langwatch 0.29.1 → 0.31.0

package/dist/chunk-7AXJHD6Z.mjs

@@ -0,0 +1,101 @@
+import {
+  createLangWatchApiClient
+} from "./chunk-NCK4JOHC.mjs";
+import {
+  extractStatusFromResponse,
+  formatApiErrorForOperation
+} from "./chunk-J3KM7ZO7.mjs";
+
+// src/client-sdk/services/evaluators/errors.ts
+var EvaluatorsApiError = class extends Error {
+  constructor(message, operation, originalError) {
+    super(message);
+    this.operation = operation;
+    this.originalError = originalError;
+    this.name = "EvaluatorsApiError";
+  }
+};
+
+// src/client-sdk/services/evaluators/evaluators-api.service.ts
+var EvaluatorsApiService = class {
+  constructor(config) {
+    var _a;
+    this.apiClient = (_a = config == null ? void 0 : config.langwatchApiClient) != null ? _a : createLangWatchApiClient();
+  }
+  handleApiError(operation, error) {
+    const message = formatApiErrorForOperation({ operation, error, options: {
+      status: extractStatusFromResponse(error)
+    } });
+    throw new EvaluatorsApiError(message, operation, error);
+  }
+  /**
+   * Fetches all evaluators for the project.
+   */
+  async getAll() {
+    const { data, error } = await this.apiClient.GET("/api/evaluators");
+    if (error) this.handleApiError("fetch all evaluators", error);
+    return data;
+  }
+  /**
+   * Fetches a single evaluator by its ID or slug.
+   */
+  async get(idOrSlug) {
+    const { data, error } = await this.apiClient.GET(
+      "/api/evaluators/{idOrSlug}",
+      {
+        params: { path: { idOrSlug } }
+      }
+    );
+    if (error)
+      this.handleApiError(
+        `fetch evaluator with ID or slug "${idOrSlug}"`,
+        error
+      );
+    return data;
+  }
+  /**
+   * Creates a new evaluator.
+   */
+  async create(params) {
+    const { data, error } = await this.apiClient.POST("/api/evaluators", {
+      body: params
+    });
+    if (error) this.handleApiError("create evaluator", error);
+    return data;
+  }
+  /**
+   * Updates an evaluator by its ID.
+   */
+  async update(id, params) {
+    const { data, error } = await this.apiClient.PUT(
+      "/api/evaluators/{id}",
+      {
+        params: { path: { id } },
+        body: params
+      }
+    );
+    if (error)
+      this.handleApiError(`update evaluator with ID "${id}"`, error);
+    return data;
+  }
+  /**
+   * Deletes (archives) an evaluator by its ID.
+   */
+  async delete(id) {
+    const { data, error } = await this.apiClient.DELETE(
+      "/api/evaluators/{id}",
+      {
+        params: { path: { id } }
+      }
+    );
+    if (error)
+      this.handleApiError(`delete evaluator with ID "${id}"`, error);
+    return data;
+  }
+};
+
+export {
+  EvaluatorsApiError,
+  EvaluatorsApiService
+};
+//# sourceMappingURL=chunk-7AXJHD6Z.mjs.map

package/dist/chunk-7IX4CELY.mjs

@@ -0,0 +1,63 @@
+import {
+  DatasetApiError,
+  DatasetNotFoundError,
+  DatasetPlanLimitError,
+  DatasetService
+} from "./chunk-XKXYBWXC.mjs";
+import {
+  resolveControlPlaneUrl
+} from "./chunk-7UCML4GT.mjs";
+import {
+  failSpinner
+} from "./chunk-Q7AHHFC3.mjs";
+import {
+  createLangWatchApiClient
+} from "./chunk-NCK4JOHC.mjs";
+import {
+  NoOpLogger
+} from "./chunk-GVFRS2UN.mjs";
+
+// src/cli/commands/dataset/service-factory.ts
+function createDatasetService() {
+  var _a;
+  const apiKey = (_a = process.env.LANGWATCH_API_KEY) != null ? _a : "";
+  const endpoint = resolveControlPlaneUrl().replace(/\/$/, "");
+  return new DatasetService({
+    langwatchApiClient: createLangWatchApiClient(apiKey, endpoint),
+    logger: new NoOpLogger(),
+    endpoint,
+    apiKey
+  });
+}
+
+// src/cli/commands/dataset/error-handler.ts
+import chalk from "chalk";
+function handleDatasetCommandError({
+  spinner,
+  error,
+  context
+}) {
+  if (error instanceof DatasetNotFoundError) {
+    spinner.fail(chalk.red(`Not found: ${error.message}`));
+  } else if (error instanceof DatasetPlanLimitError) {
+    spinner.fail(chalk.red(`Plan limit reached: ${error.message}`));
+    if (error.current !== void 0 && error.max !== void 0) {
+      console.error(
+        chalk.gray(
+          `  Current ${error.limitType}: ${error.current} / ${error.max}`
+        )
+      );
+    }
+  } else if (error instanceof DatasetApiError) {
+    failSpinner({ spinner, error, action: context });
+  } else {
+    failSpinner({ spinner, error, action: context });
+  }
+  process.exit(1);
+}
+
+export {
+  createDatasetService,
+  handleDatasetCommandError
+};
+//# sourceMappingURL=chunk-7IX4CELY.mjs.map

package/dist/chunk-7IX4CELY.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/dataset/service-factory.ts","../src/cli/commands/dataset/error-handler.ts"],"sourcesContent":["import { DatasetService } from \"@/client-sdk/services/datasets\";\nimport { createLangWatchApiClient } from \"@/internal/api/client\";\nimport { NoOpLogger } from \"@/logger\";\nimport { DEFAULT_ENDPOINT } from \"@/internal/constants\";\n\nimport { resolveControlPlaneUrl } from \"@/cli/utils/governance/resolveEndpoint\";\n/**\n * Creates a DatasetService configured from environment variables.\n * Reused by all dataset CLI commands.\n */\nexport function createDatasetService(): DatasetService {\n  const apiKey = process.env.LANGWATCH_API_KEY ?? \"\";\n  const endpoint = (\n    resolveControlPlaneUrl()\n  ).replace(/\\/$/, \"\");\n\n  return new DatasetService({\n    langwatchApiClient: createLangWatchApiClient(apiKey, endpoint),\n    logger: new NoOpLogger(),\n    endpoint,\n    apiKey,\n  });\n}\n","import chalk from \"chalk\";\nimport type { Ora } from \"ora\";\nimport {\n  DatasetApiError,\n  DatasetNotFoundError,\n  DatasetPlanLimitError,\n} from \"@/client-sdk/services/datasets/errors\";\nimport { failSpinner } from \"../../utils/spinnerError\";\n\n/**\n * Centralized error handler for all dataset CLI commands.\n * Maps known error types to a single spinner-fail line (plus an optional\n * detail line for plan limits) and exits with code 1.\n *\n * @param spinner - The ora spinner to fail. The spinner's message is the\n *   only top-level error line rendered — we never emit a separate\n *   `console.error` that would produce two disconnected lines.\n * @param error - The caught error\n * @param context - Human-readable action description (e.g. \"create dataset\",\n *   \"upload records\"). Used as a fallback prefix when the error doesn't\n *   already carry one.\n */\nexport function handleDatasetCommandError({\n  spinner,\n  error,\n  context,\n}: {\n  spinner: Ora;\n  error: unknown;\n  context: string;\n}): never {\n  if (error instanceof DatasetNotFoundError) {\n    spinner.fail(chalk.red(`Not found: ${error.message}`));\n  } else if (error instanceof DatasetPlanLimitError) {\n    spinner.fail(chalk.red(`Plan limit reached: ${error.message}`));\n    if (error.current !== undefined && error.max !== undefined) {\n      console.error(\n        chalk.gray(\n          `  Current ${error.limitType}: ${error.current} / ${error.max}`,\n        ),\n      );\n    }\n  } else if (error instanceof DatasetApiError) {\n    // DatasetApiError.message is already built with formatApiErrorForOperation\n    // (\"Failed to <op>: <detail>\"), so forward it as-is via failSpinner to keep\n    // the double-prefix guard and single-line rendering consistent.\n    failSpinner({ spinner, error, action: context });\n  } else {\n    failSpinner({ spinner, error, action: context });\n  }\n  process.exit(1);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAUO,SAAS,uBAAuC;AAVvD;AAWE,QAAM,UAAS,aAAQ,IAAI,sBAAZ,YAAiC;AAChD,QAAM,WACJ,uBAAuB,EACvB,QAAQ,OAAO,EAAE;AAEnB,SAAO,IAAI,eAAe;AAAA,IACxB,oBAAoB,yBAAyB,QAAQ,QAAQ;AAAA,IAC7D,QAAQ,IAAI,WAAW;AAAA,IACvB;AAAA,IACA;AAAA,EACF,CAAC;AACH;;;ACtBA,OAAO,WAAW;AAsBX,SAAS,0BAA0B;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AACF,GAIU;AACR,MAAI,iBAAiB,sBAAsB;AACzC,YAAQ,KAAK,MAAM,IAAI,cAAc,MAAM,OAAO,EAAE,CAAC;AAAA,EACvD,WAAW,iBAAiB,uBAAuB;AACjD,YAAQ,KAAK,MAAM,IAAI,uBAAuB,MAAM,OAAO,EAAE,CAAC;AAC9D,QAAI,MAAM,YAAY,UAAa,MAAM,QAAQ,QAAW;AAC1D,cAAQ;AAAA,QACN,MAAM;AAAA,UACJ,aAAa,MAAM,SAAS,KAAK,MAAM,OAAO,MAAM,MAAM,GAAG;AAAA,QAC/D;AAAA,MACF;AAAA,IACF;AAAA,EACF,WAAW,iBAAiB,iBAAiB;AAI3C,gBAAY,EAAE,SAAS,OAAO,QAAQ,QAAQ,CAAC;AAAA,EACjD,OAAO;AACL,gBAAY,EAAE,SAAS,OAAO,QAAQ,QAAQ,CAAC;AAAA,EACjD;AACA,UAAQ,KAAK,CAAC;AAChB;","names":[]}

package/dist/chunk-7KTDTNXT.mjs

@@ -0,0 +1,297 @@
+import {
+  __spreadProps,
+  __spreadValues
+} from "./chunk-BAX4W3AY.mjs";
+
+// src/cli/utils/governance/surface.ts
+var CLI_SURFACE_HEADER = "X-LangWatch-Surface";
+var CLI_SURFACE_VALUE = "cli";
+
+// src/cli/utils/governance/cli-api.ts
+var GovernanceCliError = class extends Error {
+  constructor(status, code, message) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.name = "GovernanceCliError";
+  }
+};
+async function getJSON(cfg, path, opts = {}) {
+  var _a, _b, _c;
+  if (!cfg.access_token) {
+    throw new GovernanceCliError(
+      401,
+      "not_logged_in",
+      "Not logged in. Run `langwatch login --device` first."
+    );
+  }
+  const url = cfg.control_plane_url.replace(/\/+$/, "") + path;
+  const f = (_a = opts.fetchImpl) != null ? _a : fetch;
+  const res = await f(url, {
+    method: "GET",
+    headers: {
+      Authorization: `Bearer ${cfg.access_token}`,
+      Accept: "application/json"
+    }
+  });
+  if (res.status === 401) {
+    throw new GovernanceCliError(
+      401,
+      "unauthorized",
+      "Session expired \u2014 run `langwatch login --device` again"
+    );
+  }
+  if (res.status === 402) {
+    const body = await res.json().catch(() => ({}));
+    const description = (_b = body.error_description) != null ? _b : "This feature requires an Enterprise plan";
+    const upgrade = body.upgrade_url ? `
+
+  Upgrade your organization at:
+    ${body.upgrade_url}` : "";
+    throw new GovernanceCliError(
+      402,
+      "payment_required",
+      `${description}${upgrade}`
+    );
+  }
+  if (res.status === 404) {
+    const body = await res.json().catch(() => ({}));
+    throw new GovernanceCliError(
+      404,
+      "not_found",
+      (_c = body.error_description) != null ? _c : "Not found"
+    );
+  }
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new GovernanceCliError(
+      res.status,
+      "other",
+      `${res.status} ${body.slice(0, 200)}`
+    );
+  }
+  return await res.json();
+}
+async function listIngestionSources(cfg, options = {}) {
+  const qs = options.includeArchived ? "?include_archived=1" : "";
+  const body = await getJSON(
+    cfg,
+    `/api/auth/cli/governance/ingest/sources${qs}`,
+    options
+  );
+  return body.sources;
+}
+async function getEventsForSource(cfg, sourceId, options = {}) {
+  const params = new URLSearchParams();
+  if (options.limit) params.set("limit", String(options.limit));
+  if (options.beforeIso) params.set("before_iso", options.beforeIso);
+  const qs = params.toString() ? `?${params.toString()}` : "";
+  const body = await getJSON(
+    cfg,
+    `/api/auth/cli/governance/ingest/sources/${encodeURIComponent(
+      sourceId
+    )}/events${qs}`,
+    options
+  );
+  return body.events;
+}
+async function getSourceHealth(cfg, sourceId, options = {}) {
+  return getJSON(
+    cfg,
+    `/api/auth/cli/governance/ingest/sources/${encodeURIComponent(
+      sourceId
+    )}/health`,
+    options
+  );
+}
+async function getGovernanceStatus(cfg, options = {}) {
+  return getJSON(cfg, `/api/auth/cli/governance/status`, options);
+}
+async function getCliBootstrap(cfg, options = {}) {
+  try {
+    return await getJSON(
+      cfg,
+      `/api/auth/cli/bootstrap`,
+      options
+    );
+  } catch (err) {
+    if (err instanceof GovernanceCliError && err.status === 404) {
+      return null;
+    }
+    throw err;
+  }
+}
+async function requestREST(cfg, method, path, options = {}) {
+  var _a, _b, _c, _d, _e, _f, _g;
+  if (!cfg.access_token) {
+    throw new GovernanceCliError(
+      401,
+      "not_logged_in",
+      "Not logged in. Run `langwatch login --device` first."
+    );
+  }
+  const url = cfg.control_plane_url.replace(/\/+$/, "") + path;
+  const f = (_a = options.fetchImpl) != null ? _a : fetch;
+  const headers = {
+    Authorization: `Bearer ${cfg.access_token}`,
+    Accept: "application/json"
+  };
+  if (options.mutating) {
+    headers[CLI_SURFACE_HEADER] = CLI_SURFACE_VALUE;
+  }
+  if (options.body !== void 0) {
+    headers["Content-Type"] = "application/json";
+  }
+  const res = await f(url, {
+    method,
+    headers,
+    body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
+  });
+  if (res.status === 204) return void 0;
+  if (res.status === 401) {
+    throw new GovernanceCliError(
+      401,
+      "unauthorized",
+      "Session expired \u2014 run `langwatch login --device` again"
+    );
+  }
+  if (res.status === 403) {
+    const body = await res.json().catch(() => ({}));
+    throw new GovernanceCliError(
+      403,
+      (_c = (_b = body.error) == null ? void 0 : _b.code) != null ? _c : "forbidden",
+      (_e = (_d = body.error) == null ? void 0 : _d.message) != null ? _e : "Forbidden"
+    );
+  }
+  if (res.status === 404) {
+    const body = await res.json().catch(() => ({}));
+    throw new GovernanceCliError(
+      404,
+      "not_found",
+      (_g = (_f = body.error) == null ? void 0 : _f.message) != null ? _g : "Not found"
+    );
+  }
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new GovernanceCliError(
+      res.status,
+      "other",
+      `${res.status} ${body.slice(0, 200)}`
+    );
+  }
+  return await res.json();
+}
+async function listIngestionTemplates(cfg, options = {}) {
+  const body = await requestREST(
+    cfg,
+    "GET",
+    "/api/governance/ingestion-templates",
+    options
+  );
+  return body.ingestion_templates;
+}
+async function adminListIngestionTemplates(cfg, options = {}) {
+  const body = await requestREST(
+    cfg,
+    "GET",
+    "/api/governance/ingestion-templates/admin",
+    options
+  );
+  return body.ingestion_templates;
+}
+async function getIngestionTemplate(cfg, id, options = {}) {
+  const body = await requestREST(
+    cfg,
+    "GET",
+    `/api/governance/ingestion-templates/${encodeURIComponent(id)}`,
+    options
+  );
+  return body.ingestion_template;
+}
+async function createIngestionTemplate(cfg, input, options = {}) {
+  const body = await requestREST(
+    cfg,
+    "POST",
+    "/api/governance/ingestion-templates",
+    __spreadProps(__spreadValues({}, options), { body: input, mutating: true })
+  );
+  return body.ingestion_template;
+}
+async function updateIngestionTemplateOttlRules(cfg, id, ottlRules, options = {}) {
+  const body = await requestREST(
+    cfg,
+    "PATCH",
+    `/api/governance/ingestion-templates/${encodeURIComponent(id)}/ottl-rules`,
+    __spreadProps(__spreadValues({}, options), { body: { ottl_rules: ottlRules }, mutating: true })
+  );
+  return body.ingestion_template;
+}
+async function archiveIngestionTemplate(cfg, id, options = {}) {
+  return requestREST(
+    cfg,
+    "DELETE",
+    `/api/governance/ingestion-templates/${encodeURIComponent(id)}`,
+    __spreadProps(__spreadValues({}, options), { mutating: true })
+  );
+}
+async function cloneIngestionTemplateFromPlatform(cfg, sourceTemplateId, options = {}) {
+  const body = await requestREST(
+    cfg,
+    "POST",
+    "/api/governance/ingestion-templates/clone-from-platform",
+    __spreadProps(__spreadValues({}, options), {
+      body: { source_template_id: sourceTemplateId },
+      mutating: true
+    })
+  );
+  return body.ingestion_template;
+}
+async function listUserIngestionBindings(cfg, options = {}) {
+  const body = await requestREST(cfg, "GET", "/api/governance/user-ingestion-bindings", options);
+  return body.user_ingestion_bindings;
+}
+async function installUserIngestionBinding(cfg, templateId, options = {}) {
+  return requestREST(
+    cfg,
+    "POST",
+    "/api/governance/user-ingestion-bindings",
+    __spreadProps(__spreadValues({}, options), { body: { template_id: templateId }, mutating: true })
+  );
+}
+async function uninstallUserIngestionBinding(cfg, bindingId, options = {}) {
+  return requestREST(
+    cfg,
+    "DELETE",
+    `/api/governance/user-ingestion-bindings/${encodeURIComponent(bindingId)}`,
+    __spreadProps(__spreadValues({}, options), { mutating: true })
+  );
+}
+async function rotateUserIngestionBindingToken(cfg, bindingId, options = {}) {
+  return requestREST(
+    cfg,
+    "POST",
+    `/api/governance/user-ingestion-bindings/${encodeURIComponent(bindingId)}/rotate`,
+    __spreadProps(__spreadValues({}, options), { mutating: true })
+  );
+}
+
+export {
+  GovernanceCliError,
+  listIngestionSources,
+  getEventsForSource,
+  getSourceHealth,
+  getGovernanceStatus,
+  getCliBootstrap,
+  listIngestionTemplates,
+  adminListIngestionTemplates,
+  getIngestionTemplate,
+  createIngestionTemplate,
+  updateIngestionTemplateOttlRules,
+  archiveIngestionTemplate,
+  cloneIngestionTemplateFromPlatform,
+  listUserIngestionBindings,
+  installUserIngestionBinding,
+  uninstallUserIngestionBinding,
+  rotateUserIngestionBindingToken
+};
+//# sourceMappingURL=chunk-7KTDTNXT.mjs.map

package/dist/chunk-7KTDTNXT.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/utils/governance/surface.ts","../src/cli/utils/governance/cli-api.ts"],"sourcesContent":["/**\n * Mirror of `GovernanceCallSurface` from the langwatch app\n * (ee/governance/services/auditSurface.ts). Kept as a hand-written\n * type alias rather than imported because the CLI package doesn't\n * pull from the langwatch source tree.\n *\n * The CLI only ever sends \"cli\" — the other values are documented\n * here so the type stays informational + so any future SDK regen\n * targeting governance audit metadata picks up the canonical set.\n */\nexport type GovernanceCallSurface = \"trpc\" | \"hono\" | \"cli\" | \"mcp\";\n\nexport const CLI_SURFACE_HEADER = \"X-LangWatch-Surface\" as const;\nexport const CLI_SURFACE_VALUE: GovernanceCallSurface = \"cli\";\n","/**\n * Thin REST client for governance endpoints used by the\n * `langwatch governance ...` CLI namespace.\n *\n * Two transports live in this file:\n *\n *   1. `/api/auth/cli/governance/*` — CLI-specific read proxies for\n *      activity monitor + status that pre-date the public REST\n *      surface. Read-only.\n *   2. `/api/governance/*` — the public REST contract Sergey shipped\n *      at 0bb951160 / 5275e7e11. Full CRUD on IngestionTemplate +\n *      UserIngestionBinding. The CLI sends\n *      `X-LangWatch-Surface: cli` so audit rows land with\n *      `metadata.surface = 'cli'` per @audit-uniform.\n */\n\nimport { type GovernanceConfig } from \"./config\";\nimport {\n  CLI_SURFACE_HEADER,\n  CLI_SURFACE_VALUE,\n} from \"./surface\";\n\nexport interface IngestionSourceSummary {\n  id: string;\n  name: string;\n  sourceType: string;\n  description: string | null;\n  status: string;\n  lastEventAt: string | null;\n  createdAt: string;\n  archivedAt: string | null;\n}\n\nexport interface ActivityEventDetailRow {\n  eventId: string;\n  eventType: string;\n  actor: string;\n  action: string;\n  target: string;\n  costUsd: number;\n  tokensInput: number;\n  tokensOutput: number;\n  eventTimestampIso: string;\n  ingestedAtIso: string;\n  rawPayload: string;\n}\n\nexport interface SourceHealthMetrics {\n  events24h: number;\n  events7d: number;\n  events30d: number;\n  lastSuccessIso: string | null;\n}\n\nexport interface GovernanceSetupState {\n  hasPersonalVKs: boolean;\n  hasRoutingPolicies: boolean;\n  hasIngestionSources: boolean;\n  hasAnomalyRules: boolean;\n  hasRecentActivity: boolean;\n  governanceActive: boolean;\n}\n\nexport class GovernanceCliError extends Error {\n  constructor(\n    public readonly status: number,\n    public readonly code: string,\n    message: string,\n  ) {\n    super(message);\n    this.name = \"GovernanceCliError\";\n  }\n}\n\nexport interface CliApiOptions {\n  fetchImpl?: typeof fetch;\n}\n\nasync function getJSON<T>(\n  cfg: GovernanceConfig,\n  path: string,\n  opts: CliApiOptions = {},\n): Promise<T> {\n  if (!cfg.access_token) {\n    throw new GovernanceCliError(\n      401,\n      \"not_logged_in\",\n      \"Not logged in. Run `langwatch login --device` first.\",\n    );\n  }\n  const url = cfg.control_plane_url.replace(/\\/+$/, \"\") + path;\n  const f = opts.fetchImpl ?? fetch;\n  const res = await f(url, {\n    method: \"GET\",\n    headers: {\n      Authorization: `Bearer ${cfg.access_token}`,\n      Accept: \"application/json\",\n    },\n  });\n  if (res.status === 401) {\n    throw new GovernanceCliError(\n      401,\n      \"unauthorized\",\n      \"Session expired — run `langwatch login --device` again\",\n    );\n  }\n  if (res.status === 402) {\n    const body = (await res.json().catch(() => ({}))) as {\n      error_description?: string;\n      upgrade_url?: string;\n    };\n    const description =\n      body.error_description ?? \"This feature requires an Enterprise plan\";\n    const upgrade = body.upgrade_url\n      ? `\\n\\n  Upgrade your organization at:\\n    ${body.upgrade_url}`\n      : \"\";\n    throw new GovernanceCliError(\n      402,\n      \"payment_required\",\n      `${description}${upgrade}`,\n    );\n  }\n  if (res.status === 404) {\n    const body = (await res.json().catch(() => ({}))) as {\n      error_description?: string;\n    };\n    throw new GovernanceCliError(\n      404,\n      \"not_found\",\n      body.error_description ?? \"Not found\",\n    );\n  }\n  if (!res.ok) {\n    const body = await res.text().catch(() => \"\");\n    throw new GovernanceCliError(\n      res.status,\n      \"other\",\n      `${res.status} ${body.slice(0, 200)}`,\n    );\n  }\n  return (await res.json()) as T;\n}\n\nexport async function listIngestionSources(\n  cfg: GovernanceConfig,\n  options: { includeArchived?: boolean } & CliApiOptions = {},\n): Promise<IngestionSourceSummary[]> {\n  const qs = options.includeArchived ? \"?include_archived=1\" : \"\";\n  const body = await getJSON<{ sources: IngestionSourceSummary[] }>(\n    cfg,\n    `/api/auth/cli/governance/ingest/sources${qs}`,\n    options,\n  );\n  return body.sources;\n}\n\nexport async function getEventsForSource(\n  cfg: GovernanceConfig,\n  sourceId: string,\n  options: { limit?: number; beforeIso?: string } & CliApiOptions = {},\n): Promise<ActivityEventDetailRow[]> {\n  const params = new URLSearchParams();\n  if (options.limit) params.set(\"limit\", String(options.limit));\n  if (options.beforeIso) params.set(\"before_iso\", options.beforeIso);\n  const qs = params.toString() ? `?${params.toString()}` : \"\";\n  const body = await getJSON<{ events: ActivityEventDetailRow[] }>(\n    cfg,\n    `/api/auth/cli/governance/ingest/sources/${encodeURIComponent(\n      sourceId,\n    )}/events${qs}`,\n    options,\n  );\n  return body.events;\n}\n\nexport async function getSourceHealth(\n  cfg: GovernanceConfig,\n  sourceId: string,\n  options: CliApiOptions = {},\n): Promise<{\n  source: { id: string; name: string; status: string };\n  health: SourceHealthMetrics;\n}> {\n  return getJSON(\n    cfg,\n    `/api/auth/cli/governance/ingest/sources/${encodeURIComponent(\n      sourceId,\n    )}/health`,\n    options,\n  );\n}\n\nexport async function getGovernanceStatus(\n  cfg: GovernanceConfig,\n  options: CliApiOptions = {},\n): Promise<{ setup: GovernanceSetupState }> {\n  return getJSON(cfg, `/api/auth/cli/governance/status`, options);\n}\n\nexport interface CliBootstrapProvider {\n  name: string;\n  displayName: string;\n  models: string[];\n}\n\nexport interface CliBootstrapBudget {\n  monthlyLimitUsd: number | null;\n  monthlyUsedUsd: number;\n  period: string;\n}\n\nexport interface CliBootstrapResponse {\n  providers: CliBootstrapProvider[];\n  budget: CliBootstrapBudget;\n  /**\n   * Server-authoritative gateway base URL. Sourced from the backend's\n   * `LW_GATEWAY_BASE_URL` (or its self-hosted/SaaS-aware fallback).\n   * Older self-hosted servers without this field fall back to the\n   * CLI's local config default — so undefined is the legacy shape, not\n   * an error.\n   */\n  gatewayUrl?: string;\n  /**\n   * First org admin's email (by createdAt). Rendered as a mailto in\n   * wrapper preflight failure messages so non-admin users get a real\n   * contact path instead of a vague \"ask your admin\". `null` when the\n   * org has no admin yet; `undefined` on legacy servers without the\n   * field (CLI falls back to a generic line).\n   */\n  adminEmail?: string | null;\n}\n\n/**\n * Fetch the Storyboard Screen 4 ceremony enrichment data —\n * inheritable providers + the user's effective monthly budget.\n *\n * Backend tRPC source: `api.user.cliBootstrap` (Sergey 32cad11ae).\n * REST adapter: `/api/auth/cli/bootstrap` (queued backend follow-up).\n *\n * Graceful degrade: returns null on 404 (older self-hosted server\n * without the REST endpoint) so the CLI ceremony falls back to the\n * basic header + try-it block. Other errors still throw so they can\n * be logged at the call site.\n */\nexport async function getCliBootstrap(\n  cfg: GovernanceConfig,\n  options: CliApiOptions = {},\n): Promise<CliBootstrapResponse | null> {\n  try {\n    return await getJSON<CliBootstrapResponse>(\n      cfg,\n      `/api/auth/cli/bootstrap`,\n      options,\n    );\n  } catch (err) {\n    if (err instanceof GovernanceCliError && err.status === 404) {\n      return null;\n    }\n    throw err;\n  }\n}\n\n// ── Public REST: /api/governance/* ─────────────────────────────────────────\n//\n// Sergey's Hono routes at 0bb951160 (templates) + 5275e7e11 (bindings).\n// Wire shape locked at 1839d9f54 + 60f769498 (snake_case in/out).\n// All mutating calls send X-LangWatch-Surface: cli per @audit-uniform.\n\nexport interface IngestionTemplateRow {\n  id: string;\n  organization_id: string | null;\n  slug: string;\n  source_type: string;\n  display_name: string;\n  description: string | null;\n  icon_asset: string | null;\n  credential_schema: string | null;\n  ottl_rules: string;\n  platform_published: boolean;\n  enabled: boolean;\n}\n\nexport interface UserIngestionBindingRow {\n  id: string;\n  template_id: string;\n  user_id: string;\n  organization_id: string;\n  personal_project_id: string;\n  binding_access_token_prefix: string;\n  enabled: boolean;\n  created_at: string;\n}\n\ntype RestMethod = \"GET\" | \"POST\" | \"PATCH\" | \"DELETE\";\n\nasync function requestREST<T>(\n  cfg: GovernanceConfig,\n  method: RestMethod,\n  path: string,\n  options: { body?: unknown; mutating?: boolean } & CliApiOptions = {},\n): Promise<T> {\n  if (!cfg.access_token) {\n    throw new GovernanceCliError(\n      401,\n      \"not_logged_in\",\n      \"Not logged in. Run `langwatch login --device` first.\",\n    );\n  }\n  const url = cfg.control_plane_url.replace(/\\/+$/, \"\") + path;\n  const f = options.fetchImpl ?? fetch;\n  const headers: Record<string, string> = {\n    Authorization: `Bearer ${cfg.access_token}`,\n    Accept: \"application/json\",\n  };\n  if (options.mutating) {\n    headers[CLI_SURFACE_HEADER] = CLI_SURFACE_VALUE;\n  }\n  if (options.body !== undefined) {\n    headers[\"Content-Type\"] = \"application/json\";\n  }\n  const res = await f(url, {\n    method,\n    headers,\n    body: options.body !== undefined ? JSON.stringify(options.body) : undefined,\n  });\n  if (res.status === 204) return undefined as T;\n  if (res.status === 401) {\n    throw new GovernanceCliError(\n      401,\n      \"unauthorized\",\n      \"Session expired — run `langwatch login --device` again\",\n    );\n  }\n  if (res.status === 403) {\n    const body = (await res.json().catch(() => ({}))) as {\n      error?: { message?: string; code?: string };\n    };\n    throw new GovernanceCliError(\n      403,\n      body.error?.code ?? \"forbidden\",\n      body.error?.message ?? \"Forbidden\",\n    );\n  }\n  if (res.status === 404) {\n    const body = (await res.json().catch(() => ({}))) as {\n      error?: { message?: string };\n    };\n    throw new GovernanceCliError(\n      404,\n      \"not_found\",\n      body.error?.message ?? \"Not found\",\n    );\n  }\n  if (!res.ok) {\n    const body = await res.text().catch(() => \"\");\n    throw new GovernanceCliError(\n      res.status,\n      \"other\",\n      `${res.status} ${body.slice(0, 200)}`,\n    );\n  }\n  return (await res.json()) as T;\n}\n\n// IngestionTemplate verbs ----------------------------------------------------\n\nexport async function listIngestionTemplates(\n  cfg: GovernanceConfig,\n  options: CliApiOptions = {},\n): Promise<IngestionTemplateRow[]> {\n  const body = await requestREST<{ ingestion_templates: IngestionTemplateRow[] }>(\n    cfg,\n    \"GET\",\n    \"/api/governance/ingestion-templates\",\n    options,\n  );\n  return body.ingestion_templates;\n}\n\nexport async function adminListIngestionTemplates(\n  cfg: GovernanceConfig,\n  options: CliApiOptions = {},\n): Promise<IngestionTemplateRow[]> {\n  const body = await requestREST<{ ingestion_templates: IngestionTemplateRow[] }>(\n    cfg,\n    \"GET\",\n    \"/api/governance/ingestion-templates/admin\",\n    options,\n  );\n  return body.ingestion_templates;\n}\n\nexport async function getIngestionTemplate(\n  cfg: GovernanceConfig,\n  id: string,\n  options: CliApiOptions = {},\n): Promise<IngestionTemplateRow> {\n  const body = await requestREST<{ ingestion_template: IngestionTemplateRow }>(\n    cfg,\n    \"GET\",\n    `/api/governance/ingestion-templates/${encodeURIComponent(id)}`,\n    options,\n  );\n  return body.ingestion_template;\n}\n\nexport async function createIngestionTemplate(\n  cfg: GovernanceConfig,\n  input: {\n    source_type: string;\n    display_name: string;\n    description?: string;\n    icon_asset?: string;\n    credential_schema?: \"otlp_token\" | \"static_api_key\" | \"agent_id\" | null;\n    ottl_rules?: string;\n  },\n  options: CliApiOptions = {},\n): Promise<IngestionTemplateRow> {\n  const body = await requestREST<{ ingestion_template: IngestionTemplateRow }>(\n    cfg,\n    \"POST\",\n    \"/api/governance/ingestion-templates\",\n    { ...options, body: input, mutating: true },\n  );\n  return body.ingestion_template;\n}\n\nexport async function updateIngestionTemplateOttlRules(\n  cfg: GovernanceConfig,\n  id: string,\n  ottlRules: string,\n  options: CliApiOptions = {},\n): Promise<IngestionTemplateRow> {\n  const body = await requestREST<{ ingestion_template: IngestionTemplateRow }>(\n    cfg,\n    \"PATCH\",\n    `/api/governance/ingestion-templates/${encodeURIComponent(id)}/ottl-rules`,\n    { ...options, body: { ottl_rules: ottlRules }, mutating: true },\n  );\n  return body.ingestion_template;\n}\n\nexport async function archiveIngestionTemplate(\n  cfg: GovernanceConfig,\n  id: string,\n  options: CliApiOptions = {},\n): Promise<{ ok: true }> {\n  return requestREST<{ ok: true }>(\n    cfg,\n    \"DELETE\",\n    `/api/governance/ingestion-templates/${encodeURIComponent(id)}`,\n    { ...options, mutating: true },\n  );\n}\n\nexport async function cloneIngestionTemplateFromPlatform(\n  cfg: GovernanceConfig,\n  sourceTemplateId: string,\n  options: CliApiOptions = {},\n): Promise<IngestionTemplateRow> {\n  const body = await requestREST<{ ingestion_template: IngestionTemplateRow }>(\n    cfg,\n    \"POST\",\n    \"/api/governance/ingestion-templates/clone-from-platform\",\n    {\n      ...options,\n      body: { source_template_id: sourceTemplateId },\n      mutating: true,\n    },\n  );\n  return body.ingestion_template;\n}\n\n// UserIngestionBinding verbs ------------------------------------------------\n\nexport async function listUserIngestionBindings(\n  cfg: GovernanceConfig,\n  options: CliApiOptions = {},\n): Promise<UserIngestionBindingRow[]> {\n  const body = await requestREST<{\n    user_ingestion_bindings: UserIngestionBindingRow[];\n  }>(cfg, \"GET\", \"/api/governance/user-ingestion-bindings\", options);\n  return body.user_ingestion_bindings;\n}\n\nexport async function installUserIngestionBinding(\n  cfg: GovernanceConfig,\n  templateId: string,\n  options: CliApiOptions = {},\n): Promise<{\n  user_ingestion_binding: UserIngestionBindingRow;\n  binding_access_token: string;\n}> {\n  return requestREST(\n    cfg,\n    \"POST\",\n    \"/api/governance/user-ingestion-bindings\",\n    { ...options, body: { template_id: templateId }, mutating: true },\n  );\n}\n\nexport async function uninstallUserIngestionBinding(\n  cfg: GovernanceConfig,\n  bindingId: string,\n  options: CliApiOptions = {},\n): Promise<{ ok: true }> {\n  return requestREST<{ ok: true }>(\n    cfg,\n    \"DELETE\",\n    `/api/governance/user-ingestion-bindings/${encodeURIComponent(bindingId)}`,\n    { ...options, mutating: true },\n  );\n}\n\nexport async function rotateUserIngestionBindingToken(\n  cfg: GovernanceConfig,\n  bindingId: string,\n  options: CliApiOptions = {},\n): Promise<{\n  user_ingestion_binding: UserIngestionBindingRow;\n  binding_access_token: string;\n}> {\n  return requestREST(\n    cfg,\n    \"POST\",\n    `/api/governance/user-ingestion-bindings/${encodeURIComponent(bindingId)}/rotate`,\n    { ...options, mutating: true },\n  );\n}\n"],"mappings":";;;;;;AAYO,IAAM,qBAAqB;AAC3B,IAAM,oBAA2C;;;ACkDjD,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAC5C,YACkB,QACA,MAChB,SACA;AACA,UAAM,OAAO;AAJG;AACA;AAIhB,SAAK,OAAO;AAAA,EACd;AACF;AAMA,eAAe,QACb,KACA,MACA,OAAsB,CAAC,GACX;AAlFd;AAmFE,MAAI,CAAC,IAAI,cAAc;AACrB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAM,IAAI,kBAAkB,QAAQ,QAAQ,EAAE,IAAI;AACxD,QAAM,KAAI,UAAK,cAAL,YAAkB;AAC5B,QAAM,MAAM,MAAM,EAAE,KAAK;AAAA,IACvB,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe,UAAU,IAAI,YAAY;AAAA,MACzC,QAAQ;AAAA,IACV;AAAA,EACF,CAAC;AACD,MAAI,IAAI,WAAW,KAAK;AACtB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,KAAK;AACtB,UAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAI/C,UAAM,eACJ,UAAK,sBAAL,YAA0B;AAC5B,UAAM,UAAU,KAAK,cACjB;AAAA;AAAA;AAAA,MAA4C,KAAK,WAAW,KAC5D;AACJ,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,GAAG,WAAW,GAAG,OAAO;AAAA,IAC1B;AAAA,EACF;AACA,MAAI,IAAI,WAAW,KAAK;AACtB,UAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAG/C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,OACA,UAAK,sBAAL,YAA0B;AAAA,IAC5B;AAAA,EACF;AACA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,UAAM,IAAI;AAAA,MACR,IAAI;AAAA,MACJ;AAAA,MACA,GAAG,IAAI,MAAM,IAAI,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,IACrC;AAAA,EACF;AACA,SAAQ,MAAM,IAAI,KAAK;AACzB;AAEA,eAAsB,qBACpB,KACA,UAAyD,CAAC,GACvB;AACnC,QAAM,KAAK,QAAQ,kBAAkB,wBAAwB;AAC7D,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA,0CAA0C,EAAE;AAAA,IAC5C;AAAA,EACF;AACA,SAAO,KAAK;AACd;AAEA,eAAsB,mBACpB,KACA,UACA,UAAkE,CAAC,GAChC;AACnC,QAAM,SAAS,IAAI,gBAAgB;AACnC,MAAI,QAAQ,MAAO,QAAO,IAAI,SAAS,OAAO,QAAQ,KAAK,CAAC;AAC5D,MAAI,QAAQ,UAAW,QAAO,IAAI,cAAc,QAAQ,SAAS;AACjE,QAAM,KAAK,OAAO,SAAS,IAAI,IAAI,OAAO,SAAS,CAAC,KAAK;AACzD,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA,2CAA2C;AAAA,MACzC;AAAA,IACF,CAAC,UAAU,EAAE;AAAA,IACb;AAAA,EACF;AACA,SAAO,KAAK;AACd;AAEA,eAAsB,gBACpB,KACA,UACA,UAAyB,CAAC,GAIzB;AACD,SAAO;AAAA,IACL;AAAA,IACA,2CAA2C;AAAA,MACzC;AAAA,IACF,CAAC;AAAA,IACD;AAAA,EACF;AACF;AAEA,eAAsB,oBACpB,KACA,UAAyB,CAAC,GACgB;AAC1C,SAAO,QAAQ,KAAK,mCAAmC,OAAO;AAChE;AA+CA,eAAsB,gBACpB,KACA,UAAyB,CAAC,GACY;AACtC,MAAI;AACF,WAAO,MAAM;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,eAAe,sBAAsB,IAAI,WAAW,KAAK;AAC3D,aAAO;AAAA,IACT;AACA,UAAM;AAAA,EACR;AACF;AAmCA,eAAe,YACb,KACA,QACA,MACA,UAAkE,CAAC,GACvD;AA5Sd;AA6SE,MAAI,CAAC,IAAI,cAAc;AACrB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAM,IAAI,kBAAkB,QAAQ,QAAQ,EAAE,IAAI;AACxD,QAAM,KAAI,aAAQ,cAAR,YAAqB;AAC/B,QAAM,UAAkC;AAAA,IACtC,eAAe,UAAU,IAAI,YAAY;AAAA,IACzC,QAAQ;AAAA,EACV;AACA,MAAI,QAAQ,UAAU;AACpB,YAAQ,kBAAkB,IAAI;AAAA,EAChC;AACA,MAAI,QAAQ,SAAS,QAAW;AAC9B,YAAQ,cAAc,IAAI;AAAA,EAC5B;AACA,QAAM,MAAM,MAAM,EAAE,KAAK;AAAA,IACvB;AAAA,IACA;AAAA,IACA,MAAM,QAAQ,SAAS,SAAY,KAAK,UAAU,QAAQ,IAAI,IAAI;AAAA,EACpE,CAAC;AACD,MAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,MAAI,IAAI,WAAW,KAAK;AACtB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,KAAK;AACtB,UAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAG/C,UAAM,IAAI;AAAA,MACR;AAAA,OACA,gBAAK,UAAL,mBAAY,SAAZ,YAAoB;AAAA,OACpB,gBAAK,UAAL,mBAAY,YAAZ,YAAuB;AAAA,IACzB;AAAA,EACF;AACA,MAAI,IAAI,WAAW,KAAK;AACtB,UAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAG/C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,OACA,gBAAK,UAAL,mBAAY,YAAZ,YAAuB;AAAA,IACzB;AAAA,EACF;AACA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,UAAM,IAAI;AAAA,MACR,IAAI;AAAA,MACJ;AAAA,MACA,GAAG,IAAI,MAAM,IAAI,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,IACrC;AAAA,EACF;AACA,SAAQ,MAAM,IAAI,KAAK;AACzB;AAIA,eAAsB,uBACpB,KACA,UAAyB,CAAC,GACO;AACjC,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO,KAAK;AACd;AAEA,eAAsB,4BACpB,KACA,UAAyB,CAAC,GACO;AACjC,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO,KAAK;AACd;AAEA,eAAsB,qBACpB,KACA,IACA,UAAyB,CAAC,GACK;AAC/B,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,uCAAuC,mBAAmB,EAAE,CAAC;AAAA,IAC7D;AAAA,EACF;AACA,SAAO,KAAK;AACd;AAEA,eAAsB,wBACpB,KACA,OAQA,UAAyB,CAAC,GACK;AAC/B,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA,iCAAK,UAAL,EAAc,MAAM,OAAO,UAAU,KAAK;AAAA,EAC5C;AACA,SAAO,KAAK;AACd;AAEA,eAAsB,iCACpB,KACA,IACA,WACA,UAAyB,CAAC,GACK;AAC/B,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,uCAAuC,mBAAmB,EAAE,CAAC;AAAA,IAC7D,iCAAK,UAAL,EAAc,MAAM,EAAE,YAAY,UAAU,GAAG,UAAU,KAAK;AAAA,EAChE;AACA,SAAO,KAAK;AACd;AAEA,eAAsB,yBACpB,KACA,IACA,UAAyB,CAAC,GACH;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,uCAAuC,mBAAmB,EAAE,CAAC;AAAA,IAC7D,iCAAK,UAAL,EAAc,UAAU,KAAK;AAAA,EAC/B;AACF;AAEA,eAAsB,mCACpB,KACA,kBACA,UAAyB,CAAC,GACK;AAC/B,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA,iCACK,UADL;AAAA,MAEE,MAAM,EAAE,oBAAoB,iBAAiB;AAAA,MAC7C,UAAU;AAAA,IACZ;AAAA,EACF;AACA,SAAO,KAAK;AACd;AAIA,eAAsB,0BACpB,KACA,UAAyB,CAAC,GACU;AACpC,QAAM,OAAO,MAAM,YAEhB,KAAK,OAAO,2CAA2C,OAAO;AACjE,SAAO,KAAK;AACd;AAEA,eAAsB,4BACpB,KACA,YACA,UAAyB,CAAC,GAIzB;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,iCAAK,UAAL,EAAc,MAAM,EAAE,aAAa,WAAW,GAAG,UAAU,KAAK;AAAA,EAClE;AACF;AAEA,eAAsB,8BACpB,KACA,WACA,UAAyB,CAAC,GACH;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,2CAA2C,mBAAmB,SAAS,CAAC;AAAA,IACxE,iCAAK,UAAL,EAAc,UAAU,KAAK;AAAA,EAC/B;AACF;AAEA,eAAsB,gCACpB,KACA,WACA,UAAyB,CAAC,GAIzB;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,2CAA2C,mBAAmB,SAAS,CAAC;AAAA,IACxE,iCAAK,UAAL,EAAc,UAAU,KAAK;AAAA,EAC/B;AACF;","names":[]}

package/dist/chunk-7SF4OITT.js

@@ -0,0 +1,40 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _chunk27ICOQ2Gjs = require('./chunk-27ICOQ2G.js');
+
+// src/cli/commands/virtual-keys/_shared.ts
+function virtualKeyDetailUrl(vkId) {
+  const uiOverride = process.env.LANGWATCH_UI_ENDPOINT;
+  const base = (uiOverride != null ? uiOverride : _chunk27ICOQ2Gjs.resolveControlPlaneUrl.call(void 0, )).replace(/\/+$/, "");
+  if (!base) return "";
+  return `${base}/settings/gateway/virtual-keys/${encodeURIComponent(vkId)}`;
+}
+var SCOPE_TYPES = ["ORGANIZATION", "TEAM", "PROJECT"];
+function parseScopeArg(raw) {
+  const trimmed = raw.trim();
+  const colon = trimmed.indexOf(":");
+  if (colon < 1 || colon === trimmed.length - 1) {
+    throw new Error(`--scope value "${raw}" must be in the form TYPE:id (e.g. ORG:acme, TEAM:platform, PROJECT:demo)`);
+  }
+  const typeRaw = trimmed.slice(0, colon).toUpperCase();
+  const scopeId = trimmed.slice(colon + 1).trim();
+  const scopeType = typeRaw === "ORG" ? "ORGANIZATION" : SCOPE_TYPES.includes(typeRaw) ? typeRaw : null;
+  if (!scopeType) {
+    throw new Error(`--scope type "${typeRaw}" must be one of ORG | ORGANIZATION | TEAM | PROJECT`);
+  }
+  if (!scopeId) {
+    throw new Error(`--scope value "${raw}" is missing the id after the colon`);
+  }
+  return { scope_type: scopeType, scope_id: scopeId };
+}
+function formatScope(scope) {
+  const prefix = scope.scope_type === "ORGANIZATION" ? "ORG" : scope.scope_type;
+  return `${prefix}:${scope.scope_id}`;
+}
+
+
+
+
+
+exports.virtualKeyDetailUrl = virtualKeyDetailUrl; exports.parseScopeArg = parseScopeArg; exports.formatScope = formatScope;
+//# sourceMappingURL=chunk-7SF4OITT.js.map

package/dist/chunk-7SF4OITT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/home/runner/work/langwatch/langwatch/typescript-sdk/dist/chunk-7SF4OITT.js","../src/cli/commands/virtual-keys/_shared.ts"],"names":[],"mappings":"AAAA;AACE;AACF,sDAA4B;AAC5B;AACA;ACMO,SAAS,mBAAA,CAAoB,IAAA,EAAsB;AACxD,EAAA,MAAM,WAAA,EAAa,OAAA,CAAQ,GAAA,CAAI,qBAAA;AAC/B,EAAA,MAAM,KAAA,EAAA,CAAQ,WAAA,GAAA,KAAA,EAAA,WAAA,EAAc,qDAAA,CAAuB,CAAA,CAAG,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACxE,EAAA,GAAA,CAAI,CAAC,IAAA,EAAM,OAAO,EAAA;AAClB,EAAA,OAAO,CAAA,EAAA;AACT;AAEM;AASU;AACR,EAAA;AACA,EAAA;AACF,EAAA;AACI,IAAA;AACR,EAAA;AACM,EAAA;AACA,EAAA;AACA,EAAA;AAID,EAAA;AACG,IAAA;AACR,EAAA;AACK,EAAA;AACG,IAAA;AACR,EAAA;AACO,EAAA;AACT;AAMgB;AACR,EAAA;AACC,EAAA;AACT;ADrBU;AACA;AACA;AACA;AACA;AACA","file":"/home/runner/work/langwatch/langwatch/typescript-sdk/dist/chunk-7SF4OITT.js","sourcesContent":[null,"import type { VirtualKeyScope, VirtualKeyScopeType } from \"@/client-sdk/services/virtual-keys/virtual-keys-api.service\";\nimport { resolveControlPlaneUrl } from \"@/cli/utils/governance/resolveEndpoint\";\n\n/**\n * Build the public-facing LangWatch UI URL for a VK detail page. After the\n * multi-scope refactor (PR #3524), VKs live at the org-scoped settings\n * surface (/settings/gateway/virtual-keys/:id) regardless of their scope\n * rows; the per-project gateway pages are gone. Honours\n * `LANGWATCH_UI_ENDPOINT` for split UI/API hosts.\n */\nexport function virtualKeyDetailUrl(vkId: string): string {\n  const uiOverride = process.env.LANGWATCH_UI_ENDPOINT;\n  const base = (uiOverride ?? resolveControlPlaneUrl()).replace(/\\/+$/, \"\");\n  if (!base) return \"\";\n  return `${base}/settings/gateway/virtual-keys/${encodeURIComponent(vkId)}`;\n}\n\nconst SCOPE_TYPES: VirtualKeyScopeType[] = [\"ORGANIZATION\", \"TEAM\", \"PROJECT\"];\n\n/**\n * Parse a single `--scope <TYPE>:<id>` CLI value into a `VirtualKeyScope`.\n * Accepts the canonical ORGANIZATION/TEAM/PROJECT spellings (case-insensitive)\n * plus the friendly ORG alias for `ORGANIZATION`. Throws an Error with a\n * single-sentence message the CLI can print directly so users see what they\n * mistyped without a stack trace.\n */\nexport function parseScopeArg(raw: string): VirtualKeyScope {\n  const trimmed = raw.trim();\n  const colon = trimmed.indexOf(\":\");\n  if (colon < 1 || colon === trimmed.length - 1) {\n    throw new Error(`--scope value \"${raw}\" must be in the form TYPE:id (e.g. ORG:acme, TEAM:platform, PROJECT:demo)`);\n  }\n  const typeRaw = trimmed.slice(0, colon).toUpperCase();\n  const scopeId = trimmed.slice(colon + 1).trim();\n  const scopeType: VirtualKeyScopeType | null =\n    typeRaw === \"ORG\" ? \"ORGANIZATION\" :\n    (SCOPE_TYPES as readonly string[]).includes(typeRaw) ? (typeRaw as VirtualKeyScopeType) :\n    null;\n  if (!scopeType) {\n    throw new Error(`--scope type \"${typeRaw}\" must be one of ORG | ORGANIZATION | TEAM | PROJECT`);\n  }\n  if (!scopeId) {\n    throw new Error(`--scope value \"${raw}\" is missing the id after the colon`);\n  }\n  return { scope_type: scopeType, scope_id: scopeId };\n}\n\n/**\n * Format a scope for display in CLI tables / get output: `ORG:acme`,\n * `TEAM:platform`, etc. Uses the short `ORG` form for brevity.\n */\nexport function formatScope(scope: VirtualKeyScope): string {\n  const prefix = scope.scope_type === \"ORGANIZATION\" ? \"ORG\" : scope.scope_type;\n  return `${prefix}:${scope.scope_id}`;\n}\n"]}

package/dist/chunk-7UCML4GT.mjs

@@ -0,0 +1,42 @@
+import {
+  loadConfig
+} from "./chunk-VW3GTPRE.mjs";
+import {
+  DEFAULT_ENDPOINT
+} from "./chunk-B4QCZKFV.mjs";
+
+// src/cli/utils/governance/resolveEndpoint.ts
+function resolveControlPlaneEndpoint(opts = {}) {
+  if (opts.flag) {
+    return { url: stripTrailingSlash(opts.flag), source: "flag" };
+  }
+  const env = process.env.LANGWATCH_ENDPOINT;
+  if (env && env.trim() !== "") {
+    return { url: stripTrailingSlash(env), source: "env" };
+  }
+  let cfg = opts.cfg;
+  if (cfg === void 0) {
+    try {
+      cfg = loadConfig();
+    } catch (e) {
+      cfg = void 0;
+    }
+  }
+  const persisted = cfg == null ? void 0 : cfg.control_plane_url;
+  if (persisted && persisted !== DEFAULT_ENDPOINT) {
+    return { url: stripTrailingSlash(persisted), source: "config" };
+  }
+  return { url: stripTrailingSlash(DEFAULT_ENDPOINT), source: "default" };
+}
+function resolveControlPlaneUrl(opts = {}) {
+  return resolveControlPlaneEndpoint(opts).url;
+}
+function stripTrailingSlash(url) {
+  return url.replace(/\/+$/, "");
+}
+
+export {
+  resolveControlPlaneEndpoint,
+  resolveControlPlaneUrl
+};
+//# sourceMappingURL=chunk-7UCML4GT.mjs.map

package/dist/chunk-7UCML4GT.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/utils/governance/resolveEndpoint.ts"],"sourcesContent":["/**\n * Single source of truth for resolving the LangWatch control-plane URL\n * across the CLI. Replaces the previous three drifted readers\n * (`endpoint.ts:getEndpoint`, `governance/config.ts:defaults`, and the\n * inline `process.env.LANGWATCH_ENDPOINT ?? ...` literal in\n * `commands/status.ts`) so every command sees the same value for the\n * same inputs.\n *\n * Priority (highest wins):\n *   1. opts.flag           — per-command override (e.g. `langwatch login --endpoint <url>`)\n *   2. LANGWATCH_ENDPOINT  — env var (CI / scripts)\n *   3. persisted config    — `~/.langwatch/config.json:control_plane_url` (daily driver)\n *   4. DEFAULT_ENDPOINT    — `https://app.langwatch.ai` (cloud default)\n *\n * Spec: specs/ai-governance/cli-onboarding/login-unified.feature\n */\n\nimport { DEFAULT_ENDPOINT } from \"@/internal/constants\";\nimport { loadConfig } from \"./config\";\n\nexport interface ResolveEndpointOptions {\n  /** Per-command override flag value (e.g. `--endpoint`). NULL/empty ignored. */\n  flag?: string | null;\n  /** Optional pre-loaded config to reuse (skips disk read). */\n  cfg?: ReturnType<typeof loadConfig>;\n}\n\nexport interface ResolvedEndpoint {\n  /** The resolved URL with trailing slashes stripped. */\n  url: string;\n  /** Where the value came from — useful for `langwatch config list`. */\n  source: \"flag\" | \"env\" | \"config\" | \"default\";\n}\n\n/**\n * Resolve the control-plane endpoint per the documented priority order.\n *\n * Returns both the resolved URL and the source that won, so\n * `langwatch config list` can show the user where each value came from.\n */\nexport function resolveControlPlaneEndpoint(\n  opts: ResolveEndpointOptions = {},\n): ResolvedEndpoint {\n  if (opts.flag) {\n    return { url: stripTrailingSlash(opts.flag), source: \"flag\" };\n  }\n  const env = process.env.LANGWATCH_ENDPOINT;\n  if (env && env.trim() !== \"\") {\n    return { url: stripTrailingSlash(env), source: \"env\" };\n  }\n  // Reading the config involves disk I/O; only do it if we need to.\n  // Callers that already have a cfg in scope can pass it in to skip.\n  let cfg = opts.cfg;\n  if (cfg === undefined) {\n    try {\n      cfg = loadConfig();\n    } catch {\n      cfg = undefined;\n    }\n  }\n  // The persisted control_plane_url is populated EITHER by a prior\n  // `langwatch login --device` (snapshot of env at save time) OR by an\n  // explicit `langwatch config set endpoint <url>`. If it differs from\n  // the hardcoded default, treat it as a user choice.\n  const persisted = cfg?.control_plane_url;\n  if (persisted && persisted !== DEFAULT_ENDPOINT) {\n    return { url: stripTrailingSlash(persisted), source: \"config\" };\n  }\n  return { url: stripTrailingSlash(DEFAULT_ENDPOINT), source: \"default\" };\n}\n\n/**\n * Convenience for callers that just want the URL string and don't need\n * the source-attribution. Equivalent to\n * `resolveControlPlaneEndpoint(opts).url`.\n */\nexport function resolveControlPlaneUrl(\n  opts: ResolveEndpointOptions = {},\n): string {\n  return resolveControlPlaneEndpoint(opts).url;\n}\n\nfunction stripTrailingSlash(url: string): string {\n  return url.replace(/\\/+$/, \"\");\n}\n"],"mappings":";;;;;;;;AAwCO,SAAS,4BACd,OAA+B,CAAC,GACd;AAClB,MAAI,KAAK,MAAM;AACb,WAAO,EAAE,KAAK,mBAAmB,KAAK,IAAI,GAAG,QAAQ,OAAO;AAAA,EAC9D;AACA,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,OAAO,IAAI,KAAK,MAAM,IAAI;AAC5B,WAAO,EAAE,KAAK,mBAAmB,GAAG,GAAG,QAAQ,MAAM;AAAA,EACvD;AAGA,MAAI,MAAM,KAAK;AACf,MAAI,QAAQ,QAAW;AACrB,QAAI;AACF,YAAM,WAAW;AAAA,IACnB,SAAQ;AACN,YAAM;AAAA,IACR;AAAA,EACF;AAKA,QAAM,YAAY,2BAAK;AACvB,MAAI,aAAa,cAAc,kBAAkB;AAC/C,WAAO,EAAE,KAAK,mBAAmB,SAAS,GAAG,QAAQ,SAAS;AAAA,EAChE;AACA,SAAO,EAAE,KAAK,mBAAmB,gBAAgB,GAAG,QAAQ,UAAU;AACxE;AAOO,SAAS,uBACd,OAA+B,CAAC,GACxB;AACR,SAAO,4BAA4B,IAAI,EAAE;AAC3C;AAEA,SAAS,mBAAmB,KAAqB;AAC/C,SAAO,IAAI,QAAQ,QAAQ,EAAE;AAC/B;","names":[]}