primcli 1.33.0 → 1.35.0

package/dist/{cli-config-Cv2-NAOd.js → cli-config-DmhlcS3s.js}

@@ -1,9 +1,8 @@
+import { c as mailTime, d as readMailJson, h as writeMailJson, i as mailId, l as privateMailDirectory, o as mailObject, r as mailAddress, s as mailString } from "./shared-mail-files-Cbwnf79a.js";
 import { Errors } from "@oclif/core";
-import { chmodSync, closeSync, fsyncSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
-import { createHash, randomUUID } from "node:crypto";
-import { dirname, join, win32 } from "node:path";
-import { setTimeout as setTimeout$1 } from "node:timers/promises";
-import { execFileSync } from "node:child_process";
+import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { dirname, join } from "node:path";
 //#region ../packages/api-core/src/api/core/bodySerializer.gen.ts
 const jsonBodySerializer = { bodySerializer: (body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value) };
 //#endregion
@@ -638,353 +637,31 @@ var PrimitiveApiClient = class {
 	}
 };
 //#endregion
-//#region src/oclif/listen-state.ts
-var ListenStateError = class extends Error {};
-function normalizeListenOrigin(value) {
-	const url = new URL(value);
-	if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) throw new ListenStateError("The API base URL must be an HTTP(S) URL without credentials, query, or fragment.");
-	return `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
-}
-function listenIdentity(origin, accountId) {
-	return createHash("sha256").update(JSON.stringify([normalizeListenOrigin(origin), accountId])).digest("hex");
-}
-function privateDirectory(path) {
-	mkdirSync(path, {
-		recursive: true,
-		mode: 448
-	});
-	if (!lstatSync(path).isDirectory() || lstatSync(path).isSymbolicLink()) throw new ListenStateError("Listener state must be a private directory.");
-	chmodSync(path, 448);
-}
-function processAlive(pid) {
-	try {
-		process.kill(pid, 0);
-		return true;
-	} catch (error) {
-		return error.code !== "ESRCH";
-	}
-}
-function listenProcessIdentity(pid) {
-	if (!Number.isSafeInteger(pid) || pid < 1) return null;
-	try {
-		if (process.platform === "linux") {
-			const boot = readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim();
-			const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
-			const end = stat.lastIndexOf(")");
-			const started = stat.slice(end + 1).trim().split(/\s+/)[19];
-			if (!/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/.test(boot) || !stat.startsWith(`${pid} (`) || end < 0 || !started || !/^\d+$/.test(started)) return null;
-			return `linux:${boot}:${started}`;
-		}
-		if (process.platform === "darwin") {
-			const options = {
-				encoding: "utf8",
-				timeout: 1e3,
-				maxBuffer: 4096,
-				stdio: [
-					"ignore",
-					"pipe",
-					"ignore"
-				],
-				env: {
-					LC_ALL: "C",
-					TZ: "UTC",
-					PATH: "/usr/bin:/bin:/usr/sbin:/sbin"
-				}
-			};
-			const bootId = execFileSync("/usr/sbin/sysctl", ["-n", "kern.bootsessionuuid"], options).trim().toLowerCase();
-			const started = execFileSync("/bin/ps", [
-				"-p",
-				String(pid),
-				"-o",
-				"lstart="
-			], options).trim().replace(/\s+/g, " ");
-			if (!/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/.test(bootId) || !/^[A-Z][a-z]{2} [A-Z][a-z]{2} \d{1,2} \d{2}:\d{2}:\d{2} \d{4}$/.test(started)) return null;
-			return `darwin-boot:${bootId}:${started}`;
-		}
-		if (process.platform === "win32") {
-			const root = process.env.SystemRoot;
-			if (!root || !win32.isAbsolute(root)) return null;
-			const started = execFileSync(win32.join(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"), [
-				"-NoLogo",
-				"-NoProfile",
-				"-NonInteractive",
-				"-Command",
-				`$ErrorActionPreference='Stop'; (Get-Process -Id ${pid} -ErrorAction Stop).StartTime.ToUniversalTime().Ticks.ToString([System.Globalization.CultureInfo]::InvariantCulture)`
-			], {
-				encoding: "utf8",
-				timeout: 2e3,
-				maxBuffer: 4096,
-				windowsHide: true,
-				stdio: [
-					"ignore",
-					"pipe",
-					"ignore"
-				]
-			}).trim();
-			return /^\d{1,20}$/.test(started) ? `win32:${started}` : null;
-		}
-	} catch {}
-	return null;
-}
-/** Legacy macOS timestamps cannot prove that a live PID changed owners. */
-function compareListenProcessIdentity(saved, current) {
-	if (saved === null || current === null) return null;
-	if (saved === current) return true;
-	if (saved.startsWith("darwin:") || current.startsWith("darwin:")) return null;
-	return false;
-}
-function ownerIdentity(path) {
-	try {
-		const stat = lstatSync(path);
-		if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1024) return null;
-		const saved = JSON.parse(readFileSync(path, "utf8"));
-		if (!saved || typeof saved !== "object" || !("version" in saved) || saved.version !== 1 || !("identity" in saved) || typeof saved.identity !== "string") return null;
-		return /^(?:linux:[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}:\d+|darwin:\d+:\d+:[A-Z][a-z]{2} [A-Z][a-z]{2} \d{1,2} \d{2}:\d{2}:\d{2} \d{4}|darwin-boot:[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}:[A-Z][a-z]{2} [A-Z][a-z]{2} \d{1,2} \d{2}:\d{2}:\d{2} \d{4}|win32:\d{1,20})$/.test(saved.identity) ? saved.identity : null;
-	} catch {
-		return null;
-	}
-}
-function removeOwner(path, owner) {
-	try {
-		unlinkSync(join(path, owner));
-	} catch (error) {
-		if (error.code !== "ENOENT") throw error;
-	}
-	try {
-		rmdirSync(path);
-	} catch (error) {
-		if (![
-			"ENOENT",
-			"ENOTEMPTY",
-			"EEXIST"
-		].includes(error.code ?? "")) throw error;
-	}
-}
-function acquireListenLock(directory, scope) {
-	privateDirectory(directory);
-	const path = join(directory, `${createHash("sha256").update(scope).digest("hex")}.lock`);
-	const owner = `${process.pid}-${randomUUID()}`;
-	const candidate = mkdtempSync(join(directory, ".claim-"));
-	chmodSync(candidate, 448);
-	writeFileSync(join(candidate, owner), JSON.stringify({
-		version: 1,
-		identity: listenProcessIdentity(process.pid)
-	}), {
-		mode: 384,
-		flag: "wx"
-	});
-	let installed = false;
-	try {
-		for (let attempt = 0; attempt < 8; attempt++) {
-			try {
-				renameSync(candidate, path);
-				installed = true;
-				break;
-			} catch (error) {
-				if (!["EEXIST", "ENOTEMPTY"].includes(error.code ?? "")) throw error;
-			}
-			let entries;
-			try {
-				entries = readdirSync(path);
-			} catch (error) {
-				if (error.code === "ENOENT") continue;
-				throw error;
-			}
-			if (entries.length === 0) continue;
-			const match = entries.length === 1 ? /^(\d+)-[a-f0-9-]{36}$/.exec(entries[0] ?? "") : null;
-			const pid = match ? Number(match[1]) : null;
-			let stale = pid !== null && !processAlive(pid);
-			if (!stale && pid !== null) {
-				const saved = ownerIdentity(join(path, entries[0] ?? ""));
-				stale = compareListenProcessIdentity(saved, saved === null ? null : listenProcessIdentity(pid)) === false;
-			}
-			if (!stale) throw new ListenStateError("Another listener is using this subscription, or its owner cannot be verified. Stop the original listener before reconnecting. To use a separate subscription instead, run: primitive listen --subscription local-" + randomUUID());
-			removeOwner(path, entries[0] ?? "");
-		}
-		if (!installed) throw new ListenStateError("Subscription lock changed concurrently. Retry the command.");
-	} finally {
-		if (!installed) removeOwner(candidate, owner);
-	}
-	let released = false;
-	return () => {
-		if (!released) {
-			released = true;
-			removeOwner(path, owner);
-		}
-	};
-}
-function resolveListenSubscription(configDir, identity, explicit) {
-	const directory = join(configDir, "listen", identity);
-	privateDirectory(directory);
-	let name = explicit;
-	if (name === void 0) {
-		const unlock = acquireListenLock(directory, "default-name");
-		try {
-			const file = join(directory, "default.json");
-			try {
-				if (!lstatSync(file).isFile() || lstatSync(file).isSymbolicLink()) throw new ListenStateError("Invalid listener identity file.");
-				const saved = JSON.parse(readFileSync(file, "utf8"));
-				if (typeof saved.name !== "string" || !/^local-[a-f0-9-]{36}$/.test(saved.name)) throw new ListenStateError("Invalid listener identity file.");
-				name = saved.name;
-			} catch (error) {
-				if (error.code !== "ENOENT") throw error;
-				name = `local-${randomUUID()}`;
-				const temporary = join(directory, `.state-${randomUUID()}`);
-				const fd = openSync(temporary, "wx", 384);
-				try {
-					writeFileSync(fd, `${JSON.stringify({ name })}\n`);
-					fsyncSync(fd);
-				} finally {
-					closeSync(fd);
-				}
-				renameSync(temporary, file);
-			}
-			if (process.platform !== "win32") for (const path of [
-				directory,
-				join(configDir, "listen"),
-				configDir
-			]) {
-				const directoryFd = openSync(path, "r");
-				try {
-					fsyncSync(directoryFd);
-				} finally {
-					closeSync(directoryFd);
-				}
-			}
-		} finally {
-			unlock();
-		}
-	}
-	if (!name || name.length > 64 || !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(name)) throw new ListenStateError("Use a subscription name of 1–64 letters, digits, underscores, or hyphens.");
+//#region src/oclif/connected-agent-profile.ts
+const AGENT_PROFILE_ENV = "PRIMITIVE_AGENT_PROFILE";
+function parsePresenceProfile(value, owner) {
+	const row = mailObject(value, [
+		"protocol",
+		"version",
+		"authentication_profile",
+		"return_address"
+	]);
+	if (row.protocol !== "primitive.presence" || row.version !== 1 || row.authentication_profile !== "primitive-issued-v1" || mailAddress(row.return_address) !== owner) throw new AgentConnectionSetupError("The presence authentication profile is not supported.");
 	return {
-		name,
-		release: acquireListenLock(directory, `subscription:${name}`)
+		protocol: "primitive.presence",
+		version: 1,
+		authentication_profile: "primitive-issued-v1",
+		return_address: owner
 	};
 }
-//#endregion
-//#region src/oclif/shared-mail-files.ts
-var SharedMailStateError = class extends ListenStateError {};
-const invalidSharedMail = () => new SharedMailStateError("Shared mail state is invalid or inconsistent. Preserve it before retrying to avoid duplicate delivery.");
-function privateMailPermissions(info, platform = process.platform) {
-	return platform === "win32" || info.uid === process.getuid?.() && (info.mode & 63) === 0;
-}
-function privateMailDirectory(path, create = false) {
-	if (create) {
-		const created = mkdirSync(path, {
-			recursive: true,
-			mode: 448
-		});
-		if (created !== void 0) {
-			let current = path;
-			for (;;) {
-				syncMailDirectory(current);
-				syncMailDirectory(dirname(current));
-				if (current === created) break;
-				current = dirname(current);
-			}
-		}
-	}
-	const stat = lstatSync(path);
-	if (!stat.isDirectory() || !privateMailPermissions(stat)) throw invalidSharedMail();
-}
-function syncMailDirectory(path, platform = process.platform) {
-	if (platform === "win32") return;
-	const fd = openSync(path, "r");
-	try {
-		fsyncSync(fd);
-	} finally {
-		closeSync(fd);
-	}
-}
-function readMailJson(path, maxBytes = 16384) {
-	try {
-		const info = lstatSync(path);
-		if (!info.isFile() || !privateMailPermissions(info) || info.size > maxBytes) throw invalidSharedMail();
-		const value = JSON.parse(readFileSync(path, "utf8"));
-		if (value === null) throw invalidSharedMail();
-		return value;
-	} catch (error) {
-		if (error.code === "ENOENT") return null;
-		throw invalidSharedMail();
-	}
-}
-function writeMailJson(path, value) {
-	privateMailDirectory(dirname(path), true);
-	const temporary = join(dirname(path), `.write-${randomUUID()}`);
+function supportedPresenceProfile(value, owner) {
+	if (value === void 0) return void 0;
 	try {
-		const fd = openSync(temporary, "wx", 384);
-		try {
-			writeFileSync(fd, `${JSON.stringify(value)}\n`);
-			fsyncSync(fd);
-		} finally {
-			closeSync(fd);
-		}
-		renameSync(temporary, path);
-		syncMailDirectory(dirname(path));
-	} finally {
-		try {
-			unlinkSync(temporary);
-		} catch {}
-	}
-}
-function removeMailFile(path) {
-	try {
-		unlinkSync(path);
-	} catch (error) {
-		if (error.code !== "ENOENT") throw error;
-	}
-	syncMailDirectory(dirname(path));
-}
-function mailLockBusy(error) {
-	return error instanceof ListenStateError && /^(Another listener|Subscription lock changed)/.test(error.message);
-}
-async function withMailLock(directory, action, signal) {
-	const deadline = performance.now() + 5e3;
-	for (;;) {
-		signal?.throwIfAborted();
-		let release;
-		try {
-			release = acquireListenLock(directory, "shared-mail-state");
-		} catch (error) {
-			if (!mailLockBusy(error) || performance.now() >= deadline) throw error;
-			await setTimeout$1(25, void 0, { signal });
-			continue;
-		}
-		try {
-			signal?.throwIfAborted();
-			return action();
-		} finally {
-			release();
-		}
+		return parsePresenceProfile(value, owner);
+	} catch {
+		return;
 	}
 }
-function mailObject(value, keys) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw invalidSharedMail();
-	const result = value;
-	if (Object.keys(result).length !== keys.length || keys.some((key) => !Object.hasOwn(result, key))) throw invalidSharedMail();
-	return result;
-}
-function mailId(value) {
-	if (typeof value !== "string" || !/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(value)) throw invalidSharedMail();
-	return value.toLowerCase();
-}
-function mailString(value, max = 256) {
-	if (typeof value !== "string" || !value || value.length > max || Array.from(value).some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)) throw invalidSharedMail();
-	return value;
-}
-function mailAddress(value) {
-	const address = mailString(value, 254).toLowerCase();
-	if (!/^[^\s<>@]+@[^\s<>@]+\.[^\s<>@]+$/.test(address)) throw invalidSharedMail();
-	return address;
-}
-function mailTime(value) {
-	const time = mailString(value, 40);
-	if (!Number.isFinite(Date.parse(time))) throw invalidSharedMail();
-	return new Date(time).toISOString();
-}
-//#endregion
-//#region src/oclif/connected-agent-profile.ts
-const AGENT_PROFILE_ENV = "PRIMITIVE_AGENT_PROFILE";
 var AgentConnectionSetupError = class extends Error {};
 function requireDefaultLoginProfile() {
 	if (process.env["PRIMITIVE_AGENT_PROFILE"]?.trim()) throw new AgentConnectionSetupError("This command manages the default OAuth login. Unset PRIMITIVE_AGENT_PROFILE before using it; the connected-agent profile is unchanged.");
@@ -1008,7 +685,7 @@ function profilePath(configDir, profileName) {
 }
 function parseConnectedAgentProfile(value) {
 	try {
-		const row = mailObject(value, [
+		const keys = [
 			"version",
 			"auth_method",
 			"api_key",
@@ -1018,10 +695,12 @@ function parseConnectedAgentProfile(value) {
 			"owner_address",
 			"invitation_hash",
 			"created_at"
-		]);
+		];
+		const row = mailObject(value, value && typeof value === "object" && Object.hasOwn(value, "presence_profile") ? [...keys, "presence_profile"] : keys);
 		const apiKey = mailString(row.api_key, 4096);
 		const invitationHash = mailString(row.invitation_hash, 64);
 		if (row.version !== 1 || row.auth_method !== "agent_connection" || !apiKey.startsWith("pconn_") || /\s/.test(apiKey) || !/^[a-f0-9]{64}$/.test(invitationHash)) throw new Error();
+		const presence = supportedPresenceProfile(row.presence_profile, mailAddress(row.owner_address));
 		return {
 			version: 1,
 			auth_method: "agent_connection",
@@ -1031,7 +710,8 @@ function parseConnectedAgentProfile(value) {
 			agent_address: mailAddress(row.agent_address),
 			owner_address: mailAddress(row.owner_address),
 			invitation_hash: invitationHash,
-			created_at: mailTime(row.created_at)
+			created_at: mailTime(row.created_at),
+			...presence === void 0 ? {} : { presence_profile: presence }
 		};
 	} catch {
 		throw new AgentConnectionSetupError("Saved agent profile is invalid. Preserve its private files and request a fresh setup invitation.");
@@ -1782,4 +1462,4 @@ function redactCliEnvironment(environment) {
 	};
 }
 //#endregion
-export { syncMailDirectory as $, saveActiveChatState as A, requireDefaultLoginProfile as B, resolveCliAuth as C, deleteChatState as D, chatStatePath as E, agentProfilesDirectory as F, mailId as G, SharedMailStateError as H, connectedAgentIdentity as I, mailString as J, mailLockBusy as K, connectedApiBaseUrl as L, AgentConnectionSetupError as M, agentProfileDirectory as N, loadActiveChatState as O, agentProfileName as P, removeMailFile as Q, loadConnectedAgentProfile as R, normalizeApiBaseUrl as S, saveSignupCredentials as T, invalidSharedMail as U, saveConnectedAgentProfile as V, mailAddress as W, privateMailDirectory as X, mailTime as Y, readMailJson as Z, deleteCliCredentials as _, normalizeCliEnvironmentName as a, listenIdentity as at, hasStoredCliLogin as b, resolveConfigEnvironment as c, resolveListenSubscription as ct, validateCliHeaderName as d, createConfig as dt, withMailLock as et, validateCliHeaderValue as f, credentialsPath as g, credentialsLockPath as h, loadCliConfig as i, compareListenProcessIdentity as it, AGENT_PROFILE_ENV as j, loadChatConversationByLocalId as k, saveCliConfig as l, PrimitiveApiClient as lt, cliAccessTokenExpiresAt as m, deleteCliConfig as n, ListenStateError as nt, redactCliEnvironment as o, listenProcessIdentity as ot, acquireCliCredentialsLock as p, mailObject as q, emptyCliConfig as r, acquireListenLock as rt, removeCliEnvironment as s, normalizeListenOrigin as st, DEFAULT_ENVIRONMENT as t, writeMailJson as tt, upsertCliEnvironment as u, createClient as ut, deleteCliCredentialsLock as v, saveCliCredentials as w, loadCliCredentials as x, detectPrimitiveKeyEnvMisname as y, parseConnectedAgentProfile as z };
+export { saveActiveChatState as A, requireDefaultLoginProfile as B, resolveCliAuth as C, deleteChatState as D, chatStatePath as E, agentProfilesDirectory as F, PrimitiveApiClient as H, connectedAgentIdentity as I, connectedApiBaseUrl as L, AgentConnectionSetupError as M, agentProfileDirectory as N, loadActiveChatState as O, agentProfileName as P, loadConnectedAgentProfile as R, normalizeApiBaseUrl as S, saveSignupCredentials as T, createClient as U, saveConnectedAgentProfile as V, createConfig as W, deleteCliCredentials as _, normalizeCliEnvironmentName as a, hasStoredCliLogin as b, resolveConfigEnvironment as c, validateCliHeaderName as d, validateCliHeaderValue as f, credentialsPath as g, credentialsLockPath as h, loadCliConfig as i, AGENT_PROFILE_ENV as j, loadChatConversationByLocalId as k, saveCliConfig as l, cliAccessTokenExpiresAt as m, deleteCliConfig as n, redactCliEnvironment as o, acquireCliCredentialsLock as p, emptyCliConfig as r, removeCliEnvironment as s, DEFAULT_ENVIRONMENT as t, upsertCliEnvironment as u, deleteCliCredentialsLock as v, saveCliCredentials as w, loadCliCredentials as x, detectPrimitiveKeyEnvMisname as y, parseConnectedAgentProfile as z };

package/dist/json-output-KAIuP9rG.js

@@ -0,0 +1,254 @@
+import { format } from "node:util";
+//#region src/oclif/json-output.ts
+/**
+* Parse-safe `--json` output.
+*
+* Agents often run commands with stderr merged into stdout (`2>&1`).
+* A command that prints a JSON document on stdout and a notice on
+* stderr then hands the caller text that is not JSON, and a delivered
+* send can look like an unknown outcome. With `--json`, every guarded
+* command therefore prints exactly one JSON document on stdout, on
+* success and on failure, and writes nothing to stderr:
+*
+* - Anything the command would have written to stderr (notices, hints,
+*   cursors, warnings) goes into the document's `warnings` array.
+* - A failure adds `error` and `exit_code` to the document. When the
+*   command printed no document of its own, the CLI builds one.
+* - A command whose `--json` output is a bare JSON array keeps that
+*   documented shape on success; its stderr notices are dropped.
+*
+* Commands that stream several documents (`listen`) are not guarded.
+*/
+const GUARDED = Symbol.for("primitive.cli.jsonOutputGuard");
+/** True when `--json` appears before any `--` separator. */
+function jsonOutputRequested(argv) {
+	const end = argv.indexOf("--");
+	return (end === -1 ? argv : argv.slice(0, end)).includes("--json");
+}
+function chunkToString(chunk, encoding) {
+	if (typeof chunk === "string") return chunk;
+	if (chunk instanceof Uint8Array) return Buffer.from(chunk).toString(typeof encoding === "string" ? encoding : "utf8");
+	return String(chunk);
+}
+function capturingWrite(sink) {
+	return (chunk, encoding, callback) => {
+		sink.push(chunkToString(chunk, encoding));
+		const done = typeof encoding === "function" ? encoding : callback;
+		if (typeof done === "function") done();
+		return true;
+	};
+}
+/**
+* Redirect stdout and stderr (both the streams and the console methods
+* that write to them) into memory until `restore` is called. Nested
+* captures restore in reverse order, so a guarded command that runs
+* another guarded command still produces one document.
+*/
+function captureOutput() {
+	const stdout = [];
+	const stderr = [];
+	const originalStdoutWrite = process.stdout.write;
+	const originalStderrWrite = process.stderr.write;
+	const originalConsole = {
+		debug: console.debug,
+		error: console.error,
+		info: console.info,
+		log: console.log,
+		warn: console.warn
+	};
+	const toStdout = (...args) => {
+		stdout.push(`${format(...args)}\n`);
+	};
+	const toStderr = (...args) => {
+		stderr.push(`${format(...args)}\n`);
+	};
+	process.stdout.write = capturingWrite(stdout);
+	process.stderr.write = capturingWrite(stderr);
+	console.log = toStdout;
+	console.info = toStdout;
+	console.debug = toStderr;
+	console.error = toStderr;
+	console.warn = toStderr;
+	return {
+		stderr,
+		stdout,
+		restore: () => {
+			process.stdout.write = originalStdoutWrite;
+			process.stderr.write = originalStderrWrite;
+			console.debug = originalConsole.debug;
+			console.error = originalConsole.error;
+			console.info = originalConsole.info;
+			console.log = originalConsole.log;
+			console.warn = originalConsole.warn;
+		}
+	};
+}
+function isPlainObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function parseJson(text) {
+	try {
+		return {
+			ok: true,
+			value: JSON.parse(text)
+		};
+	} catch {
+		return { ok: false };
+	}
+}
+/**
+* Split captured stderr into an API error payload (the JSON object the
+* CLI prints for a failed request) and plain-text warning lines.
+*/
+const ANSI_SEQUENCE = new RegExp(`${String.fromCharCode(27)}\\[[0-9;?]*[A-Za-z]`, "g");
+function stripAnsi(text) {
+	return text.replace(ANSI_SEQUENCE, "");
+}
+function summarizeStderr(chunks) {
+	let errorPayload = null;
+	const warnings = [];
+	for (const chunk of chunks) {
+		const trimmed = stripAnsi(chunk).trim();
+		if (trimmed === "") continue;
+		if (trimmed.startsWith("{")) {
+			const parsed = parseJson(trimmed);
+			if (parsed.ok && isPlainObject(parsed.value)) {
+				if (errorPayload === null) errorPayload = parsed.value;
+				else warnings.push(JSON.stringify(parsed.value));
+				continue;
+			}
+		}
+		for (const line of trimmed.split("\n")) {
+			const text = line.trim();
+			if (text !== "" && !warnings.includes(text)) warnings.push(text);
+		}
+	}
+	return {
+		errorPayload,
+		warnings
+	};
+}
+function errorExitCode(error) {
+	const exit = error?.oclif?.exit;
+	return typeof exit === "number" ? exit : void 0;
+}
+/** An oclif `this.exit(n)` unwinds by throwing; it is not a failure message. */
+function isExitSignal(error) {
+	return error?.code === "EEXIT";
+}
+function thrownErrorBody(error) {
+	if (error instanceof Error) {
+		const body = { message: error.message };
+		const code = error.code;
+		if (typeof code === "string" && code !== "EEXIT") body.code = code;
+		return body;
+	}
+	return { message: String(error) };
+}
+/**
+* Build the single JSON document a guarded `--json` command prints from
+* what it wrote to stdout and stderr and how it ended.
+*/
+function composeJsonDocument(input) {
+	const { errorPayload, warnings: stderrLines } = summarizeStderr(input.stderr);
+	const failed = input.exitCode !== 0;
+	let warnings = stderrLines;
+	if (!failed && errorPayload !== null) warnings = [...warnings, JSON.stringify(errorPayload)];
+	const failure = () => {
+		if (errorPayload !== null) return errorPayload;
+		if (input.thrown && !isExitSignal(input.thrown.error)) return thrownErrorBody(input.thrown.error);
+		return { message: warnings.at(-1) ?? `The command failed with exit code ${input.exitCode}.` };
+	};
+	const text = input.stdout.trim();
+	let document;
+	let hasDocument = false;
+	if (text !== "") {
+		const parsed = parseJson(text);
+		document = parsed.ok ? parsed.value : { output: text };
+		hasDocument = true;
+	}
+	if (!hasDocument) {
+		if (failed) return {
+			error: failure(),
+			exit_code: input.exitCode,
+			...warnings.length > 0 ? { warnings } : {}
+		};
+		return warnings.length > 0 ? { summary: warnings.join("\n") } : {};
+	}
+	if (!isPlainObject(document)) {
+		if (!failed) return document;
+		return {
+			data: document,
+			error: failure(),
+			exit_code: input.exitCode,
+			...warnings.length > 0 ? { warnings } : {}
+		};
+	}
+	const merged = { ...document };
+	const stated = new Set([merged.outcome_message, merged.summary].filter((value) => typeof value === "string"));
+	warnings = warnings.filter((warning) => !stated.has(warning));
+	if (failed) {
+		if (merged.error === void 0 || merged.error === null) merged.error = failure();
+		if (merged.exit_code === void 0) merged.exit_code = input.exitCode;
+	}
+	if (warnings.length > 0) {
+		const existing = merged.warnings;
+		if (existing === void 0 || existing === null) merged.warnings = warnings;
+		else if (Array.isArray(existing)) merged.warnings = [...existing, ...warnings.filter((warning) => !existing.includes(warning))];
+		else merged.cli_warnings = warnings;
+	}
+	return merged;
+}
+/**
+* Make `cls` print one JSON document under `--json`. Idempotent per
+* class; command aliases that share a class are guarded once.
+*/
+function guardJsonOutput(cls) {
+	const prototype = cls.prototype;
+	if (Object.hasOwn(prototype, GUARDED)) return;
+	const originalRun = prototype._run;
+	prototype[GUARDED] = true;
+	prototype._run = async function guardedRun() {
+		if (!jsonOutputRequested(this.argv)) return originalRun.call(this);
+		const capture = captureOutput();
+		let result;
+		let thrown;
+		try {
+			result = await originalRun.call(this);
+		} catch (error) {
+			thrown = { error };
+		} finally {
+			capture.restore();
+		}
+		const document = composeJsonDocument({
+			exitCode: thrown ? isExitSignal(thrown.error) ? errorExitCode(thrown.error) ?? 0 : errorExitCode(thrown.error) ?? (typeof process.exitCode === "number" && process.exitCode !== 0 ? process.exitCode : 1) : typeof process.exitCode === "number" ? process.exitCode : 0,
+			stderr: capture.stderr,
+			stdout: capture.stdout.join(""),
+			thrown
+		});
+		console.log(JSON.stringify(document, null, 2));
+		if (thrown) {
+			if (thrown.error !== null && typeof thrown.error === "object") thrown.error.skipOclifErrorHandling = true;
+			throw thrown.error;
+		}
+		return result;
+	};
+}
+/** Command ids whose `--json` streams several documents over time. */
+const STREAMING_JSON_COMMAND_IDS = new Set(["listen"]);
+/**
+* Guard every command in `commands` that accepts `--json`, except the
+* streaming ones. Called once by the command registry.
+*/
+function guardJsonOutputCommands(commands) {
+	const streaming = /* @__PURE__ */ new Set();
+	for (const id of STREAMING_JSON_COMMAND_IDS) if (commands[id] !== void 0) streaming.add(commands[id]);
+	for (const command of Object.values(commands)) {
+		if (streaming.has(command)) continue;
+		const flags = command.flags;
+		const enableJsonFlag = command.enableJsonFlag;
+		if (flags && "json" in flags || enableJsonFlag === true) guardJsonOutput(command);
+	}
+}
+//#endregion
+export { jsonOutputRequested as n, guardJsonOutputCommands as t };