KAAK,cAAc,SAAS,CAAC;AACpD,sBAAoB,MAAM,UAAU,UAAU,OAAO,YAAY,CAAC;AAClE,QAAM,UAAK,UAAU,UAAU,KAAK,IAAI,UAAU,GAAG,CAAC,EAAE;AAIxD,QAAM,UAAU,aAAa;AAC7B,QAAM,gBAAgB,UAAU,IAAI,YAAY,QAAQ,OAAO,IAAI;AACnE,QAAM,kBACJ,UAAU,UAAU,gBAChB,YAAY,IAAI,CAAC,UAAU,QAAQ,aAAa,CAAC,IAChD,UAAU,UAAU,iBAAiB;AAE5C,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,MAAM,KAAK,EAAE,GAAG,WAAW,QAAQ,gBAAgB,CAAC;AAAA,EACvE,SAAS,KAAK;AACZ,UAAM,YACH,KAA2B,SAAS,kBACrC,QAAQ,eAAe,OAAO;AAChC,QAAI,WAAW;AACb,YAAMC,OAAM,cAAc,UAAU,GAAG,CAAC,oBAAoB,OAAO;AACnE,YAAM,wBAAmB;AACzB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,SAAS,EAAE,MAAM,WAAW,QAAQ,MAAM,KAAK,SAASA,MAAK,OAAO,IAAI;AAAA,MAC1E;AAAA,IACF;AACA,UAAM,OAAO,iBAAiB,GAAG;AACjC,QAAI,QAAQ,UAAU,IAAI,IAAI,GAAG;AAC/B,YAAMA,OAAM;AAAA,QACV,sCAAsC,UAAU,GAAG,CAAC,KAAK,IAAI;AAAA,QAC7D;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,EAAE,KAAK,IAAI;AACX,YAAM,cAAS,IAAI,EAAE;AACrB,aAAO,EAAE,IAAI,OAAO,SAAS,EAAE,MAAM,OAAO,QAAQ,MAAM,KAAK,SAASA,MAAK,OAAO,IAAI,EAAE;AAAA,IAC5F;AACA,UAAM,MAAM,0BAA0B,UAAU,GAAG,CAAC,KAAK,OAAQ,IAAc,WAAW,GAAG,CAAC;AAC9F,UAAM,kBAAa,GAAG,EAAE;AACxB,WAAO,EAAE,IAAI,OAAO,SAAS,EAAE,MAAM,WAAW,QAAQ,MAAM,KAAK,SAAS,KAAK,OAAO,IAAI,EAAE;AAAA,EAChG;AAEA,QAAM,YAAY,SAAS,QAAQ,IAAI,wBAAwB;AAC/D,QAAM,cAAc,SAAS,QAAQ,IAAI,cAAc;AACvD,QAAM,UAAK,SAAS,MAAM,IAAI,UAAU,GAAG,CAAC,QAAQ,eAAe,KAAK,QAAQ,aAAa,MAAM,GAAG;AAEtG,MAAI,SAAS,IAAI;AACf,WAAO,EAAE,IAAI,MAAM,UAAU,UAAU;AAAA,EACzC;AAKA,QAAM,WAAW,MAAM,SAAS,MAAM,EAAE,KAAK,EAAE,MAAM,MAAM,EAAE;AAC7D,QAAM,UAAU,cAAc,SAAS,MAAM,GAAG,GAAG,CAAC;AAGpD,MAAI,cAAc,UAAU,WAAW,GAAG;AACxC,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS;AAAA,QACP,MAAM;AAAA,QACN,QAAQ,SAAS;AAAA,QACjB;AAAA,QACA,aAAa,eAAe;AAAA,QAC5B;AAAA,QACA,MAAM;AAAA,QACN,SAAS;AAAA,UACP,6BAA6B,GAAG,YAAY,SAAS,MAAM;AAAA,UAC3D;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,UAAU,gBAAgB,QAAQ,QAAQ,QAAQ,GAAG,CAAC,KAAK;AAAA,QAC7D,EACG,OAAO,OAAO,EACd,KAAK,IAAI;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAGA,OAAK,SAAS,WAAW,OAAO,SAAS,WAAW,QAAQ,CAAC,WAAW;AACtE,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS;AAAA,QACP,MAAM;AAAA,QACN,QAAQ,SAAS;AAAA,QACjB;AAAA,QACA,aAAa,eAAe;AAAA,QAC5B;AAAA,QACA,MAAM;AAAA,QACN,SAAS;AAAA,UACP,OAAO,SAAS,MAAM,SAAS,GAAG,sCAAsC,wBAAwB;AAAA,UAChG;AAAA,UACA;AAAA,UACA;AAAA,QACF,EAAE,KAAK,IAAI;AAAA,MACb;AAAA,IACF;AAAA,EACF;AAEA,MAAI,SAAS,WAAW,KAAK;AAC3B,UAAM,YAAY,aAAa,KAAK;AACpC,QAAI,cAAc,SAAS;AACzB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,SAAS;AAAA,UACP,MAAM;AAAA,UACN,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,UACA,MAAM;AAAA,UACN,SAAS;AAAA,YACP;AAAA,YACA;AAAA,YACA;AAAA,UACF,EAAE,KAAK,IAAI;AAAA,QACb;AAAA,MACF;AAAA,IACF;AACA,QAAI,cAAc,WAAW;AAC3B,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,SAAS;AAAA,UACP,MAAM;AAAA,UACN,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,UACA,MAAM;AAAA,UACN,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS;AAAA,QACP,MAAM;AAAA,QACN,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,MAAM;AAAA,QACN,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,SAAS;AAAA,MACP,MAAM;AAAA,MACN,QAAQ,SAAS;AAAA,MACjB;AAAA,MACA,aAAa,eAAe;AAAA,MAC5B;AAAA,MACA,MAAM;AAAA,MACN,SAAS,GAAG,SAAS,MAAM,IAAI,SAAS,UAAU,GAAG,UAAU,KAAK,OAAO,KAAK,EAAE;AAAA,IACpF;AAAA,EACF;AACF;AAQO,SAAS,kBAAkB,SAAqC;AACrE,SAAO,QAAQ,SAAS;AAC1B;AAOO,SAAS,cAAc,SAAmC;AAC/D,EAAAD,SAAQ,OAAO,MAAM,UAAU,QAAQ,OAAO;AAAA,CAAI;AAClD,MAAI,QAAQ,KAAK,QAAQ,QAAQ,QAAQ,SAAS,aAAa;AAC7D,IAAAA,SAAQ,OAAO,MAAM,wBAAwB,QAAQ,IAAI;AAAA,CAAI;AAAA,EAC/D;AACA,EAAAA,SAAQ,KAAK,CAAC;AAChB;AAQA,eAAsB,YACpB,KACA,OAA6D,CAAC,GAC3C;AACnB,QAAM,SAAS,MAAM,SAAS,KAAK,IAAI;AACvC,MAAI,OAAO,GAAI,QAAO,OAAO;AAC7B,MAAI,kBAAkB,OAAO,OAAO,EAAG,eAAc,OAAO,OAAO;AAEnE,SAAO,IAAI,SAAS,OAAO,QAAQ,QAAQ,IAAI;AAAA,IAC7C,QAAQ,OAAO,QAAQ,UAAU;AAAA,IACjC,SAAS,OAAO,QAAQ,cACpB,EAAE,gBAAgB,OAAO,QAAQ,YAAY,IAC7C;AAAA,EACN,CAAC;AACH;;;AI9XO,IAAM,kBAAkB;AACxB,IAAM,kBAAkB;;;ALiC/B,SAAS,eAA8C;AACrD,QAAM,MAAM,aAAa,mBAAmB,KAAK,iBAAiB;AAClE,SAAO,EAAE,KAAK,MAAM,KAAK,KAAK,KAAK,WAAW,EAAE;AAClD;AAGO,SAAS,mBAA2B;AACzC,SAAO,KAAK,KAAK,GAAG,QAAQ,GAAG,WAAW,YAAY;AACxD;AAGO,SAAS,kBAA0B;AACxC,SAAO,aAAa,EAAE;AACxB;AAIO,SAAS,YAAY,MAAgB,KAAiC;AAC3E,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,QAAQ,KAAK,CAAC;AACpB,QAAI,UAAU,IAAK,QAAO,IAAI,KAAK,SAAS,IAAI,KAAK,IAAI,CAAC,IAAI;AAC9D,QAAI,MAAM,WAAW,GAAG,GAAG,GAAG,EAAG,QAAO,MAAM,MAAM,IAAI,SAAS,CAAC;AAAA,EACpE;AACA,SAAO;AACT;AAGA,SAAS,SAAS,OAAuB;AACvC,SAAO,MAAM,KAAK,EAAE,MAAM,OAAO,EAAE,CAAC;AACtC;AAGO,IAAM,qBAAqB,CAAC,SAAS,SAAS,aAAa,gBAAgB,SAAS;AAgBpF,SAAS,4BAA4B,MAAsB;AAChE,QAAM,SAAS,CAAC,YAA2B;AACzC,YAAQ,MAAM,UAAU,OAAO,EAAE;AACjC,IAAAE,SAAQ,KAAK,CAAC;AAAA,EAChB;AACA,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,QAAQ,KAAK,CAAC;AACpB,QAAI,gBAAgB,MAAM,CAAC,GAAG;AAE5B,UAAI,MAAM,SAAS,GAAG,KAAK,mBAAmB,SAAS,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,GAAG;AAC3E,eAAO,gBAAgB,KAAK,IAAI,CAAC,CAAC,gBAAgB,SAAS,KAAK,CAAC,kCAAkC,SAAS,KAAK,CAAC,GAAG;AAAA,MACvH;AACA;AAAA,IACF;AACA,QAAI,SAAS,KAAK,KAAK,GAAG;AACxB;AAAA,QACE,0BAA0B,SAAS,KAAK,CAAC;AAAA,MAC3C;AAAA,IACF;AACA,QAAI,CAAC,MAAM,WAAW,IAAI,EAAG;AAC7B,UAAM,CAAC,MAAM,GAAG,MAAM,IAAI,MAAM,MAAM,GAAG;AAEzC,UAAM,iBAAiB,OAAO,SAAS,KAAK,eAAe,IAAI;AAC/D,QAAI,KAAK,KAAK,IAAI,KAAM,CAAC,kBAAkB,aAAa,KAAK,KAAK,GAAI;AACpE;AAAA,QACE,GAAG,SAAS,KAAK,CAAC;AAAA,MAIpB;AAAA,IACF;AACA,QAAI,CAAC,mBAAmB,SAAS,IAAI,EAAG;AACxC,UAAM,QAAQ,OAAO,SAAS,IAAI,OAAO,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC;AAC/D,QAAI,CAAC,SAAU,OAAO,WAAW,KAAK,MAAM,WAAW,IAAI,EAAI,QAAO,GAAG,IAAI,oBAAoB;AACjG,QAAI,iBAAiB,KAAK,KAAK,GAAG;AAChC,aAAO,gBAAgB,IAAI,0FAA0F;AAAA,IACvH;AAAA,EACF;AACF;AAEO,SAAS,QAAQ,SAAmB,OAA0B;AACnE,SAAO,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC;AACjD;AAKO,SAAS,aAAa,KAAqB;AAChD,MAAI,QAAQ,UAAU,QAAQ,aAAc,QAAO;AACnD,MAAI,QAAQ,MAAO,QAAO;AAC1B,MAAI,QAAQ,QAAS,QAAO;AAC5B,SAAO;AACT;AAEA,IAAM,aAAa,CAAC,QAAQ,OAAO,OAAO;AAGnC,IAAM,WAAyD;AAAA,EACpE,MAAM;AAAA,IACJ,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AAAA,EACA,YAAY;AAAA,IACV,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AAAA,EACA,KAAK;AAAA,IACH,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AAAA,EACA,OAAO;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AACF;AAIO,SAAS,kBAAkB,QAAoC;AACpE,aAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAClD,QAAI,KAAK,QAAQ,OAAQ,QAAO,aAAa,GAAG;AAAA,EAClD;AACA,SAAO;AACT;AAOO,SAAS,cAAc,OAAe,UAA2B;AACtE,SAAO,WAAW,GAAG,KAAK,IAAI,QAAQ,KAAK;AAC7C;AAUO,SAAS,cAAc,QAAwB;AACpD,QAAM,WAAW,MAAM;AACrB,eAAW,OAAO,OAAO,OAAO,QAAQ,GAAG;AACzC,UAAI,IAAI,QAAQ,OAAQ,QAAO,IAAI;AAAA,IACrC;AAEA,WAAO,OAAO,QAAQ,gBAAgB,QAAQ,EAAE,QAAQ,WAAW,OAAO;AAAA,EAC5E,GAAG;AACH,SAAO,QAAQ,QAAQ,qBAAqB,iBAAiB;AAC/D;AAMA,IAAM,uBAAuB;AAgBtB,SAAS,iBAAiB,QAAgB,cAAsC;AACrF,QAAM,SAAS,cAAc,MAAM;AACnC,MAAI,CAAC,gBAAgB,CAAC,qBAAqB,KAAK,YAAY,EAAG,QAAO;AAEtE,QAAM,MAAM,IAAI,IAAI,MAAM;AAG1B,MAAI,CAAC,IAAI,SAAS,WAAW,MAAM,KAAK,CAAC,IAAI,SAAS,SAAS,kBAAkB,GAAG;AAClF,WAAO;AAAA,EACT;AACA,MAAI,WAAW,GAAG,YAAY,IAAI,IAAI,QAAQ;AAC9C,SAAO,IAAI,SAAS,EAAE,QAAQ,OAAO,EAAE;AACzC;AAEA,SAAS,eAAe,MAAyC;AAC/D,SAAO,OAAO,SAAS,YAAY,SAAS,QAAQ,cAAc;AACpE;AAGA,eAAe,aAAa,WAAsD;AAChF,MAAI;AACF,UAAM,UAAU,MAAM,GAAG,SAAS,YAAY,KAAK,KAAK,WAAW,WAAW,IAAI,aAAa,EAAE,MAAM,MAAM;AAC7G,UAAM,OAAO,KAAK,MAAM,OAAO;AAE/B,QAAI,eAAe,IAAI,GAAG;AACxB,aAAO;AAAA,IACT;AAGA,UAAM,SAAS;AACf,WAAO;AAAA,MACL,UAAU,EAAE,SAAS,OAAO;AAAA,MAC5B,SAAS;AAAA,IACX;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,eAAe,SAA8C;AACjF,QAAM,OAAO,MAAM,aAAa;AAChC,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,MAAM,WAAW,KAAK;AAC5B,SAAO,KAAK,SAAS,GAAG,KAAK;AAC/B;AAEA,eAAsB,gBAAgB,SAA0C;AAC9E,QAAM,OAAO,MAAM,eAAe,OAAO;AACzC,SAAO,MAAM,SAAS;AACxB;AAEA,eAAsB,iBAAiB,SAA0C;AAC/E,QAAM,OAAO,MAAM,eAAe,OAAO;AACzC,SAAO,MAAM,UAAU;AACzB;AAGA,eAAsB,sBAAyC;AAC7D,QAAM,OAAO,MAAM,aAAa;AAChC,MAAI,CAAC,KAAM,QAAO,CAAC;AACnB,SAAO,OAAO,OAAO,KAAK,QAAQ,EAC/B,IAAI,CAAC,MAAM,EAAE,KAAK,EAClB,OAAO,CAAC,MAAmB,CAAC,CAAC,CAAC;AACnC;AAEA,eAAsB,SAAS,MAAkB,SAAmC;AAClF,QAAM,EAAE,KAAK,UAAU,MAAM,UAAU,IAAI,aAAa;AACxD,QAAM,GAAG,MAAM,UAAU,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAGzD,MAAI;AACJ,MAAI;AACF,UAAM,UAAU,MAAM,GAAG,SAAS,WAAW,MAAM;AACnD,UAAM,OAAO,KAAK,MAAM,OAAO;AAE/B,QAAI,eAAe,IAAI,GAAG;AACxB,iBAAW;AAAA,IACb,OAAO;AAEL,iBAAW;AAAA,QACT,UAAU,EAAE,SAAS,KAAmB;AAAA,QACxC,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF,QAAQ;AACN,eAAW,EAAE,UAAU,CAAC,GAAG,SAAS,UAAU;AAAA,EAChD;AAEA,QAAM,MAAM,WAAW;AACvB,WAAS,SAAS,GAAG,IAAI;AAGzB,MAAI,CAAC,SAAS,SAAS,SAAS,OAAO,GAAG;AACxC,aAAS,UAAU;AAAA,EACrB;AAEA,QAAM,GAAG,UAAU,WAAW,KAAK,UAAU,UAAU,MAAM,CAAC,GAAG;AAAA,IAC/D,UAAU;AAAA,IACV,MAAM;AAAA,EACR,CAAC;AAED,QAAM,GAAG,MAAM,WAAW,GAAK,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AAC/C,SAAO;AACT;AAOA,eAAsB,kBAGnB;AACD,QAAM,OAAO,MAAM,aAAa;AAChC,MAAI,CAAC,KAAM,QAAO,EAAE,UAAU,CAAC,GAAG,SAAS,UAAU;AACrD,SAAO;AAAA,IACL,UAAU,OAAO,QAAQ,KAAK,QAAQ,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,EAAE;AAAA,IAC5E,SAAS,KAAK;AAAA,EAChB;AACF;AAeA,eAAsB,iBACpB,UACA,KACA,WACA,QACuB;AACvB,QAAM,OAAO,MAAM,aAAa,SAAS;AACzC,MAAI,CAAC,KAAM,QAAO,EAAE,MAAM,OAAO;AAEjC,QAAM,MAAM,SAAS,YAAY;AACjC,QAAM,MAAM,OAAO,QAAQ,KAAK,QAAQ,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,EAAE;AAG9E,QAAM,OAAO,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,QAAQ;AAC7D,MAAI,aAAa,KAAK,SAAS,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,YAAY,MAAM,GAAG;AAMtG,MAAI,QAAQ;AAEV,iBAAa,WAAW,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,MAAM;AAAA,EACrE,WAAW,KAAK;AACd,UAAM,UAAU,aAAa,GAAG;AAChC,UAAM,UAAU,SAAS,GAAG,GAAG;AAC/B,iBAAa,WAAW;AAAA,MACtB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,WAAY,CAAC,CAAC,WAAW,EAAE,WAAW;AAAA,IACxE;AAAA,EACF;AAQA,MAAI,WAAW,SAAS,GAAG;AACzB,UAAM,OAAO,oBAAI,IAA2B;AAC5C,eAAW,KAAK,YAAY;AAC1B,YAAM,QAAQ,EAAE,KAAK,SAAS,EAAE;AAChC,UAAI,CAAC,KAAK,IAAI,KAAK,EAAG,MAAK,IAAI,OAAO,CAAC;AAAA,IACzC;AACA,iBAAa,CAAC,GAAG,KAAK,OAAO,CAAC;AAAA,EAChC;AAUA,MAAI,WAAW,SAAS,GAAG;AACzB,UAAM,OAAO,IAAI,IAAI,WAAW,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;AACjD,UAAM,sBAAsB,CAAC,EAAE,KAAK,MAAM,EAAE,MAC1C,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,YAAY,QAAQ,EAAE,YAAY,KAAK,IAAI,cAAc,EAAE,OAAO,EAAE,QAAQ,CAAC;AAChG,iBAAa,WAAW,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;AAAA,EAC/D;AAEA,MAAI,WAAW,WAAW,EAAG,QAAO,EAAE,MAAM,OAAO;AACnD,MAAI,WAAW,WAAW,EAAG,QAAO,EAAE,MAAM,SAAS,KAAK,WAAW,CAAC,EAAE,KAAK,MAAM,WAAW,CAAC,EAAE,KAAK;AACtG,SAAO,EAAE,MAAM,aAAa,WAAW;AACzC;AAGA,eAAsB,kBAAkB,KAA4B;AAClE,QAAM,OAAO,MAAM,aAAa;AAChC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAS,GAAG,GAAG;AAChC,UAAM,IAAI,MAAM,kCAAkC,GAAG,IAAI;AAAA,EAC3D;AACA,OAAK,UAAU;AACf,QAAM,EAAE,KAAK,UAAU,MAAM,UAAU,IAAI,aAAa;AACxD,QAAM,GAAG,MAAM,UAAU,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACzD,QAAM,GAAG,UAAU,WAAW,KAAK,UAAU,MAAM,MAAM,CAAC,GAAG;AAAA,IAC3D,UAAU;AAAA,IACV,MAAM;AAAA,EACR,CAAC;AAED,QAAM,GAAG,MAAM,WAAW,GAAK,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AACjD;AA2BO,SAAS,eAAe,MAA+B;AAC5D,SAAO,YAAY,MAAM,OAAO,MAAM,aAAa,YAAY,KAAK;AACtE;AAQA,eAAsB,cAAc,MAAiC;AACnE,QAAM,MAAM,YAAY,MAAM,OAAO;AACrC,QAAM,UAAU,MAAM,aAAa,GAAG,IAAI;AAC1C,SACE,YAAY,MAAM,WAAW,MAC5B,MAAM,SAAS,GAAG,GAAG,MAAM,WAC5B,aAAa,gBAAgB,KAC5B,MAAM,iBAAiB,OAAO,KAC/B;AAEJ;AAEA,eAAe,sBACb,MACA,MACgC;AAChC,QAAM,MAAM,YAAY,MAAM,OAAO;AACrC,QAAM,UAAU,MAAM,aAAa,GAAG,IAAI;AAE1C,MAAI,OAAO,CAAC,SAAS,GAAG,GAAG;AACzB,QAAI,KAAK,UAAU;AACjB,cAAQ,MAAM,wBAAwB,GAAG,EAAE;AAC3C,cAAQ,MAAM,uBAAuB,WAAW,KAAK,IAAI,CAAC,EAAE;AAC5D,MAAAA,SAAQ,KAAK,CAAC;AAAA,IAChB;AACA,WAAO;AAAA,EACT;AAKA,QAAM,cAAc,eAAe,IAAI;AACvC,MAAI,eAAkC;AACtC,MAAI,aAAa;AACf,UAAM,QAAQ,MAAM,iBAAiB,aAAa,GAAG;AACrD,QAAI,MAAM,SAAS,QAAQ;AACzB,UAAI,KAAK,UAAU;AACjB,6BAAqB,aAAa,MAAM,gBAAgB,CAAC;AACzD,QAAAA,SAAQ,KAAK,CAAC;AAAA,MAChB;AACA,aAAO;AAAA,IACT;AACA,QAAI,MAAM,SAAS,aAAa;AAC9B,UAAI,KAAK,UAAU;AACjB,0BAAkB,aAAa,MAAM,UAAU;AAC/C,QAAAA,SAAQ,KAAK,CAAC;AAAA,MAChB;AACA,aAAO;AAAA,IACT;AACA,mBAAe,MAAM;AAAA,EACvB;AAEA,MAAI;AACJ,MAAI,cAAc;AAGhB,aAAS,aAAa,UAAU;AAChC,UAAM,iBAAiB,YAAY,MAAM,WAAW;AACpD,QAAI,kBAAkB,mBAAmB,QAAQ;AAC/C,UAAI,KAAK,UAAU;AACjB,gBAAQ,MAAM,eAAe,WAAW,kBAAkB,MAAM,sBAAsB,cAAc,GAAG;AACvG,gBAAQ,MAAM,4DAA4D;AAC1E,QAAAA,SAAQ,KAAK,CAAC;AAAA,MAChB;AACA,aAAO;AAAA,IACT;AAAA,EACF,OAAO;AACL,aAAS,MAAM,cAAc,IAAI;AAAA,EACnC;AAEA,QAAM,gBAAgB,YAAY,MAAM,SAAS;AAOjD,MAAI,cAAiC;AAErC,MAAI;AACJ,MAAI,eAAe;AACjB,YAAQ;AAAA,EACV,WAAW,cAAc;AAEvB,YAAQ,aAAa,SAAS,aAAa,kBAAkB,KAAK;AAClE,QAAI,aAAa,MAAO,eAAc;AACtC,QAAI,CAAC,SAAS,KAAK,UAAU;AAC3B,cAAQ,MAAM,mCAAmC,WAAW,IAAI;AAChE,cAAQ,MAAM,4BAA4B,WAAW,GAAG;AACxD,MAAAA,SAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,WAAW,SAAS;AAClB,UAAM,aAAa,MAAM,eAAe,OAAO;AAC/C,YAAQ,YAAY,SAAS,aAAa,kBAAkB,KAAK;AACjE,QAAI,YAAY,MAAO,eAAc;AACrC,QAAI,CAAC,SAAS,KAAK,UAAU;AAC3B,cAAQ,MAAM,8BAA8B,GAAG,YAAY;AAC3D,cAAQ,MAAM,2BAA2B,GAAG,EAAE;AAC9C,MAAAA,SAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,OAAO;AACL,UAAM,WAAW,aAAa,kBAAkB;AAChD,QAAI,UAAU;AACZ,cAAQ;AAAA,IACV,OAAO;AACL,YAAM,aAAa,MAAM,eAAe;AACxC,cAAQ,YAAY,SAAS;AAC7B,UAAI,YAAY,MAAO,eAAc;AAAA,IACvC;AACA,QAAI,CAAC,SAAS,KAAK,UAAU;AAC3B,cAAQ,MAAM,4BAA4B;AAC1C,cAAQ,MAAM,mBAAmB;AACjC,MAAAA,SAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AASA,QAAM,gBAAgB,gBAAgB,cAAc,gBAAgB;AAEpE,QAAM,SAAS,gBAAgB;AAC/B,kBAAgB;AAAA,IACd,SAAS,QAAQ,WAAW;AAAA,IAC5B,OAAO,QAAQ,SAAS;AAAA,IACxB,KAAK,QAAQ,YAAY,OAAO;AAAA,IAChC;AAAA,EACF,CAAC;AAED,SAAO,QAAQ,EAAE,QAAQ,OAAO,aAAa,IAAI;AACnD;AAGO,SAAS,qBACd,UACA,KACM;AACN,UAAQ,MAAM,wCAAwC,QAAQ,IAAI;AAClE,QAAM,UAAU,IAAI,SAAS,OAAO,CAAC,MAAM,EAAE,KAAK,WAAW,EAAE,KAAK,KAAK;AACzE,MAAI,QAAQ,SAAS,GAAG;AACtB,YAAQ,MAAM,mBAAmB;AACjC,eAAW,EAAE,MAAM,EAAE,KAAK,SAAS;AACjC,YAAM,WAAW,EAAE,WAAW,KAAK,EAAE,QAAQ,MAAM;AACnD,cAAQ,MAAM,OAAO,EAAE,WAAW,WAAW,KAAK,EAAE,SAAS,GAAG,IAAI,QAAQ,EAAE;AAAA,IAChF;AAAA,EACF;AACA,UAAQ,MAAM;AAAA,mCAAsC,QAAQ,GAAG;AAC/D,UAAQ;AAAA,IACN;AAAA,EAEF;AACF;AAKO,SAAS,kBAAkB,UAAkB,YAAmC;AACrF,QAAM,eAAe,IAAI,IAAI,WAAW,IAAI,CAAC,MAAM,EAAE,KAAK,SAAS,EAAE,GAAG,CAAC;AACzE,MAAI,aAAa,QAAQ,GAAG;AAC1B,YAAQ,MAAM,eAAe,QAAQ,4DAA4D;AAAA,EACnG,OAAO;AACL,YAAQ,MAAM,WAAW,QAAQ,4CAA4C;AAAA,EAC/E;AACA,aAAW,EAAE,MAAM,EAAE,KAAK,YAAY;AACpC,UAAM,WAAW,EAAE,YAAY;AAC/B,YAAQ,MAAM,OAAO,EAAE,WAAW,WAAW,KAAK,EAAE,SAAS,GAAG,MAAM,QAAQ,GAAG;AAAA,EACnF;AACF;AAMA,eAAsB,cAAc,MAAyC;AAC3E,SAAQ,MAAM,sBAAsB,MAAM,EAAE,UAAU,KAAK,CAAC;AAC9D;AAEA,eAAsB,sBAAsB,MAAgD;AAC1F,SAAO,sBAAsB,MAAM,EAAE,UAAU,MAAM,CAAC;AACxD;AAaA,eAAsB,kBACpB,MAC6C;AAC7C,QAAM,MAAM,YAAY,MAAM,OAAO;AACrC,MAAI,OAAO,CAAC,SAAS,GAAG,EAAG,QAAO;AAClC,QAAM,UAAU,MAAM,aAAa,GAAG,IAAI;AAE1C,MAAI,YAAY,MAAM,SAAS,EAAG,QAAO;AAEzC,QAAM,cAAc,eAAe,IAAI;AACvC,MAAI,aAAa;AACf,UAAM,QAAQ,MAAM,iBAAiB,aAAa,GAAG;AACrD,QAAI,MAAM,SAAS,WAAW,MAAM,KAAK,MAAO,QAAO;AACvD,QAAI,aAAa,kBAAkB,EAAG,QAAO;AAC7C,WAAO;AAAA,EACT;AAEA,MAAI,SAAS;AAEX,QAAI,MAAM,gBAAgB,OAAO,EAAG,QAAO;AAC3C,QAAI,aAAa,kBAAkB,EAAG,QAAO;AAC7C,WAAO;AAAA,EACT;AAGA,MAAI,aAAa,kBAAkB,EAAG,QAAO;AAC7C,MAAI,MAAM,gBAAgB,EAAG,QAAO;AACpC,SAAO;AACT;","names":["process","process","hasAuthHeader","process","msg","process"]}