@tailor-platform/sdk 2.38.0 → 2.39.0

package/dist/configure/services/auth/types.d.mts

@@ -155,17 +155,34 @@ export type AuthServiceInput<User extends TailorDBInstance, Attributes extends U
   publishSessionEvents?: boolean;
 };
 declare const authDefinitionBrand: unique symbol;
-export type AuthDefinitionBrand = {
+type AuthDefinitionBrand = {
   readonly [authDefinitionBrand]: true;
 };
 export type DefinedAuth<Name extends string, Config> = Config & {
   name: Name;
-} & AuthDefinitionBrand;
+} & AuthDefinitionBrand & {
+  /**
+   * Reference this auth from another app's config as an external auth.
+   * Only the name and the machine users are taken over; the app that defines the auth still deploys the rest.
+   * @returns External auth reference to use as `auth` of the other app's `defineConfig`
+   */
+  asExternal(): AuthExternalReference<Name, Config>;
+};
 export type AuthExternalConfig = {
   name: string;
   external: true;
 };
+/** Reference to another app's auth returned by `asExternal()` of a `defineAuth` result. */
+type AuthExternalReference<Name extends string, Config> = {
+  readonly name: Name;
+  readonly external: true;
+  readonly machineUsers: [Config] extends [{
+    machineUsers?: infer MachineUsers;
+  }] ? NonNullable<MachineUsers> : never;
+};
 type AuthServiceInputLoose = AuthServiceInput<any, any, any, string, any>;
-export type AuthOwnConfig = DefinedAuth<string, AuthServiceInputLoose>;
+export type AuthOwnConfig = AuthServiceInputLoose & {
+  name: string;
+} & AuthDefinitionBrand;
 export type AuthConfig = AuthOwnConfig | AuthExternalConfig;
 export {};

package/dist/configure/services/executor/trigger/webhook.d.mts

@@ -3,9 +3,16 @@ import { TailorEnv } from "../../../../runtime/types.mjs";
 import { IncomingWebhookTrigger as IncomingWebhookTrigger$1 } from "../../../../types/executor.generated.mjs";
 export interface IncomingWebhookArgs<T extends IncomingWebhookRequest> {
   body: T["body"];
+  /**
+   * Request headers. Empty when the executor is triggered manually with
+   * `tailor executor trigger` or `triggerExecutor`.
+   */
   headers: T["headers"];
   method: "POST" | "GET" | "PUT" | "DELETE";
-  /** Raw request body, base64-encoded. */
+  /**
+   * Raw request body, base64-encoded. Absent when the executor is triggered
+   * manually with `tailor executor trigger` or `triggerExecutor`.
+   */
   rawBody: string;
   env: TailorEnv;
 }

package/dist/{context-OOASEQLA.mjs → context-CYBcQZyO.mjs}

@@ -1 +1 @@
-export{u as loadPlatformClientConfig,d as loadStoredAccessTokenWithoutRefresh,h as platformConfigExists,_ as readEnvironmentToken}from"./context-DSi5kfqr.mjs";
+export{u as loadPlatformClientConfig,d as loadStoredAccessTokenWithoutRefresh,h as platformConfigExists,_ as readEnvironmentToken}from"./context-aAgFGDBD.mjs";

package/dist/{context-DSi5kfqr.mjs → context-aAgFGDBD.mjs}

@@ -1,4 +1,4 @@
-import{i as e}from"./resource_pb-elY668ZB.mjs";import{t}from"./assert-WeXvmG4j.mjs";import{l as n}from"./validation-errors-DqCeUW4L.mjs";import{S as r,a as i,f as a,o,p as s,r as c,t as l,u}from"./errors-9OOL3xOM.mjs";import{t as d}from"./multiline-EyzjEwn9.mjs";import{C as f,M as p,T as ee,_ as te,j as m,k as h,u as g,y as _}from"./client-DOQv-BP8.mjs";import{t as v}from"./package-json-C690ceex.mjs";import{n as y,r as b,t as ne}from"./secret-file-CSXzcg4c.mjs";import{AsyncLocalStorage as re}from"node:async_hooks";import{arg as x,extractFields as ie,parseArgv as ae,toCamelCase as oe}from"@politty/zod";import*as S from"pathe";import{z as C}from"zod";import*as w from"node:fs";import{parseEnv as se}from"node:util";import{parseYAML as ce,stringifyYAML as le}from"confbox";import{findUpSync as ue}from"find-up-simple";import{lt as de}from"semver";import{xdgConfig as T}from"xdg-basedir";import*as fe from"node:crypto";import*as pe from"node:os";const me={ms:1,s:1e3,m:6e4},E=/^(\d+)(ms|s|m)$/,he=C.string().refine(e=>E.test(e),{message:`Invalid duration format. Expected format: '3s', '500ms', '1m'`}).refine(e=>{let t=e.match(E);if(!t)return!1;let n=t[1];return n!==void 0&&parseInt(n,10)>0},{message:`Duration must be greater than 0`});function parseDuration(e){let n=t(e.match(E),`invalid duration format: ${e}`),r=parseInt(t(n[1],`duration digits group missing`),10),i=t(n[2],`duration unit group missing`);return r*me[i]}const ge=C.coerce.number().int().positive(),D=C.coerce.number().int().nonnegative(),O=C.enum([`asc`,`desc`]);function toPageDirection(t){if(t!==void 0)return t===`asc`?e.ASC:e.DESC}function optionTokens(e){let t=e.indexOf(`--`);return t===-1?e:e.slice(0,t)}function hasMachineUserFlag(e){return optionTokens(e).some(e=>e===`-m`||e.startsWith(`-m=`)||e===`--machine-user`||e.startsWith(`--machine-user=`)||e===`--machineUser`||e.startsWith(`--machineUser=`)||e===`--machineuser`||e.startsWith(`--machineuser=`))}function resolveMachineUserInputSource(e,t=process.argv.slice(2),n={}){if(e!==void 0)return n.valueIsExplicit||hasMachineUserFlag(t)?`option`:process.env.TAILOR_PLATFORM_MACHINE_USER_NAME===e?`env`:`option`}function loadEnvFiles(e,t){let n=new Set(Object.keys(process.env)),load=(e,t)=>{for(let r of[e??[]].flat()){let e=S.resolve(process.cwd(),r);if(!w.existsSync(e)){if(t)throw Error(`Environment file not found: ${e}`);continue}let i=w.readFileSync(e,`utf-8`),a=se(i);for(let[e,t]of Object.entries(a))n.has(e)||(process.env[e]=t)}};load(e,!0),load(t,!1)}const k=`json`,A=`verbose`,_e={aliasMap:/* @__PURE__ */ new Map([[`j`,k]]),booleanFlags:/* @__PURE__ */ new Set([k,A]),defaultNegationDisabledFields:/* @__PURE__ */ new Set};let j=!1;function globalArgsApplied(){return j}function parseGlobalFlag(e,t){return ae(e,_e).options[t]}function globalFlagValue(e,t,n){let r=e.indexOf(`--`);return parseGlobalFlag((r===-1?e:e.slice(0,r)).filter(e=>{let[r]=e.split(`=`,1);return r===`--${t}`||e===`--no-${t}`||n!==void 0&&r===`-${n}`}),t)}function jsonFlagRequested(e){return globalFlagValue(e,k,`j`)===!0}function requestedJsonModeSource(e){let t=globalFlagValue(e,k,`j`),n=process.env[u],r=n!==void 0&&parseGlobalFlag([`--${k}=${n}`],k)===!0;if(t===!0)return r?`both`:`flag`;if(t===void 0){if(r)return`env`;if(n===void 0&&a()!==void 0)return`agent`}}function resolveEarlyFailure(e,t){let r=globalFlagValue(t,A);typeof r==`boolean`&&(s.verbose=r);let i=requestedJsonModeSource(t);i&&(s.setJsonMode(!0,i),e instanceof Error&&Object.getPrototypeOf(e)===Error.prototype&&!Object.hasOwn(e,`code`)&&n(e,{code:`INVALID_ARGUMENTS`}))}function jsonArgSource(e){return e===`env`?`env`:e==="default"?`agent`:e===`cli`&&r(process.env.TAILOR_JSON_OUTPUT)===!0?`both`:`flag`}function createCommonArgs(e={}){return{"env-file":x(C.array(C.string()).optional(),{alias:`e`,description:`Path to an environment file, repeatable (error if not found)`,completion:{type:`file`,matcher:[`.env.*`,`.env`]}}),"env-file-if-exists":x(C.array(C.string()).optional(),{description:`Path to an environment file, repeatable (ignored if not found)`,completion:{type:`file`,matcher:[`.env.*`,`.env`]},effect:(e,{args:t})=>{loadEnvFiles(t[`env-file`],t[`env-file-if-exists`])}}),[A]:x(C.boolean().default(!1),{...e.verboseAlias===void 0?{}:{alias:e.verboseAlias},description:`Enable verbose logging`,negation:!0,effect:(e,{args:t})=>{s.verbose=t.$source?.(A)===`cli`?e:void 0}}),[k]:x(C.boolean().default(()=>a()!==void 0),{alias:`j`,description:`Output as JSON`,negation:!0,env:u,effect:(e,{args:t})=>{j=!0,s.setJsonMode(e,jsonArgSource(t.$source?.(k)))}})}}const M=createCommonArgs();function flagTokensOf(e){return[e.cliName,...e.alias??[]].flatMap(e=>e.length===1?[`-${e}`]:[`--${e}`,`--${oe(e)}`])}const ve=/* @__PURE__ */ new Map([[`env-file`,`envFiles`],[`env-file-if-exists`,`envFilesIfExists`]]),ye=new Map(ie(C.strictObject(M)).fields.flatMap(e=>{let t=ve.get(e.name);return t===void 0?[]:flagTokensOf(e).map(e=>[e,t])}));function globalBooleanAliases(e){return new Set(ie(C.strictObject(createCommonArgs(e))).fields.filter(e=>e.type===`boolean`).flatMap(e=>e.alias??[]))}function splitOptionToken(e,t){if(e.startsWith(`-`)&&!e.startsWith(`--`)&&e.length>2&&!e.includes(`=`)){let n=Array.from(e.slice(1)),r=n.findIndex(e=>!t.has(e));if(r===-1)return{flag:e,value:void 0};let i=n.slice(r+1).join(``);return{flag:`-${n[r]}`,value:i===``?void 0:i}}let n=e.indexOf(`=`);return n===-1?{flag:e,value:void 0}:{flag:e.slice(0,n),value:e.slice(n+1)}}function readEnvFileArgs(e,t={}){let n={envFiles:[],envFilesIfExists:[]},r=globalBooleanAliases(t),i=optionTokens(e);for(let e=0;e<i.length;e++){let{flag:t,value:a}=splitOptionToken(i[e]??``,r),o=ye.get(t);if(o===void 0)continue;if(a!==void 0){n[o].push(a);continue}let s=i[e+1];s!==void 0&&!s.startsWith(`-`)&&(n[o].push(s),e++)}return n}function loadEnvFilesFromArgv(e,t={}){let{envFiles:n,envFilesIfExists:r}=readEnvFileArgs(e,t);loadEnvFiles(n,r)}const N={"workspace-id":x(C.string().optional(),{alias:`w`,description:`Workspace ID`,env:`TAILOR_PLATFORM_WORKSPACE_ID`,completion:{type:`none`}}),profile:x(C.string().optional(),{alias:`p`,description:`Workspace profile`,env:`TAILOR_PLATFORM_PROFILE`,completion:{type:`none`}})},P=`tailor.config.ts`;function formatConfigArg(e){if(!e)return;let t=S.relative(process.cwd(),e);if(t!==`tailor.config.ts`)return`--config=${t}`}function recoveryContextArgs(e){return[...e.workspaceId?[`--workspace-id=${e.workspaceId}`]:[],...e.profile?[`--profile=${e.profile}`]:[]]}function profileUpdateArgs(e,t){return e.startsWith(`-`)?[`profile`,`update`,...t,`--`,e]:[`profile`,`update`,e,...t]}const F={config:x(C.string().default(P),{alias:`c`,description:`Path to Tailor config file`,env:`TAILOR_CONFIG_PATH`,completion:{type:`file`,extensions:[`ts`]}})},be={config:x(C.string().default(P),{alias:`c`,description:`Path to SDK config file. Use comma-separated paths to deploy multiple apps together.`,env:`TAILOR_CONFIG_PATH`,completion:{type:`file`,extensions:[`ts`]}})};function readDeployConfigPathEnv(){let e=process.env.TAILOR_CONFIG_PATH;if(e)return e;let t=process.env.TAILOR_PLATFORM_SDK_CONFIG_PATH;if(t)return s.warn(`TAILOR_PLATFORM_SDK_CONFIG_PATH is deprecated. Please use TAILOR_CONFIG_PATH instead.`),t}const xe={...N,...F},Se={yes:x(C.boolean().default(!1),{alias:`y`,description:`Skip confirmation prompts`})},Ce=`Pass --yes to skip the confirmation.`,we={"organization-id":x(C.string(),{alias:`o`,description:`Organization ID`,env:`TAILOR_PLATFORM_ORGANIZATION_ID`,completion:{type:`none`}})},paginationArgs=(e=`desc`)=>({order:x(O.default(e),{description:`Sort order (asc or desc)`}),limit:x(D.optional(),{alias:`l`,description:`Maximum number of items to return (0 or omit: unlimited)`})}),Te={order:x(O.default(`desc`),{description:`Sort order (asc or desc)`}),limit:x(D.default(50),{alias:`l`,description:`Maximum number of items to return (0: unlimited)`})},Ee={"folder-id":x(C.string(),{alias:`f`,description:`Folder ID`,env:`TAILOR_PLATFORM_FOLDER_ID`,completion:{type:`none`}})};function locationIds(e){let read=t=>{let n=e[t];return n===``&&e.$source?.(t)===`env`?void 0:n};return{organizationId:read(`organization-id`),folderId:read(`folder-id`)}}const I=`CONFIG_LOCK_TIMEOUT`,L=fe.randomUUID(),De=C.looseObject({pid:C.number().int(),hostname:C.string(),instanceId:C.string(),nonce:C.string(),createdAt:C.number()}),R=new re,z=/* @__PURE__ */ new Map;async function withConfigLock(e,t,n={}){let r=R.getStore();if(r?.has(e))return await t();let i=z.get(e)??Promise.resolve(),releaseLocal=()=>{},a=new Promise(e=>{releaseLocal=e}),o=i.then(()=>a);z.set(e,o),await i;try{let i=await acquireFileLock(e,n.timeoutMs??15e4);try{return await R.run(/* @__PURE__ */ new Set([...r??[],e]),t)}finally{releaseFileLock(e,i)}}finally{releaseLocal(),z.get(e)===o&&z.delete(e)}}function isConfigLockTimeout(e){return i(e)&&e.code===I}async function acquireFileLock(e,t){ne(S.dirname(e));let n=fe.randomUUID(),r=Date.now(),i=!1,a=10;for(;;){if(tryCreateLock(e,n))return n;if(reclaimIfStale(e))continue;let o=Date.now()-r;if(o>=t)throw lockTimeoutError(e);!i&&o>=3e3&&(i=!0,s.info(`Waiting for another tailor command to release ${e}...`)),await new Promise(e=>setTimeout(e,a*(.5+Math.random()))),a=Math.min(a*2,250)}}function tryCreateLock(e,t){let n;try{n=w.openSync(e,`wx`,384)}catch(e){if(e.code===`EEXIST`)return!1;throw e}let r={pid:process.pid,hostname:pe.hostname(),instanceId:L,nonce:t,createdAt:Date.now()};try{w.writeSync(n,JSON.stringify(r))}catch(t){throw w.closeSync(n),w.rmSync(e,{force:!0}),t}return w.closeSync(n),!0}function readLock(e){let t,n;try{t=w.statSync(e),n=w.readFileSync(e,`utf-8`)}catch(e){if(e.code===`ENOENT`)return;throw e}return{content:n,ino:t.ino,mtimeMs:t.mtimeMs,owner:parseOwner(n)}}function parseOwner(e){try{let t=De.safeParse(JSON.parse(e));return t.success?t.data:void 0}catch{return}}function isStale(e){let{owner:t}=e,n=Date.now();return t?n-t.createdAt>12e4?!0:t.hostname===pe.hostname()?t.pid===process.pid?t.instanceId===L:!isProcessAlive(t.pid):!1:n-e.mtimeMs>1e4}function isProcessAlive(e){try{return process.kill(e,0),!0}catch(e){return e.code===`EPERM`}}function reclaimIfStale(e){let t=readLock(e);if(!t)return!0;if(!isStale(t))return!1;let n=`${e}.reclaim`;if(!tryCreateGuard(n))return!1;try{let n=readLock(e);return n?.ino===t.ino&&n.mtimeMs===t.mtimeMs&&n.content===t.content&&w.rmSync(e,{force:!0}),!0}finally{w.rmSync(n,{force:!0})}}function tryCreateGuard(e){try{return w.closeSync(w.openSync(e,`wx`,384)),!0}catch(e){if(e.code!==`EEXIST`)throw e}try{Date.now()-w.statSync(e).mtimeMs>1e4&&w.rmSync(e,{force:!0})}catch(e){if(e.code!==`ENOENT`)throw e}return!1}function releaseFileLock(e,t){readLock(e)?.owner?.nonce===t&&w.rmSync(e,{force:!0})}function lockTimeoutError(e){return l({code:I,message:`Timed out waiting for another tailor command to release ${e}.`,suggestion:`Wait for the other tailor commands to finish, then retry. If none is running, delete the lock file.`,context:{lockPath:e}})}const B=`tailor-platform-cli`;let V;async function getEntryClass(){if(V!==void 0)return V;try{V=(await import(`@napi-rs/keyring`)).Entry}catch{s.warn(`System keyring is not available. Tokens will be stored in the config file. Set TAILOR_PLATFORM_TOKEN environment variable for CI environments.`),V=!1}return V}async function isKeyringAvailable(){return await getEntryClass()!==!1}async function loadKeyringTokens(e){let t=await getEntryClass();if(!t)throw Error(`System keyring is not available.`);let n=new t(B,e).getPassword();if(n!==null)try{return JSON.parse(n)}catch{return}}async function saveKeyringTokens(e,t){let n=await getEntryClass();if(!n)throw Error(`System keyring is not available.`);new n(B,e).setPassword(JSON.stringify(t))}async function deleteKeyringTokens(e){let t=await getEntryClass();if(t)try{new t(B,e).deletePassword()}catch{}}const H=C.looseObject({user:C.string(),workspace_id:C.string(),readonly:C.boolean().optional(),machine_user:C.string().optional(),machine_user_override:C.enum([`allow`,`deny`]).optional(),platform_url:C.url().optional(),oauth2_client_id:C.string().optional(),console_url:C.url().optional()}),Oe=C.looseObject({access_token:C.string(),refresh_token:C.string().optional(),token_expires_at:C.string()}),U=C.looseObject({storage:C.literal(`keyring`),token_expires_at:C.string()}),W=C.looseObject({storage:C.literal(`file`),token_expires_at:C.string(),access_token:C.string(),refresh_token:C.string().optional()}),ke=C.discriminatedUnion(`storage`,[U,W]),G=C.strictObject({email:C.string().optional()}),K={...G.shape,default_organization_id:C.string().optional(),default_folder_id:C.string().optional()},q=U.extend(K),Ae=W.extend(K),je=C.discriminatedUnion(`storage`,[q,Ae]),Me=C.looseObject({version:C.literal(1),users:C.partialRecord(C.string(),Oe),profiles:C.partialRecord(C.string(),H),current_user:C.string().nullable()}),J=`2.0.0`,Y=C.templateLiteral([C.number().int(),`.`,C.number().int(),`.`,C.number().int()]),Ne=C.looseObject({version:C.literal(2),min_sdk_version:Y,latest_version:C.number().int().optional(),latest_min_sdk_version:Y.optional(),users:C.partialRecord(C.string(),ke),profiles:C.partialRecord(C.string(),H),current_user:C.string().nullable()}),X=C.looseObject({version:C.literal(3),min_sdk_version:Y,latest_version:C.number().int().optional(),latest_min_sdk_version:Y.optional(),users:C.partialRecord(C.string(),je),profiles:C.partialRecord(C.string(),H),current_user:C.string().nullable()});function platformConfigPath(){if(!T)throw Error(`User home directory not found`);return S.join(T,`tailor-platform`,`config.yaml`)}function platformConfigExists(){return T?w.existsSync(platformConfigPath()):!1}function platformConfigFromProfile(e){let t={...e?.platform_url?{platformUrl:e.platform_url}:{},...e?.oauth2_client_id?{oauth2ClientId:e.oauth2_client_id}:{},...e?.console_url?{consoleUrl:e.console_url}:{}};return Object.keys(t).length>0?t:void 0}function platformUserKey(e,t){let n=f(t);return n===h(`https://api.tailor.tech`)?e:`${n}|${e}`}function userFromPlatformUserKey(e,t){let n=`${f(t)}|`;return e.startsWith(n)?e.slice(n.length):e}function canUseLegacyUserKey(e){try{return f()===e}catch{return!1}}function findUserByEmail(e,t,n){let r=f(n),i=`${r}|`,a=r===h(g);return Object.entries(e).find(([e,n])=>n?.email===t?a?!e.includes(`|`):e.startsWith(i):!1)}function findUserEntry(e,t,n,r={}){let i=platformUserKey(t,n),a=e.users[i];if(a)return{userKey:i,userEntry:a};let o=findUserByEmail(e.users,t,n);if(o?.[1])return{userKey:o[0],userEntry:o[1]};let s=f(n);if(i!==t&&(r.allowLegacyUserKey===!1||!canUseLegacyUserKey(s)))return{userKey:i,userEntry:a};let c=e.users[t];return c?{userKey:t,userEntry:c}:{userKey:i,userEntry:a}}function resolveUserTokenKey(e,t,n,r){return findUserEntry(e,t,n,r).userKey}function resolveConfigUser(e,t,n,r){let{userKey:i,userEntry:a}=findUserEntry(e,t,n,r);return a?userFromPlatformUserKey(i,n):void 0}function hasUserTokenEntry(e,t,n,r){return findUserEntry(e,t,n,r).userEntry!==void 0}function hasUserKeyForName(e,t){return e[t]!==void 0||Object.keys(e).some(e=>e.endsWith(`|${t}`))}function hasUserEmailEntry(e,t){return Object.values(e).some(e=>e?.email===t)}function hasAnyUserTokenEntry(e,t){return hasUserKeyForName(e.users,t)||hasUserEmailEntry(e.users,t)}function hasCurrentUserEntry(e,t){return hasUserKeyForName(e,t)}function declaredKeys(...e){return new Set(e.flatMap(e=>Object.keys(e.shape)))}const Z=declaredKeys(Ne),Q=declaredKeys(U,W),Pe=Q.union(declaredKeys(G)),Fe=declaredKeys(H),Ie=Z.difference(declaredKeys(Me)),Le=declaredKeys(X).difference(Z),Re=declaredKeys(q,Ae).difference(Q);function withoutKeys(e,t){return Object.fromEntries(Object.entries(e).filter(([e])=>!t.has(e)))}function migrateV1ToV2(e){let t={};for(let[n,r]of Object.entries(e.users))r&&(t[n]={...withoutKeys(r,Re),storage:`file`});return{...withoutKeys(e,Ie),version:2,min_sdk_version:`1.29.0`,users:t}}function inferEmailFromUserId(e){return C.email().safeParse(e).success?e:void 0}function migrateV2ToV3(e){let t={};for(let[n,r]of Object.entries(e.users)){if(!r)continue;let e=inferEmailFromUserId(n);t[n]={...withoutKeys(r,Re),...e?{email:e}:{}}}return{...withoutKeys(e,Le),version:3,min_sdk_version:J,users:t}}function migrateV1ToV3(e){return migrateV2ToV3(migrateV1ToV2(e))}function formatUnknownError(e){return e instanceof Error?e.message:String(e)}async function trySaveTokensInKeyring(e,t){if(!await isKeyringAvailable())return!1;try{return await saveKeyringTokens(e,t),!0}catch(e){return s.warn(`System keyring failed to store credentials. Tokens will be stored in the config file. ${formatUnknownError(e)}`),!1}}let ze=!1;async function warnIfNewerConfigAvailable(e){if(!e.latest_min_sdk_version||ze)return;let t=(await v()).version??`0.0.0`;de(t,e.latest_min_sdk_version)&&(ze=!0,s.warn(d`
+import{i as e}from"./resource_pb-elY668ZB.mjs";import{t}from"./assert-WeXvmG4j.mjs";import{l as n}from"./validation-errors-ChvCG6wT.mjs";import{S as r,a as i,f as a,o,p as s,r as c,t as l,u}from"./errors-9OOL3xOM.mjs";import{t as d}from"./multiline-EyzjEwn9.mjs";import{A as f,C as p,M as m,N as h,T as ee,_ as te,u as g,y as _}from"./client-CqiPQgMG.mjs";import{t as v}from"./package-json-C690ceex.mjs";import{n as y,r as b,t as ne}from"./secret-file-CSXzcg4c.mjs";import{AsyncLocalStorage as re}from"node:async_hooks";import{arg as x,extractFields as ie,parseArgv as ae,toCamelCase as oe}from"@politty/zod";import*as S from"pathe";import{z as C}from"zod";import*as w from"node:fs";import{parseEnv as se}from"node:util";import{parseYAML as ce,stringifyYAML as le}from"confbox";import{findUpSync as ue}from"find-up-simple";import{lt as de}from"semver";import{xdgConfig as T}from"xdg-basedir";import*as fe from"node:crypto";import*as pe from"node:os";const me={ms:1,s:1e3,m:6e4},E=/^(\d+)(ms|s|m)$/,he=C.string().refine(e=>E.test(e),{message:`Invalid duration format. Expected format: '3s', '500ms', '1m'`}).refine(e=>{let t=e.match(E);if(!t)return!1;let n=t[1];return n!==void 0&&parseInt(n,10)>0},{message:`Duration must be greater than 0`});function parseDuration(e){let n=t(e.match(E),`invalid duration format: ${e}`),r=parseInt(t(n[1],`duration digits group missing`),10),i=t(n[2],`duration unit group missing`);return r*me[i]}const ge=C.coerce.number().int().positive(),D=C.coerce.number().int().nonnegative(),O=C.enum([`asc`,`desc`]);function toPageDirection(t){if(t!==void 0)return t===`asc`?e.ASC:e.DESC}function optionTokens(e){let t=e.indexOf(`--`);return t===-1?e:e.slice(0,t)}function hasMachineUserFlag(e){return optionTokens(e).some(e=>e===`-m`||e.startsWith(`-m=`)||e===`--machine-user`||e.startsWith(`--machine-user=`)||e===`--machineUser`||e.startsWith(`--machineUser=`)||e===`--machineuser`||e.startsWith(`--machineuser=`))}function resolveMachineUserInputSource(e,t=process.argv.slice(2),n={}){if(e!==void 0)return n.valueIsExplicit||hasMachineUserFlag(t)?`option`:process.env.TAILOR_PLATFORM_MACHINE_USER_NAME===e?`env`:`option`}function loadEnvFiles(e,t){let n=new Set(Object.keys(process.env)),load=(e,t)=>{for(let r of[e??[]].flat()){let e=S.resolve(process.cwd(),r);if(!w.existsSync(e)){if(t)throw Error(`Environment file not found: ${e}`);continue}let i=w.readFileSync(e,`utf-8`),a=se(i);for(let[e,t]of Object.entries(a))n.has(e)||(process.env[e]=t)}};load(e,!0),load(t,!1)}const k=`json`,A=`verbose`,_e={aliasMap:/* @__PURE__ */ new Map([[`j`,k]]),booleanFlags:/* @__PURE__ */ new Set([k,A]),defaultNegationDisabledFields:/* @__PURE__ */ new Set};let j=!1;function globalArgsApplied(){return j}function parseGlobalFlag(e,t){return ae(e,_e).options[t]}function globalFlagValue(e,t,n){let r=e.indexOf(`--`);return parseGlobalFlag((r===-1?e:e.slice(0,r)).filter(e=>{let[r]=e.split(`=`,1);return r===`--${t}`||e===`--no-${t}`||n!==void 0&&r===`-${n}`}),t)}function jsonFlagRequested(e){return globalFlagValue(e,k,`j`)===!0}function requestedJsonModeSource(e){let t=globalFlagValue(e,k,`j`),n=process.env[u],r=n!==void 0&&parseGlobalFlag([`--${k}=${n}`],k)===!0;if(t===!0)return r?`both`:`flag`;if(t===void 0){if(r)return`env`;if(n===void 0&&a()!==void 0)return`agent`}}function resolveEarlyFailure(e,t){let r=globalFlagValue(t,A);typeof r==`boolean`&&(s.verbose=r);let i=requestedJsonModeSource(t);i&&(s.setJsonMode(!0,i),e instanceof Error&&Object.getPrototypeOf(e)===Error.prototype&&!Object.hasOwn(e,`code`)&&n(e,{code:`INVALID_ARGUMENTS`}))}function jsonArgSource(e){return e===`env`?`env`:e==="default"?`agent`:e===`cli`&&r(process.env.TAILOR_JSON_OUTPUT)===!0?`both`:`flag`}function createCommonArgs(e={}){return{"env-file":x(C.array(C.string()).optional(),{alias:`e`,description:`Path to an environment file, repeatable (error if not found)`,completion:{type:`file`,matcher:[`.env.*`,`.env`]}}),"env-file-if-exists":x(C.array(C.string()).optional(),{description:`Path to an environment file, repeatable (ignored if not found)`,completion:{type:`file`,matcher:[`.env.*`,`.env`]},effect:(e,{args:t})=>{loadEnvFiles(t[`env-file`],t[`env-file-if-exists`])}}),[A]:x(C.boolean().default(!1),{...e.verboseAlias===void 0?{}:{alias:e.verboseAlias},description:`Enable verbose logging`,negation:!0,effect:(e,{args:t})=>{s.verbose=t.$source?.(A)===`cli`?e:void 0}}),[k]:x(C.boolean().default(()=>a()!==void 0),{alias:`j`,description:`Output as JSON`,negation:!0,env:u,effect:(e,{args:t})=>{j=!0,s.setJsonMode(e,jsonArgSource(t.$source?.(k)))}})}}const M=createCommonArgs();function flagTokensOf(e){return[e.cliName,...e.alias??[]].flatMap(e=>e.length===1?[`-${e}`]:[`--${e}`,`--${oe(e)}`])}const ve=/* @__PURE__ */ new Map([[`env-file`,`envFiles`],[`env-file-if-exists`,`envFilesIfExists`]]),ye=new Map(ie(C.strictObject(M)).fields.flatMap(e=>{let t=ve.get(e.name);return t===void 0?[]:flagTokensOf(e).map(e=>[e,t])}));function globalBooleanAliases(e){return new Set(ie(C.strictObject(createCommonArgs(e))).fields.filter(e=>e.type===`boolean`).flatMap(e=>e.alias??[]))}function splitOptionToken(e,t){if(e.startsWith(`-`)&&!e.startsWith(`--`)&&e.length>2&&!e.includes(`=`)){let n=Array.from(e.slice(1)),r=n.findIndex(e=>!t.has(e));if(r===-1)return{flag:e,value:void 0};let i=n.slice(r+1).join(``);return{flag:`-${n[r]}`,value:i===``?void 0:i}}let n=e.indexOf(`=`);return n===-1?{flag:e,value:void 0}:{flag:e.slice(0,n),value:e.slice(n+1)}}function readEnvFileArgs(e,t={}){let n={envFiles:[],envFilesIfExists:[]},r=globalBooleanAliases(t),i=optionTokens(e);for(let e=0;e<i.length;e++){let{flag:t,value:a}=splitOptionToken(i[e]??``,r),o=ye.get(t);if(o===void 0)continue;if(a!==void 0){n[o].push(a);continue}let s=i[e+1];s!==void 0&&!s.startsWith(`-`)&&(n[o].push(s),e++)}return n}function loadEnvFilesFromArgv(e,t={}){let{envFiles:n,envFilesIfExists:r}=readEnvFileArgs(e,t);loadEnvFiles(n,r)}const N={"workspace-id":x(C.string().optional(),{alias:`w`,description:`Workspace ID`,env:`TAILOR_PLATFORM_WORKSPACE_ID`,completion:{type:`none`}}),profile:x(C.string().optional(),{alias:`p`,description:`Workspace profile`,env:`TAILOR_PLATFORM_PROFILE`,completion:{type:`none`}})},P=`tailor.config.ts`;function formatConfigArg(e){if(!e)return;let t=S.relative(process.cwd(),e);if(t!==`tailor.config.ts`)return`--config=${t}`}function recoveryContextArgs(e){return[...e.workspaceId?[`--workspace-id=${e.workspaceId}`]:[],...e.profile?[`--profile=${e.profile}`]:[]]}function profileUpdateArgs(e,t){return e.startsWith(`-`)?[`profile`,`update`,...t,`--`,e]:[`profile`,`update`,e,...t]}const F={config:x(C.string().default(P),{alias:`c`,description:`Path to Tailor config file`,env:`TAILOR_CONFIG_PATH`,completion:{type:`file`,extensions:[`ts`]}})},be={config:x(C.string().default(P),{alias:`c`,description:`Path to SDK config file. Use comma-separated paths to deploy multiple apps together.`,env:`TAILOR_CONFIG_PATH`,completion:{type:`file`,extensions:[`ts`]}})};function readDeployConfigPathEnv(){let e=process.env.TAILOR_CONFIG_PATH;if(e)return e;let t=process.env.TAILOR_PLATFORM_SDK_CONFIG_PATH;if(t)return s.warn(`TAILOR_PLATFORM_SDK_CONFIG_PATH is deprecated. Please use TAILOR_CONFIG_PATH instead.`),t}const xe={...N,...F},Se={yes:x(C.boolean().default(!1),{alias:`y`,description:`Skip confirmation prompts`})},Ce=`Pass --yes to skip the confirmation.`,we={"organization-id":x(C.string(),{alias:`o`,description:`Organization ID`,env:`TAILOR_PLATFORM_ORGANIZATION_ID`,completion:{type:`none`}})},paginationArgs=(e=`desc`)=>({order:x(O.default(e),{description:`Sort order (asc or desc)`}),limit:x(D.optional(),{alias:`l`,description:`Maximum number of items to return (0 or omit: unlimited)`})}),Te={order:x(O.default(`desc`),{description:`Sort order (asc or desc)`}),limit:x(D.default(50),{alias:`l`,description:`Maximum number of items to return (0: unlimited)`})},Ee={"folder-id":x(C.string(),{alias:`f`,description:`Folder ID`,env:`TAILOR_PLATFORM_FOLDER_ID`,completion:{type:`none`}})};function locationIds(e){let read=t=>{let n=e[t];return n===``&&e.$source?.(t)===`env`?void 0:n};return{organizationId:read(`organization-id`),folderId:read(`folder-id`)}}const I=`CONFIG_LOCK_TIMEOUT`,L=fe.randomUUID(),De=C.looseObject({pid:C.number().int(),hostname:C.string(),instanceId:C.string(),nonce:C.string(),createdAt:C.number()}),R=new re,z=/* @__PURE__ */ new Map;async function withConfigLock(e,t,n={}){let r=R.getStore();if(r?.has(e))return await t();let i=z.get(e)??Promise.resolve(),releaseLocal=()=>{},a=new Promise(e=>{releaseLocal=e}),o=i.then(()=>a);z.set(e,o),await i;try{let i=await acquireFileLock(e,n.timeoutMs??15e4);try{return await R.run(/* @__PURE__ */ new Set([...r??[],e]),t)}finally{releaseFileLock(e,i)}}finally{releaseLocal(),z.get(e)===o&&z.delete(e)}}function isConfigLockTimeout(e){return i(e)&&e.code===I}async function acquireFileLock(e,t){ne(S.dirname(e));let n=fe.randomUUID(),r=Date.now(),i=!1,a=10;for(;;){if(tryCreateLock(e,n))return n;if(reclaimIfStale(e))continue;let o=Date.now()-r;if(o>=t)throw lockTimeoutError(e);!i&&o>=3e3&&(i=!0,s.info(`Waiting for another tailor command to release ${e}...`)),await new Promise(e=>setTimeout(e,a*(.5+Math.random()))),a=Math.min(a*2,250)}}function tryCreateLock(e,t){let n;try{n=w.openSync(e,`wx`,384)}catch(e){if(e.code===`EEXIST`)return!1;throw e}let r={pid:process.pid,hostname:pe.hostname(),instanceId:L,nonce:t,createdAt:Date.now()};try{w.writeSync(n,JSON.stringify(r))}catch(t){throw w.closeSync(n),w.rmSync(e,{force:!0}),t}return w.closeSync(n),!0}function readLock(e){let t,n;try{t=w.statSync(e),n=w.readFileSync(e,`utf-8`)}catch(e){if(e.code===`ENOENT`)return;throw e}return{content:n,ino:t.ino,mtimeMs:t.mtimeMs,owner:parseOwner(n)}}function parseOwner(e){try{let t=De.safeParse(JSON.parse(e));return t.success?t.data:void 0}catch{return}}function isStale(e){let{owner:t}=e,n=Date.now();return t?n-t.createdAt>12e4?!0:t.hostname===pe.hostname()?t.pid===process.pid?t.instanceId===L:!isProcessAlive(t.pid):!1:n-e.mtimeMs>1e4}function isProcessAlive(e){try{return process.kill(e,0),!0}catch(e){return e.code===`EPERM`}}function reclaimIfStale(e){let t=readLock(e);if(!t)return!0;if(!isStale(t))return!1;let n=`${e}.reclaim`;if(!tryCreateGuard(n))return!1;try{let n=readLock(e);return n?.ino===t.ino&&n.mtimeMs===t.mtimeMs&&n.content===t.content&&w.rmSync(e,{force:!0}),!0}finally{w.rmSync(n,{force:!0})}}function tryCreateGuard(e){try{return w.closeSync(w.openSync(e,`wx`,384)),!0}catch(e){if(e.code!==`EEXIST`)throw e}try{Date.now()-w.statSync(e).mtimeMs>1e4&&w.rmSync(e,{force:!0})}catch(e){if(e.code!==`ENOENT`)throw e}return!1}function releaseFileLock(e,t){readLock(e)?.owner?.nonce===t&&w.rmSync(e,{force:!0})}function lockTimeoutError(e){return l({code:I,message:`Timed out waiting for another tailor command to release ${e}.`,suggestion:`Wait for the other tailor commands to finish, then retry. If none is running, delete the lock file.`,context:{lockPath:e}})}const B=`tailor-platform-cli`;let V;async function getEntryClass(){if(V!==void 0)return V;try{V=(await import(`@napi-rs/keyring`)).Entry}catch{s.warn(`System keyring is not available. Tokens will be stored in the config file. Set TAILOR_PLATFORM_TOKEN environment variable for CI environments.`),V=!1}return V}async function isKeyringAvailable(){return await getEntryClass()!==!1}async function loadKeyringTokens(e){let t=await getEntryClass();if(!t)throw Error(`System keyring is not available.`);let n=new t(B,e).getPassword();if(n!==null)try{return JSON.parse(n)}catch{return}}async function saveKeyringTokens(e,t){let n=await getEntryClass();if(!n)throw Error(`System keyring is not available.`);new n(B,e).setPassword(JSON.stringify(t))}async function deleteKeyringTokens(e){let t=await getEntryClass();if(t)try{new t(B,e).deletePassword()}catch{}}const H=C.looseObject({user:C.string(),workspace_id:C.string(),readonly:C.boolean().optional(),machine_user:C.string().optional(),machine_user_override:C.enum([`allow`,`deny`]).optional(),platform_url:C.url().optional(),oauth2_client_id:C.string().optional(),console_url:C.url().optional()}),Oe=C.looseObject({access_token:C.string(),refresh_token:C.string().optional(),token_expires_at:C.string()}),U=C.looseObject({storage:C.literal(`keyring`),token_expires_at:C.string()}),W=C.looseObject({storage:C.literal(`file`),token_expires_at:C.string(),access_token:C.string(),refresh_token:C.string().optional()}),ke=C.discriminatedUnion(`storage`,[U,W]),G=C.strictObject({email:C.string().optional()}),K={...G.shape,default_organization_id:C.string().optional(),default_folder_id:C.string().optional()},q=U.extend(K),Ae=W.extend(K),je=C.discriminatedUnion(`storage`,[q,Ae]),Me=C.looseObject({version:C.literal(1),users:C.partialRecord(C.string(),Oe),profiles:C.partialRecord(C.string(),H),current_user:C.string().nullable()}),J=`2.0.0`,Y=C.templateLiteral([C.number().int(),`.`,C.number().int(),`.`,C.number().int()]),Ne=C.looseObject({version:C.literal(2),min_sdk_version:Y,latest_version:C.number().int().optional(),latest_min_sdk_version:Y.optional(),users:C.partialRecord(C.string(),ke),profiles:C.partialRecord(C.string(),H),current_user:C.string().nullable()}),X=C.looseObject({version:C.literal(3),min_sdk_version:Y,latest_version:C.number().int().optional(),latest_min_sdk_version:Y.optional(),users:C.partialRecord(C.string(),je),profiles:C.partialRecord(C.string(),H),current_user:C.string().nullable()});function platformConfigPath(){if(!T)throw Error(`User home directory not found`);return S.join(T,`tailor-platform`,`config.yaml`)}function platformConfigExists(){return T?w.existsSync(platformConfigPath()):!1}function platformConfigFromProfile(e){let t={...e?.platform_url?{platformUrl:e.platform_url}:{},...e?.oauth2_client_id?{oauth2ClientId:e.oauth2_client_id}:{},...e?.console_url?{consoleUrl:e.console_url}:{}};return Object.keys(t).length>0?t:void 0}function platformUserKey(e,t){let n=p(t);return n===f(`https://api.tailor.tech`)?e:`${n}|${e}`}function userFromPlatformUserKey(e,t){let n=`${p(t)}|`;return e.startsWith(n)?e.slice(n.length):e}function canUseLegacyUserKey(e){try{return p()===e}catch{return!1}}function findUserByEmail(e,t,n){let r=p(n),i=`${r}|`,a=r===f(g);return Object.entries(e).find(([e,n])=>n?.email===t?a?!e.includes(`|`):e.startsWith(i):!1)}function findUserEntry(e,t,n,r={}){let i=platformUserKey(t,n),a=e.users[i];if(a)return{userKey:i,userEntry:a};let o=findUserByEmail(e.users,t,n);if(o?.[1])return{userKey:o[0],userEntry:o[1]};let s=p(n);if(i!==t&&(r.allowLegacyUserKey===!1||!canUseLegacyUserKey(s)))return{userKey:i,userEntry:a};let c=e.users[t];return c?{userKey:t,userEntry:c}:{userKey:i,userEntry:a}}function resolveUserTokenKey(e,t,n,r){return findUserEntry(e,t,n,r).userKey}function resolveConfigUser(e,t,n,r){let{userKey:i,userEntry:a}=findUserEntry(e,t,n,r);return a?userFromPlatformUserKey(i,n):void 0}function hasUserTokenEntry(e,t,n,r){return findUserEntry(e,t,n,r).userEntry!==void 0}function hasUserKeyForName(e,t){return e[t]!==void 0||Object.keys(e).some(e=>e.endsWith(`|${t}`))}function hasUserEmailEntry(e,t){return Object.values(e).some(e=>e?.email===t)}function hasAnyUserTokenEntry(e,t){return hasUserKeyForName(e.users,t)||hasUserEmailEntry(e.users,t)}function hasCurrentUserEntry(e,t){return hasUserKeyForName(e,t)}function declaredKeys(...e){return new Set(e.flatMap(e=>Object.keys(e.shape)))}const Z=declaredKeys(Ne),Q=declaredKeys(U,W),Pe=Q.union(declaredKeys(G)),Fe=declaredKeys(H),Ie=Z.difference(declaredKeys(Me)),Le=declaredKeys(X).difference(Z),Re=declaredKeys(q,Ae).difference(Q);function withoutKeys(e,t){return Object.fromEntries(Object.entries(e).filter(([e])=>!t.has(e)))}function migrateV1ToV2(e){let t={};for(let[n,r]of Object.entries(e.users))r&&(t[n]={...withoutKeys(r,Re),storage:`file`});return{...withoutKeys(e,Ie),version:2,min_sdk_version:`1.29.0`,users:t}}function inferEmailFromUserId(e){return C.email().safeParse(e).success?e:void 0}function migrateV2ToV3(e){let t={};for(let[n,r]of Object.entries(e.users)){if(!r)continue;let e=inferEmailFromUserId(n);t[n]={...withoutKeys(r,Re),...e?{email:e}:{}}}return{...withoutKeys(e,Le),version:3,min_sdk_version:J,users:t}}function migrateV1ToV3(e){return migrateV2ToV3(migrateV1ToV2(e))}function formatUnknownError(e){return e instanceof Error?e.message:String(e)}async function trySaveTokensInKeyring(e,t){if(!await isKeyringAvailable())return!1;try{return await saveKeyringTokens(e,t),!0}catch(e){return s.warn(`System keyring failed to store credentials. Tokens will be stored in the config file. ${formatUnknownError(e)}`),!1}}let ze=!1;async function warnIfNewerConfigAvailable(e){if(!e.latest_min_sdk_version||ze)return;let t=(await v()).version??`0.0.0`;de(t,e.latest_min_sdk_version)&&(ze=!0,s.warn(d`
       A newer config version (${String(e.latest_version)}) is available.
       Please update your SDK to >= ${e.latest_min_sdk_version}: pnpm update @tailor-platform/sdk
     `))}async function readPlatformConfig(){let e=platformConfigPath();if(!w.existsSync(e)){let e={version:3,min_sdk_version:J,users:{},profiles:{},current_user:null};return writePlatformConfig(e),e}let t=ce(w.readFileSync(e,`utf-8`));y(e);let n=typeof t==`object`&&t&&`version`in t?t.version:void 0;if(typeof n==`number`&&n>3){let e=`min_sdk_version`in t?String(t.min_sdk_version):void 0,r=e?`Please update your SDK to >= ${e}: pnpm update @tailor-platform/sdk`:`Please update your SDK: pnpm update @tailor-platform/sdk`;throw Error(d`
@@ -10,7 +10,7 @@ import{i as e}from"./resource_pb-elY668ZB.mjs";import{t}from"./assert-WeXvmG4j.m
   `)}function toV1ForDisk(e){let t={};for(let[n,r]of Object.entries(e.users))r&&r.storage!==`keyring`&&(t[n]={access_token:r.access_token,refresh_token:r.refresh_token,token_expires_at:r.token_expires_at});let n=e.current_user&&hasCurrentUserEntry(t,e.current_user)?e.current_user:null;return{version:1,users:t,profiles:e.profiles,current_user:n}}function hasProfilePlatformSettings(e){return Object.values(e.profiles).some(e=>e?.platform_url!==void 0||e?.oauth2_client_id!==void 0||e?.console_url!==void 0)}function hasScopedUserKeys(e){return Object.keys(e.users).some(e=>e.includes(`|`))}function hasKeysOutside(e,t){return e!==void 0&&Object.entries(e).some(([e,n])=>n!==void 0&&!t.has(e))}function hasFieldsUnknownToV2(e){return hasKeysOutside(e,Z)||Object.values(e.users).some(e=>hasKeysOutside(e,Q))||Object.values(e.profiles).some(e=>hasKeysOutside(e,Fe))}function toLatestForDisk(e){return{...e.version===1?migrateV1ToV2(e):e,version:3,min_sdk_version:J}}function writePlatformConfig(e){let t=platformConfigPath(),n=e.version!==1&&Object.values(e.users).some(e=>e?.storage===`keyring`),r=e.version===3||hasProfilePlatformSettings(e)||hasScopedUserKeys(e)||hasFieldsUnknownToV2(e)?toLatestForDisk(e):e.version===2&&!n?toV1ForDisk(e):e;b(t,le(r.version===1?r:{...r,users:withoutKeyringFileTokens(r.users)}))}function withoutKeyringFileTokens(e){return Object.fromEntries(Object.entries(e).map(([e,t])=>{if(t?.storage!==`keyring`)return[e,t];let{access_token:n,refresh_token:r,...i}=t;return[e,i]}))}function validateUUID(e,t){let n=C.uuid().safeParse(e);if(!n.success)throw Error(`Invalid value from ${t}: must be a valid UUID`);return n.data}async function loadWorkspaceId(e){let t=await tryLoadWorkspaceId(e);if(t)return t;throw Error(d`
     Workspace ID not found.
     Please specify workspace ID via --workspace-id option or TAILOR_PLATFORM_WORKSPACE_ID environment variable.
-  `)}async function tryLoadWorkspaceId(e){let t=e?.profile||process.env.TAILOR_PLATFORM_PROFILE;if(e?.workspaceId!==void 0)return validateUUID(e.workspaceId,`--workspace-id option`);if(process.env.TAILOR_PLATFORM_WORKSPACE_ID)return validateUUID(process.env.TAILOR_PLATFORM_WORKSPACE_ID,`TAILOR_PLATFORM_WORKSPACE_ID environment variable`);if(t){let e=(await readPlatformConfig()).profiles[t]?.workspace_id;if(!e)throw o(t);return validateUUID(e,`profile "${t}"`)}}async function loadMachineUserName(e){if(e?.machineUser===``)throw l({code:`MACHINE_USER_NAME_EMPTY`,message:`Machine user name cannot be empty.`,suggestion:`Pass a non-empty machine user name, or omit the option to use the environment variable or profile default.`});let t=process.env.TAILOR_PLATFORM_MACHINE_USER_NAME||void 0,n=e?.machineUser?{source:e.machineUserSource??`option`,value:e.machineUser}:t?{source:`env`,value:t}:void 0,r=n?.value,i=e?.profile||process.env.TAILOR_PLATFORM_PROFILE;if(!i)return r;let a=(await readPlatformConfig()).profiles[i];if(!a){if(r)return r;throw o(i)}if(a.machine_user&&a.machine_user_override===`deny`){if(r&&r!==a.machine_user){let e=n.source===`env`?`The machine user is being set to "${r}" via the TAILOR_PLATFORM_MACHINE_USER_NAME environment variable, which conflicts with this profile's pinned machine user "${a.machine_user}".`:`This profile fixes the machine user to "${a.machine_user}" for application-data commands.`;throw l({code:`PROFILE_MACHINE_USER_OVERRIDE_DENIED`,message:`Profile "${i}" denies overriding the machine user.`,details:e,suggestion:`Omit the machine user option, unset TAILOR_PLATFORM_MACHINE_USER_NAME, or run ${c({command:`tailor`,args:profileUpdateArgs(i,[`--machine-user-override`,`allow`])})}.`})}return a.machine_user}return r||a.machine_user}function readEnvironmentToken(){return process.env.TAILOR_PLATFORM_TOKEN??process.env.TAILOR_TOKEN}async function loadStoredAccessTokenWithoutRefresh(e){let t=e.profile||process.env.TAILOR_PLATFORM_PROFILE,n=await readPlatformConfig(),r=t?n.profiles[t]:void 0;if(t&&!r)return;let i=r?.user??n.current_user;if(!i)return;let a=r?platformConfigFromProfile(r):void 0,o=await readStoredToken(n,i,a,loginFailureFor(t));if(!isDueForRefresh(o))return{accessToken:o.tokens.accessToken,platformConfig:a}}async function loadAccessToken(e){let t=e?.profile||process.env.TAILOR_PLATFORM_PROFILE,n=readEnvironmentToken();if(n&&!process.env.TAILOR_PLATFORM_TOKEN&&s.warn(`TAILOR_TOKEN is deprecated. Please use TAILOR_PLATFORM_TOKEN instead.`),n){s.registerSecret(n);let e=await loadPlatformClientConfig({profile:t,allowMissingProfile:!0});return p(n,e),n}let r=await readPlatformConfig(),i=t?r.profiles[t]:void 0;if(t&&!i)throw o(t);let a=i?.user??r.current_user;if(!a)throw l({code:`AUTH_TOKEN_NOT_FOUND`,message:`Tailor Platform token not found.`,suggestion:`Set TAILOR_PLATFORM_TOKEN or log in using the selected profile.`,next:{command:`tailor`,args:[`login`,...recoveryContextArgs({profile:t})]},context:{profile:t??null}});let c=i?platformConfigFromProfile(i):void 0,u=await resolveLatestToken({config:r,user:a,platformConfig:c,profile:t});return u.refreshable&&m(u.accessToken,createStoredTokenSource({token:u,platformConfig:c,profile:t})),u.accessToken}async function loadAuthStatus(e){let t=e?.profile||process.env.TAILOR_PLATFORM_PROFILE,n=readEnvironmentToken();if(n&&!process.env.TAILOR_PLATFORM_TOKEN&&s.warn(`TAILOR_TOKEN is deprecated. Please use TAILOR_PLATFORM_TOKEN instead.`),n){s.registerSecret(n);let e=await readPlatformConfig().catch(()=>void 0),r=t?e?.profiles[t]:void 0,i=r?platformConfigFromProfile(r):void 0;return{authenticated:!0,identity:null,identitySource:`environment`,profile:t??null,workspaceId:process.env.TAILOR_PLATFORM_WORKSPACE_ID??r?.workspace_id??null,permission:r?.readonly===!0?`read`:`write`,platformUrl:f(i),tokenStatus:`environment`}}let r=await readPlatformConfig(),i=t?r.profiles[t]:void 0;if(t&&!i)throw o(t);let a=i?platformConfigFromProfile(i):void 0,c=f(a),l=process.env.TAILOR_PLATFORM_WORKSPACE_ID??i?.workspace_id??null,u=i?.user??r.current_user,d=i?.user?`profile`:u?`default`:`none`,p=`missing`;if(u){let{userKey:e,userEntry:t}=findUserEntry(r,u,a);if(t){let n=await resolveTokens(t,e,u).catch(()=>void 0);n&&(p=new Date(t.token_expires_at)<=/* @__PURE__ */ new Date?n.refreshToken?`refreshable`:`expired`:`valid`)}}return{authenticated:p===`valid`||p===`refreshable`,identity:u??null,identitySource:d,profile:t??null,workspaceId:l,permission:i?.readonly===!0?`read`:`write`,platformUrl:c,tokenStatus:p}}function resolveSelectedUserEntry(e,t){let n=t?.profile||process.env.TAILOR_PLATFORM_PROFILE,r=n?e.profiles[n]:void 0;if(n&&!r)return;let i=r?.user??e.current_user,a=r?platformConfigFromProfile(r):void 0;return{profile:n,user:i,userEntry:i?findUserEntry(e,i,a,{allowLegacyUserKey:!1}).userEntry:void 0}}async function loadUserWorkspaceDefaults(e){if(readEnvironmentToken())return;let t=resolveSelectedUserEntry(await readPlatformConfig(),e)?.userEntry;if(t?.default_organization_id)return{organizationId:t.default_organization_id,...t.default_folder_id?{folderId:t.default_folder_id}:{}}}async function loadPlatformClientConfig(e){let t=e?.profile||process.env.TAILOR_PLATFORM_PROFILE;if(!t)return;let n;try{n=await readPlatformConfig()}catch(t){if(e?.allowMissingProfile)return;throw t}let r=n.profiles[t];if(!r){if(e?.allowMissingProfile)return;throw o(t)}return platformConfigFromProfile(r)}async function loadConsoleBaseUrl(e){let t=await loadPlatformClientConfig(e);return _(t)}function registerTokenSecrets(e){s.registerSecret(e.accessToken),e.refreshToken&&s.registerSecret(e.refreshToken)}async function resolveTokens(e,t,n=t){if(e.storage===`keyring`){let e;try{e=await loadKeyringTokens(t)}catch(e){throw Error(d`
+  `)}async function tryLoadWorkspaceId(e){let t=e?.profile||process.env.TAILOR_PLATFORM_PROFILE;if(e?.workspaceId!==void 0)return validateUUID(e.workspaceId,`--workspace-id option`);if(process.env.TAILOR_PLATFORM_WORKSPACE_ID)return validateUUID(process.env.TAILOR_PLATFORM_WORKSPACE_ID,`TAILOR_PLATFORM_WORKSPACE_ID environment variable`);if(t){let e=(await readPlatformConfig()).profiles[t]?.workspace_id;if(!e)throw o(t);return validateUUID(e,`profile "${t}"`)}}async function loadMachineUserName(e){if(e?.machineUser===``)throw l({code:`MACHINE_USER_NAME_EMPTY`,message:`Machine user name cannot be empty.`,suggestion:`Pass a non-empty machine user name, or omit the option to use the environment variable or profile default.`});let t=process.env.TAILOR_PLATFORM_MACHINE_USER_NAME||void 0,n=e?.machineUser?{source:e.machineUserSource??`option`,value:e.machineUser}:t?{source:`env`,value:t}:void 0,r=n?.value,i=e?.profile||process.env.TAILOR_PLATFORM_PROFILE;if(!i)return r;let a=(await readPlatformConfig()).profiles[i];if(!a){if(r)return r;throw o(i)}if(a.machine_user&&a.machine_user_override===`deny`){if(r&&r!==a.machine_user){let e=n.source===`env`?`The machine user is being set to "${r}" via the TAILOR_PLATFORM_MACHINE_USER_NAME environment variable, which conflicts with this profile's pinned machine user "${a.machine_user}".`:`This profile fixes the machine user to "${a.machine_user}" for application-data commands.`;throw l({code:`PROFILE_MACHINE_USER_OVERRIDE_DENIED`,message:`Profile "${i}" denies overriding the machine user.`,details:e,suggestion:`Omit the machine user option, unset TAILOR_PLATFORM_MACHINE_USER_NAME, or run ${c({command:`tailor`,args:profileUpdateArgs(i,[`--machine-user-override`,`allow`])})}.`})}return a.machine_user}return r||a.machine_user}function readEnvironmentToken(){return process.env.TAILOR_PLATFORM_TOKEN??process.env.TAILOR_TOKEN}async function loadStoredAccessTokenWithoutRefresh(e){let t=e.profile||process.env.TAILOR_PLATFORM_PROFILE,n=await readPlatformConfig(),r=t?n.profiles[t]:void 0;if(t&&!r)return;let i=r?.user??n.current_user;if(!i)return;let a=r?platformConfigFromProfile(r):void 0,o=await readStoredToken(n,i,a,loginFailureFor(t));if(!isDueForRefresh(o))return{accessToken:o.tokens.accessToken,platformConfig:a}}async function loadAccessToken(e){let t=e?.profile||process.env.TAILOR_PLATFORM_PROFILE,n=readEnvironmentToken();if(n&&!process.env.TAILOR_PLATFORM_TOKEN&&s.warn(`TAILOR_TOKEN is deprecated. Please use TAILOR_PLATFORM_TOKEN instead.`),n){s.registerSecret(n);let e=await loadPlatformClientConfig({profile:t,allowMissingProfile:!0});return h(n,e),n}let r=await readPlatformConfig(),i=t?r.profiles[t]:void 0;if(t&&!i)throw o(t);let a=i?.user??r.current_user;if(!a)throw l({code:`AUTH_TOKEN_NOT_FOUND`,message:`Tailor Platform token not found.`,suggestion:`Set TAILOR_PLATFORM_TOKEN or log in using the selected profile.`,next:{command:`tailor`,args:[`login`,...recoveryContextArgs({profile:t})]},context:{profile:t??null}});let c=i?platformConfigFromProfile(i):void 0,u=await resolveLatestToken({config:r,user:a,platformConfig:c,profile:t});return u.refreshable&&m(u.accessToken,createStoredTokenSource({token:u,platformConfig:c,profile:t})),u.accessToken}async function loadAuthStatus(e){let t=e?.profile||process.env.TAILOR_PLATFORM_PROFILE,n=readEnvironmentToken();if(n&&!process.env.TAILOR_PLATFORM_TOKEN&&s.warn(`TAILOR_TOKEN is deprecated. Please use TAILOR_PLATFORM_TOKEN instead.`),n){s.registerSecret(n);let e=await readPlatformConfig().catch(()=>void 0),r=t?e?.profiles[t]:void 0,i=r?platformConfigFromProfile(r):void 0;return{authenticated:!0,identity:null,identitySource:`environment`,profile:t??null,workspaceId:process.env.TAILOR_PLATFORM_WORKSPACE_ID??r?.workspace_id??null,permission:r?.readonly===!0?`read`:`write`,platformUrl:p(i),tokenStatus:`environment`}}let r=await readPlatformConfig(),i=t?r.profiles[t]:void 0;if(t&&!i)throw o(t);let a=i?platformConfigFromProfile(i):void 0,c=p(a),l=process.env.TAILOR_PLATFORM_WORKSPACE_ID??i?.workspace_id??null,u=i?.user??r.current_user,d=i?.user?`profile`:u?`default`:`none`,f=`missing`;if(u){let{userKey:e,userEntry:t}=findUserEntry(r,u,a);if(t){let n=await resolveTokens(t,e,u).catch(()=>void 0);n&&(f=new Date(t.token_expires_at)<=/* @__PURE__ */ new Date?n.refreshToken?`refreshable`:`expired`:`valid`)}}return{authenticated:f===`valid`||f===`refreshable`,identity:u??null,identitySource:d,profile:t??null,workspaceId:l,permission:i?.readonly===!0?`read`:`write`,platformUrl:c,tokenStatus:f}}function resolveSelectedUserEntry(e,t){let n=t?.profile||process.env.TAILOR_PLATFORM_PROFILE,r=n?e.profiles[n]:void 0;if(n&&!r)return;let i=r?.user??e.current_user,a=r?platformConfigFromProfile(r):void 0;return{profile:n,user:i,userEntry:i?findUserEntry(e,i,a,{allowLegacyUserKey:!1}).userEntry:void 0}}async function loadUserWorkspaceDefaults(e){if(readEnvironmentToken())return;let t=resolveSelectedUserEntry(await readPlatformConfig(),e)?.userEntry;if(t?.default_organization_id)return{organizationId:t.default_organization_id,...t.default_folder_id?{folderId:t.default_folder_id}:{}}}async function loadPlatformClientConfig(e){let t=e?.profile||process.env.TAILOR_PLATFORM_PROFILE;if(!t)return;let n;try{n=await readPlatformConfig()}catch(t){if(e?.allowMissingProfile)return;throw t}let r=n.profiles[t];if(!r){if(e?.allowMissingProfile)return;throw o(t)}return platformConfigFromProfile(r)}async function loadConsoleBaseUrl(e){let t=await loadPlatformClientConfig(e);return _(t)}function registerTokenSecrets(e){s.registerSecret(e.accessToken),e.refreshToken&&s.registerSecret(e.refreshToken)}async function resolveTokens(e,t,n=t){if(e.storage===`keyring`){let e;try{e=await loadKeyringTokens(t)}catch(e){throw Error(d`
           Failed to read credentials from OS keyring for "${n}". ${formatUnknownError(e)}
           Restore access to the OS keyring and try again, or run 'tailor login' in this environment to authenticate again.
           For non-interactive environments, set TAILOR_PLATFORM_TOKEN.
@@ -19,5 +19,5 @@ import{i as e}from"./resource_pb-elY668ZB.mjs";import{t}from"./assert-WeXvmG4j.m
         Credentials may be missing or inaccessible from this environment (for example, due to sandbox restrictions).
         Restore access to the OS keyring and try again, or run 'tailor login' in this environment to authenticate again.
         For non-interactive environments, set TAILOR_PLATFORM_TOKEN.
-      `);return registerTokenSecrets(e),e}let r={accessToken:e.access_token,refreshToken:e.refresh_token};return registerTokenSecrets(r),r}function userExtraFields(e){return e?withoutKeys(e,Pe):{}}async function removeUserAlias(e,t,n,r){let i=e.users[t];if(t===n||!i)return;let a=e.users[n];r.carryExtraFields&&a&&(e.users[n]={...userExtraFields(i),...a}),i.storage===`keyring`&&await deleteKeyringTokens(t),delete e.users[t]}async function saveUserTokens(e,t,n,r,i={}){registerTokenSecrets(n);let a=platformUserKey(t,i.platformConfig),o=e.users[a],s=userExtraFields(o),c=i.email??o?.email;await trySaveTokensInKeyring(a,n)?e.users[a]={...s,token_expires_at:r,storage:`keyring`,...c?{email:c}:{}}:(o?.storage===`keyring`&&await deleteKeyringTokens(a),e.users[a]={...s,access_token:n.accessToken,refresh_token:n.refreshToken,token_expires_at:r,storage:`file`,...c?{email:c}:{}})}async function deleteUserTokens(e,t,n,r){let{userKey:i,userEntry:a}=findUserEntry(e,t,n,r);a?.storage===`keyring`&&await deleteKeyringTokens(i),delete e.users[i]}async function loadStoredUserTokens(e,t,n,r){let{userKey:i,userEntry:a}=findUserEntry(e,t,n,r);if(a)return{userEntry:a,...await resolveTokens(a,i,t)}}function updateUserReferences(e,t,n){if(t!==n){e.current_user===t&&(e.current_user=n);for(let r of Object.values(e.profiles))r?.user===t&&(r.user=n)}}async function removeLegacyUserAlias(e,t,n,r){if(t===n)return;updateUserReferences(e,t,n);let i=platformUserKey(n,r);await removeUserAlias(e,platformUserKey(t,r),i,{carryExtraFields:!0}),await removeUserAlias(e,t,i,{carryExtraFields:canUseLegacyUserKey(f(r))})}function shouldResolveSubjectOnRefresh(e,t){return!!(t.email||inferEmailFromUserId(e))}async function withPlatformConfigLock(e,t){return await withConfigLock(`${platformConfigPath()}.lock`,e,t)}const Be=3e5,Ve=1e4;function expiresWithin(e,t){let n=e-Date.now();return Number.isNaN(n)||n<=t}function isExpired(e,t){return e.tokens.accessToken===t||expiresWithin(Date.parse(e.entry.token_expires_at),Ve)}function isDueForRefresh(e,t){return isExpired(e,t)||!!e.tokens.refreshToken&&expiresWithin(Date.parse(e.entry.token_expires_at),Be)}async function readStoredToken(e,t,n,r){let{userKey:i,userEntry:a}=findUserEntry(e,t,n);if(!a)throw r(`AUTH_USER_NOT_FOUND`,`User "${t}" not found.`,`Verify the selected user and use the original login method (browser or --machine-user) on the same platform.`);return{userKey:i,configUser:userFromPlatformUserKey(i,n),entry:a,tokens:await resolveTokens(a,i,t)}}function useStoredToken(e,t){return p(e.tokens.accessToken,t),{accessToken:e.tokens.accessToken,user:e.configUser,expiresAt:Date.parse(e.entry.token_expires_at),refreshable:!!e.tokens.refreshToken}}function isRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function replaceContents(e,t){for(let n of Object.keys(e))Object.hasOwn(t,n)||delete e[n];for(let[n,r]of Object.entries(t)){let t=e[n];isRecord(t)&&isRecord(r)?replaceContents(t,r):e[n]=r}}async function fetchLatestToken(e,t,n,r){let i=await resolveLatestToken({config:e,user:t,platformConfig:n,profile:r});return{accessToken:i.accessToken,user:i.user}}function loginFailureFor(e){let t=e?[`--profile`,e]:[];return(n,r,i)=>l({code:n,message:r,suggestion:i,next:{command:`tailor`,args:[`login`,...t,`--help`]},context:{profile:e??null}})}function tokenExpiredError(e){return e(`AUTH_TOKEN_EXPIRED`,`Token expired.`,`Use the original login method (browser or --machine-user) to authenticate again on the same platform.`)}async function resolveLatestToken(e){let{config:t,user:n,platformConfig:r,profile:i,rejectedToken:a}=e,o=loginFailureFor(i),c=await readStoredToken(t,n,r,o);if(!isDueForRefresh(c,a))return useStoredToken(c,r);let l=isExpired(c,a);try{return await withPlatformConfigLock(async()=>{let n=await readPlatformConfig();try{return await refreshStoredToken({...e,config:n},o)}finally{replaceContents(t,n)}},l?void 0:{timeoutMs:2e3})}catch(t){if(l||!isConfigLockTimeout(t))throw t;return isExpired(c,a)?await resolveLatestToken(e):(s.debug(`Another tailor command is refreshing the token; using the current token.`),useStoredToken(c,r))}}async function refreshStoredToken(e,n){let{config:r,user:i,platformConfig:a,rejectedToken:o}=e,c=await readStoredToken(r,i,a,n);if(!isDueForRefresh(c,o))return useStoredToken(c,a);let{userKey:l,configUser:u,entry:d,tokens:f}=c;if(!f.refreshToken)throw tokenExpiredError(n);let m=ee(a),h;try{h=await m.refreshToken({accessToken:f.accessToken,refreshToken:f.refreshToken,expiresAt:Date.parse(d.token_expires_at)})}catch(e){if(!isExpired(c,o))return s.debug(`Failed to refresh a token that has not expired yet: ${String(e)}`),useStoredToken(c,a);throw n(`AUTH_TOKEN_REFRESH_FAILED`,`Failed to refresh token. Your session may have expired.`,`Check network connectivity and platform availability, then use the original login method (browser or --machine-user) on the same platform if needed.`)}registerTokenSecrets({accessToken:h.accessToken,refreshToken:h.refreshToken??void 0});let g={accessToken:h.accessToken,refreshToken:h.refreshToken??f.refreshToken},_=new Date(t(h.expiresAt,`token refresh response missing expiresAt`)).toISOString(),v=d.email??inferEmailFromUserId(i)??inferEmailFromUserId(u);await saveUserTokens(r,u,g,_,{platformConfig:a,email:v}),writePlatformConfig(r);let y=u,b=v;if(shouldResolveSubjectOnRefresh(i,d)||shouldResolveSubjectOnRefresh(u,d))try{let e=await te(h.accessToken,a);y=e.sub,b=e.email}catch(e){s.debug(`Failed to resolve refreshed token user info: ${String(e)}`)}return(y!==u||b!==v)&&await saveUserTokens(r,y,g,_,{platformConfig:a,email:b}),await removeLegacyUserAlias(r,i,y,a),await removeUserAlias(r,l,platformUserKey(y,a),{carryExtraFields:!0}),v&&b&&v!==b&&s.info(`Updated local user email from "${v}" to "${b}".`),writePlatformConfig(r),p(h.accessToken,a),{accessToken:h.accessToken,user:y,expiresAt:Date.parse(_),refreshable:!0}}const $=3e4;function createStoredTokenSource(e){let{accessToken:t,expiresAt:n,user:r}=e.token,i,a,o=0,c=-1/0,l=-1/0,u,isUsable=()=>!expiresWithin(n,Ve),isDue=()=>expiresWithin(n,Be)&&(!isUsable()||Date.now()>=o),renew=l=>i??=(async()=>{try{let i=await resolveLatestToken({config:await readPlatformConfig(),user:r,platformConfig:e.platformConfig,profile:e.profile,rejectedToken:l});a=void 0;let s=l!==void 0&&i.accessToken!==l;i.expiresAt>n||s?({accessToken:t,expiresAt:n,user:r}=i,c=Date.now(),m(t,d)):o=Date.now()+$}catch(e){a=e instanceof Error?e:Error(String(e)),o=Date.now()+$,s.debug(`Failed to renew the access token: ${String(e)}`)}finally{i=void 0}})(),d={async current(){if(i&&t===u&&await i,!isDue()||i&&isUsable())return t;if(await renew(),!isUsable())throw a??tokenExpiredError(loginFailureFor(e.profile));return t},async replaceRejected(e){if(t!==e)return t;for(u=e;i;)await i;if(t!==e)return t;if(!(Date.now()-Math.max(c,l)<6e4))return l=Date.now(),await renew(e),t===e?void 0:t}};return d}function loadConfigPath(e){return e||(process.env.TAILOR_CONFIG_PATH?process.env.TAILOR_CONFIG_PATH:ue(`tailor.config.ts`))}export{profileUpdateArgs as $,Ce as A,globalArgsApplied as B,resolveTokens as C,withPlatformConfigLock as D,tryLoadWorkspaceId as E,xe as F,be as G,loadEnvFiles as H,he as I,we as J,D as K,flagTokensOf as L,F as M,Se as N,writePlatformConfig as O,createCommonArgs as P,ge as Q,Ee as R,resolveSelectedUserEntry as S,saveUserTokens as T,loadEnvFilesFromArgv as U,jsonFlagRequested as V,locationIds as W,paginationArgs as X,Te as Y,parseDuration as Z,readEnvironmentToken as _,loadAccessToken as a,resolveMachineUserInputSource as at,removeLegacyUserAlias as b,loadConsoleBaseUrl as c,loadStoredAccessTokenWithoutRefresh as d,readDeployConfigPathEnv as et,loadStoredUserTokens as f,platformConfigFromProfile as g,platformConfigExists as h,hasUserTokenEntry as i,resolveEarlyFailure as it,M as j,P as k,loadMachineUserName as l,loadWorkspaceId as m,fetchLatestToken as n,recoveryContextArgs as nt,loadAuthStatus as o,toPageDirection as ot,loadUserWorkspaceDefaults as p,O as q,hasAnyUserTokenEntry as r,requestedJsonModeSource as rt,loadConfigPath as s,N as st,deleteUserTokens as t,readEnvFileArgs as tt,loadPlatformClientConfig as u,readPlatformConfig as v,resolveUserTokenKey as w,resolveConfigUser as x,registerTokenSecrets as y,formatConfigArg as z};
-//# sourceMappingURL=context-DSi5kfqr.mjs.map
+      `);return registerTokenSecrets(e),e}let r={accessToken:e.access_token,refreshToken:e.refresh_token};return registerTokenSecrets(r),r}function userExtraFields(e){return e?withoutKeys(e,Pe):{}}async function removeUserAlias(e,t,n,r){let i=e.users[t];if(t===n||!i)return;let a=e.users[n];r.carryExtraFields&&a&&(e.users[n]={...userExtraFields(i),...a}),i.storage===`keyring`&&await deleteKeyringTokens(t),delete e.users[t]}async function saveUserTokens(e,t,n,r,i={}){registerTokenSecrets(n);let a=platformUserKey(t,i.platformConfig),o=e.users[a],s=userExtraFields(o),c=i.email??o?.email;await trySaveTokensInKeyring(a,n)?e.users[a]={...s,token_expires_at:r,storage:`keyring`,...c?{email:c}:{}}:(o?.storage===`keyring`&&await deleteKeyringTokens(a),e.users[a]={...s,access_token:n.accessToken,refresh_token:n.refreshToken,token_expires_at:r,storage:`file`,...c?{email:c}:{}})}async function deleteUserTokens(e,t,n,r){let{userKey:i,userEntry:a}=findUserEntry(e,t,n,r);a?.storage===`keyring`&&await deleteKeyringTokens(i),delete e.users[i]}async function loadStoredUserTokens(e,t,n,r){let{userKey:i,userEntry:a}=findUserEntry(e,t,n,r);if(a)return{userEntry:a,...await resolveTokens(a,i,t)}}function updateUserReferences(e,t,n){if(t!==n){e.current_user===t&&(e.current_user=n);for(let r of Object.values(e.profiles))r?.user===t&&(r.user=n)}}async function removeLegacyUserAlias(e,t,n,r){if(t===n)return;updateUserReferences(e,t,n);let i=platformUserKey(n,r);await removeUserAlias(e,platformUserKey(t,r),i,{carryExtraFields:!0}),await removeUserAlias(e,t,i,{carryExtraFields:canUseLegacyUserKey(p(r))})}function shouldResolveSubjectOnRefresh(e,t){return!!(t.email||inferEmailFromUserId(e))}async function withPlatformConfigLock(e,t){return await withConfigLock(`${platformConfigPath()}.lock`,e,t)}const Be=3e5,Ve=1e4;function expiresWithin(e,t){let n=e-Date.now();return Number.isNaN(n)||n<=t}function isExpired(e,t){return e.tokens.accessToken===t||expiresWithin(Date.parse(e.entry.token_expires_at),Ve)}function isDueForRefresh(e,t){return isExpired(e,t)||!!e.tokens.refreshToken&&expiresWithin(Date.parse(e.entry.token_expires_at),Be)}async function readStoredToken(e,t,n,r){let{userKey:i,userEntry:a}=findUserEntry(e,t,n);if(!a)throw r(`AUTH_USER_NOT_FOUND`,`User "${t}" not found.`,`Verify the selected user and use the original login method (browser or --machine-user) on the same platform.`);return{userKey:i,configUser:userFromPlatformUserKey(i,n),entry:a,tokens:await resolveTokens(a,i,t)}}function useStoredToken(e,t){return h(e.tokens.accessToken,t),{accessToken:e.tokens.accessToken,user:e.configUser,expiresAt:Date.parse(e.entry.token_expires_at),refreshable:!!e.tokens.refreshToken}}function isRecord(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function replaceContents(e,t){for(let n of Object.keys(e))Object.hasOwn(t,n)||delete e[n];for(let[n,r]of Object.entries(t)){let t=e[n];isRecord(t)&&isRecord(r)?replaceContents(t,r):e[n]=r}}async function fetchLatestToken(e,t,n,r){let i=await resolveLatestToken({config:e,user:t,platformConfig:n,profile:r});return{accessToken:i.accessToken,user:i.user}}function loginFailureFor(e){let t=e?[`--profile`,e]:[];return(n,r,i)=>l({code:n,message:r,suggestion:i,next:{command:`tailor`,args:[`login`,...t,`--help`]},context:{profile:e??null}})}function tokenExpiredError(e){return e(`AUTH_TOKEN_EXPIRED`,`Token expired.`,`Use the original login method (browser or --machine-user) to authenticate again on the same platform.`)}async function resolveLatestToken(e){let{config:t,user:n,platformConfig:r,profile:i,rejectedToken:a}=e,o=loginFailureFor(i),c=await readStoredToken(t,n,r,o);if(!isDueForRefresh(c,a))return useStoredToken(c,r);let l=isExpired(c,a);try{return await withPlatformConfigLock(async()=>{let n=await readPlatformConfig();try{return await refreshStoredToken({...e,config:n},o)}finally{replaceContents(t,n)}},l?void 0:{timeoutMs:2e3})}catch(t){if(l||!isConfigLockTimeout(t))throw t;return isExpired(c,a)?await resolveLatestToken(e):(s.debug(`Another tailor command is refreshing the token; using the current token.`),useStoredToken(c,r))}}async function refreshStoredToken(e,n){let{config:r,user:i,platformConfig:a,rejectedToken:o}=e,c=await readStoredToken(r,i,a,n);if(!isDueForRefresh(c,o))return useStoredToken(c,a);let{userKey:l,configUser:u,entry:d,tokens:f}=c;if(!f.refreshToken)throw tokenExpiredError(n);let p=ee(a),m;try{m=await p.refreshToken({accessToken:f.accessToken,refreshToken:f.refreshToken,expiresAt:Date.parse(d.token_expires_at)})}catch(e){if(!isExpired(c,o))return s.debug(`Failed to refresh a token that has not expired yet: ${String(e)}`),useStoredToken(c,a);throw n(`AUTH_TOKEN_REFRESH_FAILED`,`Failed to refresh token. Your session may have expired.`,`Check network connectivity and platform availability, then use the original login method (browser or --machine-user) on the same platform if needed.`)}registerTokenSecrets({accessToken:m.accessToken,refreshToken:m.refreshToken??void 0});let g={accessToken:m.accessToken,refreshToken:m.refreshToken??f.refreshToken},_=new Date(t(m.expiresAt,`token refresh response missing expiresAt`)).toISOString(),v=d.email??inferEmailFromUserId(i)??inferEmailFromUserId(u);await saveUserTokens(r,u,g,_,{platformConfig:a,email:v}),writePlatformConfig(r);let y=u,b=v;if(shouldResolveSubjectOnRefresh(i,d)||shouldResolveSubjectOnRefresh(u,d))try{let e=await te(m.accessToken,a);y=e.sub,b=e.email}catch(e){s.debug(`Failed to resolve refreshed token user info: ${String(e)}`)}return(y!==u||b!==v)&&await saveUserTokens(r,y,g,_,{platformConfig:a,email:b}),await removeLegacyUserAlias(r,i,y,a),await removeUserAlias(r,l,platformUserKey(y,a),{carryExtraFields:!0}),v&&b&&v!==b&&s.info(`Updated local user email from "${v}" to "${b}".`),writePlatformConfig(r),h(m.accessToken,a),{accessToken:m.accessToken,user:y,expiresAt:Date.parse(_),refreshable:!0}}const $=3e4;function createStoredTokenSource(e){let{accessToken:t,expiresAt:n,user:r}=e.token,i,a,o=0,c=-1/0,l=-1/0,u,isUsable=()=>!expiresWithin(n,Ve),isDue=()=>expiresWithin(n,Be)&&(!isUsable()||Date.now()>=o),renew=l=>i??=(async()=>{try{let i=await resolveLatestToken({config:await readPlatformConfig(),user:r,platformConfig:e.platformConfig,profile:e.profile,rejectedToken:l});a=void 0;let s=l!==void 0&&i.accessToken!==l;i.expiresAt>n||s?({accessToken:t,expiresAt:n,user:r}=i,c=Date.now(),m(t,d)):o=Date.now()+$}catch(e){a=e instanceof Error?e:Error(String(e)),o=Date.now()+$,s.debug(`Failed to renew the access token: ${String(e)}`)}finally{i=void 0}})(),d={async current(){if(i&&t===u&&await i,!isDue()||i&&isUsable())return t;if(await renew(),!isUsable())throw a??tokenExpiredError(loginFailureFor(e.profile));return t},async replaceRejected(e){if(t!==e)return t;for(u=e;i;)await i;if(t!==e)return t;if(!(Date.now()-Math.max(c,l)<6e4))return l=Date.now(),await renew(e),t===e?void 0:t}};return d}function loadConfigPath(e){return e||(process.env.TAILOR_CONFIG_PATH?process.env.TAILOR_CONFIG_PATH:ue(`tailor.config.ts`))}export{profileUpdateArgs as $,Ce as A,globalArgsApplied as B,resolveTokens as C,withPlatformConfigLock as D,tryLoadWorkspaceId as E,xe as F,be as G,loadEnvFiles as H,he as I,we as J,D as K,flagTokensOf as L,F as M,Se as N,writePlatformConfig as O,createCommonArgs as P,ge as Q,Ee as R,resolveSelectedUserEntry as S,saveUserTokens as T,loadEnvFilesFromArgv as U,jsonFlagRequested as V,locationIds as W,paginationArgs as X,Te as Y,parseDuration as Z,readEnvironmentToken as _,loadAccessToken as a,resolveMachineUserInputSource as at,removeLegacyUserAlias as b,loadConsoleBaseUrl as c,loadStoredAccessTokenWithoutRefresh as d,readDeployConfigPathEnv as et,loadStoredUserTokens as f,platformConfigFromProfile as g,platformConfigExists as h,hasUserTokenEntry as i,resolveEarlyFailure as it,M as j,P as k,loadMachineUserName as l,loadWorkspaceId as m,fetchLatestToken as n,recoveryContextArgs as nt,loadAuthStatus as o,toPageDirection as ot,loadUserWorkspaceDefaults as p,O as q,hasAnyUserTokenEntry as r,requestedJsonModeSource as rt,loadConfigPath as s,N as st,deleteUserTokens as t,readEnvFileArgs as tt,loadPlatformClientConfig as u,readPlatformConfig as v,resolveUserTokenKey as w,resolveConfigUser as x,registerTokenSecrets as y,formatConfigArg as z};
+//# sourceMappingURL=context-aAgFGDBD.mjs.map