@synteq/cli 0.1.6 → 1.1.1

package/dist/functions-support/resolve.d.ts

@@ -0,0 +1,3 @@
+import { type ApiClient } from "../api/client.js";
+import type { Fn } from "../api/types.js";
+export declare function resolveFunction(api: ApiClient, ref: string, projectId?: string): Promise<Fn>;

package/dist/functions-support/resolve.js

@@ -0,0 +1,31 @@
+import { pageThrough } from "../api/client.js";
+import { idPrefixMatches, isIdPrefix } from "../apps-support/resolve.js";
+/**
+ * Resolve a function reference (slug OR uuid) to a full Fn row — the
+ * functions twin of apps-support/resolve.ts. A uuid goes straight to
+ * GET /functions/{id}; anything else is a slug asked of the server with
+ * `q=<slug>` (name / slug / hostname search, portal #419) and exact-matched
+ * here. An id prefix is not something `q` searches, so that walks every
+ * page of the project's list.
+ *
+ * Throws a plain Error (a user error the command surfaces as exit 1); an
+ * API fault is an ApiError and propagates to `this.fail`.
+ */
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export async function resolveFunction(api, ref, projectId) {
+    if (UUID_RE.test(ref))
+        return api.functions.get(ref);
+    const bySlug = await pageThrough((page) => api.functions.listPage(projectId, { q: ref, page }), (page) => page.items.some((f) => f.slug === ref));
+    let matches = bySlug.filter((f) => f.slug === ref);
+    if (matches.length === 0 && isIdPrefix(ref)) {
+        const all = await pageThrough((page) => api.functions.listPage(projectId, { page }));
+        matches = idPrefixMatches(all, ref, "function");
+    }
+    if (matches.length === 0) {
+        throw new Error(`No function named "${ref}" in the active project. Run \`synteq function list\` to see available functions.`);
+    }
+    if (matches.length > 1)
+        matches.sort((a, b) => b.id.localeCompare(a.id));
+    return matches[0];
+}
+//# sourceMappingURL=resolve.js.map

package/dist/functions-support/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/functions-support/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAkB,MAAM,kBAAkB,CAAC;AAE/D,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAEzE;;;;;;;;;;GAUG;AACH,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAc,EAAE,GAAW,EAAE,SAAkB;IACnF,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAC7D,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CACjD,CAAC;IACF,IAAI,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACrF,OAAO,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,sBAAsB,GAAG,mFAAmF,CAC7G,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}

package/dist/functions-support/runtime.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Runtime knowledge the CLI needs offline: which handler filenames belong to
+ * which runtime, and the starter each `synteq function init` scaffolds.
+ *
+ * HANDLER_ENTRIES mirrors the BACKEND's table verbatim
+ * (portal/backend/app/services/functions/source_shape.py::HANDLER_ENTRIES),
+ * in the same order, so what the CLI infers from a directory is what the
+ * build's shaping step will conclude from the same files. The two sets are
+ * disjoint by extension, which is what makes inference sound.
+ */
+export declare const RUNTIMES: readonly ["node22", "python312"];
+export type Runtime = (typeof RUNTIMES)[number];
+export declare const RUNTIME_LABELS: Record<Runtime, string>;
+export declare const HANDLER_ENTRIES: Record<Runtime, readonly string[]>;
+/**
+ * The runtime a set of ROOT-relative paths is written against, or null when
+ * they do not say: no recognised entry, a Dockerfile (that build path never
+ * consults the runtime), or entries for both runtimes at once.
+ */
+export declare function inferRuntime(paths: string[]): Runtime | null;
+/** The first entry filename per runtime — what `init` writes. */
+export declare function entryFor(runtime: Runtime): string;
+/**
+ * Starter handlers. The node one is byte-identical to the portal editor's
+ * seed (frontend/lib/functions/files.ts STARTER) so a function scaffolded
+ * from the terminal and one pasted in the browser start from the same file.
+ * Both are HANDLERS, not servers: the platform's shim owns the listener and
+ * imports this file expecting a default export (node) or `handler` (python).
+ */
+export declare const STARTERS: Record<Runtime, string>;

package/dist/functions-support/runtime.js

@@ -0,0 +1,52 @@
+/**
+ * Runtime knowledge the CLI needs offline: which handler filenames belong to
+ * which runtime, and the starter each `synteq function init` scaffolds.
+ *
+ * HANDLER_ENTRIES mirrors the BACKEND's table verbatim
+ * (portal/backend/app/services/functions/source_shape.py::HANDLER_ENTRIES),
+ * in the same order, so what the CLI infers from a directory is what the
+ * build's shaping step will conclude from the same files. The two sets are
+ * disjoint by extension, which is what makes inference sound.
+ */
+export const RUNTIMES = ["node22", "python312"];
+export const RUNTIME_LABELS = {
+    node22: "Node.js 22",
+    python312: "Python 3.12",
+};
+export const HANDLER_ENTRIES = {
+    node22: ["index.mjs", "index.js", "handler.mjs", "handler.js", "main.mjs", "main.js"],
+    python312: ["handler.py", "main.py", "index.py", "app.py"],
+};
+/**
+ * The runtime a set of ROOT-relative paths is written against, or null when
+ * they do not say: no recognised entry, a Dockerfile (that build path never
+ * consults the runtime), or entries for both runtimes at once.
+ */
+export function inferRuntime(paths) {
+    const names = new Set(paths.map((p) => p.replace(/^\.\//, "").trim()).filter(Boolean));
+    if (names.has("Dockerfile"))
+        return null;
+    const hits = RUNTIMES.filter((rt) => HANDLER_ENTRIES[rt].some((e) => names.has(e)));
+    return hits.length === 1 ? hits[0] : null;
+}
+/** The first entry filename per runtime — what `init` writes. */
+export function entryFor(runtime) {
+    return HANDLER_ENTRIES[runtime][0];
+}
+/**
+ * Starter handlers. The node one is byte-identical to the portal editor's
+ * seed (frontend/lib/functions/files.ts STARTER) so a function scaffolded
+ * from the terminal and one pasted in the browser start from the same file.
+ * Both are HANDLERS, not servers: the platform's shim owns the listener and
+ * imports this file expecting a default export (node) or `handler` (python).
+ */
+export const STARTERS = {
+    node22: `export default async function handler(event, context) {
+  return { hello: "world", path: event.path };
+}
+`,
+    python312: `def handler(event, context):
+    return {"hello": "world", "path": event["path"]}
+`,
+};
+//# sourceMappingURL=runtime.js.map

package/dist/functions-support/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/functions-support/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAU,CAAC;AAGzD,MAAM,CAAC,MAAM,cAAc,GAA4B;IACrD,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,aAAa;CACzB,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAuC;IACjE,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,CAAC;IACrF,SAAS,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC;CAC3D,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAe;IAC1C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACvF,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,QAAQ,CAAC,OAAgB;IACvC,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,QAAQ,GAA4B;IAC/C,MAAM,EAAE;;;CAGT;IACC,SAAS,EAAE;;CAEZ;CACA,CAAC"}

package/dist/functions-support/source.d.ts

@@ -0,0 +1,92 @@
+import type { FnSourceFile } from "../api/types.js";
+/**
+ * Collect a directory into the `files` shape POST /functions/{id}/deploys/source
+ * takes: plain UTF-8 text files, root-relative slash paths, sorted.
+ *
+ * CONTRACT (the deploy command depends on every line of this):
+ *  - Walks `dir` recursively. Skips, at any depth: node_modules, .git,
+ *    .synteq (reserved for the platform shim — the backend refuses it),
+ *    __pycache__, .venv, venv, dist, build, target, .DS_Store, *.log,
+ *    dotenv files (`.env`, `.env.*` except `.env.example` / `.env.sample` /
+ *    `.env.template`; reason "dotenv", no opt-in), and anything matched by
+ *    a `.synteqignore` in `dir` (gitignore-style globs, one per line, `#`
+ *    comments) when one exists.
+ *  - Skips binary files (a NUL byte in the first 8 KiB) and any single file
+ *    larger than the whole source cap — each skip is reported in `skipped`
+ *    with a reason so the command can print them, never silently dropped.
+ *  - Refuses paths longer than 255 chars or containing `..` (backend limits).
+ *  - Enforces `maxFiles` on the number of collected files (the backend's
+ *    bundle member ceiling, `Fn.maxSourceFiles`; MAX_SOURCE_FILES without
+ *    one). Over it throws SourceTooManyFilesError naming the limit.
+ *  - Enforces `maxTotalBytes` on the sum of UTF-8 content. The caller passes
+ *    the backend's LIVE cap (`Fn.maxSourceBytes`, admin-editable); without
+ *    one, MAX_TOTAL_BYTES is the backend's own default. Over it throws
+ *    SourceTooLargeError naming the total and the largest offenders so the
+ *    user knows what to exclude.
+ *  - Never follows symlinks.
+ *  - Returns files sorted by path so a re-run of an unchanged tree produces
+ *    an identical payload.
+ */
+/**
+ * Fallback source ceiling, used only when the API row carries no
+ * `maxSourceBytes` (an older backend). Mirrors the backend's
+ * `DEFAULT_MAX_FUNCTION_SOURCE_MB` (5 MB); the live number is what an admin
+ * set in portal settings and rides on every GET /functions row.
+ */
+export declare const MAX_TOTAL_BYTES = 5000000;
+/**
+ * Fallback file-count ceiling, used only when the API row carries no
+ * `maxSourceFiles` (an older backend). Mirrors the backend's
+ * `source_shape.MAX_TARBALL_MEMBERS`.
+ */
+export declare const MAX_SOURCE_FILES = 4096;
+/**
+ * The editor's inline `files` shape takes at most this many files
+ * (`functions_deploys._MAX_SOURCE_FILES`). A tree that fits is sent that way
+ * so the deployed source stays re-openable in the portal editor; a larger one
+ * goes up as a tarball (`sourceB64`), which only the caps above bound.
+ */
+export declare const EDITOR_MAX_FILES = 32;
+export interface CollectOptions {
+    /** The backend's source cap for this function, in bytes. */
+    maxTotalBytes?: number;
+    /** The backend's file-count cap for this function. */
+    maxFiles?: number;
+}
+export interface SkippedFile {
+    path: string;
+    reason: "binary" | "too-large" | "ignored" | "dotenv" | "symlink" | "bad-path";
+}
+export interface CollectedSource {
+    files: FnSourceFile[];
+    skipped: SkippedFile[];
+    totalBytes: number;
+}
+export declare class SourceTooLargeError extends Error {
+    readonly totalBytes: number;
+    readonly largest: {
+        path: string;
+        bytes: number;
+    }[];
+    readonly limitBytes: number;
+    constructor(totalBytes: number, largest: {
+        path: string;
+        bytes: number;
+    }[], limitBytes?: number);
+}
+export declare class SourceTooManyFilesError extends Error {
+    readonly fileCount: number;
+    readonly limitFiles: number;
+    constructor(fileCount: number, limitFiles?: number);
+}
+interface IgnoreRule {
+    re: RegExp;
+    /** Trailing "/" — only matches directories. */
+    dirOnly: boolean;
+    /** Leading "/" or an interior "/" — matched against the full root-relative path. */
+    anchored: boolean;
+}
+export declare function parseIgnoreFile(text: string): IgnoreRule[];
+export declare function collectSourceFiles(dir: string, opts?: CollectOptions): Promise<CollectedSource>;
+export declare function tarballFromFiles(files: FnSourceFile[]): Buffer;
+export {};

package/dist/functions-support/source.js

@@ -0,0 +1,343 @@
+import { readdir, lstat, readFile } from "node:fs/promises";
+import path from "node:path";
+import { gzipSync } from "node:zlib";
+import { isDotenvName } from "../apps-support/deploy.js";
+/**
+ * Collect a directory into the `files` shape POST /functions/{id}/deploys/source
+ * takes: plain UTF-8 text files, root-relative slash paths, sorted.
+ *
+ * CONTRACT (the deploy command depends on every line of this):
+ *  - Walks `dir` recursively. Skips, at any depth: node_modules, .git,
+ *    .synteq (reserved for the platform shim — the backend refuses it),
+ *    __pycache__, .venv, venv, dist, build, target, .DS_Store, *.log,
+ *    dotenv files (`.env`, `.env.*` except `.env.example` / `.env.sample` /
+ *    `.env.template`; reason "dotenv", no opt-in), and anything matched by
+ *    a `.synteqignore` in `dir` (gitignore-style globs, one per line, `#`
+ *    comments) when one exists.
+ *  - Skips binary files (a NUL byte in the first 8 KiB) and any single file
+ *    larger than the whole source cap — each skip is reported in `skipped`
+ *    with a reason so the command can print them, never silently dropped.
+ *  - Refuses paths longer than 255 chars or containing `..` (backend limits).
+ *  - Enforces `maxFiles` on the number of collected files (the backend's
+ *    bundle member ceiling, `Fn.maxSourceFiles`; MAX_SOURCE_FILES without
+ *    one). Over it throws SourceTooManyFilesError naming the limit.
+ *  - Enforces `maxTotalBytes` on the sum of UTF-8 content. The caller passes
+ *    the backend's LIVE cap (`Fn.maxSourceBytes`, admin-editable); without
+ *    one, MAX_TOTAL_BYTES is the backend's own default. Over it throws
+ *    SourceTooLargeError naming the total and the largest offenders so the
+ *    user knows what to exclude.
+ *  - Never follows symlinks.
+ *  - Returns files sorted by path so a re-run of an unchanged tree produces
+ *    an identical payload.
+ */
+/**
+ * Fallback source ceiling, used only when the API row carries no
+ * `maxSourceBytes` (an older backend). Mirrors the backend's
+ * `DEFAULT_MAX_FUNCTION_SOURCE_MB` (5 MB); the live number is what an admin
+ * set in portal settings and rides on every GET /functions row.
+ */
+export const MAX_TOTAL_BYTES = 5_000_000;
+/**
+ * Fallback file-count ceiling, used only when the API row carries no
+ * `maxSourceFiles` (an older backend). Mirrors the backend's
+ * `source_shape.MAX_TARBALL_MEMBERS`.
+ */
+export const MAX_SOURCE_FILES = 4096;
+/**
+ * The editor's inline `files` shape takes at most this many files
+ * (`functions_deploys._MAX_SOURCE_FILES`). A tree that fits is sent that way
+ * so the deployed source stays re-openable in the portal editor; a larger one
+ * goes up as a tarball (`sourceB64`), which only the caps above bound.
+ */
+export const EDITOR_MAX_FILES = 32;
+export class SourceTooLargeError extends Error {
+    totalBytes;
+    largest;
+    limitBytes;
+    constructor(totalBytes, largest, limitBytes = MAX_TOTAL_BYTES) {
+        super(`Source is ${(totalBytes / 1024).toFixed(0)} KiB; the limit is ${(limitBytes / 1024).toFixed(0)} KiB. ` +
+            `Largest: ${largest.map((f) => `${f.path} (${(f.bytes / 1024).toFixed(0)} KiB)`).join(", ")}. ` +
+            "Exclude files with a .synteqignore, or add a Dockerfile and deploy as a container.");
+        this.totalBytes = totalBytes;
+        this.largest = largest;
+        this.limitBytes = limitBytes;
+        this.name = "SourceTooLargeError";
+    }
+}
+export class SourceTooManyFilesError extends Error {
+    fileCount;
+    limitFiles;
+    constructor(fileCount, limitFiles = MAX_SOURCE_FILES) {
+        super(`Source has ${fileCount} files; the limit is ${limitFiles}. ` +
+            "Exclude files with a .synteqignore, or add a Dockerfile and deploy as a container.");
+        this.fileCount = fileCount;
+        this.limitFiles = limitFiles;
+        this.name = "SourceTooManyFilesError";
+    }
+}
+/** Names skipped at any depth, whether they name a directory or a file. */
+const SKIP_NAMES = new Set([
+    "node_modules",
+    ".git",
+    ".synteq",
+    "__pycache__",
+    ".venv",
+    "venv",
+    "dist",
+    "build",
+    "target",
+    ".DS_Store",
+]);
+/** Max root-relative path length the backend accepts. */
+const MAX_PATH_CHARS = 255;
+/** How much of a file we sniff for a NUL byte before calling it binary. */
+const BINARY_SNIFF_BYTES = 8 * 1024;
+/** How many offenders SourceTooLargeError names. */
+const LARGEST_REPORTED = 5;
+/** Translate one gitignore-ish glob into a RegExp over a `/`-joined path. */
+function globToRegExp(glob) {
+    let re = "";
+    for (let i = 0; i < glob.length; i++) {
+        const c = glob[i];
+        if (c === "*") {
+            if (glob[i + 1] === "*") {
+                // `**` spans separators. `a/**/b` must also match `a/b`, so swallow a
+                // following slash into the optional group.
+                i++;
+                if (glob[i + 1] === "/") {
+                    i++;
+                    re += "(?:.*/)?";
+                }
+                else {
+                    re += ".*";
+                }
+            }
+            else {
+                re += "[^/]*";
+            }
+        }
+        else if (c === "?") {
+            re += "[^/]";
+        }
+        else {
+            re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+        }
+    }
+    return new RegExp(`^${re}$`);
+}
+export function parseIgnoreFile(text) {
+    const rules = [];
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        let pattern = line;
+        const dirOnly = pattern.endsWith("/");
+        if (dirOnly)
+            pattern = pattern.slice(0, -1);
+        const leadingSlash = pattern.startsWith("/");
+        if (leadingSlash)
+            pattern = pattern.slice(1);
+        if (!pattern)
+            continue;
+        // gitignore: a pattern with no interior slash matches at any depth.
+        const anchored = leadingSlash || pattern.includes("/");
+        rules.push({ re: globToRegExp(pattern), dirOnly, anchored });
+    }
+    return rules;
+}
+/**
+ * Does `relPath` (root-relative, forward slashes, no trailing slash) match?
+ * `isDir` gates the trailing-slash rules. An unanchored rule is tried against
+ * every path segment, matching gitignore's "matches at any depth".
+ */
+function ignoreMatches(rules, relPath, isDir) {
+    const base = path.posix.basename(relPath);
+    for (const rule of rules) {
+        if (rule.dirOnly && !isDir)
+            continue;
+        if (rule.re.test(relPath))
+            return true;
+        if (!rule.anchored && rule.re.test(base))
+            return true;
+    }
+    return false;
+}
+async function readIgnoreRules(dir) {
+    try {
+        const text = await readFile(path.join(dir, ".synteqignore"), "utf8");
+        return parseIgnoreFile(text);
+    }
+    catch {
+        return [];
+    }
+}
+// ── walk ────────────────────────────────────────────────────────────────────
+function isBinary(buf) {
+    return buf.subarray(0, BINARY_SNIFF_BYTES).includes(0);
+}
+export async function collectSourceFiles(dir, opts = {}) {
+    const limit = opts.maxTotalBytes ?? MAX_TOTAL_BYTES;
+    const maxFiles = opts.maxFiles ?? MAX_SOURCE_FILES;
+    const root = path.resolve(dir);
+    const rules = await readIgnoreRules(root);
+    const files = [];
+    const skipped = [];
+    const sizes = [];
+    let totalBytes = 0;
+    const walk = async (absDir, relDir) => {
+        let entries;
+        try {
+            entries = await readdir(absDir);
+        }
+        catch {
+            return;
+        }
+        entries.sort();
+        for (const name of entries) {
+            const rel = relDir ? `${relDir}/${name}` : name;
+            const abs = path.join(absDir, name);
+            // `.synteqignore` itself is metadata, not source.
+            if (rel === ".synteqignore")
+                continue;
+            if (SKIP_NAMES.has(name) || name.endsWith(".log")) {
+                skipped.push({ path: rel, reason: "ignored" });
+                continue;
+            }
+            // `.env` / `.env.*` (not `.env.example`): never packed, on any path —
+            // the same rule as the app pack and the orchestrator's extraction.
+            // Reported with its own reason so the deploy can say where the
+            // variables go instead.
+            if (isDotenvName(name)) {
+                skipped.push({ path: rel, reason: "dotenv" });
+                continue;
+            }
+            // lstat, never stat: a symlink must be reported, never traversed.
+            let st;
+            try {
+                st = await lstat(abs);
+            }
+            catch {
+                continue;
+            }
+            if (st.isSymbolicLink()) {
+                skipped.push({ path: rel, reason: "symlink" });
+                continue;
+            }
+            if (st.isDirectory()) {
+                if (ignoreMatches(rules, rel, true)) {
+                    skipped.push({ path: rel, reason: "ignored" });
+                    continue;
+                }
+                await walk(abs, rel);
+                continue;
+            }
+            if (!st.isFile()) {
+                // Sockets, FIFOs, devices — nothing the backend can take.
+                skipped.push({ path: rel, reason: "ignored" });
+                continue;
+            }
+            if (ignoreMatches(rules, rel, false)) {
+                skipped.push({ path: rel, reason: "ignored" });
+                continue;
+            }
+            if (rel.length > MAX_PATH_CHARS || rel.split("/").includes("..")) {
+                skipped.push({ path: rel, reason: "bad-path" });
+                continue;
+            }
+            // A file bigger than the whole cap can never fit; skip it before
+            // reading it so the walk stays cheap on a stray multi-GB artefact.
+            if (st.size > limit) {
+                skipped.push({ path: rel, reason: "too-large" });
+                continue;
+            }
+            let buf;
+            try {
+                buf = await readFile(abs);
+            }
+            catch {
+                skipped.push({ path: rel, reason: "ignored" });
+                continue;
+            }
+            if (isBinary(buf)) {
+                skipped.push({ path: rel, reason: "binary" });
+                continue;
+            }
+            const content = buf.toString("utf8");
+            const bytes = Buffer.byteLength(content, "utf8");
+            files.push({ path: rel, content });
+            sizes.push({ path: rel, bytes });
+            totalBytes += bytes;
+        }
+    };
+    await walk(root, "");
+    if (totalBytes > limit) {
+        const largest = [...sizes]
+            .sort((a, b) => b.bytes - a.bytes || a.path.localeCompare(b.path))
+            .slice(0, LARGEST_REPORTED);
+        throw new SourceTooLargeError(totalBytes, largest, limit);
+    }
+    if (files.length > maxFiles)
+        throw new SourceTooManyFilesError(files.length, maxFiles);
+    files.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    skipped.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    return { files, skipped, totalBytes };
+}
+// ── tarball ─────────────────────────────────────────────────────────────────
+//
+// The `sourceB64` shape: a gzipped tar of the collected files. Hand-rolled
+// ustar (no new dependency) and DETERMINISTIC like the backend's own
+// `tar_from_members` — sorted paths, mtime/uid/gid zeroed, one mode, no owner
+// names — so an unchanged tree uploads identical bytes. A path over the
+// 100-byte ustar name field gets a POSIX pax `path` record ahead of it.
+const BLOCK = 512;
+function octal(n, width) {
+    return n.toString(8).padStart(width - 1, "0") + "\0";
+}
+function tarHeader(name, size, type) {
+    const h = Buffer.alloc(BLOCK);
+    name.copy(h, 0, 0, Math.min(name.length, 100));
+    h.write(octal(0o644, 8), 100, "ascii");
+    h.write(octal(0, 8), 108, "ascii");
+    h.write(octal(0, 8), 116, "ascii");
+    h.write(octal(size, 12), 124, "ascii");
+    h.write(octal(0, 12), 136, "ascii");
+    h.write("        ", 148, "ascii");
+    h.write(type, 156, "ascii");
+    h.write("ustar\0", 257, "ascii");
+    h.write("00", 263, "ascii");
+    let sum = 0;
+    for (const b of h)
+        sum += b;
+    h.write(sum.toString(8).padStart(6, "0") + "\0 ", 148, "ascii");
+    return h;
+}
+function padded(data) {
+    const rem = data.length % BLOCK;
+    return rem ? [data, Buffer.alloc(BLOCK - rem)] : [data];
+}
+/** One pax record: "<len> path=<value>\n", where <len> counts itself. */
+function paxPathRecord(p) {
+    const body = ` path=${p}\n`;
+    const bodyLen = Buffer.byteLength(body, "utf8");
+    let len = bodyLen + 1;
+    while (String(len).length + bodyLen !== len)
+        len = String(len).length + bodyLen;
+    return Buffer.from(`${len}${body}`, "utf8");
+}
+export function tarballFromFiles(files) {
+    const parts = [];
+    const sorted = [...files].sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    for (const f of sorted) {
+        const name = Buffer.from(f.path, "utf8");
+        const data = Buffer.from(f.content, "utf8");
+        if (name.length > 100) {
+            const pax = paxPathRecord(f.path);
+            parts.push(tarHeader(Buffer.from("././@PaxHeader"), pax.length, "x"), ...padded(pax));
+        }
+        parts.push(tarHeader(name, data.length, "0"), ...padded(data));
+    }
+    parts.push(Buffer.alloc(BLOCK * 2));
+    return gzipSync(Buffer.concat(parts));
+}
+//# sourceMappingURL=source.js.map

package/dist/functions-support/source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.js","sourceRoot":"","sources":["../../src/functions-support/source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGrC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC;AAEzC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAoBnC,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAE1B;IACA;IACA;IAHlB,YACkB,UAAkB,EAClB,OAA0C,EAC1C,aAAqB,eAAe;QAEpD,KAAK,CACH,aAAa,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;YACrG,YAAY,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC/F,oFAAoF,CACvF,CAAC;QARc,eAAU,GAAV,UAAU,CAAQ;QAClB,YAAO,GAAP,OAAO,CAAmC;QAC1C,eAAU,GAAV,UAAU,CAA0B;QAOpD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAE9B;IACA;IAFlB,YACkB,SAAiB,EACjB,aAAqB,gBAAgB;QAErD,KAAK,CACH,cAAc,SAAS,wBAAwB,UAAU,IAAI;YAC3D,oFAAoF,CACvF,CAAC;QANc,cAAS,GAAT,SAAS,CAAQ;QACjB,eAAU,GAAV,UAAU,CAA2B;QAMrD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,cAAc;IACd,MAAM;IACN,SAAS;IACT,aAAa;IACb,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,WAAW;CACZ,CAAC,CAAC;AAEH,yDAAyD;AACzD,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,2EAA2E;AAC3E,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,CAAC;AAEpC,oDAAoD;AACpD,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAmB3B,6EAA6E;AAC7E,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxB,sEAAsE;gBACtE,2CAA2C;gBAC3C,CAAC,EAAE,CAAC;gBACJ,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACxB,CAAC,EAAE,CAAC;oBACJ,EAAE,IAAI,UAAU,CAAC;gBACnB,CAAC;qBAAM,CAAC;oBACN,EAAE,IAAI,IAAI,CAAC;gBACb,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,OAAO,CAAC;YAChB,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,EAAE,IAAI,MAAM,CAAC;QACf,CAAC;aAAM,CAAC;YACN,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,OAAO;YAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,YAAY;YAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,oEAAoE;QACpE,MAAM,QAAQ,GAAG,YAAY,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAmB,EAAE,OAAe,EAAE,KAAc;IACzE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK;YAAE,SAAS;QACrC,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAW;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC;QACrE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,OAAuB,EAAE;IAEzB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,IAAI,eAAe,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,MAAM,KAAK,GAAsC,EAAE,CAAC;IACpD,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,MAAM,IAAI,GAAG,KAAK,EAAE,MAAc,EAAE,MAAc,EAAiB,EAAE;QACnE,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,OAAO,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAChD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAEpC,kDAAkD;YAClD,IAAI,GAAG,KAAK,eAAe;gBAAE,SAAS;YAEtC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC/C,SAAS;YACX,CAAC;YAED,sEAAsE;YACtE,mEAAmE;YACnE,+DAA+D;YAC/D,wBAAwB;YACxB,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC9C,SAAS;YACX,CAAC;YAED,kEAAkE;YAClE,IAAI,EAAE,CAAC;YACP,IAAI,CAAC;gBACH,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC/C,SAAS;YACX,CAAC;YAED,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBACrB,IAAI,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;oBACpC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;oBAC/C,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACrB,SAAS;YACX,CAAC;YAED,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;gBACjB,0DAA0D;gBAC1D,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC/C,SAAS;YACX,CAAC;YAED,IAAI,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC/C,SAAS;YACX,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,GAAG,cAAc,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;gBAChD,SAAS;YACX,CAAC;YAED,iEAAiE;YACjE,mEAAmE;YACnE,IAAI,EAAE,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;gBACjD,SAAS;YACX,CAAC;YAED,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC/C,SAAS;YACX,CAAC;YAED,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC9C,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACjD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YACjC,UAAU,IAAI,KAAK,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAErB,IAAI,UAAU,GAAG,KAAK,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC;aACvB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aACjE,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAC9B,MAAM,IAAI,mBAAmB,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ;QAAE,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAEvF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACxC,CAAC;AAED,+EAA+E;AAC/E,EAAE;AACF,2EAA2E;AAC3E,qEAAqE;AACrE,8EAA8E;AAC9E,wEAAwE;AACxE,wEAAwE;AAExE,MAAM,KAAK,GAAG,GAAG,CAAC;AAElB,SAAS,KAAK,CAAC,CAAS,EAAE,KAAa;IACrC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;AACvD,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,IAAY,EAAE,IAAe;IAC5D,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5B,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IAChC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,yEAAyE;AACzE,SAAS,aAAa,CAAC,CAAS;IAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,GAAG,GAAG,OAAO,GAAG,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,OAAO,KAAK,GAAG;QAAE,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC;IAChF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAqB;IACpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxF,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACpC,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACxC,CAAC"}

package/dist/help/help-filter.d.ts

@@ -0,0 +1,10 @@
+import { type AuthMode, type ScopeSet } from "../auth/scope.js";
+export interface HelpCommand {
+    id: string;
+    apiKeyScope?: string;
+    hidden: boolean;
+}
+/** Given the oclif command list, mode, and granted scopes, return a new
+ *  list where commands that shouldn't render in --help have `hidden: true`.
+ *  Existing hidden=true entries stay hidden regardless. */
+export declare function computeVisibleCommands<T extends HelpCommand>(cmds: readonly T[], mode: AuthMode, granted: ScopeSet): T[];

package/dist/help/help-filter.js

@@ -0,0 +1,9 @@
+import { filterCommandIdsByScope } from "../auth/scope.js";
+/** Given the oclif command list, mode, and granted scopes, return a new
+ *  list where commands that shouldn't render in --help have `hidden: true`.
+ *  Existing hidden=true entries stay hidden regardless. */
+export function computeVisibleCommands(cmds, mode, granted) {
+    const keep = filterCommandIdsByScope(cmds.map((c) => ({ id: c.id, apiKeyScope: c.apiKeyScope })), mode, granted);
+    return cmds.map((c) => (c.hidden || keep.has(c.id) ? c : { ...c, hidden: true }));
+}
+//# sourceMappingURL=help-filter.js.map

package/dist/help/help-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"help-filter.js","sourceRoot":"","sources":["../../src/help/help-filter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAgC,MAAM,kBAAkB,CAAC;AAQzF;;2DAE2D;AAC3D,MAAM,UAAU,sBAAsB,CACpC,IAAkB,EAClB,IAAc,EACd,OAAiB;IAEjB,MAAM,IAAI,GAAG,uBAAuB,CAClC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAC3D,IAAI,EACJ,OAAO,CACR,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACpF,CAAC"}

package/dist/help/scope-aware-help.d.ts

@@ -0,0 +1,30 @@
+import { Help } from "@oclif/core";
+import { type HelpCommand } from "./help-filter.js";
+/** A minimal shape of oclif's Command.Loadable — just enough to load the
+ *  live command class and read its cached id/hidden fields. Kept separate
+ *  from oclif's own type so this can be unit-tested with plain mocks. */
+export interface LoadableCommand {
+    id: string;
+    hidden: boolean;
+    load(): Promise<unknown>;
+}
+/** this.config.commands is oclif's cached Command.Cached[] descriptor
+ *  list. That descriptor is built from each command's KNOWN static fields
+ *  (description, examples, flags, hidden, ...) — a custom static like
+ *  `apiKeyScope` only lives on the live command class and is NOT
+ *  guaranteed to survive onto the cached descriptor (e.g. a stale
+ *  oclif.manifest.json built before the field existed short-circuits
+ *  oclif's fresh-cache build entirely, per-field). Reading `apiKeyScope`
+ *  off the cached descriptor can silently return undefined, which
+ *  scopeAllowsCommand() fail-closes to session-only, hiding every command
+ *  under api-key mode. Load each command's live class instead (oclif's
+ *  standard `Loadable.load()` escape hatch — modules are cached after
+ *  first import, so this is cheap and only runs once for --help) and read
+ *  apiKeyScope from there. Exported standalone so it can be unit-tested
+ *  against mock Loadable objects without spinning up a real oclif Config. */
+export declare function enrichWithLiveApiKeyScope(cmds: readonly LoadableCommand[]): Promise<HelpCommand[]>;
+export default class ScopeAwareHelp extends Help {
+    showHelp(argv: string[]): Promise<void>;
+    showRootHelp(): Promise<void>;
+    private applyScopeFilter;
+}