@stigmer/cli 3.0.8

package/auth/token.js

@@ -0,0 +1,111 @@
+// Auth0 token operations: exchange an authorization code for tokens, refresh an
+// expired access token, and expose a token provider that refreshes silently.
+import { save } from "../config/index.js";
+import { CliExitError, ExitCode } from "../errors/index.js";
+import { CLIENT_ID, callbackUrl, TOKEN_URL } from "./auth0.js";
+// Refresh this many ms before the real expiry so an in-flight request never
+// races the token going stale.
+const EXPIRY_SKEW_MS = 60_000;
+/** Exchange a PKCE authorization code for an access (+refresh) token. */
+export async function exchangeCode(params) {
+    return postToken({
+        grant_type: "authorization_code",
+        client_id: CLIENT_ID,
+        code: params.code,
+        redirect_uri: callbackUrl(),
+        code_verifier: params.codeVerifier,
+    });
+}
+/** Exchange a refresh token for a fresh access token. */
+export async function refreshAccessToken(refreshToken) {
+    return postToken({
+        grant_type: "refresh_token",
+        client_id: CLIENT_ID,
+        refresh_token: refreshToken,
+    });
+}
+/**
+ * A token provider for the backend client that keeps the access token fresh.
+ *
+ * Precedence and behavior, evaluated per request:
+ *   1. STIGMER_API_KEY (env / bridged --api-key) wins and is never refreshed.
+ *   2. A non-expired access token is returned as-is.
+ *   3. An expired token with a refresh token is refreshed; the new token,
+ *      rotated refresh token, and expiry are persisted, then returned.
+ *   4. Otherwise the (possibly stale) token or null is returned, letting the
+ *      server reject it so the error maps to a clear "please log in" exit.
+ *
+ * Closes over `config` so a refresh updates the same object the rest of the
+ * command sees, and writes it through to disk.
+ */
+export function createRefreshingTokenProvider(config) {
+    return async () => {
+        const envKey = process.env.STIGMER_API_KEY;
+        if (envKey !== undefined && envKey !== "")
+            return envKey;
+        const cloud = config.backend.cloud;
+        if (cloud?.token === undefined || cloud.token === "") {
+            return cloud?.refresh_token ? refreshAndPersist(config, cloud.refresh_token) : null;
+        }
+        if (!isExpired(cloud.token_expiry))
+            return cloud.token;
+        if (cloud.refresh_token === undefined || cloud.refresh_token === "")
+            return cloud.token;
+        return refreshAndPersist(config, cloud.refresh_token);
+    };
+}
+async function refreshAndPersist(config, refreshToken) {
+    let next;
+    try {
+        next = await refreshAccessToken(refreshToken);
+    }
+    catch {
+        // Refresh failed (revoked/expired refresh token). Fall back to the current
+        // token if any; the server will reject it and the user is prompted to log in.
+        return config.backend.cloud?.token ?? null;
+    }
+    const cloud = config.backend.cloud ?? {};
+    cloud.token = next.accessToken;
+    if (next.refreshToken !== undefined)
+        cloud.refresh_token = next.refreshToken;
+    cloud.token_expiry = next.expiresAt;
+    config.backend.cloud = cloud;
+    save(config);
+    return next.accessToken;
+}
+function isExpired(expiresAt) {
+    // Legacy tokens persisted without an expiry are assumed valid; the server is
+    // the ultimate authority and a 401 triggers re-login.
+    if (expiresAt === undefined || expiresAt === "")
+        return false;
+    const expiryMs = Date.parse(expiresAt);
+    if (Number.isNaN(expiryMs))
+        return false;
+    return Date.now() >= expiryMs - EXPIRY_SKEW_MS;
+}
+async function postToken(form) {
+    let response;
+    try {
+        response = await fetch(TOKEN_URL, {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams(form).toString(),
+        });
+    }
+    catch (err) {
+        throw new CliExitError(`failed to reach the authentication server: ${err.message}`, ExitCode.Connection);
+    }
+    const body = (await response.json().catch(() => ({})));
+    if (!response.ok || body.access_token === undefined) {
+        const detail = body.error_description ?? body.error ?? `HTTP ${response.status}`;
+        throw new CliExitError(`authentication failed: ${detail}`, ExitCode.Auth);
+    }
+    return {
+        accessToken: body.access_token,
+        refreshToken: body.refresh_token,
+        expiresAt: body.expires_in !== undefined
+            ? new Date(Date.now() + body.expires_in * 1000).toISOString()
+            : undefined,
+    };
+}
+//# sourceMappingURL=token.js.map

package/auth/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/auth/token.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,6EAA6E;AAG7E,OAAO,EAAe,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAW/D,4EAA4E;AAC5E,+BAA+B;AAC/B,MAAM,cAAc,GAAG,MAAM,CAAC;AAU9B,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAA8C;IAC/E,OAAO,SAAS,CAAC;QACf,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,YAAY,EAAE,WAAW,EAAE;QAC3B,aAAa,EAAE,MAAM,CAAC,YAAY;KACnC,CAAC,CAAC;AACL,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,YAAoB;IAC3D,OAAO,SAAS,CAAC;QACf,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,SAAS;QACpB,aAAa,EAAE,YAAY;KAC5B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,OAAO,KAAK,IAA4B,EAAE;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAC3C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE;YAAE,OAAO,MAAM,CAAC;QAEzD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,IAAI,KAAK,EAAE,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;YACrD,OAAO,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC;QACvD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC;QACxF,OAAO,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IACxD,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,YAAoB;IACnE,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,8EAA8E;QAC9E,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC;IAC7C,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IACzC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC;IAC/B,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC;IAC7E,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC;IACpC,MAAM,CAAC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,CAAC;IACb,OAAO,IAAI,CAAC,WAAW,CAAC;AAC1B,CAAC;AAED,SAAS,SAAS,CAAC,SAA6B;IAC9C,6EAA6E;IAC7E,sDAAsD;IACtD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,GAAG,cAAc,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAA4B;IACnD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CACpB,8CAA+C,GAAa,CAAC,OAAO,EAAE,EACtE,QAAQ,CAAC,UAAU,CACpB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;IAC7E,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;QACjF,MAAM,IAAI,YAAY,CAAC,0BAA0B,MAAM,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,SAAS,EACP,IAAI,CAAC,UAAU,KAAK,SAAS;YAC3B,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YAC7D,CAAC,CAAC,SAAS;KAChB,CAAC;AACJ,CAAC"}

package/backend.d.ts

@@ -0,0 +1,5 @@
+import { type BackendClient } from "./client/index.js";
+import { type Config } from "./config/index.js";
+/** Build a backend client for the given (or on-disk) config, with auto-refresh. */
+export declare function connectBackend(config?: Config): BackendClient;
+//# sourceMappingURL=backend.d.ts.map

package/backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../src/backend.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,aAAa,EAAuB,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,KAAK,MAAM,EAAQ,MAAM,mBAAmB,CAAC;AAEtD,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,MAAM,GAAE,MAAe,GAAG,aAAa,CAErE"}

package/backend.js

@@ -0,0 +1,14 @@
+// Composition root for the backend client.
+//
+// `createBackendClient` (the client module) is deliberately auth-agnostic; this
+// is the one place that injects the refreshing token provider so every command
+// gets silent token refresh without the client module depending on auth. Keep
+// this as the single entry point commands use to reach the backend.
+import { createRefreshingTokenProvider } from "./auth/token.js";
+import { createBackendClient } from "./client/index.js";
+import { load } from "./config/index.js";
+/** Build a backend client for the given (or on-disk) config, with auto-refresh. */
+export function connectBackend(config = load()) {
+    return createBackendClient({ config, getAccessToken: createRefreshingTokenProvider(config) });
+}
+//# sourceMappingURL=backend.js.map

package/backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.js","sourceRoot":"","sources":["../src/backend.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,oEAAoE;AAEpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAsB,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAe,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEtD,mFAAmF;AACnF,MAAM,UAAU,cAAc,CAAC,SAAiB,IAAI,EAAE;IACpD,OAAO,mBAAmB,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,6BAA6B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAChG,CAAC"}

package/cli/stigmer.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=stigmer.d.ts.map

package/cli/stigmer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stigmer.d.ts","sourceRoot":"","sources":["../../src/cli/stigmer.ts"],"names":[],"mappings":""}

package/cli/stigmer.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+// Entry point for the `stigmer` CLI. Builds the commander program and runs it.
+//
+// Every command-action failure (and any parse-time rejection) funnels through
+// clierr.handle, the single exit point that maps the error to a stable exit
+// code and prints a user-facing message to stderr.
+import { handle } from "../errors/index.js";
+import { buildProgram } from "../program.js";
+async function main() {
+    const program = buildProgram();
+    await program.parseAsync(process.argv);
+}
+main().catch(handle);
+//# sourceMappingURL=stigmer.js.map

package/cli/stigmer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stigmer.js","sourceRoot":"","sources":["../../src/cli/stigmer.ts"],"names":[],"mappings":";AACA,+EAA+E;AAC/E,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,mDAAmD;AAEnD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAC/B,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC"}

package/client/client.d.ts

@@ -0,0 +1,25 @@
+import type { DescService } from "@bufbuild/protobuf";
+import { type Client, type Transport } from "@connectrpc/connect";
+import { Stigmer, type TokenProvider } from "@stigmer/sdk";
+import { type Config } from "../config/index.js";
+/** The composed backend client returned by {@link createBackendClient}. */
+export interface BackendClient {
+    /** High-level typed client for reads (and high-level writes). */
+    readonly stigmer: Stigmer;
+    /** The shared underlying transport. */
+    readonly transport: Transport;
+    /** The config this client was built from (for org resolution by callers). */
+    readonly config: Config;
+    /** Create a raw Connect client for a generated service controller. */
+    controller<Desc extends DescService>(service: Desc): Client<Desc>;
+    /** Probe the server (unauthenticated) to fail fast on connectivity issues. */
+    connect(timeoutMs?: number): Promise<void>;
+}
+export interface BackendClientOptions {
+    /** Config to use; defaults to the on-disk config (or standalone default). */
+    readonly config?: Config;
+    /** Token-provider override (the auth module supplies a refreshing provider). */
+    readonly getAccessToken?: TokenProvider;
+}
+export declare function createBackendClient(options?: BackendClientOptions): BackendClient;
+//# sourceMappingURL=client.d.ts.map

package/client/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/client/client.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,KAAK,MAAM,EAAgB,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAE3D,OAAO,EAAE,KAAK,MAAM,EAAuC,MAAM,oBAAoB,CAAC;AAGtF,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,UAAU,CAAC,IAAI,SAAS,WAAW,EAAE,OAAO,EAAE,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAClE,8EAA8E;IAC9E,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,oBAAoB;IACnC,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;CACzC;AAID,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,oBAAyB,GAAG,aAAa,CAuBrF"}

package/client/client.js

@@ -0,0 +1,55 @@
+// Backend client façade.
+//
+// Builds a single transport (via the SDK's createNodeTransport + the Go-parity
+// normalizeEndpoint) and exposes:
+//   - `stigmer`: the high-level typed client, used by read verbs.
+//   - `transport` + `controller(service)`: the raw Connect layer, so write
+//     flows (a later wave) can drive generated controllers directly for full
+//     YAML->proto fidelity rather than the high-level client's lossy inputs.
+//
+// This module holds no business logic: backend selection, token precedence, and
+// endpoint shape are delegated to the config layer; org resolution and verb
+// dispatch live with the commands and the registry.
+import { createClient } from "@connectrpc/connect";
+import { Stigmer } from "@stigmer/sdk";
+import { createNodeTransport, normalizeEndpoint } from "@stigmer/sdk/node";
+import { load, resolveEndpoint, resolveToken } from "../config/index.js";
+import { CliExitError, ExitCode } from "../errors/index.js";
+const DEFAULT_CONNECT_TIMEOUT_MS = 10_000;
+export function createBackendClient(options = {}) {
+    const config = options.config ?? load();
+    const baseUrl = normalizeEndpoint(resolveEndpoint(config));
+    // Dynamic provider: re-reads env/config on every request so a token refreshed
+    // mid-session is picked up. STIGMER_API_KEY > config token precedence lives in
+    // resolveToken; a caller-supplied provider (refresh-aware) takes over entirely.
+    const tokenProvider = options.getAccessToken ?? (() => resolveToken(config) || null);
+    const transport = createNodeTransport({ baseUrl, getAccessToken: tokenProvider });
+    const stigmer = new Stigmer({ baseUrl, getAccessToken: tokenProvider, customTransport: transport });
+    return {
+        stigmer,
+        transport,
+        config,
+        controller(service) {
+            return createClient(service, transport);
+        },
+        async connect(timeoutMs = DEFAULT_CONNECT_TIMEOUT_MS) {
+            await withTimeout(stigmer.platform.getServerInfo(), timeoutMs);
+        },
+    };
+}
+// Soft timeout: races the RPC against a timer. It cannot cancel the underlying
+// request, but the CLI exits immediately after, so the dangling call is moot.
+async function withTimeout(promise, timeoutMs) {
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new CliExitError("Timed out connecting to the Stigmer server", ExitCode.Connection)), timeoutMs);
+    });
+    try {
+        return await Promise.race([promise, timeout]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=client.js.map

package/client/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/client/client.ts"],"names":[],"mappings":"AAAA,yBAAyB;AACzB,EAAE;AACF,+EAA+E;AAC/E,kCAAkC;AAClC,kEAAkE;AAClE,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,oDAAoD;AAGpD,OAAO,EAAe,YAAY,EAAkB,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,OAAO,EAAsB,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAe,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAuB5D,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAE1C,MAAM,UAAU,mBAAmB,CAAC,UAAgC,EAAE;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,iBAAiB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAE3D,8EAA8E;IAC9E,+EAA+E;IAC/E,gFAAgF;IAChF,MAAM,aAAa,GAAkB,OAAO,CAAC,cAAc,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;IAEpG,MAAM,SAAS,GAAG,mBAAmB,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC;IAEpG,OAAO;QACL,OAAO;QACP,SAAS;QACT,MAAM;QACN,UAAU,CAAC,OAAO;YAChB,OAAO,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,0BAA0B;YAClD,MAAM,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,SAAS,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,KAAK,UAAU,WAAW,CAAI,OAAmB,EAAE,SAAiB;IAClE,IAAI,KAAiC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAC/C,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,4CAA4C,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,EACjG,SAAS,CACV,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAChD,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC"}

package/client/index.d.ts

@@ -0,0 +1,2 @@
+export { type BackendClient, type BackendClientOptions, createBackendClient } from "./client.js";
+//# sourceMappingURL=index.d.ts.map

package/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC"}

package/client/index.js

@@ -0,0 +1,3 @@
+// Public surface of the CLI backend-client module.
+export { createBackendClient } from "./client.js";
+//# sourceMappingURL=index.js.map

package/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,mDAAmD;AAEnD,OAAO,EAAiD,mBAAmB,EAAE,MAAM,aAAa,CAAC"}

package/commands/agent-exec-flags.d.ts

@@ -0,0 +1,30 @@
+import type { Command } from "commander";
+import type { AgentExecFlags } from "../resources/run/prepare.js";
+/** Commander collector for repeatable string options. */
+export declare const collect: (value: string, previous: string[]) => string[];
+/** The parsed shape of the shared agent-exec options on a commander command. */
+export interface AgentExecOptions {
+    message?: string;
+    attach: string[];
+    approveDefault?: string;
+    verbose?: boolean;
+    detach?: boolean;
+    workspace: string[];
+    branch?: string;
+    commit?: string;
+    env: string[];
+    envFile: string[];
+    secret: string[];
+    secretFile: string[];
+    model?: string;
+    autoApprove?: boolean;
+    mode?: string;
+}
+/**
+ * Register the shared agent-exec options on `command`. `requireMessage` marks
+ * `-m/--message` as required (draft requires a prompt; run does not).
+ */
+export declare function addAgentExecFlags(command: Command, requireMessage?: boolean): Command;
+/** Map parsed commander options onto the shared {@link AgentExecFlags} shape. */
+export declare function toAgentExecFlags(options: AgentExecOptions): AgentExecFlags;
+//# sourceMappingURL=agent-exec-flags.d.ts.map

package/commands/agent-exec-flags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-exec-flags.d.ts","sourceRoot":"","sources":["../../src/commands/agent-exec-flags.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,cAAc,EAAW,MAAM,6BAA6B,CAAC;AAE3E,yDAAyD;AACzD,eAAO,MAAM,OAAO,GAAI,OAAO,MAAM,EAAE,UAAU,MAAM,EAAE,KAAG,MAAM,EAA0B,CAAC;AAE7F,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,cAAc,UAAQ,GAAG,OAAO,CAoBnF;AAED,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,GAAG,cAAc,CAkB1E"}

package/commands/agent-exec-flags.js

@@ -0,0 +1,52 @@
+// The agent-execution flag set shared by `run` and `draft` (Go's
+// registerAgentExecFlags). Centralized so both commands stay in lockstep — a new
+// execution flag is added here once and both surfaces pick it up.
+/** Commander collector for repeatable string options. */
+export const collect = (value, previous) => [...previous, value];
+/**
+ * Register the shared agent-exec options on `command`. `requireMessage` marks
+ * `-m/--message` as required (draft requires a prompt; run does not).
+ */
+export function addAgentExecFlags(command, requireMessage = false) {
+    const messageDesc = "initial message/prompt for execution";
+    if (requireMessage)
+        command.requiredOption("-m, --message <text>", messageDesc);
+    else
+        command.option("-m, --message <text>", messageDesc);
+    return command
+        .option("--attach <path>", "file or directory to attach as input (repeatable)", collect, [])
+        .option("--approve-default <action>", "auto-resolve approvals in headless mode (approve, skip, reject, approve-all)")
+        .option("-v, --verbose", "show execution IDs and phase transitions")
+        .option("--detach", "start execution and return immediately without streaming")
+        .option("-w, --workspace <source>", "workspace: HTTPS git URL or local path (repeatable)", collect, [])
+        .option("--branch <name>", "git branch to clone (single git workspace only)")
+        .option("--commit <sha>", "git commit SHA to checkout (single git workspace only)")
+        .option("--env <kv>", "runtime env var KEY=VALUE (repeatable)", collect, [])
+        .option("--env-file <path>", "load env from file (repeatable, later override earlier)", collect, [])
+        .option("--secret <kv>", "secret env var KEY=VALUE (repeatable, encrypted)", collect, [])
+        .option("--secret-file <path>", "load secrets from file (repeatable, encrypted)", collect, [])
+        .option("--model <model>", "LLM model to use (e.g. claude-sonnet-4-6)")
+        .option("--auto-approve", "automatically approve all tool executions")
+        .option("--mode <mode>", 'interaction mode: "agent" (default) or "plan" (read-only)');
+}
+/** Map parsed commander options onto the shared {@link AgentExecFlags} shape. */
+export function toAgentExecFlags(options) {
+    return {
+        message: options.message ?? "",
+        attach: options.attach,
+        approveDefault: options.approveDefault ?? "",
+        verbose: options.verbose === true,
+        detach: options.detach === true,
+        workspace: options.workspace,
+        branch: options.branch ?? "",
+        commit: options.commit ?? "",
+        env: options.env,
+        envFile: options.envFile,
+        secret: options.secret,
+        secretFile: options.secretFile,
+        model: options.model ?? "",
+        autoApprove: options.autoApprove === true,
+        mode: (options.mode ?? ""),
+    };
+}
+//# sourceMappingURL=agent-exec-flags.js.map

package/commands/agent-exec-flags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-exec-flags.js","sourceRoot":"","sources":["../../src/commands/agent-exec-flags.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,iFAAiF;AACjF,kEAAkE;AAKlE,yDAAyD;AACzD,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,QAAkB,EAAY,EAAE,CAAC,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC;AAqB7F;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAgB,EAAE,cAAc,GAAG,KAAK;IACxE,MAAM,WAAW,GAAG,sCAAsC,CAAC;IAC3D,IAAI,cAAc;QAAE,OAAO,CAAC,cAAc,CAAC,sBAAsB,EAAE,WAAW,CAAC,CAAC;;QAC3E,OAAO,CAAC,MAAM,CAAC,sBAAsB,EAAE,WAAW,CAAC,CAAC;IAEzD,OAAO,OAAO;SACX,MAAM,CAAC,iBAAiB,EAAE,mDAAmD,EAAE,OAAO,EAAE,EAAE,CAAC;SAC3F,MAAM,CAAC,4BAA4B,EAAE,8EAA8E,CAAC;SACpH,MAAM,CAAC,eAAe,EAAE,0CAA0C,CAAC;SACnE,MAAM,CAAC,UAAU,EAAE,0DAA0D,CAAC;SAC9E,MAAM,CAAC,0BAA0B,EAAE,qDAAqD,EAAE,OAAO,EAAE,EAAE,CAAC;SACtG,MAAM,CAAC,iBAAiB,EAAE,iDAAiD,CAAC;SAC5E,MAAM,CAAC,gBAAgB,EAAE,wDAAwD,CAAC;SAClF,MAAM,CAAC,YAAY,EAAE,wCAAwC,EAAE,OAAO,EAAE,EAAE,CAAC;SAC3E,MAAM,CAAC,mBAAmB,EAAE,yDAAyD,EAAE,OAAO,EAAE,EAAE,CAAC;SACnG,MAAM,CAAC,eAAe,EAAE,kDAAkD,EAAE,OAAO,EAAE,EAAE,CAAC;SACxF,MAAM,CAAC,sBAAsB,EAAE,gDAAgD,EAAE,OAAO,EAAE,EAAE,CAAC;SAC7F,MAAM,CAAC,iBAAiB,EAAE,2CAA2C,CAAC;SACtE,MAAM,CAAC,gBAAgB,EAAE,2CAA2C,CAAC;SACrE,MAAM,CAAC,eAAe,EAAE,2DAA2D,CAAC,CAAC;AAC1F,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,OAAyB;IACxD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;QAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,EAAE;QAC5C,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI;QACjC,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,IAAI;QAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW,KAAK,IAAI;QACzC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAY;KACtC,CAAC;AACJ,CAAC"}

package/commands/apikey/duration.d.ts

@@ -0,0 +1,2 @@
+export declare function parseExpiration(input: string): number;
+//# sourceMappingURL=duration.d.ts.map

package/commands/apikey/duration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"duration.d.ts","sourceRoot":"","sources":["../../../src/commands/apikey/duration.ts"],"names":[],"mappings":"AAaA,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAqBrD"}

package/commands/apikey/duration.js

@@ -0,0 +1,30 @@
+// Parse human expiration durations like "30d", "6h", "1y" into milliseconds.
+// Ported from the Go CLI's ParseExpirationDuration; invalid input is a usage
+// error (exit 2). Units: m (minutes), h (hours), d (days), y (years).
+import { UsageError } from "../../errors/index.js";
+const UNIT_MS = {
+    m: 60 * 1000,
+    h: 60 * 60 * 1000,
+    d: 24 * 60 * 60 * 1000,
+    y: 365 * 24 * 60 * 60 * 1000,
+};
+export function parseExpiration(input) {
+    if (input.length < 2) {
+        throw new UsageError(`invalid duration format: "${input}" (expected e.g. 30d, 6h, 1y)`);
+    }
+    const unit = input[input.length - 1];
+    const valueText = input.slice(0, -1);
+    const multiplier = UNIT_MS[unit];
+    if (multiplier === undefined) {
+        throw new UsageError(`invalid duration unit '${unit}' (valid: m, h, d, y)`);
+    }
+    if (!/^\d+$/.test(valueText)) {
+        throw new UsageError(`invalid duration value in "${input}"`);
+    }
+    const value = Number.parseInt(valueText, 10);
+    if (value <= 0) {
+        throw new UsageError(`duration must be positive, got ${value}`);
+    }
+    return value * multiplier;
+}
+//# sourceMappingURL=duration.js.map

package/commands/apikey/duration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"duration.js","sourceRoot":"","sources":["../../../src/commands/apikey/duration.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,6EAA6E;AAC7E,sEAAsE;AAEtE,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,MAAM,OAAO,GAA2B;IACtC,CAAC,EAAE,EAAE,GAAG,IAAI;IACZ,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACjB,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;IACtB,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;CAC7B,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,UAAU,CAAC,6BAA6B,KAAK,+BAA+B,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,UAAU,CAAC,0BAA0B,IAAI,uBAAuB,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,UAAU,CAAC,8BAA8B,KAAK,GAAG,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,UAAU,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,KAAK,GAAG,UAAU,CAAC;AAC5B,CAAC"}

package/commands/apikey/index.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from "commander";
+export declare function registerApiKey(program: Command): void;
+//# sourceMappingURL=index.d.ts.map

package/commands/apikey/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/apikey/index.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAczC,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAqBrD"}

package/commands/apikey/index.js

@@ -0,0 +1,118 @@
+// `stigmer apikey create|fingerprint` — manage API keys for programmatic access.
+//
+// API keys are the non-interactive alternative to browser OAuth, for CI/CD and
+// service accounts. The unified get/list/delete verbs cover the rest.
+import { createHash } from "node:crypto";
+import { create } from "@bufbuild/protobuf";
+import { timestampDate } from "@bufbuild/protobuf/wkt";
+import { ApiKeySchema } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/api_pb";
+import { ApiKeyHashSchema } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/io_pb";
+import { ensureAuthenticated, resolveContextOrganization } from "../../config/index.js";
+import { renderProtoJson, renderProtoYaml } from "../../output/index.js";
+import { addReadFlags, readFormat } from "../shared.js";
+import { parseExpiration } from "./duration.js";
+const DEFAULT_EXPIRATION_DAYS = 90;
+export function registerApiKey(program) {
+    const apikey = program.command("apikey").description("manage API keys for Stigmer Cloud authentication");
+    const create = apikey
+        .command("create")
+        .description("create a new API key")
+        .option("--name <name>", "display name for the API key")
+        .option("--never-expires", "create a key that never expires")
+        .option("--expires-in <duration>", "custom expiration (e.g. 30d, 6h, 1y)")
+        .action(async (options) => {
+        await runCreate(options);
+    });
+    addReadFlags(create);
+    const fingerprint = apikey
+        .command("fingerprint <raw-key>")
+        .description("look up which API key matches a raw token")
+        .action(async (rawKey, options) => {
+        await runFingerprint(rawKey, options);
+    });
+    addReadFlags(fingerprint);
+}
+async function runCreate(options) {
+    const expiresAt = resolveExpiry(options);
+    const { connectBackend } = await import("../../backend.js");
+    const client = connectBackend();
+    ensureAuthenticated(client.config);
+    const created = await client.stigmer.apiKey.create({
+        name: options.name ?? "",
+        org: resolveContextOrganization(client.config),
+        neverExpires: options.neverExpires,
+        expiresAt,
+    });
+    const format = readFormat(options);
+    if (format === "json") {
+        process.stdout.write(renderProtoJson(ApiKeySchema, created));
+        return;
+    }
+    if (format === "yaml") {
+        process.stdout.write(renderProtoYaml(ApiKeySchema, created));
+        return;
+    }
+    process.stdout.write(renderCreatedBanner(created));
+}
+async function runFingerprint(rawKey, options) {
+    const hash = createHash("sha256").update(rawKey).digest("hex");
+    const { connectBackend } = await import("../../backend.js");
+    const client = connectBackend();
+    ensureAuthenticated(client.config);
+    const key = await client.stigmer.apiKey.getByKeyHash(create(ApiKeyHashSchema, { value: hash }));
+    renderApiKey(key, readFormat(options));
+}
+function resolveExpiry(options) {
+    if (options.neverExpires === true)
+        return undefined;
+    if (options.expiresIn !== undefined && options.expiresIn !== "") {
+        return new Date(Date.now() + parseExpiration(options.expiresIn));
+    }
+    return new Date(Date.now() + DEFAULT_EXPIRATION_DAYS * 24 * 60 * 60 * 1000);
+}
+function renderApiKey(key, format) {
+    if (format === "json") {
+        process.stdout.write(renderProtoJson(ApiKeySchema, key));
+        return;
+    }
+    if (format === "yaml") {
+        process.stdout.write(renderProtoYaml(ApiKeySchema, key));
+        return;
+    }
+    const lines = [`API Key: ${key.metadata?.id ?? ""}`, ""];
+    if (key.metadata?.name)
+        lines.push(`  Name:        ${key.metadata.name}`);
+    if (key.spec?.fingerprint)
+        lines.push(`  Fingerprint: ***${key.spec.fingerprint}`);
+    lines.push(`  Expires:     ${formatExpiry(key)}`);
+    process.stdout.write(`${lines.join("\n")}\n`);
+}
+function renderCreatedBanner(key) {
+    const divider = "═".repeat(63);
+    const lines = [
+        "",
+        "API key created successfully!",
+        "",
+        "IMPORTANT: Save this API key now — it will not be shown again!",
+        "",
+        divider,
+        `  ${key.spec?.keyHash ?? ""}`,
+        divider,
+        "",
+        `  ID:          ${key.metadata?.id ?? ""}`,
+    ];
+    if (key.metadata?.name)
+        lines.push(`  Name:        ${key.metadata.name}`);
+    if (key.spec?.fingerprint)
+        lines.push(`  Fingerprint: ***${key.spec.fingerprint}`);
+    lines.push(`  Expires:     ${formatExpiry(key)}`, "", "Usage:", `  export STIGMER_API_KEY='${key.spec?.keyHash ?? ""}'`, "");
+    return `${lines.join("\n")}\n`;
+}
+function formatExpiry(key) {
+    if (key.spec?.neverExpires)
+        return "Never";
+    if (key.spec?.expiresAt !== undefined)
+        return timestampDate(key.spec.expiresAt).toISOString();
+    return "Never";
+}
+//# sourceMappingURL=index.js.map

package/commands/apikey/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/apikey/index.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,EAAE;AACF,+EAA+E;AAC/E,sEAAsE;AAEtE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAe,YAAY,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAElF,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAuC,eAAe,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC9G,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAQnC,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,kDAAkD,CAAC,CAAC;IAEzG,MAAM,MAAM,GAAG,MAAM;SAClB,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,sBAAsB,CAAC;SACnC,MAAM,CAAC,eAAe,EAAE,8BAA8B,CAAC;SACvD,MAAM,CAAC,iBAAiB,EAAE,iCAAiC,CAAC;SAC5D,MAAM,CAAC,yBAAyB,EAAE,sCAAsC,CAAC;SACzE,MAAM,CAAC,KAAK,EAAE,OAA0B,EAAE,EAAE;QAC3C,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IACL,YAAY,CAAC,MAAM,CAAC,CAAC;IAErB,MAAM,WAAW,GAAG,MAAM;SACvB,OAAO,CAAC,uBAAuB,CAAC;SAChC,WAAW,CAAC,2CAA2C,CAAC;SACxD,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,OAAoB,EAAE,EAAE;QACrD,MAAM,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IACL,YAAY,CAAC,WAAW,CAAC,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAA0B;IACjD,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAEzC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEnC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;QACjD,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE;QACxB,GAAG,EAAE,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC;QAC9C,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS;KACV,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,OAAoB;IAChE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE/D,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEnC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAChG,YAAY,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,aAAa,CAAC,OAA0B;IAC/C,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;QAChE,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,MAAoB;IACrD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,YAAY,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACzD,IAAI,GAAG,CAAC,QAAQ,EAAE,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1E,IAAI,GAAG,CAAC,IAAI,EAAE,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACnF,KAAK,CAAC,IAAI,CAAC,kBAAkB,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG;QACZ,EAAE;QACF,+BAA+B;QAC/B,EAAE;QACF,gEAAgE;QAChE,EAAE;QACF,OAAO;QACP,KAAK,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE;QAC9B,OAAO;QACP,EAAE;QACF,kBAAkB,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE;KAC3C,CAAC;IACF,IAAI,GAAG,CAAC,QAAQ,EAAE,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1E,IAAI,GAAG,CAAC,IAAI,EAAE,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACnF,KAAK,CAAC,IAAI,CAAC,kBAAkB,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,6BAA6B,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7H,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,GAAG,CAAC,IAAI,EAAE,YAAY;QAAE,OAAO,OAAO,CAAC;IAC3C,IAAI,GAAG,CAAC,IAAI,EAAE,SAAS,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9F,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/commands/apply.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from "commander";
+export declare function registerApply(program: Command): void;
+//# sourceMappingURL=apply.d.ts.map

package/commands/apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../src/commands/apply.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAazC,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAapD"}