@withandeo/cli 0.19.8 → 0.19.9

package/dist/flagship-contract.d.ts

@@ -0,0 +1,63 @@
+/** Shared admission contract. No runtime rules engine: Cloudflare owns evaluation. */
+export type FlagEnvironment = "development" | "preview" | "production";
+export interface FlagBinding {
+    binding: string;
+    app_id: string;
+}
+export interface FlagBindings {
+    flagship: FlagBinding[];
+    env: {
+        preview: {
+            flagship: FlagBinding[];
+        };
+        production: {
+            flagship: FlagBinding[];
+        };
+    };
+}
+export declare function flagEnvironment(value: unknown): FlagEnvironment;
+export declare function flagBindings(value: unknown): FlagBinding[];
+export declare function parseFlagBindings(value: unknown): FlagBindings | undefined;
+export declare function selectedFlagBindings(value: FlagBindings | undefined, environment: FlagEnvironment): FlagBinding[];
+export declare function flagKey(value: unknown): string;
+export declare function customerIds(value: unknown): string[];
+export declare function rolloutPercentage(value: unknown): number;
+export interface BooleanFlag {
+    key: string;
+    description?: string;
+    enabled: boolean;
+    default_variation: "off";
+    variations: {
+        off: false;
+        on: true;
+    };
+    rules: Array<{
+        priority: number;
+        conditions: Array<{
+            attribute: "customerId";
+            operator: "in";
+            value: string[];
+        }>;
+        serve_variation: "on";
+        rollout?: {
+            percentage: number;
+            attribute: "customerId";
+        };
+    }>;
+}
+export declare function booleanFlag(key: string, enabled?: boolean, ids?: string[], percentage?: number, description?: string): BooleanFlag;
+/** Reject unsupported dashboard edits instead of erasing them. Provider metadata is excluded. */
+export declare function supportedFlag(value: unknown): {
+    definition: BooleanFlag;
+    ids: string[];
+    percentage: number;
+};
+export type FlagAction = "create" | "enable" | "disable" | "audience" | "rollout";
+export declare function changeFlag(current: unknown, action: FlagAction, input: {
+    key: string;
+    customerIds?: unknown;
+    percentage?: unknown;
+    all?: boolean;
+}): Record<string, unknown>;
+export declare function record(value: unknown): value is Record<string, unknown>;
+//# sourceMappingURL=flagship-contract.d.ts.map

package/dist/flagship-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flagship-contract.d.ts","sourceRoot":"","sources":["../src/flagship-contract.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,MAAM,MAAM,eAAe,GAAG,aAAa,GAAG,SAAS,GAAG,YAAY,CAAC;AACvE,MAAM,WAAW,WAAW;IAAG,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAChE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,GAAG,EAAE;QAAE,OAAO,EAAE;YAAE,QAAQ,EAAE,WAAW,EAAE,CAAA;SAAE,CAAC;QAAC,UAAU,EAAE;YAAE,QAAQ,EAAE,WAAW,EAAE,CAAA;SAAE,CAAA;KAAE,CAAC;CACxF;AACD,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAG/D;AACD,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,EAAE,CAW1D;AACD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAe1E;AACD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,EAAE,WAAW,EAAE,eAAe,GAAG,WAAW,EAAE,CAEjH;AACD,wBAAgB,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAG9C;AACD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAGpD;AACD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGxD;AACD,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,iBAAiB,EAAE,KAAK,CAAC;IAC9E,UAAU,EAAE;QAAE,GAAG,EAAE,KAAK,CAAC;QAAC,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACrC,KAAK,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,KAAK,CAAC;YAAC,SAAS,EAAE,YAAY,CAAC;YAAC,QAAQ,EAAE,IAAI,CAAC;YAAC,KAAK,EAAE,MAAM,EAAE,CAAA;SAAC,CAAC,CAAC;QAC7G,eAAe,EAAE,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE;YAAC,UAAU,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,YAAY,CAAA;SAAC,CAAA;KAAE,CAAC,CAAC;CACrF;AACD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,UAAQ,EAAE,GAAG,GAAE,MAAM,EAAO,EAAE,UAAU,SAAI,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,WAAW,CAM/H;AACD,iGAAiG;AACjG,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,UAAU,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAiB5G;AACD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAClF,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAe1K;AACD,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAA0E"}

package/dist/flagship-contract.js

@@ -0,0 +1,117 @@
+export function flagEnvironment(value) {
+    if (value !== "development" && value !== "preview" && value !== "production")
+        throw new Error("flagship_environment_invalid");
+    return value;
+}
+export function flagBindings(value) {
+    if (!Array.isArray(value) || value.length > 8)
+        throw new Error("flagship_bindings_invalid");
+    const names = new Set();
+    return value.map(item => {
+        if (!record(item) || Object.keys(item).some(k => k !== "binding" && k !== "app_id")
+            || typeof item.binding !== "string" || !/^[A-Z][A-Z0-9_]{2,63}$/.test(item.binding)
+            || /^(TENDER_|ANDEO_)/.test(item.binding) || item.binding === "ASSETS" || names.has(item.binding)
+            || typeof item.app_id !== "string" || !/^[A-Za-z0-9_-]{1,128}$/.test(item.app_id))
+            throw new Error("flagship_bindings_invalid");
+        names.add(item.binding);
+        return { binding: item.binding, app_id: item.app_id };
+    }).sort((a, b) => a.binding.localeCompare(b.binding));
+}
+export function parseFlagBindings(value) {
+    if (value === undefined)
+        return undefined;
+    if (!record(value) || Object.keys(value).some(k => !["flagship", "env"].includes(k))
+        || !record(value.env) || Object.keys(value.env).some(k => !["preview", "production"].includes(k)))
+        throw new Error("flagship_config_invalid");
+    const environments = value.env;
+    const environment = (name) => {
+        const entry = environments[name];
+        if (!record(entry) || Object.keys(entry).some(k => k !== "flagship"))
+            throw new Error("flagship_environment_missing");
+        return { flagship: flagBindings(entry.flagship) };
+    };
+    const result = { flagship: flagBindings(value.flagship), env: { preview: environment("preview"), production: environment("production") } };
+    // Same names in every environment; explicit empty lists are supported only together.
+    const names = result.flagship.map(b => b.binding).join(",");
+    for (const entry of Object.values(result.env))
+        if (entry.flagship.map(b => b.binding).join(",") !== names)
+            throw new Error("flagship_environment_binding_mismatch");
+    return result;
+}
+export function selectedFlagBindings(value, environment) {
+    return value === undefined ? [] : environment === "development" ? value.flagship : value.env[environment].flagship;
+}
+export function flagKey(value) {
+    if (typeof value !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/.test(value))
+        throw new Error("flagship_key_invalid");
+    return value;
+}
+export function customerIds(value) {
+    if (!Array.isArray(value) || value.length > 1000 || value.some(id => typeof id !== "string" || !id.trim() || id !== id.trim() || id.length > 128 || /[\x00-\x1f\x7f]/.test(id)))
+        throw new Error("flagship_audience_invalid");
+    return [...new Set(value)].sort();
+}
+export function rolloutPercentage(value) {
+    if (typeof value !== "number" || !Number.isFinite(value) || value < 0 || value > 100 || Number(value.toFixed(2)) !== value)
+        throw new Error("flagship_percentage_invalid");
+    return value;
+}
+export function booleanFlag(key, enabled = false, ids = [], percentage = 0, description) {
+    ids = customerIds(ids);
+    percentage = rolloutPercentage(percentage);
+    return { key: flagKey(key), ...(description === undefined ? {} : { description }), enabled, default_variation: "off", variations: { off: false, on: true }, rules: [
+            ...(ids.length ? [{ priority: 1, conditions: [{ attribute: "customerId", operator: "in", value: ids }], serve_variation: "on" }] : []),
+            ...(percentage > 0 ? [{ priority: 2, conditions: [], serve_variation: "on", rollout: { percentage, attribute: "customerId" } }] : []),
+        ] };
+}
+/** Reject unsupported dashboard edits instead of erasing them. Provider metadata is excluded. */
+export function supportedFlag(value) {
+    if (!record(value) || typeof value.enabled !== "boolean" || value.default_variation !== "off" || !record(value.variations)
+        || value.variations.off !== false || value.variations.on !== true || Object.keys(value.variations).length !== 2
+        || !Array.isArray(value.rules) || value.rules.length > 2 || (value.description !== undefined && typeof value.description !== "string"))
+        throw new Error("flagship_reconciliation_required");
+    let ids = [], percentage = 0;
+    for (const rule of value.rules) {
+        if (!record(rule) || Object.keys(rule).some(k => !["priority", "conditions", "serve_variation", "rollout"].includes(k)) || rule.serve_variation !== "on" || !Array.isArray(rule.conditions))
+            throw new Error("flagship_reconciliation_required");
+        if (rule.priority === 1 && rule.conditions.length === 1 && rule.rollout === undefined && !ids.length) {
+            const condition = rule.conditions[0];
+            if (!record(condition) || Object.keys(condition).some(k => !["attribute", "operator", "value"].includes(k)) || condition.attribute !== "customerId" || condition.operator !== "in")
+                throw new Error("flagship_reconciliation_required");
+            ids = customerIds(condition.value);
+            if (!ids.length)
+                throw new Error("flagship_reconciliation_required");
+        }
+        else if (rule.priority === 2 && rule.conditions.length === 0 && record(rule.rollout) && percentage === 0
+            && Object.keys(rule.rollout).every(k => ["percentage", "attribute"].includes(k)) && rule.rollout.attribute === "customerId") {
+            percentage = rolloutPercentage(rule.rollout.percentage);
+            if (percentage === 0)
+                throw new Error("flagship_reconciliation_required");
+        }
+        else
+            throw new Error("flagship_reconciliation_required");
+    }
+    return { definition: booleanFlag(flagKey(value.key), value.enabled, ids, percentage, value.description), ids, percentage };
+}
+export function changeFlag(current, action, input) {
+    if (action === "create")
+        return booleanFlag(input.key);
+    // Emergency disable preserves the complete observed writable definition, including unsupported rules.
+    if (action === "disable") {
+        if (!record(current) || !record(current.variations) || current.default_variation !== "off" || current.variations.off !== false
+            || !Array.isArray(current.rules) || typeof current.enabled !== "boolean" || flagKey(current.key) !== input.key)
+            throw new Error("flagship_reconciliation_required");
+        return { key: input.key, ...(current.description === undefined ? {} : { description: current.description }), variations: current.variations,
+            default_variation: "off", rules: current.rules, enabled: false };
+    }
+    const { definition, ids, percentage } = supportedFlag(current);
+    if (definition.key !== input.key)
+        throw new Error("flagship_key_mismatch");
+    const nextIds = action === "audience" && !input.all ? customerIds(input.customerIds) : ids;
+    const nextPercentage = action === "rollout" ? rolloutPercentage(input.percentage) : action === "audience" && input.all ? 100 : percentage;
+    if (action === "enable" && !nextIds.length && nextPercentage === 0)
+        throw new Error("flagship_empty_audience");
+    return booleanFlag(input.key, action === "enable" ? true : definition.enabled, nextIds, nextPercentage, definition.description);
+}
+export function record(value) { return !!value && typeof value === "object" && !Array.isArray(value); }
+//# sourceMappingURL=flagship-contract.js.map

package/dist/flagship-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flagship-contract.js","sourceRoot":"","sources":["../src/flagship-contract.ts"],"names":[],"mappings":"AAOA,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC9H,OAAO,KAAK,CAAC;AACf,CAAC;AACD,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,QAAQ,CAAC;eAC9E,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;eAChF,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;eAC9F,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAClI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACxD,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AACvD,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;WAC/E,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAChJ,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC;IAC/B,MAAM,WAAW,GAAG,CAAC,IAA8B,EAAE,EAAE;QACrD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACtH,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;IACpD,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;IAC3I,qFAAqF;IACrF,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAClK,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,MAAM,UAAU,oBAAoB,CAAC,KAA+B,EAAE,WAA4B;IAChG,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;AACrH,CAAC;AACD,MAAM,UAAU,OAAO,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC5H,OAAO,KAAK,CAAC;AACf,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC9N,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAiB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAChD,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC3K,OAAO,KAAK,CAAC;AACf,CAAC;AAOD,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,OAAO,GAAG,KAAK,EAAE,GAAG,GAAa,EAAE,EAAE,UAAU,GAAG,CAAC,EAAE,WAAoB;IAChH,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAAC,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACnE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE;YACjK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAC,SAAS,EAAE,YAAqB,EAAE,QAAQ,EAAE,IAAa,EAAE,KAAK,EAAE,GAAG,EAAC,CAAC,EAAE,eAAe,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/J,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,eAAe,EAAE,IAAa,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,YAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACxJ,EAAE,CAAC;AACN,CAAC;AACD,iGAAiG;AACjG,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,iBAAiB,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;WACrH,KAAK,CAAC,UAAU,CAAC,GAAG,KAAK,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC;WAC5G,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC9L,IAAI,GAAG,GAAa,EAAE,EAAE,UAAU,GAAG,CAAC,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,UAAU,EAAC,YAAY,EAAC,iBAAiB,EAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC5O,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACrG,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,WAAW,EAAC,UAAU,EAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,SAAS,KAAK,YAAY,IAAI,SAAS,CAAC,QAAQ,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACpO,GAAG,GAAG,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC3G,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,UAAU,KAAK,CAAC;eACrG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,YAAY,EAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,YAAY,EAAE,CAAC;YAC3H,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAAC,IAAI,UAAU,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACrI,CAAC;;YAAM,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,WAAiC,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AACnJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAgB,EAAE,MAAkB,EAAE,KAAgF;IAC/I,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,GAAG,CAAsC,CAAC;IAC5F,sGAAsG;IACtG,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,iBAAiB,KAAK,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,KAAK,KAAK;eACzH,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtK,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAC,WAAW,EAAE,OAAO,CAAC,WAAW,EAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU;YACvI,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACrE,CAAC;IACD,MAAM,EAAC,UAAU,EAAE,GAAG,EAAE,UAAU,EAAC,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,UAAU,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,MAAM,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3F,MAAM,cAAc,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;IAC1I,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,cAAc,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/G,OAAO,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,CAAC,WAAW,CAAsC,CAAC;AACvK,CAAC;AACD,MAAM,UAAU,MAAM,CAAC,KAAc,IAAsC,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC"}

package/dist/flagship-package.d.ts

@@ -0,0 +1,3 @@
+/** Retain every environment in the artifact; only the trusted deployer selects one. */
+export declare function packageFlagBindings(root: string, artifactDirectory: string): Promise<void>;
+//# sourceMappingURL=flagship-package.d.ts.map

package/dist/flagship-package.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flagship-package.d.ts","sourceRoot":"","sources":["../src/flagship-package.ts"],"names":[],"mappings":"AAOA,uFAAuF;AACvF,wBAAsB,mBAAmB,CAAC,IAAI,EAAC,MAAM,EAAC,iBAAiB,EAAC,MAAM,GAAE,OAAO,CAAC,IAAI,CAAC,CAiB5F"}

package/dist/flagship-package.js

@@ -0,0 +1,31 @@
+import { writeFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { parseFlagBindings, record } from "./flagship-contract.js";
+import { verifyArtifact } from "./artifact.js";
+import { pathExists, readBoundedFile } from "./files.js";
+import { createHash } from "node:crypto";
+/** Retain every environment in the artifact; only the trusted deployer selects one. */
+export async function packageFlagBindings(root, artifactDirectory) {
+    const path = resolve(root, "tender-app.config.json");
+    if (!await pathExists(path))
+        return;
+    const source = JSON.parse(new TextDecoder().decode(await readBoundedFile(path, 1024 * 1024)));
+    if (!record(source))
+        throw new Error("flagship_source_invalid");
+    if (source.flagship === undefined && (!record(source.env) || !Object.values(source.env).some(e => record(e) && e.flagship !== undefined)))
+        return;
+    const flags = parseFlagBindings({ flagship: source.flagship, env: source.env });
+    const verified = await verifyArtifact(artifactDirectory);
+    if (verified.envelope.manifest.flags && JSON.stringify(verified.envelope.manifest.flags) !== JSON.stringify(flags))
+        throw new Error("flagship_declaration_mismatch");
+    const { envelope } = verified;
+    envelope.manifest.flags = flags;
+    const manifest = envelope.manifest;
+    envelope.bundleDigest = createHash("sha256").update(JSON.stringify({ module: manifest.module, files: manifest.files,
+        ...(manifest.databaseSchema === undefined ? {} : { databaseSchema: manifest.databaseSchema }),
+        ...(manifest.workflows === undefined ? {} : { workflows: manifest.workflows }), flags })).digest("hex");
+    manifest.runtime.assetPrefix = `/_tenant-artifacts/${envelope.bundleDigest}`;
+    await writeFile(verified.envelopePath, JSON.stringify(envelope, null, 2) + "\n");
+    await verifyArtifact(artifactDirectory);
+}
+//# sourceMappingURL=flagship-package.js.map

package/dist/flagship-package.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flagship-package.js","sourceRoot":"","sources":["../src/flagship-package.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAW,EAAC,iBAAwB;IAC5E,MAAM,IAAI,GAAC,OAAO,CAAC,IAAI,EAAC,wBAAwB,CAAC,CAAC;IAAA,IAAG,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC;QAAC,OAAO;IACpF,MAAM,MAAM,GAAS,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,eAAe,CAAC,IAAI,EAAC,IAAI,GAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjG,IAAG,CAAC,MAAM,CAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC9D,IAAG,MAAM,CAAC,QAAQ,KAAG,SAAS,IAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,MAAM,CAAC,CAAC,CAAC,IAAE,CAAC,CAAC,QAAQ,KAAG,SAAS,CAAC,CAAC;QAAC,OAAO;IACpI,MAAM,KAAK,GAAC,iBAAiB,CAAC,EAAC,QAAQ,EAAC,MAAM,CAAC,QAAQ,EAAC,GAAG,EAAC,MAAM,CAAC,GAAG,EAAC,CAAE,CAAC;IAC1E,MAAM,QAAQ,GAAC,MAAM,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACvD,IAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/J,MAAM,EAAC,QAAQ,EAAC,GAAC,QAAQ,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,KAAK,GAAC,KAAK,CAAC;IAC9B,MAAM,QAAQ,GAAC,QAAQ,CAAC,QAAQ,CAAC;IACjC,QAAQ,CAAC,YAAY,GAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAC,MAAM,EAAC,QAAQ,CAAC,MAAM,EAAC,KAAK,EAAC,QAAQ,CAAC,KAAK;QAC3G,GAAG,CAAC,QAAQ,CAAC,cAAc,KAAG,SAAS,CAAA,CAAC,CAAA,EAAE,CAAA,CAAC,CAAA,EAAC,cAAc,EAAC,QAAQ,CAAC,cAAc,EAAC,CAAC;QACpF,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAG,SAAS,CAAA,CAAC,CAAA,EAAE,CAAA,CAAC,CAAA,EAAC,SAAS,EAAC,QAAQ,CAAC,SAAS,EAAC,CAAC,EAAC,KAAK,EAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/F,QAAQ,CAAC,OAAO,CAAC,WAAW,GAAC,sBAAsB,QAAQ,CAAC,YAAY,EAAE,CAAC;IAC3E,MAAM,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAC,IAAI,EAAC,CAAC,CAAC,GAAC,IAAI,CAAC,CAAC;IAC5E,MAAM,cAAc,CAAC,iBAAiB,CAAC,CAAC;AAC1C,CAAC"}

package/dist/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AASA,OAAO,EAIL,KAAK,YAAY,EAIlB,MAAM,iBAAiB,CAAC;AA2BzB,OAAO,EAIL,4BAA4B,EAE7B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAU/B,eAAO,MAAM,WAAW,QAA0B,CAAC;AAenD,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC;IAC7B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,OAAO,EAAE,OAAO,KAAK,CAAC;IACtB,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,iBAAiB,EAAE,OAAO,iBAAiB,CAAC;IAC5C,cAAc,EAAE,OAAO,cAAc,CAAC;IACtC,SAAS,EAAE,YAAY,CAAC;IACxB,eAAe,EAAE,kBAAkB,CAAC;IACpC,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,4BAA4B,EAAE,OAAO,4BAA4B,CAAC;IAClE,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;IAClE,WAAW,CAAC,OAAO,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;CAC9C;AAED,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAC3D,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,GAAG,IAAI,CAAC;IACtF,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG,IAAI,CAAC;IACnG,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAC5D,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7C;AA6BD,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,GAAE,OAAO,CAAC,UAAU,CAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAmCjG"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AASA,OAAO,EAIL,KAAK,YAAY,EAIlB,MAAM,iBAAiB,CAAC;AA2BzB,OAAO,EAIL,4BAA4B,EAE7B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAW/B,eAAO,MAAM,WAAW,QAA0B,CAAC;AAenD,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC;IAC7B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,OAAO,EAAE,OAAO,KAAK,CAAC;IACtB,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,iBAAiB,EAAE,OAAO,iBAAiB,CAAC;IAC5C,cAAc,EAAE,OAAO,cAAc,CAAC;IACtC,SAAS,EAAE,YAAY,CAAC;IACxB,eAAe,EAAE,kBAAkB,CAAC;IACpC,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,4BAA4B,EAAE,OAAO,4BAA4B,CAAC;IAClE,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;IAClE,WAAW,CAAC,OAAO,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;CAC9C;AAED,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAC3D,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,GAAG,IAAI,CAAC;IACtF,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG,IAAI,CAAC;IACnG,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAC5D,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7C;AA6BD,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,GAAE,OAAO,CAAC,UAAU,CAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAmCjG"}

package/dist/main.js

@@ -20,6 +20,7 @@ import { initializeStarter } from "./starter.js";
 import { normalizeAndeoEnvironment } from "./andeo-environment.js";
 import { DOC_TOPICS, readDocumentation, installDocumentation, installedSkillCheck } from "./documentation.js";
 import { capabilityPreflight } from "./capability-preflight.js";
+import { flagEnvironment, flagKey, rolloutPercentage, customerIds } from "./flagship-contract.js";
 const packageMetadata = createRequire(import.meta.url)("../package.json");
 if (typeof packageMetadata.version !== "string" || packageMetadata.version.length === 0) {
     throw new Error("Andeo CLI package version is missing.");
@@ -101,6 +102,8 @@ async function execute(topic, options, cwd, runtime) {
         return { value: await workflowCommand(topic.slice(10), cwd, options, runtime) };
     if (topic.startsWith("email "))
         return { value: await emailCommand(topic.slice(6), cwd, options, runtime) };
+    if (topic.startsWith("flagship "))
+        return { value: await flagshipCommand(topic.slice(9), cwd, options, runtime) };
     switch (topic) {
         case "docs": {
             const name = options.positionals[0];
@@ -225,7 +228,27 @@ async function execute(topic, options, cwd, runtime) {
             return { value: await sourceChangeCreate(cwd, options, runtime) };
         case "source merge": {
             const value = await sourceMerge(cwd, options, runtime);
-            return { value, exitCode: value.status === "timeout" ? 3 : value.merge && ["awaiting_approval", "needs_attention", "superseded", "authorization_required", "cancelled"].includes(value.merge.stage) ? 2 : 0 };
+            return { value, exitCode: value.status === "timeout" ? 3 : value.merge && ["awaiting_approval", "needs_attention", "superseded", "authorization_required", "reconciliation_required", "cancelled"].includes(value.merge.stage) ? 2 : 0 };
+        }
+        case "source merge status":
+        case "source merge resume":
+        case "source merge cancel":
+        case "source merge take-over": {
+            const mergeId = requiredFlag(options, "merge");
+            if (!/^smi_[A-Za-z0-9_-]+$/.test(mergeId))
+                throw new CliError("argument_invalid", "--merge must be a merge intent ID (smi_...).");
+            const key = topic === "source merge take-over" ? requiredFlag(options, "idempotency-key") : undefined;
+            if (key && !/^[A-Za-z0-9:_-]{8,128}$/.test(key))
+                throw new CliError("argument_invalid", "--idempotency-key must contain 8–128 letters, numbers, colons, underscores or hyphens.");
+            const access = await sourceReadAccess(cwd, options, runtime);
+            const current = await access.client.sourceMergeStatus(mergeId);
+            requireLinkedSourceChange(access.projectId, current.merge.projectId);
+            if (current.merge.id !== mergeId || current.merge.repositoryId !== access.repository.id)
+                throw new CliError("source_merge_changed", "The returned merge does not match this repository and intent.");
+            if (topic === "source merge status")
+                return { value: current };
+            return { value: topic === "source merge resume" ? await access.client.resumeSourceMergeById(mergeId)
+                    : key ? await access.client.takeOverSourceMergeById(mergeId, key) : await access.client.cancelSourceMergeById(mergeId) };
         }
         case "source change resume": {
             const access = await sourceReadAccess(cwd, options, runtime);
@@ -249,13 +272,17 @@ async function execute(topic, options, cwd, runtime) {
             if (topic === "source merge-policy show")
                 return { value: await access.client.sourceMergePolicy(access.repository.id) };
             const mode = requiredFlag(options, "mode");
-            if (!["human-review", "agent"].includes(mode))
-                throw new CliError("source_merge_policy_invalid", "--mode must be human-review or agent.");
+            if (!["human-review", "agent", "administrator-authorized"].includes(mode))
+                throw new CliError("source_merge_policy_invalid", "--mode must be human-review, agent or administrator-authorized.");
+            const principalIds = (options.flags.get("principals") ?? "").split(",").filter(Boolean);
+            if (mode === "administrator-authorized" && principalIds.length)
+                throw new CliError("source_merge_policy_invalid", "Administrator-authorized mode requires exact per-operation approval; omit --principals.");
             const executionSeconds = options.flags.has("execution-seconds") ? Number(options.flags.get("execution-seconds")) : undefined;
             if (executionSeconds !== undefined && (!Number.isSafeInteger(executionSeconds) || executionSeconds < 300 || executionSeconds > 86400))
                 throw new CliError("argument_invalid", "--execution-seconds must be between 300 and 86400.");
             return { value: await access.client.sourceMergePolicy(access.repository.id, { enabled: mode === "agent",
-                    principalIds: (options.flags.get("principals") ?? "").split(",").filter(Boolean),
+                    principalIds, validationMode: mode === "administrator-authorized" ? "administrator_authorized" : "native_preview",
+                    buildAdmission: mode === "administrator-authorized" ? "source_only" : "native",
                     expectedRevision: Number(requiredFlag(options, "expected-revision")), idempotencyKey: requiredFlag(options, "idempotency-key"), executionSeconds }) };
         }
         case "source change list":
@@ -1329,9 +1356,34 @@ async function sourceMerge(cwd, options, runtime) {
         throw new CliError("argument_invalid", "--expected-head must be a commit SHA.");
     if (expectedSnapshot && (!changeId || !Number.isSafeInteger(Number(expectedSnapshot)) || Number(expectedSnapshot) < 1))
         throw new CliError("argument_invalid", "--expected-snapshot requires --change and a positive integer.");
+    const expectedBase = options.flags.get("expected-base"), policyRevision = options.flags.get("expected-policy-revision");
+    const validationMode = options.flags.get("validation-mode"), continuation = options.flags.get("continuation");
+    const authorize = options.booleans.has("authorize"), dryRun = options.booleans.has("dry-run"), note = options.flags.get("note");
+    if (expectedBase && !/^[a-f0-9]{40}$/.test(expectedBase))
+        throw new CliError("argument_invalid", "--expected-base must be a commit SHA.");
+    if (policyRevision !== undefined && (!/^\d+$/.test(policyRevision) || !Number.isSafeInteger(Number(policyRevision))))
+        throw new CliError("argument_invalid", "--expected-policy-revision must be a nonnegative integer.");
+    if (validationMode !== undefined && validationMode !== "native_preview" && validationMode !== "administrator_authorized")
+        throw new CliError("argument_invalid", "--validation-mode must be native_preview or administrator_authorized.");
+    if (continuation !== undefined && continuation !== "source_only")
+        throw new CliError("argument_invalid", "--continuation must be source_only.");
+    if (note !== undefined && (note.length < 1 || note.length > 1000))
+        throw new CliError("argument_invalid", "--note must contain 1–1000 characters.");
+    if (validationMode === "administrator_authorized") {
+        if (changeId || expectedSnapshot)
+            throw new CliError("argument_invalid", "Administrator-authorized merges use --head and --title without a native change request.");
+        if (!dryRun && (!authorize || !expectedBase || !expectedHead || policyRevision === undefined))
+            throw new CliError("argument_invalid", "Administrator-authorized merges require --authorize, --expected-base, --expected-head and --expected-policy-revision. Use --dry-run to inspect the exact snapshot first.");
+    }
+    else if (authorize || expectedBase !== undefined || policyRevision !== undefined || continuation !== undefined || note !== undefined) {
+        throw new CliError("argument_invalid", "Administrator authorization flags require --validation-mode administrator_authorized.");
+    }
     const access = await sourceReadAccess(cwd, options, runtime);
     const result = await access.client.sourceMerge(access.repository.id, { headBranch, title, changeId, idempotencyKey,
-        expectedHead, expectedSnapshot: expectedSnapshot ? Number(expectedSnapshot) : undefined, dryRun: options.booleans.has("dry-run") });
+        expectedHead, expectedSnapshot: expectedSnapshot ? Number(expectedSnapshot) : undefined, dryRun,
+        expectedBase, expectedPolicyRevision: policyRevision === undefined ? undefined : Number(policyRevision),
+        validationMode, authorize: validationMode === "administrator_authorized" ? authorize : undefined,
+        continuation: validationMode === "administrator_authorized" ? "source_only" : undefined, note });
     if (result.merge) {
         requireLinkedSourceChange(access.projectId, result.merge.projectId);
         if (result.merge.repositoryId !== access.repository.id)
@@ -1341,13 +1393,14 @@ async function sourceMerge(cwd, options, runtime) {
         return result;
     let merge = result.merge;
     for (let poll = 0; poll < Math.ceil(timeout / 5); poll++) {
-        if (["deployed", "needs_attention", "publication_not_enabled", "superseded", "authorization_required", "cancelled"].includes(merge.stage))
+        if (merge.terminal || ["merged", "deployed", "needs_attention", "publication_not_enabled", "superseded", "authorization_required", "reconciliation_required", "cancelled"].includes(merge.stage))
             return { ...result, merge };
         if (merge.stage === "awaiting_approval")
             return { ...result, merge };
         await runtime.sleep(Math.min(5000, timeout * 1000 - poll * 5000));
-        const current = await access.client.sourceChangeRequest(merge.changeId);
-        requireLinkedSourceChange(access.projectId, current.changeRequest.projectId);
+        const current = merge.changeId ? await access.client.sourceChangeRequest(merge.changeId) : await access.client.sourceMergeStatus(merge.id);
+        if ("changeRequest" in current)
+            requireLinkedSourceChange(access.projectId, current.changeRequest.projectId);
         if (!current.merge || current.merge.id !== merge.id)
             throw new CliError("source_merge_changed", "The merge intent changed. Inspect this exact change before continuing.");
         requireLinkedSourceChange(access.projectId, current.merge.projectId);
@@ -1355,7 +1408,10 @@ async function sourceMerge(cwd, options, runtime) {
             throw new CliError("source_merge_changed", "The returned merge belongs to another repository.");
         merge = current.merge;
     }
-    return { ...result, status: "timeout", merge: { ...merge, waitTimedOut: true }, next: `andeo source change show --change ${merge.changeId} --json` };
+    if (merge.terminal || ["merged", "deployed", "awaiting_approval", "needs_attention", "publication_not_enabled", "superseded", "authorization_required", "reconciliation_required", "cancelled"].includes(merge.stage))
+        return { ...result, merge };
+    return { ...result, status: "timeout", merge: { ...merge, waitTimedOut: true }, next: merge.changeId
+            ? `andeo source change show --change ${merge.changeId} --json` : `andeo source merge status --merge ${merge.id} --json` };
 }
 async function sourceChangeCreate(cwd, options, runtime) {
     const access = await sourceReadAccess(cwd, options, runtime);
@@ -2410,7 +2466,82 @@ function exampleConfig() {
         returnPath: "/account",
     };
 }
+async function flagshipCommand(command, cwd, options, runtime) {
+    let environment;
+    try {
+        environment = flagEnvironment(requiredFlag(options, "env"));
+    }
+    catch {
+        throw new CliError("flagship_environment_invalid", "Use --env development, preview, or production explicitly.");
+    }
+    const context = await optionalContext(cwd);
+    const projectId = options.flags.get("project") ?? context?.link?.projectId;
+    if (!projectId)
+        throw new CliError("project_required", "Link a project or pass --project.");
+    const { client } = await authenticatedClient(cwd, context?.link ?? null, options, runtime);
+    if (command.startsWith("apps "))
+        return client.flagship(projectId, ["apps", ...(command === "apps ensure" ? ["ensure"] : [])], environment, command === "apps ensure" ? { body: {} } : {});
+    const action = command.slice(6), app = options.positionals[0], key = options.positionals[1];
+    const segments = ["flags", app, ...(key ? [flagKey(key)] : [])];
+    if (action === "list" || action === "get")
+        return client.flagship(projectId, segments, environment);
+    segments.push(action);
+    if (action === "changelog")
+        return client.flagship(projectId, segments, environment);
+    if (action === "evaluate") {
+        const context = requiredFlag(options, "context");
+        if (!context.startsWith("customerId="))
+            throw new CliError("flagship_context_invalid", "Use --context customerId=IDENTIFIER.");
+        const [customerId] = customerIds([context.slice(11)]);
+        return client.flagship(projectId, segments, environment, { customerId });
+    }
+    const revision = options.flags.get("expected-revision");
+    // Read before mutation by default. Server rechecks this revision inside serialization.
+    let expectedRevision;
+    if (revision !== undefined) {
+        expectedRevision = Number(revision);
+        if (!/^\d+$/.test(revision) || !Number.isSafeInteger(expectedRevision))
+            throw new CliError("flagship_revision_invalid", "Expected revision must be a nonnegative integer.");
+    }
+    else if (action === "create")
+        expectedRevision = 0;
+    else
+        expectedRevision = (await client.flagship(projectId, segments.slice(0, -1), environment)).revision;
+    const body = { expectedRevision };
+    if (action === "audience") {
+        const all = options.booleans.has("all"), file = options.flags.get("customer-ids-file");
+        if (all === !!file)
+            throw new CliError("flagship_audience_invalid", "Choose --all or --customer-ids-file.");
+        if (all)
+            body.all = true;
+        else {
+            let value;
+            try {
+                value = JSON.parse(new TextDecoder().decode(await readBoundedFile(resolve(cwd, file), 192 * 1024)));
+            }
+            catch {
+                throw new CliError("flagship_audience_invalid", "The customer ID file must contain a bounded JSON array.");
+            }
+            body.customerIds = customerIds(value);
+        }
+    }
+    if (action === "rollout") {
+        if (requiredFlag(options, "to") !== "on" || requiredFlag(options, "by") !== "customerId")
+            throw new CliError("flagship_rollout_invalid", "V1 supports --to on --by customerId.");
+        const percentage = requiredFlag(options, "percentage");
+        if (!/^(?:\d+)(?:\.\d{1,2})?$/.test(percentage))
+            throw new CliError("flagship_percentage_invalid", "Use a percentage from 0 to 100 with at most two decimals.");
+        body.percentage = rolloutPercentage(Number(percentage));
+    }
+    return client.flagship(projectId, segments, environment, { body });
+}
 function commandTopic(argv) {
+    if (argv[0] === "flagship") {
+        const topic = argv.slice(0, 3).join(" ");
+        if (argv.length < 3 || argv.includes("--help") || argv.includes("-h"))
+            return { topic: "help", values: ["flagship"] };
+        return { topic, values: argv.slice(3) };
+    }
     if (argv.length === 0 || argv[0] === "help" || argv[0] === "--help" || argv[0] === "-h") {
         return { topic: "help", values: argv.slice(1) };
     }
@@ -2425,6 +2556,10 @@ function commandTopic(argv) {
         const child = argv[1];
         if (!child || child.startsWith("--"))
             return { topic: "help", values: [parent] };
+        if (parent === "source" && child === "merge" && argv[2] && !argv[2].startsWith("-")) {
+            const topic = `source merge ${argv[2]}`;
+            return argv.includes("--help") || argv.includes("-h") ? { topic: "help", values: [topic] } : { topic, values: argv.slice(3) };
+        }
         if (parent === "source" && (child === "default" || child === "history" || child === "operation" || child === "change" || child === "policy" || child === "merge-policy" || child === "reconnect" || child === "branch")) {
             const grandchild = argv[2];
             if (!grandchild || grandchild.startsWith("--"))
@@ -2460,7 +2595,7 @@ function parseOptions(values) {
     const booleans = new Set();
     const positionals = [];
     const booleanNames = new Set([
-        "json", "token-stdin", "dry-run", "no-wait", "force", "reauthorize",
+        "json", "token-stdin", "dry-run", "no-wait", "force", "reauthorize", "authorize",
         "device", "wait", "no-open", "local", "all", "production",
     ]);
     for (let index = 0; index < values.length; index += 1) {
@@ -2490,6 +2625,20 @@ function parseOptions(values) {
     return { flags, booleans, positionals, json: booleans.has("json") };
 }
 function assertAllowedOptions(topic, options) {
+    if (topic.startsWith("flagship ")) {
+        const common = ["cwd", "json", "api-url", "token-stdin", "profile", "project", "env"];
+        const extras = { "flags create": ["expected-revision"], "flags enable": ["expected-revision"], "flags disable": ["expected-revision"],
+            "flags audience": ["expected-revision", "customer-ids-file", "all"], "flags rollout": ["expected-revision", "to", "percentage", "by"], "flags evaluate": ["context"], "flags reconcile": ["expected-revision"] };
+        const sub = topic.slice(9);
+        if (!["apps ensure", "apps list", "flags list", "flags get", "flags create", "flags enable", "flags disable", "flags audience", "flags rollout", "flags evaluate", "flags changelog", "flags reconcile"].includes(sub))
+            throw new CliError("argument_unknown", "Unknown flagship command.");
+        if ([...options.flags.keys(), ...options.booleans].some(k => ![...common, ...(extras[sub] ?? [])].includes(k)))
+            throw new CliError("argument_unknown", "Unsupported flagship option.");
+        const length = sub.startsWith("apps") ? 0 : sub === "flags list" ? 1 : 2;
+        if (options.positionals.length !== length)
+            throw new CliError("argument_required", `Expected ${length} positional arguments for ${topic}.`);
+        return;
+    }
     const common = ["cwd", "json"];
     const authentication = ["api-url", "token-stdin", "profile"];
     const allowed = {
@@ -2588,7 +2737,12 @@ function assertAllowedOptions(topic, options) {
         "source operation status": [...common, ...authentication, "operation"],
         "source operation retry": [...common, ...authentication, "operation", "no-wait", "timeout-seconds"],
         "source change create": [...common, ...authentication, "project", "title", "description", "base", "head"],
-        "source merge": [...common, ...authentication, "project", "head", "title", "change", "expected-head", "expected-snapshot", "idempotency-key", "dry-run", "wait", "no-wait", "timeout-seconds"],
+        "source merge": [...common, ...authentication, "project", "head", "title", "change", "expected-head", "expected-snapshot", "idempotency-key", "dry-run", "wait", "no-wait", "timeout-seconds",
+            "expected-base", "expected-policy-revision", "validation-mode", "authorize", "continuation", "note"],
+        "source merge status": [...common, ...authentication, "project", "merge"],
+        "source merge resume": [...common, ...authentication, "project", "merge"],
+        "source merge cancel": [...common, ...authentication, "project", "merge"],
+        "source merge take-over": [...common, ...authentication, "project", "merge", "idempotency-key"],
         "source change resume": [...common, ...authentication, "project", "change"],
         "source change cancel": [...common, ...authentication, "project", "change"],
         "source change take-over": [...common, ...authentication, "project", "change", "idempotency-key"],
@@ -2726,6 +2880,8 @@ function writeOutput(value, options, runtime) {
     runtime.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
 }
 function helpText(topic) {
+    if (topic === "flagship")
+        return "Usage: andeo flagship apps ensure|list --env development|preview|production [--project ID] [--json]\n       andeo flagship flags list APP_ID --env ENV\n       andeo flagship flags create|get|enable|disable|changelog|reconcile APP_ID KEY --env ENV [--expected-revision N]\n       andeo flagship flags audience APP_ID KEY --env ENV --customer-ids-file FILE|--all\n       andeo flagship flags rollout APP_ID KEY --env ENV --to on --percentage 5 --by customerId\n       andeo flagship flags evaluate APP_ID KEY --env ENV --context customerId=synthetic-customer-a\n\nDefaults off. Audience and percentage edits preserve each other and do not enable a disabled flag. Changes propagate; pending writes must be reconciled.";
     if (topic === "email" || topic?.startsWith("email "))
         return `Usage: andeo email <capabilities|create|list|cursor|wait|read|messages|retire> [options]
 
@@ -2805,11 +2961,15 @@ Account workflow entitlement is required for new starts. Run status is authorita
         "source change": "Usage: andeo source change <create|list|show|close|resume|cancel|take-over> [options]\n\nCreate and inspect exact preview-backed changes, or recover an accepted merge intent.",
         "source change cancel": "Usage: andeo source change cancel --change scr_... [--json]\n\nWithdraw new work for an accepted intent. Already-issued effects require readback; source may already be merged.",
         "source change take-over": "Usage: andeo source change take-over --change scr_... --idempotency-key KEY [--json]\n\nAdministrator only. Records a new bounded authorization for the same exact inputs; then use source change resume.",
-        "source merge": "Usage: andeo source merge --head BRANCH --title TITLE --idempotency-key KEY [--dry-run] [--wait] [--timeout-seconds N] [--json]\n       andeo source merge --change scr_... --idempotency-key KEY [--wait] [--json]\n\nRequest exact fast-forward landing and follow the saved publication policy. Human review remains the default; agent merging requires an administrator policy and principal grant. Waiting is bounded and never cancels hosted work.\n\nExamples:\n  andeo source merge --head feature/copy --title \"Update copy\" --idempotency-key account-copy-v1 --dry-run --json\n  andeo source merge --head feature/copy --title \"Update copy\" --idempotency-key account-copy-v1 --wait --json",
+        "source merge": "Usage: andeo source merge --head BRANCH --title TITLE --idempotency-key KEY [--dry-run] [--wait] [--timeout-seconds N] [--json]\n       andeo source merge --change scr_... --idempotency-key KEY [--wait] [--json]\n       andeo source merge --head BRANCH --title TITLE --validation-mode administrator_authorized --expected-base SHA --expected-head SHA --expected-policy-revision N --authorize --idempotency-key KEY [--continuation source_only] [--note TEXT] [--wait] [--json]\n       andeo source merge <status|resume|cancel|take-over> --merge smi_... [options]\n\nRequest exact fast-forward landing. Native review remains the default. Administrator-authorized source-only mode requires saved policy and a current administrator; Andeo does not independently verify checks. Inspect refs and blockers with --dry-run before authorizing. Waiting is bounded and never cancels hosted work.\n\nExamples:\n  andeo source merge --head feature/copy --title \"Update copy\" --idempotency-key account-copy-v1 --dry-run --json\n  andeo source merge --head feature/copy --title \"Update copy\" --idempotency-key account-copy-v1 --wait --json",
+        "source merge status": "Usage: andeo source merge status --merge smi_... [--json]\n\nRead the retained source, validation, authorization, continuation and cleanup outcomes. Source-only merged is successful completion.",
+        "source merge resume": "Usage: andeo source merge resume --merge smi_... [--json]\n\nResume the same exact eligible intent after revalidating authority. Never substitutes a new source snapshot.",
+        "source merge cancel": "Usage: andeo source merge cancel --merge smi_... [--json]\n\nWithdraw new work. Already-issued effects require readback; cancellation cannot undo a merge.",
+        "source merge take-over": "Usage: andeo source merge take-over --merge smi_... --idempotency-key KEY [--json]\n\nAdministrator only. Take ownership of the retained exact source snapshot before resuming.",
         "source merge-policy": "Usage: andeo source merge-policy <show|set> [options]",
         "source change resume": "Usage: andeo source change resume --change scr_... [--json]\n\nResume the same eligible merge intent or exact failed publication. Revalidates authority and retained lineage; never creates a replacement build.\n\nExample:\n  andeo source change resume --change scr_... --json",
         "source merge-policy show": "Usage: andeo source merge-policy show [--json]\n\nRead the saved merge policy and explicit principal grants.",
-        "source merge-policy set": "Usage: andeo source merge-policy set --mode human-review|agent --principals PRINCIPAL_IDS --expected-revision N --idempotency-key KEY [--json]\n\nAdministrator only. Grants are comma-separated stable principal IDs. This never changes publication policy.\n\nExample:\n  andeo source merge-policy set --mode agent --principals principal_example --expected-revision 0 --idempotency-key merge-policy-v1 --json",
+        "source merge-policy set": "Usage: andeo source merge-policy set --mode human-review|agent|administrator-authorized [--principals PRINCIPAL_IDS] --expected-revision N --idempotency-key KEY [--json]\n\nAdministrator only. Agent grants are comma-separated stable principal IDs. Administrator-authorized mode requires controlled transport, source-only continuation and exact per-operation approval; omit --principals. This never changes publication policy.\n\nExample:\n  andeo source merge-policy set --mode agent --principals principal_example --expected-revision 0 --idempotency-key merge-policy-v1 --json",
         "source change create": "Usage: andeo source change create --head BRANCH --title TITLE [--description TEXT] [--base BRANCH] [--json]\n\nOpen a review for the exact protected-base and feature-branch SHAs. Andeo binds checks and approval to this immutable snapshot.",
         "source change list": "Usage: andeo source change list [--state open|closed|all] [--json]\n\nList reviewed source changes for this exact linked project.",
         "source change show": "Usage: andeo source change show --change scr_... [--json]\n\nRead exact snapshot, preview, decision, and landing state.",