@tenderprompt/accounts 0.8.3 → 0.9.0

package/dist/main.js

@@ -1,2131 +0,0 @@
-import { fileURLToPath } from "node:url";
-import { createRequire } from "node:module";
-import { copyFile, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rm } from "node:fs/promises";
-import { basename, dirname, join, relative, resolve, sep } from "node:path";
-import { homedir, hostname, tmpdir } from "node:os";
-import { createHash } from "node:crypto";
-import { AgentApiClient } from "./api.js";
-import { CLI_AUTH_SCHEMA, DEFAULT_AUTH_PROFILE, createDefaultAuthStore, validateAuthProfile, validateNamedAuthProfile, } from "./auth-store.js";
-import { labelLocalArtifact, verifyArtifact } from "./artifact.js";
-import { BUILD_ENVELOPE_FILENAME, CLI_CONFIG_SCHEMA, CLI_LINK_SCHEMA, } from "./contracts.js";
-import { CliApiError, CliError } from "./errors.js";
-import { loadProjectContext, normalizeApiUrl, pathExists, readBoundedFile, readOptionalToken, requiredProjectId, resolveArtifactDirectory, safeArtifactPath, writeProjectLink, } from "./files.js";
-import { OAuthApiClient, createPkcePair, openSystemBrowser, waitForLoopbackAuthorization, } from "./oauth.js";
-import { captureCommand, runProjectCommand } from "./processes.js";
-import { createDefaultProfileBindings, } from "./profile-bindings.js";
-import { initializeStarter } from "./starter.js";
-const packageMetadata = createRequire(import.meta.url)("../package.json");
-if (typeof packageMetadata.version !== "string" || packageMetadata.version.length === 0) {
-    throw new Error("Tender Accounts CLI package version is missing.");
-}
-export const CLI_VERSION = packageMetadata.version;
-const DEFAULT_RUNTIME = {
-    cwd: process.cwd(),
-    homeDirectory: homedir(),
-    environment: process.env,
-    stdin: process.stdin,
-    stdout: process.stdout,
-    stderr: process.stderr,
-    fetcher: fetch,
-    sleep: async (milliseconds) => await new Promise((resolvePromise) => setTimeout(resolvePromise, milliseconds)),
-    runProjectCommand,
-    captureCommand,
-    authStore: createDefaultAuthStore(process.env),
-    profileBindings: createDefaultProfileBindings(process.env),
-    openBrowser: openSystemBrowser,
-    waitForLoopbackAuthorization,
-    openLogStream: (url, protocols) => new WebSocket(url, protocols),
-    onInterrupt: (handler) => {
-        process.once("SIGINT", handler);
-        process.once("SIGTERM", handler);
-        return () => {
-            process.off("SIGINT", handler);
-            process.off("SIGTERM", handler);
-        };
-    },
-};
-export async function runCli(argv, overrides = {}) {
-    const runtime = { ...DEFAULT_RUNTIME, ...overrides };
-    const jsonRequested = argv.includes("--json");
-    try {
-        const { topic, values } = commandTopic(argv);
-        if (topic === "help") {
-            runtime.stdout.write(`${helpText(values[0])}\n`);
-            return 0;
-        }
-        if (topic === "version") {
-            runtime.stdout.write(`${CLI_VERSION}\n`);
-            return 0;
-        }
-        const options = parseOptions(values);
-        assertAllowedOptions(topic, options);
-        const cwd = resolve(runtime.cwd, options.flags.get("cwd") ?? ".");
-        const result = await execute(topic, options, cwd, runtime);
-        if (result.raw !== undefined)
-            runtime.stdout.write(result.raw.endsWith("\n") ? result.raw : `${result.raw}\n`);
-        else if (result.value !== undefined)
-            writeOutput(result.value, options, runtime);
-        return result.exitCode ?? 0;
-    }
-    catch (error) {
-        const normalized = normalizeError(error);
-        if (jsonRequested) {
-            runtime.stderr.write(`${JSON.stringify({ error: normalized })}\n`);
-        }
-        else {
-            runtime.stderr.write(`Error: ${normalized.message}\n`);
-            if (normalized.hint)
-                runtime.stderr.write(`Try: ${normalized.hint}\n`);
-            if (normalized.requestId)
-                runtime.stderr.write(`request_id: ${normalized.requestId}\n`);
-        }
-        return 1;
-    }
-}
-async function execute(topic, options, cwd, runtime) {
-    switch (topic) {
-        case "init":
-            return { value: await initializeStarter({
-                    cwd,
-                    directory: options.flags.get("directory"),
-                    name: requiredStarterName(options),
-                    slug: options.flags.get("slug"),
-                    template: options.flags.get("template"),
-                    dryRun: options.booleans.has("dry-run"),
-                }) };
-        case "config example":
-            return { value: exampleConfig() };
-        case "skill print":
-            return options.json
-                ? { value: { schema: "tender.accounts-skill/v1", content: await readSkill() } }
-                : { raw: await readSkill() };
-        case "skill install":
-            return { value: await installSkill(cwd, options, runtime) };
-        case "dev":
-            return await runDev(cwd, options, runtime);
-        case "check":
-            return { value: await runBuildStage(cwd, options, runtime, "check") };
-        case "build":
-            return { value: await buildProject(cwd, options, runtime) };
-        case "auth status":
-            return { value: await authStatus(cwd, options, runtime) };
-        case "auth list":
-            return { value: await authList(runtime) };
-        case "auth create":
-            return { value: await authCreate(cwd, options, runtime) };
-        case "auth delete":
-            return { value: await authDelete(cwd, options, runtime) };
-        case "auth activate":
-            return { value: await authActivate(cwd, options, runtime) };
-        case "auth deactivate":
-            return { value: await authDeactivate(cwd, options, runtime) };
-        case "auth login":
-            return { value: await authLogin(cwd, options, runtime) };
-        case "auth logout":
-            return { value: await authLogout(cwd, options, runtime) };
-        case "link":
-            return { value: await linkProject(cwd, options, runtime) };
-        case "doctor":
-            return await doctor(cwd, options, runtime);
-        case "preview":
-            return { value: await preview(cwd, options, runtime) };
-        case "source status":
-            return { value: await sourceStatus(cwd, options, runtime) };
-        case "source branches":
-            return { value: await sourceBranches(cwd, options, runtime) };
-        case "source log":
-            return { value: await sourceLog(cwd, options, runtime) };
-        case "source compare":
-            return { value: await sourceCompare(cwd, options, runtime) };
-        case "source default set":
-            return { value: await sourceDefaultSet(cwd, options, runtime) };
-        case "source promote":
-            return { value: await sourcePromote(cwd, options, runtime) };
-        case "source history replace":
-            return { value: await sourceHistoryReplace(cwd, options, runtime) };
-        case "source operation status":
-            return { value: await sourceOperationStatus(cwd, options, runtime) };
-        case "source operation retry":
-            return { value: await sourceOperationRetry(cwd, options, runtime) };
-        case "source change create":
-            return { value: await sourceChangeCreate(cwd, options, runtime) };
-        case "source change list":
-            return { value: await sourceChangeList(cwd, options, runtime) };
-        case "source change show":
-            return { value: await sourceChangeShow(cwd, options, runtime) };
-        case "source change close":
-            return { value: await sourceChangeClose(cwd, options, runtime) };
-        case "source connect":
-            return { value: await sourceConnect(cwd, options, runtime) };
-        case "source pull":
-            return { value: await sourcePull(cwd, options, runtime) };
-        case "source token":
-            return { value: await sourceToken(cwd, options, runtime) };
-        case "source push":
-            return { value: await sourcePush(cwd, options, runtime) };
-        case "tail":
-            await tail(cwd, options, runtime);
-            return {};
-        case "delivery status":
-            return { value: await deliveryStatus(cwd, options, runtime) };
-        case "delivery preview":
-            return { value: await deliveryPreview(cwd, options, runtime) };
-        case "delivery retry":
-            return { value: await deliveryRetry(cwd, options, runtime) };
-        default:
-            throw new CliError("command_unknown", `Unknown command: ${topic}.`, "tender-accounts --help");
-    }
-}
-async function sourceStatus(cwd, options, runtime) {
-    const context = await optionalContext(cwd);
-    const { client, projectId } = await sourceProjectAccess(cwd, context?.link ?? null, options, runtime, false);
-    const result = await client.sourceRepository(projectId);
-    return {
-        status: result.repository ? "connected" : "not_connected",
-        projectId,
-        repository: result.repository ? publicManagedSourceRepository(result.repository) : null,
-    };
-}
-function publicManagedSourceRepository(repository) {
-    const { namespace: _providerNamespace, remoteUrl: _providerRemoteUrl, ...publicRepository } = repository;
-    return {
-        ...publicRepository,
-        transport: "tender-managed",
-    };
-}
-async function sourceBranches(cwd, options, runtime) {
-    const access = await sourceReadAccess(cwd, options, runtime);
-    let credential = null;
-    try {
-        const token = await access.client.sourceToken(access.repository.id, 15 * 60, "read");
-        credential = token.token;
-        const result = await runtime.captureCommand("git", ["ls-remote", "--heads", access.repository.remoteUrl], cwd, managedGitEnvironment(runtime.environment, credential, managedGitCredentialHeaderKey(access.repository.remoteUrl)));
-        const branches = parseManagedSourceRefs(result.stdout).map(({ ref, sha }) => ({
-            name: ref.slice("refs/heads/".length),
-            sha,
-            default: ref === `refs/heads/${access.repository.defaultBranch}`,
-            providerDefault: access.repository.providerDefaultBranch !== null
-                && ref === `refs/heads/${access.repository.providerDefaultBranch}`,
-        }));
-        return {
-            status: "ready",
-            projectId: access.projectId,
-            repositoryId: access.repository.id,
-            defaultBranch: access.repository.defaultBranch,
-            providerDefaultBranch: access.repository.providerDefaultBranch,
-            branches,
-            credentialPersisted: false,
-        };
-    }
-    finally {
-        credential = null;
-    }
-}
-async function sourceLog(cwd, options, runtime) {
-    const access = await sourceReadAccess(cwd, options, runtime);
-    const branch = options.flags.get("branch") ?? access.repository.defaultBranch;
-    assertGitBranchName(branch);
-    const limit = numberFlag(options, "limit", 1, 100, 20);
-    return withManagedSourceMirror(cwd, access.repository, access.client, runtime, async (mirror) => {
-        const refs = await managedSourceMirrorRefs(mirror, runtime);
-        if (!refs.has(`refs/heads/${branch}`)) {
-            throw new CliError("source_branch_missing", `Managed source branch ${branch} does not exist.`);
-        }
-        await runtime.captureCommand("git", ["fetch", "--no-tags", "origin", `refs/heads/${branch}:refs/remotes/origin/${branch}`], mirror.path, mirror.environment);
-        const result = await runtime.captureCommand("git", ["log", `--max-count=${limit}`, "--format=%H%x09%P%x09%aI%x09%an%x09%s", `refs/remotes/origin/${branch}`], mirror.path, managedGitCheckoutEnvironment(runtime.environment));
-        return {
-            status: "ready",
-            projectId: access.projectId,
-            repositoryId: access.repository.id,
-            branch,
-            commits: result.stdout.split(/\r?\n/u).filter(Boolean).map(parseManagedSourceCommit),
-            credentialPersisted: false,
-        };
-    });
-}
-async function sourceCompare(cwd, options, runtime) {
-    const access = await sourceReadAccess(cwd, options, runtime);
-    const base = requiredFlag(options, "base");
-    const head = requiredFlag(options, "head");
-    assertGitBranchName(base);
-    assertGitBranchName(head);
-    return withManagedSourceMirror(cwd, access.repository, access.client, runtime, async (mirror) => {
-        const refs = await managedSourceMirrorRefs(mirror, runtime);
-        const missing = [base, head].filter((branch) => !refs.has(`refs/heads/${branch}`));
-        if (missing.length > 0) {
-            throw new CliError("source_branch_missing", `Managed source branch ${missing.join(", ")} does not exist.`);
-        }
-        await runtime.captureCommand("git", [
-            "fetch", "--no-tags", "origin",
-            `refs/heads/${base}:refs/remotes/origin/${base}`,
-            `refs/heads/${head}:refs/remotes/origin/${head}`,
-        ], mirror.path, mirror.environment);
-        const checkoutEnv = managedGitCheckoutEnvironment(runtime.environment);
-        const baseSha = (await runtime.captureCommand("git", ["rev-parse", `refs/remotes/origin/${base}`], mirror.path, checkoutEnv)).stdout;
-        const headSha = (await runtime.captureCommand("git", ["rev-parse", `refs/remotes/origin/${head}`], mirror.path, checkoutEnv)).stdout;
-        let mergeBase = null;
-        try {
-            mergeBase = (await runtime.captureCommand("git", ["merge-base", baseSha, headSha], mirror.path, checkoutEnv)).stdout || null;
-        }
-        catch {
-            mergeBase = null;
-        }
-        const counts = (await runtime.captureCommand("git", ["rev-list", "--left-right", "--count", `${baseSha}...${headSha}`], mirror.path, checkoutEnv)).stdout.split(/\s+/u).map(Number);
-        const changedFiles = (await runtime.captureCommand("git", ["diff", "--name-status", "--no-renames", baseSha, headSha], mirror.path, checkoutEnv)).stdout.split(/\r?\n/u).filter(Boolean);
-        const files = changedFiles.slice(0, 500).map((line) => {
-            const [status, ...path] = line.split("\t");
-            return { status, path: path.join("\t") };
-        });
-        const relationship = baseSha === headSha
-            ? "identical"
-            : mergeBase === baseSha
-                ? "fast_forward"
-                : mergeBase === headSha
-                    ? "behind"
-                    : mergeBase === null
-                        ? "unrelated"
-                        : "diverged";
-        return {
-            status: "ready",
-            projectId: access.projectId,
-            repositoryId: access.repository.id,
-            base: { branch: base, sha: baseSha, commitsOnlyHere: counts[0] ?? 0 },
-            head: { branch: head, sha: headSha, commitsOnlyHere: counts[1] ?? 0 },
-            mergeBase,
-            relationship,
-            files,
-            filesTruncated: changedFiles.length > files.length,
-            credentialPersisted: false,
-        };
-    });
-}
-async function sourceDefaultSet(cwd, options, runtime) {
-    const targetBranch = requiredFlag(options, "branch");
-    const expectedDefaultBranch = requiredFlag(options, "expected-current");
-    assertGitBranchName(targetBranch);
-    assertGitBranchName(expectedDefaultBranch);
-    return requestAndWaitForSourceOperation(cwd, options, runtime, {
-        kind: "set_default",
-        targetBranch,
-        expectedDefaultBranch,
-    });
-}
-async function sourcePromote(cwd, options, runtime) {
-    const headBranch = requiredFlag(options, "head");
-    const expectedCurrentSha = requiredSourceSha(options, "expected-current");
-    assertGitBranchName(headBranch);
-    const access = await sourceReadAccess(cwd, options, runtime);
-    const targetBranch = options.flags.get("base") ?? access.repository.defaultBranch;
-    assertGitBranchName(targetBranch);
-    return requestAndWaitForSourceOperation(cwd, options, runtime, {
-        kind: "promote",
-        targetBranch,
-        headBranch,
-        expectedCurrentSha,
-    }, access);
-}
-async function sourceHistoryReplace(cwd, options, runtime) {
-    const access = await sourceReadAccess(cwd, options, runtime);
-    const confirmation = requiredFlag(options, "confirm");
-    if (confirmation !== access.repository.id) {
-        throw new CliError("source_history_confirmation_required", "History replacement requires --confirm with the exact managed repository ID.", `tender-accounts source history replace --head ${requiredFlag(options, "head")} --expected-current <sha> --confirm ${access.repository.id} --dry-run --json`);
-    }
-    const headBranch = requiredFlag(options, "head");
-    const targetBranch = options.flags.get("target") ?? access.repository.defaultBranch;
-    const expectedCurrentSha = requiredSourceSha(options, "expected-current");
-    assertGitBranchName(headBranch);
-    assertGitBranchName(targetBranch);
-    return requestAndWaitForSourceOperation(cwd, options, runtime, {
-        kind: "history_replace",
-        targetBranch,
-        headBranch,
-        expectedCurrentSha,
-    }, access);
-}
-async function sourceOperationStatus(cwd, options, runtime) {
-    const context = await optionalContext(cwd);
-    const { client } = await authenticatedClient(cwd, context?.link ?? null, options, runtime);
-    return (await client.sourceOperation(requiredSourceOperationId(requiredFlag(options, "operation")))).operation;
-}
-async function sourceOperationRetry(cwd, options, runtime) {
-    const context = await optionalContext(cwd);
-    const { client } = await authenticatedClient(cwd, context?.link ?? null, options, runtime);
-    const requested = await client.retrySourceOperation(requiredSourceOperationId(requiredFlag(options, "operation")));
-    if (options.booleans.has("no-wait"))
-        return requested.operation;
-    return await waitForSourceOperation(client, requested.operation, options, runtime);
-}
-async function requestAndWaitForSourceOperation(cwd, options, runtime, input, resolvedAccess) {
-    const access = resolvedAccess ?? await sourceReadAccess(cwd, options, runtime);
-    const idempotencyKey = options.flags.get("idempotency-key")
-        ?? `cli-${input.kind}-${crypto.randomUUID()}`;
-    const requested = await access.client.createSourceOperation(access.repository.id, {
-        ...input,
-        idempotencyKey,
-        dryRun: options.booleans.has("dry-run"),
-    });
-    if (options.booleans.has("no-wait"))
-        return requested.operation;
-    return await waitForSourceOperation(access.client, requested.operation, options, runtime);
-}
-async function waitForSourceOperation(client, initial, options, runtime) {
-    const timeoutSeconds = numberFlag(options, "timeout-seconds", 10, 15 * 60, 10 * 60);
-    const deadline = Date.now() + timeoutSeconds * 1000;
-    let operation = initial;
-    while (operation.status === "requested" || operation.status === "running") {
-        if (Date.now() >= deadline) {
-            throw new CliError("source_operation_timeout", `Source operation ${operation.id} is still ${operation.status}.`, `tender-accounts source operation status --operation ${operation.id} --json`);
-        }
-        await runtime.sleep(2_000);
-        operation = (await client.sourceOperation(operation.id)).operation;
-    }
-    if (operation.status === "failed") {
-        throw new CliError(operation.error?.code ?? "source_operation_failed", operation.error?.message ?? "The managed source operation failed.", `tender-accounts source operation retry --operation ${operation.id} --json`);
-    }
-    return operation;
-}
-async function sourceReadAccess(cwd, options, runtime) {
-    const context = await optionalContext(cwd);
-    const access = await sourceProjectAccess(cwd, context?.link ?? null, options, runtime, false);
-    const source = await access.client.sourceRepository(access.projectId);
-    if (!source.repository) {
-        throw new CliError("source_repository_missing", "This project does not have a Tender-managed Git repository.");
-    }
-    if (source.repository.status !== "active") {
-        throw new CliError("source_repository_paused", "This Tender-managed repository is paused.");
-    }
-    return { ...access, repository: source.repository };
-}
-async function withManagedSourceMirror(cwd, repository, client, runtime, callback) {
-    const mirrorPath = await mkdtemp(join(tmpdir(), "tender-accounts-source-read-"));
-    let credential = null;
-    try {
-        await runtime.captureCommand("git", ["init", "--bare", mirrorPath], cwd, managedGitCheckoutEnvironment(runtime.environment));
-        await runtime.captureCommand("git", ["remote", "add", "origin", repository.remoteUrl], mirrorPath, managedGitCheckoutEnvironment(runtime.environment));
-        const token = await client.sourceToken(repository.id, 15 * 60, "read");
-        credential = token.token;
-        return await callback({
-            path: mirrorPath,
-            environment: managedGitEnvironment(runtime.environment, credential, managedGitCredentialHeaderKey(repository.remoteUrl)),
-        });
-    }
-    finally {
-        credential = null;
-        await rm(mirrorPath, { recursive: true, force: true });
-    }
-}
-function parseManagedSourceRefs(stdout) {
-    const refs = [];
-    for (const line of stdout.split(/\r?\n/u)) {
-        const match = /^([0-9a-f]{40})\s+(refs\/heads\/[A-Za-z0-9._/-]{1,480})$/u.exec(line);
-        if (match?.[1] && match[2])
-            refs.push({ sha: match[1], ref: match[2] });
-    }
-    return refs.sort((left, right) => left.ref.localeCompare(right.ref));
-}
-async function managedSourceMirrorRefs(mirror, runtime) {
-    const result = await runtime.captureCommand("git", ["ls-remote", "--heads", "origin"], mirror.path, mirror.environment);
-    return new Map(parseManagedSourceRefs(result.stdout).map(({ ref, sha }) => [ref, sha]));
-}
-function parseManagedSourceCommit(line) {
-    const [sha, parents, authoredAt, author, ...subject] = line.split("\t");
-    return {
-        sha,
-        parents: parents ? parents.split(" ").filter(Boolean) : [],
-        authoredAt,
-        author,
-        subject: subject.join("\t"),
-    };
-}
-function requiredSourceSha(options, name) {
-    const value = requiredFlag(options, name);
-    if (!/^[0-9a-f]{40}$/u.test(value)) {
-        throw new CliError("source_revision_invalid", `--${name} must be an exact lowercase 40-character Git SHA.`);
-    }
-    return value;
-}
-function requiredSourceOperationId(value) {
-    if (!/^sop_[A-Za-z0-9_-]{8,64}$/u.test(value)) {
-        throw new CliError("source_operation_id_invalid", "--operation must be the sop_ ID returned by a source mutation.");
-    }
-    return value;
-}
-async function sourcePull(cwd, options, runtime) {
-    const context = await optionalContext(cwd);
-    const access = await sourceProjectAccess(cwd, context?.link ?? null, options, runtime, true);
-    const source = await access.client.sourceRepository(access.projectId);
-    if (!source.repository) {
-        throw new CliError("source_repository_missing", "This project does not have an active Tender-managed Git repository to pull.", "Open the merchant-hosted connected repository, or ask a merchant administrator to connect Tender-managed Git.");
-    }
-    const repository = source.repository;
-    if (repository.status !== "active") {
-        throw new CliError("source_repository_paused", "This Tender-managed repository is paused and cannot be pulled.", "Use tender-accounts source status --project <project-id> --json to inspect the authoritative source.");
-    }
-    const credentialHeaderKey = managedGitCredentialHeaderKey(repository.remoteUrl);
-    const remote = options.flags.get("remote") ?? "tender";
-    assertGitRemoteName(remote);
-    const existingGitRoot = await optionalGitRoot(cwd, runtime);
-    let checkoutRoot;
-    let action;
-    let selectedRemote = remote;
-    let selectedBranch = repository.defaultBranch;
-    let beforeRevision = null;
-    if (!existingGitRoot) {
-        const entries = await readdir(cwd);
-        if (entries.length > 0) {
-            throw new CliError("source_pull_target_not_empty", "Tender can clone the connected repository only into an empty directory.", "Run this command from an empty workspace, or open the existing matching Git checkout and retry there.");
-        }
-        checkoutRoot = cwd;
-        action = "clone";
-    }
-    else {
-        checkoutRoot = existingGitRoot;
-        action = "pull";
-        selectedRemote = await matchingSourceRemote(checkoutRoot, remote, repository.remoteUrl, runtime);
-        selectedBranch = (await runtime.captureCommand("git", ["branch", "--show-current"], checkoutRoot)).stdout;
-        if (!selectedBranch) {
-            throw new CliError("source_pull_detached_head", "Tender will not pull while the checkout has a detached HEAD.", `Switch to ${repository.defaultBranch}, then retry tender-accounts source pull.`);
-        }
-        const state = await sourceState(checkoutRoot, runtime);
-        if (state.dirty) {
-            throw new CliError("source_pull_dirty_worktree", "Tender will not pull over uncommitted or untracked files.", "Commit, stash, or remove the local changes, then retry tender-accounts source pull.");
-        }
-        beforeRevision = state.revision;
-    }
-    assertGitBranchName(selectedBranch);
-    let appRoot = managedSourceAppRoot(checkoutRoot, repository.workingDirectory);
-    if (action === "pull") {
-        appRoot = await verifiedManagedSourceAppRoot(checkoutRoot, repository.workingDirectory);
-        await compatibleManagedSourceContext(appRoot, access.projectId, access.apiUrl);
-    }
-    if (options.booleans.has("dry-run")) {
-        return {
-            status: "planned",
-            action,
-            projectId: access.projectId,
-            repositoryId: repository.id,
-            remote: selectedRemote,
-            transport: "tender-managed",
-            branch: selectedBranch,
-            checkoutRoot,
-            appRoot,
-            credentialIssued: false,
-            wroteFiles: false,
-        };
-    }
-    let credential = null;
-    try {
-        const token = await access.client.sourceToken(repository.id, 15 * 60, "read");
-        if (token.remoteUrl !== repository.remoteUrl) {
-            throw new CliError("source_token_target_mismatch", "Tender refused a repository credential whose target did not match the connected source.");
-        }
-        credential = token.token;
-        const environment = managedGitEnvironment(runtime.environment, credential, credentialHeaderKey);
-        if (action === "clone") {
-            await runtime.captureCommand("git", [
-                "clone",
-                "--no-checkout",
-                "--no-recurse-submodules",
-                "--origin", selectedRemote,
-                "--branch", repository.defaultBranch,
-                repository.remoteUrl,
-                ".",
-            ], checkoutRoot, environment);
-        }
-        else {
-            await runtime.captureCommand("git", ["fetch", "--no-recurse-submodules", selectedRemote, selectedBranch], checkoutRoot, environment);
-        }
-    }
-    finally {
-        credential = null;
-    }
-    const checkoutEnvironment = managedGitCheckoutEnvironment(runtime.environment);
-    if (action === "clone") {
-        await runtime.captureCommand("git", ["reset", "--hard", "HEAD"], checkoutRoot, checkoutEnvironment);
-    }
-    else {
-        await runtime.captureCommand("git", ["merge", "--ff-only", "FETCH_HEAD"], checkoutRoot, checkoutEnvironment);
-    }
-    appRoot = await verifiedManagedSourceAppRoot(checkoutRoot, repository.workingDirectory);
-    const pulledContext = await compatibleManagedSourceContext(appRoot, access.projectId, access.apiUrl);
-    const linkCreated = !pulledContext.link;
-    const linkPath = linkCreated
-        ? await writeProjectLink(appRoot, {
-            schema: CLI_LINK_SCHEMA,
-            projectId: access.projectId,
-            apiUrl: access.apiUrl,
-        })
-        : pulledContext.linkPath;
-    const afterRevision = (await sourceState(checkoutRoot, runtime)).revision;
-    return {
-        status: action === "clone" ? "cloned" : beforeRevision === afterRevision ? "up_to_date" : "updated",
-        action,
-        projectId: access.projectId,
-        repositoryId: repository.id,
-        remote: selectedRemote,
-        branch: selectedBranch,
-        checkoutRoot,
-        appRoot,
-        sourceRevision: afterRevision,
-        linkPath,
-        linkCreated,
-        credentialPersisted: false,
-        next: appRoot === checkoutRoot
-            ? "tender-accounts doctor --json"
-            : `tender-accounts doctor --cwd ${repository.workingDirectory} --json`,
-    };
-}
-async function compatibleManagedSourceContext(appRoot, projectId, apiUrl) {
-    const context = await loadProjectContext(appRoot).catch((error) => {
-        if (error instanceof CliError && error.code === "file_missing") {
-            throw new CliError("source_checkout_config_missing", `The connected repository does not contain tender-accounts.json at ${appRoot}.`, "Ask a merchant administrator to repair the managed source working directory before continuing.");
-        }
-        throw error;
-    });
-    if (context.link && (context.link.projectId !== projectId
-        || context.link.apiUrl !== apiUrl)) {
-        throw new CliError("source_checkout_link_conflict", "The pulled app is already linked to a different Tender project or API origin.", "Do not replace the link automatically; verify the checkout and project with a merchant administrator.");
-    }
-    return context;
-}
-async function sourceProjectAccess(cwd, link, options, runtime, requireDeveloper) {
-    const resolved = await authenticatedClient(cwd, link, options, runtime);
-    const principal = await resolved.client.whoami();
-    if (resolved.profile)
-        await savePrincipalSummary(runtime.authStore, resolved.profile, principal);
-    const explicitProject = options.flags.get("project");
-    const requestedProject = explicitProject ? requiredProjectId(explicitProject) : link?.projectId;
-    const project = requestedProject
-        ? principal.projects.find((candidate) => candidate.projectId === requestedProject)
-        : principal.projects.length === 1 ? principal.projects[0] : undefined;
-    if (!project) {
-        throw new CliError(requestedProject ? "project_not_permitted" : "project_required", requestedProject
-            ? "The current credential is not permitted to use that project."
-            : "The credential grants more than one project; select one explicitly.", `tender-accounts source status --project ${principal.projects[0]?.projectId ?? "prj_..."} --json`);
-    }
-    if (explicitProject && link && project.projectId !== link.projectId) {
-        throw new CliError("project_link_mismatch", "The requested project does not match this checkout's Tender link.", "Run the command from an empty workspace, or use the project already recorded in .tender/link.json.");
-    }
-    if (requireDeveloper && project.role !== "developer") {
-        throw new CliError("project_role_insufficient", "The selected project grant is read-only and cannot issue a repository credential.", "Ask a merchant administrator for developer access to this exact project.");
-    }
-    return { client: resolved.client, apiUrl: resolved.apiUrl, projectId: project.projectId };
-}
-async function optionalGitRoot(cwd, runtime) {
-    try {
-        return resolve((await runtime.captureCommand("git", ["rev-parse", "--show-toplevel"], cwd)).stdout);
-    }
-    catch {
-        return null;
-    }
-}
-async function matchingSourceRemote(gitRoot, requestedRemote, remoteUrl, runtime) {
-    const remotes = (await runtime.captureCommand("git", ["remote"], gitRoot)).stdout.split(/\r?\n/u).filter(Boolean);
-    const matches = [];
-    for (const remote of remotes) {
-        const current = (await runtime.captureCommand("git", ["remote", "get-url", remote], gitRoot)).stdout;
-        if (current === remoteUrl)
-            matches.push(remote);
-        if (remote === requestedRemote && current !== remoteUrl) {
-            throw new CliError("source_remote_conflict", `Git remote ${requestedRemote} points somewhere other than this project's connected source.`, "Open the matching checkout or choose its existing remote with --remote after verifying the URL.");
-        }
-    }
-    if (matches.includes(requestedRemote))
-        return requestedRemote;
-    if (matches.length === 1)
-        return matches[0];
-    if (matches.length > 1) {
-        throw new CliError("source_remote_ambiguous", "More than one Git remote points to the connected Tender source.", "Select the intended existing remote explicitly with --remote.");
-    }
-    throw new CliError("source_checkout_mismatch", "This Git checkout does not match the project's connected Tender source.", "Run tender-accounts source pull from an empty workspace to clone the exact repository.");
-}
-function managedSourceAppRoot(checkoutRoot, workingDirectory) {
-    if (workingDirectory === ".")
-        return checkoutRoot;
-    if (!workingDirectory || workingDirectory.startsWith("/") || workingDirectory.includes("\\") || workingDirectory.includes("%")) {
-        throw new CliError("source_working_directory_invalid", "The managed source working directory is unsafe.");
-    }
-    const segments = workingDirectory.split("/");
-    if (segments.some((segment) => !segment || segment === "." || segment === ".." || !/^[A-Za-z0-9._-]+$/u.test(segment))) {
-        throw new CliError("source_working_directory_invalid", "The managed source working directory is unsafe.");
-    }
-    const appRoot = resolve(checkoutRoot, workingDirectory);
-    const pathFromCheckout = relative(checkoutRoot, appRoot);
-    if (pathFromCheckout === ".." || pathFromCheckout.startsWith(`..${sep}`)) {
-        throw new CliError("source_working_directory_invalid", "The managed source working directory escapes the checkout.");
-    }
-    return appRoot;
-}
-async function verifiedManagedSourceAppRoot(checkoutRoot, workingDirectory) {
-    const lexicalAppRoot = managedSourceAppRoot(checkoutRoot, workingDirectory);
-    const realCheckoutRoot = await realpath(checkoutRoot);
-    let cursor = realCheckoutRoot;
-    if (workingDirectory !== ".") {
-        for (const segment of workingDirectory.split("/")) {
-            cursor = resolve(cursor, segment);
-            let entry;
-            try {
-                entry = await lstat(cursor);
-            }
-            catch (error) {
-                if (error instanceof Error && "code" in error && error.code === "ENOENT") {
-                    throw new CliError("source_working_directory_missing", `The managed source working directory does not exist: ${workingDirectory}.`, "Ask a merchant administrator to repair the connected source working directory.");
-                }
-                throw error;
-            }
-            if (entry.isSymbolicLink() || !entry.isDirectory()) {
-                throw new CliError("source_working_directory_unsafe", `The managed source working directory contains a symlink or non-directory component: ${workingDirectory}.`, "Replace it with regular directories inside the connected repository before retrying.");
-            }
-        }
-    }
-    const realAppRoot = await realpath(lexicalAppRoot);
-    const pathFromCheckout = relative(realCheckoutRoot, realAppRoot);
-    if (pathFromCheckout === ".." || pathFromCheckout.startsWith(`..${sep}`)) {
-        throw new CliError("source_working_directory_unsafe", "The managed source working directory escapes the checkout.");
-    }
-    return lexicalAppRoot;
-}
-function managedGitCredentialHeaderKey(remoteUrl) {
-    let url;
-    try {
-        url = new URL(remoteUrl);
-    }
-    catch {
-        throw new CliError("source_remote_invalid", "The connected managed Git URL is invalid.");
-    }
-    if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash) {
-        throw new CliError("source_remote_invalid", "The connected managed Git URL must be credential-free HTTPS without query parameters or fragments.");
-    }
-    return `http.${url.toString()}.extraHeader`;
-}
-function managedGitEnvironment(environment, credential, credentialHeaderKey) {
-    return {
-        ...environment,
-        GIT_CONFIG_COUNT: "1",
-        GIT_CONFIG_KEY_0: credentialHeaderKey,
-        GIT_CONFIG_VALUE_0: `Authorization: Bearer ${credential}`,
-        GIT_TERMINAL_PROMPT: "0",
-        GIT_LFS_SKIP_SMUDGE: "1",
-    };
-}
-function managedGitCheckoutEnvironment(environment) {
-    return {
-        ...environment,
-        GIT_TERMINAL_PROMPT: "0",
-        GIT_LFS_SKIP_SMUDGE: "1",
-    };
-}
-async function sourceConnect(cwd, options, runtime) {
-    const context = await loadProjectContext(cwd);
-    if (!context.link)
-        throw new CliError("project_not_linked", "This app is not linked to a Tender Accounts project.", "tender-accounts link --json");
-    const projectId = requiredProjectId(context.link.projectId);
-    const { client } = await authenticatedClient(cwd, context.link, options, runtime);
-    const gitRoot = await requireGitRoot(context.root, runtime);
-    const derivedWorkingDirectory = relative(gitRoot, context.root).split(sep).join("/") || ".";
-    if (derivedWorkingDirectory.startsWith("../")) {
-        throw new CliError("source_working_directory_invalid", "The Tender app must be inside the Git repository being connected.");
-    }
-    const publication = options.flags.get("publication") ?? "preview-only";
-    if (publication !== "preview-only" && publication !== "default-branch") {
-        throw new CliError("source_publication_invalid", "--publication must be preview-only or default-branch.");
-    }
-    const workingDirectory = options.flags.get("working-directory") ?? derivedWorkingDirectory;
-    const artifactLatestPath = options.flags.get("artifact-path")
-        ?? `${context.config.artifactDirectory}/${BUILD_ENVELOPE_FILENAME}`;
-    const created = await client.connectSourceRepository(projectId, {
-        repoName: options.flags.get("repo-name") ?? `${safeRepositoryName(basename(gitRoot))}-source`,
-        defaultBranch: options.flags.get("default-branch") ?? "main",
-        installCommand: options.flags.get("install-command") ?? "npm ci",
-        validateCommand: context.config.commands.check,
-        buildCommand: context.config.commands.package,
-        workingDirectory,
-        artifactLatestPath,
-        autoPublishDefaultBranch: publication === "default-branch",
-    });
-    const remote = options.flags.get("remote") ?? "tender";
-    await ensureGitRemote(gitRoot, remote, created.repository.remoteUrl, runtime);
-    return {
-        status: "connected",
-        projectId,
-        remote,
-        repository: publicManagedSourceRepository(created.repository),
-        next: `tender-accounts source push --remote ${remote} --json`,
-    };
-}
-async function sourceToken(cwd, options, runtime) {
-    const context = await loadProjectContext(cwd);
-    if (!context.link)
-        throw new CliError("project_not_linked", "This app is not linked to a Tender Accounts project.", "tender-accounts link --json");
-    const { client } = await authenticatedClient(cwd, context.link, options, runtime);
-    const source = await client.sourceRepository(requiredProjectId(context.link.projectId));
-    if (!source.repository)
-        throw new CliError("source_repository_missing", "Connect a Tender-managed repository before requesting source access.", "tender-accounts source connect --json");
-    return {
-        status: "issued",
-        repositoryId: source.repository.id,
-        ...(await client.sourceToken(source.repository.id, numberFlag(options, "ttl-seconds", 15 * 60, 7 * 24 * 60 * 60, 60 * 60), "read")),
-        warning: "This read-only repository credential is shown once. Keep it out of source and shell history.",
-    };
-}
-async function sourcePush(cwd, options, runtime) {
-    const context = await loadProjectContext(cwd);
-    if (!context.link)
-        throw new CliError("project_not_linked", "This app is not linked to a Tender Accounts project.", "tender-accounts link --json");
-    const projectId = requiredProjectId(context.link.projectId);
-    const { client } = await authenticatedClient(cwd, context.link, options, runtime);
-    const source = await client.sourceRepository(projectId);
-    if (!source.repository)
-        throw new CliError("source_repository_missing", "Connect a Tender-managed repository before pushing.", "tender-accounts source connect --json");
-    const gitRoot = await requireGitRoot(context.root, runtime);
-    const remote = options.flags.get("remote") ?? "tender";
-    await ensureGitRemote(gitRoot, remote, source.repository.remoteUrl, runtime);
-    const currentBranch = (await runtime.captureCommand("git", ["branch", "--show-current"], gitRoot)).stdout;
-    const branch = options.flags.get("branch") ?? (currentBranch || source.repository.defaultBranch);
-    assertGitBranchName(branch);
-    const state = await sourceState(gitRoot, runtime);
-    if (source.repository.changeRequestProtection === "enabling") {
-        throw new CliError("source_review_activation_pending", "Reviewed changes are still activating. Retry after Tender confirms previous write access was revoked.");
-    }
-    if (source.repository.changeRequestProtection === "enabled") {
-        if (!currentBranch) {
-            throw new CliError("source_push_detached_head", "Tender will not submit a detached HEAD. Create or switch to a feature branch first.");
-        }
-        if (branch === source.repository.defaultBranch) {
-            throw new CliError("source_default_branch_protected", `${source.repository.defaultBranch} is protected. Push a feature branch, then create a reviewed change request.`, "tender-accounts source push --branch my-change --json");
-        }
-        return await submitProtectedSourcePush(gitRoot, projectId, source.repository, branch, state, options, client, runtime);
-    }
-    let credential = null;
-    try {
-        const token = await client.sourceToken(source.repository.id, 15 * 60);
-        credential = token.token;
-        await runtime.captureCommand("git", ["push", remote, `HEAD:refs/heads/${branch}`], gitRoot, managedGitEnvironment(runtime.environment, credential, managedGitCredentialHeaderKey(source.repository.remoteUrl)));
-    }
-    finally {
-        credential = null;
-    }
-    return {
-        status: "pushed",
-        projectId,
-        repositoryId: source.repository.id,
-        remote,
-        branch,
-        sourceRevision: state.revision,
-        dirtyWorkingTreeExcluded: state.dirty,
-        next: "tender-accounts source status --json",
-    };
-}
-async function submitProtectedSourcePush(gitRoot, projectId, repository, branch, state, options, client, runtime) {
-    let credential = null;
-    let expectedCurrentSha = null;
-    try {
-        const token = await client.sourceToken(repository.id, 15 * 60, "read");
-        credential = token.token;
-        const remote = await runtime.captureCommand("git", ["ls-remote", "--heads", repository.remoteUrl, `refs/heads/${branch}`], gitRoot, managedGitEnvironment(runtime.environment, credential, managedGitCredentialHeaderKey(repository.remoteUrl)));
-        const refs = parseManagedSourceRefs(remote.stdout);
-        expectedCurrentSha = refs[0]?.sha ?? null;
-    }
-    finally {
-        credential = null;
-    }
-    const temporary = await mkdtemp(join(tmpdir(), "tender-source-push-"));
-    const bundlePath = join(temporary, "source.bundle");
-    try {
-        await runtime.captureCommand("git", ["bundle", "create", bundlePath, "HEAD"], gitRoot, managedGitCheckoutEnvironment(runtime.environment));
-        const bytes = new Uint8Array(await readFile(bundlePath));
-        if (bytes.byteLength > 50 * 1024 * 1024) {
-            throw new CliError("source_bundle_too_large", "The committed source bundle exceeds Tender's 50 MiB limit.");
-        }
-        const bundleSha256 = createHash("sha256").update(bytes).digest("hex");
-        const retryWindow = Math.floor(Date.now() / (24 * 60 * 60 * 1000));
-        const pushIntentDigest = createHash("sha256")
-            .update(`${repository.id}\0${branch}\0${state.revision}\0${retryWindow}`)
-            .digest("hex");
-        const requested = await client.createSourcePush(repository.id, {
-            idempotencyKey: `source-push-${pushIntentDigest}`,
-            branch,
-            expectedCurrentSha,
-            sourceRevision: state.revision,
-            bundleSha256,
-            bundleBytes: bytes.byteLength,
-        });
-        let push = requested.push;
-        if (push.status === "uploading")
-            push = (await client.uploadSourceBundle(push.id, bytes)).push;
-        if (!options.booleans.has("no-wait")) {
-            const deadline = Date.now() + numberFlag(options, "timeout-seconds", 30, 900, 300) * 1000;
-            while (push.status === "requested" || push.status === "running" || push.status === "uploading") {
-                if (Date.now() >= deadline) {
-                    throw new CliError("source_push_timeout", `Source push ${push.id} is still ${push.status}.`, `tender-accounts source push --branch ${branch} --no-wait --json`);
-                }
-                await runtime.sleep(1500);
-                push = (await client.sourcePush(push.id)).push;
-            }
-        }
-        if (push.status === "failed") {
-            throw new CliError(push.error?.code ?? "source_push_failed", push.error?.message ?? "Tender could not push the exact feature branch.");
-        }
-        if (push.status === "expired") {
-            throw new CliError(push.error?.code ?? "source_push_expired", push.error?.message ?? "The exact source push expired before it completed.");
-        }
-        return {
-            status: push.status === "succeeded" ? "pushed" : push.status,
-            projectId,
-            repositoryId: repository.id,
-            pushId: push.id,
-            branch,
-            sourceRevision: state.revision,
-            dirtyWorkingTreeExcluded: state.dirty,
-            credentialPersisted: false,
-            defaultBranchProtected: true,
-            next: `tender-accounts source change create --head ${branch} --title \"Describe this change\" --json`,
-        };
-    }
-    finally {
-        await rm(temporary, { recursive: true, force: true });
-    }
-}
-async function sourceChangeCreate(cwd, options, runtime) {
-    const access = await sourceReadAccess(cwd, options, runtime);
-    if (access.repository.changeRequestProtection !== "enabled") {
-        throw new CliError("source_review_not_enabled", "A merchant administrator must enable reviewed changes for this managed repository first.");
-    }
-    const baseBranch = options.flags.get("base") ?? access.repository.defaultBranch;
-    const headBranch = requiredFlag(options, "head");
-    const title = requiredFlag(options, "title");
-    assertGitBranchName(baseBranch);
-    assertGitBranchName(headBranch);
-    if (baseBranch === headBranch)
-        throw new CliError("source_change_invalid", "The head branch must differ from the protected base branch.");
-    return withManagedSourceMirror(cwd, access.repository, access.client, runtime, async (mirror) => {
-        const refs = await managedSourceMirrorRefs(mirror, runtime);
-        const baseSha = refs.get(`refs/heads/${baseBranch}`);
-        const headSha = refs.get(`refs/heads/${headBranch}`);
-        if (!baseSha || !headSha)
-            throw new CliError("source_branch_missing", "Both the protected base and proposed head branches must exist.");
-        const created = await access.client.createSourceChangeRequest(access.repository.id, {
-            title,
-            description: options.flags.get("description") ?? "",
-            baseBranch,
-            headBranch,
-            baseSha,
-            headSha,
-        });
-        return {
-            status: created.changeRequest.status,
-            created: created.created,
-            projectId: access.projectId,
-            repositoryId: access.repository.id,
-            changeRequest: created.changeRequest,
-            next: created.changeRequest.status === "ready_for_review"
-                ? "A merchant administrator can open the exact preview and approve this change in Tender."
-                : "Wait for Tender to validate and seal the exact preview, then inspect this change again.",
-        };
-    });
-}
-async function sourceChangeList(cwd, options, runtime) {
-    const access = await sourceReadAccess(cwd, options, runtime);
-    const state = (options.flags.get("state") ?? "open");
-    if (!new Set(["open", "closed", "all"]).has(state))
-        throw new CliError("argument_invalid", "--state must be open, closed, or all.");
-    const result = await access.client.sourceChangeRequests(access.repository.id, state);
-    return { status: "ready", projectId: access.projectId, repositoryId: access.repository.id, changeRequests: result.changeRequests };
-}
-async function sourceChangeShow(cwd, options, runtime) {
-    const context = await loadProjectContext(cwd);
-    if (!context.link)
-        throw new CliError("project_not_linked", "This app is not linked to a Tender Accounts project.");
-    const { client } = await authenticatedClient(cwd, context.link, options, runtime);
-    const result = await client.sourceChangeRequest(requiredSourceChangeRequestId(requiredFlag(options, "change")));
-    requireLinkedSourceChange(context.link.projectId, result.changeRequest.projectId);
-    return result;
-}
-async function sourceChangeClose(cwd, options, runtime) {
-    const context = await loadProjectContext(cwd);
-    if (!context.link)
-        throw new CliError("project_not_linked", "This app is not linked to a Tender Accounts project.");
-    const { client } = await authenticatedClient(cwd, context.link, options, runtime);
-    const changeRequestId = requiredSourceChangeRequestId(requiredFlag(options, "change"));
-    const current = await client.sourceChangeRequest(changeRequestId);
-    requireLinkedSourceChange(context.link.projectId, current.changeRequest.projectId);
-    return client.closeSourceChangeRequest(changeRequestId);
-}
-function requireLinkedSourceChange(expectedProjectId, actualProjectId) {
-    if (actualProjectId !== expectedProjectId) {
-        throw new CliError("project_link_mismatch", "That source change belongs to another Tender project. Run the command from its linked checkout.");
-    }
-}
-function requiredSourceChangeRequestId(value) {
-    if (!/^scr_[A-Za-z0-9_-]{8,64}$/u.test(value)) {
-        throw new CliError("source_change_id_invalid", "--change must be the scr_ ID returned by source change create.");
-    }
-    return value;
-}
-async function requireGitRoot(root, runtime) {
-    try {
-        return resolve((await runtime.captureCommand("git", ["rev-parse", "--show-toplevel"], root)).stdout);
-    }
-    catch {
-        throw new CliError("source_repository_required", "This app must be inside a Git repository before managed source can be connected.");
-    }
-}
-async function ensureGitRemote(gitRoot, remote, remoteUrl, runtime) {
-    assertGitRemoteName(remote);
-    const remotes = (await runtime.captureCommand("git", ["remote"], gitRoot)).stdout.split(/\r?\n/u).filter(Boolean);
-    if (!remotes.includes(remote)) {
-        await runtime.captureCommand("git", ["remote", "add", remote, remoteUrl], gitRoot);
-        return;
-    }
-    const current = (await runtime.captureCommand("git", ["remote", "get-url", remote], gitRoot)).stdout;
-    if (current !== remoteUrl) {
-        throw new CliError("source_remote_conflict", `Git remote ${remote} already points somewhere else. Tender will not replace it automatically.`, `Choose another name with --remote, or update ${remote} yourself after verifying the URL.`);
-    }
-}
-function assertGitRemoteName(remote) {
-    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(remote)) {
-        throw new CliError("source_remote_invalid", "The Git remote name is invalid.");
-    }
-}
-function assertGitBranchName(branch) {
-    if (!/^[A-Za-z0-9][A-Za-z0-9._/-]{0,127}$/u.test(branch)) {
-        throw new CliError("source_branch_invalid", "The managed source branch name is invalid.");
-    }
-}
-function safeRepositoryName(value) {
-    const normalized = value.replaceAll(/[^A-Za-z0-9._-]+/gu, "-").replace(/^-+|-+$/gu, "");
-    return normalized.length >= 2 ? normalized.slice(0, 100) : "tender-app";
-}
-async function tail(cwd, options, runtime) {
-    const context = await loadProjectContext(cwd);
-    if (!context.link) {
-        throw new CliError("project_not_linked", "This app is not linked to a Tender Accounts project.", "tender-accounts link --json");
-    }
-    const projectId = requiredProjectId(context.link.projectId);
-    const resolved = await authenticatedClient(cwd, context.link, options, runtime);
-    const production = options.booleans.has("production");
-    const deliveryId = options.flags.get("delivery");
-    if (production === Boolean(deliveryId)) {
-        throw new CliError("runtime_log_target_required", "Choose exactly one runtime log target: --delivery dly_... or --production.", "tender-accounts tail --delivery dly_... --json");
-    }
-    if (deliveryId && !/^dly_[A-Za-z0-9_-]{8,64}$/u.test(deliveryId)) {
-        throw new CliError("developer_delivery_id_required", "--delivery must be a dly_ developer-delivery ID.");
-    }
-    const filters = {
-        statuses: csvFlag(options, "status"),
-        methods: csvFlag(options, "method"),
-        search: options.flags.get("search") ?? null,
-        samplingRate: decimalFlag(options, "sampling-rate", 0, 1, 1),
-    };
-    const session = await resolved.client.createRuntimeLogSession(projectId, {
-        environment: production ? "production" : "preview",
-        ...(deliveryId ? { deliveryId } : {}),
-        filters,
-    });
-    const streamUrl = new URL(session.streamUrl);
-    streamUrl.protocol = streamUrl.protocol === "https:" ? "wss:" : "ws:";
-    runtime.stderr.write(`Streaming ${session.environment} logs for ${projectId} until ${session.expiresAt}. Press Ctrl+C to stop.\n`);
-    const socket = runtime.openLogStream(streamUrl.toString(), [session.protocol, `tender-auth.${session.streamToken}`]);
-    let interrupted = false;
-    const removeInterrupt = runtime.onInterrupt(() => {
-        interrupted = true;
-        socket.close(1000, "CLI interrupted");
-    });
-    try {
-        await new Promise((resolvePromise, rejectPromise) => {
-            socket.addEventListener("message", (event) => {
-                const raw = typeof event.data === "string" ? event.data : String(event.data);
-                if (options.json)
-                    runtime.stdout.write(`${raw}\n`);
-                else
-                    runtime.stdout.write(`${formatRuntimeLogEvent(raw)}\n`);
-            });
-            socket.addEventListener("close", (event) => {
-                if (!interrupted && event.code !== 1000) {
-                    rejectPromise(new CliError("runtime_log_stream_closed", `Runtime log stream closed (${event.code}${event.reason ? `: ${event.reason}` : ""}).`));
-                }
-                else {
-                    resolvePromise();
-                }
-            });
-            socket.addEventListener("error", () => rejectPromise(new CliError("runtime_log_stream_failed", "Tender could not connect to the runtime log stream.", "Run tender-accounts doctor --json, then start a new tail session.")));
-        });
-    }
-    finally {
-        removeInterrupt();
-        await resolved.client.closeRuntimeLogSession(session.id).catch(() => undefined);
-    }
-}
-function formatRuntimeLogEvent(raw) {
-    try {
-        const value = JSON.parse(raw);
-        if (!isRecord(value))
-            return terminalSafe(raw);
-        const event = isRecord(value.event) ? value.event : {};
-        const timestamp = typeof value.timestamp === "number" ? new Date(value.timestamp).toISOString() : "unknown-time";
-        const request = [event.method, event.url, event.status]
-            .filter((part) => part !== undefined)
-            .map((part) => terminalSafe(String(part)))
-            .join(" ");
-        const correlation = isRecord(value.correlation) ? value.correlation : {};
-        const correlationSuffix = [
-            ["ray", correlation.rayId],
-            ["trace", correlation.traceId],
-            ["span", correlation.spanId],
-        ].flatMap(([label, identifier]) => (typeof identifier === "string" ? [` ${label}=${terminalSafe(identifier)}`] : [])).join("");
-        const lines = [
-            `${timestamp} ${terminalSafe(String(value.outcome ?? "unknown"))}${request ? ` ${request}` : ""}${correlationSuffix}`,
-        ];
-        if (Array.isArray(value.logs)) {
-            for (const log of value.logs) {
-                if (isRecord(log))
-                    lines.push(`  ${String(log.level ?? "log")}: ${JSON.stringify(log.message ?? [])}`);
-            }
-        }
-        if (Array.isArray(value.exceptions)) {
-            for (const exception of value.exceptions) {
-                if (isRecord(exception)) {
-                    lines.push(`  exception: ${terminalSafe(String(exception.name ?? "Error"))}: ${terminalSafe(String(exception.message ?? ""))}`);
-                }
-            }
-        }
-        return lines.join("\n");
-    }
-    catch {
-        return terminalSafe(raw);
-    }
-}
-function terminalSafe(value) {
-    return value.replace(/[\u0000-\u001f\u007f-\u009f]/gu, (character) => (`\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`));
-}
-async function authStatus(cwd, options, runtime) {
-    const context = await optionalContext(cwd);
-    const resolved = await authenticatedClient(cwd, context?.link ?? null, options, runtime);
-    const principal = await resolved.client.whoami();
-    if (resolved.profile)
-        await savePrincipalSummary(runtime.authStore, resolved.profile, principal);
-    return {
-        ...principal,
-        authentication: {
-            source: resolved.source,
-            apiUrl: resolved.apiUrl,
-            ...(resolved.accessTokenExpiresAt ? { accessTokenExpiresAt: resolved.accessTokenExpiresAt } : {}),
-            ...(resolved.source === "login" ? { profile: resolved.profile, storage: runtime.authStore.description() } : {}),
-        },
-    };
-}
-async function authList(runtime) {
-    const profiles = await runtime.authStore.list();
-    const bindings = await runtime.profileBindings.list();
-    return {
-        schema: "tender.accounts-auth-profiles/v1",
-        storage: runtime.authStore.description(),
-        bindingStorage: runtime.profileBindings.description(),
-        profiles: profiles.map(({ profile, auth }) => ({
-            profile,
-            default: profile === DEFAULT_AUTH_PROFILE,
-            apiUrl: auth.apiUrl,
-            status: auth.pendingDevice ? "authorization_pending" : "authenticated",
-            ...(auth.pendingDevice ? { expiresAt: auth.pendingDevice.expiresAt } : {}),
-            ...(!auth.pendingDevice && auth.refreshTokenExpiresAt ? { expiresAt: auth.refreshTokenExpiresAt } : {}),
-            boundDirectories: bindings
-                .filter((binding) => binding.profile === profile)
-                .map((binding) => binding.directory),
-            containsCredential: false,
-        })),
-    };
-}
-async function authLogin(cwd, options, runtime) {
-    return await authenticateProfile(cwd, options, runtime, DEFAULT_AUTH_PROFILE, options.booleans.has("force"));
-}
-async function authCreate(cwd, options, runtime) {
-    assertNoEnvironmentCredentialForProfileManagement(runtime.environment);
-    const profile = validateNamedAuthProfile(requiredPositional(options, 0, "profile name"));
-    return await authenticateProfile(cwd, options, runtime, profile, true);
-}
-async function authenticateProfile(cwd, options, runtime, profile, replaceExisting) {
-    const context = await optionalContext(cwd);
-    const apiUrl = selectedApiUrl(options, context?.link ?? null, runtime.environment);
-    const projectHint = options.flags.get("project") ?? context?.link?.projectId;
-    const clientName = options.flags.get("client-name") ?? `Tender CLI on ${hostname()}`;
-    const existing = await runtime.authStore.read(profile);
-    if (existing && !replaceExisting) {
-        const replacement = profile === DEFAULT_AUTH_PROFILE
-            ? "tender-accounts auth login --force"
-            : `tender-accounts auth create ${profile}`;
-        throw new CliError("already_authenticated", existing.pendingDevice
-            ? `Tender CLI profile ${profile} already has a pending device authorization.`
-            : `Tender CLI profile ${profile} is already authenticated.`, existing.pendingDevice
-            ? `Run tender-accounts auth status --profile ${profile} --json after approving it, or ${replacement} to replace it.`
-            : `Run tender-accounts auth status --profile ${profile} --json, or ${replacement} to replace it.`);
-    }
-    if (existing?.refreshToken) {
-        await new OAuthApiClient(existing.apiUrl, runtime.fetcher).revoke(existing.refreshToken);
-    }
-    if (existing)
-        await clearStoredProfile(runtime.authStore, profile, existing);
-    const oauth = new OAuthApiClient(apiUrl, runtime.fetcher);
-    if (options.booleans.has("device")) {
-        const device = await oauth.deviceAuthorization({ clientName, ...(projectHint ? { projectHint } : {}) });
-        const expiresAt = new Date(Date.now() + device.expires_in * 1000).toISOString();
-        const pending = {
-            schema: CLI_AUTH_SCHEMA,
-            apiUrl,
-            pendingDevice: {
-                deviceCode: device.device_code,
-                userCode: device.user_code,
-                verificationUri: device.verification_uri,
-                verificationUriComplete: device.verification_uri_complete,
-                expiresAt,
-                intervalSeconds: device.interval,
-            },
-        };
-        if (!await runtime.authStore.compareAndSwap(profile, null, pending))
-            throw authProfileChanged(profile);
-        if (!options.booleans.has("no-open"))
-            await runtime.openBrowser(device.verification_uri_complete);
-        if (!options.booleans.has("wait")) {
-            return {
-                status: "authorization_pending",
-                flow: "device",
-                userCode: device.user_code,
-                verificationUrl: device.verification_uri,
-                verificationUrlComplete: device.verification_uri_complete,
-                profile,
-                expiresAt,
-                next: `Approve the request, then run tender-accounts auth status --profile ${profile} --json.`,
-            };
-        }
-        const token = await waitForDeviceToken(oauth, pending, profile, runtime);
-        await saveTokenResponse(runtime.authStore, profile, apiUrl, token, oauth, pending);
-        return await authenticatedLoginSummary(apiUrl, token, profile, runtime);
-    }
-    const pkce = createPkcePair();
-    const callback = await runtime.waitForLoopbackAuthorization({
-        timeoutMilliseconds: numberFlag(options, "timeout-seconds", 60, 900, 600) * 1000,
-        noOpen: options.booleans.has("no-open"),
-        openBrowser: runtime.openBrowser,
-        notify: (authorizationUrl) => runtime.stderr.write(`Open this URL to authorize Tender CLI:\n${authorizationUrl}\n`),
-        start: async (redirectUri) => {
-            const request = await oauth.createAuthorizationRequest({
-                clientName,
-                redirectUri,
-                codeChallenge: pkce.challenge,
-                state: pkce.state,
-                ...(projectHint ? { projectHint } : {}),
-            });
-            return { authorizationUrl: request.authorization_url, expectedState: pkce.state };
-        },
-    });
-    const token = await oauth.exchangeAuthorizationCode({
-        code: callback.code,
-        codeVerifier: pkce.verifier,
-        redirectUri: callback.redirectUri,
-    });
-    await saveTokenResponse(runtime.authStore, profile, apiUrl, token, oauth, null);
-    return await authenticatedLoginSummary(apiUrl, token, profile, runtime);
-}
-async function authActivate(cwd, options, runtime) {
-    assertNoEnvironmentCredentialForProfileManagement(runtime.environment);
-    const profile = validateNamedAuthProfile(requiredPositional(options, 0, "profile name"));
-    if (!await runtime.authStore.read(profile)) {
-        throw new CliError("auth_profile_not_found", `Tender Accounts auth profile ${profile} does not exist.`, `tender-accounts auth create ${profile}`);
-    }
-    const directory = resolve(cwd, options.positionals[1] ?? ".");
-    await runtime.profileBindings.activate(profile, directory);
-    return {
-        status: "activated",
-        profile,
-        directory,
-        inheritedByDescendants: true,
-        containsCredential: false,
-    };
-}
-async function authDeactivate(cwd, options, runtime) {
-    assertNoEnvironmentCredentialForProfileManagement(runtime.environment);
-    const directory = resolve(cwd, options.positionals[0] ?? ".");
-    const removed = await runtime.profileBindings.deactivate(directory);
-    const fallback = await runtime.profileBindings.resolve(directory);
-    return {
-        status: "deactivated",
-        profile: removed.profile,
-        directory: removed.directory,
-        activeProfile: fallback?.profile ?? (await runtime.authStore.read(DEFAULT_AUTH_PROFILE) ? DEFAULT_AUTH_PROFILE : null),
-        containsCredential: false,
-    };
-}
-async function authDelete(_cwd, options, runtime) {
-    assertNoEnvironmentCredentialForProfileManagement(runtime.environment);
-    const profile = validateNamedAuthProfile(requiredPositional(options, 0, "profile name"));
-    const stored = await runtime.authStore.read(profile);
-    if (!stored)
-        throw new CliError("auth_profile_not_found", `Tender Accounts auth profile ${profile} does not exist.`);
-    if (!options.booleans.has("local") && stored.refreshToken) {
-        await new OAuthApiClient(stored.apiUrl, runtime.fetcher).revoke(stored.refreshToken);
-    }
-    await clearStoredProfile(runtime.authStore, profile, stored);
-    const removedBindings = await runtime.profileBindings.removeProfile(profile);
-    return {
-        status: "deleted",
-        profile,
-        remoteSessionRevoked: !options.booleans.has("local") && Boolean(stored.refreshToken),
-        removedBindings,
-        storage: runtime.authStore.description(),
-    };
-}
-function assertNoEnvironmentCredentialForProfileManagement(environment) {
-    if (!environment.TENDER_ACCOUNTS_TOKEN)
-        return;
-    throw new CliError("auth_profile_environment_override", "TENDER_ACCOUNTS_TOKEN overrides local auth profiles, so profile management is disabled for this command.", "Unset TENDER_ACCOUNTS_TOKEN, then retry the auth profile command.");
-}
-async function authLogout(_cwd, options, runtime) {
-    if (options.booleans.has("all") && options.booleans.has("local")) {
-        await runtime.authStore.clearAll();
-        await runtime.profileBindings.clearAll();
-        return {
-            status: "logged_out",
-            profiles: "all",
-            remoteSessionRevoked: false,
-            remoteSessionsRevoked: 0,
-            storage: runtime.authStore.description(),
-        };
-    }
-    const profiles = await runtime.authStore.list();
-    if (profiles.length === 0)
-        return { status: "not_authenticated", remoteSessionRevoked: false };
-    if (!options.booleans.has("all") && !profiles.some(({ profile }) => profile === DEFAULT_AUTH_PROFILE)) {
-        return {
-            status: "not_authenticated",
-            profile: DEFAULT_AUTH_PROFILE,
-            namedProfilesRetained: profiles.length,
-            remoteSessionRevoked: false,
-        };
-    }
-    const selectedProfiles = options.booleans.has("all")
-        ? profiles.map(({ profile }) => profile)
-        : [DEFAULT_AUTH_PROFILE];
-    let revoked = 0;
-    for (const profile of selectedProfiles) {
-        const stored = await runtime.authStore.read(profile);
-        if (!stored)
-            continue;
-        if (!options.booleans.has("local") && stored.refreshToken) {
-            await new OAuthApiClient(stored.apiUrl, runtime.fetcher).revoke(stored.refreshToken);
-            revoked += 1;
-        }
-        await clearStoredProfile(runtime.authStore, profile, stored);
-    }
-    if (options.booleans.has("all"))
-        await runtime.profileBindings.clearAll();
-    return {
-        status: "logged_out",
-        profiles: selectedProfiles,
-        remoteSessionRevoked: revoked > 0,
-        remoteSessionsRevoked: revoked,
-        storage: runtime.authStore.description(),
-    };
-}
-async function linkProject(cwd, options, runtime) {
-    const context = await loadProjectContext(cwd);
-    const apiUrl = selectedApiUrl(options, context.link, runtime.environment);
-    const resolved = await authenticatedClient(context.root, context.link, options, runtime);
-    const { client } = resolved;
-    const principal = await client.whoami();
-    if (resolved.profile)
-        await savePrincipalSummary(runtime.authStore, resolved.profile, principal);
-    const requested = options.flags.get("project");
-    const project = requested
-        ? principal.projects.find((candidate) => candidate.projectId === requiredProjectId(requested))
-        : principal.projects.length === 1 ? principal.projects[0] : undefined;
-    if (!project) {
-        throw new CliError(requested ? "project_not_permitted" : "project_required", requested
-            ? "The current credential is not permitted to use that project."
-            : "The credential grants more than one project; select one explicitly.", `tender-accounts link --project ${principal.projects[0]?.projectId ?? "prj_..."} --json`);
-    }
-    if (project.role !== "developer") {
-        throw new CliError("project_role_insufficient", "The selected project grant is read-only and cannot create previews.", "Ask a merchant administrator for a short-lived developer credential scoped to this project.");
-    }
-    const path = await writeProjectLink(context.root, {
-        schema: CLI_LINK_SCHEMA,
-        projectId: project.projectId,
-        apiUrl,
-    });
-    return {
-        status: "linked",
-        tenantId: principal.tenantId,
-        projectId: project.projectId,
-        role: project.role,
-        apiUrl,
-        ...(resolved.profile ? { activeProfile: resolved.profile } : {}),
-        linkPath: path,
-        containsCredential: false,
-        reminder: "Keep .tender/ and .dev.vars out of Git.",
-    };
-}
-async function doctor(cwd, options, runtime) {
-    const checks = [];
-    const nodeMajor = Number(process.versions.node.split(".")[0]);
-    checks.push({
-        name: "node",
-        status: nodeMajor >= 22 ? "pass" : "fail",
-        message: nodeMajor >= 22 ? `Node ${process.versions.node}` : "Node 22 or newer is required.",
-    });
-    let context = null;
-    try {
-        context = await loadProjectContext(cwd);
-        checks.push({ name: "config", status: "pass", message: context.configPath });
-    }
-    catch (error) {
-        checks.push({ name: "config", status: "fail", message: normalizeError(error).message });
-    }
-    if (context) {
-        checks.push(context.link
-            ? { name: "link", status: "pass", message: `${context.link.projectId} at ${context.link.apiUrl}` }
-            : { name: "link", status: "fail", message: "Run tender-accounts link after receiving a project-scoped credential." });
-        try {
-            const { client } = await authenticatedClient(cwd, context.link, options, runtime);
-            const principal = await client.whoami();
-            const project = context.link
-                ? principal.projects.find((candidate) => candidate.projectId === context.link?.projectId)
-                : undefined;
-            checks.push({ name: "authentication", status: "pass", message: `${principal.ownerEmail} · ${principal.label}` });
-            checks.push(project
-                ? { name: "project-access", status: project.role === "developer" ? "pass" : "fail", message: `${project.projectId} · ${project.role}` }
-                : { name: "project-access", status: "fail", message: "The linked project is outside this credential's scope." });
-        }
-        catch (error) {
-            checks.push({ name: "authentication", status: "fail", message: normalizeError(error).message });
-        }
-        const artifactDirectory = resolveArtifactDirectory(context);
-        checks.push(await pathExists(resolve(artifactDirectory, BUILD_ENVELOPE_FILENAME))
-            ? { name: "artifact", status: "pass", message: artifactDirectory }
-            : { name: "artifact", status: "warn", message: "No packaged artifact yet; tender-accounts build will create it." });
-    }
-    const failed = checks.some((check) => check.status === "fail");
-    return {
-        value: { status: failed ? "failed" : "ready", checks },
-        exitCode: failed ? 1 : 0,
-    };
-}
-async function runDev(cwd, options, runtime) {
-    const context = await loadProjectContext(cwd);
-    if (!context.config.commands.dev) {
-        throw new CliError("dev_command_missing", "This app does not declare commands.dev in tender-accounts.json.");
-    }
-    await runtime.runProjectCommand({
-        command: context.config.commands.dev,
-        cwd: context.root,
-        environment: runtime.environment,
-        machineOutput: options.json,
-    });
-    return { value: { status: "stopped", command: context.config.commands.dev } };
-}
-async function runBuildStage(cwd, options, runtime, stage, extraEnvironment = {}) {
-    const context = await loadProjectContext(cwd);
-    const command = context.config.commands[stage];
-    runtime.stderr.write(`tender-accounts: ${stage}\n`);
-    await runtime.runProjectCommand({
-        command,
-        cwd: context.root,
-        environment: { ...runtime.environment, ...extraEnvironment },
-        machineOutput: options.json,
-    });
-    return { status: "succeeded", stage, command };
-}
-async function buildProject(cwd, options, runtime) {
-    const context = await loadProjectContext(cwd);
-    const source = await sourceState(context.root, runtime);
-    await runBuildStage(cwd, options, runtime, "check", { TENDER_SOURCE_REVISION: source.revision });
-    await runBuildStage(cwd, options, runtime, "package", { TENDER_SOURCE_REVISION: source.revision });
-    let artifact = await verifyArtifact(resolveArtifactDirectory(context));
-    artifact = await labelLocalArtifact(artifact, { gitRevision: source.revision, dirty: source.dirty });
-    return buildSummary(artifact, source.dirty);
-}
-async function preview(cwd, options, runtime) {
-    const context = await loadProjectContext(cwd);
-    const build = await buildProject(cwd, options, runtime);
-    const artifact = await verifyArtifact(resolveArtifactDirectory(context));
-    if (options.booleans.has("dry-run")) {
-        return { ...build, status: "validated", uploaded: false, productionChanged: false };
-    }
-    if (!context.link) {
-        throw new CliError("project_not_linked", "This app is not linked to a Tender Accounts project.", "tender-accounts link --json");
-    }
-    const { client } = await authenticatedClient(cwd, context.link, options, runtime);
-    const suffix = artifact.envelope.bundleDigest.slice(0, 24);
-    const submission = await client.createSubmission(context.link.projectId, {
-        idempotencyKey: options.flags.get("submission-key") ?? `submit-${suffix}`,
-        envelope: artifact.envelope,
-    });
-    for (const file of submission.files) {
-        if (file.uploaded)
-            continue;
-        const bytes = await readBoundedFile(safeArtifactPath(artifact.directory, file.path), file.bytes);
-        await client.uploadFile(submission.id, file.index, bytes);
-    }
-    const finalized = await client.finalizeSubmission(submission.id);
-    if (finalized.status !== "ready" || !finalized.releaseId) {
-        throw new CliError("artifact_finalize_failed", "The artifact submission did not finalize to a ready release.");
-    }
-    let delivery = await client.createDelivery(context.link.projectId, {
-        submissionId: finalized.id,
-        idempotencyKey: options.flags.get("delivery-key") ?? `preview-${suffix}`,
-    });
-    if (options.booleans.has("no-wait")) {
-        return deliverySummary(context.link.projectId, finalized.id, finalized.releaseId, delivery);
-    }
-    delivery = await waitForDelivery(client, delivery, options, runtime);
-    const session = await client.previewSession(delivery.id, options.flags.get("return-path") ?? context.config.returnPath);
-    return {
-        ...deliverySummary(context.link.projectId, finalized.id, finalized.releaseId, delivery),
-        status: "succeeded",
-        sourceRevision: artifact.envelope.sourceRevision,
-        bundleDigest: artifact.envelope.bundleDigest,
-        previewUrl: session.url,
-        previewGrantId: session.grantId,
-        previewExpiresAt: session.expiresAt,
-        productionChanged: false,
-    };
-}
-async function deliveryStatus(cwd, options, runtime) {
-    const context = await loadProjectContext(cwd);
-    const { client } = await authenticatedClient(cwd, context.link, options, runtime);
-    return await client.delivery(requiredDeliveryId(options));
-}
-async function deliveryPreview(cwd, options, runtime) {
-    const context = await loadProjectContext(cwd);
-    const { client } = await authenticatedClient(cwd, context.link, options, runtime);
-    const deliveryId = requiredDeliveryId(options);
-    const session = await client.previewSession(deliveryId, options.flags.get("return-path") ?? context.config.returnPath);
-    return { status: "ready", deliveryId, previewUrl: session.url, expiresAt: session.expiresAt };
-}
-async function deliveryRetry(cwd, options, runtime) {
-    const context = await loadProjectContext(cwd);
-    const { client } = await authenticatedClient(cwd, context.link, options, runtime);
-    return await client.retryDelivery(requiredDeliveryId(options));
-}
-async function authenticatedClient(cwd, link, options, runtime) {
-    const apiUrl = selectedApiUrl(options, link, runtime.environment);
-    const stdin = options.booleans.has("token-stdin") ? runtime.stdin : undefined;
-    const explicit = await readOptionalToken(cwd, runtime.environment, stdin);
-    if (explicit) {
-        const source = stdin
-            ? "stdin"
-            : runtime.environment.TENDER_ACCOUNTS_TOKEN
-                ? "environment"
-                : "dev-vars";
-        return { client: new AgentApiClient(apiUrl, explicit, runtime.fetcher), apiUrl, source };
-    }
-    const profile = await selectAuthProfile(cwd, options, runtime);
-    const stored = await resolveStoredLogin(apiUrl, profile, runtime);
-    return {
-        client: new AgentApiClient(apiUrl, stored.accessToken, runtime.fetcher),
-        apiUrl,
-        source: "login",
-        profile,
-        accessTokenExpiresAt: stored.accessTokenExpiresAt,
-    };
-}
-async function selectAuthProfile(cwd, options, runtime) {
-    const explicit = options.flags.get("profile") ?? runtime.environment.TENDER_ACCOUNTS_PROFILE;
-    if (explicit)
-        return validateAuthProfile(explicit);
-    const binding = await runtime.profileBindings.resolve(cwd);
-    if (binding)
-        return binding.profile;
-    const profiles = await runtime.authStore.list();
-    if (profiles.some(({ profile }) => profile === DEFAULT_AUTH_PROFILE))
-        return DEFAULT_AUTH_PROFILE;
-    if (profiles.length === 0) {
-        throw new CliError("authentication_required", "No Tender Accounts credential or CLI login was found.", "tender-accounts auth login, or tender-accounts auth create merchant-name");
-    }
-    throw new CliError("auth_profile_required", "Named Tender Accounts logins are available, but this directory does not select one and no default login exists.", `Run tender-accounts auth list --json, then tender-accounts auth activate ${profiles[0].profile}.`);
-}
-function selectedApiUrl(options, link, environment) {
-    return normalizeApiUrl(options.flags.get("api-url")
-        ?? environment.TENDER_ACCOUNTS_API_URL
-        ?? link?.apiUrl
-        ?? "https://agents.tenderprompt.dev");
-}
-async function resolveStoredLogin(apiUrl, profile, runtime) {
-    let stored = await runtime.authStore.read(profile);
-    if (!stored) {
-        throw new CliError("authentication_required", `Tender Accounts auth profile ${profile} is not logged in.`, authCommandForProfile(profile));
-    }
-    if (stored.apiUrl !== apiUrl) {
-        throw new CliError("auth_origin_mismatch", `The stored login belongs to ${stored.apiUrl}, not ${apiUrl}.`, `${authCommandForProfile(profile)} --api-url ${apiUrl}${profile === DEFAULT_AUTH_PROFILE ? " --force" : ""}`);
-    }
-    const oauth = new OAuthApiClient(apiUrl, runtime.fetcher);
-    if (stored.pendingDevice) {
-        const pendingDevice = stored.pendingDevice;
-        if (Date.parse(pendingDevice.expiresAt) <= Date.now()) {
-            await clearStoredProfile(runtime.authStore, profile, stored);
-            throw new CliError("device_authorization_expired", "The pending device authorization expired.", `${authCommandForProfile(profile)} --device --json`);
-        }
-        try {
-            const token = await oauth.exchangeDeviceCode(pendingDevice.deviceCode);
-            stored = await saveTokenResponse(runtime.authStore, profile, apiUrl, token, oauth, stored);
-        }
-        catch (error) {
-            if (error instanceof CliApiError && error.code === "authorization_pending") {
-                throw new CliError("authorization_pending", `Approve Tender CLI with code ${pendingDevice.userCode}.`, `Open ${pendingDevice.verificationUriComplete}, then run tender-accounts auth status --profile ${profile} --json.`);
-            }
-            throw error;
-        }
-    }
-    if (!stored.accessToken || !stored.accessTokenExpiresAt || !stored.refreshToken || !stored.refreshTokenExpiresAt) {
-        throw new CliError("authentication_required", "The stored Tender Accounts login is incomplete.", `${authCommandForProfile(profile)}${profile === DEFAULT_AUTH_PROFILE ? " --force" : ""}`);
-    }
-    if (Date.parse(stored.refreshTokenExpiresAt) <= Date.now()) {
-        await clearStoredProfile(runtime.authStore, profile, stored);
-        throw new CliError("authentication_expired", "The Tender Accounts login expired.", authCommandForProfile(profile));
-    }
-    if (Date.parse(stored.accessTokenExpiresAt) <= Date.now() + 30_000) {
-        try {
-            const token = await oauth.refresh(stored.refreshToken);
-            stored = await saveTokenResponse(runtime.authStore, profile, apiUrl, token, oauth, stored, true);
-        }
-        catch (error) {
-            if (!(error instanceof CliApiError && error.code === "invalid_grant"))
-                throw error;
-            const winner = await concurrentRefreshWinner(runtime.authStore, profile, stored);
-            if (!winner)
-                throw error;
-            stored = winner;
-        }
-    }
-    if (!stored.accessToken || !stored.accessTokenExpiresAt) {
-        throw new CliError("authentication_required", "Tender Accounts could not restore the stored login.", `${authCommandForProfile(profile)}${profile === DEFAULT_AUTH_PROFILE ? " --force" : ""}`);
-    }
-    return { accessToken: stored.accessToken, accessTokenExpiresAt: stored.accessTokenExpiresAt };
-}
-function authCommandForProfile(profile) {
-    return profile === DEFAULT_AUTH_PROFILE
-        ? "tender-accounts auth login"
-        : `tender-accounts auth create ${profile}`;
-}
-async function saveTokenResponse(store, profile, apiUrl, token, oauth, previous, acceptConcurrentRefreshWinner = false) {
-    const now = Date.now();
-    const stored = {
-        schema: CLI_AUTH_SCHEMA,
-        apiUrl,
-        accessToken: token.access_token,
-        accessTokenExpiresAt: new Date(now + token.expires_in * 1000).toISOString(),
-        refreshToken: token.refresh_token,
-        refreshTokenExpiresAt: new Date(now + token.refresh_expires_in * 1000).toISOString(),
-        ...(previous?.principal ? { principal: previous.principal } : {}),
-    };
-    if (!await store.compareAndSwap(profile, previous, stored)) {
-        try {
-            await oauth.revoke(token.refresh_token);
-        }
-        catch {
-            throw new CliError("auth_profile_race_revoke_failed", `Tender Accounts profile ${profile} changed while authentication was rotating, and the newly issued session could not be revoked safely.`, `Run tender-accounts auth status --profile ${profile} --json, then tender-accounts auth delete ${profile} if the session is not expected.`);
-        }
-        if (acceptConcurrentRefreshWinner && previous) {
-            const winner = await concurrentRefreshWinner(store, profile, previous);
-            if (winner)
-                return winner;
-        }
-        throw authProfileChanged(profile);
-    }
-    return stored;
-}
-async function concurrentRefreshWinner(store, profile, previous) {
-    const current = await store.read(profile);
-    if (!current
-        || current.apiUrl !== previous.apiUrl
-        || current.pendingDevice
-        || current.refreshToken === previous.refreshToken
-        || !sameStoredPrincipal(current, previous)
-        || !current.accessToken
-        || !current.accessTokenExpiresAt
-        || !current.refreshToken
-        || !current.refreshTokenExpiresAt
-        || Date.parse(current.accessTokenExpiresAt) <= Date.now() + 30_000
-        || Date.parse(current.refreshTokenExpiresAt) <= Date.now()) {
-        return null;
-    }
-    return current;
-}
-function sameStoredPrincipal(left, right) {
-    if (!left.principal || !right.principal)
-        return false;
-    return left.principal.tenantId === right.principal.tenantId
-        && left.principal.ownerEmail === right.principal.ownerEmail
-        && [...left.principal.projects].sort().join("\n") === [...right.principal.projects].sort().join("\n");
-}
-async function clearStoredProfile(store, profile, expected) {
-    if (!await store.compareAndSwap(profile, expected, null))
-        throw authProfileChanged(profile);
-}
-function authProfileChanged(profile) {
-    return new CliError("auth_profile_changed", `Tender Accounts profile ${profile} changed while this command was running. No newer local login was overwritten.`, `Run tender-accounts auth status --profile ${profile} --json, then retry the command.`);
-}
-async function waitForDeviceToken(oauth, pending, profile, runtime) {
-    const device = pending.pendingDevice;
-    if (!device)
-        throw new CliError("device_authorization_missing", "The device authorization was not saved.");
-    while (Date.parse(device.expiresAt) > Date.now()) {
-        try {
-            return await oauth.exchangeDeviceCode(device.deviceCode);
-        }
-        catch (error) {
-            if (!(error instanceof CliApiError && error.code === "authorization_pending"))
-                throw error;
-            await runtime.sleep(device.intervalSeconds * 1000);
-        }
-    }
-    await clearStoredProfile(runtime.authStore, profile, pending);
-    throw new CliError("device_authorization_expired", "The device authorization expired.", `${authCommandForProfile(profile)} --device --json`);
-}
-async function authenticatedLoginSummary(apiUrl, token, profile, runtime) {
-    const principal = await new AgentApiClient(apiUrl, token.access_token, runtime.fetcher).whoami();
-    await savePrincipalSummary(runtime.authStore, profile, principal);
-    return {
-        status: "authenticated",
-        flow: "oauth",
-        apiUrl,
-        profile,
-        ownerEmail: principal.ownerEmail,
-        tenantId: principal.tenantId,
-        projects: principal.projects,
-        accessTokenExpiresAt: new Date(Date.now() + token.expires_in * 1000).toISOString(),
-        storage: runtime.authStore.description(),
-        containsCredential: false,
-    };
-}
-async function savePrincipalSummary(store, profile, principal) {
-    const stored = await store.read(profile);
-    if (!stored)
-        return;
-    const updated = {
-        ...stored,
-        principal: {
-            tenantId: principal.tenantId,
-            ownerEmail: principal.ownerEmail,
-            projects: principal.projects.map(({ projectId }) => projectId),
-        },
-    };
-    if (!await store.compareAndSwap(profile, stored, updated))
-        throw authProfileChanged(profile);
-}
-async function sourceState(root, runtime) {
-    let revision;
-    try {
-        revision = (await runtime.captureCommand("git", ["rev-parse", "HEAD"], root)).stdout;
-    }
-    catch {
-        throw new CliError("source_revision_unavailable", "The app must be inside a Git repository with an initial commit before it can be packaged.", "git add . && git commit -m 'Initialize account app'");
-    }
-    if (!/^[a-f0-9]{40}$/u.test(revision)) {
-        throw new CliError("source_revision_unavailable", "Git did not return a 40-character source revision.");
-    }
-    const status = await runtime.captureCommand("git", ["status", "--porcelain", "--untracked-files=normal"], root);
-    return { revision, dirty: status.stdout.length > 0 };
-}
-async function waitForDelivery(client, initial, options, runtime) {
-    const timeoutSeconds = numberFlag(options, "timeout-seconds", 60, 1800, 900);
-    const deadline = Date.now() + timeoutSeconds * 1000;
-    let current = initial;
-    while (current.workflow.status === "requested" || current.workflow.status === "running") {
-        if (Date.now() >= deadline) {
-            throw new CliError("preview_timeout", `Preview deployment is still ${current.workflow.status}.`, `tender-accounts delivery status --delivery ${current.id} --json`);
-        }
-        await runtime.sleep(2000);
-        current = await client.delivery(current.id);
-    }
-    if (current.workflow.status !== "succeeded") {
-        throw new CliError(current.workflow.error?.code ?? "preview_failed", current.workflow.error?.message ?? "The preview workflow failed.", `tender-accounts delivery retry --delivery ${current.id} --json`);
-    }
-    return current;
-}
-function deliverySummary(projectId, submissionId, releaseId, delivery) {
-    return {
-        status: delivery.workflow.status,
-        projectId,
-        submissionId,
-        releaseId,
-        deliveryId: delivery.id,
-        workflowId: delivery.workflow.id,
-        compositionId: delivery.workflow.result?.compositionId ?? null,
-    };
-}
-function buildSummary(artifact, dirty) {
-    return {
-        status: "built",
-        app: artifact.envelope.manifest.app.slug,
-        sourceRevision: artifact.envelope.sourceRevision,
-        dirty,
-        bundleDigest: artifact.envelope.bundleDigest,
-        artifactDirectory: artifact.directory,
-        fileCount: artifact.fileCount,
-        totalBytes: artifact.totalBytes,
-        declaredResources: artifact.envelope.manifest.resources.length,
-        declaredServices: artifact.envelope.manifest.services.length,
-        declaredSecrets: artifact.envelope.manifest.secrets ?? [],
-    };
-}
-async function optionalContext(cwd) {
-    try {
-        return await loadProjectContext(cwd);
-    }
-    catch (error) {
-        if (error instanceof CliError && error.code === "file_missing")
-            return null;
-        throw error;
-    }
-}
-async function installSkill(cwd, options, runtime) {
-    const agent = options.flags.get("agent") ?? "codex";
-    const requestedDirectory = options.flags.get("directory");
-    const base = requestedDirectory
-        ? resolve(cwd, requestedDirectory)
-        : agent === "codex"
-            ? resolve(runtime.homeDirectory, ".agents/skills")
-            : agent === "claude"
-                ? resolve(runtime.homeDirectory, ".claude/skills")
-                : null;
-    if (!base) {
-        throw new CliError("skill_target_invalid", "--agent must be codex or claude unless --directory is provided.");
-    }
-    const target = resolve(base, "tender-accounts/SKILL.md");
-    if (await pathExists(target) && !options.booleans.has("force")) {
-        throw new CliError("skill_exists", `A Tender Accounts skill already exists at ${target}.`, `tender-accounts skill install --agent ${agent} --force`);
-    }
-    await mkdir(dirname(target), { recursive: true });
-    await copyFile(skillPath(), target);
-    return { status: "installed", agent, path: target };
-}
-async function readSkill() {
-    return await readFile(skillPath(), "utf8");
-}
-function skillPath() {
-    return fileURLToPath(new URL("../skill/tender-accounts/SKILL.md", import.meta.url));
-}
-function exampleConfig() {
-    return {
-        schema: CLI_CONFIG_SCHEMA,
-        commands: {
-            dev: "npm run dev",
-            check: "npm run check",
-            package: "npm run pack:tender",
-        },
-        artifactDirectory: ".tender/artifacts/current",
-        returnPath: "/account",
-    };
-}
-function commandTopic(argv) {
-    if (argv.length === 0 || argv[0] === "help" || argv[0] === "--help" || argv[0] === "-h") {
-        return { topic: "help", values: argv.slice(1) };
-    }
-    if (argv[0] === "--version" || argv[0] === "version")
-        return { topic: "version", values: argv.slice(1) };
-    const parent = argv[0];
-    if (parent === "auth" || parent === "delivery" || parent === "source" || parent === "skill" || parent === "config") {
-        const child = argv[1];
-        if (!child || child.startsWith("--"))
-            return { topic: "help", values: [parent] };
-        if (parent === "source" && (child === "default" || child === "history" || child === "operation" || child === "change")) {
-            const grandchild = argv[2];
-            if (!grandchild || grandchild.startsWith("--"))
-                return { topic: "help", values: [`${parent} ${child}`] };
-            if (argv.includes("--help") || argv.includes("-h")) {
-                return { topic: "help", values: [`${parent} ${child} ${grandchild}`] };
-            }
-            return { topic: `${parent} ${child} ${grandchild}`, values: argv.slice(3) };
-        }
-        if (argv.includes("--help") || argv.includes("-h"))
-            return { topic: "help", values: [`${parent} ${child}`] };
-        return { topic: `${parent} ${child}`, values: argv.slice(2) };
-    }
-    if (argv.includes("--help") || argv.includes("-h"))
-        return { topic: "help", values: [parent] };
-    const legacy = {
-        "auth-check": "auth status",
-        status: "delivery status",
-        "preview-session": "delivery preview",
-    };
-    return { topic: legacy[parent] ?? parent ?? "help", values: argv.slice(1) };
-}
-function parseOptions(values) {
-    const flags = new Map();
-    const booleans = new Set();
-    const positionals = [];
-    const booleanNames = new Set([
-        "json", "token-stdin", "dry-run", "no-wait", "force",
-        "device", "wait", "no-open", "local", "all", "production",
-    ]);
-    for (let index = 0; index < values.length; index += 1) {
-        const raw = values[index];
-        if (!raw?.startsWith("--")) {
-            if (raw)
-                positionals.push(raw);
-            continue;
-        }
-        const name = raw.slice(2);
-        if (name === "token") {
-            throw new CliError("credential_argument_forbidden", "Never pass credentials as command-line arguments.");
-        }
-        if (booleanNames.has(name)) {
-            if (booleans.has(name))
-                throw new CliError("argument_duplicate", `Duplicate --${name} option.`);
-            booleans.add(name);
-            continue;
-        }
-        const value = values[index + 1];
-        if (!value || value.startsWith("--") || flags.has(name)) {
-            throw new CliError("argument_value_missing", `Option --${name} requires exactly one value.`);
-        }
-        flags.set(name, value);
-        index += 1;
-    }
-    return { flags, booleans, positionals, json: booleans.has("json") };
-}
-function assertAllowedOptions(topic, options) {
-    const common = ["cwd", "json"];
-    const authentication = ["api-url", "token-stdin", "profile"];
-    const allowed = {
-        init: [...common, "name", "slug", "directory", "template", "dry-run"],
-        "config example": common,
-        "skill print": common,
-        "skill install": [...common, "agent", "directory", "force"],
-        dev: common,
-        check: common,
-        build: common,
-        "auth status": [...common, ...authentication],
-        "auth list": common,
-        "auth create": [...common, "api-url", "project", "client-name", "timeout-seconds", "device", "wait", "no-open"],
-        "auth delete": [...common, "local"],
-        "auth activate": common,
-        "auth deactivate": common,
-        "auth login": [...common, "api-url", "project", "client-name", "timeout-seconds", "device", "wait", "no-open", "force"],
-        "auth logout": [...common, "local", "all"],
-        link: [...common, ...authentication, "project"],
-        doctor: [...common, ...authentication],
-        preview: [
-            ...common,
-            ...authentication,
-            "dry-run",
-            "no-wait",
-            "submission-key",
-            "delivery-key",
-            "timeout-seconds",
-            "return-path",
-        ],
-        "source status": [...common, ...authentication, "project"],
-        "source branches": [...common, ...authentication, "project"],
-        "source log": [...common, ...authentication, "project", "branch", "limit"],
-        "source compare": [...common, ...authentication, "project", "base", "head"],
-        "source default set": [
-            ...common, ...authentication, "project", "branch", "expected-current",
-            "idempotency-key", "dry-run", "no-wait", "timeout-seconds",
-        ],
-        "source promote": [
-            ...common, ...authentication, "project", "head", "base", "expected-current",
-            "idempotency-key", "dry-run", "no-wait", "timeout-seconds",
-        ],
-        "source history replace": [
-            ...common, ...authentication, "project", "head", "target", "expected-current", "confirm",
-            "idempotency-key", "dry-run", "no-wait", "timeout-seconds",
-        ],
-        "source operation status": [...common, ...authentication, "operation"],
-        "source operation retry": [...common, ...authentication, "operation", "no-wait", "timeout-seconds"],
-        "source change create": [...common, ...authentication, "project", "title", "description", "base", "head"],
-        "source change list": [...common, ...authentication, "project", "state"],
-        "source change show": [...common, ...authentication, "change"],
-        "source change close": [...common, ...authentication, "change"],
-        "source connect": [
-            ...common,
-            ...authentication,
-            "repo-name",
-            "default-branch",
-            "publication",
-            "remote",
-            "install-command",
-            "working-directory",
-            "artifact-path",
-        ],
-        "source pull": [...common, ...authentication, "project", "remote", "dry-run"],
-        "source token": [...common, ...authentication, "ttl-seconds"],
-        "source push": [...common, ...authentication, "branch", "remote", "no-wait", "timeout-seconds"],
-        tail: [
-            ...common,
-            ...authentication,
-            "delivery",
-            "production",
-            "status",
-            "method",
-            "search",
-            "sampling-rate",
-        ],
-        "delivery status": [...common, ...authentication, "delivery"],
-        "delivery preview": [...common, ...authentication, "delivery", "return-path"],
-        "delivery retry": [...common, ...authentication, "delivery"],
-    };
-    const accepted = new Set(allowed[topic] ?? common);
-    const provided = [...options.flags.keys(), ...options.booleans];
-    const unexpected = provided.find((name) => !accepted.has(name));
-    if (unexpected) {
-        throw new CliError("argument_unknown", `Option --${unexpected} is not valid for ${topic}.`, `tender-accounts ${topic} --help`);
-    }
-    const positionalLimits = {
-        "auth create": { minimum: 1, maximum: 1 },
-        "auth delete": { minimum: 1, maximum: 1 },
-        "auth activate": { minimum: 1, maximum: 2 },
-        "auth deactivate": { minimum: 0, maximum: 1 },
-    };
-    const limit = positionalLimits[topic] ?? { minimum: 0, maximum: 0 };
-    if (options.positionals.length < limit.minimum) {
-        throw new CliError("argument_required", `Missing ${topic.startsWith("auth ") ? "profile name" : "argument"}.`, `tender-accounts ${topic} --help`);
-    }
-    if (options.positionals.length > limit.maximum) {
-        throw new CliError("argument_unexpected", `Unexpected argument: ${options.positionals[limit.maximum] ?? ""}.`, `tender-accounts ${topic} --help`);
-    }
-}
-function requiredPositional(options, index, label) {
-    const value = options.positionals[index];
-    if (!value)
-        throw new CliError("argument_required", `Missing ${label}.`);
-    return value;
-}
-function requiredFlag(options, name) {
-    const value = options.flags.get(name);
-    if (!value) {
-        throw new CliError("argument_required", `Missing --${name}.`, `tender-accounts delivery status --${name} <value> --json`);
-    }
-    return value;
-}
-function requiredDeliveryId(options) {
-    const value = requiredFlag(options, "delivery");
-    if (value.startsWith("dwf_")) {
-        throw new CliError("developer_delivery_id_required", "--delivery expects a dly_ developer-delivery ID, not a dwf_ production workflow ID.", "Merchant administrators resume a waiting production workflow from the app's Activity page.");
-    }
-    if (!/^dly_[A-Za-z0-9_-]{8,64}$/u.test(value)) {
-        throw new CliError("developer_delivery_id_required", "--delivery must be the dly_ developer-delivery ID returned by tender-accounts preview.");
-    }
-    return value;
-}
-function requiredStarterName(options) {
-    const value = options.flags.get("name");
-    if (!value) {
-        throw new CliError("argument_required", "Missing --name.", "tender-accounts init --name \"My customer account\" --directory ./my-account");
-    }
-    return value;
-}
-function numberFlag(options, name, minimum, maximum, fallback) {
-    const raw = options.flags.get(name);
-    if (!raw)
-        return fallback;
-    const value = Number(raw);
-    if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
-        throw new CliError("argument_invalid", `--${name} must be an integer between ${minimum} and ${maximum}.`);
-    }
-    return value;
-}
-function decimalFlag(options, name, minimumExclusive, maximum, fallback) {
-    const raw = options.flags.get(name);
-    if (!raw)
-        return fallback;
-    const value = Number(raw);
-    if (!Number.isFinite(value) || value <= minimumExclusive || value > maximum) {
-        throw new CliError("argument_invalid", `--${name} must be greater than ${minimumExclusive} and at most ${maximum}.`);
-    }
-    return value;
-}
-function csvFlag(options, name) {
-    const raw = options.flags.get(name);
-    if (!raw)
-        return [];
-    const values = [...new Set(raw.split(",").map((value) => value.trim()).filter(Boolean))];
-    if (values.length > 12 || values.some((value) => value.length > 32)) {
-        throw new CliError("argument_invalid", `--${name} has too many or overly long values.`);
-    }
-    return values;
-}
-function writeOutput(value, options, runtime) {
-    if (options.json) {
-        runtime.stdout.write(`${JSON.stringify(value)}\n`);
-        return;
-    }
-    if (isRecord(value) && typeof value.previewUrl === "string") {
-        runtime.stdout.write(`preview ready\nurl: ${value.previewUrl}\ndelivery_id: ${String(value.deliveryId ?? "")}\n`);
-        return;
-    }
-    if (isRecord(value) && Array.isArray(value.checks)) {
-        for (const check of value.checks) {
-            if (isRecord(check))
-                runtime.stdout.write(`${String(check.status).padEnd(4)} ${String(check.name)}: ${String(check.message)}\n`);
-        }
-        return;
-    }
-    runtime.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
-}
-function helpText(topic) {
-    const topics = {
-        init: "Usage: tender-accounts init --name NAME [--slug SLUG] [--directory PATH] [--template shopify-customer-account] [--dry-run] [--json]\n\nCreate a new merchant-owned Shopify gateway and React portal in an empty directory.\n\nExamples:\n  tender-accounts init --name \"Acme account\" --directory ./acme-account\n  tender-accounts init --name \"Acme account\" --directory ./acme-account --dry-run --json",
-        auth: "Usage: tender-accounts auth <login|create|activate|deactivate|status|list|delete|logout> [options]",
-        "auth login": "Usage: tender-accounts auth login [--device] [--project PROJECT_ID] [--no-open] [--wait] [--force] [--json]\n\nCreate or refresh the default login. Browser-capable terminals use Authorization Code with PKCE. --device returns an agent-safe approval URL and code; add --wait to keep polling. Use auth create for named merchant profiles.",
-        "auth create": "Usage: tender-accounts auth create NAME [--device] [--project PROJECT_ID] [--no-open] [--wait] [--json]\n\nCreate or re-authorize one named login without changing the active profile for any directory.\n\nExample:\n  tender-accounts auth create acme --device --project prj_... --json",
-        "auth activate": "Usage: tender-accounts auth activate NAME [DIRECTORY] [--json]\n\nActivate a named login for a directory and all descendants. A closer descendant binding wins. The binding is machine-local and is not written to the repository.",
-        "auth deactivate": "Usage: tender-accounts auth deactivate [DIRECTORY] [--json]\n\nRemove the binding declared exactly at the directory. An inherited binding must be removed at the ancestor that declares it.",
-        "auth delete": "Usage: tender-accounts auth delete NAME [--local] [--json]\n\nRevoke and delete one named login plus its directory bindings. --local keeps the remote session intact.",
-        "auth status": "Usage: tender-accounts auth status [--profile NAME] [--api-url URL] [--token-stdin] [--json]\n\nValidate the selected login or explicit project-scoped credential and list its permitted projects. Selection order is explicit profile, nearest private directory binding, then default. Repository files cannot select a local profile.",
-        "auth list": "Usage: tender-accounts auth list [--json]\n\nList locally stored profile names, expiration state, and bound directories without credentials or tenant metadata.",
-        "auth logout": "Usage: tender-accounts auth logout [--all] [--local] [--json]\n\nRevoke the default login. --local removes only the local copy; --all must be explicit to remove every login and directory binding.",
-        link: "Usage: tender-accounts link [--project PROJECT_ID] [--profile NAME] [--api-url URL] [--json]\n\nLink this checkout to exactly one project. The project ID remains a target guard; profile activation stays machine-local.",
-        doctor: "Usage: tender-accounts doctor [--json]\n\nValidate configuration, authentication, project scope, and local artifact readiness.",
-        dev: "Usage: tender-accounts dev\n\nRun the app's declared local development command. This starts local development and does not create a Tender deployment.",
-        check: "Usage: tender-accounts check [--json]\n\nRun the app's declared validation command.",
-        build: "Usage: tender-accounts build [--json]\n\nRun validation and packaging, then verify the complete portable artifact.",
-        preview: "Usage: tender-accounts preview [--dry-run] [--no-wait] [--timeout-seconds N] [--return-path /account] [--json]\n\nBuild and submit an exact preview. --dry-run validates locally without authentication or upload.",
-        source: "Usage: tender-accounts source <status|branches|log|compare|connect|pull|push|change|default|promote|history|operation> [options]\n\nUse standard Git through Tender for a gateway or service project. Source changes never publish production directly.",
-        "source status": "Usage: tender-accounts source status [--project PROJECT_ID] [--json]\n\nRead the managed repository, immutable build contract, and recent source builds. --project works before a checkout is linked.\n\nExamples:\n  tender-accounts source status --project prj_... --json\n  tender-accounts source status --json",
-        "source branches": "Usage: tender-accounts source branches [--project PROJECT_ID] [--json]\n\nList exact branch refs and identify Tender's authoritative default separately from the provider's create-time default. Uses a short-lived read credential without persisting it.",
-        "source log": "Usage: tender-accounts source log [--project PROJECT_ID] [--branch BRANCH] [--limit 20] [--json]\n\nRead bounded commit history from one exact managed branch without requiring a checkout.",
-        "source compare": "Usage: tender-accounts source compare [--project PROJECT_ID] --base BRANCH --head BRANCH [--json]\n\nCompare exact managed refs and report identical, fast-forward, behind, diverged, or unrelated history plus a bounded file list.",
-        "source default": "Usage: tender-accounts source default set --branch BRANCH --expected-current BRANCH [--dry-run] [--json]",
-        "source default set": "Usage: tender-accounts source default set [--project PROJECT_ID] --branch BRANCH --expected-current BRANCH [--idempotency-key KEY] [--dry-run] [--no-wait] [--json]\n\nSet an existing branch as Tender's authoritative default with compare-and-swap. This metadata-only operation cannot change production.",
-        "source promote": "Usage: tender-accounts source promote [--project PROJECT_ID] --head BRANCH [--base BRANCH] --expected-current SHA [--idempotency-key KEY] [--dry-run] [--no-wait] [--json]\n\nPromote a successfully previewed head into the current default branch using an exact expected-SHA lease. Normal preview/publication policy applies to the resulting push; protected gateways remain preview-only.",
-        "source history": "Usage: tender-accounts source history replace --head BRANCH --expected-current SHA --confirm REPOSITORY_ID [--dry-run] [--json]",
-        "source history replace": "Usage: tender-accounts source history replace [--project PROJECT_ID] --head BRANCH [--target BRANCH] --expected-current SHA --confirm REPOSITORY_ID [--idempotency-key KEY] [--dry-run] [--no-wait] [--json]\n\nExceptional source migration only: archive the exact previous target, then replace it with an expected-SHA compare-and-swap. Automatic production publication is always suppressed.",
-        "source operation": "Usage: tender-accounts source operation <status|retry> --operation sop_... [--json]",
-        "source operation status": "Usage: tender-accounts source operation status --operation sop_... [--json]\n\nRead durable status and safe evidence for one exact source operation.",
-        "source operation retry": "Usage: tender-accounts source operation retry --operation sop_... [--no-wait] [--timeout-seconds N] [--json]\n\nRetry or resume the same durable source operation without changing its reviewed intent. This never publishes production.",
-        "source change": "Usage: tender-accounts source change <create|list|show|close> [options]\n\nCreate and inspect exact preview-backed changes. Approval and landing stay merchant-admin actions in Tender.",
-        "source change create": "Usage: tender-accounts source change create --head BRANCH --title TITLE [--description TEXT] [--base BRANCH] [--json]\n\nOpen a review for the exact protected-base and feature-branch SHAs. Tender binds checks and approval to this immutable snapshot.",
-        "source change list": "Usage: tender-accounts source change list [--state open|closed|all] [--json]\n\nList reviewed source changes for this exact linked project.",
-        "source change show": "Usage: tender-accounts source change show --change scr_... [--json]\n\nRead exact snapshot, preview, decision, and landing state.",
-        "source change close": "Usage: tender-accounts source change close --change scr_... [--json]\n\nClose an unlanded change without changing source or production.",
-        "source connect": "Usage: tender-accounts source connect [--repo-name NAME] [--default-branch NAME] [--publication preview-only|default-branch] [--remote NAME] [--install-command COMMAND] [--working-directory PATH] [--artifact-path PATH] [--json]\n\nCreate or reconnect this linked project to Tender-managed Git. Build and artifact commands come from tender-accounts.json. Protected gateways accept preview-only publication.",
-        "source pull": "Usage: tender-accounts source pull [--project PROJECT_ID] [--remote NAME] [--dry-run] [--json]\n\nClone the exact connected Tender-managed repository into an empty workspace, or fast-forward an existing clean matching checkout. The app is linked automatically and the short-lived Git credential is never persisted.\n\nExamples:\n  tender-accounts source pull --project prj_... --dry-run --json\n  tender-accounts source pull --project prj_... --json\n  tender-accounts source pull --json",
-        "source token": "Usage: tender-accounts source token [--ttl-seconds N] [--json]\n\nIssue a short-lived read-only repository credential. It is shown once and is never stored by the CLI.",
-        "source push": "Usage: tender-accounts source push [--branch NAME] [--remote NAME] [--no-wait] [--json]\n\nPush the exact committed revision. Reviewed repositories upload a bounded Git bundle and never expose a write credential; the default branch remains protected. Dirty working-tree changes are excluded.",
-        tail: "Usage: tender-accounts tail (--delivery dly_... | --production) [--status ok,error,canceled] [--method GET,POST] [--search TEXT] [--sampling-rate 0.25] [--json]\n\nStream sanitized logs for this exact linked project. Preview tails require a succeeded dly_ delivery. Production tails require merchant-administrator authorization. Sessions expire after 15 minutes and do not persist events.",
-        delivery: "Usage: tender-accounts delivery <status|preview|retry> --delivery dly_... [--json]\n\nThese commands accept the developer-delivery ID returned by preview. A dwf_ ID is a production workflow managed by merchant administrators in Activity.",
-        "delivery status": "Usage: tender-accounts delivery status --delivery dly_... [--json]\n\nRead one developer preview delivery. Do not pass a dwf_ production workflow ID.",
-        "delivery preview": "Usage: tender-accounts delivery preview --delivery dly_... [--return-path /account] [--json]\n\nMint a fresh 15-minute same-domain preview session. Do not pass a dwf_ production workflow ID.",
-        "delivery retry": "Usage: tender-accounts delivery retry --delivery dly_... [--json]\n\nRetry one requested or failed developer preview idempotently. A dwf_ production workflow is resumed by a merchant administrator from Activity.",
-        skill: "Usage: tender-accounts skill <print|install> [options]",
-        "skill print": "Usage: tender-accounts skill print [--json]",
-        "skill install": "Usage: tender-accounts skill install [--agent codex|claude] [--directory PATH] [--force] [--json]\n\nInstall globally for the current user by default: ~/.agents/skills for Codex or ~/.claude/skills for Claude. --directory is an explicit custom or repository-local override.",
-        config: "Usage: tender-accounts config example [--json]",
-        "config example": "Usage: tender-accounts config example [--json]\n\nPrint the committed tender-accounts.json contract.",
-    };
-    if (topic && topics[topic])
-        return topics[topic];
-    return `Tender Accounts merchant developer CLI ${CLI_VERSION}\n\nCommands:\n  init              Create a new Shopify account starter\n  auth login        Create or refresh the default login\n  auth create       Create or re-authorize a named login\n  auth activate     Bind a named login to a directory tree\n  auth deactivate   Remove an exact directory binding\n  auth status       Validate one login or scoped credential\n  auth list         List local login profiles and bindings\n  auth delete       Revoke one named login\n  auth logout       Revoke the default or every login\n  link              Link this checkout to one permitted project\n  doctor            Check developer readiness\n  dev               Run the project-owned local dev command\n  check             Run project validation\n  build             Package and verify a portable artifact\n  preview           Build and deploy an exact preview\n  source status     Inspect Tender-managed Git and recent builds\n  source branches   List exact managed branches and default policy\n  source compare    Compare two managed branches\n  source connect    Connect this linked project to managed Git\n  source pull       Clone or fast-forward the exact connected repository\n  source token      Issue a short-lived repository credential\n  source push       Push the exact commit without persisting a token\n  source promote    Fast-forward the default after successful preview checks\n  source history    Run guarded, archived source-history migration\n  tail              Stream logs for one exact linked project\n  delivery status   Read preview workflow state\n  delivery preview  Mint a fresh preview session\n  delivery retry    Retry a failed preview workflow\n  skill install     Install the Tender Accounts agent skill\n  config example    Print the project configuration contract\n\nThere is intentionally no production publish command.\nRun tender-accounts <command> --help for examples.`;
-}
-function normalizeError(error) {
-    if (error instanceof CliApiError) {
-        return { code: error.code, message: error.message, ...(error.hint ? { hint: error.hint } : {}), ...(error.requestId ? { requestId: error.requestId } : {}) };
-    }
-    if (error instanceof CliError) {
-        return { code: error.code, message: error.message, ...(error.hint ? { hint: error.hint } : {}) };
-    }
-    return { code: "cli_failed", message: error instanceof Error ? error.message : "Tender Accounts CLI failed." };
-}
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-//# sourceMappingURL=main.js.map