statelyai 0.10.1 → 0.11.0

package/dist/{cli-DV60djkN.mjs → cli-Dw84PDUH.mjs}

@@ -1,14 +1,15 @@
-import * as crypto from "node:crypto";
-import fs, { promises, watch } from "node:fs";
+import { Args, Command, Flags, flush, handle, run } from "@oclif/core";
 import fsPromises from "node:fs/promises";
-import { execFile, execFileSync, spawn } from "node:child_process";
 import * as path$1 from "node:path";
 import path from "node:path";
+import { z } from "zod";
+import { execFile, execFileSync, spawn } from "node:child_process";
+import { promisify } from "node:util";
+import * as crypto from "node:crypto";
+import fs, { promises, watch } from "node:fs";
 import { createInterface } from "node:readline/promises";
 import { Writable } from "node:stream";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { promisify } from "node:util";
-import { Args, Command, Flags, flush, handle, run } from "@oclif/core";
 import * as http from "node:http";
 import * as ts from "typescript";
 import { EditorHostWorkspaceSession, StudioApiError, buildAuthorizeUrl, createPkcePair, createRemoteEditorSyncBackend, createStatelyClient, discoverAuthorizationServer, discoverProtectedResource, exchangeCodeForToken, findStatelyPragmaAttachments, getStatelyPragma, refreshToken, registerOAuthClient } from "@statelyai/sdk";
@@ -16,121 +17,814 @@ import { WebSocket, WebSocketServer } from "ws";
 import os from "node:os";
 import { PullSourceReconciliationError, planSync, pullSync, pushLocalMachineLinks } from "@statelyai/sdk/sync";
 
-//#region src/version.ts
-const CLI_VERSION = "0.10.1";
+//#region ../api-contract/dist/verification.mjs
+const count = z.number().int().nonnegative();
+const metric = (value) => z.object({
+	value: z.union([value, z.literal("n/a")]),
+	detail: z.string()
+});
+const coverageBucket = z.object({
+	covered: count,
+	total: count,
+	uncovered: z.array(z.string())
+}).refine((bucket) => bucket.covered <= bucket.total, "Covered count exceeds total");
+const verificationCoverageSchema = z.object({
+	states: coverageBucket,
+	transitions: coverageBucket,
+	eventCases: coverageBucket,
+	percent: z.object({
+		states: z.number().min(0).max(100),
+		transitions: z.number().min(0).max(100),
+		eventCases: z.number().min(0).max(100),
+		overall: z.number().min(0).max(100)
+	})
+});
+const witnessStep = z.object({
+	index: count,
+	event: z.object({ type: z.string() }).catchall(z.unknown()),
+	expectedState: z.unknown()
+});
+const predicateResult = z.object({
+	state: z.string(),
+	status: z.enum(["passed", "failed"]),
+	signals: z.array(z.string()),
+	message: z.string().optional()
+});
+const verificationDivergenceSchema = z.object({
+	version: z.literal(1),
+	id: z.string(),
+	kind: z.enum(["expectation", "negative-probe"]),
+	classification: z.enum([
+		"unclassified",
+		"model-gap",
+		"behavior-gap",
+		"flake"
+	]),
+	pathId: z.string().optional(),
+	witness: z.object({
+		path: z.array(witnessStep),
+		stepCount: count
+	}),
+	minimalWitness: z.object({
+		steps: z.array(witnessStep),
+		pathLength: count,
+		candidatesTried: count,
+		reproduced: z.boolean()
+	}).optional(),
+	expected: z.object({
+		state: z.string(),
+		predicateResults: z.array(predicateResult),
+		refusal: z.object({
+			stateUnchanged: z.literal(true),
+			noNavigationOrMutation: z.literal(true)
+		}).optional()
+	}),
+	observed: z.object({
+		predicateResults: z.array(predicateResult),
+		snapshot: z.object({
+			url: z.string(),
+			title: z.string(),
+			visibleText: z.string(),
+			domHash: z.string(),
+			mutationCount: count.optional(),
+			requestCount: count.optional()
+		}),
+		error: z.string().optional()
+	}),
+	screenshotPath: z.string(),
+	provenance: z.object({
+		suite: z.string(),
+		modelVersion: z.string(),
+		modelHash: z.string(),
+		appBaseUrl: z.string(),
+		timestamp: z.string(),
+		traceFileRef: z.string()
+	}),
+	weakOracles: z.boolean()
+}).passthrough();
+const verificationPathSchema = z.object({
+	type: z.literal("path-result"),
+	id: z.string(),
+	status: z.enum(["passed", "failed"]),
+	witnessedStates: z.array(z.string()),
+	witnessedTransitions: z.array(z.string())
+}).passthrough();
+/** MBT version-one run report. Optional path/probe records support older reports. */
+const verificationRunReportSchema = z.object({
+	version: z.literal(1),
+	suite: z.string(),
+	status: z.enum(["passed", "failed"]),
+	verdict: z.enum([
+		"conformant",
+		"divergent",
+		"inconclusive"
+	]),
+	coverage: z.enum(["shortest", "simple"]),
+	scenario: z.string().optional(),
+	startedAt: z.iso.datetime({ offset: true }),
+	completedAt: z.iso.datetime({ offset: true }),
+	durationMs: z.number().nonnegative(),
+	exitCode: z.number().int(),
+	weakOracles: z.boolean(),
+	phases: z.array(z.object({
+		name: z.enum(["exploration", "verification"]),
+		status: z.enum(["completed", "skipped"]),
+		aiFree: z.boolean()
+	})),
+	probePlan: z.object({
+		cap: count,
+		totalCandidates: count,
+		samplingRule: z.string()
+	}),
+	metrics: z.object({
+		fitness: metric(z.number()).optional(),
+		precision: metric(z.number()),
+		soundnessRatio: metric(z.number()),
+		frontierSize: metric(z.number()),
+		determinism: metric(z.boolean())
+	}).passthrough(),
+	modelCoverage: verificationCoverageSchema,
+	executedCoverage: verificationCoverageSchema,
+	paths: z.array(verificationPathSchema).optional(),
+	probes: z.array(z.object({
+		type: z.literal("probe-result"),
+		id: z.string(),
+		state: z.string(),
+		event: z.string(),
+		status: z.enum(["passed", "failed"])
+	})).optional(),
+	divergences: z.array(verificationDivergenceSchema),
+	ledger: z.array(z.object({
+		type: z.literal("divergence"),
+		timestamp: z.string(),
+		divergence: verificationDivergenceSchema
+	}))
+}).passthrough().superRefine((report, context) => {
+	if (report.divergences.length > 0 !== (report.verdict === "divergent")) context.addIssue({
+		code: "custom",
+		path: ["verdict"],
+		message: "Verdict must agree with recorded divergences"
+	});
+	if (report.verdict === "conformant" && (report.status !== "passed" || report.exitCode !== 0 || report.paths?.some((item) => item.status === "failed") || report.probes?.some((item) => item.status === "failed") || report.metrics.determinism.value === false)) context.addIssue({
+		code: "custom",
+		path: ["verdict"],
+		message: "Conformant reports cannot contain failed execution results"
+	});
+	if (report.status === "passed" && (report.verdict !== "conformant" || report.exitCode !== 0)) context.addIssue({
+		code: "custom",
+		path: ["status"],
+		message: "A passed report requires a conformant verdict and zero exit code"
+	});
+});
+const verificationFailOnSchema = z.enum(["divergent", "inconclusive"]);
+/** References are inert data. The host resolves them inside its execution boundary. */
+const verificationRequestSchema = z.object({
+	model: z.discriminatedUnion("kind", [z.object({
+		kind: z.literal("source"),
+		content: z.string().min(1),
+		name: z.string().optional()
+	}), z.object({
+		kind: z.literal("machine"),
+		machineId: z.string().min(1)
+	})]),
+	bindings: z.object({
+		content: z.string(),
+		name: z.string().optional()
+	}).optional(),
+	baseline: z.discriminatedUnion("kind", [z.object({
+		kind: z.literal("report"),
+		report: verificationRunReportSchema
+	}), z.object({
+		kind: z.literal("reference"),
+		id: z.string().min(1)
+	})]).optional()
+});
+const verificationExecutionPolicy = {
+	aiFree: true,
+	network: "deny",
+	env: { MBT_VERIFY_AI_FREE: "1" }
+};
+/** Strict mode fails on divergences and inconclusive runs; default fails on divergences. */
+function verificationExitCode(report, failOn = "divergent") {
+	return report.verdict === "divergent" || failOn === "inconclusive" && report.verdict === "inconclusive" ? 1 : 0;
+}
+function verificationWitnessEvents(divergence) {
+	return (divergence.minimalWitness?.reproduced ? divergence.minimalWitness.steps : divergence.witness.path).map((step) => step.event.type);
+}
+function formatVerificationSummary(report) {
+	const violations = report.divergences.filter((item) => item.kind === "negative-probe").length;
+	return [`${report.verdict}: ${report.divergences.length} divergence(s), ${violations} negative-probe violation(s), ${report.executedCoverage.percent.overall}% executed coverage`, ...report.divergences.map((item) => `${item.id}: witness: [${verificationWitnessEvents(item).join(", ")}]`)].join("\n");
+}
 
 //#endregion
-//#region src/cliHost.ts
-const DEFAULT_SYNC_MAX_FILES = 150;
-const DEFAULT_SYNC_MAX_BYTES = 2e6;
-const supportedDocumentPattern = /\.(?:c|m)?(?:jsx?|tsx?)$|\.jsonc?$|\.ya?ml$|\.mmd$|\.mermaid$/i;
-var WebSocketClient = class {
-	listeners = /* @__PURE__ */ new Set();
-	constructor(socket) {
-		this.socket = socket;
-		socket.on("message", (data, isBinary) => {
-			if (isBinary) return;
-			let message;
-			try {
-				message = JSON.parse(rawDataToBuffer(data).toString("utf8"));
-			} catch {
-				socket.close(1007, "Invalid JSON payload");
-				return;
-			}
-			for (const listener of this.listeners) listener(message);
-		});
-	}
-	onMessage(listener) {
-		this.listeners.add(listener);
-	}
-	send(message) {
-		if (this.socket.readyState === WebSocket.OPEN) this.socket.send(JSON.stringify(message));
+//#region src/projectConfig.ts
+const STATELY_CONFIG_FILE = "statelyai.json";
+const STATELY_CONFIG_SCHEMA_URL = "https://stately.ai/schemas/statelyai.json";
+const STATELY_CONFIG_VERSION = "1.0.0";
+/**
+* Base URL of the deployment that hosts the owned resource contract
+* (`/api/v1/*`). Matches the SDK default.
+*/
+const DEFAULT_STATELY_API_BASE_URL = "https://editor.stately.ai";
+/**
+* Hosts of the legacy hosted Studio. `statelyai.json#studioUrl` values that
+* point at them predate the editor-hosted API and must be redirected.
+*/
+const HOSTED_STUDIO_HOSTNAMES = new Set(["stately.ai", "www.stately.ai"]);
+/**
+* Maps a configured `statelyai.json#studioUrl` (or a `--base-url` flag) to the
+* base URL of the editor API that serves our owned contract.
+*
+* Hosted legacy values (`https://stately.ai`, `http://www.stately.ai/`, ...)
+* resolve to {@link DEFAULT_STATELY_API_BASE_URL}. Anything else is used as-is
+* (minus trailing slashes): self-hosted editor deployments already point at the
+* server that hosts `/api/v1`.
+*
+* This is a read-only compatibility shim: the CLI never rewrites
+* `statelyai.json` because of it.
+*/
+function resolveApiBaseUrl(studioUrl) {
+	const trimmed = studioUrl?.trim();
+	if (!trimmed) return DEFAULT_STATELY_API_BASE_URL;
+	const parsed = tryParseUrl(trimmed) ?? tryParseUrl(`https://${trimmed}`);
+	if (parsed && HOSTED_STUDIO_HOSTNAMES.has(parsed.hostname.toLowerCase())) return DEFAULT_STATELY_API_BASE_URL;
+	return trimmed.replace(/\/+$/, "");
+}
+function tryParseUrl(value) {
+	try {
+		return new URL(value);
+	} catch {
+		return;
 	}
-	close() {
-		if (this.socket.readyState === WebSocket.OPEN || this.socket.readyState === WebSocket.CONNECTING) this.socket.close();
+}
+const DEFAULT_SOURCE_EXCLUDES = ["**/*.test.*", "**/*.spec.*"];
+const CODE_SOURCE_EXTENSIONS = new Set([
+	".ts",
+	".tsx",
+	".js",
+	".jsx",
+	".mts",
+	".cts",
+	".mjs",
+	".cjs"
+]);
+const execFileAsync$1 = promisify(execFile);
+const ALWAYS_IGNORED_DIRECTORIES = new Set([
+	".git",
+	"node_modules",
+	"dist",
+	"build",
+	"out",
+	"coverage",
+	".next"
+]);
+function createStatelyProjectConfig(options) {
+	const defaultXStateVersion = options.defaultXStateVersion ?? 5;
+	return {
+		$schema: STATELY_CONFIG_SCHEMA_URL,
+		version: STATELY_CONFIG_VERSION,
+		projectId: options.projectId ?? "",
+		studioUrl: options.studioUrl ?? "https://stately.ai",
+		defaultXStateVersion,
+		include: [],
+		exclude: [...DEFAULT_SOURCE_EXCLUDES]
+	};
+}
+async function writeStatelyProjectConfig(configPath, config) {
+	const serialized = { ...config };
+	if (!config.projectId) {
+		delete serialized.projectId;
+		delete serialized.studioUrl;
 	}
-};
-function rawDataToBuffer(data) {
-	if (Array.isArray(data)) return Buffer.concat(data);
-	if (data instanceof ArrayBuffer) return Buffer.from(data);
-	return Buffer.from(data);
+	await fsPromises.writeFile(configPath, `${JSON.stringify(serialized, null, 2)}\n`, "utf8");
 }
-var RemoteEditorSession = class {
-	session;
-	workspaceWatcher;
-	constructor(options, sendMessage) {
-		this.options = options;
-		const send = (message) => {
-			this.log("send", message.type, message);
-			sendMessage(message);
+function normalizeProjectConfig(config) {
+	const firstSource = config.sources?.[0];
+	return {
+		$schema: config.$schema ?? STATELY_CONFIG_SCHEMA_URL,
+		version: config.version ?? STATELY_CONFIG_VERSION,
+		projectId: config.projectId ?? "",
+		studioUrl: config.studioUrl ?? "https://stately.ai",
+		defaultXStateVersion: Math.max(5, config.defaultXStateVersion ?? 5),
+		...config.sourceUpdateStrategy === "preserve" || config.sourceUpdateStrategy === "rewrite" ? { sourceUpdateStrategy: config.sourceUpdateStrategy } : {},
+		include: [...config.include ?? firstSource?.include ?? []],
+		exclude: config.exclude == null ? [...firstSource?.exclude ?? DEFAULT_SOURCE_EXCLUDES] : [...config.exclude],
+		...config.newMachinesDir ? { newMachinesDir: config.newMachinesDir } : {}
+	};
+}
+function getConfigRewriteStatus(config) {
+	if (!config.sources) return { needsRewrite: false };
+	if (config.sources.length > 1) return {
+		needsRewrite: true,
+		reason: "multiple-legacy-sources"
+	};
+	return {
+		needsRewrite: true,
+		reason: "legacy-sources"
+	};
+}
+async function readStatelyProjectConfig(options = {}) {
+	const rootDir = path.resolve(options.cwd ?? process.cwd());
+	const configPath = path.resolve(rootDir, options.configPath ?? STATELY_CONFIG_FILE);
+	const raw = await fsPromises.readFile(configPath, "utf8");
+	const parsed = JSON.parse(raw);
+	const config = normalizeProjectConfig(parsed);
+	const rewriteStatus = getConfigRewriteStatus(parsed);
+	if (options.rewriteIfNeeded && rewriteStatus.reason === "legacy-sources") {
+		await writeStatelyProjectConfig(configPath, config);
+		return {
+			config,
+			configPath,
+			rootDir,
+			rewriteStatus: {
+				needsRewrite: false,
+				rewritten: true
+			}
 		};
-		const machines = options.machines ?? [{
-			id: `${options.rootUri}#0`,
-			fileName: options.fileName,
-			machineIndex: 0
-		}];
-		this.workspaceWatcher = createSharedWorkspaceWatcher(options.rootDir);
-		this.session = new EditorHostWorkspaceSession({
-			machines: machines.map((machine) => ({
-				id: machine.id,
-				name: machine.name,
-				source: {
-					rootUri: fileNameToUri(machine.fileName),
-					rootFileName: machine.fileName,
-					rootDir: options.rootDir,
-					machineIndex: machine.machineIndex,
-					collectDocuments: (extraUris) => collectSourceDocuments({
-						rootFileName: machine.fileName,
-						extraUris: [...extraUris ?? []]
-					}),
-					applyReplacements: async (replacements, rootUri) => {
-						await applyFileReplacements(replacements, rootUri);
-						return [...new Set(replacements.map((replacement) => replacement.uri ?? rootUri))];
-					},
-					watchSavedDocuments: (listener) => this.workspaceWatcher.subscribe(listener)
-				}
-			})),
-			currentMachineId: machines[0]?.id,
-			workspaceName: path$1.basename(options.rootDir),
-			projectWorkspaceOpen: false,
-			sourceUpdateStrategy: options.sourceUpdateStrategy ?? "preserve",
-			sync: createRemoteEditorSyncBackend({
-				editorUrl: options.editorUrl,
-				apiKey: options.apiKey,
-				fetch: (input, init) => fetchEditorHost(input instanceof URL ? input : new URL(String(input)), init)
-			}),
-			send,
-			apiKey: options.apiKey,
-			client: {
-				name: "statelyai",
-				version: CLI_VERSION
-			},
-			showError: (message) => console.error(`Stately Editor: ${message}`)
-		});
-	}
-	receiveMessage(message) {
-		this.log("recv", message.type, message);
-		return this.session.receive(message);
 	}
-	dispose() {
-		this.session.dispose();
-		this.workspaceWatcher.dispose();
-	}
-	log(direction, type, payload) {
-		if (this.options.debug) console.error(`[${direction}] ${type}`, redactDebugPayload(payload) ?? "");
-	}
-};
-function redactDebugPayload(payload) {
-	if (Array.isArray(payload)) return payload.map(redactDebugPayload);
-	if (!payload || typeof payload !== "object") return payload;
-	return Object.fromEntries(Object.entries(payload).map(([key, value]) => [key, /^(?:apiKey|accessToken|refreshToken|token|authorization)$/i.test(key) ? "[REDACTED]" : redactDebugPayload(value)]));
+	return {
+		config,
+		configPath,
+		rootDir,
+		rewriteStatus
+	};
 }
-async function openEditor(options) {
-	const fileName = path$1.resolve(options.fileName);
-	const machines = (options.machines ?? [{
-		id: `${fileNameToUri(fileName)}#0`,
-		fileName,
-		machineIndex: 0
+async function walkFiles(rootDir, currentDir = rootDir) {
+	const entries = await fsPromises.readdir(currentDir, { withFileTypes: true });
+	const files = [];
+	for (const entry of entries) {
+		if (ALWAYS_IGNORED_DIRECTORIES.has(entry.name)) continue;
+		const absolutePath = path.join(currentDir, entry.name);
+		if (entry.isDirectory()) {
+			files.push(...await walkFiles(rootDir, absolutePath));
+			continue;
+		}
+		if (!entry.isFile()) continue;
+		files.push(path.relative(rootDir, absolutePath).replace(/\\/g, "/"));
+	}
+	return files;
+}
+async function filterGitIgnoredPaths(rootDir, relativeFiles) {
+	if (relativeFiles.length === 0) return relativeFiles;
+	try {
+		const { stdout } = await execFileAsync$1("git", ["check-ignore", ...relativeFiles], { cwd: rootDir });
+		const ignoredEntries = stdout.split(/\r?\n/).map((entry) => entry.trim()).filter(Boolean);
+		if (ignoredEntries.length === 0) return relativeFiles;
+		const ignoredPaths = new Set(ignoredEntries);
+		return relativeFiles.filter((relativePath) => {
+			return !ignoredPaths.has(relativePath);
+		});
+	} catch {
+		return relativeFiles;
+	}
+}
+function isCodeSourceFile(relativePath) {
+	return CODE_SOURCE_EXTENSIONS.has(path.extname(relativePath).toLowerCase());
+}
+function expandBraces(pattern) {
+	const match = pattern.match(/\{([^{}]+)\}/);
+	if (!match || match.index == null) return [pattern];
+	const [token, inner] = match;
+	return inner.split(",").flatMap((variant) => expandBraces(`${pattern.slice(0, match.index)}${variant}${pattern.slice(match.index + token.length)}`));
+}
+function globToRegExp(pattern) {
+	let regex = "^";
+	for (let index = 0; index < pattern.length; index += 1) {
+		const char = pattern[index];
+		const next = pattern[index + 1];
+		if (char === "*") {
+			if (next === "*") {
+				const slashAfterGlobstar = pattern[index + 2] === "/";
+				regex += slashAfterGlobstar ? "(?:.*/)?" : ".*";
+				index += slashAfterGlobstar ? 2 : 1;
+				continue;
+			}
+			regex += "[^/]*";
+			continue;
+		}
+		if (char === "?") {
+			regex += "[^/]";
+			continue;
+		}
+		if ("\\.[]{}()+-^$|".includes(char)) {
+			regex += `\\${char}`;
+			continue;
+		}
+		regex += char;
+	}
+	regex += "$";
+	return new RegExp(regex);
+}
+function matchesGlob(relativePath, pattern) {
+	return expandBraces(pattern).some((expanded) => globToRegExp(expanded).test(relativePath));
+}
+function matchesAny(patterns, relativePath) {
+	return (patterns ?? []).some((pattern) => matchesGlob(relativePath, pattern));
+}
+function isTrackedByStatelyProjectConfig(config, relativePath) {
+	return matchesAny(config.include, relativePath) && !matchesAny(config.exclude ?? DEFAULT_SOURCE_EXCLUDES, relativePath);
+}
+async function discoverCodeSourceFiles(options = {}) {
+	const rootDir = path.resolve(options.cwd ?? process.cwd());
+	return (await filterGitIgnoredPaths(rootDir, await walkFiles(rootDir))).filter((relativePath) => isCodeSourceFile(relativePath)).filter((relativePath) => !matchesAny(DEFAULT_SOURCE_EXCLUDES, relativePath)).sort((left, right) => left.localeCompare(right));
+}
+function createSuggestedConfig(include) {
+	return {
+		include: [include],
+		exclude: [...DEFAULT_SOURCE_EXCLUDES]
+	};
+}
+function toExtensionToken(extname) {
+	return extname.startsWith(".") ? extname.slice(1) : extname;
+}
+function formatExtensionPattern(extnames) {
+	const unique = [...new Set(extnames.map(toExtensionToken))].sort();
+	if (unique.length === 1) return `.${unique[0]}`;
+	return `.{${unique.join(",")}}`;
+}
+function getSuggestionRoot(relativePath) {
+	if (relativePath.startsWith("src/")) return "src/";
+	const packageMatch = relativePath.match(/^packages\/([^/]+)\/src\//);
+	if (packageMatch) return `packages/${packageMatch[1]}/src/`;
+	const appMatch = relativePath.match(/^apps\/([^/]+)\/src\//);
+	if (appMatch) return `apps/${appMatch[1]}/src/`;
+	return null;
+}
+function getCommonDirectory(relativePaths) {
+	const [firstDirectory, ...remainingDirectories] = relativePaths.map((relativePath) => path.posix.dirname(relativePath).split("/"));
+	if (!firstDirectory) return;
+	const commonSegments = [];
+	for (const [index, segment] of firstDirectory.entries()) {
+		if (!remainingDirectories.every((directory) => directory[index] === segment)) break;
+		commonSegments.push(segment);
+	}
+	return commonSegments.length > 0 ? commonSegments.join("/") : void 0;
+}
+function suggestGroupedInclude(relativePaths, root) {
+	const extPattern = formatExtensionPattern(relativePaths.map((relativePath) => path.posix.extname(relativePath)));
+	if (relativePaths.map((relativePath) => path.posix.basename(relativePath, path.posix.extname(relativePath))).every((basename) => basename.toLowerCase().endsWith("machine"))) return `${root}**/*machine${extPattern}`;
+	const commonDirectory = getCommonDirectory(relativePaths);
+	if (commonDirectory) return `${commonDirectory}/${relativePaths.every((relativePath) => path.posix.dirname(relativePath) === commonDirectory) ? "*" : "**/*"}${extPattern}`;
+	return `${root}**/*${extPattern}`;
+}
+function suggestStatelySourceConfigs(relativePaths) {
+	const pending = new Set(relativePaths.map((relativePath) => relativePath.replace(/\\/g, "/")).filter(Boolean));
+	const suggestions = [];
+	const addSuggestion = (include, predicate) => {
+		const matched = [...pending].filter(predicate);
+		if (matched.length === 0) return;
+		suggestions.push(createSuggestedConfig(include));
+		for (const matchedPath of matched) pending.delete(matchedPath);
+	};
+	const groupedRoots = /* @__PURE__ */ new Map();
+	for (const relativePath of pending) {
+		const root = getSuggestionRoot(relativePath);
+		if (!root) continue;
+		const bucket = groupedRoots.get(root) ?? [];
+		bucket.push(relativePath);
+		groupedRoots.set(root, bucket);
+	}
+	for (const [root, groupedPaths] of [...groupedRoots.entries()].sort((left, right) => left[0].localeCompare(right[0]))) addSuggestion(suggestGroupedInclude(groupedPaths, root), (relativePath) => groupedPaths.includes(relativePath));
+	const byDirectory = /* @__PURE__ */ new Map();
+	for (const relativePath of pending) {
+		const directory = path.posix.dirname(relativePath);
+		const key = directory === "." ? relativePath : directory;
+		const bucket = byDirectory.get(key) ?? [];
+		bucket.push(relativePath);
+		byDirectory.set(key, bucket);
+	}
+	for (const [key, matchedPaths] of [...byDirectory.entries()].sort((left, right) => left[0].localeCompare(right[0]))) {
+		if (matchedPaths.length > 1 && key !== "." && key !== matchedPaths[0]) {
+			addSuggestion(`${key}/**/*.{ts,tsx,js,jsx,mts,cts,mjs,cjs}`, (relativePath) => relativePath.startsWith(`${key}/`));
+			continue;
+		}
+		const exactPath = matchedPaths[0];
+		addSuggestion(exactPath, (relativePath) => relativePath === exactPath);
+	}
+	return suggestions;
+}
+async function discoverStatelySourceFiles(options = {}) {
+	const { config, rootDir } = options.config ? {
+		config: options.config,
+		rootDir: path.resolve(options.cwd ?? process.cwd())
+	} : await readStatelyProjectConfig(options);
+	const relativeFiles = await filterGitIgnoredPaths(rootDir, await walkFiles(rootDir));
+	const discovered = /* @__PURE__ */ new Map();
+	const source = {
+		include: config.include,
+		exclude: config.exclude ?? DEFAULT_SOURCE_EXCLUDES,
+		format: "xstate",
+		xstateVersion: config.defaultXStateVersion
+	};
+	for (const relativePath of relativeFiles) {
+		if (!matchesAny(source.include, relativePath)) continue;
+		if (matchesAny(source.exclude, relativePath)) continue;
+		const filePath = path.join(rootDir, relativePath);
+		if (!discovered.has(filePath)) discovered.set(filePath, {
+			filePath,
+			relativePath,
+			source
+		});
+	}
+	return [...discovered.values()].sort((left, right) => left.relativePath.localeCompare(right.relativePath));
+}
+
+//#endregion
+//#region src/verificationJUnit.ts
+function xml(text) {
+	return text.replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\uFFFE\uFFFF]/gu, "�").replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&apos;");
+}
+/** One case per recorded path/probe. Unattributed divergences remain separate cases. */
+function formatVerificationJUnit(report) {
+	if (!report.paths) throw new Error("JUnit requires path records. This report predates path reporting.");
+	const records = [...report.paths, ...report.probes ?? []];
+	const counts = /* @__PURE__ */ new Map();
+	for (const record of records) counts.set(record.id, (counts.get(record.id) ?? 0) + 1);
+	const hasUniqueRecord = (id) => id !== void 0 && counts.get(id) === 1;
+	const cases = [];
+	let errors = 0;
+	const failures = (items) => items.map((item) => `<failure type="${xml(item.kind)}" message="${xml(`${item.id}; witness: [${verificationWitnessEvents(item).join(", ")}]`)}">${xml(item.observed.error ?? `Expected ${item.expected.state}`)}</failure>`).join("");
+	for (const record of records) {
+		const divergences = report.divergences.filter((item) => item.pathId === record.id && hasUniqueRecord(item.pathId));
+		const failedWithoutWitness = record.status === "failed" && !divergences.length;
+		if (failedWithoutWitness) errors++;
+		cases.push(`<testcase name="${xml(record.id)}" classname="${xml(report.suite)}">${failures(divergences)}${failedWithoutWitness ? "<error type=\"unattributed_path_failure\" message=\"Path failed without a linked divergence; consult the run report.\"/>" : ""}</testcase>`);
+	}
+	for (const item of report.divergences.filter((item) => !hasUniqueRecord(item.pathId))) cases.push(`<testcase name="${xml(item.id)}" classname="${xml(report.suite)}">${failures([item])}</testcase>`);
+	if (report.verdict === "inconclusive" || report.status === "failed" && !errors && !report.divergences.length) {
+		errors++;
+		cases.push("<testcase name=\"verification incomplete\"><error type=\"inconclusive\" message=\"Verification did not produce a conclusive successful run.\"/></testcase>");
+	}
+	return `<?xml version="1.0" encoding="UTF-8"?>\n<testsuite name="${xml(report.suite)}" tests="${cases.length}" failures="${report.divergences.length}" errors="${errors}" time="${report.durationMs / 1e3}">\n${cases.join("\n")}\n</testsuite>\n`;
+}
+
+//#endregion
+//#region src/verification.ts
+const maxInputBytes = 10 * 1024 * 1024;
+async function readInput(file) {
+	if ((await fsPromises.stat(file)).size > maxInputBytes) throw new Error(`Verification input exceeds ${maxInputBytes} bytes: ${file}`);
+	return fsPromises.readFile(file, "utf8");
+}
+async function localFile(root, reference) {
+	const file = path.resolve(root, reference);
+	try {
+		if (!(await fsPromises.stat(file)).isFile()) throw new Error(`Not a file: ${reference}`);
+		return file;
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+		if (reference.includes("/") || reference.includes("\\") || path.extname(reference) || reference.startsWith(".")) throw new Error(`Verification input not found: ${reference}`);
+		return;
+	}
+}
+/** Read local source as data; never import or execute model/bindings modules. */
+async function resolveVerificationRequest(options) {
+	const cwd = path.resolve(options.cwd ?? process.cwd());
+	const inputFiles = [];
+	let model = options.model;
+	if (!model) {
+		const project = await readStatelyProjectConfig({
+			cwd,
+			configPath: options.configPath
+		});
+		const files = await discoverStatelySourceFiles({
+			cwd: project.rootDir,
+			config: project.config
+		});
+		if (files.length !== 1) throw new Error(`Expected one configured model, found ${files.length}. Select one with --model.`);
+		model = files[0].filePath;
+	}
+	const modelFile = await localFile(cwd, model);
+	const request = { model: modelFile ? {
+		kind: "source",
+		content: await readInput(modelFile),
+		name: path.basename(modelFile)
+	} : {
+		kind: "machine",
+		machineId: model.replace(/^machine:/, "")
+	} };
+	if (modelFile) inputFiles.push(modelFile);
+	if (options.bindings) {
+		const file = path.resolve(cwd, options.bindings);
+		request.bindings = {
+			content: await readInput(file),
+			name: path.basename(file)
+		};
+		inputFiles.push(file);
+	}
+	if (options.baseline) {
+		const file = await localFile(cwd, options.baseline);
+		request.baseline = file ? {
+			kind: "report",
+			report: verificationRunReportSchema.parse(JSON.parse(await readInput(file)))
+		} : {
+			kind: "reference",
+			id: options.baseline
+		};
+		if (file) inputFiles.push(file);
+	}
+	return {
+		request: verificationRequestSchema.parse(request),
+		inputFiles
+	};
+}
+async function verifyProject(options = {}) {
+	const cwd = path.resolve(options.cwd ?? process.cwd());
+	let report;
+	let inputFiles;
+	if (options.fromReport) {
+		if (options.model || options.bindings || options.baseline || options.configPath) throw new Error("--from-report cannot be combined with model, bindings, baseline, or config inputs.");
+		const file = path.resolve(cwd, options.fromReport);
+		report = verificationRunReportSchema.parse(JSON.parse(await readInput(file)));
+		inputFiles = [file];
+	} else {
+		if (!options.execute) throw new Error("Live verification is not configured. Use --from-report <file> to process an existing run report, or supply a VerificationExecutor to verifyProject().");
+		const resolved = await resolveVerificationRequest(options);
+		inputFiles = resolved.inputFiles;
+		report = verificationRunReportSchema.parse(await options.execute(resolved.request, verificationExecutionPolicy));
+	}
+	const format = options.reportFormat ?? "json";
+	const output = format === "junit" ? formatVerificationJUnit(report) : `${JSON.stringify(report, null, 2)}\n`;
+	const destination = options.report ?? `statelyai-verify-report.${format === "junit" ? "xml" : "json"}`;
+	if (destination !== "-") {
+		const file = path.resolve(cwd, destination);
+		const existing = await fsPromises.realpath(file).catch((error) => {
+			if (error.code === "ENOENT") return file;
+			throw error;
+		});
+		for (const input of inputFiles) if (existing === await fsPromises.realpath(input)) throw new Error("Report output cannot overwrite a verification input.");
+		await fsPromises.mkdir(path.dirname(file), { recursive: true });
+		await fsPromises.writeFile(file, output, "utf8");
+	}
+	return {
+		report,
+		output,
+		destination,
+		summary: `${options.fromReport ? "Saved report: " : ""}${formatVerificationSummary(report)}`,
+		exitCode: verificationExitCode(report, options.failOn)
+	};
+}
+
+//#endregion
+//#region src/verifyCommand.ts
+var VerifyCommand = class VerifyCommand extends Command {
+	static enableJsonFlag = false;
+	static summary = "Validate a verification report, print its verdict, and export JSON or JUnit.";
+	static description = "Saved-report processing works offline. Live execution requires a configured verification adapter.";
+	static flags = {
+		model: Flags.string({ description: "Model file or registry machine ID (live execution)" }),
+		bindings: Flags.string({ description: "Bindings file (live execution)" }),
+		baseline: Flags.string({ description: "Baseline report file or reference ID (live execution)" }),
+		config: Flags.string({ description: "Path to statelyai.json (live execution)" }),
+		"from-report": Flags.string({ description: "Process an existing run report without executing verification" }),
+		report: Flags.string({ description: "Output file, or - for stdout; defaults to statelyai-verify-report.json/xml" }),
+		"report-format": Flags.string({
+			options: ["json", "junit"],
+			default: "json"
+		}),
+		"fail-on": Flags.string({
+			options: ["divergent", "inconclusive"],
+			default: "divergent",
+			description: "inconclusive also fails on divergences"
+		})
+	};
+	async run() {
+		const { flags } = await this.parse(VerifyCommand);
+		let result;
+		try {
+			result = await verifyProject({
+				model: flags.model,
+				bindings: flags.bindings,
+				baseline: flags.baseline,
+				configPath: flags.config,
+				fromReport: flags["from-report"],
+				report: flags.report,
+				reportFormat: flags["report-format"],
+				failOn: flags["fail-on"]
+			});
+		} catch (error) {
+			this.error(error instanceof Error ? error.message : String(error), { exit: 2 });
+		}
+		this.log(result.destination === "-" ? result.output.trimEnd() : result.summary);
+		if (result.exitCode) this.exit(result.exitCode);
+	}
+};
+
+//#endregion
+//#region src/version.ts
+const CLI_VERSION = "0.11.0";
+
+//#endregion
+//#region src/cliHost.ts
+const DEFAULT_SYNC_MAX_FILES = 150;
+const DEFAULT_SYNC_MAX_BYTES = 2e6;
+const supportedDocumentPattern = /\.(?:c|m)?(?:jsx?|tsx?)$|\.jsonc?$|\.ya?ml$|\.mmd$|\.mermaid$/i;
+var WebSocketClient = class {
+	listeners = /* @__PURE__ */ new Set();
+	constructor(socket) {
+		this.socket = socket;
+		socket.on("message", (data, isBinary) => {
+			if (isBinary) return;
+			let message;
+			try {
+				message = JSON.parse(rawDataToBuffer(data).toString("utf8"));
+			} catch {
+				socket.close(1007, "Invalid JSON payload");
+				return;
+			}
+			for (const listener of this.listeners) listener(message);
+		});
+	}
+	onMessage(listener) {
+		this.listeners.add(listener);
+	}
+	send(message) {
+		if (this.socket.readyState === WebSocket.OPEN) this.socket.send(JSON.stringify(message));
+	}
+	close() {
+		if (this.socket.readyState === WebSocket.OPEN || this.socket.readyState === WebSocket.CONNECTING) this.socket.close();
+	}
+};
+function rawDataToBuffer(data) {
+	if (Array.isArray(data)) return Buffer.concat(data);
+	if (data instanceof ArrayBuffer) return Buffer.from(data);
+	return Buffer.from(data);
+}
+var RemoteEditorSession = class {
+	session;
+	workspaceWatcher;
+	constructor(options, sendMessage) {
+		this.options = options;
+		const send = (message) => {
+			this.log("send", message.type, message);
+			sendMessage(message);
+		};
+		const machines = options.machines ?? [{
+			id: `${options.rootUri}#0`,
+			fileName: options.fileName,
+			machineIndex: 0
+		}];
+		this.workspaceWatcher = createSharedWorkspaceWatcher(options.rootDir);
+		this.session = new EditorHostWorkspaceSession({
+			machines: machines.map((machine) => ({
+				id: machine.id,
+				name: machine.name,
+				source: {
+					rootUri: fileNameToUri(machine.fileName),
+					rootFileName: machine.fileName,
+					rootDir: options.rootDir,
+					machineIndex: machine.machineIndex,
+					collectDocuments: (extraUris) => collectSourceDocuments({
+						rootFileName: machine.fileName,
+						extraUris: [...extraUris ?? []]
+					}),
+					applyReplacements: async (replacements, rootUri) => {
+						await applyFileReplacements(replacements, rootUri);
+						return [...new Set(replacements.map((replacement) => replacement.uri ?? rootUri))];
+					},
+					watchSavedDocuments: (listener) => this.workspaceWatcher.subscribe(listener)
+				}
+			})),
+			currentMachineId: machines[0]?.id,
+			workspaceName: path$1.basename(options.rootDir),
+			projectWorkspaceOpen: false,
+			sourceUpdateStrategy: options.sourceUpdateStrategy ?? "preserve",
+			sync: createRemoteEditorSyncBackend({
+				editorUrl: options.editorUrl,
+				apiKey: options.apiKey,
+				fetch: (input, init) => fetchEditorHost(input instanceof URL ? input : new URL(String(input)), init)
+			}),
+			send,
+			apiKey: options.apiKey,
+			client: {
+				name: "statelyai",
+				version: CLI_VERSION
+			},
+			showError: (message) => console.error(`Stately Editor: ${message}`)
+		});
+	}
+	receiveMessage(message) {
+		this.log("recv", message.type, message);
+		return this.session.receive(message);
+	}
+	dispose() {
+		this.session.dispose();
+		this.workspaceWatcher.dispose();
+	}
+	log(direction, type, payload) {
+		if (this.options.debug) console.error(`[${direction}] ${type}`, redactDebugPayload(payload) ?? "");
+	}
+};
+function redactDebugPayload(payload) {
+	if (Array.isArray(payload)) return payload.map(redactDebugPayload);
+	if (!payload || typeof payload !== "object") return payload;
+	return Object.fromEntries(Object.entries(payload).map(([key, value]) => [key, /^(?:apiKey|accessToken|refreshToken|token|authorization)$/i.test(key) ? "[REDACTED]" : redactDebugPayload(value)]));
+}
+async function openEditor(options) {
+	const fileName = path$1.resolve(options.fileName);
+	const machines = (options.machines ?? [{
+		id: `${fileNameToUri(fileName)}#0`,
+		fileName,
+		machineIndex: 0
 	}]).map((machine) => ({
 		...machine,
 		fileName: path$1.resolve(machine.fileName)
@@ -624,99 +1318,32 @@ async function writeFileStoredCredential(credential) {
 		location: credentialsPath
 	};
 }
-async function deleteFileCredentials() {
-	try {
-		await promises.unlink(getCredentialsFilePath());
-		return true;
-	} catch {
-		return false;
-	}
-}
-async function readMacOSStoredCredential() {
-	if (process.platform !== "darwin") return;
-	try {
-		const { stdout } = await execFile$1("security", [
-			"find-generic-password",
-			"-s",
-			SERVICE_NAME,
-			"-a",
-			ACCOUNT_NAME,
-			"-w"
-		]);
-		return parseStoredCredential(stdout, "macos-keychain", "macOS Keychain");
-	} catch {
-		return;
-	}
-}
-async function writeMacOSKeychain(apiKey) {
-	const stored = await writeMacOSStoredCredential({
-		type: "api_key",
-		token: apiKey
-	});
-	return stored ? {
-		apiKey,
-		backend: stored.backend,
-		location: stored.location
-	} : void 0;
-}
-async function writeMacOSStoredCredential(credential) {
-	if (process.platform !== "darwin") return;
-	const payload = {
-		version: 1,
-		credential
-	};
-	try {
-		await execFile$1("security", [
-			"add-generic-password",
-			"-U",
-			"-s",
-			SERVICE_NAME,
-			"-a",
-			ACCOUNT_NAME,
-			"-w",
-			JSON.stringify(payload)
-		]);
-		return {
-			...credential ? { credential } : {},
-			backend: "macos-keychain",
-			location: "macOS Keychain"
-		};
-	} catch {
-		return;
-	}
-}
-async function deleteMacOSKeychain() {
-	if (process.platform !== "darwin") return false;
+async function deleteFileCredentials() {
 	try {
-		await execFile$1("security", [
-			"delete-generic-password",
-			"-s",
-			SERVICE_NAME,
-			"-a",
-			ACCOUNT_NAME
-		]);
+		await promises.unlink(getCredentialsFilePath());
 		return true;
 	} catch {
 		return false;
 	}
 }
-async function readLinuxStoredCredential() {
-	if (process.platform !== "linux") return;
+async function readMacOSStoredCredential() {
+	if (process.platform !== "darwin") return;
 	try {
-		const { stdout } = await execFile$1("secret-tool", [
-			"lookup",
-			"service",
+		const { stdout } = await execFile$1("security", [
+			"find-generic-password",
+			"-s",
 			SERVICE_NAME,
-			"account",
-			ACCOUNT_NAME
+			"-a",
+			ACCOUNT_NAME,
+			"-w"
 		]);
-		return parseStoredCredential(stdout, "linux-secret-tool", "Secret Service (secret-tool)");
+		return parseStoredCredential(stdout, "macos-keychain", "macOS Keychain");
 	} catch {
 		return;
 	}
 }
-async function writeLinuxSecretTool(apiKey) {
-	const stored = await writeLinuxStoredCredential({
+async function writeMacOSKeychain(apiKey) {
+	const stored = await writeMacOSStoredCredential({
 		type: "api_key",
 		token: apiKey
 	});
@@ -726,394 +1353,148 @@ async function writeLinuxSecretTool(apiKey) {
 		location: stored.location
 	} : void 0;
 }
-async function writeLinuxStoredCredential(credential) {
-	if (process.platform !== "linux") return;
+async function writeMacOSStoredCredential(credential) {
+	if (process.platform !== "darwin") return;
 	const payload = {
 		version: 1,
 		credential
 	};
 	try {
-		execFileSync("secret-tool", [
-			"store",
-			"--label",
-			"statelyai API key",
-			"service",
-			SERVICE_NAME,
-			"account",
-			ACCOUNT_NAME
-		], { input: JSON.stringify(payload) });
-		return {
-			...credential ? { credential } : {},
-			backend: "linux-secret-tool",
-			location: "Secret Service (secret-tool)"
-		};
-	} catch {
-		return;
-	}
-}
-async function deleteLinuxSecretTool() {
-	if (process.platform !== "linux") return false;
-	try {
-		await execFile$1("secret-tool", [
-			"clear",
-			"service",
+		await execFile$1("security", [
+			"add-generic-password",
+			"-U",
+			"-s",
 			SERVICE_NAME,
-			"account",
-			ACCOUNT_NAME
-		]);
-		return true;
-	} catch {
-		return false;
-	}
-}
-async function getStoredCredential() {
-	if (shouldUseFileBackendOnly()) return readFileStoredCredential();
-	return await readMacOSStoredCredential() ?? await readLinuxStoredCredential() ?? await readFileStoredCredential();
-}
-async function setStoredApiKey(apiKey) {
-	if (shouldUseFileBackendOnly()) return writeFileCredentials(apiKey);
-	return await writeMacOSKeychain(apiKey) ?? await writeLinuxSecretTool(apiKey) ?? await writeFileCredentials(apiKey);
-}
-async function setStoredCredential(credential) {
-	if (shouldUseFileBackendOnly()) return writeFileStoredCredential(credential);
-	return await writeMacOSStoredCredential(credential) ?? await writeLinuxStoredCredential(credential) ?? await writeFileStoredCredential(credential);
-}
-async function deleteStoredApiKey() {
-	if (shouldUseFileBackendOnly()) {
-		const deleted = await deleteFileCredentials();
-		return {
-			deleted,
-			locations: deleted ? [getCredentialsFilePath()] : []
-		};
-	}
-	const locations = [];
-	if (await deleteMacOSKeychain()) locations.push("macOS Keychain");
-	if (await deleteLinuxSecretTool()) locations.push("Secret Service (secret-tool)");
-	if (await deleteFileCredentials()) locations.push(getCredentialsFilePath());
-	return {
-		deleted: locations.length > 0,
-		locations
-	};
-}
-function describeCredentialBackend(backend, location) {
-	switch (backend) {
-		case "macos-keychain": return location;
-		case "linux-secret-tool": return location;
-		case "file": return `file (${location})`;
-	}
-}
-
-//#endregion
-//#region src/projectConfig.ts
-const STATELY_CONFIG_FILE = "statelyai.json";
-const STATELY_CONFIG_SCHEMA_URL = "https://stately.ai/schemas/statelyai.json";
-const STATELY_CONFIG_VERSION = "1.0.0";
-/**
-* Base URL of the deployment that hosts the owned resource contract
-* (`/api/v1/*`). Matches the SDK default.
-*/
-const DEFAULT_STATELY_API_BASE_URL = "https://editor.stately.ai";
-/**
-* Hosts of the legacy hosted Studio. `statelyai.json#studioUrl` values that
-* point at them predate the editor-hosted API and must be redirected.
-*/
-const HOSTED_STUDIO_HOSTNAMES = new Set(["stately.ai", "www.stately.ai"]);
-/**
-* Maps a configured `statelyai.json#studioUrl` (or a `--base-url` flag) to the
-* base URL of the editor API that serves our owned contract.
-*
-* Hosted legacy values (`https://stately.ai`, `http://www.stately.ai/`, ...)
-* resolve to {@link DEFAULT_STATELY_API_BASE_URL}. Anything else is used as-is
-* (minus trailing slashes): self-hosted editor deployments already point at the
-* server that hosts `/api/v1`.
-*
-* This is a read-only compatibility shim: the CLI never rewrites
-* `statelyai.json` because of it.
-*/
-function resolveApiBaseUrl(studioUrl) {
-	const trimmed = studioUrl?.trim();
-	if (!trimmed) return DEFAULT_STATELY_API_BASE_URL;
-	const parsed = tryParseUrl(trimmed) ?? tryParseUrl(`https://${trimmed}`);
-	if (parsed && HOSTED_STUDIO_HOSTNAMES.has(parsed.hostname.toLowerCase())) return DEFAULT_STATELY_API_BASE_URL;
-	return trimmed.replace(/\/+$/, "");
-}
-function tryParseUrl(value) {
-	try {
-		return new URL(value);
-	} catch {
-		return;
-	}
-}
-const DEFAULT_SOURCE_EXCLUDES = ["**/*.test.*", "**/*.spec.*"];
-const CODE_SOURCE_EXTENSIONS = new Set([
-	".ts",
-	".tsx",
-	".js",
-	".jsx",
-	".mts",
-	".cts",
-	".mjs",
-	".cjs"
-]);
-const execFileAsync$1 = promisify(execFile);
-const ALWAYS_IGNORED_DIRECTORIES = new Set([
-	".git",
-	"node_modules",
-	"dist",
-	"build",
-	"out",
-	"coverage",
-	".next"
-]);
-function createStatelyProjectConfig(options) {
-	const defaultXStateVersion = options.defaultXStateVersion ?? 5;
-	return {
-		$schema: STATELY_CONFIG_SCHEMA_URL,
-		version: STATELY_CONFIG_VERSION,
-		projectId: options.projectId ?? "",
-		studioUrl: options.studioUrl ?? "https://stately.ai",
-		defaultXStateVersion,
-		include: [],
-		exclude: [...DEFAULT_SOURCE_EXCLUDES]
-	};
-}
-async function writeStatelyProjectConfig(configPath, config) {
-	const serialized = { ...config };
-	if (!config.projectId) {
-		delete serialized.projectId;
-		delete serialized.studioUrl;
-	}
-	await fsPromises.writeFile(configPath, `${JSON.stringify(serialized, null, 2)}\n`, "utf8");
-}
-function normalizeProjectConfig(config) {
-	const firstSource = config.sources?.[0];
-	return {
-		$schema: config.$schema ?? STATELY_CONFIG_SCHEMA_URL,
-		version: config.version ?? STATELY_CONFIG_VERSION,
-		projectId: config.projectId ?? "",
-		studioUrl: config.studioUrl ?? "https://stately.ai",
-		defaultXStateVersion: Math.max(5, config.defaultXStateVersion ?? 5),
-		...config.sourceUpdateStrategy === "preserve" || config.sourceUpdateStrategy === "rewrite" ? { sourceUpdateStrategy: config.sourceUpdateStrategy } : {},
-		include: [...config.include ?? firstSource?.include ?? []],
-		exclude: config.exclude == null ? [...firstSource?.exclude ?? DEFAULT_SOURCE_EXCLUDES] : [...config.exclude],
-		...config.newMachinesDir ? { newMachinesDir: config.newMachinesDir } : {}
-	};
-}
-function getConfigRewriteStatus(config) {
-	if (!config.sources) return { needsRewrite: false };
-	if (config.sources.length > 1) return {
-		needsRewrite: true,
-		reason: "multiple-legacy-sources"
-	};
-	return {
-		needsRewrite: true,
-		reason: "legacy-sources"
-	};
-}
-async function readStatelyProjectConfig(options = {}) {
-	const rootDir = path.resolve(options.cwd ?? process.cwd());
-	const configPath = path.resolve(rootDir, options.configPath ?? STATELY_CONFIG_FILE);
-	const raw = await fsPromises.readFile(configPath, "utf8");
-	const parsed = JSON.parse(raw);
-	const config = normalizeProjectConfig(parsed);
-	const rewriteStatus = getConfigRewriteStatus(parsed);
-	if (options.rewriteIfNeeded && rewriteStatus.reason === "legacy-sources") {
-		await writeStatelyProjectConfig(configPath, config);
-		return {
-			config,
-			configPath,
-			rootDir,
-			rewriteStatus: {
-				needsRewrite: false,
-				rewritten: true
-			}
-		};
-	}
-	return {
-		config,
-		configPath,
-		rootDir,
-		rewriteStatus
-	};
-}
-async function walkFiles(rootDir, currentDir = rootDir) {
-	const entries = await fsPromises.readdir(currentDir, { withFileTypes: true });
-	const files = [];
-	for (const entry of entries) {
-		if (ALWAYS_IGNORED_DIRECTORIES.has(entry.name)) continue;
-		const absolutePath = path.join(currentDir, entry.name);
-		if (entry.isDirectory()) {
-			files.push(...await walkFiles(rootDir, absolutePath));
-			continue;
-		}
-		if (!entry.isFile()) continue;
-		files.push(path.relative(rootDir, absolutePath).replace(/\\/g, "/"));
+			"-a",
+			ACCOUNT_NAME,
+			"-w",
+			JSON.stringify(payload)
+		]);
+		return {
+			...credential ? { credential } : {},
+			backend: "macos-keychain",
+			location: "macOS Keychain"
+		};
+	} catch {
+		return;
 	}
-	return files;
 }
-async function filterGitIgnoredPaths(rootDir, relativeFiles) {
-	if (relativeFiles.length === 0) return relativeFiles;
+async function deleteMacOSKeychain() {
+	if (process.platform !== "darwin") return false;
 	try {
-		const { stdout } = await execFileAsync$1("git", ["check-ignore", ...relativeFiles], { cwd: rootDir });
-		const ignoredEntries = stdout.split(/\r?\n/).map((entry) => entry.trim()).filter(Boolean);
-		if (ignoredEntries.length === 0) return relativeFiles;
-		const ignoredPaths = new Set(ignoredEntries);
-		return relativeFiles.filter((relativePath) => {
-			return !ignoredPaths.has(relativePath);
-		});
+		await execFile$1("security", [
+			"delete-generic-password",
+			"-s",
+			SERVICE_NAME,
+			"-a",
+			ACCOUNT_NAME
+		]);
+		return true;
 	} catch {
-		return relativeFiles;
+		return false;
 	}
 }
-function isCodeSourceFile(relativePath) {
-	return CODE_SOURCE_EXTENSIONS.has(path.extname(relativePath).toLowerCase());
-}
-function expandBraces(pattern) {
-	const match = pattern.match(/\{([^{}]+)\}/);
-	if (!match || match.index == null) return [pattern];
-	const [token, inner] = match;
-	return inner.split(",").flatMap((variant) => expandBraces(`${pattern.slice(0, match.index)}${variant}${pattern.slice(match.index + token.length)}`));
-}
-function globToRegExp(pattern) {
-	let regex = "^";
-	for (let index = 0; index < pattern.length; index += 1) {
-		const char = pattern[index];
-		const next = pattern[index + 1];
-		if (char === "*") {
-			if (next === "*") {
-				const slashAfterGlobstar = pattern[index + 2] === "/";
-				regex += slashAfterGlobstar ? "(?:.*/)?" : ".*";
-				index += slashAfterGlobstar ? 2 : 1;
-				continue;
-			}
-			regex += "[^/]*";
-			continue;
-		}
-		if (char === "?") {
-			regex += "[^/]";
-			continue;
-		}
-		if ("\\.[]{}()+-^$|".includes(char)) {
-			regex += `\\${char}`;
-			continue;
-		}
-		regex += char;
+async function readLinuxStoredCredential() {
+	if (process.platform !== "linux") return;
+	try {
+		const { stdout } = await execFile$1("secret-tool", [
+			"lookup",
+			"service",
+			SERVICE_NAME,
+			"account",
+			ACCOUNT_NAME
+		]);
+		return parseStoredCredential(stdout, "linux-secret-tool", "Secret Service (secret-tool)");
+	} catch {
+		return;
 	}
-	regex += "$";
-	return new RegExp(regex);
-}
-function matchesGlob(relativePath, pattern) {
-	return expandBraces(pattern).some((expanded) => globToRegExp(expanded).test(relativePath));
-}
-function matchesAny(patterns, relativePath) {
-	return (patterns ?? []).some((pattern) => matchesGlob(relativePath, pattern));
 }
-function isTrackedByStatelyProjectConfig(config, relativePath) {
-	return matchesAny(config.include, relativePath) && !matchesAny(config.exclude ?? DEFAULT_SOURCE_EXCLUDES, relativePath);
-}
-async function discoverCodeSourceFiles(options = {}) {
-	const rootDir = path.resolve(options.cwd ?? process.cwd());
-	return (await filterGitIgnoredPaths(rootDir, await walkFiles(rootDir))).filter((relativePath) => isCodeSourceFile(relativePath)).filter((relativePath) => !matchesAny(DEFAULT_SOURCE_EXCLUDES, relativePath)).sort((left, right) => left.localeCompare(right));
+async function writeLinuxSecretTool(apiKey) {
+	const stored = await writeLinuxStoredCredential({
+		type: "api_key",
+		token: apiKey
+	});
+	return stored ? {
+		apiKey,
+		backend: stored.backend,
+		location: stored.location
+	} : void 0;
 }
-function createSuggestedConfig(include) {
-	return {
-		include: [include],
-		exclude: [...DEFAULT_SOURCE_EXCLUDES]
+async function writeLinuxStoredCredential(credential) {
+	if (process.platform !== "linux") return;
+	const payload = {
+		version: 1,
+		credential
 	};
+	try {
+		execFileSync("secret-tool", [
+			"store",
+			"--label",
+			"statelyai API key",
+			"service",
+			SERVICE_NAME,
+			"account",
+			ACCOUNT_NAME
+		], { input: JSON.stringify(payload) });
+		return {
+			...credential ? { credential } : {},
+			backend: "linux-secret-tool",
+			location: "Secret Service (secret-tool)"
+		};
+	} catch {
+		return;
+	}
 }
-function toExtensionToken(extname) {
-	return extname.startsWith(".") ? extname.slice(1) : extname;
-}
-function formatExtensionPattern(extnames) {
-	const unique = [...new Set(extnames.map(toExtensionToken))].sort();
-	if (unique.length === 1) return `.${unique[0]}`;
-	return `.{${unique.join(",")}}`;
+async function deleteLinuxSecretTool() {
+	if (process.platform !== "linux") return false;
+	try {
+		await execFile$1("secret-tool", [
+			"clear",
+			"service",
+			SERVICE_NAME,
+			"account",
+			ACCOUNT_NAME
+		]);
+		return true;
+	} catch {
+		return false;
+	}
 }
-function getSuggestionRoot(relativePath) {
-	if (relativePath.startsWith("src/")) return "src/";
-	const packageMatch = relativePath.match(/^packages\/([^/]+)\/src\//);
-	if (packageMatch) return `packages/${packageMatch[1]}/src/`;
-	const appMatch = relativePath.match(/^apps\/([^/]+)\/src\//);
-	if (appMatch) return `apps/${appMatch[1]}/src/`;
-	return null;
+async function getStoredCredential() {
+	if (shouldUseFileBackendOnly()) return readFileStoredCredential();
+	return await readMacOSStoredCredential() ?? await readLinuxStoredCredential() ?? await readFileStoredCredential();
 }
-function getCommonDirectory(relativePaths) {
-	const [firstDirectory, ...remainingDirectories] = relativePaths.map((relativePath) => path.posix.dirname(relativePath).split("/"));
-	if (!firstDirectory) return;
-	const commonSegments = [];
-	for (const [index, segment] of firstDirectory.entries()) {
-		if (!remainingDirectories.every((directory) => directory[index] === segment)) break;
-		commonSegments.push(segment);
-	}
-	return commonSegments.length > 0 ? commonSegments.join("/") : void 0;
+async function setStoredApiKey(apiKey) {
+	if (shouldUseFileBackendOnly()) return writeFileCredentials(apiKey);
+	return await writeMacOSKeychain(apiKey) ?? await writeLinuxSecretTool(apiKey) ?? await writeFileCredentials(apiKey);
 }
-function suggestGroupedInclude(relativePaths, root) {
-	const extPattern = formatExtensionPattern(relativePaths.map((relativePath) => path.posix.extname(relativePath)));
-	if (relativePaths.map((relativePath) => path.posix.basename(relativePath, path.posix.extname(relativePath))).every((basename) => basename.toLowerCase().endsWith("machine"))) return `${root}**/*machine${extPattern}`;
-	const commonDirectory = getCommonDirectory(relativePaths);
-	if (commonDirectory) return `${commonDirectory}/${relativePaths.every((relativePath) => path.posix.dirname(relativePath) === commonDirectory) ? "*" : "**/*"}${extPattern}`;
-	return `${root}**/*${extPattern}`;
+async function setStoredCredential(credential) {
+	if (shouldUseFileBackendOnly()) return writeFileStoredCredential(credential);
+	return await writeMacOSStoredCredential(credential) ?? await writeLinuxStoredCredential(credential) ?? await writeFileStoredCredential(credential);
 }
-function suggestStatelySourceConfigs(relativePaths) {
-	const pending = new Set(relativePaths.map((relativePath) => relativePath.replace(/\\/g, "/")).filter(Boolean));
-	const suggestions = [];
-	const addSuggestion = (include, predicate) => {
-		const matched = [...pending].filter(predicate);
-		if (matched.length === 0) return;
-		suggestions.push(createSuggestedConfig(include));
-		for (const matchedPath of matched) pending.delete(matchedPath);
-	};
-	const groupedRoots = /* @__PURE__ */ new Map();
-	for (const relativePath of pending) {
-		const root = getSuggestionRoot(relativePath);
-		if (!root) continue;
-		const bucket = groupedRoots.get(root) ?? [];
-		bucket.push(relativePath);
-		groupedRoots.set(root, bucket);
-	}
-	for (const [root, groupedPaths] of [...groupedRoots.entries()].sort((left, right) => left[0].localeCompare(right[0]))) addSuggestion(suggestGroupedInclude(groupedPaths, root), (relativePath) => groupedPaths.includes(relativePath));
-	const byDirectory = /* @__PURE__ */ new Map();
-	for (const relativePath of pending) {
-		const directory = path.posix.dirname(relativePath);
-		const key = directory === "." ? relativePath : directory;
-		const bucket = byDirectory.get(key) ?? [];
-		bucket.push(relativePath);
-		byDirectory.set(key, bucket);
-	}
-	for (const [key, matchedPaths] of [...byDirectory.entries()].sort((left, right) => left[0].localeCompare(right[0]))) {
-		if (matchedPaths.length > 1 && key !== "." && key !== matchedPaths[0]) {
-			addSuggestion(`${key}/**/*.{ts,tsx,js,jsx,mts,cts,mjs,cjs}`, (relativePath) => relativePath.startsWith(`${key}/`));
-			continue;
-		}
-		const exactPath = matchedPaths[0];
-		addSuggestion(exactPath, (relativePath) => relativePath === exactPath);
+async function deleteStoredApiKey() {
+	if (shouldUseFileBackendOnly()) {
+		const deleted = await deleteFileCredentials();
+		return {
+			deleted,
+			locations: deleted ? [getCredentialsFilePath()] : []
+		};
 	}
-	return suggestions;
-}
-async function discoverStatelySourceFiles(options = {}) {
-	const { config, rootDir } = options.config ? {
-		config: options.config,
-		rootDir: path.resolve(options.cwd ?? process.cwd())
-	} : await readStatelyProjectConfig(options);
-	const relativeFiles = await filterGitIgnoredPaths(rootDir, await walkFiles(rootDir));
-	const discovered = /* @__PURE__ */ new Map();
-	const source = {
-		include: config.include,
-		exclude: config.exclude ?? DEFAULT_SOURCE_EXCLUDES,
-		format: "xstate",
-		xstateVersion: config.defaultXStateVersion
+	const locations = [];
+	if (await deleteMacOSKeychain()) locations.push("macOS Keychain");
+	if (await deleteLinuxSecretTool()) locations.push("Secret Service (secret-tool)");
+	if (await deleteFileCredentials()) locations.push(getCredentialsFilePath());
+	return {
+		deleted: locations.length > 0,
+		locations
 	};
-	for (const relativePath of relativeFiles) {
-		if (!matchesAny(source.include, relativePath)) continue;
-		if (matchesAny(source.exclude, relativePath)) continue;
-		const filePath = path.join(rootDir, relativePath);
-		if (!discovered.has(filePath)) discovered.set(filePath, {
-			filePath,
-			relativePath,
-			source
-		});
+}
+function describeCredentialBackend(backend, location) {
+	switch (backend) {
+		case "macos-keychain": return location;
+		case "linux-secret-tool": return location;
+		case "file": return `file (${location})`;
 	}
-	return [...discovered.values()].sort((left, right) => left.relativePath.localeCompare(right.relativePath));
 }
 
 //#endregion
@@ -2654,6 +3035,7 @@ var WhoamiCommand = class extends Command {
 	}
 };
 const COMMANDS = {
+	verify: VerifyCommand,
 	plan: PlanCommand,
 	diff: DiffCommand,
 	pull: PullCommand,
@@ -2688,4 +3070,4 @@ function isDirectExecution() {
 if (isDirectExecution()) run$1();
 
 //#endregion
-export { scanProjectMachines as C, run$1 as S, createStatelyProjectConfig as T, isFileGitDirty as _, discoverMachinesInSource as a, resolveCredentialStatus as b, formatDiscoveredMachines as c, formatProjectStatus as d, formatStoredCredentialSource as f, initProject as g, inferInitProjectName as h, discoverLinkedPullTargets as i, formatMissingNewMachineDirMessage as l, getEnvCredential as m, buildOAuthLoginStart as n, discoverOAuthLogin as o, getEnvApiKey as p, classifyPushCandidates as r, discoverRemoteProjectMachineTargets as s, COMMANDS as t, formatPlanSummary as u, resolveApiKey as v, scanProjectSources as w, resolveProjectStatus as x, resolveConfiguredPullTargets as y };
+export { scanProjectMachines as C, formatVerificationJUnit as D, verifyProject as E, createStatelyProjectConfig as O, run$1 as S, resolveVerificationRequest as T, isFileGitDirty as _, discoverMachinesInSource as a, resolveCredentialStatus as b, formatDiscoveredMachines as c, formatProjectStatus as d, formatStoredCredentialSource as f, initProject as g, inferInitProjectName as h, discoverLinkedPullTargets as i, formatMissingNewMachineDirMessage as l, getEnvCredential as m, buildOAuthLoginStart as n, discoverOAuthLogin as o, getEnvApiKey as p, classifyPushCandidates as r, discoverRemoteProjectMachineTargets as s, COMMANDS as t, formatPlanSummary as u, resolveApiKey as v, scanProjectSources as w, resolveProjectStatus as x, resolveConfiguredPullTargets as y };