@vendure/cloud 0.4.0 → 0.5.0-dev.20261016123507.ge07a06e

package/dist/cli/lib/contract/foreign-credentials.js

@@ -1,37 +1,26 @@
 // Mirrors `@vendure-cloud/api-types`'s `foreign-credentials.ts`. See ./README.md for why this
 // package cannot import it, and `test/cli-contract-parity.test.ts` for what keeps the two
-// answering the same. The refusal wording is shared with the control plane's `AuthGuard`, so it
-// is reproduced exactly rather than reworded for this caller.
+// answering the same. The refusal wording is shared with the control plane's `AuthGuard`, so it is
+// reproduced exactly.
 /**
- * Credentials that other Vendure products issue, and that a Vendure Cloud
- * management request must never authenticate with.
+ * Credentials that other Vendure products issue, and that a Vendure Cloud management request must
+ * never authenticate with.
  *
- * Two call sites read this file, and they are the two places a customer's
- * credential is taken in: `resolveCredential` in the CLI, which refuses the
- * value before it leaves the machine, and `AuthGuard` in the control plane,
- * which refuses it again for every caller that is not this CLI. Restating
- * either the prefixes or the refusal at one of those places would let them
- * drift, and a drifted denylist is one that has a hole in it.
+ * `resolveCredential` in the CLI refuses the value before it leaves the machine, and `AuthGuard` in
+ * the control plane refuses it for every other caller. Both read this file, so the prefixes and the
+ * refusal cannot drift apart.
  *
- * `AdminGuard` and `StaffAuthGuard` also take a bearer token and are
- * deliberately not covered. The token they verify is a staff session this
- * platform issued and signs, checked locally against our own key, so a value
- * from another Vendure product is refused there on its own and is never handed
- * to anyone. The property this file protects — that a first-party credential
- * is not forwarded to a third party — has nothing to reach on those routes.
+ * `AdminGuard` and `StaffAuthGuard` are not covered. They verify a staff session this platform
+ * signs, so a value from another Vendure product fails there on its own.
  *
- * `vce_` is the project-scoped Environment Credential that Vendure Platform
- * writes to `<projectRoot>/.vendure/credentials.json` and injects into a
- * running Vendure process. `vcli_` and `vclr_` are the access and refresh
- * halves of the user-scoped Console CLI Session in
+ * `vce_` is the project-scoped Environment Credential that Vendure Platform writes to
+ * `<projectRoot>/.vendure/credentials.json` and injects into a running Vendure process. `vcli_` and
+ * `vclr_` are the access and refresh halves of the user-scoped Console CLI Session in
  * `~/.vendure/console-credentials.json`.
  *
- * `vcli_` is refused as an API key only. A Console session presented as
- * `Authorization: Bearer` is resolved by the control plane against Console's
- * introspection route (CLO-641), which is the one place that can check it, and
- * only on a deployment configured to reach a Console. Presenting it through
- * `--token`, `VENDURE_CLOUD_TOKEN` or `x-api-key` is still a mistake, because
- * none of those paths reaches that check.
+ * `vcli_` is refused as an API key only. The control plane resolves a Console session sent as
+ * `Authorization: Bearer` against Console's introspection route (CLO-641), when configured to reach
+ * a Console. `--token`, `VENDURE_CLOUD_TOKEN` and `x-api-key` never reach that check.
  */
 export const ENVIRONMENT_CREDENTIAL_PREFIX = "vce_";
 export const CONSOLE_SESSION_TOKEN_PREFIX = "vcli_";
@@ -47,16 +36,14 @@ const PREFIXES = [
     [CONSOLE_REFRESH_TOKEN_PREFIX, ForeignCredential.CONSOLE_REFRESH],
 ];
 const REFUSALS = {
-    [ForeignCredential.ENVIRONMENT]: "A Vendure project environment credential cannot manage Vendure Cloud. It authenticates one environment of one project. Use a Vendure Cloud API key, or run `vcloud login`.",
-    [ForeignCredential.CONSOLE_SESSION]: "A Vendure Console session is not a Vendure Cloud API key. Vendure Cloud reads your Console session from `~/.vendure/console-credentials.json` on its own. Use a Vendure Cloud API key here, or run `vcloud login`.",
-    [ForeignCredential.CONSOLE_REFRESH]: "A Vendure Console refresh token is not a credential Vendure Cloud accepts. Use a Vendure Cloud API key, or run `vcloud login`.",
+    [ForeignCredential.ENVIRONMENT]: "A Vendure project environment credential cannot manage Vendure Cloud. It authenticates one environment of one project. Use a Vendure Cloud API key, or run `vendure auth login`.",
+    [ForeignCredential.CONSOLE_SESSION]: "A Vendure Console session is not a Vendure Cloud API key. Use a Vendure Cloud API key here, or run `vendure auth login` to sign in with the Vendure CLI.",
+    [ForeignCredential.CONSOLE_REFRESH]: "A Vendure Console refresh token is not a credential Vendure Cloud accepts. Use a Vendure Cloud API key, or run `vendure auth login`.",
 };
 /**
  * Which foreign credential this value is, or null when it is none of them.
  *
- * A denylist, not a shape check. Anything that is not recognised here is left
- * alone and validated as it always was, so a legitimate credential can never be
- * turned away by this function.
+ * A denylist, not a shape check, so a legitimate credential is never turned away here.
  */
 export function classifyForeignCredential(value) {
     for (const [prefix, kind] of PREFIXES) {

package/dist/cli/lib/contract/foreign-credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"foreign-credentials.js","sourceRoot":"","sources":["../../../../src/cli/lib/contract/foreign-credentials.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,0FAA0F;AAC1F,gGAAgG;AAChG,8DAA8D;AAE9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AACpD,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC;AACpD,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC;AAEpD,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,WAAW,EAAE,aAAa;IAC1B,eAAe,EAAE,gBAAgB;IACjC,eAAe,EAAE,gBAAgB;CACzB,CAAC;AAGX,MAAM,QAAQ,GAAwD;IACpE,CAAC,6BAA6B,EAAE,iBAAiB,CAAC,WAAW,CAAC;IAC9D,CAAC,4BAA4B,EAAE,iBAAiB,CAAC,eAAe,CAAC;IACjE,CAAC,4BAA4B,EAAE,iBAAiB,CAAC,eAAe,CAAC;CAClE,CAAC;AAEF,MAAM,QAAQ,GAAsC;IAClD,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAC7B,4KAA4K;IAC9K,CAAC,iBAAiB,CAAC,eAAe,CAAC,EACjC,oNAAoN;IACtN,CAAC,iBAAiB,CAAC,eAAe,CAAC,EACjC,gIAAgI;CACnI,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,wBAAwB,CAAC,IAAuB;IAC9D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC"}
+{"version":3,"file":"foreign-credentials.js","sourceRoot":"","sources":["../../../../src/cli/lib/contract/foreign-credentials.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,0FAA0F;AAC1F,mGAAmG;AACnG,sBAAsB;AAEtB;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AACpD,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC;AACpD,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC;AAEpD,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,WAAW,EAAE,aAAa;IAC1B,eAAe,EAAE,gBAAgB;IACjC,eAAe,EAAE,gBAAgB;CACzB,CAAC;AAGX,MAAM,QAAQ,GAAwD;IACpE,CAAC,6BAA6B,EAAE,iBAAiB,CAAC,WAAW,CAAC;IAC9D,CAAC,4BAA4B,EAAE,iBAAiB,CAAC,eAAe,CAAC;IACjE,CAAC,4BAA4B,EAAE,iBAAiB,CAAC,eAAe,CAAC;CAClE,CAAC;AAEF,MAAM,QAAQ,GAAsC;IAClD,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAC7B,kLAAkL;IACpL,CAAC,iBAAiB,CAAC,eAAe,CAAC,EACjC,0JAA0J;IAC5J,CAAC,iBAAiB,CAAC,eAAe,CAAC,EACjC,sIAAsI;CACzI,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,wBAAwB,CAAC,IAAuB;IAC9D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC"}

package/dist/cli/lib/contract/logs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logs.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/contract/logs.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,YAAY,+BAAgC,CAAC;AAC1D,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,UAAU,CAE/D;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE;QACX,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE;QACf,MAAM,EAAE,kBAAkB,CAAC;KAC5B,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE;QACd,MAAM,EAAE,qBAAqB,CAAC;KAC/B,CAAC;CACH;AAOD,eAAO,MAAM,sBAAsB,gFAMzB,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAOD,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI;IACnD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAgBA;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CASlF;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,uBAAuB,CAQ1F;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,sBAAsB,CAQxF;AAmBD,eAAO,MAAM,WAAW,4CAA0C,CAAC;AACnE,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,SAAS,CAE7D;AAED,eAAO,MAAM,cAAc,wDAAyD,CAAC;AACrF,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAO1D,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,WAAW,CAEjE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,WAAW,GAAG,IAAI,CAKxF;AAMD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAcjE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAE7D;AAKD,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,WAAW,GAAG,IAAI,EAC5B,OAAO,EAAE,WAAW,GAAG,IAAI,GAC1B,OAAO,CAGT;AAED,eAAO,MAAM,uBAAuB,6LAY1B,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E,eAAO,MAAM,4BAA4B,4DAI/B,CAAC;AACX,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC;AAErF,eAAO,MAAM,iCAAiC,2CAA4C,CAAC;AAC3F,MAAM,MAAM,6BAA6B,GAAG,CAAC,OAAO,iCAAiC,CAAC,CAAC,MAAM,CAAC,CAAC;AAK/F,eAAO,MAAM,iBAAiB,+FAOpB,CAAC;AACX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,WAAW,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAKD,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,OAAO,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,qBAAqB,EAAE,6BAA6B,GAAG,IAAI,CAAC;IAC5D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,eAAe,EAAE,WAAW,GAAG,IAAI,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,mBAAmB,CAAC;IAC3B,gBAAgB,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAClD,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,YAAY,CAAC;IACxB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,OAAO,EAAE,eAAe,CAAC;CAC1B;AAED,eAAO,MAAM,kBAAkB,4BAA6B,CAAC;AAC7D,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE,eAAO,MAAM,iBAAiB,oDAAqD,CAAC;AACpF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,eAAe,CAAC;IACxB,KAAK,EAAE,cAAc,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAClD,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACnC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,SAAS,CAAC;IAClB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,uBAAuB,EAAE,MAAM,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,eAAe,EAAE,CAAC;IACjC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,uBAAuB,EAAE,MAAM,CAAC;IAChC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,mBAAmB,EAAE,CAAC;CAChC"}
+{"version":3,"file":"logs.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/contract/logs.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,YAAY,+BAAgC,CAAC;AAC1D,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,UAAU,CAE/D;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE;QACX,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE;QACf,MAAM,EAAE,kBAAkB,CAAC;KAC5B,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE;QACd,MAAM,EAAE,qBAAqB,CAAC;KAC/B,CAAC;CACH;AAMD,eAAO,MAAM,sBAAsB,gFAMzB,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAKD,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI;IACnD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAgBA;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CASlF;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,uBAAuB,CAQ1F;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,sBAAsB,CAQxF;AAkBD,eAAO,MAAM,WAAW,4CAA0C,CAAC;AACnE,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,SAAS,CAE7D;AAED,eAAO,MAAM,cAAc,wDAAyD,CAAC;AACrF,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAO1D,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,WAAW,CAEjE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,WAAW,GAAG,IAAI,CAKxF;AAKD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAcjE;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAE7D;AAID,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,WAAW,GAAG,IAAI,EAC5B,OAAO,EAAE,WAAW,GAAG,IAAI,GAC1B,OAAO,CAGT;AAED,eAAO,MAAM,uBAAuB,6LAY1B,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E,eAAO,MAAM,4BAA4B,4DAI/B,CAAC;AACX,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC;AAErF,eAAO,MAAM,iCAAiC,2CAA4C,CAAC;AAC3F,MAAM,MAAM,6BAA6B,GAAG,CAAC,OAAO,iCAAiC,CAAC,CAAC,MAAM,CAAC,CAAC;AAI/F,eAAO,MAAM,iBAAiB,+FAOpB,CAAC;AACX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,WAAW,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAID,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,OAAO,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,qBAAqB,EAAE,6BAA6B,GAAG,IAAI,CAAC;IAC5D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,eAAe,EAAE,WAAW,GAAG,IAAI,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,mBAAmB,CAAC;IAC3B,gBAAgB,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAClD,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,YAAY,CAAC;IACxB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,OAAO,EAAE,eAAe,CAAC;CAC1B;AAED,eAAO,MAAM,kBAAkB,4BAA6B,CAAC;AAC7D,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE,eAAO,MAAM,iBAAiB,oDAAqD,CAAC;AACpF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,eAAe,CAAC;IACxB,KAAK,EAAE,cAAc,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAClD,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACnC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,SAAS,CAAC;IAClB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,uBAAuB,EAAE,MAAM,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,eAAe,EAAE,CAAC;IACjC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,uBAAuB,EAAE,MAAM,CAAC;IAChC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,mBAAmB,EAAE,CAAC;CAChC"}

package/dist/cli/lib/contract/logs.js

@@ -1,23 +1,21 @@
 // Mirrors the environment log and build log wire contract from `@vendure-cloud/api-types`'s
 // `index.ts`. See ./README.md for why this package cannot import it, including as types.
 //
-// `GET /environments/{id}/logs` returns `LogEntry[]`. Nothing in this package calls it since
-// CLO-891: `logs` reads the Project-scoped query below, and only the stream route is still read
-// from here. `GET /environments/{id}/logs/stream`
-// (`?service=<LogService>&lines=<history replay count>`) is SSE: it replays recent history, then
-// tails; each frame's data is a JSON `LogEntry`. Handler-level failures cannot use an HTTP status,
-// because SSE commits the 200 before the handler runs, so they arrive as a single
-// `LogStreamErrorFrame` followed by a clean close — consumers gate on it the way they would gate on
-// the status. Keepalives are frames with empty data and SSE parsers drop them.
+// `GET /environments/{id}/logs` returns `LogEntry[]`; only the stream route is read from this
+// package since CLO-891, and `logs` reads the Project-scoped query below.
+// `GET /environments/{id}/logs/stream` (`?service=<LogService>&lines=<history replay count>`) is
+// SSE: it replays recent history, then tails, and each frame's data is a JSON `LogEntry`. SSE
+// commits the 200 before the handler runs, so handler failures arrive as a single
+// `LogStreamErrorFrame` followed by a clean close. Keepalives are frames with empty data and SSE
+// parsers drop them.
 export const LOG_SERVICES = ["server", "worker"];
 export function isLogService(value) {
     return LOG_SERVICES.includes(value);
 }
-// NO_OUTPUT and EXPIRED are the same absence seen from two distances. A build can fail before it
-// has a log stream at all — a role or an image the build service cannot use fails it in its queued
-// phase, with no container and nothing written — and reporting that as EXPIRED tells a customer
-// their log aged out on a build that ran minutes ago. The reason for such a failure is on the VC
-// Deployment's own status message rather than in a log.
+// NO_OUTPUT and EXPIRED are the same absence seen from two distances. A build can fail in its
+// queued phase with no log stream, for a role or image the build service cannot use. Reporting that
+// as EXPIRED tells a customer their log aged out on a build that ran minutes ago. The reason is on
+// the VC Deployment's status message.
 export const BUILD_LOG_AVAILABILITY = [
     "AVAILABLE",
     "NOT_STARTED",
@@ -25,11 +23,9 @@ export const BUILD_LOG_AVAILABILITY = [
     "NO_OUTPUT",
     "EXPIRED",
 ];
-// Runtime guards for stream consumers: each SSE frame is untrusted until
-// shape-checked — a drifted producer must never render garbage as log lines.
-// The guard deliberately accepts older producers without `id`/`timestamp`;
-// consumers can degrade display while the current producer contract remains
-// the stricter LogEntry interface above.
+// Runtime guards for stream consumers: an SSE frame is untrusted until shape-checked. The guard
+// accepts older producers without `id` or `timestamp`, which the stricter `LogEntry` above
+// requires.
 export function isLogEntry(value) {
     if (typeof value !== "object" || value === null)
         return false;
@@ -72,15 +68,14 @@ export function isLogStreamTerminalFrame(value) {
 // `GET /projects/{projectId}/log-exports/{exportId}/download` and
 // `GET /projects/{projectId}/log-capabilities`.
 //
-// An export is created and then re-read until it reports `READY`; the download route is what
-// `LogExportDownload.url` names, so redeeming one carries the caller's own credential.
+// An export is re-read until it reports `READY`. `LogExportDownload.url` names the download route,
+// so redeeming it carries the caller's own credential.
 //
-// A cursor is opaque and composed by the server: this package neither reads one nor builds one. An
-// event's identity is the provider's own event id, carried as `LogQueryEvent.id`, and is what a
-// resumed read de-duplicates on.
+// A cursor is opaque and composed by the server. An event's identity is the provider's event id,
+// `LogQueryEvent.id`, which a resumed read de-duplicates on.
 //
-// `CLOSED_BETA_LOG_CAPABILITIES` is deliberately not mirrored. The bounds a caller is held to are
-// read from the capability resource over the wire, so the CLI has no copy of them to go stale.
+// `CLOSED_BETA_LOG_CAPABILITIES` is not mirrored. The CLI reads the bounds from the capability
+// resource, so it holds no copy to go stale.
 export const LOG_SOURCES = ["migration", ...LOG_SERVICES];
 export function isLogSource(value) {
     return LOG_SOURCES.includes(value);
@@ -102,9 +97,8 @@ export function classifyLogSeverity(value) {
     return LOG_SEVERITY_ALIASES.get(normalized) ?? null;
 }
 // The level a structured line declares, or null for a line this contract does not read one from.
-// The eligibility rule is the schema observed on the wire: a JSON object with a non-blank string
-// `message`. Returns the word the producer wrote rather than a severity, because a renderer wants
-// the first and a threshold wants `classifyLogSeverity` over it.
+// Eligible lines are JSON objects with a non-blank string `message`. Returns the word the producer
+// wrote, not a severity. A threshold applies `classifyLogSeverity` to it.
 export function structuredLogLevel(message) {
     const trimmed = message.trim();
     if (!trimmed.startsWith("{") || !trimmed.endsWith("}"))
@@ -128,9 +122,8 @@ export function structuredLogLevel(message) {
 export function logSeverityRank(severity) {
     return LOG_SEVERITIES.indexOf(severity);
 }
-// An unclassified line passes every threshold, including the most severe one. The server applies
-// this function to compose a page and a client applies it to render one, so both sides answer the
-// same way about a line whose level nothing could parse.
+// An unclassified line passes every threshold, including the most severe one. The server composes
+// a page with this function and a client renders it with the same one, so both agree.
 export function passesMinimumSeverity(severity, minimum) {
     if (minimum === null || severity === null)
         return true;
@@ -155,9 +148,8 @@ export const LOG_QUERY_TRUNCATION_REASONS = [
     "EXPORT_LIMIT",
 ];
 export const LOG_QUERY_DEPLOYMENT_CORRELATIONS = ["TIME_WINDOW", "TASK_IDENTITY"];
-// Include and exclude are one term each, matched as a case-sensitive literal substring of the line,
-// with the exclusion winning where both match. Minimum severity keeps every classified line at or
-// above the named severity and every line the contract cannot classify.
+// Include and exclude are one term each, a case-sensitive literal substring, and exclusion wins
+// where both match. Minimum severity keeps every line at or above it and every unclassifiable line.
 export const LOG_QUERY_FILTERS = [
     "TIME",
     "SOURCE",

package/dist/cli/lib/contract/logs.js.map

@@ -1 +1 @@
-{"version":3,"file":"logs.js","sourceRoot":"","sources":["../../../../src/cli/lib/contract/logs.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,yFAAyF;AACzF,EAAE;AACF,6FAA6F;AAC7F,gGAAgG;AAChG,kDAAkD;AAClD,iGAAiG;AACjG,mGAAmG;AACnG,kFAAkF;AAClF,oGAAoG;AACpG,+EAA+E;AAE/E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAG1D,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAQ,YAAkC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AA6BD,iGAAiG;AACjG,mGAAmG;AACnG,gGAAgG;AAChG,iGAAiG;AACjG,wDAAwD;AACxD,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,WAAW;IACX,aAAa;IACb,eAAe;IACf,WAAW;IACX,SAAS;CACD,CAAC;AASX,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,yCAAyC;AACzC,MAAM,UAAU,UAAU,CAAC,KAAc;IAOvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,SAAS,GAAG,KAMjB,CAAC;IACF,OAAO,CACL,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;QACrC,CAAC,SAAS,CAAC,EAAE,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC;QAChE,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,CAAC;QAC9E,CAAC,SAAS,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC;QAChF,CAAC,SAAS,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,YAAY,KAAK,QAAQ,CAAC,CACrF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,aAAa,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3F,MAAM,SAAS,GAAI,KAAkC,CAAC,WAAW,CAAC;IAClE,OAAO,CACL,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,KAAK,IAAI;QAClB,OAAQ,SAAsC,CAAC,UAAU,KAAK,QAAQ;QACtE,OAAQ,SAAmC,CAAC,OAAO,KAAK,QAAQ,CACjE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,iBAAiB,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/F,MAAM,SAAS,GAAI,KAAsC,CAAC,eAAe,CAAC;IAC1E,OAAO,CACL,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,KAAK,IAAI;QACjB,SAAkC,CAAC,MAAM,KAAK,kBAAkB,CAClE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,gBAAgB,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9F,MAAM,SAAS,GAAI,KAAqC,CAAC,cAAc,CAAC;IACxE,OAAO,CACL,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,KAAK,IAAI;QACjB,SAAkC,CAAC,MAAM,KAAK,qBAAqB,CACrE,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,6EAA6E;AAC7E,4FAA4F;AAC5F,sDAAsD;AACtD,kEAAkE;AAClE,gDAAgD;AAChD,EAAE;AACF,6FAA6F;AAC7F,uFAAuF;AACvF,EAAE;AACF,mGAAmG;AACnG,gGAAgG;AAChG,iCAAiC;AACjC,EAAE;AACF,kGAAkG;AAClG,+FAA+F;AAE/F,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,WAAW,EAAE,GAAG,YAAY,CAAU,CAAC;AAGnE,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAQ,WAAiC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAGrF,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAsB;IACxD,CAAC,SAAS,EAAE,MAAM,CAAC;IACnB,CAAC,OAAO,EAAE,OAAO,CAAC;CACnB,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAQ,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAgC;IAClE,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,aAAa,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IACjD,OAAO,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;AACtD,CAAC;AAED,iGAAiG;AACjG,iGAAiG;AACjG,kGAAkG;AAClG,iEAAiE;AACjE,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,MAAM,MAAM,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;IACtD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACpF,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChF,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAqB;IACnD,OAAO,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,iGAAiG;AACjG,kGAAkG;AAClG,yDAAyD;AACzD,MAAM,UAAU,qBAAqB,CACnC,QAA4B,EAC5B,OAA2B;IAE3B,IAAI,OAAO,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,eAAe,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,WAAW;IACX,SAAS;IACT,SAAS;IACT,YAAY;IACZ,SAAS;IACT,iBAAiB;IACjB,2BAA2B;IAC3B,oBAAoB;IACpB,eAAe;IACf,cAAc;IACd,aAAa;CACL,CAAC;AAGX,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,iBAAiB;IACjB,YAAY;IACZ,cAAc;CACN,CAAC;AAGX,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAU,CAAC;AAG3F,oGAAoG;AACpG,kGAAkG;AAClG,wEAAwE;AACxE,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,cAAc;IACd,cAAc;IACd,kBAAkB;CACV,CAAC;AAsEX,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAU,CAAC;AAG7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAU,CAAC"}
+{"version":3,"file":"logs.js","sourceRoot":"","sources":["../../../../src/cli/lib/contract/logs.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,yFAAyF;AACzF,EAAE;AACF,8FAA8F;AAC9F,0EAA0E;AAC1E,iGAAiG;AACjG,8FAA8F;AAC9F,kFAAkF;AAClF,iGAAiG;AACjG,qBAAqB;AAErB,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAG1D,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAQ,YAAkC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AA6BD,8FAA8F;AAC9F,oGAAoG;AACpG,mGAAmG;AACnG,sCAAsC;AACtC,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,WAAW;IACX,aAAa;IACb,eAAe;IACf,WAAW;IACX,SAAS;CACD,CAAC;AASX,gGAAgG;AAChG,2FAA2F;AAC3F,YAAY;AACZ,MAAM,UAAU,UAAU,CAAC,KAAc;IAOvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,SAAS,GAAG,KAMjB,CAAC;IACF,OAAO,CACL,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;QACrC,CAAC,SAAS,CAAC,EAAE,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC;QAChE,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,CAAC;QAC9E,CAAC,SAAS,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC;QAChF,CAAC,SAAS,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,YAAY,KAAK,QAAQ,CAAC,CACrF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,aAAa,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3F,MAAM,SAAS,GAAI,KAAkC,CAAC,WAAW,CAAC;IAClE,OAAO,CACL,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,KAAK,IAAI;QAClB,OAAQ,SAAsC,CAAC,UAAU,KAAK,QAAQ;QACtE,OAAQ,SAAmC,CAAC,OAAO,KAAK,QAAQ,CACjE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,iBAAiB,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/F,MAAM,SAAS,GAAI,KAAsC,CAAC,eAAe,CAAC;IAC1E,OAAO,CACL,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,KAAK,IAAI;QACjB,SAAkC,CAAC,MAAM,KAAK,kBAAkB,CAClE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,gBAAgB,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9F,MAAM,SAAS,GAAI,KAAqC,CAAC,cAAc,CAAC;IACxE,OAAO,CACL,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,KAAK,IAAI;QACjB,SAAkC,CAAC,MAAM,KAAK,qBAAqB,CACrE,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,6EAA6E;AAC7E,4FAA4F;AAC5F,sDAAsD;AACtD,kEAAkE;AAClE,gDAAgD;AAChD,EAAE;AACF,mGAAmG;AACnG,uDAAuD;AACvD,EAAE;AACF,iGAAiG;AACjG,6DAA6D;AAC7D,EAAE;AACF,+FAA+F;AAC/F,6CAA6C;AAE7C,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,WAAW,EAAE,GAAG,YAAY,CAAU,CAAC;AAGnE,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAQ,WAAiC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAGrF,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAsB;IACxD,CAAC,SAAS,EAAE,MAAM,CAAC;IACnB,CAAC,OAAO,EAAE,OAAO,CAAC;CACnB,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAQ,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAgC;IAClE,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,aAAa,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IACjD,OAAO,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;AACtD,CAAC;AAED,iGAAiG;AACjG,mGAAmG;AACnG,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,MAAM,MAAM,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;IACtD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACpF,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChF,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAqB;IACnD,OAAO,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,kGAAkG;AAClG,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CACnC,QAA4B,EAC5B,OAA2B;IAE3B,IAAI,OAAO,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,eAAe,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,WAAW;IACX,SAAS;IACT,SAAS;IACT,YAAY;IACZ,SAAS;IACT,iBAAiB;IACjB,2BAA2B;IAC3B,oBAAoB;IACpB,eAAe;IACf,cAAc;IACd,aAAa;CACL,CAAC;AAGX,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,iBAAiB;IACjB,YAAY;IACZ,cAAc;CACN,CAAC;AAGX,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAU,CAAC;AAG3F,gGAAgG;AAChG,oGAAoG;AACpG,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,cAAc;IACd,cAAc;IACd,kBAAkB;CACV,CAAC;AAqEX,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAU,CAAC;AAG7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAU,CAAC"}

package/dist/cli/lib/contract/managed-email.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"managed-email.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/contract/managed-email.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,6BAA6B,sDAAuD,CAAC;AAClG,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AAKtF,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,KAAK,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAKD,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,wBAAwB,CAAC;IACjC,eAAe,EAAE,2BAA2B,CAAC;IAC7C,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,OAAO,CAAC;IACxB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,0BAA0B,EAAE,CAAC;CACvC;AAKD,MAAM,WAAW,+BAA+B;IAC9C,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,oCAAoC;IACnD,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAID,eAAO,MAAM,yBAAyB,8HAU5B,CAAC;AACX,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/E,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,qBAAqB,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,yBAAyB,EAAE,CAAC;CACrC;AAKD,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B"}
+{"version":3,"file":"managed-email.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/contract/managed-email.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,6BAA6B,sDAAuD,CAAC;AAClG,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AAItF,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,KAAK,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAID,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,wBAAwB,CAAC;IACjC,eAAe,EAAE,2BAA2B,CAAC;IAC7C,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,OAAO,CAAC;IACxB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,0BAA0B,EAAE,CAAC;CACvC;AAKD,MAAM,WAAW,+BAA+B;IAC9C,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,oCAAoC;IACnD,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAID,eAAO,MAAM,yBAAyB,8HAU5B,CAAC;AACX,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/E,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,qBAAqB,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,yBAAyB,EAAE,CAAC;CACrC;AAKD,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B"}

package/dist/cli/lib/contract/managed-email.js

@@ -1,9 +1,8 @@
 // Mirrors `packages/api-types/src/managed-email.ts`. See ./README.md for why this package cannot
 // import `@vendure-cloud/api-types`, and `test/cli-contract-drift.test.ts` for what holds the two
 // declarations identical.
-// `ownership_verified` is deliberately not spelled `verified`: it says the customer controls the
-// domain, which is one of the two things a domain needs before it can send. `sendingEnabled` below
-// is the answer to whether it can send.
+// `ownership_verified` is not spelled `verified`: it says the customer controls the domain, one of
+// the two things a domain needs before it can send. `sendingEnabled` says whether it can send.
 export const MANAGED_EMAIL_DOMAIN_STATUSES = ["pending", "ownership_verified", "failed"];
 // One vocabulary for what a customer is told happened to a message, whichever provider reported it.
 // `accepted` is the metered event: an accepted submission counts even if it later bounces.

package/dist/cli/lib/contract/managed-email.js.map

@@ -1 +1 @@
-{"version":3,"file":"managed-email.js","sourceRoot":"","sources":["../../../../src/cli/lib/contract/managed-email.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,kGAAkG;AAClG,0BAA0B;AAE1B,iGAAiG;AACjG,mGAAmG;AACnG,wCAAwC;AACxC,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,SAAS,EAAE,oBAAoB,EAAE,QAAQ,CAAU,CAAC;AAkDlG,oGAAoG;AACpG,2FAA2F;AAC3F,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,UAAU;IACV,WAAW;IACX,aAAa;IACb,aAAa;IACb,WAAW;IACX,YAAY;IACZ,UAAU;IACV,QAAQ;IACR,SAAS;CACD,CAAC"}
+{"version":3,"file":"managed-email.js","sourceRoot":"","sources":["../../../../src/cli/lib/contract/managed-email.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,kGAAkG;AAClG,0BAA0B;AAE1B,mGAAmG;AACnG,+FAA+F;AAC/F,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,SAAS,EAAE,oBAAoB,EAAE,QAAQ,CAAU,CAAC;AAgDlG,oGAAoG;AACpG,2FAA2F;AAC3F,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,UAAU;IACV,WAAW;IACX,aAAa;IACb,aAAa;IACb,WAAW;IACX,YAAY;IACZ,UAAU;IACV,QAAQ;IACR,SAAS;CACD,CAAC"}

package/dist/cli/lib/contract/permission-denied.d.ts

@@ -0,0 +1,16 @@
+export declare const PERMISSION_DENIED_CODE = "PERMISSION_DENIED";
+export declare const PermissionDeniedScope: {
+    readonly ORGANIZATION: "organization";
+    readonly PROJECT: "project";
+};
+export type PermissionDeniedScope = (typeof PermissionDeniedScope)[keyof typeof PermissionDeniedScope];
+export interface PermissionDeniedBody {
+    statusCode: 403;
+    error: "Forbidden";
+    code: typeof PERMISSION_DENIED_CODE;
+    requiredPermission: string;
+    scope: PermissionDeniedScope;
+    message: string;
+}
+export declare function isPermissionDeniedBody(body: unknown): body is PermissionDeniedBody;
+//# sourceMappingURL=permission-denied.d.ts.map

package/dist/cli/lib/contract/permission-denied.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-denied.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/contract/permission-denied.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAI1D,eAAO,MAAM,qBAAqB;;;CAGxB,CAAC;AACX,MAAM,MAAM,qBAAqB,GAC/B,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAC;AAErE,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,GAAG,CAAC;IAChB,KAAK,EAAE,WAAW,CAAC;IACnB,IAAI,EAAE,OAAO,sBAAsB,CAAC;IACpC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,KAAK,EAAE,qBAAqB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,oBAAoB,CAWlF"}

package/dist/cli/lib/contract/permission-denied.js

@@ -0,0 +1,20 @@
+// Mirrors `@vendure-cloud/api-types`'s `permission-denied.ts`. See ./README.md for why this package
+// cannot import it, and `test/cli-contract-drift.test.ts` for what keeps the two identical.
+export const PERMISSION_DENIED_CODE = "PERMISSION_DENIED";
+// `project` covers routes on a VC Environment, VC Deployment or teardown too: each is authorized at
+// the VC Project it belongs to.
+export const PermissionDeniedScope = {
+    ORGANIZATION: "organization",
+    PROJECT: "project",
+};
+export function isPermissionDeniedBody(body) {
+    if (typeof body !== "object" || body === null) {
+        return false;
+    }
+    const candidate = body;
+    return (candidate.code === PERMISSION_DENIED_CODE &&
+        typeof candidate.requiredPermission === "string" &&
+        (candidate.scope === PermissionDeniedScope.ORGANIZATION ||
+            candidate.scope === PermissionDeniedScope.PROJECT));
+}
+//# sourceMappingURL=permission-denied.js.map

package/dist/cli/lib/contract/permission-denied.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-denied.js","sourceRoot":"","sources":["../../../../src/cli/lib/contract/permission-denied.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,4FAA4F;AAE5F,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAE1D,oGAAoG;AACpG,gCAAgC;AAChC,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,YAAY,EAAE,cAAc;IAC5B,OAAO,EAAE,SAAS;CACV,CAAC;AAaX,MAAM,UAAU,sBAAsB,CAAC,IAAa;IAClD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,IAA4D,CAAC;IAC/E,OAAO,CACL,SAAS,CAAC,IAAI,KAAK,sBAAsB;QACzC,OAAO,SAAS,CAAC,kBAAkB,KAAK,QAAQ;QAChD,CAAC,SAAS,CAAC,KAAK,KAAK,qBAAqB,CAAC,YAAY;YACrD,SAAS,CAAC,KAAK,KAAK,qBAAqB,CAAC,OAAO,CAAC,CACrD,CAAC;AACJ,CAAC"}

package/dist/cli/lib/contract/project-grants.d.ts

@@ -0,0 +1,16 @@
+export interface ProjectGrantView {
+    workosUserId: string;
+    email: string;
+    permissions: string[];
+    updatedAt: string;
+    grantedByWorkosUserId: string | null;
+}
+export interface PutProjectGrantRequest {
+    permissions: string[];
+}
+export declare const PROJECT_GRANT_PRESETS: {
+    readonly viewer: readonly ["cloud:projects:read", "cloud:environments:read", "cloud:deployments:read", "cloud:source:read", "cloud:env-vars:read", "cloud:db-backups:read", "cloud:seeds:read"];
+    readonly developer: readonly ["cloud:projects:read", "cloud:environments:read", "cloud:environments:update", "cloud:deployments:read", "cloud:deployments:create", "cloud:source:read", "cloud:env-vars:read", "cloud:env-vars:create", "cloud:env-vars:update", "cloud:db-backups:read", "cloud:seeds:read", "cloud:seeds:apply"];
+    readonly administrator: readonly ["cloud:projects:read", "cloud:projects:update", "cloud:projects:delete", "cloud:environments:create", "cloud:environments:read", "cloud:environments:update", "cloud:environments:delete", "cloud:deployments:create", "cloud:deployments:read", "cloud:deployments:delete", "cloud:source:create", "cloud:source:read", "cloud:source:update", "cloud:source:delete", "cloud:env-vars:create", "cloud:env-vars:read", "cloud:env-vars:update", "cloud:env-vars:delete", "cloud:db-backups:create", "cloud:db-backups:read", "cloud:db-restores:create", "cloud:db-tunnels:create", "cloud:seeds:read", "cloud:seeds:apply", "cloud:logs:export"];
+};
+//# sourceMappingURL=project-grants.d.ts.map

package/dist/cli/lib/contract/project-grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-grants.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/contract/project-grants.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAKD,eAAO,MAAM,qBAAqB;;;;CAmDoB,CAAC"}

package/dist/cli/lib/contract/project-grants.js

@@ -0,0 +1,58 @@
+// Mirrors `@vendure-cloud/api-types`'s `project-grants.ts`. See ./README.md for why this package
+// cannot import it, and `test/cli-contract-drift.test.ts` for what keeps the two identical.
+// Named sets of grantable permissions. A grant stores the keys, not the preset's name, so changing
+// a preset never changes an existing grant. `permission-catalogue.spec.ts` in the control plane pins that
+// every key is grantable.
+export const PROJECT_GRANT_PRESETS = {
+    viewer: [
+        "cloud:projects:read",
+        "cloud:environments:read",
+        "cloud:deployments:read",
+        "cloud:source:read",
+        "cloud:env-vars:read",
+        "cloud:db-backups:read",
+        "cloud:seeds:read",
+    ],
+    developer: [
+        "cloud:projects:read",
+        "cloud:environments:read",
+        "cloud:environments:update",
+        "cloud:deployments:read",
+        "cloud:deployments:create",
+        "cloud:source:read",
+        "cloud:env-vars:read",
+        "cloud:env-vars:create",
+        "cloud:env-vars:update",
+        "cloud:db-backups:read",
+        "cloud:seeds:read",
+        "cloud:seeds:apply",
+    ],
+    administrator: [
+        "cloud:projects:read",
+        "cloud:projects:update",
+        "cloud:projects:delete",
+        "cloud:environments:create",
+        "cloud:environments:read",
+        "cloud:environments:update",
+        "cloud:environments:delete",
+        "cloud:deployments:create",
+        "cloud:deployments:read",
+        "cloud:deployments:delete",
+        "cloud:source:create",
+        "cloud:source:read",
+        "cloud:source:update",
+        "cloud:source:delete",
+        "cloud:env-vars:create",
+        "cloud:env-vars:read",
+        "cloud:env-vars:update",
+        "cloud:env-vars:delete",
+        "cloud:db-backups:create",
+        "cloud:db-backups:read",
+        "cloud:db-restores:create",
+        "cloud:db-tunnels:create",
+        "cloud:seeds:read",
+        "cloud:seeds:apply",
+        "cloud:logs:export",
+    ],
+};
+//# sourceMappingURL=project-grants.js.map

package/dist/cli/lib/contract/project-grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-grants.js","sourceRoot":"","sources":["../../../../src/cli/lib/contract/project-grants.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,4FAA4F;AAc5F,mGAAmG;AACnG,0GAA0G;AAC1G,0BAA0B;AAC1B,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,MAAM,EAAE;QACN,qBAAqB;QACrB,yBAAyB;QACzB,wBAAwB;QACxB,mBAAmB;QACnB,qBAAqB;QACrB,uBAAuB;QACvB,kBAAkB;KACnB;IACD,SAAS,EAAE;QACT,qBAAqB;QACrB,yBAAyB;QACzB,2BAA2B;QAC3B,wBAAwB;QACxB,0BAA0B;QAC1B,mBAAmB;QACnB,qBAAqB;QACrB,uBAAuB;QACvB,uBAAuB;QACvB,uBAAuB;QACvB,kBAAkB;QAClB,mBAAmB;KACpB;IACD,aAAa,EAAE;QACb,qBAAqB;QACrB,uBAAuB;QACvB,uBAAuB;QACvB,2BAA2B;QAC3B,yBAAyB;QACzB,2BAA2B;QAC3B,2BAA2B;QAC3B,0BAA0B;QAC1B,wBAAwB;QACxB,0BAA0B;QAC1B,qBAAqB;QACrB,mBAAmB;QACnB,qBAAqB;QACrB,qBAAqB;QACrB,uBAAuB;QACvB,qBAAqB;QACrB,uBAAuB;QACvB,uBAAuB;QACvB,yBAAyB;QACzB,uBAAuB;QACvB,0BAA0B;QAC1B,yBAAyB;QACzB,kBAAkB;QAClB,mBAAmB;QACnB,mBAAmB;KACpB;CACmD,CAAC"}

package/dist/cli/lib/contract/projects.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"projects.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/contract/projects.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,uBAAuB,EACvB,aAAa,EACb,YAAY,EACZ,iBAAiB,EAClB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iCAAiC;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,uBAAuB,CAAC;IAC9B,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,MAAM,iCAAiC,GACzC,0BAA0B,GAC1B,2BAA2B,GAC3B,0BAA0B,GAC1B,uBAAuB,GACvB,2BAA2B,GAC3B,qBAAqB,CAAC;AAE1B,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,iCAAiC,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAuB,SAAQ,eAAe;IAC7D,IAAI,EAAE,iCAAiC,EAAE,CAAC;IAC1C,oBAAoB,EAAE,2BAA2B,CAAC;CACnD;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,IAAI,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd"}
+{"version":3,"file":"projects.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/contract/projects.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,uBAAuB,EACvB,aAAa,EACb,YAAY,EACZ,iBAAiB,EAClB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iCAAiC;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,uBAAuB,CAAC;IAC9B,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,MAAM,iCAAiC,GACzC,0BAA0B,GAC1B,2BAA2B,GAC3B,0BAA0B,GAC1B,uBAAuB,GACvB,2BAA2B,GAC3B,qBAAqB,CAAC;AAE1B,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,iCAAiC,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAuB,SAAQ,eAAe;IAC7D,IAAI,EAAE,iCAAiC,EAAE,CAAC;IAC1C,oBAAoB,EAAE,2BAA2B,CAAC;CACnD;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,IAAI,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd"}

package/dist/cli/lib/contract/projects.js

@@ -2,8 +2,7 @@
 // answer both delete commands read. See ./README.md for why this package cannot import them,
 // including as types.
 //
-// `ResourceDeletionResponse` is one shape shared by two families: deleting a VC Project and
-// deleting a VC Environment are answered the same way. It is declared here once rather than in both
-// areas, so the two families cannot end up describing that answer differently.
+// `ResourceDeletionResponse` is shared by deleting a VC Project and deleting a VC Environment, and
+// is declared once so the two families describe it the same way.
 export {};
 //# sourceMappingURL=projects.js.map

package/dist/cli/lib/contract/projects.js.map

@@ -1 +1 @@
-{"version":3,"file":"projects.js","sourceRoot":"","sources":["../../../../src/cli/lib/contract/projects.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,6FAA6F;AAC7F,sBAAsB;AACtB,EAAE;AACF,4FAA4F;AAC5F,oGAAoG;AACpG,+EAA+E"}
+{"version":3,"file":"projects.js","sourceRoot":"","sources":["../../../../src/cli/lib/contract/projects.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,6FAA6F;AAC7F,sBAAsB;AACtB,EAAE;AACF,mGAAmG;AACnG,iEAAiE"}

package/dist/cli/lib/contract/public-error-details.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public-error-details.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/contract/public-error-details.ts"],"names":[],"mappings":"AAaA,OAAO,EACL,KAAK,8BAA8B,EAEpC,MAAM,iCAAiC,CAAC;AAiDzC,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,8BAA8B,GACvC,MAAM,CAMR;AAED,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,8BAA8B,GACvC,MAAM,CAER"}
+{"version":3,"file":"public-error-details.d.ts","sourceRoot":"","sources":["../../../../src/cli/lib/contract/public-error-details.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,KAAK,8BAA8B,EAEpC,MAAM,iCAAiC,CAAC;AA8CzC,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,8BAA8B,GACvC,MAAM,CAMR;AAED,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,8BAA8B,GACvC,MAAM,CAER"}

package/dist/cli/lib/contract/public-error-details.js

@@ -2,24 +2,20 @@
 // for why this package cannot import it, and `test/cli-contract-parity.test.ts` for what keeps the
 // two answering the same.
 //
-// The write half stays where it is. `trustedPublicErrorDetails`, `providerPublicErrorDetails` and
-// `statusTokenPublicErrorDetails` are how the control plane records an error, and nothing in the
-// CLI records one.
+// The write half stays in the control plane: `trustedPublicErrorDetails`,
+// `providerPublicErrorDetails` and `statusTokenPublicErrorDetails` record errors, and the CLI does
+// not.
 //
-// The `PublicErrorDetails` brand is not mirrored either. It marks a value as safe to persist and
-// return, which is a claim only the writer can make; here these strings are display output. Two
-// separately declared brands would also be distinct types that never unify, which is worse than
-// not having one.
+// The `PublicErrorDetails` brand is not mirrored. It marks a value safe to persist, a claim only
+// the writer can make, and two separately declared brands would never unify.
 import { formatDeploymentResourceLabel, } from "./deployment-resource-labels.js";
-// Signatures of raw infrastructure-provider prose: a versioned provider API
-// path, a retired provider's name, or its API host.
+// Signatures of raw infrastructure-provider prose: a versioned provider API path, a retired
+// provider's name, or its API host.
 //
-// Denylist, not vocabulary — same rule as KNOWN_RESOURCE_KINDS below. Nothing
-// emits the retired vendor token any more, but `formatUserFacingErrorDetails`
-// runs on READ over every persisted `errorDetails` row, and rows written before
-// the execution backend was removed (CLO-294) still contain it. Dropping the
-// alternative would echo those rows verbatim instead of describing them.
-// Detection is internal; the scrubbed OUTPUT never names a provider.
+// A denylist. `formatUserFacingErrorDetails` runs on read over every persisted `errorDetails` row,
+// and rows written before the execution backend was removed (CLO-294) still contain the retired
+// name. Dropping the alternative echoes those rows verbatim. The scrubbed output never names a
+// provider.
 const PROVIDER_DETAIL_RE = /\/v\d+\/(?:teams|projects|orgs|accounts)\/|\bNorthflank\b|https?:\/\/api\.northflank\.com/i;
 const SAFE_PROVIDER_MESSAGES = [
     /^(?:volume )?(?:is )?(?:still )?(?:attached|in use)\.?$/i,
@@ -28,9 +24,8 @@ const SAFE_PROVIDER_MESSAGES = [
     /^(?:name )?already exists\.?$/i,
     /^project-level quota exceeded\.?$/i,
 ];
-// Denylist, not vocabulary: a kind listed here is recognised so the line is
-// relabelled instead of echoed. Retired kinds stay in the set on purpose —
-// dropping one only lets an old stored error line through unscrubbed.
+// A denylist: a listed kind is relabelled instead of echoed. Retired kinds stay, because dropping
+// one lets an old stored error line through unscrubbed.
 const KNOWN_RESOURCE_KINDS = new Set([
     "Addon",
     "Condition",
@@ -46,8 +41,8 @@ const KNOWN_RESOURCE_KINDS = new Set([
     "Volume",
     "Workflow",
 ]);
-// Only unambiguous generated refs belong here. Common words such as
-// "database" and "server" may be ordinary application-error prefixes.
+// Only unambiguous generated refs belong here. "database" and "server" may be ordinary
+// application-error prefixes.
 const KNOWN_RESOURCE_REF_LABELS = {
     migrationRun: "Migration job",
     searchSecrets: "Search",
@@ -68,8 +63,7 @@ function formatUserFacingErrorLine(rawLine, context) {
     const line = rawLine.trim();
     if (!line)
         return rawLine;
-    // The vendor alternative is the shape the removed teardown path actually
-    // persisted; the neutral one is what a replacement backend would write.
+    // The vendor alternative is the shape the removed teardown path persisted.
     if (/^Timed out waiting for deleted (?:Northflank|provider) resources to disappear\b/i.test(line)) {
         return "Timed out waiting for deleted resources to disappear.";
     }
@@ -121,11 +115,9 @@ function labelForResourceRef(ref) {
     }
     return null;
 }
-// Rollout vocabulary from the removed orchestrator. Same denylist reasoning as
-// KNOWN_RESOURCE_KINDS and PROVIDER_DETAIL_RE: nothing writes these lines any
-// more, but they are already stored in `deployments` and `teardowns`, and
-// `formatUserFacingErrorDetails` runs on READ. Without the branch the prose
-// matches no scrubber and is echoed verbatim, third-party noun included.
+// Rollout vocabulary from the removed orchestrator. Stored `deployments` and `teardowns` rows still
+// contain these lines and `formatUserFacingErrorDetails` runs on read. Without this branch the
+// prose is echoed verbatim, third-party noun included.
 function formatDeploymentRolloutLine(line) {
     if (/^Template run exceeded timeout\b/i.test(line)) {
         return "Deployment rollout timed out; cleanup was requested.";
@@ -135,9 +127,8 @@ function formatDeploymentRolloutLine(line) {
     return null;
 }
 function formatErrorMessage(message, context) {
-    // `NF: ` is a prefix only the removed writer produced, so this branch is dead
-    // for anything written from now on — but it keeps every already-persisted row
-    // on the default-deny path instead of echoing arbitrary provider prose.
+    // `NF: ` is a prefix only the removed writer produced. The branch keeps already-persisted rows on
+    // the default-deny path instead of echoing provider prose.
     const withoutPrefix = message.replace(/^NF:\s*/i, "").trim();
     if (withoutPrefix !== message.trim())
         return scrubProviderMessage(withoutPrefix, context);
@@ -208,22 +199,16 @@ function findNestedErrorMessage(value) {
     }
     return null;
 }
-// Default-deny. Provider prose is untrusted: unless it matches one of the
-// short, id-free phrases we have vetted, it is described rather than echoed.
+// Default-deny. Provider prose is untrusted: unless it matches a vetted, id-free phrase, it is
+// described instead of echoed.
 function scrubProviderMessage(message, context) {
-    // Retired rollout shapes, kept for the same reason as formatDeploymentRolloutLine:
-    // these reach here nested inside a stored provider body or behind the `NF:`
+    // Retired rollout shapes reach here nested inside a stored provider body or behind the `NF:`
     // prefix, where the line-level branch above never sees them.
     //
-    // One retired shape was deliberately NOT kept: the removed template engine's
-    // `Payload validation failed after resolving inputs. "deployment.external.imagePath"
-    // is required.`, which used to render as "required container image is missing".
-    // It is not a denylist branch — nothing leaks without it, the message falls
-    // through to the default-deny below and reads "Provider request failed" — and
-    // the advice it carried ("push an image") is not actionable while there is no
-    // build backend to produce one (CLO-347). A stored row from before the
-    // decommission gets the generic wording rather than an instruction the
-    // customer cannot follow. Restore the branch with the build pipeline.
+    // The removed template engine's `Payload validation failed after resolving inputs.
+    // "deployment.external.imagePath" is required.` has no branch. Nothing leaks without one, and its
+    // advice to push an image is not actionable without a build backend (CLO-347). Such a row reads
+    // "Provider request failed". Restore the branch with the build pipeline.
     if (/^template cleanup failed\.?$/i.test(message))
         return "cleanup failed";
     if (/\btemplate run\b.*\b(?:failed|failure|error|timed out)\b/i.test(message)) {